Git guardrails for Claude Code

Wire up a PreToolUse hook that inspects every Bash command Claude is about to run and refuses the destructive git operations before they touch the repository.

What the guard refuses

• git push in any form, including --force
• git reset --hard
• git clean -f and git clean -fd
• git branch -D
• git checkout . and git restore .

When a command matches, the hook exits with code 2 and Claude receives a message stating it is not permitted to run that command, so it stops rather than retrying.

Steps

1. Confirm the scope

Ask whether the guard should cover this project only (.claude/settings.json) or every project (~/.claude/settings.json). The answer decides where the script and the hook entry go.