@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.8 → 0.1.10

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
-size: 82920928 bytes
-sha256: ecd5111c7bc2c06d56361450a0d97b8280f6d300f879714a0bd23d2c534ec61b
+size: 82925024 bytes
+sha256: bf72c4f43099dc33afd161d5e8205d2fbfc5607e4b3aafac4ac0644224b75337

package/bin/git

@@ -621,8 +621,76 @@ case "$command_name" in
   *) exec "$real_git" ${args[@]+"${args[@]}"} ;;
 esac
 
+# Whether option ARG, for network subcommand SUB, consumes the NEXT argv
+# element as its value.  Incident 2026-09-30 (Azure DevOps push 16505 recorded
+# as the HUMAN "Tarun Rana" for an agent session's `git push -u origin
+# feat/adl-install`): one shared value-option list treated `-u` as taking a
+# value for EVERY subcommand.  It only does for ls-remote/clone
+# (`--upload-pack <exec>`); for push it is `--set-upstream` and for fetch/pull
+# `--update-head-ok`, both flags.  `origin` was swallowed as the "value",
+# `feat/adl-install` became the "remote", `remote get-url` failed, and the
+# push went to plain git and the human's credential helper.  The table is
+# therefore PER SUBCOMMAND (verified against git-push/fetch/pull/ls-remote/
+# clone(1)).  Options whose argument is optional (`--force-with-lease`,
+# `--recurse-submodules` on fetch/pull/clone, `-S`, `-r`) only take it
+# attached (`--opt=value`) and so never consume the next element.
+network_option_takes_value() {
+  local sub="$1" arg="$2" short_values long_values chars i ch
+  local fetch_long=' depth deepen shallow-since shallow-exclude negotiation-tip negotiation-restrict negotiation-include filter refmap jobs server-option upload-pack exec submodule-prefix recurse-submodules-default bundle-uri '
+  case "$sub" in
+    push) short_values='o'; long_values=' push-option receive-pack exec repo recurse-submodules ' ;;
+    fetch) short_values='jo'; long_values="$fetch_long" ;;
+    pull) short_values='josX'; long_values="$fetch_long strategy strategy-option cleanup into-name " ;;
+    ls-remote) short_values='ou'; long_values=' upload-pack exec server-option sort ' ;;
+    clone) short_values='obucj'; long_values=' origin branch upload-pack template config separate-git-dir ref-format jobs bundle-uri depth shallow-since shallow-exclude reference reference-if-able server-option filter revision object-format ' ;;
+    *) return 1 ;;
+  esac
+  case "$arg" in
+    --|--*=*) return 1 ;;
+    --*) [[ "$long_values" == *" ${arg#--} "* ]] ;;
+    -?) [[ "$short_values" == *"${arg#-}"* ]] ;;
+    -*)
+      # Clustered short options (`-uf`, `-fo x`): the first value-taking
+      # letter ends the cluster; it consumes the next element only when it is
+      # the LAST letter (otherwise the rest of the cluster is its value).
+      chars="${arg#-}"
+      for ((i = 0; i < ${#chars}; i += 1)); do
+        ch="${chars:i:1}"
+        if [[ "$short_values" == *"$ch"* ]]; then
+          ((i == ${#chars} - 1)) && return 0
+          return 1
+        fi
+      done
+      return 1
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+# True when OPERAND (an unresolved would-be remote name) is really a local
+# path or a URL, which plain git handles without any named remote: an
+# absolute/relative/home path, an existing path (relative to any leading
+# `-C <dir>`), a `scheme://` URL, or scp-like `host:path`.
+is_path_or_url_operand() {
+  local operand="$1" base='' i
+  case "$operand" in
+    /*|./*|../*|~*|.|..|*://*) return 0 ;;
+  esac
+  is_scp_like_url "$operand" && return 0
+  for ((i = 0; i < command_index; i += 1)); do
+    if [[ "${args[i]}" == -C && $((i + 1)) -lt command_index ]]; then
+      case "${args[i + 1]}" in
+        /*) base="${args[i + 1]}" ;;
+        *) base="${base:+$base/}${args[i + 1]}" ;;
+      esac
+    fi
+  done
+  [[ -e "${base:+$base/}$operand" ]]
+}
+
 remote_url=''
 remote_name='origin'
+remote_explicit=0
 
 # A direct URL is authoritative for every network command.  Scan it before
 # resolving a remote name so clone, ls-remote, and explicit fetch/push/pull URLs never
@@ -635,24 +703,27 @@ for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
 done
 
 if [[ -z "$remote_url" ]]; then
-  # The first positional argument to fetch, pull, push, and ls-remote is the selected
-  # remote.  Skip the common options that carry a following value; unknown
-  # options are skipped rather than treated as a remote name.
+  # The first positional argument to fetch, pull, push, and ls-remote is the
+  # selected remote.  Skip options (and the value of those that take one FOR
+  # THIS SUBCOMMAND, see network_option_takes_value); other options are
+  # skipped rather than treated as a remote name.
   for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
     argument="${args[index]}"
     case "$argument" in
       --)
         ((index += 1))
-        ((index < ${#args[@]})) && remote_name="${args[index]}"
+        if ((index < ${#args[@]})); then
+          remote_name="${args[index]}"
+          remote_explicit=1
+        fi
         break
         ;;
-      -c|-j|-o|-u|--depth|--deepen|--filter|--jobs|--negotiation-tip|--push-option|--receive-pack|--refmap|--recurse-submodules|--server-option|--shallow-exclude|--shallow-since|--strategy|--strategy-option|--upload-pack)
-        ((index += 1))
-        ;;
-      -?*|--*=*)
+      -?*)
+        network_option_takes_value "$command_name" "$argument" && ((index += 1))
         ;;
       *)
         remote_name="$argument"
+        remote_explicit=1
         break
         ;;
     esac
@@ -661,6 +732,16 @@ fi
 
 if [[ -z "$remote_url" ]]; then
   if ! remote_url="$("$real_git" "${args[@]:0:command_index}" remote get-url "$remote_name" 2>/dev/null)"; then
+    # FAIL CLOSED (incident 2026-09-30, above): an EXPLICITLY named remote
+    # that does not resolve, and is not a local path or a URL, must never be
+    # handed to plain git -- it would authenticate as the human via the
+    # keychain/credential helper if the name was really an Azure DevOps
+    # remote we mis-scanned.  clone has no remote name (its operand is the
+    # source), and an unnamed default remote keeps today's pass-through.
+    if [[ "$command_name" != clone && "$remote_explicit" == 1 ]] && ! is_path_or_url_operand "$remote_name"; then
+      printf "git: cannot resolve remote '%s' for %s; refusing to pass an unresolved remote to plain git (it may authenticate as the human)\n" "$remote_name" "$command_name" >&2
+      exit 1
+    fi
     exec "$real_git" ${args[@]+"${args[@]}"}
   fi
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/agent-hooks/src/hooks/crg/background.ts

@@ -0,0 +1,179 @@
+/**
+ * Single-flight, detached `code-review-graph update --skip-flows`.
+ *
+ * Why this exists: on a large repo `update` takes ~13 s, but the
+ * `PostToolUse` hook that triggers it is killed by the host at 5 s
+ * (`assets/hooks.json`, `"timeout": 5`), so a synchronous run never
+ * finishes and the graph goes stale on every edit. The hook therefore only
+ * DECIDES here and returns at once; the work runs in a detached process
+ * group that outlives the hook.
+ *
+ * Protocol (all state under `<root>/.adl/`, already git-ignored):
+ *  - `crg-update.lock`   holds the pid of the process running the update.
+ *  - `crg-update.pending` marker: "an edit landed while an update ran".
+ *  - `logs/crg-update.log` the update's own stdout+stderr (append).
+ *
+ * `requestUpdate` (the hook side):
+ *  1. Acquire the lock atomically (`wx`), holding the hook's own pid as a
+ *     placeholder so a concurrent hook sees a live owner, then spawn the
+ *     runner and overwrite the lock with the runner's pid.
+ *  2. Lock already held by a live process (and younger than
+ *     `MAX_LOCK_AGE_MS`, a guard against pid reuse after a crash/reboot):
+ *     touch the pending marker and spawn nothing. A dead pid, or an
+ *     over-age lock, is stale: it is removed and step 1 retried once.
+ *  3. After touching the marker, re-check the owner: if it exited in the
+ *     window between the first check and the marker write, acquire and
+ *     spawn instead, so the queued edit is never stranded.
+ *
+ * `RUNNER_SCRIPT` (the detached side) runs the update, and while the
+ * pending marker exists clears it and runs once more. On its way out it
+ * releases the lock, then re-checks the marker once and re-acquires the
+ * lock (noclobber) if a hook queued in the meantime, closing the last gap.
+ */
+
+import { closeSync, mkdirSync, openSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+export const LOCK_REL = '.adl/crg-update.lock'
+export const PENDING_REL = '.adl/crg-update.pending'
+export const UPDATE_LOG_REL = '.adl/logs/crg-update.log'
+
+/** A lock older than this is presumed left by a crash, whatever its pid says. */
+export const MAX_LOCK_AGE_MS = 30 * 60 * 1000
+
+export const RUNNER_SCRIPT = [
+  'lock="$1"; pending="$2"; shift 2',
+  'while :; do',
+  '  rm -f "$pending"',
+  '  "$@"',
+  '  if [ -e "$pending" ]; then continue; fi',
+  '  rm -f "$lock"',
+  '  if [ -e "$pending" ] && (set -C; echo $$ > "$lock") 2>/dev/null; then continue; fi',
+  '  break',
+  'done',
+].join('\n')
+
+export interface SpawnSpec {
+  readonly cmd: string
+  readonly args: readonly string[]
+  readonly cwd: string
+  readonly env: Readonly<Record<string, string | undefined>>
+  /** Absolute path the child's stdout+stderr are appended to. */
+  readonly logFile: string
+}
+
+export interface BackgroundDeps {
+  /** Start a detached, unref'd child; return its pid. Must not wait for it. */
+  readonly spawn: (spec: SpawnSpec) => number
+  readonly isAlive: (pid: number) => boolean
+  readonly now: () => number
+  readonly selfPid: () => number
+  /** Resolve `bin` against `path` (the hook's own PATH); `null` when it is not there. */
+  readonly resolve: (bin: string, path: string | undefined) => string | null
+}
+
+export type UpdateRequest = 'spawned' | 'queued'
+
+const UPDATE_ARGS = ['update', '--skip-flows'] as const
+
+function isPidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0)
+    return true
+  } catch (error) {
+    // EPERM: the process exists but belongs to someone else.
+    return (error as NodeJS.ErrnoException).code === 'EPERM'
+  }
+}
+
+function spawnDetached(spec: SpawnSpec): number {
+  const fd = openSync(spec.logFile, 'a', 0o600)
+  try {
+    const proc = Bun.spawn([spec.cmd, ...spec.args], {
+      cwd: spec.cwd,
+      env: spec.env as Record<string, string>,
+      stdin: 'ignore',
+      stdout: fd,
+      stderr: fd,
+      // Own session/process group: survives the hook, unreachable by the host's timeout kill.
+      detached: true,
+    })
+    proc.unref()
+    return proc.pid
+  } finally {
+    closeSync(fd)
+  }
+}
+
+export const defaultBackgroundDeps: BackgroundDeps = {
+  spawn: spawnDetached,
+  isAlive: isPidAlive,
+  now: () => Date.now(),
+  selfPid: () => process.pid,
+  resolve: (bin, path) => Bun.which(bin, { PATH: path ?? '' }),
+}
+
+function ownerIsLive(deps: BackgroundDeps, lockPath: string): boolean {
+  try {
+    const pid = Number.parseInt(readFileSync(lockPath, 'utf8').trim(), 10)
+    const ageMs = deps.now() - statSync(lockPath).mtimeMs
+    return Number.isInteger(pid) && pid > 0 && ageMs < MAX_LOCK_AGE_MS && deps.isAlive(pid)
+  } catch {
+    // Vanished between the caller's check and this read: nobody owns it.
+    return false
+  }
+}
+
+/** `wx` create: true if this call created the lock, false if it already exists. */
+function tryAcquire(lockPath: string, pid: number): boolean {
+  try {
+    writeFileSync(lockPath, `${pid}\n`, { flag: 'wx', mode: 0o600 })
+    return true
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'EEXIST') return false
+    throw error
+  }
+}
+
+function startRunner(deps: BackgroundDeps, root: string, env: SpawnSpec['env'], lockPath: string, pendingPath: string): void {
+  const pid = deps.spawn({
+    cmd: 'sh',
+    args: ['-c', RUNNER_SCRIPT, 'sh', lockPath, pendingPath, 'code-review-graph', ...UPDATE_ARGS],
+    cwd: root,
+    env,
+    logFile: join(root, UPDATE_LOG_REL),
+  })
+  writeFileSync(lockPath, `${pid}\n`, { mode: 0o600 })
+}
+
+/** Acquire + spawn. On a spawn failure the placeholder lock is released so the next edit can retry. */
+function acquireAndStart(deps: BackgroundDeps, root: string, env: SpawnSpec['env'], lockPath: string, pendingPath: string): boolean {
+  if (!tryAcquire(lockPath, deps.selfPid())) return false
+  try {
+    startRunner(deps, root, env, lockPath, pendingPath)
+  } catch (error) {
+    rmSync(lockPath, { force: true })
+    throw error
+  }
+  return true
+}
+
+export function requestUpdate(deps: BackgroundDeps, root: string, env: SpawnSpec['env']): UpdateRequest {
+  mkdirSync(join(root, '.adl', 'logs'), { recursive: true, mode: 0o700 })
+  const lockPath = join(root, LOCK_REL)
+  const pendingPath = join(root, PENDING_REL)
+
+  if (acquireAndStart(deps, root, env, lockPath, pendingPath)) return 'spawned'
+  if (!ownerIsLive(deps, lockPath)) {
+    rmSync(lockPath, { force: true })
+    if (acquireAndStart(deps, root, env, lockPath, pendingPath)) return 'spawned'
+  }
+  writeFileSync(pendingPath, '', { mode: 0o600 })
+  // The owner may have exited between the check and the marker write.
+  if (!ownerIsLive(deps, lockPath)) {
+    rmSync(lockPath, { force: true })
+    // The new runner clears the marker as its first step, so the queued edit is covered.
+    if (acquireAndStart(deps, root, env, lockPath, pendingPath)) return 'spawned'
+  }
+  return 'queued'
+}

package/packages/agent-hooks/src/hooks/crg/handler.ts

@@ -13,9 +13,10 @@
  */
 
 import type { HookInvocation, HookResult } from '../contract.ts'
+import { defaultBackgroundDeps } from './background.ts'
 import { bunRunner, createCrgHandler } from './index.ts'
 
-const crgHandler = createCrgHandler({ run: bunRunner })
+const crgHandler = createCrgHandler({ run: bunRunner, background: defaultBackgroundDeps })
 
 export async function handleCrg(inv: HookInvocation): Promise<HookResult> {
   return crgHandler(inv)

package/packages/agent-hooks/src/hooks/crg/index.ts

@@ -47,6 +47,7 @@
 
 import type { HookHandler, HookInvocation, HookResult } from '../contract.ts'
 import { spawnWithTimeout } from '../../lib/spawn-with-timeout.ts'
+import { defaultBackgroundDeps, requestUpdate, type BackgroundDeps } from './background.ts'
 import { toDecideInput } from '../../pre-tool-use/handler.ts'
 import { invocations } from '../../rules/shell/invocation.ts'
 
@@ -99,8 +100,38 @@ function missingBinaryNote(subcommand: string, result: RunResult): string {
   return `crg ${subcommand}: ${BIN} ${reason}\n`
 }
 
-/** `after-file-edit.sh`: silent `update --skip-flows`, stdout `{}`, always exit 0. */
-async function afterFileEdit(run: Runner, inv: HookInvocation): Promise<HookResult> {
+const UPDATE_LABEL = 'code-review-graph update --skip-flows'
+
+/**
+ * `after-file-edit.sh`: `update --skip-flows`, stdout `{}`, always exit 0.
+ *
+ * With `background` (production wiring) the update is spawned DETACHED and
+ * single-flight (see `./background.ts`) and the hook returns at once: the
+ * update takes longer than the host's 5 s hook timeout on a large repo, so a
+ * synchronous run was killed every time and the graph never refreshed.
+ * Without it (unit tests of the plain runner path) the update runs inline.
+ */
+async function afterFileEdit(run: Runner, inv: HookInvocation, background: BackgroundDeps | undefined): Promise<HookResult> {
+  if (background !== undefined) {
+    // Fail loud up front: the detached runner's own "command not found" would land only in crg-update.log.
+    if (background.resolve(BIN, inv.env.PATH) === null) {
+      const note = missingBinaryNote('after-file-edit', { status: null, stdout: '', stderr: '' })
+      inv.record?.({ reason: `ERROR ${BIN} not on PATH`, message: note.trim() })
+      return { stdout: '{}\n', stderr: note, exitCode: 0 }
+    }
+    try {
+      const outcome = requestUpdate(background, inv.root, inv.env)
+      inv.record?.({
+        reason: 'PASS',
+        downstream: outcome === 'spawned' ? `spawned ${UPDATE_LABEL} (background)` : 'update already running; queued',
+      })
+      return { stdout: '{}\n', stderr: '', exitCode: 0 }
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error)
+      inv.record?.({ reason: `ERROR background ${UPDATE_LABEL}`, message })
+      return { stdout: '{}\n', stderr: `crg after-file-edit: could not start background update: ${message}\n`, exitCode: 0 }
+    }
+  }
   const result = await runCrg(run, inv, ['update', '--skip-flows'])
   return { stdout: '{}\n', stderr: missingBinaryNote('after-file-edit', result), exitCode: 0 }
 }
@@ -156,11 +187,11 @@ async function sessionStop(run: Runner, inv: HookInvocation): Promise<HookResult
   return { stdout: `${JSON.stringify({ message, passed: true })}\n`, stderr: note, exitCode: 0 }
 }
 
-export function createCrgHandler(deps: { run: Runner }): HookHandler {
+export function createCrgHandler(deps: { run: Runner; background?: BackgroundDeps }): HookHandler {
   return async (inv: HookInvocation): Promise<HookResult> => {
     switch (inv.subcommand) {
       case 'after-file-edit':
-        return afterFileEdit(deps.run, inv)
+        return afterFileEdit(deps.run, inv, deps.background)
       case 'pre-commit':
         return preCommit(deps.run, inv)
       case 'session-stop':
@@ -205,5 +236,5 @@ export const bunRunner: Runner = async (cmd, args, opts) => {
   }
 }
 
-export const handleCrg: HookHandler = createCrgHandler({ run: bunRunner })
+export const handleCrg: HookHandler = createCrgHandler({ run: bunRunner, background: defaultBackgroundDeps })
 export default handleCrg

package/packages/agent-hooks/src/rules/impl/git-paths.ts

@@ -31,15 +31,14 @@ export const gitRm: RuleSpec = {
   },
   message(_finding: Finding, ctx: MessageContext) {
     return {
-      user: 'Blocked git rm. It deletes tracked content and stages the deletion in one step; agents leave the file in place and hand the removal to you.',
+      user: 'Blocked git rm. It deletes tracked content and stages the deletion in one step; agents remove a tracked file with trash instead.',
       agent:
         'DENIED git rm. Every form is refused - with flags or without, --cached included. `git rm` deletes ' +
         'tracked content AND stages the deletion in one step, so it is both the delete and the commit-prep ' +
-        'for it, and it was the last deletion verb this hook left open after rm and trash were closed. ' +
-        'There is no flag that makes it acceptable and no `git rm` that this hook allows. ' +
-        'If a tracked file genuinely has to go: leave it exactly where it is, finish the rest of the change, ' +
-        'and tell the user which paths should be removed and why - removal is theirs to run, the same rule ' +
-        `that already applies to committing a protected tree. ${gitAgentTail(ctx.snippet)}`,
+        'for it. There is no flag that makes it acceptable and no `git rm` that this hook allows. ' +
+        'If a tracked file genuinely has to go, run `trash <path>` (recoverable from ~/.Trash; fs.trash only ' +
+        'refuses the working directory, a system root, $HOME and .git), then `git add <path>` to stage the ' +
+        `deletion with the rest of the change. ${gitAgentTail(ctx.snippet)}`,
     }
   },
   corpus: {

package/packages/agent-hooks/src/rules/impl/tool-grep.ts

@@ -37,7 +37,7 @@ export const toolGrep: RuleSpec = {
   category: 'tool',
   severity: 'deny',
   enabledByDefault: true,
-  summary: 'Deny the grep family; steer at rg / ast-grep / search / ctx_search.',
+  summary: 'Deny the grep family; steer at ast-grep / search / crg / rg / ctx_search.',
   params: noParams,
   match(inv: Invocation): Finding | null {
     if (inv.kind !== 'grep') return null
@@ -45,15 +45,15 @@ export const toolGrep: RuleSpec = {
   },
   message(_finding: Finding, ctx: MessageContext) {
     return {
-      user: 'Blocked grep. Use `rg` (same job, faster, repo-aware), `ast-grep` for structural search, or `ctx_search` for the indexed search.',
+      user: 'Blocked grep. Pick the tool for the question: `ast-grep` for code shapes, `search` for docs by meaning, `crg` for callers and impact, `rg` for literal text, `ctx_search` for the indexed code search.',
       agent:
-        'DENIED grep. Use one of these instead - all are on PATH and already allowed:\n' +
-        '  rg          drop-in for grep, including stdin: `npm test 2>&1 | rg "pass|fail"`\n' +
-        '  ast-grep    structural/syntax search, for shapes rather than strings\n' +
-        '  search      hybrid semantic + keyword over indexed docs (`search query "<text>"`)\n' +
+        'DENIED grep. Match the tool to the question - in this order, all on PATH and already allowed:\n' +
+        '  ast-grep  code STRUCTURE: shapes rather than strings (`ast-grep -p "foo($A)" -l ts`)\n' +
+        '  search    docs and plans by MEANING: hybrid semantic + keyword (`search query "<text>"`)\n' +
+        '  crg       the code GRAPH: callers, callees, impact (`crg query callers_of <fn>`, `crg impact`)\n' +
+        '  rg        LITERAL text or regex, including stdin: `npm test 2>&1 | rg "pass|fail"`\n' +
         '  ctx_search  the indexed code search (action=symbol for an exact symbol)\n' +
-        'This applies to a pure output filter too: `rg` reads stdin exactly as grep does, ' +
-        'so there is no capability being removed here, only a slower tool. ' +
+        'A pure output filter is no exception: `rg` reads stdin exactly as grep does. ' +
         `Blocked command: ${ctx.snippet}`,
     }
   },