dcg (Destructive Command Guard)

// Overview

Destructive Command Guard — `dcg` — is a hook that sits between an AI coding agent and your shell. The problem it addresses is narrow and familiar: agents occasionally run something like `git reset --hard`, `rm -rf ./src` or `DROP TABLE users`, and hours of uncommitted work disappear in a second. dcg intercepts the command before it executes, refuses the destructive ones, and explains why along with a safer alternative.

It is written in Rust for speed, since it runs on the critical path of every tool call — the project credits SIMD-accelerated filtering and lazily compiled regexes for sub-millisecond execution. Patterns are organised as a modular pack system of more than fifty packs grouped into categories: enabling a bare category such as `database` turns on every sub-pack beneath it, and single sub-packs can be dropped again. Out of the box it blocks dangerous git and filesystem commands with no configuration; on Windows the filesystem and system packs are on by default, so `del /s`, `rd /s`, `Remove-Item -Recurse`, `format` and `vssadmin delete shadows` are covered too. Beyond simple pattern matching it scans heredocs and inline scripts, classifies context and applies allowlists.

dcg detects which agent is calling it and can apply a per-agent profile that adds or removes packs, widens the allowlist, or ignores allowlists entirely for unknown callers. The supported list is long and hook-native where possible: Claude Code, Codex CLI 0.125.0+, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok, Antigravity CLI, OpenCode, Oh My Pi, Crush, Pi, Posit Assistant, with Aider (git hooks only) and Continue (detection only). Escape hatches are deliberate and graded: `DCG_BYPASS=1` for one command, an allow-once code printed in the block message, or a permanent allowlist entry with a recorded reason. The project began as a Python hook by Jeffrey Emanuel and was ported to Rust by Darin Gordon before being substantially expanded.

Distribution is security-conscious: the PowerShell installer verifies a mandatory SHA256 checksum, checks the release's minisign signature when minisign is present, and verifies Sigstore/cosign provenance when cosign and a trusted bundle are available.

// What it does

• Blocks destructive git, filesystem, database, Kubernetes, cloud and container commands before execution, with an explanation and a safer alternative
• 50+ modular rule packs organised into categories, enabled or disabled per category or per sub-pack in `~/.config/dcg/config.toml`
• Per-agent profiles: add or remove packs, extend the allowlist, or disable allowlist bypass entirely for unknown callers
• Native hook integration across Claude Code, Codex CLI, Gemini CLI, GitHub Copilot CLI, VS Code Copilot Chat, Cursor, Hermes Agent, Grok, OpenCode, Crush, Oh My Pi and more
• Sub-millisecond Rust implementation with SIMD-accelerated filtering, heredoc and inline-script scanning, and context classification
• Graded escape hatches — one-shot `DCG_BYPASS=1`, an allow-once code from the block message, or a permanent allowlist entry with a reason
• Installers verify a SHA256 checksum, plus minisign and Sigstore/cosign provenance when the tooling is available

// Getting started

The installer auto-detects your platform, downloads the right binary and wires up whichever supported agents it finds. It works on Linux, macOS and Windows (natively via PowerShell, or through WSL).

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.ps1"))) -EasyMode -Verify

dcg install --grok       # ~/.grok/hooks/dcg.json
dcg install --opencode   # tool.execute.before plugin
dcg install --crush      # hooks.PreToolUse in crush.json
dcg install --omp        # Oh My Pi tool_call extension

# ~/.config/dcg/config.toml
[packs]
enabled = [
    "database.postgresql",    # Blocks DROP TABLE, TRUNCATE
    "kubernetes.kubectl",     # Blocks kubectl delete namespace
    "cloud.aws",              # Blocks aws ec2 terminate-instances
    "containers.docker",      # Blocks docker system prune
]

DCG_BYPASS=1 <command>                              # single command
dcg allow-once <code>                               # code from the block message
dcg allowlist add core.git:reset-hard -r "reason"   # permanent

Commands and code are distilled from the project's own documentation — always check the official repo for the latest.

// When to use it

• Stopping a coding agent from destroying uncommitted work with `git reset --hard` or `rm -rf`
• Keeping agents away from production databases, Kubernetes namespaces and cloud resources via the database, kubernetes and cloud packs
• Running several different coding agents on one machine under one policy, with per-agent trust profiles
• Giving a less-trusted or unrecognised agent a stricter rule set and no allowlist bypass

// How dcg (Destructive Command Guard) compares

dcg (Destructive Command Guard) alongside other open-source guardrails & security tools AI/TLDR tracks, ranked by GitHub stars.