@deftai/directive-core 0.87.0 → 0.88.0

package/dist/policy/runtime-authority.js

@@ -177,4 +177,278 @@ export function evaluateRuntimeAuthorityDirectWrite(input) {
     }
     return { allowed: true, reason: null, code: null };
 }
+/** True when token is a shell env assignment (FOO=1 / FOO=). Linear; no nested quantifiers. */
+function isShellEnvAssignToken(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return false;
+    const name = token.slice(0, eq);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        return false;
+    return true;
+}
+/**
+ * Normalize a shell token for classification (#2711).
+ * Shell strips quotes, empty quote pairs, and backslash escapes before exec
+ * (`g''it` / `g\it` / `'push'` → `git` / `push`). Dropping `'`/`"`/`\` after
+ * whitespace split closes those bypasses without nested-quantifier regex. O(n).
+ */
+function normalizeShellToken(token) {
+    return token.replace(/['"\\]/g, "");
+}
+/**
+ * Split a shell command into list/pipeline/newline segments without splitting
+ * on separators that appear inside quotes or after a backslash escape (#2711).
+ * Prevents `printf '%s' ';' 'git push'` and `hello\; git push` false denials.
+ */
+function splitShellSegments(command) {
+    const segments = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (quote !== null) {
+            if (c === quote)
+                quote = null;
+            cur += c;
+            continue;
+        }
+        // Outside quotes: backslash escapes the next character (including separators).
+        if (c === "\\" && i + 1 < command.length) {
+            cur += c;
+            cur += command[i + 1] ?? "";
+            i++;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        // Outside quotes: list/pipeline separators and newlines start a new segment.
+        if (c === "&" && command[i + 1] === "&") {
+            segments.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (c === "|" && command[i + 1] === "|") {
+            segments.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (c === ";" || c === "|" || c === "&" || c === "\n" || c === "\r") {
+            segments.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += c;
+    }
+    segments.push(cur);
+    return segments;
+}
+/** Git global options that take a separate value token (not `--opt=value`). */
+const GIT_GLOBAL_VALUE_OPTS = new Set([
+    "-C",
+    "-c",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--config-env",
+    "--super-prefix",
+    "--list-cmds",
+]);
+/**
+ * Classify one shell list/pipeline segment for push/merge (#2711).
+ * Token walk is O(n) — avoids nested-quantifier ReDoS that CodeQL flags on
+ * `git (?:options)* push` style regexes (alerts #77 / #78 on this PR).
+ */
+function classifyShellSegment(segment) {
+    const tokens = segment
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0);
+    let i = 0;
+    while (i < tokens.length) {
+        const tok = tokens[i];
+        if (tok === undefined || !isShellEnvAssignToken(tok))
+            break;
+        i++;
+    }
+    const wrapTok = tokens[i];
+    if (wrapTok !== undefined) {
+        const wrap = normalizeShellToken(wrapTok).toLowerCase();
+        if (wrap === "sudo" || wrap === "env" || wrap === "command") {
+            i++;
+            while (i < tokens.length) {
+                const tok = tokens[i];
+                if (tok === undefined || !isShellEnvAssignToken(tok))
+                    break;
+                i++;
+            }
+        }
+    }
+    const binTok = tokens[i];
+    if (binTok === undefined)
+        return null;
+    const bin = normalizeShellToken(binTok).toLowerCase();
+    if (bin === "git" || bin === "git.exe") {
+        i++;
+        // Skip git global options before the subcommand (-C, --git-dir, -c, …).
+        while (i < tokens.length) {
+            const raw = tokens[i];
+            if (raw === undefined)
+                return null;
+            const t = normalizeShellToken(raw);
+            const lower = t.toLowerCase();
+            if (!t.startsWith("-")) {
+                return lower === "push" ? "push" : null;
+            }
+            // --opt=value forms never consume a following token.
+            if (t.startsWith("--") && t.includes("=")) {
+                i++;
+                continue;
+            }
+            // Value-taking globals: -C path, --git-dir /repo, -c name=value, …
+            if (GIT_GLOBAL_VALUE_OPTS.has(t)) {
+                i += 2;
+                continue;
+            }
+            // Glued short forms: -C/path, -cname=value
+            if (t.startsWith("-C") || t.startsWith("-c")) {
+                i++;
+                continue;
+            }
+            // Boolean / other short/long flags without a separate value.
+            i++;
+        }
+        return null;
+    }
+    if (bin === "gh" || bin === "gh.exe") {
+        i++;
+        while (i < tokens.length) {
+            const flagRaw = tokens[i];
+            if (flagRaw === undefined)
+                break;
+            const flag = normalizeShellToken(flagRaw);
+            if (!flag.startsWith("-"))
+                break;
+            i++;
+        }
+        const pr = tokens[i];
+        const merge = tokens[i + 1];
+        if (pr !== undefined &&
+            merge !== undefined &&
+            normalizeShellToken(pr).toLowerCase() === "pr" &&
+            normalizeShellToken(merge).toLowerCase() === "merge") {
+            return "merge";
+        }
+        return null;
+    }
+    return null;
+}
+/**
+ * List all classifiable push/merge ops in a shell command (#2711).
+ * Scans every list/pipeline/newline segment so compound commands like
+ * `gh pr merge 1 && git push` surface both ops (dispatcher evaluates each).
+ * Newlines are delimiters so multi-line scripts cannot hide a later push/merge.
+ */
+export function listShellOps(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const found = new Set();
+    // Quote-aware split so separators inside quotes are not treated as list ops.
+    for (const raw of splitShellSegments(cmd)) {
+        const op = classifyShellSegment(raw);
+        if (op !== null)
+            found.add(op);
+    }
+    const out = [];
+    // Stable order for deterministic multi-op evaluation.
+    if (found.has("push"))
+        out.push("push");
+    if (found.has("merge"))
+        out.push("merge");
+    return out;
+}
+/**
+ * Classify a shell command string for push/merge scopes (#2711).
+ * Unclassifiable commands return null (fail open at the gate).
+ * When a compound command has multiple ops, returns the first of listShellOps
+ * (push before merge); prefer listShellOps + evaluate-each for enforcement.
+ *
+ * Patterns (intentionally narrow; prefer false-open over false-deny):
+ * - push: `git push`, `git.exe push`, with optional env / -C / -c prefixes
+ * - merge: `gh pr merge`, `gh.exe pr merge`
+ */
+export function classifyShellCommand(command) {
+    const ops = listShellOps(command);
+    return ops[0] ?? null;
+}
+/**
+ * Classify an MCP (or MCP-like) tool name + optional argument blob for push/merge (#2711).
+ * Returns null when the tool is not a known push/merge mutation (fail open).
+ */
+export function classifyMcpTool(toolName, argsText = null) {
+    const name = toolName.trim().toLowerCase();
+    if (name.length === 0)
+        return null;
+    // Common GitHub MCP / bridge spellings for merge
+    if (/merge[_-]?pull[_-]?request/.test(name) ||
+        /pull[_-]?request[_-]?merge/.test(name) ||
+        /(^|__)merge_pr($|__)/.test(name) ||
+        /pr[_-]?merge/.test(name)) {
+        return "merge";
+    }
+    // Push-like tool names (narrow — prefer fail-open)
+    if (/(^|__)git[_-]?push($|__)/.test(name) || /push[_-]?branch/.test(name)) {
+        return "push";
+    }
+    if (/push/.test(name) && /(git|branch|remote|ref)/.test(name))
+        return "push";
+    const blob = (argsText ?? "").toLowerCase();
+    if (blob.length > 0) {
+        if (/\bgit(?:\.exe)?\s+push\b/.test(blob))
+            return "push";
+        if (/\bgh(?:\.exe)?\s+pr\s+merge\b/.test(blob))
+            return "merge";
+    }
+    return null;
+}
+/**
+ * Evaluate scopes.push / scopes.merge for a classifiable shell/MCP operation (#2711).
+ * null op → allow (unclassifiable fail-open). disabled policy → allow.
+ */
+export function evaluateRuntimeAuthorityShellOp(input) {
+    const { policy, op } = input;
+    if (!policy.enabled) {
+        return { allowed: true, reason: null, code: null, unclassifiable: op === null };
+    }
+    if (op === null) {
+        return { allowed: true, reason: null, code: null, unclassifiable: true };
+    }
+    if (op === "push" && !policy.scopes.push) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            unclassifiable: false,
+            reason: "Directive denied this shell/MCP operation: plan.policy.runtimeAuthority.scopes.push is false. " +
+                "Grant the push scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    if (op === "merge" && !policy.scopes.merge) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            unclassifiable: false,
+            reason: "Directive denied this shell/MCP operation: plan.policy.runtimeAuthority.scopes.merge is false. " +
+                "Grant the merge scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    return { allowed: true, reason: null, code: null, unclassifiable: false };
+}
 //# sourceMappingURL=runtime-authority.js.map

package/dist/session/session-start-hook.d.ts

@@ -1,9 +1,12 @@
+import { detectNoDeftDirective } from "../policy/no-deft-directive.js";
 import { writeSentinel } from "./ritual-sentinel.js";
 export interface SessionStartHookOptions {
     readonly resolveVersionFn?: () => string;
     readonly detectBranchFn?: (projectRoot: string) => string | null;
     readonly detectLatestActiveVbriefFn?: (projectRoot: string) => string | null;
     readonly writeSentinelFn?: typeof writeSentinel;
+    /** Test seam for #2926 opt-out detection. */
+    readonly detectNoDeftDirectiveFn?: typeof detectNoDeftDirective;
 }
 /** Write ``.deft/last-session.json`` from current git state (#1269). */
 export declare function runSessionStartHookWrite(projectRoot: string, options?: SessionStartHookOptions): {

package/dist/session/session-start-hook.js

@@ -1,8 +1,23 @@
 import { resolveVersion } from "../doctor/paths.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { detectBranch } from "./git.js";
 import { detectLatestActiveVbrief, writeSentinel } from "./ritual-sentinel.js";
 /** Write ``.deft/last-session.json`` from current git state (#1269). */
 export function runSessionStartHookWrite(projectRoot, options = {}) {
+    const detectOptOut = options.detectNoDeftDirectiveFn ?? detectNoDeftDirective;
+    // #2926: root opt-out wins — host SessionStart must not write ritual bookkeeping.
+    const optOut = detectOptOut(projectRoot);
+    if (optOut.present) {
+        const lines = [NO_DEFT_DIRECTIVE_DISABLED_MESSAGE];
+        if (optOut.inconsistent) {
+            lines.push(NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE);
+        }
+        return {
+            code: optOut.inconsistent ? 1 : 0,
+            stdout: `${lines.join("\n")}\n`,
+            stderr: optOut.inconsistent ? `${NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE}\n` : "",
+        };
+    }
     const detectBranchFn = options.detectBranchFn ?? detectBranch;
     const detectVbriefFn = options.detectLatestActiveVbriefFn ?? detectLatestActiveVbrief;
     const resolveVersionFn = options.resolveVersionFn ?? resolveVersion;

package/dist/session/session-start.js

@@ -4,6 +4,7 @@ import { emitSessionEvalReadback } from "../eval/readback.js";
 import { MIGRATE_COMPLETION_NUDGE, shouldEmitMigrateNudge } from "../init-deposit/migrate.js";
 import { detectEnvironmentContext, environmentContextToDict, formatEnvironmentContext, } from "../platform/shell-context.js";
 import { disclosureLine } from "../policy/disclosure.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { resolvePolicy } from "../policy/resolve.js";
 import { maybeFormatProductSignalConsentPrompt } from "../product-signal/consent-prompt.js";
 import { maybeRunStalenessTickler } from "../staleness-tickler/run.js";
@@ -233,6 +234,35 @@ export function runSessionStart(projectRoot, options = {}) {
     const deferrals = options.deferrals ?? {};
     const runGit = options.runGit ?? defaultGitRunner;
     const environment = (options.probeEnvironment ?? detectEnvironmentContext)();
+    // #2926: official root opt-out wins locally — skip Directive session ritual.
+    // disabled = skip ritual (exit 0 clean / 1 inconsistent). ready stays false so
+    // automation does not treat opt-out as "session fully initialized for work".
+    const optOut = detectNoDeftDirective(projectRoot);
+    if (optOut.present) {
+        const lines = [NO_DEFT_DIRECTIVE_DISABLED_MESSAGE];
+        if (optOut.inconsistent) {
+            lines.push(NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE);
+        }
+        const code = optOut.inconsistent ? 1 : 0;
+        return {
+            code,
+            payload: {
+                ready: false,
+                exit_code: code,
+                disabled: true,
+                disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                inconsistent: optOut.inconsistent,
+                inconsistent_policy: optOut.inconsistent
+                    ? NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY
+                    : undefined,
+                deposit_present: optOut.depositPresent,
+                posture,
+                environment: environmentContextToDict(environment),
+                message: NO_DEFT_DIRECTIVE_DISABLED_MESSAGE,
+            },
+            lines,
+        };
+    }
     if (posture === READ_ONLY_POSTURE) {
         return runReadOnlySessionStart(projectRoot, options, instant, environment);
     }

package/dist/verify-source/cursor-tier1.js

@@ -3,14 +3,19 @@ import { join, resolve } from "node:path";
 export const CURSOR_TIER1_TARGETS = [
     {
         path: "content/skills/deft-directive-swarm/SKILL.md",
-        label: "swarm Phase 3 capability matrix",
+        label: "swarm Phase 3 capability matrix (thin skill)",
         markers: [
             "Probe for the Cursor `Task` tool",
             "cursor-composer",
             "cursor-cloud-agent",
-            "Step 2e: Cursor Launch",
+            "host-cursor.md",
         ],
     },
+    {
+        path: "content/skills/deft-directive-swarm/references/host-cursor.md",
+        label: "swarm Cursor host adapter",
+        markers: ["Step 2e: Cursor Launch", "cursor-composer", "Task"],
+    },
     {
         path: "content/skills/deft-directive-review-cycle/SKILL.md",
         label: "review-cycle monitoring tier selection",

package/dist/verify-source/openclaw-tier1.js

@@ -3,14 +3,19 @@ import { join, resolve } from "node:path";
 export const OPENCLAW_TIER1_TARGETS = [
     {
         path: "content/skills/deft-directive-swarm/SKILL.md",
-        label: "swarm Phase 3 capability matrix",
+        label: "swarm Phase 3 capability matrix (thin skill)",
         markers: [
             "Probe for the OpenClaw `sessions_spawn` tool",
             "sessions_spawn",
             "openclaw",
-            "Step 2f: OpenClaw Launch",
+            "host-openclaw.md",
         ],
     },
+    {
+        path: "content/skills/deft-directive-swarm/references/host-openclaw.md",
+        label: "swarm OpenClaw host adapter",
+        markers: ["Step 2f: OpenClaw Launch", "sessions_spawn", "openclaw"],
+    },
     {
         path: "packages/core/src/swarm/routing.ts",
         label: "swarm routing dispatch_provider",

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.87.0",
+  "version": "0.88.0",
   "description": "TypeScript engine core for the Directive framework.",
+  "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -317,8 +318,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.87.0",
-    "@deftai/directive-types": "^0.87.0",
+    "@deftai/directive-content": "^0.88.0",
+    "@deftai/directive-types": "^0.88.0",
     "archiver": "^8.0.0"
   },
   "scripts": {