rubik 0.1.0

data/lib/rubik/security/classifier/commands/strace.yaml

@@ -0,0 +1,20 @@
+# $schema: ../../../schemas/command.schema.json
+command: strace
+description: "Trace system calls and signals"
+classification: LOCAL_EFFECTS
+global_options:
+  --help: {overrides: READONLY}
+delegates_to:
+  mode: rest_are_argv
+options:
+  -e: {takes_value: true}
+  -p: {takes_value: true}
+  -o: {takes_value: true}
+  -f: {}
+  -ff: {}
+  -t: {}
+  -tt: {}
+  -T: {}
+  -v: {}
+  -s: {takes_value: true}
+  -c: {}

data/lib/rubik/security/classifier/commands/strings.yaml

@@ -0,0 +1,11 @@
+# $schema: ../../../schemas/command.schema.json
+command: strings
+description: "Display printable strings in files"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  -h: {overrides: READONLY, aliases: [--help]}
+  --version: {overrides: READONLY}
+  -v: {overrides: READONLY, aliases: [--version]}
+  -V: {overrides: READONLY, aliases: [--version]}

data/lib/rubik/security/classifier/commands/sudo.yaml

@@ -0,0 +1,24 @@
+# $schema: ../../../schemas/command.schema.json
+command: sudo
+description: "Execute a command as another user"
+classification: DANGEROUS
+global_options:
+  --help: {overrides: READONLY}
+delegates_to:
+  mode: rest_are_argv
+  min_classification: DANGEROUS
+options:
+  -u: {takes_value: true}
+  --user: {takes_value: true, aliases: [-u]}
+  -g: {takes_value: true}
+  --group: {takes_value: true, aliases: [-g]}
+  -H: {}
+  --set-home: {}
+  -E: {}
+  --preserve-env: {}
+  -n: {}
+  --non-interactive: {}
+  -S: {}
+  --stdin: {}
+  -k: {}
+  --reset-timestamp: {}

data/lib/rubik/security/classifier/commands/systemctl.yaml

@@ -0,0 +1,58 @@
+# $schema: ../../../schemas/command.schema.json
+command: systemctl
+description: "Control the systemd system and service manager"
+classification: DANGEROUS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+subcommands:
+  status:
+    classification: READONLY
+  is-active:
+    classification: READONLY
+  is-enabled:
+    classification: READONLY
+  is-failed:
+    classification: READONLY
+  list-units:
+    classification: READONLY
+  list-unit-files:
+    classification: READONLY
+  show:
+    classification: READONLY
+  start:
+    classification: DANGEROUS
+  stop:
+    classification: DANGEROUS
+  restart:
+    classification: DANGEROUS
+  reload:
+    classification: DANGEROUS
+  enable:
+    classification: LOCAL_EFFECTS
+  disable:
+    classification: LOCAL_EFFECTS
+  mask:
+    classification: DANGEROUS
+  unmask:
+    classification: LOCAL_EFFECTS
+  daemon-reload:
+    classification: DANGEROUS
+  cat:
+    classification: READONLY
+  list-dependencies:
+    classification: READONLY
+  list-timers:
+    classification: READONLY
+  list-sockets:
+    classification: READONLY
+  kill:
+    classification: DANGEROUS
+  edit:
+    classification: DANGEROUS
+  poweroff:
+    classification: DANGEROUS
+  reboot:
+    classification: DANGEROUS
+  halt:
+    classification: DANGEROUS

data/lib/rubik/security/classifier/commands/systemd-run.yaml

@@ -0,0 +1,30 @@
+# $schema: ../../../schemas/command.schema.json
+command: systemd-run
+description: "Run a command in a transient systemd unit (memory/resource wrapper mandated by many AGENTS.md files)"
+global_options:
+  --help: {overrides: READONLY}
+  --version: {overrides: READONLY}
+delegates_to:
+  mode: rest_are_argv
+  min_classification: LOCAL_EFFECTS
+options:
+  --user: {}
+  --system: {}
+  --scope: {}
+  --user-unit: {takes_value: true}
+  --unit: {takes_value: true, aliases: [-u]}
+  --property: {takes_value: true, aliases: [-p]}
+  --description: {takes_value: true}
+  --slice: {takes_value: true}
+  --service-type: {takes_value: true}
+  --working-directory: {takes_value: true, captures_directory: true}
+  --uid: {takes_value: true}
+  --gid: {takes_value: true}
+  --nice: {takes_value: true, aliases: [-n]}
+  --quiet: {aliases: [-q]}
+  --wait: {}
+  --pipe: {}
+  --collect: {}
+  --no-ask-password: {}
+  --remain-after-exit: {aliases: [-r]}
+  --same-dir: {}

data/lib/rubik/security/classifier/commands/tac.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: tac
+description: "Concatenate and print files in reverse"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/tail.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: tail
+description: "Output the last part of files"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/tar.yaml

@@ -0,0 +1,25 @@
+# $schema: ../../../schemas/command.schema.json
+command: tar
+description: "Archive utility for creating and extracting tarballs"
+classification: LOCAL_EFFECTS
+risk: LOW
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+options:
+  -t: {overrides: READONLY}
+  --list: {overrides: READONLY, aliases: [-t]}
+  -c: {}
+  --create: {aliases: [-c]}
+  -x: {}
+  --extract: {aliases: [-x]}
+  -f: {takes_value: true}
+  --file: {takes_value: true, aliases: [-f]}
+  -z: {}
+  --gzip: {aliases: [-z]}
+  -j: {}
+  --bzip2: {aliases: [-j]}
+  -v: {}
+  --verbose: {aliases: [-v]}
+  -C: {takes_value: true, captures_directory: true}
+  --directory: {takes_value: true, captures_directory: true, aliases: [-C]}

data/lib/rubik/security/classifier/commands/tee.yaml

@@ -0,0 +1,8 @@
+# $schema: ../../../schemas/command.schema.json
+command: tee
+description: "Read from stdin and write to stdout and files"
+classification: LOCAL_EFFECTS
+risk: LOW
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/terraform.yaml

@@ -0,0 +1,70 @@
+# $schema: ../../../schemas/command.schema.json
+command: terraform
+description: "Infrastructure as code tool by HashiCorp"
+classification: DANGEROUS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+subcommands:
+  init:
+    classification: LOCAL_EFFECTS
+  plan:
+    classification: READONLY
+  apply:
+    classification: DANGEROUS
+  destroy:
+    classification: DANGEROUS
+  show:
+    classification: READONLY
+  output:
+    classification: READONLY
+  state:
+    classification: READONLY
+    subcommands:
+      list:
+        classification: READONLY
+      show:
+        classification: READONLY
+      mv:
+        classification: DANGEROUS
+      rm:
+        classification: DANGEROUS
+      pull:
+        classification: EXTERNAL_EFFECTS
+      push:
+        classification: EXTERNAL_EFFECTS
+  validate:
+    classification: READONLY
+  fmt:
+    classification: LOCAL_EFFECTS
+  workspace:
+    classification: READONLY
+    subcommands:
+      list:
+        classification: READONLY
+      show:
+        classification: READONLY
+      new:
+        classification: EXTERNAL_EFFECTS
+      select:
+        classification: EXTERNAL_EFFECTS
+      delete:
+        classification: DANGEROUS
+  import:
+    classification: DANGEROUS
+  refresh:
+    classification: EXTERNAL_EFFECTS
+  providers:
+    classification: READONLY
+  console:
+    classification: DANGEROUS
+  taint:
+    classification: DANGEROUS
+  untaint:
+    classification: DANGEROUS
+  force-unlock:
+    classification: DANGEROUS
+  graph:
+    classification: READONLY
+  test:
+    classification: READONLY

data/lib/rubik/security/classifier/commands/test.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: test
+description: "Evaluate conditional expressions"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/time.yaml

@@ -0,0 +1,8 @@
+# $schema: ../../../schemas/command.schema.json
+command: time
+description: "Time a command execution"
+classification: READONLY
+global_options:
+  --help: {overrides: READONLY}
+delegates_to:
+  mode: rest_are_argv

data/lib/rubik/security/classifier/commands/timeout.yaml

@@ -0,0 +1,18 @@
+# $schema: ../../../schemas/command.schema.json
+command: timeout
+description: "Run a command with a time limit"
+classification: READONLY
+global_options:
+  --help: {overrides: READONLY}
+delegates_to:
+  mode: rest_are_argv
+  skip_leading_positionals: 1
+options:
+  -k: {takes_value: true}
+  --kill-after: {takes_value: true, aliases: [-k]}
+  -s: {takes_value: true}
+  --signal: {takes_value: true, aliases: [-s]}
+  --foreground: {}
+  --preserve-status: {}
+  -v: {}
+  --verbose: {}

data/lib/rubik/security/classifier/commands/top.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: top
+description: "Display Linux processes in real time"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/touch.yaml

@@ -0,0 +1,8 @@
+# $schema: ../../../schemas/command.schema.json
+command: touch
+description: "Change file timestamps or create empty files"
+classification: LOCAL_EFFECTS
+risk: LOW
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/tr.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: tr
+description: "Translate or delete characters"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/traceroute.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: traceroute
+description: "Print the route packets take to a host"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/true.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: "true"
+description: "Return a successful exit status"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/tsc.yaml

@@ -0,0 +1,16 @@
+# $schema: ../../../schemas/command.schema.json
+command: tsc
+description: "TypeScript compiler"
+classification: LOCAL_EFFECTS
+risk: LOW
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+options:
+  --noEmit: {overrides: READONLY}
+  --version: {overrides: READONLY}
+  -v: {overrides: READONLY}
+  --watch: {overrides: LOCAL_EFFECTS}
+  -w: {overrides: LOCAL_EFFECTS}
+  --build: {overrides: LOCAL_EFFECTS}
+  -b: {overrides: LOCAL_EFFECTS}

data/lib/rubik/security/classifier/commands/type.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: type
+description: "Display information about command type"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/uname.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: uname
+description: "Print system information"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/unexpand.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: unexpand
+description: "Convert spaces to tabs"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/uniq.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: uniq
+description: "Report or omit repeated lines"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/unzip.yaml

@@ -0,0 +1,10 @@
+# $schema: ../../../schemas/command.schema.json
+command: unzip
+description: "Extract files from ZIP archives"
+classification: LOCAL_EFFECTS
+risk: LOW
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+options:
+  -l: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/uptime.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: uptime
+description: "Show how long the system has been running"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/uv.yaml

@@ -0,0 +1,156 @@
+# $schema: ../../../schemas/command.schema.json
+command: uv
+description: "An extremely fast Python package manager"
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+subcommands:
+  run:
+    classification: DANGEROUS
+    strict: false
+    delegates_to:
+      mode: rest_are_argv
+      strip_assignments: true
+    subcommands:
+      pytest:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      ruff:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      mypy:
+        classification: READONLY
+        strict: false
+  init:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+  add:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+    options:
+      --dry-run: {overrides: READONLY}
+  remove:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+    options:
+      --dry-run: {overrides: READONLY}
+  version:
+    classification: READONLY
+    strict: false
+  sync:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+  lock:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+    options:
+      --check: {overrides: READONLY}
+  export:
+    classification: READONLY
+    strict: false
+  tree:
+    classification: READONLY
+    strict: false
+  format:
+    classification: LOCAL_EFFECTS
+    strict: false
+  tool:
+    strict: false
+    subcommands:
+      install:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      uninstall:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      list:
+        classification: READONLY
+      run:
+        classification: DANGEROUS
+        strict: false
+      dir:
+        classification: READONLY
+  python:
+    strict: false
+    subcommands:
+      install:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      uninstall:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      list:
+        classification: READONLY
+      find:
+        classification: READONLY
+        strict: false
+      dir:
+        classification: READONLY
+      pin:
+        classification: LOCAL_EFFECTS
+        strict: false
+  pip:
+    strict: false
+    subcommands:
+      install:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      uninstall:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false
+      list:
+        classification: READONLY
+        strict: false
+      show:
+        classification: READONLY
+        strict: false
+      freeze:
+        classification: READONLY
+      check:
+        classification: READONLY
+      compile:
+        classification: LOCAL_EFFECTS
+        strict: false
+  venv:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+  build:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+    strict: false
+  publish:
+    classification: DANGEROUS
+    strict: false
+  cache:
+    strict: false
+    subcommands:
+      clean:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+      prune:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+      dir:
+        classification: READONLY
+  self:
+    strict: false
+    subcommands:
+      update:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+  help:
+    classification: READONLY

data/lib/rubik/security/classifier/commands/wait.yaml

@@ -0,0 +1,11 @@
+# $schema: ../../../schemas/command.schema.json
+command: wait
+description: "Wait for background jobs or processes to complete"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+options:
+  -n: {}
+  -f: {}
+  -p: {takes_value: true}

data/lib/rubik/security/classifier/commands/wc.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: wc
+description: "Print newline, word, and byte counts for files"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/wget.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: wget
+description: "Non-interactive network file downloader"
+classification: EXTERNAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/whereis.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: whereis
+description: "Locate the binary, source, and manual page for a command"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/which.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: which
+description: "Locate a command in the PATH"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/whoami.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: whoami
+description: "Print effective user name"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}

data/lib/rubik/security/classifier/commands/xargs.yaml

@@ -0,0 +1,26 @@
+# $schema: ../../../schemas/command.schema.json
+command: xargs
+description: "Build and execute command lines from standard input"
+global_options:
+  --help: {overrides: READONLY}
+delegates_to:
+  mode: rest_are_argv
+options:
+  -I: {takes_value: true}
+  --replace: {takes_value: true, aliases: [-I]}
+  -L: {takes_value: true}
+  --max-lines: {takes_value: true, aliases: [-L]}
+  -n: {takes_value: true}
+  --max-args: {takes_value: true, aliases: [-n]}
+  -P: {takes_value: true}
+  --max-procs: {takes_value: true, aliases: [-P]}
+  -d: {takes_value: true}
+  --delimiter: {takes_value: true, aliases: [-d]}
+  -0: {}
+  --null: {}
+  --no-run-if-empty: {}
+  -r: {}
+  -t: {}
+  --verbose: {}
+  -p: {}
+  --interactive: {}

data/lib/rubik/security/classifier/commands/xmllint.yaml

@@ -0,0 +1,7 @@
+# $schema: ../../../schemas/command.schema.json
+command: xmllint
+description: "XML parser and linter tool"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}