guard

brigade guard is the CLI for the content guard scanner embedded in brigade-cli. The same packaged scanner and policies back brigade scrub, so a fresh Brigade install can scan without a separate content-guard checkout.

Set CONTENT_GUARD_DIR only when you intentionally want Brigade to run an external content-guard checkout instead of the embedded brigade.guard package. Leaving it unset is the default path.

Embedded scanner commands

• brigade guard scan [target] scans a file, directory, or stdin against a policy. It exits nonzero when blocking findings exist.
• brigade guard redact [target] prints redacted output, or rewrites a file or directory with --in-place.
• brigade guard diff [target] shows the redaction diff without rewriting.
• brigade guard audit <dir> aggregates findings across a directory. Use --strict when findings should fail the command.
• brigade guard baseline init <dir> records current findings so later scans can focus on new findings.
• brigade guard allow add <value> and brigade guard allow list manage private allow_values for known-public literals.

brigade guard scan README.md
brigade guard scan src/content/docs --policy public-content
printf '%s\n' "$DRAFT_TEXT" | brigade guard scan --policy public-content

Git and publish commands

• brigade guard git scans staged files by default, or all tracked files with --all-tracked.
• brigade guard git --history scans content introduced by commits, which catches leaks that were later removed from the tip.
• brigade guard commits scans commit messages. Use --range origin/main..HEAD or --all.
• brigade guard publish-check runs the local publish gate for PR bodies, staged files, commit messages, and optionally all tracked files.
• brigade guard pr <body.md> scans a PR draft and writes sanitized copy plus a JSON report.
• brigade guard pr-prepare [body.md] prepares a reusable PR body bundle under .content-guard/pr-drafts.
• brigade guard n8n-advisory reads one JSON payload from stdin and returns advisory JSON for workflow branching.
• brigade guard n8n-validate runs the bundled n8n advisory fixtures.

brigade guard git
brigade guard git --all-tracked
brigade guard git --history --range origin/main..HEAD

brigade guard publish-check
brigade guard publish-check --pr-body .brigade/pr-body.md
brigade guard publish-check --all-tracked --commit-range origin/main..HEAD

Scrub shortcut

brigade scrub --target . --policy public-repo is the repo-level shortcut. It uses the embedded scanner by default, resolves packaged policies first, and writes a summary receipt at .brigade/scrub/latest.json unless --no-receipt is passed.

brigade scrub --target .
brigade scrub --target . --policy public-content
brigade scrub --target . --policy public-repo --dry-run