🛡 secret-guard — how it decides

flowchart TD
  A([Claude asks to run a tool]) --> B{Which tool?}

  B -->|Bash| C[Bash checks
secret-file read · env dump
printenv SECRET · $SECRET expansion
git add of secret file]
  C --> C2[Scan the command text
for known values + token shapes]
  C2 --> G{git / gh in
the command?}
  G -->|git add -A / .| G1[git status:
would a secret file be staged?]
  G -->|git commit| G2[git diff --cached
scan added lines + file names]
  G -->|git push| G3[git log of commits
not yet on any remote
scan added lines]
  G -->|gh pr / issue / release / gist| G4[Read --body-file / gist files
scan contents]
  G -->|none| F

  B -->|Read| R{Secret file?
.env · .bashrc · .aws · .ssh · secrets/ …}
  R -->|yes| X
  R -->|no| OK

  B -->|Write| W{Secret file?}
  W -->|yes| X
  W -->|no| W2[Scan new content
for known values + token shapes]

  B -->|Edit / NotebookEdit| E[Scan new text
structural edits of a secret file allowed,
carrying a value is not]

  B -->|Anything else
MCP · WebFetch · Agent …| M[Scan every text field
of the input]

  G1 --> F
  G2 --> F
  G3 --> F
  G4 --> F
  W2 --> F
  E --> F
  M --> F

  F{Any finding?}
  F -->|no| OK([✅ Call runs])
  F -->|yes| MODE{Mode}
  MODE -->|block| X([⛔ Refused
Claude gets reason + safe alternative
toast · note on the call · banner · log])
  MODE -->|warn| WN([⚠️ Runs, but flagged
toast · note · banner · log])

  ERR[[The check itself crashed]] -.->|block mode| X
  ERR -.->|warn mode| OK

  classDef bad fill:#3a1414,stroke:#f85149,color:#fff;
  classDef good fill:#12301b,stroke:#3fb950,color:#fff;
  classDef warn fill:#3a2c0e,stroke:#d29922,color:#fff;
  class X bad; class OK good; class WN warn;