{"slug": "show-hn-a-pre-execution-guard-that-stops-ai-agents-running-destructive-commands", "title": "Show HN: A pre-execution guard that stops AI agents running destructive commands", "summary": "A developer released a ~60-line shell hook that blocks AI coding agents from running irreversible commands like `git reset --hard`, `rm -rf`, and `DROP TABLE`, exiting with code 2 and writing the reason to stderr so agent CLIs surface the command to the human. The tool, which works with Claude Code's PreToolUse hook and any agent CLI that respects exit codes, is designed for well-intentioned models having a bad moment, not hostile ones, and complements server-side protections like branch protection and backups.", "body_md": "Your coding agent will eventually run `git reset --hard`\n\n, force-push to main, or\ndrop a table. Not because it's careless — because it's confident, and the loop\ndrifted three steps ago.\n\n** Try it in your browser →** — paste any command, see whether it would be blocked and by which rule. Nothing is sent anywhere; the rules run locally.\n\nThis is a ~60-line shell hook that stops the commands you can't undo. It runs before every shell command the agent proposes, exits 2 to deny, and writes the reason to stderr — which agent CLIs feed back into the loop, so the agent stops retrying and surfaces the command to you instead.\n\n```\nBLOCKED by guard [discard all local changes (git reset --hard)]\n  command: git reset --hard HEAD~3\n  This one is gated to the human. Do not retry, do not reword.\n  Surface the exact command and let the human run it.\nbash install.sh          # merges a PreToolUse hook into .claude/settings.json\nbash test-guard.sh       # 6 assertions, should be 6 passed / 0 failed\n```\n\nWorks with Claude Code's `PreToolUse`\n\nhook, and with any agent CLI that runs a\nshell hook before a tool call and respects its exit code. Requires `bash`\n\n,\n`grep -E`\n\n, and `python3`\n\n.\n\n`git reset --hard`\n\n· `rm -rf`\n\n· `git clean -f/-x`\n\n· `git checkout .`\n\n·\n`git filter-branch`\n\n· force-push to main/master/production · `DROP TABLE`\n\n·\n`TRUNCATE`\n\n· `FLUSHALL`\n\n· `aws delete-*`\n\n/`terminate-*`\n\n· `kubectl delete`\n\n·\n`terraform destroy`\n\n· `docker … prune`\n\n· `chmod 777`\n\n· `curl … | sh`\n\n·\nraw writes to `/dev/sd*`\n\n.\n\nRules live in one array at the top of the script as `label@@regex`\n\npairs. Edit\nthem. Add a test case when you do — including a benign command the new pattern\nmust *not* catch. That's how you find an over-greedy regex before it finds you.\n\n**It stops:** a confident agent proposing an irreversible command in plain text, which is the\nfailure mode I actually hit — the loop drifted three steps ago and the next command discards a\nday's work.\n\n**It does not stop:** anything deliberately evading it. `g\"\"it reset --hard`\n\n, a base64 payload\nthrough `eval`\n\n, a shell script, an alias. The matcher is a regex over the proposed command string,\nand a regex loses to an adversary every time.\n\nThat distinction is the whole threat model, and it is worth being blunt about: if your agent is obfuscating commands to get around a hook you installed, a pattern list is not your problem. This assumes a well-intentioned model having a bad moment, not a hostile one.\n\nIt also does not replace the things that are strictly more reliable because they sit outside your machine: server-side branch protection, least-privilege credentials, and backups. Nothing here is a substitute for any of those. Use them, and use this for the irreversible operations they do not cover — a hard reset on uncommitted work, a recursive delete, a dropped table, a destroyed stack.\n\nA seatbelt, not a rollcage.\n\n**It matches the whole command string, arguments included.** So a commit message\nthat quotes a gated phrase gets blocked. That's deliberate: the alternative is\nparsing shell quoting, expansion and `eval`\n\n, and every parser is a new way to\nslip a command past the guard. Fail-safe beats clever. The habit that fixes it:\n`git commit -F .commit-msg`\n\ninstead of `-m \"…\"`\n\n, never a heredoc.\n\n**It fails closed.** If it can't read the command out of the hook payload, it\nblocks. A guard that silently degrades to \"allow everything\" is worse than no\nguard, because you'd stop watching.\n\nDestructive commands and *external-effect* commands are different problems.\n\n**Tier 1**—`rm -rf`\n\n,`reset --hard`\n\n,`DROP TABLE`\n\n. Unrecoverable. Never negotiable, no unlock, not even for you-in-a-hurry. This repo is tier 1.**Tier 2**—`git push`\n\n,`npm publish`\n\n, deploys, migrations. Real effects, but reviewable and reversible. These shouldn't be*banned*— they should be gated, unlockable by a human for a short window that auto-relocks.\n\nTier 2 is where the design gets interesting: the unlock has to be something the agent can't touch, including refreshing its timestamp to extend the window or deleting it to hide that it was used.\n\nThe full kit adds tier 2 with the time-boxed unlock, a config file, a git\npre-push hook, an isolation workflow, a merge gate that catches prompt\nregressions with a deterministic grader, and the incident write-ups behind each\nrule: [https://andevan.gumroad.com/l/agent-control-kit](https://andevan.gumroad.com/l/agent-control-kit)\n\nMIT licensed. Take it, fork it, ship it in your own tooling.", "url": "https://wpnews.pro/news/show-hn-a-pre-execution-guard-that-stops-ai-agents-running-destructive-commands", "canonical_source": "https://github.com/vandith1/agent-guard", "published_at": "2026-08-16 12:53:51+00:00", "updated_at": "2026-08-16 13:10:53.225371+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-agents"], "entities": ["Claude Code"], "alternates": {"html": "https://wpnews.pro/news/show-hn-a-pre-execution-guard-that-stops-ai-agents-running-destructive-commands", "markdown": "https://wpnews.pro/news/show-hn-a-pre-execution-guard-that-stops-ai-agents-running-destructive-commands.md", "text": "https://wpnews.pro/news/show-hn-a-pre-execution-guard-that-stops-ai-agents-running-destructive-commands.txt", "jsonld": "https://wpnews.pro/news/show-hn-a-pre-execution-guard-that-stops-ai-agents-running-destructive-commands.jsonld"}}