{"slug":"shellpermit-schemasure-com-v1-guard-shell-f540d6","title":"Decide whether an agent-authored bash command complies with an execution policy,","host":"shellpermit.schemasure.com","method":"POST","resource":"https://shellpermit.schemasure.com/v1/guard/shell","category":"code","description":"Decide whether an agent-authored bash command complies with an execution policy, using a real shell tokenizer rather than pattern matching. Catches recursive deletes, force pushes, cluster and infrastructure teardown, raw device writes, path escapes, privilege escalation, and curl-piped-to-shell thr","price_listed":0.015,"price_asked":null,"state":"effects","state_label":"Not tested: has real-world effects","checks_7d":0,"answered_7d":0,"latency_ms_median":null,"reported_calls_30d":9,"reported_payers_30d":1,"networks":["eip155:8453"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"body":{"audience":"executor:acme-prod-01","command":"rm -rf ./dist && npm run build","issue_permit":true,"policy":{"allow_destructive":true,"allow_network_egress":false,"allowed_roots":["/srv/app"],"cwd":"/srv/app"},"shell":"bash"},"bodyType":"json","method":"POST","type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"additionalProperties":false,"properties":{"body":{"additionalProperties":false,"properties":{"audience":{"description":"Identity of the ONE executor the permit is for. Required when issue_permit is true. Wildcards are rejected.","type":"string"},"command":{"maxLength":32768,"minLength":1,"type":"string"},"env":{"additionalProperties":{"type":"string"},"description":"Environment the executor will run with, used only for static expansion so that paths like \"$HOME/.cache\" can be resolved and decided rather than reported as unresolvable.","type":"object"},"issue_permit":{"type":"boolean"},"policy":{"additionalProperties":false,"properties":{"allow_destructive":{"description":"Permit deletes, truncations, and overwrites. Defaults to false.","type":"boolean"},"allow_network_egress":{"description":"Permit commands that reach the network. Defaults to false.","type":"boolean"},"allow_privilege_escalation":{"description":"Permit sudo, su, chmod 777, chown root. Defaults to false.","type":"boolean"},"allowed_commands":{"description":"If set, argv[0] must appear here.","items":{"type":"string"},"type":"array"},"allowed_roots":{"description":"Absolute directories the command may touch. Containment is lexical, not symlink-resolved.","items":{"type":"string"},"type":"array"},"cwd":{"description":"Absolute working directory relative operands resolve against. Defaults to the first allowed root.","type":"string"},"denied_commands":{"description":"Always blocked, applied after allowed_commands.","items":{"type":"string"},"type":"array"},"max_segments":{"description":"Ceiling on chained segments. Defaults to 32.","minimum":1,"type":"integer"},"protected_branches":{"description":"Branches a force push must never target. Defaults to main, master, trunk, develop, production, prod, release.","items":{"type":"string"},"type":"array"},"timeout_ms":{"description":"Execution timeout written into the permit obligations. Defaults to 120000.","minimum":1,"type":"integer"}},"type":"object"},"shell":{"description":"Required. Only bash is supported in v1: a permit issued under one shell's grammar and executed under another is a parser differential with a signature on it.","enum":["bash"],"type":"string"},"subject":{"description":"Opaque caller label recorded as the permit subject.","type":"string"}},"required":["shell","command"],"type":"object"},"bodyType":{"enum":["json","form-data","text"],"type":"string"},"method":{"enum":["POST"],"type":"string"},"type":{"const":"http","type":"string"}},"required":["type","method","bodyType","body"],"type":"object"},"output":{"properties":{"example":{"properties":{"confidence":{"type":"number"},"evidence":{"items":{"properties":{"code":{"description":"Stable reason code, e.g. REMOTE_CODE_EXECUTION.","type":"string"},"data":{"type":"object"},"detail":{"type":"string"},"disposition":{"description":"What this finding does to the verdict, which is a different axis from how bad it is.","enum":["block","unknown","warn","info"],"type":"string"},"severity":{"enum":["info","low","medium","high","critical"],"type":"string"},"source":{"type":"string"},"span":{"properties":{"end":{"type":"integer"},"start":{"type":"integer"}},"type":"object"}},"required":["code","severity","detail","disposition"],"type":"object"},"type":"array"},"ok":{"type":"boolean"},"result":{"properties":{"canonical_command":{"description":"What a permit binds. Every operand preserved.","type":"string"},"cmd_fingerprint":{"description":"ADVISORY ONLY. Operands discarded; never authorize on it.","type":"string"},"cmd_hash":{"description":"BINDING. sha256 of canonical_command.","type":"string"},"permit":{"description":"Compact JWS, 60s TTL, one audience.","type":"string"}},"required":["canonical_command","cmd_hash","cmd_fingerprint"],"type":"object"},"risk_codes":{"items":{"type":"string"},"type":"array"},"verdict":{"enum":["pass","warn","unknown","block"],"type":"string"},"warnings":{"items":{"type":"string"},"type":"array"}},"required":["ok","verdict","confidence","risk_codes","evidence","result","warnings"],"type":"object"},"type":{"type":"string"}},"required":["type"],"type":"object"}},"required":["input"],"type":"object"},"history":[],"description_full":"Decide whether an agent-authored bash command complies with an execution policy, using a real shell tokenizer rather than pattern matching. Catches recursive deletes, force pushes, cluster and infrastructure teardown, raw device writes, path escapes, privilege escalation, and curl-piped-to-shell through pipelines, substitutions, quoting games and base64. Returns reason codes with spans and an optional short-lived permit bound to the exact canonical command. Never executes anything.","last_updated":"2026-09-24T07:39:31.352Z","schemes":["exact"]}