Module install 

Shared write-guard arm/disarm machinery.

Each harness’s installer (in its adapter module, e.g. crate::adapters::claude_code::guard) writes a marker listing the allowed roots and merges a PreToolUse hook into that harness’s project config, using the marker/manifest helpers here. Arming also initializes a privacy-safe raw denial log under the guarded task env; disarming preserves that evidence. The original hook file is backed up verbatim in a manifest so teardown_guard restores it exactly.

The hook command points at the running binary (std::env::current_exe), so there is no separate hook script to ship and no interpreter to select.

Constants

GUARD_MANIFEST

Manifest recording what install changed, so teardown can restore it.

GUARD_MARKER

Marker file (under the staged skills dir) that arms the guard.

Functions

teardown_guard

Disarm the guard: restore the original harness hook file (or delete it if we created it) and remove the marker + manifest, for every harness’s skills dir. Safe to call when no guard is installed. Returns true if a guard was found and torn down.