git-guardrails

name	git-guardrails
description	Set up git safety hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wants to prevent destructive git operations, add git safety hooks, or block git push/reset.

Setup Git Guardrails

Sets up safety mechanisms that intercept and block dangerous git commands before they execute.

What Gets Blocked

• git push (all variants including --force)
• git reset --hard
• git clean -f / git clean -fd
• git branch -D
• git checkout . / git restore .

When blocked, the user/agent sees a message telling them that the operation is not allowed.

Steps

1. Ask scope

Ask the user: install for this project only (local git hooks) or all projects (global git template hooks)?

2. Create the hook script

Create a shell script that checks for dangerous git commands. Save it as:

• Project: .git/hooks/pre-commit or .git/hooks/pre-push (depending on which commands to guard)
• Global: Use git's core.hooksPath to point to a shared hooks directory

For a simple guard that works across platforms, create a script like:

#!/bin/bash
# block-dangerous-git.sh
# Checks if the current command contains dangerous patterns

DANGEROUS_PATTERNS=(
  "git push"
  "git reset --hard"
  "git clean -f"
  "git branch -D"
)

block_check() {
  local cmd="$1"
  for pattern in "${DANGEROUS_PATTERNS[@]}"; do
    if echo "$cmd" | grep -qE "$pattern"; then
      echo "BLOCKED: '$pattern' is not allowed. This operation is restricted for safety." >&2
      exit 1
    fi
  done
}

For agent environments, also create an alias or wrapper that the agent's shell will use. Add to the project's configuration:

• A .env or config file that the agent reads
• Or a Makefile / justfile target that wraps dangerous commands

3. Set up git hooks

For project-level protection, create a pre-push hook:

#!/bin/sh
# .git/hooks/pre-push
# Blocks push operations

echo "BLOCKED: git push is restricted for this project." >&2
exit 1

For global protection, configure git's hooks path:

git config --global core.hooksPath ~/.git-hooks
mkdir -p ~/.git-hooks
# Copy hook scripts there

Make all scripts executable with chmod +x.

4. Alternative: Git Aliases Approach

Instead of hooks, set up safe git aliases that prevent accidents:

git config alias.safe-push "!echo 'Push is blocked. Use --force-push-override if intentional.'"
git config alias.safe-reset "!echo 'Hard reset is blocked.'"

This works on all platforms and doesn't require hook management.

5. Ask about customization

Ask if user wants to add or remove any patterns from the blocked list. Edit the script accordingly.

6. Verify

Test the guard:

# Should be blocked
git push origin main 2>&1 || echo "Guard working correctly"

Should print a BLOCKED message and exit with an error code.