Push Guard

blockingstable

Blocks force-pushes to protected branches (default: main). Two enforcement paths: (1) PreToolUse — intercepts 'git push --force' in AI tool Bash calls; (2) wrapper mode — intercepts every git push when git is aliased to the ai binary. Blocking on the force-push path; non-blocking sentinel on the unpushed-to-protected path.

ID hook/push-guardVersion 1.0.0Author convergent-systems-key

ai hooks run push-guard

EventPreToolUseLanguagepythonTriggertool-name — BashSide effects

blocks force-push to protected branches with a deny decision
emits PUSH-GUARD-VIOLATION sentinel to stderr for unblocked violations

linuxmacoswindowsRequires git. PreToolUse path parses the Bash command from stdin JSON. Wrapper mode reads WRAPPED_ARGV. Protected branches read from ~/.ai/settings.json (key: protectedBranches) with a default of ['main']. Cross-platform via 'ai hooks run'.

gitgovernancebranch-protectionclaude-code

Attribution: convergent-systems-key.