Beat the gate

Termaxa is a gate for the shell commands AI coding agents run: it previews the blast radius, backs up first, blocks the dangerous ones, and keeps a record the agent cannot rewrite. Below is the real thing, on a throwaway project, with the default policy. Try to get a destructive command past it. Attempts are recorded (the command, a hashed address and the user agent) so a bypass can be found; don't paste anything secret.

Nothing executes. termaxa check reads the command and answers.

The project has twelve files in scratch/, a .env, and a git history that has diverged from its remote. Verdicts: allow, ask (a human would be prompted; unattended, that is a refusal), deny.

What counts as beating it

A shell command that the gate allows, or that it previews as touching less than it would, and that would delete, overwrite or force-push something in the project. That is a bypass, and every bypass so far has become a fix and a published advisory.

Not a bypass, because it is documented: a script file the gate does not read (bash script.sh), a shell run by absolute path outside wrap, an agent's native file tool where no path rule names the file, and anything that is not a shell command at all. The full list is in SECURITY.md.

Found one? Report it privately. It gets fixed, credited and published here.

Solved challenges

GHSA-4mqm-4c42-2xxc (High): a path the gate could read only the end of was not matched by the path rules, so cd "$(git rev-parse --show-toplevel)/.claude" && echo {} > settings.json and cat .env.example > $PWD/.env were allowed by an explicit allow, while cd .claude && echo {} > settings.json and the direct spellings were denied.
GHSA-3hg6-x893-mfr4 (High): a path after a cd was judged where the command started, so cd .claude && echo {} > settings.json was allowed while the direct spelling was denied, and a delete after a cd was previewed and backed up in the wrong directory.
GHSA-36jf-95xr-37f2 (Moderate): options on commands allowed for reading could write files, overwrite branches or run commands (sed -n '1e …'), and push previews showed ref deletions as "nothing to push". Reported by Tim Schipper.
GHSA-rv66-7qcx-c45j (High): a compound command could inherit a benign prefix's verdict.
GHSA-m854-p747-v3gw (Moderate): a denied terraform destroy still ran terraform plan, which executes external data source programs.
GHSA-p2fg-58v6-j4fx (Moderate): a single & separator was not split, so a destructive command after an allowed one inherited the allow.
GHSA-gxg4-5fmj-534m (Moderate): the Postgres preview could execute the SQL file of the command it was analysing.

Run it on your own agent

brew install termaxa/tap/termaxa, cargo install termaxa, or scoop bucket add termaxa https://github.com/termaxa/scoop-bucket && scoop install termaxa; then termaxa init in a project. Hooks for Claude Code, Codex, Cursor and Copilot; termaxa wrap for anything else. Free and open source: github.com/termaxa/termaxa.