The Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.
This report summarizes scanner evidence for Dicklesworthstone/destructive_command_guard, a Rust project with 6,139 GitHub stars. SynthScan examined 377,941 lines of code across 577 source files, recording 1590 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 6.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 1154 finding(s).
Are imports declared and package/API names verified? 4 finding(s).
Are wrappers, guards, and repeated structures necessary? 453 finding(s).
Which changes need focused human review? 1590 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 1590 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 237 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 239 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1861 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1863 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1953 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1955 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 4369 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 4371 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 4461 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 4463 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 4500 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 4502 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | .config/nextest.toml | 4 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 6 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 20 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 22 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 46 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 48 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 66 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 68 | # ============================================================================= | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 6 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 8 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 37 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 39 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 68 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 70 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 88 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 90 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 113 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 115 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 138 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 140 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 173 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 175 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 199 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 201 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 12 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 14 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 32 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 34 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 51 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 53 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 70 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 72 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 84 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 86 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 98 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 100 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 5 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 7 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 24 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 26 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 48 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 50 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 73 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 75 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 87 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 89 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 106 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 108 | # ============================================================================ | COMMENT |
| 344 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | uninstall.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | install.sh | 301 | # Capture before any download or source-build work can change directories. | COMMENT |
| LOW | install.sh | 2601 | COMMENT | |
| LOW | install.sh | 2661 | # git-commit-verify: enables git hooks (including pre-commit) | COMMENT |
| LOW | install.sh | 2701 | CONTINUE_STATUS="skipped" | COMMENT |
| LOW | install.sh | 2721 | # hook_event_name: "PreToolUse", turn_id, tool_use_id, ... }. | COMMENT |
| LOW | install.sh | 3561 | CURSOR_STATUS="created" | COMMENT |
| LOW | install.sh | 3581 | # on stdin; no wrapper script is required. | COMMENT |
| LOW | install.sh | 3841 | # ~/.posit/assistant/settings.json plus per-workspace overrides. We write the | COMMENT |
| LOW | build.rs | 21 | .commit_date(true) | COMMENT |
| LOW | build.rs | 141 | /// changes no code path. | COMMENT |
| LOW | rust-toolchain.toml | 1 | [toolchain] | COMMENT |
| LOW | .config/nextest.toml | 1 | # cargo-nextest configuration for git_safety_guard | COMMENT |
| LOW | patches/uring-fs/src/lib.rs | 1 | COMMENT | |
| LOW | patches/uring-fs/src/lib.rs | 21 | //! let info = io.stat("src/file.txt").await?; | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1 | //! Subprocess integration tests for Codex CLI hook protocol. | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 21 | /// raising this constant cannot weaken the deadline coverage. | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 461 | ); | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 641 | /// | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1081 | COMMENT | |
| LOW | tests/codex_hook_protocol.rs | 1701 | assert_eq!(codex.exit_code, 0); | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 2081 | COMMENT | |
| LOW | tests/codex_hook_protocol.rs | 2201 | outcome.is_claude_block_shape(), | COMMENT |
| LOW | tests/temporary_allowlist_tests.rs | 1 | //! Comprehensive tests for Temporary/Expiring Allowlist Entries (Epic 6). | COMMENT |
| LOW | tests/repro_331_rebase_recovery_embedded_cd.rs | 1 | //! Regression tests for issue #331: the rebase-recovery auto-allow and permit | COMMENT |
| LOW | tests/repro_498_warn_masks_later_deny.rs | 1 | //! Regression tests for issue #498: a match that policy lets run (warn, log, | COMMENT |
| LOW | tests/repro_498_warn_masks_later_deny.rs | 541 | } | COMMENT |
| LOW | tests/repro_498_warn_masks_later_deny.rs | 621 | assert!( | COMMENT |
| LOW | tests/repro_498_warn_masks_later_deny.rs | 721 | ); | COMMENT |
| LOW | tests/allowlist_command_tests.rs | 101 | let cmd = "ee preflight check --cmd \"true\" ; rm -rf /"; | COMMENT |
| LOW | tests/suggestion_integration.rs | 1 | //! Integration tests for Command Rewriting Suggestions end-to-end flow. | COMMENT |
| LOW | tests/cross_pack_corpus.rs | 1 | //! Cross-pack regression corpus (issue #289 part D). | COMMENT |
| LOW | tests/cross_pack_corpus.rs | 21 | //! # Case format (TOML) | COMMENT |
| LOW | tests/cross_pack_corpus.rs | 41 | //! fails so the marker gets removed. `known_failing_dialects` keeps the | COMMENT |
| LOW | tests/repro_459_argv_split_spawns.rs | 1 | //! Regression pins for issue #459: argv-split spawns in JavaScript and Ruby | COMMENT |
| LOW | tests/repro_459_argv_split_spawns.rs | 121 | /// These have contiguous destructive text, so they were caught by the raw | COMMENT |
| LOW | tests/repro_459_argv_split_spawns.rs | 161 | /// Argv-split spawns follow #455's single policy for a recursive delete. | COMMENT |
| LOW | tests/repro_277_git_stdin_sink_fallback.rs | 1 | //! Regression tests for issue #277: a `git commit -F - <<'EOF'` heredoc whose | COMMENT |
| LOW | tests/agent_exit_codes.rs | 1 | //! Tests for exit code compliance with Claude Code hook protocol. | COMMENT |
| LOW | tests/repro_412_quoted_heredoc_commit_message.rs | 1 | //! Regression tests for issue #412: a German commit message denied by the | COMMENT |
| LOW | tests/repro_412_quoted_heredoc_commit_message.rs | 181 | /// The converse, which is the soundness claim the retry rests on: a function | COMMENT |
| LOW | tests/repro_412_quoted_heredoc_commit_message.rs | 241 | // The body was masked for pattern matching and simultaneously mined for inline | COMMENT |
| LOW | tests/repro_290_oversized_hook_input.rs | 1 | //! Repro for issue #290: an oversized hook payload must not fail open blind. | COMMENT |
| LOW | tests/repro_290_oversized_hook_input.rs | 201 | /// Pad-first evasion inside the command string itself: the destructive part | COMMENT |
| LOW | tests/repro_290_oversized_hook_input.rs | 261 | /// Pad-first evasion: the command begins beyond the read cap but within the | COMMENT |
| LOW | tests/repro_290_oversized_hook_input.rs | 281 | /// budget, and on a loaded machine dcg printed | COMMENT |
| LOW | tests/repro_441_dead_registry_keywords.rs | 1 | //! Regression tests for issue #441: rules whose keyword was missing from the | COMMENT |
| LOW | tests/repro_511_awk_print_into_shell.rs | 1 | //! #511: `awk 'BEGIN{print "git reset --hard" | "sh"}'` was allowed. | COMMENT |
| LOW | tests/config_schema_drift.rs | 1 | //! Drift check for the committed `config.schema.json`. | COMMENT |
| LOW | tests/repro_451_windows_pack_activation.rs | 1 | //! Regression tests for #451's activation half: a Windows payload arriving on a | COMMENT |
| LOW | tests/repro_451_windows_pack_activation.rs | 21 | use std::io::Write; | COMMENT |
| LOW | tests/repro_327_dead_override_keys.rs | 1 | //! Regression tests for issue #327: `overrides.allowlist` and | COMMENT |
| LOW | tests/credential_file_embedded_e2e.rs | 201 | "node <<'EOF'\nrequire('fs').writeFileSync('/home/me/.bashrc', 'x')\nEOF", | COMMENT |
| LOW | tests/suggest_allowlist_e2e.rs | 1 | #![allow(clippy::uninlined_format_args)] | COMMENT |
| LOW | tests/repro_1o5h_cmd_pwsh_stdin_consumer.rs | 1 | //! Regression pins for bd-1o5h: bare `cmd`/`pwsh` reading piped or redirected | COMMENT |
| LOW | tests/repro_407_relative_git_internals_redirect.rs | 1 | //! Regression tests for issue #407: a truncating redirect into `.git` named | COMMENT |
| LOW | tests/repro_dotnet_directory_delete.rs | 1 | //! Regression tests for issue #222: `windows.filesystem` must block the .NET | COMMENT |
| LOW | tests/repro_419_opencode_plugin_executes.rs | 1 | //! #419: the generated OpenCode plugin must actually load and deny. | COMMENT |
| LOW | tests/repro_419_opencode_plugin_executes.rs | 21 | //! than calling the export it expects a loader to use. | COMMENT |
| 918 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/install/test_helper.bash | 158 | # the harness capability before invoking rm, or teardown itself can lose the | COMMENT |
| MEDIUM | tests/corpus/canonical.toml | 1 | # Canonical command corpus for golden tests and the shared e2e harness. | COMMENT |
| MEDIUM | tests/e2e/framework.rs | 603 | # All features enabled for comprehensive testing | COMMENT |
| MEDIUM | tests/e2e/run_agent_e2e.sh | 4 | # This script runs comprehensive end-to-end tests for AI agent integration features. | COMMENT |
| MEDIUM | tests/e2e/run_install_e2e.sh | 341 | # Extract and source install.sh functions using the robust method | COMMENT |
| MEDIUM | tests/e2e/run_history_e2e.sh | 4 | # This script runs comprehensive end-to-end tests for the DCG history system. | COMMENT |
| MEDIUM | scripts/e2e_codex.sh | 3 | # Real Codex CLI end-to-end harness for dcg. | COMMENT |
| MEDIUM⚡ | scripts/e2e_destructive_equivalents.sh | 272 | # harness contract by exercising the closed bypass family) | COMMENT |
| MEDIUM | scripts/e2e_destructive_equivalents.sh | 5 | # Shared end-to-end test harness for the EPIC tracked at | COMMENT |
| MEDIUM⚡ | scripts/e2e_harness_matrix.sh | 7 | # dcg's value is entirely in what a *harness* does with its output. A change | COMMENT |
| MEDIUM⚡ | scripts/e2e_harness_matrix.sh | 9 | # the exit code, or the stream a harness reads changes. The unit tests call | COMMENT |
| MEDIUM⚡ | scripts/e2e_harness_matrix.sh | 11 | # payload each harness actually sends and asserts on the exact bytes it emits. | COMMENT |
| MEDIUM⚡ | scripts/e2e_harness_matrix.sh | 13 | # Every case is triple-asserted: the decision field the harness parses, the | COMMENT |
| MEDIUM⚡ | scripts/e2e_harness_matrix.sh | 128 | # assert_case <harness> <case> <payload> <expect: deny|allow> | COMMENT |
| MEDIUM⚡ | scripts/e2e_harness_matrix.sh | 129 | # <jq filter yielding the harness's decision value> | COMMENT |
| MEDIUM | scripts/templates/test_pack.sh | 89 | # Create JSON input using robust escaping | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 1398 | # samples also support the harness's 95/95 one-sided binomial tolerance | COMMENT |
| MEDIUM | src/heredoc.rs | 1169 | // Use robust wrapper stripping to handle env flags (e.g. -u, -C) correctly. | COMMENT |
| MEDIUM | src/main.rs | 1131 | /// (#331): the harness-reported `cwd` when present (else the hook process | COMMENT |
| MEDIUM | src/packs/platform/github.rs | 58 | // We use a robust value matcher that handles quoted strings to prevent bypasses. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/install/test_helper.bash | 4 | # This file is sourced by Bats test files to provide: | COMMENT |
| MEDIUM | tests/install/test_helper.bash | 31 | # Create a modified version of install.sh that can be sourced. | COMMENT |
| MEDIUM | tests/install/test_helper.bash | 534 | # Create a test file with known content and checksum | COMMENT |
| MEDIUM | tests/e2e/run_agent_e2e.sh | 107 | # Create a minimal config | COMMENT |
| MEDIUM | tests/e2e/run_history_e2e.sh | 128 | # Create a minimal config that enables history | COMMENT |
| MEDIUM⚡ | scripts/scan_gitdiff_e2e.sh | 288 | # Create a safe script first | COMMENT |
| MEDIUM⚡ | scripts/scan_gitdiff_e2e.sh | 352 | # Create a script | COMMENT |
| MEDIUM | scripts/scan_gitdiff_e2e.sh | 137 | # Create a fixture git repo with test files | COMMENT |
| MEDIUM | scripts/scan_gitdiff_e2e.sh | 465 | # Create a markdown file with dangerous commands as documentation | COMMENT |
| MEDIUM | scripts/scan_gitdiff_e2e.sh | 601 | # Create a file with a destructive command (error level) | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 202 | # Create a shell script with a destructive command | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 289 | # Create a markdown file that mentions dangerous commands but doesn't execute them | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 358 | # Create a safe shell script | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 366 | # Create a dangerous Dockerfile | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 432 | # Create a shell script with destructive command (use git reset --hard which is always error) | COMMENT |
| MEDIUM | scripts/scan_precommit_e2e.sh | 128 | # Create a fixture git repo with test files | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/codex_hook_protocol.rs | 1529 | // Step 1: Get a Claude deny with allow-once code | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1576 | // Step 2: Redeem the allow-once code using `dcg allow-once <code> --yes` | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1600 | // Step 3: Retry the same command — should now be allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1329 | // Step 2: Use dcg allow-once <code> --yes to activate the exception | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1338 | // Step 3: Re-run the same command, should now be allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1342 | // Step 4: the grant was single-use (the default since #378), so the | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1616 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1621 | // Step 2: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1625 | // Step 3: Same command in same directory is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1629 | // Step 4: Create a different directory outside the original temp dir | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1633 | // Step 5: Same command in different directory is still blocked | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1643 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1648 | // Step 2: Allow it with --single-use | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1657 | // Step 3: First run is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1661 | // Step 4: Second run is blocked again (single-use consumed) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1671 | // Step 1: Block to create pending entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1676 | // Step 2: Check list shows pending | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1686 | // Step 3: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1690 | // Step 4: Check list shows active entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1837 | // Step 2: Revoke the exception before it's used | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1846 | // Step 3: Command should be blocked again | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1856 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1861 | // Step 2: Dry-run allow | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1868 | // Step 3: Command should still be blocked (dry-run doesn't write) | COMMENT |
| LOW | tests/cli_e2e.rs | 1318 | // Step 1: Run blocked command in hook mode, verify it's denied with a code | COMMENT |
| LOW | tests/cli_e2e.rs | 1752 | // Step 2: Try to allow without --force - should fail | COMMENT |
| LOW | tests/cli_e2e.rs | 1826 | // Step 1: Block and allow | COMMENT |
| LOW⚡ | src/main.rs | 3127 | // Step 1: pack_aware_quick_reject should NOT reject this command | COMMENT |
| LOW⚡ | src/main.rs | 3133 | // Step 2: Normalize command | COMMENT |
| LOW⚡ | src/main.rs | 3136 | // Step 3: Check against pack registry (should block) | COMMENT |
| LOW⚡ | src/scan.rs | 4823 | // Step 1: Extract | COMMENT |
| LOW⚡ | src/scan.rs | 4830 | // Step 2: Evaluate | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/codex_hook_protocol.rs | 1529 | // Step 1: Get a Claude deny with allow-once code | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1576 | // Step 2: Redeem the allow-once code using `dcg allow-once <code> --yes` | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1600 | // Step 3: Retry the same command — should now be allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1329 | // Step 2: Use dcg allow-once <code> --yes to activate the exception | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1338 | // Step 3: Re-run the same command, should now be allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1342 | // Step 4: the grant was single-use (the default since #378), so the | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1616 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1621 | // Step 2: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1625 | // Step 3: Same command in same directory is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1629 | // Step 4: Create a different directory outside the original temp dir | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1633 | // Step 5: Same command in different directory is still blocked | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1643 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1648 | // Step 2: Allow it with --single-use | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1657 | // Step 3: First run is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1661 | // Step 4: Second run is blocked again (single-use consumed) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1671 | // Step 1: Block to create pending entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1676 | // Step 2: Check list shows pending | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1686 | // Step 3: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1690 | // Step 4: Check list shows active entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1837 | // Step 2: Revoke the exception before it's used | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1846 | // Step 3: Command should be blocked again | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1856 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1861 | // Step 2: Dry-run allow | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1868 | // Step 3: Command should still be blocked (dry-run doesn't write) | COMMENT |
| LOW | tests/cli_e2e.rs | 1318 | // Step 1: Run blocked command in hook mode, verify it's denied with a code | COMMENT |
| LOW | tests/cli_e2e.rs | 1752 | // Step 2: Try to allow without --force - should fail | COMMENT |
| LOW | tests/cli_e2e.rs | 1826 | // Step 1: Block and allow | COMMENT |
| LOW⚡ | src/main.rs | 3127 | // Step 1: pack_aware_quick_reject should NOT reject this command | COMMENT |
| LOW⚡ | src/main.rs | 3133 | // Step 2: Normalize command | COMMENT |
| LOW⚡ | src/main.rs | 3136 | // Step 3: Check against pack registry (should block) | COMMENT |
| LOW⚡ | src/scan.rs | 4823 | // Step 1: Extract | COMMENT |
| LOW⚡ | src/scan.rs | 4830 | // Step 2: Evaluate | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 516 | # Containers and orchestration | COMMENT |
| MEDIUM | tests/codex_hook_protocol.rs | 398 | // Smoke tests — validate the scaffold helpers work before leaf tests depend | COMMENT |
| MEDIUM | tests/repro_313_powershell_read_only_false_positives.rs | 9 | //! Windows/guardrails packs enabled as on a native Windows install, and with | COMMENT |
| MEDIUM | tests/scripts/run_e2e_tests.sh | 5 | # This script orchestrates all E2E tests for the Destructive Command Guard. | COMMENT |
| MEDIUM | docs/planning/DGC_IMPROVEMENT_PLAN__GPT.md | 44 | 3. [Design principles](#design-principles-guardrails-for-the-whole-project) | CODE |
| MEDIUM | docs/planning/DGC_IMPROVEMENT_PLAN__GPT.md | 128 | ## Design principles (guardrails for the whole project) | COMMENT |
| MEDIUM | docs/planning/DGC_IMPROVEMENT_PLAN__GPT.md | 904 | ### Cross-cutting: Performance + safety guardrails (limits, hardening, benchmarks) | COMMENT |
| MEDIUM | docs/planning/DCG_IMPROVEMENT_PLAN__OPUS.md | 49 | 9. [Test Infrastructure & Performance Guardrails](#7-test-infrastructure--performance-guardrails) | CODE |
| MEDIUM | scripts/e2e_codex.sh | 5 | # This scaffold mirrors scripts/e2e_test.sh logging conventions, but drives the | COMMENT |
| MEDIUM | src/packs/mod.rs | 2868 | // `careful_company_running_windows.guardrails:stop-security-service`). | COMMENT |
| MEDIUM | src/packs/careful_company_running_windows/mod.rs | 24 | //! | [`guardrails`] | Turning off the safety net: AV/firewall/EDR, audit logs, and dcg itself | | COMMENT |
| MEDIUM | src/packs/careful_company_running_windows/mod.rs | 151 | // blocked by `guardrails:dcg-policy-self-weakening`. | COMMENT |
| MEDIUM | src/packs/careful_company_running_windows/guardrails.rs | 4 | //! standing between a bad idea and a bad outcome: the guardrails. This sub-pack | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | uninstall.sh | 364 | # Check if dcg is configured | COMMENT |
| LOW | uninstall.sh | 467 | # Check if dcg is configured | COMMENT |
| LOW | uninstall.sh | 692 | # Check if our settings exist | COMMENT |
| LOW | uninstall.sh | 708 | # Check if file is now empty (just whitespace) | COMMENT |
| LOW | install.sh | 695 | # Check if a specific agent was detected | COMMENT |
| LOW | install.sh | 761 | # Check if installed version matches target | COMMENT |
| LOW | install.sh | 1228 | # Check if the completions subcommand exists (added in v0.2.11+) | COMMENT |
| LOW | install.sh | 1690 | # Check if existing lock is stale (process no longer running) | COMMENT |
| LOW | install.sh | 2026 | # Check if the exact current dcg hook is already configured. A stale dcg | COMMENT |
| LOW | install.sh | 2346 | # Check if Gemini CLI appears to be installed (has config dir or gemini command exists) | COMMENT |
| LOW | install.sh | 2602 | # Check if Aider is installed (command exists) | COMMENT |
| LOW | install.sh | 2619 | # Check if git-commit-verify is already set to true | COMMENT |
| LOW | install.sh | 2626 | # Check if git-commit-verify exists but is false | COMMENT |
| LOW | install.sh | 2687 | # Check if Continue is installed | COMMENT |
| LOW | install.sh | 2749 | # Check if Codex is installed | COMMENT |
| LOW | install.sh | 2773 | # Check if the exact current dcg hook is already configured. A stale dcg | COMMENT |
| LOW | tests/e2e/run_agent_e2e.sh | 141 | # Check if jq is available | COMMENT |
| LOW | tests/e2e/run_install_e2e.sh | 286 | # Check if detection works | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install.sh | 3342 | except Exception: | CODE |
| LOW | install.sh | 3350 | except Exception: | CODE |
| LOW | install.sh | 3362 | except Exception: | CODE |
| LOW | install.sh | 3398 | except Exception as err: | CODE |
| LOW | install.sh | 3407 | except Exception: | CODE |
| LOW | install.sh | 3451 | except Exception: | CODE |
| LOW | install.sh | 3507 | except Exception: | CODE |
| LOW | tests/install/test_helper.bash | 350 | except Exception: | CODE |
| LOW | tests/install/test_helper.bash | 462 | except Exception: | CODE |
| LOW | tests/install/test_helper.bash | 517 | except Exception: | CODE |
| LOW | scripts/audit_patterns.py | 19 | except Exception as e: | CODE |
| MEDIUM | scripts/audit_patterns.py | 20 | print(f"Error reading {filepath}: {e}") | CODE |
| MEDIUM | scripts/audit_patterns.py | 15 | def scan_file(filepath): | CODE |
| LOW | scripts/e2e_fleet_install.sh | 367 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 138 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 424 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 479 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 499 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 835 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 1656 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 1704 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 1779 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 1868 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 1879 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 1886 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 2101 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 2116 | except Exception as certificate_exc: # noqa: BLE001 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/run_tui_e2e.sh | 12 | # Usage: | COMMENT |
| LOW | tests/e2e/run_agent_e2e.sh | 8 | # Usage: | COMMENT |
| LOW | tests/e2e/run_install_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | tests/e2e/robot_mode_test.sh | 11 | # Usage: | COMMENT |
| LOW | tests/e2e/test_doctor_install_uninstall.sh | 9 | # Usage: | COMMENT |
| LOW | tests/e2e/run_history_e2e.sh | 7 | # Usage: | COMMENT |
| LOW | tests/e2e/run_update_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/check_benchmark_budgets.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/scan_gitdiff_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/e2e_fleet_install.sh | 22 | # Usage: | COMMENT |
| LOW | scripts/e2e_test.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/scan_precommit_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/test-quick.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/coverage.sh | 5 | # Usage: | COMMENT |
| LOW⚡ | scripts/e2e_harness_matrix.sh | 17 | # Usage: | COMMENT |
| LOW | scripts/templates/test_pack.sh | 8 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | uninstall.sh | 608 | def strip_dcg_platform_fields(entry): | CODE |
| LOW | install.sh | 3124 | def strip_dcg_platform_fields(entry): | CODE |
| LOW | scripts/check_cli_versions.sh | 118 | def github_repo_from_releases_url(url) | CODE |
| LOW | scripts/test_check_scanner_safety.py | 41 | def test_checked_in_vendor_always_gets_domain_and_fatal_sanitizer_checks(self): | CODE |
| LOW⚡ | scripts/test_check_scanner_safety.py | 53 | def test_domain_violation_cannot_be_masked_by_later_native_passes(self): | CODE |
| LOW⚡ | scripts/test_check_scanner_safety.py | 59 | def test_sanitizer_failure_is_not_swallowed(self): | CODE |
| LOW⚡ | scripts/test_check_scanner_safety.py | 64 | def test_real_undefined_behavior_fails_even_with_inherited_recovery_options(self): | CODE |
| LOW | scripts/test_check_scanner_safety.py | 86 | def test_safe_native_control_still_passes(self): | CODE |
| LOW | scripts/test_check_scanner_safety.py | 92 | def test_repeat_retains_failure_after_subsequent_successes(self): | CODE |
| LOW | scripts/test_check_scanner_safety.py | 110 | def test_repeat_retains_timeouts_as_failures(self): | CODE |
| LOW | scripts/perf_baseline.py | 363 | def create_toolchain_probe_environment( | CODE |
| LOW | scripts/perf_baseline.py | 503 | def extract_embedded_git_describe(version_output: str) -> Optional[str]: | CODE |
| LOW | scripts/perf_baseline.py | 529 | def extract_embedded_rustc_toolchain(version_output: str) -> Dict[str, Optional[str]]: | CODE |
| LOW | scripts/perf_baseline.py | 550 | def invalid_rustc_identity_fields(identity: Dict[str, Any]) -> Dict[str, str]: | CODE |
| LOW | scripts/perf_baseline.py | 578 | def classify_toolchain_binding( | CODE |
| LOW | scripts/perf_baseline.py | 702 | def capture_build_input_manifest(repo_root: str) -> Dict[str, Any]: | CODE |
| LOW | scripts/perf_baseline.py | 924 | def create_isolated_environment() -> Tuple[Dict[str, str], Dict[str, Any]]: | CODE |
| LOW | scripts/perf_baseline.py | 1057 | def max_allowed_tail_exceedances(sample_count: int) -> int: | CODE |
| LOW | .github/workflows/ci.yml | 1206 | def reject_non_finite_json_constant(value): | CODE |
| LOW | .github/workflows/ci.yml | 1221 | def finite_nonnegative_number(value, label): | CODE |
| LOW | src/perf.rs | 557 | .split("def classify_toolchain_binding(") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/planning/DCG_IMPROVEMENT_PLAN__OPUS.md | 2031 | *Document generated by Claude Opus 4.5 on 2026-01-08 (Enhanced Hybrid Version)* | COMMENT |
| HIGH | docs/planning/AGENT_FRIENDLINESS_REPORT.md | 205 | *Generated by Claude Opus 4.5 during bd-dpr execution* | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/perf_baseline.py | 913 | "git init -q . 2>/dev/null; git config user.email t@t.t\n" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/perf_baseline.py | 407 | except OSError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/check_scanner_safety.py | 81 | CODE | |
| LOW | scripts/audit_patterns.py | 42 | CODE | |
| LOW | scripts/perf_baseline.py | 108 | CODE | |
| LOW | scripts/perf_baseline.py | 529 | CODE | |
| LOW | scripts/perf_baseline.py | 578 | CODE | |
| LOW | scripts/perf_baseline.py | 632 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/check_scanner_safety.py | 11 | CODE | |
| LOW | scripts/test_check_scanner_safety.py | 8 | CODE | |
| LOW | scripts/perf_baseline.py | 11 | CODE |