@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.12

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82925024 bytes
-sha256: bf72c4f43099dc33afd161d5e8205d2fbfc5607e4b3aafac4ac0644224b75337
+size: 82949600 bytes
+sha256: b0711f880f163524abb11d00eb61e134b582627c11fe70bb96ea2d91133b3fbb

package/bin/git

@@ -435,7 +435,7 @@ case "$command_name" in
       # "whatever the schedule says" -- "Otherwise, the tasks are determined
       # by which maintenance.<task>.enabled config options are true. By
       # default, only maintenance.gc.enabled is true." A bare `run` (the
-      # shape a human, a GUI, or the git-maintain LaunchAgent's own
+      # shape a human, a GUI, or a scheduled repository-maintenance job's own
       # background gc actually calls) therefore almost never touches the
       # network at all -- routing it unconditionally, as this used to,
       # refused every one of those local-only callers once git-ado went

package/bin/git-ado

@@ -53,7 +53,7 @@
 #   NEVER a fallback to another identity: an unrecognized agent name is
 #   refused, by name, before anything reaches adl-agent-id.
 #
-# HOST AUTOMATION (sync-and-reconcile, scratch-reap, git-maintain) is not one
+# HOST AUTOMATION (sync-and-reconcile, scratch-reap, `adl maintain`) is not one
 # of the three named agents and is not a human terminal either, but it goes
 # through THIS script's ordinary agent path as agent-tarun, the machine's own
 # default agent (2026-09-27 decision 5). THIS SCRIPT NEVER READS THE
@@ -64,7 +64,7 @@
 # (packages/fleet/src/default-agent-file.ts owns the WRITE side), and sets
 # ADL_AGENT_ID_AGENT in the child env before it ever reaches this script --
 # see e.g. packages/fleet/src/scratch-reap.ts and
-# packages/fleet/jobs/git-maintain/src/main.ts. The separate host-only
+# packages/fleet/src/repo-maintain.ts. The separate host-only
 # credentialed path (git-ado-host) is retired: the old DevOps vault
 # credentials it used were deleted, so it was dead regardless.
 set -euo pipefail

package/bin/lib/bun-compile-build.sh

@@ -21,7 +21,7 @@ bun_compile_build() {
   local bun_bin="$1"
   local entry_path="$2"
   local target="$3"
-  [[ -f "$entry_path" ]] || { echo "bun-compile entry missing: $entry_path" >&2; exit 1; }
+  [[ -f "$entry_path" ]] || { echo "ERROR bun-compile entry missing: $entry_path" >&2; exit 1; }
   (
     build_dir="$(mktemp -d)"
     trap 'rm -rf "$build_dir"' EXIT

package/bin/lib/fleet-host.sh

@@ -0,0 +1,59 @@
+# Shared host lookup for `adl setup` (bin/setup) and `adl reconcile`
+# (bin/reconcile-host): the ONE place that maps a fleet host name to its
+# manifest device entry, so the two commands can never disagree on which
+# account owns a host or which minute it is scheduled at.
+#
+# Sourced, never executed. Needs jq on PATH. Both callers read the manifest
+# that ships inside their own package (packages/fleet/manifest.json); there is
+# no checkout mode and no per-command owner flag -- the owner is the device's
+# `administrator`.
+#
+# fleet_host_resolve COMMAND MANIFEST HOST
+#   On success sets fleet_host_platform (mac|linux), fleet_host_owner,
+#   fleet_host_minute and fleet_host_repo_location (empty when the device
+#   declares none). On failure prints one `ERROR COMMAND: ...` line to stderr
+#   and returns 2 (unknown host) or 1 (unreadable manifest, bad entry, or the
+#   host belongs to the other operating system).
+
+fleet_host_resolve() {
+  local command="$1" manifest="$2" host="$3"
+  local row valid os_platform
+  fleet_host_platform=""
+  fleet_host_owner=""
+  fleet_host_minute=""
+  fleet_host_repo_location=""
+
+  [[ -f "$manifest" ]] || { echo "ERROR $command: fleet manifest missing: $manifest" >&2; return 1; }
+
+  row="$(jq -r --arg host "$host" '
+    [ ("mac", "linux") as $platform
+      | (.[$platform].devices // {}) | to_entries[] | select(.key == $host)
+      | [$platform, (.value.administrator // ""), ((.value.schedule_minute // "") | tostring), (.value.repo_location // "")]
+      | join("\u001f") ] | first // empty
+  ' "$manifest")" || { echo "ERROR $command: cannot read fleet manifest: $manifest" >&2; return 1; }
+
+  if [[ -z "$row" ]]; then
+    valid="$(jq -r '[(.mac.devices // {} | keys_unsorted[]), (.linux.devices // {} | keys_unsorted[])] | join(", ")' "$manifest")" || {
+      echo "ERROR $command: cannot read fleet manifest: $manifest" >&2
+      return 1
+    }
+    echo "ERROR $command: unknown host '$host'; valid hosts: $valid" >&2
+    return 2
+  fi
+
+  # A non-whitespace delimiter (unit separator): `read` collapses runs of a
+  # whitespace IFS such as tab, which would shift a later field into an empty one.
+  IFS=$'\x1f' read -r fleet_host_platform fleet_host_owner fleet_host_minute fleet_host_repo_location <<<"$row"
+  [[ -n "$fleet_host_owner" ]] || { echo "ERROR $command: host '$host' has no administrator in $manifest" >&2; return 1; }
+  [[ "$fleet_host_minute" =~ ^[0-9]+$ ]] || { echo "ERROR $command: host '$host' has no schedule_minute in $manifest" >&2; return 1; }
+
+  case "$(uname -s)" in
+    Darwin) os_platform=mac ;;
+    Linux) os_platform=linux ;;
+    *) echo "ERROR $command: unsupported operating system: $(uname -s)" >&2; return 1 ;;
+  esac
+  [[ "$fleet_host_platform" == "$os_platform" ]] || {
+    echo "ERROR $command: host '$host' is a $fleet_host_platform device but this machine is $os_platform" >&2
+    return 1
+  }
+}

package/bin/lib/lean-ctx-observe-hooks.sh

@@ -320,34 +320,34 @@ lean_ctx_observe_hook_write() {
   local resolved mode owner tmp
   resolved="$(lean_ctx_observe_hook_resolve_target "$path")"
   mode="$(lean_ctx_observe_hook_stat_mode "$resolved")" || {
-    echo "FAILED: could not stat mode of $resolved" >&2
+    echo "ERROR FAILED: could not stat mode of $resolved" >&2
     return 1
   }
   owner="$(lean_ctx_observe_hook_stat_owner "$resolved")" || {
-    echo "FAILED: could not stat owner of $resolved" >&2
+    echo "ERROR FAILED: could not stat owner of $resolved" >&2
     return 1
   }
   tmp="$(mktemp "$(dirname "$resolved")/.$(basename "$resolved").XXXXXX" 2>/dev/null)" || {
-    echo "FAILED: mktemp for $resolved failed" >&2
+    echo "ERROR FAILED: mktemp for $resolved failed" >&2
     return 1
   }
   if ! cat "$content_src" >"$tmp" 2>/dev/null; then
-    echo "FAILED: writing $tmp failed" >&2
+    echo "ERROR FAILED: writing $tmp failed" >&2
     rm -f "$tmp" 2>/dev/null
     return 1
   fi
   if ! chmod "$mode" "$tmp" 2>/dev/null; then
-    echo "FAILED: chmod $mode $tmp failed" >&2
+    echo "ERROR FAILED: chmod $mode $tmp failed" >&2
     rm -f "$tmp" 2>/dev/null
     return 1
   fi
   if ! chown "$owner" "$tmp" 2>/dev/null; then
-    echo "FAILED: chown $owner $tmp failed" >&2
+    echo "ERROR FAILED: chown $owner $tmp failed" >&2
     rm -f "$tmp" 2>/dev/null
     return 1
   fi
   if ! mv -f "$tmp" "$resolved" 2>/dev/null; then
-    echo "FAILED: mv $tmp -> $resolved failed" >&2
+    echo "ERROR FAILED: mv $tmp -> $resolved failed" >&2
     rm -f "$tmp" 2>/dev/null
     return 1
   fi
@@ -624,11 +624,11 @@ lean_ctx_observe_strip_guard_euid() {
   local euid="$1" home="$2" owner
   [[ "$euid" == 0 ]] || return 0
   owner="$(lean_ctx_observe_hook_stat_owner "$home" 2>/dev/null)" || {
-    echo "lean-ctx-observe-strip: refusing -- running as root (EUID=0) but could not determine the owner of --home $home" >&2
+    echo "ERROR lean-ctx-observe-strip: refusing -- running as root (EUID=0) but could not determine the owner of --home $home" >&2
     return 1
   }
   local owner_uid="${owner%%:*}"
   [[ "$owner_uid" == 0 ]] && return 0
-  echo "lean-ctx-observe-strip: refusing -- running as root (EUID=0) against --home $home, owned by uid $owner_uid, not root. bin/reconcile's apply path always runs this script via 'sudo -u <administrator>' (or, on Linux, as root against root's own /root), so it should never execute as literal root against a non-root user's home. Re-run as that user, or via 'sudo -u <that user> lean-ctx-observe-strip --home $home --mode ...'." >&2
+  echo "ERROR lean-ctx-observe-strip: refusing -- running as root (EUID=0) against --home $home, owned by uid $owner_uid, not root. bin/reconcile's apply path always runs this script via 'sudo -u <administrator>' (or, on Linux, as root against root's own /root), so it should never execute as literal root against a non-root user's home. Re-run as that user, or via 'sudo -u <that user> lean-ctx-observe-strip --home $home --mode ...'." >&2
   return 1
 }