Module bash_patterns 

Bash command → permission patterns (upstream permission/arity.ts parity).

Upstream’s shell tool scans a command into (a) patterns — the concrete subcommands, and (b) always — an arity prefix per subcommand ("git status --short" → always "git status *"), so an “always” grant covers the whole command family. It also collects directories referenced by path-taking commands for the external_directory gate. ocserve previously used the whole command string as both pattern and always, so “always” only remembered the exact string and compound commands collapsed to one resource.

The ARITY table is pinned data extracted from the freeze (assets/permission/1.18.31.rules.json, scripts/extract-rules.sh) — the same discipline as the OpenAPI spec and web bundle. No table is hand-maintained here. It lives INSIDE this crate so it is packaged and published with it (embedding from bench/, outside the crate root, is not in the .crate tarball — the 0.3.0 defect; guard rule 30).

Structs

BashScan

A bash command’s permission surfaces: per-subcommand patterns and their always grants.

Functions

arity_prefix

Upstream BashArity.prefix: longest matching table prefix wins; fall back to the first token; empty for no tokens.

scan

Scan a bash command into (patterns, always), matching upstream shell.ts: each subcommand is a pattern; its arity prefix + “ *“ is the always grant.

split_commands

Split a shell command into subcommands, respecting quotes. Splits on the control operators upstream’s parser treats as command boundaries: &&, ||, ;, |, &, and newlines.

tokenize

Naive shell tokenizer for arity lookup: split on whitespace, keeping quoted runs together (the quotes are stripped, matching how the arity table keys are written).