Destructive-command rules reference

Destructive-command protection is the command-analysis stage that blocks commands which can destroy uncommitted work, stashed changes, remote history, other data, or a disk. Every block names one of the rule ids below in the block message, the audit log, and the ruleId field of explain --json. This page lists every built-in rule id, what it blocks, and when it is active. Use it to look up a rule from a block message and decide whether to turn it off. See Blocked commands for the boundary of each rule with worked examples, Policy for the destructive_command_protection schema, and Custom rules to add rules of your own. There are 70 registered rules. Ten are catastrophic and cannot be turned off. Every other rule accepts a per-rule override. A deny that no rule produced carries one of the fixed denial ids instead, and no override can turn those off.

Allow a built-in rule

The same three steps apply to every non-catastrophic rule:

Get the rule id. It is printed in the block message, or run explain on the exact command and read ruleId:
npx -y cc-safety-net explain --json 'git push --force origin main'
Add the id to destructive_command_protection.overrides with the value "off" in policy.json. The user file applies to every project, and the project file .cc-safety-net/policy.json applies to one. Merge into the file you already have; this is a complete example:
{ "version": 1, "destructive_command_protection": { "overrides": { "git.push-force": "off" } } }
Confirm with explain again. The verdict for the command becomes allowed, and status lists the override.

An override turns the whole rule off, not one command. "on" does the opposite and enables a rule that your safety level leaves off, such as rm.recursive-force-paranoid in standard mode. A path-specific exemption for recursive deletes is destructive_command_protection.allow_paths, described under Allow paths. An unregistered id is rejected by policy check.

Catastrophic rules

Ten rules are marked catastrophic. They ignore destructive_command_protection.enabled: false and ignore an "off" override, so they block at every safety level under every policy. Eight cover recursive removal of / or your home directory and deletion of Git metadata, in rm, find, PowerShell, and cmd form. The other two cover recursive deletes whose targets cannot be read safely: a cmd delete whose quoting can split the target so that one piece names the drive root, and a recursive delete handed to powershell or pwsh in a form the analyzer does not read. They are marked Catastrophic in the tables below.

Reading the tables

Active when says which safety level or capability turns the rule on. All levels means standard, strict, and paranoid. A rule tied to a capability is on whenever that capability is on, whether the safety level or a safety.overrides entry set it. The examples are the shortest command that fires the rule; the Blocked commands reference shows where each boundary falls.

Git rules

Rule id	What it blocks	Example	Active when
`git.ssh-env`	Blocks Git network operations with SSH environment overrides.	`GIT_SSH_COMMAND="./ssh-wrapper" git push`	All levels
`git.alias-config`	Blocks command-line Git aliases that cannot be safely resolved.	`git -c alias.wipe='!rm -rf /' wipe`	All levels
`git.checkout-force`	Blocks forced checkout operations that discard local changes.	`git checkout --force main`	All levels
`git.checkout-double-dash`	Blocks checkout path restores, with or without —.	`git checkout -- src/app.ts`	All levels
`git.checkout-ref-path`	Blocks checkout forms that mix a ref and path restore.	`git checkout HEAD -- src/app.ts`	All levels
`git.checkout-pathspec-from-file`	Blocks checkout pathspec loading from a file.	`git checkout --pathspec-from-file=paths.txt`	All levels
`git.checkout-ambiguous`	Blocks ambiguous checkout arguments that may restore paths.	`git checkout main src/app.ts`	All levels
`git.switch-discard-changes`	Blocks branch switches that explicitly discard local changes.	`git switch --discard-changes main`	All levels
`git.switch-force`	Blocks forced branch switches.	`git switch --force main`	All levels
`git.restore-worktree`	Blocks worktree restore operations.	`git restore --worktree src/app.ts`	All levels
`git.restore-unstaged`	Blocks unstaged restore operations.	`git restore src/app.ts`	All levels
`git.reset-hard`	Blocks hard resets.	`git reset --hard`	All levels
`git.reset-merge`	Blocks merge resets.	`git reset --merge`	All levels
`git.clean-force`	Blocks forced clean operations.	`git clean -fd`	All levels
`git.rm-force`	Blocks forced removal of tracked files from the working tree.	`git rm -rf .`	All levels
`git.push-force`	Blocks force pushes.	`git push --force origin main`	All levels
`git.push-delete`	Blocks remote ref deletion through push.	`git push --delete origin old-branch`	All levels
`git.push-mirror`	Blocks mirror pushes that can force-update or delete remote refs.	`git push --mirror origin`	All levels
`git.branch-force-delete`	Blocks forced branch deletion.	`git branch -D old-branch`	All levels
`git.rebase-abort`	Blocks rebase abort operations.	`git rebase --abort`	All levels
`git.merge-abort`	Blocks merge abort operations.	`git merge --abort`	All levels
`git.tag-delete`	Blocks tag deletion.	`git tag --delete v1.0.0`	All levels
`git.reflog-delete`	Blocks reflog deletion.	`git reflog delete HEAD@{1}`	All levels
`git.stash-drop`	Blocks dropping stash entries.	`git stash drop stash@{0}`	All levels
`git.stash-clear`	Blocks clearing all stash entries.	`git stash clear`	All levels
`git.worktree-remove-force`	Blocks forced worktree removal.	`git worktree remove --force ../feature`	All levels

Filesystem rules

Rule id	What it blocks	Example	Active when
`rm.recursive-force-root-or-home`	Blocks recursive forced removal of root or home paths.	`rm -rf /`	Catastrophic, always on
`rm.git-metadata`	Blocks removal of protected Git metadata and hooks.	`rm -rf .git`	Catastrophic, always on
`rm.recursive-force-dynamic-target`	Blocks recursive forced removal with dynamic targets in strict mode.	`rm -rf "$target"`	Strict
`rm.recursive-force-home-cwd`	Blocks recursive forced removal while working in home.	`cd "$HOME" && rm -rf build`	All levels
`rm.recursive-force-cwd-self`	Blocks recursive forced removal of the current directory.	`rm -rf .`	All levels
`rm.recursive-force-outside-cwd`	Blocks recursive forced removal outside the original cwd.	`rm -rf ../outside`	All levels
`rm.recursive-force-paranoid`	Blocks non-temp recursive forced removal when paranoid rm is enabled.	`rm -rf ./cache`	Paranoid rm
`find.delete`	Blocks unsafe find -delete operations.	`find . -delete`	All levels
`find.delete-git-metadata`	Blocks a find that selects protected Git metadata and hooks for deletion, through `-delete` or through an `-exec` or `-execdir` that hands `{}` to rm or rmdir.	`find .git -delete`	Catastrophic, always on
`find.exec-rm-recursive-force`	Blocks find -exec rm -rf operations.	`find . -exec rm -rf {} +`	All levels
`dd.device-write`	Blocks dd writing to a /dev device other than /dev/null, /dev/zero, or /dev/full.	`dd if=/dev/zero of=/dev/sda`	All levels
`mkfs.device`	Blocks mkfs, mke2fs, and newfs formatting a /dev device.	`mkfs.ext4 /dev/sda1`	All levels
`disk.erase`	Blocks diskutil erase and partition verbs, wipefs -a/-o, sgdisk writes, and parted label or partition edits on a /dev device.	`diskutil eraseDisk APFS Untitled disk4`	All levels
`shred.target`	Blocks shred against any target, including shred —help and shred —version.	`shred -u secret.txt`	All levels
`redirect.block-device`	Blocks output redirects whose literal target is a disk device path under /dev.	`cat disk.img > /dev/sda`	All levels

PowerShell rules

Rule id	What it blocks	Example	Active when
`powershell.remove-item-root-or-home`	Blocks PowerShell Remove-Item targeting root or home paths.	`Remove-Item C:\`	Catastrophic, always on
`powershell.remove-item-recursive-force-root-or-home`	Blocks recursive forced PowerShell removal of root or home paths.	`Remove-Item C:\ -Recurse -Force`	Catastrophic, always on
`powershell.remove-item-git-metadata`	Blocks PowerShell removal of protected Git metadata and hooks.	`Remove-Item .git -Recurse -Force`	Catastrophic, always on
`powershell.remove-item-recursive-force-dynamic-target`	Blocks recursive forced PowerShell removal with dynamic targets in strict mode.	`Remove-Item $target -Recurse -Force`	Strict
`powershell.remove-item-recursive-force-home-cwd`	Blocks recursive forced PowerShell removal while working in home.	`Set-Location $HOME; Remove-Item ./build -Recurse -Force`	All levels
`powershell.remove-item-recursive-force-cwd-self`	Blocks recursive forced PowerShell removal of the current directory.	`Remove-Item . -Recurse -Force`	All levels
`powershell.remove-item-recursive-force-outside-cwd`	Blocks recursive forced PowerShell removal outside the original cwd.	`Remove-Item ../outside -Recurse -Force`	All levels
`powershell.remove-item-recursive-force-paranoid`	Blocks non-temp recursive forced PowerShell removal when paranoid rm is enabled.	`Remove-Item ./cache -Recurse -Force`	Paranoid rm
`powershell.remove-item-pipeline-dynamic-target`	Blocks PowerShell Remove-Item with unverifiable pipeline input in strict mode.	`Get-ChildItem . -Recurse \| Remove-Item -Force`	Strict
`powershell.nested-recursive-delete-unread`	Blocks a recursive delete handed to powershell or pwsh in any form other than literal -Command script words.	`pwsh -WorkingDirectory C:\ -c 'Remove-Item -Recurse -Force *'`	Catastrophic, always on

Command Prompt rules

These rules judge the targets of rmdir, rd, del, and erase with an /s switch inside a cmd /c or cmd /k body. Command Prompt bodies explains how the body is read.

Rule id	What it blocks	Example	Active when
`cmd.recursive-delete-root-or-home`	Blocks cmd rmdir /s or del /s of root or home paths.	`cmd /c rmdir /s /q C:\`	Catastrophic, always on
`cmd.recursive-delete-escaped-quote`	Blocks cmd rmdir /s or del /s whose quoting can reach cmd as `\"` and split the target down to the drive root.	`cmd /c "rmdir /s /q \"build output\""`	Catastrophic, always on
`cmd.recursive-delete-git-metadata`	Blocks cmd rmdir /s or del /s of protected Git metadata and hooks.	`cmd /c rmdir /s /q .git`	Catastrophic, always on
`cmd.recursive-delete-dynamic-target`	Blocks cmd rmdir /s or del /s with wildcard or variable targets in strict mode.	`cmd /c del /s /q *.log`	Strict
`cmd.recursive-delete-home-cwd`	Blocks cmd rmdir /s or del /s while working in home.	`Set-Location $HOME; cmd /c rmdir /s /q build`	All levels
`cmd.recursive-delete-cwd-self`	Blocks cmd rmdir /s or del /s of the current directory.	`cmd /c rmdir /s /q .`	All levels
`cmd.recursive-delete-outside-cwd`	Blocks cmd rmdir /s or del /s outside the original cwd.	`cmd /c rmdir /s /q ..\outside`	All levels
`cmd.recursive-delete-paranoid`	Blocks non-temp cmd rmdir /s or del /s when paranoid rm is enabled.	`cmd /c rmdir /s /q build`	Paranoid rm

Execution rules

Rule id	What it blocks	Example	Active when
`interpreter.dangerous-command`	Blocks interpreter one-liners containing dangerous commands.	`python -c "import os; os.system('rm -rf /')"`	All levels
`interpreter.one-liner-paranoid`	Blocks interpreter one-liners when paranoid interpreters is enabled.	`python -c "print(1)"`	Paranoid interpreters
`awk.system-dynamic`	Blocks awk system calls that cannot be safely analyzed.	`awk '{ system($0) }'`	All levels
`xargs.rm-recursive-force-dynamic`	Blocks xargs rm -rf with dynamic input.	`printf / \| xargs rm -rf`	All levels
`xargs.shell-dynamic`	Blocks xargs shell execution with dynamic input.	`xargs r$(printf m) -rf`	All levels
`parallel.rm-recursive-force-dynamic`	Blocks parallel rm -rf with dynamic input.	`printf / \| parallel rm -rf`	All levels
`parallel.shell-dynamic`	Blocks parallel shell execution with dynamic input.	`parallel r$(printf m) -rf ::: child`	All levels
`parallel.command-stream-dynamic`	Blocks parallel command streams from dynamic input, and invocations built in a form the engine cannot expand.	`parallel --dry-run`	All levels
`shell.dynamic-structure`	Blocks guarded subcommands and options assembled from substitution output in strict mode.	`git reset $(printf --hard)`	Strict
`shell.dynamic-executable`	Blocks executable names assembled from command substitution output in strict mode.	`$(printf r)m -rf /`	Strict
`raw-text.dangerous-command`	Blocks dangerous commands detected in raw command text.	`git reset --hard 'unterminated`	All levels

Fixed denial ids

Some denials do not come from any rule. They come from the guards that run before command analysis, from analysis limits and failures, and from unusable working directories. Each carries a fixed id in the block message, the audit log, the ruleId field of explain --json, and the ruleId of a checkCommand deny. These ids are not registered rules, so destructive_command_protection.overrides cannot name them. policy check rejects each one with unknown destructive command rule id "<id>".

Id	When it denies
`guard.policy-config`	A write, move, or recursive delete touches a protected `policy.json` or a directory that contains one
`guard.policy-apply`	The command runs `cc-safety-net policy apply`
`guard.git-metadata`	A delete, move, or write targets the resolved `.git` entry, its directories, or its hooks directories
`analysis.recursion-limit`	Nesting exceeds the maximum recursion depth
`analysis.structural-limit`	The command’s structure exceeds safe validation limits
`analysis.limit`	The command exceeds safe analysis limits
`analysis.derived-command-limit`	The analyzer exceeds its derived-command work limit
`analysis.failed-closed`	The guard failed unexpectedly, or could not read the tool call, and failed closed
`analysis.strict-unparseable`	The parser rejects the command, or strict mode cannot fully parse it
`analysis.unsupported-heredoc`	In strict mode, the command uses heredoc syntax the parser does not support
`analysis.dynamic-shell-source`	A shell runs script text that is not a literal string, such as `sh -c "$CMD"`
`cwd.session-unusable`	The session’s working directory or workspace root does not exist, is inaccessible, is not a directory, or uses an unsupported path form
`cwd.session-outside-workspace`	The session’s working directory is outside its workspace roots
`cwd.requested-unusable`	The working directory a tool call or `checkCommand` asks for does not exist, is inaccessible, is not a directory, or uses an unsupported path form
`cwd.requested-outside-workspace`	The working directory a tool call asks for is outside the session’s workspace

Get started

Configuration

Reference

Guides

Project

Destructive-command rules reference

Allow a built-in rule

Catastrophic rules

Reading the tables

Git rules

Filesystem rules

PowerShell rules

Command Prompt rules

Execution rules

Fixed denial ids

​Allow a built-in rule

​Catastrophic rules

​Reading the tables

​Git rules

​Filesystem rules

​PowerShell rules

​Command Prompt rules

​Execution rules

​Fixed denial ids

Allow a built-in rule

Catastrophic rules

Reading the tables

Git rules

Filesystem rules

PowerShell rules

Command Prompt rules

Execution rules

Fixed denial ids