Conversation
…mmand Item #403, from the 2026-07-29 git-shim competitor audit: - Added .github/workflows/, .gitlab-ci.yml, .circleci/ to TRUST_ROOT_PATHS in classify.rs (CI-wipe was named as an attack agentflare didn't yet cover). Documented a known limitation: resolve_trust_root_touch self-diffs when the pushed branch equals the default branch by name, so this doesn't change behavior for the ordinary direct-push case yet -- tracked as an addendum on item #321. - New /flare:git prompt (mcp_prompts.rs), same mechanism as the existing /flare:artifact and /flare:handoff prompts, surfacing the agentflare git-shim's own admin subcommands: install-hooks, install-shim, uninstall-shim, snapshot list/restore/prune, audit preview/prune, doctor. Deliberately scoped to just these -- ordinary git commands and other CLI/MCP surfaces (pr_check, etc.) already have their own entrypoint (the ! shell-escape, or their own MCP tool) and don't need duplicating here.
|
Warning Review limit reached
Next review available in: 4 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe change adds an MCP ChangesMCP git prompt
Trust-root documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant MCPClient
participant get_prompt
participant get_git_command
MCPClient->>get_prompt: request git with command
get_prompt->>get_git_command: pass prompt request
get_git_command-->>MCPClient: return usage or agentflare git instruction
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@crates/flare-git-core/src/classify.rs`:
- Around line 70-76: The TrustRootTouch::Unknown denial message must stay
synchronized with TRUST_ROOT_PATHS. Update the message construction in the
TrustRootTouch::Unknown handling to derive its listed paths from the effective
trust_root_paths configuration, including all configured CI paths, rather than
maintaining a separate hardcoded subset.
In `@src/mcp_prompts.rs`:
- Around line 257-290: Validate the parsed command in get_git_command before
generating assistant_text: parse and allowlist only the documented git-shim
subcommands and their supported arguments, rejecting shell metacharacters,
malformed grammar, and hidden commands such as scope-check. Render the execution
instruction only for validated commands, and add rejection tests covering
command injection and unsupported hidden commands.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 2fdfc4cb-d377-4c45-be10-600bd044e290
📒 Files selected for processing (2)
crates/flare-git-core/src/classify.rssrc/mcp_prompts.rs
| fn get_git_command(request: &GetPromptRequestParams) -> GetPromptResult { | ||
| let command = request | ||
| .arguments | ||
| .as_ref() | ||
| .and_then(|a| a.get("command")) | ||
| .and_then(|v| v.as_str()) | ||
| .unwrap_or("") | ||
| .trim() | ||
| .to_string(); | ||
|
|
||
| if command.is_empty() { | ||
| return assistant_text( | ||
| "agentflare git-shim commands — pass as this command's argument.\n\ | ||
| install-hooks [--yes] — install branch-protection/provenance git hooks into this repo\n\ | ||
| install-shim --binary <path> — install the flare-git-shim binary as `git` on PATH (dogfooding/local use)\n\ | ||
| uninstall-shim — remove a previously installed git shim\n\ | ||
| snapshot list — list recovery snapshots for this repo, newest first\n\ | ||
| snapshot restore [<id>] [--yes] — restore a snapshot's files into the working tree (non-destructive)\n\ | ||
| snapshot prune [--keep N] — delete all but the N most recent snapshots (default 5)\n\ | ||
| audit preview — list orphaned worktree directories\n\ | ||
| audit prune <names...|--all> — remove orphaned worktree directories (snapshots taken first)\n\ | ||
| doctor [--format text|json|markdown] [--reclaim] [--force] [--staleness-days N] — health sweep over all claim worktrees", | ||
| ); | ||
| } | ||
|
|
||
| assistant_text(format!( | ||
| "agentflare git command requested: `{command}`\n\n\ | ||
| Run it as `agentflare git {command}` via the project's shell tool (ctx_shell if \ | ||
| lean-ctx is available through the flare gateway, else Bash), then report its output \ | ||
| to the user. These are the underlying git-shim CLI subcommands directly — install-hooks, \ | ||
| install-shim, uninstall-shim, snapshot list/restore/prune, audit preview/prune, and doctor \ | ||
| (see the bare `/git` usage card for each one's options). `doctor --reclaim` and \ | ||
| `audit prune`/`snapshot prune` mutate local state (worktrees/snapshots) — confirm with \ | ||
| the user before running those if it wasn't clearly what they asked for." |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Validate commands before generating a shell instruction.
command is interpolated verbatim into agentflare git {command}. Inputs such as snapshot list; ... can escape into a second shell command, and scope-check can surface a hidden internal subcommand. Parse/allowlist the supported admin grammar and reject invalid input before rendering the execution instruction; add rejection tests for shell metacharacters and hidden commands.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/mcp_prompts.rs` around lines 257 - 290, Validate the parsed command in
get_git_command before generating assistant_text: parse and allowlist only the
documented git-shim subcommands and their supported arguments, rejecting shell
metacharacters, malformed grammar, and hidden commands such as scope-check.
Render the execution instruction only for validated commands, and add rejection
tests covering command injection and unsupported hidden commands.
…-shim subcommands in /flare:git - cargo fmt fix for the new test in mcp_prompts.rs - TrustRootTouch::Unknown deny message now lists policy.trust_root_paths instead of a hardcoded subset, so it stays accurate as the list grows - get_git_command rejects trailer-inject/ref-transaction-log/scope-check instead of echoing a run instruction for internal-only subcommands
1 participant
Summary
Item #403, from the 2026-07-29 git-shim competitor audit:
.github/workflows/,.gitlab-ci.yml,.circleci/toTRUST_ROOT_PATHS(CI-wipe was named as an attack agentflare didn't yet cover). Documented a known limitation in the code:resolve_trust_root_touchself-diffs when the pushed branch equals the default branch by name, so this doesn't change behavior for the ordinary direct-push case yet — tracked as an addendum comment on item fix(worktree): reuse an existing branch that owns no worktree instead of failing #321 (also bumped to high priority)./flare:gitprompt (same mechanism as/flare:artifact//flare:handoff), surfacing the git-shim's own admin subcommands:install-hooks,install-shim,uninstall-shim,snapshot list/restore/prune,audit preview/prune,doctor. Deliberately scoped to just these — ordinary git commands (status/log/commit/push/...) already run via the!shell-escape, and other CLI/MCP surfaces (pr_check, etc.) already have their own MCP tool entrypoint, so neither is duplicated here.Related backlog filed from the same audit (not in this PR): epic #399 (tunable git-shim policy catalog, FailproofAI-inspired) with children #400–#402, the last of which is secret-exfiltration scanning as the first new policy.
Test plan
cargo test --bin agentflare mcp_promptsandcargo test -p flare-git-core classify— all greencargo test --workspace— 0 failedcargo clippy --workspace --all-features -- -D warnings— cleanSummary by CodeRabbit
New Features
gitMCP prompt for supported Git administration and recovery commands.Documentation