@deftai/directive-core 0.87.0 → 0.89.0

package/dist/policy/runtime-authority.js

@@ -127,7 +127,7 @@ export function loadRuntimeAuthorityFromProject(projectRoot) {
     const [data] = loadProjectDefinition(projectRoot);
     return loadRuntimeAuthorityPolicy(data);
 }
-/** Evaluate a project-relative POSIX path against allow/deny globs. */
+/** Evaluate a project-relative POSIX path against allow/deny globs (+ optional story layer). */
 export function evaluateRuntimeAuthorityPath(policy, relPathPosix) {
     if (!policy.enabled)
         return "allow";
@@ -136,8 +136,20 @@ export function evaluateRuntimeAuthorityPath(policy, relPathPosix) {
     if (policy.allowPaths.length > 0 && !matchAny(policy.allowPaths, relPathPosix)) {
         return "deny-allowlist";
     }
+    // Story file_scope layer (#516 / #2443): path must match when non-empty.
+    const storyAllow = policy.storyAllowPaths ?? [];
+    if (storyAllow.length > 0 && !matchAny(storyAllow, relPathPosix)) {
+        return "deny-story-scope";
+    }
     return "allow";
 }
+/** Human-readable fence source label for deny reasons. */
+function fenceSourceLabel(policy) {
+    const sources = policy.fenceSources;
+    if (sources === undefined || sources.length === 0)
+        return "project";
+    return sources.join("+");
+}
 /**
  * Evaluate direct-write runtime authority after ritual/scope gates (#1394).
  * Unclassifiable paths (null) pass — host gap documented for Shell/MCP.
@@ -164,7 +176,7 @@ export function evaluateRuntimeAuthorityDirectWrite(input) {
             allowed: false,
             code: "runtime-policy-deny-path",
             reason: `Directive denied this direct write: path ${relPathPosix} matches ` +
-                "plan.policy.runtimeAuthority.denyPaths.",
+                `write-fence denyPaths (source: ${fenceSourceLabel(policy)}).`,
         };
     }
     if (pathVerdict === "deny-allowlist") {
@@ -172,9 +184,291 @@ export function evaluateRuntimeAuthorityDirectWrite(input) {
             allowed: false,
             code: "runtime-policy-deny-path",
             reason: `Directive denied this direct write: path ${relPathPosix} is outside ` +
-                "plan.policy.runtimeAuthority.allowPaths.",
+                `write fence project allowPaths (source: ${fenceSourceLabel(policy)}).`,
+        };
+    }
+    if (pathVerdict === "deny-story-scope") {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-path",
+            reason: `Directive denied this direct write: path ${relPathPosix} is outside ` +
+                `write fence story file_scope (source: ${fenceSourceLabel(policy)}).`,
         };
     }
     return { allowed: true, reason: null, code: null };
 }
+/** True when token is a shell env assignment (FOO=1 / FOO=). Linear; no nested quantifiers. */
+function isShellEnvAssignToken(token) {
+    const eq = token.indexOf("=");
+    if (eq <= 0)
+        return false;
+    const name = token.slice(0, eq);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+        return false;
+    return true;
+}
+/**
+ * Normalize a shell token for classification (#2711).
+ * Shell strips quotes, empty quote pairs, and backslash escapes before exec
+ * (`g''it` / `g\it` / `'push'` → `git` / `push`). Dropping `'`/`"`/`\` after
+ * whitespace split closes those bypasses without nested-quantifier regex. O(n).
+ */
+function normalizeShellToken(token) {
+    return token.replace(/['"\\]/g, "");
+}
+/**
+ * Split a shell command into list/pipeline/newline segments without splitting
+ * on separators that appear inside quotes or after a backslash escape (#2711).
+ * Prevents `printf '%s' ';' 'git push'` and `hello\; git push` false denials.
+ */
+function splitShellSegments(command) {
+    const segments = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === undefined)
+            break;
+        if (quote !== null) {
+            if (c === quote)
+                quote = null;
+            cur += c;
+            continue;
+        }
+        // Outside quotes: backslash escapes the next character (including separators).
+        if (c === "\\" && i + 1 < command.length) {
+            cur += c;
+            cur += command[i + 1] ?? "";
+            i++;
+            continue;
+        }
+        if (c === "'" || c === '"') {
+            quote = c;
+            cur += c;
+            continue;
+        }
+        // Outside quotes: list/pipeline separators and newlines start a new segment.
+        if (c === "&" && command[i + 1] === "&") {
+            segments.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (c === "|" && command[i + 1] === "|") {
+            segments.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (c === ";" || c === "|" || c === "&" || c === "\n" || c === "\r") {
+            segments.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += c;
+    }
+    segments.push(cur);
+    return segments;
+}
+/** Git global options that take a separate value token (not `--opt=value`). */
+const GIT_GLOBAL_VALUE_OPTS = new Set([
+    "-C",
+    "-c",
+    "--git-dir",
+    "--work-tree",
+    "--namespace",
+    "--config-env",
+    "--super-prefix",
+    "--list-cmds",
+]);
+/**
+ * Classify one shell list/pipeline segment for push/merge (#2711).
+ * Token walk is O(n) — avoids nested-quantifier ReDoS that CodeQL flags on
+ * `git (?:options)* push` style regexes (alerts #77 / #78 on this PR).
+ */
+function classifyShellSegment(segment) {
+    const tokens = segment
+        .trim()
+        .split(/\s+/)
+        .filter((t) => t.length > 0);
+    let i = 0;
+    while (i < tokens.length) {
+        const tok = tokens[i];
+        if (tok === undefined || !isShellEnvAssignToken(tok))
+            break;
+        i++;
+    }
+    const wrapTok = tokens[i];
+    if (wrapTok !== undefined) {
+        const wrap = normalizeShellToken(wrapTok).toLowerCase();
+        if (wrap === "sudo" || wrap === "env" || wrap === "command") {
+            i++;
+            while (i < tokens.length) {
+                const tok = tokens[i];
+                if (tok === undefined || !isShellEnvAssignToken(tok))
+                    break;
+                i++;
+            }
+        }
+    }
+    const binTok = tokens[i];
+    if (binTok === undefined)
+        return null;
+    const bin = normalizeShellToken(binTok).toLowerCase();
+    if (bin === "git" || bin === "git.exe") {
+        i++;
+        // Skip git global options before the subcommand (-C, --git-dir, -c, …).
+        while (i < tokens.length) {
+            const raw = tokens[i];
+            if (raw === undefined)
+                return null;
+            const t = normalizeShellToken(raw);
+            const lower = t.toLowerCase();
+            if (!t.startsWith("-")) {
+                return lower === "push" ? "push" : null;
+            }
+            // --opt=value forms never consume a following token.
+            if (t.startsWith("--") && t.includes("=")) {
+                i++;
+                continue;
+            }
+            // Value-taking globals: -C path, --git-dir /repo, -c name=value, …
+            if (GIT_GLOBAL_VALUE_OPTS.has(t)) {
+                i += 2;
+                continue;
+            }
+            // Glued short forms: -C/path, -cname=value
+            if (t.startsWith("-C") || t.startsWith("-c")) {
+                i++;
+                continue;
+            }
+            // Boolean / other short/long flags without a separate value.
+            i++;
+        }
+        return null;
+    }
+    if (bin === "gh" || bin === "gh.exe") {
+        i++;
+        while (i < tokens.length) {
+            const flagRaw = tokens[i];
+            if (flagRaw === undefined)
+                break;
+            const flag = normalizeShellToken(flagRaw);
+            if (!flag.startsWith("-"))
+                break;
+            i++;
+        }
+        const pr = tokens[i];
+        const merge = tokens[i + 1];
+        if (pr !== undefined &&
+            merge !== undefined &&
+            normalizeShellToken(pr).toLowerCase() === "pr" &&
+            normalizeShellToken(merge).toLowerCase() === "merge") {
+            return "merge";
+        }
+        return null;
+    }
+    return null;
+}
+/**
+ * List all classifiable push/merge ops in a shell command (#2711).
+ * Scans every list/pipeline/newline segment so compound commands like
+ * `gh pr merge 1 && git push` surface both ops (dispatcher evaluates each).
+ * Newlines are delimiters so multi-line scripts cannot hide a later push/merge.
+ */
+export function listShellOps(command) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return [];
+    const found = new Set();
+    // Quote-aware split so separators inside quotes are not treated as list ops.
+    for (const raw of splitShellSegments(cmd)) {
+        const op = classifyShellSegment(raw);
+        if (op !== null)
+            found.add(op);
+    }
+    const out = [];
+    // Stable order for deterministic multi-op evaluation.
+    if (found.has("push"))
+        out.push("push");
+    if (found.has("merge"))
+        out.push("merge");
+    return out;
+}
+/**
+ * Classify a shell command string for push/merge scopes (#2711).
+ * Unclassifiable commands return null (fail open at the gate).
+ * When a compound command has multiple ops, returns the first of listShellOps
+ * (push before merge); prefer listShellOps + evaluate-each for enforcement.
+ *
+ * Patterns (intentionally narrow; prefer false-open over false-deny):
+ * - push: `git push`, `git.exe push`, with optional env / -C / -c prefixes
+ * - merge: `gh pr merge`, `gh.exe pr merge`
+ */
+export function classifyShellCommand(command) {
+    const ops = listShellOps(command);
+    return ops[0] ?? null;
+}
+/**
+ * Classify an MCP (or MCP-like) tool name + optional argument blob for push/merge (#2711).
+ * Returns null when the tool is not a known push/merge mutation (fail open).
+ */
+export function classifyMcpTool(toolName, argsText = null) {
+    const name = toolName.trim().toLowerCase();
+    if (name.length === 0)
+        return null;
+    // Common GitHub MCP / bridge spellings for merge
+    if (/merge[_-]?pull[_-]?request/.test(name) ||
+        /pull[_-]?request[_-]?merge/.test(name) ||
+        /(^|__)merge_pr($|__)/.test(name) ||
+        /pr[_-]?merge/.test(name)) {
+        return "merge";
+    }
+    // Push-like tool names (narrow — prefer fail-open)
+    if (/(^|__)git[_-]?push($|__)/.test(name) || /push[_-]?branch/.test(name)) {
+        return "push";
+    }
+    if (/push/.test(name) && /(git|branch|remote|ref)/.test(name))
+        return "push";
+    const blob = (argsText ?? "").toLowerCase();
+    if (blob.length > 0) {
+        if (/\bgit(?:\.exe)?\s+push\b/.test(blob))
+            return "push";
+        if (/\bgh(?:\.exe)?\s+pr\s+merge\b/.test(blob))
+            return "merge";
+    }
+    return null;
+}
+/**
+ * Evaluate scopes.push / scopes.merge for a classifiable shell/MCP operation (#2711).
+ * null op → allow (unclassifiable fail-open). disabled policy → allow.
+ */
+export function evaluateRuntimeAuthorityShellOp(input) {
+    const { policy, op } = input;
+    if (!policy.enabled) {
+        return { allowed: true, reason: null, code: null, unclassifiable: op === null };
+    }
+    if (op === null) {
+        return { allowed: true, reason: null, code: null, unclassifiable: true };
+    }
+    if (op === "push" && !policy.scopes.push) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            unclassifiable: false,
+            reason: "Directive denied this shell/MCP operation: plan.policy.runtimeAuthority.scopes.push is false. " +
+                "Grant the push scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    if (op === "merge" && !policy.scopes.merge) {
+        return {
+            allowed: false,
+            code: "runtime-policy-deny-scope",
+            unclassifiable: false,
+            reason: "Directive denied this shell/MCP operation: plan.policy.runtimeAuthority.scopes.merge is false. " +
+                "Grant the merge scope in PROJECT-DEFINITION or disable runtimeAuthority.",
+        };
+    }
+    return { allowed: true, reason: null, code: null, unclassifiable: false };
+}
 //# sourceMappingURL=runtime-authority.js.map

package/dist/policy/write-fence.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Unified path write fence (#516 / #2443 / #2948 Wave 3).
+ *
+ * Single evaluation SoT: path checks always go through
+ * `evaluateRuntimeAuthorityPath` / `evaluateRuntimeAuthorityDirectWrite`.
+ * This module only **resolves** a RuntimeAuthorityPolicy by intersecting
+ * project `runtimeAuthority.allowPaths` / `denyPaths` with optional story
+ * `plan.metadata.swarm.file_scope` (and a read-time `writeScope` alias).
+ *
+ * There is no second independent writeScope evaluation engine.
+ */
+import { type RuntimeAuthorityPolicy, type WriteFenceSource } from "./runtime-authority.js";
+/**
+ * Normalize a legacy #2443 `writeScope` alias into `file_scope` + deny globs.
+ * Accepts:
+ * - `string[]` → allow list
+ * - `{ allow?: string[], deny?: string[] }`
+ * - `{ file_scope?: string[], denyPaths?: string[] }` (already-normalized shape)
+ *
+ * Callers MUST feed the result into {@link resolveWriteFence}; do not evaluate
+ * writeScope with a separate matcher.
+ */
+export declare function normalizeStoryWriteScope(raw: unknown): {
+    readonly fileScope: string[];
+    readonly denyPaths: string[];
+};
+/**
+ * Extract story write fence from an xBRIEF/vBRIEF document.
+ * Prefer `plan.metadata.swarm.file_scope`; fall back to normalized `writeScope`
+ * on `plan.metadata.swarm` or `plan.metadata` (read-time alias only).
+ */
+export declare function extractStoryFileScope(storyData: unknown): {
+    readonly fileScope: string[];
+    readonly denyPaths: string[];
+};
+/** Load story fence from an active xBRIEF path (fail-open on IO/parse errors). */
+export declare function loadStoryWriteFenceFromPath(scopePath: string | null | undefined): {
+    readonly fileScope: string[];
+    readonly denyPaths: string[];
+};
+export interface ResolveWriteFenceOptions {
+    /** Extra deny globs from normalized writeScope.deny (merged; deny always wins). */
+    readonly storyDenyPaths?: readonly string[] | null;
+}
+export interface ResolvedWriteFence {
+    /**
+     * Policy for `evaluateRuntimeAuthorityPath` / `evaluateRuntimeAuthorityDirectWrite`.
+     * This is the only evaluation shape — no parallel engine.
+     */
+    readonly policy: RuntimeAuthorityPolicy;
+    /** Layers that contribute to this fence (empty when inactive). */
+    readonly sources: readonly WriteFenceSource[];
+    /** True when project and/or story path fence is active. */
+    readonly fenceActive: boolean;
+    readonly storyAllowPaths: readonly string[];
+    readonly storyDenyPaths: readonly string[];
+}
+/**
+ * Intersect project `runtimeAuthority` with optional story `file_scope`.
+ *
+ * Rules:
+ * - Empty project `allowPaths` when enabled = all paths until story narrows.
+ * - Empty story scope = project policy only.
+ * - Story `file_scope` alone enables a fence even when project policy is disabled.
+ * - `denyPaths` always win (project + story-normalized denys).
+ * - When both project allowPaths and story file_scope are non-empty, a path must
+ *   match **both** layers (AND / intersection semantics via dual allow layers).
+ */
+export declare function resolveWriteFence(projectPolicy: RuntimeAuthorityPolicy, storyFileScope?: readonly string[] | null, options?: ResolveWriteFenceOptions): ResolvedWriteFence;
+/**
+ * Resolve the write fence for PreToolUse / product sinks.
+ * Composes project policy with story fence extracted from an active xBRIEF path.
+ */
+export declare function resolveWriteFenceForScope(projectPolicy: RuntimeAuthorityPolicy, scopePath: string | null | undefined, loadStory?: (path: string | null | undefined) => {
+    fileScope: readonly string[];
+    denyPaths: readonly string[];
+}): ResolvedWriteFence;
+//# sourceMappingURL=write-fence.d.ts.map

package/dist/policy/write-fence.js

@@ -0,0 +1,164 @@
+/**
+ * Unified path write fence (#516 / #2443 / #2948 Wave 3).
+ *
+ * Single evaluation SoT: path checks always go through
+ * `evaluateRuntimeAuthorityPath` / `evaluateRuntimeAuthorityDirectWrite`.
+ * This module only **resolves** a RuntimeAuthorityPolicy by intersecting
+ * project `runtimeAuthority.allowPaths` / `denyPaths` with optional story
+ * `plan.metadata.swarm.file_scope` (and a read-time `writeScope` alias).
+ *
+ * There is no second independent writeScope evaluation engine.
+ */
+import { readFileSync } from "node:fs";
+import { DEFAULT_RUNTIME_AUTHORITY_POLICY, DEFAULT_RUNTIME_AUTHORITY_SCOPES, } from "./runtime-authority.js";
+/** Clean non-empty path glob strings. */
+function cleanGlobs(raw) {
+    if (raw === null || raw === undefined)
+        return [];
+    return raw.filter((s) => typeof s === "string" && s.trim().length > 0);
+}
+function cleanGlobArray(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.filter((s) => typeof s === "string" && s.trim().length > 0);
+}
+/**
+ * Normalize a legacy #2443 `writeScope` alias into `file_scope` + deny globs.
+ * Accepts:
+ * - `string[]` → allow list
+ * - `{ allow?: string[], deny?: string[] }`
+ * - `{ file_scope?: string[], denyPaths?: string[] }` (already-normalized shape)
+ *
+ * Callers MUST feed the result into {@link resolveWriteFence}; do not evaluate
+ * writeScope with a separate matcher.
+ */
+export function normalizeStoryWriteScope(raw) {
+    if (raw === null || raw === undefined) {
+        return { fileScope: [], denyPaths: [] };
+    }
+    if (Array.isArray(raw)) {
+        return { fileScope: cleanGlobArray(raw), denyPaths: [] };
+    }
+    if (typeof raw !== "object") {
+        return { fileScope: [], denyPaths: [] };
+    }
+    const rec = raw;
+    const allow = cleanGlobArray(rec.allow ?? rec.file_scope ?? rec.fileScope);
+    const deny = cleanGlobArray(rec.deny ?? rec.denyPaths);
+    return { fileScope: allow, denyPaths: deny };
+}
+/**
+ * Extract story write fence from an xBRIEF/vBRIEF document.
+ * Prefer `plan.metadata.swarm.file_scope`; fall back to normalized `writeScope`
+ * on `plan.metadata.swarm` or `plan.metadata` (read-time alias only).
+ */
+export function extractStoryFileScope(storyData) {
+    if (typeof storyData !== "object" || storyData === null || Array.isArray(storyData)) {
+        return { fileScope: [], denyPaths: [] };
+    }
+    const plan = storyData.plan;
+    if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
+        return { fileScope: [], denyPaths: [] };
+    }
+    const metadata = plan.metadata;
+    if (typeof metadata !== "object" || metadata === null || Array.isArray(metadata)) {
+        return { fileScope: [], denyPaths: [] };
+    }
+    const meta = metadata;
+    const swarmRaw = meta.swarm;
+    const swarm = typeof swarmRaw === "object" && swarmRaw !== null && !Array.isArray(swarmRaw)
+        ? swarmRaw
+        : null;
+    const fromFileScope = cleanGlobArray(swarm?.file_scope ?? swarm?.fileScope);
+    const fromWriteScope = normalizeStoryWriteScope(swarm?.writeScope ?? swarm?.write_scope ?? meta.writeScope ?? meta.write_scope);
+    // file_scope is SoT when present; writeScope alias only when file_scope empty.
+    if (fromFileScope.length > 0) {
+        // Still merge writeScope.deny so legacy deny lists are not lost.
+        return {
+            fileScope: fromFileScope,
+            denyPaths: fromWriteScope.denyPaths,
+        };
+    }
+    return fromWriteScope;
+}
+/** Load story fence from an active xBRIEF path (fail-open on IO/parse errors). */
+export function loadStoryWriteFenceFromPath(scopePath) {
+    if (scopePath === null || scopePath === undefined || scopePath.trim().length === 0) {
+        return { fileScope: [], denyPaths: [] };
+    }
+    try {
+        const text = readFileSync(scopePath, "utf8");
+        const data = JSON.parse(text);
+        return extractStoryFileScope(data);
+    }
+    catch {
+        // Residual: host/session may not surface a readable active story.
+        // Fail open at story layer (project policy still applies if enabled).
+        return { fileScope: [], denyPaths: [] };
+    }
+}
+/**
+ * Intersect project `runtimeAuthority` with optional story `file_scope`.
+ *
+ * Rules:
+ * - Empty project `allowPaths` when enabled = all paths until story narrows.
+ * - Empty story scope = project policy only.
+ * - Story `file_scope` alone enables a fence even when project policy is disabled.
+ * - `denyPaths` always win (project + story-normalized denys).
+ * - When both project allowPaths and story file_scope are non-empty, a path must
+ *   match **both** layers (AND / intersection semantics via dual allow layers).
+ */
+export function resolveWriteFence(projectPolicy, storyFileScope, options) {
+    const storyAllow = cleanGlobs(storyFileScope);
+    const storyDeny = cleanGlobs(options?.storyDenyPaths);
+    const projectActive = projectPolicy.enabled;
+    const storyActive = storyAllow.length > 0 || storyDeny.length > 0;
+    if (!projectActive && !storyActive) {
+        return {
+            policy: DEFAULT_RUNTIME_AUTHORITY_POLICY,
+            sources: [],
+            fenceActive: false,
+            storyAllowPaths: [],
+            storyDenyPaths: [],
+        };
+    }
+    const sources = [];
+    if (projectActive)
+        sources.push("project");
+    if (storyActive)
+        sources.push("story");
+    // Project denyPaths + story denyPaths; deny always wins at evaluation time.
+    const denyPaths = [...projectPolicy.denyPaths, ...storyDeny];
+    // Project allow layer only when project policy is enabled (empty = unrestricted until story).
+    const allowPaths = projectActive ? [...projectPolicy.allowPaths] : [];
+    // Story-only: enable fence with default scopes (edits true) so direct writes are gated.
+    const scopes = projectActive
+        ? projectPolicy.scopes
+        : { ...DEFAULT_RUNTIME_AUTHORITY_SCOPES, edits: true };
+    const policy = {
+        enabled: true,
+        allowPaths,
+        denyPaths,
+        scopes,
+        storyAllowPaths: storyAllow,
+        fenceSources: sources,
+    };
+    return {
+        policy,
+        sources,
+        fenceActive: true,
+        storyAllowPaths: storyAllow,
+        storyDenyPaths: storyDeny,
+    };
+}
+/**
+ * Resolve the write fence for PreToolUse / product sinks.
+ * Composes project policy with story fence extracted from an active xBRIEF path.
+ */
+export function resolveWriteFenceForScope(projectPolicy, scopePath, loadStory = loadStoryWriteFenceFromPath) {
+    const story = loadStory(scopePath);
+    return resolveWriteFence(projectPolicy, story.fileScope, {
+        storyDenyPaths: story.denyPaths,
+    });
+}
+//# sourceMappingURL=write-fence.js.map

package/dist/pr-wait-mergeable/cascade.d.ts

@@ -1,3 +1,4 @@
+import { type AgentMergeEvaluateResult } from "../policy/require-human-merge.js";
 import { type SemanticGreenFn } from "./semantic-green.js";
 import type { MergeFn, MonitorFn, ProtectedCheckFn, WaitMergeableResult } from "./types.js";
 export interface WaitMergeableOptions {
@@ -11,6 +12,15 @@ export interface WaitMergeableOptions {
     readonly requireMasterCiGreen?: boolean;
     /** Target branch override for stale-base comparison (defaults to PR base.ref). */
     readonly baseBranch?: string | null;
+    /**
+     * Project root for human-merge + intent-ceiling preflight (#1193).
+     * Defaults to process.cwd(). Pass explicitly in tests.
+     */
+    readonly projectRoot?: string;
+    /** Inject agent-merge evaluator (unit tests). */
+    readonly agentMergeFn?: (projectRoot: string) => AgentMergeEvaluateResult;
+    /** When true, skip human-merge / intent preflight (tests only). */
+    readonly skipHumanMergeGate?: boolean;
 }
 /** Run protected-check -> wait -> merge cascade (#1369). */
 export declare function waitMergeableAndMerge(prNumber: number, repo: string, options: {

package/dist/pr-wait-mergeable/cascade.js

@@ -1,3 +1,5 @@
+import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
+import { evaluateAgentMerge, } from "../policy/require-human-merge.js";
 import { classifyMonitorOutcome, parseMonitorPayload } from "./classify.js";
 import { EXIT_CONFIG_ERROR, EXIT_MERGED, EXIT_TIMEOUT_OR_ESCALATION } from "./constants.js";
 import { makeResult } from "./result.js";
@@ -17,6 +19,32 @@ export function waitMergeableAndMerge(prNumber, repo, options) {
     const mergeFn = options.mergeFn ?? runGhMerge;
     const semanticGreenFn = options.semanticGreenFn ?? evaluateSemanticGreen;
     const protectedIssues = options.protected;
+    const projectRoot = options.projectRoot ?? process.cwd();
+    // #1193 surface (1): refuse agent merge when requireHumanMerge is true,
+    // and refuse when slash-command intent ceiling does not authorize merge.
+    if (options.skipHumanMergeGate !== true) {
+        const intent = evaluateIntentCeilingFromEnv("merge");
+        if (!intent.allowed) {
+            return makeResult({
+                prNumber,
+                repo,
+                outcome: "config-error",
+                exitCode: EXIT_CONFIG_ERROR,
+                error: intent.reason,
+            });
+        }
+        const agentMergeFn = options.agentMergeFn ?? evaluateAgentMerge;
+        const hm = agentMergeFn(projectRoot);
+        if (!hm.allowed) {
+            return makeResult({
+                prNumber,
+                repo,
+                outcome: "config-error",
+                exitCode: EXIT_CONFIG_ERROR,
+                error: hm.message,
+            });
+        }
+    }
     let protectedCheckPayload = {};
     if (protectedIssues.length > 0) {
         const [prcRc, prcStdout, prcStderr] = protectedFn(prNumber, repo, protectedIssues);

package/dist/preflight/evaluate.js

@@ -1,5 +1,6 @@
 import { readFileSync, statSync } from "node:fs";
 import { basename, dirname } from "node:path";
+import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 /** Canonical eligibility folder — only vbrief/active/ may spawn implementation. */
 export const ACTIVE_FOLDER = "active";
 /** Canonical eligibility status — only `running` signals an active handoff. */
@@ -124,6 +125,15 @@ export function evaluate(vbriefPath) {
             message: buildReject(path, `plan.status is '${status}' -- only '${ELIGIBLE_STATUS}' is eligible for implementation.`),
         };
     }
+    // Slash-command intent containment (#1193 / extends #810): non-implement session
+    // verbs must not authorize implementation preflight even when the xBRIEF is active.
+    const intent = evaluateIntentCeilingFromEnv("implement");
+    if (!intent.allowed) {
+        return {
+            exitCode: 1,
+            message: buildReject(path, intent.reason),
+        };
+    }
     return {
         exitCode: 0,
         message: `OK ${path} -- ready for implementation.`,