stacks-guard

# /stacks-guard — Safety Rails Prevent destructive actions and enforce focus during debugging sessions. ## Destructive Command Detection ### 🔴 CRITICAL — Block and require confirmation | Pattern | Risk | |---------|------| | `rm -rf /`, `rm -rf ~`, `rm -rf .` | Catastrophic file deletion | | `DROP TABLE`, `DROP DATABASE`, `TRUNCATE` | Irreversible data loss | | `git push --force` to `main`/`master` | Overwrites shared history | | `git reset --hard` with uncommitted changes | Loses uncommitted work | | `git clean -fd` | Deletes untracked files permanently | | `buddy migrate:fresh` on production | Drops ALL tables | | `buddy seed --fresh` on production | Truncates all data | Response: ``` 🔴 GUARD: Destructive command detected Command: [command] Risk: [what will be destroyed] Reversible: [yes/no] ``` ### 🟡 WARNING — Warn but allow | Pattern | Risk | |---------|------| | `git push --force` (non-main) | Overwrites remote branch | | `rm -rf [specific dir]` | Deletes directory tree | | `bun remove [core dep]` | May break build | | `git checkout -- .` | Discards all unstaged changes | | Bulk file moves/renames | May break imports/aliases | | Modifying `config/services.ts` | Contains API keys | | Modifying `storage/framework/core/*/src/index.ts` | Public package API | ### 🟢 INFORMATIONAL — Note but don't block | Pattern | Note | |---------|------| | `git rebase` | History rewrite — ensure not shared | | `bun update` (major versions) | May introduce breaking changes | | Modifying CI/CD config | Affects deployment pipeline | | Changing auth/permissions code | Security-sensitive | | Modifying migration files | Database schema change | ## Freeze Mode Restrict edits during focused debugging. ### Activate ``` /stacks-guard freeze [file or directory pattern] ``` When active: 1. **Block edits outside the freeze scope** 2. **Track all changes** made during the session 3. **Warn if changes grow large** (>5 files or >50 lines) ### Deactivate ``` /stacks-guard thaw ``` Produces a summary of all changes. ## Pre-Commit Safety Before commits, scan for: 1. **Secrets**: API keys, tokens, passwords in staged files 2. **Debug artifacts**: `console.log`, `debugger`, `TODO: remove` 3. **Large files**: >1MB being committed 4. **Lockfile consistency**: `package.json` changed → `bun.lock` should too ## Stacks-Specific Guards - **Don't edit `storage/framework/types/*.d.ts`** — these are auto-generated - **Don't edit `storage/framework/defaults/app/Models/`** without also generating migrations - **Don't modify `config/services.ts` in commits** — contains API keys - **Check `storage/framework/core/*/package.json` versions** — workspace packages should stay in sync ## Rules - **Never silently allow destructive commands.** - **Don't be annoying.** `rm file.txt` doesn't need a warning. `rm -rf node_modules` is fine — it's regenerable. - **Respect user intent.** After warning once, if confirmed, proceed. - **Context matters.** Force-push to personal branch ≠ force-push to main.