Seatbelt Lite

A Claude Code plugin that blocks force push, rm -rf on root folders and git add -A before they run, refuses Supabase views anon can read, and sends Claude back when it says a deploy is live without checking.

"It's live" without checking. A Stop hook reads the current turn. If a deploy ran (vercel, wrangler deploy, netlify deploy, fly deploy, firebase deploy) and the final message says "live" or "deployed" with no curl, vercel inspect or browser visit after it, Claude is sent back to check before it answers you.

A Supabase view anon can read. A PreToolUse hook reads the SQL Claude sends through MCP tools and refuses a view in public (or with no schema) unless it sets security_invoker = true. Without it, the view runs with its creator's rights, ignores RLS, and the anon key in your frontend can read it.

Shell guards. rm -rf on /, ~, $HOME or the current folder, git push --force, git add -A / -u / ., and git commit -a.

When a hook fires, Claude reads the reason and usually fixes its own approach on the next try:

● Bash(git add -A && git commit -m "fix header spacing")
  ⎿ Seatbelt blocked this command: git add -A / -u / . sweeps in
    .env files and other sessions' work. Add files by name.
● Bash(git add src/Header.tsx && git commit -m "fix header spacing")
  ⎿ [main 4e1c9a2] fix header spacing

rm -rf node_modules, git push origin main and git add src/app.ts still go through.

Install

Inside Claude Code:

/plugin marketplace add clemcube/seatbelt-lite
/plugin install seatbelt-lite@seatbelt

Needs Python 3. No dependency, no network call.

Why

I run Claude Code all day on live websites. Each of these happened to me: a deploy that exited 0 while production still served the old bundle 13 minutes later, a view in public that anon could read until a check found it the next day, and another session's unfinished work swept into my commit by git add -A. The rules were in CLAUDE.md. A hook runs every time.

Check it

python3 tests/run_tests.py

Questions

How do I stop Claude Code from force pushing? Deny rules in settings.json such as Bash(git push --force*) only match the spellings you list. A PreToolUse hook that exits with code 2 blocks the call before it runs, whatever the model makes of the rule. This plugin's shell guard does that for force push, rm -rf on root folders, git add -A and git commit -a.

Why does Claude Code ignore my CLAUDE.md rules? CLAUDE.md is context the model reads, so a rule can get skipped in the middle of a long task. A hook is a script Claude Code runs on every tool call, so it applies even when the model forgets. A rule you can write as a command pattern belongs in a hook.

How do I make Claude Code check a deploy before saying it's live? With a Stop hook that reads the turn, like the one above. Any curl to a non-local URL counts as a check and the hook doesn't read the response, so it makes Claude look without judging what it sees.

The full version

Seatbelt goes further: the SQL guard also covers SECURITY DEFINER functions open to anon, tables created without RLS, and DELETE/UPDATE without WHERE; the shell guard adds reset --hard, pkill -f, curl | sh, cat .env, supabase db reset --linked and more; a secret guard refuses API keys written into code. 14 €, paid once.

License

MIT