@deftai/directive-core 0.89.0 → 0.91.0

package/dist/doctor/types.d.ts

@@ -75,6 +75,10 @@ export interface DoctorFlags {
     readonly network: boolean;
     readonly help: boolean;
     readonly projectRoot: string | null;
+    /** Replace divergent OpenClaw pin dirs during doctor --fix (#3001). */
+    readonly force: boolean;
+    /** Wire always-pins into main + every workspace-* seat (#3001). */
+    readonly openclawAllAgents: boolean;
     readonly unknown: readonly string[];
 }
 export interface ThrottleDecision {
@@ -161,5 +165,12 @@ export interface DoctorSeams {
         readonly distance: "current" | "behind-minor" | "behind-major";
         readonly stale: boolean;
     };
+    /**
+     * OpenClaw skill-pin seams (#3001). Injected so detect/fix stays offline +
+     * deterministic in tests (fake HOME / env / fs).
+     */
+    readonly openclawEnv?: NodeJS.ProcessEnv;
+    readonly openclawHomeDir?: () => string;
+    readonly openclawContentRootFor?: (frameworkRoot: string) => string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/eval/health.d.ts

@@ -40,7 +40,16 @@ export interface EvaluateHealthResult {
 }
 /** Absolute path to the versioned health history ledger (#2545). */
 export declare function healthHistoryPath(projectRoot: string): string | null;
-/** Detect the canonical wipCap unsatisfiable-nudge contradiction (#1694). */
+/**
+ * Residual regression detector for the #1694 wipCap unsatisfiable-nudge.
+ *
+ * Pre-fix: classify treated absent `plan.policy.wipCap` as incomplete while
+ * omit-by-design (#1186 D1) made materializing the default a self-check trap.
+ * The fix records decision-provenance out-of-band (`x-directive/onboarding`),
+ * so greenfield "missing wipCap decision" is satisfiable without materializing
+ * the value field. This detector now only fires if a decision marker is set
+ * but classify still lists wipCap as missing (classifier regression).
+ */
 export declare function detectWipCapUnsatisfiableNudge(projectRoot: string): ContradictionEvidence | null;
 /** Run all registered contradictory-gate detectors. */
 export declare function detectContradictoryGates(projectRoot: string): ContradictionEvidence[];

package/dist/eval/health.js

@@ -6,7 +6,6 @@ import { readCorePackageVersion } from "../engine-version.js";
 import { containedWrite } from "../fs/contained-write.js";
 import { resolveProjectDefinitionPath } from "../layout/resolve.js";
 import { healthMetricsHistoryPath } from "../metrics/resolve-metrics-home.js";
-import { readPlanPolicy } from "../policy/plan-extensions.js";
 import { classifyOnboarding, detectPriorState } from "../triage/welcome/prior-state.js";
 import { validateLinks } from "../validate-content/index.js";
 import { evaluateConformance } from "../vbrief-validate/conformance.js";
@@ -106,26 +105,27 @@ function probeContentManifest(projectRoot) {
 export function healthHistoryPath(projectRoot) {
     return healthMetricsHistoryPath(projectRoot);
 }
-/** Detect the canonical wipCap unsatisfiable-nudge contradiction (#1694). */
+/**
+ * Residual regression detector for the #1694 wipCap unsatisfiable-nudge.
+ *
+ * Pre-fix: classify treated absent `plan.policy.wipCap` as incomplete while
+ * omit-by-design (#1186 D1) made materializing the default a self-check trap.
+ * The fix records decision-provenance out-of-band (`x-directive/onboarding`),
+ * so greenfield "missing wipCap decision" is satisfiable without materializing
+ * the value field. This detector now only fires if a decision marker is set
+ * but classify still lists wipCap as missing (classifier regression).
+ */
 export function detectWipCapUnsatisfiableNudge(projectRoot) {
     const loaded = loadPlan(projectRoot);
     if (loaded === null) {
         return null;
     }
-    const { plan, filepath } = loaded;
-    const policy = readPlanPolicy(plan);
-    const wipCapPresent = typeof policy === "object" &&
-        policy !== null &&
-        !Array.isArray(policy) &&
-        "wipCap" in policy;
-    if (wipCapPresent) {
-        return null;
-    }
     const state = detectPriorState(projectRoot);
     const [, missing] = classifyOnboarding(state);
-    if (!missing.includes("wipCap")) {
+    if (!(state.wipCapDecided && missing.includes("wipCap"))) {
         return null;
     }
+    const { plan, filepath } = loaded;
     const validatorErrors = validateWipCapOnPlan(plan, filepath);
     if (validatorErrors.length > 0) {
         return null;
@@ -133,11 +133,11 @@ export function detectWipCapUnsatisfiableNudge(projectRoot) {
     return {
         id: "wipCap-unsatisfiable-nudge",
         kind: "unsatisfiable-nudge",
-        summary: "Onboarding completeness treats absent plan.policy.wipCap as incomplete, but omit-by-design accepts absence as valid (#1694 / #1186 D1).",
+        summary: "wipCap decision marker is set but classifyOnboarding still lists wipCap as missing (#1694 regression).",
         signals: [
-            "classifyOnboarding: wipCap listed in missing onboarding signals",
-            "validateWipCapOnPlan: omitted wipCap is valid",
-            "triage:welcome --onboard nudge cannot clear without violating omit-by-design contract",
+            "x-directive/onboarding.wipCapDecided: true",
+            "classifyOnboarding: wipCap still in missing onboarding signals",
+            "decision-provenance and completeness classifier are out of sync",
         ],
     };
 }

package/dist/hooks/dispatcher.js

@@ -7,9 +7,10 @@ import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRE
 import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
 import { loadStoryWriteFenceFromPath, resolveWriteFence } from "../policy/write-fence.js";
 import { detectBranch } from "../session/git.js";
+import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js";
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
 import { runSessionStartHookWrite } from "../session/session-start-hook.js";
-import { inspectSessionRitual } from "../session/verify-session-ritual.js";
+import { formatRitualRecoveryInstruction, inspectSessionRitual, } from "../session/verify-session-ritual.js";
 import { hookMcpArgsText, hookShellCommand, hookToolName, hookWriteTargetPath, missingToolNameMessage, record, } from "./classify/index.js";
 import { isExploreSpawn, isReadOnlyHookContext } from "./readonly.js";
 import { inspectActiveScope } from "./scope.js";
@@ -452,13 +453,27 @@ function inspectMutationGates(input, toolName, seams, options) {
             ((root) => inspectSessionRitual(root, { tier: "gated", posture: "mutation" })))(projectRoot);
     }
     catch (cause) {
+        // #2994: best-effort local process-cost; never changes deny verdict.
+        emitSessionRitualBlockedProcessCost({
+            toolName,
+            code: "ritual-not-ready",
+            recoveryTier: "cold",
+            detail: `inspect threw: ${String(cause)}`,
+        }, { projectRoot });
         return deny(input, "ritual-not-ready", toolName, `Directive could not inspect the gated session ritual: ${String(cause)}. ` +
-            "Run `deft session:start`, then `deft verify:session-ritual -- --tier=gated`.");
+            formatRitualRecoveryInstruction("cold"));
     }
     if (ritual.code !== 0) {
-        return deny(input, "ritual-not-ready", toolName, `Directive denied ${toolName}: ${ritual.message} ` +
-            "Recovery: run `deft session:start`, then " +
-            "`deft verify:session-ritual -- --tier=gated`.");
+        // #2992: prefer re-arm recovery when age/compact stale; cold when bind invalid.
+        const recoveryTier = ritual.recoveryTier === "rearm" ? "rearm" : "cold";
+        // #2994: best-effort local process-cost; never changes deny verdict.
+        emitSessionRitualBlockedProcessCost({
+            toolName,
+            code: "ritual-not-ready",
+            recoveryTier,
+            detail: ritual.message,
+        }, { projectRoot });
+        return deny(input, "ritual-not-ready", toolName, `Directive denied ${toolName}: ${ritual.message} ${formatRitualRecoveryInstruction(recoveryTier)}`);
     }
     if (options.proposedLifecycleExempt) {
         const writeTarget = hookWriteTargetPath(input.payload);

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export * as session from "./session/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
+export * as toolEvents from "./tool-events/index.js";
 export * as triage from "./triage/index.js";
 export * as userConfig from "./user-config/index.js";
 export * as validateContent from "./validate-content/index.js";

package/dist/index.js

@@ -54,6 +54,7 @@ export * as session from "./session/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
+export * as toolEvents from "./tool-events/index.js";
 export * as triage from "./triage/index.js";
 export * as userConfig from "./user-config/index.js";
 export * as validateContent from "./validate-content/index.js";

package/dist/init-deposit/hygiene.js

@@ -45,6 +45,9 @@ export function installerManagedMatchers() {
         // `deft update` framework-deposit PR trips no-mixed-core-and-app (#2277).
         { exact: "xbrief/.deft-version" },
         { exact: "xbrief/xbrief.md" },
+        // Minimal render-ready seed from init (#3013); operator may later edit identity.
+        { exact: "xbrief/PROJECT-DEFINITION.xbrief.json" },
+        { exact: "vbrief/PROJECT-DEFINITION.vbrief.json" },
         { prefix: "xbrief/schemas/" },
         { prefix: "xbrief/migration/" },
         ...VBRIEF_LIFECYCLE_DIRS.map((sub) => ({ exact: `xbrief/${sub}/.gitkeep` })),

package/dist/init-deposit/init-deposit.d.ts

@@ -34,6 +34,11 @@ export declare function userConfigDir(): string;
 export declare function createUserConfigDir(io: InitDepositIo): string;
 export declare function buildInstallSummaryJson(result: InitDepositResult, options: InitDepositArgs): Record<string, unknown>;
 export declare function printNextSteps(result: InitDepositResult, io: InitDepositIo): void;
+/**
+ * Ensure a minimal render-ready PROJECT-DEFINITION exists after lifecycle dirs
+ * are deposited (#3013 / epic #3009). Idempotent: never overwrites existing identity.
+ */
+export declare function seedMinimalProjectDefinition(projectDir: string, io: InitDepositIo): boolean;
 export declare function runInitDeposit(args: InitDepositArgs, io: InitDepositIo, seams?: InitDepositSeams): Promise<InitDepositResult>;
 export interface RunInitDepositCliOptions extends InitDepositArgs {
     readonly writeOut: (text: string) => void;

package/dist/init-deposit/init-deposit.js

@@ -7,12 +7,14 @@
  */
 import { existsSync, mkdirSync, readFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
-import { join, resolve } from "node:path";
+import { basename, join, resolve } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
 import { copyTree } from "../deposit/copy-tree.js";
 import { prunePythonArtifactsFromDeposit } from "../deposit/python-free.js";
 import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { readCorePackageVersion } from "../engine-version.js";
+import { renderProjectDefinition } from "../render/project-render.js";
+import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
 import { ensureInitGitignoreLines, reconstituteDepositFromContent } from "./gitignore.js";
 import { depositStagePaths, printCommitGuidance } from "./hygiene.js";
@@ -20,6 +22,7 @@ import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout,
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
 import { ensurePrettierIgnoreLines } from "./prettierignore.js";
 import { CANONICAL_INSTALL_ROOT, depositNeutralization, ensureTaskfile, writeAgentsMd, writeAgentsSkills, writeConsumerGitHooks, writeConsumerVbrief, writeInstallManifest, } from "./scaffold.js";
+import { syncBareVersionMarker } from "./xbrief-projections.js";
 export function parseInitArgv(canonicalArgv, userArgv = []) {
     const args = [...canonicalArgv, ...userArgv];
     let projectDir = process.cwd();
@@ -113,10 +116,36 @@ export function printNextSteps(result, io) {
     io.printf(`  1. Open your AI coding assistant in ${result.projectDir}\n`);
     io.printf("  2. Deft skill auto-discovery is partially implemented — if your agent doesn't\n");
     io.printf('     start setup automatically, tell it: "Use AGENTS.md"\n');
-    io.printf("  3. On first session, the agent will guide you through creating USER.md and PROJECT-DEFINITION.vbrief.json\n");
+    io.printf("  3. On first session, the agent will guide you through USER.md (if missing).\n");
+    io.printf("  4. PROJECT-DEFINITION is seeded at init (#3013) — run `task project:render` once to refresh items from lifecycle folders; do not multi-turn invent project identity.\n");
     printMigrateNudgeIfNeeded(result.projectDir, io);
     io.printf("\n");
 }
+/**
+ * Ensure a minimal render-ready PROJECT-DEFINITION exists after lifecycle dirs
+ * are deposited (#3013 / epic #3009). Idempotent: never overwrites existing identity.
+ */
+export function seedMinimalProjectDefinition(projectDir, io) {
+    const xbriefDir = join(projectDir, "xbrief");
+    const legacyDir = join(projectDir, "vbrief");
+    const root = existsSync(xbriefDir) ? xbriefDir : existsSync(legacyDir) ? legacyDir : null;
+    if (root === null) {
+        return false;
+    }
+    const isXbrief = basename(root) === "xbrief";
+    const projectDefPath = join(root, isXbrief ? "PROJECT-DEFINITION.xbrief.json" : "PROJECT-DEFINITION.vbrief.json");
+    if (existsSync(projectDefPath)) {
+        io.printf("PROJECT-DEFINITION already present — leaving identity intact (#3013).\n");
+        return false;
+    }
+    const [ok, message] = renderProjectDefinition(root);
+    if (ok) {
+        io.printf(`${message} (minimal seed for one-shot project:render; #3013)\n`);
+        return true;
+    }
+    io.printf(`PROJECT-DEFINITION seed skipped: ${message}\n`);
+    return false;
+}
 export async function runInitDeposit(args, io, seams = {}) {
     const projectDir = args.projectDir;
     const deftDir = join(projectDir, CANONICAL_INSTALL_ROOT);
@@ -154,6 +183,12 @@ export async function runInitDeposit(args, io, seams = {}) {
     const skillsCreated = writeAgentsSkills(projectDir, io);
     await depositNeutralization(projectDir, io);
     await writeConsumerVbrief(projectDir, deftDir, io);
+    seedMinimalProjectDefinition(projectDir, io);
+    // Seeding PROJECT-DEFINITION.xbrief.json makes resolveLifecycleRoot succeed.
+    // Align the same consumer derivatives update repairs (#2595 / #2806) so
+    // init + git add -A is already clean under core.autocrlf=true (#2118 / #3013).
+    syncBareVersionMarker(projectDir, version);
+    removeStaleMigratedFrameworkNarrative(projectDir);
     writeConsumerGitHooks(projectDir, deftDir, io, seams.gitHooks);
     writeAgentHookDeposit(projectDir, io);
     let taskfileWired = false;

package/dist/intake/github-auth-modes.d.ts

@@ -1,4 +1,4 @@
-import { type CompletedProcess } from "../scm/call.js";
+import type { CompletedProcess } from "../scm/call.js";
 import { probeRuntimeCapabilities, type RuntimeCapabilityReport } from "./platform-capabilities.js";
 export declare const GITHUB_AUTH_MODE_INJECTED_TOKEN = "injected-token";
 export declare const GITHUB_AUTH_MODE_HOST_GH = "host-gh";

package/dist/intake/github-auth-modes.js

@@ -1,4 +1,4 @@
-import { call } from "../scm/call.js";
+import { spawnSync } from "node:child_process";
 import { pyRepr } from "../scm/py-format.js";
 import { getPlatformCapabilities, probeRuntimeCapabilities, RUNTIME_MODE_CLOUD_HEADLESS, RUNTIME_MODE_CURSOR_NATIVE_SANDBOX, } from "./platform-capabilities.js";
 export const GITHUB_AUTH_MODE_INJECTED_TOKEN = "injected-token";
@@ -37,9 +37,31 @@ export function inferGithubAuthMode(runtimeReport) {
     }
     return GITHUB_AUTH_MODE_HOST_GH;
 }
+/**
+ * Prefer live `gh` for auth/API validation. Do not route through scm.call /
+ * BINARY_PREFERENCE (ghx-first): ghx is a cached GET proxy and rejects multi-arg
+ * `api user --jq .login` forms used here (#2275 Greptile P1 / #954).
+ */
 function defaultRunGh(args, environ) {
-    const verb = args[0];
-    return call("github-issue", verb, args.slice(1), { env: environ, timeout: 30 });
+    const binary = "gh";
+    try {
+        const result = spawnSync(binary, [...args], {
+            env: environ,
+            encoding: "utf8",
+            timeout: 30_000,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return {
+            args: [binary, ...args],
+            returncode: result.status ?? 1,
+            stdout: typeof result.stdout === "string" ? result.stdout : "",
+            stderr: typeof result.stderr === "string" ? result.stderr : "",
+        };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { args: [binary, ...args], returncode: 1, stdout: "", stderr: message };
+    }
 }
 function splitRepo(repo) {
     const idx = repo.indexOf("/");

package/dist/intake/issue-ingest-cli.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { fileURLToPath } from "node:url";
+import { ScmStubError } from "../scm/errors.js";
+import { requireScmReady } from "../scm/readiness.js";
 import { issueIngestMain } from "./issue-ingest.js";
 function parseArgs(argv) {
     const out = {};
@@ -25,6 +27,17 @@ function parseArgs(argv) {
     return out;
 }
 export function mainEntry(argv = process.argv.slice(2)) {
+    // #2275: fail loud when gh/auth is missing in this execution env.
+    try {
+        requireScmReady();
+    }
+    catch (err) {
+        if (err instanceof ScmStubError) {
+            process.stderr.write(`error: ${err.message}\n`);
+            return 2;
+        }
+        throw err;
+    }
     return issueIngestMain(parseArgs(argv));
 }
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {

package/dist/intake/reconcile-issues-cli.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import { fileURLToPath } from "node:url";
+import { ScmStubError } from "../scm/errors.js";
+import { requireScmReady } from "../scm/readiness.js";
 import { reconcileMain } from "./reconcile-issues.js";
 function parseArgs(argv) {
     const out = {};
@@ -23,6 +25,17 @@ function parseArgs(argv) {
     return out;
 }
 export function mainEntry(argv = process.argv.slice(2)) {
+    // #2275: fail loud when gh/auth is missing in this execution env.
+    try {
+        requireScmReady();
+    }
+    catch (err) {
+        if (err instanceof ScmStubError) {
+            process.stderr.write(`error: ${err.message}\n`);
+            return 2;
+        }
+        throw err;
+    }
     return reconcileMain(parseArgs(argv));
 }
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {

package/dist/lifecycle/events.js

@@ -6,11 +6,13 @@ import { contentRoot } from "../content-root.js";
 import { ATTRIBUTION_REQUIRED_PAYLOAD } from "../events/attribution-constants.js";
 import { containedWrite } from "../fs/contained-write.js";
 import { ProjectionContainmentError } from "../fs/projection-containment.js";
+import { PROCESS_COST_REQUIRED_PAYLOAD } from "../session/process-cost-constants.js";
 /** Default event log location (project-local). */
 export const DEFAULT_EVENT_LOG = join(".deft-cache", "events.jsonl");
 const BEHAVIORAL_CATEGORY = "behavioral";
 const REQUIRED_BEHAVIORAL_PAYLOAD = {
     ...ATTRIBUTION_REQUIRED_PAYLOAD,
+    ...PROCESS_COST_REQUIRED_PAYLOAD,
     "session:interrupted": ["session_id", "reason"],
     "session:resumed": ["session_id", "interrupted_id"],
     "plan:approved": ["plan_ref", "approver"],

package/dist/lifecycle/index.d.ts

@@ -2,4 +2,5 @@ export * from "./event.js";
 export * as eventDetect from "./event-detect.js";
 export * as events from "./events.js";
 export * as lifecycleHygiene from "./lifecycle-hygiene.js";
+export * from "./stats.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/lifecycle/index.js

@@ -2,4 +2,5 @@ export * from "./event.js";
 export * as eventDetect from "./event-detect.js";
 export * as events from "./events.js";
 export * as lifecycleHygiene from "./lifecycle-hygiene.js";
+export * from "./stats.js";
 //# sourceMappingURL=index.js.map

package/dist/lifecycle/stats.d.ts

@@ -0,0 +1,53 @@
+import { parseDurationMs } from "../triage/scope/duration.js";
+/** Lifecycle folders scanned for stats. */
+export declare const STATS_LIFECYCLE_FOLDERS: readonly ["proposed", "pending", "active", "completed", "cancelled"];
+export type StatsLifecycleFolder = (typeof STATS_LIFECYCLE_FOLDERS)[number];
+/** Count semantics for WWYSYDH / process forms (stable strings for --json). */
+export declare const LIFECYCLE_STATS_SEMANTICS: {
+    readonly promoted: string;
+    readonly activated: string;
+    readonly completed: string;
+    readonly cancelled_or_failed: string;
+    readonly still_active: "snapshot count of all xbriefs currently in active/ (not filtered by --since).";
+    readonly event_time: string;
+    readonly note: string;
+};
+export interface LifecycleFolderTotals {
+    readonly proposed: number;
+    readonly pending: number;
+    readonly active: number;
+    readonly completed: number;
+    readonly cancelled: number;
+}
+export interface LifecycleStats {
+    readonly since: string;
+    readonly since_ms: number;
+    readonly as_of: string;
+    readonly window_start: string;
+    readonly project_root: string;
+    readonly lifecycle_root: string;
+    readonly promoted: number;
+    readonly activated: number;
+    readonly completed: number;
+    readonly cancelled_or_failed: number;
+    readonly still_active: number;
+    readonly folder_totals: LifecycleFolderTotals;
+    readonly semantics: typeof LIFECYCLE_STATS_SEMANTICS;
+}
+export interface CollectLifecycleStatsOptions {
+    readonly projectRoot: string;
+    /** Window duration string, e.g. "7d", "24h", "1w". Default "7d". */
+    readonly since?: string;
+    /** Clock for window end (tests inject a fixed Date). */
+    readonly now?: Date;
+}
+/**
+ * Collect lifecycle folder stats for a project root.
+ * Offline / filesystem only.
+ */
+export declare function collectLifecycleStats(options: CollectLifecycleStatsOptions): LifecycleStats;
+/** Format human-readable lifecycle stats text. */
+export declare function formatLifecycleStatsText(stats: LifecycleStats): string;
+/** Re-export duration parse for CLI error messaging. */
+export { parseDurationMs };
+//# sourceMappingURL=stats.d.ts.map