git-guardrails-claude-code

Set up Git guardrails

Set up a PreToolUse hook to intercept and block dangerous Git commands before Claude executes them.

Commands that will be blocked

git push(all variants including --force )
git reset --hard
git clean -f / git clean -fd
git branch -D
git checkout . / git restore .

When a command is blocked, Claude will see a message telling it that it does not have permission to access these commands.

Steps

1. Ask about installation scope

Ask the user: install forthe current project only(.claude/settings.json), orall projects(~/.claude/settings.json）？

2. Copy the hook script

The packaged script is located at:scripts/block-dangerous-git.sh

Copy it to the target location according to the installation scope:

Project-level：.claude/hooks/block-dangerous-git.sh
Global：~/.claude/hooks/block-dangerous-git.sh

Use chmod +x to make it executable.

3. Add the hook to the settings file

Add it to the appropriate settings file:

Project-level（.claude/settings.json）：

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

Global（~/.claude/settings.json）：

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

If the settings file already exists, merge the hook into the existing hooks.PreToolUse array: do not overwrite other settings.

4. Ask about customization

Ask the user whether they need to add or remove any patterns from the block list. Edit the copied script as needed.

5. Verify

Run a quick test:

echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>

It should exit with code 2 and print a BLOCKED message to stderr.