vibeguard

VibeGuard

The firewall between AI coding agents and your codebase.

Native rules + real-time hooks + static guards that stop Claude Code, Codex CLI, and Gemini CLI from shipping hallucinated, duplicated, or unverified changes — before they land.

git clone https://github.com/majiayu000/vibeguard.git ~/vibeguard
bash ~/vibeguard/setup.sh --yes
bash ~/vibeguard/setup.sh verify-install

Open a new Claude Code or Codex session after install — protection is active from the first prompt. On supported macOS/Linux targets the production install/check/clean path is Python-free and uses a checksum-verified prebuilt runtime binary. Python still supports evals, docs generation, developer tools, and optional language-specific guard packs. Full install details live in Installation and Quickstart.

What it intercepts:

• Duplicate files and reinvented modules
• Invented APIs, fake libraries, and hardcoded placeholder values
• Dangerous shell/git operations (rm -rf dangerous paths, git clean -f, non-fast-forward pushes)
• Audited cleanup for intentional local discards, with exact path plans and confirmation gates
• Analysis paralysis and unverified "I'm done" claims
• Silent exception swallowing and Any-type abuse
• AI-slop patterns flagged on every commit

Every interception returns a fix instruction, not just a failure — so the agent can self-correct.

Chinese Docs · Quickstart · Team Rollout · Troubleshooting · Rule Reference · Contributing

Start Here

First 5 minutes

These commands prove the install is active before changing another project; expected outputs are documented in Quickstart:

bash ~/vibeguard/setup.sh doctor
bash ~/vibeguard/setup.sh verify-install
bash ~/vibeguard/scripts/doctors/codex-doctor.sh
bash ~/vibeguard/setup.sh demo safe-bash
bash ~/vibeguard/scripts/hook-health.sh 24

To protect another repository after VibeGuard is installed:

bash ~/vibeguard/scripts/project-init.sh /path/to/project

Current status

The current mainline is install-verified on macOS, full-CI verified on Ubuntu and macOS, and smoke-contract verified on Windows.

• Latest release train: v1.1.x; unreleased main may pin the next runtime version before its release tag exists
• Health checks: bash setup.sh doctor (interactive, alias --check) and bash setup.sh verify-install (CI gate); expected verdict is HEALTHY
• Hook latency is a product contract: CI tracks a Hook Latency (P95) report against per-hook budgets — see Hook Latency Contract

What you actually get

Coverage boundary: hooks and guards provide mechanical enforcement for the covered surfaces below. The full rule set is broader; severity labels and workflow rules also guide review, planning, and verification, and do not imply that every rule is hook-blocked.

Product Boundaries

VibeGuard has two layers:

If these surfaces disagree, treat the Core contract as authoritative first, then update workflow/docs surfaces to match it.

For repository layout ownership, see Directory Map.

What it looks like in practice

Real Codex hook output:

You:  "Add a login endpoint"

AI:   → tries to create auth_service.py
      ⚠ VibeGuard warns or blocks — new source files require search first

      → tries to import `flask-auth-magic`
      ⚠ VibeGuard rules/review contract — verify external libraries before adding

      → hardcodes JWT secret as "your-secret-key"
      ⚠ VibeGuard security rule — use env var or secret manager

      → runs `git push --force`
      ✗ VibeGuard git pre-push hook denies — history rewrites require explicit human approval

      → runs `git clean -fd`
      ✗ VibeGuard denies — points to an authorized discard workflow with an exact deletion plan

      → keeps reading files without acting
      ⚠ VibeGuard escalates — force a concrete next step or report blocker

      → claims done without verifying
      ⚠ VibeGuard gates — run build/test before finishing

Re-record your own demo: see docs/assets/README.md (one command via asciinema + agg).

Who this is for

Use VibeGuard if you:

• Use Claude Code or Codex regularly
• Have seen duplicate files, fake APIs, over-engineering, or unverified "done" claims
• Want mechanical enforcement for high-risk hook/guard surfaces, plus explicit rule and workflow contracts for cases that are not mechanically covered yet

It may be overkill if you only use AI occasionally or don't want hook-level interception.

Inspired by OpenAI Harness Engineering and Stripe Minions. VibeGuard maps the 5 Harness Golden Principles into repo-level rules, hooks, workflows, and observability; not every principle is a hook-level block.

How It Works

Rule Injection (active from session start)

The native rule set in rules/claude-rules/ is installed to Claude Code's native rules system (~/.claude/rules/vibeguard/), directly influencing AI reasoning. Plus a 7-layer constraint index injected into ~/.claude/CLAUDE.md:

Rules use negative constraints ("X does not exist") to implicitly guide AI, which is often more effective than positive descriptions.

Canonical references for this contract:

• Install/runtime contract: schemas/install-modules.json
• Native rule source: rules/claude-rules/
• Public summary of current rule surface: docs/rule-reference.md

Hooks — Real-Time Interception

Most hooks trigger automatically during AI operations. skills-loader remains an optional manual hook. Codex deploys native Bash/apply_patch/PermissionRequest/PostToolUse/Stop hooks; read-only exploration hooks remain Claude Code or app-server-wrapper only:

U-16 file-size enforcement applies to non-test source files with .rs, .ts, .tsx, .js, .jsx, .py, or .go extensions. The default typical-size advisory starts above 400 lines (u16.warn_limit in ~/.vibeguard/config.json / VG_U16_WARN_LIMIT), while the hard limit remains 800 lines (u16.limit in ~/.vibeguard/config.json / VG_U16_LIMIT). For Codex, apply_patch Add File and apply_patch Update File are both normalized before the file hook runs. U-16 is baseline-aware: new oversized files, files crossing the hard limit, and legacy oversized files that grow are blocked; legacy oversized files that stay the same size or shrink are allowed with a U16_LEGACY_DEBT advisory until they fall below the hard limit. The git pre-commit guard and CI changed-file check call the same runtime decision so oversized imports outside AI tool hooks are caught before submission.

Static Guards — Run Anytime

Representative standalone checks you can run on any project. The complete inventory lives in docs/rule-reference.md.

# Universal
bash ~/vibeguard/guards/universal/check_code_slop.sh /path/to/project     # AI code slop
python3 ~/vibeguard/guards/universal/check_dependency_layers.py /path      # dependency direction
python3 ~/vibeguard/guards/universal/check_circular_deps.py /path          # circular deps
bash ~/vibeguard/guards/universal/check_test_integrity.sh /path            # test shadowing / integrity issues
bash ~/vibeguard/guards/universal/check_dependency_changes.sh --base origin/main --head HEAD  # SEC-11 dependency review
bash ~/vibeguard/guards/universal/check_test_weakening.sh --base origin/main --head HEAD      # SEC-11/W-12 test weakening

# Rust
bash ~/vibeguard/guards/rust/check_unwrap_in_prod.sh /path                 # unwrap/expect in prod
bash ~/vibeguard/guards/rust/check_nested_locks.sh /path                   # deadlock risk
bash ~/vibeguard/guards/rust/check_declaration_execution_gap.sh /path      # declared but not wired
bash ~/vibeguard/guards/rust/check_duplicate_types.sh /path                # duplicate type definitions
bash ~/vibeguard/guards/rust/check_semantic_effect.sh /path                # semantic side effects
bash ~/vibeguard/guards/rust/check_single_source_of_truth.sh /path         # single source of truth
bash ~/vibeguard/guards/rust/check_taste_invariants.sh /path               # taste/style invariants
bash ~/vibeguard/guards/rust/check_workspace_consistency.sh /path          # workspace dep consistency

# Go
bash ~/vibeguard/guards/go/check_error_handling.sh /path                   # unchecked errors
bash ~/vibeguard/guards/go/check_goroutine_leak.sh /path                   # goroutine leaks
bash ~/vibeguard/guards/go/check_defer_in_loop.sh /path                    # defer in loop

# TypeScript
bash ~/vibeguard/guards/typescript/check_any_abuse.sh /path                # any type abuse
bash ~/vibeguard/guards/typescript/check_console_residual.sh /path         # console.log residue
bash ~/vibeguard/guards/typescript/check_component_duplication.sh /path    # duplicated component files
bash ~/vibeguard/guards/typescript/check_duplicate_constants.sh /path      # repeated constant definitions

# Python
python3 ~/vibeguard/guards/python/check_duplicates.py /path                # duplicate functions/classes/protocols
python3 ~/vibeguard/guards/python/check_naming_convention.py /path         # camelCase mix
python3 ~/vibeguard/guards/python/check_dead_shims.py /path                # dead re-export shims

Slash Commands

12 custom commands covering the full development lifecycle. Shortcuts: /vg:pf /vg:gc /vg:ck /vg:lrn.

Delivery Contract

Clear, bounded work executes directly. Use a short plan only for major architecture, migrations, cross-system policy changes, or when the user explicitly requests one. Ambiguous work pauses for clarification instead of generating a routing packet.

• Docs-only work, small bugs, and mechanical changes do not require a spec.
• A normal spec is limited to about two files and 300 lines.
• One repository has at most one writable session; delegation is opt-in and read-only by default.
• One PR gets at most two review rounds. Findings: 0 plus PASS ends review.

See delivery-base.md for the shared limits.

Optional Agent Prompts

14 built-in prompts are available when a user explicitly selects a specialist or bounded helper. They are not an automatic coordinator/reviewer pipeline:

Observability

bash ~/vibeguard/scripts/quality-grader.sh              # Quality grade (A/B/C/D)
bash ~/vibeguard/scripts/stats.sh                       # Project hook trigger stats (7 days)
bash ~/vibeguard/scripts/hook-health.sh 24              # Project hook health snapshot
bash ~/vibeguard/scripts/stats.sh --scope global        # Global hook trigger stats
bash ~/vibeguard/scripts/doctors/codex-doctor.sh        # Codex install + hook capability diagnosis
bash ~/vibeguard/scripts/metrics/metrics-exporter.sh    # Prometheus metrics export
bash ~/vibeguard/scripts/verify/doc-freshness-check.sh  # Rule-guard coverage check

Doctors are read-only diagnosis wrappers over the existing defense system. They summarize installation state, capability gaps, noisy hooks, recent events, and repair commands; hooks and guards remain the enforcement layer that blocks or warns during real tool execution.

Hook latency is also a product contract. See Hook Latency Contract for per-hook P95 budgets, hotspot attribution, and the static gates that block expensive hook patterns.

The local observability contract is documented in Observability Harness Contract, including project/global scope, metric labels, and the external-stack roadmap.

Tested and Evaluated

VibeGuard guards its own behavior — the test suite and eval harness ship in the repo, not as an afterthought.

• Behavior eval (CI-blocking): a zero-cost gate that runs the real guard hooks end-to-end and asserts the actual block/deny decision on both the Claude Code hook and the Codex wrapper. Enforced in CI at a 100% pass / 100% coverage threshold — removing a required platform slice fails the build (eval/run_behavior_eval.py).
• Rule-detection benchmark: a 40-sample, schema-validated, digest-pinned dataset (planted rule violations across SEC / Python / TypeScript / Go / Rust / universal rules, plus clean controls) scored on detection rate, a severity-weighted score, and per-severity Expected Calibration Error (ECE) — calibration, not just accuracy. Run manually with python3 eval/run_eval.py (uses the Claude API; not a merge gate).
• Test suite: hook/guard test scripts under tests/ and 100+ unit tests in the Rust vibeguard-runtime crate. Full CI runs on Linux and macOS; Windows runs cross-platform contract smoke tests.

Learning System

Closed-loop learning evolves defenses from mistakes:

Mode A — Defensive

/vibeguard:learn <error description>

Analyzes root cause (5-Why) → generates a new guard/hook/rule → verifies detection → the same class of error should not recur.

Mode B — Accumulative

/vibeguard:learn extract

Extracts non-obvious solutions as structured Skill files for future reuse.

Installation

One-command no-clone install

On supported macOS and Linux targets, the hosted seed downloads one exact release payload, verifies its checksum, and delegates to the canonical no-clone bootstrap contained in that verified payload:

bash -o pipefail -c 'curl -fsSL https://raw.githubusercontent.com/majiayu000/vibeguard/main/install.sh | bash -s -- --version 1.1.13'

Require GitHub release attestation verification and forward setup.sh options after the second --:

bash -o pipefail -c 'curl -fsSL https://raw.githubusercontent.com/majiayu000/vibeguard/main/install.sh | bash -s -- --version 1.1.13 --require-provenance -- --profile full --with-scheduler'

Then verify:

bash ~/.vibeguard/dist/current/setup.sh verify-install

Runtime prerequisites

Default setup downloads and verifies the pinned vibeguard-runtime release for supported platforms when the pinned runtime version has published release assets. Source builds remain available for unsupported/offline installs, for unreleased main checkouts whose pinned runtime version has not been tagged yet, and for users who explicitly request them.

setup.sh uses gh release download when gh is available, otherwise curl. If a supported-target download fails, it falls back to cargo build when Cargo is available. Checksum mismatch, a missing checksum entry, or a failed available attestation verification is fatal and does not fall back to source. When the attestation verifier is unavailable, setup prints checksum-only after SHA-256 verification.

Reproducible benchmark

The installed release includes a self-contained benchmark over paired positive and negative cases for hallucinated edit targets, duplicate definitions, swallowed exceptions, dangerous shell/Git operations, and unverified completion claims. Reproduce the current headline result with one command:

PATH="$HOME/.vibeguard/installed/bin:$PATH" vibeguard bench

Use vibeguard bench --json for machine-readable counts, rates, per-class decisions, latency, and embedded build provenance. Development/source builds are explicitly marked unverified; release CI requires the exact source commit and target embedded in the staged binary. An interception is any actual production-surface warn or block; latency is native runtime command wall time over five fresh-state measured runs per case after one warmup. Release CI runs the benchmark from both the raw native binary and a fresh no-clone installation, and derives the expected README numerators and denominators from the report.

Profiles and languages

# Profiles
bash ~/vibeguard/setup.sh                              # Install (default: core profile)
bash ~/vibeguard/setup.sh --profile minimal           # Minimal: pre-hooks only (lightweight)
bash ~/vibeguard/setup.sh --profile full              # Full: adds Stop signal + Build Check + learning
bash ~/vibeguard/setup.sh --profile strict            # Strict: full hooks + Claude Code U-32 SessionStart constraint budget

# Language selection (only install rules/guards for specified languages)
bash ~/vibeguard/setup.sh --languages rust,python
bash ~/vibeguard/setup.sh --profile full --languages rust,typescript

# Runtime / scheduler
bash ~/vibeguard/setup.sh --build-from-source          # Force local Cargo build
bash ~/vibeguard/setup.sh --with-scheduler             # Opt in to launchd/systemd scheduled GC
bash ~/vibeguard/setup.sh --yes --host gemini          # Opt in to Gemini CLI BeforeTool protection
bash ~/vibeguard/scripts/install-health-report-scheduler.sh --dry-run
bash ~/vibeguard/scripts/install-health-report-scheduler.sh --install  # Opt in to weekly health reports

# Verify / Uninstall
bash ~/vibeguard/setup.sh doctor                      # Human-friendly report, exits 0 for compatibility
bash ~/vibeguard/setup.sh --check                     # Compatibility alias for doctor
bash ~/vibeguard/setup.sh verify-install              # CI/post-install check, exits 2 on broken required state
bash ~/vibeguard/setup.sh verify-project              # Strict project check, exits 1/2 on degraded/broken
bash ~/vibeguard/setup.sh verify-dev-repo             # Strict VibeGuard repo check
bash ~/vibeguard/setup.sh verify-project --json       # Machine-readable JSON for CI
bash ~/vibeguard/setup.sh --clean                     # Uninstall

doctor / --check reports a structured rollup (OK / INFO / WARN / FAIL / BROKEN / MISSING) plus a final Verdict line of HEALTHY, DEGRADED, or BROKEN. It always exits 0 for backwards compatibility unless the checker itself cannot run. CI should use verify-install for post-install health gates or verify-project --json when it needs machine-readable strict project output.

Migration: --check --strict remains supported and maps to verify-project; --check --json remains supported and maps to verify-project --json; --check --install remains supported and maps to verify-install.

setup.sh also prepares the shared pre-commit wrapper at ~/.vibeguard/pre-commit and installs this repository's git pre-commit and pre-push hooks during setup. The git pre-push hook owns force-push / branch-deletion protection; pre-bash-guard does not regex-match git push --force. To attach the wrapper to another repository, use scripts/project-init.sh or that repository's own install step.

Codex Integration

VibeGuard deploys hooks and skills to both Claude Code and Codex CLI.

Codex App can also discover VibeGuard as a local plugin from this repository:

codex plugin marketplace add /path/to/vibeguard
codex plugin add vibeguard@vibeguard-local

The plugin is an observability-first operator entrypoint. Installing the plugin does not silently rewrite ~/.codex; use the plugin observe/setup skills, or run one of these commands from this checkout:

bash plugins/vibeguard/scripts/vibeguard-plugin.sh dashboard
bash plugins/vibeguard/scripts/vibeguard-plugin.sh health 24
bash plugins/vibeguard/scripts/vibeguard-plugin.sh stats all
bash plugins/vibeguard/scripts/vibeguard-plugin.sh install --yes

The dashboard is generated as a local HTML artifact from the existing VibeGuard diagnostic commands. It is not remote telemetry and does not replace behavior eval gates.

Hooks live in ~/.codex/hooks.json (requires [features].hooks = true in config.toml):

This is the default enforcement layer. It talks to Codex through native hooks and does not wrap or replace the Codex server. Codex has no native Read, Glob, or Grep hook surface, so analysis-paralysis is not available on the native Codex path. Use Claude Code when read-only exploration gating is required; the optional app-server wrapper is only for external orchestrators that already require codex app-server.

Codex hook command names are namespaced as vibeguard-*.sh to avoid collisions with other toolchains sharing ~/.codex/hooks.json. Output format differences are handled by the run-hook-codex.sh wrapper (Claude Code decision:block -> Codex deny payloads). Codex sends apply_patch as a patch command, so the wrapper normalizes that payload into Edit/Write-shaped inputs before calling the existing VibeGuard file hooks. For Update File patches, the wrapper also passes the line delta so pre-edit-guard.sh can enforce U-16 before Codex mutates the file. When a hook suggests updatedInput, the Codex CLI wrapper cannot apply it automatically, so VibeGuard emits an explicit note with the suggested replacement command instead of silently dropping it.

Hook status is a separate human diagnostics surface. Use vibeguard-runtime hook-status --mode focused inside a git repository to inspect the matching project log, or add --scope global for ~/.vibeguard/events.jsonl. --log-file PATH always wins for explicit fixtures or one-off diagnosis. The command reports recent pass, skipped, slow, timeout, and adapter-error states without adding successful hook summaries to the model context. Only actionable warn / block results should continue through hookSpecificOutput.additionalContext. See docs/reference/codex-hook-status.md.

MCP server status: the legacy mcp-server/ prototype is not installed by setup.sh and is not part of the supported runtime surface. Supported integrations are the Claude Code hooks, native Codex hooks, and the optional app-server wrapper below; any future MCP reintroduction must go through an explicit install path and hash/audit baseline.

Gemini CLI integration

Gemini CLI support is an explicit opt-in because setup updates the high-context file ~/.gemini/settings.json:

bash ~/vibeguard/setup.sh --yes --host gemini
bash ~/vibeguard/setup.sh --check --host gemini

The adapter registers one managed synchronous BeforeTool hook for run_shell_command, write_file, and replace. It translates Gemini's native payload into the existing VibeGuard bash/write/edit guards and translates block results back to Gemini's native decision: deny response. Re-running setup is idempotent, preserves unrelated Gemini settings and hooks, and --clean removes only VibeGuard's managed hook and wrapper.

Optional app-server wrapper (advanced orchestrators only):

Most local Codex setups do not need this path. It is not the default protection layer; use native Codex hooks in ~/.codex/hooks.json for local protection.

~/.vibeguard/installed/bin/vibeguard-runtime codex-app-server-wrapper --repo-dir ~/vibeguard --codex-command "codex app-server"

• --strategy vibeguard (default): applies strategy-based command, file-change, analysis-loop, and post-turn gates externally
• --strategy noop: pure pass-through for debugging
• Runtime: Rust-only via vibeguard-runtime; there is no Python app-server wrapper fallback.
• App-server wrapper is optional and mainly for external orchestrators that already speak codex app-server
• App-server wrapper scope today: Bash approval interception; applyPatchApproval / item/fileChange/requestApproval file-change guards mapped to pre-edit, pre-write, post-edit, and post-write; proxy-native analysis-paralysis warnings for read-only command streaks; post-turn stop/build feedback with explicit thread/session/turn propagation.
• Guard mode: VIBEGUARD_CODEX_GUARD_MODE=guarded by default. decline / denied tells Codex to continue the turn with a warning; strict upgrades file changes to cancel / abort; advisory emits warnings without blocking.
• Default local protection should use native Codex hooks in ~/.codex/hooks.json
• Still unsupported on native Codex path: Read/Glob/Grep hooks such as analysis-paralysis

Use with any project

Project Bootstrap

Bootstrap another repository with project-specific guidance and the pre-commit wrapper:

bash ~/vibeguard/scripts/project-init.sh /path/to/project

Local Contract Gate (contributors)

Run stable contract checks locally before pushing, or wire them as a pre-commit hook:

bash scripts/local-contract-check.sh          # run the full local gate
bash scripts/install-pre-commit-hook.sh       # install as git pre-commit hook

See CONTRIBUTING.md for the local-vs-CI split and the --quick flag.

Custom Rules

Add your own rules to ~/.vibeguard/user-rules/. Any .md files placed there are automatically installed to ~/.claude/rules/vibeguard/custom/ on the next setup run. Format: standard Claude Code rule files with YAML frontmatter.

Design Principles

Known Issues

Guard scripts rely heavily on pattern matching (grep/awk or lightweight AST helpers), which means false positives can still happen in some scenarios.

• Known False Positives — identified false positive scenarios, fixes, and lessons learned

Key lessons:

• grep is not an AST parser — nested scopes and multi-block structures need language-aware tools
• Guard fix messages are consumed by AI agents — an imprecise fix hint can itself trigger unnecessary edits
• Project type awareness matters — CLI/Web/MCP/Library codebases may need different acceptable patterns for the same language rule

Documentation

The Agent Infra Stack

This project is one layer of an open-source stack for running coding agents (Claude Code, Codex) as serious infrastructure. Every piece works standalone; together they close the loop:

vibeguard is the Trust layer at runtime — rules, hooks, and guards while the agent works. Its install-time counterpart is argus.

References

• OpenAI Harness Engineering
• Stripe Minions
• Anthropic: Effective Harnesses for Long-Running Agents

Chinese Documentation →