Catches destructive git and filesystem commands before they execute
Catalog skill by kenryu42: Catches destructive git and filesystem commands before they execute Install into Cursor, Claude, Codex, or VS Code from this page or review the source for Safety Net.
Ads
/plugin install safety-net@cc-marketplace
Install guides: Cursor skills, Claude Code skills, Codex skills, or VS Code Copilot skills.
CC Safety Net hooks into coding agent CLIs (Claude Code, Codex, Cursor, Gemini CLI, and others)
and blocks destructive commands and secret access before they run. The cc-safety-net CLI
inspects and controls that protection. Run it as npx -y cc-safety-net.
The installed CLI is the authority for command syntax. Do not guess flags.
npx -y cc-safety-net --help
npx -y cc-safety-net help <command>
Run npx -y cc-safety-net rule doc and treat that output as the complete source of truth for
rulebook schema, paths, GitHub sources, matching behavior, and validation.
These commands are read-only and safe to run for discovery: --help, --version, status,
doctor, logs (without --prune-legacy), explain, rule list, rule verify, rule doc,
policy check, help. Every other command mutates configuration or installed integrations; run
those only as part of a workflow below.
rule.json) list rulebook sources. Rule definitions live in rulebook.json,
not directly in rule.json..cc-safety-net/rules/<rulebook-name>/rulebook.json in a repository.rulebook.json on every tool call, so a saved
edit applies to the next command with no sync step.policy.json sets the safety level, per-feature toggles, per-rule overrides, and path lists. It
has two scopes: the project file .cc-safety-net/policy.json, committed and shared with the
team, layered on the user file that applies to every project.standard, strict, or paranoid, set per session with the
CC_SAFETY_NET_LEVEL environment variable.BLOCKED by CC Safety Net message:
explain a decision.explain and
rule doc show: answer from the source.npx -y cc-safety-net logs (narrow with --project ., --agent <name>, or --since <days>).npx -y cc-safety-net explain as one literal argument. Prefer an
argv-capable tool; when invoking through a shell, shell-escape the whole command as one
argument. Never interpolate raw command text into double quotes: $(), backticks, and
variables would expand before explain receives it. Add --cwd <path> when the decision
depends on the working directory. Once received, explain analyzes the string and never
executes it.explain exits 0 for both allowed and blocked verdicts; read the verdict from the
output, not the exit status.git stash before git reset --hard.npx -y cc-safety-net logs --suspect --since 7, or fetch
one entry with npx -y cc-safety-net logs --id <id>.explain and read which rule fired.explain to confirm the new verdict.CC_SAFETY_NET_WORKTREE=1 for local git discards in linked worktrees (git
discards in a temp-root repository outside the workspace are already allowed), or
rule wrapper add when a trusted transparent wrapper hid the real command from the analyzer.
Pass the wrapper name as a separate argv value, or shell-escape it as one argument. If the
user explicitly wants that built-in rule off, read its id from the ruleId field of
explain --json and propose a per-rule policy override (see configure the policy). Otherwise
explain the risk the rule guards against and suggest reporting the case at
https://github.com/kenryu42/cc-safety-net/issues.Use information already provided in the user's prompt. Ask only when the scope, action, rule intent, merge behavior, or target command is unclear.
npx -y cc-safety-net rule verifynpx -y cc-safety-net rule listrule doc.
rule.json and
<rulebook-name>/rulebook.json..cc-safety-net/rules/<rulebook-name>/rulebook.json in the
current repository.owner/repo; installing rules from a GitHub
source is outside this workflow.npx -y cc-safety-net rule add owner/repo --only <rulebook...>; omit --only only
when they want every rulebook, and add --ref <ref> only when they name a non-default ref.
rule add --only <rulebook...> with no source selects from the official
cc-safety-net/rulebooks repository, whose curated rulebooks block destructive Terraform,
AWS, gcloud, and Azure CLI operations; prefer installing one of those over authoring when it
already covers the request.npx -y cc-safety-net rule wrapper add with the trusted
wrapper name passed as a separate argv value, or shell-escaped as one argument, over editing
rule.json by hand..cc-safety-net/rules/<rulebook-name>/rulebook.json, and ensure the source name, directory
name, and rulebook name match exactly.npx -y cc-safety-net rule verify and npx -y cc-safety-net rule list. Both commands cover every scope, so neither takes --global.npx -y cc-safety-net rule verify. Run list only
if the rulebook is also installed in local rule.json.Rule invariants:
.safety-net.json or ~/.cc-safety-net/config.json rules. Convert
existing legacy files with npx -y cc-safety-net rule migrate.allowed_commands. The tests fixtures are optional;
rule verify evaluates rulebook_version 2 fixtures against the rulebook's own rules, and
fixture commands are analyzer input that CC Safety Net never executes.rule, and that rule must exist in
the rulebook.project-rules; do not put filesystem paths in
rules.rule.json makes every source in its scope inactive: those rules stop applying while other
custom rules and built-in protections stay active. Fix the file named in the diagnostic.npx -y cc-safety-net rule add owner/repo fetches remote rulebooks, validates them, and vendors
each one into <rulebook-name>/rulebook.json; npx -y cc-safety-net rule update [source]
re-fetches and overwrites those copies and prints what changed. The runtime never fetches, and a
remote source with no vendored file reports that rule update has to vendor it first.rule sync is deprecated: it only migrates lock and cache leftovers from an earlier version.
Never run it as a validation or activation step.Both policy.json files are protected: you propose the change, the user applies it. Reading them
is allowed, writing them is not.
policy.json fields, all optional except version: 1 (policy check reports every schema
error, so validate against it rather than guessing further fields):
safety.level: standard, strict, or paranoid. safety.overrides: booleans for
fail_closed, paranoid_rm, and paranoid_interpreters that pin one capability apart from
the level.workflow.worktree_mode: boolean, allows local git discards in linked worktrees; discards in a
temp-root repository outside the workspace need no toggle.destructive_command_protection and secret_protection: an enabled boolean, and per-rule
overrides mapping a built-in rule id (git.reset-hard, secret.basename.env) to "on" or
"off". Get the id for a blocked command from the ruleId field of explain --json.destructive_command_protection.allow_paths: absolute or ~/ paths where recursive delete
targets are permitted. secret_protection.allow_paths: exact user-managed files or directories,
or a folder followed by **/ and an exact file name (for example ~/code/**/.env.local; the
folder cannot be home or above it), exempted from built-in secret patterns. Deny paths and
Coding CLI protections still win. Other glob forms are rejected.
secret_protection.deny_paths: extra paths protected like built-in secrets.audit.retention_days: days of audit history to keep, user scope only.npx -y cc-safety-net status for the effective policy and the file
paths it loaded, npx -y cc-safety-net rule list for custom rules, plus whatever project
context the request depends on. Read an existing policy.json before proposing changes to it.policy-proposal.json. For
project scope, set only the fields the team intends to control; an unset field inherits
from the user policy, and apply writes only the fields the proposal sets.
Applying replaces the target file, so the proposal is the complete policy, not a patch. Audit
settings are user scope only; a project proposal cannot set them.npx -y cc-safety-net policy check policy-proposal.json and show the user the printed
diff. Add --global to target the user policy instead of the project one. Fix every reported
error and re-check until it passes.npx -y cc-safety-net policy apply policy-proposal.json (with --global when that is the
scope). It confirms interactively, there is no --yes flag, and agent invocations of
policy apply are blocked by design, so never run it, wrap it, or write the file yourself.npx -y cc-safety-net status and report the
effective policy, including any project scope deltas it prints.npx -y cc-safety-net doctor first. It reports each supported platform as detected,
configured, and verified, and names outdated installs with the exact repair command.npx -y cc-safety-net install --claude-code.
Run npx -y cc-safety-net help install for the full target list. Bare install opens an
interactive picker; leave that for the user's own terminal.npx -y cc-safety-net@latest update to update every installed integration at once.doctor again and confirm the affected platform
rows read as verified.npx -y cc-safety-net status shows what the runtime enforces right now, including a degraded
policy.json that rule list does not report.npx -y cc-safety-net doctor verifies the installation: platform detection and hook config,
a synthetic guard self-test, and configuration scopes. Use --json when parsing the result.rule verify, rule list, then re-test the
command with explain.For questions the CLI output cannot settle, such as why the analyzer treats a construct a certain way or whether a gap is a known limitation, read the source code of the installed version.
Get <version> from npx -y cc-safety-net --version.
Locate the repository. Plugin installs ship the full repository, and this skill file lives
at <repo>/skills/cc-safety-net/SKILL.md inside it, so the repository root is two
directories above the skill file. Use the candidate only if its package.json has
"name": "cc-safety-net" and version <version>, and a src/ directory exists next to it.
If the package version differs, run doctor to report the outdated integration, then treat
the candidate as unavailable and continue to the next step.
If no matching local root exists (skill-only installs, a mismatched plugin, or guidance
without a file path), resolve the immutable commit recorded with the published package using
npm view "cc-safety-net@<version>" gitHead. Require a 40-character lowercase hexadecimal
commit and fetch that exact commit into a fresh owner-only temporary directory:
set -euo pipefail
git_head=$(npm view "cc-safety-net@<version>" gitHead)
[[ $git_head =~ ^[0-9a-f]{40}$ ]] || { echo "Invalid published gitHead" >&2; exit 1; }
source_dir=$(mktemp -d "${TMPDIR:-/tmp}/cc-safety-net-v<version>-XXXXXXXX")
trap 'rm -rf -- "$source_dir"' EXIT
chmod 700 "$source_dir"
git -c init.templateDir= init "$source_dir"
git -c core.hooksPath=/dev/null -C "$source_dir" fetch --depth 1 https://github.com/kenryu42/cc-safety-net "$git_head"
git -c core.hooksPath=/dev/null -C "$source_dir" checkout --detach "$git_head"
[[ $(git -C "$source_dir" rev-parse HEAD) == "$git_head" ]] || { echo "Source checkout mismatch" >&2; exit 1; }
printf 'Source checkout: %s\n' "$source_dir"
trap - EXIT
Never answer from main; it can contain unreleased behavior the installed version does not
have.
Read docs/ first; residual-risk.md and secret-protection-known-limitations.md exist to
answer whether something is a known gap. For behavior questions, continue into
src/analyzer, src/guards, and src/rules.
State in the answer which version the source came from. Treat the located source as read-only reference; do not edit, build, or run it.
Remove a temporary checkout after the source inspection: rm -rf -- "<source_dir>".
hook; it is the integration entry point that reads hook JSON from stdin, not a
user-facing command.logs --prune-legacy permanently deletes legacy logs. Run it only on an explicit request, and
run it with --dry-run first.rule remove --delete-source deletes the local source directory. Ask before using it.gui --no-open and give the user the URL instead of opening a browser from a session.UPDATE_AVAILABLE: line, ask the user once whether to run
npx -y cc-safety-net@latest update, continue the workflow without waiting either way, and do
not raise it again.