safe_chains/
cli.rs

1use clap::Parser;
2
3#[derive(Parser)]
4#[command(name = "safe-chains")]
5#[command(about = "Auto-allow safe bash commands in agentic coding tools")]
6#[command(version)]
7#[allow(clippy::struct_excessive_bools)]
8pub struct Cli {
9    /// Command string to check (omit for Claude hook mode via stdin)
10    pub command: Option<String>,
11
12    /// Safety level threshold; only commands at or below it auto-approve. Levels, locked → open:
13    /// paranoid, reader, editor, developer, local-admin, network-admin, yolo. The legacy names
14    /// inert / safe-read / safe-write still work (mapped to paranoid / reader / developer, with a
15    /// notice). Default: developer.
16    #[arg(long)]
17    pub level: Option<String>,
18
19    /// Working directory to resolve relative paths against (as a harness hook would pass).
20    /// Pair with --root so e.g. `cd`-relative writes classify against the real directory.
21    #[arg(long)]
22    pub cwd: Option<String>,
23
24    /// Project root, so a relative path under it is worktree-local and one outside it (the
25    /// cwd having escaped the project) is scored as its real absolute target.
26    #[arg(long)]
27    pub root: Option<String>,
28
29    /// Print a per-segment breakdown of why a command would or would not auto-approve.
30    #[arg(long)]
31    pub explain: bool,
32
33    /// List all supported commands in Markdown format
34    #[arg(long)]
35    pub list_commands: bool,
36
37    /// Generate mdBook command reference pages in docs/src/commands/
38    #[arg(long)]
39    pub generate_book: bool,
40
41    /// Configure the hook for the named tool (default: claude). Use --auto-detect for every installed tool.
42    #[arg(long)]
43    pub setup: bool,
44
45    /// Pair with --setup to select the target tool by name. See --list-tools.
46    #[arg(long, value_name = "NAME")]
47    pub tool: Option<String>,
48
49    /// Pair with --setup to install for every installed tool detected on this machine.
50    #[arg(long)]
51    pub auto_detect: bool,
52
53    /// Print the names of every supported integration target.
54    #[arg(long)]
55    pub list_tools: bool,
56
57    /// Hook subcommand: read this tool's stdin envelope, validate the command, write the response.
58    #[command(subcommand)]
59    pub subcommand: Option<Subcommand>,
60}
61
62#[derive(clap::Subcommand)]
63pub enum Subcommand {
64    /// Run as a runtime hook for the named tool.
65    Hook {
66        /// Tool to read/write the hook envelope for. See --list-tools.
67        #[arg(value_name = "TOOL")]
68        tool: String,
69    },
70}
safe_chains/cli.rs

safe_chains/
cli.rs
