Guard Git

HARD GATE — HARD GATE — Before committing, verify: branch is not main/master, author is correct, git user is configured. Bad commits are hard to fix.

Installs a shared hook that blocks destructive git operations and enforces workflow discipline. Requires jq on the agent's PATH when the hook runs.

What gets blocked/enforced

• Safety: git push --force, git reset --hard, git clean -f, git branch -D, git checkout ., git restore ..
• Discipline: Blocks direct commits or pushes to protected branches (main, master) unless GIT_BIGPOWERS_LAND=1 (set only by scripts/land-branch.sh).
• Allows: git push origin <feature-branch> for backup/CI; solo land push to main only inside land-branch.sh.
• Standardization: Enforces Conventional Commits for all git commit commands.
• Secrets: Blocks commits containing common secret patterns (sk-, ghp_, AKIA, xoxb-, -----BEGIN private keys) — see REFERENCE.md.

Quick start

1. Scope: ask project-only vs global (paths differ per product).
2. Write the hook bundle from REFERENCE.md into the client's hooks directory.
3. Run chmod +x on pre-tool-use.sh.
4. Merge the hook snippet from REFERENCE.md into the right settings file — do not wipe unrelated keys.
5. Verify with the tests in REFERENCE.md.

Client	Mechanism	Config
Claude Code	PreToolUse (Bash)	.claude/settings.json or ~/.claude/settings.json
Cursor / Cursor CLI	beforeShellExecution	.cursor/hooks.json or ~/.cursor/hooks.json
Gemini CLI	BeforeTool + run_shell_command	.gemini/settings.json or ~/.gemini/settings.json
Google Antigravity	Built-in Terminal Deny list	Settings UI (no shell hook)

Modes (env on the hook command): GIT_GUARDRAILS_MODE is claude (default) or cursor → stderr + exit 2 on block. Set gemini for Gemini CLI → JSON decision on stdout.

Customization

To add or remove patterns or protected branches, edit pre-tool-use.sh.

Advanced

Full JSON examples, merge rules, Antigravity deny-list entries, and test commands: REFERENCE.md.