@cleocode/git-shim 2026.4.117 → 2026.4.124

package/dist/__tests__/denylist.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tests for the git-shim denylist (T1118 L2).
+ *
+ * Verifies:
+ * - Blocked operations are correctly identified for restricted roles.
+ * - Allowed operations pass through.
+ * - Flag-based matching works for subcommands like `branch` and `reset`.
+ *
+ * @task T1118
+ * @task T1121
+ */
+export {};
+//# sourceMappingURL=denylist.test.d.ts.map

package/dist/__tests__/denylist.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denylist.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/denylist.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/__tests__/denylist.test.js

@@ -0,0 +1,130 @@
+/**
+ * Tests for the git-shim denylist (T1118 L2).
+ *
+ * Verifies:
+ * - Blocked operations are correctly identified for restricted roles.
+ * - Allowed operations pass through.
+ * - Flag-based matching works for subcommands like `branch` and `reset`.
+ *
+ * @task T1118
+ * @task T1121
+ */
+import { describe, expect, it } from 'vitest';
+import { findDeniedOp, RESTRICTED_ROLES } from '../denylist.js';
+describe('RESTRICTED_ROLES', () => {
+    it('includes worker, lead, subagent', () => {
+        expect(RESTRICTED_ROLES.has('worker')).toBe(true);
+        expect(RESTRICTED_ROLES.has('lead')).toBe(true);
+        expect(RESTRICTED_ROLES.has('subagent')).toBe(true);
+    });
+    it('does not include orchestrator', () => {
+        expect(RESTRICTED_ROLES.has('orchestrator')).toBe(false);
+    });
+});
+describe('findDeniedOp', () => {
+    describe('unconditionally blocked subcommands', () => {
+        it('blocks git checkout', () => {
+            const result = findDeniedOp('checkout', []);
+            expect(result).not.toBeNull();
+            expect(result?.subcommand).toBe('checkout');
+        });
+        it('blocks git checkout with args', () => {
+            const result = findDeniedOp('checkout', ['main']);
+            expect(result).not.toBeNull();
+        });
+        it('blocks git switch', () => {
+            expect(findDeniedOp('switch', [])).not.toBeNull();
+        });
+        it('blocks git rebase', () => {
+            expect(findDeniedOp('rebase', [])).not.toBeNull();
+        });
+        it('blocks git rebase -i', () => {
+            expect(findDeniedOp('rebase', ['-i', 'HEAD~3'])).not.toBeNull();
+        });
+        it('blocks git update-ref', () => {
+            expect(findDeniedOp('update-ref', ['HEAD', 'abc123'])).not.toBeNull();
+        });
+    });
+    describe('flag-gated blocked subcommands', () => {
+        it('blocks git branch -b', () => {
+            expect(findDeniedOp('branch', ['-b', 'my-branch'])).not.toBeNull();
+        });
+        it('blocks git branch -D', () => {
+            expect(findDeniedOp('branch', ['-D', 'my-branch'])).not.toBeNull();
+        });
+        it('blocks git branch -d', () => {
+            expect(findDeniedOp('branch', ['-d', 'my-branch'])).not.toBeNull();
+        });
+        it('allows git branch (list)', () => {
+            expect(findDeniedOp('branch', [])).toBeNull();
+        });
+        it('allows git branch -a (list all)', () => {
+            expect(findDeniedOp('branch', ['-a'])).toBeNull();
+        });
+        it('blocks git reset --hard', () => {
+            expect(findDeniedOp('reset', ['--hard'])).not.toBeNull();
+        });
+        it('allows git reset --soft', () => {
+            expect(findDeniedOp('reset', ['--soft', 'HEAD~1'])).toBeNull();
+        });
+        it('allows git reset (mixed)', () => {
+            expect(findDeniedOp('reset', ['HEAD~1'])).toBeNull();
+        });
+        it('blocks git clean -f', () => {
+            expect(findDeniedOp('clean', ['-f'])).not.toBeNull();
+        });
+        it('blocks git clean -fdx', () => {
+            expect(findDeniedOp('clean', ['-fdx'])).not.toBeNull();
+        });
+        it('blocks git stash pop', () => {
+            expect(findDeniedOp('stash', ['pop'])).not.toBeNull();
+        });
+        it('blocks git stash apply', () => {
+            expect(findDeniedOp('stash', ['apply'])).not.toBeNull();
+        });
+        it('allows git stash push', () => {
+            expect(findDeniedOp('stash', ['push'])).toBeNull();
+        });
+        it('allows git stash list', () => {
+            expect(findDeniedOp('stash', ['list'])).toBeNull();
+        });
+        it('blocks git push --force', () => {
+            expect(findDeniedOp('push', ['--force'])).not.toBeNull();
+        });
+        it('blocks git push -f', () => {
+            expect(findDeniedOp('push', ['-f', 'origin', 'main'])).not.toBeNull();
+        });
+        it('allows git push (normal)', () => {
+            expect(findDeniedOp('push', ['origin', 'task/T1118'])).toBeNull();
+        });
+        it('blocks git worktree add', () => {
+            expect(findDeniedOp('worktree', ['add', '/some/path'])).not.toBeNull();
+        });
+        it('blocks git worktree remove', () => {
+            expect(findDeniedOp('worktree', ['remove', '/some/path'])).not.toBeNull();
+        });
+        it('allows git worktree list', () => {
+            expect(findDeniedOp('worktree', ['list'])).toBeNull();
+        });
+    });
+    describe('always-allowed subcommands', () => {
+        const allowed = [
+            ['status', []],
+            ['log', ['--oneline']],
+            ['diff', ['HEAD~1']],
+            ['show', ['HEAD']],
+            ['add', ['.']],
+            ['commit', ['-m', 'message']],
+            ['fetch', ['origin']],
+            ['ls-files', []],
+            ['rev-parse', ['HEAD']],
+            ['cat-file', ['-p', 'HEAD:file.ts']],
+        ];
+        for (const [sub, args] of allowed) {
+            it(`allows git ${sub}`, () => {
+                expect(findDeniedOp(sub, [...args])).toBeNull();
+            });
+        }
+    });
+});
+//# sourceMappingURL=denylist.test.js.map

package/dist/__tests__/denylist.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denylist.test.js","sourceRoot":"","sources":["../../src/__tests__/denylist.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEhE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAClD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mBAAmB,EAAE,GAAG,EAAE;YAC3B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAC9C,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;YAC7B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;YAC/B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;YAClC,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;QAC1C,MAAM,OAAO,GAAG;YACd,CAAC,QAAQ,EAAE,EAAE,CAAC;YACd,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,CAAC;YACtB,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;YACpB,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC7B,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;YACrB,CAAC,UAAU,EAAE,EAAE,CAAC;YAChB,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;SAC5B,CAAC;QAEX,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YAClC,EAAE,CAAC,cAAc,GAAG,EAAE,EAAE,GAAG,EAAE;gBAC3B,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAClD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/denylist.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Branch-mutation denylist for the git-shim binary (T1118 L2).
+ *
+ * When CLEO_AGENT_ROLE is set to a restricted role (worker|lead|subagent),
+ * any git invocation matching an entry in this list is rejected with exit 1
+ * and a structured error on stderr.
+ *
+ * The allowlist is implicit: any subcommand NOT in the denylist passes through
+ * to real git transparently.
+ *
+ * @task T1118
+ * @task T1121
+ */
+import type { DeniedGitOp } from '@cleocode/contracts';
+/**
+ * Roles that are subject to the branch-mutation denylist.
+ *
+ * Orchestrators bypass the shim entirely.
+ *
+ * @task T1118
+ * @task T1121
+ */
+export declare const RESTRICTED_ROLES: Set<string>;
+/**
+ * Branch-mutating git operations that are denied for restricted roles.
+ *
+ * Entries are matched against argv[1] (subcommand) and optional flags.
+ * When a flag is present, BOTH the subcommand AND the flag must appear.
+ *
+ * @remarks
+ * - `flag: undefined` means any invocation of the subcommand is denied.
+ * - `flag: "--hard"` means only `git reset --hard` is denied; `git reset
+ *   --soft` passes through.
+ *
+ * @task T1118
+ * @task T1121
+ */
+export declare const GIT_OP_DENYLIST: ReadonlyArray<DeniedGitOp>;
+/**
+ * Determine whether a git invocation should be denied for a restricted role.
+ *
+ * @param subcommand - The git subcommand (argv[1]).
+ * @param args - The remaining arguments (argv[2..]).
+ * @returns The matching {@link DeniedGitOp} if denied, or null if allowed.
+ */
+export declare function findDeniedOp(subcommand: string, args: string[]): DeniedGitOp | null;
+//# sourceMappingURL=denylist.d.ts.map

package/dist/denylist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"denylist.d.ts","sourceRoot":"","sources":["../src/denylist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,aAA0C,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,WAAW,CA+JtD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,WAAW,GAAG,IAAI,CAenF"}

package/dist/denylist.js

@@ -0,0 +1,211 @@
+/**
+ * Branch-mutation denylist for the git-shim binary (T1118 L2).
+ *
+ * When CLEO_AGENT_ROLE is set to a restricted role (worker|lead|subagent),
+ * any git invocation matching an entry in this list is rejected with exit 1
+ * and a structured error on stderr.
+ *
+ * The allowlist is implicit: any subcommand NOT in the denylist passes through
+ * to real git transparently.
+ *
+ * @task T1118
+ * @task T1121
+ */
+/**
+ * Roles that are subject to the branch-mutation denylist.
+ *
+ * Orchestrators bypass the shim entirely.
+ *
+ * @task T1118
+ * @task T1121
+ */
+export const RESTRICTED_ROLES = new Set(['worker', 'lead', 'subagent']);
+/**
+ * Branch-mutating git operations that are denied for restricted roles.
+ *
+ * Entries are matched against argv[1] (subcommand) and optional flags.
+ * When a flag is present, BOTH the subcommand AND the flag must appear.
+ *
+ * @remarks
+ * - `flag: undefined` means any invocation of the subcommand is denied.
+ * - `flag: "--hard"` means only `git reset --hard` is denied; `git reset
+ *   --soft` passes through.
+ *
+ * @task T1118
+ * @task T1121
+ */
+export const GIT_OP_DENYLIST = [
+    // Branch-switching operations
+    {
+        subcommand: 'checkout',
+        reason: 'agents MUST NOT switch branches — use the assigned worktree branch',
+    },
+    {
+        subcommand: 'switch',
+        reason: 'agents MUST NOT switch branches — use the assigned worktree branch',
+    },
+    // Branch mutation
+    {
+        subcommand: 'branch',
+        flag: '-b',
+        reason: 'agents MUST NOT create branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '-B',
+        reason: 'agents MUST NOT create/reset branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '-D',
+        reason: 'agents MUST NOT delete branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '-d',
+        reason: 'agents MUST NOT delete branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '--delete',
+        reason: 'agents MUST NOT delete branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '-m',
+        reason: 'agents MUST NOT rename branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '-M',
+        reason: 'agents MUST NOT rename branches — the orchestrator manages branch lifecycle',
+    },
+    {
+        subcommand: 'branch',
+        flag: '--move',
+        reason: 'agents MUST NOT rename branches — the orchestrator manages branch lifecycle',
+    },
+    // Worktree operations (workers must not create/remove worktrees)
+    {
+        subcommand: 'worktree',
+        flag: 'add',
+        reason: 'agents MUST NOT create worktrees — the orchestrator manages worktree lifecycle',
+    },
+    {
+        subcommand: 'worktree',
+        flag: 'remove',
+        reason: 'agents MUST NOT remove worktrees — the orchestrator manages worktree lifecycle',
+    },
+    {
+        subcommand: 'worktree',
+        flag: 'move',
+        reason: 'agents MUST NOT move worktrees — the orchestrator manages worktree lifecycle',
+    },
+    {
+        subcommand: 'worktree',
+        flag: 'lock',
+        reason: 'agents MUST NOT lock/unlock worktrees — the orchestrator manages worktree lifecycle',
+    },
+    {
+        subcommand: 'worktree',
+        flag: 'unlock',
+        reason: 'agents MUST NOT lock/unlock worktrees — the orchestrator manages worktree lifecycle',
+    },
+    {
+        subcommand: 'worktree',
+        flag: 'prune',
+        reason: 'agents MUST NOT prune worktrees — the orchestrator manages worktree lifecycle',
+    },
+    // Destructive reset
+    {
+        subcommand: 'reset',
+        flag: '--hard',
+        reason: 'agents MUST NOT hard-reset — create a new commit or use `git restore` instead',
+    },
+    {
+        subcommand: 'reset',
+        flag: '--merge',
+        reason: 'agents MUST NOT merge-reset — create a new commit or use `git restore` instead',
+    },
+    {
+        subcommand: 'reset',
+        flag: '--keep',
+        reason: 'agents MUST NOT keep-reset — create a new commit or use `git restore` instead',
+    },
+    // Clean operations
+    {
+        subcommand: 'clean',
+        flag: '-f',
+        reason: 'agents MUST NOT force-clean — use `git restore` for individual files',
+    },
+    {
+        subcommand: 'clean',
+        flag: '-fd',
+        reason: 'agents MUST NOT force-clean directories — use `git restore` for individual files',
+    },
+    {
+        subcommand: 'clean',
+        flag: '-fdx',
+        reason: 'agents MUST NOT force-clean directories including ignored files — unsafe for agents',
+    },
+    // Rebase (rewrites history)
+    {
+        subcommand: 'rebase',
+        reason: "agents MUST NOT rebase — history rewriting is the orchestrator's responsibility",
+    },
+    // Stash pop/apply (applies stashed changes to working tree)
+    {
+        subcommand: 'stash',
+        flag: 'pop',
+        reason: 'agents MUST NOT pop stashes — use explicit git apply or cherry-pick instead',
+    },
+    {
+        subcommand: 'stash',
+        flag: 'apply',
+        reason: 'agents MUST NOT apply stashes — use explicit git apply or cherry-pick instead',
+    },
+    // Direct ref manipulation
+    {
+        subcommand: 'update-ref',
+        reason: 'agents MUST NOT directly manipulate refs — use commits instead',
+    },
+    // Force push
+    {
+        subcommand: 'push',
+        flag: '-f',
+        reason: 'agents MUST NOT force-push — the orchestrator manages push lifecycle',
+    },
+    {
+        subcommand: 'push',
+        flag: '--force',
+        reason: 'agents MUST NOT force-push — the orchestrator manages push lifecycle',
+    },
+    {
+        subcommand: 'push',
+        flag: '--force-with-lease',
+        reason: 'agents MUST NOT force-push — the orchestrator manages push lifecycle',
+    },
+];
+/**
+ * Determine whether a git invocation should be denied for a restricted role.
+ *
+ * @param subcommand - The git subcommand (argv[1]).
+ * @param args - The remaining arguments (argv[2..]).
+ * @returns The matching {@link DeniedGitOp} if denied, or null if allowed.
+ */
+export function findDeniedOp(subcommand, args) {
+    for (const entry of GIT_OP_DENYLIST) {
+        if (entry.subcommand !== subcommand)
+            continue;
+        if (entry.flag === undefined) {
+            // Any invocation of this subcommand is denied.
+            return entry;
+        }
+        // Check if the flag appears anywhere in the argument list.
+        if (args.includes(entry.flag)) {
+            return entry;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=denylist.js.map

package/dist/denylist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denylist.js","sourceRoot":"","sources":["../src/denylist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAExE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAA+B;IACzD,8BAA8B;IAC9B;QACE,UAAU,EAAE,UAAU;QACtB,MAAM,EAAE,oEAAoE;KAC7E;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,oEAAoE;KAC7E;IAED,kBAAkB;IAClB;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,mFAAmF;KAC5F;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,QAAQ;QACpB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,6EAA6E;KACtF;IAED,iEAAiE;IACjE;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,8EAA8E;KACvF;IACD;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,qFAAqF;KAC9F;IACD;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,qFAAqF;KAC9F;IACD;QACE,UAAU,EAAE,UAAU;QACtB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,+EAA+E;KACxF;IAED,oBAAoB;IACpB;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,+EAA+E;KACxF;IACD;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,+EAA+E;KACxF;IAED,mBAAmB;IACnB;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,sEAAsE;KAC/E;IACD;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,kFAAkF;KAC3F;IACD;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,qFAAqF;KAC9F;IAED,4BAA4B;IAC5B;QACE,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,iFAAiF;KAC1F;IAED,4DAA4D;IAC5D;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,6EAA6E;KACtF;IACD;QACE,UAAU,EAAE,OAAO;QACnB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,+EAA+E;KACxF;IAED,0BAA0B;IAC1B;QACE,UAAU,EAAE,YAAY;QACxB,MAAM,EAAE,gEAAgE;KACzE;IAED,aAAa;IACb;QACE,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE,IAAI;QACV,MAAM,EAAE,sEAAsE;KAC/E;IACD;QACE,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,sEAAsE;KAC/E;IACD;QACE,UAAU,EAAE,MAAM;QAClB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,sEAAsE;KAC/E;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAc;IAC7D,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;YAAE,SAAS;QAE9C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,+CAA+C;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,2DAA2D;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * @cleocode/git-shim — Harness-agnostic git branch-mutation fence.
+ *
+ * Exports the denylist utilities so other packages can inspect the
+ * blocked operation table without executing the shim binary.
+ *
+ * The shim binary itself lives at `dist/shim.js` and is registered
+ * as the `git` bin entry in package.json.
+ *
+ * @task T1118
+ * @task T1121
+ * @packageDocumentation
+ */
+export type {} from './denylist.js';
+export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
+/**
+ * Install the shim symlink so that `git` resolves to this shim when
+ * the shim directory is on PATH.
+ *
+ * Creates `<shimDir>/git` as a symlink pointing at the shim binary.
+ * The shim binary itself is the `dist/shim.js` file emitted by tsc.
+ *
+ * @param shimDir - Directory to place the `git` symlink in.
+ * @param shimBinPath - Absolute path to the compiled shim binary (dist/shim.js).
+ * @returns Whether the symlink was created or already existed.
+ * @task T1118
+ * @task T1121
+ */
+export declare function installShimSymlink(shimDir: string, shimBinPath: string): Promise<boolean>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC/F"}

package/dist/index.js

@@ -0,0 +1,63 @@
+/**
+ * @cleocode/git-shim — Harness-agnostic git branch-mutation fence.
+ *
+ * Exports the denylist utilities so other packages can inspect the
+ * blocked operation table without executing the shim binary.
+ *
+ * The shim binary itself lives at `dist/shim.js` and is registered
+ * as the `git` bin entry in package.json.
+ *
+ * @task T1118
+ * @task T1121
+ * @packageDocumentation
+ */
+export { findDeniedOp, GIT_OP_DENYLIST, RESTRICTED_ROLES } from './denylist.js';
+/**
+ * Install the shim symlink so that `git` resolves to this shim when
+ * the shim directory is on PATH.
+ *
+ * Creates `<shimDir>/git` as a symlink pointing at the shim binary.
+ * The shim binary itself is the `dist/shim.js` file emitted by tsc.
+ *
+ * @param shimDir - Directory to place the `git` symlink in.
+ * @param shimBinPath - Absolute path to the compiled shim binary (dist/shim.js).
+ * @returns Whether the symlink was created or already existed.
+ * @task T1118
+ * @task T1121
+ */
+export async function installShimSymlink(shimDir, shimBinPath) {
+    const { existsSync, mkdirSync, symlinkSync, unlinkSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    mkdirSync(shimDir, { recursive: true });
+    const linkPath = join(shimDir, 'git');
+    // Remove stale symlink if it points somewhere wrong.
+    if (existsSync(linkPath)) {
+        try {
+            const { readlinkSync } = await import('node:fs');
+            const target = readlinkSync(linkPath);
+            if (target === shimBinPath)
+                return true; // already correct
+            unlinkSync(linkPath);
+        }
+        catch {
+            try {
+                unlinkSync(linkPath);
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+    try {
+        symlinkSync(shimBinPath, linkPath);
+        // Ensure the shim binary is executable.
+        const { chmodSync } = await import('node:fs');
+        chmodSync(shimBinPath, 0o755);
+        return true;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Failed to install git shim symlink at ${linkPath}: ${message}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAmB;IAC3E,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACnF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAE3C,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtC,qDAAqD;IACrD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;YAC3D,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,UAAU,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnC,wCAAwC;QACxC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAK,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC"}

package/dist/shim.d.ts

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+/**
+ * git-shim — harness-agnostic git branch-mutation fence (T1118 L2).
+ *
+ * Usage: place this binary on PATH BEFORE real git, and export:
+ *   CLEO_AGENT_ROLE=worker   (or lead|subagent)
+ *   CLEO_WORKTREE_ROOT=<path>
+ *
+ * Behaviour:
+ *   - If CLEO_AGENT_ROLE is a restricted role AND the git subcommand is in
+ *     the denylist AND CLEO_ALLOW_BRANCH_OPS is not set: print structured
+ *     error to stderr, exit 1.
+ *   - If CLEO_ALLOW_BRANCH_OPS=1: log a warning and pass through (escape hatch).
+ *   - Otherwise: exec real git with all original args (zero overhead path).
+ *
+ * The real git binary is resolved from CLEO_REAL_GIT_PATH env (override) or
+ * discovered by walking PATH and skipping any entry that resolves to this
+ * shim itself (detected via CLEO_SHIM_MARKER env set by the shim installer).
+ *
+ * Exit codes:
+ *   0   — passthrough succeeded (real git exited 0)
+ *   1   — git op blocked by shim
+ *   77  — well-known CLEO_GIT_BLOCKED sentinel (same as exit 1 but distinguishable)
+ *   N   — real git exit code propagated
+ *
+ * @task T1118
+ * @task T1121
+ */
+export {};
+//# sourceMappingURL=shim.d.ts.map

package/dist/shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.d.ts","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG"}

package/dist/shim.js

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+/**
+ * git-shim — harness-agnostic git branch-mutation fence (T1118 L2).
+ *
+ * Usage: place this binary on PATH BEFORE real git, and export:
+ *   CLEO_AGENT_ROLE=worker   (or lead|subagent)
+ *   CLEO_WORKTREE_ROOT=<path>
+ *
+ * Behaviour:
+ *   - If CLEO_AGENT_ROLE is a restricted role AND the git subcommand is in
+ *     the denylist AND CLEO_ALLOW_BRANCH_OPS is not set: print structured
+ *     error to stderr, exit 1.
+ *   - If CLEO_ALLOW_BRANCH_OPS=1: log a warning and pass through (escape hatch).
+ *   - Otherwise: exec real git with all original args (zero overhead path).
+ *
+ * The real git binary is resolved from CLEO_REAL_GIT_PATH env (override) or
+ * discovered by walking PATH and skipping any entry that resolves to this
+ * shim itself (detected via CLEO_SHIM_MARKER env set by the shim installer).
+ *
+ * Exit codes:
+ *   0   — passthrough succeeded (real git exited 0)
+ *   1   — git op blocked by shim
+ *   77  — well-known CLEO_GIT_BLOCKED sentinel (same as exit 1 but distinguishable)
+ *   N   — real git exit code propagated
+ *
+ * @task T1118
+ * @task T1121
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { findDeniedOp, RESTRICTED_ROLES } from './denylist.js';
+/** Sentinel exit code for a shim-blocked git operation. */
+const BLOCKED_EXIT_CODE = 77;
+/**
+ * Read and validate the CLEO agent role from the environment.
+ *
+ * @returns The agent role string, or null if not set or not restricted.
+ */
+function getAgentRole() {
+    const role = process.env['CLEO_AGENT_ROLE'];
+    if (!role)
+        return null;
+    return RESTRICTED_ROLES.has(role) ? role : null;
+}
+/**
+ * Resolve the path to the real git binary.
+ *
+ * Strategy:
+ * 1. If CLEO_REAL_GIT_PATH env is set, use it (override for testing).
+ * 2. Walk PATH entries, skip the first one that contains CLEO_SHIM_MARKER.
+ * 3. Fall back to /usr/bin/git, /usr/local/bin/git, /opt/homebrew/bin/git.
+ *
+ * @returns Absolute path to real git, or null if not found.
+ */
+function resolveRealGit() {
+    // Explicit override wins — useful for tests.
+    const override = process.env['CLEO_REAL_GIT_PATH'];
+    if (override && existsSync(override))
+        return override;
+    const shimMarker = process.env['CLEO_SHIM_MARKER'] ?? '.cleo/bin/git-shim';
+    const pathDirs = (process.env['PATH'] ?? '').split(':');
+    for (const dir of pathDirs) {
+        // Skip directories that look like the shim directory.
+        if (dir.includes(shimMarker))
+            continue;
+        const candidate = join(dir, 'git');
+        if (existsSync(candidate))
+            return candidate;
+    }
+    // Hard fallbacks for common installations.
+    const fallbacks = ['/usr/bin/git', '/usr/local/bin/git', '/opt/homebrew/bin/git'];
+    for (const fb of fallbacks) {
+        if (existsSync(fb))
+            return fb;
+    }
+    return null;
+}
+/**
+ * Emit a structured JSON error line to stderr.
+ *
+ * Format mirrors LAFS error envelopes so parsers can detect it.
+ *
+ * @param code - CLEO error code string.
+ * @param message - Human-readable message.
+ * @param context - Additional key/value context.
+ */
+function emitBlockedError(code, message, context) {
+    process.stderr.write(JSON.stringify({
+        cleo_error: true,
+        code,
+        message,
+        ...context,
+    }) + '\n');
+    // Also emit a plain-text line so human readers can understand without parsing.
+    process.stderr.write(`[git-shim] BLOCKED: ${message}\n` +
+        `[git-shim] Set CLEO_ALLOW_BRANCH_OPS=1 to bypass (audited).\n`);
+}
+/**
+ * Main shim entry point.
+ *
+ * Reads argv, env, applies the denylist, and either blocks or passes through
+ * to the real git binary.
+ */
+function main() {
+    const argv = process.argv.slice(2); // strip "node" and shim path
+    const subcommand = argv[0];
+    // Fast path: no subcommand → pass through (git with no args shows usage).
+    if (!subcommand) {
+        const realGit = resolveRealGit();
+        if (!realGit) {
+            process.stderr.write('[git-shim] ERROR: real git binary not found\n');
+            process.exit(1);
+        }
+        const result = spawnSync(realGit, argv, { stdio: 'inherit' });
+        process.exit(result.status ?? 1);
+        return;
+    }
+    const role = getAgentRole();
+    // Fast path: no restricted role → pass through unconditionally.
+    if (!role) {
+        const realGit = resolveRealGit();
+        if (!realGit) {
+            process.stderr.write('[git-shim] ERROR: real git binary not found\n');
+            process.exit(1);
+        }
+        const result = spawnSync(realGit, argv, { stdio: 'inherit' });
+        process.exit(result.status ?? 1);
+        return;
+    }
+    // Check escape hatch — operator has explicitly permitted this one invocation.
+    const allowBranchOps = process.env['CLEO_ALLOW_BRANCH_OPS'] === '1';
+    const remainingArgs = argv.slice(1);
+    const denied = findDeniedOp(subcommand, remainingArgs);
+    if (denied && !allowBranchOps) {
+        const worktreeRoot = process.env['CLEO_WORKTREE_ROOT'] ?? '(unknown)';
+        emitBlockedError('E_GIT_OP_BLOCKED', `git ${subcommand}${denied.flag ? ` ${denied.flag}` : ''} is not allowed for role '${role}': ${denied.reason}`, {
+            subcommand,
+            flag: denied.flag ?? '',
+            role,
+            worktree_root: worktreeRoot,
+        });
+        process.exit(BLOCKED_EXIT_CODE);
+        return;
+    }
+    if (denied && allowBranchOps) {
+        // Escape hatch used — log an audit warning.
+        process.stderr.write(`[git-shim] WARNING: CLEO_ALLOW_BRANCH_OPS=1 bypassed block for ` +
+            `'git ${subcommand}' (role=${role}). This bypass is audited.\n`);
+    }
+    // Pass through to real git.
+    const realGit = resolveRealGit();
+    if (!realGit) {
+        process.stderr.write('[git-shim] ERROR: real git binary not found on PATH\n');
+        process.exit(1);
+    }
+    const result = spawnSync(realGit, argv, { stdio: 'inherit' });
+    process.exit(result.status ?? 0);
+}
+main();
+//# sourceMappingURL=shim.js.map

package/dist/shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shim.js","sourceRoot":"","sources":["../src/shim.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAE/D,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAE7B;;;;GAIG;AACH,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc;IACrB,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,oBAAoB,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,sDAAsD;QACtD,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IAED,2CAA2C;IAC3C,MAAM,SAAS,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC;IAClF,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAA+B;IACtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,IAAI,CAAC,SAAS,CAAC;QACb,UAAU,EAAE,IAAI;QAChB,IAAI;QACJ,OAAO;QACP,GAAG,OAAO;KACX,CAAC,GAAG,IAAI,CACV,CAAC;IACF,+EAA+E;IAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uBAAuB,OAAO,IAAI;QAChC,+DAA+D,CAClE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,IAAI;IACX,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,6BAA6B;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAE3B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;IAE5B,gEAAgE;IAChE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IAED,8EAA8E;IAC9E,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;IAEpE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAEvD,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,WAAW,CAAC;QACtE,gBAAgB,CACd,kBAAkB,EAClB,OAAO,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,6BAA6B,IAAI,MAAM,MAAM,CAAC,MAAM,EAAE,EAC9G;YACE,UAAU;YACV,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;YACvB,IAAI;YACJ,aAAa,EAAE,YAAY;SAC5B,CACF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,IAAI,cAAc,EAAE,CAAC;QAC7B,4CAA4C;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iEAAiE;YAC/D,QAAQ,UAAU,WAAW,IAAI,8BAA8B,CAClE,CAAC;IACJ,CAAC;IAED,4BAA4B;IAC5B,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,IAAI,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/git-shim",
-  "version": "2026.4.117",
+  "version": "2026.4.124",
   "private": false,
   "type": "module",
   "description": "Harness-agnostic git shim for CLEO agent branch-protection (T1118)",
@@ -32,15 +32,17 @@
   "author": "CLEO Code <hello@cleocode.dev>",
   "license": "MIT",
   "dependencies": {
-    "@cleocode/contracts": "2026.4.117"
+    "@cleocode/contracts": "2026.4.124"
   },
   "devDependencies": {
     "@types/node": "^24.3.0",
     "typescript": "^6.0.2",
     "vitest": "^4.1.4"
   },
-  "publishConfig": {
-    "access": "public"
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/kryptobaseddev/cleo",
+    "directory": "packages/git-shim"
   },
   "scripts": {
     "build": "tsc -b",