block-sudo

━━ when it runs

• PreToolUsebefore the tool call runs. a denial here means the command never executes at all.
• PermissionRequestwhen the agent asks you to approve an action.

watchesnarrowed to the Bash tool

this pack enforces: a match returns a real denial rather than being recorded and discarded. what the denial then does depends on the event above.

━━ parameters

these are the publisher's declared defaults, and a pack policy runs on them. values saved from the dashboard are stored under the bare policy name and are not currently read back for pack policies.

• allowPatternsstring[]default []

  Sudo command patterns to allow, matched token-by-token (e.g. 'sudo systemctl status')

━━ install

this one is on by default — taking the pack without flags turns it on, and the picker shows it pre-ticked.

• just this policy$failproofai policies add FailproofAI/policies --policy block-sudo⧉ copy
• the whole pack$failproofai policies add FailproofAI/policies⧉ copy
• turn just this off$failproofai policies remove block-sudo⧉ copy
• pick from a list$failproofai policies add⧉ copy
• uninstall the pack$failproofai policies remove FailproofAI/policies⧉ copy

ships in FailproofAI/policies · v2.0.0 · source ↗

━━ also in dangerous commands

• block-curl-pipe-shBlock piping downloads to shell
• block-rm-rfPrevent catastrophic deletions
• block-secrets-writeBlock writing secret key files