launch-codes
Dangerous Bash commands need launch codes: red alert pane, siren, a code to arm and a LAUNCH to fire.
Hooks tool.call on Bash and classifies the command before it runs: risky rm -rf, git push --force, git reset --hard, DROP/TRUNCATE through a live SQL client, supabase db reset, vercel --prod, chmod -R 777, and downloaded scripts piped into a shell. A match opens a red-alert pane with a siren and a one-time code. Type the code to arm, press LAUNCH to fire. Anything else is denied and Claude is told why. /launch-codes test <command> shows the verdict without running anything.
It is strict. It blocked one of our own cleanup commands while we were putting this repo together, which is the point.
Install
In a Claude Code session (2.1.287 or later):
/plugin marketplace add OneWave-AI/claude-code-mods
/plugin install launch-codes@claude-code-mods
Or load this folder for one session: claude --plugin-dir ./launch-codes
What it reaches
| Mod | Network | Runs processes | Files | Calls a model | Sends data anywhere |
|---|---|---|---|---|---|
| launch-codes | No | No | No | No | No |
Run claude plugin validate ./launch-codes to list every event it hooks and every call it makes. See the repository README for the full security notes.
Part of claude-code-mods by OneWave AI. MIT licensed.