Your AI coding agent can nuke your repo with rm -rf or push straight to prod. New tool ai-setup forces it to ask first.
One shared policy across Claude Code + OpenCode:
• Commits, pushes, merges, deletes → approval required with risk label
• Reading SSH keys or cloud creds → hard block
• Claude Code gets OS-level sandbox on top
MIT license. macOS first.
README is honest about gaps:
• Can't catch commands inside scripts
• Can't see variable-built or base64-encoded commands
• Listed as known test failures
• This is a seatbelt, not a firewall
Installer rewrites your tool configs (backs up first). Read before you run.
Solid template for agent permissions. DYOR before installing.
One shared policy across Claude Code + OpenCode:
• Commits, pushes, merges, deletes → approval required with risk label
• Reading SSH keys or cloud creds → hard block
• Claude Code gets OS-level sandbox on top
MIT license. macOS first.
README is honest about gaps:
• Can't catch commands inside scripts
• Can't see variable-built or base64-encoded commands
• Listed as known test failures
• This is a seatbelt, not a firewall
Installer rewrites your tool configs (backs up first). Read before you run.
Solid template for agent permissions. DYOR before installing.