@deftai/directive-core 0.87.0 → 0.89.0

package/dist/hooks/tools.js

@@ -21,6 +21,11 @@ export const SPAWN_TOOL_NAMES = [
     "start_agent",
     "CreateAgent",
 ];
+/**
+ * Host spellings for Shell/Bash execution tools (#2711).
+ * Used for runtimeAuthority scopes.push / scopes.merge classification.
+ */
+export const SHELL_TOOL_NAMES = ["Shell", "Bash", "BashTool", "shell", "bash"];
 /** Env override forcing hook-level read-only write denial (#1185). */
 export const READ_ONLY_HOOK_ENV = "DEFT_HOOK_READ_ONLY";
 function normalizedToolName(toolName) {
@@ -28,12 +33,81 @@ function normalizedToolName(toolName) {
 }
 const DIRECT_WRITE_TOOLS = new Set(DIRECT_WRITE_TOOL_NAMES.map(normalizedToolName));
 const SPAWN_TOOLS = new Set(SPAWN_TOOL_NAMES.map(normalizedToolName));
+const SHELL_TOOLS = new Set(SHELL_TOOL_NAMES.map(normalizedToolName));
 export function isDirectWriteTool(toolName) {
     return DIRECT_WRITE_TOOLS.has(normalizedToolName(toolName));
 }
 export function isSpawnTool(toolName) {
     return SPAWN_TOOLS.has(normalizedToolName(toolName));
 }
+/** True for host Shell/Bash-class tools that carry a command string (#2711). */
+export function isShellTool(toolName) {
+    return SHELL_TOOLS.has(normalizedToolName(toolName));
+}
+/**
+ * Best-effort MCP tool detection for runtimeAuthority push/merge scopes (#2711).
+ * Host spellings vary (`mcp__*`, `server__tool`, bare MCP-looking names).
+ * Unclassifiable MCP tools fail open at the operation classifier.
+ *
+ * Bare push/merge names (e.g. `merge_pull_request`) are NOT detected here —
+ * they are classified by `classifyMcpTool` and routed from `decideHook` so
+ * tools.ts stays free of policy imports (#2711 Greptile conf holdout).
+ */
+export function isMcpTool(toolName) {
+    const raw = toolName.trim();
+    if (raw.length === 0)
+        return false;
+    const lower = raw.toLowerCase();
+    if (lower.startsWith("mcp__") || lower.startsWith("mcp_"))
+        return true;
+    if (lower.includes("__") && !isDirectWriteTool(toolName) && !isShellTool(toolName)) {
+        // server__tool style used by some MCP bridges
+        return true;
+    }
+    return false;
+}
+/**
+ * Bare tool names that hosts may emit without mcp__/server__ prefixes and that
+ * `classifyMcpTool` treats as push or merge (#2711).
+ * Keep in sync with classifyMcpTool name patterns (narrow list for PreToolUse matchers).
+ */
+export const MCP_PUSH_MERGE_BARE_NAMES = [
+    "merge_pull_request",
+    "merge-pull-request",
+    "pull_request_merge",
+    "pull-request-merge",
+    "merge_pr",
+    "pr_merge",
+    "pr-merge",
+    "git_push",
+    "git-push",
+    "push_branch",
+    "push-branch",
+];
 export const DIRECT_WRITE_HOOK_MATCHER = DIRECT_WRITE_TOOL_NAMES.join("|");
 export const SPAWN_HOOK_MATCHER = SPAWN_TOOL_NAMES.join("|");
+export const SHELL_HOOK_MATCHER = SHELL_TOOL_NAMES.join("|");
+/**
+ * PreToolUse matcher for MCP-class push/merge tools (#2711).
+ * Regex-friendly for Claude/nested hosts. Prefer broad install match +
+ * fail-open classify in the dispatcher over missing a classifiable push/merge
+ * tool name (e.g. `server__push_to_remote` via push+remote).
+ */
+export const MCP_HOOK_MATCHER = [
+    // Prefixed / server-bridge styles (isMcpTool); dispatcher fail-opens non-ops.
+    "mcp__.*",
+    "mcp_.*",
+    ".*__.*",
+    // Bare names classifyMcpTool recognizes without prefixes.
+    ...MCP_PUSH_MERGE_BARE_NAMES,
+    // Name fragments for hosts that strip server prefixes differently.
+    ".*merge[_-]?pull[_-]?request.*",
+    ".*pull[_-]?request[_-]?merge.*",
+    ".*(?:^|[_-])merge_pr(?:$|[_-]).*",
+    ".*pr[_-]?merge.*",
+    ".*git[_-]?push.*",
+    ".*push[_-]?branch.*",
+    ".*push.*(?:git|branch|remote|ref).*",
+    ".*(?:git|branch|remote|ref).*push.*",
+].join("|");
 //# sourceMappingURL=tools.js.map

package/dist/index.d.ts

@@ -9,6 +9,7 @@ import type { EngineInfo } from "@deftai/directive-types";
  * namespaces here (and as `@deftai/directive-core/<gate>` subpaths in package.json) to
  * avoid colliding on those shared symbol names.
  */
+export * as authz from "./authz/index.js";
 export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
@@ -16,12 +17,15 @@ export * as codebase from "./codebase/index.js";
 export * from "./coverage-hotspots/index.js";
 export * as doctor from "./doctor/index.js";
 export * from "./encoding/index.js";
+export * as escalation from "./escalation/index.js";
 export * as evalCrud from "./eval/crud-telemetry.js";
 export * as evalHealth from "./eval/health.js";
 export * as evalReport from "./eval/report.js";
 export * as evalRun from "./eval/run.js";
 export * as events from "./events/attribution-ledger.js";
 export * from "./forward-coverage/evaluate.js";
+export { ContainedWriteError, ContainedWriteErrorCode, type ContainedWriteInput, type ContainedWriteMode, type ContainedWriteResult, containedWrite, resolveContainedTarget, } from "./fs/contained-write.js";
+export { assertDestinationNotSymlink, assertDirectoryNotSymlink, assertProjectionContained, assertWriteTargetSafe, PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, walkDirectoryRejectSymlinks, } from "./fs/projection-containment.js";
 export * as intake from "./intake/index.js";
 export * as layout from "./layout/index.js";
 export * as legacyBridge from "./legacy-bridge/index.js";

package/dist/index.js

@@ -9,6 +9,7 @@ import { readCorePackageVersion } from "./engine-version.js";
  * namespaces here (and as `@deftai/directive-core/<gate>` subpaths in package.json) to
  * avoid colliding on those shared symbol names.
  */
+export * as authz from "./authz/index.js";
 export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
@@ -16,12 +17,16 @@ export * as codebase from "./codebase/index.js";
 export * from "./coverage-hotspots/index.js";
 export * as doctor from "./doctor/index.js";
 export * from "./encoding/index.js";
+export * as escalation from "./escalation/index.js";
 export * as evalCrud from "./eval/crud-telemetry.js";
 export * as evalHealth from "./eval/health.js";
 export * as evalReport from "./eval/report.js";
 export * as evalRun from "./eval/run.js";
 export * as events from "./events/attribution-ledger.js";
 export * from "./forward-coverage/evaluate.js";
+// #2951 Phase 1: contained-write API for product sinks.
+export { ContainedWriteError, ContainedWriteErrorCode, containedWrite, resolveContainedTarget, } from "./fs/contained-write.js";
+export { assertDestinationNotSymlink, assertDirectoryNotSymlink, assertProjectionContained, assertWriteTargetSafe, PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, walkDirectoryRejectSymlinks, } from "./fs/projection-containment.js";
 export * as intake from "./intake/index.js";
 export * as layout from "./layout/index.js";
 export * as legacyBridge from "./legacy-bridge/index.js";

package/dist/init-deposit/agent-hooks.d.ts

@@ -1,7 +1,7 @@
 import type { HookHost } from "../hooks/dispatcher.js";
 import { type HostHooksPolicy } from "../policy/host-hooks.js";
 import type { InitDepositIo } from "./constants.js";
-export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 export declare const DEFT_HOOK_COMMAND_MARKER = "deft-hook";
 export declare const LEGACY_DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export declare const AGENT_HOOK_PATHS: readonly [".claude/settings.json", ".grok/hooks/deft.json", ".cursor/hooks.json", ".codex/hooks.json"];

package/dist/init-deposit/agent-hooks.js

@@ -1,9 +1,10 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
-import { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
+import { containedWrite } from "../fs/contained-write.js";
+import { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 import { isHostHookDepositEnabled, loadHostHooksPolicyFromProject, } from "../policy/host-hooks.js";
-export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../hooks/tools.js";
 export const DEFT_HOOK_COMMAND_MARKER = "deft-hook";
 export const LEGACY_DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export const AGENT_HOOK_PATHS = [
@@ -103,6 +104,10 @@ function mergeNestedConfig(config, path, host, options = {}) {
         ...preTool,
         nestedGroup(host, "tool.before", DIRECT_WRITE_HOOK_MATCHER),
         nestedGroup(host, "tool.before", SPAWN_HOOK_MATCHER),
+        // Shell/Bash for runtimeAuthority scopes.push / scopes.merge (#2711)
+        nestedGroup(host, "tool.before", SHELL_HOOK_MATCHER),
+        // MCP push/merge (mcp__*, bare merge_pull_request / git_push, …) (#2711)
+        nestedGroup(host, "tool.before", MCP_HOOK_MATCHER),
     ];
     if (options.compact) {
         const preCompact = eventArray(hooks, "PreCompact", path).filter((entry) => !isManagedNestedGroup(entry));
@@ -164,18 +169,48 @@ function mergeCursorConfig(config, path) {
             failClosed: true,
             timeout: 5,
         },
+        {
+            command: command("cursor", "tool.before"),
+            matcher: SHELL_HOOK_MATCHER,
+            failClosed: true,
+            timeout: 5,
+        },
+        {
+            command: command("cursor", "tool.before"),
+            matcher: MCP_HOOK_MATCHER,
+            failClosed: true,
+            timeout: 5,
+        },
     ];
     hooks.preCompact = [...preCompact, { command: command("cursor", "session.compact"), timeout: 5 }];
     return { ...config, version: 1, hooks };
 }
-function writeJsonIfChanged(path, payload) {
+function writeJsonIfChanged(projectRoot, path, payload) {
     const next = `${JSON.stringify(payload, null, 2)}\n`;
     if (existsSync(path) && readFileSync(path, "utf8") === next)
         return false;
-    mkdirSync(dirname(path), { recursive: true });
-    const temporary = `${path}.deft-${process.pid}.tmp`;
-    writeFileSync(temporary, next, "utf8");
-    renameSync(temporary, path);
+    // Atomic replace via temp under project root (#2951 / #2980 wave A).
+    const parent = dirname(path);
+    const tmpName = `${basename(path)}.deft-${process.pid}.tmp`;
+    const temporary = join(parent, tmpName);
+    try {
+        containedWrite({
+            root: resolve(projectRoot),
+            target: temporary,
+            data: next,
+            mode: "replace",
+        });
+        renameSync(temporary, path);
+    }
+    catch (err) {
+        try {
+            rmSync(temporary, { force: true });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+        throw err;
+    }
     return true;
 }
 /** Merge Directive-owned project hook entries without replacing user configuration. */
@@ -231,7 +266,7 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     for (const item of prepared) {
         if (item.mode === "skip")
             continue;
-        if (writeJsonIfChanged(item.absolute, item.payload)) {
+        if (writeJsonIfChanged(projectRoot, item.absolute, item.payload)) {
             if (item.mode === "strip")
                 strippedPaths.push(item.path);
             else
@@ -285,6 +320,14 @@ function hasNestedRegistration(config, host, options = {}) {
         preTool.some((entry) => {
             const group = object(entry);
             return group?.matcher === SPAWN_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand);
+        }) &&
+        preTool.some((entry) => {
+            const group = object(entry);
+            return group?.matcher === SHELL_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand);
+        }) &&
+        preTool.some((entry) => {
+            const group = object(entry);
+            return group?.matcher === MCP_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand);
         });
     if (!base)
         return false;
@@ -315,6 +358,18 @@ function hasCursorRegistration(config) {
                 hook.matcher === SPAWN_HOOK_MATCHER &&
                 hook.failClosed === true);
         }) &&
+        preTool.some((entry) => {
+            const hook = object(entry);
+            return (hook?.command === command("cursor", "tool.before") &&
+                hook.matcher === SHELL_HOOK_MATCHER &&
+                hook.failClosed === true);
+        }) &&
+        preTool.some((entry) => {
+            const hook = object(entry);
+            return (hook?.command === command("cursor", "tool.before") &&
+                hook.matcher === MCP_HOOK_MATCHER &&
+                hook.failClosed === true);
+        }) &&
         preCompact.some((entry) => object(entry)?.command === command("cursor", "session.compact")));
 }
 /** Read-only registration probe shared by verify and doctor. */

package/dist/init-deposit/gitignore.js

@@ -9,8 +9,9 @@
  * Refs #1942, #1941, #1015, #1464, #1672.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { FORBIDDEN_BLANKET_EVAL_LINES, stripGitignoreInlineComment, } from "../triage/bootstrap/gitignore.js";
 /** Directory ignore entry for the hybrid deposit (greenfield only). */
@@ -196,8 +197,15 @@ function reconcileGitignoreFile(projectDir, targetLines, includeDeftCoreRational
         }
     }
     try {
+        // Keep early containment so ProjectionContainmentError type is preserved for callers/tests.
         assertWriteTargetSafe(projectDir, path);
-        writeFileSync(path, body, { encoding: "utf8", mode: 0o644 });
+        // #2980 wave A: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectDir),
+            target: path,
+            data: body,
+            mode: "replace",
+        });
     }
     catch (cause) {
         if (cause instanceof ProjectionContainmentError) {

package/dist/init-deposit/headless-manifest.js

@@ -22,10 +22,11 @@
  * emits a JSON error object so the calling backend can treat it as non-fatal
  * (never a crash or a partial write).
  */
-import { mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { mkdirSync, readdirSync, readFileSync } from "node:fs";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import { ContentPackageNotFoundError, resolveInstalledContentRoot, } from "../deposit/resolve-content.js";
 import { readCorePackageVersion } from "../engine-version.js";
+import { containedWrite } from "../fs/contained-write.js";
 import { agentsRefreshPlan } from "../platform/agents-md.js";
 import { plan } from "../resolution/plan.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
@@ -233,8 +234,15 @@ export async function runInitHeadlessCli(options) {
             const abs = resolve(options.outputPath);
             const writeFile = options.writeFile ??
                 ((path, data) => {
-                    mkdirSync(dirname(path), { recursive: true });
-                    writeFileSync(path, data);
+                    // Contain under the output parent (arbitrary --output path; #2980 wave A).
+                    const parent = dirname(path);
+                    mkdirSync(parent, { recursive: true });
+                    containedWrite({
+                        root: resolve(parent),
+                        target: basename(path),
+                        data,
+                        mode: "replace",
+                    });
                 });
             writeFile(abs, serialized);
             options.writeErr(`directive init --headless: wrote ${manifest.files.length}-file manifest (v${manifest.version}) to ${abs}\n`);

package/dist/init-deposit/hygiene.d.ts

@@ -77,8 +77,24 @@ export interface PrunePackageAbsentDepositPathsResult {
  * Remove deposit files not shipped by `@deftai/directive-content`, preserving
  * generated deposit metadata such as `VERSION` (#2804). Subsumes the legacy
  * hard-coded `packages/` prune (#2347).
+ *
+ * Individual removal failures are reported but do not throw — callers that must
+ * refuse a VERSION stamp until the deposit matches the content package should
+ * use {@link reconcileDepositToContentPackage} (#2913).
  */
 export declare function prunePackageAbsentDepositPaths(deftDir: string, contentRoot: string, io: InitDepositIo): Promise<PrunePackageAbsentDepositPathsResult>;
+/**
+ * Fail-closed deposit reconcile against the installed content package (#2913).
+ *
+ * Runs {@link prunePackageAbsentDepositPaths}, then re-scans. If any
+ * package-absent path remains, throws so callers refuse the VERSION stamp
+ * (dst-only stale/malicious agent content must not survive a refresh).
+ *
+ * After a successful {@link replaceTree} full-swap this is typically a no-op
+ * verification; it also covers additive copy seams and the already-current
+ * refresh path that skips payload copy.
+ */
+export declare function reconcileDepositToContentPackage(deftDir: string, contentRoot: string, io: InitDepositIo): Promise<PrunePackageAbsentDepositPathsResult>;
 export interface PruneStrayDepositPathsResult {
     readonly pruned: string[];
 }

package/dist/init-deposit/hygiene.js

@@ -257,6 +257,10 @@ async function pruneEmptyParentsForFile(deftDir, contentDirs, relFile) {
  * Remove deposit files not shipped by `@deftai/directive-content`, preserving
  * generated deposit metadata such as `VERSION` (#2804). Subsumes the legacy
  * hard-coded `packages/` prune (#2347).
+ *
+ * Individual removal failures are reported but do not throw — callers that must
+ * refuse a VERSION stamp until the deposit matches the content package should
+ * use {@link reconcileDepositToContentPackage} (#2913).
  */
 export async function prunePackageAbsentDepositPaths(deftDir, contentRoot, io) {
     const absent = await findPackageAbsentDepositPaths(deftDir, contentRoot);
@@ -278,6 +282,28 @@ export async function prunePackageAbsentDepositPaths(deftDir, contentRoot, io) {
     }
     return { pruned, prunedDirs };
 }
+/**
+ * Fail-closed deposit reconcile against the installed content package (#2913).
+ *
+ * Runs {@link prunePackageAbsentDepositPaths}, then re-scans. If any
+ * package-absent path remains, throws so callers refuse the VERSION stamp
+ * (dst-only stale/malicious agent content must not survive a refresh).
+ *
+ * After a successful {@link replaceTree} full-swap this is typically a no-op
+ * verification; it also covers additive copy seams and the already-current
+ * refresh path that skips payload copy.
+ */
+export async function reconcileDepositToContentPackage(deftDir, contentRoot, io) {
+    const result = await prunePackageAbsentDepositPaths(deftDir, contentRoot, io);
+    const remaining = await findPackageAbsentDepositPaths(deftDir, contentRoot);
+    if (remaining.length > 0) {
+        const sample = remaining.slice(0, 5).join(", ");
+        const more = remaining.length > 5 ? ` (+${remaining.length - 5} more)` : "";
+        throw new Error(`deposit reconcile failed: ${remaining.length} package-absent path(s) remain under .deft/core ` +
+            `(e.g. ${sample}${more}). Refusing VERSION stamp until dst-only content is removed (#2913).`);
+    }
+    return result;
+}
 /**
  * Remove framework-source subdirectories from `.deft/core/` that are not
  * present in the deposited content package (#2347). Silently skips any path

package/dist/init-deposit/init-dispatch.js

@@ -21,6 +21,7 @@
  * dispatcher never re-implements deposit, refresh, or migrate behavior.
  */
 import { resolve } from "node:path";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { classify, plan } from "../resolution/index.js";
 import { runInitDepositCli } from "./init-deposit.js";
 import { runMigrateCli } from "./migrate.js";
@@ -119,6 +120,33 @@ export async function runInitDispatchCli(options) {
                 options.writeOut(text);
         },
     };
+    // #2926: root opt-out — do not scaffold/install/refresh when flag is present.
+    const optOut = detectNoDeftDirective(projectDir);
+    if (optOut.present) {
+        io.printf(`\n[directive init] ${NO_DEFT_DIRECTIVE_DISABLED_MESSAGE}\n`);
+        if (optOut.inconsistent) {
+            io.printf(`[directive init] ${NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE}\n`);
+        }
+        if (options.jsonOut) {
+            options.writeOut(`${JSON.stringify({
+                success: false,
+                action: "init",
+                disabled: true,
+                disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                inconsistent: optOut.inconsistent,
+                ...(optOut.inconsistent
+                    ? { inconsistent_policy: NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY }
+                    : {}),
+                deposit_present: optOut.depositPresent,
+                project_dir: projectDir,
+                message: optOut.inconsistent
+                    ? NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE
+                    : NO_DEFT_DIRECTIVE_DISABLED_MESSAGE,
+            }, null, 2)}\n`);
+        }
+        // Clean opt-out is a successful short-circuit; inconsistent state fails closed.
+        return optOut.inconsistent ? 1 : 0;
+    }
     const classification = classifyInitDispatch(projectDir, seams.classifySeams ?? {});
     const { decision, plan: resolutionPlan } = classification;
     printInitDispatchSummary(io, decision, resolutionPlan);

package/dist/init-deposit/migrate.d.ts

@@ -49,7 +49,7 @@ export interface MigrateSeams {
     isFile?: (path: string) => boolean;
     /** Text read returning null on failure (default: node:fs readFileSync, utf8). */
     readText?: (path: string) => string | null;
-    /** Text write (default: node:fs writeFileSync, utf8). */
+    /** Text write (default: containedWrite under projectRoot; #2980 wave A). */
     writeText?: (path: string, text: string) => void;
     /** ISO-8601 UTC timestamp source for the backup filename (default: Date.now). */
     nowIso?: () => string;

package/dist/init-deposit/migrate.js

@@ -24,11 +24,12 @@
  *
  * Refs #1941, #1912 (freeze prerequisite b), #1933 (never-first-start), #1670.
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { resolveContentPackageRoot } from "../content-root.js";
 import { locateManifest, parseInstallManifest } from "../doctor/manifest.js";
+import { containedWrite } from "../fs/contained-write.js";
 import { CANONICAL_INSTALL_ROOT } from "./scaffold.js";
 /**
  * The npm-managed handshake sentinel. `directive migrate` adds this key/value to
@@ -99,7 +100,16 @@ function engineMissingMessage() {
 export function runMigrate(projectRoot, seams = {}) {
     const isFile = seams.isFile ?? existsSync;
     const readText = seams.readText ?? defaultReadText;
-    const writeText = seams.writeText ?? ((path, text) => writeFileSync(path, text, "utf8"));
+    const writeText = seams.writeText ??
+        ((path, text) => {
+            // #2980 wave A: product write sink routes through containedWrite.
+            containedWrite({
+                root: resolve(projectRoot),
+                target: path,
+                data: text,
+                mode: "replace",
+            });
+        });
     const nowIso = seams.nowIso ?? (() => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"));
     const resolveEngine = seams.resolveEngine ?? defaultResolveEngine;
     const manifestPath = detectCanonicalVendoredManifest(projectRoot, isFile);

package/dist/init-deposit/prettierignore.js

@@ -7,9 +7,10 @@
  *
  * Refs #2534, #670.
  */
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { assertProjectionContained } from "../fs/projection-containment.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { assertDestinationNotSymlink } from "../fs/projection-containment.js";
 import { stripGitignoreInlineComment } from "../triage/bootstrap/gitignore.js";
 /** Directory ignore entry for the hybrid deposit. */
 export const PRETTIERIGNORE_DEFT_CORE_LINE = ".deft/core/";
@@ -18,7 +19,7 @@ const DEFT_CORE_COVERING_LINES = new Set([".deft/core/", ".deft/core", ".deft/co
 const DEFT_FRAMEWORK_PRETTIERIGNORE_HEADER = "# Deft framework: the vendored payload is outside the consumer Prettier gate (#2534).\n";
 function projectionTarget(projectDir) {
     const target = join(projectDir, ".prettierignore");
-    assertProjectionContained(projectDir, target);
+    assertDestinationNotSymlink(projectDir, target);
     return target;
 }
 function prettierIgnoreCoversLine(present, line) {
@@ -72,7 +73,13 @@ export function ensurePrettierIgnoreLines(projectDir, io) {
         body += `${add}\n`;
     }
     try {
-        writeFileSync(path, body, { encoding: "utf8", mode: 0o644 });
+        // #2980 wave A: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectDir),
+            target: path,
+            data: body,
+            mode: "replace",
+        });
     }
     catch (cause) {
         throw new Error(`could not write .prettierignore: ${String(cause)}`);

package/dist/init-deposit/refresh.js

@@ -12,19 +12,20 @@ import { existsSync, readFileSync, renameSync, statSync } from "node:fs";
 import { platform as osPlatform } from "node:os";
 import { join, resolve } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
-import { copyTree } from "../deposit/copy-tree.js";
+import { replaceTree } from "../deposit/copy-tree.js";
 import { prunePythonArtifactsFromDeposit } from "../deposit/python-free.js";
 import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { manifestTagToVersion, parseInstallManifest } from "../doctor/manifest.js";
 import { readCorePackageVersion } from "../engine-version.js";
 import { resolveLifecycleRoot } from "../layout/resolve.js";
+import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { runOrgForceOnMigration } from "../policy/org-force-on-migration.js";
 import { checkLocalEngineIntegrity, classify, ENGINE_PACKAGE, plan, renderGlobalInstall, resolveEngine, } from "../resolution/index.js";
 import { gitPorcelain } from "../story-ready/git.js";
 import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
 import { ensureInitGitignoreLines, isDepositTrackedInGit } from "./gitignore.js";
-import { depositStagePaths, isInstallerManagedPath, printCommitGuidance, prunePackageAbsentDepositPaths, } from "./hygiene.js";
+import { depositStagePaths, isInstallerManagedPath, printCommitGuidance, reconcileDepositToContentPackage, } from "./hygiene.js";
 import { parseInitArgv } from "./init-deposit.js";
 import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout, LEGACY_LAYOUT_REFUSED_EXIT_CODE, LegacyLayoutRefusedError, } from "./legacy-detect.js";
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
@@ -392,7 +393,9 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     // the resolved project tree. Writes nothing on refusal.
     assertDepositContained(projectDir, deftDir);
     const resolveContent = seams.resolveContentRoot ?? resolveInstalledContentRoot;
-    const copyContent = seams.copyContent ?? copyTree;
+    // #2913: default is full-tree replace (Go swapInCore parity), not additive copyTree.
+    // Injected seams.copyContent still wins (tests / specialized callers).
+    const copyContent = seams.copyContent ?? replaceTree;
     const readEngine = seams.readEngineVersion ?? readCorePackageVersion;
     const readPackageVersion = seams.readPackageVersion ?? readCorePackageVersion;
     const contentRoot = await resolveContent();
@@ -406,15 +409,19 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     const strategy = alreadyCurrent ? "no-op" : "file-swap";
     if (alreadyCurrent) {
         io.printf("[deft update] Framework payload already current; skipping payload copy.\n");
+        // #2913: still fail-closed reconcile so dst-only leftovers cannot linger when
+        // VERSION already matches (e.g. pre-#2804 additive deposits). Does not re-stamp.
+        await reconcileDepositToContentPackage(deftDir, contentRoot, io);
         migrateLegacyInstallManifest(projectDir, join(deftDir, "VERSION"));
     }
     else {
+        // Full-tree replace (or injected seam). Additive copy is no longer the default.
         await copyContent(contentRoot, deftDir);
         await prunePythonArtifactsFromDeposit(deftDir, projectDir, io);
-        // #2804 / #2347: prune deposit paths absent from the content package. The
-        // additive file-swap never removes them, causing stale bridge-era files to
-        // survive across upgrades until manually cleaned.
-        await prunePackageAbsentDepositPaths(deftDir, contentRoot, io);
+        // #2913 / #2804 / #2347: fail-closed delete-not-in-source BEFORE VERSION stamp.
+        // replaceTree already drops dst-only paths; reconcile verifies and covers
+        // additive seams. Throws => no VERSION rewrite (refuse stamp until clean).
+        await reconcileDepositToContentPackage(deftDir, contentRoot, io);
         const nowIso = seams.nowIso ?? (() => new Date().toISOString().replace(/\.\d{3}Z$/, "Z"));
         const manifestFields = {
             ref: contentVersion.startsWith("v") ? contentVersion : `v${contentVersion}`,
@@ -586,6 +593,30 @@ export async function runRefreshDepositCli(options) {
     // Legacy layouts keep their existing refusal path (thrown by runRefreshDeposit
     // and handled below), so classification is skipped for them.
     const projectDir = resolve(options.projectDir);
+    // #2926: root opt-out wins over update/refresh and ambient force-on.
+    const optOut = detectNoDeftDirective(projectDir);
+    if (optOut.present) {
+        const message = optOut.inconsistent
+            ? NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE
+            : NO_DEFT_DIRECTIVE_DISABLED_MESSAGE;
+        io.printf(`${message}\n`);
+        if (options.jsonOut) {
+            options.writeOut(`${JSON.stringify({
+                success: false,
+                action: "update",
+                disabled: true,
+                disabled_via: NO_DEFT_DIRECTIVE_FLAG_NAME,
+                inconsistent: optOut.inconsistent,
+                ...(optOut.inconsistent
+                    ? { inconsistent_policy: NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY }
+                    : {}),
+                deposit_present: optOut.depositPresent,
+                project_dir: projectDir,
+                message,
+            }, null, 2)}\n`);
+        }
+        return UPDATE_REFUSED_EXIT_CODE;
+    }
     const detectLegacy = options.seams?.detectLegacy ?? detectLegacyLayout;
     let classification = null;
     if (!detectLegacy(projectDir).legacy) {