Destructive kubectl Guard

blocking stable

Blocks destructive kubectl operations per Common.md §2.2. Opt-in via command-wrappers.toml. Denies kubectl delete, kubectl drain, and kubectl cordon without the bypass env AI_ALLOW_DESTRUCTIVE_KUBECTL=1. All other kubectl subcommands pass through.

ID hook/destructive-kubectl-guard Version 1.0.0 Author convergent-systems-key

ai hooks run destructive-kubectl-guard

Event PreToolUse Language python Trigger tool-name — Bash Side effects

blocks tool call with explanation
bypass via AI_ALLOW_DESTRUCTIVE_KUBECTL=1

linuxmacoswindows Logic is cross-platform. Wiring: use 'ai hooks run destructive-kubectl-guard' in settings.json — the ai binary discovers Python on each OS. kubectl available on all platforms. Python logic is cross-platform.

governancekubectlkubernetesdestructiveguardclaude-code

Attribution: convergent-systems-key.