Module command_safety 

Command safety detection module

Implements granular command safety evaluation based on subcommands and options, following patterns from OpenAI’s Codex project.

Features:

• Safe-by-default subcommand allowlists (e.g., git only allows branch|status|log)
• Per-option blacklists (e.g., find forbids -delete, -exec)
• Shell chain parsing for bash -lc "..." scripts
• Windows/PowerShell-specific dangerous command detection
• Recursive dangerous command detection with sudo unwrapping
• Audit logging for compliance
• LRU caching for performance

Re-exports

pub use audit::AuditEntry;

pub use audit::SafetyAuditLogger;

pub use cache::SafetyDecisionCache;

pub use command_db::CommandDatabase;

pub use dangerous_commands::command_might_be_dangerous;

pub use safe_command_registry::SafeCommandRegistry;

pub use safe_command_registry::SafetyDecision;

pub use shell_parser::parse_bash_lc_commands;

pub use unified::EvaluationReason;

pub use unified::EvaluationResult;

pub use unified::PolicyAwareEvaluator;

pub use unified::UnifiedCommandEvaluator;

Modules

audit

Audit logging for command safety decisions.

cache

Caching layer for command safety decisions.

command_db

Command database: comprehensive safe command rules organized by category.

dangerous_commands

Detection of dangerous commands that should never be executed.

safe_command_registry

Safe command registry: defines which commands and subcommands are safe to execute.

shell_parser

Shell script parser for bash -lc and similar commands.

unified

Unified Command Evaluator - Phase 5

Functions

is_safe_command

Evaluates if a command is safe to execute. Returns true if the command passes all safety checks.

shell_string_might_be_dangerous

Evaluate a shell command string by parsing it into subcommands and checking each with the centralized dangerous-command detector.

validate_command_safety

Validates that a command is safe to execute.