damage-control: packs/groups state, heal+migration, CLI, MCP, doctor, docs (#1141)

Built by dotdev.dev

Author: dotdevdotdev

.claude/skills/agentwire-cli/SKILL.md

@@ -286,6 +286,9 @@ agentwire fetch <url> --limit 4000    # cap chars (default 8000, 0 = no limit)
 agentwire safety check "cmd"    # test if command would be blocked
 agentwire safety status         # show pattern counts and recent blocks
 agentwire safety logs           # query audit logs
+agentwire safety packs list|status [--json]   # vendor rule packs (aws, databases, ...): off by default
+agentwire safety packs enable|disable <name>   # HUMAN-ONLY (tty + protected); agents suggest, never run
+agentwire safety groups list|status|enable|disable <g>  # default groups; kernel can't be disabled
 agentwire safety install        # install damage control hooks
 agentwire hooks install         # install permission hook (Claude Code only)
 agentwire hooks uninstall       # remove permission hook (Claude Code only)

.claude/skills/agentwire-mcp-tools/SKILL.md

@@ -182,4 +182,6 @@ up|down`) — the MCP surface is read-only introspection.
 
 **Chrome tab bookkeeping (MCP):** `chrome_tab_track(tab_id, url, session)` / `chrome_tab_untrack(tab_id, session)` — agentwire can't call `tabs_close_mcp` itself (that server runs inside the calling agent's own client), so this is pure tracking: a worktree session records a verification tab right after `tabs_create_mcp`, then closes it + untracks before finishing. `worktree_remove`/`worktree_prune --gc-merged` check this during teardown and surface any tab a session never closed, so the tearing-down agent can close it. `chrome_tab_list(session)` shows what's tracked.
 
+**Damage-control packs (read-only, #1141):** `safety_packs_list()` / `safety_groups_list()` show which vendor rule packs (aws, databases, containers, ...) and default groups are on. When the user's work touches a vendor whose pack is off, SUGGEST `agentwire safety packs enable <name>` — enabling/disabling is human-only (tty gate + protected command); never run it. See wiki internals/damage-control.md.
+
 **Briefing Mode** (asymmetric-verbosity orchestration): an `anchor` (terse, human-facing) fans out `correspondent` worktrees (verbose researchers) via `worktree_create(roles="correspondent")`; they file reports into `research_dir()` (`~/.agentwire/research/<session>/`) and drop a passive `msg_send(kind="ingest", ref="<path>")` pointer; the anchor `msg_pull()`s on the human's cue and briefs with `say(text=..., display=...)` (voice + toast, different content). See wiki briefing-mode.md.

CLAUDE.md

@@ -166,6 +166,10 @@ LLM-maintained knowledge base at `~/.agentwire/wiki/` using the Karpathy LLM Wik
 
 Deterministic (zero-LLM) recovery from the Claude Code usage-limit dialog: a launchd watchdog (`agentwire limits tick`, 60s) plus ensure's completion poll detect the dialog, park the session (option 1: stop and wait), parse the reset time, email the owner via Resend, and nudge the session to continue after reset. Park state under `~/.agentwire/usage-limit/` guards every surface — ensure exits 7 (`usage_limit`), the scheduler skips dispatch, the idle hook never reaps a parked session. CLI under `agentwire limits ...`. Full reference: [`docs/wiki/usage-limit-recovery.md`](docs/wiki/usage-limit-recovery.md).
 
+## Damage-Control Packs (#1141)
+
+Every bundled `rules/*.yaml` / `tooldefs/*.yaml` is owned by one entry in `agentwire/safety/groups.py`: a default **group** (on; a human may opt out — `agentwire safety groups disable <g>`; the kernel `control-plane` + `core` never can) or an opt-in vendor **pack** (aws, gcp, firebase, cloud-hosting, databases, containers, infrastructure, publish — off until `agentwire safety packs enable <name>`). State is `packs:` / `disabled_groups:` in the protected `~/.agentwire/damagecontrol.yml`; mutations are human-only (tty gate + `PROTECTED_COMMAND_PATTERNS`), reads (`list|status`, MCP `safety_packs_list`/`safety_groups_list`) are open. **The hooks never read the state — they load what is installed, so "off" means "not installed"** (heal removes only a *pristine* file of a disabled entry, never an edited one). A pre-packs install is migrated by recording every pack with any installed file as enabled, so upgrading changes nothing. **Agents SUGGEST enabling a pack when the user's work touches that vendor; they never run it.** Detail: [`docs/wiki/internals/damage-control.md`](docs/wiki/internals/damage-control.md#rule-groups-and-packs-1141).
+
 ## Expired-Login Detection
 
 An expired Claude login refuses every turn with a **synthetic** assistant message (`Login expired · Please run /login`, `error: authentication_failed`, zero tokens, 16ms) and then goes idle. The pane is alive and the agent process is running, so every liveness check passes forever — which is how #867 cost `memory-manager` 7217s and `ai-morning-briefing` 14400s on the same 2026-08-04 outage, reported as `incomplete — Timeout waiting for task completion`. **The detector reads the TRANSCRIPT, never the pane** (`agentwire/auth_expired.py`): Claude renders this inline, not as a select-menu, so the phrase also appears in any pane merely *quoting* the incident, and a false positive here halts the whole board. Keyed on the structured `error` field, and on the **LAST** assistant turn only — so recovery needs no reset mechanism. **Field-proven across two outages that render DIFFERENTLY** (`Login expired` 08-04 / `Not logged in` 07-07, same `error`), which is the argument for the structured field; the residual risk is a future RESTRUCTURING of that field, not a rewording. All 16 real `rate_limit` rows are structurally identical to an auth refusal and reach the same predicate — only the error-value check keeps a transient blip from gating the machine. Transcripts are located by `conversation_ids` (#871) or, when the record predates that, by files in the project's history dir written since **the attempt began** — never "the newest `.jsonl`". That anchor is load-bearing: the refusal lands ~15ms after the prompt submits, seconds before the completion wait is entered, so anchoring at the wait misses it entirely. Detection is **machine-wide** (`~/.agentwire/auth-expired/state.json`) — one outage, one owner email (throttled 1h, shared Resend wiring), `detected_at` carried forward, an `OUTAGE_TTL` so a stale flag can never wedge the scheduler, and a `clear_state()` on the completion success path so a successful turn genuinely reopens the gate rather than the docs merely claiming it does. Surfaces: ensure exits **8** (`auth_expired`) and never retries, scheduler dispatch skips without consuming `last_run`, worktree finalize opens no PR, `agentwire doctor` reports it. No credential pre-flight: the secret is Keychain-gated on macOS, and `expiresAt` is the *access* token's, which lapses routinely and refreshes silently. Full reference: [`docs/wiki/auth-expired.md`](docs/wiki/auth-expired.md).

agentwire/doctor_cli.py

@@ -547,6 +547,27 @@ def _render_damage_control_section() -> int:
         if not (missing or outdated or unknown):
             print(f"  [ok] Damage-control {label} installed and match bundled")
 
+    # Rule groups and packs (#1141): informational only, never scored — a
+    # disabled pack is a choice, not drift.
+    try:
+        from agentwire.safety_packs_cli import overview
+
+        rows = overview()
+        on = [r["name"] for r in rows if r["kind"] == "pack" and r["enabled"]]
+        off = [r["name"] for r in rows if r["kind"] == "pack" and not r["enabled"]]
+        out = [r["name"] for r in rows if r["kind"] == "group" and not r["enabled"]]
+        print(f"  [..] Damage-control packs enabled: {', '.join(on) or '(none)'}")
+        print(f"  [..] Packs available: {', '.join(off) or '(none)'}  "
+              f"(agentwire safety packs enable <name>)")
+        for r in rows:
+            if r["suggest_enable"]:
+                print(f"  [..] {', '.join(r['binaries_found'])} found here — "
+                      f"pack '{r['name']}' is off")
+        if out:
+            print(f"  [..] Opted-out default groups: {', '.join(out)}")
+    except Exception as e:
+        print(f"  [..] Could not read pack state: {e}")
+
     # Files the bundle used to ship and no longer does. Informational: heal
     # never deletes them, and an edited one is the user's own (#1137).
     for section, files in safety_commands.retired_installed().items():

agentwire/hooks/damage-control/bash-tool-damage-control.py

@@ -34,7 +34,7 @@ def log_escape(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "05b94cdd15dd83517e6b4fa5e7235c98eb4bd484ec0b5d7b8c1cc90de4cdb810", "generated_at": "2026-10-19T11:15:19Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -5263,6 +5263,11 @@ def _refused_for_quoted_substitution(
         "agentwire tasks promote writes the protected .agentwire.tasks.yml — "
         "host-only, run it from your own terminal (not through an agent).",
     ),
+    (
+        r'\bagentwire\s+safety\s+(?:packs|groups)\s+(?:enable|disable)\b',
+        "agentwire safety packs/groups enable|disable changes damage-control "
+        "policy — host-only, run it from your own terminal (not through an agent).",
+    ),
 ]
 
 

agentwire/hooks/damage-control/edit-tool-damage-control.py

@@ -30,7 +30,7 @@ def log_disabled(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "05b94cdd15dd83517e6b4fa5e7235c98eb4bd484ec0b5d7b8c1cc90de4cdb810", "generated_at": "2026-10-19T11:15:19Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -5259,6 +5259,11 @@ def _refused_for_quoted_substitution(
         "agentwire tasks promote writes the protected .agentwire.tasks.yml — "
         "host-only, run it from your own terminal (not through an agent).",
     ),
+    (
+        r'\bagentwire\s+safety\s+(?:packs|groups)\s+(?:enable|disable)\b',
+        "agentwire safety packs/groups enable|disable changes damage-control "
+        "policy — host-only, run it from your own terminal (not through an agent).",
+    ),
 ]
 
 

agentwire/hooks/damage-control/mcp-tool-damage-control.py

@@ -49,7 +49,7 @@ def log_escape(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "05b94cdd15dd83517e6b4fa5e7235c98eb4bd484ec0b5d7b8c1cc90de4cdb810", "generated_at": "2026-10-19T11:15:19Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -5278,6 +5278,11 @@ def _refused_for_quoted_substitution(
         "agentwire tasks promote writes the protected .agentwire.tasks.yml — "
         "host-only, run it from your own terminal (not through an agent).",
     ),
+    (
+        r'\bagentwire\s+safety\s+(?:packs|groups)\s+(?:enable|disable)\b',
+        "agentwire safety packs/groups enable|disable changes damage-control "
+        "policy — host-only, run it from your own terminal (not through an agent).",
+    ),
 ]
 
 

agentwire/hooks/damage-control/read-tool-damage-control.py

@@ -36,7 +36,7 @@ def log_disabled(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "05b94cdd15dd83517e6b4fa5e7235c98eb4bd484ec0b5d7b8c1cc90de4cdb810", "generated_at": "2026-10-19T11:15:19Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -5265,6 +5265,11 @@ def _refused_for_quoted_substitution(
         "agentwire tasks promote writes the protected .agentwire.tasks.yml — "
         "host-only, run it from your own terminal (not through an agent).",
     ),
+    (
+        r'\bagentwire\s+safety\s+(?:packs|groups)\s+(?:enable|disable)\b',
+        "agentwire safety packs/groups enable|disable changes damage-control "
+        "policy — host-only, run it from your own terminal (not through an agent).",
+    ),
 ]
 
 

agentwire/hooks/damage-control/write-tool-damage-control.py

@@ -29,7 +29,7 @@ def log_disabled(*args, **kwargs): pass
 
 
 # === BEGIN AGENTWIRE HOOK STAMP (generated — do not edit) ===
-AGENTWIRE_HOOK_STAMP = {"core_sha256": "33f11ebb4e4472aedb37164dcb4c5d1010c5472bc516028d9aaa2c12070bdebc", "generated_at": "2026-10-19T00:29:08Z"}
+AGENTWIRE_HOOK_STAMP = {"core_sha256": "05b94cdd15dd83517e6b4fa5e7235c98eb4bd484ec0b5d7b8c1cc90de4cdb810", "generated_at": "2026-10-19T11:15:19Z"}
 # === END AGENTWIRE HOOK STAMP ===
 # === BEGIN GENERATED FROM agentwire/safety/_core.py ===
 """
@@ -5258,6 +5258,11 @@ def _refused_for_quoted_substitution(
         "agentwire tasks promote writes the protected .agentwire.tasks.yml — "
         "host-only, run it from your own terminal (not through an agent).",
     ),
+    (
+        r'\bagentwire\s+safety\s+(?:packs|groups)\s+(?:enable|disable)\b',
+        "agentwire safety packs/groups enable|disable changes damage-control "
+        "policy — host-only, run it from your own terminal (not through an agent).",
+    ),
 ]
 
 

agentwire/mcp_status.py

@@ -90,3 +90,34 @@ def network_status() -> str:
     if output:
         return output
     return f"Failed to check network: {data.get('error', 'Unknown error')}"
+
+
+def _format_entries(label: str, data: dict) -> str:
+    if not data.get("success"):
+        return f"Failed to list {label}: {data.get('error', 'Unknown error')}"
+    lines = []
+    for e in data.get("entries", []):
+        mark = "on" if e["enabled"] else "off"
+        suffix = " (vendor CLI found on this machine)" if e.get("suggest_enable") else ""
+        lines.append(f"[{mark}] {e['name']} — {e['description']}{suffix}")
+    return "\n".join(lines) or f"No {label}."
+
+
+@mcp.tool()
+def safety_packs_list() -> str:
+    """List damage-control vendor packs (aws, databases, ...) and whether each is on.
+
+    Read-only. Enabling or disabling a pack is human-only: SUGGEST
+    `agentwire safety packs enable <name>` to the user when their work touches
+    that vendor — never run it yourself.
+    """
+    return _format_entries("packs", run_agentwire_cmd(["safety", "packs", "list"]))
+
+
+@mcp.tool()
+def safety_groups_list() -> str:
+    """List damage-control default groups and whether each is on (read-only).
+
+    Kernel groups are always on. Opting a group out is human-only.
+    """
+    return _format_entries("groups", run_agentwire_cmd(["safety", "groups", "list"]))