rulvar API reference / @rulvar/core / ShellSegment
Interface: ShellSegment
Defined in: packages/core/src/tools/shell-matcher.ts:23
Argv-parsing shell matcher (M5-T06): shell allow/ask/deny is matched through a real argv parser, never a string prefix. The composition rule is the entire point: for a compound command the verdict is the strictest across segments, and any unmatched segment yields ask, never a silent allow: npm test; rm -rf / MUST yield ask (or deny when rm patterns are denied) even when npm test is allow-listed.
Matching algorithm (5.2):
- Lex with a POSIX-like shell lexer: quotes and escapes honored, no expansion of any kind.
- Split into segments at
;,&&,||,|,&, and newline. - A segment containing command substitution ($(...) or backticks), process substitution, or a here-doc is unmatchable: ask, always.
- Leading environment assignments (FOO=bar cmd) are stripped; a segment of only assignments is treated as unmatched.
- Redirection operators and their targets are retained as tokens; a pattern that does not account for them fails to match.
- Each segment is evaluated deny, then ask, then allow.
Properties
| Property | Type | Description | Defined in |
|---|---|---|---|
argv | string[] | Argv tokens after lexing and env-assignment stripping. | packages/core/src/tools/shell-matcher.ts:25 |
unmatchable | boolean | Substitutions and here-docs make a segment unmatchable (ask). | packages/core/src/tools/shell-matcher.ts:27 |