Loading plugin...
A coding agent CLI hook that acts as a safety net, catching destructive git and filesystem commands before they execute. Supports Codex, Claude Code, OpenCode, Gemini CLI, Copilot CLI, Kimi Code and Pi.
What's inside
.claude-plugin/
marketplace.json
plugin.json
.github/
assets/
cc-safety-net-header-logo-dark.svg
cc-safety-net-header-logo-light.svg
cc-safety-net.png
FUNDING.yml
hooks/
safety-net.json
ISSUE_TEMPLATE/
bug_report.yml
config.yml
feature_request.yml
workflows/
ci.yml
lint-github-actions-workflows.yml
notify-landing-page-release.yml
publish.yml
pullfrog.yml
test-windows.yml
.gitignore
.husky/
pre-commit
pre-push
.ignore
.lintstagedrc.json
AGENTS.md
assets/
cc-safety-net.schema.json
ast-grep/
rule-tests/
__snapshots__/
no-dynamic-import-snapshot.yml
.gitkeep
no-dynamic-import-test.yml
rules/
.gitkeep
no-dynamic-import.yml
utils/
.gitkeep
biome.json
bun.lock
bunfig.toml
CLAUDE.md
CODE_OF_CONDUCT.md
codecov.yml
CONTRIBUTING.md
dist/
bin/
cc-safety-net.d.ts
cc-safety-net.js
commands/
doctor.d.ts
explain.d.ts
hook.d.ts
index.d.ts
rule.d.ts
statusline.d.ts
types.d.ts
doctor/
activity.d.ts
config.d.ts
environment.d.ts
flags.d.ts
format.d.ts
hooks.d.ts
index.d.ts
system-info.d.ts
types.d.ts
updates.d.ts
explain/
analyze.d.ts
config.d.ts
flags.d.ts
format-helpers.d.ts
format.d.ts
index.d.ts
redact.d.ts
segment.d.ts
help.d.ts
hook/
claude-code.d.ts
common.d.ts
config-edit.d.ts
constants.d.ts
copilot-cli.d.ts
gemini-cli.d.ts
install/
install.d.ts
kimi-code.d.ts
types.d.ts
integrations.d.ts
kimi-code.d.ts
integration-metadata.d.ts
rule/
doc.d.ts
format.d.ts
index.d.ts
migrate.d.ts
verify.d.ts
statusline.d.ts
utils/
colors.d.ts
builtin-commands/
templates/
cc-safety-net.d.ts
core/
analyze/
analyze-command.d.ts
awk.d.ts
child-analyzer.d.ts
child-command.d.ts
constants.d.ts
dangerous-text.d.ts
find.d.ts
index.d.ts
interpreters.d.ts
parallel.d.ts
rm-flags.d.ts
rm.d.ts
segment.d.ts
shell-git-env.d.ts
shell-wrappers.d.ts
tmpdir.d.ts
xargs.d.ts
audit.d.ts
config.d.ts
env.d.ts
format.d.ts
git/
config.d.ts
env.d.ts
index.d.ts
parse.d.ts
rules.d.ts
worktree-relaxation.d.ts
worktree.d.ts
path.d.ts
rules/
custom-rule-validation.d.ts
custom.d.ts
policy/
config-file.d.ts
index.d.ts
lockfile.d.ts
paths.d.ts
resolver.d.ts
scope-policy.d.ts
sources.d.ts
sync.d.ts
types.d.ts
rulebook.d.ts
shell/
command.d.ts
index.d.ts
options.d.ts
segments.d.ts
shared.d.ts
wrappers.d.ts
index.d.ts
index.js
opencode/
builtin-commands/
commands.d.ts
index.d.ts
types.d.ts
pi/
builtin-commands/
commands.d.ts
index.d.ts
index.d.ts
index.js
tool-call.d.ts
types.d.ts
hooks/
hooks.json
knip.ts
LICENSE
package.json
README.md
scripts/
build-output.ts
build-schema.ts
build.ts
generate-changelog.ts
publish-options.ts
publish.ts
subprocess-output.ts
SECURITY.md
sgconfig.yml
skills/
cc-safety-net/
SKILL.md
src/
bin/
cc-safety-net.ts
commands/
doctor.ts
explain.ts
hook.ts
index.ts
rule.ts
statusline.ts
types.ts
doctor/
activity.ts
config.ts
environment.ts
flags.ts
format.ts
hooks.ts
index.ts
system-info.ts
types.ts
updates.ts
explain/
analyze.ts
config.ts
flags.ts
format-helpers.ts
format.ts
index.ts
redact.ts
segment.ts
help.ts
hook/
claude-code.ts
common.ts
config-edit.ts
constants.ts
copilot-cli.ts
gemini-cli.ts
install/
install.ts
kimi-code.ts
types.ts
integrations.ts
kimi-code.ts
integration-metadata.ts
rule/
doc.ts
format.ts
index.ts
migrate.ts
verify.ts
statusline.ts
utils/
colors.ts
builtin-commands/
templates/
cc-safety-net.ts
core/
analyze/
analyze-command.ts
awk.ts
child-analyzer.ts
child-command.ts
constants.ts
dangerous-text.ts
find.ts
index.ts
interpreters.ts
parallel.ts
rm-flags.ts
rm.ts
segment.ts
shell-git-env.ts
shell-wrappers.ts
tmpdir.ts
xargs.ts
audit.ts
config.ts
env.ts
format.ts
git/
config.ts
env.ts
index.ts
parse.ts
rules.ts
worktree-relaxation.ts
worktree.ts
path.ts
rules/
custom-rule-validation.ts
custom.ts
policy/
config-file.ts
index.ts
lockfile.ts
paths.ts
resolver.ts
scope-policy.ts
sources.ts
sync.ts
types.ts
rulebook.ts
shell/
command.ts
index.ts
options.ts
segments.ts
shared.ts
wrappers.ts
index.ts
opencode/
builtin-commands/
commands.ts
index.ts
types.ts
pi/
builtin-commands/
commands.ts
index.ts
index.ts
tool-call.ts
types.ts
tests/
bin/
cli-statusline.test.ts
colors.test.ts
commands.test.ts
doctor/
activity.test.ts
config.test.ts
environment.test.ts
format.test.ts
hooks.test.ts
system-info.test.ts
explain/
cli.test.ts
command.test.ts
flags.test.ts
format.test.ts
paranoid.test.ts
redact.test.ts
types.test.ts
help.test.ts
hooks/
claude-code-hook.test.ts
copilot-cli-hook.test.ts
gemini-cli-hook.test.ts
hook-adapter-direct.test.ts
hook-helpers.test.ts
hook-helpers.ts
hook-install.test.ts
hook-integrations.test.ts
hook-routing.test.ts
kimi-code-hook.test.ts
integration-metadata.test.ts
rule.test.ts
core/
analyze/
analyze-coverage.test.ts
edge-cases.test.ts
fail-closed-repair.test.ts
find.test.ts
parsing-helpers.test.ts
tmpdir.test.ts
audit.test.ts
config.test.ts
env.test.ts
format.test.ts
git/
git.test.ts
env.test.ts
worktree.test.ts
rulebook.test.ts
rules-custom-integration.test.ts
rules-custom.test.ts
rules-policy-recovery.test.ts
rules-rm.test.ts
dependencies.test.ts
helpers/
helpers.test.ts
helpers.ts
rulebook.ts
opencode/
builtin-commands.test.ts
plugin.test.ts
pi/
builtin-commands.test.ts
package.test.ts
tool-call.test.ts
scripts/
build-output.test.ts
ci-workflow.test.ts
generate-changelog.test.ts
publish-options.test.ts
subprocess-output.test.ts
tsconfig.build.json
tsconfig.json© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic
A PreToolUse hook that intercepts and blocks destructive git and filesystem commands before AI coding agents run them. CC Safety Net parses command semantics — so flag reordering, shell wrappers, and interpreter one-liners can't bypass it.
[!NOTE] Full documentation → — installation, configuration, reference, guides, and the security model live on the docs site.
We learned the hard way that instructions aren't enough to keep AI agents in check. After an agent silently wiped hours of progress with a single rm -rf ~/ or git checkout --, it became clear that soft rules in a CLAUDE.md or AGENTS.md file cannot replace hard technical constraints. CC Safety Net is that constraint: it intercepts every Bash tool call and blocks destructive commands before they reach the shell. See What Is CC Safety Net for the full background.
CC Safety Net works across seven coding agent CLIs: Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Kimi Code, OpenCode, and Pi. Each integration is documented at Architecture.
CC Safety Net runs on Windows, macOS, and Linux. It detects the host OS to apply correct behavior — case-insensitive path comparison on Windows, both / and \ path separators, and cmd.exe/PowerShell command resolution via COMSPEC/PATHEXT.
~/.codex/config.toml:[features]
plugin_hooks = true
codex plugin marketplace add kenryu42/cc-marketplace
/plugins.[cc-marketplace]./hooks and select the safety-net PreToolUse hook and press t to trust it./plugin marketplace add kenryu42/cc-marketplace
/plugin install safety-net@cc-marketplace
/reload-plugins
/plugin → Select Marketplaces → Choose cc-marketplace → Enable auto-updategemini extensions install https://github.com/kenryu42/gemini-safety-net
/plugin install kenryu42/copilot-safety-net
Install CC Safety Net into your Kimi Code config:
npx -y cc-safety-net hook install --kimi-code
Optional: run npx skill add kenryu42/cc-safety-net to add the /cc-safety-net skill for configuring custom rules.
Install CC Safety Net with OpenCode's native plugin command:
opencode plugin -g cc-safety-net
[!NOTE] OpenCode can sometimes keep using a stale cached plugin version. See anomalyco/opencode#25293 for the current tracking issue.
To force OpenCode to reinstall
cc-safety-net, remove its cached package and install the version you want:rm -rf ~/.cache/opencode/packages/cc-safety-net@latest opencode plugin -g -f cc-safety-net@latestIf you prefer pinning a specific version:
rm -rf ~/.cache/opencode/packages/cc-safety-net@latest opencode plugin -g -f cc-safety-net@<version>Restart OpenCode after updating so the plugin is loaded from the refreshed cache.
Install CC Safety Net with Pi's package installer:
pi install npm:cc-safety-net
| Capability | What it catches |
|---|---|
| Semantic command analysis | rm -rf on destructive targets, git reset --hard, git checkout --, git push --force, git stash clear, git clean -f, find -delete, dd/mkfs/shred — by intent, not string pattern. git checkout -b feature (safe) is allowed while git checkout -- file (destructive) is blocked. |
| Shell wrapper detection | Destructive commands hidden in bash -c, sh -c, and similar wrappers, recursively analyzed up to 10 levels deep. |
| Interpreter one-liners | Destructive code in python -c, node -e, ruby -e, perl -e one-liners (e.g. os.system("rm -rf /")). |
| Fail-closed by default | Malformed hook input, unparseable commands (in strict mode), invalid config, and broken rulebooks block rather than allow. |
| Custom rules via rulebooks | Add your own blocking rules at user or project scope, pinned by SHA-256 digest when fetched from GitHub. |
| Audit logging | Every blocked command logged to ~/.cc-safety-net/logs/<session_id>.jsonl with secrets auto-redacted. |
Full blocked/allowed command lists: Blocked Commands · Allowed Commands.
A workspace-writable sandbox still permits git reset --hard, git push --force, and rm -rf . inside the project directory, because the OS only sees writes to an allowed path. Sandboxing contains blast radius; CC Safety Net catches the destructive operations sandboxing permits — use both for defense-in-depth. See vs Sandboxing.
CC Safety Net has opt-in modes toggled by CC_SAFETY_NET_* environment variables (legacy SAFETY_NET_* names also accepted):
| Mode | Flag | Effect |
|---|---|---|
| Strict | CC_SAFETY_NET_STRICT=1 | Fail closed on unparseable commands, not just malformed input. |
| Paranoid | CC_SAFETY_NET_PARANOID=1 | Stricter checks; or use CC_SAFETY_NET_PARANOID_RM=1 (block rm -rf even within cwd) and CC_SAFETY_NET_PARANOID_INTERPRETERS=1 (block interpreter one-liners). |
| Worktree | CC_SAFETY_NET_WORKTREE=1 | Relax local git discards inside verified linked worktrees. |
See Modes and Environment.
# Verify your installation and run a self-test
npx cc-safety-net doctor
# Trace how a command is analyzed step-by-step
npx cc-safety-net explain "git reset --hard"
Both support --json for machine-readable output. Full reference: CLI Commands · Explain Trace.
[!WARNING] If you previously defined custom rules in a legacy inline config (
.safety-net.jsonor~/.cc-safety-net/config.json), those files are no longer loaded at runtime. Commands now fail closed (stay blocked) until you migrate. Runnpx -y cc-safety-net rule migrateto convert them to the rulebook layout. See the migration guide.
All details live on the docs site at ccsafetynet.com/docs:
| Area | Pages |
|---|---|
| Get started | Introduction · Installation · Quickstart |
| Configuration | Modes · Environment · Custom Rules · Status Line |
| Reference | Blocked Commands · Allowed Commands · Audit Log · CLI Commands · Explain Trace · Glossary |
| Guides | How It Works · Architecture · Analysis Engine · Design Principles · Security Model · vs Sandboxing · Known Limitations · Troubleshooting |
| Project | Contributing · Security Policy |
See CONTRIBUTING.md for details on how to contribute to this project.
MIT