External source: block-external-source-edits

A gate on writes, patches and shell commands (tama hook block-external-source-edits) that refuses a change to source someone else owns: installed dependency source (node_modules, site-packages, Cargo's registry and similar) and a checkout any of whose remotes, whatever it is called, is a fork of, or a repository owned by, an account other than the one signed in to GitHub. The remotes are read from the checkout's own configuration (git config --get-regexp '^remote\..*\.url$'), so renaming a remote does not change what the checkout is. A remote that is not a GitHub repository is refused as unsupported ownership provenance <remote>=<url>, and a configuration git cannot read as reading remotes at <checkout> failed: <git's error>. The refusal says what the path resolves to and to use documented configuration, APIs or a separately owned extension instead.

#How a shell command is read

Where a command reaches is read from its structure: each operand that names a path (an existing file or directory, a path whose directory exists, or a word the shell expands), git's -C, --git-dir and --work-tree, the directory cd moves to, and the directory the command runs in. A command line handed to a shell is read the same way. A shell redirection (>, >>, 1>, 2>) into external source writes it, so it is refused by the shell's grammar alone. A command that reaches no external source passes without asking anyone.

When a command reaches external source, a model reads through Oko's model call whether it changes it (block_external_source_edits/judge-prompt.md): writing, creating, deleting, moving, copying onto, truncating, re-permissioning or editing in place a path there, mutating a repository there, or running code out of an external checkout. Reading, listing, searching, copying from and diffing pass. No list of program names or git subcommands decides it. The refusal is the ownership reason followed by the command changes it: <the model's sentence>. A word that still holds $, *, ? or a backtick after expansion is reported as not a concrete path; source ownership cannot be established and the model judges whether the command changes it. A question the judge leaves unanswered refuses the command with TAMA_HOOK_INFRASTRUCTURE: block-external-source-edits: review unavailable: …, as asking a model describes.

#Where it comes from

Source: rust/crates/tama-hook-tools/src/ports/block_external_source_edits/. The journey cargo test --manifest-path rust/Cargo.toml -p tama-cli --test external_source_edits_shell builds a project with a node_modules package in its own git checkout, requires redirections into the package refused without a judge, a copy onto it refused as unjudged when the judge is down, and commands that never reach it never to ask; with TAMA_TEST_EXTERNAL_JUDGE=1 and -- --ignored it asks the real judge and requires copying onto, deleting and editing the package in place refused, and reading or copying from it passed.