Guardian (safety guard)

The Guardian keeps your secrets out of the model and puts a speed bump in front of commands that can't be undone. On by default, in every tool and on every plan.

What it does

The Guardian checks two things your coding agent does in Cursor, Claude Code and Codex: reading a file, and running a shell command. It runs on your Mac, before the agent acts, on Pro, the trial and the free tier, and even while routing is paused or the Mac is signed out. (The session watchdog is different: it is off while OptiFlume is paused or the Mac is signed out.) Its warnings start with [OptiFlume Guardian].

Secret files and keys

When the agent reads a file that usually holds credentials, the Guardian replaces the whole file with a one-line notice, so the contents never reach the model:

.env and its variants such as .env.local or .env.production
credentials.json and service-account JSON files
Private keys and certificates: *.pem, *.key, id_rsa, id_ed25519

In every other file it reads, the Guardian replaces recognizable secrets with a marker such as <REDACTED:github_token> and leaves the rest of the file intact. It recognizes:

AWS access keys and secret keys
GitHub, Slack and OpenAI-style tokens, and Stripe live secret keys
JSON Web Tokens
Database connection strings for Postgres, MySQL, MongoDB, Redis and AMQP
Private key blocks
API keys, secrets and access tokens assigned in code or configuration
Payment card numbers and bank account details (IBANs)
Personal details such as phone numbers and national ID numbers

Destructive commands

Before the agent runs a shell command that cannot easily be undone, the Guardian shows a warning. By default the command still runs; turn on blocking and it is stopped instead. It looks out for:

Forced recursive deletes (rm -rf)
Force pushes, git reset --hard and git clean -f
Dropping or truncating database tables, and DELETE FROM without a WHERE clause
chmod 777
Writing straight to a disk device, and formatting one (mkfs)
Piping a download into a shell (curl … | sh)

It also warns, without blocking, before commands that would print secrets into the conversation: cat .env, echoing variables named like keys, secrets or tokens, and printenv, env or set on their own.

Configure it

Safety settings live in a safety section of ~/.optiflume/config/advanced-config.json. The file does not exist until you create it; every key is optional, and anything you leave out keeps its default.

{
  "safety": {
    "enabled": true,
    "redact_env_files": true,
    "warn_destructive_commands": true,
    "block_destructive_commands": false,
    "whitelisted_files": ["fixtures/fake.env"],
    "whitelisted_commands": ["rm -rf ./build"]
  }
}

Key	Default	What it does
`enabled`	`true`	Turns the Guardian on or off.
`redact_env_files`	`true`	Hides secret files entirely. Secrets inside other files are still redacted when this is off.
`warn_destructive_commands`	`true`	Warns before destructive commands.
`block_destructive_commands`	`false`	Stops destructive commands instead of warning. Takes effect only while `warn_destructive_commands` is on.
`whitelisted_files`	`[]`	Any file whose path contains one of these strings is read as is, with no redaction.
`whitelisted_commands`	`[]`	Any command that contains one of these strings runs with no warning or block.

Changes apply to the next file read or command; there is nothing to restart. Setting the three on/off choices for all your Macs from console settings is coming soon. All settings are in the Settings reference.

The audit log

Every hidden file, redaction, warning and block is recorded on your Mac in ~/.optiflume/telemetry/safety-audit.ndjson, kept for 90 days. It records the file path or the first 200 characters of the command, never the secret itself. The daily usage rollup carries only the counts; see Analytics and telemetry.

tail -20 ~/.optiflume/telemetry/safety-audit.ndjson

Limits

The Guardian recognizes common secret formats and file names; it is a safety net, not a replacement for keeping secrets out of your repository. If the Guardian itself fails, the read or command goes ahead unchanged rather than blocking your work.