`AGENTS.md` in `protected_files` list blocks legitimate modifications

[arezero]

Severity: Major — common for workflows that need to update project documentation

Reproduction: The agent modifies AGENTS.md (e.g., updating build instructions as part of a CI fix) and calls push_to_pull_request_branch or create_pull_request.

Expected: The push/PR succeeds because AGENTS.md is a documentation file, not a security-sensitive config.

Actual: The push fails with: Cannot push to pull request branch: patch modifies protected files (AGENTS.md). The compiler hardcodes AGENTS.md into the protected_files list alongside lockfiles and package manifests.

Impact: Any issue that touches AGENTS.md (which is common — it's the project's own documentation) will fail.

Workaround: Remove ,"AGENTS.md" from the protected_files list in the lock file's GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG JSON. Must be reapplied after every recompile.

Suggestion: Either remove AGENTS.md from the default protected_files list, or provide a frontmatter option like protected-files: { exclude: ["AGENTS.md"] } to override it.

[pelikhan]

We are looking at a better control of the protected file set. However, AGENTS.md is loaded in every agent and as such is security critical.

[pelikhan]

Expected: The push/PR succeeds because AGENTS.md is a documentation file, not a security-sensitive config.

AGENTS.md is a security critical file injected in every agentic session. It is not just documentation.

[mvanhorn]

Agentic Implementation Plan: Allow AGENTS.md Modifications

Problem

AGENTS.md is in the protected_files list, but agents legitimately need to update it (e.g., updating build instructions as part of CI fixes).

Proposed Changes

Two possible approaches:

Option A: Remove AGENTS.md from protected_files entirely

• Simplest fix
• Risk: agents could make unwanted changes to AGENTS.md

Option B: Section-based protection

• Protect only security-sensitive sections of AGENTS.md
• Allow modifications to documentation sections (build instructions, tool descriptions)
• More granular but more complex

Recommendation

Option A is likely sufficient since AGENTS.md is a documentation file and changes are visible in PR diffs for review.

Files to Investigate

• Search for protected_files configuration
• Check the push/PR validation logic that enforces protection

[pelikhan]

Thanks @arezero and @mvanhorn looking into this.

[pelikhan]

@copilot

Do provide a frontmatter option like protected-files: { exclude: ["AGENTS.md"] } to override it.

[pelikhan]

Make sure overrides can be imported merged as set