Before your AI touches the terminal

A simple way to decide which coding agent commands can run, which need a safe copy, and which should never touch your machine.

What changed A coding assistant used to feel like better autocomplete. You asked for a component, it wrote some code, and you decided what happened next. Coding agents are different. They can open your terminal, run commands, install packages, change files, create database migrations, and keep working while you do something else. The terminal is simply the place where commands such as npm install , pnpm test , and git status run. You may already use it through Cursor, Claude Code, Codex, or another coding tool without thinking about every command underneath. Anthropic says Claude Code's auto mode will become the default for new Pro, Max, and Team sessions starting August 14. In auto mode, a built-in checker reviews each action instead of asking you to approve every routine command. That can save a lot of clicking. It also makes one question more important: what should happen before an AI command reaches your machine? Why the approval popup is not enough Imagine asking an agent to add login to your app. It may install a package, edit your environment settings, create a database migration, and run a setup script. The first popup might show npm install . That looks normal, so you approve it. The next ten commands also look normal, so you keep approving. The dangerous command rarely looks like a movie villain. It may be a familiar package script whose contents changed earlier. It may be a Python command that deletes a folder. It may connect to an unexpected website or read a secret from your .env file. The command name alone does not tell you the full story. A Scalex browser game tested this exact attention problem. Across more than 40,000 timed runs, players missed about one in three threats. This was a game with artificial time pressure and far more dangerous commands than ordinary coding, so it is not a real-world failure rate. The useful lesson is simpler: repeated approval prompts train people to click, not to investigate. If every command needs your approval, you eventually stop making a real decision. The simple setup I want I want a small checker between the coding agent and the terminal. The agent can suggest any command it wants. The checker decides what happens next using rules I wrote before the session started. Run normally: familiar read-only work such as git status , git diff , and project tests. Run in a safe copy: package installs, generated files, and database migrations that may change the project. Stop: destructive commands, production access, secret files, or anything outside the project folder. A safe copy is just a disposable duplicate of the project. The agent can try the risky step there first. If the result is useful, I can bring the changes back. If it breaks something, I throw the copy away and my real project stays untouched. This is the whole idea. The human does not inspect 100 tiny commands. The system handles the obvious cases, blocks the obvious dangers, and asks the human only when context actually matters. What the checker looks at A useful checker needs more than the first word of a command. It should inspect the action around that command: Where is it running? Inside the current project or somewhere else on the computer? What can it change? Source code, packages, migrations, secrets, or files outside the project? Does it use the internet? Which website or service will receive data? Does it have credentials? Can it reach production, billing, email, or a client system? Can the result be undone? Is there a clean diff, backup, or disposable copy? I would keep these rules in a boring text file, not ask another AI model to decide everything. If the same AI proposes the command and judges whether it is safe, the control is weaker than it looks. Simple rules are easier to read, test, and change. RUN git status git diff pnpm test SAFE COPY npm install create a migration STOP sudo rm -rf read .env write outside this project One command can hide another Blocking rm -rf is not enough. An agent can delete files through Python or Node without ever typing rm . An innocent-looking npm run command can execute whatever is currently written inside package.json . This does not mean the agent is malicious. It means commands are wrappers around other actions. For a vibe coder, the practical rule is straightforward: do not give an agent unlimited Python, Node, package-manager, network, or production access just because those tools are common. Allow the exact tasks your project needs. Send everything else to a safe copy or ask for review. The checker should also show the consequence, not only the command. “This changes two migration files and uses a local test database” is a decision you can understand. “Approve python manage.py migrate ?” asks you to guess. What I would set up first Keep the agent inside one project folder. Remove production passwords and API keys from the session. Allow read-only commands and tests that you use every day. Run installs, code generation, and migrations in a disposable copy. Stop destructive commands and anything that reads secrets or leaves the project. Save a short record of every command, result, and changed file. You do not need to build a security platform before using a coding agent. Start with a small list of commands that are clearly safe, clearly risky, and clearly forbidden. Tighten the list when the agent surprises you. Claude Code's auto mode already includes its own classifier and hard-deny rules. The broader lesson applies to every coding agent: speed should come from better defaults, not from giving the tool unlimited access and hoping you notice the dangerous line. The goal is not to approve faster. The goal is to need fewer approvals. Which command would make you nervous if your coding agent ran it without asking?

Harshith Vaddiparthy works with founders, operators, and teams on practical AI products, workflows, advisory, training, and mentorship. This no-JavaScript version preserves the page's core information and navigation.