{
  "description": "Songwhip guardrails: block (deny) any tool call that touches a .env* secrets file, without interrupting the session.",
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Read|Edit|Write|Grep|Glob|Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/guard-env-files.sh\"",
            "timeout": 10
          }
        ]
      }
    ]
  }
}