@deftai/directive-core 0.81.0 → 0.83.0

package/dist/staleness-tickler/state.js

@@ -1,6 +1,11 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
+import { resolveTriageCachePath } from "../triage/cache-path.js";
 export const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", "staleness-tickler-state.json");
+const STATE_FILE_NAME = "staleness-tickler-state.json";
+function resolveStalenessTicklerStatePath(projectRoot) {
+    return resolveTriageCachePath(projectRoot, STATE_FILE_NAME);
+}
 function defaultReadText(path) {
     try {
         return readFileSync(path, "utf8");
@@ -31,11 +36,23 @@ export function parseStalenessTicklerState(text) {
     return {};
 }
 export function loadStalenessTicklerState(projectRoot, io = {}) {
-    const path = join(projectRoot, STATE_RELATIVE_PATH);
+    let path;
+    try {
+        path = resolveStalenessTicklerStatePath(projectRoot);
+    }
+    catch {
+        return {};
+    }
     return parseStalenessTicklerState((io.readText ?? defaultReadText)(path));
 }
 export function saveStalenessTicklerState(projectRoot, state, io = {}) {
-    const path = join(projectRoot, STATE_RELATIVE_PATH);
+    let path;
+    try {
+        path = resolveStalenessTicklerStatePath(projectRoot);
+    }
+    catch {
+        return;
+    }
     try {
         (io.writeText ?? defaultWriteText)(path, `${JSON.stringify(state, null, 2)}\n`);
     }

package/dist/triage/queue/cache.js

@@ -213,6 +213,11 @@ export function loadCachedIssues(repo, options) {
         if (scanPassed === false) {
             continue;
         }
+        // cachePut writes content.md only when scan_result.passed is true; missing
+        // approved content means the entry was quarantined or tampered — fail closed.
+        if (scanPassed === true && !existsSync(join(entryDir, "content.md"))) {
+            continue;
+        }
         const rawTitle = typeof payload.title === "string" ? payload.title : "";
         const safeTitle = sanitizeQueueTitle(rawTitle);
         if (safeTitle === null) {

package/dist/vbrief-validate/plan-hooks.d.ts

@@ -6,6 +6,8 @@ export declare function validateSessionRitualStalenessHoursOnPlan(plan: unknown,
 export declare function validateTriageRankingLabelsOnPlan(plan: unknown, filepath: string): string[];
 /** vbrief_validate hook: validate ``plan.policy.runtimeAuthority`` (#1394). */
 export declare function validateRuntimeAuthorityOnPlan(plan: unknown, filepath: string): string[];
+/** vbrief_validate hook: validate ``plan.policy.hostHooks`` (#2752). */
+export declare function validateHostHooksOnPlan(plan: unknown, filepath: string): string[];
 /** vbrief_validate hook: validate ``plan.policy.stalenessTickler`` (#2489). */
 export declare function validateStalenessTicklerOnPlan(plan: unknown, filepath: string): string[];
 /** Run all PROJECT-DEFINITION policy hooks (mirrors lazy-import block in Python). */

package/dist/vbrief-validate/plan-hooks.js

@@ -1,3 +1,4 @@
+import { validateHostHooks } from "../policy/host-hooks.js";
 import { readPlanPolicy } from "../policy/plan-extensions.js";
 import { validateRuntimeAuthority } from "../policy/runtime-authority.js";
 import { validateStalenessTickler } from "../policy/staleness-tickler.js";
@@ -121,6 +122,24 @@ export function validateRuntimeAuthorityOnPlan(plan, filepath) {
     }
     return out;
 }
+/** vbrief_validate hook: validate ``plan.policy.hostHooks`` (#2752). */
+export function validateHostHooksOnPlan(plan, filepath) {
+    if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
+        return [];
+    }
+    const policy = readPlanPolicy(plan);
+    if (typeof policy !== "object" || policy === null || Array.isArray(policy)) {
+        return [];
+    }
+    if (!("hostHooks" in policy)) {
+        return [];
+    }
+    const out = [];
+    for (const err of validateHostHooks(policy.hostHooks)) {
+        out.push(`${filepath}: ${err} (#2752)`);
+    }
+    return out;
+}
 /** vbrief_validate hook: validate ``plan.policy.stalenessTickler`` (#2489). */
 export function validateStalenessTicklerOnPlan(plan, filepath) {
     if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
@@ -191,6 +210,12 @@ export function runProjectDefinitionHooks(plan, filepath) {
     catch {
         /* hook must not break validation */
     }
+    try {
+        errors.push(...validateHostHooksOnPlan(plan, filepath));
+    }
+    catch {
+        /* hook must not break validation */
+    }
     return errors;
 }
 //# sourceMappingURL=plan-hooks.js.map

package/dist/verify-env/agent-hooks.d.ts

@@ -1,4 +1,5 @@
 import { type AgentHookInspection } from "../init-deposit/agent-hooks.js";
+import type { HostHooksPolicy } from "../policy/host-hooks.js";
 import type { OutputStream } from "./verify-hooks-installed.js";
 export interface AgentHookHealthResult {
     readonly code: 0 | 1 | 2;
@@ -7,5 +8,5 @@ export interface AgentHookHealthResult {
     readonly registrations: readonly AgentHookInspection[];
 }
 /** Read-only P0 agent-host registration health, independent of git hooks. */
-export declare function evaluateAgentHooks(projectRoot: string): AgentHookHealthResult;
+export declare function evaluateAgentHooks(projectRoot: string, hostHooksPolicy?: HostHooksPolicy): AgentHookHealthResult;
 //# sourceMappingURL=agent-hooks.d.ts.map

package/dist/verify-env/agent-hooks.js

@@ -1,6 +1,7 @@
 import { statSync } from "node:fs";
 import { resolve } from "node:path";
 import { inspectAgentHookDeposit } from "../init-deposit/agent-hooks.js";
+import { loadHostHooksPolicyFromProject } from "../policy/host-hooks.js";
 function isDirectory(path) {
     try {
         return statSync(path).isDirectory();
@@ -10,7 +11,7 @@ function isDirectory(path) {
     }
 }
 /** Read-only P0 agent-host registration health, independent of git hooks. */
-export function evaluateAgentHooks(projectRoot) {
+export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksPolicyFromProject(projectRoot)) {
     const root = resolve(projectRoot);
     if (!isDirectory(root)) {
         return {
@@ -20,7 +21,7 @@ export function evaluateAgentHooks(projectRoot) {
             registrations: [],
         };
     }
-    const registrations = inspectAgentHookDeposit(root);
+    const registrations = inspectAgentHookDeposit(root, hostHooksPolicy);
     const unhealthy = registrations.filter((entry) => entry.status !== "healthy");
     if (unhealthy.length > 0) {
         return {

package/dist/verify-source/index.d.ts

@@ -6,5 +6,6 @@ export * from "./cursor-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/verify-source/index.js

@@ -6,5 +6,6 @@ export * from "./cursor-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";
+export * from "./skill-external-fetch-gate.js";
 export * from "./verify-stubs.js";
 //# sourceMappingURL=index.js.map

package/dist/verify-source/skill-external-fetch-gate.d.ts

@@ -0,0 +1,21 @@
+/**
+ * skill-external-fetch-gate.ts -- deterministic gate for fetch-then-execute skill prose (#1936 / #1532).
+ *
+ * Production entry for collectExternalFetchViolations: wired into
+ * `task verify:skill-external-fetch-gate` and `check:framework-source`.
+ *
+ * Exit codes (three-state):
+ *   0 -- clean: every shipped skill with external-fetch language has Security context mitigation.
+ *   1 -- drift: one or more skills pair fetch/follow-through with execute/install without mitigation.
+ *   2 -- config error: skills directory missing or unreadable.
+ */
+export interface SkillExternalFetchGateResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+}
+/**
+ * Evaluate the skill external-fetch gate for a framework-source or consumer tree.
+ */
+export declare function evaluateSkillExternalFetchGate(projectRoot: string): SkillExternalFetchGateResult;
+//# sourceMappingURL=skill-external-fetch-gate.d.ts.map

package/dist/verify-source/skill-external-fetch-gate.js

@@ -0,0 +1,71 @@
+/**
+ * skill-external-fetch-gate.ts -- deterministic gate for fetch-then-execute skill prose (#1936 / #1532).
+ *
+ * Production entry for collectExternalFetchViolations: wired into
+ * `task verify:skill-external-fetch-gate` and `check:framework-source`.
+ *
+ * Exit codes (three-state):
+ *   0 -- clean: every shipped skill with external-fetch language has Security context mitigation.
+ *   1 -- drift: one or more skills pair fetch/follow-through with execute/install without mitigation.
+ *   2 -- config error: skills directory missing or unreadable.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { listSkillMdEntriesFromRoot, listSkillMdFilesFromRoot, resolveContentPathFromRoot, } from "../content-contracts/skills/helpers.js";
+import { collectExternalFetchViolations } from "../content-contracts/skills/skill-external-fetch-gate.js";
+const EXIT_OK = 0;
+const EXIT_DRIFT = 1;
+const EXIT_CONFIG_ERROR = 2;
+function resolveSkillsRoot(projectRoot) {
+    const resolved = resolveContentPathFromRoot(resolve(projectRoot), "skills");
+    return existsSync(resolved) ? resolved : null;
+}
+/**
+ * Evaluate the skill external-fetch gate for a framework-source or consumer tree.
+ */
+export function evaluateSkillExternalFetchGate(projectRoot) {
+    const root = resolve(projectRoot);
+    const skillsRoot = resolveSkillsRoot(root);
+    if (skillsRoot === null) {
+        return {
+            code: EXIT_CONFIG_ERROR,
+            message: `skill external-fetch gate: skills directory not found under ${root}`,
+            stream: "stderr",
+        };
+    }
+    let entries;
+    try {
+        const skillPaths = listSkillMdFilesFromRoot(root);
+        if (skillPaths.length === 0) {
+            return {
+                code: EXIT_DRIFT,
+                message: `FAIL: skill external-fetch gate found no SKILL.md files under ${skillsRoot}`,
+                stream: "stderr",
+            };
+        }
+        entries = listSkillMdEntriesFromRoot(root);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            code: EXIT_CONFIG_ERROR,
+            message: `skill external-fetch gate: failed to read skills under ${skillsRoot}: ${msg}`,
+            stream: "stderr",
+        };
+    }
+    const violations = collectExternalFetchViolations(entries);
+    if (violations.length > 0) {
+        const sanitize = (value) => value.replace(/\r?\n/g, " ");
+        const lines = [
+            `FAIL: skill external-fetch gate detected ${violations.length} violation(s):`,
+            ...violations.map((v) => `  - ${sanitize(v.skillPath)}: ${sanitize(v.detail)}`),
+        ];
+        return { code: EXIT_DRIFT, message: lines.join("\n"), stream: "stderr" };
+    }
+    return {
+        code: EXIT_OK,
+        message: `OK: skill external-fetch gate clean -- ${entries.length} skill(s) scanned (root=${root.replace(/\r?\n/g, " ")}).`,
+        stream: "stdout",
+    };
+}
+//# sourceMappingURL=skill-external-fetch-gate.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.81.0",
+  "version": "0.83.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -30,6 +30,10 @@
       "types": "./dist/wip-cap/index.d.ts",
       "default": "./dist/wip-cap/index.js"
     },
+    "./orphan-active": {
+      "types": "./dist/orphan-active/index.d.ts",
+      "default": "./dist/orphan-active/index.js"
+    },
     "./agents-md-budget": {
       "types": "./dist/agents-md-budget/index.d.ts",
       "default": "./dist/agents-md-budget/index.js"
@@ -309,8 +313,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.81.0",
-    "@deftai/directive-types": "^0.81.0",
+    "@deftai/directive-content": "^0.83.0",
+    "@deftai/directive-types": "^0.83.0",
     "archiver": "^8.0.0"
   },
   "scripts": {