Rules that live in the context window get diluted as the session grows. Rules that live in hooks don't. Minos moves your hard rules out of the model's memory and into deterministic checks that run on every command and edit, blocking or warning before the action lands.
Your CLAUDE.md says "never force-push." The agent reads it, agrees, complies.
That instruction is 180,000 tokens behind the cursor, dissolved by context drift and compaction. The agent force-pushes with total confidence.
The hook runs outside the context window. Same check at minute 1 and minute 300. No drift, no dilution.
Every one of these happened to real teams, with real agents, in the last year. Names withheld; the pattern is what matters.
An agent deleted a production database during an active code freeze, despite receiving repeated instructions not to make changes. Then it fabricated data to cover the gap.
An agent created a directory literally named ~,
then "cleaned it up" with an unquoted rm -rf ~.
The shell expanded it to the real home directory. Machine wiped.
An agent dropped a database and its backups, stored on the same volume, in nine seconds. Recovery meant nothing was left to recover.
Instructions are not enforcement. Hooks are.
Deterministic first: keyword and regex rules cost nothing and never drift. Reach for the model only when the question genuinely needs one.
Literal substring match against the command or edit. Instant, free, zero false ambiguity.
"push --force", "push -f"
Pattern match for the cases keywords can't pin down: flag variants, path shapes, injected pipes.
curl[^|]*\|\s*(ba|z)?sh
A narrow yes/no question put to a model, with per-rule model choice from any Claude or OpenCode model you have.
"Is this reinventing existing tooling?"
Minos doesn't just block. A warn or block hands the agent a message it can act on, so the correction you'd have made in review happens on its own, before the diff ever reaches you.
Wrong commit trailer, a stray console.log, an edit to a
frozen migration: the agent reads the message, fixes it, and moves on. You review the
result, not the mistake.
A fresh correction stays in the agent's context, so it keeps doing the right thing for a good while. And when the reminder fades, Minos just catches it again. Either way you never say it twice.
Told it to use your deploy script instead of raw kubectl
and it drifted back? A rule makes the switch stick, warning or blocking until the agent
reaches for the right one.
Rules live in JSONC: comments and trailing commas welcome.
~/.config/minos/rules.jsonc
.minos/rules.jsonc
Or skip the file entirely: /minos:configure block force pushes here
writes and verifies the rule for you, and minos config opens a local web UI
with a rule editor, live test sandbox, and judge model picker.
Browse worked example rules → every one is engine-verified with its real output.
// project rules win over global by id { "rules": [ { "id": "no-claude-coauthor", "appliesTo": { "tools": ["Bash"], "commandMatch": ["git commit"] }, "trigger": { "type": "contains", "patterns": ["Co-Authored-By: Claude"] }, "action": "block", "message": "Strip the trailer before committing." }, { "id": "reinventing-the-cli", "appliesTo": { "tools": ["Bash"] }, "trigger": { "type": "llm-judge", "prompt": "rules/prefer-existing-tooling.md" }, "action": "warn" } ] }
$ claude plugin marketplace add FlavioZanoni/minos $ claude plugin install minos@minos
Registers PreToolUse (Bash) and PostToolUse (Edit/Write) hooks,
plus the /minos:* slash commands.
// .opencode/package.json { "dependencies": { "minos": "github:FlavioZanoni/minos" } } // .opencode/plugins/minos.js export { MinosPlugin } from "minos/opencode";
No registry needed: installs straight from GitHub. Same config files, same rules, same engine.
Add a Minos rule that blocks any commit command containing a
Co-Authored-By: Claude trailer. The check runs in a hook before the
commit lands, so it holds even late in a long session. Minos ships this exact rule
as a copy-paste example.
Rules written in CLAUDE.md live in the model's context window and lose attention as the session grows (context drift), and compaction summarizes them away. Minos moves hard rules into hooks that run outside the context window, so they enforce the same at minute 1 and at minute 300.
Add a regex or keyword rule that blocks it. Minos checks every shell command in a
PreToolUse hook and denies it before it runs, no matter how the agent phrases it. A
ready-made no-destructive-commands example is included.
Yes. One host-neutral engine with a thin adapter for each: a Claude Code plugin that wires PreToolUse and PostToolUse hooks, and an OpenCode plugin that runs in-process. Same config files, same rules, same behavior on both.
Yes. Minos is Apache-2.0 licensed and free. It installs straight from GitHub with no registry, account, or paid tier.