@deftai/directive-core 0.74.0 → 0.76.0

package/dist/triage/cache-path.js

@@ -6,6 +6,7 @@
  */
 import { existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
+import { assertProjectionContained } from "../fs/projection-containment.js";
 import { MIGRATED_ARTIFACT_DIR, resolveEvalDir, resolveLifecycleLayout, resolveLifecycleRoot, } from "../layout/resolve.js";
 import { generateTriageCacheReadmeBody } from "./bootstrap/gitignore.js";
 /** Directory name for the triage working-set cache (not version-eval results). */
@@ -24,8 +25,8 @@ export const TRIAGE_CACHE_FILE_NAMES = [
 ];
 /** Known triage-cache directory names migrated off the legacy `.eval/` tree. */
 export const TRIAGE_CACHE_DIR_NAMES = ["decompositions"];
-/** Absolute path to the layout-aware `.triage-cache/` directory. */
-export function resolveTriageCacheDir(projectRoot) {
+/** Compute the layout-aware `.triage-cache/` directory without containment checks. */
+function triageCacheDirPath(projectRoot) {
     let layoutRoot;
     try {
         layoutRoot = resolveLifecycleRoot(projectRoot);
@@ -35,6 +36,17 @@ export function resolveTriageCacheDir(projectRoot) {
     }
     return join(layoutRoot, TRIAGE_CACHE_DIR_NAME);
 }
+/** Refuse symlink-escaping xbrief/.triage-cache before mkdir/read/write (#2446). */
+function assertWritableTriageCachePath(projectRoot, ...segments) {
+    const base = triageCacheDirPath(projectRoot);
+    const target = segments.length > 0 ? join(base, ...segments) : base;
+    assertProjectionContained(projectRoot, target);
+}
+/** Absolute path to the layout-aware `.triage-cache/` directory. */
+export function resolveTriageCacheDir(projectRoot) {
+    assertWritableTriageCachePath(projectRoot);
+    return triageCacheDirPath(projectRoot);
+}
 /** POSIX-style path relative to project root (e.g. `xbrief/.triage-cache/foo`). */
 export function triageCacheRelPath(projectRoot, ...segments) {
     let artifactDir;
@@ -118,8 +130,9 @@ export function migrateLegacyTriageCacheFromEval(projectRoot) {
 }
 /** Resolve a path under `.triage-cache/`, migrating legacy `.eval/` files first. */
 export function resolveTriageCachePath(projectRoot, ...segments) {
+    assertWritableTriageCachePath(projectRoot, ...segments);
     migrateLegacyTriageCacheFromEval(projectRoot);
-    return join(resolveTriageCacheDir(projectRoot), ...segments);
+    return join(triageCacheDirPath(projectRoot), ...segments);
 }
 /** Display helper: project-root-relative POSIX path for logs and gitignore copy. */
 export function triageCacheDisplayPath(projectRoot, absPath) {

package/dist/triage/queue/cache.d.ts

@@ -1,4 +1,18 @@
 import type { CachedIssue } from "./types.js";
+/** Neutral title shown when the scanner fences injection-shaped title text. */
+export declare const QUARANTINED_TITLE_PLACEHOLDER = "[quarantined title]";
+/**
+ * Read `meta.json` `scan_result.passed` for a cache entry.
+ * Returns `false` when the scanner hard-failed, `true` when it passed, and
+ * `null` when meta is missing/unreadable (legacy or incomplete entries).
+ */
+export declare function readCacheScanPassed(entryDir: string): boolean | null;
+/**
+ * Sanitize a queue title through the cache scanner.
+ * Returns `null` when the title hard-fails (omit the issue); otherwise a
+ * display title that never carries unfenced injection-shaped attacker text.
+ */
+export declare function sanitizeQueueTitle(rawTitle: string): string | null;
 /** Read slices.jsonl records. */
 export declare function resolveSlicesLogPath(options?: {
     readonly slicesLogPath?: string | null;

package/dist/triage/queue/cache.js

@@ -1,10 +1,58 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { scan } from "../../cache/scanner.js";
 import { resolveTriageCachePath } from "../cache-path.js";
 import { extractAuthor, extractMilestone } from "../scope-drift/cache-walker.js";
 import { CACHE_DIR_NAME, CACHE_SOURCE_GITHUB_ISSUE } from "./constants.js";
 import { hasActiveScopeIgnores, isRawIssueScopeIgnored, resolveScopeIgnores, } from "./scope-ignores-filter.js";
 import { blockedByIssueNumber, rankByIssueNumber } from "./scope-walk.js";
+/** Neutral title shown when the scanner fences injection-shaped title text. */
+export const QUARANTINED_TITLE_PLACEHOLDER = "[quarantined title]";
+/**
+ * Read `meta.json` `scan_result.passed` for a cache entry.
+ * Returns `false` when the scanner hard-failed, `true` when it passed, and
+ * `null` when meta is missing/unreadable (legacy or incomplete entries).
+ */
+export function readCacheScanPassed(entryDir) {
+    const metaPath = join(entryDir, "meta.json");
+    if (!existsSync(metaPath)) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(readFileSync(metaPath, { encoding: "utf8" }));
+        if (typeof parsed !== "object" || parsed === null) {
+            return null;
+        }
+        const scanResult = parsed.scan_result;
+        if (typeof scanResult !== "object" || scanResult === null) {
+            return null;
+        }
+        const passed = scanResult.passed;
+        return typeof passed === "boolean" ? passed : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Sanitize a queue title through the cache scanner.
+ * Returns `null` when the title hard-fails (omit the issue); otherwise a
+ * display title that never carries unfenced injection-shaped attacker text.
+ */
+export function sanitizeQueueTitle(rawTitle) {
+    const result = scan(rawTitle);
+    if (!result.passed) {
+        return null;
+    }
+    if (result.flags.some((flag) => flag.category === "injection-heading")) {
+        return QUARANTINED_TITLE_PLACEHOLDER;
+    }
+    if (result.flags.some((flag) => flag.category === "invisible-unicode")) {
+        const stripped = result.transformed_content.replace(/\r?\n+$/u, "");
+        return stripped.length > 0 ? stripped : QUARANTINED_TITLE_PLACEHOLDER;
+    }
+    return rawTitle;
+}
 function cachedState(issue) {
     if (issue === undefined) {
         return "";
@@ -158,9 +206,21 @@ export function loadCachedIssues(repo, options) {
         if (filterScopeIgnores && isRawIssueScopeIgnored(payload, scopeIgnores)) {
             continue;
         }
+        // Fail closed on scanner hard-fail: cachePut keeps raw.json but suppresses
+        // content.md when scan_result.passed is false. The queue must not promote
+        // those titles into the mandatory triage:queue agent context.
+        const scanPassed = readCacheScanPassed(entryDir);
+        if (scanPassed === false) {
+            continue;
+        }
+        const rawTitle = typeof payload.title === "string" ? payload.title : "";
+        const safeTitle = sanitizeQueueTitle(rawTitle);
+        if (safeTitle === null) {
+            continue;
+        }
         issues.push({
             number: n,
-            title: typeof payload.title === "string" ? payload.title : "",
+            title: safeTitle,
             state,
             labels: parseLabels(payload.labels),
             author: extractAuthor(payload),

package/dist/triage/welcome/writers.js

@@ -1,5 +1,6 @@
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { assertProjectionContained } from "../../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleFolder, resolveProjectDefinitionPath, } from "../../layout/resolve.js";
 import { migrateLegacyPolicyKey, PLAN_POLICY_KEY } from "../../policy/plan-extensions.js";
 import { projectDefinitionMutationLock } from "../../vbrief-build/project-definition-io.js";
@@ -12,6 +13,7 @@ function utcIso() {
 }
 export function appendAuditEntry(projectRoot, entry) {
     const logPath = join(resolve(projectRoot), AUDIT_LOG_REL_PATH);
+    assertProjectionContained(projectRoot, logPath);
     mkdirSync(dirname(logPath), { recursive: true });
     const line = `${utcIso()} ${entry}\n`;
     if (!existsSync(logPath)) {

package/dist/ts-check-lane/index.d.ts

@@ -1,3 +1,3 @@
 export type { LaneRunner, ResolvePnpmOptions, RunnerResult, RunTsLaneOptions } from "./run-lane.js";
-export { LANE_COMMANDS, resolvePnpm, runTsLane, SKIP_NOTICE } from "./run-lane.js";
+export { LANE_COMMANDS, resolvePnpm, runTsLane, SKIP_NOTICE, sanitizeTsLaneEnv, } from "./run-lane.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/ts-check-lane/index.js

@@ -1,2 +1,2 @@
-export { LANE_COMMANDS, resolvePnpm, runTsLane, SKIP_NOTICE } from "./run-lane.js";
+export { LANE_COMMANDS, resolvePnpm, runTsLane, SKIP_NOTICE, sanitizeTsLaneEnv, } from "./run-lane.js";
 //# sourceMappingURL=index.js.map

package/dist/ts-check-lane/run-lane.d.ts

@@ -29,6 +29,11 @@ export interface RunnerResult {
     readonly error?: Error;
 }
 export type LaneRunner = (argv: readonly string[], cwd: string) => RunnerResult;
+/**
+ * Strip release preflight bypass vars before spawning pnpm/vitest so nested unit
+ * tests observe fail-closed branch and cache gates (#2434 / #1553 recurrence).
+ */
+export declare function sanitizeTsLaneEnv(base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export interface RunTsLaneOptions {
     /** Resolved pnpm executable path, or null when not installed. */
     readonly pnpm: string | null;

package/dist/ts-check-lane/run-lane.js

@@ -19,6 +19,9 @@
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { posix, win32 } from "node:path";
+import { BRANCH_GATE_BYPASS_ENV, RELEASE_PREFLIGHT_ENV } from "../release/constants.js";
+/** Release Step-5 vars that must not leak into vitest via inherited pnpm env (#2434). */
+const TS_LANE_POISON_ENV_KEYS = [BRANCH_GATE_BYPASS_ENV, RELEASE_PREFLIGHT_ENV];
 /**
  * Run order is deliberate: lint (cheapest, catches the biome class first),
  * then build, then the test suite.
@@ -31,6 +34,17 @@ export const LANE_COMMANDS = [
 export const SKIP_NOTICE = "[ts:check-lane] pnpm not found on PATH -- skipping the TypeScript lane " +
     "(build/lint/test). The TS engine stays validated by the dedicated CI job. " +
     "Install the Node toolchain (pnpm) to run the TS lane locally.";
+/**
+ * Strip release preflight bypass vars before spawning pnpm/vitest so nested unit
+ * tests observe fail-closed branch and cache gates (#2434 / #1553 recurrence).
+ */
+export function sanitizeTsLaneEnv(base = process.env) {
+    const env = { ...base };
+    for (const key of TS_LANE_POISON_ENV_KEYS) {
+        delete env[key];
+    }
+    return env;
+}
 /** Windows command shims (.cmd/.bat) need a shell; native executables do not. */
 export function shouldUseShellForCommand(command, platform = process.platform) {
     return platform === "win32" && /\.(?:cmd|bat)$/i.test(command);
@@ -41,6 +55,7 @@ function defaultRunner(argv, cwd) {
     const commandPath = command ?? "";
     const result = spawnSync(commandPath, rest, {
         cwd,
+        env: sanitizeTsLaneEnv(process.env),
         stdio: "inherit",
         shell: shouldUseShellForCommand(commandPath),
     });

package/dist/validate-content/validate-links.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { join, relative, resolve, sep } from "node:path";
 import { extractLinkTargets, shouldSkipLinkTarget } from "./link-parser.js";
 const EXCLUDE_DIRS = new Set([
     ".git",
@@ -55,7 +55,7 @@ function findBrokenLinks(cwd) {
         catch {
             continue;
         }
-        const rel = md.startsWith(`${root}/`) ? md.slice(root.length + 1) : md;
+        const rel = md.startsWith(root + sep) ? relative(root, md) : md;
         const lines = text.split("\n");
         for (let i = 0; i < lines.length; i += 1) {
             const line = lines[i] ?? "";

package/dist/value/readback.d.ts

@@ -71,6 +71,7 @@ export declare function runValueShow(options: {
     format?: "text" | "json";
     logPath?: string | null;
     policyOverride?: ValueFeedbackResolved;
+    now?: Date;
 }): ValueShowResult;
 export interface ValueShowCliArgs {
     window?: string;

package/dist/value/readback.js

@@ -415,7 +415,11 @@ export function runValueShow(options) {
         };
     }
     const windowMs = parseWindowMs(options.window);
-    const trend = computeValueShowTrend(root, { windowMs, logPath: options.logPath });
+    const trend = computeValueShowTrend(root, {
+        windowMs,
+        logPath: options.logPath,
+        now: options.now,
+    });
     const empty = trend.total === 0;
     if (options.format === "json") {
         return {

package/dist/vbrief-build/constants.d.ts

@@ -1,8 +1,8 @@
-/** Canonical ``vBRIEFInfo.version`` emitted on scope vBRIEFs (#533). */
-export declare const EMITTED_VBRIEF_VERSION = "0.6";
+/** Canonical envelope version emitted on new scope xBRIEFs (#533, #2318). */
+export declare const EMITTED_VBRIEF_VERSION: "0.8";
 /** Migrator provenance namespace under ``plan.metadata`` (#616). */
 export declare const MIGRATOR_METADATA_KEY = "x-migrator";
-export declare const PROJECT_DEFINITION_REL_PATH = "vbrief/PROJECT-DEFINITION.vbrief.json";
+/** Layout-aware PROJECT-DEFINITION paths live in ``project-definition-io.ts`` / ``policy/resolve.ts`` (#2302). */
 export declare const DEPRECATION_SENTINEL = "<!-- deft:deprecated-redirect -->";
 export declare const INTERNAL_REFERENCE_TYPES: Set<string>;
 export declare const EXTERNAL_REFERENCE_TYPES: Set<string>;

package/dist/vbrief-build/constants.js

@@ -1,8 +1,9 @@
-/** Canonical ``vBRIEFInfo.version`` emitted on scope vBRIEFs (#533). */
-export const EMITTED_VBRIEF_VERSION = "0.6";
+import { VBRIEF_VERSION } from "@deftai/directive-types";
+/** Canonical envelope version emitted on new scope xBRIEFs (#533, #2318). */
+export const EMITTED_VBRIEF_VERSION = VBRIEF_VERSION;
 /** Migrator provenance namespace under ``plan.metadata`` (#616). */
 export const MIGRATOR_METADATA_KEY = "x-migrator";
-export const PROJECT_DEFINITION_REL_PATH = "vbrief/PROJECT-DEFINITION.vbrief.json";
+/** Layout-aware PROJECT-DEFINITION paths live in ``project-definition-io.ts`` / ``policy/resolve.ts`` (#2302). */
 export const DEPRECATION_SENTINEL = "<!-- deft:deprecated-redirect -->";
 export const INTERNAL_REFERENCE_TYPES = new Set([
     "x-vbrief/plan",

package/dist/vbrief-build/index.d.ts

@@ -1,5 +1,5 @@
 export { createScopeVbrief, referenceHasRequiredFields, referenceWithDefaultTrust, setTodayForTests, slugify, TODAY, } from "./build.js";
-export { DEFAULT_STATUS_FOR_FOLDER, DEPRECATION_SENTINEL, EMITTED_VBRIEF_VERSION, EXTERNAL_REFERENCE_TYPES, FOLDER_TO_STATUSES, INTERNAL_REFERENCE_TYPES, LIFECYCLE_FOLDERS, MIGRATOR_METADATA_KEY, PROJECT_DEFINITION_REL_PATH, STATUS_TO_FOLDER, } from "./constants.js";
+export { DEFAULT_STATUS_FOR_FOLDER, DEPRECATION_SENTINEL, EMITTED_VBRIEF_VERSION, EXTERNAL_REFERENCE_TYPES, FOLDER_TO_STATUSES, INTERNAL_REFERENCE_TYPES, LIFECYCLE_FOLDERS, MIGRATOR_METADATA_KEY, STATUS_TO_FOLDER, } from "./constants.js";
 export { pythonJsonPretty } from "./json.js";
 export { cmdVbriefBuild, run, usage } from "./main.js";
 export { PARITY_SCENARIO_NAMES, renderScenarioOutput, runParityScenario, SAMPLE_PROJECT_MD, SAMPLE_ROADMAP_MD, SAMPLE_SPEC_MD, SAMPLE_SPEC_VBRIEF, } from "./parity-scenarios.js";

package/dist/vbrief-build/index.js

@@ -1,5 +1,5 @@
 export { createScopeVbrief, referenceHasRequiredFields, referenceWithDefaultTrust, setTodayForTests, slugify, TODAY, } from "./build.js";
-export { DEFAULT_STATUS_FOR_FOLDER, DEPRECATION_SENTINEL, EMITTED_VBRIEF_VERSION, EXTERNAL_REFERENCE_TYPES, FOLDER_TO_STATUSES, INTERNAL_REFERENCE_TYPES, LIFECYCLE_FOLDERS, MIGRATOR_METADATA_KEY, PROJECT_DEFINITION_REL_PATH, STATUS_TO_FOLDER, } from "./constants.js";
+export { DEFAULT_STATUS_FOR_FOLDER, DEPRECATION_SENTINEL, EMITTED_VBRIEF_VERSION, EXTERNAL_REFERENCE_TYPES, FOLDER_TO_STATUSES, INTERNAL_REFERENCE_TYPES, LIFECYCLE_FOLDERS, MIGRATOR_METADATA_KEY, STATUS_TO_FOLDER, } from "./constants.js";
 export { pythonJsonPretty } from "./json.js";
 export { cmdVbriefBuild, run, usage } from "./main.js";
 export { PARITY_SCENARIO_NAMES, renderScenarioOutput, runParityScenario, SAMPLE_PROJECT_MD, SAMPLE_ROADMAP_MD, SAMPLE_SPEC_MD, SAMPLE_SPEC_VBRIEF, } from "./parity-scenarios.js";

package/dist/verify-env/toolchain-check.js

@@ -20,16 +20,31 @@ export const CONSUMER_TOOLS = [
 export const TOOLS = MAINTAINER_TOOLS;
 const DEFAULT_TIMEOUT_MS = 10_000;
 export function defaultCommandRunner(command, timeoutMs) {
+    const bin = command[0] ?? "";
+    const args = command.slice(1);
+    const trySpawn = (shell) => childProcess.execFileSync(bin, args, {
+        encoding: "utf8",
+        timeout: timeoutMs,
+        stdio: ["ignore", "pipe", "pipe"],
+        shell,
+    });
     try {
-        const stdout = childProcess.execFileSync(command[0] ?? "", command.slice(1), {
-            encoding: "utf8",
-            timeout: timeoutMs,
-            stdio: ["ignore", "pipe", "pipe"],
-        });
+        const stdout = trySpawn(false);
         return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
     }
     catch (err) {
         const e = err;
+        // win32: npm global shims are `.cmd` and need shell/PATHEXT (#2467 / #2415).
+        if (e.code === "ENOENT" && process.platform === "win32") {
+            try {
+                const stdout = trySpawn(true);
+                return { returncode: 0, stdout: typeof stdout === "string" ? stdout : "", stderr: "" };
+            }
+            catch {
+                // Shell still failed — binary is absent (cmd.exe often exits 1, not ENOENT).
+                return { error: "not-found", message: "" };
+            }
+        }
         if (e.code === "ENOENT") {
             return { error: "not-found", message: "" };
         }

package/dist/verify-env/verify-hooks-installed.d.ts

@@ -5,6 +5,7 @@ export interface EvaluateResult {
     readonly stream: OutputStream;
 }
 export declare const REQUIRED_HOOKS: readonly ["pre-commit", "pre-push"];
+export declare const REQUIRED_HOOK_SUPPORT_FILES: readonly ["_deft-run.sh"];
 /** Substrings each hook must contain when it dispatches through the deft CLI (#2049). */
 export declare const PRE_COMMIT_DEFT_COMMANDS: readonly ["verify:branch", "verify:encoding"];
 export declare const PRE_PUSH_DEFT_COMMANDS: readonly ["preflight-gh"];
@@ -15,6 +16,7 @@ export type GitConfigReader = (projectRoot: string) => {
 export interface EvaluateOptions {
     readonly gitConfigReader?: GitConfigReader;
     readonly platform?: NodeJS.Platform;
+    readonly hookExecutable?: (hookPath: string) => boolean;
 }
 /** Drop shell ``#`` comment lines before pattern scans (#2049 shipped-hook false positives). */
 export declare function stripShellCommentLines(content: string): string;

package/dist/verify-env/verify-hooks-installed.js

@@ -2,6 +2,7 @@ import * as childProcess from "node:child_process";
 import { accessSync, constants, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 export const REQUIRED_HOOKS = ["pre-commit", "pre-push"];
+export const REQUIRED_HOOK_SUPPORT_FILES = ["_deft-run.sh"];
 /** Substrings each hook must contain when it dispatches through the deft CLI (#2049). */
 export const PRE_COMMIT_DEFT_COMMANDS = ["verify:branch", "verify:encoding"];
 export const PRE_PUSH_DEFT_COMMANDS = ["preflight-gh"];
@@ -52,7 +53,7 @@ function isDirectory(path) {
 function isPosix(platform) {
     return platform !== "win32";
 }
-function hookExecutable(hookPath) {
+function defaultHookExecutable(hookPath) {
     try {
         accessSync(hookPath, constants.X_OK);
         return true;
@@ -112,6 +113,7 @@ export function evaluate(projectRoot, options = {}) {
     const root = resolve(projectRoot);
     const gitReader = options.gitConfigReader ?? defaultGitConfigReader;
     const platform = options.platform ?? process.platform;
+    const hookExecutable = options.hookExecutable ?? defaultHookExecutable;
     if (!isDirectory(root)) {
         return {
             code: 2,
@@ -173,29 +175,29 @@ export function evaluate(projectRoot, options = {}) {
             };
         }
     }
+    const contentIssues = [];
+    const missingSupport = REQUIRED_HOOK_SUPPORT_FILES.filter((h) => !isFile(join(hooksDir, h)));
+    if (missingSupport.length > 0) {
+        contentIssues.push(`${hooksDir} is missing ${missingSupport.join(", ")} helper(s); pre-commit/pre-push source them at runtime`);
+    }
     const preCommitIssue = validateHookContent("pre-commit", readHookContent(join(hooksDir, "pre-commit")), PRE_COMMIT_DEFT_COMMANDS);
     if (preCommitIssue) {
-        return {
-            code: 1,
-            message: `❌ deft hooks wired but NON-FUNCTIONAL: ${preCommitIssue} (#2049).\n` +
-                "  Recovery: re-run the deft installer / `task setup` to refresh .githooks/.",
-            stream: "stderr",
-        };
+        contentIssues.push(`${preCommitIssue} (#2049)`);
     }
     const prePushContent = readHookContent(join(hooksDir, "pre-push"));
     const prePushIssue = validateHookContent("pre-push", prePushContent, PRE_PUSH_DEFT_COMMANDS);
     if (prePushIssue) {
-        return {
-            code: 1,
-            message: `❌ deft hooks wired but NON-FUNCTIONAL: ${prePushIssue} (#2049).\n` +
-                "  Recovery: re-run the deft installer / `task setup` to refresh .githooks/.",
-            stream: "stderr",
-        };
+        contentIssues.push(`${prePushIssue} (#2049)`);
     }
     if (prePushContent && prePushInvokesVerifyBranch(prePushContent)) {
+        contentIssues.push("pre-push must not invoke verify:branch (#1814)");
+    }
+    if (contentIssues.length > 0) {
         return {
             code: 1,
-            message: "❌ deft hooks wired but NON-FUNCTIONAL: pre-push must not invoke verify:branch (#1814).\n" +
+            message: "❌ deft hooks wired but NON-FUNCTIONAL:\n" +
+                contentIssues.map((issue) => `  - ${issue.replace(/\r?\n/g, " ")}`).join("\n") +
+                "\n" +
                 "  Recovery: re-run the deft installer / `task setup` to refresh .githooks/.",
             stream: "stderr",
         };
@@ -203,7 +205,7 @@ export function evaluate(projectRoot, options = {}) {
     return {
         code: 0,
         message: `✓ deft hooks installed and functional: core.hooksPath=${hooksPath}, ` +
-            `hooks ${REQUIRED_HOOKS.join(", ")} present and dispatch via deft CLI (#2049).`,
+            `hooks ${REQUIRED_HOOKS.join(", ")} plus ${REQUIRED_HOOK_SUPPORT_FILES.join(", ")} present and dispatch via deft CLI (#2049).`,
         stream: "stdout",
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.74.0",
+  "version": "0.76.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -38,6 +38,10 @@
       "types": "./dist/agents-md-advisory/index.d.ts",
       "default": "./dist/agents-md-advisory/index.js"
     },
+    "./eval-health-relocation": {
+      "types": "./dist/eval-health-relocation/index.d.ts",
+      "default": "./dist/eval-health-relocation/index.js"
+    },
     "./xbrief-migrate": {
       "types": "./dist/xbrief-migrate/index.d.ts",
       "default": "./dist/xbrief-migrate/index.js"
@@ -281,8 +285,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.74.0",
-    "@deftai/directive-types": "^0.74.0",
+    "@deftai/directive-content": "^0.76.0",
+    "@deftai/directive-types": "^0.76.0",
     "archiver": "^8.0.0"
   },
   "scripts": {