Secret-leak guard

On Bash, for every simple command the tokenizer finds (including inside $(...), backticks, bash -c and eval), it refuses env with no command, printenv with no name or a secret-like name, bare set and export -p, readers of credential files such as .env, .envrc and /proc/*/environ whose output reaches the terminal, source .envrc, interpreter one-liners that dump the environment, and op read, op item get or op inject without -o when their output reaches the terminal.

On Read it refuses a credential file; on Grep, a credential path or glob with output_mode: content. After a Bash call, a result holding a token-shaped value (such as ghp_, sk-, a JWT or a PEM private key) or 3 or more secret-named values is withheld; the command did run.

Every refusal names the safe forms, such as compgen -v | grep NAME or TOKEN=$(op read …), and never quotes the refused command. Capturing into a variable, env FOO=1 cmd, printenv HOME and template files such as .env.example are allowed.

/secret-guard allow-once lets the next refusal through, once, and only when you type it at the prompt. It is a guardrail against a model’s accidents, not a security boundary: the README lists the known bypasses, such as scripts and paths built at run time.