@deftai/directive-runtime 0.129.5 → 0.129.7

package/dist/setup-wiring.js

@@ -9,6 +9,7 @@ import { fileURLToPath } from "node:url";
 import { containedChmod, containedRemove, containedWrite, } from "../vendor/directive-core/dist/fs/contained-write.js";
 import { DIRECT_WRITE_HOOK_MATCHER, KILL_HOOK_MATCHER, MCP_HOOK_MATCHER, SHELL_HOOK_MATCHER, SPAWN_HOOK_MATCHER, } from "../vendor/directive-core/dist/hooks/tools.js";
 import { GROK_PRETOOLUSE_WRAPPER_REL_PATH, HOST_HOOK_MISSING_PIN_PROJECT_PM_GUIDANCE, hostHookOuterCommand, hostHookOuterRelPath, hostHookOuterSha8, hostHookOuterSource, isGrokWrapperCommand, isHostHookOuterCommand, } from "../vendor/directive-core/dist/init-deposit/agent-hooks.js";
+import { DESIRED_GITATTRIBUTES_LINES, ensureGitattributes, LEGACY_CORE_TEXT_EOL_LF, } from "../vendor/directive-core/dist/init-deposit/scaffold.js";
 import { INSTALLATION_RECOVERY_GUIDANCE, RUNTIME_PACKAGE_PATH_PREFIX, } from "../vendor/directive-core/dist/install-health/constants.js";
 import { MANAGED_SECTION_CLOSE, MANAGED_SECTION_OPEN_PREFIX, } from "../vendor/directive-core/dist/install-health/index.js";
 import { applyAgentsRefresh } from "../vendor/directive-core/dist/platform/agents-md.js";
@@ -31,6 +32,25 @@ function readText(path) {
         return null;
     }
 }
+/** Normalize CRLF/CR to LF for ownership/wrapper equality (#5995). */
+export function normalizeEol(text) {
+    return text.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+/** True when two texts differ only by end-of-line convention (#5995). */
+export function contentsEqualIgnoringEol(a, b) {
+    return normalizeEol(a) === normalizeEol(b);
+}
+/**
+ * `.githooks` shell entrypoints must be LF on disk for `sh` (#5995 / PR #6151 P1).
+ * Ownership stays EOL-insensitive; these paths still rewrite CRLF-only drift.
+ */
+export function isShellHookEntrypoint(rel) {
+    const posix = rel.replace(/\\/g, "/");
+    if (!posix.startsWith(".githooks/"))
+        return false;
+    const base = posix.slice(posix.lastIndexOf("/") + 1);
+    return base.endsWith(".sh") || !base.includes(".");
+}
 function writeContained(projectRoot, relPath, body) {
     containedWrite({
         root: projectRoot,
@@ -47,6 +67,11 @@ function trackChange(projectRoot, rel, next) {
     const prior = readText(join(projectRoot, rel));
     if (prior === next)
         return { created: false, modified: false };
+    // CRLF-vs-LF-only diffs are still Directive-managed; skip rewrite for non-shell
+    // paths (#5995). Shell hooks still need LF bytes so `sh` can exec them (#6151 P1).
+    if (prior !== null && contentsEqualIgnoringEol(prior, next) && !isShellHookEntrypoint(rel)) {
+        return { created: false, modified: false };
+    }
     writeContained(projectRoot, rel, next);
     return { created: prior === null, modified: prior !== null };
 }
@@ -227,16 +252,126 @@ function ovprSlashWrapperContents(file) {
  * (legacy .deft/core teaching or package-relative OVPR form).
  */
 function isManagedSlashWrapper(raw, file, next) {
-    if (raw === next)
+    const rawN = normalizeEol(raw);
+    const nextN = normalizeEol(next);
+    if (rawN === nextN)
         return true;
-    if (isThinWrapperMarkdown(raw, file.dispatchPath))
+    if (isThinWrapperMarkdown(rawN, file.dispatchPath))
         return true;
     // Already-rewritten OVPR wrapper: still thin + points at this dispatch path.
-    return (raw.startsWith("---\n") &&
-        raw.includes(file.dispatchPath) &&
-        (raw.includes(RUNTIME_PREFIX) || raw.includes(".deft/core/")) &&
-        raw.includes("Read and follow") &&
-        raw.includes("Do not inline"));
+    return (rawN.startsWith("---\n") &&
+        rawN.includes(file.dispatchPath) &&
+        (rawN.includes(RUNTIME_PREFIX) || rawN.includes(".deft/core/")) &&
+        rawN.includes("Read and follow") &&
+        rawN.includes("Do not inline"));
+}
+/**
+ * True when `rel` has unstaged worktree edits vs the index (#6151 P1).
+ * No repo / no git / clean path → false (safe to report modified for staging).
+ */
+export function pathHasUnstagedChanges(projectRoot, rel) {
+    try {
+        const out = execFileSync("git", ["-C", projectRoot, "diff", "--name-only", "--", rel], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return out.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Left-unstaged disclosure when LF pins land on a dirty `.gitattributes` (#6151 P1). */
+export const GITATTRIBUTES_STAGING_SKIPPED_DIRTY = ".gitattributes had unstaged local edits; LF pins were written but left unstaged so install/upgrade does not git add unrelated user changes (#6151 P1)";
+const DESIRED_GITATTRIBUTES_LINE_SET = new Set([
+    ...DESIRED_GITATTRIBUTES_LINES,
+    LEGACY_CORE_TEXT_EOL_LF,
+]);
+/**
+ * True when every attribute line is a known Directive core/managed marker (or
+ * Deft deposit comment). Foreign rules mean the file is not pure Directive-owned
+ * (#6151 P1 dirty-skip heuristic).
+ */
+export function isDirectiveManagedGitattributes(content) {
+    for (const raw of normalizeEol(content).split("\n")) {
+        const line = raw.trim();
+        if (line.length === 0)
+            continue;
+        if (line.startsWith("#")) {
+            if (line.startsWith("# Deft framework:") ||
+                line.startsWith("# Deft managed wiring:") ||
+                line.startsWith("# consumer source.") ||
+                line.startsWith("# byte identity") ||
+                line.startsWith("# to LF so Windows")) {
+                continue;
+            }
+            return false;
+        }
+        if (!DESIRED_GITATTRIBUTES_LINE_SET.has(line))
+            return false;
+    }
+    return true;
+}
+/** True when `rel` exists in the worktree but is not tracked (git repo only). */
+function pathIsUntrackedInRepo(projectRoot, rel) {
+    try {
+        execFileSync("git", ["-C", projectRoot, "rev-parse", "--is-inside-work-tree"], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    catch {
+        return false;
+    }
+    try {
+        execFileSync("git", ["-C", projectRoot, "ls-files", "--error-unmatch", "--", rel], {
+            encoding: "utf8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return false;
+    }
+    catch {
+        return existsSync(join(projectRoot, rel));
+    }
+}
+/**
+ * Deposit narrow LF .gitattributes for managed wiring paths (#5995).
+ * Reuses scaffold ensureGitattributes (core markers + managed wiring lines).
+ * Reports created/modified so install/upgrade staging commits the pins (#6151 P1).
+ * When the path already has unstaged user edits (or an untracked foreign file),
+ * still appends missing pins but does not report modified (avoids staging WIP).
+ */
+export function ensureManagedPathGitattributes(projectRoot) {
+    const attrsRel = ".gitattributes";
+    const prior = readText(join(projectRoot, attrsRel));
+    // Compute dirty signal before write — post-write `git diff` is true for clean
+    // pin appends too, so it cannot alone decide staging (#6151 P1).
+    const hadUnstagedEdits = prior !== null && pathHasUnstagedChanges(projectRoot, attrsRel);
+    const untrackedForeign = prior !== null &&
+        !isDirectiveManagedGitattributes(prior) &&
+        pathIsUntrackedInRepo(projectRoot, attrsRel);
+    const wrote = ensureGitattributes(projectRoot, { printf: () => undefined });
+    if (!wrote)
+        return { created: false, modified: false, wrote: false };
+    if (prior === null)
+        return { created: true, modified: false, wrote: true };
+    const next = readText(join(projectRoot, attrsRel)) ?? "";
+    // After write: confirm unstaged still, or foreign prior that changed and was
+    // already dirty/untracked — never stage unfinished user WIP with the pins.
+    const stillUnstaged = pathHasUnstagedChanges(projectRoot, attrsRel);
+    const priorForeignChanged = !isDirectiveManagedGitattributes(prior) && !contentsEqualIgnoringEol(prior, next);
+    const treatAsDirty = hadUnstagedEdits ||
+        untrackedForeign ||
+        (stillUnstaged && priorForeignChanged && (hadUnstagedEdits || untrackedForeign));
+    if (treatAsDirty) {
+        return {
+            created: false,
+            modified: false,
+            wrote: true,
+            stagingSkippedNotice: GITATTRIBUTES_STAGING_SKIPPED_DIRTY,
+        };
+    }
+    return { created: false, modified: true, wrote: true };
 }
 /**
  * Deposit host slash/prompt thin wrappers with package-relative targets (AC8.1 / AC8.10).
@@ -244,9 +379,22 @@ function isManagedSlashWrapper(raw, file, next) {
  * Preserves consumer-custom command files and reports conflicts instead of clobbering.
  */
 export function ensureSlashCommands(projectRoot) {
+    // Pin managed wiring paths to LF before compare/deposit (#5995).
+    const attrs = ensureManagedPathGitattributes(projectRoot);
     const created = [];
     const modified = [];
     const conflicts = [];
+    const notices = [];
+    if (attrs.created) {
+        created.push(".gitattributes");
+    }
+    else if (attrs.stagingSkippedNotice) {
+        notices.push(attrs.stagingSkippedNotice);
+        // deliberately omit from modified — dirty user WIP must not be git-added
+    }
+    else if (attrs.modified && attrs.wrote) {
+        modified.push(".gitattributes");
+    }
     const policy = loadHostSlashCommandsPolicyFromProject(projectRoot);
     for (const hostId of listSlashEmitterHosts()) {
         if (!isHostSlashCommandDepositEnabled(hostId, policy))
@@ -255,7 +403,9 @@ export function ensureSlashCommands(projectRoot) {
             const body = ovprSlashWrapperContents(file);
             const next = body.endsWith("\n") ? body : `${body}\n`;
             const prior = readText(join(projectRoot, file.relativePath));
-            if (prior !== null && prior !== next && !isManagedSlashWrapper(prior, file, next)) {
+            if (prior !== null &&
+                !contentsEqualIgnoringEol(prior, next) &&
+                !isManagedSlashWrapper(prior, file, next)) {
                 conflicts.push(`${file.relativePath}: existing command is not a Directive-managed wrapper; refusing to overwrite`);
                 continue;
             }
@@ -266,7 +416,7 @@ export function ensureSlashCommands(projectRoot) {
                 modified.push(file.relativePath);
         }
     }
-    return { created, modified, conflicts };
+    return { created, modified, conflicts, notices };
 }
 /**
  * Verified managed slash/prompt paths from the emitter inventory (AC8.1 / AC11.10).
@@ -692,7 +842,7 @@ export function ensureHostHooks(projectRoot, hostHooksPolicy = loadHostHooksPoli
                 continue;
             const stripped = spec.strip(readJsonObject(abs));
             const next = `${JSON.stringify(stripped, null, 2)}\n`;
-            if (prior === next)
+            if (prior === next || contentsEqualIgnoringEol(prior, next))
                 continue;
             writeContained(projectRoot, spec.rel, next);
             modified.push(spec.rel);
@@ -701,7 +851,7 @@ export function ensureHostHooks(projectRoot, hostHooksPolicy = loadHostHooksPoli
         const base = prior === null ? {} : readJsonObject(abs);
         const merged = spec.merge(base);
         const next = `${JSON.stringify(merged, null, 2)}\n`;
-        if (prior === next)
+        if (prior === next || (prior !== null && contentsEqualIgnoringEol(prior, next)))
             continue;
         writeContained(projectRoot, spec.rel, next);
         if (prior === null)
@@ -717,7 +867,7 @@ export function ensureHostHooks(projectRoot, hostHooksPolicy = loadHostHooksPoli
         const enabled = isHostHookDepositEnabled(host, hostHooksPolicy);
         if (enabled) {
             const prior = readText(join(projectRoot, rel));
-            if (prior !== outerSource) {
+            if (prior === null || !contentsEqualIgnoringEol(prior, outerSource)) {
                 writeContained(projectRoot, rel, outerSource);
                 if (prior === null)
                     created.push(rel);
@@ -855,13 +1005,18 @@ export function ensureGitHooks(projectRoot, options = {}) {
         const rawNext = override ?? file.body;
         const next = rawNext.endsWith("\n") ? rawNext : `${rawNext}\n`;
         const prior = readText(join(projectRoot, file.rel));
-        if (prior !== null && prior !== next && !isOurGitHookBody(file.rel, prior)) {
+        if (prior !== null &&
+            !contentsEqualIgnoringEol(prior, next) &&
+            !isOurGitHookBody(file.rel, prior)) {
             conflicts.push(`${file.rel}: existing hook is not Directive-managed; refusing to overwrite (chain or remove manually)`);
             continue;
         }
         // Tracked divergent preserve (#5837): never overwrite a committed hook body,
         // even a Directive-managed one, unless the operator forced the replace.
-        if (prior !== null && prior !== next && !force && isGitTrackedPath(projectRoot, file.rel)) {
+        if (prior !== null &&
+            !contentsEqualIgnoringEol(prior, next) &&
+            !force &&
+            isGitTrackedPath(projectRoot, file.rel)) {
             preserved.push(formatTrackedHookPreserved(file.rel));
             continue;
         }

package/dist/vbrief-preflight.d.ts

@@ -1,4 +1,8 @@
 #!/usr/bin/env node
+/** One remediation line for a code-bearing brief with no issue origin (#5710 P2). */
+export declare const ISSUELESS_CODE_BEARING_REMEDIATION: string;
+/** The P2 remediation line when the brief is code-bearing with no issue origin, else null. */
+export declare function issuelessCodeBearingNote(briefPath: string): string | null;
 interface ParsedArgs {
     vbriefPath: string | null;
     emitJson: boolean;

package/dist/vbrief-preflight.js

@@ -1,9 +1,38 @@
 #!/usr/bin/env node
+import { readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { emitJson, evaluate, PREFLIGHT_USAGE_HINT } from "../vendor/directive-core/dist/preflight/index.js";
 import { scanWorkClaimForBriefPath } from "../vendor/directive-core/dist/scm/index.js";
+import { isCodeBearingScope, resolvePlanGithubIssueRef } from "../vendor/directive-core/dist/scope/index.js";
 import { refuseIfWslOwnershipBlocked } from "./wsl-ownership-guard.js";
+/** One remediation line for a code-bearing brief with no issue origin (#5710 P2). */
+export const ISSUELESS_CODE_BEARING_REMEDIATION = "[deft preflight] note: code-bearing brief has no x-xbrief/github-issue origin (#5710). " +
+    "PR-only complete: stamp plan.metadata.productPullRequest, then " +
+    "scope:complete -- --pr <that PR> --merge-commit <sha>. " +
+    "Issue-first: add an x-xbrief/github-issue reference before the product PR.";
+/** The P2 remediation line when the brief is code-bearing with no issue origin, else null. */
+export function issuelessCodeBearingNote(briefPath) {
+    let plan;
+    try {
+        const raw = JSON.parse(readFileSync(briefPath, "utf8"));
+        plan =
+            raw !== null && typeof raw === "object" && !Array.isArray(raw)
+                ? raw.plan
+                : null;
+    }
+    catch {
+        return null;
+    }
+    if (plan === null || typeof plan !== "object" || Array.isArray(plan)) {
+        return null;
+    }
+    const record = plan;
+    if (!isCodeBearingScope(record) || resolvePlanGithubIssueRef(record) !== null) {
+        return null;
+    }
+    return ISSUELESS_CODE_BEARING_REMEDIATION;
+}
 const HELP_TEXT = `usage: xbrief:preflight [--vbrief-path PATH | PATH] [--json] [--help]
 
 Implementation-intent gate (#810): exits 0 only when the xBRIEF is in
@@ -117,6 +146,11 @@ export function run(argv, scan = scanWorkClaimForBriefPath) {
             `[deft work-claim] warning: scan failed (${message}). Warn is success; this is not a GitHub lock.`,
         ];
     }
+    // #5710 P2: advisory only; the exit code is unchanged.
+    const issuelessNote = issuelessCodeBearingNote(vbriefPath);
+    if (issuelessNote !== null) {
+        scanLines = [issuelessNote, ...scanLines];
+    }
     if (args.emitJson) {
         const message = scanLines.length > 0 ? `${result.message}\n${scanLines.join("\n")}` : result.message;
         process.stdout.write(`${emitJson(vbriefPath, result.exitCode, message)}\n`);

package/dist/verify-scope-provenance.d.ts

@@ -8,9 +8,21 @@ interface ParsedArgs {
     /** Raw `--enforce` token present, even when a later `--warn` wins `enforce`. */
     enforcePresent: boolean;
     quiet: boolean;
+    /** PR number for the forge-approval admit (#6203); null when absent. */
+    prNumber: number | null;
+    /** OWNER/NAME for the forge-approval admit; empty means resolve. */
+    repo: string;
     error?: string;
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;
-export declare function run(argv: string[]): number;
+/**
+ * PR context for the forge-approval admit (#6203): flags win, then
+ * GITHUB_PR_NUMBER (digits only) / GITHUB_REPOSITORY. Null without a PR.
+ */
+export declare function resolveForgeContext(args: Pick<ParsedArgs, "prNumber" | "repo">, env: NodeJS.ProcessEnv): {
+    prNumber: number;
+    repo: string | null;
+} | null;
+export declare function run(argv: string[], env?: NodeJS.ProcessEnv): number;
 export {};
 //# sourceMappingURL=verify-scope-provenance.d.ts.map

package/dist/verify-scope-provenance.js

@@ -6,12 +6,21 @@
  * evaluated inside evaluateScopeProvenance. This CLI forwards --base-ref.
  * `--enforce` / `--warn` stay parsed for compatibility; `--enforce` is a
  * no-op after #4956 / #5002 and prints a stderr notice when present.
+ *
+ * `--pr N` / `--repo OWNER/NAME` (env fallback GITHUB_PR_NUMBER /
+ * GITHUB_REPOSITORY) supply PR context for the forge-approved head-brief
+ * membership admit (#6203). Without a PR number the admit is never consulted.
  */
 import { resolve } from "node:path";
 import { scopeProvenance } from "../vendor/directive-core/dist/index.js";
 import { isDirectEntrypoint } from "./entrypoint.js";
 /** Stderr line when argv includes `--enforce`. Exit code is unchanged. */
 export const ENFORCE_NOOP_NOTICE = "verify_scope_provenance: --enforce has no effect after #4956 / #5002";
+const PR_DIGITS = /^[1-9][0-9]*$/;
+function parsePr(value) {
+    const t = value.trim();
+    return PR_DIGITS.test(t) ? Number(t) : null;
+}
 export function parseArgs(argv) {
     const parsed = {
         projectRoot: ".",
@@ -20,6 +29,8 @@ export function parseArgs(argv) {
         enforce: false,
         enforcePresent: false,
         quiet: false,
+        prNumber: null,
+        repo: "",
     };
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
@@ -55,22 +66,54 @@ export function parseArgs(argv) {
         else if (arg?.startsWith("--base-ref=")) {
             parsed.baseRef = arg.slice("--base-ref=".length);
         }
+        else if (arg === "--pr" || arg?.startsWith("--pr=")) {
+            const value = arg === "--pr" ? argv[i + 1] : arg.slice("--pr=".length);
+            if (arg === "--pr")
+                i += 1;
+            const pr = value === undefined ? null : parsePr(value);
+            if (pr === null) {
+                return { ...parsed, error: "argument --pr: expected a positive PR number" };
+            }
+            parsed.prNumber = pr;
+        }
+        else if (arg === "--repo" || arg?.startsWith("--repo=")) {
+            const value = arg === "--repo" ? argv[i + 1] : arg.slice("--repo=".length);
+            if (arg === "--repo")
+                i += 1;
+            if (value === undefined || value.trim().length === 0) {
+                return { ...parsed, error: "argument --repo: expected OWNER/NAME" };
+            }
+            parsed.repo = value.trim();
+        }
         else {
             return { ...parsed, error: `unrecognized argument: ${arg}` };
         }
     }
     return parsed;
 }
-export function run(argv) {
+/**
+ * PR context for the forge-approval admit (#6203): flags win, then
+ * GITHUB_PR_NUMBER (digits only) / GITHUB_REPOSITORY. Null without a PR.
+ */
+export function resolveForgeContext(args, env) {
+    const prNumber = args.prNumber ?? parsePr(env.GITHUB_PR_NUMBER ?? "");
+    if (prNumber === null)
+        return null;
+    const repo = args.repo.length > 0 ? args.repo : (env.GITHUB_REPOSITORY ?? "").trim();
+    return { prNumber, repo: repo.length > 0 ? repo : null };
+}
+export function run(argv, env = process.env) {
     const args = parseArgs(argv);
     if (args.error !== undefined) {
         process.stderr.write(`verify_scope_provenance: ${args.error}\n`);
         return 2;
     }
     const projectRoot = resolve(args.projectRoot);
+    const forgeApproval = resolveForgeContext(args, env);
     const result = scopeProvenance.evaluateScopeProvenance(projectRoot, {
         ...(args.baseRef.length > 0 ? { baseRef: args.baseRef } : {}),
         enforce: args.enforce,
+        ...(forgeApproval !== null ? { forgeApproval } : {}),
     });
     if (args.enforcePresent) {
         process.stderr.write(`${ENFORCE_NOOP_NOTICE}\n`);

package/dist/verify-source-cli/verify-deposit-closure.js

@@ -10,7 +10,7 @@ export function parseArgs(argv) {
         if (arg === "--project-root" || arg === "--pack-root") {
             const value = argv[i + 1];
             if (value === undefined) {
-                return { ...parsed, error: "argument " + arg + ": expected one argument" };
+                return { ...parsed, error: `argument ${arg}: expected one argument` };
             }
             parsed.projectRoot = value;
             parsed.packRootExplicit = arg === "--pack-root";
@@ -24,7 +24,7 @@ export function parseArgs(argv) {
             parsed.packRootExplicit = true;
         }
         else {
-            return { ...parsed, error: "unrecognized argument: " + String(arg) };
+            return { ...parsed, error: `unrecognized argument: ${String(arg)}` };
         }
     }
     return parsed;
@@ -33,16 +33,16 @@ export function parseArgs(argv) {
 export function run(argv) {
     const args = parseArgs(argv);
     if (args.error !== undefined) {
-        process.stderr.write("verify_deposit_closure: " + args.error + "\n");
+        process.stderr.write(`verify_deposit_closure: ${args.error}\n`);
         return 2;
     }
     const root = resolve(args.projectRoot);
     const result = evaluateDepositClosureAtRoot(root, args.packRootExplicit);
     if (result.stream === "stdout") {
-        process.stdout.write(result.message + "\n");
+        process.stdout.write(`${result.message}\n`);
     }
     else {
-        process.stderr.write(result.message + "\n");
+        process.stderr.write(`${result.message}\n`);
     }
     return result.code;
 }

package/dist/windows-bin-ps1.d.ts

@@ -1,5 +1,5 @@
-/** Fallback when package.json cannot be read. Keep aligned with the bin map. */
-export declare const PACKAGE_BIN_NAMES: readonly ["directive", "deft", "deft-ts", "deft-hook", "deft-verify-encoding"];
+/** Fallback when package.json cannot be read. Keep aligned with launcher bin map (#5997). */
+export declare const PACKAGE_BIN_NAMES: readonly ["directive", "deft", "deft-hook"];
 /** Node owns these shims. This package must not delete them. */
 export declare const NODE_OWNED_SHIM_NAMES: readonly ["npx", "npm"];
 export interface Ps1ShimRemoval {

package/dist/windows-bin-ps1.js

@@ -1,24 +1,18 @@
 /**
  * npm's Windows bin linker (cmd-shim) always writes a .ps1 beside the .cmd.
  * PowerShell selects that .ps1 and stops when script execution is refused, so
- * the bare name never reaches the .cmd. This runs from postinstall, after
+ * the bare name never reaches the .cmd. Launcher postinstall runs this after
  * that link, and removes only this package's generated .ps1 files.
  * A .ps1 is removed only when its sibling .cmd records a target inside this
  * install, so an ambient PNPM_HOME from another install is left alone.
  * It does not change npx.ps1, npm.ps1, or the operator's execution policy.
- * Codex deposits bare deft-hook (#4659); this postinstall is what makes Restricted
- * Get-Command select deft-hook.cmd without ExecutionPolicy Bypass.
+ * Codex deposits bare deft-hook (#4659). Launcher postinstall (#5997) runs this
+ * cleanup so Restricted Get-Command selects deft-hook.cmd without Bypass.
  */
 import { existsSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
 import { basename, dirname, join, win32 } from "node:path";
-/** Fallback when package.json cannot be read. Keep aligned with the bin map. */
-export const PACKAGE_BIN_NAMES = [
-    "directive",
-    "deft",
-    "deft-ts",
-    "deft-hook",
-    "deft-verify-encoding",
-];
+/** Fallback when package.json cannot be read. Keep aligned with launcher bin map (#5997). */
+export const PACKAGE_BIN_NAMES = ["directive", "deft", "deft-hook"];
 /** Node owns these shims. This package must not delete them. */
 export const NODE_OWNED_SHIM_NAMES = ["npx", "npm"];
 export function packageIsUnderNodeModules(pkgDir) {

package/docs/deft-directive-disable.md

@@ -82,11 +82,11 @@ rm .deft-directive-disable
 # Start a NEW agent session
 ```
 
-## Agent self-serve ban under UAT (#3186)
+## Agent self-serve ban (always-on, grant-gated) (#3186 / #6136)
 
-Operators plant and remove this flag **outside** an agent session (or with a prior human-origin grant). Under **active UAT**, PreToolUse classifies Shell writes that create `.deft-directive-disable` (and permanent opt-out `.no-deft-directive`) as **settings** and **denies** them without a human grant — same posture as `authz:grant` (#3110). Agents must not self-serve the kill-switch to bypass Write / push / PR / merge gates.
+Operators plant and remove this flag **outside** an agent session (or with a prior human-origin grant covering **settings**). PreToolUse **always** denies agent Write / Edit / Shell that creates or renames-to `.deft-directive-disable` (and permanent opt-out `.no-deft-directive`) without that grant — not only under active UAT. Shell write reissue checks the protected basename **before** skipping out-of-tree dests, so a plant outside the repo tree cannot fail-open. Agents must not self-serve the kill-switch to bypass Write / push / PR / merge gates.
 
-Related: `policy:allow-bot-merge`, `policy:allow-direct-commits`, and `policy:disable-directive` (peers) are also settings under UAT and require a human grant.
+Related: `policy:allow-bot-merge`, `policy:allow-direct-commits`, and `policy:disable-directive` (peers) are settings under UAT and require a human grant.
 
 ## Non-goals (v1)
 

package/docs/getting-started.md

@@ -58,6 +58,8 @@ directive doctor
 
 After clone or a new worktree: run the project package manager (`npm install` / `pnpm install`), then the first eligible runtime command or registered hook completes local activation.
 
+**Dependabot / pin-only bumps (AC14.10):** a PR that changes only the `@deftai/directive-runtime` pin + lockfile is valid. After `pnpm install` / `npm install` brings `node_modules` to the new pin, the first eligible skill, hook, or ordinary runtime command runs local automatic setup (wiring / `GENERATION` / readiness). `directive doctor` stays read-only — dirty doctor output before that eligible invocation is expected. CI may either rely on that first eligible command or run explicit `directive install --repair --yes`. Do not treat "deposit bytes must land in the same pin PR" as product law. Human-test mirror: HT-17 in `docs/installer-refactor-ovpr/install-ovpr-human-test-plan.md`. Schema/data behind the new pin still needs `directive upgrade` (AC14.11), not repair alone.
+
 **Repair (pin unchanged):** `npm i -g @deftai/directive`, then `directive install --repair`.
 
 **Upgrade version or migrate data:** `directive upgrade` (alias: `update`).

package/docs/scope-provenance.md

@@ -45,10 +45,24 @@ Allowance = clamp(count of **concrete** production files on the merge-base `file
 When the bound story is in the change set:
 
 1. A human-stamped merge-base mint for the **continuity-resolved** story is the allowlist when present (planId match ignores stale `xbriefRelPath`; no-`plan.id` is path-first + basename-keyed mint with matching `xbriefRelPath`).
-2. Otherwise membership evaluates against the merge-base brief's **concrete** `file_scope` as agent precommitment. Head brief cannot widen.
+2. Otherwise membership evaluates against the merge-base brief's **concrete** `file_scope` as agent precommitment. Head brief cannot widen, except under a qualifying forge approval (#6203, below).
 3. Free paths: bound brief, verified peer briefs, `CHANGELOG.md`, and continuity lifecycle paths of the bound identity. An xBRIEF-only change set may omit a mint.
 4. Empty / invalid / unreadable mint records fail closed (they are not absence).
 
+#### Forge-approved head brief (#6203)
+
+A PR can carry a new or widened brief plus its code when a human approves it on GitHub. With PR context (`--pr N` / `--repo OWNER/NAME`, or `GITHUB_PR_NUMBER` / `GITHUB_REPOSITORY` in CI), a failing membership check under precommitment or missing authority consults the forge. When a qualifying approval exists, membership evaluates against the **head** brief's concrete `file_scope` instead of the merge-base brief.
+
+- **Mint wins.** A present mint keeps the mint path. The forge is never consulted.
+- **Auth-hash v1** (`sha256:` over canonical JSON; strings byte-exact, no Unicode normalization) covers `plan.id`, the xbrief path, the concrete `file_scope`, and the acceptanceCriteria array: `plan.acceptance`, `plan.narratives.AcceptanceCriteria`, and each item's `narrative.Acceptance`, in document order. `productPullRequest` and other delivery metadata stay out, so a PPR stamp keeps the approval. Any change to the covered fields drops it.
+- **Qualifying approval:** the reviewer's latest deciding review (APPROVED / CHANGES_REQUESTED / DISMISSED) is APPROVED; the reviewer is a `User` (not Bot or App), not the PR author, and has `write`, `maintain` or `admin` on the repo; the repo is the checkout's `origin` (a `--repo` value may only confirm it, so a fork's approval never counts) and is the PR's base repo; the evaluated HEAD is the PR head (or GitHub's merge commit whose second parent is the PR head); and the brief at the reviewed commit hashes the same as the head brief.
+- **Fallback:** missing PR context, no qualifying approval, a hash mismatch, or an unavailable forge keeps today's Path B or mint finding unchanged. The result message adds one `forge approval (#6203)` line with the reason.
+- **Membership only.** The production fence still reads the merge-base brief. A widened brief can pass membership and still fail `production-scope-over-budget`. A brand-new brief has no production fence (as today).
+- **Re-run after approval.** Approval does not re-trigger CI. Re-run the merge gate (or push) after the approval lands.
+- **Residual (#6207):** an agent that holds a second human forge token can satisfy every predicate above. The hash binds the approved bytes; it does not prove independent human intent and does not close that confused-deputy risk. That posture stays open on #6207.
+
+Code: `packages/core/src/scope-provenance/forge-approval.ts`.
+
 #### Path A planning split (#5551)
 
 When an active implementation brief is **outside** the change set, membership is a no-op for that identity (Path A). Supported planning publication is two change sets, not one:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-runtime",
-  "version": "0.129.5",
+  "version": "0.129.7",
   "description": "Directive runtime — pinned product commands, hooks, content, and engine.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -82,7 +82,6 @@
     "typescript": "^5.9.3"
   },
   "scripts": {
-    "build": "tsc -b",
-    "postinstall": "node ./scripts/remove-windows-ps1-shims.mjs"
+    "build": "tsc -b"
   }
 }

package/packs/lessons/lessons-pack-0.1.json

@@ -711,6 +711,21 @@
       ],
       "source": "Issue #4888 Prefer-A Bound 6050812821 (parent #964). conflict_group mergeable-state-semantic-policy-invisibility.",
       "body": "**Source:** Issue #4888 Prefer-A Bound 6050812821 (split from parent #964).\n\n**Failure mode:** GitHub `mergeable_state` / `mergeable` report only textual (axis-1) conflicts. After a PR opens, behavioral (CI/test) and policy (`task check` / required contexts) gates can land on the base without a textual conflict. Agents read dirty/clean as readiness or gap-size and miss the invisible policy miss until `task check` runs on the merge result.\n\n**Rule:** Use the three-axis model (textual / behavioral / policy). On conflict-resolve and behind-rebase (PR open; local HEAD matches live remote PR head), require machine-checkable candidate validation keyed to `(pr_head_sha, target_head_sha)` via `evaluateNonCascadeCandidateGreen` / `evaluateSemanticGreen({ requireCandidateValidation: true })`. Attestation is a named allowlisted probe exit 0 (typically pre-pr `task check` / `deft check`); prose stamps are not success. On pre-push, run that local merge-chokepoint gate before push; require the SHA-pair attestation only after push when local HEAD matches the live remote PR head. Do not weaken `--cascade` absolute stale-base refusal. Keep #4889 out; do not satisfy with a withdrawn Python semantic-drift script SoT. Forge supersession is #633/#1517 required Merge gate aggregator + up-to-date-required; local probe is interim.\n\n**Canonical encoding (strongest-applicable layer):** probe in `packages/core/src/pr-wait-mergeable/semantic-green.ts` (`requireCandidateValidation` / `validateCandidateAttestation`); operative MUST in `content/scm/github.md` § Cascade / Three-axis (#4888) and `skills/deft-directive-pre-pr/SKILL.md` merge-chokepoint attach; forge supersession in `content/scm/github.md` § Merge-gate aggregator (#633). AGENTS/agents-entry pointer only.\n\n**Cross-references:** #4888, #964, #2385, #1369, #633, #1517, #4883 (CLEAN = axis-1 necessity), #4889 (kept out)."
+    },
+    {
+      "id": "edit-files-search-strings-must-capture-full-units-not-substrings-2026-05",
+      "title": "edit_files search strings MUST capture full units, not substrings (2026-05)",
+      "date": "2026-05",
+      "issue_refs": [
+        "#1037"
+      ],
+      "tags": [
+        "debugging",
+        "agent-orchestration",
+        "github"
+      ],
+      "source": "Issue #1037 Prefer-A Bound 6689115138. Recurrence: PR #1034 (2026-05-11); #911 cascade (2026-05-04).",
+      "body": "**Source:** Issue #1037 Prefer-A Bound 6689115138. Recurrence: PR #1034 (2026-05-11) Greptile P1 on truncated CHANGELOG #441 close-out bullet; sibling outcome class in the #911 cascade (2026-05-04).\n\n**Failure mode:** Exact-string replace tools (`edit_files` / StrReplace-class) replace only the matched `search` bytes. When the agent anchors on a substring of a longer single-line or multi-line entry (CHANGELOG bullet, ROADMAP list item, section body), the unmatched overflow past the search anchor is deleted with the match. The tool did what it was asked; the agent chose too short a search.\n\n**Rule:** When using exact-string-match replacement to modify a single-line or multi-line entry, the `search` value MUST match the FULL line / FULL entry being targeted, including any trailing prose / continuation the agent intends to preserve.\n\n**Anti-pattern:** Pick the first N words of a long bullet as the search anchor; the replacement silently truncates the bullet at the end of the matched substring.\n\n**Mitigation:**\n- ! When targeting a markdown bullet, the `search` value MUST extend to the next blank line or the next top-level list marker, whichever comes first. Re-read the file and capture ALL bytes that belong to the targeted entry.\n- ! When adding a new bullet ABOVE an existing one, an even safer pattern is to anchor `search` on the section heading (e.g. `### Refinement`) and re-emit the heading in `replace` followed by the new bullet and the existing first bullet -- but you MUST still capture every byte of that existing first bullet.\n- ! After every exact-string replace that touches CHANGELOG.md, ROADMAP.md, or any other append-only narrative file, re-read the surrounding 20 lines of the edited region and verify nothing was truncated. This is part of the standard pre-commit file review.\n\n**Recurrence record:**\n- PR #1034 (2026-05-11) -- CHANGELOG.md `### Refinement` first bullet truncated when adding a new bullet above it; Greptile caught it as a P1 in review-cycle.\n- PR #911 cascade (2026-05-04) -- different mechanism (HEAD-only slice resolution), same outcome class: CHANGELOG `[Unreleased]` branch entries dropped on conflict resolution.\n\n**Canonical encoding:** lessons-pack-0.1 entry (this body); projected via `task packs:render` into `meta/lessons.md`. Lesson-tier only -- no new AGENTS.md always-pin; optional `verify:changelog-bullets` stays out of Bound (#1037 Prefer-A Reject).\n\n**Cross-references:** Issue #1037, Prefer-A Bound 6689115138, PR #1034, PR #911 cascade, `skills/deft-directive-build/SKILL.md` / `skills/deft-directive-refinement/SKILL.md` pre-commit file review."
     }
   ]
 }