rulvar API reference / @rulvar/rulvar / ShellSegment
Interface: ShellSegment
Defined in: packages/core/dist/index.d.ts
Argv-parsing shell matcher (M5-T06): shell allow/ask/deny is matched through a real argv parser, never a string prefix. The composition rule is the entire point: for a compound command the verdict is the strictest across segments, and any unmatched segment yields ask, never a silent allow: npm test; rm -rf / MUST yield ask (or deny when rm patterns are denied) even when npm test is allow-listed.
Matching algorithm (5.2):
- Lex with a POSIX-like shell lexer: quotes and escapes honored, no expansion of any kind.
- Split into segments at
;,&&,||,|,&, and newline. - A segment containing command substitution ($(...) or backticks), process substitution, or a here-doc is unmatchable: ask, always.
- Leading environment assignments (FOO=bar cmd) are stripped; a segment of only assignments is treated as unmatched.
- Redirection operators and their targets are retained as tokens; a pattern that does not account for them fails to match.
- Each segment is evaluated deny, then ask, then allow.