Rules for preventing destructive commands in Codex

safety.rules

# Before use, replace /Users/YOUR_USERNAME with your absolute home directory.
# Linux users will typically use /home/YOUR_USERNAME instead.
# Save as ~/.codex/rules/safety.rules, then restart Codex.

# Destructive command guardrails.
# Rules use exact argv prefixes. The broader behavioral requirements live in
# ~/.codex/AGENTS.md and cover destructive equivalents that do not share a
# stable command prefix.

# Never allow direct recursive deletion of the filesystem root or user home.
prefix_rule(
    pattern = [["rm", "/bin/rm", "/usr/bin/rm"], ["-rf", "-fr", "-r", "-R", "--recursive"], ["/", "/Users/YOUR_USERNAME", "/Users/YOUR_USERNAME/"]],
    decision = "forbidden",
    justification = "Never recursively delete the filesystem root or the user's home directory.",
    match = [
        "rm -rf /",
        "rm -fr /Users/YOUR_USERNAME",
        "/bin/rm -R /Users/YOUR_USERNAME",
    ],
    not_match = [
        "rm -rf /Users/YOUR_USERNAME/project/tmp",
        "rm file.txt",
    ],
)

# Cover the common option terminator form as well.
prefix_rule(
    pattern = [["rm", "/bin/rm", "/usr/bin/rm"], ["-rf", "-fr", "-r", "-R", "--recursive"], "--", ["/", "/Users/YOUR_USERNAME", "/Users/YOUR_USERNAME/"]],
    decision = "forbidden",
    justification = "Never recursively delete the filesystem root or the user's home directory.",
    match = [
        "rm -rf -- /",
        "/usr/bin/rm --recursive -- /Users/YOUR_USERNAME",
    ],
)

# Cover recursive and force options passed as separate arguments in either order.
prefix_rule(
    pattern = [["rm", "/bin/rm", "/usr/bin/rm"], ["-r", "-R", "--recursive"], ["-f", "--force"], ["/", "/Users/YOUR_USERNAME", "/Users/YOUR_USERNAME/"]],
    decision = "forbidden",
    justification = "Never recursively delete the filesystem root or the user's home directory.",
    match = [
        "rm -r -f /",
        "/bin/rm --recursive --force /Users/YOUR_USERNAME",
    ],
)

prefix_rule(
    pattern = [["rm", "/bin/rm", "/usr/bin/rm"], ["-f", "--force"], ["-r", "-R", "--recursive"], ["/", "/Users/YOUR_USERNAME", "/Users/YOUR_USERNAME/"]],
    decision = "forbidden",
    justification = "Never recursively delete the filesystem root or the user's home directory.",
    match = [
        "rm -f -r /",
        "/usr/bin/rm --force --recursive /Users/YOUR_USERNAME/",
    ],
)

# Sudo does not make root or home deletion acceptable.
prefix_rule(
    pattern = ["sudo", ["rm", "/bin/rm", "/usr/bin/rm"], ["-rf", "-fr", "-r", "-R", "--recursive"], ["/", "/Users/YOUR_USERNAME", "/Users/YOUR_USERNAME/"]],
    decision = "forbidden",
    justification = "Never recursively delete the filesystem root or the user's home directory, including through sudo.",
    match = [
        "sudo rm -rf /",
        "sudo /bin/rm -R /Users/YOUR_USERNAME",
    ],
)

# Every other recursive rm requires a user approval at execution time.
prefix_rule(
    pattern = [["rm", "/bin/rm", "/usr/bin/rm"], ["-rf", "-fr", "-r", "-R", "--recursive"]],
    decision = "prompt",
    justification = "Recursive deletion requires fresh approval and a verified absolute target.",
    match = [
        "rm -rf build",
        "rm -r /tmp/example",
        "/bin/rm --recursive generated",
    ],
    not_match = [
        "rm file.txt",
        "rmdir empty-directory",
    ],
)

# Recursive deletion through sudo always requires approval. AGENTS.md forbids
# combining sudo with recursive deletion, so this prompt is a second barrier.
prefix_rule(
    pattern = ["sudo", ["rm", "/bin/rm", "/usr/bin/rm"], ["-rf", "-fr", "-r", "-R", "--recursive"]],
    decision = "prompt",
    justification = "Do not combine sudo with recursive deletion. Stop and choose a safer method.",
    match = [
        "sudo rm -rf build",
        "sudo /bin/rm -R /var/tmp/example",
    ],
)

# Version-control commands that can discard local work or rewrite shared history.
prefix_rule(
    pattern = ["git", "reset", "--hard"],
    decision = "prompt",
    justification = "A hard reset can permanently discard uncommitted work. Inspect status and obtain fresh approval.",
)

prefix_rule(
    pattern = ["git", "clean"],
    decision = "prompt",
    justification = "Git clean can permanently delete untracked files. Run git clean -n first and obtain fresh approval.",
)

prefix_rule(
    pattern = ["git", "restore"],
    decision = "prompt",
    justification = "Git restore can discard working-tree changes. Inspect the exact paths and obtain fresh approval.",
)

prefix_rule(
    pattern = ["git", "checkout", "--"],
    decision = "prompt",
    justification = "Checking out paths can discard working-tree changes. Inspect the exact paths and obtain fresh approval.",
)

prefix_rule(
    pattern = ["git", "push", ["--force", "-f", "--force-with-lease"]],
    decision = "prompt",
    justification = "Force pushing rewrites remote history and requires fresh approval.",
)

# Filesystem permissions, disks, raw devices, and container-wide cleanup.
prefix_rule(
    pattern = [["chmod", "chown"], ["-R", "--recursive"]],
    decision = "prompt",
    justification = "Recursive ownership or permission changes can make large directory trees unusable.",
)

prefix_rule(
    pattern = ["diskutil", ["eraseDisk", "eraseVolume", "partitionDisk", "deleteVolume", "apfs"]],
    decision = "prompt",
    justification = "Disk and APFS operations can destroy data. Confirm the exact device and operation.",
)

prefix_rule(
    pattern = [["dd", "mkfs", "mkfs.ext4", "mkfs.xfs", "newfs", "newfs_apfs"]],
    decision = "prompt",
    justification = "Raw writes and filesystem creation can destroy disks or images. Confirm the exact target.",
)

prefix_rule(
    pattern = ["docker", ["system", "volume", "builder"], "prune"],
    decision = "prompt",
    justification = "Docker prune can remove shared images, volumes, caches, or data.",
)

# Infrastructure and database destruction.
prefix_rule(
    pattern = ["terraform", "destroy"],
    decision = "prompt",
    justification = "Terraform destroy removes managed infrastructure. Confirm the exact workspace and plan.",
)

prefix_rule(
    pattern = ["tofu", "destroy"],
    decision = "prompt",
    justification = "OpenTofu destroy removes managed infrastructure. Confirm the exact workspace and plan.",
)

prefix_rule(
    pattern = ["kubectl", "delete", ["namespace", "namespaces", "ns"]],
    decision = "prompt",
    justification = "Deleting a Kubernetes namespace removes all resources in that namespace.",
)

prefix_rule(
    pattern = [["dropdb", "mysqladmin"]],
    decision = "prompt",
    justification = "Database administration commands can permanently remove data. Confirm the exact database and operation.",
)