Documentation
¶
Overview ¶
Package bash provides security classification for shell commands. Architecture ported from Claude Code's bashPermissions.ts + bashSecurity.ts: a validator chain where each validator returns allow | deny | ask | passthrough. The first non-passthrough result wins (deny-first semantics).
Validators run cheapest-first: empty check → incomplete detection → metacharacter scan → dangerous patterns → shell-specific checks.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var AllValidators = []Validator{
validateEmpty,
validateIncomplete,
validateShellSyntax,
validateShellMetacharacters,
validateDangerousPatterns,
validateZshDangerous,
validateCommandSubstitution,
validateNewlines,
validateObfuscatedFlags,
validateControlCharacters,
validateUnicodeWhitespace,
validateBraceExpansion,
}
AllValidators is the default validation chain, ordered cheapest-first.
var EnvVarSet = map[string]bool{ "HOME": true, "USER": true, "PATH": true, "PWD": true, "LANG": true, "LC_ALL": true, "TERM": true, "SHELL": true, "EDITOR": true, "VISUAL": true, "NODE_ENV": true, "GOPATH": true, "GOROOT": true, "PYTHONPATH": true, "RUST_LOG": true, "DEBUG": true, "VERBOSE": true, "CLAUDE_CODE_": true, "OVERKILL_": true, }
EnvVarSet is environment variables considered safe for prefix stripping.
Functions ¶
This section is empty.
Types ¶
type Result ¶
type Result struct {
Behavior Behavior
Message string
Reason string // machine-readable reason for logging/analytics
}
Result is a single validator's output.
func Validate ¶
Validate runs the full validator chain against the given command. Returns the first non-passthrough result (deny-first).
func ValidateWith ¶
ValidateWith runs a custom validator chain.
type ValidationCtx ¶
type ValidationCtx struct {
Command string // original, as typed
Trimmed string // whitespace-trimmed
BaseCommand string // first word (the binary/program name)
Unquoted string // single-quote content preserved, double-quote content stripped
FullyUnquoted string // all quote content removed
HasTreeSitter bool // true if AST-backed validation is available
}
ValidationCtx carries the parsed/derived forms of a shell command that validators examine.
func NewContext ¶
func NewContext(command string) ValidationCtx
NewContext parses a raw command string into a ValidationCtx.
type Validator ¶
type Validator func(ctx ValidationCtx) Result
Validator is a single security check function.
Source Files