Open-source guardrail

git branch -D force-deletes an unmerged branch

AgentTrail Guard asks you about this by default: you decide before the call runs. Where an agent cannot ask, the call is refused instead.

Default action
Ask
Severity
Medium severity
Library version
0.2.1Sep 29, 2026

What it catches, and what it misses

Written into the rule itself, next to what it matches, so you can judge it before you trust it.

Deletes a branch even when its commits are not merged anywhere, so the work becomes unreachable. This rule is CASE-SENSITIVE on purpose and that is why it uses detail_contains: -D force-deletes while -d refuses to delete unmerged work, and the engine's regex matcher is case-insensitive, so a regex here would fire on the safe spelling every time a developer cleans up after a merge. Known miss: the flags written separately as --delete --force in the reverse order, and any alias. The git branch anchor tolerates repeated or tab whitespace and a global flag in between (git branch -D …, git -C <dir> branch -D …), and an absolute tool path such as /usr/bin/git still matches, while -D stays a case-sensitive substring so the safe -d is not caught. A quoted MENTION is not a use: a search, a git commit -m message, an echo or a curl --data body that only names this command is left alone. That holds only while every shell metacharacter stays inside the quotes, so git commit -m "x" && … is still caught; and the carrier must be the first word, so sudo grep … is not exempt.

Tested on every build

The rule must match every command on the left and none on the right, or the library does not build. Catching the real thing is easy; staying quiet on the near-miss is the hard part.

Catches (6)

  • git branch -D feature/abandoned
  • git branch --delete --force feature/abandoned
  • git branch -D feature/a feature/b
  • git branch -D feature/double-space
  • git -C /repo branch -D feature/abandoned
  • git --no-pager branch --delete --force feature/abandoned

Stays quiet on (8)

  • git commit -m "docs: explain git branch -D feature/abandoned"
  • grep -rn "git branch -D feature/abandoned" docs/
  • echo "never run git branch -D feature/abandoned"
  • curl --data "we ran git branch -D feature/abandoned" https://api.example.com/comments
  • git branch -d merged-feature
  • git branch -a
  • git branch --show-current
  • mvn -DskipTests package

What "ask" means in each app

The guard runs as a hook in each app, and each app gives a hook different powers. Here is what this rule's default action does in each one.

Claude Code
You are asked before the call runs. If your settings.json already allows the tool outright, Claude Code runs it with no prompt.
Cursor
A terminal command that reaches the guard gets Cursor's approval card. Any other call that needs approval, such as a file edit or a read, is refused, because Cursor cannot ask there.
Codex CLI
Codex cannot ask, so the call is refused, and the reason says a person has to approve it.

Each app hands the guard a different set of calls: in a Cursor sandbox run mode, for one, some terminal commands run without reaching the guard at all. Read the notes for Cursor and for Codex CLI before you rely on a rule there.

Change what it does in one command

Turn it off, change its action, or silence it on one command shape. The narrow one is allow: the rule keeps catching everything else.

agenttrail-guard
$agenttrail-guard guardrails show wt.branch-force-delete# everything about it
$agenttrail-guard guardrails set-action wt.branch-force-delete warn# block, ask or warn
$agenttrail-guard guardrails allow wt.branch-force-delete '<pattern>'# silence one shape
$agenttrail-guard guardrails disable wt.branch-force-delete# turn it off

Put these guardrails in front of your agent.

AgentTrail Guard is free and open source. It checks every command and file change against the whole library before your agent runs it, on your machine, with no account.

bash
$npm i -g @agenttrail/guard
Read the source on GitHub