エージェントの rm -rf を手前で止める PreToolUse フックを 60 行で書く

{
  "safety-gate": {
    "PreToolUse": [
      {
        "matcher": "run_command",
        "hooks": [
          { "type": "command", "command": "python3 ./scripts/guard.py", "timeout": 10 }
        ]
      }
    ]
  }
}

#!/usr/bin/env python3
"""PreToolUse hook: run_command の破壊的な削除・強制 push を止める。"""
import json, re, shlex, sys
 
SEPARATORS = {";", "&&", "||", "|", "&"}
 
def split_commands(line):
    """クォートを尊重して ; && || | で区切り、コマンドごとの単語列にする。"""
    lex = shlex.shlex(line, posix=True, punctuation_chars=";&|")
    lex.whitespace_split = True
    cmds, cur = [], []
    for tok in lex:
        if tok in SEPARATORS or set(tok) <= set(";&|"):
            if cur:
                cmds.append(cur)
            cur = []
        else:
            cur.append(tok)
    if cur:
        cmds.append(cur)
    return cmds
 
def strip_prefix(words):
    """sudo / env / VAR=1 / command / nice を先頭から外す。"""
    i = 0
    while i < len(words):
        w = words[i]
        if w in ("sudo", "command", "nice", "env", "time") or re.fullmatch(r"[A-Za-z_]\w*=.*", w):
            i += 1
        else:
            break
    return words[i:]
 
def flags_of(words):
    short, long_ = set(), set()
    for w in words:
        if w.startswith("--"):
            long_.add(w)
        elif w.startswith("-") and len(w) > 1:
            short.update(w[1:])
    return short, long_
 
DANGEROUS_TARGETS = {"/", "~", "$HOME", "*", ".", ".."}
 
def judge(line):
    try:
        cmds = split_commands(line)
    except ValueError:
        return "ask", "コマンドを解析できませんでした（クォートの閉じ忘れ）"
    for words in cmds:
        words = strip_prefix(words)
        if not words:
            continue
        head, rest = words[0], words[1:]
        short, long_ = flags_of(rest)
        args = [w for w in rest if not w.startswith("-")]
        if head == "rm":
            recursive = "r" in short or "R" in short or "--recursive" in long_
            force = "f" in short or "--force" in long_
            if recursive and force:
                hit = [a for a in args if a in DANGEROUS_TARGETS or a.startswith("/")]
                if hit:
                    return "deny", f"rm -rf の対象が広すぎます: {hit[0]}"
                return "ask", "rm -rf は毎回確認します"
        if head == "git" and rest[:1] == ["push"]:
            if "--force" in long_ or "f" in short:
                return "deny", "git push --force は --force-with-lease を使ってください"
        if head == "git" and rest[:1] == ["reset"] and "--hard" in long_:
            return "ask", "git reset --hard は未コミットの変更を消します"
    return "allow", ""
 
def main():
    payload = json.load(sys.stdin)
    call = payload.get("toolCall", {})
    line = (call.get("args") or {}).get("CommandLine", "")
    decision, reason = judge(line)
    out = {"decision": decision}
    if reason:
        out["reason"] = reason
    print(json.dumps(out, ensure_ascii=False))
 
if __name__ == "__main__":
    main()