tama enforcement add and tama enforcement remove

Turn hooks on or off in the machine-wide selection while keeping every other hook it holds.

#Invocation

tama enforcement add <hook-id>...
tama enforcement remove <hook-id>...

add selects the named hooks as well as the ones already selected. remove takes the named hooks out and keeps the rest. Use tama enforcement only when the whole selection is being decided; use these when one gate changes, so no other gate is switched off by an id forgotten in a retyped list.

#Several sessions at once

Each change is made from the selection as it is at the moment Tama writes it, not from a copy read earlier. Tama takes an exclusive lock on hook-enforcement.json.lock beside the selection, reads the selection, applies the change and writes it, then releases the lock. A second add or remove started meanwhile, from another terminal or another agent session, waits for the first and starts from what the first wrote, so both changes stay. only and all take the same lock. Tama Desktop turns one hook on or off through the same add and remove (tama request enforcement/update with mode add or remove).

add asks only the hooks it is turning on whether they can run here, the way only asks every hook it selects (see tama enforcement preflight). The hooks already selected were asked when they were turned on, and they are not asked again.

#Example

$ tama enforcement add block-numeric-literals block-identity-literals
Machine enforcement selection saved.
mode: only
selected hooks: <selected>/<installed> installed
...
$ tama enforcement remove block-identity-literals
Machine enforcement selection saved.
mode: only
selected hooks: <one fewer>/<installed> installed
...

#Output and state

Success begins Machine enforcement selection saved. and prints the status as tama enforcement status does. The file is written the same way as by only, with the selection before the change in previous. On a machine that enforces every installed hook (mode all), add keeps mode all: the named hooks are already enforced; remove writes mode only with every installed hook but the named ones, computed under the same lock from the hooks installed when it writes, so no caller builds that list from a catalog it read earlier. Tama Desktop's Remove from machine selection sends the one hook as remove in either mode.

#Refusals and failures

Every refusal leaves the selection as it was, and the command exits 1.

• Unknown hook id '<id>'; the installed registry declares <N> hook ids, and the enforcement selection was not changed. (add): the installed registry does not declare that id.
• Hook '<id>' cannot run on this machine, so nothing was selected and the enforcement selection was not changed. It answered: <the hook's own line> (add): the hook ran and answered with an infrastructure failure.
• Hook '<id>' is not in this machine's selection, so nothing was changed; `tama enforcement status` prints the <N> that are. (remove in mode only): the selection does not hold that hook.
• Hook '<id>' is not installed on this machine, so nothing was changed; `tama enforcement status` prints the <N> that are. (remove in mode all): no installed hook has that id.
• Removing these would leave no hook selected, so nothing was changed; `tama enforcement all` enforces every installed hook. (remove): a selection cannot be empty.
• The machine's selection cannot be read, so nothing was changed: <reason>. `tama enforcement only <hook-id>...` or `tama enforcement all` writes a whole selection in its place.: the selection file cannot be read or is invalid. Tama does not take it for all and overwrite it; only and all replace the whole selection and do not need the old one.
• enforcement: could not open the selection lock <path>: <OS error>, enforcement: could not lock <path>: <OS error> or enforcement: could not write <path>: <OS error>: the operating system refused the lock or the write.

Return to the complete CLI command tree.