@deftai/directive-core 0.93.0 → 0.95.0

package/dist/verify-env/agent-hooks-live-probe.js

@@ -1,27 +1,19 @@
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
+import { HOOK_HOSTS } from "../hooks/dispatcher.js";
 import { READ_ONLY_HOOK_ENV } from "../hooks/tools.js";
 import { DEFT_HOOK_COMMAND_MARKER } from "../init-deposit/agent-hooks.js";
 import { SUBPROCESS_MAX_BUFFER } from "../subprocess/max-buffer.js";
 import { quoteWin32CommandForShell, resolveCommandOnPath, shouldUseShellForCommand, } from "./command-spawn.js";
-const LIVE_PROBE_HOST = "cursor";
+export const LIVE_PROBE_CASE_TIMEOUT_MS = 1_500;
 const LIVE_PROBE_EVENT = "tool.before";
+function elapsedMs(started) {
+    return Math.max(0, Math.round(performance.now() - started));
+}
 function resolveHookCommand(seams) {
-    const resolveCommand = seams.resolveCommand ?? resolveCommandOnPath;
-    const deftHook = resolveCommand(DEFT_HOOK_COMMAND_MARKER);
-    if (deftHook !== null) {
-        return { command: deftHook, argsPrefix: [] };
-    }
-    const deft = resolveCommand("deft");
-    if (deft !== null) {
-        return { command: deft, argsPrefix: ["hook:dispatch"] };
-    }
-    const directive = resolveCommand("directive");
-    if (directive !== null) {
-        return { command: directive, argsPrefix: ["hook:dispatch"] };
-    }
-    return null;
+    return (seams.resolveCommand ?? resolveCommandOnPath)(DEFT_HOOK_COMMAND_MARKER);
 }
+/** Quote one Windows cmd.exe argument used by the installed hook shim. */
 export function quoteWindowsCmdArg(value) {
     const escaped = value.replace(/%/g, "%%");
     if (!/[\s"&|<>^()]/.test(escaped)) {
@@ -31,27 +23,10 @@ export function quoteWindowsCmdArg(value) {
 }
 function spawnHookWithStdin(command, args, stdin, cwd, env = process.env) {
     const shell = shouldUseShellForCommand(command);
-    if (shell && process.platform === "win32") {
-        const cmdLine = [quoteWin32CommandForShell(command), ...args.map(quoteWindowsCmdArg)].join(" ");
-        const proc = spawnSync(cmdLine, [], {
-            input: stdin,
-            cwd,
-            env,
-            encoding: "utf8",
-            stdio: ["pipe", "pipe", "pipe"],
-            shell: true,
-            windowsHide: true,
-            maxBuffer: SUBPROCESS_MAX_BUFFER,
-        });
-        const status = proc.status ?? (proc.error ? 2 : proc.signal ? 128 : 0);
-        return {
-            status,
-            stdout: typeof proc.stdout === "string" ? proc.stdout : "",
-            stderr: typeof proc.stderr === "string" ? proc.stderr : "",
-        };
-    }
-    const spawnCmd = shell && process.platform === "win32" ? quoteWin32CommandForShell(command) : command;
-    const proc = spawnSync(spawnCmd, [...args], {
+    const commandArgs = shell && process.platform === "win32"
+        ? [[quoteWin32CommandForShell(command), ...args.map(quoteWindowsCmdArg)].join(" "), []]
+        : [command, [...args]];
+    const proc = spawnSync(commandArgs[0], commandArgs[1], {
         input: stdin,
         cwd,
         env,
@@ -60,12 +35,14 @@ function spawnHookWithStdin(command, args, stdin, cwd, env = process.env) {
         shell,
         windowsHide: true,
         maxBuffer: SUBPROCESS_MAX_BUFFER,
+        timeout: LIVE_PROBE_CASE_TIMEOUT_MS,
     });
-    const status = proc.status ?? (proc.error ? 2 : proc.signal ? 128 : 0);
+    const timedOut = proc.error?.code === "ETIMEDOUT";
     return {
-        status,
+        status: proc.status ?? (proc.error ? 2 : proc.signal ? 128 : 0),
         stdout: typeof proc.stdout === "string" ? proc.stdout : "",
         stderr: typeof proc.stderr === "string" ? proc.stderr : "",
+        ...(timedOut ? { timedOut: true } : {}),
     };
 }
 function allowFixture(projectRoot) {
@@ -86,131 +63,167 @@ function denyFixture(projectRoot) {
 function denyProbeEnv() {
     return { ...process.env, [READ_ONLY_HOOK_ENV]: "1" };
 }
-function parseCursorDecision(stdout) {
+function parseJsonObject(stdout) {
     const trimmed = stdout.trim();
     if (trimmed.length === 0) {
-        return { ok: false, detail: "empty stdout" };
+        return { value: null, issue: "empty-stdout", detail: "empty stdout" };
     }
     try {
         const parsed = JSON.parse(trimmed);
-        if (parsed !== null &&
-            typeof parsed === "object" &&
-            !Array.isArray(parsed) &&
-            parsed.permission === "allow") {
-            return { ok: true, permission: "allow", detail: "permission allow" };
-        }
-        if (parsed !== null &&
-            typeof parsed === "object" &&
-            !Array.isArray(parsed) &&
-            parsed.permission === "deny") {
-            return { ok: true, permission: "deny", detail: "permission deny" };
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return { value: parsed, issue: null, detail: "valid JSON object" };
         }
-        return { ok: false, detail: "stdout JSON missing permission allow/deny" };
+        return { value: null, issue: "unparseable-json", detail: "stdout JSON is not an object" };
     }
     catch {
-        return { ok: false, detail: "stdout is not valid JSON" };
+        return { value: null, issue: "unparseable-json", detail: "stdout is not valid JSON" };
     }
 }
-function runFixtureProbe(resolved, projectRoot, fixture, stdin, env, spawnHook) {
-    const args = [
-        ...resolved.argsPrefix,
-        "--host",
-        LIVE_PROBE_HOST,
-        "--event",
-        LIVE_PROBE_EVENT,
-        "--project-root",
-        projectRoot,
-    ];
-    const spawned = spawnHook({
-        command: resolved.command,
-        args,
-        stdin,
-        cwd: projectRoot,
-        env,
-    });
-    if (spawned.status !== 0) {
+function validatesNestedDeny(value) {
+    const output = value.hookSpecificOutput;
+    if (output === null || typeof output !== "object" || Array.isArray(output))
+        return false;
+    const nested = output;
+    return (nested.hookEventName === "PreToolUse" &&
+        nested.permissionDecision === "deny" &&
+        typeof nested.permissionDecisionReason === "string");
+}
+function validateFixtureOutput(host, fixture, stdout) {
+    if (fixture === "allow" && host !== "cursor") {
+        if (stdout.trim().length === 0)
+            return { ok: true };
+        const parsed = parseJsonObject(stdout);
         return {
-            host: LIVE_PROBE_HOST,
-            event: LIVE_PROBE_EVENT,
-            fixture,
-            issue: "spawn-failed",
-            detail: `hook command exited ${spawned.status}${spawned.stderr.trim() ? `: ${spawned.stderr.trim()}` : ""}`,
+            ok: false,
+            issue: parsed.issue ?? "missing-allow",
+            detail: "expected empty stdout so the host permission flow remains unchanged",
         };
     }
-    const decision = parseCursorDecision(spawned.stdout);
-    if (!decision.ok) {
+    const parsed = parseJsonObject(stdout);
+    if (parsed.value === null) {
         return {
-            host: LIVE_PROBE_HOST,
-            event: LIVE_PROBE_EVENT,
-            fixture,
-            issue: decision.detail.includes("JSON") ? "unparseable-json" : "empty-stdout",
-            detail: decision.detail,
+            ok: false,
+            issue: parsed.issue,
+            detail: parsed.detail,
         };
     }
-    if (fixture === "allow" && decision.permission !== "allow") {
+    const value = parsed.value;
+    if (fixture === "allow") {
+        return value.permission === "allow"
+            ? { ok: true }
+            : { ok: false, issue: "missing-allow", detail: "expected Cursor permission allow" };
+    }
+    const denied = host === "cursor"
+        ? value.permission === "deny"
+        : host === "grok"
+            ? value.decision === "deny" && typeof value.reason === "string"
+            : validatesNestedDeny(value);
+    return denied
+        ? { ok: true }
+        : { ok: false, issue: "missing-deny", detail: `expected ${host} deny envelope` };
+}
+function runFixtureProbe(command, host, projectRoot, fixture, spawnHook) {
+    const spawned = spawnHook({
+        command,
+        args: ["--host", host, "--event", LIVE_PROBE_EVENT, "--project-root", projectRoot],
+        stdin: fixture === "allow" ? allowFixture(projectRoot) : denyFixture(projectRoot),
+        cwd: projectRoot,
+        env: fixture === "allow" ? process.env : denyProbeEnv(),
+    });
+    if (spawned.timedOut === true) {
         return {
-            host: LIVE_PROBE_HOST,
+            host,
             event: LIVE_PROBE_EVENT,
             fixture,
-            issue: "missing-allow",
-            detail: `expected permission allow, got ${decision.permission ?? "none"}`,
+            issue: "timed-out",
+            detail: `hook command exceeded ${LIVE_PROBE_CASE_TIMEOUT_MS}ms`,
         };
     }
-    if (fixture === "deny" && decision.permission !== "deny") {
+    if (spawned.status !== 0) {
         return {
-            host: LIVE_PROBE_HOST,
+            host,
             event: LIVE_PROBE_EVENT,
             fixture,
-            issue: "missing-deny",
-            detail: `expected permission deny, got ${decision.permission ?? "none"}`,
+            issue: "spawn-failed",
+            detail: `hook command exited ${spawned.status}${spawned.stderr.trim() ? `: ${spawned.stderr.trim()}` : ""}`,
         };
     }
-    return null;
+    const validation = validateFixtureOutput(host, fixture, spawned.stdout);
+    return validation.ok
+        ? null
+        : {
+            host,
+            event: LIVE_PROBE_EVENT,
+            fixture,
+            issue: validation.issue,
+            detail: validation.detail,
+        };
 }
-/** Spawn the configured hook command and assert Cursor tool.before allow/deny behavior. */
+/** Invoke the installed deft-hook shim and validate enabled host allow/deny codecs. */
 export function probeAgentHooksLive(projectRoot, seams = {}) {
+    const started = performance.now();
     const root = resolve(projectRoot);
-    const resolved = resolveHookCommand(seams);
-    if (resolved === null) {
+    const hosts = [...(seams.hosts ?? HOOK_HOSTS)];
+    if (hosts.length === 0) {
+        return {
+            code: 0,
+            message: "deft agent hooks live probe skipped: every host is intentionally disabled.",
+            cases: [],
+            hosts: [],
+            durationMs: elapsedMs(started),
+        };
+    }
+    const command = resolveHookCommand(seams);
+    if (command === null) {
         return {
             code: 2,
-            message: "deft agent hooks live probe unavailable: neither deft-hook nor deft/directive hook:dispatch is on PATH.",
+            message: `deft agent hooks live probe unavailable: installed ${DEFT_HOOK_COMMAND_MARKER} is not on PATH.`,
             cases: [
                 {
-                    host: LIVE_PROBE_HOST,
+                    host: hosts[0],
                     event: LIVE_PROBE_EVENT,
                     fixture: "allow",
                     issue: "hook-command-missing",
                     detail: `${DEFT_HOOK_COMMAND_MARKER} not found on PATH`,
                 },
             ],
+            hosts: hosts.map((host) => ({ host, status: "unavailable" })),
+            durationMs: elapsedMs(started),
         };
     }
     const spawnHook = seams.spawnHook ??
-        ((input) => spawnHookWithStdin(input.command, input.args, input.stdin, input.cwd, input.env ?? process.env));
+        ((input) => spawnHookWithStdin(input.command, input.args, input.stdin, input.cwd, input.env));
     const failures = [];
-    for (const [fixture, stdin, env] of [
-        ["allow", allowFixture(root), process.env],
-        ["deny", denyFixture(root), denyProbeEnv()],
-    ]) {
-        const failure = runFixtureProbe(resolved, root, fixture, stdin, env, spawnHook);
-        if (failure !== null)
-            failures.push(failure);
+    const hostResults = [];
+    for (const host of hosts) {
+        let hostFailure = null;
+        for (const fixture of ["allow", "deny"]) {
+            hostFailure = runFixtureProbe(command, host, root, fixture, spawnHook);
+            if (hostFailure !== null) {
+                failures.push(hostFailure);
+                break;
+            }
+        }
+        hostResults.push({ host, status: hostFailure === null ? "functional" : "non-functional" });
     }
     if (failures.length === 0) {
         return {
             code: 0,
-            message: "deft agent hooks live probe passed for Cursor tool.before allow and deny fixtures.",
+            message: `deft agent hooks live probe passed allow/deny fixtures for ${hosts.join(", ")}.`,
             cases: [],
+            hosts: hostResults,
+            durationMs: elapsedMs(started),
         };
     }
     const summary = failures
-        .map((entry) => `${entry.fixture}: ${entry.issue} (${entry.detail})`)
+        .map((entry) => `${entry.host}/${entry.fixture}: ${entry.issue} (${entry.detail})`)
         .join("; ");
     return {
         code: 1,
         message: `deft agent hooks live probe FAILED: ${summary}. Recovery: reinstall @deftai/directive and run \`deft update\`.`,
         cases: failures,
+        hosts: hostResults,
+        durationMs: elapsedMs(started),
     };
 }
 //# sourceMappingURL=agent-hooks-live-probe.js.map

package/dist/verify-env/agent-hooks.js

@@ -22,7 +22,7 @@ export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksP
         };
     }
     const registrations = inspectAgentHookDeposit(root, hostHooksPolicy);
-    const unhealthy = registrations.filter((entry) => entry.status !== "healthy");
+    const unhealthy = registrations.filter((entry) => entry.status === "missing" || entry.status === "drifted");
     if (unhealthy.length > 0) {
         return {
             code: 1,
@@ -30,18 +30,26 @@ export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksP
                 unhealthy
                     .map((entry) => `  - ${entry.host}: ${entry.status} at ${entry.path} — ${entry.detail}`)
                     .join("\n") +
-                "\n  Recovery: run `deft update` (or `directive init`) to refresh project hooks.",
+                "\n  Recovery: run `deft update` (or `directive init`) to refresh project hooks." +
+                " If a failed host is intentionally unused, inspect `deft policy:show --field=hostHooks`, " +
+                "set `plan.policy.hostHooks.<host> = false`, and run `deft update` again.",
             stream: "stderr",
             registrations,
         };
     }
+    const disabledHosts = registrations
+        .filter((entry) => entry.status === "disabled")
+        .map((entry) => entry.host[0]?.toUpperCase() + entry.host.slice(1));
     return {
         code: 0,
         message: "✓ deft agent hooks registered and structurally valid for Claude, Grok, Cursor, Codex " +
             "(SessionStart + PreToolUse direct-write and spawn/Task tools; compact re-arm deposited for Claude/Grok/Cursor; " +
             "Codex has no native compact hook — re-run session ritual manually after compaction). " +
             'Read-only explore: prefer Grok role `default_capability_mode = "read-only"`; hooks also honor ' +
-            "DEFT_HOOK_READ_ONLY=1 and explore subagent_type. Codex runtime trust is user-controlled and must be reviewed with `/hooks`; shell/MCP policy is deferred.",
+            "DEFT_HOOK_READ_ONLY=1 and explore subagent_type. Codex runtime trust is user-controlled and must be reviewed with `/hooks`; shell/MCP policy is deferred." +
+            (disabledHosts.length > 0
+                ? ` Intentional hostHooks disabled: ${disabledHosts.join(", ")}.`
+                : ""),
         stream: "stdout",
         registrations,
     };

package/dist/verify-env/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./agent-hook-readiness.js";
 export * from "./agent-hooks.js";
 export * from "./agent-hooks-live-probe.js";
 export * from "./command-spawn.js";

package/dist/verify-env/index.js

@@ -1,3 +1,4 @@
+export * from "./agent-hook-readiness.js";
 export * from "./agent-hooks.js";
 export * from "./agent-hooks-live-probe.js";
 export * from "./command-spawn.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.93.0",
+  "version": "0.95.0",
   "description": "TypeScript engine core for the Directive framework.",
   "license": "MIT",
   "type": "module",
@@ -243,6 +243,10 @@
       "types": "./dist/capacity/index.d.ts",
       "default": "./dist/capacity/index.js"
     },
+    "./freshness": {
+      "types": "./dist/freshness/index.d.ts",
+      "default": "./dist/freshness/index.js"
+    },
     "./intake": {
       "types": "./dist/intake/index.d.ts",
       "default": "./dist/intake/index.js"
@@ -342,8 +346,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.93.0",
-    "@deftai/directive-types": "^0.93.0",
+    "@deftai/directive-content": "^0.95.0",
+    "@deftai/directive-types": "^0.95.0",
     "archiver": "^8.0.0"
   },
   "scripts": {