@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.8 → 0.1.9

package/bin/adl

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/bin/adl
 size: 82920928 bytes
-sha256: ecd5111c7bc2c06d56361450a0d97b8280f6d300f879714a0bd23d2c534ec61b
+sha256: 74d2d0af04a268afff30746e0d68d9d49d8e92c347e913330393c90362c99aff

package/bin/git

@@ -621,8 +621,76 @@ case "$command_name" in
   *) exec "$real_git" ${args[@]+"${args[@]}"} ;;
 esac
 
+# Whether option ARG, for network subcommand SUB, consumes the NEXT argv
+# element as its value.  Incident 2026-09-30 (Azure DevOps push 16505 recorded
+# as the HUMAN "Tarun Rana" for an agent session's `git push -u origin
+# feat/adl-install`): one shared value-option list treated `-u` as taking a
+# value for EVERY subcommand.  It only does for ls-remote/clone
+# (`--upload-pack <exec>`); for push it is `--set-upstream` and for fetch/pull
+# `--update-head-ok`, both flags.  `origin` was swallowed as the "value",
+# `feat/adl-install` became the "remote", `remote get-url` failed, and the
+# push went to plain git and the human's credential helper.  The table is
+# therefore PER SUBCOMMAND (verified against git-push/fetch/pull/ls-remote/
+# clone(1)).  Options whose argument is optional (`--force-with-lease`,
+# `--recurse-submodules` on fetch/pull/clone, `-S`, `-r`) only take it
+# attached (`--opt=value`) and so never consume the next element.
+network_option_takes_value() {
+  local sub="$1" arg="$2" short_values long_values chars i ch
+  local fetch_long=' depth deepen shallow-since shallow-exclude negotiation-tip negotiation-restrict negotiation-include filter refmap jobs server-option upload-pack exec submodule-prefix recurse-submodules-default bundle-uri '
+  case "$sub" in
+    push) short_values='o'; long_values=' push-option receive-pack exec repo recurse-submodules ' ;;
+    fetch) short_values='jo'; long_values="$fetch_long" ;;
+    pull) short_values='josX'; long_values="$fetch_long strategy strategy-option cleanup into-name " ;;
+    ls-remote) short_values='ou'; long_values=' upload-pack exec server-option sort ' ;;
+    clone) short_values='obucj'; long_values=' origin branch upload-pack template config separate-git-dir ref-format jobs bundle-uri depth shallow-since shallow-exclude reference reference-if-able server-option filter revision object-format ' ;;
+    *) return 1 ;;
+  esac
+  case "$arg" in
+    --|--*=*) return 1 ;;
+    --*) [[ "$long_values" == *" ${arg#--} "* ]] ;;
+    -?) [[ "$short_values" == *"${arg#-}"* ]] ;;
+    -*)
+      # Clustered short options (`-uf`, `-fo x`): the first value-taking
+      # letter ends the cluster; it consumes the next element only when it is
+      # the LAST letter (otherwise the rest of the cluster is its value).
+      chars="${arg#-}"
+      for ((i = 0; i < ${#chars}; i += 1)); do
+        ch="${chars:i:1}"
+        if [[ "$short_values" == *"$ch"* ]]; then
+          ((i == ${#chars} - 1)) && return 0
+          return 1
+        fi
+      done
+      return 1
+      ;;
+    *) return 1 ;;
+  esac
+}
+
+# True when OPERAND (an unresolved would-be remote name) is really a local
+# path or a URL, which plain git handles without any named remote: an
+# absolute/relative/home path, an existing path (relative to any leading
+# `-C <dir>`), a `scheme://` URL, or scp-like `host:path`.
+is_path_or_url_operand() {
+  local operand="$1" base='' i
+  case "$operand" in
+    /*|./*|../*|~*|.|..|*://*) return 0 ;;
+  esac
+  is_scp_like_url "$operand" && return 0
+  for ((i = 0; i < command_index; i += 1)); do
+    if [[ "${args[i]}" == -C && $((i + 1)) -lt command_index ]]; then
+      case "${args[i + 1]}" in
+        /*) base="${args[i + 1]}" ;;
+        *) base="${base:+$base/}${args[i + 1]}" ;;
+      esac
+    fi
+  done
+  [[ -e "${base:+$base/}$operand" ]]
+}
+
 remote_url=''
 remote_name='origin'
+remote_explicit=0
 
 # A direct URL is authoritative for every network command.  Scan it before
 # resolving a remote name so clone, ls-remote, and explicit fetch/push/pull URLs never
@@ -635,24 +703,27 @@ for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
 done
 
 if [[ -z "$remote_url" ]]; then
-  # The first positional argument to fetch, pull, push, and ls-remote is the selected
-  # remote.  Skip the common options that carry a following value; unknown
-  # options are skipped rather than treated as a remote name.
+  # The first positional argument to fetch, pull, push, and ls-remote is the
+  # selected remote.  Skip options (and the value of those that take one FOR
+  # THIS SUBCOMMAND, see network_option_takes_value); other options are
+  # skipped rather than treated as a remote name.
   for ((index = command_index + 1; index < ${#args[@]}; index += 1)); do
     argument="${args[index]}"
     case "$argument" in
       --)
         ((index += 1))
-        ((index < ${#args[@]})) && remote_name="${args[index]}"
+        if ((index < ${#args[@]})); then
+          remote_name="${args[index]}"
+          remote_explicit=1
+        fi
         break
         ;;
-      -c|-j|-o|-u|--depth|--deepen|--filter|--jobs|--negotiation-tip|--push-option|--receive-pack|--refmap|--recurse-submodules|--server-option|--shallow-exclude|--shallow-since|--strategy|--strategy-option|--upload-pack)
-        ((index += 1))
-        ;;
-      -?*|--*=*)
+      -?*)
+        network_option_takes_value "$command_name" "$argument" && ((index += 1))
         ;;
       *)
         remote_name="$argument"
+        remote_explicit=1
         break
         ;;
     esac
@@ -661,6 +732,16 @@ fi
 
 if [[ -z "$remote_url" ]]; then
   if ! remote_url="$("$real_git" "${args[@]:0:command_index}" remote get-url "$remote_name" 2>/dev/null)"; then
+    # FAIL CLOSED (incident 2026-09-30, above): an EXPLICITLY named remote
+    # that does not resolve, and is not a local path or a URL, must never be
+    # handed to plain git -- it would authenticate as the human via the
+    # keychain/credential helper if the name was really an Azure DevOps
+    # remote we mis-scanned.  clone has no remote name (its operand is the
+    # source), and an unnamed default remote keeps today's pass-through.
+    if [[ "$command_name" != clone && "$remote_explicit" == 1 ]] && ! is_path_or_url_operand "$remote_name"; then
+      printf "git: cannot resolve remote '%s' for %s; refusing to pass an unresolved remote to plain git (it may authenticate as the human)\n" "$remote_name" "$command_name" >&2
+      exit 1
+    fi
     exec "$real_git" ${args[@]+"${args[@]}"}
   fi
 fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amsterdamdatalabs/adl-agent-control-linux-x64",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "adl CLI binary for linux/x64 (agent identity + Azure DevOps front door — see docs/architecture/cli-design.md)",
   "license": "UNLICENSED",
   "os": [

package/packages/azdo/src/azdo-repo-doctor.ts

@@ -206,7 +206,9 @@ export const REPO_STANDARD = {
         allow: ["genericContribute", "pullRequestContribute"],
         deny: ["forcePush", "policyExempt", "pullRequestBypassPolicy"],
       },
-      "agent-reviewer": { allow: ["pullRequestContribute"], deny: ["genericContribute"] },
+      // Tarun, 2026-09-30: no agent gets force push — agent-reviewer included,
+      // in every project (only its genericContribute deny is Enact-only).
+      "agent-reviewer": { allow: ["pullRequestContribute"], deny: ["genericContribute", "forcePush"] },
     } as Record<string, { allow: readonly PermissionBitName[]; deny: readonly PermissionBitName[] }>,
     /**
      * The project's build service identity (display name `Build\<projectId>`,
@@ -214,12 +216,17 @@ export const REPO_STANDARD = {
      * — Tarun, 2026-09-27, cross-checked against
      * /Users/tarunrana/Documents/ADL-ISMS-Policies/.scratchpad/ci_build_service_grant.py,
      * which grants exactly these bits on adl-agent-control). CI needs to push
-     * tags/branches and complete PRs on the repo, and needs PolicyExempt only
-     * on `integration` (so a version-bump commit made by CI itself is not
+     * and complete PRs on the repo, and needs PolicyExempt only on
+     * `integration` (so a version-bump commit made by CI itself is not
      * blocked by its own policies) — never on `main`.
+     *
+     * NOT forcePush (Tarun, 2026-09-30): the bump is a plain fast-forward
+     * `git push origin HEAD:integration`; agent-identities' build service has
+     * no ForcePush and bumped 0.4.2 → 0.4.3 fine. The grant script's
+     * ForcePush has no consumer, so force push is required of no identity.
      */
     buildService: {
-      repo: { allow: ["genericContribute", "forcePush", "pullRequestContribute"] } as {
+      repo: { allow: ["genericContribute", "pullRequestContribute"] } as {
         allow: readonly PermissionBitName[];
       },
       integrationRef: { allow: ["policyExempt"] } as { allow: readonly PermissionBitName[] },

package/packages/repo-controls/assets/version-bump.sh

@@ -9,6 +9,11 @@ set -euo pipefail
 # triggering another pipeline run. No npm query, no second PR, no second
 # test run (Tarun, 2026-09-29).
 
+# CI never carries an agent identity: the push below authenticates as the
+# project build service through the checkout's persisted System.AccessToken.
+# Never set an agent identity here, and never inherit one from the caller.
+unset ADL_AGENT_ID_AGENT
+
 die() {
   echo "version-bump: $*" >&2
   exit 1
@@ -185,5 +190,5 @@ fi
 git -C "$repo_root" add -A
 git diff --cached --quiet && die "version bump produced no staged change (expected at least $version_file)"
 git commit -m "chore: bump version $current_version to $next_version ***NO_CI***"
-ADL_AGENT_ID_AGENT=agent-tarun git push origin "HEAD:$integration_branch"
+git push origin "HEAD:$integration_branch"
 echo "Bumped $version_file from $current_version to $next_version on $integration_branch."