diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..6313b56 --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +* text=auto eol=lf diff --git a/.github/workflows/close-prs.yml b/.github/workflows/close-prs.yml new file mode 100644 index 0000000..4ecd190 --- /dev/null +++ b/.github/workflows/close-prs.yml @@ -0,0 +1,55 @@ +name: Close hand-written pull requests + +# Review belongs where the source is. A pull request here would be edited compiled output +# with no policy manifest behind it, no evals, and no honesty-tier computation -- exactly +# the drift the generated-only invariant exists to prevent. Contributors are pointed at the +# catalog rather than left waiting on a review that cannot happen. + +on: + pull_request_target: + types: [opened, reopened] + +permissions: + pull-requests: write + +jobs: + redirect: + # Fork PRs only. The redirect rationale -- your change belongs in the catalog -- + # applies to outside contributions; a branch in this repository is the maintainer's + # own infrastructure work (workflows, config), which is not generated content. This + # guard closed the repo's own first hardening PR before the condition existed. + if: github.event.pull_request.head.repo.full_name != github.repository + runs-on: ubuntu-latest + steps: + - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + env: + # Passed through the environment rather than inlined, so the message is plain + # text in one place instead of an escaped string inside JavaScript inside YAML. + BODY: | + Thanks for taking the time to open this. + + This repository is **generated** -- every file here is compiled from policy sources in + [chock-catalog](https://github.com/open-coder-ai/chock-catalog) and overwritten on each + release. A change merged here would be erased by the next publish, and it would carry + none of the checks a policy gets: manifest validation, replayed evals, or the + coverage-honesty computation. + + Please open your change against the catalog instead -- it reaches every client from + there, including this one. If you found a bug in how packages are generated rather than + in a policy, the emitter lives in [chock](https://github.com/open-coder-ai/chock). + + Closing for that reason, not because the change is unwelcome. + with: + script: | + await github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: process.env.BODY, + }); + await github.rest.pulls.update({ + pull_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + state: 'closed', + }); diff --git a/.github/workflows/generated-only.yml b/.github/workflows/generated-only.yml new file mode 100644 index 0000000..018c998 --- /dev/null +++ b/.github/workflows/generated-only.yml @@ -0,0 +1,85 @@ +name: Generated-only + +# This repository is compiled output. The guarantee it offers users is that its contents +# are exactly what the catalog published -- so the check is not a lint, it is the security +# argument: regenerate from the pinned sources and fail on any difference. A hand edit, a +# tampered guard script, or a manually added plugin all surface here as a diff. + +on: + push: + branches: [main] + pull_request: + workflow_dispatch: + +permissions: + contents: read + +jobs: + verify: + runs-on: ubuntu-latest + steps: + - name: Check out this distribution repo + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + path: dist + + # The catalog is checked out first because it names the framework. `.framework-ref` + # is the emitter version this catalog's published output is defined against, so the + # only build that can prove this tree came from the catalog is a build with that + # framework. Checking out `main` here instead -- which is what this did -- compares a + # fixed tree against a moving emitter: the next merge that changes emitter output + # turns this check red on a tree nobody touched, while `publish` keeps building from + # a pinned ref. Deriving both from one file is what keeps verify and publish honest. + - name: Check out the catalog + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + repository: open-coder-ai/chock-catalog + path: catalog + + - name: Read the framework ref the catalog declares + id: framework + working-directory: catalog + run: | + if [ ! -f .framework-ref ]; then + echo "::error::chock-catalog has no .framework-ref, so there is no declared framework to verify this tree against." + exit 1 + fi + ref="$(tr -d '[:space:]' < .framework-ref)" + if [ -z "$ref" ]; then + echo "::error::chock-catalog/.framework-ref is empty, so there is no declared framework to verify this tree against." + exit 1 + fi + echo "ref=$ref" >> "$GITHUB_OUTPUT" + echo "Verifying against framework $ref, from chock-catalog/.framework-ref." + + - name: Check out the framework at the ref the catalog declares + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + repository: open-coder-ai/chock + ref: ${{ steps.framework.outputs.ref }} + path: framework + + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + with: + python-version: '3.12' + + - name: Install the framework from source + run: pip install ./framework + + - name: Verify the lockfile and index match the published tree + working-directory: dist + run: chock marketplace build --dist . --check --tree devin --name chock-devin --url https://github.com/open-coder-ai/chock-devin-plugins + + - name: Regenerate from the catalog and diff + run: | + chock plugin build --repo catalog --policies-dir base --format devin --out-dir dist + chock marketplace build --dist dist --tree devin --name chock-devin --url https://github.com/open-coder-ai/chock-devin-plugins + cd dist + if ! git diff --exit-code; then + echo "::error::This repository is generated. Regenerating from the catalog produced a different tree, so something here was not published by the catalog. Open a pull request against open-coder-ai/chock-catalog instead." + exit 1 + fi + echo "Tree matches a fresh build from the catalog." diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 0000000..14cbddc --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,143 @@ +name: Publish + +# Rebuilds this repository from the catalog and pushes the result. Runs HERE rather than +# in the catalog so no long-lived cross-repo credential exists; publishing is a human +# decision, never a side effect of a merge. + +on: + workflow_dispatch: + inputs: + catalog_ref: + description: Catalog ref to publish (tag, branch or SHA) + type: string + default: main + framework_ref: + # The framework the committed tree was built with: the emitter version whose output + # *is* this repository's content. Getting it wrong does not produce a stale build, + # it rewrites every published package against a different emitter. + # + # `auto` reads that value from the catalog ref being published, out of its + # `.framework-ref` file, so the default is right by construction. A literal default + # was tried and failed: it sat at v0.4.0 across three releases while the trees moved + # to v0.5.0, v0.6.0 and v0.7.0, because the comment asking a human to bump it does + # not execute. A sentinel is used rather than an empty default so that the resolved + # value is visible in the run log and an accidental blank still resolves the same + # way. An explicit tag, branch or SHA overrides it, which is why the input remains. + description: Framework ref to build with ("auto" = the ref chock-catalog declares) + type: string + default: auto + dry_run: + description: Build and show the diff without pushing + type: boolean + default: true + +permissions: + contents: write + +jobs: + publish: + runs-on: ubuntu-latest + steps: + - name: Check out this distribution repo + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + # The one checkout that keeps credentials: this job commits and pushes the + # regenerated tree. Documented as the artipacked exception in .github/zizmor.yml. + persist-credentials: true + path: dist + + - name: Check out the catalog at the ref being published + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + repository: open-coder-ai/chock-catalog + ref: ${{ inputs.catalog_ref }} + path: catalog + + - name: Resolve the framework ref + id: framework + working-directory: catalog + env: + # Dispatch inputs are typed by whoever runs the workflow; expanded by the runner + # into shell text they would execute, through the environment they stay data. + FRAMEWORK_REF_INPUT: ${{ inputs.framework_ref }} + run: | + ref="$FRAMEWORK_REF_INPUT" + origin="the framework_ref dispatch input" + if [ -z "$ref" ] || [ "$ref" = auto ]; then + if [ ! -f .framework-ref ]; then + echo "::error::framework_ref is \"auto\" but the catalog ref being published has no .framework-ref; name a framework ref explicitly." + exit 1 + fi + ref="$(tr -d '[:space:]' < .framework-ref)" + origin="chock-catalog/.framework-ref at the catalog ref being published" + fi + if [ -z "$ref" ]; then + echo "::error::The framework ref resolved to nothing; name a framework ref explicitly." + exit 1 + fi + echo "ref=$ref" >> "$GITHUB_OUTPUT" + echo "Building with framework $ref, from $origin." + + - name: Check out the framework at the resolved ref + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + repository: open-coder-ai/chock + ref: ${{ steps.framework.outputs.ref }} + path: framework + + - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 + with: + python-version: '3.12' + + - name: Install the framework + run: pip install ./framework + + - name: Gate on the catalog's own checks + working-directory: catalog + run: | + chock check + chock check --only evals + + - name: Clear the generated trees + run: rm -rf dist/claude dist/agent-plugins dist/copilot dist/cursor dist/codex dist/devin dist/.devin-plugin + + - name: Build the packages, index, lockfile and catalog page + run: | + chock plugin build --repo catalog --policies-dir base --format devin --out-dir dist + chock marketplace build --dist dist --tree devin --name chock-devin --url https://github.com/open-coder-ai/chock-devin-plugins + + - name: Show what would change + working-directory: dist + run: | + # Record intent-to-add first. `git diff` reports tracked files only, so without + # this every *added* file is invisible and a human reading the dry run to decide + # whether to publish is shown only what disappears. The v0.7.0 dry run printed + # "15 files changed, 14 insertions(+), 2450 deletions(-)" for what was a rename + # into a larger file; staged, the same build reads 5677 insertions(+), 14 + # deletions(-). `-N` records the paths without staging content, so the worktree + # is untouched and the commit below behaves exactly as it did. + git add -A -N . + git --no-pager diff --stat + + - name: Publish + if: ${{ inputs.dry_run == false }} + working-directory: dist + env: + CATALOG_REF: ${{ inputs.catalog_ref }} + FRAMEWORK_REF: ${{ steps.framework.outputs.ref }} + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + # Same blindness as the dry run, with a worse consequence: on a publish whose + # only change is added files, an unstaged `git diff --quiet` is clean and this + # exits 0 reporting "No change to publish" while publishing nothing. + git add -A -N . + if git diff --quiet; then + echo "No change to publish." + exit 0 + fi + git add -A + git commit -m "generated: catalog $CATALOG_REF (framework $FRAMEWORK_REF)" + git push diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..8443086 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,42 @@ +name: Security checks + +# zizmor audits the workflows (adoption-day: two input-injection sites in publish.yml, +# six credential-persisting checkouts, and two unpinned validator installs -- all fixed; +# the three deliberate exceptions live in .github/zizmor.yml with their reasons). +# actionlint checks workflow correctness. ShellCheck is deliberately NOT run here: every +# shell script in this repository is generated from the catalog and verified +# byte-identical to its source by the generated-only check, and the catalog lints the +# sources -- a second lint of the same bytes would be signal-free. + +on: + push: + branches: [main] + pull_request: + +permissions: + contents: read + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + min-severity: low + + actionlint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - name: Run actionlint + run: | + go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.7 + "$(go env GOPATH)/bin/actionlint" -color diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..dec6bfc --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,22 @@ +# zizmor configuration: deliberate, documented exceptions only. +rules: + dangerous-triggers: + # close-prs.yml uses pull_request_target in the documented-safe pattern: it never + # checks out or executes PR code -- it only calls the GitHub API to comment and close. + # The trigger is required to act on fork PRs, which is this workflow's entire job. + ignore: + - close-prs.yml + artipacked: + # publish.yml's dist checkout is the one writer this repository exists to serve: it + # commits and pushes the regenerated tree with the workflow's own scoped token. + # Credential persistence there is the mechanism, not an oversight. + ignore: + - publish.yml + adhoc-packages: + # The claude-code CLI is npm-installed to run `claude plugin validate` -- there is no + # lockfile to install it from in a repo that contains no Node project. The material + # risk (a floating version changing the verification under us) is addressed by + # pinning the exact version in both install lines. + ignore: + - generated-only.yml + - publish.yml diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..72614eb --- /dev/null +++ b/LICENSE @@ -0,0 +1,202 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2026 open-coder-ai + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + diff --git a/PLUGINS.md b/PLUGINS.md new file mode 100644 index 0000000..8d4079b --- /dev/null +++ b/PLUGINS.md @@ -0,0 +1,16 @@ +# Published plugins + + + +This file, `.devin-plugin/plugin.json` and `chock-market.lock` are compiled output, written +by the [Publish workflow](.github/workflows/publish.yml) when it runs against the catalog. +No `dry_run: false` run has been dispatched against this repository yet, so there is no +published tree yet for this file to describe truthfully — the table chock's own +`chock marketplace build --tree devin` produces lists each policy's id, version, and whether +it ships a `hooks.json` guard (best-effort and fail-open per Devin's own documentation, local +CLI/Desktop sessions only — see [SECURITY.md](SECURITY.md)) or skill text only. + +Once the first Publish run lands, this file carries that real, checkable list. Until then, +see [chock-catalog](https://github.com/open-coder-ai/chock-catalog/blob/main/docs) for the +current policy set, or run the two build commands in the README's "Verify it yourself" +section locally to see the table this repository will carry. diff --git a/README.md b/README.md new file mode 100644 index 0000000..3d02041 --- /dev/null +++ b/README.md @@ -0,0 +1,133 @@ +

+ chock logo +

+ +

chock-devin-plugins

+ +

Chock policies as Devin plugins — a real hook that can deny a command, best-effort and fail-open by the vendor's own design.

+ +

+ +[![Generated-only](https://github.com/open-coder-ai/chock-devin-plugins/actions/workflows/generated-only.yml/badge.svg)](https://github.com/open-coder-ai/chock-devin-plugins/actions/workflows/generated-only.yml) +[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE) +[![Contribute upstream](https://img.shields.io/badge/contribute-chock--catalog-8957e5)](https://github.com/open-coder-ai/chock-catalog) + +

+ +

+ A guard plugin denying a destructive command before it runs, in a Devin session +

+ +An agent you're running can already touch your shell, your git history, and your CI config. +You want it to move fast without being the reason a stray `helm uninstall` actually happens. +Telling it to be careful in a prompt is not a guarantee; a plugin that can refuse the command +is closer to one. Devin's own documentation is explicit that plugin hooks are **"currently +best effort and fail open — if a hook fails to load or run, the session continues without it +— so don't rely on them for crucial guardrails yet."** No `devin plugins install` run against +these packages has been recorded yet; the claims on this page come from Devin's published +documentation (docs.devin.ai, read 2026-09-21), not from a witnessed install. + +**Local sessions only.** Plugin hooks are registered in Devin CLI and Devin Desktop sessions. +They are not registered in Devin's cloud sessions — a guard installed from here has no effect +there. A hook's exit code decides the outcome: `2` blocks the tool call, `0` lets it continue, +and any other exit is logged but does not block. + +## Install + +``` +devin plugins install open-coder-ai/chock-devin-plugins +``` + +That installs the root meta-plugin, which offers every policy below as an optional plugin. +To install a single policy instead: + +``` +devin plugins install open-coder-ai/chock-devin-plugins#devin/ +``` + +Devin has no marketplace index file of its own, so this repository publishes as a plain git +subdirectory layout rather than a marketplace manifest — the URL above is the whole address. + +## You may already have this + +Devin's CLI also reads Claude Code plugin marketplaces and `.claude/settings.json` hooks. If +you have already installed [`chock-claude-plugins`](https://github.com/open-coder-ai/chock-claude-plugins) +for Claude Code, Devin CLI sessions in the same project may pick up those same guards through +that path. This is documented behaviour for the Claude-format fallback; it has not been +verified against this repository's bare Agent Plugins 1.0.0 layout, so treat it as a possible +second route to the same guard rather than a guarantee. + +## What you get + +See **[PLUGINS.md](PLUGINS.md)** for the full list: each policy and its version. A plugin +governs one local session; it doesn't run in CI or travel with a clone, and — per the vendor +caveats above — it doesn't run in a cloud session either. For enforcement that follows the +repository, with no host-specific caveat to track, install Chock directly: +`pip install chock && chock init && chock sync --ci`. + +## Generated from chock-catalog + +Every file here is compiled from policy sources in +[chock-catalog](https://github.com/open-coder-ai/chock-catalog) by +[chock](https://github.com/open-coder-ai/chock). Pull requests against this repository are +closed automatically — open them against the catalog instead. + +- **Generated only:** CI regenerates from the pinned catalog and fails on any difference. +- **Byte-identical guards:** guard scripts and the hook adapter are verbatim copies of their + framework sources. +- **Best-effort, not a boundary:** guards are pattern-based filters; see + [SECURITY.md](https://github.com/open-coder-ai/chock/blob/main/SECURITY.md). +- **Tested upstream, and gated:** every policy ships an eval suite + (`base//evals/suite.yaml`) in the catalog, and the publish workflow runs + `chock check` and `chock check --only evals` before packaging anything — a policy whose + evals fail cannot reach this repository. The tests live in the catalog because the policy + source does; this repository is compiled output. +- This README is the exception: the one hand-written file here, outside the guarantee. + +### Verify it yourself + +Nothing above asks for trust that cannot be checked. This rebuilds the published tree from +source and compares it with what is committed here: + +```bash +git clone https://github.com/open-coder-ai/chock-devin-plugins dist +git clone --branch v0.9.3 https://github.com/open-coder-ai/chock framework +git clone https://github.com/open-coder-ai/chock-catalog catalog +pip install ./framework +chock plugin build --repo catalog --policies-dir base --format devin --out-dir dist +chock marketplace build --dist dist --tree devin --name chock-devin --url https://github.com/open-coder-ai/chock-devin-plugins +git -C dist diff --exit-code && git -C dist status --porcelain +``` + +Silence from both `git` commands means this repository is byte-identical to a fresh build +from the catalog. `--branch v0.9.3` is the first framework release that carries the Devin format; the release a published tree was built with is recorded in its Publish commit message. +`chock-market.lock` records a sha256 per published plugin directory, so one package can be +checked without rebuilding the rest. + +**If you are listing these plugins in a marketplace,** pin both a tag and the full commit +SHA. The tag names the release; the SHA is what holds the reviewed bytes still. + +## Contributing + +| You want to | Go to | +| :--- | :--- | +| Fix or add a policy | [chock-catalog](https://github.com/open-coder-ai/chock-catalog/blob/main/CONTRIBUTING.md) — it reaches every client from there, including this one | +| Report that a guard did or did not block on your Devin version | an issue on [chock](https://github.com/open-coder-ai/chock/issues/new/choose), which is where a witnessed block or fail-open on a real Devin install gets recorded; no such run exists for these packages yet, so yours would be the first | +| Report a bug in how packages are generated | [chock](https://github.com/open-coder-ai/chock/issues/new/choose), where the emitter lives | +| Fix this README | here — it is the one hand-written file in the repository | + +## Part of open-coder-ai + +| | | +|---|---| +| [agentseam](https://github.com/open-coder-ai/agentseam) | the primitives — one handler API and a verified capability matrix across 16 agents | +| [chock](https://github.com/open-coder-ai/chock) | the compiler — one policy into git hooks, CI gates and native pre-tool hooks | +| [chock-catalog](https://github.com/open-coder-ai/chock-catalog) | the policies — 39, each labelled enforced or advisory, with replayed evals | +| [context-report](https://github.com/open-coder-ai/context-report) | the evidence — a signed report of whether an agent artifact actually works | +| [chock-threat-intel](https://github.com/open-coder-ai/chock-threat-intel) | the threat ledger the catalog's policies answer to | +| chock-{claude,cursor,copilot,codex,devin}-plugins | the catalog, packaged for each agent's plugin format (generated) | +| chock-quickstart · chock-example | template repos: what `chock init` leaves behind, and a full adoption | + +## License + +Apache-2.0, same as the framework and the catalog. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..6abec62 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,66 @@ +# Security Policy + +## What lives here, and what that means for a report + +`chock-devin-plugins` is **compiled output**. Every file under `devin/`, along with +`.devin-plugin/plugin.json`, `chock-market.lock` and `PLUGINS.md`, is generated from policy +sources in [chock-catalog](https://github.com/open-coder-ai/chock-catalog) by +[chock](https://github.com/open-coder-ai/chock), and the +[Generated-only](.github/workflows/generated-only.yml) check regenerates the tree on every +push and pull request and fails on any difference. There is no hand-written code in this +repository to hold a vulnerability of its own — a defect visible here was introduced either +in the emitter or in the policy it emitted, so a fix landed here would be overwritten by the +next publish. **Report it where it can actually be fixed:** + +| What you found | Where it belongs | +|---|---| +| A defect in a guard script, hook wiring, plugin manifest, or anything about how policies are compiled into plugins | [open-coder-ai/chock](https://github.com/open-coder-ai/chock) — see its [SECURITY.md](https://github.com/open-coder-ai/chock/blob/main/SECURITY.md) | +| A defect in **policy content**: a guard that does not match what it claims to block, a pattern that can be trivially evaded, a policy whose description overstates its enforcement | [open-coder-ai/chock-catalog](https://github.com/open-coder-ai/chock-catalog) | +| This repository's tree does not match a rebuild from the catalog — i.e. something here was not published by the catalog | [chock](https://github.com/open-coder-ai/chock)'s private advisory route, as a supply-chain report against this repository | +| A defect in this repository's own workflows (`.github/workflows/`) | [chock](https://github.com/open-coder-ai/chock)'s private advisory route, naming this repository | + +The last two are the only categories that are genuinely *this* repository's, and both are +about distribution integrity rather than about policy behaviour. + +## Reporting a vulnerability + +Use chock's private advisory route: +. Do **not** open a public +issue for an exploitable finding, here or upstream. Include the affected path, how to +reproduce it, and the impact. Acknowledgement and assessment follow the timelines stated in +[chock's SECURITY.md](https://github.com/open-coder-ai/chock/blob/main/SECURITY.md); this +repository does not set its own, and there is no PGP key — GitHub's advisory form is the +private channel. + +Pull requests are closed here automatically with a pointer to the catalog. That applies to +security fixes too: a patch to a generated file cannot survive the next publish. + +## Verifying what you installed + +Two things are checkable without trusting this repository's README: + +- **Every published plugin directory is hashed in `chock-market.lock`** (sha256 per + directory), so a plugin's content can be compared against what the index claims. +- **The tree is reproducible.** Check out this repository, the catalog and chock as + siblings, install chock from source, and run the same two build commands the + [Generated-only](.github/workflows/generated-only.yml) workflow runs. `git diff` and + `git status --porcelain` should both be silent. That workflow derives the framework + version from the catalog's own `.framework-ref`, so a rebuild from the catalog ref you + care about uses the emitter that catalog declares rather than whatever is on a branch. + +## What these plugins do not promise + +Stated here rather than left to the README, because a security file that omits it is +claiming more than the product does: + +- Devin's own documentation states that plugin hooks are **"currently best effort and fail + open — if a hook fails to load or run, the session continues without it — so don't rely on + them for crucial guardrails yet."** That is a property of the host agent, not a bug in the + plugin, and it means a matched, well-formed guard can still not run at all. +- Plugin hooks are registered in **local Devin sessions only** (Devin CLI and Devin Desktop), + not in Devin's cloud sessions. A guard installed here has no effect there. +- Skills and ambient rules (`AGENTS.md`, `rules/`) are **advisory** in every client. They are + text the model reads. +- Repository-level enforcement — git hooks and a CI gate, which apply with no agent running + — is not part of an installed plugin. It comes from `chock sync` in the target + repository. diff --git a/assets/icon.svg b/assets/icon.svg new file mode 100644 index 0000000..99e2c16 --- /dev/null +++ b/assets/icon.svg @@ -0,0 +1,7 @@ + + + + + + \ No newline at end of file diff --git a/docs/assets/hero.svg b/docs/assets/hero.svg new file mode 100644 index 0000000..aacd718 --- /dev/null +++ b/docs/assets/hero.svg @@ -0,0 +1,25 @@ + + + + + + Devin — chock guard, best-effort by vendor design, not yet witnessed + agent$ + helm uninstall chock-probe █ + + BLOCKED: helm uninstall/delete is not allowed without approval. + + + ✓ denied before it ran + plugin hook · exit code 2 + +