Honest limits:

The guards read command text. They read bash syntax (quotes, heredocs, bash -c, substitutions), and they block when they can’t tell what runs. A command assembled in pieces still gets past them. They catch mistakes and drift; they aren’t a lock. The lock is on the server: branch protection, code owners, and a bot without the rights to release or change CI. A worker’s shell write to a lead-only file is stopped only when the guard sees the file in the command: a path from a variable or stdin (xargs rm, find -exec, git apply < x.patch), or a script that writes it, gets past. A shell write to .git/config or .githooks has the same gaps, and so does a write after a cd to a folder the guard can’t read (cd "$x" && echo >> config). A program other than git, gh, yokoten or a shell may run git with the home folder it was given: an npm script, a make target or a shell function (HOME=/tmp/x npm run commit). An indirect name (export $name=x) gets past too.
A worker’s settings are read on the command line only. The guard stops a setting that moves a folder or makes a program run other code (PATH, GIT_DIR, LD_PRELOAD, NODE_OPTIONS) when it is typed in the command. A script the worker writes and then runs can set any of them: that is out of the guard’s reach, and the desk fence is the boundary for a worker’s processes. A project lets its workers set its own test settings in worker.settings.
gh’s token is hidden only from plain commands. A script written to a file and then run is not read. A script that reads gh’s own files or the system keyring, or a variable name built in pieces, still gets the token. So does a program that prints the whole environment (env, printenv, set, /proc/self/environ): refusing those would break too much. An alias you made before is not read either. Then the agent can call GitHub around the guard. The real fix is that the token is not in the agent’s environment. For a worker, that is a desk with no token at all (#637). For the lead, the lock is again the server: branch protection, and a token without the rights to merge or release.
Server settings are read on GitHub only. Another host shows the steps that only the host can judge as can’t check, with what each one asks (What a session sees). doctor does not check the bot’s rights yet.
Claude Code first. Agents follow Claude Code’s format. Skills are the open SKILL.md format, so install also puts them in ~/.agents/skills, where Codex, Gemini CLI, Copilot, Cursor and other agents find them. The tool-call guard also runs in Copilot CLI, Antigravity CLI, Codex, Muse Code, DeepSeek Harness, Gemini CLI and OpenCode: see Works with for which runs were seen to block (#30). doctor reports the other agents’ hooks, and the user hooks once ~/.codex or ~/.gemini exists, but does not count them as missing: a project may use none of these agents. The rules are plain AGENTS.md, which Claude Code reads when a project has no CLAUDE.md, and so do most other agents. Muse Code reads AGENTS.md too.
DeepSeek Harness is not guarded on Windows yet. dsh runs hooks in PowerShell there, and the guard is a POSIX shell command (#332). The guard also sees only bash, pwsh, edit and write. A profile that mounts dsh’s optional str_replace_editor or the experimental terminal_send can edit files or type into a shell unchecked.

What it doesn't do