@deftai/directive 0.119.7 → 0.119.9

package/dist/scope-record-observable-scope.d.ts

@@ -5,6 +5,7 @@ export interface ParsedArgs {
     xbriefPath: string;
     actor: string;
     kind: string;
+    mintedVia: string;
     quiet: boolean;
     confirm: boolean;
     help?: boolean;

package/dist/scope-record-observable-scope.js

@@ -11,12 +11,18 @@ import { buildObservableScopeRecord, extractObservableChangeFromPlan, parseObser
 import { isDirectEntrypoint } from "./entrypoint.js";
 import { refuseMintWhileUatActive, refuseNonInteractiveMint, resolveHumanPresenceMintSeams, } from "./human-presence-mint.js";
 import { isPathInsideRoot } from "./scope-record-approved-scope.js";
+const DEFAULT_MINTED_VIA = "scope:record-observable-scope";
+const ALLOWED_MINTED_VIA = new Set([DEFAULT_MINTED_VIA, "in-harness-ask"]);
 function usage() {
     return ("usage: scope:record-observable-scope -- <xbrief-path> --actor <name> --confirm " +
-        "[--kind operator] [--project-root <dir>] [--quiet]\n" +
+        "[--kind operator] [--minted-via in-harness-ask|scope:record-observable-scope] " +
+        "[--project-root <dir>] [--quiet]\n" +
         '  Writes .deft/observable-scope/<plan-id>.json from plan["x-directive/observableChange"].\n' +
-        "  --actor is display only and never authorizes mint. Mint requires a real TTY, " +
-        "controlling terminal, --confirm, and typed phrase mint (#3110). Agent/CI shells refuse.");
+        "  Attended mid-build (#5010): ask in parent chat; on yes the human runs this verb on a real TTY " +
+        "with --minted-via=in-harness-ask (attestation is not an agent-shell bypass). Commit the record on " +
+        "the delivery-branch merge base, then rebase the implementation branch — same-PR working-tree-only " +
+        "records are not authoritative. Unattended/C1: rewrite or park. --actor is display only. Mint still " +
+        "requires a real TTY, controlling terminal, --confirm, and typed phrase mint (#3110). Agent/CI shells refuse.");
 }
 function extractPlanId(payload) {
     if (payload === null || typeof payload !== "object" || Array.isArray(payload))
@@ -33,6 +39,7 @@ export function parseArgs(argv) {
         xbriefPath: "",
         actor: "",
         kind: "operator",
+        mintedVia: DEFAULT_MINTED_VIA,
         quiet: false,
         confirm: false,
     };
@@ -77,6 +84,16 @@ export function parseArgs(argv) {
         else if (arg?.startsWith("--kind=")) {
             parsed.kind = arg.slice("--kind=".length);
         }
+        else if (arg === "--minted-via") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --minted-via: expected one argument" };
+            parsed.mintedVia = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--minted-via=")) {
+            parsed.mintedVia = arg.slice("--minted-via=".length);
+        }
         else if (arg?.startsWith("-")) {
             return { ...parsed, error: `unrecognized argument: ${arg}` };
         }
@@ -98,6 +115,13 @@ export function parseArgs(argv) {
             error: `argument --actor is required (human operator identity)\n${usage()}`,
         };
     }
+    if (!ALLOWED_MINTED_VIA.has(parsed.mintedVia.trim())) {
+        return {
+            ...parsed,
+            error: `argument --minted-via must be one of: ${[...ALLOWED_MINTED_VIA].join(", ")}\n${usage()}`,
+        };
+    }
+    parsed.mintedVia = parsed.mintedVia.trim();
     return parsed;
 }
 export function run(argv, seams = {}) {
@@ -161,7 +185,7 @@ export function run(argv, seams = {}) {
             kind: args.kind,
             actor: args.actor,
             mintedAt: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
-            mintedVia: "scope:record-observable-scope",
+            mintedVia: args.mintedVia,
         },
     });
     if ("error" in rec) {

package/dist/verify-class-checks.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    projectRoot: string;
+    baseRef: string | null;
+    quiet: boolean;
+    error?: string;
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare function run(argv: string[]): number;
+export {};
+//# sourceMappingURL=verify-class-checks.d.ts.map

package/dist/verify-class-checks.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+/**
+ * CLI for verify:class-checks (#4980 / #3145 class).
+ */
+import { resolve } from "node:path";
+import { classChecks } from "@deftai/directive-core";
+import { isDirectEntrypoint } from "./entrypoint.js";
+export function parseArgs(argv) {
+    const parsed = {
+        projectRoot: ".",
+        baseRef: null,
+        quiet: false,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--quiet") {
+            parsed.quiet = true;
+        }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--base-ref") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --base-ref: expected one argument" };
+            }
+            parsed.baseRef = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--base-ref=")) {
+            parsed.baseRef = arg.slice("--base-ref=".length);
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write(`verify_class_checks: ${args.error}\n`);
+        return 2;
+    }
+    const projectRoot = resolve(args.projectRoot);
+    const result = classChecks.evaluateClassChecks(projectRoot, {
+        baseRef: args.baseRef,
+        quiet: args.quiet,
+    });
+    if (result.exitCode === 0) {
+        if (!args.quiet) {
+            process.stdout.write(`${result.message}\n`);
+        }
+    }
+    else {
+        process.stderr.write(`${result.message}\n`);
+    }
+    return result.exitCode;
+}
+if (isDirectEntrypoint(import.meta.url)) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-class-checks.js.map

package/dist/verify-review-monitor.d.ts

@@ -9,6 +9,11 @@ interface ParsedArgs {
     approach3: boolean;
     approach3Warned: boolean;
     emitJson: boolean;
+    /** When true, also run the #4882 merge-path arm observer (attested flags). */
+    mergePathArm: boolean;
+    liveWait: boolean;
+    explicitFinish: boolean;
+    stickyLease: boolean;
     help: boolean;
     error?: string;
 }

package/dist/verify-review-monitor.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { evaluateReviewMonitorGate, REVIEW_MONITOR_HELP, verifyResultToJson, } from "@deftai/directive-core/review-monitor";
+import { evaluateMergePathArm, } from "@deftai/directive-core/dist/pr-watch/main.js";
+import { EXIT_CONFIG_ERROR, EXIT_NOT_READY, evaluateReviewMonitorGate, isTier1, REVIEW_MONITOR_HELP, verifyResultToJson, } from "@deftai/directive-core/review-monitor";
 const CALL_SITES = new Set([
     "solo",
     "swarm-phase5-6",
@@ -18,6 +19,10 @@ export function parseVerifyReviewMonitorArgs(argv) {
         approach3: false,
         approach3Warned: false,
         emitJson: false,
+        mergePathArm: false,
+        liveWait: false,
+        explicitFinish: false,
+        stickyLease: false,
         help: false,
     };
     for (let i = 0; i < argv.length; i += 1) {
@@ -28,6 +33,18 @@ export function parseVerifyReviewMonitorArgs(argv) {
         if (arg === "--json") {
             acc.emitJson = true;
         }
+        else if (arg === "--merge-path-arm") {
+            acc.mergePathArm = true;
+        }
+        else if (arg === "--live-wait") {
+            acc.liveWait = true;
+        }
+        else if (arg === "--explicit-finish") {
+            acc.explicitFinish = true;
+        }
+        else if (arg === "--sticky-lease") {
+            acc.stickyLease = true;
+        }
         else if (arg === "--approach3") {
             acc.approach3 = true;
         }
@@ -117,6 +134,13 @@ export function run(argv) {
     const args = parseVerifyReviewMonitorArgs(argv);
     if (args.help) {
         process.stdout.write(REVIEW_MONITOR_HELP);
+        process.stdout.write("\n#4882 merge-path arm observer (optional):\n" +
+            "  --merge-path-arm       Fail closed when neither live wait nor explicit finish\n" +
+            "  --live-wait            Attest a still-running phase-correct wait for this PR\n" +
+            "                         (Tier 1: bound to gate lease evidence for --pr)\n" +
+            "  --explicit-finish      Attest option-C BLOCKED/FAILED finish for this PR\n" +
+            "  --sticky-lease         Attest a fresh sticky lease (not sufficient alone)\n" +
+            "  Prefer Approach 1 / native pr:watch; homemade line-parsed --json is not an arm.\n");
         return 0;
     }
     if (args.error !== undefined) {
@@ -129,6 +153,8 @@ export function run(argv) {
         process.stderr.write("Try: task verify:review-monitor -- --help\n");
         return 2;
     }
+    // Always evaluate the gate first so --project-root / repo config errors stay
+    // exit 2 even when --merge-path-arm would otherwise fail closed as unarmed.
     const result = evaluateReviewMonitorGate({
         pr: args.pr,
         projectRoot: resolve(args.projectRoot),
@@ -139,15 +165,69 @@ export function run(argv) {
         approach3Warned: args.approach3Warned,
         environ: process.env,
     });
+    let arm = null;
+    if (args.mergePathArm) {
+        // Bind --live-wait to gate-observed lease evidence on Tier 1 for this PR.
+        // Bare flags must not arm when Tier 1 requires a lease and none is present.
+        const leaseEvidence = result.monitorRecord !== null;
+        const liveBound = args.liveWait && (!isTier1(result.tier) || leaseEvidence);
+        arm = evaluateMergePathArm({
+            livePhaseCorrectWait: liveBound,
+            explicitFinish: args.explicitFinish,
+            stickyLeaseActive: args.stickyLease || leaseEvidence,
+        });
+        if (args.liveWait && !liveBound && !args.explicitFinish && !arm.armed) {
+            arm = {
+                armed: false,
+                reason: "unarmed_stand_down",
+                message: `unarmed stand-down: --live-wait attestation unbound to lease evidence ` +
+                    `for PR #${args.pr} (Tier 1); sticky lease alone is not a live arm (#4882)`,
+            };
+        }
+    }
     if (args.emitJson) {
-        process.stdout.write(`${JSON.stringify(verifyResultToJson(result), null, 2)}\n`);
+        const payload = verifyResultToJson(result);
+        if (arm !== null) {
+            payload.merge_path_arm = {
+                armed: arm.armed,
+                reason: arm.reason,
+                message: arm.message,
+                live_wait: args.liveWait,
+                explicit_finish: args.explicitFinish,
+                sticky_lease: args.stickyLease,
+                lease_evidence: result.monitorRecord !== null,
+            };
+            // Combined gate+arm: unarmed fails closed even when the monitor gate is ready.
+            if (!arm.armed && result.exitCode !== EXIT_CONFIG_ERROR) {
+                payload.ready = false;
+                payload.exit_code = EXIT_NOT_READY;
+                // Gate-ready → arm diagnosis; both failing → keep both messages.
+                payload.message = result.exitCode === 0 ? arm.message : `${result.message}\n${arm.message}`;
+            }
+        }
+        process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    }
+    else if (result.exitCode === EXIT_CONFIG_ERROR) {
+        process.stderr.write(`${result.message}\n`);
+    }
+    else if (arm !== null && !arm.armed) {
+        process.stderr.write(`${arm.message}\n`);
     }
     else if (result.exitCode === 0) {
         process.stdout.write(`${result.message}\n`);
+        if (arm !== null) {
+            process.stdout.write(`${arm.message}\n`);
+        }
     }
     else {
         process.stderr.write(`${result.message}\n`);
     }
+    if (result.exitCode === EXIT_CONFIG_ERROR) {
+        return EXIT_CONFIG_ERROR;
+    }
+    if (arm !== null && !arm.armed) {
+        return EXIT_NOT_READY;
+    }
     return result.exitCode;
 }
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {

package/dist/verify-session-ritual.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { emitBypassWarning, emitVerifyJson, formatCacheFreshDeferSoftPath, formatRitualRecoveryInstruction, verifySessionRitual, } from "@deftai/directive-core/session";
+import { emitBypassWarning, emitVerifyJson, formatCacheFreshDeferSoftPath, occupancyAwareDenialMessage, verifySessionRitual, } from "@deftai/directive-core/session";
 function parsePosture(value) {
     if (value === "read-only")
         return "read-only";
@@ -121,8 +121,10 @@ export function run(argv, deps = {}) {
         }
     }
     else if (result.code === 1) {
-        const recovery = formatRitualRecoveryInstruction(result.recoveryTier ?? "cold");
-        const lines = [result.message, recovery];
+        const recoveryTier = result.recoveryTier ?? "cold";
+        const lines = [
+            occupancyAwareDenialMessage(projectRoot, result.message, { env: process.env }, recoveryTier),
+        ];
         if (isCacheFreshFailureMessage(result.message)) {
             lines.push(formatCacheFreshDeferSoftPath());
         }

package/dist/windows-bin-ps1.d.ts

@@ -0,0 +1,39 @@
+/** Fallback when package.json cannot be read. Keep aligned with the bin map. */
+export declare const PACKAGE_BIN_NAMES: readonly ["directive", "deft", "deft-ts", "deft-hook", "deft-verify-encoding"];
+/** Node owns these shims. This package must not delete them. */
+export declare const NODE_OWNED_SHIM_NAMES: readonly ["npx", "npm"];
+export interface Ps1ShimRemoval {
+    readonly removed: readonly string[];
+    readonly failed: readonly string[];
+}
+export declare function packageIsUnderNodeModules(pkgDir: string): boolean;
+/** bin-links layout. Valid only when {@link packageIsUnderNodeModules} is true. */
+export declare function nodeModulesDir(pkgDir: string): string;
+/** Same directory bin-links uses for this package root. */
+export declare function linkerBinDir(opts: {
+    readonly pkgDir: string;
+    readonly global: boolean;
+    readonly platform: string;
+}): string;
+export declare function isGlobalInstall(env: Readonly<Record<string, string | undefined>>): boolean;
+export declare function candidateBinDirs(opts: {
+    readonly pkgDir: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly platform: string;
+}): string[];
+export declare function removeGeneratedPs1Shims(opts: {
+    readonly binDir: string;
+    readonly binNames: readonly string[];
+    readonly platform: string;
+    readonly protectedNames?: readonly string[];
+}): Ps1ShimRemoval;
+/** True when cmd-shim text records a target path inside this install. */
+export declare function cmdShimTargetsPackage(cmdText: string, binDir: string, pkgDir: string): boolean;
+export declare function readPackageBinNames(packageJsonText: string): string[];
+export declare function removeInstalledWindowsPs1Shims(opts: {
+    readonly pkgDir: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly platform: string;
+    readonly readText?: (path: string) => string;
+}): Ps1ShimRemoval;
+//# sourceMappingURL=windows-bin-ps1.d.ts.map

package/dist/windows-bin-ps1.js

@@ -0,0 +1,224 @@
+/**
+ * npm's Windows bin linker (cmd-shim) always writes a .ps1 beside the .cmd.
+ * PowerShell selects that .ps1 and stops when script execution is refused, so
+ * the bare name never reaches the .cmd. This runs from postinstall, after
+ * that link, and removes only this package's generated .ps1 files.
+ * A .ps1 is removed only when its sibling .cmd records a target inside this
+ * install, so an ambient PNPM_HOME from another install is left alone.
+ * It does not change npx.ps1, npm.ps1, or the operator's execution policy.
+ */
+import { existsSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { basename, dirname, join, win32 } from "node:path";
+/** Fallback when package.json cannot be read. Keep aligned with the bin map. */
+export const PACKAGE_BIN_NAMES = [
+    "directive",
+    "deft",
+    "deft-ts",
+    "deft-hook",
+    "deft-verify-encoding",
+];
+/** Node owns these shims. This package must not delete them. */
+export const NODE_OWNED_SHIM_NAMES = ["npx", "npm"];
+export function packageIsUnderNodeModules(pkgDir) {
+    const parent = dirname(pkgDir);
+    if (basename(parent) === "node_modules")
+        return true;
+    return basename(dirname(parent)) === "node_modules";
+}
+/** bin-links layout. Valid only when {@link packageIsUnderNodeModules} is true. */
+export function nodeModulesDir(pkgDir) {
+    const scopeOrNm = dirname(pkgDir);
+    if (basename(scopeOrNm) === "node_modules")
+        return scopeOrNm;
+    return dirname(scopeOrNm);
+}
+/** Same directory bin-links uses for this package root. */
+export function linkerBinDir(opts) {
+    const nm = nodeModulesDir(opts.pkgDir);
+    if (!opts.global)
+        return join(nm, ".bin");
+    const prefix = dirname(nm);
+    if (opts.platform === "win32")
+        return prefix;
+    return join(prefix, "bin");
+}
+export function isGlobalInstall(env) {
+    return env.npm_config_global === "true";
+}
+function dirKey(dir, platform) {
+    const norm = dir.replace(/[\\/]+/g, "/");
+    if (platform === "win32")
+        return norm.toLowerCase();
+    return norm;
+}
+function ancestorBinDirs(pkgDir, stopDir, platform) {
+    const stop = dirKey(stopDir, platform);
+    const start = dirKey(pkgDir, platform);
+    const stopPrefix = stop.endsWith("/") ? stop : `${stop}/`;
+    if (start !== stop && !start.startsWith(stopPrefix)) {
+        return [join(stopDir, "node_modules", ".bin")];
+    }
+    const out = [];
+    let dir = pkgDir;
+    for (;;) {
+        out.push(join(dir, "node_modules", ".bin"));
+        if (dirKey(dir, platform) === stop)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return out;
+}
+export function candidateBinDirs(opts) {
+    const global = isGlobalInstall(opts.env);
+    const dirs = [];
+    if (packageIsUnderNodeModules(opts.pkgDir)) {
+        dirs.push(linkerBinDir({ pkgDir: opts.pkgDir, global, platform: opts.platform }));
+    }
+    if (global) {
+        const prefix = opts.env.npm_config_prefix;
+        if (prefix !== undefined && prefix.length > 0) {
+            dirs.push(opts.platform === "win32" ? prefix : join(prefix, "bin"));
+        }
+        // Candidate only. Removal still requires the .cmd to target this install.
+        const pnpmHome = opts.env.PNPM_HOME;
+        if (pnpmHome !== undefined && pnpmHome.length > 0)
+            dirs.push(pnpmHome);
+    }
+    else {
+        const localPrefix = opts.env.npm_config_local_prefix;
+        if (localPrefix !== undefined && localPrefix.length > 0) {
+            dirs.push(...ancestorBinDirs(opts.pkgDir, localPrefix, opts.platform));
+        }
+    }
+    const seen = new Set();
+    const out = [];
+    for (const dir of dirs) {
+        const key = dirKey(dir, opts.platform);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(dir);
+    }
+    return out;
+}
+function isSafeBinName(name) {
+    if (name.length === 0)
+        return false;
+    if (name.includes("/") || name.includes("\\") || name.includes(".."))
+        return false;
+    return true;
+}
+export function removeGeneratedPs1Shims(opts) {
+    if (opts.platform !== "win32")
+        return { removed: [], failed: [] };
+    const protect = new Set((opts.protectedNames ?? NODE_OWNED_SHIM_NAMES).map((name) => name.toLowerCase()));
+    const removed = [];
+    const failed = [];
+    for (const name of opts.binNames) {
+        if (!isSafeBinName(name) || protect.has(name.toLowerCase()))
+            continue;
+        const ps1 = join(opts.binDir, `${name}.ps1`);
+        const cmd = join(opts.binDir, `${name}.cmd`);
+        if (!existsSync(cmd) || !existsSync(ps1))
+            continue;
+        try {
+            unlinkSync(ps1);
+            removed.push(ps1);
+        }
+        catch {
+            failed.push(ps1);
+        }
+    }
+    return { removed, failed };
+}
+function normalizedWinPath(p) {
+    const norm = win32.normalize(p).replace(/[\\/]+/g, "\\");
+    const trimmed = norm.length > 3 && norm.endsWith("\\") ? norm.slice(0, -1) : norm;
+    return trimmed.toLowerCase();
+}
+function pathIsInside(root, target) {
+    const rootKey = normalizedWinPath(root);
+    const targetKey = normalizedWinPath(target);
+    return targetKey === rootKey || targetKey.startsWith(`${rootKey}\\`);
+}
+/** cmd-shim text is Windows-shaped. realpath needs host separators or a junction never matches. */
+function hostPath(p) {
+    return p.replace(/\\/g, "/");
+}
+function realpathIsInside(root, target) {
+    try {
+        return pathIsInside(realpathSync(hostPath(root)), realpathSync(hostPath(target)));
+    }
+    catch {
+        return false;
+    }
+}
+/** True when cmd-shim text records a target path inside this install. */
+export function cmdShimTargetsPackage(cmdText, binDir, pkgDir) {
+    const re = /%(?:dp0%|~dp0)(?:\\+|\/+)([^"\r\n\s]+)/gi;
+    for (const match of cmdText.matchAll(re)) {
+        const rel = match[1];
+        if (rel === undefined || rel.length === 0)
+            continue;
+        const resolved = win32.normalize(win32.join(binDir, rel.replace(/\//g, "\\")));
+        if (pathIsInside(pkgDir, resolved) || realpathIsInside(pkgDir, resolved))
+            return true;
+    }
+    return false;
+}
+function cmdLinksCurrentInstall(binDir, name, pkgDir) {
+    if (!isSafeBinName(name))
+        return false;
+    let text;
+    try {
+        text = readFileSync(join(binDir, `${name}.cmd`), "utf8");
+    }
+    catch {
+        return false;
+    }
+    return cmdShimTargetsPackage(text, binDir, pkgDir);
+}
+export function readPackageBinNames(packageJsonText) {
+    let parsed;
+    try {
+        parsed = JSON.parse(packageJsonText);
+    }
+    catch {
+        return [];
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return [];
+    const bin = parsed.bin;
+    if (bin === null || typeof bin !== "object" || Array.isArray(bin))
+        return [];
+    return Object.keys(bin);
+}
+export function removeInstalledWindowsPs1Shims(opts) {
+    if (opts.platform !== "win32")
+        return { removed: [], failed: [] };
+    const readText = opts.readText ?? ((path) => readFileSync(path, "utf8"));
+    let names;
+    try {
+        names = readPackageBinNames(readText(join(opts.pkgDir, "package.json")));
+    }
+    catch {
+        names = PACKAGE_BIN_NAMES;
+    }
+    const removed = [];
+    const failed = [];
+    for (const binDir of candidateBinDirs(opts)) {
+        const linked = names.filter((name) => cmdLinksCurrentInstall(binDir, name, opts.pkgDir));
+        const result = removeGeneratedPs1Shims({
+            binDir,
+            binNames: linked,
+            platform: opts.platform,
+        });
+        removed.push(...result.removed);
+        failed.push(...result.failed);
+    }
+    return { removed, failed };
+}
+//# sourceMappingURL=windows-bin-ps1.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.119.7",
+  "version": "0.119.9",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -22,7 +22,8 @@
   },
   "files": [
     "dist/**/*.js",
-    "dist/**/*.d.ts"
+    "dist/**/*.d.ts",
+    "scripts/remove-windows-ps1-shims.mjs"
   ],
   "repository": {
     "type": "git",
@@ -34,10 +35,11 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.119.7",
-    "@deftai/directive-content": "^0.119.7"
+    "@deftai/directive-core": "^0.119.9",
+    "@deftai/directive-content": "^0.119.9"
   },
   "scripts": {
-    "build": "tsc -b"
+    "build": "tsc -b",
+    "postinstall": "node ./scripts/remove-windows-ps1-shims.mjs"
   }
 }

package/scripts/remove-windows-ps1-shims.mjs

@@ -0,0 +1,26 @@
+/**
+ * postinstall entry (#4654). The published tarball includes dist/.
+ * A workspace install before tsc has no linked shims yet, so a missing
+ * dist file is a no-op rather than a failed install.
+ */
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const entry = join(pkgDir, "dist", "windows-bin-ps1.js");
+
+if (existsSync(entry)) {
+  const mod = await import(pathToFileURL(entry).href);
+  const result = mod.removeInstalledWindowsPs1Shims({
+    pkgDir,
+    env: process.env,
+    platform: process.platform,
+  });
+  if (result.failed.length > 0) {
+    process.stderr.write(
+      `remove-windows-ps1-shims: could not remove ${result.failed.join(", ")}\n`,
+    );
+    process.exitCode = 1;
+  }
+}