peepholelisted

# Peephole mode control Peephole is a plugin for coding agents: it steers the write and can ask or deny before a file is saved. Modes: - **guided** — **Default.** Findings are asks. Self-protection and org mandates still deny. - **audit** — warn + log only. Org-`enforce` CWEs and self-protection still deny. - **strict** — deny high-confidence CWE patterns, ask on lower-confidence ones. - **hardened** — deny-by-default; deny unverified package installs and uninspectable writes. - **off** — enforcement disabled. ## To change mode **Raising** enforcement (to `strict` or `hardened`) can be done from the shell: ```sh sh "$CLAUDE_PLUGIN_ROOT/hooks/peephole.sh" mode strict ``` **Lowering** enforcement (to `audit` or `off`) is a human-only action — peephole denies a model-issued `mode off`/`mode audit` command as a self-protection measure. To lower it, the **user** types the whole message `/peephole off` (or `audit`), which the UserPromptSubmit hook applies directly. This prevents the assistant from waiving the gate on its own. ## To see current mode and activity Run `/sec-audit` (see the sec-audit skill), which prints the current mode, decision tally, and log-chain integrity.