Add Chock security guard plugins (enforcing PreToolUse hooks) - #77
Add Chock security guard plugins (enforcing PreToolUse hooks)#77open-coder-ai wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Adds four Chock policy plugins to the Copilot marketplace.
Changes:
- Registers destructive-command and hook-bypass guards.
- Adds agent-configuration and commit-privacy protections.
- Documents runtime requirements and limitations.
Suppressed comments (1)
.github/plugin/marketplace.json:521
- This source follows the repository's moving default branch, so the installed guard can change after this review while the marketplace still reports version 0.0.3. Pin the reviewed distribution commit to make the advertised version and reviewed package reproducible.
"source": {
"source": "github",
"repo": "open-coder-ai/chock-copilot-plugins",
"path": "claude/protect-agent-config"
}
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "source": { | ||
| "source": "github", | ||
| "repo": "open-coder-ai/chock-copilot-plugins", | ||
| "path": "claude/block-destructive-commands" | ||
| } |
There was a problem hiding this comment.
Fixed — every source now pins the reviewed release: ref: v0.3.0 plus the full commit sha (f17de7924f33c32fe3075a63c79312df015b4e06). Version and sha update together on each release, so the listed version and the installable bytes cannot diverge.
| "source": { | ||
| "source": "github", | ||
| "repo": "open-coder-ai/chock-copilot-plugins", | ||
| "path": "claude/block-no-verify" | ||
| } |
There was a problem hiding this comment.
Fixed — every source now pins the reviewed release: ref: v0.3.0 plus the full commit sha (f17de7924f33c32fe3075a63c79312df015b4e06). Version and sha update together on each release, so the listed version and the installable bytes cannot diverge.
| "source": { | ||
| "source": "github", | ||
| "repo": "open-coder-ai/chock-copilot-plugins", | ||
| "path": "claude/protect-commit-privacy" | ||
| } |
There was a problem hiding this comment.
Fixed — every source now pins the reviewed release: ref: v0.3.0 plus the full commit sha (f17de7924f33c32fe3075a63c79312df015b4e06). Version and sha update together on each release, so the listed version and the installable bytes cannot diverge.
| }, | ||
| { | ||
| "name": "block-no-verify", | ||
| "description": "Best-effort guard against bypassing git hooks via git commit/push --no-verify or -n. Known bypass classes include aliases, wrapper scripts, and non-standard clients. Fix the underlying hook failure instead of skipping validation. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", |
There was a problem hiding this comment.
Good catch — fixed at the source. block-no-verify 0.0.4 (now the pinned version here) reads short -n as the bypass spelling only on git commit; a push dry-run is allowed (non-mutating, and not a hook bypass — pre-push still runs on a dry-run). The long flag stays blocked on both commands. Also hardened per your rationale: only the first commit/push token classifies the command (an operand named commit can't reclassify a push), and -m/-F value clusters aren't flag-scanned (-mnote is a message). Five eval cases pin the behavior in the catalog.
| }, | ||
| { | ||
| "name": "protect-agent-config", | ||
| "description": "Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081; the AIVSS self-modification factor). The guard refuses shell write-commands targeting those paths; reads pass, and regeneration through `chock sync` passes because the tool writes them itself rather than through shell editing. Best-effort and deliberately coarse: a compound command that both reads a protected file and writes elsewhere may be refused -- rewrite it in two steps. Escape for a human-approved change: include 'chock: approved-config-change' in the command. [Session-enforced via a PreToolUse hook; needs python3 and a usable bash. Without them, fail-open clients allow silently; fail-closed clients refuse matched commands. On Windows, disable the python3 Store alias or install Python.]", |
There was a problem hiding this comment.
You're right that an in-command marker cannot authenticate a human — nothing in-band can, since the restricted agent writes the command line. We kept the escape (so a human-instructed config change isn't hard-blocked mid-session) but fixed the claim: protect-agent-config 0.0.4's description (pinned here) now states the marker is friction plus an audit trail, not authentication, and names the enforcement an agent cannot self-approve — the commit-time gate and CI, which re-check these files regardless of session markers. The session hook is deliberately best-effort; authenticity lives in the repo-level layers.
On git push, -n means --dry-run -- a safe, non-mutating command that runs no hooks -- and the guard wrongly refused it. Found in external review of the Copilot marketplace submission (github/copilot-plugins#77). --no-verify stays blocked on both commit and push; the combined-short-flag check (-nm) is now commit-only for the same reason. block-no-verify 0.0.3 -> 0.0.4. Three eval cases added (push -n allowed, push --no-verify blocked, commit -nm blocked); derived layers regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
On git push, -n means --dry-run -- a safe, non-mutating command that runs no hooks -- and the guard wrongly refused it. Found in external review of the Copilot marketplace submission (github/copilot-plugins#77). --no-verify stays blocked on both commit and push; the combined-short-flag check (-nm) is now commit-only for the same reason. block-no-verify 0.0.3 -> 0.0.4. Three eval cases added (push -n allowed, push --no-verify blocked, commit -nm blocked); derived layers regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
On git push, -n means --dry-run -- non-mutating and not a hook bypass (pre-push still runs on a dry-run) -- and the guard wrongly refused it. Found in external review of the Copilot marketplace submission (github/copilot-plugins#77). --no-verify stays blocked on both commit and push; the combined-short-flag check (-nm) is now commit-only for the same reason. Review follow-ups folded in: only the first commit/push token is the subcommand (an operand named 'commit' cannot reclassify a push), a cluster starting with -m/-F is that option's value (-mnote is a message, not flags), the rule text and both descriptions state the command-specific behaviour, and protect-agent-config's description now states its escape marker is friction plus an audit trail, not authentication (0.0.3 -> 0.0.4). block-no-verify 0.0.3 -> 0.0.4. Five eval cases added; derived layers regenerated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
… fixes) Regenerated from chock-catalog main (277f685) with the framework at main (2c796cd), carrying the guard and description fixes from external review of github/copilot-plugins#77: push dry-run (-n) is no longer refused, subcommand detection takes the first commit/push token, -m/-F value clusters are not flag scanned, and protect-agent-config states its escape marker is friction plus an audit trail, not authentication. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Signed-off-by: open-coder-ai <250249270+open-coder-ai@users.noreply.github.com>
Adds four Chock guard plugins that enforce via a PreToolUse hook on Copilot CLI and VS Code agent mode: block-destructive-commands, block-no-verify, protect-agent-config, protect-commit-privacy. Each source pins the reviewed distribution release (ref v0.3.0 + commit sha) of open-coder-ai/chock-copilot-plugins, a generated repo whose packages pass `claude plugin validate` and regenerate from a reviewed catalog. Review follow-ups: sources are pinned so the reviewed bytes cannot change under the listing; block-no-verify 0.0.4 no longer refuses a push dry-run and scopes the short bypass flag to git commit; protect-agent-config 0.0.4 states its escape marker is friction plus an audit trail, not authentication. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
714c650 to
993484d
Compare
This adds four Chock guard plugins to the marketplace.
Chock is open-source policy-as-code for AI coding agents: you author a policy once and it compiles to real enforcement — including a
PreToolUsehook that Copilot CLI and VS Code agent mode read natively. Unlike advisory skills, these four are session-enforced: the hook exits non-zero and the client refuses the matched command.block-destructive-commandsrm -rfof root/home/absolute paths,git push --force,git reset --hard,kubectl delete, and PowerShell/cmd recursive-force removalsblock-no-verify--no-verify/-nprotect-agent-configprotect-commit-privacySource: all four
sourceentries point atopen-coder-ai/chock-copilot-plugins, a generated, CI-validated distribution repo — every package passesclaude plugin validate, and the repo regenerates from its catalog and fails CI on any drift, so a package here cannot diverge from its reviewed source.Honest posture (stated verbatim in each plugin's description): the hook needs
python3and a usable shell on PATH; without them, fail-open clients allow silently and fail-closed clients refuse matched commands. Chock states this rather than overclaiming enforcement. The guards are best-effort pattern filters, not a security boundary.These are Chock's enforcing guards; it also ships advisory skill policies, which we're happy to submit separately if that's preferred.