Sphinx pauses a git push and asks the developer to explain the change, ensuring understanding before code ships.
SPHINX GIT HOOK FORCES AI CODE REVIEW BEFORE PUSH
*Free, open‑source tool that pauses every Git push and quizzes the developer on the changes. It aims to stop blind AI‑generated commits from reaching production.*
A new open‑source Git hook called Sphinx is targeting the growing reliance on AI‑generated code. By inserting a mandatory quiz into the push process, Sphinx forces developers to articulate the intent behind each change before it reaches production. The tool promises to catch logical oversights that AI agents might miss, especially in high‑risk scenarios like payment processing. Its creators market it as “Outsource your thinking, not your understanding,” echoing Sun Tzu’s maxim. Early adopters see it as a cheap, language‑agnostic safeguard that integrates with existing CI pipelines in minutes.
What does Sphinx actually do?
Sphinx installs as a global npm package (npm install -g sphinx-understand) and registers a Git hook. When a developer or an AI‑assisted agent runs git push, the hook pauses the push and presents a question derived from the diff. The question asks the human to explain what the changed code does, especially under failure scenarios. An answer is required before the push continues. If the answer is wrong, the developer learns why and must retry. The tool works with Codex, Claude Code, Cursor, OpenCode, Pi, or plain Git. Answers never reach the coding agent, and .env files or secret keys stay hidden. The workflow adds a mandatory sanity check without altering the existing CI pipeline.
How does Sphinx handle Stripe webhook retries?
The source example shows a webhook handler that saves an event ID before calling charge(). When Stripe times out, it resends the same event. Sphinx’s logic detects the saved ID on retry and returns HTTP 200 without invoking charge() again, preventing a double charge. However, the ID is stored before the charge succeeds. If the initial charge() fails, the next retry finds the ID but skips the charge, leaving the customer unbilled. This behavior demonstrates Sphinx’s ability to enforce idempotency checks based on developer‑provided reasoning, reducing financial errors caused by duplicated or missed webhook executions.
Which development environments does Sphinx support?
Sphinx runs on Node 22.19+ and is compatible with macOS, Linux, or WSL. Installation is a single npm command, after which developers push as usual. The hook can connect to any OpenAI‑compatible endpoint, including OpenRouter, and works with a range of coding agents such as Codex, Claude Code, Cursor, OpenCode, and Pi. It also supports plain Git without an external agent. The minimal‑token design ensures low overhead, and the tool can be activated in a minute. Documentation covers model selection, enabling teams to plug Sphinx into existing workflows without rewriting scripts.
Can teams bypass Sphinx checks?
Sphinx includes a “yolo” mode for urgent pushes. Running sphinx yolo lets the push proceed while logging each skip. The skip is recorded, preserving an audit trail. This option acknowledges real‑world pressure without disabling the safety net entirely. Even in yolo mode, the hook does not expose environment variables or secrets, maintaining the same privacy guarantees. Teams can therefore balance speed and security, but every bypass is traceable for later review.
Frequently asked questions
What is Sphinx and how is it installed?
Sphinx is a free, open‑source Git hook that quizzes developers on code changes before push. Install it globally with npm install -g sphinx-understand.
How does Sphinx prevent double charging on Stripe webhook retries?
Sphinx saves the event ID before calling charge(). On a retry, it detects the saved ID, returns 200, and skips charging, avoiding a duplicate charge.
Can Sphinx be bypassed for urgent pushes?
Yes, the yolo mode lets pushes continue while logging each skip, preserving an audit trail without exposing .env files or keys.
Sphinx delivers a pragmatic checkpoint for AI‑augmented development without demanding a full security overhaul. By leveraging a simple questionnaire tied to the diff, it catches edge‑case failures that could otherwise slip into production. The optional yolo mode respects urgent timelines while preserving an audit log. As AI agents become more prevalent, tools like Sphinx may become the baseline for responsible code deployment.
Sources: [Show HN: Sphinx – A hook that quizzes you on your AI's code before shipping]