cc-safety-net 0.8.0 → 0.8.1

package/README.md

@@ -164,11 +164,9 @@ Running both together provides defense-in-depth. Sandboxing handles unknown thre
 ```bash
 /plugin marketplace add kenryu42/cc-marketplace
 /plugin install safety-net@cc-marketplace
+/reload-plugins
 ```
 
-> [!NOTE]
-> After installing the plugin, you need to restart your Claude Code for it to take effect.
-
 ### Claude Code Auto-Update
 
 1. Run `/plugin` → Select `Marketplaces` → Choose `cc-marketplace` → Enable auto-update
@@ -207,95 +205,14 @@ gemini extensions install https://github.com/kenryu42/gemini-safety-net
 
 ### GitHub Copilot CLI Installation
 
-Safety Net supports GitHub Copilot CLI via its [hooks system](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-hooks).
-
-> [!NOTE]
-> Copilot CLI currently supports two hook configuration styles:
->
-> - Hook files:
->   - repository: `.github/hooks/*.json`
->   - user: `~/.copilot/hooks/*.json` on Copilot CLI `0.0.422+`
-> - Inline `hooks` inside Copilot config files on Copilot CLI `1.0.8+`:
->   - user: `~/.copilot/config.json`
->   - repository: `.github/copilot/settings.json`
->   - local override: `.github/copilot/settings.local.json`
->
-> Copilot settings cascade from user -> repository -> local (later files override earlier ones, so local overrides repository overrides user). `disableAllHooks: true` disables both repo-level and user-level hooks. If you use `COPILOT_HOME`, replace `~/.copilot` with that directory.
-
-#### Option A: Hook Files
-
-This is the classic hook-file format. It still works, and it is the easiest shared setup for a repository.
-
-1. **Create the hooks directory** in your repository:
-
-   ```bash
-   mkdir -p .github/hooks
-   ```
-
-2. **Create `.github/hooks/safety-net.json`**:
-
-   ```json
-   {
-     "version": 1,
-     "hooks": {
-       "preToolUse": [
-         {
-           "type": "command",
-           "bash": "npx -y cc-safety-net --copilot-cli",
-           "cwd": ".",
-           "timeoutSec": 15
-         }
-       ]
-     }
-   }
-   ```
-
-3. **Restart Copilot CLI** — hooks are loaded at session start.
-
-The hook will intercept shell commands and block destructive operations before they execute.
-
-To install the same hook globally for your user account on Copilot CLI `0.0.422+`, place the same JSON file in:
-
-- `~/.copilot/hooks/safety-net.json`
-
-#### Option B: Inline Hooks In Copilot Settings
-
-On Copilot CLI `1.0.8+`, you can define the same hook inline in Copilot settings files instead of a separate `.json` file under `.github/hooks` or `~/.copilot/hooks`.
-
-```json
-{
-  "hooks": {
-    "preToolUse": [
-      {
-        "type": "command",
-        "bash": "npx -y cc-safety-net --copilot-cli",
-        "cwd": ".",
-        "timeoutSec": 15
-      }
-    ]
-  }
-}
+```bash
+/plugin install kenryu42/copilot-safety-net
 ```
 
-Use that schema in one of these files:
-
-- `~/.copilot/config.json`
-- `.github/copilot/settings.json`
-- `.github/copilot/settings.local.json`
-
-Recommended usage:
-
-- Use `~/.copilot/config.json` for your personal default across repositories.
-- Use `.github/copilot/settings.json` for a committed repository-wide setup.
-- Use `.github/copilot/settings.local.json` for personal repo-specific overrides, and add it to `.gitignore`.
-
-If you need to turn hooks off explicitly, set:
+> [!NOTE]
+> After installing the plugin, you need to restart your Copilot CLI for it to take effect.
 
-```json
-{
-  "disableAllHooks": true
-}
-```
+---
 
 ## Status Line Integration
 

package/dist/bin/cc-safety-net.js

@@ -3731,6 +3731,7 @@ function analyzeCommand(command, options = {}) {
 }
 
 // src/bin/doctor/hooks.ts
+var COPILOT_PLUGIN_CONFIG_PATH = "copilot-plugin";
 var SELF_TEST_CASES = [
   { command: "git reset --hard", description: "git reset --hard", expectBlocked: true },
   { command: "rm -rf /", description: "rm -rf /", expectBlocked: true },
@@ -4178,13 +4179,15 @@ function detectAllHooks(cwd, options) {
         errors: errors.length > 0 ? errors : undefined
       };
     }
-    if (hooksCheck.activeConfigPaths.length > 0) {
+    if (options?.copilotPluginInstalled === true || hooksCheck.activeConfigPaths.length > 0) {
+      const viaPlugin = options?.copilotPluginInstalled === true;
+      const primaryConfigPath = hooksCheck.activeConfigPaths[0];
       return {
         platform: "copilot-cli",
         status: "configured",
-        method: "hook config",
-        configPath: hooksCheck.activeConfigPaths[0],
-        configPaths: hooksCheck.activeConfigPaths,
+        method: viaPlugin ? "plugin list" : "hook config",
+        configPath: primaryConfigPath ?? (viaPlugin ? COPILOT_PLUGIN_CONFIG_PATH : undefined),
+        configPaths: hooksCheck.activeConfigPaths.length > 0 ? hooksCheck.activeConfigPaths : undefined,
         selfTest: runSelfTest(),
         errors: errors.length > 0 ? errors : undefined
       };
@@ -4205,11 +4208,12 @@ function detectAllHooks(cwd, options) {
 
 // src/bin/doctor/system-info.ts
 import { spawn } from "node:child_process";
-var CURRENT_VERSION = "0.8.0";
+var CURRENT_VERSION = "0.8.1";
 var VERSION_FETCH_TIMEOUT_MS = 2000;
 function getPackageVersion() {
   return CURRENT_VERSION;
 }
+var COPILOT_PLUGIN_ID = "copilot-safety-net";
 var defaultVersionFetcher = async (args) => {
   const [cmd, ...rest] = args;
   if (!cmd)
@@ -4260,6 +4264,12 @@ function parseVersion(output) {
 `)[0]?.trim();
   return firstLine || null;
 }
+function hasCopilotSafetyNetPlugin(output) {
+  if (!output)
+    return false;
+  const pluginPattern = new RegExp(`(^|[^a-z0-9-])${COPILOT_PLUGIN_ID}([^a-z0-9-]|$)`, "m");
+  return pluginPattern.test(output);
+}
 async function getSystemInfo(fetcher = defaultVersionFetcher) {
   const fetchCopilotVersion = async () => {
     const binaryVersionPromise = fetcher(["copilot", "--binary-version"]);
@@ -4270,14 +4280,15 @@ async function getSystemInfo(fetcher = defaultVersionFetcher) {
     }
     return fallbackVersionPromise;
   };
-  const [claudeRaw, openCodeRaw, geminiRaw, copilotRaw, nodeRaw, npmRaw, bunRaw] = await Promise.all([
+  const [claudeRaw, openCodeRaw, geminiRaw, copilotRaw, nodeRaw, npmRaw, bunRaw, pluginListRaw] = await Promise.all([
     fetcher(["claude", "--version"]),
     fetcher(["opencode", "--version"]),
     fetcher(["gemini", "--version"]),
     fetchCopilotVersion(),
     fetcher(["node", "--version"]),
     fetcher(["npm", "--version"]),
-    fetcher(["bun", "--version"])
+    fetcher(["bun", "--version"]),
+    fetcher(["copilot", "plugin", "list"])
   ]);
   return {
     version: CURRENT_VERSION,
@@ -4288,6 +4299,7 @@ async function getSystemInfo(fetcher = defaultVersionFetcher) {
     nodeVersion: parseVersion(nodeRaw),
     npmVersion: parseVersion(npmRaw),
     bunVersion: parseVersion(bunRaw),
+    copilotPluginInstalled: hasCopilotSafetyNetPlugin(pluginListRaw),
     platform: `${process.platform} ${process.arch}`
   };
 }
@@ -4353,7 +4365,10 @@ function parseDoctorFlags(args) {
 async function runDoctor(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const system = await getSystemInfo();
-  const hooks = detectAllHooks(cwd, { copilotCliVersion: system.copilotCliVersion });
+  const hooks = detectAllHooks(cwd, {
+    copilotCliVersion: system.copilotCliVersion,
+    copilotPluginInstalled: system.copilotPluginInstalled
+  });
   const configInfo = getConfigInfo(cwd);
   const environment = getEnvironmentInfo();
   const activity = getActivitySummary(7);
@@ -5276,7 +5291,7 @@ function formatTraceJson(result) {
   return JSON.stringify(result, null, 2);
 }
 // src/bin/help.ts
-var version = "0.8.0";
+var version = "0.8.1";
 var INDENT = "  ";
 var PROGRAM_NAME = "cc-safety-net";
 function formatOptionFlags(option) {

package/dist/bin/doctor/hooks.d.ts

@@ -6,6 +6,7 @@ import type { LoadConfigOptions } from '@/core/config';
 interface HookDetectOptions extends LoadConfigOptions {
     homeDir?: string;
     copilotCliVersion?: string | null;
+    copilotPluginInstalled?: boolean;
 }
 /**
  * Strip JSONC-style comments and trailing commas from a string.

package/dist/bin/doctor/types.d.ts

@@ -105,6 +105,8 @@ export interface SystemInfo {
     npmVersion: string | null;
     /** Bun version (from `bun --version`) */
     bunVersion: string | null;
+    /** Whether the copilot-safety-net plugin is installed (from `copilot plugin list`) */
+    copilotPluginInstalled: boolean;
     /** Platform (e.g., "darwin arm64") */
     platform: string;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Claude Code / OpenCode plugin - block destructive git and filesystem commands before execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",