@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.7 → 0.1.9

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82875872 bytes
-sha256: b562edfda0f280940a2b5874874f83c22bde7fe8cd5b9d8159c003f4b53e1f5c
+size: 82920928 bytes
+sha256: 74d2d0af04a268afff30746e0d68d9d49d8e92c347e913330393c90362c99aff

package/bin/git

@@ -621,8 +621,76 @@ case "$command_name" in
   *) exec "$real_git" ${args[@]+"${args[@]}"} ;;
 esac
 
+# Whether option ARG, for network subcommand SUB, consumes the NEXT argv
+# element as its value.  Incident 2026-09-30 (Azure DevOps push 16505 recorded
+# as the HUMAN "Tarun Rana" for an agent session's `git push -u origin
+# feat/adl-install`): one shared value-option list treated `-u` as taking a
+# value for EVERY subcommand.  It only does for ls-remote/clone
+# (`--upload-pack <exec>`); for push it is `--set-upstream` and for fetch/pull
+# `--update-head-ok`, both flags.  `origin` was swallowed as the "value",
+# `feat/adl-install` became the "remote", `remote get-url` failed, and the
+# push went to plain git and the human's credential helper.  The table is
+# therefore PER SUBCOMMAND (verified against git-push/fetch/pull/ls-remote/
+# clone(1)).  Options whose argument is optional (`--force-with-lease`,
+# `--recurse-submodules` on fetch/pull/clone, `-S`, `-r`) only take it
+# attached (`--opt=value`) and so never consume the next element.
+network_option_takes_value() {
+  local sub="$1" arg="$2" short_values long_values chars i ch
+  local fetch_long=' depth deepen shallow-since shallow-exclude negotiation-tip negotiation-restrict negotiation-include filter refmap jobs server-option upload-pack exec submodule-prefix recurse-submodules-default bundle-uri '
+  case "$sub" in
+    push) short_values='o'; long_values=' push-option receive-pack exec repo recurse-submodules ' ;;
+    fetch) short_values='jo'; long_values="$fetch_long" ;;
+    pull) short_values='josX'; long_values="$fetch_long strategy strategy-option cleanup into-name " ;;
+    ls-remote) short_values='ou'; long_values=' upload-pack exec server-option sort ' ;;
+    clone) short_values='obucj'; long_values=' origin branch upload-pack template config separate-git-dir ref-format jobs bundle-uri depth shallow-since shallow-exclude reference reference-if-able server-option filter revision object-format ' ;;
+    *) return 1 ;;
+  esac
+  case "$arg" in
+    --|--*=*) return 1 ;;
+    --*) [[ "$long_values" == *" ${arg#--} "* ]] ;;
+    -?) [[ "$short_values" == *"${arg#-}"* ]] ;;
+    -*)
+      # Clustered short options (`-uf`, `-fo x`): the first value-taking
+      # letter ends the cluster; it consumes the next element only when it is
+      # the LAST letter (otherwise the rest of the cluster is its value).
+      chars="${arg#-}"
+      for ((i = 0; i < ${#chars}; i += 1)); do
+        ch="${chars:i:1}"
+        if [[ "$short_values" == *"$ch"* ]]; then
+          ((i == ${#chars} - 1)) && return 0
+          return 1
+        fi
+      done
+      return 1
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+# True when OPERAND (an unresolved would-be remote name) is really a local
+# path or a URL, which plain git handles without any named remote: an
+# absolute/relative/home path, an existing path (relative to any leading
+# `-C <dir>`), a `scheme://` URL, or scp-like `host:path`.
+is_path_or_url_operand() {
+  local operand="$1" base='' i
+  case "$operand" in
+    /*|./*|../*|~*|.|..|*://*) return 0 ;;
+  esac
+  is_scp_like_url "$operand" && return 0
+  for ((i = 0; i < command_index; i += 1)); do
+    if [[ "${args[i]}" == -C && $((i + 1)) -lt command_index ]]; then
+      case "${args[i + 1]}" in
+        /*) base="${args[i + 1]}" ;;
+        *) base="${base:+$base/}${args[i + 1]}" ;;
+      esac
+    fi
+  done
+  [[ -e "${base:+$base/}$operand" ]]
+}
+
 remote_url=''
 remote_name='origin'
+remote_explicit=0
 
 # A direct URL is authoritative for every network command.  Scan it before
 # resolving a remote name so clone, ls-remote, and explicit fetch/push/pull URLs never
@@ -635,24 +703,27 @@ for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
 done
 
 if [[ -z "$remote_url" ]]; then
-  # The first positional argument to fetch, pull, push, and ls-remote is the selected
-  # remote.  Skip the common options that carry a following value; unknown
-  # options are skipped rather than treated as a remote name.
+  # The first positional argument to fetch, pull, push, and ls-remote is the
+  # selected remote.  Skip options (and the value of those that take one FOR
+  # THIS SUBCOMMAND, see network_option_takes_value); other options are
+  # skipped rather than treated as a remote name.
   for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
     argument="${args[index]}"
     case "$argument" in
       --)
         ((index += 1))
-        ((index < ${#args[@]})) && remote_name="${args[index]}"
+        if ((index < ${#args[@]})); then
+          remote_name="${args[index]}"
+          remote_explicit=1
+        fi
         break
         ;;
-      -c|-j|-o|-u|--depth|--deepen|--filter|--jobs|--negotiation-tip|--push-option|--receive-pack|--refmap|--recurse-submodules|--server-option|--shallow-exclude|--shallow-since|--strategy|--strategy-option|--upload-pack)
-        ((index += 1))
-        ;;
-      -?*|--*=*)
+      -?*)
+        network_option_takes_value "$command_name" "$argument" && ((index += 1))
         ;;
       *)
         remote_name="$argument"
+        remote_explicit=1
         break
         ;;
     esac
@@ -661,6 +732,16 @@ fi
 
 if [[ -z "$remote_url" ]]; then
   if ! remote_url="$("$real_git" "${args[@]:0:command_index}" remote get-url "$remote_name" 2>/dev/null)"; then
+    # FAIL CLOSED (incident 2026-09-30, above): an EXPLICITLY named remote
+    # that does not resolve, and is not a local path or a URL, must never be
+    # handed to plain git -- it would authenticate as the human via the
+    # keychain/credential helper if the name was really an Azure DevOps
+    # remote we mis-scanned.  clone has no remote name (its operand is the
+    # source), and an unnamed default remote keeps today's pass-through.
+    if [[ "$command_name" != clone && "$remote_explicit" == 1 ]] && ! is_path_or_url_operand "$remote_name"; then
+      printf "git: cannot resolve remote '%s' for %s; refusing to pass an unresolved remote to plain git (it may authenticate as the human)\n" "$remote_name" "$command_name" >&2
+      exit 1
+    fi
     exec "$real_git" ${args[@]+"${args[@]}"}
   fi
 fi

package/bin/lean-ctx-observe-strip

@@ -10,7 +10,7 @@ export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/us
 # the per-repo carrier (`adl hook lean-ctx pre-tool-use|post-tool-use`,
 # written by `adl hooks deploy`) already provides rewrite/redirect/
 # read-dedup with the repo's own config, and `observe` has no per-repo
-# carrier at all and is dropped outright. Five carriers, all written by
+# carrier at all and is dropped outright. Six carriers, all written by
 # `lean-ctx setup`, are covered ("fix all the lean-ctx issues" -- Tarun,
 # 2026-09-29 -- widened this from an initial two-of-five scope):
 #   1. Raw, unwrapped `lean-ctx hook <subcommand>` entries -- observe,
@@ -33,6 +33,20 @@ export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/us
 #      at $HOME/.claude/skills/lean-ctx, .codex/skills/lean-ctx,
 #      .cursor/skills/lean-ctx, .config/opencode/skills/lean-ctx,
 #      .agents/skills/lean-ctx.
+#   6. Global lean-ctx hook SCRIPTS: every entry named `lean-ctx-*` directly
+#      under $HOME/.claude/hooks (lean-ctx-rewrite.sh, lean-ctx-redirect.sh,
+#      their -native counterparts, and any .bak copies). Added 2026-09-30
+#      because of lean-ctx's own startup refresh gate (proven from v3.10.5
+#      source, rust/src/hooks/mod.rs): refresh_installed_hooks() re-writes
+#      the global Claude hooks whenever hooks_installed_for("claude", home)
+#      is true, i.e. <claude_dir>/hooks/lean-ctx-rewrite.sh EXISTS or
+#      <claude_dir>/settings.json contains the substring `lean-ctx`.
+#      Stripping settings.json (shape 1) alone leaves the scripts behind and
+#      the gate armed, so the carrier rewrites the global hooks on its next
+#      start. Only names starting with `lean-ctx-` are touched; every other
+#      file there (enact-*, code-simplifier.mjs, lib/, symlinks to other
+#      repos) is left alone. Scope is $HOME/.claude only -- CLAUDE_CONFIG_DIR
+#      is deliberately not consulted (the tool takes --home explicitly).
 # `adl hook lean-ctx ...` (the per-repo carrier) and Orca's own hooks are
 # never touched -- see bin/lib/lean-ctx-observe-hooks.sh's own header for
 # exactly why the match can never catch either, and for the full "which
@@ -42,7 +56,7 @@ export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/us
 # that same header, not stripped. Run by bin/reconcile on every
 # reconciliation (plan AND apply, exactly like bin/kimi-hooks /
 # bin/opencode-hooks) so a hand-edited or Orca-reinstalled per-user config
-# never lets any of the five carriers creep back in unnoticed.
+# never lets any of the six carriers creep back in unnoticed.
 #
 # Usage: lean-ctx-observe-strip --home ABSOLUTE_PATH --mode plan|apply
 #
@@ -66,7 +80,11 @@ export PATH="/usr/local/bin:/opt/homebrew/bin:/home/linuxbrew/.linuxbrew/bin:/us
 #          not exist, is reported and left alone. A skill directory is
 #          moved (never deleted) only when its SKILL.md frontmatter says
 #          `name: lean-ctx`; any other content there is left alone and
-#          reported. Refuses outright (before touching anything) when run
+#          reported. The `lean-ctx-*` hook scripts under ~/.claude/hooks are
+#          moved (never deleted) into a sibling
+#          `hooks.pre-lean-ctx-observe-strip-<UTC ts>/` directory OUTSIDE
+#          the scanned hooks/ directory, exactly like a skill directory's
+#          backup, and reported one line per file. Refuses outright (before touching anything) when run
 #          as literal root (EUID 0) against a --home it does not own --
 #          bin/reconcile's apply path never does this itself; see
 #          lean_ctx_observe_strip_guard_euid in the shared lib.
@@ -348,6 +366,60 @@ strip_skill_dir_one() {
   return 0
 }
 
+# strip_hook_scripts_one <hooks-dir> -- shape 6 (see the header): moves every
+# entry named `lean-ctx-*` directly under <hooks-dir> into a sibling
+# `<hooks-dir>.pre-lean-ctx-observe-strip-<UTC ts>/` directory (OUTSIDE the
+# scanned hooks/ directory, same reasoning as strip_skill_dir_one), so
+# lean-ctx's refresh gate (`hooks/lean-ctx-rewrite.sh` exists) is disarmed.
+# Matches by name prefix only, never by content; a symlink named
+# `lean-ctx-*` is moved as the link itself (mv never follows it). Nothing
+# else in <hooks-dir> is read or touched. Each file is reported as
+# "backed up previous hook script <original> to <backup>" (two explicit
+# paths, like the skill-directory note -- the backup path does not end in
+# `.pre-<label>-<timestamp>`, so bin/reconcile cannot recover the original
+# by suffix-stripping).
+strip_hook_scripts_one() {
+  local hooks_dir="$1" entry
+  local found=()
+  if [[ -d "$hooks_dir" ]]; then
+    for entry in "$hooks_dir"/lean-ctx-*; do
+      if [[ -e "$entry" || -L "$entry" ]]; then
+        found+=("$entry")
+      fi
+    done
+  fi
+  if [[ "${#found[@]}" -eq 0 ]]; then
+    echo "lean-ctx-observe-strip: $hooks_dir/lean-ctx-*: not present -- nothing to strip"
+    return 0
+  fi
+  for entry in "${found[@]}"; do
+    echo "lean-ctx-observe-strip: $entry: found lean-ctx hook script"
+    if [[ "$mode" != apply ]]; then
+      echo "lean-ctx-observe-strip: would move $entry to a timestamped backup location outside $hooks_dir"
+    fi
+  done
+  [[ "$mode" == apply ]] || return 0
+
+  local backup_root
+  backup_root="${hooks_dir}.pre-lean-ctx-observe-strip-$(date -u +%Y%m%dT%H%M%SZ)"
+  if ! mkdir "$backup_root" 2>/dev/null; then
+    echo "lean-ctx-observe-strip: $hooks_dir: FAILED to create backup location $backup_root -- not modified" >&2
+    return 1
+  fi
+  local backup rc=0
+  for entry in "${found[@]}"; do
+    backup="$backup_root/$(basename "$entry")"
+    if ! mv "$entry" "$backup"; then
+      echo "lean-ctx-observe-strip: $entry: FAILED to move to $backup -- not modified" >&2
+      rc=1
+      continue
+    fi
+    echo "lean-ctx-observe-strip: backed up previous hook script $entry to $backup"
+    echo "lean-ctx-observe-strip: moved lean-ctx hook script $entry to $backup"
+  done
+  return "$rc"
+}
+
 status=0
 for target in "${targets[@]}"; do
   strip_one "$target" || status=1
@@ -358,4 +430,5 @@ done
 for target in "${skill_dir_targets[@]}"; do
   strip_skill_dir_one "$target" || status=1
 done
+strip_hook_scripts_one "$home/.claude/hooks" || status=1
 exit "$status"

package/bin/reconcile

@@ -180,6 +180,12 @@ collect_lean_ctx_observe_strip_backups() {
       original="${BASH_REMATCH[1]}"
       backup="${BASH_REMATCH[2]}"
       record_backup "$original" "$backup"
+    elif [[ "$line" =~ ^lean-ctx-observe-strip:\ backed\ up\ previous\ hook\ script\ (.+)\ to\ (.+)$ ]]; then
+      # ~/.claude/hooks/lean-ctx-* scripts: same two-path shape as a skill
+      # directory (sibling "hooks.pre-lean-ctx-observe-strip-<ts>/" backup).
+      original="${BASH_REMATCH[1]}"
+      backup="${BASH_REMATCH[2]}"
+      record_backup "$original" "$backup"
     fi
   done <<<"$text"
 }
@@ -1979,6 +1985,37 @@ run_surface_update() {
   sudo -u "$administrator" -H env PATH="$surface_cli_search_path" "$resolved" "$@" </dev/null
 }
 
+# Extracts an update command's own reported failure reason from its
+# captured output, or prints nothing (empty) if none is found. Confirmed
+# live for kimi on strato and hostinger-vps-1 (2026-09-30): `kimi upgrade`
+# printed "error: failed to check for updates: CDN /latest returned HTTP
+# 521" and still exited 0. Broadened by independent review the same day:
+# optional leading whitespace before the marker, ANSI color codes stripped
+# first (real CLIs colorize their own output), and any of
+# "error:"/"Error:"/"ERROR:"/"✖ error:" -- case-insensitive by
+# construction (POSIX bracket character classes, not a sed `-I`/`I` flag,
+# which BSD sed does not support). Applied identically to every surface's
+# update path, native/npm and Homebrew-cask alike, rather than one
+# per-surface parser.
+#
+# Never `cmd1 | cmd2` piped straight into the caller's assignment: see the
+# inner `if var=$(grep ...); then` below (not `grep | sed`) for why -- under
+# this file's `set -euo pipefail`, grep's ordinary "no match" exit would
+# otherwise abort the run on every surface that DIDN'T report an error. An
+# `if`-tested command is exempt from that abort by design; the function's
+# OWN exit status is therefore never meaningful (an `if` with no `else`
+# always returns 0), so callers check the printed string's emptiness, never
+# this function's exit status.
+surface_update_error_reason() {
+  local output="$1" plain line
+  # LC_ALL=C: the strip is bytewise. Under en_US.UTF-8 glibc resolves [@-~]
+  # by collation, so the escape's final letter would never match.
+  plain="$(LC_ALL=C sed -E $'s/\x1b\\[[0-9;]*[@-~]//g' <<<"$output")"
+  if line="$(grep -m1 -iE '^[[:space:]]*(✖[[:space:]]*)?error:' <<<"$plain")"; then
+    sed -E 's/^[[:space:]]*(✖[[:space:]]*)?[eE][rR][rR][oO][rR]:[[:space:]]*//' <<<"$line"
+  fi
+}
+
 # Reconciles one declared surface_clis entry. report_only (hostinger's loose
 # /root/codex, unknown install method) is version-reported only -- run_surface_update
 # is never called for it, by construction (this branch returns before
@@ -2017,6 +2054,26 @@ reconcile_one_surface_cli() {
       echo "surface update failed: $name (exit $update_status)" >&2
       return 1
     fi
+    # Same broadened check as the native/npm path below (independent
+    # review, 2026-09-30): brew itself can exit 0 while its own output
+    # reports a real problem. No install/upgrade claim without checking
+    # for one first -- Homebrew has no version comparison in this branch
+    # (it acts on cask PRESENCE, not a read version), so there is no
+    # "version changed" success case to weigh it against here; any error
+    # line found is a hard failure.
+    local update_error_line
+    update_error_line="$(surface_update_error_reason "$update_output")"
+    if [[ -n "$update_error_line" ]]; then
+      # Install vs upgrade distinguished in the failure wording too (second
+      # coordinator pass, 2026-09-30): the same `cask_action[0]` that already
+      # picks the real brew argv above also names which one failed.
+      if [[ "${cask_action[0]}" == install ]]; then
+        echo "surface $name: cask install failed ($update_error_line)" >&2
+      else
+        echo "surface $name: cask upgrade failed ($update_error_line)" >&2
+      fi
+      return 1
+    fi
     if [[ "${cask_action[0]}" == install ]]; then
       echo "surface $name: Homebrew cask installed"
     else
@@ -2045,7 +2102,7 @@ reconcile_one_surface_cli() {
     echo "surface $name: report-only, currently ${ver:-unknown}"
     return 0
   fi
-  local old_version new_version update_output update_status=0
+  local old_version new_version update_output update_status=0 update_error_line
   old_version="$(surface_cli_version "$resolved")"
   update_output="$(run_with_timeout "$SURFACE_UPDATE_TIMEOUT_SECONDS" run_surface_update "$resolved" ${update_args[@]+"${update_args[@]}"} 2>&1)" || update_status=$?
   printf '%s\n' "$update_output"
@@ -2056,12 +2113,48 @@ reconcile_one_surface_cli() {
     echo "surface update failed: $name (exit $update_status)" >&2
     return 1
   fi
+  # A surface's update command can exit 0 while its own output says the
+  # check itself failed -- confirmed live for kimi (strato + hostinger,
+  # 2026-09-30): `kimi upgrade` printed
+  # "error: failed to check for updates: CDN /latest returned HTTP 521" and
+  # still exited 0 (AGENTS.md: no silent fallback). Read new_version BEFORE
+  # judging anything (independent review, 2026-09-30): a version CHANGE is
+  # proof positive the update happened, which outranks an error line the
+  # command also printed (e.g. a flaky post-install self-check after a
+  # real, successful install) -- reported as a note on the success line,
+  # never a failure. Only an UNCHANGED version with an error line is the
+  # case this whole check exists for: the command claimed nothing changed,
+  # and said why, and that is reported as a failure -- wording "update
+  # check failed", not "could not check for updates", since the reported
+  # reason may not even be about the check itself (kept generic rather than
+  # asserting which).
+  #
+  # An EMPTY new_version (second coordinator pass, 2026-09-30: the binary
+  # broke, or --version now produces no output) must never count as
+  # "updated" just because empty differs from a non-empty old_version --
+  # that used to read as "surface X: 1.2.3 -> unknown", an arrow-style
+  # SUCCESS line for a version we cannot actually confirm. Checked before
+  # the "changed" branch below, so only a REAL, non-empty, different
+  # version ever reaches it.
   new_version="$(surface_cli_version "$resolved")"
-  if [[ "$old_version" == "$new_version" ]]; then
-    echo "surface $name: already latest (${new_version:-unknown})"
-  else
-    echo "surface $name: ${old_version:-unknown} -> ${new_version:-unknown}"
+  update_error_line="$(surface_update_error_reason "$update_output")"
+  if [[ -z "$new_version" ]]; then
+    echo "surface $name: update ran but version unreadable (${update_error_line:-"--version produced no output"}); was ${old_version:-unknown}" >&2
+    return 1
+  fi
+  if [[ "$old_version" != "$new_version" ]]; then
+    if [[ -n "$update_error_line" ]]; then
+      echo "surface $name: updated ${old_version:-unknown} -> $new_version (reported: $update_error_line)"
+    else
+      echo "surface $name: ${old_version:-unknown} -> $new_version"
+    fi
+    return 0
   fi
+  if [[ -n "$update_error_line" ]]; then
+    echo "surface $name: update check failed ($update_error_line); kept ${old_version:-unknown}" >&2
+    return 1
+  fi
+  echo "surface $name: already latest ($new_version)"
   return 0
 }
 
@@ -2692,6 +2785,83 @@ else
   echo "global-tools: $mode complete; no state changed"
 fi
 
+# git_maintain_repos (2026-09-30, arm-only decision the same day): an
+# explicit, closed list of repositories this device's own checkout lives
+# at OUTSIDE any recursively-scanned home directory -- the Linux VPSes'
+# root-owned /opt/adl-azdo is the confirmed case for both strato-vps-1 and
+# hostinger-vps-1 (STATUS.md's 2026-09-29 first-deployment record;
+# hostinger's own fleet-cutover --apply landed 2026-09-29T23:43Z, confirmed
+# the same day). git-maintain's own scheduling (packages/fleet/src/
+# launch-agents.ts: a dedicated compiled binary, ad-hoc signed, run by a
+# launchd LaunchAgent under TCC) is macOS-only by construction, so it never
+# reaches these checkouts on its own. This runs the job directly, on
+# reconcile's own schedule (every platform this script runs on already has
+# one), passing each declared path as `--repo` argv -- never a recursive
+# scan of a shared parent like `/opt` (which also holds unrelated,
+# explicitly off-limits directories), and never a new environment
+# variable: the list itself comes only from the manifest, and
+# GIT_MAINTAIN_DRY below is this job's own pre-existing dry/real contract,
+# driven by reconcile's own --mode exactly like every other step in this
+# file, not a knob an operator sets by hand. Absent or empty (every mac
+# device today) is a silent no-op, the same convention
+# launch_agents/scratch_repos/surface_clis already use.
+#
+# ARM-ONLY, always, on this path (independent review, 2026-09-30): the full
+# job on this SAME checkout `bin/reconcile` runs from turned out to be new,
+# unapproved, root-run behaviour once actually reasoned through, not merely
+# a self-checkout read/write ordering hazard -- see the `--arm-only`
+# decision recorded in jobs/git-maintain/src/main.ts's own header comment
+# for the full list (a silent fast-forward-driven auto-deploy of
+# `origin/integration`/main with no approval gate, colliding with
+# fleet-cutover.sh re-reading fleet-retire-list.json from this same
+# checkout after reconcile runs, `git branch -D` as root, and a fetch that
+# still runs even in dry/plan/audit mode and exits 0 on its own failure).
+# `--arm-only` narrows this call to ONLY `armHooks`: no fetch, no
+# fast-forward, no branch prune, no bundle-refresh installer, no network,
+# and no Azure DevOps identity resolution. The only remaining write is
+# `.git/config`'s `core.hooksPath`, real only in apply mode
+# (GIT_MAINTAIN_DRY=1 below makes it a `[dry] would arm ...` log line and
+# nothing else, in both plan AND audit mode). That is never a tracked file
+# this script (or anything downstream of it) reads, so arm-only has no
+# self-checkout read/write ordering hazard left to avoid -- this step stays
+# in this late position anyway, unchanged from the full-job version: it is
+# still the simplest place for it, and there is no reason to special-case
+# arm-only's position just because its own hazard is gone.
+git_maintain_repos=()
+while IFS= read -r repo; do
+  [[ -n "$repo" ]] && git_maintain_repos+=("$repo")
+done < <(jq -r --arg platform "$platform" --arg device "$device" \
+  '.[$platform].devices[$device].git_maintain_repos // [] | .[]' "$manifest")
+if [[ "${#git_maintain_repos[@]}" -gt 0 ]]; then
+  git_maintain_repo_args=(--arm-only)
+  for repo in "${git_maintain_repos[@]}"; do
+    git_maintain_repo_args+=(--repo "$repo")
+  done
+  # Unlike default-agent-file.ts/managed-settings.ts's plan branches earlier
+  # in this file (which never fail, by construction, so they run
+  # unguarded), this job's dry pass still validates each declared path is a
+  # real repo -- a genuine failure mode even in a non-apply mode, e.g. a
+  # declared checkout that has not been cloned yet. So every non-apply mode
+  # is guarded exactly like apply mode here, deliberately deviating from
+  # those sibling steps: report it, collect it, never let it abort the rest
+  # of this script under this file's own `set -e`. `$mode` (plan OR audit)
+  # is reported verbatim -- audit is a real, distinct reconcile mode, never
+  # relabeled "plan".
+  if [[ "$mode" != apply ]]; then
+    echo "global-tools: git-maintain (declared repos, arm-only) mode=$mode device=$device -> ${git_maintain_repos[*]}"
+    if ! GIT_MAINTAIN_DRY=1 bun "$repo_root/packages/fleet/jobs/git-maintain/src/main.ts" "${git_maintain_repo_args[@]}"; then
+      echo "global-tools: TOOL INSTALL FAILED: git-maintain-repos" >&2
+      failed_tools+=("git-maintain-repos")
+    fi
+  else
+    echo "global-tools: git-maintain (declared repos, arm-only) mode=apply device=$device -> ${git_maintain_repos[*]}"
+    if ! bun "$repo_root/packages/fleet/jobs/git-maintain/src/main.ts" "${git_maintain_repo_args[@]}"; then
+      echo "global-tools: TOOL INSTALL FAILED: git-maintain-repos" >&2
+      failed_tools+=("git-maintain-repos")
+    fi
+  fi
+fi
+
 # A recorded, continued-past tool failure (install_one_tool /
 # build_one_bun_tool / install_one_embedding_model_tool / write_one_shim)
 # still lets every post-pass above run -- sweep, kimi-hooks, global-agents,

package/bin/validate-manifest

@@ -43,10 +43,28 @@ if ! jq -e '
     all(.minimum_free_gib >= 1) and
     all((.home | type) == "string" and (.home | startswith("/"))) and
     all((.default_agent | type) == "string" and (.default_agent | test("^agent-[a-z0-9-]+$"))) and
-    all((keys - ["administrator", "default_agent", "home", "launch_agents", "minimum_free_gib", "schedule_minute", "scratch_repos", "brew_upgrade_all", "surface_clis", "tools"] | length) == 0) and
+    all((keys - ["administrator", "default_agent", "home", "launch_agents", "minimum_free_gib", "schedule_minute", "scratch_repos", "brew_upgrade_all", "surface_clis", "git_maintain_repos", "tools"] | length) == 0) and
     all((.scratch_repos // []) | type == "array" and (. | unique | length) == length and
       all(type == "string" and startswith("/") and . != "/" and
         (endswith("/") | not) and (contains("..") | not) and (test("\\s") | not))) and
+    # git_maintain_repos (2026-09-30): an explicit, closed list of
+    # repositories bin/reconcile passes to git-maintain via --repo argv --
+    # never a recursive scan root, deliberately, since these devices own
+    # checkouts that sit at a fixed path outside any device home (the Linux
+    # VPSes use /opt/adl-azdo) and a recursive scan of a shared parent like
+    # /opt would also walk into unrelated, explicitly off-limits
+    # directories. The azagent/vsts.agent substring bans are exactly that
+    # guard, enforced at the schema layer (case-insensitively -- a manifest
+    # value could be typed AzAgent2 as easily as azagent2) so a mistyped or
+    # copy-pasted entry can never point there. git-maintain itself refuses
+    # the same names again, case-insensitively and by realpath too, at the
+    # point of actual use (jobs/git-maintain/src/main.ts,
+    # isForbiddenAzurePipelinesPath) -- this schema check alone only ever
+    # sees the manifest literal string, never what a symlink resolves to.
+    all((.git_maintain_repos // []) | type == "array" and (. | unique | length) == length and
+      all(type == "string" and startswith("/") and . != "/" and
+        (endswith("/") | not) and (contains("..") | not) and (test("\\s") | not) and
+        (ascii_downcase | contains("azagent") | not) and (ascii_downcase | contains("vsts.agent") | not))) and
     all((.brew_upgrade_all // false) | type == "boolean") and
     all(
       (.surface_clis // []) as $surfaces |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [