Open-source guardrail
Block git force-push
AgentTrail Guard blocks this by default: the call never runs, and your coding agent is told which guardrail stopped it.
- Default action
- Block
- Severity
- High severity
- Library version
- 0.2.1 · Sep 29, 2026
What it does
What it catches, and what it misses
Written into the rule itself, next to what it matches, so you can judge it before you trust it.
Overwrites a remote branch's history, destroying commits other people may already have pulled. The command must contain git push and the force flag must sit in the same pipeline segment, so searching for the phrase is not blocked. A global flag between git and push is tolerated (git -C <dir> push --force, git --no-pager push …), and an absolute tool path such as /usr/bin/git still matches. The safer --force-with-lease form IS still blocked; exempting it needs a negative lookahead this corpus does not use. MISSES an alias such as git pf, and a force-push issued by a wrapper script whose own text does not say git push. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.
Examples
Tested on every build
The rule must match every command on the left and none on the right, or the library does not build. Catching the real thing is easy; staying quiet on the near-miss is the hard part.
Catches (7)
- git push origin main --force
- git push --force origin main
- git push -f origin feature/x
- git push origin main --force-with-lease
- git -C /repo push --force origin main
- git --no-pager push --force
- /usr/bin/git push -f origin main
Stays quiet on (8)
- git commit -m "docs: explain git push origin main --force"
- grep -rn "git push origin main --force" docs/
- echo "never run git push origin main --force"
- curl --data "we ran git push origin main --force" https://api.example.com/comments
- git push origin main
- git push --tags
- grep -rn 'push -f' .
- git push --set-upstream origin feature/x
In your agent
What "block" means in each app
The guard runs as a hook in each app, and each app gives a hook different powers. Here is what this rule's default action does in each one.
- Claude Code
- The call never runs, and the agent is told which guardrail stopped it.
- Cursor
- The call never runs. Cursor shows no reason of its own, so the agent retells the guardrail's message in its own words.
- Codex CLI
- The command never runs, and Codex prints the guard's reason on screen.
Each app hands the guard a different set of calls: in a Cursor sandbox run mode, for one, some terminal commands run without reaching the guard at all. Read the notes for Cursor and for Codex CLI before you rely on a rule there.
Make it yours
Change what it does in one command
Turn it off, change its action, or silence it on one command shape. The narrow one is allow: the rule keeps catching everything else.
Run it locally
Put these guardrails in front of your agent.
AgentTrail Guard is free and open source. It checks every command and file change against the whole library before your agent runs it, on your machine, with no account.
npm i -g @agenttrail/guard