The latest articles on DEV Community by Kuvosu (@kuvosuco). https://dev.to/kuvosuco https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4127226%2Fc140df6d-9316-4830-b2a2-6cecf63f6a30.png https://dev.to/kuvosuco en Kuvosu Thu, 17 Sep 2026 04:32:19 +0000 https://dev.to/kuvosuco/i-built-guardrails-for-claude-code-after-it-told-me-a-fix-worked-when-it-didnt-2a32 https://dev.to/kuvosuco/i-built-guardrails-for-claude-code-after-it-told-me-a-fix-worked-when-it-didnt-2a32 <p>Just shipped this after getting burned one too many times: <strong>Claude Code Guardrails Pack</strong> — free hooks and skills that stop an AI coding agent from claiming work is done when it never actually checked.</p> <h2> The problem </h2> <p>You've probably hit this if you use Claude Code (or Cursor, Windsurf, any agentic coding tool) for real work:</p> <ul> <li>It tells you a fix works. You ship it. It didn't work — it read the code and decided it looked right, never ran anything.</li> <li>A staged commit almost went out with an API key sitting in the diff.</li> <li>An unattended agent session kept running well past when a human should've looked.</li> </ul> <p>This is the single most-reported frustration with agentic coding tools right now, and I couldn't find a paid tool that addressed it directly — so I built the free version first.</p> <h2> What's in the free pack </h2> <ul> <li> <strong><code>unlazy</code> skill</strong> — requires a real, logged command + output before any "this works" claim</li> <li> <strong><code>handoff</code> skill</strong> — snapshots session state before context runs out, so a fresh session can resume without re-deriving everything</li> <li> <strong><code>safe_git_guard.py</code></strong> — blocks destructive git commands (<code>checkout --</code>, <code>reset --hard</code>, <code>clean -f</code>) when the tree is dirty</li> <li> <strong><code>pre-commit-secret-scan.sh</code></strong> — a plain git hook (works with <em>any</em> AI tool, not just Claude Code) that blocks commits containing AWS/GitHub/Slack/Google/Stripe keys</li> </ul> <p>MIT licensed: <strong><a href="https://github.com/kuvosu-coder/claude-code-guardrails-lite" rel="noopener noreferrer">https://github.com/kuvosu-coder/claude-code-guardrails-lite</a></strong></p> <h2> Why you should trust it </h2> <p>Every piece ships with the exact command used to verify it — including two real bugs the verification process caught before ship (a Windows interpreter-detection issue), documented in the open in the repo's <code>VERIFICATION.md</code> instead of quietly fixed and hidden. That's the whole philosophy: no claim without a real check behind it.</p> <h2> Also available: Pro pack </h2> <p>If the free pack's useful, there's a $14 Pro pack with a secret-scanning <em>Claude Code</em> hook, a per-session tool-call budget guard, and two skills (a real pre-PR checklist, and a framework for when subagent fan-out actually helps vs. burns context): <strong><a href="https://kuvosu.gumroad.com/l/claudecodeguardrails" rel="noopener noreferrer">https://kuvosu.gumroad.com/l/claudecodeguardrails</a></strong></p> <h2> Feedback welcome </h2> <p>If you try it and something doesn't work as documented, tell me the exact command and output — that's the standard I'm holding this to, so "doesn't work" isn't actionable but "ran X, expected Y, got Z" gets fixed fast. Stars/feedback on the repo appreciated if it's useful to you.</p> showdev ai claudecode opensource