git-guardrails-claude-code

Set Up Git Guardrails

Set up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

Blocked Commands

git push(all variants including --force )
git reset --hard
git clean -f / git clean -fd
git branch -D
git checkout . / git restore .

When blocked, Claude sees a message telling it that it does not have permission to access these commands.

Steps

1. Ask about scope

Ask the user: is thisthis project onlyinstallation (.claude/settings.json) orall projectsinstallation (~/.claude/settings.json）？

2. Copy the hook script

The packaged script is located at:scripts/block-dangerous-git.sh

Copy it to the destination based on scope:

Project level：.claude/hooks/block-dangerous-git.sh
Global level：~/.claude/hooks/block-dangerous-git.sh

Use chmod +x to grant execute permission.

3. Add the hook to settings

Add it to the corresponding settings file:

Project level（.claude/settings.json）：

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

Global level（~/.claude/settings.json）：

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

If the settings file already exists, merge the hook into the existing hooks.PreToolUse array—do not overwrite other settings.

4. Ask about customization

Ask the user whether they want to add or remove any patterns from the block list. Edit the copied script accordingly.

5. Verify

Run a quick test:

echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>

It should exit with exit code 2 and output a BLOCKED message to stderr.