My coding agent almost wiped my git repo. Here's what I built to stop it.

Recently, I made the mistake of trusting an autonomous coding agent with full terminal permissions on a personal open-source project.

I had over a dozen failing unit tests. Instead of fixing them manually, I ran an agent script, told it to "fix all failing tests", and walked away.

When I came back to check on the terminal, I was greeted by pure chaos:

1. An 18-turn edit-revert loop: The agent had changed a function in auth.py, broke another test, panicked, reverted its own change, re-broken the first test, and kept oscillating in a circle for over an hour.
2. Context window asphyxiation: It ran a failed command that dumped a 3,800-line node_modules stack trace into stdout. The agent got completely confused by the wall of noise, hallucinated a fake Python package that didn't exist (reqeusts-fast), and burned through API tokens trying to install it.
3. The near-fatal blow: The agent eventually decided the easiest way to resolve a git conflict was to execute git reset --hard. The only reason days of uncommitted personal work wasn't vaporized was because a Windows file lock threw an unrelated permission error.

I closed my laptop and realized something obvious:

Every command-line tool we use today was built for human eyeballs.

They output colored text, ASCII spinners, and thousands of lines of verbose logs. When you put an AI agent into that environment, it gets overwhelmed, hallucinates fake solutions, and eventually tries to burn the house down to fix a leaky faucet.

I didn't need another generic AI coding assistant. I needed an armored seatbelt for the agents already running on my machine.

So I upgraded git-oops into a dual-mode terminal harness.

---

What It Actually Does

Instead of letting an agent run wild with raw bash, git-oops acts as a protective layer between the agent and your repository.

It runs in two distinct modes:

• For Humans: You get cynical code reviews from an angry Hell's Kitchen Chef or an exhausted Staff Engineer, visual terminal diff cards, and a 1-click [y] patch prompt.
• For Agents (--agent / --mcp): It cuts all ANSI colors, speaks pure JSON, and enforces physical safety rules.

Here are the 4 safeguards that saved my sanity:

---

1. The Blast-Radius Firewall (src/firewall.py)

Agents have zero common sense about physical destruction. If an agent thinks running rm -rf / or git reset --hard HEAD~10 is the fastest way to pass a test, it will do it without hesitation.

git-oops intercepts destructive shell commands before they hit your system:

git-oops --run "rm -rf /var/data"

Output:

{
  "status": "BLOCKED",
  "reason": "FIREWALL_BLOCKED: Destructive root/wildcard deletion pattern matched."
}

It also blocks hallucinated package installations (like typosquatted pip packages) before an agent accidentally downloads malware onto your computer.

---

2. The Anti-Thrashing Watchdog (src/watchdog.py)

Watching an agent oscillate is painful. It touches lines 20-30, breaks line 80, undos its change, touches lines 20-30 again, and burns through your personal API balance.

git-oops tracks the SHA-256 hash of proposed changes per file. If an agent proposes the same or reverse patch 3 times, the watchdog steps in:

{
  "error": "ANTI_THRASHING_HALT",
  "message": "Agent is caught in a loop modifying 'auth.py'. Same patch proposed 3 times. Step back and re-architect."
}

It physically breaks the loop, wakes the agent up, and tells it to stop touching that file.

---

3. Log Squeezer & Secret Redactor (src/squeezer.py)

Dumping a 4,000-line terminal traceback into an LLM context window is burning money. Most of it is internal library plumbing that doesn't matter.

git-oops strips away the garbage:

• It eliminates standard library and node_modules frames.
• It isolates the exact Leaf Frame where the crash actually happened.
• It scans for any stray API keys, AWS credentials, or Bearer tokens and replaces them with <REDACTED_SECRET> before any model sees them.

A 3,800-line crash dump shrinks down to 18 lines of pure signal. Your agent stays focused, and you save 90% of your token costs.

---

4. 0ms Polyglot Ghost-Import Linter (src/guardian.py)

Ever had an agent fix a bug by importing a library that doesn't exist?

Before any patch is written to disk, git-oops runs zero-overhead AST syntax validation across Python, JS/TS, Go, Rust, Java/Kotlin, C/C++, PHP, Ruby, .NET (C#/F#/VB), Swift, Dart, Lua, Shell, and beyond. If the agent tried to import a non-existent or uninstalled module, the patch is rejected immediately:

{
  "error": "GHOST_IMPORT_REJECTED",
  "details": "GHOST_IMPORT_DETECTED: Agent hallucinated non-existent module 'magic_utils'."
}

No broken production files. No ghost dependencies. Works across whatever language you write in.

---

Native MCP Support (Claude Desktop, Cursor, Antigravity)

You don't need any special wrapper scripts to use this. git-oops natively speaks Model Context Protocol (MCP) over standard I/O.

To plug it into Claude Desktop, add this to your claude_desktop_config.json:

{
  "mcpServers": {
    "git-oops": {
      "command": "git-oops",
      "args": ["--mcp"]
    }
  }
}

Or point your Cursor / Windsurf / Antigravity MCP settings to git-oops --mcp.

Now when your agent writes code or runs tests, it runs through the git-oops harness automatically.

---

Still There When You Just Need a Quick Fix

If you're not using agents and just broke your own Python script while hacking:

git-oops --file broken.py --error "KeyError: 'user_id'"

It still gives you the funny roasts, the clean visual diffs, and the hard \$1.00 daily circuit breaker so you never get hit with a surprise bill. And if you don't like the fix? git-oops --undo broken.py reverts it in 1 second.

---

100% Local & Privacy-First (Zero Telemetry)

I hate developer tools that secretly phone home.

• Strictly Local: The firewall, anti-thrashing watchdog, token squeezer, and AST linters execute 100% locally on your machine.
• Zero Telemetry: No user analytics, no tracking pixels, and zero remote logging.
• Your Data Stays on Your Machine: The flight recorder, shadow workspace, and antibody DB live entirely inside ~/.git_oops/ in your local user directory.

---

Check It Out

The project is completely free, open-source, and has zero heavy C-dependencies:

👉 GitHub Repository:

Hao610 / git-oops

Turn terminal crashes into 1-click git patches. Roasted by a staff engineer, protected by a $1 API circuit breaker.

⚡ git-oops

The Dual-Mode Terminal Crash Fixer & Autonomous AI Agent Safety Harness.

Human Mode: Roasted by a Staff Engineer │ Agent Mode: The Headless Shield for Coding Agents

---

😤 Why git-oops?

For Humans:

Your script crashes with a 50-line traceback. You're exhausted, and ChatGPT gives you a polite 6-paragraph email instead of a 2-line fix. git-oops roasts your sloppy code with razor-sharp wit and applies a surgical 1-click git patch directly in your terminal.

For AI Coding Agents (Claude, Cursor, Windsurf, Codex, Devin):

Modern autonomous coding agents face catastrophic failure modes:

1. Context Bloat: Multi-thousand line terminal dumps overflow agent context windows.
2. Infinite Thrashing: Agents get trapped in loops editing and reverting the same code.
3. Ghost Hallucinations: Agents import non-existent libraries or fall into typosquatted package traps.
4. Blast-Radius Disasters: Agents accidentally execute rm -rf or destructive force-pushes.

git-oops provides the missing runtime safety harness that shields…

View on GitHub

👉 Release v0.2.0: https://github.com/Hao610/git-oops/releases/tag/v0.2.0

# Install locally
git clone https://github.com/Hao610/git-oops.git
cd git-oops
pip install -e .

# Run the 20 test suites
pytest tests -v

Have you ever had an autonomous agent go rogue in your terminal? How did you clean up the mess? Let's talk in the comments below!

Comments

[Max Quimby]

"Context window asphyxiation" is a great name for a failure I've watched happen more than once — a single command dumps a 3,800-line stack trace and the agent's judgment just dissolves in the noise. Structuring and truncating tool output is one of the most underrated safety levers there is; a tool that returns "187 failures, here are the 3 distinct root errors" instead of the raw wall changes the agent's behavior completely, before any firewall is involved.

The 18-turn edit-revert oscillation is the one I'd dig into most. How does the watchdog decide it's a loop versus slow-but-real progress? We've had reasonable luck hashing the (file, diff) pairs and tripping when the same state recurs N times, but it's fragile — the agent makes a cosmetically different edit that's semantically the same and the hash misses it. Curious whether git-oops keys on the command, the resulting tree state, or something about the test outcomes. And did you consider snapshotting to a shadow ref before any reset --hard rather than blocking it outright?

[Oleksandr]

The anti-thrashing watchdog is the piece I haven't seen anywhere else, and it's solving the most expensive failure mode. An agent that oscillates is burning tokens and your trust in the tool, and "same patch proposed three times" is a clean signal that it has no model of the problem.

One question about the firewall: how are you handling compound commands? rm -rf ./build is usually fine, rm -rf / is not, but curl ... | bash or a script that internally does a git reset won't match a pattern — does the harness intercept at the shell level, or is it catching what it can and trusting the rest?

Also genuinely nice to see zero telemetry on something that has to sit between an agent and a repo. That's the right default for a tool this invasive.