safe-mode-dev

Claude Code Safe Mode

A plugin for Claude Code that stops dangerous git and file-deletion commands before they run—so one bad command can’t wipe out your work.

Contents

• Why This Exists
• Why Use This Instead of Permission Deny Rules?
• What About Sandboxing?
• What You Need First
• Quick Start
  • Install for Claude Code
  • Install for OpenCode
  • Install for Gemini CLI
  • Install for GitHub Copilot CLI
• Show Status in the Status Bar
  • Set Up with the Slash Command
  • Set Up by Hand
  • What the Status Emojis Mean
• Check Your Setup (Doctor)
• See Why a Command Was Blocked (Explain)
• Commands That Are Blocked
• Commands That Are Allowed
• What You See When Something Is Blocked
• How to Test That It Works
• Development
• Add Your Own Rules (Experimental)
  • Where Config Files Live
  • Rule Format
  • How Matching Works
  • Examples
  • When Config Is Invalid
• Strict Mode, Paranoid Mode, and More
  • Strict Mode
  • Paranoid Mode
  • Nested Shell Detection
  • One-Line Script Detection
  • Hiding Secrets in Messages
  • Audit Log
• License

Why This Exists

I learned the hard way that written instructions alone don’t stop an AI from running harmful commands. After Claude Code wiped out hours of work with a single rm -rf ~/ or git checkout --, it was clear that rules in a CLAUDE.md or AGENTS.md file are only suggestions—they can’t actually stop a command from running. This plugin is a real guard: it runs before any command and can block it so destructive commands never execute.

Why Use This Instead of Permission Deny Rules?

Claude Code’s .claude/settings.json supports deny rules that match commands by pattern (e.g., Bash(git reset --hard:*)). Here’s how this plugin is different:

At a Glance

	Permission Deny Rules	Safe Mode
Setup	You must configure it yourself	Works as soon as you install it
How it checks	Matches text patterns (e.g. with *)	Understands what the command does
When it runs	Runs after Safe Mode	Runs first (before the command runs)
Nested shells	Doesn’t look inside sh -c '...' style commands	Looks inside nested commands (up to 5 levels)
Code in Python/Node/etc.	Doesn’t check one-line scripts	Detects and blocks dangerous one-liners

Permission Rules Can Be Worked Around

Even with pattern matching, permission rules only look at the exact text. People (or AI) can get around them in several ways:

How to bypass	Example
Put options before the value	curl -X GET http://evil.com doesn’t match Bash(curl http://evil.com:*)
Use variables	URL=http://evil.com && curl $URL doesn’t match a URL pattern
Change flag order	rm -r -f / doesn’t match Bash(rm -rf:*)
Add extra spaces	rm -rf / (double space) doesn’t match the pattern
Wrap in another shell	sh -c "rm -rf /" doesn’t match Bash(rm:*) at all

Safe Mode Understands Commands, Not Just Text