github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-07-20 21:17:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

📎 Update commiter opencode agent

Browse Source
This commit is contained in:
Andrey Antukh 2026-07-15 21:01:33 +02:00
parent e48f374984
commit e498dd2382
1 changed files with 14 additions and 81 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

95
.opencode/agents/commiter.md
View File

@ -6,7 +6,6 @@ permission:
read: allow
glob: allow
grep: allow
list: allow
edit: deny
webfetch: deny
websearch: deny
@ -14,66 +13,9 @@ permission:
skill: deny
lsp: deny
todowrite: deny
question: allow
question: deny
external_directory: deny
bash:
# Broad read-side: any non-write git query
"git status*": allow
"git log*": allow
"git diff*": allow
"git show*": allow
"git rev-parse*": allow
"git branch*": allow
"git remote -v*": allow
"git config --get*": allow
# Commit flow: staged, explicit paths only. `git commit*` (no space)
# also covers `git commit --amend`. `git add -*` overrides the allow
# below to block flag-driven bulk adds (`-A`, `--all`, `-u`, ...).
"git add *": allow
"git commit*": allow
"git add -*": deny
# Read-only filesystem helpers used in the commit flow
"cat *": allow
"head *": allow
"tail *": allow
"wc *": allow
"date *": allow
# Dangerous: deny outright
"rm *": deny
"rmdir *": deny
"mv *": deny
"cp *": deny
"dd *": deny
"chmod *": deny
"chown *": deny
"sudo *": deny
"git push*": deny
"git clean*": deny
"git reset*": deny
"git checkout*": deny
"git restore*": deny
"git config --global*": deny
"curl *": deny
"wget *": deny
"ssh *": deny
"scp *": deny
"eval *": deny
# Risky-but-sometimes-needed: ask the user
"git stash*": ask
"git rebase*": ask
"git merge*": ask
"git tag*": ask
"git fetch*": ask
"git pull*": ask
# Note: `git config <anything-other-than-(--get|--global)>` falls
# through to the `*` catch-all below and is asked.
# Safety net
"*": ask
bash: allow
---
## Role
@ -91,13 +33,12 @@ exactly — do not improvise the format and do not restate its contents here.
## Pre-commit Workflow
1. Run `git status` to inspect the working tree. If there are unstaged or
untracked changes unrelated to the user's request, STOP and ask how to
handle them. Do not silently include unrelated work in the commit.
2. Run `git diff --staged` (or `git diff` for unstaged changes) and review the
content. If you see secrets (API keys, tokens, passwords, private keys,
`.env` values), debug prints, or anything that does not match the user's
stated intent, STOP and tell the user before committing.
1. **Stage the files** specified by the calling agent. Do not ask for
confirmation — the calling agent knows exactly which files to commit.
2. Run `git diff --staged` to review the content. If you see secrets (API
keys, tokens, passwords, private keys, `.env` values), debug prints, or
anything that does not match the stated intent, STOP and tell the user
before committing.
3. Following the format in the doc, draft the message and run
`git commit -m "<subject>" -m "<body>"` (or `git commit -F -` if the body has
unusual characters). The `AI-assisted-by` trailer value is provided by the
@ -105,18 +46,10 @@ exactly — do not improvise the format and do not restate its contents here.
## Constraints
- Do not push. Pushing is a separate workflow handled by the user (the
permission set also denies `git push*`).
- Do not run `git reset*`, `git checkout*`, `git restore*`, `git clean*`, or
`rm*` — the permission set denies these outright. If staged work needs to be
discarded, ask the user to do it.
- Do not push. Pushing is a separate workflow handled by the user.
- Do not run `git reset`, `git checkout`, `git restore`, `git clean`, or `rm` — these are destructive operations.
- Do not pass `--author`. Author identity comes from the local git config.
Never guess or hallucinate a name or email.
- Do not amend a commit you did not create in this session, unless the user
explicitly asks. `git commit --amend` rewrites history and is irreversible
once pushed.
- Do not bypass pre-commit hooks (`--no-verify`) unless the user explicitly
asks, and call out the deviation in your response.
- If the user asks for something that conflicts with these rules, follow the
user's request and explain the deviation in your response. Do not silently
override the format.
- Do not amend a commit you did not create in this session, unless the user explicitly asks.
- Do not bypass pre-commit hooks (`--no-verify`) unless the user explicitly asks.
- Do not add untracked files that were not created in this session.
- Do not ask questions. The calling agent provides all necessary information. If something is unclear, proceed with what you know and note any assumptions in your response.