# Safety defaults

Writes to secrets, VCS internals, dependency dirs, and the pi harness
substrate are blocked by `packages/base/extensions/protected-paths.ts`. The
rules below cover the gaps that extension can't enforce.

- Never run `docker compose down -v` (destroys the `pi-config` volume holding
  `auth.json`). Use `docker compose down` if you must stop the stack.
- Never run `rm -rf` against paths outside `scratch/` or build outputs.
- Even though `protected-paths` blocks edits to `.env`, `docker-compose.yml`,
  `pi/Dockerfile`, and `pi/entrypoint.sh`, do not propose changes to them
  without an explicit instruction in the current turn.
- Prefer additive changes; if a refactor is needed, surface the plan before
  executing.
- Do not run `bin/pi-update` from inside this container, and do not
  invoke `docker compose build pi` / `docker compose up -d --force-recreate
  pi` via `bash`. Recreating the pi container is the same as killing the
  session you're running in. Tell the user to run `bin/pi-update` from
  their host shell instead. (`bin/pi-update` has a self-exec guard, but
  the underlying compose commands do not.)