@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/rules/impl/agent-tamper-protection.ts

@@ -0,0 +1,508 @@
+/**
+ * Editing the files that wire the host's hooks or un-manage this repo.
+ *
+ * Handoff 5, rule 5: deny Write/Edit/MultiEdit/NotebookEdit on
+ * `.claude/settings.json`, `.claude/settings.local.json`,
+ * `.codex/config.toml`, or `adl-config.toml`. These are the files that
+ * either install the hook into the host (`.claude/settings.json`,
+ * `.codex/config.toml`, including the `.local.json` overrides) or arm the
+ * gate in this repo (`adl-config.toml`'s `[hooks] enabled = false`
+ * silently no-ops every kind — see `main.ts`'s `runHook`). Editing any
+ * of them is a way to switch the gate off without anyone noticing.
+ *
+ * Decision 13 (STATUS.md 12p, 2026-09-29): the managed-
+ * hooks lock is off, so these per-repo carrier files are now the ONLY
+ * enforcement layer for the hosts that read them — three more joined the
+ * set for exactly that reason: `.codex/hooks.json`, `.cursor/hooks.json`,
+ * and `.opencode/plugins/adl-repo.ts` (the generated OpenCode plugin IS
+ * its own carrier; there is no separate settings file for that host).
+ * Measured against the real engine before this fix: Write
+ * `.codex/hooks.json` / Edit `.cursor/hooks.json` / Write
+ * `.opencode/plugins/adl-repo.ts` all had `blocked: false`, while the
+ * original four's own control case (`.claude/settings.json`) already had
+ * `blocked: true`.
+ *
+ * The list is hard-coded here on purpose. `adl-config.toml`'s own
+ * `[hooks] enabled` already lets a repo switch the whole hook system
+ * off; allowing `[rules."agent.tamper-protection"] enabled = false` in
+ * the same file is the same switch wearing a different hat. A repo that
+ * legitimately needs a different allowlist should patch this file in a
+ * PR, not in a session.
+ *
+ * The file names match against the FULL path and against the basename so
+ * `Write .claude/settings.json` AND `Write /Users/x/repo/.claude/settings.json`
+ * both fire, but `Write .claude/SETTINGS.json.bak` does NOT (the
+ * case-sensitive suffix check rejects it).
+ *
+ * Shell-write coverage (STATUS.md 12p, decision 13 follow-up, 2026-09-29):
+ * the tool-call gate above never saw a shell command at all — `echo x >
+ * .cursor/hooks.json`, `tee`, `mv`/`cp`/`install`/`ln -sf`, `sed -i`/
+ * `perl -pi`, `truncate`, `trash`/`rm`/`unlink`/`shred`, and `dd of=` were
+ * every one of them `{blocked: false}` against all seven protected files,
+ * measured directly against the real engine before this fix. Closed via
+ * three additional match() branches:
+ *  - `inv.kind === 'protected-carrier-write'` — the generic-command half
+ *    (redirection/tee/mv/cp/install/ln/sed/perl/truncate/trash/rm/unlink/
+ *    shred/dd), classified by `shell/protected-carrier-writes.ts` and wired
+ *    into `shell/invocation.ts`'s `walk()` exactly like `git-internals-write`
+ *    — which is what makes nested `bash -c`/`sh -c` covered for free (that
+ *    detection runs on every walked piece, top-level or nested).
+ *  - `inv.kind === 'git'` with subcommand `rm`, or `checkout`/`restore`/
+ *    `reset` with a protected path after `--` — `git rm`/`checkout --`/etc.
+ *    on one of these files IS already blocked today by generic, target-
+ *    independent rules (`git.rm` bans every `git rm`; `git.checkout-dashdash`
+ *    bans every `git checkout --`), but neither is protecting THESE files
+ *    specifically and neither would survive being disabled on its own —
+ *    this rule (AGENT_RULES, evaluated before GIT_RULES — see registry.ts)
+ *    now claims the protected-path case with its own message before either
+ *    generic rule gets a turn.
+ *  - A coarse textual check on `ctx.command` (the same pattern as
+ *    `adl.human-azdo-bypass`'s `os.environ`/`process.env` detection) for an
+ *    interpreter one-liner writing a protected path — `python3 -c
+ *    "open('.codex/hooks.json','w')..."`, `node -e
+ *    "fs.writeFileSync('.cursor/hooks.json', ...)"`. Not a parser: a
+ *    write-shaped call plus a protected path's text anywhere in the command
+ *    is enough to deny, same tradeoff `adl.human-azdo-bypass` already makes.
+ *
+ * A write whose target is a dynamic command substitution
+ * (`$(git rev-parse --show-toplevel)/…`) is not this rule's to classify at
+ * all — `shell/invocation.ts`'s existing, target-agnostic
+ * `unresolvableRedirectionWriteTargets`/`unresolvableOperandWriteTargets`
+ * checks already fail closed on ANY dynamic write target via
+ * `parse.uncertain`, protected carrier or not.
+ */
+import type { Token } from '../shell/token.ts'
+import { tokenValue } from '../shell/token.ts'
+import type { Invocation } from '../shell/invocation.ts'
+import { PROTECTED_CARRIER_PATHS, protectedCarrierDirMatch, protectedCarrierMatch } from '../shell/protected-carriers.ts'
+import { mcpToolName } from './mcp-tool.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+
+/** The tool name a host actually sends, past an `mcp__<server>__` prefix (e.g. `mcp__lean_ctx__ctx_patch` → `ctx_patch`) — unprefixed names (Claude/Codex/Kimi/Cursor/OpenCode's own tool names) pass through unchanged. */
+function logicalToolName(tool: string): string {
+  if (!tool.startsWith('mcp__')) return tool
+  return mcpToolName(tool) ?? tool
+}
+
+/**
+ * Tools whose `input.file_path` / `input.notebook_path` / `input.path` /
+ * `input.filePath` decides what the edit targets — matched case-insensitively
+ * (F4, independent review, 2026-09-29): OpenCode's own plugin
+ * (`.opencode/plugins/adl-repo.ts`'s `tool.execute.before`) sends its OWN
+ * lowercase tool names (`edit`, `write`), not Claude/Codex/Kimi's
+ * capitalized ones, and its `tool_input` (`output.args`) carries the target
+ * as camelCase `filePath`, not `file_path`.
+ */
+/**
+ * P2 (independent review, 2026-09-29): widened beyond Claude/Codex/Kimi's
+ * own capitalized names — one normalized (lowercase) list covering every
+ * edit-tool spelling a supported host actually sends:
+ *  - `strreplace`/`str_replace_editor`/`edit_file`/`str_replace`/
+ *    `replace_in_file`/`create_file`/`write_file` — Cursor's own matcher
+ *    regex names every one of these (`deploy-profile.json`'s
+ *    `surfaces[].matchers` entry for cursor, line ~33) as an alias its
+ *    generated carrier maps onto `Write`; this rule reads the SAME source
+ *    list rather than a second, hand-copied one.
+ *  - `delete` — Cursor's own delete-file tool.
+ *  - `writefile`/`strreplacefile` — Kimi's own tool names (`WriteFile`/
+ *    `StrReplaceFile`), lower-cased same as every other host's.
+ *  - `ctx_patch`/`ctx_edit` — the lean-ctx MCP server's own edit tools
+ *    (`mcp__lean_ctx__ctx_patch`/`ctx_edit`); their target field is `path`,
+ *    already read below alongside `file_path`/`notebook_path`/`filePath`.
+ * `apply_patch` stays a SEPARATE branch (its own patch-header parsing, not
+ * a `file_path`-shaped field) — see `applyPatchTarget`.
+ */
+const EDIT_TOOL_NAMES = new Set([
+  'write',
+  'edit',
+  'multiedit',
+  'notebookedit',
+  'patch',
+  'strreplace',
+  'str_replace_editor',
+  'edit_file',
+  'str_replace',
+  'replace_in_file',
+  'create_file',
+  'write_file',
+  'delete',
+  'writefile',
+  'strreplacefile',
+  'ctx_patch',
+  'ctx_edit',
+])
+
+function readStringField(input: Readonly<Record<string, unknown>>, key: string): string {
+  const value = input[key]
+  return typeof value === 'string' ? value : ''
+}
+
+/**
+ * Codex's `apply_patch` (F4): its patch body lives in `input.command`
+ * (`handler.ts`'s `toDecideInput` special-cases this tool to a `tool-call`
+ * precisely so it reaches here instead of being walked as shell text), and
+ * the path it targets is named in a `*** Add File:`/`*** Update File:`/
+ * `*** Delete File:`/`*** Move to:` header — never a `file_path`-shaped
+ * field. Coarse (no real patch parser): any one of those headers naming a
+ * protected path is enough to deny.
+ */
+const PATCH_HEADER_RE = /^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm
+
+function applyPatchTarget(patchBody: string): string | null {
+  for (const match of patchBody.matchAll(PATCH_HEADER_RE)) {
+    const path = (match[1] ?? '').trim()
+    if (protectedCarrierMatch(path) !== null) return path
+  }
+  return null
+}
+
+function toolCallTarget(inv: Invocation & { kind: 'tool-call' }): string | null {
+  const name = logicalToolName(inv.tool).toLowerCase()
+  // apply_patch / OpenCode's own `patch` tool: the patch body is
+  // `input.command` (Codex) or `input.patchText` (OpenCode's own field
+  // name for the same shape, P2) — never a `file_path`-shaped field.
+  if (name === 'apply_patch' || name === 'patch') {
+    const body = readStringField(inv.input, 'command') + readStringField(inv.input, 'patchText')
+    if (body.length > 0) return applyPatchTarget(body)
+  }
+  if (!EDIT_TOOL_NAMES.has(name)) return null
+  // F8 (fourth independent review, 2026-09-29): Cursor's real `edit_file`
+  // schema names its path argument `target_file` (confirmed via Cursor's
+  // own published tool schema/system-prompt documentation).
+  const filePath =
+    readStringField(inv.input, 'file_path') + readStringField(inv.input, 'notebook_path') + readStringField(inv.input, 'filePath') + readStringField(inv.input, 'target_file')
+  const path = readStringField(inv.input, 'path')
+  for (const candidate of [filePath, path]) {
+    if (candidate.length === 0) continue
+    if (protectedCarrierMatch(candidate) !== null) return candidate
+  }
+  return null
+}
+
+/** The path operands after a `--` in `rest` (git's own pathspec separator). */
+function pathsAfterDashDash(rest: readonly Token[]): readonly string[] {
+  const index = rest.findIndex((token) => tokenValue(token) === '--')
+  return index < 0 ? [] : rest.slice(index + 1).map(tokenValue)
+}
+
+/** The non-option operands (`--` itself excluded) — used for the no-`--` positional path forms below. */
+function nonOptionValues(rest: readonly Token[]): readonly string[] {
+  return rest.map(tokenValue).filter((value) => value !== '--' && (!value.startsWith('-') || value === '-'))
+}
+
+/**
+ * `git checkout` ALWAYS restores the WORKTREE for a named path — there is no
+ * staged-only variant (that is `git restore --staged`'s job) — so every
+ * shape is checked: `git checkout -- <path>` and, P1 (second independent
+ * review, 2026-09-29), the equally real `git checkout <rev> <path>` form
+ * with no `--` at all (>= 2 non-option operands; the LAST one is the path).
+ */
+function checkoutTarget(rest: readonly Token[]): string | null {
+  const afterDashDash = pathsAfterDashDash(rest)
+  if (afterDashDash.length > 0) {
+    for (const value of afterDashDash) {
+      if (protectedCarrierMatch(value) !== null) return value
+    }
+    return null
+  }
+  const operands = nonOptionValues(rest)
+  if (operands.length < 2) return null
+  const path = operands[operands.length - 1] as string
+  return protectedCarrierMatch(path) !== null ? path : null
+}
+
+/**
+ * `git restore` touches the WORKTREE by default; `--staged`/`-S` makes it an
+ * index-only unstage UNLESS `--worktree`/`-W` is ALSO given (both flags
+ * together restore both). P1 (second independent review, 2026-09-29): a
+ * plain `git restore --staged -- <path>` must be ALLOWED — it never
+ * touches the file this rule exists to protect from being overwritten.
+ */
+function restoreTouchesWorktree(rest: readonly Token[]): boolean {
+  const values = rest.map(tokenValue)
+  const staged = values.some((value) => value === '--staged' || value === '-S')
+  if (!staged) return true
+  return values.some((value) => value === '--worktree' || value === '-W')
+}
+
+function restoreTarget(rest: readonly Token[]): string | null {
+  if (!restoreTouchesWorktree(rest)) return null
+  const afterDashDash = pathsAfterDashDash(rest)
+  const candidates = afterDashDash.length > 0 ? afterDashDash : nonOptionValues(rest)
+  for (const value of candidates) {
+    if (protectedCarrierMatch(value) !== null) return value
+  }
+  return null
+}
+
+/**
+ * `git reset [<tree>] [--] <paths>...` only ever updates the INDEX for
+ * those paths — never the worktree — regardless of any flag other than
+ * `--hard`/`--merge`/`--keep`, none of which accepts a pathspec in real
+ * git (a bare `git reset --hard` with no path at all is `git.reset`'s own
+ * unconditional deny to catch, not this rule's — there is no specific
+ * carrier PATH for this function to find there). P1 (second independent
+ * review, 2026-09-29): `git reset -- <path>` and `git reset HEAD --
+ * <path>` must be ALLOWED — they only unstage.
+ */
+function resetTouchesWorktree(rest: readonly Token[]): boolean {
+  return rest.some((token) => {
+    const value = tokenValue(token)
+    return value === '--hard' || value === '--merge' || value === '--keep'
+  })
+}
+
+function resetTarget(rest: readonly Token[]): string | null {
+  if (!resetTouchesWorktree(rest)) return null
+  for (const value of pathsAfterDashDash(rest)) {
+    if (protectedCarrierMatch(value) !== null) return value
+  }
+  return null
+}
+
+/** `git rm <protected>` (any form), or `git checkout|restore|reset` in a WORKTREE-changing form naming `<protected>`. */
+/** `git rm`/`git mv`: every non-option operand is a candidate (for `mv`, moving a carrier away OR overwriting one with something else are both tamper). */
+function anyOperandTarget(rest: readonly Token[]): string | null {
+  for (const token of rest) {
+    const value = tokenValue(token)
+    if (value === '--' || value.startsWith('-')) continue
+    // F5 (fourth independent review, 2026-09-29): `git mv .claude
+    // .claude-old` moves the WHOLE carrier directory away — file-level
+    // `protectedCarrierMatch` alone never saw this.
+    const hit = protectedCarrierMatch(value) ?? protectedCarrierDirMatch(value)
+    if (hit !== null) return value
+  }
+  return null
+}
+
+function gitTarget(inv: Invocation & { kind: 'git' }): string | null {
+  // P2 (independent review, 2026-09-29): `git mv` of a carrier (either
+  // operand — moving it away, or overwriting it with something else).
+  if (inv.subcommand === 'rm' || inv.subcommand === 'mv') return anyOperandTarget(inv.rest)
+  if (inv.subcommand === 'checkout') return checkoutTarget(inv.rest)
+  if (inv.subcommand === 'restore') return restoreTarget(inv.rest)
+  if (inv.subcommand === 'reset') return resetTarget(inv.rest)
+  // P2: `git checkout-index` writes working-tree files from the index for
+  // named paths — the plumbing sibling of `git checkout -- <path>`. `-a`/
+  // `--all` (every staged file, no specific path named) is a known,
+  // documented gap — not handled here.
+  if (inv.subcommand === 'checkout-index') return anyOperandTarget(inv.rest)
+  return null
+}
+
+/**
+ * `git apply`/the standalone `patch` utility (P2, independent review,
+ * 2026-09-29): the path a patch actually modifies lives INSIDE the patch
+ * file's own headers, not (usually) as a command-line operand at all —
+ * `git apply some.patch` names the PATCH FILE, never its target. Coarse,
+ * whole-command (same tradeoff `interpreterTarget`/`coarsePathMention`
+ * already make elsewhere in this file): a protected path's text ANYWHERE
+ * on the line is enough to deny — reading the patch file's own content to
+ * parse its `--- a/<path>`/`+++ b/<path>` headers is out of scope for a
+ * static, pre-execution hook (it would need to read the file from disk,
+ * which this hook does not do for any other check either).
+ */
+/** `git apply` flags that inspect a patch without applying anything (F7, fourth independent review, 2026-09-29). */
+const DRY_RUN_GIT_APPLY_FLAGS: ReadonlySet<string> = new Set(['--check', '--stat', '--numstat', '--summary'])
+
+function coarsePathMention(command: string): string | null {
+  for (const protectedPath of PROTECTED_CARRIER_PATHS) {
+    if (command.includes(protectedPath)) return protectedPath
+    const base = protectedPath.slice(protectedPath.lastIndexOf('/') + 1)
+    if (command.includes(base)) return protectedPath
+  }
+  return null
+}
+
+/**
+ * Live false positive (third independent review, 2026-09-29): the OLD check
+ * paired "some write call anywhere in the command" (`WRITE_CALL_RE.test`)
+ * with "a carrier path anywhere in the command text" (`coarsePathMention`)
+ * — two UNCORRELATED checks. A heredoc-fed `python3 - <<'EOF'` writing an
+ * unrelated file (e.g. `STATUS.md`) whose own written TEXT merely mentioned
+ * `.codex/config.toml` (a docstring, a log line, a commit message) was
+ * wrongly denied — the mention and the write had nothing to do with each
+ * other.
+ *
+ * Replaced with CORRELATED detection: each pattern below captures the
+ * WRITE-CALL'S OWN TARGET ARGUMENT specifically (group 1) — `open(TARGET,
+ * 'w'|'a'|'x'…)`, `Path(TARGET).write_text/write_bytes(...)`,
+ * `os.remove/unlink(TARGET)`, `os.rename(SRC, TARGET)`,
+ * `shutil.move/copy/copy2/copyfile(SRC, TARGET)`,
+ * `fs.writeFileSync|appendFileSync|rmSync|unlinkSync|copyFileSync|truncateSync(TARGET, …)`,
+ * `fs.renameSync(SRC, TARGET)`, `Bun.write(TARGET, …)`, `File.write(TARGET,
+ * …)` (Ruby), `open(FH, '>'|'>>', TARGET)` (Perl 3-arg open) — a carrier
+ * path is only a match when it appears THERE. `writeCallTargets` extracts
+ * every captured target; `targetNamesCarrierPath` decides each one: a
+ * quoted string literal (or f-string) is checked directly
+ * (`protectedCarrierMatch`); a bare, unresolvable identifier/expression is
+ * fail-closed ONLY when that EXACT identifier is separately assigned a
+ * carrier-path string literal earlier in the same code (`p = '.codex/
+ * config.toml'; open(p, 'w')`) — an unrelated variable, or one assigned
+ * something else, is not a match. A capture that is a more complex
+ * expression (neither a literal nor a bare identifier — string
+ * concatenation, a function call, …) cannot be correlated at all and is
+ * left alone (allowed), the same "cannot resolve, so cannot deny" stance
+ * `adl.session-required-for-writes`'s own destination classification takes
+ * for an unresolved git push remote.
+ *
+ * `ARG` allows one level of nested parens (`os.path.join(a, b)` as a
+ * target) but otherwise stops at the next comma/paren — coarse, matching
+ * every other regex-based check in this file, not a real expression parser.
+ */
+const ARG = `((?:[^,()]|\\([^()]*\\))+)`
+/** `fs.X(...)`, `require('fs').X(...)`, or `require('fs').promises.X(...)` (no literal `fs.` substring exists in the `require(...)` forms — `'fs')` breaks it — so all three are matched explicitly rather than relying on a bare `fs\.` prefix). Required (not optional) for the async, non-Sync names below — `rename`/`unlink`/`rm` are common-enough verbs that an UNqualified bare call risks a real collision with an unrelated same-named function. */
+const FS_QUALIFIED_PREFIX = `(?:\\bfs|require\\(\\s*['"]fs['"]\\s*\\))\\s*\\.\\s*(?:promises\\s*\\.\\s*)?`
+/** The SAME prefix, but OPTIONAL — F6 (fourth independent review, 2026-09-29): `const { writeFileSync } = require('fs'); writeFileSync(...)` calls it BARE, with no qualifying prefix on the call site itself. Only for the `*Sync` names, distinctive enough on their own that an unqualified bare call is still almost certainly this Node API. */
+const FS_SYNC_OPTIONAL_PREFIX = `(?:${FS_QUALIFIED_PREFIX})?`
+const WRITE_TARGET_PATTERNS: readonly RegExp[] = [
+  new RegExp(`\\bopen\\s*\\(\\s*${ARG}\\s*,\\s*['"][wax]`, 'g'),
+  new RegExp(`\\bPath\\s*\\(\\s*${ARG}\\s*\\)\\s*\\.\\s*write_(?:text|bytes)\\s*\\(`, 'g'),
+  new RegExp(`\\bos\\.(?:remove|unlink)\\s*\\(\\s*${ARG}\\s*\\)`, 'g'),
+  new RegExp(`\\bos\\.rename\\s*\\(\\s*${ARG}\\s*,\\s*${ARG}\\s*\\)`, 'g'),
+  new RegExp(`\\bshutil\\.(?:move|copy2?|copyfile)\\s*\\(\\s*${ARG}\\s*,\\s*${ARG}\\s*\\)`, 'g'),
+  new RegExp(`${FS_SYNC_OPTIONAL_PREFIX}(?:writeFileSync|appendFileSync|rmSync|unlinkSync|copyFileSync|truncateSync)\\s*\\(\\s*${ARG}`, 'g'),
+  new RegExp(`${FS_SYNC_OPTIONAL_PREFIX}renameSync\\s*\\(\\s*${ARG}\\s*,\\s*${ARG}`, 'g'),
+  // F6: the async (non-Sync) forms, prefix REQUIRED.
+  new RegExp(`${FS_QUALIFIED_PREFIX}(?:writeFile|appendFile|rm|unlink|copyFile)\\s*\\(\\s*${ARG}`, 'g'),
+  new RegExp(`${FS_QUALIFIED_PREFIX}rename\\s*\\(\\s*${ARG}\\s*,\\s*${ARG}`, 'g'),
+  new RegExp(`\\bBun\\.write\\s*\\(\\s*${ARG}`, 'g'),
+  new RegExp(`\\bFile\\.write\\s*\\(\\s*${ARG}`, 'g'),
+  new RegExp(`\\bopen\\s*\\(\\s*${ARG}\\s*,\\s*['"]>{1,2}['"]\\s*,\\s*${ARG}\\s*\\)`, 'g'),
+]
+/** Position (from the end) of the TARGET capture group for each pattern above, in the same order — `os.rename`/`shutil.*`/the async `rename`/perl `open` capture 2 groups (source, target); every other pattern captures 1 (the target itself). */
+const TARGET_IS_LAST_GROUP: readonly boolean[] = [false, false, false, true, true, false, true, false, true, false, false, true]
+
+function writeCallTargets(command: string): readonly string[] {
+  const targets: string[] = []
+  for (let index = 0; index < WRITE_TARGET_PATTERNS.length; index += 1) {
+    const pattern = WRITE_TARGET_PATTERNS[index] as RegExp
+    const takeLast = TARGET_IS_LAST_GROUP[index]
+    for (const match of command.matchAll(pattern)) {
+      const value = takeLast ? match[2] : match[1]
+      if (value !== undefined) targets.push(value.trim())
+    }
+  }
+  return targets
+}
+
+const QUOTED_LITERAL_RE = /^f?(['"])([\s\S]*)\1$/
+const BARE_IDENTIFIER_RE = /^[A-Za-z_]\w*$/
+
+/** Whether `target` (a captured write-call argument) names a protected carrier — directly (a quoted literal) or, fail-closed, via a same-code assignment to a carrier-path literal when `target` is an unresolvable bare identifier. */
+function targetNamesCarrierPath(target: string, command: string): string | null {
+  const literal = QUOTED_LITERAL_RE.exec(target)
+  if (literal !== null) return protectedCarrierMatch(literal[2] ?? '')
+  if (!BARE_IDENTIFIER_RE.test(target)) return null
+  const escaped = target.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+  const assignment = new RegExp(`\\b${escaped}\\s*=\\s*f?(['"])([\\s\\S]*?)\\1`).exec(command)
+  if (assignment === null) return null
+  return protectedCarrierMatch(assignment[2] ?? '')
+}
+
+function interpreterTarget(command: string): string | null {
+  for (const target of writeCallTargets(command)) {
+    const hit = targetNamesCarrierPath(target, command)
+    if (hit !== null) return hit
+  }
+  return null
+}
+
+export const agentTamperProtection: RuleSpec = {
+  id: 'agent.tamper-protection',
+  category: 'tool-call',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny edits (tool, shell write, or git rewrite) to the host hook config or the repo gate marker.',
+  params: noParams,
+  match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
+    if (inv.kind === 'tool-call') {
+      const target = toolCallTarget(inv)
+      return target === null ? null : { ruleId: 'agent.tamper-protection', severity: 'deny', detail: { path: target, via: 'tool-call' } }
+    }
+    if (inv.kind === 'protected-carrier-write') {
+      // `targets` is never empty here: shell/invocation.ts only ever emits
+      // this kind when `protectedCarrierWriteTargets(...).length > 0`.
+      return { ruleId: 'agent.tamper-protection', severity: 'deny', detail: { path: inv.targets[0] ?? '', via: 'shell', command: inv.name || 'a redirection' } }
+    }
+    if (inv.kind === 'git') {
+      const target = gitTarget(inv)
+      if (target !== null) {
+        return { ruleId: 'agent.tamper-protection', severity: 'deny', detail: { path: target, via: 'git', command: `git ${inv.subcommand}` } }
+      }
+      // P2: `git apply` — coarse, whole-command (see `coarsePathMention`'s
+      // own doc for why: the target path is inside the patch's own
+      // headers, not an operand `gitTarget`'s per-operand scan would see).
+      // F7 (fourth independent review, 2026-09-29): a dry-run/inspection
+      // flag applies NOTHING — `git apply --check/--stat/--numstat/
+      // --summary` never touches the working tree, so naming a carrier is
+      // harmless.
+      if (inv.subcommand === 'apply' && !inv.rest.some((token) => DRY_RUN_GIT_APPLY_FLAGS.has(tokenValue(token)))) {
+        const hit = coarsePathMention(ctx.command ?? '')
+        if (hit !== null) return { ruleId: 'agent.tamper-protection', severity: 'deny', detail: { path: hit, via: 'git', command: 'git apply' } }
+      }
+      return null
+    }
+    // P2: the standalone `patch` utility — same coarse, whole-command
+    // reasoning as `git apply` above.
+    if (inv.kind === 'command' && inv.name === 'patch') {
+      const hit = coarsePathMention(ctx.command ?? '')
+      if (hit !== null) return { ruleId: 'agent.tamper-protection', severity: 'deny', detail: { path: hit, via: 'shell', command: 'patch' } }
+    }
+    const interpreter = interpreterTarget(ctx.command ?? '')
+    if (interpreter !== null) {
+      return { ruleId: 'agent.tamper-protection', severity: 'deny', detail: { path: interpreter, via: 'interpreter' } }
+    }
+    return null
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const path = typeof finding.detail.path === 'string' ? finding.detail.path : 'this file'
+    const via = typeof finding.detail.via === 'string' ? finding.detail.via : 'tool-call'
+    const command = typeof finding.detail.command === 'string' ? finding.detail.command : ''
+    const verb =
+      via === 'shell'
+        ? `${command} writing`
+        : via === 'git'
+          ? `${command} rewriting`
+          : via === 'interpreter'
+            ? 'an interpreter one-liner writing'
+            : 'editing'
+    return {
+      user: `Blocked ${via === 'tool-call' ? 'editing' : verb} ${path}. This file wires the host's hooks or un-manages this repo; ask the user to change it.`,
+      agent:
+        `DENIED ${verb} ${path}. This file is one of the tamper-protected files: ` +
+        '`.claude/settings.json`, `.claude/settings.local.json`, `.codex/config.toml`, ' +
+        '`.codex/hooks.json`, `.cursor/hooks.json`, `.opencode/plugins/adl-repo.ts`, ' +
+        "`~/.kimi-code/config.toml`, or `adl-config.toml`. The first six install or override a " +
+        "host's own hook contract (directly, or — for `.opencode/plugins/adl-repo.ts` — as the " +
+        'generated plugin THAT IS the carrier; `~/.kimi-code/config.toml` is Kimi\'s own single, ' +
+        "globally-installed carrier — Kimi has no per-repo one); `adl-config.toml` is the repo's " +
+        "own gate marker (`[hooks] enabled = false` silently no-ops every hook kind — see " +
+        '`main.ts`). Editing, overwriting, moving over, truncating, ' +
+        'deleting, or rewriting any of them — by a tool call, a shell write, or a git checkout/ ' +
+        'restore/reset/rm — is a way to switch the gate off without anyone noticing, the ONLY ' +
+        'enforcement layer for the hosts that read them (decision 13: the managed-hooks lock is ' +
+        `off). If a legitimate change is needed, file a PR or ask the user to make it themselves. ` +
+        `Blocked call: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    // Tool-call and shell-command shapes are both exercised directly by
+    // `tests/unit/rules-agent-tamper-protection.test.ts` (through
+    // `decide({kind:'tool-call'})` and `decideCommand`); this corpus only
+    // has to prove reads stay allowed and unrelated commands don't trip it.
+    deny: [],
+    allow: [
+      'ls -la .claude',
+      'cat .claude/settings.json',
+      'cat adl-config.toml',
+      'rg "enabled" .claude/',
+      'cat .codex/hooks.json',
+      'cat .cursor/hooks.json',
+      'cat .opencode/plugins/adl-repo.ts',
+      'jq . .codex/hooks.json',
+      'sed -n "1,5p" .codex/hooks.json',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/fs-canonical-checkout.ts

@@ -0,0 +1,86 @@
+/**
+ * `~/enact-vps` — the canonical checkout — is off-limits to agents.
+ *
+ * Owner decision, 2026-09-15. It is the tree the fleet reconciler builds every
+ * global binary from (`/Library/LaunchDaemons/com.adl.global-tools.plist` →
+ * `--repo /Users/ranahome/enact-vps`), and
+ * `/usr/local/libexec/adl-global-tools-sync` refuses the ENTIRE
+ * reconciliation while that tree is dirty (labels/binary confirmed already
+ * renamed fleet-side: `packages/fleet/README.md` documents
+ * `com.adl.global-tools`; this comment had drifted):
+ *
+ *   canonical checkout is dirty; refusing pull and reconciliation
+ *
+ * So a single stray write there does not inconvenience one repo — it silently
+ * stops every machine in the fleet from updating, with no signal beyond a line
+ * in a log nobody reads. That had been happening for an unknown number of
+ * cycles before it was found.
+ *
+ * Nothing needs to touch that path to ship: agents work in a clone and push to
+ * `main`, and the reconciler does its own `git pull --ff-only origin main`.
+ *
+ * WHY THIS LAYER. `~/.claude/settings.json` cannot express it. Permission rules
+ * match Bash by command PREFIX (`Bash(git *)`), never by path, so
+ * `rg foo ~/enact-vps` is invisible to them — and a hand-added `permissions.deny`
+ * entry is itself a global-surface-sweep candidate, so it would be removed
+ * again later. Path-aware denial exists only here.
+ *
+ * The classifier carries the path (see `shell/invocation.ts`'s `denied-path`):
+ * `cat`/`ls` and the other read-only consumers return `[]` from classification
+ * and are invisible to rules, and `read-only` carries only a name, so without
+ * that kind there would be nothing for this rule to inspect.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { detailString } from './messages.ts'
+
+export const fsCanonicalCheckout: RuleSpec = {
+  id: 'fs.canonical-checkout',
+  category: 'filesystem',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny any command reaching into ~/enact-vps, the canonical checkout the fleet builds from.',
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind !== 'denied-path') return null
+    return { ruleId: 'fs.canonical-checkout', severity: 'deny', detail: { path: inv.path, name: inv.name } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const path = detailString(finding, 'path')
+    return {
+      user: `Blocked: ${path} is inside ~/enact-vps, the canonical checkout. Work in a clone and push to main — the reconciler pulls from origin itself.`,
+      agent:
+        `DENIED ${path}. That is inside ~/enact-vps, the canonical checkout the fleet reconciler builds every ` +
+        'global binary from. It refuses the whole reconciliation while that tree is dirty ("canonical checkout ' +
+        'is dirty; refusing pull and reconciliation"), so a stray write there stops every machine updating.\n' +
+        'Nothing needs to touch it to ship: work in a clone (e.g. ~/Documents/enact-vps-m5), commit, and push to ' +
+        '`main`. The reconciler runs its own `git pull --ff-only origin main` before building, so your change ' +
+        'reaches /usr/local/bin without that path ever being written by an agent.\n' +
+        `Blocked command: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    // $HOME is /Users/tester in the rule fixtures (test/fixtures/decide.ts).
+    deny: [
+      'cat /Users/tester/enact-vps/adl-config.toml',
+      'rg TODO /Users/tester/enact-vps/adl-hook/src',
+      'ls /Users/tester/enact-vps',
+      'cp /Users/tester/enact-vps/x.ts /tmp/x.ts',
+      'ls -la && cat /Users/tester/enact-vps/adl-config.toml',
+      'echo hi; cat /Users/tester/enact-vps/adl-config.toml',
+    ],
+    allow: [
+      // A clone whose name merely starts with the denied one is a different repo.
+      'cat /Users/tester/enact-vps-m5/adl-config.toml',
+      'rg TODO /Users/tester/enact-vps-m5/adl-hook/src',
+      // Same name, different place.
+      'cat /Users/tester/Documents/enact-vps/adl-config.toml',
+      // The word is not the path.
+      'echo "see enact-vps for details"',
+      'rg TODO src/',
+      'ls -la',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/fs-git-internals.ts

@@ -0,0 +1,75 @@
+/**
+ * Filesystem writes into `.git` — the non-plumbing half of "manual git
+ * surgery".
+ *
+ * Added after an incident: an agent denied `git rebase --abort` trashed
+ * `.git/rebase-merge` and rewrote HEAD by hand. `fs.trash` refused only
+ * `.git` itself; `mv`, `cp`, `tee`, `>`, `sed -i`, `perl -pi`, `truncate`,
+ * `chmod`, `ln -sf`, `rsync` into `.git` were never inspected at all. The
+ * detection (which verbs, which operand is the written path) lives in
+ * shell/git-internals.ts; this rule only denies what it classified. Reading
+ * `.git/*` is never classified and stays allowed.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { detailString, gitAgentTail } from './messages.ts'
+
+export const fsGitInternals: RuleSpec = {
+  id: 'fs.git-internals',
+  category: 'filesystem',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny any filesystem write (rm/trash/mv/cp/ln/rsync/truncate/redirect/tee/sed -i/perl -i/chmod/find -delete) into a .git directory or gitdir file.',
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind !== 'git-internals-write') return null
+    return {
+      ruleId: 'fs.git-internals',
+      severity: 'deny',
+      detail: { command: inv.name || 'a redirection', target: inv.targets[0] ?? '' },
+    }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const command = detailString(finding, 'command')
+    const target = detailString(finding, 'target')
+    return {
+      user: `Blocked ${command} writing inside .git (${target}). Hand-editing git internals can corrupt the repository; use git's own commands, or do it yourself.`,
+      agent:
+        `DENIED ${command} writing inside .git (${target}). Deleting, moving, overwriting, truncating, ` +
+        're-permissioning, or in-place editing anything in a .git directory (refs, HEAD, the index, ' +
+        'rebase-merge/rebase-apply, MERGE_HEAD, objects, a worktree or submodule gitdir file) bypasses every ' +
+        "safety check git has and can leave the repository corrupt or silently lose commits. Reading .git " +
+        `is fine (cat, ls, grep). ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'trash .git/rebase-merge',
+      'rm -rf .git/rebase-merge',
+      'mv .git/rebase-merge ~/.Trash/',
+      'cp -f /tmp/HEAD .git/HEAD',
+      'echo ref: refs/heads/main > .git/HEAD',
+      'echo abc | tee .git/ORIG_HEAD',
+      "sed -i 's/feat/main/' .git/HEAD",
+      "perl -pi -e 's/feat/main/' .git/HEAD",
+      'truncate -s 0 .git/index',
+      'ln -sf refs/heads/main .git/HEAD',
+      'rsync -a --delete backup/ .git/',
+      'chmod 000 .git/index',
+      'find .git/rebase-merge -delete',
+      'cd repo && trash sub/.git/rebase-apply',
+      "bash <<'EOF'\nrm -rf .git\nEOF",
+      "sh <<EOF\nrm -rf .git\nEOF",
+    ],
+    allow: [
+      'cat .git/HEAD',
+      'ls -la .git/rebase-merge',
+      "sed -n '1,5p' .git/config",
+      'cp .git/config /tmp/git-config',
+      'trash .gitignore',
+      "cat <<'EOF' > notes.md\nrm -rf .git\nEOF",
+    ],
+  },
+}