---
id: package-lifecycle-scripts
track: coding
version: 0.1.2
label: blocks
keyword: block
where: write turn-end
sha256: 7d5d4e46317f447675b63e4585a5f695b47e3714510f12a45c0b8acf79bf021d
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/package-lifecycle-scripts
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Review Scripts That Run on Install

package-lifecycle-scripts · version 0.1.2

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Blocks fetch-exec class hooks and asks about other new ones when a change adds or edits code that runs at install or build time: npm install/prepare/pack scripts, gypfile without native sources, bin shadowing, unpinned git/URL deps; setup.py cmdclass and import-time calls, .pth imports, conftest, pyproject build hooks; build.rs and build-deps; go:generate; MSBuild Exec; gemspec, extconf, Podfile, Composer, Maven, Gradle exec. Judges file text, not what a hook runs. Friction, not a security boundary.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=package-lifecycle-scripts
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=package-lifecycle-scripts
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=package-lifecycle-scripts
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=package-lifecycle-scripts
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=package-lifecycle-scripts
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=package-lifecycle-scripts
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=package-lifecycle-scripts
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=package-lifecycle-scripts
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=package-lifecycle-scripts
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=package-lifecycle-scripts
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=package-lifecycle-scripts

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A commit adds a postinstall script that pipes a download into sh (roadmap postinstall-curl).
- Allowed: A commit adds husky's documented prepare script (roadmap husky-prepare).

## Latest change

0.1.2 · 2026-10-27 — Title wording only (IR-F40): "Flag Package Lifecycle Scripts" is now "Review Scripts That Run on Install". The id, guard and tests are unchanged.

## Provenance

- Tested by 28 of 28 cases run automatically
- SHA-256: `7d5d4e46317f447675b63e4585a5f695b47e3714510f12a45c0b8acf79bf021d`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/package-lifecycle-scripts (catalog path `base/package-lifecycle-scripts`)
- Presets: Packages and supply chain
- JSON: `/api/coding/policies/package-lifecycle-scripts.json`
- Report a problem: https://chock.sh/report/?policy=package-lifecycle-scripts&version=0.1.2&page=%2Fcoding%2Fpolicies%2Fpackage-lifecycle-scripts%2F