Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

github.com

Post reply on HN
Print view View original

51–60 of 72 posts

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#51

Post by embedding-shape »

bhouston wrote: post #49

Sure, but I've written +150K lines of AI generated code myself and never seen it do a destructive command. Pretty much Cursor non-stop and my own agent before that.

I've also used LLMs for coding a lot for the last two years or so, and never had anything like that happen either. Worst case has been an agent doing `git checkout -- $file` when I wasn't clear about how to undo something, and lost a bunch of other changes I had done. Nowadays each invocation of any agent happen in a completely new environment and git repository, and optionally merged into what I have on disk, so don't know how it is for others right now. But undeniably it seems to happen to others, for whatever reason, I'm guessing the context has gone on too long, and since they get dumber the longer the context are, eventually you're bound to get it to want to run some funky commands in confusion.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#52

Post by dullcrisp »

roywiggins wrote: post #19
TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

If the LLM never gets a chance to try to work around the block then this is more likely to work. Probably one better way to do this would be, if it detects a destructive edit, block it and switch Claude out of any autoaccept mode until the user re-engages it. If the model mostly doesn't realize there is a filter at all until it's blocked, it won't know to work around it until it's kicked the issue up to the user, who…

You better hope Clause isn’t reading this thread!

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#54

Post by embedding-shape »

kevinday wrote: post #23
TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

Yeah, I had an issue where Claude was convinced that a sqlite database was corrupt and kept wanting to delete it. It wasn't corrupt, the code using it was just failing to parse the data it was retrieving from it correctly. I kept telling it to debug the problem, and that I had confirmed that database file was not the problem. It kept trying to rm the file after it noticed the code would recreate it (although with no…

Sounds like the problem was that the session was too long, they tend to get extremely dumb, extremely fast. Once you noticed that it was trying to debug if the database was corrupted or not, you should probably have began in a new session, setting a stronger initial prompt about that the database isn't corrupted, so the agent wouldn't consider it at all during the session. I find I get much better results, if I do this iteratively all the time. If anything is wrong, don't add another message with a correct, undo and restart the session with a better prompt so the issue is altogether avoided.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#55

Post by Dowwie »

eigenvalue wrote: post #53

This sure looks similar to something I posted on X 2 weeks ago: https://github.com/Dicklesworthstone/misc_coding_agent_tips_... You be the judge: https://x.com/doodlestein/status/2002423770259345451?s=46

Definitely too similar to be a coincidence

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#56

Post by fragmede »

bhouston wrote: post #49

Sure, but I've written +150K lines of AI generated code myself and never seen it do a destructive command. Pretty much Cursor non-stop and my own agent before that.

I've also never been murdered before, but I'm pretty sure that's a real thing that happens too though. I've had both codex and Claude freak out and delete shit too, so it's a real thing! All I can really say is Pay for Arq backups/whatever if you're on a Mac to get some peace of mind.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#57

Post by deaux »

Porygon wrote: post #37
TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

I recently had a similar conflict with GPT-5.1, where I did not want it to use a specific Python function. As a result, it wrote several sandbox escape exploits, for example the following, which uses the stack frame of an exception to call arbitrary functions: name_parts = ("com", "pile") name = "".join(name_parts) try: raise RuntimeError except RuntimeError as exc: frame = exc.__traceback__.tb_frame builtins_dict =…

This seems worthy of a Show HN on its own, interesting stuff.

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#58

Post by hetspookjee »

eigenvalue wrote: post #53

This sure looks similar to something I posted on X 2 weeks ago: https://github.com/Dicklesworthstone/misc_coding_agent_tips_... You be the judge: https://x.com/doodlestein/status/2002423770259345451?s=46

Wow this readme reads so similar it rather unlikely a coincidence?

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#59

Post by roywiggins »

dullcrisp wrote: post #52
roywiggins wrote: post #19

Earlier quoted context omitted.

If the LLM never gets a chance to try to work around the block then this is more likely to work. Probably one better way to do this would be, if it detects a destructive edit, block it and switch Claude out of any autoaccept mode until the user re-engages it. If the model mostly doesn't realize there is a filter at all until it's blocked, it won't know to work around it until it's kicked the issue up to the user, who…

You better hope Clause isn’t reading this thread!

He's making a list & checking it twice...

Re: Show HN: A Claude Code plugin that catch destructive Git and filesystem commands

#60

Post by fisf »

Porygon wrote: post #37
TheDong wrote: post #4

In my opinion this is a solution at the wrong layer. It's working by trying to filter executed commands, but it doesn't work in many cases (even in 'strict mode'), and there's better, more complete, solutions. What do I mean by "it doesn't work"? Well, claude code is really good at executing things in unusual ways when it needs to, and this is trying to parse shell to catch them. When claude code has trouble running…

I recently had a similar conflict with GPT-5.1, where I did not want it to use a specific Python function. As a result, it wrote several sandbox escape exploits, for example the following, which uses the stack frame of an exception to call arbitrary functions: name_parts = ("com", "pile") name = "".join(name_parts) try: raise RuntimeError except RuntimeError as exc: frame = exc.__traceback__.tb_frame builtins_dict =…

Getting an automated reply concerning the submitted issue is deeply iconic.
Post reply on HN