@deftai/directive-core 0.98.0 → 0.98.1

package/dist/authz/classify.js

@@ -162,6 +162,146 @@ const POLICY_AUTHORITY_MUTATORS = new Set([
 ]);
 /** Kill-switch / permanent opt-out basenames agents must not plant under UAT (#3186 / #3039). */
 const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/**
+ * Downloaders / decoders that can plant files without shell redirects (#3206).
+ * Not in INDIRECT_WRITE_BINS: those feed hasWriteShape and would classify bare
+ * `curl $URL` as a store write via opaque-expansion heuristics.
+ */
+const DOWNLOADER_DECODER_BINS = new Set(["curl", "wget", "xxd", "openssl"]);
+/**
+ * File destination flags for downloaders/decoders (#3206).
+ * normalizeToken lowercases, so wget `-O` and curl `-o` share `-o`.
+ */
+const DOWNLOADER_FILE_DEST_FLAGS = new Set([
+    "-o",
+    "--output",
+    "--output-document",
+    "-out",
+    "--out",
+]);
+/** Directory destination flags (curl --output-dir / wget -P); bin-scoped below. */
+const CURL_DIR_DEST_FLAGS = new Set(["--output-dir"]);
+const WGET_DIR_DEST_FLAGS = new Set(["-p", "--directory-prefix"]);
+/** Final path segment of a token (path-qualified bins / .exe). */
+function binBareName(token) {
+    const pathish = token.replace(/['"]/g, "").toLowerCase().replace(/\\/g, "/");
+    const base = pathish.includes("/") ? pathish.slice(pathish.lastIndexOf("/") + 1) : pathish;
+    return base.endsWith(".exe") ? base.slice(0, -4) : base;
+}
+/** True when token names a downloader/decoder bin (bare or path-qualified). */
+function isDownloaderDecoderBin(token) {
+    const n = normalizeToken(token);
+    if (n.startsWith("-"))
+        return false;
+    return DOWNLOADER_DECODER_BINS.has(binBareName(token));
+}
+function isDownloaderDestFlag(flag, bin) {
+    if (DOWNLOADER_FILE_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "curl" && CURL_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "wget" && WGET_DIR_DEST_FLAGS.has(flag))
+        return true;
+    return false;
+}
+/**
+ * Destinations from curl/wget/xxd/openssl via -o/--output/-O/-out/--output-dir/-P
+ * (separate, =value, or attached short form) and xxd -r path-like write positionals (#3206).
+ * openssl uses flags only (no positional dests — avoids treating -in paths as writes).
+ * O(n) token walk — no nested-quantifier regex on untrusted input.
+ */
+function downloaderDecoderDestinations(tokens) {
+    const dests = [];
+    let i = 0;
+    while (i < tokens.length) {
+        if (!isDownloaderDecoderBin(tokens[i])) {
+            i++;
+            continue;
+        }
+        const bin = binBareName(tokens[i]);
+        i++;
+        // xxd reverse mode writes; without -r, path positionals are dump inputs (read).
+        let xxdReverse = false;
+        while (i < tokens.length) {
+            const raw = tokens[i];
+            const n = normalizeToken(raw);
+            // New bare bin starts another command segment (not pathish ./wget operands).
+            if (!n.startsWith("-") &&
+                !raw.includes("/") &&
+                !raw.includes("\\") &&
+                isDownloaderDecoderBin(raw)) {
+                break;
+            }
+            if (bin === "xxd" && (n === "-r" || n === "--reverse")) {
+                xxdReverse = true;
+                i++;
+                continue;
+            }
+            // Skip openssl/xxd input flags + value so -in PATH is not a write dest.
+            if (n === "-in" || n === "--in" || n === "-inform" || n === "--inform") {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-")) {
+                    i += 2;
+                    continue;
+                }
+                i++;
+                continue;
+            }
+            // --flag=value (and rare -out=value)
+            if (n.includes("=") && (n.startsWith("-") || n.startsWith("--"))) {
+                const eq = raw.indexOf("=");
+                const flag = normalizeToken(raw.slice(0, eq));
+                if (isDownloaderDestFlag(flag, bin)) {
+                    dests.push(pathishToken(raw.slice(eq + 1)));
+                }
+                i++;
+                continue;
+            }
+            // Attached short: -oPATH / -OPATH (after lowercasing both are -opath…)
+            if (n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
+                if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output")) {
+                    dests.push(pathishToken(raw.slice(4)));
+                    i++;
+                    continue;
+                }
+                if (n.startsWith("-o") && !n.startsWith("-out") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
+                // wget attached -Pdir
+                if (bin === "wget" && n.startsWith("-p") && n.length > 2 && !n.startsWith("-proxy")) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
+            }
+            // Separate value: -o PATH / --output PATH / -out PATH / --output-dir / -P
+            if (isDownloaderDestFlag(n, bin)) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-")) {
+                    dests.push(pathishToken(next));
+                    i += 2;
+                    continue;
+                }
+                i++;
+                continue;
+            }
+            // xxd -r only: path-like write positionals (not http(s) URLs). openssl: flags only.
+            if (bin === "xxd" && xxdReverse && !n.startsWith("-")) {
+                const p = pathishToken(raw);
+                if ((p.includes("/") || p.startsWith(".") || p.includes("\\")) &&
+                    !p.startsWith("http:") &&
+                    !p.startsWith("https:") &&
+                    !p.startsWith("ftp:")) {
+                    dests.push(p);
+                }
+            }
+            i++;
+        }
+    }
+    return dests;
+}
 function authzSubcommandFromToken(token) {
     const t = normalizeToken(token);
     if (t.startsWith("authz:")) {
@@ -273,6 +413,13 @@ function hasKillSwitchShellWrite(command, tokens) {
                 return true;
         }
     }
+    // Downloader/decoder destinations: curl -o .deft-directive-disable, wget -O, … (#3206).
+    for (const dest of downloaderDecoderDestinations(tokens)) {
+        for (const name of KILL_SWITCH_BASENAMES) {
+            if (dest.includes(name))
+                return true;
+        }
+    }
     // Write/destructive bins with a kill-switch path argument (touch, New-Item, …).
     const killWriteBins = new Set([
         ...INDIRECT_WRITE_BINS,
@@ -512,6 +659,11 @@ function hasAuthzDirShellWrite(command, tokens) {
                 return true;
         }
     }
+    // Downloader/decoder destinations under .deft/authz (#3206 residual after #3186).
+    for (const dest of downloaderDecoderDestinations(tokens)) {
+        if (dest.includes(".deft/authz"))
+            return true;
+    }
     return false;
 }
 /** Write/destructive shell bins (token match after normalizeToken). */

package/dist/scope-provenance/evaluate.d.ts

@@ -61,6 +61,27 @@ export declare function normalizeRepoRelPath(p: string): string;
  * Git C-quoting / slash folding may produce (Greptile conf=4 residual).
  */
 export declare function changedSetHasPath(changedSet: ReadonlySet<string>, rel: string): boolean;
+/**
+ * Parse + lightly validate an approved-scope JSON blob (base-ref `git show` or disk).
+ * Returns null when schema fields required for authorization are missing/malformed.
+ */
+export declare function parseApprovedScopeRecordRaw(raw: string): ApprovedScopeRecord | null;
+/**
+ * True when the merge-base approved-scope record authorizes the current scope and
+ * the current disk record is semantically unchanged from that base authority (#3205).
+ *
+ * Authority comes from the approval record on the base, not from whether the active
+ * xBRIEF path existed on the base (pending→active is the normal first activation).
+ */
+export declare function baseApprovalAuthorizesCurrent(input: {
+    readonly projectRoot: string;
+    readonly baseRef: string | null;
+    readonly approvalRecordRel: string;
+    readonly planId: string;
+    readonly xbriefRelPath: string;
+    readonly currentDigest: string;
+    readonly currentApproved: ApprovedScopeRecord;
+}): boolean;
 /**
  * Pure evaluation of one active xBRIEF against its approved baseline.
  * Exported for unit tests without git.

package/dist/scope-provenance/evaluate.js

@@ -203,9 +203,83 @@ function listActiveXbriefPaths(projectRoot) {
 }
 function remediationForExpansion() {
     return ("Renew human approval: re-record the approved-scope digest after operator review " +
-        "(`task scope:record-approved-scope` / write `.deft/approved-scope/<plan-id>.json` " +
-        "with humanApproval stamp). Editing the active xBRIEF alone does not authorize new " +
-        "paths (#3145). See content/docs/scope-provenance.md.");
+        "(`task scope:record-approved-scope -- <xbrief-path> --actor <you>` writes " +
+        "`.deft/approved-scope/<plan-id>.json` with a humanApproval stamp). Commit that " +
+        "approval on the merge base (or a prior PR) before expanding or activating the " +
+        "scoped xBRIEF in the implementation change set. Editing the active xBRIEF alone " +
+        "does not authorize new paths (#3145 / #3205). See content/docs/scope-provenance.md.");
+}
+/**
+ * Parse + lightly validate an approved-scope JSON blob (base-ref `git show` or disk).
+ * Returns null when schema fields required for authorization are missing/malformed.
+ */
+export function parseApprovedScopeRecordRaw(raw) {
+    try {
+        const data = JSON.parse(raw);
+        if (data === null || typeof data !== "object" || Array.isArray(data))
+            return null;
+        const rec = data;
+        if (rec.schemaVersion !== undefined && rec.schemaVersion !== 1)
+            return null;
+        if (typeof rec.planId !== "string" || rec.planId.trim().length === 0)
+            return null;
+        if (typeof rec.xbriefRelPath !== "string" || rec.xbriefRelPath.trim().length === 0) {
+            return null;
+        }
+        if (typeof rec.fileScopeDigest !== "string" || rec.fileScopeDigest.length === 0) {
+            return null;
+        }
+        if (!Array.isArray(rec.fileScope))
+            return null;
+        // Digest must match the recorded path list — never trust a forged digest alone (#3205 Greptile).
+        const scopePaths = rec.fileScope.filter((x) => typeof x === "string");
+        const expected = computeFileScopeDigest(scopePaths);
+        if (rec.fileScopeDigest !== expected)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when the merge-base approved-scope record authorizes the current scope and
+ * the current disk record is semantically unchanged from that base authority (#3205).
+ *
+ * Authority comes from the approval record on the base, not from whether the active
+ * xBRIEF path existed on the base (pending→active is the normal first activation).
+ */
+export function baseApprovalAuthorizesCurrent(input) {
+    if (input.baseRef === null || input.baseRef === "")
+        return false;
+    const baseRaw = readRepoFileAtRef(input.projectRoot, input.baseRef, input.approvalRecordRel);
+    if (baseRaw === null)
+        return false;
+    const baseRec = parseApprovedScopeRecordRaw(baseRaw);
+    if (baseRec === null)
+        return false;
+    if (!isHumanApprovalStamp(baseRec.humanApproval))
+        return false;
+    if (baseRec.planId !== input.planId)
+        return false;
+    if (normalizeRepoRelPath(baseRec.xbriefRelPath) !== normalizeRepoRelPath(input.xbriefRelPath)) {
+        return false;
+    }
+    // Base record must authorize the *current* file_scope (digest match).
+    if (baseRec.fileScopeDigest !== input.currentDigest)
+        return false;
+    // Current on-disk/injected record must not diverge from base authority fields.
+    if (input.currentApproved.fileScopeDigest !== baseRec.fileScopeDigest)
+        return false;
+    if (input.currentApproved.planId !== baseRec.planId)
+        return false;
+    if (normalizeRepoRelPath(input.currentApproved.xbriefRelPath) !==
+        normalizeRepoRelPath(baseRec.xbriefRelPath)) {
+        return false;
+    }
+    if (!isHumanApprovalStamp(input.currentApproved.humanApproval))
+        return false;
+    return true;
 }
 function configError(message) {
     return { exitCode: 2, findings: [], message };
@@ -250,13 +324,42 @@ export function evaluateOneScopeProvenance(input) {
         isHumanApprovalStamp(input.approved.humanApproval)) {
         return null;
     }
+    // Matching digest without human origin: empty-scope body edits may soft-warn
+    // via the missing-digest path only when no usable approval; agent/malformed
+    // stamps must not authorize non-empty scopes (#3205).
+    if (input.approved.fileScopeDigest === currentDigest) {
+        if (currentScope.length === 0) {
+            return null;
+        }
+        if (!isHumanApprovalStamp(input.approved.humanApproval)) {
+            return {
+                xbriefRelPath: input.xbriefRelPath,
+                planId,
+                kind: "active-xbrief-modified-without-digest",
+                expandedPaths: currentScope,
+                detail: "active xBRIEF modified with a non-human (agent/missing) approved-scope stamp; " +
+                    "only humanApproval stamps authorize non-empty file_scope",
+                remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
+                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+            };
+        }
+    }
     const expanded = scopeExpansion(input.approved.fileScope, currentScope);
     if (expanded.length === 0) {
-        // Scope shrink or identical after normalize — body edit without expansion is OK
-        if (input.approved.fileScopeDigest === currentDigest) {
-            return null;
+        // Scope shrink or digest noise without path expansion — OK for v1 when human-stamped.
+        // Non-empty current scope still requires human origin (agent shrink must not bypass #3205).
+        if (currentScope.length > 0 && !isHumanApprovalStamp(input.approved.humanApproval)) {
+            return {
+                xbriefRelPath: input.xbriefRelPath,
+                planId,
+                kind: "active-xbrief-modified-without-digest",
+                expandedPaths: currentScope,
+                detail: "active xBRIEF modified with a non-human approved-scope stamp (scope shrink/noise path); " +
+                    "only humanApproval stamps authorize non-empty file_scope",
+                remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
+                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+            };
         }
-        // Digest mismatch without path expansion (reorder/noise) — still OK for v1
         return null;
     }
     // Expansion without renewed human approval = self-authorization
@@ -303,10 +406,18 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
             if (baseRef === undefined || baseRef === "" || baseRef === "HEAD") {
                 const resolved = resolveDefaultBaseRef(root);
                 if (resolved === null) {
-                    return configError("verify_scope_provenance: no merge-base ref found (origin/master|main, " +
-                        "DEFT_BASE_REF, or GITHUB_BASE_REF).\n" +
-                        "  Recovery: fetch the default branch or pass --base-ref <ref>. " +
-                        "Bare HEAD cannot see committed PR scope expansion (#3145).");
+                    // Greenfield / single-commit consumer trees often have no origin/* and no
+                    // default-branch ref yet. Fail closed only when the caller demanded an
+                    // explicit --base-ref; otherwise soft-skip (same posture as non-git trees)
+                    // so verify:scope-provenance does not brick `task check` on init (#3205 smoke).
+                    return {
+                        exitCode: 0,
+                        findings: [],
+                        message: "verify_scope_provenance: skipped -- no merge-base ref found " +
+                            "(origin/master|main, DEFT_BASE_REF, or GITHUB_BASE_REF). " +
+                            "Fetch the default branch or pass --base-ref <ref> before enforcing " +
+                            "PR scope expansion (#3145 / #3205).",
+                    };
                 }
                 baseRef = resolved;
             }
@@ -412,38 +523,36 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 return (n.includes("/approved-scope/") &&
                     (n.endsWith(`/${safe}.json`) || n.endsWith(`${safe}.json`)));
             });
-        // Ignored / untracked approved-scope files never appear in git changedSet.
-        // Concurrent rewrite attack: scope *expanded* vs base AND an untracked disk
-        // approval was rewritten to match the *new* digest. Body-only xBRIEF edits
-        // with a pre-existing matching approval must NOT fail (Greptile conf=2).
+        // Disk-only / concurrent-rewrite inference (#3205):
+        // Authority is the *approval record on the merge base*, not whether the
+        // active xBRIEF path existed there. pending→active leaves the active path
+        // absent on base; treating that as an approval rewrite is a false positive.
+        // Fail closed when base approval is missing, malformed, agent-stamped,
+        // path/plan/digest mismatched, or the current record diverged from base.
+        // Same-PR git changes still hard-fail via approvalInGitChange.
         let approvalDiskOnly = false;
         if (modified &&
             approved !== null &&
             renewed === null &&
             approvalRecordRel !== null &&
+            planId !== null &&
             !approvalInGitChange &&
             existsSync(join(root, approvalRecordRel)) &&
             isHumanApprovalStamp(approved.humanApproval)) {
             const currentDigest = computeFileScopeDigest(normalizeFileScope(extractFileScope(payload)));
             if (approved.fileScopeDigest === currentDigest) {
-                const baseRaw = discoveryBaseRef !== null ? readRepoFileAtRef(root, discoveryBaseRef, rel) : null;
-                if (baseRaw === null) {
-                    // New active xBRIEF with untracked matching approval → fail closed.
+                const baseAuthorizes = baseApprovalAuthorizesCurrent({
+                    projectRoot: root,
+                    baseRef: discoveryBaseRef,
+                    approvalRecordRel,
+                    planId,
+                    xbriefRelPath: rel,
+                    currentDigest,
+                    currentApproved: approved,
+                });
+                if (!baseAuthorizes) {
                     approvalDiskOnly = true;
                 }
-                else {
-                    try {
-                        const basePayload = JSON.parse(baseRaw);
-                        const baseDigest = computeFileScopeDigest(normalizeFileScope(extractFileScope(basePayload)));
-                        // Only concurrent-rewrite when file-scope actually grew/changed.
-                        if (baseDigest !== currentDigest) {
-                            approvalDiskOnly = true;
-                        }
-                    }
-                    catch {
-                        approvalDiskOnly = true;
-                    }
-                }
             }
         }
         const approvalRecordRewritten = approvalInGitChange || approvalDiskOnly;
@@ -463,8 +572,9 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 expandedPaths: currentScope,
                 detail: "approved-scope record rewritten in the same change set as the active xBRIEF; " +
                     "cannot self-authorize via concurrent approval rewrite",
-                remediation: "Record renewed human approval outside the implementation PR (or pass an " +
-                    "independent renewed stamp). Same-PR approval rewrites do not authorize expansion (#3145).",
+                remediation: "Commit human approval via `task scope:record-approved-scope` on the merge base " +
+                    "(or a prior PR), then activate/expand without rewriting the approval in this " +
+                    "change set. Same-PR approval rewrites do not authorize expansion (#3145 / #3205).",
             });
             continue;
         }

package/dist/scope-provenance/index.d.ts

@@ -2,5 +2,5 @@
  * scope-provenance package surface (#3145).
  */
 export { APPROVED_SCOPE_DIR, type ApprovedScopeRecord, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
-export { evaluateOneScopeProvenance, evaluateScopeProvenance, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
+export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/scope-provenance/index.js

@@ -2,5 +2,5 @@
  * scope-provenance package surface (#3145).
  */
 export { APPROVED_SCOPE_DIR, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
-export { evaluateOneScopeProvenance, evaluateScopeProvenance, resolveDefaultBaseRef, } from "./evaluate.js";
+export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, } from "./evaluate.js";
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.98.0",
+  "version": "0.98.1",
   "description": "TypeScript engine core for the Directive framework.",
   "license": "MIT",
   "type": "module",
@@ -354,8 +354,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.98.0",
-    "@deftai/directive-types": "^0.98.0",
+    "@deftai/directive-content": "^0.98.1",
+    "@deftai/directive-types": "^0.98.1",
     "archiver": "^8.0.0"
   },
   "scripts": {