git-guardrails-claude-code

Set Up Git Guardrails

Set up a PreToolUse hook that intercepts and blocks dangerous git commands before Claude executes them.

What Gets Blocked

git push(all variants including --force）
git reset --hard
git clean -f / git clean -fd
git branch -D
git checkout . / git restore .

When blocked, Claude sees a message telling it that it does not have permission to access these commands.

Steps

1. Ask About Scope

Ask the user: install forthis projectonly (.claude/settings.json) or forall projects(~/.claude/settings.json）？

2. Copy the Hook Script

The bundled script is located at:scripts/block-dangerous-git.sh

Copy it to the target location depending on scope:

Project：.claude/hooks/block-dangerous-git.sh
Global：~/.claude/hooks/block-dangerous-git.sh

Use chmod +x to make it executable.

3. Add the Hook to Settings

Add to the appropriate settings file:

Project（.claude/settings.json）：

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$CLAUDE_PROJECT_DIR\"/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

Global（~/.claude/settings.json）：

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "~/.claude/hooks/block-dangerous-git.sh"
          }
        ]
      }
    ]
  }
}

If the settings file already exists, merge the hook into the existing hooks.PreToolUse array—do not overwrite other settings.

4. Ask About Customization

Ask the user whether they want to add or remove any patterns from the blocklist. Edit the copied script accordingly.

5. Verify

Run a quick test:

echo '{"tool_input":{"command":"git push origin main"}}' | <path-to-script>

It should exit with code 2 and print the BLOCKED message on stderr.