Bidirectional shell safety tool that purifies legacy bash scripts and lets you write shell scripts in REAL Rust with automatic safety guarantees.
- What's New
- Why Rash?
- Quick Start
- Features
- Core Commands
- Advanced Testing
- Documentation
- Quality Metrics
- Shell Compatibility
- Performance
- MCP Server
- Contributing
- License
Latest Release - 2026-02-10
- Transpiler Bug Fixes: 2 critical correctness fixes
returninsidewhile/for/matchin functions now correctly emits shell arithmeticlet x = match y { ... }now generates propercasestatements instead ofx='unknown'
- Corpus Expansion: 14,712 transpilation entries (13,397 Bash + 695 Makefile + 620 Dockerfile)
- V2 Score: 97.5/100 (A+), 0 failures across all entries
- 107+ CLI subcommands for corpus analysis, quality gates, and convergence tracking
- New Example:
transpiler_demoshowcasing nested calls, match-in-let, recursion, and multi-function programs - Quality Metrics: 10,888 tests, 97.5/100 corpus score (A+)
See CHANGELOG.md for complete release notes.
Shell scripts are everywhereβCI/CD pipelines, deployment automation, system configurationβbut they're notoriously difficult to write safely. Rash solves this by providing:
- Bidirectional Safety: Write in Rust and transpile to shell, or purify existing bash scripts
- Automatic Transformation: Don't just detect problemsβfix them automatically
- Deterministic Guarantees: Same input always produces identical, reproducible output
- Zero Runtime Dependencies: Generated scripts run on any POSIX-compliant system
- π‘οΈ Automatic Safety: Protection against shell injection, word splitting, glob expansion
- π Beyond Linting: Full AST semantic understanding - transforms code, doesn't just warn
- π¦ Zero Runtime Dependencies: Generated scripts work on any POSIX shell
- π― Deterministic Output: Same input always produces identical scripts
- β ShellCheck Compliant: All output passes strict linting
| What ShellCheck Does | What Rash Does |
|---|---|
| β Rewrites to version-based deterministic IDs | |
β
Transforms to mkdir -p (idempotent) |
|
| β Quotes all variables automatically | |
| Static pattern matching | Full AST semantic understanding |
| Detects issues (read-only) | Fixes issues (read-write transformation) |
Key Difference: ShellCheck tells you what's wrong. Rash understands your code's intent and rewrites it to be safe, deterministic, and idempotent β automatically.
# From crates.io (recommended)
cargo install bashrs
# Or from source
git clone https://github.com/paiml/bashrs
cd bashrs
cargo install --path rash// install.rs
#[rash::main]
fn main() {
let version = env_var_or("VERSION", "1.0.0");
let prefix = env_var_or("PREFIX", "/usr/local");
echo("Installing MyApp {version} to {prefix}");
mkdir_p("{prefix}/bin");
mkdir_p("{prefix}/share/myapp");
if exec("cp myapp {prefix}/bin/") {
echo("β Binary installed");
} else {
eprint("β Failed to install binary");
exit(1);
}
}Transpile to safe POSIX shell:
$ bashrs build install.rs -o install.shBefore (messy bash):
#!/bin/bash
SESSION_ID=$RANDOM # Non-deterministic
mkdir /app/releases/$RELEASE # Non-idempotent
rm /app/current # Fails if doesn't existAfter (purified by Rash):
#!/bin/sh
session_id="session-${version}" # β
Deterministic
mkdir -p "/app/releases/${release}" # β
Idempotent
rm -f "/app/current" # β
Safe removal# Transpile Rust to shell
bashrs build input.rs -o output.sh
# Purify legacy bash scripts
bashrs purify messy.sh -o clean.sh
# Interactive REPL with debugging
bashrs repl
# Lint shell scripts (including Dockerfiles)
bashrs lint script.sh
# Test bash scripts
bashrs test script.sh
# Quality scoring
bashrs score script.sh
# Comprehensive audit
bashrs audit script.shRash includes Probar integration for comprehensive quality assurance:
# State machine testing with playbooks
bashrs playbook install.playbook.yaml --run
# Mutation testing (goal: >90% kill rate)
bashrs mutate script.sh --count 10
# Deterministic simulation replay
bashrs simulate script.sh --seed 42 --verifyMutation Operators: Rash applies 10 mutation operators including string mutations, command substitutions, conditional inversions, and redirect modifications to verify test quality.
The Rash Book is the canonical source for all documentation:
Quick links:
Why the book?
- β All examples automatically tested
- β Always up-to-date with latest release
- β Comprehensive coverage of all features
- β Real-world examples and tutorials
| Metric | Value | Status |
|---|---|---|
| V2 Corpus Score | 97.5/100 | β Grade A+ |
| Corpus Entries | 14,712 | β 100% pass rate |
| Tests | 10,888 passing | β 100% pass rate |
| Transpilation | 100% (14,712/14,712) | β All entries compile |
| Behavioral | 100% (14,707/14,712) | β Output matches spec |
| Deterministic | 100% (14,712/14,712) | β Same input = same output |
| ShellCheck | 99.9% compliant | β All output passes |
| Cross-Shell | 98.8% (sh + dash) | β POSIX portable |
| Shell Compatibility | 6 shells | β sh, dash, bash, ash, zsh, mksh |
Rash uses Popperian falsificationβtests attempt to disprove functionality rather than prove it works:
# Run 130-point transpiler falsification checklist
cargo test -p bashrs --test transpiler_tcode_tests
# Run 30-point Dockerfile falsification checklist
cargo test -p bashrs --test dockerfile_dcode_testsA passing test means the falsification attempt failedβthe feature works correctly.
Generated scripts are tested on:
| Shell | Version | Status |
|---|---|---|
| POSIX sh | - | β Full support |
| dash | 0.5.11+ | β Full support |
| bash | 3.2+ | β Full support |
| ash (BusyBox) | 1.30+ | β Full support |
| zsh | 5.0+ | β Full support |
| mksh | R59+ | β Full support |
Rash is designed for fast transpilation:
- Rust-to-Shell: 21.1Β΅s transpile time
- Makefile Parsing: 0.034-1.43ms (70-320x faster than targets)
- Memory Usage: <10MB for most scripts
Rash provides a Model Context Protocol (MCP) server for AI-assisted shell script generation:
# Install MCP server
cargo install rash-mcp
# Run server
rash-mcpAvailable in the official MCP registry as io.github.paiml/rash.
We welcome contributions! See our Contributing Guide for details.
# Clone and test
git clone https://github.com/paiml/bashrs.git
cd bashrs
make test
# Run all quality checks
make validateMIT License. See LICENSE for details.