Git guardrails

Install a best-effort PreToolUse filter for literal Git invocations in Bash tool calls. It requires Bash, Python 3, and Git. Keep block-dangerous-git.sh beside check-git.py.

The filter parses direct commands and command separators. It understands Git's -C, --git-dir, and --work-tree options. It does not interpret aliases, shell functions, wrapper programs, scripts, substitutions, or the full shell grammar. Use host permission controls for those forms. Passing this filter never grants authorization.

What gets blocked

• Literal git push, including global options before push
• git reset --hard
• git clean with force, including combined short flags
• git checkout with a path separator, ., or force; worktree git restore
• Forced branch deletion unless ancestry can be checked for an isolated literal command

What stays allowed

Worktree-based flows delete branches and worktrees as routine cleanup, so the hook deliberately lets through: