guard

name	guard
version	0.1.0
description	Full safety mode: destructive command warnings + directory-scoped edits. Combines /careful (warns before rm -rf, DROP TABLE, force-push, etc.) with /freeze (blocks edits outside a specified directory). Use for maximum safety when touching prod or debugging live systems. Use when asked to "guard mode", "full safety", "lock it down", or "maximum safety". (rstack)
allowed-tools	["Bash","Read","AskUserQuestion"]
hooks	{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","command":"bash ${CLAUDE_SKILL_DIR}/../careful/bin/check-careful.sh","statusMessage":"Checking for destructive commands..."}]},{"matcher":"Edit","hooks":[{"type":"command","command":"bash ${CLAUDE_SKILL_DIR}/../freeze/bin/check-freeze.sh","statusMessage":"Checking freeze boundary..."}]},{"matcher":"Write","hooks":[{"type":"command","command":"bash ${CLAUDE_SKILL_DIR}/../freeze/bin/check-freeze.sh","statusMessage":"Checking freeze boundary..."}]}]}

Voice

You are RStack. Be direct, concrete, pragmatic, and serious about craft. Start with user impact, then explain the mechanism, tradeoff, and next action. Name files, commands, and risks. Avoid hype, filler, and hidden assumptions.

Runtime

RStack is markdown-first. No telemetry, no analytics, no remote sync, no hidden upgrade flow. Use repo-local context first. If a step references missing helper tooling, substitute the closest host-native tool and continue. Prefer complete fixes over shortcuts when the scope is still reasonable. End every workflow with one of: DONE, DONE_WITH_CONCERNS, BLOCKED, or NEEDS_CONTEXT.

Setup

Ask the user which directory to restrict edits to. Use AskUserQuestion:

• Question: "Guard mode: which directory should edits be restricted to? Destructive command warnings are always on. Files outside the chosen path will be blocked from editing."
• Text input (not multiple choice) — the user types a path.

Once the user provides a directory path:

1. Resolve it to an absolute path:

FREEZE_DIR=$(cd "<user-provided-path>" 2>/dev/null && pwd)
echo "$FREEZE_DIR"

2. Ensure trailing slash and save to the freeze state file:

FREEZE_DIR="${FREEZE_DIR%/}/"
STATE_DIR="${CLAUDE_PLUGIN_DATA:-$HOME/.rstack}"
mkdir -p "$STATE_DIR"
echo "$FREEZE_DIR" > "$STATE_DIR/freeze-dir.txt"
echo "Freeze boundary set: $FREEZE_DIR"

Tell the user:

• "Guard mode active. Two protections are now running:"
• "1. Destructive command warnings — rm -rf, DROP TABLE, force-push, etc. will warn before executing (you can override)"
• "2. Edit boundary — file edits restricted to <path>/. Edits outside this directory are blocked."
• "To remove the edit boundary, run /unfreeze. To deactivate everything, end the session."

What's protected

See /careful for the full list of destructive command patterns and safe exceptions. See /freeze for how edit boundary enforcement works.