Guard

/guard — Safety Guardrails

You have activated safety guardrails. These protect against accidental destructive operations during this session.

Telemetry preamble

Defensive telemetry init. No-op if telemetry is disabled via NANOSTACK_NO_TELEMETRY=1, ~/.nanostack/.telemetry-disabled, or if the helpers are removed.

_P="$HOME/.claude/skills/nanostack/bin/lib/skill-preamble.sh"
[ -f "$_P" ] && . "$_P" guard
unset _P

Modes

The user may activate a specific mode. If no mode is specified, default to careful.

Careful Mode (default)

What it does: Warns before any potentially destructive operation but does not block.

When you detect a destructive operation, pause and present:

⚠️  GUARD: Potentially destructive operation detected
Operation: {{what you're about to do}}
Impact: {{what could go wrong}}
Reversible: {{yes/no — if yes, how}}

Proceed? [y/n]

Use AskUserQuestion to get explicit confirmation before proceeding.

Destructive operations include:

• rm -rf, rm -r on directories
• git reset --hard, git push --force, git branch -D
• DROP TABLE, DELETE FROM without WHERE, TRUNCATE
• kubectl delete, docker rm, docker system prune
• Writing to production configs or .env files
• Modifying CI/CD pipeline files
• Any operation the guard/bin/check-dangerous.sh script flags

Freeze Mode

What it does: Asks the agent to keep its file writes (Edit, Write) within a chosen scope for the rest of the session. This is a guided instruction the agent follows, not a hook-enforced block: unlike the secret and system-path denylist in check-write.sh, the Write/Edit hook does not currently reject an out-of-scope write. Treat freeze as agent-level discipline, not a wall.

When the user says /freeze or /guard freeze:

1. Ask which directories/files are in scope (or accept them as arguments)
2. Store the scope in guard/config.json
3. For the remainder of the session, keep Edit and Write operations within the frozen scope and decline anything outside it

// guard/config.json
{
  "mode": "freeze",
  "allowed_paths": [
    "src/feature/**",
    "tests/feature/**"
  ],
  "frozen_at": "2025-01-01T00:00:00Z"
}

When you are about to write outside the frozen scope, decline and say so (the hook does not stop the write for you, so this is on the agent to honor):

🔒 GUARD FREEZE: declining write outside the frozen scope
File: {{path}}
Reason: not in the allowed scope
Allowed: {{list of allowed paths}}

To unfreeze: /unfreeze

Unfreeze Mode

What it does: Removes freeze restrictions.

When the user says /unfreeze or /guard unfreeze:

1. Remove the freeze config
2. Confirm guardrails are now in careful mode (not fully off)

🔓 GUARD: Freeze lifted. Returning to careful mode.

The Check Script

guard/bin/check-dangerous.sh runs every Bash call through a layered check pipeline. The order is deliberate: block rules run first so commands whose binary is on the allowlist (cat, find, head, tail) still get matched against known-bad patterns (e.g. cat .env, find . -delete).

Block rules (run first, no exceptions). Matched against the full command string. The current rule counts are loaded from guard/rules.json; this doc does not hand-maintain them.

Allowlist. Commands like git status, ls, jq short-circuit when no block rule matched.

Phase-aware concurrency. When a session is active and the current phase declares concurrency: read (built-in or custom), write commands are blocked with category concurrency-safety. The active phase's SKILL.md is resolved through bin/lib/phases.sh so custom phases get the same protection as built-in ones. Detection covers more than the obvious utilities: output redirection to anything except /dev/*, in-place editors (sed -i, perl -i), tee/truncate/patch/install, inline interpreter code (python -c, node -e, sh -c, whose quoted body is invisible to pattern checks), and git worktree mutations (stash, restore, checkout, merge, rebase, apply, clean). Quoted segments are stripped first so a read like awk '$3 > 5' file is never mistaken for redirection. The regression lock is ci/e2e-read-phase-writes.sh.

In-project fast-path. Operations that only touch files inside the current git repo pass through. Reviewable via version control. Runs after the concurrency check so an in-project touch ./foo cannot bypass a read-phase block.

Sprint phase gate. Blocks git commit / git push until the required-before-ship ancestors of the active phase_graph have completed. The built-in sprint defaults to review + security + qa; custom graphs gate on their own ancestor list.