If this session was compacted, the copy of this skill in context may be cut off. Read ${CLAUDE_SKILL_DIR}/SKILL.md from disk and resume at the step you are on.

When to invoke

Use when touching prod, debugging live systems, or working in a shared environment. Use when asked to "be careful", "safety mode", "prod mode", or "careful mode".

/careful — Destructive Command Guardrails

Safety mode is now active. Every Bash and PowerShell command will be checked for destructive patterns before running. Most matches warn and are overridable; a small catastrophic set is blocked outright.

Where this is enforced. The checks run as a Claude Code PreToolUse hook. Cursor, Kiro and Codex install the same skill, but the hook is not guaranteed to run there; outside Claude Code /careful is instruction-only. On those hosts, tell the user that safety mode is advisory: you will stop and confirm before a command from the table below, but nothing intercepts it if you miss one.

Copilot CLI is the exception. When the configuration payload is installed (./install --with-config or --only=config), the user hook file ~/.copilot/hooks/vibestack.json (under $COPILOT_HOME when set) runs the same check on every Bash and PowerShell command and on every edit to a gate file (see Gate files below), so on Copilot CLI /careful is always on, in every session, whether or not it was invoked. Without the configuration payload it is instruction-only there as well.

Two tiers

This is a best-effort advisory stop, not a policy boundary: it reads the command as text and cannot out-parse a shell. To lift a HIGH deny, end the /careful session. There is no /uncareful, and /unfreeze does not turn safety mode off: start a new session.

What's protected

A plain terraform apply (it shows the plan and asks), terraform plan -destroy (read-only) and npm publish --dry-run pass, as do the quiet git forms: git checkout -- f / git restore f (one file), git restore --staged . (unstages only), git clean -n, git branch -d, git stash pop and git config --get core.hooksPath.

Commit messages

The warn tier reads git commit -m / -am / --message text as prose, so a message that says "drop table" or "rm -rf build" does not ask. The masking (bin/mask-commit-message.awk) gives up and leaves the command as written — so it is checked in full — when it cannot tell message from command: $(...), backticks, $'...', ${...} and $[...] (re-evaluation and arithmetic can run an escaped $(...)), any heredoc except the plain -m "$(cat <<'EOF' ... EOF)" form, an unterminated quote, a commit piped into another command (git commit -m 'rm -rf x' | sh runs the message), or a command over 16 KiB. A word starting with - is never masked, so a flag such as --no-verify stays visible even after a value-taking option like -F. The heredoc form is masked only when its body has no quotes, \, $ or # and its parens balance: bash 3.2 reads a stray ) there as the end of the substitution.

Known limit: the deny tier and the obfuscation tripwire keep reading the raw text, message included, so a message holding ${IFS} or a base64-to-shell example still asks.

Gate files

The hook also runs on Edit and Write. An edit to a file that gates the build asks: lint and format config (.eslintrc*, .stylelintrc*, .markdownlintrc*, eslint/prettier/stylelint/commitlint/oxlint .config.* including qualified names like eslint.config.base.mjs, biome.json, ruff.toml, .flake8, .golangci.yml, .pre-commit-config.yaml), ignore files (.eslintignore, .stylelintignore, .markdownlintignore, .semgrepignore, .gitleaksignore, .gitleaks.toml), git hook managers (.husky/*, lefthook.yml, .git/hooks/*), type-check config (tsconfig*.json, mypy.ini), test and coverage config (pytest.ini, codecov.yml), CI (.github/workflows/**/*.yml, .gitlab-ci.yml, Jenkinsfile) and migrations (migrations/, migrate/, db/migrate/, alembic/versions/). File names match in any case. The cheapest way past a failing check is to loosen the check, so the prompt asks you to confirm the edit tightens or keeps it. Creating a gate file that does not exist yet adds a check and passes — except an ignore file, which can only exempt files. Every other path passes. /guard runs the same check on Edit and Write alongside its edit boundary.

PowerShell and cmd (Windows)

The hook also checks the PowerShell tool (Claude Code's shell on Windows) and any pwsh/powershell/cmd launched from Bash on any OS. Matching ignores case, covers aliases in command position, accepts parameter prefixes (-r, -fo) and strips cmd ^ and PowerShell backtick escapes. Every warning is ask; the rows above apply there too.

String matching cannot see a command PowerShell builds at runtime. For a hard stop, add Claude Code permission deny rules, which parse PowerShell and its aliases — for example "deny": ["PowerShell(Remove-Item *)"] in .claude/settings.json. The hook itself runs through bash, so on Windows it needs Git Bash.

Safe exceptions (no warning)

• rm -rf node_modules / .next / dist / __pycache__ / .cache / build / .turbo / coverage

Project patterns (additive only)

A project usually has its own destructive commands — a make nuke-db, a seed script, a teardown target. Add warn rules for them, one POSIX ERE per line (blank lines and # comments ignored), in either file:

• ~/.vibestack/careful-patterns.txt — every repo
• ~/.vibestack/projects/<slug>/careful-patterns.txt — this repo only

Both are consulted after the built-in families, so a pattern file can only ADD a warning, never suppress a baseline one — a guard a project can silence is not a guard. A line whose regex grep cannot compile is reported on stderr ([careful] skipped unusable pattern in <file>:<line>) and skipped; the built-in families and the file's other lines stay active, so a typo never takes the hook down with it.

How it works

The hook parses the tool payload with a real JSON parser, checks the command against the patterns above, and returns a hookSpecificOutput envelope carrying permissionDecision (ask or deny) plus permissionDecisionReason. The decision must be nested under hookSpecificOutput — Claude Code ignores a top-level permissionDecision, and a hook that emits one silently no-ops.

Two edge rules, opposite by design:

• Unparseable payload → ask. careful is the ask tier, so an unreadable payload prompts rather than passes.
• Shell obfuscation → ask. ${IFS} word-splitting and base64-to-shell assemble a command the pattern checks never see, so the primitives themselves are the signal.

/freeze, the deny tier, fails closed on the same unreadable payload. Both hooks share one extractor (careful/bin/hook-extract.sh) so a parsing fix cannot land in one and miss the other.

Debug logging

Off unless VIBESTACK_DEBUG=1. Switched on, it appends every decision — with the full command text — to ~/.vibestack/hook.log (rotated at 1MB). Commands routinely carry API keys and tokens, so turn it on only where that file is an acceptable audit trail. The usage counter written alongside it records the decision and the pattern name, never the command.

To deactivate: end the conversation or start a new one. Hooks are session-scoped.