telos_agent/tools/command_security/bash/mod.rs
1//! Bash command security analysis — AST-based, fail-closed.
2//!
3//! This crate module parses bash commands with `tree-sitter-bash` and extracts
4//! a static argv for each simple command. Any construct that cannot be reasoned
5//! about statically is classified as needing explicit human approval.
6//!
7//! Submodules:
8//! - [`parser`] — tree-sitter-bash wrapper and AST helpers
9//! - [`quote_context`] — quote-aware text views
10//! - [`redirect`] — redirect extraction and static target validation
11//! - [`prefix`] — command prefix extraction for permission rules
12//! - command substitution analysis — recursive handling for nested shell substitutions
13//! - [`zsh`] — zsh and advanced shell expansion checks
14//! - [`analyzer`] — main security analyzer combining all of the above
15
16pub mod analyzer;
17pub mod parser;
18pub mod prefix;
19pub mod quote_context;
20pub mod redirect;
21#[cfg(test)]
22mod substitution;
23pub mod zsh;
24
25pub use analyzer::{
26 CommandSafety, SecurityAnalysis, analyze, analyze_security, classify_simple_command,
27 extract_command_prefix,
28};
29pub use parser::{RedirectOp, SimpleCommand};
30pub use prefix::PrefixResult;
31pub use redirect::Redirect;