safe-chains 0.217.0

Auto-allow safe bash commands in agentic coding tools
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

[[command]]
name = "xcrun"
description = "macOS developer tool dispatcher that locates and executes tools within the active Xcode toolchain. The query flags (--find, --show-sdk-path, --show-sdk-version, --show-sdk-build-version, --show-sdk-platform-path, --show-sdk-platform-version, --show-toolchain-path) are read-only — they print paths or version strings. When used as a wrapper (`xcrun <tool> ...`), it exec's the inner tool, so safety is delegated to that tool's allowlist. --sdk and --toolchain select which toolchain to search. Part of Xcode command-line tools; versioning follows Xcode releases."
url = "https://ss64.com/mac/xcrun.html"
researched_version = "Xcode 16 / xcrun 16.x"
bare_flags = ["--help", "--version", "-h"]
[command.wrapper]
standalone = ["-l", "-n", "-v", "--log", "--no-cache", "--verbose"]
valued = ["--sdk", "--toolchain"]

[[command.sub]]
name = "--find"
bare = false
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "--show-sdk-build-version"
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "--show-sdk-path"
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "--show-sdk-platform-path"
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "--show-sdk-platform-version"
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "--show-sdk-version"
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "--show-toolchain-path"
tolerate_unknown_short = true
tolerate_unknown_long = true

[[command.sub]]
name = "xcodebuild"
delegate_skip = 0

[[command.sub]]
name = "swift"
delegate_skip = 0

[[command.sub]]
name = "simctl"
delegate_skip = 0

[[command.sub]]
name = "devicectl"
delegate_skip = 0

[[command.sub]]
name = "actool"
delegate_skip = 0

[[command.sub]]
name = "agvtool"
delegate_skip = 0

[[command.sub]]
name = "codesign"
delegate_skip = 0

[[command.sub]]
name = "ibtool"
delegate_skip = 0

[[command.sub]]
name = "lipo"
delegate_skip = 0

[[command.sub]]
name = "pkgutil"
delegate_skip = 0

[[command.sub]]
name = "plutil"
delegate_skip = 0

[[command.sub]]
name = "spctl"
delegate_skip = 0

[[command.sub]]
name = "stapler"
delegate_skip = 0

[[command.sub]]
name = "xcresulttool"
delegate_skip = 0

[[command.sub]]
name = "xctest"
delegate_skip = 0

[[command.sub]]
name = "xctrace"
delegate_skip = 0

[[command.sub]]
name = "altool"
candidate = true

[[command.sub]]
name = "notarytool"
candidate = true

[[command.sub]]
name = "iphoneos"
candidate = true