Fully hiding the caller's AGENTS.md dropped repo-specific operational knowledge agents need
(e.g. homelab's migration mechanism: deleting a service requires a matching migrations/*.sh, else
the old service keeps running in prod). Separate the two concerns:
- Platform golden rules stay authoritative (scripts/agent-rules.md), un-overridable.
- The caller's AGENTS.md / CLAUDE.md text is captured before quarantine and injected into the prompt
as explicitly SUBORDINATE context — usable for repo mechanics, but unable to change behavior,
grant permissions, or override the rules.
- opencode.json / .opencode remain fully blocked (config + RCE), never re-injected.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The agent runs inside the CALLER repo's checkout and opencode auto-discovers project-level config
from the working tree (opencode.json / .opencode/ for provider/model/permission/mcp/plugins, and
AGENTS.md/CLAUDE.md for instructions). opencode has no flag to disable that discovery, so any caller
repo could swap the model, unlock skills/permissions, register MCP servers or plugins (arbitrary
code execution on the runner, which holds ANTHROPIC_API_KEY/AGENT_TOKEN/TOKEN_*/SSH_PRIV_KEY), or
rewrite the rules the agent follows. The trigger gate only restricts who triggers, not what repo
content defines behavior.
- run-agent.sh: quarantine caller-controlled opencode.json/opencode.jsonc/.opencode/AGENTS.md/CLAUDE.md
for the duration of each run (moved aside, restored on EXIT via trap). Restore keeps the committed
tree/PR diff unchanged even when the agent commits mid-run.
- run-agent.sh: dev-agent golden rules now come from scripts/agent-rules.md (platform-authoritative),
injected into the prompt, instead of "read the caller's AGENTS.md and follow it exactly".
- scripts/agent-rules.md: new repo-agnostic authoritative rules.
- SECURITY.md: documents the isolation model and the requirement that callers pin agent.yml@main.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Stage the shared scripts into $RUNNER_TEMP and point $SCRIPTS there for every
step, so an agent that commits/deletes the in-tree .agents-workflow checkout no
longer destroys the scripts the post-agent steps run (issue #33). Scrub any
in-tree .agents-workflow artifact before publishing, and add a failure-safe
rescue step that opens a PR for pushed work when a run fails.
Extract the agent registry to a shared agents.json and have both
route.sh (agent → model) and install-opencode.sh (ollama-cloud provider
models map) derive from it, so the two lists can no longer drift.
route.sh now copies agents.json to /tmp/agents.json instead of an inline
heredoc. install-opencode.sh builds the ollama-cloud map by
collecting every registry model with the prefix and
stripping it — non-ollama-cloud models (e.g. @lead's anthropic/claude-opus,
the local ornith:35b) are excluded by construction.
Resolves#31.
The shared agent.yml is a reusable (workflow_call) workflow, so on Gitea
github.event_name evaluates to 'workflow_call' — not the original 'issues'/
'issue_comment'. route.sh branched on EVENT == "issues", so issue-opened runs
scanned the empty comment body and skipped the @pm fallback, exiting 1 with
"no known agent mentioned" (runs #393/#394). Comment runs were unaffected
because the @mention lives in $BODY.
Discriminate on the comment id (CID) instead, which IS reliably forwarded in
the event payload: empty => issue-opened (scan issue body, default @pm), set
=> comment (scan comment body). Also add .gitignore for .env.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rebased onto the per-agent skill-scoping change so PR #25 carries both:
- route.sh keeps the registry 'skills' allow-list and emits skills as a step output
- install-opencode.sh writes the permission.skill block (deny-all + allow listed)
Pure refactor otherwise: each step's shell moves to its own file, called via
bash "$SCRIPTS/<name>.sh". The two extracted SKILL.md bodies are byte-identical to
main; routing/config/publish behavior is unchanged. Because this is a reusable
workflow (workflow_call) the runtime checkout is the caller's repo, so agent.yml now
checks THIS repo out into .agents-workflow/ (pinned @main) and points $SCRIPTS there.
ffaerber
lead
senior