git-guardrails-claude-code

Install a PreToolUse hook that matches the Bash tool and runs a script checking each command against dangerous patterns. The hook exits with code 2 and prints a BLOCKED message to stderr when a command like git push or git reset --hard is detected.

It blocks git push (including --force), git reset --hard, git clean -f and -fd, git branch -D, git checkout ., and git restore .. The pattern list lives in the shell script and can be edited to add or remove entries.

Yes. Copy the script to ~/.claude/hooks/ and register it in ~/.claude/settings.json instead of the project-level .claude/settings.json. The global hook then applies to every project you open with Claude Code.

Pipe a JSON payload like {"tool_input":{"command":"git push origin main"}} into the script. It should exit with code 2 and print a BLOCKED message to stderr; safe commands exit with code 0.

The hook relies on grep pattern matching against the command string, so obfuscated or aliased commands may bypass it. It also requires jq to parse the JSON input and only intercepts commands run through Claude Code's Bash tool.