bash-classify 0.1.4__tar.gz → 0.2.0__tar.gz

{bash_classify-0.1.4 → bash_classify-0.2.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows readonly bash commands in Claude Code using bash-classify",
-      "version": "0.1.4",
+      "version": "0.2.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.1.4 → bash_classify-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.1.4
+Version: 0.2.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify
@@ -33,7 +33,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into four levels: `READONLY`, `WRITE`, `DANGEROUS`, and `UNKNOWN`.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into five levels: `READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, and `UNKNOWN`.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow safe, read-only commands while flagging risky ones for human review.
 
@@ -82,7 +82,7 @@ claude plugin marketplace update fprochazka-bash-classify
 claude plugin update bash-classify-hook@fprochazka-bash-classify
 ```
 
-Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (WRITE, DANGEROUS, UNKNOWN) still requires confirmation.
+Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN) still requires confirmation.
 
 ## Command database
 
@@ -95,8 +95,9 @@ The classification database includes 120+ command definitions covering common Un
 
 | Level | Description | Examples |
 |---|---|---|
-| `READONLY` | No side effects, safe to auto-approve | `ls`, `cat`, `grep`, `kubectl get` |
-| `WRITE` | Modifies local files or state | `mkdir`, `cp`, `git commit` |
+| `READONLY` | No side effects, auto-approved | `ls`, `cat`, `grep`, `kubectl get` |
+| `LOCAL_EFFECTS` | Modifies local files or state only | `git add`, `git commit`, `cp`, `mkdir`, `pytest` |
+| `EXTERNAL_EFFECTS` | Interacts with external systems | `git push`, `kubectl apply`, `curl -d` |
 | `DANGEROUS` | Destructive, system-wide, or irreversible | `rm -rf`, `git push --force`, `chmod` |
 | `UNKNOWN` | Command not in database | Any unrecognized command |
 

{bash_classify-0.1.4 → bash_classify-0.2.0}/README.md

@@ -4,7 +4,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into four levels: `READONLY`, `WRITE`, `DANGEROUS`, and `UNKNOWN`.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into five levels: `READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, and `UNKNOWN`.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow safe, read-only commands while flagging risky ones for human review.
 
@@ -53,7 +53,7 @@ claude plugin marketplace update fprochazka-bash-classify
 claude plugin update bash-classify-hook@fprochazka-bash-classify
 ```
 
-Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (WRITE, DANGEROUS, UNKNOWN) still requires confirmation.
+Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN) still requires confirmation.
 
 ## Command database
 
@@ -66,8 +66,9 @@ The classification database includes 120+ command definitions covering common Un
 
 | Level | Description | Examples |
 |---|---|---|
-| `READONLY` | No side effects, safe to auto-approve | `ls`, `cat`, `grep`, `kubectl get` |
-| `WRITE` | Modifies local files or state | `mkdir`, `cp`, `git commit` |
+| `READONLY` | No side effects, auto-approved | `ls`, `cat`, `grep`, `kubectl get` |
+| `LOCAL_EFFECTS` | Modifies local files or state only | `git add`, `git commit`, `cp`, `mkdir`, `pytest` |
+| `EXTERNAL_EFFECTS` | Interacts with external systems | `git push`, `kubectl apply`, `curl -d` |
 | `DANGEROUS` | Destructive, system-wide, or irreversible | `rm -rf`, `git push --force`, `chmod` |
 | `UNKNOWN` | Command not in database | Any unrecognized command |
 

{bash_classify-0.1.4 → bash_classify-0.2.0}/SPEC.md

@@ -93,15 +93,14 @@ $ echo 'find . -name "*.tmp" -exec rm -f {} \;' | bash-classify
       "argv": ["find", ".", "-name", "*.tmp", "-exec", "rm", "-f", "{}", ";"],
       "classification": "DANGEROUS",
       "matched_rule": "find",
-      "overriding_option": "-exec",
       "inner_commands": [
         {
           "delegation_mode": "terminated_argv",
           "delegation_source": "-exec",
           "command": ["rm"],
           "argv": ["rm", "-f"],
-          "classification": "UNKNOWN",
-          "matched_rule": null,
+          "classification": "DANGEROUS",
+          "matched_rule": "rm",
           "inner_commands": []
         }
       ]
@@ -196,7 +195,8 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 | Level | Meaning |
 |---|---|
 | `READONLY` | Only reads data, no side effects |
-| `WRITE` | Creates, modifies, or deletes data in a controlled way |
+| `LOCAL_EFFECTS` | Modifies local files or state only |
+| `EXTERNAL_EFFECTS` | Interacts with external systems or network |
 | `DANGEROUS` | Destructive, hard to reverse, or affects critical systems |
 | `UNKNOWN` | Command or subcommand not in database |
 
@@ -205,10 +205,10 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 The overall `classification` of a full expression is the **maximum severity** across all commands in the expression:
 
 ```
-DANGEROUS > UNKNOWN > WRITE > READONLY
+DANGEROUS > UNKNOWN > EXTERNAL_EFFECTS > LOCAL_EFFECTS > READONLY
 ```
 
-`UNKNOWN` is ranked above `WRITE` because an unrecognized command should not be silently trusted — it must be reviewed.
+`UNKNOWN` is ranked above `EXTERNAL_EFFECTS` because an unrecognized command should not be silently trusted — it must be reviewed.
 
 ## Bash Parsing
 
@@ -237,7 +237,7 @@ The parser walks the CST and extracts a list of `CommandInvocation` objects, eac
 | Subshells `(cmd)` | Inner command extracted recursively |
 | Heredocs `<<EOF` | Content captured but not parsed as commands |
 | Variable assignments `X=1 cmd` | Prefix assignments stripped, `cmd` extracted |
-| Backgrounding `cmd &` | Classified as WRITE (side effect: background process) |
+| Backgrounding `cmd &` | Classified as EXTERNAL_EFFECTS (side effect: background process) |
 
 ### Constructs that force DANGEROUS
 
@@ -352,15 +352,15 @@ subcommands:
       can-i:
         classification: READONLY
       reconcile:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
 
   apply:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --dry-run: {overrides: READONLY}
 
   create:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   delete:
     classification: DANGEROUS
@@ -368,13 +368,13 @@ subcommands:
       --dry-run: {overrides: READONLY}
 
   edit:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   patch:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   scale:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   rollout:
     subcommands:
@@ -383,40 +383,40 @@ subcommands:
       history:
         classification: READONLY
       restart:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       undo:
         classification: DANGEROUS
       pause:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       resume:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
 
   exec:
     classification: DANGEROUS
 
   port-forward:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   cp:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   drain:
     classification: DANGEROUS
 
   cordon:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   uncordon:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   taint:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   label:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   annotate:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   config:
     subcommands:
@@ -427,15 +427,15 @@ subcommands:
       current-context:
         classification: READONLY
       use-context:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       set:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       set-context:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       set-cluster:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       set-credentials:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       delete-context:
         classification: DANGEROUS
       delete-cluster:
@@ -471,34 +471,34 @@ subcommands:
   branch:
     classification: READONLY
     options:
-      -d: {overrides: WRITE}
+      -d: {overrides: EXTERNAL_EFFECTS}
       -D: {overrides: DANGEROUS}
-      --delete: {overrides: WRITE}
-      --move: {overrides: WRITE}
-      --copy: {overrides: WRITE}
-      --edit-description: {overrides: WRITE}
-      --set-upstream-to: {overrides: WRITE, takes_value: true}
-      --unset-upstream: {overrides: WRITE}
+      --delete: {overrides: EXTERNAL_EFFECTS}
+      --move: {overrides: EXTERNAL_EFFECTS}
+      --copy: {overrides: EXTERNAL_EFFECTS}
+      --edit-description: {overrides: EXTERNAL_EFFECTS}
+      --set-upstream-to: {overrides: EXTERNAL_EFFECTS, takes_value: true}
+      --unset-upstream: {overrides: EXTERNAL_EFFECTS}
   remote:
     classification: READONLY
     subcommands:
       add:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       remove:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       rename:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       set-url:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       prune:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
   tag:
     classification: READONLY
     options:
-      -d: {overrides: WRITE}
-      --delete: {overrides: WRITE}
-      -a: {overrides: WRITE}
-      -s: {overrides: WRITE}
+      -d: {overrides: EXTERNAL_EFFECTS}
+      --delete: {overrides: EXTERNAL_EFFECTS}
+      -a: {overrides: EXTERNAL_EFFECTS}
+      -s: {overrides: EXTERNAL_EFFECTS}
   blame:
     classification: READONLY
   shortlog:
@@ -519,49 +519,49 @@ subcommands:
     classification: READONLY
 
   add:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
   commit:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
   merge:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --abort: {overrides: DANGEROUS}
   rebase:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --abort: {overrides: DANGEROUS}
   cherry-pick:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --abort: {overrides: DANGEROUS}
 
   push:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --force: {overrides: DANGEROUS}
       -f: {overrides: DANGEROUS}
-      --force-with-lease: {overrides: WRITE}
+      --force-with-lease: {overrides: EXTERNAL_EFFECTS}
       --delete: {overrides: DANGEROUS}
 
   pull:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   fetch:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
-      --prune: {overrides: WRITE}
+      --prune: {overrides: EXTERNAL_EFFECTS}
 
   checkout:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   switch:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   restore:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   stash:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     subcommands:
       list:
         classification: READONLY
@@ -573,18 +573,18 @@ subcommands:
         classification: DANGEROUS
 
   reset:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --hard: {overrides: DANGEROUS}
 
   revert:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
 
   clean:
     classification: DANGEROUS
 
   rm:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       -r: {overrides: DANGEROUS}
 ```
@@ -598,22 +598,18 @@ strict: false  # find has too many predicates to enumerate
 options:
   -delete: {overrides: DANGEROUS}
   -exec:
-    overrides: DANGEROUS
     delegates_to:
       mode: terminated_argv
       terminator: ";"  # tokens between -exec and \; are the inner command
   -execdir:
-    overrides: DANGEROUS
     delegates_to:
       mode: terminated_argv
       terminator: ";"
   -ok:
-    overrides: WRITE
     delegates_to:
       mode: terminated_argv
       terminator: ";"
   -okdir:
-    overrides: WRITE
     delegates_to:
       mode: terminated_argv
       terminator: ";"
@@ -668,10 +664,10 @@ options:
 
 ```yaml
 command: sudo
-classification: WRITE  # sudo itself elevates privileges
+classification: EXTERNAL_EFFECTS  # sudo itself elevates privileges
 delegates_to:
   mode: rest_are_argv
-  min_classification: WRITE  # inner command is at least WRITE regardless of its own classification
+  min_classification: EXTERNAL_EFFECTS  # inner command is at least EXTERNAL_EFFECTS regardless of its own classification
 options:
   -u: {takes_value: true}
   --user: {takes_value: true, aliases: [-u]}
@@ -749,7 +745,7 @@ The `delegates_to` field defines how a command (or option like `find -exec`) han
 | `terminator` | `string` | For `terminated_argv`: the token that ends the inner argv |
 | `flag` | `string` | For `flag_value_is_expression`: which flag's value to parse |
 | `strip_assignments` | `bool` | For `rest_are_argv`: strip leading `KEY=VALUE` tokens before the inner command |
-| `min_classification` | `enum` | Floor classification for the inner command (e.g. `sudo` forces at least `WRITE`) |
+| `min_classification` | `enum` | Floor classification for the inner command (e.g. `sudo` forces at least `EXTERNAL_EFFECTS`) |
 
 ### Database field reference
 
@@ -781,13 +777,13 @@ Output redirects affect the overall classification:
 
 | Redirect | Effect |
 |---|---|
-| `> file` | Elevates to at least `WRITE` |
-| `>> file` | Elevates to at least `WRITE` |
+| `> file` | Elevates to at least `EXTERNAL_EFFECTS` |
+| `>> file` | Elevates to at least `EXTERNAL_EFFECTS` |
 | `> /dev/null` | No effect (discarding output is not a write) |
-| `2> file` / `2>> file` | Elevates to at least `WRITE` (unless `/dev/null`) |
-| `&> file` | Elevates to at least `WRITE` (unless `/dev/null`) |
+| `2> file` / `2>> file` | Elevates to at least `EXTERNAL_EFFECTS` (unless `/dev/null`) |
+| `&> file` | Elevates to at least `EXTERNAL_EFFECTS` (unless `/dev/null`) |
 | `< file` | No effect (input redirect is reading) |
-| `\| tee file` | `tee` is classified as `WRITE` via its own database entry |
+| `\| tee file` | `tee` is classified as `EXTERNAL_EFFECTS` via its own database entry |
 
 ## Directory Detection
 
@@ -829,13 +825,13 @@ The `commands` list is recursive — any command entry can contain `inner_comman
 ```json
 {
   "expression": "string — the original input",
-  "classification": "READONLY | WRITE | DANGEROUS | UNKNOWN",
+  "classification": "READONLY | LOCAL_EFFECTS | EXTERNAL_EFFECTS | DANGEROUS | UNKNOWN",
   "directories": ["string — detected directories"],
   "commands": [
     {
       "command": ["string — binary + subcommand chain (without inner command tokens)"],
       "argv": ["string — full original argv for this command"],
-      "classification": "READONLY | WRITE | DANGEROUS | UNKNOWN",
+      "classification": "READONLY | LOCAL_EFFECTS | EXTERNAL_EFFECTS | DANGEROUS | UNKNOWN",
       "matched_rule": "string — dotted path in database, or null",
       "ignored_options": ["string — global options that were stripped"],
       "remaining_options": ["string — options that were not in database"],

{bash_classify-0.1.4 → bash_classify-0.2.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Auto-allows readonly bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

{bash_classify-0.1.4 → bash_classify-0.2.0}/coding-agent-plugins/claude-code/hooks/classify-bash.sh

@@ -39,6 +39,6 @@ if [[ "$classification" == "READONLY" ]]; then
   echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
 fi
 
-# For anything else (WRITE, DANGEROUS, UNKNOWN), output nothing
+# For anything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN), output nothing
 # — this lets the normal permission flow handle it
 exit 0

{bash_classify-0.1.4 → bash_classify-0.2.0}/docs/classification-guidance.md

@@ -16,11 +16,17 @@ No side effects. Safe to auto-allow without user confirmation.
 
 Examples: `ls`, `cat`, `grep`, `kubectl get`, `git status`, `git log`, `docker ps`, `terraform plan`, `curl https://example.com`
 
-### WRITE
+### LOCAL_EFFECTS
 
-Creates, modifies, or deletes data in a controlled way. Requires user confirmation.
+Modifies local state only (files, git index, local config). No network or external system interaction. Requires user confirmation.
 
-Examples: `git commit`, `cp`, `touch`, `mkdir`, `kubectl apply`, `docker build`, `git push`, `curl -d '...'`
+Examples: `git add`, `git commit`, `cp`, `touch`, `mkdir`, `sed -i`, `chmod`
+
+### EXTERNAL_EFFECTS
+
+Creates, modifies, or deletes data beyond the local machine, or interacts with external systems. Requires user confirmation.
+
+Examples: `git push`, `kubectl apply`, `docker build`, `curl -d '...'`, `npm publish`
 
 ### DANGEROUS
 
@@ -35,10 +41,10 @@ Command or subcommand not in the database. Treated as requiring confirmation.
 ### Severity Ordering
 
 ```
-DANGEROUS > UNKNOWN > WRITE > READONLY
+DANGEROUS > UNKNOWN > EXTERNAL_EFFECTS > LOCAL_EFFECTS > READONLY
 ```
 
-UNKNOWN is ranked **above WRITE** because an unrecognized command should not be silently trusted -- it must be reviewed. A known WRITE command (like `git commit`) is predictable; an unknown command could do anything.
+UNKNOWN is ranked **above EXTERNAL_EFFECTS** because an unrecognized command should not be silently trusted -- it must be reviewed. A known EXTERNAL_EFFECTS command (like `git push`) is predictable; an unknown command could do anything.
 
 The overall classification of a full expression (e.g. a pipeline) is the **maximum severity** across all commands in the expression.
 
@@ -55,8 +61,8 @@ description: "Stream editor"       # (optional) short one-liner
 classification: READONLY            # (optional, default READONLY) base classification
 strict: false                       # (optional, default true) unrecognized options -> UNKNOWN?
 options:                            # options that affect classification
-  -i: {overrides: WRITE}           # -i changes classification to WRITE
-  --in-place: {overrides: WRITE, aliases: [-i]}
+  -i: {overrides: EXTERNAL_EFFECTS}           # -i changes classification to EXTERNAL_EFFECTS
+  --in-place: {overrides: EXTERNAL_EFFECTS, aliases: [-i]}
   -e: {takes_value: true}          # -e consumes the next token as its value
   --expression: {takes_value: true, aliases: [-e]}
   -f: {takes_value: true}
@@ -101,7 +107,7 @@ Add `# $schema: ../../../schemas/command.schema.json` as the first line of every
 - The command is a pure filter/transformer (`grep`, `awk`, `sed` without `-i`, `jq`, `sort` without `-o`)
 - The command queries a remote system without changing it (`kubectl get`, `curl` without `-d`/`-F`/`-o`, `dig`, `ping`)
 
-### Use WRITE when:
+### Use EXTERNAL_EFFECTS when:
 
 - The command creates or modifies files (`touch`, `cp`, `mv`, `mkdir`, `tee`)
 - The command modifies local state (`git commit`, `git checkout`, `kubectl apply`)
@@ -149,21 +155,21 @@ There are two distinct mechanisms for controlling classification — don't confu
 Each subcommand has its **own** `classification` field. It does not inherit from or override the parent — it simply IS the classification for that subcommand. No special keyword is needed.
 
 ```yaml
-# git.worktree is WRITE, but git.worktree.list is READONLY
+# git.worktree is EXTERNAL_EFFECTS, but git.worktree.list is READONLY
 # No "overrides" keyword — list has its own classification
 subcommands:
   worktree:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     subcommands:
       list:
         classification: READONLY    # independent, not an override
       add:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
       remove:
-        classification: WRITE
+        classification: EXTERNAL_EFFECTS
 ```
 
-The parent's classification (`WRITE`) is used only when **no subcommand matches** — e.g., bare `git worktree` or `git worktree unknown-thing`.
+The parent's classification (`EXTERNAL_EFFECTS`) is used only when **no subcommand matches** — e.g., bare `git worktree` or `git worktree unknown-thing`.
 
 ### Option overrides: replace the matched subcommand's classification
 
@@ -174,15 +180,15 @@ The `overrides` keyword is for **options** (flags) that change the classificatio
 A flag that makes a normally safe command destructive:
 
 ```yaml
-# git push is WRITE, but --force makes it DANGEROUS
+# git push is EXTERNAL_EFFECTS, but --force makes it DANGEROUS
 command: git
 subcommands:
   push:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --force: {overrides: DANGEROUS}
       -f: {overrides: DANGEROUS}
-      --force-with-lease: {overrides: WRITE}   # safer force push stays WRITE
+      --force-with-lease: {overrides: EXTERNAL_EFFECTS}   # safer force push stays EXTERNAL_EFFECTS
 ```
 
 ```yaml
@@ -190,7 +196,7 @@ subcommands:
 command: sed
 classification: READONLY
 options:
-  -i: {overrides: WRITE}
+  -i: {overrides: EXTERNAL_EFFECTS}
 ```
 
 ### Lowering classification
@@ -198,28 +204,28 @@ options:
 A flag that makes a normally writing command safe to auto-allow:
 
 ```yaml
-# kubectl apply is WRITE, but --dry-run only prints what would happen
+# kubectl apply is EXTERNAL_EFFECTS, but --dry-run only prints what would happen
 subcommands:
   apply:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       --dry-run: {takes_value: true, overrides: READONLY}
 ```
 
 ```yaml
-# tar is WRITE (creates/extracts archives), but -t only lists contents
+# tar is EXTERNAL_EFFECTS (creates/extracts archives), but -t only lists contents
 command: tar
-classification: WRITE
+classification: EXTERNAL_EFFECTS
 options:
   -t: {overrides: READONLY}
   --list: {overrides: READONLY, aliases: [-t]}
 ```
 
 ```yaml
-# git branch is WRITE (creates branches), but -l only lists them
+# git branch is EXTERNAL_EFFECTS (creates branches), but -l only lists them
 subcommands:
   branch:
-    classification: WRITE
+    classification: EXTERNAL_EFFECTS
     options:
       -l: {overrides: READONLY}
       --list: {overrides: READONLY, aliases: [-l]}
@@ -251,10 +257,10 @@ options:
 
 ```yaml
 command: sudo
-classification: WRITE
+classification: EXTERNAL_EFFECTS
 delegates_to:
   mode: rest_are_argv
-  min_classification: WRITE   # inner command is at least WRITE
+  min_classification: EXTERNAL_EFFECTS   # inner command is at least EXTERNAL_EFFECTS
 ```
 
 **env:** `env FOO=bar BAZ=1 python script.py` -- strips `FOO=bar BAZ=1`, inner command is `["python", "script.py"]`
@@ -331,7 +337,7 @@ options:
 
 ### `min_classification`
 
-Forces the inner command to be classified at least at the given level. sudo uses this to ensure that even `sudo ls` is at least WRITE -- because running anything under elevated privileges is not a no-op.
+Forces the inner command to be classified at least at the given level. sudo uses this to ensure that even `sudo ls` is at least EXTERNAL_EFFECTS -- because running anything under elevated privileges is not a no-op.
 
 ## 7. Special Cases
 
@@ -339,7 +345,7 @@ Forces the inner command to be classified at least at the given level. sudo uses
 
 Some commands default to a higher classification when used without a recognized subcommand:
 
-- **kubectl** -- base `WRITE` (bare `kubectl` without a known subcommand should not be auto-allowed)
+- **kubectl** -- base `EXTERNAL_EFFECTS` (bare `kubectl` without a known subcommand should not be auto-allowed)
 - **terraform** -- base `DANGEROUS` (unknown terraform subcommands could modify infrastructure)
 - **docker** -- no explicit base classification, so commands like `docker unknown-thing` fall through as UNKNOWN
 
@@ -367,13 +373,13 @@ The first line `# $schema: ../../../schemas/command.schema.json` is a convention
 | Pattern | Example | Classification |
 |---------|---------|---------------|
 | Pure reader | `cat`, `grep`, `ls` | READONLY |
-| Filter with in-place mode | `sed` base, `sed -i` | READONLY / WRITE |
-| File creator/modifier | `cp`, `mv`, `touch` | WRITE |
+| Filter with in-place mode | `sed` base, `sed -i` | READONLY / EXTERNAL_EFFECTS |
+| File creator/modifier | `cp`, `mv`, `touch` | EXTERNAL_EFFECTS |
 | Subcommand-driven | `git`, `kubectl` | Per subcommand |
 | Arbitrary code executor | `python`, `sh`, `eval` | DANGEROUS |
 | Wrapper/delegator | `sudo`, `xargs`, `env` | Delegation-based |
-| Lister with create mode | `git branch`, `git tag` | WRITE base, `-l` overrides to READONLY |
-| Dry-run capable | `make`, `kubectl apply` | WRITE base, `--dry-run` overrides to READONLY |
+| Lister with create mode | `git branch`, `git tag` | EXTERNAL_EFFECTS base, `-l` overrides to READONLY |
+| Dry-run capable | `make`, `kubectl apply` | EXTERNAL_EFFECTS base, `--dry-run` overrides to READONLY |
 | Network tool (read) | `curl`, `ping`, `dig` | READONLY |
-| Network tool (write) | `curl -d`, `wget` | WRITE |
+| Network tool (write) | `curl -d`, `wget` | EXTERNAL_EFFECTS |
 | System admin | `systemctl`, `kill` | DANGEROUS |

{bash_classify-0.1.4 → bash_classify-0.2.0}/schemas/command.schema.json

@@ -41,7 +41,7 @@
   "$defs": {
     "Classification": {
       "type": "string",
-      "enum": ["READONLY", "WRITE", "DANGEROUS", "UNKNOWN"],
+      "enum": ["READONLY", "LOCAL_EFFECTS", "EXTERNAL_EFFECTS", "DANGEROUS", "UNKNOWN"],
       "description": "Classification level for a command or option override"
     },
     "DelegationConfig": {