Pre-built n8n workflows that send approval emails when safe-rm intercepts a destructive command. Pick the version that matches your email provider.

1. Open your n8n instance (self-hosted or cloud).
2. Go to Workflows > Add Workflow > Import from File.
3. Select one of the JSON files from this directory.
4. The workflow will appear with all nodes pre-configured.

1. In n8n, go to Settings > Credentials > Add Credential.
2. Search for SMTP and create a new credential.
3. Fill in your SMTP server details:
   • Host: Your SMTP server (e.g., smtp.gmail.com, smtp.mailgun.org)
   • Port: Usually 465 (SSL) or 587 (TLS)
   • User: Your email address or SMTP username
   • Password: Your email password or app-specific password
   • SSL/TLS: Enable as appropriate
4. In the workflow, click the Send Approval Email node and select your new SMTP credential.

1. In n8n, go to Settings > Credentials > Add Credential.
2. Search for Gmail OAuth2 and create a new credential.
3. Follow n8n's OAuth flow to authorize your Gmail account.
4. In the workflow, click the Send Approval Email node and select your new Gmail credential.

• SMTP version: Uses the ADMIN_EMAIL environment variable by default. Set this in your n8n environment, or edit the Send Approval Email node's sendTo field directly.
• Gmail version: Edit the Send Approval Email node and replace [email protected] with your actual email address.

1. Toggle the workflow to Active in n8n.
2. Note the webhook URL shown in the Webhook Trigger node (e.g., https://your-n8n.example.com/webhook/delete-approval).

Set the webhook URL in your safe-rm server's .env file:

N8N_WEBHOOK_URL=https://your-n8n.example.com/webhook/delete-approval

For the Claude hook workflow, set a separate variable:

N8N_HOOK_WEBHOOK_URL=https://your-n8n.example.com/webhook/claude-hook

The approval server sends a POST request to the webhook with a JSON body like:

{
  "request_id": "abc-123",
  "command": "rm -rf /var/data/old-logs",
  "file_count": 47,
  "risk_factors": ["recursive delete", "large file count"],
  "user": "deploy",
  "hostname": "prod-server-01",
  "working_dir": "/var/data",
  "timeout_seconds": 300,
  "approve_url": "https://your-server.example.com/api/approve/abc-123",
  "deny_url": "https://your-server.example.com/api/deny/abc-123",
  "stop_url": "https://your-server.example.com/api/stop/abc-123"
}

The Claude hook workflow expects:

{
  "hook_id": "hook-456",
  "tool_name": "Bash",
  "tool_input": { "command": "rm -rf /tmp/build" },
  "session_id": "session-789",
  "cwd": "/home/user/project",
  "user": "developer",
  "hostname": "dev-machine",
  "approve_url": "https://your-server.example.com/api/hook/approve/hook-456",
  "deny_url": "https://your-server.example.com/api/hook/deny/hook-456",
  "respond_url": "https://your-server.example.com/api/hook/respond/hook-456",
  "auto_approve_5m_url": "https://your-server.example.com/api/hook/auto/hook-456?minutes=5",
  "auto_approve_15m_url": "https://your-server.example.com/api/hook/auto/hook-456?minutes=15"
}

All workflows use a dark theme with inline CSS. To customize colors, edit the HTML template inside the email node. Key color values:

You can extend any workflow by adding nodes after the email send node. Common additions:

• Slack node for chat notifications
• Telegram node for mobile alerts
• Discord node for team channels
• HTTP Request node to call other APIs

The SMTP workflows reference $env.ADMIN_EMAIL. You can set this in n8n via:

• Docker: -e [email protected]
• n8n Settings: Settings > Variables (n8n cloud / enterprise)
• .env file: If running n8n with dotenv support

Webhook not receiving requests

• Ensure the workflow is set to Active.
• Verify the webhook URL in your server .env matches the URL shown in n8n.
• If n8n is behind a reverse proxy, ensure the proxy forwards to the n8n webhook port.

Emails not sending

• Check your SMTP/Gmail credentials in n8n Settings > Credentials.
• For Gmail, ensure the OAuth token has not expired (re-authorize if needed).
• For SMTP, verify your provider allows the sending address.

Buttons in email not working

• The approve/deny/stop URLs must be publicly accessible from wherever you read email.
• If running locally, use a tunnel (e.g., ngrok) or deploy the approval server.