Yeah I disallow git write in my agents.md for exactly this reason. Agents have fucked up the working tree and lost code too many times for me.

I have this in agents.md now:

  # Git operations policy

  Git is read-only for coding agents unless running in a cloud environment where git writes are explicitly allowed.

  - Never run git commands that write state, change history, change the index/staging area, change branches, or modify working tree files.
  - Never run destructive git commands.
  - The human user owns git write operations.

  Allowed read-only examples: `git status`, `git diff`, `git log`, `git show`, `git branch --show-current`, `git rev-parse`, `git blame`.

  Disallowed examples: `git add`, `git rm`, `git mv`, `git restore`, `git checkout`, `git switch`, `git commit`, `git merge`, `git rebase`, `git cherry-pick`, `git revert`, `git reset`, `git stash`, `git clean`, `git fetch`, `git pull`, `git push`, `git tag`, and `git worktree`.