feat(hooks): dangerous-actions-blocker — PreToolUse hook for blocking destructive CLI ops

Proposal

A ready-to-use PreToolUse Bash hook that intercepts dangerous commands before execution in Claude Code (and compatible AI agents). Shipped as a file in hooks/claude/ that users can copy into their .claude/hooks/ config.

What it blocks/asks

Container-aware

Commands inside docker exec / kubectl exec skip host-path safety checks (paths resolve inside the container, not the host).

Integration

// .claude/settings.json
{
  "hooks": {
    "PreToolUse": [
      { "matcher": "Bash", "hooks": ["bash hooks/claude/dangerous-actions-blocker.sh"] }
    ]
  }
}

Questions for the team

1. Is this in scope for RTK? Or does it belong in a separate repo / community hooks collection?
2. Overlap with existing features? Does RTK already plan a built-in safety layer (e.g., via the rewrite hook or TOML filters)?
3. Regex vs structured parsing? Current approach uses grep -qE on the raw command string — works but can false-positive on edge cases. Would a Rust-based approach be preferred?
4. Default decisions — should rm -rf outside safe dirs be block or ask?

Happy to implement whichever direction you prefer. I have a working prototype ready to go once we align on scope.

Start by reviewing the proposed hooks/claude/dangerous-actions-blocker.sh prototype and its .claude/settings.json PreToolUse integration. Check the raw-command grep -qE approach, container-aware behavior, and the listed block/ask rules, then resolve the scope, implementation language, and default decisions with the team before defining completion.