javi-forge 1.30.1 → 1.32.0

package/assets/claude-hooks/manifest.json

@@ -1 +1 @@
-{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc","historical":[]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":null}}
+{"schemaVersion":1,"asset":{"name":"javi-forge-skillguard-pre-tool-use.mjs","version":1,"policyVersion":1,"sha256":"78be7e6613c012280b7ad17886462ba166b63ebd031e34565d757b3a0796d7cc","historical":[]},"settingsEntries":{"current":{"version":1,"canonicalSha256":"038c59a91bf8967f6908afed74c465f1e7030254e11e4f8738975d6d708424d4"},"historical":[]},"installerHelpers":{"windowsSecureObject":{"name":"javi-forge-windows-secure-object.ps1","sha256":"2289ef6ac6b039ec74dc3ea0894413e243ff9bea963f04008a356b3838f9b8dd"}}}

package/dist/cli/dispatch/hooks.d.ts

@@ -4,8 +4,11 @@
  * (`./commands/hooks.js`) is lazy-imported inside the handler to keep cold-start
  * minimal, because hooks are on the commit/push hot path.
  *
- * Only subcommand: `hooks run <pre-commit|pre-push>` → dispatches to runHook and
- * exits with its code. Any other subcommand or a missing name → usage + exit 1.
+ * Subcommands:
+ *   - `hooks run <pre-commit|pre-push>` → runHook, exits with its code.
+ *   - `hooks <install|doctor|repair> claude [--force]` → runClaudeHookCommand,
+ *     exits with its code (wrong/missing target → usage + exit 1).
+ * Any other subcommand or a missing name → usage + exit 1.
  */
 import type { CLI } from "./types.js";
 export declare function handleHooks(cli: CLI): Promise<void>;

package/dist/cli/dispatch/hooks.js

@@ -4,8 +4,11 @@
  * (`./commands/hooks.js`) is lazy-imported inside the handler to keep cold-start
  * minimal, because hooks are on the commit/push hot path.
  *
- * Only subcommand: `hooks run <pre-commit|pre-push>` → dispatches to runHook and
- * exits with its code. Any other subcommand or a missing name → usage + exit 1.
+ * Subcommands:
+ *   - `hooks run <pre-commit|pre-push>` → runHook, exits with its code.
+ *   - `hooks <install|doctor|repair> claude [--force]` → runClaudeHookCommand,
+ *     exits with its code (wrong/missing target → usage + exit 1).
+ * Any other subcommand or a missing name → usage + exit 1.
  */
 import { HOOKS_HELP_TEXT } from "../help.js";
 export async function handleHooks(cli) {
@@ -23,6 +26,17 @@ export async function handleHooks(cli) {
         const code = await runHook(name, process.cwd());
         process.exit(code);
     }
+    const sub = cli.input[1];
+    if (sub === "install" || sub === "doctor" || sub === "repair") {
+        if (cli.input[2] !== "claude") {
+            console.error(`Usage: javi-forge hooks ${sub} claude`);
+            process.exit(1);
+        }
+        const { runClaudeHookCommand } = await import("../../commands/claude-hooks.js");
+        process.exit(await runClaudeHookCommand(sub, process.cwd(), {
+            force: cli.flags.force === true,
+        }));
+    }
     // No subcommand → show usage (exit 0). An unknown subcommand is a typo →
     // show usage but exit 1 rather than run nothing silently.
     console.log(HOOKS_HELP_TEXT);

package/dist/cli/help.d.ts

@@ -19,7 +19,7 @@ export declare const CI_HELP_TEXT = "\n  Usage\n    $ javi-forge ci [subcommand]
  * Per-command help for `hooks`, shown by `javi-forge hooks --help` (or when
  * `hooks` is given an unknown subcommand). Whitespace is significant.
  */
-export declare const HOOKS_HELP_TEXT = "\n  Usage\n    $ javi-forge hooks run <pre-commit|pre-push>\n\n    Run the sections enabled under hooks: in .javi-forge/ci.yaml, in a fixed\n    cheap\u2192expensive order, fail-fast. With no hooks: config the default is the\n    quick native CI gate (setup + lint + compile + gates \u2014 no tests, no coverage).\n\n  Subcommands\n    run pre-commit  Run the composed pre-commit sections\n    run pre-push    Run the composed pre-push sections\n\n  Notes\n    A blocking section failure exits non-zero and blocks the commit/push.\n    A broken .javi-forge/ci.yaml exits 1 (fail-closed \u2014 never skips a gate).\n    To skip: git commit --no-verify   (pre-push: git push --no-verify)\n\n  Examples\n    $ javi-forge hooks run pre-commit\n    $ javi-forge hooks run pre-push\n";
+export declare const HOOKS_HELP_TEXT = "\n  Usage\n    $ javi-forge hooks run <pre-commit|pre-push>\n    $ javi-forge hooks <install|doctor|repair> claude [--force]\n\n    Run the sections enabled under hooks: in .javi-forge/ci.yaml, in a fixed\n    cheap\u2192expensive order, fail-fast. With no hooks: config the default is the\n    quick native CI gate (setup + lint + compile + gates \u2014 no tests, no coverage).\n\n  Subcommands\n    run pre-commit    Run the composed pre-commit sections\n    run pre-push      Run the composed pre-push sections\n    install claude    Install the managed Claude PreToolUse guard (.claude/)\n    doctor claude     Report Claude PreToolUse guard health (informational)\n    repair claude     Repair the managed guard; --force overwrites edited assets\n\n  Notes\n    A blocking section failure exits non-zero and blocks the commit/push.\n    A broken .javi-forge/ci.yaml exits 1 (fail-closed \u2014 never skips a gate).\n    To skip: git commit --no-verify   (pre-push: git push --no-verify)\n    doctor claude is informational (always exits 0); install/repair exit 0 on\n    success, non-zero on refusal/failure. Use repair claude --force to overwrite\n    a locally edited managed asset.\n\n  Examples\n    $ javi-forge hooks run pre-commit\n    $ javi-forge hooks run pre-push\n    $ javi-forge hooks install claude\n    $ javi-forge hooks doctor claude\n    $ javi-forge hooks repair claude --force\n";
 export declare const FLAGS_SCHEMA: {
     readonly help: {
         readonly type: "boolean";

package/dist/cli/help.js

@@ -166,23 +166,33 @@ export const CI_HELP_TEXT = `
 export const HOOKS_HELP_TEXT = `
   Usage
     $ javi-forge hooks run <pre-commit|pre-push>
+    $ javi-forge hooks <install|doctor|repair> claude [--force]
 
     Run the sections enabled under hooks: in .javi-forge/ci.yaml, in a fixed
     cheap→expensive order, fail-fast. With no hooks: config the default is the
     quick native CI gate (setup + lint + compile + gates — no tests, no coverage).
 
   Subcommands
-    run pre-commit  Run the composed pre-commit sections
-    run pre-push    Run the composed pre-push sections
+    run pre-commit    Run the composed pre-commit sections
+    run pre-push      Run the composed pre-push sections
+    install claude    Install the managed Claude PreToolUse guard (.claude/)
+    doctor claude     Report Claude PreToolUse guard health (informational)
+    repair claude     Repair the managed guard; --force overwrites edited assets
 
   Notes
     A blocking section failure exits non-zero and blocks the commit/push.
     A broken .javi-forge/ci.yaml exits 1 (fail-closed — never skips a gate).
     To skip: git commit --no-verify   (pre-push: git push --no-verify)
+    doctor claude is informational (always exits 0); install/repair exit 0 on
+    success, non-zero on refusal/failure. Use repair claude --force to overwrite
+    a locally edited managed asset.
 
   Examples
     $ javi-forge hooks run pre-commit
     $ javi-forge hooks run pre-push
+    $ javi-forge hooks install claude
+    $ javi-forge hooks doctor claude
+    $ javi-forge hooks repair claude --force
 `;
 export const FLAGS_SCHEMA = {
     // `--help` is handled manually (autoHelp is disabled at the entrypoint so

package/dist/commands/claude-hooks.d.ts

@@ -0,0 +1,32 @@
+/**
+ * `javi-forge hooks <install|doctor|repair> claude` — console-only renderer for
+ * the already-tested Claude PreToolUse guard library (Slice 4a). It wires the
+ * three lib fns to human output + exit codes; it adds NO new security logic and
+ * never touches `runTransaction`/secure-fs directly.
+ *
+ * Honest-execution constraint (spec Requirement "…never fabricates execution
+ * status"): the doctor renderer reports effective execution as `inconclusive`
+ * only. It MUST NOT print, imply, or default to `RUNNABLE` — real host-probing
+ * is Slice 4b. Exit 2 (INCONCLUSIVE gate semantics) is likewise reserved for 4b
+ * and never emitted here.
+ */
+import { doctorClaudePreToolUse, installClaudePreToolUse, repairClaudePreToolUse } from "../lib/claude-hook-manager.js";
+export type ClaudeHookSub = "install" | "doctor" | "repair";
+/** Injectable seams for tests; each defaults to the real implementation. */
+export interface ClaudeHookCmdDeps {
+    install?: typeof installClaudePreToolUse;
+    doctor?: typeof doctorClaudePreToolUse;
+    repair?: typeof repairClaudePreToolUse;
+    log?: (msg: string) => void;
+    logError?: (msg: string) => void;
+}
+/**
+ * Run one Claude-hook subcommand against `projectDir`. Returns the process exit
+ * code (the dispatcher calls `process.exit`, not this fn):
+ *   - install/repair: 0 when `ok`, 1 on refusal/failure.
+ *   - doctor: always 0 (informational).
+ */
+export declare function runClaudeHookCommand(sub: ClaudeHookSub, projectDir: string, opts: {
+    force?: boolean;
+}, deps?: ClaudeHookCmdDeps): Promise<number>;
+//# sourceMappingURL=claude-hooks.d.ts.map

package/dist/commands/claude-hooks.js

@@ -0,0 +1,75 @@
+/**
+ * `javi-forge hooks <install|doctor|repair> claude` — console-only renderer for
+ * the already-tested Claude PreToolUse guard library (Slice 4a). It wires the
+ * three lib fns to human output + exit codes; it adds NO new security logic and
+ * never touches `runTransaction`/secure-fs directly.
+ *
+ * Honest-execution constraint (spec Requirement "…never fabricates execution
+ * status"): the doctor renderer reports effective execution as `inconclusive`
+ * only. It MUST NOT print, imply, or default to `RUNNABLE` — real host-probing
+ * is Slice 4b. Exit 2 (INCONCLUSIVE gate semantics) is likewise reserved for 4b
+ * and never emitted here.
+ */
+import { doctorClaudePreToolUse, installClaudePreToolUse, repairClaudePreToolUse, } from "../lib/claude-hook-manager.js";
+function renderMutation(verb, result, log, logError) {
+    if (result.ok) {
+        log(`${verb} claude: ok`);
+        if (result.changed.length > 0) {
+            log("changed:");
+            for (const p of result.changed)
+                log(`  ${p}`);
+        }
+        else {
+            log("changed: nothing (already up to date)");
+        }
+        if (result.backups.length > 0) {
+            log("backups:");
+            for (const p of result.backups)
+                log(`  ${p}`);
+        }
+        return 0;
+    }
+    logError(`${verb} claude: refused`);
+    for (const e of result.errors)
+        logError(`  ${e}`);
+    return 1;
+}
+function renderDoctor(report, log) {
+    log(`doctor claude: ${report.healthy ? "healthy" : "unhealthy"}`);
+    log(`  settings: ${report.settings.state} — ${report.settings.detail}`);
+    log(`  asset:    ${report.asset.state} — ${report.asset.detail}`);
+    log(`  node:     ${report.node.version ?? "unavailable"} (min-satisfied: ${report.node.satisfiesMinimum})`);
+    // Honest stub: 4a cannot confirm the guard is live. Never RUNNABLE.
+    log("  execution: inconclusive (effective-execution probe deferred to 4b)");
+    log(`  host-residual: ${report.hostResidual}`);
+    if (report.remediation.length > 0) {
+        log("  remediation:");
+        for (const r of report.remediation)
+            log(`    - ${r}`);
+    }
+    // Doctor is informational, not a gate — always exit 0 (spec Scenario
+    // "Doctor reports component health").
+    return 0;
+}
+/**
+ * Run one Claude-hook subcommand against `projectDir`. Returns the process exit
+ * code (the dispatcher calls `process.exit`, not this fn):
+ *   - install/repair: 0 when `ok`, 1 on refusal/failure.
+ *   - doctor: always 0 (informational).
+ */
+export async function runClaudeHookCommand(sub, projectDir, opts, deps = {}) {
+    const log = deps.log ?? ((m) => console.log(m));
+    const logError = deps.logError ?? ((m) => console.error(m));
+    const install = deps.install ?? installClaudePreToolUse;
+    const doctor = deps.doctor ?? doctorClaudePreToolUse;
+    const repair = deps.repair ?? repairClaudePreToolUse;
+    if (sub === "install") {
+        return renderMutation("install", await install(projectDir), log, logError);
+    }
+    if (sub === "repair") {
+        const result = await repair(projectDir, { force: opts.force === true });
+        return renderMutation("repair", result, log, logError);
+    }
+    return renderDoctor(await doctor(projectDir), log);
+}
+//# sourceMappingURL=claude-hooks.js.map

package/dist/commands/init/steps/security.d.ts

@@ -1,11 +1,15 @@
 import type { StepFn } from "../types.js";
 /**
- * Step 14: Scaffold security hooks (hook-consolidation S4 fold).
+ * Step 14: Scaffold security hooks (hook-consolidation S4 fold + SkillGuard 4a).
  *
  * - When options.securityHooks is false, reports "skipped".
  * - Otherwise:
- *   1. Copies the kiteguard-style runtime settings to `.claude/settings.json`
- *      when absent (KEPT — this is a real feature).
+ *   1. When `claudePreToolUseGuard` is set, installs the managed Claude
+ *      PreToolUse guard via the transactional `installClaudePreToolUse`
+ *      (SkillGuard Slice 4a). The legacy copy-if-absent
+ *      `claude-settings-security.json` scaffold is RETIRED — the managed
+ *      installer owns `.claude/settings.json` + the hook asset with proper
+ *      ownership markers.
  *   2. Merges the `hooks:` security sections for the selected reliability
  *      profile into `.javi-forge/ci.yaml` via `setHookFeature` (creating a
  *      minimal `version: 2` config when absent). The dispatcher composes these

package/dist/commands/init/steps/security.js

@@ -1,8 +1,5 @@
-import path from "node:path";
-import fs from "fs-extra";
-import { SECURITY_HOOKS_DIR } from "../../../constants.js";
 import { setHookFeature } from "../../../lib/ci-config.js";
-import { ensureDirExists } from "../../../lib/common.js";
+import { installClaudePreToolUse } from "../../../lib/claude-hook-manager.js";
 import { report } from "../report.js";
 /**
  * Hook-feature preset per reliability profile (hook-consolidation S4).
@@ -21,12 +18,16 @@ const PROFILE_PRESET = {
     strict: { preCommit: ["secrets", "permissions"], prePush: ["deps"] },
 };
 /**
- * Step 14: Scaffold security hooks (hook-consolidation S4 fold).
+ * Step 14: Scaffold security hooks (hook-consolidation S4 fold + SkillGuard 4a).
  *
  * - When options.securityHooks is false, reports "skipped".
  * - Otherwise:
- *   1. Copies the kiteguard-style runtime settings to `.claude/settings.json`
- *      when absent (KEPT — this is a real feature).
+ *   1. When `claudePreToolUseGuard` is set, installs the managed Claude
+ *      PreToolUse guard via the transactional `installClaudePreToolUse`
+ *      (SkillGuard Slice 4a). The legacy copy-if-absent
+ *      `claude-settings-security.json` scaffold is RETIRED — the managed
+ *      installer owns `.claude/settings.json` + the hook asset with proper
+ *      ownership markers.
  *   2. Merges the `hooks:` security sections for the selected reliability
  *      profile into `.javi-forge/ci.yaml` via `setHookFeature` (creating a
  *      minimal `version: 2` config when absent). The dispatcher composes these
@@ -37,7 +38,7 @@ const PROFILE_PRESET = {
  */
 export const stepSecurityHooks = async (ctx) => {
     const { projectDir, dryRun, onStep, options } = ctx;
-    const { securityHooks, hookProfile } = options;
+    const { securityHooks, hookProfile, claudePreToolUseGuard } = options;
     const stepId = "security-hooks";
     report(onStep, stepId, "Scaffold security hooks", "running");
     try {
@@ -48,18 +49,22 @@ export const stepSecurityHooks = async (ctx) => {
         const profile = hookProfile ?? "standard";
         const preset = PROFILE_PRESET[profile];
         if (dryRun) {
-            report(onStep, stepId, "Scaffold security hooks", "done", `dry-run: would merge ${profile} hooks preset + copy .claude/settings.json`);
+            const guardNote = claudePreToolUseGuard
+                ? " + install Claude PreToolUse guard"
+                : "";
+            report(onStep, stepId, "Scaffold security hooks", "done", `dry-run: would merge ${profile} hooks preset${guardNote}`);
             return;
         }
-        // 1. Copy the kiteguard-style runtime security settings to .claude/.
-        const settingsSrc = path.join(SECURITY_HOOKS_DIR, "claude-settings-security.json");
-        if (await fs.pathExists(settingsSrc)) {
-            const claudeDir = path.join(projectDir, ".claude");
-            await ensureDirExists(claudeDir);
-            const settingsDest = path.join(claudeDir, "settings.json");
-            if (!(await fs.pathExists(settingsDest))) {
-                await fs.copy(settingsSrc, settingsDest);
+        // 1. Install the managed Claude PreToolUse guard (transactional; owns
+        //    .claude/settings.json + the hook asset). Retires the legacy copy.
+        let guardNote = "";
+        if (claudePreToolUseGuard) {
+            const result = await installClaudePreToolUse(projectDir);
+            if (!result.ok) {
+                report(onStep, stepId, "Scaffold security hooks", "error", `Claude guard install refused: ${result.errors.join("; ")}`);
+                return;
             }
+            guardNote = "; Claude guard installed";
         }
         // 2. Merge the profile's security sections into .javi-forge/ci.yaml.
         for (const feature of preset.preCommit) {
@@ -72,9 +77,10 @@ export const stepSecurityHooks = async (ctx) => {
             ...preset.preCommit.map((f) => `pre-commit.${f}`),
             ...preset.prePush.map((f) => `pre-push.${f}`),
         ];
-        report(onStep, stepId, "Scaffold security hooks", "done", merged.length > 0
+        const presetNote = merged.length > 0
             ? `${profile} preset: ${merged.join(", ")}`
-            : `${profile} preset: CI gate only (no security sections)`);
+            : `${profile} preset: CI gate only (no security sections)`;
+        report(onStep, stepId, "Scaffold security hooks", "done", `${presetNote}${guardNote}`);
     }
     catch (e) {
         report(onStep, stepId, "Scaffold security hooks", "error", String(e));

package/dist/lib/__fixtures__/fake-helper-transport.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Host-independent fake `HelperTransport` for the win32 `PlatformSecureFs`
+ * adapter tests. It returns canned framed responses per op so every adapter
+ * branch — request build, response parse, refusal mapping, opaque identity,
+ * notFound discrimination, directory-attribute assertion, and
+ * transport-error → fail-closed — is exercisable on Linux with NO real Windows
+ * host and NO PowerShell. The `.ps1` (Phase 3) computes Predicate A/B verdicts;
+ * this fake stands in for those already-decided verdicts.
+ */
+import type { HelperOp, HelperRequest, HelperResponse, HelperTransport } from "../secure-fs-windows.js";
+/** A responder decides the framed response for a single request of an op. */
+export type FakeResponder = (req: HelperRequest) => HelperResponse;
+export interface FakeHelperTransport extends HelperTransport {
+    /** Every request the adapter sent, in order (for request-build assertions). */
+    readonly requests: HelperRequest[];
+    /** True once close() ran. */
+    readonly closed: boolean;
+    /** Register the canned responder for an op (last registration wins). */
+    on(op: HelperOp, responder: FakeResponder): void;
+    /** Make the NEXT request reject with a transport error (session death). */
+    failNext(error: Error): void;
+}
+/** Build a programmable fake transport with no default behavior. */
+export declare function makeFakeHelperTransport(): FakeHelperTransport;
+/** A void-success verdict (proveOwner/proveDacl/proveContainer/write/etc. ok). */
+export declare const okVoid: () => HelperResponse;
+/** A win32 DACL refusal (Predicate A/B verdict from the .ps1). */
+export declare const daclRefuse: (detail: string) => HelperResponse;
+/** Named Predicate-A refuse postures (ground-truth + design fixtures). */
+export declare const foreignWrite: () => HelperResponse;
+export declare const deleteChild: () => HelperResponse;
+export declare const genericWrite: () => HelperResponse;
+export declare const genericAll: () => HelperResponse;
+export declare const nullDacl: () => HelperResponse;
+export declare const foreignOwner: () => HelperResponse;
+/** proveContainer-only add-child refusal (CREATE_PARENT_DIR). */
+export declare const addChild: () => HelperResponse;
+/** A successful openDir/createDir value carrying handle, identity, attributes. */
+export declare const openOk: (handleId: string, opaque: string, attributes: number) => HelperResponse;
+/** A genuine not-found openDir failure (ENOENT / ERROR_FILE/PATH_NOT_FOUND). */
+export declare const openNotFound: (status: number) => HelperResponse;
+/** A present-but-unopenable openDir failure (reparse/EACCES/transient). */
+export declare const openUnopenable: (detail: string, status?: number) => HelperResponse;
+/** A successful capture value; bytes are base64 in the JSON body. */
+export declare const captureOk: (bytes: Buffer, opaque: string) => HelperResponse;
+//# sourceMappingURL=fake-helper-transport.d.ts.map

package/dist/lib/__fixtures__/fake-helper-transport.js

@@ -0,0 +1,90 @@
+/**
+ * Host-independent fake `HelperTransport` for the win32 `PlatformSecureFs`
+ * adapter tests. It returns canned framed responses per op so every adapter
+ * branch — request build, response parse, refusal mapping, opaque identity,
+ * notFound discrimination, directory-attribute assertion, and
+ * transport-error → fail-closed — is exercisable on Linux with NO real Windows
+ * host and NO PowerShell. The `.ps1` (Phase 3) computes Predicate A/B verdicts;
+ * this fake stands in for those already-decided verdicts.
+ */
+/** Build a programmable fake transport with no default behavior. */
+export function makeFakeHelperTransport() {
+    const requests = [];
+    const responders = new Map();
+    let closed = false;
+    let pendingError = null;
+    const fake = {
+        get requests() {
+            return requests;
+        },
+        get closed() {
+            return closed;
+        },
+        on(op, responder) {
+            responders.set(op, responder);
+        },
+        failNext(error) {
+            pendingError = error;
+        },
+        async request(req) {
+            requests.push(req);
+            if (pendingError) {
+                const err = pendingError;
+                pendingError = null;
+                throw err;
+            }
+            const responder = responders.get(req.op);
+            if (!responder) {
+                throw new Error(`fake transport: no responder for op ${req.op}`);
+            }
+            return responder(req);
+        },
+        async close() {
+            closed = true;
+        },
+    };
+    return fake;
+}
+// --- canned response builders (the .ps1 verdicts, pre-decided) --------------
+/** A void-success verdict (proveOwner/proveDacl/proveContainer/write/etc. ok). */
+export const okVoid = () => ({ ok: true });
+/** A win32 DACL refusal (Predicate A/B verdict from the .ps1). */
+export const daclRefuse = (detail) => ({
+    ok: false,
+    refusal: "unsafe-windows-dacl",
+    detail,
+});
+/** Named Predicate-A refuse postures (ground-truth + design fixtures). */
+export const foreignWrite = () => daclRefuse("foreign trustee S-1-5-11 path-endangering");
+export const deleteChild = () => daclRefuse("foreign trustee S-1-1-0 path-endangering");
+export const genericWrite = () => daclRefuse("foreign trustee S-1-1-0 path-endangering");
+export const genericAll = () => daclRefuse("foreign trustee S-1-1-0 path-endangering");
+export const nullDacl = () => daclRefuse("null DACL");
+export const foreignOwner = () => daclRefuse("foreign owner S-1-5-21-1-2-3-1001");
+/** proveContainer-only add-child refusal (CREATE_PARENT_DIR). */
+export const addChild = () => daclRefuse("foreign trustee S-1-1-0 add-child");
+/** A successful openDir/createDir value carrying handle, identity, attributes. */
+export const openOk = (handleId, opaque, attributes) => ({
+    ok: true,
+    value: { handleId, opaque, attributes },
+});
+/** A genuine not-found openDir failure (ENOENT / ERROR_FILE/PATH_NOT_FOUND). */
+export const openNotFound = (status) => ({
+    ok: false,
+    refusal: "unsafe-parent-chain",
+    detail: "not found",
+    status,
+});
+/** A present-but-unopenable openDir failure (reparse/EACCES/transient). */
+export const openUnopenable = (detail, status = 5) => ({
+    ok: false,
+    refusal: "unsafe-parent-chain",
+    detail,
+    status,
+});
+/** A successful capture value; bytes are base64 in the JSON body. */
+export const captureOk = (bytes, opaque) => ({
+    ok: true,
+    value: { bytes: bytes.toString("base64"), opaque },
+});
+//# sourceMappingURL=fake-helper-transport.js.map

package/dist/lib/__fixtures__/fake-secure-fs.d.ts

@@ -27,6 +27,18 @@ export interface FakeFaults {
     writeRefuse?: (name: string, callIndex: number) => boolean;
     /** Refuse renameInDir when the destination base name matches. */
     renameRefuse?: (to: string) => boolean;
+    /**
+     * Refuse proveManagedContainer for a path on its Nth call (a foreign
+     * add/delete-child ACE on a managed container we own — the win32 CREATE_PARENT_DIR
+     * strictness that the lenient ancestor gate deliberately tolerates).
+     */
+    managedContainerRefuse?: (dirPath: string, callIndex: number) => boolean;
+    /**
+     * Make openDirNoFollow return a PRESENT-BUT-UNOPENABLE refusal (a reparse
+     * point/junction, EACCES, ENOTDIR, or transient) — a refusal with `notFound`
+     * absent, so ensureManagedContainer must fail closed, never skip (JDA6-001).
+     */
+    openDirUnopenable?: (dirPath: string) => boolean;
 }
 export interface FakeSecureFs extends PlatformSecureFs {
     readonly dirs: Set<string>;

package/dist/lib/__fixtures__/fake-secure-fs.js

@@ -15,6 +15,13 @@ const unsafe = (detail) => ({
     refusal: "unsafe-parent-chain",
     detail,
 });
+/** A GENUINE not-found refusal (the only state ensureManagedContainer may skip/create on). */
+const notFound = (detail) => ({
+    ok: false,
+    refusal: "unsafe-parent-chain",
+    detail,
+    notFound: true,
+});
 export function makeFakeSecureFs() {
     const dirs = new Set();
     const files = new Map();
@@ -25,6 +32,7 @@ export function makeFakeSecureFs() {
     const ownershipCounts = new Map();
     const aclCounts = new Map();
     const writeCounts = new Map();
+    const managedCounts = new Map();
     const inoFor = (p) => {
         let ino = inos.get(p);
         if (ino === undefined) {
@@ -76,8 +84,12 @@ export function makeFakeSecureFs() {
             return false;
         },
         async openDirNoFollow(dirPath) {
+            if (fake.faults.openDirUnopenable?.(dirPath)) {
+                // PRESENT-but-unopenable-no-follow: refusal WITHOUT notFound.
+                return unsafe(`openDir unopenable ${dirPath}`);
+            }
             if (!dirs.has(dirPath))
-                return unsafe(`openDir enoent ${dirPath}`);
+                return notFound(`openDir enoent ${dirPath}`);
             return okValue(handleFor(dirPath));
         },
         async revalidateIdentity(target, held) {
@@ -177,6 +189,19 @@ export function makeFakeSecureFs() {
             dirs.delete(handle.path);
             return ok();
         },
+        async proveManagedContainer(dirPath) {
+            const idx = bump(managedCounts, dirPath);
+            if (fake.faults.managedContainerRefuse?.(dirPath, idx)) {
+                return {
+                    ok: false,
+                    refusal: "unsafe-windows-dacl",
+                    detail: `add-child ${dirPath}`,
+                };
+            }
+            if (!dirs.has(dirPath))
+                return unsafe(`container enoent ${dirPath}`);
+            return ok();
+        },
     };
     return fake;
 }

package/dist/lib/secure-fs-posix.d.ts

@@ -28,10 +28,19 @@ export declare function createLinuxAclAdapter(spawn?: SpawnFn): PosixAclAdapter;
 export declare function createMacosAclAdapter(spawn?: SpawnFn): PosixAclAdapter;
 export declare function createPosixSecureFs(acl: PosixAclAdapter): PlatformSecureFs;
 /**
- * Select the POSIX secure filesystem for the host platform. Linux uses the
- * `getfacl` adapter, macOS uses `/bin/ls -lde`; Windows and every other platform
- * return `null` so the manager refuses with `windows-secure-object-unavailable`
- * and mutates nothing (Slice 3b implements Windows).
+ * Select the secure filesystem for the host platform. Linux uses the `getfacl`
+ * adapter, macOS uses `/bin/ls -lde`, and win32 uses the digest-bound PowerShell
+ * helper over a lazily-spawned session (Slice 3b). Every other platform returns
+ * `null` so the manager refuses with `windows-secure-object-unavailable` and
+ * mutates nothing.
+ *
+ * The win32 branch is host-independent to CONSTRUCT: `createPs1Session` spawns
+ * nothing until the first request, and it verifies the on-disk `.ps1` sha256
+ * against the manifest binding before spawning. If the binding is absent or the
+ * digest mismatches, the transport refuses every op (`refusingTransport`), so
+ * the adapter fails closed exactly like the pre-3b `null` did — but a real,
+ * matching helper now drives Windows installs. The `.ps1`'s runtime behavior is
+ * validated by the `windows-latest` CI job (Phase 5), never on the dev box.
  */
 export declare function selectSecureFs(platform?: NodeJS.Platform): PlatformSecureFs | null;
 //# sourceMappingURL=secure-fs-posix.d.ts.map

package/dist/lib/secure-fs-posix.js

@@ -12,6 +12,7 @@ import { createHash } from "node:crypto";
 import { constants as FS } from "node:fs";
 import { chmod, lstat, mkdir, open, rename, rmdir, unlink, } from "node:fs/promises";
 import path from "node:path";
+import { createPs1Session, createWindowsSecureFs, } from "./secure-fs-windows.js";
 /** Bounded time budget for a single ACL inspection. */
 const ACL_TIMEOUT_MS = 2000;
 /** Read budget for the ACL tool output (defensive; ACLs are tiny). */
@@ -142,7 +143,14 @@ export function createPosixSecureFs(acl) {
                 }
             }
             catch (error) {
-                return refuse("unsafe-parent-chain", `openDir ${dirPath}: ${errCode(error) ?? "error"}`);
+                const code = errCode(error);
+                const result = refuse("unsafe-parent-chain", `openDir ${dirPath}: ${code ?? "error"}`);
+                // Genuine not-found ONLY on ENOENT (Round-6 / JDA6-001). Every other
+                // errno — ELOOP/reparse, EACCES, ENOTDIR, transient — leaves notFound
+                // absent so a present-but-unopenable managed container fails closed.
+                if (code === "ENOENT")
+                    result.notFound = true;
+                return result;
             }
         },
         async revalidateIdentity(target, held) {
@@ -286,20 +294,40 @@ export function createPosixSecureFs(acl) {
                 return refuse("unsafe-parent-chain", `rmdir ${handle.path}: ${errCode(error) ?? "error"}`);
             }
         },
+        // On POSIX, permission to ADD a child to a directory IS the directory's
+        // write bit; proveOwnershipAndMode already refuses any group/other write
+        // (stats.mode & 0o022). So the managed-container check is definitionally the
+        // same predicate gate() just ran on this path — idempotent, no new refusal
+        // surface. The seam has teeth only on win32, where Predicate A tolerates
+        // add-child on high ancestors (Round-4 / JDA-401).
+        proveManagedContainer(dirPath) {
+            return secureFs.proveOwnershipAndMode(dirPath);
+        },
     };
     return secureFs;
 }
 /**
- * Select the POSIX secure filesystem for the host platform. Linux uses the
- * `getfacl` adapter, macOS uses `/bin/ls -lde`; Windows and every other platform
- * return `null` so the manager refuses with `windows-secure-object-unavailable`
- * and mutates nothing (Slice 3b implements Windows).
+ * Select the secure filesystem for the host platform. Linux uses the `getfacl`
+ * adapter, macOS uses `/bin/ls -lde`, and win32 uses the digest-bound PowerShell
+ * helper over a lazily-spawned session (Slice 3b). Every other platform returns
+ * `null` so the manager refuses with `windows-secure-object-unavailable` and
+ * mutates nothing.
+ *
+ * The win32 branch is host-independent to CONSTRUCT: `createPs1Session` spawns
+ * nothing until the first request, and it verifies the on-disk `.ps1` sha256
+ * against the manifest binding before spawning. If the binding is absent or the
+ * digest mismatches, the transport refuses every op (`refusingTransport`), so
+ * the adapter fails closed exactly like the pre-3b `null` did — but a real,
+ * matching helper now drives Windows installs. The `.ps1`'s runtime behavior is
+ * validated by the `windows-latest` CI job (Phase 5), never on the dev box.
  */
 export function selectSecureFs(platform = process.platform) {
     if (platform === "linux")
         return createPosixSecureFs(createLinuxAclAdapter());
     if (platform === "darwin")
         return createPosixSecureFs(createMacosAclAdapter());
+    if (platform === "win32")
+        return createWindowsSecureFs(createPs1Session());
     return null;
 }
 //# sourceMappingURL=secure-fs-posix.js.map