An independent permission gate above the built-in sandbox: blocks writes outside the workspace and to protected paths even under danger-full-access, refuses whole-file overwrites without a complete fresh read, and keeps ZIP restore points plus Recycle Bin copies before destructive actions.
This plugin has not published an npm package, so the store does not offer an install command yet. Use the repository link below to view the source.