Your sandbox thinks `git reset --hard` is harmless

What it does

cc-safety-net inspects every command an AI coding agent is about to execute and blocks the destructive ones — hard resets, force pushes, stash clears, rm -rf at the wrong altitude, and attempts to read sensitive files — before the tool call fires. It ships as a PreToolUse hook and claims support for over a dozen agents, from Claude Code and Codex to Cursor, Gemini CLI, Copilot CLI, and OpenCode. The author built it after Claude Code “silently wiped out hours of progress,” concluding that soft rules in CLAUDE.md cannot replace hard technical constraints.

The interesting bit

The core problem is that wildcard deny rules parse shell commands as strings, and shell commands are liars: flag reordering (rm -r -f /), double spaces, shell variables, and sh -c wrappers all slip past pattern matching. Safety Net does semantic analysis instead — recursively unwrapping shell wrappers five levels deep and catching interpreter one-liners like python -c 'os.system("rm -rf /")' — while letting safe variants through: git checkout -b feature passes, git checkout -- file doesn’t. The sharpest observation in the README: OS-level sandboxing sees git reset --hard as harmless because it only touches files in cwd. Technically true; you still just lost all uncommitted work.

Key highlights

• Runs before the permission system, so it stays effective even if your deny rules are misconfigured
• Distinguishes safe from dangerous variants of the same command instead of blocking by pattern
• Strict, Paranoid, and Worktree modes, plus secret redaction and audit logging
• Status line integration shows at a glance whether protection is actually active
• Experimental custom rules for extending the blocklist

Caveats

• The README is candid that this is application-level analysis of command strings — bypass resistance is lower than OS-level sandboxing
• No network protection at all; prompt-injection and exfiltration threats belong to the sandbox layer
• Custom rules are explicitly labeled experimental

Verdict

If you let agents loose in repos with uncommitted work, this is cheap insurance against known footguns. For untrusted code and prompt injection, sandboxing remains the stronger layer — the README’s own advice is to run both.