Install git and IDE enforcement hooks
Wire commit-msg validation and beforeShellExecution denials so raw git commit cannot bypass MCP.
What you will learn
- Install commit-msg hook
- Sync Cursor hooks denying raw git commit
- Prove illegal messages fail
Prerequisites
Surface
| Imports | @tmrxjd/agent-governance-system/commit-msg |
|---|---|
| MCP | commit_validate · sentinel_status |
| CLI | git config core.hooksPath .githooks |
| Config | .githooks/commit-msg · .cursor/hooks.json |
What this feature does
Hooks close the gap between MCP policy and shell reality. `validateAgentCommitMessage` rejects schema-illegal messages; IDE hooks deny `git commit` unless issued through `commit_checkpoint` (TOWER_MCP_COMMIT=1).
Configuration
Wire these surfaces first: .githooks/commit-msg, .cursor/hooks.json.. Treat them as the contract agents must not invent around.
#!/usr/bin/env node
import { readFileSync } from 'node:fs'
import { validateAgentCommitMessage } from '@tmrxjd/agent-governance-system/commit-msg'
const msg = readFileSync(process.argv[2], 'utf8')
const result = validateAgentCommitMessage(msg)
if (!result.ok) {
console.error(result.errors.join('\n'))
process.exit(1)
}How to call it
Call these MCP tools through your AGS / tower-gov host — commit_validate, sentinel_status.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.
- Write commit-msg hook
- git config core.hooksPath .githooks
- Sync .cursor/hooks.json
- Reload IDE window
{ "message": "status/checkpoint(demo): add helper\n\nStatus: checkpoint\n…" }What success looks like
One-line commit messages are rejected by the hook
Raw agent git commit is denied by beforeShellExecution
commit_checkpoint still works when CAP and attestations pass
Common failure modes
core.hooksPath unset
Agent uses --no-verify
Stale hooks.json after package upgrade