bash-classify 0.6.0__tar.gz → 0.8.0__tar.gz

{bash_classify-0.6.0 → bash_classify-0.8.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.6.0",
+      "version": "0.8.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.6.0 → bash_classify-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.6.0
+Version: 0.8.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify

{bash_classify-0.6.0 → bash_classify-0.8.0}/SPEC.md

@@ -151,13 +151,13 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 ```json
 {
   "expression": "sh -c \"ls /tmp | grep log\"",
-  "classification": "DANGEROUS",
+  "classification": "READONLY",
   "directories": ["/tmp"],
   "commands": [
     {
       "command": ["sh"],
       "argv": ["sh", "-c", "ls /tmp | grep log"],
-      "classification": "DANGEROUS",
+      "classification": "READONLY",
       "matched_rule": "sh",
       "inner_commands": [
         {
@@ -850,6 +850,8 @@ The `delegates_to` field defines how a command (or option like `find -exec`) han
 | `flag` | `string` | For `flag_value_is_expression`: which flag's value to parse |
 | `strip_assignments` | `bool` | For `rest_are_argv`: strip leading `KEY=VALUE` tokens before the inner command |
 | `min_classification` | `enum` | Floor classification for the inner command (e.g. `sudo` forces at least `EXTERNAL_EFFECTS`) |
+| `delegated_classification` | `enum` | When delegation resolves at least one inner command, the wrapper's own classification drops to this value before inner-elevation is applied. Intended for pure delegation wrappers like `sh -c` / `bash -c` where the wrapper itself has no effect beyond the command it runs. Only applies when the current classification came from the command's own base (not from an option override or strict-mode escalation). |
+| `delegated_risk` | `enum` | Optional companion to `delegated_classification` — the risk floor applied when delegation resolves. Defaults to the default risk for `delegated_classification`. |
 
 ### Database field reference
 

{bash_classify-0.6.0 → bash_classify-0.8.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

bash_classify-0.8.0/coding-agent-plugins/claude-code/hooks/hook-permission-request.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Fallback hook: PreToolUse isn't consistently fired from subagents, so we
+# also classify on PermissionRequest (just before the user sees the dialog)
+# and auto-allow low-risk commands there.
+
+BASH_CLASSIFY=""
+if command -v bash-classify &>/dev/null; then
+  BASH_CLASSIFY="bash-classify"
+elif [[ -x "$HOME/.local/bin/bash-classify" ]]; then
+  BASH_CLASSIFY="$HOME/.local/bin/bash-classify"
+else
+  exit 0
+fi
+
+input=$(cat)
+
+command=$(echo "$input" | jq -r '.tool_input.command // empty')
+
+if [[ -z "$command" ]]; then
+  exit 0
+fi
+
+classification_output=$(echo "$command" | "$BASH_CLASSIFY" 2>/dev/null) || true
+
+if [[ -z "$classification_output" ]]; then
+  exit 0
+fi
+
+risk=$(echo "$classification_output" | jq -r '.risk // empty')
+
+if [[ "$risk" == "LOW" ]]; then
+  echo '{"hookSpecificOutput":{"hookEventName":"PermissionRequest","decision":{"behavior":"allow"}}}'
+fi
+
+exit 0

bash_classify-0.8.0/coding-agent-plugins/claude-code/hooks/hooks.json

@@ -0,0 +1,31 @@
+{
+  "description": "Auto-allow low-risk bash commands using bash-classify",
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/hook-pre-tool-use.sh",
+            "timeout": 10,
+            "statusMessage": "Classifying bash command..."
+          }
+        ]
+      }
+    ],
+    "PermissionRequest": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/hook-permission-request.sh",
+            "timeout": 10,
+            "statusMessage": "Classifying bash command..."
+          }
+        ]
+      }
+    ]
+  }
+}

{bash_classify-0.6.0 → bash_classify-0.8.0}/docs/classification-guidance.md

@@ -236,6 +236,12 @@ subcommands:
 
 Some commands do not do work themselves -- they delegate to an inner command. bash-classify models this with `delegates_to`, which tells the matcher how to extract the inner command's argv and classify it recursively.
 
+### Pure-wrapper rule of thumb
+
+For commands that are pure passthroughs -- they do nothing themselves beyond running the inner command (e.g. `env`, `xargs`, `mise exec`, `pnpm exec`) -- **omit `classification`**. The missing base defaults to `READONLY`, which is the identity element for severity-max against the delegated inner: the inner command's classification is what surfaces. Writing `classification: READONLY` explicitly on a pure wrapper is misleading -- it reads as "this command is safe" when the real intent is "inherit from whatever I wrap."
+
+Only set a non-`READONLY` base when the wrapper itself contributes risk regardless of the inner (e.g. `sudo` is `EXTERNAL_EFFECTS` because it elevates privileges) or when the wrapper also has a meaningful standalone behavior that isn't READONLY.
+
 ### `rest_are_argv`
 
 All remaining positional args (after the wrapper's own options) form the inner command.
@@ -244,7 +250,7 @@ All remaining positional args (after the wrapper's own options) form the inner c
 
 ```yaml
 command: xargs
-classification: READONLY
+# classification omitted -- pure passthrough, inherits from inner
 delegates_to:
   mode: rest_are_argv
 options:
@@ -267,7 +273,7 @@ delegates_to:
 
 ```yaml
 command: env
-classification: READONLY
+# classification omitted -- pure passthrough
 delegates_to:
   mode: rest_are_argv
   strip_assignments: true     # strip leading KEY=VALUE tokens

{bash_classify-0.6.0 → bash_classify-0.8.0}/schemas/command.schema.json

@@ -116,6 +116,14 @@
         "min_classification": {
           "$ref": "#/$defs/Classification",
           "description": "Floor classification for the inner command"
+        },
+        "delegated_classification": {
+          "$ref": "#/$defs/Classification",
+          "description": "When delegation successfully resolves at least one inner command, the wrapper's own classification drops to this value before inner-elevation is applied. Use for pure delegation wrappers like sh/bash where the wrapper itself has no effect beyond the command it runs."
+        },
+        "delegated_risk": {
+          "$ref": "#/$defs/Risk",
+          "description": "Optional companion to delegated_classification — the risk floor applied when delegation resolves. Defaults to the default risk for delegated_classification."
         }
       }
     },

{bash_classify-0.6.0 → bash_classify-0.8.0}/src/bash_classify/commands/bash.yaml

@@ -8,6 +8,8 @@ global_options:
 delegates_to:
   mode: flag_value_is_expression
   flag: -c
+  delegated_classification: READONLY
+  delegated_risk: LOW
 options:
   -c: {takes_value: true}
   -e: {}

{bash_classify-0.6.0 → bash_classify-0.8.0}/src/bash_classify/commands/env.yaml

@@ -1,7 +1,6 @@
 # $schema: ../../../schemas/command.schema.json
 command: env
 description: "Run a program in a modified environment"
-classification: READONLY
 global_options:
   --help: {overrides: READONLY}
 delegates_to: