{
  "_comment": "Copy to ~/.pi/agent/configs/opl-guardian.json and customize. This replaces standalone permission-gate, protected-paths, and confirm-destructive settings.",
  "permissionGate": {
    "patterns": [
      "\\brm\\s+(?:(?:-[a-z]+|--[a-z-]+)\\s+)*(?:-[a-z]*r[a-z]*|--recursive)(?=\\s|$)",
      "\\bsudo\\b",
      "\\b(chmod|chown)\\s+(?:-[a-z]+\\s+)*777(?:\\b|$)",
      "\\bprintenv\\b",
      "(?:^|[;&|()\\n])\\s*env(?:[\\s)|]|$)"
    ],
    "blockWithoutUI": true
  },
  "protectedPaths": {
    "paths": [
      { "path": ".env", "deny": ["read", "write", "edit", "bash"] },
      { "path": ".git/", "deny": ["read", "write", "edit"] },
      { "path": "node_modules/", "deny": ["write", "edit"] },
      { "path": "~/.pi/agent/auth.json", "deny": ["read", "write", "edit", "bash"] }
    ]
  },
  "confirmDestructive": {
    "clearSession": true,
    "switchWithUnsavedWork": true,
    "forkSession": true,
    "blockWithoutUI": true
  },
  "dropMalformedToolCalls": true,
  "logging": {
    "incidentFile": null,
    "maxBytes": 262144,
    "_comment_incident_file": "Malformed-call forensics never go inside the open repository. null writes to <agent dir>/guardian-incidents.jsonl; a relative path also resolves under the agent dir; an absolute or ~/ path is used as given; false stops writing.",
    "_comment_max_bytes": "Before an append that would pass this many bytes, the current log moves to guardian-incidents.jsonl.1 and a fresh one starts. One generation of history is kept."
  }
}