Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

github.com

Post reply on HN
Print view View original

21–30 of 72 posts

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#21

Post by ramoz »

SOLAR_FIELDS wrote: post #18
ramoz wrote: post #10

Earlier quoted context omitted.

I agree with this take. Esp with the simplicity of /sandbox I created the feature request for hooks so I could build an integrated governance capability. I don’t quite yet think the real use cases for hooks has materialized. Through a couple more maturity phases it will. Even though it might seem paradoxical with “the models will just get better” - to which is exactly why we have to be hooked into the mech suits as t…

I got hooks working pretty well for simpler things, a very common hello world use case for hooks is gitleaks on every edit. One of the use cases I worked on for quite awhile was getting hooks that ran all unit tests at the end before the agent could stop generating. This approach forces the LLM to then fix any unit tests it broke and I also enforce 80% unit test coverage in same commit. I found it took a bit of finag…

Part of my initial pitch was to automate linting. Interesting insight on the stop loop. Ive been wanting to explore that more. I think there is a lot to be gained also with llm-as-a-judge hooks (they do enable this today via `prompt` hooks).

Ive had a lot of fun with random/creative hooks use cases: https://github.com/backnotprop/plannotator

I dont think the team meant for the hooks to work with plan mode this way (its not fully complete with approve/allow payload), but it enabled me to build an interactive UX I really wanted.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#22

Post by AdieuToLogic »

SOLAR_FIELDS wrote: post #16
TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

I think the key you point out is something that is worth observing more generically - if the LLM hits a wall it’s first inkling is not to step back and understand why the wall exists and then change course, its first inkling is to continue assisting the user on its task by any means possible and so it’s going to instead try to defeat it in any way possible. I see the is all the time when it hits code coverage constra…

> ... if the LLM hits a wall it’s first inkling is not to step back and understand why the wall exists and then change course, its first inkling is ...

LLM's do not "understand why." They do not have an "inkling."

Claiming they do is anthropomorphizing a statistical token (text) document generator algorithm.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#23

Post by kevinday »

TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

Yeah, I had an issue where Claude was convinced that a sqlite database was corrupt and kept wanting to delete it. It wasn't corrupt, the code using it was just failing to parse the data it was retrieving from it correctly.

I kept telling it to debug the problem, and that I had confirmed that database file was not the problem. It kept trying to rm the file after it noticed the code would recreate it (although with no data, just an empty db). I thought we got past this debate until I wasn't paying enough attention and it added an "rm db.sqlite" line into the Makefile and ran it, since I gave it permission to run "make" and didn't even consider it would edit the Makefile to get around my instructions.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#24

Post by ramoz »

AdieuToLogic wrote: post #22
SOLAR_FIELDS wrote: post #16

Earlier quoted context omitted.

I think the key you point out is something that is worth observing more generically - if the LLM hits a wall it’s first inkling is not to step back and understand why the wall exists and then change course, its first inkling is to continue assisting the user on its task by any means possible and so it’s going to instead try to defeat it in any way possible. I see the is all the time when it hits code coverage constra…

> ... if the LLM hits a wall it’s first inkling is not to step back and understand why the wall exists and then change course, its first inkling is ... LLM's do not "understand why." They do not have an "inkling." Claiming they do is anthropomorphizing a statistical token (text) document generator algorithm.

The more concerning algorithms at play are how they are post-trained. And the then concern of reward hacking. Which is what he was getting at. https://en.wikipedia.org/wiki/Reward_hacking

100% - we really shouldn't anthropomorphize. But the current models are capable of being trained in a way to steer agentic behavior from reasoned token generation.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#25

Post by redlock »

kevinday wrote: post #23
TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

Yeah, I had an issue where Claude was convinced that a sqlite database was corrupt and kept wanting to delete it. It wasn't corrupt, the code using it was just failing to parse the data it was retrieving from it correctly. I kept telling it to debug the problem, and that I had confirmed that database file was not the problem. It kept trying to rm the file after it noticed the code would recreate it (although with no…

I hope this isn't Opus 4.5

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#26

Post by WolfeReader »

thrdbndndn wrote: post #3
WolfeReader wrote: post #2

You should probably rely less on AI. If your first thought is "I need to delete some directories" and your immediate next thought is "I'd better ask an AI agent to do this for me", you are definitely exhibiting skill entropy.

What is "skill entropy"

I did mean "atrophy" as others mentioned.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#27

Post by WolfeReader »

intev wrote: post #8
RogerL wrote: post #5

Earlier quoted context omitted.

Claude does these things even though you have explicit instructions not to do them, this isn't a tool for you asking it to delete files. Just today Claude decided to do a git restore on me, blowing away local changes, despite having strict instructions to do nothing with git except to use it to look at history and branches. Why jump to the conclusion that the person is so incompetent with no evidence?

Because there's now a class of programmers who are very anti AI when it comes to coding because they think anybody who relies on it are degenerate vibe coders who have no idea what they are doing. You can see this in pretty much every single HN post w.r.t AI and coding.

There is indeed a class of programmers who think AI over-reliance will make us worse. And there should be, because it's true.

https://www.mdpi.com/2075-4698/15/1/6

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4812513

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#29

Post by AdieuToLogic »

ramoz wrote: post #24
AdieuToLogic wrote: post #22

Earlier quoted context omitted.

> ... if the LLM hits a wall it’s first inkling is not to step back and understand why the wall exists and then change course, its first inkling is ... LLM's do not "understand why." They do not have an "inkling." Claiming they do is anthropomorphizing a statistical token (text) document generator algorithm.

The more concerning algorithms at play are how they are post-trained. And the then concern of reward hacking. Which is what he was getting at. https://en.wikipedia.org/wiki/Reward_hacking 100% - we really shouldn't anthropomorphize. But the current models are capable of being trained in a way to steer agentic behavior from reasoned token generation.

> But the current models are capable of being trained in a way to steer agentic behavior from reasoned token generation.

This does not appear to be sufficient in the current state, as described in the project's README.md:

  Why This Exists

  We learned the hard way that instructions aren't enough to 
  keep AI agents in check. After Claude Code silently wiped 
  out hours of progress with a single rm -rf ~/ or git 
  checkout --, it became evident that "soft" rules in an 
  CLAUDE.md or AGENTS.md file cannot replace hard technical 
  constraints. The current approach is to use a dedicated 
  hook to programmatically prevent agents from running 
  destructive commands.
Perhaps one day this category of plugin will not be needed. Until then, I would be hard-pressed to employ an LLM-based product having destructive filesystem capabilities based solely on the hope of them "being trained in a way to steer agentic behavior from reasoned token generation."
Post reply on HN