# Claude Code

Claude Code and chock: install methods and steps, what it can enforce, and the evidence behind it.

Install methods: plugin, sync. Agentseam tier block+rewrite, grade best-effort before a tool runs.

> Ask the user before running any command on this page: each one changes how their agent or repository behaves.

## Install methods

- Plugin: `chock install --client claude-code` (ask the user before running it)
- Repo hooks: `chock sync --repo . --agents claude` writes `.claude/settings.json` (ask the user before running it)

## Install steps

### Claude Code (claude-code)

State: tested.

The command (ask the user before running it: it builds a plugin of hooks that change how their agent behaves):

    chock install --selection <code> --client claude-code --apply

With --apply, chock runs these steps for Claude Code:

    claude plugin marketplace add ~/.chock/marketplace/claude-code

    claude plugin install chock-guardrails@chock-local

Both commands are safe to repeat. The plugin loads in place from the directory: restart the Claude Code session, or run /reload-plugins in it, to pick up a rebuild.

## What it can enforce

- Tier: block+rewrite
- Grade before a tool runs: best-effort
- Fail mode before a tool runs: open
- Basis: live-run
- Recorded: 2026-09-07

## Events

| Event | Can block | Can rewrite | Fail mode |
| --- | --- | --- | --- |
| pre_tool | yes | yes | open |
| post_tool | no | no | open |
| tool_failure | no | no | open |
| prompt_submit | yes | no | open |
| session_start | no | no | open |
| session_end | no | no | open |
| stop | yes | no | open |
| pre_compact | no | no | open |
| subagent_start | no | no | open |
| subagent_stop | no | no | open |
| instructions_loaded | no | no | open |
| file_changed | no | no | open |

## Ask support

Answers an ask with: ask. Honours ask: yes. Evidence: tested (tests/test_guard_fail_to_ask.py::test_a_crashed_guard_asks_rather_than_allowing).

## Hook timeout

The engine records no timeout for this agent.

## Test status

- Plugin (claude-code): tested.
- Repo hooks: untested. A test of the plugin says nothing about repo hooks.
- Through the plugin install, at hook point plugin-hook: Claude Code 2.1.283, Windows, 2026-10-12. live probe of the chock plugin, with every other chock plugin disabled. `block-no-verify` refused a Bash call and `pin-github-actions` refused a Write at PreToolUse, before either ran. Stop was not exercised (org-plan witness/results/witness-claude-code-2026-10-12.md, 198694b)
- Through the git install, at hook point git-hook-env: Claude Code, Bash tool (CLAUDECODE=1, AI_AGENT=claude-code_<version>_agent), 2026-09-29. live probe: both variables were in the environment of a pre-commit hook run by `git commit` from the Bash tool (chock 1b0bcdd)

## Known limits

Richest surface (~30 events). Blocks via exit 2 or hookSpecificOutput.permissionDecision; rewrite via updatedInput (pre_tool only). Fail mode is not documented anywhere in this project (notes, docstring, evidence, CHANGELOG) for pre_tool or prompt_submit, so the weaker claim (FAIL_OPEN) is recorded rather than a guess in our own favour -- pre_tool and prompt_submit had rested on FAIL_CLOSED with no basis, the strongest claim in the whole vocabulary, and the only one of its kind unsupported here. PreCompact's block=True was similarly unsupported and is now detect-only; the hooks reference at the time this adapter was written suggests PreCompact's exit 2 writes to stderr without blocking anything. Live capture 2026-08-27 found detection broken against current builds: Claude Code now sends prompt_id, which this adapter treated as proof a payload was Devin's, so 38 of 42 real payloads were claimed by Devin instead and a deny rendered in the wrong dialect. Fixed by discriminating on fields observed from Claude Code rather than on a field it was assumed to lack. A second live round (2.1.247, 2026-08-28) settled the RESPONSE contract, which no capture can show: each event was sent one candidate reply shape per trial and the verdict read off the agent's own behaviour. prompt_submit and stop read a TOP-LEVEL {decision: block, reason} and ignore hookSpecificOutput.permissionDecision outright -- the shape this adapter emitted at every event, so every prompt_submit and stop deny it ever produced was silently discarded while the dispatcher reported a block. exit 2 is honoured at both too and is deliberately not used: it collapses to 1 under the PowerShell wrapper some vendors apply, and it leaks the hook's command line into the UI. pre_tool keeps permissionDecision, which was not part of that experiment; the observation-only events now get silence.


---

Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).