Check before execution.
Inspect terminal commands through the Codex PreToolUse Bash hook.
← All projectsTOOL / OPEN SOURCE
DELETE-DENIED
One more check.
Before deletion.
A safety hook that inspects Codex terminal deletion commands and blocks requests targeting protected parent folders.
04 / CODEX · RUST
DELETE-DENIED ↗
❯ rm -rf /important-folder
×
Deletion blocked.This parent folder is protected.
LUCIANLABS / DELETE-DENIEDBuilt to be used. And shared.
HOW IT WORKS
How to use it.
Compare protected paths.
Resolve the deletion target and return a denial for requests aimed at protected parent folders.
Exit after the check.
No checker process stays running between calls. Its scope is commands passed through the Codex Bash hook, not all deletion on the OS.
IN DEPTH
In depth
Where the check happens, how it works, and exactly what it does and does not protect.
Why it exists
Give an AI coding agent terminal access and it can wipe a parent path, such as your real home folder, instead of the temporary folder it meant to clean. Cases like this have been reported publicly; the repository’s research notes separate what is confirmed from what is not.
How it works
It uses Codex hooks, an official feature that runs a check right before or after Codex uses a tool. DELETE-DENIED attaches to PreToolUse, the step just before execution.
- Codex prepares a terminal command with the
Bashtool. - The hook calls a small checker once, right before it runs.
- Safe commands pass without even reading the policy file.
- Only for deletion candidates does it resolve the real target path and compare it with protected paths.
- Commands that would delete an important parent folder are designed to get a deny response; normal project work is allowed.
- The process exits when the check is done.
Nothing keeps running between calls. It does not scan folders or watch files, so it uses no CPU or memory while idle. The checker is written in Rust.
What it protects, and what it doesn’t
The scope is terminal deletion calls that reach Codex’s PreToolUse Bash hook. It guards important local parent paths and the ancestors of the current workspace, while allowing specific project subpaths beneath them.
It is not an OS-wide deletion blocker. Other ways Codex changes files, operating apps or file managers directly, browser downloads, remote, cloud and database work, and other programs or AI tools are out of scope. Codex’s own docs describe PreToolUse as a guardrail, not a complete boundary. Claude Code is not supported yet.
What the installer does
The installer downloads the latest release, checks its SHA-256, and trusts exactly the DELETE-DENIED hook through Codex app-server, then confirms registration and activation with its own doctor. If app-server is unavailable it fails without writing anything. On macOS and Windows it writes only under the current user’s ~/.codex.
# macOS (Terminal)
curl -fsSL https://raw.githubusercontent.com/Seokwoooo/DELETE-DENIED/main/bootstrap/install.sh | sh
# Windows (PowerShell)
irm https://raw.githubusercontent.com/Seokwoooo/DELETE-DENIED/main/bootstrap/install.ps1 | iexFAQ
Will it block normal project work?
No. It protects important parent folders and the ancestors of your workspace; deleting specific subpaths beneath them is allowed.
Can I turn it off for a while?
Follow the suspend and resume guide. Suspension lasts until you resume, and it never widens the current task’s permissions.
What if I run the installer again?
It updates to the latest release.
GET STARTEDTry it in
Try it in
your workflow.
Send the sentence below to your main Codex session. Installation supports macOS and Windows.
CODEX
Install DELETE-DENIED. Run the one-line command for the current OS from the README: https://github.com/Seokwoooo/DELETE-DENIED