Bionic's Auto Review Uses AST Parsing to Auto-Approve Most Agent Shell Commands
Released August 2026, Bionic's Auto Review mode parses commands into an AST, extracts capabilities, and matches them against safe rules to instantly run up to 82 percent of…
- Shell Judge parses supported shells into ASTs, extracts worst-case capabilities like file reads/writes and subcommands, then applies detailed allowlist rules to approve safe commands mechanically.
- Commands the judge cannot approve go to a parallel Shell Reviewer subagent that rates risk, user authorization, and correctness from recent transcript before deciding to run or ask the human.
- The system assumes non-hostile environments, remains Zero Data Retention by default, and uses session sync points for correct rollback and forking behavior.
What is Auto Review in Bionic?
Bionic introduced Auto Review on August 27, 2026 as a new shell command approval mode. Users no longer need to manually read and approve every command an agent proposes.
Each command enters an auto review pipeline. A deterministic Shell Judge first checks whether it is clearly safe. Safe commands run immediately. Everything else passes to a reviewer subagent that examines the session transcript and decides whether to execute it or prompt the user.
How the Shell Judge works without calling an LLM
The Shell Judge supports sh, bash, zsh, and PowerShell. It begins by parsing the command into an Abstract Syntax Tree using mvdan/sh for POSIX shells and PowerShell's built-in parser.
Next it extracts a ShellCapability structure that models the worst-case effects: potential commands, read and write targets, environment variable changes, and any unknowns. Anything the extractor cannot fully understand, such as unrecognized AST nodes, environment variable assignments, or variables with too many possible values, is rejected.
Approved capabilities then run through an extensive set of hand-written safe rules that specify exact flags, argument parsing behavior, and allowed targets for each tool. The rules can distinguish safe uses like git merge-base from dangerous ones that might expand to sensitive paths.
According to the Bionic team, this mechanical process automatically approves roughly 82 percent of the commands their agents run in practice, including complex multi-line git, tsc, and PowerShell sequences that appear intimidating but are harmless.
What happens when the Shell Judge cannot approve a command
The command is routed to a dedicated Shell Reviewer subagent running in parallel via a DAG of sync points that preserve correct rollback and forking behavior for both main and reviewer sessions.
The reviewer is deliberately kept unaware that it is judging safety and is not told any passing threshold. Instead it rates the command on three axes: Risk (low, high, or too_destructive), Authorization (explicitly_no, neutral, or explicitly_yes), and Correctness (obvious errors).
A flowchart then decides: low-risk commands run unless the user explicitly said no; high-risk commands require clear user authorization; anything too destructive is always blocked. The reviewer receives the recent transcript of user and assistant messages but not tool outputs to reduce prompt-injection risk and save context.
Known limitations and assumptions
The Shell Judge assumes a normal non-hostile environment: binaries are what they claim to be and tools are not maliciously configured. It does not model temporary directory access or certain global configuration files.
It cannot solve the halting problem, so some commands will always require reviewer or human oversight. Bionic is Zero Data Retention by default and the team states it neither collects nor analyzes users' command data.
Why it matters for uncensored AI
Our analysis: The source shows frontier models frequently emit long, complex shell commands to save tokens. Bionic's Auto Review reduces the friction of repeated manual approvals for these commands while still surfacing genuinely risky ones to the user.
This practical improvement makes local agent workflows smoother for open-ended tasks that require executing arbitrary safe shell operations on the user's own machine. People therefore gain more usable control over what their local agents can do without needing constant human intervention on every step.
