Gate global git config mutation at the auto-shell policy layer

The scoped push script gave agents an alternative, but nothing
stopped an agent in auto mode from still running git config
--global, --system, --edit, --file against an outside-repo path, or
unsetting GIT_CONFIG_GLOBAL — AGENTS.md only asked nicely. Add a
git-global-config rule to AUTO_SHELL_RULES, the table auto-shell
policy already uses to force worktree and recursive-rm commands to
ask instead of auto-running. Machine-wide config mutation is the
same category: it changes state outside the workspace boundary.

Writing ~/.gitconfig directly with write_file/edit_file bypasses
shell policy, but is already caught by the existing outside-workspace
path restriction, since $HOME sits outside the workspace boundary.
No separate gate is needed for that route.

Broaden the AGENTS.md rule to name the property (never mutate git
configuration outside the current repository) instead of enumerating
two commands, since an incomplete list reads as permission for
anything not named.

Author: TheGreatAxios

AGENTS.md

@@ -55,7 +55,7 @@ Follow the `style` skill's message format: plain-English summary, no `feat:`/`fi
 
 ## Pushing
 
-**Never mutate global git config**, for any reason — not `git config --global`, not toggling `url.*.insteadOf`, not even temporarily with a plan to restore it. Global config is shared-mutable state across every agent and every repo on the machine; a crash or a second agent running concurrently turns a "temporary" toggle into a lasting outage or collision. This is the same hazard class as running `git stash` (also global, also banned).
+**Never mutate git configuration outside the current repository**, for any reason and not even temporarily with a plan to restore it — whatever the command (`--global`, `--system`, `--edit`, `--file` pointed at a path outside the repo, reassigning or unsetting `GIT_CONFIG_GLOBAL`, or writing `~/.gitconfig` directly). That state is shared by every agent and every repo on the machine; a crash or a second agent running concurrently turns a "temporary" toggle into a lasting outage or collision. This is the same hazard class as running `git stash` (also global, also banned). Auto mode enforces this at the shell-policy layer (`git-global-config` in `src/permission/auto-shell-policy.ts`), which routes any such command to an operator ask instead of running it unattended — this instruction is the fallback for the cases the policy can't see, not the only line of defense.
 
 If SSH push fails because the shell can't reach the ssh-agent socket, use `bin/git-push-scoped` instead of touching config:
 

src/permission/auto-shell-policy.ts

@@ -143,6 +143,24 @@ export const AUTO_SHELL_RULES: AutoShellRule[] = [
       inCmd(String.raw`gcloud\s+auth\s+print-access-token\b`),
     ],
   },
+  {
+    name: "git-global-config",
+    effect: "ask",
+    reason:
+      "This command mutates git configuration outside the current repository (--global, --system, an arbitrary --file, or GIT_CONFIG_GLOBAL). That state outlives this call and is shared by every other repo and agent on the machine, so it needs explicit operator approval and never runs unattended in auto mode. Use bin/git-push-scoped for an HTTPS push instead of rewriting global config.",
+    patterns: [
+      // --global / --system write or read the machine-wide config files;
+      // --edit opens one in $EDITOR, which can write anything.
+      inCmd(String.raw`git\s+config\s+(?:--global|--system|--edit)\b`),
+      // --file points config at an arbitrary path, including ~/.gitconfig —
+      // ask rather than try to distinguish a repo-local target from that.
+      inCmd(String.raw`git\s+config\s+--file\b`),
+      // Unsetting GIT_CONFIG_GLOBAL falls back to the real ~/.gitconfig, the
+      // same as never having scoped it. (Reassigning it to a new path is
+      // already caught by the env-assignment rule above.)
+      inCmd(String.raw`unset\s+GIT_CONFIG_GLOBAL\b`),
+    ],
+  },
 ];
 
 export function matchAutoShellRule(command: string): AutoShellRule | undefined {

src/permission/classify-security.test.ts

@@ -206,6 +206,56 @@ describe("credential-print shell commands force ask in auto mode", () => {
   });
 });
 
+describe("git config mutation outside the repo forces ask in auto mode", () => {
+  test("--global write or read", () => {
+    expect(autoShellRuleForCall(shellCall("git config --global user.name foo"))?.name).toBe(
+      "git-global-config",
+    );
+    expect(autoShellRuleForCall(shellCall("git config --global --get-regexp url."))?.name).toBe(
+      "git-global-config",
+    );
+  });
+
+  test("--system", () => {
+    expect(autoShellRuleForCall(shellCall("git config --system user.name foo"))?.name).toBe(
+      "git-global-config",
+    );
+  });
+
+  test("--edit opens an editor on a config file, which can write anything", () => {
+    expect(autoShellRuleForCall(shellCall("git config --global --edit"))?.name).toBe("git-global-config");
+    expect(autoShellRuleForCall(shellCall("git config --edit"))?.name).toBe("git-global-config");
+  });
+
+  test("--file to a path outside the workspace asks (via the outside-workspace rule)", () => {
+    expect(autoShellRuleForCall(shellCall("git config --file ~/.gitconfig user.name foo"))?.effect).toBe(
+      "ask",
+    );
+  });
+
+  test("--file to a workspace-relative path still asks on its own", () => {
+    expect(
+      autoShellRuleForCall(shellCall("git config --file scratch.gitconfig user.name foo"))?.name,
+    ).toBe("git-global-config");
+  });
+
+  test("unsetting GIT_CONFIG_GLOBAL falls back to the real ~/.gitconfig", () => {
+    expect(autoShellRuleForCall(shellCall("unset GIT_CONFIG_GLOBAL"))?.name).toBe("git-global-config");
+  });
+
+  test("reassigning GIT_CONFIG_GLOBAL is caught by the general env-assignment rule", () => {
+    expect(
+      autoShellRuleForCall(shellCall("GIT_CONFIG_GLOBAL=/tmp/x git config --global foo bar"))?.name,
+    ).toBe("env-assignment");
+  });
+
+  test("does not flag a plain repo-local config read or write", () => {
+    expect(autoShellRuleForCall(shellCall("git config user.name"))).toBeUndefined();
+    expect(autoShellRuleForCall(shellCall("git config user.email me@example.com"))).toBeUndefined();
+    expect(autoShellRuleForCall(shellCall("git config --local user.name foo"))).toBeUndefined();
+  });
+});
+
 describe("sensitive-path shell commands require approval, not a hard deny", () => {
   test("secret-guard no longer hard-denies shell references to secret files", async () => {
     const middleware = secretGuardPlugin().middleware;