How to stop Claude and Cursor from wrecking your notes

Checked November 2026 against the Claude Code, Cursor and Git documentation linked below. Coffee isn't affiliated with any of them.

Make a copy the tool can't touch before it starts, then limit what it's allowed to change. In practice that means a Git commit or a copy of the folder, a branch for the work, a permission setting that makes the tool ask first, and reading the result before you keep it. Instructions like "don't touch my other notes" help, but they aren't a safeguard.

What each safeguard covers

Commit before it starts

If your notes aren't in a repository yet, this takes a minute and needs no account or server:

cd ~/Notes
git init
git add -A
git commit -m "Before the AI edit"

git init is safe to run in a folder that's already a repository, because it won't overwrite what's there. Everything stays on your Mac unless you push it somewhere.

Commit again before each session, and any committed file can be brought back with git restore. Both Claude Code and Cursor say the same in their own documentation: Claude Code's checkpoints don't replace version control, and Cursor's are local and separate from Git, with Git recommended for permanent history.

Work on a branch or a copy

For anything bigger than a small fix, such as reorganising a folder or rewriting many notes, keep the work away from your real files.

With Git, start a branch and run the tool there:

git switch -c ai-tidy
# let the tool work, and commit what it did
git switch main

Your notes on main are as you left them, and you merge the branch only if you like the result. A branch only separates what has been committed, so commit the tool's work before you switch back.

Without Git, copy the folder and point the tool at the copy:

cp -R ~/Notes ~/Notes-ai
# let the tool work in ~/Notes-ai
git diff --no-index --stat ~/Notes ~/Notes-ai

That last command needs Git installed but no repository. It lists the files that differ, which is a quick way to spot a tool that wandered further than you asked.

Limit what the tool can do

Claude Code

Start it in the smallest folder that does the job. In its permission system, reads inside the working directory don't ask for approval, so whatever is under that folder is available to it, and anything it reads goes to its AI service.

Then choose a permission mode. Press Shift+Tab to cycle through them, or set one at launch:

• Manual (default) asks before each file edit, and you see the change first.
• acceptEdits makes edits in the working directory without asking. It's the mode to leave for later, once you trust the task.
• plan reads and writes a plan but doesn't edit your files until you approve it. It's a good first step for a big reorganisation.
• bypassPermissions skips prompts. Its documentation says to keep it to isolated environments such as containers and virtual machines, so don't use it on your notes.

For folders that should never change, add deny rules to .claude/settings.json in the folder you work from:

{
  "permissions": {
    "deny": ["Edit(./Archive/**)", "Bash(rm *)"]
  }
}

Those rules have a limit that its documentation is frank about. They cover Claude's file tools and the file commands it recognises in the shell, but not a script that opens files by itself. For enforcement at the system level, it points to its sandbox.

A note about CLAUDE.md: Anthropic's docs describe it as context, not enforced configuration. Writing "never edit Archive" there shapes what Claude tries to do, and a deny rule is what actually blocks it.

Cursor

Run Modes, under Settings > Agents > Approvals & Execution, control tool calls:

• Auto-review is the default. Allowlisted calls run, other shell commands go to a sandbox when possible, and the rest go to a classifier. Cursor says plainly that this isn't a security boundary.
• Allowlist runs only what you've listed without asking.
• Run Everything has no prompts, no sandbox and no classifier. Leave this one off for your notes.

The same page lists protections against automatic file deletion and automatic changes outside the workspace, so open only the folder you mean to change. Its description of Run Modes covers shell, MCP and fetch calls, and doesn't say they govern edits inside the workspace. Cursor's help page says Agent applies edits as it works, so assume the edits land first and you review afterwards. That makes the commit beforehand matter more.

.cursorignore keeps files away from Agent and Tab. Cursor's documentation adds that terminal and MCP tools can't be blocked by it, and that complete protection isn't guaranteed.

Know what rewind can do

Both tools can roll back, and the review guide covers the steps. For safety planning, the limits matter more. Claude Code's rewind leaves alone a file that only shell commands changed, and it usually doesn't restore edits made by subagents. Cursor's Restore Checkpoint rolls back everything after a message. Neither knows what the other tool did.

Treat these as a quick way back during a session, with Git underneath them.

Ask for less at a time

Smaller requests are easier to check. "Fix the typos in this note" gives you a short list of changes, while "clean up my notes" gives you a folder to read again from the start. Name the files, say what mustn't change, and do one kind of change per pass.

How to review the changes has the full routine for checking the result, and undoing just one edit covers what to do when most of it is good.

What Coffee adds

Coffee can't stop a tool from editing a file, and none of the safeguards above depend on it. Its part comes after the edit: it remembers each note as you last read it, and shows anything different as changes you can keep or undo one at a time. It needs that first read, so it can't help with a note you've never opened in it.

Its version history keeps earlier copies on your Mac, but it's a weak safeguard here. Copies are made when Coffee saves a note, so an edit from another tool doesn't make one by itself. Use Git for this job.

Two things differ depending on how the tool reaches your notes:

• Through the folder, as Claude Code and Cursor normally do, Coffee's settings don't apply. A private note stays encrypted on disk, but a tool with access to the folder can still overwrite, move or delete the file. Review skips private notes too, so Git or a backup is what protects them from that.
• Through MCP, Coffee's Connect AI apps setting is off until you turn it on, and you can untick Edit notes to make access read-only.

Questions

What's the single most useful safeguard?

A Git commit before the tool starts. It costs a few seconds, works with any tool, and lets you bring back any file you've committed, whatever changed it.

Is telling the AI not to touch a file enough?

No. An instruction shapes what it tries to do, but nothing enforces it. In Claude Code, use a deny rule. In Cursor, work on a branch or a copy, since .cursorignore has stated limits.

Do I need Git if the tool has rewind?

Yes, for anything you'd miss. Claude Code's documentation says its checkpoints don't replace version control, and rewind doesn't catch every change, such as a file only a shell command touched.

Does read-only access exist for AI tools?

In Claude Code, plan mode and deny rules on Edit come close, with the limits above. Through Coffee's MCP server, unticking Edit notes removes the tools that create and change notes.