/plugin marketplace add kenryu42/cc-marketplace
/plugin install safety-net@cc-marketplace
/reload-plugins

/plugin
# Select Marketplaces → cc-marketplace → Enable auto-update

{
  "plugin": ["cc-safety-net"]
}

gemini extensions install https://github.com/kenryu42/gemini-safety-net

/plugin install kenryu42/copilot-safety-net

[features]
plugin_hooks = true

codex plugin marketplace add kenryu42/cc-marketplace

{
  "statusLine": {
    "type": "command",
    "command": "bunx cc-safety-net --statusline"
  }
}

{
  "statusLine": {
    "type": "command",
    "command": "git branch --show-current | bunx cc-safety-net --statusline"
  }
}

{
  "rules": [
    {
      "name": "block-npm-publish",
      "pattern": "npm publish",
      "action": "block",
      "reason": "Use CI/CD pipeline for publishing"
    },
    {
      "name": "allow-temp-cleanup",
      "pattern": "rm -rf /tmp/myapp-*",
      "action": "allow",
      "reason": "Safe to clean temp files"
    },
    {
      "name": "block-production-deploys",
      "pattern": "kubectl.*--context=prod",
      "action": "block",
      "reason": "Production deploys require manual approval"
    }
  ]
}

interface Rule {
  name: string;           // Unique identifier
  pattern: string;        // Regex pattern to match
  action: "block" | "allow";
  reason: string;         // Why this rule exists
}

{
  "safety-net": {
    "strict": true
  }
}

{
  "safety-net": {
    "paranoid": true
  }
}

{
  "safety-net": {
    "worktree": true
  }
}

# Command executed:
curl -H "Authorization: Bearer sk-1234..." https://api.example.com

# Logged as:
curl -H "Authorization: Bearer [REDACTED]" https://api.example.com

{
  "safety-net": {
    "audit": {
      "enabled": true,
      "logFile": "~/.config/cc-safety-net/audit.log"
    }
  }
}

{
  "timestamp": "2025-01-15T10:30:45.123Z",
  "command": "git reset --hard HEAD~1",
  "action": "blocked",
  "reason": "Destructive git reset detected",
  "mode": "default",
  "cwd": "/home/user/project"
}

# Destructive resets
git reset --hard
git reset --hard HEAD~1

# Discard changes
git checkout -- .
git checkout -- file.txt

# Force push
git push --force
git push -f origin main

# Stash operations
git stash clear
git stash drop

# Strict mode only
git clean -fd
git branch -D feature
git remote remove origin

# Recursive deletion of important directories
rm -rf /
rm -rf ~/
rm -rf .
rm -rf .git

# Allow safe cleanup
rm -rf /tmp/cache  # ✅ Allowed
rm -rf node_modules  # ✅ Allowed

# Direct wrapper
bash -c "rm -rf /"

# Nested wrappers
sh -c "bash -c 'rm -rf /'"
eval "sh -c 'bash -c \"rm -rf /\"'"

# Python
python -c 'import os; os.system("rm -rf /")'
python3 -c 'import shutil; shutil.rmtree("/")'

# Node.js
node -e 'require("child_process").execSync("rm -rf /")'

# Ruby
ruby -e 'system("rm -rf /")'

# Perl
perl -e 'system("rm -rf /")'

# Safe git operations
git checkout -b feature
git checkout main
git reset --soft HEAD~1
git push origin feature
git stash
git stash pop

# Safe filesystem operations
rm file.txt
rm -r /tmp/myapp-cache
rm -rf node_modules
mv old.txt new.txt
cp -r src/ backup/

# Safe git workflow
git add .
git commit -m "feat: add feature"
git push origin feature
git pull --rebase
git merge feature

bunx cc-safety-net --diagnose

🛡️  Safety Net Diagnostics

✓ Plugin installed and enabled
✓ PreToolUse hook registered
✓ Status line: Active

Configuration:
  Mode: strict
  Worktree: disabled
  Paranoid: disabled
  Audit log: enabled (~/.config/cc-safety-net/audit.log)

Custom Rules:
  ✓ block-npm-publish
  ✓ allow-temp-cleanup
  ✗ invalid-rule (Pattern compile error)

Recent Blocks (last 24h):
  - git reset --hard (2025-01-15 10:30:45)
  - rm -rf / (2025-01-15 09:15:22)

bunx cc-safety-net --explain "git reset --hard"

Command: git reset --hard
Action: 🚫 BLOCKED
Reason: Destructive git reset detected

Analysis:
  - Command: git reset --hard
  - Flags: --hard
  - Pattern matched: Destructive reset (discards uncommitted changes)
  - Mode: default
  - Custom rules: none matched

Safe alternatives:
  - git reset --soft HEAD~1 (keeps changes staged)
  - git stash (temporarily saves changes)
  - git commit (save changes permanently)

# Should be blocked
git reset --hard
rm -rf /tmp/test-deleteme

# Should be allowed
git checkout -b test-branch
rm -rf /tmp/cache

🛡️ Safety Net: Command blocked

Command: git reset --hard
Reason: Destructive git reset detected

This command would discard all uncommitted changes.

Safe alternatives:
  - git reset --soft HEAD~1
  - git stash
  - git commit

bunx cc-safety-net --diagnose

/plugins
# Verify safety-net shows as enabled

/hooks
# Select safety-net and press 't'

cat ~/.config/cc-safety-net/rules.json | jq .

bunx cc-safety-net --explain "your command here"

tail -f ~/.config/cc-safety-net/audit.log

bunx cc-safety-net --statusline

cat ~/.claude/settings.json | jq .statusLine

{
  "rules": [
    {
      "name": "allow-my-script",
      "pattern": "rm -rf /tmp/myapp-build-*",
      "action": "allow",
      "reason": "Safe cleanup pattern"
    }
  ]
}

bunx cc-safety-net --explain "your bypassed command"

{
  "rules": [
    {
      "name": "block-wrapper",
      "pattern": "your-wrapper-pattern",
      "action": "block",
      "reason": "Temporary workaround"
    }
  ]
}

# Blocked automatically
git push --force origin main

# Safe alternative shown
git push --force-with-lease origin main

{
  "rules": [
    {
      "name": "allow-build-cleanup",
      "pattern": "rm -rf (dist|build|.next|out|target)/",
      "action": "allow",
      "reason": "Safe to clean build directories"
    }
  ]
}

{
  "rules": [
    {
      "name": "block-prod-deploy",
      "pattern": "(kubectl|terraform).*prod",
      "action": "block",
      "reason": "Use CI/CD for production"
    }
  ]
}

{
  "safety-net": {
    "strict": true,
    "worktree": true,
    "audit": {
      "enabled": true,
      "logFile": "~/team-audit.log"
    }
  },
  "rules": [
    {
      "name": "block-db-drops",
      "pattern": "DROP (DATABASE|TABLE)",
      "action": "block",
      "reason": "Use migration system"
    }
  ]
}