Purge wave 1: six hooks, one refuted verdict
Divergence purge #3835, PR 3 of 6 · 2026-08-31
What went, and what replaces it
| deleted | native mechanism |
|---|---|
compound-command-validator (37 cases) | CC decomposes compound commands per segment itself (nine-release fix trail through 2.1.251) |
agent-browser-safety (43 cases) | sandbox.network.allowedDomains/deniedDomains, OS-enforced, every engine at once |
| 4 agent safety checks (block-writes, ci, deployment, migration) | agent tools:/disallowedTools frontmatter + the --restricted CI lane |
The audit was wrong about the four, and the typecheck caught it
inventory said "dead since #3461: reachable only via agent frontmatter hooks:, which CC ignores"
typecheck said error TS2307 x3 in pretool/task/unified-agent-safety-dispatcher.ts
truth hooks.json -> sync-task-dispatcher -> unified-agent-safety-dispatcher fanned out all four
on the Task matcher. LIVE, not dead.
Same outcome, corrected reason. The register's own audit rule ("read the consumer, do not grep it") was violated by the first pass and enforced by the compiler. The verdict stays DELETE, on the restrict-bash rationale, and the register row was corrected before merge.
A machine-sensitive security test, found by deletion
tests/security/test-egress-guard.sh expected ask on 4 exfil shapes; got abstain, only in the worktree. Cause: this operator's USER scope runs sandbox.enabled + 19 deniedDomains, so the #3808 stand-down is CORRECTLY silent; the primary tree's project-scope settings masked it, the worktree had none. Fix: the file pins ORK_SANDBOX_ENABLED=false. The suite tests the tiers, not the machine.
Gates at commit
| hooks suite | 7412 passed, 2 skipped; entries-map pin 197 to 191 |
| registry closure | PASS, zero grandfathered dead hooks |
| verdict probes | 17/17 (compound probe retired) |
| security suite | 20/20 with the retired compound coverage recorded in-file |