fix: add main-branch write restrictions for subagents #343
Conversation
Subagents with write:true invoked via the Task tool were bypassing branch protection (pre-edit-check.sh) because many lack bash access. The agent-review subagent wrote directly to main repo files during the t099 session instead of returning proposed edits. Rule: On main/master, subagents may only write to README.md, TODO.md, todo/PLANS.md, and todo/tasks/*. All other writes must be returned as proposals for the calling agent to apply in a worktree. Added to: - build-agent.md: Subagent design guidance (for authors) - agent-review.md: Write Restrictions section (exemplar) - AGENTS.md: Universal rule in pre-edit section (all agents)
Summary of ChangesHello @marcusquinn, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses a critical security and integrity concern where subagents, particularly those invoked via the Task tool, could bypass branch protection on the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Caution Review failedThe pull request is closed. WalkthroughThree agent policy documentation files are updated to clarify write restrictions for subagents invoked via the Task tool. When on main/master, subagents may only write to specific files (README.md, TODO.md, todo/PLANS.md, todo/tasks/*); other changes must be returned as proposed edits. Subagents cannot execute pre-edit-check.sh. No runtime changes. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Thu Feb 5 19:59:51 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request correctly identifies and addresses a potential issue where subagents could bypass branch protection rules. The introduction of write restrictions for subagents on the main branch is a crucial safeguard. The changes across the documentation files are clear and implement this rule. My review includes a few suggestions to enhance the clarity, consistency, and completeness of the new guidelines to ensure they are as effective as possible for both human developers and AI agents.
|
|
||
| **Self-verification**: Your FIRST step before any Edit/Write MUST be to run this script. If you are about to edit a file and have not yet run pre-edit-check.sh in this session, STOP and run it now. No exceptions — including TODO.md and planning files (the script handles exception logic, not you). | ||
|
|
||
| **Subagent write restrictions**: Subagents invoked via the Task tool cannot run `pre-edit-check.sh` (many lack `bash: true`). When on `main`/`master`, subagents with `write: true` may ONLY write to: `README.md`, `TODO.md`, `todo/PLANS.md`, `todo/tasks/*`. All other writes must be returned as proposed edits for the calling agent to apply in a worktree. |
There was a problem hiding this comment.
For better readability and consistency with the other updated files in this PR, consider restructuring this rule using a list format. This will make the allowed file paths easier to parse for both humans and agents.
| **Subagent write restrictions**: Subagents invoked via the Task tool cannot run `pre-edit-check.sh` (many lack `bash: true`). When on `main`/`master`, subagents with `write: true` may ONLY write to: `README.md`, `TODO.md`, `todo/PLANS.md`, `todo/tasks/*`. All other writes must be returned as proposed edits for the calling agent to apply in a worktree. | |
| **Subagent write restrictions**: Subagents invoked via the Task tool cannot run `pre-edit-check.sh` (many lack `bash: true`). When on `main`/`master`, subagents with `write: true` must follow these rules: | |
| - **Allowed writes**: `README.md`, `TODO.md`, `todo/PLANS.md`, `todo/tasks/*`. | |
| - **Other writes**: Must be returned as proposed edits for the calling agent to apply in a worktree. |
| - **BLOCKED writes**: All other files (agent definitions, scripts, configs, code) | ||
| - **For code changes**: Return proposed edits to the calling agent; do NOT write directly. The calling agent will apply them in a worktree. |
There was a problem hiding this comment.
The distinction between BLOCKED writes and For code changes could be clearer. The term 'code changes' is a bit narrow, as blocked files also include configs and other non-code files. Combining these two points would make the instruction more concise and remove ambiguity.
| - **BLOCKED writes**: All other files (agent definitions, scripts, configs, code) | |
| - **For code changes**: Return proposed edits to the calling agent; do NOT write directly. The calling agent will apply them in a worktree. | |
| - **BLOCKED writes**: For all other files (agent definitions, scripts, configs, code), return proposed edits to the calling agent; do NOT write directly. The calling agent will apply them in a worktree. |
| **Main-branch write restrictions**: Subagents with `write: true` / `edit: true` that are invoked via the Task tool MUST respect the same branch protection as the primary agent. When the working directory is on `main`/`master`: | ||
|
|
||
| - **ALLOWED**: `README.md`, `TODO.md`, `todo/PLANS.md`, `todo/tasks/*` (planning and documentation files) | ||
| - **BLOCKED**: All other files (code, scripts, configs, agent definitions) |
There was a problem hiding this comment.
The guidance for BLOCKED files is incomplete. It states which files are blocked but doesn't specify the alternative action the subagent should take, which is a key part of the rule. To make the guidance comprehensive, please include the instruction to return proposed edits.
| - **BLOCKED**: All other files (code, scripts, configs, agent definitions) | |
| - **BLOCKED**: All other files (code, scripts, configs, agent definitions). For these files, the subagent must return proposed edits to the calling agent instead of writing directly. |
1 participant
Summary
write: trueProblem
During the t099 session, the
agent-reviewsubagent (invoked via Task tool) wrote directly to files in the main repo on themainbranch. It haswrite: true/edit: truein its YAML frontmatter but nobash: true, so it cannot runpre-edit-check.sh. This bypassed branch protection.Rule
On
main/master, subagents may ONLY write to:README.md,TODO.md,todo/PLANS.md,todo/tasks/*All other writes must be returned as proposed edits for the calling agent to apply in a worktree.
Files Changed
.agent/tools/build-agent/build-agent.md.agent/tools/build-agent/agent-review.md.agent/AGENTS.mdSummary by CodeRabbit