Zsh is fast, flexible, and powerful. It is also unforgiving. A small typo in a destructive command can wipe files or damage environments. Guardrails for Zsh add a protective layer between you and disaster. These are rules, intercepts, and prompts that block or confirm risky actions before they run.
Setting up Zsh guardrails starts with hooks and shell functions. You define checks for commands like rm -rf, git push --force, or kubectl delete. The guardrail intercepts them, asks for confirmation, or refuses to run if conditions fail. This control extends to environment variables, directory paths, and even branch names.
Advanced guardrails use preexec functions to scan commands right before execution. They can match patterns, reject commands, or log them for audit. They integrate with .zshrc, aliases, and completion scripts. Guardrails also help enforce best practices—such as requiring --safe flags or blocking commands outside certain paths.