dev-guardrails

Most safety guidance for coding agents is prose the model may or may not follow. This is the other kind.

The blocking half runs on PreToolUse and blocks exactly what is unrecoverable. pre-bash parses every shell call and denies it if it would print a secret into the transcript, publish a credential in a pull request body, do irreversible damage to git state (push --force, reset --hard in a dirty tree, checkout -- .), delete unrecoverably outside the ephemeral whitelist, or commit with a first line that is not a Conventional Commit. pre-write-edit denies a write whose content carries a vendor token or private key — obvious placeholders pass, so the gate does not block its own documentation — and denies a write whose path is inside an installed plugin cache copy, where the edit would appear to work and then be destroyed by the next plugin update. pre-mcp-tool denies an MCP call that would publish a credential to a durable surface.

The reporting half is everything else: session context, static analysis on a file just written, credential redaction from command output. None of it blocks, because a PostToolUse hook fires after the fact and a block there stops the next step while leaving the damage exactly as it is.

Reach for it on any repository where an agent has a real shell and real credentials.