diff --git a/.opencode/agents/async-agent-util.md b/.opencode/agents/async-agent-util.md index 7aea0343f..4fa8e8e48 100644 --- a/.opencode/agents/async-agent-util.md +++ b/.opencode/agents/async-agent-util.md @@ -119,7 +119,8 @@ permission: "*api/v1/repos/*/labels*": deny "*https://git.cleverthis.com/api/v1/repos/cleveragents/cleveragents-core/labels*": deny - "sudo *": deny + "*force_merge": deny + "*sudo*": deny # All the subagents you want this agent to have access to task: diff --git a/.opencode/agents/auto-agents.md b/.opencode/agents/auto-agents.md index 69b4eb863..e9b0aeeb4 100644 --- a/.opencode/agents/auto-agents.md +++ b/.opencode/agents/auto-agents.md @@ -125,6 +125,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/estimator-implementation.md b/.opencode/agents/estimator-implementation.md index a3f279ea4..49ab8e159 100644 --- a/.opencode/agents/estimator-implementation.md +++ b/.opencode/agents/estimator-implementation.md @@ -123,6 +123,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-checkout-util.md b/.opencode/agents/git-checkout-util.md index bc8416083..c039bc885 100644 --- a/.opencode/agents/git-checkout-util.md +++ b/.opencode/agents/git-checkout-util.md @@ -114,7 +114,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-cleanup-util.md b/.opencode/agents/git-cleanup-util.md index 45c61d559..bbad57dba 100644 --- a/.opencode/agents/git-cleanup-util.md +++ b/.opencode/agents/git-cleanup-util.md @@ -114,7 +114,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-clone-util.md b/.opencode/agents/git-clone-util.md index 58b0bd32e..d9eac6930 100644 --- a/.opencode/agents/git-clone-util.md +++ b/.opencode/agents/git-clone-util.md @@ -122,7 +122,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-commit-and-push-util.md b/.opencode/agents/git-commit-and-push-util.md index c88856230..1baa3e33a 100644 --- a/.opencode/agents/git-commit-and-push-util.md +++ b/.opencode/agents/git-commit-and-push-util.md @@ -113,7 +113,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-commit-util.md b/.opencode/agents/git-commit-util.md index 706d569e9..8723b8f83 100644 --- a/.opencode/agents/git-commit-util.md +++ b/.opencode/agents/git-commit-util.md @@ -124,6 +124,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-create-commit-util.md b/.opencode/agents/git-create-commit-util.md index 9578995fb..91b9f0aa6 100644 --- a/.opencode/agents/git-create-commit-util.md +++ b/.opencode/agents/git-create-commit-util.md @@ -116,7 +116,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-fetch-util.md b/.opencode/agents/git-fetch-util.md index 9c18fa10e..7f7f29cb0 100644 --- a/.opencode/agents/git-fetch-util.md +++ b/.opencode/agents/git-fetch-util.md @@ -113,7 +113,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-force-push-with-lease-util.md b/.opencode/agents/git-force-push-with-lease-util.md index cbff76c47..78bea4761 100644 --- a/.opencode/agents/git-force-push-with-lease-util.md +++ b/.opencode/agents/git-force-push-with-lease-util.md @@ -113,7 +113,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-isolator-util.md b/.opencode/agents/git-isolator-util.md index 89f0c16da..44c55bd1a 100644 --- a/.opencode/agents/git-isolator-util.md +++ b/.opencode/agents/git-isolator-util.md @@ -129,6 +129,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-push-util.md b/.opencode/agents/git-push-util.md index a0f78b51b..64f8fc8bf 100644 --- a/.opencode/agents/git-push-util.md +++ b/.opencode/agents/git-push-util.md @@ -114,7 +114,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-rebase-and-push-util.md b/.opencode/agents/git-rebase-and-push-util.md index 292a0ebc4..a0417ce7b 100644 --- a/.opencode/agents/git-rebase-and-push-util.md +++ b/.opencode/agents/git-rebase-and-push-util.md @@ -115,7 +115,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/git-rebase-util.md b/.opencode/agents/git-rebase-util.md index 5ffcbb529..8e709b35b 100644 --- a/.opencode/agents/git-rebase-util.md +++ b/.opencode/agents/git-rebase-util.md @@ -129,6 +129,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/git-stage-util.md b/.opencode/agents/git-stage-util.md index 1075f7da4..5f1f466ff 100644 --- a/.opencode/agents/git-stage-util.md +++ b/.opencode/agents/git-stage-util.md @@ -115,7 +115,8 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny - "sudo *": deny + "*force_merge*": deny + "*sudo*": deny task: "*": deny diff --git a/.opencode/agents/implementation-supervisor.md b/.opencode/agents/implementation-supervisor.md index 4320a54a8..307c9c398 100644 --- a/.opencode/agents/implementation-supervisor.md +++ b/.opencode/agents/implementation-supervisor.md @@ -126,6 +126,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/implementation-worker.md b/.opencode/agents/implementation-worker.md index 3f79aca57..2bfa704a1 100644 --- a/.opencode/agents/implementation-worker.md +++ b/.opencode/agents/implementation-worker.md @@ -128,6 +128,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-merge-supervisor.md b/.opencode/agents/pr-merge-supervisor.md index e04be2cb6..54ca59dd7 100644 --- a/.opencode/agents/pr-merge-supervisor.md +++ b/.opencode/agents/pr-merge-supervisor.md @@ -118,6 +118,10 @@ permission: # CRITICAL: No direct HTTP calls to the OpenCode server "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-merge-worker.md b/.opencode/agents/pr-merge-worker.md index 0c82268af..cbc2c111b 100644 --- a/.opencode/agents/pr-merge-worker.md +++ b/.opencode/agents/pr-merge-worker.md @@ -127,6 +127,10 @@ permission: # CRITICAL: No direct HTTP calls to the OpenCode server "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-review-supervisor.md b/.opencode/agents/pr-review-supervisor.md index a3cc29b05..1e947568c 100644 --- a/.opencode/agents/pr-review-supervisor.md +++ b/.opencode/agents/pr-review-supervisor.md @@ -121,6 +121,10 @@ permission: # CRITICAL: No direct HTTP calls to the OpenCode server "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/pr-review-worker.md b/.opencode/agents/pr-review-worker.md index 1fc008a58..9f9c47753 100644 --- a/.opencode/agents/pr-review-worker.md +++ b/.opencode/agents/pr-review-worker.md @@ -137,6 +137,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/session-health-full-util.md b/.opencode/agents/session-health-full-util.md index 307fe7075..410d0bff1 100644 --- a/.opencode/agents/session-health-full-util.md +++ b/.opencode/agents/session-health-full-util.md @@ -118,6 +118,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + task: "*": deny diff --git a/.opencode/agents/session-health-quick-util.md b/.opencode/agents/session-health-quick-util.md index b0e8d7c00..0c2473208 100644 --- a/.opencode/agents/session-health-quick-util.md +++ b/.opencode/agents/session-health-quick-util.md @@ -118,6 +118,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + task: "*": deny diff --git a/.opencode/agents/session-health-util.md b/.opencode/agents/session-health-util.md index 590ec62ad..4fc5e934e 100644 --- a/.opencode/agents/session-health-util.md +++ b/.opencode/agents/session-health-util.md @@ -118,6 +118,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + task: "*": deny "session-health-quick-util": allow diff --git a/.opencode/agents/supervisor.md b/.opencode/agents/supervisor.md index 208ea9a85..e01927df5 100644 --- a/.opencode/agents/supervisor.md +++ b/.opencode/agents/supervisor.md @@ -124,6 +124,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/task-implementor.md b/.opencode/agents/task-implementor.md index 7cf014850..8cd7bd663 100644 --- a/.opencode/agents/task-implementor.md +++ b/.opencode/agents/task-implementor.md @@ -137,6 +137,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/tier-codex.md b/.opencode/agents/tier-codex.md index 00744533d..a719af598 100644 --- a/.opencode/agents/tier-codex.md +++ b/.opencode/agents/tier-codex.md @@ -122,6 +122,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-dispatcher.md b/.opencode/agents/tier-dispatcher.md index 61a41b93b..33bc87109 100644 --- a/.opencode/agents/tier-dispatcher.md +++ b/.opencode/agents/tier-dispatcher.md @@ -130,6 +130,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # All the subagents you want this agent to have access to task: # All agents should start with deny and only enable what you need diff --git a/.opencode/agents/tier-gpt5-mini.md b/.opencode/agents/tier-gpt5-mini.md index 8f66c273b..8f66b4e44 100644 --- a/.opencode/agents/tier-gpt5-mini.md +++ b/.opencode/agents/tier-gpt5-mini.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-gpt5-nano.md b/.opencode/agents/tier-gpt5-nano.md index 03bff406a..f39b7c50f 100644 --- a/.opencode/agents/tier-gpt5-nano.md +++ b/.opencode/agents/tier-gpt5-nano.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-haiku.md b/.opencode/agents/tier-haiku.md index 76187180e..e222a9e86 100644 --- a/.opencode/agents/tier-haiku.md +++ b/.opencode/agents/tier-haiku.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-kimi.md b/.opencode/agents/tier-kimi.md index c4afed7a9..315ee77f3 100644 --- a/.opencode/agents/tier-kimi.md +++ b/.opencode/agents/tier-kimi.md @@ -120,6 +120,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-o4-mini.md b/.opencode/agents/tier-o4-mini.md index 7cbf33adc..8508aa427 100644 --- a/.opencode/agents/tier-o4-mini.md +++ b/.opencode/agents/tier-o4-mini.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-opus.md b/.opencode/agents/tier-opus.md index 54fff15b0..a1e5bbce2 100644 --- a/.opencode/agents/tier-opus.md +++ b/.opencode/agents/tier-opus.md @@ -122,6 +122,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-qwen-large.md b/.opencode/agents/tier-qwen-large.md index 7e4423b33..6dd9e3d8b 100644 --- a/.opencode/agents/tier-qwen-large.md +++ b/.opencode/agents/tier-qwen-large.md @@ -120,6 +120,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-qwen-med.md b/.opencode/agents/tier-qwen-med.md index 232385f70..d97e6a93a 100644 --- a/.opencode/agents/tier-qwen-med.md +++ b/.opencode/agents/tier-qwen-med.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-qwen-small.md b/.opencode/agents/tier-qwen-small.md index bf87bdb77..49e36341c 100644 --- a/.opencode/agents/tier-qwen-small.md +++ b/.opencode/agents/tier-qwen-small.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/tier-sonnet.md b/.opencode/agents/tier-sonnet.md index 92c86a623..cd23ab07f 100644 --- a/.opencode/agents/tier-sonnet.md +++ b/.opencode/agents/tier-sonnet.md @@ -121,6 +121,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # target_agent is caller-controlled but is required by convention to be a # `task-*` agent (the final inner work agent in the tiered dispatch flow). # Restricting the wildcard to `task-*` enforces that contract while keeping diff --git a/.opencode/agents/work-group-util.md b/.opencode/agents/work-group-util.md index 4a9e17a1a..a98d0b82f 100644 --- a/.opencode/agents/work-group-util.md +++ b/.opencode/agents/work-group-util.md @@ -129,6 +129,9 @@ permission: "curl*localhost:4096*": deny "curl*127.0.0.1:4096*": deny + "*force_merge*": deny + "*sudo*": deny + # No subagents needed task: "*": deny