Git Safety Guardrails

Install and maintain deterministic pre-execution guardrails that intercept and block dangerous, destructive, or history-rewriting Git commands before autonomous agents can execute them.

Core Invariants

1. Deterministic Interception: Automatically block destructive Git commands (git push --force, git reset --hard, git clean -f/-fd, git branch -D, git checkout ., git restore .) before execution.
2. Explicit Authority Gate: Intercepted commands return an explicit non-zero exit code notifying the agent that it lacks authority to execute destructive operations.
3. Scope Clarification: Always ask the user whether to apply guardrails locally to the project (.claude/settings.json) or globally (~/.claude/settings.json).
4. Settings Merge Safety: Seamlessly merge guardrail hooks into existing PreToolUse configurations without overwriting other tools or settings.
5. Mandatory Interception Test: Verify that the safety hook triggers correctly on simulated forbidden commands before concluding setup.

Architecture & Map of Content (MOC)