Module parse 

Shell command parsing and structural analysis.

This module is policy-free — it decomposes shell commands into structured representations but makes no allow/deny decisions. Consumers (agent-jj, cc-toolgate) build policy on top.

Entry points

• parse_with_substitutions — decompose a compound shell command into a recursive ParsedPipeline tree.
• parse_command — structurally parse a single command into ParsedCommand with ordered CommandArgs (flags and positionals in source order).
• resolve_command — strip transparent wrappers (env, sudo, etc.) and classify unanalyzable patterns (eval, source, shell -c).

Design principles

• Parser annotates, consumer decides. The library classifies commands; the consumer interprets classifications as policy.
• Schema-free argument parsing. ParsedCommand identifies flags syntactically (- prefix). Flag-value association requires the consumer’s knowledge of the command’s schema. Arguments are kept in source order so consumers can walk them with schema awareness.
• Fail-closed on ambiguity. Parse errors and unresolvable patterns (dynamic $cmd, eval) are surfaced, not hidden.

Re-exports

pub use shell::dump_ast;

pub use shell::has_output_redirection;

pub use shell::parse_with_substitutions;

pub use tokenize::base_command;

pub use tokenize::command_characteristics;

pub use tokenize::env_vars;

pub use tokenize::find_base_command;

pub use tokenize::parse_command;

pub use tokenize::tokenize;

pub use types::CommandArg;

pub use types::CommandCharacteristics;

pub use types::CommandConfig;

pub use types::IndirectExecution;

pub use types::Operator;

pub use types::ParseError;

pub use types::ParsedCommand;

pub use types::ParsedFlag;

pub use types::ParsedPipeline;

pub use types::Redirection;

pub use types::ResolvedCommand;

pub use types::ShellSegment;

pub use types::SubstitutionSpan;

pub use types::UnanalyzableCommand;

pub use types::WrapperSpec;

Modules

shell

Shell command parsing backed by tree-sitter-bash.

tokenize

types

Functions

default_command_config

Return the embedded default command configuration.

resolve_command

Resolve a command through the indirection layer using the default config.

resolve_command_with

Resolve a command through the indirection layer using a custom config.

strip_with_spec

Strip a wrapper command using its spec and return the remaining arguments.