Skip to content

Allow VS Code Source Control writes on protected branches by default #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
NagyVikt merged 4 commits into from
Apr 13, 2026
Merged

Allow VS Code Source Control writes on protected branches by default #82

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a6897a7
Allow VS Code Source Control writes on protected branches by default
Imdeadpool1 Apr 13, 2026
44696c0
Merge branch 'main' into agent/codex/mate-edix-hu-vscode-protected-ma…
NagyVikt Apr 13, 2026
dccb350
Merge branch 'main' into agent/codex/mate-edix-hu-vscode-protected-ma…
NagyVikt Apr 13, 2026
fc74196
Merge branch 'main' into agent/codex/mate-edix-hu-vscode-protected-ma…
NagyVikt Apr 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .githooks/pre-commit
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ fi

allow_vscode_protected_raw="${MUSAFETY_ALLOW_VSCODE_PROTECTED_BRANCH_WRITES:-$(git config --get multiagent.allowVscodeProtectedBranchWrites || true)}"
if [[ -z "$allow_vscode_protected_raw" ]]; then
allow_vscode_protected_raw="false"
allow_vscode_protected_raw="true"
fi
allow_vscode_protected="$(printf '%s' "$allow_vscode_protected_raw" | tr '[:upper:]' '[:lower:]')"

Expand Down Expand Up @@ -155,8 +155,8 @@ Use an agent branch first:
After finishing work:
bash scripts/agent-branch-finish.sh

Optional repo override for manual VS Code protected-branch commits:
git config multiagent.allowVscodeProtectedBranchWrites true
Optional repo hard-block for VS Code protected-branch commits:
git config multiagent.allowVscodeProtectedBranchWrites false

VS Code Source Control commits on protected local-only branches
(no upstream and no remote branch) are allowed automatically.
Expand Down
6 changes: 3 additions & 3 deletions .githooks/pre-push
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ fi

allow_vscode_protected_raw="${MUSAFETY_ALLOW_VSCODE_PROTECTED_BRANCH_WRITES:-$(git config --get multiagent.allowVscodeProtectedBranchWrites || true)}"
if [[ -z "$allow_vscode_protected_raw" ]]; then
allow_vscode_protected_raw="false"
allow_vscode_protected_raw="true"
fi
allow_vscode_protected="$(printf '%s' "$allow_vscode_protected_raw" | tr '[:upper:]' '[:lower:]')"

Expand Down Expand Up @@ -77,8 +77,8 @@ if [[ "${#blocked_refs[@]}" -gt 0 ]]; then
echo "[agent-branch-guard] Push to protected branch blocked."
echo "[agent-branch-guard] Protected target(s): ${blocked_refs[*]}"
echo "[agent-branch-guard] Use an agent branch and merge via PR."
echo "[agent-branch-guard] Optional VS Code override:"
echo " git config multiagent.allowVscodeProtectedBranchWrites true"
echo "[agent-branch-guard] Optional repo hard-block for VS Code protected-branch push:"
echo " git config multiagent.allowVscodeProtectedBranchWrites false"
echo
echo "Temporary bypass (not recommended):"
echo " ALLOW_PUSH_ON_PROTECTED_BRANCH=1 git push ..."
Expand Down
6 changes: 3 additions & 3 deletions templates/githooks/pre-commit
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ fi

allow_vscode_protected_raw="${MUSAFETY_ALLOW_VSCODE_PROTECTED_BRANCH_WRITES:-$(git config --get multiagent.allowVscodeProtectedBranchWrites || true)}"
if [[ -z "$allow_vscode_protected_raw" ]]; then
allow_vscode_protected_raw="false"
allow_vscode_protected_raw="true"
fi
allow_vscode_protected="$(printf '%s' "$allow_vscode_protected_raw" | tr '[:upper:]' '[:lower:]')"

Expand Down Expand Up @@ -155,8 +155,8 @@ Use an agent branch first:
After finishing work:
bash scripts/agent-branch-finish.sh

Optional repo override for manual VS Code protected-branch commits:
git config multiagent.allowVscodeProtectedBranchWrites true
Optional repo hard-block for VS Code protected-branch commits:
git config multiagent.allowVscodeProtectedBranchWrites false

VS Code Source Control commits on protected local-only branches
(no upstream and no remote branch) are allowed automatically.
Expand Down
6 changes: 3 additions & 3 deletions templates/githooks/pre-push
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ fi

allow_vscode_protected_raw="${MUSAFETY_ALLOW_VSCODE_PROTECTED_BRANCH_WRITES:-$(git config --get multiagent.allowVscodeProtectedBranchWrites || true)}"
if [[ -z "$allow_vscode_protected_raw" ]]; then
allow_vscode_protected_raw="false"
allow_vscode_protected_raw="true"
fi
allow_vscode_protected="$(printf '%s' "$allow_vscode_protected_raw" | tr '[:upper:]' '[:lower:]')"

Expand Down Expand Up @@ -77,8 +77,8 @@ if [[ "${#blocked_refs[@]}" -gt 0 ]]; then
echo "[agent-branch-guard] Push to protected branch blocked."
echo "[agent-branch-guard] Protected target(s): ${blocked_refs[*]}"
echo "[agent-branch-guard] Use an agent branch and merge via PR."
echo "[agent-branch-guard] Optional VS Code override:"
echo " git config multiagent.allowVscodeProtectedBranchWrites true"
echo "[agent-branch-guard] Optional repo hard-block for VS Code protected-branch push:"
echo " git config multiagent.allowVscodeProtectedBranchWrites false"
echo
echo "Temporary bypass (not recommended):"
echo " ALLOW_PUSH_ON_PROTECTED_BRANCH=1 git push ..."
Expand Down
23 changes: 11 additions & 12 deletions test/install.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1168,11 +1168,10 @@ test('pre-commit blocks non-codex VS Code commits on custom protected branches b
ALLOW_COMMIT_ON_PROTECTED_BRANCH: '0',
VSCODE_GIT_IPC_HANDLE: '1',
});
assert.equal(hookResult.status, 1, hookResult.stderr || hookResult.stdout);
assert.match(hookResult.stderr, /\[agent-branch-guard\] Direct commits on protected branches are blocked\./);
assert.equal(hookResult.status, 0, hookResult.stderr || hookResult.stdout);
});

test('pre-commit blocks non-codex protected branch commits from VS Code Source Control env by default', () => {
test('pre-commit allows non-codex protected branch commits from VS Code Source Control env by default', () => {
const repoDir = initRepo();
seedCommit(repoDir);
attachOriginRemote(repoDir);
Expand All @@ -1191,8 +1190,7 @@ test('pre-commit blocks non-codex protected branch commits from VS Code Source C
VSCODE_IPC_HOOK_CLI: '1',
},
);
assert.equal(hookResult.status, 1, hookResult.stderr || hookResult.stdout);
assert.match(hookResult.stderr, /\[agent-branch-guard\] Direct commits on protected branches are blocked\./);
assert.equal(hookResult.status, 0, hookResult.stderr || hookResult.stdout);
});

test('pre-commit allows non-codex VS Code commits on protected local-only branches', () => {
Expand Down Expand Up @@ -1259,11 +1257,10 @@ test('pre-push blocks non-codex protected branch pushes from VS Code Source Cont
VSCODE_IPC_HOOK_CLI: '1',
},
);
assert.equal(hookResult.status, 1, hookResult.stderr || hookResult.stdout);
assert.match(hookResult.stderr, /\[agent-branch-guard\] Push to protected branch blocked\./);
assert.equal(hookResult.status, 0, hookResult.stderr || hookResult.stdout);
});

test('pre-commit allows non-codex protected branch commits from VS Code Source Control env when explicitly enabled', () => {
test('pre-commit blocks non-codex protected branch commits from VS Code Source Control env when explicitly disabled', () => {
const repoDir = initRepo();
seedCommit(repoDir);
attachOriginRemote(repoDir);
Expand All @@ -1273,7 +1270,7 @@ test('pre-commit allows non-codex protected branch commits from VS Code Source C

let configResult = runCmd(
'git',
['config', 'multiagent.allowVscodeProtectedBranchWrites', 'true'],
['config', 'multiagent.allowVscodeProtectedBranchWrites', 'false'],
repoDir,
);
assert.equal(configResult.status, 0, configResult.stderr || configResult.stdout);
Expand All @@ -1289,7 +1286,8 @@ test('pre-commit allows non-codex protected branch commits from VS Code Source C
VSCODE_IPC_HOOK_CLI: '1',
},
);
assert.equal(hookResult.status, 0, hookResult.stderr || hookResult.stdout);
assert.equal(hookResult.status, 1, hookResult.stderr || hookResult.stdout);
assert.match(hookResult.stderr, /\[agent-branch-guard\] Direct commits on protected branches are blocked\./);
});

test('pre-commit does not treat TERM_PROGRAM=vscode as VS Code Source Control context', () => {
Expand Down Expand Up @@ -1329,7 +1327,7 @@ test('pre-push allows non-codex protected branch pushes from VS Code Source Cont

let configResult = runCmd(
'git',
['config', 'multiagent.allowVscodeProtectedBranchWrites', 'true'],
['config', 'multiagent.allowVscodeProtectedBranchWrites', 'false'],
repoDir,
);
assert.equal(configResult.status, 0, configResult.stderr || configResult.stdout);
Expand All @@ -1347,7 +1345,8 @@ test('pre-push allows non-codex protected branch pushes from VS Code Source Cont
VSCODE_IPC_HOOK_CLI: '1',
},
);
assert.equal(hookResult.status, 0, hookResult.stderr || hookResult.stdout);
assert.equal(hookResult.status, 1, hookResult.stderr || hookResult.stdout);
assert.match(hookResult.stderr, /\[agent-branch-guard\] Push to protected branch blocked\./);
});

test('pre-push blocks codex protected branch pushes even from VS Code Source Control env', () => {
Expand Down
Loading