What PABLO may change
Agents propose; you decide. PABLO never writes a commit of its own and never changes your issue tracker. This page lists every git, pull request and file operation it does perform, and when.
Git and pull requests#
PABLO's own code only performs these operations, each under strict rules:
| Operation | When |
|---|---|
| Create a branch and a worktree | pablo task:start |
| Commit, push, open a draft pull request | only through /pablo-commit-and-pr, which you run |
| Switch a pull request between draft and ready | CI turns green (ready); changes requested or QA failure (back to draft); task:retrigger-ci (draft) |
Rebase or merge, then push with --force-with-lease | sync, only with sync.auto_apply (off by default) or pablo sync:run --apply; never on a dirty worktree, nor on a branch you rewrote locally without pushing (rules); never plain --force |
| Resolve a rebase conflict | never in code: the conflict resolver agent does it, after an applied sync hit a conflict, and pushes its replay with --force-with-lease (nothing when a conflict needs you) |
| Delete a worktree | when the pull request is merged, or when you close the task (pablo task:close or the dashboard). A pull request closed without merging only moves the task to closed |
checkout + reset --hard the primary checkout | only when it is clean and has no local commits (rules) |
It never merges or closes a pull request, never comments or reviews, and never changes an issue. It sends no notification either: the only thing it runs on a state change is your own hook command, if you configure one, and what that command does is up to you.
Files on your machine#
Outside the task worktrees, it writes only these files:
| Files | When |
|---|---|
Task records, stamps, logs, analytics under ~/.pablo/ | as it runs (see Storage); pablo system:prune, daily, removes only agent logs, archived service logs and other versions' caches older than prune.keep_days (10 days by default) |
The rendered agents and the extracted commands and skills, in ~/.pablo/runtime/ | pablo system:generate-agents and pablo system:install; the binary is read-only, so nothing is ever written next to the templates it carries |
The compiled application cache, in ~/.pablo/cache/container/<version>/ | the first run of each binary version (from a checkout: app/var/cache/); pablo system:install removes the other versions' |
One hasTrustDialogAccepted entry per worktree in Claude Code's ~/.claude.json (nothing else in the file) | just before a Remote Control run in that worktree, so Claude Code doesn't stop on "Do you trust this folder?" |
~/.local/bin/pablo (and pablo.previous, the binary the last update replaced), the links in ~/.config/opencode/, ~/.claude/, ~/.copilot/, the scheduler files, the PATH block | only pablo system:install, pablo system:uninstall and pablo update (which replaces the binary with a checksum-verified release, or puts the previous one back with --rollback), never over a file that isn't PABLO's (see Installation) |