From 8b20a36e62f33365c10bec106e31a2e7658e25bf Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Wed, 21 Oct 2026 01:15:04 +0000 Subject: [PATCH 1/3] README: point to the chock.sh builder (RP-1) Replace the Install and "What you get" sections with a pointer to https://chock.sh/coding/builder/, the Cursor migration (remove the team marketplace import and the ~/.cursor/plugins/local copy, then pip install chock and chock install), the dated retirement notice, and a per-policy table of builder links with each policy preselected for Cursor. Only README.md changes. Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 101 ++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 72 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 563f0ae..41c9229 100644 --- a/README.md +++ b/README.md @@ -26,35 +26,78 @@ refuse the command is closer to one — a matched destructive command is denied before it runs, witnessed on a real Cursor install (2026-08-24), with benign commands in the same session still allowed. -## Install - -Cursor reads this repository as a plugin marketplace via `.cursor-plugin/marketplace.json`: - -``` -# Team marketplace: Dashboard -> Plugins -> Add Marketplace -> Import from Repo -# https://github.com/open-coder-ai/chock-cursor-plugins -# Local install of one plugin (developer flow): -# copy cursor// to ~/.cursor/plugins/local// and reload Cursor -``` - -## What you get - -Two kinds of package enforce here, at different events. - -**Guard policies** ship a `beforeShellExecution` hook, a guard script and a stdlib-only -adapter. The hook returns Cursor's `permission: "deny"` response and the command is refused. -This needs `python3` and a usable `bash` on PATH — without them the hook fails **open**, and -every guard's description says so verbatim. - -**Gate policies** judge what a turn writes, not what it runs. They ship the policy's gate and -its runner instead of a shell guard, wired at `preToolUse` — judging the file a write would -create, before it lands — and again at `stop`, re-reading what the turn actually left on disk. -They need `python3`; without it a fail-open client allows silently, but a gate that cannot -reach a decision refuses rather than allowing something it never judged. Cursor does not hold -the turn's end, so a refusal at `stop` is handed back to the agent as a follow-up message once. - -Advisory policies are a skill the client reads; nothing stops a violation. See **[PLUGINS.md](PLUGINS.md)** for the full list: -each policy, its version, and whether it enforces or advises in this client. +## Moved to the chock.sh builder + +> **This repository stops publishing on the chock.sh launch day and is archived 30 days later** (notice dated 2026-10-21). + +The plugins now come from the chock.sh builder at ****: pick the +policies, and it gives you one command that builds a single `chock-guardrails` plugin on your +machine from [chock-catalog](https://github.com/open-coder-ai/chock-catalog). Nothing is +downloaded from this repository any more. The plugins already need Python 3.11+ to run their hooks, +so `pip install chock` adds a package, not a runtime. + +### Migrating from this marketplace + +Remove what you installed from here first, so the same policy does not run twice (once from the old +plugin, once from the new one): + +1. **Team marketplace import:** in Cursor, open **Dashboard -> Plugins & MCPs**, find this repository + under **Team Marketplaces** and remove it (an admin action on Enterprise). Then open **Customize** + and remove each plugin you installed from it; a plugin set to **Required** cannot be uninstalled + until it is changed in the marketplace's settings. See [Cursor's plugin docs](https://cursor.com/docs/plugins). +2. **Local copy:** delete each `~/.cursor/plugins/local//` folder you copied from `cursor//`, + then run **Developer: Reload Window** (or restart Cursor). +3. **Install from the builder:** + + ```bash + pip install chock + chock install --selection '' --client cursor --apply + ``` + + `` is the selection code the [builder](https://chock.sh/coding/builder/) shows for your + choice. Cursor has no command to run for a local plugin, so the output tells you to run + **Developer: Reload Window**; then check the plugin under **Customize**. + +### One policy, preselected + +Each link opens the builder with that one policy chosen for Cursor. The selections pin +`catalog.ref` to chock-catalog commit `e885f918a335e20dfddb4fad0331d4d5b4c5eb43`, so a link builds the +policy version at that commit, which can be newer than the one listed in [PLUGINS.md](PLUGINS.md). +"Published here as" is what [PLUGINS.md](PLUGINS.md) says for this client. + +| Policy | Published here as | Builder | +| :--- | :--- | :--- | +| `agent-discipline` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImFnZW50LWRpc2NpcGxpbmUiLCJ2ZXJzaW9uIjoiMC4wLjMiLCJzaGEyNTYiOiIwMzhiMTlkNzI2ZWZjMTI1ZWVhZjEzMjFhYzRmZWI3MGM3ZmQxYTIwN2RhOGU4OTUzYmVkNjVkNGFjZGQ4NDcyIn1dfQ) | +| `block-curl-pipe-sh` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLWN1cmwtcGlwZS1zaCIsInZlcnNpb24iOiIwLjEuNCIsInNoYTI1NiI6IjM0Yjk2MWM0ODI1ODhkMGI1MWM4ZGM3NjU1ZTkxNWVhOThjNWM0NzAyN2RjYTExNGY4YTdkMTI3ZjM3NjYyZjIifV19) | +| `block-destructive-commands` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLWRlc3RydWN0aXZlLWNvbW1hbmRzIiwidmVyc2lvbiI6IjAuMy4wIiwic2hhMjU2IjoiNTQxYjRkMzI3Nzg4NDI0OGQzMjE2MDFkMDRjZTAxODI1MzdjMzBlMjU5NmRjNzgwYzAwMWFlNTMyYjFiOWQ1MCJ9XX0) | +| `block-invisible-unicode` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLWludmlzaWJsZS11bmljb2RlIiwidmVyc2lvbiI6IjAuMS4xIiwic2hhMjU2IjoiYjEwODQzMTU3MDZkYzI2ZTMwOTdkZDFjMWE4OTNjNzgwNDE1ZjExNjhhYjVhOTk1YzE5YTg5NWY5MzY4OGM1YSJ9XX0) | +| `block-no-verify` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLW5vLXZlcmlmeSIsInZlcnNpb24iOiIwLjUuMCIsInNoYTI1NiI6ImE0MDZkNTBlNGNmMzBkNTY0MzA4NDA4MGFkNDI1OWQzNDJmM2VkZDA3MDM2ODg4YzQ3YTgyMTRmNjYwOTk0Y2MifV19) | +| `block-test-skips` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLXRlc3Qtc2tpcHMiLCJ2ZXJzaW9uIjoiMC4xLjAiLCJzaGEyNTYiOiI4NTM1YzUyZWQwNTViMDg0YjNkODcwYjMzOTQ0ODc0MWUxODM0ZjZmZDkxYWIyZDMyZWFkMWQyNjNmNDc1NTc0In1dfQ) | +| `block-unapproved-egress` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLXVuYXBwcm92ZWQtZWdyZXNzIiwidmVyc2lvbiI6IjAuMi40Iiwic2hhMjU2IjoiZTQ4NmZlMzdiMTIxYzIwNTQxZjcxY2VmNmNiODU2MDVmZTBhMDZlZWViNmU1NjM4M2M5OGZmYjAwYzAwN2UxMCJ9XX0) | +| `block-unguarded-agent-spawn` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLXVuZ3VhcmRlZC1hZ2VudC1zcGF3biIsInZlcnNpb24iOiIwLjIuMCIsInNoYTI1NiI6ImU0NWMyMTU1MWYxZjFhMjQyMjc1NjgzYWZlOWFlMDA0NjI3N2Q4ZDU3ZjUzNzM0NGFjNzEzZmZiZmJhNDYxMzcifV19) | +| `block-wildcard-agent-permissions` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImJsb2NrLXdpbGRjYXJkLWFnZW50LXBlcm1pc3Npb25zIiwidmVyc2lvbiI6IjAuMC4xMCIsInNoYTI1NiI6IjZiMzE5ZGY2OGYwM2M5MzYyNmM2OTVkMjk4NzBjMTc5NDU2ZWZiZGY0ZWZiMzMwMTJiZTlmZDBlZDhhMzhlZWQifV19) | +| `chock-mise` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImNob2NrLW1pc2UiLCJ2ZXJzaW9uIjoiMC4wLjMiLCJzaGEyNTYiOiIxYjA3MmJkNTE3NGFjOGE3NWJkNDQ0ZWQxMDBkNDFjZGI3NmNjMzlmMWQ2NmM4NjZhN2MyZDlhNzNlZWNmNTFmIn1dfQ) | +| `code-safety` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImNvZGUtc2FmZXR5IiwidmVyc2lvbiI6IjAuMC40Iiwic2hhMjU2IjoiNTEwNjc5NTEyMzVhOWFkZDMwZjJhZmEyMDc2MmM1M2ZkMzkyYmEyZDU3Mzg0NTk3MGMyOWJkMzAyOTUxZWFlMiJ9XX0) | +| `context-hygiene` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImNvbnRleHQtaHlnaWVuZSIsInZlcnNpb24iOiIwLjAuMiIsInNoYTI1NiI6IjQ4OTJkMjE0YzYyODk3YmIyODNlZjUyZmY2ZWNjODA1NmQ2NzIxMzYzMGY2MTdjMjEyMDZkZjVkNWI1ZTdkNzQifV19) | +| `firecrawl-fallback-only` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImZpcmVjcmF3bC1mYWxsYmFjay1vbmx5IiwidmVyc2lvbiI6IjAuMS4xIiwic2hhMjU2IjoiYzFmYjNmNGNkMjRkZmIwNzBiYzFkY2ZhMGQ1N2Q3ZTkwMTc0ODE5MDhiYjU0ODUwYzU2ZDU2ZGZjYzA3OTA2NCJ9XX0) | +| `git-safety` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImdpdC1zYWZldHkiLCJ2ZXJzaW9uIjoiMC4wLjQiLCJzaGEyNTYiOiI3ODRjM2ExODhjNWM0MmE4ODYwNzAzMDE5OWRlNGI1YWNhOWYzYzJmNDYyNzk4ZWI5NjY5MWM3MTMwN2NhODU4In1dfQ) | +| `guard-memory-writes` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6Imd1YXJkLW1lbW9yeS13cml0ZXMiLCJ2ZXJzaW9uIjoiMC4wLjkiLCJzaGEyNTYiOiJlODhmZDQ2ZWJiYjdhNWE2NmY3N2U2NGI3YWU2NWU0MDk0NWE0ZDJhNTdkYzI1ZDUzYzMxZjczZTU3ODBjZDdiIn1dfQ) | +| `injection-defense` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImluamVjdGlvbi1kZWZlbnNlIiwidmVyc2lvbiI6IjAuMC40Iiwic2hhMjU2IjoiNjQzN2NlMmEzNmE3Y2I0YTYwZmI3OGMzOTc4YTMzNjJhYTM1Y2M5Y2RmYjkzZjg2N2U1ODU4NTI3ZTc2MDljMCJ9XX0) | +| `java-security` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImphdmEtc2VjdXJpdHkiLCJ2ZXJzaW9uIjoiMC43LjAiLCJzaGEyNTYiOiIyYjFhODU4ODE5NDZlMWJiNjUxNTcxODMyYzRiZWQ0N2YzZjIyZTYyNTU3NTllZDIxZDNhMTcwZGVjOTcwMDU4In1dfQ) | +| `limit-diff-size` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6ImxpbWl0LWRpZmYtc2l6ZSIsInZlcnNpb24iOiIwLjAuMyIsInNoYTI1NiI6ImE3ZTVhZGQ2NmE1NzA2YTA4ODk4NDc2Njk1ZmUyYzMwYzA1ZTA2ZTRiZjgwYzBiNGM2NzIyY2QyODllNThhZjQifV19) | +| `memory-discipline` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6Im1lbW9yeS1kaXNjaXBsaW5lIiwidmVyc2lvbiI6IjAuMC41Iiwic2hhMjU2IjoiMGY3YTY2N2EwN2U4ZjViOWM5NmVhZDZmOTZkZjdhMmU5ZTk4OWMzYzBlYzc3NmFiZjgzYTA3ZmRkYzY5NTVmOCJ9XX0) | +| `no-a11y-regression` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6Im5vLWExMXktcmVncmVzc2lvbiIsInZlcnNpb24iOiIxLjEuMiIsInNoYTI1NiI6IjIxYzQ3Y2ZhZWE4ZDlmN2Q2MWU5ZjRkOWQ5YjEyN2I3MzcxNTM1NjEzYTU4OGUxYzVlNzQ0MzYwMTNkMGIxZGIifV19) | +| `pin-github-actions` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InBpbi1naXRodWItYWN0aW9ucyIsInZlcnNpb24iOiIwLjAuNyIsInNoYTI1NiI6IjE2OGQ2ZTk0NjMyNDkzMDlhYmQ0MDIyYWRjMTc2YjhkOTdhYjFmZGIxNmY0Y2E1OTY3ZjVjNGNhODU4NTY5ZWMifV19) | +| `protect-agent-config` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtYWdlbnQtY29uZmlnIiwidmVyc2lvbiI6IjAuNy4xIiwic2hhMjU2IjoiMTk2NDQ1NzUzNjVmMjU1YTYxMjM0NTQyYzY3NmIzYmRmMDI4YmZkMjBhN2MyMDU3M2FjMjNkMzBiNTkwODdhMSJ9XX0) | +| `protect-ci-workflows` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtY2ktd29ya2Zsb3dzIiwidmVyc2lvbiI6IjAuMi42Iiwic2hhMjU2IjoiMGU1MGNlOTc4ZmJhNzk5ZjNkZTZlYmE1MjRmZDIwYjFjZTg2YWRkOWM5YzFmNGJkNjE5Y2M5NGZkOGIzZjAzNyJ9XX0) | +| `protect-commit-privacy` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtY29tbWl0LXByaXZhY3kiLCJ2ZXJzaW9uIjoiMC4yLjUiLCJzaGEyNTYiOiIzMzE0Mjk1YmFlMWE0Yjc1ZDUwM2Q5NzdjODQ0OWU4OThhODE1OTFjNWNhMWU5ODk2OGM5Zjc4OTkwMmZjNzAxIn1dfQ) | +| `protect-main-branch` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtbWFpbi1icmFuY2giLCJ2ZXJzaW9uIjoiMC4wLjMiLCJzaGEyNTYiOiJlYmExNjRkMDljMjJiNDZmNWMyZDI2NTY2MDdkNzM1OTZkM2IwY2U0Yzc3ODE4NzM3ZWZjNTI3MmQ3ODcxOWVlIn1dfQ) | +| `protect-test-integrity` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InByb3RlY3QtdGVzdC1pbnRlZ3JpdHkiLCJ2ZXJzaW9uIjoiMC4wLjMiLCJzaGEyNTYiOiJlNTM2MGQ2ZTkzMjA1NGNiNmUzN2U3N2VkYTNiZTZlODFlZDkwMDBmZjU0MWIwYmRkM2YyZWU5MjU1ZDJlOTJmIn1dfQ) | +| `rtk-dangerous-actions-blocker` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InJ0ay1kYW5nZXJvdXMtYWN0aW9ucy1ibG9ja2VyIiwidmVyc2lvbiI6IjAuMy4wIiwic2hhMjU2IjoiMTQ5MDk3OTY2ZDJjOGJkYjJlMTU3YTQ0YjNmODdiYTk0ZWI5NWI0YWM3ZjcyNDI0MGU1MjUyZGQ1NmY0OGViMSJ9XX0) | +| `scan-secrets` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InNjYW4tc2VjcmV0cyIsInZlcnNpb24iOiIwLjEuMiIsInNoYTI1NiI6IjgwYzI3YjZjZTJmMTQ1NzFiMWMyYTFmYTIzZTdmNzFlMzA1Y2EzZTIxZjc2MGIzNTU3NTA5ZGZkNDMwNTYwZDAifV19) | +| `token-efficiency` | advisory | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InRva2VuLWVmZmljaWVuY3kiLCJ2ZXJzaW9uIjoiMC4xLjEiLCJzaGEyNTYiOiIxOTAwM2ZhZmFhMmE0NDgzNmRhNTQ4NmY5ZjUyOGE2N2E3NWM0NGIyYjQ5MjJlMjY0NDUyZTU5MjliNWExYzc2In1dfQ) | +| `verify-dependency-exists` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InZlcmlmeS1kZXBlbmRlbmN5LWV4aXN0cyIsInZlcnNpb24iOiIwLjIuMCIsInNoYTI1NiI6ImE5ODYzZmY0OGUyNDlmMDdhNjBhNTZmMmI0Y2ViYWNmMjRiN2M1NDExNzNjOTA5YmU4NGY2ZjY5OTE3ODg5NTUifV19) | +| `verify-mcp-allowlist` | enforces | [Open in the builder](https://chock.sh/coding/builder/#s=eyJzY2hlbWEiOjIsImNsaWVudCI6ImN1cnNvciIsImJ1bmRsZSI6eyJ2ZXJzaW9uIjoiMS4wLjAifSwiY2F0YWxvZyI6eyJzb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vb3Blbi1jb2Rlci1haS9jaG9jay1jYXRhbG9nIiwicmVmIjoiZTg4NWY5MThhMzM1ZTIwZGZkZGI0ZmFkMDMzMWQ0ZDViNGM1ZWI0MyJ9LCJwb2xpY2llcyI6W3siZnJvbSI6ImNhdGFsb2ciLCJpZCI6InZlcmlmeS1tY3AtYWxsb3dsaXN0IiwidmVyc2lvbiI6IjAuNS4zIiwic2hhMjU2IjoiMDQyMTY4ODlhNjAxMmIyZTU4MjJkYWI4MWRmNTg2MzZhMDdiNDg3YzIwZDFmZmI4MDIzYjcwZTE4YjRjZTFhNCJ9XX0) | ## Generated from chock-catalog From 7c89e2fb2b7df490641bb4fef47ccb2dbc162dc0 Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:22:19 +0000 Subject: [PATCH 2/3] docs: README offers two routes, this marketplace and the builder (IR-16) Replace "moved, stops publishing, archived" with the two routes: this marketplace (no chock on the machine, republished with every chock release) and the chock.sh builder (one plugin, needs pip install chock). Never install the same policy by both, since each copy runs its hook. README.md is hand-written, so no generator change is needed. Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 58 +++++++++++++++++++++++++++++++------------------------ 1 file changed, 33 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index 41c9229..29fe9df 100644 --- a/README.md +++ b/README.md @@ -26,39 +26,47 @@ refuse the command is closer to one — a matched destructive command is denied before it runs, witnessed on a real Cursor install (2026-08-24), with benign commands in the same session still allowed. -## Moved to the chock.sh builder +## Two ways to get these plugins -> **This repository stops publishing on the chock.sh launch day and is archived 30 days later** (notice dated 2026-10-21). +**This marketplace: no chock on the machine.** Each policy is its own plugin, republished with +every chock release. You need Python 3.11+ and git, and nothing else. Cursor reads this +repository as a plugin marketplace via `.cursor-plugin/marketplace.json`: -The plugins now come from the chock.sh builder at ****: pick the -policies, and it gives you one command that builds a single `chock-guardrails` plugin on your -machine from [chock-catalog](https://github.com/open-coder-ai/chock-catalog). Nothing is -downloaded from this repository any more. The plugins already need Python 3.11+ to run their hooks, -so `pip install chock` adds a package, not a runtime. +``` +# Team marketplace: Dashboard -> Plugins -> Add Marketplace -> Import from Repo +# https://github.com/open-coder-ai/chock-cursor-plugins +# Local install of one plugin (developer flow): +# copy cursor// to ~/.cursor/plugins/local// and reload Cursor +``` -### Migrating from this marketplace +**The builder: one plugin, needs chock.** Pick the policies you want at +****; it gives you one command that builds a single +`chock-guardrails` plugin on your machine from +[chock-catalog](https://github.com/open-coder-ai/chock-catalog). That command needs +`pip install chock`: -Remove what you installed from here first, so the same policy does not run twice (once from the old -plugin, once from the new one): +```bash +pip install chock +chock install --selection '' --client cursor --apply +``` -1. **Team marketplace import:** in Cursor, open **Dashboard -> Plugins & MCPs**, find this repository - under **Team Marketplaces** and remove it (an admin action on Enterprise). Then open **Customize** - and remove each plugin you installed from it; a plugin set to **Required** cannot be uninstalled - until it is changed in the marketplace's settings. See [Cursor's plugin docs](https://cursor.com/docs/plugins). -2. **Local copy:** delete each `~/.cursor/plugins/local//` folder you copied from `cursor//`, - then run **Developer: Reload Window** (or restart Cursor). -3. **Install from the builder:** +`` is the selection code the builder shows for your choice. Cursor has no command to run +for a local plugin, so the output tells you to run **Developer: Reload Window**; then check the +plugin under **Customize**. - ```bash - pip install chock - chock install --selection '' --client cursor --apply - ``` +**Use one route for a given policy, never both.** Every copy of a plugin runs its own hook, so +a policy installed from both places runs twice. To switch a policy from one route to the other, +remove it from the first route before installing it from the second: - `` is the selection code the [builder](https://chock.sh/coding/builder/) shows for your - choice. Cursor has no command to run for a local plugin, so the output tells you to run - **Developer: Reload Window**; then check the plugin under **Customize**. +1. **Team marketplace import:** in Cursor, open **Dashboard -> Plugins & MCPs**, find this + repository under **Team Marketplaces** and remove it (an admin action on Enterprise). Then + open **Customize** and remove each plugin you installed from it; a plugin set to + **Required** cannot be uninstalled until it is changed in the marketplace's settings. See + [Cursor's plugin docs](https://cursor.com/docs/plugins). +2. **Local copy:** delete each `~/.cursor/plugins/local//` folder you copied from + `cursor//`, then run **Developer: Reload Window** (or restart Cursor). -### One policy, preselected +### Builder links, one policy at a time Each link opens the builder with that one policy chosen for Cursor. The selections pin `catalog.ref` to chock-catalog commit `e885f918a335e20dfddb4fad0331d4d5b4c5eb43`, so a link builds the From 7a663c936a8b7c3b72d2b732a615600a9094add5 Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Fri, 23 Oct 2026 23:23:48 +0000 Subject: [PATCH 3/3] docs: README builder command unquoted, requirements name bash (IR-16) cmd.exe passes single quotes literally, so print the selection command unquoted. The plugins' hooks need git, a usable bash and Python 3.11+, so say so instead of "nothing else". Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 29fe9df..17b80d9 100644 --- a/README.md +++ b/README.md @@ -29,7 +29,7 @@ same session still allowed. ## Two ways to get these plugins **This marketplace: no chock on the machine.** Each policy is its own plugin, republished with -every chock release. You need Python 3.11+ and git, and nothing else. Cursor reads this +every chock release. You need Python 3.11+, git and a bash (Git for Windows includes one). Cursor reads this repository as a plugin marketplace via `.cursor-plugin/marketplace.json`: ``` @@ -47,7 +47,7 @@ repository as a plugin marketplace via `.cursor-plugin/marketplace.json`: ```bash pip install chock -chock install --selection '' --client cursor --apply +chock install --selection --client cursor --apply ``` `` is the selection code the builder shows for your choice. Cursor has no command to run