Vestige Operator

Vestige Operator checks every command your AI coding agent tries to run, before it runs, and stops the ones that could destroy your work. It’s the full version of the free Operator Lite gate.

Operator Lite stops a fixed list of dangerous commands, like deleting your files or force-pushing over your code. Operator does everything Lite does, then catches what Lite can’t: a string of harmless-looking steps that add up to damage, the same delete written a different way, or a password the agent found in an old file and tried to use on a live system. When Operator stops something, nothing runs until you allow it, once, from your own terminal.

What you get

• Your own rules, in plain sentences. Write “No push without my permit.” and the gate enforces it on every command.
• A setup wizard that writes your starting rules with you in about five minutes and shows one working.
• Rewind. Before a command you allowed deletes work that exists nowhere else, Operator keeps a copy for a week, so you can put it back.
• A safe preview before you say yes. Operator can run a stopped command in a sealed copy of your folder first, so you see exactly what it would do (macOS).
• Protected files. Mark a file read-only or append-only, and an agent can’t quietly rewrite it.
• Memory that survives long sessions. When a long conversation gets compressed, the agent has to reread what it was stopped from and what you allowed before it can change anything.
• One record for all your agents. If one agent is stopped from deleting a folder, another agent on the same machine can’t reach it through a script for the next 12 hours.
• A brake for an agent that keeps getting stopped, and a block on deletes sent to live online services.
• The Board shows today’s stops, the Letter sums up your week, and Replay runs your last 30 days of agent history through your rules.
• It fails safe. If the gate itself crashes or freezes, the command is stopped, not let through (Claude Code 2.1.295 or later).

Pay once. Every later version is yours at no charge.

It wires into any AI agent with one more step. It runs on macOS, Linux and Windows with Python 3.9 or newer; the safe preview needs macOS for now. Operator stops what your agent sends through its hooks and can’t stop a command that bypasses them. Its receipts are hash-chained, so any edit to the record shows up, but they’re not signatures.