Protected Paths

Upstream: https://gitlab.com/kilianpaquier/ai-integration
Description: Stop your agent from accessing unwanted or sensitive directories.

Hooks

This plugin registers a PreToolUse hook that inspects every tool call and blocks any that touch a protected directory: ~/.agents, ~/.apm, ~/.aws, ~/.azure, ~/.claude, ~/.codex, ~/.config, ~/.copilot, ~/.docker, ~/.git-credentials, ~/.gnupg, ~/.kube, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.ssh.

An allow-list carves out specific subpaths needed for plugins and instructions to keep working under ~/.apm, ~/.claude, ~/.codex, and ~/.copilot, which are otherwise fully denied.

The hook also catches recursive tools (grep -r, find, tar, rsync, ls -R, …) and bare references like cd ~ that could reach a protected directory without naming it directly.

A blocked call prints an explanatory message and denies the tool call across Claude Code, Codex, Copilot, Cursor and Hermes Agent.

Warning

A relative path used after a cd earlier in the same command is not resolved against that new directory.

Installation

Warning

Nodejs is needed in PATH environment variable to work.

Native plugin (recommended):

my-agent plugin install protected-paths@one-for-all

APM package:

apm install kilianpaquier/ai-integration/plugins/protected-paths -g

APM plugin:

apm marketplace add kilianpaquier/ai-integration
apm install protected-paths@one-for-all -g