lbds137/seyag

A Claude Code plugin marketplace with one plugin, seyag. The plugin is the portable "how to work honestly and well" layer, first built inside the Tzurot repo. It gives every Claude Code session on this machine the same working rules, shell-safety guards and turn-shape checks, whatever project the session is in.
It assumes the owner does not read diffs and is rarely watching the live transcript — on the Anthropic lane she drives from her phone, often by voice; on other lanes she's at the Deck keyboard or RDP-typing from her phone. Agent review and automated checks are the quality gate, and any blocking question has to go through AskUserQuestion so it rises above the transcript.
## What's in it
| Path | What it is |
| plugins/seyag/rules/core.md | The shared working rules, loaded into every session as a user-level rule (see Install): interaction style, working posture, evidence and claims, extra safety rules, reporting. Project rules win when they conflict. |
| plugins/seyag/hooks/ | Hooks with a .probe.sh test next to each. Shell-safety guards: self-matching-pattern-guard, python-heredoc-edit-guard, grep-escaped-dollar-guard, cache-rm-redirect (points a hand-rolled recursive delete of a regenerable cache at safe-clean), broad-walk-guard (blocks find/du/grep -r/rg/fd walks of /, /home, ~ or ~/gdrive, whose rclone mount a walk can wedge), recursive-rm-guard (blocks recursive rm (-r, -R, any --r… prefix of --recursive), find -delete, find -exec rm and xargs/parallel rm with any flags, without the owner's approval; a single rm file stays allowed; it defers to cache-rm-redirect when every delete is a cache delete and exempting deletes strictly inside the job scratch dir $CLAUDE_JOB_DIR/tmp; a blocked delete whose target is under .claude/worktrees/ also names safe-worktree-clean, and a hand-typed git worktree remove --force gets a non-blocking nudge toward it; bypass SYG_ALLOW_RM=1, only for a deletion she approved), lossy-pipe-guard (blocks git commit/git push piped into any filter, gh reads such as gh pr checks piped into head/tail/sed, and check-suite invocations such as run-probes, .probe.sh, pytest, vitest, jest, cargo test or go test piped into head/tail/sed; a project opts its own gh wrapper commands in with SYG_LOSSY_PIPE_GH_WRAPPERS, a whitespace-separated list of wrapper tokens, and SYG_LOSSY_PIPE_SUITES=0 disables the check-suite family), cwd-drift-guard (blocks a bare git command run from a subdirectory whose pathspec only exists from the repo root — or where an untracked copy in the subdir shadows a tracked root file — such as git add docs/x.md from inside pkg/sub, asking the filesystem so it needs no per-repo config; also blocks once per arrival when a bare state-changing git subcommand — the 14 subcommands commit, tag, notes, merge, rebase, reset, cherry-pick, revert, stash, am, checkout, switch, branch, push, with read-only forms exempt: bare branch or listing flags, bare tag or -l/--list/-n, notes with no args or list/show, stash list/show, and push -n/--dry-run — runs in a linked worktree, recording the last warned effective cwd per session/agent in ${XDG_STATE_HOME:-$HOME/.local/state}/seyag/cwd-drift-guard/ [. ]; SYG_CWD_DRIFT_WORKTREE=0 disables the linked-worktree rule), live-checkout-guard (PreToolUse on Bash and Edit\|Write\|MultiEdit\|NotebookEdit: when a live checkout root is active — the git toplevel of ${CLAUDE_PLUGIN_ROOT:- /..} when inside a main working tree with .claude-plugin/marketplace.json at its toplevel unless SYG_LIVE_CHECKOUT_AUTO=0, plus each colon-separated absolute path in SYG_LIVE_CHECKOUTS resolved to its main-working-tree git toplevel; linked worktrees are never live — blocks git checkout/switch away from the default branch (origin/HEAD, fallback main; including -, @{-N}, and remote-only branch DWIM on checkout), checkout [--] and restore --source= /-s unless is the default branch or HEAD, stash except list/show, commit, reset, rm, mv, merge/rebase/cherry-pick/revert/am except --abort/--quit, read-tree with -u/-m, update-ref targeting HEAD or refs/heads/ (including -d) or with --stdin, symbolic-ref HEAD , pull without --ff-only (or overridden by --ff/--no-ff or --rebase/-r) or from a non-origin remote or non-default refspec, apply with --apply/--index or without --check/--stat/--numstat/--summary, clean without -n/--dry-run, sparse-checkout set/add/reapply/init/disable, bisect start, and Edit/Write/MultiEdit/NotebookEdit of non-gitignored paths or .git/ inside the live root; allows checkout [--] , plain restore (or --source/-s naming the default branch or HEAD), checkout/switch to the default branch, merge/rebase/cherry-pick/revert/am with --abort/--quit, pull --ff-only (no positional, origin alone, or origin plus default branch), fetch, read-only subcommands, worktree add\|list\|remove\|prune, branch, gitignored scratch writes, and all work inside a linked worktree; bypass SYG_ALLOW_LIVE_CHECKOUT=1 in the git command's own prefix or the hook environment), env-print-guard (blocks bulk environment or secret dumps into the transcript via env, printenv or set without a downstream names-only selector, or bulk jq reads on .env, .env., .env or settings.json; $VAR file-sink targets trust only the built-in directory-variable allowlist plus space-separated names in SYG_EPG_TRUSTED_VARS; bypass SYG_ALLOW_ENV_PRINT=1 anywhere in the bypassed segment's own words), upstream-submission-guard (blocks gh pr/issue create|new|comment|review|edit, a commented close/reopen, and a gh api write, to a repo the owner doesn't own until the project's AI-contribution stance has been checked; bypass SYG_UPSTREAM_CHECKED= on the gh command itself, once the check is done), publish-gate (blocks a gh command that would make a repo or gist public — gh repo edit --visibility public, gh repo create --public, gh gist create -p/--public, and a gh api write (explicit PATCH/PUT/POST, or a field-flag write) to a repos/OWNER/REPO endpoint carrying private=false or visibility=pu