shellguard

package

v0.1.0-p8a.1 Latest Latest Go to latest Published: Aug 10, 2026 License: MIT Imports: 6 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/bogdanovich/mintclaw

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func ClassifyCommand(command string) string
func ExpandPowerShellEnvVars(cmd string) string
func StripQuotedHeredocBodies(command string) string
type Config
type Decision
type Validator
- func New(config Config) *Validator
- func (v *Validator) Validate(command, cwd string) Decision

Constants ¶

View Source

const (
	CommandClassReadOnly    = "read_only"
	CommandClassWrite       = "write"
	CommandClassDestructive = "destructive"
	CommandClassUnknown     = "unknown"
)

View Source

const (
	PermissionModeDefault  = ""
	PermissionModeReadOnly = "read_only"
)

Variables ¶

This section is empty.

Functions ¶

func ClassifyCommand ¶

func ClassifyCommand(command string) string

ClassifyCommand returns a conservative semantic class for a shell command. This is informational today; policy layers can use it later for mode-aware approval/read-only decisions without duplicating command parsing.

func ExpandPowerShellEnvVars ¶

func ExpandPowerShellEnvVars(cmd string) string

ExpandPowerShellEnvVars expands PowerShell/CMD environment variable syntax.

func StripQuotedHeredocBodies ¶

func StripQuotedHeredocBodies(command string) string

StripQuotedHeredocBodies removes quoted heredoc bodies before deny-pattern checks.

Types ¶

type Config ¶

type Config struct {
	BuiltInDenyPatterns []*regexp.Regexp
	CustomDenyPatterns  []*regexp.Regexp
	AllowPatterns       []*regexp.Regexp
	CustomAllowPatterns []*regexp.Regexp
	AllowedPathPatterns []*regexp.Regexp
	RestrictToWorkspace bool
	PermissionMode      string
}

Config contains the policy inputs needed to validate a shell command.

type Decision ¶

type Decision struct {
	Allowed      bool
	Reason       string
	Category     string
	CommandClass string
}

Decision is a structured command validation result.

type Validator ¶

type Validator struct {
	// contains filtered or unexported fields
}

Validator validates shell commands before execution.

func New ¶

func New(config Config) *Validator

New returns a reusable shell command validator.

func (*Validator) Validate ¶

func (v *Validator) Validate(command, cwd string) Decision

Validate applies deny/allow/path checks without executing the command.

Source Files ¶

View all Source files

validator.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL