Module suggest 

--suggest: generate the minimal custom-command TOML that would let safe-chains recognize a command it currently denies because the command NAME is unknown.

OPT-IN only. Nothing here is ever referenced by the deny/hook output — a user reaches it solely by running safe-chains --suggest "<cmd>". It rides the existing trust rails (registry::custom): the generated [[command]] block goes in a project .safe-chains.toml, which is inert until the user hand-pins its SHA-256 in the write-protected ~/.config/safe-chains.toml. This module never touches ~/, so it cannot self-approve.

Scope (v1): the “I don’t recognize this tool” case. For each simple command whose name safe-chains doesn’t know, emit a [[command]] scoped to exactly the observed flags and positional count. Commands safe-chains DOES recognize are never overridden — a recognized command that is denied is a deliberate classification (a flag, subcommand, or path), not an unknown, so --suggest reports that rather than generating a bypass.

Structs

GeneratedEntry

A scoped custom-command entry for one unknown command name.

Enums

Outcome

What analyze concluded about a command.

Functions

analyze

Analyze command and decide what, if anything, --suggest can generate. Pure — no I/O.

config_hash

SHA-256 of bytes as lowercase hex — the exact hash registry::custom::repo_is_trusted computes over a .safe-chains.toml, so the printed pin matches what the trust check will require.

merged_content

The new .safe-chains.toml content: the existing file (empty if none) with the generated blocks appended, separated by a blank line.

pin_block

The [[trusted]] pin the user pastes into ~/.config/safe-chains.toml to approve the file.

render_toml

Render the generated entries as [[command]] TOML blocks. Minimal and always valid — this is exactly the text written to .safe-chains.toml and fed to the SHA-256 pin, so it must be stable.