@deftai/directive-core 0.87.0 → 0.89.0

package/dist/packs/pack-render.js

@@ -1,8 +1,21 @@
 /** Port of scripts/pack_render.py — content-pack projection renderer (#1294, #1295). */
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { contentRoot } from "../content-root.js";
+import { containedWrite } from "../fs/contained-write.js";
+/** Write under the parent directory as containment root (#2980 wave D). */
+function writeContainedFile(output, text) {
+    const abs = resolve(output);
+    const dir = dirname(abs);
+    mkdirSync(dir, { recursive: true });
+    containedWrite({
+        root: dir,
+        target: basename(abs),
+        data: text,
+        mode: "replace",
+    });
+}
 export function resolveRepoRoot() {
     return resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..");
 }
@@ -54,6 +67,138 @@ const SWARM_SPEC_BANNER = [
 ];
 export const BANNER = `${LESSONS_BANNER.join("\n")}\n`;
 export const DOC_TITLE = "# Lessons Learned";
+/** Non-zero exit code for a pack-render containment / schema refusal. */
+export const PACK_RENDER_REFUSED_EXIT_CODE = 2;
+/**
+ * Thrown, fail-closed, when a pack record's projection path escapes CONTENT_ROOT,
+ * violates the pack path schema, or a frontmatter field carries an injection
+ * payload (null byte / newline). Remediates AppSec finding skill-pack-supply-01
+ * from tracker #2904. Refs #2914.
+ */
+export class PackRenderContainmentError extends Error {
+    pack;
+    field;
+    offendingValue;
+    constructor(message, details) {
+        super(message);
+        this.name = "PackRenderContainmentError";
+        this.pack = details.pack;
+        this.field = details.field;
+        this.offendingValue = details.offendingValue;
+    }
+}
+/**
+ * Path-SEGMENT containment: is `child` equal to `parent` or nested under it?
+ * Uses `path.relative` so `/foo` is NOT treated as containing `/foobar`
+ * (mirrors deposit/contain.ts).
+ */
+function isContained(parent, child) {
+    if (parent === child) {
+        return true;
+    }
+    const rel = relative(parent, child);
+    return rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+}
+/** realpath with a resolve() fallback when the path does not exist yet. */
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
+/**
+ * Defense-in-depth: walk each EXISTING component from CONTENT_ROOT down to the
+ * resolved output and refuse any symlink that escapes CONTENT_ROOT. Mirrors the
+ * realpath-anchored segment walk in deposit/contain.ts so a symlinked content
+ * subtree cannot redirect a projection write outside the shippable-content root.
+ */
+function assertAncestorContained(packName, field, rawPath, rootReal, outPath) {
+    const rel = relative(rootReal, outPath);
+    const segments = rel.split(/[\\/]+/).filter((segment) => segment.length > 0);
+    let current = rootReal;
+    for (const segment of segments) {
+        current = join(current, segment);
+        let info;
+        try {
+            info = lstatSync(current);
+        }
+        catch {
+            // Component does not exist yet; nothing below it can exist either.
+            break;
+        }
+        if (info.isSymbolicLink()) {
+            let linkReal;
+            try {
+                linkReal = realpathSync(current);
+            }
+            catch {
+                throw new PackRenderContainmentError(`pack-render refused: ${packName} ${field} path component ${current} is a broken symlink`, { pack: packName, field, offendingValue: rawPath });
+            }
+            if (!isContained(rootReal, linkReal)) {
+                throw new PackRenderContainmentError(`pack-render refused: ${packName} ${field} path component ${current} is a symlink ` +
+                    `escaping CONTENT_ROOT (resolves to ${linkReal}, outside ${rootReal})`, { pack: packName, field, offendingValue: rawPath });
+            }
+            current = linkReal;
+        }
+    }
+}
+/**
+ * Resolve a pack record's projection path against CONTENT_ROOT and refuse,
+ * fail-closed, any value that: is missing/empty/non-string, carries a null
+ * byte, is absolute, violates the pack's schema path pattern, or resolves
+ * outside CONTENT_ROOT (a `..` escape). Returns the contained absolute output
+ * path. Mirrors deposit/contain.ts segment containment. Refs #2914 / #2904.
+ */
+export function containedOutPath(packName, rawPath, cfg) {
+    const field = cfg.path_field ?? "path";
+    if (typeof rawPath !== "string" || rawPath.length === 0) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} entry has a missing/empty ${field}`, { pack: packName, field, offendingValue: String(rawPath) });
+    }
+    if (rawPath.includes("\0")) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} ${field} contains a null byte`, { pack: packName, field, offendingValue: rawPath });
+    }
+    if (isAbsolute(rawPath) || /^[\\/]/.test(rawPath)) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} ${field} must be a relative path (got absolute ${JSON.stringify(rawPath)})`, { pack: packName, field, offendingValue: rawPath });
+    }
+    if (cfg.path_pattern && !cfg.path_pattern.test(rawPath)) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} ${field} ${JSON.stringify(rawPath)} violates the ` +
+            `${packName}-pack schema path pattern ${String(cfg.path_pattern)}`, { pack: packName, field, offendingValue: rawPath });
+    }
+    // Resolve with realpath semantics on the trusted root, then confirm segment
+    // containment. `resolve` collapses `..`, so an escape lands outside rootReal
+    // and is refused here even when it slipped past the schema pattern (where `.`
+    // can match a path separator).
+    const rootReal = safeRealpath(CONTENT_ROOT);
+    const outPath = resolve(rootReal, rawPath);
+    if (!isContained(rootReal, outPath)) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} ${field} ${JSON.stringify(rawPath)} escapes CONTENT_ROOT ` +
+            `(resolves to ${outPath}, outside ${rootReal})`, { pack: packName, field, offendingValue: rawPath });
+    }
+    assertAncestorContained(packName, field, rawPath, rootReal, outPath);
+    return outPath;
+}
+/** Refuse a frontmatter field value that embeds a null byte. Refs #2914. */
+function assertNoNullByte(value, packName, field) {
+    if (value.includes("\0")) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} frontmatter field ${field} contains a null byte`, { pack: packName, field, offendingValue: value });
+    }
+    return value;
+}
+/**
+ * Sanitize a single-line YAML frontmatter field (skill `name`): refuse null
+ * bytes and any CR/LF. An unescaped newline would inject arbitrary YAML keys or
+ * a premature `---` document break into the generated frontmatter. Refs #2914.
+ */
+function sanitizeSingleLineField(value, packName, field) {
+    assertNoNullByte(value, packName, field);
+    if (/[\r\n]/.test(value)) {
+        throw new PackRenderContainmentError(`pack-render refused: ${packName} frontmatter field ${field} must not contain a newline ` +
+            `(YAML frontmatter injection)`, { pack: packName, field, offendingValue: value });
+    }
+    return value;
+}
 export const RENDER_REGISTRY = {
     lessons: {
         mode: "collection",
@@ -73,6 +218,7 @@ export const RENDER_REGISTRY = {
         name_field: "id",
         description_field: "description",
         path_field: "path",
+        path_pattern: /^skills\/.+\/SKILL\.md$/,
         body_field: "body",
         banner: SKILLS_BANNER,
     },
@@ -82,6 +228,7 @@ export const RENDER_REGISTRY = {
         source: join(CONTENT_ROOT, "packs", "rules", "rules-pack-0.1.json"),
         items_field: "rules",
         path_field: "path",
+        path_pattern: /^(?:coding\/.+\.md|AGENTS\.md|main\.md)$/,
         body_field: "body",
         banner: RULES_BANNER,
     },
@@ -91,6 +238,7 @@ export const RENDER_REGISTRY = {
         source: join(CONTENT_ROOT, "packs", "strategies", "strategies-pack-0.1.json"),
         items_field: "strategies",
         path_field: "path",
+        path_pattern: /^strategies\/.+\.md$/,
         body_field: "body",
         banner: STRATEGIES_BANNER,
     },
@@ -100,6 +248,7 @@ export const RENDER_REGISTRY = {
         source: join(CONTENT_ROOT, "packs", "patterns", "patterns-pack-0.1.json"),
         items_field: "patterns",
         path_field: "path",
+        path_pattern: /^patterns\/.+\.md$/,
         body_field: "body",
         banner: PATTERNS_BANNER,
     },
@@ -109,6 +258,7 @@ export const RENDER_REGISTRY = {
         source: join(CONTENT_ROOT, "packs", "swarm-spec", "swarm-spec-pack-0.1.json"),
         items_field: "entries",
         path_field: "path",
+        path_pattern: /^swarm\/.+\.md$/,
         body_field: "body",
         banner: SWARM_SPEC_BANNER,
     },
@@ -166,12 +316,18 @@ function emitDescription(description) {
     return lines.join("\n");
 }
 export function renderSkillDocument(entry, cfg) {
-    const name = entry[cfg.name_field ?? "id"];
-    const description = entry[cfg.description_field ?? "description"];
+    // Sanitize every YAML frontmatter field so a malicious pack cannot inject
+    // unescaped frontmatter (newline -> extra key / premature `---`) or a null
+    // byte. Refs #2914 / #2904 (skill-pack-supply-01).
+    const nameField = cfg.name_field ?? "id";
+    const descriptionField = cfg.description_field ?? "description";
+    const name = sanitizeSingleLineField(String(entry[nameField]), "skills", nameField);
+    const description = assertNoNullByte(String(entry[descriptionField]), "skills", descriptionField);
     const body = entry[cfg.body_field] ?? "";
     const extra = entry.frontmatter_extra;
-    const extraBlock = typeof extra === "string" && extra.length > 0 ? `${extra}\n` : "";
-    const frontmatter = `---\nname: ${String(name)}\n${emitDescription(String(description))}\n${extraBlock}---\n`;
+    const extraStr = typeof extra === "string" ? assertNoNullByte(extra, "skills", "frontmatter_extra") : "";
+    const extraBlock = extraStr.length > 0 ? `${extraStr}\n` : "";
+    const frontmatter = `---\nname: ${name}\n${emitDescription(description)}\n${extraBlock}---\n`;
     return `${frontmatter}${bannerText(cfg.banner)}\n${String(body)}`;
 }
 export function renderMarkdownDocument(entry, cfg) {
@@ -182,7 +338,7 @@ const DOCUMENT_RENDERERS = {
     skill: renderSkillDocument,
     markdown: renderMarkdownDocument,
 };
-function targetsForPack(pack, cfg) {
+export function targetsForPack(packName, pack, cfg) {
     if (cfg.mode === "collection") {
         return [[cfg.output ?? "", renderCollection(pack, cfg)]];
     }
@@ -203,7 +359,10 @@ function targetsForPack(pack, cfg) {
         const pathField = cfg.path_field ?? "path";
         // Document projection targets (skills/rules/strategies/patterns) are
         // shippable content -- they live under content/ in the source repo (#1875).
-        const outPath = join(CONTENT_ROOT, String(record[pathField]));
+        // #2914: contain the pack-supplied path under CONTENT_ROOT and enforce the
+        // pack schema path pattern BEFORE render so a malicious pack JSON cannot
+        // write outside content/ via an absolute / `..` / null-byte path.
+        const outPath = containedOutPath(packName, record[pathField], cfg);
         targets.push([outPath, docRenderer(record, cfg)]);
     }
     return targets;
@@ -218,7 +377,7 @@ export function collectTargets(packFilter) {
             throw new Error(`pack source not found: ${cfg.source}`);
         }
         const pack = JSON.parse(readFileSync(cfg.source, "utf8"));
-        for (const [outPath, text] of targetsForPack(pack, cfg)) {
+        for (const [outPath, text] of targetsForPack(name, pack, cfg)) {
             targets.push([name, outPath, text]);
         }
     }
@@ -236,8 +395,8 @@ export function renderFile(source) {
 }
 export function writeRender(source, output) {
     const text = renderFile(source);
-    mkdirSync(dirname(output), { recursive: true });
-    writeFileSync(output, text, "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    writeContainedFile(output, text);
     return text;
 }
 export function checkDrift(source, output) {
@@ -295,9 +454,9 @@ function runMultipack(packFilter, check) {
         process.stdout.write(`pack-drift: all ${targets.length} projection(s) in sync.\n`);
         return 0;
     }
+    // #2980 wave D: product write sinks route through containedWrite.
     for (const [_name, outPath, text] of targets) {
-        mkdirSync(dirname(outPath), { recursive: true });
-        writeFileSync(outPath, text, "utf8");
+        writeContainedFile(outPath, text);
     }
     process.stdout.write(`Rendered ${targets.length} projection(s) across ${Object.keys(RENDER_REGISTRY).length} pack(s).\n`);
     return 0;

package/dist/packs/quarantine-ext.d.ts

@@ -2,6 +2,16 @@
 export declare const SUSPICIOUS_TOKENS: readonly string[];
 export declare const QUARANTINE_FENCE_OPEN = "```quarantined";
 export declare const QUARANTINE_FENCE_CLOSE = "```";
+/**
+ * Neutralize a body line so it cannot act as a CommonMark fence open/close.
+ * Used on content placed inside a ```quarantined wrapper (#2915 / cache-quarantine-03).
+ *
+ * A nested bare ``` (or longer run, optional ≤3-space indent) would otherwise
+ * early-close the outer fence and let following attacker text render outside
+ * the quarantined info-string. Break the delimiter run by inserting a backslash
+ * after the first fence character: ``` → `\`` , ~~~ → ~\~~ .
+ */
+export declare function neutralizeFenceLine(line: string): string;
 export declare function quarantineBody(rawMd: string): string;
 export declare function main(argv?: string[]): number;
 //# sourceMappingURL=quarantine-ext.d.ts.map

package/dist/packs/quarantine-ext.js

@@ -28,6 +28,26 @@ export const SUSPICIOUS_TOKENS = [
 ];
 export const QUARANTINE_FENCE_OPEN = "```quarantined";
 export const QUARANTINE_FENCE_CLOSE = "```";
+/**
+ * Neutralize a body line so it cannot act as a CommonMark fence open/close.
+ * Used on content placed inside a ```quarantined wrapper (#2915 / cache-quarantine-03).
+ *
+ * A nested bare ``` (or longer run, optional ≤3-space indent) would otherwise
+ * early-close the outer fence and let following attacker text render outside
+ * the quarantined info-string. Break the delimiter run by inserting a backslash
+ * after the first fence character: ``` → `\`` , ~~~ → ~\~~ .
+ */
+export function neutralizeFenceLine(line) {
+    const match = /^( {0,3})(`{3,}|~{3,})(.*)$/.exec(line);
+    if (match === null)
+        return line;
+    const indent = match[1] ?? "";
+    const delim = match[2] ?? "";
+    const rest = match[3] ?? "";
+    // One backslash after the first fence char breaks the delimiter run.
+    // Concat (not a template literal) so "\\" is unambiguously a single "\".
+    return indent + delim[0] + "\\" + delim.slice(1) + rest;
+}
 function isWordChar(ch) {
     return ((ch >= "A" && ch <= "Z") || (ch >= "a" && ch <= "z") || (ch >= "0" && ch <= "9") || ch === "_");
 }
@@ -133,14 +153,18 @@ export function quarantineBody(rawMd) {
                 sectionEnd += 1;
             }
             out.push(QUARANTINE_FENCE_OPEN);
-            out.push(...lines.slice(i, sectionEnd));
+            // #2915: neutralize nested fence lines so they cannot early-close.
+            for (const bodyLine of lines.slice(i, sectionEnd)) {
+                out.push(neutralizeFenceLine(bodyLine));
+            }
             out.push(QUARANTINE_FENCE_CLOSE);
             i = sectionEnd;
             continue;
         }
         if (isSuspicious(line)) {
             out.push(QUARANTINE_FENCE_OPEN);
-            out.push(line);
+            // #2915: neutralize in case the single line itself is fence-shaped.
+            out.push(neutralizeFenceLine(line));
             out.push(QUARANTINE_FENCE_CLOSE);
             i += 1;
             continue;

package/dist/plan-sequence/store.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { PLAN_SEQUENCE_FILENAME, parsePlanSequence } from "./types.js";
 export function planSequencePath(projectRoot) {
     return join(projectRoot, ".deft", PLAN_SEQUENCE_FILENAME);
@@ -14,8 +15,14 @@ export function readPlanSequence(projectRoot) {
 }
 export function writePlanSequence(projectRoot, sequence) {
     const path = planSequencePath(projectRoot);
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(sequence, null, 2)}\n`, "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    const root = resolve(projectRoot);
+    containedWrite({
+        root,
+        target: path,
+        data: `${JSON.stringify(sequence, null, 2)}\n`,
+        mode: "replace",
+    });
     return path;
 }
 export function clearPlanSequence(projectRoot) {

package/dist/policy/hotfix-criteria.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Typed hotfix classifier (#1193 R2 / Wave 2 of #2948).
+ *
+ * Hard structural predicates — not agent judgement. Agent may propose the
+ * label `hotfix-candidate` only; a human promotes to `hotfix`. Pipeline keys
+ * off `hotfix` exclusively; `hotfix-candidate` has zero pipeline meaning.
+ */
+import type { HotfixCriteria } from "@deftai/directive-types";
+export declare const FIELD_HOTFIX_CRITERIA = "plan.policy.hotfixCriteria";
+export declare const FIELD_HOTFIX_CRITERIA_CLI_ALIAS = "hotfixCriteria";
+/** Agent-proposed beacon only — never pipeline-authorizing. */
+export declare const HOTFIX_CANDIDATE_LABEL: "hotfix-candidate";
+/** Human-promoted label; deploy pipeline keys off this exclusively. */
+export declare const HOTFIX_LABEL: "hotfix";
+export declare const DEFAULT_HOTFIX_MAX_LINES = 10;
+export declare const DEFAULT_HOTFIX_MAX_FILES = 2;
+/** Paths that never qualify as hotfix (deploy / CI / migrations / secrets). */
+export declare const DEFAULT_FORBIDDEN_PATH_GLOBS: readonly string[];
+export declare const DEFAULT_HOTFIX_CRITERIA: Required<HotfixCriteria>;
+export interface HotfixEligibilityInput {
+    /** Total lines added+removed (or equivalent structural line count). */
+    readonly linesChanged: number;
+    /** Distinct files touched. */
+    readonly filesChanged: number;
+    /** Project-relative POSIX paths in the diff. */
+    readonly paths: readonly string[];
+    /** Pure revert of a prior change — always eligible. */
+    readonly isPureRevert?: boolean;
+    /** One-character / trivial edit signal (always eligible when true with restoresGreen). */
+    readonly isOneCharacterEdit?: boolean;
+    /** Refactors of any size are never hotfix. */
+    readonly isRefactor?: boolean;
+    /** New package / dependency entries. */
+    readonly addsNewDependency?: boolean;
+    /** Adds, removes, or renames an exported symbol/surface. */
+    readonly changesExportedSurface?: boolean;
+    /** Schema or migration changes. */
+    readonly touchesSchemaOrMigration?: boolean;
+    /** New handler/route/media-type surface. */
+    readonly addsNewHandlerOrRoute?: boolean;
+    /** Build was green on main; this change restores green. */
+    readonly restoresGreen?: boolean;
+    /** Criteria override (defaults + project typed policy). */
+    readonly criteria?: HotfixCriteria | null;
+}
+export type HotfixDenyReason = "refactor" | "new-export" | "new-dependency" | "schema-migration" | "new-handler-route" | "forbidden-path" | "too-many-lines" | "too-many-files" | "not-restoring-green";
+export interface HotfixEligibilityResult {
+    readonly eligible: boolean;
+    /** When eligible, the agent may apply this label only. */
+    readonly proposedLabel: typeof HOTFIX_CANDIDATE_LABEL | null;
+    readonly reasons: readonly string[];
+    readonly denyCodes: readonly HotfixDenyReason[];
+    readonly criteria: Required<HotfixCriteria>;
+}
+/**
+ * Pure hotfix eligibility evaluator (#1193 R2).
+ *
+ * Eligible (agent may propose `hotfix-candidate`):
+ * - pure revert always
+ * - one-character edit that restores green
+ * - small fix: ≤ maxLines AND ≤ maxFiles, no new deps/exports/schema, no forbidden
+ *   paths, not a refactor, restores green
+ *
+ * Never eligible: refactors, new handlers/routes, export surface changes, forbidden paths.
+ */
+export declare function evaluateHotfixEligibility(input: HotfixEligibilityInput): HotfixEligibilityResult;
+/** Resolve typed hotfixCriteria from a raw policy block value. */
+export declare function resolveHotfixCriteria(raw: unknown): Required<HotfixCriteria>;
+export interface HotfixCriteriaPolicyField {
+    readonly name: string;
+    readonly current: Required<HotfixCriteria>;
+    readonly default: Required<HotfixCriteria>;
+    readonly source: string;
+}
+/** Inspector row for `policy:show --field=hotfixCriteria`. */
+export declare function inspectHotfixCriteria(data: Record<string, unknown> | null): HotfixCriteriaPolicyField;
+/** Load hotfix criteria from project root. */
+export declare function loadHotfixCriteriaFromProject(projectRoot: string): Required<HotfixCriteria>;
+//# sourceMappingURL=hotfix-criteria.d.ts.map

package/dist/policy/hotfix-criteria.js

@@ -0,0 +1,197 @@
+/**
+ * Typed hotfix classifier (#1193 R2 / Wave 2 of #2948).
+ *
+ * Hard structural predicates — not agent judgement. Agent may propose the
+ * label `hotfix-candidate` only; a human promotes to `hotfix`. Pipeline keys
+ * off `hotfix` exclusively; `hotfix-candidate` has zero pipeline meaning.
+ */
+import { matchAny } from "../orchestration/pathspec.js";
+import { readPlanPolicy } from "./plan-extensions.js";
+import { loadProjectDefinition } from "./resolve.js";
+export const FIELD_HOTFIX_CRITERIA = "plan.policy.hotfixCriteria";
+export const FIELD_HOTFIX_CRITERIA_CLI_ALIAS = "hotfixCriteria";
+/** Agent-proposed beacon only — never pipeline-authorizing. */
+export const HOTFIX_CANDIDATE_LABEL = "hotfix-candidate";
+/** Human-promoted label; deploy pipeline keys off this exclusively. */
+export const HOTFIX_LABEL = "hotfix";
+export const DEFAULT_HOTFIX_MAX_LINES = 10;
+export const DEFAULT_HOTFIX_MAX_FILES = 2;
+/** Paths that never qualify as hotfix (deploy / CI / migrations / secrets). */
+export const DEFAULT_FORBIDDEN_PATH_GLOBS = [
+    "Dockerfile",
+    "**/Dockerfile",
+    "fly.toml",
+    "**/fly.toml",
+    ".github/workflows/**",
+    "migrations/**",
+    "**/migrations/**",
+    "**/*secret*",
+    "**/*billing*",
+    "**/.env",
+    "**/.env.*",
+    "**/auth/**",
+    "**/secrets/**",
+];
+export const DEFAULT_HOTFIX_CRITERIA = {
+    maxLines: DEFAULT_HOTFIX_MAX_LINES,
+    maxFiles: DEFAULT_HOTFIX_MAX_FILES,
+    forbiddenPathGlobs: DEFAULT_FORBIDDEN_PATH_GLOBS,
+};
+function normalizeCriteria(raw) {
+    const maxLines = typeof raw?.maxLines === "number" && Number.isInteger(raw.maxLines) && raw.maxLines >= 0
+        ? raw.maxLines
+        : DEFAULT_HOTFIX_MAX_LINES;
+    const maxFiles = typeof raw?.maxFiles === "number" && Number.isInteger(raw.maxFiles) && raw.maxFiles >= 0
+        ? raw.maxFiles
+        : DEFAULT_HOTFIX_MAX_FILES;
+    const forbidden = Array.isArray(raw?.forbiddenPathGlobs) && raw.forbiddenPathGlobs.length > 0
+        ? raw.forbiddenPathGlobs.filter((g) => typeof g === "string" && g.length > 0)
+        : DEFAULT_FORBIDDEN_PATH_GLOBS;
+    return { maxLines, maxFiles, forbiddenPathGlobs: forbidden };
+}
+function pathIsForbidden(path, globs) {
+    const posix = path.replace(/\\/g, "/");
+    // Basename-only defaults (Dockerfile, fly.toml) match any depth.
+    const base = posix.includes("/") ? posix.slice(posix.lastIndexOf("/") + 1) : posix;
+    for (const g of globs) {
+        if (!g.includes("/") && !g.includes("*") && base === g)
+            return true;
+    }
+    return matchAny(globs, posix);
+}
+/**
+ * Pure hotfix eligibility evaluator (#1193 R2).
+ *
+ * Eligible (agent may propose `hotfix-candidate`):
+ * - pure revert always
+ * - one-character edit that restores green
+ * - small fix: ≤ maxLines AND ≤ maxFiles, no new deps/exports/schema, no forbidden
+ *   paths, not a refactor, restores green
+ *
+ * Never eligible: refactors, new handlers/routes, export surface changes, forbidden paths.
+ */
+export function evaluateHotfixEligibility(input) {
+    const criteria = normalizeCriteria(input.criteria);
+    const denyCodes = [];
+    const reasons = [];
+    if (input.isPureRevert === true) {
+        return {
+            eligible: true,
+            proposedLabel: HOTFIX_CANDIDATE_LABEL,
+            reasons: ["pure-revert always qualifies as hotfix-candidate"],
+            denyCodes: [],
+            criteria,
+        };
+    }
+    if (input.isOneCharacterEdit === true && input.restoresGreen !== false) {
+        return {
+            eligible: true,
+            proposedLabel: HOTFIX_CANDIDATE_LABEL,
+            reasons: ["one-character edit that restores green qualifies as hotfix-candidate"],
+            denyCodes: [],
+            criteria,
+        };
+    }
+    if (input.isRefactor === true) {
+        denyCodes.push("refactor");
+        reasons.push("refactors of any size are never hotfix");
+    }
+    if (input.changesExportedSurface === true) {
+        denyCodes.push("new-export");
+        reasons.push("exported surface add/remove/rename is never hotfix");
+    }
+    if (input.addsNewDependency === true) {
+        denyCodes.push("new-dependency");
+        reasons.push("new dependencies are never hotfix");
+    }
+    if (input.touchesSchemaOrMigration === true) {
+        denyCodes.push("schema-migration");
+        reasons.push("schema/migration changes are never hotfix");
+    }
+    if (input.addsNewHandlerOrRoute === true) {
+        denyCodes.push("new-handler-route");
+        reasons.push("new handlers/routes/media types are never hotfix");
+    }
+    for (const p of input.paths) {
+        if (pathIsForbidden(p, criteria.forbiddenPathGlobs)) {
+            denyCodes.push("forbidden-path");
+            reasons.push(`forbidden path: ${p}`);
+            break;
+        }
+    }
+    if (input.linesChanged > criteria.maxLines) {
+        denyCodes.push("too-many-lines");
+        reasons.push(`linesChanged ${input.linesChanged} > maxLines ${criteria.maxLines}`);
+    }
+    if (input.filesChanged > criteria.maxFiles) {
+        denyCodes.push("too-many-files");
+        reasons.push(`filesChanged ${input.filesChanged} > maxFiles ${criteria.maxFiles}`);
+    }
+    // Small-fix path requires restoring green unless pure-revert/one-char already returned.
+    if (input.restoresGreen === false) {
+        denyCodes.push("not-restoring-green");
+        reasons.push("change does not restore green on main");
+    }
+    if (denyCodes.length > 0) {
+        return {
+            eligible: false,
+            proposedLabel: null,
+            reasons,
+            denyCodes,
+            criteria,
+        };
+    }
+    return {
+        eligible: true,
+        proposedLabel: HOTFIX_CANDIDATE_LABEL,
+        reasons: [
+            `small fix within limits (≤${criteria.maxLines} lines, ≤${criteria.maxFiles} files); ` +
+                "agent may apply hotfix-candidate only — human promotes hotfix",
+        ],
+        denyCodes: [],
+        criteria,
+    };
+}
+/** Resolve typed hotfixCriteria from a raw policy block value. */
+export function resolveHotfixCriteria(raw) {
+    if (raw === null || raw === undefined)
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    return normalizeCriteria(raw);
+}
+/** Inspector row for `policy:show --field=hotfixCriteria`. */
+export function inspectHotfixCriteria(data) {
+    const defaults = { ...DEFAULT_HOTFIX_CRITERIA };
+    if (data === null) {
+        return { name: FIELD_HOTFIX_CRITERIA, current: defaults, default: defaults, source: "default" };
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("hotfixCriteria" in policyBlock)) {
+        return { name: FIELD_HOTFIX_CRITERIA, current: defaults, default: defaults, source: "default" };
+    }
+    return {
+        name: FIELD_HOTFIX_CRITERIA,
+        current: resolveHotfixCriteria(policyBlock.hotfixCriteria),
+        default: defaults,
+        source: "typed",
+    };
+}
+/** Load hotfix criteria from project root. */
+export function loadHotfixCriteriaFromProject(projectRoot) {
+    const [data] = loadProjectDefinition(projectRoot);
+    if (data === null)
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("hotfixCriteria" in policyBlock)) {
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    }
+    return resolveHotfixCriteria(policyBlock.hotfixCriteria);
+}
+//# sourceMappingURL=hotfix-criteria.js.map

package/dist/policy/index.d.ts

@@ -4,16 +4,21 @@ export * from "./capacity.js";
 export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./host-hooks.js";
+export * from "./hotfix-criteria.js";
+export * from "./intent-ceiling.js";
+export * from "./no-deft-directive.js";
 export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
+export * from "./require-human-merge.js";
 export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";
+export * from "./write-fence.js";
 export declare const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
 export declare const FIELD_WIP_CAP = "plan.policy.wipCap";
 export declare const FIELD_SESSION_RITUAL_STALENESS_HOURS = "plan.policy.sessionRitualStalenessHours";