Protecting Your Git History: VS Code Copilot and Force Push

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Describe the task

VS Code Copilot is amending a recent commit to fix a typo. It runs a force-push — but the branch argument resolves to main instead of the intended feature branch:

git push origin main --force

SSG blocks the destructive rewrite before it reaches the remote.

# illustrative sample output
[BLOCK] bash › git push origin main --force — rule: no-force-push-main

Give SSG context

SSG evaluates VS Code Copilot's git commands via the SSG MCP Server integration.

Required context

rule no-force-push-main {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "git push"
  AND command CONTAINS "--force"
  AND command CONTAINS "main"
  MESSAGE "Force-pushing to main is blocked. Use --force-with-lease on a feature branch."
}

Optional context

Also protect master and release branches:

rule no-force-push-protected {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "git push"
  AND command CONTAINS "--force"
  AND command MATCHES ".*(main|master|release|production).*"
  MESSAGE "Force-pushing to protected branches is blocked."
}

What SSG does

SSG intercepts the git push command before it reaches the network. The remote ref is never updated — the shared history is intact.

Ask the agent to use --force-with-lease

--force push to main was blocked. Safer alternatives:
  git push origin feature-branch --force-with-lease  # fails if remote has new commits
  git push origin HEAD:feature-branch                # push to a new remote branch
If you need to amend a shared commit, coordinate with your team first.

How your rule handles -f shorthand

Git accepts -f as an alias for --force. Add a parallel rule or extend the condition:

rule no-force-push-short {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command STARTS_WITH "git push"
  AND command CONTAINS " -f "
  AND command MATCHES ".*(main|master).*"
  MESSAGE "Force-pushing to protected branches is blocked."
}

Audit force-push attempts in CI

Blocked force-push attempts are logged on a best-effort basis with the full command. Use ssg dashboard to review how frequently agents attempt destructive git operations.