bash-classify 0.6.0__tar.gz → 0.7.0__tar.gz

{bash_classify-0.6.0 → bash_classify-0.7.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.6.0",
+      "version": "0.7.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.6.0 → bash_classify-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.6.0
+Version: 0.7.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify

{bash_classify-0.6.0 → bash_classify-0.7.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

bash_classify-0.7.0/coding-agent-plugins/claude-code/hooks/hook-permission-request.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Fallback hook: PreToolUse isn't consistently fired from subagents, so we
+# also classify on PermissionRequest (just before the user sees the dialog)
+# and auto-allow low-risk commands there.
+
+BASH_CLASSIFY=""
+if command -v bash-classify &>/dev/null; then
+  BASH_CLASSIFY="bash-classify"
+elif [[ -x "$HOME/.local/bin/bash-classify" ]]; then
+  BASH_CLASSIFY="$HOME/.local/bin/bash-classify"
+else
+  exit 0
+fi
+
+input=$(cat)
+
+command=$(echo "$input" | jq -r '.tool_input.command // empty')
+
+if [[ -z "$command" ]]; then
+  exit 0
+fi
+
+classification_output=$(echo "$command" | "$BASH_CLASSIFY" 2>/dev/null) || true
+
+if [[ -z "$classification_output" ]]; then
+  exit 0
+fi
+
+risk=$(echo "$classification_output" | jq -r '.risk // empty')
+
+if [[ "$risk" == "LOW" ]]; then
+  echo '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}'
+fi
+
+exit 0

bash_classify-0.7.0/coding-agent-plugins/claude-code/hooks/hooks.json

@@ -0,0 +1,31 @@
+{
+  "description": "Auto-allow low-risk bash commands using bash-classify",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/hook-pre-tool-use.sh",
+            "timeout": 10,
+            "statusMessage": "Classifying bash command..."
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/hook-permission-request.sh",
+            "timeout": 10,
+            "statusMessage": "Classifying bash command..."
+          }
+        ]
+      }
+    ]
+  }
+}

{bash_classify-0.6.0 → bash_classify-0.7.0}/docs/classification-guidance.md

@@ -236,6 +236,12 @@ subcommands:
 
 Some commands do not do work themselves -- they delegate to an inner command. bash-classify models this with `delegates_to`, which tells the matcher how to extract the inner command's argv and classify it recursively.
 
+### Pure-wrapper rule of thumb
+
+For commands that are pure passthroughs -- they do nothing themselves beyond running the inner command (e.g. `env`, `xargs`, `mise exec`, `pnpm exec`) -- **omit `classification`**. The missing base defaults to `READONLY`, which is the identity element for severity-max against the delegated inner: the inner command's classification is what surfaces. Writing `classification: READONLY` explicitly on a pure wrapper is misleading -- it reads as "this command is safe" when the real intent is "inherit from whatever I wrap."
+
+Only set a non-`READONLY` base when the wrapper itself contributes risk regardless of the inner (e.g. `sudo` is `EXTERNAL_EFFECTS` because it elevates privileges) or when the wrapper also has a meaningful standalone behavior that isn't READONLY.
+
 ### `rest_are_argv`
 
 All remaining positional args (after the wrapper's own options) form the inner command.
@@ -244,7 +250,7 @@ All remaining positional args (after the wrapper's own options) form the inner c
 
 ```yaml
 command: xargs
-classification: READONLY
+# classification omitted -- pure passthrough, inherits from inner
 delegates_to:
   mode: rest_are_argv
 options:
@@ -267,7 +273,7 @@ delegates_to:
 
 ```yaml
 command: env
-classification: READONLY
+# classification omitted -- pure passthrough
 delegates_to:
   mode: rest_are_argv
   strip_assignments: true     # strip leading KEY=VALUE tokens

{bash_classify-0.6.0 → bash_classify-0.7.0}/src/bash_classify/commands/env.yaml

@@ -1,7 +1,6 @@
 # $schema: ../../../schemas/command.schema.json
 command: env
 description: "Run a program in a modified environment"
-classification: READONLY
 global_options:
   --help: {overrides: READONLY}
 delegates_to: