The Destructive Command Guard (dcg) is for blocking dangerous git and shell commands from being executed by agents.
This report presents the forensic synthetic code analysis of Dicklesworthstone/destructive_command_guard, a Rust project with 4,324 GitHub stars. SynthScan v2.0 examined 243,044 lines of code across 446 source files, recording 1113 pattern matches distributed across 14 syntactic categories. The overall adjusted score of 8.2 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 1113 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 158 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 160 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1205 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1207 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1289 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 1291 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 3030 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 3032 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 3107 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 3109 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 3145 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | install.sh | 3147 | # ═══════════════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | .config/nextest.toml | 4 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 6 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 20 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 22 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 46 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 48 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 66 | # ============================================================================= | COMMENT |
| MEDIUM | .config/nextest.toml | 68 | # ============================================================================= | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 6 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 8 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 37 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 39 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 68 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 70 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 88 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 90 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 113 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 115 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 138 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 140 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 173 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 175 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 199 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/multi_segment.toml | 201 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 12 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 14 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 31 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 33 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 50 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 52 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 69 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 71 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 83 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 85 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 97 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/regex_worst_case.toml | 99 | # ----------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 5 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 7 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 24 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 26 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 48 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 50 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 73 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 75 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 87 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 89 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 106 | # ============================================================================ | COMMENT |
| MEDIUM | tests/corpus/edge_cases/quoting.toml | 108 | # ============================================================================ | COMMENT |
| 306 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | uninstall.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | install.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | install.sh | 941 | return 0 | COMMENT |
| LOW | install.sh | 961 | # The earlier form of this function unconditionally passed --new-bundle-format | COMMENT |
| LOW | install.sh | 1961 | COMMENT | |
| LOW | install.sh | 2001 | # Codex 0.125.0 marked PreToolUse hooks as STABLE (codex_hooks feature is | COMMENT |
| LOW | install.sh | 2021 | # payloads dcg switches to codex's documented alternative | COMMENT |
| LOW | install.sh | 2761 | # Hermes Agent (NousResearch — https://github.com/NousResearch/hermes-agent) | COMMENT |
| LOW | install.sh | 3001 | fi | COMMENT |
| LOW | rust-toolchain.toml | 1 | [toolchain] | COMMENT |
| LOW | .config/nextest.toml | 1 | # cargo-nextest configuration for git_safety_guard | COMMENT |
| LOW | patches/uring-fs/src/lib.rs | 1 | COMMENT | |
| LOW | patches/uring-fs/src/lib.rs | 21 | //! let info = io.stat("src/file.txt").await?; | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1 | //! Subprocess integration tests for Codex CLI hook protocol. | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 201 | ) | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 401 | outcome.is_claude_block_shape(), | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1441 | assert!(claude.stdout.is_empty()); | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1761 | // and Claude. Users use these to opt out of specific protections without | COMMENT |
| LOW | tests/temporary_allowlist_tests.rs | 1 | //! Comprehensive tests for Temporary/Expiring Allowlist Entries (Epic 6). | COMMENT |
| LOW | tests/suggestion_integration.rs | 1 | //! Integration tests for Command Rewriting Suggestions end-to-end flow. | COMMENT |
| LOW | tests/agent_exit_codes.rs | 1 | //! Tests for exit code compliance with Claude Code hook protocol. | COMMENT |
| LOW | tests/config_schema_drift.rs | 1 | //! Drift check for the committed `config.schema.json`. | COMMENT |
| LOW | tests/suggest_allowlist_e2e.rs | 1 | #![allow(clippy::uninlined_format_args)] | COMMENT |
| LOW | tests/agent_hook_output.rs | 381 | let alt_str = safe_alt.as_str().unwrap(); | COMMENT |
| LOW | tests/golden_isomorphism.rs | 1 | //! Golden isomorphism tests for the evaluator. | COMMENT |
| LOW | tests/robot_mode.rs | 1 | //! Tests for robot mode (`--robot` flag and `DCG_ROBOT` env var). | COMMENT |
| LOW | tests/debug_heredoc_extraction.rs | 21 | ); | COMMENT |
| LOW | tests/cli_e2e.rs | 1 | #![allow(clippy::needless_raw_string_hashes)] | COMMENT |
| LOW | tests/stdin_batch_mode.rs | 1 | //! End-to-end tests for stdin batch mode (`dcg hook --batch`). | COMMENT |
| LOW | tests/suggestion_scoring.rs | 1 | //! Comprehensive tests for Command Rewriting Suggestions scoring and analysis. | COMMENT |
| LOW | tests/security_regressions_v2.rs | 1 | //! Regression tests for security bypasses fixed in Jan 2025. | COMMENT |
| LOW | tests/regression_corpus.rs | 1 | //! Regression corpus test harness with full isomorphism verification. | COMMENT |
| LOW | tests/regression_corpus.rs | 21 | //! command = "git reset --hard" | COMMENT |
| LOW | tests/regression_corpus.rs | 41 | //! - `rule_id` (pack:pattern format) | COMMENT |
| LOW | tests/config_toggles_e2e.rs | 1 | #![allow( | COMMENT |
| LOW | tests/memory_tests.rs | 1 | //! Memory leak detection tests for DCG | COMMENT |
| LOW | tests/memory_tests.rs | 101 | } | COMMENT |
| LOW | tests/agent_profile_comprehensive.rs | 1 | //! Comprehensive testing for Agent-Specific Profiles (Epic 9). | COMMENT |
| LOW | tests/golden_json_tests.rs | 1 | //! Golden file tests for JSON output stability. | COMMENT |
| LOW | tests/golden_json_tests.rs | 21 | //! | COMMENT |
| LOW | tests/repro_newline_separator.rs | 21 | "Destructive command after newline was incorrectly allowed (likely masked as argument)" | COMMENT |
| LOW | tests/tui_e2e.rs | 1 | #![allow(clippy::doc_markdown)] | COMMENT |
| LOW | tests/test_explanations.rs | 1 | //! Comprehensive E2E Tests for Natural Language Explanations (Epic 2) | COMMENT |
| LOW | tests/corpus/edge_cases/regex_worst_case.toml | 1 | # Edge cases: regex worst-case inputs | COMMENT |
| LOW | tests/corpus/bypass_attempts/heredoc_inline.toml | 1 | # Bypass attempts: destructive commands in heredocs and inline scripts | COMMENT |
| LOW | tests/corpus/bypass_attempts/heredoc_inline.toml | 101 | COMMENT | |
| LOW | tests/corpus/bypass_attempts/heredoc_inline.toml | 161 | # command = "echo 'git reset --hard' | sh" | COMMENT |
| LOW | tests/corpus/false_positives/heredoc_data.toml | 1 | # False positives: heredocs to non-executing commands | COMMENT |
| LOW | tests/common/logging.rs | 1 | //! Test logging utilities for history E2E tests. | COMMENT |
| LOW | tests/common/logging.rs | 21 | /// | COMMENT |
| LOW | tests/common/db.rs | 1 | //! Test database factory for history tests. | COMMENT |
| LOW | tests/common/db.rs | 21 | /// An isolated test database with automatic cleanup. | COMMENT |
| LOW | tests/common/mod.rs | 1 | //! Common test utilities for DCG history E2E tests. | COMMENT |
| LOW | tests/common/fixtures.rs | 321 | COMMENT | |
| LOW | tests/e2e/run_tui_e2e.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tests/e2e/run_agent_e2e.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/e2e/run_install_e2e.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tests/e2e/robot_mode_test.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tests/e2e/mod.rs | 1 | //! End-to-End Test Framework for DCG | COMMENT |
| LOW | tests/e2e/mod.rs | 21 | //! │ test_suggestions.rs │ Epic 3: Command rewriting │ | COMMENT |
| 471 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/codex_hook_protocol.rs | 1268 | // Step 1: Get a Claude deny with allow-once code | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1314 | // Step 2: Redeem the allow-once code using `dcg allow-once <code> --yes` | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1338 | // Step 3: Retry the same command — should now be allowed | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1965 | // Step 1: Codex deny — creates pending exception in hermetic HOME | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 2003 | // Step 2: Redeem the allow-once code | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 2027 | // Step 3: Retry under Codex — must now be allowed (exit 0) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 922 | // Step 2: Use dcg allow-once <code> --yes to activate the exception | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 931 | // Step 3: Re-run the same command, should now be allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 935 | // Step 4: Run it again to verify reusable (not single-use) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 972 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 977 | // Step 2: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 981 | // Step 3: Same command in same directory is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 985 | // Step 4: Create a different directory outside the original temp dir | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 989 | // Step 5: Same command in different directory is still blocked | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 999 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1004 | // Step 2: Allow it with --single-use | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1013 | // Step 3: First run is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1017 | // Step 4: Second run is blocked again (single-use consumed) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1027 | // Step 1: Block to create pending entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1032 | // Step 2: Check list shows pending | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1042 | // Step 3: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1046 | // Step 4: Check list shows active entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1193 | // Step 2: Revoke the exception before it's used | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1202 | // Step 3: Command should be blocked again | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1212 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1217 | // Step 2: Dry-run allow | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1224 | // Step 3: Command should still be blocked (dry-run doesn't write) | COMMENT |
| LOW | tests/cli_e2e.rs | 911 | // Step 1: Run blocked command in hook mode, verify it's denied with a code | COMMENT |
| LOW | tests/cli_e2e.rs | 1108 | // Step 2: Try to allow without --force - should fail | COMMENT |
| LOW | tests/cli_e2e.rs | 1182 | // Step 1: Block and allow | COMMENT |
| LOW⚡ | src/evaluator.rs | 2527 | // Step 1: Check allow-once overrides (may be superseded by config blocklist). | COMMENT |
| LOW⚡ | src/evaluator.rs | 2530 | // Step 2: Check precompiled block overrides before allow overrides. Deny | COMMENT |
| LOW⚡ | src/evaluator.rs | 2591 | // Step 4: Quick rejection - if no relevant keywords, allow immediately | COMMENT |
| LOW⚡ | src/evaluator.rs | 2599 | // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, search | COMMENT |
| LOW⚡ | src/evaluator.rs | 2634 | // Step 7: Check legacy safe patterns (whitelist, reusing normalized from quick-reject) | COMMENT |
| LOW⚡ | src/evaluator.rs | 2644 | // Step 8: Check legacy destructive patterns (blacklist) | COMMENT |
| LOW | src/evaluator.rs | 1598 | // Step 1: Check precompiled block overrides first. Deny wins when | COMMENT |
| LOW | src/evaluator.rs | 1613 | // Step 2: Self-inspection exemption (dcg#170). | COMMENT |
| LOW | src/evaluator.rs | 1640 | // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open). | COMMENT |
| LOW | src/evaluator.rs | 1687 | // Step 4: Quick rejection - if no relevant keywords, allow immediately. | COMMENT |
| LOW | src/evaluator.rs | 1711 | // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, search | COMMENT |
| LOW | src/evaluator.rs | 1791 | // Step 7: Mask heredoc content for non-executing targets (cat, tee, etc.) | COMMENT |
| LOW | src/evaluator.rs | 2556 | // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open). | COMMENT |
| LOW | src/evaluator.rs | 2658 | // Step 9: Check enabled packs with allowlist override semantics. | COMMENT |
| LOW⚡ | src/main.rs | 1652 | // Step 1: pack_aware_quick_reject should NOT reject this command | COMMENT |
| LOW⚡ | src/main.rs | 1658 | // Step 2: Normalize command | COMMENT |
| LOW⚡ | src/main.rs | 1661 | // Step 3: Check against pack registry (should block) | COMMENT |
| LOW⚡ | src/scan.rs | 4101 | // Step 1: Extract | COMMENT |
| LOW⚡ | src/scan.rs | 4108 | // Step 2: Evaluate | COMMENT |
| LOW⚡ | src/cli.rs | 3236 | // Step 7: Check for empty pack | COMMENT |
| LOW⚡ | src/cli.rs | 3246 | // Step 8: Check for duplicate pattern names | COMMENT |
| LOW | src/cli.rs | 3149 | // Step 1: Check if file exists | COMMENT |
| LOW | src/cli.rs | 3160 | // Step 2: Read file content | COMMENT |
| LOW | src/cli.rs | 3174 | // Step 3: Parse YAML | COMMENT |
| LOW | src/cli.rs | 3193 | // Step 4: Validate schema version | COMMENT |
| LOW | src/cli.rs | 3208 | // Step 5: Validate ID format | COMMENT |
| LOW | src/cli.rs | 3222 | // Step 6: Validate version format (semver) | COMMENT |
| LOW | src/cli.rs | 3269 | // Step 9: Validate regex patterns | COMMENT |
| LOW | src/cli.rs | 3291 | // Step 10: Check for collision with built-in packs | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/codex_hook_protocol.rs | 1268 | // Step 1: Get a Claude deny with allow-once code | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1314 | // Step 2: Redeem the allow-once code using `dcg allow-once <code> --yes` | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1338 | // Step 3: Retry the same command — should now be allowed | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 1965 | // Step 1: Codex deny — creates pending exception in hermetic HOME | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 2003 | // Step 2: Redeem the allow-once code | COMMENT |
| LOW | tests/codex_hook_protocol.rs | 2027 | // Step 3: Retry under Codex — must now be allowed (exit 0) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 922 | // Step 2: Use dcg allow-once <code> --yes to activate the exception | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 931 | // Step 3: Re-run the same command, should now be allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 935 | // Step 4: Run it again to verify reusable (not single-use) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 972 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 977 | // Step 2: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 981 | // Step 3: Same command in same directory is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 985 | // Step 4: Create a different directory outside the original temp dir | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 989 | // Step 5: Same command in different directory is still blocked | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 999 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1004 | // Step 2: Allow it with --single-use | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1013 | // Step 3: First run is allowed | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1017 | // Step 4: Second run is blocked again (single-use consumed) | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1027 | // Step 1: Block to create pending entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1032 | // Step 2: Check list shows pending | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1042 | // Step 3: Allow it | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1046 | // Step 4: Check list shows active entry | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1193 | // Step 2: Revoke the exception before it's used | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1202 | // Step 3: Command should be blocked again | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1212 | // Step 1: Block and get code | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1217 | // Step 2: Dry-run allow | COMMENT |
| LOW⚡ | tests/cli_e2e.rs | 1224 | // Step 3: Command should still be blocked (dry-run doesn't write) | COMMENT |
| LOW | tests/cli_e2e.rs | 911 | // Step 1: Run blocked command in hook mode, verify it's denied with a code | COMMENT |
| LOW | tests/cli_e2e.rs | 1108 | // Step 2: Try to allow without --force - should fail | COMMENT |
| LOW | tests/cli_e2e.rs | 1182 | // Step 1: Block and allow | COMMENT |
| LOW⚡ | src/evaluator.rs | 2527 | // Step 1: Check allow-once overrides (may be superseded by config blocklist). | COMMENT |
| LOW⚡ | src/evaluator.rs | 2530 | // Step 2: Check precompiled block overrides before allow overrides. Deny | COMMENT |
| LOW⚡ | src/evaluator.rs | 2591 | // Step 4: Quick rejection - if no relevant keywords, allow immediately | COMMENT |
| LOW⚡ | src/evaluator.rs | 2599 | // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, search | COMMENT |
| LOW⚡ | src/evaluator.rs | 2634 | // Step 7: Check legacy safe patterns (whitelist, reusing normalized from quick-reject) | COMMENT |
| LOW⚡ | src/evaluator.rs | 2644 | // Step 8: Check legacy destructive patterns (blacklist) | COMMENT |
| LOW | src/evaluator.rs | 1598 | // Step 1: Check precompiled block overrides first. Deny wins when | COMMENT |
| LOW | src/evaluator.rs | 1613 | // Step 2: Self-inspection exemption (dcg#170). | COMMENT |
| LOW | src/evaluator.rs | 1640 | // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open). | COMMENT |
| LOW | src/evaluator.rs | 1687 | // Step 4: Quick rejection - if no relevant keywords, allow immediately. | COMMENT |
| LOW | src/evaluator.rs | 1711 | // Step 5: False-positive immunity - strip known-safe string arguments (commit messages, search | COMMENT |
| LOW | src/evaluator.rs | 1791 | // Step 7: Mask heredoc content for non-executing targets (cat, tee, etc.) | COMMENT |
| LOW | src/evaluator.rs | 2556 | // Step 3: Heredoc / inline-script detection (Tier 1/2/3, fail-open). | COMMENT |
| LOW | src/evaluator.rs | 2658 | // Step 9: Check enabled packs with allowlist override semantics. | COMMENT |
| LOW⚡ | src/main.rs | 1652 | // Step 1: pack_aware_quick_reject should NOT reject this command | COMMENT |
| LOW⚡ | src/main.rs | 1658 | // Step 2: Normalize command | COMMENT |
| LOW⚡ | src/main.rs | 1661 | // Step 3: Check against pack registry (should block) | COMMENT |
| LOW⚡ | src/scan.rs | 4101 | // Step 1: Extract | COMMENT |
| LOW⚡ | src/scan.rs | 4108 | // Step 2: Evaluate | COMMENT |
| LOW⚡ | src/cli.rs | 3236 | // Step 7: Check for empty pack | COMMENT |
| LOW⚡ | src/cli.rs | 3246 | // Step 8: Check for duplicate pattern names | COMMENT |
| LOW | src/cli.rs | 3149 | // Step 1: Check if file exists | COMMENT |
| LOW | src/cli.rs | 3160 | // Step 2: Read file content | COMMENT |
| LOW | src/cli.rs | 3174 | // Step 3: Parse YAML | COMMENT |
| LOW | src/cli.rs | 3193 | // Step 4: Validate schema version | COMMENT |
| LOW | src/cli.rs | 3208 | // Step 5: Validate ID format | COMMENT |
| LOW | src/cli.rs | 3222 | // Step 6: Validate version format (semver) | COMMENT |
| LOW | src/cli.rs | 3269 | // Step 9: Validate regex patterns | COMMENT |
| LOW | src/cli.rs | 3291 | // Step 10: Check for collision with built-in packs | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/install/test_helper.bash | 4 | # This file is sourced by Bats test files to provide: | COMMENT |
| MEDIUM | tests/install/test_helper.bash | 20 | # Create a modified version of install.sh that can be sourced. | COMMENT |
| MEDIUM | tests/install/test_helper.bash | 263 | # Create a test file with known content and checksum | COMMENT |
| MEDIUM | tests/e2e/run_agent_e2e.sh | 107 | # Create a minimal config | COMMENT |
| MEDIUM | tests/e2e/run_history_e2e.sh | 128 | # Create a minimal config that enables history | COMMENT |
| MEDIUM⚡ | scripts/scan_gitdiff_e2e.sh | 288 | # Create a safe script first | COMMENT |
| MEDIUM⚡ | scripts/scan_gitdiff_e2e.sh | 352 | # Create a script | COMMENT |
| MEDIUM | scripts/scan_gitdiff_e2e.sh | 137 | # Create a fixture git repo with test files | COMMENT |
| MEDIUM | scripts/scan_gitdiff_e2e.sh | 465 | # Create a markdown file with dangerous commands as documentation | COMMENT |
| MEDIUM | scripts/scan_gitdiff_e2e.sh | 601 | # Create a file with a destructive command (error level) | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 202 | # Create a shell script with a destructive command | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 289 | # Create a markdown file that mentions dangerous commands but doesn't execute them | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 358 | # Create a safe shell script | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 366 | # Create a dangerous Dockerfile | COMMENT |
| MEDIUM⚡ | scripts/scan_precommit_e2e.sh | 432 | # Create a shell script with destructive command (use git reset --hard which is always error) | COMMENT |
| MEDIUM | scripts/scan_precommit_e2e.sh | 128 | # Create a fixture git repo with test files | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/security_regressions.rs | 12 | /// Fix: `check_fallback_patterns` performs a robust substring/regex check | COMMENT |
| MEDIUM | tests/corpus/canonical.toml | 1 | # Canonical command corpus for golden tests and the shared e2e harness. | COMMENT |
| MEDIUM | tests/e2e/framework.rs | 590 | # All features enabled for comprehensive testing | COMMENT |
| MEDIUM | tests/e2e/run_agent_e2e.sh | 4 | # This script runs comprehensive end-to-end tests for AI agent integration features. | COMMENT |
| MEDIUM | tests/e2e/run_install_e2e.sh | 339 | # Extract and source install.sh functions using the robust method | COMMENT |
| MEDIUM | tests/e2e/run_history_e2e.sh | 4 | # This script runs comprehensive end-to-end tests for the DCG history system. | COMMENT |
| MEDIUM | scripts/e2e_codex.sh | 3 | # Real Codex CLI end-to-end harness for dcg. | COMMENT |
| MEDIUM⚡ | scripts/e2e_destructive_equivalents.sh | 272 | # harness contract by exercising the closed bypass family) | COMMENT |
| MEDIUM | scripts/e2e_destructive_equivalents.sh | 5 | # Shared end-to-end test harness for the EPIC tracked at | COMMENT |
| MEDIUM | scripts/templates/test_pack.sh | 89 | # Create JSON input using robust escaping | COMMENT |
| MEDIUM | .github/workflows/ci.yml | 1241 | # Also fail if new unexpected cases are added (keeps the harness stable) | COMMENT |
| MEDIUM | src/heredoc.rs | 794 | // Use robust wrapper stripping to handle env flags (e.g. -u, -C) correctly. | COMMENT |
| MEDIUM | src/evaluator.rs | 3176 | // These patterns must be robust to whitespace variations where applicable. | COMMENT |
| MEDIUM | src/packs/platform/github.rs | 40 | // We use a robust value matcher that handles quoted strings to prevent bypasses. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | uninstall.sh | 344 | # Check if dcg is configured | COMMENT |
| LOW | uninstall.sh | 447 | # Check if dcg is configured | COMMENT |
| LOW | uninstall.sh | 664 | # Check if our settings exist | COMMENT |
| LOW | uninstall.sh | 680 | # Check if file is now empty (just whitespace) | COMMENT |
| LOW | install.sh | 393 | # Check if a specific agent was detected | COMMENT |
| LOW | install.sh | 402 | # Check if installed version matches target | COMMENT |
| LOW | install.sh | 763 | # Check if the completions subcommand exists (added in v0.2.11+) | COMMENT |
| LOW | install.sh | 1082 | # Check if already at target version (skip download if so, unless --force) | COMMENT |
| LOW | install.sh | 1097 | # Check if existing lock is stale (process no longer running) | COMMENT |
| LOW | install.sh | 1343 | # Check if the exact current dcg hook is already configured. A stale dcg | COMMENT |
| LOW | install.sh | 1638 | # Check if Gemini CLI appears to be installed (has config dir or gemini command exists) | COMMENT |
| LOW | install.sh | 1892 | # Check if Aider is installed (command exists) | COMMENT |
| LOW | install.sh | 1909 | # Check if git-commit-verify is already set to true | COMMENT |
| LOW | install.sh | 1916 | # Check if git-commit-verify exists but is false | COMMENT |
| LOW | install.sh | 1975 | # Check if Continue is installed | COMMENT |
| LOW | install.sh | 2037 | # Check if Codex is installed | COMMENT |
| LOW | install.sh | 2061 | # Check if the exact current dcg hook is already configured. A stale dcg | COMMENT |
| LOW | tests/e2e/run_agent_e2e.sh | 141 | # Check if jq is available | COMMENT |
| LOW | tests/e2e/run_install_e2e.sh | 284 | # Check if detection works | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 367 | # Containers and orchestration | COMMENT |
| MEDIUM | tests/codex_hook_protocol.rs | 366 | // Smoke tests — validate the scaffold helpers work before leaf tests depend | COMMENT |
| MEDIUM | tests/scripts/run_e2e_tests.sh | 5 | # This script orchestrates all E2E tests for the Destructive Command Guard. | COMMENT |
| MEDIUM | docs/planning/DGC_IMPROVEMENT_PLAN__GPT.md | 44 | 3. [Design principles](#design-principles-guardrails-for-the-whole-project) | CODE |
| MEDIUM | docs/planning/DGC_IMPROVEMENT_PLAN__GPT.md | 128 | ## Design principles (guardrails for the whole project) | COMMENT |
| MEDIUM | docs/planning/DGC_IMPROVEMENT_PLAN__GPT.md | 904 | ### Cross-cutting: Performance + safety guardrails (limits, hardening, benchmarks) | COMMENT |
| MEDIUM | docs/planning/DCG_IMPROVEMENT_PLAN__OPUS.md | 49 | 9. [Test Infrastructure & Performance Guardrails](#7-test-infrastructure--performance-guardrails) | CODE |
| MEDIUM | scripts/e2e_codex.sh | 5 | # This scaffold mirrors scripts/e2e_test.sh logging conventions, but drives the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | install.sh | 2563 | def main(): | CODE |
| LOW | install.sh | 2566 | except Exception: | CODE |
| LOW | install.sh | 2575 | except Exception: | CODE |
| LOW | install.sh | 2596 | except Exception: | CODE |
| LOW | install.sh | 2607 | except Exception: | CODE |
| LOW | install.sh | 2645 | except Exception: | CODE |
| LOW | install.sh | 2701 | except Exception: | CODE |
| LOW | tests/install/test_helper.bash | 252 | except Exception: | CODE |
| LOW | scripts/audit_patterns.py | 19 | except Exception as e: | CODE |
| MEDIUM | scripts/audit_patterns.py | 20 | print(f"Error reading {filepath}: {e}") | CODE |
| MEDIUM | scripts/audit_patterns.py | 15 | def scan_file(filepath): | CODE |
| LOW | scripts/perf_baseline.py | 63 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 118 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 136 | except Exception as exc: # noqa: BLE001 | CODE |
| LOW | scripts/perf_baseline.py | 150 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 176 | except Exception: | CODE |
| LOW | scripts/perf_baseline.py | 255 | except Exception as exc: # noqa: BLE001 | CODE |
| MEDIUM | scripts/perf_baseline.py | 122 | def capture_rustc_version() -> Tuple[str, Optional[str]]: | CODE |
| MEDIUM | scripts/perf_baseline.py | 140 | def capture_git_sha() -> Optional[str]: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/e2e/run_tui_e2e.sh | 12 | # Usage: | COMMENT |
| LOW | tests/e2e/run_agent_e2e.sh | 8 | # Usage: | COMMENT |
| LOW | tests/e2e/run_install_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | tests/e2e/robot_mode_test.sh | 11 | # Usage: | COMMENT |
| LOW | tests/e2e/test_doctor_install_uninstall.sh | 9 | # Usage: | COMMENT |
| LOW | tests/e2e/run_history_e2e.sh | 7 | # Usage: | COMMENT |
| LOW | tests/e2e/run_update_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/check_benchmark_budgets.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/scan_gitdiff_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/e2e_test.sh | 8 | # Usage: | COMMENT |
| LOW | scripts/scan_precommit_e2e.sh | 11 | # Usage: | COMMENT |
| LOW | scripts/test-quick.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/coverage.sh | 5 | # Usage: | COMMENT |
| LOW | scripts/templates/test_pack.sh | 8 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/planning/DCG_IMPROVEMENT_PLAN__OPUS.md | 2031 | *Document generated by Claude Opus 4.5 on 2026-01-08 (Enhanced Hybrid Version)* | COMMENT |
| HIGH | docs/planning/AGENT_FRIENDLINESS_REPORT.md | 205 | *Generated by Claude Opus 4.5 during bd-dpr execution* | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | uninstall.sh | 585 | def strip_dcg_platform_fields(entry): | CODE |
| LOW | install.sh | 2386 | def strip_dcg_platform_fields(entry): | CODE |
| LOW | scripts/check_cli_versions.sh | 118 | def github_repo_from_releases_url(url) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/audit_patterns.py | 42 | CODE | |
| LOW | scripts/perf_baseline.py | 39 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/perf_baseline.py | 11 | CODE |