safe-chains 0.220.0

Auto-allow safe bash commands in agentic coding tools
Documentation
[[command]]
name = "sort"
aliases = ["gsort"]
description = "Sorts lines of text from stdin or files according to various orderings (lexicographic, numeric, month, version, random), writing to stdout. May create temporary files in the directory specified by -T during large sorts, but does not modify input files. No network access and no ability to execute commands. Ships with GNU coreutils and macOS."
url = "https://www.gnu.org/software/coreutils/manual/coreutils.html#sort-invocation"
level = "Inert"
bare = true
standalone = [
    "--check", "--debug", "--dictionary-order",
    "--general-numeric-sort", "--help", "--human-numeric-sort",
    "--ignore-case", "--ignore-leading-blanks",
    "--ignore-nonprinting", "--merge", "--month-sort",
    "--numeric-sort", "--random-sort", "--reverse",
    "--stable", "--unique", "--version", "--version-sort", "--zero-terminated",
    "-C", "-M", "-R", "-V", "-b", "-c", "-d",
    "-f", "-g", "-h", "-i", "-m", "-n", "-r", "-s", "-u", "-z",
]
valued = [
    "--batch-size", "--buffer-size", "--field-separator",
    "--files0-from", "--key", "--parallel",
    "--random-source", "--sort", "--temporary-directory",
    "-S", "-T", "-k", "-t",
]

# Sorting reorders the piped lines without inventing new ones, so stdout is a permutation of the
# input and carries that stage's locus — `$(fd … | sort | head -1)`. The invalidating flags are the
# ones that stop the output being the input: `--files0-from` reads its line set from a FILE rather
# than the stream, `-o`/`--output` diverts stdout to a file (leaving nothing to substitute), and
# `-c`/`-C`/`--check` print a diagnostic instead of the lines.
[command.output]
locus_from = "stdin"
valued = [
    "--batch-size", "--buffer-size", "--field-separator", "--key", "--parallel",
    "--random-source", "--sort", "--temporary-directory",
    "-S", "-T", "-k", "-t",
]
invalidated_by = ["--files0-from", "-o", "--output", "-c", "-C", "--check", "--help", "--version", "-h", "-V"]