Skip to content

Prevent in-place maintenance writes on protected main by default#31

Merged
NagyVikt merged 1 commit intomainfrom
agent/codex/20260411-190928-info-recodee-com-protected-base-maintenance-guard
Apr 11, 2026
Merged

Prevent in-place maintenance writes on protected main by default#31
NagyVikt merged 1 commit intomainfrom
agent/codex/20260411-190928-info-recodee-com-protected-base-maintenance-guard

Conversation

@NagyVikt
Copy link
Copy Markdown
Collaborator

Automated by scripts/agent-branch-finish.sh (PR flow).

Users expect local main to stay pull-only, but maintenance commands like setup/install/fix/doctor
could still mutate an already-initialized repository when run from main. This change introduces a
protected-main write guard for initialized repos and adds an explicit emergency override flag.

Setup still performs global toolchain detection/install, then blocks before repository writes when
main is protected. Documentation and tests were updated to make the behavior explicit.

Constraint: First-time bootstrap on new repos must keep working on main
Rejected: Block all protected branches (dev/main/master) immediately | would break existing dev-branch setup workflows
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Keep command option docs and parseCommonArgs in sync when adding guard/override flags
Tested: npm test (52/52); node --check bin/multiagent-safety.js; manual setup run on initialized main blocked with guidance
Not-tested: Windows shell output formatting of multiline guard error
@NagyVikt NagyVikt merged commit 3e3d9b1 into main Apr 11, 2026
7 checks passed
@NagyVikt NagyVikt deleted the agent/codex/20260411-190928-info-recodee-com-protected-base-maintenance-guard branch April 11, 2026 17:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant