feat: add --changed fast mode to maintenance agents restricting scope to git-modified files under devplacepy/ and tests/

Implement a new `--changed` flag for the maintenance agent fleet that limits checking and fixing to only files git reports as modified or new (untracked) under `devplacepy/` and `tests/`. The change introduces `agents/changed.py` with `changed_paths()` parsing `git status --porcelain`, adds `_WRITE_ALLOWLIST` guard logic in `agents/agent.py` (`set_write_allowlist`, `clear_write_allowlist`, `_allowlist_guard`) wired into `_mutation_guard` and `create_file`, threads the file list through `orchestrator.run_fleet` -> `agent.run` -> `_execute` -> `task_prompt` with a dedicated "CHANGED-FILES RUN" prompt branch, and exposes `make maintenance` (read-only) and `make maintenance-fix` (fix mode) targets in the Makefile. Documentation is updated in `AGENTS.md`, `CLAUDE.md`, and `README.md`.
This commit is contained in:
2026-06-12 06:15:19 +00:00
parent 425e9bdca1
commit 3ef1d02265
12 changed files with 220 additions and 23 deletions
+2
View File
@@ -263,6 +263,8 @@ Read the router (`routers/{area}.py`), template (`templates/{area}.html`), test
The `agents/` directory is a fleet of autonomous AI maintenance agents (developer tooling, not part of the running app). Each agent enforces one quality dimension across the repo and runs in `--fix` (default) or `--check` mode. The internals are documented in `AGENTS.md` (the "Maintenance agents" section); the public docs are `/docs/maintenance-agents.html` and `/docs/maintenance-usage.html`. Targets: `make <name>-agent` (`CHECK=1` for report-only), `make agents-all`, `make maestro`.
**Changed-files fast mode.** `make maintenance` runs the whole fleet concurrently in read-only (check) mode, and `make maintenance-fix` runs it in fix mode, both scoped to ONLY the files git reports as modified or new (untracked) under `devplacepy/` and `tests/` - for fast checking and fixing of work in progress. The scope is computed once by `agents/changed.py` `changed_paths()` (parses `git status --porcelain`, keeps existing files whose first path segment is `devplacepy/` or `tests/`) and threaded to every agent as a `files` list; an empty set short-circuits with "nothing to do" and exit 0. The list is injected into each agent's task prompt (it may still read other files for cross-reference but reports/fixes only within the set) AND enforced in fix mode by a hard write-allowlist guard (`agent._allowlist_guard`, wired into `_mutation_guard` and `create_file` beside `_protected_guard`/`_budget_guard`), so a fix run can never modify a file outside the changed set. The flag is `--changed` on both `agents.orchestrator` and any single agent (`python -m agents.security --changed --check`); the traditional full-repo targets are unchanged.
**HARD RULE - the `agents/` directory is OFF-LIMITS to every code checker, fixer, linter, style pass, or refactor, including the maintenance agents themselves, Claude, and any other tool or human cleanup.** That directory deliberately contains the exact patterns the agents hunt for - em-dash characters, forbidden-name examples (`_temp`, `_v2`, `my_`), destructive-command strings (`rm -rf`), and HTML entities - as DETECTION DATA, not as violations. "Fixing" them corrupts the detectors and breaks the fleet. The maintenance agents enforce this themselves: every run calls `agent.protect_agents()`, which makes the engine's write tools (`write_file`/`edit_file`/`patch_file`/`create_file`) hard-reject any path under `agents/`, and their system prompt forbids reading or scanning it. Do NOT em-dash-strip, rename, reformat, or otherwise "tidy" anything in `agents/`. Leave it exactly as authored.
Code validation uses `agents/validator.py` (run via `make validate` or `python -m agents.validator .`): a dependency-free validator covering Python (`ast` + `py_compile`), JavaScript (`node --check`), CSS (brace balance), and HTML/Jinja templates (Jinja2 parse). Use it in place of any external validator when checking touched files.