@r1z4x/tezgah 1.13.0 → 1.14.0

package/hooks/tezgah_gate.py

@@ -89,6 +89,7 @@ Rules, all only inside a tezgah root:
      removes it: every other switch is one of the files it protects.
 Adapters translate the returned reason into their own permission envelope.
 """
+import fnmatch
 import hashlib
 import json
 import os
@@ -97,14 +98,18 @@ import shlex
 import subprocess
 import sys
 import time
+from glob import iglob
 
 import tezgah_store
 from tezgah_extension import DEFAULT_TIMEOUT_MS, EXT_DIR, MAX_WALK, call_envelope
 
-from tezgah_integrity import (BASH_TOOLS, BEGAN_KIND, ENV_WORD, GIT_VALUE_OPTS,
-                              HEREDOC_RISK, HOOKS_KEY, PATCH_FILE,
-                              PLAIN_TAIL, SECRET_PREFIXED, STEP_KINDS,
-                              WRITE_TOOLS, _blank_heredocs, _heredocs, bind_session,
+from tezgah_integrity import (BASH_TOOLS, BEGAN_KIND, COMMIT_STUCK_SHORTS,
+                              COMMIT_VALUE_SHORTS, GIT_VALUE_OPTS,
+                              HEREDOC_RISK, HOOKS_KEYS, PATCH_FILE,
+                              PLAIN_TAIL, SECRET_PREFIXED, SHELL_KEYWORDS, STEP_KINDS,
+                              WRITE_TOOLS, _abs_target, _blank_heredocs,
+                              _commit_value_long, _heredocs, _shell_scripts,
+                              bind_session, _option_value, _past_wrappers,
                               _shell_commands, _shell_lines, _shell_segments,
                               _turn_start,
                               _unquoted_backticks, call_id, cut, events,
@@ -215,7 +220,7 @@ BASH_SEARCH = re.compile(r"(?:^|[|;&(]\s*|\s)(?:grep|rg)\s+((?:-\S+\s+)*)(\S+)")
 # ponytail: "Drafted with Cursor" passes, and "built using OpenAI, Anthropic and
 # others" is denied once; the deny names the reason, so one rephrase clears it.
 _CREDIT = (
-    r"co-authored-by\s*:|generated with|made with|"
+    r"co-authored-by\s*[:=]|generated with|made with|"
     r"(?:generated|written|authored|built|assisted|drafted|produced|composed)"
     r"\s+by\s+(?:(?:an?|the)\s+)?"
     r"(?:ai|llm|claude|chatgpt|gpt|copilot|codex|cursor|gemini|deepseek|"
@@ -242,17 +247,18 @@ ATTRIB_LINE = re.compile(r"(?im)^[\s>#*/<!+-]*(?:" + _CREDIT + r")")
 EDIT_TEXT = ("content", "new_string", "newString", "new_str", "file_text",
              "patch", "text")
 # the write subcommand may sit behind git's global options: `git -c k=v commit`,
-# `git -C dir commit`, `git --no-pager commit`. `gh api` writes comments/reviews,
-# and `gh pr merge` lands a commit, so both count as writes.
+# `git -C dir commit`, `git --no-pager commit`, and git or gh may be named by
+# its path (`/usr/bin/git commit`, audit B-012). `gh api` writes
+# comments/reviews, and `gh pr merge` lands a commit, so both count as writes.
 # The `gh` subcommands that write to the remote, so this rule counts them as
 # write commands: a PR or an issue comment is a message posted to a service
 # under the workspace's name.
 GH_SUBCOMMANDS = r"(?:create|edit|comment|review|merge|close)"
 WRITE_CMD = re.compile(
-    r"(?:^|[|;&]\s*|\s)git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*"
+    r"(?:^|[|;&]\s*|\s)(?:\S*/)?git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*"
     r"(?:commit|merge|tag|notes)\b|"
-    r"(?:^|[|;&]\s*|\s)gh\s+api\b|"
-    r"(?:^|[|;&]\s*|\s)gh\s+(?:pr|issue|release)\s+" + GH_SUBCOMMANDS + r"\b",
+    r"(?:^|[|;&]\s*|\s)(?:\S*/)?gh\s+api\b|"
+    r"(?:^|[|;&]\s*|\s)(?:\S*/)?gh\s+(?:pr|issue|release)\s+" + GH_SUBCOMMANDS + r"\b",
     re.I)
 
 # --- secret: a credential on its way into a file ----------------------------
@@ -365,7 +371,7 @@ SECRET_FIXTURE = re.compile(r"(?:^|/)tests?/(?:.+/)?fixtures/|\.example$", re.I)
 SECRET_PUBLISHED = frozenset((
     "2cafc0970149a84f3b9e62eaf169f36f59907a3b3e31f7b82e68c69cd27f7326",))
 SECRET_ADD_DENY = (
-    "Credential file add denied: `git add %s` stages a credential file, so every "
+    "Credential file add denied: `%s` stages a credential file, so every "
     "value in it lands in the repository's history. Keep it out of git (list it "
     "in .gitignore) and commit a `.env.example` that carries the names without "
     "the values.")
@@ -408,15 +414,30 @@ ATTRIB_DENY = (
     "use it or describe real behavior is fine; crediting it as author is not.")
 
 
-def attribution(command):
+def attribution(command, depth=0):
     """True when a git/gh write command carries an AI/model credit.
 
     The whole command text is read unanchored, so a credit inside a `-m` value is
     caught wherever it sits. A message that *discusses* the forms is denied too,
     and that is the known cost: the deny names the forms, so one rephrase clears
-    it (see the note on `_CREDIT`)."""
+    it (see the note on `_CREDIT`). The script of a `bash -c` or an `eval` is
+    read the same way (`_shell_scripts`, audit B-012)."""
     c = str(command or "")
-    return bool(WRITE_CMD.search(c) and ATTRIB.search(c))
+    # a quoted or backslashed program (`"/usr/bin/git" commit`, `\git commit`)
+    # is still git, and a trailer key configured on the line names the credit
+    # its `--trailer 'x=...'` carries (review 148); `git config` storing that
+    # key credits every later `--trailer` (review 148 r2)
+    bare = re.sub(r"[\"'\\]", "", c)
+    credit = TRAILER_CREDIT.search(bare)
+    if (WRITE_CMD.search(c) or WRITE_CMD.search(bare)) and (
+            ATTRIB.search(c) or credit) or credit and CONFIG_CMD.search(bare):
+        return True
+    return depth < 3 and any(attribution(s, depth + 1) for s in _shell_scripts(c))
+
+
+TRAILER_CREDIT = re.compile(r"trailer\.\S+\.key(?:\s*=\s*|\s+)co-authored-by\b", re.I)
+CONFIG_CMD = re.compile(r"(?:^|[|;&]\s*|\s)(?:\S*/)?git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*"
+                        r"config\b")
 
 
 def attribution_edit(inp):
@@ -450,16 +471,30 @@ def attribution_edit(inp):
 # draws for its own forms.
 #
 # `git commit -F <file>` is read from the file, resolved against the call's cwd.
+# A branch made by `git worktree add -b`, renamed or copied by `git branch
+# -m/-M/-c/-C` (its new name: the last of the two), a tag `git tag` makes and a
+# remote branch a push refspec names (`HEAD:refs/heads/<name>`) are created
+# identifiers too (audit B-027).
 # ponytail: a file that cannot be read (a missing path, an unreadable one, a
 # binary) is skipped rather than guessed at - the ceiling is named here, and the
 # other commit routes (`--fill`, `-m` used twice) are read for their first
-# argument only.
+# argument only; a tag whose options come before a value-taking `-m` is not read.
 BRANCH_NEW = re.compile(
     r"(?:^|[|;&(]\s*|\s)git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*"
-    r"(?:checkout\s+(?:-\S+\s+)*(?:-b|-B|--branch)\s+"
+    r"(?:checkout\s+(?:-\S+\s+)*(?:(?:-b|-B|--branch)\s+|-[bB](?=[^\s;&|]))"
     r"|switch\s+(?:-\S+\s+)*(?:-c|-C|--create)\s+"
+    r"|worktree\s+add\s+(?:-\S+\s+)*(?:-b|-B)\s+"
+    r"|branch\s+(?:-\S+\s+)*(?:-m|-M|-c|-C|--move|--copy)\s+"
+    r"(?:[^\s;&|-][^\s;&|]*\s+(?=[^\s;&|-]))?"
     r"|branch\s+(?!-))"
     r"([^\s;&|]+)")
+TAG_NEW = re.compile(
+    r"(?:^|[|;&(]\s*|\s)git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*"
+    r"tag\s+(?:(?:-[afs]+|--annotate|--sign|--force)\s+)*([^\s;&|-][^\s;&|]*)")
+PUSH_CMD = re.compile(
+    r"(?:^|[|;&(]\s*|\s)git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*push\b([^|;&]*)")
+# `git push` options that take the next word, so it is not the remote
+PUSH_VALUE_OPTS = frozenset(("-o", "--push-option", "--receive-pack", "--exec"))
 COMMIT_MSG = re.compile(
     r"(?:^|[|;&(]\s*|\s)git\s+(?:-{1,2}\S+(?:\s+\S+)?\s+)*commit\b([^|;&]*)")
 # The flag and its value, which may be one token, a quoted string, or `=`-joined.
@@ -472,7 +507,7 @@ MSG_FLAG = re.compile(r"(?<![\w-])(?:--message|-[A-Za-z]*m)(?:=|\s+|(?=[\"']))")
 MSG_FILE = re.compile(r"(?<![\w-])(?:--file|-[A-Za-z]*F)(?:=|\s+|(?=[\"']))")
 GH_NEW = re.compile(
     r"(?:^|[|;&(]\s*|\s)gh\s+(pr|issue)\s+create\b([^|;&]*)", re.I)
-TITLE_FLAG = re.compile(r"(?<![\w-])--title(?:=|\s+|(?=[\"']))")
+TITLE_FLAG = re.compile(r"(?<![\w-])(?:--title|-t)(?:=|\s+|(?=[\"']))")
 # How much of a commit-message file is read: the subject is its first line, so a
 # file past this bound loses its tail and not its point.
 MSG_READ = 64 * 1024
@@ -517,6 +552,25 @@ def created_texts(command, cwd):
     can say which identifier it is about."""
     c = str(command or "")
     out = [("branch name", m.group(1)) for m in BRANCH_NEW.finditer(c)]
+    out += [("tag name", m.group(1)) for m in TAG_NEW.finditer(c)]
+    for m in PUSH_CMD.finditer(c):
+        words, remote = m.group(1).split(), True
+        for k, word in enumerate(words):
+            # the first positional is the remote (`origin`, a URL, an
+            # scp-style `host:u/repo.git`), never a refspec; `src:dst` after it
+            # names the remote ref and `:dst` deletes it
+            if word.startswith("-") or k and words[k - 1] in PUSH_VALUE_OPTS:
+                continue
+            if remote:
+                remote = False
+                continue
+            src, colon, dst = word.partition(":")
+            if colon and src:
+                dst = re.sub(r"^refs/(?:heads|tags)/", "", dst)
+                if dst:
+                    out.append(("remote branch name", dst))
+    out += [("branch name", n) for n in _created_by_words(c, "branch")]
+    out += [("tag name", n) for n in _created_by_words(c, "tag")]
     for m in COMMIT_MSG.finditer(c):
         rest = m.group(1)
         subject = _flag_value(rest, MSG_FLAG)
@@ -533,6 +587,65 @@ def created_texts(command, cwd):
     return out
 
 
+# `git tag`'s list, delete and verify modes create nothing
+TAG_READS = re.compile(r"-[A-Za-z]*[dlvn]\w*|--(?:list|delete|verify|contains|"
+                       r"no-contains|merged|no-merged|points-at|sort|format|column)\b.*")
+
+
+def _created_by_words(command, kind):
+    """The branch or tag names a git segment creates, read word by word where
+    the patterns above miss them (review 148): `worktree add <path>` names a
+    new branch after the path when no `-b` and no commit-ish follow, `-b` may
+    come after the path, `branch -m -f old new` puts a flag between, and `git
+    tag -m msg name` / `-am msg name` give the message before the name."""
+    out = []
+    for words in _shell_segments(command):
+        words = _past_wrappers(words)
+        if not words or os.path.basename(words[0]) != "git":
+            continue
+        i = 1
+        while i < len(words) and words[i].startswith("-"):
+            i += 2 if words[i] in GIT_VALUE_OPTS else 1
+        sub, args = words[i:i + 1], words[i + 1:]
+        if kind == "branch" and sub == ["worktree"] and args[:1] == ["add"]:
+            positional, named, j = [], None, 1
+            while j < len(args):
+                if args[j] in ("-b", "-B") and j + 1 < len(args):
+                    named, j = args[j + 1], j + 2
+                elif re.match(r"-[bB].", args[j]):  # stuck: `-bname`
+                    named, j = args[j][2:], j + 1
+                elif args[j] == "--reason":
+                    j += 2
+                elif args[j].startswith("-"):
+                    if args[j] in ("-d", "--detach"):
+                        positional = None
+                        break
+                    j += 1
+                else:
+                    positional.append(args[j])
+                    j += 1
+            if named:
+                out.append(named)
+            elif positional and len(positional) == 1:
+                out.append(os.path.basename(positional[0].rstrip("/")))
+        elif kind == "branch" and sub == ["branch"] and any(
+                a in ("-m", "-M", "-c", "-C", "--move", "--copy") for a in args):
+            positional = [a for a in args if not a.startswith("-")]
+            if positional:
+                out.append(positional[-1])
+        elif kind == "tag" and sub == ["tag"] and not any(TAG_READS.fullmatch(a) for a in args):
+            j = 0
+            while j < len(args):
+                hit = _option_value(args[j], ("-m", "-F", "-u", "--message", "--file",
+                                              "--local-user", "--cleanup"))
+                if args[j].startswith("-"):
+                    j += 2 if hit and not hit[1] else 1
+                    continue
+                out.append(args[j])
+                break
+    return out
+
+
 def lang_reason(command, cwd):
     """A deny reason when this command would create a non-English identifier,
     else None. The decision is tezgah_lang's (a word list is not a language
@@ -960,9 +1073,17 @@ def _secret_printer(text):
                     or UNEXPANDED.search(program)))
 
 
+# The git subcommands that stage a file they name: `stage` is `add`, a commit
+# pathspec stages its files, and `update-index --add` adds one (audit B-028).
+STAGING = frozenset(("add", "stage", "commit", "update-index"))
+
+
 def _secret_add(command):
-    """The credential file a `git add` in this command names, or None."""
-    if SECRET_FILE is None or "add" not in command:
+    """`git <sub> <file>` for the staging command (STAGING) in this command that
+    names a credential file, or None. A commit's option values (`-m .env`) are
+    no pathspec."""
+    if SECRET_FILE is None or not re.search(r"\b(?:add|stage|commit|update-index)\b",
+                                            command):
         return None
     for words in _shell_segments(command):
         program, args = _program(words)
@@ -971,13 +1092,26 @@ def _secret_add(command):
         i = 0
         while i < len(args) and args[i].startswith("-"):
             i += 2 if args[i] in GIT_VALUE_OPTS else 1
-        if args[i:i + 1] != ["add"]:
+        sub, rest = (args[i] if i < len(args) else None), args[i + 1:]
+        if sub not in STAGING or sub == "update-index" and "--add" not in rest:
             continue
-        for arg in args[i + 1:]:
+        value_next = False
+        for arg in rest:
+            if value_next:
+                value_next = False
+                continue
+            if arg.startswith("-"):
+                if sub == "commit" and _commit_value_long(arg):
+                    value_next = True
+                elif sub == "commit" and not arg.startswith("--"):
+                    k = next((k for k, ch in enumerate(arg[1:], 1)
+                              if ch in COMMIT_VALUE_SHORTS), 0)
+                    value_next = bool(k) and k == len(arg) - 1 \
+                        and arg[k] not in COMMIT_STUCK_SHORTS
+                continue
             name = os.path.basename(arg.rstrip("/"))
-            if (not arg.startswith("-") and SECRET_FILE.match(name)
-                    and name.lower() not in SECRET_TEMPLATES):
-                return arg
+            if SECRET_FILE.match(name) and name.lower() not in SECRET_TEMPLATES:
+                return "git %s %s" % (sub, arg)
     return None
 
 
@@ -2006,11 +2140,14 @@ WORKSPACE_FOLDED = ("tracked by the project here, committed with the project's o
 
 def workspace_reason(inp, cwd, base):
     """A deny reason when this write lands in a root `plans/`, `research/` or
-    `analysis/` the project does not track, else None."""
+    `analysis/` the project does not track, else None. A shell redirect target
+    resolves past the line's `cd`/`pushd` (`_shell_dir`, audit B-070)."""
     if tezgah_task is None:
         return None
+    here = _shell_dir(inp, cwd) if inp.get("command") or inp.get("cmd") else cwd
     for path in write_paths(inp):
-        rel = tezgah_task.relative(path, cwd, base)
+        rel = tezgah_task.relative(os.path.join(here, os.path.expanduser(path)),
+                                   cwd, base)
         seg = rel.split("/", 1)[0] if rel and "/" in rel else None
         if seg not in WORKSPACE_KINDS:
             continue
@@ -2775,6 +2912,11 @@ HELD = "a directory that holds tezgah's control state"
 # A word the shell expands into names (a glob or a brace): directly under the
 # open plans it names every plan, not one.
 GLOB_CHARS = re.compile(r"[*?\[{]")
+# omp's device URLs whose call the extension records as the call it carries
+# (hosts/omp/tezgah-hook.ts.in `DEVICE`): the gate still reads the device
+# `write`'s body, and writes no `began` for it, since no result answers it
+# under that name (plan 153).
+ROUTED_DEVICE = re.compile(r"^xd://(?:mcp__[^/?#]+|ast_edit)$", re.I)
 
 
 def _refusing(label):
@@ -2807,12 +2949,14 @@ HOOK_HOSTS = frozenset(("codex", "cursor", "omp", "qwen", "droid", "commandcode"
 # target, except for the copiers, whose last one is (`cp switch /tmp` reads it).
 # `sed`/`perl` count only with an in-place flag. `sqlite3` rewrites the cache
 # stores, rows of `tezgah.db`, as `rm` would remove the files they were; its
-# SQL argument names no protected path.
+# SQL argument names no protected path. `mkfifo`/`mknod` make a file that exists
+# (a switch is read by its existence) and `ditto` is macOS's copier (audit B-029).
 CONTROL_PROGRAMS = frozenset(("touch", "rm", "rmdir", "unlink", "shred",
                               "truncate", "chmod", "chown", "chgrp", "mv",
                               "mkdir", "tee", "cp", "ln", "install", "rsync",
-                              "dd", "sed", "perl", "sqlite3"))
-CONTROL_COPIERS = frozenset(("cp", "mv", "ln", "install", "rsync"))
+                              "dd", "sed", "perl", "sqlite3", "ditto", "mkfifo",
+                              "mknod"))
+CONTROL_COPIERS = frozenset(("cp", "mv", "ln", "install", "rsync", "ditto"))
 # The programs that remove, disable or move a path. A directory that holds
 # protected state, a repository's husky hooks and the open plans (evidence) are
 # judged for these only: husky's own setup writes `.husky/pre-commit` with a
@@ -2826,12 +2970,6 @@ OPTION_TARGETS = {"cp": _INTO, "mv": _INTO, "ln": _INTO, "install": _INTO,
                   "wget": ("-O", "--output-document"), "unzip": ("-d",)}
 INTERPRETERS = frozenset(("python", "python3", "sh", "bash", "zsh", "dash"))
 SHELL_NAMES = frozenset(("sh", "bash", "zsh", "dash", "ksh"))
-# Words that open a compound command: the command after one is read as if it
-# were not there (`if touch x; then`, `! rm x`, `do touch x`). `[`/`]` are not
-# here: the test command is skipped in `_program`, so the command after it in
-# an `if` line is read.
-SHELL_KEYWORDS = frozenset(("if", "then", "elif", "else", "do", "while",
-                            "until", "!", "{", "time"))
 SHELL_OPS = re.compile(r"^[;&|()<>]+$")
 # The cache subtrees whose rows the rules read: the cache database with its WAL
 # files (the evidence ledger, the used-kind marks, the switch baselines of
@@ -2849,12 +2987,26 @@ OWNED_KEYS = ("statusLine", "attribution", "disableAllHooks", "hooksConfig")
 PATCH_DELETE = re.compile(r"(?m)^\*\*\* Delete File: (\S.*?)\s*$")
 
 
+# `${VAR:-default}` and `${VAR-default}`: os.path.expandvars reads neither, so
+# `${XDG_CONFIG_HOME:-$HOME/.config}/tezgah` stayed a relative name (B-029)
+DEFAULT_VAR = re.compile(r"\$\{(\w+)(:?)-([^{}]*)\}")
+
+
+def _expanded(path):
+    """`path` with `${VAR:-default}`, `~`, `$HOME` and the XDG variables
+    expanded the way the shell would."""
+    def default(m):
+        value = os.environ.get(m.group(1))
+        return value if (value if m.group(2) else value is not None) else m.group(3)
+    return os.path.expandvars(os.path.expanduser(DEFAULT_VAR.sub(default, str(path))))
+
+
 def _real(path, cwd):
-    """`path` as an absolute path: `~`, `$HOME` and the XDG variables expanded
-    the way the shell would, relative to `cwd`, its directory resolved and its
-    last component kept. A hook file the installer symlinked into a host's
-    config is still that host's file, and the checkout it points at is not."""
-    path = os.path.expandvars(os.path.expanduser(str(path)))
+    """`path` as an absolute path: expanded (`_expanded`), relative to `cwd`,
+    its directory resolved and its last component kept. A hook file the
+    installer symlinked into a host's config is still that host's file, and
+    the checkout it points at is not."""
+    path = _expanded(path)
     parent, name = os.path.split(os.path.normpath(os.path.join(cwd or os.sep, path)))
     return os.path.join(os.path.realpath(parent), name)
 
@@ -2862,7 +3014,7 @@ def _real(path, cwd):
 def _full(path, cwd):
     """`path` with every link resolved, the last component's too: a write
     through a link lands on what it points at."""
-    path = os.path.expandvars(os.path.expanduser(str(path)))
+    path = _expanded(path)
     return os.path.realpath(os.path.join(cwd or os.sep, path))
 
 
@@ -2920,13 +3072,10 @@ def _held(origin):
     return out
 
 
-def _registration(real):
-    """'shared' for a file tezgah writes entries into beside the user's,
-    'owned' for a hook file that is wholly tezgah's, else None. A Claude
-    `settings*.json` counts in the user's own `~/.claude` or in a project under
-    a root, not in a fixture under /tmp or another temp HOME."""
+def _registration_files():
+    """(shared, owned): the files tezgah writes entries into beside the
+    user's, and the hook files that are wholly tezgah's."""
     claude = HOST_DIRS["claude"]
-    name = os.path.basename(real)
     shared = (os.path.join(HOST_DIRS["codex"], "hooks.json"),
               os.path.join(HOST_DIRS["codex"], "config.toml"),
               os.path.join(HOST_DIRS["cursor"], "hooks.json"),
@@ -2937,16 +3086,27 @@ def _registration(real):
               os.path.join(HOST_DIRS["commandcode"], "settings.json"), os.path.join(HOST_DIRS["copilot"], "settings.json"), os.path.join(HOST_DIRS["gemini"], "settings.json"), os.path.join(HOST_DIRS["antigravity"], "settings.json"), os.path.join(os.path.dirname(HOST_DIRS["antigravity"]), "config", "hooks.json"), os.path.join(HOST_DIRS["goose"], "settings.json"),
               os.path.join(claude, "plugins", "installed_plugins.json"),
               os.path.join(claude, "plugins", "known_marketplaces.json"))
+    owned = [os.path.join(HOST_DIRS["opencode"], d, "tezgah.js")
+             for d in ("plugins", "plugin")]
+    owned += [os.path.join(HOST_DIRS["omp"], "agent", "hooks", "pre", "tezgah-hook.ts"),
+              os.path.join(HOST_DIRS["copilot"], "hooks", "tezgah.json")] + [os.path.join(HOST_DIRS["gemini"], "extensions", "tezgah", *p) for p in (("gemini-extension.json",), ("hooks", "hooks.json"))] + [os.path.join(GOOSE_PLUGIN, *p) for p in (("plugin.json",), ("hooks", "hooks.json"))] + [AMP_PLUGIN]
+    return shared, owned
+
+
+def _registration(real):
+    """'shared' for a file tezgah writes entries into beside the user's,
+    'owned' for a hook file that is wholly tezgah's, else None. A Claude
+    `settings*.json` counts in the user's own `~/.claude` or in a project under
+    a root, not in a fixture under /tmp or another temp HOME."""
+    claude = HOST_DIRS["claude"]
+    name = os.path.basename(real)
+    shared, owned = _registration_files()
     if (name in ("settings.json", "settings.local.json")
             and ".claude" in real.split(os.sep)
             and (os.path.dirname(real) == os.path.realpath(claude)
                  or root_for(real))) \
             or real in {_real(p, None) for p in shared}:
         return "shared"
-    owned = [os.path.join(HOST_DIRS["opencode"], d, "tezgah.js")
-             for d in ("plugins", "plugin")]
-    owned += [os.path.join(HOST_DIRS["omp"], "agent", "hooks", "pre", "tezgah-hook.ts"),
-              os.path.join(HOST_DIRS["copilot"], "hooks", "tezgah.json")] + [os.path.join(HOST_DIRS["gemini"], "extensions", "tezgah", *p) for p in (("gemini-extension.json",), ("hooks", "hooks.json"))] + [os.path.join(GOOSE_PLUGIN, *p) for p in (("plugin.json",), ("hooks", "hooks.json"))] + [AMP_PLUGIN]
     cache = os.path.realpath(os.path.join(claude, "plugins", "cache"))
     if real in {_real(p, None) for p in owned} or (
             _under(real, cache) and "tezgah" in real[len(cache):].lower()):
@@ -2954,6 +3114,39 @@ def _registration(real):
     return None
 
 
+def _git_config_files(origin):
+    """`~/.gitconfig`, `$XDG_CONFIG_HOME/git/config`, and each session
+    checkout's `.git/config` and `.git/config.worktree`."""
+    home = os.path.expanduser("~")
+    files = [os.path.join(home, ".gitconfig"), os.path.join(
+        os.environ.get("XDG_CONFIG_HOME") or os.path.join(home, ".config"), "git", "config")]
+    for top in _tops(origin):
+        files += [os.path.join(top, ".git", "config"),
+                  os.path.join(top, ".git", "config.worktree")]
+    return files
+
+
+def _git_config(real, origin):
+    """True for a git config file whose `core.hooksPath` or `include.path`
+    moves the hooks of the session's commits: `_git_config_files`, and a
+    linked worktree's `.git/worktrees/*/config.worktree`. Judged by key like a
+    shared registration file (`_shared_change`, audit B-002, review 148 #2)."""
+    for top in _tops(origin):
+        if os.path.basename(real) == "config.worktree" and _under(
+                real, _real(os.path.join(top, ".git", "worktrees"), None)):
+            return True
+    return real in {_real(f, None) for f in _git_config_files(origin)}
+
+
+# The git config keys that change which hooks run: HOOKS_KEYS (`core.hooksPath`
+# and an include that can carry one) and `extensions.worktreeConfig`, which
+# makes git read `.git/config.worktree` (review 148 #1, #2).
+def _hooks_setting(word):
+    """True when a `git config` word names one of those keys."""
+    key = word.lower()
+    return key == "extensions.worktreeconfig" or bool(HOOKS_KEYS.fullmatch(key))
+
+
 def _target_label(real, remove, origin):
     """`control_target` for one spelling of the path."""
     name, parent = os.path.basename(real), os.path.dirname(real)
@@ -2973,7 +3166,7 @@ def _target_label(real, remove, origin):
             and root_for(parent):
         return "a repository's extension seam (`%s`)" % name
     kind = _registration(real)
-    if kind == "shared":
+    if kind == "shared" or _git_config(real, origin):
         return real
     # an install tree's own `.tezgah/` is the private workspace of a checkout
     # used as the install, not code the hooks run
@@ -3022,6 +3215,69 @@ def control_target(path, cwd, remove=False, origin=None):
     return noted
 
 
+def _control_files(origin):
+    """(file, label) for each control file outside `_held` that
+    `control_target` refuses or judges by key: tezgah's hook files and shared
+    registrations (`_registration_files`), Claude's settings, the tezgah copies
+    in Claude's plugin cache, and the git config files (`_git_config`). A tree
+    rewrite cannot be judged by key, so a tree over one takes the whole file."""
+    shared, owned = _registration_files()
+    claude = HOST_DIRS["claude"]
+    tops = _tops(origin)
+    wiring = list(shared) + owned + [
+        os.path.join(d, n) for d in [claude] + [os.path.join(t, ".claude") for t in tops]
+        for n in ("settings.json", "settings.local.json")]
+    cache = os.path.join(claude, "plugins", "cache")
+    wiring += [p for depth in ("*", os.path.join("*", "*"))
+               for p in iglob(os.path.join(cache, depth))
+               if "tezgah" in os.path.basename(p).lower()]
+    git = _git_config_files(origin) + [
+        p for t in tops for p in iglob(os.path.join(t, ".git", "worktrees", "*",
+                                                    "config.worktree"))]
+    return ([(_real(p, None), "tezgah's hook wiring") for p in wiring]
+            + [(_real(p, None), "the repository's git hooks (`core.hooksPath` / "
+                "`include.path`)") for p in git])
+
+
+def _tree_label(path, cwd):
+    """The control label of a glob or directory `path` that reaches control
+    state, else None: its fixed prefix's own label, HELD for a protected
+    directory (`_held`) under the prefix, or the label of a control file
+    (`_control_files`) under the directory or matched by the glob.
+
+    omp's ast_edit takes directories and globs in `paths` (review 153 F2, round
+    2 #2), and reading one as the tree it names only refuses more. A target
+    behind a dot entry (`.git/hooks` from the repository root, `.config/tezgah`
+    from HOME) counts only when the glob spells a dot entry past its prefix: a
+    tree walk skips them. ponytail: fnmatch, where `*` crosses `/`, and a brace
+    glob takes every control file under its prefix."""
+    path = str(path or "").strip()
+    glob = GLOB_CHARS.search(path)
+    if not path or (not glob and not os.path.isdir(_full(path, cwd))):
+        return None
+    head = path[:glob.start()] if glob else path
+    prefix = head[:head.rfind(os.sep) + 1] if glob else head
+    label = control_target(prefix or ".", cwd)
+    if _refusing(label):
+        return label
+    root = _full(prefix or ".", cwd)
+    tail = path[len(prefix):] if glob else ""
+    dotted = glob is not None and (os.sep + ".") in os.sep + path[glob.start():]
+
+    def walked(target):
+        rel = os.path.relpath(target, root)
+        return _under(target, root) and (dotted or not any(
+            part.startswith(".") for part in rel.split(os.sep)))
+
+    if any(walked(held) for held in _held(cwd)):
+        return HELD
+    for target, label in _control_files(cwd):
+        if walked(target) and (not glob or "{" in tail
+                               or fnmatch.fnmatchcase(target, os.path.join(root, tail))):
+            return label
+    return None
+
+
 def _names_tezgah(value):
     return "tezgah" in json.dumps(value, sort_keys=True).lower()
 
@@ -3099,8 +3355,27 @@ def _after_text(inp, current):
     return text
 
 
+def _git_hook_keys(text):
+    """The `core.hooksPath` and `include.path` / `includeIf.path` entries of a
+    git config text, in order: the settings that change which hooks run."""
+    out, section = [], ""
+    for line in (text or "").splitlines():
+        s = line.strip()
+        m = re.match(r"\[\s*([^\]\s\"]+)", s)
+        if m:
+            section = m.group(1).lower()
+            s = s[s.find("]") + 1:].strip() if "]" in s else ""
+        key, eq, value = s.partition("=")
+        if eq and (section, key.strip().lower()) in (
+                ("core", "hookspath"), ("include", "path"), ("includeif", "path"),
+                ("extensions", "worktreeconfig")):
+            out.append((section, key.strip().lower(), value.strip()))
+    return out
+
+
 def _shared_change(real, inp):
-    """True when this write changes a tezgah-owned entry of a shared file."""
+    """True when this write changes a tezgah-owned entry of a shared file, or
+    a hooks entry of a git config file (`_git_config`)."""
     try:
         with open(real, encoding="utf-8") as fh:
             current = fh.read()
@@ -3109,6 +3384,8 @@ def _shared_change(real, inp):
     after = _after_text(inp, current)
     if after is None:
         return True
+    if os.path.basename(real) in ("config", ".gitconfig", "config.worktree"):
+        return _git_hook_keys(current) != _git_hook_keys(after)
     if real.endswith(".toml"):
         return _toml_owned(current) != _toml_owned(after)
     return sorted(_owned(_parsed(current))) != sorted(_owned(_parsed(after)))
@@ -3119,7 +3396,7 @@ def _shell_label(label):
     to it is refused whole."""
     if not os.path.isabs(label):
         return label
-    return ("%s, which holds tezgah's hook wiring. A shell write is not read "
+    return ("%s, which holds hook wiring. A shell write is not read "
             "key by key, so it is refused whole; an edit that leaves tezgah's "
             "entries as they are is not" % label)
 
@@ -3221,43 +3498,16 @@ def _shell_words(command):
     return out
 
 
-# The wrappers `_program` reads past, by basename, with the options that take
-# the next word as their value; `timeout` also takes its duration.
-WRAPPER_VALUE_OPTS = {"sudo": ("-u", "-g", "-h", "-p", "-C", "-D", "-r", "-t", "-U"),
-                      "env": ("-u", "--unset", "-C", "--chdir"),
-                      "nice": ("-n", "--adjustment"), "nohup": (), "exec": ("-a",),
-                      "time": ("-f", "-o"), "command": (),
-                      "timeout": ("-s", "--signal", "-k", "--kill-after"),
-                      "stdbuf": ("-i", "-o", "-e")}
 # An interpreter's options that take the next word as their value, and the ones
 # that make the program its own text rather than a script (`python3 -c`, `-m`).
 INTERPRETER_VALUE_OPTS = ("-X", "-W", "-o", "+o", "-O")
 
 
-def _past_wrappers(words):
-    """`words` past compound keywords, env assignments and the wrappers
-    (WRAPPER_VALUE_OPTS, by basename, with their options)."""
-    i = 0
-    while i < len(words):
-        word = words[i]
-        wrapper = os.path.basename(word)
-        if ENV_WORD.match(word) or word in SHELL_KEYWORDS:
-            i += 1
-            continue
-        if wrapper not in WRAPPER_VALUE_OPTS:
-            break
-        i += 1
-        while i < len(words) and words[i].startswith("-"):
-            i += 2 if words[i] in WRAPPER_VALUE_OPTS[wrapper] else 1
-        if wrapper == "timeout" and i < len(words):
-            i += 1  # the duration
-    return words[i:]
-
-
 def _program(words):
     """(program basename without `.py`, its arguments) for one simple command,
-    past compound keywords, env assignments, the wrappers (`_past_wrappers`)
-    and an interpreter's options before the script it runs."""
+    past compound keywords, env assignments, the wrappers
+    (tezgah_integrity._past_wrappers, the one reader the shortcut rule uses
+    too) and an interpreter's options before the script it runs."""
     words = _past_wrappers(words)
     if words and words[0] == "[":
         # the test command: its operands are not a program, and the command
@@ -3336,15 +3586,27 @@ def _git_change(args, cwd, origin):
                 return _shell_label(label)
             noted = noted or label
         return noted
-    if sub == "config" and HOOKS_KEY in (a.lower() for a in rest):
+    if sub == "config" and any(_hooks_setting(a) for a in rest):
         head = rest[:rest.index("--")] if "--" in rest else rest
+        # `-f`/`--file` names the file written, wherever the cwd is (review
+        # 148 r2 #1): that file is judged, and its name is no positional
+        given = None
+        for k, a in enumerate(head):
+            m = re.fullmatch(r"(?:-f|--file=?)(.*)", a, re.S)
+            if m and (m.group(1) or k + 1 < len(head)):
+                given = m.group(1) or head[k + 1]
+                head = head[:k] + head[k + (1 if m.group(1) else 2):]
+                break
         positional = [a for a in head if not a.startswith("-")]
         if any(a.startswith(("--get", "--list")) or a == "-l" for a in head) \
                 or positional[:1] in (["get"], ["list"]):
             return None
-        # the session's own checkout, or every repository at once
-        mine = any(a in ("--global", "--system") for a in head) or any(
-            _under(os.path.realpath(where), top) for top in _tops(origin))
+        # the named file, else the session's own checkout or every repository
+        if given is not None:
+            mine = _git_config(_real(given, where), origin)
+        else:
+            mine = any(a in ("--global", "--system") for a in head) or any(
+                _under(os.path.realpath(where), top) for top in _tops(origin))
         if mine and (len(positional) > 1 or any(a.startswith("--unset") for a in head)):
             return "the repository's git hooks"
     return None
@@ -3364,7 +3626,9 @@ def _command_change(words, cwd, depth, origin):
     """The control-plane label one simple command changes, or None."""
     program, args = _program(words)
     if program == "eval" and depth < 3:
-        return shell_control(" ".join(args), cwd, depth + 1, origin)
+        # a leading `--` only ends eval's options (review m3)
+        return shell_control(" ".join(args[1:] if args[:1] == ["--"] else args),
+                             cwd, depth + 1, origin)
     if program in SHELL_NAMES and depth < 3:
         # `-c`, or any flag cluster holding it (`-lc`, `-ec`); a `--` after it
         # ends the options and the script is the word after that
@@ -3486,21 +3750,44 @@ def shell_control(command, cwd, depth=0, origin=None):
     return noted
 
 
+# A forge MCP server's tools, by the server's name as the host spells the tool
+# (`mcp__github__create_or_update_file`, omp's `mcp__github_...`).
+# ponytail: a forge server registered under another name is read as local.
+REMOTE_MCP = re.compile(r"mcp__(?:github|gitlab|gitea|bitbucket)_", re.I)
+
+
 def control_reason(t, inp, cwd):
     """The control-plane label this call changes, or None (see CONTROL_DENY).
-    A CONTROL_EVIDENCE label comes back only when nothing in the call refuses."""
+    A CONTROL_EVIDENCE label comes back only when nothing in the call refuses.
+    Beside the write path, an MCP call's `path`, `file_path` and `destination`
+    fields are read (a move's target), and its `source` as a removal (a move
+    takes it away, review 148 #3). A forge server's tool (REMOTE_MCP: GitHub,
+    GitLab, Gitea, Bitbucket) writes into a remote repository, never under the
+    local cwd; the server name decides, never a `repo` field the caller can add
+    to any call (review 148 r2 #2). Only an `edit` omp's bridge derived from
+    an `ast_edit` (`via: "ast_edit"`) is read as the tree it may name
+    (`_tree_label`, review 153 round 2 #3): the field only adds a refusal."""
     if t in BASH_TOOLS:
         return shell_control(inp.get("command") or inp.get("cmd"), cwd)
+    if REMOTE_MCP.match(str(t)):
+        return None
     deletes = set(PATCH_DELETE.findall(str(inp.get("patch") or "")))
+    source = inp.get("source")
+    if isinstance(source, str) and source.strip():
+        deletes.add(source.strip())
     noted = None
-    for path in write_paths(inp):
-        label = control_target(path, cwd, remove=path in deletes)
+    named = [inp.get(k) for k in ("path", "file_path", "destination", "source")]
+    for path in dict.fromkeys(write_paths(inp) + [p.strip() for p in named
+                                                  if isinstance(p, str) and p.strip()]):
+        label = (control_target(path, cwd, remove=path in deletes)
+                 or (_tree_label(path, cwd) if inp.get("via") == "ast_edit" else None))
         if label and not os.path.isabs(label):
             if _refusing(label):
                 return label
             noted = noted or label
         elif label and _shared_change(label, inp):
-            return "tezgah's hook wiring"
+            return ("the repository's git hooks (`core.hooksPath` / `include.path`)"
+                    if _git_config(label, cwd) else "tezgah's hook wiring")
     return noted
 
 
@@ -3599,7 +3886,7 @@ def _deny(session_id, rule, reason, tool=None, inp=None, workspace=None,
     return reason
 
 
-def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
+def decision(tool, inp, cwd, session_id=None, record=True, agent=None, parent=None):
     """A deny reason for this call, or None to let it pass.
 
     `record=False` is the dry run `tezgah-gate check` and the MCP
@@ -3610,8 +3897,10 @@ def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
 
     `agent` is the host's subagent id when the call came from one (Claude's
     `agent_id`): the repeat ceilings count that agent's own attempts, so one
-    sibling's failures are not spent as another's."""
-    bind_session(session_id)  # the switch latch: off() below answers for this session
+    sibling's failures are not spent as another's. `parent` is the session that
+    spawned this one, as the host named it (B-036): a host adapter that bound
+    it already may leave it out, since a rebind of the same session keeps it."""
+    bind_session(session_id, parent)  # the switch latch: off() below answers for this session
     if not record:
         return _dry_decision(tool, inp, cwd, session_id, agent)
     if off("pretooluse-off"):
@@ -3626,13 +3915,19 @@ def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
     # hook writes the second row; a refusal below answers it with its `deny`.
     # Through `note`, so the dry run writes none. `check` is decided here, from
     # the whole command: the stored detail is cut at DETAIL_MAX.
-    if t in WRITE_TOOLS or t in BASH_TOOLS:
+    if (t in WRITE_TOOLS or t in BASH_TOOLS) and not ROUTED_DEVICE.match(
+            str(inp.get("path") or "").strip()):
         digest = call_id(tool, inp)
         if digest:
             command = str(inp.get("command") or inp.get("cmd") or "")
-            note(session_id, BEGAN_KIND, command or (write_paths(inp) or [""])[0],
+            # the file it writes, as the race rule matches it: another
+            # session's `began` row nothing answered yet is a write in flight
+            # (writers_elsewhere, audit B-069)
+            paths = write_paths(inp)
+            note(session_id, BEGAN_KIND, command or (paths or [""])[0],
                  id=digest, tool=str(tool or "").strip() or None, workspace=base,
-                 check=1 if t in BASH_TOOLS and verify_command(command, cwd) else None)
+                 check=1 if t in BASH_TOOLS and verify_command(command, cwd) else None,
+                 target=_abs_target(paths[0], cwd) if paths else None)
     # Claude's Task names the agent `subagent_type`; omp's task names it `agent`,
     # on the call (flat shape) or on each `tasks[]` item (batch shape).
     # A shell tool's `args` can be a list (Command Code splits argv there): only
@@ -3651,9 +3946,11 @@ def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
     # file this one protects (control_reason). No switch but `pretooluse-off`
     # removes it, and that one is among the files. A CONTROL_EVIDENCE target is
     # not refused: the call goes on to the rules below, and a call they let
-    # through leaves a `disarm` row beside its `began` row.
+    # through leaves a `disarm` row beside its `began` row. An MCP write-class
+    # call's path fields are judged the same way (audit B-011, owner answer
+    # OQ-07).
     evidence = None
-    if t in WRITE_TOOLS + BASH_TOOLS:
+    if t in WRITE_TOOLS + BASH_TOOLS or mcp_class(tool) == "write":
         what = control_reason(t, inp, cwd)
         if _refusing(what):
             return _deny(session_id, "control", CONTROL_DENY % what, tool, inp,
@@ -3923,14 +4220,15 @@ def _dry_decision(tool, inp, cwd, session_id, agent=None):
 
 # Every rule slug `decision` records a refusal under (`_deny`'s second argument),
 # with the kill switch that disarms it beside `pretooluse-off`, which disarms
-# them all; None means only that one. A lesson the ledger retires with
-# `|| enforced_by: <slug>` (tezgah_lessons.lines) leaves the injected
-# block only while its rule is armed, so `piped` brings its lesson back under
-# `verify-off`. `tests/test_lessons.py` holds this map to the `_deny` literals.
+# them all, or a tuple when either of several does; None means only that one. A
+# lesson the ledger retires with `|| enforced_by: <slug>` (tezgah_lessons.lines)
+# leaves the injected block only while its rule is armed, so `piped` brings its
+# lesson back under `verify-off`. `tests/test_lessons.py` holds this map to the
+# `_deny` literals.
 DENY_RULES = {"control": None, "explorer": None, "shortcut": "verify-off",
               "piped": "verify-off",
               "attribution": None, "lang": "lang-off", "race": None,
-              "lease": "orchestrate-off",
+              "lease": ("orchestrate-off", "slices-off"),
               "task": "task-off", "workspace": "workspace-off", "secret": None,
               "plan": None, "order": "verify-off", "loop": "verify-off",
               "retry": "verify-off", "drift": "reminder-off", "repo-rule": None}