@deftai/directive-runtime 0.129.4 → 0.129.6

package/vendor/directive-core/dist/authz/classify.d.ts

@@ -14,6 +14,10 @@
 import { classifyMcpTool, classifyShellCommand, listShellOps } from "../policy/runtime-authority.js";
 import type { AuthzOperation } from "./types.js";
 export type AuthzClassifiedOp = AuthzOperation | "test" | "evidence" | "unknown" | "protected_store";
+/** Kill-switch / permanent opt-out basenames agents must not plant (#3186 / #3039 / #6136). */
+export declare const KILL_SWITCH_BASENAMES: readonly [".deft-directive-disable", ".no-deft-directive"];
+/** True when a path basename is a kill-switch / permanent opt-out plant target (#6136). */
+export declare function isKillSwitchPlantPath(pathish: string): boolean;
 /** True when a recovered dest literal is a payload-relative protected path. */
 export declare function destLiteralIsRelativeProtected(dest: string): boolean;
 /**
@@ -23,6 +27,12 @@ export declare function destLiteralIsRelativeProtected(dest: string): boolean;
  * symlink dest can still be realpath-resolved.
  */
 export declare function harvestDestsOfWriteForRealpath(command: string): string[];
+/**
+ * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213 / #6136).
+ * Always-on grant-gated plant deny (not UAT-only). Includes symlink plant bins
+ * (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
+ */
+export declare function hasKillSwitchShellWrite(command: string, tokens?: readonly string[]): boolean;
 /** Best-effort shell classification for UAT-sensitive ops beyond push/merge. */
 export declare function classifyShellAuthzOps(command: string): AuthzClassifiedOp[];
 /** Map a PreToolUse tool name + optional shell command to authz ops. */
@@ -33,6 +43,8 @@ export declare function classifyHookAuthzOps(input: {
     readonly mcpArgsText?: string | null;
     /** Payload root for #4188 harvest realpath. Blank/omitted skips harvest. */
     readonly projectRoot?: string | null;
+    /** Direct Write/Edit target path for always-on kill-switch plant classify (#6136). */
+    readonly writePath?: string | null;
 }): AuthzClassifiedOp[];
 /**
  * Public pin for #4709: Shell write targeting `.deft/authz/` or `.deft/approved-scope/`.
@@ -50,6 +62,12 @@ export declare function hasProtectedDestOfWriteUnknown(command: string): boolean
  * realpath against an explicit payload root closes non-lexical symlink aliases.
  */
 export declare function inactiveShellTargetsProtectedStore(command: string): boolean;
+/**
+ * First matched protected dest/token from the same classify/harvest routes that
+ * set protected_store (#5970 P3). Lexical dest-of-write first; #4188 realpath
+ * harvest when projectRoot is provided. Proven readers yield null.
+ */
+export declare function matchProtectedStoreShellDest(command: string, projectRoot?: string | null): string | null;
 /** Re-export #2711 classifiers for composition docs/tests. */
 export { classifyMcpTool, classifyShellCommand, listShellOps };
 //# sourceMappingURL=classify.d.ts.map

package/vendor/directive-core/dist/authz/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/authz/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,GACT,iBAAiB,CAAC;AA28FtB,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BxE;AA+5CD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAgH1E;AAyOD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC,GAAG,iBAAiB,EAAE,CAkDtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/authz/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AAKxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,GACT,iBAAiB,CAAC;AA6KtB,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,4DAA6D,CAAC;AAEhG,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AA61FD,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BxE;AAuaD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAK5F;AAo/BD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAiH1E;AA+OD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,GAAG,iBAAiB,EAAE,CA2DtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,MAAM,GAAG,IAAI,CAkEf;AAED,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC"}

package/vendor/directive-core/dist/authz/classify.js

@@ -13,7 +13,7 @@
  */
 import { isShellTool } from "../hooks/tools.js";
 import { classifyMcpTool, classifyShellCommand, listShellOps, } from "../policy/runtime-authority.js";
-import { shellCommandHasPayloadRootProtectedDestAfterRealpath } from "./protected-dest-realpath.js";
+import { resolvedDestIsPayloadRootProtected, shellCommandHasPayloadRootProtectedDestAfterRealpath, } from "./protected-dest-realpath.js";
 /**
  * Split on whitespace without nested quantifiers (O(n)).
  * Newlines become `;` segment breaks so compound lists like
@@ -185,8 +185,20 @@ const POLICY_AUTHORITY_MUTATORS = new Set([
     "disable-directive",
     "enable-directive",
 ]);
-/** Kill-switch / permanent opt-out basenames agents must not plant under UAT (#3186 / #3039). */
-const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/** Kill-switch / permanent opt-out basenames agents must not plant (#3186 / #3039 / #6136). */
+export const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/** True when a path basename is a kill-switch / permanent opt-out plant target (#6136). */
+export function isKillSwitchPlantPath(pathish) {
+    // Lowercase so Windows / case-insensitive plants (`.DEFT-DIRECTIVE-DISABLE`) match.
+    const p = canonicalizePathish(pathish).toLowerCase();
+    if (p.length === 0)
+        return false;
+    for (const name of KILL_SWITCH_BASENAMES) {
+        if (p === name || p.endsWith(`/${name}`))
+            return true;
+    }
+    return false;
+}
 /**
  * Dest-form writers #3529 harvest missed (#3545). Shared across downloader,
  * archive-alt, positional, and indirect-write membership so a named-peer
@@ -1488,6 +1500,49 @@ function zipShellWithoutLineContinuations(command) {
     }
     return result;
 }
+/**
+ * True for executable command substitution (`$(…)` / backticks) outside single
+ * quotes. Arithmetic `$((…))` and plain `$VAR` / `${VAR}` do not qualify —
+ * those cannot run a nested writer before the outer argv0 (#5970 P1).
+ */
+function zipShellWordHasCommandSubstitution(raw) {
+    let quote = null;
+    for (let i = 0; i < raw.length; i++) {
+        const char = raw[i];
+        if (char === "\\" && quote !== "'" && i + 1 < raw.length) {
+            i++;
+            continue;
+        }
+        if (quote === null && char === "$" && raw[i + 1] === "'") {
+            quote = "$'";
+            i++;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            if (quote === null)
+                quote = char;
+            else if (quote === "$'" && char === "'")
+                quote = null;
+            else if (quote === char)
+                quote = null;
+            continue;
+        }
+        if (quote === "'" || quote === "$'")
+            continue;
+        if (char === "`")
+            return true;
+        if (char === "$" && raw[i + 1] === "(" && raw[i + 2] !== "(")
+            return true;
+    }
+    return false;
+}
+function argvHasCommandSubstitution(words, execIndex) {
+    for (let i = execIndex + 1; i < words.length; i++) {
+        if (zipShellWordHasCommandSubstitution(words[i]))
+            return true;
+    }
+    return false;
+}
 /** True for shell expansion syntax outside single quotes and not escaped. */
 function zipShellWordHasExpansion(raw) {
     let quote = null;
@@ -2194,6 +2249,22 @@ const READ_ONLY_PROOF_BINS = new Set([
     "gawk",
     "nawk",
 ]);
+/**
+ * #5970 Approach1 existence probes. Sole classify carve for relative dest-of-write
+ * and #4188 harvest (no second harvest-only skip list). test/[ ignore POSIX -o OR;
+ * dir/Get-ChildItem still refuse sort/awk-style output-dest flags.
+ */
+const EXISTENCE_PROBE_READ_ONLY_BINS = new Set([
+    "test-path",
+    "test",
+    "[",
+    "get-item",
+    "gi",
+    "dir",
+    "get-childitem",
+    "gci",
+]);
+const EXISTENCE_PROBE_IGNORE_OUTPUT_DEST_FLAGS = new Set(["test", "["]);
 const READ_ONLY_PROOF_OUTPUT_DEST_FLAGS = new Set(["-o", "--output", "--pretty-print"]);
 function argvHasOutputDestFlag(words, execIndex) {
     for (let i = execIndex + 1; i < words.length; i++) {
@@ -2281,6 +2352,9 @@ function isProvenReadOnlyArgv(words, execIndex) {
     const literal = argv0Literal(words, execIndex);
     if (literal === null || argv0IsPathQualified(literal))
         return false;
+    // Nested writers in argv (`$(mkfile …)` / backticks) void the reader proof (#5970 P1).
+    if (argvHasCommandSubstitution(words, execIndex))
+        return false;
     const name = writeBinName(literal);
     if (isArStyleArchiveBin(name)) {
         const rawMode = words[execIndex + 1];
@@ -2290,6 +2364,14 @@ function isProvenReadOnlyArgv(words, execIndex) {
         return (/^[abcdfilmnpqrstuvx]+$/.test(mode) &&
             ![...mode].some((letter) => ARCHIVE_WRITE_OPERATIONS.has(letter)));
     }
+    if (EXISTENCE_PROBE_READ_ONLY_BINS.has(name)) {
+        // Visible refuse for nested writers (Greptile #5970 P1); also gated above.
+        if (argvHasCommandSubstitution(words, execIndex))
+            return false;
+        if (EXISTENCE_PROBE_IGNORE_OUTPUT_DEST_FLAGS.has(name))
+            return true;
+        return !argvHasOutputDestFlag(words, execIndex);
+    }
     if (READ_ONLY_PROOF_BINS.has(name)) {
         if (name === "sort" || name === "awk" || name === "gawk" || name === "nawk") {
             return !argvHasOutputDestFlag(words, execIndex);
@@ -3452,7 +3534,7 @@ function sqlite3MetaDest(raw, next) {
     return null;
 }
 function pathishMentionsKillSwitch(pathish) {
-    const p = canonicalizePathish(pathish);
+    const p = canonicalizePathish(pathish).toLowerCase();
     for (const name of KILL_SWITCH_BASENAMES) {
         if (p === name || p.endsWith(`/${name}`) || p.includes(name)) {
             return true;
@@ -3461,11 +3543,18 @@ function pathishMentionsKillSwitch(pathish) {
     return false;
 }
 /**
- * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213).
- * Planting the kill-switch under UAT would full-bypass subsequent gates without operator recovery.
- * Includes symlink plant bins (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
+ * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213 / #6136).
+ * Always-on grant-gated plant deny (not UAT-only). Includes symlink plant bins
+ * (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
  */
-function hasKillSwitchShellWrite(command, tokens) {
+export function hasKillSwitchShellWrite(command, tokens) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return false;
+    const resolvedTokens = tokens ?? shellTokens(cmd);
+    return hasKillSwitchShellWriteInner(cmd, resolvedTokens);
+}
+function hasKillSwitchShellWriteInner(command, tokens) {
     const lower = command.toLowerCase().replace(/\\/g, "/");
     // Quote-stripped form so `'.deft'-directive-disable`-class splits still match (#3213).
     const stripped = lower.replace(/['"]/g, "");
@@ -3505,6 +3594,8 @@ function hasKillSwitchShellWrite(command, tokens) {
     }
     // Write/destructive + symlink plant + archive/alt-write bins with a kill-switch path
     // argument (#3213 ln/link/mklink; #3245 tar/axel/rclone/socat residual).
+    // echo/printf/type are stdout-only without a redirect; redirect dests are handled
+    // above so bare `echo .deft-directive-disable` stays non-plant (#6136 Greptile P2).
     const killWriteBins = new Set([
         ...INDIRECT_WRITE_BINS,
         ...SYMLINK_PLANT_BINS,
@@ -3512,9 +3603,6 @@ function hasKillSwitchShellWrite(command, tokens) {
         "touch",
         "new-item",
         "ni",
-        "echo",
-        "printf",
-        "type",
     ]);
     for (let ti = 0; ti < tokens.length; ti++) {
         const binTok = normalizeToken(tokens[ti]);
@@ -4512,7 +4600,8 @@ export function classifyShellAuthzOps(command) {
         found.add("settings");
     if (commandHasAuthzDirShellWrite(cmd, tokens))
         found.add("settings");
-    // #3186: kill-switch plant + policy authority mutators → settings (UAT fail-closed).
+    // #3186 / #6136: kill-switch plant + policy authority mutators → settings
+    // (always-on grant-gated via dispatcher; not UAT-only).
     if (hasKillSwitchShellWrite(cmd, tokens))
         found.add("settings");
     if (hasPolicyAuthorityMutator(tokens))
@@ -4729,7 +4818,11 @@ function isCargoArgv0(name) {
 const EMPTY_OPS_DEST_ASSIGNMENT_KEYS = new Set(["of"]);
 function emptyOpsSegmentIsReadShaped(tokens, index) {
     const first = firstCommandBin(segmentSliceAround(tokens, index));
-    return READ_SHAPED_FILE_FLAG_BINS.has(first) || DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(first);
+    // #5970: POSIX test/[ use -f/-o as predicates, not EMPTY_OPS_DEST_FLAGS writers.
+    // dir/Get-ChildItem stay off this carve so -o/--output dest plants still deny.
+    return (READ_SHAPED_FILE_FLAG_BINS.has(first) ||
+        DEST_ASSIGNMENT_NON_WRITER_FIRST_BINS.has(first) ||
+        EXISTENCE_PROBE_IGNORE_OUTPUT_DEST_FLAGS.has(first));
 }
 function destFlagOperandIsProtectedSettings(tokens) {
     for (let i = 0; i < tokens.length; i++) {
@@ -4813,8 +4906,17 @@ function hasWriteShapedProtectedSettingsDest(command, tokens) {
 /** Map a PreToolUse tool name + optional shell command to authz ops. */
 export function classifyHookAuthzOps(input) {
     const { toolName, shellCommand, isDirectWrite } = input;
-    if (isDirectWrite)
+    if (isDirectWrite) {
+        // Prefer-A Bound #6136: kill-switch Write/Edit is `settings` (always-on grant
+        // gate). Keep off bare `edit` — isProtectedStoreEditDest treats the flag
+        // basenames themselves as protected and would deny before the grant check.
+        // Symlink plants into `.deft/authz/` are denied in dispatcher via realpath
+        // (not this op class alone).
+        const writePath = (input.writePath ?? "").trim();
+        if (writePath.length > 0 && isKillSwitchPlantPath(writePath))
+            return ["settings"];
         return ["edit"];
+    }
     const lower = toolName.toLowerCase();
     // Shared catalog (#4041 / #3987). A second name list missed Grok monitor.
     if (isShellTool(toolName)) {
@@ -4892,6 +4994,86 @@ export function hasProtectedDestOfWriteUnknown(command) {
 export function inactiveShellTargetsProtectedStore(command) {
     return hasAuthzDirShellWrite(command) || hasProtectedDestOfWriteUnknown(command);
 }
+/**
+ * First matched protected dest/token from the same classify/harvest routes that
+ * set protected_store (#5970 P3). Lexical dest-of-write first; #4188 realpath
+ * harvest when projectRoot is provided. Proven readers yield null.
+ */
+export function matchProtectedStoreShellDest(command, projectRoot) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return null;
+    for (const segment of zipStyleCommandSegments(cmd)) {
+        if (isProvenReadOnlyArgv(segment.words, segment.execIndex))
+            continue;
+        const jarDest = jarCreateArchiveDest(segment.words, segment.execIndex);
+        if (jarDest !== null && isRelativePayloadProtectedDest(jarDest))
+            return jarDest;
+        const archiveDest = firstArchiveOperandDest(segment.words, segment.execIndex);
+        if (archiveDest !== null && isRelativePayloadProtectedDest(archiveDest))
+            return archiveDest;
+        for (const doubleColonDest of doubleColonCreateArchiveDests(segment.words, segment.execIndex)) {
+            if (isRelativePayloadProtectedDest(doubleColonDest))
+                return doubleColonDest;
+        }
+        for (const dest of harvestInterpreterPayloadDests(segment.words, segment.execIndex)) {
+            if (isRelativePayloadProtectedDest(dest))
+                return dest;
+        }
+        const name = argv0BareName(segment.words, segment.execIndex);
+        if (name !== null) {
+            for (const dest of harvestUnknownDestFlagValues(segment.words, segment.execIndex, name)) {
+                if (isRelativePayloadProtectedDest(dest))
+                    return dest;
+            }
+        }
+        const last = lastDestOfWritePositional(segment.words, segment.execIndex);
+        if (last !== null && isRelativePayloadProtectedDest(last)) {
+            const lit = zipShellWordLiteral(last);
+            return lit ?? last;
+        }
+    }
+    const tokens = shellTokens(cmd);
+    if (hasWriteShapedProtectedSettingsDest(cmd, tokens)) {
+        // Prefer redirect destinations over earlier read operands (#5970 P2).
+        for (let i = 0; i < cmd.length; i++) {
+            if (cmd[i] !== ">")
+                continue;
+            const dest = redirectDestSlice(cmd.toLowerCase().replace(/\\/g, "/"), i).trim();
+            if (dest.length > 0 && pathishIsProtectedMutationDest(dest))
+                return dest;
+        }
+        for (const raw of tokens) {
+            const pathish = pathishToken(raw);
+            if (pathishIsProtectedMutationDest(pathish))
+                return pathish;
+        }
+    }
+    if (commandHasAuthzDirShellWrite(cmd, tokens)) {
+        for (const raw of tokens) {
+            const pathish = pathishToken(raw);
+            if (pathishIsAuthzDir(pathish) || pathishIsApprovedScopeDir(pathish))
+                return pathish;
+        }
+    }
+    if (hasKillSwitchShellWrite(cmd, tokens)) {
+        for (const raw of tokens) {
+            const pathish = pathishToken(raw);
+            if (pathishMentionsKillSwitch(pathish))
+                return pathish;
+        }
+    }
+    const harvestRoot = (projectRoot ?? "").trim();
+    if (harvestRoot.length > 0) {
+        for (const dest of harvestDestsOfWriteForRealpath(cmd)) {
+            if (destLiteralIsRelativeProtected(dest))
+                continue;
+            if (resolvedDestIsPayloadRootProtected(harvestRoot, dest))
+                return dest;
+        }
+    }
+    return null;
+}
 /** Re-export #2711 classifiers for composition docs/tests. */
 export { classifyMcpTool, classifyShellCommand, listShellOps };
 //# sourceMappingURL=classify.js.map