danielvm-git/bigpowers/guard-git

Guard Git

HARD GATE — HARD GATE — Before committing, verify: branch is not main/master, author is correct, git user is configured. Bad commits are hard to fix.

Installs a shared hook that blocks destructive git operations and enforces workflow discipline. Requires `jq` on the agent's PATH when the hook runs.

What gets blocked/enforced

• Safety: git push --force, git reset --hard, git clean -f, git branch -D, git checkout ., git restore ..
• Discipline: Blocks direct commits or pushes to protected branches (main, master) unless GIT_BIGPOWERS_LAND=1 (set only by scripts/land-branch.sh).
• Allows: git push origin <feature-branch> for backup/CI; solo land push to main only inside land-branch.sh.
• Standardization: Enforces Conventional Commits for all git commit commands.
• Secrets: Blocks commits containing common secret patterns (sk-, ghp_, AKIA, xoxb-, -----BEGIN private keys) — see REFERENCE.md.

Quick start

1. Scope: ask project-only vs global (paths differ per product).
2. Write the hook bundle from REFERENCE.md into the client's hooks directory.
3. Run `chmod +x` on pre-tool-use.sh.
4. Merge the hook snippet from REFERENCE.md into the right settings file — do not wipe unrelated keys.
5. Verify with the tests in REFERENCE.md.

Modes (env on the hook command): GIT_GUARDRAILS_MODE is claude (default) or cursor → stderr + exit 2 on block. Set gemini for Gemini CLI → JSON decision on stdout.

Customization

To add or remove patterns or protected branches, edit pre-tool-use.sh.

Advanced

Full JSON examples, merge rules, Antigravity deny-list entries, and test commands: REFERENCE.md.

<!-- story: e01s03 -->