Sphinx, a Git Hook, Quizzes Developers on Agent-Written Code Before a Push Goes Through

Sphinx, a Git hook released as version 0.1 under the MIT licence, holds a push until the developer answers a question about what the change does. The repository belongs to the GitHub user parthh01, had 61 stars and 47 commits on Oct. 18, and the project page names no one else.

The task it targets is a familiar one: an agent writes 11 files, you skim the diff, and you push. Sphinx's own demonstration diff on its project page is 11 files, +5,012 and -3,147 lines, and it is labelled illustrative, not a benchmark. The Terminal did not install or run the tool.

What happens when you push

Per the README, a push to a protected branch pauses while a separate reviewer model reads the committed change through read-only Git tools. That reviewer never sees the chat that produced the code. It asks what the change will do, for example what a retry does when a webhook saves an event ID before calling charge().

A wrong answer gets an explanation and a new scenario, and a right one lets the push continue. A check can block Git for up to 25 minutes, and a pass lasts 24 hours. The page's one-line bypass is sphinx yolo, which lets the push through and logs the skip.

The part that changes every repository

Installing is two commands: npm install -g sphinx-understand, then sphinx install, on Node.js 22.19 or newer on macOS, Linux or WSL. The README says sphinx install sets the global Git core.hooksPath, so the check applies to every repository on the machine, not only the one you were thinking about.

Git's hooks documentation explains why that works: core.hooksPath moves the hooks directory, and a pre-push hook that exits with a non-zero status makes git push abort without pushing anything. The same page says the hook receives each ref being pushed on standard input.

Setting	Value in the README	Why it matters
Blocking window	Up to 25 minutes	A stalled reviewer holds a push that long
Pass lifetime	24 hours	One right answer covers a day of pushes
Typical model calls	About 5 to 8, plus one per answer	No default cap is set
Cap	sphinx config --max-model-calls	Opt-in

What leaves your machine

The reviewer's provider receives the changed code and related files from the commit, the developer's answers and a file called .sphinxcontext.md. Reviewer options are a signed-in Codex or Claude Code CLI, an OpenRouter API key or any OpenAI-compatible endpoint.

Files listed in .sphinxignore are never read, and .env files, private keys and common credential files are excluded by default. The README adds that the rules match file paths, so they will not catch a secret pasted into ordinary source. It also says OpenRouter bills separately, even for free models, and tells paid-provider users to set spending limits.

What the README says it is not

Version 0.1 covers local commits and pushes. It does not cover web merges, CI-required checks or deployments, and it cannot read binary file contents. The README calls the tool "practice, not a security gate", says the examiner is an LLM that "can be wrong", and says anyone with local access, a coding agent included, can bypass hooks.

That last line sits awkwardly beside the tool's premise. The developer most likely to wave through an agent's diff is also the one whose agent can edit the hook configuration. The README offers no accuracy or false-positive figures, and the project page lists none either.

The only open item in the repository on Oct. 18 was a single issue. Whether question quality holds up on a diff the reviewer model cannot fully read is something neither page measures. Related reading: an OpenAI model that downloaded 147,451 rows while fetching five dashboard figures, and nine models writing StarCraft bots in an hour.