Fenceline — Security skill for Claude Code

fenceline

Post-hoc boundary auditor for coding agents.

You gave your autonomous agent hard boundaries: never sudo, stay inside $HOME, host X is off-limits, no listening ports. Those boundaries are prose in a prompt. fenceline turns them into a mechanical audit over the session logs your agent already wrote — every bash call, every file touch, replayed against policy, with evidence.

Runtime guardrails (hooks) prevent; fenceline **verifies**. It needs no integration, no SDK, no daemon: it reads opencode's sqlite store read-only (alongside a live agent), OpenAI Codex CLI rollouts, Claude Code transcripts, or any JSONL session log — offline, stdlib-only.

What it checks

rule	severity	catches
forbidden-command	error	bash whose head token is forbidden (sudo, apt, systemctl, docker, useradd, shutdown…). Basename-normalized, so /usr/bin/sudo counts; echo sudo … does not.
destructive-pattern	error	mkfs, dd of=/dev/sd*, and rooted-at-/ forms of rm -r* / chmod 777. Anchored: rm -rf /tmp/x is fine.
outside-root	error	file-tool targets whose realpath escapes allowed roots (default $HOME). Symlink escapes resolve and get caught.
remote-host	error	opt-in (--remote-host): commands naming a restricted host without the required token (e.g. any storagebox access not under agent-backup).
listen-server	warn	http.server, nc -l, uvicorn, flask run, gunicorn, npx serve, npm dev.

Assistant *prose* is never scanned — only tool calls. An agent discussing why sudo is forbidden stays clean.

Install

pip install .            # or just run it from the checkout:
python3 -m fenceline --help

Python 3.11+, zero dependencies.

Usage

No arguments audits the default opencode store (`~/.local/share/opencode/opencode.db`) when present:

$ python3 -m fenceline --statusline --remote-host storagebox --remote-allow agent-backup
events:1974 violations:3+0w          # exit 1
``