# What the guard checks by default

Every agent command and file access goes through a guard before it runs. These are the default rules, copied from the harness's guard module. Relaxing any of them is an explicit setting (and burst-limited per service), and every block is shown in the UI and recorded in the run folder.

## Command rules
| Rule | Matches | Why |
|---|---|---|
| git-push | `git ... push` | publishes to a remote |
| git-remote | `git remote add / set-url / rename` | changing git remotes |
| gh-cli | `gh ...`, `hub ...` | the GitHub CLI talks to your account |
| publish | `cargo / npm / pnpm / yarn / twine / gem / dotnet nuget` publish, push or upload | publishing a package |
| git-credential | `git ... credential` | reading git credentials |
| cred-store | `cmdkey`, `vaultcmd`, `Get-StoredCredential`, `security find-*-password`, `secret-tool`, `keyring` | reading the OS credential store |
| secret-file-cmd | `.env`, `.git-credentials`, `.netrc`, `.npmrc`, `.pypirc`, `id_rsa`, `id_ed25519`, `.ssh/`, `.aws/credentials`, `keys.env`, `credentials.env`, `.pem`, `.pfx` | touching a secrets file |
| env-dump | `printenv`, `env`, `set`, `Get-ChildItem env:`, `$env:*KEY / TOKEN / SECRET` | dumping environment secrets |
| net-tool | `curl`, `wget`, `Invoke-WebRequest`, `iwr`, `Invoke-RestMethod`, `irm`, `ssh`, `scp`, `sftp`, `ftp`, `telnet`, `nc`, `ncat`, `Start-BitsTransfer`, `bitsadmin` | outbound network from an agent command |
| git-net | `git fetch / pull / clone / ls-remote / submodule update` | git network operation |
| pkg-install | `pip install`, `npm install / i / add / ci`, `cargo install / add` | installing packages from the network |
| url | any `http(s)://host.tld` in a command | a remote URL in a command |
| rm-root | recursive deletes of `/`, `~`, `$HOME` or a drive root; `format X:` | destroying files outside the workspace |
| system | `shutdown`, `reg add / delete`, `bcdedit`, `diskpart`, `Set-ExecutionPolicy`, `schtasks`, `sc create / delete / config` | changing system configuration |
| escape | `../../` | reaching outside the workspace |

## Paths
Reads and writes are blocked for `.env` and `.env.*` (except `.env.example` and `.env.sample`), `.git-credentials`, `.netrc`, `.npmrc`, `.pypirc`, `keys.env`, `credentials.env`, `id_rsa`, `id_ed25519`, `id_ecdsa`, anything ending `.pem .key .pfx .p12 .keystore .jks`, anything under `.ssh/` or `.aws/`, and names starting with `credentials` or `secrets.`.

## Environment
Variables whose names contain KEY, TOKEN, SECRET, PASSWORD, PASSWD, CREDENTIAL, COOKIE or SESSION (except `CARGO_*`) are removed from every agent command, so agents never see your keys.

## Containment
- Agents work on snapshots, never your working tree. A verified result lands on a local `throng/<id>` branch and as a patch file.
- Every build and test job runs in a Windows job object on a private, invisible desktop with UI restrictions. A test that runs `start http://localhost:8080` cannot open a tab in your browser, and anything it spawns dies with the job.
- Claude Code workers (provider `claude-code`) are tied to a job object too, so they die with throng.