--- id: protect-agent-config track: coding version: 0.7.6 label: blocks keyword: block where: command write turn-end sha256: b102a0f64c869c94ad8b6c6233749a66f8785358da2a1aac1f58f532651e2a64 source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-agent-config catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Protect Agent Config protect-agent-config · version 0.7.6 Blocks — Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: in agent (The agent's hooks check this once chock sync sets them up. If the hook crashes, the action goes through.) ## What it does Stops an agent editing its guardrails (MITRE ATLAS AML.T0081). Shell guard refuses writes to AGENTS.md, whole agent folders (.claude/, .cursor/, .codex/, .gemini/, .agents/, .chock/, ...), MCP/hook client configs (.mcp.json, ...), guardrails toggles, plugin install markers, chock.lock, hook files of Cline, Kiro, Augment, Windsurf and Devin (user and machine level), ~/.claude.json, Claude Code plugin roots, project config of Kilo Code, opencode, Factory, Amp, Continue and Goose, .git/{hooks,config}, policy implementations/: redirect, rm/mv/tee/sed -i, cp into, git checkout/restore, a write through a symlink; CLAUDE_CODE_PLUGIN_DIRS, claude --plugin-dir, chock resume (best effort). Any case. An instruction file under docs/ asks a person. Coarse: also eval or sh -c of computed text, shells fed by pipe/variable, interpreter one-liners naming such a path. Reads, \`chock sync\` pass. Edit/Write: tool gate, same set and verdicts. Misses: user config under ~/.config/, writes a script makes, an existing hard link. ## Its label on each agent - Claude Code (tested): Blocks — Refuses a matched shell command before it runs. Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=protect-agent-config - Cursor (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks. Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=protect-agent-config - Codex (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=protect-agent-config - GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=protect-agent-config - Devin (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=protect-agent-config - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=protect-agent-config - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=protect-agent-config - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=protect-agent-config - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=protect-agent-config - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=protect-agent-config - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=protect-agent-config ## What it misses User config under ~/.config/, writes a script makes, an existing hard link. ## Examples - Refused: An agent rewrites its own permission file in place. — `sed -i s/deny/allow/ .claude/settings.json` - Allowed: An agent reads its permission file. — `cat .claude/settings.json` ## Latest change 0.7.6 · 2026-10-27 — Behaviour change (SR-2d2e, Claude Security finding F24; eval cases tc-1588 to tc-1593; tests in test_protect_agent_config_sr2e.py). \`mkdir\`, \`mkdir -p\`, \`md\`, and each spelling the guard already reads for other verbs (braces, variables, \`cd\` then a relative path, \`bash -c\`, quoting, \`\\\\\` separators, capitals), is refused when it makes a folder at or under \`.chock/compiled\`, the one protected path whose bare existence a gate reads (the constant \`PRESENCE\` in pathset.py, checked against the protected paths in a test; dockerfile-compose-security reads \`.chock/compiled/\\` as an installed sibling). An empty folder planted there misled it. A \`mkdir\` anywhere else stays open: \`build/out\`, \`.claude/commands\`, \`.cursor\`, \`.agents/policies/\\` (no gate reads a bare folder there; writes inside are still refused). ## Provenance - Tested by 1593 of 1593 cases run automatically - SHA-256: `b102a0f64c869c94ad8b6c6233749a66f8785358da2a1aac1f58f532651e2a64` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-agent-config (catalog path `base/protect-agent-config`) - Presets: Agent configuration - JSON: `/api/coding/policies/protect-agent-config.json` - Report a problem: https://chock.sh/report/?policy=protect-agent-config&version=0.7.6&page=%2Fcoding%2Fpolicies%2Fprotect-agent-config%2F