A hook stops coding agents adding checksums and disclaimers nobody requested

The developer lennney has published stop-that-shit, a plug-in that sits between an AI coding agent and the shell and refuses actions the user did not ask for and the code does not need. It supports Codex, Claude Code, OpenCode, Hermes Agent CLI, and Pi. The repository was created on 2026-08-11 and has picked up 1,497 stars, 39 forks, and version 0.2.1 in the 24 days since.

The four failure types it names

The project targets four ways a coding agent turns a limited task into a larger one. Scope creep, where a small fix becomes half a refactor. Hashing and hypothetical hardening, where the agent writes a checksum or a guard nobody will read. Intent violation, where a review request becomes a rewrite. Task thrashing, where the agent redoes work it already completed. The author names these with the acronym SHIT and treats each as a separate rule.

How the block happens

The plug-in registers a PreToolUse hook and a set of skills the user invokes with review, change, and similar mode words. When the agent tries to run a covered tool call, the hook checks the current mode, the declared file boundary, and rules for hashes, dependencies, and sub-agents. If the action is out of scope the hook returns a permission deny with a short reason, an event id, and the state the guard was in. The agent can still read the repository, and it must still handle real callers of any code it touches. The hook only refuses the action that broke the boundary.

Version 0.2.1 tightens how the files= boundary is compared across absolute and relative paths, adds a per-adapter regression suite, and treats an unknown tool or an unresolvable target under a narrow files= boundary as a request for approval rather than a silent pass.

The 0.2.0 expansion

The 0.2.0 release moves the same judgement from actions into text. The author writes that agents "defend against critics who are not there" with lines like "this is not a complete study" or "this may not apply to everyone", spending tokens without changing any decision. Version 0.2.0 adds a companion rule called Stop That Shit Slop with a Sentence Consumer Test that flags a hedging sentence for deletion or shortening if no reader of the output would act differently for its being there.

Longer AGENTS.md files are the usual answer when a coding agent adds work nobody asked for. The problem lennney describes is that the file itself grows into another kind of noise, and the agent still ignores individual lines. A hook layer moves the boundary out of the prompt, and out of the reviewer's memory, and into the same code path that runs the tool call. The result is that a review command cannot silently start writing files, and a change command cannot silently start writing checksums, without the guard flagging it and asking. Teams running more than one agent across the same repository get one place to keep the rule instead of five.

Source

• Repository: lennney/stop-that-shit
• License: MIT