bash-classify 0.7.0__tar.gz → 0.9.0__tar.gz

{bash_classify-0.7.0 → bash_classify-0.9.0}/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "bash-classify-hook",
       "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
-      "version": "0.7.0",
+      "version": "0.9.0",
       "author": {
         "name": "Filip Procházka",
         "url": "https://github.com/fprochazka"

{bash_classify-0.7.0 → bash_classify-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bash-classify
-Version: 0.7.0
+Version: 0.9.0
 Summary: Classify bash commands as READONLY, WRITE, DANGEROUS, or UNKNOWN
 Project-URL: Homepage, https://github.com/fprochazka/bash-classify
 Project-URL: Repository, https://github.com/fprochazka/bash-classify

{bash_classify-0.7.0 → bash_classify-0.9.0}/SPEC.md

@@ -132,7 +132,7 @@ $ echo 'kubectl exec -it my-pod -- cat /etc/config' | bash-classify
           "delegation_source": "--",
           "command": ["cat"],
           "argv": ["cat", "/etc/config"],
-          "classification": "READONLY",
+          "classification": "EXTERNAL_EFFECTS",
           "matched_rule": "cat",
           "inner_commands": []
         }
@@ -142,6 +142,8 @@ $ echo 'kubectl exec -it my-pod -- cat /etc/config' | bash-classify
 }
 ```
 
+Note: the `cat` inner is floored to `EXTERNAL_EFFECTS` by `kubectl exec`'s `min_classification`, and the parent expression is then escalated to `DANGEROUS` by the system-path elevation rule (touching `/etc/config`).
+
 ### Nested delegation (sh -c with full expression parsing)
 
 ```
@@ -151,13 +153,13 @@ $ echo 'sh -c "ls /tmp | grep log"' | bash-classify
 ```json
 {
   "expression": "sh -c \"ls /tmp | grep log\"",
-  "classification": "DANGEROUS",
+  "classification": "READONLY",
   "directories": ["/tmp"],
   "commands": [
     {
       "command": ["sh"],
       "argv": ["sh", "-c", "ls /tmp | grep log"],
-      "classification": "DANGEROUS",
+      "classification": "READONLY",
       "matched_rule": "sh",
       "inner_commands": [
         {
@@ -849,7 +851,10 @@ The `delegates_to` field defines how a command (or option like `find -exec`) han
 | `terminator` | `string` | For `terminated_argv`: the token that ends the inner argv |
 | `flag` | `string` | For `flag_value_is_expression`: which flag's value to parse |
 | `strip_assignments` | `bool` | For `rest_are_argv`: strip leading `KEY=VALUE` tokens before the inner command |
-| `min_classification` | `enum` | Floor classification for the inner command (e.g. `sudo` forces at least `EXTERNAL_EFFECTS`) |
+| `skip_leading_positionals` | `int` | For `rest_are_argv`: number of positional tokens that belong to the wrapper itself before the inner command starts (e.g. `timeout DURATION COMMAND...` uses `1`). Default `0`. |
+| `min_classification` | `enum` | Floor classification for the inner command (e.g. `sudo` forces at least `DANGEROUS`, `nohup` and `kubectl exec` force at least `EXTERNAL_EFFECTS`) |
+
+When command-level delegation resolves at least one inner command (and no option override or strict-mode escalation is active), the wrapper's own `classification`/`risk` are ignored — the result is determined by the inner alone, with `min_classification` available to express genuine wrapper-level side-effects (e.g., `nohup` detaches a process, `kubectl exec` runs cluster-side, `sudo` enforces a security floor). The wrapper's declared base classification still applies when delegation does not resolve (e.g., `sh` invoked without `-c`, or a delegation that produces no inner command).
 
 ### Database field reference
 

{bash_classify-0.7.0 → bash_classify-0.9.0}/coding-agent-plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "bash-classify-hook",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Auto-allows low-risk bash commands in Claude Code using bash-classify",
   "author": {
     "name": "Filip Prochazka"

{bash_classify-0.7.0 → bash_classify-0.9.0}/schemas/command.schema.json

@@ -113,6 +113,12 @@
           "type": "boolean",
           "description": "For rest_are_argv mode: strip leading KEY=VALUE tokens before the inner command"
         },
+        "skip_leading_positionals": {
+          "type": "integer",
+          "minimum": 0,
+          "default": 0,
+          "description": "For rest_are_argv mode: number of positional tokens that belong to the wrapper itself before the inner command starts. Used by commands like `timeout` whose syntax is `timeout DURATION COMMAND...`."
+        },
         "min_classification": {
           "$ref": "#/$defs/Classification",
           "description": "Floor classification for the inner command"

{bash_classify-0.7.0 → bash_classify-0.9.0}/src/bash_classify/commands/gcloud.yaml

@@ -25,6 +25,331 @@ global_options:
   --no-user-output-enabled: {}
 
 subcommands:
+  # artifacts
+  artifacts:
+    classification: EXTERNAL_EFFECTS
+    strict: false
+    subcommands:
+      apt:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          import:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          upload:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      attachments:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          describe:
+            classification: READONLY
+            strict: false
+          download:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          create:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+      docker:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          images:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+            subcommands:
+              list:
+                classification: READONLY
+                strict: false
+              describe:
+                classification: READONLY
+                strict: false
+              get-operation:
+                classification: READONLY
+                strict: false
+              list-vulnerabilities:
+                classification: READONLY
+                strict: false
+              scan:
+                classification: EXTERNAL_EFFECTS
+                strict: false
+              delete:
+                classification: DANGEROUS
+                strict: false
+          tags:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+            subcommands:
+              list:
+                classification: READONLY
+                strict: false
+              add:
+                classification: EXTERNAL_EFFECTS
+                strict: false
+              delete:
+                classification: DANGEROUS
+                strict: false
+          upgrade:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+            subcommands:
+              print-iam-policy:
+                classification: READONLY
+                strict: false
+              migrate:
+                classification: EXTERNAL_EFFECTS
+                strict: false
+      files:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          describe:
+            classification: READONLY
+            strict: false
+          download:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          update:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+      generic:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          download:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          upload:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      go:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          auth:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          upload:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      locations:
+        classification: READONLY
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+      operations:
+        classification: READONLY
+        strict: false
+        subcommands:
+          describe:
+            classification: READONLY
+            strict: false
+      packages:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          describe:
+            classification: READONLY
+            strict: false
+          update:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+      print-settings:
+        classification: READONLY
+        strict: false
+        subcommands:
+          gradle:
+            classification: READONLY
+            strict: false
+          mvn:
+            classification: READONLY
+            strict: false
+          npm:
+            classification: READONLY
+            strict: false
+          python:
+            classification: READONLY
+            strict: false
+      repositories:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          describe:
+            classification: READONLY
+            strict: false
+          get-iam-policy:
+            classification: READONLY
+            strict: false
+          list-cleanup-policies:
+            classification: READONLY
+            strict: false
+          create:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          update:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          add-iam-policy-binding:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          remove-iam-policy-binding:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          set-iam-policy:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          set-cleanup-policies:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+          delete-cleanup-policies:
+            classification: DANGEROUS
+            strict: false
+      rules:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          describe:
+            classification: READONLY
+            strict: false
+          create:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          update:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+      sbom:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          export:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          load:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      settings:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          describe:
+            classification: READONLY
+            strict: false
+          enable-upgrade-redirection:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          disable-upgrade-redirection:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      tags:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          create:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          update:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          export:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+      versions:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          describe:
+            classification: READONLY
+            strict: false
+          export:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          update:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          delete:
+            classification: DANGEROUS
+            strict: false
+      vpcsc-config:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          describe:
+            classification: READONLY
+            strict: false
+          allow:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          deny:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      vulnerabilities:
+        classification: READONLY
+        strict: false
+        subcommands:
+          list:
+            classification: READONLY
+            strict: false
+          load-vex:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+      yum:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+        subcommands:
+          import:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+          upload:
+            classification: EXTERNAL_EFFECTS
+            strict: false
+
   # compute
   compute:
     classification: EXTERNAL_EFFECTS

{bash_classify-0.7.0 → bash_classify-0.9.0}/src/bash_classify/commands/kubectl.yaml

@@ -124,6 +124,7 @@ subcommands:
     delegates_to:
       mode: after_separator
       separator: "--"
+      min_classification: EXTERNAL_EFFECTS
     options:
       -it: {}
       -i: {}

{bash_classify-0.7.0 → bash_classify-0.9.0}/src/bash_classify/commands/nohup.yaml

@@ -6,3 +6,4 @@ global_options:
   --help: {overrides: READONLY}
 delegates_to:
   mode: rest_are_argv
+  min_classification: EXTERNAL_EFFECTS

{bash_classify-0.7.0 → bash_classify-0.9.0}/src/bash_classify/commands/pnpm.yaml

@@ -234,6 +234,9 @@ subcommands:
     classification: EXTERNAL_EFFECTS
     risk: HIGH
     strict: false
+    delegates_to:
+      mode: rest_are_argv
+      min_classification: EXTERNAL_EFFECTS
 
   # --- Version bump (writes package.json, creates git commit/tag) ---
   version:

bash_classify-0.9.0/src/bash_classify/commands/rtk.yaml

@@ -0,0 +1,140 @@
+# $schema: ../../../schemas/command.schema.json
+command: rtk
+description: "CLI proxy that filters/summarizes command output for LLM context"
+classification: READONLY
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  -h: {overrides: READONLY, aliases: [--help]}
+  --version: {overrides: READONLY}
+  -V: {overrides: READONLY, aliases: [--version]}
+  -v: {}
+  --verbose: {aliases: [-v]}
+  --ultra-compact: {}
+  --skip-env: {}
+# Most rtk subcommands are thin passthroughs: `rtk <tool> <args>` runs `<tool> <args>`
+# and only filters stdout. Risk profile is identical to the inner command, so by default
+# delegate to the rest of argv. Only rtk-native subcommands (config, gain, run, etc.)
+# are enumerated below.
+delegates_to:
+  mode: rest_are_argv
+subcommands:
+  # --- rtk-native readonly inspectors / filters ---
+  read:
+    classification: READONLY
+    strict: false
+  smart:
+    classification: READONLY
+    strict: false
+  pipe:
+    classification: READONLY
+    strict: false
+  json:
+    classification: READONLY
+    strict: false
+  log:
+    classification: READONLY
+    strict: false
+  deps:
+    classification: READONLY
+    strict: false
+  rewrite:
+    classification: READONLY
+    strict: false
+  hook:
+    classification: READONLY
+    strict: false
+  hook-audit:
+    classification: READONLY
+    strict: false
+  verify:
+    classification: READONLY
+    strict: false
+  discover:
+    classification: READONLY
+    strict: false
+  session:
+    classification: READONLY
+    strict: false
+  cc-economics:
+    classification: READONLY
+    strict: false
+  gain:
+    classification: READONLY
+    strict: false
+    options:
+      --reset: {overrides: LOCAL_EFFECTS}
+  config:
+    classification: READONLY
+    strict: false
+    options:
+      --create: {overrides: LOCAL_EFFECTS}
+  learn:
+    classification: READONLY
+    strict: false
+    options:
+      -w: {overrides: LOCAL_EFFECTS}
+      --write-rules: {overrides: LOCAL_EFFECTS, aliases: [-w]}
+  telemetry:
+    classification: READONLY
+    strict: false
+    subcommands:
+      status:
+        classification: READONLY
+      enable:
+        classification: LOCAL_EFFECTS
+      disable:
+        classification: LOCAL_EFFECTS
+      forget:
+        classification: LOCAL_EFFECTS
+
+  # --- rtk-native local-effects ---
+  init:
+    classification: LOCAL_EFFECTS
+    strict: false
+  trust:
+    classification: LOCAL_EFFECTS
+    strict: false
+    options:
+      --list: {overrides: READONLY}
+  untrust:
+    classification: LOCAL_EFFECTS
+    strict: false
+
+  # --- rtk-native delegating runners (inner command is arbitrary) ---
+  # `rtk run -c "<sh>"` executes a raw shell expression; `rtk run <argv>` runs argv.
+  run:
+    classification: DANGEROUS
+    strict: false
+    options:
+      -c: {takes_value: true}
+    delegates_to:
+      mode: flag_value_is_expression
+      flag: -c
+  proxy:
+    strict: false
+    delegates_to:
+      mode: rest_are_argv
+  err:
+    strict: false
+    delegates_to:
+      mode: rest_are_argv
+  test:
+    strict: false
+    delegates_to:
+      mode: rest_are_argv
+  summary:
+    strict: false
+    delegates_to:
+      mode: rest_are_argv
+
+  # --- rtk-aliased filters (rtk subcommand name doesn't match a real tool) ---
+  # `rtk lint` runs eslint; `rtk format` is a universal format checker.
+  lint:
+    classification: READONLY
+    strict: false
+    options:
+      --fix: {overrides: LOCAL_EFFECTS}
+  format:
+    classification: READONLY
+    strict: false

bash_classify-0.9.0/src/bash_classify/commands/slack.yaml

@@ -0,0 +1,113 @@
+# $schema: ../../../schemas/command.schema.json
+command: slack
+description: "Slack CLI (https://github.com/fprochazka/slackcli) — interact with Slack workspaces"
+strict: false
+global_options:
+  --help: {overrides: READONLY}
+  -o: {takes_value: true}
+  --org: {takes_value: true, aliases: [-o]}
+  -c: {takes_value: true}
+  --config: {takes_value: true, aliases: [-c]}
+  -v: {}
+  --verbose: {}
+
+subcommands:
+  # ── Resolve ───────────────────────────────────────────────────────
+  resolve:
+    classification: READONLY
+    strict: false
+
+  # ── Config ────────────────────────────────────────────────────────
+  config:
+    classification: READONLY
+    strict: false
+
+  # ── Conversations ─────────────────────────────────────────────────
+  conversations:
+    subcommands:
+      list:
+        classification: READONLY
+        strict: false
+
+  # ── Messages ──────────────────────────────────────────────────────
+  messages:
+    subcommands:
+      list:
+        classification: READONLY
+        strict: false
+      send:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      edit:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      delete:
+        classification: DANGEROUS
+        strict: false
+
+  # ── Reactions ─────────────────────────────────────────────────────
+  reactions:
+    subcommands:
+      add:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      remove:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+
+  # ── Pins ──────────────────────────────────────────────────────────
+  pins:
+    subcommands:
+      list:
+        classification: READONLY
+        strict: false
+      add:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      remove:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+
+  # ── Scheduled ─────────────────────────────────────────────────────
+  scheduled:
+    subcommands:
+      list:
+        classification: READONLY
+        strict: false
+      create:
+        classification: EXTERNAL_EFFECTS
+        strict: false
+      delete:
+        classification: DANGEROUS
+        strict: false
+
+  # ── Search ────────────────────────────────────────────────────────
+  search:
+    subcommands:
+      messages:
+        classification: READONLY
+        strict: false
+      files:
+        classification: READONLY
+        strict: false
+
+  # ── Users ─────────────────────────────────────────────────────────
+  users:
+    subcommands:
+      list:
+        classification: READONLY
+        strict: false
+      search:
+        classification: READONLY
+        strict: false
+      get:
+        classification: READONLY
+        strict: false
+
+  # ── Files ─────────────────────────────────────────────────────────
+  files:
+    subcommands:
+      download:
+        classification: LOCAL_EFFECTS
+        risk: LOW
+        strict: false