destructive-command-guard

Destructive Command Guard

A high-performance Claude Code hook that intercepts and blocks destructive commands before they execute. Written in Rust with SIMD-accelerated filtering via the memchr crate and Aho-Corasick multi-pattern matching for sub-millisecond latency. Assumes agents are well-intentioned but fallible.

Overview

DCG uses a whitelist-first architecture: safe patterns are checked before destructive patterns, and unrecognized commands are allowed by default (fail-safe). This ensures legitimate workflows are never broken while known dangerous patterns are always blocked. DCG runs as a PreToolUse hook in Claude Code, receiving JSON on stdin for each Bash tool invocation and returning exit code 0 (allow) or 2 (block). It only inspects direct Bash tool invocations, not contents of shell scripts.

The processing pipeline has four stages: JSON parsing, command normalization (strips absolute paths like /usr/bin/git), SIMD quick-reject filter (skips regex for commands without git or rm), and pattern matching. The memchr crate provides hardware-accelerated substring search (SSE2/AVX2 on x86_64, NEON on ARM), while Aho-Corasick handles multi-pattern matching in O(n) time regardless of pattern count.

DCG supports 49+ modular security packs organized by category (git, filesystem, databases, containers, Kubernetes, cloud providers, infrastructure tools). Core packs (core.git, core.filesystem) are always enabled; additional packs are configured via ~/.config/dcg/config.toml or the DCG_PACKS environment variable. The dcg scan subcommand can also audit files for destructive command contexts, suitable for CI integration.

DCG is not published on crates.io; it is installed from GitHub via cargo +nightly install or prebuilt binaries for Linux, macOS, and Windows WSL. The threat model assumes agents are well-intentioned but fallible; DCG catches honest mistakes, not adversarial attacks.

Quick Reference

Category	Blocked Commands
Uncommitted work	git reset --hard, git checkout -- <file>, git restore <file>, git clean -f
Remote history	git push --force / -f, git branch -D
Stashed work	git stash drop, git stash clear
Filesystem	rm -rf (outside /tmp, /var/tmp, $TMPDIR)

Category	Allowed Commands
Safe git	git status, git log, git diff, git add, git commit, git push, git pull, git fetch, git branch -d, git stash, git stash pop
Safe patterns	git checkout -b, git restore --staged, git clean -n, git push --force-with-lease
Temp dirs	rm -rf /tmp/*, rm -rf $TMPDIR/*

Setting	Value
Exit code (safe)	0
Exit code (blocked)	2
Default behavior	Allow (fail-safe)
Pattern priority	Safe checked first, then destructive
Safe patterns	34
Destructive patterns	16

Pack Category	Examples
Core (default)	core.git, core.filesystem
Database	database.postgresql, database.mysql, database.mongodb
Containers	containers.docker, containers.compose, containers.podman
Kubernetes	kubernetes.kubectl, kubernetes.helm, kubernetes.kustomize
Cloud	cloud.aws, cloud.gcp, cloud.azure
Infrastructure	infrastructure.terraform, infrastructure.ansible
System	system.disk, system.permissions, system.services
Other	strict_git, package_managers

Environment Variable	Purpose
DCG_PACKS	Enable packs (comma-separated)
DCG_DISABLE	Disable specific packs
DCG_VERBOSE	Verbose output
DCG_BYPASS	Bypass DCG entirely (escape hatch)
DCG_COLOR	Color mode (auto, always, never)

Installation Method	Command
Quick install	curl -fsSL ".../install.sh" | bash -s -- --easy-mode
From source	cargo +nightly install --git https://github.com/Dicklesworthstone/destructive_command_guard destructive_command_guard
Prebuilt binaries	Linux x86_64, Linux ARM64, macOS Intel, macOS Apple Silicon, Windows WSL

Processing Stage	Description
JSON parsing	Reads PreToolUse hook input, allows non-Bash tools
Normalization	Strips absolute paths (/usr/bin/git becomes git)
SIMD quick-reject	memchr substring search skips regex for irrelevant commands
Pattern matching	Safe patterns first, then destructive, default allow

Common Mistakes

Mistake	Correct Pattern
Forgetting to restart Claude Code after adding the hook	Always restart Claude Code after modifying ~/.claude/settings.json
Using DCG_BYPASS=1 permanently in shell profile	Only set bypass temporarily for a single command, then remove it
Assuming DCG inspects commands inside scripts	DCG only inspects direct Bash tool invocations, not contents of ./deploy.sh
Blocking git branch -d (lowercase) thinking it is destructive	Lowercase -d is safe (merge-checked); only uppercase -D force-deletes
Not enabling database or cloud packs for production environments	Configure relevant packs in ~/.config/dcg/config.toml for your stack
Expecting DCG to stop malicious actors	DCG catches honest mistakes; determined users can always bypass the hook
Running cargo install without nightly toolchain	DCG requires Rust nightly (edition 2024); use cargo +nightly install

Delegation

• Audit which destructive commands an agent session has attempted: Use Explore agent
• Set up DCG with custom packs for a new project environment: Use Task agent
• Plan a layered safety architecture combining DCG with other guardrails: Use Plan agent

References

• Command detection and processing pipeline
• Pack configuration and environment variables
• Installation and Claude Code setup
• Safety patterns and edge cases
• Troubleshooting and FAQ