safe_chains/
cli.rs

1use clap::Parser;
2
3#[derive(Parser)]
4#[command(name = "safe-chains")]
5#[command(about = "Auto-allow safe bash commands in agentic coding tools")]
6#[command(version)]
7#[allow(clippy::struct_excessive_bools)]
8pub struct Cli {
9    /// Command string to check (omit for Claude hook mode via stdin)
10    pub command: Option<String>,
11
12    /// Safety level threshold; only commands at or below it auto-approve. Levels, locked → open:
13    /// paranoid, reader, editor, developer, local-admin, network-admin, yolo. The legacy names
14    /// inert / safe-read / safe-write still work (mapped to paranoid / reader / developer, with a
15    /// notice). Default: developer.
16    #[arg(long)]
17    pub level: Option<String>,
18
19    /// Working directory to resolve relative paths against (as a harness hook would pass).
20    /// Pair with --root so e.g. `cd`-relative writes classify against the real directory.
21    #[arg(long)]
22    pub cwd: Option<String>,
23
24    /// Project root, so a relative path under it is worktree-local and one outside it (the
25    /// cwd having escaped the project) is scored as its real absolute target.
26    #[arg(long)]
27    pub root: Option<String>,
28
29    /// Print a per-segment breakdown of why a command would or would not auto-approve.
30    #[arg(long)]
31    pub explain: bool,
32
33    /// For a command safe-chains doesn't recognize, generate the `.safe-chains.toml` needed to
34    /// support it, and print the `[[trusted]]` pin to add to ~/.config/safe-chains.toml.
35    #[arg(long)]
36    pub suggest: bool,
37
38    /// List all supported commands in Markdown format
39    #[arg(long)]
40    pub list_commands: bool,
41
42    /// Generate mdBook command reference pages in docs/src/commands/
43    #[arg(long)]
44    pub generate_book: bool,
45
46    /// Configure the hook for the named tool (default: claude). Use --auto-detect for every installed tool.
47    #[arg(long)]
48    pub setup: bool,
49
50    /// Pair with --setup to select the target tool by name. See --list-tools.
51    #[arg(long, value_name = "NAME")]
52    pub tool: Option<String>,
53
54    /// Pair with --setup to install for every installed tool detected on this machine.
55    #[arg(long)]
56    pub auto_detect: bool,
57
58    /// Print the names of every supported integration target.
59    #[arg(long)]
60    pub list_tools: bool,
61
62    /// Hook subcommand: read this tool's stdin envelope, validate the command, write the response.
63    #[command(subcommand)]
64    pub subcommand: Option<Subcommand>,
65}
66
67#[derive(clap::Subcommand)]
68pub enum Subcommand {
69    /// Run as a runtime hook for the named tool.
70    Hook {
71        /// Tool to read/write the hook envelope for. See --list-tools.
72        #[arg(value_name = "TOOL")]
73        tool: String,
74    },
75}
safe_chains/cli.rs

safe_chains/
cli.rs
