@deftai/directive 0.119.8 → 0.119.10

package/dist/verify-review-monitor.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { evaluateReviewMonitorGate, REVIEW_MONITOR_HELP, verifyResultToJson, } from "@deftai/directive-core/review-monitor";
+import { bindLivePhaseCorrectWait, evaluateMergePathArm, } from "@deftai/directive-core/dist/pr-watch/main.js";
+import { EXIT_CONFIG_ERROR, EXIT_NOT_READY, evaluateReviewMonitorGate, isTier1, REVIEW_MONITOR_HELP, verifyResultToJson, } from "@deftai/directive-core/review-monitor";
 const CALL_SITES = new Set([
     "solo",
     "swarm-phase5-6",
@@ -18,6 +19,10 @@ export function parseVerifyReviewMonitorArgs(argv) {
         approach3: false,
         approach3Warned: false,
         emitJson: false,
+        mergePathArm: false,
+        liveWait: false,
+        explicitFinish: false,
+        stickyLease: false,
         help: false,
     };
     for (let i = 0; i < argv.length; i += 1) {
@@ -28,6 +33,18 @@ export function parseVerifyReviewMonitorArgs(argv) {
         if (arg === "--json") {
             acc.emitJson = true;
         }
+        else if (arg === "--merge-path-arm") {
+            acc.mergePathArm = true;
+        }
+        else if (arg === "--live-wait") {
+            acc.liveWait = true;
+        }
+        else if (arg === "--explicit-finish") {
+            acc.explicitFinish = true;
+        }
+        else if (arg === "--sticky-lease") {
+            acc.stickyLease = true;
+        }
         else if (arg === "--approach3") {
             acc.approach3 = true;
         }
@@ -117,6 +134,15 @@ export function run(argv) {
     const args = parseVerifyReviewMonitorArgs(argv);
     if (args.help) {
         process.stdout.write(REVIEW_MONITOR_HELP);
+        process.stdout.write("\n#4882 / #5020 merge-path arm observer (optional):\n" +
+            "  --merge-path-arm       Fail closed when neither live wait nor explicit finish\n" +
+            "  --live-wait            Require still-running wait evidence for this PR\n" +
+            "                         (Tier 1: lease + active polling heartbeat with pid liveness;\n" +
+            "                         lease+flag alone is not armed — #5020)\n" +
+            "  --explicit-finish      Attest option-C BLOCKED/FAILED finish for this PR\n" +
+            "  --sticky-lease         Attest a fresh sticky lease (not sufficient alone)\n" +
+            "  Prefer Approach 1 / native pr:watch or post-CLEAN pr:wait-mergeable-and-merge;\n" +
+            "  homemade line-parsed --json is not an arm.\n");
         return 0;
     }
     if (args.error !== undefined) {
@@ -129,6 +155,8 @@ export function run(argv) {
         process.stderr.write("Try: task verify:review-monitor -- --help\n");
         return 2;
     }
+    // Always evaluate the gate first so --project-root / repo config errors stay
+    // exit 2 even when --merge-path-arm would otherwise fail closed as unarmed.
     const result = evaluateReviewMonitorGate({
         pr: args.pr,
         projectRoot: resolve(args.projectRoot),
@@ -139,15 +167,78 @@ export function run(argv) {
         approach3Warned: args.approach3Warned,
         environ: process.env,
     });
+    let arm = null;
+    if (args.mergePathArm) {
+        // Bind --live-wait to lease (#5018) + process-liveness heartbeat (#5020) on Tier 1.
+        const leaseEvidence = result.monitorRecord !== null;
+        const liveBind = bindLivePhaseCorrectWait({
+            liveWaitFlag: args.liveWait,
+            tierIs1: isTier1(result.tier),
+            leaseEvidence,
+            heartbeatActive: result.heartbeatActive,
+            pr: args.pr,
+        });
+        arm = evaluateMergePathArm({
+            livePhaseCorrectWait: liveBind.livePhaseCorrectWait,
+            explicitFinish: args.explicitFinish,
+            stickyLeaseActive: args.stickyLease || leaseEvidence,
+        });
+        if (args.liveWait &&
+            !liveBind.livePhaseCorrectWait &&
+            !args.explicitFinish &&
+            !arm.armed &&
+            liveBind.message !== null) {
+            arm = {
+                armed: false,
+                reason: "unarmed_stand_down",
+                message: liveBind.message,
+            };
+        }
+    }
     if (args.emitJson) {
-        process.stdout.write(`${JSON.stringify(verifyResultToJson(result), null, 2)}\n`);
+        const payload = verifyResultToJson(result);
+        if (arm !== null) {
+            payload.merge_path_arm = {
+                armed: arm.armed,
+                reason: arm.reason,
+                message: arm.message,
+                live_wait: args.liveWait,
+                explicit_finish: args.explicitFinish,
+                sticky_lease: args.stickyLease,
+                lease_evidence: result.monitorRecord !== null,
+                heartbeat_active: result.heartbeatActive,
+            };
+            // Combined gate+arm: unarmed fails closed even when the monitor gate is ready.
+            if (!arm.armed && result.exitCode !== EXIT_CONFIG_ERROR) {
+                payload.ready = false;
+                payload.exit_code = EXIT_NOT_READY;
+                // Gate-ready → arm diagnosis; both failing → keep both messages.
+                payload.message = result.exitCode === 0 ? arm.message : `${result.message}\n${arm.message}`;
+            }
+        }
+        process.stdout.write(`${JSON.stringify(payload, null, 2)}\n`);
+    }
+    else if (result.exitCode === EXIT_CONFIG_ERROR) {
+        process.stderr.write(`${result.message}\n`);
+    }
+    else if (arm !== null && !arm.armed) {
+        process.stderr.write(`${arm.message}\n`);
     }
     else if (result.exitCode === 0) {
         process.stdout.write(`${result.message}\n`);
+        if (arm !== null) {
+            process.stdout.write(`${arm.message}\n`);
+        }
     }
     else {
         process.stderr.write(`${result.message}\n`);
     }
+    if (result.exitCode === EXIT_CONFIG_ERROR) {
+        return EXIT_CONFIG_ERROR;
+    }
+    if (arm !== null && !arm.armed) {
+        return EXIT_NOT_READY;
+    }
     return result.exitCode;
 }
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {

package/dist/verify-scope-provenance.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
 /**
- * CLI for verify:scope-provenance (#3145).
+ * CLI for verify:scope-provenance (#3145 / #4956 / #4774).
+ *
+ * Membership against the declared allowlist (mint / brief file_scope) is
+ * evaluated inside evaluateScopeProvenance; this CLI only forwards
+ * --base-ref / --enforce.
  */
 import { resolve } from "node:path";
 import { scopeProvenance } from "@deftai/directive-core";

package/dist/verify-session-ritual.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { emitBypassWarning, emitVerifyJson, formatCacheFreshDeferSoftPath, formatRitualRecoveryInstruction, verifySessionRitual, } from "@deftai/directive-core/session";
+import { emitBypassWarning, emitVerifyJson, formatCacheFreshDeferSoftPath, occupancyAwareDenialMessage, verifySessionRitual, } from "@deftai/directive-core/session";
 function parsePosture(value) {
     if (value === "read-only")
         return "read-only";
@@ -121,8 +121,10 @@ export function run(argv, deps = {}) {
         }
     }
     else if (result.code === 1) {
-        const recovery = formatRitualRecoveryInstruction(result.recoveryTier ?? "cold");
-        const lines = [result.message, recovery];
+        const recoveryTier = result.recoveryTier ?? "cold";
+        const lines = [
+            occupancyAwareDenialMessage(projectRoot, result.message, { env: process.env }, recoveryTier),
+        ];
         if (isCacheFreshFailureMessage(result.message)) {
             lines.push(formatCacheFreshDeferSoftPath());
         }

package/dist/windows-bin-ps1.d.ts

@@ -0,0 +1,39 @@
+/** Fallback when package.json cannot be read. Keep aligned with the bin map. */
+export declare const PACKAGE_BIN_NAMES: readonly ["directive", "deft", "deft-ts", "deft-hook", "deft-verify-encoding"];
+/** Node owns these shims. This package must not delete them. */
+export declare const NODE_OWNED_SHIM_NAMES: readonly ["npx", "npm"];
+export interface Ps1ShimRemoval {
+    readonly removed: readonly string[];
+    readonly failed: readonly string[];
+}
+export declare function packageIsUnderNodeModules(pkgDir: string): boolean;
+/** bin-links layout. Valid only when {@link packageIsUnderNodeModules} is true. */
+export declare function nodeModulesDir(pkgDir: string): string;
+/** Same directory bin-links uses for this package root. */
+export declare function linkerBinDir(opts: {
+    readonly pkgDir: string;
+    readonly global: boolean;
+    readonly platform: string;
+}): string;
+export declare function isGlobalInstall(env: Readonly<Record<string, string | undefined>>): boolean;
+export declare function candidateBinDirs(opts: {
+    readonly pkgDir: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly platform: string;
+}): string[];
+export declare function removeGeneratedPs1Shims(opts: {
+    readonly binDir: string;
+    readonly binNames: readonly string[];
+    readonly platform: string;
+    readonly protectedNames?: readonly string[];
+}): Ps1ShimRemoval;
+/** True when cmd-shim text records a target path inside this install. */
+export declare function cmdShimTargetsPackage(cmdText: string, binDir: string, pkgDir: string): boolean;
+export declare function readPackageBinNames(packageJsonText: string): string[];
+export declare function removeInstalledWindowsPs1Shims(opts: {
+    readonly pkgDir: string;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    readonly platform: string;
+    readonly readText?: (path: string) => string;
+}): Ps1ShimRemoval;
+//# sourceMappingURL=windows-bin-ps1.d.ts.map

package/dist/windows-bin-ps1.js

@@ -0,0 +1,224 @@
+/**
+ * npm's Windows bin linker (cmd-shim) always writes a .ps1 beside the .cmd.
+ * PowerShell selects that .ps1 and stops when script execution is refused, so
+ * the bare name never reaches the .cmd. This runs from postinstall, after
+ * that link, and removes only this package's generated .ps1 files.
+ * A .ps1 is removed only when its sibling .cmd records a target inside this
+ * install, so an ambient PNPM_HOME from another install is left alone.
+ * It does not change npx.ps1, npm.ps1, or the operator's execution policy.
+ */
+import { existsSync, readFileSync, realpathSync, unlinkSync } from "node:fs";
+import { basename, dirname, join, win32 } from "node:path";
+/** Fallback when package.json cannot be read. Keep aligned with the bin map. */
+export const PACKAGE_BIN_NAMES = [
+    "directive",
+    "deft",
+    "deft-ts",
+    "deft-hook",
+    "deft-verify-encoding",
+];
+/** Node owns these shims. This package must not delete them. */
+export const NODE_OWNED_SHIM_NAMES = ["npx", "npm"];
+export function packageIsUnderNodeModules(pkgDir) {
+    const parent = dirname(pkgDir);
+    if (basename(parent) === "node_modules")
+        return true;
+    return basename(dirname(parent)) === "node_modules";
+}
+/** bin-links layout. Valid only when {@link packageIsUnderNodeModules} is true. */
+export function nodeModulesDir(pkgDir) {
+    const scopeOrNm = dirname(pkgDir);
+    if (basename(scopeOrNm) === "node_modules")
+        return scopeOrNm;
+    return dirname(scopeOrNm);
+}
+/** Same directory bin-links uses for this package root. */
+export function linkerBinDir(opts) {
+    const nm = nodeModulesDir(opts.pkgDir);
+    if (!opts.global)
+        return join(nm, ".bin");
+    const prefix = dirname(nm);
+    if (opts.platform === "win32")
+        return prefix;
+    return join(prefix, "bin");
+}
+export function isGlobalInstall(env) {
+    return env.npm_config_global === "true";
+}
+function dirKey(dir, platform) {
+    const norm = dir.replace(/[\\/]+/g, "/");
+    if (platform === "win32")
+        return norm.toLowerCase();
+    return norm;
+}
+function ancestorBinDirs(pkgDir, stopDir, platform) {
+    const stop = dirKey(stopDir, platform);
+    const start = dirKey(pkgDir, platform);
+    const stopPrefix = stop.endsWith("/") ? stop : `${stop}/`;
+    if (start !== stop && !start.startsWith(stopPrefix)) {
+        return [join(stopDir, "node_modules", ".bin")];
+    }
+    const out = [];
+    let dir = pkgDir;
+    for (;;) {
+        out.push(join(dir, "node_modules", ".bin"));
+        if (dirKey(dir, platform) === stop)
+            break;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return out;
+}
+export function candidateBinDirs(opts) {
+    const global = isGlobalInstall(opts.env);
+    const dirs = [];
+    if (packageIsUnderNodeModules(opts.pkgDir)) {
+        dirs.push(linkerBinDir({ pkgDir: opts.pkgDir, global, platform: opts.platform }));
+    }
+    if (global) {
+        const prefix = opts.env.npm_config_prefix;
+        if (prefix !== undefined && prefix.length > 0) {
+            dirs.push(opts.platform === "win32" ? prefix : join(prefix, "bin"));
+        }
+        // Candidate only. Removal still requires the .cmd to target this install.
+        const pnpmHome = opts.env.PNPM_HOME;
+        if (pnpmHome !== undefined && pnpmHome.length > 0)
+            dirs.push(pnpmHome);
+    }
+    else {
+        const localPrefix = opts.env.npm_config_local_prefix;
+        if (localPrefix !== undefined && localPrefix.length > 0) {
+            dirs.push(...ancestorBinDirs(opts.pkgDir, localPrefix, opts.platform));
+        }
+    }
+    const seen = new Set();
+    const out = [];
+    for (const dir of dirs) {
+        const key = dirKey(dir, opts.platform);
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(dir);
+    }
+    return out;
+}
+function isSafeBinName(name) {
+    if (name.length === 0)
+        return false;
+    if (name.includes("/") || name.includes("\\") || name.includes(".."))
+        return false;
+    return true;
+}
+export function removeGeneratedPs1Shims(opts) {
+    if (opts.platform !== "win32")
+        return { removed: [], failed: [] };
+    const protect = new Set((opts.protectedNames ?? NODE_OWNED_SHIM_NAMES).map((name) => name.toLowerCase()));
+    const removed = [];
+    const failed = [];
+    for (const name of opts.binNames) {
+        if (!isSafeBinName(name) || protect.has(name.toLowerCase()))
+            continue;
+        const ps1 = join(opts.binDir, `${name}.ps1`);
+        const cmd = join(opts.binDir, `${name}.cmd`);
+        if (!existsSync(cmd) || !existsSync(ps1))
+            continue;
+        try {
+            unlinkSync(ps1);
+            removed.push(ps1);
+        }
+        catch {
+            failed.push(ps1);
+        }
+    }
+    return { removed, failed };
+}
+function normalizedWinPath(p) {
+    const norm = win32.normalize(p).replace(/[\\/]+/g, "\\");
+    const trimmed = norm.length > 3 && norm.endsWith("\\") ? norm.slice(0, -1) : norm;
+    return trimmed.toLowerCase();
+}
+function pathIsInside(root, target) {
+    const rootKey = normalizedWinPath(root);
+    const targetKey = normalizedWinPath(target);
+    return targetKey === rootKey || targetKey.startsWith(`${rootKey}\\`);
+}
+/** cmd-shim text is Windows-shaped. realpath needs host separators or a junction never matches. */
+function hostPath(p) {
+    return p.replace(/\\/g, "/");
+}
+function realpathIsInside(root, target) {
+    try {
+        return pathIsInside(realpathSync(hostPath(root)), realpathSync(hostPath(target)));
+    }
+    catch {
+        return false;
+    }
+}
+/** True when cmd-shim text records a target path inside this install. */
+export function cmdShimTargetsPackage(cmdText, binDir, pkgDir) {
+    const re = /%(?:dp0%|~dp0)(?:\\+|\/+)([^"\r\n\s]+)/gi;
+    for (const match of cmdText.matchAll(re)) {
+        const rel = match[1];
+        if (rel === undefined || rel.length === 0)
+            continue;
+        const resolved = win32.normalize(win32.join(binDir, rel.replace(/\//g, "\\")));
+        if (pathIsInside(pkgDir, resolved) || realpathIsInside(pkgDir, resolved))
+            return true;
+    }
+    return false;
+}
+function cmdLinksCurrentInstall(binDir, name, pkgDir) {
+    if (!isSafeBinName(name))
+        return false;
+    let text;
+    try {
+        text = readFileSync(join(binDir, `${name}.cmd`), "utf8");
+    }
+    catch {
+        return false;
+    }
+    return cmdShimTargetsPackage(text, binDir, pkgDir);
+}
+export function readPackageBinNames(packageJsonText) {
+    let parsed;
+    try {
+        parsed = JSON.parse(packageJsonText);
+    }
+    catch {
+        return [];
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return [];
+    const bin = parsed.bin;
+    if (bin === null || typeof bin !== "object" || Array.isArray(bin))
+        return [];
+    return Object.keys(bin);
+}
+export function removeInstalledWindowsPs1Shims(opts) {
+    if (opts.platform !== "win32")
+        return { removed: [], failed: [] };
+    const readText = opts.readText ?? ((path) => readFileSync(path, "utf8"));
+    let names;
+    try {
+        names = readPackageBinNames(readText(join(opts.pkgDir, "package.json")));
+    }
+    catch {
+        names = PACKAGE_BIN_NAMES;
+    }
+    const removed = [];
+    const failed = [];
+    for (const binDir of candidateBinDirs(opts)) {
+        const linked = names.filter((name) => cmdLinksCurrentInstall(binDir, name, opts.pkgDir));
+        const result = removeGeneratedPs1Shims({
+            binDir,
+            binNames: linked,
+            platform: opts.platform,
+        });
+        removed.push(...result.removed);
+        failed.push(...result.failed);
+    }
+    return { removed, failed };
+}
+//# sourceMappingURL=windows-bin-ps1.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.119.8",
+  "version": "0.119.10",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -22,7 +22,8 @@
   },
   "files": [
     "dist/**/*.js",
-    "dist/**/*.d.ts"
+    "dist/**/*.d.ts",
+    "scripts/remove-windows-ps1-shims.mjs"
   ],
   "repository": {
     "type": "git",
@@ -34,10 +35,11 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.119.8",
-    "@deftai/directive-content": "^0.119.8"
+    "@deftai/directive-core": "^0.119.10",
+    "@deftai/directive-content": "^0.119.10"
   },
   "scripts": {
-    "build": "tsc -b"
+    "build": "tsc -b",
+    "postinstall": "node ./scripts/remove-windows-ps1-shims.mjs"
   }
 }

package/scripts/remove-windows-ps1-shims.mjs

@@ -0,0 +1,26 @@
+/**
+ * postinstall entry (#4654). The published tarball includes dist/.
+ * A workspace install before tsc has no linked shims yet, so a missing
+ * dist file is a no-op rather than a failed install.
+ */
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+const entry = join(pkgDir, "dist", "windows-bin-ps1.js");
+
+if (existsSync(entry)) {
+  const mod = await import(pathToFileURL(entry).href);
+  const result = mod.removeInstalledWindowsPs1Shims({
+    pkgDir,
+    env: process.env,
+    platform: process.platform,
+  });
+  if (result.failed.length > 0) {
+    process.stderr.write(
+      `remove-windows-ps1-shims: could not remove ${result.failed.join(", ")}\n`,
+    );
+    process.exitCode = 1;
+  }
+}