Implement worker cannot edit files outside the repo root, and has no package-registry egress #1743

Summary

A live end-to-end run of Squad against a real .NET repo (bradygaster/aspiregregator-squad-test) surfaced two configuration defects in workflows/squad-implement-worker.md that make implementation impossible for a large class of repositories. Neither is caught by compilation — both fail only at agent runtime.

A. allowed-files patterns match the repository root only

The allowed-files allowlist declares 40 extension globs as bare *.ext — for example *.cs, *.csproj, *.java, *.go. A * does not cross a /, so these match only files at the repository root. The supplementary directory globs are all lowercase conventional names (src/**, lib/**, app/**, api/**, …).

The practical consequence: any repository that puts source in top-level project folders — the default layout for .NET solutions, and common in Java and Go — has no file it is permitted to change.

Observed live on a repository with AppHost/ Abstractions/ Grains/ Frontend/ FeedUpdater/ Defaults/. Every file in the worker's proposed patch was rejected:

• 5 .csproj files
• 3 .cs files
• .github/copilot-instructions.md

The run reported success. The pull request simply never appeared.

*.razor is also absent from the list entirely, which blocks Blazor components regardless of where they sit.

Fix: add a **/*.ext mirror for every extension pattern (keeping the root-level form, since **/ matching zero segments is not guaranteed), plus **/Dockerfile* and **/Makefile, and add *.razor.

B. network.allowed grants no package-registry egress

network.allowed is [defaults], which covers GitHub and certificate infrastructure but no language package registry. An implementation agent cannot restore or install dependencies, so it cannot build or test what it just wrote.

Observed live: dotnet restore failed with a proxy 403 against api.nuget.org. The worker behaved correctly — it reported the work as incomplete rather than guessing — but it could not finish the task. gh-aw's own compiler emits a recommendation to add the dotnet ecosystem identifier in exactly this situation.

Fix: add the ecosystem identifiers containers, dotnet, go, java, node, python, ruby, rust to the worker. All eight were verified to compile.

Scoped to the worker only. workflows/squad.md plans and routes; it does not restore packages, so its network surface stays narrow.

Out of scope

Also observed during the same run, tracked separately:

• protected-files: request_review logs that it will proceed with a request-changes review, then hard-refuses the push (Signed-commit payload violates file-protection policy). Soft policy, hard enforcement — appears to be a gh-aw upstream bug.
• Consumer repositories need Allow GitHub Actions to create and approve pull requests enabled, or safe-output pull request creation fails outright. Documentation/preflight, not code.
• The slash_command + bots: co-configuration warning in workflows/squad.md.