@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/agent-hooks/src/rules/shell/invocation.ts

@@ -42,11 +42,12 @@ export type Invocation =
        * The raw command word that invoked git — `git`/`git.exe` when run by
        * bare name (the common case, and the only one `git-worktree`'s
        * synthetic shortcut below ever produces), or the exact path when run
-       * by one (`/usr/local/bin/git`, `/usr/bin/git`, …). H2
-       * (`adl-git-credential-bypass.ts`) denies an ABSOLUTE path other than
+       * by one (`/usr/local/bin/git`, `/usr/bin/git`, …).
+       * `adl.git-credential-bypass` (`adl-git-credential-bypass.ts`) denies an ABSOLUTE path other than
        * the managed front controller `/usr/local/bin/git` — an agent
-       * invoking git by any other absolute path bypasses `bin/git-ado`
-       * entirely, since that routing lives at exactly that one path. Absent
+       * invoking git by any other absolute path bypasses the `bin/git` front
+       * controller and git-ado entirely, since that routing lives at exactly
+       * that one path. Absent
        * on the `git-worktree` binary shortcut (no real "binary word" to
        * report there).
        */
@@ -65,8 +66,8 @@ export type Invocation =
   | { readonly kind: 'git-internals-write'; readonly name: string; readonly targets: readonly string[] }
   /**
    * A command that writes into one of the seven tamper-protected carrier
-   * files (`.claude/settings.json`, `.codex/hooks.json`, `adl-config.toml`,
-   * …) via redirection, tee, mv/cp/install/ln, sed -i/perl -pi, truncate,
+   * files (`.claude/settings.json`, `.codex/hooks.json`,
+   * `.cursor/hooks.json`, …) via redirection, tee, mv/cp/install/ln, sed -i/perl -pi, truncate,
    * trash/rm/unlink/shred, or dd. See shell/protected-carrier-writes.ts;
    * denied by agent.tamper-protection. `git rm`/`checkout --`/`restore --`/
    * `reset --` on one of these files is a `'git'` Invocation instead — see
@@ -78,7 +79,7 @@ export type Invocation =
    * `az devops|repos|pipelines|boards|artifacts ...`. `args` is everything
    * after `az` itself (the subcommand group onward, e.g. `['repos', 'pr',
    * 'create', '--title', 'x']`) — carried so a rule can tell a mutating
-   * subcommand from a read one (`adl.session-required-for-writes`); denied
+   * subcommand from a read one (`adl.run-required-for-writes`); denied
    * outright regardless of that distinction by tool.azure-devops, which
    * ignores this field. See impl/tool-azure-devops.ts.
    */
@@ -282,10 +283,9 @@ const LEADING_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/
 /**
  * Whether `tokens` begins (after any leading `NAME=value` assignments) with
  * an `env`/`env.exe` invocation that carries `-S`/`--split-string` among its
- * own flags — R3 (STATUS.md 12p). Checked at `walk()`'s
- * own call site BEFORE `skipPrefixes` (../prefixes.ts's `skipEnvFlags`)
- * consumes `-S`/`--split-string` and its value as an opaque, value-taking
- * flag argument; this mirrors that same flag-scanning loop just far enough
+ * own flags. Checked at `walk()`'s own call site BEFORE `skipPrefixes`
+ * (../prefixes.ts's `skipEnvFlags`) consumes `-S`/`--split-string` and its
+ * value as an opaque, value-taking flag argument; this mirrors that same flag-scanning loop just far enough
  * to detect the flag's PRESENCE, without trying to parse or classify what
  * its value names. Narrow by design: only a leading `env`, not `env` nested
  * behind another wrapper (`sudo env -S …`) — the common, and only currently
@@ -523,90 +523,6 @@ function walkShellCommand(name: string, args: readonly Token[], cfg: ClassifyCon
   return null
 }
 
-const LEAN_CTX_COMMAND_NAMES: ReadonlySet<string> = new Set(['lean-ctx', 'lean-ctx.exe'])
-/** `lean-ctx raw`'s documented alias, plus `exec` ("Same as -c" per `lean-ctx help all`). */
-const LEAN_CTX_EXEC_WORDS: ReadonlySet<string> = new Set(['exec', 'raw', 'bypass'])
-/**
- * lean-ctx's own shell-hook re-exec placeholder (`exec lean-ctx -c
- * "$BASH_EXECUTION_STRING"`, injected into `~/.bashenv` by `lean-ctx setup`
- * — see `../impl/tool-lean-ctx-global.ts`'s module doc). Bash substitutes
- * the REAL command text into this variable inside the interactive shell's
- * OWN DEBUG-trap machinery — never inside a Bash-tool `command` string an
- * agent hands this hook. Reaching here unresolved means lean-ctx execs an
- * EMPTY command (the variable is unset in every context this static
- * scanner actually observes), not an unknown one, so it is recognized as
- * this ONE specific, known placeholder and left alone — rather than
- * failing closed on "any `$...`", which `dynamicToken` would otherwise do
- * for every other unresolvable value below.
- */
-const LEAN_CTX_SHELL_HOOK_PLACEHOLDER = '$BASH_EXECUTION_STRING'
-
-/**
- * lean-ctx's own arbitrary-command-execution surface — independent-review
- * finding 1 (HIGH, pre-existing, affects every rule): `-c [--raw]`, `-t`,
- * `exec`, `raw`/`bypass <command>` all hand a shell command to a REAL
- * shell, exactly like `bash -c`'s own script argument, but nothing walked
- * that argument before this fix — it was an opaque word inside an
- * unclassified `{kind:'command', name:'lean-ctx', ...}`.
- *
- * Verified against the real `lean-ctx 3.10.5` binary: `lean-ctx -c echo a
- * b` prints `a b` — every remaining word is joined with a single space
- * into ONE command string (not only the first), so `rest.map(tokenValue).
- * join(' ')` mirrors that exactly; a single already-quoted argument
- * (`-c "npm install"`) round-trips unchanged through the same join.
- *
- * `lean-ctx shell` (an interactive compressed shell) is the READ side of
- * the same risk when its stdin is fed by a pipe or a file redirection —
- * the commands it will run are whatever that feed contains, invisible to
- * this static scanner, so it fails closed as `uncertain` (matching how
- * every other unreadable script source in this file is handled) rather
- * than silently falling through to an unclassified allow. A bare `lean-ctx
- * shell` with no stdin feed is left unclassified (out of scope for this
- * finding — no probe or finding names that shape, and an interactive
- * session an agent cannot feed input into is not the arbitrary-command
- * risk this fix closes).
- *
- * Redirections between `lean-ctx` and its first argument (`lean-ctx
- * >/dev/null -c "cmd"`) are stripped here the same way `walkShell` strips
- * them for a real shell's own `-c` — `rawArgs` (`args` in `classify()`)
- * still carries them; the generic `{kind:'command', ...}` fallback and
- * `tool.lean-ctx-global-state`'s own `firstPositional` scan handle THAT
- * redirection-before-subcommand case for the subcommand forms this
- * function does not otherwise touch.
- */
-function walkLeanCtxExec(
-  name: string,
-  rawArgs: readonly Token[],
-  rawTokens: readonly Token[],
-  parser: Parser,
-  feed: StdinFeed | undefined,
-): readonly Invocation[] | null {
-  if (!LEAN_CTX_COMMAND_NAMES.has(name)) return null
-  const args = withoutRedirections(rawArgs)
-  if (args.length === 0) return null
-  const first = tokenValue(args[0] as Token)
-  const firstLower = first.toLowerCase()
-
-  if (firstLower === 'shell') {
-    return feed !== undefined || readsStdinFromFile(rawTokens) ? uncertain('lean-ctx shell fed from stdin') : null
-  }
-
-  let rest: readonly Token[] | null = null
-  if (first === '-c') {
-    const second = args[1]
-    rest = second !== undefined && tokenValue(second) === '--raw' ? args.slice(2) : args.slice(1)
-  } else if (first === '-t') {
-    rest = args.slice(1)
-  } else if (LEAN_CTX_EXEC_WORDS.has(firstLower)) {
-    rest = args.slice(1)
-  }
-  if (rest === null) return null
-  if (rest.length === 0) return uncertain('dynamic lean-ctx script')
-  if (rest.length === 1 && tokenValue(rest[0] as Token) === LEAN_CTX_SHELL_HOOK_PLACEHOLDER) return []
-  const joined = rest.map(tokenValue).join(' ')
-  return parser.parseScript(joined, feed)
-}
-
 const isTrashDestination = (token: Token): boolean => {
   const value = tokenValue(token).replace(/\/+$/, '')
   return value.endsWith('/.Trash') || value === '~/.Trash' || value.endsWith('/Trash')
@@ -669,11 +585,10 @@ function isBunTestSubcommand(args: readonly Token[]): boolean {
 /**
  * The real Azure CLI global parameters that can appear before ANY
  * subcommand group — https://learn.microsoft.com/cli/azure/reference-index
- * (checked 2026-09-28) — M6 (STATUS.md 12p):
- * without skipping these, `az --output json devops project list` read
- * `args[0]` as `--output`, not `devops`, never matched
- * `azureDevopsSubcommands`, and fell through to the generic `'command'` kind
- * — invisible to `tool.azure-devops`'s outright deny. `--help`/`-h`/
+ * (checked 2026-09-28): without skipping these,
+ * `az --output json devops project list` read `args[0]` as `--output`, not
+ * `devops`, never matched `azureDevopsSubcommands`, and fell through to the
+ * generic `'command'` kind — invisible to `tool.azure-devops`'s outright deny. `--help`/`-h`/
  * `--version`/`-v` are deliberately NOT skipped here: `isHelpOrVersionOnly`
  * already gates a purely-help invocation before this runs, and one
  * appearing BEFORE the subcommand group is real az's own "show generic
@@ -687,7 +602,7 @@ const AZ_GLOBAL_BOOLEAN_FLAGS: ReadonlySet<string> = new Set(['--debug', '--only
  * flag (or its value) — see `AZ_GLOBAL_VALUE_FLAGS`/`AZ_GLOBAL_BOOLEAN_FLAGS`.
  * `--flag=value` is a single word and is skipped as one. Exported (not just
  * used internally here) so `impl/tool-azure-devops.ts`'s own separate
- * `account get-access-token`/`rest` positional checks (M6) use the SAME
+ * `account get-access-token`/`rest` positional checks use the SAME
  * skip, rather than a second copy that could drift from this one.
  */
 export function skipAzGlobalFlags(args: readonly Token[]): number {
@@ -757,7 +672,7 @@ function walkNested(tokens: readonly Token[], index: number, args: readonly Toke
 }
 
 /** Nested shell scripts (`-c` arguments, here-document and here-string bodies fed to a shell) are walked at most this deep. */
-export const MAX_SHELL_SCRIPT_DEPTH = 16
+const MAX_SHELL_SCRIPT_DEPTH = 16
 
 /**
  * A piece's stdin when a pipe feeds it: every earlier stage of its pipeline
@@ -928,13 +843,13 @@ function makeParser(cfg: ClassifyConfig): Parser & { readonly parse: (command: s
   const walk = (rawTokens: readonly Token[], feed?: StdinFeed): readonly Invocation[] => {
     const input = detachShellInput(rawTokens, documents)
     const tokens = input.tokens
-    // R3 (STATUS.md 12p): `env -S`/`--split-string` splits its
-    // value into argv and execs it — but `skipPrefixes`'s own `skipEnvFlags`
-    // (../prefixes.ts) treats that value as an opaque, value-taking flag
-    // argument and skips straight past it, so whatever it actually names was
-    // previously invisible to every rule (a bare `env -S '<value>'` made
-    // `invocations()` return `[]` — no Invocation, so no rule's match() ever
-    // ran). Checked BEFORE `skipPrefixes` runs, so this fires instead of
+    // `env -S`/`--split-string` splits its value into argv and execs it —
+    // but `skipPrefixes`'s own `skipEnvFlags` (../prefixes.ts) treats that
+    // value as an opaque, value-taking flag argument and skips straight past
+    // it, so whatever it actually names would be invisible to every rule (a
+    // bare `env -S '<value>'` would make `invocations()` return `[]` — no
+    // Invocation, so no rule's match() ever runs). Checked BEFORE
+    // `skipPrefixes` runs, so it is reported as uncertain instead of
     // silently vanishing; see `envUsesSplitString`'s own doc.
     if (envUsesSplitString(tokens)) return [...uncertain('env -S/--split-string execution')]
     const index = skipPrefixes(tokens)
@@ -959,15 +874,6 @@ function makeParser(cfg: ClassifyConfig): Parser & { readonly parse: (command: s
     if (name === 'git-worktree' || name === 'git-worktree.exe') return [{ kind: 'git', subcommand: 'worktree', globals: [], rest: args }]
     if (dynamicToken(first)) return uncertain('dynamic shell command')
 
-    // Independent-review finding 1 (HIGH, pre-existing, affects every rule):
-    // lean-ctx's own -c/-t/exec/raw(/bypass) run an ARBITRARY shell command
-    // that nothing below this point ever inspected — see walkLeanCtxExec's
-    // own doc for the fix and the verified-against-the-real-binary behavior
-    // it relies on. Checked before walkShellCommand/walkToolCommand/the
-    // generic fallback, same priority as a real shell's own -c.
-    const leanCtxExec = walkLeanCtxExec(name, args, tokens, parser, feed)
-    if (leanCtxExec !== null) return leanCtxExec
-
     const shellCommand = walkShellCommand(name, args, cfg, parser, feed)
     const denied = deniedPathInvocation(name, args, cfg)
     if (denied !== null) return [denied]

package/packages/agent-hooks/src/rules/shell/piped-script.ts

@@ -20,7 +20,7 @@ import { splitShell } from './split.ts'
 import { nestedSources } from './substitution.ts'
 import { tokenize } from './token.ts'
 
-export const REMOTE_FETCHERS: ReadonlySet<string> = new Set([
+const REMOTE_FETCHERS: ReadonlySet<string> = new Set([
   'curl',
   'curlie',
   'wget',

package/packages/agent-hooks/src/rules/shell/prefixes.ts

@@ -53,7 +53,7 @@ export interface GitGlobalsScan {
   readonly terminal: boolean
 }
 
-export const COMMAND_PREFIXES = new Set([
+const COMMAND_PREFIXES = new Set([
   'sudo',
   'doas',
   'command',

package/packages/agent-hooks/src/rules/shell/protected-carrier-writes.ts

@@ -1,30 +1,31 @@
 /**
- * Filesystem writes into one of the seven tamper-protected carrier files —
+ * Filesystem writes into one of the tamper-protected carrier files —
  * the shell-command half of `agent.tamper-protection`.
  *
  * That rule's `match()` used to see only `tool-call` Write/Edit/MultiEdit/
  * NotebookEdit/Patch; a shell command reaching the same file through `>`,
  * `tee`, `mv`, `cp`, `install`, `ln -sf`, `sed -i`/`perl -pi`, `truncate`,
  * `trash`/`rm`/`unlink`/`shred`, or `dd of=` was invisible to it — measured
- * `{blocked: false}` against the real engine, closed here (STATUS.md 12p,
- * decision 13 follow-up, 2026-09-29).
+ * `{blocked: false}` against the real engine, which is why this module
+ * exists: hooks run per repo (Tarun, 2026-09-29), so the hook carriers are the
+ * enforcement layer, and an agent must not be able to edit its own guard away
+ * through the shell either.
  *
  * Deliberately mirrors `git-internals.ts`'s own redirection/operand
  * extraction (same incident shape: a denied edit tool is not the only way to
  * mutate a file) instead of re-deriving it — `nonOptionArgs`/`copyDestination`/
  * `inPlaceEditFiles`/`redirectionWriteTargets`/`withoutRedirections` are the
  * exact pure, path-agnostic pieces `git-internals.ts` already built and
- * tests; only the verb vocabulary (`shred` added; `chmod` added; `rsync`
- * added — P2, independent review, 2026-09-29, unlike `git-internals.ts`'s
- * own carve-out for `.git/hooks` there is no such exemption needed here;
- * `chown`/`chgrp` still excluded, not named by that finding) and the path
+ * tests; only the verb vocabulary (`shred`, `chmod` and `rsync` added;
+ * unlike `git-internals.ts`'s own carve-out for `.git/hooks` there is no such
+ * exemption needed here; `chown`/`chgrp` are not covered) and the path
  * predicate (`protectedCarrierMatch`/`protectedCarrierDirMatch` instead of
  * `isGitInternalsPath`) differ. `git rm`/`mv`/`checkout --`/`restore --`/
  * `reset --` are NOT handled here — those are `'git'`-kind Invocations, not
  * generic commands, and are checked directly in
  * `impl/agent-tamper-protection.ts`.
  *
- * P2 also asked for `mv`/`cp -r`/`rsync` onto (or, for `mv`, of) a carrier
+ * `mv`/`cp -r`/`rsync` onto (or, for `mv`, of) a carrier
  * DIRECTORY (`.claude`/`.codex`/`.cursor`/`.opencode` — deleting or
  * overwriting the whole directory takes the carrier file inside it with
  * it) — covered by the SAME candidate extraction as the file-level check,
@@ -56,7 +57,7 @@ const ANY_OPERAND = new Set(['rm', 'rm.exe', 'unlink', 'unlink.exe', 'trash', 't
 /** Tools where only the DESTINATION is a candidate write target. */
 const COPY_LIKE = new Set(['cp', 'ln', 'install'])
 
-/** `rsync ... SRC DEST` — the last positional operand is the destination (P2, independent review, 2026-09-29). */
+/** `rsync ... SRC DEST` — the last positional operand is the destination. */
 function rsyncDestination(args: readonly Token[]): string | null {
   const positional = nonOptionArgs(args)
   return positional.length >= 2 ? (positional[positional.length - 1] as string) : null
@@ -100,7 +101,7 @@ function writeTargetCandidates(name: string, rawArgs: readonly Token[], tokens:
  */
 const isDynamicCandidate = (target: string): boolean => /\$\(|`/.test(target) && !/^[<>]\(/.test(target)
 
-/** The protected-carrier paths (files or, P2, directories) `name args...` (with its whole token list, for redirections) would write to. */
+/** The protected-carrier paths (files or directories) `name args...` (with its whole token list, for redirections) would write to. */
 export function protectedCarrierWriteTargets(name: string, rawArgs: readonly Token[], tokens: readonly Token[]): readonly string[] {
   return writeTargetCandidates(name, rawArgs, tokens).filter(
     (candidate) => !isDynamicCandidate(candidate) && (protectedCarrierMatch(candidate) !== null || protectedCarrierDirMatch(candidate) !== null),

package/packages/agent-hooks/src/rules/shell/protected-carriers.ts

@@ -1,13 +1,14 @@
 /**
- * The seven tamper-protected carrier files — one source of the list.
+ * The tamper-protected carrier files — one source of the list.
  *
- * Decision 13 (STATUS.md 12p, 2026-09-29) closure: `agent.tamper-protection`
- * used to hard-code this Set inside `impl/agent-tamper-protection.ts` itself,
- * which worked while the only consumer was that rule's own `tool-call`
- * branch. Its shell-write coverage (`protected-carrier-writes.ts`) needs the
- * SAME list one layer down, in `shell/`, which `impl/*.ts` rules import FROM
- * — never the reverse — so the list moved here and `agent-tamper-protection.ts`
- * now imports it back, rather than keeping two copies that could drift.
+ * Hooks run only per repo, where `adl hooks deploy` has run (Tarun,
+ * 2026-09-29), so these carriers are the enforcement layer an agent must not
+ * be able to edit away. `agent.tamper-protection`'s `tool-call` branch
+ * (`impl/agent-tamper-protection.ts`) and the shell-write coverage
+ * (`protected-carrier-writes.ts`) both need the SAME list; `impl/*.ts` rules
+ * import FROM `shell/`, never the reverse, so the list lives here and
+ * `agent-tamper-protection.ts` imports it, rather than two copies that could
+ * drift.
  *
  * Still hard-coded on purpose (not configurable): see
  * `impl/agent-tamper-protection.ts`'s header for why an `adl-config.toml`
@@ -28,15 +29,17 @@ export const PROTECTED_CARRIER_PATHS: ReadonlySet<string> = new Set([
   '.claude/settings.json',
   '.claude/settings.local.json',
   '.codex/config.toml',
-  'adl-config.toml',
+  // `adl-config.toml` was the fourth entry until 2026-10-01 (Tarun: "nobody
+  // should stop editing adl-config.toml"). It stays human-landed at commit time
+  // (`git.protected-tree-commit`, repo-controls' integrity gate), but an agent
+  // can now write it, and every hook run re-reads it.
   '.codex/hooks.json',
   '.cursor/hooks.json',
   '.opencode/plugins/adl-repo.ts',
-  // P2 (independent review, 2026-09-29): Kimi's ONLY carrier — a single,
-  // globally-installed `~/.kimi-code/config.toml` (STATUS.md 12p's
-  // "Hooks run only where adl hooks deploy has run" decision: Kimi stays
-  // global by design, proven from Kimi's own docs — no per-repo carrier
-  // exists for it at all). Deliberately a suffix-only entry, no leading
+  // Kimi's ONLY carrier — a single, globally-installed
+  // `~/.kimi-code/config.toml` (Kimi stays global by design: its documented
+  // hook config is that one file, checked against Kimi's own docs on
+  // 2026-09-29, so no per-repo carrier exists for it). Deliberately a suffix-only entry, no leading
   // `~`/home path baked in: the EXISTING suffix match
   // (`protectedCarrierMatch`'s `candidate.endsWith('/'+target)`) already
   // matches `~/.kimi-code/config.toml`, `$HOME/.kimi-code/config.toml`, and
@@ -47,7 +50,7 @@ export const PROTECTED_CARRIER_PATHS: ReadonlySet<string> = new Set([
 ])
 
 /**
- * P2 (independent review, 2026-09-29): on a case-INSENSITIVE filesystem
+ * On a case-INSENSITIVE filesystem
  * (macOS's default APFS/HFS+ — `darwin`), `.CLAUDE/Settings.JSON` opens the
  * SAME file on disk as `.claude/settings.json`, so a purely case-sensitive
  * string compare is a real bypass there, not merely cosmetic. Linux's
@@ -60,8 +63,8 @@ const CASE_INSENSITIVE_HOST_FS = process.platform === 'darwin'
 /**
  * Collapse `//` to `/` and resolve `.`/`..` segments (POSIX-style, no
  * filesystem access — this never has to be correct about symlinks, only
- * about what STRING a shell command's own path argument denotes) — P2
- * (independent review, 2026-09-29): `.codex/sub/../hooks.json` names
+ * about what STRING a shell command's own path argument denotes):
+ * `.codex/sub/../hooks.json` names
  * `.codex/hooks.json` exactly as much as the already-normalized spelling
  * does, and a purely textual suffix check misses it. A leading `..` (would
  * escape above the argument's own root) is left as `..` — this function
@@ -102,12 +105,10 @@ export function protectedCarrierMatch(path: string): string | null {
 /**
  * The per-host carrier DIRECTORIES — deleting, moving away, or overwriting
  * the WHOLE directory removes (or replaces) the carrier file inside it too,
- * exactly as much as touching that file directly (P2, independent review,
- * 2026-09-29). `.claude`/`.codex`/`.cursor`/`.opencode` — Kimi's own
+ * exactly as much as touching that file directly. `.claude`/`.codex`/`.cursor`/`.opencode` — Kimi's own
  * `~/.kimi-code/` is deliberately NOT included: `mv ~/.kimi-code /tmp` is a
  * genuinely different, much bigger blast radius (moving the user's whole
- * Kimi config directory, not a repo-scoped host-config directory) that this
- * finding did not name.
+ * Kimi config directory, not a repo-scoped host-config directory).
  *
  * Covers `mv`/`cp -r` (destination)/`rsync` (destination) via
  * `protected-carrier-writes.ts`'s existing operand extraction — a
@@ -115,18 +116,17 @@ export function protectedCarrierMatch(path: string): string | null {
  * operand) moving it away too. `tar -x`/`unzip -o` extracting INTO one of
  * these directories (via `-C`/`-d`) are NOT covered — those tools' own
  * target-directory flags are not among `protected-carrier-writes.ts`'s
- * existing operand handlers, and adding them needs new, tool-specific
- * parsing this pass did not have room for; noted rather than silently
- * dropped.
+ * existing operand handlers, and covering them needs new, tool-specific
+ * parsing; a known gap, recorded here rather than silently dropped.
  */
-export const PROTECTED_CARRIER_DIRS: ReadonlySet<string> = new Set(['.claude', '.codex', '.cursor', '.opencode'])
+const PROTECTED_CARRIER_DIRS: ReadonlySet<string> = new Set(['.claude', '.codex', '.cursor', '.opencode'])
 
 /**
  * The protected carrier directory `path` names — exact match or a trailing
  * `/<dir>` suffix — or null. Same normalization/case rules as
  * `protectedCarrierMatch`.
  *
- * F7 (fourth independent review, 2026-09-29): `path` ending in a literal
+ * `path` ending in a literal
  * `/` (BEFORE normalization strips it for the comparison itself) means "a
  * file goes INTO this directory" (`cp GLOBAL-AGENTS.md .claude/`, `mv
  * notes.md .cursor/`) — the directory itself is untouched, only gaining an

package/packages/agent-hooks/src/rules/shell/substitution.ts

@@ -46,7 +46,7 @@ export function findMatchingParen(command: string, openIndex: number): number {
  * `$((a) && (b))` is a command substitution of two subshells, not arithmetic,
  * and returns -1.
  */
-export function arithmeticClose(command: string, openIndex: number): number {
+function arithmeticClose(command: string, openIndex: number): number {
   if (command[openIndex] !== '(' || command[openIndex + 1] !== '(') return -1
   const close = findMatchingParen(command, openIndex)
   if (close < 0) return -1

package/packages/agent-hooks/src/rules/shell/xargs.ts

@@ -12,7 +12,7 @@
 import { dynamicToken, type Token, tokenValue } from './token.ts'
 import type { Invocation } from './invocation.ts'
 
-export const XARGS_OPTIONS_WITH_VALUE = new Set([
+const XARGS_OPTIONS_WITH_VALUE = new Set([
   '-a',
   '--arg-file',
   '-d',
@@ -31,7 +31,7 @@ export const XARGS_OPTIONS_WITH_VALUE = new Set([
   '-s',
   '--max-chars',
 ])
-export const XARGS_FLAG_OPTIONS = new Set([
+const XARGS_FLAG_OPTIONS = new Set([
   '-0',
   '--null',
   '-r',

package/packages/agent-hooks/src/rules/spec.ts

@@ -33,9 +33,9 @@ export type Severity = 'deny' | 'advise'
  * (`../gating/config.ts`) treats it specially, refusing to let it resolve to
  * disabled without `rules.unsafeAllowUncertain` set.
  */
-export type RuleCategory = 'git' | 'filesystem' | 'tool' | 'tool-call' | 'uncertain' | 'advisory'
+type RuleCategory = 'git' | 'filesystem' | 'tool' | 'tool-call' | 'uncertain' | 'advisory'
 
-export interface ParamDecodeIssue {
+interface ParamDecodeIssue {
   readonly pointer: string
   readonly message: string
 }