Plugin
cw-guards: guards on tool calls
Guards on tool calls: refuses commands that would print secrets, refuses worktrees under temp folders and merges that would delete ignored data, and scopes forks spawned while a scheduled task is in context.
One plugin holds mods 1, 2 and 7 so they share one Bash tokenizer and one update (ADR-0001, shape B′). It hooks session.start, command.run, tool.call on Bash, Read, Grep and EnterWorktree, and for mod 7 prompt.submit, turn.complete, classic.Stop and agent.spawn.
Its two commands are escapes that let the next refusal through once, honoured only when you type them at the prompt: /secret-guard allow-once and /worktree-guard allow-symlink-merge.
Status (README, 2026-11-12): unit-tested, live-checked headless and in an interactive session. Not yet installed on any machine. The default 10-minute long-job toast is UNVERIFIED.
Mods in cw-guards
All features →- 01
Secret-leak guard
Refuses tool calls that would put secret values in the transcript, and names the safe form instead.
- 02
Worktree path guard
Refuses worktrees under temp folders and merges whose tracked symlinks would delete ignored data, and warns on broad adds in linked worktrees.
- 03
Fork and cron hygiene band
Puts a scope guard on forks spawned while a cron or /loop prompt is in context, and shows scheduled and background jobs on the status line.