bash-classify 0.2.4__tar.gz → 0.4.0__tar.gz

{bash_classify-0.2.4 → bash_classify-0.4.0}/.claude-plugin/marketplace.json

@@ -1,14 +1,14 @@
 {
   "name": "fprochazka-bash-classify",
-  "description": "Bash command classifier with Claude Code plugin for auto-allowing readonly commands",
+  "description": "Bash command classifier with Claude Code plugin for auto-allowing low-risk commands",
   "owner": {
     "name": "Filip Procházka"
   },
   "plugins": [
     {
       "name": "bash-classify-hook",
-      "description": "Auto-allows readonly bash commands in Claude Code using bash-classify",
-      "version": "0.2.4",
+      "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
+      "version": "0.4.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.2.4 → bash_classify-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.2.4
+Version: 0.4.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify
@@ -33,9 +33,9 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into five levels: `READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, and `UNKNOWN`.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
-Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow safe, read-only commands while flagging risky ones for human review.
+Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
 ## Installation
 
@@ -63,7 +63,7 @@ $ echo 'find . -name "*.pyc" -delete' | bash-classify | jq '.classification'
 
 ## Claude Code plugin
 
-The repo includes a Claude Code plugin that auto-allows readonly bash commands via a `PreToolUse` hook.
+The repo includes a Claude Code plugin that auto-allows low-risk bash commands via a `PreToolUse` hook.
 
 ```bash
 # Install the bash-classify CLI
@@ -82,7 +82,7 @@ claude plugin marketplace update fprochazka-bash-classify
 claude plugin update bash-classify-hook@fprochazka-bash-classify
 ```
 
-Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN) still requires confirmation.
+Once installed, any Bash tool call with `risk: LOW` is auto-approved — no permission prompt. This includes all `READONLY` commands plus safe routine operations like `git add`, `git commit`, `mkdir`, package installs, code formatters, and more. Commands with `MEDIUM` or `HIGH` risk still require confirmation.
 
 ## Command database
 
@@ -95,12 +95,24 @@ The classification database includes 120+ command definitions covering common Un
 
 | Level | Description | Examples |
 |---|---|---|
-| `READONLY` | No side effects, auto-approved | `ls`, `cat`, `grep`, `kubectl get` |
+| `READONLY` | No side effects | `ls`, `cat`, `grep`, `kubectl get` |
 | `LOCAL_EFFECTS` | Modifies local files or state only | `git add`, `git commit`, `cp`, `mkdir`, `pytest` |
 | `EXTERNAL_EFFECTS` | Interacts with external systems | `git push`, `kubectl apply`, `curl -d` |
 | `DANGEROUS` | Destructive, system-wide, or irreversible | `rm -rf`, `git push --force`, `chmod` |
 | `UNKNOWN` | Command not in database | Any unrecognized command |
 
+## Risk levels
+
+Each command also gets a **risk** rating, orthogonal to classification:
+
+| Risk | Description | Examples |
+|---|---|---|
+| `LOW` | Safe, routine operation — auto-approved | `ls`, `git add`, `git commit`, `mkdir`, `ruff format` |
+| `MEDIUM` | Normal caution warranted | `git push`, `cp`, `npm run`, `git rebase` |
+| `HIGH` | Dangerous or unknown — always requires confirmation | `rm -rf`, `git push --force`, unknown commands |
+
+Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`→MEDIUM, `EXTERNAL_EFFECTS`→MEDIUM, `DANGEROUS`/`UNKNOWN`→HIGH) but can be overridden per command, subcommand, or option in the YAML database.
+
 ## How it works
 
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
@@ -115,6 +127,7 @@ from bash_classify import classify_expression
 
 result = classify_expression("kubectl get pods")
 print(result.classification)  # Classification.READONLY
+print(result.risk)            # Risk.LOW
 ```
 
 See [SPEC.md](SPEC.md) for the full specification.

{bash_classify-0.2.4 → bash_classify-0.4.0}/README.md

@@ -4,9 +4,9 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified into five levels: `READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, and `UNKNOWN`.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
-Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow safe, read-only commands while flagging risky ones for human review.
+Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
 ## Installation
 
@@ -34,7 +34,7 @@ $ echo 'find . -name "*.pyc" -delete' | bash-classify | jq '.classification'
 
 ## Claude Code plugin
 
-The repo includes a Claude Code plugin that auto-allows readonly bash commands via a `PreToolUse` hook.
+The repo includes a Claude Code plugin that auto-allows low-risk bash commands via a `PreToolUse` hook.
 
 ```bash
 # Install the bash-classify CLI
@@ -53,7 +53,7 @@ claude plugin marketplace update fprochazka-bash-classify
 claude plugin update bash-classify-hook@fprochazka-bash-classify
 ```
 
-Once installed, any Bash tool call classified as `READONLY` is auto-approved — no permission prompt. Everything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN) still requires confirmation.
+Once installed, any Bash tool call with `risk: LOW` is auto-approved — no permission prompt. This includes all `READONLY` commands plus safe routine operations like `git add`, `git commit`, `mkdir`, package installs, code formatters, and more. Commands with `MEDIUM` or `HIGH` risk still require confirmation.
 
 ## Command database
 
@@ -66,12 +66,24 @@ The classification database includes 120+ command definitions covering common Un
 
 | Level | Description | Examples |
 |---|---|---|
-| `READONLY` | No side effects, auto-approved | `ls`, `cat`, `grep`, `kubectl get` |
+| `READONLY` | No side effects | `ls`, `cat`, `grep`, `kubectl get` |
 | `LOCAL_EFFECTS` | Modifies local files or state only | `git add`, `git commit`, `cp`, `mkdir`, `pytest` |
 | `EXTERNAL_EFFECTS` | Interacts with external systems | `git push`, `kubectl apply`, `curl -d` |
 | `DANGEROUS` | Destructive, system-wide, or irreversible | `rm -rf`, `git push --force`, `chmod` |
 | `UNKNOWN` | Command not in database | Any unrecognized command |
 
+## Risk levels
+
+Each command also gets a **risk** rating, orthogonal to classification:
+
+| Risk | Description | Examples |
+|---|---|---|
+| `LOW` | Safe, routine operation — auto-approved | `ls`, `git add`, `git commit`, `mkdir`, `ruff format` |
+| `MEDIUM` | Normal caution warranted | `git push`, `cp`, `npm run`, `git rebase` |
+| `HIGH` | Dangerous or unknown — always requires confirmation | `rm -rf`, `git push --force`, unknown commands |
+
+Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`→MEDIUM, `EXTERNAL_EFFECTS`→MEDIUM, `DANGEROUS`/`UNKNOWN`→HIGH) but can be overridden per command, subcommand, or option in the YAML database.
+
 ## How it works
 
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
@@ -86,6 +98,7 @@ from bash_classify import classify_expression
 
 result = classify_expression("kubectl get pods")
 print(result.classification)  # Classification.READONLY
+print(result.risk)            # Risk.LOW
 ```
 
 See [SPEC.md](SPEC.md) for the full specification.

{bash_classify-0.2.4 → bash_classify-0.4.0}/SPEC.md

@@ -200,6 +200,54 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 | `DANGEROUS` | Destructive, hard to reverse, or affects critical systems |
 | `UNKNOWN` | Command or subcommand not in database |
 
+### Risk levels
+
+Each command also receives a risk level, used to distinguish routine operations from high-stakes ones within the same classification tier.
+
+| Level | Meaning |
+|---|---|
+| `LOW` | Safe routine operation, suitable for auto-allowing |
+| `MEDIUM` | Standard operation, may deserve review |
+| `HIGH` | High-stakes or irreversible, always requires confirmation |
+
+#### Default risk by classification
+
+| Classification | Default risk |
+|---|---|
+| `READONLY` | `LOW` |
+| `LOCAL_EFFECTS` | `MEDIUM` |
+| `EXTERNAL_EFFECTS` | `MEDIUM` |
+| `DANGEROUS` | `HIGH` (always, cannot be overridden) |
+| `UNKNOWN` | `HIGH` (always, cannot be overridden) |
+
+`DANGEROUS` and `UNKNOWN` commands are always clamped to `HIGH` regardless of any explicit `risk` field in the YAML definition.
+
+#### Composite risk
+
+The overall `risk` of a full expression is the **maximum** across all commands in the expression:
+
+```
+HIGH > MEDIUM > LOW
+```
+
+#### YAML `risk` field
+
+The optional `risk` field can be set on commands, subcommands, and options in the database YAML. It works the same way as classification:
+
+- **Command/subcommand level:** Sets the base risk for that command or subcommand.
+- **Option level:** When the option is present, overrides the risk to this level (same semantics as classification `overrides`).
+
+When no explicit `risk` is set, the default risk for the resolved classification is used.
+
+#### Security elevations
+
+Certain expression-level patterns elevate risk to at least `HIGH`:
+
+- Writing to system paths (e.g. `/etc`, `/usr`)
+- Redirecting to `/dev/tcp` or `/dev/udp`
+- Backgrounding (`cmd &`)
+- Output redirects to non-`/dev/null` targets
+
 ### Composite classification
 
 The overall `classification` of a full expression is the **maximum severity** across all commands in the expression:
@@ -297,6 +345,48 @@ The database defines which options take values, so the parser knows whether `-n
 
 If the matched subcommand has `strict: true` (default), any unrecognized option makes the command `UNKNOWN`. If `strict: false`, unrecognized options are ignored (useful for commands with too many harmless flags to enumerate).
 
+### Subcommand matching modes
+
+The `subcommand_mode` field controls how positional arguments are matched against the subcommand dictionary. There are two modes:
+
+#### `hierarchical` (default)
+
+The default mode. Subcommands are matched as a greedy chain through nested subcommand dictionaries. Each matched subcommand narrows the context to its own subcommand dict.
+
+Example: `kubectl rollout status` matches `kubectl` → `rollout` → `status`, walking the tree.
+
+#### `match_all`
+
+Each positional argument is matched independently against the **same** top-level subcommand dictionary. This is designed for build tools like Maven and Gradle where multiple goals/tasks appear as positional arguments in any order.
+
+Example: `mvn clean install` matches both `clean` and `install` independently against `mvn`'s subcommand dict.
+
+**Classification/risk aggregation in `match_all` mode:**
+
+- The final classification is the **maximum severity** across all matched goals.
+- The final risk is the **maximum** across all matched goals' risks.
+- If any positional argument is **unrecognized** (not in the subcommand dict), the command's base classification and risk are included in the aggregation.
+- If **no goals match** (no positional args or all unrecognized), the command's base classification and risk apply.
+- Option overrides (e.g. `--dry-run`) take precedence over goal aggregation — they replace the classification as usual.
+- The `strict` mode only applies to **options** (flags starting with `-`), not to unrecognized positional arguments. Unrecognized goals do not cause UNKNOWN classification.
+
+```
+argv: ["mvn", "-B", "clean", "deploy"]
+
+Step 1: binary lookup → found "mvn" in database (subcommand_mode: match_all)
+Step 2: strip global options → none
+Step 3: subcommand matching (match_all mode)
+  - "-B" starts with "-" → passed to option classification
+  - "clean" found in subcommands → LOCAL_EFFECTS, risk LOW
+  - "deploy" found in subcommands → EXTERNAL_EFFECTS, risk MEDIUM (default)
+  - aggregate: classification = EXTERNAL_EFFECTS, risk = MEDIUM
+Step 4: option classification
+  - "-B" is a known option (no override)
+Step 5: classification
+  - aggregate classification: EXTERNAL_EFFECTS
+  - no option overrides → final: EXTERNAL_EFFECTS, risk: MEDIUM
+```
+
 ## Command Database Format
 
 YAML files, one per command or command family. Loaded from a `commands/` directory.
@@ -759,6 +849,7 @@ The `delegates_to` field defines how a command (or option like `find -exec`) han
 | `subcommands` | `map` | Nested subcommand definitions (recursive structure) |
 | `options` | `map` | Options that affect classification of this command/subcommand |
 | `strict` | `bool` | If `true` (default), unrecognized options yield `UNKNOWN` |
+| `subcommand_mode` | `enum` | How subcommands are matched: `hierarchical` (default, chained tree walk) or `match_all` (each positional arg matched independently) |
 | `delegates_to` | `object` | How this command delegates execution to an inner command (see delegation modes) |
 
 #### Option level

{bash_classify-0.2.4 → bash_classify-0.4.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.2.4",
-  "description": "Auto-allows readonly bash commands in Claude Code using bash-classify",
+  "version": "0.4.0",
+  "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"
   },

{bash_classify-0.2.4 → bash_classify-0.4.0}/coding-agent-plugins/claude-code/hooks/classify-bash.sh

@@ -31,14 +31,14 @@ if [[ -z "$classification_output" ]]; then
   exit 0
 fi
 
-# Extract the top-level classification
-classification=$(echo "$classification_output" | jq -r '.classification // empty')
+# Extract the top-level risk
+risk=$(echo "$classification_output" | jq -r '.risk // empty')
 
-if [[ "$classification" == "READONLY" ]]; then
-  # Auto-allow readonly commands
+if [[ "$risk" == "LOW" ]]; then
+  # Auto-allow low-risk commands
   echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}'
 fi
 
-# For anything else (LOCAL_EFFECTS, EXTERNAL_EFFECTS, DANGEROUS, UNKNOWN), output nothing
+# For anything else (MEDIUM, HIGH), output nothing
 # — this lets the normal permission flow handle it
 exit 0

{bash_classify-0.2.4 → bash_classify-0.4.0}/docs/classification-guidance.md

@@ -368,7 +368,92 @@ Commands invoked with a full path (e.g. `/usr/bin/rm`) are resolved to their bas
 
 The first line `# $schema: ../../../schemas/command.schema.json` is a convention for IDE support. It is not parsed by bash-classify itself but provides autocomplete and validation when editing YAML files in editors that support JSON Schema.
 
-## 8. Common Patterns
+## 8. Risk Levels
+
+Each command also has a risk level (`LOW`, `MEDIUM`, `HIGH`) that defaults based on classification. You only need to set `risk` explicitly in YAML when the default does not fit.
+
+### When to set `risk: LOW`
+
+Use for safe routine operations that should be auto-allowed, even though their classification is above READONLY:
+
+```yaml
+# git add only stages files -- safe to auto-allow
+subcommands:
+  add:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+```
+
+Other good candidates: `git fetch`, `mkdir`, `touch`, code formatters like `ruff format`, `prettier`.
+
+### When to leave the default (`MEDIUM`)
+
+The default `MEDIUM` is appropriate for most `LOCAL_EFFECTS` and `EXTERNAL_EFFECTS` commands. If the command does what its classification says and nothing surprising, don't set `risk` at all.
+
+### When to set `risk: HIGH`
+
+Use when a command is more dangerous than its classification default suggests -- e.g. an `EXTERNAL_EFFECTS` command that is particularly destructive or hard to reverse.
+
+### `DANGEROUS` and `UNKNOWN` are always `HIGH`
+
+Commands classified as `DANGEROUS` or `UNKNOWN` are automatically clamped to `HIGH` risk regardless of any explicit `risk` field. You never need to set `risk` on these.
+
+### Risk on options
+
+Options can override risk the same way they override classification:
+
+```yaml
+subcommands:
+  apply:
+    classification: EXTERNAL_EFFECTS
+    options:
+      --dry-run: {takes_value: true, overrides: READONLY, risk: LOW}
+```
+
+## 9. Subcommand Matching Modes
+
+### `subcommand_mode: hierarchical` (default)
+
+The default mode. Subcommands form a tree, and matching walks the tree greedily. This is correct for most CLI tools where subcommands are hierarchical (e.g. `kubectl rollout status`, `git stash list`).
+
+### `subcommand_mode: match_all`
+
+Use for build tools that accept multiple goals or tasks as positional arguments in any order. Each positional argument is matched independently against the same subcommand dictionary.
+
+```yaml
+# Maven accepts multiple lifecycle phases: mvn clean install
+command: mvn
+classification: LOCAL_EFFECTS
+strict: false
+subcommand_mode: match_all
+subcommands:
+  clean:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+  compile:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+  install:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+  deploy:
+    classification: EXTERNAL_EFFECTS
+```
+
+**When to use `match_all`:**
+
+- Build tools that accept multiple goals/tasks (Maven, Gradle)
+- Commands where positional args are independent operations, not hierarchical nesting
+
+**How classification works:**
+
+- The final classification is the maximum severity across all matched goals
+- `mvn clean install` → both LOCAL_EFFECTS → final: LOCAL_EFFECTS
+- `mvn clean deploy` → LOCAL_EFFECTS + EXTERNAL_EFFECTS → final: EXTERNAL_EFFECTS
+- Unrecognized goals (e.g. custom Maven plugin goals like `some-plugin:goal`) fall back to the command's base classification and risk
+- Option overrides (e.g. `--dry-run`) still take precedence over goal aggregation
+
+## 10. Common Patterns
 
 | Pattern | Example | Classification |
 |---------|---------|---------------|

{bash_classify-0.2.4 → bash_classify-0.4.0}/schemas/command.schema.json

@@ -18,6 +18,10 @@
     "classification": {
       "$ref": "#/$defs/Classification"
     },
+    "risk": {
+      "$ref": "#/$defs/Risk",
+      "description": "Explicit risk level override for this command (default derived from classification)"
+    },
     "strict": {
       "type": "boolean",
       "description": "If true (default), unrecognized options yield UNKNOWN"
@@ -34,6 +38,9 @@
       "$ref": "#/$defs/SubcommandsMap",
       "description": "Nested subcommand definitions"
     },
+    "subcommand_mode": {
+      "$ref": "#/$defs/SubcommandMode"
+    },
     "delegates_to": {
       "$ref": "#/$defs/DelegationConfig"
     }
@@ -44,6 +51,16 @@
       "enum": ["READONLY", "LOCAL_EFFECTS", "EXTERNAL_EFFECTS", "DANGEROUS", "UNKNOWN"],
       "description": "Classification level for a command or option override"
     },
+    "Risk": {
+      "type": "string",
+      "enum": ["LOW", "MEDIUM", "HIGH"],
+      "description": "Risk level for a command or option override"
+    },
+    "SubcommandMode": {
+      "type": "string",
+      "enum": ["hierarchical", "match_all"],
+      "description": "How subcommands are matched: hierarchical (chained tree walk, default) or match_all (each positional arg matched independently)"
+    },
     "DelegationConfig": {
       "type": "object",
       "required": ["mode"],
@@ -95,6 +112,10 @@
           "$ref": "#/$defs/Classification",
           "description": "When this option is present, override the classification to this level"
         },
+        "risk": {
+          "$ref": "#/$defs/Risk",
+          "description": "When this option is present, override the risk level"
+        },
         "captures_directory": {
           "type": "boolean",
           "description": "The value of this option is a working directory"
@@ -118,10 +139,17 @@
         "classification": {
           "$ref": "#/$defs/Classification"
         },
+        "risk": {
+          "$ref": "#/$defs/Risk",
+          "description": "Explicit risk level override for this subcommand (default derived from classification)"
+        },
         "strict": {
           "type": "boolean",
           "description": "If true (default), unrecognized options yield UNKNOWN"
         },
+        "subcommand_mode": {
+          "$ref": "#/$defs/SubcommandMode"
+        },
         "options": {
           "$ref": "#/$defs/OptionsMap"
         },

{bash_classify-0.2.4 → bash_classify-0.4.0}/src/bash_classify/__init__.py

@@ -2,13 +2,14 @@
 
 from bash_classify.classifier import classify_expression
 from bash_classify.database import CommandDatabase, load_database
-from bash_classify.models import Classification, CommandResult, ExpressionResult
+from bash_classify.models import Classification, CommandResult, ExpressionResult, Risk
 
 __all__ = [
     "classify_expression",
     "load_database",
     "CommandDatabase",
     "Classification",
+    "Risk",
     "ExpressionResult",
     "CommandResult",
 ]

{bash_classify-0.2.4 → bash_classify-0.4.0}/src/bash_classify/classifier.py

@@ -14,6 +14,7 @@ from .models import (
     ExpressionResult,
     InnerCommandResult,
     Redirect,
+    Risk,
 )
 from .parser import parse_expression
 
@@ -94,6 +95,7 @@ def classify_expression(
                 command=[invocation.argv[0]],
                 argv=list(invocation.argv),
                 classification=Classification.DANGEROUS,
+                risk=Risk.HIGH,
                 matched_rule=None,
                 inner_commands=[],
                 classification_reason="variable expansion in command position",
@@ -112,12 +114,15 @@ def classify_expression(
                         if result.classification_reason
                         else "elevated by output redirect"
                     )
+                # Elevate risk to at least MEDIUM for output redirects
+                result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
             # /dev/tcp and /dev/udp redirects are network access -> DANGEROUS
             if redirect.target.startswith("/dev/tcp/") or redirect.target.startswith("/dev/udp/"):
                 elevated = Classification.max_severity(result.classification, Classification.DANGEROUS)
                 if elevated != result.classification:
                     result.classification = elevated
                     result.classification_reason = "elevated to DANGEROUS: /dev/tcp or /dev/udp access detected"
+                result.risk = Risk.HIGH
 
         # Step 4b: Check for /dev/tcp and /dev/udp in command arguments
         for arg in invocation.argv:
@@ -126,6 +131,7 @@ def classify_expression(
                 if elevated != result.classification:
                     result.classification = elevated
                     result.classification_reason = "elevated to DANGEROUS: /dev/tcp or /dev/udp access detected"
+                result.risk = Risk.HIGH
 
         # Step 5: Apply backgrounding
         if invocation.is_background:
@@ -137,6 +143,8 @@ def classify_expression(
                     if result.classification_reason
                     else "elevated by backgrounding"
                 )
+            # Elevate risk to at least MEDIUM for backgrounding
+            result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
 
         # Step 6: Elevate to DANGEROUS when writing to system directories
         if result.classification.severity() >= Classification.LOCAL_EFFECTS.severity():
@@ -155,6 +163,7 @@ def classify_expression(
                 result.classification_reason = (
                     result.classification_reason or ""
                 ) + f"; elevated to DANGEROUS: system path {system_paths_found[0]}"
+                result.risk = Risk.HIGH
 
         command_results.append(result)
         all_redirects.extend(invocation.redirects)
@@ -162,17 +171,21 @@ def classify_expression(
     # Step 7: Collect directories
     directories = _collect_directories(command_results)
 
-    # Step 8: Compute composite classification
+    # Step 8: Compute composite classification and risk
     if not command_results and parse_warnings:
         overall = Classification.UNKNOWN
+        overall_risk = Risk.HIGH
     elif command_results:
         overall = Classification.max_severity(*(r.classification for r in command_results))
+        overall_risk = Risk.max_severity(*(r.risk for r in command_results))
     else:
         overall = Classification.READONLY  # empty input
+        overall_risk = Risk.LOW
 
     return ExpressionResult(
         expression=expression,
         classification=overall,
+        risk=overall_risk,
         directories=directories,
         commands=command_results,
         redirects=all_redirects,

{bash_classify-0.2.4 → bash_classify-0.4.0}/src/bash_classify/cli.py

@@ -22,6 +22,7 @@ def _inner_command_to_dict(result: InnerCommandResult) -> dict:
         "command": result.command,
         "argv": result.argv,
         "classification": result.classification.value,
+        "risk": result.risk.value,
         "matched_rule": result.matched_rule,
     }
 
@@ -43,6 +44,7 @@ def _command_to_dict(result: CommandResult) -> dict:
         "command": result.command,
         "argv": result.argv,
         "classification": result.classification.value,
+        "risk": result.risk.value,
         "matched_rule": result.matched_rule,
     }
 
@@ -74,6 +76,7 @@ def _result_to_dict(result: ExpressionResult) -> dict:
     d: dict = {
         "expression": result.expression,
         "classification": result.classification.value,
+        "risk": result.risk.value,
         "directories": result.directories,
         "commands": [_command_to_dict(cmd) for cmd in result.commands],
     }

bash_classify-0.4.0/src/bash_classify/commands/agent-browser.yaml

@@ -0,0 +1,9 @@
+# $schema: ../../../schemas/command.schema.json
+command: agent-browser
+description: "Fast browser automation CLI for AI agents"
+classification: EXTERNAL_EFFECTS
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  --version: {overrides: READONLY}
+  -V: {overrides: READONLY}

{bash_classify-0.2.4 → bash_classify-0.4.0}/src/bash_classify/commands/black.yaml

@@ -2,6 +2,7 @@
 command: black
 description: "Python code formatter"
 classification: LOCAL_EFFECTS
+risk: LOW
 strict: false
 global_options:
   --help: {overrides: READONLY}

{bash_classify-0.2.4 → bash_classify-0.4.0}/src/bash_classify/commands/brew.yaml

@@ -13,14 +13,18 @@ subcommands:
     classification: READONLY
   install:
     classification: LOCAL_EFFECTS
+    risk: LOW
   uninstall:
     classification: LOCAL_EFFECTS
+    risk: LOW
   update:
     classification: LOCAL_EFFECTS
+    risk: LOW
   upgrade:
     classification: LOCAL_EFFECTS
   cleanup:
     classification: LOCAL_EFFECTS
+    risk: LOW
   doctor:
     classification: READONLY
   config: