cc-safety-net
编码代理 CLI 钩子——阻止破坏性命令和访问机密文件
插件会安装到这里；不确定时保持 web。
npx -y @deepseek-ai/dsh plugin --profile web add cc-safety-net@2.6.0Cc Safety Net 以 cc-safety-net 发布，当前版本为 2.6.0。Plugin Hub 会校验它的 manifest，并保存精确安装来源，便于复现安装结果。
CC Safety Net (Coding CLI Safety Net) blocks destructive commands and access to secrets such as SSH keys and .env files before the tool call runs. It parses what the command does. Wrapping the command or reordering flags does not hide it. A broken config file never blocks anything. It is not a sandbox: it does not contain processes, set filesystem permissions, or watch network egress.
[!NOTE] Full documentation → covers installation, configuration, reference material, guides, and the security model. This README is the short version.
CC Safety Net supports these coding agent CLIs on Windows, macOS, and Linux.
git reset --hard, git push --force, and rm -rf on dangerous targets, even inside bash -c or python -c. See Blocked Commands..env files, ~/.aws, and coding-CLI credentials, from the shell and from the agent's file tools. See Secret Protection.npx cc-safety-net gui to pick the Standard, Strict, or Paranoid preset and turn rules on or off. See Modes..cc-safety-net/ so clones and cloud sessions get the same rules. See Team Setup.checkCommand from Node.js without installing the hook. See Library API.You need Node.js 18 or higher. Install into the coding CLIs on this machine, then check that protection is working:
npx -y cc-safety-net@latest install
npx -y cc-safety-net@latest doctor
Update with npx -y cc-safety-net@latest update and uninstall with npx -y cc-safety-net uninstall. Keep the @latest qualifier: a bare cc-safety-net spec can run an older copy from the npx cache. Per-CLI requirements are in Installation.
See CONTRIBUTING.md to report a bug or request a feature.
MIT