Protected Paths
- Upstream: https://gitlab.com/kilianpaquier/ai-integration
- Description: Protégez l’accès aux dossiers sensibles aux agents.
Hooks
This plugin registers a PreToolUse hook that inspects every tool call and blocks any that touch a
protected directory: ~/.agents, ~/.apm, ~/.aws, ~/.azure, ~/.claude, ~/.codex, ~/.config, ~/.copilot, ~/.docker,
~/.git-credentials, ~/.gnupg, ~/.kube, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.ssh.
An allow-list carves out specific subpaths needed for plugins and instructions to keep working under
~/.apm, ~/.claude, ~/.codex, and ~/.copilot, which are otherwise fully denied.
The hook also catches recursive tools (grep -r, find, tar, rsync, ls -R, …) and bare
references like cd ~ that could reach a protected directory without naming it directly.
A blocked call prints an explanatory message and denies the tool call across Claude Code, Codex, Copilot, Cursor and Hermes Agent.
Warning
A relative path used after a cd earlier in the same command is not resolved against that new directory.
Installation
Warning
Nodejs is needed in PATH environment variable to work.
Native plugin (recommended):
my-agent plugin install protected-paths@one-for-allAPM package:
apm install kilianpaquier/ai-integration/plugins/protected-paths -gAPM plugin:
apm marketplace add kilianpaquier/ai-integration
apm install protected-paths@one-for-all -g