@raishin/vanguard-frontier-agentic 3.15.0 → 3.17.0

package/mods/live-guard-gate/mod.toml

@@ -0,0 +1,34 @@
+[mod]
+id = "live-guard-gate"
+name = "Live Guard Gate"
+description = "Asks before live cloud mutations and names the guard agent that should review them."
+version = "1.0.0"
+reach_level = 0
+events = ["PreToolUse"]
+
+[footprint]
+env_reads = []
+file_writes = []
+spawns = []
+egress_hosts = []
+
+[harnesses.claude-code]
+supported = true
+surfaces = ["native", "classic"]
+events = ["PreToolUse"]
+
+[harnesses.kiro]
+supported = true
+requires = ["node"]
+events = ["PreToolUse"]
+
+[harnesses.kiro.degraded]
+PreToolUse = "Kiro documents no confirmation protocol or stdin field names; the whole payload is scanned and a hit is denied."
+
+[harnesses.codex]
+supported = true
+requires = ["node"]
+events = ["PreToolUse"]
+
+[harnesses.codex.degraded]
+PreToolUse = "Codex rejects ask; a hit is denied with a reason."

package/mods/live-guard-gate/patterns.json

@@ -0,0 +1,522 @@
+[
+  {
+    "id": "live-iac-terraform-pulumi",
+    "name": "Terraform/OpenTofu/Terragrunt/Pulumi state-changing command",
+    "description": "terraform|tofu|terragrunt apply|destroy|import|taint|untaint|force-unlock|state rm|mv|push; pulumi up|destroy|refresh|import|cancel. Cloud is not knowable from the command, so every IaC guard that explicitly covers Terraform/stacks is listed; consult the one for the target cloud.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:(?:terraform|tofu|terragrunt)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,4}[ \\t]+(?:run-all[ \\t]+)?(?:apply|destroy|import|taint|untaint|force-unlock|state[ \\t]+(?:rm|mv|push))(?![^ \\t\\r\\n;&|)])|pulumi(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,4}[ \\t]+(?:up|destroy|refresh|import|cancel)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "aws-live-iac-change-guard-agent",
+      "oci-live-resource-manager-stack-guard-agent",
+      "azure-live-arm-deployment-stack-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-aws-cloudformation-cdk",
+    "name": "CloudFormation / CDK mutation",
+    "description": "aws cloudformation create/update/delete-stack[-set], deploy, execute-change-set, update-termination-protection; cdk deploy|destroy|bootstrap.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:aws(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]cloudformation[ \\t]+(?:create-stack|update-stack|delete-stack|create-stack-set|update-stack-set|delete-stack-set|deploy|execute-change-set|update-termination-protection)(?![^ \\t\\r\\n;&|)]))|cdk(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:deploy|destroy|bootstrap)(?![^ \\t\\r\\n;&|)])))",
+    "agents": [
+      "aws-live-iac-change-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-aws-ecs",
+    "name": "aws ecs mutation",
+    "description": "aws ... ecs (create|delete|update|put|run|start|stop|register|deregister)-*.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])aws(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]ecs[ \\t]+(?:create|delete|update|put|run|start|stop|register|deregister)-[a-z0-9-]+(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "aws-live-ecs-rollout-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-aws-lambda-apigw-serverless",
+    "name": "Lambda / API Gateway / Serverless Framework release",
+    "description": "aws lambda (create|delete|update|publish|put|add|remove)-*; aws apigateway|apigatewayv2 (create|delete|update|put|import)-*; serverless|sls deploy|remove|rollback.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:aws(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:lambda[ \\t]+(?:create|delete|update|publish|put|add|remove)|apigateway(?:v2)?[ \\t]+(?:create|delete|update|put|import))-[a-z0-9-]+(?![^ \\t\\r\\n;&|)]))|(?:serverless|sls)(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:deploy|remove|rollback)(?![^ \\t\\r\\n;&|)])))",
+    "agents": [
+      "aws-live-serverless-release-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-aws-sam",
+    "name": "SAM deploy/delete",
+    "description": "sam deploy|delete. Both the serverless-release and IaC guards apply (SAM is CloudFormation-backed Lambda).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])sam(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:deploy|delete)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "aws-live-serverless-release-guard-agent",
+      "aws-live-iac-change-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-azure-arm-stack",
+    "name": "az deployment / stack create|delete",
+    "description": "az deployment [sub|group|mg|tenant] create|delete and az stack [sub|group|mg] create|delete. what-if / validate / show / list are excluded.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:deployment|stack)[ \\t]+(?:(?:sub|group|mg|tenant)[ \\t]+)?(?:create|delete)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "azure-live-arm-deployment-stack-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-azure-aks",
+    "name": "az aks mutation",
+    "description": "az aks create|delete|update|upgrade|scale|stop|start|rotate-certs|operation-abort and az aks nodepool add|delete|scale|update|upgrade|start|stop.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]aks[ \\t]+(?:(?:create|delete|update|upgrade|scale|stop|start|rotate-certs|operation-abort)|nodepool[ \\t]+(?:add|delete|scale|update|upgrade|start|stop))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "azure-live-aks-rollout-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-azure-slot-swap",
+    "name": "az webapp/functionapp deployment slot swap",
+    "description": "az webapp|functionapp deployment slot swap.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:webapp|functionapp)[ \\t]+deployment[ \\t]+slot[ \\t]+swap(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "azure-live-app-service-slot-swap-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-azure-keyvault",
+    "name": "az keyvault delete/purge/rotate",
+    "description": "az keyvault delete|purge and az keyvault key|secret|certificate delete|purge|rotate.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]keyvault[ \\t]+(?:(?:delete|purge)|(?:key|secret|certificate)[ \\t]+(?:delete|purge|rotate))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "azure-live-keyvault-rotation-purge-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-azure-role-assignment",
+    "name": "az role assignment/definition write",
+    "description": "az role assignment|definition create|update|delete.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]role[ \\t]+(?:assignment|definition)[ \\t]+(?:create|update|delete)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "azure-live-entra-role-assignment-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-azure-budget",
+    "name": "az consumption budget write",
+    "description": "az consumption budget create|update|delete.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]consumption[ \\t]+budget[ \\t]+(?:create|update|delete)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "azure-live-cost-budget-action-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-gcloud-gke",
+    "name": "gcloud container clusters/node-pools mutation",
+    "description": "gcloud container clusters|node-pools create|delete|update|upgrade|resize|rollback.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])gcloud(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]container[ \\t]+(?:clusters|node-pools)[ \\t]+(?:create|delete|update|upgrade|resize|rollback)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "gcp-live-gke-rollout-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-gcloud-run",
+    "name": "gcloud run deploy / traffic / delete",
+    "description": "gcloud run deploy; gcloud run services update|update-traffic|delete|replace; gcloud run revisions delete.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])gcloud(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]run[ \\t]+(?:deploy|(?:services|revisions)[ \\t]+(?:update|update-traffic|delete|replace))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "gcp-live-cloud-run-traffic-migration-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-gcloud-iam",
+    "name": "gcloud IAM binding / policy / SA key / org-policy mutation",
+    "description": "*-iam-policy-binding (add|remove|set), set-iam-policy, iam service-accounts keys create, iam roles create|update|delete, org-policies set-policy|delete.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])gcloud(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:(?:add|remove)-iam-policy-binding|set-iam-policy|iam[ \\t]+service-accounts[ \\t]+keys[ \\t]+create|iam[ \\t]+roles[ \\t]+(?:create|update|delete)|(?:resource-manager[ \\t]+)?org-policies[ \\t]+(?:set-policy|delete))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "gcp-live-iam-policy-change-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-gcloud-kms",
+    "name": "gcloud kms key version destroy/disable",
+    "description": "gcloud kms keys versions destroy|disable.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])gcloud(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]kms[ \\t]+keys[ \\t]+versions[ \\t]+(?:destroy|disable)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "gcp-live-kms-key-destruction-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-gcloud-billing-budget",
+    "name": "gcloud billing budgets write",
+    "description": "gcloud billing budgets create|update|delete.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])gcloud(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]billing[ \\t]+budgets[ \\t]+(?:create|update|delete)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "gcp-live-cost-budget-action-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-bq-destructive",
+    "name": "bq rm / truncate",
+    "description": "bq rm|truncate (dataset/table deletion).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])bq(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:rm|truncate)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "gcp-live-bigquery-dataset-deletion-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-k8s-rbac",
+    "name": "kubectl RBAC mutation",
+    "description": "kubectl|oc apply|create|delete|patch|replace|edit on role(s)/rolebinding(s)/clusterrole(s)/clusterrolebinding(s) given inline, or kubectl auth reconcile. Resources hidden inside -f manifests are not visible to a regex.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:(?:apply|create|delete|patch|replace|edit))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+(?:roles?|rolebindings?|clusterroles?|clusterrolebindings?)(?:\\.[a-z0-9.-]+)?(?:/|,|(?![^ \\t\\r\\n;&|)]))|(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:auth[ \\t]+reconcile)(?![^ \\t\\r\\n;&|)])",
+    "agents": [
+      "kubernetes-live-rbac-mutation-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-k8s-network-policy",
+    "name": "kubectl NetworkPolicy / Cilium policy mutation",
+    "description": "kubectl|oc apply|create|delete|patch|replace|edit on networkpolicy/netpol/ciliumnetworkpolicy/cnp/ciliumclusterwidenetworkpolicy/ccnp/ciliumegressgatewaypolicy/cegp.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:(?:apply|create|delete|patch|replace|edit))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+(?:networkpolic(?:y|ies)|netpol|ciliumnetworkpolic(?:y|ies)|cnp|ciliumclusterwidenetworkpolic(?:y|ies)|ccnp|ciliumegressgatewaypolic(?:y|ies)|cegp)(?:\\.[a-z0-9.-]+)?(?:/|,|(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "kubernetes-live-network-policy-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-k8s-admission-policy",
+    "name": "kubectl admission policy / webhook / Kyverno mutation",
+    "description": "kubectl|oc apply|create|delete|patch|replace|edit on validating/mutatingwebhookconfiguration, validating/mutatingadmissionpolicy[binding], clusterpolicy/cpol, policyexception/polex.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:(?:apply|create|delete|patch|replace|edit))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+(?:validatingwebhookconfigurations?|mutatingwebhookconfigurations?|validatingadmissionpolic(?:y|ies)|validatingadmissionpolicybindings?|mutatingadmissionpolic(?:y|ies)|mutatingadmissionpolicybindings?|clusterpolic(?:y|ies)|cpol|policyexceptions?|polex)(?:\\.[a-z0-9.-]+)?(?:/|,|(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "kubernetes-live-admission-policy-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-k8s-mesh-policy",
+    "name": "kubectl Istio policy mutation",
+    "description": "kubectl|oc apply|create|delete|patch|replace|edit on virtualservice, destinationrule, peerauthentication, requestauthentication, authorizationpolicy, serviceentry, envoyfilter.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:(?:apply|create|delete|patch|replace|edit))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+(?:virtualservices?|destinationrules?|peerauthentications?|requestauthentications?|authorizationpolic(?:y|ies)|serviceentr(?:y|ies)|envoyfilters?)(?:\\.[a-z0-9.-]+)?(?:/|,|(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "kubernetes-live-mesh-policy-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-argocd-sync",
+    "name": "argocd app/proj/appset mutation",
+    "description": "argocd app|proj|appset sync|rollback|delete|create|set|patch|edit|terminate-op, or kubectl on application(s).argoproj.io/appproject(s)/applicationset(s).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])argocd(?![A-Za-z0-9_-])[ \\t]+(?:app|proj|appset)[ \\t]+(?:sync|rollback|delete|create|set|patch|edit|terminate-op)(?![^ \\t\\r\\n;&|)])|(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:(?:apply|create|delete|patch|replace|edit))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,6}[ \\t]+(?:applications?|appprojects?|applicationsets?|[a-z]*applications?[.]argoproj[.]io)(?:\\.[a-z0-9.-]+)?(?:/|,|(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "kubernetes-live-argocd-sync-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-velero-restore",
+    "name": "velero restore / backup delete",
+    "description": "velero restore create|delete, velero create restore, velero backup|schedule delete, velero delete backup|restore|schedule. Backup create/describe/get excluded.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])velero(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:restore[ \\t]+(?:create|delete)|create[ \\t]+restore|(?:backup|schedule)[ \\t]+delete|delete[ \\t]+(?:backup|restore|schedule))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "kubernetes-live-velero-restore-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-kubectl-mutate",
+    "name": "kubectl/oc workload-mutating verb",
+    "description": "kubectl|oc apply|create|replace|patch|delete|scale|autoscale|edit|drain|cordon|uncordon|taint|annotate|label|set|expose|rollout restart|undo|pause|resume, unless --dry-run=client|server. Cluster provider unknown, so the managed-Kubernetes rollout guards are listed; consult the one for the cluster. Specific kubernetes-live-* patterns above win (first match).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:kubectl|oc)(?![A-Za-z0-9_-])(?![^;&|\\n]*[ \\t]--dry-run(?:=(?:client|server|true))?(?![^ \\t\\r\\n;&|)]))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:apply|create|replace|patch|delete|scale|autoscale|edit|drain|cordon|uncordon|taint|annotate|label|set|expose|rollout[ \\t]+(?:restart|undo|pause|resume))(?![^ \\t\\r\\n;&|)])",
+    "agents": [
+      "azure-live-aks-rollout-guard-agent",
+      "gcp-live-gke-rollout-guard-agent",
+      "oci-live-oke-rollout-guard-agent",
+      "huawei-live-cce-rollout-guard-agent",
+      "alibaba-live-ack-rollout-guard-agent",
+      "scaleway-live-kapsule-rollout-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-helm-mutate",
+    "name": "helm install/upgrade/uninstall/rollback",
+    "description": "helm install|upgrade|uninstall|delete|rollback unless --dry-run. Same managed-Kubernetes rollout guards as live-kubectl-mutate.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])helm(?![A-Za-z0-9_-])(?![^;&|\\n]*[ \\t]--dry-run(?:=(?:client|server|true))?(?![^ \\t\\r\\n;&|)]))(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:install|upgrade|uninstall|delete|rollback)(?![^ \\t\\r\\n;&|)])",
+    "agents": [
+      "azure-live-aks-rollout-guard-agent",
+      "gcp-live-gke-rollout-guard-agent",
+      "oci-live-oke-rollout-guard-agent",
+      "huawei-live-cce-rollout-guard-agent",
+      "alibaba-live-ack-rollout-guard-agent",
+      "scaleway-live-kapsule-rollout-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-oci-network-security-rule",
+    "name": "oci network security-list / NSG rule mutation",
+    "description": "oci network security-list create|update|delete; oci network nsg rules add|update|remove; oci network nsg create|update|delete. add/update and security-list update are named in the oci-live-network-security-rule-guard-agent docs; the remaining verbs are from OCI CLI knowledge.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])oci(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]network[ \\t]+(?:security-list[ \\t]+(?:create|update|delete)|nsg[ \\t]+rules[ \\t]+(?:add|update|remove)|nsg[ \\t]+(?:create|update|delete))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "oci-live-network-security-rule-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-oci-iam-policy-compartment",
+    "name": "oci iam policy / dynamic-group / compartment mutation",
+    "description": "oci iam policy create|update|delete; oci iam dynamic-group create|update|delete; oci iam compartment delete|move. policy update|delete and dynamic-group update are named in the oci-live-iam-policy-compartment-guard-agent docs; the other verbs are from OCI CLI knowledge. Global flags before the service are tolerated by scanning the simple command.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])oci(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]iam[ \\t]+(?:policy[ \\t]+(?:create|update|delete)|dynamic-group[ \\t]+(?:create|update|delete)|compartment[ \\t]+(?:delete|move))(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "oci-live-iam-policy-compartment-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-oci-autonomous-db",
+    "name": "oci db autonomous-database lifecycle change",
+    "description": "oci db autonomous-database update|restore|start|stop|restart|delete|create-from-clone. update, restore, start and create-from-clone are named in the oci-live-autonomous-db-lifecycle-guard-agent docs; stop, restart and delete are from OCI CLI knowledge.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])oci(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t]db[ \\t]+autonomous-database[ \\t]+(?:update|restore|start|stop|restart|delete|create-from-clone)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "oci-live-autonomous-db-lifecycle-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-oci-budget-quota",
+    "name": "oci budgets / limits quota mutation",
+    "description": "oci budgets budget|alert-rule|alert create|update|delete; oci limits quota create|update|delete. budgets budget update, budgets alert update and limits quota create are named in the oci-live-cost-budget-runaway-guard-agent docs; the other verbs are from OCI CLI knowledge.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])oci(?![A-Za-z0-9_-])(?=[^;&|\\n]*[ \\t](?:budgets[ \\t]+(?:budget|alert-rule|alert)|limits[ \\t]+quota)[ \\t]+(?:create|update|delete)(?![^ \\t\\r\\n;&|)]))",
+    "agents": [
+      "oci-live-cost-budget-runaway-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-snowflake-rbac",
+    "name": "snowsql / snow sql GRANT, REVOKE, ALTER ROLE",
+    "description": "snowsql or 'snow sql' on the same line as a GRANT|REVOKE statement or ALTER ROLE (flags i). The SQL must be on the command line (-q); statements piped in or read from -f files are invisible. Statements inside string literals match (known false positive).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:snowsql|snow[ \\t]+sql)(?![A-Za-z0-9_-])(?=[^\\n]*[\"' \\t;](?:(?:grant|revoke)[ \\t]+[a-z]|alter[ \\t]+role[ \\t]))",
+    "agents": [
+      "snowflake-live-rbac-grant-guard-agent"
+    ],
+    "flags": "i",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-snowflake-warehouse",
+    "name": "snowsql / snow sql warehouse change",
+    "description": "snowsql or 'snow sql' with ALTER|DROP|CREATE [OR REPLACE|OR ALTER] WAREHOUSE (flags i). ALTER WAREHOUSE is named in the snowflake-live-warehouse-cost-change-guard-agent docs; CREATE and DROP are from Snowflake SQL knowledge.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:snowsql|snow[ \\t]+sql)(?![A-Za-z0-9_-])(?=[^\\n]*[\"' \\t;](?:alter|drop|create(?:[ \\t]+or[ \\t]+(?:replace|alter))?)[ \\t]+warehouse[ \\t])",
+    "agents": [
+      "snowflake-live-warehouse-cost-change-guard-agent"
+    ],
+    "flags": "i",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-snowflake-failover",
+    "name": "snowsql / snow sql failover group change",
+    "description": "snowsql or 'snow sql' with ALTER FAILOVER GROUP (flags i), named in the snowflake-live-failover-promotion-guard-agent docs.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:snowsql|snow[ \\t]+sql)(?![A-Za-z0-9_-])(?=[^\\n]*[\"' \\t;]alter[ \\t]+failover[ \\t]+group[ \\t])",
+    "agents": [
+      "snowflake-live-failover-promotion-guard-agent"
+    ],
+    "flags": "i",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-snowflake-auth-network-policy",
+    "name": "snowsql / snow sql network or authentication policy change",
+    "description": "snowsql or 'snow sql' with ALTER|DROP|CREATE [OR REPLACE] NETWORK|AUTHENTICATION POLICY (flags i). ALTER forms are named in the snowflake-live-auth-network-policy-guard-agent docs; CREATE and DROP are from Snowflake SQL knowledge.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:snowsql|snow[ \\t]+sql)(?![A-Za-z0-9_-])(?=[^\\n]*[\"' \\t;](?:alter|drop|create(?:[ \\t]+or[ \\t]+replace)?)[ \\t]+(?:network|authentication)[ \\t]+policy[ \\t])",
+    "agents": [
+      "snowflake-live-auth-network-policy-guard-agent"
+    ],
+    "flags": "i",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-snowflake-pipeline",
+    "name": "snowsql / snow sql pipe, task or dynamic table change",
+    "description": "snowsql or 'snow sql' with ALTER PIPE|TASK|DYNAMIC TABLE (flags i), named in the snowflake-live-pipeline-streaming-change-guard-agent docs.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:snowsql|snow[ \\t]+sql)(?![A-Za-z0-9_-])(?=[^\\n]*[\"' \\t;]alter[ \\t]+(?:pipe|task|dynamic[ \\t]+table)[ \\t])",
+    "agents": [
+      "snowflake-live-pipeline-streaming-change-guard-agent"
+    ],
+    "flags": "i",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-snowflake-data-protection",
+    "name": "snowsql / snow sql masking or row access policy application",
+    "description": "snowsql or 'snow sql' with SET|UNSET|ADD|DROP MASKING POLICY or ROW ACCESS POLICY (flags i), the ALTER TABLE column / row-access forms named in the snowflake-live-data-protection-policy-guard-agent docs. CREATE MASKING POLICY (definition only) is not matched.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])(?:snowsql|snow[ \\t]+sql)(?![A-Za-z0-9_-])(?=[^\\n]*[ \\t](?:set|unset|add|drop)[ \\t]+(?:masking|row[ \\t]+access)[ \\t]+policy(?![A-Za-z0-9_]))",
+    "agents": [
+      "snowflake-live-data-protection-policy-guard-agent"
+    ],
+    "flags": "i",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-aws-cli-mutation",
+    "name": "aws CLI mutating operation (fallback)",
+    "description": "aws [global flags] <service> <operation> where operation is (create|delete|update|terminate|modify|remove|attach|detach|disable|schedule|revoke|authorize|deregister|associate|disassociate|reboot|stop)-* or put-* (data-plane put-object/put-item/put-metric-data/put-log-events/put-record(s) excluded), plus aws s3 rb|rm|mb. No dedicated guard exists for most services (ec2, rds, iam, s3, ...): all AWS live guards are listed; aws-live-iac-change-guard-agent is the nearest change-control fit. The near-miss aws-live-deployment-guarded-operator-agent is outside the *-live-*-guard-agent glob and therefore not referenced.",
+    "regex": "(?:^|[^A-Za-z0-9_.-])aws(?![A-Za-z0-9_-])(?:[ \\t]+-[^ \\t\\r\\n;&|]+(?:[ \\t]+[^ \\t\\r\\n;&|-][^ \\t\\r\\n;&|]*)?){0,8}[ \\t]+(?:s3[ \\t]+(?:rb|rm|mb)|[a-z0-9][a-z0-9-]*[ \\t]+(?:(?:create|delete|update|terminate|modify|remove|attach|detach|disable|schedule|revoke|authorize|deregister|associate|disassociate|reboot|stop)-[a-z0-9-]+|put-(?!(?:object|item|metric-data|log-events|records?)(?![^ \\t\\r\\n;&|)]))[a-z0-9-]+))(?![^ \\t\\r\\n;&|)])",
+    "agents": [
+      "aws-live-ecs-rollout-guard-agent",
+      "aws-live-iac-change-guard-agent",
+      "aws-live-serverless-release-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-az-cli-mutation",
+    "name": "az CLI mutating verb (fallback)",
+    "description": "az <command path of up to 5 words> create|delete|update|purge|deallocate|scale|upgrade|start|stop|restart; the verb must sit in the command path before the first flag, so values of --query/--name are not mistaken for verbs. All Azure live guards listed (no service-specific guard matched).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])az(?![A-Za-z0-9_-])(?:[ \\t]+[a-z][a-z0-9-]*){0,5}[ \\t]+(?:create|delete|update|purge|deallocate|scale|upgrade|start|stop|restart)(?![^ \\t\\r\\n;&|)])",
+    "agents": [
+      "azure-live-aks-rollout-guard-agent",
+      "azure-live-app-service-slot-swap-guard-agent",
+      "azure-live-arm-deployment-stack-guard-agent",
+      "azure-live-cost-budget-action-guard-agent",
+      "azure-live-entra-role-assignment-guard-agent",
+      "azure-live-keyvault-rotation-purge-guard-agent",
+      "azure-live-pim-jit-activation-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  },
+  {
+    "id": "live-gcloud-cli-mutation",
+    "name": "gcloud mutating verb (fallback)",
+    "description": "gcloud <command path of up to 5 words> create|delete|update|deploy|patch|resize|restore|import|rm, verb in the path before the first flag. All GCP live guards listed (no service-specific guard matched).",
+    "regex": "(?:^|[^A-Za-z0-9_.-])gcloud(?![A-Za-z0-9_-])(?:[ \\t]+[a-z][a-z0-9-]*){0,5}[ \\t]+(?:create|delete|update|deploy|patch|resize|restore|import|rm)(?![^ \\t\\r\\n;&|)])",
+    "agents": [
+      "gcp-live-bigquery-dataset-deletion-guard-agent",
+      "gcp-live-cloud-run-traffic-migration-guard-agent",
+      "gcp-live-cost-budget-action-guard-agent",
+      "gcp-live-gke-rollout-guard-agent",
+      "gcp-live-iam-policy-change-guard-agent",
+      "gcp-live-kms-key-destruction-guard-agent"
+    ],
+    "flags": "",
+    "context": [
+      "bash"
+    ]
+  }
+]

package/mods/secret-redactor/.claude-plugin/plugin.json

@@ -0,0 +1,5 @@
+{
+  "name": "secret-redactor",
+  "version": "1.0.0",
+  "description": "Asks before tool calls whose input carries a credential and redacts credentials from tool output."
+}

package/mods/secret-redactor/README.md

@@ -0,0 +1,86 @@
+# Secret Redactor
+
+## Reach and declared footprint
+
+**L0 (no declared file writes, subprocess spawns or network egress).** The manifest
+only declares an environment read of `VANGUARD_SECRET_REDACTOR_PATTERNS`.
+The `file_writes`, `spawns` and `egress_hosts` arrays are empty. This is capability
+disclosure, not enforced isolation.
+
+## What it does
+
+- **Before a tool runs**, it scans every string in the tool input against the credential
+  patterns in `patterns.json`. These cover GitHub tokens, AWS access key IDs and secret
+  keys, HTTP Bearer tokens and passwords embedded in URLs.
+  - A hit asks for confirmation.
+  - The reason names the pattern, never the matched text.
+- **After a tool runs**, it replaces every match in the tool output with
+  `[REDACTED:<pattern id>]` before the model reads it. This works only where the harness
+  lets a hook replace output (see the table).
+
+A secret is still found when it is split across a key and its value, for example
+`aws_secret_access_key` paired with its value. The same holds for a secret split across
+argument-list elements (`"Bearer"`, `"<token>"`).
+
+Redaction repeats until the text stops changing. Text that never settles is replaced by
+`[REDACTED:overflow]`.
+
+## Configuration
+
+`VANGUARD_SECRET_REDACTOR_PATTERNS` is an optional path to a JSON file of extra patterns.
+
+- The extra patterns are appended to the built-in list. They never replace it.
+- The file is an array of entries with the same keys as `patterns.json`:
+  - `id`: kebab-case, and not a built-in id.
+  - `name`
+  - `description`
+  - `regex`
+  - `flags`: `""` or `"i"`.
+  - `context`: `"tool-input"`, `"tool-output"` or both.
+  - `severity`
+- **The file fails closed.** If it is set and cannot be read, is not valid JSON, is
+  malformed, reuses a built-in id or names any other context:
+  - before a tool runs, every call is denied;
+  - after a tool runs, the output is withheld.
+- **Do not let an extension regex match a `[REDACTED:...]` marker.** Its redaction never
+  settles, so the output comes back as `[REDACTED:overflow]`.
+
+## Per-harness behavior
+
+| Harness | Surface | Before a tool runs | After a tool runs |
+| --- | --- | --- | --- |
+| Claude Code | native | `tool.check`: asks on a hit, never loosens the engine verdict | `tool.call`: returns the redacted result |
+| Claude Code | classic | `PreToolUse`: asks on a hit | `PostToolUse`: `updatedToolOutput` with the redacted output |
+| Kiro | hook | Degraded: the whole payload is scanned and a hit is denied | Unsupported: Kiro documents no way to replace output |
+| Codex | hook | Degraded: Codex rejects ask, so a hit is denied with a reason | Unsupported: Codex cannot replace output |
+
+On the native surface, some results cannot be rebuilt from a redacted value:
+
+- an errored call;
+- a credential that shows only in the text the model reads;
+- a credential in context added by another hook.
+
+Instead of the result, the model reads a notice followed by the redacted text.
+
+## Limitations
+
+- **Classic `PostToolUse` fires only after a tool succeeds.** Output from a failed tool is
+  not redacted there.
+- **Classic Claude Code ignores a replacement whose shape differs from the tool's output.**
+  The withheld output then cannot take effect in two cases:
+  - the hook's stdin is invalid;
+  - the redaction fails on output that is not an object.
+- **Two keys can redact to the same marker.** They collapse into one. This loses data but
+  may invalidate the tool's output schema; classic Claude Code may then ignore the
+  replacement and retain the original output.
+- **When redaction itself fails**, the withheld replacement keeps the output's keys and
+  masks only its values. Credentials embedded in keys are not protected by that fallback.
+- **An `ask` is settled by the permission mode**, so a bypass mode may auto-approve it.
+- **Patterns are regexes, not proof.** A credential format they do not describe passes
+  through, and a long uppercase run that starts like an AWS key is over-redacted.
+- **The native API is early access**, verified against Claude Code 2.1.296.
+- **Classic, Kiro and Codex hooks need Node 22+.**
+
+## Install
+
+See `mods/README.md`.