Beat the gate

Termaxa is a gate for the shell commands AI coding agents run: it previews the blast radius, backs up first, blocks the dangerous ones, and keeps a record the agent cannot rewrite. Below is the real thing, on a throwaway project, with the default policy. Try to get a destructive command past it.

Nothing executes. termaxa check reads the command and answers.

The project has twelve files in scratch/, a .env, and a git history that has diverged from its remote. Verdicts: allow, ask (a human would be prompted; unattended, that is a refusal), deny.

What counts as beating it

A shell command that the gate allows, or that it previews as touching less than it would, and that would delete, overwrite or force-push something in the project. That is a bypass, and every bypass so far has become a fix and a published advisory.

Not a bypass, because it is documented: a script file the gate does not read (bash script.sh), a shell run by absolute path outside wrap, an agent's native file tool where no path rule names the file, and anything that is not a shell command at all. The full list is in SECURITY.md.

Found one? Report it privately. It gets fixed, credited and published here.

Solved challenges

GHSA-rv66-7qcx-c45j (High): a compound command could inherit a benign prefix's verdict.
GHSA-m854-p747-v3gw (High): a denied terraform destroy still ran terraform plan, which executes external data source programs.
GHSA-p2fg-58v6-j4fx (Moderate): a single & separator was not split, so a destructive command after an allowed one inherited the allow.
GHSA-gxg4-5fmj-534m (Moderate): the Postgres preview could execute the SQL file of the command it was analysing.

Run it on your own agent

brew install termaxa/tap/termaxa, cargo install termaxa, or scoop bucket add termaxa https://github.com/termaxa/scoop-bucket && scoop install termaxa; then termaxa init in a project. Hooks for Claude Code, Codex, Cursor and Copilot; termaxa wrap for anything else. Free and open source: github.com/termaxa/termaxa.