@deftai/directive-core 0.98.0 → 0.99.0

package/dist/authz/classify.js

@@ -7,7 +7,12 @@
  * (CodeQL js/polynomial-redos).
  */
 import { classifyMcpTool, classifyShellCommand, listShellOps, } from "../policy/runtime-authority.js";
-/** Split on whitespace without nested quantifiers (O(n)). */
+/**
+ * Split on whitespace without nested quantifiers (O(n)).
+ * Newlines become `;` segment breaks so compound lists like
+ * `scp …authz…\necho ok` keep the scp dest (#3213 Greptile residual).
+ * Bare space/tab/CR still only separate tokens.
+ */
 function shellTokens(command) {
     const out = [];
     let cur = "";
@@ -15,11 +20,22 @@ function shellTokens(command) {
         const c = command[i];
         if (c === undefined)
             break;
-        if (c === " " || c === "\t" || c === "\n" || c === "\r") {
+        if (c === " " || c === "\t" || c === "\r") {
+            if (cur.length > 0) {
+                out.push(cur);
+                cur = "";
+            }
+            continue;
+        }
+        if (c === "\n") {
             if (cur.length > 0) {
                 out.push(cur);
                 cur = "";
             }
+            // Emit a segment break once (avoid runs of `;` from blank lines).
+            if (out.length > 0 && out[out.length - 1] !== ";") {
+                out.push(";");
+            }
             continue;
         }
         cur += c;
@@ -162,6 +178,279 @@ const POLICY_AUTHORITY_MUTATORS = new Set([
 ]);
 /** Kill-switch / permanent opt-out basenames agents must not plant under UAT (#3186 / #3039). */
 const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/**
+ * Downloaders / decoders / remote-copy tools that can plant files without shell
+ * redirects (#3206 / #3213). Not in INDIRECT_WRITE_BINS: those feed hasWriteShape
+ * and would classify bare `curl $URL` as a store write via opaque-expansion heuristics.
+ */
+const DOWNLOADER_DECODER_BINS = new Set([
+    "curl",
+    "wget",
+    "xxd",
+    "openssl",
+    // #3213 residual after #3206: alternate downloaders / remote copy.
+    "scp",
+    "aria2c",
+    "certutil",
+]);
+/**
+ * File destination flags for downloaders/decoders (#3206).
+ * normalizeToken lowercases, so wget `-O` and curl `-o` share `-o`.
+ * scp: `-o` is an SSH option — excluded in isDownloaderDestFlag.
+ */
+const DOWNLOADER_FILE_DEST_FLAGS = new Set([
+    "-o",
+    "--output",
+    "--output-document",
+    "-out",
+    "--out",
+]);
+/** Directory destination flags (curl --output-dir / wget -P / aria2c -d); bin-scoped below. */
+const CURL_DIR_DEST_FLAGS = new Set(["--output-dir"]);
+const WGET_DIR_DEST_FLAGS = new Set(["-p", "--directory-prefix"]);
+const ARIA2C_DIR_DEST_FLAGS = new Set(["-d", "--dir"]);
+/**
+ * Symlink / hard-link plant bins (#3213). Absent from prior killWriteBins →
+ * `ln -sf … .deft-directive-disable` classified empty → UAT fail-open.
+ */
+const SYMLINK_PLANT_BINS = new Set(["ln", "link", "mklink"]);
+/** Final path segment of a token (path-qualified bins / .exe). */
+function binBareName(token) {
+    const pathish = token.replace(/['"]/g, "").toLowerCase().replace(/\\/g, "/");
+    const base = pathish.includes("/") ? pathish.slice(pathish.lastIndexOf("/") + 1) : pathish;
+    return base.endsWith(".exe") ? base.slice(0, -4) : base;
+}
+/** True when token names a downloader/decoder bin (bare or path-qualified). */
+function isDownloaderDecoderBin(token) {
+    const n = normalizeToken(token);
+    if (n.startsWith("-"))
+        return false;
+    return DOWNLOADER_DECODER_BINS.has(binBareName(token));
+}
+function isDownloaderDestFlag(flag, bin) {
+    // scp: `-o` is OpenSSH option (ProxyCommand, …), not a file dest flag.
+    if (bin === "scp")
+        return false;
+    if (DOWNLOADER_FILE_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "curl" && CURL_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "wget" && WGET_DIR_DEST_FLAGS.has(flag))
+        return true;
+    if (bin === "aria2c" && ARIA2C_DIR_DEST_FLAGS.has(flag))
+        return true;
+    return false;
+}
+/**
+ * OpenSSH/scp flags that take a separate value token (`-o ProxyCommand=…`, `-i key`, `-P port`).
+ * Not dest flags — must skip so value tokens are not mistaken for write destinations (#3213).
+ * Case-sensitive where needed: scp `-P` (port) takes a value; `-p` (preserve) does not.
+ */
+const SCP_VALUE_FLAGS_LOWER = new Set(["-o", "-i", "-c", "-s", "-j", "-f", "-l", "-b"]);
+const SCP_VALUE_FLAGS_EXACT = new Set(["-P", "-F", "-S", "-J"]);
+/** Shell metacharacters that end a command segment (compound lists / pipelines). */
+function isShellSegmentBreak(token) {
+    const t = token.trim();
+    if (t.length === 0)
+        return false;
+    if (t === ";" || t === "|" || t === "||" || t === "&&" || t === "&")
+        return true;
+    // Trailing operator glued to a prior token is handled by pathish stripping; bare ops here.
+    return false;
+}
+/**
+ * First unquoted, unescaped shell-list operator (`;` `&` `|`) in a token, or -1.
+ * Quoted operators (e.g. `'file;name'`) and escaped unquoted ops (e.g. `path\;file`)
+ * are literal data and must not end scp segments (#3213 Greptile residual).
+ * O(n). Unquoted / double-quoted `\` escapes the next char; single-quoted `\` is literal.
+ */
+function firstUnquotedShellOpIndex(raw) {
+    let inSingle = false;
+    let inDouble = false;
+    for (let k = 0; k < raw.length; k++) {
+        const ch = raw[k];
+        // Outside single quotes, backslash escapes the next character (POSIX-ish).
+        if (ch === "\\" && k + 1 < raw.length && !inSingle) {
+            k++;
+            continue;
+        }
+        if (ch === "'" && !inDouble) {
+            inSingle = !inSingle;
+            continue;
+        }
+        if (ch === '"' && !inSingle) {
+            inDouble = !inDouble;
+            continue;
+        }
+        if (inSingle || inDouble)
+            continue;
+        if (ch === ";" || ch === "&" || ch === "|")
+            return k;
+    }
+    return -1;
+}
+/**
+ * Destinations from curl/wget/xxd/openssl/scp/aria2c/certutil via -o/--output/-O/-out/
+ * --output-dir/-P/-d/--dir (separate, =value, or attached short form), xxd -r path-like
+ * write positionals (#3206), and positional dests for scp/certutil (#3213).
+ * openssl uses flags only (no positional dests — avoids treating -in paths as writes).
+ * Segment stops at shell operators so compound `scp …authz…; echo` cannot overwrite dests.
+ * O(n) token walk — no nested-quantifier regex on untrusted input.
+ */
+function downloaderDecoderDestinations(tokens) {
+    const dests = [];
+    let i = 0;
+    while (i < tokens.length) {
+        if (!isDownloaderDecoderBin(tokens[i])) {
+            i++;
+            continue;
+        }
+        const bin = binBareName(tokens[i]);
+        i++;
+        // xxd reverse mode writes; without -r, path positionals are dump inputs (read).
+        let xxdReverse = false;
+        // scp / certutil: collect pathish operands in this segment (#3213).
+        // Fail-closed under UAT: any pathish mentioning protected store/kill paths is a dest
+        // candidate (scp source-or-dest of `.deft/authz` is treated as settings — prefer deny
+        // over source/dest thrash). Last pathish remains the ordinary write dest.
+        // Segment breaks (`;`/`\n`/glued ops) prevent following-command overwrite.
+        let lastPositionalPath = null;
+        const protectedPathish = [];
+        while (i < tokens.length) {
+            const raw = tokens[i];
+            const n = normalizeToken(raw);
+            // Bare shell ops end this bin's segment. Do NOT use normalizeToken here —
+            // quoted `';'` becomes `;` after strip and would cut before the real authz dest
+            // (Greptile P1 residual #3213). Glued ops are handled by firstUnquotedShellOpIndex.
+            if (isShellSegmentBreak(raw)) {
+                break;
+            }
+            // New bare bin starts another command segment (not pathish ./wget operands).
+            if (!n.startsWith("-") &&
+                !raw.includes("/") &&
+                !raw.includes("\\") &&
+                isDownloaderDecoderBin(raw)) {
+                break;
+            }
+            if (bin === "xxd" && (n === "-r" || n === "--reverse")) {
+                xxdReverse = true;
+                i++;
+                continue;
+            }
+            // Skip openssl/xxd input flags + value so -in PATH is not a write dest.
+            if (n === "-in" || n === "--in" || n === "-inform" || n === "--inform") {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-")) {
+                    i += 2;
+                    continue;
+                }
+                i++;
+                continue;
+            }
+            // scp: skip OpenSSH value-taking flags + their values (-o Option=Value, -i key, -P port).
+            if (bin === "scp" &&
+                (SCP_VALUE_FLAGS_LOWER.has(n) ||
+                    SCP_VALUE_FLAGS_EXACT.has(raw) ||
+                    SCP_VALUE_FLAGS_EXACT.has(n))) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    i += 2;
+                    continue;
+                }
+                i++;
+                continue;
+            }
+            // --flag=value (and rare -out=value); scp -oOption=Value attached form also lands here.
+            if (n.includes("=") && (n.startsWith("-") || n.startsWith("--"))) {
+                const eq = raw.indexOf("=");
+                const flag = normalizeToken(raw.slice(0, eq));
+                if (isDownloaderDestFlag(flag, bin)) {
+                    dests.push(pathishToken(raw.slice(eq + 1)));
+                }
+                // scp attached -oProxyCommand=… is not a file dest — skip without recording.
+                i++;
+                continue;
+            }
+            // Attached short: -oPATH / -OPATH (after lowercasing both are -opath…)
+            // Skip for scp (OpenSSH -oOption=Value attached forms are not file dests).
+            if (bin !== "scp" && n.startsWith("-") && !n.startsWith("--") && n.length > 2) {
+                if (n.startsWith("-out") && n.length > 4 && !n.startsWith("-output")) {
+                    dests.push(pathishToken(raw.slice(4)));
+                    i++;
+                    continue;
+                }
+                if (n.startsWith("-o") && !n.startsWith("-out") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
+                // wget attached -Pdir
+                if (bin === "wget" && n.startsWith("-p") && n.length > 2 && !n.startsWith("-proxy")) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
+                // aria2c attached -dDIR (#3213)
+                if (bin === "aria2c" && n.startsWith("-d") && n.length > 2) {
+                    dests.push(pathishToken(raw.slice(2)));
+                    i++;
+                    continue;
+                }
+            }
+            // Separate value: -o PATH / --output PATH / -out PATH / --output-dir / -P / -d
+            if (isDownloaderDestFlag(n, bin)) {
+                const next = tokens[i + 1];
+                if (next !== undefined && !String(next).startsWith("-") && !isShellSegmentBreak(next)) {
+                    dests.push(pathishToken(next));
+                    i += 2;
+                    continue;
+                }
+                i++;
+                continue;
+            }
+            // xxd -r only: path-like write positionals (not http(s) URLs). openssl: flags only.
+            if (bin === "xxd" && xxdReverse && !n.startsWith("-")) {
+                const p = pathishToken(raw);
+                if ((p.includes("/") || p.startsWith(".") || p.includes("\\")) &&
+                    !p.startsWith("http:") &&
+                    !p.startsWith("https:") &&
+                    !p.startsWith("ftp:")) {
+                    dests.push(p);
+                }
+            }
+            // scp / certutil: pathish operands (quote-aware glued-op cut).
+            // certutil under UAT: any `.deft/authz` / kill-switch pathish is fail-closed settings
+            // (read vs write thrash deferred — prefer deny over dest-parser perfection; #3213).
+            if ((bin === "scp" || bin === "certutil") && !n.startsWith("-")) {
+                const cut = firstUnquotedShellOpIndex(raw);
+                const cleaned = cut >= 0 ? raw.slice(0, cut) : raw;
+                const p = pathishToken(cleaned);
+                if (p.length > 0) {
+                    lastPositionalPath = p;
+                    // Fail-closed: protected store/kill basenames anywhere in scp/certutil pathish.
+                    if (p.includes(".deft/authz") ||
+                        p.includes(".deft-directive-disable") ||
+                        p.includes(".no-deft-directive")) {
+                        protectedPathish.push(p);
+                    }
+                }
+                if (cut >= 0) {
+                    i++;
+                    break;
+                }
+            }
+            i++;
+        }
+        // Prefer protected pathish (fail-closed) then last ordinary dest.
+        for (const p of protectedPathish) {
+            dests.push(p);
+        }
+        if (lastPositionalPath !== null && !protectedPathish.includes(lastPositionalPath)) {
+            dests.push(lastPositionalPath);
+        }
+    }
+    return dests;
+}
 function authzSubcommandFromToken(token) {
     const t = normalizeToken(token);
     if (t.startsWith("authz:")) {
@@ -237,45 +526,73 @@ function hasPolicyAuthorityMutator(tokens) {
     }
     return false;
 }
+/** True when pathish token names a kill-switch basename (quote-strip resistant). */
+function pathishMentionsKillSwitch(pathish) {
+    for (const name of KILL_SWITCH_BASENAMES) {
+        if (pathish === name || pathish.endsWith(`/${name}`) || pathish.includes(name)) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
- * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039).
+ * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213).
  * Planting the kill-switch under UAT would full-bypass subsequent gates without operator recovery.
+ * Includes symlink plant bins (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
  */
 function hasKillSwitchShellWrite(command, tokens) {
     const lower = command.toLowerCase().replace(/\\/g, "/");
+    // Quote-stripped form so `'.deft'-directive-disable`-class splits still match (#3213).
+    const stripped = lower.replace(/['"]/g, "");
     let mentionsKill = false;
     for (const name of KILL_SWITCH_BASENAMES) {
-        if (lower.includes(name)) {
+        if (lower.includes(name) || stripped.includes(name)) {
             mentionsKill = true;
             break;
         }
     }
+    if (!mentionsKill) {
+        for (const t of tokens) {
+            if (pathishMentionsKillSwitch(pathishToken(t))) {
+                mentionsKill = true;
+                break;
+            }
+        }
+    }
     if (!mentionsKill)
         return false;
-    // Redirect dest region after each `>` / `>>` (O(n)).
-    for (let i = 0; i < lower.length; i++) {
-        if (lower[i] !== ">")
-            continue;
-        let j = i + 1;
-        if (j < lower.length && lower[j] === ">")
-            j++;
-        let end = j;
-        while (end < lower.length &&
-            lower[end] !== "|" &&
-            lower[end] !== ";" &&
-            lower[end] !== "&" &&
-            lower[end] !== "\n") {
-            end++;
-        }
-        const dest = lower.slice(j, end);
-        for (const name of KILL_SWITCH_BASENAMES) {
-            if (dest.includes(name))
-                return true;
+    // Redirect dest region after each `>` / `>>` (O(n)); check raw + quote-stripped.
+    for (const hay of [lower, stripped]) {
+        for (let i = 0; i < hay.length; i++) {
+            if (hay[i] !== ">")
+                continue;
+            let j = i + 1;
+            if (j < hay.length && hay[j] === ">")
+                j++;
+            let end = j;
+            while (end < hay.length &&
+                hay[end] !== "|" &&
+                hay[end] !== ";" &&
+                hay[end] !== "&" &&
+                hay[end] !== "\n") {
+                end++;
+            }
+            const dest = hay.slice(j, end);
+            for (const name of KILL_SWITCH_BASENAMES) {
+                if (dest.includes(name))
+                    return true;
+            }
         }
     }
-    // Write/destructive bins with a kill-switch path argument (touch, New-Item, …).
+    // Downloader/decoder destinations: curl -o .deft-directive-disable, scp, … (#3206 / #3213).
+    for (const dest of downloaderDecoderDestinations(tokens)) {
+        if (pathishMentionsKillSwitch(dest))
+            return true;
+    }
+    // Write/destructive + symlink plant bins with a kill-switch path argument (#3213: ln/link/mklink).
     const killWriteBins = new Set([
         ...INDIRECT_WRITE_BINS,
+        ...SYMLINK_PLANT_BINS,
         "touch",
         "new-item",
         "ni",
@@ -284,26 +601,27 @@ function hasKillSwitchShellWrite(command, tokens) {
         "type",
     ]);
     for (let ti = 0; ti < tokens.length; ti++) {
-        if (!killWriteBins.has(normalizeToken(tokens[ti])))
+        const binTok = normalizeToken(tokens[ti]);
+        const bare = binBareName(tokens[ti]);
+        if (!killWriteBins.has(binTok) && !killWriteBins.has(bare))
             continue;
         for (let tj = ti + 1; tj < tokens.length; tj++) {
-            const p = pathishToken(tokens[tj]);
-            for (const name of KILL_SWITCH_BASENAMES) {
-                if (p.includes(name))
-                    return true;
-            }
+            if (pathishMentionsKillSwitch(pathishToken(tokens[tj])))
+                return true;
         }
     }
-    // Bare `touch .deft-directive-disable` — first token may be touch, path later.
+    // Bare `touch .deft-directive-disable` / `ln -sf x .deft-directive-disable` — path later.
     for (const t of tokens) {
         const p = pathishToken(t);
         for (const name of KILL_SWITCH_BASENAMES) {
             // Exact basename or ends with /basename
             if (p === name || p.endsWith(`/${name}`)) {
-                // Require some write shape (redirect already handled; touch/ni/echo/…)
+                // Require some write shape (redirect already handled; touch/ni/echo/ln/…)
                 if (hasWriteShape(command, tokens) ||
                     lower.includes("touch") ||
-                    lower.includes("new-item")) {
+                    lower.includes("new-item") ||
+                    SYMLINK_PLANT_BINS.has(binBareName(tokens[0])) ||
+                    tokens.some((tok) => SYMLINK_PLANT_BINS.has(binBareName(tok)))) {
                     return true;
                 }
             }
@@ -476,42 +794,68 @@ function pathishToken(token) {
     return token.replace(/['"]/g, "").toLowerCase().replace(/\\/g, "/");
 }
 /**
- * Shell **write** targeting `.deft/authz/` (#3110 AC-3).
+ * True when a pathish string targets `.deft/authz` (after quote strip / slash normalize).
+ * Quote-split forms like `'.deft/'authz'/grants/x'` become `.deft/authz/grants/x` via pathishToken.
+ */
+function pathishIsAuthzDir(pathish) {
+    return pathish.includes(".deft/authz");
+}
+/**
+ * Shell **write** targeting `.deft/authz/` (#3110 AC-3 / #3206 / #3213).
  * Pure reads (`cat .deft/authz/state.json`) stay unclassifiable — use `authz:show`.
  * Redirects only count when the destination region contains `.deft/authz`.
+ * Pathish/token checks run even when the raw command lacks contiguous `.deft/authz`
+ * text (quote-split residual: `cp x '.deft/'authz'/grants/y'`).
  */
 function hasAuthzDirShellWrite(command, tokens) {
     const lower = command.toLowerCase().replace(/\\/g, "/");
-    if (!lower.includes(".deft/authz"))
-        return false;
+    // Quote-stripped contiguous form for redirect dest checks (#3213).
+    const stripped = lower.replace(/['"]/g, "");
     // Redirect dest region after each `>` / `>>` (O(n); no nested-quantifier regex).
-    for (let i = 0; i < lower.length; i++) {
-        if (lower[i] !== ">")
-            continue;
-        let j = i + 1;
-        if (j < lower.length && lower[j] === ">")
-            j++;
-        // Dest until pipe/semicolon/ampersand/newline.
-        let end = j;
-        while (end < lower.length &&
-            lower[end] !== "|" &&
-            lower[end] !== ";" &&
-            lower[end] !== "&" &&
-            lower[end] !== "\n") {
-            end++;
-        }
-        if (lower.slice(j, end).includes(".deft/authz"))
-            return true;
+    // Check both raw and quote-stripped so quote-split dests still match.
+    for (const hay of [lower, stripped]) {
+        for (let i = 0; i < hay.length; i++) {
+            if (hay[i] !== ">")
+                continue;
+            let j = i + 1;
+            if (j < hay.length && hay[j] === ">")
+                j++;
+            // Dest until pipe/semicolon/ampersand/newline.
+            let end = j;
+            while (end < hay.length &&
+                hay[end] !== "|" &&
+                hay[end] !== ";" &&
+                hay[end] !== "&" &&
+                hay[end] !== "\n") {
+                end++;
+            }
+            if (hay.slice(j, end).includes(".deft/authz"))
+                return true;
+        }
     }
-    // Write/destructive bins with an authz path argument.
+    // Write/destructive + symlink plant bins with an authz path argument (pathish =
+    // quote-strip resistant). Always run — do not gate on contiguous `.deft/authz`
+    // in the raw command (#3213). SYMLINK_PLANT_BINS: `ln -s forged .deft/authz/grants/x`
+    // must not fail-open as unclassifiable (SLizard residual).
     for (let ti = 0; ti < tokens.length; ti++) {
-        if (!INDIRECT_WRITE_BINS.has(normalizeToken(tokens[ti])))
+        const bare = binBareName(tokens[ti]);
+        const n = normalizeToken(tokens[ti]);
+        if (!INDIRECT_WRITE_BINS.has(n) &&
+            !INDIRECT_WRITE_BINS.has(bare) &&
+            !SYMLINK_PLANT_BINS.has(bare)) {
             continue;
+        }
         for (let tj = ti + 1; tj < tokens.length; tj++) {
-            if (pathishToken(tokens[tj]).includes(".deft/authz"))
+            if (pathishIsAuthzDir(pathishToken(tokens[tj])))
                 return true;
         }
     }
+    // Downloader/decoder destinations under .deft/authz (#3206 / #3213 scp/aria2c/certutil).
+    for (const dest of downloaderDecoderDestinations(tokens)) {
+        if (pathishIsAuthzDir(dest))
+            return true;
+    }
+    // Contiguous mention without write shape stays false (reads like cat .deft/authz/…).
     return false;
 }
 /** Write/destructive shell bins (token match after normalizeToken). */

package/dist/consumer-check-contract/evaluate.d.ts

@@ -38,7 +38,47 @@ export interface ConsumerCheckContractOptions {
     /** When true, missing CI references warn only (default true for migration). */
     readonly ciWarnOnly?: boolean;
     readonly enforce?: boolean;
+    /**
+     * Inject included framework Taskfile text (canonical `.deft/core/Taskfile.yml`).
+     * When undefined, resolve from disk via {@link resolveCanonicalDeftTaskfileInclude}.
+     * #3218 greenfield include-only consumers.
+     */
+    readonly includedFrameworkTaskfileText?: string | null;
+    /**
+     * Inject included framework `tasks/verify.yml` text next to the canonical include.
+     * When undefined, resolve from disk beside the included Taskfile.
+     */
+    readonly includedVerifyTaskfileText?: string | null;
 }
+/**
+ * Relative path forms accepted for the deft-install canonical Taskfile include
+ * (init-deposit `MINIMAL_TASKFILE` / `CANONICAL_TASKFILE_INCLUDE`).
+ * Use only as a path-value matcher — never as a whole-file text search (Greptile P1 #3218).
+ */
+export declare const CANONICAL_DEFT_TASKFILE_PATH_RE: RegExp;
+/** @deprecated Prefer path/line parsers; kept for export stability. */
+export declare const CANONICAL_DEFT_TASKFILE_INCLUDE_RE: RegExp;
+/**
+ * Return the relative path of the canonical `.deft/core/Taskfile.yml` include when
+ * present as an **active, direct** go-task `includes:` entry; otherwise null.
+ *
+ * Greenfield `directive init` deposits an include-only Taskfile (#3218); composition
+ * lives in the included framework graph, not in root `check` deps.
+ *
+ * Greptile P1 (#3218):
+ * - Path text in comments / cmds / vars / non-include keys must not match.
+ * - Only **direct** include entries count: short form `deft: path` or object form
+ *   `deft: { taskfile: path }` (immediate property). Nested
+ *   `includes.some.nested.taskfile` is not an executable go-task include.
+ * - Namespace must be `deft` so the documented `task deft:check` entrypoint exists.
+ */
+export declare function resolveCanonicalDeftTaskfileInclude(rootTaskfileText: string): string | null;
+/**
+ * True when a framework (included) Taskfile composes every required gate via
+ * `check` / `check:consumer` / `check:framework-source` deps or an orchestrator body,
+ * and `tasks/verify.yml` defines the local task keys.
+ */
+export declare function frameworkTaskfileComposesRequiredGates(frameworkTaskfileText: string, verifyTaskfileText: string | null, required?: readonly string[]): boolean;
 /** True if `text` mentions the gate as a task dep, script, or CLI invocation. */
 export declare function textReferencesGate(text: string, gateId: string): boolean;
 /**