@deftai/directive-core 0.87.0 → 0.89.0

package/dist/hooks/dispatcher.js

@@ -1,145 +1,29 @@
 import { realpathSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
 import { hasArtifactSuffix } from "../layout/resolve.js";
-import { evaluateRuntimeAuthorityDirectWrite, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
+import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
+import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
+import { loadStoryWriteFenceFromPath, resolveWriteFence } from "../policy/write-fence.js";
+import { detectBranch } from "../session/git.js";
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
 import { inspectSessionRitual } from "../session/verify-session-ritual.js";
+import { hookMcpArgsText, hookShellCommand, hookToolName, hookWriteTargetPath, missingToolNameMessage, record, } from "./classify/index.js";
 import { isExploreSpawn, isReadOnlyHookContext } from "./readonly.js";
 import { inspectActiveScope } from "./scope.js";
-import { isDirectWriteTool, isSpawnTool } from "./tools.js";
+import { isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool } from "./tools.js";
+// Pure parse/classify helpers are defined in ./classify/ and re-exported from
+// ./index.ts (#2950). Dispatcher is orchestration: classify → policy → decision.
 export { hookReadOnlyFromPayload, isExploreSpawn, isReadOnlyHookContext } from "./readonly.js";
-export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isSpawnTool, READ_ONLY_HOOK_ENV, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, DIRECT_WRITE_TOOL_NAMES, isDirectWriteTool, isMcpTool, isShellTool, isSpawnTool, MCP_HOOK_MATCHER, MCP_PUSH_MERGE_BARE_NAMES, READ_ONLY_HOOK_ENV, SHELL_HOOK_MATCHER, SHELL_TOOL_NAMES, SPAWN_HOOK_MATCHER, SPAWN_TOOL_NAMES, } from "./tools.js";
 export const HOOK_HOSTS = ["claude", "grok", "cursor", "codex"];
 export const HOOK_EVENTS = ["session.start", "session.compact", "tool.before"];
 /** Hosts that receive compact/resume hook deposits via init/update (#2113). */
 export const COMPACT_HOOK_HOSTS = ["claude", "grok", "cursor"];
 /** Hosts without a native compact hook surface — deposit skips cleanly (#2113). */
 export const COMPACT_HOOK_SKIP_HOSTS = ["codex"];
-function record(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : null;
-}
-function firstString(...values) {
-    for (const value of values) {
-        if (typeof value === "string" && value.trim().length > 0)
-            return value.trim();
-    }
-    return null;
-}
-function fieldPresent(input, key) {
-    return key in input;
-}
-function fieldString(input, key) {
-    const value = input[key];
-    if (typeof value === "string" && value.trim().length > 0)
-        return value.trim();
-    return null;
-}
-function toolInputRecord(payload) {
-    const toolCall = record(payload.tool_call) ?? record(payload.toolCall);
-    return (record(payload.tool_input) ??
-        record(payload.toolInput) ??
-        record(payload.input) ??
-        record(payload.arguments) ??
-        (toolCall !== null ? record(toolCall.arguments) : null));
-}
-/**
- * Cursor preToolUse payloads sometimes omit `tool_name` even when the hook matcher
- * fired for a direct-write tool (#2628). Infer from nested tool input when possible.
- */
-function inferCursorDirectWriteToolName(payload) {
-    const toolInput = toolInputRecord(payload);
-    if (toolInput !== null) {
-        if (fieldPresent(toolInput, "new_string") ||
-            fieldPresent(toolInput, "newString") ||
-            fieldPresent(toolInput, "old_string") ||
-            fieldPresent(toolInput, "oldString")) {
-            return "StrReplace";
-        }
-        if (fieldString(toolInput, "contents") !== null ||
-            fieldString(toolInput, "content") !== null ||
-            fieldString(toolInput, "text") !== null) {
-            return "Write";
-        }
-        if (fieldString(toolInput, "patch") !== null ||
-            fieldString(toolInput, "unified_diff") !== null ||
-            fieldString(toolInput, "diff") !== null) {
-            return "ApplyPatch";
-        }
-        if (Array.isArray(toolInput.edits))
-            return "MultiEdit";
-        if (Array.isArray(toolInput.cells) || toolInput.cell_id != null) {
-            return "NotebookEdit";
-        }
-    }
-    // Cursor maps Claude Edit → Write; a write target without contents is still a direct write.
-    if (hookWriteTargetPath(payload) !== null)
-        return "Write";
-    return null;
-}
-export function hookPayloadTopLevelKeys(payload) {
-    const input = record(payload);
-    if (input === null)
-        return [];
-    return Object.keys(input).sort();
-}
-export function hookToolName(payload, host) {
-    const input = record(payload);
-    if (input === null)
-        return null;
-    const toolObject = record(input.tool);
-    const toolCall = record(input.tool_call) ?? record(input.toolCall);
-    // OpenAI-style nestings are host-agnostic; checked before Cursor-only inference.
-    const direct = fieldString(input, "tool_name") ??
-        fieldString(input, "toolName") ??
-        fieldString(input, "tool") ??
-        (toolObject !== null ? fieldString(toolObject, "name") : null) ??
-        (toolCall !== null ? fieldString(toolCall, "name") : null);
-    if (direct !== null)
-        return direct;
-    if (host === "cursor")
-        return inferCursorDirectWriteToolName(input);
-    return null;
-}
-function missingToolNameMessage(input) {
-    const { host, payload, context } = input;
-    if (host === "cursor") {
-        if (context?.stdinEmpty) {
-            return ("Directive denied this Cursor preToolUse event because the host sent an empty payload " +
-                "(stdin was empty — not a session ritual or scope failure). " +
-                "If write tools should pass, update Directive or report the payload shape from Cursor.");
-        }
-        if (context?.parseFailed) {
-            return ("Directive denied this Cursor preToolUse event because the host payload was not valid JSON " +
-                "(host-integration mismatch — not a session ritual or scope failure). " +
-                "If write tools should pass, update Directive or report the payload shape from Cursor.");
-        }
-        const keys = hookPayloadTopLevelKeys(payload);
-        if (keys.length > 0) {
-            return ("Directive denied this Cursor preToolUse event because the host payload omitted a " +
-                "recognizable tool name (host-integration mismatch — not a session ritual or scope failure). " +
-                `Top-level payload keys: ${keys.join(", ")}. ` +
-                "If write tools should pass, update Directive or report the payload shape from Cursor.");
-        }
-        return ("Directive denied this Cursor preToolUse event because the host payload omitted a " +
-            "recognizable tool name (host-integration mismatch — not a session ritual or scope failure). " +
-            "If write tools should pass, update Directive or report the payload shape from Cursor.");
-    }
-    return "Directive denied this matched write event because the host payload omitted its tool name.";
-}
-/**
- * Best-effort write-target path from host PreToolUse payloads (#2625).
- * Hosts disagree on nesting (`tool_input.file_path` vs top-level `path`).
- */
-export function hookWriteTargetPath(payload) {
-    const input = record(payload);
-    if (input === null)
-        return null;
-    const toolInput = toolInputRecord(input);
-    return firstString(toolInput?.file_path, toolInput?.filePath, toolInput?.path, input.file_path, input.filePath, input.path);
-}
 /** POSIX-ish project-relative path for lifecycle matching. */
 export function toProjectRelativePosix(projectRoot, targetPath) {
     const abs = resolve(projectRoot, targetPath.replace(/\\/g, "/"));
@@ -290,20 +174,275 @@ function deny(input, code, toolName, message, scopePath = null) {
 }
 function runtimeAuthorityForDirectWrite(input, toolName, seams, scopePath) {
     const projectRoot = resolve(input.projectRoot);
-    let policy;
+    // Project policy load failure: treat as disabled project layer, still apply
+    // independent story file_scope when present (#516 / #2443 Greptile P1).
+    let basePolicy = DEFAULT_RUNTIME_AUTHORITY_POLICY;
     try {
-        policy = (seams.loadRuntimeAuthority ?? loadRuntimeAuthorityFromProject)(projectRoot);
+        basePolicy = (seams.loadRuntimeAuthority ?? loadRuntimeAuthorityFromProject)(projectRoot);
     }
     catch {
-        // Fail-open on policy load crash — host behavior; ritual/scope gates already passed.
-        return null;
+        basePolicy = DEFAULT_RUNTIME_AUTHORITY_POLICY;
+    }
+    // Wave 3 unified write fence: intersect project runtimeAuthority with active
+    // story file_scope (#516 / #2443 / #2948). Single evaluation SoT via
+    // evaluateRuntimeAuthorityDirectWrite — no parallel writeScope engine.
+    let storyFence;
+    try {
+        storyFence = seams.loadStoryWriteFence
+            ? seams.loadStoryWriteFence(projectRoot, scopePath)
+            : loadStoryWriteFenceFromPath(scopePath);
     }
+    catch {
+        // Residual: host cannot load active story — project fence still applies.
+        storyFence = { fileScope: [], denyPaths: [] };
+    }
+    const fence = resolveWriteFence(basePolicy, storyFence.fileScope, {
+        storyDenyPaths: storyFence.denyPaths,
+    });
+    // Neither layer active → allow (same as disabled runtimeAuthority historically).
+    if (!fence.fenceActive)
+        return null;
     const writeTarget = hookWriteTargetPath(input.payload);
     const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
-    const verdict = evaluateRuntimeAuthorityDirectWrite({ policy, relPathPosix: relPath });
+    const verdict = evaluateRuntimeAuthorityDirectWrite({
+        policy: fence.policy,
+        relPathPosix: relPath,
+    });
     if (verdict.allowed)
         return null;
-    return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, verdict.reason ?? "Directive denied this direct write under runtime authority policy.", scopePath);
+    return deny(input, verdict.code ?? "runtime-policy-deny-path", toolName, verdict.reason ?? "Directive denied this direct write under write fence policy.", scopePath);
+}
+function loadAuthzContext(projectRoot, seams) {
+    if (seams.loadAuthzState !== undefined) {
+        const state = seams.loadAuthzState(projectRoot);
+        const raw = (seams.loadAuthzGrants ?? listActiveHumanGrants)(projectRoot, state);
+        // Production filter: self-authored grants never enter the implement gate (#2944).
+        const grants = raw.filter((g) => evidenceSatisfiesImplementationApproval({ grant: g }));
+        return { state, grants, corrupt: false, corruptReason: null };
+    }
+    const loaded = loadAuthzStateResult(projectRoot);
+    const raw = (seams.loadAuthzGrants ?? listActiveHumanGrants)(projectRoot, loaded.state);
+    const grants = raw.filter((g) => evidenceSatisfiesImplementationApproval({ grant: g }));
+    return {
+        state: loaded.state,
+        grants,
+        corrupt: loaded.corrupt,
+        corruptReason: loaded.ok ? null : loaded.reason,
+    };
+}
+function authzCodeToHook(code) {
+    // Map authz decision codes onto HookDecisionCode (same string values for denials).
+    if (code === "authz-uat-deny" ||
+        code === "authz-grant-missing" ||
+        code === "authz-grant-origin-reject" ||
+        code === "authz-grant-scope-deny" ||
+        code === "authz-grant-expired" ||
+        code === "authz-grant-revoked" ||
+        code === "authz-grant-single-use-spent") {
+        return code;
+    }
+    return "authz-uat-deny";
+}
+function recordAuthzAudit(projectRoot, decision, state, seams) {
+    if (seams.authzAudit === false)
+        return;
+    // Only audit when UAT is active or a deny occurred under an authz code.
+    const uatActive = state.uat?.active === true;
+    if (!uatActive && decision.allowed)
+        return;
+    try {
+        appendAuthzAudit(projectRoot, {
+            schemaVersion: 1,
+            ts: utcIso(),
+            humanApprovalRef: decision.humanApprovalRef,
+            approvedScope: decision.approvedScope,
+            attemptedOp: String(decision.attemptedOp),
+            path: decision.path,
+            result: decision.allowed ? "allow" : "deny",
+            code: decision.code,
+            message: decision.reason,
+            campaignId: state.uat?.campaignId ?? null,
+        });
+    }
+    catch {
+        // Audit write must not crash the host tool gate.
+    }
+}
+/**
+ * UAT lease + human-origin grant gate (#2944). Returns deny decision or null when allowed.
+ * Composes before runtimeAuthority path/scope checks for direct writes and shell/MCP.
+ */
+function authzForMutation(input, toolName, seams, options) {
+    const projectRoot = resolve(input.projectRoot);
+    let state;
+    let grants;
+    let corrupt;
+    let corruptReason;
+    try {
+        ({ state, grants, corrupt, corruptReason } = loadAuthzContext(projectRoot, seams));
+    }
+    catch (err) {
+        // Fail closed: unreadable authz store must not disable UAT enforcement (#2944).
+        return deny(input, "authz-uat-deny", toolName, `Directive denied this mutation: authz store unreadable (${String(err)}). ` +
+            "Human action required: repair `.deft/authz/state.json` or re-run `deft authz:uat-start`.", options.scopePath);
+    }
+    const shellCommand = isShellTool(toolName) ? hookShellCommand(input.payload) : null;
+    const ops = classifyHookAuthzOps({
+        toolName,
+        shellCommand,
+        isDirectWrite: options.isDirectWrite,
+        mcpArgsText: options.isDirectWrite ? null : hookMcpArgsText(input.payload),
+    });
+    // No classifiable authz ops (unrelated tools) — leave to other gates,
+    // except corrupt state still fails closed on direct writes / classifiable shell.
+    if (ops.length === 0) {
+        if (corrupt && (options.isDirectWrite || isShellTool(toolName))) {
+            return deny(input, "authz-uat-deny", toolName, `Directive denied this mutation: ${corruptReason ?? "authz state corrupt"}. ` +
+                "Fail closed while UAT authority cannot be verified. " +
+                "Human action required: repair `.deft/authz/state.json`.", options.scopePath);
+        }
+        return null;
+    }
+    // Structural context for bound grants (branch from git; repo optional env).
+    let branch = null;
+    try {
+        branch = detectBranch(projectRoot);
+    }
+    catch {
+        branch = null;
+    }
+    const repo = (process.env.DEFT_AUTHZ_REPO ?? process.env.GITHUB_REPOSITORY ?? "").trim() || null;
+    // Evaluate each op; first deny wins (compound shell must not short-circuit).
+    for (const op of ops) {
+        const decision = evaluateAuthzMutation({
+            state,
+            grants,
+            op,
+            path: options.relPath,
+            branch,
+            repo,
+            worktree: projectRoot,
+        });
+        recordAuthzAudit(projectRoot, decision, state, seams);
+        if (!decision.allowed) {
+            return deny(input, authzCodeToHook(decision.code), toolName, decision.reason, options.scopePath);
+        }
+        // Consume single-use grants after allow (persist usedAt).
+        if (shouldConsumeSingleUseGrant(decision) && decision.humanApprovalRef !== null) {
+            try {
+                markGrantUsed(projectRoot, decision.humanApprovalRef);
+            }
+            catch {
+                // Persistence failure must not flip allow → deny after a successful check;
+                // next load will still see unused if write failed (prefer allow-once risk over deadlock).
+            }
+        }
+    }
+    return null;
+}
+function loadRuntimeAuthorityPolicySafe(input, seams) {
+    const projectRoot = resolve(input.projectRoot);
+    try {
+        return (seams.loadRuntimeAuthority ?? loadRuntimeAuthorityFromProject)(projectRoot);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Evaluate scopes.push / scopes.merge for Shell/Bash or classifiable MCP tools (#2711).
+ * Returns a full HookDecision (allow or deny). Unclassifiable ops fail open.
+ */
+function decideShellOrMcpRuntimeAuthority(input, toolName, seams) {
+    const projectRoot = resolve(input.projectRoot);
+    // Wave 1 authz first: UAT lease denies push/PR/merge/settings/deploy without cohort (#2944).
+    // Composes with #2711 shell matchers; does not re-implement them.
+    const authzDeny = authzForMutation(input, toolName, seams, {
+        isDirectWrite: false,
+        relPath: null,
+        scopePath: null,
+    });
+    if (authzDeny !== null)
+        return authzDeny;
+    // #1193 intent ceiling: non-implement slash verbs cannot authorize push/merge (and deploy via merge).
+    const env = input.environ ?? process.env;
+    const shellOpsPreview = [];
+    if (isShellTool(toolName)) {
+        const command = hookShellCommand(input.payload);
+        if (command !== null)
+            shellOpsPreview.push(...listShellOps(command));
+    }
+    else {
+        const mcpOp = classifyMcpTool(toolName, hookMcpArgsText(input.payload));
+        if (mcpOp !== null)
+            shellOpsPreview.push(mcpOp);
+    }
+    for (const shellOp of shellOpsPreview) {
+        const intentOp = shellOp === "push" ? "push" : "merge";
+        const intent = evaluateIntentCeilingFromEnv(intentOp, env);
+        if (!intent.allowed) {
+            return deny(input, "intent-ceiling-deny", toolName, intent.reason);
+        }
+    }
+    const policy = loadRuntimeAuthorityPolicySafe(input, seams);
+    if (policy === null) {
+        return {
+            verdict: "allow",
+            code: "shell-op-unclassifiable",
+            event: input.event,
+            host: input.host,
+            toolName,
+            projectRoot,
+            message: `Directive allowed ${toolName}: runtimeAuthority policy load failed (fail open).`,
+            scopePath: null,
+        };
+    }
+    // Shell: evaluate every classifiable op in compound/multi-line commands (#2711 Greptile).
+    // MCP / bare push-merge names: single tool name maps to at most one op
+    // (includes bare `merge_pull_request` etc. that isMcpTool does not flag).
+    const ops = [];
+    if (isShellTool(toolName)) {
+        const command = hookShellCommand(input.payload);
+        if (command !== null)
+            ops.push(...listShellOps(command));
+    }
+    else {
+        const mcpOp = classifyMcpTool(toolName, hookMcpArgsText(input.payload));
+        if (mcpOp !== null)
+            ops.push(mcpOp);
+    }
+    if (ops.length === 0) {
+        return {
+            verdict: "allow",
+            code: "shell-op-unclassifiable",
+            event: input.event,
+            host: input.host,
+            toolName,
+            projectRoot,
+            message: `${toolName} is classifiable as Shell/MCP but the command/tool was not recognized as ` +
+                "push or merge — fail open (host gap; see runtime-authority.md).",
+            scopePath: null,
+        };
+    }
+    // Deny if any classifiable op is out of scope (compound commands must not short-circuit).
+    for (const op of ops) {
+        const verdict = evaluateRuntimeAuthorityShellOp({ policy, op });
+        if (!verdict.allowed) {
+            return deny(input, verdict.code ?? "runtime-policy-deny-scope", toolName, verdict.reason ??
+                "Directive denied this shell/MCP operation under runtime authority policy.");
+        }
+    }
+    const opsLabel = ops.join("+");
+    return {
+        verdict: "allow",
+        code: "shell-op-ready",
+        event: input.event,
+        host: input.host,
+        toolName,
+        projectRoot,
+        message: `Directive runtimeAuthority allowed classifiable ${opsLabel} via ${toolName}.`,
+        scopePath: null,
+    };
 }
 function inspectMutationGates(input, toolName, seams, options) {
     const projectRoot = resolve(input.projectRoot);
@@ -324,6 +463,15 @@ function inspectMutationGates(input, toolName, seams, options) {
     if (options.proposedLifecycleExempt) {
         const writeTarget = hookWriteTargetPath(input.payload);
         if (isProposedLifecycleWrite(projectRoot, writeTarget)) {
+            const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+            // UAT still allows xbrief/proposed/** as evidence/defect capture (#2944).
+            const authzDeny = authzForMutation(input, toolName, seams, {
+                isDirectWrite: true,
+                relPath,
+                scopePath: null,
+            });
+            if (authzDeny !== null)
+                return authzDeny;
             const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, null);
             if (runtimeDeny !== null)
                 return runtimeDeny;
@@ -371,7 +519,24 @@ function inspectMutationGates(input, toolName, seams, options) {
         }
     }
     const allowCode = isSpawnTool(toolName) ? "spawn-ready" : "write-ready";
+    // #1193: non-implement slash verbs must not authorize implement/spawn tooling.
+    {
+        const intent = evaluateIntentCeilingFromEnv("implement", input.environ ?? process.env);
+        if (!intent.allowed) {
+            return deny(input, "intent-ceiling-deny", toolName, intent.reason);
+        }
+    }
     if (!isSpawnTool(toolName)) {
+        const writeTarget = hookWriteTargetPath(input.payload);
+        const relPath = writeTarget !== null ? toProjectRelativePosix(projectRoot, writeTarget) : null;
+        // Wave 1 authz (UAT lease + human-origin grant) before runtimeAuthority (#2944 / #2948 L1–L2).
+        const authzDeny = authzForMutation(input, toolName, seams, {
+            isDirectWrite: true,
+            relPath,
+            scopePath: scope.path,
+        });
+        if (authzDeny !== null)
+            return authzDeny;
         const runtimeDeny = runtimeAuthorityForDirectWrite(input, toolName, seams, scope.path);
         if (runtimeDeny !== null)
             return runtimeDeny;
@@ -431,6 +596,24 @@ export function decideHook(input, seams = {}) {
         }
     }
     if (input.event === "session.start") {
+        // #2926: root `.no-deft-directive` wins — skip host SessionStart bookkeeping.
+        const detectOptOut = seams.detectNoDeftDirective ?? detectNoDeftDirective;
+        const optOut = detectOptOut(projectRoot);
+        if (optOut.present) {
+            const message = optOut.inconsistent
+                ? `${NO_DEFT_DIRECTIVE_DISABLED_MESSAGE}. ${NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE}`
+                : NO_DEFT_DIRECTIVE_DISABLED_MESSAGE;
+            return {
+                verdict: "allow",
+                code: "session-start-disabled",
+                event: input.event,
+                host: input.host,
+                toolName: null,
+                projectRoot,
+                message,
+                scopePath: null,
+            };
+        }
         try {
             const result = (seams.sessionStart ?? runSessionStartHookWrite)(projectRoot);
             if (result.code !== 0) {
@@ -510,6 +693,15 @@ export function decideHook(input, seams = {}) {
         }
         return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: false });
     }
+    // Shell/Bash and classifiable MCP: enforce scopes.push / scopes.merge (#2711).
+    // Route bare push/merge MCP names (merge_pull_request, git_push, …) even when
+    // isMcpTool is false — classifyMcpTool is the gate (dispatcher-side, no tools↔policy cycle).
+    // Does not require active-scope ritual — only runtimeAuthority when enabled.
+    if (isShellTool(toolName) ||
+        isMcpTool(toolName) ||
+        classifyMcpTool(toolName, hookMcpArgsText(input.payload)) !== null) {
+        return decideShellOrMcpRuntimeAuthority(input, toolName, seams);
+    }
     if (!isDirectWriteTool(toolName)) {
         return {
             verdict: "allow",
@@ -518,7 +710,7 @@ export function decideHook(input, seams = {}) {
             host: input.host,
             toolName,
             projectRoot,
-            message: `${toolName} is outside the P0 direct-write/spawn enforcement slice.`,
+            message: `${toolName} is outside the P0 direct-write/spawn/shell enforcement slice.`,
             scopePath: null,
         };
     }

package/dist/hooks/fixtures/cases.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared host × OS × tool fixture corpus (#2950 Phase A skeleton, Phase B matrix expansion).
+ *
+ * Cases are pure data: raw stdin or structured payload → expected classification.
+ * Core tests and CLI hook-dispatch tests import this module (shared corpus collapse).
+ */
+import type { ClassifyHookHost, HookWriteIntent } from "../classify/types.js";
+export type FixtureOs = "win32" | "posix";
+export type FixtureToolFamily = "Write" | "ApplyPatch" | "Task" | "StrReplace" | "other";
+export interface HookFixtureCase {
+    readonly id: string;
+    readonly host: ClassifyHookHost;
+    readonly os: FixtureOs;
+    readonly tool: FixtureToolFamily;
+    /** Closed-issue tags for the regression class this case freezes. */
+    readonly regression: readonly string[];
+    /** Structured payload when the host sends JSON. */
+    readonly payload?: unknown;
+    /** Raw stdin when testing BOM / free-form ApplyPatch parse. */
+    readonly raw?: string;
+    readonly expected: {
+        readonly toolName: string | null;
+        readonly writeIntent: HookWriteIntent;
+        readonly writeTargetPath: string | null;
+        /** When raw is set: after parseHookStdin. */
+        readonly stdinEmpty?: boolean;
+        readonly parseFailed?: boolean;
+    };
+    readonly notes?: string;
+}
+/**
+ * Cursor × {win32, posix} × {Write, ApplyPatch, Task, StrReplace}
+ * plus recent regression classes (BOM, free-form, missing tool name, outside-root).
+ * Phase B expands Write/ApplyPatch depth and shares this corpus with CLI tests.
+ */
+export declare const HOOK_FIXTURE_CASES: readonly HookFixtureCase[];
+export declare function fixtureCasesFor(filter: {
+    host?: ClassifyHookHost;
+    os?: FixtureOs;
+    tool?: FixtureToolFamily;
+}): HookFixtureCase[];
+/** Look up a single case by stable id (CLI/core shared helpers). */
+export declare function fixtureCaseById(id: string): HookFixtureCase | undefined;
+//# sourceMappingURL=cases.d.ts.map