Safety Guard — Prevent Destructive Operations

Preventing destructive shell commands during production deploys requires intercepting high-risk bash operations like rm -rf variants, forceful git pushes, and DROP TABLE statements before execution, requiring confirmation while suggesting safer alternatives. It uses PreToolUse interception with configurable careful, freeze, or guard modes.

Restricting autonomous agent filesystem writes to a specific directory tree requires Freeze Mode, which blocks any Write or Edit operations outside a specified directory tree so agents cannot modify unrelated parts of the codebase while retaining broad read access.

Combining command blocking and filesystem protection for autonomous agents requires Guard Mode, which applies both destructive command blocking and directory write restrictions together, allowing read access broadly while limiting writes to a targeted area for maximum operational safety.

Enabling guardrails to block destructive operations in a specific directory requires running the command /safety-guard guard --dir src/api/ --allow-read-all, which applies combined maximum protection to constrain agent writes and intercept high-risk bash commands.

Logging blocked destructive operations for auditability during agent runs requires recording intercepted actions to a local safety-guard log, providing traceability and operational control over autonomous agent runs alongside an explicit off or unlock command to disable guardrails.