Destructive Terraform Guard

blockingstable

Blocks terraform destroy and terraform apply per Common.md §2.2. Opt-in via command-wrappers.toml. Requires explicit bypass via AI_ALLOW_DESTRUCTIVE_TERRAFORM=1. Prevents accidental infrastructure destruction or unreviewed applies. Other tofu/terraform subcommands (plan, init, validate, output) pass through.

ID hook/destructive-terraform-guardVersion 1.0.1Author convergent-systems-key

ai hooks run destructive-terraform-guard

EventPreToolUseLanguagepythonTriggertool-name — BashSide effects

blocks tool call with explanation
bypass via AI_ALLOW_DESTRUCTIVE_TERRAFORM=1

linuxmacoswindowsLogic is cross-platform. Wiring: use 'ai hooks run destructive-terraform-guard' in settings.json — the ai binary discovers Python on each OS. tofu/terraform available on all platforms. Python logic is cross-platform.

governanceterraformtofuinfrastructuredestructiveguardclaude-code

Attribution: convergent-systems-key.