safe-chains 0.197.0

Auto-allow safe bash commands in agentic coding tools
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

[[command]]
name = "pyenv"
description = "Python version manager that selects which Python installation under $PYENV_ROOT/versions is active per directory, shell, or globally via shim wrappers on PATH. The covered read-only subcommands (versions, version, version-name, version-file, version-origin, which, whence, prefix, root, shims, hooks, commands, completions) inspect local state without modifying anything. SafeWrite subcommands operate entirely on local files: install (downloads python source via the python-build plugin and compiles it under $PYENV_ROOT/versions; running build scripts under the user-trusted-environment model, same posture as pip install running setup.py), uninstall (removes a version directory), local (writes .python-version in cwd; can take multiple versions for multi-Python projects), global (writes $PYENV_ROOT/version), shell (sets the PYENV_VERSION env var — only meaningful when invoked through the pyenv() shell function), and rehash (regenerates shim files). The init subcommand prints shell init code when invoked with `-` (full init, canonical: `eval \"$(pyenv init - bash)\"`) or `--path` (PATH-only init); the optional `--no-rehash` and `--no-push-path` toggles tune what is emitted. No remote service interaction beyond the source-tarball download performed by python-build during install."
url = "https://github.com/pyenv/pyenv#readme"
researched_version = "v2.7.1 (2026-06-03)"
bare_flags = ["--help", "--version", "-V", "-h"]
examples_safe = [
    "pyenv versions",
    "pyenv version",
    "pyenv which python",
    "eval \"$(pyenv init -)\"",
    "eval \"$(pyenv init - bash)\"",
    "eval \"$(pyenv init --path zsh --no-rehash)\"",
]
examples_denied = [
    "pyenv init bash",
    "pyenv init --install",
    "eval \"$(pyenv init bash)\"",
    "eval \"$(pyenv init --install)\"",
    "eval \"$(pyenv init - --help)\"",
    "eval \"$(pyenv init - $SHELL)\"",
]

[[command.sub]]
name = "help"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "root"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "shims"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "version"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "versions"
standalone = ["--bare", "--help", "--skip-aliases", "-h"]

[[command.sub]]
name = "which"
bare = false
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "whence"
bare = false
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "prefix"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "hooks"
bare = false
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "version-name"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "version-file"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "version-origin"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "commands"
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "completions"
bare = false
standalone = ["--bare", "--help", "-h"]

[[command.sub]]
name = "install"
level = "SafeWrite"
standalone = [
    "--debug", "--force", "--help", "--keep", "--list", "--patch",
    "--skip-existing", "--verbose", "--version",
    "-f", "-g", "-h", "-k", "-l", "-p", "-s", "-v",
]

[[command.sub]]
name = "uninstall"
level = "SafeWrite"
bare = false
standalone = ["--force", "--help", "-f", "-h"]

[[command.sub]]
name = "local"
level = "SafeWrite"
standalone = ["--force", "--help", "--unset", "-f", "-h"]

[[command.sub]]
name = "global"
level = "SafeWrite"
bare = false
standalone = ["--help", "-h"]

[[command.sub]]
name = "shell"
level = "SafeWrite"
standalone = ["--help", "--unset", "-h"]

[[command.sub]]
name = "rehash"
level = "SafeWrite"
standalone = ["--help", "-h"]

[[command.sub]]
name = "exec"
candidate = true

[[command.sub]]
name = "init"
level = "Inert"
bare = false
max_positional = 1
standalone = ["-", "--help", "--no-push-path", "--no-rehash", "--path", "-h"]
require_any = ["-", "--path"]
eval_safe = true
eval_safe_flags = ["-", "--no-push-path", "--no-rehash", "--path"]