@zerwiz/ymir 0.1.4 → 0.1.7

package/.agents/backend/fm-cd-command-policy.mjs

@@ -0,0 +1,153 @@
+#!/usr/bin/env node
+// Semantic policy for the cd-guard: does a shell command persistently change the
+// PRIMARY firstmate shell's own working directory?
+//
+// A stray persistent top-level `cd projects/<clone>` silently relocates the
+// primary shell, so the next firstmate-owned command (a backlog write, an
+// fm-* lifecycle call, tasks-axi) runs inside a project clone instead of the
+// home. This policy blocks exactly that class of command; the environmental
+// scoping to the real primary checkout lives in the bin/fm-cd-pretool-check.sh
+// transport, not here. See docs/cd-guard.md for the full contract.
+//
+// The shell tokenizer and command-position analysis are imported from
+// bin/fm-arm-command-policy.mjs, the sole owner of firstmate's shell
+// classification, so this guard never duplicates shell lexing. This policy
+// never evaluates, expands, sources, or runs any byte of the submitted command;
+// it inspects lexical command positions only.
+
+import { Lexer, splitProgram, commandPosition } from "./fm-arm-command-policy.mjs";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const REASONS = {
+  "persistent-cd":
+    "a persistent top-level directory change in the primary firstmate checkout is blocked; it would move the shell out of the home so a later firstmate-owned command runs inside a project clone. Reach the target without moving the shell - use git -C <dir> or an absolute path on the command itself - or scope the cd to a subshell like (cd <dir> && ...).",
+};
+
+// Directory-changing builtins that mutate the calling shell's own cwd.
+const CD_BUILTINS = new Set(["cd", "pushd", "popd"]);
+
+// Wrappers that fork or exec a child before reaching the builtin, so a cd behind
+// them never persists to the parent shell (and generally just fails, since cd is
+// a builtin with no external program). `command` is deliberately NOT here: it
+// runs the builtin in the current shell, so `command cd x` still persists.
+const FORKING_WRAPPERS = new Set(["env", "sudo", "nohup", "timeout", "gtimeout", "exec"]);
+
+function isPipe(separator) {
+  return separator === "|" || separator === "|&";
+}
+
+// A top-level command-list node persists its cwd change to the parent shell
+// unless it runs in a subshell context: backgrounded with a trailing `&`, or a
+// stage of a pipeline (bash runs every pipeline stage in a subshell).
+function nodePersists(separators, index) {
+  if (separators[index] === "&") return false;
+  if (isPipe(separators[index]) || isPipe(separators[index - 1])) return false;
+  return true;
+}
+
+function deny(code) {
+  return { decision: "deny", code, reason: REASONS[code] };
+}
+
+function hasPathQualifiedCommandPrefix(position) {
+  return position.words
+    .slice(position.prefixAssignments, position.index)
+    .some((word) => word.value.includes("/") && word.value.split("/").at(-1) === "command");
+}
+
+function hasCommandQueryPrefix(position) {
+  let commandPrefix = false;
+  for (const word of position.words.slice(position.prefixAssignments, position.index)) {
+    if (word.value === "command") {
+      commandPrefix = true;
+      continue;
+    }
+    if (commandPrefix && /^-[^-]*[vV]/.test(word.value)) return true;
+  }
+  return false;
+}
+
+function decision(command) {
+  const lexed = new Lexer(command).tokenize();
+  // Fail open on syntax this classifier cannot tokenize. The cd-guard's threat
+  // model is agent mistakes - an accidental bare `cd projects/foo` always
+  // tokenizes - so we prioritize zero false blocks over catching malformed or
+  // deliberately obfuscated bypasses, which stay out of scope by design.
+  if (lexed.error) return { decision: "allow" };
+
+  const { nodes, separators } = splitProgram(lexed.tokens);
+  for (let index = 0; index < nodes.length; index += 1) {
+    if (!nodePersists(separators, index)) continue;
+    // commandPosition ignores subshell/brace groups, quoted data, comments, and
+    // substitutions (they contribute no top-level command word), and skips
+    // leading assignments and wrappers to find the executed command word.
+    const position = commandPosition(nodes[index]);
+    if (hasPathQualifiedCommandPrefix(position)) continue;
+    if (hasCommandQueryPrefix(position)) continue;
+    let command = position.command;
+    let wordIndex = position.index;
+    while (command && (command.value === "builtin" || command.value === "command")) {
+      wordIndex += 1;
+      command = position.words[wordIndex];
+    }
+    if (!command) continue;
+    if (!CD_BUILTINS.has(command.value)) continue;
+    if (position.wrappers.some((wrapper) => FORKING_WRAPPERS.has(wrapper))) continue;
+    return deny("persistent-cd");
+  }
+  return { decision: "allow" };
+}
+
+function parseArguments(argv) {
+  const result = { command: "", commandSet: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const name = argv[i];
+    if (name === "--command") {
+      if (i + 1 >= argv.length) throw new Error("--command requires a value");
+      result.command = argv[i + 1];
+      result.commandSet = true;
+      i += 1;
+      continue;
+    }
+    if (name.startsWith("--command=")) {
+      result.command = name.slice("--command=".length);
+      result.commandSet = true;
+      continue;
+    }
+    throw new Error(`unknown argument: ${name}`);
+  }
+  return result;
+}
+
+function invokedDirectly() {
+  const entry = process.argv[1];
+  if (!entry) return false;
+  const self = fileURLToPath(import.meta.url);
+  try {
+    return realpathSync(entry) === realpathSync(self);
+  } catch {
+    return entry === self;
+  }
+}
+
+if (invokedDirectly()) {
+  try {
+    const args = parseArguments(process.argv.slice(2));
+    if (!args.commandSet || !args.command) {
+      process.stdout.write("allow\n");
+    } else {
+      const result = decision(args.command);
+      if (result.decision === "allow") {
+        process.stdout.write("allow\n");
+      } else {
+        process.stdout.write(`deny\t${result.code}\t${result.reason}\n`);
+      }
+    }
+  } catch (error) {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  }
+}
+
+export { decision };

package/.agents/backend/fm-cd-pretool-check.sh

@@ -0,0 +1,190 @@
+#!/usr/bin/env bash
+# Stable PreToolUse transport for the cd-guard command policy.
+#
+# A stray persistent top-level `cd projects/<clone>` in the PRIMARY firstmate
+# shell silently relocates the shell, so a later firstmate-owned command (a
+# backlog write, an fm-* lifecycle call, tasks-axi) runs inside a project clone
+# instead of the home. This seatbelt denies such a command before it runs.
+# bin/fm-cd-command-policy.mjs is the sole owner of the block/allow decision; it
+# reuses the shell classifier owned by bin/fm-arm-command-policy.mjs. This
+# wrapper only scopes the guard to the real primary checkout, acquires the
+# harness payload, invokes that policy, and renders the established harness
+# responses. It never executes, sources, evaluates, or expands the command.
+# See docs/cd-guard.md for the complete contract and validation record.
+#
+# Usage:
+#   <PreToolUse JSON on stdin> | bin/fm-cd-pretool-check.sh
+#   bin/fm-cd-pretool-check.sh --command '<cmd>'
+#
+# Stdin mode extracts .toolInput.command for Grok or .tool_input.command for
+# Claude, Codex, and Cursor. CLI mode is used by OpenCode and Pi after their
+# adapters extract the exact command string. --cursor selects Cursor's own deny
+# rendering and marks this invocation as the Cursor registration rather than the
+# Claude-settings duplicate Cursor also loads.
+#
+# Exit/output contract (identical shape to bin/fm-arm-pretool-check.sh):
+#   ALLOW - exit 0 and no output.
+#   DENY - exit 2, a Claude-shaped deny object on stderr, and a Grok-shaped
+#          deny object on stdout unless --claude was supplied.
+#   DENY, --cursor - exit 0 and Cursor's own decision object on stdout. Cursor
+#          reads the returned object rather than the exit status.
+#   INERT - not the real primary checkout (a crewmate/scout task worktree or a
+#           non-firstmate repo): exit 0 with no output, exactly like ALLOW.
+#   FAIL OPEN - malformed or empty stdin, missing jq for stdin transport,
+#               missing Node or policy owner, or an invalid policy response.
+#
+# Claude requires stdout to remain empty on deny.
+# Codex blocks on exit 2 and displays stderr.
+# Grok consumes the stdout decision object.
+# OpenCode and Pi consume exit 2 plus stderr.
+# Cursor consumes the stdout decision object.
+set -u
+
+CMD=""
+CMD_SET=0
+CLAUDE_MODE=0
+CURSOR_MODE=0
+
+usage() {
+  cat <<'EOF'
+Usage: fm-cd-pretool-check.sh [--command <cmd>] [--claude|--cursor]
+
+With no --command, reads a PreToolUse-style JSON payload on stdin (Grok
+toolInput.command, or Claude/Codex tool_input.command).
+Fires only in the real primary firstmate checkout; it is a silent no-op in a
+crewmate/scout task worktree or any non-firstmate repo.
+Exits 0 to allow and 2 to deny a persistent top-level cwd change.
+The deny reason is written to stderr, with a Grok decision object on stdout
+unless --claude is supplied.
+With --cursor, a deny is Cursor's own decision object on stdout and exit 0,
+because Cursor reads the returned object rather than the exit status.
+Malformed transport and an unavailable classifier runtime fail open.
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --command)
+      [ "$#" -gt 1 ] || { echo "error: --command requires a value" >&2; exit 2; }
+      CMD=$2
+      CMD_SET=1
+      shift 2
+      ;;
+    --command=*)
+      CMD=${1#--command=}
+      CMD_SET=1
+      shift
+      ;;
+    --claude)
+      CLAUDE_MODE=1
+      shift
+      ;;
+    --cursor)
+      CURSOR_MODE=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "error: unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ "$CMD_SET" -eq 0 ]; then
+  PAYLOAD=$(cat 2>/dev/null || true)
+  [ -n "$PAYLOAD" ] || exit 0
+  command -v jq >/dev/null 2>&1 || exit 0
+  # shellcheck source=bin/fm-hook-host-lib.sh
+  . "$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/fm-hook-host-lib.sh"
+  # Cursor's own registration passes --cursor. Without it a Cursor-delivered
+  # payload is the Claude-settings duplicate Cursor also loads, already
+  # evaluated by that registration, so this copy allows without re-classifying.
+  if [ "$CURSOR_MODE" -eq 0 ] && fm_hook_payload_is_foreign_host "$PAYLOAD"; then
+    exit 0
+  fi
+  CMD=$(printf '%s' "$PAYLOAD" | jq -r '(.toolInput.command // .tool_input.command // empty)' 2>/dev/null) || exit 0
+fi
+
+[ -n "$CMD" ] || exit 0
+
+# Strict-superset prefilter (transport only; owns zero classification
+# semantics). Strip syntax bytes that the classifier joins within a shell word
+# before looking for cd/pushd/popd, so ordinary quoted or escaped fragments
+# cannot hide a deniable cwd change from the policy owner. A quoting-decoder
+# marker - a $ immediately followed by a
+# single quote (ANSI-C $'...') or a double quote (bash locale $"...") - delegates
+# too, because the classifier decodes those and can reconstruct cd from bytes
+# this substring test cannot see. This marker set is COUPLED to the classifier's
+# decoder set in bin/fm-arm-command-policy.mjs: adding any new quote/expansion
+# form the classifier decodes REQUIRES extending it here in the same change, or
+# the prefilter stops being a strict superset. Deliberate deeper obfuscation is
+# out of scope by the same agent-mistake threat model the policy uses.
+PREFILTER=$CMD
+PREFILTER=${PREFILTER//\\/}
+PREFILTER=${PREFILTER//\"/}
+PREFILTER=${PREFILTER//\'/}
+PREFILTER=${PREFILTER//$'\n'/}
+PREFILTER=${PREFILTER//$'\r'/}
+case "$CMD" in
+  *"\$'"*|*'$"'*) ;;
+  *)
+    case "$PREFILTER" in
+      *cd*|*pushd*|*popd*) ;;
+      *) exit 0 ;;
+    esac
+    ;;
+esac
+
+SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd -P) || exit 0
+FM_ROOT=${FM_ROOT_OVERRIDE:-$(CDPATH='' cd -- "$SCRIPT_DIR/.." 2>/dev/null && pwd -P)} || exit 0
+
+# Scope to a plain, non-worktree firstmate checkout, where git-dir equals
+# git-common-dir. A crewmate/scout task worktree - the shape bin/fm-spawn.sh
+# always hands out - is a linked git worktree where the two differ. This guard
+# does not inspect .fm-secondmate-home, so it applies in a git-cloned secondmate
+# home but remains inert when the secondmate home is itself a treehouse-leased
+# linked worktree. docs/cd-guard.md owns this scope; docs/turnend-guard.md owns
+# the turn-end guard's separate marker-aware scope. Any failure to confirm the
+# checkout is inert (exit 0), never a block, so a broken environment never
+# denies a shell command.
+[ -f "$FM_ROOT/AGENTS.md" ] || exit 0
+[ -d "$FM_ROOT/bin" ] || exit 0
+command -v git >/dev/null 2>&1 || exit 0
+GIT_DIR=$(git -C "$FM_ROOT" rev-parse --git-dir 2>/dev/null) || exit 0
+GIT_COMMON_DIR=$(git -C "$FM_ROOT" rev-parse --git-common-dir 2>/dev/null) || exit 0
+[ "$GIT_DIR" = "$GIT_COMMON_DIR" ] || exit 0
+
+POLICY="$FM_ROOT/bin/fm-cd-command-policy.mjs"
+command -v node >/dev/null 2>&1 || exit 0
+[ -f "$POLICY" ] || exit 0
+
+POLICY_OUTPUT=$(node "$POLICY" --command "$CMD" 2>/dev/null) || exit 0
+[ -n "$POLICY_OUTPUT" ] || exit 0
+
+TAB=$(printf '\t')
+DECISION=${POLICY_OUTPUT%%"$TAB"*}
+[ "$DECISION" = "deny" ] || exit 0
+REST=${POLICY_OUTPUT#*"$TAB"}
+[ "$REST" != "$POLICY_OUTPUT" ] || exit 0
+CODE=${REST%%"$TAB"*}
+REASON=${REST#*"$TAB"}
+[ -n "$CODE" ] && [ -n "$REASON" ] && [ "$REASON" != "$REST" ] || exit 0
+
+json_escape() {
+  printf '%s' "$1" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' | tr '\n' ' '
+}
+
+DETAIL="[$CODE] $REASON"
+ESCAPED=$(json_escape "$DETAIL")
+if [ "$CURSOR_MODE" -eq 1 ]; then
+  printf '{"permission":"deny","user_message":"%s"}\n' "$ESCAPED"
+  exit 0
+fi
+printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny"},"systemMessage":"%s"}\n' "$ESCAPED" >&2
+[ "$CLAUDE_MODE" -eq 1 ] || printf '{"decision":"deny","reason":"%s"}\n' "$ESCAPED"
+exit 2

package/.agents/backend/fm-check-lib.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+
+FM_CUSTOM_CHECK_HASH=
+FM_CUSTOM_CHECK_SNAPSHOT=
+
+fm_custom_check_sha256() {
+  local file=$1
+  if command -v shasum >/dev/null 2>&1; then
+    shasum -a 256 "$file" 2>/dev/null | awk '{print $1}'
+  elif command -v sha256sum >/dev/null 2>&1; then
+    sha256sum "$file" 2>/dev/null | awk '{print $1}'
+  else
+    return 1
+  fi
+}
+
+fm_custom_check_trust_read() {
+  local state=$1 id=$2 trust state_device version hash
+  FM_CUSTOM_CHECK_HASH=
+  fm_pr_task_id_valid "$id" || return 1
+  [ -d "$state" ] && [ ! -L "$state" ] || return 1
+  state_device=$(fm_pr_file_device "$state") || return 1
+  trust="$state/$id.check-trust"
+  fm_pr_private_file_valid "$trust" 600 "$state_device" || return 1
+  exec 9< "$trust" || return 1
+  IFS= read -r version <&9 || { exec 9<&-; return 1; }
+  IFS= read -r hash <&9 || { exec 9<&-; return 1; }
+  if IFS= read -r _extra <&9; then
+    exec 9<&-
+    return 1
+  fi
+  exec 9<&-
+  [ "$version" = fm-custom-check-v1 ] || return 1
+  [[ "$hash" =~ ^[0-9a-f]{64}$ ]] || return 1
+  FM_CUSTOM_CHECK_HASH=$hash
+}
+
+fm_custom_check_registered() {
+  local state=$1 id=$2 check hash state_device
+  check="$state/$id.check.sh"
+  fm_custom_check_trust_read "$state" "$id" || return 1
+  state_device=$(fm_pr_file_device "$state") || return 1
+  fm_pr_private_file_valid "$check" 700 "$state_device" || return 1
+  hash=$(fm_custom_check_sha256 "$check") || return 1
+  [ "$hash" = "$FM_CUSTOM_CHECK_HASH" ]
+}
+
+fm_custom_check_snapshot_prepare() {
+  local state=$1 id=$2 check hash state_device
+  fm_custom_check_snapshot_cleanup
+  check="$state/$id.check.sh"
+  fm_custom_check_trust_read "$state" "$id" || return 1
+  state_device=$(fm_pr_file_device "$state") || return 1
+  fm_pr_private_file_valid "$check" 700 "$state_device" || return 1
+  FM_CUSTOM_CHECK_SNAPSHOT=$(mktemp "$state/.fm-custom-check.XXXXXX") || return 1
+  cp "$check" "$FM_CUSTOM_CHECK_SNAPSHOT" || { fm_custom_check_snapshot_cleanup; return 1; }
+  chmod 0600 "$FM_CUSTOM_CHECK_SNAPSHOT" || { fm_custom_check_snapshot_cleanup; return 1; }
+  [ -f "$FM_CUSTOM_CHECK_SNAPSHOT" ] && [ ! -L "$FM_CUSTOM_CHECK_SNAPSHOT" ] \
+    || { fm_custom_check_snapshot_cleanup; return 1; }
+  [ "$(fm_pr_file_mode "$FM_CUSTOM_CHECK_SNAPSHOT")" = 600 ] \
+    || { fm_custom_check_snapshot_cleanup; return 1; }
+  [ "$(fm_pr_file_device "$FM_CUSTOM_CHECK_SNAPSHOT")" = "$state_device" ] \
+    || { fm_custom_check_snapshot_cleanup; return 1; }
+  [ "$(fm_pr_file_link_count "$FM_CUSTOM_CHECK_SNAPSHOT")" = 1 ] \
+    || { fm_custom_check_snapshot_cleanup; return 1; }
+  hash=$(fm_custom_check_sha256 "$FM_CUSTOM_CHECK_SNAPSHOT") \
+    || { fm_custom_check_snapshot_cleanup; return 1; }
+  [ "$hash" = "$FM_CUSTOM_CHECK_HASH" ] || { fm_custom_check_snapshot_cleanup; return 1; }
+}
+
+fm_custom_check_snapshot_cleanup() {
+  [ -z "$FM_CUSTOM_CHECK_SNAPSHOT" ] || rm -f -- "$FM_CUSTOM_CHECK_SNAPSHOT"
+  FM_CUSTOM_CHECK_SNAPSHOT=
+}

package/.agents/backend/fm-check-register.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# Bind an intentional custom watcher check to its current bytes.
+# Usage: fm-check-register.sh <id>
+# Retire with fm-check-unregister.sh <id>; do not hand-compose an rm.
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE:-$FM_HOME/state}"
+
+# shellcheck source=bin/fm-pr-lib.sh
+. "$SCRIPT_DIR/fm-pr-lib.sh"
+# shellcheck source=bin/fm-check-lib.sh
+. "$SCRIPT_DIR/fm-check-lib.sh"
+
+if [ "$#" -ne 1 ] || ! fm_pr_task_id_valid "$1"; then
+  echo "error: invalid custom check registration" >&2
+  exit 2
+fi
+
+ID=$1
+CHECK="$STATE/$ID.check.sh"
+TRUST="$STATE/$ID.check-trust"
+[ -d "$STATE" ] && [ ! -L "$STATE" ] || { echo "error: state directory is unavailable" >&2; exit 1; }
+[ -f "$CHECK" ] && [ ! -L "$CHECK" ] || { echo "error: custom check is unavailable" >&2; exit 1; }
+STATE_DEVICE=$(fm_pr_file_device "$STATE") || exit 1
+fm_pr_private_file_valid "$CHECK" 700 "$STATE_DEVICE" \
+  || { echo "error: custom check is unavailable" >&2; exit 1; }
+fm_pr_regular_destination_on_device_or_absent "$TRUST" "$STATE_DEVICE" \
+  || { echo "error: custom check trust path is unavailable" >&2; exit 1; }
+HASH=$(fm_custom_check_sha256 "$CHECK") || { echo "error: custom check hash is unavailable" >&2; exit 1; }
+umask 077
+TMP=$(mktemp "$STATE/.fm-custom-check-trust.XXXXXX") || exit 1
+trap '[ -z "$TMP" ] || rm -f -- "$TMP"' EXIT HUP INT TERM
+printf '%s\n%s\n' fm-custom-check-v1 "$HASH" > "$TMP" || exit 1
+chmod 0600 "$TMP" || exit 1
+fm_pr_regular_destination_on_device_or_absent "$TRUST" "$STATE_DEVICE" || exit 1
+mv -f -- "$TMP" "$TRUST" || exit 1
+TMP=
+fm_custom_check_registered "$STATE" "$ID" || { rm -f -- "$TRUST"; exit 1; }
+printf 'registered: state/%s.check.sh\n' "$ID"

package/.agents/backend/fm-check-unregister.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Retire an intentional custom watcher check and its trust binding.
+# Usage: fm-check-unregister.sh <id>
+# Pass only the id. An unset FM_STATE_OVERRIDE selects FM_HOME/state; an
+# explicitly empty override, an invalid id, or a resolved state path that is
+# not an existing non-symlink directory is refused before removal.
+# Each existing named artifact must be an ordinary single-link file on the
+# state directory's device; only <id>.check.sh and <id>.check-trust are removed.
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+FM_ROOT="${FM_ROOT_OVERRIDE:-$(cd "$SCRIPT_DIR/.." && pwd)}"
+FM_HOME="${FM_HOME:-${FM_ROOT_OVERRIDE:-$FM_ROOT}}"
+STATE="${FM_STATE_OVERRIDE-$FM_HOME/state}"
+
+# shellcheck source=bin/fm-pr-lib.sh
+. "$SCRIPT_DIR/fm-pr-lib.sh"
+
+if [ "$#" -ne 1 ] || ! fm_pr_task_id_valid "$1"; then
+  echo "error: invalid custom check unregistration" >&2
+  exit 2
+fi
+
+ID=$1
+
+if [ -z "${STATE-}" ] || [ ! -d "${STATE-}" ] || [ -L "${STATE-}" ]; then
+  echo "error: state directory is unavailable" >&2
+  exit 1
+fi
+
+CHECK="$STATE/$ID.check.sh"
+TRUST="$STATE/$ID.check-trust"
+STATE_DEVICE=$(fm_pr_file_device "$STATE") || {
+  echo "error: state directory is unavailable" >&2
+  exit 1
+}
+
+for artifact in "$CHECK" "$TRUST"; do
+  [ -e "$artifact" ] || [ -L "$artifact" ] || continue
+  if [ ! -f "$artifact" ] || [ -L "$artifact" ] \
+    || [ "$(fm_pr_file_device "$artifact")" != "$STATE_DEVICE" ] \
+    || [ "$(fm_pr_file_link_count "$artifact")" != 1 ]; then
+    echo "error: custom check is unsafe to remove" >&2
+    exit 1
+  fi
+done
+
+rm -f -- "$CHECK" "$TRUST" || {
+  echo "error: custom check could not be removed" >&2
+  exit 1
+}
+printf 'unregistered: state/%s.check.sh\n' "$ID"