Overhand Beta
Menu
Solo Studios Teams Makers Docs Pricing GitHub Sign in
Install Get notified

Docs

The guard

What it stops before it runs, and how it reaches each agent.

Checked before it runs.

  • One set of rules Every agent with a hook runs the same guard, set up per run from Overhand's own folder. Your own config for each agent stays as it is.
  • What it blocks Blocks merges, force pushes, deploys and production secrets, in Claude Code, Codex and OpenCode. The whole list is under the hood.
  • Its own off switch It also blocks changes to Overhand itself and to an agent's project settings, which could turn the guard off for the next run, even when a ticket asks.
  • It fails closed A guard that can't start blocks the call.
  • Your processes Ports, process names and containers you list in governor.protect can't be stopped or restarted by an agent.

How it reaches each agent.

  • Aider It has no hook for the guard, and secret files are kept out of its reach. It runs no shell commands. Confirmed in a real run, on aider 0.86.2 (local qwen3:1.7b): asked to run gh pr merge 1, it ran nothing.
  • Claude Code Through a hook on every tool call. Confirmed in a real run, on 2.1.309: it blocked gh pr merge 1 --squash.
  • Codex Through a hook on every shell command, file edit and MCP call, inside its workspace sandbox. Confirmed in a real run, on codex-cli 0.163.0 (local qwen3:1.7b): it blocked gh pr merge 1.
  • Cursor Agent Through a plugin whose hooks see every shell command, file read, edit and MCP call. Set up, not yet confirmed in a real run.
  • Gemini CLI Through a hook on every tool call, from a Gemini home of Overhand's own (it runs on an API key). Set up, not yet confirmed in a real run.
  • OpenCode Through a plugin that sees every tool call. Confirmed in a real run, on 1.19.4 (local qwen3:1.7b): it blocked gh pr merge 1.

Each account in Settings → Agent accounts says where its agent stands.

What it can't do.

  • A program's next step A hook sees the command an agent asks for, not what a script or program it runs does next; a determined agent can hide a step there.
  • So keep tokens small Give agent accounts credentials that can't do damage anyway: no admin or deploy rights, and branch protection on your repos.
  • See what it stopped Guardrails, in Health, lists each attempt it blocked in the last day, with its time and rule.