@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/repo-controls/src/azdo-push.ts

@@ -1,16 +1,18 @@
 #!/usr/bin/env bun
 
 import { parseAzureDevOpsRemote } from './azure-devops-remote.ts'
-// Agent identity, not a fallback to the human's own Azure CLI login (12g:
-// STATUS.md 12p -- an agent pushed as the human
-// because this path used to mint its bearer from the human's Azure CLI
-// session). packages/azdo/src/lib/agent-identity.ts is THE one identity
-// resolver and mint path (W1); this is the same async `getAccessToken`
-// bin/git-ado's agent path and packages/azdo's own callers drive.
-// `resolveAgentIdentity` throws before any spawn or network call when no
-// identity resolves, so a missing identity never reaches Azure DevOps.
+// Agent identity, never the human's own Azure CLI login: an agent once pushed
+// as the human because this path minted its bearer from the human's Azure CLI
+// session, so identity is now resolved from the agent identity alone. ONE
+// credential boundary (Tarun, 2026-10-01): this module mints and injects NO credential.
+// Every git child runs through the managed front controller (bin/git ->
+// bin/git-ado), which mints its own agent token and adds its own URL-scoped
+// header; a second mint here put two Authorization headers on one request.
+// `resolveAgentIdentity` (packages/azdo/src/lib/agent-identity.ts, THE one
+// resolver) is kept only to fail closed before any spawn or network call
+// when no identity resolves, and to name the agent git-ado must mint for.
+import { closeSync, openSync, readSync } from 'node:fs'
 import { resolveAgentIdentity } from '../../azdo/src/lib/agent-identity.ts'
-import { getAccessToken } from '../../azdo/src/lib/agent-token.ts'
 
 const HOOKS_PATH = '.workflows/hooks'
 // Read on CALL, not on import. As a spawned script these could be module-level
@@ -33,7 +35,7 @@ export function resolveRemoteName(env: Readonly<Record<string, string | undefine
 }
 
 /** How many times to retry a concurrent Azure ref update (TF401028) under the push lock. */
-export const PUSH_RACE_ATTEMPTS = Number(process.env.ADL_PUSH_RACE_ATTEMPTS || 3)
+const PUSH_RACE_ATTEMPTS = Number(process.env.ADL_PUSH_RACE_ATTEMPTS || 3)
 
 interface CommandResult {
   exitCode: number
@@ -125,44 +127,70 @@ export function assertRepositoryHooksInstalled(hooksPath: string): void {
 }
 
 /**
- * `agent`, when given, is the SAME identity `accessToken` was minted for
- * (`resolveAgentIdentity(process.env).agent` at the call site). It is set as
- * `ADL_AGENT_ID_AGENT` on the returned environment so every git spawn built
- * from it -- fetch, push, and everything else in this module -- carries an
- * agent identity of its own, even when the caller's OWN identity resolved
- * from the machine default-agent file rather than the environment (STATUS.md
- * 12p, orchestrator sweep 2026-09-29: `bin/git-ado` now fails closed on an
- * Azure DevOps network git command with no `ADL_AGENT_ID_AGENT` in its env,
- * unless the caller is a marked human terminal -- neither of which describes
- * this spawned child). `ADL_HUMAN_AZDO` is always stripped from the
+ * The environment every git spawn in this module runs with. It carries NO
+ * credential: no injected header config, no `GIT_CONFIG_*` entry (the caller's own
+ * are passed through untouched). Authentication belongs to the managed front
+ * controller alone (see `assertManagedGitController`).
+ *
+ * `agent` is the identity `resolveAgentIdentity(process.env).agent` resolved.
+ * It is set as `ADL_AGENT_ID_AGENT` so every git spawn built from this
+ * environment -- fetch, push, and everything else in this module -- tells the
+ * controller which agent to mint for, even when the caller's OWN identity
+ * resolved from the machine default-agent file rather than the environment
+ * (`bin/git-ado` fails closed, Tarun 2026-09-29: an Azure DevOps network git
+ * command with no `ADL_AGENT_ID_AGENT` in its env is refused unless the caller
+ * is a marked human terminal -- neither of which describes this spawned
+ * child). `ADL_HUMAN_AZDO` is always stripped from the
  * inherited environment, never carried through: this module is agent
  * automation, never a marked human terminal, and an inherited marker (e.g.
  * Tarun's own `.zshrc` export, if this ever runs from a shell that sourced
  * it) must never let a git child claim the human pass-through instead.
  */
-export function gitEnvironmentWithBearer(
+export function gitEnvironmentForController(
   source: Readonly<Record<string, string | undefined>>,
-  accessToken: string,
-  agent?: string,
+  agent: string,
 ): Record<string, string> {
-  const token = accessToken.trim()
-  if (!token) throw new Error('Received an empty Azure DevOps access token.')
-
-  const rawCount = source.GIT_CONFIG_COUNT?.trim() || '0'
-  if (!/^\d+$/.test(rawCount)) throw new Error('GIT_CONFIG_COUNT must be a non-negative integer when set.')
-  const index = Number(rawCount)
+  const resolved = agent.trim()
+  if (!resolved) throw new Error('A resolved agent identity is required to spawn git for Azure DevOps.')
   const environment = Object.fromEntries(
     Object.entries(source).filter(
       (entry): entry is [string, string] => entry[1] !== undefined && entry[0] !== 'ADL_HUMAN_AZDO',
     ),
   )
-  if (agent) environment.ADL_AGENT_ID_AGENT = agent
-  environment.GIT_CONFIG_COUNT = String(index + 1)
-  environment[`GIT_CONFIG_KEY_${index}`] = 'http.extraheader'
-  environment[`GIT_CONFIG_VALUE_${index}`] = `AUTHORIZATION: bearer ${token}`
+  environment.ADL_AGENT_ID_AGENT = resolved
   return environment
 }
 
+/** The marker `bin/git` (and every adl-managed script) carries in its header. */
+const MANAGED_SCRIPT_MARKER = '# Managed by adl global-tools.'
+
+/**
+ * Refuses unless the `git` found on `pathVariable` is the managed front
+ * controller. With no credential injected here, a plain `git` would fall to
+ * the human credential helper and push as the human -- the exact failure
+ * an agent once hit (pushing as the human) -- so this fails loud before any network call instead.
+ * Recognised the same way fleet-cutover and install-adl-package recognise a
+ * managed script: the marker within the first 4096 bytes.
+ */
+export function assertManagedGitController(pathVariable: string | undefined): void {
+  const resolved = pathVariable ? Bun.which('git', { PATH: pathVariable }) : null
+  if (!resolved) throw new Error('no git found on PATH; expected the managed git front controller (/usr/local/bin/git).')
+  const buffer = Buffer.alloc(4096)
+  const fd = openSync(resolved, 'r')
+  let length: number
+  try {
+    length = readSync(fd, buffer, 0, buffer.length, 0)
+  } finally {
+    closeSync(fd)
+  }
+  if (!buffer.subarray(0, length).toString('latin1').includes(MANAGED_SCRIPT_MARKER)) {
+    throw new Error(
+      `git on PATH (${resolved}) is not the managed git front controller: azdo-push injects no credential, ` +
+        'so a plain git would authenticate as the human. Put the managed controller (/usr/local/bin/git) first on PATH.',
+    )
+  }
+}
+
 export function assertBranchNotBehindRemote(behindCount: string, remoteName: string, branch: string): void {
   const behind = behindCount.trim()
   if (behind !== '0') {
@@ -422,10 +450,10 @@ async function main(): Promise<void> {
     capture(['git', 'remote', 'get-url', remoteName], `Unable to read ${remoteName}`).stdout,
   )
   const agent = resolveAgentIdentity(process.env).agent
-  const token = await getAccessToken(agent)
-  const bearerEnvironment = gitEnvironmentWithBearer(process.env, token, agent)
+  assertManagedGitController(process.env.PATH)
+  const agentEnvironment = gitEnvironmentForController(process.env, agent)
   const lockEnvironment = {
-    ...bearerEnvironment,
+    ...agentEnvironment,
   }
   // Held across the network push so pre-push EXIT cannot open a TF401028 race window.
   const pushEnvironment = {

package/packages/repo-controls/src/azure-devops-governance.ts

@@ -6,10 +6,9 @@ import { parseAzureDevOpsRemote } from './azure-devops-remote.ts'
 // The relative cross-package import below (not `@adl/azdo`) matches
 // apps/cli/src/commands/mcp.ts and apps/cli/src/commands/repo-doctor.ts:
 // this workspace has no node_modules/@adl/* symlinks without `bun install`.
-// packages/azdo/src/lib/agent-identity.ts is now THE one identity resolver
-// and packages/azdo/src/lib/agent-token.ts is now THE one mint (STATUS.md
-// 12p, W1 and finding M9) — this package no longer keeps its own copy of
-// either.
+// packages/azdo/src/lib/agent-identity.ts is THE one identity resolver and
+// packages/azdo/src/lib/agent-token.ts is THE one mint — this package keeps no
+// copy of either, so identity and token handling cannot drift between callers.
 import { resolveAgentIdentity } from '../../azdo/src/lib/agent-identity.ts'
 import { getAccessTokenSync } from '../../azdo/src/lib/agent-token.ts'
 import { capture, type Env } from './runtime.ts'
@@ -82,11 +81,10 @@ function parseJson(text: string, label: string): unknown {
  * Mints a bearer token for the effective agent identity through THE one mint
  * (`packages/azdo/src/lib/agent-token.ts`'s `getAccessTokenSync` — same
  * two-hop exec `bin/git-ado`'s agent path also drives, same parsing, same
- * pinned addresses; STATUS.md 12p finding M9: this package no longer keeps
- * its own copy). `env` is threaded through unmerged with real `process.env`
- * (not `capture`'s childEnv) so a hermetic test's sparse env is exactly what
- * decides both which `adl-agent-id` is found and what the spawned child
- * sees — same isolation the old copy's own `which(..., env)` gave. This
+ * pinned addresses; this package keeps no mint of its own). `env` is
+ * threaded through unmerged with real `process.env` (not `capture`'s
+ * childEnv) so a hermetic test's sparse env is exactly what decides both
+ * which `adl-agent-id` is found and what the spawned child sees. This
  * process never sees the vault proxy, the CA, or a client secret — only the
  * finished bearer token, read from the child's stdout pipe; nothing here
  * logs it or puts it on argv.

package/packages/repo-controls/src/azure-devops-remote.ts

@@ -1,6 +1,6 @@
 const HTTPS_HANDLE_USER = 'amsterdamdatalabs'
 
-export type AzureDevOpsRemoteForm = 'https-handle' | 'https' | 'ssh'
+type AzureDevOpsRemoteForm = 'https-handle' | 'https' | 'ssh'
 
 export interface ParsedAzureDevOpsRemote {
   form: AzureDevOpsRemoteForm

package/packages/repo-controls/src/cli.ts

@@ -16,15 +16,16 @@ export interface Io {
   cwd: string
 }
 
-export const USAGE = `usage:
-  ${TOOL} install --repo <path> [--dry-run]
-  ${TOOL} uninstall --repo <path> [--dry-run]
-  ${TOOL} doctor --repo <path> [--json]
+const USAGE = `usage:
+  ${TOOL} install [--repo <path>] [--dry-run]
+  ${TOOL} uninstall [--repo <path>] [--dry-run]
+  ${TOOL} doctor [--repo <path>] [--json]
   ${TOOL} hook <${HOOK_NAMES.join('|')}> [git hook args...]
   ${TOOL} log <${HOOK_NAMES.join('|')}> <reason> [context] [message]   (internal — called by the bundled hooks)
-  ${TOOL} promote --repo <path>
-  ${TOOL} run <${Object.keys(TOOLS).join('|')}> --repo <path> [-- args...]
-  ${TOOL} --version | help`
+  ${TOOL} promote [--repo <path>]
+  ${TOOL} compliance run [--repo <path>] [-- args...]   (also: adl run compliance -- deprecated)
+  ${TOOL} --version | help
+  --repo defaults to the git work-tree root when omitted.`
 
 class UsageError extends Error {
   constructor(message: string) {
@@ -56,7 +57,10 @@ function parse(command: string, argv: string[], allowed: string[]): Parsed {
       parsed.positional.push(arg)
     }
   }
-  if (parsed.repo === '') throw new UsageError('--repo <path> is required')
+  // `repo` may be empty here — `resolveRepo` falls back to cwd's git work-tree
+  // root. The `--repo <path> is required` error no longer fires for `--repo`-
+  // taking commands; only `compliance run`'s subcommand and friends still need
+  // their own argument validation, performed by the dispatched case.
   return parsed
 }
 
@@ -168,10 +172,27 @@ async function dispatch(argv: string[], io: Io): Promise<number> {
       }
       return 0
     }
+    case 'compliance': {
+      // `adl compliance run [--repo <path>] [-- args...]` — the canonical
+      // form. `compliance` is its own top-level command so it does not clash
+      // with `adl run <surface>` (agent-surface runner) elsewhere in the CLI.
+      const [subcommand = '', ...rest] = args
+      if (subcommand !== 'run') throw new UsageError(`unknown compliance subcommand: ${subcommand} (expected 'run')`)
+      // Parse only the arguments following the required `run` subcommand, so
+      // `--repo` is resolved exactly as it is for the deprecated alias.
+      const parsed = parse(command, rest, [])
+      return runTool('compliance', parsed.repo, parsed.rest, context)
+    }
     case 'run': {
       const parsed = parse(command, args, [])
       const tool = parsed.positional[0] ?? ''
       if (!isToolName(tool)) throw new UsageError(`unknown tool: ${tool}`)
+      // Deprecated alias: `adl run compliance --repo <path>`. Prefer
+      // `adl compliance run [--repo <path>]`. Exit 0, warn to stderr only —
+      // consumers (CI, hooks) keep working unchanged.
+      if (tool === 'compliance') {
+        context.err(`deprecated: prefer 'adl compliance run'; 'adl run compliance' will be removed in a future release`)
+      }
       return runTool(tool, parsed.repo, parsed.rest, context)
     }
     default: