Seatbelt

Seatbelt

A seatbelt doesn't limit how fast you drive. It's what lets you drive fast at all.

This skill writes a per-person permission policy for the current repo so Claude can be given more autonomy, not less. It is the collection's only mutating skill — everything else here is read-only. For a read-only report on this repo's AI setup, use /context-audit instead; this skill deliberately has no dry-run mode, because that would just be /context-audit again.

What it honestly does: stops Claude over-reaching. What it does not do: stop a person who dismantles their own setup. Say this to the user; never let them believe otherwise.

Explicit invocation only (disable-model-invocation: true). Never offer or auto-run this because a user sounded worried, said Claude broke something, or challenged a change. A developer with their own permission setup would find an uninvited rewrite of it worse than the problem they were complaining about. It runs when someone types /seatbelt, and not otherwise.

Quick start

/seatbelt              # asks which mode, then sets up
/seatbelt --developer  # skip the question
/seatbelt --vibe       # skip the question
/seatbelt --allow "npm run deploy:staging"   # add one override
/seatbelt --uninstall  # remove exactly what the manifest records

--developer and --vibe together is an error, not a silent pick. --uninstall beats mode flags. With no TTY and no mode flag (headless, or running as a subagent), print what you would have asked and exit non-zero — never guess a mode.

Workflow

1. Ask the mode first

Before any grounding. A wall of stack-detection output is the worst possible first screen for a non-technical user, and the question costs nothing to ask early.

Frame by consequence, not identity. "I know what a PR is" biases everyone toward the mode with no brakes, because everyone wants fewer prompts. Use AskUserQuestion with:

• Let Claude move fast — it can push, merge and deploy on its own. Pick this if you can read a diff and undo a bad merge.
• Keep a human in the loop — Claude writes code freely, but anything permanent (merging, deploying, deleting) waits for you.

If you already know the repo has CI, a committed lockfile, or several contributors in git log, pre-select the matching default and ask them to confirm it rather than choose cold.

2. Ground

Read before deciding anything. Reuse /context-audit's read list rather than restating it (CLAUDE.md at every level, settings at every scope, .claude/agents/, project memory), then add:

git rev-parse --git-common-dir          # worktrees: .git/hooks/** is NOT where you think
git config --get core.hooksPath         # relocatable; deny the resolved path
git symbolic-ref refs/remotes/origin/HEAD
command -v gh node; gh auth status
cat .gitignore

Also enumerate connected MCP servers (.mcp.json, ~/.claude.json, claude mcp list) and the repo's manifests for a deploy-shaped script. Compute the effective policy across all four settings scopes — a pre-existing user-scope deny, or a settings.local.json carrying defaultMode: bypassPermissions, silently defeats whatever you write, and the user will blame this skill. Report the effective result, not the written one.

Render the summary at the audience's reading level. In vibe mode that is at most: "This looks like a Next.js site. I found your test command. You have no safety rules set up yet."

3. Write

Everything goes in .claude/settings.local.json — gitignored, personal. One repo can hold both a developer and a non-technical builder, so the policy belongs to the person, not the project.

Non-negotiables, each one a verified footgun. Full detail in REFERENCE.md:

• Verify .claude/settings.local.json is gitignored and add the entry if missing. This is mechanical, not tidiness: a settings.local.json a repository could have supplied goes through the workspace-trust dialog; a personal one does not.
• Never rewrite an existing .claude/settings.json. Read it, fold it into the effective policy, and only propose additions as a diff the user approves.
• Never emit Write(path), NotebookEdit(path) or Glob(path) rules. They are accepted and never matched — a silent no-op that would make your final report claim protection that does not exist. Use Edit(path) and Read(path), relative-anchored (Read(./.env*)), never absolute.
• MCP matchers need a trailing .*. mcp__github matches nothing; mcp__github__.* matches the server. The irreversible acts vibe mode exists to prevent are often one MCP call away and touch neither Bash nor gh.
• Copy assets/guard.mjs, never generate it. It is tested code. Register it in settings.local.json in exec form with a scoped matcher, an if filter and a timeout.
• Write the manifest .claude/seatbelt.manifest.json before finishing, or --uninstall cannot tell your rules from the user's.

4. Report and verify

Print the three-column table — runs freely / asks first / never — and persist it into the CLAUDE.md block so it survives the session. Vibe mode drops the middle column.

Verify by running node .claude/assets/guard.test.mjs. Never probe with a live destructive command: the case the test exists to catch is the case where the command succeeds.

Modes

Developer mode carries no ask band on purpose. Enumerating an allowlist always misses the tail (git stash, rg, jq, one-off scripts), so the developer gets interrupted anyway and flips to bypass — the exact failure this skill exists to prevent.

Rules that matter

• The reversibility test. If undoing it needs an expert or a support ticket, block it. This generalises to tools that don't exist yet, which is the only way the policy survives contact with next month's CLI.
• Every denial carries a next action. Denial messages are this skill's entire runtime surface. Problem, cause, what Claude will do instead, what the human does now, how to permit it. Templates per mode in REFERENCE.md.
• Protect mechanism, not policy. guard.mjs and seatbelt.policy.json are self-protected; seatbelt.local.json is not. Without that split, --uninstall is blocked by the thing it uninstalls.
• Never write remote state. Print the branch-protection click-path and the revert command beside it. An agent enabling branch protection can strand a solo developer with no reviewer.
• Show the resolved script body before allowlisting it. A "deploy": "vercel --prod" in package.json must never be laundered into an allow rule via Bash(npm run deploy).

Rule sets, denial templates, the report format, error paths and click-paths: REFERENCE.md.