# safe-commands

> Allowlist of safe bash commands for task gate bypass — git status, ls, cat, grep etc. that dont need an active task.

**Type:** script | **Subsystem:** context-fabric | **Location:** `agents/context/lib/safe-commands.sh`

## What It Does

Safe-command allowlist for Bash task gate (T-650, T-630)
is_bash_safe_command() returns 0 if the command is read-only/diagnostic
and should be allowed without an active task.
Design evidence: 7920 Bash invocations analyzed from real session data.
Only 1.4% are file-writing operations. This allowlist catches the safe
98.6% for fast-path bypass.
Categories (27 patterns):
1. Git read-only (8 patterns)
2. File reading (7 patterns)
3. Searching (4 patterns)

## Used By (7)

| Component | Relationship | Description |
|-----------|--------------|-------------|
| [check-active-task](/docs/generated/agents-context-check-active-task) | called_by | Task-First Enforcement Hook — PreToolUse gate for Write/Edit tools |
| [context_safe_commands](/docs/generated/tests-unit-context_safe_commands) | called_by | Unit tests for context safe_commands (35 tests) |
| [context_safe_commands](/docs/generated/tests-unit-context_safe_commands) | tests_by | Unit tests for context safe_commands (35 tests) |
| [safe_commands_env_prefix](/docs/generated/tests-unit-safe_commands_env_prefix) | called_by | TODO: describe what this component does |
| [safe_commands_env_prefix](/docs/generated/tests-unit-safe_commands_env_prefix) | tests_by | TODO: describe what this component does |
| [test_safe_commands_git_commit](/docs/generated/tests-unit-test_safe_commands_git_commit) | called_by | TODO: describe what this component does |
| [test_safe_commands_git_commit](/docs/generated/tests-unit-test_safe_commands_git_commit) | tests_by | TODO: describe what this component does |

---
*Auto-generated from Component Fabric. Card: `agents-context-lib-safe-commands.yaml`*
*Last verified: 2026-03-28*
