# guard

`brigade guard` is the CLI for the content guard scanner embedded in `brigade-cli`. The same packaged scanner and policies back `brigade scrub`, so a fresh Brigade install can scan without a separate `content-guard` checkout.

Set `CONTENT_GUARD_DIR` only when you intentionally want Brigade to run an external content-guard checkout instead of the embedded `brigade.guard` package. Leaving it unset is the default path.

## Embedded scanner commands

- `brigade guard scan [target]` scans a file, directory, or stdin against a policy. It exits nonzero when blocking findings exist.
- `brigade guard redact [target]` prints redacted output, or rewrites a file or directory with `--in-place`.
- `brigade guard diff [target]` shows the redaction diff without rewriting.
- `brigade guard audit <dir>` aggregates findings across a directory. Use `--strict` when findings should fail the command.
- `brigade guard baseline init <dir>` records current findings so later scans can focus on new findings.
- `brigade guard allow add <value>` and `brigade guard allow list` manage private `allow_values` for known-public literals.

```bash
brigade guard scan README.md
brigade guard scan src/content/docs --policy public-content
printf '%s\n' "$DRAFT_TEXT" | brigade guard scan --policy public-content
```

## Git and publish commands

- `brigade guard git` scans staged files by default, or all tracked files with `--all-tracked`.
- `brigade guard git --history` scans content introduced by commits, which catches leaks that were later removed from the tip.
- `brigade guard commits` scans commit messages. Use `--range origin/main..HEAD` or `--all`.
- `brigade guard publish-check` runs the local publish gate for PR bodies, staged files, commit messages, and optionally all tracked files.
- `brigade guard pr <body.md>` scans a PR draft and writes sanitized copy plus a JSON report.
- `brigade guard pr-prepare [body.md]` prepares a reusable PR body bundle under `.content-guard/pr-drafts`.
- `brigade guard n8n-advisory` reads one JSON payload from stdin and returns advisory JSON for workflow branching.
- `brigade guard n8n-validate` runs the bundled n8n advisory fixtures.

```bash
brigade guard git
brigade guard git --all-tracked
brigade guard git --history --range origin/main..HEAD
```

```bash
brigade guard publish-check
brigade guard publish-check --pr-body .brigade/pr-body.md
brigade guard publish-check --all-tracked --commit-range origin/main..HEAD
```

## Scrub shortcut

`brigade scrub --target . --policy public-repo` is the repo-level shortcut. It uses the embedded scanner by default, resolves packaged policies first, and writes a summary receipt at `.brigade/scrub/latest.json` unless `--no-receipt` is passed.

```bash
brigade scrub --target .
brigade scrub --target . --policy public-content
brigade scrub --target . --policy public-repo --dry-run
```