@deftai/directive-core 0.87.0 → 0.88.0

package/dist/cache/scanner.d.ts

@@ -2,7 +2,7 @@
  * Quarantine scanner v2 port (mirrors `scripts/cache_scanner.py`).
  * SCANNER_VERSION must stay in lockstep with the Python module.
  */
-export declare const SCANNER_VERSION = "2.1.0";
+export declare const SCANNER_VERSION = "2.2.0";
 export interface ScanFlag {
     category: string;
     severity: string;
@@ -21,6 +21,16 @@ export interface ScanResult {
  * Scans the line once; byte-identical match semantics to the prior regex.
  */
 export declare function lineHasShellVector(line: string): boolean;
+/**
+ * Neutralize a body line so it cannot act as a CommonMark fence open/close.
+ * Used on content placed inside a ```quarantined wrapper (#2915 / cache-quarantine-03).
+ *
+ * A nested bare ``` (or longer run, optional ≤3-space indent) would otherwise
+ * early-close the outer fence and let following attacker text render outside
+ * the quarantined info-string. Break the delimiter run by inserting a backslash
+ * after the first fence character: ``` → `\`` , ~~~ → ~\~~ .
+ */
+export declare function neutralizeFenceLine(line: string): string;
 /** Run scanner v2 over content markdown. */
 export declare function scan(contentMd: string, scannedAt?: string): ScanResult;
 /** Map scan flags for meta.json (omit match_count when zero). */

package/dist/cache/scanner.js

@@ -3,9 +3,12 @@ import { parseMarkdownHeading } from "../text/redos-safe.js";
  * Quarantine scanner v2 port (mirrors `scripts/cache_scanner.py`).
  * SCANNER_VERSION must stay in lockstep with the Python module.
  */
-export const SCANNER_VERSION = "2.1.0";
+export const SCANNER_VERSION = "2.2.0";
 const CREDENTIAL_PATTERNS = [
     ["github-pat", /\bgh[pousr]_[A-Za-z0-9]{30,}\b/],
+    // #2910: fine-grained PATs (`github_pat_...`) — aligned with product-signal
+    // SECRET_PATTERNS so cache/ingest fail-closes on modern GitHub tokens.
+    ["github-fine-grained-pat", /\bgithub_pat_[A-Za-z0-9_]{20,}\b/],
     ["anthropic-api-key", /\bsk-ant-[A-Za-z0-9_-]{20,}\b/],
     ["openai-api-key", /\bsk-[A-Za-z0-9]{20,}\b/],
     ["slack-token", /\bxox[bp]-[A-Za-z0-9-]{20,}\b/],
@@ -151,6 +154,26 @@ export function lineHasShellVector(line) {
 const FENCE_RE = /^(```|~~~)/;
 const QUARANTINE_FENCE_OPEN = "```quarantined";
 const QUARANTINE_FENCE_CLOSE = "```";
+/**
+ * Neutralize a body line so it cannot act as a CommonMark fence open/close.
+ * Used on content placed inside a ```quarantined wrapper (#2915 / cache-quarantine-03).
+ *
+ * A nested bare ``` (or longer run, optional ≤3-space indent) would otherwise
+ * early-close the outer fence and let following attacker text render outside
+ * the quarantined info-string. Break the delimiter run by inserting a backslash
+ * after the first fence character: ``` → `\`` , ~~~ → ~\~~ .
+ */
+export function neutralizeFenceLine(line) {
+    const match = /^( {0,3})(`{3,}|~{3,})(.*)$/.exec(line);
+    if (match === null)
+        return line;
+    const indent = match[1] ?? "";
+    const delim = match[2] ?? "";
+    const rest = match[3] ?? "";
+    // One backslash after the first fence char breaks the delimiter run.
+    // Concat (not a template literal) so "\\" is unambiguously a single "\".
+    return indent + delim[0] + "\\" + delim.slice(1) + rest;
+}
 function isInvisible(ch) {
     const cp = ch.codePointAt(0);
     if (cp === undefined)
@@ -277,7 +300,8 @@ function detectInjectionHeading(text) {
             if (hSignal || bSignal) {
                 out.push(QUARANTINE_FENCE_OPEN);
                 for (let j = i; j < sectionEnd; j += 1) {
-                    out.push(lines[j] ?? "");
+                    // #2915: neutralize nested fence lines so they cannot early-close.
+                    out.push(neutralizeFenceLine(lines[j] ?? ""));
                 }
                 out.push(QUARANTINE_FENCE_CLOSE);
                 sectionsWrapped += 1;
@@ -292,7 +316,8 @@ function detectInjectionHeading(text) {
         }
         if (headingSignal(line) || lineHasShellVector(line)) {
             out.push(QUARANTINE_FENCE_OPEN);
-            out.push(line);
+            // #2915: neutralize in case the single line itself is fence-shaped.
+            out.push(neutralizeFenceLine(line));
             out.push(QUARANTINE_FENCE_CLOSE);
             sectionsWrapped += 1;
             i += 1;
@@ -310,7 +335,7 @@ function detectInjectionHeading(text) {
         {
             category: "injection-heading",
             severity: "fence-and-pass",
-            detail: `wrapped ${sectionsWrapped} injection-shaped section(s) in \`quarantined\` fence (v2.1.0 strict-signal policy)`,
+            detail: `wrapped ${sectionsWrapped} injection-shaped section(s) in \`quarantined\` fence (v2.2.0 strict-signal policy)`,
             match_count: sectionsWrapped,
         },
     ];

package/dist/check/gate-lists.js

@@ -19,6 +19,7 @@ export const FRAMEWORK_CHECK_GATES = [
     "verify:rule-ownership",
     "verify:biome-config",
     "verify:content-manifest",
+    "verify:license-sync",
     "verify:skill-external-fetch-gate",
     "verify:contract-drift",
     "verify:cursor-tier1",

package/dist/content-contracts/skills/helpers.d.ts

@@ -13,6 +13,16 @@ export declare function resolveRepoPath(relPath: string): string;
 export declare function readRepoFile(relPath: string): string;
 export declare function repoFileExists(relPath: string): boolean;
 export declare function readSkill(relPath: string): string;
+/**
+ * Progressive-disclosure surface for deft-directive-swarm (#2928).
+ * Thin SKILL.md is the dispatch card; operative depth lives under references/.
+ * Content contracts assert against this ordered join so host adapters can leave
+ * the always-loaded SKILL without dropping coverage.
+ */
+export declare const SWARM_SKILL_REL = "skills/deft-directive-swarm/SKILL.md";
+/** Stable load order: core phases, then host launch adapters, then ops. */
+export declare const SWARM_REFERENCE_ORDER: readonly ["core-phase-0.md", "core-phase-1-2.md", "core-phase-3.md", "host-warp.md", "host-generic.md", "host-grok-build.md", "host-cursor.md", "host-openclaw.md", "core-phase-4.md", "core-phase-5-6.md", "core-ops.md"];
+export declare function readSwarmSkillSurface(): string;
 export declare function readAgentsMd(): string;
 /** Slice the first `## Returning Sessions` section body out of AGENTS.md. */
 export declare function returningSessionsSection(): string;

package/dist/content-contracts/skills/helpers.js

@@ -32,6 +32,41 @@ export function repoFileExists(relPath) {
 export function readSkill(relPath) {
     return readRepoFile(relPath);
 }
+/**
+ * Progressive-disclosure surface for deft-directive-swarm (#2928).
+ * Thin SKILL.md is the dispatch card; operative depth lives under references/.
+ * Content contracts assert against this ordered join so host adapters can leave
+ * the always-loaded SKILL without dropping coverage.
+ */
+export const SWARM_SKILL_REL = "skills/deft-directive-swarm/SKILL.md";
+/** Stable load order: core phases, then host launch adapters, then ops. */
+export const SWARM_REFERENCE_ORDER = [
+    "core-phase-0.md",
+    "core-phase-1-2.md",
+    "core-phase-3.md",
+    "host-warp.md",
+    "host-generic.md",
+    "host-grok-build.md",
+    "host-cursor.md",
+    "host-openclaw.md",
+    "core-phase-4.md",
+    "core-phase-5-6.md",
+    "core-ops.md",
+];
+export function readSwarmSkillSurface() {
+    const parts = [readRepoFile(SWARM_SKILL_REL)];
+    for (const name of SWARM_REFERENCE_ORDER) {
+        const rel = `skills/deft-directive-swarm/references/${name}`;
+        // Fail-loud: SWARM_REFERENCE_ORDER is the complete shipped surface (#2928).
+        // Silently skipping a missing reference lets incomplete packs pass contracts
+        // that never assert markers unique to the omitted file (Greptile on #2936).
+        if (!repoFileExists(rel)) {
+            throw new Error(`readSwarmSkillSurface: missing declared reference ${rel}`);
+        }
+        parts.push(readRepoFile(rel));
+    }
+    return parts.join("\n\n");
+}
 export function readAgentsMd() {
     return readRepoFile("AGENTS.md");
 }

package/dist/deposit/copy-tree.d.ts

@@ -5,12 +5,30 @@
  * directories are created mode 0o755; files keep their source permission bits
  * (including the executable bit for hooks and the `run` launcher).
  *
- * Refs #1942 S1, #1477.
+ * `replaceTree` is the npm-path counterpart of Go `swapInCore` (#2913): full
+ * destination replace so dst-only agent content cannot survive a refresh.
+ *
+ * Refs #1942 S1, #1477, #2913.
  */
 /**
  * Recursively copy `src` into `dst`, preserving nested structure and file modes.
  *
  * The contents of `src` are placed under `dst` (equivalent to Go `copyDir`).
+ * This is **additive** — pre-existing destination entries not present in `src`
+ * survive. Prefer {@link replaceTree} for deposit refresh integrity (#2913).
  */
 export declare function copyTree(src: string, dst: string): Promise<void>;
+/**
+ * Full-tree replace of `dst` with the contents of `src` (Go `swapInCore` parity).
+ *
+ * Stages the new tree out-of-line, moves any existing `dst` aside, then moves
+ * the staged tree into place. On failure after the old tree was moved, restores
+ * the previous payload. Destination-only files (stale or malicious) do **not**
+ * survive — unlike additive {@link copyTree}.
+ *
+ * Refuses to operate when `dst` itself is a symlink (#2305 / #2912).
+ *
+ * Refs #2913, #2904 (install-deposit-06).
+ */
+export declare function replaceTree(src: string, dst: string): Promise<void>;
 //# sourceMappingURL=copy-tree.d.ts.map

package/dist/deposit/copy-tree.js

@@ -5,22 +5,27 @@
  * directories are created mode 0o755; files keep their source permission bits
  * (including the executable bit for hooks and the `run` launcher).
  *
- * Refs #1942 S1, #1477.
+ * `replaceTree` is the npm-path counterpart of Go `swapInCore` (#2913): full
+ * destination replace so dst-only agent content cannot survive a refresh.
+ *
+ * Refs #1942 S1, #1477, #2913.
  */
 import { constants } from "node:fs";
-import { lstat, mkdir, open, readdir, readFile, stat } from "node:fs/promises";
+import { lstat, mkdir, mkdtemp, open, readdir, readFile, rename, rm, stat } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 const DEFAULT_FILE_MODE = 0o644;
 const DEFAULT_DIR_MODE = 0o755;
-async function assertDestinationIsNotSymlink(path) {
+async function assertDestinationIsNotSymlink(path, label = "copyTree") {
     try {
         const info = await lstat(path);
         if (info.isSymbolicLink()) {
-            throw new Error(`copyTree: refusing to write through destination symlink ${path}`);
+            throw new Error(`${label}: refusing to write through destination symlink ${path}`);
         }
     }
     catch (err) {
-        if (err instanceof Error && err.message.startsWith("copyTree: refusing")) {
+        if (err instanceof Error &&
+            err.message.includes("refusing to write through destination symlink")) {
             throw err;
         }
         if (err.code === "ENOENT") {
@@ -77,6 +82,8 @@ async function copyDirContents(src, dst) {
  * Recursively copy `src` into `dst`, preserving nested structure and file modes.
  *
  * The contents of `src` are placed under `dst` (equivalent to Go `copyDir`).
+ * This is **additive** — pre-existing destination entries not present in `src`
+ * survive. Prefer {@link replaceTree} for deposit refresh integrity (#2913).
  */
 export async function copyTree(src, dst) {
     const srcInfo = await stat(src);
@@ -85,4 +92,126 @@ export async function copyTree(src, dst) {
     }
     await copyDirContents(src, dst);
 }
+async function pathExists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return false;
+        throw err;
+    }
+}
+/**
+ * Move `src` to `dst`, falling back to copy+remove across devices (EXDEV),
+ * mirroring Go `movePayload` used by `swapInCore`.
+ */
+async function moveTree(src, dst) {
+    await mkdir(dirname(dst), { recursive: true, mode: DEFAULT_DIR_MODE });
+    try {
+        await rename(src, dst);
+        return;
+    }
+    catch (err) {
+        const code = err.code;
+        if (code !== "EXDEV" && code !== "EPERM") {
+            // On some platforms rename across volumes raises EXDEV; fall through only
+            // for cross-device / permission cases that still allow a copy fallback.
+            if (code !== "EINVAL")
+                throw err;
+        }
+    }
+    await copyDirContents(src, dst);
+    await rm(src, { recursive: true, force: true });
+}
+/**
+ * Full-tree replace of `dst` with the contents of `src` (Go `swapInCore` parity).
+ *
+ * Stages the new tree out-of-line, moves any existing `dst` aside, then moves
+ * the staged tree into place. On failure after the old tree was moved, restores
+ * the previous payload. Destination-only files (stale or malicious) do **not**
+ * survive — unlike additive {@link copyTree}.
+ *
+ * Refuses to operate when `dst` itself is a symlink (#2305 / #2912).
+ *
+ * Refs #2913, #2904 (install-deposit-06).
+ */
+export async function replaceTree(src, dst) {
+    const srcInfo = await stat(src);
+    if (!srcInfo.isDirectory()) {
+        throw new Error(`replaceTree: source ${src} is not a directory`);
+    }
+    await assertDestinationIsNotSymlink(dst, "replaceTree");
+    const parent = dirname(dst);
+    await mkdir(parent, { recursive: true, mode: DEFAULT_DIR_MODE });
+    const staging = await mkdtemp(join(tmpdir(), "deft-core-stage-"));
+    let backup = null;
+    /** When true, leave `backup` on disk so an operator can recover after dual failure. */
+    let preserveBackupOnExit = false;
+    try {
+        await copyDirContents(src, staging);
+        if (await pathExists(dst)) {
+            backup = await mkdtemp(join(tmpdir(), "deft-core-bak-"));
+            // mkdtemp created an empty dir; remove it so moveTree can rename onto the path.
+            await rm(backup, { recursive: true, force: true });
+            try {
+                await moveTree(dst, backup);
+            }
+            catch (asideErr) {
+                // Greptile P1: moveTree may fall back to copy+remove. If removal fails after a
+                // successful copy (or after a partial delete of dst), `backup` is the only full
+                // recovery copy while dst may already be damaged. Do NOT let `finally` delete it.
+                if (await pathExists(backup)) {
+                    preserveBackupOnExit = true;
+                }
+                else {
+                    backup = null;
+                }
+                const asideMsg = asideErr instanceof Error ? asideErr.message : String(asideErr);
+                throw new Error(`replaceTree: failed to move existing destination aside (${asideMsg})` +
+                    (backup ? ` — recovery copy at ${backup}` : ""));
+            }
+        }
+        try {
+            await moveTree(staging, dst);
+        }
+        catch (err) {
+            if (backup !== null) {
+                try {
+                    if (await pathExists(dst)) {
+                        await rm(dst, { recursive: true, force: true });
+                    }
+                    await moveTree(backup, dst);
+                    backup = null;
+                }
+                catch (restoreErr) {
+                    preserveBackupOnExit = true;
+                    const installMsg = err instanceof Error ? err.message : String(err);
+                    const restoreMsg = restoreErr instanceof Error ? restoreErr.message : String(restoreErr);
+                    throw new Error(`replaceTree: install new payload failed (${installMsg}); ROLLBACK ALSO FAILED (${restoreMsg})` +
+                        (backup ? ` — previous payload preserved at ${backup}` : ""));
+                }
+            }
+            throw err instanceof Error
+                ? err
+                : new Error(`replaceTree: install new payload failed: ${String(err)}`);
+        }
+        // Successful install — best-effort drop the backup (Go keeps it for operator
+        // rollback; the npm path does not surface a backup path today and must not
+        // litter TEMP). Cleanup MUST NOT fail the replace: the new payload is already
+        // live at `dst`. A thrown rm here would reject replaceTree and skip the
+        // VERSION stamp in runRefreshDeposit → version drift (Greptile P1).
+        if (backup !== null) {
+            await rm(backup, { recursive: true, force: true }).catch(() => undefined);
+            backup = null;
+        }
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true }).catch(() => undefined);
+        if (backup !== null && !preserveBackupOnExit) {
+            await rm(backup, { recursive: true, force: true }).catch(() => undefined);
+        }
+    }
+}
 //# sourceMappingURL=copy-tree.js.map

package/dist/doctor/main.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { evaluate as evaluateAgentsMdAdvisory } from "../agents-md-advisory/evaluate.js";
 import { contentRoot } from "../content-root.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { describeShadowedPlanExtension, detectShadowedPlanExtensions, } from "../policy/plan-extensions.js";
 import { loadProjectDefinition } from "../policy/resolve.js";
 import { checkLocalEngineIntegrity, classify, detectPackageManager, evaluateSkew, reconcileVersions, plan as resolvePlan, } from "../resolution/index.js";
@@ -62,6 +63,53 @@ export function cmdDoctor(args, seams = {}) {
     const consumerContext = resolve(projectRoot) !== resolve(frameworkRoot);
     const whichFn = seams.whichFn ?? defaultWhich;
     const nowFn = seams.now ?? (() => new Date());
+    // #2926: official root opt-out — short-circuit Directive doctor when clean;
+    // diagnose flag+deposit inconsistency (warn; exit dirty).
+    const optOut = detectNoDeftDirective(projectRoot);
+    if (optOut.present) {
+        if (optOut.inconsistent) {
+            const message = `${NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE} (${NO_DEFT_DIRECTIVE_DISABLED_MESSAGE})`;
+            if (jsonMode) {
+                const payload = {
+                    status: "disabled-inconsistent",
+                    disabled: true,
+                    disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                    inconsistent: true,
+                    inconsistent_policy: NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY,
+                    deposit_present: true,
+                    message,
+                    findings: [
+                        {
+                            severity: "warning",
+                            message,
+                            check: "no-deft-directive",
+                            policy: NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY,
+                        },
+                    ],
+                };
+                process.stdout.write(`${pythonJsonDump(payload)}\n`);
+            }
+            else if (!quietMode) {
+                process.stderr.write(`${message} [policy=${NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY}]\n`);
+            }
+            return 1;
+        }
+        if (jsonMode) {
+            const payload = {
+                status: "disabled",
+                disabled: true,
+                disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                inconsistent: false,
+                deposit_present: false,
+                message: NO_DEFT_DIRECTIVE_DISABLED_MESSAGE,
+            };
+            process.stdout.write(`${pythonJsonDump(payload)}\n`);
+        }
+        else if (!quietMode) {
+            process.stdout.write(`${NO_DEFT_DIRECTIVE_DISABLED_MESSAGE}\n`);
+        }
+        return 0;
+    }
     if (!fullMode) {
         const state = (seams.readState ?? readState)(projectRoot);
         const decision = decideThrottle(state, nowFn());

package/dist/fs/projection-containment.d.ts

@@ -37,6 +37,24 @@ export declare function assertProjectionContained(projectDir: string, targetPath
  * Pair with {@link assertProjectionContained} before read/write/mkdir/append.
  */
 export declare function assertWriteTargetSafe(projectDir: string, targetPath: string): void;
+/**
+ * Refuse projection writes that would follow an IN-TREE destination symlink on
+ * the write path (#2912).
+ *
+ * {@link assertProjectionContained} only rejects symlinks that ESCAPE the
+ * project tree, so an in-tree symlink (leaf or parent) pointing at another
+ * checked-in path is silently followed — letting a malicious or mistaken repo
+ * symlink divert a consumer projection write (AGENTS.md, .githooks/**,
+ * .gitattributes, .github/**, .agents/**, vbrief|xbrief/**, package.json, …)
+ * onto an unintended file under operator credentials.
+ *
+ * This guard first runs the escape checks in {@link assertProjectionContained},
+ * then walks every EXISTING component from the project root down to the write
+ * target and refuses the write if ANY of them is a symlink — regardless of
+ * whether the link resolves inside the tree. Call it BEFORE any projection
+ * read/write/mkdir/append on consumer deposit sinks.
+ */
+export declare function assertDestinationNotSymlink(projectDir: string, targetPath: string): void;
 /**
  * Refuse when a lifecycle corpus root is itself a symlink (#2626 category-b).
  */

package/dist/fs/projection-containment.js

@@ -133,6 +133,46 @@ export function assertWriteTargetSafe(projectDir, targetPath) {
         throw new ProjectionContainmentError(`projection write refused: ${targetAbs} is a symlink on the write path`, { projectDir: resolve(projectDir), targetPath: targetAbs, offendingPath: targetAbs });
     }
 }
+/**
+ * Refuse projection writes that would follow an IN-TREE destination symlink on
+ * the write path (#2912).
+ *
+ * {@link assertProjectionContained} only rejects symlinks that ESCAPE the
+ * project tree, so an in-tree symlink (leaf or parent) pointing at another
+ * checked-in path is silently followed — letting a malicious or mistaken repo
+ * symlink divert a consumer projection write (AGENTS.md, .githooks/**,
+ * .gitattributes, .github/**, .agents/**, vbrief|xbrief/**, package.json, …)
+ * onto an unintended file under operator credentials.
+ *
+ * This guard first runs the escape checks in {@link assertProjectionContained},
+ * then walks every EXISTING component from the project root down to the write
+ * target and refuses the write if ANY of them is a symlink — regardless of
+ * whether the link resolves inside the tree. Call it BEFORE any projection
+ * read/write/mkdir/append on consumer deposit sinks.
+ */
+export function assertDestinationNotSymlink(projectDir, targetPath) {
+    assertProjectionContained(projectDir, targetPath);
+    const projectAbs = resolve(projectDir);
+    const targetAbs = resolve(targetPath);
+    const rel = relative(projectAbs, targetAbs);
+    const segments = rel.split(/[\\/]+/).filter((segment) => segment.length > 0);
+    let current = projectAbs;
+    for (const segment of segments) {
+        current = join(current, segment);
+        let info;
+        try {
+            info = lstatSync(current);
+        }
+        catch {
+            // Component does not exist yet; nothing deeper can exist to follow.
+            break;
+        }
+        if (info.isSymbolicLink()) {
+            throw new ProjectionContainmentError(`projection write refused: ${current} is a symlink on the destination path ` +
+                `(in-tree destination symlinks are refused)`, { projectDir: projectAbs, targetPath: targetAbs, offendingPath: current });
+        }
+    }
+}
 /**
  * Refuse when a lifecycle corpus root is itself a symlink (#2626 category-b).
  */

package/dist/hooks/dispatcher.d.ts

@@ -1,8 +1,9 @@
+import { detectNoDeftDirective } from "../policy/no-deft-directive.js";
 import { type RuntimeAuthorityPolicy } from "../policy/runtime-authority.js";
 import { type VerifyResult } from "../session/verify-session-ritual.js";
 import { type ActiveScopeInspection } from "./scope.js";
 export { hookReadOnlyFromPayload, isExploreSpawn, isReadOnlyHookContext } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isSpawnTool, READ_ONLY_HOOK_ENV, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export declare const HOOK_HOSTS: readonly ["claude", "grok", "cursor", "codex"];
 export type HookHost = (typeof HOOK_HOSTS)[number];
 export declare const HOOK_EVENTS: readonly ["session.start", "session.compact", "tool.before"];
@@ -13,9 +14,13 @@ export type CompactHookHost = (typeof COMPACT_HOOK_HOSTS)[number];
 /** Hosts without a native compact hook surface — deposit skips cleanly (#2113). */
 export declare const COMPACT_HOOK_SKIP_HOSTS: readonly ["codex"];
 export type HookVerdict = "allow" | "deny";
-export type HookDecisionCode = "session-start" | "session-start-degraded" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
+export type HookDecisionCode = "session-start" | "session-start-disabled" | "session-start-degraded" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
 /** Host closed stdin with zero bytes — integration failure, not a policy gate (#2864). */
- | "stdin-empty" | "ritual-not-ready" | "scope-not-ready" | "write-propose-ready" | "write-ready" | "read-only-deny" | "spawn-explore-ready" | "spawn-ready" | "spawn-not-ready" | "runtime-policy-deny-path" | "runtime-policy-deny-scope";
+ | "stdin-empty" | "ritual-not-ready" | "scope-not-ready" | "write-propose-ready" | "write-ready" | "read-only-deny" | "spawn-explore-ready" | "spawn-ready" | "spawn-not-ready" | "runtime-policy-deny-path" | "runtime-policy-deny-scope"
+/** Shell/MCP classifiable push/merge allowed under runtimeAuthority (#2711). */
+ | "shell-op-ready"
+/** Shell/MCP tool seen but command/tool not classifiable as push/merge — fail open (#2711). */
+ | "shell-op-unclassifiable";
 export interface HookDecision {
     readonly verdict: HookVerdict;
     readonly code: HookDecisionCode;
@@ -48,6 +53,8 @@ export interface HookPolicySeams {
         stdout: string;
         stderr: string;
     };
+    /** Test seam for #2926 root opt-out on SessionStart. */
+    readonly detectNoDeftDirective?: typeof detectNoDeftDirective;
     readonly markCompactStale?: (projectRoot: string) => {
         changed: boolean;
         statePath: string;
@@ -87,6 +94,11 @@ export declare function normalizeHookProjectRoot(path: string): string;
 export declare function projectRootFromHookPayload(payload: unknown, fallback: string): string;
 export declare function isHookHost(value: string): value is HookHost;
 export declare function isHookEvent(value: string): value is HookEvent;
+/**
+ * Best-effort shell command string from host PreToolUse payloads (#2711).
+ * Hosts disagree on nesting (`tool_input.command` vs top-level `command`).
+ */
+export declare function hookShellCommand(payload: unknown): string | null;
 /** Decide a normalized event using only the P0 direct-write policy. */
 export declare function decideHook(input: HookDispatchInput, seams?: HookPolicySeams): HookDecision;
 /**