slaguru666/AIPass
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(system): docs(policy): propagate git-checkout deny rule through global prompt + devpulse prompt + drone @git --help

Browse Source 
Co-Authored-By: @devpulse <devpulse@aipass>
This commit is contained in:
AIOSAI
2026-04-20 14:16:26 -07:00
co-authored by @devpulse
parent 78df75cc98
commit 4211990cce
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.aipass/aipass_global_prompt.md
+4 -2
View File
@@ -158,9 +158,11 @@ Always work on main. Edit files in your branch directory on the main branch. Whe
`drone @git pr` does everything atomically: acquires a lock (so no other branch can PR simultaneously), creates a feature branch, stages only your files, commits with your Co-Authored-By signature, pushes, creates the PR on GitHub, returns to main, releases the lock.
Blocked for you: `git checkout -b`, `git commit`, `git push`, `gh pr create`. Only devpulse and drone have raw git access.
**Blocked system-wide via `.claude/settings.json` permission gate:** `git checkout*` (any form — switch, discard, new branch), `git add -f*`, `git add --force*`. These are denied for every agent including devpulse. Use `drone @git sync` to switch to main, `drone @git fix` to recover from broken states.
Allowed read-only: `git status`, `git diff`, `git log`.
**Culturally blocked (no permission gate yet, still don't use):** `git commit`, `git push`, `gh pr create`. Go through drone.
**Allowed read-only:** `git status`, `git diff`, `git log`, `git stash` (safe transient save).
Never merge. Only devpulse or the user merges PRs. If your PR gets feedback, fix it and run `drone @git pr` again.
src/aipass/devpulse/.aipass/aipass_local_prompt.md
+1 -1
View File
@@ -34,7 +34,7 @@ When a task belongs to a specialist's DOMAIN, ask them. You can still investigat
## Git Workflow — Drone Only
Never use raw git commands (git commit, git push, git checkout -b, gh pr create). Every time raw git is used, it causes divergence, rebase conflicts, and wasted time fixing the mess. Drone handles everything correctly.
Never use raw git commands (git commit, git push, git checkout anything, gh pr create). `Bash(git checkout*)` and `Bash(git add -f*)` are denied system-wide in `.claude/settings.json`. Every time raw git is used, it causes divergence, rebase conflicts, and wasted time fixing the mess. Drone handles everything correctly.
```
drone @git system-pr "description" # System-wide PR (devpulse only) — commit, branch, push, PR, back to main
src/aipass/drone/apps/modules/git_module.py
+5
View File
@@ -444,6 +444,11 @@ def get_help(command: str | None = None) -> str:
" sync Checkout main and pull\n"
" lock Check lock status\n"
" unlock --force Force-release the PR lock\n"
"\n"
"Policy: raw git commands are blocked for agents via .claude/settings.json:\n"
" - git checkout* (any form) — use `drone @git sync` instead\n"
" - git add -f* / --force* — use scoped `drone @git pr` instead\n"
"Culturally also avoid: raw git commit/push, gh pr create. Go through drone.\n"
)