@deftai/directive-core 0.95.0 → 0.97.0

package/dist/scope/promote-from-issue.js

@@ -0,0 +1,367 @@
+/**
+ * scope:promote --from-issue reciprocity gate (#1136 / D18).
+ *
+ * Gates promote of a proposed scope on the latest triage-cache decision for
+ * the issue, locates the proposed artifact via provenance scan, and runs the
+ * shared promotePath path (WIP rules unchanged).
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { provenanceIssueNumber, scanProvenanceRefs } from "../intake/issue-ingest.js";
+import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
+import { createCandidatesLog, resolveAuditLogPath } from "../triage/actions/candidates-log.js";
+import { resolveRepo } from "../triage/queue/repo.js";
+import { resolveProjectRoot } from "./project-context.js";
+import { promotePath } from "./promote-path.js";
+/** Collapse CR/LF in operator-facing messages (SLizard CWE-116). */
+function sanitizeMsg(value) {
+    return value.replace(/\r?\n/g, " ");
+}
+/** True when brief references or Origin point at owner/name issue N. */
+function briefMatchesIssueAndRepo(data, issueNumber, repo) {
+    if (provenanceIssueNumber(data) !== issueNumber) {
+        // Also accept plan.references github-issue URIs without Origin text.
+        const plan = data.plan;
+        if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
+            return false;
+        }
+        const refs = plan.references;
+        if (!Array.isArray(refs)) {
+            return false;
+        }
+        let hit = false;
+        for (const ref of refs) {
+            if (typeof ref !== "object" || ref === null || Array.isArray(ref))
+                continue;
+            const uri = String(ref.uri ?? "");
+            if (uri.includes(`/issues/${issueNumber}`)) {
+                hit = true;
+                if (repo === null ||
+                    uri.includes(`github.com/${repo}/`) ||
+                    uri.includes(`${repo}/issues/`)) {
+                    return true;
+                }
+            }
+        }
+        return hit && repo === null;
+    }
+    if (repo === null) {
+        return true;
+    }
+    const plan = data.plan;
+    if (typeof plan === "object" && plan !== null && !Array.isArray(plan)) {
+        const refs = plan.references;
+        if (Array.isArray(refs)) {
+            for (const ref of refs) {
+                if (typeof ref !== "object" || ref === null || Array.isArray(ref))
+                    continue;
+                const uri = String(ref.uri ?? "");
+                if (uri.includes(`/issues/${issueNumber}`) &&
+                    (uri.includes(`github.com/${repo}/`) || uri.includes(`${repo}/issues/`))) {
+                    return true;
+                }
+            }
+        }
+        const narratives = plan.narratives;
+        if (typeof narratives === "object" && narratives !== null && !Array.isArray(narratives)) {
+            const origin = String(narratives.Origin ?? "");
+            if (origin.includes(`github.com/${repo}/issues/${issueNumber}`)) {
+                return true;
+            }
+        }
+    }
+    // Provenance matched issue number but no repo-scoped URI — refuse when repo known.
+    return false;
+}
+/**
+ * Locate lifecycle artifacts whose provenance owns ``issueNumber`` (optionally repo-scoped).
+ */
+export function findLifecycleArtifactsForIssue(projectRoot, issueNumber, options = {}) {
+    const folder = options.folder ?? "proposed";
+    const repo = options.repo ?? null;
+    const root = resolve(projectRoot);
+    let lifecycleRoot;
+    try {
+        lifecycleRoot = resolveLifecycleRoot(root);
+    }
+    catch {
+        return [];
+    }
+    const byIssue = scanProvenanceRefs(lifecycleRoot);
+    const rels = (byIssue.get(issueNumber) ?? []).filter((rel) => {
+        const f = rel.split(/[/\\]/)[0];
+        return f === folder;
+    });
+    const candidates = rels.map((rel) => join(lifecycleRoot, rel));
+    // Always also scan the folder for Origin-only scaffolds.
+    const folderDir = join(lifecycleRoot, folder);
+    if (existsSync(folderDir)) {
+        for (const name of readdirSync(folderDir).filter((f) => hasArtifactSuffix(f))) {
+            candidates.push(join(folderDir, name));
+        }
+    }
+    const out = [];
+    for (const abs of uniqueExisting(candidates)) {
+        try {
+            const data = JSON.parse(readFileSync(abs, "utf8"));
+            if (briefMatchesIssueAndRepo(data, issueNumber, repo)) {
+                out.push(abs);
+            }
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return uniqueExisting(out);
+}
+/** Locate proposed/ artifacts for issue N (repo-scoped when provided). */
+export function findProposedArtifactsForIssue(projectRoot, issueNumber, repo = null) {
+    return findLifecycleArtifactsForIssue(projectRoot, issueNumber, { folder: "proposed", repo });
+}
+function uniqueExisting(paths) {
+    const seen = new Set();
+    const out = [];
+    for (const p of paths) {
+        const key = resolve(p);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        if (existsSync(key)) {
+            out.push(key);
+        }
+    }
+    return out.sort();
+}
+function resolveLatestDecision(options, projectRoot, repo) {
+    if (options.latestDecision !== undefined) {
+        return options.latestDecision;
+    }
+    const log = createCandidatesLog(projectRoot);
+    const path = options.candidatesLogPath ?? resolveAuditLogPath(projectRoot);
+    return log.latestDecision(options.issueNumber, repo, { path });
+}
+/**
+ * Promote the proposed scope for an issue, gated on triage-cache latestDecision.
+ */
+export function promoteFromIssue(options) {
+    const warnings = [];
+    const projectRoot = resolveProjectRoot(options.projectRoot);
+    if (projectRoot === null) {
+        return {
+            ok: false,
+            message: "Cannot determine project root. Pass --project-root PATH, set $DEFT_PROJECT_ROOT, or run from inside a directory tree that contains vbrief/ or .git/ (#535).",
+            exitCode: 2,
+            warnings,
+            repo: null,
+            matchedPaths: [],
+            cacheStateAtPromote: null,
+            cacheDecisionId: null,
+        };
+    }
+    const repo = resolveRepo(options.repo, projectRoot);
+    if (repo === null) {
+        return {
+            ok: false,
+            message: "scope:promote --from-issue requires --repo OWNER/NAME (or $DEFT_TRIAGE_REPO / git remote origin).",
+            exitCode: 2,
+            warnings,
+            repo: null,
+            matchedPaths: [],
+            cacheStateAtPromote: null,
+            cacheDecisionId: null,
+        };
+    }
+    const repoSafe = sanitizeMsg(repo);
+    const n = options.issueNumber;
+    if (!Number.isInteger(n) || n < 1) {
+        return {
+            ok: false,
+            message: `Invalid --from-issue value: ${String(options.issueNumber)} (expected positive integer).`,
+            exitCode: 2,
+            warnings,
+            repo,
+            matchedPaths: [],
+            cacheStateAtPromote: null,
+            cacheDecisionId: null,
+        };
+    }
+    const latest = resolveLatestDecision(options, projectRoot, repo);
+    const cacheState = latest?.decision ?? null;
+    const cacheDecisionId = latest?.decision_id ?? null;
+    const forceNoCache = options.forceNoCache === true;
+    if (!forceNoCache) {
+        if (latest === null) {
+            if (options.strict === true) {
+                return {
+                    ok: false,
+                    message: `No triage-cache decision for #${n} (${repoSafe}). ` +
+                        `Accept first: task triage:accept -- --issue ${n} --repo ${repoSafe} ` +
+                        `(or omit --strict to soft-warn and proceed; --force-no-cache skips the gate).`,
+                    exitCode: 1,
+                    warnings,
+                    repo,
+                    matchedPaths: [],
+                    cacheStateAtPromote: null,
+                    cacheDecisionId: null,
+                };
+            }
+            warnings.push(`[scope:promote --from-issue] no triage-cache decision for #${n} (${repoSafe}); proceeding (soft warn). Use --strict to fail.`);
+        }
+        else if (latest.decision !== "accept") {
+            return {
+                ok: false,
+                message: `Refusing promote for #${n} (${repoSafe}): latest triage decision is '${sanitizeMsg(latest.decision)}' ` +
+                    `(decision_id=${latest.decision_id}). ` +
+                    `Accept first: task triage:accept -- --issue ${n} --repo ${repoSafe} ` +
+                    `or override with --force-no-cache.`,
+                exitCode: 1,
+                warnings,
+                repo,
+                matchedPaths: [],
+                cacheStateAtPromote: cacheState,
+                cacheDecisionId,
+            };
+        }
+    }
+    else {
+        warnings.push(`[scope:promote --from-issue] --force-no-cache: skipped reciprocity gate for #${n} ` +
+            `(cache decision was ${cacheState === null ? "absent" : `'${sanitizeMsg(cacheState)}'`}).`);
+    }
+    // Already in pending/ for this issue → idempotent success (auto-promote re-entry).
+    const alreadyPending = findLifecycleArtifactsForIssue(projectRoot, n, {
+        folder: "pending",
+        repo,
+    });
+    if (alreadyPending.length === 1 && options.explicitPath === undefined) {
+        warnings.push(`[scope:promote --from-issue] #${n} already pending (${sanitizeMsg(alreadyPending[0] ?? "")}); no-op.`);
+        return {
+            ok: true,
+            message: `No-op: issue #${n} already has pending scope ${alreadyPending[0]}`,
+            exitCode: 0,
+            warnings,
+            repo,
+            matchedPaths: alreadyPending,
+            cacheStateAtPromote: cacheState,
+            cacheDecisionId: forceNoCache && cacheState !== "accept" ? null : cacheDecisionId,
+            destPath: alreadyPending[0],
+        };
+    }
+    let matched = findProposedArtifactsForIssue(projectRoot, n, repo);
+    if (options.explicitPath !== undefined && options.explicitPath.trim().length > 0) {
+        const raw = options.explicitPath.trim();
+        const explicit = isAbsolute(raw) ? resolve(raw) : resolve(projectRoot, raw);
+        if (!existsSync(explicit)) {
+            return {
+                ok: false,
+                message: `Explicit path not found: ${sanitizeMsg(explicit)}`,
+                exitCode: 2,
+                warnings,
+                repo,
+                matchedPaths: matched,
+                cacheStateAtPromote: cacheState,
+                cacheDecisionId,
+            };
+        }
+        // Never accept an unrelated path — must match issue provenance (and repo).
+        try {
+            const data = JSON.parse(readFileSync(explicit, "utf8"));
+            if (!briefMatchesIssueAndRepo(data, n, repo)) {
+                return {
+                    ok: false,
+                    message: `Explicit path is not a provenance match for #${n} (${repoSafe}): ${sanitizeMsg(explicit)}.`,
+                    exitCode: 2,
+                    warnings,
+                    repo,
+                    matchedPaths: matched,
+                    cacheStateAtPromote: cacheState,
+                    cacheDecisionId,
+                };
+            }
+        }
+        catch (err) {
+            return {
+                ok: false,
+                message: `Explicit path is not readable JSON: ${sanitizeMsg(explicit)} (${String(err)})`,
+                exitCode: 2,
+                warnings,
+                repo,
+                matchedPaths: matched,
+                cacheStateAtPromote: cacheState,
+                cacheDecisionId,
+            };
+        }
+        if (matched.length > 0) {
+            const hit = matched.find((p) => resolve(p) === explicit);
+            if (hit === undefined) {
+                return {
+                    ok: false,
+                    message: `Explicit path is not among proposed matches for #${n}: ${sanitizeMsg(explicit)}. ` +
+                        `Matched: ${matched.map(sanitizeMsg).join(", ")}`,
+                    exitCode: 2,
+                    warnings,
+                    repo,
+                    matchedPaths: matched,
+                    cacheStateAtPromote: cacheState,
+                    cacheDecisionId,
+                };
+            }
+            matched = [hit];
+        }
+        else {
+            matched = [explicit];
+        }
+    }
+    if (matched.length === 0) {
+        return {
+            ok: false,
+            message: `No proposed/ scope artifact found for issue #${n} (${repoSafe}). ` +
+                `Ingest first (task triage:accept -- --issue ${n} --repo ${repoSafe}) ` +
+                `or pass an explicit path: task scope:promote -- <path>.`,
+            exitCode: 1,
+            warnings,
+            repo,
+            matchedPaths: [],
+            cacheStateAtPromote: cacheState,
+            cacheDecisionId,
+        };
+    }
+    if (matched.length > 1) {
+        const list = matched.map((p) => `  - ${sanitizeMsg(p)}`).join("\n");
+        return {
+            ok: false,
+            message: `Multiple proposed/ artifacts match issue #${n}; refuse to guess.\n${list}\n` +
+                `Promote one path explicitly: task scope:promote -- <path> ` +
+                `or re-run with --path <one-of-the-above>.`,
+            exitCode: 1,
+            warnings,
+            repo,
+            matchedPaths: matched,
+            cacheStateAtPromote: cacheState,
+            cacheDecisionId,
+        };
+    }
+    const filePath = matched[0];
+    const promoteResult = promotePath(filePath, {
+        projectRoot,
+        force: options.force,
+        actor: options.actor,
+        now: options.now,
+        fromIssue: n,
+        cacheDecisionId: forceNoCache && cacheState !== "accept" ? null : cacheDecisionId,
+        cacheStateAtPromote: cacheState,
+        forceNoCache,
+        requireAudit: true,
+    });
+    warnings.push(`[scope:promote --from-issue] cache decision for #${n} was ` +
+        `${cacheState === null ? "absent" : `'${sanitizeMsg(cacheState)}'`}` +
+        (promoteResult.ok ? " (proceeded)" : " (promote failed)"));
+    return {
+        ...promoteResult,
+        warnings,
+        repo,
+        matchedPaths: matched,
+        cacheStateAtPromote: cacheState,
+        cacheDecisionId: forceNoCache && cacheState !== "accept" ? null : cacheDecisionId,
+    };
+}
+//# sourceMappingURL=promote-from-issue.js.map

package/dist/scope/promote-path.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared single-path promote (proposed/ → pending/) with optional triage audit linkage (#1136).
+ */
+export interface PromotePathOptions {
+    readonly projectRoot?: string;
+    /** WIP-cap override (--force). */
+    readonly force?: boolean;
+    readonly actor?: string;
+    readonly now?: Date;
+    /** Issue number that triggered this promote (from-issue / auto-promote). */
+    readonly fromIssue?: number;
+    /** Accept (or other) decision_id from candidates.jsonl, when known. */
+    readonly cacheDecisionId?: string | null;
+    /** Latest cache decision string at promote time (accept / defer / null). */
+    readonly cacheStateAtPromote?: string | null;
+    /** True when reciprocity gate was skipped via --force-no-cache. */
+    readonly forceNoCache?: boolean;
+    /** Write promote audit entry even without from-issue linkage (default: only when linkage present). */
+    readonly alwaysAudit?: boolean;
+    /**
+     * When true, audit append failure is a hard error (from-issue / auto-promote
+     * require from_issue + cache fields). Default false for plain path promote.
+     */
+    readonly requireAudit?: boolean;
+}
+export interface PromotePathResult {
+    readonly ok: boolean;
+    readonly message: string;
+    readonly exitCode: number;
+    readonly destPath?: string;
+    readonly auditEntry?: Record<string, unknown> | null;
+    readonly wipCapOverride?: boolean;
+}
+/**
+ * Promote a single proposed-scope path to pending/, enforcing WIP and
+ * optionally recording from_issue / cache_decision_id on the scope audit log.
+ */
+export declare function promotePath(filePath: string, options?: PromotePathOptions): PromotePathResult;
+//# sourceMappingURL=promote-path.d.ts.map

package/dist/scope/promote-path.js

@@ -0,0 +1,105 @@
+/**
+ * Shared single-path promote (proposed/ → pending/) with optional triage audit linkage (#1136).
+ */
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { append, canonicalLogPath, newDecisionId } from "./audit-log.js";
+import { resolveProjectRoot } from "./project-context.js";
+import { recordWipCapOverride, runTransition } from "./transition.js";
+import { utcNowIso } from "./vbrief-json.js";
+import { canonicalRelpath } from "./vbrief-ref.js";
+import { checkWipCap, formatWipCapRefusal } from "./wip-cap-check.js";
+/**
+ * Promote a single proposed-scope path to pending/, enforcing WIP and
+ * optionally recording from_issue / cache_decision_id on the scope audit log.
+ */
+export function promotePath(filePath, options = {}) {
+    const root = resolveProjectRoot(options.projectRoot);
+    if (root === null) {
+        return {
+            ok: false,
+            message: "Cannot determine project root. Pass --project-root PATH, set $DEFT_PROJECT_ROOT, or run from inside a directory tree that contains vbrief/ or .git/ (#535).",
+            exitCode: 2,
+        };
+    }
+    const resolved = resolve(filePath);
+    if (!existsSync(resolved)) {
+        return { ok: false, message: `File not found: ${resolved}`, exitCode: 2 };
+    }
+    const capCheck = checkWipCap(root, options.force === true);
+    if (!capCheck.allowed) {
+        return {
+            ok: false,
+            message: formatWipCapRefusal(capCheck),
+            exitCode: 1,
+        };
+    }
+    const now = options.now ?? new Date();
+    const result = runTransition("promote", resolved, now);
+    if (!result.ok) {
+        return { ok: false, message: result.message, exitCode: 1 };
+    }
+    const basename = resolved.split(/[/\\]/).pop() ?? "";
+    // Destination after promote is sibling pending/ under the same lifecycle root.
+    const lifecycleRoot = dirname(dirname(resolved));
+    const destPath = join(lifecycleRoot, "pending", basename);
+    let auditEntry = null;
+    const shouldAudit = options.alwaysAudit === true ||
+        options.fromIssue !== undefined ||
+        options.forceNoCache === true ||
+        options.cacheDecisionId !== undefined ||
+        options.cacheStateAtPromote !== undefined;
+    if (shouldAudit) {
+        try {
+            const entry = {
+                decision_id: newDecisionId(),
+                timestamp: utcNowIso(now),
+                action: "promote",
+                vbrief_path: canonicalRelpath(destPath, root),
+                from_status: "proposed",
+                to_status: "pending",
+                actor: options.actor ?? "operator",
+            };
+            if (options.fromIssue !== undefined) {
+                entry.from_issue = options.fromIssue;
+            }
+            if (options.cacheDecisionId !== undefined) {
+                entry.cache_decision_id = options.cacheDecisionId;
+            }
+            if (options.cacheStateAtPromote !== undefined) {
+                entry.cache_state_at_promote = options.cacheStateAtPromote;
+            }
+            if (options.forceNoCache === true) {
+                entry.force_no_cache = true;
+            }
+            append(entry, canonicalLogPath(root));
+            auditEntry = entry;
+        }
+        catch (err) {
+            if (options.requireAudit === true) {
+                return {
+                    ok: false,
+                    message: `Promoted ${basename} to pending/ but required scope audit failed: ${String(err)}. ` +
+                        `Artifact is in pending/; re-run promote will no-op once audit is writable.`,
+                    exitCode: 1,
+                    destPath,
+                    auditEntry: null,
+                    wipCapOverride: capCheck.forceOverride,
+                };
+            }
+            /* best-effort audit for plain path promote */
+        }
+    }
+    if (capCheck.forceOverride) {
+        recordWipCapOverride(destPath, root, capCheck, now);
+    }
+    return {
+        ok: true,
+        message: result.message,
+        exitCode: 0,
+        destPath,
+        auditEntry,
+        wipCapOverride: capCheck.forceOverride,
+    };
+}
+//# sourceMappingURL=promote-path.js.map

package/dist/scope-provenance/digest.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Approved-scope digest helpers (#3145).
+ *
+ * At activation/approval time, record an immutable digest of the human-approved
+ * file_scope. PR verification compares the live active xBRIEF against this
+ * baseline so same-PR xBRIEF edits cannot self-authorize new paths.
+ */
+/** Immutable approved-scope record written under `.deft/approved-scope/`. */
+export interface ApprovedScopeRecord {
+    readonly schemaVersion: 1;
+    /** Repo-relative path of the active xBRIEF at approval time. */
+    readonly xbriefRelPath: string;
+    readonly planId: string;
+    /** ISO-8601 UTC timestamp of approval / activation. */
+    readonly approvedAt: string;
+    /** Sorted unique file_scope paths frozen at approval. */
+    readonly fileScope: readonly string[];
+    /** sha256 hex of normalized file_scope lines. */
+    readonly fileScopeDigest: string;
+    /**
+     * Optional human-origin stamp (refs #2944). When present on renewal,
+     * re-approval is accepted. Agent-only stamps are ignored by evaluate.
+     */
+    readonly humanApproval?: {
+        readonly kind: string;
+        readonly actor: string;
+        readonly mintedAt: string;
+        readonly mintedVia?: string;
+    };
+    /** Digest of the full xBRIEF canonical JSON body (optional stronger pin). */
+    readonly xbriefBodyDigest?: string;
+}
+export declare const APPROVED_SCOPE_DIR = ".deft/approved-scope";
+/** Normalize and sort scope paths for stable digests. */
+export declare function normalizeFileScope(paths: readonly string[]): string[];
+/** sha256 hex of normalized file_scope (one path per line). */
+export declare function computeFileScopeDigest(paths: readonly string[]): string;
+/** sha256 hex of raw UTF-8 text. */
+export declare function computeTextDigest(text: string): string;
+/** Extract plan.metadata.swarm.file_scope from an xBRIEF payload. */
+export declare function extractFileScope(payload: unknown): string[];
+/** Extract plan.id from an xBRIEF payload. */
+export declare function extractPlanId(payload: unknown): string | null;
+export declare function approvedScopeDir(projectRoot: string): string;
+export declare function approvedScopeRecordPath(projectRoot: string, planId: string): string;
+/** Build an ApprovedScopeRecord from xBRIEF payload + metadata. */
+export declare function buildApprovedScopeRecord(input: {
+    readonly xbriefRelPath: string;
+    readonly payload: unknown;
+    readonly approvedAt?: string;
+    readonly humanApproval?: ApprovedScopeRecord["humanApproval"];
+    readonly xbriefRawText?: string;
+}): ApprovedScopeRecord;
+/** Persist approved-scope record (activation / renewed human approval). */
+export declare function writeApprovedScopeRecord(projectRoot: string, record: ApprovedScopeRecord): string;
+/** Load one approved-scope record by plan id, or null if missing. */
+export declare function readApprovedScopeRecord(projectRoot: string, planId: string): ApprovedScopeRecord | null;
+/** Load all approved-scope records under `.deft/approved-scope/`. */
+export declare function listApprovedScopeRecords(projectRoot: string): ApprovedScopeRecord[];
+/**
+ * Paths present in `current` but not in `approved` (normalized).
+ * These are the expansion set that cannot self-authorize.
+ */
+export declare function scopeExpansion(approved: readonly string[], current: readonly string[]): string[];
+/** True when actor/kind look like human provenance (mirrors authz subset). */
+export declare function isHumanApprovalStamp(stamp: ApprovedScopeRecord["humanApproval"] | null | undefined): boolean;
+//# sourceMappingURL=digest.d.ts.map