- Bash Hook - Evaluates commands against regex patterns and path restrictions
- Edit Hook - Validates file paths before modifications
- Write Hook - Checks paths before file creation
Exit codes:
0 = Allow operation0 + JSON = Ask for confirmation (triggers dialog)2 = Block operation (stderr fed back to Claude)
Ask patterns: Some operations trigger confirmation dialogs instead of blocking:
git checkout -- . (discards changes)git stash drop (deletes stash)DELETE FROM table WHERE id=X (SQL with specific ID)
Or ask Claude:
"Install damage control security hooks"
"Set up protection for my project"
- Install - Set up damage control hooks (global, project, or personal)
- Modify - Add/remove protected paths or blocked commands
- Test - Validate hooks are working correctly
- List - View all active protections across all levels
Wait for response before proceeding.
Direct command routing (skip menu):
- "add ~/.credentials to zero access" → Execute directly, then restart reminder
- "block npm publish command" → Execute directly, then restart reminder
- "protect /secrets folder" → Execute directly, then restart reminder
After reading the workflow, follow it exactly.
Git destructive:
git reset --hard, git push --force (not --force-with-lease)git clean -fd, git stash clear, git filter-branch
Cloud destructive:
- AWS:
terminate-instances, delete-db-instance, delete-stack
- GCP:
projects delete, instances delete, clusters delete
- Docker:
system prune -a, volume rm
- Kubernetes:
delete namespace, delete all --all
Database destructive:
DELETE FROM table; (no WHERE clause)DROP TABLE, DROP DATABASE, TRUNCATE TABLEredis-cli FLUSHALL, dropdb
See scripts/patterns.yaml for complete list.
Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
**TypeScript with Bun (Alternative):**
```bash
# macOS/Linux
curl -fsSL https://bun.sh/install | bash && bun add yaml
# Windows
powershell -c "irm bun.sh/install.ps1 | iex" && bun add yaml
Restart your agent for changes to take effect.
Hooks are only loaded at agent startup. Run /hooks after restart to verify.
| Script |
Purpose |
| scripts/bash-tool-damage-control.py |
PreToolUse hook for Bash commands |
| scripts/edit-tool-damage-control.py |
PreToolUse hook for Edit tool |
| scripts/write-tool-damage-control.py |
PreToolUse hook for Write tool |
| scripts/test-damage-control.py |
Test runner for hook validation |
| scripts/patterns.yaml |
Security patterns and protected paths |
| scripts/settings-template.json |
Hook configuration template |
|
|
- Hooks installed at chosen level (global/project/personal)
patterns.yaml copied alongside hook scriptssettings.json updated with PreToolUse hook configuration- UV (or Bun) runtime installed
- Agent restarted to load hooks
- Verified with
/hooks command showing damage-control hooks
- Tested with
rm -rf /tmp/test (should be blocked)
1---2name: damage-control3description: Install, configure, and manage Claude Code security hooks that block dangerous commands and protect sensitive files. Use when setting up security protection, blocking destructive commands (rm -rf, git reset --hard), protecting sensitive paths (.env, credentials), or managing PreToolUse hooks.4---5
6<objective>
7Defense-in-depth protection system for Claude Code. Uses PreToolUse hooks to intercept and validate tool calls before execution, blocking dangerous commands and protecting sensitive files.
8</objective>
9
10<protection_levels>
11| Level | Read | Write | Edit | Delete | Use Case |
12|-------|------|-------|------|--------|----------|
13| **zeroAccessPaths** | No | No | No | No | Secrets, credentials, .env files |
14| **readOnlyPaths** | Yes | No | No | No | System configs, lock files, build artifacts |
15| **noDeletePaths** | Yes | Yes | Yes | No | Important project files, .git/, LICENSE |
16</protection_levels>
17
18<how_it_works>
19PreToolUse hooks intercept tool calls at three points:
20
211. **Bash Hook** - Evaluates commands against regex patterns and path restrictions
222. **Edit Hook** - Validates file paths before modifications
233. **Write Hook** - Checks paths before file creation
24
25**Exit codes:**
26- `0` = Allow operation
27- `0` + JSON = Ask for confirmation (triggers dialog)
28- `2` = Block operation (stderr fed back to Claude)
29
30**Ask patterns:** Some operations trigger confirmation dialogs instead of blocking:
31- `git checkout -- .` (discards changes)
32- `git stash drop` (deletes stash)
33- `DELETE FROM table WHERE id=X` (SQL with specific ID)
34</how_it_works>
35
36<quick_start>
37**Interactive installation:**
38```
39/damage-control install
40```
41
42**Or ask Claude:**
43> "Install damage control security hooks"
44> "Set up protection for my project"
45</quick_start>
46
47<intake>
48What would you like to do?
49
501. **Install** - Set up damage control hooks (global, project, or personal)
512. **Modify** - Add/remove protected paths or blocked commands
523. **Test** - Validate hooks are working correctly
534. **List** - View all active protections across all levels
54
55**Wait for response before proceeding.**
56</intake>
57
58<routing>
59| Response | Workflow |
60|----------|----------|
61| 1, "install", "setup", "deploy" | [workflows/install.md](workflows/install.md) |
62| 2, "modify", "add", "remove", "change" | [workflows/modify.md](workflows/modify.md) |
63| 3, "test", "verify", "check" | [workflows/test.md](workflows/test.md) |
64| 4, "list", "view", "show" | [workflows/list.md](workflows/list.md) |
65
66**Direct command routing (skip menu):**
67- "add ~/.credentials to zero access" → Execute directly, then restart reminder
68- "block npm publish command" → Execute directly, then restart reminder
69- "protect /secrets folder" → Execute directly, then restart reminder
70
71**After reading the workflow, follow it exactly.**
72</routing>
73
74<blocked_commands_summary>
75**Destructive file operations:**
76- `rm -rf`, `rm --recursive`, `sudo rm`
77- `chmod 777`, `chown -R root`
78
79**Git destructive:**
80- `git reset --hard`, `git push --force` (not --force-with-lease)
81- `git clean -fd`, `git stash clear`, `git filter-branch`
82
83**Cloud destructive:**
84- AWS: `terminate-instances`, `delete-db-instance`, `delete-stack`
85- GCP: `projects delete`, `instances delete`, `clusters delete`
86- Docker: `system prune -a`, `volume rm`
87- Kubernetes: `delete namespace`, `delete all --all`
88
89**Database destructive:**
90- `DELETE FROM table;` (no WHERE clause)
91- `DROP TABLE`, `DROP DATABASE`, `TRUNCATE TABLE`
92- `redis-cli FLUSHALL`, `dropdb`
93
94See [scripts/patterns.yaml](scripts/patterns.yaml) for complete list.
95</blocked_commands_summary>
96
97<settings_locations>
98| Level | Settings Path | Hooks Path | Scope |
99|-------|--------------|------------|-------|
100| Global | `~/.claude/settings.json` | `~/.claude/hooks/damage-control/` | All projects |
101| Project | `.claude/settings.json` | `.claude/hooks/damage-control/` | Team-shared |
102| Personal | `.claude/settings.local.json` | `.claude/hooks/damage-control/` | Just you |
103</settings_locations>
104
105<runtime_requirements>
106**Python with UV (Recommended):**
107```bash
108# macOS/Linux
109curl -LsSf https://astral.sh/uv/install.sh | sh
110
111# Windows
112powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
113```
114
115**TypeScript with Bun (Alternative):**
116```bash
117# macOS/Linux
118curl -fsSL https://bun.sh/install | bash && bun add yaml
119
120# Windows
121powershell -c "irm bun.sh/install.ps1 | iex" && bun add yaml
122```
123</runtime_requirements>
124
125<critical_reminder>
126**IMPORTANT:** After any installation or modification:
127
128> **Restart your agent for changes to take effect.**
129
130Hooks are only loaded at agent startup. Run `/hooks` after restart to verify.
131</critical_reminder>
132
133<workflows_index>
134| Workflow | Purpose |
135|----------|---------|
136| [workflows/install.md](workflows/install.md) | Interactive installation at any settings level |
137| [workflows/modify.md](workflows/modify.md) | Add/remove protected paths and blocked commands |
138| [workflows/test.md](workflows/test.md) | Validate all hooks are working correctly |
139| [workflows/list.md](workflows/list.md) | View all active protections |
140</workflows_index>
141
142<scripts_index>
143| Script | Purpose |
144|--------|---------|
145| [scripts/bash-tool-damage-control.py](scripts/bash-tool-damage-control.py) | PreToolUse hook for Bash commands |
146| [scripts/edit-tool-damage-control.py](scripts/edit-tool-damage-control.py) | PreToolUse hook for Edit tool |
147| [scripts/write-tool-damage-control.py](scripts/write-tool-damage-control.py) | PreToolUse hook for Write tool |
148| [scripts/test-damage-control.py](scripts/test-damage-control.py) | Test runner for hook validation |
149| [scripts/patterns.yaml](scripts/patterns.yaml) | Security patterns and protected paths |
150| [scripts/settings-template.json](scripts/settings-template.json) | Hook configuration template |
151</scripts_index>
152
153<success_criteria>
154A working damage-control installation has:
155
156- Hooks installed at chosen level (global/project/personal)
157- `patterns.yaml` copied alongside hook scripts
158- `settings.json` updated with PreToolUse hook configuration
159- UV (or Bun) runtime installed
160- Agent restarted to load hooks
161- Verified with `/hooks` command showing damage-control hooks
162- Tested with `rm -rf /tmp/test` (should be blocked)
163</success_criteria>
cfircoo