Why a Regex-Based Claude Code Guard Hook Misses Destructive Commands

The author examines how far a PreToolUse hook in Claude Code's settings.json can protect against destructive agent actions. The hook receives each proposed tool call as JSON and can approve or block it before execution. The author built a minimal guard that pattern-matches Bash commands for operations like rm -rf and git push --force. Testing confirmed it blocks literal destructive commands but approves the same intent when the flag is built from a shell variable or when routed through an unchecked MCP tool. The gap arises because the hook only inspects the raw text of one tool's input and never evaluates what a command actually expands to or which tools it covers.