feat(hooks): dangerous-actions-blocker — PreToolUse hook for Claude Code

[ousamabenyounes]

Summary

A ready-to-use PreToolUse Bash hook that intercepts dangerous CLI operations before AI agents execute them. Ships as a copyable file in hooks/claude/.

Discussion: #1007 — opening this draft PR alongside the issue so the team can review the actual implementation while we discuss scope and approach. Happy to adapt based on feedback.

What it does

Category	Example	Decision
Files	rm -rf /, rm -rf ~	🚫 block
Files	rm -rf mydir (not a safe dir)	⚠️ ask
Git	git push --force	🚫 block (allows --force-with-lease)
Git	git reset --hard, git clean -f, git branch -D	⚠️ ask
Secrets	cat .env, reading .pem/.key files	🚫 block
Database	DROP TABLE, TRUNCATE, DELETE FROM x;	🚫 block
Docker	docker system prune -a, mass removal	⚠️ ask

Container-aware: Commands inside docker exec / kubectl exec skip host-path checks (paths resolve in the container, not the host).

Usage

// .claude/settings.json
{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash", "hooks": ["bash hooks/claude/dangerous-actions-blocker.sh"] }
    ]
  }
}

Open questions (see #1007)

1. Is this in scope for RTK or better as a separate project?
2. Should this use Rust-based parsing instead of regex?
3. What should be the default block vs ask decisions?

Test plan

• Manual testing with Claude Code on destructive commands
• Container exec false-positive fix verified

🤖 Generated with Claude Code