tripwire

Lessons that fire at the moment of action.

Agent memory is usually read once, at the start of a session, and then hoped for. Three hours later the agent is about to repeat a mistake it has a note about, and the note is nowhere near the decision.

tripwire indexes each lesson by the action that should trigger it. When a coding agent is about to make a matching tool call, the lesson fires right there:

agent runs:  npx wrangler deploy
             │
             ▼  tripwire matches
⚡ TRIPWIRE [deploy-verify-content] (remind): After this deploy, verify on CONTENT,
   not the status code: curl the live URL and grep for text that only the new version
   contains.  (learned: false 'deployed' claims, twice)

It's a Claude Code mod: a plugin with one tool.call hook.

How it works: see ARCHITECTURE.md for the design, request flow, failure model and testing.

Three severities

| Severity | What happens | |---|---| | remind | The call runs. The lesson is attached to its result, so the agent reads it right then. | | ask | You're asked first. No answer (dismissed, or no one to ask) means no. | | block | The call is refused and the agent is told why, and not to work around it. |

When several tripwires match, the strictest one wins and every lesson is shown.

A tripwire

{
  "id": "kv-list-needs-remote",
  "tool": "^Bash$",
  "field": "command",
  "pattern": "wrangler kv key (list|get)",
  "unless": "--remote",
  "severity": "remind",
  "lesson": "Without --remote, wrangler reads the LOCAL dev store and returns []. A working form looks broken.",
  "source": "half an hour lost on a client site"
}

| Field | | |---|---| | tool | Regex on the tool name: ^Bash$, ^(Edit\|Write)$, claude-in-chrome__navigate$ | | pattern | Regex (case-insensitive) on the tool input | | field | Optional. Test one input field (command, file_path, url). Default: every string in the input | | unless | Optional. If this also matches, stay quiet (e.g. --dry-run) | | redact | Never echo the matched text. Use it for tripwires that match secrets | | source | Where the lesson was learned, so it can be checked later |

Built-in tripwires

Twelve real mistakes, each with where it was learned, in hooks/tripwires.ts:

• block: a secret (Stripe, Supabase, AWS, Resend, GitHub, JWT) in a command's text, never echoed back · Claude attribution in a commit · assets.directory pointed at the repo root
• ask: an unwrapped schema or data change (update, drop, alter) · scripts that email real people
• remind: verify deploys on content · wrangler kv without --remote · Apps Script redirects need GET · only commit when asked · Google Sheets formula injection · Gmail compose swallows the first keystrokes · a paused free-tier Supabase project

Add your own in ~/.claude/tripwires.json: an array, or { "tripwires": [...] }. Broken entries are skipped, never fatal, and listed by /tripwires.

Commands

/tripwires lists every tripwire, how often each fired and when, plus any broken entries.

Install

git clone https://github.com/amahmood561/tripwire ~/tripwire
claude --plugin-dir ~/tripwire          # one session

To load it in every session, add the folder to the env block of ~/.claude/settings.json:

{ "env": { "CLAUDE_CODE_PLUGIN_DIRS": "~/tripwire" } }

Design notes

• Advice must never stop work by accident. A malformed tripwire file is skipped, not fatal. Only an explicit block or a declined ask stops a call.
• ask fails closed. A dismissed question, or a session with no one to ask, is treated as "no".
• Secrets are never repeated. A redact tripwire reports [redacted], never the match.
• It pairs with memory, not instead of it. Notes hold the why; tripwires hold the when. A lesson that keeps firing and keeps being ignored should be promoted to block; one that never fires in months can be retired.

Test

claude plugin validate .
claude plugin test .      # 13 tests: every built-in fires on its mistake and stays quiet on the fix