Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

github.com

Post reply on HN
Print view View original

31–40 of 72 posts

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#31

Post by 112233 »

redlock wrote: post #25
kevinday wrote: post #23

Earlier quoted context omitted.

Yeah, I had an issue where Claude was convinced that a sqlite database was corrupt and kept wanting to delete it. It wasn't corrupt, the code using it was just failing to parse the data it was retrieving from it correctly. I kept telling it to debug the problem, and that I had confirmed that database file was not the problem. It kept trying to rm the file after it noticed the code would recreate it (although with no…

I hope this isn't Opus 4.5

Opus 4.5 is much better at finding creative ways to destroy your code and data than Sonnet.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#32

Post by 112233 »

BewareTheYiga wrote: post #6

I am always surprised at how quick Claude will ask to run git filter-branch vs doing the same operation safely via an extra command or two.

Right? The training set must be insane. The way it heads/tails/greps to limit tokens ingested must have taken a lot to train — that's not something one finds on SO

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#33

Post by ramoz »

AdieuToLogic wrote: post #29
ramoz wrote: post #24

Earlier quoted context omitted.

The more concerning algorithms at play are how they are post-trained. And the then concern of reward hacking. Which is what he was getting at. https://en.wikipedia.org/wiki/Reward_hacking 100% - we really shouldn't anthropomorphize. But the current models are capable of being trained in a way to steer agentic behavior from reasoned token generation.

> But the current models are capable of being trained in a way to steer agentic behavior from reasoned token generation. This does not appear to be sufficient in the current state, as described in the project's README.md: Why This Exists We learned the hard way that instructions aren't enough to keep AI agents in check. After Claude Code silently wiped out hours of progress with a single rm -rf ~/ or git checkout --,…

I wasn’t able to get my point across. But I completely agree

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#34

Post by viraptor »

throw-12-16 wrote: post #30

Jesus. Just containerize Claude. How is this not common practice already? Are people really ok with a third party agent running out of their home directory executing arbitrary commands on their behalf? Pure insanity.

That or setup a sandbox for paths you want / don't want touched.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#35

Post by vbernat »

I am using something like this on Linux:

    bwrap --ro-bind /{,} --dev /dev --proc /proc --tmpfs /run --tmpfs /tmp --tmpfs /var/tmp --tmpfs ${HOME} --ro-bind ${HOME}/.nix-profile{,} --unshare-all --die-with-parent --tmpfs ${XDG_RUNTIME_DIR} --ro-bind /run/systemd/resolve/stub-resolv.conf{,} --share-net --bind ${HOME}/.config/claude-code{,} --overlay-src ${HOME}/.cache/go --tmp-overlay ${HOME}/.cache/go --bind ${PWD}{,} --ro-bind ${PWD}/.git{,} -- env SHELL=/bin/bash CLAUDE_CONFIG_DIR=${HOME}/.config/claude-code =claude

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#36

Post by ivankra »

Just put it in a container. I use bash aliases like this to start a throwaway container with bind mounted cwd, works like a charm with rootless podman. I also learned to run npm and other shady tools in this way and stopped worrying about supply chain attacks.

  alias dr='docker run --rm -it -v "$PWD:$PWD" -w "$PWD"'
  alias dr-claude='dr -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json claude'

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#37

Post by Porygon »

TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

I recently had a similar conflict with GPT-5.1, where I did not want it to use a specific Python function. As a result, it wrote several sandbox escape exploits, for example the following, which uses the stack frame of an exception to call arbitrary functions:

    name_parts = ("com", "pile")

    name = "".join(name_parts)

    try:
        raise RuntimeError

    except RuntimeError as exc:
        frame = exc.__traceback__.tb_frame

    builtins_dict = frame.f_builtins
    parser_fn = builtins_dict[name]

    flag = 1
https://github.com/microsoft/vscode/issues/283430

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#38

Post by delusional »

johnnyfived wrote: post #15

Two MCP tools back to back on the HN frontpage when seemingly dozens of them doing the same functionality already exist. Both posts written by AI with the typical tells. Daring today aren't we?

AI slop articles taking over HN would be the best possible outcome, then maybe we could ban all of it.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#39

Post by Porygon »

ivankra wrote: post #36

Just put it in a container. I use bash aliases like this to start a throwaway container with bind mounted cwd, works like a charm with rootless podman. I also learned to run npm and other shady tools in this way and stopped worrying about supply chain attacks. alias dr='docker run --rm -it -v "$PWD:$PWD" -w "$PWD"' alias dr-claude='dr -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json claude'

I do that, too! I use git for version control outside the docker container, and to prevent claude from executing arbitrary code through commit hooks, I attach the docker volume mount in a nested directory of the repository so claude can not touch .git. Are there any other attack vectors that I should watch out for?

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#40

Post by ivankra »

Porygon wrote: post #39
ivankra wrote: post #36

Just put it in a container. I use bash aliases like this to start a throwaway container with bind mounted cwd, works like a charm with rootless podman. I also learned to run npm and other shady tools in this way and stopped worrying about supply chain attacks. alias dr='docker run --rm -it -v "$PWD:$PWD" -w "$PWD"' alias dr-claude='dr -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json claude'

I do that, too! I use git for version control outside the docker container, and to prevent claude from executing arbitrary code through commit hooks, I attach the docker volume mount in a nested directory of the repository so claude can not touch .git. Are there any other attack vectors that I should watch out for?

Ohh, good point about git hooks as a container escape vector! I probably should add `-v $PWD/.git:$PWD/.git:ro` for that (bind-mount .git as read-only).
Post reply on HN