@deftai/directive-core 0.91.0 → 0.93.0

package/dist/cache/fetch.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { ContainedWriteError, containedWrite } from "../fs/contained-write.js";
 import { GhRestError, InvalidRepoError, restIssueView, runGhApi, } from "../scm/gh-rest.js";
 import { DEFAULT_BATCH_SIZE, DEFAULT_DELAY_MS } from "./constants.js";
@@ -45,7 +45,8 @@ export function writeOpenInventoryStamp(options) {
         fetched_at: utcIso(clock, fetchedAt),
         open_count: 0,
     };
-    atomicWriteText(openInventoryStampPath(options.cacheRoot, options.source, options.repo), `${JSON.stringify(payload)}\n`);
+    // #3042: contain stamp write against project root (parent of cacheRoot).
+    atomicWriteText(openInventoryStampPath(options.cacheRoot, options.source, options.repo), `${JSON.stringify(payload)}\n`, { projectRoot: dirname(resolve(options.cacheRoot)) });
 }
 export const REST_MAX_PER_PAGE = 100;
 export const REST_PAGINATION_MAX_PAGES = 100;

package/dist/cache/io.d.ts

@@ -1,9 +1,20 @@
 import { tmpdir } from "node:os";
+export interface AtomicWriteTextOptions {
+    /**
+     * Project / checkout root used as the containment boundary (#3042).
+     * When set, refuses symlink parents and out-of-root targets before temp+rename.
+     * Prefer always passing this for product sinks (brief stay-path, agents refresh, cache).
+     * When omitted, falls back to parent-dir containment (legacy test / low-risk helpers).
+     */
+    readonly projectRoot?: string;
+}
 /**
  * Write text via tempfile + rename (mirrors Python `_atomic_write_text`).
- * #2951 Phase 2: temp payload write uses containedWrite under the parent dir.
+ * #2951 Phase 2: temp payload write uses containedWrite.
+ * #3042: when `projectRoot` is set, containment root is projectRoot (not dirname(path))
+ * so force-added lifecycle / cache directory symlinks fail closed.
  */
-export declare function atomicWriteText(path: string, text: string): void;
+export declare function atomicWriteText(path: string, text: string, options?: AtomicWriteTextOptions): void;
 /**
  * Append one JSON audit record (mirrors `_append_audit`).
  * #2951 Phase 2: product write sink routes through containedWrite.

package/dist/cache/io.js

@@ -3,24 +3,53 @@ import { mkdirSync, renameSync, rmSync, statSync, utimesSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { pythonJsonLine } from "./json.js";
 /**
  * Write text via tempfile + rename (mirrors Python `_atomic_write_text`).
- * #2951 Phase 2: temp payload write uses containedWrite under the parent dir.
+ * #2951 Phase 2: temp payload write uses containedWrite.
+ * #3042: when `projectRoot` is set, containment root is projectRoot (not dirname(path))
+ * so force-added lifecycle / cache directory symlinks fail closed.
  */
-export function atomicWriteText(path, text) {
-    const dir = dirname(path);
+export function atomicWriteText(path, text, options = {}) {
+    const targetAbs = resolve(path);
+    const dir = dirname(targetAbs);
+    const tmpBase = `${basename(targetAbs)}.${randomBytes(4).toString("hex")}.tmp`;
+    const tmp = join(dir, tmpBase);
+    if (options.projectRoot !== undefined) {
+        // Contain against projectRoot (parent-as-root fix #3042 / authz writeJsonContained pattern).
+        const root = resolve(options.projectRoot);
+        assertWriteTargetSafe(root, targetAbs);
+        try {
+            containedWrite({
+                root,
+                target: tmp,
+                data: text,
+                mode: "create",
+            });
+            renameSync(tmp, targetAbs);
+        }
+        catch (err) {
+            try {
+                rmSync(tmp, { force: true });
+            }
+            catch {
+                /* v8 ignore next -- best-effort cleanup */
+            }
+            throw err;
+        }
+        return;
+    }
+    // Legacy: parent-dir containment when no projectRoot (unit helpers / transitional call sites).
     mkdirSync(dir, { recursive: true });
-    const tmpName = `${basename(path)}.${randomBytes(4).toString("hex")}.tmp`;
-    const tmp = join(dir, tmpName);
     try {
         containedWrite({
             root: resolve(dir),
-            target: tmpName,
+            target: tmpBase,
             data: text,
             mode: "create",
         });
-        renameSync(tmp, path);
+        renameSync(tmp, targetAbs);
     }
     catch (err) {
         try {

package/dist/cache/operations.js

@@ -129,14 +129,16 @@ export function cachePut(source, key, raw, options = {}) {
             incomingBytes: incomingDelta,
         });
     }
-    atomicWriteText(join(edir, "raw.json"), rawText);
+    // #3042: contain cache entry writes against project root (parent of cacheRoot).
+    const projectRoot = dirname(resolve(cacheRoot));
+    atomicWriteText(join(edir, "raw.json"), rawText, { projectRoot });
     const authoritativeSize = fileSize(join(edir, "raw.json"));
     const rendered = renderContent(source, raw);
     const scanResult = scan(rendered, utcIso(clock, fetched));
     const contentPath = join(edir, "content.md");
     let contentWritten = false;
     if (scanResult.passed) {
-        atomicWriteText(contentPath, scanResult.transformed_content);
+        atomicWriteText(contentPath, scanResult.transformed_content, { projectRoot });
         contentWritten = true;
     }
     else if (existsSync(contentPath)) {
@@ -158,7 +160,7 @@ export function cachePut(source, key, raw, options = {}) {
         clock,
     });
     validateMeta(meta);
-    atomicWriteText(join(edir, "meta.json"), pythonJsonDump(meta));
+    atomicWriteText(join(edir, "meta.json"), pythonJsonDump(meta), { projectRoot });
     appendAudit({
         event: "cache:put",
         source,

package/dist/doctor/index.d.ts

@@ -7,6 +7,7 @@ export * from "./json.js";
 export * from "./main.js";
 export * from "./manifest.js";
 export * from "./npm-registry.js";
+export * from "./openclaw-l2-adapter.js";
 export * from "./openclaw-skills.js";
 export * from "./paths.js";
 export * from "./payload-staleness.js";

package/dist/doctor/index.js

@@ -7,6 +7,7 @@ export * from "./json.js";
 export * from "./main.js";
 export * from "./manifest.js";
 export * from "./npm-registry.js";
+export * from "./openclaw-l2-adapter.js";
 export * from "./openclaw-skills.js";
 export * from "./paths.js";
 export * from "./payload-staleness.js";

package/dist/doctor/main.js

@@ -4,6 +4,7 @@ import { VBRIEF_VERSION } from "@deftai/directive-types";
 import { evaluate as evaluateAgentsMdAdvisory } from "../agents-md-advisory/evaluate.js";
 import { contentRoot } from "../content-root.js";
 import { resolveProjectDefinitionPath } from "../layout/resolve.js";
+import { DEFT_DIRECTIVE_DISABLE_FLAG_NAME, DEFT_DIRECTIVE_DISABLE_STATUS, DEFT_DIRECTIVE_DISABLE_TRACKED_WARNING, detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { describeShadowedPlanExtension, detectShadowedPlanExtensions, } from "../policy/plan-extensions.js";
 import { loadProjectDefinition } from "../policy/resolve.js";
@@ -21,6 +22,7 @@ import { formatAllowedFlagsHint, formatUnknownFlagsError, parseDoctorFlags } fro
 import { pythonJsonDump } from "./json.js";
 import { parseInstallRootFromAgentsMd } from "./manifest.js";
 import { runNpmRegistryMirrorCheck } from "./npm-registry.js";
+import { runOpenClawL2AdapterCheck } from "./openclaw-l2-adapter.js";
 import { runOpenClawSkillPinsCheck } from "./openclaw-skills.js";
 import { createPlainSink } from "./output.js";
 import { readTextSafe, resolveFrameworkRootForProject, resolvePath, resolveVersion, runningInsideDeftRepo, } from "./paths.js";
@@ -70,6 +72,42 @@ export function cmdDoctor(args, seams = {}) {
     const consumerContext = resolve(projectRoot) !== resolve(frameworkRoot);
     const whichFn = seams.whichFn ?? defaultWhich;
     const nowFn = seams.now ?? (() => new Date());
+    // #3039: temporary test kill-switch. Active (untracked) → disabled short-circuit.
+    // Tracked/committed flag → warn only and continue normal doctor (no enforcement bypass).
+    const killSwitch = detectDeftDirectiveDisable(projectRoot, { skipTrackedCache: true });
+    if (killSwitch.present &&
+        killSwitch.trackedByGit &&
+        !isDeftDirectiveDisableActive(projectRoot, { skipTrackedCache: true })) {
+        if (!jsonMode && !quietMode) {
+            process.stderr.write(`${DEFT_DIRECTIVE_DISABLE_TRACKED_WARNING}\n`);
+        }
+        // Continue into full doctor; do not short-circuit.
+    }
+    else if (isDeftDirectiveDisableActive(projectRoot, { skipTrackedCache: true })) {
+        const optOutAlso = detectNoDeftDirective(projectRoot);
+        const message = formatDeftDirectiveDisableMessage({
+            permanentOptOutAlsoPresent: optOutAlso.present,
+            trackedByGit: false,
+        });
+        if (jsonMode) {
+            const payload = {
+                status: DEFT_DIRECTIVE_DISABLE_STATUS,
+                disabled: true,
+                disabled_via: DEFT_DIRECTIVE_DISABLE_FLAG_NAME,
+                kill_switch: true,
+                inconsistent: false,
+                deposit_present: killSwitch.depositPresent,
+                tracked_by_git: false,
+                permanent_opt_out_also_present: optOutAlso.present,
+                message,
+            };
+            process.stdout.write(`${pythonJsonDump(payload)}\n`);
+        }
+        else if (!quietMode) {
+            process.stdout.write(`${message}\n`);
+        }
+        return 0;
+    }
     // #2926: official root opt-out — short-circuit Directive doctor when clean;
     // diagnose flag+deposit inconsistency (warn; exit dirty).
     const optOut = detectNoDeftDirective(projectRoot);
@@ -372,6 +410,17 @@ export function cmdDoctor(args, seams = {}) {
     if (!jsonMode) {
         sink.blank();
     }
+    sink.info("Checking OpenClaw L2 product-command skills...");
+    runOpenClawL2AdapterCheck(sink, addFinding, {
+        projectRoot,
+        fixMode,
+        jsonMode,
+        allAgents: flags.openclawAllAgents,
+        seams,
+    });
+    if (!jsonMode) {
+        sink.blank();
+    }
     sink.info("Checking xBRIEF project envelope version...");
     runXbriefEnvelopeVersionCheck(projectRoot, sink, addFinding, seams);
     let resolution = null;

package/dist/doctor/openclaw-l2-adapter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Doctor check + --fix wire for OpenClaw L2 product-command skills (#3064 D5).
+ *
+ * Primary operator recovery path when OpenClaw is detected. Deposits thin
+ * user-invocable router + 13 product skills into workspace skills roots.
+ * Fail-closed when OC signals are absent. Policy opt-out:
+ * `plan.policy.openClawProductCommands: false`.
+ */
+import { type OpenClawL2DepositResult } from "../slash/openclaw-deposit.js";
+import type { OutputSink } from "./output.js";
+import type { DoctorSeams, Finding } from "./types.js";
+/** Stable doctor check id for JSON findings. */
+export declare const OPENCLAW_L2_ADAPTER_CHECK = "openclaw-l2-product-commands";
+export interface RunOpenClawL2AdapterOptions {
+    readonly projectRoot: string;
+    readonly fixMode: boolean;
+    readonly jsonMode: boolean;
+    readonly allAgents: boolean;
+    readonly seams?: DoctorSeams;
+}
+/**
+ * Doctor check: OpenClaw L2 product-command skills present and current.
+ * No-ops when OpenClaw is not detected. Fix mode deposits managed skills.
+ */
+export declare function runOpenClawL2AdapterCheck(sink: OutputSink, addFinding: (finding: Finding) => void, options: RunOpenClawL2AdapterOptions): OpenClawL2DepositResult | null;
+//# sourceMappingURL=openclaw-l2-adapter.d.ts.map

package/dist/doctor/openclaw-l2-adapter.js

@@ -0,0 +1,199 @@
+/**
+ * Doctor check + --fix wire for OpenClaw L2 product-command skills (#3064 D5).
+ *
+ * Primary operator recovery path when OpenClaw is detected. Deposits thin
+ * user-invocable router + 13 product skills into workspace skills roots.
+ * Fail-closed when OC signals are absent. Policy opt-out:
+ * `plan.policy.openClawProductCommands: false`.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { generateOpenClawSkillArtifacts, isManagedOpenClawL2Skill, listOpenClawManagedSkillSlugs, } from "../slash/openclaw-adapter.js";
+import { depositOpenClawL2ProductCommands, loadOpenClawProductCommandsPolicyFromProject, } from "../slash/openclaw-deposit.js";
+import { detectOpenClaw, listInScopeSkillsDirs } from "./openclaw-skills.js";
+/** Stable doctor check id for JSON findings. */
+export const OPENCLAW_L2_ADAPTER_CHECK = "openclaw-l2-product-commands";
+const DOC_OPENCLAW_HOST = "docs/openclaw-agent-host.md";
+const DOC_SLASH_MULTI = "docs/slash-multi-host.md";
+const REMEDIATION_FIX = "deft doctor --fix";
+function defaultIsDir(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function assessGaps(skillsDirs) {
+    const artifacts = generateOpenClawSkillArtifacts();
+    const missing = [];
+    const stale = [];
+    let present = 0;
+    for (const skillsDir of skillsDirs) {
+        for (const art of artifacts) {
+            const path = join(skillsDir, art.slug, "SKILL.md");
+            if (!existsSync(path)) {
+                missing.push(`${skillsDir}/${art.slug}`);
+                continue;
+            }
+            let raw;
+            try {
+                raw = readFileSync(path, "utf8");
+            }
+            catch {
+                missing.push(`${skillsDir}/${art.slug}`);
+                continue;
+            }
+            if (!isManagedOpenClawL2Skill(raw)) {
+                // Consumer customization — not a gap for doctor (preserve).
+                present += 1;
+                continue;
+            }
+            if (raw === art.skillMarkdown) {
+                present += 1;
+            }
+            else {
+                stale.push(`${skillsDir}/${art.slug}`);
+            }
+        }
+    }
+    return { missing, stale, present };
+}
+/**
+ * Doctor check: OpenClaw L2 product-command skills present and current.
+ * No-ops when OpenClaw is not detected. Fix mode deposits managed skills.
+ */
+export function runOpenClawL2AdapterCheck(sink, addFinding, options) {
+    const seams = options.seams ?? {};
+    const env = seams.openclawEnv ?? process.env;
+    const homeDirFn = seams.openclawHomeDir ?? (() => homedir());
+    const isDir = seams.isDir ?? defaultIsDir;
+    const home = homeDirFn();
+    const detect = detectOpenClaw(env, { homeDir: home, isDir });
+    if (!detect.detected) {
+        sink.info(`${OPENCLAW_L2_ADAPTER_CHECK}: skip -- OpenClaw not detected`);
+        addFinding({
+            severity: "skip",
+            message: "OpenClaw not detected",
+            check: OPENCLAW_L2_ADAPTER_CHECK,
+            status: "skip",
+            reason: "openclaw-not-detected",
+        });
+        return null;
+    }
+    const policy = loadOpenClawProductCommandsPolicyFromProject(options.projectRoot);
+    if (!policy) {
+        // Opt-out: under --fix, strip managed L2 skills so the adapter does not
+        // stay active after openClawProductCommands=false (#3064 Greptile P1).
+        let depositResult = null;
+        if (options.fixMode) {
+            depositResult = depositOpenClawL2ProductCommands({
+                projectRoot: options.projectRoot,
+                env,
+                homeDir: home,
+                allAgents: options.allAgents,
+                policy: false,
+                printf: (t) => {
+                    if (!options.jsonMode)
+                        sink.info(t.trimEnd());
+                },
+                isDir,
+            });
+            const message = `${OPENCLAW_L2_ADAPTER_CHECK}: opted out (plan.policy.openClawProductCommands=false); ` +
+                (depositResult.removedPaths.length > 0
+                    ? `removed ${depositResult.removedPaths.length} managed skill path(s)`
+                    : "no managed L2 skills to remove");
+            sink.success(message);
+            addFinding({
+                severity: "skip",
+                message,
+                check: OPENCLAW_L2_ADAPTER_CHECK,
+                status: "opted-out-fixed",
+                reason: "policy-false",
+                removed: depositResult.removedPaths,
+                detect_reasons: detect.reasons,
+            });
+            return depositResult;
+        }
+        sink.info(`${OPENCLAW_L2_ADAPTER_CHECK}: skip -- plan.policy.openClawProductCommands=false`);
+        addFinding({
+            severity: "skip",
+            message: "OpenClaw L2 product commands opted out via policy; run `deft doctor --fix` to remove managed skills",
+            check: OPENCLAW_L2_ADAPTER_CHECK,
+            status: "opted-out",
+            reason: "policy-false",
+        });
+        return null;
+    }
+    const skillsDirs = listInScopeSkillsDirs(detect.stateDir, options.allAgents, {
+        isDir,
+    });
+    const gaps = assessGaps(skillsDirs);
+    const expectedCount = listOpenClawManagedSkillSlugs().length * skillsDirs.length;
+    if (gaps.missing.length === 0 && gaps.stale.length === 0) {
+        const message = `${OPENCLAW_L2_ADAPTER_CHECK}: OpenClaw L2 product-command skills present ` +
+            `(router + 13) in ${options.allAgents ? "main + workspace-* seats" : "main workspace"}`;
+        sink.success(message);
+        addFinding({
+            severity: "skip",
+            message,
+            check: OPENCLAW_L2_ADAPTER_CHECK,
+            status: "present",
+            skills_dirs: skillsDirs,
+            expected: expectedCount,
+            present: gaps.present,
+            detect_reasons: detect.reasons,
+        });
+        return null;
+    }
+    let depositResult = null;
+    if (options.fixMode) {
+        depositResult = depositOpenClawL2ProductCommands({
+            projectRoot: options.projectRoot,
+            env,
+            homeDir: home,
+            allAgents: options.allAgents,
+            policy: true,
+            printf: (t) => {
+                if (!options.jsonMode)
+                    sink.info(t.trimEnd());
+            },
+            isDir,
+        });
+        const post = assessGaps(skillsDirs);
+        if (post.missing.length === 0 && post.stale.length === 0) {
+            const message = `${OPENCLAW_L2_ADAPTER_CHECK}: deposited OpenClaw L2 product-command skills; ` +
+                "restart the OpenClaw gateway or start a new session so available_skills refreshes";
+            sink.success(message);
+            addFinding({
+                severity: "skip",
+                message,
+                check: OPENCLAW_L2_ADAPTER_CHECK,
+                status: "fixed",
+                skills_dirs: skillsDirs,
+                written: depositResult.writtenPaths,
+                detect_reasons: detect.reasons,
+            });
+            return depositResult;
+        }
+    }
+    const message = `${OPENCLAW_L2_ADAPTER_CHECK}: OpenClaw L2 product-command skills incomplete ` +
+        `(missing: ${gaps.missing.length}, stale: ${gaps.stale.length}) under ${skillsDirs.join(", ")}. ` +
+        `Remediation: ${REMEDIATION_FIX}. See ${DOC_OPENCLAW_HOST}, ${DOC_SLASH_MULTI}.`;
+    sink.warn(message);
+    addFinding({
+        severity: "warning",
+        message,
+        check: OPENCLAW_L2_ADAPTER_CHECK,
+        status: "missing",
+        missing: gaps.missing,
+        stale: gaps.stale,
+        skills_dirs: skillsDirs,
+        suggestion: REMEDIATION_FIX,
+        docs: [DOC_OPENCLAW_HOST, DOC_SLASH_MULTI],
+        detect_reasons: detect.reasons,
+    });
+    return depositResult;
+}
+//# sourceMappingURL=openclaw-l2-adapter.js.map

package/dist/hooks/dispatcher.d.ts

@@ -1,4 +1,5 @@
 import { type AuthzState, type HumanOriginGrant } from "../authz/index.js";
+import { detectDeftDirectiveDisable } from "../policy/deft-directive-disable.js";
 import { detectNoDeftDirective } from "../policy/no-deft-directive.js";
 import { type RuntimeAuthorityPolicy } from "../policy/runtime-authority.js";
 import { type VerifyResult } from "../session/verify-session-ritual.js";
@@ -16,7 +17,9 @@ export type CompactHookHost = (typeof COMPACT_HOOK_HOSTS)[number];
 /** Hosts without a native compact hook surface — deposit skips cleanly (#2113). */
 export declare const COMPACT_HOOK_SKIP_HOSTS: readonly ["codex"];
 export type HookVerdict = "allow" | "deny";
-export type HookDecisionCode = "session-start" | "session-start-disabled" | "session-start-degraded" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
+export type HookDecisionCode = "session-start" | "session-start-disabled" | "session-start-degraded"
+/** Enforcement skipped: root `.deft-directive-disable` test kill-switch (#3039). */
+ | "directive-disabled" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
 /** Host closed stdin with zero bytes — integration failure, not a policy gate (#2864). */
  | "stdin-empty" | "ritual-not-ready" | "scope-not-ready" | "write-propose-ready" | "write-ready" | "read-only-deny" | "spawn-explore-ready" | "spawn-ready" | "spawn-not-ready" | "runtime-policy-deny-path" | "runtime-policy-deny-scope"
 /** Shell/MCP classifiable push/merge allowed under runtimeAuthority (#2711). */
@@ -56,6 +59,8 @@ export interface HookPolicySeams {
     };
     /** Test seam for #2926 root opt-out on SessionStart. */
     readonly detectNoDeftDirective?: typeof detectNoDeftDirective;
+    /** Test seam for #3039 root test kill-switch (precedence over #2926 for enforcement). */
+    readonly detectDeftDirectiveDisable?: typeof detectDeftDirectiveDisable;
     readonly markCompactStale?: (projectRoot: string) => {
         changed: boolean;
         statePath: string;

package/dist/hooks/dispatcher.js

@@ -2,6 +2,7 @@ import { realpathSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
 import { hasArtifactSuffix } from "../layout/resolve.js";
+import { detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
 import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
@@ -570,6 +571,35 @@ function inspectMutationGates(input, toolName, seams, options) {
 /** Decide a normalized event using only the P0 direct-write policy. */
 export function decideHook(input, seams = {}) {
     const projectRoot = resolve(input.projectRoot);
+    // #3039: local (untracked) `.deft-directive-disable` wins for enforcement
+    // short-circuit (SessionStart / compact / PreToolUse). Deposit may remain.
+    // Tracked/committed flags do NOT bypass gates (repo-controlled content must
+    // not disable enforcement for clones) — doctor warns instead.
+    {
+        const detectKill = seams.detectDeftDirectiveDisable ?? detectDeftDirectiveDisable;
+        const kill = detectKill(projectRoot);
+        const killActive = seams.detectDeftDirectiveDisable !== undefined
+            ? kill.active
+            : isDeftDirectiveDisableActive(projectRoot);
+        if (killActive) {
+            const detectOptOut = seams.detectNoDeftDirective ?? detectNoDeftDirective;
+            const optOut = detectOptOut(projectRoot);
+            const message = formatDeftDirectiveDisableMessage({
+                permanentOptOutAlsoPresent: optOut.present,
+                trackedByGit: false,
+            });
+            return {
+                verdict: "allow",
+                code: input.event === "session.start" ? "session-start-disabled" : "directive-disabled",
+                event: input.event,
+                host: input.host,
+                toolName: null,
+                projectRoot,
+                message,
+                scopePath: null,
+            };
+        }
+    }
     if (input.event === "session.compact") {
         try {
             const result = (seams.markCompactStale ?? markRitualStaleAfterCompact)(projectRoot);

package/dist/index.d.ts

@@ -50,6 +50,7 @@ export * as resolution from "./resolution/index.js";
 export * as scm from "./scm/index.js";
 export * as scope from "./scope/index.js";
 export * as session from "./session/index.js";
+export * as slash from "./slash/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
@@ -65,6 +66,7 @@ export * as vbriefValidation from "./vbrief-validation/index.js";
 export * as verifyEnv from "./verify-env/index.js";
 export * as verifySource from "./verify-source/index.js";
 export * as wipCap from "./wip-cap/index.js";
+export * as xbrief from "./xbrief/index.js";
 export * as xbriefMigrate from "./xbrief-migrate/index.js";
 export declare const CORE_PACKAGE: "@deftai/directive-core";
 /** Returns identifying metadata for the core engine package. */

package/dist/index.js

@@ -51,6 +51,7 @@ export * as resolution from "./resolution/index.js";
 export * as scm from "./scm/index.js";
 export * as scope from "./scope/index.js";
 export * as session from "./session/index.js";
+export * as slash from "./slash/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
@@ -66,6 +67,7 @@ export * as vbriefValidation from "./vbrief-validation/index.js";
 export * as verifyEnv from "./verify-env/index.js";
 export * as verifySource from "./verify-source/index.js";
 export * as wipCap from "./wip-cap/index.js";
+export * as xbrief from "./xbrief/index.js";
 export * as xbriefMigrate from "./xbrief-migrate/index.js";
 export const CORE_PACKAGE = "@deftai/directive-core";
 /** Returns identifying metadata for the core engine package. */

package/dist/init-deposit/gitignore.js

@@ -13,6 +13,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
+import { DEFT_DIRECTIVE_DISABLE_GITIGNORE_LINE } from "../policy/deft-directive-disable.js";
 import { FORBIDDEN_BLANKET_EVAL_LINES, stripGitignoreInlineComment, } from "../triage/bootstrap/gitignore.js";
 /** Directory ignore entry for the hybrid deposit (greenfield only). */
 export const GITIGNORE_DEFT_CORE_LINE = ".deft/core/";
@@ -29,6 +30,8 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     ".deft/ritual-state.json",
     ".deft/last-session.json",
     ".deft/routing.local.json",
+    // Temporary test/local kill-switch — must stay untracked (#3039).
+    DEFT_DIRECTIVE_DISABLE_GITIGNORE_LINE,
     "vbrief/.triage-cache/candidates.jsonl",
     "vbrief/.triage-cache/summary-history.jsonl",
     "vbrief/.triage-cache/scope-lifecycle.jsonl",

package/dist/init-deposit/hygiene.d.ts

@@ -2,7 +2,13 @@
  * Scoped staging + installer-managed allowlist for TS-native init/update (#1453).
  *
  * Mirrors cmd/deft-install/hygiene.go + deposit.go installerManagedMatchers.
- * Refs #1576, #1453, #1430.
+ *
+ * CRITICAL (#1430 / #3030): the allowlist MUST honor the SPEC consumer-path
+ * denylist (`CONSUMER_GUARD_MUST_FIRE`). Consumer-authored PROJECT-DEFINITION
+ * and scope briefs are never installer-managed; if they reappear in
+ * `installerManagedMatchers()`, unit tests and deposit-time assert fail closed.
+ *
+ * Refs #1576, #1453, #1430, #3029, #3030.
  */
 import { type InitDepositIo } from "./constants.js";
 export declare const CODEQL_CONFIG_REL = ".github/codeql/codeql-config.yml";
@@ -11,11 +17,47 @@ export interface InstallerManagedMatcher {
     readonly exact?: string;
     readonly prefix?: string;
 }
+/**
+ * Consumer paths that MUST trip no-mixed-core-and-app when mixed with
+ * `.deft/core/**` (#1430 SPEC). These probe paths must never match
+ * `installerManagedMatchers()` / the deposited guard ERE.
+ *
+ * Legitimate installer scaffolding (xbrief/.deft-version, lifecycle .gitkeep,
+ * schemas/, migration/, xbrief.md) is NOT in this denylist — see #2277.
+ * Init may still *create* PROJECT-DEFINITION (#3013); create ≠ allowlist.
+ *
+ * Refs #3030, #3029, #1430.
+ */
+export declare const CONSUMER_GUARD_MUST_FIRE: readonly string[];
 /** Single source of truth for installer-managed paths (#1440 / #1576). */
 export declare function installerManagedMatchers(): InstallerManagedMatcher[];
+/**
+ * Fail closed when the installer-managed allowlist would exempt consumer
+ * PROJECT-DEFINITION or scope briefs (#3030 / #1430). Pure over `matchers` so
+ * tests can inject a bad matcher without mutating production state.
+ *
+ * Checks both:
+ * 1. Explicit probe paths in {@link CONSUMER_GUARD_MUST_FIRE}
+ * 2. Structural patterns (any exact consumer scope brief / PD; forbidden prefixes)
+ *    so an unlisted `xbrief/active/another-scope.xbrief.json` matcher still fails.
+ */
+export declare function assertInstallerAllowlistHonors1430(matchers?: readonly InstallerManagedMatcher[]): void;
 /** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
 export declare function installerManagedGuardEre(): string;
 export declare function isInstallerManagedPath(path: string): boolean;
+export interface MixedCoreAndAppClassification {
+    readonly core: string[];
+    readonly installerManaged: string[];
+    readonly app: string[];
+    /** True when both core and app are non-empty — the deposited guard fails. */
+    readonly wouldFail: boolean;
+}
+/**
+ * TS twin of Go `classifyChangedPaths` / deposited shell guard (#1430).
+ * Core = `.deft/core/**`; installer-managed = allowlist; app = everything else.
+ * Guard fails iff both core and app are non-empty.
+ */
+export declare function classifyMixedCoreAndApp(changedPaths: readonly string[], matchers?: readonly InstallerManagedMatcher[]): MixedCoreAndAppClassification;
 export interface FrameworkStagePathsOptions {
     /**
      * Include the vendored `.deft/core` payload in the stage set. Defaults to