Destructive GitHub CLI Guard

blocking stable

Blocks high-blast-radius, irreversible gh CLI operations per Common.md §2.2. Denies without explicit --force-i-mean-it confirmation: gh repo delete, gh release delete, gh secret delete, and gh auth logout. All other gh subcommands pass through.

ID hook/destructive-gh-guard Version 1.0.0 Author convergent-systems-key

ai hooks run destructive-gh-guard

Event PreToolUse Language python Trigger tool-name — Bash Side effects

blocks tool call with explanation and bypass instructions

linuxmacoswindows Logic is cross-platform. Wiring: use 'ai hooks run destructive-gh-guard' in settings.json — the ai binary discovers Python on each OS. gh CLI available on all platforms. Python logic is cross-platform.

governancegh-clidestructiveguardclaude-code

Attribution: convergent-systems-key.