@deftai/directive-core 0.86.0 → 0.88.0

package/dist/policy/runtime-authority.js

@@ -177,4 +177,278 @@ export function evaluateRuntimeAuthorityDirectWrite(input) {
     }
     return { allowed: true, reason: null, code: null };
 }
+/** True when token is a shell env assignment (FOO=1 / FOO=). Linear; no nested quantifiers. */
+function isShellEnvAssignToken(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return false;
+    const name = token.slice(0, eq);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        return false;
+    return true;
+}
+/**
+ * Normalize a shell token for classification (#2711).
+ * Shell strips quotes, empty quote pairs, and backslash escapes before exec
+ * (`g''it` / `g\it` / `'push'` → `git` / `push`). Dropping `'`/`"`/`\` after
+ * whitespace split closes those bypasses without nested-quantifier regex. O(n).
+ */
+function normalizeShellToken(token) {
+    return token.replace(/['"\\]/g, "");
+}
+/**
+ * Split a shell command into list/pipeline/newline segments without splitting
+ * on separators that appear inside quotes or after a backslash escape (#2711).
+ * Prevents `printf '%s' ';' 'git push'` and `hello\; git push` false denials.
+ */
+function splitShellSegments(command) {
+    const segments = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (quote !== null) {
+            if (c === quote)
+                quote = null;
+            cur += c;
+            continue;
+        }
+        // Outside quotes: backslash escapes the next character (including separators).
+        if (c === "\\" && i + 1 < command.length) {
+            cur += c;
+            cur += command[i + 1] ?? "";
+            i++;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        // Outside quotes: list/pipeline separators and newlines start a new segment.
+        if (c === "&" && command[i + 1] === "&") {
+            segments.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (c === "|" && command[i + 1] === "|") {
+            segments.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (c === ";" || c === "|" || c === "&" || c === "\n" || c === "\r") {
+            segments.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += c;
+    }
+    segments.push(cur);
+    return segments;
+}
+/** Git global options that take a separate value token (not `--opt=value`). */
+const GIT_GLOBAL_VALUE_OPTS = new Set([
+    "-C",
+    "-c",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--config-env",
+    "--super-prefix",
+    "--list-cmds",
+]);
+/**
+ * Classify one shell list/pipeline segment for push/merge (#2711).
+ * Token walk is O(n) — avoids nested-quantifier ReDoS that CodeQL flags on
+ * `git (?:options)* push` style regexes (alerts #77 / #78 on this PR).
+ */
+function classifyShellSegment(segment) {
+    const tokens = segment
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0);
+    let i = 0;
+    while (i < tokens.length) {
+        const tok = tokens[i];
+        if (tok === undefined || !isShellEnvAssignToken(tok))
+            break;
+        i++;
+    }
+    const wrapTok = tokens[i];
+    if (wrapTok !== undefined) {
+        const wrap = normalizeShellToken(wrapTok).toLowerCase();
+        if (wrap === "sudo" || wrap === "env" || wrap === "command") {
+            i++;
+            while (i < tokens.length) {
+                const tok = tokens[i];
+                if (tok === undefined || !isShellEnvAssignToken(tok))
+                    break;
+                i++;
+            }
+        }
+    }
+    const binTok = tokens[i];
+    if (binTok === undefined)
+        return null;
+    const bin = normalizeShellToken(binTok).toLowerCase();
+    if (bin === "git" || bin === "git.exe") {
+        i++;
+        // Skip git global options before the subcommand (-C, --git-dir, -c, …).
+        while (i < tokens.length) {
+            const raw = tokens[i];
+            if (raw === undefined)
+                return null;
+            const t = normalizeShellToken(raw);
+            const lower = t.toLowerCase();
+            if (!t.startsWith("-")) {
+                return lower === "push" ? "push" : null;
+            }
+            // --opt=value forms never consume a following token.
+            if (t.startsWith("--") && t.includes("=")) {
+                i++;
+                continue;
+            }
+            // Value-taking globals: -C path, --git-dir /repo, -c name=value, …
+            if (GIT_GLOBAL_VALUE_OPTS.has(t)) {
+                i += 2;
+                continue;
+            }
+            // Glued short forms: -C/path, -cname=value
+            if (t.startsWith("-C") || t.startsWith("-c")) {
+                i++;
+                continue;
+            }
+            // Boolean / other short/long flags without a separate value.
+            i++;
+        }
+        return null;
+    }
+    if (bin === "gh" || bin === "gh.exe") {
+        i++;
+        while (i < tokens.length) {
+            const flagRaw = tokens[i];
+            if (flagRaw === undefined)
+                break;
+            const flag = normalizeShellToken(flagRaw);
+            if (!flag.startsWith("-"))
+                break;
+            i++;
+        }
+        const pr = tokens[i];
+        const merge = tokens[i + 1];
+        if (pr !== undefined &&
+            merge !== undefined &&
+            normalizeShellToken(pr).toLowerCase() === "pr" &&
+            normalizeShellToken(merge).toLowerCase() === "merge") {
+            return "merge";
+        }
+        return null;
+    }
+    return null;
+}
+/**
+ * List all classifiable push/merge ops in a shell command (#2711).
+ * Scans every list/pipeline/newline segment so compound commands like
+ * `gh pr merge 1 && git push` surface both ops (dispatcher evaluates each).
+ * Newlines are delimiters so multi-line scripts cannot hide a later push/merge.
+ */
+export function listShellOps(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const found = new Set();
+    // Quote-aware split so separators inside quotes are not treated as list ops.
+    for (const raw of splitShellSegments(cmd)) {
+        const op = classifyShellSegment(raw);
+        if (op !== null)
+            found.add(op);
+    }
+    const out = [];
+    // Stable order for deterministic multi-op evaluation.
+    if (found.has("push"))
+        out.push("push");
+    if (found.has("merge"))
+        out.push("merge");
+    return out;
+}
+/**
+ * Classify a shell command string for push/merge scopes (#2711).
+ * Unclassifiable commands return null (fail open at the gate).
+ * When a compound command has multiple ops, returns the first of listShellOps
+ * (push before merge); prefer listShellOps + evaluate-each for enforcement.
+ *
+ * Patterns (intentionally narrow; prefer false-open over false-deny):
+ * - push: `git push`, `git.exe push`, with optional env / -C / -c prefixes
+ * - merge: `gh pr merge`, `gh.exe pr merge`
+ */
+export function classifyShellCommand(command) {
+    const ops = listShellOps(command);
+    return ops[0] ?? null;
+}
+/**
+ * Classify an MCP (or MCP-like) tool name + optional argument blob for push/merge (#2711).
+ * Returns null when the tool is not a known push/merge mutation (fail open).
+ */
+export function classifyMcpTool(toolName, argsText = null) {
+    const name = toolName.trim().toLowerCase();
+    if (name.length === 0)
+        return null;
+    // Common GitHub MCP / bridge spellings for merge
+    if (/merge[_-]?pull[_-]?request/.test(name) ||
+        /pull[_-]?request[_-]?merge/.test(name) ||
+        /(^|__)merge_pr($|__)/.test(name) ||
+        /pr[_-]?merge/.test(name)) {
+        return "merge";
+    }
+    // Push-like tool names (narrow — prefer fail-open)
+    if (/(^|__)git[_-]?push($|__)/.test(name) || /push[_-]?branch/.test(name)) {
+        return "push";
+    }
+    if (/push/.test(name) && /(git|branch|remote|ref)/.test(name))
+        return "push";
+    const blob = (argsText ?? "").toLowerCase();
+    if (blob.length > 0) {
+        if (/\bgit(?:\.exe)?\s+push\b/.test(blob))
+            return "push";
+        if (/\bgh(?:\.exe)?\s+pr\s+merge\b/.test(blob))
+            return "merge";
+    }
+    return null;
+}
+/**
+ * Evaluate scopes.push / scopes.merge for a classifiable shell/MCP operation (#2711).
+ * null op → allow (unclassifiable fail-open). disabled policy → allow.
+ */
+export function evaluateRuntimeAuthorityShellOp(input) {
+    const { policy, op } = input;
+    if (!policy.enabled) {
+        return { allowed: true, reason: null, code: null, unclassifiable: op === null };
+    }
+    if (op === null) {
+        return { allowed: true, reason: null, code: null, unclassifiable: true };
+    }
+    if (op === "push" && !policy.scopes.push) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            unclassifiable: false,
+            reason: "Directive denied this shell/MCP operation: plan.policy.runtimeAuthority.scopes.push is false. " +
+                "Grant the push scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    if (op === "merge" && !policy.scopes.merge) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            unclassifiable: false,
+            reason: "Directive denied this shell/MCP operation: plan.policy.runtimeAuthority.scopes.merge is false. " +
+                "Grant the merge scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    return { allowed: true, reason: null, code: null, unclassifiable: false };
+}
 //# sourceMappingURL=runtime-authority.js.map

package/dist/review-monitor/constants.js

@@ -40,7 +40,7 @@ export const REVIEW_MONITOR_HELP = "usage: task verify:review-monitor -- --pr <N
     "\n" +
     "Claim a lease after spawning Approach 1:\n" +
     "  task review-monitor:register -- --pr <N> --monitor-agent-id <id> \\\n" +
-    "    --platform-primitive cursor-task|spawn_subagent|start_agent \\\n" +
+    "    --platform-primitive cursor-task|spawn_subagent|start_agent|sessions_spawn \\\n" +
     "    [--head-sha SHA] [--repo OWNER/REPO] [--force]\n" +
     "\n" +
     "Release when done:\n" +
@@ -54,7 +54,8 @@ export const REGISTER_HELP = "usage: task review-monitor:register -- --pr <N> --
     "required:\n" +
     "  --pr N                     Pull request number\n" +
     "  --monitor-agent-id ID      Stable poller agent id / Task handle\n" +
-    "  --platform-primitive P     start_agent | spawn_subagent | cursor-task\n" +
+    "  --platform-primitive P     start_agent | spawn_subagent | cursor-task |\n" +
+    "                             sessions_spawn | openclaw-sessions-spawn (#2876)\n" +
     "\n" +
     "options:\n" +
     "  --repo OWNER/REPO          Repository (default: origin / DEFT_TRIAGE_REPO)\n" +

package/dist/review-monitor/tier-detection.d.ts

@@ -1,5 +1,9 @@
 import { MONITORING_TIER_1, MONITORING_TIER_2, MONITORING_TIER_3 } from "./constants.js";
-export type PlatformPrimitive = "start_agent" | "spawn_subagent" | "cursor-task";
+/** Canonical Approach-1 platform primitives for review-monitor register/verify (#2655 / #2876). */
+export type PlatformPrimitive = "start_agent" | "spawn_subagent" | "cursor-task" | "sessions_spawn" | "openclaw-sessions-spawn";
+/** Accepted `--platform-primitive` values (register CLI + help text). */
+export declare const PLATFORM_PRIMITIVES: readonly PlatformPrimitive[];
+export declare const PLATFORM_PRIMITIVE_SET: Set<string>;
 export interface MonitoringTierProbe {
     readonly tier: typeof MONITORING_TIER_1 | typeof MONITORING_TIER_2 | typeof MONITORING_TIER_3;
     readonly primitive: PlatformPrimitive | null;
@@ -7,7 +11,7 @@ export interface MonitoringTierProbe {
 }
 /**
  * Inline Tier-1 detection aligned with the swarm Phase 3 / review-cycle matrix
- * (#1877 / #2655). Prefer `task platform:capabilities` when available (#1357);
+ * (#1877 / #2655 / #2876). Prefer `task platform:capabilities` when available (#1357);
  * this probe does not block MVP.
  */
 export declare function probeMonitoringTier(environ?: NodeJS.ProcessEnv): MonitoringTierProbe;

package/dist/review-monitor/tier-detection.js

@@ -1,12 +1,24 @@
 import { MONITORING_TIER_1, MONITORING_TIER_2, MONITORING_TIER_3 } from "./constants.js";
 const TRUTHY = new Set(["1", "true", "yes", "on"]);
+/** Accepted `--platform-primitive` values (register CLI + help text). */
+export const PLATFORM_PRIMITIVES = [
+    "start_agent",
+    "spawn_subagent",
+    "cursor-task",
+    "sessions_spawn",
+    "openclaw-sessions-spawn",
+];
+export const PLATFORM_PRIMITIVE_SET = new Set(PLATFORM_PRIMITIVES);
 function envTruthy(environ, name) {
     return TRUTHY.has((environ[name] ?? "").trim().toLowerCase());
 }
 function probeOverride(environ) {
     const raw = (environ.DEFT_MONITOR_TIER ?? environ.DEFT_MONITOR_TIER_OVERRIDE ?? "").trim();
     if (raw === "1" || raw.toLowerCase() === "tier1") {
-        const primitive = environ.DEFT_MONITOR_TIER1_PRIMITIVE ?? "cursor-task";
+        const requested = (environ.DEFT_MONITOR_TIER1_PRIMITIVE ?? "cursor-task").trim();
+        const primitive = PLATFORM_PRIMITIVE_SET.has(requested)
+            ? requested
+            : "cursor-task";
         return { tier: MONITORING_TIER_1, primitive, descriptor: "override-tier1" };
     }
     if (raw === "3" || raw.toLowerCase() === "tier3") {
@@ -16,7 +28,7 @@ function probeOverride(environ) {
 }
 /**
  * Inline Tier-1 detection aligned with the swarm Phase 3 / review-cycle matrix
- * (#1877 / #2655). Prefer `task platform:capabilities` when available (#1357);
+ * (#1877 / #2655 / #2876). Prefer `task platform:capabilities` when available (#1357);
  * this probe does not block MVP.
  */
 export function probeMonitoringTier(environ = process.env) {
@@ -41,6 +53,19 @@ export function probeMonitoringTier(environ = process.env) {
         };
     }
     const runtime = (environ.DEFT_AGENT_RUNTIME ?? "").trim().toLowerCase();
+    // OpenClaw: sessions_spawn is the Tier-1 Approach 1 primitive (#2876).
+    // Alias openclaw-sessions-spawn accepted on register for explicit naming.
+    if (envTruthy(environ, "DEFT_PROBE_SESSIONS_SPAWN") ||
+        envTruthy(environ, "DEFT_HAS_SESSIONS_SPAWN") ||
+        envTruthy(environ, "DEFT_PROBE_OPENCLAW") ||
+        envTruthy(environ, "OPENCLAW") ||
+        runtime === "openclaw" ||
+        runtime === "openclaw-sessions-spawn") {
+        const alias = (environ.DEFT_MONITOR_TIER1_PRIMITIVE ?? "").trim() === "openclaw-sessions-spawn"
+            ? "openclaw-sessions-spawn"
+            : "sessions_spawn";
+        return { tier: MONITORING_TIER_1, primitive: alias, descriptor: "openclaw" };
+    }
     if (envTruthy(environ, "DEFT_PROBE_GROK_BUILD") ||
         envTruthy(environ, "GROK_BUILD") ||
         runtime === "grok-build") {

package/dist/scope/transition.js

@@ -11,6 +11,43 @@ import { detectLifecycleFolder, updateDecomposedChildBackReferences, updateDecom
 import { syncProjectDefinitionAfterScopeMove } from "./project-definition-sync.js";
 import { syncSpecificationAfterScopeMove } from "./specification-sync.js";
 import { utcNowIso } from "./vbrief-json.js";
+/** Item statuses that still represent unfinished work and should advance on terminal transitions (#2862). */
+const NON_TERMINAL_ITEM_STATUSES = new Set(["pending", "proposed", "running"]);
+/** Terminal lifecycle actions that reconcile the brief's own plan.items (#2862). */
+const OWN_ITEMS_RECONCILE_ACTIONS = new Set(["complete", "fail", "cancel"]);
+/**
+ * Advance non-terminal plan.items / subItems to the terminal target status.
+ * Leaves cancelled / failed / completed / other non-pending-proposed-running items alone (#2862).
+ */
+function advanceNonTerminalOwnItems(items, targetStatus) {
+    if (!Array.isArray(items)) {
+        return;
+    }
+    for (const item of items) {
+        if (item === null || typeof item !== "object" || Array.isArray(item)) {
+            continue;
+        }
+        const obj = item;
+        const status = String(obj.status ?? "");
+        if (NON_TERMINAL_ITEM_STATUSES.has(status)) {
+            obj.status = targetStatus;
+        }
+        advanceNonTerminalOwnItems(obj.subItems, targetStatus);
+        advanceNonTerminalOwnItems(obj.items, targetStatus);
+    }
+}
+/**
+ * Refresh the document envelope `updated` stamp to match `plan.updated`.
+ * Stamps whichever of xBRIEFInfo (v0.8) / vBRIEFInfo (v0.6) is present — never creates one (#2862 / #2346).
+ */
+function stampEnvelopeUpdated(data, nowIso) {
+    for (const key of ["xBRIEFInfo", "vBRIEFInfo"]) {
+        const env = data[key];
+        if (typeof env === "object" && env !== null && !Array.isArray(env)) {
+            env.updated = nowIso;
+        }
+    }
+}
 export function runTransition(action, filePath, now = new Date()) {
     if (!(action in TRANSITIONS)) {
         const valid = Object.keys(TRANSITIONS).sort().join(", ");
@@ -96,6 +133,12 @@ export function runTransition(action, filePath, now = new Date()) {
     const nowIso = utcNowIso(now);
     planObj.status = targetStatus;
     planObj.updated = nowIso;
+    // Keep the envelope clock aligned with plan.updated on every mutating transition (#2862).
+    stampEnvelopeUpdated(data, nowIso);
+    // Reconcile the completing brief's own plan.items (mirrors #1527 / #2566 registry sync) (#2862).
+    if (OWN_ITEMS_RECONCILE_ACTIONS.has(act)) {
+        advanceNonTerminalOwnItems(planObj.items, targetStatus);
+    }
     if (act === "complete") {
         stampCompletionMetadata(planObj, projectRoot, nowIso);
     }

package/dist/session/release-availability.d.ts

@@ -1,3 +1,5 @@
+/** Display/back-compat constant; resolution flows through resolveTriageCachePath (#2869). */
+export declare const STATE_RELATIVE_PATH: string;
 export interface ReleaseAvailabilityProbeOptions {
     readonly now?: Date;
     readonly env?: NodeJS.ProcessEnv;

package/dist/session/release-availability.js

@@ -4,9 +4,15 @@ import { dirname, join } from "node:path";
 import { locateManifest, parseInstallManifest } from "../doctor/manifest.js";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { evaluateReleaseAvailability } from "../doctor/release-availability.js";
+import { resolveTriageCachePath } from "../triage/cache-path.js";
 const THROTTLE_MS = 24 * 60 * 60 * 1000;
 const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
-const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", "release-availability-state.json");
+const STATE_FILE_NAME = "release-availability-state.json";
+/** Display/back-compat constant; resolution flows through resolveTriageCachePath (#2869). */
+export const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", STATE_FILE_NAME);
+function resolveReleaseAvailabilityStatePath(projectRoot) {
+    return resolveTriageCachePath(projectRoot, STATE_FILE_NAME);
+}
 function defaultReadText(path) {
     try {
         return readFileSync(path, "utf8");
@@ -91,18 +97,27 @@ export function probeSessionReleaseAvailability(projectRoot, options = {}) {
     const availability = evaluateReleaseAvailability(installed, npmResult.ok ? npmResult.version : null);
     if (availability.status !== "available")
         return { lines };
-    const statePath = join(projectRoot, STATE_RELATIVE_PATH);
-    const state = parseState((options.readState ?? defaultReadText)(statePath));
+    let statePath = null;
+    try {
+        statePath = resolveReleaseAvailabilityStatePath(projectRoot);
+    }
+    catch {
+        // Symlink-escaping triage-cache path: skip throttle state; still emit advisory (#2869).
+        statePath = null;
+    }
+    const state = parseState(statePath !== null ? (options.readState ?? defaultReadText)(statePath) : null);
     const now = options.now ?? new Date();
     if (isThrottled(state, availability.latestVersion, now))
         return { lines: [] };
     const message = `[deft release] Newer Directive release available: v${availability.latestVersion} ` +
         `(installed v${availability.installedVersion}). Run \`npm i -g @deftai/directive@latest\`.`;
-    try {
-        (options.writeState ?? defaultWriteState)(statePath, `${JSON.stringify({ latestVersion: availability.latestVersion, notifiedAt: now.toISOString() }, null, 2)}\n`);
-    }
-    catch {
-        // The advisory remains useful if its best-effort throttle state cannot persist.
+    if (statePath !== null) {
+        try {
+            (options.writeState ?? defaultWriteState)(statePath, `${JSON.stringify({ latestVersion: availability.latestVersion, notifiedAt: now.toISOString() }, null, 2)}\n`);
+        }
+        catch {
+            // The advisory remains useful if its best-effort throttle state cannot persist.
+        }
     }
     return { lines: [...lines, message] };
 }

package/dist/session/session-start-hook.d.ts

@@ -1,9 +1,12 @@
+import { detectNoDeftDirective } from "../policy/no-deft-directive.js";
 import { writeSentinel } from "./ritual-sentinel.js";
 export interface SessionStartHookOptions {
     readonly resolveVersionFn?: () => string;
     readonly detectBranchFn?: (projectRoot: string) => string | null;
     readonly detectLatestActiveVbriefFn?: (projectRoot: string) => string | null;
     readonly writeSentinelFn?: typeof writeSentinel;
+    /** Test seam for #2926 opt-out detection. */
+    readonly detectNoDeftDirectiveFn?: typeof detectNoDeftDirective;
 }
 /** Write ``.deft/last-session.json`` from current git state (#1269). */
 export declare function runSessionStartHookWrite(projectRoot: string, options?: SessionStartHookOptions): {

package/dist/session/session-start-hook.js

@@ -1,8 +1,23 @@
 import { resolveVersion } from "../doctor/paths.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { detectBranch } from "./git.js";
 import { detectLatestActiveVbrief, writeSentinel } from "./ritual-sentinel.js";
 /** Write ``.deft/last-session.json`` from current git state (#1269). */
 export function runSessionStartHookWrite(projectRoot, options = {}) {
+    const detectOptOut = options.detectNoDeftDirectiveFn ?? detectNoDeftDirective;
+    // #2926: root opt-out wins — host SessionStart must not write ritual bookkeeping.
+    const optOut = detectOptOut(projectRoot);
+    if (optOut.present) {
+        const lines = [NO_DEFT_DIRECTIVE_DISABLED_MESSAGE];
+        if (optOut.inconsistent) {
+            lines.push(NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE);
+        }
+        return {
+            code: optOut.inconsistent ? 1 : 0,
+            stdout: `${lines.join("\n")}\n`,
+            stderr: optOut.inconsistent ? `${NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE}\n` : "",
+        };
+    }
     const detectBranchFn = options.detectBranchFn ?? detectBranch;
     const detectVbriefFn = options.detectLatestActiveVbriefFn ?? detectLatestActiveVbrief;
     const resolveVersionFn = options.resolveVersionFn ?? resolveVersion;

package/dist/session/session-start.js

@@ -4,6 +4,7 @@ import { emitSessionEvalReadback } from "../eval/readback.js";
 import { MIGRATE_COMPLETION_NUDGE, shouldEmitMigrateNudge } from "../init-deposit/migrate.js";
 import { detectEnvironmentContext, environmentContextToDict, formatEnvironmentContext, } from "../platform/shell-context.js";
 import { disclosureLine } from "../policy/disclosure.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { resolvePolicy } from "../policy/resolve.js";
 import { maybeFormatProductSignalConsentPrompt } from "../product-signal/consent-prompt.js";
 import { maybeRunStalenessTickler } from "../staleness-tickler/run.js";
@@ -233,6 +234,35 @@ export function runSessionStart(projectRoot, options = {}) {
     const deferrals = options.deferrals ?? {};
     const runGit = options.runGit ?? defaultGitRunner;
     const environment = (options.probeEnvironment ?? detectEnvironmentContext)();
+    // #2926: official root opt-out wins locally — skip Directive session ritual.
+    // disabled = skip ritual (exit 0 clean / 1 inconsistent). ready stays false so
+    // automation does not treat opt-out as "session fully initialized for work".
+    const optOut = detectNoDeftDirective(projectRoot);
+    if (optOut.present) {
+        const lines = [NO_DEFT_DIRECTIVE_DISABLED_MESSAGE];
+        if (optOut.inconsistent) {
+            lines.push(NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE);
+        }
+        const code = optOut.inconsistent ? 1 : 0;
+        return {
+            code,
+            payload: {
+                ready: false,
+                exit_code: code,
+                disabled: true,
+                disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                inconsistent: optOut.inconsistent,
+                inconsistent_policy: optOut.inconsistent
+                    ? NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY
+                    : undefined,
+                deposit_present: optOut.depositPresent,
+                posture,
+                environment: environmentContextToDict(environment),
+                message: NO_DEFT_DIRECTIVE_DISABLED_MESSAGE,
+            },
+            lines,
+        };
+    }
     if (posture === READ_ONLY_POSTURE) {
         return runReadOnlySessionStart(projectRoot, options, instant, environment);
     }

package/dist/swarm/routing-set-cli.js

@@ -2,9 +2,8 @@
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, } from "../fs/projection-containment.js";
-import { getPlatformCapabilities } from "../intake/platform-capabilities.js";
 import { EXIT_CONFIG_ERROR, EXIT_OK } from "./constants.js";
-import { dispatchProviderFromRuntime, HARNESS_BOUND_PROVIDERS, ROUTING_MODE_HARNESS_DEFAULT, ROUTING_MODE_PINNED, resolveRoutingPath, SWARM_WORKER_ROLES, writeModelDecision, } from "./routing.js";
+import { HARNESS_BOUND_PROVIDERS, ROUTING_MODE_HARNESS_DEFAULT, ROUTING_MODE_PINNED, resolveDispatchProvider, resolveRoutingPath, SWARM_WORKER_ROLES, writeModelDecision, } from "./routing.js";
 export function routingSetMain(argv = process.argv.slice(2)) {
     let projectRoot = ".";
     let provider = null;
@@ -47,14 +46,10 @@ export function routingSetMain(argv = process.argv.slice(2)) {
     }
     let resolvedProvider = provider;
     if (resolvedProvider === null || resolvedProvider.length === 0) {
-        let runtimeMode = "";
-        try {
-            runtimeMode = getPlatformCapabilities().runtimeMode;
-        }
-        catch {
-            runtimeMode = "";
-        }
-        resolvedProvider = dispatchProviderFromRuntime(runtimeMode);
+        // Same key as launch + verify:routing: OPENCLAW / sessions_spawn → openclaw
+        // (#2875 Greptile P1). Do not map via runtimeMode alone — OpenClaw-only envs
+        // are often local-unsandboxed while still dispatching under provider openclaw.
+        resolvedProvider = resolveDispatchProvider(process.env);
     }
     if (harnessDefault) {
         if (model !== null) {

package/dist/swarm/routing.d.ts

@@ -9,7 +9,7 @@ export declare const ROUTING_MODE_HARNESS_DEFAULT = "harness-default";
 export declare const ROUTING_FILENAME = "routing.local.json";
 /** Providers whose model is harness-bound -- deft cannot pin or verify a slug. */
 export declare const HARNESS_BOUND_PROVIDERS: Set<string>;
-/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877). */
+/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877 / #2875). */
 export declare const ROUTING_GATED_DISPATCH_PROVIDERS: Set<string>;
 export interface RouteDecision {
     model: string | null;
@@ -54,7 +54,8 @@ export declare function dispatchProviderFromRuntime(runtimeMode: string): string
  * Resolve the `dispatch_provider` routing key from the active runtime envelope.
  * Separate from `runtime_mode` (#1557): Cursor sessions may carry
  * `runtime_mode=cloud-headless` for gh-auth purposes but route under provider
- * `cursor` for model selection (#1877).
+ * `cursor` for model selection (#1877). OpenClaw routes under `openclaw` when
+ * `sessions_spawn` / OPENCLAW signals are present (#2875).
  */
 export declare function resolveDispatchProvider(environ?: NodeJS.ProcessEnv): string;
 /**