Policies
Protect Commit Privacy
Protect Commit Privacy: what it does, its label on each agent, what it misses, and examples.
Catalog policy protect-commit-privacy, version 0.2.6, labelled blocks on Claude Code.
What it does
Keeps the development conversation out of git history. Guard refuses git commit and gh pr create|edit whose message or body (inline -m/-b, -F/--file/--body-file, heredoc on -F -) holds a process-leak marker (session link, 'user asked', ...); commands behind cd, sh -c, sudo, env are read. A commit-msg hook applies the same markers to the recorded message. Narrow deny-list. No waiver: a legitimate phrase needs a person to remove it from MARKERS in the guard; an agent asks the person.
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Blocks | Refuses a matched shell command before it runs |
| Cursor | Blocks | Refuses a matched shell command before it runs |
| Codex | Blocks | Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| GitHub Copilot | Blocks | Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| Devin | Blocks | Refuses a matched shell command before it runs. If the hook errors, the action goes through (vendor docs only, not witnessed) |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
This policy does not state what it misses.
Examples from its eval suite
Refused: An agent commits with a message that narrates who asked for the change.
git commit -m "quick fix because the user asked for it in review"Allowed: An agent commits with a message that describes the change itself.
git commit -m "fix(hooks): emit LF on Windows for generated dispatchers"More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.