Dicklesworthstone/destructive_command_guard v0.14.0

on GitHub

dcg v0.14.0

A large false-positive/false-negative wave plus doctor enablement checks.

Added

• Databricks pack rules, precision heredoc interpreter scoping, and strict git scoping (#357, #359, #360, #361, #362, #363): new destructive-Databricks-CLI rules; basename-evidence matching closes the #360/#361 false-negative wave; inert heredoc bodies no longer trip embedded-language analysis; strict_git rules are scoped to actual git executables, ending the ls .git/rebase-merge class of false positives.
• Doctor per-harness enablement checks (#368): dcg doctor now verifies the gate is reachable, not merely installed. A new codex_hook check distinguishes Enabled / never-approved / Disabled / NotRegistered in Codex's hooks.json + config.toml trust model (--fix only flips enabled = true on an existing entry — doctor never forges a trust entry). The OpenCode check byte-compares the installed dcg-guard.js plugin against canonical source, so an edited or stubbed plugin surfaces as OUTDATED OR MODIFIED. Both checks fail doctor (and --strict) when a hook is present but unreachable.

Fixed

• Home-subtree move/Trash-rescue deadlock (#371): mv-sensitive-source-root-home and rm-rf-root-home each recommended the command the other denies, so no move-then-cleanup could complete inside a home directory. Narrow safe patterns now allow in-home renames and the quoted-token Trash rescue (quoting was a one-directional deny amplifier even though filenames with spaces must be quoted), and rule prose recommends only remediations that actually run.
• git show <ref>:<path> redirected onto the same <path> is now denied (#373): the checkout-ref-discard remediation could walk an agent into the exact overwrite the rule exists to prevent. New rule show-redirect-overwrite-source pins redirect target == shown path (>, >>, >|); captures to a new file and the bare view stay allowed. Structured suggestions registered.
• git apply patch heredocs are structured stdin data (#374): a quoted heredoc containing an ordinary unified diff fed to git apply --cached was denied as an unknown embedded language. The git stdin-sink proof now covers apply, with fail-closed edges preserved (--unsafe-paths, config-bearing invocations, PATH/alias overrides).
• Dashed-builtin spellings restored after #362 scoping (#367): git-push --force, git-rebase, etc. are covered again via per-rule dashed executables, without reintroducing the #362 false positives.
• Test suite no longer self-heals the caller's real agent hook (#372): hook-mode test spawns set DCG_SELF_HEAL_HOOK=0, so running tests can no longer install the dev binary into ~/.claude/settings.json.

Changed

• Dependency bumps: flate2 1.1.10, tru 0.2.4, which 8.0.6 (PR #369).

Full changelog: https://github.com/Dicklesworthstone/destructive_command_guard/blob/main/CHANGELOG.md