dcg-hermes 🛡️🛸

Bridge between dcg (Destructive Command Guard) and Hermes Agent.

Pre-command scanning, cron-safe reports, pre-commit hooks, and workspace protection for AI agent workflows.

npm install -g dcg-hermes

Why?

AI coding agents (including Hermes) occasionally run catastrophic commands like git reset --hard or rm -rf ./src, destroying hours of work in seconds. dcg intercepts and blocks these commands before they execute.

dcg-hermes wraps dcg with:

• Cron-friendly output — silent when clean, actionable reports when findings exist
• Pre-commit hooks — blocks commits containing destructive commands
• JSON reports — machine-parseable output for CI/CD pipelines
• Hermes agent awareness — integrates with Hermes cron and skill workflows

Prerequisites

dcg must be installed first:

curl -fsSL "https://raw.githubusercontent.com/Dicklesworthstone/destructive_command_guard/main/install.sh" | bash

Usage

dcg-hermes <command> [options]

Commands

| Command | Description | |---------|-------------| | scan <path> | Scan files/directories for destructive commands | | check "<command>" | Test if a command would be blocked | | status | Check dcg installation and hook status | | precommit | Run as pre-commit hook (blocks on findings) | | report <path> | Generate a full JSON report | | cron [path] | Cron mode — silent if clean, report if findings |

Examples

# Check a command
dcg-hermes check "git reset --hard HEAD~5"
# → ⛔ git reset --hard HEAD~5
#      → matched deny rule

# Scan a directory
dcg-hermes scan ./src

# Pre-commit hook (add to .git/hooks/pre-commit)
dcg-hermes precommit

# Cron-friendly scan
dcg-hermes cron /opt/data/workspace

# Full JSON report
dcg-hermes report /opt/data > dcg-report.json

Git Pre-Commit Hook

ln -s "$(which dcg-hermes)" .git/hooks/pre-commit
# or
echo '#!/bin/sh\ndcg-hermes precommit' > .git/hooks/pre-commit
chmod +x .git/hooks/pre-commit

Hermes Agent Integration

Add to your .hermes.md:

## Safety

Before running destructive commands, check with dcg:
```bash
dcg-hermes check "<command>"
``

For cron workflows, use dcg-hermes cron to silently scan nothing if clean, or deliver a report if findings exist.

How It Works

dcg-hermes is a thin Node.js wrapper around the dcg binary. It:

1. Locates dcg on the system (common paths or PATH)
2. Parses dcg's output into structured formats
3. Provides agent-friendly interfaces (cron, precommit, report)
4. Exits with appropriate codes for scripting

License

MIT — see LICENSE