{
  "id": "core",
  "name": "核心护栏",
  "description": "任何项目都该装的最小保险:拦直推主干、危险命令、密钥写入与读取、丢弃工作区操作、手改 lockfile,并保护护栏自身不被关闭。全部 fail-open,可用 kimi-boost guard 调整。",
  "tags": [
    "core",
    "guardrails",
    "security",
    "cross-stack"
  ],
  "version": "1.2.0",
  "hooks": [
    {
      "event": "PreToolUse",
      "matcher": "Bash",
      "script": "protect-main.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Bash",
      "script": "block-dangerous.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Bash",
      "script": "git-destructive.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Write",
      "script": "secret-scan.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Edit",
      "script": "secret-scan.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Read",
      "script": "protect-credentials.mjs",
      "timeout": 5,
      "args": ["--tool=read"]
    },
    {
      "event": "PreToolUse",
      "matcher": "Bash",
      "script": "protect-credentials.mjs",
      "timeout": 5,
      "args": ["--tool=bash"]
    },
    {
      "event": "PreToolUse",
      "matcher": "Write",
      "script": "protect-guards.mjs",
      "timeout": 5,
      "args": ["--tool=write"]
    },
    {
      "event": "PreToolUse",
      "matcher": "Edit",
      "script": "protect-guards.mjs",
      "timeout": 5,
      "args": ["--tool=edit"]
    },
    {
      "event": "PreToolUse",
      "matcher": "Bash",
      "script": "protect-guards.mjs",
      "timeout": 5,
      "args": ["--tool=bash"]
    },
    {
      "event": "PreToolUse",
      "matcher": "Write",
      "script": "protect-paths.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Edit",
      "script": "protect-paths.mjs",
      "timeout": 5
    },
    {
      "event": "PreToolUse",
      "matcher": "Bash",
      "script": "protect-paths.mjs",
      "timeout": 5,
      "args": ["--tool=bash"]
    },
    {
      "event": "PostToolUse",
      "script": "secret-scan-post.mjs",
      "timeout": 5
    }
  ]
}