bash-classify 0.7.0__tar.gz → 0.8.0__tar.gz

{bash_classify-0.7.0 → bash_classify-0.8.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.7.0",
+      "version": "0.8.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.7.0 → bash_classify-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.7.0
+Version: 0.8.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify

{bash_classify-0.7.0 → bash_classify-0.8.0}/SPEC.md

@@ -151,13 +151,13 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 ```json
 {
   "expression": "sh -c \"ls /tmp | grep log\"",
-  "classification": "DANGEROUS",
+  "classification": "READONLY",
   "directories": ["/tmp"],
   "commands": [
     {
       "command": ["sh"],
       "argv": ["sh", "-c", "ls /tmp | grep log"],
-      "classification": "DANGEROUS",
+      "classification": "READONLY",
       "matched_rule": "sh",
       "inner_commands": [
         {
@@ -850,6 +850,8 @@ The `delegates_to` field defines how a command (or option like `find -exec`) han
 | `flag` | `string` | For `flag_value_is_expression`: which flag's value to parse |
 | `strip_assignments` | `bool` | For `rest_are_argv`: strip leading `KEY=VALUE` tokens before the inner command |
 | `min_classification` | `enum` | Floor classification for the inner command (e.g. `sudo` forces at least `EXTERNAL_EFFECTS`) |
+| `delegated_classification` | `enum` | When delegation resolves at least one inner command, the wrapper's own classification drops to this value before inner-elevation is applied. Intended for pure delegation wrappers like `sh -c` / `bash -c` where the wrapper itself has no effect beyond the command it runs. Only applies when the current classification came from the command's own base (not from an option override or strict-mode escalation). |
+| `delegated_risk` | `enum` | Optional companion to `delegated_classification` — the risk floor applied when delegation resolves. Defaults to the default risk for `delegated_classification`. |
 
 ### Database field reference
 

{bash_classify-0.7.0 → bash_classify-0.8.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

{bash_classify-0.7.0 → bash_classify-0.8.0}/schemas/command.schema.json

@@ -116,6 +116,14 @@
         "min_classification": {
           "$ref": "#/$defs/Classification",
           "description": "Floor classification for the inner command"
+        },
+        "delegated_classification": {
+          "$ref": "#/$defs/Classification",
+          "description": "When delegation successfully resolves at least one inner command, the wrapper's own classification drops to this value before inner-elevation is applied. Use for pure delegation wrappers like sh/bash where the wrapper itself has no effect beyond the command it runs."
+        },
+        "delegated_risk": {
+          "$ref": "#/$defs/Risk",
+          "description": "Optional companion to delegated_classification — the risk floor applied when delegation resolves. Defaults to the default risk for delegated_classification."
         }
       }
     },

{bash_classify-0.7.0 → bash_classify-0.8.0}/src/bash_classify/commands/bash.yaml

@@ -8,6 +8,8 @@ global_options:
 delegates_to:
   mode: flag_value_is_expression
   flag: -c
+  delegated_classification: READONLY
+  delegated_risk: LOW
 options:
   -c: {takes_value: true}
   -e: {}

{bash_classify-0.7.0 → bash_classify-0.8.0}/src/bash_classify/commands/sh.yaml

@@ -7,6 +7,8 @@ global_options:
 delegates_to:
   mode: flag_value_is_expression
   flag: -c
+  delegated_classification: READONLY
+  delegated_risk: LOW
 options:
   -c: {takes_value: true}
   -e: {}

{bash_classify-0.7.0 → bash_classify-0.8.0}/src/bash_classify/database.py

@@ -289,6 +289,8 @@ def _parse_delegation_config(raw: dict | None) -> DelegationConfig | None:
 
     mode = DelegationMode(raw["mode"])
     min_class = _parse_classification(raw.get("min_classification"))
+    delegated_class = _parse_classification(raw.get("delegated_classification"))
+    delegated_risk = _parse_risk(raw.get("delegated_risk"))
 
     return DelegationConfig(
         mode=mode,
@@ -297,4 +299,6 @@ def _parse_delegation_config(raw: dict | None) -> DelegationConfig | None:
         flag=raw.get("flag"),
         strip_assignments=raw.get("strip_assignments", False),
         min_classification=min_class,
+        delegated_classification=delegated_class,
+        delegated_risk=delegated_risk,
     )

{bash_classify-0.7.0 → bash_classify-0.8.0}/src/bash_classify/matcher.py

@@ -248,24 +248,44 @@ def match_command(
 
     # Step 6: Handle delegation
     inner_commands: list[InnerCommandResult] = []
+    command_level_inner_count = 0
 
     # Command-level delegation
     if matched_def.delegates_to is not None:
-        inner_commands.extend(
-            _handle_delegation(
-                remaining_positional,
-                matched_def.delegates_to,
-                database,
-                argv,
-                matched_def,
-            )
+        command_level_inner = _handle_delegation(
+            remaining_positional,
+            matched_def.delegates_to,
+            database,
+            argv,
+            matched_def,
         )
+        command_level_inner_count = len(command_level_inner)
+        inner_commands.extend(command_level_inner)
 
     # Option-level delegation (e.g., find -exec)
     for opt_name, delegation_config, delegation_tokens in option_delegations:
         inner_results = _handle_option_delegation(opt_name, delegation_config, delegation_tokens, database)
         inner_commands.extend(inner_results)
 
+    # When command-level delegation actually produced inner commands, optionally
+    # drop the wrapper's own base classification to `delegated_classification`.
+    # This only applies when the current classification came from the command's
+    # own base (no option override and no strict-mode escalation) — otherwise
+    # we'd be erasing an intentional escalation.
+    if (
+        matched_def.delegates_to is not None
+        and matched_def.delegates_to.delegated_classification is not None
+        and command_level_inner_count > 0
+        and not all_overrides
+        and not (matched_def.strict and unknown_options)
+    ):
+        final_classification = matched_def.delegates_to.delegated_classification
+        if matched_def.delegates_to.delegated_risk is not None:
+            final_risk = matched_def.delegates_to.delegated_risk
+        else:
+            final_risk = _default_risk(final_classification)
+        classification_reason = f"delegated to inner via {matched_rule}"
+
     # Inner command classifications and risks affect the parent
     for inner in inner_commands:
         if inner.classification.severity() > final_classification.severity():

{bash_classify-0.7.0 → bash_classify-0.8.0}/src/bash_classify/models.py

@@ -116,6 +116,8 @@ class DelegationConfig:
     flag: str | None = None
     strip_assignments: bool = False
     min_classification: Classification | None = None
+    delegated_classification: Classification | None = None
+    delegated_risk: Risk | None = None
 
 
 @dataclass

{bash_classify-0.7.0 → bash_classify-0.8.0}/tests/test_classifier.py

@@ -105,11 +105,13 @@ class TestSpecExamples:
             'sh -c "ls /tmp | grep log"',
             database=database,
         )
-        assert result.classification == Classification.DANGEROUS
+        # sh -c with only READONLY inner commands drops the DANGEROUS floor
+        # via delegated_classification and ends up READONLY.
+        assert result.classification == Classification.READONLY
 
         sh_cmd = result.commands[0]
         assert sh_cmd.matched_rule == "sh"
-        assert sh_cmd.classification == Classification.DANGEROUS
+        assert sh_cmd.classification == Classification.READONLY
         assert len(sh_cmd.inner_commands) >= 2
 
         inner_cmds = {tuple(ic.command) for ic in sh_cmd.inner_commands}

{bash_classify-0.7.0 → bash_classify-0.8.0}/tests/test_matcher.py

@@ -553,6 +553,77 @@ class TestShFlagEqualsValue:
             pytest.skip("sh -c=value form not supported — known limitation")
 
 
+class TestDelegatedClassification:
+    """Tests for `delegated_classification` on delegates_to — sh/bash -c drops floor."""
+
+    def test_sh_c_readonly_inner(self, database: dict[str, CommandDef]) -> None:
+        """sh -c 'cat /tmp/x' -> READONLY/LOW (floor dropped, inner is READONLY)."""
+        result = match_command(_make_invocation(["sh", "-c", "cat /tmp/x"]), database)
+        assert result.classification == Classification.READONLY
+        assert result.risk == Risk.LOW
+
+    def test_bash_c_readonly_inner(self, database: dict[str, CommandDef]) -> None:
+        """bash -c 'cat /tmp/x' -> READONLY/LOW (same behavior for bash)."""
+        result = match_command(_make_invocation(["bash", "-c", "cat /tmp/x"]), database)
+        assert result.classification == Classification.READONLY
+        assert result.risk == Risk.LOW
+
+    def test_sh_c_dangerous_inner_elevates(self, database: dict[str, CommandDef]) -> None:
+        """sh -c 'rm -rf /' -> DANGEROUS (inner elevates past dropped floor)."""
+        result = match_command(_make_invocation(["sh", "-c", "rm -rf /"]), database)
+        assert result.classification == Classification.DANGEROUS
+        assert result.risk == Risk.HIGH
+
+    def test_sh_c_local_effects_inner(self, database: dict[str, CommandDef]) -> None:
+        """sh -c 'git add .' -> LOCAL_EFFECTS (inner elevates from READONLY floor)."""
+        result = match_command(_make_invocation(["sh", "-c", "git add ."]), database)
+        assert result.classification == Classification.LOCAL_EFFECTS
+        # git add is LOCAL_EFFECTS/LOW in the database
+        assert result.risk == Risk.LOW
+
+    def test_sh_without_c_preserves_base(self, database: dict[str, CommandDef]) -> None:
+        """sh alone (no -c) -> DANGEROUS/HIGH (no delegation fired, base preserved)."""
+        result = match_command(_make_invocation(["sh"]), database)
+        assert result.classification == Classification.DANGEROUS
+        assert result.risk == Risk.HIGH
+
+    def test_sh_c_empty_preserves_base(self, database: dict[str, CommandDef]) -> None:
+        """sh -c '' -> DANGEROUS (empty expression produces no inner, base preserved)."""
+        result = match_command(_make_invocation(["sh", "-c", ""]), database)
+        assert result.classification == Classification.DANGEROUS
+        assert result.risk == Risk.HIGH
+
+    def test_sudo_cat_unchanged(self, database: dict[str, CommandDef]) -> None:
+        """sudo cat x -> DANGEROUS (sudo.yaml untouched, regression test)."""
+        result = match_command(_make_invocation(["sudo", "cat", "/tmp/x"]), database)
+        assert result.classification == Classification.DANGEROUS
+
+    def test_sh_c_unknown_option_stays_dangerous(self, database: dict[str, CommandDef]) -> None:
+        """sh -c 'cat x' --bogus -> strict-mode escalation should not be dropped.
+
+        sh.yaml has default strict=true; an unknown option should escalate to
+        UNKNOWN/HIGH. The delegated_classification drop must not undo that.
+        """
+        result = match_command(_make_invocation(["sh", "--bogus", "-c", "cat /tmp/x"]), database)
+        # Inner is READONLY, but strict-mode unknown option should keep it non-READONLY.
+        assert result.classification != Classification.READONLY
+
+
+class TestShXargsIntegration:
+    """Integration: xargs sh -c 'cat x' should come out as READONLY/LOW.
+
+    This uses parse_expression to exercise the full pipeline including xargs's
+    rest_are_argv delegation wrapping sh's flag_value_is_expression delegation.
+    """
+
+    def test_xargs_sh_c_readonly(self, database: dict[str, CommandDef]) -> None:
+        from bash_classify.classifier import classify_expression
+
+        result = classify_expression("xargs -I{} sh -c 'cat {}'")
+        assert result.classification == Classification.READONLY
+        assert result.risk == Risk.LOW
+
+
 class TestGlobalOptionOverrides:
     """Global options with overrides should affect classification."""