Solutions
You already approved all of it.
The realistic failure is not an attacker with a shell. It is an agent doing exactly what it was asked, to the wrong copy of something — and no prompt firing, because you allowed that months ago, one convenient afternoon at a time.
The deny rule that didn't hold
A wildcard interpreter grant subsumes a deny rule: anything the denied tool could do, the interpreter can do. The guard reads the command that will actually run.
Fixes you read first
No silent remediation. Every fixable finding is written to disk as a shell script you can open before anything runs it, and settings are backed up first.
What the session cost
Model use and API-equivalent spend rebuilt from the transcripts already on your Mac, with the specific waste named rather than a total to feel bad about.
Where it sits
A permission list sitting beside a general interpreter is advice. The guard is a PreToolUse hook, so it sees the call after the permission list has decided and before anything runs — which is the one place a wildcard grant cannot step around. The enforcement pipeline page has the surfaces it inspects and the fourteen cases it is tested against.
It asks rather than refusing. Block, allow once, or allow for a set time; the override expires on its own and is listed with a Revoke button. A control that only ever says no is a control you will switch off by Thursday.
Measure before you change anything
The order is load-bearing. Checks run against the actual machine — permission lists, file flags, hooks, snapshots, open database handles — and each reports the evidence it found rather than a green tick. Most machines score badly the first time; that is the finding, not a failure.
Every rule is a shell probe you can read, edit, re-weight or replace, and the score follows whatever pack is loaded. How the score works.
The part that is about money, not safety
Cache hit rate, context carried past the line, the same file read twice in one session, a 200-line instruction file re-sent on every turn. Each finding says which meter its tokens sat on, so the figure uses the rate that traffic was actually billed at. The detectors.