Rules and native hooks for Claude Code and Codex.

What the current runtime checks

• Review rules: 75 scoped topics covering scope, facts, errors, security, workflow, Rust, Python, Go, and TypeScript. Rule severity is guidance, not an automatic blocking level.
• Native Bash hooks: reject selected bulk Git restore, forced Git clean, and recursive forced deletion spellings. Results record only the latest observed outcome.
• Optional Git pre-push hook: checks commit ancestry, rejects remote ref deletion and replacement of existing tags, and requires fast-forward branch updates.
• Installation diagnostics: report hook registration, executable mode bits, local hook settings, and the last observation.

The Bash classifier is not a complete shell parser or sandbox. Alternate commands and disabled or untrusted hooks can bypass it; Git hooks are also bypassable. A reported zero exit code does not prove that tests ran or that the current tree is verified. The host owns permissions and the agent loop.

Read the runtime contract for the exact enforcement and evidence boundaries.

Install from a release archive

Download your OS and CPU archive from GitHub Releases, extract it, and open a terminal in that directory. macOS, Linux, and WSL are supported; choose a Linux archive for WSL. This path does not require a Rust toolchain.

./vibeguard-runtime install codex
# Or select Claude Code:
./vibeguard-runtime install claude

Restart the selected host and review its native hook trust settings.

~/.vibeguard/bin/vibeguard-runtime status codex
~/.vibeguard/bin/vibeguard-runtime rules
~/.vibeguard/bin/vibeguard-runtime rules RS-01

Use claude instead of codex for Claude Code. Native Windows installation is not implemented; the portable CLI and JSON protocol are tested in Windows CI.

For source builds, optional Git protection, v1 upgrade instructions, or uninstall, follow the current README. V2 removes the earlier static scanners, learning metrics, workflow routing, and Stop/test-keyword gates.

Use VibeGuard in a coding session

This is the Rust vibeguard-runtime project maintained at majiayu000/vibeguard. Use that repository's releases and documentation when choosing an archive or checking a command.

How do I find a rule for the code I am reviewing?

Start with the category, then open the relevant topic. For example:

~/.vibeguard/bin/vibeguard-runtime rules rust
~/.vibeguard/bin/vibeguard-runtime rules RS-01

Read the topic's scope and exceptions before applying it. These commands print guidance; they do not scan your source or decide whether a change passes review. The rule reference lists the other categories and identifiers.

Hooks are installed. Why is protection still uncertain?

~/.vibeguard/bin/vibeguard-runtime status codex

Use status claude for Claude Code. An incomplete result points to registration, executable mode bits, or local hook settings. Prompt text is not an installation-health requirement. Check the reported paths and the status contract. Even a complete result cannot establish host trust or reload state; restart the host and review its native hook settings. The last observation is a diagnostic, not proof that the current code passed tests.

Do review rules block every violation?

No. The rule library guides the agent and reviewer. The runtime enforces selected Bash spellings and the optional Git pre-push policy; other tools and arbitrary shell programs are outside those checks. Keep host permissions and repository protection in place. See what is checked and the protocol boundaries.

Why do older instructions mention different commands?

V2 removed the earlier scanners, proxy, and workflow systems. Use the README bundled with your exact release archive. For an existing v1 installation, follow the version-specific uninstall sequence before installing v2; v2 inventories legacy files but leaves them in place.

For a reproducible installation or command problem, open a GitHub issue with the release version, platform, command, and redacted status output. Use the security policy for vulnerability reports.