Module bash_parser 

Constants

ARCHITECT_COMMANDS

Commands exposed by architect mode. This deliberately omits general-purpose interpreters and utilities with write/exec primitives (sed, awk, find, tee, …). Bash restricted mode is only defense in depth: it does not make ordinary commands such as touch or rm read-only.

SHELL_SPAWNING_COMMANDS

Commands that can execute arbitrary code passed as a string argument.

Functions

architect_allowed_commands

assert_single_powershell_statement

Reject PowerShell input that chains statements: ;, newlines, or the &&/|| chain operators outside quotes. A single pipeline is allowed.

assert_single_statement

assert_single_statement_for

Validate that command is a single top-level bash statement.

detect_allowlist_bypass

Return the deduplicated allowlist entries that make a code_writer allowlist bypassable (see SHELL_SPAWNING_COMMANDS).

extract_command_texts

Collect the full text of every command node in the script.

extract_static_write_paths

Return statically visible filesystem destinations written by a shell command.

is_architect_command_allowed

Fail-closed read-only policy for architect shell commands.