agentwire-dev 1.56.1__tar.gz → 1.57.0__tar.gz

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwire-dev
-Version: 1.56.1
+Version: 1.57.0
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.56.1"
+__version__ = "1.57.0"

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/__main__.py

@@ -16,7 +16,6 @@ from . import (  # noqa: E402  # must follow load_dotenv() above
 from .core import (  # noqa: E402,F401  # E402: must follow load_dotenv(); F401: re-exported moved helpers
     _UNATTENDED_ENV_KEYS,
     CONFIG_DIR,
-    KIND_DEFAULT_POSTURE,
     AgentCommand,
     _add_posture_harness_flags,
     _build_tmux_env_flags,
@@ -188,10 +187,11 @@ Command Categories:
     from . import diff_cli, limits_cli, msg_cli, pane_cli, prompts_cli, send_cli  # noqa: I001  # session_cli kept on its own line below to minimize Phase 1 #495 merge conflicts
     from . import session_cli
     from . import channels_cli, config_cli, portal_cli, tts_cli
-    from . import scheduler_cli, ensure_cli
+    from . import scheduler_cli, ensure_cli, tasks_cli
     from . import doctor_cli, history_cli, machine_cli, safety_cli
     from . import handoff_cli, hooks_cli, mcp_cli, roles_cli, tunnels_cli
     from . import notify_cli, palette_cli, push_cli, repo_cli, system_cli, wiki_cli
+    from . import tabs_cli
     from .council import cli as council_cli
 
     _REGISTRARS = [  # noqa: N806  # registry constant; Phase 1 of #495 appends here
@@ -207,6 +207,7 @@ Command Categories:
         channels_cli.register_channels_parser,
         scheduler_cli.register_scheduler_parser,
         ensure_cli.register_ensure_parser,
+        tasks_cli.register_tasks_parser,
         doctor_cli.register_doctor_parser,
         safety_cli.register_safety_parser,
         machine_cli.register_machine_parser,
@@ -224,6 +225,7 @@ Command Categories:
         repo_cli.register_repo_parser,
         config_cli.register_config_parser,
         palette_cli.register_palette_parser,
+        tabs_cli.register_tabs_parser,
     ]
     for _reg in _REGISTRARS:
         _reg(subparsers)

agentwire_dev-1.57.0/agentwire/chrome_tabs.py

@@ -0,0 +1,124 @@
+"""Tracks claude-in-chrome tab ids opened by a session (#717).
+
+Worktree sessions open claude-in-chrome tabs to e2e-verify their work before
+opening a PR. Those tabs are never closed if the session finishes without
+tidying up after itself, or dies mid-work — this module is pure bookkeeping
+so a crashed session's orphaned tabs can still be identified during teardown.
+
+agentwire has no way to call `tabs_close_mcp` itself: that MCP server runs
+inside the CALLING agent's own client, not agentwire's process. So this only
+tracks tab ids; the actual close always happens at the LLM/agent layer —
+either the session closing its own tabs before finishing (the normal path),
+or `worktree_remove` surfacing untracked-but-still-open tab ids to whichever
+agent runs the teardown (the crash backstop).
+
+Layout: one JSON file (``~/.agentwire/chrome-tabs.json``), keyed by session
+name -> list of ``{tab_id, url, tracked_at}``. Plain JSON, hand-editable.
+"""
+
+import contextlib
+import datetime
+import fcntl
+import json
+import os
+import tempfile
+from pathlib import Path
+
+REGISTRY_FILE = Path.home() / ".agentwire" / "chrome-tabs.json"
+
+
+@contextlib.contextmanager
+def _locked():
+    """Serialize read-modify-write across processes via an flock sidecar."""
+    REGISTRY_FILE.parent.mkdir(parents=True, exist_ok=True)
+    lock_path = REGISTRY_FILE.with_suffix(REGISTRY_FILE.suffix + ".lock")
+    fd = os.open(str(lock_path), os.O_CREAT | os.O_RDWR, 0o644)
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX)
+        yield
+    finally:
+        fcntl.flock(fd, fcntl.LOCK_UN)
+        os.close(fd)
+
+
+def _load() -> dict:
+    if not REGISTRY_FILE.exists():
+        return {}
+    try:
+        data = json.loads(REGISTRY_FILE.read_text())
+        return data if isinstance(data, dict) else {}
+    except (json.JSONDecodeError, OSError):
+        return {}
+
+
+def _save(data: dict) -> None:
+    """Atomically write the registry (temp file in same dir + os.replace)."""
+    REGISTRY_FILE.parent.mkdir(parents=True, exist_ok=True)
+    payload = json.dumps(data, indent=2) + "\n"
+    fd, tmp = tempfile.mkstemp(dir=str(REGISTRY_FILE.parent), prefix=REGISTRY_FILE.name + ".", suffix=".tmp")
+    try:
+        with os.fdopen(fd, "w") as f:
+            f.write(payload)
+            f.flush()
+            os.fsync(f.fileno())
+        os.replace(tmp, REGISTRY_FILE)  # atomic on POSIX
+    except BaseException:
+        with contextlib.suppress(OSError):
+            os.unlink(tmp)
+        raise
+
+
+def track(session: str, tab_id: str, url: str | None = None) -> dict:
+    """Record that ``session`` opened claude-in-chrome tab ``tab_id``.
+
+    Idempotent per (session, tab_id) — re-tracking the same tab just refreshes
+    its entry rather than duplicating it.
+    """
+    entry = {
+        "tab_id": tab_id,
+        "url": url,
+        "tracked_at": datetime.datetime.now().astimezone().isoformat(timespec="seconds"),
+    }
+    with _locked():
+        data = _load()
+        tabs = [t for t in data.get(session, []) if t.get("tab_id") != tab_id]
+        tabs.append(entry)
+        data[session] = tabs
+        _save(data)
+    return entry
+
+
+def untrack(session: str, tab_id: str) -> bool:
+    """Drop a tracked tab (the session closed it itself). Returns whether it was tracked."""
+    with _locked():
+        data = _load()
+        tabs = data.get(session, [])
+        remaining = [t for t in tabs if t.get("tab_id") != tab_id]
+        removed = len(remaining) != len(tabs)
+        if remaining:
+            data[session] = remaining
+        else:
+            data.pop(session, None)
+        if removed:
+            _save(data)
+    return removed
+
+
+def tabs_for(session: str) -> list[dict]:
+    """All tracked tabs for a session (read-only)."""
+    return _load().get(session, [])
+
+
+def clear(session: str) -> list[dict]:
+    """Drop + return every tracked tab for a session — the teardown backstop."""
+    with _locked():
+        data = _load()
+        tabs = data.pop(session, [])
+        if tabs:
+            _save(data)
+    return tabs
+
+
+def all_tabs() -> dict[str, list[dict]]:
+    """Every session -> tracked-tabs mapping (read-only, for listing/debugging)."""
+    return _load()

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/config.py

@@ -101,9 +101,11 @@ class WorktreesConfig:
     # Gitignored files that `git worktree add` won't carry over (it only
     # checks out tracked files). These are copied from the main repo into
     # each fresh worktree so agents have the secrets/config they need.
-    # .agentwire.yml is included because worktree-dispatched tasks can't
-    # load their task definition without it when the project gitignores it.
-    copy_files: list = field(default_factory=lambda: [".env", ".agentwire.yml"])
+    # .agentwire.yml/.agentwire.tasks.yml are included because worktree-dispatched
+    # tasks can't load their session/task config without them when the project
+    # gitignores them (the latter is the protected, host-authored task-exec file —
+    # #720).
+    copy_files: list = field(default_factory=lambda: [".env", ".agentwire.yml", ".agentwire.tasks.yml"])
 
 
 @dataclass
@@ -120,7 +122,7 @@ class ProjectsConfig:
 
 @dataclass
 class WorktreeConfig:
-    """Standalone worktree-session orchestration (`worktree:` config key).
+    """Standalone worktree session orchestration (`worktree:` config key).
 
     Governs `agentwire worktree <name>` — the first-class primitive for
     spawning an isolated branch+worktree+session for one unit of work.
@@ -621,7 +623,7 @@ def _dict_to_config(data: dict) -> Config:
         enabled=worktrees_data.get("enabled", True),
         suffix=worktrees_data.get("suffix", "-worktrees"),
         auto_create_branch=worktrees_data.get("auto_create_branch", True),
-        copy_files=worktrees_data.get("copy_files", [".env", ".agentwire.yml"]),
+        copy_files=worktrees_data.get("copy_files", [".env", ".agentwire.yml", ".agentwire.tasks.yml"]),
     )
     projects = ProjectsConfig(
         dir=projects_data.get("dir", "~/projects"),

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/core.py

@@ -28,7 +28,7 @@ from .project_config import (
     normalize_session_type,
 )
 from .roles import RoleConfig, merge_roles
-from .worktree import parse_session_name
+from .worktree import git_common_dir, parse_session_name
 
 # Default config directory
 CONFIG_DIR = Path.home() / ".agentwire"
@@ -489,16 +489,30 @@ def wait_for_shell_prompt(target: str, timeout: float = 2.0) -> None:
         time.sleep(0.05)
 
 
+def _live_session_cwd(session: str) -> Path | None:
+    """The session's current pane cwd, or None if it isn't a live tmux session.
+
+    Unlike ``_get_session_project_path``, this never falls back to guessing a
+    path from the session name — a guessed path is unsafe for an identity
+    comparison (#715's same-project check needs the real cwd or nothing).
+    """
+    if not tmux_session_exists(session):
+        return None
+    result = subprocess.run(
+        ["tmux", "display-message", "-t", session, "-p", "#{pane_current_path}"],
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode == 0 and result.stdout.strip():
+        return Path(result.stdout.strip())
+    return None
+
+
 def _get_session_project_path(session: str) -> Path | None:
     """Get a session's project path from tmux cwd, falling back to session name parsing."""
-    if tmux_session_exists(session):
-        result = subprocess.run(
-            ["tmux", "display-message", "-t", session, "-p", "#{pane_current_path}"],
-            capture_output=True,
-            text=True,
-        )
-        if result.returncode == 0 and result.stdout.strip():
-            return Path(result.stdout.strip())
+    live = _live_session_cwd(session)
+    if live is not None:
+        return live
 
     # Fallback: derive from session name
     config = load_config()
@@ -507,6 +521,41 @@ def _get_session_project_path(session: str) -> Path | None:
     return projects_dir / project
 
 
+def _same_project(path_a: Path, path_b: Path) -> bool:
+    """True when two paths belong to the same git repo (shared .git dir
+    across linked worktrees) or, outside a repo, are the same resolved path."""
+    common_a = git_common_dir(path_a)
+    if common_a is None:
+        return path_a.resolve() == path_b.resolve()
+    common_b = git_common_dir(path_b)
+    if common_b is None:
+        return path_a.resolve() == path_b.resolve()
+    return common_a == common_b
+
+
+def resolve_default_created_by(caller: str | None, target_path: Path) -> str | None:
+    """The default ``created_by`` when none was explicitly given.
+
+    Inherit the caller only when the new session's project is the one the
+    caller is already running in — a cross-project spawn gets its own root
+    instead of flattening into the caller's subtree (#715). An explicit
+    --created-by always wins and never reaches this function.
+
+    Uses ``_live_session_cwd`` rather than ``_get_session_project_path`` —
+    the latter's session-name-guessing fallback isn't a safe basis for an
+    identity comparison (it doesn't understand the worktree naming scheme,
+    `{project}-{name}`, and would misjudge same/cross-project); if the
+    caller's real cwd can't be confirmed, treat it as unknown (no inheritance)
+    rather than risk a wrong guess.
+    """
+    if not caller:
+        return None
+    caller_path = _live_session_cwd(caller)
+    if caller_path is None:
+        return None
+    return caller if _same_project(caller_path, target_path) else None
+
+
 def tmux_session_has_agent(name: str) -> bool:
     """Check if a tmux session has an agent running (not just a bare shell).
 
@@ -1135,14 +1184,20 @@ def _post_desktop_notification(text: str, session: str | None = None, priority:
         return False
 
 
-KIND_DEFAULT_POSTURE = {
-    "orchestrator": "bypass",      # agentwire new — you drive it, full access
-    "worktree-session": "bypass",  # agentwire worktree — autonomous, full access
-    "worker": "restricted",        # agentwire spawn — locked-down executor
-}
+def _default_posture(kind: str | None, worktree_topology: bool = False) -> str:
+    """Default posture for a spawn: bypass, unless it's a worker that is NOT
+    isolated on its own worktree — a pane (agentwire spawn) or a worker on
+    plain main topology, both sharing a live checkout someone else may be
+    watching, stay restricted. Orchestrators (main or worktree topology) and
+    worktree-topology workers get full autonomous access — nothing to step
+    on but their own isolated branch.
+    """
+    if kind == "worker" and not worktree_topology:
+        return "restricted"
+    return "bypass"
 
 
-def _resolve_session_type_from_args(args, kind: str) -> tuple[str | None, str | None]:
+def _resolve_session_type_from_args(args, kind: str, worktree_topology: bool = False) -> tuple[str | None, str | None]:
     """Resolve the internal fused session type from the shared flag core.
 
     Posture × harness are the canonical axes; legacy --type (fused strings or
@@ -1158,7 +1213,7 @@ def _resolve_session_type_from_args(args, kind: str) -> tuple[str | None, str |
     posture = getattr(args, 'posture', None)
     harness = getattr(args, 'harness', None)
     type_arg = getattr(args, 'type', None)
-    default_posture = KIND_DEFAULT_POSTURE.get(kind, "bypass")
+    default_posture = _default_posture(kind, worktree_topology)
 
     if posture or harness:
         try:

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/diff_cli.py

@@ -29,7 +29,7 @@ Output shape (``--json``)::
 
 Base resolution (no ``--base``): if the worktree has uncommitted changes the
 diff is vs ``HEAD`` (what the agent just did, not yet committed); otherwise it
-is vs ``origin/main`` (a worktree-session's committed branch work). The portal
+is vs ``origin/main`` (a worktree session's committed branch work). The portal
 relies on this so a phone review needs zero flags.
 """
 

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/doctor_cli.py

@@ -2,8 +2,9 @@
 
 ``doctor`` walks the full install (Python/deps, hooks, skills, damage control,
 source-checkout drift, services, config, SSH/tunnels, voice loop, secrets,
-remote machines, dead-lettered messages) and optionally auto-fixes the local
-ones. ``network status`` is the read-only network-health glance.
+remote machines, dead-lettered messages, dangling worktree sessions) and
+optionally auto-fixes the local ones. ``network status`` is the read-only
+network-health glance.
 
 The hook/skill drift helpers (``get_hooks_source``, ``_managed_hook_files``,
 ``_managed_file_state``, ``skill_drift``, ``CLAUDE_SKILLS_DIR``) are owned by
@@ -869,6 +870,26 @@ def cmd_doctor(args) -> int:
     except Exception as e:
         print(f"  [..] Could not check dead-lettered messages: {e}")
 
+    # 11. Check for dangling worktree sessions (live, open PR, no live parent
+    # to review/merge it — #716's concrete failure mode: a rootless-but-
+    # still-subordinate session that correctly refuses to self-merge).
+    print("\nChecking for dangling worktree sessions...")
+    try:
+        from . import worktree_registry
+        from .session_cli import scan_dangling_worktrees
+
+        dangling = scan_dangling_worktrees(worktree_registry.all_entries())
+        if not dangling:
+            print("  [ok] No dangling worktree sessions found")
+        else:
+            issues_found += 1
+            print(f"  [!!] {len(dangling)} live worktree session(s) with an open PR and no live parent:")
+            for d in dangling:
+                print(f"       - {d['session']} branch={d['branch']} {d.get('pr_url', '')} ({d['reason']})")
+            print("       Assign a parent (agentwire msg send / --created-by) or merge/close the PR yourself.")
+    except Exception as e:
+        print(f"  [..] Could not check for dangling worktree sessions: {e}")
+
     # Summary
     print()
     print("-" * 60)

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/ensure_cli.py

@@ -492,6 +492,16 @@ def _run_ensure_task(args, session, task, ctx, shell, project_path, json_mode) -
                         self.roles = task_role if task_role else None
                         self.model = None
                         self.json = json_mode
+                        # Force the pre-#715 unconditional-inherit behavior:
+                        # ensure is the scheduler's dispatch primitive — the
+                        # scheduler daemon fans out across many projects from
+                        # one fixed tmux session by design, so #715's
+                        # same-project default (meant for an interactive
+                        # session's own cross-project spawns) would wrongly
+                        # drop the parent link for nearly every dispatched
+                        # task. Always parent to whichever session is
+                        # actually running this ensure call.
+                        self.created_by = pane_manager.get_current_session()
 
                 from . import session_cli
                 result = session_cli.cmd_new(NewArgs(task.role))
@@ -739,7 +749,7 @@ def cmd_task_list(args) -> int:
         return 0
 
     if not tasks:
-        print(f"No tasks defined in {project_path / '.agentwire.yml'}")
+        print(f"No tasks defined in {project_path / '.agentwire.tasks.yml'}")
         return 0
 
     print(f"Tasks in {project_path.name}:\n")

{agentwire_dev-1.56.1 → agentwire_dev-1.57.0}/agentwire/hooks/damage-control/bash-tool-damage-control.py

@@ -766,12 +766,16 @@ PROTECTED_CONTROL_PLANE_PATHS = [
     # confused-deputy escape). Treat them as control plane (#466 lockdown).
     "~/.agentwire/scheduler.yaml",      # scheduler gate commands run via shell
     "~/.agentwire/config.yaml",         # service healthcheck commands run via shell
-    # Per-project task config: ``.agentwire.yml`` also defines task pre/post/gate
-    # commands. Protecting it closes the same escape, with an ergonomic tradeoff —
-    # under worktree dispatch the agent can no longer author its own task config,
-    # so task authoring becomes a host-side act (consistent with the control-plane
-    # guarantee: loosening is always host-side).
-    "*.agentwire.yml",                  # project session/task config (any dir)
+    # Per-project task-EXECUTION config (#720): split out of ``.agentwire.yml``,
+    # which is now purely declarative (type/roles/voice/parent/worktree) and
+    # agent-writable again — it carries no exec vector. ``.agentwire.tasks.yml``
+    # holds the ``tasks:`` block (pre/post/on_task_end/shell/unattended_allow),
+    # which agentwire runs the same way (confused-deputy risk above), so it
+    # stays protected. Authored via propose-and-promote: an agent drafts to the
+    # UNPROTECTED ``.agentwire.tasks.proposed.yml`` staging file; a human reviews
+    # (``agentwire tasks review``) and promotes (``agentwire tasks promote``) —
+    # the agent never writes the live file. See ``agentwire/tasks_cli.py``.
+    "*.agentwire.tasks.yml",            # project task-execution config (any dir)
 ]
 
 
@@ -791,12 +795,33 @@ def _protected_path_patterns() -> List[str]:
     return out
 
 
-def is_protected_control_plane(file_path: str) -> bool:
-    """True if ``file_path`` is part of the damage-control control plane."""
+def _matched_protected_pattern(file_path: str) -> Optional[str]:
+    """The protected-path pattern that matches ``file_path``, if any."""
     for pat in _protected_path_patterns():
         if match_path(file_path, pat):
-            return True
-    return False
+            return pat
+    return None
+
+
+def is_protected_control_plane(file_path: str) -> bool:
+    """True if ``file_path`` is part of the damage-control control plane."""
+    return _matched_protected_pattern(file_path) is not None
+
+
+def _protected_reason(matched_pattern: str) -> str:
+    """Block reason for a protected-control-plane hit, tailored to the path.
+
+    ``.agentwire.tasks.yml`` has a real, host-side remedy (propose-and-promote,
+    #720) — name it so the agent doesn't dead-end. Everything else keeps the
+    generic "edit on the host" message.
+    """
+    if matched_pattern.endswith(".agentwire.tasks.yml"):
+        return (
+            "protected task-execution control-plane file (host-owned) — draft "
+            "to .agentwire.tasks.proposed.yml instead, then ask the host to run "
+            "`agentwire tasks review` and `agentwire tasks promote`"
+        )
+    return "protected control-plane file (host-owned; edit on the host)"
 
 
 def check_protected_path(
@@ -808,10 +833,11 @@ def check_protected_path(
     Used by the edit/write hooks. The allowlist (a human opt-in) may override;
     nothing else does.
     """
-    if is_protected_control_plane(file_path):
+    matched = _matched_protected_pattern(file_path)
+    if matched:
         if is_path_allowed_for_op(file_path, allowed_paths, "edit"):
             return False, ""
-        return True, "protected control-plane file (host-owned; edit on the host)"
+        return True, _protected_reason(matched)
     return False, ""
 
 
@@ -841,7 +867,58 @@ def check_protected_command(
                 op = _infer_operation_from_reason(reason)
                 if is_command_path_allowed(command, allowed_paths, op):
                     break
-                return True, f"Protected control-plane path: {path}"
+                return True, _protected_reason(path)
+    return False, ""
+
+
+# ============================================================================
+# PROTECTED COMMANDS (escape-hatch- AND kill-switch-EXEMPT, like the protected
+# control plane above, but keyed on COMMAND SHAPE rather than a file path)
+# ============================================================================
+#
+# Some operations are dangerous no matter which file they touch — running
+# them at all IS the confused-deputy escape, not merely writing a particular
+# path. ``agentwire tasks promote`` is the first case (#720/#721 review):
+# it's the host-trusted program that copies a vetted draft into the protected
+# ``.agentwire.tasks.yml``. If a policed/unattended agent could just invoke
+# the CLI itself, the file protection above is moot — so this, like the
+# protected-path check, is evaluated before ``detect_escape_hatch`` and the
+# kill switch, and has NO allowlist override (there's no legitimate reason
+# for an agent to ever run this; unlike a path, there's nothing to allowlist
+# it TO). This is defense in depth on TOP OF ``cmd_tasks_promote``'s own
+# runtime refusal (unattended check + host-context gate in ``tasks_cli.py``)
+# — that second gate is what actually closes the ``python3 -c
+# "from agentwire.tasks_cli import cmd_tasks_promote; ..."`` bypass, since a
+# raw interpreter call never matches a bash command pattern at all.
+
+PROTECTED_COMMAND_PATTERNS: List[Tuple[str, str]] = [
+    (
+        r'\bagentwire\s+tasks\s+promote\b',
+        "agentwire tasks promote writes the protected .agentwire.tasks.yml — "
+        "host-only, run it from your own terminal (not through an agent).",
+    ),
+]
+
+
+def check_protected_bash_command(command: str) -> Tuple[bool, str]:
+    """Block a command matching a ``PROTECTED_COMMAND_PATTERNS`` entry.
+
+    Unconditional — no allowlist override, no escape hatch, no kill switch
+    (see module note above). These are COMMAND-PREFIX patterns, so — like the
+    ``anchored`` tooldef bashToolPatterns (#675) — matched only against
+    ``masked_subcommands``: quoting/escaping of the command itself still
+    normalizes to the literal form (``agentwire tasks prom''ote`` can't sneak
+    past), but quoted CONTENT (a commit message, an echo string) that merely
+    *mentions* the phrase is masked out first, so it can't false-match.
+    """
+    haystacks = masked_subcommands(command)
+    for pattern, reason in PROTECTED_COMMAND_PATTERNS:
+        for hay in haystacks:
+            try:
+                if re.search(pattern, hay, re.IGNORECASE):
+                    return True, reason
+            except re.error:
+                continue
     return False, ""
 
 
@@ -1121,6 +1198,8 @@ def check_command(command: str, config: Dict[str, Any]) -> Dict[str, Any]:
       0. Protected control plane → BLOCK (escape-hatch- AND kill-switch-exempt;
          only the user's allowlist re-permits) — runs FIRST so an agent can't
          self-authorize a write to the files that gate everything else.
+      0.5. Protected commands → BLOCK (same exemption, no allowlist override —
+         a command whose mere invocation is the escape, not a path it touches).
       1. Escape hatch (``# allow: <reason>``) → ALLOW (escape=True)
       2. Kill switch (``config["safety"]["enabled"] is False``) → ALLOW (disabled=True)
       3. Hard-blocked bash patterns (skip if ``id`` in ``disabled_rules``)
@@ -1149,6 +1228,19 @@ def check_command(command: str, config: Dict[str, Any]) -> Dict[str, Any]:
             "protected": True,
         }
 
+    # Protected COMMANDS — same tier, same reason (an agent-invoked
+    # `agentwire tasks promote` is the confused-deputy escape itself, not a
+    # path it happens to touch).
+    cmd_blocked, cmd_reason = check_protected_bash_command(command)
+    if cmd_blocked:
+        return {
+            "decision": "block",
+            "reason": cmd_reason,
+            "pattern": "protectedCommand",
+            "command": command,
+            "protected": True,
+        }
+
     # Parser unavailable ⇒ no rules loaded ⇒ fail closed (block), before the
     # escape hatch / kill switch can wave it through.
     if config.get("_parser_unavailable"):