ldraw-nova: AI agents build LEGO models by writing Python geometry
In ldraw-nova, models write a plan and a Python generator instead of raw coordinates, but nothing checks physics or stability.
Claude Code mods: a command guard warns, permission rules block
Claude Code mods see every event, but a guard matching command text misses $(...), aliases and scripts; hard blocks belong in permission rules.
Huseyin Kaplan · 1 min read
A guard that reads the command text can't stop the command it never sees.
Anthropic published its Claude Code mods guide today. A mod is a JavaScript module that loads once in your session and sees every event, like middleware.
Each hook gets the event and a next(). Three moves:
- observe: call next, then look
- rewrite: pass a changed event down
- answer: return a deny, skip next
Their Blast Radius example uses the third. It holds rm -rf or git reset --hard, runs a dry run, and asks Proceed or Cancel.
The guide names the limit itself. It matches the command string, so $(...), an alias, or a script that calls rm gets past it. Hard blocks belong in permission rules.
Before installing anyone's mod, I'd check:
- it runs with Claude Code's access, so read the repo first
- which events it answers instead of observing
A mod can warn you. A permission rule can stop it.
