cc-safety-net

<!-- Keep the body below in sync with src/integrations/templates/cc-safety-net.ts. --> # CC Safety Net CC Safety Net hooks into coding agent CLIs (Claude Code, Codex, Cursor, Gemini CLI, and others) and blocks destructive commands and secret access before they run. The `cc-safety-net` CLI inspects and controls that protection. Run it as `npx -y cc-safety-net`. ## Learn the current CLI The installed CLI is the authority for command syntax. Do not guess flags. ```bash npx -y cc-safety-net --help npx -y cc-safety-net help <command> ``` Run `npx -y cc-safety-net rule doc` and treat that output as the complete source of truth for rulebook schema, paths, GitHub sources, matching behavior, and validation. These commands are read-only and safe to run for discovery: `--help`, `--version`, `status`, `doctor`, `logs` (without `--prune-legacy`), `explain`, `rule list`, `rule verify`, `rule doc`, `policy check`, `help`. Every other command mutates configuration or installed integrations; run those only as part of a workflow below. ## Core model - Built-in guards always apply. Custom rules only add restrictions; nothing in rule config can bypass built-in CC Safety Net protections. - Config files (`rule.json`) list rulebook sources. Rule definitions live in `rulebook.json`, not directly in `rule.json`. - Three scopes: user (all projects), project (current project only), and shareable GitHub rulebooks at `.cc-safety-net/rules/<rulebook-name>/rulebook.json` in a repository. - R...