@deftai/directive-core 0.79.0 → 0.79.2

package/dist/pr-merge-readiness/greptile-inline.js

@@ -0,0 +1,239 @@
+import { detect } from "../content-contracts/skills/greptile-detector.js";
+import { GREPTILE_LOGIN } from "./constants.js";
+const REVIEW_THREADS_QUERY = `
+query($owner: String!, $repo: String!, $pr: Int!, $after: String) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $pr) {
+      reviewThreads(first: 100, after: $after) {
+        pageInfo { hasNextPage endCursor }
+        nodes {
+          isResolved
+          isOutdated
+          comments(first: 50) {
+            nodes {
+              author { login }
+              body
+              path
+              commit { oid }
+            }
+          }
+        }
+      }
+    }
+  }
+}`;
+const EMPTY_INLINE = {
+    p0Count: 0,
+    p1Count: 0,
+    unresolvedThreadCount: 0,
+    error: null,
+};
+/** True when a review comment commit SHA matches the current PR head (#2620 AC-2). */
+export function headShaMatches(commentSha, headSha) {
+    return headSha.startsWith(commentSha) || commentSha.startsWith(headSha);
+}
+export function inlineFindingsToDict(findings) {
+    return {
+        p0_count: findings.p0Count,
+        p1_count: findings.p1Count,
+        unresolved_thread_count: findings.unresolvedThreadCount,
+        error: findings.error,
+    };
+}
+function parseOwnerRepo(ownerRepo) {
+    const slash = ownerRepo.indexOf("/");
+    if (slash <= 0 || slash >= ownerRepo.length - 1) {
+        return null;
+    }
+    return { owner: ownerRepo.slice(0, slash), repo: ownerRepo.slice(slash + 1) };
+}
+function asRecord(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        return null;
+    }
+    return value;
+}
+function parseReviewComment(node) {
+    const record = asRecord(node);
+    if (record === null) {
+        return null;
+    }
+    const author = asRecord(record.author);
+    const login = author?.login;
+    if (typeof login !== "string" || login.length === 0) {
+        return null;
+    }
+    const body = record.body;
+    if (typeof body !== "string") {
+        return null;
+    }
+    const commit = asRecord(record.commit);
+    const oid = commit?.oid;
+    const path = record.path;
+    return {
+        authorLogin: login,
+        body,
+        path: typeof path === "string" ? path : null,
+        commitOid: typeof oid === "string" && oid.length > 0 ? oid : null,
+    };
+}
+function parseReviewThread(node) {
+    const record = asRecord(node);
+    if (record === null) {
+        return null;
+    }
+    const commentsBlock = asRecord(record.comments);
+    const commentNodes = commentsBlock?.nodes;
+    const comments = [];
+    if (Array.isArray(commentNodes)) {
+        for (const commentNode of commentNodes) {
+            const parsed = parseReviewComment(commentNode);
+            if (parsed !== null) {
+                comments.push(parsed);
+            }
+        }
+    }
+    return {
+        isResolved: record.isResolved === true,
+        isOutdated: record.isOutdated === true,
+        comments,
+    };
+}
+function parseGraphqlReviewThreadsPage(stdout) {
+    if (!stdout.trim()) {
+        return { threads: [], hasNextPage: false, endCursor: null, error: "empty GraphQL body" };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(stdout);
+    }
+    catch (exc) {
+        const message = exc instanceof Error ? exc.message : String(exc);
+        return {
+            threads: [],
+            hasNextPage: false,
+            endCursor: null,
+            error: `could not parse GraphQL JSON: ${message}`,
+        };
+    }
+    const root = asRecord(payload);
+    const errors = root?.errors;
+    if (Array.isArray(errors) && errors.length > 0) {
+        const first = errors[0];
+        const message = typeof first === "object" && first !== null && "message" in first
+            ? String(first.message)
+            : "GraphQL errors present";
+        return { threads: [], hasNextPage: false, endCursor: null, error: message };
+    }
+    const data = asRecord(root?.data);
+    const repository = asRecord(data?.repository);
+    const pullRequest = asRecord(repository?.pullRequest);
+    const reviewThreads = asRecord(pullRequest?.reviewThreads);
+    const nodes = reviewThreads?.nodes;
+    const pageInfo = asRecord(reviewThreads?.pageInfo);
+    const threads = [];
+    if (Array.isArray(nodes)) {
+        for (const node of nodes) {
+            const parsed = parseReviewThread(node);
+            if (parsed !== null) {
+                threads.push(parsed);
+            }
+        }
+    }
+    return {
+        threads,
+        hasNextPage: pageInfo?.hasNextPage === true,
+        endCursor: typeof pageInfo?.endCursor === "string" ? pageInfo.endCursor : null,
+        error: null,
+    };
+}
+/** Score unresolved Greptile inline P0/P1 threads pinned to the current HEAD (#2620). */
+export function evaluateInlineReviewThreads(threads, headSha) {
+    let p0Count = 0;
+    let p1Count = 0;
+    let unresolvedThreadCount = 0;
+    for (const thread of threads) {
+        if (thread.isResolved || thread.isOutdated) {
+            continue;
+        }
+        let threadP0 = 0;
+        let threadP1 = 0;
+        for (const comment of thread.comments) {
+            if (comment.authorLogin !== GREPTILE_LOGIN) {
+                continue;
+            }
+            if (comment.commitOid === null || !headShaMatches(comment.commitOid, headSha)) {
+                continue;
+            }
+            const findings = detect(comment.body);
+            threadP0 += findings.p0_count;
+            threadP1 += findings.p1_count;
+        }
+        if (threadP0 + threadP1 > 0) {
+            p0Count += threadP0;
+            p1Count += threadP1;
+            unresolvedThreadCount += 1;
+        }
+    }
+    return { p0Count, p1Count, unresolvedThreadCount, error: null };
+}
+/** Fetch unresolved Greptile inline P0/P1 on the current HEAD via reviewThreads GraphQL (#2620). */
+export function fetchUnresolvedGreptileInlineFindings(prNumber, repo, headSha, runGh) {
+    const parsed = parseOwnerRepo(repo);
+    if (parsed === null) {
+        return { ...EMPTY_INLINE, error: `invalid repo: ${repo}` };
+    }
+    const allThreads = [];
+    let after = null;
+    const maxPages = 10;
+    let hasNextPage = true;
+    for (let page = 0; hasNextPage && page < maxPages; page += 1) {
+        const cmd = [
+            "gh",
+            "api",
+            "graphql",
+            "-f",
+            `query=${REVIEW_THREADS_QUERY}`,
+            "-f",
+            `owner=${parsed.owner}`,
+            "-f",
+            `repo=${parsed.repo}`,
+            "-F",
+            `pr=${String(prNumber)}`,
+        ];
+        if (after !== null) {
+            cmd.push("-f", `after=${after}`);
+        }
+        const rc = runGh(cmd);
+        if (rc.returncode !== 0) {
+            return {
+                ...EMPTY_INLINE,
+                error: `graphql reviewThreads failed: ${rc.stderr.trim() || rc.stdout.trim()}`,
+            };
+        }
+        const pageResult = parseGraphqlReviewThreadsPage(rc.stdout);
+        if (pageResult.error !== null) {
+            return { ...EMPTY_INLINE, error: pageResult.error };
+        }
+        allThreads.push(...pageResult.threads);
+        hasNextPage = pageResult.hasNextPage;
+        if (!hasNextPage) {
+            break;
+        }
+        if (pageResult.endCursor === null) {
+            return {
+                ...EMPTY_INLINE,
+                error: "graphql reviewThreads pagination missing endCursor while hasNextPage=true",
+            };
+        }
+        after = pageResult.endCursor;
+    }
+    if (hasNextPage) {
+        return {
+            ...EMPTY_INLINE,
+            error: `graphql reviewThreads pagination exceeded ${maxPages} pages`,
+        };
+    }
+    return evaluateInlineReviewThreads(allThreads, headSha);
+}
+//# sourceMappingURL=greptile-inline.js.map

package/dist/pr-merge-readiness/index.d.ts

@@ -3,6 +3,7 @@ export { type ComputeGateOptions, computeGateResult, type FetchMergeabilityFn }
 export * from "./constants.js";
 export { evaluateGates, isMergeReady } from "./evaluate.js";
 export { defaultRunGh } from "./gh.js";
+export { evaluateInlineReviewThreads, fetchUnresolvedGreptileInlineFindings, headShaMatches, type InlineGreptileFindings, type InlineReviewComment, type InlineReviewThread, inlineFindingsToDict, } from "./greptile-inline.js";
 export { cmdPrMergeReadiness, parseArgs, run } from "./main.js";
 export { fetchMergeability, isGithubMergeableClean, MERGE_STATE_CLEAN, type MergeabilitySignal, mergeabilityToDict, verdictBlockIsSoftOnly, verdictShaIsStale, } from "./mergeability.js";
 export { emitJson, exitCodeFor, gateResultToDict, printHuman } from "./output.js";

package/dist/pr-merge-readiness/index.js

@@ -3,6 +3,7 @@ export { computeGateResult } from "./compute.js";
 export * from "./constants.js";
 export { evaluateGates, isMergeReady } from "./evaluate.js";
 export { defaultRunGh } from "./gh.js";
+export { evaluateInlineReviewThreads, fetchUnresolvedGreptileInlineFindings, headShaMatches, inlineFindingsToDict, } from "./greptile-inline.js";
 export { cmdPrMergeReadiness, parseArgs, run } from "./main.js";
 export { fetchMergeability, isGithubMergeableClean, MERGE_STATE_CLEAN, mergeabilityToDict, verdictBlockIsSoftOnly, verdictShaIsStale, } from "./mergeability.js";
 export { emitJson, exitCodeFor, gateResultToDict, printHuman } from "./output.js";

package/dist/pr-merge-readiness/mergeability.d.ts

@@ -1,3 +1,4 @@
+import type { InlineGreptileFindings } from "./greptile-inline.js";
 import type { GreptileVerdict, RunGhFn } from "./types.js";
 /**
  * GitHub's authoritative mergeability signal, read over REST (#2260).
@@ -41,5 +42,5 @@ export declare function verdictShaIsStale(verdict: GreptileVerdict, headSha: str
  * regardless of GitHub mergeability (guardrail: do not merge a PR with a real
  * P0/P1 review finding).
  */
-export declare function verdictBlockIsSoftOnly(verdict: GreptileVerdict, headSha: string | null): boolean;
+export declare function verdictBlockIsSoftOnly(verdict: GreptileVerdict, headSha: string | null, inline?: InlineGreptileFindings | null): boolean;
 //# sourceMappingURL=mergeability.d.ts.map

package/dist/pr-merge-readiness/mergeability.js

@@ -75,7 +75,13 @@ export function verdictShaIsStale(verdict, headSha) {
  * regardless of GitHub mergeability (guardrail: do not merge a PR with a real
  * P0/P1 review finding).
  */
-export function verdictBlockIsSoftOnly(verdict, headSha) {
+export function verdictBlockIsSoftOnly(verdict, headSha, inline = null) {
+    if (inline !== null && inline.error !== null) {
+        return false;
+    }
+    if (inline !== null && inline.error === null && (inline.p0Count > 0 || inline.p1Count > 0)) {
+        return false;
+    }
     // Absent: no Greptile rolling-summary comment at all.
     if (!verdict.found) {
         return true;

package/dist/pr-wait-mergeable/wrappers.d.ts

@@ -17,6 +17,15 @@ export interface CaptureExecOptions {
 }
 /** UTF-8-safe subprocess capture via spawnSync (no shell) — mirrors #1366. */
 export declare function captureExec(executable: string, args: readonly string[], timeoutMs: number, options?: CaptureExecOptions): CaptureExecResult;
+/**
+ * Resolve a CLI entry script for subprocess spawn (#2615).
+ *
+ * Published npm layout nests `@deftai/directive-core` under `@deftai/directive`,
+ * so the old `../../../cli/dist` relative path resolved to a non-existent
+ * `@deftai/cli` sibling. Prefer the published package root, then monorepo path,
+ * then nested `@deftai/directive/dist`.
+ */
+export declare function cliScriptPath(name: string): string;
 export interface RunProtectedCheckOptions {
     readonly nodeExecutable?: string;
     readonly timeout?: number;

package/dist/pr-wait-mergeable/wrappers.js

@@ -1,4 +1,6 @@
 import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveBinary } from "../scm/binary.js";
@@ -40,9 +42,36 @@ export function captureExec(executable, args, timeoutMs, options = {}) {
         stderr: typeof result.stderr === "string" ? result.stderr : "",
     };
 }
-function cliScriptPath(name) {
+/**
+ * Resolve a CLI entry script for subprocess spawn (#2615).
+ *
+ * Published npm layout nests `@deftai/directive-core` under `@deftai/directive`,
+ * so the old `../../../cli/dist` relative path resolved to a non-existent
+ * `@deftai/cli` sibling. Prefer the published package root, then monorepo path,
+ * then nested `@deftai/directive/dist`.
+ */
+export function cliScriptPath(name) {
+    const script = `${name}.js`;
     const here = dirname(fileURLToPath(import.meta.url));
-    return resolve(here, "../../../cli/dist", `${name}.js`);
+    const candidates = [];
+    try {
+        const require = createRequire(import.meta.url);
+        const pkgJson = require.resolve("@deftai/directive/package.json");
+        candidates.push(resolve(dirname(pkgJson), "dist", script));
+    }
+    catch {
+        // Core does not declare a runtime dependency on the CLI package; ignore.
+    }
+    // Monorepo: packages/core/dist/pr-wait-mergeable -> packages/cli/dist
+    candidates.push(resolve(here, "../../../cli/dist", script));
+    // npm nested: .../directive/node_modules/@deftai/directive-core/dist/... -> .../directive/dist
+    candidates.push(resolve(here, "../../../../dist", script));
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    // ENOENT path for actionable errors — monorepo layout is the stable fallback.
+    return resolve(here, "../../../cli/dist", script);
 }
 /** Invoke pr-protected-issues CLI and return (returncode, stdout, stderr). */
 export function runProtectedCheck(prNumber, repo, protectedIssues, options = {}) {

package/dist/release/constants.js

@@ -64,6 +64,8 @@ export const RELEASE_HELP = "usage: release [-h] [--dry-run] [--skip-tag] [--ski
     "                        Acknowledge a hairline coverage miss: Step 5 passes\n" +
     "                        only when metrics sit below the 85% goal and this\n" +
     "                        flag cites an operator-owned issue number (#2573).\n" +
+    "                        PowerShell: use --allow-coverage-debt=N (no bare #)\n" +
+    '                        or quote "#N"; unquoted # starts a comment (#2621).\n' +
     "  --skip-ci             Skip Step 3 (task ci:local / task check fallback).\n" +
     "                        Used by `task release:e2e` to keep wall-clock\n" +
     "                        manageable inside the auto-created temp repo (CI\n" +

package/dist/scope/demote.js

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleFolder } from "../layout/resolve.js";
 import { stripTrailingPathSeparators } from "../text/redos-safe.js";
 import { append, canonicalLogPath, latestForPath, newDecisionId } from "./audit-log.js";
@@ -51,6 +52,15 @@ export function demoteOne(filePath, projectRoot, reason, options = {}) {
             auditEntry: null,
         };
     }
+    try {
+        assertWriteTargetSafe(projectRoot, resolved);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            return { ok: false, message: err.message, auditEntry: null };
+        }
+        throw err;
+    }
     let data;
     try {
         data = JSON.parse(readFileSync(resolved, "utf8"));
@@ -129,6 +139,16 @@ export function batchDemote(projectRoot, olderThanDays, options = {}) {
         .sort();
     for (const name of files) {
         const candidate = join(pendingDir, name);
+        try {
+            assertWriteTargetSafe(projectRoot, candidate);
+        }
+        catch (err) {
+            if (err instanceof ProjectionContainmentError) {
+                skipped.push(`${name}: ${err.message}`);
+                continue;
+            }
+            throw err;
+        }
         let data;
         try {
             data = JSON.parse(readFileSync(candidate, "utf8"));

package/dist/swarm/worktrees.d.ts

@@ -18,6 +18,9 @@ export declare class DuplicateStoryError extends WorktreeMapError {
 export declare class WorktreeMapConfigError extends Error {
     name: string;
 }
+export declare class WorktreePathEscapeError extends WorktreeMapError {
+    name: string;
+}
 export type GitRunner = (args: readonly string[], cwd: string) => TextCaptureResult;
 export declare const defaultGitRunner: GitRunner;
 /** Case-normalized comparison key for worktree-path equality. */

package/dist/swarm/worktrees.js

@@ -1,5 +1,6 @@
 import { mkdirSync, readFileSync } from "node:fs";
-import { resolve as pathResolve } from "node:path";
+import { isAbsolute, resolve as pathResolve } from "node:path";
+import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { C3_FIELDS } from "./constants.js";
 import { runText } from "./subprocess.js";
 export class WorktreeMapError extends Error {
@@ -20,11 +21,25 @@ export class DuplicateStoryError extends WorktreeMapError {
 export class WorktreeMapConfigError extends Error {
     name = "WorktreeMapConfigError";
 }
+export class WorktreePathEscapeError extends WorktreeMapError {
+    name = "WorktreePathEscapeError";
+}
 export const defaultGitRunner = (args, cwd) => runText(["git", ...args], { cwd });
 function resolvePath(raw, repoRoot) {
-    const candidate = raw.startsWith("/") ? raw : pathResolve(repoRoot, raw);
+    const candidate = isAbsolute(raw) ? raw : pathResolve(repoRoot, raw);
     return pathResolve(candidate);
 }
+function assertWorktreePathContained(repoRoot, worktreePath) {
+    try {
+        assertProjectionContained(repoRoot, worktreePath);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            throw new WorktreePathEscapeError(`worktree_path must stay under the repository root: ${err.message}`);
+        }
+        throw err;
+    }
+}
 /** Case-normalized comparison key for worktree-path equality. */
 export function compareKey(pathStr) {
     return pathStr.replace(/\\/g, "/").toLowerCase();
@@ -119,6 +134,7 @@ export function resolveWorktreeMap(mapping, baseBranch, createMissing = true, op
             }
         }
         const worktreePath = resolvePath(rawPath.trim(), root);
+        assertWorktreePathContained(root, worktreePath);
         const key = compareKey(worktreePath);
         const posixPath = worktreePath.replace(/\\/g, "/");
         if (seenPaths.has(key)) {

package/dist/task-surface/index.js

@@ -1,13 +1,14 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { LEGACY_VBRIEF_VERSION } from "@deftai/directive-types";
 const UNRELEASED_RE = /## \[Unreleased\][ \t]*\n([\s\S]*?)(?=\n## \[|$)/;
 const CHANGE_NAME_RE = /^[\w][\w-]*$/;
 const COMMIT_TYPES = "feat|fix|docs|chore|refactor|test|style|perf|ci|build|revert";
 const COMMIT_SUBJECT_RE = new RegExp(`^(${COMMIT_TYPES})(\\(.+\\))?!?: .+`);
 function proposalTemplate(name) {
     return {
-        vBRIEFInfo: { version: "0.5" },
+        vBRIEFInfo: { version: LEGACY_VBRIEF_VERSION },
         plan: {
             title: name,
             status: "draft",
@@ -26,7 +27,7 @@ function proposalTemplate(name) {
 }
 function tasksTemplate(name) {
     return {
-        vBRIEFInfo: { version: "0.5" },
+        vBRIEFInfo: { version: LEGACY_VBRIEF_VERSION },
         plan: { title: name, status: "draft", items: [], edges: [] },
     };
 }

package/dist/vitest-runner/win32-coverage-tmp-setup.d.ts

@@ -1,12 +1,20 @@
+/** Matches Vitest v8 chunk paths such as coverage/.tmp/coverage-0.json (#2580 / #2634). */
+export declare const COVERAGE_TMP_CHUNK_RE: RegExp;
+export declare function isCoverageTmpChunkPath(filePath: string): boolean;
+export declare function ensureCoverageTmpDir(coverageTmpDir?: string): void;
 /**
- * Win32 globalSetup for coverage runs (#2580).
+ * Vitest 3.2.x writes coverage chunks without mkdir'ing the parent directory
+ * (fixed upstream in vitest 4.x — vitest-dev/vitest#10117). On Windows the
+ * directory can disappear between clean() and writeFile under release-scale
+ * load; mkdir immediately before chunk writes closes that race without
+ * soft-failing real threshold failures (#2634).
+ */
+export declare function installCoverageTmpWriteGuard(): () => void;
+/**
+ * Win32 globalSetup for coverage runs (#2580, hardened #2634).
  *
- * Vitest's v8 provider writes per-suite JSON under coverage/.tmp without always
- * re-mkdir'ing before writeFile. Under parallel fork load the directory can
- * disappear mid-suite, surfacing as ENOENT after an otherwise green run.
- * Keep the directory present for the coordinator process; late ENOENT flakes
- * are tolerated via vitest dangerouslyIgnoreUnhandledErrors (#2546) without
- * soft-failing real coverage threshold failures.
+ * Keepalive mkdir plus a writeFile guard mirror vitest 4's defensive mkdir until
+ * directive upgrades past vitest@3 (see vitest.config.ts #2634 upgrade note).
  */
-export default function setup(): void;
+export default function setup(): () => void;
 //# sourceMappingURL=win32-coverage-tmp-setup.d.ts.map

package/dist/vitest-runner/win32-coverage-tmp-setup.js

@@ -1,24 +1,51 @@
-import { mkdirSync } from "node:fs";
-import { resolve } from "node:path";
-const COVERAGE_TMP = resolve(process.cwd(), "coverage", ".tmp");
-function ensureCoverageTmpDir() {
-    mkdirSync(COVERAGE_TMP, { recursive: true });
+import { promises as fsPromises, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+/** Matches Vitest v8 chunk paths such as coverage/.tmp/coverage-0.json (#2580 / #2634). */
+export const COVERAGE_TMP_CHUNK_RE = /[/\\]coverage[/\\]\.tmp[/\\]coverage-\d+\.json$/;
+const defaultCoverageTmp = resolve(process.cwd(), "coverage", ".tmp");
+export function isCoverageTmpChunkPath(filePath) {
+    return COVERAGE_TMP_CHUNK_RE.test(filePath.replace(/\\/g, "/"));
+}
+export function ensureCoverageTmpDir(coverageTmpDir = defaultCoverageTmp) {
+    mkdirSync(coverageTmpDir, { recursive: true });
+}
+/**
+ * Vitest 3.2.x writes coverage chunks without mkdir'ing the parent directory
+ * (fixed upstream in vitest 4.x — vitest-dev/vitest#10117). On Windows the
+ * directory can disappear between clean() and writeFile under release-scale
+ * load; mkdir immediately before chunk writes closes that race without
+ * soft-failing real threshold failures (#2634).
+ */
+export function installCoverageTmpWriteGuard() {
+    const originalWriteFile = fsPromises.writeFile.bind(fsPromises);
+    const patchedWriteFile = async (path, ...args) => {
+        const target = typeof path === "string" ? path : String(path);
+        if (isCoverageTmpChunkPath(target)) {
+            mkdirSync(dirname(target), { recursive: true });
+        }
+        return originalWriteFile(path, ...args);
+    };
+    fsPromises.writeFile = patchedWriteFile;
+    return () => {
+        fsPromises.writeFile = originalWriteFile;
+    };
 }
 /**
- * Win32 globalSetup for coverage runs (#2580).
+ * Win32 globalSetup for coverage runs (#2580, hardened #2634).
  *
- * Vitest's v8 provider writes per-suite JSON under coverage/.tmp without always
- * re-mkdir'ing before writeFile. Under parallel fork load the directory can
- * disappear mid-suite, surfacing as ENOENT after an otherwise green run.
- * Keep the directory present for the coordinator process; late ENOENT flakes
- * are tolerated via vitest dangerouslyIgnoreUnhandledErrors (#2546) without
- * soft-failing real coverage threshold failures.
+ * Keepalive mkdir plus a writeFile guard mirror vitest 4's defensive mkdir until
+ * directive upgrades past vitest@3 (see vitest.config.ts #2634 upgrade note).
  */
 export default function setup() {
     if (process.platform !== "win32")
-        return;
+        return () => { };
     ensureCoverageTmpDir();
-    const keepalive = setInterval(ensureCoverageTmpDir, 100);
+    const uninstallWriteGuard = installCoverageTmpWriteGuard();
+    const keepalive = setInterval(() => ensureCoverageTmpDir(), 50);
     keepalive.unref?.();
+    return () => {
+        clearInterval(keepalive);
+        uninstallWriteGuard();
+    };
 }
 //# sourceMappingURL=win32-coverage-tmp-setup.js.map

package/dist/xbrief-migrate/migration-containment.js

@@ -1,37 +1,21 @@
-import { lstatSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { assertProjectionContained } from "../fs/projection-containment.js";
+import { assertProjectionContained, ProjectionContainmentError, walkDirectoryRejectSymlinks, } from "../fs/projection-containment.js";
 /**
  * Refuse migrate:xbrief when legacy `vbrief/` (or any traversed entry) escapes
  * the project tree via symlinks (#2601).
  */
 export function assertMigrationSourceSafe(projectRoot, legacyDir) {
     assertProjectionContained(projectRoot, legacyDir);
-    walkMigrationTreeRejectSymlinks(legacyDir);
-}
-function walkMigrationTreeRejectSymlinks(root) {
-    let entries;
     try {
-        entries = readdirSync(root, { withFileTypes: true });
-    }
-    catch {
-        return;
+        walkDirectoryRejectSymlinks(legacyDir);
     }
-    for (const entry of entries) {
-        const full = join(root, entry.name);
-        let info;
-        try {
-            info = lstatSync(full);
-        }
-        catch {
-            continue;
-        }
-        if (info.isSymbolicLink()) {
-            throw new Error(`refusing to migrate: symlink on migration path: ${full}`);
-        }
-        if (info.isDirectory()) {
-            walkMigrationTreeRejectSymlinks(full);
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            const nested = err.message.match(/symlink on traversal path: (.+)$/);
+            if (nested) {
+                throw new Error(`refusing to migrate: symlink on migration path: ${nested[1]}`);
+            }
         }
+        throw err;
     }
 }
 //# sourceMappingURL=migration-containment.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.79.0",
+  "version": "0.79.2",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -305,8 +305,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.79.0",
-    "@deftai/directive-types": "^0.79.0",
+    "@deftai/directive-content": "^0.79.2",
+    "@deftai/directive-types": "^0.79.2",
     "archiver": "^8.0.0"
   },
   "scripts": {