@cnwenf/occ 2.1.300 → 2.1.301

package/dist/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-globalThis.MACRO={"VERSION":"2.1.300","BINARY_NAME":"occ","BUILD_TIME":"2026-08-13T23:37:42.199Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
+globalThis.MACRO={"VERSION":"2.1.301","BINARY_NAME":"occ","BUILD_TIME":"2026-08-14T18:51:25.355Z","FEEDBACK_CHANNEL":"","ISSUES_EXPLAINER":"","NATIVE_PACKAGE_URL":"","PACKAGE_URL":"@cnwenf/occ","VERSION_CHANGELOG":""};
 // @bun
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
@@ -53615,12 +53615,13 @@ __export(exports_git, {
   getChangedFiles: () => getChangedFiles,
   getBranch: () => getBranch,
   findRemoteBase: () => findRemoteBase,
+  findGitRootUncached: () => findGitRootUncached,
   findGitRoot: () => findGitRoot,
   findCanonicalGitRoot: () => findCanonicalGitRoot,
   dirIsInGitRepo: () => dirIsInGitRepo
 });
 import { createHash } from "crypto";
-import { readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync4 } from "fs";
+import { lstatSync as lstatSync2, readFileSync as readFileSync5, realpathSync as realpathSync3, statSync as statSync4 } from "fs";
 import { open as open2, readFile as readFile5, realpath as realpath3, stat as stat4 } from "fs/promises";
 import { basename as basename3, dirname as dirname8, join as join14, resolve as resolve6, sep as sep3 } from "path";
 function createFindGitRoot() {
@@ -53631,6 +53632,35 @@ function createFindGitRoot() {
   wrapper.cache = findGitRootImpl.cache;
   return wrapper;
 }
+function findGitRootUncached(startPath) {
+  let current = resolve6(startPath);
+  const root2 = current.substring(0, current.indexOf(sep3) + 1) || sep3;
+  while (current !== root2) {
+    if (isGitRootForTrust(current)) {
+      return current.normalize("NFC");
+    }
+    const parent = dirname8(current);
+    if (parent === current) {
+      break;
+    }
+    current = parent;
+  }
+  if (isGitRootForTrust(root2)) {
+    return root2.normalize("NFC");
+  }
+  return null;
+}
+function isGitRootForTrust(dir) {
+  try {
+    const s = lstatSync2(join14(dir, ".git"));
+    if (s.isSymbolicLink()) {
+      return false;
+    }
+    return s.isDirectory() || s.isFile();
+  } catch {
+    return false;
+  }
+}
 function createFindCanonicalGitRoot() {
   function wrapper(startPath) {
     const root2 = findGitRoot(startPath);
@@ -152932,31 +152962,44 @@ function computeTrustDialogAccepted() {
   if (projectConfig?.hasTrustDialogAccepted) {
     return true;
   }
-  let currentPath = normalizePathForConfigKey(getCwd());
+  const resolvedCwd = resolve9(getCwd());
+  const repoRoot = findGitRootUncached(resolvedCwd);
+  const boundary = repoRoot !== null ? normalizePathForConfigKey(resolve9(repoRoot)) : null;
+  return walkAncestorsForTrust(config4, resolvedCwd, boundary);
+}
+function walkAncestorsForTrust(config4, startPath, boundary) {
+  let currentPath = normalizePathForConfigKey(startPath);
   while (true) {
-    const pathConfig = config4.projects?.[currentPath];
-    if (pathConfig?.hasTrustDialogAccepted) {
+    if (!(boundary === null || currentPath === boundary || currentPath.startsWith(boundary.endsWith("/") ? boundary : `${boundary}/`))) {
+      return false;
+    }
+    if (config4.projects?.[currentPath]?.hasTrustDialogAccepted) {
       return true;
     }
+    if (currentPath === boundary) {
+      return false;
+    }
     const parentPath = normalizePathForConfigKey(resolve9(currentPath, ".."));
     if (parentPath === currentPath) {
-      break;
+      return false;
     }
     currentPath = parentPath;
   }
-  return false;
 }
-function isPathTrusted(dir) {
+function isPathTrusted(dir, opts = {}) {
   const config4 = getGlobalConfig();
-  let currentPath = normalizePathForConfigKey(resolve9(dir));
-  while (true) {
-    if (config4.projects?.[currentPath]?.hasTrustDialogAccepted)
-      return true;
-    const parentPath = normalizePathForConfigKey(resolve9(currentPath, ".."));
-    if (parentPath === currentPath)
-      return false;
-    currentPath = parentPath;
+  if (opts.advisoryNoFsProbe) {
+    return walkAncestorsForTrust(config4, resolve9(dir), null);
   }
+  const canonicalRoot = findCanonicalGitRoot(dir);
+  const persistKey = normalizePathForConfigKey(canonicalRoot !== null ? resolve9(canonicalRoot) : resolve9(dir));
+  if (config4.projects?.[persistKey]?.hasTrustDialogAccepted === true) {
+    return true;
+  }
+  const resolved = resolve9(dir);
+  const repoRoot = findGitRootUncached(resolved);
+  const boundary = repoRoot !== null ? normalizePathForConfigKey(resolve9(repoRoot)) : null;
+  return walkAncestorsForTrust(config4, resolved, boundary);
 }
 function isProjectConfigKey(key) {
   return PROJECT_CONFIG_KEYS.includes(key);
@@ -201262,7 +201305,7 @@ __export(exports_sandbox_adapter, {
   SandboxRuntimeConfigSchema: () => SandboxRuntimeConfigSchema,
   SandboxManager: () => SandboxManager2
 });
-import { lstatSync as lstatSync3, readdirSync as readdirSync4, realpathSync as realpathSync6, rmSync as rmSync4, statSync as statSync8 } from "fs";
+import { lstatSync as lstatSync4, readdirSync as readdirSync4, realpathSync as realpathSync6, rmSync as rmSync4, statSync as statSync8 } from "fs";
 import { readFile as readFile15 } from "fs/promises";
 import { join as join39, resolve as resolve17, sep as sep9 } from "path";
 function permissionRuleValueFromString2(ruleString) {
@@ -201425,7 +201468,7 @@ function convertToSandboxRuntimeConfig(settings) {
     }
   }
   const { rgPath, rgArgs, argv0 } = ripgrepCommand();
-  const ripgrepConfig = settings.sandbox?.ripgrep ?? {
+  const ripgrepConfig = ["policySettings", "flagSettings", "userSettings"].map((source) => getSettingsForSource(source)?.sandbox?.ripgrep).find((config5) => config5 !== undefined) ?? {
     command: rgPath,
     args: rgArgs,
     argv0
@@ -201465,7 +201508,7 @@ function reconcileClaudeSymlinks(dirs) {
     for (const name3 of entries) {
       const entryPath = join39(claudeDir, name3);
       try {
-        if (!lstatSync3(entryPath).isSymbolicLink()) {
+        if (!lstatSync4(entryPath).isSymbolicLink()) {
           continue;
         }
       } catch {
@@ -372210,7 +372253,9 @@ function ruleIdToLabel(ruleId) {
     digitalocean: "DigitalOcean",
     huggingface: "HuggingFace",
     hashicorp: "HashiCorp",
-    sendgrid: "SendGrid"
+    sendgrid: "SendGrid",
+    ci: "CI",
+    scim: "SCIM"
   };
   return ruleId.split("-").map((part) => specialCase[part] ?? capitalize(part)).join(" ");
 }
@@ -372241,7 +372286,7 @@ function redactSecrets(content) {
   }
   return content;
 }
-var ANT_KEY_PFX, SECRET_RULES, compiledRules = null, redactRules = null;
+var ANT_KEY_PFX, GITLAB_TOKEN_BODY = "[\\w=-]{20,}(?:\\.[0-9a-z]{9})?", SECRET_RULES, compiledRules = null, redactRules = null;
 var init_secretScanner = __esm(() => {
   init_stringUtils();
   ANT_KEY_PFX = ["sk", "ant", "api"].join("-");
@@ -372304,11 +372349,47 @@ var init_secretScanner = __esm(() => {
     },
     {
       id: "gitlab-pat",
-      source: "glpat-[\\w-]{20}"
+      source: `glpat-${GITLAB_TOKEN_BODY}`
     },
     {
       id: "gitlab-deploy-token",
-      source: "gldt-[0-9a-zA-Z_\\-]{20}"
+      source: `gldt-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-runner-authentication-token",
+      source: `glrt-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-oauth-app-secret",
+      source: `gloas-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-pipeline-trigger-token",
+      source: `glptt-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-kubernetes-agent-token",
+      source: `glagent-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-incoming-mail-token",
+      source: `glimt-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-scim-oauth-token",
+      source: `glsoat-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-ci-build-token",
+      source: `glcbt-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-feed-token",
+      source: `glft-${GITLAB_TOKEN_BODY}`
+    },
+    {
+      id: "gitlab-feature-flag-client-token",
+      source: `glffct-${GITLAB_TOKEN_BODY}`
     },
     {
       id: "slack-bot-token",
@@ -379587,6 +379668,33 @@ function validateOutputRedirections(redirections, cwd2, toolPermissionContext, c
     message: "No unsafe redirections found"
   };
 }
+function validateInputRedirections(astRedirects, cwd2, toolPermissionContext) {
+  for (const r4 of astRedirects) {
+    if (r4.op !== "<" || r4.target === "/dev/null") {
+      continue;
+    }
+    const { allowed, resolvedPath, decisionReason } = validatePath(r4.target, cwd2, toolPermissionContext, "read");
+    if (allowed) {
+      continue;
+    }
+    const message = decisionReason?.type === "other" || decisionReason?.type === "safetyCheck" ? decisionReason.reason : decisionReason?.type === "rule" ? `Input redirection from '${resolvedPath}' was blocked by a deny rule.` : `Input redirection from '${resolvedPath}' was blocked. For security, Claude Code may only read files in the allowed working directories for this session.`;
+    if (decisionReason?.type === "rule") {
+      return { behavior: "deny", message, decisionReason };
+    }
+    const suggestion = decisionReason === undefined ? createReadRuleSuggestion(getDirectoryForPath(resolvedPath), "session") : undefined;
+    return {
+      behavior: "ask",
+      message,
+      blockedPath: resolvedPath,
+      decisionReason,
+      ...suggestion !== undefined && { suggestions: [suggestion] }
+    };
+  }
+  return {
+    behavior: "passthrough",
+    message: "No unsafe input redirections found"
+  };
+}
 function checkPathConstraints(input, cwd2, toolPermissionContext, compoundCommandHasCd, astRedirects, astCommands) {
   if (!astCommands && />>\s*>\s*\(|>\s*>\s*\(|<\s*\(/.test(input.command)) {
     return {
@@ -379613,6 +379721,12 @@ function checkPathConstraints(input, cwd2, toolPermissionContext, compoundComman
   if (redirectionResult.behavior !== "passthrough") {
     return redirectionResult;
   }
+  if (astRedirects) {
+    const inputRedirectResult = validateInputRedirections(astRedirects, cwd2, toolPermissionContext);
+    if (inputRedirectResult.behavior !== "passthrough") {
+      return inputRedirectResult;
+    }
+  }
   if (astCommands) {
     for (const cmd of astCommands) {
       const result = validateSinglePathCommandArgv(cmd, cwd2, toolPermissionContext, compoundCommandHasCd);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cnwenf/occ",
-  "version": "2.1.300",
+  "version": "2.1.301",
   "license": "MIT",
   "type": "module",
   "bin": {