safety-net

Once you hand the terminal to a coding agent, a single rm -rf / or git push --force can wipe out days of work in an instant. A sandbox stops file escapes, but it cannot stop the agent from "legitimately" invoking git reset --hard to discard the entire working tree, or rm -rf to delete untracked files in the workspace. What you need is not a cage—it is a confirmation gate that fires the instant an irreversible operation is about to land.
safety-net (Barricade) is that gate. It ships its own POSIX lexer for semantic-level command parsing rather than naive string matching, so wrappers like bash -c "rm -rf /", sudo, eval nesting, and command substitution $(…) cannot slip through. Forty-one built-in rules cover thirteen dangerous git forms (with long-flag prefix and short-flag unbinding support), rm tiered by target scope (root/home/.git = fatal, outside workspace or dynamic targets = high, inside workspace = medium), dd/mkfs/shred, fork bombs, curl|sh, interpreter-embedded deletion, and more. Three security levels—relaxed, balanced (default), and vigilant—map severity to deny/ask/allow actions layer by layer; fatal rules can never be downgraded. On a TTY, a hit triggers an interactive prompt showing the exact command and matched rules, where you choose to run once, deny, allow for this session, or allow permanently (written to policy); non-TTY environments always fail safe. All interception and confirmation records are persisted as JSONL for audit, with secret-like content automatically redacted. The plugin has zero runtime dependencies, is pure Node.js ESM, and its verdict core is fully harness-agnostic—pluggable via a dsh in-process plugin, a stdin-hook JSON contract, or a gate shell wrapper, and reusable as a plain function in any Node host.
If you are letting an AI coding agent drive the shell and do not want to pay for that capability with a blanket ban on command execution, safety-net is a lightweight, auditable confirmation guardrail that does not sandbox and does not strip privileges. It does exactly one thing: hands the final decision back to you, right before an irreversible operation runs.