plugin-scanner 2.0.1074__tar.gz → 2.0.1075__tar.gz

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.1074
+Version: 2.0.1075
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://hol.org/guard
 Project-URL: Documentation, https://github.com/hashgraph-online/hol-guard/tree/main/docs/guard
@@ -166,6 +166,9 @@ pipx run hol-guard supply-chain sync
 pipx run hol-guard supply-chain scan
 pipx run hol-guard supply-chain explain minimist@1.2.5 --ecosystem npm
 pipx run hol-guard explain install-connect
+pipx run hol-guard command test 'git reset --hard HEAD~1'
+pipx run hol-guard command explain 'grep "rm -rf|git clean" README.md'
+pipx run hol-guard command extensions
 ```
 
 What you get from Guard:
@@ -179,6 +182,22 @@ What you get from Guard:
 
 See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local flow.
 
+### Inspect command protection without running it
+
+Command safety extensions make Guard's existing shell, Git, filesystem, data-protection, container, Kubernetes,
+encoded-execution, and self-protection behavior inspectable. They are built-in capability boundaries over the same
+parser used by harness hooks, not downloadable regex bundles.
+
+Use `command test` for a concise classification and `command explain` for the complete evaluation trace. Both are
+side-effect free: they do not execute the command, evaluate final policy, create an approval, or record a receipt.
+Use `--json` for a stable automation contract.
+
+```bash
+hol-guard command test 'rm -rf ./build'
+hol-guard command explain 'grep "rm -rf|git clean" README.md'
+hol-guard command extensions command.shell-mutations --json
+```
+
 <details>
 <summary>Guard commands at a glance</summary>
 

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/README.md

@@ -118,6 +118,9 @@ pipx run hol-guard supply-chain sync
 pipx run hol-guard supply-chain scan
 pipx run hol-guard supply-chain explain minimist@1.2.5 --ecosystem npm
 pipx run hol-guard explain install-connect
+pipx run hol-guard command test 'git reset --hard HEAD~1'
+pipx run hol-guard command explain 'grep "rm -rf|git clean" README.md'
+pipx run hol-guard command extensions
 ```
 
 What you get from Guard:
@@ -131,6 +134,22 @@ What you get from Guard:
 
 See [docs/guard/get-started.md](docs/guard/get-started.md) for the full local flow.
 
+### Inspect command protection without running it
+
+Command safety extensions make Guard's existing shell, Git, filesystem, data-protection, container, Kubernetes,
+encoded-execution, and self-protection behavior inspectable. They are built-in capability boundaries over the same
+parser used by harness hooks, not downloadable regex bundles.
+
+Use `command test` for a concise classification and `command explain` for the complete evaluation trace. Both are
+side-effect free: they do not execute the command, evaluate final policy, create an approval, or record a receipt.
+Use `--json` for a stable automation contract.
+
+```bash
+hol-guard command test 'rm -rf ./build'
+hol-guard command explain 'grep "rm -rf|git clean" README.md'
+hol-guard command extensions command.shell-mutations --json
+```
+
 <details>
 <summary>Guard commands at a glance</summary>
 

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/docs/guard/get-started.md

@@ -128,6 +128,8 @@ For security reviews, sales conversations, and GRC packets, see the
 | I need to remove Guard from this machine | `hol-guard uninstall --self` | Can Guard disconnect its managed harnesses, remove package shims and local state, then uninstall itself cleanly? |
 | I need install/connect docs | `hol-guard explain install-connect` | Which local-first setup and optional cloud commands should I share? |
 | I need to preview one install before I run it | `hol-guard protect npm install <package> --dry-run` | Would Guard allow, warn, review, or block this exact install request right now? |
+| I need to understand command protection | `hol-guard command test '<command>'` or `hol-guard command explain '<command>'` | Which built-in command safety extension recognizes this command, and why, without executing it or creating Guard state? |
+| I need the command protection catalog | `hol-guard command extensions` | Which built-in command safety extensions and action classes are available in this Guard version? |
 | I need setup or runtime troubleshooting | `hol-guard doctor <harness>` | Why is this harness or Guard runtime not behaving correctly? |
 | A launch was blocked or changed | `hol-guard diff <harness>` | What changed since the last recorded snapshot? |
 | I need to resolve a queued block | `hol-guard approvals` | Which requests are waiting, and how do I approve or deny them? |

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.1074"
+version = "2.0.1075"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.1074"
+version = "2.0.1075"
 description = "Open-source antivirus and runtime protection for AI agents, tools, MCP servers, plugins, skills, and package installs."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/cli.py

@@ -248,6 +248,7 @@ def _resolve_legacy_args(
         "preflight",
         "diff",
         "test-eval",
+        "command",
         "receipts",
         "history",
         "inventory",

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/guard/cli/commands_dispatch_local.py

@@ -21,6 +21,31 @@ if TYPE_CHECKING:
 from ._commands_shared import *
 from .commands_parser_helpers import *
 
+def _run_guard_command_inspection_command(
+    args: argparse.Namespace,
+    *,
+    input_text: str | None = None,
+    output_stream: TextIO | None = None,
+) -> int:
+    from ..runtime.command_inspection import command_extensions_payload, inspect_command
+
+    command_command = str(getattr(args, "command_command", ""))
+    try:
+        if command_command == "extensions":
+            payload = command_extensions_payload(getattr(args, "extension_id", None))
+            _emit("command-extensions", payload, bool(getattr(args, "json", False)))
+            return 0
+        if command_command not in {"test", "explain"}:
+            print("Choose command test, command explain, or command extensions.", file=sys.stderr)
+            return 2
+        payload = inspect_command(str(getattr(args, "command_text", "")), cwd=Path.cwd(), home_dir=Path.home())
+    except ValueError as error:
+        print(f"Error: {error}", file=sys.stderr)
+        return 2
+    payload["mode"] = command_command
+    _emit("command-inspection", payload, bool(getattr(args, "json", False)))
+    return 0
+
 def _run_guard_scan_command(
     args: argparse.Namespace,
     *,
@@ -392,6 +417,7 @@ def _run_guard_mcp_command(
 __all__ = [
     "_run_guard_apps_command",
     "_run_guard_bootstrap_command",
+    "_run_guard_command_inspection_command",
     "_run_guard_dashboard_command",
     "_run_guard_detect_command",
     "_run_guard_init_command",

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/guard/cli/commands_parser.py

@@ -51,7 +51,7 @@ def _configure_guard_parser(guard_parser: argparse.ArgumentParser) -> None:
         parser_class=FriendlyArgumentParser,
         metavar=(
             "{start,status,dashboard,init,apps,bootstrap,detect,install,update,uninstall,package-shims,run,protect,preflight,scan,diff,"
-            "test-eval,"
+            "test-eval,command,"
             "receipts,inventory,abom,aibom,approvals,explain,allow,deny,policies,trust,exceptions,advisories,events,doctor,connect,"
             "remote-pair,disconnect,"
             "login,sync,device,commands,bridge,mcp}"

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/guard/cli/commands_parser_local.py

@@ -168,6 +168,28 @@ def _configure_guard_local_parsers(
     protect_parser.add_argument("--package-shim-ui", action="store_true", help=argparse.SUPPRESS)
     protect_parser.add_argument("protect_command", nargs=argparse.REMAINDER)
 
+    command_parser = guard_subparsers.add_parser(
+        "command",
+        help="Inspect commands and built-in command safety extensions without executing anything",
+    )
+    command_subparsers = command_parser.add_subparsers(dest="command_command", required=True, metavar="COMMAND")
+    for command_name in ("test", "explain"):
+        inspect_parser = command_subparsers.add_parser(
+            command_name,
+            help=f"{command_name.title()} how Guard classifies one shell command",
+        )
+        inspect_parser.add_argument(
+            "command_text",
+            help="Exact shell command to inspect; quote to preserve shell syntax",
+        )
+        inspect_parser.add_argument("--json", action="store_true")
+    extensions_parser = command_subparsers.add_parser(
+        "extensions",
+        help="List or inspect built-in command safety extensions",
+    )
+    extensions_parser.add_argument("extension_id", nargs="?")
+    extensions_parser.add_argument("--json", action="store_true")
+
     preflight_parser = guard_subparsers.add_parser(
         "preflight",
         help="Scan an artifact before you add it to a harness config or install path",

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/guard/cli/commands_router.py

@@ -16,6 +16,7 @@ from ._commands_shared import *
 from .commands_parser_helpers import *
 
 _EARLY_HANDLERS = {
+    "command": "_run_guard_command_inspection_command",
     "scan": "_run_guard_scan_command",
     "preflight": "_run_guard_preflight_command",
     "mcp": "_run_guard_mcp_command",

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py

@@ -14,6 +14,7 @@ if TYPE_CHECKING:
     from .commands_support_prompts import _prompt_request_classes, _prompt_requires_hard_block
 
 
+from ..runtime.command_extensions import risk_classes_for_command_action
 from ..store import _runtime_scoped_exact_match_key, runtime_tool_action_exact_match_context
 from ..text import ensure_terminal_punctuation as _ensure_terminal_punctuation
 from ._commands_shared import *
@@ -434,22 +435,7 @@ def _runtime_artifact_risk_classes(artifact: GuardArtifact) -> list[str]:
     action_class = artifact.metadata.get("action_class")
     if not isinstance(action_class, str):
         return []
-    action_risk_classes = {
-        "credential exfiltration shell command": [
-            "data_flow_exfiltration",
-            "credential_exfiltration",
-            "network_egress",
-        ],
-        "guard-managed config write": ["destructive_shell"],
-        "docker-sensitive command": ["network_egress", "destructive_shell"],
-        "docker client config access": ["local_secret_read"],
-        "encoded or encrypted shell command": ["encoded_execution"],
-        "kubernetes secret read command": ["local_secret_read"],
-        "shell file upload command": ["credential_exfiltration", "network_egress"],
-        "sensitive local file write": ["destructive_shell", "local_secret_read"],
-        "destructive shell command": ["destructive_shell"],
-    }
-    return action_risk_classes.get(action_class.strip().lower(), [])
+    return list(risk_classes_for_command_action(action_class))
 
 def _guard_settings_payload(config: GuardConfig) -> dict[str, object]:
     return {

{plugin_scanner-2.0.1074 → plugin_scanner-2.0.1075}/src/codex_plugin_scanner/guard/cli/render.py

@@ -479,6 +479,84 @@ def _render_init(console: Console, payload: dict[str, object]) -> None:
     console.print(_build_steps_panel(_coerce_dict_list(payload.get("next_steps"))))
 
 
+def _render_command_inspection(console: Console, payload: dict[str, object]) -> None:
+    status = str(payload.get("status") or "invalid")
+    classification = _coerce_object_dict(payload.get("classification"))
+    extensions = _coerce_dict_list(payload.get("extensions"))
+    risk_classes = _coerce_string_list(payload.get("risk_classes"))
+    border_style = "yellow" if status == "review" else "cyan"
+    summary = Table.grid(padding=(0, 1))
+    summary.add_row("Result", Text(status.upper(), style=f"bold {border_style}"))
+    action_class = classification.get("action_class")
+    summary.add_row("Action class", Text(str(action_class or "No sensitive action matched")))
+    if extensions:
+        summary.add_row("Extension", Text(str(extensions[0].get("extension_id") or "unknown"), style="cyan"))
+    if risk_classes:
+        summary.add_row("Risk classes", Text(", ".join(risk_classes)))
+    summary.add_row("Policy", Text("Not evaluated; this inspection creates no approvals or receipts", style="dim"))
+    console.print(Panel(summary, title="HOL Guard command inspection", border_style=border_style))
+    console.print(Panel(Syntax(str(payload.get("command") or ""), "bash", word_wrap=True), title="Command"))
+    reason = classification.get("reason")
+    if isinstance(reason, str) and reason:
+        console.print(Panel(Text(reason), title="Why", border_style=border_style))
+    if extensions:
+        alternatives = _coerce_string_list(extensions[0].get("safer_alternatives"))
+        if alternatives:
+            console.print(Panel("\n".join(f"• {item}" for item in alternatives), title="Safer approaches"))
+    if str(payload.get("mode") or "") == "explain":
+        trace = _coerce_dict_list(payload.get("trace"))
+        trace_table = Table(title="Evaluation trace", box=box.SIMPLE_HEAD, show_lines=False)
+        trace_table.add_column("Step", style="bold")
+        trace_table.add_column("Result")
+        trace_table.add_column("Detail")
+        for item in trace:
+            trace_table.add_row(
+                str(item.get("step") or ""),
+                str(item.get("result") or ""),
+                str(item.get("detail") or ""),
+            )
+        console.print(trace_table)
+
+
+def _render_command_extensions(console: Console, payload: dict[str, object]) -> None:
+    extensions = _coerce_dict_list(payload.get("extensions"))
+    table = Table(title="Built-in command safety extensions", box=box.SIMPLE_HEAD, show_lines=False)
+    table.add_column("Extension", style="bold cyan", no_wrap=True)
+    table.add_column("Version", no_wrap=True)
+    table.add_column("Coverage")
+    table.add_column("Purpose")
+    for extension in extensions:
+        table.add_row(
+            str(extension.get("extension_id") or ""),
+            str(extension.get("version") or ""),
+            str(len(_coerce_string_list(extension.get("action_classes")))),
+            str(extension.get("description") or ""),
+        )
+    console.print(table)
+
+
+def _plain_text_command_inspection(payload: PayloadDict) -> str:
+    classification = _coerce_object_dict(payload.get("classification"))
+    extensions = _coerce_dict_list(payload.get("extensions"))
+    lines = [
+        f"HOL Guard command inspection: {str(payload.get('status') or 'invalid').upper()}",
+        f"Command: {payload.get('command') or ''}",
+        f"Action class: {classification.get('action_class') or 'No sensitive action matched'}",
+        f"Reason: {classification.get('reason') or ''}",
+        "Policy: Not evaluated; this inspection creates no approvals or receipts.",
+    ]
+    if extensions:
+        lines.insert(3, f"Extension: {extensions[0].get('extension_id') or 'unknown'}")
+    return "\n".join(lines)
+
+
+def _plain_text_command_extensions(payload: PayloadDict) -> str:
+    extensions = _coerce_dict_list(payload.get("extensions"))
+    lines = [f"Built-in command safety extensions ({len(extensions)})"]
+    lines.extend(f"{item.get('extension_id')} {item.get('version')} - {item.get('description')}" for item in extensions)
+    return "\n".join(lines)
+
+
 def _init_plan_panel(plan: list[dict[str, object]], status: str) -> Panel:
     table = Table.grid(padding=(0, 1))
     for step in plan:
@@ -2684,11 +2762,15 @@ def _clean_terminal_output(value: str) -> str:
 
 
 _PLAIN_TEXT_RENDERERS: dict[str, PlainTextRenderer] = {
+    "command-extensions": _plain_text_command_extensions,
+    "command-inspection": _plain_text_command_inspection,
     "protect": _plain_text_protect,
 }
 
 
 _RENDERERS: dict[str, Renderer] = {
+    "command-extensions": _render_command_extensions,
+    "command-inspection": _render_command_inspection,
     "approvals": _render_approvals,
     "init": _render_init,
     "start": _render_start,

plugin_scanner-2.0.1075/src/codex_plugin_scanner/guard/runtime/command_extensions.py

@@ -0,0 +1,206 @@
+"""Versioned metadata for Guard's built-in command safety extensions."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from typing import final
+
+COMMAND_EXTENSION_SCHEMA_VERSION = 1
+_VERSION_PATTERN = re.compile(r"^[1-9][0-9]*\.[0-9]+\.[0-9]+$")
+
+_ACTION_RISK_CLASSES: dict[str, tuple[str, ...]] = {
+    "credential exfiltration shell command": (
+        "data_flow_exfiltration",
+        "credential_exfiltration",
+        "network_egress",
+    ),
+    "guard-managed config write": ("destructive_shell",),
+    "docker-sensitive command": ("network_egress", "destructive_shell"),
+    "docker client config access": ("local_secret_read",),
+    "encoded or encrypted shell command": ("encoded_execution",),
+    "kubernetes secret read command": ("local_secret_read",),
+    "shell file upload command": ("credential_exfiltration", "network_egress"),
+    "sensitive local file write": ("destructive_shell", "local_secret_read"),
+    "destructive shell command": ("destructive_shell",),
+    "guard approval self-authorization command": ("policy_bypass",),
+    "github pr body shell substitution": ("execution",),
+}
+
+
+def risk_classes_for_command_action(action_class: str) -> tuple[str, ...]:
+    """Return the existing runtime risk classes for a command action class."""
+
+    return _ACTION_RISK_CLASSES.get(action_class.strip().lower(), ())
+
+
+@dataclass(frozen=True, slots=True)
+class CommandSafetyExtension:
+    """An inspectable capability boundary over existing command detection."""
+
+    extension_id: str
+    version: str
+    name: str
+    description: str
+    action_classes: tuple[str, ...]
+    risk_classes: tuple[str, ...]
+    safer_alternatives: tuple[str, ...]
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "schema_version": COMMAND_EXTENSION_SCHEMA_VERSION,
+            "extension_id": self.extension_id,
+            "version": self.version,
+            "name": self.name,
+            "description": self.description,
+            "enabled": True,
+            "source": "built-in",
+            "action_classes": list(self.action_classes),
+            "risk_classes": list(self.risk_classes),
+            "safer_alternatives": list(self.safer_alternatives),
+        }
+
+
+@final
+class CommandSafetyExtensionRegistry:
+    """Validated, deterministic registry of command safety extensions."""
+
+    def __init__(self, extensions: tuple[CommandSafetyExtension, ...]) -> None:
+        ordered = tuple(sorted(extensions, key=lambda extension: extension.extension_id))
+        by_id: dict[str, CommandSafetyExtension] = {}
+        by_action_class: dict[str, CommandSafetyExtension] = {}
+        for extension in ordered:
+            _validate_extension(extension)
+            if extension.extension_id in by_id:
+                raise ValueError(f"Duplicate command safety extension ID: {extension.extension_id}")
+            by_id[extension.extension_id] = extension
+            for action_class in extension.action_classes:
+                normalized_action_class = action_class.strip().lower()
+                owner = by_action_class.get(normalized_action_class)
+                if owner is not None:
+                    ownership = f"{owner.extension_id} and {extension.extension_id}"
+                    raise ValueError(f"Command action class {action_class!r} is owned by both {ownership}")
+                by_action_class[normalized_action_class] = extension
+                undeclared_risk_classes = set(risk_classes_for_command_action(action_class)).difference(
+                    extension.risk_classes
+                )
+                if undeclared_risk_classes:
+                    undeclared = ", ".join(sorted(undeclared_risk_classes))
+                    message = " ".join(
+                        (
+                            f"Command safety extension {extension.extension_id} does not declare runtime",
+                            f"risk classes for {action_class!r}: {undeclared}",
+                        )
+                    )
+                    raise ValueError(message)
+        self._extensions = ordered
+        self._by_id = by_id
+        self._by_action_class = by_action_class
+
+    @property
+    def extensions(self) -> tuple[CommandSafetyExtension, ...]:
+        return self._extensions
+
+    def get(self, extension_id: str) -> CommandSafetyExtension | None:
+        return self._by_id.get(extension_id.strip().lower())
+
+    def for_action_class(self, action_class: str) -> CommandSafetyExtension | None:
+        return self._by_action_class.get(action_class.strip().lower())
+
+
+def _validate_extension(extension: CommandSafetyExtension) -> None:
+    if not extension.extension_id.startswith("command."):
+        raise ValueError("Command safety extension IDs must start with 'command.'")
+    if extension.extension_id != extension.extension_id.lower():
+        raise ValueError("Command safety extension IDs must be lowercase")
+    if not _VERSION_PATTERN.fullmatch(extension.version):
+        raise ValueError(f"Invalid command safety extension version: {extension.version}")
+    if not extension.name.strip() or not extension.description.strip():
+        raise ValueError(f"Command safety extension {extension.extension_id} requires a name and description")
+    if not extension.action_classes:
+        raise ValueError(f"Command safety extension {extension.extension_id} must own an action class")
+    if len(set(extension.action_classes)) != len(extension.action_classes):
+        raise ValueError(f"Command safety extension {extension.extension_id} has duplicate action classes")
+    if not extension.risk_classes:
+        raise ValueError(f"Command safety extension {extension.extension_id} must declare a risk class")
+    if len(set(extension.risk_classes)) != len(extension.risk_classes):
+        raise ValueError(f"Command safety extension {extension.extension_id} has duplicate risk classes")
+    if not extension.safer_alternatives:
+        raise ValueError(f"Command safety extension {extension.extension_id} requires safer alternatives")
+
+
+_BUILT_IN_EXTENSIONS = (
+    CommandSafetyExtension(
+        extension_id="command.container-runtime",
+        version="1.0.0",
+        name="Container runtime protection",
+        description="Reviews container operations that can expose credentials, publish data, or mutate host state.",
+        action_classes=("docker-sensitive command", "Docker client config access"),
+        risk_classes=("network_egress", "destructive_shell", "local_secret_read"),
+        safer_alternatives=(
+            "Use a pinned image and a read-only container filesystem where possible.",
+            "Pass only the specific secret or file required by the container.",
+        ),
+    ),
+    CommandSafetyExtension(
+        extension_id="command.data-protection",
+        version="1.0.0",
+        name="Command data protection",
+        description="Detects shell flows that can send credentials or local file contents to a network destination.",
+        action_classes=("credential exfiltration shell command", "shell file upload command"),
+        risk_classes=("data_flow_exfiltration", "credential_exfiltration", "network_egress"),
+        safer_alternatives=(
+            "Send an explicit non-secret value instead of piping local files or environment output.",
+            "Use a destination allowlist and review the exact payload before transmission.",
+        ),
+    ),
+    CommandSafetyExtension(
+        extension_id="command.encoded-execution",
+        version="1.0.0",
+        name="Encoded execution protection",
+        description=(
+            "Reviews decode-and-execute flows whose effective program is hidden from normal command inspection."
+        ),
+        action_classes=("encoded or encrypted shell command",),
+        risk_classes=("encoded_execution",),
+        safer_alternatives=("Decode the payload to a file, inspect it, then invoke the reviewed file directly.",),
+    ),
+    CommandSafetyExtension(
+        extension_id="command.guard-self-protection",
+        version="1.0.0",
+        name="Guard self-protection",
+        description="Prevents commands from authorizing their own Guard approval or weakening protected Guard state.",
+        action_classes=("Guard approval self-authorization command",),
+        risk_classes=("policy_bypass",),
+        safer_alternatives=("Approve the pending request through Guard's authenticated approval surface.",),
+    ),
+    CommandSafetyExtension(
+        extension_id="command.kubernetes-secrets",
+        version="1.0.0",
+        name="Kubernetes secret protection",
+        description="Reviews Kubernetes CLI operations that can reveal cluster or application secrets.",
+        action_classes=("Kubernetes secret read command",),
+        risk_classes=("local_secret_read",),
+        safer_alternatives=("Request only the required non-secret field or metadata instead of the Secret payload.",),
+    ),
+    CommandSafetyExtension(
+        extension_id="command.shell-mutations",
+        version="1.0.0",
+        name="Shell, Git, and filesystem protection",
+        description="Reviews destructive shell, Git, filesystem, redirection, and protected configuration mutations.",
+        action_classes=(
+            "destructive shell command",
+            "guard-managed config write",
+            "sensitive local file write",
+            "GitHub PR body shell substitution",
+        ),
+        risk_classes=("destructive_shell", "local_secret_read", "execution"),
+        safer_alternatives=(
+            "Use a dry run or preview mode before a destructive operation.",
+            "Narrow the target path or Git ref and avoid recursive or forced mutation.",
+            "Use a literal body file instead of shell substitution in command arguments.",
+        ),
+    ),
+)
+
+BUILT_IN_COMMAND_EXTENSION_REGISTRY = CommandSafetyExtensionRegistry(_BUILT_IN_EXTENSIONS)