Build a Path Deny List Before Your First Agent PR

说明与用途

创建本地拒绝列表和 pre‑commit 脚本，阻止代理在第一次 PR 中修改关键文件。

问题

Agents can unintentionally modify critical files (secrets, lockfiles, CI configs) in a first PR, causing merge risks and security leaks.

结果

The workflow prevents accidental agent edits to critical paths by enforcing a local deny list and pre-commit check, reducing merge risk and secret leakage.

工作流

• Clone repo and inspect tree
• Run find to list dangerous files
• Create .agent-untouchable with patterns
• Copy deny file to home for backup
• Write check-untouchable.sh to compare staged files against deny list
• Make script executable
• Optionally add pre-commit hook to run checker
• Test checker by staging a frozen file and verifying failure

证据

Agents will chase a green local run. They do not share your merge risk.

来源

Frozen paths never enter the agent context window.

来源