---
id: block-destructive-commands
track: coding
version: 0.3.1
label: blocks
keyword: block
where: command
sha256: cec4264eaaf8862aa26873c4127dae8aff5ea716e81086b3b3e57edcd3a18085
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-destructive-commands
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Block Destructive Commands

block-destructive-commands · version 0.3.1

Blocks — Refuses a matched shell command before it runs. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Best-effort, on parsed commands (echo ignored); one verdict table shared with rtk-dangerous-actions-blocker. Blocks recursive deletes of root, home, abs paths or .git; mv/chmod/chown -R of system dirs; dd to devices, mkfs; lockouts; force, delete, mirror pushes; history rewrites; switch --discard; IaC destroy; cloud deletes; DB drops. Asks: rm -rf off a safe list, one named kubectl delete, bare lease, stash drop, -auto-approve, drain, prunes, API deletes. Dry runs pass. Pre-push: no non-ff.

## Its label on each agent

- Claude Code (tested): Blocks — Refuses a matched shell command before it runs. Builder: /coding/builder/#client=claude-code&p=block-destructive-commands
- Cursor (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks. Builder: /coding/builder/#client=cursor&p=block-destructive-commands
- Codex (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=block-destructive-commands
- GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=block-destructive-commands
- Devin (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=block-destructive-commands
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=block-destructive-commands
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=block-destructive-commands
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=block-destructive-commands
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=block-destructive-commands
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=block-destructive-commands
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=block-destructive-commands

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A request asks the agent to run git push --force to main. — `git push --force origin main`
- Allowed: A request asks the agent to run git status. — `git status`

## Latest change

0.3.1 · 2026-10-24 — Shared shell reader updated (SR-2d1; the copy in implementations/chock_shellparse is regenerated, this policy's own script is unchanged). Added coverage: an arithmetic shift in \`$(( ))\`, \`(( ))\` or \`$\[ \]\` is no longer read as the start of a here-document, so the lines after it are judged as before; the string given to \`env -S\` or \`--split-string\` is read as the command env runs; \`env -i\` is recorded on the command it runs. Tests: test_shellparse_sr2d1.py and eval cases tc-190 and tc-191.

## Provenance

- Tested by 191 of 191 cases run automatically
- SHA-256: `cec4264eaaf8862aa26873c4127dae8aff5ea716e81086b3b3e57edcd3a18085`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-destructive-commands (catalog path `base/block-destructive-commands`)
- Presets: Shell containment
- JSON: `/api/coding/policies/block-destructive-commands.json`
- Report a problem: https://chock.sh/report/?policy=block-destructive-commands&version=0.3.1&page=%2Fcoding%2Fpolicies%2Fblock-destructive-commands%2F