bash-classify 0.5.0__tar.gz → 0.7.0__tar.gz

{bash_classify-0.5.0 → bash_classify-0.7.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.5.0",
+      "version": "0.7.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.5.0 → bash_classify-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.5.0
+Version: 0.7.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify
@@ -33,7 +33,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 150+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
@@ -86,10 +86,12 @@ Once installed, any Bash tool call with `risk: LOW` is auto-approved — no perm
 
 ## Command database
 
-The classification database includes 120+ command definitions covering common Unix utilities, package managers, container tools, cloud CLIs, and more.
+bash-classify loads command definitions from two locations:
 
-- See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands
-- YAML definitions are validated against a JSON Schema for IDE autocomplete and CI checks
+- **Built-in database** — 150+ command definitions bundled with the package, covering common Unix utilities, package managers, container tools, cloud CLIs, and more. Lives in `src/bash_classify/commands/*.yaml`.
+- **User database** — your own command definitions at `~/.config/bash-classify/commands/*.yaml` (override the location with the `BASH_CLASSIFY_CONFIG_DIR` env var, which resolves to `$BASH_CLASSIFY_CONFIG_DIR/commands/`). User files with the same name as a built-in override it completely, so you can customize classifications for internal tools, company-specific wrappers, or personal CLIs without forking the repo.
+
+Both directories use the same YAML format. See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands. YAML definitions are validated against a [JSON Schema](schemas/command.schema.json) for IDE autocomplete and CI checks.
 
 ## Classification levels
 
@@ -118,7 +120,9 @@ Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
 - **YAML command database** -- each command has classification rules with subcommand and option matching
 - **Subcommand matching** -- `kubectl get` and `kubectl delete` can have different classifications
+- **Multi-goal build tools** -- `subcommand_mode: match_all` handles commands like `mvn clean install` and `gradle clean build test` where multiple goals can be combined in any order
 - **Delegation for wrappers** -- commands like `xargs`, `sudo`, and `env` delegate classification to the inner command
+- **File path detection** -- redirect operators (`>`, `>>`, `<`) are parsed into `write_paths`/`read_paths` in the output; writes to `/tmp` and `/var/tmp` stay at LOW risk
 
 ## Python API
 

{bash_classify-0.5.0 → bash_classify-0.7.0}/README.md

@@ -4,7 +4,7 @@ Classify bash commands by their side-effect risk level.
 
 ## What it does
 
-bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 120+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
+bash-classify parses bash expressions using tree-sitter, classifies each command against a database of 150+ known commands, and outputs a structured JSON verdict. Commands are classified along two axes: **classification** (`READONLY`, `LOCAL_EFFECTS`, `EXTERNAL_EFFECTS`, `DANGEROUS`, `UNKNOWN`) describing what kind of effects a command has, and **risk** (`LOW`, `MEDIUM`, `HIGH`) describing how worried you should be.
 
 Designed primarily as a [Claude Code](https://docs.anthropic.com/en/docs/claude-code) hook to automatically allow low-risk commands while flagging risky ones for human review.
 
@@ -57,10 +57,12 @@ Once installed, any Bash tool call with `risk: LOW` is auto-approved — no perm
 
 ## Command database
 
-The classification database includes 120+ command definitions covering common Unix utilities, package managers, container tools, cloud CLIs, and more.
+bash-classify loads command definitions from two locations:
 
-- See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands
-- YAML definitions are validated against a JSON Schema for IDE autocomplete and CI checks
+- **Built-in database** — 150+ command definitions bundled with the package, covering common Unix utilities, package managers, container tools, cloud CLIs, and more. Lives in `src/bash_classify/commands/*.yaml`.
+- **User database** — your own command definitions at `~/.config/bash-classify/commands/*.yaml` (override the location with the `BASH_CLASSIFY_CONFIG_DIR` env var, which resolves to `$BASH_CLASSIFY_CONFIG_DIR/commands/`). User files with the same name as a built-in override it completely, so you can customize classifications for internal tools, company-specific wrappers, or personal CLIs without forking the repo.
+
+Both directories use the same YAML format. See [docs/classification-guidance.md](docs/classification-guidance.md) for how to add new commands. YAML definitions are validated against a [JSON Schema](schemas/command.schema.json) for IDE autocomplete and CI checks.
 
 ## Classification levels
 
@@ -89,7 +91,9 @@ Risk defaults are derived from classification (`READONLY`→LOW, `LOCAL_EFFECTS`
 - **Tree-sitter parsing** -- bash expressions are parsed into an AST for accurate command extraction, handling pipes, subshells, and command substitution
 - **YAML command database** -- each command has classification rules with subcommand and option matching
 - **Subcommand matching** -- `kubectl get` and `kubectl delete` can have different classifications
+- **Multi-goal build tools** -- `subcommand_mode: match_all` handles commands like `mvn clean install` and `gradle clean build test` where multiple goals can be combined in any order
 - **Delegation for wrappers** -- commands like `xargs`, `sudo`, and `env` delegate classification to the inner command
+- **File path detection** -- redirect operators (`>`, `>>`, `<`) are parsed into `write_paths`/`read_paths` in the output; writes to `/tmp` and `/var/tmp` stay at LOW risk
 
 ## Python API
 

{bash_classify-0.5.0 → bash_classify-0.7.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

bash_classify-0.7.0/coding-agent-plugins/claude-code/hooks/hook-permission-request.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Fallback hook: PreToolUse isn't consistently fired from subagents, so we
+# also classify on PermissionRequest (just before the user sees the dialog)
+# and auto-allow low-risk commands there.
+
+BASH_CLASSIFY=""
+if command -v bash-classify &>/dev/null; then
+  BASH_CLASSIFY="bash-classify"
+elif [[ -x "$HOME/.local/bin/bash-classify" ]]; then
+  BASH_CLASSIFY="$HOME/.local/bin/bash-classify"
+else
+  exit 0
+fi
+
+input=$(cat)
+
+command=$(echo "$input" | jq -r '.tool_input.command // empty')
+
+if [[ -z "$command" ]]; then
+  exit 0
+fi
+
+classification_output=$(echo "$command" | "$BASH_CLASSIFY" 2>/dev/null) || true
+
+if [[ -z "$classification_output" ]]; then
+  exit 0
+fi
+
+risk=$(echo "$classification_output" | jq -r '.risk // empty')
+
+if [[ "$risk" == "LOW" ]]; then
+  echo '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}'
+fi
+
+exit 0

bash_classify-0.7.0/coding-agent-plugins/claude-code/hooks/hooks.json

@@ -0,0 +1,31 @@
+{
+  "description": "Auto-allow low-risk bash commands using bash-classify",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/hook-pre-tool-use.sh",
+            "timeout": 10,
+            "statusMessage": "Classifying bash command..."
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/hook-permission-request.sh",
+            "timeout": 10,
+            "statusMessage": "Classifying bash command..."
+          }
+        ]
+      }
+    ]
+  }
+}

{bash_classify-0.5.0 → bash_classify-0.7.0}/docs/classification-guidance.md

@@ -236,6 +236,12 @@ subcommands:
 
 Some commands do not do work themselves -- they delegate to an inner command. bash-classify models this with `delegates_to`, which tells the matcher how to extract the inner command's argv and classify it recursively.
 
+### Pure-wrapper rule of thumb
+
+For commands that are pure passthroughs -- they do nothing themselves beyond running the inner command (e.g. `env`, `xargs`, `mise exec`, `pnpm exec`) -- **omit `classification`**. The missing base defaults to `READONLY`, which is the identity element for severity-max against the delegated inner: the inner command's classification is what surfaces. Writing `classification: READONLY` explicitly on a pure wrapper is misleading -- it reads as "this command is safe" when the real intent is "inherit from whatever I wrap."
+
+Only set a non-`READONLY` base when the wrapper itself contributes risk regardless of the inner (e.g. `sudo` is `EXTERNAL_EFFECTS` because it elevates privileges) or when the wrapper also has a meaningful standalone behavior that isn't READONLY.
+
 ### `rest_are_argv`
 
 All remaining positional args (after the wrapper's own options) form the inner command.
@@ -244,7 +250,7 @@ All remaining positional args (after the wrapper's own options) form the inner c
 
 ```yaml
 command: xargs
-classification: READONLY
+# classification omitted -- pure passthrough, inherits from inner
 delegates_to:
   mode: rest_are_argv
 options:
@@ -267,7 +273,7 @@ delegates_to:
 
 ```yaml
 command: env
-classification: READONLY
+# classification omitted -- pure passthrough
 delegates_to:
   mode: rest_are_argv
   strip_assignments: true     # strip leading KEY=VALUE tokens

{bash_classify-0.5.0 → bash_classify-0.7.0}/schemas/command.schema.json

@@ -6,6 +6,28 @@
   "type": "object",
   "required": ["command"],
   "additionalProperties": false,
+  "oneOf": [
+    {
+      "description": "Alias file: points at another command, mutually exclusive with classification-bearing fields",
+      "required": ["alias_of"],
+      "not": {
+        "anyOf": [
+          {"required": ["classification"]},
+          {"required": ["risk"]},
+          {"required": ["subcommands"]},
+          {"required": ["options"]},
+          {"required": ["global_options"]},
+          {"required": ["subcommand_mode"]},
+          {"required": ["delegates_to"]},
+          {"required": ["strict"]}
+        ]
+      }
+    },
+    {
+      "description": "Regular command definition",
+      "not": {"required": ["alias_of"]}
+    }
+  ],
   "properties": {
     "command": {
       "type": "string",
@@ -15,6 +37,10 @@
       "type": "string",
       "description": "Short description of the tool"
     },
+    "alias_of": {
+      "type": "string",
+      "description": "Name of another command in the database whose definition should be used verbatim. Mutually exclusive with classification/risk/subcommands/options/global_options/subcommand_mode/delegates_to/strict."
+    },
     "classification": {
       "$ref": "#/$defs/Classification"
     },

{bash_classify-0.5.0 → bash_classify-0.7.0}/src/bash_classify/commands/env.yaml

@@ -1,7 +1,6 @@
 # $schema: ../../../schemas/command.schema.json
 command: env
 description: "Run a program in a modified environment"
-classification: READONLY
 global_options:
   --help: {overrides: READONLY}
 delegates_to: