[External Plugin]: block-destructive-commands

[open-coder-ai]

Plugin name

block-destructive-commands

Short description

A Copilot pre-tool-use hook that denies destructive shell commands before they run — rm -rf targeting root, home, or absolute paths, git push --force, git reset --hard, git clean -f, kubectl delete, terraform destroy, and PowerShell/cmd recursive-force removals. It is enforcement, not advice: the hook exits non-zero and the client refuses the call.

GitHub repository

open-coder-ai/chock-copilot-plugins

Plugin path inside the repository

copilot/block-destructive-commands

Ref to review

v0.2.0

Commit SHA to review

3dcdac1af1c1c7bc15e9bcb18891788e56e55c49

Version

0.0.6

License identifier

Apache-2.0

Author name

open-coder-ai

Author URL

https://github.com/open-coder-ai

Homepage URL

https://github.com/open-coder-ai/chock

Keywords

chock
policy-as-code
security
guardrail
pre-tool-use
destructive-commands

Additional notes for reviewers

What it is. This plugin comes from Chock, open-source policy-as-code for AI coding agents. The package ships a PreToolUse hook plus a stdlib-only Python adapter and the guard script, so it is session-enforced in Copilot CLI and VS Code agent mode rather than advisory.

Honest fail posture (stated verbatim in the plugin's own description, not just here): the hook needs python3 and a usable shell on PATH. Without them, fail-open clients allow silently and fail-closed clients refuse matched commands; on Windows, the Microsoft Store python3 alias must be disabled or Python installed. The guard is a best-effort pattern filter — aliases, quoting, and unusual paths can evade it — so it is friction, not a security boundary. We state this rather than overclaim enforcement.

Provenance. The source repository is generated: every file is compiled from policy sources in chock-catalog by the framework, and CI regenerates from the catalog and fails on any difference, so a package cannot be hand-edited into something the catalog never published. Every package also passes claude plugin validate in CI. The guard script and hook adapter are byte-identical copies of their framework sources.

Update after first intake run. All three quality-gate failures are fixed at the source: the plugin now ships in the Agent Plugins 1.0 layout (plugin.json at the package root under copilot/), and the SKILL.md frontmatter metadata is a flat string-to-string map per the Agent Skills spec (the nested object vally rejected). The enforcing hook lives at com.github.copilot/hooks/hooks.json, the location VS Code documents for Agent Plugins hook bundles. The generator changes shipped in the open-source framework (open-coder-ai/chock#59) with tests pinning the spec constraints, so every future package stays conformant.

Scope of this submission. Chock publishes four enforcing guard plugins (block-destructive-commands, block-no-verify, protect-agent-config, protect-commit-privacy) in the same repository. This issue submits the first one; we are happy to submit the remaining three once this listing is reviewed, so you can assess the pattern on a single entry first. The plugins are also submitted to the Copilot plugins marketplace in github/copilot-plugins#77.

Submission checklist

• The plugin lives in a public GitHub repository.
• The ref and/or sha I provided is immutable (release tag and/or full 40-character commit SHA), not a branch.
• This submission follows this repository's contribution, security, and responsible AI policies.
• This plugin is not already listed in the Awesome Copilot marketplace.

[github-actions]

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[open-coder-ai]

C:/Program Files/Git/rerun-intake

[github-actions]

✅ External plugin intake passed

This submission passed automated intake validation and quality checks and is ready for maintainer review.

• Plugin: block-destructive-commands
• Repository: https://github.com/open-coder-ai/chock-copilot-plugins
• Ref: v0.2.0
• SHA: 3dcdac1af1c1c7bc15e9bcb18891788e56e55c49

Reviewer signals

These are non-blocking heuristics for maintainer review; they are not evidence of misconduct or low quality.

Signal	Result
Repository age	0 day(s)
Repository activity	repository is 0 day(s) old; 0 stars; 0 watchers; 0 forks
Repository counts	0 stars · 0 watchers · 0 forks · 0 open issues/PRs
Homepage heuristics	⚠️ pricing, checkout

Quality gate summary

Legend: ✅ pass · ⚠️ warning · 🛑 fail

Gate	Status
spec compliance (non-blocking)	✅ pass
vally lint	✅ pass
install smoke test	✅ pass
version match	✅ pass
ref/sha consistency	✅ pass
canvas structure	⚪ not_run

• spec compliance: pass
• vally lint: pass
• install smoke test: pass
• version match: pass
• ref/sha consistency: pass
• canvas structure: not_run
• overall: pass

spec compliance output (✅ pass)

Agent Plugins v1.0.0 manifest checks passed for plugin.json.

vally lint output (✅ pass)

✅ block-destructive-commands (2/2 checks passed)
    ✓ [spec-compliance] All 1 skill(s) are spec-compliant.
        ✓ spec-compliance: All spec checks passed.
    ✓ [valid-refs] All file references across 1 skill(s) are valid.
        ✓ valid-refs: All file references resolve to existing files within the skill directory.

1 skill(s) linted, 1 passed

install smoke test output (✅ pass)

Install smoke test succeeded. Verified /tmp/external-plugin-quality-U7jj3P/copilot-home/.copilot/installed-plugins/external-plugin-intake/block-destructive-commands/plugin.json.

Version match output

- v0.2.0: matched version "0.0.6" at "copilot/block-destructive-commands/plugin.json".
- 3dcdac1af1c1c7bc15e9bcb18891788e56e55c49: matched version "0.0.6" at "copilot/block-destructive-commands/plugin.json".

Ref/SHA consistency output

source.ref "v0.2.0" resolves to the same commit as source.sha "3dcdac1af1c1c7bc15e9bcb18891788e56e55c49".

Canvas structure output

Canvas structure gate skipped because plugin is not tagged with "canvas".

Canonical external.json payload

{
  "name": "block-destructive-commands",
  "description": "A Copilot pre-tool-use hook that denies destructive shell commands before they run — `rm -rf` targeting root, home, or absolute paths, `git push --force`, `git reset --hard`, `git clean -f`, `kubectl delete`, `terraform destroy`, and PowerShell/cmd recursive-force removals. It is enforcement, not advice: the hook exits non-zero and the client refuses the call.",
  "version": "0.0.6",
  "author": {
    "name": "open-coder-ai",
    "url": "https://github.com/open-coder-ai"
  },
  "repository": "https://github.com/open-coder-ai/chock-copilot-plugins",
  "homepage": "https://github.com/open-coder-ai/chock",
  "license": "Apache-2.0",
  "keywords": [
    "chock",
    "policy-as-code",
    "security",
    "guardrail",
    "pre-tool-use",
    "destructive-commands"
  ],
  "source": {
    "source": "github",
    "repo": "open-coder-ai/chock-copilot-plugins",
    "path": "copilot/block-destructive-commands",
    "ref": "v0.2.0",
    "sha": "3dcdac1af1c1c7bc15e9bcb18891788e56e55c49"
  }
}

View workflow run