Block dangerous Bash with a PreToolUse hook

The problem

Permission prompts help, but you want hard blocks for `rm -rf`, force-push, and similar commands.

The hack

Configure a PreToolUse command hook in settings that inspects Bash input and exits non-zero (or returns deny) on dangerous patterns.

Why it works

Hooks are deterministic—unlike CLAUDE.md suggestions—so safety gates always run.

Setup

1. Open project `.claude/settings.json` (or user settings). 2. Add a PreToolUse matcher for Bash that runs your guard script. 3. Have the script parse stdin JSON and fail on patterns like `rm -rf /`, `git push --force`, `mkfs`. 4. Run `/hooks` and intentionally try a blocked command to verify denial.

Additional details

Source