root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(FN-1430): add worktree execution boundaries to prevent out-of-scope modifications

Browse Source 
- Add worktree-aware path boundaries in agent factory to prevent cross-task contamination
- Sync core agent prompts with worktree boundary guidance for consistent enforcement
- Add boundary guidance to executor prompts so agents understand their scope
- Fix TypeScript types for worktree boundary wrapping
- Add comprehensive tests for boundary wrapping behavior
- Create changeset for @gsxdsm/fusion (minor)
This commit is contained in:
gsxdsm
2026-04-09 23:59:45 -07:00
parent 3fdc16bf5d
commit 03f010cf60
7 changed files with 528 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
.changeset/worktree-execution-boundaries.md Normal file
View File

@@ -0,0 +1,15 @@
---
"@gsxdsm/fusion": patch
---
Enforce worktree-only execution boundaries for coding agents
Executor coding sessions are now constrained to their assigned task worktree, preventing accidental mutations to files in the main project checkout or other unrelated paths.
**Key changes:**
- File tool operations (read/write/edit/glob/grep/bash) now validate that paths are inside the current worktree when running in worktree mode
- Project memory writes to `.fusion/memory.md` at project root are still permitted (required for durable project learnings)
- Task attachment reads from `.fusion/tasks/{taskId}/attachments/` are still permitted (required for context access)
- Executor and senior-engineer prompts now explicitly document the worktree boundary rules
Non-worktree agents (triage, merger, cron, planning sessions) continue to use project root and are unaffected.