Bash control

Shell command policy for IDE coding agents. Allowlist or deny the commands agents may run in the terminal—package scripts yes, destructive or exfil patterns no.

Why it matters

Cursor and Claude can invoke arbitrary shell from a laptop. Without a shared control channel, each engineer’s agent is a private toolchain—and security only finds out after something leaks or lands on main.

Allow and deny examples

Allow

• npm test, pnpm lint, scoped git helpers

Deny

• curl | sh, rm -rf, secrets dumpers

How it works

When an agent proposes a bash action, Relay evaluates bash rules before the command runs. Allowed calls proceed; denied calls return a structured reason and are recorded for audit.