safe-chains 0.196.0

Auto-allow safe bash commands in agentic coding tools
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

[[command]]
name = "nodenv"
description = "Node.js version manager modeled on rbenv that selects which Node installation under $NODENV_ROOT/versions is active per directory, shell, or globally via shim wrappers on PATH. The covered read-only subcommands (versions, version, version-name, version-file, version-origin, which, whence, prefix, root, shims, hooks, completions, help) inspect local state without modifying anything. The init subcommand with `-` prints shell init code to stdout (canonical pattern: `eval \"$(nodenv init - bash)\"`); the optional `--no-rehash` skips the rehash phase. No remote service interaction beyond the source-tarball download performed by node-build during install."
url = "https://github.com/nodenv/nodenv#readme"
researched_version = "v1.6.2 (2025-07-30)"
bare_flags = ["--help", "--version", "-V", "-h"]
examples_safe = [
    "nodenv versions",
    "nodenv version",
    "nodenv which node",
    "eval \"$(nodenv init -)\"",
    "eval \"$(nodenv init - bash)\"",
    "eval \"$(nodenv init - zsh --no-rehash)\"",
]
examples_denied = [
    "nodenv init bash",
    "nodenv init",
    "eval \"$(nodenv init bash)\"",
    "eval \"$(nodenv init - --help)\"",
    "eval \"$(nodenv init - $SHELL)\"",
]

[[command.sub]]
name = "help"
standalone = ["--help", "-h"]

[[command.sub]]
name = "root"
standalone = ["--help", "-h"]

[[command.sub]]
name = "shims"
standalone = ["--help", "-h"]

[[command.sub]]
name = "version"
standalone = ["--help", "-h"]

[[command.sub]]
name = "versions"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "which"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "whence"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "prefix"
standalone = ["--help", "-h"]

[[command.sub]]
name = "hooks"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "version-name"
standalone = ["--help", "-h"]

[[command.sub]]
name = "version-file"
standalone = ["--help", "-h"]

[[command.sub]]
name = "version-origin"
standalone = ["--help", "-h"]

[[command.sub]]
name = "completions"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "init"
level = "Inert"
bare = false
max_positional = 1
standalone = ["-", "--help", "--no-rehash", "-h"]
require_any = ["-"]
eval_safe = true
eval_safe_flags = ["-", "--no-rehash"]