Chock.sh Build your plugin

For AI agents

How to read chock.sh: the machine-readable catalog at /api/index.json, per-policy JSON and Markdown twins, and the selection format.

What this site is

This site, chock.sh, is a static catalog of guardrail policies for AI coding agents. The site has 3 sections: Coding agents under /coding/, General agents under /general/ (still in design) and Git repositories under /repos/. Every page has a Markdown twin at the same path: fetch index.md inside the page's directory. The catalog is pinned to one chock-catalog commit, shown in the footer of every page.

Machine-readable data

Start at /api/index.json: it lists the site's sections, each with a home path and an api path. For the coding section, read /api/coding/catalog.json. It holds every visible policy and preset, with schema_version 1 and track coding. /api/coding/policies/<id>.json holds one policy record, /api/coding/presets.json the presets, and /api/coding/selection.schema.json the schema a selection file is checked against. The same catalog data is at /data/site.json.

Labels

Every policy carries one label per agent: the catalog's grade for it on that agent. Blocks: the agent refuses the action. Asks: the agent stops and asks the user. Warns: the action goes ahead with a warning. Advisory: the agent reads the text, and nothing stops a violation. A policy the catalog does not grade on an agent yet says "Not graded yet" there. Never read another agent's grade in its place. Each JSON record has the default agent's label in keyword and says, and every agent's label under agent_labels.

Choosing policies with the user

Pick policy ids together with the user. Do not pick them on the user's behalf. The presets are named starting points. A policy's page lists the presets it belongs to. An advisory policy adds text the agent reads. It stops nothing on its own.

Building the selection

Build the selection object exactly as the schema describes. It holds:

Encode it as base64url of the UTF-8 JSON, without padding. The same functions are below in Python and JavaScript.

Encode a selection object to its share code:

import base64, json

def encode_selection(obj):
    data = json.dumps(obj, separators=(",", ":")).encode("utf-8")
    return base64.urlsafe_b64encode(data).decode("ascii").rstrip("=")
export function encodeSelection(obj) {
  const bytes = new TextEncoder().encode(JSON.stringify(obj));
  let bin = "";
  for (const b of bytes) bin += String.fromCharCode(b);
  return btoa(bin).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
}

A worked example

The git-hygiene preset for claude-code, built the way the section above describes. The site build generates the selection object, its share code and the command from the pinned catalog, so they match this catalog commit. Ask the user before running the command.

The selection object for the git-hygiene preset, then its share code and command:

{
  "schema": 2,
  "client": "claude-code",
  "bundle": {
    "version": "1.0.0"
  },
  "catalog": {
    "source": "https://github.com/open-coder-ai/chock-catalog",
    "ref": "1e60d211c1bb767152c6ab0167932da06ab3a10f"
  },
  "preset": "git-hygiene",
  "policies": [
    {
      "from": "catalog",
      "id": "block-hook-bypass-in-files",
      "version": "0.1.2",
      "sha256": "6a64829bce5cd926cf6628869f64bc0b663eca4b849bb68fd5ada079f5a20896"
    },
    {
      "from": "catalog",
      "id": "block-no-verify",
      "version": "0.5.4",
      "sha256": "45055c8896e8401c430fbf27f60a83194fd8a6aad93e75442b3aae3b0146c330"
    },
    {
      "from": "catalog",
      "id": "limit-diff-size",
      "version": "0.0.4",
      "sha256": "d8d7f3db55af998760999b9dad86d936ddc205d2315404aaa590b7ae7ea8c176"
    },
    {
      "from": "catalog",
      "id": "protect-commit-privacy",
      "version": "0.2.6",
      "sha256": "a45e03826170f98796f98cbd48462c3a16f28d3f4b49acb6446468d234a58508"
    },
    {
      "from": "catalog",
      "id": "protect-main-branch",
      "version": "0.0.4",
      "sha256": "b469c3dbab9a12a009e3ef995fcab99d468e1363da4892af9f1b3bbdcf24a173"
    },
    {
      "from": "catalog",
      "id": "refname-filename-metachar",
      "version": "0.1.5",
      "sha256": "dbab33cf859b0457faff6f0ba2f5212fa83274a55233c119810a3ad6daae9ee8"
    }
  ]
}
# Share code
eyJzY2hlbWEiOjIsImNsaWVudCI6ImNsYXVkZS1jb2RlIiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiIxZTYwZDIxMWMxYmI3NjcxNTJjNmFiMDE2NzkzMmRhMDZhYjNhMTBmIn0sInByZXNldCI6ImdpdC1oeWdpZW5lIiwicG9saWNpZXMiOlt7ImZyb20iOiJjYXRhbG9nIiwiaWQiOiJibG9jay1ob29rLWJ5cGFzcy1pbi1maWxlcyIsInZlcnNpb24iOiIwLjEuMiIsInNoYTI1NiI6IjZhNjQ4MjliY2U1Y2Q5MjZjZjY2Mjg4NjlmNjRiYzBiNjYzZWNhNGI4NDliYjY4ZmQ1YWRhMDc5ZjVhMjA4OTYifSx7ImZyb20iOiJjYXRhbG9nIiwiaWQiOiJibG9jay1uby12ZXJpZnkiLCJ2ZXJzaW9uIjoiMC41LjQiLCJzaGEyNTYiOiI0NTA1NWM4ODk2ZTg0MDFjNDMwZmJmMjdmNjBhODMxOTRmZDhhNmFhZDkzZTc1NDQyYjNhYWUzYjAxNDZjMzMwIn0seyJmcm9tIjoiY2F0YWxvZyIsImlkIjoibGltaXQtZGlmZi1zaXplIiwidmVyc2lvbiI6IjAuMC40Iiwic2hhMjU2IjoiZDhkN2YzZGI1NWFmOTk4NzYwOTk5YjlkYWQ4NmQ5MzZkZGMyMDVkMjMxNTQwNGFhYTU5MGI3YWU3ZWE4YzE3NiJ9LHsiZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtY29tbWl0LXByaXZhY3kiLCJ2ZXJzaW9uIjoiMC4yLjYiLCJzaGEyNTYiOiJhNDVlMDM4MjYxNzBmOTg3OTZmOThjYmQ0ODQ2MmMzYTE2ZjI4ZDNmNGI0OWFjYjY0NDY0NjhkMjM0YTU4NTA4In0seyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC1tYWluLWJyYW5jaCIsInZlcnNpb24iOiIwLjAuNCIsInNoYTI1NiI6ImI0NjljM2RiYWI5YTEyYTAwOWUzZWY5OTVmY2FiOTlkNDY4ZTEzNjNkYTQ4OTJhZjlmMWIzYmJkY2YyNGExNzMifSx7ImZyb20iOiJjYXRhbG9nIiwiaWQiOiJyZWZuYW1lLWZpbGVuYW1lLW1ldGFjaGFyIiwidmVyc2lvbiI6IjAuMS41Iiwic2hhMjU2IjoiZGJhYjMzY2Y4NTliMDQ1N2ZhZmY2ZjBiYTJmNTIxMmZhODMyNzRhNTUyMzNjMTE5ODEwYTNhZDZkYWFlOWVlOCJ9XX0

# Ask the user first: it installs hooks
chock install --selection eyJzY2hlbWEiOjIsImNsaWVudCI6ImNsYXVkZS1jb2RlIiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiIxZTYwZDIxMWMxYmI3NjcxNTJjNmFiMDE2NzkzMmRhMDZhYjNhMTBmIn0sInByZXNldCI6ImdpdC1oeWdpZW5lIiwicG9saWNpZXMiOlt7ImZyb20iOiJjYXRhbG9nIiwiaWQiOiJibG9jay1ob29rLWJ5cGFzcy1pbi1maWxlcyIsInZlcnNpb24iOiIwLjEuMiIsInNoYTI1NiI6IjZhNjQ4MjliY2U1Y2Q5MjZjZjY2Mjg4NjlmNjRiYzBiNjYzZWNhNGI4NDliYjY4ZmQ1YWRhMDc5ZjVhMjA4OTYifSx7ImZyb20iOiJjYXRhbG9nIiwiaWQiOiJibG9jay1uby12ZXJpZnkiLCJ2ZXJzaW9uIjoiMC41LjQiLCJzaGEyNTYiOiI0NTA1NWM4ODk2ZTg0MDFjNDMwZmJmMjdmNjBhODMxOTRmZDhhNmFhZDkzZTc1NDQyYjNhYWUzYjAxNDZjMzMwIn0seyJmcm9tIjoiY2F0YWxvZyIsImlkIjoibGltaXQtZGlmZi1zaXplIiwidmVyc2lvbiI6IjAuMC40Iiwic2hhMjU2IjoiZDhkN2YzZGI1NWFmOTk4NzYwOTk5YjlkYWQ4NmQ5MzZkZGMyMDVkMjMxNTQwNGFhYTU5MGI3YWU3ZWE4YzE3NiJ9LHsiZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtY29tbWl0LXByaXZhY3kiLCJ2ZXJzaW9uIjoiMC4yLjYiLCJzaGEyNTYiOiJhNDVlMDM4MjYxNzBmOTg3OTZmOThjYmQ0ODQ2MmMzYTE2ZjI4ZDNmNGI0OWFjYjY0NDY0NjhkMjM0YTU4NTA4In0seyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC1tYWluLWJyYW5jaCIsInZlcnNpb24iOiIwLjAuNCIsInNoYTI1NiI6ImI0NjljM2RiYWI5YTEyYTAwOWUzZWY5OTVmY2FiOTlkNDY4ZTEzNjNkYTQ4OTJhZjlmMWIzYmJkY2YyNGExNzMifSx7ImZyb20iOiJjYXRhbG9nIiwiaWQiOiJyZWZuYW1lLWZpbGVuYW1lLW1ldGFjaGFyIiwidmVyc2lvbiI6IjAuMS41Iiwic2hhMjU2IjoiZGJhYjMzY2Y4NTliMDQ1N2ZhZmY2ZjBiYTJmNTIxMmZhODMyNzRhNTUyMzNjMTE5ODEwYTNhZDZkYWFlOWVlOCJ9XX0 --client claude-code --apply

The install command

For an agent marked tested (claude-code, cursor, codex, copilot, devin, grok, goose, antigravity), ask the user before running chock install --selection <code> --client <agent> --apply: it also runs that agent's own install steps. For the others, ask the user before running chock install --selection <code> --client <agent>: it only builds the plugin and prints the steps for the user to apply. Both build hooks that change how the user's agent behaves. Show the user the chosen policies, with their labels on their agent, before asking. /coding/install/ lists every agent's steps.

What chock is not

Chock adds friction. It is not a security boundary. An agent can ignore advisory text, and a determined agent can get around a block on the shell. Tell the user exactly that. Do not call it protection.