Auto-approval permission guard: a middle tier between workspace-write and danger-full-access — auto-allows safe operations inside trust directories, always asks a human for destructive ones, with 11 p

Blocks edit/write writes that contain characters matching configurable regex rules, executed before the tool runs, with configurable messages and same-turn pwsh propagation; default rule matches full-

String-matches tool-call input arguments, blocks dangerous tool calls (deny) or allows them with an injected warning (warn), and ships a full rules-management panel.

Host-side guard that lets the write tool only create new files: when the target already exists it denies the call before execution and tells the model to use edit instead, applied to all sessions.

Runtime security gate on the tool pipeline: denies calls naming hosts outside an egress allowlist, redacts credentials from results at the canonical value rather than only the rendered content, and ap

Fine-grained permission gateway: per-category tool-call review (outside-workspace directories, commands, file read/write, subagents, repeated actions) with global & per-project allow/deny exceptions,