Block Destructive Commands
Refuses a matched shell command before it runs.
Acts on
Shell command
When
Before the command runs
Tested
191 of 191 pass
In a git repo
At commit
What it does
Best-effort, on parsed commands (echo ignored); one verdict table shared with rtk-dangerous-actions-blocker. Blocks recursive deletes of root, home, abs paths or .git; mv/chmod/chown -R of system dirs; dd to devices, mkfs; lockouts; force, delete, mirror pushes; history rewrites; switch --discard; IaC destroy; cloud deletes; DB drops. Asks: rm -rf off a safe list, one named kubectl delete, bare lease, stash drop, -auto-approve, drain, prunes, API deletes. Dry runs pass. Pre-push: no non-ff.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Refuses a matched shell command before it runsBuild →
- Cursor TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it asksBuild →
- Codex TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A request asks the agent to run git push --force to main.
git push --force origin mainAllowed
A request asks the agent to run git status.
git statusBoth examples are this policy's own test cases.
What it misses
This policy does not state what it misses.
Latest change
0.3.1 · · Shared shell reader updated (SR-2d1; the copy in implementations/chock_shellparse is regenerated, this policy's own script is unchanged). Added coverage: an arithmetic shift in $(( )), (( )) or $[ ] is no longer read as the start of a here-document, so the lines after it are judged as before; the string given to env -S or --split-string is read as the command env runs; env -i is recorded on the command it runs. Tests: test_shellparse_sr2d1.py and eval cases tc-190 and tc-191.