Preventing Mass-Staging: VS Code Copilot and git add -A

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Correction note (2026-10-13). An earlier version of the rules in this article used ==, which the rule DSL does not have, so the rules did not load. The rules now use EQUALS.

Describe the task

VS Code Copilot prepares a commit by staging all changes in one command:

git add -A

This includes .env, *.log, compiled binaries, and any secrets the agent generated during the session. SSG blocks it before the index is written.

# illustrative sample output
[BLOCK] bash › git add -A — rule: no-git-add-all

Give SSG context

SSG evaluates VS Code Copilot's git commands via the SSG MCP Server integration.

Required context

rule no-git-add-all {
  enabled true
  priority 90
  severity warning
  DENY execution
  IF command MATCHES "^git add (-A|--all|\.)$"
  MESSAGE "Staging all files is blocked. Use explicit paths: git add src/ or git add -p for interactive staging."
}

Optional context

Also catch git add . which stages from the current directory:

rule no-git-add-dot {
  enabled true
  priority 90
  severity warning
  DENY execution
  IF command EQUALS "git add ."
  MESSAGE "git add . stages everything including secrets. Use explicit paths."
}

What SSG does

SSG blocks the staging command before the git index is updated. No files are added to the staging area — the working tree is unchanged.

Ask the agent to stage explicitly

git add -A was blocked. Stage only the files you intend to commit:
  git add src/feature.ts        # specific file
  git add src/                  # specific directory
  git add -p                    # interactive hunk-by-hunk staging
Ensure .env, *.log, and dist/ are in your .gitignore.

Protect sensitive files at the write layer too

Pair with a write rule to prevent secrets from being created in the first place:

rule no-write-env-tokens {
  enabled true
  priority 100
  severity error
  DENY write
  IF path ENDS_WITH ".env"
  AND content MATCHES "[A-Z_]+=.{16,}"
  MESSAGE "Writing secrets to .env files in the repo root is blocked. Use a secrets manager."
}

Audit what gets staged in CI

Use git diff --cached --name-only after any staging operation to review what's in the index before committing. SSG logs blocked staging attempts on a best-effort basis for post-incident review.