Destructive Terraform Guard

blocking stable

Blocks terraform destroy and terraform apply per Common.md §2.2. Opt-in via command-wrappers.toml. Requires explicit bypass via AI_ALLOW_DESTRUCTIVE_TERRAFORM=1. Prevents accidental infrastructure destruction or unreviewed applies. Other tofu/terraform subcommands (plan, init, validate, output) pass through.

ID hook/destructive-terraform-guard Version 1.0.0 Author convergent-systems-key

ai hooks run destructive-terraform-guard

Event PreToolUse Language python Trigger tool-name — Bash Side effects

blocks tool call with explanation
bypass via AI_ALLOW_DESTRUCTIVE_TERRAFORM=1

linuxmacoswindows Logic is cross-platform. Wiring: use 'ai hooks run destructive-terraform-guard' in settings.json — the ai binary discovers Python on each OS. tofu/terraform available on all platforms. Python logic is cross-platform.

governanceterraformtofuinfrastructuredestructiveguardclaude-code

Attribution: convergent-systems-key.