@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.26

package/packages/fleet/src/install-embedding-model.ts

@@ -1,7 +1,7 @@
 /**
- * Global installer for the `adl-embedding` static (Model2Vec) embedding
+ * Global installer for the `enact-embedding` static (Model2Vec) embedding
  * artifact that `adl hook`'s skill-match hook loads from
- * `${XDG_CACHE_HOME:-$HOME/.cache}/adl-embedding/model/` (falling back to
+ * `${XDG_CACHE_HOME:-$HOME/.cache}/enact-embedding/model/` (falling back to
  * BM25 when absent) — see enact-repo-controls-m5's
  * `src/hooks/user-prompt-submit/vector.ts`, which this script's output must
  * satisfy exactly: `model.bin`, `tokenizer.json`, `tokenizer_config.json`,
@@ -76,7 +76,7 @@ const UPSTREAM_FILE_NAMES = ['model.safetensors', 'tokenizer.json', 'tokenizer_c
 export function resolveArtifactDir(env: Readonly<Record<string, string | undefined>>): string {
   const xdgCacheHome = env.XDG_CACHE_HOME
   const base = xdgCacheHome && xdgCacheHome.trim() !== '' ? xdgCacheHome : join(requireHome(env), '.cache')
-  return join(base, 'adl-embedding', 'model')
+  return join(base, 'enact-embedding', 'model')
 }
 
 function requireHome(env: Readonly<Record<string, string | undefined>>): string {
@@ -255,7 +255,7 @@ export interface EmbeddingModelDeps {
   readonly downloadFile: (url: string, dest: string) => void
 }
 
-export const defaultDeps: EmbeddingModelDeps = {
+const defaultDeps: EmbeddingModelDeps = {
   resolveLatestRevision: defaultResolveLatestRevision,
   fetchPathsInfo: defaultFetchPathsInfo,
   downloadFile: defaultDownloadFile,
@@ -279,13 +279,13 @@ export async function install(spec: EmbeddingModelSpec, artifactDir: string, dep
   const revision = await deps.resolveLatestRevision(spec.source)
 
   if (isInstalledAtRevision(artifactDir, revision)) {
-    console.log(`adl-embedding: already installed and verified at ${artifactDir} (${spec.source}@${revision})`)
+    console.log(`enact-embedding: already installed and verified at ${artifactDir} (${spec.source}@${revision})`)
     return
   }
 
-  const work = mkdtempSync(join(tmpdir(), 'adl-embedding-install-'))
+  const work = mkdtempSync(join(tmpdir(), 'enact-embedding-install-'))
   try {
-    console.log(`adl-embedding: installing ${spec.package} ${spec.version} (${spec.source}@${revision})`)
+    console.log(`enact-embedding: installing ${spec.package} ${spec.version} (${spec.source}@${revision})`)
 
     const pathsInfo = await deps.fetchPathsInfo(spec.source, revision, UPSTREAM_FILE_NAMES)
     const downloadedPaths: Record<string, string> = {}
@@ -345,7 +345,7 @@ export async function install(spec: EmbeddingModelSpec, artifactDir: string, dep
       writeFileSync(staged, readFileSync(join(outDir, name)))
       renameSync(staged, join(artifactDir, name))
     }
-    console.log(`adl-embedding: installed and verified at ${artifactDir} (${spec.source}@${revision})`)
+    console.log(`enact-embedding: installed and verified at ${artifactDir} (${spec.source}@${revision})`)
   } finally {
     rmSync(work, { recursive: true, force: true })
   }
@@ -353,18 +353,18 @@ export async function install(spec: EmbeddingModelSpec, artifactDir: string, dep
 
 export function uninstall(artifactDir: string): void {
   if (!existsSync(artifactDir)) {
-    console.log(`adl-embedding: nothing to remove at ${artifactDir}`)
+    console.log(`enact-embedding: nothing to remove at ${artifactDir}`)
     return
   }
   rmSync(artifactDir, { recursive: true, force: true })
-  console.log(`adl-embedding: removed ${artifactDir}`)
+  console.log(`enact-embedding: removed ${artifactDir}`)
 }
 
 function usage(): never {
   throw new Error('usage: install-embedding-model <install|check|uninstall> --spec JSON [--home ABSOLUTE_PATH]')
 }
 
-export async function main(argv: readonly string[]): Promise<void> {
+async function main(argv: readonly string[]): Promise<void> {
   const mode = argv[0]
   if (mode !== 'install' && mode !== 'check' && mode !== 'uninstall') usage()
 
@@ -394,8 +394,8 @@ export async function main(argv: readonly string[]): Promise<void> {
     const ok = isInstalledAtRevision(artifactDir, revision)
     console.log(
       ok
-        ? `adl-embedding: installed and verified at ${artifactDir} (${spec.source}@${revision})`
-        : `adl-embedding: NOT installed at latest revision ${revision} at ${artifactDir}`,
+        ? `enact-embedding: installed and verified at ${artifactDir} (${spec.source}@${revision})`
+        : `enact-embedding: NOT installed at latest revision ${revision} at ${artifactDir}`,
     )
     process.exitCode = ok ? 0 : 1
     return

package/packages/fleet/src/managed-settings.ts

@@ -1,6 +1,6 @@
 /**
- * Render and install the managed baseline hook artifacts (adl items 10/17,
- * `docs/architecture/cli-design.md` §2/§3) from the committed templates in
+ * Render and install the managed baseline hook artifacts
+ * (`docs/architecture/cli-design.md` §2/§3) from the committed templates in
  * `packages/agent-settings/managed/` onto the real, per-platform system
  * paths -- the "fleet installation" that directory's own README used to say
  * was a separate, later item. It is this reconcile pass.
@@ -70,7 +70,7 @@
  *          best-effort, never depended on) -- the actual, CONFIRMED
  *          enforcement is `allow_managed_hooks_only` above plus the
  *          fail-closed managed baseline hook
- *          (`adl.session-required-for-writes`): a missing or overridden
+ *          (`adl.run-required-for-writes`): a missing or overridden
  *          `ADL_AGENT_ID_AGENT` denies Azure DevOps writes for that session,
  *          exactly like a plain `codex` with no `adl run` today -- it never
  *          grants anything by being absent. Installed at
@@ -92,8 +92,8 @@ import { DEFAULT_AGENT_PATTERN } from './default-agent-file.ts'
 export type FleetPlatform = 'mac' | 'linux'
 
 const MANAGED_DIR = fileURLToPath(new URL('../../agent-settings/managed', import.meta.url))
-export const CLAUDE_TEMPLATE_PATH = join(MANAGED_DIR, 'claude-managed-settings.json')
-export const CODEX_REQUIREMENTS_TEMPLATE_PATH = join(MANAGED_DIR, 'codex-requirements.toml')
+const CLAUDE_TEMPLATE_PATH = join(MANAGED_DIR, 'claude-managed-settings.json')
+const CODEX_REQUIREMENTS_TEMPLATE_PATH = join(MANAGED_DIR, 'codex-requirements.toml')
 
 export function claudeManagedSettingsPath(platform: FleetPlatform, root = ''): string {
   switch (platform) {
@@ -153,7 +153,7 @@ export function renderCodexManagedConfig(agent: string): string {
 # https://developers.openai.com/codex/config-reference. Deployed anyway
 # because it is harmless if ignored or overridden: unsetting
 # ADL_AGENT_ID_AGENT here grants nothing -- the managed baseline hook
-# (adl.session-required-for-writes, CONFIRMED enforced from
+# (adl.run-required-for-writes, CONFIRMED enforced from
 # allow_managed_hooks_only in requirements.toml in this same directory) then
 # denies Azure DevOps writes for that session, fail-closed, exactly like a
 # plain \`codex\` with no \`adl run\` today. That hook is the real backstop,
@@ -168,7 +168,7 @@ set = { ADL_AGENT_ID_AGENT = "${agent}" }
 `
 }
 
-export interface FileWriteResult {
+interface FileWriteResult {
   readonly path: string
   readonly changed: boolean
 }

package/packages/fleet/src/repo-maintain.ts

@@ -22,12 +22,20 @@
  *      integration/main/master/develop and HEAD are never deleted, the KEEP
  *      most recent branches are kept, and only "[gone]" upstreams (-D) or
  *      branches merged into the baseline (-d) are deleted;
- *   4. `adl install --repo <repo>` -- the existing per-repo enrolment.
+ *   4. the stale-branch prune (only when `branchMaxAgeDays` is configured, from
+ *      the manifest's `config.repo_maintain.branch_max_age_days`): every local
+ *      branch whose TIP commit is older than that many days is deleted with
+ *      `git branch -D` -- never integration/main/master/develop, the checked-out
+ *      HEAD, or a branch checked out in any worktree. Each deletion is a
+ *      `WARN repo-maintain: <repo>: deleted stale branch <name> at <sha> (last
+ *      commit <date>)` line, which is how a deleted branch is recovered from the
+ *      log (`git branch <name> <sha>`); a dry run lists them without deleting;
+ *   5. `adl install --repo <repo>` -- the existing per-repo enrolment.
  *
  * This runs as the device administrator, never root (the caller,
  * bin/reconcile-host, drops privileges and `adl maintain --expect-user`
- * refuses otherwise). It never migrates enact-config.toml: a repo that has
- * both markers is a named failure.
+ * refuses otherwise). It never reads, migrates or modifies enact-config.toml:
+ * a repo may carry both markers, and adl-config.toml alone decides scope.
  *
  * Reporting: plain progress lines go to `out`; every warning and failure goes
  * to `err` as `WARN repo-maintain: ...` / `ERROR repo-maintain: ...` (the
@@ -42,9 +50,7 @@ import { NO_AGENT_IDENTITY_MESSAGE, resolveAgentIdentity } from '../../azdo/src/
 export const TCC_DENIED_MARKER = 'TCC denied'
 
 /** The file whose presence puts a repository in this step's scope. */
-export const MARKER = 'adl-config.toml'
-/** The retired marker; a repo with both is ambiguous and fails loud. */
-const LEGACY_MARKER = 'enact-config.toml'
+const MARKER = 'adl-config.toml'
 
 /** Branches fast-forwarded, in this order. */
 const SYNCED_BRANCHES = ['integration', 'main'] as const
@@ -65,6 +71,14 @@ export interface MaintainOptions {
   readonly keep?: number
   /** Report only: fetches, but never moves a ref, deletes a branch or runs install. */
   readonly dryRun?: boolean
+  /**
+   * Delete local branches whose tip commit is older than this many days (a
+   * positive whole number). Unset: no age-based deletion. The manifest's
+   * `config.repo_maintain.branch_max_age_days`, never an environment variable.
+   */
+  readonly branchMaxAgeDays?: number
+  /** The clock, injectable for tests. Default: the current time. */
+  readonly now?: () => Date
   /** Environment for identity resolution and every child. Default process.env. */
   readonly env?: NodeJS.ProcessEnv
   readonly out?: (line: string) => void
@@ -87,15 +101,18 @@ export function listFailureLines(root: string, error: unknown, executable: strin
   const code = (error as { code?: unknown } | null)?.code
   if (code === 'ENOTDIR') return [`${root}: ${message}`]
   const lines = [`${root}: cannot list: ${message}`]
-  if (code === 'EPERM') {
-    lines.push(
-      `${root}: ${TCC_DENIED_MARKER}: macOS privacy protection blocked ${executable}; ` +
-        `one-time fix: System Settings › Privacy & Security › Full Disk Access › + › add ${executable}`,
-    )
-  }
+  if (code === 'EPERM') lines.push(tccDeniedLine(root, executable))
   return lines
 }
 
+/** The one Full Disk Access hint, for a refused readdir and for a git child refused the same way. */
+function tccDeniedLine(path: string, executable: string): string {
+  return (
+    `${path}: ${TCC_DENIED_MARKER}: macOS privacy protection blocked ${executable}; ` +
+    `one-time fix: System Settings › Privacy & Security › Full Disk Access › + › add ${executable}`
+  )
+}
+
 interface GitResult {
   readonly ok: boolean
   readonly stdout: string
@@ -120,29 +137,6 @@ function isForbiddenAzurePipelinesPath(path: string): boolean {
   }
 }
 
-/** `packages/<name>/enact-config.toml` -- the per-package copies of the retired marker. */
-function legacyMarkers(repo: string): string[] {
-  const found: string[] = []
-  const tryStat = (relative: string): void => {
-    try {
-      if (statSync(join(repo, relative)).isFile()) found.push(relative)
-    } catch (error) {
-      if (errorCode(error) !== 'ENOENT' && errorCode(error) !== 'ENOTDIR') throw error
-    }
-  }
-  tryStat(LEGACY_MARKER)
-  let packages: Dirent[] = []
-  try {
-    packages = readdirSync(join(repo, 'packages'), { withFileTypes: true })
-  } catch (error) {
-    if (errorCode(error) !== 'ENOENT' && errorCode(error) !== 'ENOTDIR') throw error
-  }
-  for (const entry of packages.sort((a, b) => a.name.localeCompare(b.name))) {
-    if (entry.isDirectory()) tryStat(join('packages', entry.name, LEGACY_MARKER))
-  }
-  return found
-}
-
 export function maintainRepositories(options: MaintainOptions): MaintainResult {
   const env = options.env ?? process.env
   const keep = options.keep ?? DEFAULT_KEEP
@@ -165,6 +159,13 @@ export function maintainRepositories(options: MaintainOptions): MaintainResult {
     return { ok: result.status === 0, stdout: result.stdout, stderr: result.stderr ?? '' }
   }
 
+  const maxAgeDays = options.branchMaxAgeDays
+  if (maxAgeDays !== undefined && (!Number.isInteger(maxAgeDays) || maxAgeDays < 1)) {
+    fail(`branch max age must be a positive whole number of days: ${maxAgeDays}`, 'branch-max-age-days')
+    return { ok: false, repositories: 0, failures }
+  }
+  const now = options.now ?? ((): Date => new Date())
+
   const { location } = options
   if (!isAbsolute(location)) {
     fail(`location must be an absolute path: ${location}`, location)
@@ -196,7 +197,7 @@ export function maintainRepositories(options: MaintainOptions): MaintainResult {
   }
   if (agent !== undefined) identityEnv = { ADL_AGENT_ID_AGENT: agent }
 
-  info(`start location=${location} keep=${keep} dry=${dry ? 1 : 0}`)
+  info(`start location=${location} keep=${keep} dry=${dry ? 1 : 0}${maxAgeDays === undefined ? '' : ` branch_max_age_days=${maxAgeDays}`}`)
 
   let entries: Dirent[]
   let locationReal: string
@@ -242,19 +243,10 @@ export function maintainRepositories(options: MaintainOptions): MaintainResult {
     }
     seen.add(real)
 
-    // 3. In scope from here on.
-    let legacy: string[]
-    try {
-      legacy = legacyMarkers(real)
-    } catch (error) {
-      fail(`${real}: cannot read: ${error instanceof Error ? error.message : String(error)}`, real)
-      continue
-    }
-    if (legacy.length > 0) {
-      fail(`${real}: duplicate markers: ${MARKER} and ${LEGACY_MARKER} (${legacy.join(', ')}); migrate or remove one`, real)
-      continue
-    }
-    if (!isGitToplevel(real)) {
+    // 3. In scope from here on. enact-config.toml may sit beside the marker; it is never read.
+    const toplevel = gitToplevelState(real)
+    if (toplevel === 'failed') continue
+    if (toplevel === 'not-toplevel') {
       warn(`${real}: ${MARKER} but not a git top-level; skipped`)
       continue
     }
@@ -265,13 +257,33 @@ export function maintainRepositories(options: MaintainOptions): MaintainResult {
   info(`done (${repositories} repositories, ${failures.length} failed)`)
   return { ok: failures.length === 0, repositories, failures }
 
-  function isGitToplevel(directory: string): boolean {
+  /**
+   * 'not-toplevel' only on git's own "not a git repository" answer (exit 128) or
+   * a toplevel that is a different directory. Anything else (spawn error, other
+   * exit status, unresolvable toplevel) is reported here as a failure naming the
+   * directory, and the repo is not maintained: it may hide an in-scope repository.
+   */
+  function gitToplevelState(directory: string): 'toplevel' | 'not-toplevel' | 'failed' {
+    const command = 'git rev-parse --show-toplevel'
     const top = spawnSync('git', ['-C', directory, 'rev-parse', '--show-toplevel'], { encoding: 'utf8', env: childEnv() })
-    if (top.error !== undefined || top.status !== 0) return false
+    if (top.error !== undefined) {
+      fail(`${directory}: cannot run ${command}: ${top.error.message}`, directory)
+      return 'failed'
+    }
+    const stderr = (top.stderr ?? '').trim()
+    if (top.status === 128 && stderr.includes('not a git repository')) return 'not-toplevel'
+    if (top.status !== 0) {
+      const shown = stderr.split('\n').slice(0, 3).join(' | ')
+      fail(`${directory}: ${command} exited ${top.status ?? `by signal ${top.signal}`}: ${shown}`, directory)
+      // git's "Operation not permitted" is TCC refusing the files to this job's responsible process (adl).
+      if (stderr.includes('Operation not permitted')) errOut(`ERROR repo-maintain: ${tccDeniedLine(directory, options.executable)}`)
+      return 'failed'
+    }
     try {
-      return realpathSync(top.stdout.trim()) === directory
-    } catch {
-      return false
+      return realpathSync(top.stdout.trim()) === directory ? 'toplevel' : 'not-toplevel'
+    } catch (error) {
+      fail(`${directory}: cannot resolve git toplevel ${top.stdout.trim()}: ${error instanceof Error ? error.message : String(error)}`, directory)
+      return 'failed'
     }
   }
 
@@ -312,7 +324,10 @@ export function maintainRepositories(options: MaintainOptions): MaintainResult {
     // 3. guarded prune.
     prune(repo, name, current)
 
-    // 4. the per-repo enrolment.
+    // 4. stale-branch prune: by the tip commit's age.
+    if (maxAgeDays !== undefined) pruneStale(repo, name, current, maxAgeDays)
+
+    // 5. the per-repo enrolment.
     const argv = [...options.install.leadingArgs, 'install', '--repo', repo]
     const shown = `adl install --repo ${repo}`
     if (dry) {
@@ -368,6 +383,27 @@ export function maintainRepositories(options: MaintainOptions): MaintainResult {
     }
   }
 
+  function pruneStale(repo: string, name: string, current: string, days: number): void {
+    const cutoff = now().getTime() / 1000 - days * 86_400
+    // %1f (unit separator) cannot appear in a ref name, unlike `|`.
+    const format = '%(refname:short)%1f%(objectname)%1f%(committerdate:unix)%1f%(worktreepath)'
+    for (const line of lines(git(repo, 'for-each-ref', 'refs/heads/', `--format=${format}`).stdout)) {
+      const [branch = '', sha = '', committed = '', worktree = ''] = line.split('\x1f')
+      if (branch === '' || PROTECTED.has(branch) || branch === current) continue
+      const tip = Number(committed)
+      if (!Number.isFinite(tip) || tip >= cutoff) continue
+      // A branch checked out in any worktree (the main one included) is in use.
+      if (worktree !== '') {
+        info(`${name}: kept stale branch ${branch} (checked out in ${worktree})`)
+        continue
+      }
+      const described = `stale branch ${branch} at ${sha} (last commit ${new Date(tip * 1000).toISOString().slice(0, 10)})`
+      if (dry) info(`${name}: [dry] would delete ${described}`)
+      else if (git(repo, 'branch', '-D', branch).ok) warn(`${name}: deleted ${described}`)
+      else warn(`${name}: could not delete ${described}`)
+    }
+  }
+
   function prune(repo: string, name: string, current: string): void {
     const base = baselineFor(repo)
     const keptRecent = new Set(

package/packages/fleet/src/scratch-reap.ts

@@ -34,12 +34,12 @@ import { defaultAgentFilePath, type FleetPlatform } from './default-agent-file.t
 // apps/cli/src/commands/mcp.ts's own cross-package import of packages/azdo:
 // this workspace has no node_modules/@adl/* symlinks without `bun install`.
 // packages/azdo/src/lib/agent-identity.ts is now THE one place the
-// default-agent file is READ from (STATUS.md 12p,
-// W1); this package's own default-agent-file.ts keeps only the WRITE side
-// (`reconcileDefaultAgentFile`) plus the path computation both sides need.
+// default-agent file is READ from; this package's own default-agent-file.ts
+// keeps only the WRITE side (`reconcileDefaultAgentFile`) plus the path
+// computation both sides need.
 import { NO_AGENT_IDENTITY_MESSAGE, resolveAgentIdentity } from '../../azdo/src/lib/agent-identity.ts'
 
-export type Mode = 'plan' | 'apply'
+type Mode = 'plan' | 'apply'
 
 export type GitResult = { ok: boolean; stdout: string; stderr: string }
 export type Git = (args: string[], cwd: string) => GitResult
@@ -530,7 +530,7 @@ function usage(): never {
   process.exit(2)
 }
 
-export function main(argv: string[]): number {
+function main(argv: string[]): number {
   const repos: string[] = []
   let mode: Mode = 'plan'
   let idleDays = 1

package/packages/fleet/src/vscode-settings.ts

@@ -21,7 +21,7 @@
  * format and default/named-profile directory shape, under its own
  * `Application Support`/`.config` folder name (`Cursor` instead of `Code`) —
  * this is the standard, well-known Cursor Application Support location
- * (docs/operations/research-2026-09-27-worktree-controls-per-surface.md confirms
+ * (docs/research/research-2026-09-27-worktree-controls-per-surface.md confirms
  * `~/.cursor/worktrees/<repo>/` for worktree storage and that
  * `cursor.worktreeMaxCount` lives in "the regular Cursor settings.json (user
  * or workspace scope, VS Code-style)", but does not separately spell out the
@@ -51,14 +51,14 @@ import { basename, dirname, isAbsolute, join } from 'node:path'
 export type VscodePlatform = 'mac' | 'linux'
 
 /** A managed setting's value: VS Code's two owned keys are boolean; Cursor's `worktreeMaxCount` is numeric. */
-export type SettingValue = boolean | number
+type SettingValue = boolean | number
 
 export const REQUIRED_VSCODE_SETTINGS = {
   'git.detectWorktrees': true,
   'scm.alwaysShowRepositories': true,
 } as const
 
-export const APPLY_TO_ALL_PROFILES_SETTING = 'workbench.settings.applyToAllProfiles'
+const APPLY_TO_ALL_PROFILES_SETTING = 'workbench.settings.applyToAllProfiles'
 
 /**
  * `cursor.worktreeMaxCount` — docs/operations/worktree-guard.md L0. Deployed as a
@@ -75,7 +75,7 @@ export const REQUIRED_CURSOR_SETTINGS = {
   'cursor.worktreeMaxCount': 3,
 } as const
 
-export interface EditorSettingsSpec {
+interface EditorSettingsSpec {
   readonly requiredSettings: Readonly<Record<string, SettingValue>>
   /** VS Code only: the setting id that collects a profile-wide apply-to-all list. Omit for editors with no confirmed equivalent (Cursor). */
   readonly applyToAllProfilesSetting?: string
@@ -90,7 +90,7 @@ const CURSOR_SPEC: EditorSettingsSpec = {
   requiredSettings: REQUIRED_CURSOR_SETTINGS,
 }
 
-export interface VscodeSettingsFileResult {
+interface VscodeSettingsFileResult {
   readonly path: string
   readonly changed: boolean
   readonly missing: boolean