Destructive Command Guard (dcg)

What it is

dcg (destructive_command_guard) is a compiled hook binary that AI coding agents call before running shell commands; it blocks destructive ones (git reset --hard, rm -rf, DROP TABLE, kubectl delete namespace) and returns a reason plus a safer alternative. Beyond the agents in the summary, native integrations now cover Antigravity CLI (agy), OpenCode, Oh My Pi (omp), Crush, Posit Assistant, Hermes Agent, and Grok (xAI). It began as a Python script by Jeffrey Emanuel.

How it works

The agent invokes dcg on each command; dcg matches it against enabled rule "packs" and either allows or emits a denial in the agent's expected output format. It auto-detects which agent is calling (e.g. Codex payloads are identified by a non-empty turn_id, and dcg emits only Codex's documented denial fields because Codex rejects unknown fields — otherwise a block would surface as a failed hook rather than a block).

What to do

Install (Linux/macOS/WSL):

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh?$(date +%s)" | bash -s -- --easy-mode

Native Windows (PowerShell), with checksum/signature verification:

& ([scriptblock]::Create((irm "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.ps1"))) -EasyMode -Verify

On Windows the windows.filesystem and windows.system packs are on by default, blocking del /s, rd /s, Remove-Item -Recurse, format, and vssadmin delete shadows. Pin a version with -Version vX.Y.Z. Use -RequireMinisign to fail closed if the signature sidecar or verifier is unavailable.

Enable packs in ~/.config/dcg/config.toml:

[packs]
enabled = [
    "database.postgresql",
    "kubernetes.kubectl",
    "cloud.aws",
    "containers.docker",
]

Caveats

• trust_level does nothing to rule evaluation. The page states it is an advisory label recorded only in JSON/logs. Actual behavior comes from the other profile fields — additional_allowlist, disabled_packs, extra_packs, disabled_allowlist. Do not treat a trust_level = "high" label as a security setting.
• "paranoid" is a graduation mode, not a pack — enable the real strict_git pack for stricter git rules. Use IDs from dcg packs.
• Coverage is uneven: Aider is git-hooks only, and Continue is detection only (no blocking).
• Codex CLI support requires 0.125.0+.
• The default install is a curl | bash pipe with a cache-busting query string; review the script if that pattern concerns you.