Yes-Claude

Tired of "Prompt Fatigue" — clicking "Yes" constantly without reading until the next malicious web page slips an rm -rf past you? yes-claude is a permission plugin that ships four presets and a fully customizable config file, so safe calls run silently and only the dangerous ones interrupt. Single self-contained Node hook — no dependencies, no network, no telemetry, no LLM in the loop.

Ships four presets — allow-everything, allow-most, allow-cautious, ask — plus a heavily-commented TOML template for hand-tuned per-category allow/deny patterns.

A destructive-shell detector quarantines sudo / rm -r / chmod / pipe-to-shell / shutdown / fork-bombs into a separate category you can ask or deny independently; allow-everything requires explicit y/N before installation; project-local config overrides user-global so teams can pin a stricter policy per repo.

Platform: Claude Code only — does not run in Claude Cowork (Cowork does not currently support PreToolUse hooks). No extra dependencies. Node 18+ (already required by Claude Code).

---

Install (60 seconds)

# 1. Add this repo as a marketplace
/plugin marketplace add rahulr85r/yes-claude

# 2. Install the plugin
/plugin install yes-claude

# 3. Pick a preset and start with it
/yes-claude:perm-mode allow-most

# 4. Restart Claude Code (or open a new session) so the hook loads.

That's it. The hook registers at session start, so you need to restart Claude Code (or open a new session) once after /plugin install — after that, switching presets or editing the TOML is live on the next tool call (no restart needed).

---

Pick a preset

Four presets, ordered most-permissive to most-cautious:

Preset	What asks	What auto-allows
/yes-claude:perm-mode allow-everything	nothing — zero prompts	everything (including sudo, rm -rf /, force-push, pipe-to-shell)
/yes-claude:perm-mode allow-most	every Bash command (shell + shell_destructive)	file reads/edits, network, git (incl. force-push), subagents, MCP
/yes-claude:perm-mode allow-cautious	every Bash command and every web fetch	file reads/edits, git (incl. force-push), subagents, MCP
/yes-claude:perm-mode ask	everything	nothing

When to pick which:

• allow-everything — throwaway VMs and containers you can rebuild in 5 minutes. Not your laptop.
• allow-most — your normal dev box, when you want to see every shell command before it runs but trust Claude on file edits and web fetches.
• allow-cautious — like allow-most but you also want to see every URL Claude fetches.
• ask — shared machines, untrusted projects, learning what Claude actually does. Maximum oversight.

You can also run /yes-claude:perm-mode example to drop the heavily-commented template config in place and hand-edit from there.

---

Customize

Open your config in your editor:

/yes-claude:perm-edit

Lives at ~/.claude/yes-claude.toml (global). For a project-specific override, drop one at <project>/.claude/yes-claude.toml — the project file wins.

Skeleton:

default = "ask"          # allow | ask | deny

[categories.read_files]  # Read, Glob, Grep, NotebookRead, LS
mode = "allow"

[categories.edit_files]  # Edit, Write, NotebookEdit, MultiEdit
mode = "custom"
allow = ["~/Desktop/**", "~/projects/**"]
deny  = ["~/.ssh/**", "**/.env", "**/*.pem"]

[categories.shell]       # Bash, the non-git, non-destructive bucket
mode = "custom"
allow = ["npm *", "git *", "python *", "ls *", "cat *"]
deny  = ["sudo *", "* | sh", "* | bash"]

[categories.network]     # WebFetch, WebSearch
mode = "custom"
allow_domains = ["github.com", "*.anthropic.com", "npmjs.com"]

[categories.git_destructive]  # push --force, reset --hard, branch -D, ...
mode = "deny"

See config/permissions.example.toml for the fully-annotated version with every category and every option.

---

All categories

Category	What it covers
read_files	Read, Glob, Grep, NotebookRead, LS
edit_files	Edit, Write, NotebookEdit, MultiEdit
shell	Bash, default bucket (anything not classified below)
shell_destructive	sudo, rm -r*, chmod with mode, chown, mkfs, dd if=, pipe-to-shell (curl|sh, wget|sh), >/dev/sd*, shutdown/reboot/halt, fork bomb
network	WebFetch, WebSearch
git_safe	git status/log/diff/branch -l/show/blame, gh ... view/list, gh api
git_write	git commit/push/pull/fetch/merge/tag/stash/rebase, gh pr create, gh issue create, etc.
git_destructive	git push --force, git reset --hard, git branch -D, git clean -f, git checkout ., git restore .
subagents	Agent, Task
mcp	any mcp__* tool from an MCP server
scheduling	CronCreate, CronDelete, CronList, CronUpdate, ScheduleWakeup

For each category you set mode = "allow" | "ask" | "deny" | "custom". Only custom reads the allow / deny lists.

---

Pattern syntax

• Shell commands — glob, * matches any sequence. "git *" matches git status, git push -u origin main, etc.
• File paths — glob, ** matches any depth, * matches one path segment, ~ is expanded. "~/Desktop/**", "**/.env".
• Domains (only network.allow_domains) — exact or wildcard subdomain. "github.com", "*.github.com".

Inside a custom category, evaluation goes: deny → allow → fall back to the global default.

---

Inspect / debug

/yes-claude:perm-status

Shows which config file is active and a summary of the rules. Pass a sample command to dry-run the hook:

/yes-claude:perm-status "git push --force"
/yes-claude:perm-status "rm -rf /tmp/foo"
/yes-claude:perm-status "npm install"

The hook prints its decision and the rule that matched. Useful when you're not sure why something was (or wasn't) auto-allowed.

---

How it works

Claude Code fires a PreToolUse event before running any tool. This plugin registers a Node script that:

1. Reads your TOML config (project file → user file → bundled default).
2. Maps the tool call to one of the categories above.
3. Returns {"permissionDecision": "allow" | "ask" | "deny", ...} per the Claude Code hook spec.

No daemon, no LLM in the loop, no telemetry. The whole hook is one self-contained Node file with no npm install step.

---

Safety notes

• allow-everything has no safety net. No asks, no denies. sudo, rm -rf /, force-push, pipe-to-shell all run silently. A malicious tool result or fetched web page can take destructive actions. Only use on machines you can wipe in 5 minutes.
• On any other preset, the asks are your defense. Read each prompt before approving — that's the whole point of the ask category. If you're hitting "Yes to all" without reading, switch to allow-most so fewer prompts appear and you can actually pay attention to the ones that do.
• Project overrides ship in git. If you commit .claude/yes-claude.toml in a project, everyone who works on it sees that policy. Useful for "this repo should never auto-deploy". Don't put secrets in it.

---

Contributing

PRs welcome. The full contribution guide lives at CONTRIBUTING.md — fork, branch, test, PR. Run claude plugin validate and ./test/smoke.sh locally before opening a PR; CI runs the same checks.

Where to start: ROADMAP.md is the canonical list of contribution opportunities, organized by scope. Near-term picks include new destructive-shell detectors (xargs rm, find -delete, package uninstalls), stack-specific presets (Rails / Django / Go / Rust), and README translations.

Security issues: please don't file them publicly. See SECURITY.md for the reporting process.

Community: Discussions for open-ended questions; Issues for bugs and feature requests; Code of Conduct applies everywhere.

License: MIT.