DEV Community: Sandeep Shelke

My own guardrail stopped my coding agent for 70 minutes

Sandeep Shelke — Sat, 24 Oct 2026 19:21:47 +0000

I left a coding agent running unattended: Copilot CLI, headless, in a resume loop. It loaded my gitpro skill on its own, because the skill's description says to use it before committing.

The skill has one rule: before any git commit, run gitpro why to check the identity. On that machine the gitpro CLI was not installed. The skill also says: if it is missing, ask before installing. There was nobody to ask.

So the agent did exactly what it was told. It kept working, checked once more for gitpro, never committed, and ended the run with a note: the identity preflight is unavailable and must not be bypassed. No --no-verify, no install, no commit under a wrong name.

The guardrail worked. It also left about 70 minutes and 55 files of verified work uncommitted, until I re-ran the tests and committed it myself.

What the rule was missing

A path for unattended runs. "Ask the user" is not a rule when nobody is there.
A difference between a local commit and a push. This repo had no remote. A local commit is easy to undo; a push is not.
A difference between blocked and done. The agent finished the run instead of reporting a blocker.

The change I am proposing

In an unattended run without gitpro: allow a local commit in a repo with no remote, when the repo's own user.email is set, and record that the check was skipped. Anything with a remote, or any push, stops and is reported as blocked, not done.

If you write rules for agents, give every "ask first" an answer for when nobody is there. In an unattended run you can't be available, so the decisions it will need have to be recorded beforehand, as part of the skill. This needs better understanding. How do you handle those decisions in your unattended runs?

gitpro: https://gitpro.dev

PS: Written with help from Claude. The experience and the tool are mine.

The cable was fine: overlapping subnets on a two-NIC machine

Sandeep Shelke — Wed, 21 Oct 2026 21:31:16 +0000

While isolating my AI model cluster on its own network segment, I could not reach a host on another network from my lab machine.

I was suspecting a faulty NIC card, a faulty cable, or a wrong connection on the switch in the lab.

AI came in handy to detect it. I asked it to trace why I was not able to reach that host. The machine had two NIC cards, one on my subnet and the other used as a bridge to another subnet. It said the new IP being assigned was from the same subnet as my own. Two networks with overlapping addresses.

So I gave the bridged network its own range.

If you are using a VLAN, ensure that it is isolated and only one of the nodes has the bridge enabled. It could be wired or wireless.

To check quickly: ip -br addr shows each card with its address and prefix. If one range sits inside the other, you have the same problem.

With private AI this matters more. Model servers should sit on their own segment, with one way in and out. I wrote more on why: https://yantrakar.com/self-replication-network-boundary.html

Have you lost time on overlapping subnets?

Written with help from Claude. The experience is mine. Addresses in the pictures are deliberately obfuscated to avoid leaking internals.

Wrong git email again? Pick the identity from the remote URL

Sandeep Shelke — Tue, 20 Oct 2026 15:18:24 +0000

Personal GitHub, work GitHub, GitLab, two Bitbuckets. More than once I committed with the wrong name and email. Sometimes the push was rejected. Sometimes nobody noticed for weeks.

Why `includeIf gitdir` is not enough

It picks the identity by folder. Repos don't always live in the right folder. The remote URL is a better signal: git@bitbucket.org:client/api.git is a client repo wherever it is cloned.

Git can do this itself since 2.36:

[includeIf "hasconfig:remote.*.url:git@bitbucket.org:client/**"]
    path = ~/.gitconfig-client

Add one SSH host entry per account, because GitHub and Bitbucket won't take the same key on two accounts.

Or let gitpro write it

gitpro is a small open-source CLI that writes exactly this: the includeIf blocks and the SSH entries, in a marked block, backed up first. No daemon, no git wrapper.

pipx install gitpro
gitpro setup   # preview, then confirm once
gitpro why     # which identity this repo should use, and the fix
gitpro scan    # find repos that override it

scan found one old repo of mine with its own user.email that ignored everything. scan --fix removed it.

Coding agents commit as whoever git says you are, so there is also a Claude Code hook that blocks a wrong-identity commit or push.

Linux and macOS, MIT: github.com/Yantrakar/gitpro

Written with help from Claude. The experience and the tool are mine.