Three shell calls through the approval order The approval order for the shell calls of guarded.yaml, top down. The preempt_yolo hook log-hook.sh runs on every call and returns allow, which is advice only. A deny pattern shell:cmd=rm* blocks rm -rf work/m101-nothing with Tool shell is denied by permissions configuration. An allow pattern shell:cmd=echo* runs echo m101-ok in both modes. The file has no ask patterns. The safety mode then decides pwd, which has the label safe: restricted runs it and prints the capture directory, and strict asks the user, which under exec with no terminal ends as The user rejected the tool call. SHELL CALLS OF GUARDED.YAML, --SAFETY STRICT AND RESTRICTED 20-STRICT.NDJSON, 20-RESTRICTED.NDJSON preempt_yolo hook log-hook.sh, on every call allow, as advice only pre_tool_use_pre_yolo, allowed: true a deny or ask here would end the call go on a deny pattern matches? shell:cmd=rm* rm -rf work/m101-nothing Tool 'shell' is denied by permissions configuration. no an allow pattern matches? shell:cmd=echo* echo m101-ok runs result m101-ok in both modes no an ask pattern matches? guarded.yaml has none no safety mode on the label pwd has the label safe restricted: pwd runs result $CAPTURE strict strict: ask the user default hooks first, none here no terminal under --exec The user rejected the tool call.