Repository navigation
First public release.
A seatbelt for coding agents: blocks the common download-and-run moves (a download piped into a shell or interpreter, running files from Downloads, installers and disk images, stripping the macOS quarantine flag) and anything macOS flagged as downloaded. Tracks files the agent downloads in a session and refuses to run them later.
- Claude Code plugin (tested live), Codex CLI (tested live), Grok (experimental).
- Asks in interactive Claude Code sessions, blocks in bypass and auto mode.
- Replay of 32,385 real agent commands: 1 legitimate command refused (a 111 KB heredoc, refused as too large to check).
Not a sandbox. See KNOWN-BYPASSES.md and THREAT-MODEL.md.