Dcg

dcg Plugin

Destructive Command Guard (dcg) blocks dangerous git and shell commands from being executed by agents. Provides headless test, explain, scan, and exception management with structured JSON output.

Commands

Command Safety

• dcg command test — Evaluate whether a command would be allowed or blocked
• dcg command explain — Explain why a command is blocked or allowed

Repository Scanning

• dcg repo scan — Scan repository for destructive commands embedded in files

Exceptions

• dcg exception allow-once — Create a temporary exception for a blocked command

Configuration

• dcg config packs — List enabled rule packs
• dcg config allowlist — Manage allowlist entries

Utility

• dcg self version — Print dcg version
• dcg _ _ — Passthrough to dcg CLI

Usage Examples

• "Would git reset --hard be blocked?"
• "Explain why rm -rf / is blocked"
• "Scan this repo for dangerous commands in scripts"
• "Test if kubectl delete namespace prod would be allowed"
• "List all enabled rule packs"

Installation

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode

Examples

# Test a command
dcg command test "rm -rf ./build"
dcg command test --format json "kubectl delete namespace prod"

# Test with a specific config
dcg command test --config .dcg.prod.toml "docker system prune"

# Test with extra packs enabled
dcg command test --with-packs containers.docker,database.postgresql "docker system prune"

# Explain a blocked command
dcg command explain "git reset --hard HEAD"
dcg command explain --format json "git reset --hard HEAD"
dcg command explain --verbose "rm -rf /tmp/build"

# Scan repository for destructive commands
dcg repo scan
dcg repo scan --format json
dcg repo scan ./my-project --format json

# Create a temporary exception
dcg exception allow-once ab12
dcg exception allow-once ab12 --single-use

# List enabled packs
dcg config packs --verbose
dcg config packs --format json

# List allowlist entries
dcg config allowlist list

Key Features

• Block dangerous git commands (force push, destructive reset, etc.)
• Block dangerous shell commands (rm -rf, recursive deletes, etc.)
• 40+ modular rule packs (core, containers, databases, cloud providers, etc.)
• Pattern matching with whitelist and blacklist
• JSON and token-efficient (toon) output formats
• CI/CD integration with exit codes (0=allow, 1=block)
• Repository scanning for destructive commands in committed files
• Temporary allow-once exceptions with short codes
• Configurable via .dcg.toml or DCG_CONFIG environment variable
• Sub-microsecond evaluation latency with SIMD-accelerated rejection

Output Formats

• pretty — Human-readable output with context and suggestions (default)
• json — Structured payload for scripts and CI pipelines
• toon — Token-efficient encoding for agent-to-agent pipelines

Notes

• dcg test exits with code 0 if allowed, 1 if blocked
• Use --format json for machine parsing in CI pipelines
• Add --no-color if parsers choke on ANSI output
• Config precedence: DCG_CONFIG env > project .dcg.toml > user/system config