Host-neutral runtime bindings

These assignments select stable paths only; they do not install anything or grant consent:

GSTACK_HOME="${GSTACK_HOME:-$HOME/.gstack}"
GSTACK_ROOT="$GSTACK_HOME"
GSTACK_STATE_ROOT="$GSTACK_HOME"
GSTACK_BIN="$GSTACK_HOME/bin"
B="$GSTACK_BIN/browse"
D="$GSTACK_BIN/gstack-design"
P="$GSTACK_BIN/make-pdf"

$debug --mode Diagnose-only --module guard — Full Safety Mode

Activates both destructive command warnings and directory-scoped edit restrictions. This is the combination of $debug --mode Diagnose-only --module careful + $debug --mode Diagnose-only --module freeze in a single command.

Dependency note: This skill references hook scripts from the sibling $debug --mode Diagnose-only --module careful and $debug --mode Diagnose-only --module freeze skill directories. Both must be installed (they are installed together by the gstack setup script).

Canonical execution does not write engagement analytics or telemetry.

Setup

Ask the user which directory to restrict edits to. Use AskUserQuestion:

Question: "Guard mode: which directory should edits be restricted to? Destructive command warnings are always on. Files outside the chosen path will be blocked from editing."
Text input (not multiple choice) — the user types a path.

Once the user provides a directory path:

Resolve it to an absolute path:

FREEZE_DIR=$(cd "<user-provided-path>" 2>/dev/null && pwd)
echo "$FREEZE_DIR"

Ensure trailing slash and save to the freeze state file:

FREEZE_DIR="${FREEZE_DIR%/}/"
eval "$($GSTACK_BIN/gstack-paths)"
STATE_DIR="$GSTACK_STATE_ROOT"
mkdir -p "$STATE_DIR"
echo "$FREEZE_DIR" > "$STATE_DIR/freeze-dir.txt"
echo "Freeze boundary set: $FREEZE_DIR"

Tell the user:

"Guard mode active. Two protections are now running:"
"1. Destructive command warnings — rm -rf, DROP TABLE, force-push, etc. will warn before executing (you can override)"
"2. Edit boundary — file edits restricted to <path>/. Edits outside this directory are blocked."
"To remove the edit boundary, run $debug --mode Diagnose-only --module unfreeze. To deactivate everything, end the session."

What's protected

See $debug --mode Diagnose-only --module careful for the full list of destructive command patterns and safe exceptions. See $debug --mode Diagnose-only --module freeze for how edit boundary enforcement works.

Upstream judgment port: PR #679

Match the user language

User-language rule

Write questions, progress updates, reports, and artifacts in the language used by the user. Source material, code identifiers, commands, and quotations may remain in their original language when translating them would reduce accuracy.

3.5 KiB Raw Blame History