opsentry 1.8.0__py3-none-any.whl

opsentry/config/hook_templates/block-environment-escape.sh.j2

@@ -0,0 +1,99 @@
+#!/bin/bash
+# block-environment-escape.sh
+# PreToolUse hook — blocks Claude Code from escaping the local dev environment.
+# Blocks SSH/SCP, Docker run/exec/build, production env vars, destructive Terraform/kubectl.
+# Exit code 2 = block the action, stderr message goes to Claude as feedback.
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-environment-escape"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash tool
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+# --- SSH / SCP ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)(ssh|scp)\s'; then
+  log_block "SSH/SCP command detected" "$COMMAND"
+  echo "BLOCKED: SSH and SCP commands are not allowed. The AI agent must not connect to remote hosts. Write the command for the developer to review and run manually." >&2
+  exit 2
+fi
+
+# --- rsync to remote ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)rsync\s.*:'; then
+  log_block "rsync to remote detected" "$COMMAND"
+  echo "BLOCKED: rsync to remote hosts is not allowed. Local rsync operations are permitted." >&2
+  exit 2
+fi
+
+{% if infra_tools.get("docker", "read_only") == "block" %}
+# --- Docker (all blocked) ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)docker\s'; then
+  log_block "Docker command detected" "$COMMAND"
+  echo "BLOCKED: All Docker commands are blocked by policy. Write the command for the developer to review and run manually." >&2
+  exit 2
+fi
+{% elif infra_tools.get("docker", "read_only") == "read_only" %}
+# --- Docker (write commands blocked, read-only allowed) ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)docker\s+(run|exec|cp|build|push|pull|commit|tag|save|load|import|export)\s'; then
+  log_block "Docker write command detected" "$COMMAND"
+  echo "BLOCKED: Docker run/exec/cp/build commands are not allowed. Read-only commands (ps, logs, images, inspect) are permitted." >&2
+  exit 2
+fi
+{% endif %}
+
+# --- Production environment variables ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)(export\s+|env\s+)?(PROD_|PRODUCTION_)'; then
+  log_block "Production env var detected" "$COMMAND"
+  echo "BLOCKED: Setting or reading production environment variables (PROD_*, PRODUCTION_*) is not allowed." >&2
+  exit 2
+fi
+
+{% if infra_tools.get("terraform", "read_only") == "block" %}
+# --- Terraform (all blocked) ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)terraform\s'; then
+  log_block "Terraform command detected" "$COMMAND"
+  echo "BLOCKED: All Terraform commands are blocked by policy." >&2
+  exit 2
+fi
+{% elif infra_tools.get("terraform", "read_only") == "read_only" %}
+# --- Terraform (destructive blocked, read-only allowed) ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)terraform\s+(apply|destroy|import)\s*'; then
+  log_block "Destructive Terraform command detected" "$COMMAND"
+  echo "BLOCKED: terraform apply/destroy/import are not allowed. Read-only commands (plan, validate, fmt, show, state list) are permitted." >&2
+  exit 2
+fi
+{% endif %}
+
+{% if infra_tools.get("kubectl", "read_only") == "block" %}
+# --- kubectl (all blocked) ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)kubectl\s'; then
+  log_block "kubectl command detected" "$COMMAND"
+  echo "BLOCKED: All kubectl commands are blocked by policy." >&2
+  exit 2
+fi
+{% elif infra_tools.get("kubectl", "read_only") == "read_only" %}
+# --- kubectl (destructive blocked, read-only allowed) ---
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)kubectl\s+(delete|exec|apply|patch|replace|edit|scale|rollout)\s'; then
+  log_block "Destructive kubectl command detected" "$COMMAND"
+  echo "BLOCKED: kubectl delete/exec/apply are not allowed. Read-only commands (get, describe, logs, top) are permitted." >&2
+  exit 2
+fi
+{% endif %}
+
+exit 0

opsentry/config/hook_templates/block-git-commands.sh.j2

@@ -0,0 +1,46 @@
+#!/bin/bash
+# block-git-commands.sh
+# PreToolUse hook — blocks Claude Code from executing git commands
+# Exit code 2 = block the action, stderr message goes to Claude as feedback
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-git-commands"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash tool
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+{% if git_policy == "block_all" %}
+# Block ALL git commands
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)git\s'; then
+  log_block "Git command detected" "$COMMAND"
+  echo "BLOCKED: Git commands are not allowed. The developer manages version control. Provide git commands as text for the developer to review and run manually." >&2
+  exit 2
+fi
+{% elif git_policy == "read_only" %}
+# Block git write commands, allow read-only (status, log, diff, show, branch list, remote -v, describe)
+GIT_WRITE_CMDS='(commit|push|pull|merge|reset|rebase|checkout|stash|cherry-pick|tag|branch\s+-[dD]|push\s+--force)'
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)git\s+$GIT_WRITE_CMDS"; then
+  log_block "Git write command detected" "$COMMAND"
+  echo "BLOCKED: Git write commands are not allowed. You may use read-only commands (status, log, diff, show, branch). Provide write commands as text for the developer to review." >&2
+  exit 2
+fi
+{% endif %}
+
+exit 0

opsentry/config/hook_templates/block-package-install.sh.j2

@@ -0,0 +1,95 @@
+#!/bin/bash
+# block-package-install.sh
+# PreToolUse hook that blocks package installations from untrusted or arbitrary sources.
+# It detects pip, npm, gem, and go installs from custom registries, git URLs, and direct URLs.
+# Curl/wget piped to package managers is also blocked.
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-package-install"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash commands
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+# === PIP INSTALL FROM ARBITRARY SOURCES ===
+if echo "$COMMAND" | grep -qE 'pip[3]?\s+install\s.*(-i\s|--index-url\s)'; then
+  log_block "pip install with custom index URL" "$COMMAND"
+  echo "BLOCKED: pip install with --index-url or -i pointing to a custom registry is not allowed. Use the default PyPI registry." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'pip[3]?\s+install\s.*git\+'; then
+  log_block "pip install from git URL" "$COMMAND"
+  echo "BLOCKED: pip install from a git URL is not allowed. Only install packages from PyPI." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'pip[3]?\s+install\s.*https?://'; then
+  log_block "pip install from direct URL" "$COMMAND"
+  echo "BLOCKED: pip install from a direct URL is not allowed. Only install packages from PyPI." >&2
+  exit 2
+fi
+
+# === NPM INSTALL FROM ARBITRARY SOURCES ===
+if echo "$COMMAND" | grep -qE 'npm\s+install\s.*--registry\s'; then
+  log_block "npm install with custom registry" "$COMMAND"
+  echo "BLOCKED: npm install with --registry pointing to a custom registry is not allowed. Use the default npm registry." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'npm\s+install\s.*git(\+https?|\+ssh|://)'; then
+  log_block "npm install from git URL" "$COMMAND"
+  echo "BLOCKED: npm install from a git URL is not allowed. Only install packages from the npm registry." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'npm\s+install\s.*https?://'; then
+  log_block "npm install from tarball URL" "$COMMAND"
+  echo "BLOCKED: npm install from a direct URL is not allowed. Only install packages from the npm registry." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'npm\s+install\s+[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+'; then
+  log_block "npm install from GitHub shorthand" "$COMMAND"
+  echo "BLOCKED: npm install from GitHub shorthand (user/repo) is not allowed. Only install packages from the npm registry." >&2
+  exit 2
+fi
+
+# === GEM INSTALL FROM ARBITRARY SOURCES ===
+if echo "$COMMAND" | grep -qE 'gem\s+install\s.*--source\s'; then
+  log_block "gem install with custom source" "$COMMAND"
+  echo "BLOCKED: gem install with --source pointing to a custom registry is not allowed. Use the default RubyGems registry." >&2
+  exit 2
+fi
+
+# === GO INSTALL FROM ARBITRARY SOURCES ===
+if echo "$COMMAND" | grep -qE 'go\s+install\s+https?://'; then
+  log_block "go install from URL" "$COMMAND"
+  echo "BLOCKED: go install from a direct URL is not allowed. Use standard Go module paths." >&2
+  exit 2
+fi
+
+# === CURL/WGET PIPED TO PACKAGE MANAGERS ===
+if echo "$COMMAND" | grep -qE '(curl|wget)\s.*\|\s*(pip[3]?|npm|gem|go)\s'; then
+  log_block "curl/wget piped to package manager" "$COMMAND"
+  echo "BLOCKED: Piping curl/wget output to a package manager is not allowed. Download files first, review them, then install." >&2
+  exit 2
+fi
+
+exit 0

opsentry/config/hook_templates/block-pii-leakage.sh.j2

@@ -0,0 +1,100 @@
+#!/bin/bash
+# block-pii-leakage.sh
+# PreToolUse hook -- blocks Claude Code from writing PII patterns into source files.
+# Checks Write and Edit tool inputs for SSNs, credit card numbers, and similar patterns.
+# Exit code 2 = block the action, stderr message goes to Claude as feedback.
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-pii-leakage"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Write, Edit, and Bash tools
+if [ "$TOOL_NAME" != "Write" ] && [ "$TOOL_NAME" != "Edit" ] && [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+# Extract the content to scan based on tool type
+CONTENT=""
+if [ "$TOOL_NAME" = "Write" ]; then
+  CONTENT=$(echo "$INPUT" | jq -r '.tool_input.content // ""')
+elif [ "$TOOL_NAME" = "Edit" ]; then
+  CONTENT=$(echo "$INPUT" | jq -r '.tool_input.new_string // ""')
+elif [ "$TOOL_NAME" = "Bash" ]; then
+  CONTENT=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+fi
+
+if [ -z "$CONTENT" ]; then
+  exit 0
+fi
+
+{% if "US" in pii_locales %}
+# ============================================================
+# Default PII patterns (US locale)
+# ============================================================
+
+# --- US Social Security Number (XXX-XX-XXXX) ---
+SSN_MATCH=$(echo "$CONTENT" | grep -oE '\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b' | head -1 || true)
+if [ -n "$SSN_MATCH" ]; then
+  # Allow well-known synthetic test SSNs
+  IS_SYNTHETIC=$(echo "$SSN_MATCH" | grep -cE '^({{ synthetic_ssns | join("|") }})$' || true)
+  if [ "$IS_SYNTHETIC" -eq 0 ]; then
+    log_block "US SSN pattern detected" "$SSN_MATCH"
+    echo "BLOCKED: Content contains a pattern matching a US Social Security Number ($SSN_MATCH). Use synthetic test data like {{ synthetic_ssns[0] }} or {{ synthetic_ssns[1] }} instead. Never include real PII in source code." >&2
+    exit 2
+  fi
+fi
+
+# --- Credit Card Numbers (Visa, Mastercard, Amex, Discover) ---
+CC_MATCH=$(echo "$CONTENT" | grep -oE '\b(4[0-9]{3}|5[1-5][0-9]{2}|6(011|5[0-9]{2}))[- ]?[0-9]{4}[- ]?[0-9]{4}[- ]?[0-9]{1,4}\b' | head -1 || true)
+if [ -z "$CC_MATCH" ]; then
+  # Try Amex pattern separately: 3[47]XX-XXXXXX-XXXXX
+  CC_MATCH=$(echo "$CONTENT" | grep -oE '\b3[47][0-9]{2}[- ]?[0-9]{6}[- ]?[0-9]{5}\b' | head -1 || true)
+fi
+if [ -n "$CC_MATCH" ]; then
+  log_block "Credit card number pattern detected" "$CC_MATCH"
+  echo "BLOCKED: Content contains a pattern matching a credit card number. Use synthetic test data like 4111-1111-1111-1111 instead. Never include real PII in source code." >&2
+  exit 2
+fi
+{% endif %}
+
+{% if "KR" in pii_locales %}
+# ============================================================
+# Optional locale: KR (Korean Resident Registration Number)
+# ============================================================
+
+# --- Korean Resident Registration Number (YYMMDD-NNNNNNN) ---
+RRN_MATCH=$(echo "$CONTENT" | grep -oE '\b[0-9]{6}-[0-9]{7}\b' | head -1 || true)
+if [ -n "$RRN_MATCH" ]; then
+  log_block "Korean RRN pattern detected" "$RRN_MATCH"
+  echo "BLOCKED: Content contains a pattern matching a Korean Resident Registration Number ($RRN_MATCH). Use synthetic test data instead. Never include real PII in source code." >&2
+  exit 2
+fi
+{% endif %}
+
+{% if "EU" in pii_locales %}
+# ============================================================
+# Optional locale: EU (IBAN)
+# ============================================================
+
+# --- IBAN (International Bank Account Number) ---
+IBAN_MATCH=$(echo "$CONTENT" | grep -oE '\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}([A-Z0-9]?){0,16}\b' | head -1 || true)
+if [ -n "$IBAN_MATCH" ]; then
+  log_block "IBAN pattern detected" "$IBAN_MATCH"
+  echo "BLOCKED: Content contains a pattern matching an IBAN ($IBAN_MATCH). Use synthetic test data instead. Never include real PII in source code." >&2
+  exit 2
+fi
+{% endif %}
+
+exit 0

opsentry/config/hook_templates/block-scope-escape.sh.j2

@@ -0,0 +1,115 @@
+#!/bin/bash
+# block-scope-escape.sh -- PreToolUse hook that prevents the agent from modifying
+# its own guardrails in ~/.claude/ and from writing to dangerous system locations.
+# Exit code 2 = block the action, stderr message goes to Claude as feedback.
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-scope-escape"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# ---------------------------------------------------------------------------
+# A. Self-modification prevention -- all tool types
+# ---------------------------------------------------------------------------
+
+# For file-based tools (Read, Write, Edit): check file_path
+if [ "$TOOL_NAME" = "Read" ] || [ "$TOOL_NAME" = "Write" ] || [ "$TOOL_NAME" = "Edit" ]; then
+  FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // ""')
+
+  if [ -n "$FILE_PATH" ]; then
+    if echo "$FILE_PATH" | grep -qE '(/\.claude/|^~/.claude)'; then
+      log_block "Self-modification via $TOOL_NAME" "$FILE_PATH"
+      echo "BLOCKED: Access to '$FILE_PATH' is denied. Modifying files in ~/.claude/ is forbidden -- this directory contains security guardrails that must not be read or altered by the agent." >&2
+      exit 2
+    fi
+  fi
+
+  # File-based tools have no scope-boundary check; allow
+  exit 0
+fi
+
+# For Bash tool: check command text
+if [ "$TOOL_NAME" = "Bash" ]; then
+  COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+  # --- A. Self-modification in Bash commands ---
+  CLAUDE_DIR_PATTERNS=(
+    '~/.claude'
+    '\$HOME/.claude'
+    '/\.claude/'
+  )
+  for pattern in "${CLAUDE_DIR_PATTERNS[@]}"; do
+    if echo "$COMMAND" | grep -qF "$pattern" 2>/dev/null || echo "$COMMAND" | grep -qE "$pattern" 2>/dev/null; then
+      log_block "Self-modification via Bash" "$COMMAND"
+      echo "BLOCKED: Command references ~/.claude/ directory. Modifying guardrail files is forbidden -- this directory contains security guardrails that must not be altered by the agent." >&2
+      exit 2
+    fi
+  done
+
+  # --- B. Scope boundary enforcement -- block writes to system locations ---
+  # Only trigger when the command contains a write indicator
+  WRITE_INDICATORS='(>|>>|(^|[[:space:]])cp[[:space:]]|(^|[[:space:]])mv[[:space:]]|(^|[[:space:]])tee[[:space:]]|(^|[[:space:]])install[[:space:]]|(^|[[:space:]])rsync[[:space:]])'
+
+  if echo "$COMMAND" | grep -qE "$WRITE_INDICATORS"; then
+    # System paths that must not be written to
+    BLOCKED_SYSTEM_PATHS=(
+      '/etc/'
+      '/usr/'
+      '/opt/'
+      '/System/'
+      '/Library/'
+    )
+    for sys_path in "${BLOCKED_SYSTEM_PATHS[@]}"; do
+      if echo "$COMMAND" | grep -qF "$sys_path"; then
+        # Allow /var/log for legitimate logging
+        if [ "$sys_path" = "/var/" ] && echo "$COMMAND" | grep -qF "/var/log"; then
+          continue
+        fi
+        log_block "Write to system path: $sys_path" "$COMMAND"
+        echo "BLOCKED: Command attempts to write to '$sys_path'. Writing to system directories is forbidden. Limit file operations to your project directory." >&2
+        exit 2
+      fi
+    done
+
+    # /var/ checked separately to allow /var/log
+    if echo "$COMMAND" | grep -qF "/var/"; then
+      if ! echo "$COMMAND" | grep -qE '/var/log(/|$|[[:space:]])'; then
+        log_block "Write to system path: /var/" "$COMMAND"
+        echo "BLOCKED: Command attempts to write to '/var/'. Writing to system directories is forbidden (except /var/log). Limit file operations to your project directory." >&2
+        exit 2
+      fi
+    fi
+
+    # Shell config files
+    SHELL_CONFIGS=(
+      '.bashrc'
+      '.zshrc'
+      '.bash_profile'
+      '.zprofile'
+      '.profile'
+    )
+    for config in "${SHELL_CONFIGS[@]}"; do
+      if echo "$COMMAND" | grep -qF "$config"; then
+        log_block "Write to shell config: $config" "$COMMAND"
+        echo "BLOCKED: Command attempts to modify shell config file '$config'. Modifying shell configuration is forbidden. Ask the developer to make shell changes manually." >&2
+        exit 2
+      fi
+    done
+  fi
+
+  exit 0
+fi
+
+# Unknown tool -- allow by default
+exit 0

opsentry/config/hook_templates/block-sensitive-files.sh.j2

@@ -0,0 +1,97 @@
+#!/bin/bash
+# block-sensitive-files.sh
+# PreToolUse hook — blocks Claude Code from reading sensitive files
+# Exit code 2 = block the action, stderr message goes to Claude as feedback
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-sensitive-files"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Get the file path depending on the tool
+FILE_PATH=""
+if [ "$TOOL_NAME" = "Read" ]; then
+  FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // ""')
+elif [ "$TOOL_NAME" = "Bash" ]; then
+  COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+  # Check if bash command references sensitive files
+  SENSITIVE_PATTERNS=(
+    '\.env'
+    'credentials\.'
+    'secret'
+    'token'
+    '\.pem'
+    '\.key$'
+    '\.crt$'
+    '\.p12'
+    '\.pfx'
+    '\.keystore'
+    '\.jks'
+    '\.ssh/'
+    '\.aws/'
+    '\.azure/'
+    '\.gcloud/'
+    'snowflake\.config'
+    'profiles\.yml'
+    'connections\.toml'
+  )
+  for pattern in "${SENSITIVE_PATTERNS[@]}"; do
+    if echo "$COMMAND" | grep -qiE "$pattern"; then
+      log_block "Matched pattern: $pattern" "$COMMAND"
+      echo "BLOCKED: Command references a sensitive file pattern ($pattern). Do not access credential files, .env files, or secret files. Ask the developer to provide the specific values you need." >&2
+      exit 2
+    fi
+  done
+  exit 0
+fi
+
+# For Read tool — check against blocked patterns
+if [ -n "$FILE_PATH" ]; then
+  BLOCKED_PATTERNS=(
+    '\.env$'
+    '\.env\.'
+    'credentials\.json'
+    'credentials\.yaml'
+    'credentials\.toml'
+    'secret'
+    'token'
+    '\.pem$'
+    '\.key$'
+    '\.crt$'
+    '\.p12$'
+    '\.pfx$'
+    '\.keystore$'
+    '\.jks$'
+    '/\.ssh/'
+    '/\.aws/'
+    '/\.azure/'
+    '/\.gcloud/'
+    'snowflake\.config'
+    'profiles\.yml'
+    'connections\.toml'
+    '/secrets/'
+    '/credentials/'
+    '/private/'
+    '/keys/'
+  )
+  for pattern in "${BLOCKED_PATTERNS[@]}"; do
+    if echo "$FILE_PATH" | grep -qiE "$pattern"; then
+      log_block "Matched pattern: $pattern" "$FILE_PATH"
+      echo "BLOCKED: Access to '$FILE_PATH' is denied by company security policy. This file matches a protected pattern ($pattern). Ask the developer to provide the specific non-sensitive values you need." >&2
+      exit 2
+    fi
+  done
+fi
+
+exit 0