#rm -rf

Block rm -rf with a Claude Code PreToolUse hook, and know its limits

Two ways to deny a dangerous rm before it runs: exit code 2 and permissionDecision. Why a hook deny works even in bypassPermissions, and where string matching stops being enough.