magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

unread-command

A deny rule by default: it refuses a program or VCS subcommand the shell computes before it runs, which no rule can read, and names what to run instead.

What it catches

A program or VCS subcommand the shell computes before it runs, which no rule can read.

Why

Every shell rule reads the program and its subcommand as written, and the shell rewrites some words first: \git and g\it drop the escape, $'g\x69t' decodes it, {git,push} and gi? expand, $x, ${x} and $(echo git) substitute. Each runs a command none of the rules judged. Spell the command plainly. Quotes are fine, since removing them changes nothing ("git", 'git', $'git'), and so is an expansion in an argument (git commit -m "$msg", cd "$dir"): only the words that pick what runs are read. A wrapper's program (env \git), a sh -c script and an eval are read the same way.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"unread-command": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [unread-command]: ...

A workspace that sets this rule to advise sees advise [unread-command]: ... instead.

magus describe rule unread-command prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. inline-alias: a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runsA deny rule by default: it refuses a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runs, and names what to run instead. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule by default: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead.
guardrulesunread-commanddeny
Last updated (580de406)
Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. Workspace in full.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. Magusfile in full.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). Op in full.

Spell

A language/runtime adapter (e.g. go, md) that maps generic targets onto a toolchain's real commands. Spell in full.

Buzz

The language magusfiles are written in (the .buzz engine). Buzz in full.

CI

An ordinary target you compose yourself with ctx.needs; magus does not hardcode its stages. It is the anchor magus affected ci keys off, and ci strips the rw charm. CI in full.

Agent

A model working through an agent host such as Claude Code, Codex, Cursor or OpenCode. magus treats an agent as one more caller of its CLI, MCP tools and console, held to the same checks as a person. Agent in full.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate. Run in full.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.