safe-chains 0.213.0

Auto-allow safe bash commands in agentic coding tools
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

[[command]]
name = "mocha"
description = "JavaScript testing framework that executes arbitrary user-authored test code. Test runs can perform any operation the Node.js process has access to, including filesystem writes and network requests. The --require flag loads arbitrary modules before tests run, and custom reporters execute user code. --dry-run and --list-files are read-only. Mature project in maintenance mode with infrequent releases."
url = "https://mochajs.org/"
level = "SafeRead"
standalone = [
    "--bail", "--check-leaks", "--color", "--diff", "--dry-run",
    "--exit", "--forbid-only", "--forbid-pending", "--full-trace",
    "--help", "--inline-diffs", "--invert", "--list-files",
    "--list-reporters", "--no-color", "--no-diff", "--no-timeouts",
    "--parallel", "--quiet", "--recursive", "--sort", "--version",
    "-A", "-R", "-V", "-b", "-c", "-h",
]
valued = [
    "--config", "--delay", "--extension", "--fgrep", "--file",
    "--grep", "--ignore", "--jobs", "--node-option", "--package",
    "--reporter", "--reporter-option", "--require", "--retries",
    "--slow", "--spec", "--timeout", "--ui",
    "-f", "-g", "-j", "-n", "-r", "-s", "-t", "-u",
]

# Flags whose value is a module mocha loads and executes in-process before/around the tests:
# --require/-r (the classic mocha RCE vector), --config, --file (a setup file loaded before the
# root suite), and the custom --reporter/--ui modules. Gated as executors — a worktree module runs,
# a foreign or /tmp one denies; a bare builtin name (--reporter spec, --ui bdd) passes untouched.
# Test-file SELECTION (--spec, positionals) is left ungated: running the project's tests is mocha's job.
[command.path_gate]
flags = { "--require" = "exec", "-r" = "exec", "--config" = "exec", "--file" = "exec", "--reporter" = "exec", "--ui" = "exec" }