@deftai/directive-core 0.79.0 → 0.79.2

package/dist/cache/fetch.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
+import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { GhRestError, InvalidRepoError, restIssueView, runGhApi, } from "../scm/gh-rest.js";
 import { DEFAULT_BATCH_SIZE, DEFAULT_DELAY_MS } from "./constants.js";
 import { CacheError, CacheFetchError } from "./errors.js";
@@ -569,8 +570,9 @@ function readSelfHealState(cacheRoot) {
         return null;
     }
 }
-function writeSelfHealState(cacheRoot, when) {
-    const path = join(cacheRoot, SELF_HEAL_STATE_FILENAME);
+function writeSelfHealState(projectRoot, cacheRoot, when) {
+    const path = join(resolve(cacheRoot), SELF_HEAL_STATE_FILENAME);
+    assertWriteTargetSafe(projectRoot, path);
     writeFileSync(path, `${JSON.stringify({ last_reconcile_at: when.toISOString() })}\n`, "utf8");
 }
 /** TTL-bounded closed-reconcile for session ritual / triage:welcome self-healing (#1886). */
@@ -623,7 +625,15 @@ export function maybeSelfHealCache(projectRoot, options = {}) {
     try {
         const refresh = refreshFn({ source, repo, cacheRoot, openNumbers });
         if (options.writeState !== false && refresh.refreshFailed === 0) {
-            writeSelfHealState(cacheRoot, now);
+            try {
+                writeSelfHealState(projectRoot, cacheRoot, now);
+            }
+            catch (err) {
+                if (err instanceof ProjectionContainmentError) {
+                    return { skipped: true, skipReason: "containment-refused", drift, refresh: null };
+                }
+                throw err;
+            }
         }
         return { skipped: false, skipReason: null, drift, refresh };
     }

package/dist/capacity/backfill.js

@@ -3,6 +3,7 @@ import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
 import { sortedStringifyCompact } from "../codebase/json.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleFolder } from "../layout/resolve.js";
 import { classifyBucket, loadBucketMatchers, resolveCapacityAllocation, SOURCE_MATCH, } from "../policy/capacity.js";
 export const COMPLETED_FOLDER = "completed";
@@ -137,7 +138,8 @@ function inWindow(completedAt, windowDays, now) {
     const ageDays = (now.getTime() - parsed.getTime()) / (86400 * 1000);
     return ageDays >= 0 && ageDays <= windowDays;
 }
-function writeMetadata(path, data, plan, metadata, options) {
+function writeMetadata(projectRoot, path, data, plan, metadata, options) {
+    assertWriteTargetSafe(projectRoot, path);
     if (typeof plan.metadata !== "object" || plan.metadata === null || Array.isArray(plan.metadata)) {
         plan.metadata = metadata;
     }
@@ -272,7 +274,7 @@ export async function backfill(projectRoot, options = {}) {
         result.items.push(item);
         if (!result.dry_run && (setBucket || setCompletedAt)) {
             try {
-                writeMetadata(path, data, planRec, metadata, {
+                writeMetadata(projectRoot, path, data, planRec, metadata, {
                     bucket: setBucket ? bucket : undefined,
                     source: setBucket ? source : undefined,
                     completedAt: setCompletedAt ? (gitCompletedAt ?? undefined) : undefined,

package/dist/category-b-namespace/index.js

@@ -9,8 +9,9 @@
  * order-preserving (the namespaced key takes the legacy key's slot, keeping
  * artifact diffs minimal).
  */
-import { existsSync, readdirSync, readFileSync, statSync, writeFileSync, } from "node:fs";
+import { existsSync, lstatSync, readdirSync, readFileSync, writeFileSync, } from "node:fs";
 import { join, relative, resolve } from "node:path";
+import { assertDirectoryNotSymlink, assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { LEGACY_PLAN_COMPLETED_NOTE_KEY, LEGACY_PLAN_POLICY_KEY, PLAN_COMPLETED_NOTE_KEY, PLAN_POLICY_KEY, } from "../policy/plan-extensions.js";
 /** The locked Category B renames (#1650): directive's own config, not xbrief data. */
@@ -69,10 +70,20 @@ function collectVbriefFiles(dir, acc = []) {
     }
     for (const entry of entries) {
         const full = join(dir, entry.name);
-        if (entry.isDirectory()) {
+        let info;
+        try {
+            info = lstatSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (info.isSymbolicLink()) {
+            continue;
+        }
+        if (info.isDirectory()) {
             collectVbriefFiles(full, acc);
         }
-        else if (entry.isFile() && hasArtifactSuffix(entry.name)) {
+        else if (info.isFile() && hasArtifactSuffix(entry.name)) {
             acc.push(full);
         }
     }
@@ -100,13 +111,17 @@ export function migrateCategoryBCorpus(projectRoot) {
             return { scanned: 0, changed: [], conflicts: [] };
         }
     }
+    try {
+        assertDirectoryNotSymlink(root, vbriefDir, "lifecycle root");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { scanned: 0, changed: [], conflicts: [{ path: relative(root, vbriefDir), message }] };
+    }
     let scanned = 0;
     const changed = [];
     const conflicts = [];
     for (const file of collectVbriefFiles(vbriefDir)) {
-        if (!statSync(file).isFile()) {
-            continue;
-        }
         scanned += 1;
         let parsed;
         try {
@@ -125,6 +140,16 @@ export function migrateCategoryBCorpus(projectRoot) {
             continue;
         }
         if (result.changed) {
+            try {
+                assertWriteTargetSafe(root, file);
+            }
+            catch (err) {
+                conflicts.push({
+                    path: relPath,
+                    message: err instanceof Error ? err.message : String(err),
+                });
+                continue;
+            }
             writeFileSync(file, `${JSON.stringify(result.doc, null, 2)}\n`, "utf8");
             changed.push(relPath);
         }

package/dist/content-contracts/skills/skill-frontmatter.js

@@ -34,8 +34,12 @@ function parseOsArray(fm) {
     const body = match.groups?.body ?? "";
     return [...body.matchAll(OS_TOKEN)].map((m) => m[1] ?? "");
 }
-function pathHasExcludedPart(filePath) {
-    const parts = filePath.split(/[/\\]/);
+function pathHasExcludedPart(filePath, repoRoot = REPO_ROOT) {
+    const rel = relative(repoRoot, filePath).replace(/\\/g, "/");
+    if (rel.startsWith("..") || rel.length === 0) {
+        return true;
+    }
+    const parts = rel.split("/");
     return parts.some((part) => EXCLUDED_PARTS.has(part));
 }
 function discoverSkillMdFiles(dir, results) {

package/dist/eval/health.js

@@ -1,8 +1,9 @@
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { dirname, isAbsolute, relative, resolve } from "node:path";
 import { agentsRefreshPlan } from "../doctor/agents-md.js";
 import { evaluate as evaluateEncoding } from "../encoding/evaluate.js";
 import { readCorePackageVersion } from "../engine-version.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { resolveProjectDefinitionPath } from "../layout/resolve.js";
 import { healthMetricsHistoryPath } from "../metrics/resolve-metrics-home.js";
 import { readPlanPolicy } from "../policy/plan-extensions.js";
@@ -162,6 +163,12 @@ export function persistHealthRun(projectRoot, report) {
     if (path === null) {
         return;
     }
+    const projectAbs = resolve(projectRoot);
+    const targetAbs = resolve(path);
+    const rel = relative(projectAbs, targetAbs);
+    if (rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel)) {
+        assertWriteTargetSafe(projectRoot, path);
+    }
     mkdirSync(dirname(path), { recursive: true });
     appendFileSync(path, `${JSON.stringify(report)}\n`, "utf8");
 }

package/dist/eval/run.js

@@ -3,6 +3,7 @@ import { appendFileSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "n
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { readCorePackageVersion } from "../engine-version.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { resolveEvalPath } from "../layout/resolve.js";
 import { BYTE_DIFF_WHOLE_FILE_THRESHOLD, InstrumentedVbriefCrud } from "./crud-telemetry.js";
 import { evaluateHealth } from "./health.js";
@@ -194,6 +195,7 @@ export function goldenRunsHistoryPath(projectRoot) {
 /** Append one golden run to the versioned ledger (#1703 Tier 2). */
 export function persistGoldenRun(projectRoot, record) {
     const path = goldenRunsHistoryPath(projectRoot);
+    assertWriteTargetSafe(projectRoot, path);
     mkdirSync(dirname(path), { recursive: true });
     appendFileSync(path, `${JSON.stringify(record)}\n`, "utf8");
 }

package/dist/fs/projection-containment.d.ts

@@ -32,4 +32,15 @@ export declare class ProjectionContainmentError extends Error {
  * MUST be called BEFORE any projection read/write/mkdir.
  */
 export declare function assertProjectionContained(projectDir: string, targetPath: string): void;
+/**
+ * Refuse writes when the resolved target already exists as a symlink (#2626 / #2632).
+ * Pair with {@link assertProjectionContained} before read/write/mkdir/append.
+ */
+export declare function assertWriteTargetSafe(projectDir: string, targetPath: string): void;
+/**
+ * Refuse when a lifecycle corpus root is itself a symlink (#2626 category-b).
+ */
+export declare function assertDirectoryNotSymlink(projectDir: string, dirPath: string, label: string): void;
+/** Walk a directory tree and refuse any symlink entry (#2601 / #2626). */
+export declare function walkDirectoryRejectSymlinks(root: string): void;
 //# sourceMappingURL=projection-containment.d.ts.map

package/dist/fs/projection-containment.js

@@ -13,7 +13,7 @@
  *
  * Refs #2413.
  */
-import { lstatSync, realpathSync } from "node:fs";
+import { lstatSync, readdirSync, realpathSync } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
 /** Non-zero exit code for a projection-containment refusal (needs-action). */
 export const PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE = 2;
@@ -115,4 +115,65 @@ export function assertProjectionContained(projectDir, targetPath) {
             `(${deepestExistingReal} is outside ${projectReal})`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: deepestExistingReal });
     }
 }
+/**
+ * Refuse writes when the resolved target already exists as a symlink (#2626 / #2632).
+ * Pair with {@link assertProjectionContained} before read/write/mkdir/append.
+ */
+export function assertWriteTargetSafe(projectDir, targetPath) {
+    assertProjectionContained(projectDir, targetPath);
+    const targetAbs = resolve(targetPath);
+    let info;
+    try {
+        info = lstatSync(targetAbs);
+    }
+    catch {
+        return;
+    }
+    if (info.isSymbolicLink()) {
+        throw new ProjectionContainmentError(`projection write refused: ${targetAbs} is a symlink on the write path`, { projectDir: resolve(projectDir), targetPath: targetAbs, offendingPath: targetAbs });
+    }
+}
+/**
+ * Refuse when a lifecycle corpus root is itself a symlink (#2626 category-b).
+ */
+export function assertDirectoryNotSymlink(projectDir, dirPath, label) {
+    assertProjectionContained(projectDir, dirPath);
+    const dirAbs = resolve(dirPath);
+    let info;
+    try {
+        info = lstatSync(dirAbs);
+    }
+    catch {
+        throw new ProjectionContainmentError(`projection write refused: ${label} ${dirAbs} does not exist`, { projectDir: resolve(projectDir), targetPath: dirAbs, offendingPath: dirAbs });
+    }
+    if (info.isSymbolicLink()) {
+        throw new ProjectionContainmentError(`projection write refused: ${label} ${dirAbs} must not be a symlink`, { projectDir: resolve(projectDir), targetPath: dirAbs, offendingPath: dirAbs });
+    }
+}
+/** Walk a directory tree and refuse any symlink entry (#2601 / #2626). */
+export function walkDirectoryRejectSymlinks(root) {
+    let entries;
+    try {
+        entries = readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = join(root, entry.name);
+        let info;
+        try {
+            info = lstatSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (info.isSymbolicLink()) {
+            throw new ProjectionContainmentError(`projection write refused: symlink on traversal path: ${full}`, { projectDir: resolve(root), targetPath: full, offendingPath: full });
+        }
+        if (info.isDirectory()) {
+            walkDirectoryRejectSymlinks(full);
+        }
+    }
+}
 //# sourceMappingURL=projection-containment.js.map

package/dist/hooks/dispatcher.d.ts

@@ -6,7 +6,7 @@ export type HookHost = (typeof HOOK_HOSTS)[number];
 export declare const HOOK_EVENTS: readonly ["session.start", "tool.before"];
 export type HookEvent = (typeof HOOK_EVENTS)[number];
 export type HookVerdict = "allow" | "deny";
-export type HookDecisionCode = "session-start" | "session-start-degraded" | "not-direct-write" | "invalid-input" | "ritual-not-ready" | "scope-not-ready" | "write-ready";
+export type HookDecisionCode = "session-start" | "session-start-degraded" | "not-direct-write" | "invalid-input" | "ritual-not-ready" | "scope-not-ready" | "write-propose-ready" | "write-ready";
 export interface HookDecision {
     readonly verdict: HookVerdict;
     readonly code: HookDecisionCode;
@@ -32,7 +32,19 @@ export interface HookPolicySeams {
         stderr: string;
     };
 }
-export declare function hookToolName(payload: unknown): string | null;
+export declare function hookToolName(payload: unknown, host?: HookHost): string | null;
+/**
+ * Best-effort write-target path from host PreToolUse payloads (#2625).
+ * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
+ */
+export declare function hookWriteTargetPath(payload: unknown): string | null;
+/** POSIX-ish project-relative path for lifecycle matching. */
+export declare function toProjectRelativePosix(projectRoot: string, targetPath: string): string;
+/**
+ * Proposing a scope under xbrief/proposed/ (or legacy vbrief/proposed/) is
+ * planning, not implementation dispatch — exempt from the active-scope gate (#2625).
+ */
+export declare function isProposedLifecycleWrite(projectRoot: string, targetPath: string | null): boolean;
 export declare function projectRootFromHookPayload(payload: unknown, fallback: string): string;
 export declare function isHookHost(value: string): value is HookHost;
 export declare function isHookEvent(value: string): value is HookEvent;

package/dist/hooks/dispatcher.js

@@ -1,4 +1,5 @@
-import { resolve } from "node:path";
+import { relative, resolve, sep } from "node:path";
+import { hasArtifactSuffix } from "../layout/resolve.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
 import { inspectSessionRitual } from "../session/verify-session-ritual.js";
 import { inspectActiveScope } from "./scope.js";
@@ -18,11 +19,103 @@ function firstString(...values) {
     }
     return null;
 }
-export function hookToolName(payload) {
+function fieldPresent(input, key) {
+    return key in input;
+}
+function fieldString(input, key) {
+    const value = input[key];
+    if (typeof value === "string" && value.trim().length > 0)
+        return value.trim();
+    return null;
+}
+function toolInputRecord(payload) {
+    return record(payload.tool_input) ?? record(payload.toolInput) ?? record(payload.input);
+}
+/**
+ * Cursor preToolUse payloads sometimes omit `tool_name` even when the hook matcher
+ * fired for a direct-write tool (#2628). Infer from nested tool input when possible.
+ */
+function inferCursorDirectWriteToolName(payload) {
+    const toolInput = toolInputRecord(payload);
+    if (toolInput !== null) {
+        if (fieldPresent(toolInput, "new_string") ||
+            fieldPresent(toolInput, "newString") ||
+            fieldPresent(toolInput, "old_string") ||
+            fieldPresent(toolInput, "oldString")) {
+            return "StrReplace";
+        }
+        if (fieldString(toolInput, "contents") !== null ||
+            fieldString(toolInput, "content") !== null ||
+            fieldString(toolInput, "text") !== null) {
+            return "Write";
+        }
+        if (fieldString(toolInput, "patch") !== null ||
+            fieldString(toolInput, "unified_diff") !== null ||
+            fieldString(toolInput, "diff") !== null) {
+            return "ApplyPatch";
+        }
+        if (Array.isArray(toolInput.edits))
+            return "MultiEdit";
+        if (Array.isArray(toolInput.cells) || toolInput.cell_id != null) {
+            return "NotebookEdit";
+        }
+    }
+    // Cursor maps Claude Edit → Write; a write target without contents is still a direct write.
+    if (hookWriteTargetPath(payload) !== null)
+        return "Write";
+    return null;
+}
+export function hookToolName(payload, host) {
     const input = record(payload);
     if (input === null)
         return null;
-    return firstString(input.tool_name, input.toolName, input.tool);
+    const direct = fieldString(input, "tool_name") ?? fieldString(input, "toolName") ?? fieldString(input, "tool");
+    if (direct !== null)
+        return direct;
+    if (host === "cursor")
+        return inferCursorDirectWriteToolName(input);
+    return null;
+}
+function missingToolNameMessage(host) {
+    if (host === "cursor") {
+        return ("Directive denied this Cursor preToolUse event because the host payload omitted a " +
+            "recognizable tool name (host-integration mismatch — not a session ritual or scope failure). " +
+            "If write tools should pass, update Directive or report the payload shape from Cursor.");
+    }
+    return "Directive denied this matched write event because the host payload omitted its tool name.";
+}
+/**
+ * Best-effort write-target path from host PreToolUse payloads (#2625).
+ * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
+ */
+export function hookWriteTargetPath(payload) {
+    const input = record(payload);
+    if (input === null)
+        return null;
+    const toolInput = toolInputRecord(input);
+    return firstString(toolInput?.file_path, toolInput?.filePath, toolInput?.path, input.file_path, input.filePath, input.path);
+}
+/** POSIX-ish project-relative path for lifecycle matching. */
+export function toProjectRelativePosix(projectRoot, targetPath) {
+    const abs = resolve(projectRoot, targetPath.replace(/\\/g, "/"));
+    const rel = relative(resolve(projectRoot), abs);
+    return rel.split(sep).join("/").replace(/\\/g, "/");
+}
+/**
+ * Proposing a scope under xbrief/proposed/ (or legacy vbrief/proposed/) is
+ * planning, not implementation dispatch — exempt from the active-scope gate (#2625).
+ */
+export function isProposedLifecycleWrite(projectRoot, targetPath) {
+    if (targetPath === null || targetPath.trim().length === 0)
+        return false;
+    const posix = toProjectRelativePosix(projectRoot, targetPath);
+    // resolve()+relative() collapses mid-path `..`; only outside-root `..` remains.
+    if (posix.startsWith(".."))
+        return false;
+    const base = posix.includes("/") ? posix.slice(posix.lastIndexOf("/") + 1) : posix;
+    if (!hasArtifactSuffix(base))
+        return false;
+    return posix.startsWith("xbrief/proposed/") || posix.startsWith("vbrief/proposed/");
 }
 export function projectRootFromHookPayload(payload, fallback) {
     const input = record(payload);
@@ -94,9 +187,9 @@ export function decideHook(input, seams = {}) {
             scopePath: null,
         };
     }
-    const toolName = hookToolName(input.payload);
+    const toolName = hookToolName(input.payload, input.host);
     if (toolName === null) {
-        return deny(input, "invalid-input", null, "Directive denied this matched write event because the host payload omitted its tool name.");
+        return deny(input, "invalid-input", null, missingToolNameMessage(input.host));
     }
     if (!isDirectWriteTool(toolName)) {
         return {
@@ -124,6 +217,20 @@ export function decideHook(input, seams = {}) {
             "Recovery: run `deft session:start`, then " +
             "`deft verify:session-ritual -- --tier=gated`.");
     }
+    const writeTarget = hookWriteTargetPath(input.payload);
+    if (isProposedLifecycleWrite(projectRoot, writeTarget)) {
+        return {
+            verdict: "allow",
+            code: "write-propose-ready",
+            event: input.event,
+            host: input.host,
+            toolName,
+            projectRoot,
+            message: `Directive write gate allowed ${toolName} for a proposed lifecycle xBRIEF ` +
+                "(planning write; active scope not required).",
+            scopePath: null,
+        };
+    }
     let scope;
     try {
         scope = (seams.inspectScope ?? inspectActiveScope)(projectRoot);
@@ -132,8 +239,15 @@ export function decideHook(input, seams = {}) {
         scope = { ready: false, path: null, message: String(cause) };
     }
     if (!scope.ready) {
-        return deny(input, "scope-not-ready", toolName, `Directive denied ${toolName}: ${scope.message} ` +
-            "Recovery: run `deft scope:activate -- <path>` for the approved xBRIEF.");
+        const relTarget = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+        const proposedPathHint = relTarget !== null &&
+            (relTarget.startsWith("xbrief/proposed/") || relTarget.startsWith("vbrief/proposed/"))
+            ? " For a new proposal under xbrief/proposed/, include a lifecycle artifact " +
+                "filename (*.xbrief.json) in the Write/Edit payload so the gate can exempt " +
+                "planning writes (#2625)."
+            : " Recovery: run `deft scope:activate -- <path>` for the approved xBRIEF, " +
+                "or Write a new proposal to xbrief/proposed/*.xbrief.json (planning exemption).";
+        return deny(input, "scope-not-ready", toolName, `Directive denied ${toolName}: ${scope.message}${proposedPathHint}`);
     }
     return {
         verdict: "allow",

package/dist/init-deposit/hygiene.js

@@ -27,6 +27,9 @@ export function installerManagedMatchers() {
         { exact: ".codex/hooks.json" },
         { exact: ".gitattributes" },
         { exact: ".gitignore" },
+        // Installer-deposited Prettier gate exclusion (#2534); must be allowlisted or
+        // framework-only deposit PRs trip no-mixed-core-and-app (#2629).
+        { exact: ".prettierignore" },
         { exact: "greptile.json" },
         { exact: CODEQL_CONFIG_REL },
         { exact: CORE_GUARD_WORKFLOW_REL },

package/dist/intake/reconcile-issues.d.ts

@@ -56,7 +56,7 @@ export declare function formatJson(report: ReconcileReport): string;
 export declare function formatMarkdown(report: ReconcileReport): string;
 export declare function applyLifecycleFixes(vbriefDir: string, report: ReconcileReport, projectRoot?: string | null): [number, number, string[]];
 /** Repair completed/ files whose plan.status is not terminal (#2578). */
-export declare function repairCompletedStatusDrift(vbriefDir: string, drift: readonly CompletedStatusDriftEntry[]): [number, number, string[]];
+export declare function repairCompletedStatusDrift(vbriefDir: string, drift: readonly CompletedStatusDriftEntry[], projectRoot?: string | null): [number, number, string[]];
 export declare function detectRepo(): string | null;
 export interface ReconcileCliArgs {
     vbriefDir?: string;

package/dist/intake/reconcile-issues.js

@@ -1,6 +1,7 @@
 import { execFileSync } from "node:child_process";
 import { mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { assertProjectionContained, assertWriteTargetSafe, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { call } from "../scm/call.js";
 import { updateDecomposedChildBackReferences } from "../scope/decomposed-refs.js";
@@ -673,6 +674,17 @@ export function applyLifecycleFixes(vbriefDir, report, projectRoot = null) {
             failures.push(`vBRIEF file missing: ${relPath}`);
             continue;
         }
+        try {
+            assertWriteTargetSafe(cwd, src);
+            assertProjectionContained(cwd, join(vbriefDir, destFolder));
+        }
+        catch (err) {
+            if (err instanceof ProjectionContainmentError) {
+                failures.push(`${relPath}: ${err.message}`);
+                continue;
+            }
+            throw err;
+        }
         let data;
         try {
             data = JSON.parse(readFileSync(src, "utf8"));
@@ -684,7 +696,12 @@ export function applyLifecycleFixes(vbriefDir, report, projectRoot = null) {
         mkdirSync(join(vbriefDir, destFolder), { recursive: true });
         try {
             statSync(dst);
-            failures.push(`target already exists in ${destFolder}/: ${filename}`);
+            // Destination already holds this basename (#2622). Treat as already-terminal
+            // and continue the sweep. Do not unlink the source — a same-basename collision
+            // can be a non-identical artifact; leave removal to the operator / git.
+            process.stderr.write(`reconcile: skipped ${relPath} — already present in ${destFolder}/ (#2622); ` +
+                "left source in place for manual cleanup\n");
+            skipped += 1;
             continue;
         }
         catch {
@@ -723,11 +740,12 @@ export function applyLifecycleFixes(vbriefDir, report, projectRoot = null) {
     return [moved, skipped, failures];
 }
 /** Repair completed/ files whose plan.status is not terminal (#2578). */
-export function repairCompletedStatusDrift(vbriefDir, drift) {
+export function repairCompletedStatusDrift(vbriefDir, drift, projectRoot = null) {
     let repaired = 0;
     let skipped = 0;
     const failures = [];
     const completedDir = join(vbriefDir, "completed");
+    const cwd = projectRoot ?? resolve(vbriefDir, "..");
     for (const entry of drift) {
         const slash = entry.rel_path.indexOf("/");
         if (slash < 0) {
@@ -736,6 +754,16 @@ export function repairCompletedStatusDrift(vbriefDir, drift) {
         }
         const filename = entry.rel_path.slice(slash + 1);
         const src = join(completedDir, filename);
+        try {
+            assertWriteTargetSafe(cwd, src);
+        }
+        catch (err) {
+            if (err instanceof ProjectionContainmentError) {
+                failures.push(`${entry.rel_path}: ${err.message}`);
+                continue;
+            }
+            throw err;
+        }
         let data;
         try {
             data = JSON.parse(readFileSync(src, "utf8"));
@@ -871,7 +899,7 @@ export function reconcileMain(args) {
         }, 0);
         const [moved, skipped, failures] = applyLifecycleFixes(vbriefDir, applyReport, projectRoot);
         const driftAfterMove = scanCompletedStatusDrift(vbriefDir);
-        const [driftRepaired, driftSkipped, driftFailures] = repairCompletedStatusDrift(vbriefDir, driftAfterMove);
+        const [driftRepaired, driftSkipped, driftFailures] = repairCompletedStatusDrift(vbriefDir, driftAfterMove, projectRoot);
         const allFailures = [...failures, ...driftFailures];
         process.stderr.write(`[${moved}/${candidates}] vBRIEFs reconciled (moved=${moved}, already-terminal=${skipped}, failures=${failures.length})\n`);
         process.stderr.write(`[${driftRepaired}/${completedDrift.length}] completed/ status drift repaired (repaired=${driftRepaired}, already-terminal=${driftSkipped}, failures=${driftFailures.length})\n`);

package/dist/issue-sync/sync-from-xbrief-cli.d.ts

@@ -4,6 +4,7 @@ export interface ParsedSyncFromXbriefCliArgs {
     dryRun?: boolean;
     projectRoot?: string;
     repo?: string;
+    allowCrossRepo?: boolean;
     error?: string;
 }
 export declare function parseArgs(argv: readonly string[]): ParsedSyncFromXbriefCliArgs;

package/dist/issue-sync/sync-from-xbrief-cli.js

@@ -8,6 +8,9 @@ export function parseArgs(argv) {
         if (arg === "--dry-run") {
             out.dryRun = true;
         }
+        else if (arg === "--allow-cross-repo") {
+            out.allowCrossRepo = true;
+        }
         else if (arg === "--project-root") {
             const value = argv[i + 1];
             if (value === undefined) {

package/dist/issue-sync/sync-from-xbrief.d.ts

@@ -29,6 +29,8 @@ export interface SyncFromXbriefOptions {
     readonly dryRun?: boolean;
     readonly projectRoot?: string;
     readonly repo?: string;
+    readonly allowCrossRepo?: boolean;
+    readonly repoAllowlist?: readonly string[];
     readonly runFn?: RunGhApiFn;
     readonly writeErr?: (message: string) => void;
     readonly writeOut?: (message: string) => void;
@@ -41,6 +43,8 @@ export interface SyncFromXbriefCliArgs {
     readonly dryRun?: boolean;
     readonly projectRoot?: string;
     readonly repo?: string;
+    readonly allowCrossRepo?: boolean;
+    readonly repoAllowlist?: readonly string[];
 }
 export declare function syncFromXbriefMain(args: SyncFromXbriefCliArgs): number;
 //# sourceMappingURL=sync-from-xbrief.d.ts.map

package/dist/issue-sync/sync-from-xbrief.js

@@ -6,6 +6,7 @@ import { provenanceIssueNumber, repoSlugFromUrl } from "../intake/issue-ingest.j
 import { extractReferencesFromVbrief, GITHUB_ISSUE_REF_TYPES, parseIssueNumber, } from "../intake/reconcile-issues.js";
 import { resolveProjectRoot } from "../scope/project-context.js";
 import { resolveProjectRepo } from "../slice/project-context.js";
+import { isRepoMutationAllowed } from "../vbrief-reconcile/repo-guard.js";
 export const SYNC_COMMENT_HEADER = "## xBRIEF sync (deft issue:sync-from-xbrief)";
 export function resolveOriginIssue(data, options = {}) {
     const refs = extractReferencesFromVbrief(data);
@@ -161,6 +162,15 @@ export function syncFromXbrief(options) {
         writeOut(`issue:sync-from-xbrief: no material AC/status changes since last sync for #${origin.number}; nothing to post.`);
         return 0;
     }
+    const mutateGate = isRepoMutationAllowed(origin.repo, projectRoot, {
+        allowCrossRepo: options.allowCrossRepo,
+        allowlist: options.repoAllowlist,
+        explicitRepo: fallbackRepo,
+    });
+    if (!mutateGate.allowed) {
+        writeErr(`issue:sync-from-xbrief: ${mutateGate.reason ?? `refusing cross-repo mutation on ${origin.repo}`}`);
+        return 1;
+    }
     const relPath = options.xbriefPath.replace(/\\/g, "/");
     const comment = buildSyncComment(data, relPath);
     if (options.dryRun) {
@@ -203,6 +213,8 @@ export function syncFromXbriefMain(args) {
         dryRun: args.dryRun,
         projectRoot: args.projectRoot,
         repo: args.repo,
+        allowCrossRepo: args.allowCrossRepo,
+        repoAllowlist: args.repoAllowlist,
     });
 }
 //# sourceMappingURL=sync-from-xbrief.js.map