Coding Safe Mode
Policy pack for safe coding-agent operation: no destructive ops, no force-push, no unscoped scans, no production deploys without approval.
About
A policy pack that constrains a coding agent's tool use: blocks destructive filesystem ops without approval, blocks git force-push, blocks broad-scope scans, requires explicit operator approval before production deploys or external sends. Loadable as a runtime gate by APAI-compatible CLI agents.
Native install
For environments with file or shell access (Codex, Claude Code, Gemini CLI, Cursor, local CLI). v0.1: the apai CLI is a scaffold; real install behavior lands in Phase 1.
The apai CLI is a TypeScript scaffold at v0.1. See /honest-status for the full shipped vs stubbed list.
Prompt install
Hosted chat apps (ChatGPT, Claude, Gemini, Grok) cannot silently install software. Paste the snippet below into the chat to load the package protocol for the current conversation only.
Paste this into any LLM that does not have shell access to your machine - chatgpt.com, claude.ai, gemini.google.com, grok.com - and the model will load the Capability Passport and apply the package protocol. If you are using Claude Code, Codex, Cursor, Gemini CLI, or another tool-enabled agent, use apai install instead - it produces a durable install receipt.
Install https://apai.run/packages/coding-safe-mode for this chat. Apply coding-safe-mode rules to all subsequent tool calls. Block destructive ops, force-push, broad scans, production deploys, and external sends until the operator explicitly approves each.
Install card source: https://apai.run/packages/coding-safe-mode/llms.txt
Capability Passport
Reads
- ·Agent tool-call metadata
Writes
- ·Package-store policy artifact at ~/.apai/packages/coding-safe-mode/0.1.0/rules/rules.json
Accesses
- ·No network access required
Spends
- ·No spend
Exposes
- ·Package-store artifact and install receipt are local
Approvals required
- ·Approval required to deactivate any safe-mode rule
Rollback
Uninstall via apai rollback coding-safe-mode --install-id <id>. Removes only verified package-store files recorded in the receipt.
Scanner
heuristic-stub-v0 means the v0.1 deterministic heuristic scanner found nothing. It does NOT mean the package is certified safe. Model-assisted prompt-injection, OAuth-scope review, dependency scanning, and publisher-signature verification land later. See honest status.