@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/rules/impl/git-helpers.ts

@@ -0,0 +1,408 @@
+/**
+ * Shared git-argument predicates.
+ *
+ * Ported from `.agents/hooks/pre-tool-use/utils/git-rules.mjs`, minus
+ * `protectedPathsInCommit` (moved into git-protected-tree.ts, where it reads
+ * `ctx.index: RepoIndexPort` instead of shelling out to `git` with a
+ * `checkIndex` boolean — see spec.ts's `RuleContext` doc for why that
+ * boolean is gone).
+ */
+
+import type { Token } from '../shell/token.ts'
+import { tokenValue } from '../shell/token.ts'
+
+export function hasFlag(rest: readonly Token[], ...flags: readonly string[]): boolean {
+  const set = new Set(flags)
+  return rest.some((token) => set.has(tokenValue(token)))
+}
+
+export function hasFlagOrCluster(rest: readonly Token[], longFlags: readonly string[], shortLetters: readonly string[]): boolean {
+  return rest.some((token) => {
+    const value = tokenValue(token)
+    if (longFlags.includes(value)) return true
+    if (value.startsWith('--') || !value.startsWith('-') || value.length < 2) return false
+    return [...value.slice(1)].some((ch) => shortLetters.includes(ch))
+  })
+}
+
+/** Every argument looks like `--help`/`--version` (or a lone `-h`) and nothing else — this subcommand prints text and runs nothing. */
+export function isHelpOnlyInvocation(rest: readonly Token[]): boolean {
+  const flags = new Set<string>()
+  for (const token of rest) {
+    const arg = tokenValue(token)
+    if (arg === '--') break
+    if (arg === '--help' || arg === '--version') flags.add('help')
+    if (arg === '-h' && rest.length === 1) flags.add('help')
+  }
+  return flags.has('help') && rest.every((token) => tokenValue(token).startsWith('-') && tokenValue(token) !== '--')
+}
+
+/**
+ * `--abort` or `--quit` and nothing else — the in-progress-operation exits
+ * shared by rebase/merge/cherry-pick/revert/am. Both only ever end the
+ * operation (restoring, or keeping, the current HEAD); git itself rejects any
+ * other argument alongside them.
+ */
+export function isSequencerRecoveryOnly(rest: readonly Token[]): boolean {
+  if (rest.length !== 1) return false
+  const value = tokenValue(rest[0] as Token)
+  return value === '--abort' || value === '--quit'
+}
+
+export function commitSkipsVerify(rest: readonly Token[], subcommand: string): boolean {
+  return rest.some((token) => {
+    const value = tokenValue(token)
+    if (value === '--no-verify') return true
+    return value === '-n' && subcommand === 'commit'
+  })
+}
+
+export function commitAmends(rest: readonly Token[]): boolean {
+  return hasFlag(rest, '--amend')
+}
+
+export function branchForceDeletes(rest: readonly Token[]): boolean {
+  if (hasFlagOrCluster(rest, [], ['D'])) return true
+  return hasFlagOrCluster(rest, ['--delete'], ['d']) && hasFlagOrCluster(rest, ['--force'], ['f'])
+}
+
+export function tagDeletes(rest: readonly Token[]): boolean {
+  return hasFlagOrCluster(rest, ['--delete'], ['d'])
+}
+
+export function switchIsForced(rest: readonly Token[]): boolean {
+  return hasFlagOrCluster(rest, ['--force'], ['f'])
+}
+
+/** `--prune=<date>` or a bare `--prune` (git's default expiry) — `--no-prune` is the opposite and is not matched. */
+export function gcPrunesExplicitly(rest: readonly Token[]): boolean {
+  return rest.some((token) => {
+    const value = tokenValue(token)
+    return value === '--prune' || value.startsWith('--prune=')
+  })
+}
+
+export function overridesHooksPath(tokens: readonly Token[]): boolean {
+  return tokens.some((token) => /core\.hookspath/i.test(tokenValue(token)))
+}
+
+export function flipsCoreBare(tokens: readonly Token[]): boolean {
+  return tokens.some((token) => /core\.bare/i.test(tokenValue(token)))
+}
+
+export function pathIsInProtectedTree(rawPath: string, protectedTrees: readonly string[]): boolean {
+  const path = `/${rawPath.replace(/^\.\//, '').replace(/\/+$/, '')}/`
+  return protectedTrees.some((tree) => path.includes(`/${tree}`))
+}
+
+export function moveEscapesRepo(rest: readonly Token[], protectedTrees: readonly string[]): boolean {
+  const paths = rest.map((token) => tokenValue(token)).filter((value) => !value.startsWith('-'))
+  if (paths.length < 2) return false
+  const destination = paths[paths.length - 1] as string
+  if (!paths.slice(0, -1).some((source) => pathIsInProtectedTree(source, protectedTrees))) return false
+  if (/[$`]/.test(destination)) return true
+  if (destination.startsWith('/') || destination.startsWith('~')) return true
+  return destination.split('/').includes('..')
+}
+
+const WHOLE_TREE_PATHSPEC = new Set(['.', './', '..', '../', '*', ':', ':/', ':/*', ':(top)'])
+
+export function namedPathspecs(tokens: readonly Token[]): readonly string[] {
+  const paths: string[] = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const value = tokenValue(tokens[index] as Token)
+    if (value === '--source' || value === '-s') {
+      index += 1
+      continue
+    }
+    if (value === '--' || value.startsWith('-')) continue
+    paths.push(value)
+  }
+  return paths
+}
+
+export function isNamedPathspecOnly(tokens: readonly Token[]): boolean {
+  const paths = namedPathspecs(tokens)
+  if (paths.length === 0) return false
+  return paths.every((value) => !WHOLE_TREE_PATHSPEC.has(value))
+}
+
+export function restoreIsStagedOnly(rest: readonly Token[]): boolean {
+  if (!hasFlagOrCluster(rest, ['--staged'], ['S'])) return false
+  if (hasFlagOrCluster(rest, ['--worktree'], ['W'])) return false
+  if (hasFlag(rest, '--ours', '--theirs', '--merge', '-m')) return false
+  if (rest.some((token) => tokenValue(token).startsWith('--conflict'))) return false
+  return isNamedPathspecOnly(rest)
+}
+
+export function resetIsPathspecOnly(rest: readonly Token[]): boolean {
+  if (hasFlag(rest, '--hard', '--soft', '--merge', '--keep')) return false
+  const dashIndex = rest.findIndex((token) => tokenValue(token) === '--')
+  if (dashIndex < 0 || dashIndex + 1 >= rest.length) return false
+  return isNamedPathspecOnly(rest.slice(dashIndex + 1))
+}
+
+export function updateIndexIsUnstageOnly(rest: readonly Token[]): boolean {
+  if (!rest.some((token) => tokenValue(token) === '--unstage')) return false
+  const flagsAreUnstageOnly = rest.every((token) => {
+    const value = tokenValue(token)
+    return value === '--unstage' || value === '--' || !value.startsWith('-')
+  })
+  return flagsAreUnstageOnly && isNamedPathspecOnly(rest)
+}
+
+/**
+ * `git push` destination classification shared by `adl.session-required-for-writes`
+ * and `adl.git-push-branch-policy` — moved here (2026-09-27, docs/architecture/cli-design.md
+ * decision 2 / docs/operations/agent-permissions.md) so the two rules cannot drift on what
+ * counts as an Azure DevOps push. Both decide statically, off argv alone: no
+ * `git remote get-url` subprocess (the deployed `bin/git` front controller can
+ * do that; a pre-tool-use hook decides before the child runs).
+ */
+export const ADO_HOST = 'dev.azure.com'
+
+/**
+ * The second Azure DevOps host the one-agent-identity standard names
+ * (STATUS.md 12p, "What the hook covers" — REST:
+ * curl/wget/httpie/xh to `dev.azure.com` / `*.visualstudio.com`). Widened
+ * 2026-09-28 alongside the identity-bearing command classes below;
+ * `isAdoUrl` used to check `dev.azure.com` alone.
+ */
+export const ADO_VISUALSTUDIO_HOST = 'visualstudio.com'
+
+export function isAdoUrl(value: string): boolean {
+  const lower = value.toLowerCase()
+  return lower.includes(ADO_HOST) || lower.includes(ADO_VISUALSTUDIO_HOST)
+}
+
+/**
+ * Identity-bearing `adl <...>` subcommand shapes
+ * (STATUS.md 12p "What the hook covers" / W2 build
+ * item 1): every one of these reaches Azure DevOps and needs the resolved
+ * agent identity, exactly like a network git command. Matched positionally
+ * against the words/tokens right after `adl` itself (case-insensitively,
+ * dynamic values excluded by the caller) — shared by the shell scanner
+ * (`../shell/git-identity.ts`, which needs the raw source span to rewrite)
+ * and the ordinary invocation-based rules (`adl-session-required.ts`, which
+ * only needs a yes/no match) so the two classifications cannot drift apart.
+ */
+export const ADL_IDENTITY_COMMAND_SHAPES: readonly (readonly string[])[] = [
+  ['mcp', 'cli'],
+  ['repo', 'doctor'],
+  ['repo', 'controls', 'azdo-push'],
+  ['id', 'token'],
+]
+
+/** `adl-agent-id exec` — the token-minting entry point; same reasoning as `ADL_IDENTITY_COMMAND_SHAPES`. */
+export const ADL_AGENT_ID_COMMAND_SHAPES: readonly (readonly string[])[] = [['exec']]
+
+/** `adl`'s own binary name spellings this repo's other name-matchers use (e.g. `git`/`git.exe`, `curl`/`curl.exe`). */
+export const ADL_BINARY_NAMES: ReadonlySet<string> = new Set(['adl', 'adl.exe'])
+export const ADL_AGENT_ID_BINARY_NAMES: ReadonlySet<string> = new Set(['adl-agent-id', 'adl-agent-id.exe'])
+
+/**
+ * curl/wget/httpie(`http`/`https`)/xh — the REST client family the standard
+ * names. Shared with `adl-session-required.ts`'s own `HTTP_CLIENT_NAMES` so
+ * the two classifications (this file's shape matcher vs. that rule's method
+ * inspection) cannot name a different set of binaries.
+ */
+export const HTTP_CLIENT_BINARY_NAMES: ReadonlySet<string> = new Set([
+  'curl',
+  'curl.exe',
+  'wget',
+  'wget.exe',
+  'http',
+  'http.exe',
+  'https',
+  'https.exe',
+  'xh',
+  'xh.exe',
+])
+
+const CURL_NAMES: ReadonlySet<string> = new Set(['curl', 'curl.exe'])
+const WGET_NAMES: ReadonlySet<string> = new Set(['wget', 'wget.exe'])
+const CURL_DATA_FLAGS: ReadonlySet<string> = new Set([
+  '-d',
+  '--data',
+  '--data-raw',
+  '--data-binary',
+  '--data-urlencode',
+  '-F',
+  '--form',
+  '--json',
+])
+
+/** curl's effective HTTP method: an explicit `-X`/`--request` wins; otherwise a data flag implies POST; otherwise GET. */
+function curlMethod(args: readonly Token[]): string {
+  let explicit: string | null = null
+  let hasData = false
+  for (let index = 0; index < args.length; index += 1) {
+    const value = tokenValue(args[index] as Token)
+    if (value === '-X' || value === '--request') {
+      const next = args[index + 1]
+      if (next !== undefined) explicit = tokenValue(next).toUpperCase()
+      index += 1
+      continue
+    }
+    if (value.startsWith('--request=')) {
+      explicit = value.slice('--request='.length).toUpperCase()
+      continue
+    }
+    if (value.startsWith('-X') && value.length > 2) {
+      explicit = value.slice(2).toUpperCase()
+      continue
+    }
+    if (CURL_DATA_FLAGS.has(value)) hasData = true
+  }
+  return explicit ?? (hasData ? 'POST' : 'GET')
+}
+
+const WGET_POST_PREFIXES = ['--post-data', '--post-file']
+
+/** wget's effective HTTP method: `--method=`, or `--post-data`/`--post-file`, imply a write; otherwise GET. */
+function wgetMethod(args: readonly Token[]): string {
+  for (const token of args) {
+    const value = tokenValue(token)
+    if (value.startsWith('--method=')) return value.slice('--method='.length).toUpperCase()
+    if (WGET_POST_PREFIXES.some((prefix) => value === prefix || value.startsWith(`${prefix}=`))) return 'POST'
+  }
+  return 'GET'
+}
+
+const HTTP_METHOD_NAMES: ReadonlySet<string> = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'])
+const HTTPIE_DATA_FLAGS: ReadonlySet<string> = new Set(['-f', '--form', '--raw'])
+
+/**
+ * httpie/xh request-item operators that mean a request BODY is being built:
+ * `field=value` (data), `field:=value` (raw JSON), `field=@file`/`field:=@file`
+ * (value from file), `field@file` (file upload). Deliberately EXCLUDES the
+ * bare `field==value` (query string — no body) and `Field:value` (header — no
+ * body) shapes, both of which leave the request a GET.
+ */
+const HTTPIE_DATA_ITEM = /^[^\s=:@]+(:=@|:=|=@|@|=)(?!=)/
+
+/**
+ * httpie/xh's effective HTTP method: an explicit method as the first
+ * positional argument wins (httpie's own syntax: `http POST url ...`);
+ * otherwise the request defaults to GET unless a data item or `--form`/`--raw`
+ * is present, in which case httpie itself defaults to POST.
+ */
+function httpieMethod(args: readonly Token[]): string {
+  let explicit: string | null = null
+  let hasDataItem = false
+  for (const token of args) {
+    const value = tokenValue(token)
+    if (value.startsWith('-')) {
+      if (HTTPIE_DATA_FLAGS.has(value)) hasDataItem = true
+      continue
+    }
+    if (/^https?:\/\//i.test(value)) continue // the URL itself, never a method or a data item
+    if (explicit === null && HTTP_METHOD_NAMES.has(value.toUpperCase())) {
+      explicit = value.toUpperCase()
+      continue
+    }
+    if (HTTPIE_DATA_ITEM.test(value)) hasDataItem = true
+  }
+  return explicit ?? (hasDataItem ? 'POST' : 'GET')
+}
+
+/**
+ * The effective HTTP method for an `HTTP_CLIENT_BINARY_NAMES` invocation,
+ * dispatched by binary name — curl/wget/httpie(`http`/`https`)/xh each spell
+ * their method differently. M10 (STATUS.md 12p): shared
+ * by `adl-session-required.ts` (deny with no identity, every method) and
+ * `tool-azure-devops.ts` (deny a WRITE method outright, identity or not —
+ * docs/operations/agent-permissions.md row 13) so the method-detection logic
+ * cannot drift between the two.
+ */
+export function httpClientMethod(name: string, args: readonly Token[]): string {
+  if (WGET_NAMES.has(name)) return wgetMethod(args)
+  if (CURL_NAMES.has(name)) return curlMethod(args)
+  return httpieMethod(args)
+}
+
+/**
+ * True when `values` (already lower-cased by the caller is NOT required —
+ * this lower-cases itself) matches one of `shapes` positionally, starting at
+ * index 0 of `values`. `values` is whatever sits immediately after the
+ * command name (e.g. `adl`'s own args) — the caller is responsible for
+ * excluding dynamic ($-expansion-carrying) values before calling this, since
+ * a dynamic value cannot be proven to match a shape.
+ */
+export function matchesIdentityShape(values: readonly string[], shapes: readonly (readonly string[])[]): boolean {
+  return shapes.some((shape) => shape.every((expected, index) => values[index]?.toLowerCase() === expected))
+}
+
+/**
+ * Drop leading dash-prefixed words — M5 (STATUS.md
+ * 12p): `adl-agent-id`'s own global flags (e.g. `--verbose`/`--quiet`)
+ * ahead of its `exec` subcommand, which `ADL_AGENT_ID_COMMAND_SHAPES`
+ * (`[['exec']]`) would otherwise require sitting at position 0 exactly —
+ * `adl-agent-id --verbose exec --agent agent-tarun -- ...` would not match
+ * at all, and the whole invocation would be silently invisible to every
+ * identity/role rule that keys off this shape. Boolean-only: a value-taking
+ * global flag is not a documented `adl-agent-id` shape today, so this does
+ * not try to consume one — a bare `-` (stdin marker) is not treated as a
+ * flag either. Shared by `../shell/git-identity.ts` (the rewrite scanner)
+ * and `adl-session-required.ts` so the two classifications cannot drift on
+ * this.
+ */
+export function skipLeadingDashFlags(values: readonly string[]): readonly string[] {
+  let index = 0
+  while (index < values.length && (values[index] as string).startsWith('-') && values[index] !== '-') index += 1
+  return values.slice(index)
+}
+
+/** The first `http(s)://` token in `rest`, or null when none appears. */
+function firstUrl(rest: readonly Token[]): string | null {
+  for (const token of rest) {
+    const value = tokenValue(token)
+    if (/^https?:\/\//i.test(value)) return value
+  }
+  return null
+}
+
+export type GitPushDestinationRisk = 'ado' | 'non-ado' | 'unresolved'
+
+/**
+ * Classify a `git push`'s destination from its argv alone. An explicit
+ * `https://.../dev.azure.com/...` URL anywhere in the arguments is
+ * authoritative; otherwise the destination is UNRESOLVED (a bare `git push`,
+ * or `git push origin main` naming a remote this function cannot look up) and
+ * callers must fail closed — unresolved is treated exactly like "proven
+ * Azure DevOps", never like "proven safe". Only an explicit NON-Azure-DevOps
+ * URL is provably safe.
+ */
+export function classifyGitPushDestination(rest: readonly Token[]): GitPushDestinationRisk {
+  const url = firstUrl(rest)
+  if (url === null) return 'unresolved'
+  return isAdoUrl(url) ? 'ado' : 'non-ado'
+}
+
+/**
+ * R3 (STATUS.md 12p): a coarse, TEXTUAL (not
+ * shell-parsed) signal that some string holds an identity-bearing token —
+ * used by `adl-session-required.ts`'s `identityBearingReason` for the two
+ * shapes the shell walker (`../shell/invocation.ts`) cannot see INTO at all:
+ * an interpreter one-liner's `-c`/`-e` code string (`python3 -c
+ * "...subprocess.run(['git','push'])..."` — the walker only re-parses
+ * `sh`/`bash`/`zsh`/`dash`/`ksh`/`fish` as nested shell, never an
+ * interpreter's own code), and an `env -S`/`--split-string` value (the
+ * walker's own `skipPrefixes` treats it as an opaque, value-taking flag
+ * argument and never looks inside it). Deliberately loose — a git network/
+ * credential verb following the word `git` anywhere in the text (not
+ * necessarily adjacent: `git.push(...)`/`['git','push']`-shaped code still
+ * matches), a literal `adl ` command word, `adl-agent-id`, or either Azure
+ * DevOps host. False positives (the text merely MENTIONS one of these) only
+ * cost an extra deny with a clear, actionable message; this is not the
+ * precise per-piece scanner and never claims to be.
+ */
+const GIT_NETWORK_OR_CREDENTIAL_VERBS = String.raw`(?:fetch|pull|clone|ls-remote|push|credential)`
+const IDENTITY_TOKEN_PATTERN = new RegExp(
+  String.raw`\bgit(?:\.exe)?\b[\s\S]*?\b${GIT_NETWORK_OR_CREDENTIAL_VERBS}\b` + String.raw`|\badl\s` + String.raw`|\badl-agent-id\b` + String.raw`|dev\.azure\.com` + String.raw`|visualstudio\.com`,
+  'i',
+)
+
+export function containsIdentityBearingToken(text: string): boolean {
+  return IDENTITY_TOKEN_PATTERN.test(text)
+}

package/packages/agent-hooks/src/rules/impl/git-history.ts

@@ -0,0 +1,77 @@
+/**
+ * `branch -D`, `tag -d`, `switch -f`, `gc --prune[=<date>]`.
+ * (`update-ref` in every form lives in git-plumbing.ts.)
+ *
+ * Ported from `blockedGitHistoryReason` in blocked-reason.mjs:78-86. None of
+ * these bypass on a bare `--help`/`--version` the way the "core" rules do —
+ * the original's `blockedGitPolicyReason` is called unconditionally, with no
+ * `rmIsHelpOnly` gate — so neither does this. All four fall through
+ * `classifyReason`'s default arm.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { branchForceDeletes, gcPrunesExplicitly, switchIsForced, tagDeletes } from './git-helpers.ts'
+import { defaultGitMessage, detailString } from './messages.ts'
+
+function git(inv: Invocation): (Invocation & { kind: 'git' }) | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+function make(id: string, subcommand: string, reasonFor: () => string, hits: (g: Invocation & { kind: 'git' }) => boolean, deny: readonly string[], allow: readonly string[]): RuleSpec {
+  return {
+    id,
+    category: 'git',
+    severity: 'deny',
+    enabledByDefault: true,
+    summary: `Deny git ${subcommand} when it force-discards history.`,
+    params: noParams,
+    match(inv): Finding | null {
+      const g = git(inv)
+      if (!g || g.subcommand !== subcommand) return null
+      if (!hits(g)) return null
+      return { ruleId: id, severity: 'deny', detail: { reason: reasonFor() } }
+    },
+    message(finding: Finding, ctx: MessageContext) {
+      return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+    },
+    corpus: { deny, allow },
+  }
+}
+
+export const gitBranchForceDelete = make(
+  'git.branch-force-delete',
+  'branch',
+  () => 'git branch -D',
+  (g) => branchForceDeletes(g.rest),
+  ['git branch -D old-feature', 'git branch -aD', 'git branch --delete --force old-feature'],
+  ['git branch -d merged-feature', 'git branch feature-x', 'git branch -a'],
+)
+
+export const gitTagDelete = make(
+  'git.tag-delete',
+  'tag',
+  () => 'git tag -d',
+  (g) => tagDeletes(g.rest),
+  ['git tag -d v1.0.0', 'git tag --delete v1.0.0'],
+  ['git tag v1.0.0', 'git tag -l'],
+)
+
+export const gitSwitchForce = make(
+  'git.switch-force',
+  'switch',
+  () => 'git switch -f',
+  (g) => switchIsForced(g.rest),
+  ['git switch -f main', 'git switch --force main'],
+  ['git switch main', 'git switch -c new-branch'],
+)
+
+export const gitGcPrune = make(
+  'git.gc-prune',
+  'gc',
+  () => 'git gc --prune',
+  (g) => gcPrunesExplicitly(g.rest),
+  ['git gc --prune=now', 'git gc --prune=1.day.ago', 'git gc --aggressive --prune'],
+  ['git gc', 'git gc --aggressive', 'git gc --no-prune'],
+)

package/packages/agent-hooks/src/rules/impl/git-paths.ts

@@ -0,0 +1,139 @@
+/**
+ * `git rm`, `git mv` out of a protected tree, `git checkout --`.
+ *
+ * Ported from `blockedGitPathReason` in blocked-reason.mjs:88-93. `git rm` is
+ * denied unconditionally — see the DENIED message below, ported verbatim
+ * from deny.mjs, for why every flag combination including `--cached` is
+ * refused rather than inspected.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { moveEscapesRepo } from './git-helpers.ts'
+import { defaultGitMessage, detailString, gitAgentTail, protectedTreesText } from './messages.ts'
+
+function git(inv: Invocation): (Invocation & { kind: 'git' }) | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+export const gitRm: RuleSpec = {
+  id: 'git.rm',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git rm in every form, including --cached.',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'rm') return null
+    return { ruleId: 'git.rm', severity: 'deny', detail: {} }
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user: 'Blocked git rm. It deletes tracked content and stages the deletion in one step; agents leave the file in place and hand the removal to you.',
+      agent:
+        'DENIED git rm. Every form is refused - with flags or without, --cached included. `git rm` deletes ' +
+        'tracked content AND stages the deletion in one step, so it is both the delete and the commit-prep ' +
+        'for it, and it was the last deletion verb this hook left open after rm and trash were closed. ' +
+        'There is no flag that makes it acceptable and no `git rm` that this hook allows. ' +
+        'If a tracked file genuinely has to go: leave it exactly where it is, finish the rest of the change, ' +
+        'and tell the user which paths should be removed and why - removal is theirs to run, the same rule ' +
+        `that already applies to committing a protected tree. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'git rm file.txt',
+      'git rm docs/old-page.md README.md',
+      'git rm .agents/sql/rules/parse-error.yml',
+      'git rm --cached file.txt',
+      'git rm -r somedir',
+      'git rm -f file.txt',
+      'git rm -rf somedir',
+      'git rm -fr somedir',
+      'git rm --recursive somedir',
+      'git rm --force file.txt',
+      'git rm -- workflows/scripts/gates/x.sh',
+    ],
+    allow: ['git status', 'git add docs/operations/index.md'],
+  },
+}
+
+export const gitMvEscape: RuleSpec = {
+  id: 'git.mv-escape',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git mv that moves a protected tree outside the repository.',
+  params: noParams,
+  match(inv, ctx: RuleContext<Record<string, never>>): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'mv') return null
+    if (!moveEscapesRepo(g.rest, ctx.repo.protectedTrees)) return null
+    return {
+      ruleId: 'git.mv-escape',
+      severity: 'deny',
+      detail: { reason: 'git mv out of the repository', protectedTreesText: protectedTreesText(ctx.repo.protectedTrees) },
+    }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const reason = detailString(finding, 'reason')
+    const protectedText = detailString(finding, 'protectedTreesText')
+    return {
+      user: `Blocked ${reason.replace(' out of the repository', '')} moving a protected tree (${protectedText}) out of the repository. Renames inside the repo are fine; this one leaves nothing to restore from.`,
+      agent:
+        `DENIED ${reason}: a protected tree (${protectedText}) leaving the repository. Renaming or ` +
+        'relocating these files INSIDE the repository is allowed and is ordinary refactoring - ' +
+        '`mv .agents/a.yml .agents/b.yml` and `git mv .agents/a.yml docs/a.yml` both pass. ' +
+        'What is refused is a destination that leaves the worktree: an absolute path, a `~` path, a `..` that ' +
+        'climbs above the root, or an unexpanded $VAR the hook cannot resolve. That is a deletion of a gate ' +
+        "file with a rename's paperwork - nothing is left behind to restore from. Move it to a path inside " +
+        `the repository, or leave it in place and ask the user to remove it. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'git mv .agents/sql/rules/parse-error.yml ../parse-error.yml',
+      'git mv .agents/sql/rules/parse-error.yml /tmp/parse-error.yml',
+      'git mv .agents/cli/cmd-sql.sh ~/.Trash/cmd-sql.sh',
+      'git mv /Users/me/repo/.agents/hooks/block-git-destructive.mjs /tmp/hook.mjs',
+      'git mv .agents/sql/rules/parse-error.yml $DEST',
+      'git mv -f .agents/sql/rules/parse-error.yml ~/x.yml',
+    ],
+    allow: [
+      'git mv docs/a.md docs/b.md',
+      'git mv .agents/sql/rules/parse-error.yml .agents/sql/rules/retired.yml',
+      'git mv .agents/sql/rules/parse-error.yml .agents/pgsql/rules/parse-error.yml',
+      'git mv .agents/cli/cmd-sql.sh docs/cmd-sql.sh',
+      'git mv -k src/a.ts src/b.ts',
+      'git mv -- workflows/scripts/a.sh workflows/scripts/b.sh',
+      'git mv workflows/scripts/gates/x.sh ../../x.sh',
+      'git mv docs/a.md ../a.md',
+      'git mv src/a.ts /tmp/a.ts',
+    ],
+  },
+}
+
+export const gitCheckoutDashDash: RuleSpec = {
+  id: 'git.checkout-dashdash',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny `git checkout -- <path>` (discards working-tree changes).',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'checkout') return null
+    const hasDashDash = g.rest.some((token) => token.value === '--')
+    if (!hasDashDash) return null
+    return { ruleId: 'git.checkout-dashdash', severity: 'deny', detail: { reason: 'git checkout --' } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+  },
+  corpus: {
+    deny: ['git checkout -- frontend/packages/desktop/src/index.ts'],
+    allow: ['git switch main'],
+  },
+}