Skip to content

Pattern Syntax Overview

runok uses a pattern syntax to define which commands are allowed or denied. The basic form looks like the commands you normally type in the terminal, with additional syntax elements like wildcards (*), alternation (|), and optional groups ([]) for flexible matching.

Patterns are parsed exactly as written, with no hidden rewriting or implicit transformation. See Matching Behavior for details.

SyntaxExampleDescription
Literalgit statusExact token match
Wildcardgit *Zero or more tokens
Globlist-*, *.txt* inside a literal matches zero or more characters
Alternation-X|--request, main|masterPipe-separated alternatives
Negation!GET, !describe|getMatches anything except the specified value(s)
Optional group[-f], [-X POST]Matches with or without the group
Flag with value-X|--request POSTA flag-value pair matched in any order
Placeholder<cmd>, <opts>, <path:...>, <var:...>Special tokens in <...> with various behaviors (see below)
Backslash escape\;Literal match after removing the backslash
Quoted literal"WIP*", 'hello'Exact match without glob expansion
Multi-word alternation"npx prettier"|prettierAlternatives that include multi-word commands

Tokens wrapped in <...> are placeholders — special tokens that match dynamically rather than by exact string comparison. Each placeholder type has different matching behavior:

PlaceholderExampleDescriptionDetails
<cmd>sudo <cmd>Captures the wrapped command for further rule evaluationCommand
<opts>env <opts> <cmd>Absorbs zero or more flag-like tokens (starting with -)Options
<vars>env <vars> <cmd>Absorbs zero or more KEY=VALUE tokensVariables
<path:name>cat <path:sensitive>Matches against a named list of paths from definitionsPath References
<var:name>cmd <var:ids>Matches against a typed variable definition (argument or command position)Variable References

A pattern consists of a command name followed by argument tokens:

<command> [argument tokens...]

The first token is always the command name. The remaining tokens define the argument pattern.

# Command: "git", argument tokens: ["push", "--force"]
- deny: 'git push --force'
# Command: "curl", argument tokens: ["-X|--request", "POST", "*"]
- allow: 'curl -X|--request POST *'