@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.12

package/packages/agent-hooks/src/rules/impl/fs-trash.ts

@@ -7,8 +7,8 @@
  *
  * The original's eighth predicate -- any path with an `.agents` segment --
  * was dropped by owner decision on 2026-09-15. `.agents/` is reconciled
- * centrally every six hours (global-tools `git-maintain` refreshes repo-local
- * surfaces in every managed repo), so a trashed copy is restored rather than
+ * centrally every 12 hours (`adl reconcile`'s repository step runs `adl install --repo`,
+ * which refreshes repo-local surfaces in every managed repo), so a trashed copy is restored rather than
  * lost, and `trash(1)` is itself recoverable from ~/.Trash. Protecting it here
  * blocked routine work to guard against something the fleet already repairs.
  *

package/packages/agent-settings/assets/GLOBAL-AGENTS.md

@@ -9,7 +9,7 @@ repo's own `AGENTS.md`.
 - If a task is ambiguous, ask exactly one clarifying question.
 
 ## Truthfulness (non-negotiable)
-- **No fake-green tests** — never edit an assertion to force a pass. Red is honest.
+- **No fake-green tests.** A test changes only when the intended behaviour changes, never to make unintended behaviour pass. Red is honest.
 - **No silent fallback or degrade** — if the real path fails, fail loud and stop.
 - **No silent drops** — no `|| true`, no swallowed errors, no skipped gates.
 - **No fakes** — no stubs, placeholders or TODOs passed off as done.
@@ -69,7 +69,9 @@ repo's own `AGENTS.md`.
 
 ## Tests
 - For features, bugfixes and non-trivial refactors: **tests first**, confirmed failing for the right reason; then minimal code to pass; then a separate review pass.
-- Every change ships a **new** test. Never edit an existing test to make work pass.
+- Every change ships a **new** test.
+- When a change deliberately alters behaviour, rework the existing tests that assert the old behaviour, in the same change. Name each reworked test and the decision that changed it.
+- **Never fake green.** Don't loosen, skip or delete an assertion, or set an expectation to whatever the code returns, to hide a failure you didn't intend.
 - Skip for pure config, docs and trivial one-liners.
 
 ## Delegation & parallelism

package/packages/agent-settings/src/global-surface-sweep.ts

@@ -29,7 +29,6 @@ import {
 import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { BEGIN as KIMI_BEGIN, END as KIMI_END } from './kimi-hooks.ts'
-import { declaredLaunchAgentPlists } from '../../../packages/fleet/src/launch-agents.ts'
 
 const LAUNCH_AGENTS_DIR = 'Library/LaunchAgents'
 
@@ -40,8 +39,6 @@ const LAUNCH_AGENTS_DIR = 'Library/LaunchAgents'
  * these strings verbatim) contain, case-insensitively, one of these agent
  * tool tokens. Everything else (GoogleUpdater, Keystone, other application
  * updaters) is not an agent surface and is neither a candidate nor reported.
- * LaunchAgents enact-vps declares in fleet/manifest.json are always in
- * scope and protected by identity (see loadProtectionList).
  */
 export const AGENT_TOOL_TOKENS = [
   'lean-ctx',
@@ -295,7 +292,6 @@ export const EMPTY_PROTECTION: ProtectionList = {
 }
 
 export const DEFAULT_PROTECTION_PATH = fileURLToPath(new URL('../protected.json', import.meta.url))
-export const DEFAULT_MANIFEST_PATH = fileURLToPath(new URL('../../fleet/manifest.json', import.meta.url))
 
 export interface SweepNote {
   readonly level: 'warn' | 'ok'
@@ -605,18 +601,12 @@ export function decodeProtectionList(value: unknown): ProtectionList {
 }
 
 /**
- * The checked-in protection list plus every LaunchAgent plist enact-vps
- * itself ships (declared under `launch_agents` in fleet/manifest.json).
- * Shipped-job protection is derived from the manifest, never hand-listed.
+ * The checked-in protection list. (It used to add every LaunchAgent the fleet
+ * manifest declared; the manifest declares none since git-maintain was retired
+ * on 2026-09-30, so nothing is derived from it any more.)
  */
-export function loadProtectionList(path = DEFAULT_PROTECTION_PATH, manifestPath = DEFAULT_MANIFEST_PATH): ProtectionList {
-  const list = decodeProtectionList(JSON.parse(readFileSync(path, 'utf8')))
-  const declared = declaredLaunchAgentPlists(JSON.parse(readFileSync(manifestPath, 'utf8')))
-  const listed = new Set(list.paths.map((entry) => entry.path))
-  const derived = declared
-    .filter((entry) => !listed.has(entry.path))
-    .map((entry) => ({ path: entry.path, reason: `LaunchAgent shipped by enact-vps (fleet/manifest.json ${entry.declaredAt})` }))
-  return { ...list, paths: [...list.paths, ...derived] }
+export function loadProtectionList(path = DEFAULT_PROTECTION_PATH): ProtectionList {
+  return decodeProtectionList(JSON.parse(readFileSync(path, 'utf8')))
 }
 
 function tomlHeaderName(header: string): string {

package/packages/agent-skills/package.json

@@ -15,7 +15,7 @@
   "scripts": {
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "bun run typecheck && bun test"
+    "test": "bun run typecheck && bun test --coverage"
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",

package/packages/azdo/package.json

@@ -5,8 +5,7 @@
   "type": "module",
   "scripts": {
     "start": "bun src/mcp-server.ts",
-    "test": "bun test",
-    "test:coverage": "bun test --coverage",
+    "test": "bun test --coverage",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {

package/packages/fleet/manifest.json

@@ -3,7 +3,7 @@
     "schema": 1,
     "repository": "https://dev.azure.com/amsterdamdatalabs/Infrastructure-AzDo/_git/adl-agent-control",
     "branch": "main",
-    "interval_seconds": 21600,
+    "interval_seconds": 43200,
     "update_policy": "latest-stable",
     "allow_major_updates": true,
     "remove_deleted_entries": true,
@@ -33,12 +33,6 @@
     "git_global_config": {
       "lfs.ssh://ssh.dev.azure.com/.sshtransfer": "never",
       "lfs.https://ssh.dev.azure.com/.locksverify": "false"
-    },
-    "azure_agents": {
-      "organization": "amsterdamdatalabs",
-      "pool_id": 1,
-      "coordinator": "hostinger-vps-1",
-      "enabled_agents": ["mac-m5-ci", "hostinger-vps-1-agent-1", "hostinger-vps-1-agent-2"]
     }
   },
   "mac": {
@@ -70,21 +64,6 @@
         "shfmt": {"manager": "brew", "package": "shfmt", "executable": "shfmt"},
         "uv": {"manager": "brew", "package": "uv", "executable": "uv"},
         "yq": {"manager": "brew", "package": "yq", "executable": "yq"}
-      },
-      "launch_agents": {
-        "git-maintain": {
-          "label": "com.adl.git-maintain",
-          "source": "packages/fleet/jobs/git-maintain",
-          "entry": "src/main.ts",
-          "start_interval_seconds": 86400,
-          "run_at_load": true,
-          "repo_scope": {"root": "Documents", "glob": "*", "recursive": true},
-          "environment": {
-            "PATH": "/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
-          },
-          "log": "Library/Logs/adl/git-maintain.log",
-          "replaces": [".local/bin/git-maintain.sh"]
-        }
       }
     },
     "devices": {
@@ -94,6 +73,7 @@
         "home": "/Users/tarunrana",
         "minimum_free_gib": 20,
         "schedule_minute": 5,
+        "repo_location": "/Users/tarunrana/Documents/Repos",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
@@ -114,6 +94,7 @@
         "home": "/Users/ranahome",
         "minimum_free_gib": 20,
         "schedule_minute": 35,
+        "repo_location": "/Users/ranahome/Documents",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
@@ -169,7 +150,7 @@
         "minimum_free_gib": 25,
         "schedule_minute": 50,
         "scratch_repos": ["/root/enact-webview"],
-        "git_maintain_repos": ["/opt/adl-azdo"],
+        "repo_location": "/root/workspace",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "claude", "manager": "native", "command": "claude", "update_args": ["update"]},
@@ -190,7 +171,7 @@
         "minimum_free_gib": 25,
         "schedule_minute": 20,
         "scratch_repos": ["/root/enact-webview"],
-        "git_maintain_repos": ["/opt/adl-azdo"],
+        "repo_location": "/root/workspace",
         "brew_upgrade_all": true,
         "surface_clis": [
           {"name": "opencode", "manager": "npm", "command": "opencode", "update_args": ["upgrade"]},

package/packages/fleet/manifest.schema.json

@@ -8,7 +8,7 @@
   "properties": {
     "config": {
       "type": "object",
-      "required": ["schema", "repository", "branch", "interval_seconds", "update_policy", "allow_major_updates", "remove_deleted_entries", "global_surface_sweep", "kimi_hooks", "surface_policy", "global_agents", "vscode_settings", "scratch_reap", "protected_tools", "git_global_config", "azure_agents"],
+      "required": ["schema", "repository", "branch", "interval_seconds", "update_policy", "allow_major_updates", "remove_deleted_entries", "global_surface_sweep", "kimi_hooks", "surface_policy", "global_agents", "vscode_settings", "scratch_reap", "protected_tools", "git_global_config"],
       "properties": {
         "global_surface_sweep": {
           "type": "object",
@@ -72,20 +72,8 @@
         }
       }
     },
-    "mac": {
-      "allOf": [{"$ref": "#/$defs/platform"}],
-      "properties": {
-        "common": {"properties": {"launch_agents": {"$ref": "#/$defs/launch_agents"}}},
-        "devices": {"additionalProperties": {"properties": {"launch_agents": {"$ref": "#/$defs/launch_agents"}}}}
-      }
-    },
-    "linux": {
-      "allOf": [{"$ref": "#/$defs/platform"}],
-      "properties": {
-        "common": {"not": {"required": ["launch_agents"]}},
-        "devices": {"additionalProperties": {"not": {"required": ["launch_agents"]}}}
-      }
-    }
+    "mac": {"$ref": "#/$defs/platform"},
+    "linux": {"$ref": "#/$defs/platform"}
   },
   "$defs": {
     "tool": {
@@ -157,7 +145,6 @@
       "type": "object",
       "additionalProperties": {"$ref": "#/$defs/tool"}
     },
-    "relative_path": {"type": "string", "pattern": "^(?!/)(?!.*(^|/)\\.\\.(/|$)).+$"},
     "surface_cli": {
       "type": "object",
       "additionalProperties": false,
@@ -197,46 +184,13 @@
         }
       ]
     },
-    "launch_agent": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["label", "source", "entry", "start_interval_seconds", "run_at_load", "environment", "log"],
-      "properties": {
-        "label": {"type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$"},
-        "source": {"$ref": "#/$defs/relative_path", "description": "Checkout-relative job directory; reconcile compiles it to a dedicated signed binary, rebuilt when its content hash changes."},
-        "entry": {"$ref": "#/$defs/relative_path", "description": "TypeScript entry file relative to source."},
-        "start_interval_seconds": {"type": "integer", "minimum": 60},
-        "run_at_load": {"type": "boolean"},
-        "repo_scope": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["root", "glob", "recursive"],
-          "properties": {
-            "root": {"$ref": "#/$defs/relative_path", "description": "Repository scan root relative to the device administrator's home."},
-            "glob": {"type": "string", "minLength": 1},
-            "recursive": {"const": true}
-          }
-        },
-        "environment": {
-          "type": "object",
-          "propertyNames": {"pattern": "^[A-Z_][A-Z0-9_]*$"},
-          "additionalProperties": {"type": "string"}
-        },
-        "log": {"$ref": "#/$defs/relative_path"},
-        "replaces": {"type": "array", "items": {"$ref": "#/$defs/relative_path"}}
-      }
-    },
-    "launch_agents": {
-      "description": "User LaunchAgents enact-vps installs for the device administrator (macOS only).",
-      "type": "object",
-      "additionalProperties": {"$ref": "#/$defs/launch_agent"}
-    },
     "platform": {
       "type": "object",
       "required": ["common", "devices"],
       "properties": {
         "common": {
           "type": "object",
+          "additionalProperties": false,
           "required": ["tools"],
           "properties": {
             "os_upgrade": {"type": "boolean"},
@@ -274,14 +228,10 @@
                 "items": {"type": "string", "pattern": "^/[^\\s]*[^/\\s]$"},
                 "uniqueItems": true
               },
-              "git_maintain_repos": {
-                "type": "array",
-                "description": "An explicit, closed list of repositories bin/reconcile passes to git-maintain's --repo argv, for a device whose enrolled checkout sits at a fixed path outside any device's home (the Linux VPSes' /opt/adl-azdo) rather than under a recursively-scanned ~/Documents. Never a scan root: each entry is one exact repository path, so this can never walk into an unrelated directory the way scanning a shared parent like /opt could. Case-insensitive azagent/vsts.agent ban: git-maintain itself refuses the same names again, by realpath too, at the point of actual use.",
-                "items": {
-                  "type": "string",
-                  "pattern": "^/(?!$)(?!.*\\s)(?!.*/$)(?!.*\\.\\.)(?!.*[aA][zZ][aA][gG][eE][nN][tT])(?!.*[vV][sS][tT][sS]\\.[aA][gG][eE][nN][tT]).+$"
-                },
-                "uniqueItems": true
+              "repo_location": {
+                "type": "string",
+                "description": "One absolute directory on this host. `adl reconcile` maintains (fetch --prune, fast-forward integration and main, safe branch prune, then `adl install --repo`) every IMMEDIATE child of it that carries adl-config.toml and is a git top-level, as the device administrator. It is the entire scope of that step: nothing outside it is scanned or touched, and a child that resolves outside it is refused. A missing or unreadable location fails the run; a host that declares none skips the step with a log line. The case-insensitive azagent/vsts.agent ban keeps it away from Azure Pipelines agent installs (JSON Schema `pattern` has no case-insensitive flag, so the classes are spelled out).",
+                "pattern": "^/(?!$)(?!.*\\s)(?!.*/$)(?!.*\\.\\.)(?!.*[aA][zZ][aA][gG][eE][nN][tT])(?!.*[vV][sS][tT][sS]\\.[aA][gG][eE][nN][tT]).+$"
               },
               "tools": {"$ref": "#/$defs/tools"}
             }

package/packages/fleet/src/install-embedding-model.ts

@@ -32,7 +32,7 @@
  * bytes because they merely arrived over HTTPS. `revision` is then recorded
  * in the installed `manifest.json` so the next run can skip the rebuild
  * (network round-trip to resolve latest + a local file read) instead of
- * re-downloading and re-verifying multi-hundred-MB files on every six-hour
+ * re-downloading and re-verifying multi-hundred-MB files on every 12-hour
  * reconcile just to reach the same answer.
  *
  * `manifest.json`'s `source`, `vocab_limit`, and `dim` come from