@amsterdamdatalabs/adl-agent-control-darwin-arm64 0.1.4

package/packages/repo-controls/assets/enable-integration-auto-complete.mjs

@@ -0,0 +1,79 @@
+// Managed by adl-repo-controls — do not edit installed copies.
+// Regenerate with: adl-repo-controls install --repo .
+import { pathToFileURL } from 'node:url'
+
+export const REQUIRED_ENVIRONMENT_NAMES = Object.freeze([
+  'AZURE_DEVOPS_TOKEN',
+  'AZURE_DEVOPS_COLLECTION_URI',
+  'AZURE_DEVOPS_PROJECT_ID',
+  'AZURE_DEVOPS_REPOSITORY_ID',
+  'AZURE_DEVOPS_PULL_REQUEST_ID',
+])
+
+function requireEnvironment(env) {
+  const values = {}
+  for (const name of REQUIRED_ENVIRONMENT_NAMES) {
+    const value = env[name]?.trim()
+    if (!value) throw new Error(`missing required environment: ${name}`)
+    values[name] = value
+  }
+  if (!/^[1-9]\d*$/.test(values.AZURE_DEVOPS_PULL_REQUEST_ID)) {
+    throw new Error('AZURE_DEVOPS_PULL_REQUEST_ID must be a positive integer')
+  }
+  return values
+}
+
+async function readResponse(response, action) {
+  const text = await response.text()
+  if (!response.ok) throw new Error(`${action} failed (${response.status}): ${text || response.statusText}`)
+  if (!text) return {}
+  try {
+    return JSON.parse(text)
+  } catch {
+    throw new Error(`${action} returned invalid JSON`)
+  }
+}
+
+export async function enableIntegrationAutoComplete(env = process.env, fetchImpl = fetch) {
+  const {
+    AZURE_DEVOPS_TOKEN: token,
+    AZURE_DEVOPS_COLLECTION_URI: collectionUri,
+    AZURE_DEVOPS_PROJECT_ID: projectId,
+    AZURE_DEVOPS_REPOSITORY_ID: repositoryId,
+    AZURE_DEVOPS_PULL_REQUEST_ID: pullRequestId,
+  } = requireEnvironment(env)
+  const baseUrl = collectionUri.endsWith('/') ? collectionUri : `${collectionUri}/`
+  const headers = { Authorization: `Bearer ${token}`, Accept: 'application/json' }
+
+  const identityUrl = new URL('_apis/connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1', baseUrl)
+  const identityResponse = await fetchImpl(identityUrl, { headers })
+  const connectionData = await readResponse(identityResponse, 'identity lookup')
+  const authenticatedUserId = connectionData.authenticatedUser?.id
+  if (typeof authenticatedUserId !== 'string' || !authenticatedUserId.trim()) {
+    throw new Error('identity lookup returned no authenticated user id')
+  }
+
+  const pullRequestUrl = new URL(
+    `${encodeURIComponent(projectId)}/_apis/git/repositories/${encodeURIComponent(repositoryId)}/pullRequests/${pullRequestId}?api-version=7.1`,
+    baseUrl,
+  )
+  const updateResponse = await fetchImpl(pullRequestUrl, {
+    method: 'PATCH',
+    headers: { ...headers, 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      autoCompleteSetBy: { id: authenticatedUserId },
+      completionOptions: { deleteSourceBranch: true, mergeStrategy: 'squash', transitionWorkItems: false },
+    }),
+  })
+  await readResponse(updateResponse, 'pull request update')
+  return { pullRequestId: Number(pullRequestId), authenticatedUserId }
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  enableIntegrationAutoComplete()
+    .then(({ pullRequestId }) => console.log(`Enabled auto-complete for PR ${pullRequestId}`))
+    .catch((error) => {
+      console.error(error instanceof Error ? error.message : error)
+      process.exitCode = 1
+    })
+}

package/packages/repo-controls/assets/promote.ts

@@ -0,0 +1,371 @@
+// Managed by adl-repo-controls — do not edit.
+// Regenerate with: adl-repo-controls install --repo .
+//
+// Vendored into `.workflows/` byte-for-byte so CI depends on nothing: no
+// adl-repo-controls on PATH, no MCP client, no package install. A pipeline
+// agent is a cold environment, and a promotion that needs a global npm binary
+// fails there for reasons that have nothing to do with the promotion.
+//
+// Byte-identical in every repository, deliberately. Refs come from the
+// environment, never baked in — otherwise each consumer's copy would hash
+// differently and one published hash could not verify any of them.
+
+/**
+ * Promote one branch to another through an Azure DevOps pull request.
+ *
+ * Standard, not repo-local: every repository in this estate is on Azure DevOps,
+ * and promoting a branch to its trunk is find-or-reuse a PR, then set
+ * auto-complete. Ported from enact-m5's `workflows/scripts/release/
+ * promote-main.ts`, where the mechanism was already injectable — fetch,
+ * collection, project, repository and token were all parameters — and only
+ * three module-scoped literals made it that repository's:
+ *
+ *     SOURCE_REF = 'refs/heads/integration'
+ *     TARGET_REF = 'refs/heads/main'
+ *     title      = 'release: promote integration to main'
+ *
+ * The refs are declared as `[controls.release].source` / `.target`. The title is
+ * DERIVED from them rather than being a third key: a title that can disagree
+ * with the refs it describes is a bug waiting for someone to change one and
+ * forget the other, and the derived form satisfies this package's own
+ * commit-msg grammar for any pair.
+ *
+ * There is no default pair. Defaulting to integration -> main would put one
+ * repository's branch names back into the package by the back door.
+ */
+
+/**
+ * Azure DevOps' `GitPullRequestCompletionOptions.mergeStrategy`, by name.
+ * The REST API's wire values are the camelCase strings below (confirmed
+ * against a live PR: sending the numeric `GitPullRequestMergeStrategy` enum
+ * ordinal here is silently accepted by the type system but is not what the
+ * API expects — PR 1477, 2026-09-27, armed auto-complete with `rebase`
+ * although "no-fast-forward" was intended). `squash` is the standard.
+ */
+export const MERGE_STRATEGIES = {
+  squash: 'squash',
+  rebase: 'rebase',
+  'rebase-merge': 'rebaseMerge',
+  'no-fast-forward': 'noFastForward',
+} as const
+export type MergeStrategy = keyof typeof MERGE_STRATEGIES
+
+export type FetchImpl = (url: string | URL | Request, init?: RequestInit) => Promise<Response>
+
+export interface PromotionRequest {
+  fetchImpl?: FetchImpl
+  collectionUri?: string
+  project?: string
+  repositoryId?: string
+  token?: string
+  buildId?: string
+  sourceVersion?: string
+  /** Declared branch names, WITHOUT the `refs/heads/` prefix. */
+  source?: string
+  target?: string
+  /**
+   * Azure's `GitPullRequestMergeStrategy`. Defaults to the standard the MCP
+   * server defines -- its PR tool admits `enum: ['Squash']` and nothing else.
+   * A repository wanting something else declares it, so the deviation is
+   * visible instead of welded into this file.
+   */
+  mergeStrategy?: MergeStrategy
+}
+
+export type PromotionResult =
+  | { status: 'created' | 'reused'; pullRequestId: number }
+  | { status: 'not-needed'; pullRequestId: null }
+
+interface PullRequest {
+  pullRequestId: number
+  createdBy: { id: string }
+}
+
+interface PullRequestList {
+  value?: PullRequest[]
+}
+
+export interface PolicyScope {
+  repositoryId?: string
+  refName?: string
+  matchKind?: string
+}
+
+export interface PolicyConfiguration {
+  id?: number
+  isEnabled?: boolean
+  isBlocking?: boolean
+  type?: { id?: string }
+  settings?: {
+    scope?: PolicyScope[]
+    requiredReviewerIds?: string[]
+    filenamePatterns?: string[]
+    minimumApproverCount?: number
+    resetOnSourcePush?: boolean
+    buildDefinitionId?: number
+  }
+}
+
+export interface PolicyConfigurationList {
+  value?: PolicyConfiguration[]
+}
+
+export const MINIMUM_REVIEWER_POLICY_TYPE = 'fa4e907d-c16b-4a4c-9dfa-4906e5d171dd'
+export const BUILD_POLICY_TYPE = '0609b952-1397-4640-95ec-e00a01b2c241'
+
+/** `release: promote <source> to <target>` — derived, never declared. */
+export function promotionTitle(source: string, target: string): string {
+  return `release: promote ${source} to ${target}`
+}
+
+function required(name: string, value: string | undefined): string {
+  if (!value) throw new Error(`${name} is required`)
+  return value
+}
+
+class AzureRequestError extends Error {
+  constructor(
+    readonly status: number,
+    readonly body: string,
+  ) {
+    super(`Azure DevOps ${status}: ${body}`)
+    this.name = 'AzureRequestError'
+  }
+}
+
+async function azureRequest<T>(
+  fetchImpl: FetchImpl,
+  url: string,
+  token: string,
+  init: RequestInit = {},
+): Promise<T> {
+  const response = await fetchImpl(url, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
+      ...init.headers,
+    },
+  })
+  if (!response.ok) throw new AzureRequestError(response.status, await response.text())
+  return (await response.json()) as T
+}
+
+function isNoChanges(error: unknown): error is AzureRequestError {
+  return (
+    error instanceof AzureRequestError &&
+    error.status === 400 &&
+    /\b(no commits|no changes|nothing to compare)\b/i.test(error.body)
+  )
+}
+
+function same(value: string | undefined, expected: string): boolean {
+  return value?.toLowerCase() === expected.toLowerCase()
+}
+
+function appliesExactlyTo(policy: PolicyConfiguration, repositoryId: string, targetRef: string): boolean {
+  return Boolean(
+    policy.isEnabled &&
+      policy.isBlocking &&
+      policy.settings?.scope?.some(
+        (scope) =>
+          same(scope.repositoryId, repositoryId) &&
+          scope.refName === targetRef &&
+          same(scope.matchKind, 'Exact'),
+      ),
+  )
+}
+
+export interface PromotionPolicyRequirement {
+  repositoryId: string
+  targetRef: string
+}
+
+export interface PromotionPolicyReceipts {
+  minimumReviewer: PolicyConfiguration | null
+  build: PolicyConfiguration | null
+}
+
+/**
+ * The one policy contract used by both promotion and doctor. A configuration
+ * only counts when it is enabled, blocking, and scoped exactly to the target
+ * branch; a project-wide or path-filtered lookalike cannot guard a promotion.
+ *
+ * No named-reviewer policy is checked here, deliberately (Tarun,
+ * 2026-09-27): the two-branch standard's `main` gate is "exactly one human
+ * reviewer, author's vote excluded" via the minimum-reviewer policy below —
+ * never a specific named individual. A required-reviewer-by-identity policy
+ * on `main` was PR 1477's second live bug: it named the person who pushed to
+ * `integration` as a mandatory approver, which both self-approves (that
+ * person is usually the change's author) and contradicts "agent-reviewer is
+ * optional, never required".
+ */
+export function promotionPolicyReceipts(
+  policies: readonly PolicyConfiguration[],
+  { repositoryId, targetRef }: PromotionPolicyRequirement,
+): PromotionPolicyReceipts {
+  const minimumReviewer =
+    policies.find(
+      (policy) =>
+        same(policy.type?.id, MINIMUM_REVIEWER_POLICY_TYPE) &&
+        appliesExactlyTo(policy, repositoryId, targetRef) &&
+        typeof policy.settings?.minimumApproverCount === 'number' &&
+        policy.settings.minimumApproverCount >= 1 &&
+        policy.settings?.resetOnSourcePush === true,
+    ) ?? null
+  const build =
+    policies.find(
+      (policy) =>
+        same(policy.type?.id, BUILD_POLICY_TYPE) &&
+        appliesExactlyTo(policy, repositoryId, targetRef) &&
+        typeof policy.settings?.buildDefinitionId === 'number' &&
+        policy.settings.buildDefinitionId > 0,
+    ) ?? null
+  return { minimumReviewer, build }
+}
+
+async function verifyPolicyGate(
+  fetchImpl: FetchImpl,
+  projectUrl: string,
+  repositoryId: string,
+  targetRef: string,
+  token: string,
+): Promise<void> {
+  const query = new URLSearchParams({
+    repositoryId,
+    refName: targetRef,
+    '$top': '1000',
+    'api-version': '7.1',
+  })
+  const response = await azureRequest<PolicyConfigurationList>(
+    fetchImpl,
+    `${projectUrl}/_apis/git/policy/configurations?${query}`,
+    token,
+  )
+  const policies = response.value ?? []
+  const receipts = promotionPolicyReceipts(policies, { repositoryId, targetRef })
+  const { minimumReviewer, build } = receipts
+  if (!minimumReviewer) {
+    throw new Error(
+      `promotion requires an enabled blocking minimum-reviewer policy for repository ${repositoryId} ${targetRef} with minimumApproverCount>=1 and resetOnSourcePush=true`,
+    )
+  }
+  if (!build) {
+    throw new Error(
+      `promotion requires an enabled blocking build policy for repository ${repositoryId} ${targetRef} with buildDefinitionId>0`,
+    )
+  }
+}
+
+export async function ensurePromotionPullRequest({
+  fetchImpl = fetch,
+  collectionUri,
+  project,
+  repositoryId,
+  token,
+  buildId,
+  sourceVersion,
+  source,
+  target,
+  mergeStrategy = 'squash',
+}: PromotionRequest): Promise<PromotionResult> {
+  const uri = required('collectionUri', collectionUri)
+  const projectName = required('project', project)
+  const repository = required('repositoryId', repositoryId)
+  const authToken = required('token', token)
+  const sourceBranch = required('[controls.release].source', source)
+  const targetBranch = required('[controls.release].target', target)
+  if (!Object.hasOwn(MERGE_STRATEGIES, mergeStrategy)) {
+    throw new Error(`mergeStrategy must be one of ${Object.keys(MERGE_STRATEGIES).join(', ')}`)
+  }
+  const mergeStrategyWireValue = MERGE_STRATEGIES[mergeStrategy]
+  const sourceRef = `refs/heads/${sourceBranch}`
+  const targetRef = `refs/heads/${targetBranch}`
+
+  const projectUrl = `${uri.replace(/\/$/, '')}/${encodeURIComponent(projectName)}`
+  const repositoryUrl = `${projectUrl}/_apis/git/repositories/${encodeURIComponent(repository)}`
+  await verifyPolicyGate(fetchImpl, projectUrl, repository, targetRef, authToken)
+  const query = new URLSearchParams({
+    'searchCriteria.status': 'active',
+    'searchCriteria.sourceRefName': sourceRef,
+    'searchCriteria.targetRefName': targetRef,
+    'api-version': '7.1',
+  })
+  const active = await azureRequest<PullRequestList>(fetchImpl, `${repositoryUrl}/pullrequests?${query}`, authToken)
+
+  let pullRequest = active.value?.[0]
+  let status: 'created' | 'reused' = 'reused'
+  if (!pullRequest) {
+    const pipelineBuildId = required('buildId', buildId)
+    const commit = required('sourceVersion', sourceVersion)
+    try {
+      pullRequest = await azureRequest<PullRequest>(
+        fetchImpl,
+        `${repositoryUrl}/pullrequests?api-version=7.1`,
+        authToken,
+        {
+          method: 'POST',
+          body: JSON.stringify({
+            sourceRefName: sourceRef,
+            targetRefName: targetRef,
+            title: promotionTitle(sourceBranch, targetBranch),
+            description: `Development deployment succeeded in build ${pipelineBuildId}.\n\n${sourceBranch} commit: ${commit}`,
+          }),
+        },
+      )
+    } catch (error) {
+      if (isNoChanges(error)) return { status: 'not-needed', pullRequestId: null }
+      throw error
+    }
+    status = 'created'
+  }
+
+  // No reviewer is named here, deliberately (Tarun, 2026-09-27): naming one —
+  // typically the person who pushed to `integration` — is a self-approval
+  // risk and contradicts "agent-reviewer is optional, never required". The
+  // gate is the target branch's own minimum-reviewer policy (verified above),
+  // which excludes the author's own vote.
+  await azureRequest(fetchImpl, `${repositoryUrl}/pullrequests/${pullRequest.pullRequestId}?api-version=7.1`, authToken, {
+    method: 'PATCH',
+    body: JSON.stringify({
+      autoCompleteSetBy: { id: pullRequest.createdBy.id },
+      completionOptions: {
+        mergeStrategy: mergeStrategyWireValue,
+        deleteSourceBranch: false,
+        transitionWorkItems: false,
+      },
+    }),
+  })
+
+  return { status, pullRequestId: pullRequest.pullRequestId }
+}
+
+
+/**
+ * Standalone entry point. Reads the refs from the ENVIRONMENT, not from config:
+ * this file is vendored into `.workflows/` byte-for-byte, so its content must
+ * be identical in every repository or a single published hash cannot verify
+ * any of them. The pipeline supplies the repository-specific values through
+ * environment variables while the managed implementation stays identical.
+ */
+export async function main(env: Record<string, string | undefined> = process.env): Promise<void> {
+  const result = await ensurePromotionPullRequest({
+    collectionUri: env.AZURE_DEVOPS_COLLECTION_URI,
+    project: env.AZURE_DEVOPS_PROJECT,
+    repositoryId: env.AZURE_DEVOPS_REPOSITORY_ID,
+    token: env.AZURE_DEVOPS_TOKEN,
+    buildId: env.AZURE_DEVOPS_BUILD_ID,
+    sourceVersion: env.AZURE_DEVOPS_SOURCE_VERSION,
+    source: env.ADL_PROMOTE_SOURCE,
+    target: env.ADL_PROMOTE_TARGET,
+    mergeStrategy: (env.ADL_PROMOTE_MERGE_STRATEGY as MergeStrategy) || 'squash',
+  })
+  if (result.status === 'not-needed') {
+    console.log(`No promotion needed for ${env.ADL_PROMOTE_SOURCE} \u2192 ${env.ADL_PROMOTE_TARGET}`)
+    return
+  }
+  console.log(`${result.status === 'created' ? 'Created' : 'Reused'} ${env.ADL_PROMOTE_SOURCE} \u2192 ${env.ADL_PROMOTE_TARGET} PR #${result.pullRequestId}`)
+}
+
+if (import.meta.main) await main()

package/packages/repo-controls/assets/version-bump.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# The integration build owns package version allocation, exactly as every
+# other repo on this standard does it (enact-extensions, enact-combined):
+# after a PR merges, bump the patch version on `integration`, commit it with
+# ***NO_CI*** and push it straight back to `integration`. The build service
+# has "bypass policies when pushing"; ***NO_CI*** stops the push from
+# triggering another pipeline run. No npm query, no second PR, no second
+# test run (Tarun, 2026-09-29).
+
+die() {
+  echo "version-bump: $*" >&2
+  exit 1
+}
+
+version_file=''
+integration_branch=''
+integration_mode=false
+push_bump=false
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --file)
+      [[ $# -ge 2 ]] || die '--file requires a path'
+      version_file="$2"
+      shift 2
+      ;;
+    --branch)
+      [[ $# -ge 2 ]] || die '--branch requires a name'
+      integration_branch="$2"
+      shift 2
+      ;;
+    --integration)
+      integration_mode=true
+      shift
+      ;;
+    --push)
+      push_bump=true
+      shift
+      ;;
+    *)
+      die "unknown argument: $1"
+      ;;
+  esac
+done
+
+[[ "$version_file" == 'package.json' ]] || die 'only --file package.json is supported'
+[[ -f "$version_file" ]] || die "manifest not found: $version_file"
+[[ -n "$integration_branch" ]] || die '--branch is required'
+[[ "$integration_mode" == true ]] || die '--integration is required'
+[[ "$push_bump" == true ]] || die '--push is required'
+
+current_branch="$(git branch --show-current)"
+if [[ -z "$current_branch" ]]; then
+  # Azure Pipelines' `checkout: self` leaves the working tree on a detached
+  # HEAD (build 4822, integration, 2026-09-27: `git branch --show-current`
+  # came back empty even though the checkout was the right commit on
+  # `integration`). Fall back to Build.SourceBranch (env BUILD_SOURCEBRANCH,
+  # e.g. `refs/heads/integration`) rather than requiring the pipeline to
+  # `git checkout -B` a real branch first.
+  case "${BUILD_SOURCEBRANCH:-}" in
+    refs/heads/*)
+      current_branch="${BUILD_SOURCEBRANCH#refs/heads/}"
+      ;;
+    '')
+      die 'cannot determine the current branch: HEAD is detached (git branch --show-current is empty) and BUILD_SOURCEBRANCH is not set'
+      ;;
+    *)
+      die "BUILD_SOURCEBRANCH '$BUILD_SOURCEBRANCH' is not a branch ref (expected 'refs/heads/<name>')"
+      ;;
+  esac
+fi
+[[ "$current_branch" == "$integration_branch" ]] || \
+  die "integration mode expects branch '$integration_branch', currently on '$current_branch'"
+
+current_version="$(node -e 'const version = JSON.parse(require("node:fs").readFileSync(process.argv[1], "utf8")).version; if (typeof version !== "string") process.exit(1); process.stdout.write(version)' "$version_file")" || \
+  die "cannot read a string version from $version_file"
+
+if [[ ! "$current_version" =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+  die "cannot parse '$current_version' as a release version x.y.z"
+fi
+
+next_version="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}.$((BASH_REMATCH[3] + 1))"
+
+git diff --quiet || die 'working tree is not clean before version bump'
+git diff --cached --quiet || die 'index is not clean before version bump'
+repo_root="$(git rev-parse --show-toplevel)" || die 'cannot resolve the repository root'
+node -e '
+  const fs = require("node:fs")
+  const [file, version] = process.argv.slice(1)
+  const manifest = JSON.parse(fs.readFileSync(file, "utf8"))
+  manifest.version = version
+  fs.writeFileSync(file, `${JSON.stringify(manifest, null, 2)}\n`)
+' "$version_file" "$next_version"
+
+# `[controls.release].pre_bump` (adl-config.toml, repo root): ordered,
+# repository-relative scripts a multi-language repo runs before the bump
+# commit — e.g. agent-identities updates a Go version constant nothing about
+# package.json can reach. No file, or no `pre_bump` key: no scripts, and
+# everything below this comment is a no-op, so the resulting commit is
+# byte-identical to the behaviour before this feature existed (see
+# packages/repo-controls/tests/version-bump-pre-bump.test.ts).
+config_path="$repo_root/adl-config.toml"
+pre_bump_list=''
+if [[ -f "$config_path" ]]; then
+  pre_bump_list="$(bun -e '
+    const path = process.argv[1]
+    const text = await Bun.file(path).text()
+    let root
+    try {
+      root = Bun.TOML.parse(text)
+    } catch (error) {
+      console.error(`pre_bump: ${path} is not valid TOML: ${error.message}`)
+      process.exit(1)
+    }
+    const controls = root && typeof root === "object" ? root.controls : undefined
+    const release = controls && typeof controls === "object" ? controls.release : undefined
+    const preBump = release && typeof release === "object" ? release.pre_bump : undefined
+    if (preBump === undefined) process.exit(0)
+    if (!Array.isArray(preBump) || preBump.some((entry) => typeof entry !== "string")) {
+      console.error("pre_bump: [controls.release].pre_bump must be an array of strings")
+      process.exit(1)
+    }
+    for (const entry of preBump) {
+      if (entry === "" || entry.startsWith("/") || entry.split("/").includes("..")) {
+        console.error(`pre_bump: entry must be a repository-relative path with no leading / and no .. segment: ${entry}`)
+        process.exit(1)
+      }
+      console.log(entry)
+    }
+  ' "$config_path")" || die "invalid [controls.release].pre_bump in $config_path"
+fi
+
+pre_bump_scripts=()
+if [[ -n "$pre_bump_list" ]]; then
+  while IFS= read -r script; do
+    [[ -n "$script" ]] || continue
+    pre_bump_scripts+=("$script")
+  done <<< "$pre_bump_list"
+fi
+
+if [[ ${#pre_bump_scripts[@]} -gt 0 ]]; then
+  # Validated before any of them run, so a bad declaration fails clearly
+  # instead of leaving the repo half-way through a partial run.
+  for script in "${pre_bump_scripts[@]}"; do
+    [[ -f "$repo_root/$script" ]] || die "pre_bump script not found: $script"
+  done
+
+  # Every var whose name ends _TOKEN/_PAT/_SECRET/_PASSWORD, plus the two
+  # Azure DevOps credentials by their exact names (SYSTEM_ACCESSTOKEN does
+  # not end in "_TOKEN"), is stripped from each script's environment. A
+  # pre_bump script is repo-authored, unreviewed by this package, and has no
+  # business ever seeing the pipeline's push/PR credentials.
+  unset_flags=(-u SYSTEM_ACCESSTOKEN -u AZURE_DEVOPS_EXT_PAT -u AZURE_DEVOPS_TOKEN -u AZURE_DEVOPS_PAT)
+  while IFS= read -r var_name; do
+    unset_flags+=(-u "$var_name")
+  done < <(compgen -v | grep -Ei '_(TOKEN|PAT|SECRET|PASSWORD)$' || true)
+
+  # A pre_bump script that edits `.git` directly (hooks, config, refs) would
+  # never show up in `git status` — `.git` sits outside the working tree that
+  # diffs against — so this is a separate, explicit check. There is no
+  # equivalent check for a script writing to an absolute path OUTSIDE the
+  # repository entirely: a plain shell script has no sandbox to enforce
+  # that, so this refuses `.git` tampering only, honestly, rather than
+  # claiming a guarantee this script cannot keep. Changes INSIDE the repo
+  # tree are never "outside the repo" by construction: every add below is
+  # scoped to `$repo_root`, so nothing beyond it can ever be staged.
+  git_marker="$(mktemp)"
+  for script in "${pre_bump_scripts[@]}"; do
+    if ! ( cd "$repo_root" && env "${unset_flags[@]}" \
+        ADL_CURRENT_VERSION="$current_version" \
+        ADL_NEXT_VERSION="$next_version" \
+        ADL_REPO_ROOT="$repo_root" \
+        bash "$repo_root/$script" ); then
+      die "pre_bump script failed: $script"
+    fi
+  done
+  if [[ -n "$(find "$repo_root/.git" -newer "$git_marker" 2>/dev/null)" ]]; then
+    die 'a pre_bump script modified .git; refusing to bump'
+  fi
+  rm -f "$git_marker"
+fi
+
+git -C "$repo_root" add -A
+git diff --cached --quiet && die "version bump produced no staged change (expected at least $version_file)"
+git commit -m "chore: bump version $current_version to $next_version ***NO_CI***"
+ADL_AGENT_ID_AGENT=agent-tarun git push origin "HEAD:$integration_branch"
+echo "Bumped $version_file from $current_version to $next_version on $integration_branch."