Development Tools gate
81 allow
77 ask
0 block
Developer tools that can modify files. Linters and type checkers run in inspection mode by default and ask when a write flag (--write, --fix, -i, -w) appears. Default unknown_action is allow because most tools in this category are read-only analysis.
Showing all 158 rules.
Allowed · read-only modes
rules/devtools.toml#allow 81 patternsactionlint (all subcommands)
Allow
Lints GitHub Actions workflow files. Read-only static analysis.
air (all subcommands)
Allow
Live-reloads a Go app, rebuilding and restarting it on file changes. Runs the project's own build and binary.
autoflake --check --check-diff
Allow
Reports unused imports/variables and prints the diff. Read-only with
--check/--check-diff; no files are written.bandit (all subcommands)
Allow
Scans Python for common security issues. Read-only static analysis.
biome lint
Allow
Reports Biome lint diagnostics for the matched files. Read-only; writing fixes needs
--write/--fix.black --check --diff
Allow
Reports whether files are
black-formatted and prints the diff. Read-only with --check/--diff; no files are written.buf lint
Allow
Reports Protobuf lint diagnostics for the schema. Read-only; no files are written.
buf breaking
Allow
Reports breaking-change diagnostics against a baseline schema. Read-only; no files are written.
buf ls-files
Allow
Lists the Protobuf files in the module. Read-only.
buf --version
Allow
Prints the
buf version. Read-only.coverage report
Allow
Prints a coverage summary to stdout from the existing
.coverage data file. Read-only; no report files are written.coverage --version
Allow
Prints the coverage.py version. Read-only.
coverage --help
Allow
Prints coverage.py usage help. Read-only.
cypress run
Allow
Runs the Cypress test suite headless and reports results. Writes test artifacts (videos, screenshots) to the configured output dir.
cypress verify
Allow
Verifies that the installed Cypress binary is runnable. Read-only check; no tests are run.
cypress version
Allow
Prints Cypress binary and package versions. Read-only.
cypress info
Allow
Prints Cypress environment and detected-browser info. Read-only.
cypress --version
Allow
Prints the Cypress version. Read-only.
cypress --help
Allow
Prints Cypress usage help. Read-only.
d2 (all subcommands)
Allow
Renders D2 diagram source to an image. Writes the output file when one is specified.
dart analyze
Allow
Runs Dart static analysis and reports diagnostics. Read-only; no files are written.
dart info
Allow
Prints Dart/Flutter environment and tooling info. Read-only.
dart --version
Allow
Prints the Dart SDK version. Read-only.
esbuild (all subcommands)
Allow
Bundles JS/TS. Writes output when an outfile or outdir is set, otherwise prints to stdout.
ffmpeg -version -buildconf -L -h --help
Allow
Prints ffmpeg version, build config, license, or usage help. Read-only info flags; no transcode runs.
ffprobe (all subcommands)
Allow
Inspects media files and prints stream and format metadata. Read-only.
flake8 (all subcommands)
Allow
Lints Python and reports style and error findings. Read-only static analysis.
gitleaks (all subcommands)
Allow
Scans for committed secrets and reports findings. Read-only; does not modify files.
hadolint (all subcommands)
Allow
Lints Dockerfiles and reports issues. Read-only static analysis.
isort --check --check-only --diff
Allow
Reports whether imports are sorted and prints the diff. Read-only with
--check/--check-only/--diff; no files are written.jest (all subcommands)
Allow
Runs the Jest test suite and prints results. Read-only unless tests write files or
-u updates snapshots.jq (all subcommands)
Allow
Processes JSON from files or stdin and prints the result. Read-only.
knip (all subcommands)
Allow
Finds unused files, dependencies, and exports. Read-only analysis.
lefthook run
Allow
Runs the configured git hooks on demand (the commands defined in
lefthook.yml). Side effects depend on those configured commands.lefthook version
Allow
Prints the lefthook version. Read-only.
lefthook dump
Allow
Prints the merged lefthook configuration to stdout. Read-only.
mocha (all subcommands)
Allow
Runs the Mocha test suite and prints results. Read-only unless the tests write files.
mypy (all subcommands)
Allow
Type-checks Python and reports errors. Read-only static analysis.
nox --version
Allow
Prints the nox version. Read-only.
nox --help
Allow
Prints nox usage help. Read-only.
nox -l --list
Allow
Lists the sessions declared in
noxfile.py. Read-only; no session is run.nx (all subcommands)
Allow
Runs Nx workspace tasks. Executes the configured target scripts.
oxlint (all subcommands)
Allow
Lints JS/TS and reports findings. Read-only unless
--fix is set.parcel build
Allow
Builds the production bundle into the configured dist dir. Writes build artifacts only; no dev server is started.
parcel --version
Allow
Prints the Parcel version. Read-only.
parcel --help
Allow
Prints Parcel usage help. Read-only.
parcel serve
Allow
parcel serve: starts the Parcel dev server on a local port. Binds to localhost until interrupted.
patch --dry-run
Allow
Simulates applying a patch and reports whether it would succeed. Read-only with
--dry-run; no files are modified.playwright test
Allow
Runs the Playwright test suite headless and reports results. Writes test artifacts (report, traces) to the configured output dir.
playwright show-report
Allow
Serves the existing HTML test report locally for viewing. Read-only; no tests are run.
playwright show-trace
Allow
Opens the trace viewer on an existing trace file. Read-only; no tests are run.
playwright --version
Allow
Prints the Playwright version. Read-only.
playwright --help
Allow
Prints Playwright usage help. Read-only.
pylint (all subcommands)
Allow
Lints Python and reports findings. Read-only static analysis.
pyright (all subcommands)
Allow
Type-checks Python and reports errors. Read-only static analysis.
pytest (all subcommands)
Allow
Runs the Python test suite and prints results. Read-only unless the tests write files or hit external services.
rollup (all subcommands)
Allow
Bundles JS modules. Outputs to the configured file or directory.
ruff format --check --diff
Allow
Checks Python formatting and prints the diff. Read-only with
--check/--diff; no files are written.rustfmt --check
Allow
Reports whether files are
rustfmt-formatted via the exit code. Read-only with --check; no files are written.scalafmt --check
Allow
Reports whether Scala files are
scalafmt-formatted via the exit code. Read-only with --check; no files are written.shellcheck (all subcommands)
Allow
Lints shell scripts and reports issues. Read-only static analysis.
stylua --check
Allow
Reports whether Lua files are
stylua-formatted via the exit code. Read-only with --check; no files are written.swc (all subcommands)
Allow
Compiles and transforms JS/TS. Writes output to the configured location.
swiftformat --lint
Allow
Reports Swift formatting violations without rewriting. Read-only with
--lint; no files are written.tox --version
Allow
Prints the tox version. Read-only.
tox --help
Allow
Prints tox usage help. Read-only.
tox -l --list --listenvs
Allow
Lists the environments declared in
tox.ini / pyproject.toml. Read-only; no env is run.ts-node --version
Allow
Prints the ts-node version. Read-only; no script is run.
ts-node --help
Allow
Prints ts-node usage help. Read-only; no script is run.
tsc (all subcommands)
Allow
Type-checks TypeScript and reports errors. Emits compiled output only when configured to (
--noEmit disables writes).tsup (all subcommands)
Allow
Bundles TypeScript/JavaScript. Outputs to the configured dist directory.
tsx --version
Allow
Prints the tsx version. Read-only; no script is run.
tsx --help
Allow
Prints tsx usage help. Read-only; no script is run.
turbo (all subcommands)
Allow
Runs Turborepo tasks across the workspace. Executes the configured pipeline scripts.
vite (all subcommands)
Allow
Runs the Vite dev server or build. A build writes to the configured dist directory.
vitest (all subcommands)
Allow
Runs the Vitest test suite and prints results. Read-only unless tests write files or
-u updates snapshots.webpack (all subcommands)
Allow
Bundles assets to the output directory. Runs plugins and loaders that can execute build code.
wrangler whoami
Allow
Prints the authenticated Cloudflare account for the current credentials. Read-only.
wrangler --version
Allow
Prints the wrangler version. Read-only.
wrangler --help
Allow
Prints wrangler usage help. Read-only.
wrangler tail
Allow
Streams live logs from a deployed Worker. Read-only observation; does not change the deployment.
Asks first · write flags
rules/devtools.toml#ask 77 patternsast-grep -U --update-all
Ask
ast-grep -U: applies the rewrite pattern across matched files. Default ast-grep is search-only;
-U/--update-all writes the changes.autoflake --in-place -i
Ask
autoflake --in-place: rewrites Python files to remove unused imports/variables. Default autoflake prints suggested diffs only.
autopep8 -i --in-place
Ask
Formatting files in-place
awk
Ask
awk program uses a shell-exec or file-write construct (system, getline, |, @, or a > redirect), or reads its program from a file. Plain field/print/arithmetic awk auto-allows.
biome check --write --fix --fix-unsafe
Ask
Writing fixes
biome format --write
Ask
Formatting files
black
Ask
Formatting files
buf format
Ask
Formatting files
clang-format -i
Ask
Formatting files in-place
comby -in-place -i
Ask
comby -in-place: applies the structural match-and-rewrite to the matched files. Default comby prints diffs to stdout.
coverage run
Ask
coverage run: executes the given Python script/module under coverage. Writes a
.coverage data file in cwd.coverage html
Ask
coverage html: writes an HTML report tree (default
htmlcov/) from the current .coverage data file.coverage json
Ask
coverage json: writes a
coverage.json report file from the current .coverage data file.coverage xml
Ask
coverage xml: writes a
coverage.xml (Cobertura) report file from the current .coverage data file.coverage lcov
Ask
coverage lcov: writes a
coverage.lcov report file from the current .coverage data file.coverage erase
Ask
coverage erase: deletes the
.coverage data file in cwd. Pending reports cannot be regenerated without rerunning.coverage combine
Ask
coverage combine: merges multiple
.coverage.* data files into a single .coverage file. Inputs are consumed.cypress open
Ask
cypress open: launches the Cypress test runner GUI. Long-running until the window is closed.
cypress install
Ask
cypress install: downloads the Cypress binary to the local cache (~200MB).
dart format
Ask
Formatting files
dartfmt
Ask
Formatting files
dos2unix
Ask
Converting line endings
elm-format
Ask
Formatting files
eslint --fix
Ask
Auto-fixing
gci write
Ask
Formatting imports
gofmt -w
Ask
Formatting files
gofumpt -w
Ask
Formatting files
goimports -w
Ask
Formatting imports
golangci-lint --fix
Ask
Applying lint fixes
grit apply
Ask
grit apply: applies a Grit migration pattern to matched files. Other grit subcommands are read-only/listing operations.
isort
Ask
Sorting imports
ktlint -F --format
Ask
Formatting files
lefthook install
Ask
lefthook install: writes hook scripts to
.git/hooks/ per lefthook.yml. Subsequent git operations invoke them.lefthook uninstall
Ask
lefthook uninstall: removes lefthook-managed hook scripts from
.git/hooks/. Git stops invoking the configured hooks.lefthook add
Ask
lefthook add: creates hook script files under
.git/hooks/ for the named hook. Edits the git hooks directory.markdownlint --fix -f
Ask
Auto-fixing markdown
markdownlint-cli2 --fix
Ask
Rewrites the Markdown files in place. Run without
--fix first to see what would change.mdbook build
Ask
Writes the rendered book into the output directory, replacing its current contents.
mdbook serve
Ask
Rebuilds the book into the output directory and serves it, rewriting on every change.
mdbook clean
Ask
Deletes the book output directory. Verify the configured build dir before removing it.
mix format
Ask
Formatting files
nox
Ask
nox: runs the configured sessions from
noxfile.py. Each session creates/uses a virtualenv and runs arbitrary Python code per the noxfile.parcel watch
Ask
parcel watch: rebuilds the bundle on file changes. Long-running; writes output to the configured dist dir.
patch
Ask
Applying patch (targets come from patch file content, not CLI args)
perltidy -b
Ask
Formatting in-place
playwright install
Ask
playwright install: downloads Chromium/Firefox/WebKit binaries to the Playwright cache (~300MB-1GB total).
playwright codegen
Ask
playwright codegen: opens a browser and records user actions as test code. Writes the generated spec to stdout or
-o <file>.prettier --write -w
Ask
Writing formatted files
rubocop -a -A --auto-correct --autocorrect
Ask
Auto-correcting
ruff check --fix
Ask
Auto-fixing
ruff format
Ask
Formatting files
rumdl --fix -f
Ask
Rewrites the Markdown files in place. Run without
--fix first to see what would change.rustfmt
Ask
Formatting files
sad --commit
Ask
sad --commit: applies the proposed search-and-replace to the matched files. Default sad without
--commit is preview-only.scalafmt
Ask
Formatting files
sd
Ask
sd in-place: rewrites the given files (regex find/replace). Without file args sd is a stdin->stdout pipe; with file args it modifies in place.
semgrep --autofix --fix
Ask
semgrep --autofix: applies rule-driven code rewrites to matched files. Default semgrep only reports findings.
sg
Ask
sg is ambiguous: ast-grep deprecated that executable name, while some systems provide an unrelated group-switching command. Use ast-grep run or ast-grep scan explicitly.shfmt -w
Ask
Formatting files
standardrb -a -A --auto-correct --autocorrect
Ask
Auto-correcting
stylelint --fix
Ask
Auto-fixing styles
stylua
Ask
Formatting files
swiftformat
Ask
Formatting files
taplo format
Ask
Reformats TOML files in place. Pass
--check to report differences without writing.taplo fmt
Ask
Reformats TOML files in place. Pass
--check to report differences without writing.tox
Ask
tox: runs the configured environments from
tox.ini / pyproject.toml. Each env creates/uses a virtualenv and runs arbitrary commands per config.ts-node
Ask
ts-node: runs the given TypeScript file under Node. The script's side effects (network, FS, child processes) execute.
tsx
Ask
tsx: runs the given TypeScript file directly (Node + esbuild). The script's side effects (network, FS, child processes) execute.
ty --add-ignore
Ask
ty --add-ignore: inserts
ty: ignore comments into source files at flagged diagnostics. Default ty only reports.unix2dos
Ask
Converting line endings
watchexec
Ask
watchexec: runs the given command whenever matching files change. The wrapped command's side effects fire on every change.
wrangler dev
Ask
wrangler dev: runs the Worker locally on a dev port. Long-running; binds to localhost until interrupted.
wrangler deploy
Ask
Cloudflare wrangler deploy: publishes the Worker live to Cloudflare. Verify env vs preview vs production; the Worker starts handling traffic immediately.
wrangler publish
Ask
Cloudflare wrangler publish: pushes the Worker live (older form of deploy). Verify env; the Worker starts handling traffic immediately.
wrangler login
Ask
wrangler login: starts the OAuth flow and writes Cloudflare credentials to
~/.wrangler (or ~/.config/.wrangler). Anyone with read access to the file gets those credentials.wrangler pages
Ask
wrangler pages: Cloudflare Pages operation (deploy/dev/project).
pages deploy publishes a site live to Cloudflare's edge.yq -i --inplace
Ask
yq -i: rewrites the YAML file in place per the given expression. Default yq prints to stdout;
-i/--inplace writes the file.