Module guard 

Constants

PROTECTED_FILES

Functions

bash_is_safe

Hard-blocks Bash payloads unconditionally if they attempt to reference OS-critical locations

classify_bash_risk

Three-tier risk classifier for shell commands.

path_is_safe

Enforces the absolute Canonical Traversal lock on the LLM, rendering directory climbing (../) obsolete and blocking any OS-critical reads aggressively by cross-referencing global blacklists.