@deftai/directive-core 0.94.0 → 0.95.0

package/dist/authz/classify.js

@@ -145,6 +145,442 @@ function hasGhApiPath(tokens, needle) {
     }
     return false;
 }
+/**
+ * Authz authority-mutating CLI verbs (#3110). Classified as **settings** so under
+ * active UAT they deny without a prior human grant — never empty → shell-op-unclassifiable fail-open.
+ */
+const AUTHZ_MUTATING_SUBCOMMANDS = new Set(["grant", "uat-start", "uat-suspend", "revoke"]);
+function authzSubcommandFromToken(token) {
+    const t = normalizeToken(token);
+    if (t.startsWith("authz:")) {
+        const sub = t.slice("authz:".length);
+        return AUTHZ_MUTATING_SUBCOMMANDS.has(sub) ? sub : null;
+    }
+    return AUTHZ_MUTATING_SUBCOMMANDS.has(t) ? t : null;
+}
+/**
+ * Detect `deft|task|directive authz:grant` / `authz grant` (and wrappers) in shell tokens.
+ * O(n) token walk — no nested-quantifier regex on untrusted input.
+ */
+function hasAuthzMutatingCli(tokens) {
+    for (let i = 0; i < tokens.length; i++) {
+        const raw = tokens[i];
+        if (raw === undefined)
+            break;
+        const t = normalizeToken(raw);
+        // Combined form anywhere: authz:grant / authz:uat-suspend / …
+        if (authzSubcommandFromToken(t) !== null && t.startsWith("authz:")) {
+            return true;
+        }
+        // Separated form: … authz grant|uat-start|uat-suspend|revoke
+        // Also path-ish bins ending in /authz or \authz (node …/authz.js grant).
+        const isAuthzBin = t === "authz" ||
+            t.endsWith("/authz") ||
+            t.endsWith("\\authz") ||
+            t.endsWith("/authz.js") ||
+            t.endsWith("\\authz.js") ||
+            t.endsWith("/authz.ts") ||
+            t.endsWith("\\authz.ts");
+        if (!isAuthzBin)
+            continue;
+        const next = tokens[i + 1] !== undefined ? normalizeToken(tokens[i + 1]) : "";
+        if (authzSubcommandFromToken(next) !== null)
+            return true;
+    }
+    return false;
+}
+/**
+ * Path-ish normalize: keep separators (do not strip `\` like normalizeToken).
+ */
+function pathishToken(token) {
+    return token.replace(/['"]/g, "").toLowerCase().replace(/\\/g, "/");
+}
+/**
+ * Shell **write** targeting `.deft/authz/` (#3110 AC-3).
+ * Pure reads (`cat .deft/authz/state.json`) stay unclassifiable — use `authz:show`.
+ * Redirects only count when the destination region contains `.deft/authz`.
+ */
+function hasAuthzDirShellWrite(command, tokens) {
+    const lower = command.toLowerCase().replace(/\\/g, "/");
+    if (!lower.includes(".deft/authz"))
+        return false;
+    // Redirect dest region after each `>` / `>>` (O(n); no nested-quantifier regex).
+    for (let i = 0; i < lower.length; i++) {
+        if (lower[i] !== ">")
+            continue;
+        let j = i + 1;
+        if (j < lower.length && lower[j] === ">")
+            j++;
+        // Dest until pipe/semicolon/ampersand/newline.
+        let end = j;
+        while (end < lower.length &&
+            lower[end] !== "|" &&
+            lower[end] !== ";" &&
+            lower[end] !== "&" &&
+            lower[end] !== "\n") {
+            end++;
+        }
+        if (lower.slice(j, end).includes(".deft/authz"))
+            return true;
+    }
+    // Write/destructive bins with an authz path argument.
+    for (let ti = 0; ti < tokens.length; ti++) {
+        if (!INDIRECT_WRITE_BINS.has(normalizeToken(tokens[ti])))
+            continue;
+        for (let tj = ti + 1; tj < tokens.length; tj++) {
+            if (pathishToken(tokens[tj]).includes(".deft/authz"))
+                return true;
+        }
+    }
+    return false;
+}
+/** Write/destructive shell bins (token match after normalizeToken). */
+const INDIRECT_WRITE_BINS = new Set([
+    "dd",
+    "sed",
+    "tee",
+    "cp",
+    "mv",
+    "rsync",
+    "rm",
+    "rmdir",
+    "unlink",
+    "shred",
+    "truncate",
+    "chmod",
+    "chown",
+    "install",
+    "python",
+    "python3",
+    "node",
+    "perl",
+    "ruby",
+    "pwsh",
+    "powershell",
+    "set-content",
+    "out-file",
+    "add-content",
+    "copy-item",
+    "move-item",
+    "remove-item",
+    "ri",
+    "ni",
+    "sc",
+    "mi",
+]);
+/**
+ * O(n): true when command expands `$…` / `` `…` `` / `%VAR%`
+ * (no nested-quantifier regex). Includes command substitution and positional `$1`.
+ */
+function hasEnvExpansion(command) {
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        if (c === "`")
+            return true;
+        if (c === "$" && i + 1 < command.length) {
+            const n = command[i + 1];
+            // $VAR / ${VAR} / $(cmd) / $1 / $@ / $* / $? / $'…' (ANSI-C)
+            if (n === "{" ||
+                n === "(" ||
+                n === "_" ||
+                n === "'" ||
+                n === "@" ||
+                n === "*" ||
+                n === "?" ||
+                n === "#" ||
+                n === "!" ||
+                (n >= "0" && n <= "9") ||
+                (n >= "A" && n <= "Z") ||
+                (n >= "a" && n <= "z")) {
+                return true;
+            }
+        }
+        if (c === "%" && i + 1 < command.length) {
+            const n = command[i + 1];
+            if (n === "_" || (n >= "A" && n <= "Z") || (n >= "a" && n <= "z")) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function hasWriteShape(command, tokens) {
+    if (command.includes(">"))
+        return true;
+    for (const t of tokens) {
+        if (INDIRECT_WRITE_BINS.has(normalizeToken(t)))
+            return true;
+    }
+    return false;
+}
+/**
+ * Split-path containment: `.deft` and `authz` both appear (e.g. `cd .deft && … authz/…`).
+ * O(n) substring checks — no nested-quantifier regex.
+ */
+function hasSplitAuthzPath(command) {
+    const lower = command.toLowerCase().replace(/\\/g, "/");
+    if (!lower.includes("authz"))
+        return false;
+    return lower.includes(".deft") || lower.includes("/deft/") || lower.includes("deft/");
+}
+/**
+ * Last non-flag token is a pure expansion dest (`$STORE`, `${STORE}`, `%TEMP%`)
+ * with no trailing path segment (`$HOME/out` is NOT pure — ordinary user write).
+ */
+function lastTokenIsOpaqueExpansion(tokens) {
+    let last = "";
+    for (const t of tokens) {
+        if (t.startsWith("-"))
+            continue;
+        last = t;
+    }
+    if (last.length === 0)
+        return false;
+    const n = last.replace(/['"]/g, "");
+    // Path after expansion → ordinary dest, not opaque store alias.
+    if (n.includes("/") || n.includes("\\"))
+        return false;
+    if (n.startsWith("$") && n.length > 1)
+        return true;
+    if (n.startsWith("%") && n.endsWith("%") && n.length > 2)
+        return true;
+    return false;
+}
+/** Env / path tokens that are ordinary non-store destinations (not authz containment). */
+const ORDINARY_EXPANSION_PREFIXES = [
+    "home",
+    "tmpdir",
+    "temp",
+    "tmp",
+    "pwd",
+    "user",
+    "username",
+    "userprofile",
+    "xdg_",
+    "path",
+    "psmodulepath",
+    "appdata",
+    "localappdata",
+    "programfiles",
+    "systemroot",
+    "windir",
+    "shell",
+    "term",
+    "color",
+    "lang",
+    "lc_",
+    "editor",
+    "visual",
+    "pager",
+    "browser",
+    "http",
+    "https",
+    "proxy",
+    "npm_",
+    "pnpm_",
+    "yarn_",
+    "node_",
+    "python",
+    "virtual_env",
+    "conda",
+    "cargo",
+    "go",
+    "java",
+    "ssh",
+    "gpg",
+    "git_",
+    "gh_",
+    "github_",
+    "ci",
+    "tf_",
+    "aws_",
+    "azure",
+    "gcloud",
+];
+/**
+ * True when the expansion name itself suggests authz / grant store
+ * (e.g. $AUTHZ_DIR, $DEFT_AUTHZ_ROOT, %GRANT_STORE%) — residual path without keywords.
+ */
+function hasAuthzPlausibleExpansionName(command) {
+    const lower = command.toLowerCase();
+    // O(n) scan for $NAME / ${NAME} / %NAME% containing authz/grant/store store-ish tokens.
+    for (let i = 0; i < lower.length; i++) {
+        const c = lower[i];
+        if (c === "$" && i + 1 < lower.length) {
+            let j = i + 1;
+            if (lower[j] === "{" || lower[j] === "(")
+                j++;
+            let name = "";
+            while (j < lower.length) {
+                const ch = lower[j];
+                if ((ch >= "a" && ch <= "z") || (ch >= "0" && ch <= "9") || ch === "_") {
+                    name += ch;
+                    j++;
+                    continue;
+                }
+                break;
+            }
+            if (nameLooksAuthzStore(name))
+                return true;
+        }
+        if (c === "%" && i + 1 < lower.length) {
+            let j = i + 1;
+            let name = "";
+            while (j < lower.length && lower[j] !== "%") {
+                const ch = lower[j];
+                if ((ch >= "a" && ch <= "z") || (ch >= "0" && ch <= "9") || ch === "_") {
+                    name += ch;
+                    j++;
+                    continue;
+                }
+                break;
+            }
+            if (nameLooksAuthzStore(name))
+                return true;
+        }
+    }
+    return false;
+}
+function nameLooksAuthzStore(name) {
+    if (name.length === 0)
+        return false;
+    if (name.includes("authz") ||
+        name.includes("grant") ||
+        name === "store" ||
+        name.endsWith("_store") ||
+        name.startsWith("store_") ||
+        name.includes("deft_auth") ||
+        name.includes("auth_store")) {
+        // Exclude ordinary false friends if any appear later.
+        return true;
+    }
+    return false;
+}
+/**
+ * Programmatic env write to store: python/node open(os.environ[...]) / process.env patterns
+ * that lack shell `$` expansion but still hit authz paths (#3110 residual).
+ */
+function hasProgrammaticAuthzEnvWrite(command, tokens) {
+    const lower = command.toLowerCase();
+    let hasProg = false;
+    for (const t of tokens) {
+        const n = normalizeToken(t);
+        if (n === "python" ||
+            n === "python3" ||
+            n === "node" ||
+            n === "nodejs" ||
+            n === "perl" ||
+            n === "ruby" ||
+            n === "pwsh" ||
+            n === "powershell") {
+            hasProg = true;
+            break;
+        }
+    }
+    if (!hasProg)
+        return false;
+    // Must look like a write (open/write/writefile/set-content) not a pure read.
+    const writeish = lower.includes("open(") ||
+        lower.includes(".write") ||
+        lower.includes("writefile") ||
+        lower.includes("writetext") ||
+        lower.includes("set-content") ||
+        lower.includes("out-file") ||
+        lower.includes("fs.write") ||
+        lower.includes("createwritestream") ||
+        lower.includes(">>") ||
+        lower.includes("mode='w'") ||
+        lower.includes('mode="w"') ||
+        lower.includes(",'w'") ||
+        lower.includes(',"w"');
+    if (!writeish)
+        return false;
+    // Authz-store target only — bare `state.json` alone is ordinary app state (#3110 residual).
+    if (lower.includes("authz") ||
+        lower.includes("/grants/") ||
+        lower.includes("grant-") ||
+        lower.includes("deft_auth") ||
+        lower.includes("auth_store") ||
+        lower.includes(".deft/authz") ||
+        lower.includes(".deft\\authz")) {
+        return true;
+    }
+    // os.environ / process.env + authz-store-ish key (not generic "auth"/"store" alone).
+    if (lower.includes("os.environ") ||
+        lower.includes("process.env") ||
+        lower.includes("$env:") ||
+        lower.includes("getenv")) {
+        if (lower.includes("authz") ||
+            lower.includes("grant") ||
+            lower.includes("deft_auth") ||
+            lower.includes("auth_store")) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Indirect shell FS mutation that can plausibly hit the authz store (#3110).
+ * Narrower than "any write + any expansion" (avoids denying `echo > $HOME/out` under UAT)
+ * but still catches opaque `$STORE` dest, `rm -rf $STORE`, authz-named expansions,
+ * and programmatic os.environ writes. Does **not** flag ordinary cleanup `rm $TMP/x`.
+ * O(n) walks — no polynomial regex on input.
+ */
+function hasIndirectAuthzStoreWrite(command, tokens) {
+    if (hasProgrammaticAuthzEnvWrite(command, tokens))
+        return true;
+    if (!hasWriteShape(command, tokens))
+        return false;
+    const lower = command.toLowerCase().replace(/\\/g, "/");
+    // Authz-plausible destination text (literal or expanded path segments).
+    // Bare `state.json` alone is ordinary app state — require authz/grants/.deft context
+    // (Greptile residual: do not deny unrelated expanded state-file writes under UAT).
+    if (lower.includes("authz") ||
+        lower.includes("/grants/") ||
+        lower.includes("grant-") ||
+        lower.includes(".deft/authz") ||
+        (lower.includes("state.json") &&
+            (lower.includes("authz") ||
+                lower.includes(".deft") ||
+                lower.includes("/grants/") ||
+                hasAuthzPlausibleExpansionName(command)))) {
+        // Require write shape already true; still need expansion OR already handled by literal path.
+        // When expansion is absent, hasAuthzDirShellWrite covers literals; here catch expanded.
+        if (hasEnvExpansion(command) || hasAuthzPlausibleExpansionName(command))
+            return true;
+    }
+    if (!hasEnvExpansion(command))
+        return false;
+    // Expansion var **name** suggests store (e.g. $AUTHZ_DIR without "authz" path text after).
+    if (hasAuthzPlausibleExpansionName(command))
+        return true;
+    // Destructive bins: only pure-opaque dest or authz-named expansion — not `rm $TMP/build`.
+    let destructive = false;
+    for (const t of tokens) {
+        const n = normalizeToken(t);
+        if (n === "rm" ||
+            n === "rmdir" ||
+            n === "unlink" ||
+            n === "shred" ||
+            n === "remove-item" ||
+            n === "ri") {
+            destructive = true;
+            break;
+        }
+    }
+    if (destructive && lastTokenIsOpaqueExpansion(tokens))
+        return true;
+    // cp/mv/tee/redirect dest is only `$VAR` / `%VAR%` (opaque absolute store path).
+    // Skip ordinary well-known env prefixes ($HOME, $TMPDIR, …).
+    if (lastTokenIsOpaqueExpansion(tokens)) {
+        const last = [...tokens].reverse().find((t) => !t.startsWith("-")) ?? "";
+        const bare = last.replace(/['"%${}]/g, "").toLowerCase();
+        if (!ORDINARY_EXPANSION_PREFIXES.some((p) => bare === p || bare.startsWith(p))) {
+            return true;
+        }
+    }
+    return false;
+}
 /** Best-effort shell classification for UAT-sensitive ops beyond push/merge. */
 export function classifyShellAuthzOps(command) {
     const cmd = command.trim();
@@ -180,6 +616,55 @@ export function classifyShellAuthzOps(command) {
         found.add("test");
     if (hasDeploy(tokens))
         found.add("deployment");
+    // #3110: authz authority CLI + store **writes** (literal / split / $VAR / rm) → settings.
+    if (hasAuthzMutatingCli(tokens))
+        found.add("settings");
+    if (hasAuthzDirShellWrite(cmd, tokens))
+        found.add("settings");
+    // Split path write: `cd .deft && echo x > authz/state.json` OR `cd .deft/authz && echo x > state.json`
+    // OR `cd .deft/authz && cp … grants/x` (write bin without redirect).
+    // When the command cds into an authz path, any write shape is settings (relative dest has no "authz" text).
+    {
+        let cdsIntoAuthz = false;
+        for (let ti = 0; ti < tokens.length - 1; ti++) {
+            const bin = normalizeToken(tokens[ti]);
+            if (bin !== "cd" && bin !== "pushd" && bin !== "set-location" && bin !== "sl")
+                continue;
+            const dest = pathishToken(tokens[ti + 1]);
+            if (dest.includes("authz")) {
+                cdsIntoAuthz = true;
+                break;
+            }
+        }
+        if (cdsIntoAuthz && hasWriteShape(cmd, tokens)) {
+            found.add("settings");
+        }
+        else if (hasSplitAuthzPath(cmd) && cmd.includes(">")) {
+            // Scan every `>` region — not only the last — so a later `> /tmp/x` cannot hide an earlier store write.
+            const lower = cmd.toLowerCase().replace(/\\/g, "/");
+            for (let i = 0; i < lower.length; i++) {
+                if (lower[i] !== ">")
+                    continue;
+                let j = i + 1;
+                if (j < lower.length && lower[j] === ">")
+                    j++;
+                let end = j;
+                while (end < lower.length &&
+                    lower[end] !== "|" &&
+                    lower[end] !== ";" &&
+                    lower[end] !== "&" &&
+                    lower[end] !== "\n") {
+                    end++;
+                }
+                if (lower.slice(j, end).includes("authz")) {
+                    found.add("settings");
+                    break;
+                }
+            }
+        }
+    }
+    if (hasIndirectAuthzStoreWrite(cmd, tokens))
+        found.add("settings");
     return [...found];
 }
 /** Map a PreToolUse tool name + optional shell command to authz ops. */

package/dist/doctor/main.js

@@ -517,8 +517,11 @@ export function runAgentHooksHealthCheck(projectRoot, consumerContext, sink, add
             });
             return false;
         }
-        const message = `${checkName}: registered and structurally valid; ` +
-            "Codex runtime trust is user-controlled and must be reviewed with `/hooks`";
+        const codexEnabled = result.registrations.some((entry) => entry.host === "codex" && entry.status !== "disabled");
+        const message = `${checkName}: registered and structurally valid` +
+            (codexEnabled
+                ? "; Codex trust is manual-review-required — open `/hooks` to review the project commands"
+                : "");
         sink.success(message);
         addFinding({
             severity: "skip",
@@ -526,8 +529,11 @@ export function runAgentHooksHealthCheck(projectRoot, consumerContext, sink, add
             check: checkName,
             status: "registered",
             registrations: result.registrations,
-            trust_status: "not-verifiable",
-            trust_review: "Open `/hooks` in Codex and review the project hook commands.",
+            trust_status: codexEnabled ? "manual-review-required" : "not-applicable",
+            trust_review: codexEnabled
+                ? "Open `/hooks` in Codex and review the exact project hook commands."
+                : null,
+            interception_status: "not-directly-verified",
         });
         return true;
     }
@@ -543,7 +549,25 @@ export function runAgentHooksLiveProbeCheck(projectRoot, sink, addFinding, seams
     const liveCheckName = "agent-hooks-live-probe";
     try {
         const result = (seams.evaluateAgentHooks ?? evaluateAgentHooks)(projectRoot);
-        const liveResult = (seams.probeAgentHooksLive ?? probeAgentHooksLive)(projectRoot);
+        if (result.code !== 0) {
+            const message = `${checkName}: ${result.message.replace(/\s+/g, " ").trim()}`;
+            sink.warn(message);
+            addFinding({
+                severity: "warning",
+                message,
+                check: checkName,
+                status: result.code === 2 ? "unavailable" : "incomplete",
+                registrations: result.registrations,
+                suggestion: "deft update",
+            });
+            return;
+        }
+        const enabledHosts = result.registrations
+            .filter((entry) => entry.status !== "disabled")
+            .map((entry) => entry.host);
+        const liveResult = (seams.probeAgentHooksLive ?? probeAgentHooksLive)(projectRoot, {
+            hosts: enabledHosts,
+        });
         if (liveResult.code !== 0) {
             const message = `${liveCheckName}: ${liveResult.message.replace(/\s+/g, " ").trim()}`;
             sink.warn(message);
@@ -557,8 +581,12 @@ export function runAgentHooksLiveProbeCheck(projectRoot, sink, addFinding, seams
             });
             return;
         }
-        const message = `${checkName}: registered, structurally valid, and live probe passed; ` +
-            "Codex runtime trust is user-controlled and must be reviewed with `/hooks`";
+        const codexEnabled = result.registrations.some((entry) => entry.host === "codex" && entry.status !== "disabled");
+        const message = `${checkName}: registered, structurally valid, and live probe passed` +
+            (codexEnabled
+                ? "; Codex trust is manual-review-required — open `/hooks` to review the project commands"
+                : "") +
+            "; direct shim invocation does not verify host interception";
         sink.success(message);
         addFinding({
             severity: "skip",
@@ -566,9 +594,13 @@ export function runAgentHooksLiveProbeCheck(projectRoot, sink, addFinding, seams
             check: liveCheckName,
             status: "registered-and-functional",
             registrations: result.registrations,
-            trust_status: "not-verifiable",
-            trust_review: "Open `/hooks` in Codex and review the project hook commands.",
+            trust_status: codexEnabled ? "manual-review-required" : "not-applicable",
+            trust_review: codexEnabled
+                ? "Open `/hooks` in Codex and review the exact project hook commands."
+                : null,
+            interception_status: "not-directly-verified",
             live_probe: "passed",
+            live_probe_duration_ms: liveResult.durationMs,
         });
     }
     catch (cause) {

package/dist/doctor/types.d.ts

@@ -4,7 +4,7 @@ import type { EngineProbeResult } from "../resolution/classify.js";
 import type { ResolutionMode } from "../resolution/index.js";
 import type { ResolveUserMdResult } from "../user-config/resolve-user-md.js";
 import type { AgentHookHealthResult } from "../verify-env/agent-hooks.js";
-import type { AgentHookLiveProbeResult } from "../verify-env/agent-hooks-live-probe.js";
+import type { AgentHookLiveProbeResult, AgentHookLiveProbeSeams } from "../verify-env/agent-hooks-live-probe.js";
 export declare const EXIT_CLEAN = 0;
 export declare const EXIT_DRIFT = 1;
 export declare const EXIT_CONFIG_ERROR = 2;
@@ -153,7 +153,7 @@ export interface DoctorSeams {
     /** Read-only agent-host hook registration probe (#2438). */
     readonly evaluateAgentHooks?: (projectRoot: string) => AgentHookHealthResult;
     /** Live hook spawn probe for doctor --full (#2852). */
-    readonly probeAgentHooksLive?: (projectRoot: string) => AgentHookLiveProbeResult;
+    readonly probeAgentHooksLive?: (projectRoot: string, seams?: AgentHookLiveProbeSeams) => AgentHookLiveProbeResult;
     /**
      * xBRIEF project-envelope staleness probe (#2971). Injected so doctor can
      * fail closed on 0.6 project JSON under an xbrief/ layout without re-deriving

package/dist/freshness/bind.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Session bind of live deposit generation (#3117).
+ *
+ * Host-agnostic storage:
+ * - Default (no sessionId): `.deft/session-bind.json` — single-operator convenience.
+ * - With sessionId: `.deft/session-binds/<safeId>.json` — isolated multi-session binds.
+ *
+ * Multi-agent hosts MUST pass a stable host session identity when binding and
+ * reporting so one session cannot certify another as current.
+ */
+import { type BoundGeneration, type LiveGeneration } from "./types.js";
+/** Relative path for the default (no-sessionId) bind record. */
+export declare const SESSION_BIND_REL: string;
+/** Directory for per-session bind records. */
+export declare const SESSION_BINDS_DIR_REL: string;
+export declare function sessionBindPath(projectRoot: string, sessionId?: string | null): string;
+/**
+ * Stable filesystem-safe file name for a host session id.
+ * Keeps a short prefix for debug, hashes the rest to avoid path injection.
+ * Character filter is O(n) (no regex) — CodeQL poly-redos on uncontrolled ids.
+ */
+export declare function safeSessionFileName(sessionId: string): string;
+export interface BindSessionOptions {
+    readonly sessionId?: string | null;
+    readonly nowIso?: string;
+    /**
+     * When live generation is missing (legacy deposit), stamp generation 1 from
+     * contentVersion before binding. Default true.
+     */
+    readonly ensureLive?: boolean;
+    /** Used only when ensuring a missing live token. */
+    readonly contentVersion?: string;
+    readonly stampedBy?: string;
+    /**
+     * When binding with a sessionId, also write the default bind path.
+     * Default **false** — multi-agent isolation requires hosts to report with
+     * `--session-id`. Enabling this reopens cross-session false-current (Greptile).
+     */
+    readonly alsoWriteDefault?: boolean;
+    /**
+     * Host attests that payload surfaces for the live generation were reloaded
+     * into the session. Required for trusted readiness. Default false.
+     */
+    readonly payloadLoaded?: boolean;
+}
+export interface ReadBoundOptions {
+    /** When set, read only that session's bind (never the default). */
+    readonly sessionId?: string | null;
+}
+/** Parse a bound generation record (null if invalid). */
+export declare function parseBoundGeneration(raw: unknown): BoundGeneration | null;
+/** Read the session bind record (null when absent/unreadable). */
+export declare function readBoundGeneration(projectRoot: string, options?: ReadBoundOptions): BoundGeneration | null;
+/**
+ * Bind the current live generation into session context.
+ *
+ * Does not require restarting a shared host runtime — callers re-load payload
+ * surfaces into the session and call this (or `freshness:bind`) to rebind.
+ *
+ * Multi-agent hosts MUST supply `sessionId` so binds do not overwrite each other.
+ */
+export declare function bindSessionGeneration(projectRoot: string, options?: BindSessionOptions): {
+    bound: BoundGeneration;
+    live: LiveGeneration;
+    path: string;
+};
+//# sourceMappingURL=bind.d.ts.map