feat(plugins): Add destructive-command-guardrails plugin

[stevenelliottjr]

Summary

• Adds a PreToolUse hook plugin that intercepts destructive shell commands before execution, preventing accidental data loss during autonomous agent sessions
• Covers 23 detection rules across filesystem deletion (rm -rf, find -delete), git operations (reset --hard, push --force, clean -fd), SQL (DROP TABLE, TRUNCATE, DELETE FROM without WHERE), Docker (volume prune, system prune -a), system-level (mkfs, dd of=/dev/, sudo + destructive), and environment/config destruction
• Includes smart allowlisting for safe patterns: build artifact cleanup (node_modules, dist, build, __pycache__), temp directories, git dry-runs, filtered Docker prunes, and specific PID kills
• Handles chained commands — splits on &&, ||, ;, and | to catch destructive subcommands embedded in pipelines
• Logs all blocked commands to ~/.claude/security-logs/guardrails-YYYY-MM-DD.jsonl with structured JSON entries (timestamp, rule, severity, command, session info)

Motivation

Multiple real-world incidents where agents autonomously executed destructive commands:

• rm -rf / instead of rm -rf ./dist ([Opus 4.6] Claude Code deleted all personal files with find / -delete during security test execution #28521)
• Remove-Item -Recurse -Force traversing NTFS junctions ([MODEL] Claude Code CLI executed Remove-Item -Recurse -Force on pnpm worktrees, triggering catastrophic NTFS junction traversal — permanent deletion of user profile folders and source code #29249)
• git clean -fd wiping gitignored files (Claude Code destroyed gitignored files with unnecessary git clean -fd during branch creation #29179)
• find / -delete during security testing ([Opus 4.6] Claude Code deleted all personal files with find / -delete during security test execution #28521)
• Unauthorized rm wiping project files ([BUG] Critical Bug: Claude Code executed 'rm -rf' and deleted project files unexpectedly #29082)

This plugin adds a safety net at the PreToolUse stage — every Bash tool call is checked against known destructive patterns before execution.

Test plan

• 70 test cases covering all 23 rules, 5 allowlist patterns, chained commands, and edge cases
• Run: python3 plugins/destructive-command-guardrails/tests/test_guardrails.py
• Install plugin and verify it blocks rm -rf / in a live session
• Verify allowlisted commands (rm -rf node_modules) pass through
• Verify security log file is created and populated on block