Auto Guard

auto-guard

English | [简体中文](README.zh-CN.md)

A **command-review safety net for AI coding agents**. Before the host executes a command or reads/writes a file, auto-guard decides **allow / deny / ask** using layered static rules, caches, learned rules, audit history and a one-shot LLM review (DeepSeek by default). It is meant to sit on top of full-access mode: dangerous commands are blocked, routine ones pass in milliseconds, and only genuinely uncertain cases reach the LLM or a human.


Why

• Full-access mode is productive but scary. Existing LLM-based approval mechanisms (Claude Code auto mode, Codex auto-review) send every command to a model, which is slow and expensive.
• In practice most agent shell commands are safe, simple and highly repetitive. So the review prompt is minimal (no context payload), and anything already adjudicated is served from one of several caches. Measured over short-term daily use, review cost stays around 1–4% of total spend and keeps dropping as history accumulates.
• Latency is dominated by the layers, not the LLM: whitelist and cache hits return without any model call, so the guard is effectively invisible.

Install

auto-guard is **not on npm** — the repo is a private pnpm workspace whose packages depend on each other via `workspace:*` (only resolvable inside the workspace), so `npm i -g git+…` cannot work either. Clone the repo and run the TypeScript entries directly with Node ≥ 22.18 (the core has zero runtime dependencies; the SQLCipher audit store is an optional native dependency that falls back automatically when absent). Windows and macOS work exactly the same:

git clone https://github.com/Ayle5678/auto-guard.git
cd auto-guard
pnpm install
pnpm build                                   # produces dist/ — the zcode/claude/opencode/qoder/codex hooks point at it
node packages/cli/src/auto-guard.ts init     # installer: dete