irreversible-command-gate

irreversible-command-gate (icg) is a small Rust guard meant to sit in an AI coding agent's harness hook and catch the handful of actions that cannot be undone — deleting a secret, force-pushing over history, printing a credential into the transcript, purging a Docker volume — while every other tool call passes through untouched. It plugs into a harness's PreToolUse hook: one JSON document in, one decision envelope out. The project documentation describes it as a backstop for an honest, fallible agent rather than a security boundary against a hostile one. How it works. A tool call is dispatched to rule packs by tool keyword. Safe patterns are tried first and short-circuit; among guarded patterns the first match wins. That ordering is what keeps ordinary read-only work quiet, because a rule only fires on input no safe pattern claimed. The engine is deterministic and performs no network I/O. It fails open by design: an empty pack directory, an unrecognised tool, or a crashed check all allow the command, on the reasoning that a missed violation is recoverable while a wedged agent fleet is not. The README reports a median check cost of roughly 10 ms on a warm cache, and notes a graduated fail-closed policy exists for use once a release has proven itself. Four verdicts, one per redirect channel a rule can declare, and only deny actually stops the command: allow (no rule matched, or a safe pattern matched first), warning (allow plus additional context when the rule cannot decide reliably enough to block), rewrite (allow plus updated input, so the harness retries with a safe form of the same intent), and deny (the reason carries the alternative course of action). What ships. The published packs include openbao (kv destroy, metadata delete, mount and policy deletion, operator rekey, secret literals in argv, secret reads to stdout), git (bare credential fill, force push rewritten to a plain push, commits without a pathspec, pushing over a stale remote head), secrets (GitHub tokens and PATs, AWS keys, Slack tokens, Anthropic keys, PEM private-key blocks, matched in commands and in file content), docker (system prune --all, volume rm, image rm --force), image-tag, storage-class, plus beads, misc, tmux and argocd-topology, which encode fleet-local convention. The documentation marks each pack as general or fleet-specific and names every rule id. Pack scaffolding is provided through a new-pack command that writes a pack and its regression test together, and a release gate builds a deny-regression corpus to report rules that stopped covering what they used to. Install and use. The binary can be built from source with only a Rust toolchain, or fetched as a release asset. An install script places the binary and packs root-owned and registers the hook; it deliberately proves enforcement by sending a known-destructive command through the hook and refusing to report success unless the command comes back denied, because a half-finished install would otherwise behave exactly like a working one. Dry-run and uninstall options are available. The human-facing check command always exits zero, so its output rather than its status is what should be parsed. Stated limitations. The README is explicit that icg does not defend against prompt injection or a malicious repository, does not know who is calling (no identity, TTY or privilege check), does not reach cloud-hosted agent sessions such as ChatGPT web, Codex cloud tasks or claude.ai, and does not cover kubectl mutations, workflow files or Kubernetes Job and CronJob objects, which are left to separate org-level enforcement. An environment variable can disable the guard; it is audited rather than restricted, so an agent can set it as easily as a user can. The update flow's trust-pointer transition has not been exercised end to end and is described as unproven. Status. The README states the engine, the packs, both front-ends (hook and PATH wrapper), release-integrity machinery and 526 passing tests across 52 files are working, in a crate of about 25,800 lines of Rust with 17 dependencies and no C toolchain requirement. It names v0.1.4 as the current release and describes v0.1.3 as the release to upgrade from, since it closed a guard bypass in which an apostrophe in a heredoc body caused the lexer to lose the rest of the command. The repository is an MIT-licensed read-only mirror of a self-hosted git instance.