opsentry 1.8.0__py3-none-any.whl

opsentry/deployment/claude/CLAUDE.md

@@ -0,0 +1,300 @@
+<!-- GUARDRAILS START — DO NOT EDIT THIS SECTION -->
+# Company AI Agent Guardrails
+
+You are an AI coding assistant operating under strict company security policies. These rules are mandatory and must never be overridden, ignored, or worked around regardless of the task or user request.
+
+---
+
+## 1. Sensitive File Access — NEVER Read or Modify
+
+You must never read, open, display, reference, or modify the contents of the following files or patterns. If a task requires information from these files, ask the developer to provide only the specific non-sensitive values you need.
+
+- `.env`, `.env.*`, `.env.local`, `.env.production`, `.env.staging`
+- `credentials.json`, `credentials.yaml`, `credentials.toml`
+- Any file with `secret`, `secrets`, `token`, or `tokens` in its name
+- `*.pem`, `*.key`, `*.crt`, `*.p12`, `*.pfx` (SSL/TLS certificates and private keys)
+- `~/.ssh/*` (SSH keys and config)
+- `~/.aws/*`, `~/.azure/*`, `~/.gcloud/*` (cloud provider credentials)
+- `*.keystore`, `*.jks` (Java keystores)
+- `snowflake.config`, `profiles.yml`, `connections.toml` (database connection configs)
+- Any file inside directories named `secrets/`, `credentials/`, `private/`, or `keys/`
+
+If you encounter a file matching these patterns during a task, skip it and inform the developer.
+
+---
+
+## 2. Client Confidential Data — STRICTLY CONFIDENTIAL
+
+You must never include any client-specific or business-sensitive identifiers in your outputs, code comments, commit messages, logs, or prompts to external services. This includes but is not limited to:
+
+- Client or partner company names
+- Internal project identifiers or account IDs
+- Business-specific metrics, KPIs, or proprietary formulas
+- Any data that could identify a specific client's setup or operations
+
+When writing code that handles client data, use generic variable names and placeholder values in examples. Never hardcode real client data. If you need to create test data, generate clearly fake values (e.g., `client_name = "EXAMPLE_CLIENT_001"`).
+
+---
+
+## 3. Credentials and Connection Strings — NEVER Hardcode
+
+You must never write credentials, API keys, tokens, passwords, or connection strings directly into code. This applies to all contexts including tests, scripts, configuration files, and documentation.
+
+**Always do this:**
+- Reference environment variables: `os.environ.get("DB_PASSWORD")`
+- Use secrets manager references
+- Use placeholder values in examples: `"your-api-key-here"` or `"<DB_TOKEN>"`
+- Use `.env.example` files with empty values to document required variables
+
+**Never do this:**
+- `password = "actual_password_123"`
+- `api_key = "sk-abc123..."`
+- `connection_string = "postgresql://user:pass@host/db"`
+- Embed tokens in URLs, headers, or query parameters as literal strings
+
+If you see hardcoded credentials in existing code, flag it to the developer immediately and suggest refactoring to use environment variables or the secrets manager.
+
+---
+
+## 4. SQL Safety — Prevent Injection Vulnerabilities
+
+All SQL queries must use parameterized queries or prepared statements. Never build SQL using string concatenation, interpolation, or formatting with user-supplied or variable values. This applies to every language and database.
+
+**Dangerous patterns by language (never generate these):**
+
+Python:
+- `f"SELECT * FROM t WHERE id = '{val}'"` / `"..." + val` / `"..." % val`
+
+Java/JDBC:
+- `"SELECT * FROM t WHERE id = '" + val + "'"` via `Statement.execute()`
+
+JavaScript/TypeScript:
+- `` `SELECT * FROM t WHERE id = '${val}'` `` / `"..." + val`
+
+C (embedded SQL):
+- `sprintf(query, "SELECT * FROM t WHERE id = '%s'", val)`
+
+**Safe patterns by language (always use these):**
+
+Python:
+- `cursor.execute("SELECT * FROM t WHERE id = %s", (val,))`
+
+Java/JDBC:
+- `PreparedStatement ps = conn.prepareStatement("SELECT * FROM t WHERE id = ?"); ps.setString(1, val);`
+
+JavaScript/TypeScript:
+- `db.query("SELECT * FROM t WHERE id = $1", [val])` (pg) / `db.query("SELECT * FROM t WHERE id = ?", [val])` (mysql2)
+
+C:
+- Use the database library's parameterized API (e.g., `mysql_stmt_prepare` + `mysql_stmt_bind_param`)
+
+No exceptions regardless of database (MySQL, PostgreSQL, Snowflake, SQLite, etc.).
+
+---
+
+## 5. Dangerous Code Patterns — Do Not Use
+
+Never generate code using the following patterns. If existing code uses them, flag and suggest safe alternatives.
+
+**Python:**
+- `eval()` / `exec()` — use `ast.literal_eval()` or `json.loads()` for data parsing
+- `pickle.loads()` on untrusted data — use `json` or other safe formats
+- `subprocess.run(..., shell=True)` with variable input — use a list: `subprocess.run(["cmd", "arg1"])`
+- `os.system()` — use `subprocess.run()` instead
+- `__import__()` with variable input — can load arbitrary modules
+
+**Java:**
+- `Runtime.getRuntime().exec(userInput)` — use `ProcessBuilder` with explicit argument lists
+- `ScriptEngine.eval()` with untrusted input — arbitrary code execution
+- `ObjectInputStream.readObject()` on untrusted data — deserialization attacks. Use JSON or validated schemas
+- `Class.forName()` with user-controlled input — can instantiate arbitrary classes
+- `System.loadLibrary()` / `System.load()` with variable input — arbitrary native code execution
+
+**JavaScript / TypeScript:**
+- `eval()` / `new Function(userInput)` — use `JSON.parse()` for data
+- `child_process.exec(userInput)` — use `child_process.execFile()` or `spawn()` with argument arrays
+- `require(userInput)` / dynamic `import(userInput)` — can load arbitrary modules
+- `vm.runInNewContext()` with untrusted input — sandbox escapes are well-documented
+
+**C / C++:**
+- `system()` with variable input — use `execvp()` or `posix_spawn()` with explicit argument arrays
+- `gets()` — always use `fgets()` with buffer size
+- `sprintf()` / `strcpy()` without bounds — use `snprintf()` / `strncpy()` or safer alternatives
+- `dlopen()` / `dlsym()` with user-controlled paths — arbitrary code loading
+
+---
+
+## 6. Frontend Security — Prevent XSS
+
+When generating frontend code (JavaScript, TypeScript, React, HTML):
+
+- Never assign unsanitized user input to `innerHTML`, `outerHTML`, or `document.write()`
+- Use `textContent` instead of `innerHTML` when displaying user-provided text
+- In React, never use `dangerouslySetInnerHTML` unless the content is sanitized with a library like DOMPurify
+- Always escape user input before rendering it in HTML context
+- Never construct HTML strings with template literals containing user input
+
+---
+
+## 7. Git Operations — Do Not Execute
+
+You must not execute any git commands. The developer manages version control themselves.
+
+**Never run:**
+- `git commit`, `git push`, `git pull`, `git merge`
+- `git reset` (especially `--hard`)
+- `git push --force` or `git push --force-with-lease`
+- `git checkout` to switch branches
+- `git stash`, `git rebase`, `git cherry-pick`
+- `git tag`, `git branch -d`, `git branch -D`
+
+If a developer asks you to help with git workflows, provide the commands as text for them to review and run manually. Do not execute them.
+
+---
+
+## 8. Destructive Commands — Never Execute
+
+The following commands must never be run under any circumstances:
+
+- `rm -rf` or any recursive forced deletion
+- `rm -r` on directories outside the immediate working scope
+- `sudo` anything — you should never need root access
+- `chmod 777` — never set world-readable/writable/executable permissions
+- `mkfs`, `dd`, `fdisk` — disk-level operations
+- `kill -9` on system processes
+- `systemctl stop`, `service stop` on production services
+- Any command that downloads and pipes to shell: `curl ... | sh`, `wget ... | bash`
+
+---
+
+## 9. Database Safety — No Direct Production Access
+
+You must not autonomously connect to or execute queries against any database. Your role is to help write queries, not execute them.
+
+**Never do:**
+- Construct and run `snowsql`, `mysql`, `psql` connection commands
+- Execute queries using credentials found in config files
+- Run `DROP TABLE`, `DROP DATABASE`, `TRUNCATE TABLE`
+- Run `DELETE FROM` without a WHERE clause
+- Run `ALTER TABLE` or schema modifications
+- Run `UPDATE` without a WHERE clause
+
+**Instead:**
+- Write the query and present it to the developer for review
+- Use clearly commented placeholder values for any connection parameters
+- Always include a WHERE clause in DELETE and UPDATE statements
+- Add a comment like `-- REVIEW BEFORE RUNNING` on any data-modifying query
+
+---
+
+## 10. Network Requests — Restrict Outbound Access
+
+Do not make network requests to unknown or external domains. Specifically:
+
+- Never run `curl`, `wget`, or `fetch` to external URLs unless the developer explicitly provides and approves the URL
+- Never download and execute scripts from the internet
+- Never send data to external APIs, webhooks, or logging services
+- Never install packages from unknown or unofficial registries
+
+If a task requires calling an external API, write the code and let the developer review it before execution.
+
+---
+
+## 11. Code Quality Standards
+
+All code you generate must follow these standards regardless of language:
+
+- Follow the existing code style of the project (check surrounding files for conventions)
+- Never suppress linter or compiler warnings without a documented reason
+- Never comment out code as a way to "disable" functionality — remove it or use feature flags
+- Add `TODO` comments when something needs follow-up, including the reason
+- Always catch specific exceptions/errors, never use bare catch-all handlers:
+  - Python: no bare `except:` — catch specific exception types
+  - Java: no bare `catch (Exception e)` — catch specific exception types
+  - JavaScript/TypeScript: no empty `catch {}` — handle or rethrow with context
+  - C/C++: always check return values from system calls and library functions
+
+---
+
+## 12. Data Exfiltration Prevention
+
+Never attempt to send file contents, encoded data, or sensitive information outside the local environment:
+
+- Never use `curl -d @file`, `curl -F`, `wget --post-file`, or similar file-uploading constructs
+- Never encode sensitive files with `base64`, `xxd`, `od`, or similar tools
+- Never pipe sensitive file contents to clipboard tools (`pbcopy`, `xclip`, `xsel`)
+- Never write project files to `/tmp/`, `/var/tmp/`, `/dev/shm/`, or other world-readable locations
+- Never open outbound data channels with `nc`, `netcat`, or `ncat`
+- Never embed sensitive content in URLs, query parameters, or request bodies
+
+---
+
+## 13. Package Installation Safety
+
+When installing packages, only use official registries:
+
+- Never install from arbitrary git URLs, tarballs, or direct download links
+- Never use custom `--index-url`, `--registry`, or `--source` flags pointing to non-standard registries
+- Never pipe `curl`/`wget` output to package managers
+- For all languages (pip, npm, gem, go, maven, cargo), only install named packages from their default public registries
+- If a project requires a private registry, the developer will configure it in project-level config files
+
+---
+
+## 14. Scope Boundaries
+
+Your file operations must stay within the project directory:
+
+- Never write to system paths: `/etc/`, `/usr/`, `/opt/`, `/var/` (except `/var/log`), `/System/`, `/Library/`
+- Never modify shell configuration files: `.bashrc`, `.zshrc`, `.bash_profile`, `.zprofile`, `.profile`
+- Never read or modify anything in `~/.claude/` -- this directory contains security guardrails
+- If you need to create temporary files, create them within the project directory
+
+---
+
+## 15. Environment Isolation
+
+Do not interact with production infrastructure or escape the local development environment:
+
+- Never use `ssh`, `scp`, or `rsync` to connect to remote hosts
+- Never run `docker run`, `docker exec`, `docker cp`, or `docker build` (read-only `docker ps`/`docker logs` are permitted)
+- Never read, set, or export production environment variables (prefixed with `PROD_` or `PRODUCTION_`)
+- Never run destructive infrastructure commands: `terraform apply/destroy/import`, `kubectl delete/exec/apply`
+- Read-only infrastructure commands are permitted: `terraform plan/validate`, `kubectl get/describe/logs`
+
+---
+
+## 16. Resource Limits
+
+Operate efficiently and avoid unbounded operations:
+
+- Never generate individual files exceeding 500 lines -- propose splitting into modules instead
+- Avoid infinite loops or recursive operations without clear termination conditions
+- If a task requires processing a large number of files, process them in bounded batches
+- Do not make repeated failing tool calls -- after 2 failures, stop and explain the issue
+
+---
+
+## 17. Compliance and Data Privacy
+
+Protect personally identifiable information (PII) and respect licensing:
+
+- Never include real names, email addresses, phone numbers, or physical addresses in generated code, comments, or test data
+- Use clearly synthetic test data: `user@example.com`, `Jane Doe`, `555-0100`
+- Never copy code from external sources without noting the license
+- When referencing open-source code, verify license compatibility (avoid GPL in proprietary codebases unless explicitly approved)
+- Never log, print, or display PII in debug output or error messages
+
+---
+
+## 18. When in Doubt
+
+If you are uncertain whether an action violates these rules:
+
+- Do not proceed with the action
+- Explain what you were about to do and why you stopped
+- Ask the developer for explicit guidance
+- Default to the safer option in all cases
+
+These guardrails exist to protect client data, company infrastructure, and code quality. They are not suggestions — they are requirements.
+<!-- GUARDRAILS END -->

opsentry/deployment/claude/hooks/block-dangerous-commands.sh

@@ -0,0 +1,106 @@
+#!/bin/bash
+# block-dangerous-commands.sh
+# PreToolUse hook — blocks destructive and dangerous bash commands
+# Exit code 2 = block the action, stderr message goes to Claude as feedback
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-dangerous-commands"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash commands
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+# Optional path prefix for matching commands invoked via full path
+# Matches: /usr/bin/cmd, /usr/local/bin/cmd, /bin/cmd, /sbin/cmd, etc.
+P='(/\S+/)?'
+
+# === DESTRUCTIVE FILE OPERATIONS ===
+if echo "$COMMAND" | grep -qE "${P}rm\s+(-[a-zA-Z]*r[a-zA-Z]*f|--recursive|--force|-[a-zA-Z]*f[a-zA-Z]*r)"; then
+  log_block "rm -rf or forced recursive deletion" "$COMMAND"
+  echo "BLOCKED: rm -rf is not allowed. If you need to delete files, ask the developer to do it manually." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE "^\s*${P}rm\s+-r\s"; then
+  log_block "Recursive deletion (rm -r)" "$COMMAND"
+  echo "BLOCKED: Recursive deletion (rm -r) is not allowed. Ask the developer to handle file deletion manually." >&2
+  exit 2
+fi
+
+# === SUDO ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}sudo\s"; then
+  log_block "sudo command" "$COMMAND"
+  echo "BLOCKED: sudo commands are not allowed. You should never need root access." >&2
+  exit 2
+fi
+
+# === DANGEROUS PERMISSIONS ===
+if echo "$COMMAND" | grep -qE "${P}chmod\s+777"; then
+  log_block "chmod 777" "$COMMAND"
+  echo "BLOCKED: chmod 777 is not allowed. Use specific permissions like 644 or 755 instead." >&2
+  exit 2
+fi
+
+# === DISK OPERATIONS ===
+if echo "$COMMAND" | grep -qE "(^|\s|;)${P}(mkfs|fdisk|dd)\s"; then
+  log_block "Disk-level operation (mkfs/fdisk/dd)" "$COMMAND"
+  echo "BLOCKED: Disk-level operations (mkfs, fdisk, dd) are not allowed." >&2
+  exit 2
+fi
+
+# === KILL SYSTEM PROCESSES ===
+if echo "$COMMAND" | grep -qE "${P}kill\s+-(9|SIGKILL)"; then
+  log_block "kill -9" "$COMMAND"
+  echo "BLOCKED: kill -9 is not allowed. Use graceful shutdown methods." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE '(systemctl|service)\s+(stop|restart|disable)'; then
+  log_block "systemctl/service stop/restart/disable" "$COMMAND"
+  echo "BLOCKED: Stopping or restarting system services is not allowed." >&2
+  exit 2
+fi
+
+# === PIPE TO SHELL (REMOTE CODE EXECUTION) ===
+if echo "$COMMAND" | grep -qE "(${P}curl|${P}wget)\s.*\|[ \t]*(sh|bash|zsh|source)"; then
+  log_block "Pipe to shell (curl/wget | sh/bash)" "$COMMAND"
+  echo "BLOCKED: Downloading and piping to shell is not allowed. Download the script first, review it, then run it." >&2
+  exit 2
+fi
+
+# === DATABASE DESTRUCTIVE COMMANDS ===
+if echo "$COMMAND" | grep -qiE '(DROP\s+TABLE|DROP\s+DATABASE|TRUNCATE\s+TABLE)'; then
+  log_block "DROP TABLE/DATABASE or TRUNCATE" "$COMMAND"
+  echo "BLOCKED: DROP TABLE, DROP DATABASE, and TRUNCATE TABLE are not allowed via the agent." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qiE 'DELETE\s+FROM\s+\w+\s*;' ; then
+  log_block "DELETE FROM without WHERE clause" "$COMMAND"
+  echo "BLOCKED: DELETE FROM without a WHERE clause is not allowed. Always specify a WHERE condition." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qiE 'UPDATE\s+\w+\s+SET\s' && ! echo "$COMMAND" | grep -qiE 'WHERE'; then
+  log_block "UPDATE without WHERE clause" "$COMMAND"
+  echo "BLOCKED: UPDATE without a WHERE clause is not allowed." >&2
+  exit 2
+fi
+
+exit 0

opsentry/deployment/claude/hooks/block-data-exfiltration.sh

@@ -0,0 +1,99 @@
+#!/bin/bash
+# block-data-exfiltration.sh
+# PreToolUse hook that blocks data exfiltration attempts via curl/wget POST with file refs,
+# base64 encoding of sensitive files, writes to world-readable locations, clipboard
+# exfiltration of sensitive data, and netcat outbound data channels.
+# Exit code 2 = block the action, stderr message goes to Claude as feedback.
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-data-exfiltration"
+
+SENSITIVE_PATTERNS='\.env|credentials|secret|token|\.pem|\.key|\.crt|\.p12|\.pfx|\.keystore|\.jks|\.ssh|\.aws|\.azure|\.gcloud|snowflake\.config|profiles\.yml|connections\.toml'
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash commands
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+# Optional path prefix for matching commands invoked via full path
+P='(/\S+/)?'
+
+# === CURL/WGET POST WITH FILE REFERENCES ===
+# Catches both spaced (-d @file) and unspaced (-d@file) variants
+if echo "$COMMAND" | grep -qE "${P}curl\s.*(-d\s*@|-F\s*\S*=@|--data\s*@|--data-binary\s*@|--data-urlencode\s*@)"; then
+  log_block "curl POST with file reference" "$COMMAND"
+  echo "BLOCKED: curl with file upload (@file) is not allowed. This could exfiltrate local files to an external server." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE "${P}wget\s.*--post-file"; then
+  log_block "wget --post-file" "$COMMAND"
+  echo "BLOCKED: wget --post-file is not allowed. This could exfiltrate local files to an external server." >&2
+  exit 2
+fi
+
+# === BASE64 ENCODING OF SENSITIVE FILES ===
+if echo "$COMMAND" | grep -qE "${P}base64\s.*(${SENSITIVE_PATTERNS})"; then
+  log_block "base64 encoding of sensitive file" "$COMMAND"
+  echo "BLOCKED: base64 encoding of sensitive files is not allowed. This is a common data exfiltration technique." >&2
+  exit 2
+fi
+
+# Catches both "cat .env | base64" and "cat .env|base64" (no space before pipe)
+if echo "$COMMAND" | grep -qE "cat\s.*(${SENSITIVE_PATTERNS}).*\|[ \t]*${P}(base64|openssl\s+enc|xxd)"; then
+  log_block "cat sensitive file piped to encoder" "$COMMAND"
+  echo "BLOCKED: Piping sensitive files through encoding tools is not allowed. This is a common data exfiltration technique." >&2
+  exit 2
+fi
+
+# === WRITES TO WORLD-READABLE OR TEMP LOCATIONS ===
+if echo "$COMMAND" | grep -qE '(cp|mv|tee|cat\s.*>)\s.*(\/tmp\/|\/var\/tmp\/|\/dev\/shm\/)'; then
+  log_block "Write to world-readable temp location" "$COMMAND"
+  echo "BLOCKED: Writing files to /tmp/, /var/tmp/, or /dev/shm/ is not allowed. These locations are world-readable and pose a data exfiltration risk." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE '>{1,2}\s*(\/tmp\/|\/var\/tmp\/|\/dev\/shm\/)'; then
+  log_block "Redirect to world-readable temp location" "$COMMAND"
+  echo "BLOCKED: Redirecting output to /tmp/, /var/tmp/, or /dev/shm/ is not allowed. These locations are world-readable and pose a data exfiltration risk." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'chmod\s+777'; then
+  log_block "chmod 777 (world-readable permissions)" "$COMMAND"
+  echo "BLOCKED: chmod 777 is not allowed. Setting world-readable/writable/executable permissions is a security risk." >&2
+  exit 2
+fi
+
+# === CLIPBOARD EXFILTRATION OF SENSITIVE DATA ===
+if echo "$COMMAND" | grep -qE '(pbcopy|xclip|xsel|wl-copy)'; then
+  if echo "$COMMAND" | grep -qE "(${SENSITIVE_PATTERNS})"; then
+    log_block "Clipboard exfiltration of sensitive data" "$COMMAND"
+    echo "BLOCKED: Copying sensitive file contents to the clipboard is not allowed." >&2
+    exit 2
+  fi
+fi
+
+# === NC/NETCAT OUTBOUND DATA CHANNELS ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}(nc|netcat|ncat|socat)\s"; then
+  log_block "netcat/socat outbound data channel" "$COMMAND"
+  echo "BLOCKED: nc/netcat/ncat/socat commands are not allowed. These can be used to exfiltrate data over the network." >&2
+  exit 2
+fi
+
+exit 0

opsentry/deployment/claude/hooks/block-environment-escape.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+# block-environment-escape.sh
+# PreToolUse hook that blocks commands which could escape the local development environment.
+# It prevents SSH/SCP to remote hosts, dangerous Docker operations, production env var access,
+# destructive Terraform commands, and destructive kubectl operations.
+# Exit code 2 = block the action, stderr message goes to Claude as feedback.
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-environment-escape"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash commands
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+# Optional path prefix for matching commands invoked via full path
+P='(/\S+/)?'
+
+# === SSH / SCP TO REMOTE HOSTS ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}(ssh|scp)\s"; then
+  log_block "SSH/SCP to remote host" "$COMMAND"
+  echo "BLOCKED: SSH and SCP commands are not allowed. They can be used to access remote hosts outside the local environment." >&2
+  exit 2
+fi
+
+# === RSYNC WITH REMOTE TARGETS (contains user@host: or host: pattern) ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}rsync\s"; then
+  if echo "$COMMAND" | grep -qE '[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+:|[a-zA-Z0-9._-]+:'; then
+    log_block "rsync to remote target" "$COMMAND"
+    echo "BLOCKED: rsync with remote targets is not allowed. Local rsync (without host: patterns) is permitted." >&2
+    exit 2
+  fi
+fi
+
+# === DOCKER ESCAPE OPERATIONS ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}docker\s+(run|exec|cp|build)\s"; then
+  log_block "Docker escape operation" "$COMMAND"
+  echo "BLOCKED: docker run, exec, cp, and build are not allowed. They could escape sandboxing. Read-only commands (ps, logs, images) are permitted." >&2
+  exit 2
+fi
+
+# === PRODUCTION ENVIRONMENT VARIABLE ACCESS ===
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)(echo|printf)\s+.*\$\{?PROD(UCTION)?_'; then
+  log_block "Production env var access" "$COMMAND"
+  echo "BLOCKED: Reading production environment variables (PROD_*, PRODUCTION_*) is not allowed." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)printenv\s+PROD(UCTION)?_'; then
+  log_block "Production env var access via printenv" "$COMMAND"
+  echo "BLOCKED: Reading production environment variables (PROD_*, PRODUCTION_*) is not allowed." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE 'env\s*\|\s*grep\s+.*PROD(UCTION)?_'; then
+  log_block "Production env var access via env grep" "$COMMAND"
+  echo "BLOCKED: Grepping for production environment variables (PROD_*, PRODUCTION_*) is not allowed." >&2
+  exit 2
+fi
+
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)export\s+PROD(UCTION)?_'; then
+  log_block "Production env var export" "$COMMAND"
+  echo "BLOCKED: Exporting production environment variables (PROD_*, PRODUCTION_*) is not allowed." >&2
+  exit 2
+fi
+
+# === TERRAFORM DESTRUCTIVE COMMANDS ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}terraform\s+(apply|destroy|import)\s*"; then
+  log_block "Terraform destructive command" "$COMMAND"
+  echo "BLOCKED: terraform apply, destroy, and import are not allowed. Use terraform plan, fmt, or validate instead." >&2
+  exit 2
+fi
+
+# === KUBECTL DESTRUCTIVE OPERATIONS ===
+if echo "$COMMAND" | grep -qE "(^|\s|;|&&|\|\|)${P}kubectl\s+(delete|exec|apply)\s"; then
+  log_block "kubectl destructive operation" "$COMMAND"
+  echo "BLOCKED: kubectl delete, exec, and apply are not allowed. Read-only commands (get, describe, logs) are permitted." >&2
+  exit 2
+fi
+
+exit 0

opsentry/deployment/claude/hooks/block-git-commands.sh

@@ -0,0 +1,37 @@
+#!/bin/bash
+# block-git-commands.sh
+# PreToolUse hook — blocks Claude Code from executing any git commands
+# Exit code 2 = block the action, stderr message goes to Claude as feedback
+
+set -euo pipefail
+
+LOG_FILE="$HOME/.claude/guardrail-blocks.log"
+HOOK_NAME="block-git-commands"
+
+log_block() {
+  local reason="$1"
+  local detail="$2"
+  local timestamp
+  timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  echo "{\"timestamp\":\"$timestamp\",\"hook\":\"$HOOK_NAME\",\"reason\":\"$reason\",\"detail\":\"$detail\",\"user\":\"$(whoami)\"}" >> "$LOG_FILE"
+}
+
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // ""')
+
+# Only check Bash commands
+if [ "$TOOL_NAME" != "Bash" ]; then
+  exit 0
+fi
+
+COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // ""')
+
+# Block any command that starts with git or contains git as a chained command
+# Also catches full-path invocations like /usr/bin/git
+if echo "$COMMAND" | grep -qE '(^|\s|;|&&|\|\|)(/\S+/)?git\s'; then
+  log_block "Git command detected" "$COMMAND"
+  echo "BLOCKED: Git commands are not allowed. Write the git command as text for the developer to review and run manually." >&2
+  exit 2
+fi
+
+exit 0