SafeShell Presentation

MINOR PROJECT  /  SEMESTER 7

SafeShell

Transactional Command Framework with AI-Generated Undo Plans and Simulation-Based Safety Guarantees

A safety layer that lives in your terminal.

Samarth Vala

23BCP422 | Div 7 | G13

Tavish Gupta

23BCP064 | Div 1 | G2

$ rm -rf ~/projects
SAFESHELL: BLOCKED
Deletes 4,312 files
(2.1 GB, permanent)
1) trash-put ~/projects
   safer, recoverable
2) Do it anyway + snapshot
3) Cancel

01  THE PROBLEM

Who is typing your commands?

AI agents now run terminal commands for us, faster than we can read them.

Claude Code

Codex

Other AI agents

Your terminal

NO SAFETY CHECK

Your files, company servers, production

Too fast

One task can run dozens of commands in seconds.

Too many

Nobody reads every command. Approvals become habit.

Too final

rm, dd, force-push: no undo, no recycle bin.

SafeShell

2 / 14

01  THE PROBLEM

DevOps and company servers

Here, one wrong command means an outage.

Illustrative scenario

An AI agent is asked to clean old logs

rm -rf /var/data

wrong path, no warning

Production database is gone

customers affected

Humans cannot watch every server, every minute.

Approval fatigue: people click Yes without reading.

SafeShell

3 / 14

01  THE PROBLEM

Linux asks you to remember

TODAY

find . -name "*.pdf" \
  -mtime -7 -exec cp {} \
  ~/Documents/ \;

WHAT YOU MEAN

"Copy this week's PDFs to Documents"

Hundreds of commands and flags to remember

One typo can delete the wrong thing

Beginners are afraid of the terminal

Today's people expect to just say what they want.

SafeShell

4 / 14

02  OUR IDEA

Our idea: SafeShell

Installed once, active in every terminal you open.

Protect

Blocks harmful commands and explains why.

Prove

Runs the command in a sandbox first and shows the real impact.

Translate

Understands plain English. No need to remember commands.

Undo

Snapshots let you roll back if something still goes wrong.

You always have the final say: SafeShell warns, it never locks you out.

SafeShell

5 / 14

03  HOW IT WORKS

From keystroke to decision

You type

A command or plain English

Understand

Parse it and rate its risk

Simulate

Run it in a safe sandbox

Explain

Show impact and safer options

Decide

Run, snapshot, or cancel

Always on: hooks into bash and zsh. Safe commands pass in milliseconds.

BUILT WITH

Rust

Linux namespaces

OverlayFS

seccomp

llama.cpp

SafeShell

6 / 14

03  HOW IT WORKS

Not every command is equal

Read-only

ls, cat, grep

Runs instantly

Reversible

mv, cp, mkdir

Runs, undo recorded

Recoverable

sed -i, small rm

Simulate + snapshot

Irreversible

rm -rf, dd, git push -f

Blocked, explained

Catastrophic

rm -rf /, chmod -R 777 /

Hard block

SafeShell

7 / 14

03  HOW IT WORKS

Simulate first, then decide

Command sees

real files + sandbox changes

Sandbox layer

every change lands here

Real files

never touched

IMPACT REPORT

4,312

files would be deleted

deleted  4,312
created        0
modified       0

Observed, not predicted

SafeShell

8 / 14

04  EXAMPLE

A harmful command, caught

$ rm -rf ~/projects /tmp/old
SAFESHELL  BLOCKED  (irreversible)
Why: permanently deletes 4,312 files
     (2.1 GB). Cannot be recovered.
1) trash-put ~/projects /tmp/old  [safer]
2) rm -rI ~/projects /tmp/old     [asks first]
3) Do it anyway + snapshot
4) Do it anyway, no snapshot
5) Cancel
Choose [1-5]: _

Why it stopped

Plain-English reason from what the sandbox saw.

Better options

A safer command is offered first.

You decide

"Do it anyway" is always there, with a snapshot.

SafeShell

9 / 14

05  BEYOND FILES

Every side effect, covered

Files are only one part. Each kind of effect has its own safeguard.

Files

Real diff from the sandbox

Network

Connections logged only

Processes

Lists what would be killed

Databases

Run, rolled back, or cloned

Git and packages

Uses each tool's own dry run

Disks and devices

Shows which drive is erased

EVIDENCE SHOWN FOR EACH EFFECT

OBSERVED

PREVIEWED

INSPECTED

ESTIMATED

Estimated-only commands never run automatically.

SafeShell

10 / 14

06  NATURAL LANGUAGE

Just say what you want

copy report.pdf from downloads to documents

cp ~/Downloads/report.pdf ~/Documents/

SAFE

delete everything in this folder

rm -rf ./*

R3 BLOCKED

Shows the command

You learn as you use it.

Asks when unclear

3 files match: which one?

Same safety rules

Plain English gives no extra power.

Next: voice control on top of the same pipeline.

SafeShell

11 / 14

07  THE AI LAYER

AI: local or cloud, your choice

Off

Rules only. Works fully offline.

Local

Runs on your machine. Private and free.

Cloud

Your own API key. Best on weak PCs.

Hybrid

Local first, cloud only if you allow.

Local models

Qwen models run by SafeShell itself on CUDA, Vulkan or CPU. Or connect Claude, GPT or Gemini.

AI proposes, sandbox verifies

Undo plans are tested in the sandbox first. AI can raise risk, never lower it.

SafeShell

12 / 14

08  RESULTS

What we built and measured

PHASE 1

Foundation

PHASE 2

Sandbox

PHASE 3

Shell hook

PHASE 4

AI layer

PHASE 5

Undo

PHASE 6

English input

Measured, not promised

92%

of 220 commands rated exactly, by an independent test set

97%

of 43 plain-English requests turned into the right command (local Qwen 3B; Gemini 95-100%)

0.5 s

to translate a request once the local model is loaded

339

automated tests, incl. a real terminal and the real kernel

SafeShell

13 / 14

09  FUTURE

Where this goes next

Voice control

Speak it, same safety checks.

More tools

git, docker, kubectl.

Team policies

Shared rules for labs and servers.

Learning mode

Teaches real commands.

Thank you

Questions?

Samarth Vala

23BCP422 | Div 7 | G13

Tavish Gupta

23BCP064 | Div 1 | G2

SafeShell

14 / 14