blast-radius

blast-radius stops a risky shell command before it runs, works out what it would change, and waits for you to press Proceed or Cancel. Cancel refuses the call and Claude is told why, so it reports back instead of trying again.

It is one of the example mods Anthropic’s Claude Code DevRel team publishes in its claude-code-playground repo, at version 0.1.0 and shared as-is. As a mod to learn from, it shows how to hold a tool call until a person decides.

What it does

• rm with -r or -f: the files it would delete, with the count and total size. Globs and ~ are expanded, and the first 10 files are listed.
• git reset --hard: the files with staged or unstaged changes, plus the git diff --shortstat line.
• git checkout -- . and git restore .: the files with unstaged changes.
• git clean: the untracked paths it would remove, from a dry run with your flags.
• git push --force, -f, --force-with-lease or a +ref: the commits on the remote branch that your HEAD lacks, which the push would drop.
• Migrations (manage.py migrate, db:migrate, alembic upgrade, prisma migrate): the pending ones, from the tool’s own status command. Any other migrate is held with a note that it can’t list them.

Every other command runs as normal. When the line moves first, with cd dir &&, pushd, popd or git -C dir, it measures in that folder. In a terminal about 144 columns wide or more, the report opens in a side pane; narrower, it draws in the band above the prompt, as in the cover.

Install

Needs Claude Code 2.1.287 or later, plus bash, git, find and du on your PATH. To list pending migrations it also needs the project’s own tool, such as python3 manage.py.

git clone https://github.com/anthropics/claude-code-playground.git
cd claude-code-playground/claude-code/mods
claude plugin marketplace add ./
claude plugin install blast-radius@claude-code-playground-mods --scope user

The repo keeps its marketplace file in claude-code/mods, not at the root, so it is added by path from the clone. claude --plugin-dir ./blast-radius, run from the same folder, loads it for one session instead.

To see it work, ask Claude to run something destructive in a throwaway repo, such as rm -rf build. Press 1 for Proceed or 2 for Cancel, or click a button. Cancel has the focus when the pane opens, so Enter refuses the command. In the band, 1 and 2 work while the prompt is empty.

How it works

The mod hooks tool.call for the Bash tool only and reads the command text. To measure a risky one, it runs local programs through $.process.run, passing paths as arguments so nothing in them runs as shell:

• rm: a short bash script that expands the paths and globs without command substitution, then find to count and list files and du -k for the size.
• Resets and checkouts: git status --porcelain and git diff --shortstat.
• git clean: git clean -n with your flags, minus -f, -i and -q.
• Force pushes: git rev-parse and git log against your remote-tracking branch, as of your last fetch. It fetches nothing.
• Migrations: python3 manage.py showmigrations --plan, alembic history -r current:head, bin/rails db:migrate:status or npx --no-install prisma migrate status. These load your project’s code before you choose.
• A folder from cd is resolved with bash -c and pwd -P.

The mod makes no network calls of its own and writes nothing to disk. While it waits, the hook loops on sleep 0.25 through the same process call, because time spent inside a $ call doesn’t count against a hook’s 10-second budget.

What each outcome does:

• Proceed: a toast says it is running, and the whole command line runs as written.
• Cancel: the call is denied with the reason and a summary of what the command would have done, plus a request not to retry unless you ask.
• No answer in 10 minutes, an interrupted turn (Esc) or an error while holding: the same refusal.

One command is held at a time. A second risky call, from a subagent for example, waits until the first is answered.

Limitations

• It reads the command text without parsing shell fully. $(...), aliases, eval, bash -c "...", xargs rm, find -delete, scripts that call rm and wrappers such as timeout 5 rm or doas rm get through.
• Only the first risky part of a line is measured, but Proceed runs the whole line.
• It watches the Bash tool only. File edits and other tools are not held.
• The band above the prompt holds one mod at a time. If another mod draws there, such as token-weather or replay-theater from the same folder, the buttons may not show and the command is refused after 10 minutes. Use a wider terminal or turn the other mod off.
• Counts are approximate: a path matched twice counts twice, and sizes are disk usage to the nearest kilobyte. A very large tree takes a few seconds to measure.
• Without a fetch of the remote branch, it can’t list what a force push drops, and says so. With no remote named, it assumes origin.
• Some harmless commands are held too, such as a commit whose message contains ; rm -rf.
• The author ran rm -rf, git reset --hard and git clean -fdx in a live session. Force pushes and migrations were checked against the classifier only, and the fixes from a later review were tested with Node against a stand-in for Claude Code, not re-run live.
• The author documents it in the terminal only.
• It is a safety net, not a sandbox or a permission system. For a hard block, use permission rules.