@deftai/directive-core 0.95.0 → 0.97.0

package/dist/triage/help/registry-data.js

@@ -170,9 +170,9 @@ export const registryData = {
         "task triage:queue": {
             name: "task triage:queue",
             summary: "Ranked candidate list",
-            refs: "(D11 / #1128)",
-            description: "Print the ranked triage queue from the local cache. Groups (display order): [ORPHAN] -> [RESUME] -> [URGENT] -> untriaged -> other -> [BLOCKED]. Within-group default = updated_at desc; consumer plan.policy.triageRankingLabels[] re-orders within-group by matched-label declared order. Items whose linked vBRIEF is blocked (status:blocked / unresolved depends_on) are demoted into [BLOCKED] unless --include-blocked is passed (#1286).",
-            usage: "task triage:queue [-- --limit=N] [--include-blocked] [--repo=owner/name]",
+            refs: "(D11 / #1128, #3129 / #1318 Layer 1)",
+            description: "Print the ranked triage queue from the local cache. Groups (display order): [ORPHAN] -> [RESUME] -> [URGENT] -> untriaged -> other -> [BLOCKED]. Within-group default = updated_at desc; consumer plan.policy.triageRankingLabels[] re-orders within-group by matched-label declared order. Items whose linked vBRIEF is blocked (status:blocked / unresolved depends_on) are demoted into [BLOCKED] unless --include-blocked is passed (#1286). Optional --author LOGIN filters to cache author.login (exact; @me resolves to authenticated login; comma allow-list; missing author counted as unknown and disclosed in the header) (#3129 / #1318 Layer 1).",
+            usage: "task triage:queue [-- --limit=N] [--include-blocked] [--repo=owner/name] [--author LOGIN|@me] [--author-mine]",
             flags: [
                 ["--limit N", "10", "Max rows to print."],
                 [
@@ -181,13 +181,26 @@ export const registryData = {
                     "Re-surface blocked items into their natural group (#1286).",
                 ],
                 ["--repo owner/name", "(git remote)", "Explicit repo override."],
+                [
+                    "--author LOGIN|@me",
+                    "(none)",
+                    "Only issues whose cache author.login matches (exact; @me = gh user; comma allow-list) (#3129).",
+                ],
+                ["--author-mine", "(off)", "Alias for --author @me (#1318 / #3129)."],
             ],
             examples: [
                 "task triage:queue",
-                "task triage:queue -- --limit=20 --state=accept",
-                "task triage:queue -- --format=json | jq '.[] | select(.score > 5)'",
+                "task triage:queue -- --limit=20",
+                "task triage:queue -- --author @me",
+                "task triage:queue -- --author alice,bob --limit=20",
+            ],
+            see_also: [
+                "task triage:show",
+                "task triage:audit",
+                "task triage:classify",
+                "#1119 / D11",
+                "#3129",
             ],
-            see_also: ["task triage:show", "task triage:audit", "#1119 / D11"],
             placeholder: false,
         },
         "task triage:audit": {
@@ -264,28 +277,49 @@ export const registryData = {
         },
         "task triage:classify": {
             name: "task triage:classify",
-            summary: "Inspect / validate auto-classification surface; Tier-1 SCM label mirror",
-            refs: "(D10 / #1129, #1423 Wave 1)",
-            description: "Inspect or validate the auto-classification rule set. --list renders effective rules (framework universal first, consumer overrides next). --validate exits non-zero on a malformed plan.policy.triageAutoClassify or triageLabelMirror. --mirror runs the Tier-1 deterministic SCM label mirror over the github-issue cache (dry-run default; --apply writes via SCM boundary). Never calls triage:accept / never writes proposed/ xBRIEFs.",
-            usage: "task triage:classify -- [--list | --validate | --mirror [--apply] [--repo owner/name] [--json] [--allow-cross-repo]]",
+            summary: "Inspect / validate auto-classification; bootstrap mass-triage label mirror",
+            refs: "(D10 / #1129, #1423 Wave 1–2 / #3125, #3129)",
+            description: "Inspect or validate the auto-classification rule set. --list renders effective rules (framework universal first, consumer overrides next). --validate exits non-zero on a malformed plan.policy.triageAutoClassify or triageLabelMirror. --mirror is the bootstrap mass-triage entrypoint (#3125): classifies the github-issue cache and mirrors outcomes as SCM labels. Open-only by default (opt-in --include-closed); optional --author LOGIN scopes plan/apply to matching author.login (AND with open-only; #3129); dry-run digest shows totals + by state/rule/action + samples and surfaces the author filter; --apply batches writes with rate-limit delay. Never calls triage:accept / never writes proposed/ xBRIEFs.",
+            usage: "task triage:classify -- [--list | --validate | --mirror [--apply] [--include-closed] [--author LOGIN|@me] [--repo owner/name] [--batch-size N] [--delay-ms N] [--sample-limit N] [--json] [--allow-cross-repo]]",
             flags: [
                 ["--list", "(default)", "Print effective rules + hold markers."],
                 ["--validate", "(off)", "Validate plan.policy.triageAutoClassify + triageLabelMirror."],
                 [
                     "--mirror",
                     "(off)",
-                    "Tier-1 label mirror: classify cache → planned/applied labels (dry-run default).",
+                    "Bootstrap mass-triage label mirror: classify cache → planned/applied labels (dry-run default, open-only).",
+                ],
+                [
+                    "--apply",
+                    "(off)",
+                    "With --mirror: write labels via SCM (batched; requires github SCM boundary).",
+                ],
+                [
+                    "--include-closed",
+                    "(off)",
+                    "With --mirror: include closed issues (default open-only avoids archive mass-stamp).",
+                ],
+                [
+                    "--author LOGIN|@me",
+                    "(none)",
+                    "With --mirror: only plan/apply issues whose cache author.login matches (exact; @me; comma allow-list) (#3129).",
                 ],
-                ["--apply", "(off)", "With --mirror: write labels via SCM (requires github SCM boundary)."],
+                ["--author-mine", "(off)", "With --mirror: alias for --author @me (#3129)."],
                 ["--repo owner/name", "(all cached)", "Limit mirror to one repo."],
-                ["--json", "(off)", "With --mirror: structured JSON outcome."],
+                ["--batch-size N", "10", "With --mirror --apply: writes per batch before delay."],
+                ["--delay-ms N", "1000", "With --mirror --apply: ms sleep between batches (rate-limit)."],
+                ["--sample-limit N", "15", "With --mirror: max samples in human digest."],
+                ["--json", "(off)", "With --mirror: structured JSON outcome including digest aggregates."],
                 ["--allow-cross-repo", "(off)", "With --mirror --apply: allow non-project repos (#2601)."],
             ],
             examples: [
                 "task triage:classify -- --list",
                 "task triage:classify -- --validate",
                 "task triage:classify -- --mirror",
-                "task triage:classify -- --mirror --apply --repo owner/name",
+                "task triage:classify -- --mirror --author @me --repo owner/name",
+                "task triage:classify -- --mirror --repo owner/name --json",
+                "task triage:classify -- --mirror --apply --repo owner/name --batch-size 10 --delay-ms 1000",
+                "task triage:classify -- --mirror --include-closed --repo owner/name",
             ],
             see_also: [
                 "task triage:bootstrap",
@@ -293,6 +327,8 @@ export const registryData = {
                 "task vbrief:reconcile:labels",
                 "#1119 / D10",
                 "#1423",
+                "#3125",
+                "#3129",
             ],
             placeholder: false,
         },
@@ -493,40 +529,79 @@ export const registryData = {
             see_also: ["task triage:subscribe", "task triage:scope", "#1119 / D14"],
             placeholder: false,
         },
-        "task triage:audit:prune": {
-            name: "task triage:audit:prune",
-            summary: "Operator-invoked archive of closed-terminal entries",
-            refs: "(D19, coming)",
-            description: "Move closed-terminal audit entries (accept/reject/mark-duplicate after the upstream issue is closed) into the archive sidecar so the live cache stays focused on open work.",
-            usage: "task triage:audit:prune [-- --dry-run] [--older-than-days N]",
+        "task triage:cache-archive": {
+            name: "task triage:cache-archive",
+            summary: "Reversible archive of closed github-issue cache entries",
+            refs: "(#1137)",
+            description: "Move closed-and-aged live `.deft-cache/github-issue/` entries under `.deft-cache/archived/github-issue/...` with archive-meta.json. Operator-only; never auto on check/session/sync. Distinct from task cache:prune (TTL hard-delete). Skips issues referenced in xbrief/{proposed,pending,active}. Alias: cache:archive-closed.",
+            usage: "task triage:cache-archive -- [--dry-run] [--older-than-days 30] [--repo owner/name] [--json] [--terminal-decision-only]",
             flags: [
-                ["--dry-run", "(off)", "Preview eligible entries without writing."],
-                ["--older-than-days N", "30", "Age threshold."],
+                ["--dry-run", "(off)", "Report eligible entries without moving."],
+                ["--older-than-days N", "30", "Minimum age of closed_at (or fetched_at/mtime fallback)."],
+                ["--repo owner/name", "(all)", "Limit to one repo."],
+                ["--json", "(off)", "Structured summary."],
+                [
+                    "--terminal-decision-only",
+                    "(off)",
+                    "Only archive when latest candidates decision is reject or mark-duplicate.",
+                ],
             ],
-            examples: ["task triage:audit:prune -- --dry-run"],
-            see_also: ["task triage:archive-list", "task triage:restore-from-archive", "#1119 / D19"],
-            placeholder: true,
+            examples: [
+                "task triage:cache-archive -- --dry-run",
+                "task triage:cache-archive -- --older-than-days 30 --repo deftai/directive",
+            ],
+            see_also: [
+                "task triage:archive-list",
+                "task triage:restore-from-archive",
+                "task cache:prune",
+                "#1137",
+            ],
+            placeholder: false,
         },
         "task triage:archive-list": {
             name: "task triage:archive-list",
-            summary: "List archived entries",
-            refs: "(D19, coming)",
-            description: "Read-only listing of archived audit entries from the archive sidecar. Useful before restoring an entry.",
-            usage: "task triage:archive-list [-- --since=WINDOW]",
-            flags: [["--since WINDOW", "(all)", "Time window (e.g. '30d', '6mo')."]],
-            examples: ["task triage:archive-list"],
-            see_also: ["task triage:audit:prune", "#1119 / D19"],
-            placeholder: true,
+            summary: "List archived github-issue cache entries",
+            refs: "(#1137)",
+            description: "List `.deft-cache/archived/github-issue/...` entries newest archived_at first. Alias: cache:archive-list.",
+            usage: "task triage:archive-list -- [--repo owner/name] [--format=json] [--since ISO] [--limit N]",
+            flags: [
+                ["--repo owner/name", "(all)", "Limit to one repo."],
+                ["--format=json", "text", "JSON listing."],
+                ["--since ISO", "(none)", "Only entries archived at/after this timestamp."],
+                ["--limit N", "(none)", "Cap result count."],
+            ],
+            examples: ["task triage:archive-list -- --format=json"],
+            see_also: ["task triage:cache-archive", "task triage:restore-from-archive", "#1137"],
+            placeholder: false,
         },
         "task triage:restore-from-archive": {
             name: "task triage:restore-from-archive",
-            summary: "Restore archived entry to live cache",
-            refs: "(D19, coming)",
-            description: "Move an archived entry back to the live audit log so it becomes visible to triage:queue / triage:audit again.",
-            usage: "task triage:restore-from-archive -- <N>",
-            flags: [["<N>", "(required)", "Archived entry number to restore."]],
-            examples: ["task triage:restore-from-archive -- 42"],
-            see_also: ["task triage:archive-list", "#1119 / D19"],
+            summary: "Restore archived issue entry to live cache",
+            refs: "(#1137)",
+            description: "Move an archived github-issue entry back to the live key path. Idempotent if already live with matching content; refuse live conflict unless --force. Alias: cache:restore-from-archive.",
+            usage: "task triage:restore-from-archive -- --issue N --repo owner/name [--force]",
+            flags: [
+                ["--issue N", "(required unless --key)", "Issue number."],
+                ["--repo owner/name", "(required with --issue)", "Upstream repo."],
+                ["--key owner/repo/N", "(alt)", "Full cache key."],
+                ["--force", "(off)", "Replace live path when content differs."],
+            ],
+            examples: ["task triage:restore-from-archive -- --issue 1234 --repo deftai/directive"],
+            see_also: ["task triage:cache-archive", "task triage:show", "#1137"],
+            placeholder: false,
+        },
+        "task triage:audit:prune": {
+            name: "task triage:audit:prune",
+            summary: "Legacy name — use triage:cache-archive",
+            refs: "(#1137 supersedes D19 name)",
+            description: "Historical D19 placeholder name. Implemented surface is task triage:cache-archive (reversible closed github-issue cache archive). Do not confuse with task cache:prune (TTL hard-delete).",
+            usage: "task triage:cache-archive -- [--dry-run] [--older-than-days N]",
+            flags: [
+                ["--dry-run", "(off)", "Preview eligible entries without writing."],
+                ["--older-than-days N", "30", "Age threshold."],
+            ],
+            examples: ["task triage:cache-archive -- --dry-run"],
+            see_also: ["task triage:cache-archive", "task triage:archive-list", "#1137"],
             placeholder: true,
         },
         "task triage:audit-log:rotate": {

package/dist/triage/index.d.ts

@@ -7,6 +7,7 @@
  * ...) without colliding.
  */
 export * as actions from "./actions/index.js";
+export * as authorFilter from "./author-filter.js";
 export * as bootstrap from "./bootstrap/index.js";
 export * as bulk from "./bulk/index.js";
 export * as cachePath from "./cache-path.js";

package/dist/triage/index.js

@@ -7,6 +7,7 @@
  * ...) without colliding.
  */
 export * as actions from "./actions/index.js";
+export * as authorFilter from "./author-filter.js";
 export * as bootstrap from "./bootstrap/index.js";
 export * as bulk from "./bulk/index.js";
 export * as cachePath from "./cache-path.js";

package/dist/triage/queue/index.d.ts

@@ -1,3 +1,4 @@
+export { type AuthorFilter, type AuthorFilterResolveResult, type AuthorPartitionResult, authorLoginFromRawIssue, defaultResolveAuthenticatedLogin, formatAuthorFilterLine, matchesAuthorFilter, normalizeAuthorLogin, parseAuthorTokens, partitionByAuthorFilter, type ResolveAuthenticatedLogin, resolveAuthorFilter, } from "../author-filter.js";
 export * from "./audit.js";
 export * from "./build-queue.js";
 export * from "./cache.js";

package/dist/triage/queue/index.js

@@ -1,3 +1,4 @@
+export { authorLoginFromRawIssue, defaultResolveAuthenticatedLogin, formatAuthorFilterLine, matchesAuthorFilter, normalizeAuthorLogin, parseAuthorTokens, partitionByAuthorFilter, resolveAuthorFilter, } from "../author-filter.js";
 export * from "./audit.js";
 export * from "./build-queue.js";
 export * from "./cache.js";

package/dist/triage/queue/render.d.ts

@@ -5,5 +5,7 @@ export declare function renderQueue(options: {
     readonly repo: string;
     readonly limit?: number | null;
     readonly rankingLabels?: readonly string[];
+    /** Active author filter disclosure line (#3129 / #1318 Layer 1). */
+    readonly authorFilterLine?: string | null;
 }): string;
 //# sourceMappingURL=render.d.ts.map

package/dist/triage/queue/render.js

@@ -16,6 +16,12 @@ export function renderQueue(options) {
     else {
         lines.push("  consumer ranking labels: <empty> (framework default; within-group = updated_at desc)");
     }
+    if (options.authorFilterLine !== null && options.authorFilterLine !== undefined) {
+        const line = options.authorFilterLine.trim();
+        if (line.length > 0) {
+            lines.push(`  ${line}`);
+        }
+    }
     if (options.limit !== null && options.limit !== undefined) {
         lines.push(`  limit: ${options.limit}`);
     }

package/dist/vbrief-activate/activate.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
+import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { utcNowIso } from "../scope/vbrief-json.js";
 import { pythonJsonPretty } from "../vbrief-build/json.js";
 import { ACTIVE_FOLDER, ELIGIBLE_STATUSES_FOR_FLIP, formatEligibleStatusList, SOURCE_FOLDERS, TARGET_STATUS, } from "./constants.js";
@@ -120,6 +121,22 @@ export function activate(vbriefPath, options = {}) {
                 `'${TARGET_STATUS}'.`,
         };
     }
+    // Resolve destination early so containment can refuse before any mutation.
+    // Parity with scope:activate / #2447: projectRoot is parent of the xbrief/ root.
+    const vbriefDir = dirname(dirname(vbriefPath));
+    const projectRoot = dirname(vbriefDir);
+    const activeDir = `${vbriefDir}/${ACTIVE_FOLDER}`;
+    try {
+        // #3147 / #2447: refuse when active/ (or a parent) is a symlink escaping the checkout.
+        // Run before mutating the source payload or unlinking pending so a refusal leaves state intact.
+        assertProjectionContained(projectRoot, activeDir);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            return { exitCode: 1, message: err.message };
+        }
+        throw err;
+    }
     planObj.status = TARGET_STATUS;
     let info = payload.vBRIEFInfo;
     if (info === undefined) {
@@ -133,8 +150,6 @@ export function activate(vbriefPath, options = {}) {
         };
     }
     info.updated = utcNowIso(now);
-    const vbriefDir = dirname(dirname(vbriefPath));
-    const activeDir = `${vbriefDir}/${ACTIVE_FOLDER}`;
     try {
         mkdirSync(activeDir, { recursive: true });
     }
@@ -151,13 +166,14 @@ export function activate(vbriefPath, options = {}) {
                 "collision manually before re-running `task vbrief:activate`.",
         };
     }
-    const tmpBase = `${fileName}.tmp`;
     const tmp = `${dest}.tmp`;
     try {
-        // #2980 wave D: product write sink routes through containedWrite.
+        // #2980 wave D + #3147: product write sink routes through containedWrite with
+        // checkout root as containment root (not resolve(activeDir), which treats an
+        // escaping active/ realpath as "contained" relative to itself).
         containedWrite({
-            root: resolve(activeDir),
-            target: tmpBase,
+            root: resolve(projectRoot),
+            target: resolve(tmp),
             data: pythonJsonPretty(payload),
             mode: "create",
         });

package/dist/xbrief/styles.js

@@ -4,6 +4,19 @@
  * One schema spine (xBRIEF v0.8); markdown is a dense render of the same plan,
  * not a second dialect.
  */
+import { parseMarkdownHeading } from "../text/redos-safe.js";
+/**
+ * Linear frontmatter ``key: value`` parse (no nested quantifiers).
+ * Replaces ``/^key:\s*(.+)\s*$/`` flagged as CodeQL js/polynomial-redos (#3174).
+ */
+function frontmatterField(line, key) {
+    const prefix = `${key}:`;
+    if (!line.startsWith(prefix)) {
+        return null;
+    }
+    const value = line.slice(prefix.length).trim();
+    return value.length > 0 ? value : null;
+}
 /** Required H2 section titles in the markdown form per style. */
 export const MD_REQUIRED_SECTIONS = {
     scope: ["Title", "Status", "Overview", "Items"],
@@ -200,25 +213,28 @@ export function parseMarkdownMeta(md) {
             continue;
         }
         if (inFront) {
-            const idMatch = /^id:\s*(.+)\s*$/.exec(line);
-            if (idMatch?.[1] !== undefined)
-                id = idMatch[1].trim();
-            const styleMatch = /^style:\s*(.+)\s*$/.exec(line);
-            if (styleMatch?.[1] !== undefined)
-                style = styleMatch[1].trim();
+            // Linear field parse — avoids js/polynomial-redos on \s*(.+)\s* (#3174 alerts #84-#85).
+            const idValue = frontmatterField(line, "id");
+            if (idValue !== null)
+                id = idValue;
+            const styleValue = frontmatterField(line, "style");
+            if (styleValue !== null)
+                style = styleValue;
             continue;
         }
-        const h1 = /^#\s+(.+)$/.exec(line);
-        if (h1?.[1] !== undefined && title === null) {
-            title = h1[1].trim();
-        }
-        const h2 = /^##\s+(.+)$/.exec(line);
-        if (h2?.[1] !== undefined) {
-            const name = h2[1].trim();
-            sections.add(name);
-            afterTitleH2 = name === "Title";
-            afterStatusH2 = name === "Status";
-            continue;
+        // Linear ATX heading parse — avoids js/polynomial-redos on ^#+\s+(.+)$ (#3174 alerts #86-#87).
+        const heading = parseMarkdownHeading(line);
+        if (heading !== null) {
+            const name = heading.text.trim();
+            if (heading.hashes === "#" && title === null) {
+                title = name;
+            }
+            else if (heading.hashes === "##") {
+                sections.add(name);
+                afterTitleH2 = name === "Title";
+                afterStatusH2 = name === "Status";
+                continue;
+            }
         }
         if (afterTitleH2 && line.trim().length > 0 && !line.startsWith("#")) {
             // Prefer ## Title body over H1 when present.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.95.0",
+  "version": "0.97.0",
   "description": "TypeScript engine core for the Directive framework.",
   "license": "MIT",
   "type": "module",
@@ -247,6 +247,14 @@
       "types": "./dist/freshness/index.d.ts",
       "default": "./dist/freshness/index.js"
     },
+    "./parent-turn-shape": {
+      "types": "./dist/parent-turn-shape/index.d.ts",
+      "default": "./dist/parent-turn-shape/index.js"
+    },
+    "./delivery-attempt": {
+      "types": "./dist/delivery-attempt/index.d.ts",
+      "default": "./dist/delivery-attempt/index.js"
+    },
     "./intake": {
       "types": "./dist/intake/index.d.ts",
       "default": "./dist/intake/index.js"
@@ -346,8 +354,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.95.0",
-    "@deftai/directive-types": "^0.95.0",
+    "@deftai/directive-content": "^0.97.0",
+    "@deftai/directive-types": "^0.97.0",
     "archiver": "^8.0.0"
   },
   "scripts": {