I built Nomos, an open-source policy hook for Claude Code and Codex. It parses shell commands instead of string-matching...

I built Nomos, an open-source policy hook for Claude Code and Codex. It parses shell commands instead of string-matching them, checks every path against the workspace, and applies deny-wins rules kept in Git. A deny holds even under --dangerously-skip-permissions; every decision lands in a hash-linked audit log.On 1,526 real CI commands the default profile allows 777, asks 740, and denies 2.https://github.com/safe-agentic-world/nomosDrafted with help from Claude.#infosec #AI #ClaudeCode #golang #opensource