@deftai/directive-core 0.96.0 → 0.97.0

package/dist/cache/archive.js

@@ -58,18 +58,24 @@ function loadPlan(path) {
 /** Parse github issue URI → `{repo: owner/name, number}` when possible. */
 function issueRefFromUri(uri) {
     const cleaned = uri.replace(/\/+$/, "");
-    const m = /github\.com\/([^/]+)\/([^/]+)\/issues\/(\d+)$/i.exec(cleaned);
+    // Accept github.com and www.github.com (case-insensitive host).
+    // Digits may include leading zeros (rare URL forms); Number() normalizes.
+    const m = /(?:https?:\/\/)?(?:www\.)?github\.com\/([^/]+)\/([^/]+)\/issues\/(\d+)$/i.exec(cleaned);
     if (m) {
         // Lowercase owner/repo so protection matches case-folded cache keys (#1137 review).
+        // Leading zeros normalize via Number(); reject 0 / non-positive.
+        const num = Number(m[3]);
+        if (!(num >= 1))
+            return null;
         return {
             repo: `${(m[1] ?? "").toLowerCase()}/${(m[2] ?? "").toLowerCase()}`,
-            number: Number.parseInt(m[3] ?? "", 10),
+            number: num,
         };
     }
     const slash = cleaned.lastIndexOf("/");
     const tail = slash >= 0 ? cleaned.slice(slash + 1) : cleaned;
-    if (/^\d+$/.test(tail)) {
-        return { repo: "", number: Number.parseInt(tail, 10) };
+    if (/^[1-9]\d*$/.test(tail)) {
+        return { repo: "", number: Number(tail) };
     }
     return null;
 }

package/dist/check/gate-lists.js

@@ -29,6 +29,10 @@ export const FRAMEWORK_CHECK_GATES = [
     "verify:branch",
     "verify:encoding",
     "verify:forward-coverage",
+    // #3145: test/source boundary + approved-scope provenance + consumer gate composition
+    "verify:test-boundary",
+    "verify:scope-provenance",
+    "verify:consumer-check-contract",
     "verify:vbrief-conformance",
     "verify:destructive-gh-verbs",
     "verify:scm-boundary",
@@ -55,6 +59,10 @@ export const CONSUMER_CHECK_GATES = [
     "verify:cache-fresh",
     "verify:wip-cap",
     "verify:orphan-active",
+    // #3145 enforcement trio (test placement, scope provenance, gate composition)
+    "verify:test-boundary",
+    "verify:scope-provenance",
+    "verify:consumer-check-contract",
     "vbrief:validate",
     "verify-strategy-output",
 ];

package/dist/consumer-check-contract/evaluate.d.ts

@@ -0,0 +1,124 @@
+/**
+ * verify:consumer-check-contract evaluation (#3145).
+ *
+ * Fail closed when the consumer check task or required CI workflows omit
+ * configured Directive enforcement gates (test-boundary, scope-provenance,
+ * and other required surfaces). Emits a concrete repair path.
+ *
+ * Three-state exit: 0 clean / 1 missing gates / 2 config.
+ */
+import { type CheckGateSpec } from "../check/gate-lists.js";
+/** Gates that #3145 requires on consumer check composition (beyond baseline). */
+export declare const REQUIRED_CONSUMER_ENFORCEMENT_GATES: readonly string[];
+export interface ConsumerCheckContractFinding {
+    readonly gateId: string;
+    readonly surface: "check-task" | "ci-workflow" | "verify-taskfile";
+    readonly detail: string;
+    readonly remediation: string;
+}
+export interface ConsumerCheckContractResult {
+    readonly exitCode: 0 | 1 | 2;
+    readonly findings: readonly ConsumerCheckContractFinding[];
+    readonly message: string;
+}
+export interface ConsumerCheckContractOptions {
+    /** Override required gates under test. */
+    readonly requiredGates?: readonly string[];
+    /** Inject Taskfile text (root). */
+    readonly rootTaskfileText?: string | null;
+    /** Inject tasks/verify.yml text. */
+    readonly verifyTaskfileText?: string | null;
+    /** Inject CI workflow file contents: relPath -> text. */
+    readonly ciWorkflows?: ReadonlyMap<string, string>;
+    /**
+     * Framework-source self-check: gates live in FRAMEWORK_CHECK_GATES / check:framework-source.
+     * When true, also accept framework aggregate composition.
+     */
+    readonly frameworkSource?: boolean;
+    /** When true, missing CI references warn only (default true for migration). */
+    readonly ciWarnOnly?: boolean;
+    readonly enforce?: boolean;
+}
+/** True if `text` mentions the gate as a task dep, script, or CLI invocation. */
+export declare function textReferencesGate(text: string, gateId: string): boolean;
+/**
+ * True when a shell line is only assignment(s) (no executed command).
+ * `CHECK_CMD="task check"` is pure assignment; `FOO=1 task check` is not.
+ * Linear scan (no nested regex quantifiers — CodeQL js/redos).
+ */
+export declare function isPureAssignmentLine(cmd: string): boolean;
+/**
+ * True when a shell/task line does not execute gates (echo, comment, pure assign).
+ * Greptile conf gate: non-executing text must not satisfy composition (#3145).
+ */
+export declare function isNonExecutingCommandLine(line: string): boolean;
+/** Executable run/script command lines from a workflow (skips comments). */
+export declare function extractWorkflowRunCommands(text: string): string[];
+/**
+ * Strip simple single/double-quoted segments so runner phrases inside printf/args
+ * do not impersonate command-position invocations (Greptile conf=1).
+ */
+export declare function stripQuotedSegments(line: string): string;
+/**
+ * True when a shell line discards or defers the primary command's exit status
+ * via `||`, pipelines, `;` chains, or job-control backgrounding. Used for
+ * dispatcher tokens that do not match the check-specific mask predicate.
+ */
+export declare function lineMasksShellStatus(line: string): boolean;
+/**
+ * True when a shell line uses job-control backgrounding (`cmd &`, `cmd & next`)
+ * as opposed to fd redirection (`2>&1`, `&>file`). Backgrounded jobs return
+ * before completion and do not propagate exit status — must not satisfy
+ * composition (Greptile conf=3/4 residual, #3145).
+ */
+export declare function lineHasBackgroundJob(line: string): boolean;
+/**
+ * True when a shell line masks check failures (`|| true`, `| true`, `|| :`).
+ * Such lines must not satisfy composition (Greptile conf=3).
+ */
+export declare function lineMasksCheckFailure(line: string): boolean;
+/**
+ * True when `line` invokes a runner at command position (start / after chain),
+ * not merely mentions it inside an argument, and does not mask failures.
+ */
+export declare function lineHasCommandPositionRunner(line: string, runnerPattern: RegExp): boolean;
+/** True when a run command is a full check aggregate (not a single verify gate). */
+export declare function runCommandIsFullCheck(cmd: string): boolean;
+/**
+ * True when a run command invokes a specific verify gate id as an executable
+ * task/CLI form — not a bare substring in echo/docs/printf args.
+ */
+export declare function runCommandInvokesGate(cmd: string, gateId: string): boolean;
+/**
+ * True when CI/workflow text has an executable `run:` line that invokes the full
+ * check aggregate (not a single gate, not prose) — Greptile P1.
+ */
+export declare function workflowExecutesCheck(text: string): boolean;
+/** Extract the body of a top-level go-task task (indent=2 key). */
+export declare function extractTaskBody(taskfileText: string, taskName: string): string;
+/**
+ * Drop YAML/shell comment lines (and trailing `# ...` on otherwise empty marker
+ * lines) before orchestrator matching so commented markers cannot grant trust.
+ */
+export declare function stripTaskBodyComments(body: string): string;
+/**
+ * True when a Taskfile task body actually dispatches the check orchestrator.
+ * ENGINE_CMD alone is inert metadata — require engine:invoke / dispatchTaskCheck
+ * (or a command-position runner) so inert YAML cannot grant trust (Greptile).
+ * Comments are stripped first so commented markers cannot bypass (Greptile conf=3).
+ */
+export declare function taskBodyInvokesCheckOrchestrator(body: string): boolean;
+/** True when the check / check:consumer / check:framework-source task invokes orchestrator. */
+export declare function taskfileInvokesCheckOrchestrator(text: string): boolean;
+/**
+ * Extract dependency task names from a go-task task definition body snippet.
+ * Best-effort line parser for `deps:` list entries.
+ */
+export declare function extractCheckDeps(taskfileText: string, taskName: string): string[];
+/**
+ * Evaluate whether required enforcement gates are composed into consumer check/CI.
+ */
+export declare function evaluateConsumerCheckContract(projectRoot: string, options?: ConsumerCheckContractOptions): ConsumerCheckContractResult;
+/** Exported for tests — gate list helper. */
+export declare function requiredGatesFromConsumerList(gates?: readonly CheckGateSpec[]): string[];
+//# sourceMappingURL=evaluate.d.ts.map