[bel8]

For open-source agents, like https://pi.dev, it is as easy as asking it to create a plugin to stop the session or ask for permission whenever the LLM is trying to execute a commit command. I believe Claude and Codex also suport plugins. Codex is open-source too.

Then you add one line in AGENTS.md stating the LLM should never commit, push or perform any write git operation without explicitly being asked to.

So in the very rare case that the LLM bypass your instruction, you catch it red-handed and stop the session or allow it.

I always make the plugin stop the session because LLMs tend to try to circunvent textual block messages by doing nifty things like concatenating characters to build a bash script to execute the git commit command. Yes, I have seen it.