From 993484ddcd45623268e913303a1f4db181da215f Mon Sep 17 00:00:00 2001 From: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com> Date: Sun, 23 Aug 2026 19:50:53 -0400 Subject: [PATCH 1/2] Add Chock security guard plugins (enforcing PreToolUse hooks) Adds four Chock guard plugins that enforce via a PreToolUse hook on Copilot CLI and VS Code agent mode: block-destructive-commands, block-no-verify, protect-agent-config, protect-commit-privacy. Each source pins the reviewed distribution release (ref v0.3.0 + commit sha) of open-coder-ai/chock-copilot-plugins, a generated repo whose packages pass `claude plugin validate` and regenerate from a reviewed catalog. Review follow-ups: sources are pinned so the reviewed bytes cannot change under the listing; block-no-verify 0.0.4 no longer refuses a push dry-run and scopes the short bypass flag to git commit; protect-agent-config 0.0.4 states its escape marker is friction plus an audit trail, not authentication. Co-Authored-By: Claude Opus 4.8 --- .github/plugin/marketplace.json | 104 ++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index deba3ab..cf750fe 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -447,6 +447,110 @@ "flowagent" ], "license": "MIT" + }, + { + "name": "block-destructive-commands", + "description": "Best-effort guard against destructive commands: rm -rf targeting absolute, home, or root-adjacent paths; git push --force (not --force-with-lease); git reset --hard; git clean -f; kubectl delete; terraform destroy. Known bypass classes include aliases, quoted arguments, non-standard clients, and scripts that invoke these commands indirectly. This is friction, not a security boundary. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", + "version": "0.0.6", + "author": { + "name": "open-coder-ai", + "url": "https://github.com/open-coder-ai" + }, + "homepage": "https://github.com/open-coder-ai/chock", + "keywords": [ + "chock", + "policy-as-code", + "security", + "guardrail", + "block-destructive-commands" + ], + "license": "Apache-2.0", + "repository": "https://github.com/open-coder-ai/chock-copilot-plugins", + "source": { + "source": "github", + "repo": "open-coder-ai/chock-copilot-plugins", + "path": "claude/block-destructive-commands", + "ref": "v0.3.0", + "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + } + }, + { + "name": "block-no-verify", + "description": "Best-effort guard against bypassing git hooks via git commit/push --no-verify, commit's short -n form, or -c core.hooksPath overrides. On git push, -n means --dry-run and stays allowed. Known bypass classes include aliases, wrapper scripts, and non-standard clients. Fix the underlying hook failure instead of skipping validation. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", + "version": "0.0.4", + "author": { + "name": "open-coder-ai", + "url": "https://github.com/open-coder-ai" + }, + "homepage": "https://github.com/open-coder-ai/chock", + "keywords": [ + "chock", + "policy-as-code", + "security", + "guardrail", + "block-no-verify" + ], + "license": "Apache-2.0", + "repository": "https://github.com/open-coder-ai/chock-copilot-plugins", + "source": { + "source": "github", + "repo": "open-coder-ai/chock-copilot-plugins", + "path": "claude/block-no-verify", + "ref": "v0.3.0", + "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + } + }, + { + "name": "protect-agent-config", + "description": "Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081; the AIVSS self-modification factor). The guard refuses shell write-commands targeting those paths; reads pass, and regeneration through `chock sync` passes because the tool writes them itself rather than through shell editing. Best-effort and deliberately coarse: a compound command that both reads a protected file and writes elsewhere may be refused -- rewrite it in two steps. The 'chock: approved-config-change' escape marker is friction plus an audit trail, not authentication -- the agent can write it too; the check an agent cannot self-approve is the commit-time gate and CI. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", + "version": "0.0.4", + "author": { + "name": "open-coder-ai", + "url": "https://github.com/open-coder-ai" + }, + "homepage": "https://github.com/open-coder-ai/chock", + "keywords": [ + "chock", + "policy-as-code", + "security", + "guardrail", + "protect-agent-config" + ], + "license": "Apache-2.0", + "repository": "https://github.com/open-coder-ai/chock-copilot-plugins", + "source": { + "source": "github", + "repo": "open-coder-ai/chock-copilot-plugins", + "path": "claude/protect-agent-config", + "ref": "v0.3.0", + "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + } + }, + { + "name": "protect-commit-privacy", + "description": "Keep the development conversation out of git history. Agent-authored commits narrate by default -- who asked for what, which discussion decided it, what the plan was -- and on a public repo that narration is published forever. The guard refuses git commit commands whose message (inline -m/--message or the file behind -F/--file) contains process-leak markers; the rule tells the agent to describe the change, not the conversation, and to propose sensitive messages to the human before committing. Best-effort: markers are a narrow deny-list, and a message the human explicitly approves can say anything -- edit the marker list in the guard, the content is yours. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", + "version": "0.0.2", + "author": { + "name": "open-coder-ai", + "url": "https://github.com/open-coder-ai" + }, + "homepage": "https://github.com/open-coder-ai/chock", + "keywords": [ + "chock", + "policy-as-code", + "security", + "guardrail", + "protect-commit-privacy" + ], + "license": "Apache-2.0", + "repository": "https://github.com/open-coder-ai/chock-copilot-plugins", + "source": { + "source": "github", + "repo": "open-coder-ai/chock-copilot-plugins", + "path": "claude/protect-commit-privacy", + "ref": "v0.3.0", + "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + } } ] } From caffd5d85af22c3ac2c0be6559105747fa11f892 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 31 Aug 2026 01:37:04 +0000 Subject: [PATCH 2/2] Repin chock guards to v0.5.0 The listing pinned open-coder-ai/chock-copilot-plugins at v0.3.0, so the marketplace served packages built by an older framework than that repository now publishes. The pin still did its job -- the reviewed bytes could not change under the listing -- but the bytes it froze had fallen behind. Repinned to v0.5.0 (6c2d6e70c40d894dc8f109cf1833f615b7fbfb52), tag and full commit SHA together, so the reviewed-bytes guarantee holds exactly as before. Versions follow the packages at that tag rather than being bumped by hand: block-destructive-commands 0.0.6 -> 0.0.8, block-no-verify 0.0.4 -> 0.0.6, protect-agent-config 0.0.4 -> 0.0.5, protect-commit-privacy 0.0.2 -> 0.0.3. Descriptions are deliberately left as already reviewed, so this change is the pin and nothing else. One of them is now narrower than what the guard does: block-destructive-commands at v0.5.0 also matches aws s3 rm --recursive and rb --force, dropdb, helm uninstall/delete, docker volume rm/prune and system prune, gcloud ... delete, and PowerShell's Remove-Item -Recurse, and matches destructive verbs position-aware so an object merely NAMED like a verb is allowed. Understating coverage is the safe direction -- the description promises less than the guard delivers, never more -- and it can be widened in its own change where it can be reviewed on its merits instead of riding along with a version pin. Verified at the pinned SHA: each of the four claude/ paths exists, and each hooks.json names a script present in its own package. No other listing entry is touched; the file still holds 23 plugins and .claude-plugin/marketplace.json remains a symlink to this path. Signed-off-by: Claude --- .github/plugin/marketplace.json | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/plugin/marketplace.json b/.github/plugin/marketplace.json index cf750fe..a310412 100644 --- a/.github/plugin/marketplace.json +++ b/.github/plugin/marketplace.json @@ -451,7 +451,7 @@ { "name": "block-destructive-commands", "description": "Best-effort guard against destructive commands: rm -rf targeting absolute, home, or root-adjacent paths; git push --force (not --force-with-lease); git reset --hard; git clean -f; kubectl delete; terraform destroy. Known bypass classes include aliases, quoted arguments, non-standard clients, and scripts that invoke these commands indirectly. This is friction, not a security boundary. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", - "version": "0.0.6", + "version": "0.0.8", "author": { "name": "open-coder-ai", "url": "https://github.com/open-coder-ai" @@ -470,14 +470,14 @@ "source": "github", "repo": "open-coder-ai/chock-copilot-plugins", "path": "claude/block-destructive-commands", - "ref": "v0.3.0", - "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + "ref": "v0.5.0", + "sha": "6c2d6e70c40d894dc8f109cf1833f615b7fbfb52" } }, { "name": "block-no-verify", "description": "Best-effort guard against bypassing git hooks via git commit/push --no-verify, commit's short -n form, or -c core.hooksPath overrides. On git push, -n means --dry-run and stays allowed. Known bypass classes include aliases, wrapper scripts, and non-standard clients. Fix the underlying hook failure instead of skipping validation. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", - "version": "0.0.4", + "version": "0.0.6", "author": { "name": "open-coder-ai", "url": "https://github.com/open-coder-ai" @@ -496,14 +496,14 @@ "source": "github", "repo": "open-coder-ai/chock-copilot-plugins", "path": "claude/block-no-verify", - "ref": "v0.3.0", - "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + "ref": "v0.5.0", + "sha": "6c2d6e70c40d894dc8f109cf1833f615b7fbfb52" } }, { "name": "protect-agent-config", "description": "Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081; the AIVSS self-modification factor). The guard refuses shell write-commands targeting those paths; reads pass, and regeneration through `chock sync` passes because the tool writes them itself rather than through shell editing. Best-effort and deliberately coarse: a compound command that both reads a protected file and writes elsewhere may be refused -- rewrite it in two steps. The 'chock: approved-config-change' escape marker is friction plus an audit trail, not authentication -- the agent can write it too; the check an agent cannot self-approve is the commit-time gate and CI. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", - "version": "0.0.4", + "version": "0.0.5", "author": { "name": "open-coder-ai", "url": "https://github.com/open-coder-ai" @@ -522,14 +522,14 @@ "source": "github", "repo": "open-coder-ai/chock-copilot-plugins", "path": "claude/protect-agent-config", - "ref": "v0.3.0", - "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + "ref": "v0.5.0", + "sha": "6c2d6e70c40d894dc8f109cf1833f615b7fbfb52" } }, { "name": "protect-commit-privacy", "description": "Keep the development conversation out of git history. Agent-authored commits narrate by default -- who asked for what, which discussion decided it, what the plan was -- and on a public repo that narration is published forever. The guard refuses git commit commands whose message (inline -m/--message or the file behind -F/--file) contains process-leak markers; the rule tells the agent to describe the change, not the conversation, and to propose sensitive messages to the human before committing. Best-effort: markers are a narrow deny-list, and a message the human explicitly approves can say anything -- edit the marker list in the guard, the content is yours. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", - "version": "0.0.2", + "version": "0.0.3", "author": { "name": "open-coder-ai", "url": "https://github.com/open-coder-ai" @@ -548,8 +548,8 @@ "source": "github", "repo": "open-coder-ai/chock-copilot-plugins", "path": "claude/protect-commit-privacy", - "ref": "v0.3.0", - "sha": "f17de7924f33c32fe3075a63c79312df015b4e06" + "ref": "v0.5.0", + "sha": "6c2d6e70c40d894dc8f109cf1833f615b7fbfb52" } } ]