From 9c94864746862cb5e0aa406a89540de3256bdab3 Mon Sep 17 00:00:00 2001 From: "Jason (Json)" <263060202+fuller-stack-dev@users.noreply.github.com> Date: Mon, 13 Jul 2026 00:39:56 -0600 Subject: [PATCH] docs(coding-agent): require fresh project worktrees (#105993) * improve(agents): require fresh canonical worktrees * fix(agents): scope fresh worktrees to project coding * chore(agents): preserve prompt LOC baseline * fix(skills): exempt scratch Codex scaffolds * docs: refresh agent template map * fix(agents): scope worktree policy to prepared workers * fix(skills): require launcher-prepared worktrees * fix(skills): sandbox untrusted contributor refs --- skills/coding-agent/SKILL.md | 49 ++++++++++++++++++++++++++++++------ 1 file changed, 42 insertions(+), 7 deletions(-) diff --git a/skills/coding-agent/SKILL.md b/skills/coding-agent/SKILL.md index 431eca127dd6..086221ce2a65 100644 --- a/skills/coding-agent/SKILL.md +++ b/skills/coding-agent/SKILL.md @@ -48,6 +48,40 @@ Use for background feature builds, PR reviews, large refactors, and issue-to-PR - If user asked for a specific agent, use that agent. - If worker fails/hangs, respawn or ask; do not silently hand-code instead. - Never checkout branches or run background coding agents in `~/Projects/openclaw`; use an isolated checkout. +- Treat contributor-controlled refs as untrusted code. Never launch a permission-bypassed worker in them; use the repository's approved untrusted-PR sandbox/review workflow or stop. +- For tasks that modify a Git-backed project, prepare and verify the Git worktree before launch, then include the exact Git preparation block below in the worker prompt. + +## Mandatory Git preparation + +Before launching Codex, Claude Code, or OpenCode for work that modifies a Git-backed project: + +1. Establish the intended target repository, then select its canonical remote. Prefer `upstream` when it exists and matches that target; otherwise verify `origin`. Resolve the selected remote's default branch dynamically, and stop if the target or remote cannot be proven. +2. For new work, run `git fetch --prune ` immediately before creating a new isolated worktree and branch from `/`. +3. For new work, verify the worktree's initial `HEAD` equals the fetched canonical base SHA. Record the canonical remote, default branch, base SHA, worktree path, and branch. +4. For an existing PR or shared branch, fetch canonical and the contributor branch immediately before creating an isolated worktree from the fetched contributor branch. Record that source ref and starting SHA, report its divergence from the refreshed canonical default, and do not automatically rebase, merge, reset, force-push, or otherwise rewrite contributor history. +5. Classify the prepared ref as trusted or untrusted. An isolated worktree is not a security sandbox; contributor-controlled refs require the repository's approved untrusted-PR sandbox/review workflow and must not use a permission-bypassed worker. +6. Launch the worker in the isolated worktree, never the primary checkout. For OpenClaw, the primary checkout under `~/Projects/openclaw` remains forbidden. + +For tasks that modify a Git-backed project, append this block to the worker prompt with real values: + +```text +Git preparation (mandatory before edits): +- canonical remote: +- canonical default branch: +- fetched canonical base SHA: +- preparation mode: +- checkout trust: +- prepared source ref: +- prepared start SHA: +- isolated worktree: +- working branch: +- preparation receipt: ` ran immediately before creation from `/` | existing branch: canonical and the contributor ref were fetched immediately before the worktree was created from `` at ``> + +Before editing, verify the current directory is the isolated worktree and its initial HEAD equals . For new work, that SHA must equal . Never edit the primary checkout. For existing PR/shared-branch work, report divergence and do not rebase, merge, reset, force-push, or otherwise rewrite contributor history unless explicitly asked. +Immediately before the final push or PR for newly authored work, run `git fetch --prune ` and `git merge-base --is-ancestor / HEAD`. If the ancestry check fails, update the new branch onto the latest canonical base, rerun the relevant proof, and only then push without force. For existing PR/shared-branch work, report a failed ancestry check and follow the repository workflow without rewriting the branch. +``` + +The launcher must create and verify the worktree before starting the editing worker; do not delegate worktree creation to that worker. Never start it in `~/Projects/openclaw`. Read-only tasks and non-project scratch work do not require the Git preparation block. ## Notification block @@ -77,42 +111,43 @@ Write the worker prompt to a temp file first. This avoids shell quoting bugs whe PROMPT=$(mktemp -t openclaw-worker-prompt.XXXXXX) cat >"$PROMPT" <<'EOF' Task. + EOF printf 'prompt file: %s\n' "$PROMPT" ``` -Use `$PROMPT` when launching from the same shell/session. If using a separate tool call, substitute the printed path. +Use `$PROMPT` when launching from the same shell/session. If using a separate tool call, substitute the printed path. The launch forms below are for trusted checkouts only; untrusted contributor refs require the repository's approved sandbox/review workflow. Codex: ```bash -bash pty:true background:true workdir:/path/repo command:"codex exec - < \"$PROMPT\"" +bash pty:true background:true workdir:/path/isolated-worktree command:"codex exec - < \"$PROMPT\"" ``` Claude Code: ```bash -bash background:true workdir:/path/repo command:"claude --permission-mode bypassPermissions --print < \"$PROMPT\"" +bash background:true workdir:/path/isolated-worktree command:"claude --permission-mode bypassPermissions --print < \"$PROMPT\"" ``` OpenCode: ```bash -bash pty:true background:true workdir:/path/repo command:"opencode run < \"$PROMPT\"" +bash pty:true background:true workdir:/path/isolated-worktree command:"opencode run < \"$PROMPT\"" ``` ## Long issue-to-PR work 1. Create/reuse a GitHub issue as durable spec. -2. Include issue URL, repo, base branch, expected PR, proof, and notification route. -3. Tell worker to branch, implement, test, run review until no accepted actionable findings, open PR. +2. Include issue URL, repo, canonical remote/default/base SHA, isolated worktree, working branch, expected PR, proof, and notification route. +3. Include the mandatory Git preparation block, then tell the worker to implement, test, run review until no accepted actionable findings, and open the PR. 4. Return issue URL and `sessionId` immediately. 5. Monitor with `process`; cancel through Task Registry if mirrored there. ## Scratch Codex -Codex needs a trusted git repo: +Codex needs a trusted git repo. This throwaway scaffold is not project work and has no canonical remote, so the Git preparation block does not apply: ```bash SCRATCH=$(mktemp -d)