@deftai/directive-core 0.79.1 → 0.79.2

package/dist/pr-merge-readiness/index.js

@@ -3,6 +3,7 @@ export { computeGateResult } from "./compute.js";
 export * from "./constants.js";
 export { evaluateGates, isMergeReady } from "./evaluate.js";
 export { defaultRunGh } from "./gh.js";
+export { evaluateInlineReviewThreads, fetchUnresolvedGreptileInlineFindings, headShaMatches, inlineFindingsToDict, } from "./greptile-inline.js";
 export { cmdPrMergeReadiness, parseArgs, run } from "./main.js";
 export { fetchMergeability, isGithubMergeableClean, MERGE_STATE_CLEAN, mergeabilityToDict, verdictBlockIsSoftOnly, verdictShaIsStale, } from "./mergeability.js";
 export { emitJson, exitCodeFor, gateResultToDict, printHuman } from "./output.js";

package/dist/pr-merge-readiness/mergeability.d.ts

@@ -1,3 +1,4 @@
+import type { InlineGreptileFindings } from "./greptile-inline.js";
 import type { GreptileVerdict, RunGhFn } from "./types.js";
 /**
  * GitHub's authoritative mergeability signal, read over REST (#2260).
@@ -41,5 +42,5 @@ export declare function verdictShaIsStale(verdict: GreptileVerdict, headSha: str
  * regardless of GitHub mergeability (guardrail: do not merge a PR with a real
  * P0/P1 review finding).
  */
-export declare function verdictBlockIsSoftOnly(verdict: GreptileVerdict, headSha: string | null): boolean;
+export declare function verdictBlockIsSoftOnly(verdict: GreptileVerdict, headSha: string | null, inline?: InlineGreptileFindings | null): boolean;
 //# sourceMappingURL=mergeability.d.ts.map

package/dist/pr-merge-readiness/mergeability.js

@@ -75,7 +75,13 @@ export function verdictShaIsStale(verdict, headSha) {
  * regardless of GitHub mergeability (guardrail: do not merge a PR with a real
  * P0/P1 review finding).
  */
-export function verdictBlockIsSoftOnly(verdict, headSha) {
+export function verdictBlockIsSoftOnly(verdict, headSha, inline = null) {
+    if (inline !== null && inline.error !== null) {
+        return false;
+    }
+    if (inline !== null && inline.error === null && (inline.p0Count > 0 || inline.p1Count > 0)) {
+        return false;
+    }
     // Absent: no Greptile rolling-summary comment at all.
     if (!verdict.found) {
         return true;

package/dist/scope/demote.js

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleFolder } from "../layout/resolve.js";
 import { stripTrailingPathSeparators } from "../text/redos-safe.js";
 import { append, canonicalLogPath, latestForPath, newDecisionId } from "./audit-log.js";
@@ -51,6 +52,15 @@ export function demoteOne(filePath, projectRoot, reason, options = {}) {
             auditEntry: null,
         };
     }
+    try {
+        assertWriteTargetSafe(projectRoot, resolved);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            return { ok: false, message: err.message, auditEntry: null };
+        }
+        throw err;
+    }
     let data;
     try {
         data = JSON.parse(readFileSync(resolved, "utf8"));
@@ -129,6 +139,16 @@ export function batchDemote(projectRoot, olderThanDays, options = {}) {
         .sort();
     for (const name of files) {
         const candidate = join(pendingDir, name);
+        try {
+            assertWriteTargetSafe(projectRoot, candidate);
+        }
+        catch (err) {
+            if (err instanceof ProjectionContainmentError) {
+                skipped.push(`${name}: ${err.message}`);
+                continue;
+            }
+            throw err;
+        }
         let data;
         try {
             data = JSON.parse(readFileSync(candidate, "utf8"));

package/dist/swarm/worktrees.d.ts

@@ -18,6 +18,9 @@ export declare class DuplicateStoryError extends WorktreeMapError {
 export declare class WorktreeMapConfigError extends Error {
     name: string;
 }
+export declare class WorktreePathEscapeError extends WorktreeMapError {
+    name: string;
+}
 export type GitRunner = (args: readonly string[], cwd: string) => TextCaptureResult;
 export declare const defaultGitRunner: GitRunner;
 /** Case-normalized comparison key for worktree-path equality. */

package/dist/swarm/worktrees.js

@@ -1,5 +1,6 @@
 import { mkdirSync, readFileSync } from "node:fs";
-import { resolve as pathResolve } from "node:path";
+import { isAbsolute, resolve as pathResolve } from "node:path";
+import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { C3_FIELDS } from "./constants.js";
 import { runText } from "./subprocess.js";
 export class WorktreeMapError extends Error {
@@ -20,11 +21,25 @@ export class DuplicateStoryError extends WorktreeMapError {
 export class WorktreeMapConfigError extends Error {
     name = "WorktreeMapConfigError";
 }
+export class WorktreePathEscapeError extends WorktreeMapError {
+    name = "WorktreePathEscapeError";
+}
 export const defaultGitRunner = (args, cwd) => runText(["git", ...args], { cwd });
 function resolvePath(raw, repoRoot) {
-    const candidate = raw.startsWith("/") ? raw : pathResolve(repoRoot, raw);
+    const candidate = isAbsolute(raw) ? raw : pathResolve(repoRoot, raw);
     return pathResolve(candidate);
 }
+function assertWorktreePathContained(repoRoot, worktreePath) {
+    try {
+        assertProjectionContained(repoRoot, worktreePath);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            throw new WorktreePathEscapeError(`worktree_path must stay under the repository root: ${err.message}`);
+        }
+        throw err;
+    }
+}
 /** Case-normalized comparison key for worktree-path equality. */
 export function compareKey(pathStr) {
     return pathStr.replace(/\\/g, "/").toLowerCase();
@@ -119,6 +134,7 @@ export function resolveWorktreeMap(mapping, baseBranch, createMissing = true, op
             }
         }
         const worktreePath = resolvePath(rawPath.trim(), root);
+        assertWorktreePathContained(root, worktreePath);
         const key = compareKey(worktreePath);
         const posixPath = worktreePath.replace(/\\/g, "/");
         if (seenPaths.has(key)) {

package/dist/task-surface/index.js

@@ -1,13 +1,14 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { LEGACY_VBRIEF_VERSION } from "@deftai/directive-types";
 const UNRELEASED_RE = /## \[Unreleased\][ \t]*\n([\s\S]*?)(?=\n## \[|$)/;
 const CHANGE_NAME_RE = /^[\w][\w-]*$/;
 const COMMIT_TYPES = "feat|fix|docs|chore|refactor|test|style|perf|ci|build|revert";
 const COMMIT_SUBJECT_RE = new RegExp(`^(${COMMIT_TYPES})(\\(.+\\))?!?: .+`);
 function proposalTemplate(name) {
     return {
-        vBRIEFInfo: { version: "0.5" },
+        vBRIEFInfo: { version: LEGACY_VBRIEF_VERSION },
         plan: {
             title: name,
             status: "draft",
@@ -26,7 +27,7 @@ function proposalTemplate(name) {
 }
 function tasksTemplate(name) {
     return {
-        vBRIEFInfo: { version: "0.5" },
+        vBRIEFInfo: { version: LEGACY_VBRIEF_VERSION },
         plan: { title: name, status: "draft", items: [], edges: [] },
     };
 }

package/dist/vitest-runner/win32-coverage-tmp-setup.d.ts

@@ -1,12 +1,20 @@
+/** Matches Vitest v8 chunk paths such as coverage/.tmp/coverage-0.json (#2580 / #2634). */
+export declare const COVERAGE_TMP_CHUNK_RE: RegExp;
+export declare function isCoverageTmpChunkPath(filePath: string): boolean;
+export declare function ensureCoverageTmpDir(coverageTmpDir?: string): void;
 /**
- * Win32 globalSetup for coverage runs (#2580).
+ * Vitest 3.2.x writes coverage chunks without mkdir'ing the parent directory
+ * (fixed upstream in vitest 4.x — vitest-dev/vitest#10117). On Windows the
+ * directory can disappear between clean() and writeFile under release-scale
+ * load; mkdir immediately before chunk writes closes that race without
+ * soft-failing real threshold failures (#2634).
+ */
+export declare function installCoverageTmpWriteGuard(): () => void;
+/**
+ * Win32 globalSetup for coverage runs (#2580, hardened #2634).
  *
- * Vitest's v8 provider writes per-suite JSON under coverage/.tmp without always
- * re-mkdir'ing before writeFile. Under parallel fork load the directory can
- * disappear mid-suite, surfacing as ENOENT after an otherwise green run.
- * Keep the directory present for the coordinator process; late ENOENT flakes
- * are tolerated via vitest dangerouslyIgnoreUnhandledErrors (#2546) without
- * soft-failing real coverage threshold failures.
+ * Keepalive mkdir plus a writeFile guard mirror vitest 4's defensive mkdir until
+ * directive upgrades past vitest@3 (see vitest.config.ts #2634 upgrade note).
  */
-export default function setup(): void;
+export default function setup(): () => void;
 //# sourceMappingURL=win32-coverage-tmp-setup.d.ts.map

package/dist/vitest-runner/win32-coverage-tmp-setup.js

@@ -1,24 +1,51 @@
-import { mkdirSync } from "node:fs";
-import { resolve } from "node:path";
-const COVERAGE_TMP = resolve(process.cwd(), "coverage", ".tmp");
-function ensureCoverageTmpDir() {
-    mkdirSync(COVERAGE_TMP, { recursive: true });
+import { promises as fsPromises, mkdirSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+/** Matches Vitest v8 chunk paths such as coverage/.tmp/coverage-0.json (#2580 / #2634). */
+export const COVERAGE_TMP_CHUNK_RE = /[/\\]coverage[/\\]\.tmp[/\\]coverage-\d+\.json$/;
+const defaultCoverageTmp = resolve(process.cwd(), "coverage", ".tmp");
+export function isCoverageTmpChunkPath(filePath) {
+    return COVERAGE_TMP_CHUNK_RE.test(filePath.replace(/\\/g, "/"));
+}
+export function ensureCoverageTmpDir(coverageTmpDir = defaultCoverageTmp) {
+    mkdirSync(coverageTmpDir, { recursive: true });
+}
+/**
+ * Vitest 3.2.x writes coverage chunks without mkdir'ing the parent directory
+ * (fixed upstream in vitest 4.x — vitest-dev/vitest#10117). On Windows the
+ * directory can disappear between clean() and writeFile under release-scale
+ * load; mkdir immediately before chunk writes closes that race without
+ * soft-failing real threshold failures (#2634).
+ */
+export function installCoverageTmpWriteGuard() {
+    const originalWriteFile = fsPromises.writeFile.bind(fsPromises);
+    const patchedWriteFile = async (path, ...args) => {
+        const target = typeof path === "string" ? path : String(path);
+        if (isCoverageTmpChunkPath(target)) {
+            mkdirSync(dirname(target), { recursive: true });
+        }
+        return originalWriteFile(path, ...args);
+    };
+    fsPromises.writeFile = patchedWriteFile;
+    return () => {
+        fsPromises.writeFile = originalWriteFile;
+    };
 }
 /**
- * Win32 globalSetup for coverage runs (#2580).
+ * Win32 globalSetup for coverage runs (#2580, hardened #2634).
  *
- * Vitest's v8 provider writes per-suite JSON under coverage/.tmp without always
- * re-mkdir'ing before writeFile. Under parallel fork load the directory can
- * disappear mid-suite, surfacing as ENOENT after an otherwise green run.
- * Keep the directory present for the coordinator process; late ENOENT flakes
- * are tolerated via vitest dangerouslyIgnoreUnhandledErrors (#2546) without
- * soft-failing real coverage threshold failures.
+ * Keepalive mkdir plus a writeFile guard mirror vitest 4's defensive mkdir until
+ * directive upgrades past vitest@3 (see vitest.config.ts #2634 upgrade note).
  */
 export default function setup() {
     if (process.platform !== "win32")
-        return;
+        return () => { };
     ensureCoverageTmpDir();
-    const keepalive = setInterval(ensureCoverageTmpDir, 100);
+    const uninstallWriteGuard = installCoverageTmpWriteGuard();
+    const keepalive = setInterval(() => ensureCoverageTmpDir(), 50);
     keepalive.unref?.();
+    return () => {
+        clearInterval(keepalive);
+        uninstallWriteGuard();
+    };
 }
 //# sourceMappingURL=win32-coverage-tmp-setup.js.map

package/dist/xbrief-migrate/migration-containment.js

@@ -1,37 +1,21 @@
-import { lstatSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-import { assertProjectionContained } from "../fs/projection-containment.js";
+import { assertProjectionContained, ProjectionContainmentError, walkDirectoryRejectSymlinks, } from "../fs/projection-containment.js";
 /**
  * Refuse migrate:xbrief when legacy `vbrief/` (or any traversed entry) escapes
  * the project tree via symlinks (#2601).
  */
 export function assertMigrationSourceSafe(projectRoot, legacyDir) {
     assertProjectionContained(projectRoot, legacyDir);
-    walkMigrationTreeRejectSymlinks(legacyDir);
-}
-function walkMigrationTreeRejectSymlinks(root) {
-    let entries;
     try {
-        entries = readdirSync(root, { withFileTypes: true });
-    }
-    catch {
-        return;
+        walkDirectoryRejectSymlinks(legacyDir);
     }
-    for (const entry of entries) {
-        const full = join(root, entry.name);
-        let info;
-        try {
-            info = lstatSync(full);
-        }
-        catch {
-            continue;
-        }
-        if (info.isSymbolicLink()) {
-            throw new Error(`refusing to migrate: symlink on migration path: ${full}`);
-        }
-        if (info.isDirectory()) {
-            walkMigrationTreeRejectSymlinks(full);
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            const nested = err.message.match(/symlink on traversal path: (.+)$/);
+            if (nested) {
+                throw new Error(`refusing to migrate: symlink on migration path: ${nested[1]}`);
+            }
         }
+        throw err;
     }
 }
 //# sourceMappingURL=migration-containment.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.79.1",
+  "version": "0.79.2",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -305,8 +305,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.79.1",
-    "@deftai/directive-types": "^0.79.1",
+    "@deftai/directive-content": "^0.79.2",
+    "@deftai/directive-types": "^0.79.2",
     "archiver": "^8.0.0"
   },
   "scripts": {