| name | codex-log-guard |
| description | Diagnose excessive Codex local SQLite diagnostic log writes with read-only evidence by default. Use when a user mentions logs_2.sqlite, logs_2.sqlite-wal, block_log_inserts, SSD/TBW wear, or explicitly asks to protect, clean up, verify, or restore Codex diagnostic logging. |
Codex Log Guard
Overview
Diagnose Codex persistent diagnostic logging from local evidence, then give a concise conclusion and the safest next action. Do not make the user choose from a command menu.
Operating Contract
Select one mode from the current user request:
diagnose_only is the default for check, inspect, explain, or verify requests. It is read-only.protect requires an explicit request to stop or mitigate log writes. It may install and verify block_log_inserts, but it does not delete rows or vacuum files.cleanup requires an explicit current request to reclaim disk space or clean up logs. It first installs protection when needed, creates and verifies a timestamped backup, and only then deletes log rows and vacuums.restore requires an explicit request to resume diagnostic logging. It may drop only the known block_log_inserts trigger.
Generic wording such as "处理", "修一下", or "止血" selects protect, not cleanup. Prior approval does not carry into a later run. If the requested write mode is ambiguous, return the diagnose_only report and the exact proposed mutation without applying it.
Direct actions:
- Run local read-only file, SQLite schema, row, and open-process checks.
- Apply only the mutation authorized by the selected mode and verify its result.
Escalate before:
- Touching any database outside the two declared Codex log paths, deleting a backup, killing a process, or changing remote telemetry or credentials.
