safe-chains 0.220.0

Auto-allow safe bash commands in agentic coding tools
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

[[command]]
name = "seq"
aliases = ["gseq"]
description = "Generates a sequence of numbers between a start and end value, printing them to stdout. Pure computation with no filesystem writes, no network access, and no side effects beyond stdout. Ships with GNU coreutils and macOS."
url = "https://www.gnu.org/software/coreutils/manual/coreutils.html#seq-invocation"
level = "Inert"
bare = false
standalone = ["--equal-width", "--help", "--version", "-V", "-h", "-w"]
valued = ["--format", "--separator", "-f", "-s", "-t"]

# Every word of a plain `seq` is a number, so no word can contain `/` — that is the `atom` claim,
# and it is what lets `> "$SCRATCH/dx_$i.txt"` stay confined to its literal prefix.
#
# Three flags break it and all three are listed, because each one puts caller text into stdout:
# `-s`/`--separator` sets what goes BETWEEN the numbers (`seq -s / 1 4` → `1/2/3/4`), `-t` sets the
# terminator, and `-f`/`--format` is a printf format wrapping each number (`seq -f ../%g 1 4` →
# `../1`, which traverses with no separator of its own). `-w` only pads with zeros, so it keeps the
# claim.
[command.output]
locus_from = "atom"
# `-h`/`-V` are here because seq's own grammar maps them to help/version, and GNU seq's help
# prints `<https://www.gnu.org/software/coreutils/>` — slash-bearing words under a claim that says
# there are none. The long forms are voided engine-wide; short spellings are per-command because
# `-h` means human-readable elsewhere.
invalidated_by = ["--format", "--separator", "--version", "-V", "-f", "-h", "-s", "-t"]