bash-classify 0.2.3__tar.gz → 0.3.0__tar.gz

{bash_classify-0.2.3 → bash_classify-0.3.0}/.claude-plugin/marketplace.json

@@ -1,14 +1,14 @@
 {
   "name": "fprochazka-bash-classify",
-  "description": "Bash command classifier with Claude Code plugin for auto-allowing readonly commands",
+  "description": "Bash command classifier with Claude Code plugin for auto-allowing low-risk commands",
   "owner": {
     "name": "Filip Procházka"
   },
   "plugins": [
     {
       "name": "bash-classify-hook",
-      "description": "Auto-allows readonly bash commands in Claude Code using bash-classify",
-      "version": "0.2.3",
+      "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
+      "version": "0.3.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.2.3 → bash_classify-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.2.3
+Version: 0.3.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify
@@ -33,9 +33,9 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into five levels: `READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, and `UNKNOWN`.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
-Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow safe, read-only commands while flagging risky ones for human review.
+Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
 ## Installation
 
@@ -63,7 +63,7 @@ $ echo 'find . -name "*.pyc" -delete' | bash-classify | jq '.classification'
 
 ## Claude Code plugin
 
-The repo includes a Claude Code plugin that auto-allows readonly bash commands via a `PreToolUse` hook.
+The repo includes a Claude Code plugin that auto-allows low-risk bash commands via a `PreToolUse` hook.
 
 ```bash
 # Install the bash-classify CLI
@@ -82,7 +82,7 @@ claude plugin marketplace update fprochazka-bash-classify
 claude plugin update bash-classify-hook@fprochazka-bash-classify
 ```
 
-Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN) still requires confirmation.
+Once installed, any Bash tool call with `risk: LOW` is auto-approved — no permission prompt. This includes all `READONLY` commands plus safe routine operations like `git add`, `git commit`, `mkdir`, package installs, code formatters, and more. Commands with `MEDIUM` or `HIGH` risk still require confirmation.
 
 ## Command database
 
@@ -95,12 +95,24 @@ The classification database includes 120+ command definitions covering common Un
 
 | Level | Description | Examples |
 |---|---|---|
-| `READONLY` | No side effects, auto-approved | `ls`, `cat`, `grep`, `kubectl get` |
+| `READONLY` | No side effects | `ls`, `cat`, `grep`, `kubectl get` |
 | `LOCAL_EFFECTS` | Modifies local files or state only | `git add`, `git commit`, `cp`, `mkdir`, `pytest` |
 | `EXTERNAL_EFFECTS` | Interacts with external systems | `git push`, `kubectl apply`, `curl -d` |
 | `DANGEROUS` | Destructive, system-wide, or irreversible | `rm -rf`, `git push --force`, `chmod` |
 | `UNKNOWN` | Command not in database | Any unrecognized command |
 
+## Risk levels
+
+Each command also gets a **risk** rating, orthogonal to classification:
+
+| Risk | Description | Examples |
+|---|---|---|
+| `LOW` | Safe, routine operation — auto-approved | `ls`, `git add`, `git commit`, `mkdir`, `ruff format` |
+| `MEDIUM` | Normal caution warranted | `git push`, `cp`, `npm run`, `git rebase` |
+| `HIGH` | Dangerous or unknown — always requires confirmation | `rm -rf`, `git push --force`, unknown commands |
+
+Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`→MEDIUM, `EXTERNAL_EFFECTS`→MEDIUM, `DANGEROUS`/`UNKNOWN`→HIGH) but can be overridden per command, subcommand, or option in the YAML database.
+
 ## How it works
 
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
@@ -115,6 +127,7 @@ from bash_classify import classify_expression
 
 result = classify_expression("kubectl get pods")
 print(result.classification)  # Classification.READONLY
+print(result.risk)            # Risk.LOW
 ```
 
 See [SPEC.md](SPEC.md) for the full specification.

{bash_classify-0.2.3 → bash_classify-0.3.0}/README.md

@@ -4,9 +4,9 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into five levels: `READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, and `UNKNOWN`.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
-Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow safe, read-only commands while flagging risky ones for human review.
+Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
 ## Installation
 
@@ -34,7 +34,7 @@ $ echo 'find . -name "*.pyc" -delete' | bash-classify | jq '.classification'
 
 ## Claude Code plugin
 
-The repo includes a Claude Code plugin that auto-allows readonly bash commands via a `PreToolUse` hook.
+The repo includes a Claude Code plugin that auto-allows low-risk bash commands via a `PreToolUse` hook.
 
 ```bash
 # Install the bash-classify CLI
@@ -53,7 +53,7 @@ claude plugin marketplace update fprochazka-bash-classify
 claude plugin update bash-classify-hook@fprochazka-bash-classify
 ```
 
-Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN) still requires confirmation.
+Once installed, any Bash tool call with `risk: LOW` is auto-approved — no permission prompt. This includes all `READONLY` commands plus safe routine operations like `git add`, `git commit`, `mkdir`, package installs, code formatters, and more. Commands with `MEDIUM` or `HIGH` risk still require confirmation.
 
 ## Command database
 
@@ -66,12 +66,24 @@ The classification database includes 120+ command definitions covering common Un
 
 | Level | Description | Examples |
 |---|---|---|
-| `READONLY` | No side effects, auto-approved | `ls`, `cat`, `grep`, `kubectl get` |
+| `READONLY` | No side effects | `ls`, `cat`, `grep`, `kubectl get` |
 | `LOCAL_EFFECTS` | Modifies local files or state only | `git add`, `git commit`, `cp`, `mkdir`, `pytest` |
 | `EXTERNAL_EFFECTS` | Interacts with external systems | `git push`, `kubectl apply`, `curl -d` |
 | `DANGEROUS` | Destructive, system-wide, or irreversible | `rm -rf`, `git push --force`, `chmod` |
 | `UNKNOWN` | Command not in database | Any unrecognized command |
 
+## Risk levels
+
+Each command also gets a **risk** rating, orthogonal to classification:
+
+| Risk | Description | Examples |
+|---|---|---|
+| `LOW` | Safe, routine operation — auto-approved | `ls`, `git add`, `git commit`, `mkdir`, `ruff format` |
+| `MEDIUM` | Normal caution warranted | `git push`, `cp`, `npm run`, `git rebase` |
+| `HIGH` | Dangerous or unknown — always requires confirmation | `rm -rf`, `git push --force`, unknown commands |
+
+Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`→MEDIUM, `EXTERNAL_EFFECTS`→MEDIUM, `DANGEROUS`/`UNKNOWN`→HIGH) but can be overridden per command, subcommand, or option in the YAML database.
+
 ## How it works
 
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
@@ -86,6 +98,7 @@ from bash_classify import classify_expression
 
 result = classify_expression("kubectl get pods")
 print(result.classification)  # Classification.READONLY
+print(result.risk)            # Risk.LOW
 ```
 
 See [SPEC.md](SPEC.md) for the full specification.

{bash_classify-0.2.3 → bash_classify-0.3.0}/SPEC.md

@@ -200,6 +200,54 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 | `DANGEROUS` | Destructive, hard to reverse, or affects critical systems |
 | `UNKNOWN` | Command or subcommand not in database |
 
+### Risk levels
+
+Each command also receives a risk level, used to distinguish routine operations from high-stakes ones within the same classification tier.
+
+| Level | Meaning |
+|---|---|
+| `LOW` | Safe routine operation, suitable for auto-allowing |
+| `MEDIUM` | Standard operation, may deserve review |
+| `HIGH` | High-stakes or irreversible, always requires confirmation |
+
+#### Default risk by classification
+
+| Classification | Default risk |
+|---|---|
+| `READONLY` | `LOW` |
+| `LOCAL_EFFECTS` | `MEDIUM` |
+| `EXTERNAL_EFFECTS` | `MEDIUM` |
+| `DANGEROUS` | `HIGH` (always, cannot be overridden) |
+| `UNKNOWN` | `HIGH` (always, cannot be overridden) |
+
+`DANGEROUS` and `UNKNOWN` commands are always clamped to `HIGH` regardless of any explicit `risk` field in the YAML definition.
+
+#### Composite risk
+
+The overall `risk` of a full expression is the **maximum** across all commands in the expression:
+
+```
+HIGH > MEDIUM > LOW
+```
+
+#### YAML `risk` field
+
+The optional `risk` field can be set on commands, subcommands, and options in the database YAML. It works the same way as classification:
+
+- **Command/subcommand level:** Sets the base risk for that command or subcommand.
+- **Option level:** When the option is present, overrides the risk to this level (same semantics as classification `overrides`).
+
+When no explicit `risk` is set, the default risk for the resolved classification is used.
+
+#### Security elevations
+
+Certain expression-level patterns elevate risk to at least `HIGH`:
+
+- Writing to system paths (e.g. `/etc`, `/usr`)
+- Redirecting to `/dev/tcp` or `/dev/udp`
+- Backgrounding (`cmd &`)
+- Output redirects to non-`/dev/null` targets
+
 ### Composite classification
 
 The overall `classification` of a full expression is the **maximum severity** across all commands in the expression:

{bash_classify-0.2.3 → bash_classify-0.3.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.2.3",
-  "description": "Auto-allows readonly bash commands in Claude Code using bash-classify",
+  "version": "0.3.0",
+  "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"
   },

{bash_classify-0.2.3 → bash_classify-0.3.0}/coding-agent-plugins/claude-code/hooks/classify-bash.sh

@@ -31,14 +31,14 @@ if [[ -z "$classification_output" ]]; then
   exit 0
 fi
 
-# Extract the top-level classification
-classification=$(echo "$classification_output" | jq -r '.classification // empty')
+# Extract the top-level risk
+risk=$(echo "$classification_output" | jq -r '.risk // empty')
 
-if [[ "$classification" == "READONLY" ]]; then
-  # Auto-allow readonly commands
+if [[ "$risk" == "LOW" ]]; then
+  # Auto-allow low-risk commands
   echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
 fi
 
-# For anything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN), output nothing
+# For anything else (MEDIUM, HIGH), output nothing
 # — this lets the normal permission flow handle it
 exit 0

{bash_classify-0.2.3 → bash_classify-0.3.0}/docs/classification-guidance.md

@@ -368,7 +368,49 @@ Commands invoked with a full path (e.g. `/usr/bin/rm`) are resolved to their bas
 
 The first line `# $schema: ../../../schemas/command.schema.json` is a convention for IDE support. It is not parsed by bash-classify itself but provides autocomplete and validation when editing YAML files in editors that support JSON Schema.
 
-## 8. Common Patterns
+## 8. Risk Levels
+
+Each command also has a risk level (`LOW`, `MEDIUM`, `HIGH`) that defaults based on classification. You only need to set `risk` explicitly in YAML when the default does not fit.
+
+### When to set `risk: LOW`
+
+Use for safe routine operations that should be auto-allowed, even though their classification is above READONLY:
+
+```yaml
+# git add only stages files -- safe to auto-allow
+subcommands:
+  add:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+```
+
+Other good candidates: `git fetch`, `mkdir`, `touch`, code formatters like `ruff format`, `prettier`.
+
+### When to leave the default (`MEDIUM`)
+
+The default `MEDIUM` is appropriate for most `LOCAL_EFFECTS` and `EXTERNAL_EFFECTS` commands. If the command does what its classification says and nothing surprising, don't set `risk` at all.
+
+### When to set `risk: HIGH`
+
+Use when a command is more dangerous than its classification default suggests -- e.g. an `EXTERNAL_EFFECTS` command that is particularly destructive or hard to reverse.
+
+### `DANGEROUS` and `UNKNOWN` are always `HIGH`
+
+Commands classified as `DANGEROUS` or `UNKNOWN` are automatically clamped to `HIGH` risk regardless of any explicit `risk` field. You never need to set `risk` on these.
+
+### Risk on options
+
+Options can override risk the same way they override classification:
+
+```yaml
+subcommands:
+  apply:
+    classification: EXTERNAL_EFFECTS
+    options:
+      --dry-run: {takes_value: true, overrides: READONLY, risk: LOW}
+```
+
+## 9. Common Patterns
 
 | Pattern | Example | Classification |
 |---------|---------|---------------|

{bash_classify-0.2.3 → bash_classify-0.3.0}/schemas/command.schema.json

@@ -18,6 +18,10 @@
     "classification": {
       "$ref": "#/$defs/Classification"
     },
+    "risk": {
+      "$ref": "#/$defs/Risk",
+      "description": "Explicit risk level override for this command (default derived from classification)"
+    },
     "strict": {
       "type": "boolean",
       "description": "If true (default), unrecognized options yield UNKNOWN"
@@ -44,6 +48,11 @@
       "enum": ["READONLY", "LOCAL_EFFECTS", "EXTERNAL_EFFECTS", "DANGEROUS", "UNKNOWN"],
       "description": "Classification level for a command or option override"
     },
+    "Risk": {
+      "type": "string",
+      "enum": ["LOW", "MEDIUM", "HIGH"],
+      "description": "Risk level for a command or option override"
+    },
     "DelegationConfig": {
       "type": "object",
       "required": ["mode"],
@@ -95,6 +104,10 @@
           "$ref": "#/$defs/Classification",
           "description": "When this option is present, override the classification to this level"
         },
+        "risk": {
+          "$ref": "#/$defs/Risk",
+          "description": "When this option is present, override the risk level"
+        },
         "captures_directory": {
           "type": "boolean",
           "description": "The value of this option is a working directory"
@@ -118,6 +131,10 @@
         "classification": {
           "$ref": "#/$defs/Classification"
         },
+        "risk": {
+          "$ref": "#/$defs/Risk",
+          "description": "Explicit risk level override for this subcommand (default derived from classification)"
+        },
         "strict": {
           "type": "boolean",
           "description": "If true (default), unrecognized options yield UNKNOWN"

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/__init__.py

@@ -2,13 +2,14 @@
 
 from bash_classify.classifier import classify_expression
 from bash_classify.database import CommandDatabase, load_database
-from bash_classify.models import Classification, CommandResult, ExpressionResult
+from bash_classify.models import Classification, CommandResult, ExpressionResult, Risk
 
 __all__ = [
     "classify_expression",
     "load_database",
     "CommandDatabase",
     "Classification",
+    "Risk",
     "ExpressionResult",
     "CommandResult",
 ]

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/classifier.py

@@ -14,6 +14,7 @@ from .models import (
     ExpressionResult,
     InnerCommandResult,
     Redirect,
+    Risk,
 )
 from .parser import parse_expression
 
@@ -94,6 +95,7 @@ def classify_expression(
                 command=[invocation.argv[0]],
                 argv=list(invocation.argv),
                 classification=Classification.DANGEROUS,
+                risk=Risk.HIGH,
                 matched_rule=None,
                 inner_commands=[],
                 classification_reason="variable expansion in command position",
@@ -112,12 +114,15 @@ def classify_expression(
                         if result.classification_reason
                         else "elevated by output redirect"
                     )
+                # Elevate risk to at least MEDIUM for output redirects
+                result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
             # /dev/tcp and /dev/udp redirects are network access -> DANGEROUS
             if redirect.target.startswith("/dev/tcp/") or redirect.target.startswith("/dev/udp/"):
                 elevated = Classification.max_severity(result.classification, Classification.DANGEROUS)
                 if elevated != result.classification:
                     result.classification = elevated
                     result.classification_reason = "elevated to DANGEROUS: /dev/tcp or /dev/udp access detected"
+                result.risk = Risk.HIGH
 
         # Step 4b: Check for /dev/tcp and /dev/udp in command arguments
         for arg in invocation.argv:
@@ -126,6 +131,7 @@ def classify_expression(
                 if elevated != result.classification:
                     result.classification = elevated
                     result.classification_reason = "elevated to DANGEROUS: /dev/tcp or /dev/udp access detected"
+                result.risk = Risk.HIGH
 
         # Step 5: Apply backgrounding
         if invocation.is_background:
@@ -137,6 +143,8 @@ def classify_expression(
                     if result.classification_reason
                     else "elevated by backgrounding"
                 )
+            # Elevate risk to at least MEDIUM for backgrounding
+            result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
 
         # Step 6: Elevate to DANGEROUS when writing to system directories
         if result.classification.severity() >= Classification.LOCAL_EFFECTS.severity():
@@ -155,6 +163,7 @@ def classify_expression(
                 result.classification_reason = (
                     result.classification_reason or ""
                 ) + f"; elevated to DANGEROUS: system path {system_paths_found[0]}"
+                result.risk = Risk.HIGH
 
         command_results.append(result)
         all_redirects.extend(invocation.redirects)
@@ -162,17 +171,21 @@ def classify_expression(
     # Step 7: Collect directories
     directories = _collect_directories(command_results)
 
-    # Step 8: Compute composite classification
+    # Step 8: Compute composite classification and risk
     if not command_results and parse_warnings:
         overall = Classification.UNKNOWN
+        overall_risk = Risk.HIGH
     elif command_results:
         overall = Classification.max_severity(*(r.classification for r in command_results))
+        overall_risk = Risk.max_severity(*(r.risk for r in command_results))
     else:
         overall = Classification.READONLY  # empty input
+        overall_risk = Risk.LOW
 
     return ExpressionResult(
         expression=expression,
         classification=overall,
+        risk=overall_risk,
         directories=directories,
         commands=command_results,
         redirects=all_redirects,

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/cli.py

@@ -22,6 +22,7 @@ def _inner_command_to_dict(result: InnerCommandResult) -> dict:
         "command": result.command,
         "argv": result.argv,
         "classification": result.classification.value,
+        "risk": result.risk.value,
         "matched_rule": result.matched_rule,
     }
 
@@ -43,6 +44,7 @@ def _command_to_dict(result: CommandResult) -> dict:
         "command": result.command,
         "argv": result.argv,
         "classification": result.classification.value,
+        "risk": result.risk.value,
         "matched_rule": result.matched_rule,
     }
 
@@ -74,6 +76,7 @@ def _result_to_dict(result: ExpressionResult) -> dict:
     d: dict = {
         "expression": result.expression,
         "classification": result.classification.value,
+        "risk": result.risk.value,
         "directories": result.directories,
         "commands": [_command_to_dict(cmd) for cmd in result.commands],
     }

bash_classify-0.3.0/src/bash_classify/commands/agent-browser.yaml

@@ -0,0 +1,9 @@
+# $schema: ../../../schemas/command.schema.json
+command: agent-browser
+description: "Fast browser automation CLI for AI agents"
+classification: EXTERNAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  --version: {overrides: READONLY}
+  -V: {overrides: READONLY}

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/commands/black.yaml

@@ -2,6 +2,7 @@
 command: black
 description: "Python code formatter"
 classification: LOCAL_EFFECTS
+risk: LOW
 strict: false
 global_options:
   --help: {overrides: READONLY}

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/commands/brew.yaml

@@ -13,14 +13,18 @@ subcommands:
     classification: READONLY
   install:
     classification: LOCAL_EFFECTS
+    risk: LOW
   uninstall:
     classification: LOCAL_EFFECTS
+    risk: LOW
   update:
     classification: LOCAL_EFFECTS
+    risk: LOW
   upgrade:
     classification: LOCAL_EFFECTS
   cleanup:
     classification: LOCAL_EFFECTS
+    risk: LOW
   doctor:
     classification: READONLY
   config:

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/commands/cargo.yaml

@@ -7,8 +7,10 @@ global_options:
 subcommands:
   build:
     classification: LOCAL_EFFECTS
+    risk: LOW
   test:
     classification: LOCAL_EFFECTS
+    risk: LOW
   run:
     classification: DANGEROUS
   check:
@@ -19,18 +21,23 @@ subcommands:
       --fix: {overrides: LOCAL_EFFECTS}
   fmt:
     classification: LOCAL_EFFECTS
+    risk: LOW
   doc:
     classification: LOCAL_EFFECTS
+    risk: LOW
   publish:
     classification: DANGEROUS
   install:
     classification: LOCAL_EFFECTS
+    risk: LOW
     options:
       --list: {overrides: READONLY}
   clean:
     classification: LOCAL_EFFECTS
+    risk: LOW
   update:
     classification: LOCAL_EFFECTS
+    risk: LOW
   search:
     classification: READONLY
   tree:
@@ -41,15 +48,22 @@ subcommands:
     classification: READONLY
   bench:
     classification: LOCAL_EFFECTS
+    risk: LOW
   init:
     classification: LOCAL_EFFECTS
+    risk: LOW
   new:
     classification: LOCAL_EFFECTS
+    risk: LOW
   fix:
     classification: LOCAL_EFFECTS
+    risk: LOW
   add:
     classification: LOCAL_EFFECTS
+    risk: LOW
   remove:
     classification: LOCAL_EFFECTS
+    risk: LOW
   generate-lockfile:
     classification: LOCAL_EFFECTS
+    risk: LOW

{bash_classify-0.2.3 → bash_classify-0.3.0}/src/bash_classify/commands/docker.yaml

@@ -60,9 +60,11 @@ subcommands:
     strict: false
   build:
     classification: LOCAL_EFFECTS
+    risk: LOW
     strict: false
   pull:
     classification: LOCAL_EFFECTS
+    risk: LOW
     strict: false
   push:
     classification: EXTERNAL_EFFECTS
@@ -114,9 +116,11 @@ subcommands:
         strict: false
       build:
         classification: LOCAL_EFFECTS
+        risk: LOW
         strict: false
       pull:
         classification: LOCAL_EFFECTS
+        risk: LOW
       push:
         classification: EXTERNAL_EFFECTS
       exec: