Solutions

You already approved all of it.

The realistic failure is not an attacker with a shell. It is an agent doing exactly what it was asked, against the live store rather than a copy of it — your real message database, not an extract — and no prompt firing, because you allowed that months ago, one convenient afternoon at a time.

The grant is wider than the rule A wildcard interpreter grant drawn around a deny rule that sits inside it, because anything the denied tool could do the interpreter can do. Bash(python3 -c *) APPROVED ONCE, MONTHS AGO deny sqlite3 is inside it anything the denied tool could do, the interpreter can do the scan names the grant, with the file and the line

The deny rule that didn't hold

A wildcard interpreter grant subsumes a deny rule: anything the denied tool could do, the interpreter can do. The scan flags the grant, with the file and the line.

Fixes you read first

No silent remediation. Every fixable finding is written to disk as a shell script you can open before anything runs it, and settings are backed up first.

What the session cost

Model use and API-equivalent spend rebuilt from the transcripts already on your device, with the specific waste named rather than a total to feel bad about.

Where it sits

A permission list sitting beside a general interpreter is advice. The guard is a PreToolUse hook, so it sees the call after the permission list has decided and before anything runs. It reads the command as text: a path to an original written plainly in it is caught, and the same path assembled at runtime is not. The enforcement pipeline page has the surfaces it inspects and the fourteen cases it is tested against.

Which agents that covers. PreToolUse is a Claude Code hook, so Claude Code is where calls are stopped before they run. Every other agent the Roster reads — Claude Desktop, Cursor, Windsurf, Continue, Zed, VS Code, Codex — is scanned and scored, and what it can reach is reported, but nothing is intercepted there.

So the grant is still the thing to fix. Scope python3 -c * down to the script you meant; the guard narrows what a redirected call can reach in passing, and is not a reason to leave an interpreter wildcarded.

It asks rather than refusing. Block, allow once, or allow for a set time; the override expires on its own and is listed with a Revoke button. A control that only ever says no is a control you will switch off by Thursday.

Measure before you change anything

The order is load-bearing. Checks run against the actual machine — permission lists, file flags, hooks, snapshots, open database handles — and each reports the evidence it found rather than a green tick. Most machines score badly the first time; that is the finding, not a failure.

Every rule is a shell probe you can read, edit, re-weight or replace, and the score follows whatever pack is loaded. How the score works.

The part that is about money, not safety

Cache hit rate, context carried past 150K tokens, the same file read twice in one session, a 200-line instruction file re-sent on every turn. Each finding says which meter its tokens sat on, so the figure uses the rate that traffic was actually billed at. The detectors.