agent-guard playground

Your coding agent will eventually run git reset --hard, force-push to main, or drop a table. This is the rule set that stops it. Type a command below; it's evaluated on every keystroke against the same regexes the shell hook uses.

Everything runs locally in your browser. No network requests, no analytics, nothing leaves this page.

Verdicts appear below and are announced to screen readers.

The rules

Every rule, with its regex

Tier 1 is destructive and unrecoverable: never unlockable, no flag lifts it. Tier 2 has a real external effect but is reviewable, so a human can unlock it for a short window that auto-relocks. The free repo ships tier 1; the tier-2 list and the unlock mechanism are the full kit's. Patterns are POSIX ERE matched case-insensitively against the whole command string; this page expands the POSIX classes to their JavaScript equivalents at runtime, so the strings below are byte-identical to the shell config and diff cleanly against it.

The trap this design accepts

The guard matches the whole command string, arguments included. So a commit message that quotes a gated phrase gets blocked, even though nothing destructive would run. Click both of these; only the second one blocks:

One word apart. The pattern needs git, whitespace, reset, so the first message slips through and the second, which happens to spell the command out, does not. The guard has no idea it's inside a quoted string, and that is the point: knowing would mean parsing shell quoting, expansion and eval, and every parser you add is a new way to smuggle a command past the guard. A false positive costs you one reworded commit message. A false negative costs you the repo. The habit that fixes it: git commit -F .commit-msg instead of -m "…".