incident · recovery & prevention
claude code deleted my files. can I recover them — and prevent it?
First, stop writing to the affected disk and check your recovery paths in order: git history / git reflog, editor local history, OS trash, filesystem snapshots (Time Machine, APFS/ZFS/btrfs), and backups. Deletion outside those is usually unrecoverable — which is why prevention matters more than recovery.
To stop the next one, add gate.cat: a free, deterministic PreToolUse hook that blocks rm -rf and other irreversible commands before Claude Code runs them. pip install gate-cat.
AI coding agents delete files as a normal part of refactoring and cleanup. When one deletes the wrong thing — sometimes thousands of files, sometimes your home directory — the damage is done the instant the command runs. Recovery is a scramble; prevention is a one-liner.
step 1 — try to recover (in order, act fast)
- Stop writing to the disk. Every new write lowers the odds an undelete tool can recover an unreferenced file.
- Git. If the files were committed:
git checkout -- <path>or restore from history. For lost commits:git reflogthengit checkout <sha>. Staged-but-not-committed blobs can sometimes be recovered withgit fsck --lost-found. - Editor local history. VS Code keeps a Local History; JetBrains IDEs keep “Local History” with per-file timelines — often the fastest win for uncommitted work.
- OS trash & snapshots. Check the trash, then Time Machine (macOS), APFS/ZFS/btrfs snapshots, or Windows File History / Previous Versions.
- Backups. Restore from your last known-good backup and re-apply recent work by hand.
rm -rf on files that were never committed, snapshotted or backed up is usually gone for good. There is no reliable undo for an irreversible command that already executed — which is exactly the gap gate.cat closes.step 2 — make sure it can't happen again
The durable fix is a check the agent runs into before the delete executes. gate.cat is a deterministic deny-list that plugs into Claude Code as a PreToolUse hook. When Claude Code tries an irreversible command, the hook matches it against 38 default policies, blocks it, and returns the reason to the agent — which then continues without the destruction.
Because the hook runs outside the model, a persuasive prompt can't disable it, and if the gate can't judge a command it stops rather than allows. Setup is two lines in .claude/settings.json after pip install gate-cat.
frequently asked
Can gate.cat recover files that were already deleted?
No — gate.cat is prevention, not recovery. It blocks the irreversible command before it runs. For files already deleted, use git reflog / git fsck, editor local history, OS snapshots, or backups.
How do I stop Claude Code from deleting files?
Add gate.cat as a PreToolUse hook in .claude/settings.json. It matches commands against 38 default policies and blocks irreversible ones like rm -rf before Claude Code executes them, returning the reason to the agent.
Will the hook get in the way of normal edits?
It intervenes on about 0.6% of real commands, measured on a 14.7k-command Claude Code log. Ordinary file edits and safe deletes pass through; only irreversible shapes are stopped.
Does this work for agents other than Claude Code?
The native hook is Claude Code specific. For other agents (Codex, Copilot BYOK, Ollama, vLLM and any OpenAI-API agent) run gate.cat as a proxy by pointing the agent's base_url at it.
Is gate.cat free, and does it phone home?
It is free forever under Apache 2.0, and the pip package has zero telemetry. Nothing about your commands leaves your machine unless you opt into the (separate, off-by-default) Cloud copy.
put a leash on your agent — 60 seconds
The gate, all 38 default policies, the Claude Code hook and the proxy are free forever (Apache 2.0). No account, no daemon, no telemetry.
One email when there's a catch worth showing: a real irreversible command an agent tried, and how the wall stopped it. Opt-in, no spam, no telemetry. The gate itself is free.
✓ you're on the list — first catch lands soon.