From 31ab2ce1432947f9878ee03dc4934cc0684091d7 Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Wed, 21 Oct 2026 01:14:39 +0000 Subject: [PATCH 1/3] docs: point the README at the chock.sh builder (RP-1) Replace the Install and "What you get" sections with a pointer to the chock.sh builder, the Codex migration steps, the archive date line and a per-policy builder link table. PLUGINS.md, plugin folders, workflows and the lockfile are unchanged. Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 79 +++++++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 59 insertions(+), 20 deletions(-) diff --git a/README.md b/README.md index 86c0180..72dd8fc 100644 --- a/README.md +++ b/README.md @@ -41,26 +41,65 @@ answers on stdout with a JSON decision, not an exit code: with exit status 0. Gate plugins wire the same `PreToolUse` hook plus a `Stop` hook. The one exit-code answer is exit 2, used only when no working Python 3.11+ is found. -## Install - -Codex reads this repository as a git marketplace, the same mechanism as its Plugins UI: - -```toml -# ~/.codex/config.toml -[marketplaces.chock-codex] -source_type = "git" -source = "https://github.com/open-coder-ai/chock-codex-plugins.git" -``` - -Then install plugins from the `chock-codex` marketplace in the Plugins UI, and approve each -guard's hook trust review. - -## What you get - -See **[PLUGINS.md](PLUGINS.md)** for the full list: each policy, its version, and whether it -enforces or advises in this client. A plugin governs one session; it doesn't run in CI or -travel with a clone. For enforcement that follows the repository, with no trust toggle to -forget, install Chock directly: `pip install chock && chock init && chock sync --ci`. +## Moved to the chock.sh builder + +These plugins now come from the **[chock.sh builder](https://chock.sh/coding/builder/)**: pick +policies there and it writes one `chock install` command that builds a single plugin on your machine +from [chock-catalog](https://github.com/open-coder-ai/chock-catalog). Nothing is downloaded from this +repository any more. + +**Migrate from this marketplace.** + +1. Remove each plugin you installed from the `chock-codex` marketplace in the Codex Plugins UI. +2. Remove the marketplace: delete the `[marketplaces.chock-codex]` table from `~/.codex/config.toml`. +3. `pip install chock`, then run the command the builder gives you: + `chock install --selection '' --client codex --apply` + +Codex runs a plugin's hooks only after you trust them in `/hooks`; approve the new plugin's hooks +there, or it stays advisory text. + +**This repository stops publishing on the chock.sh launch day and is archived 30 days later.** + +### One policy at a time + +Each link opens the builder with that one policy preselected for Codex, pinned to chock-catalog +commit `e885f918a335e20dfddb4fad0331d4d5b4c5eb43` (the catalog's `main` on 2026-10-21). The pin is +the catalog's current version of each policy, which can be newer than the version listed in +[PLUGINS.md](PLUGINS.md). + +| policy | in Codex | builder | +| :--- | :--- | :--- | +| `agent-discipline` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYWdlbnQtZGlzY2lwbGluZSIsInZlcnNpb24iOiIwLjAuMyIsInNoYTI1NiI6IjAzOGIxOWQ3MjZlZmMxMjVlZWFmMTMyMWFjNGZlYjcwYzdmZDFhMjA3ZGE4ZTg5NTNiZWQ2NWQ0YWNkZDg0NzIifV19) | +| `block-curl-pipe-sh` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2stY3VybC1waXBlLXNoIiwidmVyc2lvbiI6IjAuMS40Iiwic2hhMjU2IjoiMzRiOTYxYzQ4MjU4OGQwYjUxYzhkYzc2NTVlOTE1ZWE5OGM1YzQ3MDI3ZGNhMTE0ZjhhN2QxMjdmMzc2NjJmMiJ9XX0) | +| `block-destructive-commands` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2stZGVzdHJ1Y3RpdmUtY29tbWFuZHMiLCJ2ZXJzaW9uIjoiMC4zLjAiLCJzaGEyNTYiOiI1NDFiNGQzMjc3ODg0MjQ4ZDMyMTYwMWQwNGNlMDE4MjUzN2MzMGUyNTk2ZGM3ODBjMDAxYWU1MzJiMWI5ZDUwIn1dfQ) | +| `block-invisible-unicode` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2staW52aXNpYmxlLXVuaWNvZGUiLCJ2ZXJzaW9uIjoiMC4xLjEiLCJzaGEyNTYiOiJiMTA4NDMxNTcwNmRjMjZlMzA5N2RkMWMxYTg5M2M3ODA0MTVmMTE2OGFiNWE5OTVjMTlhODk1ZjkzNjg4YzVhIn1dfQ) | +| `block-no-verify` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2stbm8tdmVyaWZ5IiwidmVyc2lvbiI6IjAuNS4wIiwic2hhMjU2IjoiYTQwNmQ1MGU0Y2YzMGQ1NjQzMDg0MDgwYWQ0MjU5ZDM0MmYzZWRkMDcwMzY4ODhjNDdhODIxNGY2NjA5OTRjYyJ9XX0) | +| `block-test-skips` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2stdGVzdC1za2lwcyIsInZlcnNpb24iOiIwLjEuMCIsInNoYTI1NiI6Ijg1MzVjNTJlZDA1NWIwODRiM2Q4NzBiMzM5NDQ4NzQxZTE4MzRmNmZkOTFhYjJkMzJlYWQxZDI2M2Y0NzU1NzQifV19) | +| `block-unapproved-egress` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2stdW5hcHByb3ZlZC1lZ3Jlc3MiLCJ2ZXJzaW9uIjoiMC4yLjQiLCJzaGEyNTYiOiJlNDg2ZmUzN2IxMjFjMjA1NDFmNzFjZWY2Y2I4NTYwNWZlMGEwNmVlZWI2ZTU2MzgzYzk4ZmZiMDBjMDA3ZTEwIn1dfQ) | +| `block-unguarded-agent-spawn` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2stdW5ndWFyZGVkLWFnZW50LXNwYXduIiwidmVyc2lvbiI6IjAuMi4wIiwic2hhMjU2IjoiZTQ1YzIxNTUxZjFmMWEyNDIyNzU2ODNhZmU5YWUwMDQ2Mjc3ZDhkNTdmNTM3MzQ0YWM3MTNmZmJmYmE0NjEzNyJ9XX0) | +| `block-wildcard-agent-permissions` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiYmxvY2std2lsZGNhcmQtYWdlbnQtcGVybWlzc2lvbnMiLCJ2ZXJzaW9uIjoiMC4wLjEwIiwic2hhMjU2IjoiNmIzMTlkZjY4ZjAzYzkzNjI2YzY5NWQyOTg3MGMxNzk0NTZlZmJkZjRlZmIzMzAxMmJlOWZkMGVkOGEzOGVlZCJ9XX0) | +| `chock-mise` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiY2hvY2stbWlzZSIsInZlcnNpb24iOiIwLjAuMyIsInNoYTI1NiI6IjFiMDcyYmQ1MTc0YWM4YTc1YmQ0NDRlZDEwMGQ0MWNkYjc2Y2MzOWYxZDY2Yzg2NmE3YzJkOWE3M2VlY2Y1MWYifV19) | +| `code-safety` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiY29kZS1zYWZldHkiLCJ2ZXJzaW9uIjoiMC4wLjQiLCJzaGEyNTYiOiI1MTA2Nzk1MTIzNWE5YWRkMzBmMmFmYTIwNzYyYzUzZmQzOTJiYTJkNTczODQ1OTcwYzI5YmQzMDI5NTFlYWUyIn1dfQ) | +| `context-hygiene` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiY29udGV4dC1oeWdpZW5lIiwidmVyc2lvbiI6IjAuMC4yIiwic2hhMjU2IjoiNDg5MmQyMTRjNjI4OTdiYjI4M2VmNTJmZjZlY2M4MDU2ZDY3MjEzNjMwZjYxN2MyMTIwNmRmNWQ1YjVlN2Q3NCJ9XX0) | +| `firecrawl-fallback-only` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiZmlyZWNyYXdsLWZhbGxiYWNrLW9ubHkiLCJ2ZXJzaW9uIjoiMC4xLjEiLCJzaGEyNTYiOiJjMWZiM2Y0Y2QyNGRmYjA3MGJjMWRjZmEwZDU3ZDdlOTAxNzQ4MTkwOGJiNTQ4NTBjNTZkNTZkZmNjMDc5MDY0In1dfQ) | +| `git-safety` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiZ2l0LXNhZmV0eSIsInZlcnNpb24iOiIwLjAuNCIsInNoYTI1NiI6Ijc4NGMzYTE4OGM1YzQyYTg4NjA3MDMwMTk5ZGU0YjVhY2E5ZjNjMmY0NjI3OThlYjk2NjkxYzcxMzA3Y2E4NTgifV19) | +| `guard-memory-writes` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiZ3VhcmQtbWVtb3J5LXdyaXRlcyIsInZlcnNpb24iOiIwLjAuOSIsInNoYTI1NiI6ImU4OGZkNDZlYmJiN2E1YTY2Zjc3ZTY0YjdhZTY1ZTQwOTQ1YTRkMmE1N2RjMjVkNTNjMzFmNzNlNTc4MGNkN2IifV19) | +| `injection-defense` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiaW5qZWN0aW9uLWRlZmVuc2UiLCJ2ZXJzaW9uIjoiMC4wLjQiLCJzaGEyNTYiOiI2NDM3Y2UyYTM2YTdjYjRhNjBmYjc4YzM5NzhhMzM2MmFhMzVjYzljZGZiOTNmODY3ZTU4NTg1MjdlNzYwOWMwIn1dfQ) | +| `java-security` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoiamF2YS1zZWN1cml0eSIsInZlcnNpb24iOiIwLjcuMCIsInNoYTI1NiI6IjJiMWE4NTg4MTk0NmUxYmI2NTE1NzE4MzJjNGJlZDQ3ZjNmMjJlNjI1NTc1OWVkMjFkM2ExNzBkZWM5NzAwNTgifV19) | +| `limit-diff-size` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoibGltaXQtZGlmZi1zaXplIiwidmVyc2lvbiI6IjAuMC4zIiwic2hhMjU2IjoiYTdlNWFkZDY2YTU3MDZhMDg4OTg0NzY2OTVmZTJjMzBjMDVlMDZlNGJmODBjMGI0YzY3MjJjZDI4OWU1OGFmNCJ9XX0) | +| `memory-discipline` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoibWVtb3J5LWRpc2NpcGxpbmUiLCJ2ZXJzaW9uIjoiMC4wLjUiLCJzaGEyNTYiOiIwZjdhNjY3YTA3ZThmNWI5Yzk2ZWFkNmY5NmRmN2EyZTllOTg5YzNjMGVjNzc2YWJmODNhMDdmZGRjNjk1NWY4In1dfQ) | +| `no-a11y-regression` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoibm8tYTExeS1yZWdyZXNzaW9uIiwidmVyc2lvbiI6IjEuMS4yIiwic2hhMjU2IjoiMjFjNDdjZmFlYThkOWY3ZDYxZTlmNGQ5ZDliMTI3YjczNzE1MzU2MTNhNTg4ZTFjNWU3NDQzNjAxM2QwYjFkYiJ9XX0) | +| `pin-github-actions` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicGluLWdpdGh1Yi1hY3Rpb25zIiwidmVyc2lvbiI6IjAuMC43Iiwic2hhMjU2IjoiMTY4ZDZlOTQ2MzI0OTMwOWFiZDQwMjJhZGMxNzZiOGQ5N2FiMWZkYjE2ZjRjYTU5NjdmNWM0Y2E4NTg1NjllYyJ9XX0) | +| `protect-agent-config` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC1hZ2VudC1jb25maWciLCJ2ZXJzaW9uIjoiMC43LjEiLCJzaGEyNTYiOiIxOTY0NDU3NTM2NWYyNTVhNjEyMzQ1NDJjNjc2YjNiZGYwMjhiZmQyMGE3YzIwNTczYWMyM2QzMGI1OTA4N2ExIn1dfQ) | +| `protect-ci-workflows` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC1jaS13b3JrZmxvd3MiLCJ2ZXJzaW9uIjoiMC4yLjYiLCJzaGEyNTYiOiIwZTUwY2U5NzhmYmE3OTlmM2RlNmViYTUyNGZkMjBiMWNlODZhZGQ5YzljMWY0YmQ2MTljYzk0ZmQ4YjNmMDM3In1dfQ) | +| `protect-commit-privacy` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC1jb21taXQtcHJpdmFjeSIsInZlcnNpb24iOiIwLjIuNSIsInNoYTI1NiI6IjMzMTQyOTViYWUxYTRiNzVkNTAzZDk3N2M4NDQ5ZTg5OGE4MTU5MWM1Y2ExZTk4OTY4YzlmNzg5OTAyZmM3MDEifV19) | +| `protect-main-branch` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC1tYWluLWJyYW5jaCIsInZlcnNpb24iOiIwLjAuMyIsInNoYTI1NiI6ImViYTE2NGQwOWMyMmI0NmY1YzJkMjY1NjYwN2Q3MzU5NmQzYjBjZTRjNzc4MTg3MzdlZmM1MjcyZDc4NzE5ZWUifV19) | +| `protect-test-integrity` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicHJvdGVjdC10ZXN0LWludGVncml0eSIsInZlcnNpb24iOiIwLjAuMyIsInNoYTI1NiI6ImU1MzYwZDZlOTMyMDU0Y2I2ZTM3ZTc3ZWRhM2JlNmU4MWVkOTAwMGZmNTQxYjBiZGQzZjJlZTkyNTVkMmU5MmYifV19) | +| `rtk-dangerous-actions-blocker` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoicnRrLWRhbmdlcm91cy1hY3Rpb25zLWJsb2NrZXIiLCJ2ZXJzaW9uIjoiMC4zLjAiLCJzaGEyNTYiOiIxNDkwOTc5NjZkMmM4YmRiMmUxNTdhNDRiM2Y4N2JhOTRlYjk1YjRhYzdmNzI0MjQwZTUyNTJkZDU2ZjQ4ZWIxIn1dfQ) | +| `scan-secrets` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoic2Nhbi1zZWNyZXRzIiwidmVyc2lvbiI6IjAuMS4yIiwic2hhMjU2IjoiODBjMjdiNmNlMmYxNDU3MWIxYzJhMWZhMjNlN2Y3MWUzMDVjYTNlMjFmNzYwYjM1NTc1MDlkZmQ0MzA1NjBkMCJ9XX0) | +| `token-efficiency` | advisory | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoidG9rZW4tZWZmaWNpZW5jeSIsInZlcnNpb24iOiIwLjEuMSIsInNoYTI1NiI6IjE5MDAzZmFmYWEyYTQ0ODM2ZGE1NDg2ZjlmNTI4YTY3YTc1YzQ0YjJiNDkyMmUyNjQ0NTJlNTkyOWI1YTFjNzYifV19) | +| `verify-dependency-exists` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoidmVyaWZ5LWRlcGVuZGVuY3ktZXhpc3RzIiwidmVyc2lvbiI6IjAuMi4wIiwic2hhMjU2IjoiYTk4NjNmZjQ4ZTI0OWYwN2E2MGE1NmYyYjRjZWJhY2YyNGI3YzU0MTE3M2M5MDliZTg0ZjZmNjk5MTc4ODk1NSJ9XX0) | +| `verify-mcp-allowlist` | enforces | [open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImNvZGV4IiwiYnVuZGxlIjp7InZlcnNpb24iOiIxLjAuMCJ9LCJjYXRhbG9nIjp7InNvdXJjZSI6Imh0dHBzOi8vZ2l0aHViLmNvbS9vcGVuLWNvZGVyLWFpL2Nob2NrLWNhdGFsb2ciLCJyZWYiOiJlODg1ZjkxOGEzMzVlMjBkZmRkYjRmYWQwMzMxZDRkNWI0YzVlYjQzIn0sInBvbGljaWVzIjpbeyJmcm9tIjoiY2F0YWxvZyIsImlkIjoidmVyaWZ5LW1jcC1hbGxvd2xpc3QiLCJ2ZXJzaW9uIjoiMC41LjMiLCJzaGEyNTYiOiIwNDIxNjg4OWE2MDEyYjJlNTgyMmRhYjgxZGY1ODYzNmEwN2I0ODdjMjBkMWZmYjgwMjNiNzBlMThiNGNlMWE0In1dfQ) | ## Generated from chock-catalog From 3322bddf8f89339476c3b268819d038014d8b254 Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:22:22 +0000 Subject: [PATCH 2/3] docs: README offers two routes, this marketplace and the builder (IR-16) Replace "moved, stops publishing, archived" with the two routes: this marketplace (no chock on the machine, republished with every chock release) and the chock.sh builder (one plugin, needs pip install chock). Never install the same policy by both, since each copy runs its hook. README.md is hand-written, so no generator change is needed. Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 45 +++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 72dd8fc..1262849 100644 --- a/README.md +++ b/README.md @@ -41,26 +41,43 @@ answers on stdout with a JSON decision, not an exit code: with exit status 0. Gate plugins wire the same `PreToolUse` hook plus a `Stop` hook. The one exit-code answer is exit 2, used only when no working Python 3.11+ is found. -## Moved to the chock.sh builder +## Two ways to get these plugins -These plugins now come from the **[chock.sh builder](https://chock.sh/coding/builder/)**: pick -policies there and it writes one `chock install` command that builds a single plugin on your machine -from [chock-catalog](https://github.com/open-coder-ai/chock-catalog). Nothing is downloaded from this -repository any more. +**This marketplace: no chock on the machine.** Each policy is its own plugin, republished with +every chock release. You need Python 3.11+ and git, and nothing else. Codex reads this +repository as a git marketplace, the same mechanism as its Plugins UI: -**Migrate from this marketplace.** +```toml +# ~/.codex/config.toml +[marketplaces.chock-codex] +source_type = "git" +source = "https://github.com/open-coder-ai/chock-codex-plugins.git" +``` + +Then install plugins from the `chock-codex` marketplace in the Plugins UI, and approve each +guard's hook trust review. + +**The builder: one plugin, needs chock.** Pick the policies you want at +**[chock.sh](https://chock.sh/coding/builder/)**; it writes one `chock install` command that +builds a single plugin on your machine from +[chock-catalog](https://github.com/open-coder-ai/chock-catalog). That command needs +`pip install chock`: -1. Remove each plugin you installed from the `chock-codex` marketplace in the Codex Plugins UI. -2. Remove the marketplace: delete the `[marketplaces.chock-codex]` table from `~/.codex/config.toml`. -3. `pip install chock`, then run the command the builder gives you: - `chock install --selection '' --client codex --apply` +```bash +pip install chock +chock install --selection '' --client codex --apply +``` -Codex runs a plugin's hooks only after you trust them in `/hooks`; approve the new plugin's hooks -there, or it stays advisory text. +Codex runs a plugin's hooks only after you trust them in `/hooks`; approve the new plugin's +hooks there, or it stays advisory text. -**This repository stops publishing on the chock.sh launch day and is archived 30 days later.** +**Use one route for a given policy, never both.** Every copy of a plugin runs its own hook, so +a policy installed from both places runs twice. To switch a policy from one route to the other, +remove it from the first route before installing it from the second: remove each plugin you +installed from the `chock-codex` marketplace in the Codex Plugins UI, and to drop the +marketplace too, delete the `[marketplaces.chock-codex]` table from `~/.codex/config.toml`. -### One policy at a time +### Builder links, one policy at a time Each link opens the builder with that one policy preselected for Codex, pinned to chock-catalog commit `e885f918a335e20dfddb4fad0331d4d5b4c5eb43` (the catalog's `main` on 2026-10-21). The pin is From 20dd5516bf571fa373a1d1fdd8129144e0f7e318 Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:23:50 +0000 Subject: [PATCH 3/3] docs: README builder command unquoted, requirements name bash (IR-16) cmd.exe passes single quotes literally, so print the selection command unquoted. The plugins' hooks need git, a usable bash and Python 3.11+, so say so instead of "nothing else". Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1262849..a9b7ca9 100644 --- a/README.md +++ b/README.md @@ -44,7 +44,7 @@ exit-code answer is exit 2, used only when no working Python 3.11+ is found. ## Two ways to get these plugins **This marketplace: no chock on the machine.** Each policy is its own plugin, republished with -every chock release. You need Python 3.11+ and git, and nothing else. Codex reads this +every chock release. You need Python 3.11+, git and a bash (Git for Windows includes one). Codex reads this repository as a git marketplace, the same mechanism as its Plugins UI: ```toml @@ -65,7 +65,7 @@ builds a single plugin on your machine from ```bash pip install chock -chock install --selection '' --client codex --apply +chock install --selection --client codex --apply ``` Codex runs a plugin's hooks only after you trust them in `/hooks`; approve the new plugin's