Add Chock security guard plugins (enforcing PreToolUse hooks) - #77
Open
open-coder-ai wants to merge 2 commits into
Open
Add Chock security guard plugins (enforcing PreToolUse hooks)#77open-coder-ai wants to merge 2 commits into
open-coder-ai wants to merge 2 commits into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds four Chock policy plugins to the Copilot marketplace.
Changes:
- Registers destructive-command and hook-bypass guards.
- Adds agent-configuration and commit-privacy protections.
- Documents runtime requirements and limitations.
Suppressed comments (1)
.github/plugin/marketplace.json:521
- This source follows the repository's moving default branch, so the installed guard can change after this review while the marketplace still reports version 0.0.3. Pin the reviewed distribution commit to make the advertised version and reviewed package reproducible.
"source": {
"source": "github",
"repo": "open-coder-ai/chock-copilot-plugins",
"path": "claude/protect-agent-config"
}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This was referenced Aug 23, 2026
open-coder-ai
added a commit
to open-coder-ai/chock-catalog
that referenced
this pull request
Aug 23, 2026
On git push, -n means --dry-run -- a safe, non-mutating command that runs no hooks -- and the guard wrongly refused it. Found in external review of the Copilot marketplace submission (github/copilot-plugins#77). --no-verify stays blocked on both commit and push; the combined-short-flag check (-nm) is now commit-only for the same reason. block-no-verify 0.0.3 -> 0.0.4. Three eval cases added (push -n allowed, push --no-verify blocked, commit -nm blocked); derived layers regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
open-coder-ai
added a commit
to open-coder-ai/chock-catalog
that referenced
this pull request
Aug 23, 2026
On git push, -n means --dry-run -- a safe, non-mutating command that runs no hooks -- and the guard wrongly refused it. Found in external review of the Copilot marketplace submission (github/copilot-plugins#77). --no-verify stays blocked on both commit and push; the combined-short-flag check (-nm) is now commit-only for the same reason. block-no-verify 0.0.3 -> 0.0.4. Three eval cases added (push -n allowed, push --no-verify blocked, commit -nm blocked); derived layers regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
open-coder-ai
added a commit
to open-coder-ai/chock-catalog
that referenced
this pull request
Aug 23, 2026
On git push, -n means --dry-run -- non-mutating and not a hook bypass (pre-push still runs on a dry-run) -- and the guard wrongly refused it. Found in external review of the Copilot marketplace submission (github/copilot-plugins#77). --no-verify stays blocked on both commit and push; the combined-short-flag check (-nm) is now commit-only for the same reason. Review follow-ups folded in: only the first commit/push token is the subcommand (an operand named 'commit' cannot reclassify a push), a cluster starting with -m/-F is that option's value (-mnote is a message, not flags), the rule text and both descriptions state the command-specific behaviour, and protect-agent-config's description now states its escape marker is friction plus an audit trail, not authentication (0.0.3 -> 0.0.4). block-no-verify 0.0.3 -> 0.0.4. Five eval cases added; derived layers regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
open-coder-ai
added a commit
to open-coder-ai/chock-copilot-plugins
that referenced
this pull request
Aug 23, 2026
… fixes) Regenerated from chock-catalog main (277f685) with the framework at main (2c796cd), carrying the guard and description fixes from external review of github/copilot-plugins#77: push dry-run (-n) is no longer refused, subcommand detection takes the first commit/push token, -m/-F value clusters are not flag scanned, and protect-agent-config states its escape marker is friction plus an audit trail, not authentication. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
Adds four Chock guard plugins that enforce via a PreToolUse hook on Copilot CLI and VS Code agent mode: block-destructive-commands, block-no-verify, protect-agent-config, protect-commit-privacy. Each source pins the reviewed distribution release (ref v0.3.0 + commit sha) of open-coder-ai/chock-copilot-plugins, a generated repo whose packages pass `claude plugin validate` and regenerate from a reviewed catalog. Review follow-ups: sources are pinned so the reviewed bytes cannot change under the listing; block-no-verify 0.0.4 no longer refuses a push dry-run and scopes the short bypass flag to git commit; protect-agent-config 0.0.4 states its escape marker is friction plus an audit trail, not authentication. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
open-coder-ai
force-pushed
the
add-chock-guard-plugins
branch
from
August 23, 2026 23:50
714c650 to
993484d
Compare
The listing pinned open-coder-ai/chock-copilot-plugins at v0.3.0, so the marketplace served packages built by an older framework than that repository now publishes. The pin still did its job -- the reviewed bytes could not change under the listing -- but the bytes it froze had fallen behind. Repinned to v0.5.0 (6c2d6e70c40d894dc8f109cf1833f615b7fbfb52), tag and full commit SHA together, so the reviewed-bytes guarantee holds exactly as before. Versions follow the packages at that tag rather than being bumped by hand: block-destructive-commands 0.0.6 -> 0.0.8, block-no-verify 0.0.4 -> 0.0.6, protect-agent-config 0.0.4 -> 0.0.5, protect-commit-privacy 0.0.2 -> 0.0.3. Descriptions are deliberately left as already reviewed, so this change is the pin and nothing else. One of them is now narrower than what the guard does: block-destructive-commands at v0.5.0 also matches aws s3 rm --recursive and rb --force, dropdb, helm uninstall/delete, docker volume rm/prune and system prune, gcloud ... delete, and PowerShell's Remove-Item -Recurse, and matches destructive verbs position-aware so an object merely NAMED like a verb is allowed. Understating coverage is the safe direction -- the description promises less than the guard delivers, never more -- and it can be widened in its own change where it can be reviewed on its merits instead of riding along with a version pin. Verified at the pinned SHA: each of the four claude/<policy-id> paths exists, and each hooks.json names a script present in its own package. No other listing entry is touched; the file still holds 23 plugins and .claude-plugin/marketplace.json remains a symlink to this path. Signed-off-by: Claude <noreply@anthropic.com>
Author
The enforcement is tested, just not in this repository — and it can't be, since the entries are source-pinned to an external repo. Every one of the 21 policies in open-coder-ai/chock-catalog ships an eval suite (base//evals/suite.yaml), and the publish workflow runs chock check and chock check --only evals as a gate before anything is packaged. A policy whose evals fail cannot reach this listing. On trusting what's listed: the source here pins both a tag and the full commit SHA (v0.5.0 / 6c2d6e70…), and the upstream repo runs a generated-only check that regenerates its whole tree from the catalog and fails on any difference — so the bytes behind this entry are fixed and provably catalog-derived, not hand-edited. On the enforcement claims themselves, the descriptions deliberately understate rather than overstate: each says "Best-effort", names its known bypass classes, states "This is friction, not a security boundary", and spells out that a missing python3 means fail-open clients allow silently. Happy to add anything further a maintainer wants to see. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds four Chock guard plugins to the marketplace.
Chock is open-source policy-as-code for AI coding agents: you author a policy once and it compiles to real enforcement — including a
PreToolUsehook that Copilot CLI and VS Code agent mode read natively. Unlike advisory skills, these four are session-enforced: the hook exits non-zero and the client refuses the matched command.block-destructive-commandsrm -rfof root/home/absolute paths,git push --force,git reset --hard,kubectl delete, and PowerShell/cmd recursive-force removalsblock-no-verify--no-verify/-nprotect-agent-configprotect-commit-privacySource: all four
sourceentries point atopen-coder-ai/chock-copilot-plugins, a generated, CI-validated distribution repo — every package passesclaude plugin validate, and the repo regenerates from its catalog and fails CI on any drift, so a package here cannot diverge from its reviewed source.Honest posture (stated verbatim in each plugin's description): the hook needs
python3and a usable shell on PATH; without them, fail-open clients allow silently and fail-closed clients refuse matched commands. Chock states this rather than overclaiming enforcement. The guards are best-effort pattern filters, not a security boundary.These are Chock's enforcing guards; it also ships advisory skill policies, which we're happy to submit separately if that's preferred.