safe-chains 0.161.0

Auto-allow safe bash commands in agentic coding tools
Documentation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
[[command]]
name = "sample"
description = "macOS profiling utility that attaches to a process by PID (or partial-name match), samples its call stacks at the configured interval for the configured duration, and prints a stack-trace report to stdout. Read-only — does not modify the target process. Operates via Mach task port APIs (the same APIs Instruments uses); attaching to processes owned by other users typically requires elevated permissions and may be blocked by SIP/AMFI policy. Useful for diagnosing CPU spikes, hangs, and lock contention without launching Instruments. The -wait flag pauses until a matching process spawns. -mayDie keeps sampling even if the target exits mid-run. The -file and -html flags redirect the report to a file (write operation) and are out of coverage; to capture a profile to disk, redirect stdout instead (`sample <pid> 1 > profile.txt`). Ships with macOS; the surface is stable across releases."
url = "https://ss64.com/mac/sample.html"
level = "Inert"
bare = false
max_positional = 3
numeric_dash = true
standalone = [
    "--help", "-h",
    "-DTRACE", "-DTRACE_PROBE",
    "-e", "-fullPaths", "-mayDie",
    "-microsecondPrecision",
    "-noBinarySpec", "-noSymbolize", "-noTaskName",
    "-revSymbolicate", "-stackInfo",
    "-wait",
]
valued = ["-allMaxThreadCount"]