@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.26

package/packages/agent-hooks/src/hooks/contract.ts

@@ -3,13 +3,12 @@
  *
  * `controls hook <kind> --host=X` is invoked by agent hosts (Claude Code,
  * Codex, Cursor, OpenCode, Kimi) with a JSON payload on stdin. Every kind
- * (`pre-tool-use`, `user-prompt-submit`, `briefing`, `crg`, `lean-ctx`
- * pre-tool-use/post-tool-use) is dispatched from `src/main.ts` through one
+ * (`pre-tool-use`, `user-prompt-submit`, `briefing`, `crg`) is dispatched
+ * from `src/main.ts` through one
  * `HookHandler` shape, so a handler never sees `process`, argv, or stdin
  * directly — only the `HookInvocation` it is called with, and it returns a
  * `HookResult` for `main.ts` to write to stdout/stderr and turn into a
- * process exit code. `lean-ctx mcp` is the one exception: it is not a
- * `HookHandler` at all — see `src/lean-ctx/mcp.ts`'s header.
+ * process exit code.
  *
  * This file is intentionally the *only* place that shape is defined: other
  * agents implementing `src/hooks/user-prompt-submit/`, `src/hooks/briefing/`,
@@ -31,26 +30,27 @@ export interface ActivityNote {
   /** `PASS`, `DENY <rule>`, `ERROR <what>`, `TIMEOUT <what>`, or `SKIP <why>`. */
   readonly reason: string
   readonly message?: string
-  /** What the hook invoked downstream, e.g. `lean-ctx hook redirect`, `skills: tdd, research`. */
+  /** What the hook invoked downstream, e.g. `skills: tdd, research`. */
   readonly downstream?: string
   /** Set only for a blocked pre-tool-use decision: the rule id written to the deny log. */
   readonly denyRuleId?: string
   /**
    * Set only when an identity decision was actually made for this
-   * invocation (a rewrite, or a deny/pass decided by one of the four
-   * identity rules — `adl.session-required-for-writes`, `adl.git-identity`,
-   * `adl.token-minting-role`, `tool.azure-devops`): where the effective
-   * agent identity came from, per the one-agent-identity standard's own
-   * resolution order (STATUS.md 12p, "The
-   * standard") — `inline` (a valid `ADL_AGENT_ID_AGENT=` on the command
-   * itself), `env` (the session environment), `default-file` (the machine
-   * default-agent file), or `none` (nothing resolved at all). See
-   * `../pre-tool-use/handler.ts`'s `identitySourceFor`.
+   * invocation (a rewrite, or a deny/pass decided by one of the identity
+   * rules — `adl.run-required-for-writes`, `adl.git-identity`,
+   * `adl.token-minting-role`, `tool.azure-devops`, … — or by a role gate on
+   * an Azure DevOps MCP call): where the effective agent identity came from,
+   * per the one-agent-identity resolution order — `inline` (a valid
+   * `ADL_AGENT_ID_AGENT=` on the command itself), `env` (the session
+   * environment), `default-file` (the machine default-agent file), or
+   * `none` (nothing resolved at all). An allowed Azure DevOps MCP call logs
+   * it too, reads included (Tarun, 2026-09-29). See
+   * `../pre-tool-use/handler.ts`'s `effectiveIdentityFor` and
+   * `fallbackIdentity`.
    */
   readonly identitySource?: 'inline' | 'env' | 'default-file' | 'none'
   /**
-   * M8 (STATUS.md 12p): the EFFECTIVE agent
-   * identity this decision actually used — set together with
+   * The EFFECTIVE agent identity this decision actually used — set together with
    * `identitySource`, whenever that is set to anything but `'none'`. Read
    * by `./log.ts` for the `agent` column INSTEAD OF the session's raw
    * `ADL_AGENT_ID_AGENT` env var — the two differ exactly when a command
@@ -63,7 +63,7 @@ export interface ActivityNote {
 }
 
 export interface HookInvocation {
-  readonly kind: 'pre-tool-use' | 'user-prompt-submit' | 'briefing' | 'crg' | 'lean-ctx'
+  readonly kind: 'pre-tool-use' | 'user-prompt-submit' | 'briefing' | 'crg'
   readonly host: HostId
   readonly event?: string
   readonly subcommand?: string

package/packages/agent-hooks/src/hooks/crg/background.ts

@@ -29,11 +29,25 @@
  * pending marker exists clears it and runs once more. On its way out it
  * releases the lock, then re-checks the marker once and re-acquires the
  * lock (noclobber) if a hook queued in the meantime, closing the last gap.
+ *
+ * Self-heal: if `code-review-graph update --skip-flows` exits non-zero,
+ * the runner runs `code-review-graph build --skip-flows` once and logs a
+ * `SELF-HEAL:` marker to stderr (captured by the spawn into
+ * `crg-update.log`). The original error is already in the log because
+ * the spawn captures the update's own stderr; the marker is appended
+ * after, so the failure is never silently swallowed. The build runs at
+ * most once per runner invocation (a per-runner shell variable), so a
+ * runner that re-iterates because the pending marker was set does not
+ * re-trigger the build on the second iteration. If the build itself
+ * fails, the runner exits and the next edit tries again — persistent
+ * failures stay visible in the log instead of being hidden.
  */
 
 import { closeSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
 import { join } from 'node:path'
 
+import { ensureAdlGitignore } from '../../log/adl-dir.ts'
+
 export const LOCK_REL = '.adl/crg-update.lock'
 export const PENDING_REL = '.adl/crg-update.pending'
 export const UPDATE_LOG_REL = '.adl/logs/crg-update.log'
@@ -43,9 +57,21 @@ export const MAX_LOCK_AGE_MS = 30 * 60 * 1000
 
 export const RUNNER_SCRIPT = [
   'lock="$1"; pending="$2"; shift 2',
+  'build_attempted=',
   'while :; do',
   '  rm -f "$pending"',
   '  "$@"',
+  '  rc=$?',
+  '  if [ "$rc" -ne 0 ] && [ -z "$build_attempted" ]; then',
+  '    echo "SELF-HEAL: $* exited $rc; running code-review-graph build --skip-flows" >&2',
+  '    if code-review-graph build --skip-flows; then',
+  '      echo "SELF-HEAL: build ok; next update will validate" >&2',
+  '    else',
+  '      build_rc=$?',
+  '      echo "SELF-HEAL: build failed (exit $build_rc); self-heal aborted" >&2',
+  '    fi',
+  '    build_attempted=1',
+  '  fi',
   '  if [ -e "$pending" ]; then continue; fi',
   '  rm -f "$lock"',
   '  if [ -e "$pending" ] && (set -C; echo $$ > "$lock") 2>/dev/null; then continue; fi',
@@ -160,6 +186,7 @@ function acquireAndStart(deps: BackgroundDeps, root: string, env: SpawnSpec['env
 
 export function requestUpdate(deps: BackgroundDeps, root: string, env: SpawnSpec['env']): UpdateRequest {
   mkdirSync(join(root, '.adl', 'logs'), { recursive: true, mode: 0o700 })
+  ensureAdlGitignore(join(root, '.adl'))
   const lockPath = join(root, LOCK_REL)
   const pendingPath = join(root, PENDING_REL)
 

package/packages/agent-hooks/src/hooks/crg/index.ts

@@ -47,7 +47,7 @@
 
 import type { HookHandler, HookInvocation, HookResult } from '../contract.ts'
 import { spawnWithTimeout } from '../../lib/spawn-with-timeout.ts'
-import { defaultBackgroundDeps, requestUpdate, type BackgroundDeps } from './background.ts'
+import { requestUpdate, type BackgroundDeps } from './background.ts'
 import { toDecideInput } from '../../pre-tool-use/handler.ts'
 import { invocations } from '../../rules/shell/invocation.ts'
 
@@ -155,7 +155,8 @@ function isGitCommitInvocation(payload: Record<string, unknown>): boolean {
 }
 
 /**
- * `pre-commit.sh`: silent `detect-changes --brief`, stdout `{"passed":true}`,
+ * `pre-commit.sh`: silent `detect-changes --brief`, with Codex receiving its
+ * native allow envelope rather than the legacy `{"passed":true}` payload,
  * always exit 0 — but ONLY when the invoking payload's shell command is
  * actually a `git commit` (see this file's header, work item B). Anything
  * else — no shell command at all (a non-Bash tool call), or a shell command
@@ -168,7 +169,10 @@ async function preCommit(run: Runner, inv: HookInvocation): Promise<HookResult>
     return { stdout: '', stderr: '', exitCode: 0 }
   }
   const result = await runCrg(run, inv, ['detect-changes', '--brief'])
-  return { stdout: '{"passed":true}\n', stderr: missingBinaryNote('pre-commit', result), exitCode: 0 }
+  const stdout = inv.host === 'codex'
+    ? `${JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'allow' } })}\n`
+    : '{"passed":true}\n'
+  return { stdout, stderr: missingBinaryNote('pre-commit', result), exitCode: 0 }
 }
 
 /**
@@ -235,6 +239,3 @@ export const bunRunner: Runner = async (cmd, args, opts) => {
     return { status: null, stdout: '', stderr: message }
   }
 }
-
-export const handleCrg: HookHandler = createCrgHandler({ run: bunRunner, background: defaultBackgroundDeps })
-export default handleCrg

package/packages/agent-hooks/src/hooks/log.ts

@@ -40,8 +40,7 @@
  *     `result` is never left empty just because a row has nothing to say.
  *   - `rule` is set only for a blocked pre-tool-use decision
  *     (`ActivityNote.denyRuleId`), same trigger as the old deny log.
- *   - `agent` is `ActivityNote.identityAgent` (M8,
- *     STATUS.md 12p) — the EFFECTIVE identity the
+ *   - `agent` is `ActivityNote.identityAgent` — the EFFECTIVE identity the
  *     decision actually used, set by `../pre-tool-use/handler.ts`'s
  *     `effectiveIdentityFor` — when an identity decision was made; a valid
  *     inline `ADL_AGENT_ID_AGENT=` override on the command differs from the
@@ -50,12 +49,12 @@
  *     `ADL_AGENT_ID_AGENT` (`../rules/impl/adl-identity.ts`'s env var) for
  *     any row with no identity decision at all. `human` has no source at
  *     this layer and is left absent.
- *   - `identity_source` (W2 build item 5, 2026-09-28) comes straight off
+ *   - `identity_source` comes straight off
  *     `ActivityNote.identitySource` (`./contract.ts`), set by
  *     `../pre-tool-use/handler.ts`'s `decideAndRespond` only when an
  *     identity decision was actually made for this invocation — absent
- *     otherwise, never defaulted to `'none'` for an unrelated row. M8 widens
- *     when this is set to also cover the "override's PASS" row: an
+ *     otherwise, never defaulted to `'none'` for an unrelated row. It is set
+ *     for the "override's PASS" row too: an
  *     identity-bearing command whose only identity-bearing pieces already
  *     carry a valid inline override needs no rewrite (`rewriteGitNetworkCommands`'s
  *     `unchanged` outcome), but it still made a real identity decision.
@@ -79,9 +78,9 @@ import type { ActivityNote, HookHandler, HookInvocation, HookResult } from './co
 
 export const HOOKS_LOG_REL = '.adl/logs/hooks.log'
 export const HOOKS_DENY_LOG_REL = '.adl/logs/hooks-deny.log'
-export const MAX_LOGGED_COMMAND_LENGTH = 2000
+const MAX_LOGGED_COMMAND_LENGTH = 2000
 
-export function truncateCommand(value: string): string {
+function truncateCommand(value: string): string {
   return value.length > MAX_LOGGED_COMMAND_LENGTH ? `${value.slice(0, MAX_LOGGED_COMMAND_LENGTH)}...<truncated>` : value
 }
 
@@ -108,7 +107,7 @@ const stringAt = (record: Readonly<Record<string, unknown>>, key: string): strin
  * `{"command": "...", "cwd": "...", "sandbox": false}` (no `tool_input` at
  * all). No Cursor-specific field renaming was needed here.
  */
-export function toolSummary(payload: Readonly<Record<string, unknown>>): string {
+function toolSummary(payload: Readonly<Record<string, unknown>>): string {
   const rawInput = payload.tool_input
   const input = typeof rawInput === 'object' && rawInput !== null && !Array.isArray(rawInput) ? (rawInput as Record<string, unknown>) : {}
   for (const key of ['command', 'cmd', 'script']) {
@@ -172,8 +171,7 @@ export async function runLogged(inv: HookInvocation, handler: HookHandler, now:
     const duration = Math.round(performance.now() - started)
     const sessionId = sessionOf(inv.payload)
     const runId = runIdOf(inv.env)
-    // M8 (STATUS.md 12p): the EFFECTIVE identity
-    // this decision used — set on `outcome` whenever an identity decision
+    // The EFFECTIVE identity this decision used — set on `outcome` whenever an identity decision
     // was actually made (`../pre-tool-use/handler.ts`'s `effectiveIdentityFor`)
     // — wins over the session's raw `ADL_AGENT_ID_AGENT` env var: they
     // differ exactly when the command carries a valid inline override

package/packages/agent-hooks/src/hooks/user-prompt-submit/match.ts

@@ -51,7 +51,7 @@ function processTerm(term: string): string | null {
  * so it is rebuilt per invocation rather than persisted — that keeps the hook
  * stateless and makes an edited SKILL.md take effect immediately.
  */
-export function buildIndex(skills: readonly Skill[]): MiniSearch {
+function buildIndex(skills: readonly Skill[]): MiniSearch {
   const index = new MiniSearch({
     fields: ['name', 'keywords', 'description'],
     storeFields: ['label', 'description'],

package/packages/agent-hooks/src/hooks/user-prompt-submit/tokenizer.ts

@@ -1,6 +1,6 @@
 /**
  * Minimal Unigram tokenizer over the pruned tokenizer.json of the
- * adl-embedding artifact. Pure TS — no dependency on a native tokenizer
+ * enact-embedding artifact. Pure TS — no dependency on a native tokenizer
  * package.
  *
  * Ported unchanged from enact-repo-controls-m5's

package/packages/agent-hooks/src/hooks/user-prompt-submit/vector.ts

@@ -10,10 +10,11 @@
  * the artifact from a repo-local `.cache/enact-embedding/model/` directory
  * built by that repo's own installer. This hook instead treats the model as a
  * GLOBAL, machine-wide asset shared by every repository —
- * `resolveGlobalArtifactDir` resolves `${XDG_CACHE_HOME:-$HOME/.cache}/adl-embedding/model/`
- * (renamed from `enact-embedding`, matching `packages/fleet/src/install-embedding-model.ts`,
- * the installer that actually writes this directory) from the invocation's
- * own `env`, never `process.env` and never repo-relative.
+ * `resolveGlobalArtifactDir` resolves `${XDG_CACHE_HOME:-$HOME/.cache}/enact-embedding/model/`
+ * (matching `packages/fleet/src/install-embedding-model.ts`, the installer that
+ * actually writes this directory; the earlier `adl-embedding` name is a hard
+ * cut, never read as a fallback) from the invocation's own `env`, never
+ * `process.env` and never repo-relative.
  *
  * `loadVectorHalf`'s `LoadVectorResult.reason` (on `ok: false`) already
  * carries a specific, human-readable cause (directory missing, which files
@@ -37,7 +38,7 @@ const ARTIFACT_FILES = ['model.bin', 'tokenizer.json', 'tokenizer_config.json',
 export function resolveGlobalArtifactDir(env: Readonly<Record<string, string | undefined>>): string {
   const xdgCacheHome = env.XDG_CACHE_HOME
   const base = xdgCacheHome && xdgCacheHome.trim() !== '' ? xdgCacheHome : join(requireHome(env), '.cache')
-  return join(base, 'adl-embedding', 'model')
+  return join(base, 'enact-embedding', 'model')
 }
 
 function requireHome(env: Readonly<Record<string, string | undefined>>): string {

package/packages/agent-hooks/src/hosts/registry.ts

@@ -15,7 +15,7 @@ import { cursorSpec } from './impl/cursor.ts'
 import { opencodeSpec } from './impl/opencode.ts'
 import { kimiSpec } from './impl/kimi.ts'
 
-export const HOST_SPECS: Readonly<Record<HostId, HostSpec>> = {
+const HOST_SPECS: Readonly<Record<HostId, HostSpec>> = {
   claude: claudeSpec,
   codex: codexSpec,
   cursor: cursorSpec,

package/packages/agent-hooks/src/log/adl-dir.ts

@@ -0,0 +1,44 @@
+/**
+ * The one place that makes a repository's `.adl/` folder self-ignoring.
+ *
+ * Every adl component that creates `<repo>/.adl/` (the `.adl/logs/` writer,
+ * `adl run`'s transcript, the crg background update, the git-hook log seam)
+ * calls `ensureAdlGitignore` right after it creates the directory. The file it
+ * writes, `.adl/.gitignore` containing exactly `*\n`, ignores the folder's whole
+ * content INCLUDING itself, so `.adl/` never shows in `git status` -- in any git
+ * repository, adl-controlled or not, without ever editing the repo's own
+ * `.gitignore` (the `/.adl/` block `adl repo controls install` writes covers
+ * controlled repos only). Logs carry commands and output, so they must not be
+ * committable by accident.
+ *
+ * `apps/cli` and `packages/repo-controls` import this module by relative path
+ * (as they already do `./writer.ts`), so there is exactly one copy.
+ */
+import { writeFileSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+
+const ADL_DIR_NAME = ".adl";
+
+/** Exactly this content, nothing else: ignore every entry, this file included. */
+const ADL_GITIGNORE_CONTENT = "*\n";
+
+/**
+ * Finds the nearest `.adl` directory at or above `path` and, if it has no
+ * `.gitignore` yet, writes one containing `*\n`. An existing `.gitignore` is
+ * never overwritten or read. A `path` with no `.adl` segment (the
+ * `~/.local/state/adl/logs` fallback, a test tmp dir) is a no-op. The `.adl`
+ * directory must already exist; a missing one throws, like any other write.
+ */
+export function ensureAdlGitignore(path: string): void {
+  if (basename(path) !== ADL_DIR_NAME) {
+    const parent = dirname(path);
+    if (parent !== path) ensureAdlGitignore(parent);
+    return;
+  }
+  try {
+    // "wx": create only if absent -- an existing file is left untouched.
+    writeFileSync(join(path, ".gitignore"), ADL_GITIGNORE_CONTENT, { flag: "wx" });
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+  }
+}

package/packages/agent-hooks/src/log/writer.ts

@@ -2,7 +2,7 @@
  * The `.adl/logs/` logger (docs/architecture/cli-design.md §5a, item 9). `agent-hooks`
  * "holds logs" (§12): this module lives here and writes `hooks.log` /
  * `hooks-deny.log` (`../hooks/log.ts`); `apps/cli/src/log.ts` re-exports it
- * unchanged so `adl run`'s `tool-calls.log` writer keeps working. The module
+ * unchanged so `adl run`'s `agents/tool-calls.log` writer keeps working. The module
  * is generic across all five documented files so a caller never has to
  * reinvent the format.
  *
@@ -28,7 +28,8 @@ import {
   writeFileSync,
 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { basename, dirname, join } from "node:path";
+import { ensureAdlGitignore } from "./adl-dir.ts";
 
 export type LogFileName = "hooks" | "hooks-deny" | "tool-rewrites" | "tool-calls" | "repo-controls";
 
@@ -128,9 +129,22 @@ function tightenMode(path: string, target: number): void {
 function ensureDirSecure(dir: string): void {
   const parent = dirname(dir);
   mkdirSync(parent, { recursive: true });
+  // A nested log stream such as `.adl/logs/agents/` must not leave the
+  // repository's `.adl/` ancestor at the default mkdir mode (0755).
+  // Root-level streams already tightened it as `parent`; locate it rather
+  // than changing unrelated ancestors of the state-directory fallback.
+  let ancestor = parent;
+  while (ancestor !== dirname(ancestor)) {
+    if (basename(ancestor) === ".adl") {
+      tightenMode(ancestor, 0o700);
+      break;
+    }
+    ancestor = dirname(ancestor);
+  }
   tightenMode(parent, 0o700);
   mkdirSync(dir, { recursive: true });
   tightenMode(dir, 0o700);
+  ensureAdlGitignore(dir);
 }
 
 function ensureFileSecure(filePath: string): void {

package/packages/agent-hooks/src/main.ts

@@ -7,11 +7,9 @@
  *
  *   adl hook <kind> [subcommand] --host=<claude|codex|cursor|kimi|opencode>
  *
- *   kinds: pre-tool-use, user-prompt-submit, briefing, crg <subcommand>,
- *          lean-ctx <subcommand>
+ *   kinds: pre-tool-use, user-prompt-submit, briefing, crg <subcommand>
  *   crg subcommands: after-file-edit, pre-commit, session-stop
- *   lean-ctx subcommands: mcp, pre-tool-use, post-tool-use
- *   payload: JSON on stdin (NOT for `lean-ctx mcp` — see below)
+ *   payload: JSON on stdin
  *   --version prints the package version and exits 0
  *
  * Operator commands (src/cli/; no --host, no stdin):
@@ -30,14 +28,6 @@
  *     loud (non-zero exit, reason on stderr) — never silently ignored.
  *   - `[hooks] enabled = false`: silent no-op, same as unmanaged.
  *
- * `lean-ctx mcp` is the one exception to this whole flow (work item A.1): it
- * takes no JSON payload, needs no `--host`, and never no-ops for an
- * unmanaged repo (an MCP client that just spawned it expects a running
- * server, not a silent exit) — see `src/lean-ctx/mcp.ts`'s header. It is
- * dispatched before `--host` resolution, before stdin is read at all, and
- * bypasses `HookHandler`/`HookResult` entirely (real stdio passthrough
- * cannot be buffered into a string).
- *
  * Every other hook kind is dispatched through the shared `HookHandler` shape
  * in `src/hooks/contract.ts` so a handler never touches `process`, argv, or
  * stdin directly.
@@ -49,7 +39,7 @@
  * the shared fail-closed signal `pre-tool-use`'s own decisions already use
  * (`FAIL_CLOSED_EXIT_CODE`, `src/rules/engine.ts`) for Kimi/OpenCode denials.
  * Every other kind is advisory or best-effort (`user-prompt-submit`,
- * `briefing`, `crg`, `lean-ctx` pre/post/mcp) and none of them has a "block"
+ * `briefing`, `crg`) and none of them has a "block"
  * concept at all — worse, on Claude Code and Codex, exit code 2 from
  * `UserPromptSubmit` specifically blocks the prompt AND ERASES IT (documented
  * Claude Code hook behaviour: a `UserPromptSubmit` hook exiting 2 shows
@@ -88,13 +78,11 @@ import { handlePreToolUse } from './pre-tool-use/handler.ts'
 import { handleUserPromptSubmit } from './hooks/user-prompt-submit/handler.ts'
 import { handleBriefing } from './hooks/briefing/handler.ts'
 import { handleCrg } from './hooks/crg/handler.ts'
-import { handleLeanCtx } from './hooks/lean-ctx/handler.ts'
-import { runLeanCtxMcp } from './lean-ctx/mcp.ts'
 import { runRules } from './cli/rules.ts'
 import { runDoctor } from './cli/doctor.ts'
 import { runLogged } from './hooks/log.ts'
 
-const HOOK_KINDS = ['pre-tool-use', 'user-prompt-submit', 'briefing', 'crg', 'lean-ctx'] as const
+const HOOK_KINDS = ['pre-tool-use', 'user-prompt-submit', 'briefing', 'crg'] as const
 type HookKind = (typeof HOOK_KINDS)[number]
 
 function isHookKind(value: string | undefined): value is HookKind {
@@ -102,14 +90,12 @@ function isHookKind(value: string | undefined): value is HookKind {
 }
 
 const CRG_SUBCOMMANDS = ['after-file-edit', 'pre-commit', 'session-stop'] as const
-const LEAN_CTX_SUBCOMMANDS = ['mcp', 'pre-tool-use', 'post-tool-use'] as const
 
 const HANDLERS: Readonly<Record<HookKind, HookHandler>> = {
   'pre-tool-use': handlePreToolUse,
   'user-prompt-submit': handleUserPromptSubmit,
   briefing: handleBriefing,
   crg: handleCrg,
-  'lean-ctx': handleLeanCtx,
 }
 
 /** Exit code `pre-tool-use` alone uses to fail closed on an undecidable payload — see this file's header (work item D). */
@@ -167,24 +153,6 @@ export async function run(argv: readonly string[]): Promise<number> {
     }
     subcommand = candidate
   }
-  if (kind === 'lean-ctx') {
-    const candidate = argv[1]
-    if (candidate === undefined || !(LEAN_CTX_SUBCOMMANDS as readonly string[]).includes(candidate)) {
-      process.stderr.write(
-        `adl hook: lean-ctx requires a subcommand (one of ${LEAN_CTX_SUBCOMMANDS.join(', ')})\n`,
-      )
-      return 1
-    }
-    subcommand = candidate
-  }
-
-  // `lean-ctx mcp` bypasses everything below: no --host, no stdin-as-JSON,
-  // no HookHandler dispatch, and unmanaged is NOT a no-op — see
-  // `./lean-ctx/mcp.ts`'s header and this file's own header (work item A.1).
-  if (kind === 'lean-ctx' && subcommand === 'mcp') {
-    return runLeanCtxMcp(process.cwd(), process.env)
-  }
-
   // az385: host resolution failure fails CLOSED (FAIL_CLOSED_EXIT_CODE, 2)
   // only for pre-tool-use — the one kind whose job is "block a dangerous
   // action," matching the invalid-JSON-on-stdin split a few lines below and
@@ -217,11 +185,9 @@ export async function run(argv: readonly string[]): Promise<number> {
   // `adl-config.toml` where `adl hooks deploy` has run — nowhere else. No
   // git root, or no `adl-config.toml` above `cwd`: a strict no-op (this
   // file's own header) — no rule evaluation, no identity check, no
-  // `hooks.log` write. This REVERSES the earlier "global identity baseline"
-  // (W2 build item 3 / STATUS.md 12p): that baseline
-  // ran the four (later seven, R2) identity rules even in an unmanaged
-  // repo; Tarun decided the repos where `adl-config.toml` does not exist
-  // have no business running hooks at all.
+  // `hooks.log` write. There is no global identity baseline: a repo where
+  // `adl-config.toml` does not exist has no business running hooks at all.
+  // The same no-op applies when `[hooks] enabled = false` (below).
   const managed = resolveManagedRepo(realRootIO, cwd)
   if (!managed.managed || managed.root === null || managed.configPath === null) {
     return writeResult(silentNoop())