Module bash 

Bash command security analysis — AST-based, fail-closed.

This crate module parses bash commands with tree-sitter-bash and extracts a static argv for each simple command. Any construct that cannot be reasoned about statically is classified as needing explicit human approval.

Submodules:

• parser — tree-sitter-bash wrapper and AST helpers
• quote_context — quote-aware text views
• redirect — redirect extraction and static target validation
• prefix — command prefix extraction for permission rules
• command substitution analysis — recursive handling for nested shell substitutions
• zsh — zsh and advanced shell expansion checks
• analyzer — main security analyzer combining all of the above

Re-exports

pub use analyzer::CommandSafety;

pub use analyzer::SecurityAnalysis;

pub use analyzer::analyze;

pub use analyzer::analyze_security;

pub use analyzer::classify_simple_command;

pub use analyzer::extract_command_prefix;

pub use parser::RedirectOp;

pub use parser::SimpleCommand;

pub use prefix::PrefixResult;

pub use redirect::Redirect;

Modules

analyzer

Main bash command security analyzer.

parser

Bash AST parser wrapper around tree-sitter-bash.

prefix

Command prefix extraction for permission rule matching.

quote_context

Quote context extraction for bash commands.

redirect

Redirect analysis and validation.

zsh

Zsh and other advanced shell expansion checks.