From b0853dc5dd0d455d202607ee576c0a696e22ba99 Mon Sep 17 00:00:00 2001
From: Fabian Ising <fabian@murgi.de>
Date: Thu, 1 Oct 2026 10:42:54 +0200
Subject: [PATCH] [ZSH] No safe wrappers in CODEX/CODE shells

---
 zsh/.zshrc | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/zsh/.zshrc b/zsh/.zshrc
index 5a6d3cb..a581eba 100644
--- a/zsh/.zshrc
+++ b/zsh/.zshrc
@@ -28,9 +28,14 @@ if (( $+commands[go] )); then
 fi
 
 # Use safe wrappers after ~/.local/bin has been added to PATH.
-(( $+commands[safecp] )) && alias cp=safecp
-(( $+commands[safemv] )) && alias mv=safemv
-(( $+commands[safescp] )) && alias scp=safescp
+# Agent shells: </dev/null makes the prompt decline (exit 1) instead of blocking.
+if [[ -n ${CLAUDECODE:-} || -n ${CODEX_SHELL:-} ]]; then
+    _safe_redir=' </dev/null'
+fi
+(( $+commands[safecp] )) && alias cp="safecp${_safe_redir:-}"
+(( $+commands[safemv] )) && alias mv="safemv${_safe_redir:-}"
+(( $+commands[safescp] )) && alias scp="safescp${_safe_redir:-}"
+unset _safe_redir
 
 if [[ -f ~/.ssh/sudo_key ]]; then
     [[ -e /tmp/sudo-agent.sock ]] || ssh-agent -a /tmp/sudo-agent.sock &>/dev/null