freeze-mode

Files (2)

• SKILL.md
• freeze-mode.js · scripts/

SKILL.md (first lines)

# Freeze Mode

## When to Use

- Production debugging, audits, incident review, or evidence collection that
  must not mutate anything.
- Work that stays read-only until a human lifts the freeze.
- Situations where `careful-mode` guards too few operations.

## Script

- `node scripts/freeze-mode.js enable`: activates `freeze-mode` for the current
  Claude session.
- `node scripts/freeze-mode.js status`: reports activation, state location, and
  protections.
- `node scripts/freeze-mode.js disable`: deactivates the mode.

Flags: `--session <id>` targets another session; `--json` prints
machine-readable output.

## Protections

While active, the `PreToolUse` router:

- Blocks every non-Bash tool outside `READ_ONLY_TOOLS` in
  `hooks/scripts/lib/hook-router/pretool-policy.js`.
- Blocks every Bash command outside `FREEZE_MODE_ALLOWED_BASH` in
  `hooks/scripts/lib/hook-router/freeze-mode-rules.js`.
- Blocks shell chaining, command substitution, pipes, and redirections.

## Gotchas

- The mode adds friction; it does not replace change control, approvals, or
  runbooks.
- The allowlist favors false positives: command families with mutating forms
  are excluded entirely.
- Disable the mode before implementing fixes.
- Mode state is session-scoped; check `status` before claiming a session stayed
  read-only.
- Without `${CLAUDE_PLUGIN_DATA}`, mode state falls back to temp storage.

## Completion Check

Before claiming the session stayed read-only, report:

- The command used to enable the mode.
- The `status` evidence before the investigation.
- The read-only evidence gathered.
- Any blocked tool or shell attempt.
- The `status` evidence after disabling the mode.

From leo110047/goldband, MIT.

More from leo110047/goldband