@deftai/directive-core 0.86.0 → 0.88.0

package/dist/cache/scanner.d.ts

@@ -2,7 +2,7 @@
  * Quarantine scanner v2 port (mirrors `scripts/cache_scanner.py`).
  * SCANNER_VERSION must stay in lockstep with the Python module.
  */
-export declare const SCANNER_VERSION = "2.1.0";
+export declare const SCANNER_VERSION = "2.2.0";
 export interface ScanFlag {
     category: string;
     severity: string;
@@ -21,6 +21,16 @@ export interface ScanResult {
  * Scans the line once; byte-identical match semantics to the prior regex.
  */
 export declare function lineHasShellVector(line: string): boolean;
+/**
+ * Neutralize a body line so it cannot act as a CommonMark fence open/close.
+ * Used on content placed inside a ```quarantined wrapper (#2915 / cache-quarantine-03).
+ *
+ * A nested bare ``` (or longer run, optional ≤3-space indent) would otherwise
+ * early-close the outer fence and let following attacker text render outside
+ * the quarantined info-string. Break the delimiter run by inserting a backslash
+ * after the first fence character: ``` → `\`` , ~~~ → ~\~~ .
+ */
+export declare function neutralizeFenceLine(line: string): string;
 /** Run scanner v2 over content markdown. */
 export declare function scan(contentMd: string, scannedAt?: string): ScanResult;
 /** Map scan flags for meta.json (omit match_count when zero). */

package/dist/cache/scanner.js

@@ -3,9 +3,12 @@ import { parseMarkdownHeading } from "../text/redos-safe.js";
  * Quarantine scanner v2 port (mirrors `scripts/cache_scanner.py`).
  * SCANNER_VERSION must stay in lockstep with the Python module.
  */
-export const SCANNER_VERSION = "2.1.0";
+export const SCANNER_VERSION = "2.2.0";
 const CREDENTIAL_PATTERNS = [
     ["github-pat", /\bgh[pousr]_[A-Za-z0-9]{30,}\b/],
+    // #2910: fine-grained PATs (`github_pat_...`) — aligned with product-signal
+    // SECRET_PATTERNS so cache/ingest fail-closes on modern GitHub tokens.
+    ["github-fine-grained-pat", /\bgithub_pat_[A-Za-z0-9_]{20,}\b/],
     ["anthropic-api-key", /\bsk-ant-[A-Za-z0-9_-]{20,}\b/],
     ["openai-api-key", /\bsk-[A-Za-z0-9]{20,}\b/],
     ["slack-token", /\bxox[bp]-[A-Za-z0-9-]{20,}\b/],
@@ -151,6 +154,26 @@ export function lineHasShellVector(line) {
 const FENCE_RE = /^(```|~~~)/;
 const QUARANTINE_FENCE_OPEN = "```quarantined";
 const QUARANTINE_FENCE_CLOSE = "```";
+/**
+ * Neutralize a body line so it cannot act as a CommonMark fence open/close.
+ * Used on content placed inside a ```quarantined wrapper (#2915 / cache-quarantine-03).
+ *
+ * A nested bare ``` (or longer run, optional ≤3-space indent) would otherwise
+ * early-close the outer fence and let following attacker text render outside
+ * the quarantined info-string. Break the delimiter run by inserting a backslash
+ * after the first fence character: ``` → `\`` , ~~~ → ~\~~ .
+ */
+export function neutralizeFenceLine(line) {
+    const match = /^( {0,3})(`{3,}|~{3,})(.*)$/.exec(line);
+    if (match === null)
+        return line;
+    const indent = match[1] ?? "";
+    const delim = match[2] ?? "";
+    const rest = match[3] ?? "";
+    // One backslash after the first fence char breaks the delimiter run.
+    // Concat (not a template literal) so "\\" is unambiguously a single "\".
+    return indent + delim[0] + "\\" + delim.slice(1) + rest;
+}
 function isInvisible(ch) {
     const cp = ch.codePointAt(0);
     if (cp === undefined)
@@ -277,7 +300,8 @@ function detectInjectionHeading(text) {
             if (hSignal || bSignal) {
                 out.push(QUARANTINE_FENCE_OPEN);
                 for (let j = i; j < sectionEnd; j += 1) {
-                    out.push(lines[j] ?? "");
+                    // #2915: neutralize nested fence lines so they cannot early-close.
+                    out.push(neutralizeFenceLine(lines[j] ?? ""));
                 }
                 out.push(QUARANTINE_FENCE_CLOSE);
                 sectionsWrapped += 1;
@@ -292,7 +316,8 @@ function detectInjectionHeading(text) {
         }
         if (headingSignal(line) || lineHasShellVector(line)) {
             out.push(QUARANTINE_FENCE_OPEN);
-            out.push(line);
+            // #2915: neutralize in case the single line itself is fence-shaped.
+            out.push(neutralizeFenceLine(line));
             out.push(QUARANTINE_FENCE_CLOSE);
             sectionsWrapped += 1;
             i += 1;
@@ -310,7 +335,7 @@ function detectInjectionHeading(text) {
         {
             category: "injection-heading",
             severity: "fence-and-pass",
-            detail: `wrapped ${sectionsWrapped} injection-shaped section(s) in \`quarantined\` fence (v2.1.0 strict-signal policy)`,
+            detail: `wrapped ${sectionsWrapped} injection-shaped section(s) in \`quarantined\` fence (v2.2.0 strict-signal policy)`,
             match_count: sectionsWrapped,
         },
     ];

package/dist/check/gate-lists.js

@@ -19,9 +19,11 @@ export const FRAMEWORK_CHECK_GATES = [
     "verify:rule-ownership",
     "verify:biome-config",
     "verify:content-manifest",
+    "verify:license-sync",
     "verify:skill-external-fetch-gate",
     "verify:contract-drift",
     "verify:cursor-tier1",
+    "verify:openclaw-tier1",
     "verify:go-freeze",
     "verify:bridge-drift",
     "verify:branch",

package/dist/content-contracts/skills/helpers.d.ts

@@ -13,6 +13,16 @@ export declare function resolveRepoPath(relPath: string): string;
 export declare function readRepoFile(relPath: string): string;
 export declare function repoFileExists(relPath: string): boolean;
 export declare function readSkill(relPath: string): string;
+/**
+ * Progressive-disclosure surface for deft-directive-swarm (#2928).
+ * Thin SKILL.md is the dispatch card; operative depth lives under references/.
+ * Content contracts assert against this ordered join so host adapters can leave
+ * the always-loaded SKILL without dropping coverage.
+ */
+export declare const SWARM_SKILL_REL = "skills/deft-directive-swarm/SKILL.md";
+/** Stable load order: core phases, then host launch adapters, then ops. */
+export declare const SWARM_REFERENCE_ORDER: readonly ["core-phase-0.md", "core-phase-1-2.md", "core-phase-3.md", "host-warp.md", "host-generic.md", "host-grok-build.md", "host-cursor.md", "host-openclaw.md", "core-phase-4.md", "core-phase-5-6.md", "core-ops.md"];
+export declare function readSwarmSkillSurface(): string;
 export declare function readAgentsMd(): string;
 /** Slice the first `## Returning Sessions` section body out of AGENTS.md. */
 export declare function returningSessionsSection(): string;

package/dist/content-contracts/skills/helpers.js

@@ -32,6 +32,41 @@ export function repoFileExists(relPath) {
 export function readSkill(relPath) {
     return readRepoFile(relPath);
 }
+/**
+ * Progressive-disclosure surface for deft-directive-swarm (#2928).
+ * Thin SKILL.md is the dispatch card; operative depth lives under references/.
+ * Content contracts assert against this ordered join so host adapters can leave
+ * the always-loaded SKILL without dropping coverage.
+ */
+export const SWARM_SKILL_REL = "skills/deft-directive-swarm/SKILL.md";
+/** Stable load order: core phases, then host launch adapters, then ops. */
+export const SWARM_REFERENCE_ORDER = [
+    "core-phase-0.md",
+    "core-phase-1-2.md",
+    "core-phase-3.md",
+    "host-warp.md",
+    "host-generic.md",
+    "host-grok-build.md",
+    "host-cursor.md",
+    "host-openclaw.md",
+    "core-phase-4.md",
+    "core-phase-5-6.md",
+    "core-ops.md",
+];
+export function readSwarmSkillSurface() {
+    const parts = [readRepoFile(SWARM_SKILL_REL)];
+    for (const name of SWARM_REFERENCE_ORDER) {
+        const rel = `skills/deft-directive-swarm/references/${name}`;
+        // Fail-loud: SWARM_REFERENCE_ORDER is the complete shipped surface (#2928).
+        // Silently skipping a missing reference lets incomplete packs pass contracts
+        // that never assert markers unique to the omitted file (Greptile on #2936).
+        if (!repoFileExists(rel)) {
+            throw new Error(`readSwarmSkillSurface: missing declared reference ${rel}`);
+        }
+        parts.push(readRepoFile(rel));
+    }
+    return parts.join("\n\n");
+}
 export function readAgentsMd() {
     return readRepoFile("AGENTS.md");
 }

package/dist/deposit/copy-tree.d.ts

@@ -5,12 +5,30 @@
  * directories are created mode 0o755; files keep their source permission bits
  * (including the executable bit for hooks and the `run` launcher).
  *
- * Refs #1942 S1, #1477.
+ * `replaceTree` is the npm-path counterpart of Go `swapInCore` (#2913): full
+ * destination replace so dst-only agent content cannot survive a refresh.
+ *
+ * Refs #1942 S1, #1477, #2913.
  */
 /**
  * Recursively copy `src` into `dst`, preserving nested structure and file modes.
  *
  * The contents of `src` are placed under `dst` (equivalent to Go `copyDir`).
+ * This is **additive** — pre-existing destination entries not present in `src`
+ * survive. Prefer {@link replaceTree} for deposit refresh integrity (#2913).
  */
 export declare function copyTree(src: string, dst: string): Promise<void>;
+/**
+ * Full-tree replace of `dst` with the contents of `src` (Go `swapInCore` parity).
+ *
+ * Stages the new tree out-of-line, moves any existing `dst` aside, then moves
+ * the staged tree into place. On failure after the old tree was moved, restores
+ * the previous payload. Destination-only files (stale or malicious) do **not**
+ * survive — unlike additive {@link copyTree}.
+ *
+ * Refuses to operate when `dst` itself is a symlink (#2305 / #2912).
+ *
+ * Refs #2913, #2904 (install-deposit-06).
+ */
+export declare function replaceTree(src: string, dst: string): Promise<void>;
 //# sourceMappingURL=copy-tree.d.ts.map

package/dist/deposit/copy-tree.js

@@ -5,22 +5,27 @@
  * directories are created mode 0o755; files keep their source permission bits
  * (including the executable bit for hooks and the `run` launcher).
  *
- * Refs #1942 S1, #1477.
+ * `replaceTree` is the npm-path counterpart of Go `swapInCore` (#2913): full
+ * destination replace so dst-only agent content cannot survive a refresh.
+ *
+ * Refs #1942 S1, #1477, #2913.
  */
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readdir, readFile, stat } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, open, readdir, readFile, rename, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 const DEFAULT_FILE_MODE = 0o644;
 const DEFAULT_DIR_MODE = 0o755;
-async function assertDestinationIsNotSymlink(path) {
+async function assertDestinationIsNotSymlink(path, label = "copyTree") {
     try {
         const info = await lstat(path);
         if (info.isSymbolicLink()) {
-            throw new Error(`copyTree: refusing to write through destination symlink ${path}`);
+            throw new Error(`${label}: refusing to write through destination symlink ${path}`);
         }
     }
     catch (err) {
-        if (err instanceof Error && err.message.startsWith("copyTree: refusing")) {
+        if (err instanceof Error &&
+            err.message.includes("refusing to write through destination symlink")) {
             throw err;
         }
         if (err.code === "ENOENT") {
@@ -77,6 +82,8 @@ async function copyDirContents(src, dst) {
  * Recursively copy `src` into `dst`, preserving nested structure and file modes.
  *
  * The contents of `src` are placed under `dst` (equivalent to Go `copyDir`).
+ * This is **additive** — pre-existing destination entries not present in `src`
+ * survive. Prefer {@link replaceTree} for deposit refresh integrity (#2913).
  */
 export async function copyTree(src, dst) {
     const srcInfo = await stat(src);
@@ -85,4 +92,126 @@ export async function copyTree(src, dst) {
     }
     await copyDirContents(src, dst);
 }
+async function pathExists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+/**
+ * Move `src` to `dst`, falling back to copy+remove across devices (EXDEV),
+ * mirroring Go `movePayload` used by `swapInCore`.
+ */
+async function moveTree(src, dst) {
+    await mkdir(dirname(dst), { recursive: true, mode: DEFAULT_DIR_MODE });
+    try {
+        await rename(src, dst);
+        return;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "EXDEV" && code !== "EPERM") {
+            // On some platforms rename across volumes raises EXDEV; fall through only
+            // for cross-device / permission cases that still allow a copy fallback.
+            if (code !== "EINVAL")
+                throw err;
+        }
+    }
+    await copyDirContents(src, dst);
+    await rm(src, { recursive: true, force: true });
+}
+/**
+ * Full-tree replace of `dst` with the contents of `src` (Go `swapInCore` parity).
+ *
+ * Stages the new tree out-of-line, moves any existing `dst` aside, then moves
+ * the staged tree into place. On failure after the old tree was moved, restores
+ * the previous payload. Destination-only files (stale or malicious) do **not**
+ * survive — unlike additive {@link copyTree}.
+ *
+ * Refuses to operate when `dst` itself is a symlink (#2305 / #2912).
+ *
+ * Refs #2913, #2904 (install-deposit-06).
+ */
+export async function replaceTree(src, dst) {
+    const srcInfo = await stat(src);
+    if (!srcInfo.isDirectory()) {
+        throw new Error(`replaceTree: source ${src} is not a directory`);
+    }
+    await assertDestinationIsNotSymlink(dst, "replaceTree");
+    const parent = dirname(dst);
+    await mkdir(parent, { recursive: true, mode: DEFAULT_DIR_MODE });
+    const staging = await mkdtemp(join(tmpdir(), "deft-core-stage-"));
+    let backup = null;
+    /** When true, leave `backup` on disk so an operator can recover after dual failure. */
+    let preserveBackupOnExit = false;
+    try {
+        await copyDirContents(src, staging);
+        if (await pathExists(dst)) {
+            backup = await mkdtemp(join(tmpdir(), "deft-core-bak-"));
+            // mkdtemp created an empty dir; remove it so moveTree can rename onto the path.
+            await rm(backup, { recursive: true, force: true });
+            try {
+                await moveTree(dst, backup);
+            }
+            catch (asideErr) {
+                // Greptile P1: moveTree may fall back to copy+remove. If removal fails after a
+                // successful copy (or after a partial delete of dst), `backup` is the only full
+                // recovery copy while dst may already be damaged. Do NOT let `finally` delete it.
+                if (await pathExists(backup)) {
+                    preserveBackupOnExit = true;
+                }
+                else {
+                    backup = null;
+                }
+                const asideMsg = asideErr instanceof Error ? asideErr.message : String(asideErr);
+                throw new Error(`replaceTree: failed to move existing destination aside (${asideMsg})` +
+                    (backup ? ` — recovery copy at ${backup}` : ""));
+            }
+        }
+        try {
+            await moveTree(staging, dst);
+        }
+        catch (err) {
+            if (backup !== null) {
+                try {
+                    if (await pathExists(dst)) {
+                        await rm(dst, { recursive: true, force: true });
+                    }
+                    await moveTree(backup, dst);
+                    backup = null;
+                }
+                catch (restoreErr) {
+                    preserveBackupOnExit = true;
+                    const installMsg = err instanceof Error ? err.message : String(err);
+                    const restoreMsg = restoreErr instanceof Error ? restoreErr.message : String(restoreErr);
+                    throw new Error(`replaceTree: install new payload failed (${installMsg}); ROLLBACK ALSO FAILED (${restoreMsg})` +
+                        (backup ? ` — previous payload preserved at ${backup}` : ""));
+                }
+            }
+            throw err instanceof Error
+                ? err
+                : new Error(`replaceTree: install new payload failed: ${String(err)}`);
+        }
+        // Successful install — best-effort drop the backup (Go keeps it for operator
+        // rollback; the npm path does not surface a backup path today and must not
+        // litter TEMP). Cleanup MUST NOT fail the replace: the new payload is already
+        // live at `dst`. A thrown rm here would reject replaceTree and skip the
+        // VERSION stamp in runRefreshDeposit → version drift (Greptile P1).
+        if (backup !== null) {
+            await rm(backup, { recursive: true, force: true }).catch(() => undefined);
+            backup = null;
+        }
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+        if (backup !== null && !preserveBackupOnExit) {
+            await rm(backup, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+}
 //# sourceMappingURL=copy-tree.js.map

package/dist/doctor/main.d.ts

@@ -6,11 +6,12 @@ export declare function runAgentHooksHealthCheck(projectRoot: string, consumerCo
 export declare function runAgentHooksLiveProbeCheck(projectRoot: string, sink: ReturnType<typeof createPlainSink>, addFinding: (finding: Finding) => void, seams: DoctorSeams): void;
 /**
  * Never emit a bare `task ...` remediation in a project without Taskfile wiring
- * (#2267). The `directive` surface always works; `task deft:X` is optional and
- * only present when the consumer wired the include. `plan()` already emits the
- * `directive` / `npx` / `npm` surface, so this guard is a defensive invariant:
- * any `task`-prefixed command is rewritten to the `directive` surface unless the
- * project actually has the include.
+ * (#2267 / #2893). The `directive`/`deft` surface always works; `task deft:X` is
+ * the go-task namespaced form only when the consumer wired the include (bare
+ * `task pr:watch` is not the consumer form under include key `deft:`). `plan()`
+ * already emits the `directive` / `npx` / `npm` surface, so this guard is a
+ * defensive invariant: any `task`-prefixed command is rewritten to the
+ * `directive` surface unless the project actually has the include.
  */
 /**
  * Detect Taskfile wiring through the injected seam (#2267). Mirrors

package/dist/doctor/main.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { evaluate as evaluateAgentsMdAdvisory } from "../agents-md-advisory/evaluate.js";
 import { contentRoot } from "../content-root.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { describeShadowedPlanExtension, detectShadowedPlanExtensions, } from "../policy/plan-extensions.js";
 import { loadProjectDefinition } from "../policy/resolve.js";
 import { checkLocalEngineIntegrity, classify, detectPackageManager, evaluateSkew, reconcileVersions, plan as resolvePlan, } from "../resolution/index.js";
@@ -20,7 +21,7 @@ import { createPlainSink } from "./output.js";
 import { readTextSafe, resolveFrameworkRootForProject, resolvePath, resolveVersion, runningInsideDeftRepo, } from "./paths.js";
 import { runPayloadStalenessCheck } from "./payload-staleness.js";
 import { runLocalSignpostChecks } from "./signpost-checks.js";
-import { classifyTaskfileInclude, formatMissingIncludeSnippet, includesBlockHasDeftTaskfile, resolveConsumerTaskfile, } from "./taskfile.js";
+import { classifyTaskfileInclude, formatGatesSurfaceDualRemediation, formatMissingIncludeSnippet, GATES_SURFACE_DEFT_REMEDIATION, includesBlockHasDeftTaskfile, resolveConsumerTaskfile, } from "./taskfile.js";
 import { defaultWhich } from "./which.js";
 const DEFAULT_RESOLUTION_PLATFORMS = ["linux", "darwin", "win32"];
 /**
@@ -62,6 +63,53 @@ export function cmdDoctor(args, seams = {}) {
     const consumerContext = resolve(projectRoot) !== resolve(frameworkRoot);
     const whichFn = seams.whichFn ?? defaultWhich;
     const nowFn = seams.now ?? (() => new Date());
+    // #2926: official root opt-out — short-circuit Directive doctor when clean;
+    // diagnose flag+deposit inconsistency (warn; exit dirty).
+    const optOut = detectNoDeftDirective(projectRoot);
+    if (optOut.present) {
+        if (optOut.inconsistent) {
+            const message = `${NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE} (${NO_DEFT_DIRECTIVE_DISABLED_MESSAGE})`;
+            if (jsonMode) {
+                const payload = {
+                    status: "disabled-inconsistent",
+                    disabled: true,
+                    disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                    inconsistent: true,
+                    inconsistent_policy: NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY,
+                    deposit_present: true,
+                    message,
+                    findings: [
+                        {
+                            severity: "warning",
+                            message,
+                            check: "no-deft-directive",
+                            policy: NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY,
+                        },
+                    ],
+                };
+                process.stdout.write(`${pythonJsonDump(payload)}\n`);
+            }
+            else if (!quietMode) {
+                process.stderr.write(`${message} [policy=${NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY}]\n`);
+            }
+            return 1;
+        }
+        if (jsonMode) {
+            const payload = {
+                status: "disabled",
+                disabled: true,
+                disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                inconsistent: false,
+                deposit_present: false,
+                message: NO_DEFT_DIRECTIVE_DISABLED_MESSAGE,
+            };
+            process.stdout.write(`${pythonJsonDump(payload)}\n`);
+        }
+        else if (!quietMode) {
+            process.stdout.write(`${NO_DEFT_DIRECTIVE_DISABLED_MESSAGE}\n`);
+        }
+        return 0;
+    }
     if (!fullMode) {
         const state = (seams.readState ?? readState)(projectRoot);
         const decision = decideThrottle(state, nowFn());
@@ -291,7 +339,7 @@ export function cmdDoctor(args, seams = {}) {
     if (!jsonMode) {
         sink.blank();
     }
-    sink.info("Checking optional root Taskfile.yml include...");
+    sink.info("Checking gates-surface readiness (Taskfile include for deep-think agent gates)...");
     runTaskfileIncludeCheck(projectRoot, fixMode, jsonMode, sink, addFinding, seams);
     let resolution = null;
     if (!runningInsideDeftRepo(projectRoot, seams)) {
@@ -640,15 +688,21 @@ function runTaskfileIncludeCheck(projectRoot, fixMode, jsonMode, sink, addFindin
     }
     const includeStatus = classifyTaskfileInclude(projectRoot);
     if (includeStatus === "ok") {
-        sink.success("Root Taskfile.yml includes the deft framework");
+        sink.success("Gates-surface ready: root Taskfile.yml includes the deft framework (`task deft:<verb>`)");
         return;
     }
     if (includeStatus === "missing-file") {
         let includeMissing = true;
         const target = join(projectRoot, "Taskfile.yml");
-        const message = "Root Taskfile.yml missing. This is OK for package-manager installs that use the `deft X` surface directly. To also enable the optional `task deft:X` surface, paste this into " +
-            `${target}:`;
-        sink.info(message);
+        // #2893: elevate to warning — deep-think agent gates need a working invoke path.
+        // Dual remediations: (1) deft CLI primary (2) Taskfile include for task deft: verbs.
+        const message = "Gates-surface readiness: root Taskfile.yml missing. Deep-think agent gates " +
+            "(`pr:watch`, `review-monitor:*`) need a working invoke path — not optional convenience. " +
+            "1. " +
+            GATES_SURFACE_DEFT_REMEDIATION +
+            ` 2. Create ${target} with the canonical include so go-task exposes \`task deft:<verb>\` ` +
+            "(include key `deft:` → namespaced tasks; bare `task pr:watch` is not the consumer form):";
+        sink.warn(message);
         if (!jsonMode) {
             sink.blank();
             sink.raw(TASKFILE_INCLUDE_SNIPPET);
@@ -668,22 +722,27 @@ function runTaskfileIncludeCheck(projectRoot, fixMode, jsonMode, sink, addFindin
                 }
             }
             else {
-                sink.info("Skipped Taskfile.yml creation -- paste the snippet above when you are ready.");
+                sink.info("Skipped Taskfile.yml creation -- use `deft <verb>` now, or paste the include snippet when ready.");
             }
         }
         if (includeMissing) {
             addFinding({
                 severity: "warning",
-                message: "Root Taskfile.yml missing; optional Taskfile include unavailable",
+                message: "Gates-surface: root Taskfile.yml missing — deep-think gates need `deft` CLI or `task deft:` include",
                 check: "taskfile-include",
                 file: target,
-                suggestion: TASKFILE_INCLUDE_SNIPPET,
+                suggestion: formatGatesSurfaceDualRemediation("missing-file"),
             });
         }
         return;
     }
     if (includeStatus === "missing-include") {
-        const message = "Root Taskfile.yml exists but does not include the deft framework. The `deft X` surface still works; add this to the Taskfile `includes:` block only if you want the optional `task deft:X` surface (doctor NEVER mutates an existing user-owned Taskfile):";
+        const message = "Gates-surface readiness: root Taskfile.yml exists but does not include the deft framework. " +
+            "Deep-think agent gates (`pr:watch`, `review-monitor:*`) need a working invoke path. " +
+            "1. " +
+            GATES_SURFACE_DEFT_REMEDIATION +
+            " 2. Add this to the Taskfile `includes:` block so go-task exposes `task deft:<verb>` " +
+            "(doctor NEVER mutates an existing user-owned Taskfile; bare `task pr:watch` is not the consumer form when the include key is `deft:`):";
         sink.warn(message);
         if (!jsonMode) {
             sink.blank();
@@ -692,21 +751,23 @@ function runTaskfileIncludeCheck(projectRoot, fixMode, jsonMode, sink, addFindin
         const tf = resolveConsumerTaskfile(projectRoot);
         addFinding({
             severity: "warning",
-            message: "Root Taskfile.yml does not include the deft framework",
+            message: "Gates-surface: root Taskfile.yml does not include the deft framework — deep-think gates need `deft` CLI or `task deft:` include",
             check: "taskfile-include",
             file: tf,
-            suggestion: formatMissingIncludeSnippet(),
+            suggestion: formatGatesSurfaceDualRemediation("missing-include"),
         });
         return;
     }
     const taskfilePath = resolveConsumerTaskfile(projectRoot) ?? join(projectRoot, "Taskfile.yml");
-    const message = `Root Taskfile.yml at ${taskfilePath} exists but could not be read -- check file permissions.`;
+    const message = `Gates-surface readiness: root Taskfile.yml at ${taskfilePath} exists but could not be read — ` +
+        "check file permissions. Deep-think gates still work via `deft <verb>` until the include is readable.";
     sink.warn(message);
     addFinding({
         severity: "warning",
         message,
         check: "taskfile-include",
         file: taskfilePath,
+        suggestion: GATES_SURFACE_DEFT_REMEDIATION,
     });
 }
 /**
@@ -786,11 +847,12 @@ function runPlanExtensionShadowCheck(projectRoot, sink, addFinding, seams) {
 }
 /**
  * Never emit a bare `task ...` remediation in a project without Taskfile wiring
- * (#2267). The `directive` surface always works; `task deft:X` is optional and
- * only present when the consumer wired the include. `plan()` already emits the
- * `directive` / `npx` / `npm` surface, so this guard is a defensive invariant:
- * any `task`-prefixed command is rewritten to the `directive` surface unless the
- * project actually has the include.
+ * (#2267 / #2893). The `directive`/`deft` surface always works; `task deft:X` is
+ * the go-task namespaced form only when the consumer wired the include (bare
+ * `task pr:watch` is not the consumer form under include key `deft:`). `plan()`
+ * already emits the `directive` / `npx` / `npm` surface, so this guard is a
+ * defensive invariant: any `task`-prefixed command is rewritten to the
+ * `directive` surface unless the project actually has the include.
  */
 /**
  * Detect Taskfile wiring through the injected seam (#2267). Mirrors

package/dist/doctor/taskfile.d.ts

@@ -3,4 +3,12 @@ export declare function resolveConsumerTaskfile(projectRoot: string): string | n
 export type TaskfileIncludeStatus = "ok" | "missing-file" | "missing-include" | "unreadable";
 export declare function classifyTaskfileInclude(projectRoot: string): TaskfileIncludeStatus;
 export declare function formatMissingIncludeSnippet(): string;
+/** Primary remediation for deep-think gates when Taskfile include is absent (#2893). */
+export declare const GATES_SURFACE_DEFT_REMEDIATION: string;
+/**
+ * Dual remediations for gates-surface readiness (#2893):
+ * 1. `deft <verb>` CLI (works without Taskfile)
+ * 2. Taskfile include so go-task exposes `task deft:<verb>` (not bare `task pr:watch`)
+ */
+export declare function formatGatesSurfaceDualRemediation(kind: "missing-file" | "missing-include"): string;
 //# sourceMappingURL=taskfile.d.ts.map

package/dist/doctor/taskfile.js

@@ -62,4 +62,23 @@ export function classifyTaskfileInclude(projectRoot) {
 export function formatMissingIncludeSnippet() {
     return "  deft:\n    taskfile: ./.deft/core/Taskfile.yml\n    optional: true\n";
 }
+/** Primary remediation for deep-think gates when Taskfile include is absent (#2893). */
+export const GATES_SURFACE_DEFT_REMEDIATION = "Prefer `deft pr:watch` / `deft review-monitor:register` / `deft verify:review-monitor` " +
+    "(primary npm/CLI surface; no Taskfile required).";
+/**
+ * Dual remediations for gates-surface readiness (#2893):
+ * 1. `deft <verb>` CLI (works without Taskfile)
+ * 2. Taskfile include so go-task exposes `task deft:<verb>` (not bare `task pr:watch`)
+ */
+export function formatGatesSurfaceDualRemediation(kind) {
+    const includePart = kind === "missing-file"
+        ? "Create root Taskfile.yml with the canonical deft include so go-task exposes `task deft:<verb>` " +
+            "(not bare `task pr:watch`):\n" +
+            "version: '3'\n\nincludes:\n" +
+            formatMissingIncludeSnippet()
+        : "Add the deft include to the existing Taskfile `includes:` block so go-task exposes " +
+            "`task deft:<verb>` (doctor NEVER mutates an existing user-owned Taskfile):\n" +
+            formatMissingIncludeSnippet();
+    return `${GATES_SURFACE_DEFT_REMEDIATION}\n2. ${includePart}`;
+}
 //# sourceMappingURL=taskfile.js.map

package/dist/fs/projection-containment.d.ts

@@ -37,6 +37,24 @@ export declare function assertProjectionContained(projectDir: string, targetPath
  * Pair with {@link assertProjectionContained} before read/write/mkdir/append.
  */
 export declare function assertWriteTargetSafe(projectDir: string, targetPath: string): void;
+/**
+ * Refuse projection writes that would follow an IN-TREE destination symlink on
+ * the write path (#2912).
+ *
+ * {@link assertProjectionContained} only rejects symlinks that ESCAPE the
+ * project tree, so an in-tree symlink (leaf or parent) pointing at another
+ * checked-in path is silently followed — letting a malicious or mistaken repo
+ * symlink divert a consumer projection write (AGENTS.md, .githooks/**,
+ * .gitattributes, .github/**, .agents/**, vbrief|xbrief/**, package.json, …)
+ * onto an unintended file under operator credentials.
+ *
+ * This guard first runs the escape checks in {@link assertProjectionContained},
+ * then walks every EXISTING component from the project root down to the write
+ * target and refuses the write if ANY of them is a symlink — regardless of
+ * whether the link resolves inside the tree. Call it BEFORE any projection
+ * read/write/mkdir/append on consumer deposit sinks.
+ */
+export declare function assertDestinationNotSymlink(projectDir: string, targetPath: string): void;
 /**
  * Refuse when a lifecycle corpus root is itself a symlink (#2626 category-b).
  */