Skip to content

v1.0.0

Choose a tag to compare

View all tags
@karlkfi karlkfi released this 04 Jul 14:17
v1.0.0
267aeb2

Initial release: a Claude Code PreToolUse hook that guards Bash infrastructure commands against two threats — prod blast-radius (mutating verb resolving to a production target → deny, PROD_GUARD_OVERRIDE=<reason> downgrades to a confirmation prompt) and ambient-context clobbering (mutating command relying on shared current-context/active-config state → ask, steering to per-command pinning).

  • Covered tools: kubectl/oc, helm, flux, argocd, gcloud, aws/eksctl, az, terraform/tofu, docker/podman/nerdctl/docker-compose, gh, doctl, kubectx/kubens, kustomize
  • Compound-command evaluation: &&/|/;/newlines/$( )/backticks/sh -c bodies/wrappers are split and each segment judged
  • Fail-open on infrastructure errors, fail-closed on the security decision (unknown target + mutating verb always prompts); never emits allow
  • Configurable prod/nonprod patterns: ~/.claude/prod-guard.json, project .claude/prod-guard.json, PROD_GUARD_* env vars — all additive over built-ins
  • 175 tests: decision matrix, adversarial bypass battery, per-tool verb sweeps, ambient-reader fixtures, robustness corpus

Install:

/plugin marketplace add karlkfi/claude-prod-guard
/plugin install prod-guard@prod-guard
Assets 2
Loading