Stopping agents from running destructive git commands.

A coding agent that can run shell commands can run git reset --hard, and an instruction file saying "never do that" is a request, not a barrier. The reliable setup is layered: each layer covers the gaps of the one before.

Layer 1: say it in the rules

Put the boundary in CLAUDE.md or AGENTS.md in one line: ask before force pushes, hard resets, forced cleans and branch deletion. It costs almost nothing and covers the cases where the agent is simply unaware. It does not hold when the model forgets or is under pressure to get a clean test run.

Layer 2: permission rules

In Claude Code, deny rules are checked before ask and allow, so Bash(git push --force *) in the deny list and Bash(git push *) in the ask list does what it says. Know the limit: Bash rules match the command text. git -C . push --force or a command inside sh -c is different text. See the permissions guide for the details.

Layer 3: a hook that reads the command

A PreToolUse hook sees the command before it runs and can deny it, which covers variants a pattern list misses. The hooks guide has a working script. Claude Code hooks can also return ask; Codex hooks cannot, so there a guarded operation is denied and the agent is told to leave the prepared result for you. Three habits make a guard last:

Cover the bypasses. Agents under a failing hook will try to skip it. Ban --no-verify, git commit -n, LEFTHOOK=0, HUSKY=0 and attempts to change core.hooksPath.
Guard by repository. Some repositories need tighter limits than others: permitted commit branches, banned operations, and operations that need approval.
Roll out in log mode. Record what would be blocked for a week, check for false positives, then enforce, with a kill switch.

The CommonRig kit's shell guard works this way. Its policy file has a global list of banned git operations and per-repository guards:

{
  "global_banned_git": ["push --force", "reset --hard"],
  "git_guards": [
    {
      "id": "client-repo",
      "repo_regex": "(^|[\/])client-repo([\/]|$)",
      "commit_branches": ["feature/*", "fix/*"],
      "banned_git": ["rebase", "clean -f", "branch -D"],
      "approval_ops": ["git push", "git merge"]
    }
  ]
}

It splits command chains, treats quoted text and heredocs as data, recognises equivalent short flags, and checks git -C targets. A separate critical-operations gate asks (Claude) or denies (Codex) before recursive deletes of home or protected folders and disk or database destroyers. It is a conservative checker, not a sandbox: dynamic paths, command substitution and unknown wrappers pass.

Layer 4: protect the remote and the filesystem

Turn on branch protection on your git host so force pushes to main and release branches are refused server-side.
For a hard read-only boundary on a folder, use operating-system permissions or a sandbox, not a pattern.
Keep work recoverable. Committed work survives most mistakes through the reflog; uncommitted changes do not, so have agents commit or stash only where the brief allows it.

In subagent briefs

When an orchestrator hands work to subagents, the brief states the ban explicitly (add, commit, checkout, restore, reset, stash, clean, merge, rebase, worktree changes), and only the orchestrator commits, with scoped pathspecs. See parallel agents with worktrees.

Check your own files

Paste your CLAUDE.md or AGENTS.md into the free footprint scorer, or get the free sample and run rig doctor --lite locally. The hosted doctor check is A$0.50 a run and scores the whole setup, hooks included. The kit (A$10 once) has the rule source, generator, hooks and protocols these guides describe.