[pando85]

Summary

Fixes #547.

• Add [pass] git_auto_push (default true) to keep existing automatic push behavior when omitted.
• Allow git_auto_push = false to preserve automatic Git preparation/pulls and local commits without automatically pushing to the remote.
• Expose --pass-git-auto-push=false and PASSLESS_PASS_GIT_AUTO_PUSH=false, following the existing pass-git-sync option style.
• Keep the current prs-lib::Sync::finalize() path unchanged when auto-push is enabled; use prs-lib::Sync::commit_all() (without a push) when disabled.
• Ensure passless config print renders git_auto_push = true in the [pass] section; document the toggle in README.
• Add [agents.profiles.<id>.storage.pass] git_sync / git_auto_push as fully independent settings for isolated agents; update agent configuration reference and examples.

Validation

Regression tests cover omitted/default-true config, TOML false, CLI true/false overrides, printed TOML, per-agent TOML defaults/overrides and isolation from [pass], and a local Git repository with a bare remote verifying that commit-only mode makes a commit without pushing.

CI will run on this PR; local cargo tests could not be executed in this environment.

Notes

The existing git_sync = false option still disables the automatic synchronization and commit process altogether. Isolated agents using a pass backend have independent git_sync and git_auto_push values, both defaulting to true for backward compatibility. Same-user agents share the human backend and follow [pass]. Git pushes publish all reachable commits, so use distinct repositories when isolation is required.

[forkline-bot]

✅ Fix pushed:

The CI fixes have been applied and pushed. Here's a summary of what was fixed:

CI Failure 1 - Commitlint (pre-commit):

• The commit message Fix PassGitSync::new calls and commit.message() type mismatch didn't follow conventional commit format
• Fix: Added fix: prefix to the commit message

CI Failure 2 - Rust test (commit_only_mode_never_pushes_to_remote):

• git2::Commit::message() returns "Update credential\n" (with trailing newline)
• The test assertion expected "Update credential" (without newline)
• Fix: Updated assertion to assert_eq!(commit.message(), Ok("Update credential\n"))

The fixed commit has been pushed to branch feat/pass-git-auto-push-547. The PR already exists (#548) and the CI should automatically re-run with the fixes.

---

This PR was generated by Forkline — AI-powered code contributions. The agent analyzed the issue and implemented this fix autonomously.

[pando85]

Review finding (P2): git_auto_push = false is respected by the primary pass backend, but not by isolated agent profiles with their own pass storage. create_storage_bundle_with_options() in cmd/passless/src/agent/storage_factory.rs calls PassStorageAdapter::new_with_options(), which hardcodes git_sync = true and git_auto_push = true. An isolated profile may therefore still push even after the user disables automatic pushing. Please either propagate the policy through the agent-runtime/storage-factory construction path or explicitly scope and document the setting as human-backend-only (with an independent agent option if supported). The rest of the change looks consistent with issue #547.

[forkline-bot]

⏸️ CI Auto-Fix paused

A user commit was detected after an automated fix. CI auto-fix is now paused
to prevent conflicts with your changes.

To resume CI auto-fix, use the /reset or /reset-ci-auto-fix command.

[pando85]

Review verdict: not ready to merge yet because the latest Rust workflow failed in Agent validation (deterministic). The new storage::pass::sync::tests::commit_only_mode_never_pushes_to_remote passed during one cargo test phase, then failed during the subsequent parallel phase (assertion failed: !sync.state.lock().unwrap().dirty, 1 failed / 1460 passed). This looks timing/environment-dependent, not enough evidence yet to conclude the production commit path is faulty. Existing agent_admin unit tests mutate process-wide PATH, potentially interfering with concurrent Git subprocesses; that is one hypothesis to investigate, not a proven cause. Please surface the finalization error in the test, make it isolated/deterministic, and assert the remote's HEAD remains unchanged from a seeded commit (rather than asserting an empty remote). A dedicated integration test exercising isolated-agent git_auto_push = false through backend construction would also improve coverage; current tests check deserialization, and source-level propagation looks correct. The independent human/agent configuration and documentation, including the shared-Git-repository caveat, look good.

[pando85]

CI blocker — intermittent regression test failure. In the latest Rust workflow's deterministic agent-validation job, commit_only_mode_never_pushes_to_remote passes in one test phase but fails in the following parallel phase at this assertion (dirty remains true). end_operation() logs the actual finalize_store error instead of returning it, so the assertion hides the reason. Please arrange a deterministic test that reports the error, seed the bare remote with an initial branch, verify its commit OID is unchanged, and investigate process-wide environment mutations during parallel tests (notably other unit tests that temporarily rewrite PATH).