# Destructive Command Guard — Block Dangerous Shell Commands from AI Agents

> A Rust CLI tool that intercepts and blocks dangerous git and shell commands before AI coding agents can execute them. Prevents accidental force pushes, hard resets, and destructive operations.

## Install

Save in your project root:

# Destructive Command Guard — Block Dangerous Shell Commands from AI Agents

## Quick Use
```bash
cargo install destructive-command-guard
# Add as a git hook or shell wrapper
dcg wrap -- git push --force
```

## Introduction
Destructive Command Guard (DCG) is a lightweight Rust tool that acts as a safety layer between AI coding agents and your shell. It intercepts commands before execution, checks them against a configurable blocklist of destructive patterns, and prevents accidental data loss from force pushes, hard resets, and file deletions.

## What DCG Does
- Intercepts shell commands before execution and checks for destructive patterns
- Blocks dangerous git operations like force push, reset --hard, and clean -fd
- Prevents accidental rm -rf and other file system destructive commands
- Provides configurable allow/deny lists for fine-grained control
- Logs blocked commands for audit and review

## Architecture Overview
DCG is a single static Rust binary with zero dependencies. It operates as a command wrapper or shell hook, parsing the command line before passing it to the underlying shell. Pattern matching uses a compiled rule set that evaluates in microseconds, adding negligible latency to command execution.

## Self-Hosting & Configuration
- Install via cargo: `cargo install destructive-command-guard`
- Or download prebuilt binaries from GitHub releases
- Configure rules in `~/.config/dcg/rules.toml`
- Integrate as a git hook or shell alias
- Set environment-specific overrides for CI/CD pipelines

## Key Features
- Zero-dependency single binary written in Rust
- Sub-millisecond command evaluation overhead
- Configurable rules with allow and deny patterns
- Works with any AI coding agent that executes shell commands
- Audit logging of all blocked commands

## Comparison with Similar Tools
- **Git hooks** — Per-repo only; DCG protects globally across all repos
- **Shell aliases** — Easy to bypass; DCG wraps the actual binary
- **Husky** — JS-specific git hooks; DCG is language-agnostic
- **pre-commit** — Runs checks on staged files; DCG blocks dangerous commands themselves

## FAQ
**Q: Does DCG add latency to commands?**
A: Negligible. Rule evaluation takes microseconds since patterns are compiled at startup.

**Q: Can I allow specific destructive commands?**
A: Yes, configure allow rules in rules.toml to permit specific patterns when needed.

**Q: Does it work with Claude Code, Codex, etc.?**
A: Yes, DCG works with any tool that executes shell commands, including all major AI coding agents.

**Q: What happens when a command is blocked?**
A: DCG prints a warning explaining why the command was blocked and exits with a non-zero status code.

## Sources
- https://github.com/Dicklesworthstone/destructive_command_guard

---
Source: https://tokrepo.com/en/workflows/asset-46c76857
Author: AI Open Source