fix(code): keep CODE_ALLOWED_TARGET_BRANCHES optional

[ralphbean]

The code post-script already has the behavior we want when CODE_ALLOWED_TARGET_BRANCHES is unset: it discovers the repository default branch through the forge API and falls back to main. If a user sets the variable, it becomes an explicit comma-separated allowlist (or *).

Right now, the base code harness maps CODE_ALLOWED_TARGET_BRANCHES: "${CODE_ALLOWED_TARGET_BRANCHES}" into env.runner. Harness validation therefore requires the host variable before the post-script can use its unset behavior. Jira code dispatches fail with:

validating env: env.runner[CODE_ALLOWED_TARGET_BRANCHES]: host variable CODE_ALLOWED_TARGET_BRANCHES is not set

Let’s keep this configuration optional. The base harness should not require the host variable; without an override, code runs should use the repository default branch. Repositories that want a narrower or broader policy can set CODE_ALLOWED_TARGET_BRANCHES in an extending harness.

Acceptance criteria:

• A code run succeeds without CODE_ALLOWED_TARGET_BRANCHES in the host environment.
• An unset value uses the forge-detected default branch, with the existing main fallback.
• An explicitly configured allowlist continues to be enforced.
• The base harness and documentation agree about the default behavior.

[ralphbean]

/fs-code

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 3:47 PM UTC · Completed 3:51 PM UTC

Commit: 74aebe0 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.86

[fullsend-ai-coder]

🤖 Code · ⚠️ Cancelled · Started 3:47 PM UTC · Ended 3:52 PM UTC

Commit: 74aebe0 · View workflow run →

[fullsend-ai-triage]

Severity: high — Jira code dispatches are currently broken by this validation requirement.

Related issues:

• Code agent can never target non-default branches — no way to configure CODE_ALLOWED_TARGET_BRANCHES #6556 (open): Broader issue about enabling CODE_ALLOWED_TARGET_BRANCHES configuration for non-default branch targeting — complementary but not blocking
• Verify ${VAR} substitution semantics for unset harness env vars #5799 (open): Verifying ${VAR} substitution semantics for unset harness env vars — the underlying semantic question, but this fix can proceed independently
• Env validator should report all missing variable errors, not just the first #6792 (open): Env validator fail-fast behavior (report all errors, not just the first) — related validation UX improvement

Proposed test case:

Test: code harness env resolution without CODE_ALLOWED_TARGET_BRANCHES

Setup:
  - Load the base code harness with no CODE_ALLOWED_TARGET_BRANCHES in host env

Assertions:
  1. Harness validation succeeds (no env resolution error)
  2. Runner environment does not contain CODE_ALLOWED_TARGET_BRANCHES key
     (or contains empty string — verify post-script handles both)
  3. With CODE_ALLOWED_TARGET_BRANCHES="main,release-*" in host env,
     the value is passed through and the allowlist is enforced

---

Labels: Code agent harness bug causing Jira dispatch failures — high severity, harness component, code agent scope.

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure (post-script /home/runner/work/fullsend/fullsend/.fullsend/.fullsend-cache/resources/sha256/d170de3071cdcdc7c17ab7ca674db7c1f0f8de97f84dab0459eb5568506ba7d1/scripts/post-code.sh failed: exit status 1) · Started 3:54 PM UTC · Completed 4:11 PM UTC

Commit: 74aebe0 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.93

[fullsend-ai-coder]

⚠️ Post-code script failed — Push rejected — workflows permission (exit code 1)

The code agent completed, but the post-code script failed before finishing.

Security boundary: the coder app intentionally lacks workflows write permission. Changes to .github/workflows/ must be made outside the agent (e.g., via a manual PR). Re-run the agent without workflow file changes, or apply those changes separately.

Workflow run: https://github.com/fullsend-ai/fullsend/actions/runs/33528362126

Details:
To https://github.com/fullsend-ai/fullsend.git
! [remote rejected] agent/6858-optional-allowed-branches -> agent/6858-optional-allowed-branches (refusing to allow a GitHub App to create or update workflow .github/workflows/reusable-code.yml without workflows permission)
error: failed to push some refs to 'https://github.com/fullsend-ai/fullsend.git'
To https://github.com/fullsend-ai/fullsend.git
! [remote rejected] agent/6858-optional-allowed-branches -> agent/6858-optional-allowed-branches (refusing to allow a GitHub App to create or update workflow .github/workflows/reusable-code.yml without workflows permission)
error: failed to push some refs to 'https://github.com/fullsend-ai/fullsend.git'
Please check the workflow logs for full details and retry with /fs-code if appropriate.