docs(agents): clarify cleanup safety boundaries

This commit is contained in:
Ryan Yin
2026-08-05 10:06:04 +08:00
parent c0f50a7d4a
commit 6f837b8718
+4 -2
View File
@@ -22,8 +22,10 @@ If rules conflict, follow the higher-priority source and state the conflict brie
- Examples: `git push`, creating/updating remote PRs/Issues via `gh`.
- MUST NOT auto-run remote-mutating commands unless explicitly requested.
- Examples: `kubectl apply/delete`, `helm upgrade`, `terraform apply`, remote `ssh` mutation.
- MUST NOT use destructive/force/delete options EVEN if explicitly requested.
- Examples: `--force`, `rm -rf`, `git reset --hard`, `gh repo delete`, `terraform destroy`
- MUST NOT perform destructive/irreversible operations or use force options, even if explicitly
requested (e.g. `rm -rf`, `terraform destroy`).
- MAY perform verified, recoverable cleanup when explicitly requested (e.g. `git branch -d` for a
fully merged branch).
- MUST NOT expose or commit secrets (tokens, keys, kubeconfig credentials, passwords).
## 3) Security and Secrets Handling