Claude Code

Install methods

• Plugin: chock install --client claude-code (ask the user before running it)
• Repo hooks: chock sync --repo . --agents claude writes .claude/settings.json (ask the user before running it)

Install steps

Claude Code (claude-code)

Tested

The command (ask the user before running it: it builds a plugin of hooks that change how their agent behaves):

chock install --selection <code> --client claude-code --apply

With --apply, chock runs these steps for Claude Code:

1. claude plugin marketplace add ~/.chock/marketplace/claude-code

2. claude plugin install chock-guardrails@chock-local

Both commands are safe to repeat. The plugin loads in place from the directory: restart the Claude Code session, or run /reload-plugins in it, to pick up a rebuild.

What it can enforce

Tier

block+rewrite

Grade before a tool runs

best-effort

Fail mode before a tool runs

open

Basis

live-run

Recorded

2026-09-07

Events

Ask support

Answers an ask with: ask. Honours ask: yes. Evidence: tested (tests/test_guard_fail_to_ask.py::test_a_crashed_guard_asks_rather_than_allowing).

Hook timeout

The engine records no timeout for this agent.

Test status

• Plugin (claude-code): tested.
• Repo hooks: untested. A test of the plugin says nothing about repo hooks.
• Through the plugin install, at hook point plugin-hook: Claude Code 2.1.283, Windows, 2026-10-12. live probe of the chock plugin, with every other chock plugin disabled. block-no-verify refused a Bash call and pin-github-actions refused a Write at PreToolUse, before either ran. Stop was not exercised (org-plan witness/results/witness-claude-code-2026-10-12.md, 198694b)
• Through the git install, at hook point git-hook-env: Claude Code, Bash tool (CLAUDECODE=1, AI_AGENT=claude-code_<version>_agent), 2026-09-29. live probe: both variables were in the environment of a pre-commit hook run by git commit from the Bash tool (chock 1b0bcdd)

Known limits

Richest surface (~30 events). Blocks via exit 2 or hookSpecificOutput.permissionDecision; rewrite via updatedInput (pre_tool only). Fail mode is not documented anywhere in this project (notes, docstring, evidence, CHANGELOG) for pre_tool or prompt_submit, so the weaker claim (FAIL_OPEN) is recorded rather than a guess in our own favour -- pre_tool and prompt_submit had rested on FAIL_CLOSED with no basis, the strongest claim in the whole vocabulary, and the only one of its kind unsupported here. PreCompact's block=True was similarly unsupported and is now detect-only; the hooks reference at the time this adapter was written suggests PreCompact's exit 2 writes to stderr without blocking anything. Live capture 2026-08-27 found detection broken against current builds: Claude Code now sends prompt_id, which this adapter treated as proof a payload was Devin's, so 38 of 42 real payloads were claimed by Devin instead and a deny rendered in the wrong dialect. Fixed by discriminating on fields observed from Claude Code rather than on a field it was assumed to lack. A second live round (2.1.247, 2026-08-28) settled the RESPONSE contract, which no capture can show: each event was sent one candidate reply shape per trial and the verdict read off the agent's own behaviour. prompt_submit and stop read a TOP-LEVEL {decision: block, reason} and ignore hookSpecificOutput.permissionDecision outright -- the shape this adapter emitted at every event, so every prompt_submit and stop deny it ever produced was silently discarded while the dispatcher reported a block. exit 2 is honoured at both too and is deliberately not used: it collapses to 1 under the PowerShell wrapper some vendors apply, and it leaks the hook's command line into the UI. pre_tool keeps permissionDecision, which was not part of that experiment; the observation-only events now get silence.