Claude Code sometimes issues Bash commands for things it could easily do with builtin tools (e.g., shelling out to grep when it has a dedicated Grep tool). A hook that catches those and nudges the agent back — "you already have a tool for this" — could improve session quality without blocking anything.

I suspect there's a lot of overlap with what you've built: parse the command into tokens, run it against rules, decide. The difference is the output is "redirect" instead of "deny." Have you thought about non-blocking rules that warn or suggest rather than reject?

Copilot's hook system lets you intercept commands before they run, but it ships without any. No rules, no protection. If you don't install a hook, everything goes straight through.

I kept thinking about this after an agent ran rm -rf in one of my sessions.

So I wrote HAL. It sits in the hook, checks every command against a set of rules, and blocks the destructive ones. git reset --hard, rm -rf /, docker system prune -a that sort of thing. It knows --force is dangerous but --force-with-lease is fine. It knows rm -rf node_modules is safe but rm -rf src isn't.

You might say "I just won't use autopilot" or "I'll review each command myself." That works with one session. It doesn't work with several running in parallel.

And the thing that asks "allow Bash?" every time trains you to click yes without reading...

Also it parses commands as tokens, not strings. So git commit -m 'fix rm -rf bug' doesn't false-positive.

Rules are YAML files, not code. About 400 lines of Python total. Covers git, filesystem, Docker, AWS and Azure out of the box.

pip install openhal && hal install

Open source, contributions welcome https://github.com/otherland/hal