Protect Commit Privacy
Refuses a matched shell command before it runs.
Acts on
Shell command
When
Before the command runs
Tested
35 of 35 pass
In a git repo
At commit
What it does
Keeps the development conversation out of git history. Guard refuses git commit and gh pr create|edit whose message or body (inline -m/-b, -F/--file/--body-file, heredoc on -F -) holds a process-leak marker (session link, 'user asked', ...); commands behind cd, sh -c, sudo, env are read. A commit-msg hook applies the same markers to the recorded message. Narrow deny-list. No waiver: a legitimate phrase needs a person to remove it from MARKERS in the guard; an agent asks the person.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Refuses a matched shell command before it runsBuild →
- Cursor TestedBlocks Refuses a matched shell command before it runsBuild →
- Codex TestedBlocks Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Refuses a matched shell command before it runs. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
An agent commits with a message that narrates who asked for the change.
git commit -m "quick fix because the user asked for it in review"Allowed
An agent commits with a message that describes the change itself.
git commit -m "fix(hooks): emit LF on Windows for generated dispatchers"Both examples are this policy's own test cases.
What it misses
This policy does not state what it misses.
Latest change
0.2.6 · · Shared shell reader updated (SR-2d1; the copy in implementations/chock_shellparse is regenerated, this policy's own script is unchanged). Added coverage: an arithmetic shift in $(( )), (( )) or $[ ] is no longer read as the start of a here-document, so the lines after it are judged as before; the string given to env -S or --split-string is read as the command env runs; env -i is recorded on the command it runs. Tests: test_shellparse_sr2d1.py.