Chock policies as installable Claude Code plugins — each says whether it enforces in your client or advises.
An agent you're running can already touch your shell, your git history, and your CI config.
You want it to move fast without being the reason a stray rm -rf or a force-push actually
happens. Telling it to be careful in a prompt is not a guarantee; a plugin that can refuse
the command is closer to one — and it should be honest about which of those two it is.
# Claude Code
/plugin marketplace add open-coder-ai/chock-claude-plugins
/plugin install block-destructive-commands@chockThe Claude plugin format is also read natively by GitHub Copilot CLI, VS Code, and Grok Build, so this repository works there too.
Every package here says whether it enforces in your client or only advises, and never claims
past what its mechanism does. The same policy can appear twice: as a Claude-format package
under claude/ that ships a PreToolUse hook where the policy has a guard, and as an Agent
Plugins 1.0 package under agent-plugins/, which is advisory because that standard carries no
hooks. See PLUGINS.md for the full list: each policy, its version, its
posture in this client, and a link to its page in the catalog.
A plugin governs one person's session in one client; it doesn't run in CI or travel with a
clone. For enforcement that follows the repository instead, install Chock directly:
pip install chock && chock init && chock sync --ci.
Every file here is compiled from policy sources in chock-catalog by chock. Pull requests against this repository are closed automatically — open them against the catalog instead.
- Generated only: CI regenerates from the pinned catalog and fails on any difference.
- Byte-identical guards: guard scripts and the hook adapter are verbatim copies of their framework sources.
- Best-effort, not a boundary: guards are pattern-based filters; see SECURITY.md.
- This README is the exception: the one hand-written file in this repository, so it alone sits outside the generated-only guarantee.
| agentseam | the primitives — one handler API and a verified capability matrix across 16 agents |
| chock | the compiler — one policy into git hooks, CI gates and native pre-tool hooks |
| chock-catalog | the policies — 39, each labelled enforced or advisory, with replayed evals |
| context-report | the evidence — a signed report of whether an agent artifact actually works |
| chock-threat-intel | the threat ledger the catalog's policies answer to |
| chock-{claude,cursor,copilot,codex}-plugins | the catalog, packaged for each agent's plugin format (generated) |
| chock-quickstart · chock-example | template repos: what chock init leaves behind, and a full adoption |
Apache-2.0, same as the framework and the catalog.