@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.34 → 0.1.37

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82945504 bytes
-sha256: b6594d01b2ebea8949f80faa8da029598f8be7513fb1e3c7b63ddc01df4c8f02
+size: 82998752 bytes
+sha256: a9c4655905b5f4b937f9d93dadeb7ad5ae28dec1392a767225242478684aff98

package/bin/reconcile

@@ -186,6 +186,7 @@ collect_sweep_backups() {
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "$script_dir/.." && pwd)"
 manifest="${manifest:-$repo_root/packages/fleet/manifest.json}"
+manifest="$(cd "$(dirname "$manifest")" && pwd)/$(basename "$manifest")"
 # shellcheck source=lib/bun-compile-build.sh
 source "$script_dir/lib/bun-compile-build.sh"
 # shellcheck source=lib/adl-package.sh
@@ -3055,13 +3056,13 @@ fi
 if [[ "$global_agents_enabled" == true ]]; then
   if [[ "$mode" != apply ]]; then
     echo "global-tools: global agents mode=status home=$administrator_home"
-    "$BASH" "$script_dir/global-agents" --home "$administrator_home" --mode status
+    "$BASH" "$script_dir/global-agents" --home "$administrator_home" --mode status --host "$device" --manifest "$manifest"
   else
     echo "global-tools: global agents mode=deploy home=$administrator_home (as $administrator)"
     # The exact target files are authoritative global artifacts. Drift is
-    # replaced from GLOBAL-AGENTS.md with no backup or leave-in-place branch.
+    # replaced from TARUN-GLOBAL-AGENTS-INSTRUCTIONS.md with no backup or leave-in-place branch.
     (cd /tmp && sudo -u "$administrator" -H env PATH="${brew_bin%/*}:/usr/bin:/bin" \
-      "$BASH" "$script_dir/global-agents" --home "$administrator_home" --mode deploy)
+      "$BASH" "$script_dir/global-agents" --home "$administrator_home" --mode deploy --host "$device" --manifest "$manifest")
   fi
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.34",
+  "version": "0.1.37",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/README.md

@@ -474,6 +474,17 @@ rendered by `src/deploy/opencode-template.ts` from `assets/opencode-plugin.templ
 `assets/hooks.json` and the OpenCode surface in `deploy-profile.json`. Do not edit
 the deployed file by hand; re-run `adl install`.
 
+- The deployed file uses OpenCode v2's plugin shape (`export default { id, setup }`,
+  with `setup(ctx)` imperatively registering hooks via `ctx.session.hook` /
+  `ctx.tool.hook` / `ctx.event.subscribe` — confirmed against
+  `github.com/anomalyco/opencode/blob/dev/packages/core/src/plugin/module.ts`
+  and the promise adapter at
+  `github.com/anomalyco/opencode/blob/dev/packages/plugin/src/promise/adapter.ts`).
+  v2 dropped v1's `chat.message` + `experimental.chat.system.transform` events; the
+  template maps the equivalent flow to `ctx.session.hook("prompt", ...)` (run
+  `user-prompt-submit` per submission, stash the additionalContext) and
+  `ctx.session.hook("context", ...)` (push stashed context into `event.system`
+  immediately before provider dispatch).
 - The deployed file has no multi-line comments (Tarun 2026-10-08, Bug 602), so it
   passes compliance control REP-007. Its header is a single line pointing here.
 - Fallback projection: an event with no documented OpenCode equivalent runs on a
@@ -481,5 +492,8 @@ the deployed file by hand; re-run `adl install`.
   `packages/agent-hooks/deploy-profile.json` (today `SessionEnd -> SessionIdle`).
   The generated file lists the map as one line, `// Event fallbacks: A -> B, C -> D`,
   and emits no line at all when the map is empty.
+- `UserPromptSubmit` is intentionally not routed to any opencode slot — the v2
+  public plugin model has no replacement for v1's `chat.message` event; the rule
+  still runs for claude/codex/cursor/kimi through their own carriers.
 - Source of truth for hook commands is `assets/hooks.json`; the generated arrays
   carry `command`, `matcher`, `timeoutMs` and `fallbackFor` per entry.

package/packages/agent-hooks/assets/opencode-plugin.template.ts

@@ -2,6 +2,8 @@
 
 __ADL_FALLBACK_ENTRIES__
 
+// OpenCode v2 plugin: `export default { id, setup }`; setup(ctx) imperatively registers hooks via ctx.session.hook / ctx.tool.hook / ctx.event.subscribe.
+
 interface HookCommandSpec {
   command: string;
   matcher?: string;
@@ -27,10 +29,6 @@ const HOOKS_TOOL_EXECUTE_AFTER: HookCommandSpec[] = [
 __ADL_ARRAY_HOOKS_TOOL_EXECUTE_AFTER__
 ];
 
-const HOOKS_CHAT_MESSAGE: HookCommandSpec[] = [
-__ADL_ARRAY_HOOKS_CHAT_MESSAGE__
-];
-
 const HOOKS_EVENT_SESSION_CREATED: HookCommandSpec[] = [
 __ADL_ARRAY_HOOKS_EVENT_SESSION_CREATED__
 ];
@@ -47,30 +45,41 @@ async function runHookCommand(
   payload: Record<string, unknown>,
   cwd: string,
 ): Promise<{ exitCode: number | null; stdout: string; stderr: string }> {
-  try {
-    const proc = Bun.spawn(["/bin/sh", "-c", spec.command], {
-      cwd,
-      stdin: "pipe",
-      stdout: "pipe",
-      stderr: "pipe",
-      ...(spec.timeoutMs ? { timeout: spec.timeoutMs, killSignal: "SIGTERM" } : {}),
-    });
-    proc.stdin.write(JSON.stringify(payload));
-    proc.stdin.end();
-    const [stdout, stderr] = await Promise.all([
-      new Response(proc.stdout).text(),
-      new Response(proc.stderr).text(),
-    ]);
-    await proc.exited;
-    if (proc.exitCode !== 0 && proc.exitCode !== 2) {
-      console.error("[" + PLUGIN_NAME + "] hook command exited " + proc.exitCode + ": " + spec.command);
+  const { spawn } = await import("node:child_process");
+  return new Promise((resolve) => {
+    try {
+      const proc = spawn("/bin/sh", ["-c", spec.command], {
+        cwd,
+        stdio: ["pipe", "pipe", "pipe"],
+      });
+      let stdout = "";
+      let stderr = "";
+      proc.stdout!.on("data", (chunk: Buffer) => { stdout += chunk.toString("utf8"); });
+      proc.stderr!.on("data", (chunk: Buffer) => { stderr += chunk.toString("utf8"); });
+      const timer = spec.timeoutMs
+        ? setTimeout(() => { try { proc.kill("SIGTERM"); } catch {} }, spec.timeoutMs)
+        : null;
+      proc.on("error", (err) => {
+        if (timer) clearTimeout(timer);
+        const message = err instanceof Error ? err.message : String(err);
+        console.error("[" + PLUGIN_NAME + "] hook command crashed: " + spec.command + " -- " + message);
+        resolve({ exitCode: null, stdout: "", stderr: message });
+      });
+      proc.on("exit", (code) => {
+        if (timer) clearTimeout(timer);
+        if (code !== 0 && code !== 2) {
+          console.error("[" + PLUGIN_NAME + "] hook command exited " + code + ": " + spec.command);
+        }
+        resolve({ exitCode: code, stdout, stderr });
+      });
+      proc.stdin!.write(JSON.stringify(payload));
+      proc.stdin!.end();
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error("[" + PLUGIN_NAME + "] hook command crashed: " + spec.command + " -- " + message);
+      resolve({ exitCode: null, stdout: "", stderr: message });
     }
-    return { exitCode: proc.exitCode, stdout, stderr };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    console.error("[" + PLUGIN_NAME + "] hook command crashed: " + spec.command + " -- " + message);
-    return { exitCode: null, stdout: "", stderr: message };
-  }
+  });
 }
 
 function denyReason(result: { exitCode: number | null; stdout: string; stderr: string }): string | undefined {
@@ -113,9 +122,7 @@ function applyUpdatedInput(
   }
 }
 
-const adlPromptContext = new Map<string, string>();
-
-function extractHookContext(result: { exitCode: number | null; stdout: string; stderr: string }): string | undefined {
+function extractHookContext(result: { stdout: string }): string | undefined {
   const trimmed = result.stdout.trim();
   if (!trimmed) return undefined;
   try {
@@ -130,91 +137,120 @@ function extractHookContext(result: { exitCode: number | null; stdout: string; s
   return trimmed;
 }
 
-export const __ADL_PLUGIN_IDENTIFIER__ = async ({ directory }: { directory: string }) => {
-  return {
-  "chat.message": async (input: any, output: any) => {
-    const parts = output && Array.isArray(output.parts) ? output.parts : [];
-    const promptText = parts.filter((p: any) => p && p.type === "text").map((p: any) => p.text).join(" ");
-    let context: string | undefined;
-    for (const spec of HOOKS_CHAT_MESSAGE) {
+export default {
+  id: "__ADL_PLUGIN_NAME__",
+  setup: async (ctx: any) => {
+    const cwd = ctx.location?.directory ?? process.cwd();
+    const adlPromptContext = new Map<string, string[]>();
+
+    // Per-prompt: run user-prompt-submit, stash additionalContext keyed by sessionID.
+    await ctx.session.hook("prompt", async (event: any) => {
+      const sessionID: string | undefined = event?.sessionID;
+      if (!sessionID) return;
+      const promptText: string = event?.prompt?.text ?? "";
+      const out: string[] = [];
       const payload = {
         hook_event_name: "UserPromptSubmit",
         prompt: promptText,
-        cwd: directory,
-        session_id: input && input.sessionID,
+        cwd,
+        session_id: sessionID,
       };
-      const result = await runHookCommand(spec, payload, directory);
+      const result = await runHookCommand(
+        { command: "adl hook user-prompt-submit --host=opencode", timeoutMs: 15000 },
+        payload,
+        cwd,
+      );
       const extracted = extractHookContext(result);
-      if (extracted) context = context ? context + " " + extracted : extracted;
-    }
-    const sessionID = input && input.sessionID;
-    if (sessionID) {
-      if (context) adlPromptContext.set(sessionID, context);
+      if (extracted) out.push(extracted);
+      if (out.length) adlPromptContext.set(sessionID, out);
       else adlPromptContext.delete(sessionID);
-    }
-  },
-  "experimental.chat.system.transform": async (input: any, output: any) => {
-    const sessionID = input && input.sessionID;
-    if (!sessionID) return;
-    const context = adlPromptContext.get(sessionID);
-    if (context && output && Array.isArray(output.system)) {
-      output.system.push(context);
-    }
-  },
-  "tool.execute.before": async (input: ToolHookInput, output: ToolHookOutput) => {
-    for (const spec of HOOKS_TOOL_EXECUTE_BEFORE) {
-      if (spec.matcher && !new RegExp("^(?:" + spec.matcher + ")$", "i").test(input.tool)) continue;
-      const payload = {
-        hook_event_name: "PreToolUse",
-        tool_name: input.tool,
-        tool_input: output.args,
-        cwd: directory,
-        session_id: input.sessionID,
-      };
-      const result = await runHookCommand(spec, payload, directory);
-      const reason = denyReason(result);
-      if (reason) throw new Error(reason);
-      applyUpdatedInput(result, output);
-    }
-  },
-  "tool.execute.after": async (input: ToolHookInput, output: ToolHookOutput) => {
-    for (const spec of HOOKS_TOOL_EXECUTE_AFTER) {
-      if (spec.matcher && !new RegExp("^(?:" + spec.matcher + ")$", "i").test(input.tool)) continue;
-      const payload = {
-        hook_event_name: "PostToolUse",
-        tool_name: input.tool,
-        tool_input: output.args,
-        cwd: directory,
-        session_id: input.sessionID,
-      };
-      const result = await runHookCommand(spec, payload, directory);
-      // PostToolUse cannot block: the tool call already completed.
-    }
-  },
-  event: async ({ event }: { event: any }) => {
-    if (event && event.type === "session.created") {
-      for (const spec of HOOKS_EVENT_SESSION_CREATED) {
+    });
+
+    // Before provider dispatch: push stashed context into the system prompt array.
+    await ctx.session.hook("context", (event: any) => {
+      const sessionID: string | undefined = event?.sessionID;
+      if (!sessionID) return;
+      const out = adlPromptContext.get(sessionID);
+      if (!out || out.length === 0) return;
+      if (!Array.isArray(event.system)) return;
+      for (const text of out) {
+        event.system.push({ type: "text", text });
+      }
+    });
+
+    // Pre-tool-use: deny / rewrite. Always runs pre-tool-use; crg:pre-commit only on bash.
+    await ctx.tool.hook("execute.before", async (event: any) => {
+      const input = event as ToolHookInput;
+      const output = { args: (event?.input ?? {}) as Record<string, unknown> };
+      for (const spec of HOOKS_TOOL_EXECUTE_BEFORE) {
+        if (spec.matcher && !new RegExp("^(?:" + spec.matcher + ")$", "i").test(input.tool)) continue;
         const payload = {
-          hook_event_name: "SessionStart",
-          cwd: directory,
-          session_id: event.properties && (event.properties.sessionID || (event.properties.info && event.properties.info.id)),
+          hook_event_name: "PreToolUse",
+          tool_name: input.tool,
+          tool_input: output.args,
+          cwd,
+          session_id: input.sessionID,
         };
-        await runHookCommand(spec, payload, directory);
+        const result = await runHookCommand(spec, payload, cwd);
+        const reason = denyReason(result);
+        if (reason) throw new Error(reason);
+        applyUpdatedInput(result, output);
       }
-    }
-    if (event && event.type === "session.idle") {
-      for (const spec of HOOKS_EVENT_SESSION_IDLE) {
+      if (output.args !== event?.input && event && "input" in event) {
+        event.input = output.args;
+      }
+    });
+
+    // Post-tool-use: observational, can't block. Runs after-file-edit on write|edit.
+    await ctx.tool.hook("execute.after", async (event: any) => {
+      const input = event as ToolHookInput;
+      for (const spec of HOOKS_TOOL_EXECUTE_AFTER) {
+        if (spec.matcher && !new RegExp("^(?:" + spec.matcher + ")$", "i").test(input.tool)) continue;
         const payload = {
-          hook_event_name: "SessionIdle",
-          cwd: directory,
-          session_id: event.properties && (event.properties.sessionID || (event.properties.info && event.properties.info.id)),
-          ...(spec.fallbackFor ? { fallback_for: spec.fallbackFor } : {}),
+          hook_event_name: "PostToolUse",
+          tool_name: input.tool,
+          tool_input: (event?.input ?? {}),
+          cwd,
+          session_id: input.sessionID,
         };
-        await runHookCommand(spec, payload, directory);
+        await runHookCommand(spec, payload, cwd);
       }
+    });
+
+    // session.created / session.idle: subscribe to the event stream and dispatch.
+    if (ctx.event && typeof ctx.event.subscribe === "function") {
+      (async () => {
+        try {
+          for await (const event of ctx.event.subscribe()) {
+            const type = event?.type;
+            if (type === "session.created") {
+              const sessionID: string | undefined = event?.properties?.sessionID ?? event?.properties?.info?.id;
+              for (const spec of HOOKS_EVENT_SESSION_CREATED) {
+                const payload = {
+                  hook_event_name: "SessionStart",
+                  cwd,
+                  session_id: sessionID,
+                };
+                await runHookCommand(spec, payload, cwd);
+              }
+            } else if (type === "session.idle") {
+              const sessionID: string | undefined = event?.properties?.sessionID ?? event?.properties?.info?.id;
+              for (const spec of HOOKS_EVENT_SESSION_IDLE) {
+                const payload = {
+                  hook_event_name: "SessionIdle",
+                  cwd,
+                  session_id: sessionID,
+                  ...(spec.fallbackFor ? { fallback_for: spec.fallbackFor } : {}),
+                };
+                await runHookCommand(spec, payload, cwd);
+              }
+            }
+          }
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          console.error("[" + PLUGIN_NAME + "] event subscriber crashed: " + message);
+        }
+      })();
     }
   },
-  };
-};
-
-export default __ADL_PLUGIN_IDENTIFIER__;
+};

package/packages/agent-hooks/deploy-profile.json

@@ -40,7 +40,7 @@
       "file": ".opencode/plugins/adl-repo.ts",
       "hostSuffix": "opencode",
       "matchers": {
-        "Bash": "bash",
+        "Bash": "bash|shell",
         "Write|Edit|MultiEdit|StrReplace|str_replace_editor|edit_file|str_replace|replace_in_file|create_file|write_file": "write|edit"
       },
       "unmappedMatcher": "keep",

package/packages/agent-hooks/src/deploy/opencode-template.ts

@@ -1,11 +1,10 @@
 /**
  * Fills assets/opencode-plugin.template.ts with the rendered hook arrays
- * (render.ts's renderOpencodeSlots), the profile's pluginName, and the
- * identifier derived from it — reproducing this repo's own committed
- * `.opencode/plugins/adl-repo.ts` byte-for-byte for the current
- * deploy-profile.json + assets/hooks.json, except the header (a one-line
- * comment plus an optional one-line fallback comment; no multi-line comments in
- * deployed code, Bug 602). See README "Generated OpenCode plugin".
+ * (render.ts's renderOpencodeSlots) and the profile's pluginName — reproducing
+ * this repo's own committed `.opencode/plugins/adl-repo.ts` byte-for-byte for
+ * the current deploy-profile.json + assets/hooks.json, except the header
+ * (a one-line comment plus an optional one-line fallback comment; no multi-line
+ * comments in deployed code, Bug 602). See README "Generated OpenCode plugin".
  */
 import { readFileSync } from 'node:fs'
 import { join } from 'node:path'
@@ -13,14 +12,6 @@ import type { HookSurface } from './profile.ts'
 import { OPENCODE_SLOTS, type RenderedOpencodeEntry, renderOpencodeSlots } from './render.ts'
 import type { CanonicalHooksDoc } from './source.ts'
 
-/** kebab-case -> camelCase, e.g. "adl-repo" -> "adlRepo". Ported from the deleted generator's toIdentifier (git show 5b34d10:packages/agent-skills/src/create/opencode.ts). */
-function toCamelCase(pluginName: string): string {
-  return pluginName
-    .split('-')
-    .map((part, index) => (index === 0 ? part : part.charAt(0).toUpperCase() + part.slice(1)))
-    .join('')
-}
-
 function serializeEntry(entry: RenderedOpencodeEntry): string {
   const fields: string[] = [`command: ${JSON.stringify(entry.command)}`]
   if (entry.matcher !== undefined) fields.push(`matcher: ${JSON.stringify(entry.matcher)}`)
@@ -68,9 +59,5 @@ export function renderOpencodePlugin(options: RenderOpencodePluginOptions): stri
   if (!out.includes('__ADL_PLUGIN_NAME__')) throw new Error(`opencode plugin template is missing marker __ADL_PLUGIN_NAME__: ${templatePath}`)
   out = out.split('__ADL_PLUGIN_NAME__').join(surface.pluginName)
 
-  const identifier = `${toCamelCase(surface.pluginName)}Plugin`
-  if (!out.includes('__ADL_PLUGIN_IDENTIFIER__')) throw new Error(`opencode plugin template is missing marker __ADL_PLUGIN_IDENTIFIER__: ${templatePath}`)
-  out = out.split('__ADL_PLUGIN_IDENTIFIER__').join(identifier)
-
   return out
 }

package/packages/agent-hooks/src/deploy/render.ts

@@ -119,24 +119,33 @@ export interface RenderedOpencodeEntry {
 const OPENCODE_SLOT_FOR_EVENT: Readonly<Record<string, string>> = {
   PreToolUse: 'HOOKS_TOOL_EXECUTE_BEFORE',
   PostToolUse: 'HOOKS_TOOL_EXECUTE_AFTER',
-  UserPromptSubmit: 'HOOKS_CHAT_MESSAGE',
   SessionStart: 'HOOKS_EVENT_SESSION_CREATED',
   SessionEnd: 'HOOKS_EVENT_SESSION_IDLE',
 }
 
+/**
+ * Canonical events intentionally NOT routed to any opencode plugin slot.
+ * v2's public plugin model dropped the v1 `chat.message` +
+ * `experimental.chat.system.transform` pair that carried UserPromptSubmit,
+ * so the rule still runs for claude/codex/cursor/kimi through their own
+ * carriers but is invisible to the opencode surface. Add a new entry here
+ * only with the same justification.
+ */
+const OPENCODE_UNSUPPORTED_CANONICAL_EVENTS: ReadonlySet<string> = new Set(['UserPromptSubmit'])
+
 export const OPENCODE_SLOTS: readonly string[] = [
   'HOOKS_TOOL_EXECUTE_BEFORE',
   'HOOKS_TOOL_EXECUTE_AFTER',
-  'HOOKS_CHAT_MESSAGE',
   'HOOKS_EVENT_SESSION_CREATED',
   'HOOKS_EVENT_SESSION_IDLE',
 ]
 
-/** slot name -> rendered entries, in source order. Every event in `doc` must have a known slot (see OPENCODE_SLOT_FOR_EVENT). */
+/** slot name -> rendered entries, in source order. Every event in `doc` must have a known slot or be in OPENCODE_UNSUPPORTED_CANONICAL_EVENTS. */
 export function renderOpencodeSlots(doc: CanonicalHooksDoc, surface: HookSurface): ReadonlyMap<string, readonly RenderedOpencodeEntry[]> {
   const out = new Map<string, RenderedOpencodeEntry[]>()
   for (const slot of OPENCODE_SLOTS) out.set(slot, [])
   for (const [event, groups] of doc) {
+    if (OPENCODE_UNSUPPORTED_CANONICAL_EVENTS.has(event)) continue
     const slot = OPENCODE_SLOT_FOR_EVENT[event]
     if (slot === undefined) throw new Error(`opencode-plugin has no template slot for canonical event "${event}"`)
     // `fallbackFor` names the CANONICAL event being substituted (e.g.

package/packages/agent-hooks/src/pre-tool-use/handler.ts

@@ -284,7 +284,7 @@ const IDENTITY_RULE_IDS: ReadonlySet<RuleId> = new Set([
  * The four role-gate rules that deny a SPECIFIC Azure DevOps MCP tool call by
  * the caller's identity (`adl.workitem-requires-tarun-or-vivek`,
  * `adl.pr-create-update-role`, `adl.pr-review-role`,
- * `adl.build-run-denied`). None of these are in `IDENTITY_RULE_IDS` above —
+ * `adl.build-run-role`). None of these are in `IDENTITY_RULE_IDS` above —
  * that set covers the rules that fire when no identity is resolved or
  * carried, never a rule that denies WITH an identity already resolved, on the
  * strength of who that identity is. Each of them can only fire on the same
@@ -297,7 +297,7 @@ const ROLE_GATE_RULE_IDS: ReadonlySet<RuleId> = new Set([
   'adl.workitem-requires-tarun-or-vivek',
   'adl.pr-create-update-role',
   'adl.pr-review-role',
-  'adl.build-run-denied',
+  'adl.build-run-role',
 ])
 
 type IdentitySourceLabel = 'inline' | 'env' | 'default-file' | 'none'

package/packages/agent-hooks/src/rules/impl/adl-build-run-role.ts

@@ -0,0 +1,116 @@
+/** `adl.build-run-role` — docs/operations/agent-permissions.md row 12 (build run), decision H1; the allow condition and the caller-declared id-is-its-own-PR-validation-build approximation (hook has no network; azdo core must re-verify) are documented on match() below and in the summary. */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { BRANCH_PREFIXES } from '../../../../azdo/src/lib/commit-types.ts'
+import { BUILDER_AGENTS, resolveFromEnvOrFile } from './adl-identity.ts'
+import { detailString } from './messages.ts'
+import { mcpToolName } from './mcp-tool.ts'
+import { effectiveIdentityForMcpCli, toolCallFor } from './adl-mcp-cli.ts'
+
+const RULE_ID = 'adl.build-run-role'
+
+const PROTECTED_BRANCHES: ReadonlySet<string> = new Set(['integration', 'main'])
+const FEATURE_PREFIXES: readonly string[] = BRANCH_PREFIXES.map((prefix) => `${prefix}/`)
+
+type Violation = 'not-a-builder' | 'missing-id' | 'missing-branch' | 'non-feature-branch'
+
+function normalizeBranchRef(ref: string): string {
+  return ref.startsWith('refs/heads/') ? ref.slice('refs/heads/'.length) : ref
+}
+
+function isFeatureBranchName(branch: string): boolean {
+  return FEATURE_PREFIXES.some((prefix) => branch.startsWith(prefix))
+}
+
+export const adlBuildRunRole: RuleSpec = {
+  id: RULE_ID,
+  category: 'tool-call',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary:
+    'Deny build_run except the lead (agent-tarun/agent-vivek) re-queuing its own PR’s validation pipeline on that PR’s feature branch (docs/operations/agent-permissions.md row 12, H1) — the MCP tool AND its adl mcp cli equivalent.',
+  params: noParams,
+  match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
+    // Also catch `adl mcp cli build-run` — same tool, same grade.
+    const call = toolCallFor(inv)
+    if (call === null) return null
+    if (mcpToolName(call.tool) !== 'build_run') return null
+
+    // Grade the EFFECTIVE identity for THIS call — an inline ADL_AGENT_ID_AGENT= override on the same CLI invocation wins, like the other role rules.
+    const resolution = resolveFromEnvOrFile(ctx.env)
+    const fallback = resolution.ok ? resolution.agent : null
+    const agent = effectiveIdentityForMcpCli(inv, ctx.command ?? '', fallback)
+    if (agent === null) return null // no identity at all: adl.run-required-for-writes's job
+
+    // 1. Only the lead re-queues CI — the role mismatch reports first regardless of shape.
+    if (!BUILDER_AGENTS.has(agent)) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'not-a-builder' satisfies Violation } }
+    }
+
+    // 2. The definition id, validated exactly like azdo-pl.ts's buildRun (a positive integer).
+    const id = call.input.id
+    if (typeof id !== 'number' || !Number.isInteger(id) || id < 1) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'missing-id' satisfies Violation } }
+    }
+
+    // 3. The PR source branch, caller-declared exactly like pr_review's targetBranch: required, and provably a feature branch.
+    const branch = call.input.branch
+    if (typeof branch !== 'string' || branch.trim().length === 0) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'missing-branch' satisfies Violation } }
+    }
+    const normalized = normalizeBranchRef(branch.trim())
+    if (PROTECTED_BRANCHES.has(normalized) || !isFeatureBranchName(normalized)) {
+      return { ruleId: RULE_ID, severity: 'deny', detail: { tool: call.tool, violation: 'non-feature-branch' satisfies Violation } }
+    }
+
+    return null
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const tool = detailString(finding, 'tool')
+    const violation = detailString(finding, 'violation') as Violation
+
+    if (violation === 'not-a-builder') {
+      const user = 'this operation can only be done with agent-tarun or agent-vivek'
+      return {
+        user,
+        agent:
+          `DENIED ${tool}: ${user}. Only the lead may re-queue its own PR’s validation pipeline on that PR’s ` +
+          `source branch — agent-reviewer runs no implementation PRs, so it has no PR CI to re-queue. Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    if (violation === 'missing-id') {
+      const user = 'a build definition id is required'
+      return {
+        user,
+        agent: `DENIED ${tool}: ${user} — pass the definition id of your PR’s validation pipeline (a positive integer). Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    if (violation === 'missing-branch') {
+      const user = 'name the source branch of your own PR to re-queue its validation pipeline'
+      return {
+        user,
+        agent:
+          `DENIED ${tool}: ${user}. The branch argument is what lets this hook scope the re-queue to your own ` +
+          `PR’s CI — without it, pipelines run on their own triggers. Re-queue with \`branch\` naming your PR’s ` +
+          `feature branch. Blocked: ${ctx.snippet}`,
+      }
+    }
+
+    const user = 'only a feature branch that is your own PR’s source branch may be re-queued'
+    return {
+      user,
+      agent:
+        `DENIED ${tool}: ${user}. \`integration\`/\`main\` and every unrecognized branch name are denied — a PR’s ` +
+        `source branch always carries a \`${FEATURE_PREFIXES.join(' ')}\` prefix. Blocked: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    // Tool-call rule; real coverage is tests/unit/rules-adl-build-run-role.test.ts (the shared shell corpus only proves non-firing on unrelated commands).
+    deny: [],
+    allow: ['ls -la', 'git status'],
+  },
+}