https://latent-site.pages.dev/tags/workspaceguard/ Recent content in WorkspaceGuard on Latent Hugo zh 2026 Latent Sun, 13 Sep 2026 00:00:00 +0000 https://latent-site.pages.dev/posts/2026/09/pocketpilot-03-policy/ Sun, 13 Sep 2026 00:00:00 +0000 https://latent-site.pages.dev/posts/2026/09/pocketpilot-03-policy/ PocketPilot 不按工具名写白名单：路径先过 WorkspaceGuard，再按 capability 后缀分成 ALLOW / REQUIRE_APPROVAL / DENY。写操作在磁盘变更前用异常打断；批准恢复时重建 Guard，下一次 write 还要再批。配策略决策图。