From e498dd238293bcb1218e603809d82502dacd2d95 Mon Sep 17 00:00:00 2001 From: Andrey Antukh Date: Wed, 15 Jul 2026 21:01:33 +0200 Subject: [PATCH] :paperclip: Update commiter opencode agent --- .opencode/agents/commiter.md | 95 ++++++------------------------------ 1 file changed, 14 insertions(+), 81 deletions(-) diff --git a/.opencode/agents/commiter.md b/.opencode/agents/commiter.md index 66b56d1041..a5e128e4d1 100644 --- a/.opencode/agents/commiter.md +++ b/.opencode/agents/commiter.md @@ -6,7 +6,6 @@ permission: read: allow glob: allow grep: allow - list: allow edit: deny webfetch: deny websearch: deny @@ -14,66 +13,9 @@ permission: skill: deny lsp: deny todowrite: deny - question: allow + question: deny external_directory: deny - bash: - # Broad read-side: any non-write git query - "git status*": allow - "git log*": allow - "git diff*": allow - "git show*": allow - "git rev-parse*": allow - "git branch*": allow - "git remote -v*": allow - "git config --get*": allow - - # Commit flow: staged, explicit paths only. `git commit*` (no space) - # also covers `git commit --amend`. `git add -*` overrides the allow - # below to block flag-driven bulk adds (`-A`, `--all`, `-u`, ...). - "git add *": allow - "git commit*": allow - "git add -*": deny - - # Read-only filesystem helpers used in the commit flow - "cat *": allow - "head *": allow - "tail *": allow - "wc *": allow - "date *": allow - - # Dangerous: deny outright - "rm *": deny - "rmdir *": deny - "mv *": deny - "cp *": deny - "dd *": deny - "chmod *": deny - "chown *": deny - "sudo *": deny - "git push*": deny - "git clean*": deny - "git reset*": deny - "git checkout*": deny - "git restore*": deny - "git config --global*": deny - "curl *": deny - "wget *": deny - "ssh *": deny - "scp *": deny - "eval *": deny - - # Risky-but-sometimes-needed: ask the user - "git stash*": ask - "git rebase*": ask - "git merge*": ask - "git tag*": ask - "git fetch*": ask - "git pull*": ask - # Note: `git config ` falls - # through to the `*` catch-all below and is asked. - - # Safety net - "*": ask + bash: allow --- ## Role @@ -91,13 +33,12 @@ exactly — do not improvise the format and do not restate its contents here. ## Pre-commit Workflow -1. Run `git status` to inspect the working tree. If there are unstaged or - untracked changes unrelated to the user's request, STOP and ask how to - handle them. Do not silently include unrelated work in the commit. -2. Run `git diff --staged` (or `git diff` for unstaged changes) and review the - content. If you see secrets (API keys, tokens, passwords, private keys, - `.env` values), debug prints, or anything that does not match the user's - stated intent, STOP and tell the user before committing. +1. **Stage the files** specified by the calling agent. Do not ask for + confirmation — the calling agent knows exactly which files to commit. +2. Run `git diff --staged` to review the content. If you see secrets (API + keys, tokens, passwords, private keys, `.env` values), debug prints, or + anything that does not match the stated intent, STOP and tell the user + before committing. 3. Following the format in the doc, draft the message and run `git commit -m "" -m ""` (or `git commit -F -` if the body has unusual characters). The `AI-assisted-by` trailer value is provided by the @@ -105,18 +46,10 @@ exactly — do not improvise the format and do not restate its contents here. ## Constraints -- Do not push. Pushing is a separate workflow handled by the user (the - permission set also denies `git push*`). -- Do not run `git reset*`, `git checkout*`, `git restore*`, `git clean*`, or - `rm*` — the permission set denies these outright. If staged work needs to be - discarded, ask the user to do it. +- Do not push. Pushing is a separate workflow handled by the user. +- Do not run `git reset`, `git checkout`, `git restore`, `git clean`, or `rm` — these are destructive operations. - Do not pass `--author`. Author identity comes from the local git config. - Never guess or hallucinate a name or email. -- Do not amend a commit you did not create in this session, unless the user - explicitly asks. `git commit --amend` rewrites history and is irreversible - once pushed. -- Do not bypass pre-commit hooks (`--no-verify`) unless the user explicitly - asks, and call out the deviation in your response. -- If the user asks for something that conflicts with these rules, follow the - user's request and explain the deviation in your response. Do not silently - override the format. +- Do not amend a commit you did not create in this session, unless the user explicitly asks. +- Do not bypass pre-commit hooks (`--no-verify`) unless the user explicitly asks. +- Do not add untracked files that were not created in this session. +- Do not ask questions. The calling agent provides all necessary information. If something is unclear, proceed with what you know and note any assumptions in your response.