chock-devin-plugins

Blocks your Devin agent's wrong moves before they land.

Chock policies as Devin plugins — a real hook that can deny a command, best-effort and fail-open by the vendor's own design.

An agent you're running can already touch your shell, your git history, and your CI config. You want it to move fast without being the reason a stray helm uninstall actually happens. Telling it to be careful in a prompt is not a guarantee; a plugin that can refuse the command is closer to one. Devin's own documentation is explicit that plugin hooks are "currently best effort and fail open — if a hook fails to load or run, the session continues without it — so don't rely on them for crucial guardrails yet." No devin plugins install run against these packages has been recorded yet; the claims on this page come from Devin's published documentation (docs.devin.ai, read 2026-09-21), not from a witnessed install.

Local sessions only. Plugin hooks are registered in Devin CLI and Devin Desktop sessions. They are not registered in Devin's cloud sessions — a guard installed from here has no effect there. A hook's exit code decides the outcome: 2 blocks the tool call, 0 lets it continue, and any other exit is logged but does not block. The shipped hook is wired as PreToolUse in each plugin's hooks.json; when it denies, it prints a JSON decision on stdout, {"decision": "block", "reason": "..."}, and exits 0, and it exits 2 only when the hook cannot run or itself faults. Whether Devin honours that JSON decision has not been witnessed, because no install has been recorded (see above).

Two ways to get these plugins

This repository: no chock on the machine. Each policy is its own plugin, republished with every chock release. You need Python 3.11+, git and a bash (Git for Windows includes one).

devin plugins install open-coder-ai/chock-devin-plugins

That installs the root meta-plugin, which offers every policy below as an optional plugin. To install a single policy instead:

devin plugins install open-coder-ai/chock-devin-plugins#devin/<policy-id>

Devin has no marketplace index file of its own, so this repository publishes as a plain git subdirectory layout rather than a marketplace manifest — the URL above is the whole address.

The builder: one plugin, needs chock. Pick the policies you want at https://chock.sh/coding/builder/. chock install generates one plugin on your machine from the selection, and needs pip install chock:

pip install chock
chock install --selection <code> --client devin --apply

Use one route for a given policy, never both. Every copy of a plugin runs its own hook, so a policy installed from both places runs twice. To switch a policy from one route to the other, remove it from the first route before installing it from the second. List what you have with devin plugins list, then remove the root meta-plugin and any single policy:

devin plugins remove chock-devin
devin plugins remove <policy-id>

This repository is not a marketplace, so there is no marketplace to remove.

Builder links, one policy at a time

Each link opens the builder for Devin with that one policy preselected. Every link pins the chock-catalog commit e885f918a335e20dfddb4fad0331d4d5b4c5eb43, so each row names the policy version at that commit, which can be newer than the version in PLUGINS.md.

policy	version	builder
agent-discipline	0.0.3	Open in the builder
block-curl-pipe-sh	0.1.4	Open in the builder
block-destructive-commands	0.3.0	Open in the builder
block-invisible-unicode	0.1.1	Open in the builder
block-no-verify	0.5.0	Open in the builder
block-test-skips	0.1.0	Open in the builder
block-unapproved-egress	0.2.4	Open in the builder
block-unguarded-agent-spawn	0.2.0	Open in the builder
block-wildcard-agent-permissions	0.0.10	Open in the builder
chock-mise	0.0.3	Open in the builder
code-safety	0.0.4	Open in the builder
context-hygiene	0.0.2	Open in the builder
firecrawl-fallback-only	0.1.1	Open in the builder
git-safety	0.0.4	Open in the builder
guard-memory-writes	0.0.9	Open in the builder
injection-defense	0.0.4	Open in the builder
java-security	0.7.0	Open in the builder
limit-diff-size	0.0.3	Open in the builder
memory-discipline	0.0.5	Open in the builder
no-a11y-regression	1.1.2	Open in the builder
pin-github-actions	0.0.7	Open in the builder
protect-agent-config	0.7.1	Open in the builder
protect-ci-workflows	0.2.6	Open in the builder
protect-commit-privacy	0.2.5	Open in the builder
protect-main-branch	0.0.3	Open in the builder
protect-test-integrity	0.0.3	Open in the builder
rtk-dangerous-actions-blocker	0.3.0	Open in the builder
scan-secrets	0.1.2	Open in the builder
token-efficiency	0.1.1	Open in the builder
verify-dependency-exists	0.2.0	Open in the builder
verify-mcp-allowlist	0.5.3	Open in the builder

You may already have this

Devin's CLI also reads Claude Code plugin marketplaces and .claude/settings.json hooks. If you have already installed chock-claude-plugins for Claude Code, Devin CLI sessions in the same project may pick up those same guards through that path. This is documented behaviour for the Claude-format fallback; it has not been verified against this repository's bare Agent Plugins 1.0.0 layout, so treat it as a possible second route to the same guard rather than a guarantee.

Generated from chock-catalog

Every file here is compiled from policy sources in chock-catalog by chock. Pull requests against this repository are closed automatically — open them against the catalog instead.

• Generated only: CI regenerates from the pinned catalog and fails on any difference.
• Byte-identical guards: guard scripts and the hook adapter are verbatim copies of their framework sources.
• Best-effort, not a boundary: guards are pattern-based filters; see SECURITY.md.
• Tested upstream, and gated: every policy ships an eval suite (base/<policy>/evals/suite.yaml) in the catalog, and the publish workflow runs chock check and chock check --only evals before packaging anything — a policy whose evals fail cannot reach this repository. The tests live in the catalog because the policy source does; this repository is compiled output.
• This README is the exception: the one hand-written file here, outside the guarantee.

Verify it yourself

Nothing above asks for trust that cannot be checked. This rebuilds the published tree from source and compares it with what is committed here:

git clone https://github.com/open-coder-ai/chock-devin-plugins dist
git clone --branch v0.9.3 https://github.com/open-coder-ai/chock framework
git clone https://github.com/open-coder-ai/chock-catalog catalog
pip install ./framework
chock plugin build --repo catalog --policies-dir base --format devin --out-dir dist
chock marketplace build --dist dist --tree devin --name chock-devin --url https://github.com/open-coder-ai/chock-devin-plugins
git -C dist diff --exit-code && git -C dist status --porcelain

Silence from both git commands means this repository is byte-identical to a fresh build from the catalog. --branch v0.9.3 is the first framework release that carries the Devin format; the release a published tree was built with is recorded in its Publish commit message. chock-market.lock records a sha256 per published plugin directory, so one package can be checked without rebuilding the rest.

If you are listing these plugins in a marketplace, pin both a tag and the full commit SHA. The tag names the release; the SHA is what holds the reviewed bytes still.

Contributing

You want to	Go to
Fix or add a policy	chock-catalog — it reaches every client from there, including this one
Report that a guard did or did not block on your Devin version	an issue on chock, which is where a witnessed block or fail-open on a real Devin install gets recorded; no such run exists for these packages yet, so yours would be the first
Report a bug in how packages are generated	chock, where the emitter lives
Fix this README	here — it is the one hand-written file in the repository

Part of open-coder-ai

agentseam	the primitives — one handler API and a verified capability matrix across 16 agents
chock	the compiler — one policy into git hooks, CI gates and native pre-tool hooks
chock-catalog	the policies — 39, each labelled enforced or advisory, with replayed evals
context-report	the evidence — a signed report of whether an agent artifact actually works
chock-threat-intel	the threat ledger the catalog's policies answer to
chock-{claude,cursor,copilot,codex,devin}-plugins	the catalog, packaged for each agent's plugin format (generated)
chock-quickstart · chock-example	template repos: what chock init leaves behind, and a full adoption

License

Apache-2.0, same as the framework and the catalog.