@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/bin/git

@@ -0,0 +1,670 @@
+#!/usr/bin/env bash
+# Managed by adl global-tools.
+#
+# Front controller for ordinary Git.  Only Azure DevOps HTTPS network commands
+# cross the Agent Vault boundary; all other Git behavior belongs to the real
+# system or Homebrew Git executable and is delegated without modification.
+#
+# KNOWN GAP, not this script's to close (second independent review,
+# 2026-09-29): git's OWN children -- `git bisect run <cmd>`, `git difftool -x
+# <cmd>`, `GIT_EXTERNAL_DIFF`/`GIT_DIFF_OPT`-invoked helpers, `git
+# for-each-repo --config=... <command>` -- resolve `git` for THEMSELVES via
+# `$GIT_EXEC_PATH`/`git --exec-path`'s libexec/git-core directory (or PATH,
+# for a plain sub-invocation), which is not guaranteed to put THIS controller
+# first the way the user's own shell PATH does. A child spawned that way can
+# reach the real system/Homebrew git directly, bypassing this controller and
+# its Azure DevOps routing entirely. Closing that is a credential-helper-level
+# decision (e.g. relocating the real git's own libexec/git-core, or a
+# `core.gitProxy`-style hook) that belongs to Tarun, not a fix inside this
+# routing script.
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+self_path="$script_dir/$(basename -- "${BASH_SOURCE[0]}")"
+
+# Resolves every symlink in a candidate's path -- both the directory
+# component (a plain `cd -P` already handles that) and, unlike a plain
+# `cd -P`, the final path component itself if IT is a symlink (e.g. a `git`
+# entry that is itself a symlink into another directory). Needed so a
+# Homebrew shim reached only through such a symlink (a `git` alias sitting
+# outside `Library/Homebrew/shims/` that points into it) still resolves to
+# its real location, not the alias's own directory.
+resolve_symlink_target() {
+  local target="$1" dir
+  while [[ -L "$target" ]]; do
+    dir="$(cd -- "$(dirname -- "$target")" && pwd -P)"
+    target="$(readlink -- "$target")"
+    [[ "$target" == /* ]] || target="$dir/$target"
+  done
+  dir="$(cd -- "$(dirname -- "$target")" && pwd -P)"
+  printf '%s/%s\n' "$dir" "$(basename -- "$target")"
+}
+
+# Homebrew's own shims (`Library/Homebrew/shims/{shared,scm,super}/git`) walk
+# PATH the same way this controller does and exec the first non-system git
+# they find -- which, inside `brew`, is this controller again. Left
+# unfiltered, the two exec each other forever (plans/GAPS-AND-FINDINGS.md
+# 2026-09-29). Skip any candidate that resolves into a Homebrew shims
+# directory so a real, non-shim git is chosen instead.
+is_homebrew_shim() {
+  [[ "$(resolve_symlink_target "$1")" == */Library/Homebrew/shims/* ]]
+}
+
+resolve_real_git() {
+  local path_entry candidate candidate_dir
+  local old_ifs="$IFS"
+  IFS=:
+  for path_entry in $PATH; do
+    [[ -n "$path_entry" ]] || path_entry=.
+    candidate="$path_entry/git"
+    [[ -x "$candidate" ]] || continue
+    candidate_dir="$(cd -- "$(dirname -- "$candidate")" && pwd -P)"
+    candidate="$candidate_dir/$(basename -- "$candidate")"
+    [[ "$candidate" == "$self_path" ]] && continue
+    [[ "$candidate" -ef "$self_path" ]] && continue
+    is_homebrew_shim "$candidate" && continue
+    IFS="$old_ifs"
+    printf '%s\n' "$candidate"
+    return
+  done
+  IFS="$old_ifs"
+
+  for candidate in /opt/homebrew/bin/git /home/linuxbrew/.linuxbrew/bin/git /usr/bin/git /bin/git; do
+    [[ -x "$candidate" ]] || continue
+    [[ "$candidate" -ef "$self_path" ]] && continue
+    is_homebrew_shim "$candidate" && continue
+    printf '%s\n' "$candidate"
+    return
+  done
+  echo 'git: cannot locate a real Git executable outside /usr/local/bin/git' >&2
+  exit 1
+}
+
+real_git="$(resolve_real_git)"
+args=("$@")
+command_index=-1
+index=0
+while (( index < ${#args[@]} )); do
+  argument="${args[index]}"
+  case "$argument" in
+    --)
+      ((index += 1))
+      break
+      ;;
+    -C|-c|--config-env|--exec-path|--git-dir|--work-tree|--namespace|--super-prefix)
+      ((index += 2))
+      ;;
+    -C*|--config-env=*|--exec-path=*|--git-dir=*|--work-tree=*|--namespace=*|--super-prefix=*)
+      ((index += 1))
+      ;;
+    -*)
+      ((index += 1))
+      ;;
+    *)
+      command_index=$index
+      break
+      ;;
+  esac
+done
+
+# THIRD independent review (2026-09-29), item 4: `"${args[@]}"` when `args`
+# has ZERO elements (a bare `git` with no arguments at all) is the classic
+# old-bash "unbound variable" trap under `set -u` -- /bin/bash 3.2, macOS's
+# own default, treats an empty array's `${arr[@]}` expansion as unset for
+# this purpose. `${args[@]+"${args[@]}"}` is the portable idiom (Bash FAQ
+# E13): it expands to nothing at all when `args` is unset/empty, instead of
+# erroring, and is otherwise identical to `"${args[@]}"`.
+(( command_index >= 0 )) || exec "$real_git" ${args[@]+"${args[@]}"}
+command_name="${args[command_index]}"
+
+# L1 worktree guard (STATUS.md item 2, docs/operations/worktree-guard.md): refuse
+# `git worktree add` when the repository already has 3 checkouts, including
+# the main folder. Runs BEFORE the network-command routing below because it
+# applies to every command line, not only Azure DevOps ones, and to humans
+# as well as agents (docs/operations/worktree-guard.md L1 is the one layer that covers
+# every surface, every cwd). Any other `git worktree ...` subcommand (list,
+# remove, prune, repair, move, lock, unlock, ...) falls straight through
+# unchanged, same as every other git command.
+if [[ "$command_name" == "worktree" ]]; then
+  worktree_sub=''
+  for ((wi = command_index + 1; wi < ${#args[@]}; wi += 1)); do
+    case "${args[wi]}" in
+      -*) ;;
+      *) worktree_sub="${args[wi]}"; break ;;
+    esac
+  done
+  if [[ "$worktree_sub" == "add" ]]; then
+    if ! porcelain="$("$real_git" "${args[@]:0:command_index}" worktree list --porcelain 2>&1)"; then
+      printf 'worktree limit: could not determine the current worktree count (`git worktree list --porcelain` failed: %s). Failing closed.\n' "$porcelain" >&2
+      exit 1
+    fi
+
+    # First, cheap pass: just count `worktree <path>` header lines. Kept
+    # separate from the detailed per-row pass below (branch/clean/merged),
+    # which spawns extra `git status`/`merge-base` per worktree and is only
+    # worth paying for once the count is actually over the cap.
+    worktree_count=0
+    while IFS= read -r line; do
+      case "$line" in
+        worktree\ *) worktree_count=$((worktree_count + 1)) ;;
+      esac
+    done <<<"$porcelain"
+
+    if (( worktree_count >= 3 )); then
+      wt_path=''
+      wt_branch=''
+      wt_head=''
+      rows=()
+
+      flush_worktree_row() {
+        [[ -n "$wt_path" ]] || return 0
+        local branch_label clean status_out merged ancestor_status
+        branch_label="${wt_branch:-detached}"
+        if status_out="$("$real_git" -C "$wt_path" status --porcelain 2>/dev/null)"; then
+          if [[ -z "$status_out" ]]; then clean='clean'; else clean='dirty'; fi
+        else
+          clean='unknown'
+        fi
+        merged='unknown'
+        if [[ -n "$wt_head" ]] && "$real_git" -C "$wt_path" rev-parse --verify -q refs/remotes/origin/integration >/dev/null 2>&1; then
+          ancestor_status=0
+          "$real_git" -C "$wt_path" merge-base --is-ancestor "$wt_head" refs/remotes/origin/integration 2>/dev/null || ancestor_status=$?
+          if (( ancestor_status == 0 )); then merged='yes'
+          elif (( ancestor_status == 1 )); then merged='no'
+          fi
+        fi
+        rows+=("  ${wt_path}  branch=${branch_label}  ${clean}  merged-into-origin/integration=${merged}")
+        wt_path=''
+        wt_branch=''
+        wt_head=''
+        return 0
+      }
+
+      while IFS= read -r line; do
+        case "$line" in
+          '') flush_worktree_row ;;
+          worktree\ *) flush_worktree_row; wt_path="${line#worktree }" ;;
+          HEAD\ *) wt_head="${line#HEAD }" ;;
+          branch\ *) wt_branch="${line#branch }"; wt_branch="${wt_branch#refs/heads/}" ;;
+          detached) wt_branch='' ;;
+        esac
+      done <<<"$porcelain"
+      flush_worktree_row
+
+      {
+        printf 'worktree limit: only a maximum of 3 worktrees per repo is allowed (including the main folder). Reconcile old worktrees first:\n'
+        for row in "${rows[@]}"; do printf '%s\n' "$row"; done
+        printf 'Remove one with: git worktree remove <path>\n'
+      } >&2
+      exit 1
+    fi
+  fi
+fi
+
+# Second independent review (2026-09-29): widened to match the hook's own
+# `isAdoUrl` (packages/agent-hooks/src/rules/impl/git-helpers.ts) -- which
+# already treats `*.visualstudio.com` and any host casing as Azure DevOps
+# too -- so the hook and this controller's own routing cannot disagree about
+# what counts as an Azure DevOps remote. Deliberately duplicated in
+# bin/git-ado (no shared bash include exists to source from; same reasoning
+# as the Homebrew-shim skip). `tr` rather than bash 4's `${var,,}`: the
+# default `/bin/bash` on macOS is 3.2, which does not have it.
+#
+# KNOWN LIMITATION, inherited unchanged from before this widening: this is a
+# substring-style glob, not a true host-anchored parse, so a URL whose PATH
+# (not host) happens to contain "dev.azure.com/" or ".visualstudio.com/"
+# would also match (e.g. `https://evil.test/dev.azure.com/x`). Narrowing
+# that would need an actual URL parse, which no caller here has asked for;
+# tracked as a known gap, not fixed in this pass.
+is_ado_url() {
+  local lower
+  lower="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+  case "$lower" in
+    https://*dev.azure.com|https://*dev.azure.com/*) return 0 ;;
+    https://*.visualstudio.com|https://*.visualstudio.com/*) return 0 ;;
+    https://visualstudio.com|https://visualstudio.com/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# True for git's "SCP-like" syntax, `[user@]host.xz:path/to/repo.git` (see
+# `git help clone`, TRANSPORTS) -- used for a `.gitmodules` URL classifier
+# below. Requires a `:` with no `/` before it and no `://` anywhere (an
+# absolute URL with a scheme is handled by its own case arm first); this is
+# git's own heuristic for telling `host:path` apart from a local path that
+# happens to contain a colon after a slash.
+is_scp_like_url() {
+  case "$1" in
+    *://*) return 1 ;;
+  esac
+  case "${1%%:*}" in
+    */*) return 1 ;;
+    "$1") return 1 ;; # no ':' at all
+    *) return 0 ;;
+  esac
+}
+
+# THIRD independent review (2026-09-29): the full set of top-level command
+# NAMES this controller can ever route to git-ado, byte-for-byte identical
+# to bin/git-ado's OWN copy (which used to have a narrower list --
+# `fetch|pull|clone|ls-remote|push` only -- so every OTHER verb THIS
+# controller routes reached git-ado's fallback and ran the real git
+# directly, BEFORE any identity or human-marker check: confirmed live with
+# GIT_TRACE=1). Not wired into this script's OWN control flow -- the case
+# arms above and below already express, per verb, exactly when a given
+# invocation actually routes (e.g. `remote add` never does, even though
+# `remote` is in this list) -- this exists as the canonical anchor a
+# contract test in packages/fleet/tests/git-ado-vault-boundary.test.ts
+# extracts and compares against bin/git-ado's copy, so the two cannot drift
+# apart silently again.
+is_network_command_name() {
+  case "$1" in
+    clone|push|fetch|pull|ls-remote|remote|maintenance|submodule|archive|remote-https|remote-http|remote-ftp|remote-ftps|http-fetch|http-push|lfs) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Prints remote NAME's configured URL (from the cwd/`-C` the caller already
+# gave, via the leading options this file already sliced off at
+# `args[0:command_index]`), or fails silently -- callers decide what
+# "unknown remote" means for their own command.
+remote_url_for() {
+  "$real_git" "${args[@]:0:command_index}" remote get-url "$1" 2>/dev/null
+}
+
+# The first configured remote that resolves to an Azure DevOps HTTPS URL, or
+# fails if none does. Used by commands that touch every configured remote
+# (`remote update`, `maintenance run --task=prefetch`) rather than one named
+# remote: git-ado's credential header is scoped to the HOST
+# (`http.https://dev.azure.com/.extraHeader`), not to a remote NAME, so
+# routing the whole command through git-ado with ANY one Azure DevOps remote
+# URL is correct regardless of which specific remote(s) the command actually
+# touches (F2, plans/GAPS-AND-FINDINGS.md: over-inclusive is safe here,
+# under-inclusive -- silently reaching the real credential helper -- is not).
+first_ado_remote_url() {
+  local name url
+  while IFS= read -r name; do
+    [[ -n "$name" ]] || continue
+    url="$(remote_url_for "$name")" || continue
+    if is_ado_url "$url"; then
+      printf '%s\n' "$url"
+      return 0
+    fi
+  done < <("$real_git" "${args[@]:0:command_index}" remote 2>/dev/null)
+  return 1
+}
+
+# Never returns. `repo` is git-ado's own `repo` argument -- an https:// URL
+# means "run the ORIGINAL args unchanged, with a credential header for that
+# URL's host"; git-ado never inspects it beyond that (see bin/git-ado's own
+# header comment), so any Azure DevOps URL is an equally valid sentinel when
+# the caller has no single canonical one to hand (submodules, below).
+route_through_git_ado() {
+  local repo="$1"
+  git_ado="$script_dir/git-ado"
+  [[ -x "$git_ado" ]] || git_ado="$(command -v git-ado || :)"
+  [[ -n "$git_ado" && -x "$git_ado" ]] || {
+    echo 'git: managed git-ado is unavailable; reconcile the global-tools manifest first' >&2
+    exit 1
+  }
+  exec "$git_ado" "$repo" ${args[@]+"${args[@]}"}
+}
+
+# F2 (independent review, 2026-09-29): the plain clone/push/fetch/pull/
+# ls-remote list below only ever covered the commands whose network verb IS
+# the command name. Several other commands are network-capable in SOME of
+# their invocation shapes, against whichever remote(s) they touch -- routed
+# here BEFORE the plain list, each on its own narrower rule.
+#
+# CORRECTION (second independent review, 2026-09-29): a command shape NOT
+# named in this case, or named here but whose own rule decides it is not
+# network-capable in THIS invocation, falls through to the plain list below
+# and, if not clone/push/fetch/pull/ls-remote either, runs the REAL git
+# directly (line ~615's `exec "$real_git" "${args[@]}"`) -- it does NOT
+# reach git-ado's fail-closed refusal at all, because it never reaches
+# git-ado in the first place. The previous wording here claimed the
+# opposite; corrected to state what the code actually does. Anything this
+# scanner does not recognize as network-capable is a genuine gap (see
+# plans/GAPS-AND-FINDINGS.md), not a fail-closed refusal.
+case "$command_name" in
+  remote)
+    remote_sub=''
+    remote_sub_index=-1
+    for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+      case "${args[index]}" in
+        -*) ;;
+        *)
+          remote_sub="${args[index]}"
+          remote_sub_index=$index
+          break
+          ;;
+      esac
+    done
+    case "$remote_sub" in
+      show)
+        # `git remote show` with no name lists remotes without touching the
+        # network; an explicit name (without `-n`) contacts that remote.
+        # Second independent review (2026-09-29): `git remote show a b`
+        # previously routed on the LAST name only, so an ADO remote listed
+        # first (and a non-ADO one listed last) went unrouted -- now, same
+        # as `prune`, ANY named remote being ADO routes the whole command,
+        # regardless of position.
+        show_n=0
+        show_found_ado=''
+        for ((index = remote_sub_index + 1; index < ${#args[@]}; index += 1)); do
+          case "${args[index]}" in
+            -n) show_n=1 ;;
+            -*) ;;
+            *)
+              if [[ -z "$show_found_ado" ]]; then
+                url="$(remote_url_for "${args[index]}")" && is_ado_url "$url" && show_found_ado="$url"
+              fi
+              ;;
+          esac
+        done
+        [[ "$show_n" == 0 && -n "$show_found_ado" ]] && route_through_git_ado "$show_found_ado"
+        ;;
+      prune)
+        # One or more explicit remote names, each always contacted.
+        for ((index = remote_sub_index + 1; index < ${#args[@]}; index += 1)); do
+          case "${args[index]}" in
+            -*) ;;
+            *)
+              url="$(remote_url_for "${args[index]}")" && is_ado_url "$url" && route_through_git_ado "$url"
+              ;;
+          esac
+        done
+        ;;
+      set-head)
+        # Only `-a` (auto) contacts the remote; a delete or an explicit
+        # branch name never does.
+        auto=0
+        head_name=''
+        for ((index = remote_sub_index + 1; index < ${#args[@]}; index += 1)); do
+          case "${args[index]}" in
+            -a) auto=1 ;;
+            -*) ;;
+            *) [[ -n "$head_name" ]] || head_name="${args[index]}" ;;
+          esac
+        done
+        if [[ "$auto" == 1 && -n "$head_name" ]]; then
+          url="$(remote_url_for "$head_name")" && is_ado_url "$url" && route_through_git_ado "$url"
+        fi
+        ;;
+      update)
+        # No cheap way to know exactly which remotes/groups an argument-less
+        # or group-named `update` will touch without reading `remotes.<group>`
+        # config -- so any configured Azure DevOps remote routes the WHOLE
+        # invocation through git-ado (over-inclusive, never a silent pass).
+        url="$(first_ado_remote_url)" && route_through_git_ado "$url"
+        ;;
+    esac
+    ;;
+  maintenance)
+    maint_sub=''
+    maint_sub_index=-1
+    for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+      case "${args[index]}" in
+        -*) ;;
+        *)
+          maint_sub="${args[index]}"
+          maint_sub_index=$index
+          break
+          ;;
+      esac
+    done
+    if [[ "$maint_sub" == "run" ]]; then
+      maint_has_task=0
+      maint_task_is_prefetch=0
+      for ((index = maint_sub_index + 1; index < ${#args[@]}; index += 1)); do
+        case "${args[index]}" in
+          --task=prefetch)
+            maint_has_task=1
+            maint_task_is_prefetch=1
+            ;;
+          --task=*) maint_has_task=1 ;;
+          --task)
+            maint_has_task=1
+            ((index += 1))
+            [[ "${args[index]:-}" == "prefetch" ]] && maint_task_is_prefetch=1
+            ;;
+        esac
+      done
+      # REGRESSION FIX (second independent review, 2026-09-29): `git help
+      # maintenance` is explicit that a bare `run` with no `--task` is NOT
+      # "whatever the schedule says" -- "Otherwise, the tasks are determined
+      # by which maintenance.<task>.enabled config options are true. By
+      # default, only maintenance.gc.enabled is true." A bare `run` (the
+      # shape a human, a GUI, or the git-maintain LaunchAgent's own
+      # background gc actually calls) therefore almost never touches the
+      # network at all -- routing it unconditionally, as this used to,
+      # refused every one of those local-only callers once git-ado went
+      # fail-closed. The one real question is whether `maintenance.prefetch.
+      # enabled` is true (set by `register`/`start`, or by hand) -- that is
+      # the ONLY config `run` with no `--task` actually consults to decide
+      # whether prefetch (the one network task) runs, so it is the one
+      # cheap check made here.
+      if [[ "$maint_has_task" == 0 ]]; then
+        # The `if COMMAND; then` form matters under `set -e`: a plain
+        # `var=$(cmd)` assignment as its OWN statement is NOT exempt from
+        # errexit, and `git config --bool` on a missing key (the common
+        # case -- this config is unset by default) exits 1, which would
+        # otherwise kill this whole script.
+        if prefetch_enabled="$("$real_git" "${args[@]:0:command_index}" config --bool maintenance.prefetch.enabled 2>/dev/null)" && [[ "$prefetch_enabled" == "true" ]]; then
+          maint_task_is_prefetch=1
+        fi
+      fi
+      if [[ "$maint_task_is_prefetch" == 1 ]]; then
+        url="$(first_ado_remote_url)" && route_through_git_ado "$url"
+      fi
+    fi
+    ;;
+  submodule)
+    sub_sub=''
+    for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+      case "${args[index]}" in
+        -*) ;;
+        *) sub_sub="${args[index]}"; break ;;
+      esac
+    done
+    if [[ "$sub_sub" == "update" ]]; then
+      sub_no_fetch=0
+      for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+        [[ "${args[index]}" == "--no-fetch" ]] && sub_no_fetch=1
+      done
+      if [[ "$sub_no_fetch" == 0 ]]; then
+        # REGRESSION FIX (second independent review, 2026-09-29): `.gitmodules`
+        # lives at the SUPERPROJECT'S TOP LEVEL, not necessarily the caller's
+        # cwd -- reading `./.gitmodules` (or `-C <path>/.gitmodules`, still
+        # relative to that ONE `-C`) found nothing, and silently fell through
+        # to an unrouted real-git call, when invoked from a subdirectory (or
+        # a nested `-C`). `rev-parse --show-toplevel` resolves this the same
+        # way `submodule update` itself does, honoring the FULL leading
+        # option slice (every `-C`/`-c`/etc, in order), not just the last
+        # `-C`.
+        sub_toplevel="$("$real_git" "${args[@]:0:command_index}" rev-parse --show-toplevel 2>/dev/null)" || sub_toplevel=''
+        if [[ -n "$sub_toplevel" ]]; then
+          gitmodules="$sub_toplevel/.gitmodules"
+        else
+          gitmodules=''
+        fi
+        if [[ -f "$gitmodules" ]]; then
+          sub_ado=0
+          sub_relative=0
+          while IFS= read -r sub_line; do
+            sub_value="${sub_line#* }"
+            case "$sub_value" in
+              https://*)
+                is_ado_url "$sub_value" && sub_ado=1
+                ;;
+              [a-zA-Z][a-zA-Z0-9+.-]*://*)
+                # An absolute URL with some OTHER scheme (ssh://, git://,
+                # ftp(s)://, ...) -- git-ado is https-only, so this is
+                # definitely not Azure DevOps' concern, regardless of host.
+                ;;
+              /*)
+                # An absolute LOCAL filesystem path -- never Azure DevOps.
+                ;;
+              *)
+                # REGRESSION FIX: an SCP-like URL (`git@github.com:org/x.git`)
+                # is NEITHER a scheme URL nor relative -- it was falling into
+                # the ambiguous/fail-closed branch and refusing every
+                # submodule update in a superproject that had one, which is
+                # the common case for github/self-hosted submodules. git-ado
+                # only ever handles https, so an scp-like URL is never its
+                # concern either, no matter the host.
+                if ! is_scp_like_url "$sub_value"; then
+                  sub_relative=1
+                fi
+                ;;
+            esac
+          done < <("$real_git" config -f "$gitmodules" --get-regexp '\.url$' 2>/dev/null)
+          if [[ "$sub_relative" == 1 ]]; then
+            # A genuinely relative submodule URL (`../x.git`, `./x`) resolves
+            # against the SUPERPROJECT's own origin -- cheap to check
+            # (`git config remote.origin.url`), and authoritative: git's own
+            # relative-submodule-URL resolution keeps the same scheme+host as
+            # origin, only rewriting the path, so if origin is not Azure
+            # DevOps, nothing relative to it can be either. Only an
+            # unresolvable origin (none configured at all) is truly
+            # ambiguous -- fail closed rather than guess, exactly as before.
+            if sub_origin_url="$("$real_git" "${args[@]:0:command_index}" config --get remote.origin.url 2>/dev/null)"; then
+              is_ado_url "$sub_origin_url" && sub_ado=1
+            else
+              printf 'git: submodule update: at least one submodule URL in %s is relative and the superproject has no configured "origin" remote to resolve it against; refusing (fail closed). Configure "origin", or run the submodule fetch through git-ado directly.\n' "$gitmodules" >&2
+              exit 1
+            fi
+          fi
+          [[ "$sub_ado" == 1 ]] && route_through_git_ado 'https://dev.azure.com/'
+        fi
+      fi
+    fi
+    ;;
+  archive)
+    archive_remote=''
+    for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+      case "${args[index]}" in
+        --remote=*) archive_remote="${args[index]#--remote=}" ;;
+        --remote)
+          ((index += 1))
+          archive_remote="${args[index]:-}"
+          ;;
+      esac
+    done
+    if [[ -n "$archive_remote" ]]; then
+      if [[ "$archive_remote" == https://* ]]; then
+        is_ado_url "$archive_remote" && route_through_git_ado "$archive_remote"
+      else
+        url="$(remote_url_for "$archive_remote")" && is_ado_url "$url" && route_through_git_ado "$url"
+      fi
+    fi
+    ;;
+  remote-https|remote-http|remote-ftp|remote-ftps|http-fetch|http-push)
+    # Raw transport-helper plumbing: each takes a URL positionally, exactly
+    # like clone/ls-remote already do below -- the same direct-URL scan.
+    for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+      is_ado_url "${args[index]}" && route_through_git_ado "${args[index]}"
+    done
+    ;;
+  lfs)
+    # GAP (second independent review, 2026-09-29), fix REVISED (third
+    # independent review, 2026-09-29, item 3): `git lfs push|pull|fetch`
+    # against an Azure DevOps remote used to reach the real `git-lfs`
+    # binary (a SEPARATE executable git dispatches to via PATH, never
+    # through THIS controller's own real_git exec) with no identity at all.
+    # The FIRST fix refused this outright here in bin/git -- but that also
+    # refused it in Tarun's OWN marked human terminal, a regression: his
+    # real credential helper has always handled `git lfs` fine, and the
+    # human path never involved git-ado's unverified header mechanism in
+    # the first place. Routing through git-ado instead lets IT apply the
+    # SAME policy it applies to every other verb: human (TTY+marker) passes
+    # through unchanged (unaffected by any of this); the agent identity
+    # path refuses with a clear message (git-lfs's own HTTP credential
+    # resolution has not been verified to honor git-ado's
+    # `http.<url>.extraHeader` mechanism); no identity and no human marker
+    # refuses, exactly as for every other verb.
+    lfs_sub=''
+    lfs_sub_index=-1
+    for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+      case "${args[index]}" in
+        -*) ;;
+        *) lfs_sub="${args[index]}"; lfs_sub_index=$index; break ;;
+      esac
+    done
+    case "$lfs_sub" in
+      push|pull|fetch)
+        lfs_remote_url=''
+        for ((index = lfs_sub_index + 1; index < ${#args[@]}; index += 1)); do
+          if is_ado_url "${args[index]}"; then
+            lfs_remote_url="${args[index]}"
+            break
+          fi
+        done
+        if [[ -z "$lfs_remote_url" ]]; then
+          lfs_remote_name='origin'
+          for ((index = lfs_sub_index + 1; index < ${#args[@]}; index += 1)); do
+            case "${args[index]}" in
+              -*) ;;
+              *) lfs_remote_name="${args[index]}"; break ;;
+            esac
+          done
+          lfs_remote_url="$(remote_url_for "$lfs_remote_name")" || lfs_remote_url=''
+        fi
+        is_ado_url "$lfs_remote_url" && route_through_git_ado "$lfs_remote_url"
+        ;;
+    esac
+    ;;
+esac
+
+case "$command_name" in
+  clone|push|fetch|pull|ls-remote) ;;
+  *) exec "$real_git" ${args[@]+"${args[@]}"} ;;
+esac
+
+remote_url=''
+remote_name='origin'
+
+# A direct URL is authoritative for every network command.  Scan it before
+# resolving a remote name so clone, ls-remote, and explicit fetch/push/pull URLs never
+# depend on a checkout or its origin configuration.
+for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+  if is_ado_url "${args[index]}"; then
+    remote_url="${args[index]}"
+    break
+  fi
+done
+
+if [[ -z "$remote_url" ]]; then
+  # The first positional argument to fetch, pull, push, and ls-remote is the selected
+  # remote.  Skip the common options that carry a following value; unknown
+  # options are skipped rather than treated as a remote name.
+  for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
+    argument="${args[index]}"
+    case "$argument" in
+      --)
+        ((index += 1))
+        ((index < ${#args[@]})) && remote_name="${args[index]}"
+        break
+        ;;
+      -c|-j|-o|-u|--depth|--deepen|--filter|--jobs|--negotiation-tip|--push-option|--receive-pack|--refmap|--recurse-submodules|--server-option|--shallow-exclude|--shallow-since|--strategy|--strategy-option|--upload-pack)
+        ((index += 1))
+        ;;
+      -?*|--*=*)
+        ;;
+      *)
+        remote_name="$argument"
+        break
+        ;;
+    esac
+  done
+fi
+
+if [[ -z "$remote_url" ]]; then
+  if ! remote_url="$("$real_git" "${args[@]:0:command_index}" remote get-url "$remote_name" 2>/dev/null)"; then
+    exec "$real_git" ${args[@]+"${args[@]}"}
+  fi
+fi
+
+is_ado_url "$remote_url" || exec "$real_git" ${args[@]+"${args[@]}"}
+
+route_through_git_ado "$remote_url"