anchorwatch-mod

anchorwatch-mod is the Bash guard of Anchorwatch, a guardrails plugin for Claude Code, rewritten as a Claude Mod. It reads every command Claude is about to run through the Bash tool and refuses the ones the classic plugin denies: recursive deletes of critical paths, force pushes to protected branches, history-rewriting git commands, DROP and TRUNCATE, curl | sh, disk formatting, chmod 777, printing a .env file, and shell writes to secret files. The refusal reaches the model as the tool’s error, with the same reason text the classic plugin uses, so Claude can explain the block and propose something safer.

It is an experiment by the Anchorwatch team, at version 0.0.4, and the author calls it a prototype against a pre-release API. The shell-script plugin anchorwatch stays the supported one.

What it does

Nine rules, the ones the classic plugin runs at block level:

• rm-recursive-dangerous: rm -r aimed at /, ~, ., .., *, .git, a system directory, your home or the project root.
• git-force-push-protected: git push --force, -f, --force-with-lease or --force-if-includes to main, master, production, prod or release.
• git-destructive: reset --hard, clean -f, checkout -- ., stash drop, branch -D, filter-branch and similar.
• sql-destructive: DROP TABLE, DROP DATABASE, TRUNCATE, and DELETE FROM without a WHERE.
• pipe-to-shell: curl or wget piped into a shell.
• disk-destroy: mkfs, fdisk, shred, dd if=, redirections into /dev/sd* and the like.
• perm-broad: chmod 777, chmod a+rwx, recursive chown of /.
• env-read: cat, head, less, base64 and other whole-file readers on a .env file. .env.example and its siblings are exempt.
• secret-write: a redirection, tee, cp, mv, sed -i or dd of= whose destination is a .env, a key file, an SSH or cloud credentials file.

A chained command is split into segments on &&, ||, ;, | and newlines, and $(…), backticks, subshells, brace groups and sh -c "…" payloads are unwrapped first, so X=$(rm -rf /) is checked as the command it is.

Install

Needs Claude Code with function hooks enabled and git. The README declares no minimum Claude Code version; the author validated the module scan on 2.1.268. The plugin is not in the anchorwatch marketplace, which only publishes the classic plugin, so you load it from a clone:

git clone https://github.com/anchorwatch-dev/anchorwatch
claude --plugin-dir ./anchorwatch/plugins/anchorwatch-mod

Run the second command from your project directory, with the path pointing at the clone. There is nothing to configure and no command to type: the guard is active from the first Bash call. Without the function hooks flag the module is ignored and the plugin does nothing.

How it works

Two hooks. session.start records the working directory. tool.call, filtered to the Bash tool, reads the command, runs it through the rules in order and either returns a deny with the reason or calls next(e) so the tool runs as normal.

One thing leaves the hook: when a force push names no refspec, it runs git rev-parse --abbrev-ref HEAD through $.process.run, capped at two seconds with $.clock.sleep, to learn which branch is being pushed. That is the only process it spawns. It makes no network calls, writes nothing to disk and keeps only the working directory in memory. The only token cost is the deny reason, which the model reads when a command is blocked.

Failure mode matters for a guard. Claude Code skips a hook that throws or runs past ten seconds and lets the tool run. This mod chains a .catch on its registration that denies the command when the guard never got to answer, so a broken guard says no instead of nothing. If the hook had already dispatched, the .catch replays the tool result instead.

If you run both plugins, this hook runs before the classic Bash guard, because tool.call wraps the classic PreToolUse hooks. The author reports that the two agree on every test fixture.

Limitations

• Not tested in a live session by the author. What is verified: the synthetic-event test suite, 182 cases including parity against the classic guard-bash.sh, and claude plugin validate --strict on 2.1.268. Whether the hook fires in a real session is still to be measured.
• Bash only. The Edit, Write and Read guards stay in the classic plugin, as do the warn-level rules, because the author found no additive-context channel on tool.call to carry a warning.
• No configuration. .anchorwatch.json overrides (rule levels, allow patterns, protected branches) and the ANCHORWATCH_DISABLE kill switch are not ported. The deny text still points to .anchorwatch.json; that only changes the classic plugin.
• Home directory unknown. The hook receives cwd but not home, so ~/.ssh/id_rsa is caught by its file name while directory-only cases such as ~/.aws/config are not. A literal $HOME path is not expanded either.
• It blocks the command, not the output. A secret that reaches the transcript another way is not hidden; secret-redactor covers that side.
• The API is pre-release. The author expects breakage between Claude Code versions.