safe-mode skill

Safe Mode

Three levels of protection against destructive operations during AI coding sessions.

Note: These hooks are skill-scoped — they only activate when you invoke /safe-mode. The global permission-request.js hook in hooks.json provides always-on alerting for dangerous commands. Safe-mode adds opt-in blocking and directory restrictions on top of that.

Modes

Cautious Mode

/safe-mode cautious

Intercepts Bash commands before execution. Warns on dangerous patterns but does not block — the user decides.

Flagged patterns:

What happens: the hook returns a permission ask, so Claude Code shows you a prompt that names the pattern, for example Safe mode: rm with -r or -f. You approve or reject the command. This prompt appears even in auto mode.

Lockdown Mode

/safe-mode lockdown <path>

Restricts Edit and Write operations to a single directory tree. Prevents accidental changes to unrelated code.

How it works:

1. Set the allowed path (absolute or relative to repo root)
2. Every Edit/Write call checks if the target file is inside the allowed path
3. Operations outside the path are blocked with an explanation

LOCKDOWN ACTIVE: Edits restricted to src/api/

  Blocked: Edit to src/utils/helpers.ts
  Reason: File is outside the lockdown path (src/api/)

  To edit files outside the lockdown, run: /safe-mode clear

Use cases:

• Focused refactoring of one module without touching others
• Bug fix in a specific directory while tests run elsewhere
• Junior developer guardrail — scope the blast radius
• Code review session — only edit the files under review

Scope: Keyed to the project root. It stays set until /safe-mode clear, and only enforces in sessions where /safe-mode was invoked.

Clear

/safe-mode clear

Removes all restrictions for the current session. Both cautious warnings and lockdown restrictions are disabled.

SAFE MODE: All restrictions cleared for this session.

Implementation

Invoking this skill registers one PreToolUse hook for Bash|Edit|Write that runs scripts/safe-mode-guard.js. Skill hooks stay registered for the rest of the session. The guard does nothing until a mode is set.

Set the mode

When the user runs /safe-mode , run the guard's setter from the project root:

node "${CLAUDE_PLUGIN_ROOT}/scripts/safe-mode-guard.js" set cautious
node "${CLAUDE_PLUGIN_ROOT}/scripts/safe-mode-guard.js" set lockdown src/api/
node "${CLAUDE_PLUGIN_ROOT}/scripts/safe-mode-guard.js" set clear

Then report the line the setter prints.

Cautious (Bash)

The guard checks tool_input.command against a fixed list of destructive patterns: recursive or forced rm, DROP and TRUNCATE, force-push, hard reset, git clean -f, discarding all changes, chmod 777, piping curl or wget to a shell, disk-level writes, fork bombs, and sudo rm. A match returns permissionDecision: "ask" with the pattern as the reason. No match passes through.

Lockdown (Edit and Write)

The guard resolves toolinput.filepath against the project root, follows symlinks, and checks that it sits inside the lockdown path. Inside passes through. Outside exits 2, which blocks the edit and tells Claude why.

State

The mode lives in $TMPDIR/pro-workflow/safe-mode-.json, keyed by the project root, so two projects never share it:

{ "cautious": true, "lockdownPath": "/Users/dev/project/src/api", "root": "/Users/dev/project" }

set clear deletes the file. The file outlives the session, so clear it when you are done; a new session only enforces it again after /safe-mode is invoked, because the hook is skill-scoped.

Combining Modes

Cautious and lockdown can run simultaneously:

/safe-mode cautious
/safe-mode lockdown src/api/

Now you get:

• Bash command warnings for destructive operations
• Edit/Write restrictions to src/api/ only

Clear removes both.

When to Use

Anti-Patterns

• Leaving lockdown on when you need to edit tests (update the path or clear it)
• Using safe-mode as a substitute for git branches (branches protect history, safe-mode protects the session)
• Ignoring cautious warnings repeatedly (if you always proceed, turn it off — false confidence is worse)