@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.37 → 0.1.47

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82998752 bytes
-sha256: a9c4655905b5f4b937f9d93dadeb7ad5ae28dec1392a767225242478684aff98
+size: 83039712 bytes
+sha256: e0a9055e0d4a79460ea808646054ccce2aeb7958e081287982bbae0a14fab2d1

package/bin/reconcile

@@ -69,8 +69,9 @@ source_mode="npm"
 # can point it at a disposable test_root directory (RECONCILE_SOURCE_ONLY=1)
 # and exercise the real sync/removal mechanics without root or a real
 # /usr/local. The production value is the libexec dir the apps/cli
-# commands (repo-controls, skills, hooks, settings) resolve the projected
-# payload from.
+# commands (repo-controls, hooks, settings) resolve the projected payload
+# from. az697 dropped `skills` from the libexec consumers: every skill
+# now comes from `adl skills deploy`, not from the fleet projection.
 repo_dir_libexec_root="/usr/local/libexec/adl"
 # Test-only escape hatch for default-agent-file.ts / managed-settings.ts's own
 # `--root` (both already accept it; see their headers). Unset in every real
@@ -2118,8 +2119,13 @@ run_surface_update() {
 surface_update_error_reason() {
   local output="$1" plain line
   # LC_ALL=C: the strip is bytewise. Under en_US.UTF-8 glibc resolves [@-~]
-  # by collation, so the escape's final letter would never match.
-  plain="$(LC_ALL=C sed -E $'s/\x1b\\[[0-9;]*[@-~]//g' <<<"$output")"
+  # by collation, so the escape's final letter would never match. The
+  # ANSI strip uses `tr` to delete ESC bytes first -- BSD sed on macOS has a
+  # long-standing segfault (exit 139) when fed input that contains the ESC
+  # byte directly in a $'\x1b...' pattern, so we remove the byte in a
+  # bytewise pass and let sed handle the bracketed parameter sequences that
+  # remain (which do not contain ESC).
+  plain="$(LC_ALL=C tr -d '\033' <<<"$output" | LC_ALL=C sed -E 's/\[[0-9;]*[@-~]//g')"
   local error_re='^[[:space:]]*(✖[[:space:]]*)?[eE][rR][rR][oO][rR]:' candidate
   line=""
   while IFS= read -r candidate; do
@@ -2844,9 +2850,6 @@ project_adl_package_payload() {
     fi
   done
   if [[ "$mode" != apply ]]; then
-    if [[ "$source_mode" == checkout ]]; then
-      echo "would build agent-skills payload from checkout"
-    fi
     echo "would project Adl package payload from $repo_root to /usr/local/libexec/adl and /usr/local/bin/git{,-ado}"
     if [[ "$source_mode" == npm ]]; then
       echo "would link /usr/local/bin/adl to $repo_root/bin/adl"
@@ -2855,12 +2858,6 @@ project_adl_package_payload() {
   fi
   bun_bin="$(command -v bun || true)"
   [[ -n "$bun_bin" ]] || { echo "ERROR Adl package projection requires bun on PATH" >&2; return 1; }
-  if [[ "$source_mode" == checkout ]]; then
-    (cd "$repo_root/packages/agent-skills" && "$bun_bin" run build) || {
-      echo "ERROR could not build agent-skills payload from checkout" >&2
-      return 1
-    }
-  fi
   local system_root_args=()
   if [[ -n "${RECONCILE_TEST_SYSTEM_ROOT:-}" ]]; then
     system_root_args+=(--system-root "$RECONCILE_TEST_SYSTEM_ROOT")

package/bin/setup

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# `sudo adl setup --host NAME` -- the whole onboarding of a host after
+# `sudo adl fleet setup NAME` -- the whole onboarding of a host after
 # `bun install -g @amsterdamdatalabs/adl-agent-control` (run as the device's
 # administrator):
 #
@@ -45,15 +45,15 @@ while [[ "$#" -gt 0 ]]; do
     *) echo "ERROR unknown argument: $1" >&2; exit 2 ;;
   esac
 done
-[[ -n "$host" ]] || { echo "ERROR usage: sudo adl setup --host NAME" >&2; exit 2; }
-[[ "$(id -u)" -eq 0 ]] || { echo "ERROR adl setup must run as root: sudo adl setup --host $host" >&2; exit 1; }
+[[ -n "$host" ]] || { echo "ERROR usage: sudo adl fleet setup NAME" >&2; exit 2; }
+[[ "$(id -u)" -eq 0 ]] || { echo "ERROR adl fleet setup must run as root: sudo adl fleet setup $host" >&2; exit 1; }
 
 script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
 package_dir="$(cd -- "$script_dir/.." && pwd)"
 package_dir_real="$(cd -P -- "$script_dir/.." && pwd -P)"
 # shellcheck source=lib/fleet-host.sh
 source "$script_dir/lib/fleet-host.sh"
-fleet_host_resolve "adl setup" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
+fleet_host_resolve "adl fleet setup" "$package_dir/packages/fleet/manifest.json" "$host" || exit $?
 owner="$fleet_host_owner"
 minute="$fleet_host_minute"
 
@@ -66,23 +66,23 @@ minute="$fleet_host_minute"
 source "$script_dir/lib/adl-package.sh"
 os_name="$(uname -s)"
 owner_home="$(adl_owner_home "$owner")" || {
-  echo "ERROR adl setup: cannot resolve the home directory of $owner" >&2
+  echo "ERROR adl fleet setup: cannot resolve the home directory of $owner" >&2
   exit 1
 }
 managed_dir="$(adl_platform_package_dir "$(adl_global_node_modules "$owner_home")" "$os_name" "$(uname -m)")" || exit 1
 managed_real="$(cd -P -- "$managed_dir" 2>/dev/null && pwd -P)" || managed_real=""
 if [[ -z "$managed_real" || "$package_dir_real" != "$managed_real" ]]; then
   {
-    echo "ERROR adl setup: this package ($package_dir_real) is not the package the scheduled job manages ($managed_dir)."
-    echo "ERROR adl setup: install it where the job looks, as $owner, then run setup again:"
-    echo "ERROR adl setup:   bun install -g @amsterdamdatalabs/adl-agent-control"
+    echo "ERROR adl fleet setup: this package ($package_dir_real) is not the package the scheduled job manages ($managed_dir)."
+    echo "ERROR adl fleet setup: install it where the job looks, as $owner, then run setup again:"
+    echo "ERROR adl fleet setup:   bun install -g @amsterdamdatalabs/adl-agent-control"
   } >&2
   exit 1
 fi
 
 adl_bin="$package_dir_real/bin/adl"
-[[ -x "$adl_bin" ]] || { echo "ERROR adl setup: the package adl is missing or not executable: $package_dir/bin/adl" >&2; exit 1; }
-adl_check_adl_not_shadowed "$owner" "$os_name" "$owner_home" "$package_dir_real" "adl setup" || exit 1
+[[ -x "$adl_bin" ]] || { echo "ERROR adl fleet setup: the package adl is missing or not executable: $package_dir/bin/adl" >&2; exit 1; }
+adl_check_adl_not_shadowed "$owner" "$os_name" "$owner_home" "$package_dir_real" "adl fleet setup" || exit 1
 
 if [[ -n "${ADL_SETUP_TEST_ROOT:-}" ]]; then
   system_root="${ADL_SETUP_TEST_ROOT%/}"
@@ -121,11 +121,11 @@ fi
 
 mkdir -p "$system_root/var/lib/adl" "$system_root/var/log/adl"
 
-echo "adl setup: first reconcile for $host (owner $owner)"
+echo "adl fleet setup: first reconcile for $host (owner $owner)"
 reconcile_rc=0
 "$adl_bin" reconcile --host "$host" || reconcile_rc=$?
 if [[ "$reconcile_rc" -ne 0 ]]; then
-  echo "ERROR adl setup: first reconcile failed (exit $reconcile_rc); scheduler NOT armed. Fix the failure and re-run: sudo adl setup --host $host" >&2
+  echo "ERROR adl fleet setup: first reconcile failed (exit $reconcile_rc); scheduler NOT armed. Fix the failure and re-run: sudo adl fleet setup $host" >&2
   exit "$reconcile_rc"
 fi
 
@@ -166,7 +166,7 @@ case "$fleet_host_platform" in
         sleep 0.5
       done
       [[ "$unloaded" -eq 1 ]] || {
-        echo "ERROR adl setup: com.adl.global-tools is still loaded after bootout (waited 5s); not bootstrapping. Run: sudo launchctl bootout system/com.adl.global-tools" >&2
+        echo "ERROR adl fleet setup: com.adl.global-tools is still loaded after bootout (waited 5s); not bootstrapping. Run: sudo launchctl bootout system/com.adl.global-tools" >&2
         exit 1
       }
     fi
@@ -214,7 +214,7 @@ esac
 # would keep running stale update logic if anyone invoked it.
 if [[ -e "$legacy_adl_sync" ]]; then
   rm -f -- "$legacy_adl_sync"
-  echo "adl setup: removed the legacy scheduler copy $legacy_adl_sync"
+  echo "adl fleet setup: removed the legacy scheduler copy $legacy_adl_sync"
 fi
 
-echo "adl setup: $host reconciled and armed (every 12 hours at minute $minute); run on demand with: sudo adl reconcile --host $host"
+echo "adl fleet setup: $host reconciled and armed (every 12 hours at minute $minute); run on demand with: sudo adl reconcile --host $host"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.37",
+  "version": "0.1.47",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/package.json

@@ -8,7 +8,7 @@
     "start": "bun src/main.ts",
     "build": "bun ../../workflows/scripts/build/agent-hooks/build.ts",
     "typecheck": "tsc --noEmit",
-    "test": "bun test --coverage --timeout 30000",
+    "test": "bun test --isolate --coverage --timeout 30000",
     "check": "bun run typecheck && bun test --coverage"
   },
   "dependencies": {

package/packages/agent-hooks/src/main.ts

@@ -26,6 +26,11 @@
  *     silent no-op (exit 0, empty stdout/stderr).
  *   - `adl-config.toml` present but fails to parse/decode: fail
  *     loud (non-zero exit, reason on stderr) — never silently ignored.
+ *     `pre-tool-use` exits at FAIL_CLOSED_EXIT_CODE (2); every other
+ *     kind exits at the non-blocking NON_BLOCKING_FAIL_EXIT_CODE (1),
+ *     matching the host-resolution and invalid-JSON-on-stdin branches
+ *     above and avoiding the Claude Code/Codex `UserPromptSubmit`
+ *     erase-on-exit-2 behaviour (this file's header, work item D).
  *   - `[hooks] enabled = false`: silent no-op, same as unmanaged.
  *
  * Every other hook kind is dispatched through the shared `HookHandler` shape
@@ -202,13 +207,29 @@ export async function run(argv: readonly string[], adlVersion?: string): Promise
 
   let config: AdlRepoConfig
   {
-    const text = readFileSync(managed.configPath, 'utf8')
+    let text: string
+    try {
+      text = readFileSync(managed.configPath, 'utf8')
+    } catch (error) {
+      // The readFileSync race: `resolveManagedRepo` confirmed the marker
+      // exists a moment ago, but the file was unlinked, perm-removed, or
+      // became unreadable before we opened it. Same kind-conditional
+      // exit-code split as the JSON-stdin branch above and az385's
+      // host-resolution branch: pre-tool-use fails CLOSED (refuse the
+      // dangerous action), every other kind fails at the non-blocking
+      // exit 1 so a Claude Code `UserPromptSubmit` or an advisory
+      // `briefing` is never erased.
+      process.stderr.write(
+        `adl hook: cannot read ${managed.configPath}: ${String(error)}\n`,
+      )
+      return kind === 'pre-tool-use' ? FAIL_CLOSED_EXIT_CODE : NON_BLOCKING_FAIL_EXIT_CODE
+    }
     const decoded = decodeConfig(text)
     if (!decoded.ok) {
       process.stderr.write(
         `adl hook: ${describeConfigIssue(managed.configPath, decoded.issue)}\n`,
       )
-      return 1
+      return kind === 'pre-tool-use' ? FAIL_CLOSED_EXIT_CODE : NON_BLOCKING_FAIL_EXIT_CODE
     }
     config = decoded.value
   }

package/packages/agent-hooks/src/rules/impl/adl-mcp-cli.ts

@@ -10,13 +10,14 @@
  * `adl mcp cli pr-review --vote reject ...` reaches Azure DevOps exactly the
  * way `mcp__azdo__pr_review` does, and must be denied the same way.
  *
- * Scoped to the four commands this package's role rules actually gate —
- * `workitem-create-or-update`, `pr-create-or-update`, `pr-review`,
+ * Scoped to the commands this package's role rules actually gate —
+ * `workitem-create-or-update-feature`/`-pbi`/`-bug` (one command per MCP
+ * tool), `pr-create-or-update`, `pr-review`,
  * `build-run` — not a general reimplementation of the whole CLI surface
  * (`packages/azdo/src/cli.ts`'s `commands` table), which belongs to
  * `packages/azdo`, outside this package's write scope. The flag → input-key
  * mapping below is copied from that table (re-checked 2026-09-28) for
- * exactly these four entries; if `cli.ts`'s flags for one of them change,
+ * exactly these entries; if `cli.ts`'s flags for one of them change,
  * this table needs a matching update — there is no cross-package import that
  * would keep the two in sync automatically without also pulling in
  * `tool-dispatch.ts` and everything it depends on.
@@ -59,12 +60,15 @@ interface GatedCommand {
  * `--delete-source-branch` (`isPrCompletionCall`, pr-completion.ts),
  * `pr-review`'s `--comment`/`--vote`/`--target-branch`
  * (`adl-pr-review-role.ts`), and `build-run`'s `--id`/`--branch`
- * (`adl.build-run-role`). `workitem-create-or-update` is graded on identity
- * alone — no input field changes its outcome — so its flag list is empty;
+ * (`adl.build-run-role`). The three `workitem-create-or-update-*` commands
+ * are graded on identity
+ * alone — no input field changes its outcome — so their flag lists are empty;
  * every command still needs an entry here so it is RECOGNIZED at all.
  */
 const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
-  'workitem-create-or-update': { tool: 'workitem_create_or_update', flags: [] },
+  'workitem-create-or-update-feature': { tool: 'workitem_create_or_update_feature', flags: [] },
+  'workitem-create-or-update-pbi': { tool: 'workitem_create_or_update_pbi', flags: [] },
+  'workitem-create-or-update-bug': { tool: 'workitem_create_or_update_bug', flags: [] },
   'pr-create-or-update': {
     tool: 'pr_create_or_update',
     flags: [
@@ -96,7 +100,7 @@ const GATED_COMMANDS: Readonly<Record<string, GatedCommand>> = {
  * `adl`/`adl.exe mcp cli <command> [--flag value|--boolean-flag ...]` → the
  * MCP tool call it is equivalent to, or `null` when `inv` is not this shape,
  * any of the first three words is dynamic, or `<command>` is not one of the
- * four gated commands. A `--flag`'s value is read only when the flag is
+ * six gated commands. A `--flag`'s value is read only when the flag is
  * known for that specific command (an unrecognized flag is ignored, not an
  * error — this is a read for GRADING, not the CLI's own arg parser, which
  * would reject an unknown flag itself before any tool call happens) and the
@@ -162,7 +166,7 @@ export function toolCallFor(inv: Invocation): AdlMcpCliCall | null {
  * `ADL_AGENT_ID_AGENT=` override on the very piece being graded wins. Grading
  * the session identity alone would be wrong in both directions: a reviewer
  * session's own inline `agent-tarun` override on
- * `adl mcp cli workitem-create-or-update` would be denied as `agent-reviewer`
+ * `adl mcp cli workitem-create-or-update-bug` would be denied as `agent-reviewer`
  * (a false deny), and — the more dangerous direction — an `agent-tarun`
  * SESSION with an inline `ADL_AGENT_ID_AGENT=agent-reviewer` override would be
  * graded as `agent-tarun` (a false ALLOW: the piece that will actually run is

package/packages/agent-hooks/src/rules/impl/adl-run-required.ts

@@ -58,9 +58,12 @@
  *    request-item/`--form`/`--raw` implying a body (httpie's own semantics:
  *    a request with data defaults to POST, one without defaults to GET).
  *  - An Azure DevOps MCP write tool (the `'tool-call'` kind), named
- *    `mcp__<prefix>__<tool>` where `<tool>` is one of the four mutating
+ *    `mcp__<prefix>__<tool>` where `<tool>` is one of the six mutating
  *    tools `packages/azdo/src/mcp-server.ts` actually registers:
- *    `pr_create_or_update`, `pr_review`, `build_run`, `workitem_create_or_update`. The
+ *    `pr_create_or_update`, `pr_review`, `build_run`, and the three
+ *    `workitem_create_or_update_feature`/`_pbi`/`_bug` (the tool NAME carries
+ *    the work-item type, so there is no blanket `workitem_create_or_update`
+ *    tool any more). The
  *    match is on the TOOL NAME alone, not the server prefix — the package is
  *    `azdo`, P4 folds the server under `adl`, and Claude Code's plugin-scoped
  *    form (`mcp__plugin_<plugin>_<server>__<tool>`) adds a third spelling —
@@ -165,7 +168,8 @@ const HTTP_CLIENT_NAMES = HTTP_CLIENT_BINARY_NAMES
  * `ListToolsRequestSchema` handler (re-checked 2026-10-01) — the
  * complete tool roster there is `pr_list_or_get`/`pr_create_or_update`/
  * `pr_review`, `build_list_or_get`/`build_run`, `workitem_list_or_get`/
- * `workitem_create_or_update`; the three not in this set are the read half.
+ * `workitem_create_or_update_feature`/`_pbi`/`_bug`; the three not in this
+ * set are the read half.
  * `pr_review` (docs/operations/agent-permissions.md rows 6-8: comment + vote) is
  * in this set because `adl-pr-review-role.ts` gates it by role —
  * a caller with no run identity at all must be denied here FIRST, the
@@ -176,7 +180,9 @@ const ADO_MCP_WRITE_TOOLS: ReadonlySet<string> = new Set([
   'pr_create_or_update',
   'pr_review',
   'build_run',
-  'workitem_create_or_update',
+  'workitem_create_or_update_feature',
+  'workitem_create_or_update_pbi',
+  'workitem_create_or_update_bug',
 ])
 
 /**
@@ -184,7 +190,7 @@ const ADO_MCP_WRITE_TOOLS: ReadonlySet<string> = new Set([
  * DevOps MCP tool call, reads included — the read half gets no
  * pass just because it cannot mutate anything. `mcp-server.ts`'s complete
  * roster: `pr_list_or_get`, `build_list_or_get`, `workitem_list_or_get`
- * (reads) alongside the four writes above.
+ * (reads) alongside the six writes above.
  */
 /** The leading words of the `identityBearingReason` for an Azure DevOps MCP tool call — `message()` keys the MCP-only CLI advice off it. */
 const MCP_REASON_PREFIX = 'Azure DevOps MCP tool'

package/packages/agent-hooks/src/rules/impl/adl-workitem-role.ts

@@ -27,20 +27,33 @@ import { effectiveIdentityForMcpCli, toolCallFor } from './adl-mcp-cli.ts'
 
 const RULE_ID = 'adl.workitem-requires-tarun-or-vivek'
 
+/**
+ * The work-item write tools this rule grades — the three per-type siblings the
+ * MCP server registers (the old single `workitem_create_or_update` tool is
+ * gone; the tool NAME is the type, so there is no `type` argument to inspect).
+ * A name outside this set is not a work-item write at all and is left to
+ * `adl.run-required-for-writes`/`adl-pr-role.ts`.
+ */
+const WORKITEM_WRITE_TOOLS: ReadonlySet<string> = new Set([
+  'workitem_create_or_update_feature',
+  'workitem_create_or_update_pbi',
+  'workitem_create_or_update_bug',
+])
+
 export const adlWorkitemRequiresTarunOrVivek: RuleSpec = {
   id: RULE_ID,
   category: 'tool-call',
   severity: 'deny',
   enabledByDefault: true,
-  summary: 'Deny workitem_create_or_update for agent-reviewer (docs/operations/agent-permissions.md row 10) — the MCP tool AND its adl mcp cli equivalent.',
+  summary: 'Deny the workitem_create_or_update_* tools for agent-reviewer (docs/operations/agent-permissions.md row 10) — the MCP tools AND their adl mcp cli equivalents.',
   params: noParams,
   match(inv: Invocation, ctx: RuleContext<Record<string, never>>): Finding | null {
-    // `adl mcp cli
-    // workitem-create-or-update` dispatches to the same tool the MCP server
-    // calls — graded identically, not only the tool-call payload shape.
+    // `adl mcp cli workitem-create-or-update-feature`/`-pbi`/`-bug` dispatch to
+    // the same tools the MCP server calls — graded identically, not only the
+    // tool-call payload shape.
     const call = toolCallFor(inv)
     if (call === null) return null
-    if (mcpToolName(call.tool) !== 'workitem_create_or_update') return null
+    if (!WORKITEM_WRITE_TOOLS.has(mcpToolName(call.tool) ?? '')) return null
 
     // Grade the EFFECTIVE identity for THIS specific piece — a valid inline
     // `ADL_AGENT_ID_AGENT=` override on the same `adl mcp cli` invocation

package/packages/agent-hooks/src/rules/impl/agent-tamper-protection.ts

@@ -2,22 +2,25 @@
  * Editing the files that wire the host's hooks.
  *
  * Handoff 5, rule 5: deny Write/Edit/MultiEdit/NotebookEdit on
- * `.claude/settings.json`, `.claude/settings.local.json`,
- * `.codex/config.toml`, or `adl-config.toml`. These are the files that
- * install the hook into the host (including the `.local.json` overrides)
- * or that the running hook reads on every call — editing any of them is a
- * way to switch the gate off without anyone noticing.
+ * `.claude/settings.json`, `.claude/settings.local.json`, and
+ * `.codex/config.toml`. These are the files that install the hook into
+ * the host (including the `.local.json` overrides) — editing any of them
+ * is a way to switch the gate off without anyone noticing.
  *
- * `adl-config.toml` left the list on 2026-10-01 (Tarun: "nobody should
- * stop editing adl-config.toml") and rejoined it on 2026-10-12, after a
- * review-of-the-door confirmed the gap: every hook run re-reads it, so
- * `[hooks] enabled = false` (a silent no-op, `main.ts`'s `runHook`) or a
- * `[rules."<id>"] enabled = false` takes effect on the agent's next tool
- * call, ahead of any commit. The commit-time layers
- * (`git.protected-tree-commit`, repo-controls' integrity gate) fire on the
- * COMMITTED file, not on the working-tree copy that the running hook
- * reads. The carriers on the list below are only as strong as that file,
- * since it can also switch THIS rule off.
+ * `adl-config.toml` is NOT in this set. The earlier 2026-10-12 ruling
+ * ("we left a door open, close it") assumed the working-tree copy is what
+ * every running hook reads and that an agent writing
+ * `[hooks] enabled = false` flips the gate off ahead of any commit. The
+ * commit side IS enforced — repo-controls' `integrity.ts` (`WIRING`,
+ * refuses a normal commit of `adl-config.toml`) and `agent-hooks`'s
+ * `git.protected-tree-commit` rule (PBI 373/679) — and the working-tree
+ * edit is a runtime-config edit, not a carrier rewrite. The design
+ * ("agents may edit [WIRING] while preparing a reviewed change, but a
+ * normal commit must never land them" — integrity.ts:5-7) places the
+ * edit on the allowed side and the commit on the denied side.
+ * Re-confirmed 2026-10-13 (Tarun: "adl-config.toml can be editted but
+ * not committed by the agents"). `adl-config.toml` is a config file,
+ * not a hook carrier.
  *
  * Hooks are local-repo-first (Tarun, 2026-09-29): there is no managed-hooks
  * lock and no global carrier, so these per-repo carrier files are the ONLY
@@ -478,20 +481,21 @@ export const agentTamperProtection: RuleSpec = {
           : via === 'interpreter'
             ? 'an interpreter one-liner writing'
             : 'editing'
+    const listed = [...PROTECTED_CARRIER_PATHS]
+      .map((p) => '`' + p + '`')
+      .join(', ')
     return {
       user: `Blocked ${via === 'tool-call' ? 'editing' : verb} ${path}. This file wires the host's hooks; ask the user to change it.`,
       agent:
-        `DENIED ${verb} ${path}. This file is one of the tamper-protected files: ` +
-        '`.claude/settings.json`, `.claude/settings.local.json`, `.codex/config.toml`, ' +
-        '`.codex/hooks.json`, `.cursor/hooks.json`, `.opencode/plugins/adl-repo.ts`, ' +
-        "or `~/.kimi-code/config.toml`. Each installs or overrides a host's own hook contract " +
-        "(directly, or — for `.opencode/plugins/adl-repo.ts` — as the generated plugin THAT IS " +
-        "the carrier; `~/.kimi-code/config.toml` is Kimi's own single, globally-installed " +
-        'carrier — Kimi has no per-repo one). Editing, overwriting, moving over, truncating, ' +
-        'deleting, or rewriting any of them — by a tool call, a shell write, or a git checkout/ ' +
-        'restore/reset/rm — is a way to switch the gate off without anyone noticing, the ONLY ' +
-        'enforcement layer for the hosts that read them (there is no managed-hooks lock). ' +
-        `If a legitimate change is needed, file a PR or ask the user to make it themselves. ` +
+        `DENIED ${verb} ${path}. This file is one of the tamper-protected files: ${listed}. ` +
+        'Each installs or overrides a host\'s own hook contract. Editing, overwriting, moving ' +
+        'over, truncating, deleting, or rewriting any of them — by a tool call, a shell write, ' +
+        'or a git checkout/restore/reset/rm — is a way to switch the gate off without anyone ' +
+        'noticing, the ONLY enforcement layer for the hosts that read them (there is no ' +
+        'managed-hooks lock). `adl-config.toml` is intentionally NOT in this list: it is a ' +
+        'runtime config file an agent may edit; the commit is denied by `git.protected-tree-' +
+        'commit` and by repo-controls\' `integrity.ts` (PBI 373/679). If a legitimate change ' +
+        `to a host carrier is needed, file a PR or ask the user to make it themselves. ` +
         `Blocked call: ${ctx.snippet}`,
     }
   },

package/packages/agent-hooks/src/rules/impl/git-branch.ts

@@ -7,7 +7,7 @@ import { branchMutates, isHelpOnlyInvocation, isSequencerRecoveryOnly, switchChe
 import { LANDING_SUBCOMMANDS, resolveGitTarget } from './git-target.ts'
 import { gitAgentTail } from './messages.ts'
 
-const ASK_USER = 'ask the user for git branch operations'
+const ASK_USER = 'you are enforced to commit and push to the same branch, branches are not agent\'s choice. treat them as given and continue on the same branch without stopping'
 
 const UNRESOLVED =
   'The commit target (which repository and branch this would land on) could not be determined statically from this command line. ' +

package/packages/agent-hooks/src/rules/impl/git-target.ts

@@ -209,6 +209,7 @@ function heredocDelimiters(piece: string): string[] | 'unparsable' {
       for (; i < piece.length && !/[\s;|&<>()]/.test(piece[i] as string); i++) {
         sawWord = true
         const c = piece[i] as string
+        /* istanbul ignore next -- splitShell() only yields a valid (non-`invalid`) result when its trailing `escape` flag is clear, and it clears that flag by consuming the escaped character; so a valid piece can never END on a lone `\`, it can only end on the SECOND half of a `\\` pair, which this scan reaches as `c` and steps over with a defined `piece[++i]`. Exhaustively checked: 15,867,149 valid commands over the 18-symbol quote/separator alphabet produced zero pieces ending in a lone backslash. */
         if (c === '\\') word += piece[++i] ?? ''
         else if (c === "'" || c === '"') {
           const close = piece.indexOf(c, i + 1)
@@ -240,6 +241,7 @@ function parse(command: string): Parsed | null | 'closed' {
   let cursor = 0
   for (const piece of split.pieces) {
     const at = command.indexOf(piece, cursor)
+    /* istanbul ignore next -- every piece splitShell() returns is an ordered, non-overlapping substring of the very `command` it was split from, so `indexOf(piece, cursor)` always finds it at or after `cursor`; `at < 0` would require splitShell() to emit a piece that is not in its input. Exhaustively checked: 958,762 valid commands over the 18-symbol quote/separator alphabet produced zero such pieces. */
     if (at < 0) return { tokens, gaps: null, functions }
     gaps.push(command.slice(cursor, at))
     cursor = at + piece.length
@@ -342,9 +344,11 @@ function applyState(parsed: Parsed, until: number, target: Mutable): boolean {
       if (state.names.includes('GIT_WORK_TREE')) delete target.workTree
       continue
     }
+    /* istanbul ignore next -- `gaps` is null on exactly one path, parse()'s `at < 0` return above, which is itself unreachable because splitShell() only emits ordered non-overlapping substrings of `command`. Every other parse() result carries a populated `gaps`, so this re-check is the fail-closed half of that invariant rather than a reachable state. */
     if (parsed.gaps === null) return false
     const before = plainGap(parsed.gaps[i] as string)
     if (before === null) return false
+    /* istanbul ignore next -- `parsed.tokens[i - 1]` is null only for a here-doc BODY, and parse() sets `gaps[body] = '\n'` for every such nulled index; bodies are newline-separated, so the gap at the next index is that same `'\n'`, never `'&&'`. `before === '&&'` therefore short-circuits before this line reads `tokens[i - 1]`, so the `?? null` fallback is unreachable. */
     if (before === '&&' && (i === 0 || !['cd', 'export'].includes(classify(parsed.tokens[i - 1] ?? null, parsed.functions).kind))) return false
     for (let j = i + 1; j <= Math.min(until, parsed.gaps.length - 1); j++) if (plainGap(parsed.gaps[j] as string) === null) return false
     if (state.kind === 'cd') {
@@ -406,6 +410,7 @@ function walk(command: string, inv: Invocation & { kind: 'git' }, inherited: Mut
     if (inner === undefined) continue
     if (inner === null || !applyState(parsed, i, target)) return null
     const nested = walk(script, inv, target)
+    /* istanbul ignore next -- `inner` and `nested` are the SAME walk over the SAME script and invocation, differing only in the inherited `dirs`/`gitDir`/`workTree`; no branch inside walk() reads those to choose null or undefined (only `homeUnknown` gates expandPath, and applyState above never sets it). Since `inner` was already a non-null target here, so is `nested`, and the fallback is unreachable. Fuzzed: 6.6M generated shell/-c command pairs produced no case where it fires. */
     return nested ?? null
   }
   return undefined

package/packages/agent-hooks/src/rules/impl/mcp-tool.ts

@@ -11,7 +11,9 @@ export const KNOWN_MCP_TOOL_NAMES: ReadonlySet<string> = new Set([
   'build_list_or_get',
   'build_run',
   'workitem_list_or_get',
-  'workitem_create_or_update',
+  'workitem_create_or_update_feature',
+  'workitem_create_or_update_pbi',
+  'workitem_create_or_update_bug',
 ])
 
 /**