@deftai/directive 0.69.0 → 0.70.0

package/dist/policy.js

@@ -4,9 +4,9 @@
  * mirroring scripts/_policy_show_cli.py and scripts/policy_set.py.
  */
 import { existsSync } from "node:fs";
-import { join, resolve as pathResolve } from "node:path";
+import { resolve as pathResolve, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { disclosureLine, inspectAllPolicies, inspectOnePolicy, PROJECT_DEFINITION_REL_PATH, pythonListRepr, pythonStringRepr, registeredPolicyNames, renderJson, renderText, resolvePolicy, setPolicy, } from "@deftai/directive-core/policy";
+import { describeShadowedPlanExtension, detectShadowedPlanExtensions, disclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, projectDefinitionPath, pythonListRepr, pythonStringRepr, registeredPolicyNames, renderJson, renderText, resolvePolicy, setPolicy, } from "@deftai/directive-core/policy";
 const CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- enabling direct commits to the default " +
     "branch turns OFF the deft branch-protection policy.\n" +
     "  \u2022 Pre-commit + pre-push hooks will no longer block default-branch " +
@@ -202,13 +202,30 @@ export function parseArgs(argv) {
     }
     return makeSetError(`unknown subcommand: ${cmd}`);
 }
+/**
+ * Emit a loud warning to stderr for every plan-extension key whose bare block
+ * silently shadows the namespaced form (#2301). Never fails / throws: a missing
+ * or malformed PROJECT-DEFINITION simply yields no warnings.
+ */
+function emitPlanExtensionShadowWarnings(projectRoot) {
+    const [data] = loadProjectDefinition(projectRoot);
+    if (data === null)
+        return;
+    const shadows = detectShadowedPlanExtensions(data.plan);
+    for (const shadow of shadows) {
+        process.stderr.write(`[policy:show] WARNING: ${describeShadowedPlanExtension(shadow)}\n`);
+    }
+}
 function runShow(args) {
     const projectRoot = pathResolve(args.projectRoot);
-    const pdPath = join(projectRoot, PROJECT_DEFINITION_REL_PATH);
+    // Layout-aware (#2302): name the resolved PROJECT-DEFINITION path (xbrief on a
+    // migrated tree, else vbrief) instead of the hardcoded vbrief/ literal.
+    const pdPath = projectDefinitionPath(projectRoot);
     if (!existsSync(pdPath)) {
         process.stderr.write(`[policy:show] PROJECT-DEFINITION not found at ${pdPath}; ` +
             "rendering framework defaults.\n");
     }
+    emitPlanExtensionShadowWarnings(projectRoot);
     if (args.field !== null) {
         const field = inspectOnePolicy(args.field, projectRoot);
         if (field === null) {
@@ -280,7 +297,8 @@ function runSet(args) {
         const message = err instanceof Error ? err.message : String(err);
         if (message.includes("PROJECT-DEFINITION not found")) {
             process.stderr.write(`\u274c ${message}\n`);
-            process.stderr.write("  Recovery: run `task setup` to generate vbrief/PROJECT-DEFINITION.vbrief.json.\n");
+            const pdRel = relative(projectRoot, projectDefinitionPath(projectRoot));
+            process.stderr.write(`  Recovery: run \`task setup\` to generate ${pdRel}.\n`);
             return 2;
         }
         process.stderr.write(`\u274c Config error: ${message}\n`);

package/dist/triage-bulk.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { bulkActionWithDefaults, CacheEmptyError, } from "@deftai/directive-core/dist/triage/bulk/index.js";
 import { interceptHelp } from "@deftai/directive-core/dist/triage/help/index.js";
@@ -125,8 +124,10 @@ export function run(argv) {
         process.stderr.write("triage_bulk: --repo is required\n");
         return 2;
     }
+    // #2279: the bulk path defaults to native TypeScript actions. It no longer
+    // resolves a project/DEFT_ROOT `scripts/` dir, so an attacker-planted
+    // `scripts/triage_actions.py` can never be executed. Pass only projectRoot.
     const projectRoot = process.cwd();
-    const frameworkRoot = resolve(process.env.DEFT_ROOT ?? projectRoot);
     try {
         bulkActionWithDefaults(args.action, args.repo, {
             label: args.label,
@@ -135,8 +136,7 @@ export function run(argv) {
             cluster: args.cluster,
             reason: args.reason,
             reAction: args.reAction,
-            deftRoot: projectRoot,
-            scriptsDir: join(frameworkRoot, "scripts"),
+            projectRoot,
         });
     }
     catch (exc) {

package/dist/triage-welcome.d.ts

@@ -4,6 +4,8 @@ interface ParsedArgs {
     onboard: boolean;
     noHistory: boolean;
     taskPrefix: string;
+    preset: string | null;
+    wipCap: number | null;
     error?: string;
 }
 export declare function parseArgs(argv: string[]): ParsedArgs;

package/dist/triage-welcome.js

@@ -2,13 +2,17 @@
 import { statSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { interceptHelp } from "@deftai/directive-core/dist/triage/help/index.js";
 import { runDefaultMode } from "@deftai/directive-core/dist/triage/welcome/default-mode.js";
+import { runOnboardMode } from "@deftai/directive-core/dist/triage/welcome/onboard.js";
 export function parseArgs(argv) {
     const parsed = {
         projectRoot: process.env.DEFT_PROJECT_ROOT ?? ".",
         onboard: false,
         noHistory: false,
         taskPrefix: process.env.DEFT_TASK_PREFIX ?? "",
+        preset: null,
+        wipCap: null,
     };
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i];
@@ -16,6 +20,36 @@ export function parseArgs(argv) {
             parsed.onboard = true;
         else if (arg === "--no-history")
             parsed.noHistory = true;
+        else if (arg === "--preset") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --preset: expected one argument" };
+            parsed.preset = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--preset=")) {
+            const value = arg.slice("--preset=".length);
+            if (value === "")
+                return { ...parsed, error: "argument --preset: expected one argument" };
+            parsed.preset = value;
+        }
+        else if (arg === "--wip-cap") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --wip-cap: expected one argument" };
+            const parsedCap = Number(value);
+            if (!Number.isInteger(parsedCap))
+                return { ...parsed, error: `argument --wip-cap: expected an integer, got ${value}` };
+            parsed.wipCap = parsedCap;
+            i += 1;
+        }
+        else if (arg?.startsWith("--wip-cap=")) {
+            const value = arg.slice("--wip-cap=".length);
+            const parsedCap = Number(value);
+            if (!Number.isInteger(parsedCap))
+                return { ...parsed, error: `argument --wip-cap: expected an integer, got ${value}` };
+            parsed.wipCap = parsedCap;
+        }
         else if (arg === "--project-root") {
             const value = argv[i + 1];
             if (value === undefined)
@@ -46,6 +80,10 @@ export function parseArgs(argv) {
     return parsed;
 }
 export function run(argv) {
+    const helpRc = interceptHelp("triage_welcome", argv);
+    if (helpRc !== null) {
+        return helpRc;
+    }
     const args = parseArgs(argv);
     if (args.error !== undefined) {
         process.stderr.write(`triage:welcome: ${args.error}\n`);
@@ -63,8 +101,13 @@ export function run(argv) {
         return 2;
     }
     if (args.onboard) {
-        process.stderr.write("triage:welcome: --onboard is not implemented in the TypeScript CLI yet.\n");
-        return 2;
+        const onboardOutcome = runOnboardMode(projectRoot, {
+            preset: args.preset,
+            wipCap: args.wipCap,
+            writeHistory: !args.noHistory,
+            taskPrefix: args.taskPrefix || null,
+        });
+        return onboardOutcome.exitCode;
     }
     const outcome = runDefaultMode(projectRoot, {
         writeHistory: !args.noHistory,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.69.0",
+  "version": "0.70.0",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -31,8 +31,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.69.0",
-    "@deftai/directive-content": "^0.69.0"
+    "@deftai/directive-core": "^0.70.0",
+    "@deftai/directive-content": "^0.70.0"
   },
   "scripts": {
     "build": "tsc -b"