Git gate
46 allow
60 ask
0 block
Read-only history and inspection commands pass through. Anything that writes to the tree, the index, or a remote pauses for approval. git is never hard-blocked from this gate. The dangerous floor lives in the filesystem rules and the pre-AST raw-string pass.
Showing all 106 rules.
Allowed · read-only
rules/git.toml#allow 46 patternsgit status
Allow
Shows the working tree status: staged, unstaged, and untracked files. Read-only.
git log
Allow
Shows commit history. Read-only.
git diff
Allow
Shows changes between commits, the working tree, and the index. Read-only.
git show
Allow
Shows a commit, tag, or other object and its contents. Read-only.
git tag
Allow
Lists tags when no mutating flag is given. Read-only in this form; creation and deletion flags are gated separately.
git describe
Allow
Names a commit using the nearest reachable tag. Read-only.
git rev-parse
Allow
Resolves refs and arguments to object names. Read-only.
git ls-files
Allow
Lists files tracked in the index. Read-only.
git blame
Allow
Shows the commit and author that last touched each line of a file. Read-only.
git reflog
Allow
Shows the history of ref updates such as HEAD movements. Read-only.
git shortlog
Allow
Summarizes commit history grouped by author. Read-only.
git whatchanged
Allow
Shows commit history along with the files each commit changed. Read-only.
git ls-tree
Allow
Lists the contents of a tree object. Read-only.
git cat-file
Allow
Prints the type, size, or contents of a repository object. Read-only.
git rev-list
Allow
Lists commit objects in reverse chronological order. Read-only.
git name-rev
Allow
Names commits by their position relative to refs. Read-only.
git for-each-ref
Allow
Lists refs matching a pattern, with a customizable format. Read-only.
git symbolic-ref
Allow
Reads a symbolic ref such as HEAD. Read-only when no value is given; writes are gated separately.
git verify-commit
Allow
Checks the GPG signature on a commit. Read-only.
git verify-tag
Allow
Checks the GPG signature on a tag. Read-only.
git fsck
Allow
Checks repository objects for connectivity and integrity. Read-only.
git count-objects
Allow
Reports the count and on-disk size of repository objects. Read-only.
git check-ignore
Allow
Reports which paths are ignored and the matching gitignore rule. Read-only.
git check-attr
Allow
Reports the gitattributes values applied to given paths. Read-only.
git grep
Allow
Searches tracked file contents for a pattern. Read-only.
git merge-base
Allow
Finds the common ancestor of two or more commits. Read-only.
git show-ref
Allow
Lists refs and the object names they point to. Read-only.
git help
Allow
Shows Git help text for a subcommand. Read-only.
git version
Allow
Prints the installed Git version. Read-only.
git --version
Allow
Prints the installed Git version. Read-only.
git -h
Allow
Shows short usage help. Read-only.
git --help
Allow
Shows full help text. Read-only.
git branch
Allow
Lists or creates branches. Read-only when listing; delete, move, and copy flags are gated separately.
git config get
Allow
Reads a Git configuration value. Read-only.
git config list
Allow
Lists Git configuration values. Read-only.
git config --get
Allow
Reads a Git configuration value. Read-only.
git config --list
Allow
Lists Git configuration values. Read-only.
git stash list
Allow
Lists stash entries. Read-only.
git stash show
Allow
Shows the diff recorded in a stash entry. Read-only.
git worktree list
Allow
Lists the linked worktrees of this repository. Read-only.
git submodule status
Allow
Reports the status and checked-out commit of each submodule. Read-only.
git remote
Allow
Lists configured remotes. Read-only when listing; add, remove, rename, and set-url are gated separately.
git remote show
Allow
Shows details about a remote, including its tracked branches. Read-only network query.
git remote -v
Allow
Lists remotes with their fetch and push URLs. Read-only.
git remote get-url
Allow
Prints the URL of a remote. Read-only.
git fetch
Allow
Downloads refs and objects from a remote. Does not modify the working tree or current branch.
Asks first · writes
rules/git.toml#ask 60 patternsgit gc
Ask
Runs garbage collection in
.git. Repacks objects and may prune unreachable commits older than the gc grace window.git prune
Ask
Deletes unreachable objects from
.git. Cannot be recovered without a backup or reflog entry still pointing at them.git config set
Ask
Sets a git config value.
--local scopes to this repo; --global affects all repos for the user.git config --add
Ask
Adds a git config entry.
--local for this repo, --global for user-wide.git config --unset
Ask
Removes a git config entry. Permanent for the chosen scope.
git stash drop
Ask
Drops a stash permanently. Run
git stash list first to confirm the index; cannot be undone.git stash pop
Ask
Applies the top stash and removes it. Use
git stash apply if you want to keep the stash entry.git stash clear
Ask
Clears ALL stashes permanently. List with
git stash list first; cannot be undone.git stash push
Ask
Saves working-tree changes to a new stash entry.
git stash apply
Ask
Applies a stash entry without removing it from the stash list.
git worktree add
Ask
Creates a new linked worktree checkout. Writes a new directory and registers it in
.git/worktrees/.git worktree remove
Ask
Removes a worktree directory. Refuses if it has uncommitted changes unless
--force.git worktree prune
Ask
Prunes stale worktree references that no longer point to a real directory.
git submodule foreach
Ask
git submodule foreach runs an arbitrary shell command per submodule. Treat the command as if invoked directly.git submodule init
Ask
Registers submodules from
.gitmodules into the local repo config. Does not fetch content; pair with submodule update.git submodule update
Ask
Fetches and checks out submodule commits recorded in the superproject. Can overwrite local submodule edits unless
--merge/--rebase is set.git submodule add
Ask
Adds a new submodule entry to
.gitmodules and clones the remote repo into the tree.git submodule deinit
Ask
Unregisters submodules and clears their working tree. Use
--force to drop uncommitted submodule changes.git remote add
Ask
Registers a new remote URL under the given name. Subsequent fetches/pushes will trust this endpoint.
git remote remove
Ask
Removes a remote and its tracking refs from this repo. Does not affect the remote server.
git remote rename
Ask
Renames a remote and rewrites tracking-branch refs to use the new name.
git remote set-url
Ask
Changes the URL of an existing remote. Future fetches/pushes will hit the new endpoint.
git push --force -f
Askwarn
Force push overwrites upstream history. Safer:
--force-with-lease fails if the remote moved.git reset --hard
Askwarn
Hard reset discards uncommitted changes in the working tree and index. Safer:
git stash first, or git reset --soft to keep changes staged.git clean -fd -fdx -f
Askwarn
Permanently deletes untracked files. Preview with
-n (dry run) first; deletions cannot be undone.git commit
Ask
Records staged changes as a new commit on the current branch.
git push
Ask
Publishes local commits to a remote. Inspect
git log @{u}.. first to see what would be sent.git pull
Ask
Fetches and integrates remote changes into the current branch. Use
--rebase to avoid merge commits.git merge
Ask
Merges another branch into the current one. Can produce conflicts; abort with
git merge --abort.git rebase
Ask
Replays commits from the current branch onto another base, rewriting their SHAs. Interactive (
-i) hangs the agent; abort a stuck rebase with git rebase --abort.git checkout -b -B
Ask
Creates a new branch and switches to it.
-B resets an existing branch of the same name to the start point.git checkout --
Ask
Discards uncommitted changes in the listed paths. Cannot be undone.
git checkout
Ask
Switches branches or restores files in the working tree. Uncommitted edits in affected files may be lost.
git switch
Ask
Switches the working tree to another branch. Refuses if local edits would conflict unless
--discard-changes is set.git reset
Ask
Moves HEAD and optionally the index/working tree.
--soft keeps changes staged, --mixed (default) unstages, --hard discards.git restore
Ask
Restores files in the working tree from the index or a commit. Overwrites uncommitted edits in the targeted paths.
git clean
Ask
Cleans the working tree. Preview with
-n first if unsure what would be deleted.git cherry-pick
Ask
Replays the listed commits on the current branch. May produce conflicts; abort with
git cherry-pick --abort.git revert
Ask
Creates a new commit that undoes the listed commits. Preserves history; does not rewrite it.
git am
Ask
Applies a mailbox patch series as commits. Stops on conflict; resolve and
git am --continue.git apply
Ask
Applies a patch to the working tree (no commit created). Use
--check to preview without writing.git format-patch
Ask
Writes one
.patch file per commit in the specified range. Output goes to the working directory.git init
Ask
Creates a new git repository in the current directory. Writes a
.git/ directory.git clone
Ask
Clones a remote repository into a new directory. Network operation; size depends on remote history.
git fetch --force -f --prune -p
Ask
Fetch that rewrites local refs:
--force allows non-fast-forward updates to remote-tracking branches, --prune deletes the ones whose upstream is gone.git mv
Ask
Moves or renames a tracked file and stages the rename in one step.
git rm
Ask
Removes a tracked file from the working tree and stages the deletion.
--cached keeps the file on disk.git tag -a --annotate -s --sign -u --local-user -m --message
Ask
Creates a tag pointing at the named commit (HEAD by default). Local only until
git push --tags.git tag -d --delete
Ask
Deletes a local tag. Use
git push --delete <remote> <tag> separately to delete it on the remote.git tag -f --force
Ask
Force-replacing a tag breaks anyone who already pulled it. Confirm no downstream consumers.
git branch -d -D --delete
Ask
Deletes a branch ref.
-d refuses if the branch has unmerged commits; -D forces the delete regardless. Recover via git reflog if done by mistake.git branch -m -M --move
Ask
Renames a branch.
-M forces the rename even if it would overwrite an existing branch name.git bisect
Ask
Starts a binary-search session over commit history. Mutates HEAD across iterations; end with
git bisect reset.git filter-branch
Ask
Rewrites commit history. Safer alternatives:
git revise --autosquash for fixups, git absorb for auto-folding edits. git-filter-repo is the maintained replacement for filter-branch.git filter-repo
Ask
Rewrites commit history. Refuses to run on non-fresh clones; use
--force only with intent.git notes
Ask
Adds, edits, or removes notes attached to commits. Stored in
refs/notes/*; not shown in default git log.git bundle
Ask
Creates or unpacks a git bundle file (offline-transportable pack of refs and objects).
git maintenance
Ask
Runs repo maintenance tasks (gc, commit-graph, prefetch, loose-objects). Modifies
.git/ in the background.git sparse-checkout
Ask
Modifies sparse-checkout config. Changes which files are materialized in the working tree.
git worktree
Ask
Worktree operation. See
git worktree --help for subcommand-specific risk.
Hard blocks live in other gates. The git gate never denies outright. A pattern like curl … | bash is caught by the pre-AST raw-string pass before any gate runs. Destructive filesystem patterns like rm -rf / are denied in filesystem.toml.