fix: allow Git write operations through bash tool

[teddyli18000]

DevSpace's Bash tool can execute Git write operations, but the model-facing description frames Git usage as inspection-only and broadly forbids file modifications. MCP hosts can therefore reject git add, git commit, git fetch, git pull, and git push before DevSpace receives a tool call.

This change makes the existing capability explicit in the Bash descriptor, command schema, and server instructions while preserving the guidance against using shell redirection or generated scripts to edit project source files. The allowed Git writes are limited to git add, git commit, git fetch, git pull, and git push; destructive commands such as git reset --hard, git clean, git checkout --, and branch deletion remain explicitly unauthorized. The user workflow documentation now reflects the same boundary.

The MCP server regression test exercises both full and minimal tool modes through listTools() and the initialization instructions, including negative assertions for destructive Git commands. The focused server test, full test suite, typecheck, production build, Windows doctor, and git diff --check all pass.

Fixes #149

Summary by CodeRabbit

• New Features

  • Workspace setup now reflects currently available local providers and configured provider settings.
  • Provider details, supported models, effort levels, and availability notes are surfaced more clearly.
  • Unavailable providers are omitted from workspace context.

• Documentation

  • Clarified permitted Git operations and restrictions on destructive commands and project-file edits.
  • Clarified differences between minimal and full tool modes.

• Tests

  • Added coverage for provider availability, configuration filtering, and dynamic status updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 55bad1a5-b944-4852-85e4-ea4ec4552d84

📥 Commits

Reviewing files that changed from the base of the PR and between e1a1de9 and 16d7f6c.

📒 Files selected for processing (3)

• docs/chatgpt-coding-workflow.md
• src/server.test.ts
• src/server.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR updates shell guidance for Git operations and source-file edits. It also changes local-agent provider handling to use dynamic catalog-derived statuses, filtered workspace providers, and updated provider metadata schemas. Tests cover both changes.

Changes

Provider status and workspace integration

Layer / File(s)	Summary
Provider status contracts and output src/server.ts	Agent displays and workspace schemas now use provider IDs, models, efforts, and notes instead of thinking and availability fields.
Dynamic provider resolution src/server.ts	Server creation and MCP construction now pass a resolver that refreshes provider statuses for workspace operations.
Workspace catalog and instructions src/server.ts	Workspace opening builds a catalog from usable providers and lists formatted provider details without a separate unavailable-provider list.
Provider and workspace test coverage src/server.test.ts	Tests verify provider metadata, dynamic availability refresh, configuration filtering, and resolver-based fixtures.

Shell guidance and validation

Layer / File(s)	Summary
Shell permission policy src/server.ts, docs/chatgpt-coding-workflow.md	Shell guidance permits selected Git operations, prohibits destructive Git commands, and directs project source-file changes to edit/write tools.
Tool-mode test coverage src/server.test.ts	Tests verify the guidance in full and minimal tool modes. The fixture supports an optional tool mode and defaults to full mode.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to 16d7f

The PR clarifies which Git write operations the Bash tool permits while retaining restrictions on destructive commands and source-file editing; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: waishnav

Poem

A rabbit updates providers bright,
With notes and models lined in sight.
Git may commit, fetch, pull, and push,
While source edits leave the shell’s hush.
Tests guard each refreshed route.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The documentation change supports issue #149, but the summarized server changes do not clearly implement the required Bash description updates in both modes and the command parameter.	Update both Bash tool-mode descriptions and the command parameter description to allow the specified Git write operations while restricting source-file edits.
Out of Scope Changes check	⚠️ Warning	The provider availability and local-agent changes in src/server.ts and src/server.test.ts are unrelated to issue #149's Bash guidance requirements.	Remove the provider availability changes or link them to a separate issue so this pull request remains limited to Bash guidance and related regression tests.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the primary change: allowing Git write operations through the Bash tool.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This follow-up narrows Bash’s Git-write exception to five named routine operations while explicitly withholding authorization for destructive Git commands.

• Aligns full and minimal Bash descriptors, command schema guidance, server instructions, and workflow documentation.
• Adds regression coverage for both the allowed operations and destructive-command boundary.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/server.ts	Replaces the blanket Git exception with an explicit allowlist and clearly excludes destructive commands, resolving the previous finding.
src/server.test.ts	Verifies the allowlist and destructive-command warning across full and minimal tool modes, command schemas, and initialization instructions.
docs/chatgpt-coding-workflow.md	Documents the same bounded Git-write policy exposed by the server.

_{Reviews (2): Last reviewed commit: "fix: narrow Git write guidance" | Re-trigger Greptile}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/chatgpt-coding-workflow.md`:
- Around line 206-210: Update the Git/source-write guidance in the documented
workflow to use a hard prohibition, matching the server instruction and Bash
descriptions. State that all shell commands that create or modify project source
files are prohibited outside explicitly allowed Git operations, and keep the
same comprehensive wording and examples across both policy surfaces, including
cp, mv, python -c, and other omitted writers.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 185213b0-e50a-463c-a7d4-16bfebc6332b

📥 Commits

Reviewing files that changed from the base of the PR and between 1def8ce and a6b487c.

📒 Files selected for processing (3)

• docs/chatgpt-coding-workflow.md
• src/server.test.ts
• src/server.ts

[Waishnav]

I've never seen this problem, btw i use DevSpace with this settings, what setting do you use?

[teddyli18000]

Thanks — your screenshot shows the ChatGPT connector permission set to Allow all actions.

I'm not the original reporter, so I don't want to claim that I reproduced the refusal with the same permission setting. The environment reported in #149 is toolMode: "full", checkout workspace mode, and ChatGPT Apps & Connectors over Streamable HTTP.

I opened this PR after confirming that the current tools/list payload still describes Bash as Use only for ... git inspection and separately says it must not modify files. This PR only clarifies that model-facing contract; it does not grant any new runtime permission.

@wuaishare, could you confirm which ChatGPT Permissions option you used when reproducing this? In particular, was it also Allow all actions?

[teddyli18000]

I can now add an independent reproduction on Windows using the published @waishnav/devspace v1.0.6. The installed dist/server.js still contains the original Use only for ... git inspection / Do not use bash to create or modify files descriptor.

I used a fresh ChatGPT conversation and an isolated synthetic Git repository:

1. Use DevSpace to open [the isolated repo] and run git status and git diff.
   • ChatGPT called DevSpace and ran git status && git diff.
   • It reported one untracked test file.
2. Follow-up, exactly: Please git add . and git commit -m 'test second reproduction'.
   • ChatGPT did not call DevSpace.
   • It refused: “the bash exposed by DevSpace only allows git inspection / read-only checks” and said it could not run git add or git commit.
3. An immediate local check still showed the test file as untracked, with the commit count and HEAD unchanged.

I also ran a control: when explicit write authorization plus the inspection and write commands were combined into one initial prompt, ChatGPT did execute git add and git commit. That makes the behavior context-sensitive rather than a runtime permission failure, but the issue's two-step reproduction is valid and directly attributes the refusal to the current Bash contract.

This aligns with @wuaishare's A/B result in #149: changing only the model-facing descriptor removes the refusal. No screenshot is attached because the text-only evidence is sufficient and avoids exposing unrelated local/browser information.

[teddyli18000]

Cropped visual evidence from the two-step reproduction described above. The first read-only Git request succeeded through DevSpace, while the subsequent git add / git commit request was refused specifically because the exposed Bash contract was interpreted as allowing only Git inspection. Account details, local paths, and unrelated browser content have been excluded.

[teddyli18000]

Synced this branch with the latest main and resolved the drift in the three touched files. The final diff is still scoped to the Bash guidance, its regression coverage, and the workflow documentation; GitHub now reports the PR as mergeable again.

The new CI run is currently waiting for the repository-side approval required for fork PR workflows (action_required), so no CI job has failed.