@deftai/directive 0.105.0 → 0.107.0

package/dist/authz.js

@@ -225,7 +225,7 @@ function helpText() {
         "  (grant / uat-start / uat-suspend / revoke) — no TTY, --confirm, or phrase path.",
         "  Self-approval under UAT is impossible by construction. Mint grants BEFORE uat-start.",
         "Outside UAT, mutating verbs require multi-factor human presence (#3110):",
-        "  - Interactive TTY (stdin+stdout) + controlling terminal (/dev/tty|CONIN$)",
+        "  - Interactive TTY (stdin+stdout) + controlling terminal (/dev/tty|\\\\.\\CONIN$)",
         "  - Explicit --confirm (argv flag alone never enough)",
         "  - Typed phrase 'mint' on the controlling TTY (PTY+--confirm alone never enough)",
         "  - Known agent/CI env markers always refuse (fail-closed).",

package/dist/cli-router/route-argv.js

@@ -83,6 +83,7 @@ export const SUBCOMMAND_ROUTES = {
     "policy:allow-direct-commits": ["policy", "allow-direct-commits"],
     "policy:allow-bot-merge": ["policy", "allow-bot-merge"],
     "policy:enable-value-feedback": ["policy", "enable-value-feedback"],
+    "policy:disable-host-hooks": ["policy", "disable-host-hooks"],
     "policy:set-ceremony-dial": ["policy", "set-ceremony-dial"],
     "policy:clear-value-feedback": ["policy", "clear-value-feedback"],
     "authz:show": ["authz", "show"],
@@ -196,6 +197,9 @@ function routeNamespaceVerb(ns, verb, rest) {
             return { kind: "dispatch", argv: [verifyStem, ...rest] };
         }
     }
+    if (ns === "scm" && verb === "issue:design-critique-chip") {
+        return { kind: "dispatch", argv: ["scm", "issue", "design-critique-chip", ...rest] };
+    }
     if (ns === "issue" && verb === "ingest") {
         return { kind: "dispatch", argv: ["issue-ingest", ...rest] };
     }

package/dist/dispatch.d.ts

@@ -10,7 +10,7 @@ export interface DispatchIo {
     writeErr: (text: string) => void;
 }
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
-export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "scope-lifecycle", "scope-record-approved-scope", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-skill-external-fetch-gate", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-completed-tracked", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "eval-health", "eval-run", "eval-report", "eval-triggers"];
+export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "scope-lifecycle", "scope-record-approved-scope", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-skill-external-fetch-gate", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
 export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
@@ -177,6 +177,12 @@ export declare function printCommandsList(io?: DispatchIo): void;
  * (#2172). Preserves the init/update/doctor first-run guidance from #2273.
  */
 export declare function printHelp(io?: DispatchIo): void;
+/**
+ * Unknown-colon-verb remediation (#3439 / #2652).
+ * Agent-facing spelling is `deft <verb>` (works on consumer CLI and source).
+ * Bare `task <verb>` is not consumer-runnable on include-only Taskfiles.
+ */
+export declare function unknownColonVerbHint(verb: string): string;
 /** Dispatch argv to a registered verb; returns the handler exit code. */
 export declare function dispatch(argv: string[], io?: DispatchIo): Promise<number>;
 /** Test seam: reset lazy handler cache between cases. */

package/dist/dispatch.js

@@ -10,7 +10,7 @@ import { basename, dirname, isAbsolute, join, relative, resolve } from "node:pat
 import { engineInfo, userConfig } from "@deftai/directive-core";
 import { assertWriteTargetSafe } from "@deftai/directive-core/dist/fs/projection-containment.js";
 import { parseInitArgv, runInitDepositCli } from "@deftai/directive-core/init-deposit";
-import { appendAuditLog, disclosureLine, migrateLegacyPolicyKey, PLAN_POLICY_KEY, policyColonInvocation, policySetInvocation, projectDefinitionPath, resolvePolicy, resolveWipCap, setPolicy, } from "@deftai/directive-core/policy";
+import { appendAuditLog, disclosureLine, migrateLegacyPolicyKey, PLAN_POLICY_KEY, POLICY_AUDIT_NOOP_STDOUT, policyColonInvocation, policySetInvocation, projectDefinitionPath, resolvePolicy, resolveWipCap, setPolicy, stampChangedToken, } from "@deftai/directive-core/policy";
 import { defaultWhich } from "@deftai/directive-core/scm";
 import { KNOWN_SUBAGENT_BACKEND_IDS, probeSubagentBackends, resolveSwarmSubagentBackend, } from "@deftai/directive-core/swarm";
 import { atomicWriteProjectDefinition } from "@deftai/directive-core/vbrief-build";
@@ -75,6 +75,7 @@ export const CLI_MODULE_VERBS = [
     "session-start",
     "session-ready",
     "occupancy-steal",
+    "occupancy-release",
     "plan-sequence",
     "slice",
     "subagent-monitor",
@@ -83,6 +84,7 @@ export const CLI_MODULE_VERBS = [
     "triage-bootstrap",
     "triage-bulk",
     "triage-classify",
+    "triage-evaluate",
     "triage-help",
     "triage-queue",
     "triage-reconcile",
@@ -140,7 +142,9 @@ export const CLI_MODULE_VERBS = [
     "verify-tools",
     "verify-wip-cap",
     "verify-orphan-active",
+    "verify-lifecycle-visible",
     "verify-completed-tracked",
+    "verify-completed-write-guard",
     "verify-literal-ac",
     "verify-ac",
     "verify-agents-md-budget",
@@ -220,6 +224,7 @@ export const POLICY_ACTION_ALIAS_SUBCOMMANDS = {
     "policy:allow-direct-commits": "allow-direct-commits",
     "policy:allow-bot-merge": "allow-bot-merge",
     "policy:enable-value-feedback": "enable-value-feedback",
+    "policy:disable-host-hooks": "disable-host-hooks",
     "policy:set-ceremony-dial": "set-ceremony-dial",
     "policy:clear-value-feedback": "clear-value-feedback",
     "policy:disable-directive": "disable-directive",
@@ -282,7 +287,9 @@ export const VERB_ALIASES = {
     "verify:vbrief-conformance": "vbrief-validate",
     "verify:wip-cap": "verify-wip-cap",
     "verify:orphan-active": "verify-orphan-active",
+    "verify:lifecycle-visible": "verify-lifecycle-visible",
     "verify:completed-tracked": "verify-completed-tracked",
+    "verify:completed-write-guard": "verify-completed-write-guard",
     "verify:literal-ac": "verify-literal-ac",
     "verify:literal-acceptance": "verify-literal-ac",
     "verify:ac": "verify-ac",
@@ -343,6 +350,7 @@ export const VERB_ALIASES = {
     "triage:bootstrap": "triage-bootstrap",
     "triage:summary": "triage-summary",
     "triage:queue": "triage-queue",
+    "triage:evaluate": "triage-evaluate",
     "triage:scope": "triage-scope",
     ...TRIAGE_ACTION_COLON_ALIASES,
     ...POLICY_ACTION_COLON_ALIASES,
@@ -360,6 +368,8 @@ export const VERB_ALIASES = {
     "session:start": "session-start",
     "session:ready": "session-ready",
     "occupancy:steal": "occupancy-steal",
+    "occupancy:release": "occupancy-release",
+    "session:end": "occupancy-release",
     ...FRESHNESS_COLON_ALIASES,
     "lifecycle:event": "lifecycle-event",
     "lifecycle:stats": "lifecycle-stats",
@@ -2122,7 +2132,7 @@ function loadProjectDefinitionForWrite(projectRoot) {
         throw new PolicySetError("PROJECT-DEFINITION 'plan' is not an object", "config");
     }
     const planObj = plan;
-    migrateLegacyPolicyKey(planObj);
+    const legacyMigrated = migrateLegacyPolicyKey(planObj);
     let policy = planObj[PLAN_POLICY_KEY];
     if (policy === undefined) {
         policy = {};
@@ -2131,31 +2141,31 @@ function loadProjectDefinitionForWrite(projectRoot) {
     if (typeof policy !== "object" || policy === null || Array.isArray(policy)) {
         throw new PolicySetError("plan.policy is not an object", "config");
     }
-    return { path, data, policyBlock: policy };
+    return { path, data, policyBlock: policy, legacyMigrated };
 }
 /** Write plan.policy.wipCap in place + append the audit row (mirrors set_wip_cap). */
 function writeWipCap(projectRoot, cap, actor, note) {
-    const { path, data, policyBlock } = loadProjectDefinitionForWrite(projectRoot);
+    const { path, data, policyBlock, legacyMigrated } = loadProjectDefinitionForWrite(projectRoot);
     const previous = policyBlock.wipCap;
     policyBlock.wipCap = cap;
-    assertWriteTargetSafe(projectRoot, path);
-    atomicWriteProjectDefinition(path, data);
-    const changed = previous !== cap;
+    const changed = previous !== cap || legacyMigrated;
     const parts = [`actor=${actor}`, `wipCap=${cap}`, `previous=${pyRepr(previous)}`];
     if (note)
         parts.push(`note=${sanitizeNote(note)}`);
-    const auditEntry = parts.join(" ");
-    appendAuditLog(projectRoot, auditEntry);
+    const auditEntry = stampChangedToken(parts.join(" "), changed);
+    if (changed) {
+        assertWriteTargetSafe(projectRoot, path);
+        atomicWriteProjectDefinition(path, data);
+    }
+    appendAuditLog(projectRoot, auditEntry, changed);
     return { changed, auditEntry };
 }
 /** Write plan.policy.swarmSubagentBackend in place + append the audit row. */
 function writeSubagentBackend(projectRoot, backendId, actor, note) {
-    const { path, data, policyBlock } = loadProjectDefinitionForWrite(projectRoot);
+    const { path, data, policyBlock, legacyMigrated } = loadProjectDefinitionForWrite(projectRoot);
     const previous = policyBlock.swarmSubagentBackend;
     policyBlock.swarmSubagentBackend = backendId;
-    assertWriteTargetSafe(projectRoot, path);
-    atomicWriteProjectDefinition(path, data);
-    const changed = previous !== backendId;
+    const changed = previous !== backendId || legacyMigrated;
     const parts = [
         `actor=${actor}`,
         `swarmSubagentBackend=${backendId}`,
@@ -2163,8 +2173,12 @@ function writeSubagentBackend(projectRoot, backendId, actor, note) {
     ];
     if (note)
         parts.push(`note=${sanitizeNote(note)}`);
-    const auditEntry = parts.join(" ");
-    appendAuditLog(projectRoot, auditEntry);
+    const auditEntry = stampChangedToken(parts.join(" "), changed);
+    if (changed) {
+        assertWriteTargetSafe(projectRoot, path);
+        atomicWriteProjectDefinition(path, data);
+    }
+    appendAuditLog(projectRoot, auditEntry, changed);
     return { changed, auditEntry };
 }
 /** Serialise the probe output for `subagent-backends --format json`. */
@@ -2229,7 +2243,7 @@ function applyBranchPolicy(args, io) {
         io.writeOut(`  audit: meta/policy-changes.log :: ${result.auditEntry}\n`);
     }
     else {
-        io.writeOut("  no-op: value already matched (audit entry still appended for trail).\n");
+        io.writeOut(`${POLICY_AUDIT_NOOP_STDOUT}\n`);
     }
     io.writeOut(`${disclosureLine(resolvePolicy(args.projectRoot))}\n`);
     return 0;
@@ -2258,7 +2272,7 @@ function applyWipCap(args, io) {
         io.writeOut(`  audit: meta/policy-changes.log :: ${res.auditEntry}\n`);
     }
     else {
-        io.writeOut("  no-op: value already matched (audit entry still appended for trail).\n");
+        io.writeOut(`${POLICY_AUDIT_NOOP_STDOUT}\n`);
     }
     const result = resolveWipCap(args.projectRoot);
     io.writeOut(`[deft policy] plan.policy.wipCap=${result.cap} (source: ${result.source}).\n`);
@@ -2278,7 +2292,7 @@ function applySubagentBackend(args, io) {
         io.writeOut(`  audit: meta/policy-changes.log :: ${res.auditEntry}\n`);
     }
     else {
-        io.writeOut("  no-op: value already matched (audit entry still appended for trail).\n");
+        io.writeOut(`${POLICY_AUDIT_NOOP_STDOUT}\n`);
     }
     const result = resolveSwarmSubagentBackend(args.projectRoot);
     io.writeOut(`[deft policy] plan.policy.swarmSubagentBackend=${pyRepr(result.backend_id)} ` +
@@ -2612,6 +2626,14 @@ const CURATED_HELP_GROUPS = [
                 name: "occupancy:steal",
                 summary: "Supersede a live worktree occupancy lease (--confirm --occupant)",
             },
+            {
+                name: "occupancy:release",
+                summary: "Release this worktree occupancy lease (owner live, or expired residue)",
+            },
+            {
+                name: "session:end",
+                summary: "End this mutation session by releasing occupancy (same as occupancy:release)",
+            },
             {
                 name: "freshness:report",
                 summary: "Bound vs live deposit generation (current|stale_soft|stale_hard)",
@@ -2720,6 +2742,23 @@ async function invokeHandler(handler, argv) {
     return typeof code === "number" ? code : 0;
 }
 const CLI_PACKAGE = "@deftai/directive";
+const PLAN_SEQUENCE_VERBS = "set|current|clear|advance";
+/**
+ * Unknown-colon-verb remediation (#3439 / #2652).
+ * Agent-facing spelling is `deft <verb>` (works on consumer CLI and source).
+ * Bare `task <verb>` is not consumer-runnable on include-only Taskfiles.
+ */
+export function unknownColonVerbHint(verb) {
+    if (verb.startsWith("plan-sequence:") && !(verb in PLAN_SEQUENCE_ALIAS_SUBCOMMANDS)) {
+        return (`hint: plan-sequence verbs are ${PLAN_SEQUENCE_VERBS} ` +
+            `(e.g. \`deft plan-sequence:current\`). '${verb}' is not a verb. ` +
+            `Do not run bare \`task ${verb}\` -- consumer include-only Taskfiles cannot resolve it.\n`);
+    }
+    const hyphen = verb.replaceAll(":", "-");
+    return (`hint: try \`deft ${verb}\` (CLI) or \`task deft:${verb}\` (consumer Taskfile). ` +
+        `Bare \`task ${verb}\` does not exist on include-only deposits. ` +
+        `Hyphen stem: ${hyphen}.\n`);
+}
 function versionBanner() {
     const info = engineInfo();
     return `${CLI_PACKAGE} (engine: ${info.name}@${info.version})\n`;
@@ -2743,8 +2782,7 @@ export async function dispatch(argv, io = defaultIo()) {
     if (canonical === null) {
         io.writeErr(`directive: unknown verb '${verb}'\n`);
         if (verb?.includes(":")) {
-            io.writeErr(`hint: prefer \`task ${verb}\` (Taskfile) or the hyphen stem ` +
-                `(e.g. pr:watch → pr-watch / \`task pr:watch\`)\n`);
+            io.writeErr(unknownColonVerbHint(verb));
         }
         return 1;
     }

package/dist/human-presence-mint.d.ts

@@ -16,7 +16,7 @@ export interface HumanPresenceMintSeams {
     /** Environ for agent-shell marker detection (default: process.env). */
     readonly environ?: NodeJS.ProcessEnv;
     /**
-     * True when a controlling terminal device is available (`/dev/tty` or `CONIN$`).
+     * True when a controlling terminal device is available (`/dev/tty` or `\\.\CONIN$`).
      * Default: open/close the platform controlling terminal (fail-closed on error).
      */
     readonly hasControllingTerminal?: () => boolean;
@@ -27,6 +27,15 @@ export interface HumanPresenceMintSeams {
     readonly readInteractiveConfirm?: () => string | null;
 }
 export declare function looksLikeAgentShell(environ: NodeJS.ProcessEnv): boolean;
+/** Platform controlling-terminal path (`\\.\CONIN$` on win32, `/dev/tty` elsewhere). */
+export declare function controllingTerminalPath(platform?: NodeJS.Platform): string;
+/**
+ * Open flag for the platform controlling-terminal device (#3596 leftover).
+ *
+ * Win32 stays `r+` so the probe and phrase-read share one flag. The leftover
+ * path is the Windows device-namespace CONIN$ string, not bare CONIN$.
+ */
+export declare function controllingTerminalOpenFlag(platform?: NodeJS.Platform): "r" | "r+";
 export declare function resolveHumanPresenceMintSeams(seams?: HumanPresenceMintSeams): Required<HumanPresenceMintSeams>;
 /** Active UAT campaign id, or null when no lease is active. */
 export declare function activeUatCampaignId(projectRoot: string): string | null;
@@ -43,7 +52,7 @@ export declare function refuseMintWhileUatActive(verb: string, projectRoot: stri
  * Multi-factor human-presence gate (applies only when UAT lease is inactive):
  * 1. No known agent/CI env markers
  * 2. Interactive TTY (stdin + stdout isTTY)
- * 3. Controlling terminal device present (`/dev/tty` / `CONIN$`)
+ * 3. Controlling terminal device present (`/dev/tty` / `\\.\CONIN$`)
  * 4. Explicit argv `--confirm` (flag alone never enough)
  * 5. Interactive typed phrase `mint` (argv --confirm alone never enough even on PTY)
  *

package/dist/human-presence-mint.js

@@ -67,10 +67,23 @@ export function looksLikeAgentShell(environ) {
 function defaultIsTty() {
     return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
+/** Platform controlling-terminal path (`\\.\CONIN$` on win32, `/dev/tty` elsewhere). */
+export function controllingTerminalPath(platform = process.platform) {
+    // Real-console diagnostic on #3596: bare CONIN$ and CON ENOENT; device-namespace path opens.
+    return platform === "win32" ? "\\\\.\\CONIN$" : "/dev/tty";
+}
+/**
+ * Open flag for the platform controlling-terminal device (#3596 leftover).
+ *
+ * Win32 stays `r+` so the probe and phrase-read share one flag. The leftover
+ * path is the Windows device-namespace CONIN$ string, not bare CONIN$.
+ */
+export function controllingTerminalOpenFlag(platform = process.platform) {
+    return platform === "win32" ? "r+" : "r";
+}
 function defaultHasControllingTerminal() {
     try {
-        const path = process.platform === "win32" ? "CONIN$" : "/dev/tty";
-        const fd = openSync(path, "r");
+        const fd = openSync(controllingTerminalPath(), controllingTerminalOpenFlag());
         closeSync(fd);
         return true;
     }
@@ -83,8 +96,7 @@ function defaultReadInteractiveConfirm() {
     // so agent-controlled stdin alone cannot supply the confirm phrase (#3110).
     let fd = null;
     try {
-        const path = process.platform === "win32" ? "CONIN$" : "/dev/tty";
-        fd = openSync(path, "r");
+        fd = openSync(controllingTerminalPath(), controllingTerminalOpenFlag());
         const buf = Buffer.alloc(256);
         const n = readSync(fd, buf, 0, buf.length, null);
         if (n <= 0)
@@ -142,7 +154,7 @@ export function refuseMintWhileUatActive(verb, projectRoot) {
  * Multi-factor human-presence gate (applies only when UAT lease is inactive):
  * 1. No known agent/CI env markers
  * 2. Interactive TTY (stdin + stdout isTTY)
- * 3. Controlling terminal device present (`/dev/tty` / `CONIN$`)
+ * 3. Controlling terminal device present (`/dev/tty` / `\\.\CONIN$`)
  * 4. Explicit argv `--confirm` (flag alone never enough)
  * 5. Interactive typed phrase `mint` (argv --confirm alone never enough even on PTY)
  *

package/dist/occupancy-release.d.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+export declare function parseArgs(argv: readonly string[]): {
+    projectRoot: string;
+    error?: string;
+};
+export declare function run(argv: readonly string[]): number;
+//# sourceMappingURL=occupancy-release.d.ts.map

package/dist/occupancy-release.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+import { resolve } from "node:path";
+import { releaseOccupancy } from "@deftai/directive-core/session";
+export function parseArgs(argv) {
+    const parsed = { projectRoot: "." };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write(`occupancy:release: ${args.error}\n`);
+        return 2;
+    }
+    const result = releaseOccupancy(resolve(args.projectRoot), {
+        env: process.env,
+    });
+    const sink = result.code === 0 ? process.stdout : process.stderr;
+    sink.write(`${result.message}\n`);
+    return result.code;
+}
+//# sourceMappingURL=occupancy-release.js.map

package/dist/plan-sequence.d.ts

@@ -1,3 +1,13 @@
 #!/usr/bin/env node
+interface Parsed {
+    projectRoot: string;
+    action: "set" | "current" | "clear" | "advance" | null;
+    file: string | null;
+    jsonInline: string | null;
+    emitJson: boolean;
+    error?: string;
+}
+export declare function parseArgs(argv: string[]): Parsed;
 export declare function main(argv?: string[]): number;
+export {};
 //# sourceMappingURL=plan-sequence.d.ts.map

package/dist/plan-sequence.js

@@ -6,7 +6,7 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { advancePlanSequence, clearPlanSequence, createPlanSequence, parsePlanSequence, readPlanSequence, writePlanSequence, } from "@deftai/directive-core/plan-sequence";
-function parseArgs(argv) {
+export function parseArgs(argv) {
     const parsed = {
         projectRoot: ".",
         action: null,
@@ -19,6 +19,8 @@ function parseArgs(argv) {
         const arg = argv[i];
         if (arg === undefined)
             continue;
+        if (arg === "--")
+            continue;
         if (arg === "--json") {
             parsed.emitJson = true;
         }

package/dist/policy.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { type CeremonyDepth } from "@deftai/directive-core/policy";
+import { type CeremonyDepth, type HookHost } from "@deftai/directive-core/policy";
 interface ShowArgs {
     format: "text" | "json";
     changedOnly: boolean;
@@ -8,10 +8,11 @@ interface ShowArgs {
     error?: string;
 }
 interface SetArgs {
-    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "disable-directive" | "enable-directive" | "resolve";
+    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
     confirm: boolean;
     actor: string;
     note: string;
+    host?: HookHost;
     projectRoot: string;
     format: "text" | "json";
     changedOnly: boolean;

package/dist/policy.js

@@ -6,7 +6,7 @@
 import { existsSync } from "node:fs";
 import { resolve as pathResolve, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ALLOW_BOT_MERGE_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, policyColonInvocation, projectDefinitionPath, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "@deftai/directive-core/policy";
+import { ALLOW_BOT_MERGE_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "@deftai/directive-core/policy";
 const CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- enabling direct commits to the default " +
     "branch turns OFF the deft branch-protection policy.\n" +
     "  \u2022 Pre-commit + pre-push hooks will no longer block default-branch " +
@@ -114,7 +114,7 @@ export function parseShowArgs(argv) {
 /** Parse argv for the policy CLI (show + set subcommands). */
 export function parseArgs(argv) {
     if (argv.length === 0) {
-        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|disable-directive|enable-directive|resolve] ...";
+        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
         return makeSetError(usage);
     }
     const cmd = argv[0];
@@ -152,6 +152,7 @@ export function parseArgs(argv) {
         cmd === "enable-value-feedback" ||
         cmd === "clear-value-feedback" ||
         cmd === "set-ceremony-dial" ||
+        cmd === "disable-host-hooks" ||
         cmd === "disable-directive" ||
         cmd === "enable-directive") {
         let confirm = false;
@@ -167,11 +168,14 @@ export function parseArgs(argv) {
                             ? policyColonInvocation("clear-value-feedback")
                             : cmd === "set-ceremony-dial"
                                 ? policyColonInvocation("set-ceremony-dial")
-                                : cmd === "disable-directive"
-                                    ? policyColonInvocation("disable-directive")
-                                    : policyColonInvocation("enable-directive");
+                                : cmd === "disable-host-hooks"
+                                    ? policyColonInvocation("disable-host-hooks")
+                                    : cmd === "disable-directive"
+                                        ? policyColonInvocation("disable-directive")
+                                        : policyColonInvocation("enable-directive");
         let note = "";
         let projectRoot = ".";
+        let host;
         let ceremonyOverride;
         let ceremonyEnabled;
         for (let i = 1; i < argv.length; i += 1) {
@@ -253,10 +257,32 @@ export function parseArgs(argv) {
                 }
                 ceremonyEnabled = v === "true";
             }
+            else if (cmd === "disable-host-hooks" && arg === "--host") {
+                const v = argv[i + 1];
+                const parsedHost = parseHookHost(v);
+                if (parsedHost === null) {
+                    return makeSetError("argument --host: expected claude|cursor|grok|codex");
+                }
+                host = parsedHost;
+                i += 1;
+            }
+            else if (cmd === "disable-host-hooks" && arg?.startsWith("--host=")) {
+                const parsedHost = parseHookHost(arg.slice("--host=".length));
+                if (parsedHost === null) {
+                    return makeSetError("argument --host: expected claude|cursor|grok|codex");
+                }
+                host = parsedHost;
+            }
+            else if (arg === "--") {
+                continue;
+            }
             else {
                 return makeSetError(`unrecognized argument: ${arg}`);
             }
         }
+        if (cmd === "disable-host-hooks" && host === undefined) {
+            return makeSetError("disable-host-hooks requires --host claude|cursor|grok|codex");
+        }
         return {
             cmd,
             confirm,
@@ -266,6 +292,7 @@ export function parseArgs(argv) {
             format: "text",
             changedOnly: false,
             field: null,
+            host,
             ceremonyOverride,
             ceremonyEnabled,
         };
@@ -352,6 +379,21 @@ function runEnableValueFeedback(args) {
     process.stdout.write(result.stdout);
     return result.exitCode;
 }
+function runDisableHostHooks(args) {
+    const host = args.host;
+    if (host === undefined) {
+        process.stderr.write("policy: disable-host-hooks requires --host claude|cursor|grok|codex\n");
+        return 2;
+    }
+    const result = disableHostHooks(pathResolve(args.projectRoot), {
+        host,
+        confirm: args.confirm,
+        actor: args.actor,
+        note: args.note,
+    });
+    process.stdout.write(result.stdout);
+    return result.exitCode;
+}
 function runSet(args) {
     const projectRoot = pathResolve(args.projectRoot);
     if (args.cmd === "allow-direct-commits" && !args.confirm) {
@@ -373,7 +415,7 @@ function runSet(args) {
             process.stdout.write(`  audit: meta/policy-changes.log :: ${auditEntry}\n`);
         }
         else {
-            process.stdout.write("  no-op: value already matched (audit entry still appended for trail).\n");
+            process.stdout.write(`${POLICY_AUDIT_NOOP_STDOUT}\n`);
         }
         process.stdout.write(`${disclosureLine(resolvePolicy(projectRoot))}\n`);
         return 0;
@@ -454,7 +496,7 @@ function runAllowBotMerge(args) {
             process.stdout.write(`  audit: meta/policy-changes.log :: ${auditEntry}\n`);
         }
         else {
-            process.stdout.write("  no-op: value already matched (audit entry still appended for trail).\n");
+            process.stdout.write(`${POLICY_AUDIT_NOOP_STDOUT}\n`);
         }
         const line = humanMergeDisclosureLine(resolveHumanMergePolicy(projectRoot));
         if (line !== null) {
@@ -504,6 +546,9 @@ export function run(argv) {
     if (args.cmd === "enable-value-feedback") {
         return runEnableValueFeedback(args);
     }
+    if (args.cmd === "disable-host-hooks") {
+        return runDisableHostHooks(args);
+    }
     if (args.cmd === "clear-value-feedback") {
         return runClearValueFeedback(args);
     }

package/dist/preflight-cache.d.ts

@@ -7,6 +7,8 @@ interface ParsedArgs {
     forIssue?: number;
     allowStale?: boolean;
     allowMissingBootstrap?: boolean;
+    skipDriftProbe?: boolean;
+    workSelection?: boolean;
     quiet?: boolean;
     error?: string;
 }

package/dist/preflight-cache.js

@@ -58,6 +58,12 @@ export function parseArgs(argv) {
         else if (arg === "--allow-missing-bootstrap") {
             parsed.allowMissingBootstrap = true;
         }
+        else if (arg === "--skip-drift-probe") {
+            parsed.skipDriftProbe = true;
+        }
+        else if (arg === "--work-selection") {
+            parsed.workSelection = true;
+        }
         else if (arg === "--quiet") {
             parsed.quiet = true;
         }
@@ -81,6 +87,7 @@ export function run(argv) {
         forIssue: args.forIssue ?? null,
         allowStale: args.allowStale ?? false,
         allowMissingBootstrap: args.allowMissingBootstrap ?? false,
+        skipDriftProbe: (args.skipDriftProbe ?? false) && !args.workSelection,
     });
     const quiet = args.quiet ?? false;
     if (result.code === 0) {

package/dist/triage-actions.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { accept, createDefaultDeps, deferAction, formatDecision, history, markDuplicate, needsAc, reject, reset, status, TriageError, UpstreamCloseError, } from "@deftai/directive-core/dist/triage/actions/index.js";
+import { accept, createDefaultDeps, deferAction, formatAcceptOutput, formatDecision, history, markDuplicate, needsAc, reject, reset, status, TriageError, UpstreamCloseError, } from "@deftai/directive-core/dist/triage/actions/index.js";
 const VALID_CMDS = new Set([
     "accept",
     "reject",
@@ -21,6 +21,8 @@ export function parseArgs(argv) {
     parsed.cmd = argv[0];
     for (let i = 1; i < argv.length; i += 1) {
         const arg = argv[i];
+        if (arg === "--")
+            continue;
         if (arg === "--issue") {
             const value = argv[i + 1];
             if (value === undefined)
@@ -156,8 +158,7 @@ export function run(argv) {
                 autoPromote: args.autoPromote === true,
                 force: args.force === true,
             });
-            const promoteNote = args.autoPromote === true ? " + auto-promote" : "";
-            process.stdout.write(`accept #${n} (${repo}) -> ${decisionId}${promoteNote}\n`);
+            process.stdout.write(`${formatAcceptOutput(n, repo, decisionId, { autoPromote: args.autoPromote === true })}\n`);
         }
         else if (args.cmd === "reject") {
             const decisionId = reject(n, repo, args.reason ?? "", deps, {

package/dist/triage-evaluate.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+interface Parsed {
+    projectRoot: string;
+    repo: string | null;
+    issues: number[];
+    concurrency: number;
+    json: boolean;
+    error?: string;
+}
+export declare function parseArgs(argv: string[]): Parsed;
+export declare function run(argv: string[]): Promise<number>;
+export declare function main(argv: string[]): Promise<number>;
+export {};
+//# sourceMappingURL=triage-evaluate.d.ts.map

package/dist/triage-evaluate.js

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { DEFAULT_CONCURRENCY, EvaluateError, evaluateIssues, renderEvaluateText, } from "@deftai/directive-core/dist/triage/evaluate/index.js";
+import { interceptHelp } from "@deftai/directive-core/dist/triage/help/index.js";
+import { resolveRepo } from "@deftai/directive-core/dist/triage/queue/repo.js";
+export function parseArgs(argv) {
+    const parsed = {
+        projectRoot: process.env.DEFT_PROJECT_ROOT ?? process.cwd(),
+        repo: process.env.DEFT_TRIAGE_REPO ?? null,
+        issues: [],
+        concurrency: DEFAULT_CONCURRENCY,
+        json: false,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === undefined || arg === "--") {
+            continue;
+        }
+        if (arg === "--project-root") {
+            if (i + 1 >= argv.length) {
+                return { ...parsed, error: "--project-root requires a path" };
+            }
+            i += 1;
+            const value = argv[i];
+            if (value === undefined) {
+                return { ...parsed, error: "--project-root requires a path" };
+            }
+            parsed.projectRoot = value;
+        }
+        else if (arg.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--repo") {
+            if (i + 1 >= argv.length) {
+                return { ...parsed, error: "--repo requires owner/name" };
+            }
+            i += 1;
+            const value = argv[i];
+            if (value === undefined) {
+                return { ...parsed, error: "--repo requires owner/name" };
+            }
+            parsed.repo = value;
+        }
+        else if (arg.startsWith("--repo=")) {
+            parsed.repo = arg.slice("--repo=".length);
+        }
+        else if (arg === "--issue") {
+            if (i + 1 >= argv.length) {
+                return { ...parsed, error: "--issue requires a number" };
+            }
+            i += 1;
+            const value = argv[i];
+            if (value === undefined) {
+                return { ...parsed, error: "--issue requires a number" };
+            }
+            const n = Number.parseInt(value, 10);
+            if (!Number.isInteger(n) || n < 1) {
+                return { ...parsed, error: `--issue invalid: ${value}` };
+            }
+            parsed.issues.push(n);
+        }
+        else if (arg.startsWith("--issue=")) {
+            const n = Number.parseInt(arg.slice("--issue=".length), 10);
+            if (!Number.isInteger(n) || n < 1) {
+                return { ...parsed, error: `--issue invalid: ${arg}` };
+            }
+            parsed.issues.push(n);
+        }
+        else if (arg === "--concurrency") {
+            if (i + 1 >= argv.length) {
+                return { ...parsed, error: "--concurrency requires a positive integer" };
+            }
+            i += 1;
+            const value = argv[i];
+            if (value === undefined) {
+                return { ...parsed, error: "--concurrency requires a positive integer" };
+            }
+            const n = Number.parseInt(value, 10);
+            if (!Number.isInteger(n) || n < 1) {
+                return { ...parsed, error: `--concurrency invalid: ${value}` };
+            }
+            parsed.concurrency = n;
+        }
+        else if (arg.startsWith("--concurrency=")) {
+            const n = Number.parseInt(arg.slice("--concurrency=".length), 10);
+            if (!Number.isInteger(n) || n < 1) {
+                return { ...parsed, error: `--concurrency invalid: ${arg}` };
+            }
+            parsed.concurrency = n;
+        }
+        else if (arg === "--json") {
+            parsed.json = true;
+        }
+        else if (arg.startsWith("-")) {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+        else {
+            const n = Number.parseInt(arg.replace(/^#/u, ""), 10);
+            if (!Number.isInteger(n) || n < 1) {
+                return { ...parsed, error: `invalid issue number: ${arg}` };
+            }
+            parsed.issues.push(n);
+        }
+    }
+    return parsed;
+}
+export async function run(argv) {
+    const help = interceptHelp("triage_evaluate", argv);
+    if (help !== null) {
+        return help;
+    }
+    const parsed = parseArgs(argv);
+    if (parsed.error !== undefined) {
+        process.stderr.write(`triage:evaluate: ${parsed.error}\n`);
+        return 2;
+    }
+    const projectRoot = resolve(parsed.projectRoot);
+    const repo = resolveRepo(parsed.repo, projectRoot);
+    if (repo === null) {
+        process.stderr.write("triage:evaluate: --repo owner/name is required\n");
+        return 2;
+    }
+    try {
+        const result = await evaluateIssues({
+            projectRoot,
+            repo,
+            issues: parsed.issues,
+            concurrency: parsed.concurrency,
+        });
+        if (parsed.json) {
+            process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else {
+            process.stdout.write(renderEvaluateText(result));
+        }
+        return result.verdicts.some((v) => v.error !== null) ? 1 : 0;
+    }
+    catch (err) {
+        const message = err instanceof EvaluateError ? err.message : String(err);
+        process.stderr.write(`triage:evaluate: ${message}\n`);
+        return err instanceof EvaluateError ? 2 : 1;
+    }
+}
+export async function main(argv) {
+    return run(argv);
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    void run(process.argv.slice(2)).then((code) => {
+        process.exit(code);
+    });
+}
+//# sourceMappingURL=triage-evaluate.js.map

package/dist/triage-queue.js

@@ -88,7 +88,7 @@ export function parseArgs(argv) {
     };
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
-        if (arg === "queue") {
+        if (arg === "queue" || arg === "--") {
             continue;
         }
         if (arg === "--include-blocked") {
@@ -197,6 +197,9 @@ export function parseShowArgs(argv) {
     }
     for (let i = start; i < argv.length; i += 1) {
         const arg = argv[i];
+        if (arg === "--") {
+            continue;
+        }
         const commonHit = parseCommonFlag(arg, argv, i, parsed);
         if (commonHit !== null) {
             if (commonHit.error !== undefined) {

package/dist/verify-completed-tracked.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { evaluateCompletedTracked } from "@deftai/directive-core/lifecycle";
+import { COMPLETED_TRACKED_PROGRESS_MIN_BLOBS, COMPLETED_TRACKED_PROGRESS_THRESHOLD_MS, evaluateCompletedTracked, shouldAnnounceProgress, shouldAnnounceUpFrontCount, } from "@deftai/directive-core/lifecycle";
 function parseIssueNumber(raw) {
     const trimmed = raw.startsWith("#") ? raw.slice(1) : raw;
     if (!/^\d+$/.test(trimmed)) {
@@ -95,12 +95,27 @@ export function run(argv) {
         return 2;
     }
     const projectRoot = resolve(args.projectRoot);
+    const thresholdMs = resolveProgressThresholdMs();
+    let announced = false;
     const result = evaluateCompletedTracked(projectRoot, {
         quiet: args.quiet,
         repo: args.repo,
         tip: args.tip,
         issue: args.issue,
         skipGh: args.skipGh,
+        onProgress: (event) => {
+            if (args.quiet || announced) {
+                return;
+            }
+            const minBlobs = resolveProgressMinBlobs();
+            const upFront = event.phase === "listed" &&
+                shouldAnnounceUpFrontCount(event.terminalCount, event.nonterminalCount, minBlobs);
+            if (!upFront && !shouldAnnounceProgress(event.elapsedMs, thresholdMs)) {
+                return;
+            }
+            announced = true;
+            writeProgress(event);
+        },
     });
     if (result.message.length > 0) {
         if (result.stream === "stdout") {
@@ -112,6 +127,24 @@ export function run(argv) {
     }
     return result.code;
 }
+function resolveProgressThresholdMs() {
+    const raw = process.env.DEFT_COMPLETED_TRACKED_PROGRESS_MS;
+    if (raw !== undefined && /^\d+$/.test(raw)) {
+        return Number(raw);
+    }
+    return COMPLETED_TRACKED_PROGRESS_THRESHOLD_MS;
+}
+function resolveProgressMinBlobs() {
+    const raw = process.env.DEFT_COMPLETED_TRACKED_PROGRESS_MIN_BLOBS;
+    if (raw !== undefined && /^\d+$/.test(raw)) {
+        return Number(raw);
+    }
+    return COMPLETED_TRACKED_PROGRESS_MIN_BLOBS;
+}
+function writeProgress(event) {
+    process.stderr.write(`verify:completed-tracked: still running (${event.elapsedMs}ms); ` +
+        `reading ${event.terminalCount} terminal and ${event.nonterminalCount} nonterminal blobs.\n`);
+}
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
     process.exit(run(process.argv.slice(2)));
 }

package/dist/verify-completed-write-guard.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    projectRoot: string;
+    baseRef: string;
+    quiet: boolean;
+    error?: string;
+}
+/** Parse verify-completed-write-guard CLI args (#3679). */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+/** Run the gate and return the process exit code. */
+export declare function run(argv: string[]): number;
+export {};
+//# sourceMappingURL=verify-completed-write-guard.d.ts.map

package/dist/verify-completed-write-guard.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+/**
+ * CLI for verify:completed-write-guard (#3679).
+ */
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { evaluateCompletedWriteGuard } from "@deftai/directive-core/lifecycle";
+/** Parse verify-completed-write-guard CLI args (#3679). */
+export function parseArgs(argv) {
+    const parsed = {
+        projectRoot: ".",
+        baseRef: "",
+        quiet: false,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--quiet") {
+            parsed.quiet = true;
+        }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--base-ref") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --base-ref: expected one argument" };
+            }
+            parsed.baseRef = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--base-ref=")) {
+            parsed.baseRef = arg.slice("--base-ref=".length);
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+/** Run the gate and return the process exit code. */
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write(`verify_completed_write_guard: ${args.error}\n`);
+        return 2;
+    }
+    const projectRoot = resolve(args.projectRoot);
+    const result = evaluateCompletedWriteGuard(projectRoot, {
+        ...(args.baseRef.length > 0 ? { baseRef: args.baseRef } : {}),
+    });
+    if (result.message.length > 0 && !args.quiet) {
+        if (result.code === 0) {
+            process.stdout.write(`${result.message}\n`);
+        }
+        else {
+            process.stderr.write(`${result.message}\n`);
+        }
+    }
+    return result.code;
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-completed-write-guard.js.map

package/dist/verify-forward-coverage.d.ts

@@ -5,6 +5,10 @@ interface ParsedArgs {
     projectRoot: string;
     allowList: string | null;
     quiet: boolean;
+    enforce: boolean;
+    coverageReport: string | null;
+    coverageDir: string | null;
+    help?: boolean;
     error?: string;
 }
 /** Parse the verify-forward-coverage CLI args, mirroring the verify-encoding surface. */

package/dist/verify-forward-coverage.js

@@ -2,6 +2,20 @@
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { evaluateForwardCoverage } from "@deftai/directive-core";
+const HELP_TEXT = "Usage: verify-forward-coverage [--project-root <path>] [--staged|--head] [--allow-list <path>]\n" +
+    "                               [--coverage-dir <path>] [--coverage-report <path>]\n" +
+    "                               [--enforce] [--quiet]\n" +
+    "  Fail-closed new-source-file existence (#1310) plus warn-first diff coverage of\n" +
+    "  added/modified branches (#3514). The 90% per-diff threshold is not the 75\n" +
+    "  global floor. Missing coverage reports skip the diff half.\n" +
+    "  --enforce: fail closed when uncovered changed branches are below 90%.\n";
+function takeValue(argv, i, flag) {
+    const value = argv[i + 1];
+    if (value === undefined) {
+        return { error: `argument ${flag}: expected one argument` };
+    }
+    return { value, next: i + 1 };
+}
 /** Parse the verify-forward-coverage CLI args, mirroring the verify-encoding surface. */
 export function parseArgs(argv) {
     const parsed = {
@@ -9,6 +23,9 @@ export function parseArgs(argv) {
         projectRoot: ".",
         allowList: null,
         quiet: false,
+        enforce: false,
+        coverageReport: null,
+        coverageDir: null,
     };
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
@@ -21,48 +38,97 @@ export function parseArgs(argv) {
         else if (arg === "--quiet") {
             parsed.quiet = true;
         }
+        else if (arg === "--enforce") {
+            parsed.enforce = true;
+        }
+        else if (arg === "--help" || arg === "-h") {
+            return { ...parsed, help: true };
+        }
         else if (arg === "--project-root") {
-            const value = argv[i + 1];
-            if (value === undefined) {
-                return { ...parsed, error: "argument --project-root: expected one argument" };
+            const taken = takeValue(argv, i, "--project-root");
+            if ("error" in taken) {
+                return { ...parsed, error: taken.error };
             }
-            parsed.projectRoot = value;
-            i += 1;
+            parsed.projectRoot = taken.value;
+            i = taken.next;
         }
         else if (arg?.startsWith("--project-root=")) {
             parsed.projectRoot = arg.slice("--project-root=".length);
         }
         else if (arg === "--allow-list") {
-            const value = argv[i + 1];
-            if (value === undefined) {
-                return { ...parsed, error: "argument --allow-list: expected one argument" };
+            const taken = takeValue(argv, i, "--allow-list");
+            if ("error" in taken) {
+                return { ...parsed, error: taken.error };
             }
-            parsed.allowList = value;
-            i += 1;
+            parsed.allowList = taken.value;
+            i = taken.next;
         }
         else if (arg?.startsWith("--allow-list=")) {
             parsed.allowList = arg.slice("--allow-list=".length);
         }
+        else if (arg === "--coverage-report") {
+            const taken = takeValue(argv, i, "--coverage-report");
+            if ("error" in taken) {
+                return { ...parsed, error: taken.error };
+            }
+            parsed.coverageReport = taken.value;
+            i = taken.next;
+        }
+        else if (arg?.startsWith("--coverage-report=")) {
+            parsed.coverageReport = arg.slice("--coverage-report=".length);
+        }
+        else if (arg === "--coverage-dir") {
+            const taken = takeValue(argv, i, "--coverage-dir");
+            if ("error" in taken) {
+                return { ...parsed, error: taken.error };
+            }
+            parsed.coverageDir = taken.value;
+            i = taken.next;
+        }
+        else if (arg?.startsWith("--coverage-dir=")) {
+            parsed.coverageDir = arg.slice("--coverage-dir=".length);
+        }
         else {
             return { ...parsed, error: `unrecognized argument: ${arg}` };
         }
     }
     return parsed;
 }
+function resolveCoverageReport(args) {
+    if (args.coverageReport !== null) {
+        return resolve(args.coverageReport);
+    }
+    if (args.coverageDir !== null) {
+        return resolve(args.coverageDir, "coverage-final.json");
+    }
+    return undefined;
+}
 /** Run the gate and return the process exit code (argv parse error -> 2). */
 export function run(argv) {
     const args = parseArgs(argv);
+    if (args.help === true) {
+        process.stdout.write(HELP_TEXT);
+        return 0;
+    }
     if (args.error !== undefined) {
         process.stderr.write(`verify_forward_coverage: ${args.error}\n`);
         return 2;
     }
     const projectRoot = resolve(args.projectRoot);
     const allowListPath = args.allowList !== null ? resolve(args.allowList) : null;
-    const result = evaluateForwardCoverage(projectRoot, { mode: args.mode, allowListPath });
+    const result = evaluateForwardCoverage(projectRoot, {
+        mode: args.mode,
+        allowListPath,
+        enforceDiffCoverage: args.enforce,
+        coverageReportPath: resolveCoverageReport(args),
+    });
     if (result.exitCode === 0) {
         if (!args.quiet) {
             process.stdout.write(`${result.message}\n`);
         }
+        else if (result.message.includes("ADVISORY")) {
+            process.stdout.write(`${result.message}\n`);
+        }
     }
     else {
         process.stderr.write(`${result.message}\n`);

package/dist/verify-lifecycle-visible.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    projectRoot: string;
+    enforce: boolean;
+    help?: boolean;
+    error?: string;
+}
+/** Parse verify-lifecycle-visible CLI args (#3505). */
+export declare function parseArgs(argv: string[]): ParsedArgs;
+/** Run the gate and return the process exit code. */
+export declare function run(argv: string[]): number;
+export {};
+//# sourceMappingURL=verify-lifecycle-visible.d.ts.map

package/dist/verify-lifecycle-visible.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+/**
+ * CLI for task verify:lifecycle-visible (#3505).
+ * Warn-only by default; pass --enforce to fail closed.
+ */
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { evaluateLifecycleVisible } from "@deftai/directive-core/lifecycle-visible";
+/** Parse verify-lifecycle-visible CLI args (#3505). */
+export function parseArgs(argv) {
+    const parsed = { projectRoot: ".", enforce: false };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--enforce") {
+            parsed.enforce = true;
+        }
+        else if (arg === "--help" || arg === "-h") {
+            return { ...parsed, help: true };
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+const HELP_TEXT = "Usage: verify-lifecycle-visible [--project-root <path>] [--enforce]\n" +
+    "  Detect ignore/exclude/skip-worktree flags that hide xbrief/vbrief lifecycle roots (#3505).\n" +
+    "  Default: warn-only (exit 0 with advisory report).\n" +
+    "  --enforce: fail closed (exit 1) when a lifecycle root is hidden.\n" +
+    "  Not part of task check — per-clone property, wired from session:start.\n";
+/** Run the gate and return the process exit code. */
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.help === true) {
+        process.stdout.write(HELP_TEXT);
+        return 0;
+    }
+    if (args.error !== undefined) {
+        process.stderr.write(`verify_lifecycle_visible: ${args.error}\n`);
+        return 2;
+    }
+    const result = evaluateLifecycleVisible({
+        projectRoot: resolve(args.projectRoot),
+        enforce: args.enforce,
+    });
+    if (result.stream === "stdout") {
+        process.stdout.write(`${result.message}\n`);
+    }
+    else {
+        process.stderr.write(`${result.message}\n`);
+    }
+    return result.code;
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-lifecycle-visible.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.105.0",
+  "version": "0.107.0",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -34,8 +34,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.105.0",
-    "@deftai/directive-content": "^0.105.0"
+    "@deftai/directive-core": "^0.107.0",
+    "@deftai/directive-content": "^0.107.0"
   },
   "scripts": {
     "build": "tsc -b"