@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/bin/reconcile-host

@@ -5,17 +5,21 @@ set -euo pipefail
 # the 12-hourly job does (the job's program is `adl reconcile`, which runs this),
 # also run on demand:
 #
-#   1. tools: this package's bin/sync-and-reconcile with
-#      `--source npm --device NAME --owner OWNER` (npm update, then tools
-#      reconcile). The owner is the device's `administrator` in this package's
+#   1. tools: this package's bin/sync-and-reconcile (run through bash, never
+#      executed directly: bun leaves every shipped file but the `bin` targets
+#      without an exec bit) with `--source npm --device NAME --owner OWNER`
+#      (package update with bun, then tools reconcile). `--source npm` names
+#      the registry the package comes from, not the installer. The owner is the
+#      device's `administrator` in this package's
 #      manifest (bin/lib/fleet-host.sh, the lookup bin/setup shares). --mode is
 #      forwarded only when given, so the default is apply.
 #   2. repositories: `adl maintain --location <repo_location> --expect-user
 #      OWNER`, the package's own bin/adl, run AS THE ADMINISTRATOR -- never as
 #      root. sudo resets PATH to its secure_path, which has neither Homebrew nor
 #      /usr/local/bin, so PATH is always handed over explicitly with `env PATH=`
-#      (every sudo -u call that ends up running adl, git or bun must). --mode
-#      plan becomes --dry-run.
+#      (every sudo -u call that ends up running adl, git or bun must); the
+#      owner's bun bin directory (~/.bun/bin) is on it, after /usr/local/bin.
+#      --mode plan becomes --dry-run.
 #
 # Both steps always run (a failed tools step does not hide a repository problem,
 # and vice versa); the exit code is the first failure's, and each failure is
@@ -55,8 +59,11 @@ source "$script_dir/lib/fleet-host.sh"
 fleet_host_resolve "adl reconcile" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
 owner="$fleet_host_owner"
 repo_location="$fleet_host_repo_location"
+branch_max_age_days="$fleet_host_branch_max_age_days"
 
-[[ -x "$script_dir/sync-and-reconcile" ]] || { echo "ERROR adl reconcile: package scheduler script is missing: $script_dir/sync-and-reconcile" >&2; exit 1; }
+# shellcheck source=lib/adl-package.sh
+source "$script_dir/lib/adl-package.sh"
+[[ -f "$script_dir/sync-and-reconcile" ]] || { echo "ERROR adl reconcile: package scheduler script is missing: $script_dir/sync-and-reconcile" >&2; exit 1; }
 
 # One lock around both steps: an on-demand run overlapping the timer must not
 # run a second repository pass after its tools step lost sync's own lock.
@@ -65,17 +72,14 @@ if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
 else
   lock_dir=/var/run/adl-reconcile.lock
 fi
-if ! mkdir "$lock_dir" 2>/dev/null; then
-  echo "ERROR adl reconcile: another reconcile is running (lock: $lock_dir)" >&2
-  exit 1
-fi
-trap 'rmdir -- "$lock_dir"' EXIT
+adl_lock_acquire "$lock_dir" "adl reconcile: another reconcile is running" || exit 1
+trap 'rm -rf -- "$lock_dir"' EXIT
 
 # 1. tools
 sync_args=(--source npm --device "$host" --owner "$owner")
 if [[ -n "$mode" ]]; then sync_args+=(--mode "$mode"); fi
 tools_rc=0
-"$script_dir/sync-and-reconcile" "${sync_args[@]}" || tools_rc=$?
+bash "$script_dir/sync-and-reconcile" "${sync_args[@]}" || tools_rc=$?
 if [[ "$tools_rc" -ne 0 ]]; then
   echo "ERROR global-tools: tools reconcile failed (exit $tools_rc)" >&2
 fi
@@ -90,17 +94,23 @@ else
     echo "ERROR global-tools: package adl is missing or not executable: $adl_bin" >&2
     repos_rc=1
   else
-    if [[ "$fleet_host_platform" == mac ]]; then
-      brew_bin_dir=/opt/homebrew/bin
-    else
-      brew_bin_dir=/home/linuxbrew/.linuxbrew/bin
+    case "$fleet_host_platform" in
+      mac) repo_os=Darwin ;;
+      *) repo_os=Linux ;;
+    esac
+    if ! owner_home="$(adl_owner_home "$owner")"; then
+      echo "ERROR global-tools: cannot resolve the home directory of $owner" >&2
+      exit 1
     fi
+    owner_path="$(adl_owner_path "$repo_os" "$owner_home")"
     maintain_args=(maintain --location "$repo_location" --expect-user "$owner")
+    # config.repo_maintain.branch_max_age_days in this package's manifest, never an environment variable.
+    if [[ -n "$branch_max_age_days" ]]; then maintain_args+=(--branch-max-age-days "$branch_max_age_days"); fi
     if [[ "$mode" == plan ]]; then maintain_args+=(--dry-run); fi
-    # /usr/local/bin first: git must resolve to the managed controller, which
-    # routes Azure DevOps traffic through the agent identity; Homebrew's git
-    # would bypass it.
-    sudo -u "$owner" -H env PATH="/usr/local/bin:$brew_bin_dir:/usr/bin:/bin" "$adl_bin" "${maintain_args[@]}" || repos_rc=$?
+    # /usr/local/bin first (see adl_owner_path): git must resolve to the managed
+    # controller, which routes Azure DevOps traffic through the agent identity;
+    # Homebrew's git would bypass it.
+    sudo -u "$owner" -H env PATH="$owner_path" "$adl_bin" "${maintain_args[@]}" || repos_rc=$?
     if [[ "$repos_rc" -ne 0 ]]; then
       echo "ERROR global-tools: repository maintenance failed (exit $repos_rc)" >&2
     fi

package/bin/setup

@@ -2,10 +2,12 @@
 set -euo pipefail
 
 # `sudo adl setup --host NAME` -- the whole onboarding of a host after
-# `npm install -g @amsterdamdatalabs/adl-agent-control`:
+# `bun install -g @amsterdamdatalabs/adl-agent-control` (run as the device's
+# administrator):
 #
-#   1. check this is THE package the job manages (the one in the owner's global
-#      npm root), and that its bin/adl is there
+#   1. check this is THE package the job manages (the one in the owner's bun
+#      global directory), that its bin/adl is there, and that the `adl` the
+#      owner gets on PATH is this package and not a different one that shadows it
 #   2. run the first reconcile: `<this package>/bin/adl reconcile --host NAME`
 #   3. only if that succeeded, arm the job that re-runs the same command every
 #      12 hours
@@ -18,8 +20,10 @@ set -euo pipefail
 #
 # Everything comes from this package: it locates itself from its own path and
 # reads packages/fleet/manifest.json beside it (no git checkout, no source
-# flag -- npm is the only source). The account the job runs npm as is the
-# device's `administrator` in that manifest; there is no owner flag.
+# flag -- the published package is the only source). The account the job runs
+# bun as is the device's `administrator` in that manifest; there is no owner
+# flag. The package's scripts are run through bash, never executed directly:
+# bun leaves every shipped file but the `bin` targets without an exec bit.
 #
 # ADL_SETUP_TEST_ROOT is the one test switch (packages/fleet/tests/setup.test.ts):
 # unset in every real run. When set it relocates the system paths under that
@@ -53,33 +57,32 @@ fleet_host_resolve "adl setup" "$package_dir/packages/fleet/manifest.json" "$hos
 owner="$fleet_host_owner"
 minute="$fleet_host_minute"
 
-# The job keeps THE package installed in the owner's global npm root up to date
-# and reconciles from it. This must be that package, or the host would be armed
-# to manage a different copy than the one the operator just ran. Ask npm the same
-# way the job does (the functions are the job's own, from the sibling
+# The job keeps THE package installed in the owner's bun global directory up to
+# date and reconciles from it. This must be that package, or the host would be
+# armed to manage a different copy than the one the operator just ran. Ask for
+# the location the way the job does (bin/lib/adl-package.sh, shared with
 # sync-and-reconcile), and compare real paths.
-[[ -f "$script_dir/sync-and-reconcile" ]] || { echo "ERROR adl setup: package scheduler script is missing: $script_dir/sync-and-reconcile" >&2; exit 1; }
-# shellcheck source=sync-and-reconcile
-SYNC_AND_RECONCILE_SOURCE_ONLY=1 source "$script_dir/sync-and-reconcile"
+# shellcheck source=lib/adl-package.sh
+source "$script_dir/lib/adl-package.sh"
 os_name="$(uname -s)"
-npm_root="$(npm_global_root "$owner" "$os_name")" || {
-  echo "ERROR adl setup: cannot resolve the global npm root as $owner" >&2
+owner_home="$(adl_owner_home "$owner")" || {
+  echo "ERROR adl setup: cannot resolve the home directory of $owner" >&2
   exit 1
 }
-managed_dir="$(npm_platform_package_dir "$npm_root" "$os_name" "$(uname -m)")" || exit 1
+managed_dir="$(adl_platform_package_dir "$(adl_global_node_modules "$owner_home")" "$os_name" "$(uname -m)")" || exit 1
 managed_real="$(cd -P -- "$managed_dir" 2>/dev/null && pwd -P)" || managed_real=""
 if [[ -z "$managed_real" || "$package_dir_real" != "$managed_real" ]]; then
   {
     echo "ERROR adl setup: this package ($package_dir_real) is not the package the scheduled job manages ($managed_dir)."
     echo "ERROR adl setup: install it where the job looks, as $owner, then run setup again:"
-    echo "ERROR adl setup:   Linux: npm install -g --prefix /usr/local @amsterdamdatalabs/adl-agent-control"
-    echo "ERROR adl setup:   macOS: npm install -g @amsterdamdatalabs/adl-agent-control"
+    echo "ERROR adl setup:   bun install -g @amsterdamdatalabs/adl-agent-control"
   } >&2
   exit 1
 fi
 
 adl_bin="$package_dir_real/bin/adl"
 [[ -x "$adl_bin" ]] || { echo "ERROR adl setup: the package adl is missing or not executable: $package_dir/bin/adl" >&2; exit 1; }
+adl_check_adl_not_shadowed "$owner" "$os_name" "$owner_home" "$package_dir_real" "adl setup" || exit 1
 
 if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
   system_root="${ADL_SETUP_TEST_ROOT%/}"

package/bin/shell-path-policy

@@ -1,9 +1,15 @@
 #!/usr/bin/env bash
 # Managed by adl global-tools.
 # Keep /usr/local/bin first in interactive shells so manifest-owned front
-# controllers win over Homebrew and system executables on every host.
+# controllers win over Homebrew and system executables on every host. The
+# administrator's bun bin directory comes right after it (Tarun, 2026-10-01):
+# hosts install the adl package with `bun install -g`, which links `adl` into
+# $HOME/.bun/bin, and humans and agents must be able to run it (root on Linux:
+# /root/.bun/bin). It stays behind /usr/local/bin so the managed git wins.
 set -euo pipefail
 
+managed_path_line='export PATH="/usr/local/bin:$HOME/.bun/bin${PATH:+:$PATH}"'
+
 usage() {
   echo 'usage: shell-path-policy --home ABSOLUTE_PATH --platform mac|linux --mode plan|apply [--owner USER]' >&2
   exit 2
@@ -35,10 +41,14 @@ upsert_block() {
   mkdir -p -- "$(dirname -- "$file")"
   temp="$file.adl-new"
   if [[ -e "$file" ]]; then
+    # Trailing blank lines are dropped with the block: the append below puts one
+    # blank line back in front of it, so a re-run is byte-identical, not one line longer.
     awk -v begin="$begin" -v end="$end" '
       $0 == begin { inside = 1; next }
       $0 == end { inside = 0; next }
-      !inside { print }
+      inside { next }
+      /^$/ { blanks++; next }
+      { while (blanks > 0) { print ""; blanks-- } print }
     ' "$file" >"$temp"
   else
     : >"$temp"
@@ -50,14 +60,14 @@ upsert_block() {
 
 if [[ "$platform" == mac ]]; then
   upsert_block "$home/.zshenv" '# BEGIN ADL GLOBAL PATH' '# END ADL GLOBAL PATH' \
-    'export PATH="/usr/local/bin${PATH:+:$PATH}"'
+    "$managed_path_line"
   exit 0
 fi
 
 upsert_block "$home/.bashenv" '# BEGIN ADL GLOBAL PATH ENV' '# END ADL GLOBAL PATH ENV' \
-  'export PATH="/usr/local/bin${PATH:+:$PATH}"'
+  "$managed_path_line"
 upsert_block "$home/.zshenv" '# BEGIN ADL GLOBAL PATH ENV' '# END ADL GLOBAL PATH ENV' \
-  'export PATH="/usr/local/bin${PATH:+:$PATH}"'
+  "$managed_path_line"
 for shell_file in "$home/.bashrc" "$home/.bash_profile" "$home/.profile"; do
   upsert_block "$shell_file" '# BEGIN ADL GLOBAL PATH SOURCE' '# END ADL GLOBAL PATH SOURCE' \
     'if [[ -r "$HOME/.bashenv" ]]; then . "$HOME/.bashenv"; fi'

package/bin/sync-and-reconcile

@@ -7,8 +7,14 @@ else
   export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin:/usr/sbin:/sbin"
 fi
 
-# Scheduled sync downloads the ADL platform package and executes its own
-# reconcile command. Checkout mode is an explicit developer-only bypass.
+# Scheduled sync installs the published ADL package with bun (as the device's
+# administrator) and runs that package's own reconcile. Checkout mode is an
+# explicit developer-only bypass. Package layout and owner lookups are in
+# lib/adl-package.sh, shared with bin/setup and bin/reconcile.
+_sync_and_reconcile_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/adl-package.sh
+source "$_sync_and_reconcile_dir/lib/adl-package.sh"
+
 sync_and_reconcile_platform() {
   case "$(uname -s)" in
     Darwin) printf '%s\n' mac ;;
@@ -39,7 +45,7 @@ parse_sync_source() {
   esac
 }
 
-npm_package_spec() {
+adl_package_spec() {
   local policy="$1" version="${2:-}"
   case "$policy" in
     latest-stable) printf '%s@latest\n' '@amsterdamdatalabs/adl-agent-control' ;;
@@ -54,40 +60,6 @@ npm_package_spec() {
   esac
 }
 
-npm_platform_package_dir() {
-  local npm_root="$1" os="$2" arch="$3" platform
-  case "$os:$arch" in
-    Darwin:arm64) platform=darwin-arm64 ;;
-    Linux:x86_64) platform=linux-x64 ;;
-    *) echo "ERROR unsupported platform for npm package: $os $arch" >&2; return 1 ;;
-  esac
-  # A global install nests optionalDependencies under the wrapper; npm never
-  # hoists them to the global root.
-  printf '%s/@amsterdamdatalabs/adl-agent-control/node_modules/@amsterdamdatalabs/adl-agent-control-%s\n' "${npm_root%/}" "$platform"
-}
-
-# Sets the `npm_env` array the owner's npm runs under: the same PATH and, on
-# Linux, the same /usr/local prefix for every npm call this job makes. bin/setup
-# sources this file and uses npm_global_root below, so it asks npm the very
-# same question the scheduled job does.
-resolve_npm_env() {
-  local os="$1" npm_path
-  case "$os" in
-    Darwin) npm_path=/opt/homebrew/bin:/usr/bin:/bin ;;
-    Linux) npm_path=/home/linuxbrew/.linuxbrew/bin:/usr/bin:/bin ;;
-    *) echo "ERROR unsupported operating system for npm package: $os" >&2; return 1 ;;
-  esac
-  npm_env=(PATH="$npm_path")
-  if [[ "$os" == Linux ]]; then npm_env=(npm_config_prefix=/usr/local PATH="$npm_path"); fi
-}
-
-# Prints OWNER's global npm root (`npm root -g` as that user, under npm_env).
-npm_global_root() {
-  local owner="$1" os="$2"
-  resolve_npm_env "$os" || return 1
-  sudo -u "$owner" -H env "${npm_env[@]}" npm root -g
-}
-
 prepare_adl_npm_migration() {
   local applied_manifest="$1" device="$2" platform="$3" legacy_adl="$4" hash_file="$5"
   local previous_manager previous_executable
@@ -101,7 +73,7 @@ prepare_adl_npm_migration() {
   }
   rm -f -- "$legacy_adl"
   rm -f -- "$hash_file"
-  echo "global-tools: removed prior Bun adl binary before npm install: $legacy_adl"
+  echo "global-tools: removed prior Bun adl binary before the package install: $legacy_adl"
 }
 
 if [[ "${SYNC_AND_RECONCILE_SOURCE_ONLY:-0}" == 1 ]]; then
@@ -149,11 +121,8 @@ if [[ -n "${SYNC_AND_RECONCILE_TEST_ROOT:-}" ]]; then
 else
   lock_dir=/var/run/adl-sync.lock
 fi
-if ! mkdir "$lock_dir" 2>/dev/null; then
-  echo "ERROR global-tools: another reconciliation is running (lock: $lock_dir)" >&2
-  exit 1
-fi
-trap 'rmdir "$lock_dir" 2>/dev/null || true' EXIT
+adl_lock_acquire "$lock_dir" "global-tools: another reconciliation is running" || exit 1
+trap 'rm -rf -- "$lock_dir"' EXIT
 
 host_platform="$(sync_and_reconcile_platform)"
 require_linux_automation_root "$host_platform" "$owner" || exit 1
@@ -162,44 +131,45 @@ if [[ "$sync_source" == checkout ]]; then
   [[ -e "$repo/.git" ]] || { echo "ERROR developer checkout missing: $repo" >&2; exit 1; }
   manifest="$repo/packages/fleet/manifest.json"
   [[ -f "$manifest" ]] || { echo "ERROR developer checkout manifest missing: $manifest" >&2; exit 1; }
-  [[ -x "$repo/bin/reconcile" ]] || { echo "ERROR developer checkout reconcile is missing: $repo/bin/reconcile" >&2; exit 1; }
+  [[ -f "$repo/bin/reconcile" ]] || { echo "ERROR developer checkout reconcile is missing: $repo/bin/reconcile" >&2; exit 1; }
   echo "global-tools: source=checkout (developer mode)"
   reconcile_dir="$repo/bin"
 else
   os="$(uname -s)"
   arch="$(uname -m)"
-  resolve_npm_env "$os" || exit 1
-  npm_root="$(npm_global_root "$owner" "$os")" || {
-    echo "ERROR cannot resolve the global npm root as $owner" >&2
+  owner_home="$(adl_owner_home "$owner")" || {
+    echo "ERROR cannot resolve the home directory of $owner" >&2
     exit 1
   }
-  [[ "$npm_root" == /*/lib/node_modules ]] || {
-    echo "ERROR global npm root has an unsupported path: $npm_root" >&2
-    exit 1
-  }
-  npm_prefix="${npm_root%/lib/node_modules}"
-  platform_dir="$(npm_platform_package_dir "$npm_root" "$os" "$arch")" || exit 1
+  global_node_modules="$(adl_global_node_modules "$owner_home")"
+  platform_dir="$(adl_platform_package_dir "$global_node_modules" "$os" "$arch")" || exit 1
   installed_manifest="$platform_dir/packages/fleet/manifest.json"
   package_spec=""
+  update_policy=""
+  installed_version=""
   if [[ -f "$installed_manifest" ]]; then
+    [[ -f "$platform_dir/package.json" ]] && installed_version="$(jq -er '.version | select(type == "string")' "$platform_dir/package.json")" || {
+      echo "ERROR installed adl package has no readable version: $platform_dir/package.json" >&2
+      exit 1
+    }
     update_policy="$(jq -er '.config.update_policy | select(type == "string")' "$installed_manifest")" || {
       echo "ERROR installed adl package manifest has no config.update_policy: $installed_manifest" >&2
       exit 1
     }
     case "$update_policy" in
-      latest-stable) package_spec="$(npm_package_spec latest-stable)" ;;
+      latest-stable) package_spec="$(adl_package_spec latest-stable)" ;;
       pinned)
         pinned_version="$(jq -er --arg platform "$host_platform" '.[$platform].common.tools.adl.version | select(type == "string")' "$installed_manifest")" || {
           echo "ERROR installed adl package manifest requires a version for pinned update_policy: $installed_manifest" >&2
           exit 1
         }
-        package_spec="$(npm_package_spec pinned "$pinned_version")" || exit 1
+        package_spec="$(adl_package_spec pinned "$pinned_version")" || exit 1
         ;;
-      *) package_spec="$(npm_package_spec "$update_policy")" || exit 1 ;;
+      *) package_spec="$(adl_package_spec "$update_policy")" || exit 1 ;;
     esac
   else
-    package_spec="$(npm_package_spec latest-stable)"
-    echo "global-tools: bootstrapping adl package from npm latest tag"
+    package_spec="$(adl_package_spec latest-stable)"
+    echo "global-tools: bootstrapping adl package from the registry latest tag"
   fi
 
   if [[ -n "${SYNC_AND_RECONCILE_TEST_ROOT:-}" ]]; then
@@ -214,15 +184,43 @@ else
   fi
   prepare_adl_npm_migration "$applied_manifest" "$device" "$host_platform" "$legacy_adl" "$legacy_hash"
 
-  sudo -u "$owner" -H env "${npm_env[@]}" npm install --global --prefix "$npm_prefix" --no-audit --no-fund "$package_spec"
-  [[ -d "$platform_dir" ]] || { echo "ERROR npm install did not create the platform package: $platform_dir" >&2; exit 1; }
+  # NEVER DOWNGRADE (Tarun, 2026-10-01): under latest-stable the installed package is
+  # compared with the registry's `latest` first. Newer installed (a local pre-release
+  # build) and equal are kept; only an older one is updated. A lookup that fails stops
+  # the run loudly. A first install has nothing to compare, and a pinned policy installs
+  # exactly its pin.
+  skip_install=0
+  if [[ -n "$installed_version" && "$update_policy" == latest-stable ]]; then
+    registry_latest="$(adl_registry_latest "$owner" "$os" "$owner_home")" || {
+      echo "ERROR cannot read the registry latest of $adl_wrapper_package; not updating and not reconciling (run again when the registry is reachable)" >&2
+      exit 1
+    }
+    version_order="$(adl_semver_compare "$installed_version" "$registry_latest")" || exit 1
+    case "$version_order" in
+      1)
+        echo "global-tools: installed $installed_version is newer than registry latest $registry_latest; keeping it"
+        skip_install=1
+        ;;
+      0)
+        echo "global-tools: installed $installed_version is already the registry latest; no update needed"
+        skip_install=1
+        ;;
+      *) echo "global-tools: updating adl package $installed_version -> $registry_latest" ;;
+    esac
+  fi
+  if [[ "$skip_install" -eq 0 ]]; then
+    adl_bun_add_global "$owner" "$os" "$owner_home" "$package_spec"
+  fi
+  [[ -d "$platform_dir" ]] || { echo "ERROR bun add did not create the platform package: $platform_dir" >&2; exit 1; }
   installed_manifest="$platform_dir/packages/fleet/manifest.json"
   [[ -f "$installed_manifest" ]] || { echo "ERROR installed adl package manifest missing: $installed_manifest" >&2; exit 1; }
-  [[ -x "$platform_dir/bin/reconcile" ]] || { echo "ERROR installed adl package reconcile is missing: $platform_dir/bin/reconcile" >&2; exit 1; }
-  [[ -x "$platform_dir/bin/validate-manifest" ]] || { echo "ERROR installed adl package manifest validator is missing: $platform_dir/bin/validate-manifest" >&2; exit 1; }
-  "$platform_dir/bin/validate-manifest" "$installed_manifest"
+  # bun leaves every shipped file but the `bin` targets 0644, so the package's
+  # scripts are checked with -f and run through bash, never executed directly.
+  [[ -f "$platform_dir/bin/reconcile" ]] || { echo "ERROR installed adl package reconcile is missing: $platform_dir/bin/reconcile" >&2; exit 1; }
+  [[ -f "$platform_dir/bin/validate-manifest" ]] || { echo "ERROR installed adl package manifest validator is missing: $platform_dir/bin/validate-manifest" >&2; exit 1; }
+  bash "$platform_dir/bin/validate-manifest" "$installed_manifest"
   reconcile_dir="$platform_dir/bin"
 fi
 
-PATH="$reconcile_dir:$PATH" "$reconcile_dir/reconcile" \
+PATH="$reconcile_dir:$PATH" bash "$reconcile_dir/reconcile" \
   --device "$device" --source "$sync_source" --mode "$mode"

package/bin/validate-manifest

@@ -11,6 +11,12 @@ manifest="${1:-}"
 
 if ! jq -e '
   def relpath: type == "string" and length > 0 and (startswith("/") | not) and (split("/") | index("..") | not);
+  # git_global_config (bin/git-defaults): key -> string, or key -> non-empty ordered array of strings.
+  # {git-credential-manager} is the only placeholder a value may carry (gh/GitHub is not managed by adl).
+  def gitcfg_value: type == "string" and ([match("\\{[^}]*\\}"; "g").string] | all(. == "{git-credential-manager}"));
+  def gitcfg: type == "object" and
+    (to_entries | all((.key | test("^[A-Za-z][A-Za-z0-9-]*\\..+")) and
+      (.value | gitcfg_value or (type == "array" and length > 0 and all(gitcfg_value)))));
   keys == ["config", "linux", "mac"] and
   .config.schema == 1 and
   (.config.repository | type == "string" and test("^https://dev\\.azure\\.com/[A-Za-z0-9._-]+/[A-Za-z0-9._-]+/_git/[A-Za-z0-9._-]+$")) and
@@ -26,15 +32,21 @@ if ! jq -e '
   .config.surface_policy == {"enabled": true} and
   .config.global_agents == {"enabled": true} and
   .config.vscode_settings == {"enabled": true} and
+  (.config.repo_maintain | type == "object") and
+  (.config.repo_maintain | keys == ["branch_max_age_days"]) and
+  (.config.repo_maintain.branch_max_age_days | type == "number" and . >= 1 and floor == .) and
   (.config.scratch_reap | type == "object") and
   (.config.scratch_reap | keys == ["enabled", "idle_days", "reap_days", "remove_worktrees"]) and
   .config.scratch_reap.enabled == true and
   (.config.scratch_reap.idle_days | type == "number" and . >= 0 and floor == .) and
   (.config.scratch_reap.reap_days | type == "number" and . >= 1 and floor == .) and
   (.config.scratch_reap.remove_worktrees | type == "boolean") and
+  (.config.brew_upgrade_exclude | type == "array" and
+    (. | unique | length) == length and
+    all(type == "string" and test("^[A-Za-z0-9][A-Za-z0-9@._+/-]*$"))) and
   (.config.protected_tools | type == "array") and
-  (.config.git_global_config | type == "object" and
-    (to_entries | all((.key | test("^[A-Za-z][A-Za-z0-9-]*\\..+")) and (.value | type) == "string"))) and
+  (.config.git_global_config | gitcfg) and
+  ([.mac.common, .linux.common] | all((.git_global_config // {}) | gitcfg)) and
   (.mac.common.tools | type == "object") and
   (.mac.devices | type == "object") and
   (.linux.common.tools | type == "object") and
@@ -43,7 +55,9 @@ if ! jq -e '
     all(.minimum_free_gib >= 1) and
     all((.home | type) == "string" and (.home | startswith("/"))) and
     all((.default_agent | type) == "string" and (.default_agent | test("^agent-[a-z0-9-]+$"))) and
-    all((keys - ["administrator", "default_agent", "home", "minimum_free_gib", "schedule_minute", "scratch_repos", "brew_upgrade_all", "surface_clis", "repo_location", "tools"] | length) == 0) and
+    all((.git_user | type == "object" and (keys | sort) == ["email", "name"] and
+      all(.[]; type == "string" and length > 0))) and
+    all((keys - ["administrator", "default_agent", "git_user", "home", "minimum_free_gib", "schedule_minute", "scratch_repos", "brew_upgrade_all", "surface_clis", "repo_location", "tools"] | length) == 0) and
     all((.scratch_repos // []) | type == "array" and (. | unique | length) == length and
       all(type == "string" and startswith("/") and . != "/" and
         (endswith("/") | not) and (contains("..") | not) and (test("\\s") | not))) and
@@ -65,13 +79,23 @@ if ! jq -e '
       ($surfaces | map(.name) | length == (unique | length)) and
       ($surfaces | all(
         (.name | type == "string" and length > 0) and
-        (.manager | type == "string" and (. == "native" or . == "npm" or . == "brew" or . == "unknown")) and
+        (.manager | type == "string" and (. == "native" or . == "npm" or . == "brew" or . == "bun" or . == "unknown")) and
         ((.report_only // false) | type == "boolean") and
-        (if (.report_only // false) == true then
-           (.executable | type == "string" and startswith("/"))
+        # manager bun (2026-10-01): installed and updated as `bun add -g <package>@latest`, so it
+        # names a bare registry package (no version spec: versions are never pinned) and a command,
+        # and carries no update_args (the manager fixes the argv) and no report_only.
+        (if .manager == "bun" then
+           ((.package | type == "string") and (.package | test("^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$"))) and
+           ((.command | type == "string") and (.command | length > 0) and (.command | contains("/") | not)) and
+           (has("update_args") | not) and (has("version") | not) and ((.report_only // false) == false)
          else
-           (.command | type == "string" and length > 0 and (contains("/") | not)) and
-           (.update_args | type == "array" and length > 0 and all(type == "string" and length > 0))
+           (has("package") | not) and
+           (if (.report_only // false) == true then
+              (.executable | type == "string" and startswith("/"))
+            else
+              (.command | type == "string" and length > 0 and (contains("/") | not)) and
+              (.update_args | type == "array" and length > 0 and all(type == "string" and length > 0))
+            end)
          end) and
         (.manager != "brew" or
           ((.report_only // false) == false and .command == "brew" and
@@ -153,7 +177,7 @@ if ! jq -e '
         all(type == "string" and test("^(@[a-z0-9][a-z0-9._-]*/)?[a-z0-9][a-z0-9._-]*$")))
     else true end)) and
   # launch_agents are gone (2026-09-30): a stale declaration must fail loud.
-  ([.mac.common, .linux.common] | all(keys - ["os_upgrade", "tools"] | length == 0))
+  ([.mac.common, .linux.common] | all(keys - ["os_upgrade", "git_global_config", "tools"] | length == 0))
 ' "$manifest" >/dev/null; then
   echo "global-tools manifest: INVALID ($manifest does not satisfy bin/validate-manifest's schema)" >&2
   exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.12",
+  "version": "0.1.28",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [
@@ -14,11 +14,7 @@
     "packages/fleet/manifest.json",
     "packages/fleet/manifest.schema.json",
     "packages/fleet/src",
-    "packages/agent-settings/surface-policy.json",
-    "packages/agent-settings/protected.json",
-    "packages/agent-settings/src",
-    "packages/agent-settings/assets",
-    "packages/agent-settings/managed",
+    "packages/agent-settings",
     "packages/agent-skills",
     "packages/repo-controls",
     "packages/agent-hooks",
@@ -29,13 +25,9 @@
   },
   "dependencies": {
     "@iarna/toml": "^2.2.5",
-    "@tailwindcss/node": "4.2.1",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
-    "istanbul-lib-coverage": "3.2.2",
     "minisearch": "7.2.0",
-    "svelte": "5.38.10",
-    "tailwindcss": "4.1.11",
     "typescript": "5.9.3",
     "yaml": "^2.9.0"
   }

package/packages/agent-hooks/README.md

@@ -213,14 +213,16 @@ directory containing a `.git` entry) and checking for
 
 ### File format
 
-Six top-level keys are recognized: `version`, `[hooks]`, `[rules]`, `[repo]`,
-`[controls]`, and `[skills]`. `[controls]` and `[skills]` are reserved root
-tables owned by other tools (`enact-repo-controls` and `adl-extensions`,
-respectively) that share this same file; `adl hook` accepts and ignores
-them without ever reading their contents. Every other top-level key — and
-every unrecognized key inside `[hooks]` or `[repo]` — is a decode error
-(fails loud, non-zero exit, reason on stderr), never silently ignored; see
-"Unknown keys fail loud" below.
+The recognized root keys include `version`, `[hooks]`, `[rules]`, `[repo]`,
+`[agent]`, `[controls]`, `[skills]`, `[extensions]`, and `[azdo]`. `[controls]`
+and `[skills]` belong to other tools sharing this file; `[azdo]` is reserved
+for shared Azure DevOps configuration. `adl hook` accepts these tables without
+reading their contents, so optional tables such as `[azdo.scope]` can be present
+while its hook configuration remains independent. `[extensions]` is also a
+shared table, but `adl hook` reads its sub-table names to locate extension
+skills. Every other top-level key — and every unrecognized key inside `[hooks]`
+or `[repo]` — is a decode error (fails loud, non-zero exit, reason on stderr),
+never silently ignored; see "Unknown keys fail loud" below.
 
 ```toml
 version = 1                     # optional; accepted for the marker file's
@@ -353,7 +355,10 @@ fixed in the process (see `src/lib/spawn-with-timeout.ts`,
    `XDG_CONFIG_HOME` / `XDG_DATA_HOME` / `XDG_STATE_HOME` / `XDG_CACHE_HOME`
    environment (rooted at `<repo root>/.agents/lean-ctx/`) that wrapper used
    to set, so `lean-ctx`'s state stays per-repository even though the
-   binary itself is shared.
+   binary itself is shared. In a linked git worktree the four stores root at
+   the main checkout (resolved from the worktree's own `.git` file), so
+   worktree sessions share the accumulated knowledge instead of starting
+   cold.
 
 ## Integration pass (three independently-migrated slices + foundation)
 

package/packages/agent-hooks/assets/hooks.json

@@ -21,16 +21,6 @@
             "timeout": 10
           }
         ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "adl hook lean-ctx pre-tool-use",
-            "statusMessage": "adl-repo: lean-ctx pre-tool-use",
-            "timeout": 10
-          }
-        ]
       }
     ],
     "UserPromptSubmit": [
@@ -69,16 +59,6 @@
             "timeout": 5
           }
         ]
-      },
-      {
-        "hooks": [
-          {
-            "type": "command",
-            "command": "adl hook lean-ctx post-tool-use",
-            "statusMessage": "adl-repo: lean-ctx post-tool-use",
-            "timeout": 10
-          }
-        ]
       }
     ],
     "SessionEnd": [

package/packages/agent-hooks/src/cli/args.ts

@@ -70,7 +70,7 @@ function isDirectory(path: string): boolean {
 }
 
 /** The built-in config an unmanaged repo is described with — the decode of an empty file, i.e. the schema defaults. */
-export function defaultConfig(): AdlRepoConfig {
+function defaultConfig(): AdlRepoConfig {
   return (decodeConfig('') as { readonly value: AdlRepoConfig }).value
 }