@deftai/directive-runtime 0.129.5 → 0.129.6

package/vendor/directive-core/dist/authz/classify.d.ts

@@ -14,6 +14,10 @@
 import { classifyMcpTool, classifyShellCommand, listShellOps } from "../policy/runtime-authority.js";
 import type { AuthzOperation } from "./types.js";
 export type AuthzClassifiedOp = AuthzOperation | "test" | "evidence" | "unknown" | "protected_store";
+/** Kill-switch / permanent opt-out basenames agents must not plant (#3186 / #3039 / #6136). */
+export declare const KILL_SWITCH_BASENAMES: readonly [".deft-directive-disable", ".no-deft-directive"];
+/** True when a path basename is a kill-switch / permanent opt-out plant target (#6136). */
+export declare function isKillSwitchPlantPath(pathish: string): boolean;
 /** True when a recovered dest literal is a payload-relative protected path. */
 export declare function destLiteralIsRelativeProtected(dest: string): boolean;
 /**
@@ -23,6 +27,12 @@ export declare function destLiteralIsRelativeProtected(dest: string): boolean;
  * symlink dest can still be realpath-resolved.
  */
 export declare function harvestDestsOfWriteForRealpath(command: string): string[];
+/**
+ * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213 / #6136).
+ * Always-on grant-gated plant deny (not UAT-only). Includes symlink plant bins
+ * (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
+ */
+export declare function hasKillSwitchShellWrite(command: string, tokens?: readonly string[]): boolean;
 /** Best-effort shell classification for UAT-sensitive ops beyond push/merge. */
 export declare function classifyShellAuthzOps(command: string): AuthzClassifiedOp[];
 /** Map a PreToolUse tool name + optional shell command to authz ops. */
@@ -33,6 +43,8 @@ export declare function classifyHookAuthzOps(input: {
     readonly mcpArgsText?: string | null;
     /** Payload root for #4188 harvest realpath. Blank/omitted skips harvest. */
     readonly projectRoot?: string | null;
+    /** Direct Write/Edit target path for always-on kill-switch plant classify (#6136). */
+    readonly writePath?: string | null;
 }): AuthzClassifiedOp[];
 /**
  * Public pin for #4709: Shell write targeting `.deft/authz/` or `.deft/approved-scope/`.

package/vendor/directive-core/dist/authz/classify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/authz/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AAKxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,GACT,iBAAiB,CAAC;AA2gGtB,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BxE;AA+5CD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAgH1E;AA+OD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC,GAAG,iBAAiB,EAAE,CAkDtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,MAAM,GAAG,IAAI,CAkEf;AAED,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"classify.d.ts","sourceRoot":"","sources":["../../src/authz/classify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EAEb,MAAM,gCAAgC,CAAC;AAKxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB,cAAc,GACd,MAAM,GACN,UAAU,GACV,SAAS,GACT,iBAAiB,CAAC;AA6KtB,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB,4DAA6D,CAAC;AAEhG,2FAA2F;AAC3F,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ9D;AA61FD,+EAA+E;AAC/E,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIpE;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA4BxE;AAuaD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAK5F;AAo/BD,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAiH1E;AA+OD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC,GAAG,iBAAiB,EAAE,CA2DtB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAI9D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYvE;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,EACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,GAC1B,MAAM,GAAG,IAAI,CAkEf;AAED,8DAA8D;AAC9D,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,YAAY,EAAE,CAAC"}

package/vendor/directive-core/dist/authz/classify.js

@@ -185,8 +185,20 @@ const POLICY_AUTHORITY_MUTATORS = new Set([
     "disable-directive",
     "enable-directive",
 ]);
-/** Kill-switch / permanent opt-out basenames agents must not plant under UAT (#3186 / #3039). */
-const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/** Kill-switch / permanent opt-out basenames agents must not plant (#3186 / #3039 / #6136). */
+export const KILL_SWITCH_BASENAMES = [".deft-directive-disable", ".no-deft-directive"];
+/** True when a path basename is a kill-switch / permanent opt-out plant target (#6136). */
+export function isKillSwitchPlantPath(pathish) {
+    // Lowercase so Windows / case-insensitive plants (`.DEFT-DIRECTIVE-DISABLE`) match.
+    const p = canonicalizePathish(pathish).toLowerCase();
+    if (p.length === 0)
+        return false;
+    for (const name of KILL_SWITCH_BASENAMES) {
+        if (p === name || p.endsWith(`/${name}`))
+            return true;
+    }
+    return false;
+}
 /**
  * Dest-form writers #3529 harvest missed (#3545). Shared across downloader,
  * archive-alt, positional, and indirect-write membership so a named-peer
@@ -3522,7 +3534,7 @@ function sqlite3MetaDest(raw, next) {
     return null;
 }
 function pathishMentionsKillSwitch(pathish) {
-    const p = canonicalizePathish(pathish);
+    const p = canonicalizePathish(pathish).toLowerCase();
     for (const name of KILL_SWITCH_BASENAMES) {
         if (p === name || p.endsWith(`/${name}`) || p.includes(name)) {
             return true;
@@ -3531,11 +3543,18 @@ function pathishMentionsKillSwitch(pathish) {
     return false;
 }
 /**
- * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213).
- * Planting the kill-switch under UAT would full-bypass subsequent gates without operator recovery.
- * Includes symlink plant bins (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
+ * Shell write targeting `.deft-directive-disable` / `.no-deft-directive` (#3186 / #3039 / #3213 / #6136).
+ * Always-on grant-gated plant deny (not UAT-only). Includes symlink plant bins
+ * (`ln`/`link`/`mklink`) and quote-split-resistant basename checks.
  */
-function hasKillSwitchShellWrite(command, tokens) {
+export function hasKillSwitchShellWrite(command, tokens) {
+    const cmd = command.trim();
+    if (cmd.length === 0)
+        return false;
+    const resolvedTokens = tokens ?? shellTokens(cmd);
+    return hasKillSwitchShellWriteInner(cmd, resolvedTokens);
+}
+function hasKillSwitchShellWriteInner(command, tokens) {
     const lower = command.toLowerCase().replace(/\\/g, "/");
     // Quote-stripped form so `'.deft'-directive-disable`-class splits still match (#3213).
     const stripped = lower.replace(/['"]/g, "");
@@ -3575,6 +3594,8 @@ function hasKillSwitchShellWrite(command, tokens) {
     }
     // Write/destructive + symlink plant + archive/alt-write bins with a kill-switch path
     // argument (#3213 ln/link/mklink; #3245 tar/axel/rclone/socat residual).
+    // echo/printf/type are stdout-only without a redirect; redirect dests are handled
+    // above so bare `echo .deft-directive-disable` stays non-plant (#6136 Greptile P2).
     const killWriteBins = new Set([
         ...INDIRECT_WRITE_BINS,
         ...SYMLINK_PLANT_BINS,
@@ -3582,9 +3603,6 @@ function hasKillSwitchShellWrite(command, tokens) {
         "touch",
         "new-item",
         "ni",
-        "echo",
-        "printf",
-        "type",
     ]);
     for (let ti = 0; ti < tokens.length; ti++) {
         const binTok = normalizeToken(tokens[ti]);
@@ -4582,7 +4600,8 @@ export function classifyShellAuthzOps(command) {
         found.add("settings");
     if (commandHasAuthzDirShellWrite(cmd, tokens))
         found.add("settings");
-    // #3186: kill-switch plant + policy authority mutators → settings (UAT fail-closed).
+    // #3186 / #6136: kill-switch plant + policy authority mutators → settings
+    // (always-on grant-gated via dispatcher; not UAT-only).
     if (hasKillSwitchShellWrite(cmd, tokens))
         found.add("settings");
     if (hasPolicyAuthorityMutator(tokens))
@@ -4887,8 +4906,17 @@ function hasWriteShapedProtectedSettingsDest(command, tokens) {
 /** Map a PreToolUse tool name + optional shell command to authz ops. */
 export function classifyHookAuthzOps(input) {
     const { toolName, shellCommand, isDirectWrite } = input;
-    if (isDirectWrite)
+    if (isDirectWrite) {
+        // Prefer-A Bound #6136: kill-switch Write/Edit is `settings` (always-on grant
+        // gate). Keep off bare `edit` — isProtectedStoreEditDest treats the flag
+        // basenames themselves as protected and would deny before the grant check.
+        // Symlink plants into `.deft/authz/` are denied in dispatcher via realpath
+        // (not this op class alone).
+        const writePath = (input.writePath ?? "").trim();
+        if (writePath.length > 0 && isKillSwitchPlantPath(writePath))
+            return ["settings"];
         return ["edit"];
+    }
     const lower = toolName.toLowerCase();
     // Shared catalog (#4041 / #3987). A second name list missed Grok monitor.
     if (isShellTool(toolName)) {