@deftai/directive-core 0.83.0 → 0.85.0

package/dist/init-deposit/agent-hooks.js

@@ -1,12 +1,11 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
-import { assertCursorApplyPatchMatchersDisjoint, CURSOR_APPLY_PATCH_ADAPTER_RELATIVE, CURSOR_APPLY_PATCH_ADAPTER_SOURCE, CURSOR_GENERIC_WRITE_HOOK_MATCHER, cursorApplyPatchAdapterEntry, DEFT_CURSOR_ADAPTER_COMMAND_MARKER, } from "../hooks/cursor-hooks.js";
 import { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
 import { isHostHookDepositEnabled, loadHostHooksPolicyFromProject, } from "../policy/host-hooks.js";
-export { CURSOR_GENERIC_WRITE_HOOK_MATCHER, DEFT_CURSOR_ADAPTER_COMMAND_MARKER, } from "../hooks/cursor-hooks.js";
 export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
-export const DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
+export const DEFT_HOOK_COMMAND_MARKER = "deft-hook";
+export const LEGACY_DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export const AGENT_HOOK_PATHS = [
     ".claude/settings.json",
     ".grok/hooks/deft.json",
@@ -64,17 +63,21 @@ function nestedCommands(value) {
     });
 }
 function isManagedNestedGroup(value) {
-    return nestedCommands(value).some((value) => value.includes(DEFT_HOOK_COMMAND_MARKER));
+    return nestedCommands(value).some((command) => command.includes(DEFT_HOOK_COMMAND_MARKER) ||
+        command.includes(LEGACY_DEFT_HOOK_COMMAND_MARKER));
 }
 function isManagedNestedGroupForHost(value, host) {
-    return nestedCommands(value).some((command) => command.includes(DEFT_HOOK_COMMAND_MARKER) && command.includes(`--host ${host}`));
+    return nestedCommands(value).some((command) => (command.includes(DEFT_HOOK_COMMAND_MARKER) ||
+        command.includes(LEGACY_DEFT_HOOK_COMMAND_MARKER)) &&
+        command.includes(`--host ${host}`));
 }
 function isManagedCursorEntry(value) {
     const entry = object(value);
     if (typeof entry?.command !== "string")
         return false;
     return (entry.command.includes(DEFT_HOOK_COMMAND_MARKER) ||
-        entry.command.includes(DEFT_CURSOR_ADAPTER_COMMAND_MARKER));
+        entry.command.includes(LEGACY_DEFT_HOOK_COMMAND_MARKER) ||
+        entry.command.includes("deft-cursor-hook-adapter.mjs"));
 }
 function isManagedCursorEntryForHost(value) {
     return isManagedCursorEntry(value);
@@ -142,7 +145,6 @@ function stripManagedCursorConfig(config, path) {
     return { ...config, version: 1, hooks: nextHooks };
 }
 function mergeCursorConfig(config, path) {
-    assertCursorApplyPatchMatchersDisjoint();
     const hooks = hooksObject(config, path);
     const session = eventArray(hooks, "sessionStart", path).filter((entry) => !isManagedCursorEntry(entry));
     const preTool = eventArray(hooks, "preToolUse", path).filter((entry) => !isManagedCursorEntry(entry));
@@ -150,10 +152,9 @@ function mergeCursorConfig(config, path) {
     hooks.sessionStart = [...session, { command: command("cursor", "session.start"), timeout: 5 }];
     hooks.preToolUse = [
         ...preTool,
-        cursorApplyPatchAdapterEntry(),
         {
             command: command("cursor", "tool.before"),
-            matcher: CURSOR_GENERIC_WRITE_HOOK_MATCHER,
+            matcher: DIRECT_WRITE_HOOK_MATCHER,
             failClosed: true,
             timeout: 5,
         },
@@ -167,15 +168,6 @@ function mergeCursorConfig(config, path) {
     hooks.preCompact = [...preCompact, { command: command("cursor", "session.compact"), timeout: 5 }];
     return { ...config, version: 1, hooks };
 }
-function writeTextIfChanged(path, contents) {
-    if (existsSync(path) && readFileSync(path, "utf8") === contents)
-        return false;
-    mkdirSync(dirname(path), { recursive: true });
-    const temporary = `${path}.deft-${process.pid}.tmp`;
-    writeFileSync(temporary, contents, "utf8");
-    renameSync(temporary, path);
-    return true;
-}
 function writeJsonIfChanged(path, payload) {
     const next = `${JSON.stringify(payload, null, 2)}\n`;
     if (existsSync(path) && readFileSync(path, "utf8") === next)
@@ -246,19 +238,12 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
                 changedPaths.push(item.path);
         }
     }
-    const adapterAbsolute = join(projectRoot, CURSOR_APPLY_PATCH_ADAPTER_RELATIVE);
+    const adapterAbsolute = join(projectRoot, ".cursor/hooks/deft-cursor-hook-adapter.mjs");
     assertDepositContained(projectRoot, adapterAbsolute);
-    if (isHostHookDepositEnabled("cursor", hostHooksPolicy)) {
-        if (writeTextIfChanged(adapterAbsolute, CURSOR_APPLY_PATCH_ADAPTER_SOURCE)) {
-            if (!changedPaths.includes(AGENT_HOOK_PATHS[2])) {
-                changedPaths.push(AGENT_HOOK_PATHS[2]);
-            }
-        }
-    }
-    else if (existsSync(adapterAbsolute)) {
+    if (existsSync(adapterAbsolute)) {
         rmSync(adapterAbsolute, { force: true });
-        if (!strippedPaths.includes(AGENT_HOOK_PATHS[2])) {
-            strippedPaths.push(AGENT_HOOK_PATHS[2]);
+        if (!changedPaths.includes(AGENT_HOOK_PATHS[2])) {
+            changedPaths.push(AGENT_HOOK_PATHS[2]);
         }
     }
     if (changedPaths.length > 0) {
@@ -309,18 +294,11 @@ function hasCursorRegistration(config) {
     const session = Array.isArray(hooks.sessionStart) ? hooks.sessionStart : [];
     const preTool = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
     const preCompact = Array.isArray(hooks.preCompact) ? hooks.preCompact : [];
-    const adapter = cursorApplyPatchAdapterEntry();
     return (session.some((entry) => object(entry)?.command === command("cursor", "session.start")) &&
         preTool.some((entry) => {
             const hook = object(entry);
             return (hook?.command === command("cursor", "tool.before") &&
-                hook.matcher === CURSOR_GENERIC_WRITE_HOOK_MATCHER &&
-                hook.failClosed === true);
-        }) &&
-        preTool.some((entry) => {
-            const hook = object(entry);
-            return (hook?.command === adapter.command &&
-                hook.matcher === adapter.matcher &&
+                hook.matcher === DIRECT_WRITE_HOOK_MATCHER &&
                 hook.failClosed === true);
         }) &&
         preTool.some((entry) => {

package/dist/init-deposit/gitignore.js

@@ -22,6 +22,7 @@ const DEFT_CORE_COVERING_LINES = new Set([".deft/core/", ".deft/core"]);
  */
 export const CANONICAL_GITIGNORE_BASELINE = [
     ".deft-cache/",
+    ".deft/cache/",
     ".deft/.cli/",
     ".deft/ritual-state.json",
     ".deft/last-session.json",

package/dist/init-deposit/hygiene.d.ts

@@ -57,6 +57,28 @@ export declare function stageFrameworkPaths(projectDir: string, paths: readonly
  * Refs #2347.
  */
 export declare const STRAY_DEPOSIT_FRAMEWORK_PATHS: readonly ["packages"];
+/**
+ * Deposit-local files generated by init/update that are intentionally absent
+ * from `@deftai/directive-content` (#2804).
+ */
+export declare const DEPOSIT_GENERATED_METADATA_PATHS: readonly ["VERSION"];
+export declare function isDepositGeneratedMetadata(relPath: string): boolean;
+/**
+ * List deposit-relative paths that are absent from the installed content package,
+ * excluding generated deposit metadata such as `VERSION` (#2804).
+ */
+export declare function findPackageAbsentDepositPathsSync(deftDir: string, contentRoot: string): string[];
+export declare function findPackageAbsentDepositPaths(deftDir: string, contentRoot: string): Promise<string[]>;
+export interface PrunePackageAbsentDepositPathsResult {
+    readonly pruned: string[];
+    readonly prunedDirs: string[];
+}
+/**
+ * Remove deposit files not shipped by `@deftai/directive-content`, preserving
+ * generated deposit metadata such as `VERSION` (#2804). Subsumes the legacy
+ * hard-coded `packages/` prune (#2347).
+ */
+export declare function prunePackageAbsentDepositPaths(deftDir: string, contentRoot: string, io: InitDepositIo): Promise<PrunePackageAbsentDepositPathsResult>;
 export interface PruneStrayDepositPathsResult {
     readonly pruned: string[];
 }

package/dist/init-deposit/hygiene.js

@@ -5,9 +5,9 @@
  * Refs #1576, #1453, #1430.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync } from "node:fs";
-import { rm, stat } from "node:fs/promises";
-import { join, relative } from "node:path";
+import { existsSync, readdirSync, rmSync } from "node:fs";
+import { readdir, rm, stat } from "node:fs/promises";
+import { dirname, join, relative } from "node:path";
 import { gitPorcelain } from "../story-ready/git.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
 export const CODEQL_CONFIG_REL = ".github/codeql/codeql-config.yml";
@@ -24,7 +24,6 @@ export function installerManagedMatchers() {
         { exact: ".claude/settings.json" },
         { exact: ".grok/hooks/deft.json" },
         { exact: ".cursor/hooks.json" },
-        { exact: ".cursor/hooks/deft-cursor-hook-adapter.mjs" },
         { exact: ".codex/hooks.json" },
         { exact: ".gitattributes" },
         { exact: ".gitignore" },
@@ -146,6 +145,139 @@ export function stageFrameworkPaths(projectDir, paths, seams = {}) {
  * Refs #2347.
  */
 export const STRAY_DEPOSIT_FRAMEWORK_PATHS = ["packages"];
+/**
+ * Deposit-local files generated by init/update that are intentionally absent
+ * from `@deftai/directive-content` (#2804).
+ */
+export const DEPOSIT_GENERATED_METADATA_PATHS = ["VERSION"];
+export function isDepositGeneratedMetadata(relPath) {
+    const normalized = relPath.replace(/\\/g, "/");
+    return DEPOSIT_GENERATED_METADATA_PATHS.includes(normalized);
+}
+function normalizeRelativePath(relPath) {
+    return relPath.replace(/\\/g, "/");
+}
+function listRelativeFilePathsSync(root) {
+    if (!existsSync(root))
+        return [];
+    const results = [];
+    const walk = (dir, prefix) => {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const rel = normalizeRelativePath(prefix ? `${prefix}/${entry.name}` : entry.name);
+            const abs = join(dir, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                walk(abs, rel);
+            }
+            else if (entry.isFile()) {
+                results.push(rel);
+            }
+        }
+    };
+    walk(root, "");
+    return results;
+}
+async function listRelativeFilePaths(root) {
+    if (!existsSync(root))
+        return [];
+    const results = [];
+    const walk = async (dir, prefix) => {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const rel = normalizeRelativePath(prefix ? `${prefix}/${entry.name}` : entry.name);
+            const abs = join(dir, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                await walk(abs, rel);
+            }
+            else if (entry.isFile()) {
+                results.push(rel);
+            }
+        }
+    };
+    await walk(root, "");
+    return results;
+}
+function contentDirectoryPaths(contentFiles) {
+    const dirs = new Set();
+    for (const file of contentFiles) {
+        let dir = dirname(file);
+        while (dir && dir !== ".") {
+            dirs.add(normalizeRelativePath(dir));
+            const parent = dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+        }
+    }
+    return dirs;
+}
+/**
+ * List deposit-relative paths that are absent from the installed content package,
+ * excluding generated deposit metadata such as `VERSION` (#2804).
+ */
+export function findPackageAbsentDepositPathsSync(deftDir, contentRoot) {
+    const depositFiles = listRelativeFilePathsSync(deftDir);
+    const contentFiles = new Set(listRelativeFilePathsSync(contentRoot));
+    return depositFiles
+        .filter((rel) => !contentFiles.has(rel) && !isDepositGeneratedMetadata(rel))
+        .sort();
+}
+export async function findPackageAbsentDepositPaths(deftDir, contentRoot) {
+    const depositFiles = await listRelativeFilePaths(deftDir);
+    const contentFiles = new Set(await listRelativeFilePaths(contentRoot));
+    return depositFiles
+        .filter((rel) => !contentFiles.has(rel) && !isDepositGeneratedMetadata(rel))
+        .sort();
+}
+async function pruneEmptyParentsForFile(deftDir, contentDirs, relFile) {
+    const prunedDirs = [];
+    let rel = dirname(relFile);
+    while (rel && rel !== ".") {
+        const normalized = normalizeRelativePath(rel);
+        if (contentDirs.has(normalized))
+            break;
+        const abs = join(deftDir, rel);
+        try {
+            if (!existsSync(abs) || readdirSync(abs).length !== 0)
+                break;
+            rmSync(abs, { recursive: false, force: true });
+            prunedDirs.push(normalized);
+        }
+        catch {
+            break;
+        }
+        rel = dirname(rel);
+    }
+    return prunedDirs;
+}
+/**
+ * Remove deposit files not shipped by `@deftai/directive-content`, preserving
+ * generated deposit metadata such as `VERSION` (#2804). Subsumes the legacy
+ * hard-coded `packages/` prune (#2347).
+ */
+export async function prunePackageAbsentDepositPaths(deftDir, contentRoot, io) {
+    const absent = await findPackageAbsentDepositPaths(deftDir, contentRoot);
+    const contentDirs = contentDirectoryPaths(listRelativeFilePathsSync(contentRoot));
+    const pruned = [];
+    const prunedDirs = [];
+    for (const rel of absent) {
+        try {
+            rmSync(join(deftDir, rel), { force: true });
+            pruned.push(rel);
+            prunedDirs.push(...(await pruneEmptyParentsForFile(deftDir, contentDirs, rel)));
+        }
+        catch (cause) {
+            io.printf(`Warning: could not prune .deft/core/${rel}: ${String(cause)}\n`);
+        }
+    }
+    if (pruned.length > 0) {
+        io.printf(`Pruned ${pruned.length} package-absent deposit file(s) not shipped by @deftai/directive-content (#2804).\n`);
+    }
+    return { pruned, prunedDirs };
+}
 /**
  * Remove framework-source subdirectories from `.deft/core/` that are not
  * present in the deposited content package (#2347). Silently skips any path

package/dist/init-deposit/legacy-detect.d.ts

@@ -25,7 +25,7 @@
  */
 /** Non-zero exit code for a use-time legacy-layout refusal (needs-action). */
 export declare const LEGACY_LAYOUT_REFUSED_EXIT_CODE = 2;
-export type LegacyLayoutKind = "orphan-deft-version" | "legacy-deft-prefixed" | "git-clone-or-submodule" | "pre-v0.27-sentinel-agents-md";
+export type LegacyLayoutKind = "orphan-deft-version" | "legacy-deft-prefixed" | "git-clone-or-submodule" | "pre-v0.27-sentinel-agents-md" | "dual-layout";
 export interface LegacyLayoutDetection {
     readonly legacy: boolean;
     readonly kind: LegacyLayoutKind | null;
@@ -37,6 +37,12 @@ export interface LegacyDetectSeams {
     readonly isDir?: (p: string) => boolean;
     readonly readText?: (p: string) => string | null;
 }
+/**
+ * Detect a post-bridge dual-layout: canonical `.deft/core/` plus a leftover
+ * framework-marked `deft/` tree. Doctor-only -- the npm deposit path treats
+ * `.deft/core/` as canonical and must not refuse here (#2805 / #2804 wiring).
+ */
+export declare function detectDualLayout(projectDir: string, seams?: LegacyDetectSeams): LegacyLayoutDetection | null;
 /**
  * Classify the on-disk layout at `projectDir`. Returns `legacy: false` for the
  * canonical `.deft/core/` vendored layout and for a greenfield project (so init
@@ -58,4 +64,22 @@ export declare function buildLegacyRefusalMessage(command: "init" | "update", de
 export declare function buildLegacyRefusalJson(command: "init" | "update", projectDir: string, detection: LegacyLayoutDetection): Record<string, unknown>;
 /** One-line doctor signpost carrying the stable URL (no baked version/command). */
 export declare function legacyLayoutSignpostLine(detection: LegacyLayoutDetection): string;
+/** Doctor / npm signpost for the post-bridge dual-layout state (#2805). */
+export declare function dualLayoutSignpostLine(detection: LegacyLayoutDetection): string;
+export interface LegacyDeftCleanupSeams {
+    readonly gitPorcelain?: (projectRoot: string) => string | null;
+    readonly runGitRm?: (projectDir: string, relPath: string) => void;
+    readonly removeDir?: (absPath: string) => void;
+}
+export type LegacyDeftCleanupAction = "removed" | "staged" | "refused" | "skipped";
+export interface LegacyDeftCleanupResult {
+    readonly ok: boolean;
+    readonly action: LegacyDeftCleanupAction;
+    readonly detail: string;
+}
+/**
+ * Remove a clean tracked legacy `deft/` tree after bridge migration (#2805).
+ * Refuses when the tree has local modifications or untracked files.
+ */
+export declare function tryCleanupLegacyDeftTree(projectDir: string, seams?: LegacyDeftCleanupSeams): LegacyDeftCleanupResult;
 //# sourceMappingURL=legacy-detect.d.ts.map

package/dist/init-deposit/legacy-detect.js

@@ -23,11 +23,13 @@
  *
  * Refs #1912, #1669.
  */
-import { statSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { rmSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { GO_BRIDGE_RELEASES_URL, UPGRADING_DOC_URL } from "../doctor/constants.js";
 import { extractManagedSection, parseInstallRootFromAgentsMd } from "../doctor/manifest.js";
 import { readTextSafe } from "../doctor/paths.js";
+import { gitPorcelain } from "../story-ready/git.js";
 /** Non-zero exit code for a use-time legacy-layout refusal (needs-action). */
 export const LEGACY_LAYOUT_REFUSED_EXIT_CODE = 2;
 const NOT_LEGACY = {
@@ -53,6 +55,16 @@ function defaultIsDir(p) {
     }
 }
 /** Does `.gitmodules` reference the deft framework at a deft install path? */
+const LEGACY_DEFT_DIR = "deft";
+function isFrameworkDeftDir(projectDir, isDir, isFile) {
+    const deftDir = join(projectDir, LEGACY_DEFT_DIR);
+    const deftMarkers = [
+        join(deftDir, "VERSION"),
+        join(deftDir, "main.md"),
+        join(deftDir, "Taskfile.yml"),
+    ];
+    return isDir(deftDir) && (deftMarkers.some((m) => isFile(m)) || isDir(join(deftDir, "skills")));
+}
 function gitmodulesReferencesFramework(text) {
     const normalized = text.replace(/\r\n/g, "\n").toLowerCase();
     if (normalized.includes("deftai/directive")) {
@@ -62,6 +74,27 @@ function gitmodulesReferencesFramework(text) {
     // when the url host differs (mirror, fork). Match `path = deft` / `path = .deft`.
     return /(^|\n)\s*path\s*=\s*\.?deft(\/|\s|$)/.test(normalized);
 }
+const DUAL_LAYOUT_DETAIL = "Found both the canonical .deft/core/ deposit and a leftover legacy deft/ " +
+    "framework tree -- remove deft/ so .deft/core/ is the sole framework root.";
+/**
+ * Detect a post-bridge dual-layout: canonical `.deft/core/` plus a leftover
+ * framework-marked `deft/` tree. Doctor-only -- the npm deposit path treats
+ * `.deft/core/` as canonical and must not refuse here (#2805 / #2804 wiring).
+ */
+export function detectDualLayout(projectDir, seams = {}) {
+    const isFile = seams.isFile ?? defaultIsFile;
+    const isDir = seams.isDir ?? defaultIsDir;
+    const hasCanonicalCore = isDir(join(projectDir, ".deft", "core"));
+    if (!hasCanonicalCore || !isFrameworkDeftDir(projectDir, isDir, isFile)) {
+        return null;
+    }
+    return {
+        legacy: true,
+        kind: "dual-layout",
+        detail: DUAL_LAYOUT_DETAIL,
+        evidence: [".deft/core/", "deft/"],
+    };
+}
 /**
  * Classify the on-disk layout at `projectDir`. Returns `legacy: false` for the
  * canonical `.deft/core/` vendored layout and for a greenfield project (so init
@@ -71,10 +104,11 @@ export function detectLegacyLayout(projectDir, seams = {}) {
     const isFile = seams.isFile ?? defaultIsFile;
     const isDir = seams.isDir ?? defaultIsDir;
     const readText = seams.readText ?? readTextSafe;
+    const hasCanonicalCore = isDir(join(projectDir, ".deft", "core"));
+    const deftDirIsFramework = isFrameworkDeftDir(projectDir, isDir, isFile);
     // Canonical vendored layout present -> the npm path owns it; not legacy. Any
-    // AGENTS.md / manifest drift here is repaired by the healthy refresh path,
-    // not by refusing.
-    if (isDir(join(projectDir, ".deft", "core"))) {
+    // leftover deft/ tree is a dual-layout hygiene issue surfaced by Doctor only.
+    if (hasCanonicalCore) {
         return NOT_LEGACY;
     }
     // Orphan `.deft/VERSION` (the old pre-`.deft/core/` manifest location) with no
@@ -92,13 +126,7 @@ export function detectLegacyLayout(projectDir, seams = {}) {
     // framework markers. Distinguish a git-clone / submodule deposit (a `.git`
     // inside `deft/`, or a `.gitmodules` pointing at the framework) from a plain
     // legacy-prefixed vendored copy.
-    const deftDir = join(projectDir, "deft");
-    const deftMarkers = [
-        join(deftDir, "VERSION"),
-        join(deftDir, "main.md"),
-        join(deftDir, "Taskfile.yml"),
-    ];
-    const deftDirIsFramework = isDir(deftDir) && (deftMarkers.some((m) => isFile(m)) || isDir(join(deftDir, "skills")));
+    const deftDir = join(projectDir, LEGACY_DEFT_DIR);
     if (deftDirIsFramework) {
         const submoduleGit = isFile(join(deftDir, ".git")) || isDir(join(deftDir, ".git"));
         if (submoduleGit) {
@@ -215,9 +243,113 @@ export function buildLegacyRefusalJson(command, projectDir, detection) {
 }
 /** One-line doctor signpost carrying the stable URL (no baked version/command). */
 export function legacyLayoutSignpostLine(detection) {
+    if (detection.kind === "dual-layout") {
+        return dualLayoutSignpostLine(detection);
+    }
     return (`Legacy Deft layout detected (${detection.kind ?? "unknown"}): ${detection.detail} ` +
         "Run the frozen Go bridge installer to migrate to .deft/core/, then use the npm " +
         `CLI (\`npx @deftai/directive update\`). See ${UPGRADING_DOC_URL} ` +
         `(frozen bridge: ${GO_BRIDGE_RELEASES_URL}).`);
 }
+/** Doctor / npm signpost for the post-bridge dual-layout state (#2805). */
+export function dualLayoutSignpostLine(detection) {
+    return (`Dual Deft layout detected (${detection.kind ?? "dual-layout"}): ${detection.detail} ` +
+        "Remove the legacy deft/ tree so .deft/core/ is the sole framework root " +
+        "(when clean: `git rm -r deft/`; reconcile local edits first if `git status deft/` is dirty). " +
+        `See ${UPGRADING_DOC_URL}.`);
+}
+function porcelainEntryPath(line) {
+    let path = line.slice(3).trim().replace(/\\/g, "/");
+    if (path.startsWith('"') && path.endsWith('"')) {
+        path = path.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+    }
+    return path;
+}
+function porcelainTouchesLegacyDeft(porcelain) {
+    const touched = [];
+    for (const line of porcelain.split("\n")) {
+        if (!line.trim())
+            continue;
+        const path = porcelainEntryPath(line);
+        if (path === LEGACY_DEFT_DIR || path.startsWith(`${LEGACY_DEFT_DIR}/`)) {
+            touched.push(path);
+        }
+    }
+    return touched;
+}
+/**
+ * Remove a clean tracked legacy `deft/` tree after bridge migration (#2805).
+ * Refuses when the tree has local modifications or untracked files.
+ */
+export function tryCleanupLegacyDeftTree(projectDir, seams = {}) {
+    const detection = detectDualLayout(projectDir);
+    if (detection === null) {
+        return {
+            ok: true,
+            action: "skipped",
+            detail: "No dual-layout legacy deft/ tree to remove.",
+        };
+    }
+    const readPorcelain = seams.gitPorcelain ?? gitPorcelain;
+    const porcelain = readPorcelain(projectDir);
+    if (porcelain === null) {
+        return {
+            ok: false,
+            action: "refused",
+            detail: "Cannot determine whether the legacy deft/ tree is clean (git unavailable). " +
+                "Inspect `git status deft/` and remove the tree manually once clean.",
+        };
+    }
+    const dirtyPaths = porcelainTouchesLegacyDeft(porcelain);
+    if (dirtyPaths.length > 0) {
+        return {
+            ok: false,
+            action: "refused",
+            detail: "Refusing to remove the legacy deft/ tree because it has local modifications or " +
+                "untracked files. Reconcile or commit those changes, then re-run " +
+                "`npx @deftai/directive update`, or remove deft/ manually once clean. " +
+                `Dirty paths: ${JSON.stringify(dirtyPaths.slice(0, 5))}` +
+                (dirtyPaths.length > 5 ? ", …" : "") +
+                ".",
+        };
+    }
+    const deftDir = join(projectDir, LEGACY_DEFT_DIR);
+    const removeDir = seams.removeDir ?? ((p) => rmSync(p, { recursive: true, force: true }));
+    const runGitRm = seams.runGitRm ??
+        ((root, relPath) => {
+            execFileSync("git", ["rm", "-r", "--ignore-unmatch", relPath], {
+                cwd: root,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        });
+    try {
+        runGitRm(projectDir, LEGACY_DEFT_DIR);
+        removeDir(deftDir);
+        return {
+            ok: true,
+            action: "staged",
+            detail: "Removed the legacy deft/ framework tree and staged its deletion; " +
+                ".deft/core/ is now the sole framework root.",
+        };
+    }
+    catch {
+        try {
+            removeDir(deftDir);
+            return {
+                ok: true,
+                action: "removed",
+                detail: "Removed the legacy deft/ framework tree from disk; stage the deletion with " +
+                    "`git add -u deft/` if it was tracked.",
+            };
+        }
+        catch (cause) {
+            return {
+                ok: false,
+                action: "refused",
+                detail: `Could not remove the legacy deft/ tree: ${String(cause)}`,
+            };
+        }
+    }
+}
 //# sourceMappingURL=legacy-detect.js.map

package/dist/init-deposit/refresh.d.ts

@@ -47,6 +47,8 @@ export interface RefreshDepositSeams {
     gitLsFiles?: GitLsFiles;
     /** #2530: injected git config seams for {@link writeConsumerGitHooks}. */
     gitHooks?: GitHooksSeams;
+    /** #2822: optional seam for trusted-org policy force-on migration. */
+    runOrgForceOn?: (projectRoot: string) => void;
 }
 /**
  * The four states `directive update` classifies an EXISTING install into BEFORE

package/dist/init-deposit/refresh.js

@@ -18,11 +18,13 @@ import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { manifestTagToVersion, parseInstallManifest } from "../doctor/manifest.js";
 import { readCorePackageVersion } from "../engine-version.js";
 import { resolveLifecycleRoot } from "../layout/resolve.js";
+import { runOrgForceOnMigration } from "../policy/org-force-on-migration.js";
 import { checkLocalEngineIntegrity, classify, ENGINE_PACKAGE, plan, renderGlobalInstall, resolveEngine, } from "../resolution/index.js";
 import { gitPorcelain } from "../story-ready/git.js";
+import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
 import { ensureInitGitignoreLines, isDepositTrackedInGit } from "./gitignore.js";
-import { depositStagePaths, isInstallerManagedPath, printCommitGuidance, pruneStrayDepositPaths, } from "./hygiene.js";
+import { depositStagePaths, isInstallerManagedPath, printCommitGuidance, prunePackageAbsentDepositPaths, } from "./hygiene.js";
 import { parseInitArgv } from "./init-deposit.js";
 import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout, LEGACY_LAYOUT_REFUSED_EXIT_CODE, LegacyLayoutRefusedError, } from "./legacy-detect.js";
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
@@ -409,10 +411,10 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     else {
         await copyContent(contentRoot, deftDir);
         await prunePythonArtifactsFromDeposit(deftDir, projectDir, io);
-        // #2347: prune framework-source paths that the content package does not ship.
-        // The additive file-swap never removes them, causing the deposit-hygiene
-        // advisory to persist across every upgrade until manually cleaned.
-        await pruneStrayDepositPaths(deftDir, contentRoot, io);
+        // #2804 / #2347: prune deposit paths absent from the content package. The
+        // additive file-swap never removes them, causing stale bridge-era files to
+        // survive across upgrades until manually cleaned.
+        await prunePackageAbsentDepositPaths(deftDir, contentRoot, io);
         const nowIso = seams.nowIso ?? (() => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"));
         const manifestFields = {
             ref: contentVersion.startsWith("v") ? contentVersion : `v${contentVersion}`,
@@ -441,6 +443,17 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     // lifecycle content before migrate:xbrief can transactionally converge it.
     if (hasCanonicalXbriefLifecycle(projectDir)) {
         syncConsumerXbriefSchemas(projectDir, deftDir);
+        removeStaleMigratedFrameworkNarrative(projectDir);
+    }
+    const runOrgForceOn = seams.runOrgForceOn ??
+        ((root) => {
+            runOrgForceOnMigration(root, { actor: "directive-update" });
+        });
+    try {
+        runOrgForceOn(projectDir);
+    }
+    catch {
+        // Policy migration is best-effort; never block framework refresh (#2822).
     }
     const agentsMdUpdated = writeAgentsMd(projectDir, deftDir, io);
     writeAgentHookDeposit(projectDir, io);

package/dist/policy/index.d.ts

@@ -4,6 +4,7 @@ export * from "./capacity.js";
 export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./host-hooks.js";
+export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
@@ -11,6 +12,7 @@ export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
+export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";
 export declare const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
 export declare const FIELD_WIP_CAP = "plan.policy.wipCap";

package/dist/policy/index.js

@@ -12,6 +12,7 @@ export * from "./capacity.js";
 export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./host-hooks.js";
+export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
@@ -19,6 +20,7 @@ export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
+export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";
 export const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
 export const FIELD_WIP_CAP = "plan.policy.wipCap";