@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/bin/git-ado

@@ -0,0 +1,425 @@
+#!/usr/bin/env bash
+# Managed by adl global-tools.
+# Run a git command that talks to Azure DevOps, authenticating if it must.
+#
+#   git-ado <repo> <git-arg>...
+#
+# WHY THIS EXISTS. Azure DevOps SSH remotes have no Git LFS support -- git-lfs
+# 3.x probes with a pure-SSH `git-lfs-transfer` that hangs forever against
+# ssh.dev.azure.com, stalling every push in the LFS pre-push hook -- so the
+# fleet is converting every remote to https. An https remote cannot
+# authenticate from GIT_SSH_COMMAND, and a host with no credential helper dies
+# inside git on `could not read Username`.
+#
+# THE IDENTITY MODEL (Handoff 5, ADL-ISMS, 2026-09-26). Coding agents act as
+# three Entra service principals: agent-tarun, agent-vivek, agent-reviewer.
+# Agents never see a secret.
+#
+#   HUMAN PATH (STATUS.md 12p decision 1: fail closed, the human opts in).
+#   An unset/empty ADL_AGENT_ID_AGENT is passed through to the human's own
+#   credential helper (Git Credential Manager, etc.) ONLY when BOTH stdin is
+#   a real terminal AND ADL_HUMAN_AZDO is the exact string "1" -- Tarun
+#   exports it from his own `.zshrc` (decision 1c: "its not only git, its
+#   azdo" -- the marker governs every human Azure DevOps path, not only this
+#   script). Otherwise this script refuses outright, by name, before
+#   touching git at all: the earlier "unset means human" rule relied
+#   entirely on the adl hook denying an agent's Azure DevOps network git
+#   command that omits ADL_AGENT_ID_AGENT (H2 rule 1) -- a host the hook
+#   cannot rewrite on, or a chained/opaque shell shape the hook's walker
+#   misses, reached THIS script with no agent identity and no TTY, and used
+#   to be treated as human regardless. `adl id whoami`
+#   (apps/cli/src/commands/id.ts) shares the identical check via
+#   packages/azdo/src/lib/agent-identity.ts's `isMarkedHumanAzdoCaller`,
+#   never a copy of it, since this script is bash and cannot import that
+#   module -- packages/fleet/tests/git-ado-vault-boundary.test.ts runs a
+#   contract test against both to keep them from drifting apart.
+#
+#   AGENT PATH. ADL_AGENT_ID_AGENT=<agent-tarun|agent-vivek|agent-reviewer>,
+#   set by the agent's own definition, routes through
+#     adl-agent-id exec --agent "$ADL_AGENT_ID_AGENT" -- <child>
+#   which mints a short-lived, proxy-only Agent Vault session and runs
+#   `agent-vault run -- <child>` inside it (adl-agent-id 0.4.1, `exec`). The
+#   child asks `adl id token` for that agent's Entra access token over the proxy
+#   agent-vault just set up, then hands it to git as a GIT_CONFIG_* header
+#   scoped to the remote's own host (https://dev.azure.com/ for the common
+#   case; `is_ado_url` below also accepts an org's own `*.visualstudio.com`,
+#   case-insensitively -- second independent review, 2026-09-29) -- never a
+#   -c flag (world-readable via ps for the life of the command), never an
+#   argv, never a log line. The proxy and CA variables are stripped before
+#   git runs: git must reach that host directly, and the vault's CA must
+#   never replace the system trust store for ordinary git traffic. An
+#   existing caller GIT_CONFIG_COUNT is appended to, never overwritten.
+#
+#   NEVER a fallback to another identity: an unrecognized agent name is
+#   refused, by name, before anything reaches adl-agent-id.
+#
+# HOST AUTOMATION (sync-and-reconcile, scratch-reap, git-maintain) is not one
+# of the three named agents and is not a human terminal either, but it goes
+# through THIS script's ordinary agent path as agent-tarun, the machine's own
+# default agent (2026-09-27 decision 5). THIS SCRIPT NEVER READS THE
+# DEFAULT-AGENT FILE ITSELF -- it only ever checks ADL_AGENT_ID_AGENT (the
+# HUMAN PASS-THROUGH section below). Each caller resolves the default-agent
+# file on its own, in TypeScript, via
+# packages/azdo/src/lib/agent-identity.ts's `resolveAgentIdentity`
+# (packages/fleet/src/default-agent-file.ts owns the WRITE side), and sets
+# ADL_AGENT_ID_AGENT in the child env before it ever reaches this script --
+# see e.g. packages/fleet/src/scratch-reap.ts and
+# packages/fleet/jobs/git-maintain/src/main.ts. The separate host-only
+# credentialed path (git-ado-host) is retired: the old DevOps vault
+# credentials it used were deleted, so it was dead regardless.
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
+
+# F11a (independent review, 2026-09-29): kept byte-for-byte identical to
+# bin/git's own `resolve_symlink_target`/`is_homebrew_shim` -- the two
+# scripts have no shared bash include the fleet installs, so this is a
+# deliberate duplicate, not a copy that drifted. A contract test in
+# packages/fleet/tests/git-ado-vault-boundary.test.ts sources both copies
+# and asserts they behave identically, to catch drift the moment it happens.
+#
+# Homebrew's own shims (`Library/Homebrew/shims/{shared,scm,super}/git`) walk
+# PATH the same way this script does and exec the first non-system git they
+# find -- which, inside `brew`, could be THIS script's own front controller
+# again. Skip any candidate that resolves into a Homebrew shims directory so
+# a real, non-shim git is chosen instead (see bin/git's own header comment
+# for the fuller story).
+resolve_symlink_target() {
+  local target="$1" dir
+  while [[ -L "$target" ]]; do
+    dir="$(cd -- "$(dirname -- "$target")" && pwd -P)"
+    target="$(readlink -- "$target")"
+    [[ "$target" == /* ]] || target="$dir/$target"
+  done
+  dir="$(cd -- "$(dirname -- "$target")" && pwd -P)"
+  printf '%s/%s\n' "$dir" "$(basename -- "$target")"
+}
+
+is_homebrew_shim() {
+  [[ "$(resolve_symlink_target "$1")" == */Library/Homebrew/shims/* ]]
+}
+
+resolve_real_git() {
+  local path_entry candidate candidate_dir front_controller="$script_dir/git"
+  local old_ifs="$IFS"
+  IFS=:
+  for path_entry in $PATH; do
+    [[ -n "$path_entry" ]] || path_entry=.
+    candidate="$path_entry/git"
+    [[ -x "$candidate" ]] || continue
+    candidate_dir="$(cd -- "$(dirname -- "$candidate")" && pwd -P)"
+    candidate="$candidate_dir/$(basename -- "$candidate")"
+    [[ "$candidate" == "$front_controller" ]] && continue
+    [[ "$candidate" -ef "$front_controller" ]] && continue
+    is_homebrew_shim "$candidate" && continue
+    IFS="$old_ifs"
+    printf '%s\n' "$candidate"
+    return
+  done
+  IFS="$old_ifs"
+  for candidate in /opt/homebrew/bin/git /home/linuxbrew/.linuxbrew/bin/git /usr/bin/git /bin/git; do
+    [[ -x "$candidate" ]] || continue
+    [[ "$candidate" -ef "$front_controller" ]] && continue
+    is_homebrew_shim "$candidate" && continue
+    printf '%s\n' "$candidate"
+    return
+  done
+  echo 'git-ado: cannot locate a real Git executable' >&2
+  exit 1
+}
+
+git_ado_command_index() {
+  local git_ado_args=("$@")
+  local index=0 argument
+  while (( index < ${#git_ado_args[@]} )); do
+    argument="${git_ado_args[index]}"
+    case "$argument" in
+      --) ((index += 1)); break ;;
+      -C|-c|--config-env|--exec-path|--git-dir|--work-tree|--namespace|--super-prefix) ((index += 2)) ;;
+      -C*|--config-env=*|--exec-path=*|--git-dir=*|--work-tree=*|--namespace=*|--super-prefix=*) ((index += 1)) ;;
+      -*) ((index += 1)) ;;
+      *) printf '%s\n' "$index"; return ;;
+    esac
+  done
+  printf '%s\n' -1
+}
+
+# Second independent review (2026-09-29): widened to match the hook's own
+# `isAdoUrl` (packages/agent-hooks/src/rules/impl/git-helpers.ts) -- which
+# already treats `*.visualstudio.com` and any host casing as Azure DevOps
+# too -- so the hook and this script's own gate cannot disagree about what
+# counts as an Azure DevOps remote. Deliberately duplicated in bin/git (no
+# shared bash include exists to source from; same reasoning as the
+# Homebrew-shim skip, F11a). `tr` rather than bash 4's `${var,,}`: the
+# default `/bin/bash` on macOS is 3.2, which does not have it.
+is_ado_url() {
+  local lower
+  lower="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"
+  case "$lower" in
+    https://*dev.azure.com|https://*dev.azure.com/*) return 0 ;;
+    https://*.visualstudio.com|https://*.visualstudio.com/*) return 0 ;;
+    https://visualstudio.com|https://visualstudio.com/*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# THIRD independent review (2026-09-29), item 2, companion fix: every
+# `"$repo" == https://*` check below decides "is `repo` a URL, or a local
+# path" -- case-SENSITIVELY, so `repo` itself carrying an uppercase scheme
+# (bin/git can pass one through unchanged, e.g. a literal `HTTPS://...`
+# argv URL, or whatever case a configured remote happens to use) would be
+# misdetected as a local path and passed to `-C`, never reaching the
+# ado_host fix below at all. A bracket-expression glob (POSIX, works in
+# `sh` too -- used again in the inner `sh -c` script further down) rather
+# than `${1,,}`: bash 3.2, macOS's own default, has no case-conversion
+# expansion.
+has_https_scheme() {
+  case "$1" in
+    [Hh][Tt][Tt][Pp][Ss]://*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# THIRD independent review (2026-09-29), CONFIRMED LIVE (HIGH): this script's
+# own network-verb pre-check used to be `fetch|pull|clone|ls-remote|push`
+# ONLY -- narrower than every verb bin/git can route here (`remote
+# show|prune|set-head|update`, `maintenance run`, `submodule update`,
+# `archive --remote`, the raw transport plumbing, `lfs`). Every one of THOSE
+# verbs hit this pre-check's `*)` fallback and ran the real git directly,
+# BEFORE the ADO-host check and BEFORE the identity/human-marker check --
+# live-traced with GIT_TRACE=1: `git-ado <ado-url> remote show origin` ran
+# real `git-remote-https` with no `adl-agent-id` call and no extraHeader,
+# authenticating via the real `credential.helper` (osxkeychain) instead.
+# bin/git only ever routes an Azure DevOps network command here in the
+# first place, so this script must not keep its OWN narrower allowlist --
+# `is_network_command_name` is the ONE list, duplicated byte-for-byte in
+# bin/git (same reasoning as the Homebrew-shim skip and `is_ado_url`) and
+# kept in sync by a contract test in
+# packages/fleet/tests/git-ado-vault-boundary.test.ts that extracts and
+# compares both copies.
+is_network_command_name() {
+  case "$1" in
+    clone|push|fetch|pull|ls-remote|remote|maintenance|submodule|archive|remote-https|remote-http|remote-ftp|remote-ftps|http-fetch|http-push|lfs) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# git-ado OWNS these two addresses (Tarun, 2026-09-27): the machine does not
+# supply them, and a caller's own value is never trusted, because a caller
+# that could redirect either one could redirect the signed broker request or
+# the minted token to a server of its choosing. They are fixed constants of
+# this script, not read from the environment at all.
+readonly ADL_AGENT_ID_ADDR_CONST='https://agentid.amsterdamdatalabs.com'
+readonly ADL_AGENT_ID_VAULT_ADDR_CONST='https://agentid-vault.walrus-morray.ts.net'
+
+# The three Entra service principals coding agents may act as. Every other
+# value -- a typo, an empty override, a name an agent invented -- is refused
+# by name before anything reaches adl-agent-id. There is no default identity.
+is_known_agent() {
+  case "$1" in
+    agent-tarun|agent-vivek|agent-reviewer) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# Fail loudly, by name, before the first adl-agent-id call: an unrecognized
+# agent, a missing tool, or (on Linux, where passport keys are root-owned,
+# H4) a non-root invocation must never reach the vault.
+require_agent_identity() {
+  local agent="$1" tool
+  if ! is_known_agent "$agent"; then
+    echo "git-ado: unknown Azure DevOps agent identity '$agent' (ADL_AGENT_ID_AGENT); must be agent-tarun, agent-vivek, or agent-reviewer" >&2
+    return 1
+  fi
+  case "$(uname -s)" in
+    Linux)
+      if [[ "$(id -u)" -ne 0 ]]; then
+        echo 'git-ado: Linux Azure DevOps network operations require root; use sudo -H git-ado <repo> <network-git-command...>' >&2
+        return 1
+      fi
+      ;;
+    Darwin) ;;
+    *)
+      echo "git-ado: unsupported platform for the agent identity path: $(uname -s)" >&2
+      return 1
+      ;;
+  esac
+  for tool in adl-agent-id agent-vault adl; do
+    command -v "$tool" >/dev/null 2>&1 || {
+      echo "git-ado: $tool is not on PATH; reconcile the global-tools manifest first" >&2
+      return 1
+    }
+  done
+}
+
+# Tests source only the parsing and identity boundary; executable invocations
+# always continue to the argument and network-command checks below.
+if [[ "${GIT_ADO_SOURCE_ONLY:-}" == 1 && "${BASH_SOURCE[0]}" != "$0" ]]; then
+  return 0
+fi
+
+[[ $# -ge 2 ]] || { echo "usage: git-ado <repo> <git-arg>..." >&2; exit 2; }
+repo="$1"; shift
+git_args=("$@")
+command_index="$(git_ado_command_index "${git_args[@]}")"
+(( command_index >= 0 )) || { echo 'git-ado: Git command is required' >&2; exit 2; }
+git_command="${git_args[command_index]}"
+real_git="$(resolve_real_git)"
+
+# Only the network verbs need a credential. Routing local git through the
+# identity path costs a token mint per call and fails on a host with no
+# vault at all, for a command that never leaves the disk -- `rev-parse` tried
+# to authenticate before this check existed.
+if ! is_network_command_name "$git_command"; then
+  if has_https_scheme "$repo"; then exec "$real_git" "$@"; fi
+  exec "$real_git" -C "$repo" "$@"
+fi
+
+if has_https_scheme "$repo"; then
+  remote_url="$repo"
+else
+  if ! remote_url="$("$real_git" -C "$repo" "${git_args[@]:0:command_index}" remote get-url origin 2>/dev/null)"; then
+    exec "$real_git" -C "$repo" "$@"
+  fi
+fi
+
+# Anything that is not an https Azure DevOps remote is none of this script's
+# business: ssh remotes still authenticate by key, and a non-ADO host has no
+# Entra token to offer. Passing them straight through keeps this usable as a
+# drop-in for every caller rather than only the ADO ones.
+if ! is_ado_url "$remote_url"; then
+  if has_https_scheme "$repo"; then exec "$real_git" "$@"; fi
+  exec "$real_git" -C "$repo" "$@"
+fi
+
+# The credential header is scoped to THIS remote's actual host, not a fixed
+# string (second independent review, 2026-09-29): `is_ado_url` above now also
+# accepts `*.visualstudio.com`, and a header hardcoded to `dev.azure.com`
+# would never match THAT host's requests (`http.<url>.extraHeader` is a URL
+# PREFIX match), silently sending no credential at all.
+#
+# THIRD independent review (2026-09-29): the ORIGINAL version of this line
+# stripped `https://` case-SENSITIVELY, so `HTTPS://DEV.AZURE.COM/...`
+# (`is_ado_url` above matches it -- that check already lowercases first)
+# left `ado_host` as the WHOLE original string, producing a bogus header key
+# that could never match anything -- git would silently send no credential
+# at all and fall back to the real `credential.helper`. `git help config`:
+# "the scheme and hostname [of `http.<URL>.*`] are matched case
+# insensitively" -- so lowercasing here is not a guess, it is what git
+# itself does when it later matches this key against the request.
+ado_host="$(printf '%s' "$remote_url" | tr '[:upper:]' '[:lower:]')"
+ado_host="${ado_host#https://}"
+ado_host="${ado_host%%/*}"
+
+# HUMAN PASS-THROUGH (STATUS.md 12p decision 1: fail closed, the human opts
+# in). Unset or empty ADL_AGENT_ID_AGENT passes through to the real git
+# UNCHANGED only when this is also a marked human terminal: stdin is a real
+# tty AND ADL_HUMAN_AZDO is the exact string "1" (decision 1b/1c). Anything
+# else with no agent identity -- no marker, no tty, or both -- is refused
+# outright, by name, before touching git at all. This is the ONE place that
+# check is made in bash; `isMarkedHumanAzdoCaller` in
+# packages/azdo/src/lib/agent-identity.ts is the identical check for `adl id
+# whoami`, and a contract test keeps the two from drifting apart (see the
+# header comment above).
+if [[ -z "${ADL_AGENT_ID_AGENT:-}" ]]; then
+  if [[ -t 0 && "${ADL_HUMAN_AZDO:-}" == "1" ]]; then
+    if has_https_scheme "$repo"; then exec "$real_git" "$@"; fi
+    exec "$real_git" -C "$repo" "$@"
+  fi
+  echo "git-ado: no agent identity and not a marked human terminal; agents prefix the command with ADL_AGENT_ID_AGENT=<agent-tarun|agent-vivek|agent-reviewer>; a human should read docs/operations/agent-permissions.md before enabling their own pass-through" >&2
+  exit 1
+fi
+
+# AGENT PATH.
+require_agent_identity "$ADL_AGENT_ID_AGENT" || exit 1
+
+# THIRD independent review (2026-09-29), item 3: `git lfs push|pull|fetch`
+# reaches here too now that `is_network_command_name` includes `lfs` (fixing
+# the live bug above) -- but git-lfs is a SEPARATE binary whose HTTP
+# credential resolution has not been verified to honor the
+# `http.<url>.extraHeader` mechanism the agent path below relies on (unlike
+# git itself, which this script's own tests prove reads it). Minting a
+# token and injecting a header git-lfs might silently ignore -- falling
+# back to ITS OWN Basic-auth `git credential fill` flow, bypassing the
+# identity model entirely -- is worse than refusing outright. The human
+# path above is UNAFFECTED: it execs the real git unchanged regardless of
+# `$git_command`, exactly like every other verb, so Tarun's own marked
+# terminal keeps using `git lfs` via his real credential helper as before.
+if [[ "$git_command" == "lfs" ]]; then
+  printf 'git-ado: git lfs against Azure DevOps remote %s is refused for the agent identity path (fail closed): git-lfs is a separate binary whose HTTP credential resolution has not been verified to honor this header mechanism. Run the underlying git fetch/push through git-ado directly, or ask Tarun to confirm LFS support before removing this refusal.\n' "$remote_url" >&2
+  exit 1
+fi
+
+# adl-agent-id mints the session and runs `agent-vault run -- <child>`. The
+# child asks `adl id token` for this agent's Entra token over the proxy
+# agent-vault just set up, and hands it to git as a GIT_CONFIG_* header --
+# never a -c flag, never an argv, never a log line -- scoped to
+# `$ado_host` (https://dev.azure.com/ for the common case, but ANY host
+# `is_ado_url` accepted above, e.g. an org's `*.visualstudio.com`) only,
+# never applied fleet-wide. The proxy and CA variables agent-vault set are
+# stripped before git runs: git must reach that host directly. An existing
+# caller GIT_CONFIG_COUNT is appended to, not replaced -- other inherited
+# GIT_CONFIG_KEY_N/VALUE_N pairs are left alone by `env`, which only touches
+# the names it is told to.
+#
+# ADL_AGENT_ID_ADDR and ADL_AGENT_ID_VAULT_ADDR are set to git-ado's own
+# constants here, OVERRIDING whatever the caller's environment carried --
+# adl-agent-id's `exec` resolves both only from the environment (there is no
+# --broker/--vault-addr flag path here), so this is the one place that
+# decides where the signed request and the vault session go. Any inherited
+# ADL_AGENT_ID_AGENT_VAULT_BIN is dropped too: adl-agent-id would otherwise
+# run whatever binary that named instead of the `agent-vault` this script
+# already confirmed is on PATH. ADL_AGENT_ID_STORE is deliberately left
+# alone -- adl-agent-id 0.4.1 does not read it at all (the passport store
+# location is fixed from the OS account, never from the environment), so
+# there is nothing here for a caller to redirect.
+exec env -u ADL_AGENT_ID_AGENT_VAULT_BIN \
+  ADL_AGENT_ID_ADDR="$ADL_AGENT_ID_ADDR_CONST" \
+  ADL_AGENT_ID_VAULT_ADDR="$ADL_AGENT_ID_VAULT_ADDR_CONST" \
+  adl-agent-id exec --agent "$ADL_AGENT_ID_AGENT" -- sh -c '
+  set -eu
+  agent="$1"; real_git="$2"; repo="$3"; ado_host="$4"; shift 4
+  # Validate BEFORE minting a token: a bad count can never produce a usable
+  # header, so there is no reason to spend a token mint finding that out.
+  # Unquoted arithmetic on a non-numeric value would otherwise either treat
+  # it as an unset nested variable (an "unbound variable" abort under set -u
+  # for anything letter-led) or silently compute a negative index that never
+  # matches what git reads (GIT_CONFIG_COUNT=-1 -> new_count=0, so the header
+  # this script just set is never seen). A leading zero is read as octal and a
+  # huge value wraps negative, with the same silent loss, so only canonical
+  # decimals 0-999 are accepted.
+  existing_count="${GIT_CONFIG_COUNT:-0}"
+  case "$existing_count" in
+    0|[1-9]|[1-9][0-9]|[1-9][0-9][0-9]) ;;
+    *)
+      echo "git-ado: GIT_CONFIG_COUNT must be a non-negative integer (0-999, no leading zero), got: $existing_count" >&2
+      exit 1
+      ;;
+  esac
+  token="$(adl id token "$agent")"
+  [ -n "$token" ] || { echo "git-ado: adl id token returned no access token for $agent" >&2; exit 1; }
+  new_count=$((existing_count + 1))
+  key_name="GIT_CONFIG_KEY_${existing_count}"
+  val_name="GIT_CONFIG_VALUE_${existing_count}"
+  # Case-insensitive, POSIX `case` (not `[ "${repo#https://}" != "$repo" ]`,
+  # which strips case-sensitively -- this is `sh`, not bash, so no
+  # `has_https_scheme` function from the outer script to call either).
+  case "$repo" in
+    [Hh][Tt][Tt][Pp][Ss]://*)
+      exec env -u HTTPS_PROXY -u HTTP_PROXY -u https_proxy -u http_proxy -u ALL_PROXY -u NO_PROXY \
+        -u AGENT_VAULT_TOKEN -u AGENT_VAULT_ADDR -u AGENT_VAULT_VAULT -u GIT_SSL_CAINFO -u SSL_CERT_FILE \
+        -u CURL_CA_BUNDLE -u REQUESTS_CA_BUNDLE -u NODE_EXTRA_CA_CERTS \
+        GIT_TERMINAL_PROMPT=0 GIT_CONFIG_COUNT="$new_count" \
+        "$key_name=http.https://$ado_host/.extraHeader" \
+        "$val_name=Authorization: Bearer $token" \
+        "$real_git" "$@"
+      ;;
+  esac
+  exec env -u HTTPS_PROXY -u HTTP_PROXY -u https_proxy -u http_proxy -u ALL_PROXY -u NO_PROXY \
+    -u AGENT_VAULT_TOKEN -u AGENT_VAULT_ADDR -u AGENT_VAULT_VAULT -u GIT_SSL_CAINFO -u SSL_CERT_FILE \
+    -u CURL_CA_BUNDLE -u REQUESTS_CA_BUNDLE -u NODE_EXTRA_CA_CERTS \
+    GIT_TERMINAL_PROMPT=0 GIT_CONFIG_COUNT="$new_count" \
+    "$key_name=http.https://$ado_host/.extraHeader" \
+    "$val_name=Authorization: Bearer $token" \
+    "$real_git" -C "$repo" "$@"
+' _ "$ADL_AGENT_ID_AGENT" "$real_git" "$repo" "$ado_host" "$@"

package/bin/global-agents

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/.." && pwd)"
+
+command -v bun >/dev/null 2>&1 || {
+  echo "global-agents requires bun; reconcile the global-tools manifest first" >&2
+  exit 1
+}
+
+exec bun "$repo_root/packages/agent-settings/src/global-agents.ts" "$@"

package/bin/global-surface-sweep

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/.." && pwd)"
+
+command -v bun >/dev/null 2>&1 || {
+  echo "global-surface-sweep requires bun; reconcile the global-tools manifest first" >&2
+  exit 1
+}
+
+exec bun "$repo_root/packages/agent-settings/src/global-surface-sweep.ts" "$@"

package/bin/health-check

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+device="${1:-}"
+[[ -n "$device" ]] || { echo "usage: health-check DEVICE" >&2; exit 2; }
+
+git --version >/dev/null
+jq --version >/dev/null
+curl -4 -fsS --max-time 20 https://api.ipify.org >/dev/null
+
+if command -v tailscale >/dev/null 2>&1; then
+  tailscale status --self --json 2>/dev/null |
+    jq -e '.Self.Online == true' >/dev/null
+fi
+
+case "$device" in
+  m5)
+    launchctl print system/vsts.agent.amsterdamdatalabs.Default.mac-m5-ci 2>/dev/null |
+      grep -q 'state = running'
+    ;;
+  hostinger-vps-1)
+    systemctl is-active --quiet docker tailscaled enact-agent-vault
+    for container_name in nordvpn-exit-gluetun-1 nordvpn-exit-tailscale-1 traefik-traefik-1; do
+      [[ "$(docker inspect -f '{{.State.Running}}' "$container_name" 2>/dev/null)" == true ]] || {
+        echo "required container is not running: $container_name" >&2
+        exit 1
+      }
+    done
+    ;;
+  m3|strato-vps-1)
+    # Declared for plan validation, but not part of the first deployment wave.
+    ;;
+  *) echo "unknown device: $device" >&2; exit 2 ;;
+esac
+
+echo "global-tools health: OK ($device)"

package/bin/kimi-hooks

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/.." && pwd)"
+
+command -v bun >/dev/null 2>&1 || {
+  echo "kimi-hooks requires bun; reconcile the global-tools manifest first" >&2
+  exit 1
+}
+
+exec bun "$repo_root/packages/agent-settings/src/kimi-hooks.ts" "$@"