cc-safety-net 2.0.4 → 2.0.6

package/dist/bin/cc-safety-net.js

@@ -1,43 +1,43 @@
 #!/usr/bin/env node
-import{$ as tr,$a as Ue,A as pn,Aa as Ze,B as Il,Ba as Nt,C as P,Ca as Qe,D as U,Da as Xe,E as Gt,Ea as O,F as Xt,Fa as At,G as Hn,Ga as Ct,H as Yt,Ha as Ut,I as C2,Ia as T,J as $2,Ja as g3,K as Ot,Ka as bn,L as s2,La as D3,M as b1,Ma as fe,N as nr,Na as m3,O as An,Oa as k3,P as f1,Pa as q3,Q as y1,Qa as Lt,R as Rn,Ra as j3,S as Kn,Sa as F3,T as yn,Ta as r1,U as hn,Ua as e1,V as Ee,Va as a1,W as un,Wa as l1,X as g2,Xa as r3,Y as Tt,Ya as Ge,Z as U2,Za as Ce,_ as h1,_a as Wt,aa as $1,ab as Oe,b as $e,ba as g1,bb as o2,c as ge,ca as _e,cb as x2,d as A,da as je,db as l2,e as De,ea as Pe,eb as Te,f as Bt,fa as Ie,fb as W,g as Z,ga as Ne,gb as fn,h as D,ha as Et,hb as on,i as sn,ia as Fe,ib as x1,j as g,ja as m,jb as wn,k as w2,ka as _t,kb as L2,l as Ae,la as w1,lb as B1,m as W2,ma as d2,mb as Wn,n as Ln,na as vn,o as s3,oa as Pt,p as Qt,pa as It,q as We,qa as n1,r as cn,ra as t1,s as Re,sa as ze,t as Vt,ta as V2,u as Ke,ua as St,v as Me,va as Ht,w as E,wa as Ve,x as _,xa as H2,y as K2,ya as $3,z as M2,za as Je}from"../chunks/index-xvfhq21r.js";var X3=["-h","--help"];function F(n,t){let r=Object.entries(n.booleans??{}),e=Object.entries(n.values??{}),a=Object.fromEntries(r.map(([i])=>[i,!1])),l={},d=[],s=[],L=!1,c=-1;for(let[i,u]of t.entries()){if(i<=c)continue;if(u==="--"){d.push(...t.slice(i+1));break}if(X3.includes(u)){L=!0;continue}let v=r.find(([,f])=>f.includes(u));if(v){a[v[0]]=!0;continue}let p=e.find(([,f])=>f.includes(u));if(p){let f=t[i+1];if(f===void 0||f.startsWith("-")){s.push(`${u} requires a value`);continue}l[p[0]]=f,c=i+1;continue}if(u.startsWith("-")){s.push(`Unknown option for ${n.label}: ${u}`);continue}if(n.positionals==="tail"){d.push(...t.slice(i));break}d.push(u)}if(n.positionals!=="list"&&n.positionals!=="tail")s.push(...d.map((i)=>`Unexpected argument for ${n.label}: ${i}`));return{flags:a,values:l,positionals:d,help:L,errors:s}}function e2(n){for(let t of n)console.error(t);return n.length>0}import{readdirSync as wd,statSync as s1,unlinkSync as xd}from"node:fs";import{basename as L1,dirname as $d,join as gd,resolve as Dd}from"node:path";function z(n){return Array.from(n,(t)=>{let r=t.charCodeAt(0);if(r<=31||r>=127&&r<=159)return`\\x${r.toString(16).padStart(2,"0")}`;return t}).join("")}var qt=(n)=>{let t=Date.now()-new Date(n).getTime();if(!Number.isFinite(t))return"";let r=Math.floor(t/60000),e=Math.floor(r/60),a=Math.floor(e/24);if(a>0)return`${a}d ago`;if(e>0)return`${e}h ago`;if(r>0)return`${r}m ago`;return"just now"},X2=(n)=>{let t=(n??"").trim().split(/\s+/).filter((a)=>a&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(a)),r=t[0]?.split("/").pop();if(!r)return null;let e=t[1];return e&&/^[a-z][a-z0-9-]*$/.test(e)?`${r} ${e}`:r};import{existsSync as Y3,readdirSync as S3,readFileSync as H3}from"node:fs";import{join as A3}from"node:path";function u2(n,t){try{return S3(n,{withFileTypes:!0,encoding:"utf8"}).flatMap((r)=>{let e=A3(n,r.name);if(r.isDirectory())return u2(e,t);if(r.name.endsWith(".jsonl"))return[e];return[]})}catch{if(t&&Y3(n))t.count++;return[]}}function jt(n){let t=(a)=>`${a.sessionId}
-${X2(a.segment||a.command)}`,r=n.filter((a)=>a.decision!=="allow"),e=r.filter((a)=>a.sessionId).reduce((a,l)=>a.set(t(l),(a.get(t(l))??0)+1),new Map);return new Set(r.filter((a)=>a.failureStage||(e.get(t(a))??0)>=2))}function dn(n,t){try{return H3(n,"utf-8").split(`
-`).filter(Boolean).flatMap((r)=>{try{return[JSON.parse(r)]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as pd}from"node:path";var W3=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function me(n){let t=0,r={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(e){n.record({kind:"step",scope:"global",step:e})},recordSegment(e,a=r.currentSegmentIndex){if(a===void 0)return;n.record({kind:"step",scope:"segment",segmentIndex:a,step:e})}};return r}function ke(n={}){let t=[],r=n.maxEvents??512,e={maxTextLength:n.maxTextLength??2048,maxListLength:n.maxListLength??128,maxObjectProperties:n.maxObjectProperties??n.maxListLength??128,maxDepth:n.maxDepth??16},a=0,l,d=new Set;return{record(s){if(l)return;try{if(!s||t.length>=r){a++;return}t.push(zt(R3(s,e,d)))}catch{a++}},finish(s){if(l)return l;try{l=zt({events:Object.freeze(t),droppedEvents:a,terminal:K3(s,e,d)})}catch{a++,l=Object.freeze({events:Object.freeze(t),droppedEvents:a,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,e.maxTextLength),segment:"trace unavailable".slice(0,e.maxTextLength)})})}return l}}}function R3(n,t,r){if(n.kind!=="step")throw TypeError("invalid trace event");let{scope:e,step:a}=n;Xn(a,r,t);let l=Y2(a,t,r);if(e==="global")return{kind:"step",scope:"global",step:l};if(e!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:n.segmentIndex,step:l}}function K3(n,t,r){let e=n.result;if(e==="allowed")return Object.freeze({result:"allowed"});if(e!=="blocked")throw TypeError("invalid trace terminal");let a=n.ruleId;return Object.freeze({result:"blocked",reason:Y2(n.reason,t,r),segment:Y2(n.segment,t,r),...a?{ruleId:Y2(a,t,r)}:{}})}function Xn(n,t,r,e=0,a=new WeakSet){if(typeof n==="string"){let s=n.slice(0,r.maxTextLength);if(!Bt(s))return;for(let L of De(s))for(let c of L.match(/[^\s"'()$]+/g)??[])t.add(qe(c));return}if(!n||typeof n!=="object"||e>=r.maxDepth||a.has(n))return;if(a.add(n),Array.isArray(n)){let s=Math.min(n.length,r.maxListLength);for(let L=0;L<s;L++)Xn(n[L],t,r,e+1,a);return}let l=0,d=new Set;for(let s in n){if(!Object.hasOwn(n,s))continue;if(l>=r.maxObjectProperties)break;l++,Xn(s,t,r);let L=Ft(s,r,t);if(d.has(L))continue;d.add(L),Xn(n[s],t,r,e+1,a)}}function Y2(n,t,r,e=0,a=new WeakSet){if(typeof n==="string")return Ft(n,t,r);if(!n||typeof n!=="object")return n;if(e>=t.maxDepth)return;if(a.has(n))return;if(a.add(n),Array.isArray(n)){let s=[],L=Math.min(n.length,t.maxListLength);for(let c=0;c<L;c++)s.push(Y2(n[c],t,r,e+1,a));return s}let l={},d=0;for(let s in n){if(!Object.hasOwn(n,s))continue;if(d>=t.maxObjectProperties)break;d++;let L=Ft(s,t,r);if(Object.hasOwn(l,L))continue;Object.defineProperty(l,L,{value:Y2(n[s],t,r,e+1,a),enumerable:!0,configurable:!0,writable:!0})}return l}function Ft(n,t,r){let e=n.slice(0,t.maxTextLength),a=Bt(e)?ge(e):e,l=r.size>0?V3(a,r):a;return(M3(l)?$e(l):l).slice(0,t.maxTextLength)}function M3(n){return n.includes("PRIVATE KEY")||n.includes("://")||n.includes("eyJ")||n.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(n)||n.length>=14&&W3.some((t)=>n.includes(t))||n.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(n)}function V3(n,t){return n.replace(/[^\s"'()$]+/g,(r)=>t.has(qe(r))?"<redacted>":r)}function qe(n){let t=2166136261,r=2166136261;for(let e=0;e<n.length;e++)t=Math.imul(t^n.charCodeAt(e),16777619),r=Math.imul(r^n.charCodeAt(n.length-e-1),16777619);return`${t>>>0}:${r>>>0}:${n.length}`}function zt(n){if(n&&typeof n==="object"&&!Object.isFrozen(n)){for(let t of Object.values(n))zt(t);Object.freeze(n)}return n}function Be(n,t,r,e){let a=e??je(),l=r??a.getCommandProgram(n,t.shell??"auto"),d=ke(),s=me(d),L=l.dialect==="powershell"?a.getCommandProgram(n,"posix"):l,c=Fe(L);s.recordGlobal({type:"parse",input:n,segments:c.map((v)=>[...v])});let i=ze(n,{...t,analyzePartialProgram:!0,trace:s},l,a),u=s.getNextSegmentIndex();if(i&&u>0&&u<c.length)s.recordSegment({type:"segment-skipped",index:u,reason:"prior-segment-blocked"},u);return Object.freeze({decision:i,trace:d.finish(i?{result:"blocked",reason:i.reason,segment:i.evidence.find((v)=>v.kind==="command")?.segment??n,...i.ruleId?{ruleId:i.ruleId}:{}}:{result:"allowed"}),program:l})}import{resolve as G3}from"node:path";function Jt(n){let t=Je().safeParse(n);return{errors:t.success?[]:Qe(t.error.issues),ruleNames:new Set(Ze(n).map((r)=>r.toLowerCase()))}}function Zt(n){let t=Ye(n);if(!t.ok)return t.result;return Jt(t.parsed)}function Ye(n){let t=[],r=new Set;try{let e=typeof n==="string"?sn(n):n,a=g(e);if(a===null)return t.push(`File not found: ${e.path}`),{ok:!1,result:{errors:t,ruleNames:r}};if(!a.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:r}};return{ok:!0,parsed:JSON.parse(a)}}catch(e){if(e instanceof Z)return t.push(e.message),{ok:!1,result:{errors:t,ruleNames:r}};let a=e instanceof Error?e.message:String(e);return t.push(e instanceof SyntaxError?"Invalid JSON":a),{ok:!1,result:{errors:t,ruleNames:r}}}}function Se(n){return G3(n??process.cwd(),".safety-net.json")}function a2(n){let t=Ye(n);if(!t.ok)return t.result;let r=Xe(t.parsed);return{errors:r.errors,ruleNames:r.sources}}import{isAbsolute as C3,join as Yn,relative as U3,resolve as He,sep as O3}from"node:path";async function R2(n={}){let t=Kt(n);return T3(t,await Sn(t,H2()))}function T3(n,t){if(!t.ok)return t;let r=U(n),e=[...new Set(l2(r.configPath,r.lockPath,n,r.filesystemScope))];if(e.length===0)return t;return{ok:!1,errors:e,warnings:t.warnings,entries:t.entries}}async function Sn(n,t,r,e={}){let a=null,l=!1;try{let d=U(n),s=At(d.configTarget);if(!s.ok)return s.result;let L=s.config;if(n.check)return nd(L,d,n);a={target:d.lockTarget,content:g(d.lockTarget)};let c=Wt(d.lockTarget);if(c.errors.some((y)=>y.startsWith("Unable to access ")))return{ok:!1,errors:c.errors,warnings:[],entries:[]};if(n.only&&c.errors.length>0)return{ok:!1,errors:c.errors,warnings:[],entries:[]};let i=c.errors.length>0?null:c.lock,u=n.only?Ge(L,i,n.only):{ok:!0,specs:L.rules};if(!u.ok)return u.result;if(n.only&&!i&&u.specs.length<L.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${Me}`],warnings:[],entries:[]};let v=(await _3(u.specs,(y)=>Ue(y,d.configDir,n,i,d.filesystemScope,t),t)).map((y)=>td(y,i,r));for(let y of v)ad(y.content,y.entry,d.configDir,n,d.filesystemScope);let p=n.only?rd(L,i,v):v.map((y)=>y.entry);l=!0,T(d.lockTarget,{version:1,rulebooks:p},void 0,e._testAfterPolicyRename);let f=new Map(v.map((y)=>[y.entry.spec,y.rulebook.rules.length])),o=ld(p,d.configDir,n,d.filesystemScope,e);return{ok:!0,errors:[],warnings:o,entries:p.map((y)=>ed(y,f))}}catch(d){if(l&&a)try{S2(a.target,a.content)}catch(s){return A2(s)}return A2(d)}}async function Rt(n,t={}){return E3(n,Kt(t),H2())}async function E3(n,t,r,e={}){let a=null,l=!1;try{let d=U(t),s=g(d.configTarget);a={target:d.configTarget,content:s};let L=At(d.configTarget);if(!L.ok)return L.result;let c=L.config,i=Ke(n)?await Oe(n,r):[{spec:n}],u=i.map((f)=>f.spec),v=[...new Set([...c.rules,...u])];if(v.length>St)return P3();if(v.length!==c.rules.length)l=!0,T(d.configTarget,{version:1,rules:v,overrides:c.overrides??{},transparent_wrappers:c.transparent_wrappers??[]},void 0,e._testAfterPolicyRename);let p=await Sn(t,r,new Map(i.filter((f)=>!!f.display_ref).map((f)=>[f.spec,f.display_ref])),e);if(!p.ok)S2(d.configTarget,s);return p}catch(d){if(l&&a)try{S2(a.target,a.content)}catch(s){return A2(s)}return A2(d)}}async function _3(n,t,r=H2()){if(n.length>St)throw Error(Ht);let e=Array(n.length),a=0,l,d=Array.from({length:Math.min(n.length,Ve.concurrency)},async()=>{while(!l){let s=a;if(s>=n.length)return;a++;try{e[s]=await t(n[s],s,r.controller.signal)}catch(L){if(!l)l={value:L},a=n.length,r.controller.abort(L);return}}});if(await Promise.all(d),l)throw l.value;return e}function P3(){return{ok:!1,errors:[Ht],warnings:[],entries:[]}}function Kt(n){return{cwd:n.cwd,cacheConfigDir:n.cacheConfigDir,userConfigDir:n.userConfigDir,userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath,global:n.global,check:n.check,only:n.only,refresh:n.refresh}}function I3(n){return{...Kt(n),deleteSource:n.deleteSource}}async function Mt(n,t={}){try{return await N3(n,I3(t),{})}catch(r){return A2(r)}}async function N3(n,t,r){let e=U(t),a=O(e.configTarget);if(a.errors.length>0)return{ok:!1,errors:a.errors,warnings:[],entries:[]};if(!a.config)return{ok:!1,errors:[`No config found at ${e.configPath}`],warnings:[],entries:[]};let l=Wt(e.lockTarget);if(l.errors.length>0)return{ok:!1,errors:l.errors,warnings:[],entries:[]};let d=Ce(a.config.rules,l.lock,n);if(!d.ok)return d.result;let s=t.deleteSource?dd(e.configDir,d.specs,l.lock,e.filesystemScope):{ok:!0,dirs:[]};if(!s.ok)return s.result;let L=g(e.configTarget);if(L===null)return A2(Error("Rules config is unavailable."));try{T(e.configTarget,{version:1,rules:a.config.rules.filter((u)=>!d.specs.includes(u)),overrides:a.config.overrides??{},transparent_wrappers:a.config.transparent_wrappers??[]},void 0,r._testAfterPolicyRename)}catch(u){throw S2(e.configTarget,L),u}let c=await Sn(t,H2(),void 0,r);if(!c.ok)return S2(e.configTarget,L),c;let i=Ld(s.dirs,r,e.filesystemScope);if(!i.ok){S2(e.configTarget,L);let u=await Sn(t,H2(),void 0,r);if(!u.ok)return{ok:!1,errors:[...i.result.errors,...u.errors],warnings:u.warnings,entries:u.entries};return i.result}return c}async function nd(n,t,r){let e=Te(n,t.lockPath,t.configDir,r,r.global?"user":"project",t.filesystemScope);return{ok:e.errors.length===0&&e.warnings.length===0,errors:[...e.errors,...e.warnings],warnings:[],entries:e.entries}}function td(n,t,r){let e=t?.rulebooks.find((l)=>l.spec===n.entry.spec&&l.kind==="github"),a=r?.get(n.entry.spec)??(e?.kind==="github"?e.display_ref:void 0);if(!a||n.entry.kind!=="github")return n;return{...n,entry:{...n.entry,display_ref:a}}}function rd(n,t,r){let e=new Set(n.rules),a=new Set(t?.rulebooks.map((d)=>d.spec)??[]),l=new Map(r.map((d)=>[d.entry.spec,d.entry]));return[...(t?.rulebooks.filter((d)=>e.has(d.spec))??[]).map((d)=>l.get(d.spec)??d),...r.filter((d)=>!a.has(d.entry.spec)).map((d)=>d.entry)]}function ed(n,t){return{...n,ruleCount:t.get(n.spec)}}function ad(n,t,r,e,a){let l=Xt(t,Yt(r,e));w2(D(a,l),n)}function ld(n,t,r,e,a){let l=Yt(t,r),d=Hn(l),s=D(e,d),L=W2(s);if(!L)return[];let c=n.map((u)=>D(e,Xt(u,l))),i=L.filter((u)=>u.kind==="directory").map((u)=>({directory:D(e,Yn(d,u.name)),identity:D(e,Yn(d,u.name,Re))})).filter((u)=>!c.some((v)=>Ae(u.identity,v))).map((u)=>u.directory);for(let u of i)We(u);return i.flatMap((u)=>{try{return cd(u,a),[]}catch{return["Unable to prune rules policy cache safely."]}})}function dd(n,t,r,e){let a=new Map(r?.rulebooks.map((c)=>[c.spec,c])??[]),l=t.flatMap((c)=>{let i=a.get(c);if(!i)return cn.test(c)?[]:["--delete-source can only delete local rulebook sources"];return i.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),d=t.map((c)=>{let i=a.get(c);return Yn(n,i?.kind==="local-directory"?i.path:c)}),s=l.length>0?[]:d.flatMap((c)=>sd(n,c,e)),L=[...l,...s];return L.length>0?{ok:!1,result:{ok:!1,errors:L,warnings:[],entries:[]}}:{ok:!0,dirs:d}}function sd(n,t,r){let e=He(n),a=He(t),l=U3(e,a);if(l===""||l===".."||l.startsWith(`..${O3}`)||C3(l))return[`Refusing to delete local rulebook source outside ${n}: ${t}`];let d=D(r,a),s=W2(d);if(!s)return[`Local rulebook source directory not found: ${t}`];let L=s.find((c)=>c.name==="rulebook.json");if(!L)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(L.kind!=="file")throw new Z(r.label);if(g(D(r,Yn(a,"rulebook.json"))),s.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function Ld(n,t,r){let e=n.flatMap((a)=>{try{return id(D(r,a),t),[]}catch(l){return[`Failed to delete local rulebook source ${a}: ${l instanceof Error?l.message:String(l)}`]}});return e.length>0?{ok:!1,result:{ok:!1,errors:e,warnings:[],entries:[]}}:{ok:!0}}function cd(n,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(n.path);return}Qt(n)}function id(n,t){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(n.path);return}Qt(n)}function S2(n,t){if(t===null){Ln(n);return}w2(n,t)}function A2(n){return{ok:!1,errors:[n instanceof Error?n.message:String(n)],warnings:[],entries:[]}}function G2(n,t){let r=od(t),e=n1(r),a={effectiveLevel:e.effectiveLevel,selectedPreset:r.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:e.effectiveCapabilities,destructiveCommandRuleOverrides:r.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:l,configValid:d}=ud({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!n||!n.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:l,configValid:d,...a};let s=vd(n,r);if(s)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",ruleModule:s.ruleModule,ruleFunction:s.ruleFunction,matched:!0,reason:s.reason}]}]},result:"blocked",reason:A(s.reason),segment:A(s.target),...s.ruleId?{ruleId:A(s.ruleId)}:{},configSource:l,configValid:d,...a};let L=Be(n,r),c=L.decision,i=c?.ruleId??bd(n,r),u=un.find((p)=>p.id===i&&p.activationCapability),v=u?e.policy.effectiveDestructiveCommandRules[u.id]:void 0;return{trace:yd(L.trace),result:c?"blocked":"allowed",reason:c?A(c.reason):void 0,segment:c?A(c.evidence.find((p)=>p.kind==="command")?.segment??n):void 0,ruleId:c?.ruleId?A(c.ruleId):void 0,customRule:fd(hd(c?.ruleId,r.policySnapshot)),configSource:l,configValid:d,...a,...u&&v?{ruleActivation:{id:u.id,...v}}:{}}}function ud(n){let t=E(n?.cwd),r=n?.userConfigPath??_(n),e=P({cwd:n?.cwd,userConfigDir:n?.userConfigDir,userConfigPath:n?.userConfigPath});try{if(g(e.projectConfigTarget)!==null){if(a2(e.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(a){if(a instanceof Z)return{configSource:t,configValid:!1};throw a}try{if(g(e.userConfigTarget)!==null){let a=a2(e.userConfigTarget);return{configSource:r,configValid:a.errors.length===0}}return{configSource:null,configValid:!0}}catch(a){if(a instanceof Z)return{configSource:r,configValid:!1};throw a}}function od(n){let t=pd(n?.cwd??process.cwd()),r=n?.policySnapshot??W({cwd:t,userConfigDir:n?.userConfigDir}),e=d2(r.policy);return{cwd:t,effectiveCwd:t,policySnapshot:r,environment:Ee(),protectedGitMetadata:Ne(t),effectiveCapabilities:e.capabilities,strict:n?.strict??e.strict,paranoidRm:e.paranoidRm,paranoidInterpreters:e.paranoidInterpreters,worktreeMode:e.worktreeMode}}function vd(n,t){let r=t.cwd??process.cwd(),e=_e(V2("",{command:n},{kind:"command",shell:"posix"},{executionCwd:r,configCwd:r},n)),a=e1(e);if(a)return{reason:r1,target:a.target,ruleId:"policy-protection",ruleModule:"policy-protection",ruleFunction:"findPolicyConfigMutationTarget"};let l=Ie(e,t.protectedGitMetadata);if(l)return{reason:Pe,target:l.target,ruleId:"git-metadata-protection",ruleModule:"git-metadata-protection",ruleFunction:"findGitMetadataMutationTarget"};let d=t.policySnapshot.policy,s=d.secretProtection.enabled===!1?null:l1(e,d.secretProtection,{strict:t.strict});if(s)return{reason:a1,target:s.target,ruleId:s.ruleId,ruleModule:"secret-protection",ruleFunction:"findSensitiveTarget"};return null}function bd(n,t){let r=t.policySnapshot.policy,e=on({...r,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...r.destructiveCommandRuleOverrides,...Object.fromEntries(un.flatMap((a)=>a.activationCapability?[[a.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return t1(n,{...t,policySnapshot:e,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function fd(n){if(!n)return;return{id:A(n.id),...n.rulebook?{rulebook:{name:A(n.rulebook.name),version:A(n.rulebook.version)}}:{},...n.source?{source:A(n.source)}:{},...n.override?{override:{type:"reason",reason:A(n.override.reason)}}:{}}}function yd(n){let t=n.events.flatMap((e)=>e.kind==="step"&&e.scope==="global"?[e.step]:[]),r=new Map;for(let e of n.events){if(e.kind!=="step"||e.scope!=="segment")continue;let a=r.get(e.segmentIndex)??{index:e.segmentIndex,steps:[]};a.steps.push(e.step),r.set(e.segmentIndex,a)}return{steps:t,segments:[...r.values()]}}function hd(n,t){let r=n?.replace(/^custom\./,"");if(!r||!t.policy.rules.some((e)=>e.name===r))return;return t.ruleMetadata[r]??Object.freeze({id:r})}function md(n){let t=C2(),r=F({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},n);if(e2(r.errors))return null;if(r.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(r.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let e=r.values.limit===void 0?20:d1(r.values.limit);if(e===null)return console.error("--limit must be a positive number"),null;let a=r.values.since===void 0?Math.min(30,t):d1(r.values.since);if(a===null||a>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let l={limit:e,limitExplicit:r.values.limit!==void 0,since:a,sinceExplicit:r.values.since!==void 0,all:r.flags.all,json:r.flags.json,suspect:r.flags.suspect,pruneLegacy:r.flags.pruneLegacy,dryRun:r.flags.dryRun,id:r.values.id,agent:r.values.agent,rule:r.values.rule,session:r.values.session,project:r.values.project===void 0?void 0:Dd(r.values.project)};if(l.id&&(l.agent!==void 0||l.rule!==void 0||l.session!==void 0||l.project!==void 0||l.suspect||l.sinceExplicit||l.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(l.pruneLegacy&&(l.id!==void 0||l.agent!==void 0||l.rule!==void 0||l.session!==void 0||l.project!==void 0||l.suspect||l.all||l.sinceExplicit||l.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(l.dryRun&&!l.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return l}async function c1(n,t={}){let r=md(n);if(!r)return 1;let e=t.logsDir??s2();if(r.pruneLegacy)return kd(e,r.json,r.dryRun);if(!e)return console.log(r.json?"[]":r.id?`No retained audit log entry found for id ${z(r.id)}.`:"No audit log entries found."),0;$2(e);let a={count:0},l=u2(e,a).flatMap((i)=>dn(i,a).map((u)=>({entry:u,file:i})));if(a.count>0)console.error(`warning: ${a.count} audit log ${a.count===1?"source":"sources"} could not be read; these results are incomplete`);if(r.id)return zd(l,r,t.timeZone);let d=Date.now()-r.since*24*60*60*1000,s=l.filter((i)=>Bd(i,r,e,d)),L=r.suspect?jt(s.map((i)=>i.entry)):null,c=(L?s.filter((i)=>L.has(i.entry)):s).sort((i,u)=>Date.parse(u.entry.ts)-Date.parse(i.entry.ts)).slice(0,r.limit);if(r.json)return console.log(JSON.stringify(c.map((i)=>i.entry),null,2)),0;if(c.length===0)return console.log("No audit log entries found."),0;for(let i of c)console.log(Qd(i.entry,t.timeZone));return 0}function kd(n,t,r){let e=n?jd(n).map((s)=>gd(n,s)):[];if(r)return qd(e,t);let a=[],l=0,d=0;for(let s of e){let L=s1(s,{throwIfNoEntry:!1})?.size??0,c=Fd(s);if(c){a.push(`${L1(s)}: ${c}`);continue}l++,d+=L}if(t)return console.log(JSON.stringify({removedFiles:l,removedBytes:d,failedFiles:a.length})),a.length===0?0:1;console.log(l===0&&a.length===0?"No legacy audit log files found.":`Removed ${l} legacy audit log ${l===1?"file":"files"} (${i1(d)}).`);for(let s of a)console.error(`Could not remove ${z(s)}`);if(console.log("Nested v2 audit logs were not changed."),l>0)console.log("This deletion cannot be undone.");return a.length===0?0:1}function qd(n,t){let r=n.reduce((e,a)=>e+(s1(a,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:n.length,bytes:r})),0;if(console.log(n.length===0?"No legacy audit log files found.":`Would remove ${n.length} legacy audit log ${n.length===1?"file":"files"} (${i1(r)}).`),console.log("Nested v2 audit logs are not included."),n.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function jd(n){try{return wd(n,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function Fd(n){try{return xd(n),null}catch(t){return t instanceof Error?t.message:String(t)}}function i1(n){let t=["B","KiB","MiB","GiB"],r=Math.min(Math.floor(Math.log2(Math.max(n,1))/10),t.length-1);return`${Math.round(n/1024**r*10)/10} ${t[r]}`}function zd(n,t,r){let e=n.filter((l)=>l.entry.id===t.id);if(e.length>1)return console.error(`Multiple audit log entries found for id ${z(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(e.map((l)=>l.entry),null,2)),0;let a=e[0];if(!a)return console.log(`No retained audit log entry found for id ${z(t.id??"")}.`),0;return console.log(Xd(a.entry,r)),0}function Bd(n,t,r,e){if(!t.all&&n.entry.decision==="allow")return!1;if(Date.parse(n.entry.ts)<e)return!1;if(t.agent!==void 0&&n.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&n.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!Jd(n,r,t.session))return!1;if(t.project!==void 0&&!Zd(n.entry.cwd,t.project))return!1;return!0}function Jd(n,t,r){if(n.entry.sessionId===r)return!0;return $d(n.file)===t&&L1(n.file,".jsonl")===r}function Zd(n,t){if(!n)return!1;return n===t||n.startsWith(`${t}/`)}function Qd(n,t){let r=z(n.id??"-"),e=z(n.decision??"deny"),a=n.cwd?`  [${z(n.cwd)}]`:"",l=n.segment||n.command,d=l===n.command?"":"↳ ",s=l.length>50?`${l.slice(0,50)}…`:l;return`${r.padEnd(16)}  ${z(p1(n.ts,t))}  ${e.padEnd(5)}  ${z(n.agent??"-").padEnd(15)}  ${z(n.ruleId??"-").padEnd(20)}  ${d}${z(s)}${a}`}function Xd(n,t){let r=(a)=>z(a===void 0||a===null||a===""?"-":a),e=n.shape?`${n.agent??"-"} (shape: ${n.shape})`:n.agent??"-";return[`id:        ${r(n.id)}`,`ts:        ${r(p1(n.ts,t))}`,`decision:  ${r(n.decision)}`,`agent:     ${r(e)}`,`level:     ${r(n.level)}`,`tool:      ${r(n.toolName)}`,`rule:      ${r(n.ruleId)}`,`intent:    ${r(n.intent)}`,`stage:     ${r(n.failureStage)}`,`error:     ${r(n.errorCode)}`,`session:   ${r(n.sessionId)}`,`cwd:       ${r(n.cwd)}`,`version:   ${r(n.v)}`,`truncated: ${r(n.truncated===!0?"yes":void 0)}`,`reason:    ${r(n.reason)}`,`command:   ${r(n.command)}`,`segment:   ${r(n.segment)}`].join(`
-`)}function p1(n,t){let r=new Date(n);if(Number.isNaN(r.getTime()))return n;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(r)}function d1(n){let t=Number(n);return Number.isFinite(t)&&t>0?t:null}var u1={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var o1={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var v1={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as D1,relative as Cd}from"node:path";var Yd=8388608;function Sd(n,t){console.log(JSON.stringify(n(f1(t))))}async function Hd(n){let t;try{t=(await rr(process.stdin)).trim()}catch{n({reason:"Failed to parse hook input JSON."});return}if(!t){n({reason:"Missing hook input JSON."});return}return er(t,n,"Failed to parse hook input JSON.")}async function rr(n){let t=[],r=0;for await(let e of n){let a=typeof e==="string"?Buffer.from(e,"utf-8"):Buffer.from(e.buffer,e.byteOffset,e.byteLength);if(r+=a.byteLength,r>Yd)throw Ad(n),Error("hook input byte limit exceeded");t.push(a)}return Buffer.concat(t,r).toString("utf-8")}function Ad(n){let t=n.destroy??n.cancel;if(!t)return;try{Promise.resolve(t.call(n)).catch(()=>{})}catch{}}function er(n,t,r){try{return JSON.parse(n)}catch{t({reason:r});return}}function X(n,t){let r=t.get(n);return r?{kind:"command",shell:r}:{kind:h1(n)}}function I(n,t,r,e){let a=n===void 0?process.cwd():n,l=typeof a==="string"&&a.trim()!==""?L2([a]):void 0;if(l)return{configCwd:l,executionCwd:l};return H(e,t,r,Md(a)),null}function H(n,t,r,e){let a;try{a=tr(t)}catch(l){if(!(l instanceof U2))throw l}n(An({command:a,segment:e,toolName:r}))}async function Wd(n){let t=await Hd(n.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){H(n.outputDeny);return}if(!n.isSupported(t))return;let r=n.getAgent?.(t)??n.agent,e=n.agent===r?void 0:n.agent,a=Gd(t),l=(p,f)=>{b1(p,()=>n.getSessionId(t),{agent:r,shape:e,toolName:f,cwd:a}),n.outputDeny(p)},d=n.getToolName(t);if(typeof d!=="string"||d.trim()===""){H((p)=>l(p),Vd(t));return}let s=d,L=(p)=>l(p,s),c;try{c=n.getToolInput(t,s,L)}catch(p){if(!(p instanceof U2))throw p;H(L,void 0,s);return}if(!c.ok)return;let i=n.getContext(t,c.input,s,L);if(!i)return;let u;try{u=tr(c.input)}catch(p){if(!(p instanceof U2))throw p;H(L,void 0,s);return}let v=V2(s,c.input,c.route,i,u??null);try{let p=Wn(v,{guard:{auditAllowed:w1(),dependencies:n.guardDependencies},audit:{agent:r,shape:e,getSessionId:()=>n.getSessionId(t)}}),f=nr(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:s});if(f){n.outputDeny(f);return}n.outputAllow?.()}catch(p){if(!(p instanceof x1))throw p;Rd(p);let f=nr(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:s});if(f)n.outputDeny(f);return}}function Rd(n){if(!vn(m.debug))return;console.error(`CC Safety Net debug: ${Kd(n.stage)}: ${y1(n.cause)}`)}function Kd(n){if(n==="policy-protection")return"hook policy protection failed";if(n==="config-load")return"hook config loading failed";if(n==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function Md(n){return typeof n==="string"?n:void 0}function Vd(n){if(!n||typeof n!=="object"||Array.isArray(n))return;if(Object.hasOwn(n,"tool_input"))return n.tool_input;let t=n.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Gd(n){if(!n||typeof n!=="object"||Array.isArray(n))return null;let t=n.cwd;if(typeof t==="string")return t;let r=n.toolCall;if(!r||typeof r!=="object"||Array.isArray(r))return null;let e=r.args;if(!e||typeof e!=="object"||Array.isArray(e))return null;let a=e.Cwd;return typeof a==="string"?a:null}async function Y(n){let t=(a)=>Sd(n.createDenyOutput,a),r=n.createAllowOutput;await Wd({...n,outputDeny:t,outputAllow:r?()=>console.log(JSON.stringify(r())):void 0})}var Ud=new Map([["run_command","auto"]]),Od=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function m1(n){return X(n,Ud)}async function k1(){await Y({agent:"antigravity-cli",createDenyOutput:(n)=>({decision:"deny",reason:n}),isSupported:()=>!0,getToolName:(n)=>n.toolCall?.name,getToolInput:(n,t)=>({ok:!0,input:Id(n.toolCall?.args,t),route:m1(t)}),getContext:Td,getSessionId:(n)=>n.conversationId})}function Td(n,t,r,e){let l=Pd(n).flatMap((c)=>{let i=L2([c]);return i?[i]:[]});if(!l[0])return D2(e,t,r),null;if(r!=="run_command"){let c;try{c=Ed(t,r,l)}catch(i){if(i instanceof U2)return D2(e,void 0,r),null;if(!(i instanceof Rn))throw i;return D2(e,t,r),null}if(!c)return D2(e,t,r),null;return{configCwd:c,executionCwd:c,policyConfigCwds:l}}let d=n.toolCall?.args;if(!d||!Object.hasOwn(d,"Cwd"))return{configCwd:l[0],executionCwd:l[0],policyConfigCwds:l};let s=d.Cwd;if(typeof s!=="string"||s.trim()==="")return D2(e,t,r),null;let L=wn(s,l);if(L){let c=q1(L,l);if(!c)return D2(e,t,r,s),null;return{configCwd:c,executionCwd:L,policyConfigCwds:l}}return D2(e,t,r,s),null}function Ed(n,t,r){let e=m1(t),a=[...$1(n,Od),...e.kind==="patch"?g1(n):[]].filter(D1),l=Kn(),d=new Set(a.flatMap((s)=>{let L=q1(yn(s,hn,l),r);return L?[L]:[]}));if(d.size>1)return null;return[...d][0]??r[0]??null}function q1(n,t){return t.filter((r)=>_d(n,r)).reduce((r,e)=>e.length>r.length?e:r,"")||null}function _d(n,t){let r=Cd(t,n);return r===""||!r.startsWith("..")&&!D1(r)}function D2(n,t,r,e){let a=t&&typeof t==="object"?t.command:void 0;n(An({command:typeof a==="string"?a:void 0,segment:e,toolName:r}))}function Pd(n){if(n.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(n.workspacePaths)?n.workspacePaths.filter((r)=>typeof r==="string"&&r.trim()!==""):[];return L2(t)?t:[]}function Id(n,t){if(!n)return;if(t!=="run_command")return n;return{...n,command:typeof n.CommandLine==="string"&&n.CommandLine!==""?n.CommandLine:void 0}}var O2=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",installLabel:"Antigravity CLI",helpTarget:"Antigravity CLI hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",installLabel:"Claude Code",helpTarget:"Claude Code plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",installLabel:"Codex",helpTarget:"Codex plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",installLabel:"GitHub Copilot CLI",helpTarget:"GitHub Copilot CLI plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",installLabel:"Gemini CLI",helpTarget:"Gemini CLI extension",probeCommand:["gemini","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:8,runtime:{order:6,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--hermes-agent",installLabel:"Hermes Agent",helpTarget:"Hermes Agent plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:9,runtime:{order:7,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--kimi-code",installLabel:"Kimi Code",helpTarget:"Kimi Code hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:10,install:{order:10,flag:"--openclaw",installLabel:"OpenClaw",helpTarget:"OpenClaw plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:11,install:{order:11,flag:"--opencode",installLabel:"OpenCode",helpTarget:"OpenCode plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:12,install:{order:12,flag:"--pi",installLabel:"Pi",helpTarget:"Pi package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",installLabel:"Cursor",helpTarget:"Cursor hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",installLabel:"Amp Code",helpTarget:"Amp Code plugin",probeCommand:["amp","--version"]}}],j1=O2.slice().sort((n,t)=>n.doctorOrder-t.doctorOrder).map((n)=>n.id),F1=O2.filter((n)=>("runtime"in n)).slice().sort((n,t)=>n.runtime.order-t.runtime.order).map((n)=>({id:n.id,displayName:"displayName"in n.runtime?n.runtime.displayName:n.displayName,flags:n.runtime.flags,legacyFlags:"legacyFlags"in n.runtime?n.runtime.legacyFlags:[],description:n.runtime.description,legacyTopLevelFlags:n.runtime.legacyTopLevelFlags})),c2=O2.slice().sort((n,t)=>n.install.order-t.install.order).map((n)=>({id:n.id,...n.install})).map(({order:n,...t})=>t),z6=Object.fromEntries(O2.map((n)=>[n.id,n.displayName]));function v2(n){return O2.find((t)=>t.id===n)?.displayName??n}function b2(n){return O2.find((t)=>t.id===n)?.install.installLabel??n}import{homedir as Nd}from"node:os";import{isAbsolute as z1,join as ar}from"node:path";function J1(n){if(n!==void 0&&n!==null&&!z1(n))return"unknown";try{let t=Kn(),r=n?yn(n,hn,t):void 0,e=process.env.HOME||Nd(),a=[["codex",process.env.CODEX_HOME||ar(e,".codex")],["copilot-cli",process.env.COPILOT_HOME||ar(e,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||ar(e,".claude")]],l=r?a.flatMap(([d,s])=>{if(!z1(s))return[];return B1(r,yn(s,hn,t))?[d]:[]}):[];if(l.length===1)return l[0]??"unknown";if(l.length>1)return"unknown"}catch(t){if(t instanceof Rn)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var lr="PreToolUse",Z1="BeforeTool",Q1="pre_tool_call",dr="PreToolUse";var ns=new Map([["Bash","posix"],["PowerShell","powershell"]]);function ts(n){return X(n,ns)}async function X1(){await Y({agent:"claude-code",getAgent:(n)=>J1(n.transcript_path),createDenyOutput:(n)=>({hookSpecificOutput:{hookEventName:lr,permissionDecision:"deny",permissionDecisionReason:n}}),isSupported:(n)=>n.hook_event_name===lr,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:ts(t)}),getContext:(n,t,r,e)=>I(n.cwd,t,r,e),getSessionId:(n)=>n.session_id})}var rs=new Map([["bash","auto"],["Bash","auto"]]);function es(n){return X(n,rs)}async function Y1(){await Y({agent:"copilot-cli",createDenyOutput:(n)=>({permissionDecision:"deny",permissionDecisionReason:n}),isSupported:()=>!0,getToolName:(n)=>n.toolName,getToolInput:(n,t,r)=>{if(typeof n.toolArgs!=="string")return r({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let e=er(n.toolArgs,r,"Failed to parse toolArgs JSON.");if(e===void 0)return{ok:!1};return{ok:!0,input:e,route:es(t)}},getContext:(n,t,r,e)=>I(n.cwd,t,r,e),getSessionId:(n)=>typeof n.sessionId==="string"&&n.sessionId.trim()?n.sessionId:void 0})}var as=new Map([["Shell","auto"]]);function ls(n){return X(n,as)}async function S1(){await Y({agent:"cursor",createDenyOutput:(n)=>({permission:"deny",user_message:n,agent_message:n}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:ls(t)}),getContext:ds,getSessionId:(n)=>n.conversation_id})}function ds(n,t,r,e){let a=ss(n);if(!a[0])return H(e,t,r),null;let l=wn(cs(n.cwd),a);if(!l)return H(e,t,r,typeof n.cwd==="string"?n.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l,policyConfigCwds:a};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l,policyConfigCwds:a};let d=t.working_directory;if(typeof d!=="string"||d.trim()==="")return H(e,t,r),null;let s=wn(d,a);if(!s)return H(e,t,r,d),null;return{configCwd:l,executionCwd:s,policyConfigCwds:a}}function ss(n){return Ls(n).flatMap((t)=>{let r=L2([t]);return r?[r]:[]})}function Ls(n){if(n.workspace_roots===void 0)return typeof n.cwd==="string"&&n.cwd.trim()!==""?[n.cwd]:[];if(!Array.isArray(n.workspace_roots))return[];return n.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function cs(n){return typeof n==="string"&&n.trim()!==""?n:"."}var is=new Map([["run_shell_command","auto"]]);function ps(n){return X(n,is)}async function H1(){await Y({agent:"gemini-cli",createDenyOutput:(n)=>({decision:"deny",reason:n,systemMessage:n}),isSupported:(n)=>n.hook_event_name===Z1,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:ps(t)}),getContext:(n,t,r,e)=>I(n.cwd,t,r,e),getSessionId:(n)=>n.session_id})}import{resolve as us}from"node:path";var os=new Map([["terminal","posix"]]);async function A1(){await Y({agent:"hermes-agent",createDenyOutput:(n)=>({action:"block",message:n}),isSupported:(n)=>n.hook_event_name===Q1,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:X(t,os)}),getContext:vs,getSessionId:(n)=>n.session_id})}function vs(n,t,r,e){let a=I(n.cwd,t,r,e);if(!a)return null;if(!t||typeof t!=="object"||Array.isArray(t))return a;if(!Object.hasOwn(t,"workdir"))return a;let l=t.workdir;if(typeof l!=="string"||l.trim()==="")return H(e,t,r),null;let d=L2([us(a.configCwd,l)]);if(!d)return H(e,t,r,l),null;return{...a,executionCwd:d}}var bs=new Map([["Bash","posix"]]);function fs(n){return X(n,bs)}async function W1(){await Y({agent:"kimi-code",createDenyOutput:(n)=>({hookSpecificOutput:{hookEventName:dr,permissionDecision:"deny",permissionDecisionReason:n}}),isSupported:(n)=>n.hook_event_name===dr,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:fs(t)}),getContext:(n,t,r,e)=>I(n.cwd,t,r,e),getSessionId:(n)=>n.session_id})}var ys={"antigravity-cli":k1,"claude-code":X1,"copilot-cli":Y1,cursor:S1,"gemini-cli":H1,"hermes-agent":A1,"kimi-code":W1},T2=F1.map((n)=>({...n,run:ys[n.id]}));function R1(n){let t=F({label:"hook",booleans:Object.fromEntries(T2.map((e)=>[e.id,[...e.flags,...e.legacyFlags]]))},n);if(t.errors.length>0)return;let r=T2.filter((e)=>t.flags[e.id]);return r.length===1?r[0]:void 0}function K1(n){return T2.find((t)=>t.legacyTopLevelFlags.some((r)=>r===n))}var hs=T2.map((n)=>({flags:n.flags.join(", "),description:n.description})),ws=T2.flatMap((n)=>n.flags.map((t)=>`cc-safety-net hook ${t}`)),M1={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...hs,{flags:"-h, --help",description:"Show this help"}],examples:ws};var V1={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...c2.map((n)=>({flags:n.flag,description:`Install ${n.helpTarget}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...c2.map((n)=>`cc-safety-net install ${n.flag}`)]},G1={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...c2.map((n)=>({flags:n.flag,description:`Uninstall ${n.helpTarget}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...c2.map((n)=>`cc-safety-net uninstall ${n.flag}`)]},C1={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var U1={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var E2={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var O1={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var T1={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var E1=[O1,u1,U1,o1,E2,V1,C1,G1,M1,v1,T1];function xs(n){return n.aliases??[]}function $s(n){return!n.hidden}function Mn(n){let t=n.toLowerCase();return E1.find((r)=>r.name.toLowerCase()===t||xs(r).some((e)=>e.toLowerCase()===t))}function _1(){return E1.filter($s)}import{readFileSync as gs}from"node:fs";import{basename as Ds}from"node:path";function Vn(n=7,t=s2()){let r=Date.now()-n*24*60*60*1000,e=[],a=new Set,l=0,d,s,L,c;if(t)$2(t);let i={count:0},u=t?u2(t,i):[];for(let p of u)try{let o=gs(p,"utf-8").trim().split(`
-`).filter(Boolean);for(let y of o)try{let x=JSON.parse(y);if(x.decision==="allow")continue;let w=new Date(x.ts).getTime();if(w>=r){if(l++,a.add(x.sessionId??Ds(p,".jsonl")),s===void 0||w<=s)d=x.ts,s=w;if(c===void 0||w>c)L=x.ts,c=w;ms(e,x,w)}}catch{i.count++}}catch{i.count++}let v=e.map((p)=>({timestamp:p.ts,command:p.command,reason:p.reason,relativeTime:qt(new Date(p.ts))}));return{totalBlocked:l,sessionCount:a.size,recentEntries:v,oldestEntry:d,newestEntry:L,unreadable:i.count}}function ms(n,t,r){let e=n.findIndex((a)=>r>new Date(a.ts).getTime());if(e===-1){if(n.length<3)n.push(t);return}if(n.splice(e,0,t),n.length>3)n.pop()}import{dirname as ks}from"node:path";function P1(n,t,r,e,a){let l;try{if(g(e)===null)return{path:n,exists:!1,valid:!1,ruleCount:0};l=a2(e),l.errors.push(...l2(n,t,{userConfigDir:r},a))}catch(d){if(!(d instanceof Z))throw d;l={errors:[d.message],ruleNames:new Set}}return{path:n,exists:!0,valid:l.errors.length===0,ruleCount:l.ruleNames.size,...l.errors.length>0?{errors:l.errors}:{}}}function qs(n,t){return{source:t,name:n.name,command:n.command,subcommand:n.subcommand,blockArgs:[...n.block_args],reason:n.reason}}function I1(n,t){let r=t?.userConfigPath??_(),e=t?.projectConfigPath??E(n),a=ks(r),l=o2({cwd:n,userConfigPath:r,projectConfigPath:e,userConfigDir:a}),d=P({cwd:n,userConfigPath:r,projectConfigPath:e,userConfigDir:a}),s=new Map(l.rulebooks.flatMap((L)=>L.rules.map((c)=>[c,L.source])));return{userConfig:P1(r,K2({userConfigPath:r}),a,d.userConfigTarget,d.userScope),projectConfig:P1(e,M2(e),a,d.projectConfigTarget,d.projectScope),effectiveRules:l.rules.map((L)=>qs(L,s.get(L.name)??"project")),shadowedRules:[]}}var js=[{flag:m.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:m.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:m.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:m.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:m.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:m.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:m.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:m.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function N1(){return[...js.map((n)=>({name:n.flag.name,value:Pt(n.flag),isSet:It(n.flag),legacyName:n.flag.legacyName,legacyValue:n.flag.legacyName?process.env[n.flag.legacyName]:void 0,legacyIsSet:n.flag.legacyName?process.env[n.flag.legacyName]!==void 0:void 0,description:n.description,defaultBehavior:n.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:process.env.CC_SAFETY_NET_HOME,isSet:process.env.CC_SAFETY_NET_HOME!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var na={error:0,warning:1,info:2},Fs=["policy","config","audit"];function zs(n){return n.map((t)=>{if(t==="ownership")return"is not owned by the current user";if(t==="permissions")return"has unsafe permissions";if(t==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var Bs=[{derive:(n)=>n.hooks.length>0&&n.hooks.every((t)=>!t.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(n)=>n.hooks.filter((t)=>t.inspectionStatus==="failed").map((t)=>{let r=v2(t.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${r} inspection failed`,detail:`Doctor could not verify the ${r} integration configuration.`,fixHint:`Correct the reported ${r} configuration error, then run \`cc-safety-net doctor\` again.`,integration:t.platform}})},{derive:(n)=>n.userConfig.exists&&!n.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:n.userConfig.path}]:[]},{derive:(n)=>n.projectConfig.exists&&!n.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:n.projectConfig.path}]:[]},{derive:(n)=>n.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${n.configState.reason}`,fixHint:"Correct the named source, run `cc-safety-net rule sync` for a rule source, then rerun doctor."}]:[]},{derive:(n)=>{let t=n.environment.find((r)=>r.name==="CC_SAFETY_NET_AUDIT_SCOPE");return _t(t?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...Fs.map((n)=>({derive:(t)=>t.posture.directories.filter((r)=>r.kind===n&&r.status==="unsafe").map((r)=>({checkId:`posture.${n}-directory-unsafe`,severity:"error",title:`${n[0]?.toUpperCase()}${n.slice(1)} directory is unsafe`,detail:`The ${n} directory ${zs(r.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...r.path?{path:r.path}:{}}))})),{derive:(n)=>{let t=[...n.effectiveSafety.weakenedRuleOverrides].sort();return t.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${t.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${t.join(", ")}.`}]:[]}}];function ta(n){return Bs.flatMap((t,r)=>t.derive(n).map((e,a)=>({finding:e,catalogOrder:r,occurrence:a}))).sort((t,r)=>na[t.finding.severity]-na[r.finding.severity]||t.catalogOrder-r.catalogOrder||t.occurrence-r.occurrence).map((t)=>t.finding)}function N(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var Js=(n)=>N()?`\x1B[32m${n}\x1B[0m`:n,Zs=(n)=>N()?`\x1B[33m${n}\x1B[0m`:n,Qs=(n)=>N()?`\x1B[34m${n}\x1B[0m`:n,Xs=(n)=>N()?`\x1B[35m${n}\x1B[0m`:n,Ys=(n)=>N()?`\x1B[36m${n}\x1B[0m`:n,Ss=(n)=>N()?`\x1B[31m${n}\x1B[0m`:n,Hs=(n)=>N()?`\x1B[2m${n}\x1B[0m`:n,As=(n)=>N()?`\x1B[1m${n}\x1B[0m`:n,b={green:Js,yellow:Zs,blue:Qs,magenta:Xs,cyan:Ys,red:Ss,dim:Hs,bold:As},Ws="\x1B[0m",Rs=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Ks(n){let t=n;return()=>{return t=(t*1664525+1013904223)%4294967296,t/4294967296}}function Ms(n){let t=[...Rs],r=Ks(n);for(let e=t.length-1;e>0;e--){let a=Math.floor(r()*(e+1)),l=t[e];t[e]=t[a],t[a]=l}return t}function Vs(n,t=0){if(!N())return"";let r=Ms(t);return`\x1B[38;5;${r[n%r.length]}m`}function ra(n,t,r=0){if(!N())return`"${n}"`;return`${Vs(t,r)}"${n}"${Ws}`}var Gs=new RegExp("\x1B\\[[0-9;]*m","g"),sr=(n)=>n.replace(Gs,"").length;function m2(n){let t=(n.headers??n.rows[0]??[]).map((d,s)=>{let L=Math.max(...n.rows.map((c)=>sr(c[s]??"")));return Math.max(sr(d),L)}),r=(d,s)=>d+" ".repeat(Math.max(0,s-sr(d))),e=(d,s)=>s[0]+t.map((L)=>d.repeat(L+2)).join(s[1])+s[2],a=(d)=>`│ ${d.map((s,L)=>r(s,t[L]??0)).join(" │ ")} │`,l=n.headers?[`   ${a(n.headers)}`,`   ${e("─",["├","┼","┤"])}`]:[];return[`   ${e("─",["┌","┬","┐"])}`,...l,...n.rows.map((d)=>`   ${a(d)}`),`   ${e("─",["└","┴","┘"])}`].join(`
-`)}function ea(n){let t=[];t.push("Hook Integration"),t.push(Cs(n));let r=[],e=[];for(let a of n){let l=v2(a.platform);if(a.errors&&a.errors.length>0)for(let d of a.errors)if(a.configured)r.push({platform:l,message:d});else e.push({platform:l,message:d})}for(let a of r)t.push(`   Warning (${a.platform}): ${a.message}`);for(let a of e)t.push(b.red(`   Error (${a.platform}): ${a.message}`));return t.join(`
-`)}function Cs(n){let t=["Platform","Discovery","Configuration","Inspection"],r=n.map((e)=>{let a=v2(e.platform);if(e.inspectionStatus==="not-inspected"){let L=b.dim("Not inspected");return[a,L,L,L]}let l=e.detected?b.green("Detected"):e.inspectionStatus==="failed"?b.red("Unknown"):b.dim("Not detected"),d=e.configured?b.green("Configured"):e.detected?b.yellow("Not configured"):e.inspectionStatus==="failed"?b.red("Unknown"):b.dim("Not applicable"),s=e.inspectionStatus==="verified"?b.green("Verified"):e.inspectionStatus==="failed"?b.red("Failed"):b.dim("Not applicable");return[a,l,d,s]});return m2({headers:t,rows:r})}function aa(n){let r=["Guard Engine Verification",`   Synthetic self-test: ${n.failed>0?b.red(`${n.passed}/${n.total} FAIL`):b.green(`${n.passed}/${n.total} passed`)}`],e=n.results.filter((a)=>!a.passed);if(e.length>0){r.push(""),r.push(b.red("   Failures:"));for(let a of e)r.push(b.red(`   • ${a.description}`)),r.push(b.red(`     expected ${a.expected}, got ${a.actual}`))}return r.join(`
-`)}function Us(n){if(n.length===0)return"   (no custom rules)";let t=["Source","Name","Command","Block Args"],r=n.map((e)=>[e.source,e.name,e.subcommand?`${e.command} ${e.subcommand}`:e.command,e.blockArgs.join(", ")]);return m2({headers:t,rows:r})}function la(n){let t=[];if(t.push("Configuration"),t.push(Os(n.userConfig,n.projectConfig)),t.push(""),n.effectiveRules.length>0)t.push(`   Effective rules (${n.effectiveRules.length} total):`),t.push(Us(n.effectiveRules));else t.push("   Effective rules: (none - using built-in rules only)");for(let r of n.shadowedRules)t.push(""),t.push(`   Note: Project rule "${r.name}" shadows user rule with same name`);return t.join(`
-`)}function Os(n,t){let r=["Scope","Status"],e=(l)=>{if(!l.exists)return b.dim("N/A");if(!l.valid)return b.red(`Invalid (${l.errors?.[0]??"unknown error"})`);return b.green("Configured")},a=[["User",e(n)],["Project",e(t)]];return m2({headers:r,rows:a})}function da(n){let t=[];return t.push("Environment"),t.push(Ts(n)),t.join(`
-`)}function sa(n){let t=["Effective Safety",`   Selected preset: ${n.effectiveSafety.selectedPreset}`,`   Effective: ${n.effectiveSafety.level}`],r=[["fail_closed","fail_closed"],["paranoid_rm","paranoid_rm"],["paranoid_interpreters","paranoid_interpreters"]];for(let[e,a]of r){let l=n.effectiveSafety.capabilities[e],d=l.enabled?b.green("ON"):b.dim("OFF"),s=l.sources.length>0?` (${l.sources.join(", ")})`:"";t.push(`   ${a}: ${d} via ${l.source}${s}`)}t.push(`   Stored rule customizations: ${n.effectiveSafety.ruleCounts.stored}`),t.push(`   Effective rule customizations: ${n.effectiveSafety.ruleCounts.effective}`);for(let[e,a]of Object.entries(n.effectiveSafety.ruleOverrides))t.push(`   ${e}: ${a}`);return t.join(`
-`)}function La(n){let t=["Findings"];if(n.length===0)return t.push("   No findings from inspected doctor facts."),t.join(`
-`);for(let r of n){let e=`[${r.severity.toUpperCase()}] ${r.checkId}: ${z(r.title)}`,a=r.severity==="error"?b.red:r.severity==="warning"?b.yellow:b.blue;if(t.push(`   ${a(e)}`),t.push(`      ${z(r.detail)}`),r.path)t.push(`      Path: ${z(r.path)}`);if(r.fixHint)t.push(`      Fix: ${z(r.fixHint)}`)}return t.join(`
-`)}function Ts(n){let t=["Variable","Status","Legacy"],r=n.map((e)=>{let a=e.isSet?b.green("✓"):b.dim("✗"),l=e.legacyName&&e.legacyIsSet?`${e.legacyName} ${b.green("✓")}`:e.legacyName??"";return[e.name,a,l]});return m2({headers:t,rows:r})}function ca(n){let t=[];if(n.totalBlocked===0)t.push("Recent Activity"),t.push("   No blocked commands in the last 7 days"),t.push("   Tip: This is normal for new installations");else t.push(`Recent Activity · last 7 days (${n.totalBlocked} blocked / ${n.sessionCount} sessions)`),t.push(Es(n.recentEntries));if(n.unreadable>0)t.push(`   Warning: ${n.unreadable} audit log ${n.unreadable===1?"source":"sources"} could not be read; this summary is incomplete`);return t.join(`
-`)}function Es(n){let t=["Time","Command"],r=n.map((e)=>{let a=z(e.command.replace(/\r\n|\r|\n/g," ↵ ").replace(/\t/g," ")),l=a.length>40?`${a.slice(0,37)}...`:a;return[e.relativeTime,l]});return m2({headers:t,rows:r})}function ia(n){let t=[];if(t.push("Update Check"),n.latestVersion===null&&!n.error)return t.push(Gn([["Status",b.dim("Skipped")],["Installed",n.currentVersion]])),t.join(`
-`);if(n.error)return t.push(Gn([["Status",`${b.yellow("⚠")} Error`],["Installed",n.currentVersion],["Error",b.dim(n.error)]])),t.join(`
-`);if(n.updateAvailable)return t.push(Gn([["Status",`${b.yellow("⚠")} Update Available`],["Current",n.currentVersion],["Latest",b.green(n.latestVersion??"")]])),t.push(""),t.push("   Run: bunx cc-safety-net@latest doctor"),t.push("   Or:  npx cc-safety-net@latest doctor"),t.join(`
-`);return t.push(Gn([["Status",`${b.green("✓")} Up to date`],["Version",n.currentVersion]])),t.join(`
-`)}function Gn(n){return m2({rows:n})}function pa(n){let t=[];return t.push("System Info"),t.push(_s(n)),t.join(`
-`)}function _s(n){let t=["Component","Version"],r=(l)=>{if(l===null)return b.dim("not found");return l},a=[{label:"cc-safety-net",value:n.version},{label:"Claude Code",value:n.claudeCodeVersion},{label:"Amp Code",value:n.ampVersion},{label:"Antigravity CLI",value:n.antigravityCliVersion},{label:"Codex",value:n.codexCliVersion},{label:"Cursor",value:n.cursorVersion},{label:"Gemini CLI",value:n.geminiCliVersion},{label:"GitHub Copilot CLI",value:n.copilotCliVersion},{label:"Hermes Agent",value:n.hermesAgentVersion},{label:"Kimi Code",value:n.kimiCodeVersion},{label:"OpenClaw",value:n.openClawVersion},{label:"OpenCode",value:n.openCodeVersion},{label:"Pi",value:n.piCliVersion},{label:"Node.js",value:n.nodeVersion},{label:"npm",value:n.npmVersion},{label:"Bun",value:n.bunVersion},{label:"Platform",value:n.platform}].map((l)=>[l.label,r(l.value)]);return m2({headers:t,rows:a})}function ua(n){if(n.findings.length===0)return b.green(`
-No findings from inspected doctor facts.`);let t={error:n.findings.filter((l)=>l.severity==="error").length,warning:n.findings.filter((l)=>l.severity==="warning").length,info:n.findings.filter((l)=>l.severity==="info").length},r=["error","warning","info"].filter((l)=>t[l]>0).map((l)=>`${t[l]} ${l}`),e=n.findings.length===1?"finding":"findings",a=`
-${n.findings.length} ${e}: ${r.join(", ")}.`;if(t.error>0)return b.red(a);if(t.warning>0)return b.yellow(a);return b.blue(a)}import{lstatSync as Ps}from"node:fs";import{dirname as Lr}from"node:path";function cr(n,t){try{let r=Ps(t);if(r.isSymbolicLink())return{kind:n,path:t,status:"unsafe",issues:["symlink"]};if(!r.isDirectory())return{kind:n,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:n,path:t,status:"unknown",issues:[]};let e=[...r.uid!==process.getuid()?["ownership"]:[],...(r.mode&18)!==0?["permissions"]:[]];return{kind:n,path:t,status:e.length>0?"unsafe":"safe",issues:e}}catch(r){if(typeof r==="object"&&r!==null&&"code"in r&&r.code==="ENOENT")return{kind:n,path:t,status:"not-applicable",issues:[]};return{kind:n,path:t,status:"unknown",issues:[]}}}function oa(n){let t=s2();return{directories:[cr("policy",Lr(Lr(n))),cr("config",Lr(n)),...t?[cr("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Is}from"node:child_process";import{existsSync as va}from"node:fs";import{delimiter as Ns,extname as nL,join as tL}from"node:path";import{stripVTControlCharacters as ba}from"node:util";var ya="2.0.4",rL=5000,eL="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function j(){return ya}function ir(n,t){let r=n[t];if(r)return r;let e=Object.keys(n).find((a)=>a.toLowerCase()===t.toLowerCase()&&!!n[a]);return e?n[e]:r}function aL(n){return(ir(n,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function lL(n,t){let r=nL(n)?[n]:[...aL(t).map((e)=>`${n}${e}`),n];if(n.includes("/")||n.includes("\\"))return r.find((e)=>va(e))??n;return(ir(t,"PATH")??"").split(Ns).flatMap((e)=>r.map((a)=>tL(e,a))).find((e)=>va(e))??n}function fa(n){if(!/[\s"&|<>^]/.test(n))return n;return`"${n.replace(/"/g,'""')}"`}function f2(n,t){let[r,...e]=n,a=t[eL]==="win32"?"win32":process.platform;if(!r||a!=="win32")return{cmd:r??"",args:e};let l=lL(r,t);if(!/\.(?:bat|cmd)$/i.test(l))return{cmd:l,args:e};return{cmd:ir(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",fa(l),...e.map(fa)].join(" ")]}}var k2=async(n,t=rL)=>{let r=await dL(n,{timeoutMs:t});if(r.code!==0)return null;return ba(r.stdout).trim()||ba(r.stderr).trim()||null};function dL(n,t){let[r,...e]=n;if(!r)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((a)=>{try{let l=f2([r,...e],process.env),d=Is(l.cmd,l.args,{stdio:["ignore","pipe","pipe"]}),s=!1,L="",c="";d.stdout.on("data",(v)=>{L+=v.toString()}),d.stderr.on("data",(v)=>{c+=v.toString()});let i=(v)=>{if(s)return;s=!0,clearTimeout(u),a(v)},u=setTimeout(()=>{d.kill(),i({code:null,stdout:L,stderr:c})},t.timeoutMs);d.on("close",(v)=>{i({code:v,stdout:L,stderr:c})}),d.on("error",()=>{i({code:null,stdout:L,stderr:c})})}catch{a({code:null,stdout:"",stderr:""})}})}function Q(n){if(!n)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(n);if(t)return t[1]??null;let r=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(n);if(r)return r[1]??null;return n.split(`
-`)[0]?.trim()||null}async function xn(n=k2){let[t,r,e,a,l,d,s,L,c,i,u,v,p,f,o,y,x]=await Promise.all([n(["claude","--version"]),n(["agy","--version"]),n(["opencode","--version"]),n(["codex","--version"]),n(["codex","plugin","list"]),n(["gemini","--version"]),n(["copilot","--binary-version"]),n(["hermes","--version"]),n(["kimi","--version"]),n(["openclaw","--version"]),n(["pi","--version"]),n(["cursor","--version"]),n(["amp","--version"]),n(["amp","plugins","list"],30000),n(["node","--version"]),n(["npm","--version"]),n(["bun","--version"])]);return{version:ya,claudeCodeVersion:Q(t),antigravityCliVersion:Q(r),openCodeVersion:Q(e),codexCliVersion:Q(a),codexPluginListOutput:l,geminiCliVersion:Q(d),copilotCliVersion:Q(s),hermesAgentVersion:Q(L),kimiCodeVersion:Q(c),openClawVersion:Q(i),piCliVersion:Q(u),cursorVersion:Q(v),ampVersion:Q(p),ampPluginListOutput:f,nodeVersion:Q(o),npmVersion:Q(y),bunVersion:Q(x),platform:`${process.platform} ${process.arch}`}}function pr(n,t){if(t==="dev")return!1;let r=n.split(".").map(Number),e=t.split(".").map(Number),[a=0,l=0,d=0]=r,[s=0,L=0,c=0]=e;if(a!==s)return a>s;if(l!==L)return l>L;return d>c}async function _2(){let n=j(),t=new AbortController,r=setTimeout(()=>t.abort(),3000);try{let e=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!e.ok)return{currentVersion:n,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${e.status}`};let a=await e.json(),l=pr(a.version,n);return{currentVersion:n,latestVersion:a.version,updateAvailable:l}}catch(e){return{currentVersion:n,latestVersion:null,updateAvailable:!1,error:e instanceof Error?e.message:"Network error"}}finally{clearTimeout(r)}}import*as ka from"node:readline";var $a=(n)=>`\x1B[${n}B`,sL=(n)=>`\x1B[${n}A`;var ha=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function LL(n){return new Promise((t)=>setTimeout(t,n))}function cL(n,t,r){if(!r)return t(n);if(r.aborted)return Promise.resolve();return new Promise((e,a)=>{let l=()=>r.removeEventListener("abort",d),d=()=>{l(),e()};r.addEventListener("abort",d,{once:!0}),t(n).then(()=>{l(),e()},(s)=>{l(),a(s)})})}function $n(n,t){return n&&n>0?n:t}function Cn(n){return Math.max(0,Math.min(1,n))}function P2(n){return Math.max(0,Math.min(255,Math.round(n)))}function ur(n){return n<=0.0031308?12.92*n:1.055*n**0.4166666666666667-0.055}function iL(n,t,r){let e=r*Math.PI/180,a=t*Math.cos(e),l=t*Math.sin(e),d=(n+0.3963377774*a+0.2158037573*l)**3,s=(n-0.1055613458*a-0.0638541728*l)**3,L=(n-0.0894841775*a-1.291485548*l)**3;return{blue:P2(ur(Cn(-0.0041960863*d-0.7034186147*s+1.707614701*L))*255),green:P2(ur(Cn(-1.2684380046*d+2.6097574011*s-0.3413193965*L))*255),red:P2(ur(Cn(4.0767416621*d-3.3077115913*s+0.2309699292*L))*255)}}function or(n,t){let r=(t*n*180/Math.PI%360+360)%360;return iL(0.72,0.15,r)}function ga(n,t=0.1){let r=or(t,n);return`\x1B[38;2;${r.red};${r.green};${r.blue}m`}function pL(n,t){return{blue:P2(n.blue+(255-n.blue)*t),green:P2(n.green+(255-n.green)*t),red:P2(n.red+(255-n.red)*t)}}function Da(n,t,r){let e=Math.imul(n+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(r+374761393,2654435761),a=e^e>>>15,l=Math.imul(a,739982445),d=l^l>>>12,s=Math.imul(d,695872825);return((s^s>>>15)>>>0)/4294967296}function uL(n,t,r){let e=Math.floor(Da(n,t,r)*ha.length);return ha[e]??"░"}function wa(n){let t=Cn(n);return t*t*t*(t*(t*6-15)+10)}function oL(n){if(n.length===0)return"";let t=[],r=!1,e="";for(let a of n){let l=`${a.red};${a.green};${a.blue}`;if(a.bold!==r)t.push(a.bold?"\x1B[1m":"\x1B[22m"),r=a.bold;if(l!==e)t.push(`\x1B[38;2;${l}m`),e=l;t.push(a.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function vL(n,t,r,e,a){return n.map((l,d)=>({...or(r,e+t+d/a),bold:!1,character:l}))}function bL(n,t,r,e,a,l,d,s){let L=Math.max(1,e*0.75),c=Math.min(1,r/L),i=a*wa(c),u=Math.max(0,(r-L)/Math.max(1,e-L)),v=(1-wa(r/e))*s*2,p=0.35*Math.max(0,1-u*2),f=c>=1,o=Math.min(n.length,Math.ceil(i+2+1));return n.slice(0,o).map((y,x)=>{let w=or(l,d+t+x/s+v),h=x+Da(t,x,7919)*2-1;if(h>i+2)return{...w,bold:!1,character:" "};let J=i-h,Q2=0.8*Math.exp(-(J*J)/12.5),ln=Math.min(0.9,Q2+p),mt=!f&&h>i-4;return{...pL(w,ln),bold:ln>0.3,character:mt?uL(t,x,r):y}})}function xa(n){return`\x1B[?2026h${n.map((t,r)=>`\x1B8${r>0?$a(r):""}${oL(t)}`).join("")}\x1B[?2026l`}async function vr(n,t={}){if(!n)return;let r=t.output??process.stdout,e=t.sleep??LL,a=$n(t.frequency,0.1),l=t.seed??0,d=$n(t.speed,40),s=$n(t.spread,3),L=$n(t.frameRate,60),c=Math.max(1,Math.floor($n(t.duration,12))),i=n.split(`
-`).map((o)=>Array.from(o)),u=Math.max(...i.map((o)=>o.length)),v=1000*c*i.filter((o)=>o.length>0).length/d,p=u>0?Math.max(1,Math.ceil(v/(1000/L))):0,f=p>0?v/p:0;r.write(`\x1B[?25l${i.length>1?`${`
-`.repeat(i.length-1)}${sL(i.length-1)}`:""}\x1B7`);try{for(let o=1;o<=p;o+=1){if(t.signal?.aborted)break;r.write(xa(i.map((y,x)=>bL(y,x,o,p,u,a,l,s)))),await cL(f,e,t.signal)}}finally{if(r.write(xa(i.map((o,y)=>vL(o,y,a,l,s)))),r.write("\x1B8"),i.length>1)r.write($a(i.length-1));r.write(`
+import{$ as ae,$a as Ur,A as pn,Aa as Zr,B as Nl,Ba as ee,C as P,Ca as Qr,D as U,Da as Xr,E as Ot,Ea as O,F as Ht,Fa as Kt,G as Wn,Ga as Tt,H as At,Ha as _t,I as G2,Ia as T,J as $2,Ja as D3,K as Et,Ka as bn,L as s2,La as m3,M as b1,Ma as fr,N as re,Na as k3,O as Rn,Oa as q3,P as f1,Pa as j3,Q as h1,Qa as it,R as Mn,Ra as F3,S as Vn,Sa as z3,T as hn,Ta as e1,U as yn,Ua as r1,V as _r,Va as a1,W as un,Wa as l1,X as g2,Xa as r3,Y as Pt,Ya as Gr,Z as C2,Za as Cr,_ as y1,_a as Mt,aa as $1,ab as Or,b as $r,ba as g1,bb as o2,c as gr,ca as Er,cb as x2,d as A,da as jr,db as l2,e as Dr,ea as Pr,eb as Tr,f as Qt,fa as Ir,fb as W,g as Z,ga as Nr,gb as fn,h as D,ha as It,hb as on,i as sn,ia as Fr,ib as x1,j as g,ja as m,jb as wn,k as w2,ka as Nt,kb as c2,l as Ar,la as w1,lb as B1,m as A2,ma as d2,mb as Kn,n as cn,na as vn,o as c3,oa as ne,p as St,pa as te,q as Wr,qa as n1,r as Ln,ra as t1,s as Rr,sa as zr,t as Ut,ta as M2,u as Kr,ua as Wt,v as Mr,va as Rt,w as _,wa as Vr,x as E,xa as S2,y as R2,ya as g3,z as K2,za as Jr}from"../chunks/index-3a1zwkma.js";var Y3=["-h","--help"];function F(n,t){let e=Object.entries(n.booleans??{}),r=Object.entries(n.values??{}),a=Object.fromEntries(e.map(([L])=>[L,!1])),l={},d=[],s=[],c=!1,i=-1;for(let[L,u]of t.entries()){if(L<=i)continue;if(u==="--"){d.push(...t.slice(L+1));break}if(Y3.includes(u)){c=!0;continue}let v=e.find(([,f])=>f.includes(u));if(v){a[v[0]]=!0;continue}let p=r.find(([,f])=>f.includes(u));if(p){let f=t[L+1];if(f===void 0||f.startsWith("-")){s.push(`${u} requires a value`);continue}l[p[0]]=f,i=L+1;continue}if(u.startsWith("-")){s.push(`Unknown option for ${n.label}: ${u}`);continue}if(n.positionals==="tail"){d.push(...t.slice(L));break}d.push(u)}if(n.positionals!=="list"&&n.positionals!=="tail")s.push(...d.map((L)=>`Unexpected argument for ${n.label}: ${L}`));return{flags:a,values:l,positionals:d,help:c,errors:s}}function r2(n){for(let t of n)console.error(t);return n.length>0}import{readdirSync as xd,statSync as s1,unlinkSync as $d}from"node:fs";import{basename as c1,dirname as gd,join as Dd,resolve as md}from"node:path";function z(n){return Array.from(n,(t)=>{let e=t.charCodeAt(0);if(e<=31||e>=127&&e<=159)return`\\x${e.toString(16).padStart(2,"0")}`;return t}).join("")}var zt=(n)=>{let t=Date.now()-new Date(n).getTime();if(!Number.isFinite(t))return"";let e=Math.floor(t/60000),r=Math.floor(e/60),a=Math.floor(r/24);if(a>0)return`${a}d ago`;if(r>0)return`${r}h ago`;if(e>0)return`${e}m ago`;return"just now"},Q2=(n)=>{let t=(n??"").trim().split(/\s+/).filter((a)=>a&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(a)),e=t[0]?.split("/").pop();if(!e)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${e} ${r}`:e};import{existsSync as S3,readdirSync as H3,readFileSync as A3}from"node:fs";import{join as W3}from"node:path";function u2(n,t){try{return H3(n,{withFileTypes:!0,encoding:"utf8"}).flatMap((e)=>{let r=W3(n,e.name);if(e.isDirectory())return u2(r,t);if(e.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&S3(n))t.count++;return[]}}function Bt(n){let t=(a)=>`${a.sessionId}
+${Q2(a.segment||a.command)}`,e=n.filter((a)=>a.decision!=="allow"),r=e.filter((a)=>a.sessionId).reduce((a,l)=>a.set(t(l),(a.get(t(l))??0)+1),new Map);return new Set(e.filter((a)=>a.failureStage||(r.get(t(a))??0)>=2))}function dn(n,t){try{return A3(n,"utf-8").split(`
+`).filter(Boolean).flatMap((e)=>{try{return[JSON.parse(e)]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as ud}from"node:path";var R3=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function mr(n){let t=0,e={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(r){n.record({kind:"step",scope:"global",step:r})},recordSegment(r,a=e.currentSegmentIndex){if(a===void 0)return;n.record({kind:"step",scope:"segment",segmentIndex:a,step:r})}};return e}function kr(n={}){let t=[],e=n.maxEvents??512,r={maxTextLength:n.maxTextLength??2048,maxListLength:n.maxListLength??128,maxObjectProperties:n.maxObjectProperties??n.maxListLength??128,maxDepth:n.maxDepth??16},a=0,l,d=new Set;return{record(s){if(l)return;try{if(!s||t.length>=e){a++;return}t.push(Zt(K3(s,r,d)))}catch{a++}},finish(s){if(l)return l;try{l=Zt({events:Object.freeze(t),droppedEvents:a,terminal:M3(s,r,d)})}catch{a++,l=Object.freeze({events:Object.freeze(t),droppedEvents:a,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,r.maxTextLength),segment:"trace unavailable".slice(0,r.maxTextLength)})})}return l}}}function K3(n,t,e){if(n.kind!=="step")throw TypeError("invalid trace event");let{scope:r,step:a}=n;Sn(a,e,t);let l=X2(a,t,e);if(r==="global")return{kind:"step",scope:"global",step:l};if(r!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:n.segmentIndex,step:l}}function M3(n,t,e){let r=n.result;if(r==="allowed")return Object.freeze({result:"allowed"});if(r!=="blocked")throw TypeError("invalid trace terminal");let a=n.ruleId;return Object.freeze({result:"blocked",reason:X2(n.reason,t,e),segment:X2(n.segment,t,e),...a?{ruleId:X2(a,t,e)}:{}})}function Sn(n,t,e,r=0,a=new WeakSet){if(typeof n==="string"){let s=n.slice(0,e.maxTextLength);if(!Qt(s))return;for(let c of Dr(s))for(let i of c.match(/[^\s"'()$]+/g)??[])t.add(qr(i));return}if(!n||typeof n!=="object"||r>=e.maxDepth||a.has(n))return;if(a.add(n),Array.isArray(n)){let s=Math.min(n.length,e.maxListLength);for(let c=0;c<s;c++)Sn(n[c],t,e,r+1,a);return}let l=0,d=new Set;for(let s in n){if(!Object.hasOwn(n,s))continue;if(l>=e.maxObjectProperties)break;l++,Sn(s,t,e);let c=Jt(s,e,t);if(d.has(c))continue;d.add(c),Sn(n[s],t,e,r+1,a)}}function X2(n,t,e,r=0,a=new WeakSet){if(typeof n==="string")return Jt(n,t,e);if(!n||typeof n!=="object")return n;if(r>=t.maxDepth)return;if(a.has(n))return;if(a.add(n),Array.isArray(n)){let s=[],c=Math.min(n.length,t.maxListLength);for(let i=0;i<c;i++)s.push(X2(n[i],t,e,r+1,a));return s}let l={},d=0;for(let s in n){if(!Object.hasOwn(n,s))continue;if(d>=t.maxObjectProperties)break;d++;let c=Jt(s,t,e);if(Object.hasOwn(l,c))continue;Object.defineProperty(l,c,{value:X2(n[s],t,e,r+1,a),enumerable:!0,configurable:!0,writable:!0})}return l}function Jt(n,t,e){let r=n.slice(0,t.maxTextLength),a=Qt(r)?gr(r):r,l=e.size>0?G3(a,e):a;return(V3(l)?$r(l):l).slice(0,t.maxTextLength)}function V3(n){return n.includes("PRIVATE KEY")||n.includes("://")||n.includes("eyJ")||n.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(n)||n.length>=14&&R3.some((t)=>n.includes(t))||n.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(n)}function G3(n,t){return n.replace(/[^\s"'()$]+/g,(e)=>t.has(qr(e))?"<redacted>":e)}function qr(n){let t=2166136261,e=2166136261;for(let r=0;r<n.length;r++)t=Math.imul(t^n.charCodeAt(r),16777619),e=Math.imul(e^n.charCodeAt(n.length-r-1),16777619);return`${t>>>0}:${e>>>0}:${n.length}`}function Zt(n){if(n&&typeof n==="object"&&!Object.isFrozen(n)){for(let t of Object.values(n))Zt(t);Object.freeze(n)}return n}function Br(n,t,e,r){let a=r??jr(),l=e??a.getCommandProgram(n,t.shell??"auto"),d=kr(),s=mr(d),c=l.dialect==="powershell"?a.getCommandProgram(n,"posix"):l,i=Fr(c);s.recordGlobal({type:"parse",input:n,segments:i.map((v)=>[...v])});let L=zr(n,{...t,analyzePartialProgram:!0,trace:s},l,a),u=s.getNextSegmentIndex();if(L&&u>0&&u<i.length)s.recordSegment({type:"segment-skipped",index:u,reason:"prior-segment-blocked"},u);return Object.freeze({decision:L,trace:d.finish(L?{result:"blocked",reason:L.reason,segment:L.evidence.find((v)=>v.kind==="command")?.segment??n,...L.ruleId?{ruleId:L.ruleId}:{}}:{result:"allowed"}),program:l})}import{resolve as C3}from"node:path";function Xt(n){let t=Jr().safeParse(n);return{errors:t.success?[]:Qr(t.error.issues),ruleNames:new Set(Zr(n).map((e)=>e.toLowerCase()))}}function Yt(n){let t=Yr(n);if(!t.ok)return t.result;return Xt(t.parsed)}function Yr(n){let t=[],e=new Set;try{let r=typeof n==="string"?sn(n):n,a=g(r);if(a===null)return t.push(`File not found: ${r.path}`),{ok:!1,result:{errors:t,ruleNames:e}};if(!a.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:e}};return{ok:!0,parsed:JSON.parse(a)}}catch(r){if(r instanceof Z)return t.push(r.message),{ok:!1,result:{errors:t,ruleNames:e}};let a=r instanceof Error?r.message:String(r);return t.push(r instanceof SyntaxError?"Invalid JSON":a),{ok:!1,result:{errors:t,ruleNames:e}}}}function Sr(n){return C3(n??process.cwd(),".safety-net.json")}function a2(n){let t=Yr(n);if(!t.ok)return t.result;let e=Xr(t.parsed);return{errors:e.errors,ruleNames:e.sources}}import{isAbsolute as U3,join as Hn,relative as O3,resolve as Hr,sep as T3}from"node:path";async function W2(n={}){let t=Gt(n);return _3(t,await An(t,S2()))}function _3(n,t){if(!t.ok)return t;let e=U(n),r=[...new Set(l2(e.configPath,e.lockPath,n,e.filesystemScope))];if(r.length===0)return t;return{ok:!1,errors:r,warnings:t.warnings,entries:t.entries}}async function An(n,t,e,r={}){let a=null,l=!1;try{let d=U(n),s=Kt(d.configTarget);if(!s.ok)return s.result;let c=s.config;if(n.check)return td(c,d,n);a={target:d.lockTarget,content:g(d.lockTarget)};let i=Mt(d.lockTarget);if(i.errors.some((h)=>h.startsWith("Unable to access ")))return{ok:!1,errors:i.errors,warnings:[],entries:[]};if(n.only&&i.errors.length>0)return{ok:!1,errors:i.errors,warnings:[],entries:[]};let L=i.errors.length>0?null:i.lock,u=n.only?Gr(c,L,n.only):{ok:!0,specs:c.rules};if(!u.ok)return u.result;if(n.only&&!L&&u.specs.length<c.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${Mr}`],warnings:[],entries:[]};let v=(await P3(u.specs,(h)=>Ur(h,d.configDir,n,L,d.filesystemScope,t),t)).map((h)=>ed(h,L,e));for(let h of v)ld(h.content,h.entry,d.configDir,n,d.filesystemScope);let p=n.only?rd(c,L,v):v.map((h)=>h.entry);l=!0,T(d.lockTarget,{version:1,rulebooks:p},void 0,r._testAfterPolicyRename);let f=new Map(v.map((h)=>[h.entry.spec,h.rulebook.rules.length])),o=dd(p,d.configDir,n,d.filesystemScope,r);return{ok:!0,errors:[],warnings:o,entries:p.map((h)=>ad(h,f))}}catch(d){if(l&&a)try{Y2(a.target,a.content)}catch(s){return H2(s)}return H2(d)}}async function Vt(n,t={}){return E3(n,Gt(t),S2())}async function E3(n,t,e,r={}){let a=null,l=!1;try{let d=U(t),s=g(d.configTarget);a={target:d.configTarget,content:s};let c=Kt(d.configTarget);if(!c.ok)return c.result;let i=c.config,L=Kr(n)?await Or(n,e):[{spec:n}],u=L.map((f)=>f.spec),v=[...new Set([...i.rules,...u])];if(v.length>Wt)return I3();if(v.length!==i.rules.length)l=!0,T(d.configTarget,{version:1,rules:v,overrides:i.overrides??{},transparent_wrappers:i.transparent_wrappers??[]},void 0,r._testAfterPolicyRename);let p=await An(t,e,new Map(L.filter((f)=>!!f.display_ref).map((f)=>[f.spec,f.display_ref])),r);if(!p.ok)Y2(d.configTarget,s);return p}catch(d){if(l&&a)try{Y2(a.target,a.content)}catch(s){return H2(s)}return H2(d)}}async function P3(n,t,e=S2()){if(n.length>Wt)throw Error(Rt);let r=Array(n.length),a=0,l,d=Array.from({length:Math.min(n.length,Vr.concurrency)},async()=>{while(!l){let s=a;if(s>=n.length)return;a++;try{r[s]=await t(n[s],s,e.controller.signal)}catch(c){if(!l)l={value:c},a=n.length,e.controller.abort(c);return}}});if(await Promise.all(d),l)throw l.value;return r}function I3(){return{ok:!1,errors:[Rt],warnings:[],entries:[]}}function Gt(n){return{cwd:n.cwd,cacheConfigDir:n.cacheConfigDir,userConfigDir:n.userConfigDir,userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath,global:n.global,check:n.check,only:n.only,refresh:n.refresh}}function N3(n){return{...Gt(n),deleteSource:n.deleteSource}}async function Ct(n,t={}){try{return await nd(n,N3(t),{})}catch(e){return H2(e)}}async function nd(n,t,e){let r=U(t),a=O(r.configTarget);if(a.errors.length>0)return{ok:!1,errors:a.errors,warnings:[],entries:[]};if(!a.config)return{ok:!1,errors:[`No config found at ${r.configPath}`],warnings:[],entries:[]};let l=Mt(r.lockTarget);if(l.errors.length>0)return{ok:!1,errors:l.errors,warnings:[],entries:[]};let d=Cr(a.config.rules,l.lock,n);if(!d.ok)return d.result;let s=t.deleteSource?sd(r.configDir,d.specs,l.lock,r.filesystemScope):{ok:!0,dirs:[]};if(!s.ok)return s.result;let c=g(r.configTarget);if(c===null)return H2(Error("Rules config is unavailable."));try{T(r.configTarget,{version:1,rules:a.config.rules.filter((u)=>!d.specs.includes(u)),overrides:a.config.overrides??{},transparent_wrappers:a.config.transparent_wrappers??[]},void 0,e._testAfterPolicyRename)}catch(u){throw Y2(r.configTarget,c),u}let i=await An(t,S2(),void 0,e);if(!i.ok)return Y2(r.configTarget,c),i;let L=id(s.dirs,e,r.filesystemScope);if(!L.ok){Y2(r.configTarget,c);let u=await An(t,S2(),void 0,e);if(!u.ok)return{ok:!1,errors:[...L.result.errors,...u.errors],warnings:u.warnings,entries:u.entries};return L.result}return i}async function td(n,t,e){let r=Tr(n,t.lockPath,t.configDir,e,e.global?"user":"project",t.filesystemScope);return{ok:r.errors.length===0&&r.warnings.length===0,errors:[...r.errors,...r.warnings],warnings:[],entries:r.entries}}function ed(n,t,e){let r=t?.rulebooks.find((l)=>l.spec===n.entry.spec&&l.kind==="github"),a=e?.get(n.entry.spec)??(r?.kind==="github"?r.display_ref:void 0);if(!a||n.entry.kind!=="github")return n;return{...n,entry:{...n.entry,display_ref:a}}}function rd(n,t,e){let r=new Set(n.rules),a=new Set(t?.rulebooks.map((d)=>d.spec)??[]),l=new Map(e.map((d)=>[d.entry.spec,d.entry]));return[...(t?.rulebooks.filter((d)=>r.has(d.spec))??[]).map((d)=>l.get(d.spec)??d),...e.filter((d)=>!a.has(d.entry.spec)).map((d)=>d.entry)]}function ad(n,t){return{...n,ruleCount:t.get(n.spec)}}function ld(n,t,e,r,a){let l=Ht(t,At(e,r));w2(D(a,l),n)}function dd(n,t,e,r,a){let l=At(t,e),d=Wn(l),s=D(r,d),c=A2(s);if(!c)return[];let i=n.map((u)=>D(r,Ht(u,l))),L=c.filter((u)=>u.kind==="directory").map((u)=>({directory:D(r,Hn(d,u.name)),identity:D(r,Hn(d,u.name,Rr))})).filter((u)=>!i.some((v)=>Ar(u.identity,v))).map((u)=>u.directory);for(let u of L)Wr(u);return L.flatMap((u)=>{try{return Ld(u,a),[]}catch{return["Unable to prune rules policy cache safely."]}})}function sd(n,t,e,r){let a=new Map(e?.rulebooks.map((i)=>[i.spec,i])??[]),l=t.flatMap((i)=>{let L=a.get(i);if(!L)return Ln.test(i)?[]:["--delete-source can only delete local rulebook sources"];return L.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),d=t.map((i)=>{let L=a.get(i);return Hn(n,L?.kind==="local-directory"?L.path:i)}),s=l.length>0?[]:d.flatMap((i)=>cd(n,i,r)),c=[...l,...s];return c.length>0?{ok:!1,result:{ok:!1,errors:c,warnings:[],entries:[]}}:{ok:!0,dirs:d}}function cd(n,t,e){let r=Hr(n),a=Hr(t),l=O3(r,a);if(l===""||l===".."||l.startsWith(`..${T3}`)||U3(l))return[`Refusing to delete local rulebook source outside ${n}: ${t}`];let d=D(e,a),s=A2(d);if(!s)return[`Local rulebook source directory not found: ${t}`];let c=s.find((i)=>i.name==="rulebook.json");if(!c)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(c.kind!=="file")throw new Z(e.label);if(g(D(e,Hn(a,"rulebook.json"))),s.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function id(n,t,e){let r=n.flatMap((a)=>{try{return pd(D(e,a),t),[]}catch(l){return[`Failed to delete local rulebook source ${a}: ${l instanceof Error?l.message:String(l)}`]}});return r.length>0?{ok:!1,result:{ok:!1,errors:r,warnings:[],entries:[]}}:{ok:!0}}function Ld(n,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(n.path);return}St(n)}function pd(n,t){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(n.path);return}St(n)}function Y2(n,t){if(t===null){cn(n);return}w2(n,t)}function H2(n){return{ok:!1,errors:[n instanceof Error?n.message:String(n)],warnings:[],entries:[]}}function V2(n,t){let e=vd(t),r=n1(e),a={effectiveLevel:r.effectiveLevel,selectedPreset:e.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:r.effectiveCapabilities,destructiveCommandRuleOverrides:e.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:l,configValid:d}=od({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!n||!n.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:l,configValid:d,...a};let s=bd(n,e);if(s)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",ruleModule:s.ruleModule,ruleFunction:s.ruleFunction,matched:!0,reason:s.reason}]}]},result:"blocked",reason:A(s.reason),segment:A(s.target),...s.ruleId?{ruleId:A(s.ruleId)}:{},configSource:l,configValid:d,...a};let c=Br(n,e),i=c.decision,L=i?.ruleId??fd(n,e),u=un.find((p)=>p.id===L&&p.activationCapability),v=u?r.policy.effectiveDestructiveCommandRules[u.id]:void 0;return{trace:yd(c.trace),result:i?"blocked":"allowed",reason:i?A(i.reason):void 0,segment:i?A(i.evidence.find((p)=>p.kind==="command")?.segment??n):void 0,ruleId:i?.ruleId?A(i.ruleId):void 0,customRule:hd(wd(i?.ruleId,e.policySnapshot)),configSource:l,configValid:d,...a,...u&&v?{ruleActivation:{id:u.id,...v}}:{}}}function od(n){let t=_(n?.cwd),e=n?.userConfigPath??E(n),r=P({cwd:n?.cwd,userConfigDir:n?.userConfigDir,userConfigPath:n?.userConfigPath});try{if(g(r.projectConfigTarget)!==null){if(a2(r.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(a){if(a instanceof Z)return{configSource:t,configValid:!1};throw a}try{if(g(r.userConfigTarget)!==null){let a=a2(r.userConfigTarget);return{configSource:e,configValid:a.errors.length===0}}return{configSource:null,configValid:!0}}catch(a){if(a instanceof Z)return{configSource:e,configValid:!1};throw a}}function vd(n){let t=ud(n?.cwd??process.cwd()),e=n?.policySnapshot??W({cwd:t,userConfigDir:n?.userConfigDir}),r=d2(e.policy);return{cwd:t,effectiveCwd:t,policySnapshot:e,environment:_r(),protectedGitMetadata:Nr(t),effectiveCapabilities:r.capabilities,strict:n?.strict??r.strict,paranoidRm:r.paranoidRm,paranoidInterpreters:r.paranoidInterpreters,worktreeMode:r.worktreeMode}}function bd(n,t){let e=t.cwd??process.cwd(),r=Er(M2("",{command:n},{kind:"command",shell:"posix"},{executionCwd:e,configCwd:e},n)),a=r1(r);if(a)return{reason:e1,target:a.target,ruleId:"policy-protection",ruleModule:"policy-protection",ruleFunction:"findPolicyConfigMutationTarget"};let l=Ir(r,t.protectedGitMetadata);if(l)return{reason:Pr,target:l.target,ruleId:"git-metadata-protection",ruleModule:"git-metadata-protection",ruleFunction:"findGitMetadataMutationTarget"};let d=t.policySnapshot.policy,s=d.secretProtection.enabled===!1?null:l1(r,d.secretProtection,{strict:t.strict});if(s)return{reason:a1,target:s.target,ruleId:s.ruleId,ruleModule:"secret-protection",ruleFunction:"findSensitiveTarget"};return null}function fd(n,t){let e=t.policySnapshot.policy,r=on({...e,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...e.destructiveCommandRuleOverrides,...Object.fromEntries(un.flatMap((a)=>a.activationCapability?[[a.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return t1(n,{...t,policySnapshot:r,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function hd(n){if(!n)return;return{id:A(n.id),...n.rulebook?{rulebook:{name:A(n.rulebook.name),version:A(n.rulebook.version)}}:{},...n.source?{source:A(n.source)}:{},...n.override?{override:{type:"reason",reason:A(n.override.reason)}}:{}}}function yd(n){let t=n.events.flatMap((r)=>r.kind==="step"&&r.scope==="global"?[r.step]:[]),e=new Map;for(let r of n.events){if(r.kind!=="step"||r.scope!=="segment")continue;let a=e.get(r.segmentIndex)??{index:r.segmentIndex,steps:[]};a.steps.push(r.step),e.set(r.segmentIndex,a)}return{steps:t,segments:[...e.values()]}}function wd(n,t){let e=n?.replace(/^custom\./,"");if(!e||!t.policy.rules.some((r)=>r.name===e))return;return t.ruleMetadata[e]??Object.freeze({id:e})}function kd(n){let t=G2(),e=F({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},n);if(r2(e.errors))return null;if(e.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(e.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let r=e.values.limit===void 0?20:d1(e.values.limit);if(r===null)return console.error("--limit must be a positive number"),null;let a=e.values.since===void 0?Math.min(30,t):d1(e.values.since);if(a===null||a>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let l={limit:r,limitExplicit:e.values.limit!==void 0,since:a,sinceExplicit:e.values.since!==void 0,all:e.flags.all,json:e.flags.json,suspect:e.flags.suspect,pruneLegacy:e.flags.pruneLegacy,dryRun:e.flags.dryRun,id:e.values.id,agent:e.values.agent,rule:e.values.rule,session:e.values.session,project:e.values.project===void 0?void 0:md(e.values.project)};if(l.id&&(l.agent!==void 0||l.rule!==void 0||l.session!==void 0||l.project!==void 0||l.suspect||l.sinceExplicit||l.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(l.pruneLegacy&&(l.id!==void 0||l.agent!==void 0||l.rule!==void 0||l.session!==void 0||l.project!==void 0||l.suspect||l.all||l.sinceExplicit||l.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(l.dryRun&&!l.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return l}async function i1(n,t={}){let e=kd(n);if(!e)return 1;let r=t.logsDir??s2();if(e.pruneLegacy)return qd(r,e.json,e.dryRun);if(!r)return console.log(e.json?"[]":e.id?`No retained audit log entry found for id ${z(e.id)}.`:"No audit log entries found."),0;$2(r);let a={count:0},l=u2(r,a).flatMap((L)=>dn(L,a).map((u)=>({entry:u,file:L})));if(a.count>0)console.error(`warning: ${a.count} audit log ${a.count===1?"source":"sources"} could not be read; these results are incomplete`);if(e.id)return Bd(l,e,t.timeZone);let d=Date.now()-e.since*24*60*60*1000,s=l.filter((L)=>Jd(L,e,r,d)),c=e.suspect?Bt(s.map((L)=>L.entry)):null,i=(c?s.filter((L)=>c.has(L.entry)):s).sort((L,u)=>Date.parse(u.entry.ts)-Date.parse(L.entry.ts)).slice(0,e.limit);if(e.json)return console.log(JSON.stringify(i.map((L)=>L.entry),null,2)),0;if(i.length===0)return console.log("No audit log entries found."),0;for(let L of i)console.log(Xd(L.entry,t.timeZone));return 0}function qd(n,t,e){let r=n?Fd(n).map((s)=>Dd(n,s)):[];if(e)return jd(r,t);let a=[],l=0,d=0;for(let s of r){let c=s1(s,{throwIfNoEntry:!1})?.size??0,i=zd(s);if(i){a.push(`${c1(s)}: ${i}`);continue}l++,d+=c}if(t)return console.log(JSON.stringify({removedFiles:l,removedBytes:d,failedFiles:a.length})),a.length===0?0:1;console.log(l===0&&a.length===0?"No legacy audit log files found.":`Removed ${l} legacy audit log ${l===1?"file":"files"} (${L1(d)}).`);for(let s of a)console.error(`Could not remove ${z(s)}`);if(console.log("Nested v2 audit logs were not changed."),l>0)console.log("This deletion cannot be undone.");return a.length===0?0:1}function jd(n,t){let e=n.reduce((r,a)=>r+(s1(a,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:n.length,bytes:e})),0;if(console.log(n.length===0?"No legacy audit log files found.":`Would remove ${n.length} legacy audit log ${n.length===1?"file":"files"} (${L1(e)}).`),console.log("Nested v2 audit logs are not included."),n.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Fd(n){try{return xd(n,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function zd(n){try{return $d(n),null}catch(t){return t instanceof Error?t.message:String(t)}}function L1(n){let t=["B","KiB","MiB","GiB"],e=Math.min(Math.floor(Math.log2(Math.max(n,1))/10),t.length-1);return`${Math.round(n/1024**e*10)/10} ${t[e]}`}function Bd(n,t,e){let r=n.filter((l)=>l.entry.id===t.id);if(r.length>1)return console.error(`Multiple audit log entries found for id ${z(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(r.map((l)=>l.entry),null,2)),0;let a=r[0];if(!a)return console.log(`No retained audit log entry found for id ${z(t.id??"")}.`),0;return console.log(Yd(a.entry,e)),0}function Jd(n,t,e,r){if(!t.all&&n.entry.decision==="allow")return!1;if(Date.parse(n.entry.ts)<r)return!1;if(t.agent!==void 0&&n.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&n.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!Zd(n,e,t.session))return!1;if(t.project!==void 0&&!Qd(n.entry.cwd,t.project))return!1;return!0}function Zd(n,t,e){if(n.entry.sessionId===e)return!0;return gd(n.file)===t&&c1(n.file,".jsonl")===e}function Qd(n,t){if(!n)return!1;return n===t||n.startsWith(`${t}/`)}function Xd(n,t){let e=z(n.id??"-"),r=z(n.decision??"deny"),a=n.cwd?`  [${z(n.cwd)}]`:"",l=n.segment||n.command,d=l===n.command?"":"↳ ",s=l.length>50?`${l.slice(0,50)}…`:l;return`${e.padEnd(16)}  ${z(p1(n.ts,t))}  ${r.padEnd(5)}  ${z(n.agent??"-").padEnd(15)}  ${z(n.ruleId??"-").padEnd(20)}  ${d}${z(s)}${a}`}function Yd(n,t){let e=(a)=>z(a===void 0||a===null||a===""?"-":a),r=n.shape?`${n.agent??"-"} (shape: ${n.shape})`:n.agent??"-";return[`id:        ${e(n.id)}`,`ts:        ${e(p1(n.ts,t))}`,`decision:  ${e(n.decision)}`,`agent:     ${e(r)}`,`level:     ${e(n.level)}`,`tool:      ${e(n.toolName)}`,`rule:      ${e(n.ruleId)}`,`intent:    ${e(n.intent)}`,`stage:     ${e(n.failureStage)}`,`error:     ${e(n.errorCode)}`,`session:   ${e(n.sessionId)}`,`cwd:       ${e(n.cwd)}`,`version:   ${e(n.v)}`,`truncated: ${e(n.truncated===!0?"yes":void 0)}`,`reason:    ${e(n.reason)}`,`command:   ${e(n.command)}`,`segment:   ${e(n.segment)}`].join(`
+`)}function p1(n,t){let e=new Date(n);if(Number.isNaN(e.getTime()))return n;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(e)}function d1(n){let t=Number(n);return Number.isFinite(t)&&t>0?t:null}var u1={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var o1={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var v1={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as D1,relative as Ud}from"node:path";var Sd=8388608;function Hd(n,t){console.log(JSON.stringify(n(f1(t))))}async function Ad(n){let t;try{t=(await le(process.stdin)).trim()}catch{n({reason:"Failed to parse hook input JSON."});return}if(!t){n({reason:"Missing hook input JSON."});return}return de(t,n,"Failed to parse hook input JSON.")}async function le(n){let t=[],e=0;for await(let r of n){let a=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(e+=a.byteLength,e>Sd)throw Wd(n),Error("hook input byte limit exceeded");t.push(a)}return Buffer.concat(t,e).toString("utf-8")}function Wd(n){let t=n.destroy??n.cancel;if(!t)return;try{Promise.resolve(t.call(n)).catch(()=>{})}catch{}}function de(n,t,e){try{return JSON.parse(n)}catch{t({reason:e});return}}function X(n,t){let e=t.get(n);return e?{kind:"command",shell:e}:{kind:y1(n)}}function I(n,t,e,r){let a=n===void 0?process.cwd():n,l=typeof a==="string"&&a.trim()!==""?c2([a]):void 0;if(l)return{configCwd:l,executionCwd:l};return H(r,t,e,Vd(a)),null}function H(n,t,e,r){let a;try{a=ae(t)}catch(l){if(!(l instanceof C2))throw l}n(Rn({command:a,segment:r,toolName:e}))}async function Rd(n){let t=await Ad(n.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){H(n.outputDeny);return}if(!n.isSupported(t))return;let e=n.getAgent?.(t)??n.agent,r=n.agent===e?void 0:n.agent,a=Cd(t),l=(p,f)=>{b1(p,()=>n.getSessionId(t),{agent:e,shape:r,toolName:f,cwd:a}),n.outputDeny(p)},d=n.getToolName(t);if(typeof d!=="string"||d.trim()===""){H((p)=>l(p),Gd(t));return}let s=d,c=(p)=>l(p,s),i;try{i=n.getToolInput(t,s,c)}catch(p){if(!(p instanceof C2))throw p;H(c,void 0,s);return}if(!i.ok)return;let L=n.getContext(t,i.input,s,c);if(!L)return;let u;try{u=ae(i.input)}catch(p){if(!(p instanceof C2))throw p;H(c,void 0,s);return}let v=M2(s,i.input,i.route,L,u??null);try{let p=Kn(v,{guard:{auditAllowed:w1(),dependencies:n.guardDependencies},audit:{agent:e,shape:r,getSessionId:()=>n.getSessionId(t)}}),f=re(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:s});if(f){n.outputDeny(f);return}n.outputAllow?.()}catch(p){if(!(p instanceof x1))throw p;Kd(p);let f=re(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:s});if(f)n.outputDeny(f);return}}function Kd(n){if(!vn(m.debug))return;console.error(`CC Safety Net debug: ${Md(n.stage)}: ${h1(n.cause)}`)}function Md(n){if(n==="policy-protection")return"hook policy protection failed";if(n==="config-load")return"hook config loading failed";if(n==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function Vd(n){return typeof n==="string"?n:void 0}function Gd(n){if(!n||typeof n!=="object"||Array.isArray(n))return;if(Object.hasOwn(n,"tool_input"))return n.tool_input;let t=n.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Cd(n){if(!n||typeof n!=="object"||Array.isArray(n))return null;let t=n.cwd;if(typeof t==="string")return t;let e=n.toolCall;if(!e||typeof e!=="object"||Array.isArray(e))return null;let r=e.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let a=r.Cwd;return typeof a==="string"?a:null}async function Y(n){let t=(a)=>Hd(n.createDenyOutput,a),e=n.createAllowOutput;await Rd({...n,outputDeny:t,outputAllow:e?()=>console.log(JSON.stringify(e())):void 0})}var Od=new Map([["run_command","auto"]]),Td=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function m1(n){return X(n,Od)}async function k1(){await Y({agent:"antigravity-cli",createDenyOutput:(n)=>({decision:"deny",reason:n}),isSupported:()=>!0,getToolName:(n)=>n.toolCall?.name,getToolInput:(n,t)=>({ok:!0,input:Nd(n.toolCall?.args,t),route:m1(t)}),getContext:_d,getSessionId:(n)=>n.conversationId})}function _d(n,t,e,r){let l=Id(n).flatMap((i)=>{let L=c2([i]);return L?[L]:[]});if(!l[0])return D2(r,t,e),null;if(e!=="run_command"){let i;try{i=Ed(t,e,l)}catch(L){if(L instanceof C2)return D2(r,void 0,e),null;if(!(L instanceof Mn))throw L;return D2(r,t,e),null}if(!i)return D2(r,t,e),null;return{configCwd:i,executionCwd:i,policyConfigCwds:l}}let d=n.toolCall?.args;if(!d||!Object.hasOwn(d,"Cwd"))return{configCwd:l[0],executionCwd:l[0],policyConfigCwds:l};let s=d.Cwd;if(typeof s!=="string"||s.trim()==="")return D2(r,t,e),null;let c=wn(s,l);if(c){let i=q1(c,l);if(!i)return D2(r,t,e,s),null;return{configCwd:i,executionCwd:c,policyConfigCwds:l}}return D2(r,t,e,s),null}function Ed(n,t,e){let r=m1(t),a=[...$1(n,Td),...r.kind==="patch"?g1(n):[]].filter(D1),l=Vn(),d=new Set(a.flatMap((s)=>{let c=q1(hn(s,yn,l),e);return c?[c]:[]}));if(d.size>1)return null;return[...d][0]??e[0]??null}function q1(n,t){return t.filter((e)=>Pd(n,e)).reduce((e,r)=>r.length>e.length?r:e,"")||null}function Pd(n,t){let e=Ud(t,n);return e===""||!e.startsWith("..")&&!D1(e)}function D2(n,t,e,r){let a=t&&typeof t==="object"?t.command:void 0;n(Rn({command:typeof a==="string"?a:void 0,segment:r,toolName:e}))}function Id(n){if(n.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(n.workspacePaths)?n.workspacePaths.filter((e)=>typeof e==="string"&&e.trim()!==""):[];return c2(t)?t:[]}function Nd(n,t){if(!n)return;if(t!=="run_command")return n;return{...n,command:typeof n.CommandLine==="string"&&n.CommandLine!==""?n.CommandLine:void 0}}var U2=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",installLabel:"Antigravity CLI",helpTarget:"Antigravity CLI hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",installLabel:"Claude Code",helpTarget:"Claude Code plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",installLabel:"Codex",helpTarget:"Codex plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",installLabel:"GitHub Copilot CLI",helpTarget:"GitHub Copilot CLI plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",installLabel:"Gemini CLI",helpTarget:"Gemini CLI extension",probeCommand:["gemini","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:8,runtime:{order:6,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--hermes-agent",installLabel:"Hermes Agent",helpTarget:"Hermes Agent plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:9,runtime:{order:7,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--kimi-code",installLabel:"Kimi Code",helpTarget:"Kimi Code hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:10,install:{order:10,flag:"--openclaw",installLabel:"OpenClaw",helpTarget:"OpenClaw plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:11,install:{order:11,flag:"--opencode",installLabel:"OpenCode",helpTarget:"OpenCode plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:12,install:{order:12,flag:"--pi",installLabel:"Pi",helpTarget:"Pi package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",installLabel:"Cursor",helpTarget:"Cursor hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",installLabel:"Amp Code",helpTarget:"Amp Code plugin",probeCommand:["amp","--version"]}}],j1=U2.slice().sort((n,t)=>n.doctorOrder-t.doctorOrder).map((n)=>n.id),F1=U2.filter((n)=>("runtime"in n)).slice().sort((n,t)=>n.runtime.order-t.runtime.order).map((n)=>({id:n.id,displayName:"displayName"in n.runtime?n.runtime.displayName:n.displayName,flags:n.runtime.flags,legacyFlags:"legacyFlags"in n.runtime?n.runtime.legacyFlags:[],description:n.runtime.description,legacyTopLevelFlags:n.runtime.legacyTopLevelFlags})),i2=U2.slice().sort((n,t)=>n.install.order-t.install.order).map((n)=>({id:n.id,...n.install})).map(({order:n,...t})=>t),B6=Object.fromEntries(U2.map((n)=>[n.id,n.displayName]));function v2(n){return U2.find((t)=>t.id===n)?.displayName??n}function b2(n){return U2.find((t)=>t.id===n)?.install.installLabel??n}import{homedir as ns}from"node:os";import{isAbsolute as z1,join as se}from"node:path";function J1(n){if(n!==void 0&&n!==null&&!z1(n))return"unknown";try{let t=Vn(),e=n?hn(n,yn,t):void 0,r=process.env.HOME||ns(),a=[["codex",process.env.CODEX_HOME||se(r,".codex")],["copilot-cli",process.env.COPILOT_HOME||se(r,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||se(r,".claude")]],l=e?a.flatMap(([d,s])=>{if(!z1(s))return[];return B1(e,hn(s,yn,t))?[d]:[]}):[];if(l.length===1)return l[0]??"unknown";if(l.length>1)return"unknown"}catch(t){if(t instanceof Mn)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var ce="PreToolUse",Z1="BeforeTool",Q1="pre_tool_call",ie="PreToolUse";var ts=new Map([["Bash","posix"],["PowerShell","powershell"]]);function es(n){return X(n,ts)}async function X1(){await Y({agent:"claude-code",getAgent:(n)=>J1(n.transcript_path),createDenyOutput:(n)=>({hookSpecificOutput:{hookEventName:ce,permissionDecision:"deny",permissionDecisionReason:n}}),isSupported:(n)=>n.hook_event_name===ce,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:es(t)}),getContext:(n,t,e,r)=>I(n.cwd,t,e,r),getSessionId:(n)=>n.session_id})}var rs=new Map([["bash","auto"],["Bash","auto"]]);function as(n){return X(n,rs)}async function Y1(){await Y({agent:"copilot-cli",createDenyOutput:(n)=>({permissionDecision:"deny",permissionDecisionReason:n}),isSupported:()=>!0,getToolName:(n)=>n.toolName,getToolInput:(n,t,e)=>{if(typeof n.toolArgs!=="string")return e({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=de(n.toolArgs,e,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:as(t)}},getContext:(n,t,e,r)=>I(n.cwd,t,e,r),getSessionId:(n)=>typeof n.sessionId==="string"&&n.sessionId.trim()?n.sessionId:void 0})}var ls=new Map([["Shell","auto"]]);function ds(n){return X(n,ls)}async function S1(){await Y({agent:"cursor",createDenyOutput:(n)=>({permission:"deny",user_message:n,agent_message:n}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:ds(t)}),getContext:ss,getSessionId:(n)=>n.conversation_id})}function ss(n,t,e,r){let a=cs(n);if(!a[0])return H(r,t,e),null;let l=wn(Ls(n.cwd),a);if(!l)return H(r,t,e,typeof n.cwd==="string"?n.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l,policyConfigCwds:a};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l,policyConfigCwds:a};let d=t.working_directory;if(typeof d!=="string"||d.trim()==="")return H(r,t,e),null;let s=wn(d,a);if(!s)return H(r,t,e,d),null;return{configCwd:l,executionCwd:s,policyConfigCwds:a}}function cs(n){return is(n).flatMap((t)=>{let e=c2([t]);return e?[e]:[]})}function is(n){if(n.workspace_roots===void 0)return typeof n.cwd==="string"&&n.cwd.trim()!==""?[n.cwd]:[];if(!Array.isArray(n.workspace_roots))return[];return n.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function Ls(n){return typeof n==="string"&&n.trim()!==""?n:"."}var ps=new Map([["run_shell_command","auto"]]);function us(n){return X(n,ps)}async function H1(){await Y({agent:"gemini-cli",createDenyOutput:(n)=>({decision:"deny",reason:n,systemMessage:n}),isSupported:(n)=>n.hook_event_name===Z1,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:us(t)}),getContext:(n,t,e,r)=>I(n.cwd,t,e,r),getSessionId:(n)=>n.session_id})}import{resolve as os}from"node:path";var vs=new Map([["terminal","posix"]]);async function A1(){await Y({agent:"hermes-agent",createDenyOutput:(n)=>({action:"block",message:n}),isSupported:(n)=>n.hook_event_name===Q1,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:X(t,vs)}),getContext:bs,getSessionId:(n)=>n.session_id})}function bs(n,t,e,r){let a=I(n.cwd,t,e,r);if(!a)return null;if(!t||typeof t!=="object"||Array.isArray(t))return a;if(!Object.hasOwn(t,"workdir"))return a;let l=t.workdir;if(typeof l!=="string"||l.trim()==="")return H(r,t,e),null;let d=c2([os(a.configCwd,l)]);if(!d)return H(r,t,e,l),null;return{...a,executionCwd:d}}var fs=new Map([["Bash","posix"]]);function hs(n){return X(n,fs)}async function W1(){await Y({agent:"kimi-code",createDenyOutput:(n)=>({hookSpecificOutput:{hookEventName:ie,permissionDecision:"deny",permissionDecisionReason:n}}),isSupported:(n)=>n.hook_event_name===ie,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:hs(t)}),getContext:(n,t,e,r)=>I(n.cwd,t,e,r),getSessionId:(n)=>n.session_id})}var ys={"antigravity-cli":k1,"claude-code":X1,"copilot-cli":Y1,cursor:S1,"gemini-cli":H1,"hermes-agent":A1,"kimi-code":W1},O2=F1.map((n)=>({...n,run:ys[n.id]}));function R1(n){let t=F({label:"hook",booleans:Object.fromEntries(O2.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},n);if(t.errors.length>0)return;let e=O2.filter((r)=>t.flags[r.id]);return e.length===1?e[0]:void 0}function K1(n){return O2.find((t)=>t.legacyTopLevelFlags.some((e)=>e===n))}var ws=O2.map((n)=>({flags:n.flags.join(", "),description:n.description})),xs=O2.flatMap((n)=>n.flags.map((t)=>`cc-safety-net hook ${t}`)),M1={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...ws,{flags:"-h, --help",description:"Show this help"}],examples:xs};var V1={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...i2.map((n)=>({flags:n.flag,description:`Install ${n.helpTarget}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...i2.map((n)=>`cc-safety-net install ${n.flag}`)]},G1={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...i2.map((n)=>({flags:n.flag,description:`Uninstall ${n.helpTarget}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...i2.map((n)=>`cc-safety-net uninstall ${n.flag}`)]},C1={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var U1={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var T2={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var O1={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var T1={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var _1=[O1,u1,U1,o1,T2,V1,C1,G1,M1,v1,T1];function $s(n){return n.aliases??[]}function gs(n){return!n.hidden}function Gn(n){let t=n.toLowerCase();return _1.find((e)=>e.name.toLowerCase()===t||$s(e).some((r)=>r.toLowerCase()===t))}function E1(){return _1.filter(gs)}import{readFileSync as Ds}from"node:fs";import{basename as ms}from"node:path";function Cn(n=7,t=s2()){let e=Date.now()-n*24*60*60*1000,r=[],a=new Set,l=0,d,s,c,i;if(t)$2(t);let L={count:0},u=t?u2(t,L):[];for(let p of u)try{let o=Ds(p,"utf-8").trim().split(`
+`).filter(Boolean);for(let h of o)try{let x=JSON.parse(h);if(x.decision==="allow")continue;let w=new Date(x.ts).getTime();if(w>=e){if(l++,a.add(x.sessionId??ms(p,".jsonl")),s===void 0||w<=s)d=x.ts,s=w;if(i===void 0||w>i)c=x.ts,i=w;ks(r,x,w)}}catch{L.count++}}catch{L.count++}let v=r.map((p)=>({timestamp:p.ts,command:p.command,reason:p.reason,relativeTime:zt(new Date(p.ts))}));return{totalBlocked:l,sessionCount:a.size,recentEntries:v,oldestEntry:d,newestEntry:c,unreadable:L.count}}function ks(n,t,e){let r=n.findIndex((a)=>e>new Date(a.ts).getTime());if(r===-1){if(n.length<3)n.push(t);return}if(n.splice(r,0,t),n.length>3)n.pop()}import{dirname as qs}from"node:path";function P1(n,t,e,r,a){let l;try{if(g(r)===null)return{path:n,exists:!1,valid:!1,ruleCount:0};l=a2(r),l.errors.push(...l2(n,t,{userConfigDir:e},a))}catch(d){if(!(d instanceof Z))throw d;l={errors:[d.message],ruleNames:new Set}}return{path:n,exists:!0,valid:l.errors.length===0,ruleCount:l.ruleNames.size,...l.errors.length>0?{errors:l.errors}:{}}}function js(n,t){return{source:t,name:n.name,command:n.command,subcommand:n.subcommand,blockArgs:[...n.block_args],reason:n.reason}}function I1(n,t){let e=t?.userConfigPath??E(),r=t?.projectConfigPath??_(n),a=qs(e),l=o2({cwd:n,userConfigPath:e,projectConfigPath:r,userConfigDir:a}),d=P({cwd:n,userConfigPath:e,projectConfigPath:r,userConfigDir:a}),s=new Map(l.rulebooks.flatMap((c)=>c.rules.map((i)=>[i,c.source])));return{userConfig:P1(e,R2({userConfigPath:e}),a,d.userConfigTarget,d.userScope),projectConfig:P1(r,K2(r),a,d.projectConfigTarget,d.projectScope),effectiveRules:l.rules.map((c)=>js(c,s.get(c.name)??"project")),shadowedRules:[]}}var Fs=[{flag:m.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:m.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:m.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:m.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:m.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:m.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:m.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:m.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function N1(){return[...Fs.map((n)=>({name:n.flag.name,value:ne(n.flag),isSet:te(n.flag),legacyName:n.flag.legacyName,legacyValue:n.flag.legacyName?process.env[n.flag.legacyName]:void 0,legacyIsSet:n.flag.legacyName?process.env[n.flag.legacyName]!==void 0:void 0,description:n.description,defaultBehavior:n.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:process.env.CC_SAFETY_NET_HOME,isSet:process.env.CC_SAFETY_NET_HOME!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var na={error:0,warning:1,info:2},zs=["policy","config","audit"];function Bs(n){return n.map((t)=>{if(t==="ownership")return"is not owned by the current user";if(t==="permissions")return"has unsafe permissions";if(t==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var Js=[{derive:(n)=>n.hooks.length>0&&n.hooks.every((t)=>!t.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(n)=>n.hooks.filter((t)=>t.inspectionStatus==="failed").map((t)=>{let e=v2(t.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${e} inspection failed`,detail:`Doctor could not verify the ${e} integration configuration.`,fixHint:`Correct the reported ${e} configuration error, then run \`cc-safety-net doctor\` again.`,integration:t.platform}})},{derive:(n)=>n.userConfig.exists&&!n.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:n.userConfig.path}]:[]},{derive:(n)=>n.projectConfig.exists&&!n.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:n.projectConfig.path}]:[]},{derive:(n)=>n.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${n.configState.reason}`,fixHint:"Correct the named source, run `cc-safety-net rule sync` for a rule source, then rerun doctor."}]:[]},{derive:(n)=>{let t=n.environment.find((e)=>e.name==="CC_SAFETY_NET_AUDIT_SCOPE");return Nt(t?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...zs.map((n)=>({derive:(t)=>t.posture.directories.filter((e)=>e.kind===n&&e.status==="unsafe").map((e)=>({checkId:`posture.${n}-directory-unsafe`,severity:"error",title:`${n[0]?.toUpperCase()}${n.slice(1)} directory is unsafe`,detail:`The ${n} directory ${Bs(e.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...e.path?{path:e.path}:{}}))})),{derive:(n)=>{let t=[...n.effectiveSafety.weakenedRuleOverrides].sort();return t.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${t.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${t.join(", ")}.`}]:[]}}];function ta(n){return Js.flatMap((t,e)=>t.derive(n).map((r,a)=>({finding:r,catalogOrder:e,occurrence:a}))).sort((t,e)=>na[t.finding.severity]-na[e.finding.severity]||t.catalogOrder-e.catalogOrder||t.occurrence-e.occurrence).map((t)=>t.finding)}function N(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var Zs=(n)=>N()?`\x1B[32m${n}\x1B[0m`:n,Qs=(n)=>N()?`\x1B[33m${n}\x1B[0m`:n,Xs=(n)=>N()?`\x1B[34m${n}\x1B[0m`:n,Ys=(n)=>N()?`\x1B[35m${n}\x1B[0m`:n,Ss=(n)=>N()?`\x1B[36m${n}\x1B[0m`:n,Hs=(n)=>N()?`\x1B[31m${n}\x1B[0m`:n,As=(n)=>N()?`\x1B[2m${n}\x1B[0m`:n,Ws=(n)=>N()?`\x1B[1m${n}\x1B[0m`:n,b={green:Zs,yellow:Qs,blue:Xs,magenta:Ys,cyan:Ss,red:Hs,dim:As,bold:Ws},Rs="\x1B[0m",Ks=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Ms(n){let t=n;return()=>{return t=(t*1664525+1013904223)%4294967296,t/4294967296}}function Vs(n){let t=[...Ks],e=Ms(n);for(let r=t.length-1;r>0;r--){let a=Math.floor(e()*(r+1)),l=t[r];t[r]=t[a],t[a]=l}return t}function Gs(n,t=0){if(!N())return"";let e=Vs(t);return`\x1B[38;5;${e[n%e.length]}m`}function ea(n,t,e=0){if(!N())return`"${n}"`;return`${Gs(t,e)}"${n}"${Rs}`}var Cs=new RegExp("\x1B\\[[0-9;]*m","g"),Le=(n)=>n.replace(Cs,"").length;function m2(n){let t=(n.headers??n.rows[0]??[]).map((d,s)=>{let c=Math.max(...n.rows.map((i)=>Le(i[s]??"")));return Math.max(Le(d),c)}),e=(d,s)=>d+" ".repeat(Math.max(0,s-Le(d))),r=(d,s)=>s[0]+t.map((c)=>d.repeat(c+2)).join(s[1])+s[2],a=(d)=>`│ ${d.map((s,c)=>e(s,t[c]??0)).join(" │ ")} │`,l=n.headers?[`   ${a(n.headers)}`,`   ${r("─",["├","┼","┤"])}`]:[];return[`   ${r("─",["┌","┬","┐"])}`,...l,...n.rows.map((d)=>`   ${a(d)}`),`   ${r("─",["└","┴","┘"])}`].join(`
+`)}function ra(n){let t=[];t.push("Hook Integration"),t.push(Us(n));let e=[],r=[];for(let a of n){let l=v2(a.platform);if(a.errors&&a.errors.length>0)for(let d of a.errors)if(a.configured)e.push({platform:l,message:d});else r.push({platform:l,message:d})}for(let a of e)t.push(`   Warning (${a.platform}): ${a.message}`);for(let a of r)t.push(b.red(`   Error (${a.platform}): ${a.message}`));return t.join(`
+`)}function Us(n){let t=["Platform","Discovery","Configuration","Inspection"],e=n.map((r)=>{let a=v2(r.platform);if(r.inspectionStatus==="not-inspected"){let c=b.dim("Not inspected");return[a,c,c,c]}let l=r.detected?b.green("Detected"):r.inspectionStatus==="failed"?b.red("Unknown"):b.dim("Not detected"),d=r.configured?b.green("Configured"):r.detected?b.yellow("Not configured"):r.inspectionStatus==="failed"?b.red("Unknown"):b.dim("Not applicable"),s=r.inspectionStatus==="verified"?b.green("Verified"):r.inspectionStatus==="failed"?b.red("Failed"):b.dim("Not applicable");return[a,l,d,s]});return m2({headers:t,rows:e})}function aa(n){let e=["Guard Engine Verification",`   Synthetic self-test: ${n.failed>0?b.red(`${n.passed}/${n.total} FAIL`):b.green(`${n.passed}/${n.total} passed`)}`],r=n.results.filter((a)=>!a.passed);if(r.length>0){e.push(""),e.push(b.red("   Failures:"));for(let a of r)e.push(b.red(`   • ${a.description}`)),e.push(b.red(`     expected ${a.expected}, got ${a.actual}`))}return e.join(`
+`)}function Os(n){if(n.length===0)return"   (no custom rules)";let t=["Source","Name","Command","Block Args"],e=n.map((r)=>[r.source,r.name,r.subcommand?`${r.command} ${r.subcommand}`:r.command,r.blockArgs.join(", ")]);return m2({headers:t,rows:e})}function la(n){let t=[];if(t.push("Configuration"),t.push(Ts(n.userConfig,n.projectConfig)),t.push(""),n.effectiveRules.length>0)t.push(`   Effective rules (${n.effectiveRules.length} total):`),t.push(Os(n.effectiveRules));else t.push("   Effective rules: (none - using built-in rules only)");for(let e of n.shadowedRules)t.push(""),t.push(`   Note: Project rule "${e.name}" shadows user rule with same name`);return t.join(`
+`)}function Ts(n,t){let e=["Scope","Status"],r=(l)=>{if(!l.exists)return b.dim("N/A");if(!l.valid)return b.red(`Invalid (${l.errors?.[0]??"unknown error"})`);return b.green("Configured")},a=[["User",r(n)],["Project",r(t)]];return m2({headers:e,rows:a})}function da(n){let t=[];return t.push("Environment"),t.push(_s(n)),t.join(`
+`)}function sa(n){let t=["Effective Safety",`   Selected preset: ${n.effectiveSafety.selectedPreset}`,`   Effective: ${n.effectiveSafety.level}`],e=[["fail_closed","fail_closed"],["paranoid_rm","paranoid_rm"],["paranoid_interpreters","paranoid_interpreters"]];for(let[r,a]of e){let l=n.effectiveSafety.capabilities[r],d=l.enabled?b.green("ON"):b.dim("OFF"),s=l.sources.length>0?` (${l.sources.join(", ")})`:"";t.push(`   ${a}: ${d} via ${l.source}${s}`)}t.push(`   Stored rule customizations: ${n.effectiveSafety.ruleCounts.stored}`),t.push(`   Effective rule customizations: ${n.effectiveSafety.ruleCounts.effective}`);for(let[r,a]of Object.entries(n.effectiveSafety.ruleOverrides))t.push(`   ${r}: ${a}`);return t.join(`
+`)}function ca(n){let t=["Findings"];if(n.length===0)return t.push("   No findings from inspected doctor facts."),t.join(`
+`);for(let e of n){let r=`[${e.severity.toUpperCase()}] ${e.checkId}: ${z(e.title)}`,a=e.severity==="error"?b.red:e.severity==="warning"?b.yellow:b.blue;if(t.push(`   ${a(r)}`),t.push(`      ${z(e.detail)}`),e.path)t.push(`      Path: ${z(e.path)}`);if(e.fixHint)t.push(`      Fix: ${z(e.fixHint)}`)}return t.join(`
+`)}function _s(n){let t=["Variable","Status","Legacy"],e=n.map((r)=>{let a=r.isSet?b.green("✓"):b.dim("✗"),l=r.legacyName&&r.legacyIsSet?`${r.legacyName} ${b.green("✓")}`:r.legacyName??"";return[r.name,a,l]});return m2({headers:t,rows:e})}function ia(n){let t=[];if(n.totalBlocked===0)t.push("Recent Activity"),t.push("   No blocked commands in the last 7 days"),t.push("   Tip: This is normal for new installations");else t.push(`Recent Activity · last 7 days (${n.totalBlocked} blocked / ${n.sessionCount} sessions)`),t.push(Es(n.recentEntries));if(n.unreadable>0)t.push(`   Warning: ${n.unreadable} audit log ${n.unreadable===1?"source":"sources"} could not be read; this summary is incomplete`);return t.join(`
+`)}function Es(n){let t=["Time","Command"],e=n.map((r)=>{let a=z(r.command.replace(/\r\n|\r|\n/g," ↵ ").replace(/\t/g," ")),l=a.length>40?`${a.slice(0,37)}...`:a;return[r.relativeTime,l]});return m2({headers:t,rows:e})}function La(n){let t=[];if(t.push("Update Check"),n.latestVersion===null&&!n.error)return t.push(Un([["Status",b.dim("Skipped")],["Installed",n.currentVersion]])),t.join(`
+`);if(n.error)return t.push(Un([["Status",`${b.yellow("⚠")} Error`],["Installed",n.currentVersion],["Error",b.dim(n.error)]])),t.join(`
+`);if(n.updateAvailable)return t.push(Un([["Status",`${b.yellow("⚠")} Update Available`],["Current",n.currentVersion],["Latest",b.green(n.latestVersion??"")]])),t.push(""),t.push("   Run: bunx cc-safety-net@latest doctor"),t.push("   Or:  npx cc-safety-net@latest doctor"),t.join(`
+`);return t.push(Un([["Status",`${b.green("✓")} Up to date`],["Version",n.currentVersion]])),t.join(`
+`)}function Un(n){return m2({rows:n})}function pa(n){let t=[];return t.push("System Info"),t.push(Ps(n)),t.join(`
+`)}function Ps(n){let t=["Component","Version"],e=(l)=>{if(l===null)return b.dim("not found");return l},a=[{label:"cc-safety-net",value:n.version},{label:"Claude Code",value:n.claudeCodeVersion},{label:"Amp Code",value:n.ampVersion},{label:"Antigravity CLI",value:n.antigravityCliVersion},{label:"Codex",value:n.codexCliVersion},{label:"Cursor",value:n.cursorVersion},{label:"Gemini CLI",value:n.geminiCliVersion},{label:"GitHub Copilot CLI",value:n.copilotCliVersion},{label:"Hermes Agent",value:n.hermesAgentVersion},{label:"Kimi Code",value:n.kimiCodeVersion},{label:"OpenClaw",value:n.openClawVersion},{label:"OpenCode",value:n.openCodeVersion},{label:"Pi",value:n.piCliVersion},{label:"Node.js",value:n.nodeVersion},{label:"npm",value:n.npmVersion},{label:"Bun",value:n.bunVersion},{label:"Platform",value:n.platform}].map((l)=>[l.label,e(l.value)]);return m2({headers:t,rows:a})}function ua(n){if(n.findings.length===0)return b.green(`
+No findings from inspected doctor facts.`);let t={error:n.findings.filter((l)=>l.severity==="error").length,warning:n.findings.filter((l)=>l.severity==="warning").length,info:n.findings.filter((l)=>l.severity==="info").length},e=["error","warning","info"].filter((l)=>t[l]>0).map((l)=>`${t[l]} ${l}`),r=n.findings.length===1?"finding":"findings",a=`
+${n.findings.length} ${r}: ${e.join(", ")}.`;if(t.error>0)return b.red(a);if(t.warning>0)return b.yellow(a);return b.blue(a)}import{lstatSync as Is}from"node:fs";import{dirname as pe}from"node:path";function ue(n,t){try{let e=Is(t);if(e.isSymbolicLink())return{kind:n,path:t,status:"unsafe",issues:["symlink"]};if(!e.isDirectory())return{kind:n,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:n,path:t,status:"unknown",issues:[]};let r=[...e.uid!==process.getuid()?["ownership"]:[],...(e.mode&18)!==0?["permissions"]:[]];return{kind:n,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(e){if(typeof e==="object"&&e!==null&&"code"in e&&e.code==="ENOENT")return{kind:n,path:t,status:"not-applicable",issues:[]};return{kind:n,path:t,status:"unknown",issues:[]}}}function oa(n){let t=s2();return{directories:[ue("policy",pe(pe(n))),ue("config",pe(n)),...t?[ue("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Ns}from"node:child_process";import{existsSync as va}from"node:fs";import{delimiter as nc,extname as tc,join as ec}from"node:path";import{stripVTControlCharacters as ba}from"node:util";var ha="2.0.6",rc=5000,ac="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function j(){return ha}function oe(n,t){let e=n[t];if(e)return e;let r=Object.keys(n).find((a)=>a.toLowerCase()===t.toLowerCase()&&!!n[a]);return r?n[r]:e}function lc(n){return(oe(n,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function dc(n,t){let e=tc(n)?[n]:[...lc(t).map((r)=>`${n}${r}`),n];if(n.includes("/")||n.includes("\\"))return e.find((r)=>va(r))??n;return(oe(t,"PATH")??"").split(nc).flatMap((r)=>e.map((a)=>ec(r,a))).find((r)=>va(r))??n}function fa(n){if(!/[\s"&|<>^]/.test(n))return n;return`"${n.replace(/"/g,'""')}"`}function f2(n,t){let[e,...r]=n,a=t[ac]==="win32"?"win32":process.platform;if(!e||a!=="win32")return{cmd:e??"",args:r};let l=dc(e,t);if(!/\.(?:bat|cmd)$/i.test(l))return{cmd:l,args:r};return{cmd:oe(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",fa(l),...r.map(fa)].join(" ")]}}var _2=async(n,t=rc)=>{let e=await sc(n,{timeoutMs:t});if(e.code!==0)return null;return ba(e.stdout).trim()||ba(e.stderr).trim()||null};function sc(n,t){let[e,...r]=n;if(!e)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((a)=>{try{let l=f2([e,...r],process.env),d=Ns(l.cmd,l.args,{stdio:["ignore","pipe","pipe"]}),s=!1,c="",i="";d.stdout.on("data",(v)=>{c+=v.toString()}),d.stderr.on("data",(v)=>{i+=v.toString()});let L=(v)=>{if(s)return;s=!0,clearTimeout(u),a(v)},u=setTimeout(()=>{d.kill(),L({code:null,stdout:c,stderr:i})},t.timeoutMs);d.on("close",(v)=>{L({code:v,stdout:c,stderr:i})}),d.on("error",()=>{L({code:null,stdout:c,stderr:i})})}catch{a({code:null,stdout:"",stderr:""})}})}function Q(n){if(!n)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(n);if(t)return t[1]??null;let e=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(n);if(e)return e[1]??null;return n.split(`
+`)[0]?.trim()||null}async function xn(n=_2){let[t,e,r,a,l,d,s,c,i,L,u,v,p,f,o,h,x]=await Promise.all([n(["claude","--version"]),n(["agy","--version"]),n(["opencode","--version"]),n(["codex","--version"]),n(["codex","plugin","list"]),n(["gemini","--version"]),n(["copilot","--binary-version"]),n(["hermes","--version"]),n(["kimi","--version"]),n(["openclaw","--version"]),n(["pi","--version"]),n(["cursor","--version"]),n(["amp","--version"]),n(["amp","plugins","list"],30000),n(["node","--version"]),n(["npm","--version"]),n(["bun","--version"])]);return{version:ha,claudeCodeVersion:Q(t),antigravityCliVersion:Q(e),openCodeVersion:Q(r),codexCliVersion:Q(a),codexPluginListOutput:l,geminiCliVersion:Q(d),copilotCliVersion:Q(s),hermesAgentVersion:Q(c),kimiCodeVersion:Q(i),openClawVersion:Q(L),piCliVersion:Q(u),cursorVersion:Q(v),ampVersion:Q(p),ampPluginListOutput:f,nodeVersion:Q(o),npmVersion:Q(h),bunVersion:Q(x),platform:`${process.platform} ${process.arch}`}}function ve(n,t){if(t==="dev")return!1;let e=n.split(".").map(Number),r=t.split(".").map(Number),[a=0,l=0,d=0]=e,[s=0,c=0,i=0]=r;if(a!==s)return a>s;if(l!==c)return l>c;return d>i}async function E2(){let n=j(),t=new AbortController,e=setTimeout(()=>t.abort(),3000);try{let r=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!r.ok)return{currentVersion:n,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${r.status}`};let a=await r.json(),l=ve(a.version,n);return{currentVersion:n,latestVersion:a.version,updateAvailable:l}}catch(r){return{currentVersion:n,latestVersion:null,updateAvailable:!1,error:r instanceof Error?r.message:"Network error"}}finally{clearTimeout(e)}}import*as ka from"node:readline";var $a=(n)=>`\x1B[${n}B`,cc=(n)=>`\x1B[${n}A`;var ya=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function ic(n){return new Promise((t)=>setTimeout(t,n))}function Lc(n,t,e){if(!e)return t(n);if(e.aborted)return Promise.resolve();return new Promise((r,a)=>{let l=()=>e.removeEventListener("abort",d),d=()=>{l(),r()};e.addEventListener("abort",d,{once:!0}),t(n).then(()=>{l(),r()},(s)=>{l(),a(s)})})}function $n(n,t){return n&&n>0?n:t}function On(n){return Math.max(0,Math.min(1,n))}function P2(n){return Math.max(0,Math.min(255,Math.round(n)))}function be(n){return n<=0.0031308?12.92*n:1.055*n**0.4166666666666667-0.055}function pc(n,t,e){let r=e*Math.PI/180,a=t*Math.cos(r),l=t*Math.sin(r),d=(n+0.3963377774*a+0.2158037573*l)**3,s=(n-0.1055613458*a-0.0638541728*l)**3,c=(n-0.0894841775*a-1.291485548*l)**3;return{blue:P2(be(On(-0.0041960863*d-0.7034186147*s+1.707614701*c))*255),green:P2(be(On(-1.2684380046*d+2.6097574011*s-0.3413193965*c))*255),red:P2(be(On(4.0767416621*d-3.3077115913*s+0.2309699292*c))*255)}}function fe(n,t){let e=(t*n*180/Math.PI%360+360)%360;return pc(0.72,0.15,e)}function ga(n,t=0.1){let e=fe(t,n);return`\x1B[38;2;${e.red};${e.green};${e.blue}m`}function uc(n,t){return{blue:P2(n.blue+(255-n.blue)*t),green:P2(n.green+(255-n.green)*t),red:P2(n.red+(255-n.red)*t)}}function Da(n,t,e){let r=Math.imul(n+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(e+374761393,2654435761),a=r^r>>>15,l=Math.imul(a,739982445),d=l^l>>>12,s=Math.imul(d,695872825);return((s^s>>>15)>>>0)/4294967296}function oc(n,t,e){let r=Math.floor(Da(n,t,e)*ya.length);return ya[r]??"░"}function wa(n){let t=On(n);return t*t*t*(t*(t*6-15)+10)}function vc(n){if(n.length===0)return"";let t=[],e=!1,r="";for(let a of n){let l=`${a.red};${a.green};${a.blue}`;if(a.bold!==e)t.push(a.bold?"\x1B[1m":"\x1B[22m"),e=a.bold;if(l!==r)t.push(`\x1B[38;2;${l}m`),r=l;t.push(a.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function bc(n,t,e,r,a){return n.map((l,d)=>({...fe(e,r+t+d/a),bold:!1,character:l}))}function fc(n,t,e,r,a,l,d,s){let c=Math.max(1,r*0.75),i=Math.min(1,e/c),L=a*wa(i),u=Math.max(0,(e-c)/Math.max(1,r-c)),v=(1-wa(e/r))*s*2,p=0.35*Math.max(0,1-u*2),f=i>=1,o=Math.min(n.length,Math.ceil(L+2+1));return n.slice(0,o).map((h,x)=>{let w=fe(l,d+t+x/s+v),y=x+Da(t,x,7919)*2-1;if(y>L+2)return{...w,bold:!1,character:" "};let J=L-y,Z2=0.8*Math.exp(-(J*J)/12.5),ln=Math.min(0.9,Z2+p),jt=!f&&y>L-4;return{...uc(w,ln),bold:ln>0.3,character:jt?oc(t,x,e):h}})}function xa(n){return`\x1B[?2026h${n.map((t,e)=>`\x1B8${e>0?$a(e):""}${vc(t)}`).join("")}\x1B[?2026l`}async function he(n,t={}){if(!n)return;let e=t.output??process.stdout,r=t.sleep??ic,a=$n(t.frequency,0.1),l=t.seed??0,d=$n(t.speed,40),s=$n(t.spread,3),c=$n(t.frameRate,60),i=Math.max(1,Math.floor($n(t.duration,12))),L=n.split(`
+`).map((o)=>Array.from(o)),u=Math.max(...L.map((o)=>o.length)),v=1000*i*L.filter((o)=>o.length>0).length/d,p=u>0?Math.max(1,Math.ceil(v/(1000/c))):0,f=p>0?v/p:0;e.write(`\x1B[?25l${L.length>1?`${`
+`.repeat(L.length-1)}${cc(L.length-1)}`:""}\x1B7`);try{for(let o=1;o<=p;o+=1){if(t.signal?.aborted)break;e.write(xa(L.map((h,x)=>fc(h,x,o,p,u,a,l,s)))),await Lc(f,r,t.signal)}}finally{if(e.write(xa(L.map((o,h)=>bc(o,h,a,l,s)))),e.write("\x1B8"),L.length>1)e.write($a(L.length-1));e.write(`
 \x1B[0m\x1B[?25h`)}}var ma=["┏━┛┏━┛  ┏━┛┏━┃┏━┛┏━┛━┏┛┃ ┃  ┏━ ┏━┛━┏┛","┃  ┃    ━━┃┏━┃┏━┛┏━┛ ┃ ━┏┛  ┃ ┃┏━┛ ┃ ","━━┛━━┛  ━━┛┛ ┛┛  ━━┛ ┛  ┛   ┛ ┛━━┛ ┛ "].join(`
-`);function fL(n){return Boolean(n.isTTY)}async function Un(n={}){let t=n.output??process.stdout;if(!fL(t))return;let r=n.input??process.stdin,e={duration:n.duration,frequency:n.frequency,output:t,seed:n.seed??Math.random()*8192,sleep:n.sleep,speed:n.speed,spread:n.spread};if(!r.isTTY||typeof r.setRawMode!=="function"){await vr(ma,e);return}let a=new AbortController,l=r.readableFlowing===!0,d=r.isRaw===!0,s=!1,L=(c,i)=>{if(i.ctrl&&i.name==="c")s=!0;if(s||i.name==="return"||i.name==="enter")a.abort()};ka.emitKeypressEvents(r),r.on("keypress",L),r.setRawMode(!0),r.resume();try{await vr(ma,{...e,signal:a.signal})}finally{if(r.off("keypress",L),r.setRawMode(d),!l)r.pause()}if(!s)return;if(n.onInterrupt){n.onInterrupt();return}process.kill(process.pid,"SIGINT")}var qa="\r\x1B[2K",yL="\x1B[?25l",hL="\x1B[39m",wL="\x1B[?25h",xL=100,$L=0.55,gL=80,ja=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];function DL(n){return new Promise((t)=>setTimeout(t,n))}async function br(n,t={}){let r=t.output??process.stdout;if(!r.isTTY)return n;let e=t.sleep??DL,a=!1,l=n.then((s)=>{return a=!0,s},(s)=>{throw a=!0,s});if(await Promise.race([l.then(()=>!0),e(xL).then(()=>!1)]))return l;r.write(yL);try{for(let s=0;!a;s+=1)r.write(`${qa}${ga(s*$L)}${ja[s%ja.length]}${hL} ${t.loadingMessage??"Loading…"}`),await Promise.race([l,e(gL)]);return await l}finally{r.write(`${qa}${wL}`)}}async function On(n,t,r,e={}){let a=t();if(n)await r();if(n&&a.ready)await br(a.ready,e);return a.finish()}import{homedir as Xc}from"node:os";import{stripVTControlCharacters as mL}from"node:util";var Tn="amp plugins list",kL=/^\s*[✓✗]\s+cc-safety-net(?:\.ts)?\s+\(User Plugins\)\s+(\S+)\s*$/;function Fa(n){if(!n.ampPluginListOutput)return{platform:"amp",status:"n/a"};let t=mL(n.ampPluginListOutput).split(`
-`).map((r)=>kL.exec(r)?.[1]).find((r)=>r!==void 0);if(!t)return{platform:"amp",status:"n/a"};if(t!=="active")return{platform:"amp",status:"disabled",method:Tn,configPath:Tn,errors:[`Amp personal plugin cc-safety-net is ${t}; run "plugins: reload" in Amp or reinstall with install --amp`]};return{platform:"amp",status:"configured",method:Tn,configPath:Tn}}import{existsSync as jL,readFileSync as FL}from"node:fs";import{join as qL}from"node:path";function gn(n){return qL(n,".gemini","config","hooks.json")}var zL=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*(?:--agy-cli|-ac)(\s|["']|$)/;function BL(n){if(!n||typeof n!=="object"||Array.isArray(n))return[];return Object.values(n).flatMap((t)=>{if(!t||typeof t!=="object"||Array.isArray(t))return[];let r=t,e=r.PreToolUse;if(!Array.isArray(e))return[];return e.flatMap((a)=>{if(!a||typeof a!=="object"||Array.isArray(a))return[];let l=a.hooks;if(!Array.isArray(l))return[];return l.flatMap((d)=>{if(!d||typeof d!=="object"||Array.isArray(d))return[];let s=d.command;if(typeof s!=="string"||!zL.test(s))return[];return[{command:s,enabled:r.enabled!==!1}]})})})}function za(n){let t=gn(n.homeDir);if(!jL(t))return{platform:"antigravity-cli",status:"n/a",configPath:t};let r;try{r=BL(JSON.parse(FL(t,"utf-8")))}catch(e){return{platform:"antigravity-cli",status:"n/a",configPath:t,errors:[`Failed to parse Antigravity hooks config ${t}: ${e instanceof Error?e.message:String(e)}`]}}if(r.some((e)=>e.enabled))return{platform:"antigravity-cli",status:"configured",method:"hook config",configPath:t};if(r.length>0)return{platform:"antigravity-cli",status:"disabled",method:"hook config",configPath:t};return{platform:"antigravity-cli",status:"n/a",configPath:t}}import{join as Ba}from"node:path";import{existsSync as JL,lstatSync as ZL,readFileSync as QL}from"node:fs";function n2(n,t=(r)=>r){if(!JL(n))return{kind:"missing"};try{return{kind:"ok",value:JSON.parse(t(QL(n,"utf-8")))}}catch{return{kind:"unreadable"}}}function S(n){try{return ZL(n)}catch{return}}function En(n,t){let r=S(t);if(!r)return{platform:n,status:"n/a",configPath:t};if(!r.isSymbolicLink()&&r.isDirectory())return;return{platform:n,status:"n/a",configPath:t,errors:[`${t} is a symlink or not a directory; move or remove it before installing`]}}function $(n,t){return typeof n==="object"&&n!==null?n[t]:void 0}var fr="cc-safety-net@cc-marketplace";function Ja(n){return Ba(n,".claude","plugins","installed_plugins.json")}function Za(n,t){let r=$($(n,"plugins"),t);return Array.isArray(r)&&r.length>0}function _n(n,t){let r=n2(Ja(n));return r.kind==="ok"&&Za(r.value,t)}function yr(n){let t=Ja(n),r=n2(t);if(r.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(r.kind==="missing")return{platform:"claude-code",status:"n/a"};if(!Za(r.value,fr))return{platform:"claude-code",status:"n/a"};let e=Ba(n,".claude","settings.json"),a=n2(e);if(a.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(!(a.kind==="ok"&&$($(a.value,"enabledPlugins"),fr)===!0))return{platform:"claude-code",status:"disabled",method:"plugin config",configPath:e,errors:[`${fr} is installed but not enabled in Claude Code`]};return{platform:"claude-code",status:"configured",method:"plugin config",configPath:t}}function Qa(n){return yr(n.homeDir)}function Xa(n){if(!n.codexPluginListOutput)return{platform:"codex",status:"n/a"};let t=n.codexPluginListOutput.split(`
-`).find((r)=>r.includes("https://github.com/kenryu42/cc-safety-net.git"));if(!t)return{platform:"codex",status:"n/a"};if(!t.includes("installed, enabled"))return{platform:"codex",status:"disabled",method:"codex plugin list",configPath:"codex plugin list",errors:["Codex plugin line for https://github.com/kenryu42/cc-safety-net.git must contain installed, enabled."]};return{platform:"codex",status:"configured",method:"codex plugin list",configPath:"codex plugin list"}}import{existsSync as Nn,readdirSync as XL,readFileSync as YL}from"node:fs";import{join as K}from"node:path";var t2="cc-safety-net@cc-marketplace",Pn=["cc-marketplace","cc-safety-net"],Ya=["_direct","copilot-safety-net"],Sa=["cc-marketplace","safety-net"],Ha="safety-net@cc-marketplace";function In(n,t){let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(^|[^a-z0-9-])${r}([^a-z0-9-]|$)`,"m").test(n??"")}function Aa(n){return In(n,"cc-safety-net@cc-marketplace")}function Wa(n){return In(n,"cc-marketplace")}function Ra(n){return In(n,"copilot-safety-net")}function Ka(n){return In(n,"safety-net@cc-marketplace")}function R(n){let t="",r=0,e=!1,a=!1,l=-1;while(r<n.length){let d=n[r],s=n[r+1];if(a){t+=d,a=!1,r++;continue}if(d==='"'&&!e){e=!0,l=-1,t+=d,r++;continue}if(d==='"'&&e){e=!1,t+=d,r++;continue}if(d==="\\"&&e){a=!0,t+=d,r++;continue}if(e){t+=d,r++;continue}if(d==="/"&&s==="/"){while(r<n.length&&n[r]!==`
-`)r++;continue}if(d==="/"&&s==="*"){r+=2;while(r<n.length-1){if(n[r]==="*"&&n[r+1]==="/"){r+=2;break}r++}continue}if(d===","){l=t.length,t+=d,r++;continue}if(d==="}"||d==="]"){if(l!==-1){let L=t.slice(l+1);if(/^\s*$/.test(L))t=t.slice(0,l)+L}l=-1,t+=d,r++;continue}if(!/\s/.test(d))l=-1;t+=d,r++}return t}function hr(n){if(!n?.includes("cc-safety-net"))return!1;return/(^|\s)hook\s+(?:[^\s]+\s+)*(--copilot-cli|-cp)(\s|$)/.test(n)}function Va(n,t){if(!n)return null;let r=n.match(/(\d+)\.(\d+)\.(\d+)/);if(!r)return null;let e=[Number(r[1]),Number(r[2]),Number(r[3])];for(let a=0;a<t.length;a++){let l=e[a]??0,d=t[a]??0;if(l!==d)return l>d}return!0}function SL(n){return Va(n,[0,0,422])}function HL(n){return Va(n,[1,0,8])}function Dn(n){return process.env.COPILOT_HOME||K(n,".copilot")}function xr(n){return(n.hooks?.preToolUse??[]).some((r)=>{if(r.type!=="command")return!1;return hr(r.command)||hr(r.bash)||hr(r.powershell)})}function $r(n,t){try{return JSON.parse(R(YL(n,"utf-8")))}catch(r){t?.push(`Failed to parse ${n}: ${r instanceof Error?r.message:String(r)}`);return}}function Ga(n,t){try{return XL(n).filter((r)=>r.endsWith(".json")).sort((r,e)=>r.localeCompare(e))}catch(r){return t?.push(`Failed to read ${n}: ${r instanceof Error?r.message:String(r)}`),[]}}function AL(n,t){if(!Nn(n))return[];let r=[];for(let e of Ga(n,t)){let a=K(n,e),l=$r(a,t);if(l&&xr(l))r.push(a)}return r}function wr(n,t){if(!Nn(n))return;let r=$r(n,t);if(!r)return;return{path:n,config:r}}function Ma(n,t,r,e){if(t){n.push(`GitHub Copilot CLI ${t} does not support ${r}; requires ${e}+`);return}n.push(`GitHub Copilot CLI version unavailable; skipping ${r} because it requires ${e}+`)}function WL(n){let t=[n.localSettings,n.repoSettings,n.userConfig];for(let r of t){if(r?.config.disableAllHooks===!0)return r.path;if(r?.config.disableAllHooks===!1)return}return}function RL(n,t,r,e){let a=Dn(n),l=K(t,".github","hooks"),d=K(a,"hooks"),s=K(t,".github","copilot"),L=HL(r),c=L===!0?e:void 0,i={userConfig:wr(K(a,"config.json"),c),repoSettings:wr(K(s,"settings.json"),c),localSettings:wr(K(s,"settings.local.json"),c)};if(L!==!1){let w=WL(i);if(w){if(L===null)e.push(`GitHub Copilot CLI version unavailable; treating disableAllHooks in ${w} as active`);return{activeConfigPaths:[],disabledBy:w}}}let u=AL(l,e),v=SL(r),p=v===!0?e:void 0,f=Nn(d)?Ga(d,p):[],o=[];for(let w of f){let h=K(d,w),J=$r(h,p);if(J&&xr(J))o.push(h)}if(v!==!0&&o.length>0)Ma(e,r,`user hook files in ${d}`,"0.0.422"),o.length=0;let y=[],x=[i.localSettings,i.repoSettings,i.userConfig];for(let w of x){if(!w)continue;if(!xr(w.config))continue;if(L===!0){y.push(w.path);continue}Ma(e,r,"inline hook definitions in Copilot config files","1.0.8");break}return{activeConfigPaths:[...y.filter((w)=>w.endsWith("settings.local.json")),...y.filter((w)=>w.endsWith("settings.json")),...u,...y.filter((w)=>w.endsWith("config.json")),...o]}}function Ca(n){let t=[],r=RL(n.homeDir,n.cwd,n.copilotCliVersion,t);if(r.disabledBy)return{platform:"copilot-cli",status:"disabled",method:"hook config",configPath:r.disabledBy,configPaths:[r.disabledBy],errors:t.length>0?t:void 0};let e=Dn(n.homeDir),a=K(e,"installed-plugins",...Pn),l=Nn(a),d=K(e,"settings.json"),s=n2(d,R);if(l&&s.kind==="unreadable")return{platform:"copilot-cli",status:"not-inspected"};if(l&&s.kind==="ok"&&$($(s.value,"enabledPlugins"),t2)===!1)return{platform:"copilot-cli",status:"disabled",method:"plugin config",configPath:d,errors:[`${t2} is installed but not enabled in Copilot CLI`]};if(l||r.activeConfigPaths.length>0){let L=l,c=r.activeConfigPaths[0];return{platform:"copilot-cli",status:"configured",method:L?"plugin config":"hook config",configPath:c??(L?a:void 0),configPaths:r.activeConfigPaths.length>0?r.activeConfigPaths:void 0,errors:t.length>0?t:void 0}}return{platform:"copilot-cli",status:"n/a",errors:t.length>0?t:void 0}}import{existsSync as _L,readFileSync as PL}from"node:fs";import{existsSync as Ua,mkdirSync as VL,readFileSync as GL}from"node:fs";import{dirname as CL,join as UL}from"node:path";import{renameSync as KL,writeFileSync as ML}from"node:fs";function B(n,t){let r=`${n}.${process.pid}.tmp`;ML(r,t),KL(r,n)}var mn="npx -y cc-safety-net hook --cursor",Oa=30;function tt(n){return UL(n,".cursor","hooks.json")}function q2(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}function gr(){return{command:mn,timeout:Oa,failClosed:!0}}function nt(n){return q2(n)&&n.command===mn}function OL(n){return Object.keys(n).length===3&&n.command===mn&&n.timeout===Oa&&n.failClosed===!0}function TL(n){try{return JSON.parse(GL(n,"utf-8"))}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Cursor hooks config ${n}: ${t.message}`);throw t}}function Ta(n){let t=TL(n);if(!q2(t))throw Error(`Cursor hooks config ${n} must be a JSON object`);if(t.version!==1)throw Error(`Cursor hooks config ${n} must set "version": 1`);if(t.hooks!==void 0&&!q2(t.hooks))throw Error(`Cursor hooks config ${n} "hooks" must be an object`);let r=q2(t.hooks)?t.hooks.preToolUse:void 0;if(r!==void 0&&!Array.isArray(r))throw Error(`Cursor hooks config ${n} "hooks.preToolUse" must be an array`);return t}function Ea(n){let t=q2(n.hooks)?n.hooks.preToolUse:void 0;return Array.isArray(t)?t:[]}function EL(n){if(!n.some(nt))return[...n,gr()];return n.reduce((t,r)=>{if(!nt(r))return t.result.push(r),t;if(!t.inserted)t.result.push(gr()),t.inserted=!0;return t},{result:[],inserted:!1}).result}function _a(n,t,r){let e=q2(t.hooks)?t.hooks:{},a={...t,hooks:{...e,preToolUse:r}};B(n,`${JSON.stringify(a,null,2)}
-`)}function Pa(n){let t=tt(n);if(!Ua(t))return VL(CL(t),{recursive:!0}),B(t,`${JSON.stringify({version:1,hooks:{preToolUse:[gr()]}},null,2)}
-`),{path:t,alreadyInstalled:!1};let r=Ta(t),e=Ea(r),a=e.filter(nt);if(q2(r.hooks)&&Array.isArray(r.hooks.preToolUse)&&a.length===1&&a[0]!==void 0&&OL(a[0]))return{path:t,alreadyInstalled:!0};return _a(t,r,EL(e)),{path:t,alreadyInstalled:!1}}function Ia(n){let t=tt(n);if(!Ua(t))return{path:t,alreadyInstalled:!1};let r=Ta(t),e=Ea(r),a=e.filter((l)=>!nt(l));if(a.length===e.length)return{path:t,alreadyInstalled:!1};return _a(t,r,a),{path:t,alreadyInstalled:!0}}function IL(n){if(!n||typeof n!=="object"||Array.isArray(n))return[];let t=n.hooks;if(!t||typeof t!=="object"||Array.isArray(t))return[];let r=t.preToolUse;if(!Array.isArray(r))return[];return r.filter((e)=>!!e&&typeof e==="object"&&!Array.isArray(e)&&e.command===mn)}function NL(n){let t=[];if(n.length>1)t.push("Multiple managed cc-safety-net hooks found; reinstall to collapse duplicates");let r=n[0];if(r&&r.failClosed!==!0)t.push('Managed hook is missing "failClosed": true; reinstall to repair');if(r&&r.timeout!==30)t.push('Managed hook "timeout" is not 30; reinstall to repair');return t}function Na(n){let t=tt(n.homeDir);if(!_L(t))return{platform:"cursor",status:"n/a",configPath:t};let r;try{r=JSON.parse(PL(t,"utf-8"))}catch(l){return{platform:"cursor",status:"n/a",configPath:t,errors:[`Failed to parse Cursor hooks config ${t}: ${l instanceof Error?l.message:String(l)}`]}}let e=IL(r);if(e.length===0)return{platform:"cursor",status:"n/a",configPath:t};let a=NL(e);return{platform:"cursor",status:"configured",method:"hook config",configPath:t,errors:a.length>0?a:void 0}}import{existsSync as nc}from"node:fs";import{join as Dr}from"node:path";var mr="gemini-safety-net";function kr(n){let t=Dr(n,".gemini","extensions"),r=Dr(t,mr);if(!nc(r))return{platform:"gemini-cli",status:"n/a"};let e=Dr(t,"extension-enablement.json"),a=n2(e);if(a.kind==="unreadable")return{platform:"gemini-cli",status:"not-inspected"};let l=a.kind==="ok"?$($(a.value,mr),"overrides"):void 0;if(Array.isArray(l)&&l.some((s)=>typeof s==="string"&&s.startsWith("!")))return{platform:"gemini-cli",status:"disabled",method:"extension config",configPath:e,errors:[`${mr} is disabled in Gemini CLI`]};return{platform:"gemini-cli",status:"configured",method:"extension config",configPath:r}}function n0(n){return kr(n.homeDir)}import{readFileSync as c0}from"node:fs";import{join as i0}from"node:path";var M="cc-safety-net",t0="# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent";function r0(n){return`# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent
+`);function hc(n){return Boolean(n.isTTY)}async function gn(n={}){let t=n.output??process.stdout;if(!hc(t))return;let e=n.input??process.stdin,r={duration:n.duration,frequency:n.frequency,output:t,seed:n.seed??Math.random()*8192,sleep:n.sleep,speed:n.speed,spread:n.spread};if(!e.isTTY||typeof e.setRawMode!=="function"){await he(ma,r);return}let a=new AbortController,l=e.readableFlowing===!0,d=e.isRaw===!0,s=!1,c=(i,L)=>{if(L.ctrl&&L.name==="c")s=!0;if(s||L.name==="return"||L.name==="enter")a.abort()};ka.emitKeypressEvents(e),e.on("keypress",c),e.setRawMode(!0),e.resume();try{await he(ma,{...r,signal:a.signal})}finally{if(e.off("keypress",c),e.setRawMode(d),!l)e.pause()}if(!s)return;if(n.onInterrupt){n.onInterrupt();return}process.kill(process.pid,"SIGINT")}var qa="\r\x1B[2K",yc="\x1B[?25l",wc="\x1B[39m",xc="\x1B[?25h",$c=100,gc=0.55,Dc=80,ja=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];function mc(n){return new Promise((t)=>setTimeout(t,n))}async function Tn(n,t={}){let e=t.output??process.stdout;if(!e.isTTY)return n;let r=t.sleep??mc,a=!1,l=n.then((s)=>{return a=!0,s},(s)=>{throw a=!0,s});if(await Promise.race([l.then(()=>!0),r($c).then(()=>!1)]))return l;e.write(yc);try{for(let s=0;!a;s+=1)e.write(`${qa}${ga(s*gc)}${ja[s%ja.length]}${wc} ${t.loadingMessage??"Loading…"}`),await Promise.race([l,r(Dc)]);return await l}finally{e.write(`${qa}${xc}`)}}async function Dn(n,t,e,r={}){let a=t();if(n)await e();if(n&&a.ready)await Tn(a.ready,r);return a.finish()}import{homedir as Yi}from"node:os";import{stripVTControlCharacters as kc}from"node:util";var _n="amp plugins list",qc=/^\s*[✓✗]\s+cc-safety-net(?:\.ts)?\s+\(User Plugins\)\s+(\S+)\s*$/;function Fa(n){if(!n.ampPluginListOutput)return{platform:"amp",status:"n/a"};let t=kc(n.ampPluginListOutput).split(`
+`).map((e)=>qc.exec(e)?.[1]).find((e)=>e!==void 0);if(!t)return{platform:"amp",status:"n/a"};if(t!=="active")return{platform:"amp",status:"disabled",method:_n,configPath:_n,errors:[`Amp personal plugin cc-safety-net is ${t}; run "plugins: reload" in Amp or reinstall with install --amp`]};return{platform:"amp",status:"configured",method:_n,configPath:_n}}import{existsSync as Fc,readFileSync as zc}from"node:fs";import{join as jc}from"node:path";function mn(n){return jc(n,".gemini","config","hooks.json")}var Bc=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*(?:--agy-cli|-ac)(\s|["']|$)/;function Jc(n){if(!n||typeof n!=="object"||Array.isArray(n))return[];return Object.values(n).flatMap((t)=>{if(!t||typeof t!=="object"||Array.isArray(t))return[];let e=t,r=e.PreToolUse;if(!Array.isArray(r))return[];return r.flatMap((a)=>{if(!a||typeof a!=="object"||Array.isArray(a))return[];let l=a.hooks;if(!Array.isArray(l))return[];return l.flatMap((d)=>{if(!d||typeof d!=="object"||Array.isArray(d))return[];let s=d.command;if(typeof s!=="string"||!Bc.test(s))return[];return[{command:s,enabled:e.enabled!==!1}]})})})}function za(n){let t=mn(n.homeDir);if(!Fc(t))return{platform:"antigravity-cli",status:"n/a",configPath:t};let e;try{e=Jc(JSON.parse(zc(t,"utf-8")))}catch(r){return{platform:"antigravity-cli",status:"n/a",configPath:t,errors:[`Failed to parse Antigravity hooks config ${t}: ${r instanceof Error?r.message:String(r)}`]}}if(e.some((r)=>r.enabled))return{platform:"antigravity-cli",status:"configured",method:"hook config",configPath:t};if(e.length>0)return{platform:"antigravity-cli",status:"disabled",method:"hook config",configPath:t};return{platform:"antigravity-cli",status:"n/a",configPath:t}}import{join as Ba}from"node:path";import{existsSync as Zc,lstatSync as Qc,readFileSync as Xc}from"node:fs";function n2(n,t=(e)=>e){if(!Zc(n))return{kind:"missing"};try{return{kind:"ok",value:JSON.parse(t(Xc(n,"utf-8")))}}catch{return{kind:"unreadable"}}}function S(n){try{return Qc(n)}catch{return}}function En(n,t){let e=S(t);if(!e)return{platform:n,status:"n/a",configPath:t};if(!e.isSymbolicLink()&&e.isDirectory())return;return{platform:n,status:"n/a",configPath:t,errors:[`${t} is a symlink or not a directory; move or remove it before installing`]}}function $(n,t){return typeof n==="object"&&n!==null?n[t]:void 0}var ye="cc-safety-net@cc-marketplace";function Ja(n){return Ba(n,".claude","plugins","installed_plugins.json")}function Za(n,t){let e=$($(n,"plugins"),t);return Array.isArray(e)&&e.length>0}function Pn(n,t){let e=n2(Ja(n));return e.kind==="ok"&&Za(e.value,t)}function we(n){let t=Ja(n),e=n2(t);if(e.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(e.kind==="missing")return{platform:"claude-code",status:"n/a"};if(!Za(e.value,ye))return{platform:"claude-code",status:"n/a"};let r=Ba(n,".claude","settings.json"),a=n2(r);if(a.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(!(a.kind==="ok"&&$($(a.value,"enabledPlugins"),ye)===!0))return{platform:"claude-code",status:"disabled",method:"plugin config",configPath:r,errors:[`${ye} is installed but not enabled in Claude Code`]};return{platform:"claude-code",status:"configured",method:"plugin config",configPath:t}}function Qa(n){return we(n.homeDir)}function Xa(n){if(!n.codexPluginListOutput)return{platform:"codex",status:"n/a"};let t=n.codexPluginListOutput.split(`
+`).find((e)=>e.includes("https://github.com/kenryu42/cc-safety-net.git"));if(!t)return{platform:"codex",status:"n/a"};if(!t.includes("installed, enabled"))return{platform:"codex",status:"disabled",method:"codex plugin list",configPath:"codex plugin list",errors:["Codex plugin line for https://github.com/kenryu42/cc-safety-net.git must contain installed, enabled."]};return{platform:"codex",status:"configured",method:"codex plugin list",configPath:"codex plugin list"}}import{existsSync as nt,readdirSync as Yc,readFileSync as Sc}from"node:fs";import{join as K}from"node:path";var t2="cc-safety-net@cc-marketplace",In=["cc-marketplace","cc-safety-net"],Ya=["_direct","copilot-safety-net"],Sa=["cc-marketplace","safety-net"],Ha="safety-net@cc-marketplace";function Nn(n,t){let e=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(^|[^a-z0-9-])${e}([^a-z0-9-]|$)`,"m").test(n??"")}function Aa(n){return Nn(n,"cc-safety-net@cc-marketplace")}function Wa(n){return Nn(n,"cc-marketplace")}function Ra(n){return Nn(n,"copilot-safety-net")}function Ka(n){return Nn(n,"safety-net@cc-marketplace")}function R(n){let t="",e=0,r=!1,a=!1,l=-1;while(e<n.length){let d=n[e],s=n[e+1];if(a){t+=d,a=!1,e++;continue}if(d==='"'&&!r){r=!0,l=-1,t+=d,e++;continue}if(d==='"'&&r){r=!1,t+=d,e++;continue}if(d==="\\"&&r){a=!0,t+=d,e++;continue}if(r){t+=d,e++;continue}if(d==="/"&&s==="/"){while(e<n.length&&n[e]!==`
+`)e++;continue}if(d==="/"&&s==="*"){e+=2;while(e<n.length-1){if(n[e]==="*"&&n[e+1]==="/"){e+=2;break}e++}continue}if(d===","){l=t.length,t+=d,e++;continue}if(d==="}"||d==="]"){if(l!==-1){let c=t.slice(l+1);if(/^\s*$/.test(c))t=t.slice(0,l)+c}l=-1,t+=d,e++;continue}if(!/\s/.test(d))l=-1;t+=d,e++}return t}function xe(n){if(!n?.includes("cc-safety-net"))return!1;return/(^|\s)hook\s+(?:[^\s]+\s+)*(--copilot-cli|-cp)(\s|$)/.test(n)}function Va(n,t){if(!n)return null;let e=n.match(/(\d+)\.(\d+)\.(\d+)/);if(!e)return null;let r=[Number(e[1]),Number(e[2]),Number(e[3])];for(let a=0;a<t.length;a++){let l=r[a]??0,d=t[a]??0;if(l!==d)return l>d}return!0}function Hc(n){return Va(n,[0,0,422])}function Ac(n){return Va(n,[1,0,8])}function kn(n){return process.env.COPILOT_HOME||K(n,".copilot")}function ge(n){return(n.hooks?.preToolUse??[]).some((e)=>{if(e.type!=="command")return!1;return xe(e.command)||xe(e.bash)||xe(e.powershell)})}function De(n,t){try{return JSON.parse(R(Sc(n,"utf-8")))}catch(e){t?.push(`Failed to parse ${n}: ${e instanceof Error?e.message:String(e)}`);return}}function Ga(n,t){try{return Yc(n).filter((e)=>e.endsWith(".json")).sort((e,r)=>e.localeCompare(r))}catch(e){return t?.push(`Failed to read ${n}: ${e instanceof Error?e.message:String(e)}`),[]}}function Wc(n,t){if(!nt(n))return[];let e=[];for(let r of Ga(n,t)){let a=K(n,r),l=De(a,t);if(l&&ge(l))e.push(a)}return e}function $e(n,t){if(!nt(n))return;let e=De(n,t);if(!e)return;return{path:n,config:e}}function Ma(n,t,e,r){if(t){n.push(`GitHub Copilot CLI ${t} does not support ${e}; requires ${r}+`);return}n.push(`GitHub Copilot CLI version unavailable; skipping ${e} because it requires ${r}+`)}function Rc(n){let t=[n.localSettings,n.repoSettings,n.userConfig];for(let e of t){if(e?.config.disableAllHooks===!0)return e.path;if(e?.config.disableAllHooks===!1)return}return}function Kc(n,t,e,r){let a=kn(n),l=K(t,".github","hooks"),d=K(a,"hooks"),s=K(t,".github","copilot"),c=Ac(e),i=c===!0?r:void 0,L={userConfig:$e(K(a,"config.json"),i),repoSettings:$e(K(s,"settings.json"),i),localSettings:$e(K(s,"settings.local.json"),i)};if(c!==!1){let w=Rc(L);if(w){if(c===null)r.push(`GitHub Copilot CLI version unavailable; treating disableAllHooks in ${w} as active`);return{activeConfigPaths:[],disabledBy:w}}}let u=Wc(l,r),v=Hc(e),p=v===!0?r:void 0,f=nt(d)?Ga(d,p):[],o=[];for(let w of f){let y=K(d,w),J=De(y,p);if(J&&ge(J))o.push(y)}if(v!==!0&&o.length>0)Ma(r,e,`user hook files in ${d}`,"0.0.422"),o.length=0;let h=[],x=[L.localSettings,L.repoSettings,L.userConfig];for(let w of x){if(!w)continue;if(!ge(w.config))continue;if(c===!0){h.push(w.path);continue}Ma(r,e,"inline hook definitions in Copilot config files","1.0.8");break}return{activeConfigPaths:[...h.filter((w)=>w.endsWith("settings.local.json")),...h.filter((w)=>w.endsWith("settings.json")),...u,...h.filter((w)=>w.endsWith("config.json")),...o]}}function Ca(n){let t=[],e=Kc(n.homeDir,n.cwd,n.copilotCliVersion,t);if(e.disabledBy)return{platform:"copilot-cli",status:"disabled",method:"hook config",configPath:e.disabledBy,configPaths:[e.disabledBy],errors:t.length>0?t:void 0};let r=kn(n.homeDir),a=K(r,"installed-plugins",...In),l=nt(a),d=K(r,"settings.json"),s=n2(d,R);if(l&&s.kind==="unreadable")return{platform:"copilot-cli",status:"not-inspected"};if(l&&s.kind==="ok"&&$($(s.value,"enabledPlugins"),t2)===!1)return{platform:"copilot-cli",status:"disabled",method:"plugin config",configPath:d,errors:[`${t2} is installed but not enabled in Copilot CLI`]};if(l||e.activeConfigPaths.length>0){let c=l,i=e.activeConfigPaths[0];return{platform:"copilot-cli",status:"configured",method:c?"plugin config":"hook config",configPath:i??(c?a:void 0),configPaths:e.activeConfigPaths.length>0?e.activeConfigPaths:void 0,errors:t.length>0?t:void 0}}return{platform:"copilot-cli",status:"n/a",errors:t.length>0?t:void 0}}import{existsSync as Pc,readFileSync as Ic}from"node:fs";import{existsSync as Ua,mkdirSync as Gc,readFileSync as Cc}from"node:fs";import{dirname as Uc,join as Oc}from"node:path";import{renameSync as Mc,writeFileSync as Vc}from"node:fs";function B(n,t){let e=`${n}.${process.pid}.tmp`;Vc(e,t),Mc(e,n)}var qn="npx -y cc-safety-net hook --cursor",Oa=30;function et(n){return Oc(n,".cursor","hooks.json")}function k2(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}function me(){return{command:qn,timeout:Oa,failClosed:!0}}function tt(n){return k2(n)&&n.command===qn}function Tc(n){return Object.keys(n).length===3&&n.command===qn&&n.timeout===Oa&&n.failClosed===!0}function _c(n){try{return JSON.parse(Cc(n,"utf-8"))}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Cursor hooks config ${n}: ${t.message}`);throw t}}function Ta(n){let t=_c(n);if(!k2(t))throw Error(`Cursor hooks config ${n} must be a JSON object`);if(t.version!==1)throw Error(`Cursor hooks config ${n} must set "version": 1`);if(t.hooks!==void 0&&!k2(t.hooks))throw Error(`Cursor hooks config ${n} "hooks" must be an object`);let e=k2(t.hooks)?t.hooks.preToolUse:void 0;if(e!==void 0&&!Array.isArray(e))throw Error(`Cursor hooks config ${n} "hooks.preToolUse" must be an array`);return t}function _a(n){let t=k2(n.hooks)?n.hooks.preToolUse:void 0;return Array.isArray(t)?t:[]}function Ec(n){if(!n.some(tt))return[...n,me()];return n.reduce((t,e)=>{if(!tt(e))return t.result.push(e),t;if(!t.inserted)t.result.push(me()),t.inserted=!0;return t},{result:[],inserted:!1}).result}function Ea(n,t,e){let r=k2(t.hooks)?t.hooks:{},a={...t,hooks:{...r,preToolUse:e}};B(n,`${JSON.stringify(a,null,2)}
+`)}function Pa(n){let t=et(n);if(!Ua(t))return Gc(Uc(t),{recursive:!0}),B(t,`${JSON.stringify({version:1,hooks:{preToolUse:[me()]}},null,2)}
+`),{path:t,alreadyInstalled:!1};let e=Ta(t),r=_a(e),a=r.filter(tt);if(k2(e.hooks)&&Array.isArray(e.hooks.preToolUse)&&a.length===1&&a[0]!==void 0&&Tc(a[0]))return{path:t,alreadyInstalled:!0};return Ea(t,e,Ec(r)),{path:t,alreadyInstalled:!1}}function Ia(n){let t=et(n);if(!Ua(t))return{path:t,alreadyInstalled:!1};let e=Ta(t),r=_a(e),a=r.filter((l)=>!tt(l));if(a.length===r.length)return{path:t,alreadyInstalled:!1};return Ea(t,e,a),{path:t,alreadyInstalled:!0}}function Nc(n){if(!n||typeof n!=="object"||Array.isArray(n))return[];let t=n.hooks;if(!t||typeof t!=="object"||Array.isArray(t))return[];let e=t.preToolUse;if(!Array.isArray(e))return[];return e.filter((r)=>!!r&&typeof r==="object"&&!Array.isArray(r)&&r.command===qn)}function ni(n){let t=[];if(n.length>1)t.push("Multiple managed cc-safety-net hooks found; reinstall to collapse duplicates");let e=n[0];if(e&&e.failClosed!==!0)t.push('Managed hook is missing "failClosed": true; reinstall to repair');if(e&&e.timeout!==30)t.push('Managed hook "timeout" is not 30; reinstall to repair');return t}function Na(n){let t=et(n.homeDir);if(!Pc(t))return{platform:"cursor",status:"n/a",configPath:t};let e;try{e=JSON.parse(Ic(t,"utf-8"))}catch(l){return{platform:"cursor",status:"n/a",configPath:t,errors:[`Failed to parse Cursor hooks config ${t}: ${l instanceof Error?l.message:String(l)}`]}}let r=Nc(e);if(r.length===0)return{platform:"cursor",status:"n/a",configPath:t};let a=ni(r);return{platform:"cursor",status:"configured",method:"hook config",configPath:t,errors:a.length>0?a:void 0}}import{existsSync as ti}from"node:fs";import{join as ke}from"node:path";var qe="gemini-safety-net";function je(n){let t=ke(n,".gemini","extensions"),e=ke(t,qe);if(!ti(e))return{platform:"gemini-cli",status:"n/a"};let r=ke(t,"extension-enablement.json"),a=n2(r);if(a.kind==="unreadable")return{platform:"gemini-cli",status:"not-inspected"};let l=a.kind==="ok"?$($(a.value,qe),"overrides"):void 0;if(Array.isArray(l)&&l.some((s)=>typeof s==="string"&&s.startsWith("!")))return{platform:"gemini-cli",status:"disabled",method:"extension config",configPath:r,errors:[`${qe} is disabled in Gemini CLI`]};return{platform:"gemini-cli",status:"configured",method:"extension config",configPath:e}}function n0(n){return je(n.homeDir)}import{readFileSync as i0}from"node:fs";import{join as L0}from"node:path";var M="cc-safety-net",t0="# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent";function e0(n){return`# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent
 # version: ${n}
-`}function tc(n){return`${r0(n)}name: cc-safety-net
+`}function ei(n){return`${e0(n)}name: cc-safety-net
 version: "${n}"
 description: "Block destructive commands and secret-file access before Hermes runs a tool."
 author: "cc-safety-net"
 provides_hooks:
   - pre_tool_call
-`}function rc(n){return`${r0(n)}"""CC Safety Net guard for Hermes Agent.
+`}function ri(n){return`${e0(n)}"""CC Safety Net guard for Hermes Agent.
 
 Registers pre_tool_call and forwards the tool call to the packaged CC Safety Net
 adapter (cc-safety-net hook --hermes-agent) over JSON stdin. The adapter prints nothing
@@ -169,82 +169,83 @@ def _pre_tool_call(tool_name="", args=None, session_id="", task_id="", **_):
 
 def register(ctx):
     ctx.register_hook("pre_tool_call", _pre_tool_call)
-`}function kn(n){return[{name:"__init__.py",content:rc(n)},{name:"plugin.yaml",content:tc(n)}]}import{mkdirSync as ec,readdirSync as ac,readFileSync as lc,rmSync as qr}from"node:fs";import{join as j2}from"node:path";var dc="__pycache__";function jr(n){let t=process.env.HERMES_HOME?.trim();return t?t:j2(n,".hermes")}function Fr(n){return j2(jr(n),"plugins",M)}function zr(n){return n.startsWith(t0)}function Br(n,t){let r=Fr(n),e=S(r);if(e&&(e.isSymbolicLink()||!e.isDirectory()))throw Error(`Refusing to ${t} ${r}: not a regular directory. Move or remove it and rerun ${t==="install"?"install":"uninstall"} --hermes-agent.`);return r}function e0(n,t){let r=S(n);if(!r)return;if(r.isSymbolicLink()||!r.isFile())throw Error(`Refusing to ${t} ${n}: not a regular file. Move or remove it.`);let e=lc(n,"utf-8");if(!zr(e))throw Error(`Refusing to ${t} unmanaged file at ${n}. Move or remove it.`);return e}function a0(n){let t=Br(n,"install"),r=kn(j());if(r.map((a)=>e0(j2(t,a.name),"overwrite")).every((a,l)=>a===r[l]?.content))return{path:t,alreadyInstalled:!0};return ec(t,{recursive:!0}),r.forEach((a)=>{B(j2(t,a.name),a.content)}),{path:t,alreadyInstalled:!1}}function Jr(n){let t=Br(n,"remove");if(!S(t))return[];return kn(j()).filter((r)=>e0(j2(t,r.name),"remove")!==void 0)}function l0(n){let t=Br(n,"remove");if(!S(t))return{path:t,alreadyInstalled:!1};let r=Jr(n);if(r.forEach((e)=>{qr(j2(t,e.name))}),qr(j2(t,dc),{recursive:!0,force:!0}),ac(t).length===0)qr(t,{recursive:!0});return{path:t,alreadyInstalled:r.length>0}}var rt="hermes-agent",d0=/^([^\s#][^:]*):/,sc=/^\s+([A-Za-z_][\w-]*):/,s0=/^\s+-\s*(.*)$/;function Lc(n){return n.trim().replace(/^(["'])(.*)\1$/,"$2")}function cc(n){let t=n.split(/\r?\n/),r=t.findIndex((l)=>d0.exec(l)?.[1]?.trim()==="plugins");if(r===-1)return[];let e=t.slice(r+1),a=e.findIndex((l)=>d0.test(l));return a===-1?e:e.slice(0,a)}function L0(n,t){let r=cc(n),e=r.findIndex((d)=>sc.exec(d)?.[1]===t);if(e===-1)return[];let a=r.slice(e+1),l=a.findIndex((d)=>!s0.test(d));return(l===-1?a:a.slice(0,l)).map((d)=>Lc(s0.exec(d)?.[1]??""))}function ic(n){try{return c0(i0(jr(n),"config.yaml"),"utf-8")}catch{return}}function Zr(n){let t=ic(n)??"";return L0(t,"enabled").includes(M)&&!L0(t,"disabled").includes(M)}function p0(n){return/^# version:\s*(.+)$/m.exec(n)?.[1]?.trim()}function pc(n,t){let r=S(n);if(!r)return{error:`${t.name} is missing from ${n}; run install --hermes-agent`};if(r.isSymbolicLink()||!r.isFile())return{error:`${n} is a symlink or not a regular file; move or remove it`};try{let e=c0(n,"utf-8");if(!zr(e))return{error:`Unmanaged ${t.name} occupies ${n}; move or remove it`};if(p0(e)===j()&&e!==t.content)return{error:`Modified ${t.name} occupies ${n}; run install --hermes-agent to restore it`};return{content:e}}catch(e){return{error:`Failed to read ${n}: ${e instanceof Error?e.message:String(e)}`}}}function u0(n){let t=Fr(n.homeDir),r=En(rt,t);if(r)return r;let e=kn(j()).map((s)=>pc(i0(t,s.name),s)),a=e.flatMap((s)=>("error"in s)?[s.error]:[]);if(a.length>0)return{platform:rt,status:"n/a",configPath:t,errors:a};let l=e.some((s)=>("content"in s)&&p0(s.content)!==j()),d=l?["Installed Hermes Agent plugin is outdated; run install --hermes-agent to update"]:[];if(!Zr(n.homeDir))return{platform:rt,status:"disabled",method:"plugin directory",configPath:t,errors:[`${M} is not enabled in Hermes; run \`hermes plugins enable ${M}\``,...d]};return{platform:rt,status:"configured",method:"plugin directory",configPath:t,errors:l?d:void 0}}import{existsSync as uc,readFileSync as oc}from"node:fs";import{join as o0}from"node:path";var vc=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*--kimi-code(\s|["']|$)/;function bc(n){return o0(process.env.KIMI_CODE_HOME||o0(n,".kimi-code"),"config.toml")}function qn(n){let t=bc(n.homeDir);if(!uc(t))return{platform:"kimi-code",status:"n/a",configPath:t};try{if(!vc.test(oc(t,"utf-8")))return{platform:"kimi-code",status:"n/a",configPath:t}}catch(r){return{platform:"kimi-code",status:"n/a",configPath:t,errors:[`Failed to read ${t}: ${r instanceof Error?r.message:String(r)}`]}}return{platform:"kimi-code",status:"configured",method:"hook config",configPath:t}}import{readFileSync as D0}from"node:fs";import{join as Fn}from"node:path";var q="cc-safety-net",V="index.js",I2="openclaw.plugin.json",N2="package.json";var et="// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw";import{existsSync as hc,lstatSync as wc,readdirSync as xc,readFileSync as $c}from"node:fs";import{dirname as f0,join as F2}from"node:path";import{fileURLToPath as gc}from"node:url";import{spawn as fc}from"node:child_process";function yc(n){return n.join(" ")}function Qr(n,t,r){return[`Failed to run ${yc(n)}${t===null?"":` (exit ${t})`}.`,r.trim()].filter(Boolean).join(`
-`)}function Xr(n){let t={stdout:"",stderr:""};return n.stdout.setEncoding("utf-8"),n.stderr.setEncoding("utf-8"),n.stdout.on("data",(r)=>{t.stdout+=r}),n.stderr.on("data",(r)=>{t.stderr+=r}),t}function r2(n,t){return new Promise((r,e)=>{let a=f2([...n],process.env),l=fc(a.cmd,a.args,{stdio:["ignore","pipe","pipe"]}),d=Xr(l),s=()=>[d.stdout,d.stderr].filter(Boolean).join(`
-`),L=t?.timeoutMs??120000,c=setTimeout(()=>{l.kill(),e(Error(Qr(n,null,`Timed out after ${L}ms.
-${s()}`.trim())))},L);l.on("error",(i)=>{clearTimeout(c),e(Error(Qr(n,null,`${i.message}
-${s()}`.trim())))}),l.on("close",(i)=>{if(clearTimeout(c),i!==0){e(Error(Qr(n,i,s())));return}r(t?.stdoutOnly?d.stdout:s())})})}async function Yr(n){for(let t of n)await r2(t)}async function v0(n){for(let t of n)try{await r2(t)}catch(r){console.warn(r instanceof Error?r.message:String(r))}}var b0=F2("openclaw",q),Dc=[V,I2,N2];function y0(n){let t=process.env.OPENCLAW_STATE_DIR?.trim();if(t)return t;let r=process.env.OPENCLAW_CONFIG_PATH?.trim();return r?f0(r):F2(n,".openclaw")}function h0(n){let t=process.env.OPENCLAW_CONFIG_PATH?.trim();return t?t:F2(y0(n),"openclaw.json")}function Sr(n){return F2(y0(n),"extensions",q)}function mc(n){let t=xc(n);if(t.length===0)return!0;if(t.some((a)=>!Dc.includes(a)))return!1;let r=F2(n,V),e=S(r);return e!==void 0&&!e.isSymbolicLink()&&e.isFile()&&$c(r,"utf-8").startsWith(et)}function Hr(n){let t=Sr(n),r=S(t);if(!r)return;if(!r.isSymbolicLink()&&r.isDirectory()&&mc(t))return;throw Error(`Refusing to modify ${t}: it does not hold a cc-safety-net managed OpenClaw plugin. Move or remove it, then run the command again.`)}function w0(){let n=f0(gc(import.meta.url));return[F2(n,"..",b0),F2(n,"..","..","..","dist",b0)]}function Ar(n=w0()){return n.find((t)=>hc(t)&&wc(t).isDirectory())}function kc(n=w0()){let t=Ar(n);if(!t)throw Error("Packaged OpenClaw plugin directory not found. Reinstall cc-safety-net and try again.");return t}function x0(n=kc()){return[["openclaw","plugins","install",n,"--force"],["openclaw","plugins","enable",q]]}function qc(n){let t=(()=>{try{return JSON.parse(n)}catch{return}})(),r=$($(t,"plugin"),"status");return typeof r==="string"?r:void 0}async function $0(){let n=qc(await r2(["openclaw","plugins","inspect",q,"--runtime","--json"],{stdoutOnly:!0}));if(n==="loaded")return;throw Error(`${n===void 0?`The ${q} plugin's load state could not be verified: OpenClaw's runtime inspect report was unreadable.`:`OpenClaw reports the ${q} plugin with status "${n}".`} Run \`openclaw plugins inspect ${q} --runtime\` for details.`)}var at="openclaw",jn=`run \`openclaw plugins enable ${q}\``;function nn(n,t){let r=Fn(n,t),e=S(r);if(!e)return{error:`${t} is missing from ${r}; run install --openclaw`};if(e.isSymbolicLink()||!e.isFile())return{error:`${r} is a symlink or not a regular file; move or remove it`};try{return{content:D0(r,"utf-8")}}catch(a){return{error:`Failed to read ${r}: ${a instanceof Error?a.message:String(a)}`}}}function m0(n){try{return JSON.parse(R(n))}catch{return}}function jc(n){let t=nn(n,I2);if("error"in t)return t.error;if($(m0(t.content),"id")===q)return;return`${Fn(n,I2)} is not a valid ${q} manifest; run install --openclaw`}function Fc(n){let t=nn(n,N2);if("error"in t)return t.error;let r=$($(m0(t.content),"openclaw"),"extensions");if(Array.isArray(r)&&r.includes(`./${V}`))return;return`${Fn(n,N2)} does not point OpenClaw at ${V}; run install --openclaw`}function g0(n){return Array.isArray(n)?n.filter((t)=>typeof t==="string"):[]}function zc(n){let t=h0(n);if(!S(t))return`${q} is not enabled; ${jn}`;let r=(()=>{try{return JSON.parse(R(D0(t,"utf-8")))}catch{return}})();if(r===void 0)return`Failed to read ${t}; fix it, then ${jn}`;let e=$(r,"plugins");if($(e,"enabled")===!1)return`plugins.enabled is false in ${t}; no OpenClaw plugin loads`;let a=$($($(e,"entries"),q),"enabled");if(g0($(e,"deny")).includes(q)||a===!1)return`${q} is disabled in ${t}; ${jn}`;let l=g0($(e,"allow"));if(l.length>0&&!l.includes(q))return`plugins.allow in ${t} does not list ${q}; add it, then ${jn}`;if(l.includes(q)||a===!0)return;return`${q} is not enabled; ${jn}`}function k0(n){return/^\/\/ version:\s*(.+)$/m.exec(n)?.[1]?.trim()}function Bc(n,t,r){if(r===void 0)return[];let e=nn(r,V);if("error"in e||k0(e.content)!==t)return[];return[V,I2,N2].flatMap((a)=>{let l=nn(n,a),d=nn(r,a);if("error"in l||"error"in d||l.content===d.content)return[];return[`Modified ${a} occupies ${Fn(n,a)}; run install --openclaw to restore it`]})}function q0(n){let t=Sr(n.homeDir),r=En(at,t);if(r)return r;let e=nn(t,V),l=["error"in e?e.error:e.content.startsWith(et)?void 0:`Unmanaged ${V} occupies ${Fn(t,V)}; move or remove it`,jc(t),Fc(t)].filter((i)=>i!==void 0),d="content"in e?k0(e.content):void 0,s=l.length>0?l:Bc(t,d,Ar());if(s.length>0)return{platform:at,status:"n/a",configPath:t,errors:s};let L=d===j()?[]:["Installed OpenClaw plugin is outdated; run install --openclaw to update"],c=zc(n.homeDir);if(c)return{platform:at,status:"disabled",method:"plugin directory",configPath:t,errors:[c,...L]};return{platform:at,status:"configured",method:"plugin directory",configPath:t,errors:L.length>0?L:void 0}}import{existsSync as Jc,readFileSync as Zc}from"node:fs";import{join as j0}from"node:path";function F0(n){let t=[],r=j0(n.homeDir,".config","opencode"),e=["opencode.json","opencode.jsonc"];for(let a of e){let l=j0(r,a);if(Jc(l))try{let d=Zc(l,"utf-8"),s=R(d);if((JSON.parse(s).plugin??[]).some((u)=>u.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:l,errors:t.length>0?t:void 0}}catch(d){t.push(`Failed to parse ${a}: ${d instanceof Error?d.message:String(d)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as Qc}from"node:path";function Wr(n){return Qc(n,".pi","agent","settings.json")}function Rr(n){if(typeof n!=="string")return!1;return n==="npm:cc-safety-net"||n.startsWith("npm:cc-safety-net@")}function z0(n){let t=Wr(n.homeDir),r=n2(t);if(r.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(r.kind==="missing")return{platform:"pi",status:"n/a"};let e=$(r.value,"packages");if(!Array.isArray(e))return{platform:"pi",status:"n/a"};let a=e.find((s)=>Rr(typeof s==="string"?s:$(s,"source")));if(a===void 0)return{platform:"pi",status:"n/a"};let l=$(a,"extensions");if(Array.isArray(l)&&l.some((s)=>typeof s==="string"&&s.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var Yc={amp:Fa,"antigravity-cli":za,"claude-code":Qa,codex:Xa,"copilot-cli":Ca,cursor:Na,"gemini-cli":n0,"hermes-agent":u0,"kimi-code":qn,openclaw:q0,opencode:F0,pi:z0};function tn(n,t){let r={...t,cwd:n,homeDir:t?.homeDir??Xc()};return j1.map((e)=>Sc(Yc[e](r)))}function Sc(n){if(n.status==="not-inspected")return{platform:n.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:n.platform,detected:n.status!=="n/a",configured:n.status==="configured",inspectionStatus:n.status!=="n/a"?"verified":n.errors&&n.errors.length>0?"failed":"not-applicable",method:n.method,configPath:n.configPath,configPaths:n.configPaths,errors:n.errors}}import{tmpdir as Hc}from"node:os";import{join as Ac}from"node:path";var Wc=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),Rc=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([])})})}),Kc={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}},sources:{failClosed:[],paranoidRm:[],paranoidInterpreters:[],worktreeMode:[]}};function B0(){let n=Ac(Hc(),"cc-safety-net-self-test"),t=Wc.map((r)=>{let e=Wn(V2("self-test",{command:r.command},{kind:"command",shell:"auto"},{configCwd:n,executionCwd:n},r.command),{guard:{dependencies:{loadPolicySnapshot:()=>Rc,getModes:()=>Kc,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),a=r.expectBlocked?"blocked":"allowed",l=e.decision.kind==="deny"?"blocked":"allowed";return{command:r.command,description:r.description,expected:a,actual:l,passed:a===l,reason:e.decision.kind==="deny"?e.decision.reason:void 0,ruleId:e.decision.kind==="deny"?e.decision.ruleId:void 0}});return{passed:t.filter((r)=>r.passed).length,failed:t.filter((r)=>!r.passed).length,total:t.length,results:t}}function Kr(n){let t=F({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},n);if(e2(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function J0(n={}){let t=await On(!n.json,()=>{let r=Mc(n);return{ready:r,finish:()=>r}},()=>Un(),{loadingMessage:"Checking system status…"});if(n.json)console.log(JSON.stringify(t,null,2));else Gc(t);return Vc(t.hooks,t.engineSelfTest,{userConfig:t.userConfig,projectConfig:t.projectConfig})?1:0}async function Mc(n){let t=n.cwd??process.cwd(),r=await xn(),e=tn(t,{ampPluginListOutput:r.ampPluginListOutput,codexPluginListOutput:r.codexPluginListOutput,copilotCliVersion:r.copilotCliVersion}),a=I1(t),l=N1(),d=W({cwd:t}),s=d.policy,L=d2(s),c=g2(s,L.capabilities),i=Vn(7),u=n.skipUpdateCheck?{currentVersion:j(),latestVersion:null,updateAvailable:!1}:await _2(),v={hooks:e,engineSelfTest:B0(),userConfig:a.userConfig,projectConfig:a.projectConfig,configState:fn(d),effectiveRules:a.effectiveRules,shadowedRules:a.shadowedRules,environment:l,effectiveSafety:{selectedPreset:s.safety.level??"standard",level:L.effectiveLevel,capabilities:L.capabilities,ruleOverrides:s.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(c).filter(([,p])=>p.source==="rule_override"&&p.override==="off"&&p.inheritedEnabled&&p.changesInherited).map(([p])=>p),ruleCounts:{stored:Object.keys(s.destructiveCommandRuleOverrides).length,effective:Object.values(c).filter((p)=>p.changesInherited).length}},posture:oa(a.userConfig.path),activity:i,update:u,system:r};return{...v,findings:ta(v)}}function Vc(n,t,r){return n.length>0&&n.every((e)=>!e.configured)||n.some((e)=>e.inspectionStatus==="failed")||t.failed>0||r.userConfig.exists&&!r.userConfig.valid||r.projectConfig.exists&&!r.projectConfig.valid}function Gc(n){console.log(),console.log(ea(n.hooks)),console.log(),console.log(aa(n.engineSelfTest)),console.log(),console.log(la(n)),console.log(),console.log(da(n.environment)),console.log(),console.log(sa(n)),console.log(),console.log(La(n.findings)),console.log(),console.log(ca(n.activity)),console.log(),console.log(pa(n.system)),console.log(),console.log(ia(n.update)),console.log(ua(n))}import{existsSync as Cc}from"node:fs";var Uc=/^[A-Za-z0-9_@%+=:,./-]+$/,Z0="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function Mr(n){let t=F({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},n);if(e2(t.errors))return console.error(Z0),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!Cc(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let r=t.positionals.length===1?t.positionals[0]:t.positionals.map((e)=>Uc.test(e)?e:`'${e.replaceAll("'","'\\''")}'`).join(" ");if(!r)return console.error("Error: No command provided"),console.error(Z0),null;return{json:t.flags.json,cwd:t.values.cwd,command:r}}function Q0(n){if(n)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function X0(n,t){let e=t-18;return[`${n.dtl}${n.dh.repeat(t)}${n.dtr}`,`${n.dv}  Command Analysis${" ".repeat(e)}${n.dv}`,`${n.dbl}${n.dh.repeat(t)}${n.dbr}`]}function Vr(n){return JSON.stringify(n)}function Y0(n,t=0){return`[${n.map((e,a)=>ra(e,a,t)).join(",")}]`}function lt(n,t,r=70){let e=n.split(" "),a=[],l="";for(let d of e)if(l&&l.length+d.length+1>r)a.push(l),l=d;else l=l?`${l} ${d}`:d;if(l)a.push(l);return a.map((d,s)=>s===0?d:`${t}${d}`)}function S0(n,t,r){let e=[];switch(n.type){case"parse":return null;case"env-strip":{e.push(""),e.push(`STEP ${t} ${r.h} Strip environment variables`);let a=Object.keys(n.envVars);return e.push(`  Removed: ${a.map((l)=>`${l}=<redacted>`).join(", ")}`),e.push(`  Tokens:  ${Vr(n.output)}`),{lines:e,incrementStep:!0}}case"leading-tokens-stripped":return e.push(""),e.push(`STEP ${t} ${r.h} Strip wrappers`),e.push(`  Removed: ${n.removed.join(", ")}`),e.push(`  Tokens:  ${Vr(n.output)}`),{lines:e,incrementStep:!0};case"shell-wrapper":return e.push(""),e.push(`STEP ${t} ${r.h} Detect shell wrapper`),e.push(`  Wrapper: ${n.wrapper} -c`),e.push(`  Inner:   ${n.innerCommand}`),{lines:e,incrementStep:!0};case"interpreter":{if(e.push(""),e.push(`STEP ${t} ${r.h} Detect interpreter`),e.push(`  Interpreter: ${n.interpreter}`),e.push(`  Code:        ${n.codeArg}`),n.paranoidBlocked)e.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:e,incrementStep:!0}}case"busybox":return e.push(""),e.push(`STEP ${t} ${r.h} Busybox wrapper`),e.push(`  Subcommand: ${n.subcommand}`),{lines:e,incrementStep:!0};case"transparent-wrapper":return e.push(""),e.push(`STEP ${t} ${r.h} Transparent wrapper`),e.push(`  Wrapper: ${n.wrapper}`),e.push(`  Tokens:  ${Vr(n.output)}`),{lines:e,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{e.push(""),e.push(`STEP ${t} ${r.h} Match rules`);let a=`${n.ruleModule}:${n.ruleFunction}()`;if(e.push(`  Rule:   ${a}`),n.matched)e.push("  Result: MATCHED");else e.push("  Result: No match");return{lines:e,incrementStep:!0}}case"worktree-relaxation":return e.push(""),e.push(`STEP ${t} ${r.h} Worktree relaxation`),e.push(`  Mode:   ${m.worktree.name}`),e.push(`  Git cwd: ${n.gitCwd}`),e.push("  Result: Allowed local discard in linked worktree"),{lines:e,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(n.embeddedCommandFound)return e.push(""),e.push(`STEP ${t} ${r.h} Fallback scan`),e.push(`  Found: ${n.embeddedCommandFound}`),{lines:e,incrementStep:!0};return null}case"custom-rules-check":{if(n.rulesChecked){if(e.push(""),e.push(`STEP ${t} ${r.h} Custom rules`),n.matched)e.push("  Result: MATCHED");else e.push("  Result: No match");return{lines:e,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(n.matched)return e.push(""),e.push(`STEP ${t} ${r.h} Dangerous text check`),e.push(`  Token:  ${n.token}`),e.push("  Result: MATCHED"),{lines:e,incrementStep:!0};return null}case"strict-unparseable":return e.push(""),e.push(`STEP ${t} ${r.h} Strict mode check`),e.push(`  Command: ${n.rawCommand}`),e.push("  Result:  ✗ UNPARSEABLE"),{lines:e,incrementStep:!0};case"segment-skipped":return null;case"error":return e.push(""),e.push(`ERROR: ${n.message}`),{lines:e,incrementStep:!1};default:return null}}function Gr(n,t){let r=Q0(t?.asciiOnly??!1),e=58,a=[],l=1;a.push(...X0(r,58)),a.push("");let d=n.trace.steps.find((p)=>p.type==="error");if(d&&d.type==="error"){a.push("ERROR"),a.push(`  ${d.message}`),a.push(""),a.push("RESULT"),a.push(`  Status: ${n.result==="blocked"?b.red("BLOCKED"):b.green("ALLOWED")}`),a.push(""),a.push("CONFIG");let p=n.configSource??"none";return a.push(`  Path: ${p}`),a.join(`
-`)}let s=n.trace.steps.find((p)=>p.type==="parse");if(s&&s.type==="parse"){a.push("INPUT"),a.push(`  ${s.input}`),a.push(""),a.push(`STEP ${l} ${r.h} Split shell commands`),l++;for(let p=0;p<s.segments.length;p++){let f=s.segments[p];if(f){let o=Math.random();a.push(`  Segment ${p+1}: ${Y0(f,o)}`)}}}let L=n.trace.segments,c=L.length>1;for(let p of L){if(c){a.push("");let x="";if(s&&s.type==="parse"){let kt=s.segments[p.index];if(kt)x=kt.join(" ")}let w=54,h=x,J=` Segment ${p.index+1}: `,Q2=" ";if(x){if(J.length+x.length+Q2.length>w){let Q3=w-J.length-Q2.length;h=`${x.substring(0,Q3-1)}…`}}let ln=x?`${J}${h}${Q2}`:` Segment ${p.index+1} `,mt=x?`${J}${b.cyan(h)}${Q2}`:ln,we=58-ln.length,xe=Math.floor(we/2),Z3=we-xe;a.push(`${r.sh.repeat(xe)}${mt}${r.sh.repeat(Z3)}`)}if(p.steps.find((x)=>x.type==="segment-skipped")){a.push(""),a.push("  (skipped — prior segment blocked)");continue}let o=!1,y=!1;for(let x of p.steps){let w=S0(x,l,r);if(w){if(y=!0,x.type==="recurse"){a.push("");let h=" RECURSING ",J=58-h.length-4;a.push(`  ${r.tl}${r.h}${h}${r.h.repeat(J)}`),a.push(`  ${r.v}`),o=!0;continue}for(let h of w.lines)if(o)a.push(`  ${r.v} ${h}`);else a.push(h);if(w.incrementStep)l++}}if(o)a.push(`  ${r.v}`),a.push(`  ${r.bl}${r.h.repeat(56)}`),o=!1;if(!y)a.push(""),a.push(`  ${b.green("✓")} Allowed (no matching rules)`)}if(a.push(""),a.push("RESULT"),n.result==="blocked"){if(a.push(`  Status: ${b.red("BLOCKED")}`),n.customRule){if(a.push(`  Rule: ${n.customRule.id}`),n.customRule.rulebook)a.push(`  Rulebook: ${n.customRule.rulebook.name} ${n.customRule.rulebook.version}`);if(n.customRule.source)a.push(`  Source: ${n.customRule.source}`);if(n.customRule.override)a.push(`  Override: reason ${n.customRule.override.reason}`)}if(n.reason){let p=lt(n.reason,"          ");a.push(`  Reason: ${p[0]}`);for(let f=1;f<p.length;f++)a.push(p[f]??"")}}else a.push(`  Status: ${b.green("ALLOWED")}`);a.push(""),a.push("CONFIG");let i=n.configSource??"none",u=n.configValid?"":" (invalid)";a.push(`  Path: ${i}${u}`),a.push(`  Safety preset: ${n.selectedPreset??"standard"}`),a.push(`  Effective capabilities: ${n.effectiveLevel}`);let v=Object.entries(n.destructiveCommandRuleOverrides??{});if(a.push(`  Rule customizations: ${v.length}`),n.ruleActivation)a.push(`  Rule activation: ${n.ruleActivation.id} — ${n.ruleActivation.enabled?"on":"off"} via ${n.ruleActivation.source}`);return a.join(`
-`)}function Cr(n){return JSON.stringify(n,null,2)}var H0="2.0.4",G="  ",z2="cc-safety-net";function A0(n){return n.argument?`${n.flags} ${n.argument}`:n.flags}function Oc(n){return Math.max(...n.map((t)=>A0(t).length))}function Tc(n){return Math.max(...n.map((t)=>t.usage.length))}function Ec(n){return Math.max(...n.map((t)=>`${z2} ${t.usage}`.length))}function _c(n,t){let r=`${z2} ${n.usage}`;return`${G}${r.padEnd(t+2)}${n.description}`}function i2(n,t){return`${G}${n.padEnd(Math.max(40,n.length+2))}${t}`}function dt(n,t=console.log){let r=[];if(r.push(`${z2} ${n.name}`),r.push(""),r.push(`${G}${n.description}`),r.push(""),r.push("USAGE:"),r.push(`${G}${z2} ${n.usage}`),r.push(""),n.subcommands&&n.subcommands.length>0){r.push("SUBCOMMANDS:");let e=Tc(n.subcommands);for(let a of n.subcommands)r.push(`${G}${a.usage.padEnd(e+2)}${a.description}`);r.push("")}if(n.options.length>0){r.push("OPTIONS:");let e=Oc(n.options);for(let a of n.options){let l=A0(a),d=a.default?`${a.description} (default: ${a.default})`:a.description;r.push(`${G}${l.padEnd(e+2)}${d}`)}r.push("")}if(n.examples&&n.examples.length>0){r.push("EXAMPLES:");for(let e of n.examples)r.push(`${G}${e}`)}t(r.join(`
-`))}function Ur(){let n=_1(),t=Ec(n),r=[];r.push(`${z2} v${H0}`),r.push(""),r.push("Blocks destructive commands and secret access."),r.push(""),r.push("COMMANDS:");for(let e of n)r.push(_c(e,t));r.push(""),r.push("GLOBAL OPTIONS:"),r.push(`${G}-h, --help       Show help (use with command for command-specific help)`),r.push(`${G}-V, --version    Show version`),r.push(""),r.push("HELP:"),r.push(`${G}${z2} help <command>     Show help for a specific command`),r.push(`${G}${z2} <command> --help   Show help for a specific command`),r.push(""),r.push("ENVIRONMENT VARIABLES:"),r.push(i2(`${m.level.name}=standard|strict|paranoid`,"Set session safety level")),r.push(i2(`${m.worktree.name}=1`,"Allow local git discards in linked worktrees")),r.push(i2(`${m.debug.name}=1`,"Print diagnostic messages to stderr")),r.push(i2(`${m.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),r.push(i2("CC_SAFETY_NET_HOME","Override rule config home directory")),r.push(""),r.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),r.push(i2(`${m.strict.name}=1`,"Force safety.overrides.fail_closed on")),r.push(i2(`${m.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),r.push(i2(`${m.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),r.push(i2(`${m.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),r.push(""),r.push("Documentation:        https://ccsafetynet.com/docs"),console.log(r.join(`
-`))}function W0(){console.log(H0)}function zn(n,t=console.log){let r=Mn(n);if(!r)return!1;if(r.hidden||r.name.toLowerCase()!==n.toLowerCase())return!1;return dt(r,t),!0}import{existsSync as Le,readFileSync as Kl}from"node:fs";import{homedir as Ei}from"node:os";import{join as de}from"node:path";import*as y2 from"node:readline";function Pc(n){return n==="install"?"Install":"Uninstall"}function Ic(n){return n==="install"?"Installing":"Uninstalling"}function Nc(n){return n==="install"?"into":"from"}function M0(n){return n?.available===!0}function ni(n,t){let r=new Set(t);return n.filter((e)=>r.has(e.target)).map((e)=>e.target)}function R0(n,t,r){if(n.length===0||n.every((e)=>!e.available))return t;return Array.from({length:n.length},(e,a)=>a+1).map((e)=>(t+e*r+n.length)%n.length).find((e)=>M0(n[e]))}function ti(n,t,r){if(r.ctrl&&r.name==="c")return"interrupt";if(r.name==="escape"||t==="q")return"abort";if(n==="install"&&(t==="u"||t==="U"))return"update";if(r.name==="up"||t==="k")return"up";if(r.name==="down"||t==="j")return"down";if(r.name==="space"||t===" ")return"toggle";if(r.name==="return"||r.name==="enter")return"confirm";return null}function ri(n){return{cursor:n.findIndex((t)=>t.available),selected:[]}}function ei(n,t,r){if(r==="confirm"||r==="update"||r==="abort"||r==="interrupt")return{state:n,done:r};if(r==="up")return{state:{...n,cursor:R0(t,n.cursor,-1)}};if(r==="down")return{state:{...n,cursor:R0(t,n.cursor,1)}};let e=t[n.cursor];if(!M0(e))return{state:n};let a=n.selected.includes(e.target)?n.selected.filter((l)=>l!==e.target):ni(t,[...n.selected,e.target]);return{state:{...n,selected:a}}}var V0="◉",G0="◯",C0=">",U0=" ";function ai(n,t,r,e={}){let a=e.color!==!1,l=a?b.dim:(L)=>L,d=a?b.green:(L)=>L,s=a?b.bold:(L)=>L;return["",`${Pc(n)} CC Safety Net ${Nc(n)}:`,"",...t.map((L,c)=>{let i=r.selected.includes(L.target),u=c===r.cursor,v=i?V0:G0,p=u?C0:U0,f=L.available?"":` (${L.unavailableReason??"not installed"})`,o=`${v} ${L.label}${f}`,y=!L.available?l(o):i?d(o):u?s(o):o;return`${p} ${y}`}),"",n==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":t.some((L)=>L.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${n}. q/Esc: close`].join(`
-`)}var K0=["global-hook","plugin"];function li(n,t,r={}){let e=r.color!==!1?b.bold:(l)=>l;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((l,d)=>{let s=d===n,L=`${s?V0:G0} ${l}`;return`${s?C0:U0} ${s?e(L):L}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`
-`)}function O0(n){let{input:t,output:r}=n;y2.emitKeypressEvents(t);let e=t.isRaw===!0;t.setRawMode(!0),t.resume();let a=0,l=()=>{if(a===0)return;y2.moveCursor(r,0,-a),y2.cursorTo(r,0),y2.clearScreenDown(r)},d=()=>{l();let s=n.render();r.write(`${s}
+`}function jn(n){return[{name:"__init__.py",content:ri(n)},{name:"plugin.yaml",content:ei(n)}]}import{mkdirSync as ai,readdirSync as li,readFileSync as di,rmSync as Fe}from"node:fs";import{join as q2}from"node:path";var si="__pycache__";function ze(n){let t=process.env.HERMES_HOME?.trim();return t?t:q2(n,".hermes")}function Be(n){return q2(ze(n),"plugins",M)}function Je(n){return n.startsWith(t0)}function Ze(n,t){let e=Be(n),r=S(e);if(r&&(r.isSymbolicLink()||!r.isDirectory()))throw Error(`Refusing to ${t} ${e}: not a regular directory. Move or remove it and rerun ${t==="install"?"install":"uninstall"} --hermes-agent.`);return e}function r0(n,t){let e=S(n);if(!e)return;if(e.isSymbolicLink()||!e.isFile())throw Error(`Refusing to ${t} ${n}: not a regular file. Move or remove it.`);let r=di(n,"utf-8");if(!Je(r))throw Error(`Refusing to ${t} unmanaged file at ${n}. Move or remove it.`);return r}function a0(n){let t=Ze(n,"install"),e=jn(j());if(e.map((a)=>r0(q2(t,a.name),"overwrite")).every((a,l)=>a===e[l]?.content))return{path:t,alreadyInstalled:!0};return ai(t,{recursive:!0}),e.forEach((a)=>{B(q2(t,a.name),a.content)}),{path:t,alreadyInstalled:!1}}function Qe(n){let t=Ze(n,"remove");if(!S(t))return[];return jn(j()).filter((e)=>r0(q2(t,e.name),"remove")!==void 0)}function l0(n){let t=Ze(n,"remove");if(!S(t))return{path:t,alreadyInstalled:!1};let e=Qe(n);if(e.forEach((r)=>{Fe(q2(t,r.name))}),Fe(q2(t,si),{recursive:!0,force:!0}),li(t).length===0)Fe(t,{recursive:!0});return{path:t,alreadyInstalled:e.length>0}}var rt="hermes-agent",d0=/^([^\s#][^:]*):/,ci=/^\s+([A-Za-z_][\w-]*):/,s0=/^\s+-\s*(.*)$/;function ii(n){return n.trim().replace(/^(["'])(.*)\1$/,"$2")}function Li(n){let t=n.split(/\r?\n/),e=t.findIndex((l)=>d0.exec(l)?.[1]?.trim()==="plugins");if(e===-1)return[];let r=t.slice(e+1),a=r.findIndex((l)=>d0.test(l));return a===-1?r:r.slice(0,a)}function c0(n,t){let e=Li(n),r=e.findIndex((d)=>ci.exec(d)?.[1]===t);if(r===-1)return[];let a=e.slice(r+1),l=a.findIndex((d)=>!s0.test(d));return(l===-1?a:a.slice(0,l)).map((d)=>ii(s0.exec(d)?.[1]??""))}function pi(n){try{return i0(L0(ze(n),"config.yaml"),"utf-8")}catch{return}}function Xe(n){let t=pi(n)??"";return c0(t,"enabled").includes(M)&&!c0(t,"disabled").includes(M)}function p0(n){return/^# version:\s*(.+)$/m.exec(n)?.[1]?.trim()}function ui(n,t){let e=S(n);if(!e)return{error:`${t.name} is missing from ${n}; run install --hermes-agent`};if(e.isSymbolicLink()||!e.isFile())return{error:`${n} is a symlink or not a regular file; move or remove it`};try{let r=i0(n,"utf-8");if(!Je(r))return{error:`Unmanaged ${t.name} occupies ${n}; move or remove it`};if(p0(r)===j()&&r!==t.content)return{error:`Modified ${t.name} occupies ${n}; run install --hermes-agent to restore it`};return{content:r}}catch(r){return{error:`Failed to read ${n}: ${r instanceof Error?r.message:String(r)}`}}}function u0(n){let t=Be(n.homeDir),e=En(rt,t);if(e)return e;let r=jn(j()).map((s)=>ui(L0(t,s.name),s)),a=r.flatMap((s)=>("error"in s)?[s.error]:[]);if(a.length>0)return{platform:rt,status:"n/a",configPath:t,errors:a};let l=r.some((s)=>("content"in s)&&p0(s.content)!==j()),d=l?["Installed Hermes Agent plugin is outdated; run install --hermes-agent to update"]:[];if(!Xe(n.homeDir))return{platform:rt,status:"disabled",method:"plugin directory",configPath:t,errors:[`${M} is not enabled in Hermes; run \`hermes plugins enable ${M}\``,...d]};return{platform:rt,status:"configured",method:"plugin directory",configPath:t,errors:l?d:void 0}}import{existsSync as oi,readFileSync as vi}from"node:fs";import{join as o0}from"node:path";var bi=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*--kimi-code(\s|["']|$)/;function fi(n){return o0(process.env.KIMI_CODE_HOME||o0(n,".kimi-code"),"config.toml")}function Fn(n){let t=fi(n.homeDir);if(!oi(t))return{platform:"kimi-code",status:"n/a",configPath:t};try{if(!bi.test(vi(t,"utf-8")))return{platform:"kimi-code",status:"n/a",configPath:t}}catch(e){return{platform:"kimi-code",status:"n/a",configPath:t,errors:[`Failed to read ${t}: ${e instanceof Error?e.message:String(e)}`]}}return{platform:"kimi-code",status:"configured",method:"hook config",configPath:t}}import{readFileSync as D0}from"node:fs";import{join as Bn}from"node:path";var q="cc-safety-net",V="index.js",I2="openclaw.plugin.json",N2="package.json";var at="// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw";import{existsSync as wi,lstatSync as xi,readdirSync as $i,readFileSync as gi}from"node:fs";import{dirname as f0,join as j2}from"node:path";import{fileURLToPath as Di}from"node:url";import{spawn as hi}from"node:child_process";function yi(n){return n.join(" ")}function Ye(n,t,e){return[`Failed to run ${yi(n)}${t===null?"":` (exit ${t})`}.`,e.trim()].filter(Boolean).join(`
+`)}function Se(n){let t={stdout:"",stderr:""};return n.stdout.setEncoding("utf-8"),n.stderr.setEncoding("utf-8"),n.stdout.on("data",(e)=>{t.stdout+=e}),n.stderr.on("data",(e)=>{t.stderr+=e}),t}function e2(n,t){return new Promise((e,r)=>{let a=f2([...n],process.env),l=hi(a.cmd,a.args,{stdio:["ignore","pipe","pipe"]}),d=Se(l),s=()=>[d.stdout,d.stderr].filter(Boolean).join(`
+`),c=t?.timeoutMs??120000,i=setTimeout(()=>{l.kill(),r(Error(Ye(n,null,`Timed out after ${c}ms.
+${s()}`.trim())))},c);l.on("error",(L)=>{clearTimeout(i),r(Error(Ye(n,null,`${L.message}
+${s()}`.trim())))}),l.on("close",(L)=>{if(clearTimeout(i),L!==0){r(Error(Ye(n,L,s())));return}e(t?.stdoutOnly?d.stdout:s())})})}async function He(n){for(let t of n)await e2(t)}async function v0(n){for(let t of n)try{await e2(t)}catch(e){console.warn(e instanceof Error?e.message:String(e))}}var b0=j2("openclaw",q),mi=[V,I2,N2];function h0(n){let t=process.env.OPENCLAW_STATE_DIR?.trim();if(t)return t;let e=process.env.OPENCLAW_CONFIG_PATH?.trim();return e?f0(e):j2(n,".openclaw")}function y0(n){let t=process.env.OPENCLAW_CONFIG_PATH?.trim();return t?t:j2(h0(n),"openclaw.json")}function Ae(n){return j2(h0(n),"extensions",q)}function ki(n){let t=$i(n);if(t.length===0)return!0;if(t.some((a)=>!mi.includes(a)))return!1;let e=j2(n,V),r=S(e);return r!==void 0&&!r.isSymbolicLink()&&r.isFile()&&gi(e,"utf-8").startsWith(at)}function We(n){let t=Ae(n),e=S(t);if(!e)return;if(!e.isSymbolicLink()&&e.isDirectory()&&ki(t))return;throw Error(`Refusing to modify ${t}: it does not hold a cc-safety-net managed OpenClaw plugin. Move or remove it, then run the command again.`)}function w0(){let n=f0(Di(import.meta.url));return[j2(n,"..",b0),j2(n,"..","..","..","dist",b0)]}function Re(n=w0()){return n.find((t)=>wi(t)&&xi(t).isDirectory())}function qi(n=w0()){let t=Re(n);if(!t)throw Error("Packaged OpenClaw plugin directory not found. Reinstall cc-safety-net and try again.");return t}function x0(n=qi()){return[["openclaw","plugins","install",n,"--force"],["openclaw","plugins","enable",q]]}function ji(n){let t=(()=>{try{return JSON.parse(n)}catch{return}})(),e=$($(t,"plugin"),"status");return typeof e==="string"?e:void 0}async function $0(){let n=ji(await e2(["openclaw","plugins","inspect",q,"--runtime","--json"],{stdoutOnly:!0}));if(n==="loaded")return;throw Error(`${n===void 0?`The ${q} plugin's load state could not be verified: OpenClaw's runtime inspect report was unreadable.`:`OpenClaw reports the ${q} plugin with status "${n}".`} Run \`openclaw plugins inspect ${q} --runtime\` for details.`)}var lt="openclaw",zn=`run \`openclaw plugins enable ${q}\``;function nn(n,t){let e=Bn(n,t),r=S(e);if(!r)return{error:`${t} is missing from ${e}; run install --openclaw`};if(r.isSymbolicLink()||!r.isFile())return{error:`${e} is a symlink or not a regular file; move or remove it`};try{return{content:D0(e,"utf-8")}}catch(a){return{error:`Failed to read ${e}: ${a instanceof Error?a.message:String(a)}`}}}function m0(n){try{return JSON.parse(R(n))}catch{return}}function Fi(n){let t=nn(n,I2);if("error"in t)return t.error;if($(m0(t.content),"id")===q)return;return`${Bn(n,I2)} is not a valid ${q} manifest; run install --openclaw`}function zi(n){let t=nn(n,N2);if("error"in t)return t.error;let e=$($(m0(t.content),"openclaw"),"extensions");if(Array.isArray(e)&&e.includes(`./${V}`))return;return`${Bn(n,N2)} does not point OpenClaw at ${V}; run install --openclaw`}function g0(n){return Array.isArray(n)?n.filter((t)=>typeof t==="string"):[]}function Bi(n){let t=y0(n);if(!S(t))return`${q} is not enabled; ${zn}`;let e=(()=>{try{return JSON.parse(R(D0(t,"utf-8")))}catch{return}})();if(e===void 0)return`Failed to read ${t}; fix it, then ${zn}`;let r=$(e,"plugins");if($(r,"enabled")===!1)return`plugins.enabled is false in ${t}; no OpenClaw plugin loads`;let a=$($($(r,"entries"),q),"enabled");if(g0($(r,"deny")).includes(q)||a===!1)return`${q} is disabled in ${t}; ${zn}`;let l=g0($(r,"allow"));if(l.length>0&&!l.includes(q))return`plugins.allow in ${t} does not list ${q}; add it, then ${zn}`;if(l.includes(q)||a===!0)return;return`${q} is not enabled; ${zn}`}function k0(n){return/^\/\/ version:\s*(.+)$/m.exec(n)?.[1]?.trim()}function Ji(n,t,e){if(e===void 0)return[];let r=nn(e,V);if("error"in r||k0(r.content)!==t)return[];return[V,I2,N2].flatMap((a)=>{let l=nn(n,a),d=nn(e,a);if("error"in l||"error"in d||l.content===d.content)return[];return[`Modified ${a} occupies ${Bn(n,a)}; run install --openclaw to restore it`]})}function q0(n){let t=Ae(n.homeDir),e=En(lt,t);if(e)return e;let r=nn(t,V),l=["error"in r?r.error:r.content.startsWith(at)?void 0:`Unmanaged ${V} occupies ${Bn(t,V)}; move or remove it`,Fi(t),zi(t)].filter((L)=>L!==void 0),d="content"in r?k0(r.content):void 0,s=l.length>0?l:Ji(t,d,Re());if(s.length>0)return{platform:lt,status:"n/a",configPath:t,errors:s};let c=d===j()?[]:["Installed OpenClaw plugin is outdated; run install --openclaw to update"],i=Bi(n.homeDir);if(i)return{platform:lt,status:"disabled",method:"plugin directory",configPath:t,errors:[i,...c]};return{platform:lt,status:"configured",method:"plugin directory",configPath:t,errors:c.length>0?c:void 0}}import{existsSync as Zi,readFileSync as Qi}from"node:fs";import{join as j0}from"node:path";function F0(n){let t=[],e=j0(n.homeDir,".config","opencode"),r=["opencode.json","opencode.jsonc"];for(let a of r){let l=j0(e,a);if(Zi(l))try{let d=Qi(l,"utf-8"),s=R(d);if((JSON.parse(s).plugin??[]).some((u)=>u.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:l,errors:t.length>0?t:void 0}}catch(d){t.push(`Failed to parse ${a}: ${d instanceof Error?d.message:String(d)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as Xi}from"node:path";function Ke(n){return Xi(n,".pi","agent","settings.json")}function Me(n){if(typeof n!=="string")return!1;return n==="npm:cc-safety-net"||n.startsWith("npm:cc-safety-net@")}function z0(n){let t=Ke(n.homeDir),e=n2(t);if(e.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(e.kind==="missing")return{platform:"pi",status:"n/a"};let r=$(e.value,"packages");if(!Array.isArray(r))return{platform:"pi",status:"n/a"};let a=r.find((s)=>Me(typeof s==="string"?s:$(s,"source")));if(a===void 0)return{platform:"pi",status:"n/a"};let l=$(a,"extensions");if(Array.isArray(l)&&l.some((s)=>typeof s==="string"&&s.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var Si={amp:Fa,"antigravity-cli":za,"claude-code":Qa,codex:Xa,"copilot-cli":Ca,cursor:Na,"gemini-cli":n0,"hermes-agent":u0,"kimi-code":Fn,openclaw:q0,opencode:F0,pi:z0};function tn(n,t){let e={...t,cwd:n,homeDir:t?.homeDir??Yi()};return j1.map((r)=>Hi(Si[r](e)))}function Hi(n){if(n.status==="not-inspected")return{platform:n.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:n.platform,detected:n.status!=="n/a",configured:n.status==="configured",inspectionStatus:n.status!=="n/a"?"verified":n.errors&&n.errors.length>0?"failed":"not-applicable",method:n.method,configPath:n.configPath,configPaths:n.configPaths,errors:n.errors}}import{tmpdir as Ai}from"node:os";import{join as Wi}from"node:path";var Ri=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),Ki=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),Mi={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}},sources:{failClosed:[],paranoidRm:[],paranoidInterpreters:[],worktreeMode:[]}};function B0(){let n=Wi(Ai(),"cc-safety-net-self-test"),t=Ri.map((e)=>{let r=Kn(M2("self-test",{command:e.command},{kind:"command",shell:"auto"},{configCwd:n,executionCwd:n},e.command),{guard:{dependencies:{loadPolicySnapshot:()=>Ki,getModes:()=>Mi,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),a=e.expectBlocked?"blocked":"allowed",l=r.decision.kind==="deny"?"blocked":"allowed";return{command:e.command,description:e.description,expected:a,actual:l,passed:a===l,reason:r.decision.kind==="deny"?r.decision.reason:void 0,ruleId:r.decision.kind==="deny"?r.decision.ruleId:void 0}});return{passed:t.filter((e)=>e.passed).length,failed:t.filter((e)=>!e.passed).length,total:t.length,results:t}}function Ve(n){let t=F({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},n);if(r2(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function J0(n={}){let t=await Dn(!n.json,()=>{let e=Vi(n);return{ready:e,finish:()=>e}},()=>gn(),{loadingMessage:"Checking system status…"});if(n.json)console.log(JSON.stringify(t,null,2));else Ci(t);return Gi(t.hooks,t.engineSelfTest,{userConfig:t.userConfig,projectConfig:t.projectConfig})?1:0}async function Vi(n){let t=n.cwd??process.cwd(),e=await xn(),r=tn(t,{ampPluginListOutput:e.ampPluginListOutput,codexPluginListOutput:e.codexPluginListOutput,copilotCliVersion:e.copilotCliVersion}),a=I1(t),l=N1(),d=W({cwd:t}),s=d.policy,c=d2(s),i=g2(s,c.capabilities),L=Cn(7),u=n.skipUpdateCheck?{currentVersion:j(),latestVersion:null,updateAvailable:!1}:await E2(),v={hooks:r,engineSelfTest:B0(),userConfig:a.userConfig,projectConfig:a.projectConfig,configState:fn(d),effectiveRules:a.effectiveRules,shadowedRules:a.shadowedRules,environment:l,effectiveSafety:{selectedPreset:s.safety.level??"standard",level:c.effectiveLevel,capabilities:c.capabilities,ruleOverrides:s.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(i).filter(([,p])=>p.source==="rule_override"&&p.override==="off"&&p.inheritedEnabled&&p.changesInherited).map(([p])=>p),ruleCounts:{stored:Object.keys(s.destructiveCommandRuleOverrides).length,effective:Object.values(i).filter((p)=>p.changesInherited).length}},posture:oa(a.userConfig.path),activity:L,update:u,system:e};return{...v,findings:ta(v)}}function Gi(n,t,e){return n.length>0&&n.every((r)=>!r.configured)||n.some((r)=>r.inspectionStatus==="failed")||t.failed>0||e.userConfig.exists&&!e.userConfig.valid||e.projectConfig.exists&&!e.projectConfig.valid}function Ci(n){console.log(),console.log(ra(n.hooks)),console.log(),console.log(aa(n.engineSelfTest)),console.log(),console.log(la(n)),console.log(),console.log(da(n.environment)),console.log(),console.log(sa(n)),console.log(),console.log(ca(n.findings)),console.log(),console.log(ia(n.activity)),console.log(),console.log(pa(n.system)),console.log(),console.log(La(n.update)),console.log(ua(n))}import{existsSync as Ui}from"node:fs";var Oi=/^[A-Za-z0-9_@%+=:,./-]+$/,Z0="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function Ge(n){let t=F({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},n);if(r2(t.errors))return console.error(Z0),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!Ui(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let e=t.positionals.length===1?t.positionals[0]:t.positionals.map((r)=>Oi.test(r)?r:`'${r.replaceAll("'","'\\''")}'`).join(" ");if(!e)return console.error("Error: No command provided"),console.error(Z0),null;return{json:t.flags.json,cwd:t.values.cwd,command:e}}function Q0(n){if(n)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function X0(n,t){let r=t-18;return[`${n.dtl}${n.dh.repeat(t)}${n.dtr}`,`${n.dv}  Command Analysis${" ".repeat(r)}${n.dv}`,`${n.dbl}${n.dh.repeat(t)}${n.dbr}`]}function Ce(n){return JSON.stringify(n)}function Y0(n,t=0){return`[${n.map((r,a)=>ea(r,a,t)).join(",")}]`}function dt(n,t,e=70){let r=n.split(" "),a=[],l="";for(let d of r)if(l&&l.length+d.length+1>e)a.push(l),l=d;else l=l?`${l} ${d}`:d;if(l)a.push(l);return a.map((d,s)=>s===0?d:`${t}${d}`)}function S0(n,t,e){let r=[];switch(n.type){case"parse":return null;case"env-strip":{r.push(""),r.push(`STEP ${t} ${e.h} Strip environment variables`);let a=Object.keys(n.envVars);return r.push(`  Removed: ${a.map((l)=>`${l}=<redacted>`).join(", ")}`),r.push(`  Tokens:  ${Ce(n.output)}`),{lines:r,incrementStep:!0}}case"leading-tokens-stripped":return r.push(""),r.push(`STEP ${t} ${e.h} Strip wrappers`),r.push(`  Removed: ${n.removed.join(", ")}`),r.push(`  Tokens:  ${Ce(n.output)}`),{lines:r,incrementStep:!0};case"shell-wrapper":return r.push(""),r.push(`STEP ${t} ${e.h} Detect shell wrapper`),r.push(`  Wrapper: ${n.wrapper} -c`),r.push(`  Inner:   ${n.innerCommand}`),{lines:r,incrementStep:!0};case"interpreter":{if(r.push(""),r.push(`STEP ${t} ${e.h} Detect interpreter`),r.push(`  Interpreter: ${n.interpreter}`),r.push(`  Code:        ${n.codeArg}`),n.paranoidBlocked)r.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:r,incrementStep:!0}}case"busybox":return r.push(""),r.push(`STEP ${t} ${e.h} Busybox wrapper`),r.push(`  Subcommand: ${n.subcommand}`),{lines:r,incrementStep:!0};case"transparent-wrapper":return r.push(""),r.push(`STEP ${t} ${e.h} Transparent wrapper`),r.push(`  Wrapper: ${n.wrapper}`),r.push(`  Tokens:  ${Ce(n.output)}`),{lines:r,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{r.push(""),r.push(`STEP ${t} ${e.h} Match rules`);let a=`${n.ruleModule}:${n.ruleFunction}()`;if(r.push(`  Rule:   ${a}`),n.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}case"worktree-relaxation":return r.push(""),r.push(`STEP ${t} ${e.h} Worktree relaxation`),r.push(`  Mode:   ${m.worktree.name}`),r.push(`  Git cwd: ${n.gitCwd}`),r.push("  Result: Allowed local discard in linked worktree"),{lines:r,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(n.embeddedCommandFound)return r.push(""),r.push(`STEP ${t} ${e.h} Fallback scan`),r.push(`  Found: ${n.embeddedCommandFound}`),{lines:r,incrementStep:!0};return null}case"custom-rules-check":{if(n.rulesChecked){if(r.push(""),r.push(`STEP ${t} ${e.h} Custom rules`),n.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(n.matched)return r.push(""),r.push(`STEP ${t} ${e.h} Dangerous text check`),r.push(`  Token:  ${n.token}`),r.push("  Result: MATCHED"),{lines:r,incrementStep:!0};return null}case"strict-unparseable":return r.push(""),r.push(`STEP ${t} ${e.h} Strict mode check`),r.push(`  Command: ${n.rawCommand}`),r.push("  Result:  ✗ UNPARSEABLE"),{lines:r,incrementStep:!0};case"segment-skipped":return null;case"error":return r.push(""),r.push(`ERROR: ${n.message}`),{lines:r,incrementStep:!1};default:return null}}function Ue(n,t){let e=Q0(t?.asciiOnly??!1),r=58,a=[],l=1;a.push(...X0(e,58)),a.push("");let d=n.trace.steps.find((p)=>p.type==="error");if(d&&d.type==="error"){a.push("ERROR"),a.push(`  ${d.message}`),a.push(""),a.push("RESULT"),a.push(`  Status: ${n.result==="blocked"?b.red("BLOCKED"):b.green("ALLOWED")}`),a.push(""),a.push("CONFIG");let p=n.configSource??"none";return a.push(`  Path: ${p}`),a.join(`
+`)}let s=n.trace.steps.find((p)=>p.type==="parse");if(s&&s.type==="parse"){a.push("INPUT"),a.push(`  ${s.input}`),a.push(""),a.push(`STEP ${l} ${e.h} Split shell commands`),l++;for(let p=0;p<s.segments.length;p++){let f=s.segments[p];if(f){let o=Math.random();a.push(`  Segment ${p+1}: ${Y0(f,o)}`)}}}let c=n.trace.segments,i=c.length>1;for(let p of c){if(i){a.push("");let x="";if(s&&s.type==="parse"){let Ft=s.segments[p.index];if(Ft)x=Ft.join(" ")}let w=54,y=x,J=` Segment ${p.index+1}: `,Z2=" ";if(x){if(J.length+x.length+Z2.length>w){let X3=w-J.length-Z2.length;y=`${x.substring(0,X3-1)}…`}}let ln=x?`${J}${y}${Z2}`:` Segment ${p.index+1} `,jt=x?`${J}${b.cyan(y)}${Z2}`:ln,wr=58-ln.length,xr=Math.floor(wr/2),Q3=wr-xr;a.push(`${e.sh.repeat(xr)}${jt}${e.sh.repeat(Q3)}`)}if(p.steps.find((x)=>x.type==="segment-skipped")){a.push(""),a.push("  (skipped — prior segment blocked)");continue}let o=!1,h=!1;for(let x of p.steps){let w=S0(x,l,e);if(w){if(h=!0,x.type==="recurse"){a.push("");let y=" RECURSING ",J=58-y.length-4;a.push(`  ${e.tl}${e.h}${y}${e.h.repeat(J)}`),a.push(`  ${e.v}`),o=!0;continue}for(let y of w.lines)if(o)a.push(`  ${e.v} ${y}`);else a.push(y);if(w.incrementStep)l++}}if(o)a.push(`  ${e.v}`),a.push(`  ${e.bl}${e.h.repeat(56)}`),o=!1;if(!h)a.push(""),a.push(`  ${b.green("✓")} Allowed (no matching rules)`)}if(a.push(""),a.push("RESULT"),n.result==="blocked"){if(a.push(`  Status: ${b.red("BLOCKED")}`),n.customRule){if(a.push(`  Rule: ${n.customRule.id}`),n.customRule.rulebook)a.push(`  Rulebook: ${n.customRule.rulebook.name} ${n.customRule.rulebook.version}`);if(n.customRule.source)a.push(`  Source: ${n.customRule.source}`);if(n.customRule.override)a.push(`  Override: reason ${n.customRule.override.reason}`)}if(n.reason){let p=dt(n.reason,"          ");a.push(`  Reason: ${p[0]}`);for(let f=1;f<p.length;f++)a.push(p[f]??"")}}else a.push(`  Status: ${b.green("ALLOWED")}`);a.push(""),a.push("CONFIG");let L=n.configSource??"none",u=n.configValid?"":" (invalid)";a.push(`  Path: ${L}${u}`),a.push(`  Safety preset: ${n.selectedPreset??"standard"}`),a.push(`  Effective capabilities: ${n.effectiveLevel}`);let v=Object.entries(n.destructiveCommandRuleOverrides??{});if(a.push(`  Rule customizations: ${v.length}`),n.ruleActivation)a.push(`  Rule activation: ${n.ruleActivation.id} — ${n.ruleActivation.enabled?"on":"off"} via ${n.ruleActivation.source}`);return a.join(`
+`)}function Oe(n){return JSON.stringify(n,null,2)}var H0="2.0.6",G="  ",F2="cc-safety-net";function A0(n){return n.argument?`${n.flags} ${n.argument}`:n.flags}function Ti(n){return Math.max(...n.map((t)=>A0(t).length))}function _i(n){return Math.max(...n.map((t)=>t.usage.length))}function Ei(n){return Math.max(...n.map((t)=>`${F2} ${t.usage}`.length))}function Pi(n,t){let e=`${F2} ${n.usage}`;return`${G}${e.padEnd(t+2)}${n.description}`}function L2(n,t){return`${G}${n.padEnd(Math.max(40,n.length+2))}${t}`}function st(n,t=console.log){let e=[];if(e.push(`${F2} ${n.name}`),e.push(""),e.push(`${G}${n.description}`),e.push(""),e.push("USAGE:"),e.push(`${G}${F2} ${n.usage}`),e.push(""),n.subcommands&&n.subcommands.length>0){e.push("SUBCOMMANDS:");let r=_i(n.subcommands);for(let a of n.subcommands)e.push(`${G}${a.usage.padEnd(r+2)}${a.description}`);e.push("")}if(n.options.length>0){e.push("OPTIONS:");let r=Ti(n.options);for(let a of n.options){let l=A0(a),d=a.default?`${a.description} (default: ${a.default})`:a.description;e.push(`${G}${l.padEnd(r+2)}${d}`)}e.push("")}if(n.examples&&n.examples.length>0){e.push("EXAMPLES:");for(let r of n.examples)e.push(`${G}${r}`)}t(e.join(`
+`))}function Te(){let n=E1(),t=Ei(n),e=[];e.push(`${F2} v${H0}`),e.push(""),e.push("Blocks destructive commands and secret access."),e.push(""),e.push("COMMANDS:");for(let r of n)e.push(Pi(r,t));e.push(""),e.push("GLOBAL OPTIONS:"),e.push(`${G}-h, --help       Show help (use with command for command-specific help)`),e.push(`${G}-V, --version    Show version`),e.push(""),e.push("HELP:"),e.push(`${G}${F2} help <command>     Show help for a specific command`),e.push(`${G}${F2} <command> --help   Show help for a specific command`),e.push(""),e.push("ENVIRONMENT VARIABLES:"),e.push(L2(`${m.level.name}=standard|strict|paranoid`,"Set session safety level")),e.push(L2(`${m.worktree.name}=1`,"Allow local git discards in linked worktrees")),e.push(L2(`${m.debug.name}=1`,"Print diagnostic messages to stderr")),e.push(L2(`${m.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),e.push(L2("CC_SAFETY_NET_HOME","Override rule config home directory")),e.push(""),e.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),e.push(L2(`${m.strict.name}=1`,"Force safety.overrides.fail_closed on")),e.push(L2(`${m.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),e.push(L2(`${m.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),e.push(L2(`${m.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),e.push(""),e.push("Documentation:        https://ccsafetynet.com/docs"),console.log(e.join(`
+`))}function W0(){console.log(H0)}function Jn(n,t=console.log){let e=Gn(n);if(!e)return!1;if(e.hidden||e.name.toLowerCase()!==n.toLowerCase())return!1;return st(e,t),!0}import{existsSync as ir,readFileSync as Ml}from"node:fs";import{homedir as EL}from"node:os";import{join as sr}from"node:path";import*as h2 from"node:readline";function Ii(n){return n==="install"?"Install":"Uninstall"}function Ni(n){return n==="install"?"Installing":"Uninstalling"}function nL(n){return n==="install"?"into":"from"}function M0(n){return n?.available===!0}function tL(n,t){let e=new Set(t);return n.filter((r)=>e.has(r.target)).map((r)=>r.target)}function R0(n,t,e){if(n.length===0||n.every((r)=>!r.available))return t;return Array.from({length:n.length},(r,a)=>a+1).map((r)=>(t+r*e+n.length)%n.length).find((r)=>M0(n[r]))}function eL(n,t,e){if(e.ctrl&&e.name==="c")return"interrupt";if(e.name==="escape"||t==="q")return"abort";if(n==="install"&&(t==="u"||t==="U"))return"update";if(e.name==="up"||t==="k")return"up";if(e.name==="down"||t==="j")return"down";if(e.name==="space"||t===" ")return"toggle";if(e.name==="return"||e.name==="enter")return"confirm";return null}function rL(n){return{cursor:n.findIndex((t)=>t.available),selected:[]}}function aL(n,t,e){if(e==="confirm"||e==="update"||e==="abort"||e==="interrupt")return{state:n,done:e};if(e==="up")return{state:{...n,cursor:R0(t,n.cursor,-1)}};if(e==="down")return{state:{...n,cursor:R0(t,n.cursor,1)}};let r=t[n.cursor];if(!M0(r))return{state:n};let a=n.selected.includes(r.target)?n.selected.filter((l)=>l!==r.target):tL(t,[...n.selected,r.target]);return{state:{...n,selected:a}}}var V0="◉",G0="◯",C0=">",U0=" ";function lL(n,t,e,r={}){let a=r.color!==!1,l=a?b.dim:(c)=>c,d=a?b.green:(c)=>c,s=a?b.bold:(c)=>c;return["",`${Ii(n)} CC Safety Net ${nL(n)}:`,"",...t.map((c,i)=>{let L=e.selected.includes(c.target),u=i===e.cursor,v=L?V0:G0,p=u?C0:U0,f=c.available?"":` (${c.unavailableReason??"not installed"})`,o=`${v} ${c.label}${f}`,h=!c.available?l(o):L?d(o):u?s(o):o;return`${p} ${h}`}),"",n==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":t.some((c)=>c.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${n}. q/Esc: close`].join(`
+`)}var K0=["global-hook","plugin"];function dL(n,t,e={}){let r=e.color!==!1?b.bold:(l)=>l;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((l,d)=>{let s=d===n,c=`${s?V0:G0} ${l}`;return`${s?C0:U0} ${s?r(c):c}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`
+`)}function O0(n){let{input:t,output:e}=n;h2.emitKeypressEvents(t);let r=t.isRaw===!0;t.setRawMode(!0),t.resume();let a=0,l=()=>{if(a===0)return;h2.moveCursor(e,0,-a),h2.cursorTo(e,0),h2.clearScreenDown(e)},d=()=>{l();let s=n.render();e.write(`${s}
 `),a=s.split(`
-`).length};return new Promise((s)=>{let L=(i)=>{t.off("keypress",c),t.setRawMode(e),t.pause(),l(),s(i)};function c(i,u){n.onKey(i,u,{finish:L,draw:d})}t.on("keypress",c),d()})}function T0(n={}){let t=0;return O0({input:n.input??process.stdin,output:n.output??process.stdout,render:()=>li(t,n.globalHookInstalled===!0),onKey:(r,e,a)=>{if(e.ctrl&&e.name==="c"){a.finish(null),(n.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(e.name==="escape"||r==="q")return a.finish(null);if(e.name==="return"||e.name==="enter")return a.finish(K0[t]);if(e.name==="up"||e.name==="down"||r==="k"||r==="j")t=(t+1)%K0.length,a.draw()}})}function Or(n=process.stdin,t=process.stdout){return Boolean(n.isTTY&&t.isTTY&&typeof n.setRawMode==="function")}function E0(n,t,r={}){let e=r.output??process.stdout,a=ri(t);return O0({input:r.input??process.stdin,output:e,render:()=>ai(n,t,a),onKey:(l,d,s)=>{let L=ti(n,l,d);if(!L)return;let c=ei(a,t,L);if(a=c.state,c.done==="interrupt"){s.finish(null),(r.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(c.done==="abort")return s.finish(null);if(c.done==="update")return s.finish("update");if(c.done==="confirm"){if(a.selected.length===0){e.write("\x07"),s.draw();return}s.finish([...a.selected]),e.write(`${Ic(n)} selected integrations...
-`);return}s.draw()}})}import{existsSync as P0,lstatSync as I0,mkdtempSync as si,readFileSync as ct,rmSync as N0}from"node:fs";import{tmpdir as Li}from"node:os";import{dirname as ci,join as B2}from"node:path";import{fileURLToPath as ii}from"node:url";var Tr="// cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp";import{spawn as di}from"node:child_process";var Er=(n,t)=>{let r=f2([...n],process.env);return new Promise((e)=>{let a=di(r.cmd,r.args,{cwd:t,stdio:["ignore","pipe","pipe"]}),l=Xr(a),d=!1,s=setTimeout(()=>{d=!0,a.kill()},120000);a.on("error",(L)=>{clearTimeout(s),e({status:null,errorCode:L.code,stdout:l.stdout,stderr:[L.message,l.stderr].filter(Boolean).join(`
-`)})}),a.on("close",(L)=>{clearTimeout(s),e({status:d?null:L,errorCode:d?"ETIMEDOUT":void 0,stdout:l.stdout,stderr:l.stderr})})})};var _0=B2("amp","cc-safety-net.ts"),p2="cc-safety-net.ts";function pi(n){return B2(n,".config","amp","plugins",p2)}function ui(){let n=ci(ii(import.meta.url));return[B2(n,"..",_0),B2(n,"..","..","..","dist",_0)]}function oi(n=ui()){let t=n.find((r)=>P0(r)&&I0(r).isFile());if(!t)throw Error("Packaged Amp plugin artifact not found. Reinstall cc-safety-net and try again.");return t}function nl(n){try{return I0(n)}catch{return}}function tl(n){try{return JSON.parse(n)}catch{return}}function rl(n){return n.subarray(0,Buffer.byteLength(Tr)).toString("utf-8")===Tr}async function Bn(n,t,r){let e=await n(t,r);if(e.status===0)return e;throw Error([`Failed to run ${t.join(" ")}${e.status===null?"":` (exit ${e.status})`}.`,[e.stdout,e.stderr].filter(Boolean).join(`
+`).length};return new Promise((s)=>{let c=(L)=>{t.off("keypress",i),t.setRawMode(r),t.pause(),l(),s(L)};function i(L,u){n.onKey(L,u,{finish:c,draw:d})}t.on("keypress",i),d()})}function T0(n={}){let t=0;return O0({input:n.input??process.stdin,output:n.output??process.stdout,render:()=>dL(t,n.globalHookInstalled===!0),onKey:(e,r,a)=>{if(r.ctrl&&r.name==="c"){a.finish(null),(n.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(r.name==="escape"||e==="q")return a.finish(null);if(r.name==="return"||r.name==="enter")return a.finish(K0[t]);if(r.name==="up"||r.name==="down"||e==="k"||e==="j")t=(t+1)%K0.length,a.draw()}})}function _e(n=process.stdin,t=process.stdout){return Boolean(n.isTTY&&t.isTTY&&typeof n.setRawMode==="function")}function _0(n,t,e={}){let r=e.output??process.stdout,a=rL(t);return O0({input:e.input??process.stdin,output:r,render:()=>lL(n,t,a),onKey:(l,d,s)=>{let c=eL(n,l,d);if(!c)return;let i=aL(a,t,c);if(a=i.state,i.done==="interrupt"){s.finish(null),(e.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(i.done==="abort")return s.finish(null);if(i.done==="update")return s.finish("update");if(i.done==="confirm"){if(a.selected.length===0){r.write("\x07"),s.draw();return}s.finish([...a.selected]),r.write(`${Ni(n)} selected integrations...
+`);return}s.draw()}})}import{existsSync as P0,lstatSync as I0,mkdtempSync as cL,readFileSync as Lt,rmSync as N0}from"node:fs";import{tmpdir as iL}from"node:os";import{dirname as LL,join as z2}from"node:path";import{fileURLToPath as pL}from"node:url";var Ee="// cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp";import{spawn as sL}from"node:child_process";var Pe=(n,t)=>{let e=f2([...n],process.env);return new Promise((r)=>{let a=sL(e.cmd,e.args,{cwd:t,stdio:["ignore","pipe","pipe"]}),l=Se(a),d=!1,s=setTimeout(()=>{d=!0,a.kill()},120000);a.on("error",(c)=>{clearTimeout(s),r({status:null,errorCode:c.code,stdout:l.stdout,stderr:[c.message,l.stderr].filter(Boolean).join(`
+`)})}),a.on("close",(c)=>{clearTimeout(s),r({status:d?null:c,errorCode:d?"ETIMEDOUT":void 0,stdout:l.stdout,stderr:l.stderr})})})};var E0=z2("amp","cc-safety-net.ts"),p2="cc-safety-net.ts";function uL(n){return z2(n,".config","amp","plugins",p2)}function oL(){let n=LL(pL(import.meta.url));return[z2(n,"..",E0),z2(n,"..","..","..","dist",E0)]}function vL(n=oL()){let t=n.find((e)=>P0(e)&&I0(e).isFile());if(!t)throw Error("Packaged Amp plugin artifact not found. Reinstall cc-safety-net and try again.");return t}function nl(n){try{return I0(n)}catch{return}}function tl(n){try{return JSON.parse(n)}catch{return}}function el(n){return n.subarray(0,Buffer.byteLength(Ee)).toString("utf-8")===Ee}async function Zn(n,t,e){let r=await n(t,e);if(r.status===0)return r;throw Error([`Failed to run ${t.join(" ")}${r.status===null?"":` (exit ${r.status})`}.`,[r.stdout,r.stderr].filter(Boolean).join(`
 `).trim()].filter(Boolean).join(`
-`))}async function el(n){let t=await n(["amp","plugins","repositories","--json"]);if(t.status===null)throw Error(`${t.errorCode==="ENOENT"?'Amp CLI not found. Install the amp CLI, sign in with "amp login", and rerun install --amp.':`amp plugins repositories --json did not finish (${t.errorCode??"terminated"}). Check that the amp CLI responds and rerun install --amp.`}
+`))}async function rl(n){let t=await n(["amp","plugins","repositories","--json"]);if(t.status===null)throw Error(`${t.errorCode==="ENOENT"?'Amp CLI not found. Install the amp CLI, sign in with "amp login", and rerun install --amp.':`amp plugins repositories --json did not finish (${t.errorCode??"terminated"}). Check that the amp CLI responds and rerun install --amp.`}
 ${t.stderr}`.trim());if(t.status!==0)throw Error(`Failed to run amp plugins repositories --json (exit ${t.status}). Sign in with "amp login" and rerun install --amp.
 ${[t.stdout,t.stderr].filter(Boolean).join(`
-`)}`.trim());let r=tl(t.stdout),e=(Array.isArray(r)?r:[]).filter((a)=>$(a,"scope")==="user"&&$(a,"exists")===!0&&$(a,"viewerCanWrite")===!0).map((a)=>$(a,"cloneRef")).find((a)=>typeof a==="string"&&a.length>0);if(!e)throw Error('Your Amp account has no writable Personal Plugins repository. Sign in with "amp login", open Amp once to create it, and rerun install --amp.');return e}async function al(n,t){let r=si(B2(Li(),"cc-safety-net-amp-"));try{return await Bn(n,["amp","clone","user-plugins",r]),await t(r)}finally{N0(r,{recursive:!0,force:!0})}}function ll(n,t){let r=B2(n,p2),e=nl(r);if(!e)return;if(e.isSymbolicLink()||!e.isFile())throw Error(`Refusing to ${t} ${p2} in your Amp personal plugins repository: not a regular file. Remove it there and rerun install --amp.`);let a=ct(r);if(rl(a))return a;throw Error(`Refusing to ${t} unmanaged file ${p2} in your Amp personal plugins repository. Remove it there and rerun install --amp.`)}async function dl(n,t,r,e){if(await Bn(n,r,t),(await Bn(n,["git","status","--porcelain"],t)).stdout.trim()==="")return!1;return await Bn(n,["git","-c","commit.gpgsign=false","-c","user.name=cc-safety-net","-c","user.email=cc-safety-net@localhost","commit","-m",e],t),await Bn(n,["git","push","origin","HEAD"],t),!0}function st(n,t){let r=pi(n),e=nl(r);if(!e)return;if(!e.isSymbolicLink()&&e.isFile()&&rl(ct(r))){N0(r);return}if(t==="keep")return;throw Error(`Local Amp plugin ${r} is not a managed copy and masks the personal plugin. Remove it and rerun install --amp.`)}function vi(){let n=bn();if(!P0(n))return"";let t=tl(ct(n,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))return"";return`;globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__ = ${JSON.stringify(Lt(t))};
-`}async function sl(n,t=oi(),r=Er){let e=Buffer.concat([ct(t),Buffer.from(vi(),"utf-8")]),a=await el(r);return al(r,async(l)=>{let d=`${a}/${p2}`;if(ll(l,"overwrite")?.equals(e))return st(n,"fail"),{path:d,alreadyInstalled:!0};B(B2(l,p2),e);let s=await dl(r,l,["git","add",p2],`chore: update cc-safety-net plugin to v${j()}`);return st(n,"fail"),{path:d,alreadyInstalled:!s}})}async function Ll(n,t=Er){let r=await el(t);return al(t,async(e)=>{let a=`${r}/${p2}`;if(!ll(e,"remove"))return st(n,"keep"),{path:a,alreadyInstalled:!1};return await dl(t,e,["git","rm",p2],`chore: remove cc-safety-net plugin v${j()}`),st(n,"keep"),{path:a,alreadyInstalled:!0}})}import{existsSync as cl,mkdirSync as bi,readFileSync as fi}from"node:fs";import{dirname as yi}from"node:path";var _r="npx -y cc-safety-net hook --agy-cli",h2="cc-safety-net";function pt(){return{PreToolUse:[{hooks:[{type:"command",command:_r,timeout:30}]}]}}function il(n){try{let t=JSON.parse(fi(n,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))throw Error("Antigravity hooks config must be a JSON object");return t}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Antigravity hooks config ${n}: ${t.message}`);throw t}}function pl(n){let t=n[h2];if(t===void 0)return n[h2]=pt(),n[h2];if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Antigravity hooks config entry "${h2}" must be an object`);if(!Array.isArray(t.PreToolUse))t.PreToolUse=[];return t}function ul(n){if(!Array.isArray(n.PreToolUse))return!1;return n.PreToolUse.some((t)=>Array.isArray(t.hooks)&&t.hooks.some((r)=>r.command===_r))}function hi(n){return Object.values(n).some((t)=>t.enabled!==!1&&ul(t))}function wi(n){if(n[h2]===void 0)return!1;let t=pl(n);if(t.enabled!==!1||!ul(t))return!1;return t.enabled=!0,!0}function xi(n){if(n[h2]===void 0){n[h2]=pt();return}let t=pl(n);t.PreToolUse??=[],t.enabled=!0,t.PreToolUse.push(pt().PreToolUse?.[0]??{hooks:[]})}function $i(n){let t=!1;for(let r of Object.values(n)){if(!Array.isArray(r.PreToolUse))continue;r.PreToolUse=r.PreToolUse.flatMap((e)=>{if(!Array.isArray(e.hooks))return[e];let a=e.hooks.filter((l)=>l.command!==_r);if(a.length!==e.hooks.length)t=!0;return a.length===0?[]:[{...e,hooks:a}]})}return t}function it(n,t){B(n,`${JSON.stringify(t,null,2)}
-`)}function ol(n){let t=gn(n);if(bi(yi(t),{recursive:!0}),!cl(t))return it(t,{[h2]:pt()}),{path:t,alreadyInstalled:!1};let r=il(t);if(hi(r))return{path:t,alreadyInstalled:!0};if(wi(r))return it(t,r),{path:t,alreadyInstalled:!1};return xi(r),it(t,r),{path:t,alreadyInstalled:!1}}function vl(n){let t=gn(n);if(!cl(t))return{path:t,alreadyInstalled:!1};let r=il(t);if(!$i(r))return{path:t,alreadyInstalled:!1};return it(t,r),{path:t,alreadyInstalled:!0}}import{spawn as gi,spawnSync as Di}from"node:child_process";var C=c2.map((n)=>({target:n.id,flag:n.flag,label:n.installLabel,probeCommand:n.probeCommand})),bl=new Map(C.map((n)=>[n.flag,n.target]));function Pr(n){let t=new Set(n);return C.map((r)=>r.target).filter((r)=>t.has(r))}async function fl(n,t){for(let r of n)await t(r)}var yl=5000;function mi(n){let t=f2([...n],process.env),r=Di(t.cmd,t.args,{env:process.env,stdio:"ignore",timeout:yl});return!r.error&&r.status===0}function Nr(n){return new Promise((t)=>{let r=f2([...n],process.env),e=gi(r.cmd,r.args,{env:process.env,stdio:"ignore"}),a=!1,l=(s)=>{if(a)return;a=!0,clearTimeout(d),t(s)},d=setTimeout(()=>{e.kill(),l(!1)},yl);e.on("error",()=>l(!1)),e.on("close",(s)=>l(s===0))})}function ki(n=mi,t={}){let r=new Set(t.configuredTargets??[]);if(t.async)return Promise.all(C.map(async(a)=>({target:a.target,flag:a.flag,label:a.label,...Ir(t.action,await n(a.probeCommand),r.has(a.target))})));let e=n;return C.map((a)=>({target:a.target,flag:a.flag,label:a.label,...Ir(t.action,e(a.probeCommand),r.has(a.target))}))}function hl(n=Nr,t={}){return ki(n,{...t,async:!0})}function wl(n,t){let r=new Set(t.configuredTargets??[]);return n.map((e)=>({...e,...Ir(t.action,e.available,r.has(e.target))}))}function Ir(n,t,r){if(n==="uninstall")return r?{available:!0}:{available:!1,unavailableReason:"not installed"};if(n==="install"&&r)return{available:!1,unavailableReason:"already installed"};if(!t)return{available:!1,unavailableReason:"CLI not installed"};return{available:!0}}import{existsSync as xl,readdirSync as qi,rmSync as ji}from"node:fs";import{join as rn}from"node:path";function ne(n,t=process.platform){let r=rn(process.env.npm_config_cache||(t==="win32"?rn(process.env.LOCALAPPDATA||rn(n,"AppData","Local"),"npm-cache"):rn(n,".npm")),"_npx");if(!xl(r))return;qi(r).filter((e)=>xl(rn(r,e,"node_modules","cc-safety-net"))).forEach((e)=>{ji(rn(r,e),{recursive:!0,force:!0})})}import{existsSync as ml,mkdirSync as zi,readFileSync as kl}from"node:fs";import{dirname as Bi,join as Dl}from"node:path";function $l(n){return n!==void 0&&/\s/.test(n)}function Fi(n,t,r){let e=t+1,a=!1;while(e<n.length){let l=n[e];if(a){a=!1,e++;continue}if(l==="\\"){a=!0,e++;continue}if(l==='"')return e+1;e++}throw Error(r)}function ut(n,t,r){let e=n[t],a=e==="["?"]":"}",l=0,d=t;while(d<n.length){let s=r.skipComment?.(n,d)??d;if(s!==d){d=s;continue}if(n[d]==='"'){d=Fi(n,d,r.stringError);continue}if(n[d]===e)l++;if(n[d]===a){if(l--,l===0)return d}d++}throw Error(r.bracketError)}function gl(n,t){let r=n.lastIndexOf(`
-`,t)+1;return/^[ \t]*/.exec(n.slice(r))?.[0]??""}function ot(n,t){let{start:r,end:e,end:a}=t;while($l(n[a]))a++;if(n[a]===","){if(e=a+1,n[e]===`
-`)e++;return`${n.slice(0,r)}${n.slice(e)}`}a=t.start-1;while($l(n[a]))a--;if(n[a]===","){r=a;let l=n.lastIndexOf(`
-`,r-1);if(l!==-1&&/^\s*$/.test(n.slice(l+1,r)))r=l}return`${n.slice(0,r)}${n.slice(e)}`}var Jn="npx -y cc-safety-net hook --kimi-code",te=`[[hooks]]
+`)}`.trim());let e=tl(t.stdout),r=(Array.isArray(e)?e:[]).filter((a)=>$(a,"scope")==="user"&&$(a,"exists")===!0&&$(a,"viewerCanWrite")===!0).map((a)=>$(a,"cloneRef")).find((a)=>typeof a==="string"&&a.length>0);if(!r)throw Error('Your Amp account has no writable Personal Plugins repository. Sign in with "amp login", open Amp once to create it, and rerun install --amp.');return r}async function al(n,t){let e=cL(z2(iL(),"cc-safety-net-amp-"));try{return await Zn(n,["amp","clone","user-plugins",e]),await t(e)}finally{N0(e,{recursive:!0,force:!0})}}function ll(n,t){let e=z2(n,p2),r=nl(e);if(!r)return;if(r.isSymbolicLink()||!r.isFile())throw Error(`Refusing to ${t} ${p2} in your Amp personal plugins repository: not a regular file. Remove it there and rerun install --amp.`);let a=Lt(e);if(el(a))return a;throw Error(`Refusing to ${t} unmanaged file ${p2} in your Amp personal plugins repository. Remove it there and rerun install --amp.`)}async function dl(n,t,e,r){if(await Zn(n,e,t),(await Zn(n,["git","status","--porcelain"],t)).stdout.trim()==="")return!1;return await Zn(n,["git","-c","commit.gpgsign=false","-c","user.name=cc-safety-net","-c","user.email=cc-safety-net@localhost","commit","-m",r],t),await Zn(n,["git","push","origin","HEAD"],t),!0}function ct(n,t){let e=uL(n),r=nl(e);if(!r)return;if(!r.isSymbolicLink()&&r.isFile()&&el(Lt(e))){N0(e);return}if(t==="keep")return;throw Error(`Local Amp plugin ${e} is not a managed copy and masks the personal plugin. Remove it and rerun install --amp.`)}function bL(){let n=bn();if(!P0(n))return"";let t=tl(Lt(n,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))return"";return`;globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__ = ${JSON.stringify(it(t))};
+`}async function sl(n,t=vL(),e=Pe){let r=Buffer.concat([Lt(t),Buffer.from(bL(),"utf-8")]),a=await rl(e);return al(e,async(l)=>{let d=`${a}/${p2}`;if(ll(l,"overwrite")?.equals(r))return ct(n,"fail"),{path:d,alreadyInstalled:!0};B(z2(l,p2),r);let s=await dl(e,l,["git","add",p2],`chore: update cc-safety-net plugin to v${j()}`);return ct(n,"fail"),{path:d,alreadyInstalled:!s}})}async function cl(n,t=Pe){let e=await rl(t);return al(t,async(r)=>{let a=`${e}/${p2}`;if(!ll(r,"remove"))return ct(n,"keep"),{path:a,alreadyInstalled:!1};return await dl(t,r,["git","rm",p2],`chore: remove cc-safety-net plugin v${j()}`),ct(n,"keep"),{path:a,alreadyInstalled:!0}})}import{existsSync as il,mkdirSync as fL,readFileSync as hL}from"node:fs";import{dirname as yL}from"node:path";var Ie="npx -y cc-safety-net hook --agy-cli",y2="cc-safety-net";function ut(){return{PreToolUse:[{hooks:[{type:"command",command:Ie,timeout:30}]}]}}function Ll(n){try{let t=JSON.parse(hL(n,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))throw Error("Antigravity hooks config must be a JSON object");return t}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Antigravity hooks config ${n}: ${t.message}`);throw t}}function pl(n){let t=n[y2];if(t===void 0)return n[y2]=ut(),n[y2];if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Antigravity hooks config entry "${y2}" must be an object`);if(!Array.isArray(t.PreToolUse))t.PreToolUse=[];return t}function ul(n){if(!Array.isArray(n.PreToolUse))return!1;return n.PreToolUse.some((t)=>Array.isArray(t.hooks)&&t.hooks.some((e)=>e.command===Ie))}function wL(n){return Object.values(n).some((t)=>t.enabled!==!1&&ul(t))}function xL(n){if(n[y2]===void 0)return!1;let t=pl(n);if(t.enabled!==!1||!ul(t))return!1;return t.enabled=!0,!0}function $L(n){if(n[y2]===void 0){n[y2]=ut();return}let t=pl(n);t.PreToolUse??=[],t.enabled=!0,t.PreToolUse.push(ut().PreToolUse?.[0]??{hooks:[]})}function gL(n){let t=!1;for(let e of Object.values(n)){if(!Array.isArray(e.PreToolUse))continue;e.PreToolUse=e.PreToolUse.flatMap((r)=>{if(!Array.isArray(r.hooks))return[r];let a=r.hooks.filter((l)=>l.command!==Ie);if(a.length!==r.hooks.length)t=!0;return a.length===0?[]:[{...r,hooks:a}]})}return t}function pt(n,t){B(n,`${JSON.stringify(t,null,2)}
+`)}function ol(n){let t=mn(n);if(fL(yL(t),{recursive:!0}),!il(t))return pt(t,{[y2]:ut()}),{path:t,alreadyInstalled:!1};let e=Ll(t);if(wL(e))return{path:t,alreadyInstalled:!0};if(xL(e))return pt(t,e),{path:t,alreadyInstalled:!1};return $L(e),pt(t,e),{path:t,alreadyInstalled:!1}}function vl(n){let t=mn(n);if(!il(t))return{path:t,alreadyInstalled:!1};let e=Ll(t);if(!gL(e))return{path:t,alreadyInstalled:!1};return pt(t,e),{path:t,alreadyInstalled:!0}}import{spawn as DL,spawnSync as mL}from"node:child_process";var C=i2.map((n)=>({target:n.id,flag:n.flag,label:n.installLabel,probeCommand:n.probeCommand})),bl=new Map(C.map((n)=>[n.flag,n.target]));function Ne(n){let t=new Set(n);return C.map((e)=>e.target).filter((e)=>t.has(e))}async function fl(n,t){for(let e of n)await t(e)}var hl=5000;function kL(n){let t=f2([...n],process.env),e=mL(t.cmd,t.args,{env:process.env,stdio:"ignore",timeout:hl});return!e.error&&e.status===0}function tr(n){return new Promise((t)=>{let e=f2([...n],process.env),r=DL(e.cmd,e.args,{env:process.env,stdio:"ignore"}),a=!1,l=(s)=>{if(a)return;a=!0,clearTimeout(d),t(s)},d=setTimeout(()=>{r.kill(),l(!1)},hl);r.on("error",()=>l(!1)),r.on("close",(s)=>l(s===0))})}function qL(n=kL,t={}){let e=new Set(t.configuredTargets??[]);if(t.async)return Promise.all(C.map(async(a)=>({target:a.target,flag:a.flag,label:a.label,...nr(t.action,await n(a.probeCommand),e.has(a.target))})));let r=n;return C.map((a)=>({target:a.target,flag:a.flag,label:a.label,...nr(t.action,r(a.probeCommand),e.has(a.target))}))}function yl(n=tr,t={}){return qL(n,{...t,async:!0})}function wl(n,t){let e=new Set(t.configuredTargets??[]);return n.map((r)=>({...r,...nr(t.action,r.available,e.has(r.target))}))}function nr(n,t,e){if(n==="uninstall")return e?{available:!0}:{available:!1,unavailableReason:"not installed"};if(n==="install"&&e)return{available:!1,unavailableReason:"already installed"};if(!t)return{available:!1,unavailableReason:"CLI not installed"};return{available:!0}}import{existsSync as xl,readdirSync as jL,rmSync as FL}from"node:fs";import{join as en}from"node:path";function ot(n,t=process.platform){let e=en(process.env.npm_config_cache||(t==="win32"?en(process.env.LOCALAPPDATA||en(n,"AppData","Local"),"npm-cache"):en(n,".npm")),"_npx");if(!xl(e))return;jL(e).filter((r)=>xl(en(e,r,"node_modules","cc-safety-net"))).forEach((r)=>{FL(en(e,r),{recursive:!0,force:!0})})}import{existsSync as ml,mkdirSync as BL,readFileSync as kl}from"node:fs";import{dirname as JL,join as Dl}from"node:path";function $l(n){return n!==void 0&&/\s/.test(n)}function zL(n,t,e){let r=t+1,a=!1;while(r<n.length){let l=n[r];if(a){a=!1,r++;continue}if(l==="\\"){a=!0,r++;continue}if(l==='"')return r+1;r++}throw Error(e)}function vt(n,t,e){let r=n[t],a=r==="["?"]":"}",l=0,d=t;while(d<n.length){let s=e.skipComment?.(n,d)??d;if(s!==d){d=s;continue}if(n[d]==='"'){d=zL(n,d,e.stringError);continue}if(n[d]===r)l++;if(n[d]===a){if(l--,l===0)return d}d++}throw Error(e.bracketError)}function gl(n,t){let e=n.lastIndexOf(`
+`,t)+1;return/^[ \t]*/.exec(n.slice(e))?.[0]??""}function bt(n,t){let{start:e,end:r,end:a}=t;while($l(n[a]))a++;if(n[a]===","){if(r=a+1,n[r]===`
+`)r++;return`${n.slice(0,e)}${n.slice(r)}`}a=t.start-1;while($l(n[a]))a--;if(n[a]===","){e=a;let l=n.lastIndexOf(`
+`,e-1);if(l!==-1&&/^\s*$/.test(n.slice(l+1,e)))e=l}return`${n.slice(0,e)}${n.slice(r)}`}var Qn="npx -y cc-safety-net hook --kimi-code",er=`[[hooks]]
 event = "PreToolUse"
-command = "${Jn}"`,re=`{ event = "PreToolUse", command = "${Jn}" }`;function ql(n){return Dl(process.env.KIMI_CODE_HOME??Dl(n,".kimi-code"),"config.toml")}function Ji(n){return n.split(`
-`).reduce((r,e)=>{if(/^\s*\[/.test(e))return r.activeTable=!0,r.lines.push(e),r;if(!r.activeTable&&/^\s*hooks\s*=\s*\[\s*]\s*(?:#.*)?$/.test(e))return r;return r.lines.push(e),r},{activeTable:!1,lines:[]}).lines.join(`
-`)}function Zi(n,t){if(n[t]!=="#")return t;let r=n.indexOf(`
-`,t+1);return r===-1?n.length:r+1}function Qi(n,t){return ut(n,t,{skipComment:Zi,stringError:"Unterminated string in Kimi Code config",bracketError:"Unmatched hooks array in Kimi Code config"})}function jl(n){let t=!1,r=0;while(r<n.length){let e=n.indexOf(`
-`,r),a=e===-1?n.length:e,l=n.slice(r,a);if(/^\s*\[/.test(l))t=!0;if(!t){let d=/^(\s*)hooks\s*=\s*\[/.exec(l);if(d){let s=r+d[0].lastIndexOf("[");return{start:s,end:Qi(n,s)}}}r=e===-1?n.length:e+1}return}function Xi(n,t){let r=n.slice(0,t.end).trimEnd(),e=gl(n,t.end),a=e===""?"     ":`${e}  `,l=!r.endsWith("[")&&!r.endsWith(",");return`${r}${l?",":""}
-${a}${re}${n.slice(t.end)}`}function Yi(n){let t=jl(n);if(t&&n.slice(t.start+1,t.end).trim())return Xi(n,t);let r=Ji(n).trimEnd();if(r==="")return`${te}
-`;return`${r}
-
-${te}
-`}function Si(n){return n.split(/(?=^\s*\[)/m).filter((r)=>!/^\s*\[\[hooks]]\s*$/m.test(r)||!r.includes(Jn)).join("").trimEnd()}function Hi(n,t){let r=n.indexOf(re,t.start);if(r===-1||r>t.end)return n;return ot(n,{start:r,end:r+re.length})}function Fl(n){let t=ql(n);if(zi(Bi(t),{recursive:!0}),!ml(t))return B(t,`${te}
-`),{path:t,alreadyInstalled:!1};let r=kl(t,"utf-8");if(r.includes(Jn))return{path:t,alreadyInstalled:!0};return B(t,Yi(r)),{path:t,alreadyInstalled:!1}}function zl(n){let t=ql(n);if(!ml(t))return{path:t,alreadyInstalled:!1};let r=kl(t,"utf-8");if(!r.includes(Jn))return{path:t,alreadyInstalled:!1};let e=jl(r),a=e?Hi(r,e):`${Si(r)}
-`;return B(t,a),{path:t,alreadyInstalled:!0}}import{existsSync as Bl,readFileSync as Ai,rmSync as Wi}from"node:fs";import{join as ee}from"node:path";var ae="cc-safety-net",Ri=`${ae}@latest`,Zl=["opencode.json","opencode.jsonc"];function Ki(n){return ee(n,".config","opencode",Zl[0])}function Mi(n){return Zl.map((t)=>ee(n,".config","opencode",t))}function Vi(n){return ee(n,".cache","opencode","packages",Ri)}function le(n){Wi(Vi(n),{recursive:!0,force:!0})}function vt(n,t){if(n[t]==="/"&&n[t+1]==="/"){let r=n.indexOf(`
-`,t+2);return r===-1?n.length:r+1}if(n[t]==="/"&&n[t+1]==="*"){let r=n.indexOf("*/",t+2);return r===-1?n.length:r+2}return t}function Jl(n,t){let r=t;while(r<n.length){if(/\s/.test(n[r]??"")){r++;continue}let e=vt(n,r);if(e===r)return r;r=e}return r}function Ql(n,t){let r=t+1,e=!1;while(r<n.length){if(e){e=!1,r++;continue}if(n[r]==="\\"){e=!0,r++;continue}if(n[r]==='"')return r+1;r++}throw Error("Unterminated string in OpenCode config")}function Xl(n,t,r){return JSON.parse(n.slice(t,r))}function Gi(n,t){return ut(n,t,{skipComment:vt,stringError:"Unterminated string in OpenCode config",bracketError:"Unmatched plugin array in OpenCode config"})}function Ci(n){let t=0,r=0;while(r<n.length){let e=vt(n,r);if(e!==r){r=e;continue}if(n[r]==='"'){let a=Ql(n,r);if(t===1&&Xl(n,r,a)==="plugin"){let l=Jl(n,a),d=Jl(n,l+1);if(n[l]===":"&&n[d]==="[")return{start:d,end:Gi(n,d)}}r=a;continue}if(n[r]==="{"||n[r]==="[")t++;if(n[r]==="}"||n[r]==="]")t--;r++}return}function Ui(n,t){let r=[],e=t.start+1;while(e<t.end){let a=vt(n,e);if(a!==e){e=a;continue}if(n[e]==='"'){let l=Ql(n,e),d=Xl(n,e,l);if(typeof d==="string"&&d.includes(ae))r.push({start:e,end:l});e=l;continue}e++}return r}function Yl(n,t){try{return JSON.parse(R(n))}catch(r){if(r instanceof SyntaxError)throw Error(`Failed to parse OpenCode config ${t}: ${r.message}`);throw r}}function Oi(n){if(!n||typeof n!=="object"||Array.isArray(n))return!1;let t=n.plugin;if(!Array.isArray(t))return!1;return t.some((r)=>typeof r==="string"&&r.includes(ae))}function Ti(n,t){let r=Ci(n);if(!r)throw Error(`Failed to locate OpenCode plugin array in ${t}`);let e=[...Ui(n,r)].reverse().reduce(ot,n);return Yl(e,t),e}function Sl(n){le(n);let t=Mi(n),r=t.find((a)=>Bl(a)),e=[];for(let a of t){if(!Bl(a))continue;try{let l=Ai(a,"utf-8");if(!Oi(Yl(l,a)))continue;return B(a,Ti(l,a)),{path:a,alreadyInstalled:!0}}catch(l){e.push(l instanceof Error?l.message:String(l))}}if(e.length>0)throw Error(e.join(`
-`));return{path:r??Ki(n),alreadyInstalled:!1}}var se="safety-net@cc-marketplace",Hl=new Set(["claude-code","codex","copilot-cli","gemini-cli","hermes-agent","openclaw","opencode","pi"]);function ce(n){return/^\s*safety-net@cc-marketplace[^a-z0-9-][^\n]*installed,/m.test(n??"")}function Ml(n){return/^\s*cc-safety-net[^a-z0-9-][^\n]*installed,/m.test(n??"")}function _i(n){return/^Marketplace `cc-marketplace`\s*$/m.test(n??"")}var Vl={"claude-code":{installCommands:(n)=>{let t=_n(n,"cc-safety-net@cc-marketplace");return{commands:[...t?[["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","update","cc-safety-net@cc-marketplace"]]:[["claude","plugin","marketplace","add","kenryu42/cc-marketplace"],["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","install","cc-safety-net@cc-marketplace"]],...yr(n).status==="disabled"?[["claude","plugin","enable","cc-safety-net@cc-marketplace"]]:[]],cleanupCommands:_n(n,se)?[["claude","plugin","uninstall",se]]:[],update:t}},uninstallCommands:[["claude","plugin","uninstall","cc-safety-net@cc-marketplace"],["claude","plugin","marketplace","remove","cc-marketplace"]]},codex:{installCommands:async()=>{let n=await r2(["codex","plugin","list"]),t=Ml(n);return{commands:[t||_i(n)?["codex","plugin","marketplace","upgrade","cc-marketplace"]:["codex","plugin","marketplace","add","kenryu42/cc-marketplace"],["codex","plugin","add","cc-safety-net@cc-marketplace"]],cleanupCommands:ce(n)?[["codex","plugin","remove","safety-net@cc-marketplace"]]:[],update:t}},uninstallCommands:[["codex","plugin","remove","cc-safety-net@cc-marketplace"],["codex","plugin","marketplace","remove","cc-marketplace"]],postInstallMessage:"Start Codex, open `/hooks`, select the cc-safety-net PreToolUse hook, and press `t` to trust it."},"copilot-cli":{installCommands:async()=>{let n=await r2(["copilot","plugin","list"]),t=[...Ra(n)?[["copilot","plugin","uninstall","copilot-safety-net"]]:[],...Ka(n)?[["copilot","plugin","uninstall",Ha]]:[]];if(Aa(n))return{commands:[["copilot","plugin","marketplace","update","cc-marketplace"],["copilot","plugin","update",t2]],cleanupCommands:t,update:!0};return{commands:[Wa(await r2(["copilot","plugin","marketplace","list"]))?["copilot","plugin","marketplace","update","cc-marketplace"]:["copilot","plugin","marketplace","add","kenryu42/cc-marketplace"],["copilot","plugin","install",t2]],cleanupCommands:t}},uninstallCommands:[["copilot","plugin","uninstall","cc-safety-net@cc-marketplace"],["copilot","plugin","marketplace","remove","cc-marketplace"]]},"gemini-cli":{installCommands:(n)=>{let t=kr(n);if(t.status==="configured")return{commands:[["gemini","extensions","update","gemini-safety-net"]],update:!0};if(t.status==="disabled")return{commands:[["gemini","extensions","update","gemini-safety-net"],["gemini","extensions","enable","gemini-safety-net"]],update:!0};return{commands:[["gemini","extensions","install","https://github.com/kenryu42/gemini-safety-net","--consent"]]}},uninstallCommands:[["gemini","extensions","uninstall","gemini-safety-net"]]},openclaw:{beforeInstall:Hr,installCommands:()=>({commands:x0()}),uninstallCommands:[["openclaw","plugins","uninstall",q,"--force"]],postInstallMessage:["Restart the OpenClaw Gateway to apply the change.","If plugins.allow is set in openclaw.json, it must also list cc-safety-net."].join(`
-`)},opencode:{beforeInstall:le,installCommands:[["opencode","plugin","-g","-f","cc-safety-net@latest"]]},pi:{installCommands:[["pi","install","npm:cc-safety-net"]],uninstallCommands:[["pi","uninstall","npm:cc-safety-net"]]}};function ft(){return process.env.HOME??Ei()}function Gl(n,t=(r)=>r){try{let r=JSON.parse(t(Kl(n,"utf-8")));if(!r||typeof r!=="object"||Array.isArray(r))throw Error(`Settings file ${n} must be a JSON object`);return r}catch(r){if(r instanceof SyntaxError)throw Error(`Failed to parse ${n}: ${r.message}`);throw r}}function Pi(n){let t=de(Dn(n),"settings.json");if(!Le(t))return;let r=Gl(t,R),e=r.enabledPlugins;if(!e||typeof e!=="object"||Array.isArray(e))return;if(e[t2]!==!1)return;let a=Kl(t,"utf-8"),l=a.replace(new RegExp(`("${t2}"\\s*:\\s*)false`),"$1true");return e[t2]=!0,B(t,l!==a?l:`${JSON.stringify(r,null,2)}
-`),`Enabled ${t2} plugin in ${t}`}function Ii(n){let t=Wr(n);if(!Le(t))return;let r=Gl(t);if(!Array.isArray(r.packages))return;let e=r.packages.find((a)=>!!a&&typeof a==="object"&&!Array.isArray(a)&&Rr(a.source)&&("extensions"in a));if(!e)return;return delete e.extensions,B(t,`${JSON.stringify(r,null,2)}
-`),`Enabled npm:cc-safety-net extensions in ${t}`}function Al(n,t){let r=F({label:t,booleans:Object.fromEntries(C.map((l)=>[l.target,[l.flag]]))},n),e=r.errors[0];if(e)throw Error(e);let a=C.filter((l)=>r.flags[l.target]).map((l)=>l.target);if(a.length!==1)throw Error(`Choose exactly one ${t} target: ${[...bl.keys()].join(", ")}`);return a[0]}async function Cl(n=ft(),t=k2){let[r,e,a]=await Promise.all([t(["amp","plugins","list"],30000),t(["codex","plugin","list"],30000),t(["copilot","--binary-version"])]);return{codexPluginListOutput:e,hooks:tn(process.cwd(),{homeDir:n,ampPluginListOutput:r,codexPluginListOutput:e,copilotCliVersion:a})}}async function Ni(n,t=k2){let r=await Cl(ft(),t);return r.hooks.filter((e)=>n==="install"?e.configured:e.detected||e.inspectionStatus==="not-inspected").filter((e)=>e.platform!=="codex"||!ce(r.codexPluginListOutput)||Ml(r.codexPluginListOutput)).map((e)=>e.platform)}function n5(n,t,r){if(t.length>0)return{finish:async()=>[Al(t,n)]};if(!r.selectTargets&&!Or(r.input,r.output))return{finish:async()=>[Al(t,n)]};let e=r.detectConfiguredTargets??(()=>Ni(n,r.fetchVersion)),a=Promise.all([hl(r.probeTargets),e()]);return{ready:a,finish:async()=>{let[l,d]=await a,s=wl(l,{action:n,configuredTargets:d}),L=r.selectTargets?await r.selectTargets(n,Rl(n,s)):await E0(n,Rl(n,s),{input:r.input,output:r.output});if(L==="update")return L;if(!L||L.length===0)return null;return Pr(L)}}}async function J2(n,t,r=!1){let e=Vl[n];e.beforeInstall?.(t);let a=typeof e.installCommands==="function"?await e.installCommands(t):{commands:e.installCommands};return await Yr(a.commands),await v0(a.cleanupCommands??[]),[`${a.update||r?"Updated":"Installed"} ${b2(n)} integration`,e.postInstallMessage].filter(Boolean).join(`
-`)}async function en(n){let t=Vl[n];if(!t.uninstallCommands)throw Error(`${b2(n)} uninstall is not supported`);return await Yr(t.uninstallCommands),`Uninstalled ${b2(n)} integration`}function t5(n){let t=Sl(n);return t.alreadyInstalled?`Uninstalled OpenCode plugin from ${t.path}`:`OpenCode plugin not installed in ${t.path}`}var r5={"antigravity-cli":{install:ol,uninstall:vl},cursor:{install:Pa,uninstall:Ia},"kimi-code":{install:Fl,uninstall:zl}};function an(n,t,r,e=!1){if(n==="install")ne(r);let a=r5[t][n](r),l=b2(t),d=n!=="install"?"Uninstalled":e?"Updated":"Installed";return n==="install"&&a.alreadyInstalled?e?`${l} hook up to date in ${a.path}`:`${l} hook already installed in ${a.path}`:n==="uninstall"&&!a.alreadyInstalled?`${l} hook not installed in ${a.path}`:`${d} ${l} hook ${n==="install"?"in":"from"} ${a.path}`}var e5={amp:{install:sl,uninstall:Ll,restartNote:'Amp personal plugins apply to every Amp session, including Orb threads. Restart Amp or run "plugins: reload" to apply the change.'},"hermes-agent":{install:a0,uninstall:l0,afterInstall:async(n)=>{let t=Zr(n);return await r2(["hermes","plugins","enable",M,"--no-allow-tool-override"]),!t},beforeUninstall:async(n)=>{Jr(n);try{await r2(["hermes","plugins","disable",M])}catch(t){console.warn(`${t instanceof Error?t.message:String(t)}
-Removing the plugin files anyway; ${M} may still be listed in the Hermes config.`)}},restartNote:"Restart Hermes to apply the change."}};async function bt(n,t,r,e=!1){let a=e5[t];if(n==="uninstall")await a.beforeUninstall?.(r);let l=n==="install"?await a.install(r):await a.uninstall(r),d=n==="install"&&await a.afterInstall?.(r),s=b2(t),L=!d&&(n==="install"&&l.alreadyInstalled||n==="uninstall"&&!l.alreadyInstalled);return[L?n==="install"?`${s} plugin ${e?"up to date":"already installed"} at ${l.path}`:`${s} plugin not installed at ${l.path}`:`${n!=="install"?"Uninstalled":e?"Updated":"Installed"} ${s} plugin ${n==="install"?"at":"from"} ${l.path}`,L?void 0:a.restartNote].filter(Boolean).join(`
-`)}var a5={amp:{install:(n,t)=>bt("install","amp",n,t),uninstall:(n)=>bt("uninstall","amp",n)},"antigravity-cli":{install:(n,t)=>an("install","antigravity-cli",n,t),uninstall:(n)=>an("uninstall","antigravity-cli",n)},"claude-code":{install:(n,t)=>J2("claude-code",n,t),uninstall:()=>en("claude-code")},codex:{install:(n,t)=>J2("codex",n,t),uninstall:()=>en("codex")},"copilot-cli":{install:async(n,t)=>[await J2("copilot-cli",n,t),Pi(n)].filter(Boolean).join(`
-`),uninstall:()=>en("copilot-cli")},cursor:{install:(n,t)=>an("install","cursor",n,t),uninstall:(n)=>an("uninstall","cursor",n)},"gemini-cli":{install:(n,t)=>J2("gemini-cli",n,t),uninstall:()=>en("gemini-cli")},"hermes-agent":{install:(n,t)=>{return ne(n),bt("install","hermes-agent",n,t)},uninstall:(n)=>bt("uninstall","hermes-agent",n)},"kimi-code":{install:(n,t)=>an("install","kimi-code",n,t),uninstall:(n)=>an("uninstall","kimi-code",n)},openclaw:{install:async(n,t)=>{let r=await J2("openclaw",n,t);return await $0(),r},uninstall:(n)=>{return Hr(n),en("openclaw")}},opencode:{install:(n,t)=>J2("opencode",n,t),uninstall:(n)=>t5(n)},pi:{install:async(n,t)=>[await J2("pi",n,t),Ii(n)].filter(Boolean).join(`
-`),uninstall:()=>en("pi")}},Wl=["Install CC Safety Net as a native Kimi Code plugin:","","  1. Start Kimi Code and run: /plugins install https://github.com/kenryu42/cc-safety-net","     Confirm the trust prompt; it defaults to cancel.","  2. Run /reload, or start a new session.","","Note: Kimi Code hooks are fail-open. When the hook process cannot start, crashes, or times","out, Kimi Code allows the tool call."].join(`
-`);function l5(n){if(qn({homeDir:n,cwd:process.cwd()}).status!=="configured")return Wl;return[Wl,"",b.red(["CAUTION: the global Kimi Code hook is installed and will run alongside the plugin.","After the plugin is active, remove it with: cc-safety-net uninstall --kimi-code"].join(`
+command = "${Qn}"`,rr=`{ event = "PreToolUse", command = "${Qn}" }`;function ql(n){return Dl(process.env.KIMI_CODE_HOME??Dl(n,".kimi-code"),"config.toml")}function ZL(n){return n.split(`
+`).reduce((e,r)=>{if(/^\s*\[/.test(r))return e.activeTable=!0,e.lines.push(r),e;if(!e.activeTable&&/^\s*hooks\s*=\s*\[\s*]\s*(?:#.*)?$/.test(r))return e;return e.lines.push(r),e},{activeTable:!1,lines:[]}).lines.join(`
+`)}function QL(n,t){if(n[t]!=="#")return t;let e=n.indexOf(`
+`,t+1);return e===-1?n.length:e+1}function XL(n,t){return vt(n,t,{skipComment:QL,stringError:"Unterminated string in Kimi Code config",bracketError:"Unmatched hooks array in Kimi Code config"})}function jl(n){let t=!1,e=0;while(e<n.length){let r=n.indexOf(`
+`,e),a=r===-1?n.length:r,l=n.slice(e,a);if(/^\s*\[/.test(l))t=!0;if(!t){let d=/^(\s*)hooks\s*=\s*\[/.exec(l);if(d){let s=e+d[0].lastIndexOf("[");return{start:s,end:XL(n,s)}}}e=r===-1?n.length:r+1}return}function YL(n,t){let e=n.slice(0,t.end).trimEnd(),r=gl(n,t.end),a=r===""?"     ":`${r}  `,l=!e.endsWith("[")&&!e.endsWith(",");return`${e}${l?",":""}
+${a}${rr}${n.slice(t.end)}`}function SL(n){let t=jl(n);if(t&&n.slice(t.start+1,t.end).trim())return YL(n,t);let e=ZL(n).trimEnd();if(e==="")return`${er}
+`;return`${e}
+
+${er}
+`}function HL(n){return n.split(/(?=^\s*\[)/m).filter((e)=>!/^\s*\[\[hooks]]\s*$/m.test(e)||!e.includes(Qn)).join("").trimEnd()}function AL(n,t){let e=n.indexOf(rr,t.start);if(e===-1||e>t.end)return n;return bt(n,{start:e,end:e+rr.length})}function Fl(n){let t=ql(n);if(BL(JL(t),{recursive:!0}),!ml(t))return B(t,`${er}
+`),{path:t,alreadyInstalled:!1};let e=kl(t,"utf-8");if(e.includes(Qn))return{path:t,alreadyInstalled:!0};return B(t,SL(e)),{path:t,alreadyInstalled:!1}}function zl(n){let t=ql(n);if(!ml(t))return{path:t,alreadyInstalled:!1};let e=kl(t,"utf-8");if(!e.includes(Qn))return{path:t,alreadyInstalled:!1};let r=jl(e),a=r?AL(e,r):`${HL(e)}
+`;return B(t,a),{path:t,alreadyInstalled:!0}}import{existsSync as Bl,readFileSync as WL,rmSync as RL}from"node:fs";import{join as ar}from"node:path";var lr="cc-safety-net",KL=`${lr}@latest`,Zl=["opencode.json","opencode.jsonc"];function ML(n){return ar(n,".config","opencode",Zl[0])}function VL(n){return Zl.map((t)=>ar(n,".config","opencode",t))}function GL(n){return ar(n,".cache","opencode","packages",KL)}function dr(n){RL(GL(n),{recursive:!0,force:!0})}function ft(n,t){if(n[t]==="/"&&n[t+1]==="/"){let e=n.indexOf(`
+`,t+2);return e===-1?n.length:e+1}if(n[t]==="/"&&n[t+1]==="*"){let e=n.indexOf("*/",t+2);return e===-1?n.length:e+2}return t}function Jl(n,t){let e=t;while(e<n.length){if(/\s/.test(n[e]??"")){e++;continue}let r=ft(n,e);if(r===e)return e;e=r}return e}function Ql(n,t){let e=t+1,r=!1;while(e<n.length){if(r){r=!1,e++;continue}if(n[e]==="\\"){r=!0,e++;continue}if(n[e]==='"')return e+1;e++}throw Error("Unterminated string in OpenCode config")}function Xl(n,t,e){return JSON.parse(n.slice(t,e))}function CL(n,t){return vt(n,t,{skipComment:ft,stringError:"Unterminated string in OpenCode config",bracketError:"Unmatched plugin array in OpenCode config"})}function UL(n){let t=0,e=0;while(e<n.length){let r=ft(n,e);if(r!==e){e=r;continue}if(n[e]==='"'){let a=Ql(n,e);if(t===1&&Xl(n,e,a)==="plugin"){let l=Jl(n,a),d=Jl(n,l+1);if(n[l]===":"&&n[d]==="[")return{start:d,end:CL(n,d)}}e=a;continue}if(n[e]==="{"||n[e]==="[")t++;if(n[e]==="}"||n[e]==="]")t--;e++}return}function OL(n,t){let e=[],r=t.start+1;while(r<t.end){let a=ft(n,r);if(a!==r){r=a;continue}if(n[r]==='"'){let l=Ql(n,r),d=Xl(n,r,l);if(typeof d==="string"&&d.includes(lr))e.push({start:r,end:l});r=l;continue}r++}return e}function Yl(n,t){try{return JSON.parse(R(n))}catch(e){if(e instanceof SyntaxError)throw Error(`Failed to parse OpenCode config ${t}: ${e.message}`);throw e}}function TL(n){if(!n||typeof n!=="object"||Array.isArray(n))return!1;let t=n.plugin;if(!Array.isArray(t))return!1;return t.some((e)=>typeof e==="string"&&e.includes(lr))}function _L(n,t){let e=UL(n);if(!e)throw Error(`Failed to locate OpenCode plugin array in ${t}`);let r=[...OL(n,e)].reverse().reduce(bt,n);return Yl(r,t),r}function Sl(n){dr(n);let t=VL(n),e=t.find((a)=>Bl(a)),r=[];for(let a of t){if(!Bl(a))continue;try{let l=WL(a,"utf-8");if(!TL(Yl(l,a)))continue;return B(a,_L(l,a)),{path:a,alreadyInstalled:!0}}catch(l){r.push(l instanceof Error?l.message:String(l))}}if(r.length>0)throw Error(r.join(`
+`));return{path:e??ML(n),alreadyInstalled:!1}}var cr="safety-net@cc-marketplace",Hl=new Set(["claude-code","codex","copilot-cli","gemini-cli","hermes-agent","openclaw","opencode","pi"]),Al=new Set(["antigravity-cli","cursor","hermes-agent","kimi-code"]);function Lr(n){return/^\s*safety-net@cc-marketplace[^a-z0-9-][^\n]*installed,/m.test(n??"")}function Vl(n){return/^\s*cc-safety-net[^a-z0-9-][^\n]*installed,/m.test(n??"")}function PL(n){return/^Marketplace `cc-marketplace`\s*$/m.test(n??"")}var Gl={"claude-code":{installCommands:(n)=>{let t=Pn(n,"cc-safety-net@cc-marketplace");return{commands:[...t?[["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","update","cc-safety-net@cc-marketplace"]]:[["claude","plugin","marketplace","add","kenryu42/cc-marketplace"],["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","install","cc-safety-net@cc-marketplace"]],...we(n).status==="disabled"?[["claude","plugin","enable","cc-safety-net@cc-marketplace"]]:[]],cleanupCommands:Pn(n,cr)?[["claude","plugin","uninstall",cr]]:[],update:t}},uninstallCommands:[["claude","plugin","uninstall","cc-safety-net@cc-marketplace"],["claude","plugin","marketplace","remove","cc-marketplace"]]},codex:{installCommands:async(n,t)=>{let e=t??await e2(["codex","plugin","list"]),r=Vl(e);return{commands:[r||PL(e)?["codex","plugin","marketplace","upgrade","cc-marketplace"]:["codex","plugin","marketplace","add","kenryu42/cc-marketplace"],["codex","plugin","add","cc-safety-net@cc-marketplace"]],cleanupCommands:Lr(e)?[["codex","plugin","remove","safety-net@cc-marketplace"]]:[],update:r}},uninstallCommands:[["codex","plugin","remove","cc-safety-net@cc-marketplace"],["codex","plugin","marketplace","remove","cc-marketplace"]],postInstallMessage:"Start Codex, open `/hooks`, select the cc-safety-net PreToolUse hook, and press `t` to trust it."},"copilot-cli":{installCommands:async()=>{let n=await e2(["copilot","plugin","list"]),t=[...Ra(n)?[["copilot","plugin","uninstall","copilot-safety-net"]]:[],...Ka(n)?[["copilot","plugin","uninstall",Ha]]:[]];if(Aa(n))return{commands:[["copilot","plugin","marketplace","update","cc-marketplace"],["copilot","plugin","update",t2]],cleanupCommands:t,update:!0};return{commands:[Wa(await e2(["copilot","plugin","marketplace","list"]))?["copilot","plugin","marketplace","update","cc-marketplace"]:["copilot","plugin","marketplace","add","kenryu42/cc-marketplace"],["copilot","plugin","install",t2]],cleanupCommands:t}},uninstallCommands:[["copilot","plugin","uninstall","cc-safety-net@cc-marketplace"],["copilot","plugin","marketplace","remove","cc-marketplace"]]},"gemini-cli":{installCommands:(n)=>{let t=je(n);if(t.status==="configured")return{commands:[["gemini","extensions","update","gemini-safety-net"]],update:!0};if(t.status==="disabled")return{commands:[["gemini","extensions","update","gemini-safety-net"],["gemini","extensions","enable","gemini-safety-net"]],update:!0};return{commands:[["gemini","extensions","install","https://github.com/kenryu42/gemini-safety-net","--consent"]]}},uninstallCommands:[["gemini","extensions","uninstall","gemini-safety-net"]]},openclaw:{beforeInstall:We,installCommands:()=>({commands:x0()}),uninstallCommands:[["openclaw","plugins","uninstall",q,"--force"]],postInstallMessage:["Restart the OpenClaw Gateway to apply the change.","If plugins.allow is set in openclaw.json, it must also list cc-safety-net."].join(`
+`)},opencode:{beforeInstall:dr,installCommands:[["opencode","plugin","-g","-f","cc-safety-net@latest"]]},pi:{installCommands:[["pi","install","npm:cc-safety-net"]],uninstallCommands:[["pi","uninstall","npm:cc-safety-net"]]}};function wt(){return process.env.HOME??EL()}function Cl(n,t=(e)=>e){try{let e=JSON.parse(t(Ml(n,"utf-8")));if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Settings file ${n} must be a JSON object`);return e}catch(e){if(e instanceof SyntaxError)throw Error(`Failed to parse ${n}: ${e.message}`);throw e}}function IL(n){let t=sr(kn(n),"settings.json");if(!ir(t))return;let e=Cl(t,R),r=e.enabledPlugins;if(!r||typeof r!=="object"||Array.isArray(r))return;if(r[t2]!==!1)return;let a=Ml(t,"utf-8"),l=a.replace(new RegExp(`("${t2}"\\s*:\\s*)false`),"$1true");return r[t2]=!0,B(t,l!==a?l:`${JSON.stringify(e,null,2)}
+`),`Enabled ${t2} plugin in ${t}`}function NL(n){let t=Ke(n);if(!ir(t))return;let e=Cl(t);if(!Array.isArray(e.packages))return;let r=e.packages.find((a)=>!!a&&typeof a==="object"&&!Array.isArray(a)&&Me(a.source)&&("extensions"in a));if(!r)return;return delete r.extensions,B(t,`${JSON.stringify(e,null,2)}
+`),`Enabled npm:cc-safety-net extensions in ${t}`}function Wl(n,t){let e=F({label:t,booleans:Object.fromEntries(C.map((l)=>[l.target,[l.flag]]))},n),r=e.errors[0];if(r)throw Error(r);let a=C.filter((l)=>e.flags[l.target]).map((l)=>l.target);if(a.length!==1)throw Error(`Choose exactly one ${t} target: ${[...bl.keys()].join(", ")}`);return a[0]}async function Ul(n=wt(),t=_2){let[e,r,a]=await Promise.all([t(["amp","plugins","list"],30000),t(["codex","plugin","list"],30000),t(["copilot","--binary-version"])]);return{codexPluginListOutput:r,hooks:tn(process.cwd(),{homeDir:n,ampPluginListOutput:e,codexPluginListOutput:r,copilotCliVersion:a})}}async function n5(n,t=_2){let e=await Ul(wt(),t);return e.hooks.filter((r)=>n==="install"?r.configured:r.detected||r.inspectionStatus==="not-inspected").filter((r)=>r.platform!=="codex"||!Lr(e.codexPluginListOutput)||Vl(e.codexPluginListOutput)).map((r)=>r.platform)}function t5(n,t,e){if(t.length>0)return{finish:async()=>[Wl(t,n)]};if(!e.selectTargets&&!_e(e.input,e.output))return{finish:async()=>[Wl(t,n)]};let r=e.detectConfiguredTargets??(()=>n5(n,e.fetchVersion)),a=Promise.all([yl(e.probeTargets),r()]);return{ready:a,finish:async()=>{let[l,d]=await a,s=wl(l,{action:n,configuredTargets:d}),c=e.selectTargets?await e.selectTargets(n,Kl(n,s)):await _0(n,Kl(n,s),{input:e.input,output:e.output});if(c==="update")return c;if(!c||c.length===0)return null;return Ne(c)}}}async function B2(n,t,e=!1,r){let a=Gl[n];a.beforeInstall?.(t);let l=typeof a.installCommands==="function"?await a.installCommands(t,r):{commands:a.installCommands};return await He(l.commands),await v0(l.cleanupCommands??[]),[`${l.update||e?"Updated":"Installed"} ${b2(n)} integration`,a.postInstallMessage].filter(Boolean).join(`
+`)}async function rn(n){let t=Gl[n];if(!t.uninstallCommands)throw Error(`${b2(n)} uninstall is not supported`);return await He(t.uninstallCommands),`Uninstalled ${b2(n)} integration`}function e5(n){let t=Sl(n);return t.alreadyInstalled?`Uninstalled OpenCode plugin from ${t.path}`:`OpenCode plugin not installed in ${t.path}`}var r5={"antigravity-cli":{install:ol,uninstall:vl},cursor:{install:Pa,uninstall:Ia},"kimi-code":{install:Fl,uninstall:zl}};function an(n,t,e,r=!1){if(n==="install"&&!r)ot(e);let a=r5[t][n](e),l=b2(t),d=n!=="install"?"Uninstalled":r?"Updated":"Installed";return n==="install"&&a.alreadyInstalled?r?`${l} hook up to date in ${a.path}`:`${l} hook already installed in ${a.path}`:n==="uninstall"&&!a.alreadyInstalled?`${l} hook not installed in ${a.path}`:`${d} ${l} hook ${n==="install"?"in":"from"} ${a.path}`}var a5={amp:{install:sl,uninstall:cl,restartNote:'Amp personal plugins apply to every Amp session, including Orb threads. Restart Amp or run "plugins: reload" to apply the change.'},"hermes-agent":{install:a0,uninstall:l0,afterInstall:async(n)=>{let t=Xe(n);return await e2(["hermes","plugins","enable",M,"--no-allow-tool-override"]),!t},beforeUninstall:async(n)=>{Qe(n);try{await e2(["hermes","plugins","disable",M])}catch(t){console.warn(`${t instanceof Error?t.message:String(t)}
+Removing the plugin files anyway; ${M} may still be listed in the Hermes config.`)}},restartNote:"Restart Hermes to apply the change."}};async function ht(n,t,e,r=!1){let a=a5[t];if(n==="uninstall")await a.beforeUninstall?.(e);let l=n==="install"?await a.install(e):await a.uninstall(e),d=n==="install"&&await a.afterInstall?.(e),s=b2(t),c=!d&&(n==="install"&&l.alreadyInstalled||n==="uninstall"&&!l.alreadyInstalled);return[c?n==="install"?`${s} plugin ${r?"up to date":"already installed"} at ${l.path}`:`${s} plugin not installed at ${l.path}`:`${n!=="install"?"Uninstalled":r?"Updated":"Installed"} ${s} plugin ${n==="install"?"at":"from"} ${l.path}`,c?void 0:a.restartNote].filter(Boolean).join(`
+`)}var l5={amp:{install:(n,t)=>ht("install","amp",n,t),uninstall:(n)=>ht("uninstall","amp",n)},"antigravity-cli":{install:(n,t)=>an("install","antigravity-cli",n,t),uninstall:(n)=>an("uninstall","antigravity-cli",n)},"claude-code":{install:(n,t)=>B2("claude-code",n,t),uninstall:()=>rn("claude-code")},codex:{install:(n,t,e)=>B2("codex",n,t,e),uninstall:()=>rn("codex")},"copilot-cli":{install:async(n,t)=>[await B2("copilot-cli",n,t),IL(n)].filter(Boolean).join(`
+`),uninstall:()=>rn("copilot-cli")},cursor:{install:(n,t)=>an("install","cursor",n,t),uninstall:(n)=>an("uninstall","cursor",n)},"gemini-cli":{install:(n,t)=>B2("gemini-cli",n,t),uninstall:()=>rn("gemini-cli")},"hermes-agent":{install:(n,t)=>{if(!t)ot(n);return ht("install","hermes-agent",n,t)},uninstall:(n)=>ht("uninstall","hermes-agent",n)},"kimi-code":{install:(n,t)=>an("install","kimi-code",n,t),uninstall:(n)=>an("uninstall","kimi-code",n)},openclaw:{install:async(n,t)=>{let e=await B2("openclaw",n,t);return await $0(),e},uninstall:(n)=>{return We(n),rn("openclaw")}},opencode:{install:(n,t)=>B2("opencode",n,t),uninstall:(n)=>e5(n)},pi:{install:async(n,t)=>[await B2("pi",n,t),NL(n)].filter(Boolean).join(`
+`),uninstall:()=>rn("pi")}},Rl=["Install CC Safety Net as a native Kimi Code plugin:","","  1. Start Kimi Code and run: /plugins install https://github.com/kenryu42/cc-safety-net","     Confirm the trust prompt; it defaults to cancel.","  2. Run /reload, or start a new session.","","Note: Kimi Code hooks are fail-open. When the hook process cannot start, crashes, or times","out, Kimi Code allows the tool call."].join(`
+`);function d5(n){if(Fn({homeDir:n,cwd:process.cwd()}).status!=="configured")return Rl;return[Rl,"",b.red(["CAUTION: the global Kimi Code hook is installed and will run alongside the plugin.","After the plugin is active, remove it with: cc-safety-net uninstall --kimi-code"].join(`
 `))].join(`
-`)}function Rl(n,t){return t.map((r)=>n==="install"&&r.target==="kimi-code"&&r.unavailableReason==="already installed"?{...r,available:!0,unavailableReason:void 0,label:`${r.label} (global hook installed)`}:r)}function d5(n,t){if(n.selectKimiInstallMethod)return n.selectKimiInstallMethod();if(!Or(n.input,n.output))return Promise.resolve("global-hook");return T0({input:n.input,output:n.output,globalHookInstalled:qn({homeDir:t,cwd:process.cwd()}).status==="configured"})}async function Ul(n,t,r,e=!1){return a5[t][n](r,e)}function s5(n){let t=F({label:"update"},n).errors[0];if(t)throw Error(t)}async function L5(n,t=k2){let r=await Cl(n,t),e=de(Dn(n),"installed-plugins");return Pr([...r.hooks.filter((a)=>a.platform!=="copilot-cli"&&a.detected).map((a)=>a.platform),...[Pn,Sa,Ya].flatMap((a)=>Le(de(e,...a))?["copilot-cli"]:[]),..._n(n,se)?["claude-code"]:[],...ce(r.codexPluginListOutput)?["codex"]:[]])}async function c5(n=k2){let t=ft(),r=await L5(t,n);if(r.length===0)return console.log("No installed integrations found. Run `cc-safety-net install` to set one up."),0;let e=new Set(r),a=new Map(await Promise.all(C.filter((d)=>e.has(d.target)&&Hl.has(d.target)).map(async(d)=>[d.target,await Nr(d.probeCommand)]))),l=[];for(let d of r){if(Hl.has(d)&&!a.get(d)){console.log(`${b2(d)} not found; skipped`);continue}try{console.log(await Ul("install",d,t,!0))}catch(s){console.error(pe(s)),l.push(d)}}return l.length>0?1:0}function ie(n,t=k2){return Promise.resolve().then(()=>s5(n)).then(()=>c5(t)).catch((r)=>{return console.error(pe(r)),1})}async function Zn(n,t,r={}){try{let e=await On(!0,()=>n5(n,t,r),()=>Un({input:r.input??process.stdin,output:r.output??process.stdout}),{loadingMessage:n==="install"?"Checking available integrations…":"Checking installed integrations…",output:r.output??process.stdout});if(!e)return(r.output??process.stdout).write(`Cancelled: nothing was ${n}ed.
-`),0;if(e==="update")return(r.runUpdate??(()=>ie([])))();let a=ft(),l=r.output??process.stdout;return await fl(e,async(d)=>{if(d==="kimi-code"&&n==="install"){let L=await d5(r,a);if(L===null){l.write(`Cancelled: Kimi Code integration was not installed.
-`);return}if(L==="plugin"){l.write(`${l5(a)}
-`);return}}let s=await br(Ul(n,d,a),{loadingMessage:`${n==="install"?"Installing":"Uninstalling"} ${b2(d)} integration…`,output:l});l.write(`${s}
-`)}),0}catch(e){return console.error(pe(e)),1}}function pe(n){let t=n instanceof Error?n.message:String(n),r=typeof n==="object"&&n!==null&&"code"in n?n.code:null;if(r==="EACCES"||r==="EPERM")return`${t}
-Check file permissions for the target config file and parent directory.`;if(r==="ENOENT")return`${t}
-Check that the target config path and parent directory exist.`;if(r==="ENOTDIR")return`${t}
-Check that every parent path component is a directory.`;return t}import{join as O5}from"node:path";var Ol="# Custom Rules Reference\n\nAgent reference for generating CC Safety Net rulebook configuration.\n\n## Config Locations\n\n| Scope | Config path | Rulebook path | Cache path | Priority |\n|-------|-------------|---------------|------------|----------|\n| User | `~/.cc-safety-net/rules/rule.json` | `~/.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `~/.cc-safety-net/cache/rulebooks/` | First |\n| Project | `.cc-safety-net/rules/rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `.cc-safety-net/cache/rulebooks/` | Second |\n| GitHub source | Listed in a local `rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` in the source repository | Consumer local cache | Source order |\n\nUser scope is evaluated before project scope; within a scope, sources apply in `rules` array order. A duplicate active rulebook name keeps the first claim and ignores the later rulebook with a warning, so a user-scoped name shadows a project-scoped one.\n\nUse `cc-safety-net rule init` to create an inert local config. Use `--global` for user scope. Use `cc-safety-net rule init --example` to also create an inactive example rulebook. `CC_SAFETY_NET_HOME` overrides the `~/.cc-safety-net` user root.\n\nLegacy inline `.safety-net.json` and `~/.cc-safety-net/config.json` files are not loaded at runtime. Convert them with `cc-safety-net rule migrate`.\n\n## rule.json Schema\n\n```json\n{\n  \"version\": 1,\n  \"rules\": [\"project-rules\", \"owner/repo#main/team-rules\"],\n  \"overrides\": {\n    \"project-rules/block-docker-system-prune\": {\n      \"reason\": \"Use targeted Docker cleanup commands.\"\n    },\n    \"team-rules/block-npm-global\": \"off\"\n  },\n  \"transparent_wrappers\": [\"rtk\"]\n}\n```\n\n- `version`: Required. Must be `1`.\n- `$schema`: Optional. `cc-safety-net rule verify` inserts it into a valid `rule.json` that lacks it.\n- `rules`: Optional array of rulebook source strings. Missing `rules` is treated as `[]`.\n- `overrides`: Optional object keyed by `<rulebook-name>/<rule-name>`.\n- `overrides` values are either `\"off\"` to disable a rule or an object with a required `reason` (replacement block reason) and an optional `intent` (one of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain`).\n- A project override cannot target a user-scoped rule: only that override is ignored, the user rule keeps its configured state, and `rule sync`/`rule verify` report the diagnostic as a failure.\n- `transparent_wrappers`: Optional array of command names that transparently execute a visible child command.\n- Transparent wrappers have no built-in defaults. Configure only wrappers you intentionally trust, such as `\"rtk\"`.\n- Use `cc-safety-net rule wrapper add rtk` to configure RTK without manually editing `rule.json`.\n\n## Rulebook Sources\n\n- Local sources are bare rulebook names such as `project-rules`; the rulebook file is `.cc-safety-net/rules/project-rules/rulebook.json`.\n- GitHub sources use `owner/repo#ref/<rulebook-name>`.\n- GitHub refs must be one path segment, such as a tag, SHA, or branch name without `/`.\n- The GitHub source name, the repository directory name, and the rulebook `name` must match exactly.\n- Rulebook source strings must be unique in a config.\n\n## rulebook.json Schema\n\n```json\n{\n  \"rulebook_version\": 1,\n  \"name\": \"project-rules\",\n  \"version\": \"1.0.0\",\n  \"description\": \"Project-specific CC Safety Net rules.\",\n  \"author\": \"project\",\n  \"allowed_commands\": [\"docker\"],\n  \"rules\": [\n    {\n      \"name\": \"block-docker-system-prune\",\n      \"command\": \"docker\",\n      \"subcommand\": \"system\",\n      \"block_args\": [\"prune\"],\n      \"reason\": \"Use targeted cleanup instead.\"\n    }\n  ],\n  \"tests\": [\n    {\n      \"command\": \"docker system prune\",\n      \"expect\": \"blocked\",\n      \"rule\": \"block-docker-system-prune\"\n    },\n    {\n      \"command\": \"docker ps\",\n      \"expect\": \"allowed\"\n    }\n  ]\n}\n```\n\n### Rulebook Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `rulebook_version` | Yes | Must be `1` |\n| `name` | Yes | `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$` |\n| `version` | Yes | Non-empty string |\n| `description` | No | Free text; not type-checked at runtime |\n| `author` | No | Free text; not type-checked at runtime |\n| `allowed_commands` | Yes | Unique command names matching `^[a-zA-Z][a-zA-Z0-9_-]*$` |\n| `rules` | Yes | Array of rule objects |\n| `tests` | No | Array of fixtures |\n\n### Rule Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Unique within the rulebook (case-insensitive); same pattern as rulebook `name` |\n| `command` | Yes | Must be listed in `allowed_commands`; basename only, not path |\n| `subcommand` | No | Same pattern as `command`; omit to match any subcommand |\n| `intent` | No | One of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain` |\n| `block_args` | Yes | Non-empty array of non-empty strings |\n| `reason` | Yes | Non-empty string, max 256 chars |\n\n### Test Fixture Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `command` | Yes | Non-empty shell command string |\n| `expect` | Yes | `\"blocked\"` or `\"allowed\"` |\n| `rule` | Required for blocked fixtures | Rule name expected to block the command |\n\nFixtures are optional documentation of intended behavior. Fixtures are shape-validated only; CC Safety Net does not execute them.\n\n## Matching Behavior\n\n- **Command**: Normalized to lowercase basename with any trailing `.exe` removed (`/usr/bin/git` → `git`).\n- **Subcommand**: The first command token after recognized Git and Docker global options and their values; `--` ends option parsing. An unrecognized option without `=` may consume the following token as its value.\n- **Arguments**: Each `block_args` value is compared literally against every command token, including expanded short options. The command is blocked if **any** item matches.\n- **Short options**: Expanded (`-Ap` matches `-A`).\n- **Long options**: Exact match (`--all-files` does not match `--all`).\n- **Execution order**: Built-in rules first, then custom rulebooks. Custom rules only add restrictions.\n- **Transparent wrappers**: A configured wrapper such as `rtk` lets `rtk git commit` be analyzed as `git commit` only when `git` is protected by built-in analyzers or active custom rules. `rtk -- git commit` is also supported.\n\n## Workflow\n\n1. Run `cc-safety-net rule init` or create `rule.json` manually.\n2. Optionally run `cc-safety-net rule init --example` to create an inactive example rulebook.\n3. Use `cc-safety-net rule wrapper add rtk` for trusted transparent wrappers.\n4. Run `cc-safety-net rule add <source>` after creating or choosing a rulebook source; it adds the source and syncs it.\n5. Run `cc-safety-net rule sync` after manual `rule.json` changes or local rulebook edits.\n6. Run `cc-safety-net rule verify` to validate config, lock/cache state, local rulebooks, and shareable GitHub-source rulebook directories in the current repository (it does not fetch remote content).\n7. Run `cc-safety-net rule list` to inspect active rulebooks and transparent wrappers.\n\nAn edited or invalid local rulebook keeps its last synced, digest-verified cached version enforced until `cc-safety-net rule sync` validates the edit. A missing lock entry or cache, a cache digest mismatch, or an invalid cached rulebook makes that source inactive; a missing lockfile or an unreadable or invalid `rule.json` makes every source in its scope inactive. Inactive sources stop applying their rules while other custom rules and all built-in protections stay active. Repair the reported condition, then run `cc-safety-net rule sync`. Run `cc-safety-net status` to see degraded sources.\n";function Qn(n,t){if(!n.ok){o5(n);return}v5(n),console.log(t),console.log("Rule config synced."),console.log(""),i5(n.entries)}function i5(n){if(n.length===0){console.log("Active rulebooks: (none)");return}console.log(`Active rulebooks (${n.length}):`);for(let t of n)console.log(`  - ${t.name} ${t.version} (${p5(t.ruleCount??0)})`),console.log(`    Source: ${Gt(t)}`)}function p5(n){return`${n} ${n===1?"rule":"rules"}`}function El(n,t){Z2("Active sources",n.rulebooks,(r)=>[`[${r.source}] ${r.name} ${r.version}`,`  Source: ${t[r.source].get(r.spec)??r.spec}`]),Z2("Active rules",n.rules,(r)=>[`[${u5(n,r.name)}] ${r.name}`,`  Command: ${r.subcommand?`${r.command} ${r.subcommand}`:r.command}`,`  Block args: ${r.block_args.join(", ")}`,`  Reason: ${r.reason}`]),Z2("Disabled rules",Tl(n,"off"),(r)=>[r.key]),Z2("Reason overrides",Tl(n,"reason"),(r)=>[r.key,`  Reason: ${r.value.reason}`]),Z2("Transparent wrappers",n.transparent_wrappers,(r)=>[r]),Z2("Issues",n.errors,(r)=>[r]),Z2("Warnings",n.warnings,(r)=>[r])}function Z2(n,t,r){if(t.length===0){console.log(`${n}: (none)`);return}console.log(`${n} (${t.length}):`);for(let e of t){let[a,...l]=r(e);console.log(`  - ${a}`);for(let d of l)console.log(`    ${d}`)}}function u5(n,t){return n.rulebooks.find((r)=>r.rules.includes(t))?.source??"project"}function Tl(n,t){return Object.entries({...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}}).filter((r)=>{if(t==="off")return r[1]==="off";return!!r[1]&&typeof r[1]==="object"}).map(([r,e])=>({key:r,value:e}))}function o5(n){for(let t of n.errors)console.error(t)}function v5(n){if(!n.warnings||n.warnings.length===0)return;for(let t of n.warnings)console.warn(t)}import{dirname as _l,join as yt}from"node:path";var b5=".safety-net.json",f5="~/.cc-safety-net/config.json";async function Nl(n){return[await Pl({legacyPath:Il({cwd:n.cwd}),configPath:E(n.cwd),defaultRulebookName:"project-rules",migratedFrom:b5,cleanup:n.cleanup,syncOptions:{cwd:n.cwd}}),await Pl({legacyPath:pn(),configPath:_(),defaultRulebookName:"user-rules",migratedFrom:f5,cleanup:n.cleanup,syncOptions:{cwd:n.cwd,global:!0}})].every((r)=>r)?0:1}async function Pl(n){let t=U(n.syncOptions),r=D(t.filesystemScope,n.legacyPath),e=g(r);if(e===null)return console.log(`No legacy config found at ${n.legacyPath}`),!0;let a=h5(e);if(!a.ok){for(let v of a.errors)console.error(v);return!1}let l=O(t.configTarget);if(l.errors.length>0){for(let v of l.errors)console.error(v);return!1}let d=l.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},s=w5(_l(n.configPath),d.rules,n.defaultRulebookName,n.migratedFrom,t.filesystemScope),L=yt(_l(n.configPath),s,"rulebook.json"),c=D(t.filesystemScope,L),i=[ue(t.configTarget),ue(c),ue(t.lockTarget)],u=await y5(n,t.configTarget,c,s,a.config.rules,d.rules.includes(s)?d.rules:[...d.rules,s],d.overrides??{},d.transparent_wrappers??[]);if(!u.ok){g5(i);for(let v of u.errors)console.error(v);return!1}if(!n.cleanup)return console.log(`Migrated legacy config at ${n.legacyPath}. Legacy file is no longer used.`),!0;if(!$5(t.configTarget,c,s,n.migratedFrom,a.config.rules))return console.error(`Migration cleanup verification failed for ${n.legacyPath}`),!1;return Ln(r),console.log(`Deleted legacy config at ${n.legacyPath}`),!0}async function y5(n,t,r,e,a,l,d,s){try{return T(t,{version:1,rules:l,overrides:d,transparent_wrappers:s}),T(r,x5(e,n.migratedFrom,a)),await R2(n.syncOptions)}catch(L){return{ok:!1,errors:[L instanceof Error?L.message:String(L)]}}}function h5(n){try{let t=JSON.parse(n),r=Jt(t);if(r.errors.length>0)return{ok:!1,errors:r.errors};return{ok:!0,config:{version:1,rules:t.rules??[]}}}catch{return{ok:!1,errors:["Invalid JSON"]}}}function w5(n,t,r,e,a){let l=t.find((d)=>D5(D(a,yt(n,d,"rulebook.json")))===e);if(l)return l;if(g(D(a,yt(n,r,"rulebook.json")))===null)return r;for(let d=2;;d++){let s=`${r}-${d}`;if(g(D(a,yt(n,s,"rulebook.json")))===null)return s}}function x5(n,t,r){return{rulebook_version:1,name:n,version:"1.0.0",description:"Migrated CC Safety Net rules.",author:"project",migrated_from:t,allowed_commands:[...new Set(r.map((e)=>e.command))],rules:r,tests:r.map((e)=>({command:[e.command,e.subcommand,e.block_args[0]].filter(Boolean).join(" "),expect:"blocked",rule:e.name}))}}function $5(n,t,r,e,a){if(!O(n).config?.rules.includes(r))return!1;try{let d=g(t);if(d===null)return!1;let s=JSON.parse(d);return s.migrated_from===e&&JSON.stringify(s.rules)===JSON.stringify(a)}catch{return!1}}function ue(n){return{target:n,content:g(n)}}function g5(n){for(let t of n){if(t.content===null){Ln(t.target);continue}w2(t.target,t.content)}}function D5(n){let t=g(n);if(t===null)return null;try{let r=JSON.parse(t);return typeof r.migrated_from==="string"?r.migrated_from:null}catch{return null}}import{mkdir as m5,readFile as k5,writeFile as q5}from"node:fs/promises";import{dirname as j5,join as F5}from"node:path";var z5=86400000,B5=604800000;async function t3(n=Date.now()){if(process.env.CC_SAFETY_NET_NO_UPDATE_CHECK)return null;let t=Ot();if(!t)return null;let r=F5(t,".cc-safety-net","update-check.json"),e=await J5(r,n);if(!e.lastCheck||n-e.lastCheck>z5){let d=await _2();if(e.lastCheck=n,d.latestVersion)e.latestVersion=d.latestVersion;if(!await n3(r,e))return null;if(d.error)return null}let a=e.latestVersion,l=j();if(!a||!pr(a,l))return null;if(e.notifiedVersion===a&&e.notifiedAt!==void 0&&n-e.notifiedAt<B5)return null;if(e.notifiedVersion=a,e.notifiedAt=n,!await n3(r,e))return null;return`UPDATE_AVAILABLE: cc-safety-net v${a} is available (running v${l}). Ask the user once whether to run \`npx -y cc-safety-net@latest update\`; continue the current task either way and do not raise this again.`}async function J5(n,t){let r=await k5(n,"utf8").then((l)=>JSON.parse(l)).catch(()=>{return});if(!r||typeof r!=="object"||Array.isArray(r))return{};let e=r,a=(l)=>typeof l==="number"&&Number.isFinite(l)&&l<=t?l:void 0;return{lastCheck:a(e.lastCheck),latestVersion:typeof e.latestVersion==="string"?e.latestVersion:void 0,notifiedVersion:typeof e.notifiedVersion==="string"?e.notifiedVersion:void 0,notifiedAt:a(e.notifiedAt)}}async function n3(n,t){return m5(j5(n),{recursive:!0,mode:448}).then(()=>q5(n,JSON.stringify(t),{mode:384})).then(()=>!0).catch(()=>!1)}import{dirname as Z5,join as Q5,resolve as oe}from"node:path";var e3="CC Safety Net Config",X5="═".repeat(e3.length),Y5="https://raw.githubusercontent.com/kenryu42/cc-safety-net/main/assets/cc-safety-net.schema.json",S5=new Set(["rule.json","rule.lock","cache"]);function a3(n={}){try{return H5(n)}catch(t){if(t instanceof Z)return console.error(t.message),1;throw t}}function H5(n){let t=n.cwd??process.cwd(),r=n.userConfigPath??_(),e=n.projectConfigPath??E(t),a=n.legacyUserConfigPath??pn(),l=n.legacyProjectConfigPath??Se(t),d=oe(t,Vt),s=Z5(r),L=P({cwd:t,userConfigPath:r,projectConfigPath:e}),c=P({cwd:t}),i=D(L.userScope,r),u=D(L.projectScope,e),v=n.legacyUserConfigPath?sn(n.legacyUserConfigPath,"user policy"):D(c.userScope,a),p=n.legacyProjectConfigPath?sn(n.legacyProjectConfigPath,"project policy"):D(c.projectScope,l),f=!1,o=!1,y=[],x=[],w=A5(D(c.projectScope,d));if(R5(),g(i)!==null){let h=a2(i);if(h.errors.push(...l2(r,K2({userConfigDir:s}),{userConfigDir:s},L.userScope)),y.push({scope:"User",path:r,result:h,schema:"rules",sourceDisplayMap:x2(r,L.userScope),target:i}),h.errors.length>0)f=!0}if(g(v)!==null)if(o=!0,g(i)!==null)x.push(ht("user","cleanup"));else{let h=Zt(v);if(y.push({scope:"User",path:a,result:h,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:v}),x.push(ht("user",h.errors.length>0?"fix-or-delete":"migrate")),h.errors.length>0)f=!0}if(g(u)!==null){let h=a2(u);if(h.errors.push(...l2(e,M2(e),{userConfigDir:s},L.projectScope)),y.push({scope:"Project",path:oe(e),result:h,schema:"rules",sourceDisplayMap:x2(e,L.projectScope),target:u}),h.errors.length>0)f=!0;if(g(p)!==null)o=!0,x.push(ht("project","cleanup"))}else if(g(p)!==null){o=!0,f=!0;let h=Zt(p);y.push({scope:"Project",path:oe(l),result:h,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:p}),x.push(ht("project",h.errors.length>0?"fix-or-delete":"migrate"))}if(w?.result.errors.length)f=!0;if(y.length===0&&!w)return console.log(`
-No config files found. Using built-in rules only.`),0;for(let h of y)if(h.inactive)M5(h.scope,h.path,h.result,h.sourceDisplayMap);else if(h.result.errors.length>0)V5(h.scope,h.path,h.result.errors);else{if(h.schema==="rules"&&U5(h.target))console.log(`
-Added $schema to ${h.scope.toLowerCase()} config.`);K5(h.scope,h.path,h.result,h.schema,h.sourceDisplayMap)}for(let h of x)console.error(`
-${b.red(h)}`);if(w)if(w.result.errors.length>0)C5(w.path,w.result.errors);else G5(w.path,w.result);if(f)return console.error(`
+`)}function Kl(n,t){return t.map((e)=>n==="install"&&e.target==="kimi-code"&&e.unavailableReason==="already installed"?{...e,available:!0,unavailableReason:void 0,label:`${e.label} (global hook installed)`}:e)}function s5(n,t){if(n.selectKimiInstallMethod)return n.selectKimiInstallMethod();if(!_e(n.input,n.output))return Promise.resolve("global-hook");return T0({input:n.input,output:n.output,globalHookInstalled:Fn({homeDir:t,cwd:process.cwd()}).status==="configured"})}async function Ol(n,t,e,r=!1,a){return l5[t][n](e,r,a)}function c5(n){let t=F({label:"update"},n).errors[0];if(t)throw Error(t)}async function i5(n,t=_2){let e=await Ul(n,t),r=sr(kn(n),"installed-plugins");return{targets:Ne([...e.hooks.filter((l)=>l.platform!=="copilot-cli"&&l.detected).map((l)=>l.platform),...[In,Sa,Ya].flatMap((l)=>ir(sr(r,...l))?["copilot-cli"]:[]),...Pn(n,cr)?["claude-code"]:[],...Lr(e.codexPluginListOutput)?["codex"]:[]]),codexPluginListOutput:e.codexPluginListOutput}}async function L5(n){let t=wt(),e=n.output??process.stdout,r=i5(t,n.fetchVersion??_2).then(async(s)=>{let c=new Set(s.targets);return{targets:s.targets,codexPluginListOutput:s.codexPluginListOutput,available:new Map(await Promise.all(C.filter((i)=>c.has(i.target)&&Hl.has(i.target)).map(async(i)=>[i.target,await tr(i.probeCommand)])))}}),a=await Dn(n.showBanner??!0,()=>({ready:r,finish:()=>r}),()=>gn({input:n.input??process.stdin,output:e}),{loadingMessage:"Checking installed integrations…",output:e});if(a.targets.length===0)return e.write("No installed integrations found. Run `cc-safety-net install` to set one up.\n"),0;let l=a.targets.some((s)=>Al.has(s))?await Promise.resolve().then(()=>{return ot(t),null}).catch((s)=>yt(s)):null,d=await Tn(Promise.all(a.targets.map((s)=>{if(Hl.has(s)&&!a.available.get(s))return Promise.resolve({message:`${b2(s)} not found; skipped`,failed:!1});if(l!==null&&Al.has(s))return Promise.resolve({message:l,failed:!0});return Ol("install",s,t,!0,a.codexPluginListOutput).then((c)=>({message:c,failed:!1}),(c)=>({message:yt(c),failed:!0}))})),{loadingMessage:`Updating ${a.targets.length} integration${a.targets.length===1?"":"s"}…`,output:e});return d.forEach((s)=>{s.failed?console.error(s.message):e.write(`${s.message}
+`)}),d.some((s)=>s.failed)?1:0}function pr(n,t={}){return Promise.resolve().then(()=>c5(n)).then(()=>L5(t)).catch((e)=>{return console.error(yt(e)),1})}async function Xn(n,t,e={}){try{let r=await Dn(!0,()=>t5(n,t,e),()=>gn({input:e.input??process.stdin,output:e.output??process.stdout}),{loadingMessage:n==="install"?"Checking available integrations…":"Checking installed integrations…",output:e.output??process.stdout});if(!r)return(e.output??process.stdout).write(`Cancelled: nothing was ${n}ed.
+`),0;if(r==="update")return(e.runUpdate??(()=>pr([],{fetchVersion:e.fetchVersion,input:e.input,output:e.output,showBanner:!1})))();let a=wt(),l=e.output??process.stdout;return await fl(r,async(d)=>{if(d==="kimi-code"&&n==="install"){let c=await s5(e,a);if(c===null){l.write(`Cancelled: Kimi Code integration was not installed.
+`);return}if(c==="plugin"){l.write(`${d5(a)}
+`);return}}let s=await Tn(Ol(n,d,a),{loadingMessage:`${n==="install"?"Installing":"Uninstalling"} ${b2(d)} integration…`,output:l});l.write(`${s}
+`)}),0}catch(r){return console.error(yt(r)),1}}function yt(n){let t=n instanceof Error?n.message:String(n),e=typeof n==="object"&&n!==null&&"code"in n?n.code:null;if(e==="EACCES"||e==="EPERM")return`${t}
+Check file permissions for the target config file and parent directory.`;if(e==="ENOENT")return`${t}
+Check that the target config path and parent directory exist.`;if(e==="ENOTDIR")return`${t}
+Check that every parent path component is a directory.`;return t}import{join as T5}from"node:path";var Tl="# Custom Rules Reference\n\nAgent reference for generating CC Safety Net rulebook configuration.\n\n## Config Locations\n\n| Scope | Config path | Rulebook path | Cache path | Priority |\n|-------|-------------|---------------|------------|----------|\n| User | `~/.cc-safety-net/rules/rule.json` | `~/.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `~/.cc-safety-net/cache/rulebooks/` | First |\n| Project | `.cc-safety-net/rules/rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `.cc-safety-net/cache/rulebooks/` | Second |\n| GitHub source | Listed in a local `rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` in the source repository | Consumer local cache | Source order |\n\nUser scope is evaluated before project scope; within a scope, sources apply in `rules` array order. A duplicate active rulebook name keeps the first claim and ignores the later rulebook with a warning, so a user-scoped name shadows a project-scoped one.\n\nUse `cc-safety-net rule init` to create an inert local config. Use `--global` for user scope. Use `cc-safety-net rule init --example` to also create an inactive example rulebook. `CC_SAFETY_NET_HOME` overrides the `~/.cc-safety-net` user root.\n\nLegacy inline `.safety-net.json` and `~/.cc-safety-net/config.json` files are not loaded at runtime. Convert them with `cc-safety-net rule migrate`.\n\n## rule.json Schema\n\n```json\n{\n  \"version\": 1,\n  \"rules\": [\"project-rules\", \"owner/repo#main/team-rules\"],\n  \"overrides\": {\n    \"project-rules/block-docker-system-prune\": {\n      \"reason\": \"Use targeted Docker cleanup commands.\"\n    },\n    \"team-rules/block-npm-global\": \"off\"\n  },\n  \"transparent_wrappers\": [\"rtk\"]\n}\n```\n\n- `version`: Required. Must be `1`.\n- `$schema`: Optional. `cc-safety-net rule verify` inserts it into a valid `rule.json` that lacks it.\n- `rules`: Optional array of rulebook source strings. Missing `rules` is treated as `[]`.\n- `overrides`: Optional object keyed by `<rulebook-name>/<rule-name>`.\n- `overrides` values are either `\"off\"` to disable a rule or an object with a required `reason` (replacement block reason) and an optional `intent` (one of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain`).\n- A project override cannot target a user-scoped rule: only that override is ignored, the user rule keeps its configured state, and `rule sync`/`rule verify` report the diagnostic as a failure.\n- `transparent_wrappers`: Optional array of command names that transparently execute a visible child command.\n- Transparent wrappers have no built-in defaults. Configure only wrappers you intentionally trust, such as `\"rtk\"`.\n- Use `cc-safety-net rule wrapper add rtk` to configure RTK without manually editing `rule.json`.\n\n## Rulebook Sources\n\n- Local sources are bare rulebook names such as `project-rules`; the rulebook file is `.cc-safety-net/rules/project-rules/rulebook.json`.\n- GitHub sources use `owner/repo#ref/<rulebook-name>`.\n- GitHub refs must be one path segment, such as a tag, SHA, or branch name without `/`.\n- The GitHub source name, the repository directory name, and the rulebook `name` must match exactly.\n- Rulebook source strings must be unique in a config.\n\n## rulebook.json Schema\n\n```json\n{\n  \"rulebook_version\": 1,\n  \"name\": \"project-rules\",\n  \"version\": \"1.0.0\",\n  \"description\": \"Project-specific CC Safety Net rules.\",\n  \"author\": \"project\",\n  \"allowed_commands\": [\"docker\"],\n  \"rules\": [\n    {\n      \"name\": \"block-docker-system-prune\",\n      \"command\": \"docker\",\n      \"subcommand\": \"system\",\n      \"block_args\": [\"prune\"],\n      \"reason\": \"Use targeted cleanup instead.\"\n    }\n  ],\n  \"tests\": [\n    {\n      \"command\": \"docker system prune\",\n      \"expect\": \"blocked\",\n      \"rule\": \"block-docker-system-prune\"\n    },\n    {\n      \"command\": \"docker ps\",\n      \"expect\": \"allowed\"\n    }\n  ]\n}\n```\n\n### Rulebook Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `rulebook_version` | Yes | Must be `1` |\n| `name` | Yes | `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$` |\n| `version` | Yes | Non-empty string |\n| `description` | No | Free text; not type-checked at runtime |\n| `author` | No | Free text; not type-checked at runtime |\n| `allowed_commands` | Yes | Unique command names matching `^[a-zA-Z][a-zA-Z0-9_-]*$` |\n| `rules` | Yes | Array of rule objects |\n| `tests` | No | Array of fixtures |\n\n### Rule Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Unique within the rulebook (case-insensitive); same pattern as rulebook `name` |\n| `command` | Yes | Must be listed in `allowed_commands`; basename only, not path |\n| `subcommand` | No | Same pattern as `command`; omit to match any subcommand |\n| `intent` | No | One of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain` |\n| `block_args` | Yes | Non-empty array of non-empty strings |\n| `reason` | Yes | Non-empty string, max 256 chars |\n\n### Test Fixture Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `command` | Yes | Non-empty shell command string |\n| `expect` | Yes | `\"blocked\"` or `\"allowed\"` |\n| `rule` | Required for blocked fixtures | Rule name expected to block the command |\n\nFixtures are optional documentation of intended behavior. Fixtures are shape-validated only; CC Safety Net does not execute them.\n\n## Matching Behavior\n\n- **Command**: Normalized to lowercase basename with any trailing `.exe` removed (`/usr/bin/git` → `git`).\n- **Subcommand**: The first command token after recognized Git and Docker global options and their values; `--` ends option parsing. An unrecognized option without `=` may consume the following token as its value.\n- **Arguments**: Each `block_args` value is compared literally against every command token, including expanded short options. The command is blocked if **any** item matches.\n- **Short options**: Expanded (`-Ap` matches `-A`).\n- **Long options**: Exact match (`--all-files` does not match `--all`).\n- **Execution order**: Built-in rules first, then custom rulebooks. Custom rules only add restrictions.\n- **Transparent wrappers**: A configured wrapper such as `rtk` lets `rtk git commit` be analyzed as `git commit` only when `git` is protected by built-in analyzers or active custom rules. `rtk -- git commit` is also supported.\n\n## Workflow\n\n1. Run `cc-safety-net rule init` or create `rule.json` manually.\n2. Optionally run `cc-safety-net rule init --example` to create an inactive example rulebook.\n3. Use `cc-safety-net rule wrapper add rtk` for trusted transparent wrappers.\n4. Run `cc-safety-net rule add <source>` after creating or choosing a rulebook source; it adds the source and syncs it.\n5. Run `cc-safety-net rule sync` after manual `rule.json` changes or local rulebook edits.\n6. Run `cc-safety-net rule verify` to validate config, lock/cache state, local rulebooks, and shareable GitHub-source rulebook directories in the current repository (it does not fetch remote content).\n7. Run `cc-safety-net rule list` to inspect active rulebooks and transparent wrappers.\n\nAn edited or invalid local rulebook keeps its last synced, digest-verified cached version enforced until `cc-safety-net rule sync` validates the edit. A missing lock entry or cache, a cache digest mismatch, or an invalid cached rulebook makes that source inactive; a missing lockfile or an unreadable or invalid `rule.json` makes every source in its scope inactive. Inactive sources stop applying their rules while other custom rules and all built-in protections stay active. Repair the reported condition, then run `cc-safety-net rule sync`. Run `cc-safety-net status` to see degraded sources.\n";function Yn(n,t){if(!n.ok){v5(n);return}b5(n),console.log(t),console.log("Rule config synced."),console.log(""),p5(n.entries)}function p5(n){if(n.length===0){console.log("Active rulebooks: (none)");return}console.log(`Active rulebooks (${n.length}):`);for(let t of n)console.log(`  - ${t.name} ${t.version} (${u5(t.ruleCount??0)})`),console.log(`    Source: ${Ot(t)}`)}function u5(n){return`${n} ${n===1?"rule":"rules"}`}function El(n,t){J2("Active sources",n.rulebooks,(e)=>[`[${e.source}] ${e.name} ${e.version}`,`  Source: ${t[e.source].get(e.spec)??e.spec}`]),J2("Active rules",n.rules,(e)=>[`[${o5(n,e.name)}] ${e.name}`,`  Command: ${e.subcommand?`${e.command} ${e.subcommand}`:e.command}`,`  Block args: ${e.block_args.join(", ")}`,`  Reason: ${e.reason}`]),J2("Disabled rules",_l(n,"off"),(e)=>[e.key]),J2("Reason overrides",_l(n,"reason"),(e)=>[e.key,`  Reason: ${e.value.reason}`]),J2("Transparent wrappers",n.transparent_wrappers,(e)=>[e]),J2("Issues",n.errors,(e)=>[e]),J2("Warnings",n.warnings,(e)=>[e])}function J2(n,t,e){if(t.length===0){console.log(`${n}: (none)`);return}console.log(`${n} (${t.length}):`);for(let r of t){let[a,...l]=e(r);console.log(`  - ${a}`);for(let d of l)console.log(`    ${d}`)}}function o5(n,t){return n.rulebooks.find((e)=>e.rules.includes(t))?.source??"project"}function _l(n,t){return Object.entries({...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}}).filter((e)=>{if(t==="off")return e[1]==="off";return!!e[1]&&typeof e[1]==="object"}).map(([e,r])=>({key:e,value:r}))}function v5(n){for(let t of n.errors)console.error(t)}function b5(n){if(!n.warnings||n.warnings.length===0)return;for(let t of n.warnings)console.warn(t)}import{dirname as Pl,join as xt}from"node:path";var f5=".safety-net.json",h5="~/.cc-safety-net/config.json";async function n3(n){return[await Il({legacyPath:Nl({cwd:n.cwd}),configPath:_(n.cwd),defaultRulebookName:"project-rules",migratedFrom:f5,cleanup:n.cleanup,syncOptions:{cwd:n.cwd}}),await Il({legacyPath:pn(),configPath:E(),defaultRulebookName:"user-rules",migratedFrom:h5,cleanup:n.cleanup,syncOptions:{cwd:n.cwd,global:!0}})].every((e)=>e)?0:1}async function Il(n){let t=U(n.syncOptions),e=D(t.filesystemScope,n.legacyPath),r=g(e);if(r===null)return console.log(`No legacy config found at ${n.legacyPath}`),!0;let a=w5(r);if(!a.ok){for(let v of a.errors)console.error(v);return!1}let l=O(t.configTarget);if(l.errors.length>0){for(let v of l.errors)console.error(v);return!1}let d=l.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},s=x5(Pl(n.configPath),d.rules,n.defaultRulebookName,n.migratedFrom,t.filesystemScope),c=xt(Pl(n.configPath),s,"rulebook.json"),i=D(t.filesystemScope,c),L=[ur(t.configTarget),ur(i),ur(t.lockTarget)],u=await y5(n,t.configTarget,i,s,a.config.rules,d.rules.includes(s)?d.rules:[...d.rules,s],d.overrides??{},d.transparent_wrappers??[]);if(!u.ok){D5(L);for(let v of u.errors)console.error(v);return!1}if(!n.cleanup)return console.log(`Migrated legacy config at ${n.legacyPath}. Legacy file is no longer used.`),!0;if(!g5(t.configTarget,i,s,n.migratedFrom,a.config.rules))return console.error(`Migration cleanup verification failed for ${n.legacyPath}`),!1;return cn(e),console.log(`Deleted legacy config at ${n.legacyPath}`),!0}async function y5(n,t,e,r,a,l,d,s){try{return T(t,{version:1,rules:l,overrides:d,transparent_wrappers:s}),T(e,$5(r,n.migratedFrom,a)),await W2(n.syncOptions)}catch(c){return{ok:!1,errors:[c instanceof Error?c.message:String(c)]}}}function w5(n){try{let t=JSON.parse(n),e=Xt(t);if(e.errors.length>0)return{ok:!1,errors:e.errors};return{ok:!0,config:{version:1,rules:t.rules??[]}}}catch{return{ok:!1,errors:["Invalid JSON"]}}}function x5(n,t,e,r,a){let l=t.find((d)=>m5(D(a,xt(n,d,"rulebook.json")))===r);if(l)return l;if(g(D(a,xt(n,e,"rulebook.json")))===null)return e;for(let d=2;;d++){let s=`${e}-${d}`;if(g(D(a,xt(n,s,"rulebook.json")))===null)return s}}function $5(n,t,e){return{rulebook_version:1,name:n,version:"1.0.0",description:"Migrated CC Safety Net rules.",author:"project",migrated_from:t,allowed_commands:[...new Set(e.map((r)=>r.command))],rules:e,tests:e.map((r)=>({command:[r.command,r.subcommand,r.block_args[0]].filter(Boolean).join(" "),expect:"blocked",rule:r.name}))}}function g5(n,t,e,r,a){if(!O(n).config?.rules.includes(e))return!1;try{let d=g(t);if(d===null)return!1;let s=JSON.parse(d);return s.migrated_from===r&&JSON.stringify(s.rules)===JSON.stringify(a)}catch{return!1}}function ur(n){return{target:n,content:g(n)}}function D5(n){for(let t of n){if(t.content===null){cn(t.target);continue}w2(t.target,t.content)}}function m5(n){let t=g(n);if(t===null)return null;try{let e=JSON.parse(t);return typeof e.migrated_from==="string"?e.migrated_from:null}catch{return null}}import{mkdir as k5,readFile as q5,writeFile as j5}from"node:fs/promises";import{dirname as F5,join as z5}from"node:path";var B5=86400000,J5=604800000;async function e3(n=Date.now()){if(process.env.CC_SAFETY_NET_NO_UPDATE_CHECK)return null;let t=Et();if(!t)return null;let e=z5(t,".cc-safety-net","update-check.json"),r=await Z5(e,n);if(!r.lastCheck||n-r.lastCheck>B5){let d=await E2();if(r.lastCheck=n,d.latestVersion)r.latestVersion=d.latestVersion;if(!await t3(e,r))return null;if(d.error)return null}let a=r.latestVersion,l=j();if(!a||!ve(a,l))return null;if(r.notifiedVersion===a&&r.notifiedAt!==void 0&&n-r.notifiedAt<J5)return null;if(r.notifiedVersion=a,r.notifiedAt=n,!await t3(e,r))return null;return`UPDATE_AVAILABLE: cc-safety-net v${a} is available (running v${l}). Ask the user once whether to run \`npx -y cc-safety-net@latest update\`; continue the current task either way and do not raise this again.`}async function Z5(n,t){let e=await q5(n,"utf8").then((l)=>JSON.parse(l)).catch(()=>{return});if(!e||typeof e!=="object"||Array.isArray(e))return{};let r=e,a=(l)=>typeof l==="number"&&Number.isFinite(l)&&l<=t?l:void 0;return{lastCheck:a(r.lastCheck),latestVersion:typeof r.latestVersion==="string"?r.latestVersion:void 0,notifiedVersion:typeof r.notifiedVersion==="string"?r.notifiedVersion:void 0,notifiedAt:a(r.notifiedAt)}}async function t3(n,t){return k5(F5(n),{recursive:!0,mode:448}).then(()=>j5(n,JSON.stringify(t),{mode:384})).then(()=>!0).catch(()=>!1)}import{dirname as Q5,join as X5,resolve as or}from"node:path";var a3="CC Safety Net Config",Y5="═".repeat(a3.length),S5="https://raw.githubusercontent.com/kenryu42/cc-safety-net/main/assets/cc-safety-net.schema.json",H5=new Set(["rule.json","rule.lock","cache"]);function l3(n={}){try{return A5(n)}catch(t){if(t instanceof Z)return console.error(t.message),1;throw t}}function A5(n){let t=n.cwd??process.cwd(),e=n.userConfigPath??E(),r=n.projectConfigPath??_(t),a=n.legacyUserConfigPath??pn(),l=n.legacyProjectConfigPath??Sr(t),d=or(t,Ut),s=Q5(e),c=P({cwd:t,userConfigPath:e,projectConfigPath:r}),i=P({cwd:t}),L=D(c.userScope,e),u=D(c.projectScope,r),v=n.legacyUserConfigPath?sn(n.legacyUserConfigPath,"user policy"):D(i.userScope,a),p=n.legacyProjectConfigPath?sn(n.legacyProjectConfigPath,"project policy"):D(i.projectScope,l),f=!1,o=!1,h=[],x=[],w=W5(D(i.projectScope,d));if(K5(),g(L)!==null){let y=a2(L);if(y.errors.push(...l2(e,R2({userConfigDir:s}),{userConfigDir:s},c.userScope)),h.push({scope:"User",path:e,result:y,schema:"rules",sourceDisplayMap:x2(e,c.userScope),target:L}),y.errors.length>0)f=!0}if(g(v)!==null)if(o=!0,g(L)!==null)x.push($t("user","cleanup"));else{let y=Yt(v);if(h.push({scope:"User",path:a,result:y,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:v}),x.push($t("user",y.errors.length>0?"fix-or-delete":"migrate")),y.errors.length>0)f=!0}if(g(u)!==null){let y=a2(u);if(y.errors.push(...l2(r,K2(r),{userConfigDir:s},c.projectScope)),h.push({scope:"Project",path:or(r),result:y,schema:"rules",sourceDisplayMap:x2(r,c.projectScope),target:u}),y.errors.length>0)f=!0;if(g(p)!==null)o=!0,x.push($t("project","cleanup"))}else if(g(p)!==null){o=!0,f=!0;let y=Yt(p);h.push({scope:"Project",path:or(l),result:y,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:p}),x.push($t("project",y.errors.length>0?"fix-or-delete":"migrate"))}if(w?.result.errors.length)f=!0;if(h.length===0&&!w)return console.log(`
+No config files found. Using built-in rules only.`),0;for(let y of h)if(y.inactive)V5(y.scope,y.path,y.result,y.sourceDisplayMap);else if(y.result.errors.length>0)G5(y.scope,y.path,y.result.errors);else{if(y.schema==="rules"&&O5(y.target))console.log(`
+Added $schema to ${y.scope.toLowerCase()} config.`);M5(y.scope,y.path,y.result,y.schema,y.sourceDisplayMap)}for(let y of x)console.error(`
+${b.red(y)}`);if(w)if(w.result.errors.length>0)U5(w.path,w.result.errors);else C5(w.path,w.result);if(f)return console.error(`
 Config validation failed.`),1;return console.log(o?`
 Configs valid with warnings.`:`
-All configs valid.`),0}function ht(n,t){let r=`legacy ${n} config`;if(t==="cleanup")return`Warning: Legacy ${n} config is no longer needed. Run \`npx -y cc-safety-net rule migrate --cleanup\` to clean it up safely.`;if(t==="migrate")return`Warning: Legacy ${n} config is ignored by CC Safety Net. Run \`npx -y cc-safety-net rule migrate\`.`;return`Warning: Legacy ${n} config is no longer supported. Fix or delete the ${r}, then run \`npx -y cc-safety-net rule migrate\`.`}function A5(n){if(W2(n)===null)return null;let t=W5(n);if(t.ruleNames.size===0&&t.errors.length===0)return null;return{path:n.path,result:t}}function W5(n){let t=[],r=new Set,e=(W2(n)??[]).filter((a)=>!S5.has(a.name)).sort((a,l)=>a.name.localeCompare(l.name));if(e.length===0)return{errors:t,ruleNames:r};for(let a of e){if(!cn.test(a.name)){t.push(`rulebook directory names must match ${cn}: ${a.name}`);continue}if(a.kind!=="directory"){t.push(`${a.name} must be a rulebook directory`);continue}let l=D(n.scope,Q5(n.path,a.name,"rulebook.json")),d=g(l);if(d===null){t.push(`${a.name}/rulebook.json is required`);continue}try{let s;try{s=JSON.parse(d)}catch{t.push(`${a.name}/rulebook.json: invalid JSON`);continue}let L=r3(s);if(L.name!==a.name){t.push(`rulebook name "${L.name}" must match folder "${a.name}"`);continue}r.add(a.name)}catch(s){t.push(s instanceof Error?`${a.name}/rulebook.json: ${s.message}`:`${a.name}/rulebook.json: ${String(s)}`)}}return{errors:t,ruleNames:r}}function R5(){console.log(e3),console.log(X5)}function K5(n,t,r,e,a){if(console.log(`
-✓ ${n} config: ${t}`),console.log(`  Schema: ${e==="rules"?"rulebook sources":"legacy inline rules"}`),r.ruleNames.size>0){console.log(`  ${e==="rules"?"Sources":"Rules"}:`);let l=1;for(let d of r.ruleNames)console.log(`    ${l}. ${a.get(d)??d}`),l++}else console.log(`  ${e==="rules"?"Sources":"Rules"}: (none)`)}function M5(n,t,r,e){if(console.error(`
-✗ Legacy ${n.toLowerCase()} config: ${t}`),console.error("  Schema: legacy inline rules"),console.error("  Status: ignored by CC Safety Net"),r.errors.length>0){console.error("  Errors:");let a=1;for(let l of r.errors)for(let d of l.split("; "))console.error(`    ${a}. ${d}`),a++;return}if(r.ruleNames.size>0){console.error("  Rules:");let a=1;for(let l of r.ruleNames)console.error(`    ${a}. ${e.get(l)??l}`),a++;return}console.error("  Rules: (none)")}function V5(n,t,r){l3(`${n} config`,t,r)}function G5(n,t){console.log(`
-✓ GitHub source rules: ${n}`),console.log("  Rulebooks:");let r=1;for(let e of t.ruleNames)console.log(`    ${r}. ${e}`),r++}function C5(n,t){l3("GitHub source rules",n,t)}function l3(n,t,r){console.error(`
-✗ ${n}: ${t}`),console.error("  Errors:");let e=1;for(let a of r)for(let l of a.split("; "))console.error(`    ${e}. ${l}`),e++}function U5(n){try{let t=g(n);if(t===null)return!1;let r=JSON.parse(t);if(r.$schema)return!1;return w2(n,JSON.stringify({$schema:Y5,...r},null,2)),!0}catch(t){if(t instanceof Z)throw t;return!1}}var d3=new Set(["init","add","remove","update","sync","list","wrapper","migrate","doc","verify"]),T5=new Set(["add","remove","list"]);async function L3(n){try{return await E5(n)}catch(t){if(t instanceof Z)return console.error(t.message),1;throw t}}async function E5(n){let t=P5(n),r=t.help?_5(t.positionals):null;if(r)return dt(r),0;if(t.errors.length>0){for(let d of t.errors)console.error(d);return 1}let e=t.positionals[0];if(!e)return dt(E2,console.error),1;let a=t.positionals[1],l={global:t.global,check:t.check};if(e==="init"){let d=U(l),s=d.configDir;n8(d.configTarget),s3(D(d.filesystemScope,Hn({...l,cacheConfigDir:s})));let L=O5(s,"example-rules","rulebook.json"),c=D(d.filesystemScope,L);if(t.example&&g(c)===null)Ut(c,"example-rules");let i=await R2(l);return Qn(i,"Rule config initialized."),i.ok?0:1}if(e==="add"){if(!a)return console.error("rule add requires a source"),1;let d=await Rt(a,l);return Qn(d,`Added rulebook source: ${a}`),d.ok?0:1}if(e==="remove"){if(!a)return console.error("rule remove requires a source"),1;let d=await Mt(a,{...l,deleteSource:t.deleteSource});return Qn(d,`Removed rulebook source: ${a}`),d.ok?0:1}if(e==="update"||e==="sync"){let d=await R2({...l,only:e==="update"?a:void 0});return Qn(d,t.check?"Rule config checked.":"Rule config synced."),d.ok?0:1}if(e==="list"){let d=o2(),s=P({});return El(d,{user:x2(d.userConfigPath,s.userScope),project:x2(d.projectConfigPath,s.projectScope)}),d.errors.length>0?1:0}if(e==="wrapper")return t8(t);if(e==="migrate")return Nl({cleanup:t.cleanup,cwd:process.cwd()});if(e==="doc"){console.log(Ol);let d=await t3();if(d)console.error(d);return 0}if(e==="verify")return a3();return 1}function _5(n){if(n.length===0)return E2;let t=E2.subcommands.filter((e)=>e.usage.split(" ")[0]===n[0]);if(t.length===0)return null;if(n.length===1&&t.length>1)return{name:`rule ${n[0]}`,description:`Subcommands of rule ${n[0]}`,usage:`rule ${n[0]} <subcommand>`,subcommands:t,options:[]};let r=n.length===1?t[0]:t.find((e)=>e.usage.split(" ")[1]===n[1]);if(!r)return null;return{name:`rule ${n[0]}`,description:r.description,usage:`rule ${r.usage}`,options:[]}}function P5(n){let t=F({label:"rule",booleans:{global:["-g","--global"],check:["--check"],cleanup:["--cleanup"],deleteSource:["--delete-source"],example:["--example"]},positionals:"list"},n),r={...t.flags,help:t.help,positionals:t.positionals,errors:t.errors};return I5(r),r}function I5(n){let[t]=n.positionals;if(t&&!d3.has(t))n.errors.push(`Unknown rule subcommand: ${t}`);if(n.deleteSource&&t!=="remove")if(t&&d3.has(t))n.errors.push(`Unknown option for rule ${t}: --delete-source`);else n.errors.push("--delete-source is only valid with 'rule remove'");if(n.cleanup&&t!=="migrate")n.errors.push(wt(t,"--cleanup"));if(n.example&&t!=="init")n.errors.push(wt(t,"--example"));if(t==="migrate"){if(n.global)n.errors.push(wt(t,"--global"));if(n.check)n.errors.push(wt(t,"--check"));if(n.positionals.length>1)n.errors.push(`Unexpected rule migrate argument: ${n.positionals[1]}`)}else if(t==="wrapper")N5(n);else if(n.positionals.length>2)n.errors.push(`Unexpected rule argument: ${n.positionals[2]}`);if(t==="list"&&n.global)n.errors.push("Unknown option for rule list: --global")}function wt(n,t){return n?`Unknown option for rule ${n}: ${t}`:`Unknown option for rule: ${t}`}function N5(n){let t=n.positionals[1],r=n.positionals[2];if(!t){n.errors.push("rule wrapper requires add, remove, or list");return}if(!T5.has(t)){n.errors.push(`Unknown rule wrapper action: ${t}`);return}if(t==="list"){if(r)n.errors.push(`Unexpected rule wrapper argument: ${r}`);return}if(!r){n.errors.push(`rule wrapper ${t} requires a command`);return}if(n.positionals.length>3)n.errors.push(`Unexpected rule wrapper argument: ${n.positionals[3]}`)}function n8(n){if(g(n)===null){Ct(n);return}let t=O(n);if(!t.config)return;T(n,{version:1,rules:t.config.rules,overrides:t.config.overrides??{},transparent_wrappers:t.config.transparent_wrappers??[]})}async function t8(n){let t=n.positionals[1],r=n.positionals[2],e=U({global:n.global}).configTarget;if(t==="list"){let s=O(e);if(s.errors.length>0){for(let L of s.errors)console.error(L);return 1}return r8(s.config?.transparent_wrappers??[]),0}if(!r||!Tt.test(r))return console.error("transparent wrapper must match command pattern"),1;if(Et(r))return console.error(`reserved command "${r}" cannot be a wrapper`),1;let a=O(e);if(a.errors.length>0){for(let s of a.errors)console.error(s);return 1}let l=a.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},d=t==="add"?[...new Set([...l.transparent_wrappers??[],r])]:(l.transparent_wrappers??[]).filter((s)=>s!==r);return T(e,{version:1,rules:l.rules,overrides:l.overrides??{},transparent_wrappers:d}),console.log(t==="add"?`Added transparent wrapper: ${r}`:`Removed transparent wrapper: ${r}`),0}function r8(n){if(n.length===0){console.log("Transparent wrappers: (none)");return}console.log(`Transparent wrappers (${n.length}):`);for(let t of n)console.log(`  - ${t}`)}import{homedir as c3}from"node:os";import{existsSync as e8,readFileSync as a8}from"node:fs";import{homedir as l8}from"node:os";import{join as d8}from"node:path";async function s8(n){if(n.isTTY)return null;return(await rr(n).catch(()=>null))?.trim()||null}function L8(){if(process.env.CLAUDE_SETTINGS_PATH)return process.env.CLAUDE_SETTINGS_PATH;return d8(l8(),".claude","settings.json")}function ve(){let n=L8();if(!e8(n))return!1;try{let t=a8(n,"utf-8"),r=JSON.parse(t);if(!r.enabledPlugins)return!1;let e="cc-safety-net@cc-marketplace";if(!(e in r.enabledPlugins))return!1;return r.enabledPlugins[e]===!0}catch(t){if(vn(m.debug))console.error(`CC Safety Net debug: failed to read Claude settings: ${n}: ${t instanceof Error?t.message:String(t)}`);return!1}}async function be(n=process.stdin){let t=ve(),r;if(!t)r="\uD83D\uDEE1️ CC Safety Net ❌";else{let a=W({cwd:process.cwd()}),l=a.policy,d=d2(l),s=Object.values(g2(l,d.capabilities)).some((c)=>c.changesInherited);r=`\uD83D\uDEE1️ CC Safety Net ${{standard:"✅",strict:"\uD83D\uDD12",paranoid:"\uD83D\uDC41️",custom:"\uD83D\uDD27"}[s?"custom":d.effectiveLevel]}${d.worktreeMode?"\uD83C\uDF33":""}${a.state==="degraded"?"⚠️":""}`}let e=await s8(n);if(e&&!e.startsWith("{"))console.log(`${e} | ${r}`);else console.log(r)}function i3(){let n=W({cwd:process.cwd()}),t=n.policy,r=d2(t),e=!!process.env.NO_COLOR||!process.stdout.isTTY,a=Math.min(process.stdout.columns||80,100),l=e?"ok":"✔",d=e?"OFF":"✘",s=(p,f)=>{let o=`  ${p.padEnd(13)}${f}`;return(o.length>a?`${o.slice(0,a-1)}…`:o).replaceAll(d,b.red(d))},L=Object.values(g2(t,r.capabilities)).some((p)=>p.changesInherited),c=bn(),i={ready:b.green,degraded:b.yellow}[n.state],u=[...ve()?[]:["plugin cc-safety-net@cc-marketplace is disabled in Claude Code; nothing is enforced in Claude Code until it is re-enabled. Other integrations are not affected."],...n.diagnostics],v=e?"-":"·";console.log([`${e?"":"\uD83D\uDEE1️  "}CC Safety Net — ${i(n.state)}`,"",s("Protection",`destructive ${t.destructiveCommandProtectionEnabled?l:d}   secrets ${t.secretProtection.enabled?l:d}`),s("Level",L?`${r.effectiveLevel} (customised)`:r.effectiveLevel),s("Rules",t.rules.length===0?"none active":`${t.rules.length} active`),s("Policy",c.startsWith(c3())?`~${c.slice(c3().length)}`:c),...r.worktreeMode?[s("Worktree","relaxations active")]:[],"",...u.length===0?["  Everything configured is active."]:["  Not active",...u.flatMap((p)=>lt(p,"      ",a-6).map((f,o)=>o===0?`    ${v} ${f}`:f)),"","  Full report: cc-safety-net doctor"]].join(`
-`))}import{spawn as z3}from"node:child_process";import{randomBytes as w8}from"node:crypto";import{createServer as x8}from"node:http";import{Writable as $8}from"node:stream";import{homedir as c8}from"node:os";var xt=500;function i8(n){let t=n.filter((a)=>a.decision!=="allow"),r=n.filter((a)=>a.decision==="allow"),e=Math.min(t.length,Math.max(xt-r.length,Math.ceil(xt/2)));return[...t.slice(0,e),...r.slice(0,xt-e)]}function p3(n,t=s2()){if(t)$2(t);let r=(o)=>new Date(o.getFullYear(),o.getMonth(),o.getDate()).getTime(),e=r(new Date),a=new Date(e);a.setDate(a.getDate()-(n-1));let l=a.getTime(),d=[],s={count:0};for(let o of t?u2(t,s):[])for(let y of dn(o,s)){if(!y||typeof y.ts!=="string"||typeof y.command!=="string")continue;let x=new Date(y.ts).getTime();if(!Number.isFinite(x))continue;if(x>=l)d.push(y)}d.sort((o,y)=>new Date(y.ts).getTime()-new Date(o.ts).getTime());let L=Array.from({length:n},()=>0),c=Array.from({length:n},()=>0),i={},u={},v={},p=0,f=0;for(let o of d){let y=o.agent||"unknown";i[y]=(i[y]??0)+1;let x=Math.round((e-r(new Date(o.ts)))/86400000),w=n-1-x,h=x>=0&&x<n;if(h)c[w]=(c[w]??0)+1;if(o.decision!=="allow"){if(p++,o.ruleId)u[o.ruleId]=(u[o.ruleId]??0)+1;let J=X2(o.segment||o.command);if(J)v[J]=(v[J]??0)+1;if(o.failureStage)f++;if(h)L[w]=(L[w]??0)+1}}return{days:n,logsDir:t,homeDir:c8(),totalInWindow:d.length,truncated:d.length>xt,unreadable:s.count,counts:{blocked:p,allowed:d.length-p,agents:i,blockedByDay:L,analyzedByDay:c,rules:u,commands:v,errors:f},entries:i8(d).sort((o,y)=>new Date(y.ts).getTime()-new Date(o.ts).getTime())}}import{spawn as p8}from"node:child_process";import{existsSync as u3,statSync as u8}from"node:fs";import{delimiter as o8,join as v8}from"node:path";var b8=120000,$t="Choose the project folder",f8=`try
-  return POSIX path of (choose folder with prompt "${$t}")
+All configs valid.`),0}function $t(n,t){let e=`legacy ${n} config`;if(t==="cleanup")return`Warning: Legacy ${n} config is no longer needed. Run \`npx -y cc-safety-net rule migrate --cleanup\` to clean it up safely.`;if(t==="migrate")return`Warning: Legacy ${n} config is ignored by CC Safety Net. Run \`npx -y cc-safety-net rule migrate\`.`;return`Warning: Legacy ${n} config is no longer supported. Fix or delete the ${e}, then run \`npx -y cc-safety-net rule migrate\`.`}function W5(n){if(A2(n)===null)return null;let t=R5(n);if(t.ruleNames.size===0&&t.errors.length===0)return null;return{path:n.path,result:t}}function R5(n){let t=[],e=new Set,r=(A2(n)??[]).filter((a)=>!H5.has(a.name)).sort((a,l)=>a.name.localeCompare(l.name));if(r.length===0)return{errors:t,ruleNames:e};for(let a of r){if(!Ln.test(a.name)){t.push(`rulebook directory names must match ${Ln}: ${a.name}`);continue}if(a.kind!=="directory"){t.push(`${a.name} must be a rulebook directory`);continue}let l=D(n.scope,X5(n.path,a.name,"rulebook.json")),d=g(l);if(d===null){t.push(`${a.name}/rulebook.json is required`);continue}try{let s;try{s=JSON.parse(d)}catch{t.push(`${a.name}/rulebook.json: invalid JSON`);continue}let c=r3(s);if(c.name!==a.name){t.push(`rulebook name "${c.name}" must match folder "${a.name}"`);continue}e.add(a.name)}catch(s){t.push(s instanceof Error?`${a.name}/rulebook.json: ${s.message}`:`${a.name}/rulebook.json: ${String(s)}`)}}return{errors:t,ruleNames:e}}function K5(){console.log(a3),console.log(Y5)}function M5(n,t,e,r,a){if(console.log(`
+✓ ${n} config: ${t}`),console.log(`  Schema: ${r==="rules"?"rulebook sources":"legacy inline rules"}`),e.ruleNames.size>0){console.log(`  ${r==="rules"?"Sources":"Rules"}:`);let l=1;for(let d of e.ruleNames)console.log(`    ${l}. ${a.get(d)??d}`),l++}else console.log(`  ${r==="rules"?"Sources":"Rules"}: (none)`)}function V5(n,t,e,r){if(console.error(`
+✗ Legacy ${n.toLowerCase()} config: ${t}`),console.error("  Schema: legacy inline rules"),console.error("  Status: ignored by CC Safety Net"),e.errors.length>0){console.error("  Errors:");let a=1;for(let l of e.errors)for(let d of l.split("; "))console.error(`    ${a}. ${d}`),a++;return}if(e.ruleNames.size>0){console.error("  Rules:");let a=1;for(let l of e.ruleNames)console.error(`    ${a}. ${r.get(l)??l}`),a++;return}console.error("  Rules: (none)")}function G5(n,t,e){d3(`${n} config`,t,e)}function C5(n,t){console.log(`
+✓ GitHub source rules: ${n}`),console.log("  Rulebooks:");let e=1;for(let r of t.ruleNames)console.log(`    ${e}. ${r}`),e++}function U5(n,t){d3("GitHub source rules",n,t)}function d3(n,t,e){console.error(`
+✗ ${n}: ${t}`),console.error("  Errors:");let r=1;for(let a of e)for(let l of a.split("; "))console.error(`    ${r}. ${l}`),r++}function O5(n){try{let t=g(n);if(t===null)return!1;let e=JSON.parse(t);if(e.$schema)return!1;return w2(n,JSON.stringify({$schema:S5,...e},null,2)),!0}catch(t){if(t instanceof Z)throw t;return!1}}var s3=new Set(["init","add","remove","update","sync","list","wrapper","migrate","doc","verify"]),_5=new Set(["add","remove","list"]);async function i3(n){try{return await E5(n)}catch(t){if(t instanceof Z)return console.error(t.message),1;throw t}}async function E5(n){let t=I5(n),e=t.help?P5(t.positionals):null;if(e)return st(e),0;if(t.errors.length>0){for(let d of t.errors)console.error(d);return 1}let r=t.positionals[0];if(!r)return st(T2,console.error),1;let a=t.positionals[1],l={global:t.global,check:t.check};if(r==="init"){let d=U(l),s=d.configDir;t8(d.configTarget),c3(D(d.filesystemScope,Wn({...l,cacheConfigDir:s})));let c=T5(s,"example-rules","rulebook.json"),i=D(d.filesystemScope,c);if(t.example&&g(i)===null)_t(i,"example-rules");let L=await W2(l);return Yn(L,"Rule config initialized."),L.ok?0:1}if(r==="add"){if(!a)return console.error("rule add requires a source"),1;let d=await Vt(a,l);return Yn(d,`Added rulebook source: ${a}`),d.ok?0:1}if(r==="remove"){if(!a)return console.error("rule remove requires a source"),1;let d=await Ct(a,{...l,deleteSource:t.deleteSource});return Yn(d,`Removed rulebook source: ${a}`),d.ok?0:1}if(r==="update"||r==="sync"){let d=await W2({...l,only:r==="update"?a:void 0});return Yn(d,t.check?"Rule config checked.":"Rule config synced."),d.ok?0:1}if(r==="list"){let d=o2(),s=P({});return El(d,{user:x2(d.userConfigPath,s.userScope),project:x2(d.projectConfigPath,s.projectScope)}),d.errors.length>0?1:0}if(r==="wrapper")return e8(t);if(r==="migrate")return n3({cleanup:t.cleanup,cwd:process.cwd()});if(r==="doc"){console.log(Tl);let d=await e3();if(d)console.error(d);return 0}if(r==="verify")return l3();return 1}function P5(n){if(n.length===0)return T2;let t=T2.subcommands.filter((r)=>r.usage.split(" ")[0]===n[0]);if(t.length===0)return null;if(n.length===1&&t.length>1)return{name:`rule ${n[0]}`,description:`Subcommands of rule ${n[0]}`,usage:`rule ${n[0]} <subcommand>`,subcommands:t,options:[]};let e=n.length===1?t[0]:t.find((r)=>r.usage.split(" ")[1]===n[1]);if(!e)return null;return{name:`rule ${n[0]}`,description:e.description,usage:`rule ${e.usage}`,options:[]}}function I5(n){let t=F({label:"rule",booleans:{global:["-g","--global"],check:["--check"],cleanup:["--cleanup"],deleteSource:["--delete-source"],example:["--example"]},positionals:"list"},n),e={...t.flags,help:t.help,positionals:t.positionals,errors:t.errors};return N5(e),e}function N5(n){let[t]=n.positionals;if(t&&!s3.has(t))n.errors.push(`Unknown rule subcommand: ${t}`);if(n.deleteSource&&t!=="remove")if(t&&s3.has(t))n.errors.push(`Unknown option for rule ${t}: --delete-source`);else n.errors.push("--delete-source is only valid with 'rule remove'");if(n.cleanup&&t!=="migrate")n.errors.push(gt(t,"--cleanup"));if(n.example&&t!=="init")n.errors.push(gt(t,"--example"));if(t==="migrate"){if(n.global)n.errors.push(gt(t,"--global"));if(n.check)n.errors.push(gt(t,"--check"));if(n.positionals.length>1)n.errors.push(`Unexpected rule migrate argument: ${n.positionals[1]}`)}else if(t==="wrapper")n8(n);else if(n.positionals.length>2)n.errors.push(`Unexpected rule argument: ${n.positionals[2]}`);if(t==="list"&&n.global)n.errors.push("Unknown option for rule list: --global")}function gt(n,t){return n?`Unknown option for rule ${n}: ${t}`:`Unknown option for rule: ${t}`}function n8(n){let t=n.positionals[1],e=n.positionals[2];if(!t){n.errors.push("rule wrapper requires add, remove, or list");return}if(!_5.has(t)){n.errors.push(`Unknown rule wrapper action: ${t}`);return}if(t==="list"){if(e)n.errors.push(`Unexpected rule wrapper argument: ${e}`);return}if(!e){n.errors.push(`rule wrapper ${t} requires a command`);return}if(n.positionals.length>3)n.errors.push(`Unexpected rule wrapper argument: ${n.positionals[3]}`)}function t8(n){if(g(n)===null){Tt(n);return}let t=O(n);if(!t.config)return;T(n,{version:1,rules:t.config.rules,overrides:t.config.overrides??{},transparent_wrappers:t.config.transparent_wrappers??[]})}async function e8(n){let t=n.positionals[1],e=n.positionals[2],r=U({global:n.global}).configTarget;if(t==="list"){let s=O(r);if(s.errors.length>0){for(let c of s.errors)console.error(c);return 1}return r8(s.config?.transparent_wrappers??[]),0}if(!e||!Pt.test(e))return console.error("transparent wrapper must match command pattern"),1;if(It(e))return console.error(`reserved command "${e}" cannot be a wrapper`),1;let a=O(r);if(a.errors.length>0){for(let s of a.errors)console.error(s);return 1}let l=a.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},d=t==="add"?[...new Set([...l.transparent_wrappers??[],e])]:(l.transparent_wrappers??[]).filter((s)=>s!==e);return T(r,{version:1,rules:l.rules,overrides:l.overrides??{},transparent_wrappers:d}),console.log(t==="add"?`Added transparent wrapper: ${e}`:`Removed transparent wrapper: ${e}`),0}function r8(n){if(n.length===0){console.log("Transparent wrappers: (none)");return}console.log(`Transparent wrappers (${n.length}):`);for(let t of n)console.log(`  - ${t}`)}import{homedir as L3}from"node:os";import{existsSync as a8,readFileSync as l8}from"node:fs";import{homedir as d8}from"node:os";import{join as s8}from"node:path";async function c8(n){if(n.isTTY)return null;return(await le(n).catch(()=>null))?.trim()||null}function i8(){if(process.env.CLAUDE_SETTINGS_PATH)return process.env.CLAUDE_SETTINGS_PATH;return s8(d8(),".claude","settings.json")}function vr(){let n=i8();if(!a8(n))return!1;try{let t=l8(n,"utf-8"),e=JSON.parse(t);if(!e.enabledPlugins)return!1;let r="cc-safety-net@cc-marketplace";if(!(r in e.enabledPlugins))return!1;return e.enabledPlugins[r]===!0}catch(t){if(vn(m.debug))console.error(`CC Safety Net debug: failed to read Claude settings: ${n}: ${t instanceof Error?t.message:String(t)}`);return!1}}async function br(n=process.stdin){let t=vr(),e;if(!t)e="\uD83D\uDEE1️ CC Safety Net ❌";else{let a=W({cwd:process.cwd()}),l=a.policy,d=d2(l),s=Object.values(g2(l,d.capabilities)).some((i)=>i.changesInherited);e=`\uD83D\uDEE1️ CC Safety Net ${{standard:"✅",strict:"\uD83D\uDD12",paranoid:"\uD83D\uDC41️",custom:"\uD83D\uDD27"}[s?"custom":d.effectiveLevel]}${d.worktreeMode?"\uD83C\uDF33":""}${a.state==="degraded"?"⚠️":""}`}let r=await c8(n);if(r&&!r.startsWith("{"))console.log(`${r} | ${e}`);else console.log(e)}function p3(){let n=W({cwd:process.cwd()}),t=n.policy,e=d2(t),r=!!process.env.NO_COLOR||!process.stdout.isTTY,a=Math.min(process.stdout.columns||80,100),l=r?"ok":"✔",d=r?"OFF":"✘",s=(p,f)=>{let o=`  ${p.padEnd(13)}${f}`;return(o.length>a?`${o.slice(0,a-1)}…`:o).replaceAll(d,b.red(d))},c=Object.values(g2(t,e.capabilities)).some((p)=>p.changesInherited),i=bn(),L={ready:b.green,degraded:b.yellow}[n.state],u=[...vr()?[]:["plugin cc-safety-net@cc-marketplace is disabled in Claude Code; nothing is enforced in Claude Code until it is re-enabled. Other integrations are not affected."],...n.diagnostics],v=r?"-":"·";console.log([`${r?"":"\uD83D\uDEE1️  "}CC Safety Net — ${L(n.state)}`,"",s("Protection",`destructive ${t.destructiveCommandProtectionEnabled?l:d}   secrets ${t.secretProtection.enabled?l:d}`),s("Level",c?`${e.effectiveLevel} (customised)`:e.effectiveLevel),s("Rules",t.rules.length===0?"none active":`${t.rules.length} active`),s("Policy",i.startsWith(L3())?`~${i.slice(L3().length)}`:i),...e.worktreeMode?[s("Worktree","relaxations active")]:[],"",...u.length===0?["  Everything configured is active."]:["  Not active",...u.flatMap((p)=>dt(p,"      ",a-6).map((f,o)=>o===0?`    ${v} ${f}`:f)),"","  Full report: cc-safety-net doctor"]].join(`
+`))}import{spawn as B3}from"node:child_process";import{randomBytes as x8}from"node:crypto";import{createServer as $8}from"node:http";import{Writable as g8}from"node:stream";import{homedir as L8}from"node:os";var Dt=500;function p8(n){let t=n.filter((a)=>a.decision!=="allow"),e=n.filter((a)=>a.decision==="allow"),r=Math.min(t.length,Math.max(Dt-e.length,Math.ceil(Dt/2)));return[...t.slice(0,r),...e.slice(0,Dt-r)]}function u3(n,t=s2()){if(t)$2(t);let e=(o)=>new Date(o.getFullYear(),o.getMonth(),o.getDate()).getTime(),r=e(new Date),a=new Date(r);a.setDate(a.getDate()-(n-1));let l=a.getTime(),d=[],s={count:0};for(let o of t?u2(t,s):[])for(let h of dn(o,s)){if(!h||typeof h.ts!=="string"||typeof h.command!=="string")continue;let x=new Date(h.ts).getTime();if(!Number.isFinite(x))continue;if(x>=l)d.push(h)}d.sort((o,h)=>new Date(h.ts).getTime()-new Date(o.ts).getTime());let c=Array.from({length:n},()=>0),i=Array.from({length:n},()=>0),L={},u={},v={},p=0,f=0;for(let o of d){let h=o.agent||"unknown";L[h]=(L[h]??0)+1;let x=Math.round((r-e(new Date(o.ts)))/86400000),w=n-1-x,y=x>=0&&x<n;if(y)i[w]=(i[w]??0)+1;if(o.decision!=="allow"){if(p++,o.ruleId)u[o.ruleId]=(u[o.ruleId]??0)+1;let J=Q2(o.segment||o.command);if(J)v[J]=(v[J]??0)+1;if(o.failureStage)f++;if(y)c[w]=(c[w]??0)+1}}return{days:n,logsDir:t,homeDir:L8(),totalInWindow:d.length,truncated:d.length>Dt,unreadable:s.count,counts:{blocked:p,allowed:d.length-p,agents:L,blockedByDay:c,analyzedByDay:i,rules:u,commands:v,errors:f},entries:p8(d).sort((o,h)=>new Date(h.ts).getTime()-new Date(o.ts).getTime())}}import{spawn as u8}from"node:child_process";import{existsSync as o3,statSync as o8}from"node:fs";import{delimiter as v8,join as b8}from"node:path";var f8=120000,mt="Choose the project folder",h8=`try
+  return POSIX path of (choose folder with prompt "${mt}")
 on error number -128
   return ""
 end try`,y8=`Add-Type -AssemblyName System.Windows.Forms
 $dialog = New-Object System.Windows.Forms.FolderBrowserDialog
-$dialog.Description = '${$t}'
-if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write($dialog.SelectedPath) }`,o3=[{binary:"zenity",args:["--file-selection","--directory",`--title=${$t}`]},{binary:"kdialog",args:["--getexistingdirectory",".","--title",$t]}],v3=(n,t)=>(t.PATH??"").split(o8).some((r)=>r.length>0&&u3(v8(r,n)));function b3(n,t){if(n==="darwin"||n==="win32")return!0;if(n!=="linux")return!1;if(!t.DISPLAY&&!t.WAYLAND_DISPLAY)return!1;return o3.some((r)=>v3(r.binary,t))}function h8(n,t){if(n==="darwin")return{cmd:"osascript",args:["-e",f8]};if(n==="win32")return{cmd:"powershell.exe",args:["-NoProfile","-STA","-Command",y8]};let r=o3.find((e)=>v3(e.binary,t));return r?{cmd:r.binary,args:r.args}:null}function f3(n=process.platform,t=process.env){let r=h8(n,t);if(!r)return Promise.resolve({error:"No folder dialog is available on this system"});return new Promise((e)=>{let a=p8(r.cmd,r.args,{env:t,stdio:["ignore","pipe","pipe"]}),l="",d=!1,s=(c)=>{if(d)return;d=!0,clearTimeout(L),e(c)},L=setTimeout(()=>{a.kill(),s({error:"The folder dialog timed out"})},b8);a.stdout.on("data",(c)=>{l+=c.toString()}),a.on("error",()=>s({error:`Could not open the folder dialog (${r.cmd})`})),a.on("close",()=>{let c=l.trim().replace(/\/+$/,"");if(!c)return s({cancelled:!0});if(!u3(c)||!u8(c).isDirectory())return s({error:"That selection is not a folder on disk"});s({path:c})})})}var y3=`<!doctype html>
+$dialog.Description = '${mt}'
+if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write($dialog.SelectedPath) }`,v3=[{binary:"zenity",args:["--file-selection","--directory",`--title=${mt}`]},{binary:"kdialog",args:["--getexistingdirectory",".","--title",mt]}],b3=(n,t)=>(t.PATH??"").split(v8).some((e)=>e.length>0&&o3(b8(e,n)));function f3(n,t){if(n==="darwin"||n==="win32")return!0;if(n!=="linux")return!1;if(!t.DISPLAY&&!t.WAYLAND_DISPLAY)return!1;return v3.some((e)=>b3(e.binary,t))}function w8(n,t){if(n==="darwin")return{cmd:"osascript",args:["-e",h8]};if(n==="win32")return{cmd:"powershell.exe",args:["-NoProfile","-STA","-Command",y8]};let e=v3.find((r)=>b3(r.binary,t));return e?{cmd:e.binary,args:e.args}:null}function h3(n=process.platform,t=process.env){let e=w8(n,t);if(!e)return Promise.resolve({error:"No folder dialog is available on this system"});return new Promise((r)=>{let a=u8(e.cmd,e.args,{env:t,stdio:["ignore","pipe","pipe"]}),l="",d=!1,s=(i)=>{if(d)return;d=!0,clearTimeout(c),r(i)},c=setTimeout(()=>{a.kill(),s({error:"The folder dialog timed out"})},f8);a.stdout.on("data",(i)=>{l+=i.toString()}),a.on("error",()=>s({error:`Could not open the folder dialog (${e.cmd})`})),a.on("close",()=>{let i=l.trim().replace(/\/+$/,"");if(!i)return s({cancelled:!0});if(!o3(i)||!o8(i).isDirectory())return s({error:"That selection is not a folder on disk"});s({path:i})})})}var y3=`<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
@@ -3432,7 +3433,8 @@ var collectFormPolicy = () => ({
   secret_protection: {
     enabled: draftPolicy.secret_protection.enabled,
     overrides: draftPolicy.secret_protection.overrides,
-    deny_paths: draftPolicy.secret_protection.deny_paths
+    deny_paths: draftPolicy.secret_protection.deny_paths,
+    allow_paths: draftPolicy.secret_protection.allow_paths
   },
   audit: draftPolicy.audit
 });
@@ -4301,6 +4303,25 @@ var pathLists = {
       return errorText(result);
     }
   }),
+  "secret-allow-paths": createPathList("secret-allow-paths", {
+    getPaths: () => draftPolicy.secret_protection.allow_paths,
+    setPaths: (paths) => {
+      draftPolicy.secret_protection.allow_paths = paths;
+    },
+    isDisabled: () => !draftPolicy.secret_protection.enabled,
+    itemLabel: "allow path",
+    validateAdditions: async (paths) => {
+      const candidate = collectFormPolicy();
+      candidate.secret_protection = {
+        ...candidate.secret_protection,
+        allow_paths: paths
+      };
+      const result = await requestPolicyPreview(candidate);
+      if (result.ok && result.data?.preview)
+        return null;
+      return errorText(result);
+    }
+  }),
   "allow-paths": createPathList("allow-paths", {
     getPaths: () => draftPolicy.destructive_command_protection.allow_paths,
     setPaths: (paths) => {
@@ -4321,7 +4342,7 @@ var pathLists = {
     }
   })
 };
-var pathListFor = (name) => name === "deny-paths" || name === "allow-paths" ? pathLists[name] : null;
+var pathListFor = (name) => name === "deny-paths" || name === "allow-paths" || name === "secret-allow-paths" ? pathLists[name] : null;
 var secretRuleIsActive = (rule, overrides) => overrides[rule.id] ? overrides[rule.id] === "on" : !rule.defaultOff;
 var setSecretOverride = (rule, active) => {
   if (active === !rule.defaultOff) {
@@ -4628,13 +4649,14 @@ function render() {
   qs("app-version").textContent = state.version;
   renderSafety();
   qs("destructive-command").innerHTML = '<label class="row master"><input type="checkbox" data-destructive-command-enabled ' + checkbox(state.policy.destructive_command_protection.enabled) + '><span><strong>Destructive command protection</strong><small>Block configurable destructive git, filesystem, and execution patterns. Catastrophic and custom rules remain active when disabled.</small></span><span class="master-badge">' + (state.policy.destructive_command_protection.enabled ? "On" : "Off") + "</span></label>" + '<div id="destructive-command-rules"></div>' + '<section class="rule-tier">' + '<button type="button" class="rule-tier-head" aria-expanded="false" aria-controls="allow-paths-content"><span class="panel-chevron" aria-hidden="true"></span><span class="tier-label"><strong id="allow-paths-label">Allow paths</strong><small>Recursive deletes targeting these paths are not blocked, like /tmp. The home directory, or any path containing it, is rejected.</small></span><span class="tier-counts" id="allow-paths-count"></span></button>' + '<div class="tier-content paths-content" id="allow-paths-content" hidden>' + '<p class="muted">Use an absolute path or a ~/ path. Paste multiple lines to add several paths at once.</p>' + '<div class="paths-add"><input type="text" id="allow-paths-input" data-path-input="allow-paths" autocomplete="off" spellcheck="false" placeholder="/absolute/path or ~/path" aria-labelledby="allow-paths-label"><button type="button" class="icon-button" id="allow-paths-add-button" data-path-add="allow-paths" aria-label="Add allow path">' + pathListIcons.add + "</button></div>" + '<p class="paths-hint" id="allow-paths-hint" hidden></p>' + '<ul class="paths-list" id="allow-paths-list"></ul>' + "</div></section>";
-  qs("secret").innerHTML = '<label class="row master"><input type="checkbox" id="secret-enabled" ' + checkbox(state.policy.secret_protection.enabled) + '><span><strong>Secret protection</strong><small>Block default sensitive paths, coding CLI credential locations, and configured deny paths.</small></span><span class="master-badge">' + (state.policy.secret_protection.enabled ? "On" : "Off") + "</span></label>" + '<div id="secret-patterns"></div>' + '<section class="rule-tier">' + '<button type="button" class="rule-tier-head" aria-expanded="false" aria-controls="deny-paths-content"><span class="panel-chevron" aria-hidden="true"></span><span class="tier-label"><strong id="deny-paths-label">Deny paths</strong><small>Configured paths and everything inside them are blocked while Secret protection is on.</small></span><span class="tier-counts" id="deny-paths-count"></span></button>' + '<div class="tier-content paths-content" id="deny-paths-content" hidden>' + '<p class="muted">Paste multiple lines to add several paths at once.</p>' + '<div class="paths-add"><input type="text" id="deny-paths-input" data-path-input="deny-paths" autocomplete="off" spellcheck="false" placeholder="path/to/protect" aria-labelledby="deny-paths-label"><button type="button" class="icon-button" id="deny-paths-add-button" data-path-add="deny-paths" aria-label="Add deny path">' + pathListIcons.add + "</button></div>" + '<p class="paths-hint" id="deny-paths-hint" hidden></p>' + '<ul class="paths-list" id="deny-paths-list"></ul>' + "</div></section>";
+  qs("secret").innerHTML = '<label class="row master"><input type="checkbox" id="secret-enabled" ' + checkbox(state.policy.secret_protection.enabled) + '><span><strong>Secret protection</strong><small>Block default sensitive paths, coding CLI credential locations, and configured deny paths.</small></span><span class="master-badge">' + (state.policy.secret_protection.enabled ? "On" : "Off") + "</span></label>" + '<div id="secret-patterns"></div>' + '<section class="rule-tier">' + '<button type="button" class="rule-tier-head" aria-expanded="false" aria-controls="deny-paths-content"><span class="panel-chevron" aria-hidden="true"></span><span class="tier-label"><strong id="deny-paths-label">Deny paths</strong><small>Configured paths and everything inside them are blocked while Secret protection is on.</small></span><span class="tier-counts" id="deny-paths-count"></span></button>' + '<div class="tier-content paths-content" id="deny-paths-content" hidden>' + '<p class="muted">Paste multiple lines to add several paths at once.</p>' + '<div class="paths-add"><input type="text" id="deny-paths-input" data-path-input="deny-paths" autocomplete="off" spellcheck="false" placeholder="path/to/protect" aria-labelledby="deny-paths-label"><button type="button" class="icon-button" id="deny-paths-add-button" data-path-add="deny-paths" aria-label="Add deny path">' + pathListIcons.add + "</button></div>" + '<p class="paths-hint" id="deny-paths-hint" hidden></p>' + '<ul class="paths-list" id="deny-paths-list"></ul>' + "</div></section>" + '<section class="rule-tier">' + '<button type="button" class="rule-tier-head" aria-expanded="false" aria-controls="secret-allow-paths-content"><span class="panel-chevron" aria-hidden="true"></span><span class="tier-label"><strong id="secret-allow-paths-label">Allow paths</strong><small>Configured files and subtrees are exempt from the pattern rules. Deny paths and coding CLI protections still apply. Entries covering the home directory are rejected, and glob patterns are not supported.</small></span><span class="tier-counts" id="secret-allow-paths-count"></span></button>' + '<div class="tier-content paths-content" id="secret-allow-paths-content" hidden>' + '<p class="muted">Paste multiple lines to add several paths at once.</p>' + '<div class="paths-add"><input type="text" id="secret-allow-paths-input" data-path-input="secret-allow-paths" autocomplete="off" spellcheck="false" placeholder="~/project/.env.test or ~/project/fixtures" aria-labelledby="secret-allow-paths-label"><button type="button" class="icon-button" id="secret-allow-paths-add-button" data-path-add="secret-allow-paths" aria-label="Add allow path">' + pathListIcons.add + "</button></div>" + '<p class="paths-hint" id="secret-allow-paths-hint" hidden></p>' + '<ul class="paths-list" id="secret-allow-paths-list"></ul>' + "</div></section>";
   qs("raw").value = state.errors.length ? state.raw : formatPolicy(draftPolicy);
   qs("policy-search").value = "";
   syncSearchState();
   renderDestructiveCommands();
   renderSecretPatterns();
   pathLists["deny-paths"].render();
+  pathLists["secret-allow-paths"].render();
   pathLists["allow-paths"].render();
   updateRawSource();
   renderRetention(state);
@@ -4676,6 +4698,7 @@ var restoreDraft = () => {
     sessionStorage.removeItem("cc-safety-net-draft");
     return;
   }
+  parsed.secret_protection.allow_paths ??= [];
   draftPolicy = parsed;
   const masterToggle = document.querySelector("[data-destructive-command-enabled]");
   if (masterToggle)
@@ -4686,6 +4709,7 @@ var restoreDraft = () => {
   renderDestructiveCommands();
   renderSecretPatterns();
   pathLists["deny-paths"].render();
+  pathLists["secret-allow-paths"].render();
   pathLists["allow-paths"].render();
   syncRawFromForm();
   updateDirtyStatus();
@@ -4924,6 +4948,7 @@ document.addEventListener("change", (event) => {
       syncMasterBadges();
       renderSecretPatterns();
       pathLists["deny-paths"].render();
+      pathLists["secret-allow-paths"].render();
       syncRawFromForm();
       updateDirtyStatus();
     })();
@@ -5341,5 +5366,5 @@ load().then((loaded) => {
   </script>
 </body>
 </html>
-`;var h3='<script id="ccsn-data" type="application/json">';function w3(n){return y3.replace(h3,()=>h3+JSON.stringify({token:n}).replaceAll("<","\\u003c"))}var Dt="kenryu42/cc-safety-net",g8=`https://github.com/${Dt}`,he=1e4,D8=7;async function B3(n,t={}){let r=F({label:"gui",booleans:{noOpen:["--no-open"]}},n),e=t.log??console.log,a=t.error??console.error;if(r.errors.length>0){for(let d of r.errors)a(d);return a("Usage: cc-safety-net gui [--no-open]"),1}let l=await m8(t);if(e(`CC Safety Net policy GUI: ${l.url}`),!r.flags.noOpen)try{await(t.openBrowser??Z8)(l.url)}catch(d){a(`Failed to open browser: ${d instanceof Error?d.message:String(d)}`),a(`Open this URL manually: ${l.url}`)}if(t.keepAlive===!1)return await l.close(),0;return await J8(l),0}async function m8(n={}){let t=n.token??w8(24).toString("base64url"),r=x8((l,d)=>{k8(l,d,t,n)});await new Promise((l,d)=>{r.once("error",d),r.listen(0,"127.0.0.1",()=>{r.off("error",d),l()})});let a=`http://127.0.0.1:${r.address().port}`;return{origin:a,token:t,url:`${a}/?token=${encodeURIComponent(t)}`,close:()=>B8(r)}}async function k8(n,t,r,e){let a=new URL(n.url??"/","http://127.0.0.1");if(n.method==="GET"&&a.pathname==="/favicon.ico"){t.writeHead(204,{"cache-control":"no-store"}),t.end();return}if(!F8(n,a,r)){k(t,403,{error:"Forbidden"});return}if(n.method==="GET"&&a.pathname==="/"){z8(t,w3(r));return}if(n.method==="GET"&&a.pathname==="/api/policy"){let l=D3(e);k(t,200,{...l,configState:fn(W(e)),destructiveCommandRules:un,secretPatterns:$3,version:j(),preview:l.errors.length>0?null:k3(l.policy)});return}if(n.method==="POST"&&a.pathname==="/api/policy/preview"){let l=await gt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=m3(l.value);k(t,d.errors.length>0?400:200,d);return}if(n.method==="POST"&&a.pathname==="/api/policy/explain"){let l=await gt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=l.value;if(d===null||typeof d.command!=="string"){k(t,400,{errors:["command must be a string"]});return}let s=Nt(d.policy);if(s.length>0){k(t,400,{errors:s});return}k(t,200,q8(d.command,d.policy,e));return}if(n.method==="POST"&&a.pathname==="/api/policy"){let l=await gt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=fe(l.value,e);k(t,d.errors.length>0?400:200,d);return}if(n.method==="POST"&&a.pathname==="/api/reset"){k(t,200,fe(g3,e));return}if(n.method==="POST"&&a.pathname==="/api/repair"){k(t,200,q3(e));return}if(n.method==="GET"&&a.pathname==="/api/activity"){let l=C2(e),d=j8(a.searchParams.get("days"),l);if(d===null){k(t,400,{error:`days must be an integer between 1 and ${l}`});return}k(t,200,p3(d,e.activityLogsDir));return}if(n.method==="POST"&&a.pathname==="/api/rules/choose-directory"){k(t,200,await f3());return}if(n.method==="GET"&&a.pathname==="/api/rules"){let l=o2(e),d=new Map(l.rules.map((s)=>[s.name,s]));k(t,200,{projectPath:e.cwd??process.cwd(),canPickDirectory:b3(process.platform,process.env),rulebooks:l.rulebooks.map((s)=>({source:s.source,spec:s.spec,name:s.name,version:s.version,rules:s.rules.flatMap((L)=>{let c=d.get(L);if(!c)return[];return[{name:c.name,command:c.command,subcommand:c.subcommand,block_args:c.block_args,reason:c.reason}]})})),errors:l.errors,warnings:l.warnings});return}if(n.method==="GET"&&a.pathname==="/api/star/context"){k(t,200,await(e.fetchStarContext??(()=>A8({logsDir:e.activityLogsDir})))());return}if(n.method==="POST"&&a.pathname==="/api/star"){let l=await(e.starRepo??Q8)();k(t,200,l.ok?{ok:!0}:{ok:!1,fallbackUrl:g8});return}if(n.method==="GET"&&a.pathname==="/api/integrations"){k(t,200,await(e.fetchIntegrations??Y8)());return}if(n.method==="GET"&&a.pathname==="/api/health"){k(t,200,await(e.fetchHealth??S8)());return}if(n.method==="POST"&&(a.pathname==="/api/install"||a.pathname==="/api/uninstall")){let l=await gt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=l.value?.target;if(typeof d!=="string"||!C.some((L)=>L.target===d)){k(t,400,{error:"unknown target"});return}let s=a.pathname==="/api/install"?"install":"uninstall";k(t,200,await(e.runIntegration??H8)(s,d));return}k(t,404,{error:"Not found"})}function q8(n,t,r){let e=Lt(t),a=W(r),l=on({rules:a.policy.rules,transparentWrappers:a.policy.transparentWrappers,safety:F3(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:[...j3(e.secret_protection.overrides)],denyPaths:e.secret_protection.deny_paths}});return G2(n,{policySnapshot:l,cwd:r.cwd,userConfigDir:r.userConfigDir})}function j8(n,t){if(n===null)return Math.min(D8,t);let r=Number(n);if(!Number.isInteger(r)||r<1||r>t)return null;return r}function F8(n,t,r){if(t.searchParams.get("token")!==r)return!1;if(n.method!=="POST")return!0;return n.headers["x-cc-safety-net-token"]===r}async function gt(n){let t=[];for await(let r of n)t.push(r);try{return{ok:!0,value:JSON.parse(Buffer.concat(t).toString("utf-8")||"{}")}}catch(r){return{ok:!1,error:`Invalid JSON: ${r instanceof Error?r.message:String(r)}`}}}function z8(n,t){n.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),n.end(t)}function k(n,t,r){n.writeHead(t,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),n.end(JSON.stringify(r))}function B8(n){return new Promise((t,r)=>{n.close((e)=>e?r(e):t())})}function J8(n){return new Promise((t)=>{let r=()=>{process.off("SIGINT",e),process.off("SIGTERM",e)},e=()=>{r(),n.close().then(t)};process.once("SIGINT",e),process.once("SIGTERM",e)})}function Z8(n){let t=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",r=process.platform==="win32"?["/c","start","",n]:[n];return new Promise((e,a)=>{let l=z3(t,r,{detached:!0,stdio:"ignore"}),d=(L)=>{l.off("spawn",s),a(L)},s=()=>{l.off("error",d),l.unref(),e()};l.once("error",d),l.once("spawn",s)})}async function Q8(n="gh",t=he){return{ok:await ye(n,["api","-X","PUT",`/user/starred/${Dt}`],t)===0}}var X8={amp:"ampVersion","antigravity-cli":"antigravityCliVersion","claude-code":"claudeCodeVersion",codex:"codexCliVersion","copilot-cli":"copilotCliVersion",cursor:"cursorVersion","gemini-cli":"geminiCliVersion","hermes-agent":"hermesAgentVersion","kimi-code":"kimiCodeVersion",openclaw:"openClawVersion",opencode:"openCodeVersion",pi:"piCliVersion"};async function Y8(n={}){let t=await xn(n.fetcher),r=J3(t,n.homeDir);return{targets:c2.map((e)=>{let a=r.find((l)=>l.platform===e.id);return{target:e.id,label:v2(e.id),version:t[X8[e.id]],status:a?.configured?"active":a?.detected?"disabled":a?.inspectionStatus==="not-inspected"?"not-inspected":"not-installed"}}),system:{version:t.version,nodeVersion:t.nodeVersion,platform:t.platform}}}function J3(n,t){return tn(process.cwd(),{homeDir:t,ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.copilotCliVersion})}async function S8(n={}){let[t,r]=await Promise.all([xn(n.fetcher),(n.checkUpdates??_2)()]);return{hooks:J3(t,n.homeDir).filter((e)=>e.detected).map((e)=>({platform:e.platform,label:v2(e.platform),configured:e.configured})),update:{currentVersion:r.currentVersion,latestVersion:r.latestVersion??null,updateAvailable:r.updateAvailable}}}var x3=Promise.resolve();function H8(n,t,r={}){let e=async()=>{let l=[],d=console.log,s=console.error;console.log=(...L)=>l.push(L.map(String).join(" ")),console.error=console.log;try{return{ok:await Zn(n,[],{selectTargets:async()=>[t],output:new $8({write(c,i,u){u()}}),...r})===0,output:l.join(`
-`)}}finally{console.log=d,console.error=s}},a=x3.then(e);return x3=a.then(()=>{return},()=>{return}),a}async function A8(n={}){let[t,r,e]=await Promise.all([W8(n.command),R8(n.fetchRepo),Promise.resolve(Vn(C2(),n.logsDir).totalBlocked)]);return{starred:t,starCount:r,blockedTotal:e}}async function W8(n="gh",t=he){if(await ye(n,["auth","status"],t)!==0)return null;let r=await ye(n,["api",`/user/starred/${Dt}`],t);if(r===0)return!0;if(r===null)return null;return!1}function ye(n,t,r){return new Promise((e)=>{let a=z3(n,t,{stdio:"ignore",windowsHide:!0}),l=!1,d,s=(L)=>{if(l)return;if(l=!0,d)clearTimeout(d);e(L)};a.once("error",()=>s(null)),a.once("close",s),d=setTimeout(()=>{a.kill(),s(null)},r)})}async function R8(n=fetch){try{let t=await n(`https://api.github.com/repos/${Dt}`,{headers:{accept:"application/vnd.github+json"},signal:AbortSignal.timeout(he)});if(!t.ok)return null;let r=await t.json();return typeof r.stargazers_count==="number"?r.stargazers_count:null}catch{return null}}function K8(n){if(n[0]!=="help")return!1;let t=n[1];if(!t)Ur(),process.exit(0);if(zn(t))process.exit(0);console.error(`Unknown command: ${t}`),console.error("Run 'cc-safety-net --help' for available commands."),process.exit(1)}var M8={hook:async(n)=>{let t=R1(n);if(t){await t.run();return}console.error("hook requires exactly one integration flag. Try: cc-safety-net hook --kimi-code"),zn("hook",console.error),process.exit(1)},install:async(n)=>{process.exit(await Zn("install",n))},update:async(n)=>{process.exit(await ie(n))},uninstall:async(n)=>{process.exit(await Zn("uninstall",n))},rule:async(n)=>{process.exit(await L3(n))},status:async(n)=>{if(e2(F({label:"status"},n).errors))process.exit(1);i3()},statusline:async(n)=>{let t=F({label:"statusline",booleans:{claudeCode:["-cc","--claude-code"]}},n);if(t.errors.length===0&&t.flags.claudeCode){await be();return}if(e2(t.errors),!t.flags.claudeCode)console.error("statusline requires --claude-code (-cc)");zn("statusline",console.error),process.exit(1)},doctor:async(n)=>{let t=Kr(n);if(!t)process.exit(1);let r=await J0({json:t.json,skipUpdateCheck:t.skipUpdateCheck});process.exit(r)},logs:async(n)=>{process.exit(await c1(n))},gui:async(n)=>{process.exit(await B3(n))},explain:async(n)=>{let t=Mr(n);if(!t)process.exit(1);let r=G2(t.command,{cwd:t.cwd}),e=!!process.env.NO_COLOR||!process.stdout.isTTY;if(t.json)console.log(Cr(r));else console.log(Gr(r,{asciiOnly:e}));process.exit(0)}};async function V8(){let n=process.argv.slice(2),t=F({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},n);if(K8(n))return;let r=n[0],e=r?Mn(r):void 0;if(t.help&&e&&e.name!=="rule")zn(e.name),process.exit(0);if(!r||t.help&&!e)Ur(),process.exit(0);if(t.flags.version)W0(),process.exit(0);if(e){await M8[e.name](n.slice(1));return}let a=K1(r);if(a){await a.run();return}if(r==="--statusline"){await be();return}console.error(r.startsWith("-")?`Unknown option: ${r}`:`Unknown command: ${r}`),console.error("Run 'cc-safety-net --help' for usage."),process.exit(1)}V8().catch((n)=>{console.error("CC Safety Net error:",n),process.exit(1)});
+`;var w3='<script id="ccsn-data" type="application/json">';function x3(n){return y3.replace(w3,()=>w3+JSON.stringify({token:n}).replaceAll("<","\\u003c"))}var qt="kenryu42/cc-safety-net",D8=`https://github.com/${qt}`,yr=1e4,m8=7;async function J3(n,t={}){let e=F({label:"gui",booleans:{noOpen:["--no-open"]}},n),r=t.log??console.log,a=t.error??console.error;if(e.errors.length>0){for(let d of e.errors)a(d);return a("Usage: cc-safety-net gui [--no-open]"),1}let l=await k8(t);if(r(`CC Safety Net policy GUI: ${l.url}`),!e.flags.noOpen)try{await(t.openBrowser??Q8)(l.url)}catch(d){a(`Failed to open browser: ${d instanceof Error?d.message:String(d)}`),a(`Open this URL manually: ${l.url}`)}if(t.keepAlive===!1)return await l.close(),0;return await Z8(l),0}async function k8(n={}){let t=n.token??x8(24).toString("base64url"),e=$8((l,d)=>{q8(l,d,t,n)});await new Promise((l,d)=>{e.once("error",d),e.listen(0,"127.0.0.1",()=>{e.off("error",d),l()})});let a=`http://127.0.0.1:${e.address().port}`;return{origin:a,token:t,url:`${a}/?token=${encodeURIComponent(t)}`,close:()=>J8(e)}}async function q8(n,t,e,r){let a=new URL(n.url??"/","http://127.0.0.1");if(n.method==="GET"&&a.pathname==="/favicon.ico"){t.writeHead(204,{"cache-control":"no-store"}),t.end();return}if(!z8(n,a,e)){k(t,403,{error:"Forbidden"});return}if(n.method==="GET"&&a.pathname==="/"){B8(t,x3(e));return}if(n.method==="GET"&&a.pathname==="/api/policy"){let l=m3(r);k(t,200,{...l,configState:fn(W(r)),destructiveCommandRules:un,secretPatterns:g3,version:j(),preview:l.errors.length>0?null:q3(l.policy)});return}if(n.method==="POST"&&a.pathname==="/api/policy/preview"){let l=await kt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=k3(l.value);k(t,d.errors.length>0?400:200,d);return}if(n.method==="POST"&&a.pathname==="/api/policy/explain"){let l=await kt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=l.value;if(d===null||typeof d.command!=="string"){k(t,400,{errors:["command must be a string"]});return}let s=ee(d.policy);if(s.length>0){k(t,400,{errors:s});return}k(t,200,j8(d.command,d.policy,r));return}if(n.method==="POST"&&a.pathname==="/api/policy"){let l=await kt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=fr(l.value,r);k(t,d.errors.length>0?400:200,d);return}if(n.method==="POST"&&a.pathname==="/api/reset"){k(t,200,fr(D3,r));return}if(n.method==="POST"&&a.pathname==="/api/repair"){k(t,200,j3(r));return}if(n.method==="GET"&&a.pathname==="/api/activity"){let l=G2(r),d=F8(a.searchParams.get("days"),l);if(d===null){k(t,400,{error:`days must be an integer between 1 and ${l}`});return}k(t,200,u3(d,r.activityLogsDir));return}if(n.method==="POST"&&a.pathname==="/api/rules/choose-directory"){k(t,200,await h3());return}if(n.method==="GET"&&a.pathname==="/api/rules"){let l=o2(r),d=new Map(l.rules.map((s)=>[s.name,s]));k(t,200,{projectPath:r.cwd??process.cwd(),canPickDirectory:f3(process.platform,process.env),rulebooks:l.rulebooks.map((s)=>({source:s.source,spec:s.spec,name:s.name,version:s.version,rules:s.rules.flatMap((c)=>{let i=d.get(c);if(!i)return[];return[{name:i.name,command:i.command,subcommand:i.subcommand,block_args:i.block_args,reason:i.reason}]})})),errors:l.errors,warnings:l.warnings});return}if(n.method==="GET"&&a.pathname==="/api/star/context"){k(t,200,await(r.fetchStarContext??(()=>W8({logsDir:r.activityLogsDir})))());return}if(n.method==="POST"&&a.pathname==="/api/star"){let l=await(r.starRepo??X8)();k(t,200,l.ok?{ok:!0}:{ok:!1,fallbackUrl:D8});return}if(n.method==="GET"&&a.pathname==="/api/integrations"){k(t,200,await(r.fetchIntegrations??S8)());return}if(n.method==="GET"&&a.pathname==="/api/health"){k(t,200,await(r.fetchHealth??H8)());return}if(n.method==="POST"&&(a.pathname==="/api/install"||a.pathname==="/api/uninstall")){let l=await kt(n);if(!l.ok){k(t,400,{errors:[l.error]});return}let d=l.value?.target;if(typeof d!=="string"||!C.some((c)=>c.target===d)){k(t,400,{error:"unknown target"});return}let s=a.pathname==="/api/install"?"install":"uninstall";k(t,200,await(r.runIntegration??A8)(s,d));return}k(t,404,{error:"Not found"})}function j8(n,t,e){let r=it(t),a=W(e),l=on({rules:a.policy.rules,transparentWrappers:a.policy.transparentWrappers,safety:z3(r.safety),worktreeMode:r.workflow.worktree_mode,destructiveCommandProtectionEnabled:r.destructive_command_protection.enabled,destructiveCommandRuleOverrides:r.destructive_command_protection.overrides,destructiveCommandAllowPaths:r.destructive_command_protection.allow_paths,secretProtection:{enabled:r.secret_protection.enabled,disabledRules:[...F3(r.secret_protection.overrides)],denyPaths:r.secret_protection.deny_paths,allowPaths:r.secret_protection.allow_paths}});return V2(n,{policySnapshot:l,cwd:e.cwd,userConfigDir:e.userConfigDir})}function F8(n,t){if(n===null)return Math.min(m8,t);let e=Number(n);if(!Number.isInteger(e)||e<1||e>t)return null;return e}function z8(n,t,e){if(t.searchParams.get("token")!==e)return!1;if(n.method!=="POST")return!0;return n.headers["x-cc-safety-net-token"]===e}async function kt(n){let t=[];for await(let e of n)t.push(e);try{return{ok:!0,value:JSON.parse(Buffer.concat(t).toString("utf-8")||"{}")}}catch(e){return{ok:!1,error:`Invalid JSON: ${e instanceof Error?e.message:String(e)}`}}}function B8(n,t){n.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),n.end(t)}function k(n,t,e){n.writeHead(t,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),n.end(JSON.stringify(e))}function J8(n){return new Promise((t,e)=>{n.close((r)=>r?e(r):t())})}function Z8(n){return new Promise((t)=>{let e=()=>{process.off("SIGINT",r),process.off("SIGTERM",r)},r=()=>{e(),n.close().then(t)};process.once("SIGINT",r),process.once("SIGTERM",r)})}function Q8(n){let t=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",e=process.platform==="win32"?["/c","start","",n]:[n];return new Promise((r,a)=>{let l=B3(t,e,{detached:!0,stdio:"ignore"}),d=(c)=>{l.off("spawn",s),a(c)},s=()=>{l.off("error",d),l.unref(),r()};l.once("error",d),l.once("spawn",s)})}async function X8(n="gh",t=yr){return{ok:await hr(n,["api","-X","PUT",`/user/starred/${qt}`],t)===0}}var Y8={amp:"ampVersion","antigravity-cli":"antigravityCliVersion","claude-code":"claudeCodeVersion",codex:"codexCliVersion","copilot-cli":"copilotCliVersion",cursor:"cursorVersion","gemini-cli":"geminiCliVersion","hermes-agent":"hermesAgentVersion","kimi-code":"kimiCodeVersion",openclaw:"openClawVersion",opencode:"openCodeVersion",pi:"piCliVersion"};async function S8(n={}){let t=await xn(n.fetcher),e=Z3(t,n.homeDir);return{targets:i2.map((r)=>{let a=e.find((l)=>l.platform===r.id);return{target:r.id,label:v2(r.id),version:t[Y8[r.id]],status:a?.configured?"active":a?.detected?"disabled":a?.inspectionStatus==="not-inspected"?"not-inspected":"not-installed"}}),system:{version:t.version,nodeVersion:t.nodeVersion,platform:t.platform}}}function Z3(n,t){return tn(process.cwd(),{homeDir:t,ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.copilotCliVersion})}async function H8(n={}){let[t,e]=await Promise.all([xn(n.fetcher),(n.checkUpdates??E2)()]);return{hooks:Z3(t,n.homeDir).filter((r)=>r.detected).map((r)=>({platform:r.platform,label:v2(r.platform),configured:r.configured})),update:{currentVersion:e.currentVersion,latestVersion:e.latestVersion??null,updateAvailable:e.updateAvailable}}}var $3=Promise.resolve();function A8(n,t,e={}){let r=async()=>{let l=[],d=console.log,s=console.error;console.log=(...c)=>l.push(c.map(String).join(" ")),console.error=console.log;try{return{ok:await Xn(n,[],{selectTargets:async()=>[t],output:new g8({write(i,L,u){u()}}),...e})===0,output:l.join(`
+`)}}finally{console.log=d,console.error=s}},a=$3.then(r);return $3=a.then(()=>{return},()=>{return}),a}async function W8(n={}){let[t,e,r]=await Promise.all([R8(n.command),K8(n.fetchRepo),Promise.resolve(Cn(G2(),n.logsDir).totalBlocked)]);return{starred:t,starCount:e,blockedTotal:r}}async function R8(n="gh",t=yr){if(await hr(n,["auth","status"],t)!==0)return null;let e=await hr(n,["api",`/user/starred/${qt}`],t);if(e===0)return!0;if(e===null)return null;return!1}function hr(n,t,e){return new Promise((r)=>{let a=B3(n,t,{stdio:"ignore",windowsHide:!0}),l=!1,d,s=(c)=>{if(l)return;if(l=!0,d)clearTimeout(d);r(c)};a.once("error",()=>s(null)),a.once("close",s),d=setTimeout(()=>{a.kill(),s(null)},e)})}async function K8(n=fetch){try{let t=await n(`https://api.github.com/repos/${qt}`,{headers:{accept:"application/vnd.github+json"},signal:AbortSignal.timeout(yr)});if(!t.ok)return null;let e=await t.json();return typeof e.stargazers_count==="number"?e.stargazers_count:null}catch{return null}}function M8(n){if(n[0]!=="help")return!1;let t=n[1];if(!t)Te(),process.exit(0);if(Jn(t))process.exit(0);console.error(`Unknown command: ${t}`),console.error("Run 'cc-safety-net --help' for available commands."),process.exit(1)}var V8={hook:async(n)=>{let t=R1(n);if(t){await t.run();return}console.error("hook requires exactly one integration flag. Try: cc-safety-net hook --kimi-code"),Jn("hook",console.error),process.exit(1)},install:async(n)=>{process.exit(await Xn("install",n))},update:async(n)=>{process.exit(await pr(n))},uninstall:async(n)=>{process.exit(await Xn("uninstall",n))},rule:async(n)=>{process.exit(await i3(n))},status:async(n)=>{if(r2(F({label:"status"},n).errors))process.exit(1);p3()},statusline:async(n)=>{let t=F({label:"statusline",booleans:{claudeCode:["-cc","--claude-code"]}},n);if(t.errors.length===0&&t.flags.claudeCode){await br();return}if(r2(t.errors),!t.flags.claudeCode)console.error("statusline requires --claude-code (-cc)");Jn("statusline",console.error),process.exit(1)},doctor:async(n)=>{let t=Ve(n);if(!t)process.exit(1);let e=await J0({json:t.json,skipUpdateCheck:t.skipUpdateCheck});process.exit(e)},logs:async(n)=>{process.exit(await i1(n))},gui:async(n)=>{process.exit(await J3(n))},explain:async(n)=>{let t=Ge(n);if(!t)process.exit(1);let e=V2(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;if(t.json)console.log(Oe(e));else console.log(Ue(e,{asciiOnly:r}));process.exit(0)}};async function G8(){let n=process.argv.slice(2),t=F({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},n);if(M8(n))return;let e=n[0],r=e?Gn(e):void 0;if(t.help&&r&&r.name!=="rule")Jn(r.name),process.exit(0);if(!e||t.help&&!r)Te(),process.exit(0);if(t.flags.version)W0(),process.exit(0);if(r){await V8[r.name](n.slice(1));return}let a=K1(e);if(a){await a.run();return}if(e==="--statusline"){await br();return}console.error(e.startsWith("-")?`Unknown option: ${e}`:`Unknown command: ${e}`),console.error("Run 'cc-safety-net --help' for usage."),process.exit(1)}G8().catch((n)=>{console.error("CC Safety Net error:",n),process.exit(1)});