Module shell_allowlist 

Shell allowlist with AST-based command parsing.

Security model (Information Bottleneck principle):

• When allowlist is set: ALL segments of a compound command must be allowed (deny-by-default)
• When empty: all commands pass (backwards-compatible blocklist-only mode)
• Dangerous patterns (subshells, eval, backticks) are blocked in restricted mode

Functions

check_shell_allowlist

Checks if a command is allowed by the shell allowlist. Returns Ok(()) if allowed, Err(message) if blocked.

effective_allowlist_pub

Public accessor: the fully-resolved allowlist actually enforced by the MCP tools (base shell_allowlist + additive shell_allowlist_extra + env), deduplicated. Empty means blocklist-only mode (all commands pass). Used by lean-ctx allow and lean-ctx doctor to show users exactly what the runtime sees.

extract_all_commands_pub

Public accessor for extracting all command segments.

extract_base_command

shell_tokenize

Tokenize a shell command segment respecting single/double quotes and backslash escapes. Returns tokens with outer quotes stripped, matching how the shell would parse them. E.g. git -C "Program Files" status → ["git", "-C", "Program Files", "status"]