cc-safety-net 0.8.1 → 0.8.2

package/dist/bin/cc-safety-net.js

@@ -2865,6 +2865,7 @@ function normalizePathForComparison(p) {
 }
 var REASON_RM_RF = "rm -rf outside cwd is blocked. Use explicit paths within the current directory, or delete manually.";
 var REASON_RM_RF_ROOT_HOME = "rm -rf targeting root or home directory is extremely dangerous and always blocked.";
+var REASON_RM_HOME_CWD = "rm -rf in home directory is dangerous. Change to a project directory first.";
 function analyzeRm(tokens, options = {}) {
   const {
     cwd,
@@ -2921,18 +2922,16 @@ function classifyTarget(target, ctx) {
   if (isDangerousRootOrHomeTarget(target)) {
     return { kind: "root_or_home_target" };
   }
-  const anchoredCwd = ctx.anchoredCwd;
-  if (anchoredCwd) {
-    if (isCwdSelfTarget(target, anchoredCwd)) {
-      return { kind: "cwd_self_target" };
-    }
-  }
   if (isTempTarget(target, ctx.trustTmpdirVar)) {
     return { kind: "temp_target" };
   }
+  const anchoredCwd = ctx.anchoredCwd;
   if (anchoredCwd) {
     if (isCwdHomeForRmPolicy(anchoredCwd, ctx.homeDir)) {
-      return { kind: "root_or_home_target" };
+      return { kind: "home_cwd_target" };
+    }
+    if (isCwdSelfTarget(target, anchoredCwd)) {
+      return { kind: "cwd_self_target" };
     }
     if (isTargetWithinCwd(target, anchoredCwd, ctx.resolvedCwd ?? anchoredCwd)) {
       return { kind: "within_anchored_cwd" };
@@ -2944,10 +2943,12 @@ function reasonForClassification(classification, ctx) {
   switch (classification.kind) {
     case "root_or_home_target":
       return REASON_RM_RF_ROOT_HOME;
-    case "cwd_self_target":
-      return REASON_RM_RF;
     case "temp_target":
       return null;
+    case "home_cwd_target":
+      return REASON_RM_HOME_CWD;
+    case "cwd_self_target":
+      return REASON_RM_RF;
     case "within_anchored_cwd":
       if (ctx.paranoid) {
         return `${REASON_RM_RF} (SAFETY_NET_PARANOID_RM enabled)`;
@@ -3069,14 +3070,6 @@ function isTargetWithinCwd(target, originalCwd, effectiveCwd) {
     return false;
   }
 }
-function isHomeDirectory(cwd) {
-  const home = process.env.HOME ?? homedir3();
-  try {
-    return normalizePathForComparison(cwd) === normalizePathForComparison(home);
-  } catch {
-    return false;
-  }
-}
 
 // src/core/analyze/parallel.ts
 var REASON_PARALLEL_RM = "parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.";
@@ -3497,7 +3490,6 @@ function matchesBlockArgs(tokens, blockArgs, shortOpts) {
 // src/core/analyze/segment.ts
 var REASON_INTERPRETER_DANGEROUS = "Detected potentially dangerous command in interpreter code.";
 var REASON_INTERPRETER_BLOCKED = "Interpreter one-liners are blocked in paranoid mode.";
-var REASON_RM_HOME_CWD = "rm -rf in home directory is dangerous. Change to a project directory first.";
 function deriveCwdContext(options) {
   const cwdUnknown = options.effectiveCwd === null;
   const cwdForRm = cwdUnknown ? undefined : options.effectiveCwd ?? options.cwd;
@@ -3561,11 +3553,6 @@ function analyzeSegment(tokens, depth, options) {
     }
   }
   if (isRm) {
-    if (cwdForRm && isHomeDirectory(cwdForRm)) {
-      if (hasRecursiveForceFlags(stripped)) {
-        return REASON_RM_HOME_CWD;
-      }
-    }
     const rmResult = analyzeRm(stripped, {
       cwd: cwdForRm,
       originalCwd,
@@ -4208,7 +4195,7 @@ function detectAllHooks(cwd, options) {
 
 // src/bin/doctor/system-info.ts
 import { spawn } from "node:child_process";
-var CURRENT_VERSION = "0.8.1";
+var CURRENT_VERSION = "0.8.2";
 var VERSION_FETCH_TIMEOUT_MS = 2000;
 function getPackageVersion() {
   return CURRENT_VERSION;
@@ -4682,19 +4669,9 @@ function explainSegment(tokens, depth, options, steps) {
       return { reason };
   }
   if (isRm) {
-    if (effectiveCwd && isHomeDirectory(effectiveCwd) && hasRecursiveForceFlags(strippedTokens)) {
-      const reason2 = "rm -rf in home directory is dangerous. Change to a project directory first.";
-      steps.push({
-        type: "rule-check",
-        ruleModule: "rules-rm.ts",
-        ruleFunction: "isHomeDirectory",
-        matched: true,
-        reason: reason2
-      });
-      return { reason: reason2 };
-    }
     const reason = analyzeRm(strippedTokens, {
-      cwd: effectiveCwd ?? undefined,
+      cwd: cwdForRm,
+      originalCwd,
       paranoid: options.paranoidRm,
       allowTmpdirVar
     });
@@ -5291,7 +5268,7 @@ function formatTraceJson(result) {
   return JSON.stringify(result, null, 2);
 }
 // src/bin/help.ts
-var version = "0.8.1";
+var version = "0.8.2";
 var INDENT = "  ";
 var PROGRAM_NAME = "cc-safety-net";
 function formatOptionFlags(option) {

package/dist/core/rules-rm.d.ts

@@ -6,4 +6,5 @@ export interface AnalyzeRmOptions {
     tmpdirOverridden?: boolean;
 }
 export declare function analyzeRm(tokens: string[], options?: AnalyzeRmOptions): string | null;
+/** @internal Exported for testing */
 export declare function isHomeDirectory(cwd: string): boolean;

package/dist/index.js

@@ -1724,6 +1724,7 @@ function normalizePathForComparison(p) {
 }
 var REASON_RM_RF = "rm -rf outside cwd is blocked. Use explicit paths within the current directory, or delete manually.";
 var REASON_RM_RF_ROOT_HOME = "rm -rf targeting root or home directory is extremely dangerous and always blocked.";
+var REASON_RM_HOME_CWD = "rm -rf in home directory is dangerous. Change to a project directory first.";
 function analyzeRm(tokens, options = {}) {
   const {
     cwd,
@@ -1780,18 +1781,16 @@ function classifyTarget(target, ctx) {
   if (isDangerousRootOrHomeTarget(target)) {
     return { kind: "root_or_home_target" };
   }
-  const anchoredCwd = ctx.anchoredCwd;
-  if (anchoredCwd) {
-    if (isCwdSelfTarget(target, anchoredCwd)) {
-      return { kind: "cwd_self_target" };
-    }
-  }
   if (isTempTarget(target, ctx.trustTmpdirVar)) {
     return { kind: "temp_target" };
   }
+  const anchoredCwd = ctx.anchoredCwd;
   if (anchoredCwd) {
     if (isCwdHomeForRmPolicy(anchoredCwd, ctx.homeDir)) {
-      return { kind: "root_or_home_target" };
+      return { kind: "home_cwd_target" };
+    }
+    if (isCwdSelfTarget(target, anchoredCwd)) {
+      return { kind: "cwd_self_target" };
     }
     if (isTargetWithinCwd(target, anchoredCwd, ctx.resolvedCwd ?? anchoredCwd)) {
       return { kind: "within_anchored_cwd" };
@@ -1803,10 +1802,12 @@ function reasonForClassification(classification, ctx) {
   switch (classification.kind) {
     case "root_or_home_target":
       return REASON_RM_RF_ROOT_HOME;
-    case "cwd_self_target":
-      return REASON_RM_RF;
     case "temp_target":
       return null;
+    case "home_cwd_target":
+      return REASON_RM_HOME_CWD;
+    case "cwd_self_target":
+      return REASON_RM_RF;
     case "within_anchored_cwd":
       if (ctx.paranoid) {
         return `${REASON_RM_RF} (SAFETY_NET_PARANOID_RM enabled)`;
@@ -1928,14 +1929,6 @@ function isTargetWithinCwd(target, originalCwd, effectiveCwd) {
     return false;
   }
 }
-function isHomeDirectory(cwd) {
-  const home = process.env.HOME ?? homedir();
-  try {
-    return normalizePathForComparison(cwd) === normalizePathForComparison(home);
-  } catch {
-    return false;
-  }
-}
 
 // src/core/analyze/parallel.ts
 var REASON_PARALLEL_RM = "parallel rm -rf with dynamic input is dangerous. Use explicit file list instead.";
@@ -2356,7 +2349,6 @@ function matchesBlockArgs(tokens, blockArgs, shortOpts) {
 // src/core/analyze/segment.ts
 var REASON_INTERPRETER_DANGEROUS = "Detected potentially dangerous command in interpreter code.";
 var REASON_INTERPRETER_BLOCKED = "Interpreter one-liners are blocked in paranoid mode.";
-var REASON_RM_HOME_CWD = "rm -rf in home directory is dangerous. Change to a project directory first.";
 function deriveCwdContext(options) {
   const cwdUnknown = options.effectiveCwd === null;
   const cwdForRm = cwdUnknown ? undefined : options.effectiveCwd ?? options.cwd;
@@ -2420,11 +2412,6 @@ function analyzeSegment(tokens, depth, options) {
     }
   }
   if (isRm) {
-    if (cwdForRm && isHomeDirectory(cwdForRm)) {
-      if (hasRecursiveForceFlags(stripped)) {
-        return REASON_RM_HOME_CWD;
-      }
-    }
     const rmResult = analyzeRm(stripped, {
       cwd: cwdForRm,
       originalCwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Claude Code / OpenCode plugin - block destructive git and filesystem commands before execution",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",