@deftai/directive-core 0.81.0 → 0.83.0

package/dist/content-contracts/skills/helpers.d.ts

@@ -8,6 +8,7 @@ export declare function repoPath(...segments: string[]): string;
  * first (SOURCE layout), then fall back to the repo root so root-resident
  * harness entries (AGENTS.md) and the flattened consumer layout still resolve.
  */
+export declare function resolveContentPathFromRoot(projectRoot: string, relPath: string): string;
 export declare function resolveRepoPath(relPath: string): string;
 export declare function readRepoFile(relPath: string): string;
 export declare function repoFileExists(relPath: string): boolean;
@@ -15,7 +16,12 @@ export declare function readSkill(relPath: string): string;
 export declare function readAgentsMd(): string;
 /** Slice the first `## Returning Sessions` section body out of AGENTS.md. */
 export declare function returningSessionsSection(): string;
+export declare function listSkillMdFilesFromRoot(projectRoot: string): string[];
 export declare function listSkillMdFiles(): string[];
+export declare function listSkillMdEntriesFromRoot(projectRoot: string): ReadonlyArray<{
+    path: string;
+    text: string;
+}>;
 export declare const RFC2119_LEGEND = "!=MUST, ~=SHOULD";
 export declare const PLATFORM_DETECTION_HEADING = "## Platform Detection";
 export declare const USER_MD_GATE_HEADING = "## USER.md Gate";

package/dist/content-contracts/skills/helpers.js

@@ -13,12 +13,15 @@ export function repoPath(...segments) {
  * first (SOURCE layout), then fall back to the repo root so root-resident
  * harness entries (AGENTS.md) and the flattened consumer layout still resolve.
  */
-export function resolveRepoPath(relPath) {
-    const underContent = join(REPO_ROOT, "content", relPath);
+export function resolveContentPathFromRoot(projectRoot, relPath) {
+    const underContent = join(projectRoot, "content", relPath);
     if (existsSync(underContent)) {
         return underContent;
     }
-    return repoPath(relPath);
+    return join(projectRoot, relPath);
+}
+export function resolveRepoPath(relPath) {
+    return resolveContentPathFromRoot(REPO_ROOT, relPath);
 }
 export function readRepoFile(relPath) {
     return readFileSync(resolveRepoPath(relPath), "utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n");
@@ -43,6 +46,26 @@ export function returningSessionsSection() {
     const nextHeading = rest.indexOf("\n## ");
     return nextHeading === -1 ? rest : rest.slice(0, nextHeading);
 }
+function skillsDirFromRoot(projectRoot) {
+    const resolved = resolveContentPathFromRoot(projectRoot, "skills");
+    return existsSync(resolved) ? resolved : null;
+}
+export function listSkillMdFilesFromRoot(projectRoot) {
+    const skillsDir = skillsDirFromRoot(projectRoot);
+    if (skillsDir === null) {
+        return [];
+    }
+    const results = [];
+    for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+            const skillMd = join(skillsDir, entry.name, "SKILL.md");
+            if (existsSync(skillMd)) {
+                results.push(join("skills", entry.name, "SKILL.md"));
+            }
+        }
+    }
+    return results.sort();
+}
 export function listSkillMdFiles() {
     const skillsDir = resolveRepoPath("skills");
     const results = [];
@@ -56,6 +79,27 @@ export function listSkillMdFiles() {
     }
     return results.sort();
 }
+export function listSkillMdEntriesFromRoot(projectRoot) {
+    const skillsDir = skillsDirFromRoot(projectRoot);
+    if (skillsDir === null) {
+        return [];
+    }
+    const entries = [];
+    for (const entry of readdirSync(skillsDir, { withFileTypes: true })) {
+        if (!entry.isDirectory()) {
+            continue;
+        }
+        const skillMd = join(skillsDir, entry.name, "SKILL.md");
+        if (!existsSync(skillMd)) {
+            continue;
+        }
+        entries.push({
+            path: join("skills", entry.name, "SKILL.md"),
+            text: readFileSync(skillMd, "utf8").replace(/\r\n/g, "\n").replace(/\r/g, "\n"),
+        });
+    }
+    return entries.sort((a, b) => a.path.localeCompare(b.path));
+}
 export const RFC2119_LEGEND = "!=MUST, ~=SHOULD";
 export const PLATFORM_DETECTION_HEADING = "## Platform Detection";
 export const USER_MD_GATE_HEADING = "## USER.md Gate";

package/dist/content-contracts/skills/skill-external-fetch-gate.d.ts

@@ -0,0 +1,18 @@
+/** Skill-validation gate: external fetch must not pair with execute/install without mitigation (#1532 / #1936). */
+export type ExternalFetchViolation = {
+    skillPath: string;
+    detail: string;
+};
+/** Strip YAML frontmatter and HTML comment banners before scanning skill prose. */
+export declare function skillProse(raw: string): string;
+export declare function hasExternalFetchSignal(prose: string): boolean;
+export declare function hasRiskyExternalFetchPattern(prose: string): boolean;
+export declare function hasExecuteFromExternalSignal(prose: string): boolean;
+export declare function hasUntrustedFetchMitigation(prose: string): boolean;
+export declare function analyzeSkillExternalFetch(skillPath: string, rawText: string): ExternalFetchViolation | null;
+/** Collect violations across skill entries (used by verify-source gate + tests). */
+export declare function collectExternalFetchViolations(entries: ReadonlyArray<{
+    path: string;
+    text: string;
+}>): ExternalFetchViolation[];
+//# sourceMappingURL=skill-external-fetch-gate.d.ts.map

package/dist/content-contracts/skills/skill-external-fetch-gate.js

@@ -0,0 +1,81 @@
+/** Skill-validation gate: external fetch must not pair with execute/install without mitigation (#1532 / #1936). */
+const EXTERNAL_FETCH_RE = /\b(fetch(?:ing)?(?:\s+\w+){0,6}\s+(?:the\s+)?(?:url|content|article|related\s+urls?|http|https|web\s+page)|fetch\s+and\s+read|webfetch|mcp.*fetch)/i;
+const EXECUTE_FROM_EXTERNAL_RE = /\b(download|install|run|execute)\b.{0,40}\b(?:found|inside|within|in)\b.{0,40}\b(?:fetched|external|url|content|page|article)\b|\bfollow\b.{0,40}\b(?:instructions?|commands?)\b.{0,40}\b(?:download|install|run|execute)\b|\bexecute\b.{0,40}\b(?:commands?|scripts?|instructions?)\b.{0,40}\b(?:found|inside|within)\b/i;
+const FETCH_THEN_EXECUTE_RE = /\bfetch\b.{0,120}\b(?:then|and)\b.{0,60}\b(?:run|execute|install|download)\b/i;
+const RUN_FETCHED_ARTIFACT_RE = /\b(?:run|execute|install)\b.{0,40}\b(?:downloaded|fetched)\b/i;
+const FETCHED_ARTIFACT_RE = /\b(?:downloaded|fetched)\b.{0,40}\b(?:script|binary|executable|tool|installer|package|file)\b/i;
+const FOLLOW_RELATED_URLS_RE = /\bfetch(?:ing)?\s+related\s+urls?\b/i;
+const SECURITY_CONTEXT_HEADING = /## Security context/i;
+const UNTRUSTED_DOCTRINE_RE = /untrusted\s+(?:external\s+)?(?:content|data)/i;
+const FORBID_EXTERNAL_EXECUTE_RE = /⊗[\s\S]{0,200}\b(?:download|install|execute|run)\b[\s\S]{0,200}\b(?:external|fetched|externally|found inside)\b/i;
+/** Strip HTML comment blocks; repeat until stable for CodeQL multi-char sanitization. */
+function stripHtmlComments(text) {
+    let body = text;
+    let prev = "";
+    while (prev !== body) {
+        prev = body;
+        body = body.replace(/<!--[\s\S]*?-->/g, "");
+    }
+    return body;
+}
+/** Strip YAML frontmatter and HTML comment banners before scanning skill prose. */
+export function skillProse(raw) {
+    let body = raw.replace(/\r\n/g, "\n");
+    if (body.startsWith("---")) {
+        const end = body.indexOf("\n---", 3);
+        if (end !== -1) {
+            body = body.slice(end + 4);
+        }
+    }
+    return stripHtmlComments(body);
+}
+export function hasExternalFetchSignal(prose) {
+    return EXTERNAL_FETCH_RE.test(prose);
+}
+export function hasRiskyExternalFetchPattern(prose) {
+    if (!hasExternalFetchSignal(prose)) {
+        return false;
+    }
+    return (hasExecuteFromExternalSignal(prose) ||
+        FOLLOW_RELATED_URLS_RE.test(prose) ||
+        /\bfetch\b.{0,40}\bfollow\b/i.test(prose));
+}
+export function hasExecuteFromExternalSignal(prose) {
+    return (EXECUTE_FROM_EXTERNAL_RE.test(prose) ||
+        FETCH_THEN_EXECUTE_RE.test(prose) ||
+        RUN_FETCHED_ARTIFACT_RE.test(prose) ||
+        FETCHED_ARTIFACT_RE.test(prose));
+}
+export function hasUntrustedFetchMitigation(prose) {
+    return (SECURITY_CONTEXT_HEADING.test(prose) &&
+        UNTRUSTED_DOCTRINE_RE.test(prose) &&
+        FORBID_EXTERNAL_EXECUTE_RE.test(prose));
+}
+export function analyzeSkillExternalFetch(skillPath, rawText) {
+    const prose = skillProse(rawText);
+    if (!hasExternalFetchSignal(prose)) {
+        return null;
+    }
+    if (!hasRiskyExternalFetchPattern(prose)) {
+        return null;
+    }
+    if (hasUntrustedFetchMitigation(prose)) {
+        return null;
+    }
+    return {
+        skillPath,
+        detail: "external fetch or follow-through language without Security context untrusted-data / forbid-execute mitigation (#1936)",
+    };
+}
+/** Collect violations across skill entries (used by verify-source gate + tests). */
+export function collectExternalFetchViolations(entries) {
+    const violations = [];
+    for (const { path, text } of entries) {
+        const finding = analyzeSkillExternalFetch(path, text);
+        if (finding !== null) {
+            violations.push(finding);
+        }
+    }
+    return violations;
+}
+//# sourceMappingURL=skill-external-fetch-gate.js.map

package/dist/eval/crud-telemetry.d.ts

@@ -54,6 +54,8 @@ export declare class InstrumentedVbriefCrud {
     update(path: string, content: string, options?: {
         trustedWrite?: boolean;
     }): CrudResult;
+    /** Record update metrics without persisting (caller owns validated atomic write). */
+    recordTrustedUpdate(path: string, content: string): void;
     delete(path: string): CrudResult;
     private recordMetric;
 }

package/dist/eval/crud-telemetry.js

@@ -248,6 +248,36 @@ export class InstrumentedVbriefCrud {
         writeFileSync(path, content, "utf8");
         return { ok: true };
     }
+    /** Record update metrics without persisting (caller owns validated atomic write). */
+    recordTrustedUpdate(path, content) {
+        let parsed;
+        try {
+            parsed = JSON.parse(content);
+        }
+        catch (err) {
+            const message = sanitizeInlineMessage(err instanceof Error ? err.message : String(err));
+            this.recordMetric({
+                operation: "update",
+                path,
+                schemaValid: false,
+                schemaErrors: [`${path}: invalid JSON -- ${message}`],
+                inventedKeys: [],
+                byteDiffMinimality: null,
+                byteDiffChangedRatio: null,
+            });
+            return;
+        }
+        const assessment = assessDocument(path, parsed);
+        this.recordMetric({
+            operation: "update",
+            path,
+            schemaValid: assessment.schemaValid,
+            schemaErrors: assessment.schemaErrors,
+            inventedKeys: assessment.inventedKeys,
+            byteDiffMinimality: null,
+            byteDiffChangedRatio: null,
+        });
+    }
     delete(path) {
         if (!existsSync(path)) {
             this.recordMetric({

package/dist/hooks/cursor-hooks.d.ts

@@ -0,0 +1,23 @@
+/** Cursor ApplyPatch spellings handled by the project adapter, not generic write dispatch. */
+export declare const APPLY_PATCH_TOOL_NAMES: readonly ["ApplyPatch", "apply_patch"];
+export declare const APPLY_PATCH_HOOK_MATCHER: string;
+/** Generic Cursor write matcher excludes ApplyPatch — adapter owns it (#2764). */
+export declare const CURSOR_GENERIC_WRITE_TOOL_NAMES: ("Edit" | "Write" | "WriteFile" | "CreateFile" | "MultiEdit" | "NotebookEdit" | "StrReplace" | "SearchReplace" | "Delete" | "DeleteFile" | "ApplyPatch" | "apply_patch")[];
+export declare const CURSOR_GENERIC_WRITE_HOOK_MATCHER: string;
+export declare const CURSOR_APPLY_PATCH_ADAPTER_RELATIVE = ".cursor/hooks/deft-cursor-hook-adapter.mjs";
+export declare const DEFT_CURSOR_ADAPTER_COMMAND_MARKER = "deft-cursor-hook-adapter.mjs";
+export declare const CURSOR_APPLY_PATCH_ADAPTER_COMMAND = "node .cursor/hooks/deft-cursor-hook-adapter.mjs ApplyPatch";
+/** Deposited adapter forwards free-form ApplyPatch stdin to hook:dispatch with explicit project root. */
+export declare const CURSOR_APPLY_PATCH_ADAPTER_SOURCE = "#!/usr/bin/env node\nimport { spawnSync } from \"node:child_process\";\nimport { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\n\nconst projectRoot = resolve(process.cwd());\nconst stdin = readFileSync(0, \"utf8\");\n\nfunction deftCommand() {\n  for (const candidate of [\"deft\", \"directive\"]) {\n    const probe = spawnSync(candidate, [\"--version\"], {\n      encoding: \"utf8\",\n      stdio: \"ignore\",\n      shell: process.platform === \"win32\",\n      windowsHide: true,\n    });\n    if (probe.error === undefined && probe.status === 0) return candidate;\n  }\n  process.stderr.write(\n    \"Directive ApplyPatch adapter: neither deft nor directive is on PATH.\\n\",\n  );\n  process.exit(2);\n}\n\nconst cli = deftCommand();\nconst result = spawnSync(\n  cli,\n  [\n    \"hook:dispatch\",\n    \"--host\",\n    \"cursor\",\n    \"--event\",\n    \"tool.before\",\n    \"--project-root\",\n    projectRoot,\n  ],\n  {\n    input: stdin,\n    encoding: \"utf8\",\n    stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    shell: process.platform === \"win32\",\n    windowsHide: true,\n  },\n);\n\nif (result.stderr) process.stderr.write(result.stderr);\nif (result.error) {\n  process.stderr.write(String(result.error));\n  process.exit(2);\n}\nif (result.status !== 0 && result.status !== null) {\n  if (result.stdout) process.stdout.write(result.stdout);\n  process.exit(result.status);\n}\n// Cursor failClosed treats empty stdout as failure \u2014 normalize allow.\nconst out = (result.stdout ?? \"\").trim();\nprocess.stdout.write((out.length > 0 ? out : '{\"permission\":\"allow\"}') + \"\\n\");\nprocess.exit(0);\n";
+export interface CursorPreToolUseEntry {
+    readonly command: string;
+    readonly matcher?: string;
+    readonly failClosed?: boolean;
+    readonly timeout?: number;
+}
+export declare function cursorApplyPatchAdapterEntry(): CursorPreToolUseEntry;
+/** True when generic and adapter matchers share no tool tokens. */
+export declare function cursorApplyPatchMatchersDisjoint(): boolean;
+/** Fail closed when Cursor hook projection would double-dispatch ApplyPatch (#2764). */
+export declare function assertCursorApplyPatchMatchersDisjoint(): void;
+//# sourceMappingURL=cursor-hooks.d.ts.map

package/dist/hooks/cursor-hooks.js

@@ -0,0 +1,95 @@
+import { DIRECT_WRITE_TOOL_NAMES } from "./tools.js";
+/** Cursor ApplyPatch spellings handled by the project adapter, not generic write dispatch. */
+export const APPLY_PATCH_TOOL_NAMES = ["ApplyPatch", "apply_patch"];
+export const APPLY_PATCH_HOOK_MATCHER = APPLY_PATCH_TOOL_NAMES.join("|");
+const APPLY_PATCH_TOOLS = new Set(APPLY_PATCH_TOOL_NAMES);
+/** Generic Cursor write matcher excludes ApplyPatch — adapter owns it (#2764). */
+export const CURSOR_GENERIC_WRITE_TOOL_NAMES = DIRECT_WRITE_TOOL_NAMES.filter((name) => !APPLY_PATCH_TOOLS.has(name));
+export const CURSOR_GENERIC_WRITE_HOOK_MATCHER = CURSOR_GENERIC_WRITE_TOOL_NAMES.join("|");
+export const CURSOR_APPLY_PATCH_ADAPTER_RELATIVE = ".cursor/hooks/deft-cursor-hook-adapter.mjs";
+export const DEFT_CURSOR_ADAPTER_COMMAND_MARKER = "deft-cursor-hook-adapter.mjs";
+export const CURSOR_APPLY_PATCH_ADAPTER_COMMAND = `node ${CURSOR_APPLY_PATCH_ADAPTER_RELATIVE} ApplyPatch`;
+/** Deposited adapter forwards free-form ApplyPatch stdin to hook:dispatch with explicit project root. */
+export const CURSOR_APPLY_PATCH_ADAPTER_SOURCE = `#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const projectRoot = resolve(process.cwd());
+const stdin = readFileSync(0, "utf8");
+
+function deftCommand() {
+  for (const candidate of ["deft", "directive"]) {
+    const probe = spawnSync(candidate, ["--version"], {
+      encoding: "utf8",
+      stdio: "ignore",
+      shell: process.platform === "win32",
+      windowsHide: true,
+    });
+    if (probe.error === undefined && probe.status === 0) return candidate;
+  }
+  process.stderr.write(
+    "Directive ApplyPatch adapter: neither deft nor directive is on PATH.\\n",
+  );
+  process.exit(2);
+}
+
+const cli = deftCommand();
+const result = spawnSync(
+  cli,
+  [
+    "hook:dispatch",
+    "--host",
+    "cursor",
+    "--event",
+    "tool.before",
+    "--project-root",
+    projectRoot,
+  ],
+  {
+    input: stdin,
+    encoding: "utf8",
+    stdio: ["pipe", "pipe", "pipe"],
+    shell: process.platform === "win32",
+    windowsHide: true,
+  },
+);
+
+if (result.stderr) process.stderr.write(result.stderr);
+if (result.error) {
+  process.stderr.write(String(result.error));
+  process.exit(2);
+}
+if (result.status !== 0 && result.status !== null) {
+  if (result.stdout) process.stdout.write(result.stdout);
+  process.exit(result.status);
+}
+// Cursor failClosed treats empty stdout as failure — normalize allow.
+const out = (result.stdout ?? "").trim();
+process.stdout.write((out.length > 0 ? out : '{"permission":"allow"}') + "\\n");
+process.exit(0);
+`;
+export function cursorApplyPatchAdapterEntry() {
+    return {
+        command: CURSOR_APPLY_PATCH_ADAPTER_COMMAND,
+        matcher: APPLY_PATCH_HOOK_MATCHER,
+        failClosed: true,
+        timeout: 5,
+    };
+}
+/** True when generic and adapter matchers share no tool tokens. */
+export function cursorApplyPatchMatchersDisjoint() {
+    const generic = new Set(CURSOR_GENERIC_WRITE_HOOK_MATCHER.split("|"));
+    for (const token of APPLY_PATCH_HOOK_MATCHER.split("|")) {
+        if (generic.has(token))
+            return false;
+    }
+    return true;
+}
+/** Fail closed when Cursor hook projection would double-dispatch ApplyPatch (#2764). */
+export function assertCursorApplyPatchMatchersDisjoint() {
+    if (!cursorApplyPatchMatchersDisjoint()) {
+        throw new Error("Cursor ApplyPatch and generic direct-write matchers overlap — refusing hook deposit (#2764).");
+    }
+}
+//# sourceMappingURL=cursor-hooks.js.map

package/dist/hooks/dispatcher.d.ts

@@ -72,6 +72,13 @@ export declare function isHookHost(value: string): value is HookHost;
 export declare function isHookEvent(value: string): value is HookEvent;
 /** Decide a normalized event using only the P0 direct-write policy. */
 export declare function decideHook(input: HookDispatchInput, seams?: HookPolicySeams): HookDecision;
-/** Render only authoritative denials; allow preserves the host's own permission flow. */
+/**
+ * Render host-facing hook output.
+ *
+ * Cursor deposits use `failClosed: true`. Cursor treats empty/null stdout as a
+ * hook failure and blocks the tool — so Cursor allows must emit explicit
+ * `{"permission":"allow"}`. Other hosts keep empty allow so the host permission
+ * flow is unchanged.
+ */
 export declare function renderHostDecision(host: HookHost, decision: HookDecision): string;
 //# sourceMappingURL=dispatcher.d.ts.map

package/dist/hooks/dispatcher.js

@@ -161,13 +161,20 @@ export function isProposedLifecycleWrite(projectRoot, targetPath) {
         return false;
     return posix.startsWith("xbrief/proposed/") || posix.startsWith("vbrief/proposed/");
 }
+function isWindowsDriveOnlyRoot(value) {
+    return /^[A-Za-z]:[/\\]?$/.test(value.trim());
+}
 export function projectRootFromHookPayload(payload, fallback) {
     const input = record(payload);
+    const fallbackResolved = resolve(fallback);
     if (input === null)
-        return resolve(fallback);
+        return fallbackResolved;
     const workspaceRoots = input.workspace_roots;
-    const root = firstString(input.workspaceRoot, input.workspace_root, Array.isArray(workspaceRoots) ? workspaceRoots[0] : null, input.cwd, fallback);
-    return resolve(root ?? fallback);
+    const candidate = firstString(input.workspaceRoot, input.workspace_root, Array.isArray(workspaceRoots) ? workspaceRoots[0] : null, input.cwd);
+    if (candidate === null || isWindowsDriveOnlyRoot(candidate)) {
+        return fallbackResolved;
+    }
+    return resolve(candidate);
 }
 export function isHookHost(value) {
     return HOOK_HOSTS.includes(value);
@@ -411,10 +418,21 @@ export function decideHook(input, seams = {}) {
     }
     return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: true });
 }
-/** Render only authoritative denials; allow preserves the host's own permission flow. */
+/**
+ * Render host-facing hook output.
+ *
+ * Cursor deposits use `failClosed: true`. Cursor treats empty/null stdout as a
+ * hook failure and blocks the tool — so Cursor allows must emit explicit
+ * `{"permission":"allow"}`. Other hosts keep empty allow so the host permission
+ * flow is unchanged.
+ */
 export function renderHostDecision(host, decision) {
-    if (decision.verdict === "allow")
+    if (decision.verdict === "allow") {
+        if (host === "cursor") {
+            return JSON.stringify({ permission: "allow" });
+        }
         return "";
+    }
     switch (host) {
         case "claude":
         case "codex":

package/dist/hooks/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./cursor-hooks.js";
 export * from "./dispatcher.js";
 export * from "./scope.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/hooks/index.js

@@ -1,3 +1,4 @@
+export * from "./cursor-hooks.js";
 export * from "./dispatcher.js";
 export * from "./scope.js";
 //# sourceMappingURL=index.js.map

package/dist/init-deposit/agent-hooks.d.ts

@@ -1,5 +1,7 @@
 import type { HookHost } from "../hooks/dispatcher.js";
+import { type HostHooksPolicy } from "../policy/host-hooks.js";
 import type { InitDepositIo } from "./constants.js";
+export { CURSOR_GENERIC_WRITE_HOOK_MATCHER, DEFT_CURSOR_ADAPTER_COMMAND_MARKER, } from "../hooks/cursor-hooks.js";
 export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
 export declare const DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export declare const AGENT_HOOK_PATHS: readonly [".claude/settings.json", ".grok/hooks/deft.json", ".cursor/hooks.json", ".codex/hooks.json"];
@@ -19,7 +21,7 @@ export interface AgentHookDepositResult {
     readonly changedPaths: AgentHookPath[];
 }
 /** Merge Directive-owned project hook entries without replacing user configuration. */
-export declare function writeAgentHookDeposit(projectRoot: string, io?: InitDepositIo): AgentHookDepositResult;
+export declare function writeAgentHookDeposit(projectRoot: string, io?: InitDepositIo, hostHooksPolicy?: HostHooksPolicy): AgentHookDepositResult;
 /** Read-only registration probe shared by verify and doctor. */
-export declare function inspectAgentHookDeposit(projectRoot: string): AgentHookInspection[];
+export declare function inspectAgentHookDeposit(projectRoot: string, hostHooksPolicy?: HostHooksPolicy): AgentHookInspection[];
 //# sourceMappingURL=agent-hooks.d.ts.map