Safety rules

Rules for driving BeSwarm safely — especially when an agent is the one running the commands.

Addressing

• Always name the agents you start, and address them by name or terminal id — never by kind.
• Parse ids and names from command output (status, agent list, workspace list). Don't derive them from tab order or examples.
• Pass --session explicitly when working outside default.
• Don't agent focus unless the user asked to switch context.

Commands that kill running work

These stop agents, close tabs or delete checkouts:

Command	Effect
server stop	Kills every tab helper and shell in the session.
terminal close	Kills a tab's shell.
agent close --group	Stops every agent in the group and closes its tabs.
workspace remove --yes	Closes every terminal the workspace owns.
worktree close	Kills the worktree's shells.
worktree remove	Also deletes the checkout, and its branch if merged.
session close	Kills one session's helpers and shells. Layout kept.
session clear	Deletes sessions. Not undoable.
session reset	Removes every workspace and tab from default, killing its shells. Not undoable.

Ownership

• Don't stop, close or remove agents, tabs, groups, workspaces, worktrees or sessions you didn't create unless the user explicitly asked.
• Never add --force or --yes just to get past a refusal.
• Don't add a plugin the user hasn't asked for. Plugins run as the user, with no sandbox.
• Never run server stop or update --handoff from inside the session you're running in unless you intend to stop it.

Permission prompts

Don't answer a blocked agent's permission prompt without the user's consent. Read it with agent read --source visible first, then answer with agent send-keys only once the user agrees.