Language Runtimes gate
48 allow
37 ask
0 block
Language runtime invocations. Version and syntax-check flags are safe. Anything that executes code (inline via -c/-e or a script file) asks. No blocks at this layer; the filesystem-level floor catches the destructive cases.
Showing all 85 rules.
Allowed · inspection
rules/runtimes.toml#allow 48 patternsdeno --version
Allow
Info flags. Always safe.
deno -V
Allow
Info flags. Always safe.
deno --help
Allow
Info flags. Always safe.
deno -h
Allow
Info flags. Always safe.
deno check
Allow
Deno's read-only inspection subcommands.
fmt --check and test also allow.deno lint
Allow
Deno's read-only inspection subcommands.
fmt --check and test also allow.deno doc
Allow
Deno's read-only inspection subcommands.
fmt --check and test also allow.deno info
Allow
Deno's read-only inspection subcommands.
fmt --check and test also allow.deno types
Allow
Deno's read-only inspection subcommands.
fmt --check and test also allow.deno completions
Allow
Prints shell completion script for
deno to stdout. Read-only.deno help
Allow
Prints
deno help text. Read-only.deno fmt --check
Allow
Deno's read-only inspection subcommands.
fmt --check and test also allow.deno test
Allow
Runs the Deno test suite. Executes test files in the default sandbox; no files written and no global installs.
deno bench
Allow
Runs Deno benchmarks. Executes bench files in the default sandbox; no files written and no global installs.
dotnet --version --info --list-sdks --list-runtimes
Allow
Info flags. Always safe.
dotnet --help
Allow
Info flags. Always safe.
dotnet -h
Allow
Info flags. Always safe.
dotnet help
Allow
Prints
dotnet help text. Read-only.dotnet build
Allow
Local build, test, and dependency restore. Outputs land under
bin/ and obj/.dotnet test
Allow
Local build, test, and dependency restore. Outputs land under
bin/ and obj/.dotnet run
Allow
Local build, test, and dependency restore. Outputs land under
bin/ and obj/.dotnet clean
Allow
Deletes build outputs under
bin/ and obj/ for the project. Local cleanup only.dotnet restore
Allow
Local build, test, and dependency restore. Outputs land under
bin/ and obj/.dotnet list
Allow
Lists project references or installed packages. Read-only.
dotnet sln
Allow
Inspects or edits the solution file's project list. Reads with no args;
add/remove rewrite the .sln.dotnet format --check --verify-no-changes
Allow
Reports formatting issues without writing.
--check and --verify-no-changes make it read-only.elixir --version -v
Allow
Info flags. Always safe.
elixir --help -h
Allow
Info flags. Always safe.
iex --version -v
Allow
Info flags. Always safe.
java --version -version --help -help -h
Allow
Info flags. Always safe.
javac --version -version --help -help
Allow
Info flags. Always safe.
lua -v
Allow
Info flags. Always safe.
node --version -v
Allow
Info flags. Always safe.
node --help -h
Allow
Info flags. Always safe.
node -c --check
Allow
Syntax check without execution.
php --version -v
Allow
Info flags. Always safe.
php --help -h
Allow
Info flags. Always safe.
php --info -i
Allow
Prints PHP configuration (
phpinfo). Read-only.php -l --syntax-check
Allow
Per-language syntax checks. Read-only.
php -m
Allow
Lists compiled-in PHP modules. Read-only.
python3 --version -V -VV
Allow
Info flags. Always safe.
python3 --help -h
Allow
Info flags. Always safe.
ruby --version -v
Allow
Info flags. Always safe.
ruby --help -h
Allow
Info flags. Always safe.
ruby -c
Allow
Per-language syntax checks. Read-only.
swift --version --help -h
Allow
Info flags. Always safe.
swift build
Allow
Compiles the Swift package. Outputs land under
.build/; no code is executed.swift test
Allow
Runs the Swift package test suite. Builds and executes tests locally; outputs land under
.build/.Asks first · code execution
rules/runtimes.toml#ask 37 patternsdeno run
Ask
Runs a Deno script. Permissions are sandboxed by default; flags like
--allow-all / --allow-net / --allow-write widen access.deno serve
Ask
Starts a Deno HTTP server. Binds a port (default 8000) and listens for incoming requests.
deno fmt
Ask
Formats source files in place. Rewrites every matching file under the target paths.
deno compile
Ask
Produces a standalone executable for the script. Writes a binary that embeds the Deno runtime and the script's modules.
deno install
Ask
Installs a script as a global executable on PATH, or installs project dependencies. The global form writes to the Deno install root.
deno uninstall
Ask
Removes a Deno-installed global executable from the Deno install root.
deno task
Ask
Runs a named task from
deno.json. Executes the task's shell command line; treat as running that command.deno upgrade
Ask
Replaces the Deno binary with a newer release. Modifies the installed
deno executable on PATH.deno add
Ask
Adds a dependency to
deno.json imports. Network fetch on next resolve.deno remove
Ask
Removes a dependency from
deno.json imports.deno publish
Ask
Uploads the module to JSR. Public publish is irreversible: the version number cannot be reused.
dotnet publish
Ask
Publishing application
dotnet new
Ask
Creating project
dotnet add
Ask
Adding reference/package
dotnet remove
Ask
Removing reference/package
dotnet nuget
Ask
NuGet operation
dotnet tool
Ask
Tool management
dotnet pack
Ask
Creating NuGet package
dotnet format
Ask
Formatting code
elixir -e
Ask
Executes inline Elixir via
-e. Treat the code as an inline script.elixir
Ask
Runs an Elixir script file (
.exs / .ex). Full Elixir and Erlang stdlib access.iex
Ask
Starts the interactive Elixir REPL. Each input is evaluated with full Elixir and Erlang stdlib access.
java
Ask
Runs a Java class, JAR, or single source file. Full JVM access; classpath-loaded code runs unsandboxed.
javac
Ask
Compiles Java source files into
.class bytecode. Writes output to the configured destination directory.lua -e
Ask
Executes inline Lua via
-e. Treat the code as an inline script.lua
Ask
Runs a Lua script file. Full Lua stdlib access including
io, os, and loaded C modules.node -e --eval -p --print
Ask
Executes inline JavaScript via
-e. Treat the code as an inline script; full Node API access.node
Ask
Runs a Node.js script file. Full Node API access including filesystem, network, and child processes.
php -r
Ask
Executes inline PHP via
-r. Treat the code as an inline script.php
Ask
Runs a PHP script file. Full PHP API access including filesystem, network, and shell execution.
python3 -c
Ask
Executes inline Python via
-c. Treat the code as an inline script; can import any installed module.python3 -m
Ask
Runs an installed Python module via
-m <module>. Module code runs with the current interpreter; inherits the active venv if one is on PATH.python3
Ask
Runs a Python script file. The script runs with the current interpreter; inherits the active venv if one is on PATH.
ruby -e
Ask
Executes inline Ruby via
-e. Treat the code as an inline script; full stdlib access.ruby
Ask
Runs a Ruby script file. Full stdlib access including filesystem, network, and child processes.
swift run
Ask
Builds and runs the Swift executable target in the current package. Full Swift runtime access.
swift package
Ask
Manages the Swift package: init, update, resolve, generate-xcodeproj, clean. Mutates
Package.resolved and the build cache.