@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.32 → 0.1.33

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
 size: 82920928 bytes
-sha256: f63a82963b12de92399625846d611dc9a469ceec692522e95fbae7ff3f702acb
+sha256: 3e480a5aff47ee61aec30d26dad9d06dc8f3c4b33ca4b5ed1b8ef9b4a810bb99

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/src/rules/impl/adl-git-push-policy.ts

@@ -39,14 +39,14 @@
  *     `classifyGitPushDestination`) — denied for EVERY identity, matching the
  *     matrix's ❌/❌ for this row. An unrecognized branch name (neither a
  *     protected name nor a recognized feature prefix) fails closed into this
- *     same bucket: the matrix only grants an exception for the four listed
+ *     same bucket: the matrix only grants an exception for the listed
  *     prefixes, not for "anything else". `develop` is retired
  *     (docs/specs/two-branch-standard-2026-09-27.md §1b.2 — the standard is
  *     two branches, not three) and is deliberately NOT a named protected
  *     branch any more; a push to it still lands in this same bucket, but as
  *     an ordinary unrecognized name, not a special case.
  *  3. Row 2 — the destination is a recognized feature branch
- *     (`feat/ fix/ docs/ chore/`): allowed for `agent-tarun`/`agent-vivek`
+ *     (`<commit type>/`, every type but `release` — packages/azdo/src/lib/commit-types.ts): allowed for `agent-tarun`/`agent-vivek`
  *     (Azure DevOps Contributors, and this is the ordinary way they ship
  *     work); denied for `agent-reviewer` (Azure DevOps Reader — cannot push
  *     at all, see docs/enact/handoff-enact-vps-global-tools-2026-09-25.md's
@@ -56,6 +56,7 @@
 import type { Invocation } from '../shell/invocation.ts'
 import type { Token } from '../shell/token.ts'
 import { tokenValue } from '../shell/token.ts'
+import { BRANCH_PREFIXES } from '../../../../azdo/src/lib/commit-types.ts'
 import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
 import { noParams } from '../spec.ts'
 import { AGENT_REVIEWER, resolveFromEnvOrFile } from './adl-identity.ts'
@@ -134,7 +135,7 @@ function pushBypassesPolicy(rest: readonly Token[]): boolean {
 }
 
 const PROTECTED_BRANCHES: ReadonlySet<string> = new Set(['integration', 'main'])
-const FEATURE_PREFIXES: readonly string[] = ['feat/', 'fix/', 'docs/', 'chore/']
+const FEATURE_PREFIXES: readonly string[] = BRANCH_PREFIXES.map((prefix) => `${prefix}/`)
 
 function normalizeBranchRef(ref: string): string {
   return ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref
@@ -229,7 +230,7 @@ export const adlGitPushBranchPolicy: RuleSpec = {
       const user = 'protected branch: push a feature branch and open a PR'
       return {
         user,
-        agent: `DENIED ${user}. \`integration\`/\`main\` (and any branch this hook cannot resolve from argv alone, including a retired name like \`develop\`) never take a direct push — push a \`feat/ fix/ docs/ chore/\` branch and open a PR. Blocked: ${ctx.snippet}`,
+        agent: `DENIED ${user}. \`integration\`/\`main\` (and any branch this hook cannot resolve from argv alone, including a retired name like \`develop\`) never take a direct push — push a \`${FEATURE_PREFIXES.join(' ')}\` branch and open a PR. Blocked: ${ctx.snippet}`,
       }
     }
 

package/packages/agent-hooks/src/rules/shell/protected-carriers.ts

@@ -47,6 +47,12 @@ export const PROTECTED_CARRIER_PATHS: ReadonlySet<string> = new Set([
   // separate home-relative resolution needed — the suffix is the same
   // regardless of what resolves the leading `~`/`$HOME`/absolute prefix.
   '.kimi-code/config.toml',
+  // OpenCode's permission policy (surface-policy.ts); OpenCode reads both spellings (global-surface-sweep.ts).
+  '.config/opencode/opencode.jsonc',
+  '.config/opencode/opencode.json',
+  // Claude managed settings, macOS and Linux; suffix entries so /private/etc and ../ spellings match too.
+  'Library/Application Support/ClaudeCode/managed-settings.json',
+  'etc/claude-code/managed-settings.json',
 ])
 
 /**
@@ -105,10 +111,8 @@ export function protectedCarrierMatch(path: string): string | null {
 /**
  * The per-host carrier DIRECTORIES — deleting, moving away, or overwriting
  * the WHOLE directory removes (or replaces) the carrier file inside it too,
- * exactly as much as touching that file directly. `.claude`/`.codex`/`.cursor`/`.opencode` — Kimi's own
- * `~/.kimi-code/` is deliberately NOT included: `mv ~/.kimi-code /tmp` is a
- * genuinely different, much bigger blast radius (moving the user's whole
- * Kimi config directory, not a repo-scoped host-config directory).
+ * exactly as much as touching that file directly. All five surfaces, global and
+ * in the repo (Tarun, 2026-10-09): `.claude`/`.codex`/`.cursor`/`.opencode`, `.kimi-code`, `.config/opencode`.
  *
  * Covers `mv`/`cp -r` (destination)/`rsync` (destination) via
  * `protected-carrier-writes.ts`'s existing operand extraction — a
@@ -119,7 +123,17 @@ export function protectedCarrierMatch(path: string): string | null {
  * existing operand handlers, and covering them needs new, tool-specific
  * parsing; a known gap, recorded here rather than silently dropped.
  */
-const PROTECTED_CARRIER_DIRS: ReadonlySet<string> = new Set(['.claude', '.codex', '.cursor', '.opencode'])
+// The managed-settings folders are protected too: moving one away takes its managed-settings.json with it.
+const PROTECTED_CARRIER_DIRS: ReadonlySet<string> = new Set([
+  '.claude',
+  '.codex',
+  '.cursor',
+  '.opencode',
+  '.kimi-code',
+  '.config/opencode',
+  'Library/Application Support/ClaudeCode',
+  'etc/claude-code',
+])
 
 /**
  * The protected carrier directory `path` names — exact match or a trailing

package/packages/agent-settings/assets/GLOBAL-AGENTS.md

@@ -64,7 +64,7 @@ repo's own `AGENTS.md`.
 - **Repository controls run via `adl repo controls`.** Git hooks in controlled repositories run pre-commit (local checks) and pre-push (Azure DevOps governance). Each repository is reconciled on its own with its `.agents/`, `.claude/`, `.codex/`, `.cursor/`, `.kimi-code/`, `.opencode/` projections.
 - **The release flow (`integration` auto-complete; the `branch → PR → integration → main` promotion; the integration PR merging itself once green) applies to repositories whose root contains an `adl-config.toml`.** Other repositories follow the release flow declared in their own `AGENTS.md`. The human approval gate, where it exists, is the promotion from `integration` to `main`; everything before that is auto-complete once CI is green.
 - Keep each commit **independently green** and on one cohesive topic. Never use `git stash`. When "one topic" and "independently green" conflict, green wins — and say so.
-- Subjects are `<type>(<scope>): <lowercase subject>`. Types: `feat|fix|docs|refactor|perf|chore`. No `!` marker. `release:` is reserved for the promotion PR the pipeline raises — never write one by hand. **In repositories whose root contains an `adl-config.toml`, the pipeline opens `integration → main` once CI is green on `integration` — no agent opens it; the subject follows the commit grammar above.**
+- Subjects are `<type>(<scope>): <lowercase subject>`. Types: `feat|fix|docs|refactor|perf|chore`. Branch prefixes are exactly these types (`<type>/<kebab>`), not configurable per repository. No `!` marker. `release:` is reserved for the promotion PR the pipeline raises — never write one by hand. **In repositories whose root contains an `adl-config.toml`, the pipeline opens `integration → main` once CI is green on `integration` — no agent opens it; the subject follows the commit grammar above.**
 - A PR body needs non-empty `## Summary`, `## Why` and `## Changes`. The title follows the commit grammar above.
 
 ## Tests

package/packages/azdo/src/lib/commit-types.ts

@@ -0,0 +1,8 @@
+// The one list of commit types (Bug 651, Tarun 2026-10-09); every other list derives from it.
+export const COMMIT_TYPES = ['feat', 'fix', 'docs', 'refactor', 'perf', 'chore', 'release'] as const
+
+// `release` is reserved for the promotion PR the pipeline raises; agents and humans never author it.
+const RESERVED_COMMIT_TYPE = 'release'
+
+// Branch prefixes are exactly the commit types minus `release`; no repository overrides them.
+export const BRANCH_PREFIXES: readonly string[] = COMMIT_TYPES.filter((type) => type !== RESERVED_COMMIT_TYPE)

package/packages/azdo/src/lib/validate-pr-metadata.ts

@@ -1,4 +1,7 @@
-const TITLE_PATTERN = /^(feat|fix|docs|refactor|perf|chore)(\([a-z0-9][a-z0-9-]*\))?: .+$/
+import { BRANCH_PREFIXES } from './commit-types.ts'
+
+// A PR title never carries the pipeline-reserved `release`, so its types are the branch prefixes.
+const TITLE_PATTERN = new RegExp(`^(${BRANCH_PREFIXES.join('|')})(\\([a-z0-9][a-z0-9-]*\\))?: .+$`)
 const REQUIRED_SECTIONS = ['Summary', 'Why', 'Changes']
 
 export function validatePullRequestMetadata(title: string, description: string): string[] {

package/packages/repo-controls/AGENTS.md

@@ -51,7 +51,7 @@ written) and the `core.hooksPath` setting are what `install --repo` wires in
 **target** repos.
 
 **Rule values are defaults, not universals.** The bundled defaults are enact-m5's:
-branch prefixes `feat|fix|docs|chore`, protected `main` and `integration`,
+branch prefixes fixed to the commit types minus `release` (`packages/azdo/src/lib/commit-types.ts`), protected `main` and `integration`,
 lowercase kebab-case descriptions, lowercase commit subject with an 80-character
 limit and a fixed type list, plus the coverage ratchet and the behind-origin push
 check. Per-repo values are config-driven, in `adl-config.toml`'s `[controls]`

package/packages/repo-controls/README.md

@@ -384,7 +384,7 @@ gate is switched off by an explicit `false`. See "No silent skips" below.
 | Key | Seeded by install | When absent | enact-m5 | Effect |
 |---|---|---|---|---|
 | `branches.protected` | yes | *required* | `["main", "integration"]` | pre-push refuses while on these branches |
-| `branches.prefixes` | yes | *required* | `["feat", "fix", "docs", "chore"]` | pre-push / azdo-push branch pattern `<prefix>/<kebab>` |
+| `branches.prefixes` | removed | a config error naming the key | n/a | not configurable: branch prefixes are the commit types minus `release` (`packages/azdo/src/lib/commit-types.ts`); pre-push / azdo-push enforce `<prefix>/<kebab>`; delete the key |
 | `pre_push.remote` | yes | *required* | `"origin"` | remote azdo-push pushes to and reads status from |
 | `pre_commit.staged_coverage` | yes (`true`) | config error | `true` | enact-m5-only staged coverage measurement (fails when `[controls.coverage].produce` is not declared) |
 | `pre_commit.doc_freshness` | yes (`true`) | config error | opt in | a staged `docs/` or `plans/` `.md` carries a `last_update` stamped within 5h (nothing to grade when no docs are staged) |
@@ -633,7 +633,7 @@ the repository, and any of their files with consecutive comment lines fail REP-0
 result.
 
 Fixed conventions (enact-m5, not configurable): commit subject
-`^(feat|fix|docs|refactor|perf|chore|release)(\([a-z0-9][a-z0-9-]*\))?: .+`, at most 80
+`^(<commit type>)(\([a-z0-9][a-z0-9-]*\))?: .+` (types `feat|fix|docs|refactor|perf|chore|release`, defined once in `packages/azdo/src/lib/commit-types.ts` and handed to the hook as `ADL_REPO_CONTROLS_COMMIT_TYPES`; `release` is the pipeline's only), at most 80
 characters, lowercase description without trailing period; `Merge `, `Revert "`
 and `X.Y.Z` subjects exempt; no staged `.scratchpad` paths or new references;
 `git diff --cached --check`; git environment scrubbed before push checks.
@@ -650,16 +650,16 @@ The pre-commit gate has two deliberately different outcomes:
 - A changed or untracked **top-level** dot path is **commit-required**.
   When it is omitted from the index, the hook names it and tells the author to
   stage it. Once staged, it can be committed normally. This covers top-level dot
-  paths that are not protected, such as `.mcp.json` and future ones. Nested paths such as
+  paths that are not protected, such as `.mcp.json`, `.workflows/` and the agent surface roots
+  (`.agents/`, `.claude/`, `.codex/`, `.cursor/`, `.kimi-code/`, `.opencode/`): those hold a
+  repository's own hooks and skills, so they are not protected as a whole (Bug 644). Nested paths such as
   `tools/.claude/**` are ordinary repository content. The designated ephemeral
   scratch storage is never committable.
 - A **protected control** requires human approval even when staged: every path
-  under `compliance/`, `workflows/`, `.workflows/` or an agent surface root
-  (`.agents/`, `.claude/`, `.codex/`, `.cursor/`, `.kimi-code/`, `.opencode/`),
-  `adl-config.toml`, the folder declared as `[controls.compliance.trees].compliance`
+  under `compliance/` or `workflows/`, `adl-config.toml`, the folder declared as `[controls.compliance.trees].compliance`
   (in addition to the fixed `compliance/` root, so a relocated register folder stays
   protected: `integrityWatched` in `src/hook.ts`), and the repository's explicit
-  `[controls.integrity].watched` patterns (`FIXED_ROOTS` and `WIRING` in `src/integrity.ts`). The full definition and the
+  `[controls.integrity].watched` patterns (`PROTECTED_ROOTS` and `WIRING` in `src/integrity.ts`). A repository protects any dot path it chooses through `watched`. The full definition and the
   owner override: [`#protected-paths-and-owner-override`](../../docs/architecture/compliance-controls.md#protected-paths-and-owner-override). The same controls cannot be
   left dirty while committing other work.
 

package/packages/repo-controls/scripts/hooks/commit-msg

@@ -2,7 +2,7 @@
 # Enforce the conventional commit subject contract.
 set -euo pipefail
 
-ALLOWED_TYPES='feat|fix|docs|refactor|perf|chore|release'
+ALLOWED_TYPES="${ADL_REPO_CONTROLS_COMMIT_TYPES:?}"
 ALLOWED_TYPES_DISPLAY="${ALLOWED_TYPES//|/, }"
 FORMAT_RE="^(${ALLOWED_TYPES})"'(\([a-z0-9][a-z0-9-]*\))?: .+'
 TYPE_RE='^([A-Za-z0-9]+)(\(|:)'

package/packages/repo-controls/src/config.ts

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { join } from 'node:path'
+import { BRANCH_PREFIXES, COMMIT_TYPES } from '../../azdo/src/lib/commit-types.ts'
 import { CONFIG_REL, INSTALL_HINT } from './constants.ts'
 import { MERGE_STRATEGIES, type MergeStrategy } from './promote.ts'
 
@@ -76,7 +77,7 @@ export interface FindingsConfig {
 }
 
 export interface RepoControlsConfig {
-  branches: { protected: string[]; prefixes: string[] }
+  branches: { protected: string[] }
   preCommit: { staticChecks: StaticCheck[]; stagedCoverage: boolean; docFreshness: boolean; compliance: boolean }
   commitMsg: { staticChecks: StaticCheck[] }
   release: { optedOut: boolean; source: string; target: string; mergeStrategy: MergeStrategy; preBump: string[] }
@@ -111,8 +112,8 @@ export const SEEDED_ATTRIBUTES: SeededAttribute[] = [
   {
     key: 'branches',
     text: `
-# pre-push refuses to push while one of these branches is checked out; prefixes: <prefix>/<kebab>.
-branches = { protected = ["main", "integration"], prefixes = ["feat", "fix", "docs", "chore"] }
+# pre-push refuses to push while one of these branches is checked out; branch prefixes are fixed to the commit types.
+branches = { protected = ["main", "integration"] }
 `,
   },
   {
@@ -340,7 +341,6 @@ export function extractControlsSpan(text: string): string | null {
 }
 
 const BRANCH_RE = /^[a-z0-9][a-z0-9/-]*$/
-const PREFIX_RE = /^[a-z0-9][a-z0-9-]*$/
 const LABEL_RE = /^[a-z0-9][a-z0-9-]*$/
 const REMOTE_RE = /^\S+$/
 
@@ -487,6 +487,7 @@ export function parseConfig(text: string): RepoControlsConfig {
   problems.unknownKeys(controls, ['branches', 'pre_commit', 'pre_push', 'commit_msg', 'post_commit', 'compliance', 'coverage', 'findings', 'integrity', 'release'], '')
 
   const branches = problems.table(controls, 'branches', ['protected', 'prefixes'])
+  if (branches.prefixes !== undefined) problems.add('branches.prefixes is no longer configurable — delete it; branch prefixes are fixed to the commit types')
   // `branches` and `pre_push.remote` are REQUIRED: install always seeds them, and
   // `pre-push` reads their env vars with `${VAR:?}`, which aborts on an empty value —
   // so "no branch policy" cannot be spelled as an empty list.
@@ -539,7 +540,6 @@ export function parseConfig(text: string): RepoControlsConfig {
   const config: RepoControlsConfig = {
     branches: {
       protected: problems.names(branches, 'protected', 'branches.protected', BRANCH_RE),
-      prefixes: problems.names(branches, 'prefixes', 'branches.prefixes', PREFIX_RE),
     },
     preCommit: {
       // The repository declares WHAT runs at commit and WHICH hook it runs in.
@@ -747,7 +747,8 @@ export function configEnv(repo: string, config: RepoControlsConfig): Record<stri
   const env: Record<string, string> = {
     ADL_REPO_CONTROLS_ROOT: repo,
     ADL_REPO_CONTROLS_PROTECTED_BRANCHES: config.branches.protected.join('|'),
-    ADL_REPO_CONTROLS_BRANCH_PREFIXES: config.branches.prefixes.join('|'),
+    ADL_REPO_CONTROLS_BRANCH_PREFIXES: BRANCH_PREFIXES.join('|'),
+    ADL_REPO_CONTROLS_COMMIT_TYPES: COMMIT_TYPES.join('|'),
     ADL_REPO_CONTROLS_COVERAGE_RATCHET: config.prePush.coverageRatchet ? '1' : '0',
     ADL_REPO_CONTROLS_FINDINGS_RATCHET: config.prePush.findingsRatchet ? '1' : '0',
     ADL_REPO_CONTROLS_EXPORT_LINKS: config.prePush.exportLinks.join('\n'),

package/packages/repo-controls/src/integrity.ts

@@ -9,21 +9,8 @@
 
 const WIRING: readonly string[] = ['adl-config.toml']
 
-// Tarun, 2026-09-30: `.workflows/` and every agent surface root are protected
-// like `workflows/` — a dirty path under any of them blocks a normal commit and
-// only Tarun lands it. They were "centrally managed dotfiles" an agent could
-// commit alongside a related change; that let an agent land gate-defining files.
-const FIXED_ROOTS: readonly string[] = [
-  'compliance',
-  'workflows',
-  '.workflows',
-  '.agents',
-  '.claude',
-  '.codex',
-  '.cursor',
-  '.kimi-code',
-  '.opencode',
-]
+// Only these folders are protected as a whole; dot folders hold a repository's own hooks and skills (Bug 644).
+const PROTECTED_ROOTS: readonly string[] = ['compliance', 'workflows']
 
 /** A declared pattern, as a regex. `*` stays in one directory; `**` crosses them. */
 function patternToRegExp(pattern: string): RegExp {
@@ -59,18 +46,18 @@ function protectedMatchers(watched: readonly string[]): ((path: string) => boole
   return [...wiring, ...declared]
 }
 
-const isUnderFixedRoot = (path: string): boolean => FIXED_ROOTS.some((root) => path === root || path.startsWith(`${root}/`))
+const isUnderProtectedRoot = (path: string): boolean => PROTECTED_ROOTS.some((root) => path === root || path.startsWith(`${root}/`))
 
 /** Centrally managed repository files that must travel with the next commit. */
 const isTopLevelDotPath = (path: string): boolean => path.startsWith('.')
 
 /**
  * The single source of truth used for final-index and dirty-worktree checks.
- * Fixed package policy protects root compliance/workflows and the enrollment
+ * Package policy protects root compliance/workflows and the enrollment
  * file; each repository adds its own gate files through `watched`.
  */
 export function isProtectedPath(path: string, watched: readonly string[]): boolean {
-  return isUnderFixedRoot(path) || protectedMatchers(watched).some((match) => match(path))
+  return isUnderProtectedRoot(path) || protectedMatchers(watched).some((match) => match(path))
 }
 
 /**