safe-rm

Safe Delete Protection for Claude Code

Catch 99% of accidental deletions with one simple install.

Stop AI agents from accidentally deleting .env files, git-tracked code, or critical system files. This plugin adds automatic safety checks to every rm command in Claude Code sessions.

Zero configuration. Zero learning curve. Just install and forget.

The Problem

AI agents are powerful, but they can make costly mistakes:

# Claude executes: rm .env
# 💥 Your API keys are gone

# Claude executes: rm -rf ../important-project
# 💥 Wrong directory deleted

# Claude executes: rm src/config.ts
# 💥 Git-tracked file removed without confirmation

One accidental deletion can cost hours of recovery work.

The Solution

A lightweight safety layer you can "just install and forget":

• ✅ 30-second setup, zero configuration
• ✅ Works transparently (no new commands to learn)
• ✅ Catches most common AI deletion mistakes
• ✅ Zero performance impact, minimal false positives

Why This Plugin, Not Other Solutions?

You might be using these common approaches to protect your files:

❌ Approach 1: Deny rm in settings.json

{
  "permissions": {
    "deny": ["Bash(rm *)"]
  }
}

Problem: Pattern matching is fragile and can be bypassed:

• rm file.txt → ❌ Blocked
• rm file.txt (extra space) → ✅ Bypassed
• /bin/rm file.txt → ✅ Bypassed
• Known bug: deny permissions not enforced

❌ Approach 2: Instructions in CLAUDE.md

IMPORTANT: Never use the rm command to delete files.

Problem: LLM instructions are unreliable:

• Claude may ignore instructions under certain contexts
• No guaranteed enforcement
• Real incidents: "rm -rf executed on home directory despite explicit instructions"

✅ This Plugin: Shell-Layer Protection

This plugin works at the shell execution layer — below the LLM:

User Request → Claude (LLM) → Shell Command → [🛡️ THIS PLUGIN] → System

Why it works reliably:

1. Physical layer enforcement — runs BEFORE the system executes rm
2. Catches all rm variants — direct interception, not pattern matching
3. LLM-agnostic — works regardless of what Claude decides
4. Zero regex fragility — no bypass through spacing or syntax tricks
5. AI-friendly feedback — clear error messages guide the agent to correct actions

Note: This doesn't protect against other deletion methods (like find -delete), but it handles 99% of accidental AI deletions with zero productivity cost.

Quick Start

Installation

# Add the marketplace
/plugin marketplace add TeXmeijin/safe-rm-claude-plugin

# Install the plugin
/plugin install safe-rm@safe-rm-marketplace

That's it! Your Claude Code sessions now catch most accidental deletions automatically.

How It Works

After installation, all rm commands in Claude Code are transparently protected:

# You use rm normally
rm .env

# But the plugin automatically blocks dangerous operations
# ❌ FORBIDDEN: You are trying to remove dotfile: .env
# You must ask your leader to run manually: rm /path/to/.env

You don't need to learn new commands or change your workflow. The protection works invisibly in the background.

Smart AI Guidance

Unlike silent blocking, this plugin provides actionable feedback that helps Claude understand what went wrong and what to do next:

rm -r large-directory/  # contains 50+ files

# ❌ Error output:
# FORBIDDEN: Directory contains 50 files (limit: 10)
# Directory: /Users/you/project/large-directory
# NEXT ACTION👉: You MUST ask your manager to run manually: rm -rf /path/to/directory

This prevents AI runaway behavior:

• ✅ Claude sees exactly why the operation was blocked
• ✅ Claude learns what alternative actions to suggest
• ✅ Claude stops trying dangerous variations
• ✅ Claude can ask the user for confirmation instead

What's Protected

The plugin enforces 6 critical safety checks:

Protection	What It Does
🔒 Dotfiles	Blocks deletion of configuration files (.env, .gitignore, etc.)
🔒 Git-managed files	Requires confirmation before removing tracked files
🔒 Outside project scope	Prevents deleting files outside your current directory
🔒 System directories	Blocks removal of /, ~, and other critical paths
🔒 Gitignored files	Protects important files like node_modules, build outputs
🔒 Large directories	Limits recursive deletion to 10 files (configurable)

Examples

Protected Scenarios

# ❌ Blocked: Dotfile
rm .env
# FORBIDDEN: You are trying to remove dotfile: .env
# You must ask your leader to run manually: rm /path/to/.env
# → Claude learns: "I should ask the user for permission"