Copilot CLI's checkpoint restore ran git clean -fd and destroyed 1GB of evaluation data the agent never touched

copilot --deny-tool='shell(git reset)' --deny-tool='shell(git clean)' --deny-tool='shell(git stash)' --deny-tool='shell(git filter-repo)' --deny-tool='shell(git worktree)'

Stronger control: Avoid --allow-all-tools on a machine with data you cannot lose; --deny-tool takes precedence over it. Docs

{
  "permissions": {
    "ask": [
      "Bash(git reset --hard*)",
      "Bash(git clean *)",
      "Bash(git push --force*)",
      "Bash(git push -f*)",
      "Bash(git stash drop*)",
      "Bash(git filter-repo*)",
      "Bash(git worktree remove *)"
    ]
  }
}

Stronger control: Turn on the sandbox (/sandbox): shell commands can then write only to the project, a temp folder and directories you add. It runs on macOS, Linux and WSL2; on native Windows Claude Code runs commands unsandboxed. Docs

prefix_rule(pattern = ["git", "reset", "--hard"], decision = "prompt")
prefix_rule(pattern = ["git", "clean"], decision = "prompt")
prefix_rule(pattern = ["git", "push", ["--force", "-f"]], decision = "prompt")
prefix_rule(pattern = ["git", "stash", "drop"], decision = "prompt")
prefix_rule(pattern = ["git", "filter-repo"], decision = "prompt")
prefix_rule(pattern = ["git", "worktree", "remove"], decision = "prompt")

Stronger control: Keep Codex's OS sandbox on (it limits writes, typically to the workspace) and leave approvals on for sessions that can reach data you cannot lose. Docs

[[rule]]
toolName = "run_shell_command"
commandPrefix = ["git reset --hard", "git clean", "git push --force", "git push -f", "git stash drop", "git filter-repo", "git worktree remove"]
decision = "ask_user"
priority = 100
denyMessage = "Destructive command: needs a human to confirm (stupidllm.com)"

Stronger control: Policies in ~/.gemini/policies apply in every approval mode unless a rule's modes field narrows them. Docs