bash-classify 0.5.0__tar.gz → 0.6.0__tar.gz

{bash_classify-0.5.0 → bash_classify-0.6.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.5.0 → bash_classify-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.5.0
+Version: 0.6.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify
@@ -33,7 +33,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 150+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
@@ -86,10 +86,12 @@ Once installed, any Bash tool call with `risk: LOW` is auto-approved — no perm
 
 ## Command database
 
-The classification database includes 120+ command definitions covering common Unix utilities, package managers, container tools, cloud CLIs, and more.
+bash-classify loads command definitions from two locations:
 
-- See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands
-- YAML definitions are validated against a JSON Schema for IDE autocomplete and CI checks
+- **Built-in database** — 150+ command definitions bundled with the package, covering common Unix utilities, package managers, container tools, cloud CLIs, and more. Lives in `src/bash_classify/commands/*.yaml`.
+- **User database** — your own command definitions at `~/.config/bash-classify/commands/*.yaml` (override the location with the `BASH_CLASSIFY_CONFIG_DIR` env var, which resolves to `$BASH_CLASSIFY_CONFIG_DIR/commands/`). User files with the same name as a built-in override it completely, so you can customize classifications for internal tools, company-specific wrappers, or personal CLIs without forking the repo.
+
+Both directories use the same YAML format. See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands. YAML definitions are validated against a [JSON Schema](schemas/command.schema.json) for IDE autocomplete and CI checks.
 
 ## Classification levels
 
@@ -118,7 +120,9 @@ Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
 - **YAML command database** -- each command has classification rules with subcommand and option matching
 - **Subcommand matching** -- `kubectl get` and `kubectl delete` can have different classifications
+- **Multi-goal build tools** -- `subcommand_mode: match_all` handles commands like `mvn clean install` and `gradle clean build test` where multiple goals can be combined in any order
 - **Delegation for wrappers** -- commands like `xargs`, `sudo`, and `env` delegate classification to the inner command
+- **File path detection** -- redirect operators (`>`, `>>`, `<`) are parsed into `write_paths`/`read_paths` in the output; writes to `/tmp` and `/var/tmp` stay at LOW risk
 
 ## Python API
 

{bash_classify-0.5.0 → bash_classify-0.6.0}/README.md

@@ -4,7 +4,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 150+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
@@ -57,10 +57,12 @@ Once installed, any Bash tool call with `risk: LOW` is auto-approved — no perm
 
 ## Command database
 
-The classification database includes 120+ command definitions covering common Unix utilities, package managers, container tools, cloud CLIs, and more.
+bash-classify loads command definitions from two locations:
 
-- See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands
-- YAML definitions are validated against a JSON Schema for IDE autocomplete and CI checks
+- **Built-in database** — 150+ command definitions bundled with the package, covering common Unix utilities, package managers, container tools, cloud CLIs, and more. Lives in `src/bash_classify/commands/*.yaml`.
+- **User database** — your own command definitions at `~/.config/bash-classify/commands/*.yaml` (override the location with the `BASH_CLASSIFY_CONFIG_DIR` env var, which resolves to `$BASH_CLASSIFY_CONFIG_DIR/commands/`). User files with the same name as a built-in override it completely, so you can customize classifications for internal tools, company-specific wrappers, or personal CLIs without forking the repo.
+
+Both directories use the same YAML format. See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands. YAML definitions are validated against a [JSON Schema](schemas/command.schema.json) for IDE autocomplete and CI checks.
 
 ## Classification levels
 
@@ -89,7 +91,9 @@ Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
 - **YAML command database** -- each command has classification rules with subcommand and option matching
 - **Subcommand matching** -- `kubectl get` and `kubectl delete` can have different classifications
+- **Multi-goal build tools** -- `subcommand_mode: match_all` handles commands like `mvn clean install` and `gradle clean build test` where multiple goals can be combined in any order
 - **Delegation for wrappers** -- commands like `xargs`, `sudo`, and `env` delegate classification to the inner command
+- **File path detection** -- redirect operators (`>`, `>>`, `<`) are parsed into `write_paths`/`read_paths` in the output; writes to `/tmp` and `/var/tmp` stay at LOW risk
 
 ## Python API
 

{bash_classify-0.5.0 → bash_classify-0.6.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

{bash_classify-0.5.0 → bash_classify-0.6.0}/schemas/command.schema.json

@@ -6,6 +6,28 @@
   "type": "object",
   "required": ["command"],
   "additionalProperties": false,
+  "oneOf": [
+    {
+      "description": "Alias file: points at another command, mutually exclusive with classification-bearing fields",
+      "required": ["alias_of"],
+      "not": {
+        "anyOf": [
+          {"required": ["classification"]},
+          {"required": ["risk"]},
+          {"required": ["subcommands"]},
+          {"required": ["options"]},
+          {"required": ["global_options"]},
+          {"required": ["subcommand_mode"]},
+          {"required": ["delegates_to"]},
+          {"required": ["strict"]}
+        ]
+      }
+    },
+    {
+      "description": "Regular command definition",
+      "not": {"required": ["alias_of"]}
+    }
+  ],
   "properties": {
     "command": {
       "type": "string",
@@ -15,6 +37,10 @@
       "type": "string",
       "description": "Short description of the tool"
     },
+    "alias_of": {
+      "type": "string",
+      "description": "Name of another command in the database whose definition should be used verbatim. Mutually exclusive with classification/risk/subcommands/options/global_options/subcommand_mode/delegates_to/strict."
+    },
     "classification": {
       "$ref": "#/$defs/Classification"
     },

bash_classify-0.6.0/src/bash_classify/commands/gws.yaml

@@ -0,0 +1,211 @@
+# $schema: ../../../schemas/command.schema.json
+command: gws
+description: "Google Workspace CLI — manages Drive, Sheets, Gmail, Calendar, Docs, and more via Google APIs"
+classification: READONLY
+strict: false
+
+# Dispatch model:
+#
+# `gws <service> <resource> [sub-resource] <method>` is a 3-4 level hierarchy.
+# bash-classify only honors `subcommand_mode: match_all` on the top-level
+# command, not on nested subcommands. To avoid enumerating every
+# service × resource × method triple, we run the whole thing in match_all
+# mode at the top. Every positional token is matched independently against
+# the flat verb dictionary below; unknown tokens (service names like
+# "drive", resource names like "files", IDs, etc.) fall back to the base
+# READONLY classification. The final classification is the max severity
+# across all matched tokens.
+#
+# This means:
+#   gws drive files list         -> list (READONLY)                -> READONLY
+#   gws drive files delete       -> delete (DANGEROUS)              -> DANGEROUS
+#   gws drive files create       -> create (EXTERNAL_EFFECTS)       -> EXTERNAL
+#   gws gmail users messages send -> send (EXTERNAL_EFFECTS)        -> EXTERNAL
+#
+# The verb `export` is used both for "download as format" (drive/sheets/docs
+# export = READONLY) and for `auth export`, which by default prints *masked*
+# credentials (also READONLY). Only `auth export --unmasked` prints plaintext
+# OAuth tokens and client secrets — that specific case is flagged via the
+# `--unmasked` global option override below.
+subcommand_mode: match_all
+
+global_options:
+  --help: {overrides: READONLY}
+  -h: {overrides: READONLY}
+  --format: {takes_value: true}
+  --params: {takes_value: true}
+  --json: {takes_value: true}
+  --upload: {takes_value: true}
+  --upload-content-type: {takes_value: true}
+  --output: {takes_value: true}
+  --api-version: {takes_value: true}
+  --page-all: {}
+  --page-limit: {takes_value: true}
+  --page-delay: {takes_value: true}
+  --sanitize: {takes_value: true}
+  --dry-run: {overrides: READONLY, risk: LOW}
+  # `auth export --unmasked` prints plaintext OAuth tokens and client secrets.
+  --unmasked: {overrides: DANGEROUS, risk: HIGH}
+
+subcommands:
+  # ── service names (explicit READONLY so they don't pollute risk) ──
+  drive: {classification: READONLY}
+  sheets: {classification: READONLY}
+  gmail: {classification: READONLY}
+  calendar: {classification: READONLY}
+  docs: {classification: READONLY}
+  slides: {classification: READONLY}
+  tasks: {classification: READONLY}
+  people: {classification: READONLY}
+  chat: {classification: READONLY}
+  classroom: {classification: READONLY}
+  forms: {classification: READONLY}
+  keep: {classification: READONLY}
+  meet: {classification: READONLY}
+  events: {classification: READONLY}
+  workflow: {classification: READONLY}
+  wf: {classification: READONLY}
+  script: {classification: READONLY}
+  admin: {classification: READONLY}
+  admin-reports: {classification: READONLY}
+  reports: {classification: READONLY}
+  modelarmor: {classification: READONLY}
+  schema: {classification: READONLY}
+
+  # ── auth: a flat "verb" since match_all treats every token equally ─
+  # `auth` itself maps to READONLY; the method tokens below elevate.
+  # `auth export` defaults to READONLY (masked); `--unmasked` is flagged
+  # separately via the global option override above.
+  auth: {classification: READONLY}
+  status: {classification: READONLY}
+  # `auth login` performs an OAuth2 handshake with Google — creates/rotates
+  # a credential server-side, so it has external effects.
+  login: {classification: EXTERNAL_EFFECTS}
+  logout:
+    classification: LOCAL_EFFECTS
+    risk: LOW
+  # `auth setup` can shell out to `gcloud` and create GCP OAuth clients/projects.
+  setup: {classification: EXTERNAL_EFFECTS}
+
+  # ── READONLY methods ──────────────────────────────────────────────
+  get: {classification: READONLY}
+  getProfile: {classification: READONLY}
+  getContent: {classification: READONLY}
+  getMetrics: {classification: READONLY}
+  getThumbnail: {classification: READONLY}
+  getByDataFilter: {classification: READONLY}
+  getBatchGet: {classification: READONLY}
+  batchGet: {classification: READONLY}
+  list: {classification: READONLY}
+  listLabels: {classification: READONLY}
+  listContactGroups: {classification: READONLY}
+  listDirectoryPeople: {classification: READONLY}
+  listScriptProcesses: {classification: READONLY}
+  listUserProcesses: {classification: READONLY}
+  searchContacts: {classification: READONLY}
+  searchDirectoryPeople: {classification: READONLY}
+  search: {classification: READONLY}
+  query: {classification: READONLY}
+  findDirectMessage: {classification: READONLY}
+  freebusy: {classification: READONLY}
+  instances: {classification: READONLY}
+  about: {classification: READONLY}
+  download: {classification: READONLY}
+  export: {classification: READONLY}           # drive/sheets/docs export; NOTE: auth export also matches
+  generateIds: {classification: READONLY}
+  generateCseToken: {classification: READONLY}
+
+  # ── READONLY helpers ('+' prefix) ─────────────────────────────────
+  "+read": {classification: READONLY}
+  "+triage": {classification: READONLY}
+  "+agenda": {classification: READONLY}
+  "+standup-report": {classification: READONLY}
+  "+meeting-prep": {classification: READONLY}
+  "+weekly-digest": {classification: READONLY}
+  "+subscribe": {classification: READONLY}
+
+  # ── EXTERNAL_EFFECTS methods ──────────────────────────────────────
+  create: {classification: EXTERNAL_EFFECTS}
+  createContact: {classification: EXTERNAL_EFFECTS}
+  update: {classification: EXTERNAL_EFFECTS}
+  updateContent: {classification: EXTERNAL_EFFECTS}
+  updateContact: {classification: EXTERNAL_EFFECTS}
+  updateContactPhoto: {classification: EXTERNAL_EFFECTS}
+  patch: {classification: EXTERNAL_EFFECTS}
+  insert: {classification: EXTERNAL_EFFECTS}
+  import: {classification: EXTERNAL_EFFECTS}
+  send: {classification: EXTERNAL_EFFECTS}
+  copy: {classification: EXTERNAL_EFFECTS}
+  copyTo: {classification: EXTERNAL_EFFECTS}
+  copyOtherContactToMyContactsGroup: {classification: EXTERNAL_EFFECTS}
+  move: {classification: EXTERNAL_EFFECTS}
+  modify: {classification: EXTERNAL_EFFECTS}
+  modifyLabels: {classification: EXTERNAL_EFFECTS}
+  modifyAttachments: {classification: EXTERNAL_EFFECTS}
+  modifyAssignment: {classification: EXTERNAL_EFFECTS}
+  modifyIndividualStudentsOptions: {classification: EXTERNAL_EFFECTS}
+  batchUpdate: {classification: EXTERNAL_EFFECTS}
+  batchUpdateByDataFilter: {classification: EXTERNAL_EFFECTS}
+  batchModify: {classification: EXTERNAL_EFFECTS}
+  batchCreateContacts: {classification: EXTERNAL_EFFECTS}
+  batchUpdateContacts: {classification: EXTERNAL_EFFECTS}
+  append: {classification: EXTERNAL_EFFECTS}
+  upload: {classification: EXTERNAL_EFFECTS}
+  watch: {classification: EXTERNAL_EFFECTS}
+  stop: {classification: EXTERNAL_EFFECTS}
+  untrash: {classification: EXTERNAL_EFFECTS}
+  hide: {classification: EXTERNAL_EFFECTS}
+  unhide: {classification: EXTERNAL_EFFECTS}
+  enable: {classification: EXTERNAL_EFFECTS}
+  disable: {classification: EXTERNAL_EFFECTS}
+  verify: {classification: EXTERNAL_EFFECTS}
+  accept: {classification: EXTERNAL_EFFECTS}
+  reclaim: {classification: EXTERNAL_EFFECTS}
+  return: {classification: EXTERNAL_EFFECTS}
+  turnIn: {classification: EXTERNAL_EFFECTS}
+  quickAdd: {classification: EXTERNAL_EFFECTS}
+  setUp: {classification: EXTERNAL_EFFECTS}
+  setPublishSettings: {classification: EXTERNAL_EFFECTS}
+  completeImport: {classification: EXTERNAL_EFFECTS}
+  reactivate: {classification: EXTERNAL_EFFECTS}
+  publish: {classification: EXTERNAL_EFFECTS}
+  endActiveConference: {classification: EXTERNAL_EFFECTS}
+  # Model Armor sanitize* methods POST user-controlled text to the remote
+  # modelarmor.{region}.rep.googleapis.com endpoint.
+  sanitizeUserPrompt: {classification: EXTERNAL_EFFECTS}
+  sanitizeModelResponse: {classification: EXTERNAL_EFFECTS}
+
+  # ── EXTERNAL_EFFECTS helpers ──────────────────────────────────────
+  "+upload": {classification: EXTERNAL_EFFECTS}
+  "+push": {classification: EXTERNAL_EFFECTS}
+  "+send": {classification: EXTERNAL_EFFECTS}
+  # `gmail +watch` creates Pub/Sub topic+subscription and calls users.watch —
+  # leaves persistent server-side GCP resources unless --cleanup is passed.
+  "+watch": {classification: EXTERNAL_EFFECTS}
+  "+sanitize-prompt": {classification: EXTERNAL_EFFECTS}
+  "+sanitize-response": {classification: EXTERNAL_EFFECTS}
+  "+reply": {classification: EXTERNAL_EFFECTS}
+  "+reply-all": {classification: EXTERNAL_EFFECTS}
+  "+forward": {classification: EXTERNAL_EFFECTS}
+  "+insert": {classification: EXTERNAL_EFFECTS}
+  "+write": {classification: EXTERNAL_EFFECTS}
+  "+append": {classification: EXTERNAL_EFFECTS}
+  "+email-to-task": {classification: EXTERNAL_EFFECTS}
+  "+file-announce": {classification: EXTERNAL_EFFECTS}
+  "+renew": {classification: EXTERNAL_EFFECTS}
+  "+create-template": {classification: EXTERNAL_EFFECTS}
+
+  # ── DANGEROUS methods ─────────────────────────────────────────────
+  delete: {classification: DANGEROUS}
+  deleteContact: {classification: DANGEROUS}
+  deleteContactPhoto: {classification: DANGEROUS}
+  batchDelete: {classification: DANGEROUS}
+  batchDeleteContacts: {classification: DANGEROUS}
+  batchClear: {classification: DANGEROUS}
+  batchClearByDataFilter: {classification: DANGEROUS}
+  clear: {classification: DANGEROUS}
+  trash: {classification: DANGEROUS}
+  emptyTrash: {classification: DANGEROUS}
+  remove: {classification: DANGEROUS}
+  # Running an Apps Script project executes arbitrary code.
+  run: {classification: DANGEROUS}

{bash_classify-0.5.0 → bash_classify-0.6.0}/src/bash_classify/database.py

@@ -167,8 +167,32 @@ def _yaml_str(value: object) -> str:
     return str(value)
 
 
+_ALIAS_FORBIDDEN_KEYS = frozenset(
+    {
+        "classification",
+        "risk",
+        "subcommands",
+        "options",
+        "global_options",
+        "subcommand_mode",
+        "delegates_to",
+        "strict",
+    }
+)
+
+
 def _parse_command_def(data: dict, command_name: str) -> CommandDef:
     """Parse a raw YAML dict into a CommandDef structure."""
+    alias_of = data.get("alias_of")
+    if alias_of is not None:
+        conflicting = sorted(_ALIAS_FORBIDDEN_KEYS & data.keys())
+        if conflicting:
+            raise ValueError(
+                f"alias file for '{command_name}' has alias_of='{alias_of}' "
+                f"combined with forbidden field(s): {', '.join(conflicting)}"
+            )
+        return CommandDef(command=command_name, alias_of=str(alias_of))
+
     classification = _parse_classification(data.get("classification"))
     risk = _parse_risk(data.get("risk"))
 

{bash_classify-0.5.0 → bash_classify-0.6.0}/src/bash_classify/matcher.py

@@ -94,6 +94,17 @@ def match_command(
             classification_reason="command not in database",
         )
 
+    # Step 1b: Resolve alias_of (max depth 1). The user-facing binary stays
+    # as typed; only command_def is swapped to the target.
+    if command_def.alias_of is not None:
+        target_name = command_def.alias_of
+        target_def = database.get(target_name)
+        if target_def is None:
+            raise ValueError(f"{binary} aliases '{target_name}' which is not in the database")
+        if target_def.alias_of is not None:
+            raise ValueError(f"alias chain too deep: {binary} -> {target_name} -> {target_def.alias_of}")
+        command_def = target_def
+
     remaining = argv[1:]
 
     # Step 2: Strip global options

{bash_classify-0.5.0 → bash_classify-0.6.0}/src/bash_classify/models.py

@@ -135,6 +135,7 @@ class CommandDef:
     """Definition of a command (or subcommand) from the database."""
 
     command: str
+    alias_of: str | None = None
     classification: Classification | None = None
     risk: Risk | None = None
     global_options: dict[str, OptionDef] = field(default_factory=dict)

{bash_classify-0.5.0 → bash_classify-0.6.0}/tests/test_classifier.py

@@ -687,3 +687,60 @@ class TestFilePathDetection:
         result = classify_expression("cat < /home/user/data.txt | tee /tmp/out.txt > /tmp/log.txt", database=database)
         assert "/home/user/data.txt" in result.read_paths
         assert "/tmp/log.txt" in result.write_paths
+
+
+class TestAliasOfClassification:
+    """Tests for the alias_of feature — an alias file points at another command def."""
+
+    def _make_db(self, tmp_path):
+        from bash_classify.database import load_database
+
+        (tmp_path / "target.yaml").write_text(
+            "command: target\n"
+            "classification: READONLY\n"
+            "strict: false\n"
+            "subcommands:\n"
+            "  sub1: {classification: READONLY}\n"
+            "  sub2: {classification: DANGEROUS}\n"
+        )
+        (tmp_path / "myalias.yaml").write_text("command: myalias\ndescription: pointer\nalias_of: target\n")
+        return load_database(tmp_path)
+
+    def test_alias_resolves_to_target(self, tmp_path) -> None:
+        db = self._make_db(tmp_path)
+        result = classify_expression("myalias sub1", database=db)
+        target_result = classify_expression("target sub1", database=db)
+        assert result.classification == target_result.classification
+        assert result.risk == target_result.risk
+        cmd = result.commands[0]
+        # matched_rule and command reflect the alias as typed
+        assert cmd.command[0] == "myalias"
+        assert cmd.matched_rule == "myalias.sub1"
+
+    def test_alias_resolves_dangerous_subcommand(self, tmp_path) -> None:
+        db = self._make_db(tmp_path)
+        result = classify_expression("myalias sub2", database=db)
+        assert result.classification == Classification.DANGEROUS
+        assert result.commands[0].matched_rule == "myalias.sub2"
+
+    def test_dangling_alias_raises(self, tmp_path) -> None:
+        import pytest
+
+        (tmp_path / "myalias.yaml").write_text("command: myalias\nalias_of: nonexistent\n")
+        from bash_classify.database import load_database
+
+        db = load_database(tmp_path)
+        with pytest.raises(ValueError, match="nonexistent"):
+            classify_expression("myalias foo", database=db)
+
+    def test_alias_chain_too_deep_raises(self, tmp_path) -> None:
+        import pytest
+
+        (tmp_path / "target.yaml").write_text("command: target\nclassification: READONLY\n")
+        (tmp_path / "mid.yaml").write_text("command: mid\nalias_of: target\n")
+        (tmp_path / "myalias.yaml").write_text("command: myalias\nalias_of: mid\n")
+        from bash_classify.database import load_database
+
+        db = load_database(tmp_path)
+        with pytest.raises(ValueError, match="alias chain too deep"):
+            classify_expression("myalias foo", database=db)

{bash_classify-0.5.0 → bash_classify-0.6.0}/tests/test_database.py

@@ -199,6 +199,45 @@ class TestStrictDefault:
         assert grep.strict is False
 
 
+class TestAliasOf:
+    def test_alias_file_parses(self, tmp_path: Path) -> None:
+        """An alias file produces a CommandDef with alias_of set."""
+        target = tmp_path / "target.yaml"
+        target.write_text("command: target\nclassification: READONLY\n")
+        alias = tmp_path / "myalias.yaml"
+        alias.write_text("command: myalias\ndescription: pointer\nalias_of: target\n")
+
+        db = load_database(tmp_path)
+        alias_def = db["myalias"]
+        assert alias_def.alias_of == "target"
+        assert alias_def.command == "myalias"
+        assert alias_def.classification is None
+        assert alias_def.subcommands == {}
+
+    def test_alias_file_with_subcommands_raises(self, tmp_path: Path) -> None:
+        """An alias file combined with classification-bearing fields is rejected."""
+        alias = tmp_path / "bad.yaml"
+        alias.write_text("command: bad\nalias_of: target\nsubcommands:\n  sub: {classification: READONLY}\n")
+        db = load_database(tmp_path)
+        with pytest.raises(ValueError, match="subcommands"):
+            db["bad"]
+
+    def test_alias_file_with_classification_raises(self, tmp_path: Path) -> None:
+        alias = tmp_path / "bad.yaml"
+        alias.write_text("command: bad\nalias_of: target\nclassification: READONLY\n")
+        db = load_database(tmp_path)
+        with pytest.raises(ValueError, match="classification"):
+            db["bad"]
+
+    def test_alias_file_only_command_description_alias_of_is_valid(self, tmp_path: Path) -> None:
+        target = tmp_path / "target.yaml"
+        target.write_text("command: target\nclassification: READONLY\n")
+        alias = tmp_path / "myalias.yaml"
+        alias.write_text('command: myalias\ndescription: "some desc"\nalias_of: target\n')
+        db = load_database(tmp_path)
+        assert db["myalias"].alias_of == "target"
+
+
 class TestUserCommandsDir:
     def test_user_override_replaces_builtin(self, tmp_path: Path) -> None:
         """User YAML overrides built-in command definition."""