bash-classify 0.4.2__tar.gz → 0.6.0__tar.gz

{bash_classify-0.4.2 → bash_classify-0.6.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.4.2",
+      "version": "0.6.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.4.2 → bash_classify-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.4.2
+Version: 0.6.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify
@@ -33,7 +33,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 150+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
@@ -86,10 +86,12 @@ Once installed, any Bash tool call with `risk: LOW` is auto-approved — no perm
 
 ## Command database
 
-The classification database includes 120+ command definitions covering common Unix utilities, package managers, container tools, cloud CLIs, and more.
+bash-classify loads command definitions from two locations:
 
-- See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands
-- YAML definitions are validated against a JSON Schema for IDE autocomplete and CI checks
+- **Built-in database** — 150+ command definitions bundled with the package, covering common Unix utilities, package managers, container tools, cloud CLIs, and more. Lives in `src/bash_classify/commands/*.yaml`.
+- **User database** — your own command definitions at `~/.config/bash-classify/commands/*.yaml` (override the location with the `BASH_CLASSIFY_CONFIG_DIR` env var, which resolves to `$BASH_CLASSIFY_CONFIG_DIR/commands/`). User files with the same name as a built-in override it completely, so you can customize classifications for internal tools, company-specific wrappers, or personal CLIs without forking the repo.
+
+Both directories use the same YAML format. See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands. YAML definitions are validated against a [JSON Schema](schemas/command.schema.json) for IDE autocomplete and CI checks.
 
 ## Classification levels
 
@@ -118,7 +120,9 @@ Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
 - **YAML command database** -- each command has classification rules with subcommand and option matching
 - **Subcommand matching** -- `kubectl get` and `kubectl delete` can have different classifications
+- **Multi-goal build tools** -- `subcommand_mode: match_all` handles commands like `mvn clean install` and `gradle clean build test` where multiple goals can be combined in any order
 - **Delegation for wrappers** -- commands like `xargs`, `sudo`, and `env` delegate classification to the inner command
+- **File path detection** -- redirect operators (`>`, `>>`, `<`) are parsed into `write_paths`/`read_paths` in the output; writes to `/tmp` and `/var/tmp` stay at LOW risk
 
 ## Python API
 

{bash_classify-0.4.2 → bash_classify-0.6.0}/README.md

@@ -4,7 +4,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 150+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
@@ -57,10 +57,12 @@ Once installed, any Bash tool call with `risk: LOW` is auto-approved — no perm
 
 ## Command database
 
-The classification database includes 120+ command definitions covering common Unix utilities, package managers, container tools, cloud CLIs, and more.
+bash-classify loads command definitions from two locations:
 
-- See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands
-- YAML definitions are validated against a JSON Schema for IDE autocomplete and CI checks
+- **Built-in database** — 150+ command definitions bundled with the package, covering common Unix utilities, package managers, container tools, cloud CLIs, and more. Lives in `src/bash_classify/commands/*.yaml`.
+- **User database** — your own command definitions at `~/.config/bash-classify/commands/*.yaml` (override the location with the `BASH_CLASSIFY_CONFIG_DIR` env var, which resolves to `$BASH_CLASSIFY_CONFIG_DIR/commands/`). User files with the same name as a built-in override it completely, so you can customize classifications for internal tools, company-specific wrappers, or personal CLIs without forking the repo.
+
+Both directories use the same YAML format. See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands. YAML definitions are validated against a [JSON Schema](schemas/command.schema.json) for IDE autocomplete and CI checks.
 
 ## Classification levels
 
@@ -89,7 +91,9 @@ Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
 - **YAML command database** -- each command has classification rules with subcommand and option matching
 - **Subcommand matching** -- `kubectl get` and `kubectl delete` can have different classifications
+- **Multi-goal build tools** -- `subcommand_mode: match_all` handles commands like `mvn clean install` and `gradle clean build test` where multiple goals can be combined in any order
 - **Delegation for wrappers** -- commands like `xargs`, `sudo`, and `env` delegate classification to the inner command
+- **File path detection** -- redirect operators (`>`, `>>`, `<`) are parsed into `write_paths`/`read_paths` in the output; writes to `/tmp` and `/var/tmp` stay at LOW risk
 
 ## Python API
 

{bash_classify-0.4.2 → bash_classify-0.6.0}/SPEC.md

@@ -246,7 +246,21 @@ Certain expression-level patterns elevate risk to at least `HIGH`:
 - Writing to system paths (e.g. `/etc`, `/usr`)
 - Redirecting to `/dev/tcp` or `/dev/udp`
 - Backgrounding (`cmd &`)
-- Output redirects to non-`/dev/null` targets
+- Output redirects to non-`/dev/null` targets (except when all write targets are under `/tmp` or `/var/tmp`)
+
+#### Temp path risk lowering
+
+When all write targets from output redirects (`>`, `>>`, `2>`, `&>`, `>&`) are under `/tmp` or `/var/tmp`, the risk elevation to `MEDIUM` from output redirects is skipped. This allows commands like `cat > /tmp/foo.txt` to remain at `LOW` risk while still being classified as `LOCAL_EFFECTS`.
+
+### File path detection
+
+The tool extracts file paths from shell redirects:
+
+- **`write_paths`**: Files targeted by output redirects (`>`, `>>`, `2>`, `&>`, `>&`), excluding `/dev/null`, `/dev/stdin`, `/dev/stdout`, `/dev/stderr`, and `/dev/fd/*`.
+- **`read_paths`**: Files targeted by input redirects (`<`), excluding the same `/dev/*` paths.
+- Heredoc operators (`<<`, `<<<`) are not included — their target is a delimiter, not a file path.
+
+Paths are reported at both the per-command level (`commands[].write_paths`, `commands[].read_paths`) and the expression level (aggregated from all commands).
 
 ### Composite classification
 
@@ -918,6 +932,8 @@ The `commands` list is recursive — any command entry can contain `inner_comman
   "expression": "string — the original input",
   "classification": "READONLY | LOCAL_EFFECTS | EXTERNAL_EFFECTS | DANGEROUS | UNKNOWN",
   "directories": ["string — detected directories"],
+  "write_paths": ["string — files targeted by output redirects (optional, omitted when empty)"],
+  "read_paths": ["string — files targeted by input redirects (optional, omitted when empty)"],
   "commands": [
     {
       "command": ["string — binary + subcommand chain (without inner command tokens)"],
@@ -928,6 +944,8 @@ The `commands` list is recursive — any command entry can contain `inner_comman
       "remaining_options": ["string — options that were not in database"],
       "classification_reason": "string — why this classification was chosen",
       "overriding_option": "string | null — the option that elevated classification",
+      "write_paths": ["string — files targeted by output redirects (optional, omitted when empty)"],
+      "read_paths": ["string — files targeted by input redirects (optional, omitted when empty)"],
       "inner_commands": [
         {
           "delegation_mode": "string — how this inner command was extracted",

{bash_classify-0.4.2 → bash_classify-0.6.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.4.2",
+  "version": "0.6.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

{bash_classify-0.4.2 → bash_classify-0.6.0}/docs/classification-guidance.md

@@ -453,7 +453,15 @@ subcommands:
 - Unrecognized goals (e.g. custom Maven plugin goals like `some-plugin:goal`) fall back to the command's base classification and risk
 - Option overrides (e.g. `--dry-run`) still take precedence over goal aggregation
 
-## 10. Common Patterns
+## 10. Temp Path Risk Behavior
+
+When a command writes to a file via output redirects (`>`, `>>`, `2>`, `&>`, `>&`), its risk is normally elevated to at least `MEDIUM`. However, if **all** write targets are under `/tmp` or `/var/tmp`, the risk elevation is skipped and the command stays at `LOW` risk (assuming no other risk elevations apply).
+
+This means `cat > /tmp/foo.txt` is classified as `LOCAL_EFFECTS` with risk `LOW`, while `cat > ~/foo.txt` is classified as `LOCAL_EFFECTS` with risk `MEDIUM`.
+
+The tool also reports `write_paths` and `read_paths` in the output, extracted from redirect operators. These fields are omitted from the JSON output when empty.
+
+## 11. Common Patterns
 
 | Pattern | Example | Classification |
 |---------|---------|---------------|

{bash_classify-0.4.2 → bash_classify-0.6.0}/schemas/command.schema.json

@@ -6,6 +6,28 @@
   "type": "object",
   "required": ["command"],
   "additionalProperties": false,
+  "oneOf": [
+    {
+      "description": "Alias file: points at another command, mutually exclusive with classification-bearing fields",
+      "required": ["alias_of"],
+      "not": {
+        "anyOf": [
+          {"required": ["classification"]},
+          {"required": ["risk"]},
+          {"required": ["subcommands"]},
+          {"required": ["options"]},
+          {"required": ["global_options"]},
+          {"required": ["subcommand_mode"]},
+          {"required": ["delegates_to"]},
+          {"required": ["strict"]}
+        ]
+      }
+    },
+    {
+      "description": "Regular command definition",
+      "not": {"required": ["alias_of"]}
+    }
+  ],
   "properties": {
     "command": {
       "type": "string",
@@ -15,6 +37,10 @@
       "type": "string",
       "description": "Short description of the tool"
     },
+    "alias_of": {
+      "type": "string",
+      "description": "Name of another command in the database whose definition should be used verbatim. Mutually exclusive with classification/risk/subcommands/options/global_options/subcommand_mode/delegates_to/strict."
+    },
     "classification": {
       "$ref": "#/$defs/Classification"
     },

{bash_classify-0.4.2 → bash_classify-0.6.0}/src/bash_classify/classifier.py

@@ -48,6 +48,22 @@ _SAFE_PREFIXES = (
     "/dev/udp",
 )
 
+_WRITE_OPERATORS = {">", ">>", "2>", "&>", ">&"}
+_READ_OPERATORS = {"<"}
+_HEREDOC_OPERATORS = {"<<", "<<<"}
+
+_DEV_PATHS = ("/dev/null", "/dev/stdin", "/dev/stdout", "/dev/stderr", "/dev/fd/")
+
+
+def _is_temp_path(path: str) -> bool:
+    """Check if a path is under a temp directory."""
+    return path.startswith("/tmp/") or path == "/tmp" or path.startswith("/var/tmp/") or path == "/var/tmp"
+
+
+def _is_real_file_path(path: str) -> bool:
+    """Check if a redirect target is a real file path (not /dev/null etc)."""
+    return all(not (path == dev or path.startswith(dev)) for dev in _DEV_PATHS)
+
 
 def _is_system_path(path: str) -> bool:
     """Check if a path is a system directory that should trigger DANGEROUS when written to."""
@@ -103,6 +119,20 @@ def classify_expression(
         else:
             result = match_command(invocation, database)
 
+        # Collect file paths from redirects
+        write_paths: list[str] = []
+        read_paths: list[str] = []
+        all_write_targets_are_temp = True
+
+        for redirect in invocation.redirects:
+            if redirect.operator in _WRITE_OPERATORS and _is_real_file_path(redirect.target):
+                write_paths.append(redirect.target)
+                if not _is_temp_path(redirect.target):
+                    all_write_targets_are_temp = False
+            elif redirect.operator in _READ_OPERATORS and _is_real_file_path(redirect.target):
+                read_paths.append(redirect.target)
+            # Skip << and <<< (heredoc/herestring - target is delimiter, not file)
+
         # Step 4: Apply redirect classification
         for redirect in invocation.redirects:
             if redirect.affects_classification:
@@ -114,8 +144,9 @@ def classify_expression(
                         if result.classification_reason
                         else "elevated by output redirect"
                     )
-                # Elevate risk to at least MEDIUM for output redirects
-                result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
+                # Only elevate risk if write targets are NOT all temp paths
+                if not (write_paths and all_write_targets_are_temp):
+                    result.risk = Risk.max_severity(result.risk, Risk.MEDIUM)
             # /dev/tcp and /dev/udp redirects are network access -> DANGEROUS
             if redirect.target.startswith("/dev/tcp/") or redirect.target.startswith("/dev/udp/"):
                 elevated = Classification.max_severity(result.classification, Classification.DANGEROUS)
@@ -165,12 +196,24 @@ def classify_expression(
                 ) + f"; elevated to DANGEROUS: system path {system_paths_found[0]}"
                 result.risk = Risk.HIGH
 
+        result.write_paths = write_paths if write_paths else None
+        result.read_paths = read_paths if read_paths else None
+
         command_results.append(result)
         all_redirects.extend(invocation.redirects)
 
     # Step 7: Collect directories
     directories = _collect_directories(command_results)
 
+    # Step 7b: Aggregate write_paths and read_paths
+    all_write_paths: list[str] = []
+    all_read_paths: list[str] = []
+    for cmd_result in command_results:
+        if cmd_result.write_paths:
+            all_write_paths.extend(cmd_result.write_paths)
+        if cmd_result.read_paths:
+            all_read_paths.extend(cmd_result.read_paths)
+
     # Step 8: Compute composite classification and risk
     if not command_results and parse_warnings:
         overall = Classification.UNKNOWN
@@ -187,6 +230,8 @@ def classify_expression(
         classification=overall,
         risk=overall_risk,
         directories=directories,
+        write_paths=all_write_paths,
+        read_paths=all_read_paths,
         commands=command_results,
         redirects=all_redirects,
         parse_warnings=parse_warnings,

{bash_classify-0.4.2 → bash_classify-0.6.0}/src/bash_classify/cli.py

@@ -57,6 +57,11 @@ def _command_to_dict(result: CommandResult) -> dict:
     if result.overriding_option is not None:
         d["overriding_option"] = result.overriding_option
 
+    if result.write_paths:
+        d["write_paths"] = result.write_paths
+    if result.read_paths:
+        d["read_paths"] = result.read_paths
+
     d["inner_commands"] = [_inner_command_to_dict(ic) for ic in result.inner_commands]
 
     return d
@@ -81,6 +86,11 @@ def _result_to_dict(result: ExpressionResult) -> dict:
         "commands": [_command_to_dict(cmd) for cmd in result.commands],
     }
 
+    if result.write_paths:
+        d["write_paths"] = result.write_paths
+    if result.read_paths:
+        d["read_paths"] = result.read_paths
+
     if result.redirects:
         d["redirects"] = [_redirect_to_dict(r) for r in result.redirects]
 

bash_classify-0.6.0/src/bash_classify/commands/gws.yaml

@@ -0,0 +1,211 @@
+# $schema: ../../../schemas/command.schema.json
+command: gws
+description: "Google Workspace CLI — manages Drive, Sheets, Gmail, Calendar, Docs, and more via Google APIs"
+classification: READONLY
+strict: false
+
+# Dispatch model:
+#
+# `gws <service> <resource> [sub-resource] <method>` is a 3-4 level hierarchy.
+# bash-classify only honors `subcommand_mode: match_all` on the top-level
+# command, not on nested subcommands. To avoid enumerating every
+# service × resource × method triple, we run the whole thing in match_all
+# mode at the top. Every positional token is matched independently against
+# the flat verb dictionary below; unknown tokens (service names like
+# "drive", resource names like "files", IDs, etc.) fall back to the base
+# READONLY classification. The final classification is the max severity
+# across all matched tokens.
+#
+# This means:
+#   gws drive files list         -> list (READONLY)                -> READONLY
+#   gws drive files delete       -> delete (DANGEROUS)              -> DANGEROUS
+#   gws drive files create       -> create (EXTERNAL_EFFECTS)       -> EXTERNAL
+#   gws gmail users messages send -> send (EXTERNAL_EFFECTS)        -> EXTERNAL
+#
+# The verb `export` is used both for "download as format" (drive/sheets/docs
+# export = READONLY) and for `auth export`, which by default prints *masked*
+# credentials (also READONLY). Only `auth export --unmasked` prints plaintext
+# OAuth tokens and client secrets — that specific case is flagged via the
+# `--unmasked` global option override below.
+subcommand_mode: match_all
+
+global_options:
+  --help: {overrides: READONLY}
+  -h: {overrides: READONLY}
+  --format: {takes_value: true}
+  --params: {takes_value: true}
+  --json: {takes_value: true}
+  --upload: {takes_value: true}
+  --upload-content-type: {takes_value: true}
+  --output: {takes_value: true}
+  --api-version: {takes_value: true}
+  --page-all: {}
+  --page-limit: {takes_value: true}
+  --page-delay: {takes_value: true}
+  --sanitize: {takes_value: true}
+  --dry-run: {overrides: READONLY, risk: LOW}
+  # `auth export --unmasked` prints plaintext OAuth tokens and client secrets.
+  --unmasked: {overrides: DANGEROUS, risk: HIGH}
+
+subcommands:
+  # ── service names (explicit READONLY so they don't pollute risk) ──
+  drive: {classification: READONLY}
+  sheets: {classification: READONLY}
+  gmail: {classification: READONLY}
+  calendar: {classification: READONLY}
+  docs: {classification: READONLY}
+  slides: {classification: READONLY}
+  tasks: {classification: READONLY}
+  people: {classification: READONLY}
+  chat: {classification: READONLY}
+  classroom: {classification: READONLY}
+  forms: {classification: READONLY}
+  keep: {classification: READONLY}
+  meet: {classification: READONLY}
+  events: {classification: READONLY}
+  workflow: {classification: READONLY}
+  wf: {classification: READONLY}
+  script: {classification: READONLY}
+  admin: {classification: READONLY}
+  admin-reports: {classification: READONLY}
+  reports: {classification: READONLY}
+  modelarmor: {classification: READONLY}
+  schema: {classification: READONLY}
+
+  # ── auth: a flat "verb" since match_all treats every token equally ─
+  # `auth` itself maps to READONLY; the method tokens below elevate.
+  # `auth export` defaults to READONLY (masked); `--unmasked` is flagged
+  # separately via the global option override above.
+  auth: {classification: READONLY}
+  status: {classification: READONLY}
+  # `auth login` performs an OAuth2 handshake with Google — creates/rotates
+  # a credential server-side, so it has external effects.
+  login: {classification: EXTERNAL_EFFECTS}
+  logout:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+  # `auth setup` can shell out to `gcloud` and create GCP OAuth clients/projects.
+  setup: {classification: EXTERNAL_EFFECTS}
+
+  # ── READONLY methods ──────────────────────────────────────────────
+  get: {classification: READONLY}
+  getProfile: {classification: READONLY}
+  getContent: {classification: READONLY}
+  getMetrics: {classification: READONLY}
+  getThumbnail: {classification: READONLY}
+  getByDataFilter: {classification: READONLY}
+  getBatchGet: {classification: READONLY}
+  batchGet: {classification: READONLY}
+  list: {classification: READONLY}
+  listLabels: {classification: READONLY}
+  listContactGroups: {classification: READONLY}
+  listDirectoryPeople: {classification: READONLY}
+  listScriptProcesses: {classification: READONLY}
+  listUserProcesses: {classification: READONLY}
+  searchContacts: {classification: READONLY}
+  searchDirectoryPeople: {classification: READONLY}
+  search: {classification: READONLY}
+  query: {classification: READONLY}
+  findDirectMessage: {classification: READONLY}
+  freebusy: {classification: READONLY}
+  instances: {classification: READONLY}
+  about: {classification: READONLY}
+  download: {classification: READONLY}
+  export: {classification: READONLY}           # drive/sheets/docs export; NOTE: auth export also matches
+  generateIds: {classification: READONLY}
+  generateCseToken: {classification: READONLY}
+
+  # ── READONLY helpers ('+' prefix) ─────────────────────────────────
+  "+read": {classification: READONLY}
+  "+triage": {classification: READONLY}
+  "+agenda": {classification: READONLY}
+  "+standup-report": {classification: READONLY}
+  "+meeting-prep": {classification: READONLY}
+  "+weekly-digest": {classification: READONLY}
+  "+subscribe": {classification: READONLY}
+
+  # ── EXTERNAL_EFFECTS methods ──────────────────────────────────────
+  create: {classification: EXTERNAL_EFFECTS}
+  createContact: {classification: EXTERNAL_EFFECTS}
+  update: {classification: EXTERNAL_EFFECTS}
+  updateContent: {classification: EXTERNAL_EFFECTS}
+  updateContact: {classification: EXTERNAL_EFFECTS}
+  updateContactPhoto: {classification: EXTERNAL_EFFECTS}
+  patch: {classification: EXTERNAL_EFFECTS}
+  insert: {classification: EXTERNAL_EFFECTS}
+  import: {classification: EXTERNAL_EFFECTS}
+  send: {classification: EXTERNAL_EFFECTS}
+  copy: {classification: EXTERNAL_EFFECTS}
+  copyTo: {classification: EXTERNAL_EFFECTS}
+  copyOtherContactToMyContactsGroup: {classification: EXTERNAL_EFFECTS}
+  move: {classification: EXTERNAL_EFFECTS}
+  modify: {classification: EXTERNAL_EFFECTS}
+  modifyLabels: {classification: EXTERNAL_EFFECTS}
+  modifyAttachments: {classification: EXTERNAL_EFFECTS}
+  modifyAssignment: {classification: EXTERNAL_EFFECTS}
+  modifyIndividualStudentsOptions: {classification: EXTERNAL_EFFECTS}
+  batchUpdate: {classification: EXTERNAL_EFFECTS}
+  batchUpdateByDataFilter: {classification: EXTERNAL_EFFECTS}
+  batchModify: {classification: EXTERNAL_EFFECTS}
+  batchCreateContacts: {classification: EXTERNAL_EFFECTS}
+  batchUpdateContacts: {classification: EXTERNAL_EFFECTS}
+  append: {classification: EXTERNAL_EFFECTS}
+  upload: {classification: EXTERNAL_EFFECTS}
+  watch: {classification: EXTERNAL_EFFECTS}
+  stop: {classification: EXTERNAL_EFFECTS}
+  untrash: {classification: EXTERNAL_EFFECTS}
+  hide: {classification: EXTERNAL_EFFECTS}
+  unhide: {classification: EXTERNAL_EFFECTS}
+  enable: {classification: EXTERNAL_EFFECTS}
+  disable: {classification: EXTERNAL_EFFECTS}
+  verify: {classification: EXTERNAL_EFFECTS}
+  accept: {classification: EXTERNAL_EFFECTS}
+  reclaim: {classification: EXTERNAL_EFFECTS}
+  return: {classification: EXTERNAL_EFFECTS}
+  turnIn: {classification: EXTERNAL_EFFECTS}
+  quickAdd: {classification: EXTERNAL_EFFECTS}
+  setUp: {classification: EXTERNAL_EFFECTS}
+  setPublishSettings: {classification: EXTERNAL_EFFECTS}
+  completeImport: {classification: EXTERNAL_EFFECTS}
+  reactivate: {classification: EXTERNAL_EFFECTS}
+  publish: {classification: EXTERNAL_EFFECTS}
+  endActiveConference: {classification: EXTERNAL_EFFECTS}
+  # Model Armor sanitize* methods POST user-controlled text to the remote
+  # modelarmor.{region}.rep.googleapis.com endpoint.
+  sanitizeUserPrompt: {classification: EXTERNAL_EFFECTS}
+  sanitizeModelResponse: {classification: EXTERNAL_EFFECTS}
+
+  # ── EXTERNAL_EFFECTS helpers ──────────────────────────────────────
+  "+upload": {classification: EXTERNAL_EFFECTS}
+  "+push": {classification: EXTERNAL_EFFECTS}
+  "+send": {classification: EXTERNAL_EFFECTS}
+  # `gmail +watch` creates Pub/Sub topic+subscription and calls users.watch —
+  # leaves persistent server-side GCP resources unless --cleanup is passed.
+  "+watch": {classification: EXTERNAL_EFFECTS}
+  "+sanitize-prompt": {classification: EXTERNAL_EFFECTS}
+  "+sanitize-response": {classification: EXTERNAL_EFFECTS}
+  "+reply": {classification: EXTERNAL_EFFECTS}
+  "+reply-all": {classification: EXTERNAL_EFFECTS}
+  "+forward": {classification: EXTERNAL_EFFECTS}
+  "+insert": {classification: EXTERNAL_EFFECTS}
+  "+write": {classification: EXTERNAL_EFFECTS}
+  "+append": {classification: EXTERNAL_EFFECTS}
+  "+email-to-task": {classification: EXTERNAL_EFFECTS}
+  "+file-announce": {classification: EXTERNAL_EFFECTS}
+  "+renew": {classification: EXTERNAL_EFFECTS}
+  "+create-template": {classification: EXTERNAL_EFFECTS}
+
+  # ── DANGEROUS methods ─────────────────────────────────────────────
+  delete: {classification: DANGEROUS}
+  deleteContact: {classification: DANGEROUS}
+  deleteContactPhoto: {classification: DANGEROUS}
+  batchDelete: {classification: DANGEROUS}
+  batchDeleteContacts: {classification: DANGEROUS}
+  batchClear: {classification: DANGEROUS}
+  batchClearByDataFilter: {classification: DANGEROUS}
+  clear: {classification: DANGEROUS}
+  trash: {classification: DANGEROUS}
+  emptyTrash: {classification: DANGEROUS}
+  remove: {classification: DANGEROUS}
+  # Running an Apps Script project executes arbitrary code.
+  run: {classification: DANGEROUS}

{bash_classify-0.4.2 → bash_classify-0.6.0}/src/bash_classify/commands/tee.yaml

@@ -2,6 +2,7 @@
 command: tee
 description: "Read from stdin and write to stdout and files"
 classification: LOCAL_EFFECTS
+risk: LOW
 strict: false
 global_options:
   --help: {overrides: READONLY}

{bash_classify-0.4.2 → bash_classify-0.6.0}/src/bash_classify/database.py

@@ -167,8 +167,32 @@ def _yaml_str(value: object) -> str:
     return str(value)
 
 
+_ALIAS_FORBIDDEN_KEYS = frozenset(
+    {
+        "classification",
+        "risk",
+        "subcommands",
+        "options",
+        "global_options",
+        "subcommand_mode",
+        "delegates_to",
+        "strict",
+    }
+)
+
+
 def _parse_command_def(data: dict, command_name: str) -> CommandDef:
     """Parse a raw YAML dict into a CommandDef structure."""
+    alias_of = data.get("alias_of")
+    if alias_of is not None:
+        conflicting = sorted(_ALIAS_FORBIDDEN_KEYS & data.keys())
+        if conflicting:
+            raise ValueError(
+                f"alias file for '{command_name}' has alias_of='{alias_of}' "
+                f"combined with forbidden field(s): {', '.join(conflicting)}"
+            )
+        return CommandDef(command=command_name, alias_of=str(alias_of))
+
     classification = _parse_classification(data.get("classification"))
     risk = _parse_risk(data.get("risk"))
 

{bash_classify-0.4.2 → bash_classify-0.6.0}/src/bash_classify/matcher.py

@@ -94,6 +94,17 @@ def match_command(
             classification_reason="command not in database",
         )
 
+    # Step 1b: Resolve alias_of (max depth 1). The user-facing binary stays
+    # as typed; only command_def is swapped to the target.
+    if command_def.alias_of is not None:
+        target_name = command_def.alias_of
+        target_def = database.get(target_name)
+        if target_def is None:
+            raise ValueError(f"{binary} aliases '{target_name}' which is not in the database")
+        if target_def.alias_of is not None:
+            raise ValueError(f"alias chain too deep: {binary} -> {target_name} -> {target_def.alias_of}")
+        command_def = target_def
+
     remaining = argv[1:]
 
     # Step 2: Strip global options

{bash_classify-0.4.2 → bash_classify-0.6.0}/src/bash_classify/models.py

@@ -135,6 +135,7 @@ class CommandDef:
     """Definition of a command (or subcommand) from the database."""
 
     command: str
+    alias_of: str | None = None
     classification: Classification | None = None
     risk: Risk | None = None
     global_options: dict[str, OptionDef] = field(default_factory=dict)
@@ -177,6 +178,8 @@ class CommandResult:
     classification_reason: str | None = None
     overriding_option: str | None = None
     directories: list[str] | None = None
+    write_paths: list[str] | None = None
+    read_paths: list[str] | None = None
 
 
 @dataclass
@@ -187,6 +190,8 @@ class ExpressionResult:
     classification: Classification
     risk: Risk
     directories: list[str]
+    write_paths: list[str]
+    read_paths: list[str]
     commands: list[CommandResult]
     redirects: list[Redirect]
     parse_warnings: list[str]