@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.4

package/packages/agent-hooks/src/rules/impl/tool-frontend.ts

@@ -0,0 +1,83 @@
+/**
+ * Direct `npx`/`vitest`/`jest`/`biome`/`tsc`.
+ *
+ * Ported from the `'frontend-tool'` invocation kind. `--help`/`--version`
+ * alone are allowed through at classification time (shell/invocation.ts),
+ * and so is invoking the tool from inside a `just` recipe body — the gate
+ * runs at the recipe boundary, not inside it (this hook only ever sees the
+ * shell command actually run, so it has no visibility into a recipe's own
+ * body either way; the allowance is stated in the message for the human,
+ * not enforced here).
+ *
+ * Tarun's decision (2026-09-27, feature az372): the message must not name a
+ * particular recipe — see messages.ts's `JUST_RECIPES_POINTER`.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+import { detailString, JUST_RECIPES_POINTER } from './messages.ts'
+
+export const toolFrontend: RuleSpec = {
+  id: 'tool.frontend',
+  category: 'tool',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: "Deny direct npx/vitest/jest/biome/tsc; steer at the repository's just recipes.",
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind !== 'frontend-tool') return null
+    return { ruleId: 'tool.frontend', severity: 'deny', detail: { tool: inv.tool } }
+  },
+  message(finding: Finding, ctx: MessageContext) {
+    const tool = detailString(finding, 'tool')
+    return {
+      user: `Blocked direct ${tool}. Run it through ${JUST_RECIPES_POINTER} instead; it carries the same arguments and runs through the gate profile.`,
+      agent:
+        `DENIED direct ${tool}. Do not invoke ${tool} from Bash/Shell, including through sh -c, xargs, find -exec, or command substitution. ` +
+        `Run it through ${JUST_RECIPES_POINTER} instead - the recipe carries the same arguments and runs the gate profile rather than skipping it. ` +
+        '--help and --version remain allowed (they print text and run nothing), ' +
+        'and invoking the tool from inside a `just` recipe body is allowed because the gate runs at the recipe boundary. ' +
+        `Blocked command: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'npx biome check packages/desktop/src',
+      'vitest run',
+      'vitest --coverage run',
+      'jest --testPathPattern=adl-conversation',
+      'biome lint packages/desktop/src',
+      'biome format packages/desktop/src --write',
+      'tsc --noEmit',
+      'tsc -p tsconfig.json',
+      'xargs npx tsc --noEmit',
+      'env npx vitest run',
+      "sh -c 'npx tsc --noEmit'",
+      "bash -lc 'npx tsc --noEmit'",
+      'echo $(biome lint src/)',
+      // Not help-only: isHelpOrVersionOnly requires EVERY token to be a
+      // help/version flag, and 'lint'/'--noEmit' are real arguments.
+      'biome lint --help',
+      'tsc --noEmit --help',
+    ],
+    allow: [
+      'npx --version',
+      'vitest --version',
+      'jest --version',
+      'biome --version',
+      'tsc --version',
+      'npx --help',
+      'vitest --help',
+      'jest --help',
+      'biome --help',
+      'tsc --help',
+      'just frontend lint',
+      'just frontend fmt',
+      'just frontend typecheck',
+      'just frontend test',
+      'just frontend i18n-check',
+      'cd frontend && just frontend lint',
+    ],
+  },
+}

package/packages/agent-hooks/src/rules/impl/tool-grep.ts

@@ -0,0 +1,93 @@
+/**
+ * `grep`, unconditionally.
+ *
+ * Owner decision, 2026-09-15: ban the grep family outright and steer at
+ * `rg` / `ast-grep` / `search` / `ctx_search`. Every replacement was measured
+ * present and already passing the allowlist before the ban was written:
+ *
+ *   rg        /opt/homebrew/bin/rg        stdin filter AND tree search
+ *   fd        10.4.2                      replaces find
+ *   ast-grep  0.45.3                      structural search neither ever did
+ *   search    /usr/local/bin/search       hybrid semantic + keyword
+ *
+ * BLANKET, including a pure stdin filter. An earlier proposal carved out
+ * `npm test 2>&1 | grep -E '…'` as "reading output, not searching code". That
+ * carve-out was withdrawn: `rg` filters stdin exactly as well, so it defended
+ * a habit rather than a capability, and a rule with a shape-shaped hole in it
+ * is a rule agents learn to route around.
+ *
+ * Every invocation shape is caught — at the start, after a pipe, after
+ * `&&`/`||`/`;`, inside `$()`/backticks, after xargs, after sudo, and via a
+ * leading path — because that classification lives in shell/invocation.ts,
+ * not here. This fires on the agent's PreToolUse surface only, so a `grep`
+ * inside `.workflows/scripts/`, the justfile or CI is untouched: the hook
+ * sees `just check`, never what the recipe shells out to.
+ *
+ * `ls` is deliberately NOT denied. It shares `find`'s weakness — it answers
+ * about names, never contents — but it is far more load-bearing for ordinary
+ * work than the search tools this replaces.
+ */
+
+import type { Invocation } from '../shell/invocation.ts'
+import type { Finding, MessageContext, RuleSpec } from '../spec.ts'
+import { noParams } from '../spec.ts'
+
+export const toolGrep: RuleSpec = {
+  id: 'tool.grep',
+  category: 'tool',
+  severity: 'deny',
+  enabledByDefault: true,
+  summary: 'Deny the grep family; steer at rg / ast-grep / search / ctx_search.',
+  params: noParams,
+  match(inv: Invocation): Finding | null {
+    if (inv.kind !== 'grep') return null
+    return { ruleId: 'tool.grep', severity: 'deny', detail: {} }
+  },
+  message(_finding: Finding, ctx: MessageContext) {
+    return {
+      user: 'Blocked grep. Use `rg` (same job, faster, repo-aware), `ast-grep` for structural search, or `ctx_search` for the indexed search.',
+      agent:
+        'DENIED grep. Use one of these instead - all are on PATH and already allowed:\n' +
+        '  rg          drop-in for grep, including stdin: `npm test 2>&1 | rg "pass|fail"`\n' +
+        '  ast-grep    structural/syntax search, for shapes rather than strings\n' +
+        '  search      hybrid semantic + keyword over indexed docs (`search query "<text>"`)\n' +
+        '  ctx_search  the indexed code search (action=symbol for an exact symbol)\n' +
+        'This applies to a pure output filter too: `rg` reads stdin exactly as grep does, ' +
+        'so there is no capability being removed here, only a slower tool. ' +
+        `Blocked command: ${ctx.snippet}`,
+    }
+  },
+  corpus: {
+    deny: [
+      'grep -r TODO src/',
+      'grep TODO file.txt',
+      "npm test 2>&1 | grep -E 'pass|fail'",
+      'ls && grep TODO file.txt',
+      'false || grep TODO file.txt',
+      'echo hi; grep TODO file.txt',
+      'echo $(grep TODO file.txt)',
+      'echo `grep TODO file.txt`',
+      'echo . | xargs -I{} grep TODO {}',
+      'sudo grep TODO /etc/hosts',
+      '/usr/bin/grep TODO file.txt',
+      'egrep TODO file.txt',
+      'fgrep TODO file.txt',
+      'rgrep TODO file.txt',
+    ],
+    allow: [
+      // The replacements must keep working — a ban with no escape route is a trap.
+      'rg TODO src/',
+      "npm test 2>&1 | rg 'pass|fail'",
+      'fd -e ts src/',
+      'ast-grep --version',
+      'search query "how do I author a metric"',
+      'ls -la',
+      // The word `grep` is not the command `grep`.
+      'rg grep src/',
+      './grep-refs.sh --verbose',
+      'cat tools/grep-helpers.ts',
+      'echo "grep the logs"',
+      'rg -e grep file.txt',
+    ],
+  },
+}