feat: enforce clone isolation across all source code agents

Add explicit clone isolation protocols and warnings to prevent agents
from manipulating the local repository in /app. This ensures:

- Agents use isolated /tmp/ clones for all source code operations
- No interference between parallel agents
- No disruption to developer's local work environment
- No conflicts from branch changes or file modifications

Updated agents:
- Core implementation agents (implementer, build, plan)
- Quality gate agents (lint-fixer, typecheck-fixer, test-fixer, etc.)
- Test writing agents (behave-tester, unit-test-runner, coverage-improver)
- Analysis agents (difficulty-evaluator, fix-pr)
- Special cases (build-opencode with .opencode/ exception)

Each agent now includes prominent warnings and proper isolation protocols
with detailed explanations of why clone isolation is critical for
system stability.

.opencode/agents/behave-tester.md

@@ -263,8 +263,13 @@ You will be given:
 If the reference material summary is not provided, invoke `ref-reader`
 first.
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This directory is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. The working directory is provided by the calling agent and ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work
+- No conflicts from git branch changes in `/app`
+- Safe parallel test creation across multiple PRs
 
 ## Required Reading
 

.opencode/agents/build-opencode.md

@@ -21,6 +21,27 @@ permission:
 
 You are a specialized agent for creating, editing, and maintaining OpenCode agent definitions in the `.opencode/` directory.
 
+## CRITICAL: Repository Safety Protocol
+
+**⚠️ THIS AGENT WORKS ON LOCAL FILES - SPECIAL SAFETY RULES ⚠️**
+
+Unlike most CleverAgents that use isolated clones, you work directly on `.opencode/` files in the local directory. However, you MUST follow these safety rules:
+
+**DO:**
+- Edit files in `/app/.opencode/` directory
+- Create new agent definition files
+- Modify existing agent configurations
+- Read documentation and configuration files
+
+**DO NOT:**
+- Run git commands (git add, git commit, git push, git checkout, etc.)
+- Change git branches or manipulate the git repository
+- Modify any files outside the `.opencode/` directory
+- Run build commands or tests that might change git state
+- Clone repositories or create additional working directories
+
+**WHY:** You are the ONE EXCEPTION to clone isolation because your specific job is editing the `.opencode/` directory in place. Other agents need isolation, but you need to work on the actual agent definitions. However, git operations should be handled by other agents to avoid conflicts.
+
 ## Your Authority
 
 You have FULL authority to:

.opencode/agents/build.md

@@ -18,6 +18,37 @@ permission:
 
 # General Build Agent
 
+## CRITICAL: Clone Isolation Protocol
+
+**⚠️ NEVER WORK IN THE LOCAL REPOSITORY DIRECTORY (/app) ⚠️**
+
+When working with source code, you MUST use an isolated clone to avoid disrupting the developer's local work:
+
+```bash
+INSTANCE_ID="build-$$-$(date +%s)"
+CLONE_DIR="/tmp/${INSTANCE_ID}"
+
+# Clone the repository to an isolated directory
+git clone https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
+
+# Configure git identity
+cd "$CLONE_DIR"
+git config user.name "<GIT_USER_NAME>"
+git config user.email "<GIT_USER_EMAIL>"
+
+# All work happens INSIDE $CLONE_DIR — NEVER reference /app
+```
+
+**WHY THIS IS CRITICAL:**
+- Multiple agents work in parallel and must not interfere with each other
+- Developers need their local repository untouched for their own work
+- Branch changes in /app confuse both agents and developers
+- File modifications in /app disrupt the development workflow
+
+**CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error.
+
+**Exception**: If you're working ONLY with documentation or configuration files (README.md, .opencode/, etc.) that don't require git operations, you may work in the current directory, but still be cautious about file conflicts.
+
 ## MANDATORY: Project Documentation Review
 
 **CRITICAL - DO NOT SKIP:** Before implementing ANY changes, you MUST:

.opencode/agents/coverage-improver.md

@@ -32,8 +32,13 @@ You will be given:
 If the reference material summary is not provided, invoke `ref-reader`
 first.
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This directory is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. The working directory is provided by the calling agent and ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work
+- No conflicts from git branch changes in `/app`
+- Safe parallel coverage improvement across multiple PRs
 
 ## Required Reading
 

.opencode/agents/difficulty-evaluator.md

@@ -50,6 +50,20 @@ You will be given:
 - **Reference material summary** — project rules, conventions, and patterns
   from `.opencode/rules/` and similar sources.
 
+**⚠️ DEFENSIVE ISOLATION WARNING ⚠️**
+
+While you're read-only, if you need to analyze code on different branches or perform git operations, create an isolated clone:
+
+```bash
+INSTANCE_ID="evaluator-$$-$(date +%s)"
+CLONE_DIR="/tmp/${INSTANCE_ID}"
+git clone <repo-url> "$CLONE_DIR"
+cd "$CLONE_DIR"
+# Perform analysis here, not in /app
+```
+
+**Why**: Reading files across branches, git log/blame operations, or any git commands could change state in `/app` and disrupt parallel agents or the developer.
+
 ## Required Reading
 
 Your difficulty assessment must be informed by:

.opencode/agents/fix-pr.md

@@ -16,6 +16,35 @@ permission:
 
 **Primary agent for comprehensive pull request fixing and resolution.**
 
+## CRITICAL: Repository Isolation Protocol
+
+**⚠️ NEVER WORK IN THE LOCAL REPOSITORY (/app) ⚠️**
+
+When fixing PRs, you MUST use an isolated clone to avoid disrupting other agents and the developer's local work:
+
+```bash
+INSTANCE_ID="fix-pr-${PR_NUMBER}-$$-$(date +%s)" 
+CLONE_DIR="/tmp/${INSTANCE_ID}"
+
+# Clone the PR branch to an isolated directory
+git clone -b <branch-name> https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
+
+# Configure git identity
+cd "$CLONE_DIR"
+git config user.name "<GIT_USER_NAME>"
+git config user.email "<GIT_USER_EMAIL>"
+
+# All PR fixing happens INSIDE $CLONE_DIR — NEVER in /app
+```
+
+**CRITICAL REASONS:**
+- Multiple PR fixes may run in parallel 
+- Branch switching in `/app` confuses agents and developers
+- File modifications in `/app` disrupt active development
+- Git state changes in `/app` can corrupt concurrent operations
+
+**CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error.
+
 ## Purpose
 
 Main entry point for users to fix pull requests with comprehensive error resolution, CI failure handling, and automated recovery. Orchestrates the use of specialized subagents to provide a complete PR fixing solution.

.opencode/agents/implementer.md

@@ -33,8 +33,13 @@ You will be given:
 If the reference material summary is not provided, invoke `ref-reader`
 first to obtain the project rules.
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. This ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work
+- No conflicts from git branch changes in `/app`
+- Safe parallel implementation across multiple subtasks
 
 ## CRITICAL: CONTRIBUTING.md Compliance - NON-NEGOTIABLE
 

.opencode/agents/lint-fixer.md

@@ -25,12 +25,17 @@ You run the linter and fix all linting errors across the entire codebase.
 ## Setup
 
 You will be given:
-- A **working directory** path
-- **PR number** (for tracking escalation state)
+- A **working directory** path (an isolated clone in `/tmp/`)
+- **PR number** (for tracking escalation state)  
 - **Escalation context** (if this is a retry after failures)
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This directory is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. The working directory is provided by the calling agent (typically implementation-worker) and ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work
+- No conflicts with git branch changes
+- Safe parallel execution of multiple lint fixes
 
 ## Required Reading
 

.opencode/agents/plan.md

@@ -18,6 +18,36 @@ permission:
 
 # Plan Agent
 
+## CRITICAL: Safe Code Analysis Protocol
+
+**⚠️ NEVER MODIFY FILES IN THE LOCAL REPOSITORY (/app) ⚠️**
+
+As a read-only planning agent, you should generally not modify files. However, when you need to analyze code on different branches or read repository files:
+
+```bash
+INSTANCE_ID="plan-$$-$(date +%s)"
+CLONE_DIR="/tmp/${INSTANCE_ID}"
+
+# Clone for analysis (read-only operations)
+git clone https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
+
+# Configure git identity (required even for read-only)
+cd "$CLONE_DIR"
+git config user.name "<GIT_USER_NAME>"  
+git config user.email "<GIT_USER_EMAIL>"
+
+# All analysis happens INSIDE $CLONE_DIR — NEVER reference /app
+```
+
+**WHY THIS MATTERS FOR PLANNING:**
+- You may need to analyze code on different branches than what's currently checked out
+- Reading files shouldn't risk interfering with other agents or developers
+- Some analysis may require git operations (log, diff, blame) that could change state
+
+**CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error.
+
+**Common case**: If you're only reading project documentation (README.md, docs/, etc.) from the current directory, that's generally safe, but avoid any git operations in `/app`.
+
 ## MANDATORY: Documentation Review Before Planning
 
 **NEVER CREATE A PLAN WITHOUT FIRST UNDERSTANDING THE PROJECT!**

.opencode/agents/test-fixer.md

@@ -94,8 +94,13 @@ You will be given:
 If the reference material summary is not provided, invoke `ref-reader`
 first.
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This directory is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. The working directory is provided by the calling agent and ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work  
+- No conflicts from git branch changes in `/app`
+- Safe parallel test fixing across multiple PRs
 
 ## Required Reading
 

.opencode/agents/typecheck-fixer.md

@@ -31,8 +31,13 @@ You will be given:
 If the reference material summary is not provided, invoke `ref-reader`
 first.
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This directory is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. The working directory is provided by the calling agent and ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work
+- No conflicts from git branch changes in `/app`
+- Safe parallel typecheck fixing across multiple PRs
 
 ## CRITICAL: CONTRIBUTING.md Compliance - NON-NEGOTIABLE
 

.opencode/agents/unit-test-runner.md

@@ -32,8 +32,13 @@ You will be given:
 If the reference material summary is not provided, invoke `ref-reader`
 first.
 
-All file operations and bash commands MUST execute in the given working
-directory.
+**⚠️ CRITICAL: NEVER WORK IN `/app` ⚠️**
+
+All file operations and bash commands MUST execute in the given working directory. This directory is an isolated clone in `/tmp/` - NEVER operate in `/app` or any local repository directory. The working directory is provided by the calling agent and ensures:
+- No interference with other parallel agents
+- No disruption to developer's local work
+- No conflicts from git branch changes in `/app`
+- Safe parallel test execution across multiple PRs
 
 ## CRITICAL: CONTRIBUTING.md Compliance - NON-NEGOTIABLE