@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.4

package/packages/agent-hooks/src/rules/impl/git-plumbing.ts

@@ -0,0 +1,167 @@
+/**
+ * Ref / index / object plumbing that rewrites repository state directly.
+ *
+ * Added after an incident: an agent whose `git rebase --abort` was (wrongly)
+ * denied rebuilt the branch by hand — `git update-ref`, `git symbolic-ref`,
+ * `git read-tree HEAD`, plus trashing `.git/rebase-merge` (see
+ * fs-git-internals.ts). None of that was denied, and all of it bypasses the
+ * porcelain's own safety checks: no reflog-aware recovery, no conflict
+ * handling, no "you have uncommitted changes" refusal. Each rule allows the
+ * subcommand's genuinely read-only or dry-run forms and denies the rest.
+ *
+ * `git update-ref` replaces the delete-only `git.update-ref-delete` (HARDCUT):
+ * pointing a branch at an arbitrary object loses work exactly as surely as
+ * deleting it does.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import { type Token, tokenValue } from '../shell/token.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { hasFlag, hasFlagOrCluster, isHelpOnlyInvocation } from './git-helpers.ts'
+import { defaultGitMessage, detailString } from './messages.ts'
+
+type GitInvocation = Invocation & { kind: 'git' }
+
+function plumbingRule(spec: {
+  readonly id: string
+  readonly subcommand: string
+  readonly summary: string
+  readonly reason: string
+  readonly hits: (rest: readonly Token[]) => boolean
+  readonly deny: readonly string[]
+  readonly allow: readonly string[]
+}): RuleSpec {
+  return {
+    id: spec.id,
+    category: 'git',
+    severity: 'deny',
+    enabledByDefault: true,
+    summary: spec.summary,
+    params: noParams,
+    match(inv): Finding | null {
+      if (inv.kind !== 'git') return null
+      const g: GitInvocation = inv
+      if (g.subcommand !== spec.subcommand) return null
+      if (isHelpOnlyInvocation(g.rest)) return null
+      if (!spec.hits(g.rest)) return null
+      return { ruleId: spec.id, severity: 'deny', detail: { reason: spec.reason } }
+    },
+    message(finding: Finding, ctx: MessageContext) {
+      return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+    },
+    corpus: { deny: spec.deny, allow: spec.allow },
+  }
+}
+
+/** Non-option arguments (everything after `--` counts). */
+function positionals(rest: readonly Token[]): readonly string[] {
+  const found: string[] = []
+  for (let index = 0; index < rest.length; index += 1) {
+    const value = tokenValue(rest[index] as Token)
+    if (value === '--') {
+      found.push(...rest.slice(index + 1).map(tokenValue))
+      break
+    }
+    if (value.startsWith('-')) continue
+    found.push(value)
+  }
+  return found
+}
+
+const isDryRun = (rest: readonly Token[]): boolean => hasFlagOrCluster(rest, ['--dry-run'], ['n'])
+
+export const gitUpdateRef = plumbingRule({
+  id: 'git.update-ref',
+  subcommand: 'update-ref',
+  summary: 'Deny git update-ref in every form (set, -d/--delete, --stdin).',
+  reason: 'git update-ref',
+  hits: () => true,
+  deny: [
+    'git update-ref refs/heads/x HEAD',
+    'git update-ref -d refs/heads/x',
+    'git update-ref --delete refs/heads/x',
+    'git update-ref --stdin',
+    'git -C sub update-ref refs/heads/x HEAD',
+    'GIT_DIR=x git update-ref refs/heads/x HEAD',
+    // A here-string fed to a shell is the script it runs.
+    "bash <<< 'git update-ref -d refs/heads/main'",
+  ],
+  allow: ['git update-ref --help', 'git show-ref', "cat <<< 'git update-ref -d refs/heads/main'"],
+})
+
+export const gitSymbolicRefWrite = plumbingRule({
+  id: 'git.symbolic-ref-write',
+  subcommand: 'symbolic-ref',
+  summary: 'Deny git symbolic-ref write forms (<name> <ref>, -d/--delete); the one-argument read form is allowed.',
+  reason: 'git symbolic-ref (write)',
+  hits: (rest) => hasFlagOrCluster(rest, ['--delete'], ['d']) || hasFlag(rest, '-m') || positionals(rest).length >= 2,
+  deny: [
+    'git symbolic-ref HEAD refs/heads/main',
+    'git symbolic-ref -m rescue HEAD refs/heads/main',
+    'git symbolic-ref -d HEAD',
+    'git symbolic-ref --delete HEAD',
+  ],
+  allow: ['git symbolic-ref HEAD', 'git symbolic-ref --short HEAD', 'git symbolic-ref -q HEAD'],
+})
+
+export const gitReadTree = plumbingRule({
+  id: 'git.read-tree',
+  subcommand: 'read-tree',
+  summary: 'Deny git read-tree unless it is a -n/--dry-run.',
+  reason: 'git read-tree',
+  hits: (rest) => !isDryRun(rest),
+  deny: ['git read-tree HEAD', 'git read-tree -m -u HEAD', 'git read-tree --reset -u HEAD', 'git read-tree --empty'],
+  allow: ['git read-tree -n HEAD', 'git read-tree --dry-run -m HEAD main'],
+})
+
+const REPLACE_WRITE_FLAGS = ['--delete', '--force', '--edit', '--graft', '--convert-graft-file']
+
+export const gitReplace = plumbingRule({
+  id: 'git.replace',
+  subcommand: 'replace',
+  summary: 'Deny git replace except its listing forms (no arguments, -l/--list, --format).',
+  reason: 'git replace',
+  hits: (rest) => {
+    if (hasFlagOrCluster(rest, REPLACE_WRITE_FLAGS, ['d', 'f', 'e'])) return true
+    if (hasFlag(rest, '-l', '--list')) return false
+    return positionals(rest).length > 0
+  },
+  deny: ['git replace HEAD~1 HEAD', 'git replace -d abc123', 'git replace --edit HEAD', 'git replace --graft HEAD HEAD~2'],
+  allow: ['git replace', 'git replace -l', 'git replace --list'],
+})
+
+export const gitFilterRepo = plumbingRule({
+  id: 'git.filter-repo',
+  subcommand: 'filter-repo',
+  summary: 'Deny git filter-repo outright.',
+  reason: 'git filter-repo',
+  hits: () => true,
+  deny: ['git filter-repo --path src', 'git filter-repo --invert-paths --path secrets.txt --force'],
+  allow: ['git filter-repo --help'],
+})
+
+const REFLOG_REWRITE_ACTIONS = new Set(['expire', 'delete'])
+
+export const gitReflogRewrite = plumbingRule({
+  id: 'git.reflog-rewrite',
+  subcommand: 'reflog',
+  summary: 'Deny git reflog expire/delete; show/list/exists are read-only.',
+  reason: 'git reflog expire/delete',
+  hits: (rest) => {
+    const first = rest.find((token) => !tokenValue(token).startsWith('-'))
+    return first !== undefined && REFLOG_REWRITE_ACTIONS.has(tokenValue(first))
+  },
+  deny: ['git reflog expire --expire=now --all', 'git reflog delete HEAD@{1}'],
+  allow: ['git reflog', 'git reflog show feat', 'git reflog exists refs/heads/main'],
+})
+
+export const gitPrune = plumbingRule({
+  id: 'git.prune',
+  subcommand: 'prune',
+  summary: 'Deny git prune unless it is a -n/--dry-run.',
+  reason: 'git prune',
+  hits: (rest) => !isDryRun(rest),
+  deny: ['git prune', 'git prune --expire=now'],
+  allow: ['git prune -n', 'git prune --dry-run'],
+})

package/packages/agent-hooks/src/rules/impl/git-protected-tree.ts

@@ -0,0 +1,132 @@
+/**
+ * `git commit` touching a protected tree.
+ *
+ * Ported from `protectedPathsInCommit` / `protectedCommitReason` in
+ * git-rules.mjs:57-102 and blocked-reason.mjs:61-68. The original shelled
+ * out to `git diff --cached --name-only` (and, for `commit -a`, `git diff
+ * --name-only`) directly from a `utils/` module; here that read goes through
+ * `ctx.index: RepoIndexPort` (kernel/ports/index.ts), so the test suite runs
+ * it against a real repository instead of mocking it — see
+ * rules-git-protected-tree.test.ts, which is the first test in this port
+ * that actually exercises the "staged, not named on the command line"
+ * branch. The self-test corpus below all names paths explicitly on the
+ * command line (checkIndex=false in the original), which is exactly the
+ * branch that had zero coverage there.
+ */
+
+import { tokenValue } from '../shell/token.ts'
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { detailString, gitAgentTail, protectedTreesText } from './messages.ts'
+
+function git(inv: Invocation): (Invocation & { kind: 'git' }) | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+const isProtectedPath = (path: string, protectedTrees: readonly string[]): boolean =>
+  protectedTrees.some((tree) => path.startsWith(tree))
+
+/** Fail-closed sentinel for "the index could not be read" — git-rules.mjs:99. */
+const REFUSAL = '<could not read the index; refusing to guess>'
+
+export const gitProtectedTreeCommit: RuleSpec = {
+  id: 'git.protected-tree-commit',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny a git commit that touches a protected tree, explicitly or staged.',
+  params: noParams,
+  match(inv, ctx: RuleContext<Record<string, never>>): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'commit') return null
+    // NOT gated by isHelpOnlyInvocation, unlike the "core" git rules — this
+    // matches blocked-reason.mjs's blockedGitPolicyReason exactly, which is
+    // never passed through the rmIsHelpOnly bypass that blockedGitCoreReason
+    // applies. Ported as-is rather than "fixed": a `git commit --help` with
+    // paths already staged under a protected tree would deny in the
+    // original too, since protectedPathsInCommit consults the real index
+    // regardless of `rest`.
+
+    const protectedTrees = ctx.repo.commitProtectedTrees
+    const hit = new Set<string>()
+    for (const token of g.rest) {
+      const value = tokenValue(token)
+      if (!value || value.startsWith('-')) continue
+      const normalized = value.replace(/^\.\//, '')
+      if (isProtectedPath(normalized, protectedTrees)) hit.add(normalized)
+    }
+
+    const refused = (): Finding => ({
+      ruleId: 'git.protected-tree-commit',
+      severity: 'deny',
+      detail: { landed: [REFUSAL], protectedTreesText: protectedTreesText(protectedTrees) },
+    })
+
+    const staged = ctx.index.stagedPaths()
+    if (staged === null) return refused()
+    for (const path of staged) if (isProtectedPath(path, protectedTrees)) hit.add(path)
+
+    const stagesTracked = g.rest.some((token) => {
+      const value = tokenValue(token)
+      return value === '-a' || value === '--all' || /^-[a-zA-Z]*a[a-zA-Z]*$/.test(value)
+    })
+    if (stagesTracked) {
+      const trackedModified = ctx.index.trackedModifiedPaths()
+      if (trackedModified === null) return refused()
+      for (const path of trackedModified) if (isProtectedPath(path, protectedTrees)) hit.add(path)
+    }
+
+    if (hit.size === 0) return null
+    return {
+      ruleId: 'git.protected-tree-commit',
+      severity: 'deny',
+      detail: { landed: [...hit], protectedTreesText: protectedTreesText(protectedTrees) },
+    }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const landed = finding.detail['landed']
+    const list = Array.isArray(landed) ? (landed as readonly string[]) : []
+    const shown = list.slice(0, 6)
+    // Matches blocked-reason.mjs:65-67 + deny.mjs:132: the log-facing reason
+    // string joins overflow with a comma, then the agent message re-splits
+    // on comma and rejoins with '\n  ' — so the "+N more" suffix lands on
+    // its own indented line, same as every other path.
+    const more = list.length > 6 ? `\n  +${list.length - 6} more` : ''
+    const protectedText = detailString(finding, 'protectedTreesText')
+    return {
+      user:
+        `Blocked an agent commit touching a protected tree (${protectedText}). These hold the gates, this ` +
+        'hook, and the deployed surface; review and commit them yourself.',
+      agent:
+        `DENIED committing a protected tree (${protectedText}). These hold the gates, this hook itself, and the compliance-load-bearing deployment surface - profile ` +
+        'rows, exception catalogs, ratchet floors, git hooks, and the reusable scanners - so a commit here ' +
+        'can widen an exception or disarm a hook in the same change whose gates were meant to catch it.\n' +
+        'You MAY keep editing these files; only landing them needs a human.\n' +
+        'Staged under a protected tree:\n  ' +
+        shown.join('\n  ') +
+        more +
+        '\nDo this instead: leave the edits in place, summarise them for the user, and ask them to review ' +
+        'and commit. To commit your OTHER work now, unstage just these paths ' +
+        `(git restore --staged <path>) and commit the rest. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'git commit -m x adl-config.toml',
+      // `./` is normalised away before the protected-tree prefix check.
+      'git commit -m x ./adl-config.toml',
+    ],
+    allow: [
+      "git commit -m 'feat(x): y'",
+      // No longer default-protected (owner decision 2026-09-15); the mechanism
+      // still protects them for a repo that opts in via `[repo] protectedTrees`.
+      'git commit -m x .agents/hooks/pre-tool-use.mjs',
+      'git commit -m x .code-quality/scripts/scan.sh',
+      'git commit -- workflows/config/profiles/gate-profiles.yaml',
+      'git commit -m x docker/Dockerfile',
+      'git commit -m x infra/main.tf',
+      'git commit -m x dev/up-hot.sh',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/git-transitions.ts

@@ -0,0 +1,292 @@
+/**
+ * `git stash`, `clean`, `rebase`, `filter-branch`, `restore`, `reset`,
+ * `update-index` — subcommands that rewrite or discard working-tree state.
+ *
+ * Ported from `blockedGitTransitionReason` in blocked-reason.mjs:31-42. Each
+ * shares the `rmIsHelpOnly` bypass with the other "core" git rules (a
+ * `--help`/`--version`-only invocation prints text and changes nothing), and
+ * each falls through `classifyReason`'s `default:` arm in the original, so
+ * they all use `defaultGitMessage`.
+ */
+
+import { type Token, tokenValue } from '../shell/token.ts'
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { isHelpOnlyInvocation, isSequencerRecoveryOnly, resetIsPathspecOnly, restoreIsStagedOnly, updateIndexIsUnstageOnly } from './git-helpers.ts'
+import { defaultGitMessage, detailString } from './messages.ts'
+
+function git(inv: Invocation): (Invocation & { kind: 'git' }) | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+const STASH_READONLY = new Set(['list', 'show'])
+
+export const gitStash: RuleSpec = {
+  id: 'git.stash',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny every git stash action except list/show.',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'stash') return null
+    if (isHelpOnlyInvocation(g.rest)) return null
+    const first = g.rest[0]
+    const action = first ? tokenValue(first).toLowerCase() : 'push'
+    if (STASH_READONLY.has(action.replace(/^-+/, ''))) return null
+    return { ruleId: 'git.stash', severity: 'deny', detail: { reason: `git stash ${action}`.trimEnd() } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+  },
+  corpus: {
+    deny: [
+      'git stash',
+      'git stash push -u',
+      'git stash pop',
+      'git stash apply',
+      'git stash drop',
+      'git stash clear',
+      "bash -lc 'git stash pop'",
+    ],
+    allow: ['git stash list', 'git stash show -p', 'git stash --help'],
+  },
+}
+
+/**
+ * `blockedGitTransitionReason`'s `BLOCKED_GIT` set (constants.mjs:5) held
+ * clean/rebase/filter-branch together as one JS `Set.has` check; ported as
+ * three separate rules (one per subcommand) rather than one rule matching
+ * three subcommands, so each has its own id, corpus, and independent
+ * enable/disable switch in config — matching the brief's count of 21
+ * distinct git rules rather than 19.
+ */
+function transitionRule(
+  id: string,
+  subcommand: string,
+  deny: readonly string[],
+  allow: readonly string[],
+  exempt: (rest: readonly Token[]) => boolean = () => false,
+): RuleSpec {
+  return {
+    id,
+    category: 'git',
+    severity: 'deny',
+    enabledByDefault: true,
+    summary: `Deny git ${subcommand} outright.`,
+    params: noParams,
+    match(inv): Finding | null {
+      const g = git(inv)
+      if (!g || g.subcommand !== subcommand) return null
+      if (isHelpOnlyInvocation(g.rest)) return null
+      if (exempt(g.rest)) return null
+      return { ruleId: id, severity: 'deny', detail: { reason: `git ${subcommand}` } }
+    },
+    message(finding: Finding, ctx: MessageContext) {
+      return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+    },
+    corpus: { deny, allow },
+  }
+}
+
+export const gitClean = transitionRule(
+  'git.clean',
+  'clean',
+  [
+    'git clean -fd',
+    // `{ ... }` group braces are dropped as boundaries by splitShell, same
+    // as bare parens — the wrapped command is denied on its own merits.
+    '{ git clean -fd; }',
+  ],
+  ['git clean --help'],
+)
+
+/**
+ * `git rebase --abort` / `--quit` are exempt: they only ever end an
+ * in-progress rebase (restoring, or leaving, the pre-rebase HEAD), and denying
+ * them is what drove an agent into hand-editing refs, HEAD, the index and
+ * `.git/rebase-merge` instead. `--continue`/`--skip` stay denied.
+ */
+export const gitRebase = transitionRule(
+  'git.rebase',
+  'rebase',
+  ['git rebase main', 'git rebase -i HEAD~3', 'git rebase --continue'],
+  ['git rebase --help', 'git rebase --abort', 'git rebase --quit', 'git -C sub rebase --abort'],
+  isSequencerRecoveryOnly,
+)
+
+/**
+ * az387: this rule shipped with an empty `allow` corpus — the only built-in
+ * rule that did (verified via `BUILTIN_RULES` at az384-close time; every
+ * other rule already had at least one). `corpusIsEmpty` (registry.ts) only
+ * refuses deny+allow BOTH empty, so this registered fine while staying
+ * invisible to the allow-corpus execution loop — the `rules-corpus-executed`
+ * test never proved a `git filter-branch` mention doesn't false-positive.
+ * These four cover: help (`--help` is exempt via `isHelpOnlyInvocation`,
+ * like every other transition rule), documentation (a filename mentioning
+ * filter-branch is not a git invocation at all), quoted prose (the literal
+ * string appears inside an unrelated git subcommand's message, not as the
+ * subcommand itself), and search (grepping for the term, not running it).
+ */
+export const gitFilterBranch = transitionRule(
+  'git.filter-branch',
+  'filter-branch',
+  ['git filter-branch --force', 'git filter-branch -f -- --all'],
+  [
+    'git filter-branch --help',
+    'cat docs/history/filter-branch-runbook.md',
+    'git commit -m "docs: warn against git filter-branch --force in this repo"',
+    "rg -n 'filter-branch' docs/",
+  ],
+)
+
+export const gitRestore: RuleSpec = {
+  id: 'git.restore',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git restore unless it is staged-only (an unstage, not a discard).',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'restore') return null
+    if (isHelpOnlyInvocation(g.rest)) return null
+    if (restoreIsStagedOnly(g.rest)) return null
+    return { ruleId: 'git.restore', severity: 'deny', detail: { reason: 'git restore' } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+  },
+  corpus: {
+    deny: [
+      'git restore docs/file.md',
+      'git restore --worktree docs/file.md',
+      'git restore -W docs/file.md',
+      'git restore --staged --worktree docs/file.md',
+      'git restore --staged --ours docs/file.md',
+      'git restore --staged -m docs/file.md',
+      'git restore --source=HEAD --staged --worktree .',
+      'git restore --staged .',
+      'git restore --staged ./',
+      'git restore --staged *',
+      'git restore --staged :/',
+      'git restore --staged :/*',
+      'git restore --staged :(top)',
+      'git restore --staged -- .',
+      'git restore --staged docs/file.md .',
+      'git restore --staged',
+      'git restore --source HEAD~1 --staged',
+      // A leading `>out` redirection token is skipped by skipPrefixes; the
+      // git invocation underneath is an ordinary (non-staged-only) restore.
+      '>out git restore --source=HEAD file',
+    ],
+    allow: [
+      'git restore --staged docs/file.md',
+      'git restore -S docs/file.md',
+      'git restore --staged -- docs/file.md',
+      'git restore --staged workflows/config/exceptions/frontend-biome.yaml',
+      'git restore --staged workflows/',
+      'git restore --source HEAD~1 --staged docs/file.md',
+    ],
+  },
+}
+
+export const gitReset: RuleSpec = {
+  id: 'git.reset',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git reset unless it names only specific pathspecs after `--` (an unstage, not a rewind).',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'reset') return null
+    if (isHelpOnlyInvocation(g.rest)) return null
+    if (resetIsPathspecOnly(g.rest)) return null
+    return { ruleId: 'git.reset', severity: 'deny', detail: { reason: 'git reset' } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+  },
+  corpus: {
+    deny: [
+      'git reset',
+      'git reset --hard',
+      'git reset --soft HEAD~1',
+      'git reset --mixed',
+      'git reset docs/file.md',
+      'git reset HEAD',
+      'git reset HEAD~1',
+      'git reset --hard -- docs/file.md',
+      'git reset --soft -- docs/file.md',
+      'git reset -- .',
+      'git reset HEAD -- .',
+      'git reset HEAD -- :/',
+      'git reset --hard --help-me',
+      // A bare `(...)` is a group boundary at the splitShell layer (dropped
+      // like whitespace), not a substitution — the wrapped command is denied
+      // on its own merits, not as 'uncertain'.
+      '(git reset --hard)',
+      // Here-document bodies fed to a shell (directly, piped from cat, or nested in -c) are walked as scripts.
+      "bash -s <<'EOF'\ngit reset --hard\nEOF",
+      "cat <<'EOF' | bash\ngit reset --hard\nEOF",
+      "zsh <<-'EOF'\n\tgit reset --hard\n\tEOF",
+      "bash -c \"bash <<'EOF'\ngit reset --hard\nEOF\"",
+      // Static echo/printf output piped into a shell is reconstructed and walked as the script.
+      "echo 'git reset --hard' | bash",
+      "printf '%s\\n' 'git reset --hard' | sh",
+      // A `-c` script inherits the outer pipe's stdin: a bare shell (or
+      // `exec <shell>`) as the `-c` payload reads that same static
+      // echo/printf output as ITS script, one level deeper.
+      "echo 'git reset --hard' | bash -c 'bash -s'",
+      "echo 'git reset --hard' | bash -c 'bash'",
+      "echo 'git reset --hard' | sh -c 'sh'",
+      "echo 'git reset --hard' | bash -c 'exec bash'",
+      "printf '%s\\n' 'git reset --hard' | bash -c 'bash -s'",
+    ],
+    allow: [
+      'git reset --help',
+      'git reset -- docs/file.md',
+      'git reset HEAD -- docs/file.md',
+      'git reset HEAD~1 -- docs/file.md',
+      // A body not fed to a shell is text.
+      "git commit -F- <<'EOF'\nstop running git reset --hard\nEOF",
+    ],
+  },
+}
+
+export const gitUpdateIndex: RuleSpec = {
+  id: 'git.update-index',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git update-index unless it is a plain --unstage of named pathspecs.',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'update-index') return null
+    if (isHelpOnlyInvocation(g.rest)) return null
+    if (updateIndexIsUnstageOnly(g.rest)) return null
+    return { ruleId: 'git.update-index', severity: 'deny', detail: { reason: 'git update-index' } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+  },
+  corpus: {
+    deny: [
+      'git update-index docs/file.md',
+      'git update-index --skip-worktree docs/file.md',
+      'git update-index --assume-unchanged docs/file.md',
+      'git update-index --no-skip-worktree docs/file.md',
+      'git update-index --no-assume-unchanged docs/file.md',
+      'git update-index --force-remove docs/file.md',
+      'git update-index --cacheinfo 100644,1234567,docs/file.md',
+      'git update-index --unstage --skip-worktree docs/file.md',
+      'git update-index --unstage .',
+      'git update-index --unstage -- .',
+    ],
+    allow: ['git update-index --unstage docs/file.md', 'git update-index --unstage -- docs/file.md docs/other.md'],
+  },
+}

package/packages/agent-hooks/src/rules/impl/git-verify.ts

@@ -0,0 +1,95 @@
+/**
+ * `--no-verify` and `--amend`.
+ *
+ * Ported from `blockedGitVerifyReason` in blocked-reason.mjs:44-50.
+ * `--no-verify` gets its own message in the original (`classifyReason`'s
+ * `/ --no-verify$/` case); `--amend`'s reason string `'git commit --amend'`
+ * matches none of `classifyReason`'s patterns and so falls to the generic
+ * default — kept exactly that way here.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { commitAmends, commitSkipsVerify, isHelpOnlyInvocation } from './git-helpers.ts'
+import { defaultGitMessage, detailString, gitAgentTail } from './messages.ts'
+
+function git(inv: Invocation): (Invocation & { kind: 'git' }) | null {
+  return inv.kind === 'git' ? inv : null
+}
+
+const NO_VERIFY_SUBCOMMANDS = new Set(['commit', 'push', 'merge'])
+
+export const gitNoVerify: RuleSpec = {
+  id: 'git.no-verify',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git commit/push/merge with --no-verify (or commit -n).',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || !NO_VERIFY_SUBCOMMANDS.has(g.subcommand)) return null
+    if (isHelpOnlyInvocation(g.rest)) return null
+    if (!commitSkipsVerify(g.rest, g.subcommand)) return null
+    return { ruleId: 'git.no-verify', severity: 'deny', detail: { reason: `git ${g.subcommand} --no-verify` } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const reason = detailString(finding, 'reason')
+    return {
+      user: `Blocked ${reason}. Do not skip the repository hooks.`,
+      agent:
+        `DENIED ${reason}. This skips the repository hooks, which are the only thing running the quality ` +
+        'gates. Run the plain command instead - `git commit` and `git push` are both allowed and both run ' +
+        'the gates. If a gate fails, fix what it reports; it prints the file, line, and a `fix:` line. If ' +
+        `the human explicitly asked to skip it, tell them to run it themselves. ${gitAgentTail(ctx.snippet)}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'git commit -m x --no-verify',
+      'git commit -n -m x',
+      'git commit --no-verify -m x',
+      "sh -c 'git commit -n -m x'",
+      'git push --no-verify',
+      'git push origin main --no-verify',
+      'git merge --no-verify main',
+      'timeout 90 git push --no-verify',
+      'timeout 5 git commit --no-verify -m x',
+    ],
+    // A bare push has an implicit destination, which the Azure DevOps
+    // credential-broker rule must fail closed when it cannot resolve. Keep
+    // these examples explicit and non-ADO so this corpus continues to prove
+    // that this rule permits ordinary, hook-verifying pushes without
+    // contradicting that network guard.
+    allow: [
+      "git commit -m 'fix: no bypass here'",
+      'git push -n https://github.com/org/repo main',
+      'git push https://github.com/org/repo main',
+      'git merge main',
+    ],
+  },
+}
+
+export const gitAmend: RuleSpec = {
+  id: 'git.amend',
+  category: 'git',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny git commit --amend.',
+  params: noParams,
+  match(inv): Finding | null {
+    const g = git(inv)
+    if (!g || g.subcommand !== 'commit') return null
+    if (isHelpOnlyInvocation(g.rest)) return null
+    if (!commitAmends(g.rest)) return null
+    return { ruleId: 'git.amend', severity: 'deny', detail: { reason: 'git commit --amend' } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    return defaultGitMessage(detailString(finding, 'reason'), ctx.snippet)
+  },
+  corpus: {
+    deny: ['git commit --amend', "git commit --amend -m 'oops'", 'timeout 5 git commit --amend --no-edit'],
+    allow: ["git commit -m 'feat(x): y'"],
+  },
+}