Environment Guard

Environment Guard makes the workbench itself tell you when you are pointed at production. It watches three local signals:

  • the kubectl current-context in your kubeconfig,
  • the Terraform workspace marker (.terraform/environment),
  • the git branch of each workspace folder.

When a signal matches your production patterns, the single Syntalume status entry changes to a red $(shield) PROD state and (optionally) the status bar or title bar takes a warning tint. An optional editor banner can mark the first line of visible editors, but only for confirmed production—not staging. Staging matches get an amber treatment. Syntalume does not add a row of permanent feature icons.

Privacy and safety#

  • File reads only. Syntalume never runs kubectl, terraform, or git for this feature, and nothing leaves your machine.
  • Trusted workspaces only, and off by default. Enable with Syntalume: Toggle Environment Guard.
  • Desktop VS Code only (browser VS Code has no local files to read).

Configure#

{
  "auralis.environmentGuard.enabled": true,
  "auralis.environmentGuard.tint": "statusBar",
  "auralis.environmentGuard.editorBanner": false,
  "auralis.environmentGuard.alert": "statusOnly",
  "auralis.environmentGuard.prodPatterns": ["prod", "production", "live", "main$", "master$"],
  "auralis.environmentGuard.stagingPatterns": ["stag", "staging", "preprod", "uat", "release"]
}

Patterns in Settings are case-insensitive regular expressions matched against each signal. Matching runs in a cancellable worker with a 250 ms budget per evaluation, at most 64 patterns per category, 256 characters per pattern, and 4,096 characters per signal. Invalid, oversized, or timed-out checks show an explicit unknown warning; an incomplete check is never reported as safe. Repository-shared profiles use literal production/staging labels; Syntalume escapes them before writing workspace patterns so a repository cannot inject executable regular-expression behavior.

alert can be statusOnly or oncePerSignal. The second option shows one native warning for a newly detected risky signal, with View signals and Snooze this signal actions. A fingerprint, not the raw context or branch name, is remembered in workspace state to prevent repeat alerts. Snooze hides the Guard status, tint, and optional editor banner for that exact signal for 30 minutes, then restores them if the signal is still active. The Environment Status menu shows the remaining time and lets you resume immediately.

tint can be off, statusBar, or full (status bar + title bar). The tint is written to workspace settings and removed automatically when you leave the risky context; Syntalume: Reset Syntalume Settings also removes it.

If the Toggle Environment Guard command enabled Guard, General Reset restores its prior enabled value as well as removing the owned tint, so a later refresh cannot tint the workspace again. A manual Settings edit made afterward wins.

editorBanner is off by default. When enabled, Syntalume owns one temporary editor decoration and removes it when production clears, the signal is snoozed, the setting is disabled, the extension stops, or Syntalume settings are reset. It never writes editor text or leaves a decoration behind.

Click the Syntalume status entry (or run Syntalume: Show Environment Status) to see exactly which local signal matched and open the relevant settings. Incomplete checks remain visible as Guard unknown. If you explicitly enable auralis.environmentGuard.showWhenSafe, completed checks with no matching pattern show a neutral no match shield. Neither label certifies safety.

Kubeconfig files are read in KUBECONFIG order, using the first nonempty current context (at most 32 files, 1 MiB per file). Empty values and YAML comments are handled as YAML; aliases and excessive nesting are rejected. Missing, unreadable, malformed or timed-out kubeconfig inputs make the check incomplete even when another signal can still be classified. The maximum is 96 file watchers: 32 kubeconfigs plus Git/Terraform signals for 32 folders.

JetBrains Companion#

The optional Companion provides local Guard controls in its status widget and Tools menu. It reads the same ordered kubeconfig context and reports missing or invalid contexts as unknown. Its RE2/J matcher is non-backtracking, with at most 32 patterns per category, 256 characters per pattern and 4,096 characters per signal. Unsupported lookarounds and backreferences are rejected explicitly. File collection runs off the UI thread with only one in-flight collection per project; no command or kubeconfig authentication plugin is executed.