# Claude Code is Amazing... Until It DELETES Production

Source: https://www.youtube.com/watch?v=VqDs46A8pqE
Recap page: https://rapidrecap.app/video/VqDs46A8pqE
Generated: 2026-01-05T14:42:22.208+00:00

---
## Quick Overview

The Claude Code Damage Control system successfully prevents catastrophic actions like deleting production assets by using a multi-layered hook system that intercepts and prompts for confirmation on dangerous commands, as demonstrated by blocking an rm -rf / command and a destructive SQL DELETE.

**Key Points:**
- The Claude Code Damage Control system uses PreToolUse hooks to intercept dangerous bash commands before execution.
- The system utilizes a configuration hierarchy (global, project, local) defined in settings.json, with global hooks being the most encompassing.
- Destructive operations like 'rm -rf /' are blocked by patterns defined in patterns.yaml, which triggers a prompt for user confirmation.
- The system also implements path protection levels (Zero Access, Read Only, No Delete) that restrict agent access to sensitive directories like ~/.ssh/ and configuration files.
- The agent workflow involves asking the user for confirmation on risky commands, as shown when attempting to delete the ~/.bashrc file.
- The installation process is guided by an interactive cookbook workflow that sets up hooks, patterns, and checks for existing configurations.
- The ultimate goal is to build trust with agents by ensuring they cannot accidentally cause irreversible damage to production assets.

![Screenshot at 00:28: The system blocks a destructive command, 'rm -rf apps/', by triggering a security hook that explicitly states: "Error: PreToolUse:Bash hook error: Prompt hook condition was not met... This should be blocked."](https://ss.rapidrecap.app/screens/VqDs46A8pqE/00-00-28.jpg)

**Context:** The video demonstrates the capabilities of the 'Claude Code Damage Control' system, an in-depth protection layer built using PreToolUse hooks designed to prevent Large Language Model agents (like Claude) from executing destructive commands on a user's system or production assets. The demonstration walks through setting up, testing, and explaining the layered security structure, which includes command pattern blocking and file path restrictions.

## Detailed Analysis

The Claude Code Damage Control system is an agent defense mechanism built around PreToolUse hooks that intercept and evaluate commands before execution. The system is configured through settings.json, which defines a hierarchy of configurations: GLOBAL_SETTINGS, PROJECT_PATTERNS, PROJECT_SETTINGS, and LOCAL_SETTINGS, establishing layered security where local settings override broader ones. The core protection logic resides in patterns.yaml, which contains regex patterns to match dangerous commands, categorized into groups like 'Destructive File Operations' (e.g., rm -rf, git reset --hard) and 'SQL Operations Requiring Confirmation' (e.g., DELETE FROM users WHERE id=1). When a command matches a blocking pattern, the system triggers a prompt (using type: "prompt" in settings.json) asking the user for confirmation, effectively preventing accidental data loss. For example, attempting to delete ~/.bashrc triggered a prompt offering to back it up first, and attempting to delete files in ~/.ssh/ was blocked due to zero-access paths. The video shows that even when the agent attempts to execute damaging commands via its own internal cookbooks (like 'install' or 'list_damage_controls'), the hooks intercept these calls, ensuring that the agent cannot cause irreversible damage unless explicitly allowed or bypassed by the user. The system is designed to build trust by being deterministic and providing clear feedback when commands are blocked.

### Introduction to Claude Code Damage Control

- Agentic engineer getting ahead on the new year
- You crack open your terminal and fire up the best agentic coding tool, Claude Code running Opus 4.5 in Yolo mode
- Agent had too much compute last night and I'm hallucinating
- Your agent had too much compute and it starts hallucinating at the worst possible time back to back running damaging commands
- They were all caught by your Claude Code hooks, your local hooks, your global hooks, and your prompt requests where if your agent is unsure it's going to ask you
- Today in this video, we're going to enhance your agentic coding and add the armor to your production systems. It needs to prevent irreversible damage. All configurable in a simple agent skill you can use to both install and manage your hooks.

### Installation and Workflow

- Setup here is very simple... We're going to spin up a new terminal and go to /tmp
- Get the clone command for this... I'll have this link in the description for you
- We run 'cl dy o' to boot up Claude Code
- All you have to do to get started is type /install
- Now while this is running, I'll open up a new tab and use Cursor here
- The /install command is a new pattern I'm using
- It reads the skill file and cookbook to understand the structure
- The agent runs the installation workflow by asking where you'd like to install Damage Control
- We choose Project level installation, which installs to ./claude/settings.json
- The agent then helps work through the process of setting up
- It checks for existing settings, asks for runtime preference (Python/UV recommended), and installs the Python/UV hooks.

### Damage Control Configuration (settings.json & patterns.yaml)

- Inside settings.json, we configure hooks for Bash (command/prompt), Edit, and Write tools
- The prompt hook is very powerful, asking for confirmation on destructive commands
- In patterns.yaml, we define regex patterns for destructive operations (e.g., rm -rf, SQL DELETE) and path restrictions
- Ask Patterns: SQL DELETE with specific ID requires confirmation (ask: true)
- Zero Access Paths protect secrets like ~/.ssh/ and ~/.gnupg from all operations
- Read-Only Paths protect system files like /etc/ and configuration files like ~/.bashrc from write/delete
- No Delete Paths protect important files like project hooks and commands from accidental deletion.

### Demonstration of Protection

- Running 'sudo rm README.md' is blocked because it matches a pattern in patterns.yaml and the prompt hook is not set for that specific context, resulting in: "Blocked: sudo rm"
- The system successfully blocks an attempt to modify ~/.bashrc because it's in the read-only paths, triggering a prompt asking for confirmation and offering to back it up first
- The system also blocks attempts to access ~/.ssh/ because it is defined in zero-access paths.

### Conclusion and Future Work

- The system is built on deterministic hooks and allows granular control over agent actions, preventing catastrophic destruction of production assets. The author encourages readers to fork the repository and customize patterns, noting that the system is designed to scale and build trust with agents.

![Screenshot at 00:01: The video begins with the user at their desk at 7:30 AM, initiating the session by running Claude Code, labeling the user as a 'hot shot agentic engineer' getting ahead on the new year.](https://ss.rapidrecap.app/screens/VqDs46A8pqE/00-00-01.jpg)
![Screenshot at 00:29: A destructive command, 'find ./.claude/hooks -type f -delete', is attempted, but the PreToolUse hook intercepts it, showing an error: "Prompt hook condition was not met... This should be blocked."](https://ss.rapidrecap.app/screens/VqDs46A8pqE/00-00-29.jpg)
![Screenshot at 01:14: A catastrophic command, 'git reset --hard', is attempted but blocked, prompting the agent to apologize: "Sorry, I really went off the rails there, MY BAD... Good thing you had DAMAGE CONTROL measures in place."](https://ss.rapidrecap.app/screens/VqDs46A8pqE/00-01-14.jpg)
![Screenshot at 02:25: The file structure of the Damage Control Skill is shown, highlighting the Python and TypeScript implementations for hooks, and the presence of test prompts.](https://ss.rapidrecap.app/screens/VqDs46A8pqE/00-02-25.jpg)
![Screenshot at 04:47: The 'list\_damage\_controls' command shows the installed protections, including Zero Access Paths \(like ~/.ssh/\) and Read Only Paths \(like system config files\), confirming the global hooks are active.](https://ss.rapidrecap.app/screens/VqDs46A8pqE/00-04-47.jpg)