---
id: block-no-verify
track: coding
version: 0.5.4
label: blocks
keyword: block
where: command
sha256: 45055c8896e8401c430fbf27f60a83194fd8a6aad93e75442b3aae3b0146c330
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-no-verify
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Block Skipping Git Hooks

block-no-verify · version 0.5.4

Blocks — Refuses a matched shell command before it runs. Chock adds friction. It is not a security boundary. 

In a git repo: in agent (The agent's hooks check this once chock sync sets them up. If the hook crashes, the action goes through.)



## What it does

Friction, not a security boundary: refuses agent commands that skip git hooks. --no-verify on commit/push/merge/am/rebase/pull/cherry-pick/revert, -n on commit/am; core.hooksPath set by -c, git config or GIT_CONFIG_*; HUSKY=0, SKIP=, LEFTHOOK=0 and kin; hook manager uninstall; aliases and rebase --exec defined in the command. Asks on plumbing, unset hooksPath, another GIT_DIR and config files. Refuses person-only CHOCK_*/marker changes. Mandatory. Misses: older aliases, scripts, $VARs.

## Its label on each agent

- Claude Code (tested): Blocks — Refuses a matched shell command before it runs. Builder: /coding/builder/#client=claude-code&p=block-no-verify
- Cursor (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks. Builder: /coding/builder/#client=cursor&p=block-no-verify
- Codex (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=block-no-verify
- GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=block-no-verify
- Devin (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=block-no-verify
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=block-no-verify
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=block-no-verify
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=block-no-verify
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=block-no-verify
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=block-no-verify
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=block-no-verify

## What it misses

Older aliases, scripts, $VARs.

## Examples

- Refused: A request asks the agent to run git commit --no-verify. — `git commit --no-verify -m wip`
- Allowed: A request asks the agent to run git commit after all checks pass. — `git commit -m done`

## Latest change

0.5.4 · 2026-10-30 — Fix for Windows (IR-F45; tests in test_block_no_verify_launcher.py). A direct write to the repository config with \`--file .git/config\` was allowed there because the path check compared a backslash-separated path with \`.git/config\`; it now compares with \`/\` separators, so the write is refused on Windows as elsewhere. The comparison also ignores case, since Windows and default macOS file systems fold it: \`.GIT/CONFIG\` is the same file.

## Provenance

- Tested by 116 of 116 cases run automatically
- SHA-256: `45055c8896e8401c430fbf27f60a83194fd8a6aad93e75442b3aae3b0146c330`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-no-verify (catalog path `base/block-no-verify`)
- Presets: Git hygiene
- JSON: `/api/coding/policies/block-no-verify.json`
- Report a problem: https://chock.sh/report/?policy=block-no-verify&version=0.5.4&page=%2Fcoding%2Fpolicies%2Fblock-no-verify%2F