@deftai/directive-core 0.81.0 → 0.82.0

package/dist/scope/registry-artifact-sync.js

@@ -1,7 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
-import { formatVbriefJson } from "./vbrief-json.js";
+import { atomicWriteText } from "../cache/io.js";
+import { formatBriefJson } from "./brief-io.js";
 import { relativeToVbrief, resolveVbriefRef, scopeIdsForFilename } from "./vbrief-ref.js";
 function rewriteRegistryPlanReference(ref, oldResolved, newRel, vbriefRoot) {
     if (typeof ref !== "object" || ref === null || Array.isArray(ref)) {
@@ -88,20 +89,30 @@ function registryItemMatchesScope(item, scopeData, oldPath, newPath, vbriefRoot)
     return (typeof scopeTitle === "string" && typeof itemTitle === "string" && itemTitle === scopeTitle);
 }
 /** Best-effort sync of a registry artifact (PROJECT-DEFINITION, specification, etc.) after a lifecycle move. */
-export function syncRegistryArtifactAfterScopeMove(registryPath, scopeData, oldPath, newPath, vbriefRoot, targetStatus) {
+export function syncRegistryArtifactAfterScopeMove(registryPath, scopeData, oldPath, newPath, vbriefRoot, targetStatus, hooks = {}) {
     const newRel = relativeToVbrief(newPath, vbriefRoot);
     if (newRel === null) {
         return;
     }
-    if (!existsSync(registryPath)) {
-        return;
-    }
     try {
-        const parsed = JSON.parse(readFileSync(registryPath, "utf8"));
-        if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-            return;
+        let registry;
+        if (hooks.loadForMutation !== undefined) {
+            if (!existsSync(registryPath)) {
+                return;
+            }
+            const [loaded] = hooks.loadForMutation();
+            registry = loaded;
+        }
+        else {
+            if (!existsSync(registryPath)) {
+                return;
+            }
+            const parsed = JSON.parse(readFileSync(registryPath, "utf8"));
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                return;
+            }
+            registry = parsed;
         }
-        const registry = parsed;
         const plan = registry.plan;
         if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
             return;
@@ -149,11 +160,18 @@ export function syncRegistryArtifactAfterScopeMove(registryPath, scopeData, oldP
             }
         }
         if (changed) {
-            writeFileSync(registryPath, formatVbriefJson(registry), "utf8");
+            if (hooks.persist !== undefined) {
+                hooks.persist(registryPath, registry);
+            }
+            else {
+                atomicWriteText(registryPath, formatBriefJson(registry));
+            }
         }
     }
-    catch {
-        /* best-effort */
+    catch (err) {
+        if (hooks.loadForMutation !== undefined || hooks.persist !== undefined) {
+            throw err;
+        }
     }
 }
 //# sourceMappingURL=registry-artifact-sync.js.map

package/dist/scope/transition.js

@@ -1,15 +1,16 @@
-import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
+import { existsSync, mkdirSync, unlinkSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { InstrumentedVbriefCrud, persistCrudMetrics } from "../eval/crud-telemetry.js";
 import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { hasArtifactSuffix } from "../layout/resolve.js";
 import { append, canonicalLogPath, newDecisionId } from "./audit-log.js";
+import { atomicWriteBrief, formatBriefJson, readBriefForMutation } from "./brief-io.js";
 import { stampCompletionMetadata } from "./capacity-stamp.js";
 import { LIFECYCLE_FOLDERS, MOVE_LABELS, STATUS_PRECONDITIONS, STAY_LABELS, TRANSITIONS, } from "./constants.js";
 import { detectLifecycleFolder, updateDecomposedChildBackReferences, updateDecomposedParentBackReferences, } from "./decomposed-refs.js";
 import { syncProjectDefinitionAfterScopeMove } from "./project-definition-sync.js";
 import { syncSpecificationAfterScopeMove } from "./specification-sync.js";
-import { formatVbriefJson, utcNowIso } from "./vbrief-json.js";
+import { utcNowIso } from "./vbrief-json.js";
 export function runTransition(action, filePath, now = new Date()) {
     if (!(action in TRANSITIONS)) {
         const valid = Object.keys(TRANSITIONS).sort().join(", ");
@@ -43,13 +44,11 @@ export function runTransition(action, filePath, now = new Date()) {
                 `File is in ${currentFolder}/.`,
         };
     }
-    let data;
-    try {
-        data = JSON.parse(readFileSync(resolvedPath, "utf8"));
-    }
-    catch (err) {
-        return { ok: false, message: `Invalid JSON in ${resolvedPath}: ${String(err)}` };
+    const readResult = readBriefForMutation(resolvedPath);
+    if (!readResult.ok) {
+        return { ok: false, message: readResult.message };
     }
+    const data = readResult.data;
     const plan = data.plan;
     if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
         return { ok: false, message: `Missing or invalid 'plan' object in ${resolvedPath}` };
@@ -100,7 +99,7 @@ export function runTransition(action, filePath, now = new Date()) {
     if (act === "complete") {
         stampCompletionMetadata(planObj, projectRoot, nowIso);
     }
-    const formatted = formatVbriefJson(data);
+    const formatted = formatBriefJson(data);
     const crud = new InstrumentedVbriefCrud({ now: () => now });
     if (targetFolder !== null) {
         const destDir = join(vbriefRoot, targetFolder);
@@ -111,10 +110,11 @@ export function runTransition(action, filePath, now = new Date()) {
         }
         // #2578: stamp terminal status at the destination path in the same write as
         // folder placement — never leave a non-terminal status under completed/.
-        const writeResult = crud.update(destPath, formatted, { trustedWrite: true });
+        const writeResult = atomicWriteBrief(destPath, data, vbriefRoot);
         if (!writeResult.ok) {
-            return { ok: false, message: writeResult.error ?? `CRUD update failed for ${destPath}` };
+            return { ok: false, message: writeResult.message };
         }
+        crud.recordTrustedUpdate(destPath, formatted);
         try {
             unlinkSync(resolvedPath);
         }
@@ -135,18 +135,26 @@ export function runTransition(action, filePath, now = new Date()) {
         }
         updateDecomposedParentBackReferences(data, resolvedPath, destPath, vbriefRoot);
         updateDecomposedChildBackReferences(data, resolvedPath, destPath, vbriefRoot);
-        syncProjectDefinitionAfterScopeMove(data, resolvedPath, destPath, vbriefRoot, targetStatus);
-        syncSpecificationAfterScopeMove(data, resolvedPath, destPath, vbriefRoot, targetStatus);
         const actionLabel = MOVE_LABELS[act] ?? act.charAt(0).toUpperCase() + act.slice(1);
+        const pdSyncError = syncProjectDefinitionAfterScopeMove(data, resolvedPath, destPath, vbriefRoot, targetStatus);
+        if (pdSyncError !== null) {
+            return {
+                ok: false,
+                message: `${actionLabel} ${basename}: brief moved to ${targetFolder}/ but ` +
+                    `PROJECT-DEFINITION sync failed: ${pdSyncError}`,
+            };
+        }
+        syncSpecificationAfterScopeMove(data, resolvedPath, destPath, vbriefRoot, targetStatus);
         return {
             ok: true,
             message: `${actionLabel} ${basename}: ${currentFolder}/ -> ${targetFolder}/ (status: ${targetStatus})`,
         };
     }
-    const writeResult = crud.update(resolvedPath, formatted, { trustedWrite: true });
+    const writeResult = atomicWriteBrief(resolvedPath, data, vbriefRoot);
     if (!writeResult.ok) {
-        return { ok: false, message: writeResult.error ?? `CRUD update failed for ${resolvedPath}` };
+        return { ok: false, message: writeResult.message };
     }
+    crud.recordTrustedUpdate(resolvedPath, formatted);
     try {
         persistCrudMetrics(projectRoot, crud.getMetrics());
     }

package/dist/scope/undo.js

@@ -4,7 +4,7 @@ import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/project
 import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { append, canonicalLogPath, newDecisionId, readAll } from "./audit-log.js";
 import { REVERSIBLE_ACTIONS, TERMINAL_ACTIONS } from "./constants.js";
-import { formatVbriefJson, utcNowIso } from "./vbrief-json.js";
+import { formatBriefJson, utcNowIso } from "./vbrief-json.js";
 function vbriefRoot(projectRoot) {
     return resolveLifecycleRoot(projectRoot);
 }
@@ -185,7 +185,7 @@ function moveAndFlip(srcFile, destFolder, newStatus, timestamp, projectRoot) {
     const planObj = plan;
     planObj.status = newStatus;
     planObj.updated = timestamp;
-    writeFileSync(srcFile, formatVbriefJson(data), "utf8");
+    writeFileSync(srcFile, formatBriefJson(data), "utf8");
     mkdirSync(destFolder, { recursive: true });
     const destPath = join(destFolder, basename(srcFile));
     renameSync(srcFile, destPath);

package/dist/scope/vbrief-json.d.ts

@@ -1,4 +1,3 @@
-/** Format vBRIEF JSON like Python json.dumps(..., indent=2, ensure_ascii=False) + newline. */
-export declare function formatVbriefJson(data: unknown): string;
+export { formatBriefJson } from "./brief-io.js";
 export declare function utcNowIso(now?: Date): string;
 //# sourceMappingURL=vbrief-json.d.ts.map

package/dist/scope/vbrief-json.js

@@ -1,7 +1,4 @@
-/** Format vBRIEF JSON like Python json.dumps(..., indent=2, ensure_ascii=False) + newline. */
-export function formatVbriefJson(data) {
-    return `${JSON.stringify(data, null, 2)}\n`;
-}
+export { formatBriefJson } from "./brief-io.js";
 export function utcNowIso(now = new Date()) {
     return now.toISOString().replace(/\.\d{3}Z$/, "Z");
 }

package/dist/staleness-tickler/state.js

@@ -1,6 +1,11 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { resolveTriageCachePath } from "../triage/cache-path.js";
 export const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", "staleness-tickler-state.json");
+const STATE_FILE_NAME = "staleness-tickler-state.json";
+function resolveStalenessTicklerStatePath(projectRoot) {
+    return resolveTriageCachePath(projectRoot, STATE_FILE_NAME);
+}
 function defaultReadText(path) {
     try {
         return readFileSync(path, "utf8");
@@ -31,11 +36,23 @@ export function parseStalenessTicklerState(text) {
     return {};
 }
 export function loadStalenessTicklerState(projectRoot, io = {}) {
-    const path = join(projectRoot, STATE_RELATIVE_PATH);
+    let path;
+    try {
+        path = resolveStalenessTicklerStatePath(projectRoot);
+    }
+    catch {
+        return {};
+    }
     return parseStalenessTicklerState((io.readText ?? defaultReadText)(path));
 }
 export function saveStalenessTicklerState(projectRoot, state, io = {}) {
-    const path = join(projectRoot, STATE_RELATIVE_PATH);
+    let path;
+    try {
+        path = resolveStalenessTicklerStatePath(projectRoot);
+    }
+    catch {
+        return;
+    }
     try {
         (io.writeText ?? defaultWriteText)(path, `${JSON.stringify(state, null, 2)}\n`);
     }

package/dist/triage/queue/cache.js

@@ -213,6 +213,11 @@ export function loadCachedIssues(repo, options) {
         if (scanPassed === false) {
             continue;
         }
+        // cachePut writes content.md only when scan_result.passed is true; missing
+        // approved content means the entry was quarantined or tampered — fail closed.
+        if (scanPassed === true && !existsSync(join(entryDir, "content.md"))) {
+            continue;
+        }
         const rawTitle = typeof payload.title === "string" ? payload.title : "";
         const safeTitle = sanitizeQueueTitle(rawTitle);
         if (safeTitle === null) {

package/dist/verify-source/index.d.ts

@@ -6,5 +6,6 @@ export * from "./cursor-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/verify-source/index.js

@@ -6,5 +6,6 @@ export * from "./cursor-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.js.map

package/dist/verify-source/skill-external-fetch-gate.d.ts

@@ -0,0 +1,21 @@
+/**
+ * skill-external-fetch-gate.ts -- deterministic gate for fetch-then-execute skill prose (#1936 / #1532).
+ *
+ * Production entry for collectExternalFetchViolations: wired into
+ * `task verify:skill-external-fetch-gate` and `check:framework-source`.
+ *
+ * Exit codes (three-state):
+ *   0 -- clean: every shipped skill with external-fetch language has Security context mitigation.
+ *   1 -- drift: one or more skills pair fetch/follow-through with execute/install without mitigation.
+ *   2 -- config error: skills directory missing or unreadable.
+ */
+export interface SkillExternalFetchGateResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+}
+/**
+ * Evaluate the skill external-fetch gate for a framework-source or consumer tree.
+ */
+export declare function evaluateSkillExternalFetchGate(projectRoot: string): SkillExternalFetchGateResult;
+//# sourceMappingURL=skill-external-fetch-gate.d.ts.map

package/dist/verify-source/skill-external-fetch-gate.js

@@ -0,0 +1,71 @@
+/**
+ * skill-external-fetch-gate.ts -- deterministic gate for fetch-then-execute skill prose (#1936 / #1532).
+ *
+ * Production entry for collectExternalFetchViolations: wired into
+ * `task verify:skill-external-fetch-gate` and `check:framework-source`.
+ *
+ * Exit codes (three-state):
+ *   0 -- clean: every shipped skill with external-fetch language has Security context mitigation.
+ *   1 -- drift: one or more skills pair fetch/follow-through with execute/install without mitigation.
+ *   2 -- config error: skills directory missing or unreadable.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { listSkillMdEntriesFromRoot, listSkillMdFilesFromRoot, resolveContentPathFromRoot, } from "../content-contracts/skills/helpers.js";
+import { collectExternalFetchViolations } from "../content-contracts/skills/skill-external-fetch-gate.js";
+const EXIT_OK = 0;
+const EXIT_DRIFT = 1;
+const EXIT_CONFIG_ERROR = 2;
+function resolveSkillsRoot(projectRoot) {
+    const resolved = resolveContentPathFromRoot(resolve(projectRoot), "skills");
+    return existsSync(resolved) ? resolved : null;
+}
+/**
+ * Evaluate the skill external-fetch gate for a framework-source or consumer tree.
+ */
+export function evaluateSkillExternalFetchGate(projectRoot) {
+    const root = resolve(projectRoot);
+    const skillsRoot = resolveSkillsRoot(root);
+    if (skillsRoot === null) {
+        return {
+            code: EXIT_CONFIG_ERROR,
+            message: `skill external-fetch gate: skills directory not found under ${root}`,
+            stream: "stderr",
+        };
+    }
+    let entries;
+    try {
+        const skillPaths = listSkillMdFilesFromRoot(root);
+        if (skillPaths.length === 0) {
+            return {
+                code: EXIT_DRIFT,
+                message: `FAIL: skill external-fetch gate found no SKILL.md files under ${skillsRoot}`,
+                stream: "stderr",
+            };
+        }
+        entries = listSkillMdEntriesFromRoot(root);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            code: EXIT_CONFIG_ERROR,
+            message: `skill external-fetch gate: failed to read skills under ${skillsRoot}: ${msg}`,
+            stream: "stderr",
+        };
+    }
+    const violations = collectExternalFetchViolations(entries);
+    if (violations.length > 0) {
+        const sanitize = (value) => value.replace(/\r?\n/g, " ");
+        const lines = [
+            `FAIL: skill external-fetch gate detected ${violations.length} violation(s):`,
+            ...violations.map((v) => `  - ${sanitize(v.skillPath)}: ${sanitize(v.detail)}`),
+        ];
+        return { code: EXIT_DRIFT, message: lines.join("\n"), stream: "stderr" };
+    }
+    return {
+        code: EXIT_OK,
+        message: `OK: skill external-fetch gate clean -- ${entries.length} skill(s) scanned (root=${root.replace(/\r?\n/g, " ")}).`,
+        stream: "stdout",
+    };
+}
+//# sourceMappingURL=skill-external-fetch-gate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -30,6 +30,10 @@
       "types": "./dist/wip-cap/index.d.ts",
       "default": "./dist/wip-cap/index.js"
     },
+    "./orphan-active": {
+      "types": "./dist/orphan-active/index.d.ts",
+      "default": "./dist/orphan-active/index.js"
+    },
     "./agents-md-budget": {
       "types": "./dist/agents-md-budget/index.d.ts",
       "default": "./dist/agents-md-budget/index.js"
@@ -309,8 +313,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.81.0",
-    "@deftai/directive-types": "^0.81.0",
+    "@deftai/directive-content": "^0.82.0",
+    "@deftai/directive-types": "^0.82.0",
     "archiver": "^8.0.0"
   },
   "scripts": {