@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/rules/impl/fs-mv.ts

@@ -0,0 +1,66 @@
+/**
+ * `mv` moving a protected tree out of the repository.
+ *
+ * Ported from `blockedFilesystemInvocationReason` in blocked-reason.mjs:115
+ * (the `'mv'` kind) — the non-git counterpart of git.mv-escape in
+ * git-paths.ts. `walk.mjs` never classifies a plain `mv` into this kind when
+ * its destination is `~/.Trash`-shaped; that case becomes a `trash`
+ * Invocation instead (see shell/invocation.ts's `walkFileCommand`), so
+ * fs.trash's rule sees it, not this one.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { moveEscapesRepo } from './git-helpers.ts'
+import { detailString, protectedTreesText } from './messages.ts'
+
+export const fsMv: RuleSpec = {
+  id: 'fs.mv',
+  category: 'filesystem',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny mv that moves a protected tree outside the repository.',
+  params: noParams,
+  match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
+    if (inv.kind !== 'mv') return null
+    if (!moveEscapesRepo(inv.args, ctx.repo.protectedTrees)) return null
+    return {
+      ruleId: 'fs.mv',
+      severity: 'deny',
+      detail: { reason: 'mv out of the repository', protectedTreesText: protectedTreesText(ctx.repo.protectedTrees) },
+    }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const reason = detailString(finding, 'reason')
+    const protectedText = detailString(finding, 'protectedTreesText')
+    return {
+      user: `Blocked ${reason.replace(' out of the repository', '')} moving a protected tree (${protectedText}) out of the repository. Renames inside the repo are fine; this one leaves nothing to restore from.`,
+      agent:
+        `DENIED ${reason}: a protected tree (${protectedText}) leaving the repository. Renaming or ` +
+        'relocating these files INSIDE the repository is allowed and is ordinary refactoring - ' +
+        '`mv .agents/a.yml .agents/b.yml` and `git mv .agents/a.yml docs/a.yml` both pass. ' +
+        'What is refused is a destination that leaves the worktree: an absolute path, a `~` path, a `..` that ' +
+        'climbs above the root, or an unexpanded $VAR the hook cannot resolve. That is a deletion of a gate ' +
+        "file with a rename's paperwork - nothing is left behind to restore from. Move it to a path inside " +
+        `the repository, or leave it in place and ask the user to remove it. Blocked command: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'mv .agents/sql/rules/parse-error.yml /tmp/parse-error.yml',
+      'mv .agents/scripts/scan.sh ../scan.sh',
+      'mv /Users/me/repo/.agents/hooks/block-git-destructive.mjs /tmp/hook.mjs',
+      'mv -f .agents/cli/cmd-sql.sh /tmp/cmd-sql.sh',
+    ],
+    allow: [
+      'mv .agents/sql/rules/parse-error.yml .agents/sql/rules/retired.yml',
+      'mv .agents/pgsql/scripts/pgsql-parse.sh .agents/scripts/internal/pgsql-parse.sh',
+      'mv .agents/cli/cmd-sql.sh docs/cmd-sql.sh',
+      'mv docs/a.md /tmp/a.md',
+      'mv workflows/config/profiles/rule-profiles.yaml ~/rule-profiles.yaml',
+      'mv .enact/out ../out',
+      'mv frontend/dist frontend/build',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/fs-rm.ts

@@ -0,0 +1,83 @@
+/**
+ * `rm` / `unlink`, any flags, any form.
+ *
+ * Ported from `blockedFilesystemInvocationReason` in blocked-reason.mjs:113
+ * and `rmIsHelpOnly` in walk.mjs:45-60. `--help`/`--version` alone is not a
+ * deletion and is allowed through; anything else is refused outright — the
+ * hook does not try to distinguish `rm -rf /tmp/scratch` from `rm -rf dist`,
+ * because both are unrecoverable and `trash` (fs-trash.ts) is the
+ * recoverable alternative for both.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import { rmIsHelpOnly } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+
+export const fsRm: RuleSpec = {
+  id: 'fs.rm',
+  category: 'filesystem',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny rm/unlink; --help and --version alone are not a deletion.',
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind !== 'rm') return null
+    if (rmIsHelpOnly(inv.args)) return null
+    return { ruleId: 'fs.rm', severity: 'deny', detail: {} }
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user: 'Blocked rm. Move files to Trash (`trash <relative/path>`), do not rm -rf.',
+      agent:
+        'DENIED rm. Do not run rm, rm -f, rm -r, or rm -rf. Put the path in Trash: trash <path>  ' +
+        '(or: mv <path> ~/.Trash/). Absolute paths, ~ paths, .. and the protected trees are all fine for ' +
+        'trash - it is recoverable from ~/.Trash, which is the whole point. Write the path out LITERALLY: ' +
+        'a $VAR, a command substitution, an empty argument, and a bare dot are refused, because a variable ' +
+        'set in an earlier Bash call is empty in this one and an empty trash argument takes the working ' +
+        'directory. Also refused: a system root, $HOME itself, and .git. ' +
+        `If trash(1) is missing: brew install trash. Blocked command: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'rm -rf dist',
+      'rm -fr .',
+      'rm -r node_modules',
+      'rm -f tmp/file.txt',
+      'rm file.txt',
+      '/bin/rm -rf /tmp/x',
+      'sudo rm -rf /tmp/x',
+      'env -i rm -rf dist',
+      'env --ignore-environment rm -rf dist',
+      'env -- rm -rf dist',
+      'command -- rm -rf dist',
+      'exec rm -rf dist',
+      'cd frontend && rm -rf dist',
+      "sh -c 'rm -rf dist'",
+      'echo $(rm -rf dist)',
+      "bash -lc 'rm -rf dist'",
+      'xargs rm -rf',
+      'xargs -0 -I{} rm -rf {}',
+      'find . -exec rm -rf {} \\;',
+      'find . -delete',
+      'find . -type f -exec wc -c {} +',
+      'find . -type f -exec rm -f {} +',
+      'xargs -I{} rm -rf {}',
+      "sh -c 'rm -rf $HOME/dist'",
+      // `-nc` matches the `-c`-style shell-command-option regex (any
+      // non-'-' run ending in 'c'), so this runs "rm -rf dist" as the -c
+      // script body — an ordinary rm denial, not a parse failure.
+      "bash -nc 'rm -rf dist'",
+      'nice -n 10 rm -rf dist',
+      'timeout 90 rm -rf /tmp/x',
+      'chrt -f 1 rm -rf /',
+      // Fixed: shell-parser.mjs's nestedSources() used to swallow every
+      // character inside a double quote unconditionally, so a $(...) inside
+      // "..." was invisible to every rule, not just this one. See
+      // substitution.ts's consumeNestedQuote doc for the fix.
+      'echo "$(rm -rf dist)"',
+    ],
+    allow: ['echo rm -rf /', 'rm --help', 'rm --version', 'cat rm.txt', 'type rm', 'whereis rm', "echo '$(rm -rf dist)'"],
+  },
+}

package/packages/agent-hooks/src/rules/impl/fs-trash.ts

@@ -0,0 +1,140 @@
+/**
+ * `trash` (and an `mv <path> ~/.Trash/` reclassified as `trash` by
+ * shell/invocation.ts's `walkFileCommand`).
+ *
+ * Ported from `.agents/hooks/pre-tool-use/utils/trash.mjs`. Seven
+ * sub-predicates, checked per path argument, in order.
+ *
+ * The original's eighth predicate -- any path with an `.agents` segment --
+ * was dropped by owner decision on 2026-09-15. `.agents/` is reconciled
+ * centrally every six hours (global-tools `git-maintain` refreshes repo-local
+ * surfaces in every managed repo), so a trashed copy is restored rather than
+ * lost, and `trash(1)` is itself recoverable from ~/.Trash. Protecting it here
+ * blocked routine work to guard against something the fleet already repairs.
+ *
+ *  1. an unresolved `$`/backtick expansion
+ *  2. an empty path
+ *  3. the working directory (`.`, `..`, `*`, or empty after trimming slashes)
+ *  4. a system root (trash.mjs:6-21)
+ *  5. `$HOME` itself
+ *  6. `.git` (bare or nested)
+ *  7. — the deliberate non-rule: an absolute path, `~`, and `..` are all
+ *     ALLOWED. `trash(1)` is recoverable from `~/.Trash`; `rm` is the one
+ *     that stays blocked outright (fs-rm.ts). See trash.mjs:40-47.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import { tokenValue } from '../shell/token.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { detailString } from './messages.ts'
+
+const SYSTEM_ROOTS = new Set([
+  '/',
+  '/Applications',
+  '/bin',
+  '/etc',
+  '/Library',
+  '/opt',
+  '/private',
+  '/sbin',
+  '/System',
+  '/tmp',
+  '/usr',
+  '/Users',
+  '/var',
+  '/Volumes',
+])
+
+function denialForPath(raw: string, home: string): string | null {
+  if (/[$`]/.test(raw)) return 'trash of an unresolved expansion'
+  if (raw.trim() === '') return 'trash of an empty path'
+  const path = raw.replace(/\/+$/, '')
+  if (path === '' || path === '.' || path === '..' || path === '*') return 'trash of the working directory'
+  if (SYSTEM_ROOTS.has(path)) return 'trash of a system root'
+  if (path === '~' || (home && path === home)) return 'trash of the home directory'
+  if (path === '.git' || path.endsWith('/.git')) return 'trash of the git directory'
+  return null
+}
+
+export const fsTrash: RuleSpec = {
+  id: 'fs.trash',
+  category: 'filesystem',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny trash of the working directory, a system root, $HOME, or .git.',
+  params: noParams,
+  match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
+    if (inv.kind !== 'trash') return null
+    const home = (ctx.env.home() || '').replace(/\/+$/, '')
+    const paths = inv.args.map((token) => tokenValue(token)).filter((value) => !value.startsWith('-'))
+    if (paths.length === 0) return { ruleId: 'fs.trash', severity: 'deny', detail: { reason: 'trash with no path argument' } }
+    for (const raw of paths) {
+      const denial = denialForPath(raw, home)
+      if (denial) return { ruleId: 'fs.trash', severity: 'deny', detail: { reason: denial } }
+    }
+    return null
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const reason = detailString(finding, 'reason')
+    return {
+      user: `Blocked ${reason}. This git operation can discard or irreversibly rewrite work in a shared checkout. Run it yourself in a terminal if you really mean it.`,
+      agent:
+        `DENIED ${reason}. This git operation is blocked for agents in this shared checkout - it can discard, ` +
+        'hide, or irreversibly rewrite work. Read-only inspection (git status, git log, git diff, git stash ' +
+        'list) is always fine. If the human explicitly asked for this exact command, tell them to run it ' +
+        `themselves in their own terminal - this hook still blocks you. Blocked command: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'trash "$FAKE_ROOT"',
+      'trash $FAKE_ROOT',
+      'trash "${FAKE_ROOT}"',
+      'trash "$(git rev-parse --show-toplevel)"',
+      'trash ""',
+      'trash',
+      'trash .',
+      'trash ./',
+      'trash ..',
+      'trash *',
+      'trash .git',
+      'trash backend/.git',
+      'trash /',
+      'trash /System',
+      'trash /Users',
+      'trash /Applications',
+      'trash ~',
+      'trash /tmp/',
+    ],
+    allow: [
+      // No longer denied (owner decision 2026-09-15): `.agents/` is restored by
+      // the six-hourly reconcile, and trash(1) is recoverable from ~/.Trash.
+      'trash ~/Documents/Repos/adl-app-checkout/.agents',
+      'mv .agents ~/.Trash/',
+      'trash .agents',
+      'trash dist',
+      'trash node_modules/electron',
+      'trash .enact/qua-restore',
+      'trash frontend/out',
+      'trash workflows',
+      'trash workflows/config/exceptions',
+      'trash .code-quality',
+      'trash docker',
+      'trash infra',
+      'trash dev',
+      'trash dist workflows',
+      'trash /Users/tarunrana/Documents/Repos/adl-maintenance-checkout',
+      'trash ~/Documents/Repos/adl-maintenance-checkout',
+      'trash ~/.gemini ~/.qwen ~/.codeium',
+      'trash ~/Library/Caches/lean-ctx',
+      'trash "~/Library/Application Support/lean-ctx"',
+      'trash ../adl-app-checkout',
+      'trash /opt/homebrew/lib/node_modules/@google',
+      'mv workflows ~/.Trash/',
+      'mv build ~/.Trash/',
+      'mv /Users/tarunrana/Documents/Repos/adl-maintenance-checkout ~/.Trash/',
+    ],
+  },
+}
+

package/packages/agent-hooks/src/rules/impl/git-core.ts

@@ -0,0 +1,101 @@
+/**
+ * `core.hooksPath` and `core.bare` — the two settings that disable or detach
+ * every other gate at once.
+ *
+ * Ported from `blockedGitPrefixReason` in blocked-reason.mjs:23-29. Checked
+ * ahead of every other git rule (see registry.ts) because both fire on
+ * `-c core.*=` globals that can ride along with *any* subcommand — a
+ * `git -c core.hooksPath=/dev/null commit --no-verify` should be reported as
+ * the hooksPath override, not the --no-verify, which is exactly the order
+ * the original's `blockedGitCoreReason` evaluated them in.
+ */
+
+import { isHelpOnlyInvocation, flipsCoreBare, overridesHooksPath } from './git-helpers.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { gitAgentTail } from './messages.ts'
+import type { Invocation } from '../shell/invocation.ts'
+
+function gitInvocation(inv: Invocation): Invocation & { kind: 'git' } | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+export const gitHooksPath: RuleSpec = {
+  id: 'git.hooks-path',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny any git invocation that overrides core.hooksPath.',
+  params: noParams,
+  match(inv, _ctx: RuleContext<Record<string, never>>): Finding | null {
+    const git = gitInvocation(inv)
+    if (!git) return null
+    if (isHelpOnlyInvocation(git.rest)) return null
+    const hit = overridesHooksPath(git.globals) || (git.subcommand === 'config' && overridesHooksPath(git.rest))
+    return hit ? { ruleId: 'git.hooks-path', severity: 'deny', detail: {} } : null
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user: 'Blocked a core.hooksPath override. That switches off every repository gate at once.',
+      agent:
+        'DENIED core.hooksPath override. Repointing or emptying core.hooksPath disables EVERY repository ' +
+        'hook at once - pre-commit, commit-msg, and pre-push all stop running, silently and with no other ' +
+        'signal. Run the plain command instead: `git commit` and `git push` already execute the gates ' +
+        `through workflows/hooks. If a gate is failing, fix the finding it reports. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'git -c core.hooksPath=/dev/null commit -m x',
+      'git -c core.hooksPath= push',
+      'git -c core.hooksPath=/tmp/empty commit --amend',
+      'git config core.hooksPath /dev/null',
+      'git config --global core.hooksPath /tmp/empty',
+    ],
+    allow: ['git stash --help', 'git config user.name t'],
+  },
+}
+
+export const gitCoreBare: RuleSpec = {
+  id: 'git.core-bare',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny any git invocation that flips core.bare.',
+  params: noParams,
+  match(inv, _ctx: RuleContext<Record<string, never>>): Finding | null {
+    const git = gitInvocation(inv)
+    if (!git) return null
+    if (isHelpOnlyInvocation(git.rest)) return null
+    const hit = flipsCoreBare(git.globals) || (git.subcommand === 'config' && flipsCoreBare(git.rest))
+    return hit ? { ruleId: 'git.core-bare', severity: 'deny', detail: {} } : null
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user:
+        'Blocked a core.bare flip. Setting the repo bare detaches every working tree (git status/diff stop ' +
+        'working) while leaving files on disk looking normal. If the repo is already bare, the fix is ' +
+        '`git config core.bare false` — run it yourself.',
+      agent:
+        'DENIED core.bare flip. Setting core.bare=true converts the checkout to a bare repository: ' +
+        'git status/diff/commit stop working in every directory that used to be a working tree, while all ' +
+        'the files stay on disk looking normal - the failure surfaces later, far from the cause (this exact ' +
+        'flip happened in this repo and detached the main checkout). ' +
+        'Converting a repo bare is NEVER needed for worktrees; linked worktrees work fine in a normal repo. ' +
+        'If the human says the repo is already bare and asks to fix it, the repair is ' +
+        '`git config core.bare false` - but that one is theirs to run, not yours. ' +
+        gitAgentTail(ctx.snippet),
+    }
+  },
+  corpus: {
+    deny: [
+      'git -c core.bare=true status',
+      'git -c core.bare=false commit -m x',
+      'git config core.bare true',
+      'git config --bool core.bare true',
+      'git config --global core.bare true',
+      'git config --unset core.bare',
+    ],
+    allow: ['git status', 'git config user.name t'],
+  },
+}