You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by "liwenjie200543 (via GitHub)" <gi...@apache.org> on 2026/10/13 03:36:04 UTC
[PR] fix(agent-guard): recognize the +refspec force spelling in the empty-rebase guard [magpie]
liwenjie200543 opened a new pull request, #1607:
URL: https://github.com/apache/magpie/pull/1607
## Summary
- The `empty-rebase` guard now treats a refspec positional with a leading `+` as a force-push — git-push(1) documents the `+` prefix as equivalent to `--force` for that refspec — and strips the prefix before resolving the source ref, because `git rev-parse +ref` fails and recognition alone would still fail open.
- Before this change `git push origin +empty-branch:main` bypassed the guard entirely, while the semantically identical `git push --force origin empty-branch:main` was denied. The guard exists to stop exactly that empty push, which auto-closes a PR and revokes maintainer write access.
## Type of change
<!-- Tick all that apply. -->
- [ ] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
- [ ] Tool / bridge contract (`tools/<system>/*.md`)
- [x] Python package (`tools/*/` with `pyproject.toml`)
- [ ] Groovy reference impl
- [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
- [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
- [ ] Project template (`projects/_template/`)
- [ ] CI / dev loop (`prek`, workflows, validators)
- [ ] Other:
## Test plan
<!-- How you verified the change. Be specific. -->
- [ ] `prek run --all-files` passes
- [x] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes
- `pytest tests/test_guards.py` (agent-guard): all 11 empty-rebase cases pass — 6 existing + 5 new (both `+` spellings denied, still denied behind `git -C`, non-empty `+` push allowed, plain refspec not mistaken for force). Run directly with pytest 9.1.1 / CPython 3.13 rather than through `uv`; 5 pre-existing commit-trailer failures on Windows (`shlex` vs `C:\` paths) reproduce on unpatched `main` too and are untouched by this change.
- `ruff check .` and `mypy` clean under the package's own config.
- [ ] For Groovy bridges touched: command-line invocation tested end-to-end
- [ ] For skill changes: eval suite passes for the affected skill
(`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/`)
- [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
(a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
- [x] Other: end-to-end against a real git repository (bare `origin`, `origin/HEAD` → `main`, empty branch `pr`): after the patch all five force spellings deny (`--force`, `-f`, `--force-with-lease`, `+pr:main`, `+pr`); before the patch the two `+refspec` spellings were allowed.
## RFC-AI-0004 compliance
<!-- No new mutation surface: the change only tightens an existing deterministic guard. -->
- [ ] **HITL** — any new mutation is gated on explicit user confirmation
- [ ] **Sandbox** — no new unrestricted host access; network reach declared in the adapter
- [ ] **Vendor neutrality** — placeholders (`<PROJECT>`, `<tracker>`, `<upstream>`, `<security-list>`) used in all skill / tool prose (the `check-placeholders` prek hook is the mechanical gate)
- [ ] **Conversational + correctable** — agentic-override path documented if behaviour is adopter-tunable
- [ ] **Write-access discipline** — no autonomous outbound messages; drafts only, sent on confirmation
- [ ] **Privacy LLM** — private content does not reach a non-approved LLM; redactor invoked where needed
## Linked issues
Closes #1606
## Notes for reviewers (optional)
- The prefix strip is load-bearing: recognizing `+` as forced without stripping it would still fail open at `git rev-parse --verify +ref^{commit}`.
- The `MAGPIE_ALLOW_EMPTY_PUSH=1` override path is unchanged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(agent-guard): recognize the +refspec force spelling in the empty-rebase guard [magpie]
Posted by "bigdatadeveloper8 (via GitHub)" <gi...@apache.org>.
bigdatadeveloper8 commented on PR #1607:
URL: https://github.com/apache/magpie/pull/1607#issuecomment-6166873294
Hi @liwenjie200543
Thanks for opening this PR!
The CI failed on the isolated-setup-fingerprint hook
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(agent-guard): recognize the +refspec force spelling in the empty-rebase guard [magpie]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #1607:
URL: https://github.com/apache/magpie/pull/1607#issuecomment-6206241312
Rebased onto current `main` (the generated isolated-setup fingerprint conflicted) and regenerated it with `write-constant`. The agent-guard tests pass.
Not changed here: a roborev pass noted that `git -C <dir> push` runs the guard's inspection commands in the original cwd rather than `<dir>`, so it can fail open outside the target repo. That behaviour predates this PR and is worth a separate issue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(agent-guard): recognize the +refspec force spelling in the empty-rebase guard [magpie]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #1607:
URL: https://github.com/apache/magpie/pull/1607
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org