Block Persistence and Publishing Commands
Refuses a matched shell command before it runs.
Acts on
Shell command
When
Before the command runs
Tested
109 of 109 pass
In a git repo
In agent
What it does
Best-effort guard against shell commands that publish or keep access after the session: npm/pnpm/yarn/twine/ poetry/uv/cargo/gem publish, docker/podman push and login, npm token and registry edits, repos made public; user services, launch agents, cron/at/schtasks, Run keys, authorized_keys, runner registration, sudoers, setuid bits, detached downloads. Asks on gh release create, git remote add, git push to a URL. Misses: scripts, aliases, system units, shell rc files, ssh-run commands.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Refuses a matched shell command before it runsBuild →
- Cursor TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it asksBuild →
- Codex TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A request publishes the package to npm.
npm publishAllowed
A request inspects what would ship with a dry run.
npm publish --dry-runBoth examples are this policy's own test cases.
What it misses
Scripts, aliases, system units, shell rc files, ssh-run commands.
Latest change
0.0.6 · · Title wording only (IR-F40): "Block Persistence Shapes" is now "Block Persistence and Publishing Commands". The id, guard and tests are unchanged.