Claude Code now blocks destructive git commands by default. Keep your deny rules anyway.

Some time ago I asked an agent to roll back to my last push so I could peek at older code. It chose git reset --hard and took my uncommitted work down with it. After that scare I started hand-writing