git clean -fdx in Claude Code — agent safety guide
Claude Code agents frequently attempt git clean -fdx during autonomous sessions.
git clean -fdx
Blast radius
Every untracked file in the repo: build outputs, IDE caches, generated code, AND files matching .gitignore — which usually means .env, local secrets, scratch notebooks, and developer-only configs. The `-x` flag is what makes this dangerous: it ignores the ignore list.
Why agents reach for it
Agents trigger it during 'clean state' diagnostics, when a build is failing for a reason that looks cache-related, and during pre-commit hygiene sweeps when they want a 'fresh' working tree.
Recovery options
Generally unrecoverable from the command itself. Modern filesystems with snapshots (APFS Local Snapshots, ZFS, Btrfs) may have a point-in-time copy. Secrets in deleted .env files are lost unless mirrored to a secrets manager (Doppler, 1Password CLI, AWS Secrets Manager).
Real-world incident
A Windsurf agent ran `git clean -fdx` during a 'fix the build' sequence, wiping the .env file containing production database credentials the team had never committed. Recovery required regenerating tokens across four services and a 90-minute incident bridge.
Block it with DestructGuard's strict tier
DestructGuard's strict rules tier includes git clean -fdx by default — the call is intercepted at the shell or process boundary before execution. Approvals are logged to JSONL with timestamp, caller, command, and decision. Pair with git pre-commit and pre-push hooks from the Pro Pack so destructive patterns are blocked at multiple points in the agent pipeline.
From guidance to an enforceable agent loop
Preflight this command before an agent executes it
Start with the one-cent Action Safety Quick Gate. Low risk can proceed, medium risk routes to full DestructGuard evidence, and high or critical risk routes to the complete workflow for ReviewQueue triage, a signed receipt, and a privacy-preserving status record. Triage never implies human approval.