Bash security gate

13-pattern Bash validator and server-mode defaults.

BashSecurityGate blocks destructive and exfiltration-shaped commands before execution.

Server defaults

  • Bash denied unless SWARM_ALLOW_BASH=1
  • SWARM_HITL_BASH requires approval in server/production

Validate

from techtide_swarm import BashSecurityGate
ok, reason = BashSecurityGate().validate("rm -rf /")

See Bash policy.

Related reading

PreviousMemvid bridgeNext Human-in-the-loop approvals