@deftai/directive-core 0.96.0 → 0.98.0

package/dist/doctor/openclaw-soft-rebind.js

@@ -0,0 +1,164 @@
+/**
+ * Doctor check + --fix wire for OpenClaw soft AGENTS re-bind skill (#3171).
+ *
+ * Complements always-pins (#3001/#3008) and L2 product commands (#3064). This
+ * skill is the required durable soft post-amnesia surface for OpenClaw — not
+ * claimed via file-host PreCompact hooks alone.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { formatOpenClawSoftRebindSkillMarkdown, isManagedOpenClawSoftRebindSkill, OPENCLAW_SOFT_REBIND_SKILL_ID, } from "../session/compact-ritual.js";
+import { assessOpenClawSoftRebindSkill, depositOpenClawSoftRebindSkill, } from "../session/openclaw-soft-rebind-deposit.js";
+import { detectOpenClaw, listInScopeSkillsDirs } from "./openclaw-skills.js";
+/** Stable doctor check id for JSON findings. */
+export const OPENCLAW_SOFT_REBIND_CHECK = "openclaw-soft-agents-rebind";
+const DOC_OPENCLAW_HOST = "docs/openclaw-agent-host.md";
+const REMEDIATION_FIX = "deft doctor --fix";
+function defaultIsDir(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function assessGaps(skillsDirs) {
+    const expected = formatOpenClawSoftRebindSkillMarkdown();
+    const missing = [];
+    const stale = [];
+    let present = 0;
+    for (const skillsDir of skillsDirs) {
+        const path = join(skillsDir, OPENCLAW_SOFT_REBIND_SKILL_ID, "SKILL.md");
+        if (!existsSync(path)) {
+            missing.push(`${skillsDir}/${OPENCLAW_SOFT_REBIND_SKILL_ID}`);
+            continue;
+        }
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch {
+            missing.push(`${skillsDir}/${OPENCLAW_SOFT_REBIND_SKILL_ID}`);
+            continue;
+        }
+        // Unmanaged content at the required slug is incomplete health, not pass
+        // (Greptile P1 #3171). Doctor --fix overwrites via deposit.
+        if (!isManagedOpenClawSoftRebindSkill(raw) || raw !== expected) {
+            stale.push(`${skillsDir}/${OPENCLAW_SOFT_REBIND_SKILL_ID}`);
+            continue;
+        }
+        present += 1;
+    }
+    return { missing, stale, present };
+}
+/**
+ * Doctor check: OpenClaw soft AGENTS re-bind skill present and current.
+ * No-ops when OpenClaw is not detected. Fix mode deposits managed skill.
+ */
+export function runOpenClawSoftRebindCheck(sink, addFinding, options) {
+    const seams = options.seams ?? {};
+    const env = seams.openclawEnv ?? process.env;
+    const homeDirFn = seams.openclawHomeDir ?? (() => homedir());
+    const isDir = seams.isDir ?? defaultIsDir;
+    const detect = detectOpenClaw(env, { homeDir: homeDirFn(), isDir });
+    if (!detect.detected) {
+        sink.info(`${OPENCLAW_SOFT_REBIND_CHECK}: skip -- OpenClaw not detected`);
+        addFinding({
+            severity: "skip",
+            message: "OpenClaw not detected",
+            check: OPENCLAW_SOFT_REBIND_CHECK,
+            status: "skip",
+            reason: "openclaw-not-detected",
+        });
+        return null;
+    }
+    const skillsDirs = listInScopeSkillsDirs(detect.stateDir, options.allAgents, {
+        isDir,
+    });
+    const gaps = assessGaps(skillsDirs);
+    if (gaps.missing.length === 0 && gaps.stale.length === 0) {
+        const scope = options.allAgents ? "main + workspace-* seats" : "main workspace";
+        const message = `${OPENCLAW_SOFT_REBIND_CHECK}: soft AGENTS re-bind skill present ` +
+            `(${OPENCLAW_SOFT_REBIND_SKILL_ID}) in ${scope}`;
+        sink.success(message);
+        addFinding({
+            severity: "skip",
+            message,
+            check: OPENCLAW_SOFT_REBIND_CHECK,
+            status: "present",
+            skill: OPENCLAW_SOFT_REBIND_SKILL_ID,
+            skills_dirs: skillsDirs,
+        });
+        return null;
+    }
+    if (options.fixMode) {
+        const depositResult = depositOpenClawSoftRebindSkill({
+            env,
+            homeDir: homeDirFn(),
+            allAgents: options.allAgents,
+            isDir,
+            skillsDirs,
+        });
+        const after = assessGaps(skillsDirs);
+        if (after.missing.length === 0 && after.stale.length === 0) {
+            const message = `${OPENCLAW_SOFT_REBIND_CHECK}: deposited soft AGENTS re-bind skill; ` +
+                `restart OpenClaw gateway or start a new session (${DOC_OPENCLAW_HOST})`;
+            sink.success(message);
+            addFinding({
+                severity: "skip",
+                message,
+                check: OPENCLAW_SOFT_REBIND_CHECK,
+                status: "fixed",
+                written: depositResult.writtenPaths,
+            });
+            return depositResult;
+        }
+        // Partial fix: report remaining gaps from post-deposit assessment (SLizard P2).
+        const partsAfter = [];
+        if (after.missing.length > 0) {
+            partsAfter.push(`missing=${after.missing.join(", ")}`);
+        }
+        if (after.stale.length > 0) {
+            partsAfter.push(`stale=${after.stale.join(", ")}`);
+        }
+        const messageAfter = `${OPENCLAW_SOFT_REBIND_CHECK}: OpenClaw soft AGENTS re-bind skill incomplete after fix ` +
+            `(${partsAfter.join("; ")}). Remediation: ${REMEDIATION_FIX} — see ${DOC_OPENCLAW_HOST}`;
+        sink.warn(messageAfter);
+        addFinding({
+            severity: "warning",
+            message: messageAfter,
+            check: OPENCLAW_SOFT_REBIND_CHECK,
+            status: "incomplete",
+            missing: after.missing,
+            stale: after.stale,
+            written: depositResult.writtenPaths,
+            suggestion: REMEDIATION_FIX,
+            docs: [DOC_OPENCLAW_HOST],
+        });
+        return depositResult;
+    }
+    const parts = [];
+    if (gaps.missing.length > 0) {
+        parts.push(`missing=${gaps.missing.join(", ")}`);
+    }
+    if (gaps.stale.length > 0) {
+        parts.push(`stale=${gaps.stale.join(", ")}`);
+    }
+    const message = `${OPENCLAW_SOFT_REBIND_CHECK}: OpenClaw soft AGENTS re-bind skill incomplete ` +
+        `(${parts.join("; ")}). Remediation: ${REMEDIATION_FIX} — see ${DOC_OPENCLAW_HOST}`;
+    sink.warn(message);
+    addFinding({
+        severity: "warning",
+        message,
+        check: OPENCLAW_SOFT_REBIND_CHECK,
+        status: "incomplete",
+        missing: gaps.missing,
+        stale: gaps.stale,
+        suggestion: REMEDIATION_FIX,
+        docs: [DOC_OPENCLAW_HOST],
+    });
+    return null;
+}
+export { assessOpenClawSoftRebindSkill, depositOpenClawSoftRebindSkill };
+//# sourceMappingURL=openclaw-soft-rebind.js.map

package/dist/hooks/dispatcher.d.ts

@@ -119,6 +119,11 @@ export declare const ASSIST_SCRATCH_ROOT_PREFIXES: readonly [".deft-scratch/", "
  * True when the write target is under an allowlisted disposable scratch root (#1802).
  * Fail closed on null/empty/unparseable targets and on path escape (`..`).
  * Does not authorize tracked product paths even under assist posture.
+ *
+ * #3186: after lexical allowlist match, realpath the scratch root and require
+ * {@link assertProjectionContained}; refuse symlink scratch roots and any
+ * realpath outside the project (host Write would follow the link).
+ * When the project root cannot be realpath'd (unit fixtures), lexical classification wins.
  */
 export declare function isAllowlistedAssistScratchPath(projectRoot: string, targetPath: string | null): boolean;
 /**
@@ -140,7 +145,8 @@ export declare function decideHook(input: HookDispatchInput, seams?: HookPolicyS
  * Cursor deposits use `failClosed: true`. Cursor treats empty/null stdout as a
  * hook failure and blocks the tool — so Cursor allows must emit explicit
  * `{"permission":"allow"}`. Other hosts keep empty allow so the host permission
- * flow is unchanged.
+ * flow is unchanged — except session.start / session.compact soft re-bind
+ * injection (#3171), which surfaces checklist text without a write tool.
  *
  * Cursor stdout always includes `code` (stable machine-readable decision code)
  * so agents can distinguish policy denials from host-integration failures

package/dist/hooks/dispatcher.js

@@ -1,12 +1,14 @@
-import { realpathSync } from "node:fs";
+import { lstatSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
+import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { hasArtifactSuffix } from "../layout/resolve.js";
 import { detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
 import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
 import { loadStoryWriteFenceFromPath, resolveWriteFence } from "../policy/write-fence.js";
+import { appendSoftAgentsRebindToMessage, decisionCarriesSoftAgentsRebind, formatSoftAgentsRebindChecklist, } from "../session/compact-ritual.js";
 import { detectBranch } from "../session/git.js";
 import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js";
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
@@ -109,6 +111,11 @@ export const ASSIST_SCRATCH_ROOT_PREFIXES = [".deft-scratch/", "temp/"];
  * True when the write target is under an allowlisted disposable scratch root (#1802).
  * Fail closed on null/empty/unparseable targets and on path escape (`..`).
  * Does not authorize tracked product paths even under assist posture.
+ *
+ * #3186: after lexical allowlist match, realpath the scratch root and require
+ * {@link assertProjectionContained}; refuse symlink scratch roots and any
+ * realpath outside the project (host Write would follow the link).
+ * When the project root cannot be realpath'd (unit fixtures), lexical classification wins.
  */
 export function isAllowlistedAssistScratchPath(projectRoot, targetPath) {
     if (targetPath === null || targetPath.trim().length === 0)
@@ -119,11 +126,55 @@ export function isAllowlistedAssistScratchPath(projectRoot, targetPath) {
         return false;
     if (isLexicalOutsideProjectRoot(posix))
         return false;
+    let matchedPrefix = null;
     for (const prefix of ASSIST_SCRATCH_ROOT_PREFIXES) {
-        if (posix === prefix.slice(0, -1) || posix.startsWith(prefix))
-            return true;
+        if (posix === prefix.slice(0, -1) || posix.startsWith(prefix)) {
+            matchedPrefix = prefix;
+            break;
+        }
     }
-    return false;
+    if (matchedPrefix === null)
+        return false;
+    // #3186 containment: realpath scratch root + projection fence (symlink escape).
+    const projectAbs = resolve(projectRoot);
+    try {
+        realpathSync(projectAbs);
+    }
+    catch {
+        // Unit fixtures / missing project dir — lexical allowlist only.
+        return true;
+    }
+    const scratchRootName = matchedPrefix.slice(0, -1); // ".deft-scratch" | "temp"
+    const scratchRootAbs = resolve(projectAbs, scratchRootName);
+    try {
+        // Refuse when the scratch root (or any parent on the path) escapes via symlink.
+        assertProjectionContained(projectAbs, scratchRootAbs);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError)
+            return false;
+        return false;
+    }
+    // Refuse symlink scratch roots entirely (#3186) — even in-tree links can divert Write.
+    try {
+        const st = lstatSync(scratchRootAbs);
+        if (st.isSymbolicLink())
+            return false;
+    }
+    catch {
+        // Scratch root does not exist yet — mkdir will create a real directory; allow.
+    }
+    // Also fence the concrete write target when it already exists on disk.
+    const targetAbs = resolve(projectAbs, targetPath.replace(/\\/g, "/"));
+    try {
+        assertProjectionContained(projectAbs, targetAbs);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError)
+            return false;
+        return false;
+    }
+    return true;
 }
 /**
  * Assist/ephemeral classification for scratch-write carve-out (#1802).
@@ -716,7 +767,8 @@ export function decideHook(input, seams = {}) {
                     host: input.host,
                     toolName: null,
                     projectRoot,
-                    message: result.message,
+                    // Soft checklist still surfaces after compact even when ritual was absent (#3171).
+                    message: appendSoftAgentsRebindToMessage(result.message),
                     scopePath: null,
                 };
             }
@@ -727,7 +779,7 @@ export function decideHook(input, seams = {}) {
                 host: input.host,
                 toolName: null,
                 projectRoot,
-                message: result.message,
+                message: appendSoftAgentsRebindToMessage(result.message),
                 scopePath: null,
             };
         }
@@ -739,8 +791,8 @@ export function decideHook(input, seams = {}) {
                 host: input.host,
                 toolName: null,
                 projectRoot,
-                message: "Directive compact re-arm bookkeeping failed on its non-blocking path: " +
-                    `${String(cause)}`,
+                message: appendSoftAgentsRebindToMessage("Directive compact re-arm bookkeeping failed on its non-blocking path: " +
+                    `${String(cause)}`),
                 scopePath: null,
             };
         }
@@ -775,8 +827,9 @@ export function decideHook(input, seams = {}) {
                     host: input.host,
                     toolName: null,
                     projectRoot,
-                    message: `Directive SessionStart bookkeeping reported exit ${result.code} on its non-blocking path` +
-                        `${detail.length > 0 ? `: ${detail}` : "."}`,
+                    // Best-effort soft cue on SessionStart (Codex gap + resume/amnesia) (#3171).
+                    message: appendSoftAgentsRebindToMessage(`Directive SessionStart bookkeeping reported exit ${result.code} on its non-blocking path` +
+                        `${detail.length > 0 ? `: ${detail}` : "."}`),
                     scopePath: null,
                 };
             }
@@ -789,7 +842,7 @@ export function decideHook(input, seams = {}) {
                 host: input.host,
                 toolName: null,
                 projectRoot,
-                message: `Directive SessionStart bookkeeping failed on its non-blocking path: ${String(cause)}`,
+                message: appendSoftAgentsRebindToMessage(`Directive SessionStart bookkeeping failed on its non-blocking path: ${String(cause)}`),
                 scopePath: null,
             };
         }
@@ -800,7 +853,8 @@ export function decideHook(input, seams = {}) {
             host: input.host,
             toolName: null,
             projectRoot,
-            message: "SessionStart bookkeeping completed on a non-blocking path.",
+            // Soft AGENTS re-bind on SessionStart without requiring a write tool (#3171 / #2769).
+            message: appendSoftAgentsRebindToMessage("SessionStart bookkeeping completed on a non-blocking path."),
             scopePath: null,
         };
     }
@@ -881,13 +935,27 @@ export function decideHook(input, seams = {}) {
     }
     return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: true });
 }
+/**
+ * Soft AGENTS re-bind text for host injection when decision carries soft path (#3171).
+ * Prefer the checklist portion of the decision message; fall back to SoT formatter.
+ */
+function softAgentsRebindWireText(decision) {
+    if (!decisionCarriesSoftAgentsRebind({ event: decision.event, code: decision.code })) {
+        return null;
+    }
+    if (decision.message.includes("Soft AGENTS re-bind checklist:")) {
+        return decision.message;
+    }
+    return formatSoftAgentsRebindChecklist();
+}
 /**
  * Render host-facing hook output.
  *
  * Cursor deposits use `failClosed: true`. Cursor treats empty/null stdout as a
  * hook failure and blocks the tool — so Cursor allows must emit explicit
  * `{"permission":"allow"}`. Other hosts keep empty allow so the host permission
- * flow is unchanged.
+ * flow is unchanged — except session.start / session.compact soft re-bind
+ * injection (#3171), which surfaces checklist text without a write tool.
  *
  * Cursor stdout always includes `code` (stable machine-readable decision code)
  * so agents can distinguish policy denials from host-integration failures
@@ -896,9 +964,45 @@ export function decideHook(input, seams = {}) {
  */
 export function renderHostDecision(host, decision) {
     if (decision.verdict === "allow") {
+        const soft = softAgentsRebindWireText(decision);
         if (host === "cursor") {
+            if (decision.event === "session.start" && soft !== null) {
+                // Cursor sessionStart injects additional_context into the conversation.
+                return JSON.stringify({
+                    permission: "allow",
+                    code: decision.code,
+                    additional_context: soft,
+                });
+            }
+            if (decision.event === "session.compact" && soft !== null) {
+                // Cursor preCompact is observational; user_message surfaces the soft cue.
+                // Hard re-arm still ran via bookkeeping; agent path also gets SessionStart on resume.
+                return JSON.stringify({
+                    user_message: soft,
+                    code: decision.code,
+                });
+            }
             return JSON.stringify({ permission: "allow", code: decision.code });
         }
+        if (soft !== null &&
+            (decision.event === "session.start" || decision.event === "session.compact")) {
+            if (host === "claude" || host === "codex") {
+                const hookEventName = decision.event === "session.start" ? "SessionStart" : "PostCompact";
+                return JSON.stringify({
+                    hookSpecificOutput: {
+                        hookEventName,
+                        additionalContext: soft,
+                    },
+                });
+            }
+            if (host === "grok") {
+                return JSON.stringify({
+                    decision: "allow",
+                    reason: soft,
+                    additional_context: soft,
+                });
+            }
+        }
         return "";
     }
     switch (host) {

package/dist/index.d.ts

@@ -14,7 +14,9 @@ export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
 export * as codebase from "./codebase/index.js";
+export * as consumerCheckContract from "./consumer-check-contract/index.js";
 export * from "./coverage-hotspots/index.js";
+export * as deliveryAttempt from "./delivery-attempt/index.js";
 export * as doctor from "./doctor/index.js";
 export * from "./encoding/index.js";
 export * as escalation from "./escalation/index.js";
@@ -52,11 +54,13 @@ export * as render from "./render/index.js";
 export * as resolution from "./resolution/index.js";
 export * as scm from "./scm/index.js";
 export * as scope from "./scope/index.js";
+export * as scopeProvenance from "./scope-provenance/index.js";
 export * as session from "./session/index.js";
 export * as slash from "./slash/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
+export * as testBoundary from "./test-boundary/index.js";
 export * as toolEvents from "./tool-events/index.js";
 export * as triage from "./triage/index.js";
 export * as userConfig from "./user-config/index.js";

package/dist/index.js

@@ -14,7 +14,9 @@ export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
 export * as codebase from "./codebase/index.js";
+export * as consumerCheckContract from "./consumer-check-contract/index.js";
 export * from "./coverage-hotspots/index.js";
+export * as deliveryAttempt from "./delivery-attempt/index.js";
 export * as doctor from "./doctor/index.js";
 export * from "./encoding/index.js";
 export * as escalation from "./escalation/index.js";
@@ -53,11 +55,13 @@ export * as render from "./render/index.js";
 export * as resolution from "./resolution/index.js";
 export * as scm from "./scm/index.js";
 export * as scope from "./scope/index.js";
+export * as scopeProvenance from "./scope-provenance/index.js";
 export * as session from "./session/index.js";
 export * as slash from "./slash/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
+export * as testBoundary from "./test-boundary/index.js";
 export * as toolEvents from "./tool-events/index.js";
 export * as triage from "./triage/index.js";
 export * as userConfig from "./user-config/index.js";

package/dist/init-deposit/gitignore.js

@@ -37,6 +37,11 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     "vbrief/.triage-cache/scope-lifecycle.jsonl",
     "vbrief/.triage-cache/decompositions/",
     "vbrief/.triage-cache/doctor-state.json",
+    // Per-clone session state (#3146): throttle / release-availability JSON
+    // written under the lifecycle .triage-cache; selective ignore only (hybrid
+    // #1144 — never blanket-ignore the whole .triage-cache directory).
+    "vbrief/.triage-cache/staleness-tickler-state.json",
+    "vbrief/.triage-cache/release-availability-state.json",
     // Symmetric `xbrief/` layout entries (#2348). On the migrated `xbrief/` tree
     // the engine writes operator-private triage-cache files to
     // `xbrief/.triage-cache/`; without these the paths are trackable, violating
@@ -47,6 +52,8 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     "xbrief/.triage-cache/scope-lifecycle.jsonl",
     "xbrief/.triage-cache/decompositions/",
     "xbrief/.triage-cache/doctor-state.json",
+    "xbrief/.triage-cache/staleness-tickler-state.json",
+    "xbrief/.triage-cache/release-availability-state.json",
     "vbrief/*.lock",
     ".deft/core.bak-*/",
     ".deft/*.bak-*",

package/dist/init-deposit/hygiene.d.ts

@@ -8,7 +8,7 @@
  * and scope briefs are never installer-managed; if they reappear in
  * `installerManagedMatchers()`, unit tests and deposit-time assert fail closed.
  *
- * Refs #1576, #1453, #1430, #3029, #3030, #3127, #3117.
+ * Refs #1576, #1453, #1430, #3029, #3030, #3127, #3117, #3193.
  */
 import { type InitDepositIo } from "./constants.js";
 export declare const CODEQL_CONFIG_REL = ".github/codeql/codeql-config.yml";
@@ -51,13 +51,82 @@ export interface MixedCoreAndAppClassification {
     readonly app: string[];
     /** True when both core and app are non-empty — the deposited guard fails. */
     readonly wouldFail: boolean;
+    /**
+     * Pin/lock paths that were path-allowlisted but failed content-aware checks
+     * when co-travelling with core (#3193). Empty when path-only classification.
+     */
+    readonly pinContentRejected?: string[];
+}
+/** Paths that path-allowlist for upgrade co-travel but need content checks with core (#3193). */
+export declare const UPGRADE_PIN_CONTENT_PATHS: readonly ["package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock"];
+export type UpgradePinContentPath = (typeof UPGRADE_PIN_CONTENT_PATHS)[number];
+/** package.json dependency map fields that may hold @deftai/directive* pins. */
+export declare const PACKAGE_JSON_DEP_FIELDS: readonly ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+/**
+ * True when `name` is an `@deftai/directive*` dependency **key** (#3193).
+ * Substring hits in scripts/settings values do not qualify.
+ */
+export declare function isDirectiveDependencyKey(name: string): boolean;
+/**
+ * package.json co-travel is allowed only when the sole differences are
+ * `@deftai/directive*` dependency-key pins under the standard dep maps (#3193).
+ * Scripts/settings/metadata that merely contain the substring still fail.
+ */
+export declare function isPackageJsonDirectivePinOnlyDiff(baseRaw: string, headRaw: string): boolean;
+/**
+ * package-lock.json follow-through: non-@deftai/directive* root direct dependency
+ * identities (and their `node_modules/<name>` package entries when present) must
+ * be unchanged. Directive pin identity + transitive/resolution churn may change.
+ */
+export declare function isPackageLockDirectivePinFollowThrough(baseRaw: string, headRaw: string): boolean;
+/**
+ * Minimal pnpm-lock.yaml (v6/v9) root importer (`.`) direct-dep extractor.
+ * Avoids a YAML dependency; sufficient for pin follow-through identity checks.
+ */
+export declare function pnpmLockRootDirectDeps(raw: string): Record<string, string>;
+/**
+ * Extract pnpm `packages:` section records keyed by the package name (not
+ * name@version). Used to freeze product package resolution blocks.
+ */
+export declare function pnpmPackagesByName(raw: string): Map<string, string>;
+export declare function isPnpmLockDirectivePinFollowThrough(baseRaw: string, headRaw: string): boolean;
+/**
+ * yarn.lock (v1) package identity blocks: every non-@deftai/directive* package
+ * must keep identical block text (or fail if added/removed). Directive package
+ * blocks may change freely as pin follow-through (#3193).
+ */
+export declare function isYarnLockDirectivePinFollowThrough(baseRaw: string, headRaw: string): boolean;
+/**
+ * Content-aware check for a single upgrade pin path (#3193).
+ * Returns true when the path may co-travel with `.deft/core/**`.
+ */
+export declare function isUpgradePinPathContentAllowed(path: string, baseRaw: string, headRaw: string): boolean;
+export interface PinContentFilePair {
+    readonly base: string;
+    readonly head: string;
 }
 /**
  * TS twin of Go `classifyChangedPaths` / deposited shell guard (#1430).
  * Core = `.deft/core/**`; installer-managed = allowlist; app = everything else.
  * Guard fails iff both core and app are non-empty.
+ *
+ * Path-only: does not inspect package/lock contents. Prefer
+ * {@link classifyMixedCoreAndAppContentAware} when base/head blobs are available
+ * (deposited guard + unit tests for #3193).
  */
 export declare function classifyMixedCoreAndApp(changedPaths: readonly string[], matchers?: readonly InstallerManagedMatcher[]): MixedCoreAndAppClassification;
+/**
+ * Content-aware upgrade co-travel classifier (#3193).
+ *
+ * Starts from path classification (#3127 allowlist), then when `.deft/core/**`
+ * is present reclassifies package.json / lockfile paths as **app** unless their
+ * base→head content is the Directive pin unit (or lock follow-through).
+ * `.deft/GENERATION.json` remains path-allowlisted with no content constraint.
+ *
+ * Missing content for a pin path co-travelling with core fails closed (treated
+ * as app) so partial fixtures cannot silently re-open the path-only hole.
+ */
+export declare function classifyMixedCoreAndAppContentAware(changedPaths: readonly string[], fileContents: Readonly<Partial<Record<string, PinContentFilePair>>>, matchers?: readonly InstallerManagedMatcher[]): MixedCoreAndAppClassification;
 export interface FrameworkStagePathsOptions {
     /**
      * Include the vendored `.deft/core` payload in the stage set. Defaults to