先看看示例
作者提供的示例，实际效果取决于你的输入和使用工具。
输入
在自主 agent 会话中启用 guard --dir src/api/，允许读取任意文件但仅能写入 src/api/，并拦截强制推送。
输出
预期交付：危险命令的确认提示或拦截说明，以及被阻止操作的日志记录。（编辑说明，非实际运行结果）
方法说明
--- name: safety-guard description: "Guard against destructive operations with three modes: Careful intercepts dangerous commands (rm -rf, git push --force, DROP TABLE) for confirmation, Freeze locks writes to one directory, and Guard combines both via PreToolUse hooks. Use when working on production systems, running agents autonomously, restricting edits to a directory, or during migrations, deploys, and data changes." metadata: origin: ECC --- # Safety Guard — Prevent Destructive Operations ## When to Use - When working on production systems - When agents are running autonomously (full-auto mode) - When you want to restrict edits to a specific directory - During sensitive operations (migrations, deploys, data changes) ## How It Works Three modes of protection: ### Mode 1: Careful Mode Intercepts destructive commands before execution and warns: ``` Watched patterns: - rm -rf (especially /, ~, or project root) - git push --force - git reset --hard - git checkout . (discard all changes) - DROP TABLE / DROP DATABASE - docker system prune - kubectl delete - chmod 777 - sudo rm - npm publish (accidental publishes) - Any command with --no-verify ``` When detected: shows what the command does, asks for confirmation, suggests safer alternative. ### Mode 2: Freeze Mode Locks file edits to a specific directory tree: ``` /safety-guard freeze src/components/ ``` Any Write/Edit outside `src/components/` is blocked with an explanation. Useful when you want an agent to focus on one area without touching unrelated code. ### Mode 3: Guard Mode (Careful + Freeze combined) Both protections active. Maximum safety for autonomous agents. ``` /safety-guard guard --dir src/api/ --allow-read-all ``` Agents can read anything but only write to `src/api/`. Destructive commands are blocked everywhere. ### Unlock ``` /safety-guard off ``` ## Implementation Uses PreToolUse hooks to intercept Bash, Write, Edit, and MultiEdit tool calls. Checks the command/path against the active rules before allowing execution. ## Integration - Enable by default for `codex -a never` sessions - Pair with observability risk scoring in ECC 2.0 - Logs all blocked actions to `~/.claude/safety-guard.log`