diff --git a/zsh/.zshrc b/zsh/.zshrc
index 5a6d3cb..a581eba 100644
--- a/zsh/.zshrc
+++ b/zsh/.zshrc
@@ -28,9 +28,14 @@ if (( $+commands[go] )); then
 fi
 
 # Use safe wrappers after ~/.local/bin has been added to PATH.
-(( $+commands[safecp] )) && alias cp=safecp
-(( $+commands[safemv] )) && alias mv=safemv
-(( $+commands[safescp] )) && alias scp=safescp
+# Agent shells: </dev/null makes the prompt decline (exit 1) instead of blocking.
+if [[ -n ${CLAUDECODE:-} || -n ${CODEX_SHELL:-} ]]; then
+    _safe_redir=' </dev/null'
+fi
+(( $+commands[safecp] )) && alias cp="safecp${_safe_redir:-}"
+(( $+commands[safemv] )) && alias mv="safemv${_safe_redir:-}"
+(( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}"
+unset _safe_redir
 
 if [[ -f ~/.ssh/sudo_key ]]; then
     [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null