omp · TypeScript · Node.js
destructive-check
A guard for the omp coding agent. Deletes, moves, writes outside the project, destructive git, credential files and fork bombs are decided before they run.
What it does
Every decision passes static deny, then static allow, and finally one small model check. Most calls never reach the model.
There are five guard presets (simple, medium default, hard, custom, readonly); each rule resolves to block, ask, model or allow, and the most restrictive rule wins.
Highlights
Three layers
Static deny (system paths, secret files, fork bombs), static allow (build artifacts and temp files inside the project), then one bounded model check, measured at 1.7-3.0 seconds.
A floor no setting re-opens
guardSelf, catastrophic, systemTarget and protectSecrets are a floor that no configuration can loosen.
The model is never blamed
If the checker itself fails or times out the guard asks you; headless sessions block with the real error text.
One config file
~/.omp/destructive-check.json, edited through the /dc menu; a project's own .omp/destructive-check.json may only tighten the policy.
