Destructive Command Guard
A high-performance Claude Code hook that intercepts and blocks destructive commands before they execute. Written in Rust with SIMD-accelerated filtering via the memchr crate and Aho-Corasick multi-pattern matching for sub-millisecond latency. Assumes agents are well-intentioned but fallible.
Overview
DCG uses a whitelist-first architecture: safe patterns are checked before destructive patterns, and unrecognized commands are allowed by default (fail-safe). This ensures legitimate workflows are never broken while known dangerous patterns are always blocked. DCG runs as a PreToolUse hook in Claude Code, receiving JSON on stdin for each Bash tool invocation and returning exit code 0 (allow) or 2 (block). It only inspects direct Bash tool invocations, not contents of shell scripts.
The processing pipeline has four stages: JSON parsing, command normalization (strips absolute paths like /usr/bin/git), SIMD quick-reject filter (skips regex for commands without git or rm), and pattern matching. The memchr crate provides hardware-accelerated substring search (SSE2/AVX2 on x86_64, NEON on ARM), while Aho-Corasick handles multi-pattern matching in O(n) time regardless of pattern count.
DCG supports 49+ modular security packs organized by category (git, filesystem, databases, containers, Kubernetes, cloud providers, infrastructure tools). Core packs (core.git, core.filesystem) are always enabled; additional packs are configured via ~/.config/dcg/config.toml or the DCG_PACKS environment variable. The dcg scan subcommand can also audit files for destructive command contexts, suitable for CI integration.
DCG is not published on crates.io; it is installed from GitHub via cargo +nightly install or prebuilt binaries for Linux, macOS, and Windows WSL. The threat model assumes agents are well-intentioned but fallible; DCG catches honest mistakes, not adversarial attacks.
Quick Reference
| Category |
Blocked Commands |
| Uncommitted work |
git reset --hard, git checkout -- <file>, git restore <file>, git clean -f |
| Remote history |
git push --force / -f, git branch -D |
| Stashed work |
git stash drop, git stash clear |
| Filesystem |
rm -rf (outside /tmp, /var/tmp, $TMPDIR) |
| Category |
Allowed Commands |
| Safe git |
git status, git log, git diff, git add, git commit, git push, git pull, git fetch, git branch -d, git stash, git stash pop |
| Safe patterns |
git checkout -b, git restore --staged, git clean -n, git push --force-with-lease |
| Temp dirs |
rm -rf /tmp/*, rm -rf $TMPDIR/* |
| Setting |
Value |
| Exit code (safe) |
0 |
| Exit code (blocked) |
2 |
| Default behavior |
Allow (fail-safe) |
| Pattern priority |
Safe checked first, then destructive |
| Safe patterns |
34 |
| Destructive patterns |
16 |
| Pack Category |
Examples |
| Core (default) |
core.git, core.filesystem |
| Database |
database.postgresql, database.mysql, database.mongodb |
| Containers |
containers.docker, containers.compose, containers.podman |
| Kubernetes |
kubernetes.kubectl, kubernetes.helm, kubernetes.kustomize |
| Cloud |
cloud.aws, cloud.gcp, cloud.azure |
| Infrastructure |
infrastructure.terraform, infrastructure.ansible |
| System |
system.disk, system.permissions, system.services |
| Other |
strict_git, package_managers |
| Environment Variable |
Purpose |
DCG_PACKS |
Enable packs (comma-separated) |
DCG_DISABLE |
Disable specific packs |
DCG_VERBOSE |
Verbose output |
DCG_BYPASS |
Bypass DCG entirely (escape hatch) |
DCG_COLOR |
Color mode (auto, always, never) |
| Installation Method |
Command |
| Quick install |
curl -fsSL ".../install.sh" | bash -s -- --easy-mode |
| From source |
cargo +nightly install --git https://github.com/Dicklesworthstone/destructive_command_guard destructive_command_guard |
| Prebuilt binaries |
Linux x86_64, Linux ARM64, macOS Intel, macOS Apple Silicon, Windows WSL |
| Processing Stage |
Description |
| JSON parsing |
Reads PreToolUse hook input, allows non-Bash tools |
| Normalization |
Strips absolute paths (/usr/bin/git becomes git) |
| SIMD quick-reject |
memchr substring search skips regex for irrelevant commands |
| Pattern matching |
Safe patterns first, then destructive, default allow |
Common Mistakes
| Mistake |
Correct Pattern |
| Forgetting to restart Claude Code after adding the hook |
Always restart Claude Code after modifying ~/.claude/settings.json |
Using DCG_BYPASS=1 permanently in shell profile |
Only set bypass temporarily for a single command, then remove it |
| Assuming DCG inspects commands inside scripts |
DCG only inspects direct Bash tool invocations, not contents of ./deploy.sh |
Blocking git branch -d (lowercase) thinking it is destructive |
Lowercase -d is safe (merge-checked); only uppercase -D force-deletes |
| Not enabling database or cloud packs for production environments |
Configure relevant packs in ~/.config/dcg/config.toml for your stack |
| Expecting DCG to stop malicious actors |
DCG catches honest mistakes; determined users can always bypass the hook |
Running cargo install without nightly toolchain |
DCG requires Rust nightly (edition 2024); use cargo +nightly install |
Delegation
- Audit which destructive commands an agent session has attempted: Use
Explore agent
- Set up DCG with custom packs for a new project environment: Use
Task agent
- Plan a layered safety architecture combining DCG with other guardrails: Use
Plan agent
References
- Command detection and processing pipeline
- Pack configuration and environment variables
- Installation and Claude Code setup
- Safety patterns and edge cases
- Troubleshooting and FAQ
1---2name: destructive-command-guard3description: Blocks dangerous commands before execution via a Rust-based Claude Code hook. Use when configuring agent safety guards, setting up destructive command blocking, or auditing CLI protection rules. Use for git reset protection, rm -rf interception, force-push blocking, pack-based command filtering, and PreToolUse hook safety.4license: MIT5---6
7# Destructive Command Guard
8
9A high-performance Claude Code hook that intercepts and blocks destructive commands before they execute. Written in Rust with SIMD-accelerated filtering via the `memchr` crate and Aho-Corasick multi-pattern matching for sub-millisecond latency. Assumes agents are well-intentioned but fallible.
10
11## Overview
12
13DCG uses a whitelist-first architecture: safe patterns are checked before destructive patterns, and unrecognized commands are allowed by default (fail-safe). This ensures legitimate workflows are never broken while known dangerous patterns are always blocked. DCG runs as a `PreToolUse` hook in Claude Code, receiving JSON on stdin for each Bash tool invocation and returning exit code `0` (allow) or `2` (block). It only inspects direct Bash tool invocations, not contents of shell scripts.
14
15The processing pipeline has four stages: JSON parsing, command normalization (strips absolute paths like `/usr/bin/git`), SIMD quick-reject filter (skips regex for commands without `git` or `rm`), and pattern matching. The `memchr` crate provides hardware-accelerated substring search (SSE2/AVX2 on x86_64, NEON on ARM), while Aho-Corasick handles multi-pattern matching in O(n) time regardless of pattern count.
16
17DCG supports 49+ modular security packs organized by category (git, filesystem, databases, containers, Kubernetes, cloud providers, infrastructure tools). Core packs (`core.git`, `core.filesystem`) are always enabled; additional packs are configured via `~/.config/dcg/config.toml` or the `DCG_PACKS` environment variable. The `dcg scan` subcommand can also audit files for destructive command contexts, suitable for CI integration.
18
19DCG is not published on crates.io; it is installed from GitHub via `cargo +nightly install` or prebuilt binaries for Linux, macOS, and Windows WSL. The threat model assumes agents are well-intentioned but fallible; DCG catches honest mistakes, not adversarial attacks.
20
21## Quick Reference
22
23| Category | Blocked Commands |
24| ---------------- | ---------------------------------------------------------------------------------- |
25| Uncommitted work | `git reset --hard`, `git checkout -- <file>`, `git restore <file>`, `git clean -f` |
26| Remote history | `git push --force` / `-f`, `git branch -D` |
27| Stashed work | `git stash drop`, `git stash clear` |
28| Filesystem | `rm -rf` (outside `/tmp`, `/var/tmp`, `$TMPDIR`) |
29
30| Category | Allowed Commands |
31| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
32| Safe git | `git status`, `git log`, `git diff`, `git add`, `git commit`, `git push`, `git pull`, `git fetch`, `git branch -d`, `git stash`, `git stash pop` |
33| Safe patterns | `git checkout -b`, `git restore --staged`, `git clean -n`, `git push --force-with-lease` |
34| Temp dirs | `rm -rf /tmp/*`, `rm -rf $TMPDIR/*` |
35
36| Setting | Value |
37| -------------------- | ------------------------------------ |
38| Exit code (safe) | `0` |
39| Exit code (blocked) | `2` |
40| Default behavior | Allow (fail-safe) |
41| Pattern priority | Safe checked first, then destructive |
42| Safe patterns | 34 |
43| Destructive patterns | 16 |
44
45| Pack Category | Examples |
46| -------------- | --------------------------------------------------------------- |
47| Core (default) | `core.git`, `core.filesystem` |
48| Database | `database.postgresql`, `database.mysql`, `database.mongodb` |
49| Containers | `containers.docker`, `containers.compose`, `containers.podman` |
50| Kubernetes | `kubernetes.kubectl`, `kubernetes.helm`, `kubernetes.kustomize` |
51| Cloud | `cloud.aws`, `cloud.gcp`, `cloud.azure` |
52| Infrastructure | `infrastructure.terraform`, `infrastructure.ansible` |
53| System | `system.disk`, `system.permissions`, `system.services` |
54| Other | `strict_git`, `package_managers` |
55
56| Environment Variable | Purpose |
57| -------------------- | ---------------------------------- |
58| `DCG_PACKS` | Enable packs (comma-separated) |
59| `DCG_DISABLE` | Disable specific packs |
60| `DCG_VERBOSE` | Verbose output |
61| `DCG_BYPASS` | Bypass DCG entirely (escape hatch) |
62| `DCG_COLOR` | Color mode (auto, always, never) |
63
64| Installation Method | Command |
65| ------------------- | ----------------------------------------------------------------------------------------------------------------------- |
66| Quick install | `curl -fsSL ".../install.sh" \| bash -s -- --easy-mode` |
67| From source | `cargo +nightly install --git https://github.com/Dicklesworthstone/destructive_command_guard destructive_command_guard` |
68| Prebuilt binaries | Linux x86_64, Linux ARM64, macOS Intel, macOS Apple Silicon, Windows WSL |
69
70| Processing Stage | Description |
71| ----------------- | ------------------------------------------------------------- |
72| JSON parsing | Reads `PreToolUse` hook input, allows non-Bash tools |
73| Normalization | Strips absolute paths (`/usr/bin/git` becomes `git`) |
74| SIMD quick-reject | `memchr` substring search skips regex for irrelevant commands |
75| Pattern matching | Safe patterns first, then destructive, default allow |
76
77## Common Mistakes
78
79| Mistake | Correct Pattern |
80| ---------------------------------------------------------------- | ----------------------------------------------------------------------------- |
81| Forgetting to restart Claude Code after adding the hook | Always restart Claude Code after modifying `~/.claude/settings.json` |
82| Using `DCG_BYPASS=1` permanently in shell profile | Only set bypass temporarily for a single command, then remove it |
83| Assuming DCG inspects commands inside scripts | DCG only inspects direct Bash tool invocations, not contents of `./deploy.sh` |
84| Blocking `git branch -d` (lowercase) thinking it is destructive | Lowercase `-d` is safe (merge-checked); only uppercase `-D` force-deletes |
85| Not enabling database or cloud packs for production environments | Configure relevant packs in `~/.config/dcg/config.toml` for your stack |
86| Expecting DCG to stop malicious actors | DCG catches honest mistakes; determined users can always bypass the hook |
87| Running `cargo install` without nightly toolchain | DCG requires Rust nightly (edition 2024); use `cargo +nightly install` |
88
89## Delegation
90
91- **Audit which destructive commands an agent session has attempted**: Use `Explore` agent
92- **Set up DCG with custom packs for a new project environment**: Use `Task` agent
93- **Plan a layered safety architecture combining DCG with other guardrails**: Use `Plan` agent
94
95## References
96
97- [Command detection and processing pipeline](references/command-detection.md)
98- [Pack configuration and environment variables](references/pack-configuration.md)
99- [Installation and Claude Code setup](references/installation.md)
100- [Safety patterns and edge cases](references/safety-patterns.md)
101- [Troubleshooting and FAQ](references/troubleshooting.md)
oakoss