Session Hardening

This plugin provides three layers of production hardening:

Pretool Guard (PreToolUse)

Blocks dangerous operations before they execute:

• rm -rf → suggests trash instead
• Co-author injection in commits
• npm/cargo/pip publish without approval
• curl | python/node download-first patterns
• chmod 777 → suggests specific masks
• git reset --hard, git clean -f
• Data exfiltration via curl --data @.env
• Push to main on public repos

Continuous QA (PostToolUse)