Dicklesworthstone/destructive_command_guard

**Learn more:** [github.com/steveyegge/beads](https://github.com/steveyegge/beads)

# Install Beads curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash

curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash

curl -sSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash

- **Documentation**: [github.com/steveyegge/beads/docs](https://github.com/steveyegge/beads/tree/main/docs)

- **Examples**: [github.com/steveyegge/beads/examples](https://github.com/steveyegge/beads/tree/main/examples)

- Commands like `rm --verbose --recursive --force target/` weren't matching

- Tested rm -rf build/target/dist - all correctly DENIED

- pack_aware_quick_reject_rm_commands_not_rejected: verifies rm -rf build/target/dist/node_modules NOT quick-rejected

- All rm -rf commands correctly blocked by core.filesystem

{"id":"bd-1e50","title":"P6.9: Implement detailed test logging for debugging failures","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:40:14.962143148Z","created_by":"ubuntu","updated_at":"2026-04-28T04:46:59.

{"id":"bd-1o5h","title":"cmd/pwsh reading piped or redirected stdin as commands is not guarded (executing-sink gap)","description":"Executing-sink gap: bare cmd/pwsh reading piped or redirected stdin as commands is not modeled, so a destruc

{"id":"bd-1pd8","title":"P3.5: Migrate progress.rs to rich_rust ProgressBar","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-19T21:09:47.843510239Z","created_by":"ubuntu","updated_at":"2026-01-21T19:41:18.818475684Z

{"id":"bd-1srj","title":"P4.3: Implement Tree visualization for explain command","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-19T21:11:53.227379280Z","created_by":"ubuntu","updated_at":"2026-01-21T18:31:23.218881

{"id":"bd-1tco","title":"Honor active CLAUDE_CONFIG_DIR across hook lifecycle and diagnostics (#541)","description":"Resolve non-empty CLAUDE_CONFIG_DIR consistently for user install, uninstall, doctor, self-heal and platform installers. Pr

{"id":"bd-23gx","title":"P6.4: Add fallback path tests - verify legacy output when rich-output disabled","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:15:25.371830903Z","created_by":"ubuntu","updated_at":"20

{"id":"bd-26hy","title":"Update all dependencies to latest stable versions","description":"## Rust Dependency Update for destructive_command_guard\n\n### Steps\n1. `cd /data/projects/destructive_command_guard`\n2. `cargo update` -- update w

{"id":"bd-298n","title":"P6.3: Create integration tests for full denial rendering pipeline","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:15:21.471328034Z","created_by":"ubuntu","updated_at":"2026-04-28T04:4

{"id":"bd-29s0","title":"Robot mode polish and remaining work","description":"## Robot Mode Polish - Remaining Work\n\n### Context\nThe core robot mode implementation (bd-7373) is complete. These polish items improve the agent experience.\n

[Credential-related source omitted]

[Credential-related source omitted]

{"id":"bd-2s08","title":"P6.6: Verify stdout/stderr separation remains intact for agent compatibility","status":"closed","priority":0,"issue_type":"task","created_at":"2026-01-19T21:15:32.449346029Z","created_by":"ubuntu","updated_at":"2026

{"id":"bd-2uor","title":"P7.5: Add AGENTS.md section on rich output and agent compatibility","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-19T21:16:26.375647950Z","created_by":"ubuntu","updated_at":"2026-04-28T07:

{"id":"bd-3dl3","title":"P2.5: Migrate TestResultBox.render_unicode() to rich_rust Panel","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:06:58.873946223Z","created_by":"ubuntu","updated_at":"2026-01-21T18:17:

{"id":"bd-3epj","title":"P5.3: Implement Markdown rendering for explanation text with rich_rust Markdown","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:14:22.392485464Z","created_by":"ubuntu","updated_at":"2

{"id":"bd-3epj","title":"P5.3: Implement Markdown rendering for explanation text with rich_rust Markdown","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:14:22.392485464Z","created_by":"ubuntu","updated_at":"2

{"id":"bd-3fs5","title":"P7.3: Update README.md with new rich output screenshots and docs","status":"closed","priority":2,"issue_type":"task","created_at":"2026-01-19T21:16:19.458335063Z","created_by":"ubuntu","updated_at":"2026-04-28T08:02

{"id":"bd-3w60","title":"Switch Linux release builds to musl for static binaries","description":"## Problem\n\nRelease binaries built on Ubuntu 24.04 (glibc 2.39) fail on Ubuntu 22.04 (glibc 2.35) and older with:\n  version 'GLIBC_2.39' not

{"id":"bd-3w60","title":"Switch Linux release builds to musl for static binaries","description":"## Problem\n\nRelease binaries built on Ubuntu 24.04 (glibc 2.39) fail on Ubuntu 22.04 (glibc 2.35) and older with:\n  version 'GLIBC_2.39' not

{"id":"bd-4gzt","title":"#570 fix (ec28682) left main uncompilable and regressed 4 lib tests; 3df4240 regressed 1","description":"## Summary\nCommit ec28682 (\"fix issue 570\") referenced `SkipReason::ExceededBodySize`, a variant that does 

{"id":"bd-5xgt","title":"core.filesystem rm-rf bypassed by balanced quotes inside an rm flag token (rm -r'f' /)","description":"BYPASS (corrected/narrowed): balanced quotes embedded WITHIN an rm flag token defeat core.filesystem's rm-rf det

[Credential-related source omitted]

{"id":"bd-bl3b","title":"Windows: default-on windows.* packs over-block POSIX commands in the Unknown dialect (dcg test/explain, corpus)","description":"Measured on a sandboxed native Windows 11 run (wlap) of the full suite @8e4c87c. All fa

{"id":"bd-hgm5","title":"DECISION: may an agent approve its own denial by default? (dcg allow-once <code> --yes)","description":"Measured 2026-09-24 at 6595a33, default config, sandboxed HOME: (1) hook denies git reset --hard and returns al

{"id":"bd-hqfv","title":"P6.2: Add unit tests for all new output components (DenialBox, TestResultBox, Tables)","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:15:16.994745952Z","created_by":"ubuntu","updated_

[Credential-related source omitted]

{"id":"bd-llgx","title":"P6.1: Create visual regression test infrastructure with screenshots","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:15:13.083182028Z","created_by":"ubuntu","updated_at":"2026-04-28T06

{"id":"bd-migo","title":"cleanup(core.filesystem): rm regexes are unanchored at the pack layer","description":"core.filesystem's rm rules use a bare `rm\\s+...` with no argv0 anchor, so at the PACK layer they match inside a longer word: pac

{"id":"bd-pwvp","title":"fix(core.filesystem): 'bq rm -r -f' attributed to rm-r-f-separate, not the bq rule","description":"'bq rm -r -f my_project:my_dataset' is blocked by core.filesystem:rm-r-f-separate rather than database.bigquery:bq-r

{"id":"bd-taet","title":"P6.10: Create golden file tests for JSON output stability","status":"closed","priority":0,"issue_type":"task","created_at":"2026-01-19T21:40:19.468957810Z","created_by":"ubuntu","updated_at":"2026-01-23T06:55:20.810

{"id":"bd-ti7z","title":"DECISION: three permission shapes system.permissions does not claim (non-recursive system dir, chattr, non-recursive setfacl -b)","description":"Carved out of bd-permission-unclaimed-shapes-tl37, whose fourth row tu

{"id":"bd-v9hh","title":"deferred-execution shell hooks run a blocked command: trap and PROMPT_COMMAND hold a command dcg treats as data","description":"Measured 2026-09-25, default config, real hook. Each command below was ALLOW:\n\n- trap

{"id":"bd-v9hh","title":"deferred-execution shell hooks run a blocked command: trap and PROMPT_COMMAND hold a command dcg treats as data","description":"Measured 2026-09-25, default config, real hook. Each command below was ALLOW:\n\n- trap

{"id":"bd-vweh","title":"Unquoted dynamic shell -c operand (sh -c $CMD) is not treated as an unverifiable launcher","description":"97522b2 made a wholly dynamic QUOTED -c script fail closed (heredoc.posix:inline-launcher-unverified): bash -

{"id":"bd-vweh","title":"Unquoted dynamic shell -c operand (sh -c $CMD) is not treated as an unverifiable launcher","description":"97522b2 made a wholly dynamic QUOTED -c script fail closed (heredoc.posix:inline-launcher-unverified): bash -

{"id":"bd-xbr4","title":"P6.8: Add performance benchmarks for hook mode latency (<50ms)","status":"closed","priority":1,"issue_type":"task","created_at":"2026-01-19T21:40:10.483771633Z","created_by":"ubuntu","updated_at":"2026-04-28T04:41:5

{"id":"bd-z3h5","title":"P6.7: Create E2E test script simulating full agent workflow","status":"closed","priority":0,"issue_type":"task","created_at":"2026-01-19T21:40:05.955877394Z","created_by":"ubuntu","updated_at":"2026-01-23T07:08:48.8

[Credential-related source omitted]

[Credential-related source omitted]

{"id":"git_safety_guard-001j","title":"[E7-T4] Implement config modification from interactive mode","description":"## Task: Implement config modification from interactive mode\n\n### Parent Epic\nEpic 7: Interactive Learning Mode (git_safet

{"id":"git_safety_guard-0umb","title":"[E4-T4] Create suggestion output formatter","description":"## Task: Create suggestion output formatter\n\n### Parent Epic\nEpic 4: Automatic Allowlist Suggestions (git_safety_guard-egdp)\n\n### What To

{"id":"git_safety_guard-0w9f","title":"[E5-T7] Comprehensive testing for Context-Aware Allowlisting","description":"## Comprehensive Unit & E2E Testing for Epic 5: Context-Aware Allowlisting\n\n### Overview\nTesting for path-specific and co

{"id":"git_safety_guard-0w9f","title":"[E5-T7] Comprehensive testing for Context-Aware Allowlisting","description":"## Comprehensive Unit & E2E Testing for Epic 5: Context-Aware Allowlisting\n\n### Overview\nTesting for path-specific and co

{"id":"git_safety_guard-0xe5","title":"[E3-T2] Curate suggestions for filesystem patterns","description":"## Task: Curate suggestions for filesystem patterns\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\

{"id":"git_safety_guard-0xe5","title":"[E3-T2] Curate suggestions for filesystem patterns","description":"## Task: Curate suggestions for filesystem patterns\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\

{"id":"git_safety_guard-130","title":"[PACK] cicd.circleci - CircleCI Pack","description":"# CircleCI Pack\n\n## Scope\nImplement pattern matching for CircleCI CLI and API operations.\n\n## Destructive Patterns\n- `circleci context remove-s

{"id":"git_safety_guard-1gt.1","title":"Add dcg explain (full decision trace; pretty/json/compact)","description":"## Objective\n\nShip an explainability mode that makes `dcg` trustworthy and debuggable:\n\n- `dcg explain \"<command>\"` (pr

{"id":"git_safety_guard-1gt.2","title":"Allowlist by stable rule ID (project/user allowlists + CLI)","description":"## Objective\n\nMake customization safe, ergonomic, and auditable by allowing users to allowlist specific rules via stable i

{"id":"git_safety_guard-1gt.3","title":"Add decision modes: block vs warn vs log-only","description":"## Objective\n\nReduce disruption by allowing less-confident detections to warn or log instead of hard-blocking, while keeping high-confid

{"id":"git_safety_guard-1gt.3.1","title":"Decision policy: define rule severity taxonomy + default modes","description":"## Objective\n\nDefine an explicit, documented severity taxonomy for rules, and map severity → default decision mode.\n

{"id":"git_safety_guard-1gt.5","title":"Suggestions DB: safe alternatives + how-to-allow guidance","description":"## Objective\n\nMake `dcg` helpful, not just restrictive, by attaching curated suggestions to blocked rules.\n\nWhen a command

{"id":"git_safety_guard-1gt.5.1","title":"Suggestions: data model + registry keyed by rule id","description":"## Objective\n\nDefine the suggestion data model and implement a registry lookup by stable rule id.\n\n## Background\n\nWhen DCG b

{"id":"git_safety_guard-1gt.5.5","title":"Suggestions: correctness and coverage tests","description":"## Objective\n\nPrevent suggestion drift and ensure suggestions remain helpful.\n\n## Tests\n\n- Coverage:\n  - assert that all patterns w

[Credential-related source omitted]

{"id":"git_safety_guard-1n85","title":"[Explain] Write explanations for core.filesystem patterns","description":"# Task: Write explanations for core.filesystem patterns\n\n## Parent Epic: Visual Explanations (git_safety_guard-r97e)\n\n## Ob

{"id":"git_safety_guard-1x7y","title":"Debug DCG evaluation trace on false positive example","description":"## Objective\n\nStep through DCG's execution line-by-line to understand exactly why it fails to recognize non-executable context in 

{"id":"git_safety_guard-1y6","title":"[PACK] cdn.fastly - Fastly CDN Pack","description":"# Fastly CDN Pack\n\n## Scope\nImplement pattern matching for Fastly CLI and API operations.\n\n## Destructive Patterns\n### fastly CLI\n- `fastly ser

{"id":"git_safety_guard-26f","title":"Define TypeScript destructive patterns for heredoc scanning","description":"## Objective\n\nDefine TypeScript heredoc patterns with a focus on **runtime destructive operations**, while avoiding low-sign

{"id":"git_safety_guard-2cu","title":"Design false positive reduction strategy for string arguments","description":"## Objective\n\nDesign and implement strategies to dramatically reduce false positives in command blocking, especially for d

{"id":"git_safety_guard-2d4","title":"Define Perl destructive patterns for heredoc scanning","description":"## Objective\n\nDefine Perl heredoc matchers that detect **high-signal destructive operations** while minimizing false positives.\n\

{"id":"git_safety_guard-2fma","title":"[Epic 6] Temporary/Expiring Allowlist Entries","description":"## EPIC 6: Temporary/Expiring Allowlist Entries\n\n### Background & Context\nUsers frequently need to run a dangerous command once—debuggin

{"id":"git_safety_guard-2j3","title":"Research tree-sitter Rust bindings","description":"# Research tree-sitter Rust Bindings\n\n## Objective\n\nEvaluate direct tree-sitter integration as an alternative to ast-grep CLI.\n\n## Background\n\n

{"id":"git_safety_guard-2py1","title":"[Epic 7] Interactive Learning Mode with Security Safeguards","description":"## EPIC 7: Interactive Learning Mode with Security Safeguards\n\n### Background & Context\nWhen dcg blocks a command, users m

{"id":"git_safety_guard-300","title":"Implement package.json scripts extractor","description":"## Objective\n\nImplement an extractor for package.json files to detect executable npm script contexts.\n\n## File Pattern\n\n- `package.json`\n\

{"id":"git_safety_guard-33xf","title":"EPIC: cross-segment data-flow analyzer (Approach B from nqhi.7)","description":"Tracks the more general cross-segment destructive-flow analyzer deferred from nqhi.7. nqhi.7 shipped Approach A (block an

{"id":"git_safety_guard-39k","title":"Add memory tests for hook input parsing and pattern evaluation","description":"# Task: Add Memory Tests for DCG Hot Paths\n\n## What to Do\n\nAdd comprehensive memory leak tests for all of DCG's critica

{"id":"git_safety_guard-39k","title":"Add memory tests for hook input parsing and pattern evaluation","description":"# Task: Add Memory Tests for DCG Hot Paths\n\n## What to Do\n\nAdd comprehensive memory leak tests for all of DCG's critica

{"id":"git_safety_guard-3a1","title":"[PACK] storage.s3 - AWS S3 Pack","description":"# AWS S3 Storage Pack - PROMOTED TO TIER 1\n\n## Why Tier 1 (Critical)\n**This pack was promoted from Tier 3 to Tier 1** because S3 is the most commonly u

{"id":"git_safety_guard-4kcu","title":"[E10-T2] Implement occurrence tracking (session state)","description":"## Task: Implement occurrence tracking (session state)\n\n### Parent Epic\nEpic 10: Graduated Response System (git_safety_guard-ye

{"id":"git_safety_guard-5dga","title":"[E5-T1] Design new allowlist config schema","description":"## Task: Design new allowlist config schema\n\n### Parent Epic\nEpic 5: Context-Aware Allowlisting (git_safety_guard-nuyf)\n\n### What To Do\n

[Credential-related source omitted]

{"id":"git_safety_guard-5rbb.8","title":"[Scan] Unit tests for GitHub Actions extractor","description":"# Task: Unit tests for GitHub Actions extractor\n\n## Purpose\nVerify GitHub Actions extractor behavior on supported syntax with determi

{"id":"git_safety_guard-5rbb.9","title":"[Scan] Add SARIF 2.1.0 output format","description":"# Task: Add SARIF 2.1.0 Output Format for Scan Mode\n\n## Background\n\nSARIF (Static Analysis Results Interchange Format) is the industry standar

{"id":"git_safety_guard-5rbb.9","title":"[Scan] Add SARIF 2.1.0 output format","description":"# Task: Add SARIF 2.1.0 Output Format for Scan Mode\n\n## Background\n\nSARIF (Static Analysis Results Interchange Format) is the industry standar

{"id":"git_safety_guard-699y","title":"[E3-T1] Add suggestions field to Pattern struct","description":"## Task: Add suggestions field to Pattern struct\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\n\n###

{"id":"git_safety_guard-69d7","title":"[E7-T7] Comprehensive testing for Interactive Learning Mode","description":"## Comprehensive Unit & E2E Testing for Epic 7: Interactive Learning Mode\n\n### Overview\nTesting for the interactive mode w

{"id":"git_safety_guard-69d7","title":"[E7-T7] Comprehensive testing for Interactive Learning Mode","description":"## Comprehensive Unit & E2E Testing for Epic 7: Interactive Learning Mode\n\n### Overview\nTesting for the interactive mode w

{"id":"git_safety_guard-6ao","title":"Feature: Codecov Cloud Integration for Coverage Trend Tracking","description":"# Feature: Codecov Cloud Integration\n\n## Background\n\nDCG currently generates coverage reports using `cargo-llvm-cov` an

{"id":"git_safety_guard-6g73","title":"[E1-T5] Implement JSON output mode","description":"## Task: Implement JSON output mode\n\n### Parent Epic\nEpic 1: Pattern Testing Tool (git_safety_guard-nimk)\n\n### What To Do\nImplement --json flag 

{"id":"git_safety_guard-6k3j","title":"perf: medium heredoc at 2.08ms is near Tier 4 panic threshold of 2ms","description":"full_pipeline/evaluate_command/medium_heredoc benchmarks at 2.08ms mean, which is at the Tier 4 (Heredoc Extract) pa

{"id":"git_safety_guard-6sg","title":"Design destructive pattern library structure","description":"# Design Destructive Pattern Library Structure\n\n## Objective\n\nDesign the structure and organization of language-specific destructive patt

{"id":"git_safety_guard-6ska","title":"[E6-T3] Add 'dcg allow' CLI command","description":"## Task: Add 'dcg allow' CLI command\n\n### Parent Epic\nEpic 6: Temporary/Expiring Allowlist Entries (git_safety_guard-2fma)\n\n### What To Do\nAdd 

{"id":"git_safety_guard-6t3b","title":"[E1-T1] Add 'test' subcommand to CLI","description":"## Task: Add 'test' subcommand to CLI\n\n### Parent Epic\nEpic 1: Pattern Testing Tool (git_safety_guard-nimk)\n\n### What To Do\nAdd a new 'test' s

{"id":"git_safety_guard-7bl0","title":"Research Codex CLI integration via MCP","status":"closed","priority":3,"issue_type":"task","created_at":"2026-01-12T03:29:46.164443926Z","created_by":"ubuntu","updated_at":"2026-01-12T15:07:26.04697647

{"id":"git_safety_guard-7cx","title":"[PACK] monitoring.datadog - Datadog Pack","description":"# Datadog Monitoring Pack\n\n## Scope\nImplement pattern matching for Datadog CLI and API operations.\n\n## Destructive Patterns\n### datadog-ci 

{"id":"git_safety_guard-7z4","title":"[PACK] apigateway.kong - Kong API Gateway Pack","description":"# Kong API Gateway Pack\n\n## Scope\nImplement pattern matching for Kong Gateway CLI and API operations.\n\n## Destructive Patterns\n### ko

{"id":"git_safety_guard-7zg","title":"Add UBS installation and run steps to CI workflow","description":"# Task: Add UBS Installation and Run Steps to CI\n\n## What to Do\n\nAdd two steps to the check job in .github/workflows/ci.yml:\n1. Ins

{"id":"git_safety_guard-7zg","title":"Add UBS installation and run steps to CI workflow","description":"# Task: Add UBS Installation and Run Steps to CI\n\n## What to Do\n\nAdd two steps to the check job in .github/workflows/ci.yml:\n1. Ins

{"id":"git_safety_guard-85p","title":"[PACK] monitoring.prometheus - Prometheus/Grafana Pack","description":"# Prometheus/Grafana Monitoring Pack\n\n## Scope\nImplement pattern matching for Prometheus and Grafana operations.\n\n## Destructi

{"id":"git_safety_guard-8kh4","title":"Add mkswap coverage to system.disk pack","description":"While implementing nqhi.8 (promote system.disk), discovered that `mkswap /dev/sdb` has no rule in the system.disk pack. mkswap formats a partitio

{"id":"git_safety_guard-8sjj","title":"[E10-T3] Implement cross-session tracking via history","description":"## Task: Implement cross-session tracking via history\n\n### Parent Epic\nEpic 10: Graduated Response System (git_safety_guard-yejh

{"id":"git_safety_guard-8u1","title":"[DESIGN] Architectural Decisions for Pack Implementation","description":"# Architectural Decisions for Pack Implementation\n\n## Overview\nBefore implementing new packs, several architectural decisions 

{"id":"git_safety_guard-8uh0","title":"[E7-T1] Design security safeguards for interactive mode","description":"## Task: Design security safeguards for interactive mode\n\n### Parent Epic\nEpic 7: Interactive Learning Mode (git_safety_guard-

{"id":"git_safety_guard-95ye","title":"[E4-T2] Implement history analysis queries","description":"## Task: Implement history analysis queries\n\n### Parent Epic\nEpic 4: Automatic Allowlist Suggestions (git_safety_guard-egdp)\n\n### What To

{"id":"git_safety_guard-96c","title":"Document new CI jobs in AGENTS.md","description":"# Task: Document New CI Jobs in AGENTS.md\n\n## What to Do\n\nUpdate AGENTS.md to document all new CI jobs added as part of the CI/CD Maturity epic. Thi

{"id":"git_safety_guard-96c8","title":"[Epic 3] Command Rewriting Suggestions","description":"## EPIC 3: Command Rewriting Suggestions\n\n### Background & Context\nWhen dcg blocks a command, users are left stuck. They know they can't run th

{"id":"git_safety_guard-99e.1","title":"BUG: Non-core packs are unreachable in hook mode (global quick reject)","description":"## Summary\n\nIn hook mode, `dcg` returns early for any command that does not contain `git` or `rm`, which makes 

{"id":"git_safety_guard-99e.12","title":"Normalization: strip common wrappers (sudo/env/command/\\git) safely","description":"## Objective\n\nImprove correctness and reduce bypasses/false negatives by normalizing common *wrapper prefixes* s

{"id":"git_safety_guard-99e.2","title":"Deterministic pack evaluation + return pattern identity","description":"## Objective\n\nMake allow/deny decisions **deterministic and debuggable** by:\n\n1. Evaluating enabled packs in a stable order.

{"id":"git_safety_guard-99e.6","title":"Extend e2e_test.sh to cover non-core packs (docker/k8s/db)","description":"## Objective\n\nMake the E2E suite reflect the actual feature set by adding coverage for non-core packs (Docker/Kubernetes/Da

{"id":"git_safety_guard-9ic","title":"[TIER-3] Valuable Pack Additions","notes":"Testing/Validation:\n- All Tier-3 pack additions must include unit tests plus e2e corpus scenarios with verbose logging via the shared harness.\n- Track covera

{"id":"git_safety_guard-9np","title":"Add Codecov coverage badge to README","description":"# Task: Add Codecov Coverage Badge to README\n\n## What to Do\n\nAdd a coverage badge to README.md that displays the current coverage percentage from

{"id":"git_safety_guard-9tw5","title":"[E1-T3] Expose detailed evaluation in evaluator","description":"## Task: Expose detailed evaluation in evaluator\n\n### Parent Epic\nEpic 1: Pattern Testing Tool (git_safety_guard-nimk)\n\n### What To 

{"id":"git_safety_guard-a21","title":"[PACK] search.elasticsearch - Elasticsearch Pack","description":"# Elasticsearch Pack\n\n## Scope\nImplement pattern matching for Elasticsearch REST API and CLI operations.\n\n## Destructive Patterns\n#

{"id":"git_safety_guard-a52","title":"Fix bypass: quoted command word lets destructive git/rm evade rules","description":"## Background / Motivation\n\nWe discovered a **false-negative bypass** where destructive commands are incorrectly all

{"id":"git_safety_guard-001j","title":"[E7-T4] Implement config modification from interactive mode","description":"## Task: Implement config modification from interactive mode\n\n### Parent Epic\nEpic 7: Interactive Learning Mode (git_safet

{"id":"git_safety_guard-0umb","title":"[E4-T4] Create suggestion output formatter","description":"## Task: Create suggestion output formatter\n\n### Parent Epic\nEpic 4: Automatic Allowlist Suggestions (git_safety_guard-egdp)\n\n### What To

{"id":"git_safety_guard-0w9f","title":"[E5-T7] Comprehensive testing for Context-Aware Allowlisting","description":"## Comprehensive Unit & E2E Testing for Epic 5: Context-Aware Allowlisting\n\n### Overview\nTesting for path-specific and co

{"id":"git_safety_guard-0w9f","title":"[E5-T7] Comprehensive testing for Context-Aware Allowlisting","description":"## Comprehensive Unit & E2E Testing for Epic 5: Context-Aware Allowlisting\n\n### Overview\nTesting for path-specific and co

{"id":"git_safety_guard-0xe5","title":"[E3-T2] Curate suggestions for filesystem patterns","description":"## Task: Curate suggestions for filesystem patterns\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\

{"id":"git_safety_guard-0xe5","title":"[E3-T2] Curate suggestions for filesystem patterns","description":"## Task: Curate suggestions for filesystem patterns\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\

{"id":"git_safety_guard-130","title":"[PACK] cicd.circleci - CircleCI Pack","description":"# CircleCI Pack\n\n## Scope\nImplement pattern matching for CircleCI CLI and API operations.\n\n## Destructive Patterns\n- `circleci context remove-s

{"id":"git_safety_guard-1gt.1","title":"Add dcg explain (full decision trace; pretty/json/compact)","description":"## Objective\n\nShip an explainability mode that makes `dcg` trustworthy and debuggable:\n\n- `dcg explain \"<command>\"` (pr

{"id":"git_safety_guard-1gt.2","title":"Allowlist by stable rule ID (project/user allowlists + CLI)","description":"## Objective\n\nMake customization safe, ergonomic, and auditable by allowing users to allowlist specific rules via stable i

{"id":"git_safety_guard-1gt.3","title":"Add decision modes: block vs warn vs log-only","description":"## Objective\n\nReduce disruption by allowing less-confident detections to warn or log instead of hard-blocking, while keeping high-confid

{"id":"git_safety_guard-1gt.3.1","title":"Decision policy: define rule severity taxonomy + default modes","description":"## Objective\n\nDefine an explicit, documented severity taxonomy for rules, and map severity → default decision mode.\n

{"id":"git_safety_guard-1gt.5","title":"Suggestions DB: safe alternatives + how-to-allow guidance","description":"## Objective\n\nMake `dcg` helpful, not just restrictive, by attaching curated suggestions to blocked rules.\n\nWhen a command

{"id":"git_safety_guard-1gt.5.1","title":"Suggestions: data model + registry keyed by rule id","description":"## Objective\n\nDefine the suggestion data model and implement a registry lookup by stable rule id.\n\n## Background\n\nWhen DCG b

{"id":"git_safety_guard-1gt.5.5","title":"Suggestions: correctness and coverage tests","description":"## Objective\n\nPrevent suggestion drift and ensure suggestions remain helpful.\n\n## Tests\n\n- Coverage:\n  - assert that all patterns w

[Credential-related source omitted]

{"id":"git_safety_guard-1n85","title":"[Explain] Write explanations for core.filesystem patterns","description":"# Task: Write explanations for core.filesystem patterns\n\n## Parent Epic: Visual Explanations (git_safety_guard-r97e)\n\n## Ob

{"id":"git_safety_guard-1x7y","title":"Debug DCG evaluation trace on false positive example","description":"## Objective\n\nStep through DCG's execution line-by-line to understand exactly why it fails to recognize non-executable context in 

{"id":"git_safety_guard-1y6","title":"[PACK] cdn.fastly - Fastly CDN Pack","description":"# Fastly CDN Pack\n\n## Scope\nImplement pattern matching for Fastly CLI and API operations.\n\n## Destructive Patterns\n### fastly CLI\n- `fastly ser

{"id":"git_safety_guard-26f","title":"Define TypeScript destructive patterns for heredoc scanning","description":"## Objective\n\nDefine TypeScript heredoc patterns with a focus on **runtime destructive operations**, while avoiding low-sign

{"id":"git_safety_guard-2cu","title":"Design false positive reduction strategy for string arguments","description":"## Objective\n\nDesign and implement strategies to dramatically reduce false positives in command blocking, especially for d

{"id":"git_safety_guard-2d4","title":"Define Perl destructive patterns for heredoc scanning","description":"## Objective\n\nDefine Perl heredoc matchers that detect **high-signal destructive operations** while minimizing false positives.\n\

{"id":"git_safety_guard-2fma","title":"[Epic 6] Temporary/Expiring Allowlist Entries","description":"## EPIC 6: Temporary/Expiring Allowlist Entries\n\n### Background & Context\nUsers frequently need to run a dangerous command once—debuggin

{"id":"git_safety_guard-2j3","title":"Research tree-sitter Rust bindings","description":"# Research tree-sitter Rust Bindings\n\n## Objective\n\nEvaluate direct tree-sitter integration as an alternative to ast-grep CLI.\n\n## Background\n\n

{"id":"git_safety_guard-2py1","title":"[Epic 7] Interactive Learning Mode with Security Safeguards","description":"## EPIC 7: Interactive Learning Mode with Security Safeguards\n\n### Background & Context\nWhen dcg blocks a command, users m

{"id":"git_safety_guard-300","title":"Implement package.json scripts extractor","description":"## Objective\n\nImplement an extractor for package.json files to detect executable npm script contexts.\n\n## File Pattern\n\n- `package.json`\n\

{"id":"git_safety_guard-39k","title":"Add memory tests for hook input parsing and pattern evaluation","description":"# Task: Add Memory Tests for DCG Hot Paths\n\n## What to Do\n\nAdd comprehensive memory leak tests for all of DCG's critica

{"id":"git_safety_guard-39k","title":"Add memory tests for hook input parsing and pattern evaluation","description":"# Task: Add Memory Tests for DCG Hot Paths\n\n## What to Do\n\nAdd comprehensive memory leak tests for all of DCG's critica

{"id":"git_safety_guard-3a1","title":"[PACK] storage.s3 - AWS S3 Pack","description":"# AWS S3 Storage Pack - PROMOTED TO TIER 1\n\n## Why Tier 1 (Critical)\n**This pack was promoted from Tier 3 to Tier 1** because S3 is the most commonly u

{"id":"git_safety_guard-4kcu","title":"[E10-T2] Implement occurrence tracking (session state)","description":"## Task: Implement occurrence tracking (session state)\n\n### Parent Epic\nEpic 10: Graduated Response System (git_safety_guard-ye

{"id":"git_safety_guard-5dga","title":"[E5-T1] Design new allowlist config schema","description":"## Task: Design new allowlist config schema\n\n### Parent Epic\nEpic 5: Context-Aware Allowlisting (git_safety_guard-nuyf)\n\n### What To Do\n

[Credential-related source omitted]

{"id":"git_safety_guard-5rbb.7","title":"[Scan] Unit tests for Makefile extractor","description":"# Task: Unit tests for Makefile extractor\n\n## Purpose\nVerify Makefile extractor behavior on supported syntax with deterministic unit tests.

{"id":"git_safety_guard-5rbb.8","title":"[Scan] Unit tests for GitHub Actions extractor","description":"# Task: Unit tests for GitHub Actions extractor\n\n## Purpose\nVerify GitHub Actions extractor behavior on supported syntax with determi

{"id":"git_safety_guard-5rbb.9","title":"[Scan] Add SARIF 2.1.0 output format","description":"# Task: Add SARIF 2.1.0 Output Format for Scan Mode\n\n## Background\n\nSARIF (Static Analysis Results Interchange Format) is the industry standar

{"id":"git_safety_guard-5rbb.9","title":"[Scan] Add SARIF 2.1.0 output format","description":"# Task: Add SARIF 2.1.0 Output Format for Scan Mode\n\n## Background\n\nSARIF (Static Analysis Results Interchange Format) is the industry standar

{"id":"git_safety_guard-699y","title":"[E3-T1] Add suggestions field to Pattern struct","description":"## Task: Add suggestions field to Pattern struct\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\n\n###

{"id":"git_safety_guard-69d7","title":"[E7-T7] Comprehensive testing for Interactive Learning Mode","description":"## Comprehensive Unit & E2E Testing for Epic 7: Interactive Learning Mode\n\n### Overview\nTesting for the interactive mode w

{"id":"git_safety_guard-69d7","title":"[E7-T7] Comprehensive testing for Interactive Learning Mode","description":"## Comprehensive Unit & E2E Testing for Epic 7: Interactive Learning Mode\n\n### Overview\nTesting for the interactive mode w

{"id":"git_safety_guard-6ao","title":"Feature: Codecov Cloud Integration for Coverage Trend Tracking","description":"# Feature: Codecov Cloud Integration\n\n## Background\n\nDCG currently generates coverage reports using `cargo-llvm-cov` an

{"id":"git_safety_guard-6g73","title":"[E1-T5] Implement JSON output mode","description":"## Task: Implement JSON output mode\n\n### Parent Epic\nEpic 1: Pattern Testing Tool (git_safety_guard-nimk)\n\n### What To Do\nImplement --json flag 

{"id":"git_safety_guard-6sg","title":"Design destructive pattern library structure","description":"# Design Destructive Pattern Library Structure\n\n## Objective\n\nDesign the structure and organization of language-specific destructive patt

{"id":"git_safety_guard-6ska","title":"[E6-T3] Add 'dcg allow' CLI command","description":"## Task: Add 'dcg allow' CLI command\n\n### Parent Epic\nEpic 6: Temporary/Expiring Allowlist Entries (git_safety_guard-2fma)\n\n### What To Do\nAdd 

{"id":"git_safety_guard-6t3b","title":"[E1-T1] Add 'test' subcommand to CLI","description":"## Task: Add 'test' subcommand to CLI\n\n### Parent Epic\nEpic 1: Pattern Testing Tool (git_safety_guard-nimk)\n\n### What To Do\nAdd a new 'test' s

{"id":"git_safety_guard-7bl0","title":"Research Codex CLI integration via MCP","status":"closed","priority":3,"issue_type":"task","created_at":"2026-01-11T22:29:46.164443926-05:00","created_by":"ubuntu","updated_at":"2026-01-12T10:07:26.046

{"id":"git_safety_guard-7cx","title":"[PACK] monitoring.datadog - Datadog Pack","description":"# Datadog Monitoring Pack\n\n## Scope\nImplement pattern matching for Datadog CLI and API operations.\n\n## Destructive Patterns\n### datadog-ci 

{"id":"git_safety_guard-7z4","title":"[PACK] apigateway.kong - Kong API Gateway Pack","description":"# Kong API Gateway Pack\n\n## Scope\nImplement pattern matching for Kong Gateway CLI and API operations.\n\n## Destructive Patterns\n### ko

{"id":"git_safety_guard-7zg","title":"Add UBS installation and run steps to CI workflow","description":"# Task: Add UBS Installation and Run Steps to CI\n\n## What to Do\n\nAdd two steps to the check job in .github/workflows/ci.yml:\n1. Ins

{"id":"git_safety_guard-7zg","title":"Add UBS installation and run steps to CI workflow","description":"# Task: Add UBS Installation and Run Steps to CI\n\n## What to Do\n\nAdd two steps to the check job in .github/workflows/ci.yml:\n1. Ins

{"id":"git_safety_guard-85p","title":"[PACK] monitoring.prometheus - Prometheus/Grafana Pack","description":"# Prometheus/Grafana Monitoring Pack\n\n## Scope\nImplement pattern matching for Prometheus and Grafana operations.\n\n## Destructi

{"id":"git_safety_guard-8sjj","title":"[E10-T3] Implement cross-session tracking via history","description":"## Task: Implement cross-session tracking via history\n\n### Parent Epic\nEpic 10: Graduated Response System (git_safety_guard-yejh

{"id":"git_safety_guard-8u1","title":"[DESIGN] Architectural Decisions for Pack Implementation","description":"# Architectural Decisions for Pack Implementation\n\n## Overview\nBefore implementing new packs, several architectural decisions 

{"id":"git_safety_guard-8uh0","title":"[E7-T1] Design security safeguards for interactive mode","description":"## Task: Design security safeguards for interactive mode\n\n### Parent Epic\nEpic 7: Interactive Learning Mode (git_safety_guard-

{"id":"git_safety_guard-95ye","title":"[E4-T2] Implement history analysis queries","description":"## Task: Implement history analysis queries\n\n### Parent Epic\nEpic 4: Automatic Allowlist Suggestions (git_safety_guard-egdp)\n\n### What To

{"id":"git_safety_guard-96c","title":"Document new CI jobs in AGENTS.md","description":"# Task: Document New CI Jobs in AGENTS.md\n\n## What to Do\n\nUpdate AGENTS.md to document all new CI jobs added as part of the CI/CD Maturity epic. Thi

{"id":"git_safety_guard-96c8","title":"[Epic 3] Command Rewriting Suggestions","description":"## EPIC 3: Command Rewriting Suggestions\n\n### Background & Context\nWhen dcg blocks a command, users are left stuck. They know they can't run th

{"id":"git_safety_guard-99e.1","title":"BUG: Non-core packs are unreachable in hook mode (global quick reject)","description":"## Summary\n\nIn hook mode, `dcg` returns early for any command that does not contain `git` or `rm`, which makes 

{"id":"git_safety_guard-99e.12","title":"Normalization: strip common wrappers (sudo/env/command/\\git) safely","description":"## Objective\n\nImprove correctness and reduce bypasses/false negatives by normalizing common *wrapper prefixes* s

{"id":"git_safety_guard-99e.2","title":"Deterministic pack evaluation + return pattern identity","description":"## Objective\n\nMake allow/deny decisions **deterministic and debuggable** by:\n\n1. Evaluating enabled packs in a stable order.

{"id":"git_safety_guard-99e.6","title":"Extend e2e_test.sh to cover non-core packs (docker/k8s/db)","description":"## Objective\n\nMake the E2E suite reflect the actual feature set by adding coverage for non-core packs (Docker/Kubernetes/Da

{"id":"git_safety_guard-9ic","title":"[TIER-3] Valuable Pack Additions","notes":"Testing/Validation:\n- All Tier-3 pack additions must include unit tests plus e2e corpus scenarios with verbose logging via the shared harness.\n- Track covera

{"id":"git_safety_guard-9np","title":"Add Codecov coverage badge to README","description":"# Task: Add Codecov Coverage Badge to README\n\n## What to Do\n\nAdd a coverage badge to README.md that displays the current coverage percentage from

{"id":"git_safety_guard-9tw5","title":"[E1-T3] Expose detailed evaluation in evaluator","description":"## Task: Expose detailed evaluation in evaluator\n\n### Parent Epic\nEpic 1: Pattern Testing Tool (git_safety_guard-nimk)\n\n### What To 

{"id":"git_safety_guard-a21","title":"[PACK] search.elasticsearch - Elasticsearch Pack","description":"# Elasticsearch Pack\n\n## Scope\nImplement pattern matching for Elasticsearch REST API and CLI operations.\n\n## Destructive Patterns\n#

{"id":"git_safety_guard-a52","title":"Fix bypass: quoted command word lets destructive git/rm evade rules","description":"## Background / Motivation\n\nWe discovered a **false-negative bypass** where destructive commands are incorrectly all

{"id":"git_safety_guard-advk","title":"TUI/CLI Visual Polish & Rich Terminal Output","description":"# Epic: TUI/CLI Visual Polish & Rich Terminal Output\n\n## Priority Score: 720/1000 (High Priority)\n\n## Background and Rationale\n\nDCG cu

{"id":"git_safety_guard-advk.7","title":"[TUI] Unit tests for output renderers","description":"# Task: Unit Tests for Output Renderers\n\n## Background\n\nThe TUI output module needs thorough unit testing to ensure correct rendering across 

{"id":"git_safety_guard-advk.8","title":"[TUI] E2E tests for rich output + CI fallback","description":"# Task: E2E Tests for Rich Output and CI Fallback\n\n## Background\n\nEnd-to-end tests verify the full output rendering pipeline works co

[Credential-related source omitted]

{"id":"git_safety_guard-ar9j","title":"[E6-T5] Add 'dcg allowlist list' command","description":"## Task: Add 'dcg allowlist list' command\n\n### Parent Epic\nEpic 6: Temporary/Expiring Allowlist Entries (git_safety_guard-2fma)\n\n### What T

{"id":"git_safety_guard-auhp","title":"[E8-T3] Implement branch-to-strictness mapping","description":"## Task: Implement branch-to-strictness mapping\n\n### Parent Epic\nEpic 8: Git Branch-Aware Strictness (git_safety_guard-1d6e)\n\n### Wha

{"id":"git_safety_guard-aw0","title":"Verify Codecov integration works end-to-end","description":"# Task: Verify Codecov Integration End-to-End\n\n## What to Do\n\nAfter implementing Codecov upload and configuration, verify the integration 

{"id":"git_safety_guard-b6vb","title":"Auto-Install & AI Agent Detection","description":"# Epic: Auto-Install & AI Agent Detection\n\n## Priority Score: 800/1000 (Very High Priority)\n\n## Background and Rationale\n\nDCG is a security tool 

{"id":"git_safety_guard-b6vb","title":"Auto-Install & AI Agent Detection","description":"# Epic: Auto-Install & AI Agent Detection\n\n## Priority Score: 800/1000 (Very High Priority)\n\n## Background and Rationale\n\nDCG is a security tool 

{"id":"git_safety_guard-b6vb.1","title":"[Install] Checksum verification in install.sh","description":"Add SHA256 checksum verification to install.sh.\n\n## Current State\n\ninstall.sh downloads binaries but does not verify checksums.\n\n##

{"id":"git_safety_guard-b6vb.10","title":"[Install] Continue auto-configuration","description":"# Task: Continue Auto-Configuration\n\n## Background\n\nContinue is an open-source AI coding assistant that integrates with IDEs. DCG should aut

{"id":"git_safety_guard-b6vb.11","title":"[Install] Uninstall command and removal script","description":"# Task: Uninstall Command and Removal Script\n\n## Background\n\nGood software should be as easy to remove as it is to install. DCG nee

{"id":"git_safety_guard-b6vb.11","title":"[Install] Uninstall command and removal script","description":"# Task: Uninstall Command and Removal Script\n\n## Background\n\nGood software should be as easy to remove as it is to install. DCG nee

{"id":"git_safety_guard-b6vb.7","title":"[Install] Tests for install.sh and agent config","description":"# Task: Tests for install.sh and Agent Configuration\n\n## Background\n\nThe installer and agent configuration code must be thoroughly 

{"id":"git_safety_guard-b6vb.9","title":"[Install] Aider auto-configuration","description":"# Task: Aider Auto-Configuration\n\n## Background\n\nAider is a popular terminal-based AI coding assistant. DCG should auto-configure Aider during i

{"id":"git_safety_guard-b8c","title":"[PACK] search.meilisearch - Meilisearch Pack","description":"# Meilisearch Pack\n\n## Scope\nImplement pattern matching for Meilisearch REST API operations.\n\n## Destructive Patterns\n- `DELETE /indexe

{"id":"git_safety_guard-beq","title":"Define Python destructive patterns for heredoc scanning","description":"# Define Python Destructive Patterns for Heredoc Scanning\n\n## Objective\n\nCreate AST-aware matchers for Python heredoc content 

{"id":"git_safety_guard-ccj1","title":"[E7-T2] Implement interactive prompt handler","description":"## Task: Implement interactive prompt handler\n\n### Parent Epic\nEpic 7: Interactive Learning Mode (git_safety_guard-2py1)\n\n### What To D

{"id":"git_safety_guard-cle3","title":"[E9-T1] Implement agent detection","description":"## Task: Implement agent detection\n\n### Parent Epic\nEpic 9: Agent-Specific Profiles (git_safety_guard-pwsr)\n\n### What To Do\nCreate a module to de

{"id":"git_safety_guard-cpal","title":"Implement custom pattern allowlisting for heredoc scanning","description":"# Custom Pattern Allowlisting\n\n## Objective\n\nAllow users to define custom allowlist patterns for heredocs that are known-s

[Credential-related source omitted]

{"id":"git_safety_guard-dco0","title":"Fix external_pack_validation test compile errors","description":"cargo check fails: tests/external_pack_validation.rs expects ExternalPackLoader and PatternEngineInfo fields (pattern/is_destructive) + 

{"id":"git_safety_guard-dis","title":"Feature: UBS (Ultimate Bug Scanner) Integration","description":"# Feature: UBS (Ultimate Bug Scanner) Integration\n\n## Background\n\nUBS (Ultimate Bug Scanner) is a static analysis tool that catches bu

{"id":"git_safety_guard-dr15","title":"[E4-T3] Implement suggestion heuristics","description":"## Task: Implement suggestion heuristics\n\n### Parent Epic\nEpic 4: Automatic Allowlist Suggestions (git_safety_guard-egdp)\n\n### What To Do\nC

{"id":"git_safety_guard-drbg","title":"[E4-T10] Comprehensive testing for Automatic Allowlist Suggestions","description":"## Comprehensive Unit & E2E Testing for Epic 4: Automatic Allowlist Suggestions\n\n### Overview\nTesting for the histo

{"id":"git_safety_guard-e2eh","title":"Extend e2e_test.sh with heredoc test cases","description":"# E2E Test Script Extension for Heredocs\n\n## Objective\n\nExtend the existing `scripts/e2e_test.sh` with comprehensive heredoc test cases.\n

{"id":"git_safety_guard-e4fl.8","title":"[Agent] stdin batch mode for agent pipelines","description":"# Task: stdin Batch Mode\n\n## Background\nAllow processing multiple commands from stdin for agent pipelines.\n\n## Usage\n```bash\ncat co

{"id":"git_safety_guard-e4fl.8","title":"[Agent] stdin batch mode for agent pipelines","description":"# Task: stdin Batch Mode\n\n## Background\nAllow processing multiple commands from stdin for agent pipelines.\n\n## Usage\n```bash\ncat co

{"id":"git_safety_guard-e4fl.9","title":"[Agent] Unit tests for stdin batch mode","description":"# Task: Unit Tests for stdin Batch Mode\n\n## Test Coverage\n\n```rust\n#[test]\nfn test_batch_processes_multiple_commands() {\n    log::info!(

{"id":"git_safety_guard-eao6","title":"[E2-T10] Comprehensive testing for Natural Language Explanations","description":"## Comprehensive Unit & E2E Testing for Epic 2: Natural Language Explanations\n\n### Overview\nTesting for the natural l

{"id":"git_safety_guard-egdp","title":"[Epic 4] Automatic Allowlist Suggestions from History","description":"## EPIC 4: Automatic Allowlist Suggestions from History\n\n### Background & Context\ndcg already collects command history in a SQLi

{"id":"git_safety_guard-egmh","title":"[Packs] Define YAML schema for external pack files","description":"# Task: Define YAML schema for external pack files\n\n## Parent Epic: Custom Pack Authoring (git_safety_guard-8kkm)\n\n## Objective\n\

{"id":"git_safety_guard-ehc","title":"Implement GitLab CI extractor (.gitlab-ci.yml)","description":"## Objective\n\nImplement an extractor for GitLab CI YAML files to detect executable command contexts.\n\n## File Pattern\n\n- `.gitlab-ci.

{"id":"git_safety_guard-emqt","title":"[E3-T4] Curate suggestions for docker patterns","description":"## Task: Curate suggestions for docker patterns\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\n\n### W

{"id":"git_safety_guard-emqt","title":"[E3-T4] Curate suggestions for docker patterns","description":"## Task: Curate suggestions for docker patterns\n\n### Parent Epic\nEpic 3: Command Rewriting Suggestions (git_safety_guard-96c8)\n\n### W

[Credential-related source omitted]

[Credential-related source omitted]

{"id":"git_safety_guard-eoj","title":"[PACK] loadbalancer.traefik - Traefik Pack","description":"# Traefik Load Balancer Pack\n\n## Scope\nImplement pattern matching for Traefik operations.\n\n## Destructive Patterns\n### Container/Kubernet

{"id":"git_safety_guard-erux","title":"Design user-friendly error messages for heredoc blocks","description":"# User-Friendly Error Messages for Heredoc Blocking\n\n## Objective\n\nWhen a heredoc command is blocked, provide clear, actionabl

{"id":"git_safety_guard-ew0","title":"[PACK] featureflags.split - Split.io Pack","description":"# Split.io Feature Flags Pack\n\n## Scope\nImplement pattern matching for Split.io operations.\n\n## Destructive Patterns\n### split CLI\n- Spli

{"id":"git_safety_guard-ewbq","title":"[LIFECYCLE] Pack Maintenance and CLI Evolution Strategy","description":"# Pack Maintenance and CLI Evolution Strategy\n\n## Problem\nCLI tools evolve over time:\n- New commands are added\n- Command syn

{"id":"git_safety_guard-f4f","title":"Implement ast-grep-core pattern matching layer","description":"# ast-grep-core Pattern Matching Layer\n\n## Objective\n\nIntegrate ast-grep-core as a Rust library for structural pattern matching in here

{"id":"git_safety_guard-f9fv.3","title":"[Update] Add background update notification","description":"Add background update notification shown on regular commands.\n\n## Implementation\n\nUsing update-informer crate pattern:\n- Spawn backgro

{"id":"git_safety_guard-f9fv.4","title":"[Update] Implement version rollback","description":"Implement version rollback capability.\n\n## Implementation\n\n- Keep up to 3 previous binary backups\n- Allow rollback to specific version\n- List

{"id":"git_safety_guard-f9fv.5","title":"[Update] Tests for update and rollback","description":"# Task: Tests for Update and Rollback\n\n## Background\n\nThe self-update mechanism must be thoroughly tested to ensure reliable updates and saf

{"id":"git_safety_guard-f9fv.6","title":"[Update] Sigstore/cosign signature verification","description":"# Task: Sigstore/Cosign Signature Verification\n\n## Background\n\nChecksums verify integrity but not authenticity. An attacker who com

{"id":"git_safety_guard-fbol","title":"[E10-T9] Comprehensive testing for Graduated Response System","description":"## Comprehensive Unit & E2E Testing for Epic 10: Graduated Response System\n\n### Overview\nTesting for the progressive warn

{"id":"git_safety_guard-fpim","title":"Implement false positive reduction for string arguments","description":"# False Positive Reduction Implementation\n\n## Problem\n\nCurrent regex patterns match dangerous strings even in safe contexts:\

{"id":"git_safety_guard-fu8","title":"Implement docker-compose extractor","description":"## Objective\n\nImplement an extractor for docker-compose files to detect executable command contexts.\n\n## File Pattern\n\n- `docker-compose.yml`\n- 

{"id":"git_safety_guard-goph","title":"Define Go destructive patterns for heredoc scanning","description":"# Go Destructive Patterns for Heredoc Scanning\n\n## Objective\n\nDefine Go heredoc matchers that detect **high-signal destructive op

# cargo-nextest configuration for git_safety_guard # https://nexte.st/book/configuration.html

# https://nexte.st/book/configuration.html

contact_links:   - name: Documentation     url: https://github.com/Dicklesworthstone/destructive_command_guard#readme

- name: Documentation     url: https://github.com/Dicklesworthstone/destructive_command_guard#readme     about: Check the README and docs before opening an issue

url: https://github.com/Dicklesworthstone/destructive_command_guard#readme

about: Check the README and docs before opening an issue   - name: Discussions     url: https://github.com/Dicklesworthstone/destructive_command_guard/discussions

- name: Discussions     url: https://github.com/Dicklesworthstone/destructive_command_guard/discussions     about: Ask questions and discuss ideas

url: https://github.com/Dicklesworthstone/destructive_command_guard/discussions

placeholder: "e.g., rm -rf /var/log/*"

# Dependabot configuration for DCG # Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates

# Docs: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates

- name: Install UBS         run: |           curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh" \

run: |           curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh" \             | bash -s -- --easy-mode

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/ultimate_bug_scanner/main/install.sh" \

echo "- Upload: Attempted (check Codecov dashboard for status)" >> $GITHUB_STEP_SUMMARY           echo "" >> $GITHUB_STEP_SUMMARY           echo "Dashboard: https://codecov.io/gh/Dicklesworthstone/destructive_command_guard" >> $GITHUB_STEP_

echo "Dashboard: https://codecov.io/gh/Dicklesworthstone/destructive_command_guard" >> $GITHUB_STEP_SUMMARY

sudo apt-get update -qq

sudo apt-get install -y -qq bats

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

command -v jq >/dev/null 2>&1 || sudo apt-get install -y jq

$dest = Join-Path $env:RUNNER_TEMP 'dcg-bin'           New-Item -ItemType Directory -Force -Path $dest | Out-Null           $src = Invoke-RestMethod -Uri "https://raw.githubusercontent.com/${{ github.repository }}/main/install.ps1"

New-Item -ItemType Directory -Force -Path $dest | Out-Null           $src = Invoke-RestMethod -Uri "https://raw.githubusercontent.com/${{ github.repository }}/main/install.ps1"           & ([scriptblock]::Create($src)) -Version $version -De

$src = Invoke-RestMethod -Uri "https://raw.githubusercontent.com/${{ github.repository }}/main/install.ps1"

foreach ($c in @('echo hi 2>NUL', 'cp report.txt backup.txt', 'rm ./scratch.txt')) {

if [ "$DCG_VERSION" = "latest" ]; then             VERSION=$(curl -fsSL https://api.github.com/repos/Dicklesworthstone/destructive_command_guard/releases/latest | jq -er '.tag_name | select(type == "string" and length > 0)')

VERSION=$(curl -fsSL https://api.github.com/repos/Dicklesworthstone/destructive_command_guard/releases/latest | jq -er '.tag_name | select(type == "string" and length > 0)')

ARCHIVE="dcg-x86_64-unknown-linux-musl.tar.xz"           DOWNLOAD_URL="https://github.com/Dicklesworthstone/destructive_command_guard/releases/download/${VERSION}/${ARCHIVE}"

DOWNLOAD_URL="https://github.com/Dicklesworthstone/destructive_command_guard/releases/download/${VERSION}/${ARCHIVE}"

if ! curl -fsSL "$DOWNLOAD_URL" -o "$ARCHIVE"; then

echo "::warning::No pre-built binary found, building from source..."             # Fallback: build from source             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal

# Fallback: build from source             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal             source "$HOME/.cargo/env"

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal

echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"           else             curl -fsSL "$CHECKSUM_URL" -o "${ARCHIVE}.sha256"

else             curl -fsSL "$CHECKSUM_URL" -o "${ARCHIVE}.sha256"             EXPECTED_SHA256=$(awk 'NR == 1 { print $1 }' "${ARCHIVE}.sha256")

curl -fsSL "$CHECKSUM_URL" -o "${ARCHIVE}.sha256"

sudo apt-get update -qq

sudo apt-get install -y --no-install-recommends ${{ matrix.apt_install }}

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

'existing context and launcher tests, argv-spawn regressions, all-target '               'check and Clippy, formatting, and real hook protocols.\n\n'               f'Validation: https://github.com/{repository}/actions/runs/{os.environ["GITH

'check and Clippy, formatting, and real hook protocols.\n\n'               f'Validation: https://github.com/{repository}/actions/runs/{os.environ["GITHUB_RUN_ID"]}\n\n'               'Fixes #538'

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

'evaluator/core tests, all-target check and Clippy, formatting, and '               'the real hook harness.\n\n'               f'Validation: https://github.com/{repository}/actions/runs/{os.environ["GITHUB_RUN_ID"]}'

'the real hook harness.\n\n'               f'Validation: https://github.com/{repository}/actions/runs/{os.environ["GITHUB_RUN_ID"]}'           )

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

run: sudo apt-get update && sudo apt-get install -y shellcheck

[Credential-related source omitted]

#   - redact: none, quoted, or aggressive (for sensitive commands) # # For more information: https://github.com/Dicklesworthstone/destructive_command_guard

# For more information: https://github.com/Dicklesworthstone/destructive_command_guard

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

tools_dir="$RUNNER_TEMP/tar-helper-tools"           mkdir -p "$tools_dir"           curl --fail --location --user-agent "$DOWNLOAD_USER_AGENT" \

mkdir -p "$tools_dir"           curl --fail --location --user-agent "$DOWNLOAD_USER_AGENT" \             "https://codeload.github.com/Dicklesworthstone/ultimate_bug_scanner/tar.gz/$UBS_COMMIT" \

curl --fail --location --user-agent "$DOWNLOAD_USER_AGENT" \

"https://codeload.github.com/Dicklesworthstone/ultimate_bug_scanner/tar.gz/$UBS_COMMIT" \

bash "$ubs_dir/scripts/verify_checksums.sh" > "$EVIDENCE/ubs-integrity.log" 2>&1           mkdir -p "$tools_dir/ast-grep"           curl --fail --location --user-agent "$DOWNLOAD_USER_AGENT" \

mkdir -p "$tools_dir/ast-grep"           curl --fail --location --user-agent "$DOWNLOAD_USER_AGENT" \             https://github.com/ast-grep/ast-grep/releases/download/0.45.3/app-aarch64-unknown-linux-gnu.zip \

curl --fail --location --user-agent "$DOWNLOAD_USER_AGENT" \

https://github.com/ast-grep/ast-grep/releases/download/0.45.3/app-aarch64-unknown-linux-gnu.zip \

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[cm] MCP HTTP server listening on http://127.0.0.1:44965

[cm] WARNING: Transport is HTTP-only; stdio/SSE are intentionally disabled. [cm] MCP HTTP server listening on http://127.0.0.1:46019 [cm] WARNING: Transport is HTTP-only; stdio/SSE are intentionally disabled.

[cm] MCP HTTP server listening on http://127.0.0.1:46019

[cm] WARNING: Transport is HTTP-only; stdio/SSE are intentionally disabled. [cm] MCP HTTP server listening on http://127.0.0.1:44023 [cm] WARNING: Transport is HTTP-only; stdio/SSE are intentionally disabled.

[cm] MCP HTTP server listening on http://127.0.0.1:44023

- Finding: Unix trusted `rm -f` exit zero without verifying that the directory

[Credential-related source omitted]

1. **Absolutely forbidden commands:** `git reset --hard`, `git clean -fd`, `rm -rf`, or any command that can delete or overwrite code/data must never be run unless the user explicitly provides the exact command and states, in the same messa

patterns (`rm -rf /`, `normalize.rs` stripping `/usr/bin/git`, `/etc`, `/tmp`)

| `normalize_command_tests` | 8 | Path stripping for git/rm binaries |

| `quick_reject_tests` | 5 | Fast-path filtering for non-git/rm commands |

| `core.filesystem:rm-rf-root` | `rm -rf /`, `rm -rf ~` | Critical |

| `core.filesystem:rm-rf-general` | `rm -rf` outside temp dirs | High |

| `rm-tmp` | `rm -rf /tmp/*`, `/var/tmp/*` | Temp directory cleanup |

Coverage is uploaded to Codecov for trend tracking. Dashboard: https://codecov.io/gh/Dicklesworthstone/destructive_command_guard

This project uses [beads_rust](https://github.com/Dicklesworthstone/beads_rust) (`br`) for issue tracking. Issues are stored in `.beads/` and tracked in git.

For any web requests you must make with curl or otherwise, identify yourself honestly: use a User-Agent that names this project, e.g. "destructive_command_guard-agent (+https://github.com/Dicklesworthstone/destructive_command_guard)". Never

Repository: <https://github.com/Dicklesworthstone/destructive_command_guard>

## [v0.15.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.15.3) -- 2026-10-08 [Release]

`rm .git/index.lock` is still denied under `core.filesystem:rm-protected-file`,

environment (`sudo -u`, `env -C`, remote and container shells) were checked

## [v0.15.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.15.2) -- 2026-10-01 [Release]

commands.** The confidence scorer cut the command with a match span   measured on the unwrapped inner command (`env --split-string='rm -rf   ./build'`, a `curl … | bash` install line) and panicked, so the command

measured on the unwrapped inner command (`env --split-string='rm -rf

measured on the unwrapped inner command (`env --split-string='rm -rf   ./build'`, a `curl … | bash` install line) and panicked, so the command   ran. A span that does not address the command now leaves the confidence

./build'`, a `curl … | bash` install line) and panicked, so the command

./build'`, a `curl … | bash` install line) and panicked, so the command

## [v0.15.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.15.1) -- 2026-09-29 [Release]

## [v0.15.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.15.0) -- 2026-09-29 [Release]

- `ssh host git commit -m 'rm -rf x'` is now denied. ssh joins its arguments

`rm -rf x`. Quote the whole remote command

(`ssh host "git commit -m 'rm -rf x'"`) if you mean the message.

(`alias x='git stash drop'; rm -rf /`, `d=git; $d stash drop; git reset

(`watch rm -rf ./build; rm -rf ./build`). That repeat was found by the

(`rm -r''f ./build`, `a=(rm -rf ./build); "${a[@]}"`) still went unjudged;

were allowed while `rm -rf` behind the same wrappers denied.

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- **`rm $'-rf' /` was allowed** while `rm '-rf' /` denied: Bash ANSI-C

parameter, so `rm $'-rf' /`, `rm $'-\x72f' /` and `rm -$'\x72'f ./build`

- **A command handed over as a string ran unjudged.** `watch 'rm -rf ./b'`,

`sudo --user=…`, `chronic`, `strace`, `flock`, `taskset`, `ssh host …`,

in executable position, as `rm -rf` in the same place always was.

`sudo -u bob watch '…'`, `timeout 5s watch '…'`); words the runner joins

[Credential-related source omitted]

[Credential-related source omitted]

and the destructured `const { rm } = require('fs/promises')` spelling are pinned

[Credential-related source omitted]

scan it in the raw command, verified rather than assumed (`rm -r /home/user` and

denied in Go while Python and plain `rm -rf /tmp/build` allowed it. That is now

`['rm',…]` spelling and the plain shell `/bin/rm -rf /home/user` were both

Why it stayed hidden: the nested shape `['sh','-c','/bin/rm -rf /home/user']`

`rm -rf` text for that layer to catch, so only it depended on this comparison.

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

| `chmod -R 777 /etc --reference=/tmp/stat` | **allowed** |

`rm -rf /etc/nginx --exclude=ls` all still deny.

[Credential-related source omitted]

[Credential-related source omitted]

`p=/tmp/safe; printf -v p /; rm -rf "$p"` reached `rm -rf /`.** Narrowing the

previous release. The rm proof was handed the argument-masked view, in which

returned a single result and exit 0, with the `rm -rf /Users/x/Documents` on

[Credential-related source omitted]

binary under **node v26.0.0 and bun 1.4.2**. Both contracts deny `rm -rf /`

— which is why `rm -rf /` and `$(rm -rf /)` in that position were always allowed.

`eval "$(cat foo)"` and `eval $CMD` denied identically.

input turned `rm -rf ./src` into an allow. The collectors ask different

command and the whole `eval "$(cat foo)"` / `eval $CMD` class now allow, while

`rm -rf /` in the body returned `allow` 40/40 idle and 40/40 at loadavg 66 — so

the `rm -rf` denial offered `mv /path/to/directory /.Trash/` as its recoverable

[Credential-related source omitted]

- **`find … -delete` explains itself honestly (#418).** The rule text claimed

"bytewise-equivalent to `rm -rf`". Neither was true. It now says what it does:

(#451).** Under `tool_name: "powershell"`, `rm -Recurse ./tree` denies and

`rm -Recurse ./tree` goes the other way — the hook denies, `dcg test` allows.

[Credential-related source omitted]

[Credential-related source omitted]

relative operand** — `rm -rf projects`, `rm *`, `unlink .bashrc`,

`find . -delete`, `tar --remove-files docs` all deny — so the irreversible-delete

## [v0.14.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.14.4) -- 2026-09-16 [Release]

`rm -rf -- /tmp/foo` is what a careful script writes so an operand beginning

temp-dir rm safe pattern now admits an optional bare `--`. It widens the

- **A proven `$VAR` rm operand gets the same exemption its literal value gets

into the segment and the real rm classifier is asked again, so only a command

## [v0.14.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.14.3) -- 2026-09-10 [Release]

- **`/dev/tcp/<host>/<port>` and `/dev/udp/<host>/<port>` are sockets, not

- **`/dev/tcp/<host>/<port>` and `/dev/udp/<host>/<port>` are sockets, not

files (#404).** Bash intercepts those two prefixes in its own redirect   parser and opens a socket; no file is opened and nothing can be truncated.   `echo > /dev/tcp/host/22`, the standard port probe on a host without `nc`,

parser and opens a socket; no file is opened and nothing can be truncated.   `echo > /dev/tcp/host/22`, the standard port probe on a host without `nc`,   is allowed. The exemption is scoped to the exact `host/port` shape bash

`echo > /dev/tcp/host/22`, the standard port probe on a host without `nc`,

`echo > /dev/tcp/host/22`, the standard port probe on a host without `nc`,

## [v0.14.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.14.2) -- 2026-09-09 [Release]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

## [v0.14.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.14.1) -- 2026-09-07 [Release]

subshell syntax — so `rm -rf ~/scratch/lo(g|x)` was matched as

subshell grouping (`(rm -rf ~/scratch/x)`, `rm -rf ~/scratch/x (echo

unquoted-delimiter heredoc body as plain content, so `` `rm -rf ~/x` ``

## [v0.14.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.14.0) -- 2026-09-01 [Release]

## [v0.13.9](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.9) -- 2026-08-27 [Release]

## [v0.13.8](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.8) -- 2026-08-27 [Release]

[#355]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/355

[#356]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/356

## [v0.13.7](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.7) -- 2026-08-27 [Release]

## [v0.13.6](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.6) -- 2026-08-27 [Release]

[#288]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/288

[#289]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/289

[#337]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/337

[#354]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/354

## [v0.13.5](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.5) -- 2026-08-27 [Release]

[#352]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/352

## [v0.13.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.4) -- 2026-08-27 [Release]

[#353]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/353

## [v0.13.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.3) -- 2026-08-27 [Release]

## [v0.13.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.2) -- 2026-08-27 [Release]

## [v0.13.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.1) -- 2026-08-27 [Release]

[#289]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/289

[#342]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/342

[#344]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/344

[#351]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/351

## [v0.13.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.13.0) -- 2026-08-24 [Release]

[#335]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/335

[#339]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/339

[#340]: https://github.com/Dicklesworthstone/destructive_command_guard/issues/340

## [v0.12.5](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.12.5) -- 2026-08-23 [Release]

`echo 'rm -rf ~' | bash --norc` and `bash --norc <(echo 'rm -rf ~')` were

## [v0.12.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.12.4) -- 2026-08-23 [Release]

- **Quoted `rm` flags no longer bypass the always-on `rm -rf` guard

`rm -r'f' /` (and `rm -'r'f /`, `rm -r"f" /`, `rm '-r'f /`) really runs

`rm -rf /` — but dcg **allowed** them, because the `rm` flag char-class

(`echo 'rm -rf /'`, `grep 'rm -rf' file`) stay allowed; an unbalanced quote

## [v0.12.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.12.3) -- 2026-08-22 [Release]

## [v0.12.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.12.2) -- 2026-08-22 [Release]

## [v0.12.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.12.1) -- 2026-08-22 [Release]

`| bash -s`, `| python3`, `| sudo bash`, `| env bash`) executed its body

literals (`python3 -c "print(\"rm -rf\")"`) deliberately stay on the

## [v0.12.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.12.0) -- 2026-08-20 [Release]

## [v0.11.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.11.1) -- 2026-08-19 [Release]

command — an unverifiable encoded-launcher segment chained with `rm -rf /`

emit most — `rm -Recurse -Force .\pipelines`, `del /s /q C:\src`,

A plain POSIX `rm -rf ./build` has neither and keeps the Posix dialect.

`mv-sensitive-source-root-home`, `find -delete`, `unlink`, `truncate`,

set (`ls -la` preview / `rm -ri` / move-to-trash) for redirect rules — a non

recommends `rm -rf /path/to/specific/directory` — a command dcg itself

denies — and points at the literal-temp and interactive (`rm -ri`) forms it

## [v0.11.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.11.0) -- 2026-08-14 [Release]

[Credential-related source omitted]

`bash -lc 'grep -n "rm -rf /" notes.md'` was denied while the bare inner

command — and `bash -c 'rm -rf /'` still denies, because the payload

## [v0.10.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.10.0) -- 2026-08-07 [Release]

## [v0.9.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.9.4) -- 2026-08-05 [Release]

`eval "$(ssh-agent -s)"` and `source <(kubectl completion bash)` warn instead

when the whole command is a single POSIX segment (a trailing `; rm -rf ~` or

`docker compose rm -fsv` remove volumes but were allowed when only

## [v0.9.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.9.3) -- 2026-08-05 [Release]

## [v0.9.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.9.2) -- 2026-08-02 [Release]

## [v0.9.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.9.1) -- 2026-08-02 [Release]

the first `--` anywhere, so `mise exec rm -rf / -- ok` evaluated only `ok`;

masked the rest of the segment (`mise exec -p echo rm -rf /`). The scan now

## [v0.9.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.9.0) -- 2026-08-02 [Release]

a real alphanumeric cluster. `"$(cmd)" foo -c` and `FOO=bar sh -c 'rm -rf

allows while `for f in /etc x; do mv "$f" d/; done`, `for f in $(ls); …`,   and rebinding/nested-loop variants all still deny. - **Prompt from the terminal under `curl … | bash` (#251).** The installer's

and rebinding/nested-loop variants all still deny. - **Prompt from the terminal under `curl … | bash` (#251).** The installer's   three prompts (rustup install, predecessor removal, shell startup check)

- **Prompt from the terminal under `curl … | bash` (#251).** The installer's

- **Prompt from the terminal under `curl … | bash` (#251).** The installer's

## [v0.8.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.8.0) -- 2026-07-31 [Release]

(`sh -c 'rm -rf {}'`), records in command position (`sh -c '{}'`,

unexpanded glob under a home directory (`rm -f ~/Downloads/*.md`,

`rm /Users/<u>/Documents/*.pdf`, `rm -f $HOME/*`) now requires approval.

## [v0.7.8](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.8) -- 2026-07-28 [Release]

## [v0.7.7](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.7) -- 2026-07-28 [Release]

## [v0.7.6](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.6) -- 2026-07-28 [Release]

## [v0.7.5](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.5) -- 2026-07-28 [Release]

## [v0.7.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.4) -- 2026-07-28 [Release]

## [v0.7.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.3) -- 2026-07-28 [Release]

## [v0.7.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.2) -- 2026-07-27 [Release]

## [v0.7.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.1) -- 2026-07-27 [Release]

## [v0.7.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.7.0) -- 2026-07-27 [Release]

## [v0.6.12](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.12) -- 2026-07-27 [Release]

## [v0.6.11](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.11) -- 2026-07-27 [Tag]

POSIX `rm -r` commands are no longer reinterpreted as PowerShell

## [v0.6.10](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.10) -- 2026-07-27 [Tag]

## [v0.6.9](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.9) -- 2026-07-18 [Release]

- **Protect every recursive `rm`, not only forced forms (#211).** `rm -r`,

`rm -R`, and `rm --recursive` now receive the same bounded target analysis as

`rm -rf`; interactive `-i`/`-I`, literal temp subdirectories, option ordering,

## [v0.6.8](https://github.com/Dicklesworthstone/destructive_command_guard/tree/v0.6.8) -- 2026-07-15 [Tag]

## [v0.6.7](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.7) -- 2026-07-14 [Release]

## [v0.6.6](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.6) -- 2026-07-13 [Release]

## [v0.6.5](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.5) -- 2026-07-02 [Release]

## [v0.6.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.4) -- 2026-06-27 [Release]

## [v0.6.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.3) -- 2026-06-25 [Release]

## [v0.6.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.2) -- 2026-06-25 [Release]

## [v0.6.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.1) -- 2026-06-25 [Release]

## [v0.6.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.6.0) -- 2026-06-24 [Tag]

## [v0.5.6](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.5.6) -- 2026-05-26 [Release]

- **Switched `fsqlite`/`fsqlite-types`/`fsqlite-error` from the v0.5.5 git revision   to the published `fsqlite 0.1.4`** ([frankensqlite#94](https://github.com/Dicklesworthstone/frankensqlite/issues/94)),

to the published `fsqlite 0.1.4`** ([frankensqlite#94](https://github.com/Dicklesworthstone/frankensqlite/issues/94)),

## [v0.5.5](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.5.5) -- 2026-05-26 [Release]

module instance stale, so the `DELETE FROM commands_fts; <re-INSERT>` rebuild   pattern collided on re-insert of the same rowid. Fixed upstream in   [frankensqlite#94](https://github.com/Dicklesworthstone/frankensqlite/issues/94)

pattern collided on re-insert of the same rowid. Fixed upstream in   [frankensqlite#94](https://github.com/Dicklesworthstone/frankensqlite/issues/94)   (commit `a0425adb` — live virtual-table DELETE now routes through the module's

[frankensqlite#94](https://github.com/Dicklesworthstone/frankensqlite/issues/94)

## [v0.5.4](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.5.4) -- 2026-05-25 [crates.io only — no GitHub binaries]

and v0.5.3's `dist` run failed at `cargo fmt --check`, so it shipped nothing. v0.5.4 carries the v0.5.3 fixes forward and adds the items below. Closes [#126](https://github.com/Dicklesworthstone/destructive_command_guard/issues/126).

[#126](https://github.com/Dicklesworthstone/destructive_command_guard/issues/126).

- **dcg now descends into `powershell -Command` / `pwsh -c` inline scripts** ([#125](https://github.com/Dicklesworthstone/destructive_command_guard/issues/125)).

- Added an end-to-end regression test for the [#124](https://github.com/Dicklesworthstone/destructive_command_guard/issues/124)

## [v0.5.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.5.3) -- 2026-05-23 [Tag]

- **`push-force-{long,short}` no longer fires across shell-token boundaries** ([#124](https://github.com/Dicklesworthstone/destructive_command_guard/issues/124)).

push --force'` all tripped the Critical rule — and dcg refused the   entire command. Switched both regexes to the bounded form already   used by `branch-force-delete` since [#121](https://github.com/Dicklesworthstone/destructive_command_gua

entire command. Switched both regexes to the bounded form already   used by `branch-force-delete` since [#121](https://github.com/Dicklesworthstone/destructive_command_guard/issues/121):   `(?:[^\s&;|`()<>]+\s+)*`. Added five regression cas

used by `branch-force-delete` since [#121](https://github.com/Dicklesworthstone/destructive_command_guard/issues/121):

- **`install.ps1` now writes `hooks.json` as UTF-8 without the BOM** ([#125](https://github.com/Dicklesworthstone/destructive_command_guard/issues/125)).

- **Intended as the first crates.io publish since v0.4.5 — but the `dist` run   for v0.5.3 failed at `cargo fmt --check`, so no binaries or crate were   published.** Superseded by v0.5.4, which completes the publish ([#126](https://github.c

published.** Superseded by v0.5.4, which completes the publish ([#126](https://github.com/Dicklesworthstone/destructive_command_guard/issues/126)).

detection tests in `agent::env_tests`, and CLI parse coverage for     `--grok`/`--grok --project`. Closes the contribution proposals in     [#117](https://github.com/Dicklesworthstone/destructive_command_guard/pull/117)

`--grok`/`--grok --project`. Closes the contribution proposals in     [#117](https://github.com/Dicklesworthstone/destructive_command_guard/pull/117)     and [#118](https://github.com/Dicklesworthstone/destructive_command_guard/pull/118)

[#117](https://github.com/Dicklesworthstone/destructive_command_guard/pull/117)

and [#118](https://github.com/Dicklesworthstone/destructive_command_guard/pull/118)

- **Linux x86_64 now ships as static musl** ([#114](https://github.com/Dicklesworthstone/destructive_command_guard/issues/114)).

- **aarch64 release artifact verified at build time** ([#112](https://github.com/Dicklesworthstone/destructive_command_guard/issues/112)).

## [v0.5.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.5.1) -- 2026-05-03 [Release]

quoted-delimiter strip and bail out unmasked. Pre-fix the body escaped   masking, and pack matching denied prose like "gh repo delete" inside a   heredoc fed to a non-executing target ([f3c96bd](https://github.com/Dicklesworthstone/destruct

masking, and pack matching denied prose like "gh repo delete" inside a   heredoc fed to a non-executing target ([f3c96bd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f3c96bd),   test coverage added in [a739dc9](htt

heredoc fed to a non-executing target ([f3c96bd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f3c96bd),

test coverage added in [a739dc9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a739dc9)

and [03bf276](https://github.com/Dicklesworthstone/destructive_command_guard/commit/03bf276)).

produced false positives on documentation prose like `rm -rf /` inside

produced false positives on documentation prose like `rm -rf /` inside   the heredoc body   ([a8a0a8d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a8a0a8d)).

([a8a0a8d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a8a0a8d)).

### Compact curl / glab API method forms

verb. Pre-fix bypasses such as `glab api -XDELETE   projects/123/variables/SECRET`, `glab api --method=DELETE   /projects/123/protected_branches/main`, `curl -XDELETE

projects/123/variables/SECRET`, `glab api --method=DELETE   /projects/123/protected_branches/main`, `curl -XDELETE   https://splunk.example.com:8089/services/data/inputs/abc`, and `curl

/projects/123/protected_branches/main`, `curl -XDELETE

https://splunk.example.com:8089/services/data/inputs/abc`, and `curl

--request=DELETE   https://circleci.com/api/v2/.../envvar/FOO` slipped through unblocked   because curl and glab's cobra-based CLI accept those compact short forms

https://circleci.com/api/v2/.../envvar/FOO` slipped through unblocked   because curl and glab's cobra-based CLI accept those compact short forms   and equals long forms. Aligned the affected packs with the broader

because curl and glab's cobra-based CLI accept those compact short forms

Datadog, PagerDuty, Prometheus, New Relic, Meilisearch, and the email   packs, and added regression tests for each block   ([1fdfbec](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1fdfbec)).

([1fdfbec](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1fdfbec)).

| Commit | Subject | |--------|---------| | [f3c96bd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f3c96bd) | fix(heredoc): consume whitespace between `<<-` / `<<~` marker and delimiter (issue #109) |

|--------|---------| | [f3c96bd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f3c96bd) | fix(heredoc): consume whitespace between `<<-` / `<<~` marker and delimiter (issue #109) | | [a739dc9](https://github.com/Dick

| [f3c96bd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f3c96bd) | fix(heredoc): consume whitespace between `<<-` / `<<~` marker and delimiter (issue #109) |

| [a739dc9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a739dc9) | test(heredoc): cover `<<-` / `<<~` with space-after-marker quoted forms (issue #109) |

| [03bf276](https://github.com/Dicklesworthstone/destructive_command_guard/commit/03bf276) | test(heredoc): restore unquoted-delimiter assertion to its parent test | | [a8a0a8d](https://github.com/Dicklesworthstone/destructive_command_guard

| [a8a0a8d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a8a0a8d) | fix(heredoc): respect whitespace gap when classifying tab-strip marker |

| [1fdfbec](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1fdfbec) | fix(packs): match `curl -XDELETE` and `--request=DELETE` compact forms across CI/platform packs |

## [v0.5.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.5.0) -- 2026-05-02 [Release]

hook payloads can select the right agent profile without relying only on   process environment detection   ([7f7d67e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7f7d67e)).

process environment detection   ([7f7d67e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7f7d67e)). - Kept blank Codex `turn_id` fields from forcing the Codex stderr-deny path,

([7f7d67e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7f7d67e)).

preserving Claude-compatible JSON behavior for payloads that are not actually   Codex hook events   ([d0a1bef](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d0a1bef)).

Codex hook events   ([d0a1bef](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d0a1bef)). - Hardened Copilot handling for PowerShell payloads, missing tool names, and

([d0a1bef](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d0a1bef)).

warn-severity decisions so Copilot warnings remain non-stopping while denies   still block   ([e11baea](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e11baea),

still block   ([e11baea](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e11baea),   [4862be4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4862be4),

([e11baea](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e11baea),

[4862be4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4862be4),

[708536e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/708536e)).

hermetic HOME isolation, allow-once/allowlist parity, pack enablement,   heredoc behavior, and cross-protocol block/allow shape checks   ([tests/codex_hook_protocol.rs](https://github.com/Dicklesworthstone/destructive_command_guard/blob/mai

([tests/codex_hook_protocol.rs](https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/tests/codex_hook_protocol.rs)).

configuration instead of overwriting it for Claude Code, Codex CLI, Gemini   CLI, GitHub Copilot CLI, Cursor IDE, and PowerShell hook payloads   ([c55bf33](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c55bf33),

CLI, GitHub Copilot CLI, Cursor IDE, and PowerShell hook payloads   ([c55bf33](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c55bf33),   [1a4b015](https://github.com/Dicklesworthstone/destructive_command_guard/commit

([c55bf33](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c55bf33),

[1a4b015](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1a4b015),

[563d538](https://github.com/Dicklesworthstone/destructive_command_guard/commit/563d538),

[46f3764](https://github.com/Dicklesworthstone/destructive_command_guard/commit/46f3764),

[fba6067](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fba6067)).

- Preserved coexisting user hooks while keeping dcg first in the relevant Bash   hook lists, including mixed Copilot entries and existing Claude hooks   ([792236e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/792236

hook lists, including mixed Copilot entries and existing Claude hooks   ([792236e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/792236e),   [85028ce](https://github.com/Dicklesworthstone/destructive_command_guard/co

([792236e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/792236e),

[85028ce](https://github.com/Dicklesworthstone/destructive_command_guard/commit/85028ce),

[389ac52](https://github.com/Dicklesworthstone/destructive_command_guard/commit/389ac52)).

`--version --system` fail as setup errors instead of treating `--system` as   the version value   ([e8cb117](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e8cb117)).

the version value   ([e8cb117](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e8cb117)). - Matched uninstall ownership checks more exactly for Cursor, Codex,

([e8cb117](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e8cb117)).

PowerShell, and non-dcg hook preservation so uninstallers remove only dcg's   own entries   ([6d71b68](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6d71b68),

own entries   ([6d71b68](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6d71b68),   [af68c72](https://github.com/Dicklesworthstone/destructive_command_guard/commit/af68c72),

([6d71b68](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6d71b68),

[af68c72](https://github.com/Dicklesworthstone/destructive_command_guard/commit/af68c72),

[b043068](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b043068),

[e8e65d1](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e8e65d1)).

- Expanded the Railway pack to recognize `Project-Access-Token` and   `RAILWAY_TOKEN` signals, multiline API payloads, curl executable suffixes,

`RAILWAY_TOKEN` signals, multiline API payloads, curl executable suffixes,

and JSON database variable keys that can mutate production connection   settings   ([d6b49d5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d6b49d5),

settings   ([d6b49d5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d6b49d5),   [6220da9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6220da9),

([d6b49d5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d6b49d5),

[6220da9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6220da9),

[586afff](https://github.com/Dicklesworthstone/destructive_command_guard/commit/586afff),

[2193c67](https://github.com/Dicklesworthstone/destructive_command_guard/commit/2193c67)).

- Closed broad safe-pattern masking gaps across cloud, database, Kubernetes,   package manager, backup, search, monitoring, feature flag, Kafka, and   Ansible packs, including attached/equal curl methods and false dry-run text

package manager, backup, search, monitoring, feature flag, Kafka, and   Ansible packs, including attached/equal curl methods and false dry-run text   bypasses

Ansible packs, including attached/equal curl methods and false dry-run text

bypasses   ([8e86dbc](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8e86dbc),   [1a1c1b0](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1a1c1b0),

([8e86dbc](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8e86dbc),

[1a1c1b0](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1a1c1b0),

[2690864](https://github.com/Dicklesworthstone/destructive_command_guard/commit/2690864),

[c8faf44](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c8faf44),

[552b83d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/552b83d),

[7a02669](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7a02669),

[535b01a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/535b01a)).

- Kept legitimate AWS S3 `--dryrun` previews allowed while blocking deceptive   dry-run-looking strings in destructive contexts   ([b5bea76](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b5bea76)).

([b5bea76](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b5bea76)).

forms so destructive append/truncate redirections are not split or hidden   from filesystem rules   ([87766f9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/87766f9),

from filesystem rules   ([87766f9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/87766f9),   [8aeffdc](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8aeffdc),

([87766f9](https://github.com/Dicklesworthstone/destructive_command_guard/commit/87766f9),

[8aeffdc](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8aeffdc),

[149255c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/149255c),

[616cd75](https://github.com/Dicklesworthstone/destructive_command_guard/commit/616cd75)).

wrapper-launched agents, and Windows shim-launched processes while recording   the hook-protocol-detected agent type in history   ([224f2f8](https://github.com/Dicklesworthstone/destructive_command_guard/commit/224f2f8),

the hook-protocol-detected agent type in history   ([224f2f8](https://github.com/Dicklesworthstone/destructive_command_guard/commit/224f2f8),   [97e91d4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/97e91d4),

([224f2f8](https://github.com/Dicklesworthstone/destructive_command_guard/commit/224f2f8),

[97e91d4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/97e91d4),

[dba007c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/dba007c),

[77bfbaf](https://github.com/Dicklesworthstone/destructive_command_guard/commit/77bfbaf)).

pruning preserves the intended target, and backup artifact names are   validated before use   ([a4d467c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a4d467c),

validated before use   ([a4d467c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a4d467c),   [5c7312b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/5c7312b),

([a4d467c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a4d467c),

[5c7312b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/5c7312b),

[1eea079](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1eea079),

[ea3fcc5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/ea3fcc5)).

## [v0.4.11](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.11) -- 2026-05-01 [Release]

## [v0.4.10](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.10) -- 2026-05-01 [Pre-release]

while tokenizing commands for normalization, preventing quotes inside nested   command substitutions from corrupting the normalized command stream   ([41d233a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/41d233a)).

command substitutions from corrupting the normalized command stream   ([41d233a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/41d233a)). - Masked quoted process-substitution-looking literals before Docker pack

([41d233a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/41d233a)).

evaluation while still blocking real input and output process substitutions   that execute destructive Docker commands   ([41d233a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/41d233a)).

([41d233a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/41d233a)).

## [v0.4.9](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.9) -- 2026-05-01 [Release]

the current command segment instead of splitting them as command separators,   preserving correct downstream pack evaluation for redirected commands   ([acf6803](https://github.com/Dicklesworthstone/destructive_command_guard/commit/acf6803)

preserving correct downstream pack evaluation for redirected commands   ([acf6803](https://github.com/Dicklesworthstone/destructive_command_guard/commit/acf6803)). - Honored documented falsey values for `DCG_NO_COLOR` and `DCG_NO_RICH` in

([acf6803](https://github.com/Dicklesworthstone/destructive_command_guard/commit/acf6803)).

non-clap output paths, so values such as `0`, `false`, `no`, and `off` no   longer disable colors or rich output by mere presence   ([14f1aac](https://github.com/Dicklesworthstone/destructive_command_guard/commit/14f1aac)).

longer disable colors or rich output by mere presence   ([14f1aac](https://github.com/Dicklesworthstone/destructive_command_guard/commit/14f1aac)). - Applied the same falsey-value semantics to `DCG_NO_UPDATE_CHECK` and

([14f1aac](https://github.com/Dicklesworthstone/destructive_command_guard/commit/14f1aac)).

`DCG_NO_SELF_HEAL`, so `0`, `false`, `no`, `n`, and `off` no longer disable   update checks or self-healing by mere presence   ([27ac314](https://github.com/Dicklesworthstone/destructive_command_guard/commit/27ac314)).

update checks or self-healing by mere presence   ([27ac314](https://github.com/Dicklesworthstone/destructive_command_guard/commit/27ac314)). - Kept Linux-only allowlist process inspection imports behind a Linux cfg so

([27ac314](https://github.com/Dicklesworthstone/destructive_command_guard/commit/27ac314)).

- Kept Linux-only allowlist process inspection imports behind a Linux cfg so   macOS and Windows release builds stay warning-clean   ([bdcbb9b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/bdcbb9b)).

([bdcbb9b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/bdcbb9b)).

production credentials even when no database variable name appears in the   payload   ([fb6431e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fb6431e)).

payload   ([fb6431e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fb6431e)). - Kept that Railway replacement mutation detector on the linear regex path for

([fb6431e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fb6431e)).

- Kept that Railway replacement mutation detector on the linear regex path for   predictable hook latency   ([b7aa4e2](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b7aa4e2)).

([b7aa4e2](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b7aa4e2)).

state from previous local runs cannot turn an expected Codex deny into an   allow during release gates   ([29d870c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/29d870c)).

([29d870c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/29d870c)).

## [v0.4.8](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.8) -- 2026-05-01 [Release]

flags such as `DCG_NO_COLOR=1`, `DCG_QUIET=1`,   `DCG_LEGACY_OUTPUT=1`, and `DCG_NO_SUGGESTIONS=1` instead of letting clap   reject `1` as an invalid boolean ([0b350e3](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0

reject `1` as an invalid boolean ([0b350e3](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0b350e3)).

## [v0.4.7](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.7) -- 2026-05-01 [Release]

- Preserved invalid Codex `~/.codex/hooks.json` files instead of overwriting them during Unix installer runs, with an explicit failure reason in the install summary ([a3fc05a](https://github.com/Dicklesworthstone/destructive_command_guard/c

- Preserved malformed Codex hook shapes on both Unix and Windows installers, including non-object `hooks` values and non-list `PreToolUse` values, instead of replacing user-edited data ([7167be6](https://github.com/Dicklesworthstone/destruc

- Removed self-service bypass commands from Codex-visible denial text, so Codex sees the block reason and an explicit no-bypass instruction instead of a command it can use to allowlist and rerun the destructive operation ([a4b9a84](https://

- Made Gemini installer reruns reset `GEMINI_BACKUP` state at the start of `configure_gemini`, preventing stale backup paths from leaking between attempts ([762f3c7](https://github.com/Dicklesworthstone/destructive_command_guard/commit/762f

- Tightened Gemini hook detection so the installer recognizes the exact dcg hook shape and reports configuration failures rather than silently treating near-matches as success ([4c9fbb2](https://github.com/Dicklesworthstone/destructive_comm

- Fixed Gemini warn-severity hook output to emit `decision = "allow"` instead of `ask`, matching Gemini's accepted hook contract ([5d70198](https://github.com/Dicklesworthstone/destructive_command_guard/commit/5d70198)). - Prevented broad A

- Prevented broad API safe patterns from masking destructive method-bearing requests across packs, including `curl -XDELETE`, `curl --request=DELETE`, and attached-method forms such as `-XDELETE` / `--request=DELETE` ([bdb297f](https://gith

- Blocked Redis mass key deletion pipelines and Prometheus destructive API calls that were previously hidden by overly broad safe `GET` handling ([41ec95d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/41ec95d), [9f0

- Scoped Railway original-payload rechecks to relevant compound-command segments so safe Railway API queries are not tainted by unrelated text in later shell segments, while destructive Railway mutations remain blocked ([701630f](https://gi

- Blocked Railway API mutations split across shell line continuations ([3818efc](https://github.com/Dicklesworthstone/destructive_command_guard/commit/3818efc)).

- Added Railway function deletion coverage ([f15bdf6](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f15bdf6)).

- Expanded the Google Cloud Storage pack to match `gcloud alpha storage` and `gcloud beta storage` release tracks ([a68ad66](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a68ad66)).

- Refreshed the pattern-audit document after the storage.gcs keyword widening ([dc02ff4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/dc02ff4)).

- Hardened the real Codex E2E harness so relative `--dcg-binary` paths are canonicalized before hook configuration, and missing option values fail with a setup error instead of shifting later arguments ([cd1b612](https://github.com/Dicklesw

## [v0.4.6](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.6) -- 2026-05-01 [Release]

- **Recursive-force-delete bypass family** (`core.filesystem`): closed seven sibling-bypass families an agent could use after `rm -rf` is blocked.

- `find ... -delete` on sensitive paths (Critical/High) — closes the `find -delete` path-bypass plus compound, subshell, and path-prefix variants.

- `mv <sensitive>` (Critical) — closes the canonical cross-segment bypass `mv /etc /tmp/x && rm -rf /tmp/x` where each segment is allowed individually but together destroys `/etc`. Blocks any mv that mentions a sensitive path (source OR des

- Sensitive-source propagation chains (Critical) — blocks phase-1 data-flow bypasses for `cp -a/-al <sensitive> <tmp> && rm -rf <tmp>`, `ln -s <sensitive> <tmp> && rm -rf <tmp>/.`, and `rsync -a <sensitive> <tmp> && rm -rf <tmp>`. The files

- `> <sensitive>` (Critical) — Bash output redirects (`>`, `>|`, `&>`, `1>`, `2>` with optional `|` force-overwrite) truncate the target file to zero bytes; bare `> /etc/passwd`, `: > /etc/passwd`, `echo > /etc/passwd`, and numbered-FD vari

- **mkswap rule added to `system.disk`** (`git_safety_guard-8kh4`) — `mkswap /dev/sdb` formats a partition as a swap area with the same blast radius as `mkfs`. Previously slipped through because mkswap is a separate binary and the existing 

- **`dcg update` verifies install.sh / install.ps1 before exec** (`git_safety_guard-ythp`) — `self_update_unix` previously did `curl -fsSL <script> | bash -s -- ...`: a tag-pinned but unverified pipe, so a GitHub account compromise that pla

- **`dcg update` verifies install.sh / install.ps1 before exec** (`git_safety_guard-ythp`) — `self_update_unix` previously did `curl -fsSL <script> | bash -s -- ...`: a tag-pinned but unverified pipe, so a GitHub account compromise that pla

- **Interactive prompt sanitizes attacker-controlled command** (`git_safety_guard-m1ic`) — `display_prompt` in `src/interactive.rs` now passes the blocked command and reason through `sanitize_for_display` before any styling. The helper stri

- **system.disk pack promoted to default-on** (`PacksConfig::enabled_pack_ids`) — first-time users with empty config now get `mkfs`/`dd-to-/dev`/`fdisk`/`parted`/`mdadm`/`lvm`/`wipefs` protection without manual enablement. Opt-out via `disa

- **Strict git pack**: expanded dangerous-command detection for additional destructive git patterns ([6d950f3](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6d950f3), [031e84a](https://github.com/Dicklesworthstone/de

- Removed safe patterns in strict git pack that created a compound-command bypass ([d6ce202](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d6ce202))

- Podman `rm`/`rmi` combined-flag bypass (e.g. `podman rm -af`) ([d9d23b5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d9d23b5))

- Podman `rm`/`rmi` combined-flag bypass (e.g. `podman rm -af`) ([d9d23b5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d9d23b5))

- **Codex CLI PreToolUse hook support**: Codex CLI 0.125.0+ is supported via stable `~/.codex/hooks.json` PreToolUse hooks. dcg detects Codex hook input from the `turn_id` field and uses the strict stderr-deny contract with exit code 2 requ

- Hook system expansion with additional interception patterns and strict git pack hardening ([031e84a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/031e84a))

- Disambiguate Claude Code from Gemini in `detect_protocol()` -- closes [#77](https://github.com/Dicklesworthstone/destructive_command_guard/issues/77) ([8815b54](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8815b54

- Clippy and rustfmt cleanup across CLI, hook, and pack modules ([c26f22d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c26f22d))

- Test infrastructure: `large_dataset_insertion` test updated to use in-memory DB with manual seeding ([784e356](https://github.com/Dicklesworthstone/destructive_command_guard/commit/784e356))

## [v0.4.3](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.3) -- 2026-03-14 [Tag]

- **Real-time `settings.json` overwrite detection and self-healing** -- DCG now watches for external processes silently removing its hook registration and restores it automatically ([708d202](https://github.com/Dicklesworthstone/destructive

- `dcg setup` command with shell startup hook-removal detection -- closes [#56](https://github.com/Dicklesworthstone/destructive_command_guard/issues/56) ([45db4b7](https://github.com/Dicklesworthstone/destructive_command_guard/commit/45db4

- Shell startup check to detect silently removed DCG hook ([eb06112](https://github.com/Dicklesworthstone/destructive_command_guard/commit/eb06112))

- Prevent duplicate shell check injection on re-runs ([8b70cab](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8b70cab))

- **Supabase database protection pack** -- full CLI coverage including `db push`, `db reset`, `migration repair`, `functions delete`, `secrets unset`, `storage rm`, `projects delete`, and more; `--dry-run` whitelisted as safe ([003a429](htt

- **Gemini CLI hook protocol support** with improved detection for minimal payloads ([ac6e6ad](https://github.com/Dicklesworthstone/destructive_command_guard/commit/ac6e6ad), [0629a5d](https://github.com/Dicklesworthstone/destructive_comman

- **Augment Code** agent detection ([5917125](https://github.com/Dicklesworthstone/destructive_command_guard/commit/5917125))

- **GitHub Copilot CLI** agent detection ([84bb1a0](https://github.com/Dicklesworthstone/destructive_command_guard/commit/84bb1a0))

- **Session-scoped allowlist** binding with `session_id` and testable interactive checks ([3533533](https://github.com/Dicklesworthstone/destructive_command_guard/commit/3533533))

- **Interactive allowlist audit system** with collision-resistant backup naming and SQLite schema v6 migration ([c948240](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c948240))

- Project-level hook install and `--no-configure` update flag ([1397a8b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1397a8b))

- **TOON output format** support, hardened history storage, and improved test infrastructure ([69f60c8](https://github.com/Dicklesworthstone/destructive_command_guard/commit/69f60c8))

- Emit JSON `"ask"` decision for warn-severity matches in hook mode -- closes [#70](https://github.com/Dicklesworthstone/destructive_command_guard/issues/70) ([91f09db](https://github.com/Dicklesworthstone/destructive_command_guard/commit/9

- Display `custom_paths` packs in `dcg packs` listing -- closes [#57](https://github.com/Dicklesworthstone/destructive_command_guard/issues/57) ([045cfc0](https://github.com/Dicklesworthstone/destructive_command_guard/commit/045cfc0))

- Redis `maxmemory` regex no longer matches `maxmemory-policy` ([1c3c94a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1c3c94a))

- Missing Redis CONFIG SET rules for `maxmemory`, persistence, and rewrite ([4f0a21a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4f0a21a))

- ARM64 compilation fix for `uring-fs` (`*const i8` to `*const libc::c_char`) ([7b9bf96](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7b9bf96))

- Installer and CI aligned on `gnu` targets to match existing release binaries ([5e81603](https://github.com/Dicklesworthstone/destructive_command_guard/commit/5e81603))

## [v0.4.2](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.2) -- 2026-02-23 [Tag]

- Resolved 91+ pre-existing test failures across the entire test suite ([faf7e0e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/faf7e0e))

- License updated to MIT with OpenAI/Anthropic Rider ([c1200c7](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c1200c7))

## [v0.4.1](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.1) -- 2026-02-22 [Tag]

- Switch Linux x86_64 distribution to **musl** for portable, statically linked binaries ([e066687](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e066687))

- Static linking verification for musl builds in CI ([6cdbfc1](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6cdbfc1), [0a6850c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0a6850c))

- `fsqlite` dependencies switched from local paths to crates.io v0.1.0 ([9dc695b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/9dc695b))

- `rich_rust` dependency updated from pre-release/git ref to crates.io v0.2.0 ([83d4abf](https://github.com/Dicklesworthstone/destructive_command_guard/commit/83d4abf))

- crates.io keyword limit compliance (max 5) ([0a46ef7](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0a46ef7))

- `dcg pack-info` shows patterns by default; new `--json` and `--no-patterns` flags ([48e303e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/48e303e))

- Binary content detection for Unicode; FTS rowid sync; regex engine fallback ([acc2f2c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/acc2f2c))

- macOS `CursorUIViewService` filtered from Cursor IDE detection ([970f62f](https://github.com/Dicklesworthstone/destructive_command_guard/commit/970f62f))

- Migrate all branch references from `master` to `main`; fix quote-stripping in normalizer ([920d785](https://github.com/Dicklesworthstone/destructive_command_guard/commit/920d785))

- History writer migrated to thread-local DB; updated `rand` API ([4d1b3c7](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4d1b3c7))

- Comprehensive unit tests for output modules ([b97f50a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b97f50a))

## [v0.4.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.4.0) -- 2026-02-10 [Release]

- **GitHub Copilot CLI hook support** and installer integration ([7385931](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7385931))

- Timeout protection and user feedback for agent scanning during install ([37c9123](https://github.com/Dicklesworthstone/destructive_command_guard/commit/37c9123))

- `repository_dispatch` triggers for homebrew-tap and scoop-bucket automated packaging ([b5482b4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b5482b4))

- Evaluator refactored to consolidate external pack checking into core evaluation ([fea7d6a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fea7d6a))

- Build ordered pack list and keyword index after external packs are loaded ([314e591](https://github.com/Dicklesworthstone/destructive_command_guard/commit/314e591))

- All available subcommands now appear in `dcg --help` output ([23f3301](https://github.com/Dicklesworthstone/destructive_command_guard/commit/23f3301))

## [v0.3.0](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.3.0) -- 2026-02-02 [Release]

- **Robot mode** with structured JSON output and machine-readable exit codes (`dcg test --robot`) ([e576883](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e576883))

- Robot mode API documentation ([34506dd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/34506dd))

- Schema versioning and metadata in `TestOutput` JSON ([b7a6d6d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b7a6d6d))

- `rich_rust` dependency with DcgConsole wrapper and rich theme bridge ([ae39947](https://github.com/Dicklesworthstone/destructive_command_guard/commit/ae39947), [c881a75](https://github.com/Dicklesworthstone/destructive_command_guard/commi

- Tables migrated to `rich_rust` ([328107a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/328107a))

- Enhanced `doctor`, `packs`, and `stats` commands with rich terminal output ([02b5086](https://github.com/Dicklesworthstone/destructive_command_guard/commit/02b5086), [ea39323](https://github.com/Dicklesworthstone/destructive_command_guard

- Tree visualization for `dcg explain` ([e538399](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e538399), [2b8780d](https://github.com/Dicklesworthstone/destructive_command_guard/commit/2b8780d))

- CLI output control flags for legacy and color modes ([fdda44f](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fdda44f))

- Golden JSON tests framework for deterministic output validation ([0b0ca97](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0b0ca97))

- Robot framework test fixtures ([cbf74da](https://github.com/Dicklesworthstone/destructive_command_guard/commit/cbf74da))

- Detailed explanations added to all destructive patterns ([e775c2b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/e775c2b))

- Expanded allowlist rules for safe command patterns ([db272dc](https://github.com/Dicklesworthstone/destructive_command_guard/commit/db272dc))

- External pack loading from `custom_paths` wired into the evaluator ([bea17d0](https://github.com/Dicklesworthstone/destructive_command_guard/commit/bea17d0), [a2cabc5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/

- Expanded `system.disk` pack with mdadm, btrfs, LVM, and dmsetup patterns ([56df75a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/56df75a))

- **Agent-specific profiles and trust levels** (Epic 9) -- auto-detect AI coding agent and apply tailored settings ([77571ba](https://github.com/Dicklesworthstone/destructive_command_guard/commit/77571ba))

- Configurable verification methods for interactive prompts ([23618ac](https://github.com/Dicklesworthstone/destructive_command_guard/commit/23618ac))

- OpenCode added to supported tools list ([4473419](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4473419))

- macOS config path: check XDG-style `~/.config/dcg` first ([ceffdf5](https://github.com/Dicklesworthstone/destructive_command_guard/commit/ceffdf5))

- External packs marked as always-enabled in listing ([7821773](https://github.com/Dicklesworthstone/destructive_command_guard/commit/7821773))

- Iteration limit added to prevent unbounded wrapper stripping in normalizer ([d342171](https://github.com/Dicklesworthstone/destructive_command_guard/commit/d342171))

- CI/TERM=dumb detection for plain text fallback output ([47b4ddd](https://github.com/Dicklesworthstone/destructive_command_guard/commit/47b4ddd))

## [v0.2.15](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.2.15) -- 2026-01-20 [Release]

- Run only lib tests in dist workflow to avoid missing binary errors ([6489d2b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6489d2b))

## [v0.2.14](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.2.14) -- 2026-01-20 [Tag]

- Bump version to 0.2.14 and apply `cargo fmt` ([6d67502](https://github.com/Dicklesworthstone/destructive_command_guard/commit/6d67502))

## [v0.2.13](https://github.com/Dicklesworthstone/destructive_command_guard/releases/tag/v0.2.13) -- 2026-01-20 [Tag]

- **MCP server mode** (`dcg mcp`) for direct agent integration via the Model Context Protocol ([b372d99](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b372d99))

- Hook output enriched with `ruleId`, `severity`, and `remediation` fields ([b439cd4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/b439cd4))

- Agent ergonomics test suite ([0ebc72f](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0ebc72f))

- Machine-readable DCG documentation added to AGENTS.md ([871f929](https://github.com/Dicklesworthstone/destructive_command_guard/commit/871f929))

- **SARIF 2.1.0 output format** for security tool and CI integration ([4a4c09e](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4a4c09e), [17f2040](https://github.com/Dicklesworthstone/destructive_command_guard/commit/

- Standardized error code system (DCG-XXXX) ([4f87561](https://github.com/Dicklesworthstone/destructive_command_guard/commit/4f87561))

- JSON Schema (Draft 2020-12) for all DCG output formats ([8c7601c](https://github.com/Dicklesworthstone/destructive_command_guard/commit/8c7601c))

- `--format json` support for `test` and `packs` commands ([f9db962](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f9db962))

- **Rich terminal rendering** -- denial boxes, progress bars, tables, and TUI denial integration ([a0aaf42](https://github.com/Dicklesworthstone/destructive_command_guard/commit/a0aaf42), [f9986e0](https://github.com/Dicklesworthstone/destr

- Span highlighting with caret-style terminal formatter for denial output ([32aaa18](https://github.com/Dicklesworthstone/destructive_command_guard/commit/32aaa18), [ad2ac66](https://github.com/Dicklesworthstone/destructive_command_guard/co

- **Native Rust self-update mechanism** with version rollback and background notification ([f8a8a15](https://github.com/Dicklesworthstone/destructive_command_guard/commit/f8a8a15), [d0e1066](https://github.com/Dicklesworthstone/destructive_

- `--check` flag for version checking ([c4f4f64](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c4f4f64))

- **Sigstore cosign signing** added to release workflow ([45c8109](https://github.com/Dicklesworthstone/destructive_command_guard/commit/45c8109))

- Installer: sigstore verification, Cursor detection, preflight checks, version-check idempotency ([2a597b6](https://github.com/Dicklesworthstone/destructive_command_guard/commit/2a597b6), [1ab0b5b](https://github.com/Dicklesworthstone/dest

- Installer: checksum verification with `--no-verify` flag ([616db4a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/616db4a))

- Installer: `uninstall.sh` script with agent hook removal ([c3d3eff](https://github.com/Dicklesworthstone/destructive_command_guard/commit/c3d3eff))

- Installer: Aider auto-configuration, Continue detection (unsupported status), Codex CLI detection (unsupported status) ([0a06a82](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0a06a82), [8d07940](https://github.com

- **Custom pack system** with external YAML loading (`custom_paths` in config) ([0e4bc64](https://github.com/Dicklesworthstone/destructive_command_guard/commit/0e4bc64), [f87aade](https://github.com/Dicklesworthstone/destructive_command_gua

- Regex engine analysis and pack validation utilities ([fa9400f](https://github.com/Dicklesworthstone/destructive_command_guard/commit/fa9400f))

- CircleCI extractor (`.circleci/config.yml`) ([1a3b232](https://github.com/Dicklesworthstone/destructive_command_guard/commit/1a3b232))

- Azure Pipelines extractor ([80d4cda](https://github.com/Dicklesworthstone/destructive_command_guard/commit/80d4cda))

- Dockerfile extractor improvements ([302e35f](https://github.com/Dicklesworthstone/destructive_command_guard/commit/302e35f))

- GitLab CI extractor tests ([3316733](https://github.com/Dicklesworthstone/destructive_command_guard/commit/3316733))

- Comprehensive severity levels and extended explanations across all packs ([86b6b9a](https://github.com/Dicklesworthstone/destructive_command_guard/commit/86b6b9a), [8dafbe3](https://github.com/Dicklesworthstone/destructive_command_guard/c

- Explanations added to DNS, Payment, database, infrastructure, Kubernetes, container, CI/CD, backup, and API gateway packs ([82064d4](https://github.com/Dicklesworthstone/destructive_command_guard/commit/82064d4), [42ed80b](https://github.

- **MySQL pack** with comprehensive destructive patterns ([81b0ca8](https://github.com/Dicklesworthstone/destructive_command_guard/commit/81b0ca8))

- Suggestions added for Docker, Kubernetes, MySQL, and system permissions packs ([26dcc3b](https://github.com/Dicklesworthstone/destructive_command_guard/commit/26dcc3b), [1b16ef0](https://github.com/Dicklesworthstone/destructive_command_gu