Factory Droid

Install methods

• Plugin: chock install --client factory-droid (ask the user before running it)
• Repo hooks: chock sync --repo . --agents factory-droid writes .factory/hooks.json (ask the user before running it)

Install steps

Factory Droid (factory-droid)

Untested

The command (ask the user before running it: it builds a plugin of hooks that change how their agent behaves):

chock install --selection <code> --client factory-droid

Then, in Factory Droid:

Run these from the root of the project the plugin is for: --scope project records it in that project's Droid settings. The marketplace is local to this machine; chock publishes nothing.

1. droid plugin marketplace add ~/.chock/marketplace/factory-droid/chock-local

2. droid plugin install chock-guardrails@chock-local --scope project

Droid names a local marketplace from its source; if droid plugin marketplace list shows a name other than chock-local (a --dest folder named otherwise), install chock-guardrails@<that name>. Droid copies the plugin into its cache: after a rebuild run droid plugin marketplace update and droid plugin update chock-guardrails@chock-local --scope project, then start a new session.

What it can enforce

Tier

block

Grade before a tool runs

best-effort

Fail mode before a tool runs

open

Basis

vendor-docs

Recorded

2026-10-11

Events

Ask support

Answers an ask with: deny. Honours ask: no. Evidence: tested (tests/test_guard_fail_to_ask.py::test_a_crashed_guard_asks_rather_than_allowing).

Hook timeout

Default 60 seconds, set by the timeout field in s.

Vendor source

Test status

• Plugin (factory-droid): untested.
• Repo hooks: untested. A test of the plugin says nothing about repo hooks.
• No row in the engine's list of live tests for this agent.

Known limits

Adapted (D2a): Droid's hooks speak the Claude Code dialect, and its payload carries the same keys as a Claude Code payload, including transcript_path and permission_mode, the markers agentseam uses to recognise Claude Code. A value separates them: every Droid payload carries permission_mode with one of Droid's own values (off, spec, auto-low, auto-medium, auto-high), which Claude Code never sends, so claude_code declines such a payload and factory_droid claims it (claims.accept_values). If a Droid build ever sent a Claude Code permission_mode value, the payload would read as claude_code again, whose deny Droid also honours. A deny is hookSpecificOutput.permissionDecision: deny at PreToolUse and decision: block at UserPromptSubmit and Stop. Escalate and transform degrade to a block: Droid's documented ask does not force a prompt in 0.238.0 (it falls through to the autonomy level's normal permission flow, which may auto-approve), and updatedInput is merged into the original input rather than replacing it, so a transform cannot remove a field. Shell policies see Execute; write policies see Create, Edit, MultiEdit and ApplyPatch, whose patch text is read as content but whose target path lives inside the patch and is not extracted. Install writes .factory/hooks.json keyed directly by event name, the documented project file; Droid snapshots hooks at startup, so a new hook applies to the next session. Fail mode is documented only for non-2 exits (fail-open); timeout and malformed-output behaviour are not documented. The Notification event is not mapped. Instruction files reach it through AGENTS.md. Evidence wanted (to test or overturn this row): https://github.com/open-coder-ai/agentseam/issues/184