Safety

Three independent layers, so one bug doesn't open the door:

1. File tools (read, edit, write, list, grep, glob, and the cwd of shell) are confined to the folder you started in. Paths are resolved first, so .. and symlinks that point out are refused. Add roots on purpose with --add-dir.
2. Shell commands are scanned for paths in your home, /etc, other users' folders, or .. escapes, and refused before they run. History-destroying git commands are blocked.
3. OS sandbox (macOS sandbox-exec, on by default; none on Linux or Windows yet, see Windows notes). Even a dynamically built command cannot write outside the workspace, temp dirs and package caches, or read ~/.ssh, ~/.aws, ~/.gnupg and keychains. sandbox = "off" disables it.

Plus:

• .env*, *.pem, *.key and SSH keys are protected by default.
• Allow / deny / ask rules in Claude Code's notation: Bash(git diff:*), Edit(src/**), Read(.env*), WebFetch(domain:...).
• gh and curl run outside the sandbox (they need the keychain login and the network) but only as one plain command, only after you approve, even in auto mode. Chained or piped ones stay sandboxed.
• web_fetch refuses localhost, private ranges and cloud metadata at every redirect hop (SSRF-safe).
• Project trust: a repo's .zerd/config.toml cannot enable hooks, mcp_servers, verify_commands, verify_rules, approval or shell_environment until you trust that exact file (--trust). Editing the file revokes the trust. A cloned repo can't quietly turn on code execution.
• Approvals show a diff, and what you approve is exactly what gets written: preview and write share one planner. Choices are yes / yes and don't ask again / no, and tell me what to do differently (your reply goes to the model).
• Atomic writes for files and sessions.
• /undo: before each request zerd records the working tree as a commit object (refs/zerd/backup, nothing touches your index or stash). /undo restores what the last request changed and removes files it created. Untracked files that existed before are never deleted.

Approval modes: on-request (default), auto-edit, auto, plan (read-only, ends in a plan), never, on-failure, yolo. Shift+Tab cycles them.