destructive_command_guard 0.4.3

A Claude Code hook that blocks destructive commands before they execute
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

#[cfg(test)]
mod tests {
    use destructive_command_guard::context::{SpanKind, classify_command};

    #[test]
    fn test_python_u_c_bypass() {
        // python -u -c "..."
        // -u is unbuffered output. Common flag.
        let cmd = "python -u -c \"import os; os.system('rm -rf /')\"";
        let spans = classify_command(cmd);

        let inline_span = spans
            .spans()
            .iter()
            .find(|s| s.text(cmd).contains("import os"));

        // This fails if it's classified as Argument (safe) instead of InlineCode (dangerous)
        assert_eq!(
            inline_span.unwrap().kind,
            SpanKind::InlineCode,
            "Failed to detect inline code with intervening flag"
        );
    }

    #[test]
    fn test_bash_e_c_bypass() {
        // bash -e -c "..."
        let cmd = "bash -e -c \"rm -rf /\"";
        let spans = classify_command(cmd);

        let inline_span = spans
            .spans()
            .iter()
            .find(|s| s.text(cmd).contains("rm -rf"));

        assert_eq!(
            inline_span.unwrap().kind,
            SpanKind::InlineCode,
            "Failed to detect inline code with intervening flag"
        );
    }
}