Bash Authorize — Development skill for Claude Code

Bash-Authorize

**Claude Code "PreToolUse" hook for authorizing Bash commands**

[](https://github.com/rse) [](https://github.com/rse)

Abstract

This is a small Command-Line Interface (CLI) acting as a *Claude Code* `PreToolUse` hook for the `Bash` tool. It parses the to-be-executed Bash command into an Abstract Syntax Tree (with the help of the [`unbash`](https://npmjs.com/unbash) parser), recursively walks the full command structure, and classifies it into one of four verdicts:

• **allow** — the command is *genuinely inert* (read-only, no side-effects), so it is *auto-approved* without prompting the user (e.g. `ls`, `cat`, `grep`, `git status`, or `curl`/`wget` as long as they stream to stdout and do not write any file).

• **ask** — the command is *known-dangerous* but legitimate, so a user confirmation *prompt is forced* (e.g. `rm -rf`, `git push`, `chmod`).

• **deny** — the command is *catastrophic* and near-never legitimate, so it is *blocked outright* (e.g. `rm -rf /`, `mkfs.*`, `dd of=/dev/...`).

• **passthrough** — nothing matched, or the classification was *gated* by a hard safety condition (a mutating redirect, a background job, an embedded `$(...)` substitution, a non-literal command name, etc.), so the hook *stays silent* and defers to *Claude Code*'s normal permission flow.

The classification is *fail-safe* throughout: any parse error, thrown exception, or unexpected/unmatched construct yields `passthrough`, so the tool never crashes the host agent and never auto-approves on doubt.

[!CAUTION] THIS IS A SECURITY-RELEVANT AND RISKY PIECE OF SO