cc-safe-setup 8.1.0 → 8.3.0

package/index.mjs

@@ -91,6 +91,9 @@ const GENERATE_CI = process.argv.includes('--generate-ci');
 const REPORT = process.argv.includes('--report');
 const QUICKFIX = process.argv.includes('--quickfix');
 const SHIELD = process.argv.includes('--shield');
+const ANALYZE = process.argv.includes('--analyze');
+const PROFILE_IDX = process.argv.findIndex(a => a === '--profile');
+const PROFILE = PROFILE_IDX !== -1 ? process.argv[PROFILE_IDX + 1] : null;
 const COMPARE_IDX = process.argv.findIndex(a => a === '--compare');
 const COMPARE = COMPARE_IDX !== -1 ? { a: process.argv[COMPARE_IDX + 1], b: process.argv[COMPARE_IDX + 2] } : null;
 const CREATE_IDX = process.argv.findIndex(a => a === '--create');
@@ -126,6 +129,8 @@ if (HELP) {
     npx cc-safe-setup --doctor     Diagnose why hooks aren't working
     npx cc-safe-setup --watch      Live dashboard of blocked commands
     npx cc-safe-setup --create "<desc>"  Generate a custom hook from description
+    npx cc-safe-setup --profile <level>  Switch safety profile (strict/standard/minimal)
+    npx cc-safe-setup --analyze     Analyze what Claude did in your last session
     npx cc-safe-setup --shield     Maximum safety in one command (fix + scan + install + CLAUDE.md)
     npx cc-safe-setup --quickfix   Auto-detect and fix common Claude Code problems
     npx cc-safe-setup --stats      Block statistics and patterns report
@@ -833,6 +838,229 @@ async function fullSetup() {
   console.log();
 }
 
+async function profile(level) {
+  const { readdirSync } = await import('fs');
+  console.log();
+
+  const PROFILES = {
+    strict: {
+      desc: 'Maximum safety — blocks everything dangerous, requires verification',
+      hooks: ['destructive-guard', 'branch-guard', 'secret-guard', 'syntax-check',
+        'context-monitor', 'comment-strip', 'cd-git-allow', 'api-error-alert',
+        'scope-guard', 'no-sudo-guard', 'protect-claudemd', 'env-source-guard',
+        'no-install-global', 'deploy-guard', 'protect-dotfiles', 'symlink-guard',
+        'strict-allowlist', 'uncommitted-work-guard', 'test-deletion-guard',
+        'overwrite-guard', 'error-memory-guard', 'hardcoded-secret-detector',
+        'conflict-marker-guard', 'token-budget-guard', 'fact-check-gate',
+        'block-database-wipe', 'no-eval', 'file-size-limit', 'large-read-guard',
+        'loop-detector', 'verify-before-done', 'diff-size-guard', 'commit-scope-guard']
+    },
+    standard: {
+      desc: 'Balanced — blocks dangerous commands, auto-approves safe ones',
+      hooks: ['destructive-guard', 'branch-guard', 'secret-guard', 'syntax-check',
+        'context-monitor', 'comment-strip', 'cd-git-allow', 'api-error-alert',
+        'scope-guard', 'no-sudo-guard', 'protect-claudemd',
+        'auto-approve-build', 'auto-approve-python', 'auto-approve-docker',
+        'loop-detector', 'deploy-guard', 'block-database-wipe',
+        'compound-command-approver', 'session-handoff', 'cost-tracker']
+    },
+    minimal: {
+      desc: 'Essential only — just the 8 core safety hooks',
+      hooks: ['destructive-guard', 'branch-guard', 'secret-guard', 'syntax-check',
+        'context-monitor', 'comment-strip', 'cd-git-allow', 'api-error-alert']
+    },
+  };
+
+  if (!level || !PROFILES[level]) {
+    console.log(c.bold + '  Safety Profiles' + c.reset);
+    console.log();
+    for (const [name, prof] of Object.entries(PROFILES)) {
+      console.log(`  ${c.bold}${name}${c.reset} (${prof.hooks.length} hooks)`);
+      console.log(`  ${c.dim}${prof.desc}${c.reset}`);
+      console.log(`  ${c.dim}npx cc-safe-setup --profile ${name}${c.reset}`);
+      console.log();
+    }
+    return;
+  }
+
+  const prof = PROFILES[level];
+  console.log(c.bold + `  Applying "${level}" profile` + c.reset);
+  console.log(c.dim + `  ${prof.desc}` + c.reset);
+  console.log();
+
+  mkdirSync(HOOKS_DIR, { recursive: true });
+  let installed = 0;
+
+  for (const hookId of prof.hooks) {
+    const hookPath = join(HOOKS_DIR, `${hookId}.sh`);
+    if (existsSync(hookPath)) {
+      console.log(c.dim + '  ✓' + c.reset + ` ${hookId}`);
+      continue;
+    }
+
+    // Try built-in first
+    if (SCRIPTS[hookId]) {
+      writeFileSync(hookPath, SCRIPTS[hookId]);
+      chmodSync(hookPath, 0o755);
+      installed++;
+      console.log(c.green + '  +' + c.reset + ` ${hookId}`);
+      continue;
+    }
+
+    // Try examples
+    const exPath = join(__dirname, 'examples', `${hookId}.sh`);
+    if (existsSync(exPath)) {
+      copyFileSync(exPath, hookPath);
+      chmodSync(hookPath, 0o755);
+      installed++;
+      console.log(c.green + '  +' + c.reset + ` ${hookId}`);
+      continue;
+    }
+
+    console.log(c.yellow + '  ?' + c.reset + ` ${hookId} (not found)`);
+  }
+
+  // Update settings.json
+  let settings = {};
+  if (existsSync(SETTINGS_PATH)) {
+    try { settings = JSON.parse(readFileSync(SETTINGS_PATH, 'utf-8')); } catch {}
+  }
+  if (!settings.hooks) settings.hooks = {};
+
+  // Register all hooks in settings
+  const hookFiles = prof.hooks.filter(h => existsSync(join(HOOKS_DIR, `${h}.sh`)));
+  const bashHooks = hookFiles.map(h => ({ type: 'command', command: `bash ${join(HOOKS_DIR, h + '.sh')}` }));
+
+  // Simplified: put all under PreToolUse Bash for now
+  if (!settings.hooks.PreToolUse) settings.hooks.PreToolUse = [];
+  const existing = settings.hooks.PreToolUse.find(e => e.matcher === 'Bash');
+  if (existing) {
+    const existingCmds = new Set(existing.hooks.map(h => h.command));
+    for (const h of bashHooks) {
+      if (!existingCmds.has(h.command)) existing.hooks.push(h);
+    }
+  } else {
+    settings.hooks.PreToolUse.push({ matcher: 'Bash', hooks: bashHooks });
+  }
+
+  writeFileSync(SETTINGS_PATH, JSON.stringify(settings, null, 2));
+
+  console.log();
+  console.log(c.green + `  ✓ "${level}" profile applied (${installed} new hooks installed)` + c.reset);
+  console.log(c.dim + `  ${prof.hooks.length} hooks total in profile` + c.reset);
+  console.log();
+}
+
+async function analyze() {
+  const { execSync } = await import('child_process');
+  const { readdirSync, statSync } = await import('fs');
+  console.log();
+  console.log(c.bold + '  cc-safe-setup --analyze' + c.reset);
+  console.log(c.dim + '  What Claude did in your sessions' + c.reset);
+  console.log();
+
+  // 1. Blocked commands log
+  const blockLog = join(HOME, '.claude', 'blocked-commands.log');
+  let blocks = [];
+  if (existsSync(blockLog)) {
+    const content = readFileSync(blockLog, 'utf-8');
+    blocks = content.split('\n').filter(l => l.trim());
+    const recent = blocks.slice(-20);
+    console.log(c.bold + '  Blocked Commands' + c.reset + c.dim + ` (${blocks.length} total)` + c.reset);
+    if (recent.length > 0) {
+      // Count by type
+      const types = {};
+      for (const line of blocks) {
+        const match = line.match(/BLOCKED:\s*(.+?)(?:\s*—|\s*\(|$)/);
+        if (match) {
+          const type = match[1].trim().substring(0, 40);
+          types[type] = (types[type] || 0) + 1;
+        }
+      }
+      const sorted = Object.entries(types).sort((a, b) => b[1] - a[1]);
+      for (const [type, count] of sorted.slice(0, 8)) {
+        const bar = '█'.repeat(Math.min(count, 20));
+        console.log(`    ${c.red}${bar}${c.reset} ${count}× ${type}`);
+      }
+    } else {
+      console.log(c.green + '    No blocked commands recorded.' + c.reset);
+    }
+    console.log();
+  }
+
+  // 2. Git activity (last 24h)
+  console.log(c.bold + '  Git Activity (last 24h)' + c.reset);
+  try {
+    const log = execSync('git log --oneline --since="24 hours ago" 2>/dev/null', { encoding: 'utf-8' }).trim();
+    if (log) {
+      const commits = log.split('\n');
+      console.log(c.dim + `    ${commits.length} commits` + c.reset);
+      for (const commit of commits.slice(0, 10)) {
+        console.log(`    ${c.blue}•${c.reset} ${commit}`);
+      }
+      if (commits.length > 10) console.log(c.dim + `    ... and ${commits.length - 10} more` + c.reset);
+    } else {
+      console.log(c.dim + '    No commits in last 24h' + c.reset);
+    }
+  } catch {
+    console.log(c.dim + '    Not in a git repository' + c.reset);
+  }
+  console.log();
+
+  // 3. Files changed (last 24h)
+  console.log(c.bold + '  Files Changed (last 24h)' + c.reset);
+  try {
+    const diff = execSync('git diff --stat HEAD~10 2>/dev/null || git diff --stat 2>/dev/null', { encoding: 'utf-8' }).trim();
+    if (diff) {
+      const lines = diff.split('\n');
+      const summary = lines[lines.length - 1];
+      console.log(c.dim + `    ${summary.trim()}` + c.reset);
+    }
+  } catch {}
+  console.log();
+
+  // 4. Hook health
+  console.log(c.bold + '  Hook Health' + c.reset);
+  const hookDir = join(HOME, '.claude', 'hooks');
+  if (existsSync(hookDir)) {
+    const hooks = readdirSync(hookDir).filter(f => f.endsWith('.sh') || f.endsWith('.py'));
+    let execCount = 0, nonExec = 0;
+    for (const h of hooks) {
+      const st = statSync(join(hookDir, h));
+      if (st.mode & 0o111) execCount++; else nonExec++;
+    }
+    console.log(`    ${c.green}${execCount}${c.reset} hooks executable${nonExec > 0 ? `, ${c.red}${nonExec}${c.reset} missing permissions` : ''}`);
+  }
+
+  // 5. Context usage estimate
+  console.log();
+  console.log(c.bold + '  Session Estimates' + c.reset);
+  // Check tool call log if exists
+  const toolLog = join(HOME, '.claude', 'tool-calls.log');
+  if (existsSync(toolLog)) {
+    const logContent = readFileSync(toolLog, 'utf-8');
+    const calls = logContent.split('\n').filter(l => l.trim());
+    const today = new Date().toISOString().split('T')[0];
+    const todayCalls = calls.filter(l => l.includes(today));
+    console.log(`    Tool calls today: ${todayCalls.length}`);
+  }
+
+  // Token budget state
+  const budgetFiles = existsSync('/tmp') ? readdirSync('/tmp').filter(f => f.startsWith('cc-token-budget-')) : [];
+  if (budgetFiles.length > 0) {
+    for (const bf of budgetFiles.slice(0, 3)) {
+      const tokens = parseInt(readFileSync(join('/tmp', bf), 'utf-8').trim()) || 0;
+      const costCents = Math.round(tokens * 75 / 10000);
+      console.log(`    Estimated cost: ~$${(costCents / 100).toFixed(2)} (${tokens.toLocaleString()} tokens)`);
+    }
+  }
+
+  console.log();
+  console.log(c.dim + '  Tip: Use --stats for block history analytics' + c.reset);
+  console.log(c.dim + '  Tip: Use --dashboard for real-time monitoring' + c.reset);
+  console.log();
+}
+
 async function shield() {
   const { execSync } = await import('child_process');
   const { readdirSync } = await import('fs');
@@ -3042,6 +3270,8 @@ async function main() {
   if (FULL) return fullSetup();
   if (DOCTOR) return doctor();
   if (WATCH) return watch();
+  if (PROFILE_IDX !== -1) return profile(PROFILE);
+  if (ANALYZE) return analyze();
   if (SHIELD) return shield();
   if (QUICKFIX) return quickfix();
   if (REPORT) return report();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safe-setup",
-  "version": "8.1.0",
+  "version": "8.3.0",
   "description": "One command to make Claude Code safe. 59 hooks (8 built-in + 51 examples). 26 CLI commands: dashboard, create, audit, lint, diff, migrate, compare, generate-ci. 284 tests.",
   "main": "index.mjs",
   "bin": {