@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/agent-hooks/src/rules/shell/piped-script.ts

@@ -0,0 +1,201 @@
+/**
+ * What a shell reads as its script when a pipe feeds its stdin.
+ *
+ * Two questions, both answered conservatively:
+ *
+ * - Is the content remote? A pipeline stage (or a `$(...)`/`<(...)`/backtick
+ *   anywhere in the runner's words) that runs a network fetcher (`curl`,
+ *   `wget`, PowerShell's `iwr`/`irm`, ...) means the shell executes content
+ *   nobody inspected — `shell.remote-script-exec`.
+ * - Can the script text be known? Only for a lone `echo`/`printf` stage whose
+ *   raw words are fully static literals (unquoted safe characters, single
+ *   quotes, or double quotes with no `$`, backtick, backslash or `!`). Echo's
+ *   `-n`/`-e`/`-E` and printf's `%s`/`%%` formats with `\n`/`\t`/`\\` escapes
+ *   are reproduced; anything else returns null and the caller fails closed.
+ */
+
+import { basename, type Token, tokenValue } from './token.ts'
+import { skipPrefixes } from './prefixes.ts'
+import { splitShell } from './split.ts'
+import { nestedSources } from './substitution.ts'
+import { tokenize } from './token.ts'
+
+export const REMOTE_FETCHERS: ReadonlySet<string> = new Set([
+  'curl',
+  'curlie',
+  'wget',
+  'wget2',
+  'fetch',
+  'http',
+  'https',
+  'xh',
+  'xhs',
+  'aria2c',
+  'lwp-request',
+  'iwr',
+  'irm',
+  'invoke-webrequest',
+  'invoke-restmethod',
+])
+
+/** PowerShell's `iex`: runs its pipeline input as code. */
+export const EXPRESSION_RUNNERS: ReadonlySet<string> = new Set(['iex', 'invoke-expression'])
+
+const commandName = (token: Token): string => basename(token).replace(/\.exe$/, '')
+
+/** The fetcher a stage runs directly or inside any substitution in its words, or null. */
+export function stageFetcher(tokens: readonly Token[]): string | null {
+  const index = skipPrefixes(tokens)
+  const first = tokens[index]
+  if (first !== undefined && REMOTE_FETCHERS.has(commandName(first))) return commandName(first)
+  for (const token of tokens) {
+    const fetcher = wordFetcher(tokenValue(token))
+    if (fetcher !== null) return fetcher
+  }
+  return null
+}
+
+/** The fetcher run inside a `$(...)`, `<(...)`/`>(...)` or backtick of `word`, or null. */
+export function wordFetcher(word: string): string | null {
+  if (!/[$`<>]/.test(word)) return null
+  for (const source of nestedSources(word).sources) {
+    const fetcher = sourceFetcher(source)
+    if (fetcher !== null) return fetcher
+  }
+  return null
+}
+
+function sourceFetcher(source: string): string | null {
+  for (const piece of splitShell(source).pieces) {
+    const fetcher = stageFetcher(tokenize(piece).tokens)
+    if (fetcher !== null) return fetcher
+  }
+  return null
+}
+
+const SAFE_UNQUOTED = /[A-Za-z0-9_./:=@%+,^-]/
+
+/** The words of `text` when every one is a static literal; null for anything the shell would expand or reinterpret. */
+function staticWords(text: string): string[] | null {
+  const words: string[] = []
+  let index = 0
+  const input = text.trim()
+  while (index < input.length) {
+    while (input[index] === ' ' || input[index] === '\t') index += 1
+    if (index >= input.length) break
+    let word = ''
+    while (index < input.length && input[index] !== ' ' && input[index] !== '\t') {
+      const char = input[index] as string
+      if (char === "'" || char === '"') {
+        const close = input.indexOf(char, index + 1)
+        if (close < 0) return null
+        const content = input.slice(index + 1, close)
+        if (char === '"' && /[$`\\!]/.test(content)) return null
+        word += content
+        index = close + 1
+        continue
+      }
+      if (!SAFE_UNQUOTED.test(char)) return null
+      word += char
+      index += 1
+    }
+    words.push(word)
+  }
+  return words
+}
+
+const ESCAPES: Readonly<Record<string, string>> = { n: '\n', t: '\t', '\\': '\\' }
+
+/** Interpret `\n`, `\t`, `\\` (plus `extra`); null on any other escape. */
+function interpretEscapes(text: string, extra: Readonly<Record<string, string>> = {}): string | null {
+  let out = ''
+  for (let index = 0; index < text.length; index += 1) {
+    const char = text[index] as string
+    if (char !== '\\') {
+      out += char
+      continue
+    }
+    const next = text[index + 1]
+    const replacement = next === undefined ? undefined : (ESCAPES[next] ?? extra[next])
+    if (replacement === undefined) return null
+    out += replacement
+    index += 1
+  }
+  return out
+}
+
+function echoOutput(args: readonly string[]): string | null {
+  let index = 0
+  let newline = true
+  let escapes = false
+  while (index < args.length && /^-[neE]+$/.test(args[index] as string)) {
+    for (const flag of (args[index] as string).slice(1)) {
+      if (flag === 'n') newline = false
+      else escapes = flag === 'e'
+    }
+    index += 1
+  }
+  const joined = args.slice(index).join(' ')
+  // Without -e, bash prints backslashes literally but sh/dash's echo interprets them: unknowable, so fail closed.
+  const body = escapes ? interpretEscapes(joined) : joined.includes('\\') ? null : joined
+  return body === null ? null : body + (newline ? '\n' : '')
+}
+
+type FormatPart = { readonly literal: string } | { readonly slot: true }
+
+function parseFormat(format: string): FormatPart[] | null {
+  const parts: FormatPart[] = []
+  let literal = ''
+  for (let index = 0; index < format.length; index += 1) {
+    const char = format[index] as string
+    if (char === '%') {
+      const next = format[index + 1]
+      index += 1
+      if (next === '%') literal += '%'
+      else if (next === 's') {
+        parts.push({ literal }, { slot: true })
+        literal = ''
+      } else return null
+      continue
+    }
+    literal += char
+  }
+  parts.push({ literal })
+  const unescaped: FormatPart[] = []
+  for (const part of parts) {
+    if ('slot' in part) {
+      unescaped.push(part)
+      continue
+    }
+    const text = interpretEscapes(part.literal, { '"': '"', "'": "'" })
+    if (text === null) return null
+    unescaped.push({ literal: text })
+  }
+  return unescaped
+}
+
+function printfOutput(rawArgs: readonly string[]): string | null {
+  const args = rawArgs[0] === '--' ? rawArgs.slice(1) : rawArgs
+  const format = args[0]
+  if (format === undefined || format.startsWith('-')) return null
+  const parts = parseFormat(format)
+  if (parts === null) return null
+  const values = args.slice(1)
+  const slots = parts.filter((part) => 'slot' in part).length
+  let out = ''
+  let consumed = 0
+  do {
+    for (const part of parts) out += 'slot' in part ? (values[consumed++] ?? '') : part.literal
+  } while (slots > 0 && consumed < values.length)
+  return out
+}
+
+/** The exact text a lone static `echo`/`printf` stage writes, or null when it cannot be known. */
+export function staticProducerOutput(stageText: string): string | null {
+  const words = staticWords(stageText)
+  if (words === null || words.length === 0) return null
+  const [name, ...args] = words
+  if (name === 'echo') return echoOutput(args)
+  if (name === 'printf') return printfOutput(args)
+  return null
+}

package/packages/agent-hooks/src/rules/shell/prefixes.ts

@@ -0,0 +1,214 @@
+/**
+ * Wrapper-command skipping.
+ *
+ * Ported from `.agents/hooks/pre-tool-use/utils/shell-parser.mjs:66-217`. A
+ * command run through `sudo`, `env`, `timeout`, `nice`, `caffeinate`, `arch`,
+ * `exec`, `time`, `stdbuf`, `setsid`, `command`, `doas`, `nohup` or `gtimeout`
+ * (any nesting of them) must be classified by the command it wraps, not by
+ * the wrapper — `timeout 90 git reset --hard` is `git reset --hard` wearing a
+ * timeout. `skipPrefixes` walks past the wrapper's own flags/arguments so the
+ * caller lands on the wrapped command.
+ */
+
+import { basename, isAssignment, skipRedirections, type Token, tokenValue } from './token.ts'
+
+export const GIT_GLOBAL_TAKES_ARG = new Set([
+  '-C',
+  '-c',
+  '--git-dir',
+  '--work-tree',
+  '--namespace',
+  '--super-prefix',
+  '--config-env',
+])
+export const GIT_GLOBAL_EQ = ['--exec-path=', '--git-dir=', '--work-tree=', '--namespace=', '--super-prefix=', '--config-env=']
+
+/**
+ * Git front-end options that print information (or an option error) and exit
+ * before dispatching any following subcommand-shaped argv. `--exec-path=<p>`
+ * is deliberately absent: with a value it changes the helper search path and
+ * continues to the real subcommand. `--list-cmds` requires `=`, but its bare
+ * invalid form still exits before a following argv and must not be re-read as
+ * a subcommand.
+ *
+ * Exported for `../shell/git-identity.ts`'s offset-aware rewrite scan, which
+ * ports `scanGitGlobals` onto span-carrying words: a terminal global means the
+ * invocation prints and runs nothing, so there is nothing to carry an
+ * identity into.
+ */
+export const GIT_TERMINAL_GLOBALS = new Set([
+  '-v',
+  '--version',
+  '-h',
+  '--help',
+  '--exec-path',
+  '--html-path',
+  '--man-path',
+  '--info-path',
+  '--list-cmds',
+])
+
+export interface GitGlobalsScan {
+  readonly index: number
+  readonly terminal: boolean
+}
+
+export const COMMAND_PREFIXES = new Set([
+  'sudo',
+  'doas',
+  'command',
+  'env',
+  'exec',
+  'nice',
+  'nohup',
+  'time',
+  'timeout',
+  'gtimeout',
+  'stdbuf',
+  'caffeinate',
+  'setsid',
+  'arch',
+])
+
+export function scanGitGlobals(tokens: readonly Token[], start: number): GitGlobalsScan {
+  let index = start
+  while (index < tokens.length) {
+    const token = tokenValue(tokens[index] as Token)
+    if (GIT_TERMINAL_GLOBALS.has(token) || token.startsWith('--list-cmds=')) return { index, terminal: true }
+    if (GIT_GLOBAL_TAKES_ARG.has(token)) {
+      index += 2
+      continue
+    }
+    if (GIT_GLOBAL_EQ.some((prefix) => token.startsWith(prefix)) || (token.startsWith('-c') && token.includes('=') && token !== '-c')) {
+      index += 1
+      continue
+    }
+    if (token === '--') {
+      index += 1
+      break
+    }
+    if (token.startsWith('-') && token !== '-' && token !== '--') {
+      index += 1
+      continue
+    }
+    break
+  }
+  return { index, terminal: false }
+}
+
+export function skipGitGlobals(tokens: readonly Token[], start: number): number {
+  return scanGitGlobals(tokens, start).index
+}
+
+function skipWrapperFlags(tokens: readonly Token[], start: number, withValue: readonly string[]): number {
+  let index = start
+  while (index < tokens.length) {
+    const token = tokenValue(tokens[index] as Token)
+    if (token === '--') {
+      index += 1
+      break
+    }
+    if (withValue.includes(token)) {
+      index += 2
+      continue
+    }
+    if (token.startsWith('-') && token !== '-') {
+      index += 1
+      continue
+    }
+    break
+  }
+  return index
+}
+
+function skipEnvFlags(tokens: readonly Token[], start: number): number {
+  let index = start
+  while (index < tokens.length) {
+    const token = tokenValue(tokens[index] as Token)
+    if (token === '--') return index + 1
+    if (['-u', '--unset', '-C', '--chdir', '-S', '--split-string'].includes(token)) {
+      index += 2
+      continue
+    }
+    if (token.startsWith('--unset=') || token.startsWith('--chdir=') || token.startsWith('-') || token.includes('=')) {
+      index += 1
+      continue
+    }
+    break
+  }
+  return index
+}
+
+function skipDashOptions(
+  tokens: readonly Token[],
+  start: number,
+  valueOptions: readonly string[],
+  stopAtDoubleDash = false,
+): number {
+  let index = start
+  while (index < tokens.length && tokenValue(tokens[index] as Token).startsWith('-')) {
+    const token = tokenValue(tokens[index] as Token)
+    if (stopAtDoubleDash && token === '--') return index + 1
+    index += valueOptions.includes(token) ? 2 : 1
+  }
+  return index
+}
+
+function skipRepeatedTokens(tokens: readonly Token[], start: number, options: readonly string[]): number {
+  let index = start
+  while (index < tokens.length && options.includes(tokenValue(tokens[index] as Token))) index += 1
+  return index
+}
+
+function skipCommandFlags(tokens: readonly Token[], start: number): number {
+  const first = tokens[start]
+  if (first !== undefined && ['-v', '-V'].includes(tokenValue(first))) return tokens.length
+  return skipRepeatedTokens(tokens, start, ['--', '-p'])
+}
+
+function skipExecFlags(tokens: readonly Token[], start: number): number {
+  const first = tokens[start]
+  const index = first !== undefined && tokenValue(first) === '-a' ? start + 2 : start
+  return skipRepeatedTokens(tokens, index, ['--'])
+}
+
+function skipTimeoutFlags(tokens: readonly Token[], start: number): number {
+  const index = skipWrapperFlags(tokens, start, ['-s', '--signal', '-k', '--kill-after'])
+  return index < tokens.length ? index + 1 : index
+}
+
+const PREFIX_HANDLERS: Readonly<Record<string, (tokens: readonly Token[], start: number) => number>> = {
+  env: skipEnvFlags,
+  command: skipCommandFlags,
+  sudo: (tokens, start) => skipDashOptions(tokens, start, ['-u', '-g', '-C', '--user', '--group'], true),
+  doas: (tokens, start) => skipDashOptions(tokens, start, ['-u', '-g', '-C', '--user', '--group'], true),
+  nice: (tokens, start) => skipDashOptions(tokens, start, ['-n', '--adjustment']),
+  exec: skipExecFlags,
+  time: (tokens, start) => skipDashOptions(tokens, start, ['-o', '--output']),
+  timeout: skipTimeoutFlags,
+  gtimeout: skipTimeoutFlags,
+  stdbuf: (tokens, start) => skipWrapperFlags(tokens, start, ['-i', '-o', '-e']),
+  caffeinate: (tokens, start) => skipWrapperFlags(tokens, start, ['-t', '-w']),
+  arch: (tokens, start) => skipWrapperFlags(tokens, start, ['-arch']),
+  setsid: (tokens, start) => skipWrapperFlags(tokens, start, []),
+}
+
+function skipPrefixArguments(name: string, tokens: readonly Token[], start: number): number {
+  const handler = PREFIX_HANDLERS[name]
+  return handler ? handler(tokens, start) : skipDashOptions(tokens, start, [], true)
+}
+
+/** Walk past leading assignments, redirections, and any nesting of wrapper commands. */
+export function skipPrefixes(tokens: readonly Token[]): number {
+  let index = 0
+  while (index < tokens.length && isAssignment(tokens[index] as Token)) index += 1
+  index = skipRedirections(tokens, index)
+
+  while (index < tokens.length && COMMAND_PREFIXES.has(basename(tokens[index] as Token))) {
+    const name = basename(tokens[index] as Token)
+    index = skipPrefixArguments(name, tokens, skipRedirections(tokens, index + 1))
+    while (index < tokens.length && isAssignment(tokens[index] as Token)) index += 1
+    index = skipRedirections(tokens, index)
+  }
+  return index
+}

package/packages/agent-hooks/src/rules/shell/protected-carrier-writes.ts

@@ -0,0 +1,108 @@
+/**
+ * Filesystem writes into one of the seven tamper-protected carrier files —
+ * the shell-command half of `agent.tamper-protection`.
+ *
+ * That rule's `match()` used to see only `tool-call` Write/Edit/MultiEdit/
+ * NotebookEdit/Patch; a shell command reaching the same file through `>`,
+ * `tee`, `mv`, `cp`, `install`, `ln -sf`, `sed -i`/`perl -pi`, `truncate`,
+ * `trash`/`rm`/`unlink`/`shred`, or `dd of=` was invisible to it — measured
+ * `{blocked: false}` against the real engine, closed here (STATUS.md 12p,
+ * decision 13 follow-up, 2026-09-29).
+ *
+ * Deliberately mirrors `git-internals.ts`'s own redirection/operand
+ * extraction (same incident shape: a denied edit tool is not the only way to
+ * mutate a file) instead of re-deriving it — `nonOptionArgs`/`copyDestination`/
+ * `inPlaceEditFiles`/`redirectionWriteTargets`/`withoutRedirections` are the
+ * exact pure, path-agnostic pieces `git-internals.ts` already built and
+ * tests; only the verb vocabulary (`shred` added; `chmod` added; `rsync`
+ * added — P2, independent review, 2026-09-29, unlike `git-internals.ts`'s
+ * own carve-out for `.git/hooks` there is no such exemption needed here;
+ * `chown`/`chgrp` still excluded, not named by that finding) and the path
+ * predicate (`protectedCarrierMatch`/`protectedCarrierDirMatch` instead of
+ * `isGitInternalsPath`) differ. `git rm`/`mv`/`checkout --`/`restore --`/
+ * `reset --` are NOT handled here — those are `'git'`-kind Invocations, not
+ * generic commands, and are checked directly in
+ * `impl/agent-tamper-protection.ts`.
+ *
+ * P2 also asked for `mv`/`cp -r`/`rsync` onto (or, for `mv`, of) a carrier
+ * DIRECTORY (`.claude`/`.codex`/`.cursor`/`.opencode` — deleting or
+ * overwriting the whole directory takes the carrier file inside it with
+ * it) — covered by the SAME candidate extraction as the file-level check,
+ * just also filtered through `protectedCarrierDirMatch`. `tar -x`/
+ * `unzip -o` extracting INTO one of these directories are a KNOWN, NOT
+ * covered gap — see `protected-carriers.ts`'s own doc on
+ * `PROTECTED_CARRIER_DIRS` for why.
+ *
+ * Wired into `shell/invocation.ts`'s `walk()` exactly like
+ * `gitInternalsWriteTargets` — unconditionally, ahead of the command's own
+ * classification, which is what makes nested `bash -c`/`sh -c` (and every
+ * other already-recursive shell construct `walk()` handles) covered for
+ * free: this runs on every walked piece, top-level or nested.
+ *
+ * A dynamic/unresolvable write target (`$(git rev-parse --show-toplevel)/…`)
+ * is already denied fail-closed by the EXISTING, target-agnostic
+ * `unresolvableRedirectionWriteTargets`/`unresolvableOperandWriteTargets`
+ * checks in `walk()` — those fire on ANY dynamic write target, not only a
+ * `.git` one, so no separate "uncertain" path is needed here.
+ */
+
+import { copyDestination, inPlaceEditFiles, nonOptionArgs, redirectionWriteTargets, withoutRedirections } from './git-internals.ts'
+import { protectedCarrierDirMatch, protectedCarrierMatch } from './protected-carriers.ts'
+import type { Token } from './token.ts'
+import { tokenValue } from './token.ts'
+
+/** Tools where EVERY non-option operand is a candidate write target (source or destination alike — `mv a b` can move either INTO or OUT OF a protected path). */
+const ANY_OPERAND = new Set(['rm', 'rm.exe', 'unlink', 'unlink.exe', 'trash', 'trash.exe', 'shred', 'shred.exe', 'mv', 'truncate', 'tee', 'chmod', 'chmod.exe'])
+/** Tools where only the DESTINATION is a candidate write target. */
+const COPY_LIKE = new Set(['cp', 'ln', 'install'])
+
+/** `rsync ... SRC DEST` — the last positional operand is the destination (P2, independent review, 2026-09-29). */
+function rsyncDestination(args: readonly Token[]): string | null {
+  const positional = nonOptionArgs(args)
+  return positional.length >= 2 ? (positional[positional.length - 1] as string) : null
+}
+
+/** `dd of=FILE` — the only `dd` operand this rule treats as a write target. */
+function ddDestinations(args: readonly Token[]): readonly string[] {
+  return args
+    .map(tokenValue)
+    .filter((value) => value.startsWith('of='))
+    .map((value) => value.slice('of='.length))
+}
+
+/** The write-target candidates `name args...` (with its whole token list, for redirections) produces, before the protected-carrier filter. */
+function writeTargetCandidates(name: string, rawArgs: readonly Token[], tokens: readonly Token[]): readonly string[] {
+  const candidates: string[] = [...redirectionWriteTargets(tokens)]
+  const args = withoutRedirections(rawArgs)
+  if (ANY_OPERAND.has(name)) candidates.push(...nonOptionArgs(args))
+  else if (COPY_LIKE.has(name)) {
+    const destination = copyDestination(args)
+    if (destination !== null) candidates.push(destination)
+  } else if (name === 'rsync') {
+    const destination = rsyncDestination(args)
+    if (destination !== null) candidates.push(destination)
+  } else if (name === 'sed' || name === 'perl') candidates.push(...inPlaceEditFiles(args, name))
+  else if (name === 'dd') candidates.push(...ddDestinations(args))
+  return candidates
+}
+
+/**
+ * A candidate built from a command substitution (`$(...)`, backticks) other
+ * than a process substitution (`<(...)`/`>(...)`) — its real value cannot be
+ * known statically. Left OUT of this rule's own candidates on purpose: the
+ * generic, target-agnostic `unresolvableRedirectionWriteTargets`/
+ * `unresolvableOperandWriteTargets` checks in `shell/invocation.ts`'s
+ * `walk()` already fail closed on ANY dynamic write target via
+ * `parse.uncertain`, whether or not it happens to end in a protected suffix
+ * — so a dynamic candidate here would only ever race that existing check for
+ * the same command, and `parse.uncertain`'s fail-closed message is the one
+ * that should win (mirrors `git-internals.ts`'s own `isUnresolvableWriteTarget`).
+ */
+const isDynamicCandidate = (target: string): boolean => /\$\(|`/.test(target) && !/^[<>]\(/.test(target)
+
+/** The protected-carrier paths (files or, P2, directories) `name args...` (with its whole token list, for redirections) would write to. */
+export function protectedCarrierWriteTargets(name: string, rawArgs: readonly Token[], tokens: readonly Token[]): readonly string[] {
+  return writeTargetCandidates(name, rawArgs, tokens).filter(
+    (candidate) => !isDynamicCandidate(candidate) && (protectedCarrierMatch(candidate) !== null || protectedCarrierDirMatch(candidate) !== null),
+  )
+}

package/packages/agent-hooks/src/rules/shell/protected-carriers.ts

@@ -0,0 +1,149 @@
+/**
+ * The seven tamper-protected carrier files — one source of the list.
+ *
+ * Decision 13 (STATUS.md 12p, 2026-09-29) closure: `agent.tamper-protection`
+ * used to hard-code this Set inside `impl/agent-tamper-protection.ts` itself,
+ * which worked while the only consumer was that rule's own `tool-call`
+ * branch. Its shell-write coverage (`protected-carrier-writes.ts`) needs the
+ * SAME list one layer down, in `shell/`, which `impl/*.ts` rules import FROM
+ * — never the reverse — so the list moved here and `agent-tamper-protection.ts`
+ * now imports it back, rather than keeping two copies that could drift.
+ *
+ * Still hard-coded on purpose (not configurable): see
+ * `impl/agent-tamper-protection.ts`'s header for why an `adl-config.toml`
+ * allowlist for this rule would be the same "switch the gate off" hole it
+ * exists to close.
+ */
+
+/**
+ * The files an agent must not write, move over, copy over, truncate, delete,
+ * or in-place edit. Matched against the FULL path and against the basename
+ * (see `protectedCarrierMatch`) so `.claude/settings.json` and
+ * `/Users/x/repo/.claude/settings.json` both fire, but
+ * `.claude/SETTINGS.json.bak` does not (a different, longer basename, not a
+ * case difference — see `protectedCarrierMatch`'s own doc for why a case
+ * difference alone no longer escapes the match).
+ */
+export const PROTECTED_CARRIER_PATHS: ReadonlySet<string> = new Set([
+  '.claude/settings.json',
+  '.claude/settings.local.json',
+  '.codex/config.toml',
+  'adl-config.toml',
+  '.codex/hooks.json',
+  '.cursor/hooks.json',
+  '.opencode/plugins/adl-repo.ts',
+  // P2 (independent review, 2026-09-29): Kimi's ONLY carrier — a single,
+  // globally-installed `~/.kimi-code/config.toml` (STATUS.md 12p's
+  // "Hooks run only where adl hooks deploy has run" decision: Kimi stays
+  // global by design, proven from Kimi's own docs — no per-repo carrier
+  // exists for it at all). Deliberately a suffix-only entry, no leading
+  // `~`/home path baked in: the EXISTING suffix match
+  // (`protectedCarrierMatch`'s `candidate.endsWith('/'+target)`) already
+  // matches `~/.kimi-code/config.toml`, `$HOME/.kimi-code/config.toml`, and
+  // the fully-resolved `/Users/x/.kimi-code/config.toml` alike, with no
+  // separate home-relative resolution needed — the suffix is the same
+  // regardless of what resolves the leading `~`/`$HOME`/absolute prefix.
+  '.kimi-code/config.toml',
+])
+
+/**
+ * P2 (independent review, 2026-09-29): on a case-INSENSITIVE filesystem
+ * (macOS's default APFS/HFS+ — `darwin`), `.CLAUDE/Settings.JSON` opens the
+ * SAME file on disk as `.claude/settings.json`, so a purely case-sensitive
+ * string compare is a real bypass there, not merely cosmetic. Linux's
+ * default filesystems (ext4, …) ARE case-sensitive — `.CLAUDE/Settings.JSON`
+ * is a genuinely different, unrelated path there — so this is gated on the
+ * ACTUAL host platform (`process.platform`), not applied unconditionally.
+ */
+const CASE_INSENSITIVE_HOST_FS = process.platform === 'darwin'
+
+/**
+ * Collapse `//` to `/` and resolve `.`/`..` segments (POSIX-style, no
+ * filesystem access — this never has to be correct about symlinks, only
+ * about what STRING a shell command's own path argument denotes) — P2
+ * (independent review, 2026-09-29): `.codex/sub/../hooks.json` names
+ * `.codex/hooks.json` exactly as much as the already-normalized spelling
+ * does, and a purely textual suffix check misses it. A leading `..` (would
+ * escape above the argument's own root) is left as `..` — this function
+ * only normalizes WITHIN the given string, it does not know the real
+ * filesystem root to resolve past it.
+ */
+function normalizePath(path: string): string {
+  const absolute = path.startsWith('/')
+  const out: string[] = []
+  for (const segment of path.split('/')) {
+    if (segment === '' || segment === '.') continue
+    if (segment === '..' && out.length > 0 && out[out.length - 1] !== '..') {
+      out.pop()
+      continue
+    }
+    out.push(segment)
+  }
+  return (absolute ? '/' : '') + out.join('/')
+}
+
+/**
+ * The protected path `path` names — exact match or a trailing
+ * `/<protected>` suffix — or null. `path` is normalized first
+ * (`normalizePath`), and compared case-insensitively when the host
+ * filesystem is (`CASE_INSENSITIVE_HOST_FS`).
+ */
+export function protectedCarrierMatch(path: string): string | null {
+  const normalized = normalizePath(path)
+  const candidate = CASE_INSENSITIVE_HOST_FS ? normalized.toLowerCase() : normalized
+  for (const protectedPath of PROTECTED_CARRIER_PATHS) {
+    const target = CASE_INSENSITIVE_HOST_FS ? protectedPath.toLowerCase() : protectedPath
+    if (candidate === target) return protectedPath
+    if (candidate.endsWith(`/${target}`)) return protectedPath
+  }
+  return null
+}
+
+/**
+ * The per-host carrier DIRECTORIES — deleting, moving away, or overwriting
+ * the WHOLE directory removes (or replaces) the carrier file inside it too,
+ * exactly as much as touching that file directly (P2, independent review,
+ * 2026-09-29). `.claude`/`.codex`/`.cursor`/`.opencode` — Kimi's own
+ * `~/.kimi-code/` is deliberately NOT included: `mv ~/.kimi-code /tmp` is a
+ * genuinely different, much bigger blast radius (moving the user's whole
+ * Kimi config directory, not a repo-scoped host-config directory) that this
+ * finding did not name.
+ *
+ * Covers `mv`/`cp -r` (destination)/`rsync` (destination) via
+ * `protected-carrier-writes.ts`'s existing operand extraction — a
+ * DESTINATION overwriting the directory, or (for `mv`, which checks every
+ * operand) moving it away too. `tar -x`/`unzip -o` extracting INTO one of
+ * these directories (via `-C`/`-d`) are NOT covered — those tools' own
+ * target-directory flags are not among `protected-carrier-writes.ts`'s
+ * existing operand handlers, and adding them needs new, tool-specific
+ * parsing this pass did not have room for; noted rather than silently
+ * dropped.
+ */
+export const PROTECTED_CARRIER_DIRS: ReadonlySet<string> = new Set(['.claude', '.codex', '.cursor', '.opencode'])
+
+/**
+ * The protected carrier directory `path` names — exact match or a trailing
+ * `/<dir>` suffix — or null. Same normalization/case rules as
+ * `protectedCarrierMatch`.
+ *
+ * F7 (fourth independent review, 2026-09-29): `path` ending in a literal
+ * `/` (BEFORE normalization strips it for the comparison itself) means "a
+ * file goes INTO this directory" (`cp GLOBAL-AGENTS.md .claude/`, `mv
+ * notes.md .cursor/`) — the directory itself is untouched, only gaining an
+ * unrelated file — never "this directory is the thing being moved/
+ * overwritten" (`mv .claude .claude-old`, `mv attacker-stuff .codex` — no
+ * trailing slash on either). Trailing-slash candidates return null here on
+ * purpose; the FILE-level `protectedCarrierMatch` still catches an explicit
+ * `.cursor/hooks.json` destination regardless of this exemption.
+ */
+export function protectedCarrierDirMatch(path: string): string | null {
+  if (path.endsWith('/')) return null
+  const normalized = normalizePath(path)
+  const candidate = CASE_INSENSITIVE_HOST_FS ? normalized.toLowerCase() : normalized
+  for (const dir of PROTECTED_CARRIER_DIRS) {
+    const target = CASE_INSENSITIVE_HOST_FS ? dir.toLowerCase() : dir
+    if (candidate === target) return dir
+    if (candidate.endsWith(`/${target}`)) return dir
+  }
+  return null
+}