{
  "schema_version": 1,
  "id": "block-persistence-shapes",
  "track": "coding",
  "name": "Block Persistence and Publishing Commands",
  "version": "0.0.6",
  "sha256": "e1e6484082078f8351fdbae59dde8796266297fd6c35a47372537c0d6dda517c",
  "sha256_v1": "45c713d38c2f2b763420c43db781fc212adf6f7abaefaba74f512b57785ca562",
  "keyword": "block",
  "word": "blocks",
  "says": "refuses a matched shell command before it runs",
  "description": "Best-effort guard against shell commands that publish or keep access after the session: npm/pnpm/yarn/twine/ poetry/uv/cargo/gem publish, docker/podman push and login, npm token and registry edits, repos made public; user services, launch agents, cron/at/schtasks, Run keys, authorized_keys, runner registration, sudoers, setuid bits, detached downloads. Asks on gh release create, git remote add, git push to a URL. Misses: scripts, aliases, system units, shell rc files, ssh-run commands.",
  "misses": "scripts, aliases, system units, shell rc files, ssh-run commands.",
  "where": [
    "command"
  ],
  "groups": [
    "shell-containment"
  ],
  "eval_cases": 109,
  "eval_executed": 109,
  "latest": {
    "version": "0.0.6",
    "date": "2026-10-27",
    "change": "Title wording only (IR-F40): \"Block Persistence Shapes\" is now \"Block Persistence and Publishing Commands\". The id, guard and tests are unchanged."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs"
    },
    "cursor": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. Where its description says it asks, it asks"
    },
    "codex": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "copilot": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "devin": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed)"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-persistence-shapes",
  "enforces": "best-effort (pre-tool-use, once hooks are installed; fails open if the hook crashes)",
  "examples": [
    {
      "word": "Refused",
      "prompt": "A request publishes the package to npm.",
      "command": "npm publish"
    },
    {
      "word": "Allowed",
      "prompt": "A request inspects what would ship with a dry run.",
      "command": "npm publish --dry-run"
    }
  ]
}