diff --git a/scripts/commands/build.ps1 b/scripts/commands/build.ps1
index 21d9c0e..0743df8 100644
--- a/scripts/commands/build.ps1
+++ b/scripts/commands/build.ps1
@@ -202,11 +202,8 @@ foreach ($shell in @('powershell','bash')) {
         $script = if ($shell -eq 'powershell') { 'flashbang.ps1' } else { 'flashbang.sh' }
         $statusLineScript = if ($shell -eq 'powershell') { 'statusline.ps1' } else { 'statusline.sh' }
         $content = Get-Content -LiteralPath $path -Raw
-        $denyRules = if ($shell -eq 'powershell') {
-            @('PowerShell(git reset --hard*)','PowerShell(git clean*)','PowerShell(Remove-Item *-Recurse*)')
-        } else {
-            @('Bash(git reset --hard*)','Bash(git clean*)','Bash(rm -rf*)')
-        }
+        # Claude can offer both shell tools on Windows, so every package denies the destructive commands in both.
+        $denyRules = @('PowerShell(git reset --hard*)','PowerShell(git clean*)','PowerShell(Remove-Item *-Recurse*)','Bash(git reset --hard*)','Bash(git clean*)','Bash(rm -rf*)')
         $denyRulesJson = ConvertTo-Json -InputObject $denyRules -Compress
         $shellTool = if ($shell -eq 'powershell') { 'PowerShell' } else { 'Bash' }
         $allowRulesJson = ConvertTo-Json -InputObject @('Agent', "$shellTool(mcporter call context7.*)") -Compress
diff --git a/scripts/commands/build.sh b/scripts/commands/build.sh
index dd6ad21..004446a 100644
--- a/scripts/commands/build.sh
+++ b/scripts/commands/build.sh
@@ -204,11 +204,11 @@ for client in codex claude; do
   fi
   path="$output/$client-$shell/$file"
   content=$(<"$path")
+  # Claude can offer both shell tools on Windows, so every package denies the destructive commands in both.
+  deny_rules='["PowerShell(git reset --hard*)","PowerShell(git clean*)","PowerShell(Remove-Item *-Recurse*)","Bash(git reset --hard*)","Bash(git clean*)","Bash(rm -rf*)"]'
   if [ "$shell" = powershell ]; then
-    deny_rules='["PowerShell(git reset --hard*)","PowerShell(git clean*)","PowerShell(Remove-Item *-Recurse*)"]'
     allow_rules='["Agent","PowerShell(mcporter call context7.*)"]'
   else
-    deny_rules='["Bash(git reset --hard*)","Bash(git clean*)","Bash(rm -rf*)"]'
     allow_rules='["Agent","Bash(mcporter call context7.*)"]'
   fi
   content=${content//__HOOK_COMMAND__/$command}