cc-safety-net 2.0.8 → 2.0.10

package/dist/bin/cc-safety-net.js

@@ -1,43 +1,43 @@
 #!/usr/bin/env node
-import{$ as u1,$a as Et,A as on,Aa as Rr,B as pl,Ba as Vr,C as n2,Ca as p1,D as _,Da as Ar,E as t1,Ea as Mr,F as Ut,Fa as E,G as Mn,Ga as _t,H as Ct,Ha as r1,I as T2,Ia as e1,J as g2,Ja as P,K as a1,Ka as Yl,L as i2,La as wn,M as ge,Ma as Sl,N as v1,Na as kr,O as Gn,Oa as Hl,P as ke,Pa as Wl,Q as qe,Qa as Kl,R as k2,Ra as wt,S as Cn,Sa as Rl,T as $n,Ta as Vl,U as Dn,Ua as pe,V as ae,Va as ve,W as fn,Wa as ue,X as q2,Xa as be,Y as l1,Ya as ol,Z as p2,Za as Nr,_ as je,_a as ne,aa as Be,ab as te,b as Br,ba as Je,bb as re,c as Jr,ca as s1,cb as y2,d as V,da as le,db as m2,e as Zr,ea as Sr,eb as c2,f as Vt,fa as se,fb as ee,g as Y,ga as de,gb as A,h as g,ha as ce,hb as xn,i as vn,ia as d1,ib as yn,j as D,ja as Hr,jb as Fe,k as D2,ka as k,kb as z2,l as Or,la as c1,lb as v2,m as A2,ma as ze,mb as We,n as un,na as L2,nb as Un,o as xl,oa as hn,p as Gt,pa as L1,q as Tr,qa as i1,r as bn,ra as Le,s as _r,sa as ie,t as n1,ta as Wr,u as Er,ua as C2,v as Pr,va as Ot,w as I,wa as Tt,x as N,xa as Ir,y as G2,ya as R2,z as U2,za as Xl}from"../chunks/index-hwg5anw1.js";var Ol=["-h","--help"];function J(n,t){let r=Object.entries(n.booleans??{}),e=Object.entries(n.values??{}),a=Object.fromEntries(r.map(([i])=>[i,!1])),l={},s=[],d=[],c=!1,L=-1;for(let[i,v]of t.entries()){if(i<=L)continue;if(v==="--"){s.push(...t.slice(i+1));break}if(Ol.includes(v)){c=!0;continue}let b=r.find(([,f])=>f.includes(v));if(b){a[b[0]]=!0;continue}let p=e.find(([,f])=>f.includes(v));if(p){let f=t[i+1];if(f===void 0||f.startsWith("-")){d.push(`${v} requires a value`);continue}l[p[0]]=f,L=i+1;continue}if(v.startsWith("-")){d.push(`Unknown option for ${n.label}: ${v}`);continue}if(n.positionals==="tail"){s.push(...t.slice(i));break}s.push(v)}if(n.positionals!=="list"&&n.positionals!=="tail")d.push(...s.map((i)=>`Unexpected argument for ${n.label}: ${i}`));return{flags:a,values:l,positionals:s,help:c,errors:d}}function s2(n){for(let t of n)console.error(t);return n.length>0}import{readdirSync as Zs,statSync as fe,unlinkSync as Qs}from"node:fs";import{basename as ye,dirname as Xs,join as Ys,resolve as Ss}from"node:path";function Z(n){return Array.from(n,(t)=>{let r=t.charCodeAt(0);if(r<=31||r>=127&&r<=159)return`\\x${r.toString(16).padStart(2,"0")}`;return t}).join("")}var Ht=(n)=>{let t=Date.now()-new Date(n).getTime();if(!Number.isFinite(t))return"";let r=Math.floor(t/60000),e=Math.floor(r/60),a=Math.floor(e/24);if(a>0)return`${a}d ago`;if(e>0)return`${e}h ago`;if(r>0)return`${r}m ago`;return"just now"},H2=(n)=>{let t=(n??"").trim().split(/\s+/).filter((a)=>a&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(a)),r=t[0]?.split("/").pop();if(!r)return null;let e=t[1];return e&&/^[a-z][a-z0-9-]*$/.test(e)?`${r} ${e}`:r};import{existsSync as Tl,readdirSync as _l,readFileSync as El}from"node:fs";import{join as Pl}from"node:path";function f2(n,t){try{return _l(n,{withFileTypes:!0,encoding:"utf8"}).flatMap((r)=>{let e=Pl(n,r.name);if(r.isDirectory())return f2(e,t);if(r.name.endsWith(".jsonl"))return[e];return[]})}catch{if(t&&Tl(n))t.count++;return[]}}function Wt(n){let t=(a)=>`${a.sessionId}
-${H2(a.segment||a.command)}`,r=n.filter((a)=>a.decision!=="allow"),e=r.filter((a)=>a.sessionId).reduce((a,l)=>a.set(t(l),(a.get(t(l))??0)+1),new Map);return new Set(r.filter((a)=>a.failureStage||(e.get(t(a))??0)>=2))}function pn(n,t){try{return El(n,"utf-8").split(`
-`).filter(Boolean).flatMap((r)=>{try{return[JSON.parse(r)]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as gs}from"node:path";var Il=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function Qr(n){let t=0,r={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(e){n.record({kind:"step",scope:"global",step:e})},recordSegment(e,a=r.currentSegmentIndex){if(a===void 0)return;n.record({kind:"step",scope:"segment",segmentIndex:a,step:e})}};return r}function Xr(n={}){let t=[],r=n.maxEvents??512,e={maxTextLength:n.maxTextLength??2048,maxListLength:n.maxListLength??128,maxObjectProperties:n.maxObjectProperties??n.maxListLength??128,maxDepth:n.maxDepth??16},a=0,l,s=new Set;return{record(d){if(l)return;try{if(!d||t.length>=r){a++;return}t.push(Rt(Nl(d,e,s)))}catch{a++}},finish(d){if(l)return l;try{l=Rt({events:Object.freeze(t),droppedEvents:a,terminal:ns(d,e,s)})}catch{a++,l=Object.freeze({events:Object.freeze(t),droppedEvents:a,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,e.maxTextLength),segment:"trace unavailable".slice(0,e.maxTextLength)})})}return l}}}function Nl(n,t,r){if(n.kind!=="step")throw TypeError("invalid trace event");let{scope:e,step:a}=n;Rn(a,r,t);let l=W2(a,t,r);if(e==="global")return{kind:"step",scope:"global",step:l};if(e!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:n.segmentIndex,step:l}}function ns(n,t,r){let e=n.result;if(e==="allowed")return Object.freeze({result:"allowed"});if(e!=="blocked")throw TypeError("invalid trace terminal");let a=n.ruleId;return Object.freeze({result:"blocked",reason:W2(n.reason,t,r),segment:W2(n.segment,t,r),...a?{ruleId:W2(a,t,r)}:{}})}function Rn(n,t,r,e=0,a=new WeakSet){if(typeof n==="string"){let d=n.slice(0,r.maxTextLength);if(!Vt(d))return;for(let c of Zr(d))for(let L of c.match(/[^\s"'()$]+/g)??[])t.add(Yr(L));return}if(!n||typeof n!=="object"||e>=r.maxDepth||a.has(n))return;if(a.add(n),Array.isArray(n)){let d=Math.min(n.length,r.maxListLength);for(let c=0;c<d;c++)Rn(n[c],t,r,e+1,a);return}let l=0,s=new Set;for(let d in n){if(!Object.hasOwn(n,d))continue;if(l>=r.maxObjectProperties)break;l++,Rn(d,t,r);let c=Kt(d,r,t);if(s.has(c))continue;s.add(c),Rn(n[d],t,r,e+1,a)}}function W2(n,t,r,e=0,a=new WeakSet){if(typeof n==="string")return Kt(n,t,r);if(!n||typeof n!=="object")return n;if(e>=t.maxDepth)return;if(a.has(n))return;if(a.add(n),Array.isArray(n)){let d=[],c=Math.min(n.length,t.maxListLength);for(let L=0;L<c;L++)d.push(W2(n[L],t,r,e+1,a));return d}let l={},s=0;for(let d in n){if(!Object.hasOwn(n,d))continue;if(s>=t.maxObjectProperties)break;s++;let c=Kt(d,t,r);if(Object.hasOwn(l,c))continue;Object.defineProperty(l,c,{value:W2(n[d],t,r,e+1,a),enumerable:!0,configurable:!0,writable:!0})}return l}function Kt(n,t,r){let e=n.slice(0,t.maxTextLength),a=Vt(e)?Jr(e):e,l=r.size>0?rs(a,r):a;return(ts(l)?Br(l):l).slice(0,t.maxTextLength)}function ts(n){return n.includes("PRIVATE KEY")||n.includes("://")||n.includes("eyJ")||n.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(n)||n.length>=14&&Il.some((t)=>n.includes(t))||n.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(n)}function rs(n,t){return n.replace(/[^\s"'()$]+/g,(r)=>t.has(Yr(r))?"<redacted>":r)}function Yr(n){let t=2166136261,r=2166136261;for(let e=0;e<n.length;e++)t=Math.imul(t^n.charCodeAt(e),16777619),r=Math.imul(r^n.charCodeAt(n.length-e-1),16777619);return`${t>>>0}:${r>>>0}:${n.length}`}function Rt(n){if(n&&typeof n==="object"&&!Object.isFrozen(n)){for(let t of Object.values(n))Rt(t);Object.freeze(n)}return n}function Kr(n,t,r){let e=r??Sr(),a=e.getCommandProgram(n,t.shell??"auto"),l=Xr(),s=Qr(l),d=a.dialect==="powershell"?e.getCommandProgram(n,"posix"):a,c=Hr(d);s.recordGlobal({type:"parse",input:n,segments:c.map((v)=>[...v])});let L=Wr(n,{...t,analyzePartialProgram:!0,trace:s},a,e),i=s.getNextSegmentIndex();if(L&&i>0&&i<c.length)s.recordSegment({type:"segment-skipped",index:i,reason:"prior-segment-blocked"},i);return Object.freeze({decision:L,trace:l.finish(L?{result:"blocked",reason:L.reason,segment:L.evidence.find((v)=>v.kind==="command")?.segment??n,...L.ruleId?{ruleId:L.ruleId}:{}}:{result:"allowed"}),program:a})}import{resolve as es}from"node:path";function At(n){let t=Rr().safeParse(n);return{errors:t.success?[]:Ar(t.error.issues),ruleNames:new Set(Vr(n).map((r)=>r.toLowerCase()))}}function Mt(n){let t=Gr(n);if(!t.ok)return t.result;return At(t.parsed)}function Gr(n){let t=[],r=new Set;try{let e=typeof n==="string"?vn(n):n,a=D(e);if(a===null)return t.push(`File not found: ${e.path}`),{ok:!1,result:{errors:t,ruleNames:r}};if(!a.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:r}};return{ok:!0,parsed:JSON.parse(a)}}catch(e){if(e instanceof Y)return t.push(e.message),{ok:!1,result:{errors:t,ruleNames:r}};let a=e instanceof Error?e.message:String(e);return t.push(e instanceof SyntaxError?"Invalid JSON":a),{ok:!1,result:{errors:t,ruleNames:r}}}}function Ur(n){return es(n??process.cwd(),".safety-net.json")}function d2(n){let t=Gr(n);if(!t.ok)return t.result;let r=Mr(t.parsed);return{errors:r.errors,ruleNames:r.sources}}import{isAbsolute as as,join as Vn,relative as ls,resolve as Cr,sep as ss}from"node:path";async function M2(n={}){let t=It(n);return ds(t,await An(t,R2()))}function ds(n,t){if(!t.ok)return t;let r=_(n),e=[...new Set(c2(r.configPath,r.lockPath,n,r.filesystemScope))];if(e.length===0)return t;return{ok:!1,errors:e,warnings:t.warnings,entries:t.entries}}async function An(n,t,r,e={}){let a=null,l=!1;try{let s=_(n),d=_t(s.configTarget);if(!d.ok)return d.result;let c=d.config;if(n.check)return us(c,s,n);a={target:s.lockTarget,content:D(s.lockTarget)};let L=Et(s.lockTarget);if(L.errors.some((h)=>h.startsWith("Unable to access ")))return{ok:!1,errors:L.errors,warnings:[],entries:[]};if(n.only&&L.errors.length>0)return{ok:!1,errors:L.errors,warnings:[],entries:[]};let i=L.errors.length>0?null:L.lock,v=n.only?Nr(c,i,n.only):{ok:!0,specs:c.rules};if(!v.ok)return v.result;if(n.only&&!i&&v.specs.length<c.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${Pr}`],warnings:[],entries:[]};let b=(await Ls(v.specs,(h)=>te(h,s.configDir,n,i,s.filesystemScope,t),t)).map((h)=>bs(h,i,r));for(let h of b)ys(h.content,h.entry,s.configDir,n,s.filesystemScope);let p=n.only?os(c,i,b):b.map((h)=>h.entry);l=!0,P(s.lockTarget,{version:1,rulebooks:p},void 0,e._testAfterPolicyRename);let f=new Map(b.map((h)=>[h.entry.spec,h.rulebook.rules.length])),u=hs(p,s.configDir,n,s.filesystemScope,e);return{ok:!0,errors:[],warnings:u,entries:p.map((h)=>fs(h,f))}}catch(s){if(l&&a)try{K2(a.target,a.content)}catch(d){return V2(d)}return V2(s)}}async function Pt(n,t={}){return cs(n,It(t),R2())}async function cs(n,t,r,e={}){let a=null,l=!1;try{let s=_(t),d=D(s.configTarget);a={target:s.configTarget,content:d};let c=_t(s.configTarget);if(!c.ok)return c.result;let L=c.config,i=Er(n)?await re(n,r):[{spec:n}],v=i.map((f)=>f.spec),b=[...new Set([...L.rules,...v])];if(b.length>Ot)return is();if(b.length!==L.rules.length)l=!0,P(s.configTarget,{version:1,rules:b,overrides:L.overrides??{},transparent_wrappers:L.transparent_wrappers??[]},void 0,e._testAfterPolicyRename);let p=await An(t,r,new Map(i.filter((f)=>!!f.display_ref).map((f)=>[f.spec,f.display_ref])),e);if(!p.ok)K2(s.configTarget,d);return p}catch(s){if(l&&a)try{K2(a.target,a.content)}catch(d){return V2(d)}return V2(s)}}async function Ls(n,t,r=R2()){if(n.length>Ot)throw Error(Tt);let e=Array(n.length),a=0,l,s=Array.from({length:Math.min(n.length,Ir.concurrency)},async()=>{while(!l){let d=a;if(d>=n.length)return;a++;try{e[d]=await t(n[d],d,r.controller.signal)}catch(c){if(!l)l={value:c},a=n.length,r.controller.abort(c);return}}});if(await Promise.all(s),l)throw l.value;return e}function is(){return{ok:!1,errors:[Tt],warnings:[],entries:[]}}function It(n){return{cwd:n.cwd,cacheConfigDir:n.cacheConfigDir,userConfigDir:n.userConfigDir,userConfigPath:n.userConfigPath,projectConfigPath:n.projectConfigPath,global:n.global,check:n.check,only:n.only,refresh:n.refresh}}function ps(n){return{...It(n),deleteSource:n.deleteSource}}async function Nt(n,t={}){try{return await vs(n,ps(t),{})}catch(r){return V2(r)}}async function vs(n,t,r){let e=_(t),a=E(e.configTarget);if(a.errors.length>0)return{ok:!1,errors:a.errors,warnings:[],entries:[]};if(!a.config)return{ok:!1,errors:[`No config found at ${e.configPath}`],warnings:[],entries:[]};let l=Et(e.lockTarget);if(l.errors.length>0)return{ok:!1,errors:l.errors,warnings:[],entries:[]};let s=ne(a.config.rules,l.lock,n);if(!s.ok)return s.result;let d=t.deleteSource?ws(e.configDir,s.specs,l.lock,e.filesystemScope):{ok:!0,dirs:[]};if(!d.ok)return d.result;let c=D(e.configTarget);if(c===null)return V2(Error("Rules config is unavailable."));try{P(e.configTarget,{version:1,rules:a.config.rules.filter((v)=>!s.specs.includes(v)),overrides:a.config.overrides??{},transparent_wrappers:a.config.transparent_wrappers??[]},void 0,r._testAfterPolicyRename)}catch(v){throw K2(e.configTarget,c),v}let L=await An(t,R2(),void 0,r);if(!L.ok)return K2(e.configTarget,c),L;let i=$s(d.dirs,r,e.filesystemScope);if(!i.ok){K2(e.configTarget,c);let v=await An(t,R2(),void 0,r);if(!v.ok)return{ok:!1,errors:[...i.result.errors,...v.errors],warnings:v.warnings,entries:v.entries};return i.result}return L}async function us(n,t,r){let e=ee(n,t.lockPath,t.configDir,r,r.global?"user":"project",t.filesystemScope);return{ok:e.errors.length===0&&e.warnings.length===0,errors:[...e.errors,...e.warnings],warnings:[],entries:e.entries}}function bs(n,t,r){let e=t?.rulebooks.find((l)=>l.spec===n.entry.spec&&l.kind==="github"),a=r?.get(n.entry.spec)??(e?.kind==="github"?e.display_ref:void 0);if(!a||n.entry.kind!=="github")return n;return{...n,entry:{...n.entry,display_ref:a}}}function os(n,t,r){let e=new Set(n.rules),a=new Set(t?.rulebooks.map((s)=>s.spec)??[]),l=new Map(r.map((s)=>[s.entry.spec,s.entry]));return[...(t?.rulebooks.filter((s)=>e.has(s.spec))??[]).map((s)=>l.get(s.spec)??s),...r.filter((s)=>!a.has(s.entry.spec)).map((s)=>s.entry)]}function fs(n,t){return{...n,ruleCount:t.get(n.spec)}}function ys(n,t,r,e,a){let l=Ut(t,Ct(r,e));D2(g(a,l),n)}function hs(n,t,r,e,a){let l=Ct(t,r),s=Mn(l),d=g(e,s),c=A2(d);if(!c)return[];let L=n.map((v)=>g(e,Ut(v,l))),i=c.filter((v)=>v.kind==="directory").map((v)=>({directory:g(e,Vn(s,v.name)),identity:g(e,Vn(s,v.name,_r))})).filter((v)=>!L.some((b)=>Or(v.identity,b))).map((v)=>v.directory);for(let v of i)Tr(v);return i.flatMap((v)=>{try{return Ds(v,a),[]}catch{return["Unable to prune rules policy cache safely."]}})}function ws(n,t,r,e){let a=new Map(r?.rulebooks.map((L)=>[L.spec,L])??[]),l=t.flatMap((L)=>{let i=a.get(L);if(!i)return bn.test(L)?[]:["--delete-source can only delete local rulebook sources"];return i.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),s=t.map((L)=>{let i=a.get(L);return Vn(n,i?.kind==="local-directory"?i.path:L)}),d=l.length>0?[]:s.flatMap((L)=>xs(n,L,e)),c=[...l,...d];return c.length>0?{ok:!1,result:{ok:!1,errors:c,warnings:[],entries:[]}}:{ok:!0,dirs:s}}function xs(n,t,r){let e=Cr(n),a=Cr(t),l=ls(e,a);if(l===""||l===".."||l.startsWith(`..${ss}`)||as(l))return[`Refusing to delete local rulebook source outside ${n}: ${t}`];let s=g(r,a),d=A2(s);if(!d)return[`Local rulebook source directory not found: ${t}`];let c=d.find((L)=>L.name==="rulebook.json");if(!c)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(c.kind!=="file")throw new Y(r.label);if(D(g(r,Vn(a,"rulebook.json"))),d.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function $s(n,t,r){let e=n.flatMap((a)=>{try{return ms(g(r,a),t),[]}catch(l){return[`Failed to delete local rulebook source ${a}: ${l instanceof Error?l.message:String(l)}`]}});return e.length>0?{ok:!1,result:{ok:!1,errors:e,warnings:[],entries:[]}}:{ok:!0}}function Ds(n,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(n.path);return}Gt(n)}function ms(n,t){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(n.path);return}Gt(n)}function K2(n,t){if(t===null){un(n);return}D2(n,t)}function V2(n){return{ok:!1,errors:[n instanceof Error?n.message:String(n)],warnings:[],entries:[]}}function O2(n,t){let r=qs(t),e=Le(r),a={effectiveLevel:e.effectiveLevel,selectedPreset:r.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:e.effectiveCapabilities,destructiveCommandRuleOverrides:r.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:l,configValid:s}=ks({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!n||!n.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:l,configValid:s,...a};let d=js(n,r);if(d)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:d.rule,matched:!0,reason:d.reason}]}]},result:"blocked",reason:V(d.reason),segment:V(d.target),...d.ruleId?{ruleId:V(d.ruleId)}:{},configSource:l,configValid:s,...a};let c=Kr(n,r),L=c.decision,i=L?.ruleId??zs(n,r),v=fn.find((p)=>p.id===i&&p.activationCapability),b=v?e.policy.effectiveDestructiveCommandRules[v.id]:void 0;return{trace:Bs(c.trace),result:L?"blocked":"allowed",reason:L?V(L.reason):void 0,segment:L?V(L.evidence.find((p)=>p.kind==="command")?.segment??n):void 0,ruleId:L?.ruleId?V(L.ruleId):void 0,customRule:Fs(Js(L?.ruleId,r.policySnapshot)),configSource:l,configValid:s,...a,...v&&b?{ruleActivation:{id:v.id,...b}}:{}}}function ks(n){let t=I(n?.cwd),r=n?.userConfigPath??N(n),e=n2({cwd:n?.cwd,userConfigDir:n?.userConfigDir,userConfigPath:n?.userConfigPath});try{if(D(e.projectConfigTarget)!==null){if(d2(e.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(a){if(a instanceof Y)return{configSource:t,configValid:!1};throw a}try{if(D(e.userConfigTarget)!==null){let a=d2(e.userConfigTarget);return{configSource:r,configValid:a.errors.length===0}}return{configSource:null,configValid:!0}}catch(a){if(a instanceof Y)return{configSource:r,configValid:!1};throw a}}function qs(n){let t=gs(n?.cwd??process.cwd()),r=n?.policySnapshot??A({cwd:t,userConfigDir:n?.userConfigDir}),e=L2(r.policy);return{cwd:t,effectiveCwd:t,policySnapshot:r,environment:ae(),protectedGitMetadata:ce(t),effectiveCapabilities:e.capabilities,strict:n?.strict??e.strict,paranoidRm:e.paranoidRm,paranoidInterpreters:e.paranoidInterpreters,worktreeMode:e.worktreeMode}}function js(n,t){let r=t.cwd??process.cwd(),e=le(C2("",{command:n},{kind:"command",shell:"posix"},{executionCwd:r,configCwd:r},n)),a=ve(e);if(a)return{reason:pe,target:a.target,ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};let l=de(e,t.protectedGitMetadata);if(l)return{reason:se,target:l.target,ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};let s=t.policySnapshot.policy,d=s.secretProtection.enabled===!1?null:be(e,s.secretProtection,{strict:t.strict});if(d)return{reason:ue,target:d.target,ruleId:d.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"};return null}function zs(n,t){let r=t.policySnapshot.policy,e=yn({...r,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...r.destructiveCommandRuleOverrides,...Object.fromEntries(fn.flatMap((a)=>a.activationCapability?[[a.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return ie(n,{...t,policySnapshot:e,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function Fs(n){if(!n)return;return{id:V(n.id),...n.rulebook?{rulebook:{name:V(n.rulebook.name),version:V(n.rulebook.version)}}:{},...n.source?{source:V(n.source)}:{},...n.override?{override:{type:"reason",reason:V(n.override.reason)}}:{}}}function Bs(n){let t=n.events.flatMap((e)=>e.kind==="step"&&e.scope==="global"?[e.step]:[]),r=new Map;for(let e of n.events){if(e.kind!=="step"||e.scope!=="segment")continue;let a=r.get(e.segmentIndex)??{index:e.segmentIndex,steps:[]};a.steps.push(e.step),r.set(e.segmentIndex,a)}return{steps:t,segments:[...r.values()]}}function Js(n,t){let r=n?.replace(/^custom\./,"");if(!r||!t.policy.rules.some((e)=>e.name===r))return;return t.ruleMetadata[r]??Object.freeze({id:r})}function Hs(n){let t=T2(),r=J({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},n);if(s2(r.errors))return null;if(r.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(r.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let e=r.values.limit===void 0?20:oe(r.values.limit);if(e===null)return console.error("--limit must be a positive number"),null;let a=r.values.since===void 0?Math.min(30,t):oe(r.values.since);if(a===null||a>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let l={limit:e,limitExplicit:r.values.limit!==void 0,since:a,sinceExplicit:r.values.since!==void 0,all:r.flags.all,json:r.flags.json,suspect:r.flags.suspect,pruneLegacy:r.flags.pruneLegacy,dryRun:r.flags.dryRun,id:r.values.id,agent:r.values.agent,rule:r.values.rule,session:r.values.session,project:r.values.project===void 0?void 0:Ss(r.values.project)};if(l.id&&(l.agent!==void 0||l.rule!==void 0||l.session!==void 0||l.project!==void 0||l.suspect||l.sinceExplicit||l.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(l.pruneLegacy&&(l.id!==void 0||l.agent!==void 0||l.rule!==void 0||l.session!==void 0||l.project!==void 0||l.suspect||l.all||l.sinceExplicit||l.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(l.dryRun&&!l.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return l}async function he(n,t={}){let r=Hs(n);if(!r)return 1;let e=t.logsDir??i2();if(r.pruneLegacy)return Ws(e,r.json,r.dryRun);if(!e)return console.log(r.json?"[]":r.id?`No retained audit log entry found for id ${Z(r.id)}.`:"No audit log entries found."),0;g2(e);let a={count:0},l=f2(e,a).flatMap((i)=>pn(i,a).map((v)=>({entry:v,file:i})));if(a.count>0)console.error(`warning: ${a.count} audit log ${a.count===1?"source":"sources"} could not be read; these results are incomplete`);if(r.id)return As(l,r,t.timeZone);let s=Date.now()-r.since*24*60*60*1000,d=l.filter((i)=>Ms(i,r,e,s)),c=r.suspect?Wt(d.map((i)=>i.entry)):null,L=(c?d.filter((i)=>c.has(i.entry)):d).sort((i,v)=>Date.parse(v.entry.ts)-Date.parse(i.entry.ts)).slice(0,r.limit);if(r.json)return console.log(JSON.stringify(L.map((i)=>i.entry),null,2)),0;if(L.length===0)return console.log("No audit log entries found."),0;for(let i of L)console.log(Cs(i.entry,t.timeZone));return 0}function Ws(n,t,r){let e=n?Rs(n).map((d)=>Ys(n,d)):[];if(r)return Ks(e,t);let a=[],l=0,s=0;for(let d of e){let c=fe(d,{throwIfNoEntry:!1})?.size??0,L=Vs(d);if(L){a.push(`${ye(d)}: ${L}`);continue}l++,s+=c}if(t)return console.log(JSON.stringify({removedFiles:l,removedBytes:s,failedFiles:a.length})),a.length===0?0:1;console.log(l===0&&a.length===0?"No legacy audit log files found.":`Removed ${l} legacy audit log ${l===1?"file":"files"} (${we(s)}).`);for(let d of a)console.error(`Could not remove ${Z(d)}`);if(console.log("Nested v2 audit logs were not changed."),l>0)console.log("This deletion cannot be undone.");return a.length===0?0:1}function Ks(n,t){let r=n.reduce((e,a)=>e+(fe(a,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:n.length,bytes:r})),0;if(console.log(n.length===0?"No legacy audit log files found.":`Would remove ${n.length} legacy audit log ${n.length===1?"file":"files"} (${we(r)}).`),console.log("Nested v2 audit logs are not included."),n.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Rs(n){try{return Zs(n,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function Vs(n){try{return Qs(n),null}catch(t){return t instanceof Error?t.message:String(t)}}function we(n){let t=["B","KiB","MiB","GiB"],r=Math.min(Math.floor(Math.log2(Math.max(n,1))/10),t.length-1);return`${Math.round(n/1024**r*10)/10} ${t[r]}`}function As(n,t,r){let e=n.filter((l)=>l.entry.id===t.id);if(e.length>1)return console.error(`Multiple audit log entries found for id ${Z(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(e.map((l)=>l.entry),null,2)),0;let a=e[0];if(!a)return console.log(`No retained audit log entry found for id ${Z(t.id??"")}.`),0;return console.log(Os(a.entry,r)),0}function Ms(n,t,r,e){if(!t.all&&n.entry.decision==="allow")return!1;if(Date.parse(n.entry.ts)<e)return!1;if(t.agent!==void 0&&n.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&n.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!Gs(n,r,t.session))return!1;if(t.project!==void 0&&!Us(n.entry.cwd,t.project))return!1;return!0}function Gs(n,t,r){if(n.entry.sessionId===r)return!0;return Xs(n.file)===t&&ye(n.file,".jsonl")===r}function Us(n,t){if(!n)return!1;return n===t||n.startsWith(`${t}/`)}function Cs(n,t){let r=Z(n.id??"-"),e=Z(n.decision??"deny"),a=n.cwd?`  [${Z(n.cwd)}]`:"",l=n.segment||n.command,s=l===n.command?"":"↳ ",d=l.length>50?`${l.slice(0,50)}…`:l;return`${r.padEnd(16)}  ${Z(xe(n.ts,t))}  ${e.padEnd(5)}  ${Z(n.agent??"-").padEnd(15)}  ${Z(n.ruleId??"-").padEnd(20)}  ${s}${Z(d)}${a}`}function Os(n,t){let r=(a)=>Z(a===void 0||a===null||a===""?"-":a),e=n.shape?`${n.agent??"-"} (shape: ${n.shape})`:n.agent??"-";return[`id:        ${r(n.id)}`,`ts:        ${r(xe(n.ts,t))}`,`decision:  ${r(n.decision)}`,`agent:     ${r(e)}`,`level:     ${r(n.level)}`,`tool:      ${r(n.toolName)}`,`rule:      ${r(n.ruleId)}`,`intent:    ${r(n.intent)}`,`stage:     ${r(n.failureStage)}`,`error:     ${r(n.errorCode)}`,`session:   ${r(n.sessionId)}`,`cwd:       ${r(n.cwd)}`,`version:   ${r(n.v)}`,`truncated: ${r(n.truncated===!0?"yes":void 0)}`,`reason:    ${r(n.reason)}`,`command:   ${r(n.command)}`,`segment:   ${r(n.segment)}`].join(`
-`)}function xe(n,t){let r=new Date(n);if(Number.isNaN(r.getTime()))return n;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(r)}function oe(n){let t=Number(n);return Number.isFinite(t)&&t>0?t:null}var $e={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var De={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var me={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as Ze,relative as ad}from"node:path";var Ts=8388608;function _s(n,t){console.log(JSON.stringify(n(ke(t))))}async function Es(n){let t;try{t=(await b1(process.stdin)).trim()}catch{n({reason:"Failed to parse hook input JSON."});return}if(!t){n({reason:"Missing hook input JSON."});return}return o1(t,n,"Failed to parse hook input JSON.")}async function b1(n){let t=[],r=0;for await(let e of n){let a=typeof e==="string"?Buffer.from(e,"utf-8"):Buffer.from(e.buffer,e.byteOffset,e.byteLength);if(r+=a.byteLength,r>Ts)throw Ps(n),Error("hook input byte limit exceeded");t.push(a)}return Buffer.concat(t,r).toString("utf-8")}function Ps(n){let t=n.destroy??n.cancel;if(!t)return;try{Promise.resolve(t.call(n)).catch(()=>{})}catch{}}function o1(n,t,r){try{return JSON.parse(n)}catch{t({reason:r});return}}function W(n,t){let r=t.get(n);return r?{kind:"command",shell:r}:{kind:je(n)}}function t2(n,t,r,e){let a=n===void 0?process.cwd():n,l=typeof a==="string"&&a.trim()!==""?v2([a]):void 0;if(l)return{configCwd:l,executionCwd:l};return X(e,t,r,td(a)),null}function X(n,t,r,e){let a;try{a=u1(t)}catch(l){if(!(l instanceof p2))throw l}n(Gn({command:a,segment:e,toolName:r}))}async function Is(n){let t=await Es(n.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){X(n.outputDeny);return}if(!n.isSupported(t))return;let r=n.getAgent?.(t)??n.agent,e=n.agent===r?void 0:n.agent,a=ed(t),l=(p,f)=>{ge(p,()=>n.getSessionId(t),{agent:r,shape:e,toolName:f,cwd:a}),n.outputDeny(p)},s=n.getToolName(t);if(typeof s!=="string"||s.trim()===""){X((p)=>l(p),rd(t));return}let d=s,c=(p)=>l(p,d),L;try{L=n.getToolInput(t,d,c)}catch(p){if(!(p instanceof p2))throw p;X(c,void 0,d);return}if(!L.ok)return;let i=n.getContext(t,L.input,d,c);if(!i)return;let v;try{v=u1(L.input)}catch(p){if(!(p instanceof p2))throw p;X(c,void 0,d);return}let b=C2(d,L.input,L.route,i,v??null);try{let p=Un(b,{guard:{auditAllowed:ze(),dependencies:n.guardDependencies},audit:{agent:r,shape:e,getSessionId:()=>n.getSessionId(t)}}),f=v1(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:d});if(f){n.outputDeny(f);return}n.outputAllow?.()}catch(p){if(!(p instanceof Fe))throw p;Ns(p);let f=v1(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:d});if(f)n.outputDeny(f);return}}function Ns(n){if(!hn(k.debug))return;console.error(`CC Safety Net debug: ${nd(n.stage)}: ${qe(n.cause)}`)}function nd(n){if(n==="policy-protection")return"hook policy protection failed";if(n==="config-load")return"hook config loading failed";if(n==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function td(n){return typeof n==="string"?n:void 0}function rd(n){if(!n||typeof n!=="object"||Array.isArray(n))return;if(Object.hasOwn(n,"tool_input"))return n.tool_input;let t=n.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function ed(n){if(!n||typeof n!=="object"||Array.isArray(n))return null;let t=n.cwd;if(typeof t==="string")return t;let r=n.toolCall;if(!r||typeof r!=="object"||Array.isArray(r))return null;let e=r.args;if(!e||typeof e!=="object"||Array.isArray(e))return null;let a=e.Cwd;return typeof a==="string"?a:null}async function K(n){let t=(a)=>_s(n.createDenyOutput,a),r=n.createAllowOutput;await Is({...n,outputDeny:t,outputAllow:r?()=>console.log(JSON.stringify(r())):void 0})}var ld=new Map([["run_command","auto"]]),sd=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function Qe(n){return W(n,ld)}async function Xe(){await K({agent:"antigravity-cli",createDenyOutput:(n)=>({decision:"deny",reason:n}),isSupported:()=>!0,getToolName:(n)=>n.toolCall?.name,getToolInput:(n,t)=>({ok:!0,input:pd(n.toolCall?.args,t),route:Qe(t)}),getContext:dd,getSessionId:(n)=>n.conversationId})}function dd(n,t,r,e){let l=id(n).flatMap((L)=>{let i=v2([L]);return i?[i]:[]});if(!l[0])return j2(e,t,r),null;if(r!=="run_command"){let L;try{L=cd(t,r,l)}catch(i){if(i instanceof p2)return j2(e,void 0,r),null;if(!(i instanceof k2))throw i;return j2(e,t,r),null}if(!L)return j2(e,t,r),null;return{configCwd:L,executionCwd:L,policyConfigCwds:l}}let s=n.toolCall?.args;if(!s||!Object.hasOwn(s,"Cwd"))return{configCwd:l[0],executionCwd:l[0],policyConfigCwds:l};let d=s.Cwd;if(typeof d!=="string"||d.trim()==="")return j2(e,t,r),null;let c=z2(d,l);if(c){let L=Ye(c,l);if(!L)return j2(e,t,r,d),null;return{configCwd:L,executionCwd:c,policyConfigCwds:l}}return j2(e,t,r,d),null}function cd(n,t,r){let e=Qe(t),a=[...Be(n,sd),...e.kind==="patch"?Je(n):[]].filter(Ze),l=Cn(),s=new Set(a.flatMap((d)=>{let c=Ye($n(d,Dn,l),r);return c?[c]:[]}));if(s.size>1)return null;return[...s][0]??r[0]??null}function Ye(n,t){return t.filter((r)=>Ld(n,r)).reduce((r,e)=>e.length>r.length?e:r,"")||null}function Ld(n,t){let r=ad(t,n);return r===""||!r.startsWith("..")&&!Ze(r)}function j2(n,t,r,e){let a=t&&typeof t==="object"?t.command:void 0;n(Gn({command:typeof a==="string"?a:void 0,segment:e,toolName:r}))}function id(n){if(n.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(n.workspacePaths)?n.workspacePaths.filter((r)=>typeof r==="string"&&r.trim()!==""):[];return v2(t)?t:[]}function pd(n,t){if(!n)return;if(t!=="run_command")return n;return{...n,command:typeof n.CommandLine==="string"&&n.CommandLine!==""?n.CommandLine:void 0}}var mn=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:8,runtime:{order:6,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:9,runtime:{order:7,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:10,install:{order:10,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:11,install:{order:11,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:12,install:{order:12,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],On=mn.slice().sort((n,t)=>n.doctorOrder-t.doctorOrder).map((n)=>n.id),Se=mn.filter((n)=>("runtime"in n)).slice().sort((n,t)=>n.runtime.order-t.runtime.order).map((n)=>({id:n.id,displayName:"displayName"in n.runtime?n.runtime.displayName:n.displayName,flags:n.runtime.flags,legacyFlags:"legacyFlags"in n.runtime?n.runtime.legacyFlags:[],description:n.runtime.description,legacyTopLevelFlags:n.runtime.legacyTopLevelFlags})),G=mn.slice().sort((n,t)=>n.install.order-t.install.order).map((n)=>({id:n.id,...n.install})).map(({order:n,...t})=>t),E6=Object.fromEntries(mn.map((n)=>[n.id,n.displayName]));function j(n){return mn.find((t)=>t.id===n)?.displayName??n}import{homedir as vd}from"node:os";import{isAbsolute as He,join as f1}from"node:path";function Ke(n){if(n!==void 0&&n!==null&&!He(n))return"unknown";try{let t=Cn(),r=n?$n(n,Dn,t):void 0,e=process.env.HOME||vd(),a=[["codex",process.env.CODEX_HOME||f1(e,".codex")],["copilot-cli",process.env.COPILOT_HOME||f1(e,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||f1(e,".claude")]],l=r?a.flatMap(([s,d])=>{if(!He(d))return[];return We(r,$n(d,Dn,t))?[s]:[]}):[];if(l.length===1)return l[0]??"unknown";if(l.length>1)return"unknown"}catch(t){if(t instanceof k2)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var y1="PreToolUse",Re="BeforeTool",Ve="pre_tool_call",h1="PreToolUse";var ud=new Map([["Bash","posix"],["PowerShell","powershell"]]);function bd(n){return W(n,ud)}async function Ae(){await K({agent:"claude-code",getAgent:(n)=>Ke(n.transcript_path),createDenyOutput:(n)=>({hookSpecificOutput:{hookEventName:y1,permissionDecision:"deny",permissionDecisionReason:n}}),isSupported:(n)=>n.hook_event_name===y1,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:bd(t)}),getContext:(n,t,r,e)=>t2(n.cwd,t,r,e),getSessionId:(n)=>n.session_id})}var od=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function fd(n){return W(n,od)}async function Me(){await K({agent:"copilot-cli",createDenyOutput:(n)=>({permissionDecision:"deny",permissionDecisionReason:n}),isSupported:()=>!0,getToolName:(n)=>n.toolName,getToolInput:(n,t,r)=>{if(typeof n.toolArgs!=="string")return r({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let e=o1(n.toolArgs,r,"Failed to parse toolArgs JSON.");if(e===void 0)return{ok:!1};return{ok:!0,input:e,route:fd(t)}},getContext:(n,t,r,e)=>t2(n.cwd,t,r,e),getSessionId:(n)=>typeof n.sessionId==="string"&&n.sessionId.trim()?n.sessionId:void 0})}var yd=new Map([["Shell","auto"]]);function hd(n){return W(n,yd)}async function Ge(){await K({agent:"cursor",createDenyOutput:(n)=>({permission:"deny",user_message:n,agent_message:n}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:hd(t)}),getContext:wd,getSessionId:(n)=>n.conversation_id})}function wd(n,t,r,e){let a=xd(n);if(!a[0])return X(e,t,r),null;let l=z2(Dd(n.cwd),a);if(!l)return X(e,t,r,typeof n.cwd==="string"?n.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l,policyConfigCwds:a};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l,policyConfigCwds:a};let s=t.working_directory;if(typeof s!=="string"||s.trim()==="")return X(e,t,r),null;let d=z2(s,a);if(!d)return X(e,t,r,s),null;return{configCwd:l,executionCwd:d,policyConfigCwds:a}}function xd(n){return $d(n).flatMap((t)=>{let r=v2([t]);return r?[r]:[]})}function $d(n){if(n.workspace_roots===void 0)return typeof n.cwd==="string"&&n.cwd.trim()!==""?[n.cwd]:[];if(!Array.isArray(n.workspace_roots))return[];return n.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function Dd(n){return typeof n==="string"&&n.trim()!==""?n:"."}var md=new Map([["run_shell_command","auto"]]);function gd(n){return W(n,md)}async function Ue(){await K({agent:"gemini-cli",createDenyOutput:(n)=>({decision:"deny",reason:n,systemMessage:n}),isSupported:(n)=>n.hook_event_name===Re,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:gd(t)}),getContext:(n,t,r,e)=>t2(n.cwd,t,r,e),getSessionId:(n)=>n.session_id})}import{resolve as kd}from"node:path";var qd=new Map([["terminal","posix"]]);async function Ce(){await K({agent:"hermes-agent",createDenyOutput:(n)=>({action:"block",message:n}),isSupported:(n)=>n.hook_event_name===Ve,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:W(t,qd)}),getContext:jd,getSessionId:(n)=>n.session_id})}function jd(n,t,r,e){let a=t2(n.cwd,t,r,e);if(!a)return null;if(!t||typeof t!=="object"||Array.isArray(t))return a;if(!Object.hasOwn(t,"workdir"))return a;let l=t.workdir;if(typeof l!=="string"||l.trim()==="")return X(e,t,r),null;let s=v2([kd(a.configCwd,l)]);if(!s)return X(e,t,r,l),null;return{...a,executionCwd:s}}var Oe=new Map([["Bash","posix"]]);function zd(n){return W(n,Oe)}async function Te(){await K({agent:"kimi-code",createDenyOutput:(n)=>({hookSpecificOutput:{hookEventName:h1,permissionDecision:"deny",permissionDecisionReason:n}}),isSupported:(n)=>n.hook_event_name===h1,getToolName:(n)=>n.tool_name,getToolInput:(n,t)=>({ok:!0,input:n.tool_input,route:zd(t)}),getContext:(n,t,r,e)=>{let a=t2(n.cwd,t,r,e);if(!a)return null;let l=n.tool_input;if(!Oe.has(r)||!l||!Object.hasOwn(l,"cwd"))return a;let s=l.cwd;if(typeof s!=="string"||s.trim()==="")return X(e,t,r),null;let d=z2(s,[a.configCwd]);if(!d)return X(e,t,r,s),null;return{configCwd:a.configCwd,executionCwd:d}},getSessionId:(n)=>n.session_id})}var Fd={"antigravity-cli":Xe,"claude-code":Ae,"copilot-cli":Me,cursor:Ge,"gemini-cli":Ue,"hermes-agent":Ce,"kimi-code":Te},_2=Se.map((n)=>({...n,run:Fd[n.id]}));function _e(n){let t=J({label:"hook",booleans:Object.fromEntries(_2.map((e)=>[e.id,[...e.flags,...e.legacyFlags]]))},n);if(t.errors.length>0)return;let r=_2.filter((e)=>t.flags[e.id]);return r.length===1?r[0]:void 0}function Ee(n){return _2.find((t)=>t.legacyTopLevelFlags.some((r)=>r===n))}var Bd=_2.map((n)=>({flags:n.flags.join(", "),description:n.description})),Jd=_2.flatMap((n)=>n.flags.map((t)=>`cc-safety-net hook ${t}`)),Pe={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Bd,{flags:"-h, --help",description:"Show this help"}],examples:Jd};var Ie={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...G.map((n)=>({flags:n.flag,description:`Install ${j(n.id)} ${n.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...G.map((n)=>`cc-safety-net install ${n.flag}`)]},Ne={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...G.map((n)=>({flags:n.flag,description:`Uninstall ${j(n.id)} ${n.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...G.map((n)=>`cc-safety-net uninstall ${n.flag}`)]},na={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var ta={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var E2={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var ra={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var ea={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var aa=[ra,$e,ta,De,E2,Ie,na,Ne,Pe,me,ea];function Zd(n){return n.aliases??[]}function Qd(n){return!n.hidden}function Tn(n){let t=n.toLowerCase();return aa.find((r)=>r.name.toLowerCase()===t||Zd(r).some((e)=>e.toLowerCase()===t))}function la(){return aa.filter(Qd)}import{readFileSync as Xd}from"node:fs";import{basename as Yd}from"node:path";function _n(n=7,t=i2()){let r=Date.now()-n*24*60*60*1000,e=[],a=new Set,l=0,s,d,c,L;if(t)g2(t);let i={count:0},v=t?f2(t,i):[];for(let p of v)try{let u=Xd(p,"utf-8").trim().split(`
-`).filter(Boolean);for(let h of u)try{let w=JSON.parse(h);if(w.decision==="allow")continue;let $=new Date(w.ts).getTime();if($>=r){if(l++,a.add(w.sessionId??Yd(p,".jsonl")),d===void 0||$<=d)s=w.ts,d=$;if(L===void 0||$>L)c=w.ts,L=$;Sd(e,w,$)}}catch{i.count++}}catch{i.count++}let b=e.map((p)=>({timestamp:p.ts,command:p.command,reason:p.reason,relativeTime:Ht(new Date(p.ts))}));return{totalBlocked:l,sessionCount:a.size,recentEntries:b,oldestEntry:s,newestEntry:c,unreadable:i.count}}function Sd(n,t,r){let e=n.findIndex((a)=>r>new Date(a.ts).getTime());if(e===-1){if(n.length<3)n.push(t);return}if(n.splice(e,0,t),n.length>3)n.pop()}import{dirname as Hd}from"node:path";function sa(n,t,r,e,a){let l;try{if(D(e)===null)return{path:n,exists:!1,valid:!1,ruleCount:0};l=d2(e),l.errors.push(...c2(n,t,{userConfigDir:r},a))}catch(s){if(!(s instanceof Y))throw s;l={errors:[s.message],ruleNames:new Set}}return{path:n,exists:!0,valid:l.errors.length===0,ruleCount:l.ruleNames.size,...l.errors.length>0?{errors:l.errors}:{}}}function Wd(n,t){return{source:t,name:n.name,command:n.command,subcommand:n.subcommand,blockArgs:[...n.block_args],reason:n.reason}}function da(n,t){let r=t?.userConfigPath??N(),e=t?.projectConfigPath??I(n),a=Hd(r),l=y2({cwd:n,userConfigPath:r,projectConfigPath:e,userConfigDir:a}),s=n2({cwd:n,userConfigPath:r,projectConfigPath:e,userConfigDir:a}),d=new Map(l.rulebooks.flatMap((c)=>c.rules.map((L)=>[L,c.source])));return{userConfig:sa(r,G2({userConfigPath:r}),a,s.userConfigTarget,s.userScope),projectConfig:sa(e,U2(e),a,s.projectConfigTarget,s.projectScope),effectiveRules:l.rules.map((c)=>Wd(c,d.get(c.name)??"project")),shadowedRules:[]}}var Kd=[{flag:k.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:k.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:k.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:k.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:k.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:k.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:k.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:k.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function ca(){return[...Kd.map((n)=>({name:n.flag.name,value:L1(n.flag),isSet:i1(n.flag),legacyName:n.flag.legacyName,legacyValue:n.flag.legacyName?process.env[n.flag.legacyName]:void 0,legacyIsSet:n.flag.legacyName?process.env[n.flag.legacyName]!==void 0:void 0,description:n.description,defaultBehavior:n.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:process.env.CC_SAFETY_NET_HOME,isSet:process.env.CC_SAFETY_NET_HOME!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var La={error:0,warning:1,info:2},Rd=["policy","config","audit"];function Vd(n){return n.map((t)=>{if(t==="ownership")return"is not owned by the current user";if(t==="permissions")return"has unsafe permissions";if(t==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var Ad=[{derive:(n)=>n.hooks.length>0&&n.hooks.every((t)=>!t.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(n)=>n.hooks.filter((t)=>t.inspectionStatus==="failed").map((t)=>{let r=j(t.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${r} inspection failed`,detail:`Doctor could not verify the ${r} integration configuration.`,fixHint:`Correct the reported ${r} configuration error, then run \`cc-safety-net doctor\` again.`,integration:t.platform}})},{derive:(n)=>n.userConfig.exists&&!n.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:n.userConfig.path}]:[]},{derive:(n)=>n.projectConfig.exists&&!n.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:n.projectConfig.path}]:[]},{derive:(n)=>n.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${n.configState.reason}`,fixHint:"Correct the named source, run `cc-safety-net rule sync` for a rule source, then rerun doctor."}]:[]},{derive:(n)=>{let t=n.environment.find((r)=>r.name==="CC_SAFETY_NET_AUDIT_SCOPE");return c1(t?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...Rd.map((n)=>({derive:(t)=>t.posture.directories.filter((r)=>r.kind===n&&r.status==="unsafe").map((r)=>({checkId:`posture.${n}-directory-unsafe`,severity:"error",title:`${n[0]?.toUpperCase()}${n.slice(1)} directory is unsafe`,detail:`The ${n} directory ${Vd(r.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...r.path?{path:r.path}:{}}))})),{derive:(n)=>{let t=[...n.effectiveSafety.weakenedRuleOverrides].sort();return t.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${t.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${t.join(", ")}.`}]:[]}}];function ia(n){return Ad.flatMap((t,r)=>t.derive(n).map((e,a)=>({finding:e,catalogOrder:r,occurrence:a}))).sort((t,r)=>La[t.finding.severity]-La[r.finding.severity]||t.catalogOrder-r.catalogOrder||t.occurrence-r.occurrence).map((t)=>t.finding)}function r2(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var Md=(n)=>r2()?`\x1B[32m${n}\x1B[0m`:n,Gd=(n)=>r2()?`\x1B[33m${n}\x1B[0m`:n,Ud=(n)=>r2()?`\x1B[34m${n}\x1B[0m`:n,Cd=(n)=>r2()?`\x1B[35m${n}\x1B[0m`:n,Od=(n)=>r2()?`\x1B[36m${n}\x1B[0m`:n,Td=(n)=>r2()?`\x1B[31m${n}\x1B[0m`:n,_d=(n)=>r2()?`\x1B[2m${n}\x1B[0m`:n,Ed=(n)=>r2()?`\x1B[1m${n}\x1B[0m`:n,o={green:Md,yellow:Gd,blue:Ud,magenta:Cd,cyan:Od,red:Td,dim:_d,bold:Ed},Pd="\x1B[0m",Id=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Nd(n){let t=n;return()=>{return t=(t*1664525+1013904223)%4294967296,t/4294967296}}function nc(n){let t=[...Id],r=Nd(n);for(let e=t.length-1;e>0;e--){let a=Math.floor(r()*(e+1)),l=t[e];t[e]=t[a],t[a]=l}return t}function tc(n,t=0){if(!r2())return"";let r=nc(t);return`\x1B[38;5;${r[n%r.length]}m`}function pa(n,t,r=0){if(!r2())return`"${n}"`;return`${tc(t,r)}"${n}"${Pd}`}var rc=new RegExp("\x1B\\[[0-9;]*m","g"),w1=(n)=>n.replace(rc,"").length;function F2(n){let t=(n.headers??n.rows[0]??[]).map((s,d)=>{let c=Math.max(...n.rows.map((L)=>w1(L[d]??"")));return Math.max(w1(s),c)}),r=(s,d)=>s+" ".repeat(Math.max(0,d-w1(s))),e=(s,d)=>d[0]+t.map((c)=>s.repeat(c+2)).join(d[1])+d[2],a=(s)=>`│ ${s.map((d,c)=>r(d,t[c]??0)).join(" │ ")} │`,l=n.headers?[`   ${a(n.headers)}`,`   ${e("─",["├","┼","┤"])}`]:[];return[`   ${e("─",["┌","┬","┐"])}`,...l,...n.rows.map((s)=>`   ${a(s)}`),`   ${e("─",["└","┴","┘"])}`].join(`
-`)}function va(n){let t=[];t.push("Hook Integration"),t.push(ec(n));let r=[],e=[];for(let a of n){let l=j(a.platform);if(a.errors&&a.errors.length>0)for(let s of a.errors)if(a.configured)r.push({platform:l,message:s});else e.push({platform:l,message:s})}for(let a of r)t.push(`   Warning (${a.platform}): ${a.message}`);for(let a of e)t.push(o.red(`   Error (${a.platform}): ${a.message}`));return t.join(`
-`)}function ec(n){let t=["Platform","Discovery","Configuration","Inspection"],r=n.map((e)=>{let a=j(e.platform);if(e.inspectionStatus==="not-inspected"){let c=o.dim("Not inspected");return[a,c,c,c]}let l=e.detected?o.green("Detected"):e.inspectionStatus==="failed"?o.red("Unknown"):o.dim("Not detected"),s=e.configured?o.green("Configured"):e.detected?o.yellow("Not configured"):e.inspectionStatus==="failed"?o.red("Unknown"):o.dim("Not applicable"),d=e.inspectionStatus==="verified"?o.green("Verified"):e.inspectionStatus==="failed"?o.red("Failed"):o.dim("Not applicable");return[a,l,s,d]});return F2({headers:t,rows:r})}function ua(n){let r=["Guard Engine Verification",`   Synthetic self-test: ${n.failed>0?o.red(`${n.passed}/${n.total} FAIL`):o.green(`${n.passed}/${n.total} passed`)}`],e=n.results.filter((a)=>!a.passed);if(e.length>0){r.push(""),r.push(o.red("   Failures:"));for(let a of e)r.push(o.red(`   • ${a.description}`)),r.push(o.red(`     expected ${a.expected}, got ${a.actual}`))}return r.join(`
-`)}function ac(n){if(n.length===0)return"   (no custom rules)";let t=["Source","Name","Command","Block Args"],r=n.map((e)=>[e.source,e.name,e.subcommand?`${e.command} ${e.subcommand}`:e.command,e.blockArgs.join(", ")]);return F2({headers:t,rows:r})}function ba(n){let t=[];if(t.push("Configuration"),t.push(lc(n.userConfig,n.projectConfig)),t.push(""),n.effectiveRules.length>0)t.push(`   Effective rules (${n.effectiveRules.length} total):`),t.push(ac(n.effectiveRules));else t.push("   Effective rules: (none - using built-in rules only)");for(let r of n.shadowedRules)t.push(""),t.push(`   Note: Project rule "${r.name}" shadows user rule with same name`);return t.join(`
-`)}function lc(n,t){let r=["Scope","Status"],e=(l)=>{if(!l.exists)return o.dim("N/A");if(!l.valid)return o.red(`Invalid (${l.errors?.[0]??"unknown error"})`);return o.green("Configured")},a=[["User",e(n)],["Project",e(t)]];return F2({headers:r,rows:a})}function oa(n){let t=[];return t.push("Environment"),t.push(sc(n)),t.join(`
-`)}function fa(n){let t=["Effective Safety",`   Selected preset: ${n.effectiveSafety.selectedPreset}`,`   Effective: ${n.effectiveSafety.level}`],r=[["fail_closed","fail_closed"],["paranoid_rm","paranoid_rm"],["paranoid_interpreters","paranoid_interpreters"]];for(let[e,a]of r){let l=n.effectiveSafety.capabilities[e],s=l.enabled?o.green("ON"):o.dim("OFF"),d=l.sources.length>0?` (${l.sources.join(", ")})`:"";t.push(`   ${a}: ${s} via ${l.source}${d}`)}t.push(`   Stored rule customizations: ${n.effectiveSafety.ruleCounts.stored}`),t.push(`   Effective rule customizations: ${n.effectiveSafety.ruleCounts.effective}`);for(let[e,a]of Object.entries(n.effectiveSafety.ruleOverrides))t.push(`   ${e}: ${a}`);return t.join(`
-`)}function ya(n){let t=["Findings"];if(n.length===0)return t.push("   No findings from inspected doctor facts."),t.join(`
-`);for(let r of n){let e=`[${r.severity.toUpperCase()}] ${r.checkId}: ${Z(r.title)}`,a=r.severity==="error"?o.red:r.severity==="warning"?o.yellow:o.blue;if(t.push(`   ${a(e)}`),t.push(`      ${Z(r.detail)}`),r.path)t.push(`      Path: ${Z(r.path)}`);if(r.fixHint)t.push(`      Fix: ${Z(r.fixHint)}`)}return t.join(`
-`)}function sc(n){let t=["Variable","Status","Legacy"],r=n.map((e)=>{let a=e.isSet?o.green("✓"):o.dim("✗"),l=e.legacyName&&e.legacyIsSet?`${e.legacyName} ${o.green("✓")}`:e.legacyName??"";return[e.name,a,l]});return F2({headers:t,rows:r})}function ha(n){let t=[];if(n.totalBlocked===0)t.push("Recent Activity"),t.push("   No blocked commands in the last 7 days"),t.push("   Tip: This is normal for new installations");else t.push(`Recent Activity · last 7 days (${n.totalBlocked} blocked / ${n.sessionCount} sessions)`),t.push(dc(n.recentEntries));if(n.unreadable>0)t.push(`   Warning: ${n.unreadable} audit log ${n.unreadable===1?"source":"sources"} could not be read; this summary is incomplete`);return t.join(`
-`)}function dc(n){let t=["Time","Command"],r=n.map((e)=>{let a=Z(e.command.replace(/\r\n|\r|\n/g," ↵ ").replace(/\t/g," ")),l=a.length>40?`${a.slice(0,37)}...`:a;return[e.relativeTime,l]});return F2({headers:t,rows:r})}function wa(n){let t=[];if(t.push("Update Check"),n.latestVersion===null&&!n.error)return t.push(En([["Status",o.dim("Skipped")],["Installed",n.currentVersion]])),t.join(`
-`);if(n.error)return t.push(En([["Status",`${o.yellow("⚠")} Error`],["Installed",n.currentVersion],["Error",o.dim(n.error)]])),t.join(`
-`);if(n.updateAvailable)return t.push(En([["Status",`${o.yellow("⚠")} Update Available`],["Current",n.currentVersion],["Latest",o.green(n.latestVersion??"")]])),t.push(""),t.push("   Run: bunx cc-safety-net@latest doctor"),t.push("   Or:  npx cc-safety-net@latest doctor"),t.join(`
-`);return t.push(En([["Status",`${o.green("✓")} Up to date`],["Version",n.currentVersion]])),t.join(`
-`)}function En(n){return F2({rows:n})}function xa(n){let t=[];return t.push("System Info"),t.push(cc(n)),t.join(`
-`)}function cc(n){let t=["Component","Version"],r=(l)=>{if(l===null)return o.dim("not found");return l},a=[{label:"cc-safety-net",value:n.version},...On.map((l)=>({label:j(l),value:n.versions[l]??null})),{label:"Node.js",value:n.nodeVersion},{label:"npm",value:n.npmVersion},{label:"Bun",value:n.bunVersion},{label:"Platform",value:n.platform}].map((l)=>[l.label,r(l.value)]);return F2({headers:t,rows:a})}function $a(n){if(n.findings.length===0)return o.green(`
-No findings from inspected doctor facts.`);let t={error:n.findings.filter((l)=>l.severity==="error").length,warning:n.findings.filter((l)=>l.severity==="warning").length,info:n.findings.filter((l)=>l.severity==="info").length},r=["error","warning","info"].filter((l)=>t[l]>0).map((l)=>`${t[l]} ${l}`),e=n.findings.length===1?"finding":"findings",a=`
-${n.findings.length} ${e}: ${r.join(", ")}.`;if(t.error>0)return o.red(a);if(t.warning>0)return o.yellow(a);return o.blue(a)}import{lstatSync as Lc}from"node:fs";import{dirname as x1}from"node:path";function $1(n,t){try{let r=Lc(t);if(r.isSymbolicLink())return{kind:n,path:t,status:"unsafe",issues:["symlink"]};if(!r.isDirectory())return{kind:n,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:n,path:t,status:"unknown",issues:[]};let e=[...r.uid!==process.getuid()?["ownership"]:[],...(r.mode&18)!==0?["permissions"]:[]];return{kind:n,path:t,status:e.length>0?"unsafe":"safe",issues:e}}catch(r){if(typeof r==="object"&&r!==null&&"code"in r&&r.code==="ENOENT")return{kind:n,path:t,status:"not-applicable",issues:[]};return{kind:n,path:t,status:"unknown",issues:[]}}}function Da(n){let t=i2();return{directories:[$1("policy",x1(x1(n))),$1("config",x1(n)),...t?[$1("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as ic}from"node:child_process";import{existsSync as ma}from"node:fs";import{delimiter as pc,extname as vc,join as uc}from"node:path";import{stripVTControlCharacters as ga}from"node:util";var qa="2.0.8",bc=5000,oc="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function B(){return qa}function D1(n,t){let r=n[t];if(r)return r;let e=Object.keys(n).find((a)=>a.toLowerCase()===t.toLowerCase()&&!!n[a]);return e?n[e]:r}function fc(n){return(D1(n,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function yc(n,t){let r=vc(n)?[n]:[...fc(t).map((e)=>`${n}${e}`),n];if(n.includes("/")||n.includes("\\"))return r.find((e)=>ma(e))??n;return(D1(t,"PATH")??"").split(pc).flatMap((e)=>r.map((a)=>uc(e,a))).find((e)=>ma(e))??n}function ka(n){if(!/[\s"&|<>^]/.test(n))return n;return`"${n.replace(/"/g,'""')}"`}function h2(n,t){let[r,...e]=n,a=t[oc]==="win32"?"win32":process.platform;if(!r||a!=="win32")return{cmd:r??"",args:e};let l=yc(r,t);if(!/\.(?:bat|cmd)$/i.test(l))return{cmd:l,args:e};return{cmd:D1(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",ka(l),...e.map(ka)].join(" ")]}}var P2=async(n,t=bc)=>{let r=await hc(n,{timeoutMs:t});if(r.code!==0)return null;return ga(r.stdout).trim()||ga(r.stderr).trim()||null};function hc(n,t){let[r,...e]=n;if(!r)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((a)=>{try{let l=h2([r,...e],process.env),s=ic(l.cmd,l.args,{stdio:["ignore","pipe","pipe"]}),d=!1,c="",L="";s.stdout.on("data",(b)=>{c+=b.toString()}),s.stderr.on("data",(b)=>{L+=b.toString()});let i=(b)=>{if(d)return;d=!0,clearTimeout(v),a(b)},v=setTimeout(()=>{s.kill(),i({code:null,stdout:c,stderr:L})},t.timeoutMs);s.on("close",(b)=>{i({code:b,stdout:c,stderr:L})}),s.on("error",()=>{i({code:null,stdout:c,stderr:L})})}catch{a({code:null,stdout:"",stderr:""})}})}function Pn(n){if(!n)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(n);if(t)return t[1]??null;let r=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(n);if(r)return r[1]??null;return n.split(`
-`)[0]?.trim()||null}async function gn(n=P2){let[t,r,e,a,l,s]=await Promise.all([Promise.all(G.map(async(d)=>[d.id,Pn(await n([...d.probeCommand]))])),n(["codex","plugin","list"],30000),n(["amp","plugins","list"],30000),n(["node","--version"]),n(["npm","--version"]),n(["bun","--version"])]);return{version:qa,versions:Object.fromEntries(t),codexPluginListOutput:r,ampPluginListOutput:e,nodeVersion:Pn(a),npmVersion:Pn(l),bunVersion:Pn(s),platform:`${process.platform} ${process.arch}`}}function m1(n,t){if(t==="dev")return!1;let r=n.split(".").map(Number),e=t.split(".").map(Number),[a=0,l=0,s=0]=r,[d=0,c=0,L=0]=e;if(a!==d)return a>d;if(l!==c)return l>c;return s>L}async function I2(){let n=B(),t=new AbortController,r=setTimeout(()=>t.abort(),3000);try{let e=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!e.ok)return{currentVersion:n,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${e.status}`};let a=await e.json(),l=m1(a.version,n);return{currentVersion:n,latestVersion:a.version,updateAvailable:l}}catch(e){return{currentVersion:n,latestVersion:null,updateAvailable:!1,error:e instanceof Error?e.message:"Network error"}}finally{clearTimeout(r)}}import*as Xa from"node:readline";var Ba=(n)=>`\x1B[${n}B`,wc=(n)=>`\x1B[${n}A`;var ja=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function xc(n){return new Promise((t)=>setTimeout(t,n))}function $c(n,t,r){if(!r)return t(n);if(r.aborted)return Promise.resolve();return new Promise((e,a)=>{let l=()=>r.removeEventListener("abort",s),s=()=>{l(),e()};r.addEventListener("abort",s,{once:!0}),t(n).then(()=>{l(),e()},(d)=>{l(),a(d)})})}function kn(n,t){return n&&n>0?n:t}function In(n){return Math.max(0,Math.min(1,n))}function N2(n){return Math.max(0,Math.min(255,Math.round(n)))}function g1(n){return n<=0.0031308?12.92*n:1.055*n**0.4166666666666667-0.055}function Dc(n,t,r){let e=r*Math.PI/180,a=t*Math.cos(e),l=t*Math.sin(e),s=(n+0.3963377774*a+0.2158037573*l)**3,d=(n-0.1055613458*a-0.0638541728*l)**3,c=(n-0.0894841775*a-1.291485548*l)**3;return{blue:N2(g1(In(-0.0041960863*s-0.7034186147*d+1.707614701*c))*255),green:N2(g1(In(-1.2684380046*s+2.6097574011*d-0.3413193965*c))*255),red:N2(g1(In(4.0767416621*s-3.3077115913*d+0.2309699292*c))*255)}}function k1(n,t){let r=(t*n*180/Math.PI%360+360)%360;return Dc(0.72,0.15,r)}function Ja(n,t=0.1){let r=k1(t,n);return`\x1B[38;2;${r.red};${r.green};${r.blue}m`}function mc(n,t){return{blue:N2(n.blue+(255-n.blue)*t),green:N2(n.green+(255-n.green)*t),red:N2(n.red+(255-n.red)*t)}}function Za(n,t,r){let e=Math.imul(n+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(r+374761393,2654435761),a=e^e>>>15,l=Math.imul(a,739982445),s=l^l>>>12,d=Math.imul(s,695872825);return((d^d>>>15)>>>0)/4294967296}function gc(n,t,r){let e=Math.floor(Za(n,t,r)*ja.length);return ja[e]??"░"}function za(n){let t=In(n);return t*t*t*(t*(t*6-15)+10)}function kc(n){if(n.length===0)return"";let t=[],r=!1,e="";for(let a of n){let l=`${a.red};${a.green};${a.blue}`;if(a.bold!==r)t.push(a.bold?"\x1B[1m":"\x1B[22m"),r=a.bold;if(l!==e)t.push(`\x1B[38;2;${l}m`),e=l;t.push(a.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function qc(n,t,r,e,a){return n.map((l,s)=>({...k1(r,e+t+s/a),bold:!1,character:l}))}function jc(n,t,r,e,a,l,s,d){let c=Math.max(1,e*0.75),L=Math.min(1,r/c),i=a*za(L),v=Math.max(0,(r-c)/Math.max(1,e-c)),b=(1-za(r/e))*d*2,p=0.35*Math.max(0,1-v*2),f=L>=1,u=Math.min(n.length,Math.ceil(i+2+1));return n.slice(0,u).map((h,w)=>{let $=k1(l,s+t+w/d+b),y=w+Za(t,w,7919)*2-1;if(y>i+2)return{...$,bold:!1,character:" "};let m=i-y,H=0.8*Math.exp(-(m*m)/12.5),o2=Math.min(0.9,H+p),Yt=!f&&y>i-4;return{...mc($,o2),bold:o2>0.3,character:Yt?gc(t,w,r):h}})}function Fa(n){return`\x1B[?2026h${n.map((t,r)=>`\x1B8${r>0?Ba(r):""}${kc(t)}`).join("")}\x1B[?2026l`}async function q1(n,t={}){if(!n)return;let r=t.output??process.stdout,e=t.sleep??xc,a=kn(t.frequency,0.1),l=t.seed??0,s=kn(t.speed,40),d=kn(t.spread,3),c=kn(t.frameRate,60),L=Math.max(1,Math.floor(kn(t.duration,12))),i=n.split(`
-`).map((u)=>Array.from(u)),v=Math.max(...i.map((u)=>u.length)),b=1000*L*i.filter((u)=>u.length>0).length/s,p=v>0?Math.max(1,Math.ceil(b/(1000/c))):0,f=p>0?b/p:0;r.write(`\x1B[?25l${i.length>1?`${`
-`.repeat(i.length-1)}${wc(i.length-1)}`:""}\x1B7`);try{for(let u=1;u<=p;u+=1){if(t.signal?.aborted)break;r.write(Fa(i.map((h,w)=>jc(h,w,u,p,v,a,l,d)))),await $c(f,e,t.signal)}}finally{if(r.write(Fa(i.map((u,h)=>qc(u,h,a,l,d)))),r.write("\x1B8"),i.length>1)r.write(Ba(i.length-1));r.write(`
-\x1B[0m\x1B[?25h`)}}var Qa=["┏━┛┏━┛  ┏━┛┏━┃┏━┛┏━┛━┏┛┃ ┃  ┏━ ┏━┛━┏┛","┃  ┃    ━━┃┏━┃┏━┛┏━┛ ┃ ━┏┛  ┃ ┃┏━┛ ┃ ","━━┛━━┛  ━━┛┛ ┛┛  ━━┛ ┛  ┛   ┛ ┛━━┛ ┛ "].join(`
-`);function zc(n){return Boolean(n.isTTY)}async function qn(n={}){let t=n.output??process.stdout;if(!zc(t))return;let r=n.input??process.stdin,e={duration:n.duration,frequency:n.frequency,output:t,seed:n.seed??Math.random()*8192,sleep:n.sleep,speed:n.speed,spread:n.spread};if(!r.isTTY||typeof r.setRawMode!=="function"){await q1(Qa,e);return}let a=new AbortController,l=r.readableFlowing===!0,s=r.isRaw===!0,d=!1,c=(L,i)=>{if(i.ctrl&&i.name==="c")d=!0;if(d||i.name==="return"||i.name==="enter")a.abort()};Xa.emitKeypressEvents(r),r.on("keypress",c),r.setRawMode(!0),r.resume();try{await q1(Qa,{...e,signal:a.signal})}finally{if(r.off("keypress",c),r.setRawMode(s),!l)r.pause()}if(!d)return;if(n.onInterrupt){n.onInterrupt();return}process.kill(process.pid,"SIGINT")}var Ya="\r\x1B[2K",Fc="\x1B[?25l",Bc="\x1B[39m",Jc="\x1B[?25h",Zc=100,Qc=0.55,Xc=80,Sa=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];function Yc(n){return new Promise((t)=>setTimeout(t,n))}async function Nn(n,t={}){let r=t.output??process.stdout;if(!r.isTTY)return n;let e=t.sleep??Yc,a=!1,l=n.then((d)=>{return a=!0,d},(d)=>{throw a=!0,d});if(await Promise.race([l.then(()=>!0),e(Zc).then(()=>!1)]))return l;r.write(Fc);try{for(let d=0;!a;d+=1)r.write(`${Ya}${Ja(d*Qc)}${Sa[d%Sa.length]}${Bc} ${t.loadingMessage??"Loading…"}`),await Promise.race([l,e(Xc)]);return await l}finally{r.write(`${Ya}${Jc}`)}}async function jn(n,t,r,e={}){let a=t();if(n)await r();if(n&&a.ready)await Nn(a.ready,e);return a.finish()}import{homedir as ei}from"node:os";import{stripVTControlCharacters as Sc}from"node:util";var nt="amp plugins list",Hc=/^\s*[✓✗]\s+cc-safety-net(?:\.ts)?\s+\(User Plugins\)\s+(\S+)\s*$/;function Ha(n){if(!n.ampPluginListOutput)return{platform:"amp",status:"n/a"};let t=Sc(n.ampPluginListOutput).split(`
-`).map((r)=>Hc.exec(r)?.[1]).find((r)=>r!==void 0);if(!t)return{platform:"amp",status:"n/a"};if(t!=="active")return{platform:"amp",status:"disabled",method:nt,configPath:nt,errors:[`Amp personal plugin cc-safety-net is ${t}; run "plugins: reload" in Amp or reinstall with install --amp`]};return{platform:"amp",status:"configured",method:nt,configPath:nt}}import{existsSync as Kc,readFileSync as Rc}from"node:fs";import{join as Wc}from"node:path";function zn(n){return Wc(n,".gemini","config","hooks.json")}var Vc=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*(?:--agy-cli|-ac)(\s|["']|$)/;function Ac(n){if(!n||typeof n!=="object"||Array.isArray(n))return[];return Object.values(n).flatMap((t)=>{if(!t||typeof t!=="object"||Array.isArray(t))return[];let r=t,e=r.PreToolUse;if(!Array.isArray(e))return[];return e.flatMap((a)=>{if(!a||typeof a!=="object"||Array.isArray(a))return[];let l=a.hooks;if(!Array.isArray(l))return[];return l.flatMap((s)=>{if(!s||typeof s!=="object"||Array.isArray(s))return[];let d=s.command;if(typeof d!=="string"||!Vc.test(d))return[];return[{command:d,enabled:r.enabled!==!1}]})})})}function Wa(n){let t=zn(n.homeDir);if(!Kc(t))return{platform:"antigravity-cli",status:"n/a",configPath:t};let r;try{r=Ac(JSON.parse(Rc(t,"utf-8")))}catch(e){return{platform:"antigravity-cli",status:"n/a",configPath:t,errors:[`Failed to parse Antigravity hooks config ${t}: ${e instanceof Error?e.message:String(e)}`]}}if(r.some((e)=>e.enabled))return{platform:"antigravity-cli",status:"configured",method:"hook config",configPath:t};if(r.length>0)return{platform:"antigravity-cli",status:"disabled",method:"hook config",configPath:t};return{platform:"antigravity-cli",status:"n/a",configPath:t}}import{join as Ka}from"node:path";import{existsSync as Mc,lstatSync as Gc,readFileSync as Uc}from"node:fs";function e2(n,t=(r)=>r){if(!Mc(n))return{kind:"missing"};try{return{kind:"ok",value:JSON.parse(t(Uc(n,"utf-8")))}}catch{return{kind:"unreadable"}}}function F(n){try{return Gc(n)}catch{return}}function tt(n,t){let r=F(t);if(!r)return{platform:n,status:"n/a",configPath:t};if(!r.isSymbolicLink()&&r.isDirectory())return;return{platform:n,status:"n/a",configPath:t,errors:[`${t} is a symlink or not a directory; move or remove it before installing`]}}function x(n,t){return typeof n==="object"&&n!==null?n[t]:void 0}var j1="cc-safety-net@cc-marketplace";function Ra(n){return Ka(n,".claude","plugins","installed_plugins.json")}function Va(n,t){let r=x(x(n,"plugins"),t);return Array.isArray(r)&&r.length>0}function rt(n,t){let r=e2(Ra(n));return r.kind==="ok"&&Va(r.value,t)}function z1(n){let t=Ra(n),r=e2(t);if(r.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(r.kind==="missing")return{platform:"claude-code",status:"n/a"};if(!Va(r.value,j1))return{platform:"claude-code",status:"n/a"};let e=Ka(n,".claude","settings.json"),a=e2(e);if(a.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(!(a.kind==="ok"&&x(x(a.value,"enabledPlugins"),j1)===!0))return{platform:"claude-code",status:"disabled",method:"plugin config",configPath:e,errors:[`${j1} is installed but not enabled in Claude Code`]};return{platform:"claude-code",status:"configured",method:"plugin config",configPath:t}}function Aa(n){return z1(n.homeDir)}function Ma(n){if(!n.codexPluginListOutput)return{platform:"codex",status:"n/a"};let t=n.codexPluginListOutput.split(`
-`).find((r)=>r.includes("https://github.com/kenryu42/cc-safety-net.git"));if(!t)return{platform:"codex",status:"n/a"};if(!t.includes("installed,"))return{platform:"codex",status:"n/a"};if(!t.includes("installed, enabled"))return{platform:"codex",status:"disabled",method:"codex plugin list",configPath:"codex plugin list",errors:["Codex plugin line for https://github.com/kenryu42/cc-safety-net.git must contain installed, enabled."]};return{platform:"codex",status:"configured",method:"codex plugin list",configPath:"codex plugin list"}}import{existsSync as lt,readdirSync as Cc,readFileSync as Oc}from"node:fs";import{join as S}from"node:path";var a2="cc-safety-net@cc-marketplace",et=["cc-marketplace","cc-safety-net"],Ga=["_direct","copilot-safety-net"],Ua=["cc-marketplace","safety-net"],Ca="safety-net@cc-marketplace";function at(n,t){let r=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(^|[^a-z0-9-])${r}([^a-z0-9-]|$)`,"m").test(n??"")}function Oa(n){return at(n,"cc-safety-net@cc-marketplace")}function Ta(n){return at(n,"cc-marketplace")}function _a(n){return at(n,"copilot-safety-net")}function Ea(n){return at(n,"safety-net@cc-marketplace")}function M(n){let t="",r=0,e=!1,a=!1,l=-1;while(r<n.length){let s=n[r],d=n[r+1];if(a){t+=s,a=!1,r++;continue}if(s==='"'&&!e){e=!0,l=-1,t+=s,r++;continue}if(s==='"'&&e){e=!1,t+=s,r++;continue}if(s==="\\"&&e){a=!0,t+=s,r++;continue}if(e){t+=s,r++;continue}if(s==="/"&&d==="/"){while(r<n.length&&n[r]!==`
-`)r++;continue}if(s==="/"&&d==="*"){r+=2;while(r<n.length-1){if(n[r]==="*"&&n[r+1]==="/"){r+=2;break}r++}continue}if(s===","){l=t.length,t+=s,r++;continue}if(s==="}"||s==="]"){if(l!==-1){let c=t.slice(l+1);if(/^\s*$/.test(c))t=t.slice(0,l)+c}l=-1,t+=s,r++;continue}if(!/\s/.test(s))l=-1;t+=s,r++}return t}function F1(n){if(!n?.includes("cc-safety-net"))return!1;return/(^|\s)hook\s+(?:[^\s]+\s+)*(--copilot-cli|-cp)(\s|$)/.test(n)}function Ia(n,t){if(!n)return null;let r=n.match(/(\d+)\.(\d+)\.(\d+)/);if(!r)return null;let e=[Number(r[1]),Number(r[2]),Number(r[3])];for(let a=0;a<t.length;a++){let l=e[a]??0,s=t[a]??0;if(l!==s)return l>s}return!0}function Tc(n){return Ia(n,[0,0,422])}function _c(n){return Ia(n,[1,0,8])}function Fn(n){return process.env.COPILOT_HOME||S(n,".copilot")}function B1(n){return(n.hooks?.preToolUse??[]).some((r)=>{if(r.type!=="command")return!1;return F1(r.command)||F1(r.bash)||F1(r.powershell)})}function J1(n,t){try{return JSON.parse(M(Oc(n,"utf-8")))}catch(r){t?.push(`Failed to parse ${n}: ${r instanceof Error?r.message:String(r)}`);return}}function Na(n,t){try{return Cc(n).filter((r)=>r.endsWith(".json")).sort((r,e)=>r.localeCompare(e))}catch(r){return t?.push(`Failed to read ${n}: ${r instanceof Error?r.message:String(r)}`),[]}}function Ec(n,t){if(!lt(n))return[];let r=[];for(let e of Na(n,t)){let a=S(n,e),l=J1(a,t);if(l&&B1(l))r.push(a)}return r}function nn(n,t){if(!lt(n))return;let r=J1(n,t);if(!r)return;return{path:n,config:r}}function Pa(n,t,r,e){if(t){n.push(`GitHub Copilot CLI ${t} does not support ${r}; requires ${e}+`);return}n.push(`GitHub Copilot CLI version unavailable; skipping ${r} because it requires ${e}+`)}function Pc(n){for(let t of n){if(t?.config.disableAllHooks===!0)return t.path;if(t?.config.disableAllHooks===!1)return}return}function Ic(n,t,r,e){let a=Fn(n),l=S(t,".github","hooks"),s=S(a,"hooks"),d=S(t,".github","copilot"),c=S(t,".claude"),L=_c(r),i=L===!0?e:void 0,v=[nn(S(d,"settings.local.json"),i),nn(S(d,"settings.json"),i),nn(S(c,"settings.local.json"),i),nn(S(c,"settings.json"),i)],b=[nn(S(a,"settings.json"),i),nn(S(a,"config.json"),i)];if(L!==!1){let m=Pc([...v,...b]);if(m){if(L===null)e.push(`GitHub Copilot CLI version unavailable; treating disableAllHooks in ${m} as active`);return{activeConfigPaths:[],disabledBy:m}}}let p=Ec(l,e),f=Tc(r),u=f===!0?e:void 0,h=lt(s)?Na(s,u):[],w=[];for(let m of h){let H=S(s,m),o2=J1(H,u);if(o2&&B1(o2))w.push(H)}if(f!==!0&&w.length>0)Pa(e,r,`user hook files in ${s}`,"0.0.422"),w.length=0;let $=[];for(let m of[...v,...b]){if(!m)continue;if(!B1(m.config))continue;if(L===!0){$.push(m);continue}Pa(e,r,"inline hook definitions in Copilot config files","1.0.8");break}let y=(m)=>m.filter((H)=>!!H&&$.includes(H)).map((H)=>H.path);return{activeConfigPaths:[...y(v),...p,...y(b),...w]}}function n0(n){let t=[],r=Ic(n.homeDir,n.cwd,n.copilotCliVersion,t);if(r.disabledBy)return{platform:"copilot-cli",status:"disabled",method:"hook config",configPath:r.disabledBy,configPaths:[r.disabledBy],errors:t.length>0?t:void 0};let e=Fn(n.homeDir),a=S(e,"installed-plugins",...et),l=lt(a),s=S(e,"settings.json"),d=e2(s,M);if(l&&d.kind==="unreadable")return{platform:"copilot-cli",status:"not-inspected"};if(l&&d.kind==="ok"&&x(x(d.value,"enabledPlugins"),a2)===!1)return{platform:"copilot-cli",status:"disabled",method:"plugin config",configPath:s,errors:[`${a2} is installed but not enabled in Copilot CLI`]};if(l||r.activeConfigPaths.length>0){let c=l,L=r.activeConfigPaths[0];return{platform:"copilot-cli",status:"configured",method:c?"plugin config":"hook config",configPath:L??(c?a:void 0),configPaths:r.activeConfigPaths.length>0?r.activeConfigPaths:void 0,errors:t.length>0?t:void 0}}return{platform:"copilot-cli",status:"n/a",errors:t.length>0?t:void 0}}import{existsSync as cL,readFileSync as LL}from"node:fs";import{existsSync as t0,mkdirSync as tL,readFileSync as rL}from"node:fs";import{dirname as eL,join as aL}from"node:path";import{renameSync as Nc,writeFileSync as nL}from"node:fs";function Q(n,t){let r=`${n}.${process.pid}.tmp`;nL(r,t),Nc(r,n)}var Bn="npx -y cc-safety-net hook --cursor",r0=30;function dt(n){return aL(n,".cursor","hooks.json")}function B2(n){return typeof n==="object"&&n!==null&&!Array.isArray(n)}function Z1(){return{command:Bn,timeout:r0,failClosed:!0}}function st(n){return B2(n)&&n.command===Bn}function lL(n){return Object.keys(n).length===3&&n.command===Bn&&n.timeout===r0&&n.failClosed===!0}function sL(n){try{return JSON.parse(rL(n,"utf-8"))}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Cursor hooks config ${n}: ${t.message}`);throw t}}function e0(n){let t=sL(n);if(!B2(t))throw Error(`Cursor hooks config ${n} must be a JSON object`);if(t.version!==1)throw Error(`Cursor hooks config ${n} must set "version": 1`);if(t.hooks!==void 0&&!B2(t.hooks))throw Error(`Cursor hooks config ${n} "hooks" must be an object`);let r=B2(t.hooks)?t.hooks.preToolUse:void 0;if(r!==void 0&&!Array.isArray(r))throw Error(`Cursor hooks config ${n} "hooks.preToolUse" must be an array`);return t}function a0(n){let t=B2(n.hooks)?n.hooks.preToolUse:void 0;return Array.isArray(t)?t:[]}function dL(n){if(!n.some(st))return[...n,Z1()];return n.reduce((t,r)=>{if(!st(r))return t.result.push(r),t;if(!t.inserted)t.result.push(Z1()),t.inserted=!0;return t},{result:[],inserted:!1}).result}function l0(n,t,r){let e=B2(t.hooks)?t.hooks:{},a={...t,hooks:{...e,preToolUse:r}};Q(n,`${JSON.stringify(a,null,2)}
-`)}function s0(n){let t=dt(n);if(!t0(t))return tL(eL(t),{recursive:!0}),Q(t,`${JSON.stringify({version:1,hooks:{preToolUse:[Z1()]}},null,2)}
-`),{path:t,alreadyInstalled:!1};let r=e0(t),e=a0(r),a=e.filter(st);if(B2(r.hooks)&&Array.isArray(r.hooks.preToolUse)&&a.length===1&&a[0]!==void 0&&lL(a[0]))return{path:t,alreadyInstalled:!0};return l0(t,r,dL(e)),{path:t,alreadyInstalled:!1}}function d0(n){let t=dt(n);if(!t0(t))return{path:t,alreadyInstalled:!1};let r=e0(t),e=a0(r),a=e.filter((l)=>!st(l));if(a.length===e.length)return{path:t,alreadyInstalled:!1};return l0(t,r,a),{path:t,alreadyInstalled:!0}}function iL(n){if(!n||typeof n!=="object"||Array.isArray(n))return[];let t=n.hooks;if(!t||typeof t!=="object"||Array.isArray(t))return[];let r=t.preToolUse;if(!Array.isArray(r))return[];return r.filter((e)=>!!e&&typeof e==="object"&&!Array.isArray(e)&&e.command===Bn)}function pL(n){let t=[];if(n.length>1)t.push("Multiple managed cc-safety-net hooks found; reinstall to collapse duplicates");let r=n[0];if(r&&r.failClosed!==!0)t.push('Managed hook is missing "failClosed": true; reinstall to repair');if(r&&r.timeout!==30)t.push('Managed hook "timeout" is not 30; reinstall to repair');return t}function c0(n){let t=dt(n.homeDir);if(!cL(t))return{platform:"cursor",status:"n/a",configPath:t};let r;try{r=JSON.parse(LL(t,"utf-8"))}catch(l){return{platform:"cursor",status:"n/a",configPath:t,errors:[`Failed to parse Cursor hooks config ${t}: ${l instanceof Error?l.message:String(l)}`]}}let e=iL(r);if(e.length===0)return{platform:"cursor",status:"n/a",configPath:t};let a=pL(e);return{platform:"cursor",status:"configured",method:"hook config",configPath:t,errors:a.length>0?a:void 0}}import{existsSync as vL}from"node:fs";import{join as Q1}from"node:path";var X1="gemini-safety-net";function Y1(n){let t=Q1(n,".gemini","extensions"),r=Q1(t,X1);if(!vL(r))return{platform:"gemini-cli",status:"n/a"};let e=Q1(t,"extension-enablement.json"),a=e2(e);if(a.kind==="unreadable")return{platform:"gemini-cli",status:"not-inspected"};let l=a.kind==="ok"?x(x(a.value,X1),"overrides"):void 0;if(Array.isArray(l)&&l.some((d)=>typeof d==="string"&&d.startsWith("!")))return{platform:"gemini-cli",status:"disabled",method:"extension config",configPath:e,errors:[`${X1} is disabled in Gemini CLI`]};return{platform:"gemini-cli",status:"configured",method:"extension config",configPath:r}}function L0(n){return Y1(n.homeDir)}import{readFileSync as h0}from"node:fs";import{join as w0}from"node:path";var U="cc-safety-net",i0="# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent";function p0(n){return`# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent
-# version: ${n}
-`}function uL(n){return`${p0(n)}name: cc-safety-net
-version: "${n}"
+import{$ as gr,$a as Xn,A as gt,Aa as Go,B as dc,Ba as Bo,C as ee,Ca as fr,D as J,Da as qo,E as rr,Ea as Vo,F as Kn,Fa as Y,G as Bt,Ga as Zn,H as Wn,Ha as or,I as Je,Ia as ir,J as ke,Ja as Z,K as sr,Ka as Oc,L as ue,La as vt,M as Di,Ma as $c,N as mr,Na as Ro,O as qt,Oa as Nc,P as Ri,Pa as Fc,Q as Ai,Qa as Hc,R as Se,Ra as wn,S as zt,Sa as Mc,T as wt,Ta as jc,U as xt,Ua as fi,V as si,Va as mi,W as ht,Wa as gi,X as De,Xa as hi,Y as ar,Ya as mc,Z as pe,Za as ti,_ as Ei,_a as ni,aa as Ii,ab as ri,b as Io,ba as _i,bb as oi,c as _o,ca as lr,cb as Le,d as G,da as ai,db as Ce,e as Oo,ea as Ho,eb as ce,f as Bn,fa as li,fb as ii,g as N,ga as ci,gb as B,h as k,ha as di,hb as bt,i as pt,ia as cr,ib as yt,j as x,ja as Mo,jb as Ti,k as xe,ka as S,kb as Ae,l as Jo,la as dr,lb as fe,m as Be,ma as Pi,mb as ji,n as ft,na as de,nb as Vt,o as vc,oa as Lt,p as zn,pa as ur,q as Yo,qa as pr,r as mt,ra as ui,s as Zo,sa as pi,t as nr,ta as jo,u as Xo,ua as Ke,v as Qo,va as Jn,w as X,wa as Yn,x as Q,xa as ei,y as Ve,ya as Ue,z as ze,za as _c}from"../chunks/index-dnak4vk0.js";var zc=["-h","--help"];function T(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.fromEntries(n.map(([d])=>[d,!1])),i={},s=[],a=[],l=!1,c=-1;for(let[d,p]of t.entries()){if(d<=c)continue;if(p==="--"){s.push(...t.slice(d+1));break}if(zc.includes(p)){l=!0;continue}let m=n.find(([,h])=>h.includes(p));if(m){o[m[0]]=!0;continue}let u=r.find(([,h])=>h.includes(p));if(u){let h=t[d+1];if(h===void 0||h.startsWith("-")){a.push(`${p} requires a value`);continue}i[u[0]]=h,c=d+1;continue}if(p.startsWith("-")){a.push(`Unknown option for ${e.label}: ${p}`);continue}if(e.positionals==="tail"){s.push(...t.slice(d));break}s.push(p)}if(e.positionals!=="list"&&e.positionals!=="tail")a.push(...s.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:o,values:i,positionals:s,help:l,errors:a}}function ae(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as Td,statSync as Li,unlinkSync as Id}from"node:fs";import{basename as vi,dirname as _d,join as Od,resolve as $d}from"node:path";function I(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var Mn=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},He=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as Kc,readdirSync as Wc,readFileSync as Jc}from"node:fs";import{join as Yc}from"node:path";function ye(e,t){try{return Wc(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=Yc(e,n.name);if(n.isDirectory())return ye(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&Kc(e))t.count++;return[]}}function jn(e){let t=(o)=>`${o.sessionId}
+${He(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o)=>o.sessionId).reduce((o,i)=>o.set(t(i),(o.get(t(i))??0)+1),new Map);return new Set(n.filter((o)=>o.failureStage||(r.get(t(o))??0)>=2))}function ut(e,t){try{return Jc(e,"utf-8").split(`
+`).filter(Boolean).flatMap((n)=>{try{return[JSON.parse(n)]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as Cd}from"node:path";var Zc=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function $o(e){let t=0,n={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(r){e.record({kind:"step",scope:"global",step:r})},recordSegment(r,o=n.currentSegmentIndex){if(o===void 0)return;e.record({kind:"step",scope:"segment",segmentIndex:o,step:r})}};return n}function No(e={}){let t=[],n=e.maxEvents??512,r={maxTextLength:e.maxTextLength??2048,maxListLength:e.maxListLength??128,maxObjectProperties:e.maxObjectProperties??e.maxListLength??128,maxDepth:e.maxDepth??16},o=0,i,s=new Set;return{record(a){if(i)return;try{if(!a||t.length>=n){o++;return}t.push(Gn(Xc(a,r,s)))}catch{o++}},finish(a){if(i)return i;try{i=Gn({events:Object.freeze(t),droppedEvents:o,terminal:Qc(a,r,s)})}catch{o++,i=Object.freeze({events:Object.freeze(t),droppedEvents:o,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,r.maxTextLength),segment:"trace unavailable".slice(0,r.maxTextLength)})})}return i}}}function Xc(e,t,n){if(e.kind!=="step")throw TypeError("invalid trace event");let{scope:r,step:o}=e;jt(o,n,t);let i=Me(o,t,n);if(r==="global")return{kind:"step",scope:"global",step:i};if(r!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:e.segmentIndex,step:i}}function Qc(e,t,n){let r=e.result;if(r==="allowed")return Object.freeze({result:"allowed"});if(r!=="blocked")throw TypeError("invalid trace terminal");let o=e.ruleId;return Object.freeze({result:"blocked",reason:Me(e.reason,t,n),segment:Me(e.segment,t,n),...o?{ruleId:Me(o,t,n)}:{}})}function jt(e,t,n,r=0,o=new WeakSet){if(typeof e==="string"){let a=e.slice(0,n.maxTextLength);if(!Bn(a))return;for(let l of Oo(a))for(let c of l.match(/[^\s"'()$]+/g)??[])t.add(Fo(c));return}if(!e||typeof e!=="object"||r>=n.maxDepth||o.has(e))return;if(o.add(e),Array.isArray(e)){let a=Math.min(e.length,n.maxListLength);for(let l=0;l<a;l++)jt(e[l],t,n,r+1,o);return}let i=0,s=new Set;for(let a in e){if(!Object.hasOwn(e,a))continue;if(i>=n.maxObjectProperties)break;i++,jt(a,t,n);let l=Un(a,n,t);if(s.has(l))continue;s.add(l),jt(e[a],t,n,r+1,o)}}function Me(e,t,n,r=0,o=new WeakSet){if(typeof e==="string")return Un(e,t,n);if(!e||typeof e!=="object")return e;if(r>=t.maxDepth)return;if(o.has(e))return;if(o.add(e),Array.isArray(e)){let a=[],l=Math.min(e.length,t.maxListLength);for(let c=0;c<l;c++)a.push(Me(e[c],t,n,r+1,o));return a}let i={},s=0;for(let a in e){if(!Object.hasOwn(e,a))continue;if(s>=t.maxObjectProperties)break;s++;let l=Un(a,t,n);if(Object.hasOwn(i,l))continue;Object.defineProperty(i,l,{value:Me(e[a],t,n,r+1,o),enumerable:!0,configurable:!0,writable:!0})}return i}function Un(e,t,n){let r=e.slice(0,t.maxTextLength),o=Bn(r)?_o(r):r,i=n.size>0?td(o,n):o;return(ed(i)?Io(i):i).slice(0,t.maxTextLength)}function ed(e){return e.includes("PRIVATE KEY")||e.includes("://")||e.includes("eyJ")||e.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(e)||e.length>=14&&Zc.some((t)=>e.includes(t))||e.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(e)}function td(e,t){return e.replace(/[^\s"'()$]+/g,(n)=>t.has(Fo(n))?"<redacted>":n)}function Fo(e){let t=2166136261,n=2166136261;for(let r=0;r<e.length;r++)t=Math.imul(t^e.charCodeAt(r),16777619),n=Math.imul(n^e.charCodeAt(e.length-r-1),16777619);return`${t>>>0}:${n>>>0}:${e.length}`}function Gn(e){if(e&&typeof e==="object"&&!Object.isFrozen(e)){for(let t of Object.values(e))Gn(t);Object.freeze(e)}return e}function Uo(e,t,n){let r=n??Ho(),o=r.getCommandProgram(e,t.shell??"auto"),i=No(),s=$o(i),a=o.dialect==="powershell"?r.getCommandProgram(e,"posix"):o,l=Mo(a);s.recordGlobal({type:"parse",input:e,segments:l.map((p)=>[...p])});let c=jo(e,{...t,analyzePartialProgram:!0,trace:s},o,r),d=s.getNextSegmentIndex();if(c&&d>0&&d<l.length)s.recordSegment({type:"segment-skipped",index:d,reason:"prior-segment-blocked"},d);return Object.freeze({decision:c,trace:i.finish(c?{result:"blocked",reason:c.reason,segment:c.evidence.find((p)=>p.kind==="command")?.segment??e,...c.ruleId?{ruleId:c.ruleId}:{}}:{result:"allowed"}),program:o})}import{resolve as nd}from"node:path";function qn(e){let t=Go().safeParse(e);return{errors:t.success?[]:qo(t.error.issues),ruleNames:new Set(Bo(e).map((n)=>n.toLowerCase()))}}function Vn(e){let t=zo(e);if(!t.ok)return t.result;return qn(t.parsed)}function zo(e){let t=[],n=new Set;try{let r=typeof e==="string"?pt(e):e,o=x(r);if(o===null)return t.push(`File not found: ${r.path}`),{ok:!1,result:{errors:t,ruleNames:n}};if(!o.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:n}};return{ok:!0,parsed:JSON.parse(o)}}catch(r){if(r instanceof N)return t.push(r.message),{ok:!1,result:{errors:t,ruleNames:n}};let o=r instanceof Error?r.message:String(r);return t.push(r instanceof SyntaxError?"Invalid JSON":o),{ok:!1,result:{errors:t,ruleNames:n}}}}function Ko(e){return nd(e??process.cwd(),".safety-net.json")}function le(e){let t=zo(e);if(!t.ok)return t.result;let n=Vo(t.parsed);return{errors:n.errors,ruleNames:n.sources}}import{isAbsolute as rd,join as Ut,relative as od,resolve as Wo,sep as id}from"node:path";async function qe(e={}){let t=er(e);return sd(t,await Gt(t,Ue()))}function sd(e,t){if(!t.ok)return t;let n=J(e),r=[...new Set(ce(n.configPath,n.lockPath,e,n.filesystemScope))];if(r.length===0)return t;return{ok:!1,errors:r,warnings:t.warnings,entries:t.entries}}async function Gt(e,t,n,r={}){let o=null,i=!1;try{let s=J(e),a=Zn(s.configTarget);if(!a.ok)return a.result;let l=a.config;if(e.check)return pd(l,s,e);o={target:s.lockTarget,content:x(s.lockTarget)};let c=Xn(s.lockTarget);if(c.errors.some((L)=>L.startsWith("Unable to access ")))return{ok:!1,errors:c.errors,warnings:[],entries:[]};if(e.only&&c.errors.length>0)return{ok:!1,errors:c.errors,warnings:[],entries:[]};let d=c.errors.length>0?null:c.lock,p=e.only?ti(l,d,e.only):{ok:!0,specs:l.rules};if(!p.ok)return p.result;if(e.only&&!d&&p.specs.length<l.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${Qo}`],warnings:[],entries:[]};let m=(await ld(p.specs,(L)=>ri(L,s.configDir,e,d,s.filesystemScope,t),t)).map((L)=>fd(L,d,n));for(let L of m)hd(L.content,L.entry,s.configDir,e,s.filesystemScope);let u=e.only?md(l,d,m):m.map((L)=>L.entry);i=!0,Z(s.lockTarget,{version:1,rulebooks:u},void 0,r._testAfterPolicyRename);let h=new Map(m.map((L)=>[L.entry.spec,L.rulebook.rules.length])),f=yd(u,s.configDir,e,s.filesystemScope,r);return{ok:!0,errors:[],warnings:f,entries:u.map((L)=>gd(L,h))}}catch(s){if(i&&o)try{je(o.target,o.content)}catch(a){return Ge(a)}return Ge(s)}}async function Qn(e,t={}){return ad(e,er(t),Ue())}async function ad(e,t,n,r={}){let o=null,i=!1;try{let s=J(t),a=x(s.configTarget);o={target:s.configTarget,content:a};let l=Zn(s.configTarget);if(!l.ok)return l.result;let c=l.config,d=Xo(e)?await oi(e,n):[{spec:e}],p=d.map((h)=>h.spec),m=[...new Set([...c.rules,...p])];if(m.length>Jn)return cd();if(m.length!==c.rules.length)i=!0,Z(s.configTarget,{version:1,rules:m,overrides:c.overrides??{},transparent_wrappers:c.transparent_wrappers??[]},void 0,r._testAfterPolicyRename);let u=await Gt(t,n,new Map(d.filter((h)=>!!h.display_ref).map((h)=>[h.spec,h.display_ref])),r);if(!u.ok)je(s.configTarget,a);return u}catch(s){if(i&&o)try{je(o.target,o.content)}catch(a){return Ge(a)}return Ge(s)}}async function ld(e,t,n=Ue()){if(e.length>Jn)throw Error(Yn);let r=Array(e.length),o=0,i,s=Array.from({length:Math.min(e.length,ei.concurrency)},async()=>{while(!i){let a=o;if(a>=e.length)return;o++;try{r[a]=await t(e[a],a,n.controller.signal)}catch(l){if(!i)i={value:l},o=e.length,n.controller.abort(l);return}}});if(await Promise.all(s),i)throw i.value;return r}function cd(){return{ok:!1,errors:[Yn],warnings:[],entries:[]}}function er(e){return{cwd:e.cwd,cacheConfigDir:e.cacheConfigDir,userConfigDir:e.userConfigDir,userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,global:e.global,check:e.check,only:e.only,refresh:e.refresh}}function dd(e){return{...er(e),deleteSource:e.deleteSource}}async function tr(e,t={}){try{return await ud(e,dd(t),{})}catch(n){return Ge(n)}}async function ud(e,t,n){let r=J(t),o=Y(r.configTarget);if(o.errors.length>0)return{ok:!1,errors:o.errors,warnings:[],entries:[]};if(!o.config)return{ok:!1,errors:[`No config found at ${r.configPath}`],warnings:[],entries:[]};let i=Xn(r.lockTarget);if(i.errors.length>0)return{ok:!1,errors:i.errors,warnings:[],entries:[]};let s=ni(o.config.rules,i.lock,e);if(!s.ok)return s.result;let a=t.deleteSource?Ld(r.configDir,s.specs,i.lock,r.filesystemScope):{ok:!0,dirs:[]};if(!a.ok)return a.result;let l=x(r.configTarget);if(l===null)return Ge(Error("Rules config is unavailable."));try{Z(r.configTarget,{version:1,rules:o.config.rules.filter((p)=>!s.specs.includes(p)),overrides:o.config.overrides??{},transparent_wrappers:o.config.transparent_wrappers??[]},void 0,n._testAfterPolicyRename)}catch(p){throw je(r.configTarget,l),p}let c=await Gt(t,Ue(),void 0,n);if(!c.ok)return je(r.configTarget,l),c;let d=bd(a.dirs,n,r.filesystemScope);if(!d.ok){je(r.configTarget,l);let p=await Gt(t,Ue(),void 0,n);if(!p.ok)return{ok:!1,errors:[...d.result.errors,...p.errors],warnings:p.warnings,entries:p.entries};return d.result}return c}async function pd(e,t,n){let r=ii(e,t.lockPath,t.configDir,n,n.global?"user":"project",t.filesystemScope);return{ok:r.errors.length===0&&r.warnings.length===0,errors:[...r.errors,...r.warnings],warnings:[],entries:r.entries}}function fd(e,t,n){let r=t?.rulebooks.find((i)=>i.spec===e.entry.spec&&i.kind==="github"),o=n?.get(e.entry.spec)??(r?.kind==="github"?r.display_ref:void 0);if(!o||e.entry.kind!=="github")return e;return{...e,entry:{...e.entry,display_ref:o}}}function md(e,t,n){let r=new Set(e.rules),o=new Set(t?.rulebooks.map((s)=>s.spec)??[]),i=new Map(n.map((s)=>[s.entry.spec,s.entry]));return[...(t?.rulebooks.filter((s)=>r.has(s.spec))??[]).map((s)=>i.get(s.spec)??s),...n.filter((s)=>!o.has(s.entry.spec)).map((s)=>s.entry)]}function gd(e,t){return{...e,ruleCount:t.get(e.spec)}}function hd(e,t,n,r,o){let i=Kn(t,Wn(n,r));xe(k(o,i),e)}function yd(e,t,n,r,o){let i=Wn(t,n),s=Bt(i),a=k(r,s),l=Be(a);if(!l)return[];let c=e.map((p)=>k(r,Kn(p,i))),d=l.filter((p)=>p.kind==="directory").map((p)=>({directory:k(r,Ut(s,p.name)),identity:k(r,Ut(s,p.name,Zo))})).filter((p)=>!c.some((m)=>Jo(p.identity,m))).map((p)=>p.directory);for(let p of d)Yo(p);return d.flatMap((p)=>{try{return wd(p,o),[]}catch{return["Unable to prune rules policy cache safely."]}})}function Ld(e,t,n,r){let o=new Map(n?.rulebooks.map((c)=>[c.spec,c])??[]),i=t.flatMap((c)=>{let d=o.get(c);if(!d)return mt.test(c)?[]:["--delete-source can only delete local rulebook sources"];return d.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),s=t.map((c)=>{let d=o.get(c);return Ut(e,d?.kind==="local-directory"?d.path:c)}),a=i.length>0?[]:s.flatMap((c)=>vd(e,c,r)),l=[...i,...a];return l.length>0?{ok:!1,result:{ok:!1,errors:l,warnings:[],entries:[]}}:{ok:!0,dirs:s}}function vd(e,t,n){let r=Wo(e),o=Wo(t),i=od(r,o);if(i===""||i===".."||i.startsWith(`..${id}`)||rd(i))return[`Refusing to delete local rulebook source outside ${e}: ${t}`];let s=k(n,o),a=Be(s);if(!a)return[`Local rulebook source directory not found: ${t}`];let l=a.find((c)=>c.name==="rulebook.json");if(!l)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(l.kind!=="file")throw new N(n.label);if(x(k(n,Ut(o,"rulebook.json"))),a.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function bd(e,t,n){let r=e.flatMap((o)=>{try{return xd(k(n,o),t),[]}catch(i){return[`Failed to delete local rulebook source ${o}: ${i instanceof Error?i.message:String(i)}`]}});return r.length>0?{ok:!1,result:{ok:!1,errors:r,warnings:[],entries:[]}}:{ok:!0}}function wd(e,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(e.path);return}zn(e)}function xd(e,t){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(e.path);return}zn(e)}function je(e,t){if(t===null){ft(e);return}xe(e,t)}function Ge(e){return{ok:!1,errors:[e instanceof Error?e.message:String(e)],warnings:[],entries:[]}}function We(e,t){let n=Sd(t),r=ui(n),o={effectiveLevel:r.effectiveLevel,selectedPreset:n.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:r.effectiveCapabilities,destructiveCommandRuleOverrides:n.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:i,configValid:s}=kd({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!e||!e.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:i,configValid:s,...o};let a=Dd(e,n);if(a)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:a.rule,matched:!0,reason:a.reason}]}]},result:"blocked",reason:G(a.reason),segment:G(a.target),...a.ruleId?{ruleId:G(a.ruleId)}:{},configSource:i,configValid:s,...o};let l=Uo(e,n),c=l.decision,d=c?.ruleId??Rd(e,n),p=ht.find((u)=>u.id===d&&u.activationCapability),m=p?r.policy.effectiveDestructiveCommandRules[p.id]:void 0;return{trace:Ed(l.trace),result:c?"blocked":"allowed",reason:c?G(c.reason):void 0,segment:c?G(c.evidence.find((u)=>u.kind==="command")?.segment??e):void 0,ruleId:c?.ruleId?G(c.ruleId):void 0,customRule:Ad(Pd(c?.ruleId,n.policySnapshot)),configSource:i,configValid:s,...o,...p&&m?{ruleActivation:{id:p.id,...m}}:{}}}function kd(e){let t=X(e?.cwd),n=e?.userConfigPath??Q(e),r=ee({cwd:e?.cwd,userConfigDir:e?.userConfigDir,userConfigPath:e?.userConfigPath});try{if(x(r.projectConfigTarget)!==null){if(le(r.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(o){if(o instanceof N)return{configSource:t,configValid:!1};throw o}try{if(x(r.userConfigTarget)!==null){let o=le(r.userConfigTarget);return{configSource:n,configValid:o.errors.length===0}}return{configSource:null,configValid:!0}}catch(o){if(o instanceof N)return{configSource:n,configValid:!1};throw o}}function Sd(e){let t=Cd(e?.cwd??process.cwd()),n=e?.policySnapshot??B({cwd:t,userConfigDir:e?.userConfigDir}),r=de(n.policy);return{cwd:t,effectiveCwd:t,policySnapshot:n,environment:si(),protectedGitMetadata:di(t),effectiveCapabilities:r.capabilities,strict:e?.strict??r.strict,paranoidRm:r.paranoidRm,paranoidInterpreters:r.paranoidInterpreters,worktreeMode:r.worktreeMode}}function Dd(e,t){let n=t.cwd??process.cwd(),r=ai(Ke("",{command:e},{kind:"command",shell:"posix"},{executionCwd:n,configCwd:n},e)),o=mi(r);if(o)return{reason:fi,target:o.target,ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};let i=ci(r,t.protectedGitMetadata);if(i)return{reason:li,target:i.target,ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};let s=t.policySnapshot.policy,a=s.secretProtection.enabled===!1?null:hi(r,s.secretProtection,{strict:t.strict});if(a)return{reason:gi,target:a.target,ruleId:a.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"};return null}function Rd(e,t){let n=t.policySnapshot.policy,r=yt({...n,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...n.destructiveCommandRuleOverrides,...Object.fromEntries(ht.flatMap((o)=>o.activationCapability?[[o.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return pi(e,{...t,policySnapshot:r,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function Ad(e){if(!e)return;return{id:G(e.id),...e.rulebook?{rulebook:{name:G(e.rulebook.name),version:G(e.rulebook.version)}}:{},...e.source?{source:G(e.source)}:{},...e.override?{override:{type:"reason",reason:G(e.override.reason)}}:{}}}function Ed(e){let t=e.events.flatMap((r)=>r.kind==="step"&&r.scope==="global"?[r.step]:[]),n=new Map;for(let r of e.events){if(r.kind!=="step"||r.scope!=="segment")continue;let o=n.get(r.segmentIndex)??{index:r.segmentIndex,steps:[]};o.steps.push(r.step),n.set(r.segmentIndex,o)}return{steps:t,segments:[...n.values()]}}function Pd(e,t){let n=e?.replace(/^custom\./,"");if(!n||!t.policy.rules.some((r)=>r.name===n))return;return t.ruleMetadata[n]??Object.freeze({id:n})}function Nd(e){let t=Je(),n=T({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},e);if(ae(n.errors))return null;if(n.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(n.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let r=n.values.limit===void 0?20:yi(n.values.limit);if(r===null)return console.error("--limit must be a positive number"),null;let o=n.values.since===void 0?Math.min(30,t):yi(n.values.since);if(o===null||o>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let i={limit:r,limitExplicit:n.values.limit!==void 0,since:o,sinceExplicit:n.values.since!==void 0,all:n.flags.all,json:n.flags.json,suspect:n.flags.suspect,pruneLegacy:n.flags.pruneLegacy,dryRun:n.flags.dryRun,id:n.values.id,agent:n.values.agent,rule:n.values.rule,session:n.values.session,project:n.values.project===void 0?void 0:$d(n.values.project)};if(i.id&&(i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.sinceExplicit||i.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(i.pruneLegacy&&(i.id!==void 0||i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.all||i.sinceExplicit||i.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(i.dryRun&&!i.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return i}async function bi(e,t={}){let n=Nd(e);if(!n)return 1;let r=t.logsDir??ue();if(n.pruneLegacy)return Fd(r,n.json,n.dryRun);if(!r)return console.log(n.json?"[]":n.id?`No retained audit log entry found for id ${I(n.id)}.`:"No audit log entries found."),0;ke(r);let o={count:0},i=ye(r,o).flatMap((d)=>ut(d,o).map((p)=>({entry:p,file:d})));if(o.count>0)console.error(`warning: ${o.count} audit log ${o.count===1?"source":"sources"} could not be read; these results are incomplete`);if(n.id)return Ud(i,n,t.timeZone);let s=Date.now()-n.since*24*60*60*1000,a=i.filter((d)=>Gd(d,n,r,s)),l=n.suspect?jn(a.map((d)=>d.entry)):null,c=(l?a.filter((d)=>l.has(d.entry)):a).sort((d,p)=>Date.parse(p.entry.ts)-Date.parse(d.entry.ts)).slice(0,n.limit);if(n.json)return console.log(JSON.stringify(c.map((d)=>d.entry),null,2)),0;if(c.length===0)return console.log("No audit log entries found."),0;for(let d of c)console.log(Vd(d.entry,t.timeZone));return 0}function Fd(e,t,n){let r=e?Md(e).map((a)=>Od(e,a)):[];if(n)return Hd(r,t);let o=[],i=0,s=0;for(let a of r){let l=Li(a,{throwIfNoEntry:!1})?.size??0,c=jd(a);if(c){o.push(`${vi(a)}: ${c}`);continue}i++,s+=l}if(t)return console.log(JSON.stringify({removedFiles:i,removedBytes:s,failedFiles:o.length})),o.length===0?0:1;console.log(i===0&&o.length===0?"No legacy audit log files found.":`Removed ${i} legacy audit log ${i===1?"file":"files"} (${wi(s)}).`);for(let a of o)console.error(`Could not remove ${I(a)}`);if(console.log("Nested v2 audit logs were not changed."),i>0)console.log("This deletion cannot be undone.");return o.length===0?0:1}function Hd(e,t){let n=e.reduce((r,o)=>r+(Li(o,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:e.length,bytes:n})),0;if(console.log(e.length===0?"No legacy audit log files found.":`Would remove ${e.length} legacy audit log ${e.length===1?"file":"files"} (${wi(n)}).`),console.log("Nested v2 audit logs are not included."),e.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Md(e){try{return Td(e,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function jd(e){try{return Id(e),null}catch(t){return t instanceof Error?t.message:String(t)}}function wi(e){let t=["B","KiB","MiB","GiB"],n=Math.min(Math.floor(Math.log2(Math.max(e,1))/10),t.length-1);return`${Math.round(e/1024**n*10)/10} ${t[n]}`}function Ud(e,t,n){let r=e.filter((i)=>i.entry.id===t.id);if(r.length>1)return console.error(`Multiple audit log entries found for id ${I(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(r.map((i)=>i.entry),null,2)),0;let o=r[0];if(!o)return console.log(`No retained audit log entry found for id ${I(t.id??"")}.`),0;return console.log(zd(o.entry,n)),0}function Gd(e,t,n,r){if(!t.all&&e.entry.decision==="allow")return!1;if(Date.parse(e.entry.ts)<r)return!1;if(t.agent!==void 0&&e.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&e.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!Bd(e,n,t.session))return!1;if(t.project!==void 0&&!qd(e.entry.cwd,t.project))return!1;return!0}function Bd(e,t,n){if(e.entry.sessionId===n)return!0;return _d(e.file)===t&&vi(e.file,".jsonl")===n}function qd(e,t){if(!e)return!1;return e===t||e.startsWith(`${t}/`)}function Vd(e,t){let n=I(e.id??"-"),r=I(e.decision??"deny"),o=e.cwd?`  [${I(e.cwd)}]`:"",i=e.segment||e.command,s=i===e.command?"":"↳ ",a=i.length>50?`${i.slice(0,50)}…`:i;return`${n.padEnd(16)}  ${I(xi(e.ts,t))}  ${r.padEnd(5)}  ${I(e.agent??"-").padEnd(15)}  ${I(e.ruleId??"-").padEnd(20)}  ${s}${I(a)}${o}`}function zd(e,t){let n=(o)=>I(o===void 0||o===null||o===""?"-":o),r=e.shape?`${e.agent??"-"} (shape: ${e.shape})`:e.agent??"-";return[`id:        ${n(e.id)}`,`ts:        ${n(xi(e.ts,t))}`,`decision:  ${n(e.decision)}`,`agent:     ${n(r)}`,`level:     ${n(e.level)}`,`tool:      ${n(e.toolName)}`,`rule:      ${n(e.ruleId)}`,`intent:    ${n(e.intent)}`,`stage:     ${n(e.failureStage)}`,`error:     ${n(e.errorCode)}`,`session:   ${n(e.sessionId)}`,`cwd:       ${n(e.cwd)}`,`version:   ${n(e.v)}`,`truncated: ${n(e.truncated===!0?"yes":void 0)}`,`reason:    ${n(e.reason)}`,`command:   ${n(e.command)}`,`segment:   ${n(e.segment)}`].join(`
+`)}function xi(e,t){let n=new Date(e);if(Number.isNaN(n.getTime()))return e;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(n)}function yi(e){let t=Number(e);return Number.isFinite(t)&&t>0?t:null}var Ci={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var ki={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var Si={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as Oi,join as ru,relative as ou}from"node:path";var Kd=8388608;function Wd(e,t){console.log(JSON.stringify(e(Ri(t))))}async function Jd(e){let t;try{t=(await hr(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return yr(t,e,"Failed to parse hook input JSON.")}async function hr(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>Kd)throw Yd(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function Yd(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function yr(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function M(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:Ei(e)}}function te(e,t,n,r){let o=e===void 0?process.cwd():e,i=typeof o==="string"&&o.trim()!==""?fe([o]):void 0;if(i)return{configCwd:i,executionCwd:i};return O(r,t,n,eu(o)),null}function O(e,t,n,r){let o;try{o=gr(t)}catch(i){if(!(i instanceof pe))throw i}e(qt({command:o,segment:r,toolName:n}))}async function Zd(e){let t=await Jd(e.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){O(e.outputDeny);return}if(!e.isSupported(t))return;let n=e.getAgent?.(t)??e.agent,r=e.agent===n?void 0:e.agent,o=nu(t),i=(u,h)=>{Di(u,()=>e.getSessionId(t),{agent:n,shape:r,toolName:h,cwd:o}),e.outputDeny(u)},s=e.getToolName(t);if(typeof s!=="string"||s.trim()===""){O((u)=>i(u),tu(t));return}let a=s,l=(u)=>i(u,a),c;try{c=e.getToolInput(t,a,l)}catch(u){if(!(u instanceof pe))throw u;O(l,void 0,a);return}if(!c.ok)return;let d=e.getContext(t,c.input,a,l);if(!d)return;let p;try{p=gr(c.input)}catch(u){if(!(u instanceof pe))throw u;O(l,void 0,a);return}let m=Ke(a,c.input,c.route,d,p??null);try{let u=Vt(m,{guard:{auditAllowed:Pi(),dependencies:e.guardDependencies},audit:{agent:n,shape:r,getSessionId:()=>e.getSessionId(t)}}),h=mr(u,{includeEvidence:!0,toolName:u.stage==="command-analysis"?void 0:a});if(h){e.outputDeny(h);return}e.outputAllow?.()}catch(u){if(!(u instanceof Ti))throw u;Xd(u);let h=mr(u.evaluation,{includeEvidence:!0,toolName:u.evaluation.stage==="command-analysis"?void 0:a});if(h)e.outputDeny(h);return}}function Xd(e){if(!Lt(S.debug))return;console.error(`CC Safety Net debug: ${Qd(e.stage)}: ${Ai(e.cause)}`)}function Qd(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function eu(e){return typeof e==="string"?e:void 0}function tu(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function nu(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function j(e){let t=(o)=>Wd(e.createDenyOutput,o),n=e.createAllowOutput;await Zd({...e,outputDeny:t,outputAllow:n?()=>console.log(JSON.stringify(n())):void 0})}function Ct(e){return ru(e,".gemini","config","hooks.json")}var iu=new Map([["run_command","auto"]]),su=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function $i(e){return M(e,iu)}async function Ni(){await j({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:uu(e.toolCall?.args,t),route:$i(t)}),getContext:au,getSessionId:(e)=>e.conversationId})}function au(e,t,n,r){let i=du(e).flatMap((c)=>{let d=fe([c]);return d?[d]:[]});if(!i[0])return Re(r,t,n),null;if(n!=="run_command"){let c;try{c=lu(t,n,i)}catch(d){if(d instanceof pe)return Re(r,void 0,n),null;if(!(d instanceof Se))throw d;return Re(r,t,n),null}if(!c)return Re(r,t,n),null;return{configCwd:c,executionCwd:c}}let s=e.toolCall?.args;if(!s||!Object.hasOwn(s,"Cwd"))return{configCwd:i[0],executionCwd:i[0]};let a=s.Cwd;if(typeof a!=="string"||a.trim()==="")return Re(r,t,n),null;let l=Ae(a,i);if(l){let c=Fi(l,i);if(!c)return Re(r,t,n,a),null;return{configCwd:c,executionCwd:l}}return Re(r,t,n,a),null}function lu(e,t,n){let r=$i(t),o=[...Ii(e,su),...r.kind==="patch"?_i(e):[]].filter(Oi),i=zt(),s=new Set(o.flatMap((a)=>{let l=Fi(wt(a,xt,i),n);return l?[l]:[]}));if(s.size>1)return null;return[...s][0]??n[0]??null}function Fi(e,t){return t.filter((n)=>cu(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function cu(e,t){let n=ou(t,e);return n===""||!n.startsWith("..")&&!Oi(n)}function Re(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(qt({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function du(e){if(e.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((n)=>typeof n==="string"&&n.trim()!==""):[];return fe(t)?t:[]}function uu(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var kt=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:8,runtime:{order:6,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:9,runtime:{order:7,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:10,install:{order:10,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:11,install:{order:11,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:12,install:{order:12,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],Kt=kt.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Hi=kt.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),V=kt.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),K0=Object.fromEntries(kt.map((e)=>[e.id,e.displayName]));function R(e){return kt.find((t)=>t.id===e)?.displayName??e}import{homedir as pu}from"node:os";import{isAbsolute as Mi,join as Lr}from"node:path";function Ui(e){if(e!==void 0&&e!==null&&!Mi(e))return"unknown";try{let t=zt(),n=e?wt(e,xt,t):void 0,r=process.env.HOME||pu(),o=[["codex",process.env.CODEX_HOME||Lr(r,".codex")],["copilot-cli",process.env.COPILOT_HOME||Lr(r,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||Lr(r,".claude")]],i=n?o.flatMap(([s,a])=>{if(!Mi(a))return[];return ji(n,wt(a,xt,t))?[s]:[]}):[];if(i.length===1)return i[0]??"unknown";if(i.length>1)return"unknown"}catch(t){if(t instanceof Se)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var vr="PreToolUse",Gi="BeforeTool",Bi="pre_tool_call",br="PreToolUse";var fu=new Map([["Bash","posix"],["PowerShell","powershell"]]);function mu(e){return M(e,fu)}async function qi(){await j({agent:"claude-code",getAgent:(e)=>Ui(e.transcript_path),createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:vr,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===vr,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:mu(t)}),getContext:(e,t,n,r)=>te(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}var gu=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function hu(e){return M(e,gu)}async function Vi(){await j({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=yr(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:hu(t)}},getContext:(e,t,n,r)=>te(e.cwd,t,n,r),getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var yu=new Map([["Shell","auto"]]);function Lu(e){return M(e,yu)}async function zi(){await j({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Lu(t)}),getContext:vu,getSessionId:(e)=>e.conversation_id})}function vu(e,t,n,r){let o=bu(e);if(!o[0])return O(r,t,n),null;let i=Ae(xu(e.cwd),o);if(!i)return O(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:i,executionCwd:i};if(!Object.hasOwn(t,"working_directory"))return{configCwd:i,executionCwd:i};let s=t.working_directory;if(typeof s!=="string"||s.trim()==="")return O(r,t,n),null;let a=Ae(s,o);if(!a)return O(r,t,n,s),null;return{configCwd:i,executionCwd:a}}function bu(e){return wu(e).flatMap((t)=>{let n=fe([t]);return n?[n]:[]})}function wu(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function xu(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Cu=new Map([["run_shell_command","auto"]]);function ku(e){return M(e,Cu)}async function Ki(){await j({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===Gi,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:ku(t)}),getContext:(e,t,n,r)=>te(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}import{resolve as Su}from"node:path";var Du=new Map([["terminal","posix"]]);async function Wi(){await j({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===Bi,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:M(t,Du)}),getContext:Ru,getSessionId:(e)=>e.session_id})}function Ru(e,t,n,r){let o=te(e.cwd,t,n,r);if(!o)return null;if(!t||typeof t!=="object"||Array.isArray(t))return o;if(!Object.hasOwn(t,"workdir"))return o;let i=t.workdir;if(typeof i!=="string"||i.trim()==="")return O(r,t,n),null;let s=fe([Su(o.configCwd,i)]);if(!s)return O(r,t,n,i),null;return{...o,executionCwd:s}}var Ji=new Map([["Bash","posix"]]);function Au(e){return M(e,Ji)}async function Yi(){await j({agent:"kimi-code",createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:br,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===br,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Au(t)}),getContext:(e,t,n,r)=>{let o=te(e.cwd,t,n,r);if(!o)return null;let i=e.tool_input;if(!Ji.has(n)||!i||!Object.hasOwn(i,"cwd"))return o;let s=i.cwd;if(typeof s!=="string"||s.trim()==="")return O(r,t,n),null;let a=Ae(s,[o.configCwd]);if(!a)return O(r,t,n,s),null;return{configCwd:o.configCwd,executionCwd:a}},getSessionId:(e)=>e.session_id})}var Eu={"antigravity-cli":Ni,"claude-code":qi,"copilot-cli":Vi,cursor:zi,"gemini-cli":Ki,"hermes-agent":Wi,"kimi-code":Yi},Ye=Hi.map((e)=>({...e,run:Eu[e.id]}));function Zi(e){let t=T({label:"hook",booleans:Object.fromEntries(Ye.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=Ye.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Xi(e){return Ye.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}var Pu=Ye.map((e)=>({flags:e.flags.join(", "),description:e.description})),Tu=Ye.flatMap((e)=>e.flags.map((t)=>`cc-safety-net hook ${t}`)),Qi={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Pu,{flags:"-h, --help",description:"Show this help"}],examples:Tu};var es={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...V.map((e)=>({flags:e.flag,description:`Install ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...V.map((e)=>`cc-safety-net install ${e.flag}`)]},ts={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...V.map((e)=>({flags:e.flag,description:`Uninstall ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...V.map((e)=>`cc-safety-net uninstall ${e.flag}`)]},ns={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var rs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var Ze={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var os={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var is={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var Wt=[os,Ci,rs,ki,Ze,es,ns,ts,Qi,Si,is];function Iu(e){return e.aliases??[]}function Jt(e){let t=e.toLowerCase();return Wt.find((n)=>n.name.toLowerCase()===t||Iu(n).some((r)=>r.toLowerCase()===t))}import{readFileSync as _u}from"node:fs";import{basename as Ou}from"node:path";function Yt(e=7,t=ue()){let n=Date.now()-e*24*60*60*1000,r=[],o=new Set,i=0,s,a,l,c;if(t)ke(t);let d={count:0},p=t?ye(t,d):[];for(let u of p)try{let f=_u(u,"utf-8").trim().split(`
+`).filter(Boolean);for(let L of f)try{let v=JSON.parse(L);if(v.decision==="allow")continue;let w=new Date(v.ts).getTime();if(w>=n){if(i++,o.add(v.sessionId??Ou(u,".jsonl")),a===void 0||w<=a)s=v.ts,a=w;if(c===void 0||w>c)l=v.ts,c=w;$u(r,v,w)}}catch{d.count++}}catch{d.count++}let m=r.map((u)=>({timestamp:u.ts,command:u.command,reason:u.reason,relativeTime:Mn(new Date(u.ts))}));return{totalBlocked:i,sessionCount:o.size,recentEntries:m,oldestEntry:s,newestEntry:l,unreadable:d.count}}function $u(e,t,n){let r=e.findIndex((o)=>n>new Date(o.ts).getTime());if(r===-1){if(e.length<3)e.push(t);return}if(e.splice(r,0,t),e.length>3)e.pop()}import{dirname as Nu}from"node:path";function ss(e,t,n,r,o){let i;try{if(x(r)===null)return{path:e,exists:!1,valid:!1,ruleCount:0};i=le(r),i.errors.push(...ce(e,t,{userConfigDir:n},o))}catch(s){if(!(s instanceof N))throw s;i={errors:[s.message],ruleNames:new Set}}return{path:e,exists:!0,valid:i.errors.length===0,ruleCount:i.ruleNames.size,...i.errors.length>0?{errors:i.errors}:{}}}function Fu(e,t){return{source:t,name:e.name,command:e.command,subcommand:e.subcommand,blockArgs:[...e.block_args],reason:e.reason}}function as(e,t){let n=t?.userConfigPath??Q(),r=t?.projectConfigPath??X(e),o=Nu(n),i=Le({cwd:e,userConfigPath:n,projectConfigPath:r,userConfigDir:o}),s=ee({cwd:e,userConfigPath:n,projectConfigPath:r,userConfigDir:o}),a=new Map(i.rulebooks.flatMap((l)=>l.rules.map((c)=>[c,l.source])));return{userConfig:ss(n,Ve({userConfigPath:n}),o,s.userConfigTarget,s.userScope),projectConfig:ss(r,ze(r),o,s.projectConfigTarget,s.projectScope),effectiveRules:i.rules.map((l)=>Fu(l,a.get(l.name)??"project")),shadowedRules:[]}}var Hu=[{flag:S.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:S.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:S.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:S.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:S.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:S.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:S.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:S.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function ls(){return[...Hu.map((e)=>({name:e.flag.name,value:ur(e.flag),isSet:pr(e.flag),legacyName:e.flag.legacyName,legacyValue:e.flag.legacyName?process.env[e.flag.legacyName]:void 0,legacyIsSet:e.flag.legacyName?process.env[e.flag.legacyName]!==void 0:void 0,description:e.description,defaultBehavior:e.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:process.env.CC_SAFETY_NET_HOME,isSet:process.env.CC_SAFETY_NET_HOME!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var cs={error:0,warning:1,info:2},Mu=["policy","config","audit"];function ju(e){return e.map((t)=>{if(t==="ownership")return"is not owned by the current user";if(t==="permissions")return"has unsafe permissions";if(t==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var Uu=[{derive:(e)=>e.hooks.length>0&&e.hooks.every((t)=>!t.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(e)=>e.hooks.filter((t)=>t.inspectionStatus==="failed").map((t)=>{let n=R(t.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${n} inspection failed`,detail:`Doctor could not verify the ${n} integration configuration.`,fixHint:`Correct the reported ${n} configuration error, then run \`cc-safety-net doctor\` again.`,integration:t.platform}})},{derive:(e)=>e.userConfig.exists&&!e.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:e.userConfig.path}]:[]},{derive:(e)=>e.projectConfig.exists&&!e.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:e.projectConfig.path}]:[]},{derive:(e)=>e.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${e.configState.reason}`,fixHint:"Correct the named source, run `cc-safety-net rule sync` for a rule source, then rerun doctor."}]:[]},{derive:(e)=>{let t=e.environment.find((n)=>n.name==="CC_SAFETY_NET_AUDIT_SCOPE");return dr(t?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...Mu.map((e)=>({derive:(t)=>t.posture.directories.filter((n)=>n.kind===e&&n.status==="unsafe").map((n)=>({checkId:`posture.${e}-directory-unsafe`,severity:"error",title:`${e[0]?.toUpperCase()}${e.slice(1)} directory is unsafe`,detail:`The ${e} directory ${ju(n.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...n.path?{path:n.path}:{}}))})),{derive:(e)=>{let t=[...e.effectiveSafety.weakenedRuleOverrides].sort();return t.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${t.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${t.join(", ")}.`}]:[]}}];function ds(e){return Uu.flatMap((t,n)=>t.derive(e).map((r,o)=>({finding:r,catalogOrder:n,occurrence:o}))).sort((t,n)=>cs[t.finding.severity]-cs[n.finding.severity]||t.catalogOrder-n.catalogOrder||t.occurrence-n.occurrence).map((t)=>t.finding)}function ne(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var Gu=(e)=>ne()?`\x1B[32m${e}\x1B[0m`:e,Bu=(e)=>ne()?`\x1B[33m${e}\x1B[0m`:e,qu=(e)=>ne()?`\x1B[34m${e}\x1B[0m`:e,Vu=(e)=>ne()?`\x1B[35m${e}\x1B[0m`:e,zu=(e)=>ne()?`\x1B[36m${e}\x1B[0m`:e,Ku=(e)=>ne()?`\x1B[31m${e}\x1B[0m`:e,Wu=(e)=>ne()?`\x1B[2m${e}\x1B[0m`:e,Ju=(e)=>ne()?`\x1B[1m${e}\x1B[0m`:e,g={green:Gu,yellow:Bu,blue:qu,magenta:Vu,cyan:zu,red:Ku,dim:Wu,bold:Ju},Yu="\x1B[0m",Zu=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Xu(e){let t=e;return()=>(t=(t*1664525+1013904223)%4294967296,t/4294967296)}function Qu(e){let t=[...Zu],n=Xu(e);for(let r=t.length-1;r>0;r--){let o=Math.floor(n()*(r+1)),i=t[r];t[r]=t[o],t[o]=i}return t}function ep(e,t=0){if(!ne())return"";let n=Qu(t);return`\x1B[38;5;${n[e%n.length]}m`}function us(e,t,n=0){if(!ne())return`"${e}"`;return`${ep(t,n)}"${e}"${Yu}`}var tp=new RegExp("\x1B\\[[0-9;]*m","g"),wr=(e)=>e.replace(tp,"").length;function Ee(e){let t=(e.headers??e.rows[0]??[]).map((s,a)=>{let l=Math.max(...e.rows.map((c)=>wr(c[a]??"")));return Math.max(wr(s),l)}),n=(s,a)=>s+" ".repeat(Math.max(0,a-wr(s))),r=(s,a)=>a[0]+t.map((l)=>s.repeat(l+2)).join(a[1])+a[2],o=(s)=>`│ ${s.map((a,l)=>n(a,t[l]??0)).join(" │ ")} │`,i=e.headers?[`   ${o(e.headers)}`,`   ${r("─",["├","┼","┤"])}`]:[];return[`   ${r("─",["┌","┬","┐"])}`,...i,...e.rows.map((s)=>`   ${o(s)}`),`   ${r("─",["└","┴","┘"])}`].join(`
+`)}function ps(e){let t=[];t.push("Hook Integration"),t.push(np(e));let n=[],r=[];for(let o of e){let i=R(o.platform);if(o.errors&&o.errors.length>0)for(let s of o.errors)if(o.configured)n.push({platform:i,message:s});else r.push({platform:i,message:s})}for(let o of n)t.push(`   Warning (${o.platform}): ${o.message}`);for(let o of r)t.push(g.red(`   Error (${o.platform}): ${o.message}`));return t.join(`
+`)}function np(e){let t=["Platform","Discovery","Configuration","Inspection"],n=e.map((r)=>{let o=R(r.platform);if(r.inspectionStatus==="not-inspected"){let l=g.dim("Not inspected");return[o,l,l,l]}let i=r.detected?g.green("Detected"):r.inspectionStatus==="failed"?g.red("Unknown"):g.dim("Not detected"),s=r.configured?g.green("Configured"):r.detected?g.yellow("Not configured"):r.inspectionStatus==="failed"?g.red("Unknown"):g.dim("Not applicable"),a=r.inspectionStatus==="verified"?g.green("Verified"):r.inspectionStatus==="failed"?g.red("Failed"):g.dim("Not applicable");return[o,i,s,a]});return Ee({headers:t,rows:n})}function fs(e){let n=["Guard Engine Verification",`   Synthetic self-test: ${e.failed>0?g.red(`${e.passed}/${e.total} FAIL`):g.green(`${e.passed}/${e.total} passed`)}`],r=e.results.filter((o)=>!o.passed);if(r.length>0){n.push(""),n.push(g.red("   Failures:"));for(let o of r)n.push(g.red(`   • ${o.description}`)),n.push(g.red(`     expected ${o.expected}, got ${o.actual}`))}return n.join(`
+`)}function rp(e){if(e.length===0)return"   (no custom rules)";let t=["Source","Name","Command","Block Args"],n=e.map((r)=>[r.source,r.name,r.subcommand?`${r.command} ${r.subcommand}`:r.command,r.blockArgs.join(", ")]);return Ee({headers:t,rows:n})}function ms(e){let t=[];if(t.push("Configuration"),t.push(op(e.userConfig,e.projectConfig)),t.push(""),e.effectiveRules.length>0)t.push(`   Effective rules (${e.effectiveRules.length} total):`),t.push(rp(e.effectiveRules));else t.push("   Effective rules: (none - using built-in rules only)");for(let n of e.shadowedRules)t.push(""),t.push(`   Note: Project rule "${n.name}" shadows user rule with same name`);return t.join(`
+`)}function op(e,t){let n=["Scope","Status"],r=(i)=>{if(!i.exists)return g.dim("N/A");if(!i.valid)return g.red(`Invalid (${i.errors?.[0]??"unknown error"})`);return g.green("Configured")},o=[["User",r(e)],["Project",r(t)]];return Ee({headers:n,rows:o})}function gs(e){let t=[];return t.push("Environment"),t.push(ip(e)),t.join(`
+`)}function hs(e){let t=["Effective Safety",`   Selected preset: ${e.effectiveSafety.selectedPreset}`,`   Effective: ${e.effectiveSafety.level}`],n=[["fail_closed","fail_closed"],["paranoid_rm","paranoid_rm"],["paranoid_interpreters","paranoid_interpreters"]];for(let[r,o]of n){let i=e.effectiveSafety.capabilities[r],s=i.enabled?g.green("ON"):g.dim("OFF"),a=i.sources.length>0?` (${i.sources.join(", ")})`:"";t.push(`   ${o}: ${s} via ${i.source}${a}`)}t.push(`   Stored rule customizations: ${e.effectiveSafety.ruleCounts.stored}`),t.push(`   Effective rule customizations: ${e.effectiveSafety.ruleCounts.effective}`);for(let[r,o]of Object.entries(e.effectiveSafety.ruleOverrides))t.push(`   ${r}: ${o}`);return t.join(`
+`)}function ys(e){let t=["Findings"];if(e.length===0)return t.push("   No findings from inspected doctor facts."),t.join(`
+`);for(let n of e){let r=`[${n.severity.toUpperCase()}] ${n.checkId}: ${I(n.title)}`,o=n.severity==="error"?g.red:n.severity==="warning"?g.yellow:g.blue;if(t.push(`   ${o(r)}`),t.push(`      ${I(n.detail)}`),n.path)t.push(`      Path: ${I(n.path)}`);if(n.fixHint)t.push(`      Fix: ${I(n.fixHint)}`)}return t.join(`
+`)}function ip(e){let t=["Variable","Status","Legacy"],n=e.map((r)=>{let o=r.isSet?g.green("✓"):g.dim("✗"),i=r.legacyName&&r.legacyIsSet?`${r.legacyName} ${g.green("✓")}`:r.legacyName??"";return[r.name,o,i]});return Ee({headers:t,rows:n})}function Ls(e){let t=[];if(e.totalBlocked===0)t.push("Recent Activity"),t.push("   No blocked commands in the last 7 days"),t.push("   Tip: This is normal for new installations");else t.push(`Recent Activity · last 7 days (${e.totalBlocked} blocked / ${e.sessionCount} sessions)`),t.push(sp(e.recentEntries));if(e.unreadable>0)t.push(`   Warning: ${e.unreadable} audit log ${e.unreadable===1?"source":"sources"} could not be read; this summary is incomplete`);return t.join(`
+`)}function sp(e){let t=["Time","Command"],n=e.map((r)=>{let o=I(r.command.replace(/\r\n|\r|\n/g," ↵ ").replace(/\t/g," ")),i=o.length>40?`${o.slice(0,37)}...`:o;return[r.relativeTime,i]});return Ee({headers:t,rows:n})}function vs(e){let t=[];if(t.push("Update Check"),e.latestVersion===null&&!e.error)return t.push(Zt([["Status",g.dim("Skipped")],["Installed",e.currentVersion]])),t.join(`
+`);if(e.error)return t.push(Zt([["Status",`${g.yellow("⚠")} Error`],["Installed",e.currentVersion],["Error",g.dim(e.error)]])),t.join(`
+`);if(e.updateAvailable)return t.push(Zt([["Status",`${g.yellow("⚠")} Update Available`],["Current",e.currentVersion],["Latest",g.green(e.latestVersion??"")]])),t.push(""),t.push("   Run: bunx cc-safety-net@latest doctor"),t.push("   Or:  npx cc-safety-net@latest doctor"),t.join(`
+`);return t.push(Zt([["Status",`${g.green("✓")} Up to date`],["Version",e.currentVersion]])),t.join(`
+`)}function Zt(e){return Ee({rows:e})}function bs(e){let t=[];return t.push("System Info"),t.push(ap(e)),t.join(`
+`)}function ap(e){let t=["Component","Version"],n=(i)=>{if(i===null)return g.dim("not found");return i},o=[{label:"cc-safety-net",value:e.version},...Kt.map((i)=>({label:R(i),value:e.versions[i]??null})),{label:"Node.js",value:e.nodeVersion},{label:"npm",value:e.npmVersion},{label:"Bun",value:e.bunVersion},{label:"Platform",value:e.platform}].map((i)=>[i.label,n(i.value)]);return Ee({headers:t,rows:o})}function ws(e){if(e.findings.length===0)return g.green(`
+No findings from inspected doctor facts.`);let t={error:e.findings.filter((i)=>i.severity==="error").length,warning:e.findings.filter((i)=>i.severity==="warning").length,info:e.findings.filter((i)=>i.severity==="info").length},n=["error","warning","info"].filter((i)=>t[i]>0).map((i)=>`${t[i]} ${i}`),r=e.findings.length===1?"finding":"findings",o=`
+${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return g.red(o);if(t.warning>0)return g.yellow(o);return g.blue(o)}import{lstatSync as lp}from"node:fs";import{dirname as xr}from"node:path";function Cr(e,t){try{let n=lp(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function xs(e){let t=ue();return{directories:[Cr("policy",xr(xr(e))),Cr("config",xr(e)),...t?[Cr("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as cp}from"node:child_process";import{existsSync as Cs}from"node:fs";import{delimiter as dp,extname as up,join as pp}from"node:path";import{stripVTControlCharacters as ks}from"node:util";var Ds="2.0.10",fp=5000,mp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function P(){return Ds}function kr(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function gp(e){return(kr(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function hp(e,t){let n=up(e)?[e]:[...gp(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>Cs(r))??e;return(kr(t,"PATH")??"").split(dp).flatMap((r)=>n.map((o)=>pp(r,o))).find((r)=>Cs(r))??e}function Ss(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function Pe(e,t){let[n,...r]=e,o=t[mp]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=hp(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:kr(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Ss(i),...r.map(Ss)].join(" ")]}}var Xe=async(e,t=fp)=>{let n=await yp(e,{timeoutMs:t});if(n.code!==0)return null;return ks(n.stdout).trim()||ks(n.stderr).trim()||null};function yp(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=Pe([n,...r],process.env),s=cp(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(m)=>{l+=m.toString()}),s.stderr.on("data",(m)=>{c+=m.toString()});let d=(m)=>{if(a)return;a=!0,clearTimeout(p),o(m)},p=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(m)=>{d({code:m,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function Xt(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
+`)[0]?.trim()||null}async function St(e=Xe){let[t,n,r,o,i,s]=await Promise.all([Promise.all(V.map(async(a)=>[a.id,Xt(await e([...a.probeCommand]))])),e(["codex","plugin","list"],30000),e(["amp","plugins","list"],30000),e(["node","--version"]),e(["npm","--version"]),e(["bun","--version"])]);return{version:Ds,versions:Object.fromEntries(t),codexPluginListOutput:n,ampPluginListOutput:r,nodeVersion:Xt(o),npmVersion:Xt(i),bunVersion:Xt(s),platform:`${process.platform} ${process.arch}`}}function Sr(e,t){if(t==="dev")return!1;let n=e.split(".").map(Number),r=t.split(".").map(Number),[o=0,i=0,s=0]=n,[a=0,l=0,c=0]=r;if(o!==a)return o>a;if(i!==l)return i>l;return s>c}async function Qe(){let e=P(),t=new AbortController,n=setTimeout(()=>t.abort(),3000);try{let r=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!r.ok)return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${r.status}`};let o=await r.json(),i=Sr(o.version,e);return{currentVersion:e,latestVersion:o.version,updateAvailable:i}}catch(r){return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:r instanceof Error?r.message:"Network error"}}finally{clearTimeout(n)}}import*as Os from"node:readline";var Ps=(e)=>`\x1B[${e}B`,Lp=(e)=>`\x1B[${e}A`;var Rs=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function vp(e){return new Promise((t)=>setTimeout(t,e))}function bp(e,t,n){if(!n)return t(e);if(n.aborted)return Promise.resolve();return new Promise((r,o)=>{let i=()=>n.removeEventListener("abort",s),s=()=>{i(),r()};n.addEventListener("abort",s,{once:!0}),t(e).then(()=>{i(),r()},(a)=>{i(),o(a)})})}function Dt(e,t){return e&&e>0?e:t}function Qt(e){return Math.max(0,Math.min(1,e))}function et(e){return Math.max(0,Math.min(255,Math.round(e)))}function Dr(e){return e<=0.0031308?12.92*e:1.055*e**0.4166666666666667-0.055}function wp(e,t,n){let r=n*Math.PI/180,o=t*Math.cos(r),i=t*Math.sin(r),s=(e+0.3963377774*o+0.2158037573*i)**3,a=(e-0.1055613458*o-0.0638541728*i)**3,l=(e-0.0894841775*o-1.291485548*i)**3;return{blue:et(Dr(Qt(-0.0041960863*s-0.7034186147*a+1.707614701*l))*255),green:et(Dr(Qt(-1.2684380046*s+2.6097574011*a-0.3413193965*l))*255),red:et(Dr(Qt(4.0767416621*s-3.3077115913*a+0.2309699292*l))*255)}}function Rr(e,t){let n=(t*e*180/Math.PI%360+360)%360;return wp(0.72,0.15,n)}function Ts(e,t=0.1){let n=Rr(t,e);return`\x1B[38;2;${n.red};${n.green};${n.blue}m`}function xp(e,t){return{blue:et(e.blue+(255-e.blue)*t),green:et(e.green+(255-e.green)*t),red:et(e.red+(255-e.red)*t)}}function Is(e,t,n){let r=Math.imul(e+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(n+374761393,2654435761),o=r^r>>>15,i=Math.imul(o,739982445),s=i^i>>>12,a=Math.imul(s,695872825);return((a^a>>>15)>>>0)/4294967296}function Cp(e,t,n){let r=Math.floor(Is(e,t,n)*Rs.length);return Rs[r]??"░"}function As(e){let t=Qt(e);return t*t*t*(t*(t*6-15)+10)}function kp(e){if(e.length===0)return"";let t=[],n=!1,r="";for(let o of e){let i=`${o.red};${o.green};${o.blue}`;if(o.bold!==n)t.push(o.bold?"\x1B[1m":"\x1B[22m"),n=o.bold;if(i!==r)t.push(`\x1B[38;2;${i}m`),r=i;t.push(o.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function Sp(e,t,n,r,o){return e.map((i,s)=>({...Rr(n,r+t+s/o),bold:!1,character:i}))}function Dp(e,t,n,r,o,i,s,a){let l=Math.max(1,r*0.75),c=Math.min(1,n/l),d=o*As(c),p=Math.max(0,(n-l)/Math.max(1,r-l)),m=(1-As(n/r))*a*2,u=0.35*Math.max(0,1-p*2),h=c>=1,f=Math.min(e.length,Math.ceil(d+2+1));return e.slice(0,f).map((L,v)=>{let w=Rr(i,s+t+v/a+m),y=v+Is(t,v,7919)*2-1;if(y>d+2)return{...w,bold:!1,character:" "};let C=d-y,H=0.8*Math.exp(-(C*C)/12.5),he=Math.min(0.9,H+u),Fn=!h&&y>d-4;return{...xp(w,he),bold:he>0.3,character:Fn?Cp(t,v,n):L}})}function Es(e){return`\x1B[?2026h${e.map((t,n)=>`\x1B8${n>0?Ps(n):""}${kp(t)}`).join("")}\x1B[?2026l`}async function Ar(e,t={}){if(!e)return;let n=t.output??process.stdout,r=t.sleep??vp,o=Dt(t.frequency,0.1),i=t.seed??0,s=Dt(t.speed,40),a=Dt(t.spread,3),l=Dt(t.frameRate,60),c=Math.max(1,Math.floor(Dt(t.duration,12))),d=e.split(`
+`).map((f)=>Array.from(f)),p=Math.max(...d.map((f)=>f.length)),m=1000*c*d.filter((f)=>f.length>0).length/s,u=p>0?Math.max(1,Math.ceil(m/(1000/l))):0,h=u>0?m/u:0;n.write(`\x1B[?25l${d.length>1?`${`
+`.repeat(d.length-1)}${Lp(d.length-1)}`:""}\x1B7`);try{for(let f=1;f<=u;f+=1){if(t.signal?.aborted)break;n.write(Es(d.map((L,v)=>Dp(L,v,f,u,p,o,i,a)))),await bp(h,r,t.signal)}}finally{if(n.write(Es(d.map((f,L)=>Sp(f,L,o,i,a)))),n.write("\x1B8"),d.length>1)n.write(Ps(d.length-1));n.write(`
+\x1B[0m\x1B[?25h`)}}var _s=["┏━┛┏━┛  ┏━┛┏━┃┏━┛┏━┛━┏┛┃ ┃  ┏━ ┏━┛━┏┛","┃  ┃    ━━┃┏━┃┏━┛┏━┛ ┃ ━┏┛  ┃ ┃┏━┛ ┃ ","━━┛━━┛  ━━┛┛ ┛┛  ━━┛ ┛  ┛   ┛ ┛━━┛ ┛ "].join(`
+`);function Rp(e){return Boolean(e.isTTY)}async function Rt(e={}){let t=e.output??process.stdout;if(!Rp(t))return;let n=e.input??process.stdin,r={duration:e.duration,frequency:e.frequency,output:t,seed:e.seed??Math.random()*8192,sleep:e.sleep,speed:e.speed,spread:e.spread};if(!n.isTTY||typeof n.setRawMode!=="function"){await Ar(_s,r);return}let o=new AbortController,i=n.readableFlowing===!0,s=n.isRaw===!0,a=!1,l=(c,d)=>{if(d.ctrl&&d.name==="c")a=!0;if(a||d.name==="return"||d.name==="enter")o.abort()};Os.emitKeypressEvents(n),n.on("keypress",l),n.setRawMode(!0),n.resume();try{await Ar(_s,{...r,signal:o.signal})}finally{if(n.off("keypress",l),n.setRawMode(s),!i)n.pause()}if(!a)return;if(e.onInterrupt){e.onInterrupt();return}process.kill(process.pid,"SIGINT")}var $s="\r\x1B[2K",Ap="\x1B[?25l",Ep="\x1B[39m",Pp="\x1B[?25h",Tp=100,Ip=0.55,_p=80,Ns=["⠋","⠙","⠹","⠸","⠼","⠴","⠦","⠧","⠇","⠏"];function Op(e){return new Promise((t)=>setTimeout(t,e))}async function en(e,t={}){let n=t.output??process.stdout;if(!n.isTTY)return e;let r=t.sleep??Op,o=!1,i=e.then((a)=>(o=!0,a),(a)=>{throw o=!0,a});if(await Promise.race([i.then(()=>!0),r(Tp).then(()=>!1)]))return i;n.write(Ap);try{for(let a=0;!o;a+=1)n.write(`${$s}${Ts(a*Ip)}${Ns[a%Ns.length]}${Ep} ${t.loadingMessage??"Loading…"}`),await Promise.race([i,r(_p)]);return await i}finally{n.write(`${$s}${Pp}`)}}async function At(e,t,n,r={}){let o=t();if(e)await n();if(e&&o.ready)await en(o.ready,r);return o.finish()}import{homedir as tf}from"node:os";import{stripVTControlCharacters as $p}from"node:util";var tn="amp plugins list",Np=/^\s*[✓✗]\s+cc-safety-net(?:\.ts)?\s+\(User Plugins\)\s+(\S+)\s*$/;function Fs(e){if(!e.ampPluginListOutput)return{platform:"amp",status:"n/a"};let t=$p(e.ampPluginListOutput).split(`
+`).map((n)=>Np.exec(n)?.[1]).find((n)=>n!==void 0);if(!t)return{platform:"amp",status:"n/a"};if(t!=="active")return{platform:"amp",status:"disabled",method:tn,configPath:tn,errors:[`Amp personal plugin cc-safety-net is ${t}; run "plugins: reload" in Amp or reinstall with install --amp`]};return{platform:"amp",status:"configured",method:tn,configPath:tn}}import{existsSync as Fp,readFileSync as Hp}from"node:fs";var Mp=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*(?:--agy-cli|-ac)(\s|["']|$)/;function jp(e){if(!e||typeof e!=="object"||Array.isArray(e))return[];return Object.values(e).flatMap((t)=>{if(!t||typeof t!=="object"||Array.isArray(t))return[];let n=t,r=n.PreToolUse;if(!Array.isArray(r))return[];return r.flatMap((o)=>{if(!o||typeof o!=="object"||Array.isArray(o))return[];let i=o.hooks;if(!Array.isArray(i))return[];return i.flatMap((s)=>{if(!s||typeof s!=="object"||Array.isArray(s))return[];let a=s.command;if(typeof a!=="string"||!Mp.test(a))return[];return[{command:a,enabled:n.enabled!==!1}]})})})}function Hs(e){let t=Ct(e.homeDir);if(!Fp(t))return{platform:"antigravity-cli",status:"n/a",configPath:t};let n;try{n=jp(JSON.parse(Hp(t,"utf-8")))}catch(r){return{platform:"antigravity-cli",status:"n/a",configPath:t,errors:[`Failed to parse Antigravity hooks config ${t}: ${r instanceof Error?r.message:String(r)}`]}}if(n.some((r)=>r.enabled))return{platform:"antigravity-cli",status:"configured",method:"hook config",configPath:t};if(n.length>0)return{platform:"antigravity-cli",status:"disabled",method:"hook config",configPath:t};return{platform:"antigravity-cli",status:"n/a",configPath:t}}import{join as Ms}from"node:path";import{existsSync as Up,lstatSync as Gp,readFileSync as Bp}from"node:fs";function re(e,t=(n)=>n){if(!Up(e))return{kind:"missing"};try{return{kind:"ok",value:JSON.parse(t(Bp(e,"utf-8")))}}catch{return{kind:"unreadable"}}}function E(e){try{return Gp(e)}catch{return}}function nn(e,t){let n=E(t);if(!n)return{platform:e,status:"n/a",configPath:t};if(!n.isSymbolicLink()&&n.isDirectory())return;return{platform:e,status:"n/a",configPath:t,errors:[`${t} is a symlink or not a directory; move or remove it before installing`]}}function b(e,t){return typeof e==="object"&&e!==null?e[t]:void 0}var Er="cc-safety-net@cc-marketplace";function js(e){return Ms(e,".claude","plugins","installed_plugins.json")}function Us(e,t){let n=b(b(e,"plugins"),t);return Array.isArray(n)&&n.length>0}function rn(e,t){let n=re(js(e));return n.kind==="ok"&&Us(n.value,t)}function Pr(e){let t=js(e),n=re(t);if(n.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(n.kind==="missing")return{platform:"claude-code",status:"n/a"};if(!Us(n.value,Er))return{platform:"claude-code",status:"n/a"};let r=Ms(e,".claude","settings.json"),o=re(r);if(o.kind==="unreadable")return{platform:"claude-code",status:"not-inspected"};if(!(o.kind==="ok"&&b(b(o.value,"enabledPlugins"),Er)===!0))return{platform:"claude-code",status:"disabled",method:"plugin config",configPath:r,errors:[`${Er} is installed but not enabled in Claude Code`]};return{platform:"claude-code",status:"configured",method:"plugin config",configPath:t}}function Gs(e){return Pr(e.homeDir)}function Bs(e){if(!e.codexPluginListOutput)return{platform:"codex",status:"n/a"};let t=e.codexPluginListOutput.split(`
+`).find((n)=>n.includes("https://github.com/kenryu42/cc-safety-net.git"));if(!t)return{platform:"codex",status:"n/a"};if(!t.includes("installed,"))return{platform:"codex",status:"n/a"};if(!t.includes("installed, enabled"))return{platform:"codex",status:"disabled",method:"codex plugin list",configPath:"codex plugin list",errors:["Codex plugin line for https://github.com/kenryu42/cc-safety-net.git must contain installed, enabled."]};return{platform:"codex",status:"configured",method:"codex plugin list",configPath:"codex plugin list"}}import{existsSync as an,readdirSync as qp,readFileSync as Vp}from"node:fs";import{join as F}from"node:path";var oe="cc-safety-net@cc-marketplace",on=["cc-marketplace","cc-safety-net"],qs=["_direct","copilot-safety-net"],Vs=["cc-marketplace","safety-net"],zs="safety-net@cc-marketplace";function sn(e,t){let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(^|[^a-z0-9-])${n}([^a-z0-9-]|$)`,"m").test(e??"")}function Ks(e){return sn(e,"cc-safety-net@cc-marketplace")}function Ws(e){return sn(e,"cc-marketplace")}function Js(e){return sn(e,"copilot-safety-net")}function Ys(e){return sn(e,"safety-net@cc-marketplace")}function q(e){let t="",n=0,r=!1,o=!1,i=-1;while(n<e.length){let s=e[n],a=e[n+1];if(o){t+=s,o=!1,n++;continue}if(s==='"'&&!r){r=!0,i=-1,t+=s,n++;continue}if(s==='"'&&r){r=!1,t+=s,n++;continue}if(s==="\\"&&r){o=!0,t+=s,n++;continue}if(r){t+=s,n++;continue}if(s==="/"&&a==="/"){while(n<e.length&&e[n]!==`
+`)n++;continue}if(s==="/"&&a==="*"){n+=2;while(n<e.length-1){if(e[n]==="*"&&e[n+1]==="/"){n+=2;break}n++}continue}if(s===","){i=t.length,t+=s,n++;continue}if(s==="}"||s==="]"){if(i!==-1){let l=t.slice(i+1);if(/^\s*$/.test(l))t=t.slice(0,i)+l}i=-1,t+=s,n++;continue}if(!/\s/.test(s))i=-1;t+=s,n++}return t}function Tr(e){if(!e?.includes("cc-safety-net"))return!1;return/(^|\s)hook\s+(?:[^\s]+\s+)*(--copilot-cli|-cp)(\s|$)/.test(e)}function Xs(e,t){if(!e)return null;let n=e.match(/(\d+)\.(\d+)\.(\d+)/);if(!n)return null;let r=[Number(n[1]),Number(n[2]),Number(n[3])];for(let o=0;o<t.length;o++){let i=r[o]??0,s=t[o]??0;if(i!==s)return i>s}return!0}function zp(e){return Xs(e,[0,0,422])}function Kp(e){return Xs(e,[1,0,8])}function Et(e){return process.env.COPILOT_HOME||F(e,".copilot")}function Ir(e){return(e.hooks?.preToolUse??[]).some((n)=>{if(n.type!=="command")return!1;return Tr(n.command)||Tr(n.bash)||Tr(n.powershell)})}function _r(e,t){try{return JSON.parse(q(Vp(e,"utf-8")))}catch(n){t?.push(`Failed to parse ${e}: ${n instanceof Error?n.message:String(n)}`);return}}function Qs(e,t){try{return qp(e).filter((n)=>n.endsWith(".json")).sort((n,r)=>n.localeCompare(r))}catch(n){return t?.push(`Failed to read ${e}: ${n instanceof Error?n.message:String(n)}`),[]}}function Wp(e,t){if(!an(e))return[];let n=[];for(let r of Qs(e,t)){let o=F(e,r),i=_r(o,t);if(i&&Ir(i))n.push(o)}return n}function tt(e,t){if(!an(e))return;let n=_r(e,t);if(!n)return;return{path:e,config:n}}function Zs(e,t,n,r){if(t){e.push(`GitHub Copilot CLI ${t} does not support ${n}; requires ${r}+`);return}e.push(`GitHub Copilot CLI version unavailable; skipping ${n} because it requires ${r}+`)}function Jp(e){for(let t of e){if(t?.config.disableAllHooks===!0)return t.path;if(t?.config.disableAllHooks===!1)return}return}function Yp(e,t,n,r){let o=Et(e),i=F(t,".github","hooks"),s=F(o,"hooks"),a=F(t,".github","copilot"),l=F(t,".claude"),c=Kp(n),d=c===!0?r:void 0,p=[tt(F(a,"settings.local.json"),d),tt(F(a,"settings.json"),d),tt(F(l,"settings.local.json"),d),tt(F(l,"settings.json"),d)],m=[tt(F(o,"settings.json"),d),tt(F(o,"config.json"),d)];if(c!==!1){let C=Jp([...p,...m]);if(C){if(c===null)r.push(`GitHub Copilot CLI version unavailable; treating disableAllHooks in ${C} as active`);return{activeConfigPaths:[],disabledBy:C}}}let u=Wp(i,r),h=zp(n),f=h===!0?r:void 0,L=an(s)?Qs(s,f):[],v=[];for(let C of L){let H=F(s,C),he=_r(H,f);if(he&&Ir(he))v.push(H)}if(h!==!0&&v.length>0)Zs(r,n,`user hook files in ${s}`,"0.0.422"),v.length=0;let w=[];for(let C of[...p,...m]){if(!C)continue;if(!Ir(C.config))continue;if(c===!0){w.push(C);continue}Zs(r,n,"inline hook definitions in Copilot config files","1.0.8");break}let y=(C)=>C.filter((H)=>!!H&&w.includes(H)).map((H)=>H.path);return{activeConfigPaths:[...y(p),...u,...y(m),...v]}}function ea(e){let t=[],n=Yp(e.homeDir,e.cwd,e.copilotCliVersion,t);if(n.disabledBy)return{platform:"copilot-cli",status:"disabled",method:"hook config",configPath:n.disabledBy,configPaths:[n.disabledBy],errors:t.length>0?t:void 0};let r=Et(e.homeDir),o=F(r,"installed-plugins",...on),i=an(o),s=F(r,"settings.json"),a=re(s,q);if(i&&a.kind==="unreadable")return{platform:"copilot-cli",status:"not-inspected"};if(i&&a.kind==="ok"&&b(b(a.value,"enabledPlugins"),oe)===!1)return{platform:"copilot-cli",status:"disabled",method:"plugin config",configPath:s,errors:[`${oe} is installed but not enabled in Copilot CLI`]};if(i||n.activeConfigPaths.length>0){let l=i,c=n.activeConfigPaths[0];return{platform:"copilot-cli",status:"configured",method:l?"plugin config":"hook config",configPath:c??(l?o:void 0),configPaths:n.activeConfigPaths.length>0?n.activeConfigPaths:void 0,errors:t.length>0?t:void 0}}return{platform:"copilot-cli",status:"n/a",errors:t.length>0?t:void 0}}import{existsSync as s2,readFileSync as a2}from"node:fs";import{existsSync as ta,mkdirSync as Qp,readFileSync as e2}from"node:fs";import{dirname as t2,join as n2}from"node:path";import{renameSync as Zp,writeFileSync as Xp}from"node:fs";function _(e,t){let n=`${e}.${process.pid}.tmp`;Xp(n,t),Zp(n,e)}var Pt="npx -y cc-safety-net hook --cursor",na=30;function cn(e){return n2(e,".cursor","hooks.json")}function Te(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Or(){return{command:Pt,timeout:na,failClosed:!0}}function ln(e){return Te(e)&&e.command===Pt}function r2(e){return Object.keys(e).length===3&&e.command===Pt&&e.timeout===na&&e.failClosed===!0}function o2(e){try{return JSON.parse(e2(e,"utf-8"))}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Cursor hooks config ${e}: ${t.message}`);throw t}}function ra(e){let t=o2(e);if(!Te(t))throw Error(`Cursor hooks config ${e} must be a JSON object`);if(t.version!==1)throw Error(`Cursor hooks config ${e} must set "version": 1`);if(t.hooks!==void 0&&!Te(t.hooks))throw Error(`Cursor hooks config ${e} "hooks" must be an object`);let n=Te(t.hooks)?t.hooks.preToolUse:void 0;if(n!==void 0&&!Array.isArray(n))throw Error(`Cursor hooks config ${e} "hooks.preToolUse" must be an array`);return t}function oa(e){let t=Te(e.hooks)?e.hooks.preToolUse:void 0;return Array.isArray(t)?t:[]}function i2(e){if(!e.some(ln))return[...e,Or()];return e.reduce((t,n)=>{if(!ln(n))return t.result.push(n),t;if(!t.inserted)t.result.push(Or()),t.inserted=!0;return t},{result:[],inserted:!1}).result}function ia(e,t,n){let r=Te(t.hooks)?t.hooks:{},o={...t,hooks:{...r,preToolUse:n}};_(e,`${JSON.stringify(o,null,2)}
+`)}function sa(e){let t=cn(e);if(!ta(t))return Qp(t2(t),{recursive:!0}),_(t,`${JSON.stringify({version:1,hooks:{preToolUse:[Or()]}},null,2)}
+`),{path:t,alreadyInstalled:!1};let n=ra(t),r=oa(n),o=r.filter(ln);if(Te(n.hooks)&&Array.isArray(n.hooks.preToolUse)&&o.length===1&&o[0]!==void 0&&r2(o[0]))return{path:t,alreadyInstalled:!0};return ia(t,n,i2(r)),{path:t,alreadyInstalled:!1}}function aa(e){let t=cn(e);if(!ta(t))return{path:t,alreadyInstalled:!1};let n=ra(t),r=oa(n),o=r.filter((i)=>!ln(i));if(o.length===r.length)return{path:t,alreadyInstalled:!1};return ia(t,n,o),{path:t,alreadyInstalled:!0}}function l2(e){if(!e||typeof e!=="object"||Array.isArray(e))return[];let t=e.hooks;if(!t||typeof t!=="object"||Array.isArray(t))return[];let n=t.preToolUse;if(!Array.isArray(n))return[];return n.filter((r)=>!!r&&typeof r==="object"&&!Array.isArray(r)&&r.command===Pt)}function c2(e){let t=[];if(e.length>1)t.push("Multiple managed cc-safety-net hooks found; reinstall to collapse duplicates");let n=e[0];if(n&&n.failClosed!==!0)t.push('Managed hook is missing "failClosed": true; reinstall to repair');if(n&&n.timeout!==30)t.push('Managed hook "timeout" is not 30; reinstall to repair');return t}function la(e){let t=cn(e.homeDir);if(!s2(t))return{platform:"cursor",status:"n/a",configPath:t};let n;try{n=JSON.parse(a2(t,"utf-8"))}catch(i){return{platform:"cursor",status:"n/a",configPath:t,errors:[`Failed to parse Cursor hooks config ${t}: ${i instanceof Error?i.message:String(i)}`]}}let r=l2(n);if(r.length===0)return{platform:"cursor",status:"n/a",configPath:t};let o=c2(r);return{platform:"cursor",status:"configured",method:"hook config",configPath:t,errors:o.length>0?o:void 0}}import{existsSync as d2}from"node:fs";import{join as $r}from"node:path";var Nr="gemini-safety-net";function Fr(e){let t=$r(e,".gemini","extensions"),n=$r(t,Nr);if(!d2(n))return{platform:"gemini-cli",status:"n/a"};let r=$r(t,"extension-enablement.json"),o=re(r);if(o.kind==="unreadable")return{platform:"gemini-cli",status:"not-inspected"};let i=o.kind==="ok"?b(b(o.value,Nr),"overrides"):void 0;if(Array.isArray(i)&&i.some((a)=>typeof a==="string"&&a.startsWith("!")))return{platform:"gemini-cli",status:"disabled",method:"extension config",configPath:r,errors:[`${Nr} is disabled in Gemini CLI`]};return{platform:"gemini-cli",status:"configured",method:"extension config",configPath:n}}function ca(e){return Fr(e.homeDir)}import{readFileSync as La}from"node:fs";import{join as va}from"node:path";var z="cc-safety-net",da="# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent";function ua(e){return`# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent
+# version: ${e}
+`}function u2(e){return`${ua(e)}name: cc-safety-net
+version: "${e}"
 description: "Block destructive commands and secret-file access before Hermes runs a tool."
 author: "cc-safety-net"
 provides_hooks:
   - pre_tool_call
-`}function bL(n){return`${p0(n)}"""CC Safety Net guard for Hermes Agent.
+`}function p2(e){return`${ua(e)}"""CC Safety Net guard for Hermes Agent.
 
 Registers pre_tool_call and forwards the tool call to the packaged CC Safety Net
 adapter (cc-safety-net hook --hermes-agent) over JSON stdin. The adapter prints nothing
@@ -175,84 +175,84 @@ def _pre_tool_call(tool_name="", args=None, session_id="", task_id="", **_):
 
 def register(ctx):
     ctx.register_hook("pre_tool_call", _pre_tool_call)
-`}function Jn(n){return[{name:"__init__.py",content:bL(n)},{name:"plugin.yaml",content:uL(n)}]}import{mkdirSync as oL,readdirSync as fL,readFileSync as yL,rmSync as S1}from"node:fs";import{join as J2}from"node:path";var hL="__pycache__";function H1(n){let t=process.env.HERMES_HOME?.trim();return t?t:J2(n,".hermes")}function W1(n){return J2(H1(n),"plugins",U)}function K1(n){return n.startsWith(i0)}function R1(n,t){let r=W1(n),e=F(r);if(e&&(e.isSymbolicLink()||!e.isDirectory()))throw Error(`Refusing to ${t} ${r}: not a regular directory. Move or remove it and rerun ${t==="install"?"install":"uninstall"} --hermes-agent.`);return r}function v0(n,t){let r=F(n);if(!r)return;if(r.isSymbolicLink()||!r.isFile())throw Error(`Refusing to ${t} ${n}: not a regular file. Move or remove it.`);let e=yL(n,"utf-8");if(!K1(e))throw Error(`Refusing to ${t} unmanaged file at ${n}. Move or remove it.`);return e}function u0(n){let t=R1(n,"install"),r=Jn(B());if(r.map((a)=>v0(J2(t,a.name),"overwrite")).every((a,l)=>a===r[l]?.content))return{path:t,alreadyInstalled:!0};return oL(t,{recursive:!0}),r.forEach((a)=>{Q(J2(t,a.name),a.content)}),{path:t,alreadyInstalled:!1}}function V1(n){let t=R1(n,"remove");if(!F(t))return[];return Jn(B()).filter((r)=>v0(J2(t,r.name),"remove")!==void 0)}function b0(n){let t=R1(n,"remove");if(!F(t))return{path:t,alreadyInstalled:!1};let r=V1(n);if(r.forEach((e)=>{S1(J2(t,e.name))}),S1(J2(t,hL),{recursive:!0,force:!0}),fL(t).length===0)S1(t,{recursive:!0});return{path:t,alreadyInstalled:r.length>0}}var ct="hermes-agent",o0=/^([^\s#][^:]*):/,wL=/^\s+([A-Za-z_][\w-]*):/,f0=/^\s+-\s*(.*)$/;function xL(n){return n.trim().replace(/^(["'])(.*)\1$/,"$2")}function $L(n){let t=n.split(/\r?\n/),r=t.findIndex((l)=>o0.exec(l)?.[1]?.trim()==="plugins");if(r===-1)return[];let e=t.slice(r+1),a=e.findIndex((l)=>o0.test(l));return a===-1?e:e.slice(0,a)}function y0(n,t){let r=$L(n),e=r.findIndex((s)=>wL.exec(s)?.[1]===t);if(e===-1)return[];let a=r.slice(e+1),l=a.findIndex((s)=>!f0.test(s));return(l===-1?a:a.slice(0,l)).map((s)=>xL(f0.exec(s)?.[1]??""))}function DL(n){try{return h0(w0(H1(n),"config.yaml"),"utf-8")}catch{return}}function A1(n){let t=DL(n)??"";return y0(t,"enabled").includes(U)&&!y0(t,"disabled").includes(U)}function x0(n){return/^# version:\s*(.+)$/m.exec(n)?.[1]?.trim()}function mL(n,t){let r=F(n);if(!r)return{error:`${t.name} is missing from ${n}; run install --hermes-agent`};if(r.isSymbolicLink()||!r.isFile())return{error:`${n} is a symlink or not a regular file; move or remove it`};try{let e=h0(n,"utf-8");if(!K1(e))return{error:`Unmanaged ${t.name} occupies ${n}; move or remove it`};if(x0(e)===B()&&e!==t.content)return{error:`Modified ${t.name} occupies ${n}; run install --hermes-agent to restore it`};return{content:e}}catch(e){return{error:`Failed to read ${n}: ${e instanceof Error?e.message:String(e)}`}}}function $0(n){let t=W1(n.homeDir),r=tt(ct,t);if(r)return r;let e=Jn(B()).map((d)=>mL(w0(t,d.name),d)),a=e.flatMap((d)=>("error"in d)?[d.error]:[]);if(a.length>0)return{platform:ct,status:"n/a",configPath:t,errors:a};let l=e.some((d)=>("content"in d)&&x0(d.content)!==B()),s=l?["Installed Hermes Agent plugin is outdated; run install --hermes-agent to update"]:[];if(!A1(n.homeDir))return{platform:ct,status:"disabled",method:"plugin directory",configPath:t,errors:[`${U} is not enabled in Hermes; run \`hermes plugins enable ${U}\``,...s]};return{platform:ct,status:"configured",method:"plugin directory",configPath:t,errors:l?s:void 0}}import{existsSync as gL,readFileSync as kL}from"node:fs";import{join as D0}from"node:path";var qL=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*--kimi-code(\s|["']|$)/;function jL(n){return D0(process.env.KIMI_CODE_HOME||D0(n,".kimi-code"),"config.toml")}function Zn(n){let t=jL(n.homeDir);if(!gL(t))return{platform:"kimi-code",status:"n/a",configPath:t};try{if(!qL.test(kL(t,"utf-8")))return{platform:"kimi-code",status:"n/a",configPath:t}}catch(r){return{platform:"kimi-code",status:"n/a",configPath:t,errors:[`Failed to read ${t}: ${r instanceof Error?r.message:String(r)}`]}}return{platform:"kimi-code",status:"configured",method:"hook config",configPath:t}}import{readFileSync as Z0}from"node:fs";import{join as Xn}from"node:path";var z="cc-safety-net",C="index.js",tn="openclaw.plugin.json",rn="package.json";var Lt="// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw";import{existsSync as BL,lstatSync as JL,readdirSync as ZL,readFileSync as QL}from"node:fs";import{dirname as k0,join as w2}from"node:path";import{fileURLToPath as XL}from"node:url";import{spawn as zL}from"node:child_process";function FL(n){return n.join(" ")}function M1(n,t,r){return[`Failed to run ${FL(n)}${t===null?"":` (exit ${t})`}.`,r.trim()].filter(Boolean).join(`
-`)}function G1(n){let t={stdout:"",stderr:""};return n.stdout.setEncoding("utf-8"),n.stderr.setEncoding("utf-8"),n.stdout.on("data",(r)=>{t.stdout+=r}),n.stderr.on("data",(r)=>{t.stderr+=r}),t}function l2(n,t){return new Promise((r,e)=>{let a=h2([...n],process.env),l=zL(a.cmd,a.args,{stdio:["ignore","pipe","pipe"]}),s=G1(l),d=()=>[s.stdout,s.stderr].filter(Boolean).join(`
-`),c=t?.timeoutMs??120000,L=setTimeout(()=>{l.kill(),e(Error(M1(n,null,`Timed out after ${c}ms.
-${d()}`.trim())))},c);l.on("error",(i)=>{clearTimeout(L),e(Error(M1(n,null,`${i.message}
-${d()}`.trim())))}),l.on("close",(i)=>{if(clearTimeout(L),i!==0){e(Error(M1(n,i,d())));return}r(t?.stdoutOnly?s.stdout:d())})})}async function U1(n){for(let t of n)await l2(t)}async function m0(n){for(let t of n)try{await l2(t)}catch(r){console.warn(r instanceof Error?r.message:String(r))}}var g0=w2("openclaw",z),YL=[C,tn,rn];function C1(n,t){if(n==="~")return t;if(n.startsWith("~/")||n.startsWith("~\\"))return w2(t,n.slice(2));return n}function q0(n){let t=process.env.OPENCLAW_STATE_DIR?.trim();if(t)return C1(t,n);let r=process.env.OPENCLAW_CONFIG_PATH?.trim();return r?k0(C1(r,n)):w2(n,".openclaw")}function j0(n){let t=process.env.OPENCLAW_CONFIG_PATH?.trim();return t?C1(t,n):w2(q0(n),"openclaw.json")}function O1(n){return w2(q0(n),"extensions",z)}function SL(n){let t=ZL(n);if(t.length===0)return!0;if(t.some((a)=>!YL.includes(a)))return!1;let r=w2(n,C),e=F(r);return e!==void 0&&!e.isSymbolicLink()&&e.isFile()&&QL(r,"utf-8").startsWith(Lt)}function T1(n){let t=O1(n),r=F(t);if(!r)return;if(!r.isSymbolicLink()&&r.isDirectory()&&SL(t))return;throw Error(`Refusing to modify ${t}: it does not hold a cc-safety-net managed OpenClaw plugin. Move or remove it, then run the command again.`)}function z0(){let n=k0(XL(import.meta.url));return[w2(n,"..",g0),w2(n,"..","..","..","dist",g0)]}function _1(n=z0()){return n.find((t)=>BL(t)&&JL(t).isDirectory())}function HL(n=z0()){let t=_1(n);if(!t)throw Error("Packaged OpenClaw plugin directory not found. Reinstall cc-safety-net and try again.");return t}function F0(n=HL()){return[["openclaw","plugins","install",n,"--force"],["openclaw","plugins","enable",z]]}function WL(n){let t=(()=>{try{return JSON.parse(n)}catch{return}})(),r=x(x(t,"plugin"),"status");return typeof r==="string"?r:void 0}async function B0(){let n=WL(await l2(["openclaw","plugins","inspect",z,"--runtime","--json"],{stdoutOnly:!0}));if(n==="loaded")return;throw Error(`${n===void 0?`The ${z} plugin's load state could not be verified: OpenClaw's runtime inspect report was unreadable.`:`OpenClaw reports the ${z} plugin with status "${n}".`} Run \`openclaw plugins inspect ${z} --runtime\` for details.`)}var it="openclaw",Qn=`run \`openclaw plugins enable ${z}\``;function en(n,t){let r=Xn(n,t),e=F(r);if(!e)return{error:`${t} is missing from ${r}; run install --openclaw`};if(e.isSymbolicLink()||!e.isFile())return{error:`${r} is a symlink or not a regular file; move or remove it`};try{return{content:Z0(r,"utf-8")}}catch(a){return{error:`Failed to read ${r}: ${a instanceof Error?a.message:String(a)}`}}}function Q0(n){try{return JSON.parse(M(n))}catch{return}}function KL(n){let t=en(n,tn);if("error"in t)return t.error;if(x(Q0(t.content),"id")===z)return;return`${Xn(n,tn)} is not a valid ${z} manifest; run install --openclaw`}function RL(n){let t=en(n,rn);if("error"in t)return t.error;let r=x(x(Q0(t.content),"openclaw"),"extensions");if(Array.isArray(r)&&r.includes(`./${C}`))return;return`${Xn(n,rn)} does not point OpenClaw at ${C}; run install --openclaw`}function J0(n){return Array.isArray(n)?n.filter((t)=>typeof t==="string"):[]}function VL(n){let t=j0(n);if(!F(t))return`${z} is not enabled; ${Qn}`;let r=(()=>{try{return JSON.parse(M(Z0(t,"utf-8")))}catch{return}})();if(r===void 0)return`Failed to read ${t}; fix it, then ${Qn}`;let e=x(r,"plugins");if(x(e,"enabled")===!1)return`plugins.enabled is false in ${t}; no OpenClaw plugin loads`;let a=x(x(x(e,"entries"),z),"enabled");if(J0(x(e,"deny")).includes(z)||a===!1)return`${z} is disabled in ${t}; ${Qn}`;let l=J0(x(e,"allow"));if(l.length>0&&!l.includes(z))return`plugins.allow in ${t} does not list ${z}; add it, then ${Qn}`;if(l.includes(z)||a===!0)return;return`${z} is not enabled; ${Qn}`}function X0(n){return/^\/\/ version:\s*(.+)$/m.exec(n)?.[1]?.trim()}function AL(n,t,r){if(r===void 0)return[];let e=en(r,C);if("error"in e||X0(e.content)!==t)return[];return[C,tn,rn].flatMap((a)=>{let l=en(n,a),s=en(r,a);if("error"in l||"error"in s||l.content===s.content)return[];return[`Modified ${a} occupies ${Xn(n,a)}; run install --openclaw to restore it`]})}function Y0(n){let t=O1(n.homeDir),r=tt(it,t);if(r)return r;let e=en(t,C),l=["error"in e?e.error:e.content.startsWith(Lt)?void 0:`Unmanaged ${C} occupies ${Xn(t,C)}; move or remove it`,KL(t),RL(t)].filter((i)=>i!==void 0),s="content"in e?X0(e.content):void 0,d=l.length>0?l:AL(t,s,_1());if(d.length>0)return{platform:it,status:"n/a",configPath:t,errors:d};let c=s===B()?[]:["Installed OpenClaw plugin is outdated; run install --openclaw to update"],L=VL(n.homeDir);if(L)return{platform:it,status:"disabled",method:"plugin directory",configPath:t,errors:[L,...c]};return{platform:it,status:"configured",method:"plugin directory",configPath:t,errors:c.length>0?c:void 0}}import{existsSync as NL,readFileSync as ni}from"node:fs";import{join as ti}from"node:path";import{existsSync as E1,readFileSync as R0,rmSync as GL}from"node:fs";import{join as u2}from"node:path";import{pathToFileURL as UL}from"node:url";function S0(n){return n!==void 0&&/\s/.test(n)}function ML(n,t,r){let e=t+1,a=!1;while(e<n.length){let l=n[e];if(a){a=!1,e++;continue}if(l==="\\"){a=!0,e++;continue}if(l==='"')return e+1;e++}throw Error(r)}function pt(n,t,r){let e=n[t],a=e==="["?"]":"}",l=0,s=t;while(s<n.length){let d=r.skipComment?.(n,s)??s;if(d!==s){s=d;continue}if(n[s]==='"'){s=ML(n,s,r.stringError);continue}if(n[s]===e)l++;if(n[s]===a){if(l--,l===0)return s}s++}throw Error(r.bracketError)}function H0(n,t){let r=n.lastIndexOf(`
-`,t)+1;return/^[ \t]*/.exec(n.slice(r))?.[0]??""}function vt(n,t){let{start:r,end:e,end:a}=t;while(S0(n[a]))a++;if(n[a]===","){if(e=a+1,n[e]===`
-`)e++;return`${n.slice(0,r)}${n.slice(e)}`}a=t.start-1;while(S0(n[a]))a--;if(n[a]===","){r=a;let l=n.lastIndexOf(`
-`,r-1);if(l!==-1&&/^\s*$/.test(n.slice(l+1,r)))r=l}return`${n.slice(0,r)}${n.slice(e)}`}var ut="cc-safety-net",V0=`${ut}@latest`,A0=["opencode.json","opencode.jsonc"],W0="CCSafetyNetPlugin";function bt(n){return u2(process.env.XDG_CONFIG_HOME||u2(n,".config"),"opencode")}function CL(n){return u2(bt(n),A0[0])}function OL(n){return A0.map((t)=>u2(bt(n),t))}function M0(n){return u2(process.env.XDG_CACHE_HOME||u2(n,".cache"),"opencode","packages",V0)}function P1(n){GL(M0(n),{recursive:!0,force:!0})}async function G0(n){let t=u2(M0(n),"node_modules",ut),r=u2(t,"package.json");if(!E1(r))throw Error(`The OpenCode plugin cache at ${t} is missing its package, so OpenCode would load nothing and fail open. Run \`opencode plugin -g -f ${V0}\` for details.`);let e=x(JSON.parse(R0(r,"utf-8")),"main");if(typeof e!=="string")throw Error(`The cached OpenCode plugin at ${t} declares no "main" entry.`);let a=u2(t,e);if(typeof(await import(UL(a).href))[W0]==="function")return;throw Error(`The cached OpenCode plugin at ${a} does not export a callable ${W0}, so OpenCode would load nothing and fail open.`)}function ot(n,t){if(n[t]==="/"&&n[t+1]==="/"){let r=n.indexOf(`
-`,t+2);return r===-1?n.length:r+1}if(n[t]==="/"&&n[t+1]==="*"){let r=n.indexOf("*/",t+2);return r===-1?n.length:r+2}return t}function K0(n,t){let r=t;while(r<n.length){if(/\s/.test(n[r]??"")){r++;continue}let e=ot(n,r);if(e===r)return r;r=e}return r}function U0(n,t){let r=t+1,e=!1;while(r<n.length){if(e){e=!1,r++;continue}if(n[r]==="\\"){e=!0,r++;continue}if(n[r]==='"')return r+1;r++}throw Error("Unterminated string in OpenCode config")}function C0(n,t,r){return JSON.parse(n.slice(t,r))}function TL(n,t){return pt(n,t,{skipComment:ot,stringError:"Unterminated string in OpenCode config",bracketError:"Unmatched plugin array in OpenCode config"})}function _L(n){let t=0,r=0;while(r<n.length){let e=ot(n,r);if(e!==r){r=e;continue}if(n[r]==='"'){let a=U0(n,r);if(t===1&&C0(n,r,a)==="plugin"){let l=K0(n,a),s=K0(n,l+1);if(n[l]===":"&&n[s]==="[")return{start:s,end:TL(n,s)}}r=a;continue}if(n[r]==="{"||n[r]==="[")t++;if(n[r]==="}"||n[r]==="]")t--;r++}return}function EL(n,t){let r=[],e=t.start+1;while(e<t.end){let a=ot(n,e);if(a!==e){e=a;continue}if(n[e]==='"'){let l=U0(n,e),s=C0(n,e,l);if(typeof s==="string"&&s.includes(ut))r.push({start:e,end:l});e=l;continue}e++}return r}function O0(n,t){try{return JSON.parse(M(n))}catch(r){if(r instanceof SyntaxError)throw Error(`Failed to parse OpenCode config ${t}: ${r.message}`);throw r}}function PL(n){if(!n||typeof n!=="object"||Array.isArray(n))return!1;let t=n.plugin;if(!Array.isArray(t))return!1;return t.some((r)=>typeof r==="string"&&r.includes(ut))}function IL(n,t){let r=_L(n);if(!r)throw Error(`Failed to locate OpenCode plugin array in ${t}`);let e=[...EL(n,r)].reverse().reduce(vt,n);return O0(e,t),e}function T0(n){P1(n);let t=OL(n),r=t.find((a)=>E1(a)),e=[];for(let a of t){if(!E1(a))continue;try{let l=R0(a,"utf-8");if(!PL(O0(l,a)))continue;return Q(a,IL(l,a)),{path:a,alreadyInstalled:!0}}catch(l){e.push(l instanceof Error?l.message:String(l))}}if(e.length>0)throw Error(e.join(`
-`));return{path:r??CL(n),alreadyInstalled:!1}}function _0(n){let t=[],r=bt(n.homeDir),e=["opencode.json","opencode.jsonc"];for(let a of e){let l=ti(r,a);if(NL(l))try{let s=ni(l,"utf-8"),d=M(s);if((JSON.parse(d).plugin??[]).some((v)=>v.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:l,errors:t.length>0?t:void 0}}catch(s){t.push(`Failed to parse ${a}: ${s instanceof Error?s.message:String(s)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as ri}from"node:path";function I1(n){return ri(n,".pi","agent","settings.json")}function N1(n){if(typeof n!=="string")return!1;return n==="npm:cc-safety-net"||n.startsWith("npm:cc-safety-net@")}function E0(n){let t=I1(n.homeDir),r=e2(t);if(r.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(r.kind==="missing")return{platform:"pi",status:"n/a"};let e=x(r.value,"packages");if(!Array.isArray(e))return{platform:"pi",status:"n/a"};let a=e.find((d)=>N1(typeof d==="string"?d:x(d,"source")));if(a===void 0)return{platform:"pi",status:"n/a"};let l=x(a,"extensions");if(Array.isArray(l)&&l.some((d)=>typeof d==="string"&&d.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var ai={amp:Ha,"antigravity-cli":Wa,"claude-code":Aa,codex:Ma,"copilot-cli":n0,cursor:c0,"gemini-cli":L0,"hermes-agent":$0,"kimi-code":Zn,openclaw:Y0,opencode:_0,pi:E0};function an(n,t){let r={...t,cwd:n,homeDir:t?.homeDir??ei()};return On.map((e)=>li(ai[e](r)))}function li(n){if(n.status==="not-inspected")return{platform:n.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:n.platform,detected:n.status!=="n/a",configured:n.status==="configured",inspectionStatus:n.status!=="n/a"?"verified":n.errors&&n.errors.length>0?"failed":"not-applicable",method:n.method,configPath:n.configPath,configPaths:n.configPaths,errors:n.errors}}import{tmpdir as si}from"node:os";import{join as di}from"node:path";var ci=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),Li=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),ii={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function P0(){let n=di(si(),"cc-safety-net-self-test"),t=ci.map((r)=>{let e=Un(C2("self-test",{command:r.command},{kind:"command",shell:"auto"},{configCwd:n,executionCwd:n},r.command),{guard:{dependencies:{loadPolicySnapshot:()=>Li,getModes:()=>ii,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),a=r.expectBlocked?"blocked":"allowed",l=e.decision.kind==="deny"?"blocked":"allowed";return{command:r.command,description:r.description,expected:a,actual:l,passed:a===l,reason:e.decision.kind==="deny"?e.decision.reason:void 0,ruleId:e.decision.kind==="deny"?e.decision.ruleId:void 0}});return{passed:t.filter((r)=>r.passed).length,failed:t.filter((r)=>!r.passed).length,total:t.length,results:t}}function nr(n){let t=J({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},n);if(s2(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function I0(n={}){let t=await jn(!n.json,()=>{let r=pi(n);return{ready:r,finish:()=>r}},()=>qn(),{loadingMessage:"Checking system status…"});if(n.json)console.log(JSON.stringify(t,null,2));else ui(t);return vi(t.hooks,t.engineSelfTest,{userConfig:t.userConfig,projectConfig:t.projectConfig})?1:0}async function pi(n){let t=n.cwd??process.cwd(),r=await gn(),e=an(t,{ampPluginListOutput:r.ampPluginListOutput,codexPluginListOutput:r.codexPluginListOutput,copilotCliVersion:r.versions["copilot-cli"]}),a=da(t),l=ca(),s=A({cwd:t}),d=s.policy,c=L2(d),L=q2(d,c.capabilities),i=_n(7),v=n.skipUpdateCheck?{currentVersion:B(),latestVersion:null,updateAvailable:!1}:await I2(),b={hooks:e,engineSelfTest:P0(),userConfig:a.userConfig,projectConfig:a.projectConfig,configState:xn(s),effectiveRules:a.effectiveRules,shadowedRules:a.shadowedRules,environment:l,effectiveSafety:{selectedPreset:d.safety.level??"standard",level:c.effectiveLevel,capabilities:c.capabilities,ruleOverrides:d.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(L).filter(([,p])=>p.source==="rule_override"&&p.override==="off"&&p.inheritedEnabled&&p.changesInherited).map(([p])=>p),ruleCounts:{stored:Object.keys(d.destructiveCommandRuleOverrides).length,effective:Object.values(L).filter((p)=>p.changesInherited).length}},posture:Da(a.userConfig.path),activity:i,update:v,system:r};return{...b,findings:ia(b)}}function vi(n,t,r){return n.length>0&&n.every((e)=>!e.configured)||n.some((e)=>e.inspectionStatus==="failed")||t.failed>0||r.userConfig.exists&&!r.userConfig.valid||r.projectConfig.exists&&!r.projectConfig.valid}function ui(n){console.log(),console.log(va(n.hooks)),console.log(),console.log(ua(n.engineSelfTest)),console.log(),console.log(ba(n)),console.log(),console.log(oa(n.environment)),console.log(),console.log(fa(n)),console.log(),console.log(ya(n.findings)),console.log(),console.log(ha(n.activity)),console.log(),console.log(xa(n.system)),console.log(),console.log(wa(n.update)),console.log($a(n))}import{existsSync as bi}from"node:fs";var oi=/^[A-Za-z0-9_@%+=:,./-]+$/,N0="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function tr(n){let t=J({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},n);if(s2(t.errors))return console.error(N0),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!bi(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let r=t.positionals.length===1?t.positionals[0]:t.positionals.map((e)=>oi.test(e)?e:`'${e.replaceAll("'","'\\''")}'`).join(" ");if(!r)return console.error("Error: No command provided"),console.error(N0),null;return{json:t.flags.json,cwd:t.values.cwd,command:r}}function n3(n){if(n)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function t3(n,t){let e=t-18;return[`${n.dtl}${n.dh.repeat(t)}${n.dtr}`,`${n.dv}  Command Analysis${" ".repeat(e)}${n.dv}`,`${n.dbl}${n.dh.repeat(t)}${n.dbr}`]}function rr(n){return JSON.stringify(n)}function r3(n,t=0){return`[${n.map((e,a)=>pa(e,a,t)).join(",")}]`}function ft(n,t,r=70){let e=n.split(" "),a=[],l="";for(let s of e)if(l&&l.length+s.length+1>r)a.push(l),l=s;else l=l?`${l} ${s}`:s;if(l)a.push(l);return a.map((s,d)=>d===0?s:`${t}${s}`)}function e3(n,t,r){let e=[];switch(n.type){case"parse":return null;case"env-strip":return e.push(""),e.push(`STEP ${t} ${r.h} Strip environment variables`),e.push(`  Removed: ${n.envVars.map((a)=>`${a}=<redacted>`).join(", ")}`),e.push(`  Tokens:  ${rr(n.output)}`),{lines:e,incrementStep:!0};case"leading-tokens-stripped":return e.push(""),e.push(`STEP ${t} ${r.h} Strip wrappers`),e.push(`  Removed: ${n.removed.join(", ")}`),e.push(`  Tokens:  ${rr(n.output)}`),{lines:e,incrementStep:!0};case"shell-wrapper":return e.push(""),e.push(`STEP ${t} ${r.h} Detect shell wrapper`),e.push(`  Wrapper: ${n.wrapper} -c`),e.push(`  Inner:   ${n.innerCommand}`),{lines:e,incrementStep:!0};case"interpreter":{if(e.push(""),e.push(`STEP ${t} ${r.h} Detect interpreter`),e.push(`  Interpreter: ${n.interpreter}`),e.push(`  Code:        ${n.codeArg}`),n.paranoidBlocked)e.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:e,incrementStep:!0}}case"busybox":return e.push(""),e.push(`STEP ${t} ${r.h} Busybox wrapper`),e.push(`  Subcommand: ${n.subcommand}`),{lines:e,incrementStep:!0};case"transparent-wrapper":return e.push(""),e.push(`STEP ${t} ${r.h} Transparent wrapper`),e.push(`  Wrapper: ${n.wrapper}`),e.push(`  Tokens:  ${rr(n.output)}`),{lines:e,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(e.push(""),e.push(`STEP ${t} ${r.h} Match rules`),e.push(`  Rule:   ${n.rule}()`),n.matched)e.push("  Result: MATCHED");else e.push("  Result: No match");return{lines:e,incrementStep:!0}}case"worktree-relaxation":return e.push(""),e.push(`STEP ${t} ${r.h} Worktree relaxation`),e.push(`  Mode:   ${k.worktree.name}`),e.push(`  Git cwd: ${n.gitCwd}`),e.push("  Result: Allowed local discard in linked worktree"),{lines:e,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(n.embeddedCommandFound)return e.push(""),e.push(`STEP ${t} ${r.h} Fallback scan`),e.push(`  Found: ${n.embeddedCommandFound}`),{lines:e,incrementStep:!0};return null}case"custom-rules-check":{if(n.rulesChecked){if(e.push(""),e.push(`STEP ${t} ${r.h} Custom rules`),n.matched)e.push("  Result: MATCHED");else e.push("  Result: No match");return{lines:e,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(n.matched)return e.push(""),e.push(`STEP ${t} ${r.h} Dangerous text check`),e.push(`  Token:  ${n.token}`),e.push("  Result: MATCHED"),{lines:e,incrementStep:!0};return null}case"strict-unparseable":return e.push(""),e.push(`STEP ${t} ${r.h} Strict mode check`),e.push(`  Command: ${n.rawCommand}`),e.push("  Result:  ✗ UNPARSEABLE"),{lines:e,incrementStep:!0};case"segment-skipped":return null;case"error":return e.push(""),e.push(`ERROR: ${n.message}`),{lines:e,incrementStep:!1};default:return null}}function er(n,t){let r=n3(t?.asciiOnly??!1),e=58,a=[],l=1;a.push(...t3(r,58)),a.push("");let s=n.trace.steps.find((p)=>p.type==="error");if(s&&s.type==="error"){a.push("ERROR"),a.push(`  ${s.message}`),a.push(""),a.push("RESULT"),a.push(`  Status: ${n.result==="blocked"?o.red("BLOCKED"):o.green("ALLOWED")}`),a.push(""),a.push("CONFIG");let p=n.configSource??"none";return a.push(`  Path: ${p}`),a.join(`
-`)}let d=n.trace.steps.find((p)=>p.type==="parse");if(d&&d.type==="parse"){a.push("INPUT"),a.push(`  ${d.input}`),a.push(""),a.push(`STEP ${l} ${r.h} Split shell commands`),l++;for(let p=0;p<d.segments.length;p++){let f=d.segments[p];if(f){let u=Math.random();a.push(`  Segment ${p+1}: ${r3(f,u)}`)}}}let c=n.trace.segments,L=c.length>1;for(let p of c){if(L){a.push("");let w="";if(d&&d.type==="parse"){let St=d.segments[p.index];if(St)w=St.join(" ")}let $=54,y=w,m=` Segment ${p.index+1}: `,H=" ";if(w){if(m.length+w.length+H.length>$){let Cl=$-m.length-H.length;y=`${w.substring(0,Cl-1)}…`}}let o2=w?`${m}${y}${H}`:` Segment ${p.index+1} `,Yt=w?`${m}${o.cyan(y)}${H}`:o2,zr=58-o2.length,Fr=Math.floor(zr/2),Ul=zr-Fr;a.push(`${r.sh.repeat(Fr)}${Yt}${r.sh.repeat(Ul)}`)}if(p.steps.find((w)=>w.type==="segment-skipped")){a.push(""),a.push("  (skipped — prior segment blocked)");continue}let u=!1,h=!1;for(let w of p.steps){let $=e3(w,l,r);if($){if(h=!0,w.type==="recurse"){a.push("");let y=" RECURSING ",m=58-y.length-4;a.push(`  ${r.tl}${r.h}${y}${r.h.repeat(m)}`),a.push(`  ${r.v}`),u=!0;continue}for(let y of $.lines)if(u)a.push(`  ${r.v} ${y}`);else a.push(y);if($.incrementStep)l++}}if(u)a.push(`  ${r.v}`),a.push(`  ${r.bl}${r.h.repeat(56)}`),u=!1;if(!h)a.push(""),a.push(`  ${o.green("✓")} Allowed (no matching rules)`)}if(a.push(""),a.push("RESULT"),n.result==="blocked"){if(a.push(`  Status: ${o.red("BLOCKED")}`),n.customRule){if(a.push(`  Rule: ${n.customRule.id}`),n.customRule.rulebook)a.push(`  Rulebook: ${n.customRule.rulebook.name} ${n.customRule.rulebook.version}`);if(n.customRule.source)a.push(`  Source: ${n.customRule.source}`);if(n.customRule.override)a.push(`  Override: reason ${n.customRule.override.reason}`)}if(n.reason){let p=ft(n.reason,"          ");a.push(`  Reason: ${p[0]}`);for(let f=1;f<p.length;f++)a.push(p[f]??"")}}else a.push(`  Status: ${o.green("ALLOWED")}`);a.push(""),a.push("CONFIG");let i=n.configSource??"none",v=n.configValid?"":" (invalid)";a.push(`  Path: ${i}${v}`),a.push(`  Safety preset: ${n.selectedPreset??"standard"}`),a.push(`  Effective capabilities: ${n.effectiveLevel}`);let b=Object.entries(n.destructiveCommandRuleOverrides??{});if(a.push(`  Rule customizations: ${b.length}`),n.ruleActivation)a.push(`  Rule activation: ${n.ruleActivation.id} — ${n.ruleActivation.enabled?"on":"off"} via ${n.ruleActivation.source}`);return a.join(`
-`)}function ar(n){return JSON.stringify(n,null,2)}function a3(n){return new Promise((t)=>{process.stdout.write(`${n}
-`,()=>t())})}async function l3(n){let t=tr(n);if(!t)return 1;try{let r=O2(t.command,{cwd:t.cwd}),e=!!process.env.NO_COLOR||!process.stdout.isTTY;return await a3(t.json?ar(r):er(r,{asciiOnly:e})),0}catch(r){if(!(r instanceof s1)&&!(r instanceof k2)&&!(r instanceof p2))throw r;if(t.json)return await a3(JSON.stringify({error:r.message})),1;return console.error(r.message),1}}var s3="2.0.8",O="  ",Z2="cc-safety-net";function d3(n){return n.argument?`${n.flags} ${n.argument}`:n.flags}function fi(n){return Math.max(...n.map((t)=>d3(t).length))}function yi(n){return Math.max(...n.map((t)=>t.usage.length))}function hi(n){return Math.max(...n.map((t)=>`${Z2} ${t.usage}`.length))}function wi(n,t){let r=`${Z2} ${n.usage}`;return`${O}${r.padEnd(t+2)}${n.description}`}function b2(n,t){return`${O}${n.padEnd(Math.max(40,n.length+2))}${t}`}function yt(n,t=console.log){let r=[];if(r.push(`${Z2} ${n.name}`),r.push(""),r.push(`${O}${n.description}`),r.push(""),r.push("USAGE:"),r.push(`${O}${Z2} ${n.usage}`),r.push(""),n.subcommands&&n.subcommands.length>0){r.push("SUBCOMMANDS:");let e=yi(n.subcommands);for(let a of n.subcommands)r.push(`${O}${a.usage.padEnd(e+2)}${a.description}`);r.push("")}if(n.options.length>0){r.push("OPTIONS:");let e=fi(n.options);for(let a of n.options){let l=d3(a),s=a.default?`${a.description} (default: ${a.default})`:a.description;r.push(`${O}${l.padEnd(e+2)}${s}`)}r.push("")}if(n.examples&&n.examples.length>0){r.push("EXAMPLES:");for(let e of n.examples)r.push(`${O}${e}`)}t(r.join(`
-`))}function lr(){let n=la(),t=hi(n),r=[];r.push(`${Z2} v${s3}`),r.push(""),r.push("Blocks destructive commands and secret access."),r.push(""),r.push("COMMANDS:");for(let e of n)r.push(wi(e,t));r.push(""),r.push("GLOBAL OPTIONS:"),r.push(`${O}-h, --help       Show help (use with command for command-specific help)`),r.push(`${O}-V, --version    Show version`),r.push(""),r.push("HELP:"),r.push(`${O}${Z2} help <command>     Show help for a specific command`),r.push(`${O}${Z2} <command> --help   Show help for a specific command`),r.push(""),r.push("ENVIRONMENT VARIABLES:"),r.push(b2(`${k.level.name}=standard|strict|paranoid`,"Set session safety level")),r.push(b2(`${k.worktree.name}=1`,"Allow local git discards in linked worktrees")),r.push(b2(`${k.debug.name}=1`,"Print diagnostic messages to stderr")),r.push(b2(`${k.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),r.push(b2("CC_SAFETY_NET_HOME","Override rule config home directory")),r.push(""),r.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),r.push(b2(`${k.strict.name}=1`,"Force safety.overrides.fail_closed on")),r.push(b2(`${k.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),r.push(b2(`${k.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),r.push(b2(`${k.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),r.push(""),r.push("Documentation:        https://ccsafetynet.com/docs"),console.log(r.join(`
-`))}function c3(){console.log(s3)}function Yn(n,t=console.log){let r=Tn(n);if(!r)return!1;if(r.hidden||r.name.toLowerCase()!==n.toLowerCase())return!1;return yt(r,t),!0}import{existsSync as hr,readFileSync as nl}from"node:fs";import{homedir as b5}from"node:os";import{join as fr}from"node:path";import*as x2 from"node:readline";function xi(n){return n==="install"?"Install":"Uninstall"}function $i(n){return n==="install"?"Installing":"Uninstalling"}function Di(n){return n==="install"?"into":"from"}function p3(n){return n?.available===!0}function mi(n,t){let r=new Set(t);return n.filter((e)=>r.has(e.target)).map((e)=>e.target)}function L3(n,t,r){if(n.length===0||n.every((e)=>!e.available))return t;return Array.from({length:n.length},(e,a)=>a+1).map((e)=>(t+e*r+n.length)%n.length).find((e)=>p3(n[e]))}function gi(n,t,r){if(r.ctrl&&r.name==="c")return"interrupt";if(r.name==="escape"||t==="q")return"abort";if(n==="install"&&(t==="u"||t==="U"))return"update";if(r.name==="up"||t==="k")return"up";if(r.name==="down"||t==="j")return"down";if(r.name==="space"||t===" ")return"toggle";if(r.name==="return"||r.name==="enter")return"confirm";return null}function ki(n){return{cursor:n.findIndex((t)=>t.available),selected:[]}}function qi(n,t,r){if(r==="confirm"||r==="update"||r==="abort"||r==="interrupt")return{state:n,done:r};if(r==="up")return{state:{...n,cursor:L3(t,n.cursor,-1)}};if(r==="down")return{state:{...n,cursor:L3(t,n.cursor,1)}};let e=t[n.cursor];if(!p3(e))return{state:n};let a=n.selected.includes(e.target)?n.selected.filter((l)=>l!==e.target):mi(t,[...n.selected,e.target]);return{state:{...n,selected:a}}}var v3="◉",u3="◯",b3=">",o3=" ";function ji(n,t,r,e={}){let a=e.color!==!1,l=a?o.dim:(c)=>c,s=a?o.green:(c)=>c,d=a?o.bold:(c)=>c;return["",`${xi(n)} CC Safety Net ${Di(n)}:`,"",...t.map((c,L)=>{let i=r.selected.includes(c.target),v=L===r.cursor,b=i?v3:u3,p=v?b3:o3,f=c.available?"":` (${c.unavailableReason??"not installed"})`,u=`${b} ${c.label}${f}`,h=!c.available?l(u):i?s(u):v?d(u):u;return`${p} ${h}`}),"",n==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":t.some((c)=>c.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${n}. q/Esc: close`].join(`
-`)}var i3=["global-hook","plugin"];function zi(n,t,r={}){let e=r.color!==!1?o.bold:(l)=>l;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((l,s)=>{let d=s===n,c=`${d?v3:u3} ${l}`;return`${d?b3:o3} ${d?e(c):c}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`
-`)}function f3(n){let{input:t,output:r}=n;x2.emitKeypressEvents(t);let e=t.isRaw===!0;t.setRawMode(!0),t.resume();let a=0,l=()=>{if(a===0)return;x2.moveCursor(r,0,-a),x2.cursorTo(r,0),x2.clearScreenDown(r)},s=()=>{l();let d=n.render();r.write(`${d}
-`),a=d.split(`
-`).length};return new Promise((d)=>{let c=(i)=>{t.off("keypress",L),t.setRawMode(e),t.pause(),l(),d(i)};function L(i,v){n.onKey(i,v,{finish:c,draw:s})}t.on("keypress",L),s()})}function y3(n={}){let t=0;return f3({input:n.input??process.stdin,output:n.output??process.stdout,render:()=>zi(t,n.globalHookInstalled===!0),onKey:(r,e,a)=>{if(e.ctrl&&e.name==="c"){a.finish(null),(n.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(e.name==="escape"||r==="q")return a.finish(null);if(e.name==="return"||e.name==="enter")return a.finish(i3[t]);if(e.name==="up"||e.name==="down"||r==="k"||r==="j")t=(t+1)%i3.length,a.draw()}})}function sr(n=process.stdin,t=process.stdout){return Boolean(n.isTTY&&t.isTTY&&typeof n.setRawMode==="function")}function h3(n,t,r={}){let e=r.output??process.stdout,a=ki(t);return f3({input:r.input??process.stdin,output:e,render:()=>ji(n,t,a),onKey:(l,s,d)=>{let c=gi(n,l,s);if(!c)return;let L=qi(a,t,c);if(a=L.state,L.done==="interrupt"){d.finish(null),(r.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(L.done==="abort")return d.finish(null);if(L.done==="update")return d.finish("update");if(L.done==="confirm"){if(a.selected.length===0){e.write("\x07"),d.draw();return}d.finish([...a.selected]),e.write(`${$i(n)} selected integrations...
-`);return}d.draw()}})}import{existsSync as x3,lstatSync as Bi,mkdirSync as Ji,mkdtempSync as Zi,readdirSync as Qi,readFileSync as sn,rmSync as xt}from"node:fs";import{tmpdir as Xi}from"node:os";import{basename as Yi,dirname as Si,join as R}from"node:path";import{fileURLToPath as Hi}from"node:url";var dr="// cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp",Q2="cc-safety-net",X2="cc-safety-net/index.ts";import{spawn as Fi}from"node:child_process";var cr=(n,t)=>{let r=h2([...n],process.env);return new Promise((e)=>{let a=Fi(r.cmd,r.args,{cwd:t,stdio:["ignore","pipe","pipe"]}),l=G1(a),s=!1,d=setTimeout(()=>{s=!0,a.kill()},120000);a.on("error",(c)=>{clearTimeout(d),e({status:null,errorCode:c.code,stdout:l.stdout,stderr:[c.message,l.stderr].filter(Boolean).join(`
-`)})}),a.on("close",(c)=>{clearTimeout(d),e({status:s?null:c,errorCode:s?"ETIMEDOUT":void 0,stdout:l.stdout,stderr:l.stderr})})})};var ln="cc-safety-net.ts",w3=R("amp",X2);function Wi(n){return R(n,".config","amp","plugins","cc-safety-net.ts")}function Ki(){let n=Si(Hi(import.meta.url));return[R(n,"..",w3),R(n,"..","..","..","dist",w3)]}function Ri(n=Ki()){let t=n.find((r)=>x3(r)&&Bi(r).isFile());if(!t)throw Error("Packaged Amp plugin artifact not found. Reinstall cc-safety-net and try again.");return t}function $3(n){try{return JSON.parse(n)}catch{return}}function $t(n){return n.subarray(0,Buffer.byteLength(dr)).toString("utf-8")===dr}async function Sn(n,t,r){let e=await n(t,r);if(e.status===0)return e;throw Error([`Failed to run ${t.join(" ")}${e.status===null?"":` (exit ${e.status})`}.`,[e.stdout,e.stderr].filter(Boolean).join(`
+`}function Tt(e){return[{name:"__init__.py",content:p2(e)},{name:"plugin.yaml",content:u2(e)}]}import{mkdirSync as f2,readdirSync as m2,readFileSync as g2,rmSync as Hr}from"node:fs";import{join as Ie}from"node:path";var h2="__pycache__";function Mr(e){let t=process.env.HERMES_HOME?.trim();return t?t:Ie(e,".hermes")}function jr(e){return Ie(Mr(e),"plugins",z)}function Ur(e){return e.startsWith(da)}function Gr(e,t){let n=jr(e),r=E(n);if(r&&(r.isSymbolicLink()||!r.isDirectory()))throw Error(`Refusing to ${t} ${n}: not a regular directory. Move or remove it and rerun ${t==="install"?"install":"uninstall"} --hermes-agent.`);return n}function pa(e,t){let n=E(e);if(!n)return;if(n.isSymbolicLink()||!n.isFile())throw Error(`Refusing to ${t} ${e}: not a regular file. Move or remove it.`);let r=g2(e,"utf-8");if(!Ur(r))throw Error(`Refusing to ${t} unmanaged file at ${e}. Move or remove it.`);return r}function fa(e){let t=Gr(e,"install"),n=Tt(P());if(n.map((o)=>pa(Ie(t,o.name),"overwrite")).every((o,i)=>o===n[i]?.content))return{path:t,alreadyInstalled:!0};return f2(t,{recursive:!0}),n.forEach((o)=>{_(Ie(t,o.name),o.content)}),{path:t,alreadyInstalled:!1}}function Br(e){let t=Gr(e,"remove");if(!E(t))return[];return Tt(P()).filter((n)=>pa(Ie(t,n.name),"remove")!==void 0)}function ma(e){let t=Gr(e,"remove");if(!E(t))return{path:t,alreadyInstalled:!1};let n=Br(e);if(n.forEach((r)=>{Hr(Ie(t,r.name))}),Hr(Ie(t,h2),{recursive:!0,force:!0}),m2(t).length===0)Hr(t,{recursive:!0});return{path:t,alreadyInstalled:n.length>0}}var dn="hermes-agent",ga=/^([^\s#][^:]*):/,y2=/^\s+([A-Za-z_][\w-]*):/,ha=/^\s+-\s*(.*)$/;function L2(e){return e.trim().replace(/^(["'])(.*)\1$/,"$2")}function v2(e){let t=e.split(/\r?\n/),n=t.findIndex((i)=>ga.exec(i)?.[1]?.trim()==="plugins");if(n===-1)return[];let r=t.slice(n+1),o=r.findIndex((i)=>ga.test(i));return o===-1?r:r.slice(0,o)}function ya(e,t){let n=v2(e),r=n.findIndex((s)=>y2.exec(s)?.[1]===t);if(r===-1)return[];let o=n.slice(r+1),i=o.findIndex((s)=>!ha.test(s));return(i===-1?o:o.slice(0,i)).map((s)=>L2(ha.exec(s)?.[1]??""))}function b2(e){try{return La(va(Mr(e),"config.yaml"),"utf-8")}catch{return}}function qr(e){let t=b2(e)??"";return ya(t,"enabled").includes(z)&&!ya(t,"disabled").includes(z)}function ba(e){return/^# version:\s*(.+)$/m.exec(e)?.[1]?.trim()}function w2(e,t){let n=E(e);if(!n)return{error:`${t.name} is missing from ${e}; run install --hermes-agent`};if(n.isSymbolicLink()||!n.isFile())return{error:`${e} is a symlink or not a regular file; move or remove it`};try{let r=La(e,"utf-8");if(!Ur(r))return{error:`Unmanaged ${t.name} occupies ${e}; move or remove it`};if(ba(r)===P()&&r!==t.content)return{error:`Modified ${t.name} occupies ${e}; run install --hermes-agent to restore it`};return{content:r}}catch(r){return{error:`Failed to read ${e}: ${r instanceof Error?r.message:String(r)}`}}}function wa(e){let t=jr(e.homeDir),n=nn(dn,t);if(n)return n;let r=Tt(P()).map((a)=>w2(va(t,a.name),a)),o=r.flatMap((a)=>("error"in a)?[a.error]:[]);if(o.length>0)return{platform:dn,status:"n/a",configPath:t,errors:o};let i=r.some((a)=>("content"in a)&&ba(a.content)!==P()),s=i?["Installed Hermes Agent plugin is outdated; run install --hermes-agent to update"]:[];if(!qr(e.homeDir))return{platform:dn,status:"disabled",method:"plugin directory",configPath:t,errors:[`${z} is not enabled in Hermes; run \`hermes plugins enable ${z}\``,...s]};return{platform:dn,status:"configured",method:"plugin directory",configPath:t,errors:i?s:void 0}}import{existsSync as x2,readFileSync as C2}from"node:fs";import{join as xa}from"node:path";var k2=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*--kimi-code(\s|["']|$)/;function S2(e){return xa(process.env.KIMI_CODE_HOME||xa(e,".kimi-code"),"config.toml")}function It(e){let t=S2(e.homeDir);if(!x2(t))return{platform:"kimi-code",status:"n/a",configPath:t};try{if(!k2.test(C2(t,"utf-8")))return{platform:"kimi-code",status:"n/a",configPath:t}}catch(n){return{platform:"kimi-code",status:"n/a",configPath:t,errors:[`Failed to read ${t}: ${n instanceof Error?n.message:String(n)}`]}}return{platform:"kimi-code",status:"configured",method:"hook config",configPath:t}}import{readFileSync as Ia}from"node:fs";import{join as Ot}from"node:path";var A="cc-safety-net",K="index.js",nt="openclaw.plugin.json",rt="package.json";var un="// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw";import{existsSync as A2,lstatSync as E2,readdirSync as P2,readFileSync as T2}from"node:fs";import{dirname as Sa,join as ve}from"node:path";import{fileURLToPath as I2}from"node:url";import{spawn as D2}from"node:child_process";function R2(e){return e.join(" ")}function Vr(e,t,n){return[`Failed to run ${R2(e)}${t===null?"":` (exit ${t})`}.`,n.trim()].filter(Boolean).join(`
+`)}function zr(e){let t={stdout:"",stderr:""};return e.stdout.setEncoding("utf-8"),e.stderr.setEncoding("utf-8"),e.stdout.on("data",(n)=>{t.stdout+=n}),e.stderr.on("data",(n)=>{t.stderr+=n}),t}function ie(e,t){return new Promise((n,r)=>{let o=Pe([...e],process.env),i=D2(o.cmd,o.args,{stdio:["ignore","pipe","pipe"]}),s=zr(i),a=()=>[s.stdout,s.stderr].filter(Boolean).join(`
+`),l=t?.timeoutMs??120000,c=setTimeout(()=>{i.kill(),r(Error(Vr(e,null,`Timed out after ${l}ms.
+${a()}`.trim())))},l);i.on("error",(d)=>{clearTimeout(c),r(Error(Vr(e,null,`${d.message}
+${a()}`.trim())))}),i.on("close",(d)=>{if(clearTimeout(c),d!==0){r(Error(Vr(e,d,a())));return}n(t?.stdoutOnly?s.stdout:a())})})}async function Kr(e){for(let t of e)await ie(t)}async function Ca(e){for(let t of e)try{await ie(t)}catch(n){console.warn(n instanceof Error?n.message:String(n))}}var ka=ve("openclaw",A),_2=[K,nt,rt];function Wr(e,t){if(e==="~")return t;if(e.startsWith("~/")||e.startsWith("~\\"))return ve(t,e.slice(2));return e}function Da(e){let t=process.env.OPENCLAW_STATE_DIR?.trim();if(t)return Wr(t,e);let n=process.env.OPENCLAW_CONFIG_PATH?.trim();return n?Sa(Wr(n,e)):ve(e,".openclaw")}function Ra(e){let t=process.env.OPENCLAW_CONFIG_PATH?.trim();return t?Wr(t,e):ve(Da(e),"openclaw.json")}function Jr(e){return ve(Da(e),"extensions",A)}function O2(e){let t=P2(e);if(t.length===0)return!0;if(t.some((o)=>!_2.includes(o)))return!1;let n=ve(e,K),r=E(n);return r!==void 0&&!r.isSymbolicLink()&&r.isFile()&&T2(n,"utf-8").startsWith(un)}function Yr(e){let t=Jr(e),n=E(t);if(!n)return;if(!n.isSymbolicLink()&&n.isDirectory()&&O2(t))return;throw Error(`Refusing to modify ${t}: it does not hold a cc-safety-net managed OpenClaw plugin. Move or remove it, then run the command again.`)}function Aa(){let e=Sa(I2(import.meta.url));return[ve(e,"..",ka),ve(e,"..","..","..","dist",ka)]}function Zr(e=Aa()){return e.find((t)=>A2(t)&&E2(t).isDirectory())}function $2(e=Aa()){let t=Zr(e);if(!t)throw Error("Packaged OpenClaw plugin directory not found. Reinstall cc-safety-net and try again.");return t}function Ea(e=$2()){return[["openclaw","plugins","install",e,"--force"],["openclaw","plugins","enable",A]]}function N2(e){let t=(()=>{try{return JSON.parse(e)}catch{return}})(),n=b(b(t,"plugin"),"status");return typeof n==="string"?n:void 0}async function Pa(){let e=N2(await ie(["openclaw","plugins","inspect",A,"--runtime","--json"],{stdoutOnly:!0}));if(e==="loaded")return;throw Error(`${e===void 0?`The ${A} plugin's load state could not be verified: OpenClaw's runtime inspect report was unreadable.`:`OpenClaw reports the ${A} plugin with status "${e}".`} Run \`openclaw plugins inspect ${A} --runtime\` for details.`)}var pn="openclaw",_t=`run \`openclaw plugins enable ${A}\``;function ot(e,t){let n=Ot(e,t),r=E(n);if(!r)return{error:`${t} is missing from ${n}; run install --openclaw`};if(r.isSymbolicLink()||!r.isFile())return{error:`${n} is a symlink or not a regular file; move or remove it`};try{return{content:Ia(n,"utf-8")}}catch(o){return{error:`Failed to read ${n}: ${o instanceof Error?o.message:String(o)}`}}}function _a(e){try{return JSON.parse(q(e))}catch{return}}function F2(e){let t=ot(e,nt);if("error"in t)return t.error;if(b(_a(t.content),"id")===A)return;return`${Ot(e,nt)} is not a valid ${A} manifest; run install --openclaw`}function H2(e){let t=ot(e,rt);if("error"in t)return t.error;let n=b(b(_a(t.content),"openclaw"),"extensions");if(Array.isArray(n)&&n.includes(`./${K}`))return;return`${Ot(e,rt)} does not point OpenClaw at ${K}; run install --openclaw`}function Ta(e){return Array.isArray(e)?e.filter((t)=>typeof t==="string"):[]}function M2(e){let t=Ra(e);if(!E(t))return`${A} is not enabled; ${_t}`;let n=(()=>{try{return JSON.parse(q(Ia(t,"utf-8")))}catch{return}})();if(n===void 0)return`Failed to read ${t}; fix it, then ${_t}`;let r=b(n,"plugins");if(b(r,"enabled")===!1)return`plugins.enabled is false in ${t}; no OpenClaw plugin loads`;let o=b(b(b(r,"entries"),A),"enabled");if(Ta(b(r,"deny")).includes(A)||o===!1)return`${A} is disabled in ${t}; ${_t}`;let i=Ta(b(r,"allow"));if(i.length>0&&!i.includes(A))return`plugins.allow in ${t} does not list ${A}; add it, then ${_t}`;if(i.includes(A)||o===!0)return;return`${A} is not enabled; ${_t}`}function Oa(e){return/^\/\/ version:\s*(.+)$/m.exec(e)?.[1]?.trim()}function j2(e,t,n){if(n===void 0)return[];let r=ot(n,K);if("error"in r||Oa(r.content)!==t)return[];return[K,nt,rt].flatMap((o)=>{let i=ot(e,o),s=ot(n,o);if("error"in i||"error"in s||i.content===s.content)return[];return[`Modified ${o} occupies ${Ot(e,o)}; run install --openclaw to restore it`]})}function $a(e){let t=Jr(e.homeDir),n=nn(pn,t);if(n)return n;let r=ot(t,K),i=["error"in r?r.error:r.content.startsWith(un)?void 0:`Unmanaged ${K} occupies ${Ot(t,K)}; move or remove it`,F2(t),H2(t)].filter((d)=>d!==void 0),s="content"in r?Oa(r.content):void 0,a=i.length>0?i:j2(t,s,Zr());if(a.length>0)return{platform:pn,status:"n/a",configPath:t,errors:a};let l=s===P()?[]:["Installed OpenClaw plugin is outdated; run install --openclaw to update"],c=M2(e.homeDir);if(c)return{platform:pn,status:"disabled",method:"plugin directory",configPath:t,errors:[c,...l]};return{platform:pn,status:"configured",method:"plugin directory",configPath:t,errors:l.length>0?l:void 0}}import{existsSync as Z2,readFileSync as X2}from"node:fs";import{join as Q2}from"node:path";import{existsSync as Xr,readFileSync as ja,rmSync as G2}from"node:fs";import{join as me}from"node:path";import{pathToFileURL as B2}from"node:url";function Na(e){return e!==void 0&&/\s/.test(e)}function U2(e,t,n){let r=t+1,o=!1;while(r<e.length){let i=e[r];if(o){o=!1,r++;continue}if(i==="\\"){o=!0,r++;continue}if(i==='"')return r+1;r++}throw Error(n)}function fn(e,t,n){let r=e[t],o=r==="["?"]":"}",i=0,s=t;while(s<e.length){let a=n.skipComment?.(e,s)??s;if(a!==s){s=a;continue}if(e[s]==='"'){s=U2(e,s,n.stringError);continue}if(e[s]===r)i++;if(e[s]===o){if(i--,i===0)return s}s++}throw Error(n.bracketError)}function Fa(e,t){let n=e.lastIndexOf(`
+`,t)+1;return/^[ \t]*/.exec(e.slice(n))?.[0]??""}function mn(e,t){let{start:n,end:r,end:o}=t;while(Na(e[o]))o++;if(e[o]===","){if(r=o+1,e[r]===`
+`)r++;return`${e.slice(0,n)}${e.slice(r)}`}o=t.start-1;while(Na(e[o]))o--;if(e[o]===","){n=o;let i=e.lastIndexOf(`
+`,n-1);if(i!==-1&&/^\s*$/.test(e.slice(i+1,n)))n=i}return`${e.slice(0,n)}${e.slice(r)}`}var gn="cc-safety-net",Ua=`${gn}@latest`,Ga=["opencode.json","opencode.jsonc"],Ha="CCSafetyNetPlugin";function hn(e){return me(process.env.XDG_CONFIG_HOME||me(e,".config"),"opencode")}function q2(e){return me(hn(e),Ga[0])}function V2(e){return Ga.map((t)=>me(hn(e),t))}function Ba(e){return me(process.env.XDG_CACHE_HOME||me(e,".cache"),"opencode","packages",Ua)}function Qr(e){G2(Ba(e),{recursive:!0,force:!0})}async function qa(e){let t=me(Ba(e),"node_modules",gn),n=me(t,"package.json");if(!Xr(n))throw Error(`The OpenCode plugin cache at ${t} is missing its package, so OpenCode would load nothing and fail open. Run \`opencode plugin -g -f ${Ua}\` for details.`);let r=b(JSON.parse(ja(n,"utf-8")),"main");if(typeof r!=="string")throw Error(`The cached OpenCode plugin at ${t} declares no "main" entry.`);let o=me(t,r);if(typeof(await import(B2(o).href))[Ha]==="function")return;throw Error(`The cached OpenCode plugin at ${o} does not export a callable ${Ha}, so OpenCode would load nothing and fail open.`)}function yn(e,t){if(e[t]==="/"&&e[t+1]==="/"){let n=e.indexOf(`
+`,t+2);return n===-1?e.length:n+1}if(e[t]==="/"&&e[t+1]==="*"){let n=e.indexOf("*/",t+2);return n===-1?e.length:n+2}return t}function Ma(e,t){let n=t;while(n<e.length){if(/\s/.test(e[n]??"")){n++;continue}let r=yn(e,n);if(r===n)return n;n=r}return n}function Va(e,t){let n=t+1,r=!1;while(n<e.length){if(r){r=!1,n++;continue}if(e[n]==="\\"){r=!0,n++;continue}if(e[n]==='"')return n+1;n++}throw Error("Unterminated string in OpenCode config")}function za(e,t,n){return JSON.parse(e.slice(t,n))}function z2(e,t){return fn(e,t,{skipComment:yn,stringError:"Unterminated string in OpenCode config",bracketError:"Unmatched plugin array in OpenCode config"})}function K2(e){let t=0,n=0;while(n<e.length){let r=yn(e,n);if(r!==n){n=r;continue}if(e[n]==='"'){let o=Va(e,n);if(t===1&&za(e,n,o)==="plugin"){let i=Ma(e,o),s=Ma(e,i+1);if(e[i]===":"&&e[s]==="[")return{start:s,end:z2(e,s)}}n=o;continue}if(e[n]==="{"||e[n]==="[")t++;if(e[n]==="}"||e[n]==="]")t--;n++}return}function W2(e,t){let n=[],r=t.start+1;while(r<t.end){let o=yn(e,r);if(o!==r){r=o;continue}if(e[r]==='"'){let i=Va(e,r),s=za(e,r,i);if(typeof s==="string"&&s.includes(gn))n.push({start:r,end:i});r=i;continue}r++}return n}function Ka(e,t){try{return JSON.parse(q(e))}catch(n){if(n instanceof SyntaxError)throw Error(`Failed to parse OpenCode config ${t}: ${n.message}`);throw n}}function J2(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e.plugin;if(!Array.isArray(t))return!1;return t.some((n)=>typeof n==="string"&&n.includes(gn))}function Y2(e,t){let n=K2(e);if(!n)throw Error(`Failed to locate OpenCode plugin array in ${t}`);let r=[...W2(e,n)].reverse().reduce(mn,e);return Ka(r,t),r}function Wa(e){Qr(e);let t=V2(e),n=t.find((o)=>Xr(o)),r=[];for(let o of t){if(!Xr(o))continue;try{let i=ja(o,"utf-8");if(!J2(Ka(i,o)))continue;return _(o,Y2(i,o)),{path:o,alreadyInstalled:!0}}catch(i){r.push(i instanceof Error?i.message:String(i))}}if(r.length>0)throw Error(r.join(`
+`));return{path:n??q2(e),alreadyInstalled:!1}}function Ja(e){let t=[],n=hn(e.homeDir),r=["opencode.json","opencode.jsonc"];for(let o of r){let i=Q2(n,o);if(Z2(i))try{let s=X2(i,"utf-8"),a=q(s);if((JSON.parse(a).plugin??[]).some((p)=>p.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:i,errors:t.length>0?t:void 0}}catch(s){t.push(`Failed to parse ${o}: ${s instanceof Error?s.message:String(s)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as ef}from"node:path";function eo(e){return ef(e,".pi","agent","settings.json")}function to(e){if(typeof e!=="string")return!1;return e==="npm:cc-safety-net"||e.startsWith("npm:cc-safety-net@")}function Ya(e){let t=eo(e.homeDir),n=re(t);if(n.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(n.kind==="missing")return{platform:"pi",status:"n/a"};let r=b(n.value,"packages");if(!Array.isArray(r))return{platform:"pi",status:"n/a"};let o=r.find((a)=>to(typeof a==="string"?a:b(a,"source")));if(o===void 0)return{platform:"pi",status:"n/a"};let i=b(o,"extensions");if(Array.isArray(i)&&i.some((a)=>typeof a==="string"&&a.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var nf={amp:Fs,"antigravity-cli":Hs,"claude-code":Gs,codex:Bs,"copilot-cli":ea,cursor:la,"gemini-cli":ca,"hermes-agent":wa,"kimi-code":It,openclaw:$a,opencode:Ja,pi:Ya};function it(e,t){let n={...t,cwd:e,homeDir:t?.homeDir??tf()};return Kt.map((r)=>rf(nf[r](n)))}function rf(e){if(e.status==="not-inspected")return{platform:e.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:e.platform,detected:e.status!=="n/a",configured:e.status==="configured",inspectionStatus:e.status!=="n/a"?"verified":e.errors&&e.errors.length>0?"failed":"not-applicable",method:e.method,configPath:e.configPath,configPaths:e.configPaths,errors:e.errors}}import{tmpdir as of}from"node:os";import{join as sf}from"node:path";var af=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),lf=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),cf={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function Za(){let e=sf(of(),"cc-safety-net-self-test"),t=af.map((n)=>{let r=Vt(Ke("self-test",{command:n.command},{kind:"command",shell:"auto"},{configCwd:e,executionCwd:e},n.command),{guard:{dependencies:{loadPolicySnapshot:()=>lf,getModes:()=>cf,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),o=n.expectBlocked?"blocked":"allowed",i=r.decision.kind==="deny"?"blocked":"allowed";return{command:n.command,description:n.description,expected:o,actual:i,passed:o===i,reason:r.decision.kind==="deny"?r.decision.reason:void 0,ruleId:r.decision.kind==="deny"?r.decision.ruleId:void 0}});return{passed:t.filter((n)=>n.passed).length,failed:t.filter((n)=>!n.passed).length,total:t.length,results:t}}function no(e){let t=T({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},e);if(ae(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function Xa(e={}){let t=await At(!e.json,()=>{let n=df(e);return{ready:n,finish:()=>n}},()=>Rt(),{loadingMessage:"Checking system status…"});if(e.json)console.log(JSON.stringify(t,null,2));else pf(t);return uf(t.hooks,t.engineSelfTest,{userConfig:t.userConfig,projectConfig:t.projectConfig})?1:0}async function df(e){let t=e.cwd??process.cwd(),n=await St(),r=it(t,{ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.versions["copilot-cli"]}),o=as(t),i=ls(),s=B({cwd:t}),a=s.policy,l=de(a),c=De(a,l.capabilities),d=Yt(7),p=e.skipUpdateCheck?{currentVersion:P(),latestVersion:null,updateAvailable:!1}:await Qe(),m={hooks:r,engineSelfTest:Za(),userConfig:o.userConfig,projectConfig:o.projectConfig,configState:bt(s),effectiveRules:o.effectiveRules,shadowedRules:o.shadowedRules,environment:i,effectiveSafety:{selectedPreset:a.safety.level??"standard",level:l.effectiveLevel,capabilities:l.capabilities,ruleOverrides:a.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(c).filter(([,u])=>u.source==="rule_override"&&u.override==="off"&&u.inheritedEnabled&&u.changesInherited).map(([u])=>u),ruleCounts:{stored:Object.keys(a.destructiveCommandRuleOverrides).length,effective:Object.values(c).filter((u)=>u.changesInherited).length}},posture:xs(o.userConfig.path),activity:d,update:p,system:n};return{...m,findings:ds(m)}}function uf(e,t,n){return e.length>0&&e.every((r)=>!r.configured)||e.some((r)=>r.inspectionStatus==="failed")||t.failed>0||n.userConfig.exists&&!n.userConfig.valid||n.projectConfig.exists&&!n.projectConfig.valid}function pf(e){console.log(),console.log(ps(e.hooks)),console.log(),console.log(fs(e.engineSelfTest)),console.log(),console.log(ms(e)),console.log(),console.log(gs(e.environment)),console.log(),console.log(hs(e)),console.log(),console.log(ys(e.findings)),console.log(),console.log(Ls(e.activity)),console.log(),console.log(bs(e.system)),console.log(),console.log(vs(e.update)),console.log(ws(e))}import{existsSync as ff}from"node:fs";var mf=/^[A-Za-z0-9_@%+=:,./-]+$/,Qa="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function ro(e){let t=T({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},e);if(ae(t.errors))return console.error(Qa),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!ff(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let n=t.positionals.length===1?t.positionals[0]:t.positionals.map((r)=>mf.test(r)?r:`'${r.replaceAll("'","'\\''")}'`).join(" ");if(!n)return console.error("Error: No command provided"),console.error(Qa),null;return{json:t.flags.json,cwd:t.values.cwd,command:n}}function el(e){if(e)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function tl(e,t){let r=t-18;return[`${e.dtl}${e.dh.repeat(t)}${e.dtr}`,`${e.dv}  Command Analysis${" ".repeat(r)}${e.dv}`,`${e.dbl}${e.dh.repeat(t)}${e.dbr}`]}function oo(e){return JSON.stringify(e)}function nl(e,t=0){return`[${e.map((r,o)=>us(r,o,t)).join(",")}]`}function Ln(e,t,n=70){let r=e.split(" "),o=[],i="";for(let s of r)if(i&&i.length+s.length+1>n)o.push(i),i=s;else i=i?`${i} ${s}`:s;if(i)o.push(i);return o.map((s,a)=>a===0?s:`${t}${s}`)}function rl(e,t,n){let r=[];switch(e.type){case"parse":return null;case"env-strip":return r.push(""),r.push(`STEP ${t} ${n.h} Strip environment variables`),r.push(`  Removed: ${e.envVars.map((o)=>`${o}=<redacted>`).join(", ")}`),r.push(`  Tokens:  ${oo(e.output)}`),{lines:r,incrementStep:!0};case"leading-tokens-stripped":return r.push(""),r.push(`STEP ${t} ${n.h} Strip wrappers`),r.push(`  Removed: ${e.removed.join(", ")}`),r.push(`  Tokens:  ${oo(e.output)}`),{lines:r,incrementStep:!0};case"shell-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Detect shell wrapper`),r.push(`  Wrapper: ${e.wrapper} -c`),r.push(`  Inner:   ${e.innerCommand}`),{lines:r,incrementStep:!0};case"interpreter":{if(r.push(""),r.push(`STEP ${t} ${n.h} Detect interpreter`),r.push(`  Interpreter: ${e.interpreter}`),r.push(`  Code:        ${e.codeArg}`),e.paranoidBlocked)r.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:r,incrementStep:!0}}case"busybox":return r.push(""),r.push(`STEP ${t} ${n.h} Busybox wrapper`),r.push(`  Subcommand: ${e.subcommand}`),{lines:r,incrementStep:!0};case"transparent-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Transparent wrapper`),r.push(`  Wrapper: ${e.wrapper}`),r.push(`  Tokens:  ${oo(e.output)}`),{lines:r,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(r.push(""),r.push(`STEP ${t} ${n.h} Match rules`),r.push(`  Rule:   ${e.rule}()`),e.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}case"worktree-relaxation":return r.push(""),r.push(`STEP ${t} ${n.h} Worktree relaxation`),r.push(`  Mode:   ${S.worktree.name}`),r.push(`  Git cwd: ${e.gitCwd}`),r.push("  Result: Allowed local discard in linked worktree"),{lines:r,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(e.embeddedCommandFound)return r.push(""),r.push(`STEP ${t} ${n.h} Fallback scan`),r.push(`  Found: ${e.embeddedCommandFound}`),{lines:r,incrementStep:!0};return null}case"custom-rules-check":{if(e.rulesChecked){if(r.push(""),r.push(`STEP ${t} ${n.h} Custom rules`),e.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(e.matched)return r.push(""),r.push(`STEP ${t} ${n.h} Dangerous text check`),r.push(`  Token:  ${e.token}`),r.push("  Result: MATCHED"),{lines:r,incrementStep:!0};return null}case"strict-unparseable":return r.push(""),r.push(`STEP ${t} ${n.h} Strict mode check`),r.push(`  Command: ${e.rawCommand}`),r.push("  Result:  ✗ UNPARSEABLE"),{lines:r,incrementStep:!0};case"segment-skipped":return null;case"error":return r.push(""),r.push(`ERROR: ${e.message}`),{lines:r,incrementStep:!1};default:return null}}function io(e,t){let n=el(t?.asciiOnly??!1),r=58,o=[],i=1;o.push(...tl(n,58)),o.push("");let s=e.trace.steps.find((u)=>u.type==="error");if(s&&s.type==="error"){o.push("ERROR"),o.push(`  ${s.message}`),o.push(""),o.push("RESULT"),o.push(`  Status: ${e.result==="blocked"?g.red("BLOCKED"):g.green("ALLOWED")}`),o.push(""),o.push("CONFIG");let u=e.configSource??"none";return o.push(`  Path: ${u}`),o.join(`
+`)}let a=e.trace.steps.find((u)=>u.type==="parse");if(a&&a.type==="parse"){o.push("INPUT"),o.push(`  ${a.input}`),o.push(""),o.push(`STEP ${i} ${n.h} Split shell commands`),i++;for(let u=0;u<a.segments.length;u++){let h=a.segments[u];if(h){let f=Math.random();o.push(`  Segment ${u+1}: ${nl(h,f)}`)}}}let l=e.trace.segments,c=l.length>1;for(let u of l){if(c){o.push("");let v="";if(a&&a.type==="parse"){let Hn=a.segments[u.index];if(Hn)v=Hn.join(" ")}let w=54,y=v,C=` Segment ${u.index+1}: `,H=" ";if(v){if(C.length+v.length+H.length>w){let Vc=w-C.length-H.length;y=`${v.substring(0,Vc-1)}…`}}let he=v?`${C}${y}${H}`:` Segment ${u.index+1} `,Fn=v?`${C}${g.cyan(y)}${H}`:he,Po=58-he.length,To=Math.floor(Po/2),qc=Po-To;o.push(`${n.sh.repeat(To)}${Fn}${n.sh.repeat(qc)}`)}if(u.steps.find((v)=>v.type==="segment-skipped")){o.push(""),o.push("  (skipped — prior segment blocked)");continue}let f=!1,L=!1;for(let v of u.steps){let w=rl(v,i,n);if(w){if(L=!0,v.type==="recurse"){o.push("");let y=" RECURSING ",C=58-y.length-4;o.push(`  ${n.tl}${n.h}${y}${n.h.repeat(C)}`),o.push(`  ${n.v}`),f=!0;continue}for(let y of w.lines)if(f)o.push(`  ${n.v} ${y}`);else o.push(y);if(w.incrementStep)i++}}if(f)o.push(`  ${n.v}`),o.push(`  ${n.bl}${n.h.repeat(56)}`),f=!1;if(!L)o.push(""),o.push(`  ${g.green("✓")} Allowed (no matching rules)`)}if(o.push(""),o.push("RESULT"),e.result==="blocked"){if(o.push(`  Status: ${g.red("BLOCKED")}`),e.customRule){if(o.push(`  Rule: ${e.customRule.id}`),e.customRule.rulebook)o.push(`  Rulebook: ${e.customRule.rulebook.name} ${e.customRule.rulebook.version}`);if(e.customRule.source)o.push(`  Source: ${e.customRule.source}`);if(e.customRule.override)o.push(`  Override: reason ${e.customRule.override.reason}`)}if(e.reason){let u=Ln(e.reason,"          ");o.push(`  Reason: ${u[0]}`);for(let h=1;h<u.length;h++)o.push(u[h]??"")}}else o.push(`  Status: ${g.green("ALLOWED")}`);o.push(""),o.push("CONFIG");let d=e.configSource??"none",p=e.configValid?"":" (invalid)";o.push(`  Path: ${d}${p}`),o.push(`  Safety preset: ${e.selectedPreset??"standard"}`),o.push(`  Effective capabilities: ${e.effectiveLevel}`);let m=Object.entries(e.destructiveCommandRuleOverrides??{});if(o.push(`  Rule customizations: ${m.length}`),e.ruleActivation)o.push(`  Rule activation: ${e.ruleActivation.id} — ${e.ruleActivation.enabled?"on":"off"} via ${e.ruleActivation.source}`);return o.join(`
+`)}function so(e){return JSON.stringify(e,null,2)}function ol(e){return new Promise((t)=>{process.stdout.write(`${e}
+`,()=>t())})}async function il(e){let t=ro(e);if(!t)return 1;try{let n=We(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await ol(t.json?so(n):io(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof lr)&&!(n instanceof Se)&&!(n instanceof pe))throw n;if(t.json)return await ol(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var sl="2.0.10",W="  ",_e="cc-safety-net";function al(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function gf(e){return Math.max(...e.map((t)=>al(t).length))}function hf(e){return Math.max(...e.map((t)=>t.usage.length))}function yf(e){return Math.max(...e.map((t)=>`${_e} ${t.usage}`.length))}function Lf(e,t){let n=`${_e} ${e.usage}`;return`${W}${n.padEnd(t+2)}${e.description}`}function ge(e,t){return`${W}${e.padEnd(Math.max(40,e.length+2))}${t}`}function vn(e,t=console.log){let n=[];if(n.push(`${_e} ${e.name}`),n.push(""),n.push(`${W}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${W}${_e} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=hf(e.subcommands);for(let o of e.subcommands)n.push(`${W}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=gf(e.options);for(let o of e.options){let i=al(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${W}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${W}${r}`)}t(n.join(`
+`))}function ao(){let e=yf(Wt),t=[];t.push(`${_e} v${sl}`),t.push(""),t.push("Blocks destructive commands and secret access."),t.push(""),t.push("COMMANDS:");for(let n of Wt)t.push(Lf(n,e));t.push(""),t.push("GLOBAL OPTIONS:"),t.push(`${W}-h, --help       Show help (use with command for command-specific help)`),t.push(`${W}-V, --version    Show version`),t.push(""),t.push("HELP:"),t.push(`${W}${_e} help <command>     Show help for a specific command`),t.push(`${W}${_e} <command> --help   Show help for a specific command`),t.push(""),t.push("ENVIRONMENT VARIABLES:"),t.push(ge(`${S.level.name}=standard|strict|paranoid`,"Set session safety level")),t.push(ge(`${S.worktree.name}=1`,"Allow local git discards in linked worktrees")),t.push(ge(`${S.debug.name}=1`,"Print diagnostic messages to stderr")),t.push(ge(`${S.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),t.push(ge("CC_SAFETY_NET_HOME","Override rule config home directory")),t.push(""),t.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),t.push(ge(`${S.strict.name}=1`,"Force safety.overrides.fail_closed on")),t.push(ge(`${S.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),t.push(ge(`${S.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),t.push(ge(`${S.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),t.push(""),t.push("Documentation:        https://ccsafetynet.com/docs"),console.log(t.join(`
+`))}function ll(){console.log(sl)}function $t(e,t=console.log){let n=Jt(e);if(!n)return!1;if(n.name.toLowerCase()!==e.toLowerCase())return!1;return vn(n,t),!0}import{existsSync as bo,readFileSync as Ql}from"node:fs";import{homedir as um}from"node:os";import{join as Lo}from"node:path";import*as be from"node:readline";function vf(e){return e==="install"?"Install":"Uninstall"}function bf(e){return e==="install"?"Installing":"Uninstalling"}function wf(e){return e==="install"?"into":"from"}function ul(e){return e?.available===!0}function xf(e,t){let n=new Set(t);return e.filter((r)=>n.has(r.target)).map((r)=>r.target)}function cl(e,t,n){if(e.length===0||e.every((r)=>!r.available))return t;return Array.from({length:e.length},(r,o)=>o+1).map((r)=>(t+r*n+e.length)%e.length).find((r)=>ul(e[r]))}function Cf(e,t,n){if(n.ctrl&&n.name==="c")return"interrupt";if(n.name==="escape"||t==="q")return"abort";if(e==="install"&&(t==="u"||t==="U"))return"update";if(n.name==="up"||t==="k")return"up";if(n.name==="down"||t==="j")return"down";if(n.name==="space"||t===" ")return"toggle";if(n.name==="return"||n.name==="enter")return"confirm";return null}function kf(e){return{cursor:e.findIndex((t)=>t.available),selected:[]}}function Sf(e,t,n){if(n==="confirm"||n==="update"||n==="abort"||n==="interrupt")return{state:e,done:n};if(n==="up")return{state:{...e,cursor:cl(t,e.cursor,-1)}};if(n==="down")return{state:{...e,cursor:cl(t,e.cursor,1)}};let r=t[e.cursor];if(!ul(r))return{state:e};let o=e.selected.includes(r.target)?e.selected.filter((i)=>i!==r.target):xf(t,[...e.selected,r.target]);return{state:{...e,selected:o}}}var pl="◉",fl="◯",ml=">",gl=" ";function Df(e,t,n,r={}){let o=r.color!==!1,i=o?g.dim:(l)=>l,s=o?g.green:(l)=>l,a=o?g.bold:(l)=>l;return["",`${vf(e)} CC Safety Net ${wf(e)}:`,"",...t.map((l,c)=>{let d=n.selected.includes(l.target),p=c===n.cursor,m=d?pl:fl,u=p?ml:gl,h=l.available?"":` (${l.unavailableReason??"not installed"})`,f=`${m} ${l.label}${h}`,L=!l.available?i(f):d?s(f):p?a(f):f;return`${u} ${L}`}),"",e==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":t.some((l)=>l.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${e}. q/Esc: close`].join(`
+`)}var dl=["global-hook","plugin"];function Rf(e,t,n={}){let r=n.color!==!1?g.bold:(i)=>i;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((i,s)=>{let a=s===e,l=`${a?pl:fl} ${i}`;return`${a?ml:gl} ${a?r(l):l}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`
+`)}function hl(e){let{input:t,output:n}=e;be.emitKeypressEvents(t);let r=t.isRaw===!0;t.setRawMode(!0),t.resume();let o=0,i=()=>{if(o===0)return;be.moveCursor(n,0,-o),be.cursorTo(n,0),be.clearScreenDown(n)},s=()=>{i();let a=e.render();n.write(`${a}
+`),o=a.split(`
+`).length};return new Promise((a)=>{let l=(d)=>{t.off("keypress",c),t.setRawMode(r),t.pause(),i(),a(d)};function c(d,p){e.onKey(d,p,{finish:l,draw:s})}t.on("keypress",c),s()})}function yl(e={}){let t=0;return hl({input:e.input??process.stdin,output:e.output??process.stdout,render:()=>Rf(t,e.globalHookInstalled===!0),onKey:(n,r,o)=>{if(r.ctrl&&r.name==="c"){o.finish(null),(e.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(r.name==="escape"||n==="q")return o.finish(null);if(r.name==="return"||r.name==="enter")return o.finish(dl[t]);if(r.name==="up"||r.name==="down"||n==="k"||n==="j")t=(t+1)%dl.length,o.draw()}})}function lo(e=process.stdin,t=process.stdout){return Boolean(e.isTTY&&t.isTTY&&typeof e.setRawMode==="function")}function Ll(e,t,n={}){let r=n.output??process.stdout,o=kf(t);return hl({input:n.input??process.stdin,output:r,render:()=>Df(e,t,o),onKey:(i,s,a)=>{let l=Cf(e,i,s);if(!l)return;let c=Sf(o,t,l);if(o=c.state,c.done==="interrupt"){a.finish(null),(n.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(c.done==="abort")return a.finish(null);if(c.done==="update")return a.finish("update");if(c.done==="confirm"){if(o.selected.length===0){r.write("\x07"),a.draw();return}a.finish([...o.selected]),r.write(`${bf(e)} selected integrations...
+`);return}a.draw()}})}import{existsSync as bl,lstatSync as Ef,mkdirSync as Pf,mkdtempSync as Tf,readdirSync as If,readFileSync as at,rmSync as xn}from"node:fs";import{tmpdir as _f}from"node:os";import{basename as Of,dirname as $f,join as U}from"node:path";import{fileURLToPath as Nf}from"node:url";var co="// cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp",Oe="cc-safety-net",$e="cc-safety-net/index.ts";import{spawn as Af}from"node:child_process";var uo=(e,t)=>{let n=Pe([...e],process.env);return new Promise((r)=>{let o=Af(n.cmd,n.args,{cwd:t,stdio:["ignore","pipe","pipe"]}),i=zr(o),s=!1,a=setTimeout(()=>{s=!0,o.kill()},120000);o.on("error",(l)=>{clearTimeout(a),r({status:null,errorCode:l.code,stdout:i.stdout,stderr:[l.message,i.stderr].filter(Boolean).join(`
+`)})}),o.on("close",(l)=>{clearTimeout(a),r({status:s?null:l,errorCode:s?"ETIMEDOUT":void 0,stdout:i.stdout,stderr:i.stderr})})})};var st="cc-safety-net.ts",vl=U("amp",$e);function Ff(e){return U(e,".config","amp","plugins","cc-safety-net.ts")}function Hf(){let e=$f(Nf(import.meta.url));return[U(e,"..",vl),U(e,"..","..","..","dist",vl)]}function Mf(e=Hf()){let t=e.find((n)=>bl(n)&&Ef(n).isFile());if(!t)throw Error("Packaged Amp plugin artifact not found. Reinstall cc-safety-net and try again.");return t}function wl(e){try{return JSON.parse(e)}catch{return}}function Cn(e){return e.subarray(0,Buffer.byteLength(co)).toString("utf-8")===co}async function Nt(e,t,n){let r=await e(t,n);if(r.status===0)return r;throw Error([`Failed to run ${t.join(" ")}${r.status===null?"":` (exit ${r.status})`}.`,[r.stdout,r.stderr].filter(Boolean).join(`
 `).trim()].filter(Boolean).join(`
-`))}async function D3(n){let t=await n(["amp","plugins","repositories","--json"]);if(t.status===null)throw Error(`${t.errorCode==="ENOENT"?'Amp CLI not found. Install the amp CLI, sign in with "amp login", and rerun install --amp.':`amp plugins repositories --json did not finish (${t.errorCode??"terminated"}). Check that the amp CLI responds and rerun install --amp.`}
+`))}async function xl(e){let t=await e(["amp","plugins","repositories","--json"]);if(t.status===null)throw Error(`${t.errorCode==="ENOENT"?'Amp CLI not found. Install the amp CLI, sign in with "amp login", and rerun install --amp.':`amp plugins repositories --json did not finish (${t.errorCode??"terminated"}). Check that the amp CLI responds and rerun install --amp.`}
 ${t.stderr}`.trim());if(t.status!==0)throw Error(`Failed to run amp plugins repositories --json (exit ${t.status}). Sign in with "amp login" and rerun install --amp.
 ${[t.stdout,t.stderr].filter(Boolean).join(`
-`)}`.trim());let r=$3(t.stdout),e=(Array.isArray(r)?r:[]).filter((a)=>x(a,"scope")==="user"&&x(a,"exists")===!0&&x(a,"viewerCanWrite")===!0).map((a)=>x(a,"cloneRef")).find((a)=>typeof a==="string"&&a.length>0);if(!e)throw Error('Your Amp account has no writable Personal Plugins repository. Sign in with "amp login", open Amp once to create it, and rerun install --amp.');return e}async function m3(n,t){let r=Zi(R(Xi(),"cc-safety-net-amp-"));try{return await Sn(n,["amp","clone","user-plugins",r]),await t(r)}finally{xt(r,{recursive:!0,force:!0})}}function Lr(n){return`rerun ${n==="overwrite"?"install":"uninstall"} --amp`}function g3(n,t,r){let e=R(n,t),a=F(e);if(!a)return;if(a.isSymbolicLink()||!a.isFile())throw Error(`Refusing to ${r} ${t} in your Amp personal plugins repository: not a regular file. Remove it there and ${Lr(r)}.`);let l=sn(e);if($t(l))return l;throw Error(`Refusing to ${r} unmanaged file ${t} in your Amp personal plugins repository. Remove it there and ${Lr(r)}.`)}function k3(n,t){let r=R(n,Q2),e=F(r);if(!e)return;if(e.isSymbolicLink()||!e.isDirectory())throw Error(`Refusing to ${t} ${Q2} in your Amp personal plugins repository: not a regular directory. Remove it there and ${Lr(t)}.`);return g3(n,X2,t)}function Vi(n){let t=R(n,ln),r=F(t);if(!r||r.isSymbolicLink()||!r.isFile())return;let e=sn(t);return $t(e)?e:void 0}async function q3(n,t,r,e){if(await Sn(n,r,t),(await Sn(n,["git","status","--porcelain"],t)).stdout.trim()==="")return!1;return await Sn(n,["git","-c","commit.gpgsign=false","-c","user.name=cc-safety-net","-c","user.email=cc-safety-net@localhost","commit","-m",e],t),await Sn(n,["git","push","origin","HEAD"],t),!0}function ht(n,t){Ai(n,t),Mi(n,t)}function j3(n,t){if(t==="keep")return;throw Error(`Local Amp plugin ${n} is not a managed copy and masks the personal plugin. Remove it and rerun install --amp.`)}function Ai(n,t){let r=Wi(n),e=F(r);if(!e)return;if(!e.isSymbolicLink()&&e.isFile()&&$t(sn(r))){xt(r);return}j3(r,t)}function Mi(n,t){let r=R(n,".config","amp","plugins",Q2),e=F(r);if(!e)return;if(!e.isSymbolicLink()&&e.isDirectory()&&Gi(r)){xt(r,{recursive:!0});return}j3(r,t)}function Gi(n){let t=Yi(X2);if(Qi(n).join("\x00")!==t)return!1;let r=R(n,t),e=F(r);return!!e&&!e.isSymbolicLink()&&e.isFile()&&$t(sn(r))}function Ui(){let n=wn();if(!x3(n))return"";let t=$3(sn(n,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))return"";return`;globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__ = ${JSON.stringify(wt(t))};
-`}async function z3(n,t=Ri(),r=cr){let e=Buffer.concat([sn(t),Buffer.from(Ui(),"utf-8")]),a=await D3(r);return m3(r,async(l)=>{let s=`${a}/${Q2}`,d=k3(l,"overwrite"),c=g3(l,ln,"overwrite");if(d?.equals(e)&&!c)return ht(n,"fail"),{path:s,alreadyInstalled:!0};if(Ji(R(l,Q2),{recursive:!0}),Q(R(l,X2),e),c)xt(R(l,ln));let L=await q3(r,l,["git","add","--",X2,...c?[ln]:[]],`chore: update cc-safety-net plugin to v${B()}`);return ht(n,"fail"),{path:s,alreadyInstalled:!L}})}async function F3(n,t=cr){let r=await D3(t);return m3(t,async(e)=>{let a=k3(e,"remove"),l=Vi(e),s=`${r}/${l&&!a?ln:Q2}`;if(!a&&!l)return ht(n,"keep"),{path:s,alreadyInstalled:!1};return await q3(t,e,["git","rm","--",...a?[X2]:[],...l?[ln]:[]],`chore: remove cc-safety-net plugin v${B()}`),ht(n,"keep"),{path:s,alreadyInstalled:!0}})}import{existsSync as B3,mkdirSync as Ci,readFileSync as Oi}from"node:fs";import{dirname as Ti}from"node:path";var ir="npx -y cc-safety-net hook --agy-cli",$2="cc-safety-net";function mt(){return{PreToolUse:[{hooks:[{type:"command",command:ir,timeout:30}]}]}}function J3(n){try{let t=JSON.parse(Oi(n,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))throw Error("Antigravity hooks config must be a JSON object");return t}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Antigravity hooks config ${n}: ${t.message}`);throw t}}function Z3(n){let t=n[$2];if(t===void 0)return n[$2]=mt(),n[$2];if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Antigravity hooks config entry "${$2}" must be an object`);if(!Array.isArray(t.PreToolUse))t.PreToolUse=[];return t}function Q3(n){if(!Array.isArray(n.PreToolUse))return!1;return n.PreToolUse.some((t)=>Array.isArray(t.hooks)&&t.hooks.some((r)=>r.command===ir))}function _i(n){return Object.values(n).some((t)=>t.enabled!==!1&&Q3(t))}function Ei(n){if(n[$2]===void 0)return!1;let t=Z3(n);if(t.enabled!==!1||!Q3(t))return!1;return t.enabled=!0,!0}function Pi(n){if(n[$2]===void 0){n[$2]=mt();return}let t=Z3(n);t.PreToolUse??=[],t.enabled=!0,t.PreToolUse.push(mt().PreToolUse?.[0]??{hooks:[]})}function Ii(n){let t=!1;for(let r of Object.values(n)){if(!Array.isArray(r.PreToolUse))continue;r.PreToolUse=r.PreToolUse.flatMap((e)=>{if(!Array.isArray(e.hooks))return[e];let a=e.hooks.filter((l)=>l.command!==ir);if(a.length!==e.hooks.length)t=!0;return a.length===0?[]:[{...e,hooks:a}]})}return t}function Dt(n,t){Q(n,`${JSON.stringify(t,null,2)}
-`)}function X3(n){let t=zn(n);if(Ci(Ti(t),{recursive:!0}),!B3(t))return Dt(t,{[$2]:mt()}),{path:t,alreadyInstalled:!1};let r=J3(t);if(_i(r))return{path:t,alreadyInstalled:!0};if(Ei(r))return Dt(t,r),{path:t,alreadyInstalled:!1};return Pi(r),Dt(t,r),{path:t,alreadyInstalled:!1}}function Y3(n){let t=zn(n);if(!B3(t))return{path:t,alreadyInstalled:!1};let r=J3(t);if(!Ii(r))return{path:t,alreadyInstalled:!1};return Dt(t,r),{path:t,alreadyInstalled:!0}}import{spawn as Ni,spawnSync as n5}from"node:child_process";var T=G.map((n)=>({target:n.id,flag:n.flag,label:j(n.id),probeCommand:n.probeCommand})),S3=new Map(T.map((n)=>[n.flag,n.target]));function pr(n){let t=new Set(n);return T.map((r)=>r.target).filter((r)=>t.has(r))}async function H3(n,t){for(let r of n)await t(r)}var W3=5000;function t5(n){let t=h2([...n],process.env),r=n5(t.cmd,t.args,{env:process.env,stdio:"ignore",timeout:W3});return!r.error&&r.status===0}function ur(n){return new Promise((t)=>{let r=h2([...n],process.env),e=Ni(r.cmd,r.args,{env:process.env,stdio:"ignore"}),a=!1,l=(d)=>{if(a)return;a=!0,clearTimeout(s),t(d)},s=setTimeout(()=>{e.kill(),l(!1)},W3);e.on("error",()=>l(!1)),e.on("close",(d)=>l(d===0))})}function r5(n=t5,t={}){let r=new Set(t.configuredTargets??[]);if(t.async)return Promise.all(T.map(async(a)=>({target:a.target,flag:a.flag,label:a.label,...vr(t.action,await n(a.probeCommand),r.has(a.target))})));let e=n;return T.map((a)=>({target:a.target,flag:a.flag,label:a.label,...vr(t.action,e(a.probeCommand),r.has(a.target))}))}function K3(n=ur,t={}){return r5(n,{...t,async:!0})}function R3(n,t){let r=new Set(t.configuredTargets??[]);return n.map((e)=>({...e,...vr(t.action,e.available,r.has(e.target))}))}function vr(n,t,r){if(n==="uninstall")return r?{available:!0}:{available:!1,unavailableReason:"not installed"};if(n==="install"&&r)return{available:!1,unavailableReason:"already installed"};if(!t)return{available:!1,unavailableReason:"CLI not installed"};return{available:!0}}import{existsSync as V3,readdirSync as e5,rmSync as a5}from"node:fs";import{join as dn}from"node:path";function gt(n,t=process.platform){let r=dn(process.env.npm_config_cache||(t==="win32"?dn(process.env.LOCALAPPDATA||dn(n,"AppData","Local"),"npm-cache"):dn(n,".npm")),"_npx");if(!V3(r))return;e5(r).filter((e)=>V3(dn(r,e,"node_modules","cc-safety-net"))).forEach((e)=>{a5(dn(r,e),{recursive:!0,force:!0})})}import{existsSync as M3,mkdirSync as l5,readFileSync as G3}from"node:fs";import{dirname as s5,join as A3}from"node:path";var Hn="npx -y cc-safety-net hook --kimi-code",br=`[[hooks]]
+`)}`.trim());let n=wl(t.stdout),r=(Array.isArray(n)?n:[]).filter((o)=>b(o,"scope")==="user"&&b(o,"exists")===!0&&b(o,"viewerCanWrite")===!0).map((o)=>b(o,"cloneRef")).find((o)=>typeof o==="string"&&o.length>0);if(!r)throw Error('Your Amp account has no writable Personal Plugins repository. Sign in with "amp login", open Amp once to create it, and rerun install --amp.');return r}async function Cl(e,t){let n=Tf(U(_f(),"cc-safety-net-amp-"));try{return await Nt(e,["amp","clone","user-plugins",n]),await t(n)}finally{xn(n,{recursive:!0,force:!0})}}function po(e){return`rerun ${e==="overwrite"?"install":"uninstall"} --amp`}function kl(e,t,n){let r=U(e,t),o=E(r);if(!o)return;if(o.isSymbolicLink()||!o.isFile())throw Error(`Refusing to ${n} ${t} in your Amp personal plugins repository: not a regular file. Remove it there and ${po(n)}.`);let i=at(r);if(Cn(i))return i;throw Error(`Refusing to ${n} unmanaged file ${t} in your Amp personal plugins repository. Remove it there and ${po(n)}.`)}function Sl(e,t){let n=U(e,Oe),r=E(n);if(!r)return;if(r.isSymbolicLink()||!r.isDirectory())throw Error(`Refusing to ${t} ${Oe} in your Amp personal plugins repository: not a regular directory. Remove it there and ${po(t)}.`);return kl(e,$e,t)}function jf(e){let t=U(e,st),n=E(t);if(!n||n.isSymbolicLink()||!n.isFile())return;let r=at(t);return Cn(r)?r:void 0}async function Dl(e,t,n,r){if(await Nt(e,n,t),(await Nt(e,["git","status","--porcelain"],t)).stdout.trim()==="")return!1;return await Nt(e,["git","-c","commit.gpgsign=false","-c","user.name=cc-safety-net","-c","user.email=cc-safety-net@localhost","commit","-m",r],t),await Nt(e,["git","push","origin","HEAD"],t),!0}function bn(e,t){Uf(e,t),Gf(e,t)}function Rl(e,t){if(t==="keep")return;throw Error(`Local Amp plugin ${e} is not a managed copy and masks the personal plugin. Remove it and rerun install --amp.`)}function Uf(e,t){let n=Ff(e),r=E(n);if(!r)return;if(!r.isSymbolicLink()&&r.isFile()&&Cn(at(n))){xn(n);return}Rl(n,t)}function Gf(e,t){let n=U(e,".config","amp","plugins",Oe),r=E(n);if(!r)return;if(!r.isSymbolicLink()&&r.isDirectory()&&Bf(n)){xn(n,{recursive:!0});return}Rl(n,t)}function Bf(e){let t=Of($e);if(If(e).join("\x00")!==t)return!1;let n=U(e,t),r=E(n);return!!r&&!r.isSymbolicLink()&&r.isFile()&&Cn(at(n))}function qf(){let e=vt();if(!bl(e))return"";let t=wl(at(e,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))return"";return`;globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__ = ${JSON.stringify(wn(t))};
+`}async function Al(e,t=Mf(),n=uo){let r=Buffer.concat([at(t),Buffer.from(qf(),"utf-8")]),o=await xl(n);return Cl(n,async(i)=>{let s=`${o}/${Oe}`,a=Sl(i,"overwrite"),l=kl(i,st,"overwrite");if(a?.equals(r)&&!l)return bn(e,"fail"),{path:s,alreadyInstalled:!0};if(Pf(U(i,Oe),{recursive:!0}),_(U(i,$e),r),l)xn(U(i,st));let c=await Dl(n,i,["git","add","--",$e,...l?[st]:[]],`chore: update cc-safety-net plugin to v${P()}`);return bn(e,"fail"),{path:s,alreadyInstalled:!c}})}async function El(e,t=uo){let n=await xl(t);return Cl(t,async(r)=>{let o=Sl(r,"remove"),i=jf(r),s=`${n}/${i&&!o?st:Oe}`;if(!o&&!i)return bn(e,"keep"),{path:s,alreadyInstalled:!1};return await Dl(t,r,["git","rm","--",...o?[$e]:[],...i?[st]:[]],`chore: remove cc-safety-net plugin v${P()}`),bn(e,"keep"),{path:s,alreadyInstalled:!0}})}import{existsSync as Pl,mkdirSync as Vf,readFileSync as zf}from"node:fs";import{dirname as Kf}from"node:path";var fo="npx -y cc-safety-net hook --agy-cli",we="cc-safety-net";function Sn(){return{PreToolUse:[{hooks:[{type:"command",command:fo,timeout:30}]}]}}function Tl(e){try{let t=JSON.parse(zf(e,"utf-8"));if(!t||typeof t!=="object"||Array.isArray(t))throw Error("Antigravity hooks config must be a JSON object");return t}catch(t){if(t instanceof SyntaxError)throw Error(`Failed to parse Antigravity hooks config ${e}: ${t.message}`);throw t}}function Il(e){let t=e[we];if(t===void 0)return e[we]=Sn(),e[we];if(!t||typeof t!=="object"||Array.isArray(t))throw Error(`Antigravity hooks config entry "${we}" must be an object`);if(!Array.isArray(t.PreToolUse))t.PreToolUse=[];return t}function _l(e){if(!Array.isArray(e.PreToolUse))return!1;return e.PreToolUse.some((t)=>Array.isArray(t.hooks)&&t.hooks.some((n)=>n.command===fo))}function Wf(e){return Object.values(e).some((t)=>t.enabled!==!1&&_l(t))}function Jf(e){if(e[we]===void 0)return!1;let t=Il(e);if(t.enabled!==!1||!_l(t))return!1;return t.enabled=!0,!0}function Yf(e){if(e[we]===void 0){e[we]=Sn();return}let t=Il(e);t.PreToolUse??=[],t.enabled=!0,t.PreToolUse.push(Sn().PreToolUse?.[0]??{hooks:[]})}function Zf(e){let t=!1;for(let n of Object.values(e)){if(!Array.isArray(n.PreToolUse))continue;n.PreToolUse=n.PreToolUse.flatMap((r)=>{if(!Array.isArray(r.hooks))return[r];let o=r.hooks.filter((i)=>i.command!==fo);if(o.length!==r.hooks.length)t=!0;return o.length===0?[]:[{...r,hooks:o}]})}return t}function kn(e,t){_(e,`${JSON.stringify(t,null,2)}
+`)}function Ol(e){let t=Ct(e);if(Vf(Kf(t),{recursive:!0}),!Pl(t))return kn(t,{[we]:Sn()}),{path:t,alreadyInstalled:!1};let n=Tl(t);if(Wf(n))return{path:t,alreadyInstalled:!0};if(Jf(n))return kn(t,n),{path:t,alreadyInstalled:!1};return Yf(n),kn(t,n),{path:t,alreadyInstalled:!1}}function $l(e){let t=Ct(e);if(!Pl(t))return{path:t,alreadyInstalled:!1};let n=Tl(t);if(!Zf(n))return{path:t,alreadyInstalled:!1};return kn(t,n),{path:t,alreadyInstalled:!0}}import{spawn as Xf}from"node:child_process";var se=V.map((e)=>({target:e.id,flag:e.flag,label:R(e.id),probeCommand:e.probeCommand}));function mo(e){let t=new Set(e);return se.map((n)=>n.target).filter((n)=>t.has(n))}async function Nl(e,t){for(let n of e)await t(n)}var Qf=5000;function go(e){return new Promise((t)=>{let n=Pe([...e],process.env),r=Xf(n.cmd,n.args,{env:process.env,stdio:"ignore"}),o=!1,i=(a)=>{if(o)return;o=!0,clearTimeout(s),t(a)},s=setTimeout(()=>{r.kill(),i(!1)},Qf);r.on("error",()=>i(!1)),r.on("close",(a)=>i(a===0))})}function Fl(e=go,t={}){let n=new Set(t.configuredTargets??[]);return Promise.all(se.map(async(r)=>({target:r.target,flag:r.flag,label:r.label,...Ml(t.action,await e(r.probeCommand),n.has(r.target))})))}function Hl(e,t){let n=new Set(t.configuredTargets??[]);return e.map((r)=>({...r,...Ml(t.action,r.available,n.has(r.target))}))}function Ml(e,t,n){if(e==="uninstall")return n?{available:!0}:{available:!1,unavailableReason:"not installed"};if(e==="install"&&n)return{available:!1,unavailableReason:"already installed"};if(!t)return{available:!1,unavailableReason:"CLI not installed"};return{available:!0}}import{existsSync as jl,readdirSync as em,rmSync as tm}from"node:fs";import{join as lt}from"node:path";function Dn(e,t=process.platform){let n=lt(process.env.npm_config_cache||(t==="win32"?lt(process.env.LOCALAPPDATA||lt(e,"AppData","Local"),"npm-cache"):lt(e,".npm")),"_npx");if(!jl(n))return;em(n).filter((r)=>jl(lt(n,r,"node_modules","cc-safety-net"))).forEach((r)=>{tm(lt(n,r),{recursive:!0,force:!0})})}import{existsSync as Gl,mkdirSync as nm,readFileSync as Bl}from"node:fs";import{dirname as rm,join as Ul}from"node:path";var Ft="npx -y cc-safety-net hook --kimi-code",ho=`[[hooks]]
 event = "PreToolUse"
-command = "${Hn}"`,or=`{ event = "PreToolUse", command = "${Hn}" }`;function U3(n){return A3(process.env.KIMI_CODE_HOME??A3(n,".kimi-code"),"config.toml")}function d5(n){return n.split(`
-`).reduce((r,e)=>{if(/^\s*\[/.test(e))return r.activeTable=!0,r.lines.push(e),r;if(!r.activeTable&&/^\s*hooks\s*=\s*\[\s*]\s*(?:#.*)?$/.test(e))return r;return r.lines.push(e),r},{activeTable:!1,lines:[]}).lines.join(`
-`)}function c5(n,t){if(n[t]!=="#")return t;let r=n.indexOf(`
-`,t+1);return r===-1?n.length:r+1}function L5(n,t){return pt(n,t,{skipComment:c5,stringError:"Unterminated string in Kimi Code config",bracketError:"Unmatched hooks array in Kimi Code config"})}function C3(n){let t=!1,r=0;while(r<n.length){let e=n.indexOf(`
-`,r),a=e===-1?n.length:e,l=n.slice(r,a);if(/^\s*\[/.test(l))t=!0;if(!t){let s=/^(\s*)hooks\s*=\s*\[/.exec(l);if(s){let d=r+s[0].lastIndexOf("[");return{start:d,end:L5(n,d)}}}r=e===-1?n.length:e+1}return}function i5(n,t){let r=n.slice(0,t.end).trimEnd(),e=H0(n,t.end),a=e===""?"     ":`${e}  `,l=!r.endsWith("[")&&!r.endsWith(",");return`${r}${l?",":""}
-${a}${or}${n.slice(t.end)}`}function p5(n){let t=C3(n);if(t&&n.slice(t.start+1,t.end).trim())return i5(n,t);let r=d5(n).trimEnd();if(r==="")return`${br}
-`;return`${r}
-
-${br}
-`}function v5(n){return n.split(/(?=^\s*\[)/m).filter((r)=>!/^\s*\[\[hooks]]\s*$/m.test(r)||!r.includes(Hn)).join("").trimEnd()}function u5(n,t){let r=n.indexOf(or,t.start);if(r===-1||r>t.end)return n;return vt(n,{start:r,end:r+or.length})}function O3(n){let t=U3(n);if(l5(s5(t),{recursive:!0}),!M3(t))return Q(t,`${br}
-`),{path:t,alreadyInstalled:!1};let r=G3(t,"utf-8");if(r.includes(Hn))return{path:t,alreadyInstalled:!0};return Q(t,p5(r)),{path:t,alreadyInstalled:!1}}function T3(n){let t=U3(n);if(!M3(t))return{path:t,alreadyInstalled:!1};let r=G3(t,"utf-8");if(!r.includes(Hn))return{path:t,alreadyInstalled:!1};let e=C3(r),a=e?u5(r,e):`${v5(r)}
-`;return Q(t,a),{path:t,alreadyInstalled:!0}}var yr="safety-net@cc-marketplace",_3=new Set(["claude-code","codex","copilot-cli","gemini-cli","hermes-agent","openclaw","opencode","pi"]),E3=new Set(["antigravity-cli","cursor","hermes-agent","kimi-code"]);function wr(n){return/^\s*safety-net@cc-marketplace[^a-z0-9-][^\n]*installed,/m.test(n??"")}function tl(n){return/^\s*cc-safety-net[^a-z0-9-][^\n]*installed,/m.test(n??"")}function o5(n){return/^Marketplace `cc-marketplace`\s*$/m.test(n??"")}var rl={"claude-code":{installCommands:(n)=>{let t=rt(n,"cc-safety-net@cc-marketplace");return{commands:[...t?[["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","update","cc-safety-net@cc-marketplace"]]:[["claude","plugin","marketplace","add","kenryu42/cc-marketplace"],["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","install","cc-safety-net@cc-marketplace"]],...z1(n).status==="disabled"?[["claude","plugin","enable","cc-safety-net@cc-marketplace"]]:[]],cleanupCommands:rt(n,yr)?[["claude","plugin","uninstall",yr]]:[],update:t}},uninstallCommands:[["claude","plugin","uninstall","cc-safety-net@cc-marketplace"],["claude","plugin","marketplace","remove","cc-marketplace"]]},codex:{installCommands:async(n,t)=>{let r=t??await l2(["codex","plugin","list"]),e=tl(r);return{commands:[e||o5(r)?["codex","plugin","marketplace","upgrade","cc-marketplace"]:["codex","plugin","marketplace","add","kenryu42/cc-marketplace"],["codex","plugin","add","cc-safety-net@cc-marketplace"]],cleanupCommands:wr(r)?[["codex","plugin","remove","safety-net@cc-marketplace"]]:[],update:e}},uninstallCommands:[["codex","plugin","remove","cc-safety-net@cc-marketplace"],["codex","plugin","marketplace","remove","cc-marketplace"]],postInstallMessage:"Start Codex, open `/hooks`, select the cc-safety-net PreToolUse hook, and press `t` to trust it."},"copilot-cli":{installCommands:async()=>{let n=await l2(["copilot","plugin","list"]),t=[..._a(n)?[["copilot","plugin","uninstall","copilot-safety-net"]]:[],...Ea(n)?[["copilot","plugin","uninstall",Ca]]:[]];if(Oa(n))return{commands:[["copilot","plugin","marketplace","update","cc-marketplace"],["copilot","plugin","update",a2]],cleanupCommands:t,update:!0};return{commands:[Ta(await l2(["copilot","plugin","marketplace","list"]))?["copilot","plugin","marketplace","update","cc-marketplace"]:["copilot","plugin","marketplace","add","kenryu42/cc-marketplace"],["copilot","plugin","install",a2]],cleanupCommands:t}},uninstallCommands:[["copilot","plugin","uninstall","cc-safety-net@cc-marketplace"],["copilot","plugin","marketplace","remove","cc-marketplace"]]},"gemini-cli":{installCommands:(n)=>{let t=Y1(n);if(t.status==="configured")return{commands:[["gemini","extensions","update","gemini-safety-net"]],update:!0};if(t.status==="disabled")return{commands:[["gemini","extensions","update","gemini-safety-net"],["gemini","extensions","enable","gemini-safety-net"]],update:!0};return{commands:[["gemini","extensions","install","https://github.com/kenryu42/gemini-safety-net","--consent"]]}},uninstallCommands:[["gemini","extensions","uninstall","gemini-safety-net"]]},openclaw:{beforeInstall:T1,installCommands:()=>({commands:F0()}),uninstallCommands:[["openclaw","plugins","uninstall",z,"--force"]],postInstallMessage:["Restart the OpenClaw Gateway to apply the change.","If plugins.allow is set in openclaw.json, it must also list cc-safety-net."].join(`
-`)},opencode:{beforeInstall:P1,installCommands:[["opencode","plugin","-g","-f","cc-safety-net@latest"]]},pi:{installCommands:[["pi","install","npm:cc-safety-net"]],uninstallCommands:[["pi","uninstall","npm:cc-safety-net"]]}};function jt(){return process.env.HOME??b5()}function el(n,t=(r)=>r){try{let r=JSON.parse(t(nl(n,"utf-8")));if(!r||typeof r!=="object"||Array.isArray(r))throw Error(`Settings file ${n} must be a JSON object`);return r}catch(r){if(r instanceof SyntaxError)throw Error(`Failed to parse ${n}: ${r.message}`);throw r}}function f5(n){let t=fr(Fn(n),"settings.json");if(!hr(t))return;let r=el(t,M),e=r.enabledPlugins;if(!e||typeof e!=="object"||Array.isArray(e))return;if(e[a2]!==!1)return;let a=nl(t,"utf-8"),l=a.replace(new RegExp(`("${a2}"\\s*:\\s*)false`),"$1true");return e[a2]=!0,Q(t,l!==a?l:`${JSON.stringify(r,null,2)}
-`),`Enabled ${a2} plugin in ${t}`}function y5(n){let t=I1(n);if(!hr(t))return;let r=el(t);if(!Array.isArray(r.packages))return;let e=r.packages.find((a)=>!!a&&typeof a==="object"&&!Array.isArray(a)&&N1(a.source)&&("extensions"in a));if(!e)return;return delete e.extensions,Q(t,`${JSON.stringify(r,null,2)}
-`),`Enabled npm:cc-safety-net extensions in ${t}`}function P3(n,t){let r=J({label:t,booleans:Object.fromEntries(T.map((l)=>[l.target,[l.flag]]))},n),e=r.errors[0];if(e)throw Error(e);let a=T.filter((l)=>r.flags[l.target]).map((l)=>l.target);if(a.length!==1)throw Error(`Choose exactly one ${t} target: ${[...S3.keys()].join(", ")}`);return a[0]}async function al(n=jt(),t=P2){let[r,e,a]=await Promise.all([t(["amp","plugins","list"],30000),t(["codex","plugin","list"],30000),t(["copilot","--binary-version"])]);return{codexPluginListOutput:e,hooks:an(process.cwd(),{homeDir:n,ampPluginListOutput:r,codexPluginListOutput:e,copilotCliVersion:a})}}async function h5(n,t=P2){let r=await al(jt(),t);return r.hooks.filter((e)=>n==="install"?e.configured:e.detected||e.inspectionStatus==="not-inspected").filter((e)=>e.platform!=="codex"||!wr(r.codexPluginListOutput)||tl(r.codexPluginListOutput)).map((e)=>e.platform)}function w5(n,t,r){if(t.length>0)return{finish:async()=>[P3(t,n)]};if(!r.selectTargets&&!sr(r.input,r.output))return{finish:async()=>[P3(t,n)]};let e=r.detectConfiguredTargets??(()=>h5(n,r.fetchVersion)),a=Promise.all([K3(r.probeTargets),e()]);return{ready:a,finish:async()=>{let[l,s]=await a,d=R3(l,{action:n,configuredTargets:s}),c=r.selectTargets?await r.selectTargets(n,N3(n,d)):await h3(n,N3(n,d),{input:r.input,output:r.output});if(c==="update")return c;if(!c||c.length===0)return null;return pr(c)}}}async function Y2(n,t,r=!1,e){let a=rl[n];a.beforeInstall?.(t);let l=typeof a.installCommands==="function"?await a.installCommands(t,e):{commands:a.installCommands};return await U1(l.commands),await m0(l.cleanupCommands??[]),[`${l.update||r?"Updated":"Installed"} ${j(n)} integration`,a.postInstallMessage].filter(Boolean).join(`
-`)}async function cn(n){let t=rl[n];if(!t.uninstallCommands)throw Error(`${j(n)} uninstall is not supported`);return await U1(t.uninstallCommands),`Uninstalled ${j(n)} integration`}function x5(n){let t=T0(n);return t.alreadyInstalled?`Uninstalled OpenCode plugin from ${t.path}`:`OpenCode plugin not installed in ${t.path}`}var $5={"antigravity-cli":{install:X3,uninstall:Y3},cursor:{install:s0,uninstall:d0},"kimi-code":{install:O3,uninstall:T3}};function Ln(n,t,r,e=!1){if(n==="install"&&!e)gt(r);let a=$5[t][n](r),l=j(t),s=n!=="install"?"Uninstalled":e?"Updated":"Installed";return n==="install"&&a.alreadyInstalled?e?`${l} hook up to date in ${a.path}`:`${l} hook already installed in ${a.path}`:n==="uninstall"&&!a.alreadyInstalled?`${l} hook not installed in ${a.path}`:`${s} ${l} hook ${n==="install"?"in":"from"} ${a.path}`}var D5={amp:{install:z3,uninstall:F3,restartNote:'Amp personal plugins apply to every Amp session, including Orb threads. Restart Amp or run "plugins: reload" to apply the change.'},"hermes-agent":{install:u0,uninstall:b0,afterInstall:async(n)=>{let t=A1(n);return await l2(["hermes","plugins","enable",U,"--no-allow-tool-override"]),!t},beforeUninstall:async(n)=>{V1(n);try{await l2(["hermes","plugins","disable",U])}catch(t){console.warn(`${t instanceof Error?t.message:String(t)}
-Removing the plugin files anyway; ${U} may still be listed in the Hermes config.`)}},restartNote:"Restart Hermes to apply the change."}};async function kt(n,t,r,e=!1){let a=D5[t];if(n==="uninstall")await a.beforeUninstall?.(r);let l=n==="install"?await a.install(r):await a.uninstall(r),s=n==="install"&&await a.afterInstall?.(r),d=j(t),c=!s&&(n==="install"&&l.alreadyInstalled||n==="uninstall"&&!l.alreadyInstalled);return[c?n==="install"?`${d} plugin ${e?"up to date":"already installed"} at ${l.path}`:`${d} plugin not installed at ${l.path}`:`${n!=="install"?"Uninstalled":e?"Updated":"Installed"} ${d} plugin ${n==="install"?"at":"from"} ${l.path}`,c?void 0:a.restartNote].filter(Boolean).join(`
-`)}var m5={amp:{install:(n,t)=>kt("install","amp",n,t),uninstall:(n)=>kt("uninstall","amp",n)},"antigravity-cli":{install:(n,t)=>Ln("install","antigravity-cli",n,t),uninstall:(n)=>Ln("uninstall","antigravity-cli",n)},"claude-code":{install:(n,t)=>Y2("claude-code",n,t),uninstall:()=>cn("claude-code")},codex:{install:(n,t,r)=>Y2("codex",n,t,r),uninstall:()=>cn("codex")},"copilot-cli":{install:async(n,t)=>[await Y2("copilot-cli",n,t),f5(n)].filter(Boolean).join(`
-`),uninstall:()=>cn("copilot-cli")},cursor:{install:(n,t)=>Ln("install","cursor",n,t),uninstall:(n)=>Ln("uninstall","cursor",n)},"gemini-cli":{install:(n,t)=>Y2("gemini-cli",n,t),uninstall:()=>cn("gemini-cli")},"hermes-agent":{install:(n,t)=>{if(!t)gt(n);return kt("install","hermes-agent",n,t)},uninstall:(n)=>kt("uninstall","hermes-agent",n)},"kimi-code":{install:(n,t)=>Ln("install","kimi-code",n,t),uninstall:(n)=>Ln("uninstall","kimi-code",n)},openclaw:{install:async(n,t)=>{let r=await Y2("openclaw",n,t);return await B0(),r},uninstall:(n)=>{return T1(n),cn("openclaw")}},opencode:{install:async(n,t)=>{let r=await Y2("opencode",n,t);return await G0(n),r},uninstall:(n)=>x5(n)},pi:{install:async(n,t)=>[await Y2("pi",n,t),y5(n)].filter(Boolean).join(`
-`),uninstall:()=>cn("pi")}},I3=["Install CC Safety Net as a native Kimi Code plugin:","","  1. Start Kimi Code and run: /plugins install https://github.com/kenryu42/cc-safety-net","     Confirm the trust prompt; it defaults to cancel.","  2. Run /reload, or start a new session.","","Note: Kimi Code hooks are fail-open. When the hook process cannot start, crashes, or times","out, Kimi Code allows the tool call."].join(`
-`);function g5(n){if(Zn({homeDir:n,cwd:process.cwd()}).status!=="configured")return I3;return[I3,"",o.red(["CAUTION: the global Kimi Code hook is installed and will run alongside the plugin.","After the plugin is active, remove it with: cc-safety-net uninstall --kimi-code"].join(`
+command = "${Ft}"`,yo=`{ event = "PreToolUse", command = "${Ft}" }`;function ql(e){return Ul(process.env.KIMI_CODE_HOME??Ul(e,".kimi-code"),"config.toml")}function om(e){return e.split(`
+`).reduce((n,r)=>{if(/^\s*\[/.test(r))return n.activeTable=!0,n.lines.push(r),n;if(!n.activeTable&&/^\s*hooks\s*=\s*\[\s*]\s*(?:#.*)?$/.test(r))return n;return n.lines.push(r),n},{activeTable:!1,lines:[]}).lines.join(`
+`)}function im(e,t){if(e[t]!=="#")return t;let n=e.indexOf(`
+`,t+1);return n===-1?e.length:n+1}function sm(e,t){return fn(e,t,{skipComment:im,stringError:"Unterminated string in Kimi Code config",bracketError:"Unmatched hooks array in Kimi Code config"})}function Vl(e){let t=!1,n=0;while(n<e.length){let r=e.indexOf(`
+`,n),o=r===-1?e.length:r,i=e.slice(n,o);if(/^\s*\[/.test(i))t=!0;if(!t){let s=/^(\s*)hooks\s*=\s*\[/.exec(i);if(s){let a=n+s[0].lastIndexOf("[");return{start:a,end:sm(e,a)}}}n=r===-1?e.length:r+1}return}function am(e,t){let n=e.slice(0,t.end).trimEnd(),r=Fa(e,t.end),o=r===""?"     ":`${r}  `,i=!n.endsWith("[")&&!n.endsWith(",");return`${n}${i?",":""}
+${o}${yo}${e.slice(t.end)}`}function lm(e){let t=Vl(e);if(t&&e.slice(t.start+1,t.end).trim())return am(e,t);let n=om(e).trimEnd();if(n==="")return`${ho}
+`;return`${n}
+
+${ho}
+`}function cm(e){return e.split(/(?=^\s*\[)/m).filter((n)=>!/^\s*\[\[hooks]]\s*$/m.test(n)||!n.includes(Ft)).join("").trimEnd()}function dm(e,t){let n=e.indexOf(yo,t.start);if(n===-1||n>t.end)return e;return mn(e,{start:n,end:n+yo.length})}function zl(e){let t=ql(e);if(nm(rm(t),{recursive:!0}),!Gl(t))return _(t,`${ho}
+`),{path:t,alreadyInstalled:!1};let n=Bl(t,"utf-8");if(n.includes(Ft))return{path:t,alreadyInstalled:!0};return _(t,lm(n)),{path:t,alreadyInstalled:!1}}function Kl(e){let t=ql(e);if(!Gl(t))return{path:t,alreadyInstalled:!1};let n=Bl(t,"utf-8");if(!n.includes(Ft))return{path:t,alreadyInstalled:!1};let r=Vl(n),o=r?dm(n,r):`${cm(n)}
+`;return _(t,o),{path:t,alreadyInstalled:!0}}var vo="safety-net@cc-marketplace",Wl=new Set(["claude-code","codex","copilot-cli","gemini-cli","hermes-agent","openclaw","opencode","pi"]),Jl=new Set(["antigravity-cli","cursor","hermes-agent","kimi-code"]);function wo(e){return/^\s*safety-net@cc-marketplace[^a-z0-9-][^\n]*installed,/m.test(e??"")}function ec(e){return/^\s*cc-safety-net[^a-z0-9-][^\n]*installed,/m.test(e??"")}function pm(e){return/^Marketplace `cc-marketplace`\s*$/m.test(e??"")}var tc={"claude-code":{installCommands:(e)=>{let t=rn(e,"cc-safety-net@cc-marketplace");return{commands:[...t?[["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","update","cc-safety-net@cc-marketplace"]]:[["claude","plugin","marketplace","add","kenryu42/cc-marketplace"],["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","install","cc-safety-net@cc-marketplace"]],...Pr(e).status==="disabled"?[["claude","plugin","enable","cc-safety-net@cc-marketplace"]]:[]],cleanupCommands:rn(e,vo)?[["claude","plugin","uninstall",vo]]:[],update:t}},uninstallCommands:[["claude","plugin","uninstall","cc-safety-net@cc-marketplace"],["claude","plugin","marketplace","remove","cc-marketplace"]]},codex:{installCommands:async(e,t)=>{let n=t??await ie(["codex","plugin","list"]),r=ec(n);return{commands:[r||pm(n)?["codex","plugin","marketplace","upgrade","cc-marketplace"]:["codex","plugin","marketplace","add","kenryu42/cc-marketplace"],["codex","plugin","add","cc-safety-net@cc-marketplace"]],cleanupCommands:wo(n)?[["codex","plugin","remove","safety-net@cc-marketplace"]]:[],update:r}},uninstallCommands:[["codex","plugin","remove","cc-safety-net@cc-marketplace"],["codex","plugin","marketplace","remove","cc-marketplace"]],postInstallMessage:"Start Codex, open `/hooks`, select the cc-safety-net PreToolUse hook, and press `t` to trust it."},"copilot-cli":{installCommands:async()=>{let e=await ie(["copilot","plugin","list"]),t=[...Js(e)?[["copilot","plugin","uninstall","copilot-safety-net"]]:[],...Ys(e)?[["copilot","plugin","uninstall",zs]]:[]];if(Ks(e))return{commands:[["copilot","plugin","marketplace","update","cc-marketplace"],["copilot","plugin","update",oe]],cleanupCommands:t,update:!0};return{commands:[Ws(await ie(["copilot","plugin","marketplace","list"]))?["copilot","plugin","marketplace","update","cc-marketplace"]:["copilot","plugin","marketplace","add","kenryu42/cc-marketplace"],["copilot","plugin","install",oe]],cleanupCommands:t}},uninstallCommands:[["copilot","plugin","uninstall","cc-safety-net@cc-marketplace"],["copilot","plugin","marketplace","remove","cc-marketplace"]]},"gemini-cli":{installCommands:(e)=>{let t=Fr(e);if(t.status==="configured")return{commands:[["gemini","extensions","update","gemini-safety-net"]],update:!0};if(t.status==="disabled")return{commands:[["gemini","extensions","update","gemini-safety-net"],["gemini","extensions","enable","gemini-safety-net"]],update:!0};return{commands:[["gemini","extensions","install","https://github.com/kenryu42/gemini-safety-net","--consent"]]}},uninstallCommands:[["gemini","extensions","uninstall","gemini-safety-net"]]},openclaw:{beforeInstall:Yr,installCommands:()=>({commands:Ea()}),uninstallCommands:[["openclaw","plugins","uninstall",A,"--force"]],postInstallMessage:["Restart the OpenClaw Gateway to apply the change.","If plugins.allow is set in openclaw.json, it must also list cc-safety-net."].join(`
+`)},opencode:{beforeInstall:Qr,installCommands:[["opencode","plugin","-g","-f","cc-safety-net@latest"]]},pi:{installCommands:[["pi","install","npm:cc-safety-net"]],uninstallCommands:[["pi","uninstall","npm:cc-safety-net"]]}};function En(){return process.env.HOME??um()}function nc(e,t=(n)=>n){try{let n=JSON.parse(t(Ql(e,"utf-8")));if(!n||typeof n!=="object"||Array.isArray(n))throw Error(`Settings file ${e} must be a JSON object`);return n}catch(n){if(n instanceof SyntaxError)throw Error(`Failed to parse ${e}: ${n.message}`);throw n}}function fm(e){let t=Lo(Et(e),"settings.json");if(!bo(t))return;let n=nc(t,q),r=n.enabledPlugins;if(!r||typeof r!=="object"||Array.isArray(r))return;if(r[oe]!==!1)return;let o=Ql(t,"utf-8"),i=o.replace(new RegExp(`("${oe}"\\s*:\\s*)false`),"$1true");return r[oe]=!0,_(t,i!==o?i:`${JSON.stringify(n,null,2)}
+`),`Enabled ${oe} plugin in ${t}`}function mm(e){let t=eo(e);if(!bo(t))return;let n=nc(t);if(!Array.isArray(n.packages))return;let r=n.packages.find((o)=>!!o&&typeof o==="object"&&!Array.isArray(o)&&to(o.source)&&("extensions"in o));if(!r)return;return delete r.extensions,_(t,`${JSON.stringify(n,null,2)}
+`),`Enabled npm:cc-safety-net extensions in ${t}`}function Yl(e,t){let n=T({label:t,booleans:Object.fromEntries(se.map((i)=>[i.target,[i.flag]]))},e),r=n.errors[0];if(r)throw Error(r);let o=se.filter((i)=>n.flags[i.target]).map((i)=>i.target);if(o.length!==1)throw Error(`Choose exactly one ${t} target: ${se.map((i)=>i.flag).join(", ")}`);return o[0]}async function rc(e=En(),t=Xe){let[n,r,o]=await Promise.all([t(["amp","plugins","list"],30000),t(["codex","plugin","list"],30000),t(["copilot","--binary-version"])]);return{codexPluginListOutput:r,hooks:it(process.cwd(),{homeDir:e,ampPluginListOutput:n,codexPluginListOutput:r,copilotCliVersion:o})}}async function gm(e,t=Xe){let n=await rc(En(),t);return n.hooks.filter((r)=>e==="install"?r.configured:r.detected||r.inspectionStatus==="not-inspected").filter((r)=>r.platform!=="codex"||!wo(n.codexPluginListOutput)||ec(n.codexPluginListOutput)).map((r)=>r.platform)}function hm(e,t,n){if(t.length>0)return{finish:async()=>[Yl(t,e)]};if(!n.selectTargets&&!lo(n.input,n.output))return{finish:async()=>[Yl(t,e)]};let r=n.detectConfiguredTargets??(()=>gm(e,n.fetchVersion)),o=Promise.all([Fl(n.probeTargets),r()]);return{ready:o,finish:async()=>{let[i,s]=await o,a=Hl(i,{action:e,configuredTargets:s}),l=n.selectTargets?await n.selectTargets(e,Xl(e,a)):await Ll(e,Xl(e,a),{input:n.input,output:n.output});if(l==="update")return l;if(!l||l.length===0)return null;return mo(l)}}}async function Ne(e,t,n=!1,r){let o=tc[e];o.beforeInstall?.(t);let i=typeof o.installCommands==="function"?await o.installCommands(t,r):{commands:o.installCommands};return await Kr(i.commands),await Ca(i.cleanupCommands??[]),[`${i.update||n?"Updated":"Installed"} ${R(e)} integration`,o.postInstallMessage].filter(Boolean).join(`
+`)}async function ct(e){let t=tc[e];if(!t.uninstallCommands)throw Error(`${R(e)} uninstall is not supported`);return await Kr(t.uninstallCommands),`Uninstalled ${R(e)} integration`}function ym(e){let t=Wa(e);return t.alreadyInstalled?`Uninstalled OpenCode plugin from ${t.path}`:`OpenCode plugin not installed in ${t.path}`}var Lm={"antigravity-cli":{install:Ol,uninstall:$l},cursor:{install:sa,uninstall:aa},"kimi-code":{install:zl,uninstall:Kl}};function dt(e,t,n,r=!1){if(e==="install"&&!r)Dn(n);let o=Lm[t][e](n),i=R(t),s=e!=="install"?"Uninstalled":r?"Updated":"Installed";return e==="install"&&o.alreadyInstalled?r?`${i} hook up to date in ${o.path}`:`${i} hook already installed in ${o.path}`:e==="uninstall"&&!o.alreadyInstalled?`${i} hook not installed in ${o.path}`:`${s} ${i} hook ${e==="install"?"in":"from"} ${o.path}`}var vm={amp:{install:Al,uninstall:El,restartNote:'Amp personal plugins apply to every Amp session, including Orb threads. Restart Amp or run "plugins: reload" to apply the change.'},"hermes-agent":{install:fa,uninstall:ma,afterInstall:async(e)=>{let t=qr(e);return await ie(["hermes","plugins","enable",z,"--no-allow-tool-override"]),!t},beforeUninstall:async(e)=>{Br(e);try{await ie(["hermes","plugins","disable",z])}catch(t){console.warn(`${t instanceof Error?t.message:String(t)}
+Removing the plugin files anyway; ${z} may still be listed in the Hermes config.`)}},restartNote:"Restart Hermes to apply the change."}};async function Rn(e,t,n,r=!1){let o=vm[t];if(e==="uninstall")await o.beforeUninstall?.(n);let i=e==="install"?await o.install(n):await o.uninstall(n),s=e==="install"&&await o.afterInstall?.(n),a=R(t),l=!s&&(e==="install"&&i.alreadyInstalled||e==="uninstall"&&!i.alreadyInstalled);return[l?e==="install"?`${a} plugin ${r?"up to date":"already installed"} at ${i.path}`:`${a} plugin not installed at ${i.path}`:`${e!=="install"?"Uninstalled":r?"Updated":"Installed"} ${a} plugin ${e==="install"?"at":"from"} ${i.path}`,l?void 0:o.restartNote].filter(Boolean).join(`
+`)}var bm={amp:{install:(e,t)=>Rn("install","amp",e,t),uninstall:(e)=>Rn("uninstall","amp",e)},"antigravity-cli":{install:(e,t)=>dt("install","antigravity-cli",e,t),uninstall:(e)=>dt("uninstall","antigravity-cli",e)},"claude-code":{install:(e,t)=>Ne("claude-code",e,t),uninstall:()=>ct("claude-code")},codex:{install:(e,t,n)=>Ne("codex",e,t,n),uninstall:()=>ct("codex")},"copilot-cli":{install:async(e,t)=>[await Ne("copilot-cli",e,t),fm(e)].filter(Boolean).join(`
+`),uninstall:()=>ct("copilot-cli")},cursor:{install:(e,t)=>dt("install","cursor",e,t),uninstall:(e)=>dt("uninstall","cursor",e)},"gemini-cli":{install:(e,t)=>Ne("gemini-cli",e,t),uninstall:()=>ct("gemini-cli")},"hermes-agent":{install:(e,t)=>{if(!t)Dn(e);return Rn("install","hermes-agent",e,t)},uninstall:(e)=>Rn("uninstall","hermes-agent",e)},"kimi-code":{install:(e,t)=>dt("install","kimi-code",e,t),uninstall:(e)=>dt("uninstall","kimi-code",e)},openclaw:{install:async(e,t)=>{let n=await Ne("openclaw",e,t);return await Pa(),n},uninstall:(e)=>(Yr(e),ct("openclaw"))},opencode:{install:async(e,t)=>{let n=await Ne("opencode",e,t);return await qa(e),n},uninstall:(e)=>ym(e)},pi:{install:async(e,t)=>[await Ne("pi",e,t),mm(e)].filter(Boolean).join(`
+`),uninstall:()=>ct("pi")}},Zl=["Install CC Safety Net as a native Kimi Code plugin:","","  1. Start Kimi Code and run: /plugins install https://github.com/kenryu42/cc-safety-net","     Confirm the trust prompt; it defaults to cancel.","  2. Run /reload, or start a new session.","","Note: Kimi Code hooks are fail-open. When the hook process cannot start, crashes, or times","out, Kimi Code allows the tool call."].join(`
+`);function wm(e){if(It({homeDir:e,cwd:process.cwd()}).status!=="configured")return Zl;return[Zl,"",g.red(["CAUTION: the global Kimi Code hook is installed and will run alongside the plugin.","After the plugin is active, remove it with: cc-safety-net uninstall --kimi-code"].join(`
 `))].join(`
-`)}function N3(n,t){return t.map((r)=>n==="install"&&r.target==="kimi-code"&&r.unavailableReason==="already installed"?{...r,available:!0,unavailableReason:void 0,label:`${r.label} (global hook installed)`}:r)}function k5(n,t){if(n.selectKimiInstallMethod)return n.selectKimiInstallMethod();if(!sr(n.input,n.output))return Promise.resolve("global-hook");return y3({input:n.input,output:n.output,globalHookInstalled:Zn({homeDir:t,cwd:process.cwd()}).status==="configured"})}async function ll(n,t,r,e=!1,a){return m5[t][n](r,e,a)}function q5(n){let t=J({label:"update"},n).errors[0];if(t)throw Error(t)}async function j5(n,t=P2){let r=await al(n,t),e=fr(Fn(n),"installed-plugins");return{targets:pr([...r.hooks.filter((l)=>l.platform!=="copilot-cli"&&l.detected).map((l)=>l.platform),...[et,Ua,Ga].flatMap((l)=>hr(fr(e,...l))?["copilot-cli"]:[]),...rt(n,yr)?["claude-code"]:[],...wr(r.codexPluginListOutput)?["codex"]:[]]),codexPluginListOutput:r.codexPluginListOutput}}async function z5(n){let t=jt(),r=n.output??process.stdout,e=j5(t,n.fetchVersion??P2).then(async(d)=>{let c=new Set(d.targets);return{targets:d.targets,codexPluginListOutput:d.codexPluginListOutput,available:new Map(await Promise.all(T.filter((L)=>c.has(L.target)&&_3.has(L.target)).map(async(L)=>[L.target,await ur(L.probeCommand)])))}}),a=await jn(n.showBanner??!0,()=>({ready:e,finish:()=>e}),()=>qn({input:n.input??process.stdin,output:r}),{loadingMessage:"Checking installed integrations…",output:r});if(a.targets.length===0)return r.write("No installed integrations found. Run `cc-safety-net install` to set one up.\n"),0;let l=a.targets.some((d)=>E3.has(d))?await Promise.resolve().then(()=>{return gt(t),null}).catch((d)=>qt(d)):null,s=await Nn(Promise.all(a.targets.map((d)=>{if(_3.has(d)&&!a.available.get(d))return Promise.resolve({message:`${j(d)} not found; skipped`,failed:!1});if(l!==null&&E3.has(d))return Promise.resolve({message:l,failed:!0});return ll("install",d,t,!0,a.codexPluginListOutput).then((c)=>({message:c,failed:!1}),(c)=>({message:qt(c),failed:!0}))})),{loadingMessage:`Updating ${a.targets.length} integration${a.targets.length===1?"":"s"}…`,output:r});return s.forEach((d)=>{d.failed?console.error(d.message):r.write(`${d.message}
-`)}),s.some((d)=>d.failed)?1:0}function xr(n,t={}){return Promise.resolve().then(()=>q5(n)).then(()=>z5(t)).catch((r)=>{return console.error(qt(r)),1})}async function Wn(n,t,r={}){try{let e=await jn(!0,()=>w5(n,t,r),()=>qn({input:r.input??process.stdin,output:r.output??process.stdout}),{loadingMessage:n==="install"?"Checking available integrations…":"Checking installed integrations…",output:r.output??process.stdout});if(!e)return(r.output??process.stdout).write(`Cancelled: nothing was ${n}ed.
-`),0;if(e==="update")return(r.runUpdate??(()=>xr([],{fetchVersion:r.fetchVersion,input:r.input,output:r.output,showBanner:!1})))();let a=jt(),l=r.output??process.stdout;return await H3(e,async(s)=>{if(s==="kimi-code"&&n==="install"){let c=await k5(r,a);if(c===null){l.write(`Cancelled: Kimi Code integration was not installed.
-`);return}if(c==="plugin"){l.write(`${g5(a)}
-`);return}}let d=await Nn(ll(n,s,a),{loadingMessage:`${n==="install"?"Installing":"Uninstalling"} ${j(s)} integration…`,output:l});l.write(`${d}
-`)}),0}catch(e){return console.error(qt(e)),1}}function qt(n){let t=n instanceof Error?n.message:String(n),r=typeof n==="object"&&n!==null&&"code"in n?n.code:null;if(r==="EACCES"||r==="EPERM")return`${t}
-Check file permissions for the target config file and parent directory.`;if(r==="ENOENT")return`${t}
-Check that the target config path and parent directory exist.`;if(r==="ENOTDIR")return`${t}
-Check that every parent path component is a directory.`;return t}import{join as v8}from"node:path";var sl="# Custom Rules Reference\n\nAgent reference for generating CC Safety Net rulebook configuration.\n\n## Config Locations\n\n| Scope | Config path | Rulebook path | Cache path | Priority |\n|-------|-------------|---------------|------------|----------|\n| User | `~/.cc-safety-net/rules/rule.json` | `~/.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `~/.cc-safety-net/cache/rulebooks/` | First |\n| Project | `.cc-safety-net/rules/rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `.cc-safety-net/cache/rulebooks/` | Second |\n| GitHub source | Listed in a local `rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` in the source repository | Consumer local cache | Source order |\n\nUser scope is evaluated before project scope; within a scope, sources apply in `rules` array order. A duplicate active rulebook name keeps the first claim and ignores the later rulebook with a warning, so a user-scoped name shadows a project-scoped one.\n\nUse `cc-safety-net rule init` to create an inert local config. Use `--global` for user scope. Use `cc-safety-net rule init --example` to also create an inactive example rulebook. `CC_SAFETY_NET_HOME` overrides the `~/.cc-safety-net` user root.\n\nLegacy inline `.safety-net.json` and `~/.cc-safety-net/config.json` files are not loaded at runtime. Convert them with `cc-safety-net rule migrate`.\n\n## rule.json Schema\n\n```json\n{\n  \"version\": 1,\n  \"rules\": [\"project-rules\", \"owner/repo#main/team-rules\"],\n  \"overrides\": {\n    \"project-rules/block-docker-system-prune\": {\n      \"reason\": \"Use targeted Docker cleanup commands.\"\n    },\n    \"team-rules/block-npm-global\": \"off\"\n  },\n  \"transparent_wrappers\": [\"rtk\"]\n}\n```\n\n- `version`: Required. Must be `1`.\n- `$schema`: Optional. `cc-safety-net rule verify` inserts it into a valid `rule.json` that lacks it.\n- `rules`: Optional array of rulebook source strings. Missing `rules` is treated as `[]`.\n- `overrides`: Optional object keyed by `<rulebook-name>/<rule-name>`.\n- `overrides` values are either `\"off\"` to disable a rule or an object with a required `reason` (replacement block reason) and an optional `intent` (one of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain`).\n- A project override cannot target a user-scoped rule: only that override is ignored, the user rule keeps its configured state, and `rule sync`/`rule verify` report the diagnostic as a failure.\n- `transparent_wrappers`: Optional array of command names that transparently execute a visible child command.\n- Transparent wrappers have no built-in defaults. Configure only wrappers you intentionally trust, such as `\"rtk\"`.\n- Use `cc-safety-net rule wrapper add rtk` to configure RTK without manually editing `rule.json`.\n\n## Rulebook Sources\n\n- Local sources are bare rulebook names such as `project-rules`; the rulebook file is `.cc-safety-net/rules/project-rules/rulebook.json`.\n- GitHub sources use `owner/repo#ref/<rulebook-name>`.\n- GitHub refs must be one path segment, such as a tag, SHA, or branch name without `/`.\n- The GitHub source name, the repository directory name, and the rulebook `name` must match exactly.\n- Rulebook source strings must be unique in a config.\n\n## rulebook.json Schema\n\n```json\n{\n  \"rulebook_version\": 1,\n  \"name\": \"project-rules\",\n  \"version\": \"1.0.0\",\n  \"description\": \"Project-specific CC Safety Net rules.\",\n  \"author\": \"project\",\n  \"allowed_commands\": [\"docker\"],\n  \"rules\": [\n    {\n      \"name\": \"block-docker-system-prune\",\n      \"command\": \"docker\",\n      \"subcommand\": \"system\",\n      \"block_args\": [\"prune\"],\n      \"reason\": \"Use targeted cleanup instead.\"\n    }\n  ],\n  \"tests\": [\n    {\n      \"command\": \"docker system prune\",\n      \"expect\": \"blocked\",\n      \"rule\": \"block-docker-system-prune\"\n    },\n    {\n      \"command\": \"docker ps\",\n      \"expect\": \"allowed\"\n    }\n  ]\n}\n```\n\n### Rulebook Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `rulebook_version` | Yes | Must be `1` |\n| `name` | Yes | `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$` |\n| `version` | Yes | Non-empty string |\n| `description` | No | Free text; not type-checked at runtime |\n| `author` | No | Free text; not type-checked at runtime |\n| `allowed_commands` | Yes | Unique command names matching `^[a-zA-Z][a-zA-Z0-9_-]*$` |\n| `rules` | Yes | Array of rule objects |\n| `tests` | No | Array of fixtures |\n\n### Rule Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Unique within the rulebook (case-insensitive); same pattern as rulebook `name` |\n| `command` | Yes | Must be listed in `allowed_commands`; basename only, not path |\n| `subcommand` | No | Same pattern as `command`; omit to match any subcommand |\n| `intent` | No | One of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain` |\n| `block_args` | Yes | Non-empty array of non-empty strings |\n| `reason` | Yes | Non-empty string, max 256 chars |\n\n### Test Fixture Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `command` | Yes | Non-empty shell command string |\n| `expect` | Yes | `\"blocked\"` or `\"allowed\"` |\n| `rule` | Required for blocked fixtures | Rule name expected to block the command |\n\nFixtures are optional documentation of intended behavior. Fixtures are shape-validated only; CC Safety Net does not execute them.\n\n## Matching Behavior\n\n- **Command**: Normalized to lowercase basename with any trailing `.exe` removed (`/usr/bin/git` → `git`).\n- **Subcommand**: The first command token after recognized Git and Docker global options and their values; `--` ends option parsing. An unrecognized option without `=` may consume the following token as its value.\n- **Arguments**: Each `block_args` value is compared literally against every command token, including expanded short options. The command is blocked if **any** item matches.\n- **Short options**: Expanded (`-Ap` matches `-A`).\n- **Long options**: Exact match (`--all-files` does not match `--all`).\n- **Execution order**: Built-in rules first, then custom rulebooks. Custom rules only add restrictions.\n- **Transparent wrappers**: A configured wrapper such as `rtk` lets `rtk git commit` be analyzed as `git commit` only when `git` is protected by built-in analyzers or active custom rules. `rtk -- git commit` is also supported.\n\n## Workflow\n\n1. Run `cc-safety-net rule init` or create `rule.json` manually.\n2. Optionally run `cc-safety-net rule init --example` to create an inactive example rulebook.\n3. Use `cc-safety-net rule wrapper add rtk` for trusted transparent wrappers.\n4. Run `cc-safety-net rule add <source>` after creating or choosing a rulebook source; it adds the source and syncs it.\n5. Run `cc-safety-net rule sync` after manual `rule.json` changes or local rulebook edits.\n6. Run `cc-safety-net rule verify` to validate config, lock/cache state, local rulebooks, and shareable GitHub-source rulebook directories in the current repository (it does not fetch remote content).\n7. Run `cc-safety-net rule list` to inspect active rulebooks and transparent wrappers.\n\nAn edited or invalid local rulebook keeps its last synced, digest-verified cached version enforced until `cc-safety-net rule sync` validates the edit. A missing lock entry or cache, a cache digest mismatch, or an invalid cached rulebook makes that source inactive; a missing lockfile or an unreadable or invalid `rule.json` makes every source in its scope inactive. Inactive sources stop applying their rules while other custom rules and all built-in protections stay active. Repair the reported condition, then run `cc-safety-net rule sync`. Run `cc-safety-net status` to see degraded sources.\n";function Kn(n,t){if(!n.ok){Z5(n);return}Q5(n),console.log(t),console.log("Rule config synced."),console.log(""),F5(n.entries)}function F5(n){if(n.length===0){console.log("Active rulebooks: (none)");return}console.log(`Active rulebooks (${n.length}):`);for(let t of n)console.log(`  - ${t.name} ${t.version} (${B5(t.ruleCount??0)})`),console.log(`    Source: ${t1(t)}`)}function B5(n){return`${n} ${n===1?"rule":"rules"}`}function cl(n,t){S2("Active sources",n.rulebooks,(r)=>[`[${r.source}] ${r.name} ${r.version}`,`  Source: ${t[r.source].get(r.spec)??r.spec}`]),S2("Active rules",n.rules,(r)=>[`[${J5(n,r.name)}] ${r.name}`,`  Command: ${r.subcommand?`${r.command} ${r.subcommand}`:r.command}`,`  Block args: ${r.block_args.join(", ")}`,`  Reason: ${r.reason}`]),S2("Disabled rules",dl(n,"off"),(r)=>[r.key]),S2("Reason overrides",dl(n,"reason"),(r)=>[r.key,`  Reason: ${r.value.reason}`]),S2("Transparent wrappers",n.transparent_wrappers,(r)=>[r]),S2("Issues",n.errors,(r)=>[r]),S2("Warnings",n.warnings,(r)=>[r])}function S2(n,t,r){if(t.length===0){console.log(`${n}: (none)`);return}console.log(`${n} (${t.length}):`);for(let e of t){let[a,...l]=r(e);console.log(`  - ${a}`);for(let s of l)console.log(`    ${s}`)}}function J5(n,t){return n.rulebooks.find((r)=>r.rules.includes(t))?.source??"project"}function dl(n,t){return Object.entries({...n.userConfig?.overrides??{},...n.projectConfig?.overrides??{}}).filter((r)=>{if(t==="off")return r[1]==="off";return!!r[1]&&typeof r[1]==="object"}).map(([r,e])=>({key:r,value:e}))}function Z5(n){for(let t of n.errors)console.error(t)}function Q5(n){if(!n.warnings||n.warnings.length===0)return;for(let t of n.warnings)console.warn(t)}import{dirname as Ll,join as zt}from"node:path";var X5=".safety-net.json",Y5="~/.cc-safety-net/config.json";async function vl(n){return[await il({legacyPath:pl({cwd:n.cwd}),configPath:I(n.cwd),defaultRulebookName:"project-rules",migratedFrom:X5,cleanup:n.cleanup,syncOptions:{cwd:n.cwd}}),await il({legacyPath:on(),configPath:N(),defaultRulebookName:"user-rules",migratedFrom:Y5,cleanup:n.cleanup,syncOptions:{cwd:n.cwd,global:!0}})].every((r)=>r)?0:1}async function il(n){let t=_(n.syncOptions),r=g(t.filesystemScope,n.legacyPath),e=D(r);if(e===null)return console.log(`No legacy config found at ${n.legacyPath}`),!0;let a=H5(e);if(!a.ok){for(let b of a.errors)console.error(b);return!1}let l=E(t.configTarget);if(l.errors.length>0){for(let b of l.errors)console.error(b);return!1}let s=l.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},d=W5(Ll(n.configPath),s.rules,n.defaultRulebookName,n.migratedFrom,t.filesystemScope),c=zt(Ll(n.configPath),d,"rulebook.json"),L=g(t.filesystemScope,c),i=[$r(t.configTarget),$r(L),$r(t.lockTarget)],v=await S5(n,t.configTarget,L,d,a.config.rules,s.rules.includes(d)?s.rules:[...s.rules,d],s.overrides??{},s.transparent_wrappers??[]);if(!v.ok){V5(i);for(let b of v.errors)console.error(b);return!1}if(!n.cleanup)return console.log(`Migrated legacy config at ${n.legacyPath}. Legacy file is no longer used.`),!0;if(!R5(t.configTarget,L,d,n.migratedFrom,a.config.rules))return console.error(`Migration cleanup verification failed for ${n.legacyPath}`),!1;return un(r),console.log(`Deleted legacy config at ${n.legacyPath}`),!0}async function S5(n,t,r,e,a,l,s,d){try{return P(t,{version:1,rules:l,overrides:s,transparent_wrappers:d}),P(r,K5(e,n.migratedFrom,a)),await M2(n.syncOptions)}catch(c){return{ok:!1,errors:[c instanceof Error?c.message:String(c)]}}}function H5(n){try{let t=JSON.parse(n),r=At(t);if(r.errors.length>0)return{ok:!1,errors:r.errors};return{ok:!0,config:{version:1,rules:t.rules??[]}}}catch{return{ok:!1,errors:["Invalid JSON"]}}}function W5(n,t,r,e,a){let l=t.find((s)=>A5(g(a,zt(n,s,"rulebook.json")))===e);if(l)return l;if(D(g(a,zt(n,r,"rulebook.json")))===null)return r;for(let s=2;;s++){let d=`${r}-${s}`;if(D(g(a,zt(n,d,"rulebook.json")))===null)return d}}function K5(n,t,r){return{rulebook_version:1,name:n,version:"1.0.0",description:"Migrated CC Safety Net rules.",author:"project",migrated_from:t,allowed_commands:[...new Set(r.map((e)=>e.command))],rules:r,tests:r.map((e)=>({command:[e.command,e.subcommand,e.block_args[0]].filter(Boolean).join(" "),expect:"blocked",rule:e.name}))}}function R5(n,t,r,e,a){if(!E(n).config?.rules.includes(r))return!1;try{let s=D(t);if(s===null)return!1;let d=JSON.parse(s);return d.migrated_from===e&&JSON.stringify(d.rules)===JSON.stringify(a)}catch{return!1}}function $r(n){return{target:n,content:D(n)}}function V5(n){for(let t of n){if(t.content===null){un(t.target);continue}D2(t.target,t.content)}}function A5(n){let t=D(n);if(t===null)return null;try{let r=JSON.parse(t);return typeof r.migrated_from==="string"?r.migrated_from:null}catch{return null}}import{mkdir as M5,readFile as G5,writeFile as U5}from"node:fs/promises";import{dirname as C5,join as O5}from"node:path";var T5=86400000,_5=604800000;async function bl(n=Date.now()){if(process.env.CC_SAFETY_NET_NO_UPDATE_CHECK)return null;let t=a1();if(!t)return null;let r=O5(t,".cc-safety-net","update-check.json"),e=await E5(r,n);if(!e.lastCheck||n-e.lastCheck>T5){let s=await I2();if(e.lastCheck=n,s.latestVersion)e.latestVersion=s.latestVersion;if(!await ul(r,e))return null;if(s.error)return null}let a=e.latestVersion,l=B();if(!a||!m1(a,l))return null;if(e.notifiedVersion===a&&e.notifiedAt!==void 0&&n-e.notifiedAt<_5)return null;if(e.notifiedVersion=a,e.notifiedAt=n,!await ul(r,e))return null;return`UPDATE_AVAILABLE: cc-safety-net v${a} is available (running v${l}). Ask the user once whether to run \`npx -y cc-safety-net@latest update\`; continue the current task either way and do not raise this again.`}async function E5(n,t){let r=await G5(n,"utf8").then((l)=>JSON.parse(l)).catch(()=>{return});if(!r||typeof r!=="object"||Array.isArray(r))return{};let e=r,a=(l)=>typeof l==="number"&&Number.isFinite(l)&&l<=t?l:void 0;return{lastCheck:a(e.lastCheck),latestVersion:typeof e.latestVersion==="string"?e.latestVersion:void 0,notifiedVersion:typeof e.notifiedVersion==="string"?e.notifiedVersion:void 0,notifiedAt:a(e.notifiedAt)}}async function ul(n,t){return M5(C5(n),{recursive:!0,mode:448}).then(()=>U5(n,JSON.stringify(t),{mode:384})).then(()=>!0).catch(()=>!1)}import{dirname as P5,join as I5,resolve as Dr}from"node:path";var fl="CC Safety Net Config",N5="═".repeat(fl.length),n8="https://raw.githubusercontent.com/kenryu42/cc-safety-net/main/assets/cc-safety-net.schema.json",t8=new Set(["rule.json","rule.lock","cache"]);function yl(n={}){try{return r8(n)}catch(t){if(t instanceof Y)return console.error(t.message),1;throw t}}function r8(n){let t=n.cwd??process.cwd(),r=n.userConfigPath??N(),e=n.projectConfigPath??I(t),a=n.legacyUserConfigPath??on(),l=n.legacyProjectConfigPath??Ur(t),s=Dr(t,n1),d=P5(r),c=n2({cwd:t,userConfigPath:r,projectConfigPath:e}),L=n2({cwd:t}),i=g(c.userScope,r),v=g(c.projectScope,e),b=n.legacyUserConfigPath?vn(n.legacyUserConfigPath,"user policy"):g(L.userScope,a),p=n.legacyProjectConfigPath?vn(n.legacyProjectConfigPath,"project policy"):g(L.projectScope,l),f=!1,u=!1,h=[],w=[],$=e8(g(L.projectScope,s));if(l8(),D(i)!==null){let y=d2(i);if(y.errors.push(...c2(r,G2({userConfigDir:d}),{userConfigDir:d},c.userScope)),h.push({scope:"User",path:r,result:y,schema:"rules",sourceDisplayMap:m2(r,c.userScope),target:i}),y.errors.length>0)f=!0}if(D(b)!==null)if(u=!0,D(i)!==null)w.push(Ft("user","cleanup"));else{let y=Mt(b);if(h.push({scope:"User",path:a,result:y,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:b}),w.push(Ft("user",y.errors.length>0?"fix-or-delete":"migrate")),y.errors.length>0)f=!0}if(D(v)!==null){let y=d2(v);if(y.errors.push(...c2(e,U2(e),{userConfigDir:d},c.projectScope)),h.push({scope:"Project",path:Dr(e),result:y,schema:"rules",sourceDisplayMap:m2(e,c.projectScope),target:v}),y.errors.length>0)f=!0;if(D(p)!==null)u=!0,w.push(Ft("project","cleanup"))}else if(D(p)!==null){u=!0,f=!0;let y=Mt(p);h.push({scope:"Project",path:Dr(l),result:y,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:p}),w.push(Ft("project",y.errors.length>0?"fix-or-delete":"migrate"))}if($?.result.errors.length)f=!0;if(h.length===0&&!$)return console.log(`
-No config files found. Using built-in rules only.`),0;for(let y of h)if(y.inactive)d8(y.scope,y.path,y.result,y.sourceDisplayMap);else if(y.result.errors.length>0)c8(y.scope,y.path,y.result.errors);else{if(y.schema==="rules"&&p8(y.target))console.log(`
-Added $schema to ${y.scope.toLowerCase()} config.`);s8(y.scope,y.path,y.result,y.schema,y.sourceDisplayMap)}for(let y of w)console.error(`
-${o.red(y)}`);if($)if($.result.errors.length>0)i8($.path,$.result.errors);else L8($.path,$.result);if(f)return console.error(`
-Config validation failed.`),1;return console.log(u?`
+`)}function Xl(e,t){return t.map((n)=>e==="install"&&n.target==="kimi-code"&&n.unavailableReason==="already installed"?{...n,available:!0,unavailableReason:void 0,label:`${n.label} (global hook installed)`}:n)}function xm(e,t){if(e.selectKimiInstallMethod)return e.selectKimiInstallMethod();if(!lo(e.input,e.output))return Promise.resolve("global-hook");return yl({input:e.input,output:e.output,globalHookInstalled:It({homeDir:t,cwd:process.cwd()}).status==="configured"})}async function oc(e,t,n,r=!1,o){return bm[t][e](n,r,o)}function Cm(e){let t=T({label:"update"},e).errors[0];if(t)throw Error(t)}async function km(e,t=Xe){let n=await rc(e,t),r=Lo(Et(e),"installed-plugins");return{targets:mo([...n.hooks.filter((i)=>i.platform!=="copilot-cli"&&i.detected).map((i)=>i.platform),...[on,Vs,qs].flatMap((i)=>bo(Lo(r,...i))?["copilot-cli"]:[]),...rn(e,vo)?["claude-code"]:[],...wo(n.codexPluginListOutput)?["codex"]:[]]),codexPluginListOutput:n.codexPluginListOutput}}async function Sm(e){let t=En(),n=e.output??process.stdout,r=km(t,e.fetchVersion??Xe).then(async(a)=>{let l=new Set(a.targets);return{targets:a.targets,codexPluginListOutput:a.codexPluginListOutput,available:new Map(await Promise.all(se.filter((c)=>l.has(c.target)&&Wl.has(c.target)).map(async(c)=>[c.target,await go(c.probeCommand)])))}}),o=await At(e.showBanner??!0,()=>({ready:r,finish:()=>r}),()=>Rt({input:e.input??process.stdin,output:n}),{loadingMessage:"Checking installed integrations…",output:n});if(o.targets.length===0)return n.write("No installed integrations found. Run `cc-safety-net install` to set one up.\n"),0;let i=o.targets.some((a)=>Jl.has(a))?await Promise.resolve().then(()=>(Dn(t),null)).catch((a)=>An(a)):null,s=await en(Promise.all(o.targets.map((a)=>{if(Wl.has(a)&&!o.available.get(a))return Promise.resolve({message:`${R(a)} not found; skipped`,failed:!1});if(i!==null&&Jl.has(a))return Promise.resolve({message:i,failed:!0});return oc("install",a,t,!0,o.codexPluginListOutput).then((l)=>({message:l,failed:!1}),(l)=>({message:An(l),failed:!0}))})),{loadingMessage:`Updating ${o.targets.length} integration${o.targets.length===1?"":"s"}…`,output:n});return s.forEach((a)=>{a.failed?console.error(a.message):n.write(`${a.message}
+`)}),s.some((a)=>a.failed)?1:0}function xo(e,t={}){return Promise.resolve().then(()=>Cm(e)).then(()=>Sm(t)).catch((n)=>(console.error(An(n)),1))}async function Ht(e,t,n={}){try{let r=await At(!0,()=>hm(e,t,n),()=>Rt({input:n.input??process.stdin,output:n.output??process.stdout}),{loadingMessage:e==="install"?"Checking available integrations…":"Checking installed integrations…",output:n.output??process.stdout});if(!r)return(n.output??process.stdout).write(`Cancelled: nothing was ${e}ed.
+`),0;if(r==="update")return(n.runUpdate??(()=>xo([],{fetchVersion:n.fetchVersion,input:n.input,output:n.output,showBanner:!1})))();let o=En(),i=n.output??process.stdout;return await Nl(r,async(s)=>{if(s==="kimi-code"&&e==="install"){let l=await xm(n,o);if(l===null){i.write(`Cancelled: Kimi Code integration was not installed.
+`);return}if(l==="plugin"){i.write(`${wm(o)}
+`);return}}let a=await en(oc(e,s,o),{loadingMessage:`${e==="install"?"Installing":"Uninstalling"} ${R(s)} integration…`,output:i});i.write(`${a}
+`)}),0}catch(r){return console.error(An(r)),1}}function An(e){let t=e instanceof Error?e.message:String(e),n=typeof e==="object"&&e!==null&&"code"in e?e.code:null;if(n==="EACCES"||n==="EPERM")return`${t}
+Check file permissions for the target config file and parent directory.`;if(n==="ENOENT")return`${t}
+Check that the target config path and parent directory exist.`;if(n==="ENOTDIR")return`${t}
+Check that every parent path component is a directory.`;return t}import{join as cg}from"node:path";var ic="# Custom Rules Reference\n\nAgent reference for generating CC Safety Net rulebook configuration.\n\n## Config Locations\n\n| Scope | Config path | Rulebook path | Cache path | Priority |\n|-------|-------------|---------------|------------|----------|\n| User | `~/.cc-safety-net/rules/rule.json` | `~/.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `~/.cc-safety-net/cache/rulebooks/` | First |\n| Project | `.cc-safety-net/rules/rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` | `.cc-safety-net/cache/rulebooks/` | Second |\n| GitHub source | Listed in a local `rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` in the source repository | Consumer local cache | Source order |\n\nUser scope is evaluated before project scope; within a scope, sources apply in `rules` array order. A duplicate active rulebook name keeps the first claim and ignores the later rulebook with a warning, so a user-scoped name shadows a project-scoped one.\n\nUse `cc-safety-net rule init` to create an inert local config. Use `--global` for user scope. Use `cc-safety-net rule init --example` to also create an inactive example rulebook. `CC_SAFETY_NET_HOME` overrides the `~/.cc-safety-net` user root.\n\nLegacy inline `.safety-net.json` and `~/.cc-safety-net/config.json` files are not loaded at runtime. Convert them with `cc-safety-net rule migrate`.\n\n## rule.json Schema\n\n```json\n{\n  \"version\": 1,\n  \"rules\": [\"project-rules\", \"owner/repo#main/team-rules\"],\n  \"overrides\": {\n    \"project-rules/block-docker-system-prune\": {\n      \"reason\": \"Use targeted Docker cleanup commands.\"\n    },\n    \"team-rules/block-npm-global\": \"off\"\n  },\n  \"transparent_wrappers\": [\"rtk\"]\n}\n```\n\n- `version`: Required. Must be `1`.\n- `$schema`: Optional. `cc-safety-net rule verify` inserts it into a valid `rule.json` that lacks it.\n- `rules`: Optional array of rulebook source strings. Missing `rules` is treated as `[]`.\n- `overrides`: Optional object keyed by `<rulebook-name>/<rule-name>`.\n- `overrides` values are either `\"off\"` to disable a rule or an object with a required `reason` (replacement block reason) and an optional `intent` (one of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain`).\n- A project override cannot target a user-scoped rule: only that override is ignored, the user rule keeps its configured state, and `rule sync`/`rule verify` report the diagnostic as a failure.\n- `transparent_wrappers`: Optional array of command names that transparently execute a visible child command.\n- Transparent wrappers have no built-in defaults. Configure only wrappers you intentionally trust, such as `\"rtk\"`.\n- Use `cc-safety-net rule wrapper add rtk` to configure RTK without manually editing `rule.json`.\n\n## Rulebook Sources\n\n- Local sources are bare rulebook names such as `project-rules`; the rulebook file is `.cc-safety-net/rules/project-rules/rulebook.json`.\n- GitHub sources use `owner/repo#ref/<rulebook-name>`.\n- GitHub refs must be one path segment, such as a tag, SHA, or branch name without `/`.\n- The GitHub source name, the repository directory name, and the rulebook `name` must match exactly.\n- Rulebook source strings must be unique in a config.\n\n## rulebook.json Schema\n\n```json\n{\n  \"rulebook_version\": 1,\n  \"name\": \"project-rules\",\n  \"version\": \"1.0.0\",\n  \"description\": \"Project-specific CC Safety Net rules.\",\n  \"author\": \"project\",\n  \"allowed_commands\": [\"docker\"],\n  \"rules\": [\n    {\n      \"name\": \"block-docker-system-prune\",\n      \"command\": \"docker\",\n      \"subcommand\": \"system\",\n      \"block_args\": [\"prune\"],\n      \"reason\": \"Use targeted cleanup instead.\"\n    }\n  ],\n  \"tests\": [\n    {\n      \"command\": \"docker system prune\",\n      \"expect\": \"blocked\",\n      \"rule\": \"block-docker-system-prune\"\n    },\n    {\n      \"command\": \"docker ps\",\n      \"expect\": \"allowed\"\n    }\n  ]\n}\n```\n\n### Rulebook Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `rulebook_version` | Yes | Must be `1` |\n| `name` | Yes | `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$` |\n| `version` | Yes | Non-empty string |\n| `description` | No | Free text; not type-checked at runtime |\n| `author` | No | Free text; not type-checked at runtime |\n| `allowed_commands` | Yes | Unique command names matching `^[a-zA-Z][a-zA-Z0-9_-]*$` |\n| `rules` | Yes | Array of rule objects |\n| `tests` | No | Array of fixtures |\n\n### Rule Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Unique within the rulebook (case-insensitive); same pattern as rulebook `name` |\n| `command` | Yes | Must be listed in `allowed_commands`; basename only, not path |\n| `subcommand` | No | Same pattern as `command`; omit to match any subcommand |\n| `intent` | No | One of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain` |\n| `block_args` | Yes | Non-empty array of non-empty strings |\n| `reason` | Yes | Non-empty string, max 256 chars |\n\n### Test Fixture Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `command` | Yes | Non-empty shell command string |\n| `expect` | Yes | `\"blocked\"` or `\"allowed\"` |\n| `rule` | Required for blocked fixtures | Rule name expected to block the command |\n\nFixtures are optional documentation of intended behavior. Fixtures are shape-validated only; CC Safety Net does not execute them.\n\n## Matching Behavior\n\n- **Command**: Normalized to lowercase basename with any trailing `.exe` removed (`/usr/bin/git` → `git`).\n- **Subcommand**: The first command token after recognized Git and Docker global options and their values; `--` ends option parsing. An unrecognized option without `=` may consume the following token as its value.\n- **Arguments**: Each `block_args` value is compared literally against every command token, including expanded short options. The command is blocked if **any** item matches.\n- **Short options**: Expanded (`-Ap` matches `-A`).\n- **Long options**: Exact match (`--all-files` does not match `--all`).\n- **Execution order**: Built-in rules first, then custom rulebooks. Custom rules only add restrictions.\n- **Transparent wrappers**: A configured wrapper such as `rtk` lets `rtk git commit` be analyzed as `git commit` only when `git` is protected by built-in analyzers or active custom rules. `rtk -- git commit` is also supported.\n\n## Workflow\n\n1. Run `cc-safety-net rule init` or create `rule.json` manually.\n2. Optionally run `cc-safety-net rule init --example` to create an inactive example rulebook.\n3. Use `cc-safety-net rule wrapper add rtk` for trusted transparent wrappers.\n4. Run `cc-safety-net rule add <source>` after creating or choosing a rulebook source; it adds the source and syncs it.\n5. Run `cc-safety-net rule sync` after manual `rule.json` changes or local rulebook edits.\n6. Run `cc-safety-net rule verify` to validate config, lock/cache state, local rulebooks, and shareable GitHub-source rulebook directories in the current repository (it does not fetch remote content).\n7. Run `cc-safety-net rule list` to inspect active rulebooks and transparent wrappers.\n\nAn edited or invalid local rulebook keeps its last synced, digest-verified cached version enforced until `cc-safety-net rule sync` validates the edit. A missing lock entry or cache, a cache digest mismatch, or an invalid cached rulebook makes that source inactive; a missing lockfile or an unreadable or invalid `rule.json` makes every source in its scope inactive. Inactive sources stop applying their rules while other custom rules and all built-in protections stay active. Repair the reported condition, then run `cc-safety-net rule sync`. Run `cc-safety-net status` to see degraded sources.\n";function Mt(e,t){if(!e.ok){Em(e);return}Pm(e),console.log(t),console.log("Rule config synced."),console.log(""),Dm(e.entries)}function Dm(e){if(e.length===0){console.log("Active rulebooks: (none)");return}console.log(`Active rulebooks (${e.length}):`);for(let t of e)console.log(`  - ${t.name} ${t.version} (${Rm(t.ruleCount??0)})`),console.log(`    Source: ${rr(t)}`)}function Rm(e){return`${e} ${e===1?"rule":"rules"}`}function ac(e,t){Fe("Active sources",e.rulebooks,(n)=>[`[${n.source}] ${n.name} ${n.version}`,`  Source: ${t[n.source].get(n.spec)??n.spec}`]),Fe("Active rules",e.rules,(n)=>[`[${Am(e,n.name)}] ${n.name}`,`  Command: ${n.subcommand?`${n.command} ${n.subcommand}`:n.command}`,`  Block args: ${n.block_args.join(", ")}`,`  Reason: ${n.reason}`]),Fe("Disabled rules",sc(e,"off"),(n)=>[n.key]),Fe("Reason overrides",sc(e,"reason"),(n)=>[n.key,`  Reason: ${n.value.reason}`]),Fe("Transparent wrappers",e.transparent_wrappers,(n)=>[n]),Fe("Issues",e.errors,(n)=>[n]),Fe("Warnings",e.warnings,(n)=>[n])}function Fe(e,t,n){if(t.length===0){console.log(`${e}: (none)`);return}console.log(`${e} (${t.length}):`);for(let r of t){let[o,...i]=n(r);console.log(`  - ${o}`);for(let s of i)console.log(`    ${s}`)}}function Am(e,t){return e.rulebooks.find((n)=>n.rules.includes(t))?.source??"project"}function sc(e,t){return Object.entries({...e.userConfig?.overrides??{},...e.projectConfig?.overrides??{}}).filter((n)=>{if(t==="off")return n[1]==="off";return!!n[1]&&typeof n[1]==="object"}).map(([n,r])=>({key:n,value:r}))}function Em(e){for(let t of e.errors)console.error(t)}function Pm(e){if(!e.warnings||e.warnings.length===0)return;for(let t of e.warnings)console.warn(t)}import{dirname as lc,join as Pn}from"node:path";var Tm=".safety-net.json",Im="~/.cc-safety-net/config.json";async function uc(e){return[await cc({legacyPath:dc({cwd:e.cwd}),configPath:X(e.cwd),defaultRulebookName:"project-rules",migratedFrom:Tm,cleanup:e.cleanup,syncOptions:{cwd:e.cwd}}),await cc({legacyPath:gt(),configPath:Q(),defaultRulebookName:"user-rules",migratedFrom:Im,cleanup:e.cleanup,syncOptions:{cwd:e.cwd,global:!0}})].every((n)=>n)?0:1}async function cc(e){let t=J(e.syncOptions),n=k(t.filesystemScope,e.legacyPath),r=x(n);if(r===null)return console.log(`No legacy config found at ${e.legacyPath}`),!0;let o=Om(r);if(!o.ok){for(let m of o.errors)console.error(m);return!1}let i=Y(t.configTarget);if(i.errors.length>0){for(let m of i.errors)console.error(m);return!1}let s=i.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},a=$m(lc(e.configPath),s.rules,e.defaultRulebookName,e.migratedFrom,t.filesystemScope),l=Pn(lc(e.configPath),a,"rulebook.json"),c=k(t.filesystemScope,l),d=[Co(t.configTarget),Co(c),Co(t.lockTarget)],p=await _m(e,t.configTarget,c,a,o.config.rules,s.rules.includes(a)?s.rules:[...s.rules,a],s.overrides??{},s.transparent_wrappers??[]);if(!p.ok){Hm(d);for(let m of p.errors)console.error(m);return!1}if(!e.cleanup)return console.log(`Migrated legacy config at ${e.legacyPath}. Legacy file is no longer used.`),!0;if(!Fm(t.configTarget,c,a,e.migratedFrom,o.config.rules))return console.error(`Migration cleanup verification failed for ${e.legacyPath}`),!1;return ft(n),console.log(`Deleted legacy config at ${e.legacyPath}`),!0}async function _m(e,t,n,r,o,i,s,a){try{return Z(t,{version:1,rules:i,overrides:s,transparent_wrappers:a}),Z(n,Nm(r,e.migratedFrom,o)),await qe(e.syncOptions)}catch(l){return{ok:!1,errors:[l instanceof Error?l.message:String(l)]}}}function Om(e){try{let t=JSON.parse(e),n=qn(t);if(n.errors.length>0)return{ok:!1,errors:n.errors};return{ok:!0,config:{version:1,rules:t.rules??[]}}}catch{return{ok:!1,errors:["Invalid JSON"]}}}function $m(e,t,n,r,o){let i=t.find((s)=>Mm(k(o,Pn(e,s,"rulebook.json")))===r);if(i)return i;if(x(k(o,Pn(e,n,"rulebook.json")))===null)return n;for(let s=2;;s++){let a=`${n}-${s}`;if(x(k(o,Pn(e,a,"rulebook.json")))===null)return a}}function Nm(e,t,n){return{rulebook_version:1,name:e,version:"1.0.0",description:"Migrated CC Safety Net rules.",author:"project",migrated_from:t,allowed_commands:[...new Set(n.map((r)=>r.command))],rules:n,tests:n.map((r)=>({command:[r.command,r.subcommand,r.block_args[0]].filter(Boolean).join(" "),expect:"blocked",rule:r.name}))}}function Fm(e,t,n,r,o){if(!Y(e).config?.rules.includes(n))return!1;try{let s=x(t);if(s===null)return!1;let a=JSON.parse(s);return a.migrated_from===r&&JSON.stringify(a.rules)===JSON.stringify(o)}catch{return!1}}function Co(e){return{target:e,content:x(e)}}function Hm(e){for(let t of e){if(t.content===null){ft(t.target);continue}xe(t.target,t.content)}}function Mm(e){let t=x(e);if(t===null)return null;try{let n=JSON.parse(t);return typeof n.migrated_from==="string"?n.migrated_from:null}catch{return null}}import{mkdir as jm,readFile as Um,writeFile as Gm}from"node:fs/promises";import{dirname as Bm,join as qm}from"node:path";var Vm=86400000,zm=604800000;async function fc(e=Date.now()){if(process.env.CC_SAFETY_NET_NO_UPDATE_CHECK)return null;let t=sr();if(!t)return null;let n=qm(t,".cc-safety-net","update-check.json"),r=await Km(n,e);if(!r.lastCheck||e-r.lastCheck>Vm){let s=await Qe();if(r.lastCheck=e,s.latestVersion)r.latestVersion=s.latestVersion;if(!await pc(n,r))return null;if(s.error)return null}let o=r.latestVersion,i=P();if(!o||!Sr(o,i))return null;if(r.notifiedVersion===o&&r.notifiedAt!==void 0&&e-r.notifiedAt<zm)return null;if(r.notifiedVersion=o,r.notifiedAt=e,!await pc(n,r))return null;return`UPDATE_AVAILABLE: cc-safety-net v${o} is available (running v${i}). Ask the user once whether to run \`npx -y cc-safety-net@latest update\`; continue the current task either way and do not raise this again.`}async function Km(e,t){let n=await Um(e,"utf8").then((i)=>JSON.parse(i)).catch(()=>{return});if(!n||typeof n!=="object"||Array.isArray(n))return{};let r=n,o=(i)=>typeof i==="number"&&Number.isFinite(i)&&i<=t?i:void 0;return{lastCheck:o(r.lastCheck),latestVersion:typeof r.latestVersion==="string"?r.latestVersion:void 0,notifiedVersion:typeof r.notifiedVersion==="string"?r.notifiedVersion:void 0,notifiedAt:o(r.notifiedAt)}}async function pc(e,t){return jm(Bm(e),{recursive:!0,mode:448}).then(()=>Gm(e,JSON.stringify(t),{mode:384})).then(()=>!0).catch(()=>!1)}import{dirname as Wm,join as Jm,resolve as ko}from"node:path";var gc="CC Safety Net Config",Ym="═".repeat(gc.length),Zm="https://raw.githubusercontent.com/kenryu42/cc-safety-net/main/assets/cc-safety-net.schema.json",Xm=new Set(["rule.json","rule.lock","cache"]);function hc(e={}){try{return Qm(e)}catch(t){if(t instanceof N)return console.error(t.message),1;throw t}}function Qm(e){let t=e.cwd??process.cwd(),n=e.userConfigPath??Q(),r=e.projectConfigPath??X(t),o=e.legacyUserConfigPath??gt(),i=e.legacyProjectConfigPath??Ko(t),s=ko(t,nr),a=Wm(n),l=ee({cwd:t,userConfigPath:n,projectConfigPath:r}),c=ee({cwd:t}),d=k(l.userScope,n),p=k(l.projectScope,r),m=e.legacyUserConfigPath?pt(e.legacyUserConfigPath,"user policy"):k(c.userScope,o),u=e.legacyProjectConfigPath?pt(e.legacyProjectConfigPath,"project policy"):k(c.projectScope,i),h=!1,f=!1,L=[],v=[],w=eg(k(c.projectScope,s));if(ng(),x(d)!==null){let y=le(d);if(y.errors.push(...ce(n,Ve({userConfigDir:a}),{userConfigDir:a},l.userScope)),L.push({scope:"User",path:n,result:y,schema:"rules",sourceDisplayMap:Ce(n,l.userScope),target:d}),y.errors.length>0)h=!0}if(x(m)!==null)if(f=!0,x(d)!==null)v.push(Tn("user","cleanup"));else{let y=Vn(m);if(L.push({scope:"User",path:o,result:y,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:m}),v.push(Tn("user",y.errors.length>0?"fix-or-delete":"migrate")),y.errors.length>0)h=!0}if(x(p)!==null){let y=le(p);if(y.errors.push(...ce(r,ze(r),{userConfigDir:a},l.projectScope)),L.push({scope:"Project",path:ko(r),result:y,schema:"rules",sourceDisplayMap:Ce(r,l.projectScope),target:p}),y.errors.length>0)h=!0;if(x(u)!==null)f=!0,v.push(Tn("project","cleanup"))}else if(x(u)!==null){f=!0,h=!0;let y=Vn(u);L.push({scope:"Project",path:ko(i),result:y,schema:"legacy",sourceDisplayMap:new Map,inactive:!0,target:u}),v.push(Tn("project",y.errors.length>0?"fix-or-delete":"migrate"))}if(w?.result.errors.length)h=!0;if(L.length===0&&!w)return console.log(`
+No config files found. Using built-in rules only.`),0;for(let y of L)if(y.inactive)og(y.scope,y.path,y.result,y.sourceDisplayMap);else if(y.result.errors.length>0)ig(y.scope,y.path,y.result.errors);else{if(y.schema==="rules"&&lg(y.target))console.log(`
+Added $schema to ${y.scope.toLowerCase()} config.`);rg(y.scope,y.path,y.result,y.schema,y.sourceDisplayMap)}for(let y of v)console.error(`
+${g.red(y)}`);if(w)if(w.result.errors.length>0)ag(w.path,w.result.errors);else sg(w.path,w.result);if(h)return console.error(`
+Config validation failed.`),1;return console.log(f?`
 Configs valid with warnings.`:`
-All configs valid.`),0}function Ft(n,t){let r=`legacy ${n} config`;if(t==="cleanup")return`Warning: Legacy ${n} config is no longer needed. Run \`npx -y cc-safety-net rule migrate --cleanup\` to clean it up safely.`;if(t==="migrate")return`Warning: Legacy ${n} config is ignored by CC Safety Net. Run \`npx -y cc-safety-net rule migrate\`.`;return`Warning: Legacy ${n} config is no longer supported. Fix or delete the ${r}, then run \`npx -y cc-safety-net rule migrate\`.`}function e8(n){if(A2(n)===null)return null;let t=a8(n);if(t.ruleNames.size===0&&t.errors.length===0)return null;return{path:n.path,result:t}}function a8(n){let t=[],r=new Set,e=(A2(n)??[]).filter((a)=>!t8.has(a.name)).sort((a,l)=>a.name.localeCompare(l.name));if(e.length===0)return{errors:t,ruleNames:r};for(let a of e){if(!bn.test(a.name)){t.push(`rulebook directory names must match ${bn}: ${a.name}`);continue}if(a.kind!=="directory"){t.push(`${a.name} must be a rulebook directory`);continue}let l=g(n.scope,I5(n.path,a.name,"rulebook.json")),s=D(l);if(s===null){t.push(`${a.name}/rulebook.json is required`);continue}try{let d;try{d=JSON.parse(s)}catch{t.push(`${a.name}/rulebook.json: invalid JSON`);continue}let c=ol(d);if(c.name!==a.name){t.push(`rulebook name "${c.name}" must match folder "${a.name}"`);continue}r.add(a.name)}catch(d){t.push(d instanceof Error?`${a.name}/rulebook.json: ${d.message}`:`${a.name}/rulebook.json: ${String(d)}`)}}return{errors:t,ruleNames:r}}function l8(){console.log(fl),console.log(N5)}function s8(n,t,r,e,a){if(console.log(`
-✓ ${n} config: ${t}`),console.log(`  Schema: ${e==="rules"?"rulebook sources":"legacy inline rules"}`),r.ruleNames.size>0){console.log(`  ${e==="rules"?"Sources":"Rules"}:`);let l=1;for(let s of r.ruleNames)console.log(`    ${l}. ${a.get(s)??s}`),l++}else console.log(`  ${e==="rules"?"Sources":"Rules"}: (none)`)}function d8(n,t,r,e){if(console.error(`
-✗ Legacy ${n.toLowerCase()} config: ${t}`),console.error("  Schema: legacy inline rules"),console.error("  Status: ignored by CC Safety Net"),r.errors.length>0){console.error("  Errors:");let a=1;for(let l of r.errors)for(let s of l.split("; "))console.error(`    ${a}. ${s}`),a++;return}if(r.ruleNames.size>0){console.error("  Rules:");let a=1;for(let l of r.ruleNames)console.error(`    ${a}. ${e.get(l)??l}`),a++;return}console.error("  Rules: (none)")}function c8(n,t,r){hl(`${n} config`,t,r)}function L8(n,t){console.log(`
-✓ GitHub source rules: ${n}`),console.log("  Rulebooks:");let r=1;for(let e of t.ruleNames)console.log(`    ${r}. ${e}`),r++}function i8(n,t){hl("GitHub source rules",n,t)}function hl(n,t,r){console.error(`
-✗ ${n}: ${t}`),console.error("  Errors:");let e=1;for(let a of r)for(let l of a.split("; "))console.error(`    ${e}. ${l}`),e++}function p8(n){try{let t=D(n);if(t===null)return!1;let r=JSON.parse(t);if(r.$schema)return!1;return D2(n,JSON.stringify({$schema:n8,...r},null,2)),!0}catch(t){if(t instanceof Y)throw t;return!1}}var wl=new Set(["init","add","remove","update","sync","list","wrapper","migrate","doc","verify"]),u8=new Set(["add","remove","list"]);async function $l(n){try{return await b8(n)}catch(t){if(t instanceof Y)return console.error(t.message),1;throw t}}async function b8(n){let t=f8(n),r=t.help?o8(t.positionals):null;if(r)return yt(r),0;if(t.errors.length>0){for(let s of t.errors)console.error(s);return 1}let e=t.positionals[0];if(!e)return yt(E2,console.error),1;let a=t.positionals[1],l={global:t.global,check:t.check};if(e==="init"){let s=_(l),d=s.configDir;w8(s.configTarget),xl(g(s.filesystemScope,Mn({...l,cacheConfigDir:d})));let c=v8(d,"example-rules","rulebook.json"),L=g(s.filesystemScope,c);if(t.example&&D(L)===null)e1(L,"example-rules");let i=await M2(l);return Kn(i,"Rule config initialized."),i.ok?0:1}if(e==="add"){if(!a)return console.error("rule add requires a source"),1;let s=await Pt(a,l);return Kn(s,`Added rulebook source: ${a}`),s.ok?0:1}if(e==="remove"){if(!a)return console.error("rule remove requires a source"),1;let s=await Nt(a,{...l,deleteSource:t.deleteSource});return Kn(s,`Removed rulebook source: ${a}`),s.ok?0:1}if(e==="update"||e==="sync"){let s=await M2({...l,only:e==="update"?a:void 0});return Kn(s,t.check?"Rule config checked.":"Rule config synced."),s.ok?0:1}if(e==="list"){let s=y2(),d=n2({});return cl(s,{user:m2(s.userConfigPath,d.userScope),project:m2(s.projectConfigPath,d.projectScope)}),s.errors.length>0?1:0}if(e==="wrapper")return x8(t);if(e==="migrate")return vl({cleanup:t.cleanup,cwd:process.cwd()});if(e==="doc"){console.log(sl);let s=await bl();if(s)console.error(s);return 0}if(e==="verify")return yl();return 1}function o8(n){if(n.length===0)return E2;let t=E2.subcommands.filter((e)=>e.usage.split(" ")[0]===n[0]);if(t.length===0)return null;if(n.length===1&&t.length>1)return{name:`rule ${n[0]}`,description:`Subcommands of rule ${n[0]}`,usage:`rule ${n[0]} <subcommand>`,subcommands:t,options:[]};let r=n.length===1?t[0]:t.find((e)=>e.usage.split(" ")[1]===n[1]);if(!r)return null;return{name:`rule ${n[0]}`,description:r.description,usage:`rule ${r.usage}`,options:[]}}function f8(n){let t=J({label:"rule",booleans:{global:["-g","--global"],check:["--check"],cleanup:["--cleanup"],deleteSource:["--delete-source"],example:["--example"]},positionals:"list"},n),r={...t.flags,help:t.help,positionals:t.positionals,errors:t.errors};return y8(r),r}function y8(n){let[t]=n.positionals;if(t&&!wl.has(t))n.errors.push(`Unknown rule subcommand: ${t}`);if(n.deleteSource&&t!=="remove")if(t&&wl.has(t))n.errors.push(`Unknown option for rule ${t}: --delete-source`);else n.errors.push("--delete-source is only valid with 'rule remove'");if(n.cleanup&&t!=="migrate")n.errors.push(Bt(t,"--cleanup"));if(n.example&&t!=="init")n.errors.push(Bt(t,"--example"));if(t==="migrate"){if(n.global)n.errors.push(Bt(t,"--global"));if(n.check)n.errors.push(Bt(t,"--check"));if(n.positionals.length>1)n.errors.push(`Unexpected rule migrate argument: ${n.positionals[1]}`)}else if(t==="wrapper")h8(n);else if(n.positionals.length>2)n.errors.push(`Unexpected rule argument: ${n.positionals[2]}`);if(t==="list"&&n.global)n.errors.push("Unknown option for rule list: --global")}function Bt(n,t){return n?`Unknown option for rule ${n}: ${t}`:`Unknown option for rule: ${t}`}function h8(n){let t=n.positionals[1],r=n.positionals[2];if(!t){n.errors.push("rule wrapper requires add, remove, or list");return}if(!u8.has(t)){n.errors.push(`Unknown rule wrapper action: ${t}`);return}if(t==="list"){if(r)n.errors.push(`Unexpected rule wrapper argument: ${r}`);return}if(!r){n.errors.push(`rule wrapper ${t} requires a command`);return}if(n.positionals.length>3)n.errors.push(`Unexpected rule wrapper argument: ${n.positionals[3]}`)}function w8(n){if(D(n)===null){r1(n);return}let t=E(n);if(!t.config)return;P(n,{version:1,rules:t.config.rules,overrides:t.config.overrides??{},transparent_wrappers:t.config.transparent_wrappers??[]})}async function x8(n){let t=n.positionals[1],r=n.positionals[2],e=_({global:n.global}).configTarget;if(t==="list"){let d=E(e);if(d.errors.length>0){for(let c of d.errors)console.error(c);return 1}return $8(d.config?.transparent_wrappers??[]),0}if(!r||!l1.test(r))return console.error("transparent wrapper must match command pattern"),1;if(d1(r))return console.error(`reserved command "${r}" cannot be a wrapper`),1;let a=E(e);if(a.errors.length>0){for(let d of a.errors)console.error(d);return 1}let l=a.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},s=t==="add"?[...new Set([...l.transparent_wrappers??[],r])]:(l.transparent_wrappers??[]).filter((d)=>d!==r);return P(e,{version:1,rules:l.rules,overrides:l.overrides??{},transparent_wrappers:s}),console.log(t==="add"?`Added transparent wrapper: ${r}`:`Removed transparent wrapper: ${r}`),0}function $8(n){if(n.length===0){console.log("Transparent wrappers: (none)");return}console.log(`Transparent wrappers (${n.length}):`);for(let t of n)console.log(`  - ${t}`)}import{homedir as Dl}from"node:os";import{existsSync as D8,readFileSync as m8}from"node:fs";import{homedir as g8}from"node:os";import{join as k8}from"node:path";async function q8(n){if(n.isTTY)return null;return(await b1(n).catch(()=>null))?.trim()||null}function j8(){if(process.env.CLAUDE_SETTINGS_PATH)return process.env.CLAUDE_SETTINGS_PATH;return k8(g8(),".claude","settings.json")}function mr(){let n=j8();if(!D8(n))return!1;try{let t=m8(n,"utf-8"),r=JSON.parse(t);if(!r.enabledPlugins)return!1;let e="cc-safety-net@cc-marketplace";if(!(e in r.enabledPlugins))return!1;return r.enabledPlugins[e]===!0}catch(t){if(hn(k.debug))console.error(`CC Safety Net debug: failed to read Claude settings: ${n}: ${t instanceof Error?t.message:String(t)}`);return!1}}async function gr(n=process.stdin){let t=mr(),r;if(!t)r="\uD83D\uDEE1️ CC Safety Net ❌";else{let a=A({cwd:process.cwd()}),l=a.policy,s=L2(l),d=Object.values(q2(l,s.capabilities)).some((L)=>L.changesInherited);r=`\uD83D\uDEE1️ CC Safety Net ${{standard:"✅",strict:"\uD83D\uDD12",paranoid:"\uD83D\uDC41️",custom:"\uD83D\uDD27"}[d?"custom":s.effectiveLevel]}${s.worktreeMode?"\uD83C\uDF33":""}${a.state==="degraded"?"⚠️":""}`}let e=await q8(n);if(e&&!e.startsWith("{"))console.log(`${e} | ${r}`);else console.log(r)}function ml(){let n=A({cwd:process.cwd()}),t=n.policy,r=L2(t),e=!!process.env.NO_COLOR||!process.stdout.isTTY,a=Math.min(process.stdout.columns||80,100),l=e?"ok":"✔",s=e?"OFF":"✘",d=(p,f)=>{let u=`  ${p.padEnd(13)}${f}`;return(u.length>a?`${u.slice(0,a-1)}…`:u).replaceAll(s,o.red(s))},c=Object.values(q2(t,r.capabilities)).some((p)=>p.changesInherited),L=wn(),i={ready:o.green,degraded:o.yellow}[n.state],v=[...mr()?[]:["plugin cc-safety-net@cc-marketplace is disabled in Claude Code; nothing is enforced in Claude Code until it is re-enabled. Other integrations are not affected."],...n.diagnostics],b=e?"-":"·";console.log([`${e?"":"\uD83D\uDEE1️  "}CC Safety Net — ${i(n.state)}`,"",d("Protection",`destructive ${t.destructiveCommandProtectionEnabled?l:s}   secrets ${t.secretProtection.enabled?l:s}`),d("Level",c?`${r.effectiveLevel} (customised)`:r.effectiveLevel),d("Rules",t.rules.length===0?"none active":`${t.rules.length} active`),d("Policy",L.startsWith(Dl())?`~${L.slice(Dl().length)}`:L),...r.worktreeMode?[d("Worktree","relaxations active")]:[],"",...v.length===0?["  Everything configured is active."]:["  Not active",...v.flatMap((p)=>ft(p,"      ",a-6).map((f,u)=>u===0?`    ${b} ${f}`:f)),"","  Full report: cc-safety-net doctor"]].join(`
-`))}import{spawn as Al}from"node:child_process";import{randomBytes as W8}from"node:crypto";import{createServer as K8}from"node:http";import{Writable as R8}from"node:stream";import{homedir as z8}from"node:os";var Jt=500;function F8(n){let t=n.filter((a)=>a.decision!=="allow"),r=n.filter((a)=>a.decision==="allow"),e=Math.min(t.length,Math.max(Jt-r.length,Math.ceil(Jt/2)));return[...t.slice(0,e),...r.slice(0,Jt-e)]}function gl(n,t=i2()){if(t)g2(t);let r=(u)=>new Date(u.getFullYear(),u.getMonth(),u.getDate()).getTime(),e=r(new Date),a=new Date(e);a.setDate(a.getDate()-(n-1));let l=a.getTime(),s=[],d={count:0};for(let u of t?f2(t,d):[])for(let h of pn(u,d)){if(!h||typeof h.ts!=="string"||typeof h.command!=="string")continue;let w=new Date(h.ts).getTime();if(!Number.isFinite(w))continue;if(w>=l)s.push(h)}s.sort((u,h)=>new Date(h.ts).getTime()-new Date(u.ts).getTime());let c=Array.from({length:n},()=>0),L=Array.from({length:n},()=>0),i={},v={},b={},p=0,f=0;for(let u of s){let h=u.agent||"unknown";i[h]=(i[h]??0)+1;let w=Math.round((e-r(new Date(u.ts)))/86400000),$=n-1-w,y=w>=0&&w<n;if(y)L[$]=(L[$]??0)+1;if(u.decision!=="allow"){if(p++,u.ruleId)v[u.ruleId]=(v[u.ruleId]??0)+1;let m=H2(u.segment||u.command);if(m)b[m]=(b[m]??0)+1;if(u.failureStage)f++;if(y)c[$]=(c[$]??0)+1}}return{days:n,logsDir:t,homeDir:z8(),totalInWindow:s.length,truncated:s.length>Jt,unreadable:d.count,counts:{blocked:p,allowed:s.length-p,agents:i,blockedByDay:c,analyzedByDay:L,rules:v,commands:b,errors:f},entries:F8(s).sort((u,h)=>new Date(h.ts).getTime()-new Date(u.ts).getTime())}}import{spawn as B8}from"node:child_process";import{existsSync as kl,statSync as J8}from"node:fs";import{delimiter as Z8,join as Q8}from"node:path";var X8=120000,Zt="Choose the project folder",Y8=`try
-  return POSIX path of (choose folder with prompt "${Zt}")
+All configs valid.`),0}function Tn(e,t){let n=`legacy ${e} config`;if(t==="cleanup")return`Warning: Legacy ${e} config is no longer needed. Run \`npx -y cc-safety-net rule migrate --cleanup\` to clean it up safely.`;if(t==="migrate")return`Warning: Legacy ${e} config is ignored by CC Safety Net. Run \`npx -y cc-safety-net rule migrate\`.`;return`Warning: Legacy ${e} config is no longer supported. Fix or delete the ${n}, then run \`npx -y cc-safety-net rule migrate\`.`}function eg(e){if(Be(e)===null)return null;let t=tg(e);if(t.ruleNames.size===0&&t.errors.length===0)return null;return{path:e.path,result:t}}function tg(e){let t=[],n=new Set,r=(Be(e)??[]).filter((o)=>!Xm.has(o.name)).sort((o,i)=>o.name.localeCompare(i.name));if(r.length===0)return{errors:t,ruleNames:n};for(let o of r){if(!mt.test(o.name)){t.push(`rulebook directory names must match ${mt}: ${o.name}`);continue}if(o.kind!=="directory"){t.push(`${o.name} must be a rulebook directory`);continue}let i=k(e.scope,Jm(e.path,o.name,"rulebook.json")),s=x(i);if(s===null){t.push(`${o.name}/rulebook.json is required`);continue}try{let a;try{a=JSON.parse(s)}catch{t.push(`${o.name}/rulebook.json: invalid JSON`);continue}let l=mc(a);if(l.name!==o.name){t.push(`rulebook name "${l.name}" must match folder "${o.name}"`);continue}n.add(o.name)}catch(a){t.push(a instanceof Error?`${o.name}/rulebook.json: ${a.message}`:`${o.name}/rulebook.json: ${String(a)}`)}}return{errors:t,ruleNames:n}}function ng(){console.log(gc),console.log(Ym)}function rg(e,t,n,r,o){if(console.log(`
+✓ ${e} config: ${t}`),console.log(`  Schema: ${r==="rules"?"rulebook sources":"legacy inline rules"}`),n.ruleNames.size>0){console.log(`  ${r==="rules"?"Sources":"Rules"}:`);let i=1;for(let s of n.ruleNames)console.log(`    ${i}. ${o.get(s)??s}`),i++}else console.log(`  ${r==="rules"?"Sources":"Rules"}: (none)`)}function og(e,t,n,r){if(console.error(`
+✗ Legacy ${e.toLowerCase()} config: ${t}`),console.error("  Schema: legacy inline rules"),console.error("  Status: ignored by CC Safety Net"),n.errors.length>0){console.error("  Errors:");let o=1;for(let i of n.errors)for(let s of i.split("; "))console.error(`    ${o}. ${s}`),o++;return}if(n.ruleNames.size>0){console.error("  Rules:");let o=1;for(let i of n.ruleNames)console.error(`    ${o}. ${r.get(i)??i}`),o++;return}console.error("  Rules: (none)")}function ig(e,t,n){yc(`${e} config`,t,n)}function sg(e,t){console.log(`
+✓ GitHub source rules: ${e}`),console.log("  Rulebooks:");let n=1;for(let r of t.ruleNames)console.log(`    ${n}. ${r}`),n++}function ag(e,t){yc("GitHub source rules",e,t)}function yc(e,t,n){console.error(`
+✗ ${e}: ${t}`),console.error("  Errors:");let r=1;for(let o of n)for(let i of o.split("; "))console.error(`    ${r}. ${i}`),r++}function lg(e){try{let t=x(e);if(t===null)return!1;let n=JSON.parse(t);if(n.$schema)return!1;return xe(e,JSON.stringify({$schema:Zm,...n},null,2)),!0}catch(t){if(t instanceof N)throw t;return!1}}var Lc=new Set(["init","add","remove","update","sync","list","wrapper","migrate","doc","verify"]),dg=new Set(["add","remove","list"]);async function bc(e){try{return await ug(e)}catch(t){if(t instanceof N)return console.error(t.message),1;throw t}}async function ug(e){let t=fg(e),n=t.help?pg(t.positionals):null;if(n)return vn(n),0;if(t.errors.length>0){for(let s of t.errors)console.error(s);return 1}let r=t.positionals[0];if(!r)return vn(Ze,console.error),1;let o=t.positionals[1],i={global:t.global,check:t.check};if(r==="init"){let s=J(i),a=s.configDir;hg(s.configTarget),vc(k(s.filesystemScope,Bt({...i,cacheConfigDir:a})));let l=cg(a,"example-rules","rulebook.json"),c=k(s.filesystemScope,l);if(t.example&&x(c)===null)ir(c,"example-rules");let d=await qe(i);return Mt(d,"Rule config initialized."),d.ok?0:1}if(r==="add"){if(!o)return console.error("rule add requires a source"),1;let s=await Qn(o,i);return Mt(s,`Added rulebook source: ${o}`),s.ok?0:1}if(r==="remove"){if(!o)return console.error("rule remove requires a source"),1;let s=await tr(o,{...i,deleteSource:t.deleteSource});return Mt(s,`Removed rulebook source: ${o}`),s.ok?0:1}if(r==="update"||r==="sync"){let s=await qe({...i,only:r==="update"?o:void 0});return Mt(s,t.check?"Rule config checked.":"Rule config synced."),s.ok?0:1}if(r==="list"){let s=Le(),a=ee({});return ac(s,{user:Ce(s.userConfigPath,a.userScope),project:Ce(s.projectConfigPath,a.projectScope)}),s.errors.length>0?1:0}if(r==="wrapper")return yg(t);if(r==="migrate")return uc({cleanup:t.cleanup,cwd:process.cwd()});if(r==="doc"){console.log(ic);let s=await fc();if(s)console.error(s);return 0}if(r==="verify")return hc();return 1}function pg(e){if(e.length===0)return Ze;let t=Ze.subcommands.filter((r)=>r.usage.split(" ")[0]===e[0]);if(t.length===0)return null;if(e.length===1&&t.length>1)return{name:`rule ${e[0]}`,description:`Subcommands of rule ${e[0]}`,usage:`rule ${e[0]} <subcommand>`,subcommands:t,options:[]};let n=e.length===1?t[0]:t.find((r)=>r.usage.split(" ")[1]===e[1]);if(!n)return null;return{name:`rule ${e[0]}`,description:n.description,usage:`rule ${n.usage}`,options:[]}}function fg(e){let t=T({label:"rule",booleans:{global:["-g","--global"],check:["--check"],cleanup:["--cleanup"],deleteSource:["--delete-source"],example:["--example"]},positionals:"list"},e),n={...t.flags,help:t.help,positionals:t.positionals,errors:t.errors};return mg(n),n}function mg(e){let[t]=e.positionals;if(t&&!Lc.has(t))e.errors.push(`Unknown rule subcommand: ${t}`);if(e.deleteSource&&t!=="remove")if(t&&Lc.has(t))e.errors.push(`Unknown option for rule ${t}: --delete-source`);else e.errors.push("--delete-source is only valid with 'rule remove'");if(e.cleanup&&t!=="migrate")e.errors.push(In(t,"--cleanup"));if(e.example&&t!=="init")e.errors.push(In(t,"--example"));if(t==="migrate"){if(e.global)e.errors.push(In(t,"--global"));if(e.check)e.errors.push(In(t,"--check"));if(e.positionals.length>1)e.errors.push(`Unexpected rule migrate argument: ${e.positionals[1]}`)}else if(t==="wrapper")gg(e);else if(e.positionals.length>2)e.errors.push(`Unexpected rule argument: ${e.positionals[2]}`);if(t==="list"&&e.global)e.errors.push("Unknown option for rule list: --global")}function In(e,t){return e?`Unknown option for rule ${e}: ${t}`:`Unknown option for rule: ${t}`}function gg(e){let t=e.positionals[1],n=e.positionals[2];if(!t){e.errors.push("rule wrapper requires add, remove, or list");return}if(!dg.has(t)){e.errors.push(`Unknown rule wrapper action: ${t}`);return}if(t==="list"){if(n)e.errors.push(`Unexpected rule wrapper argument: ${n}`);return}if(!n){e.errors.push(`rule wrapper ${t} requires a command`);return}if(e.positionals.length>3)e.errors.push(`Unexpected rule wrapper argument: ${e.positionals[3]}`)}function hg(e){if(x(e)===null){or(e);return}let t=Y(e);if(!t.config)return;Z(e,{version:1,rules:t.config.rules,overrides:t.config.overrides??{},transparent_wrappers:t.config.transparent_wrappers??[]})}async function yg(e){let t=e.positionals[1],n=e.positionals[2],r=J({global:e.global}).configTarget;if(t==="list"){let a=Y(r);if(a.errors.length>0){for(let l of a.errors)console.error(l);return 1}return Lg(a.config?.transparent_wrappers??[]),0}if(!n||!ar.test(n))return console.error("transparent wrapper must match command pattern"),1;if(cr(n))return console.error(`reserved command "${n}" cannot be a wrapper`),1;let o=Y(r);if(o.errors.length>0){for(let a of o.errors)console.error(a);return 1}let i=o.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},s=t==="add"?[...new Set([...i.transparent_wrappers??[],n])]:(i.transparent_wrappers??[]).filter((a)=>a!==n);return Z(r,{version:1,rules:i.rules,overrides:i.overrides??{},transparent_wrappers:s}),console.log(t==="add"?`Added transparent wrapper: ${n}`:`Removed transparent wrapper: ${n}`),0}function Lg(e){if(e.length===0){console.log("Transparent wrappers: (none)");return}console.log(`Transparent wrappers (${e.length}):`);for(let t of e)console.log(`  - ${t}`)}import{homedir as wc}from"node:os";import{existsSync as vg,readFileSync as bg}from"node:fs";import{homedir as wg}from"node:os";import{join as xg}from"node:path";async function Cg(e){if(e.isTTY)return null;return(await hr(e).catch(()=>null))?.trim()||null}function kg(){if(process.env.CLAUDE_SETTINGS_PATH)return process.env.CLAUDE_SETTINGS_PATH;return xg(wg(),".claude","settings.json")}function So(){let e=kg();if(!vg(e))return!1;try{let t=bg(e,"utf-8"),n=JSON.parse(t);if(!n.enabledPlugins)return!1;let r="cc-safety-net@cc-marketplace";if(!(r in n.enabledPlugins))return!1;return n.enabledPlugins[r]===!0}catch(t){if(Lt(S.debug))console.error(`CC Safety Net debug: failed to read Claude settings: ${e}: ${t instanceof Error?t.message:String(t)}`);return!1}}async function Do(e=process.stdin){let t=So(),n;if(!t)n="\uD83D\uDEE1️ CC Safety Net ❌";else{let o=B({cwd:process.cwd()}),i=o.policy,s=de(i),a=Object.values(De(i,s.capabilities)).some((c)=>c.changesInherited);n=`\uD83D\uDEE1️ CC Safety Net ${{standard:"✅",strict:"\uD83D\uDD12",paranoid:"\uD83D\uDC41️",custom:"\uD83D\uDD27"}[a?"custom":s.effectiveLevel]}${s.worktreeMode?"\uD83C\uDF33":""}${o.state==="degraded"?"⚠️":""}`}let r=await Cg(e);if(r&&!r.startsWith("{"))console.log(`${r} | ${n}`);else console.log(n)}function xc(){let e=B({cwd:process.cwd()}),t=e.policy,n=de(t),r=!!process.env.NO_COLOR||!process.stdout.isTTY,o=Math.min(process.stdout.columns||80,100),i=r?"ok":"✔",s=r?"OFF":"✘",a=(u,h)=>{let f=`  ${u.padEnd(13)}${h}`;return(f.length>o?`${f.slice(0,o-1)}…`:f).replaceAll(s,g.red(s))},l=Object.values(De(t,n.capabilities)).some((u)=>u.changesInherited),c=vt(),d={ready:g.green,degraded:g.yellow}[e.state],p=[...So()?[]:["plugin cc-safety-net@cc-marketplace is disabled in Claude Code; nothing is enforced in Claude Code until it is re-enabled. Other integrations are not affected."],...e.diagnostics],m=r?"-":"·";console.log([`${r?"":"\uD83D\uDEE1️  "}CC Safety Net — ${d(e.state)}`,"",a("Protection",`destructive ${t.destructiveCommandProtectionEnabled?i:s}   secrets ${t.secretProtection.enabled?i:s}`),a("Level",l?`${n.effectiveLevel} (customised)`:n.effectiveLevel),a("Rules",t.rules.length===0?"none active":`${t.rules.length} active`),a("Policy",c.startsWith(wc())?`~${c.slice(wc().length)}`:c),...n.worktreeMode?[a("Worktree","relaxations active")]:[],"",...p.length===0?["  Everything configured is active."]:["  Not active",...p.flatMap((u)=>Ln(u,"      ",o-6).map((h,f)=>f===0?`    ${m} ${h}`:h)),"","  Full report: cc-safety-net doctor"]].join(`
+`))}import{spawn as Uc}from"node:child_process";import{randomBytes as $g}from"node:crypto";import{createServer as Ng}from"node:http";import{Writable as Fg}from"node:stream";import{homedir as Sg}from"node:os";var _n=500;function Dg(e){let t=e.filter((o)=>o.decision!=="allow"),n=e.filter((o)=>o.decision==="allow"),r=Math.min(t.length,Math.max(_n-n.length,Math.ceil(_n/2)));return[...t.slice(0,r),...n.slice(0,_n-r)]}function Cc(e,t=ue()){if(t)ke(t);let n=(f)=>new Date(f.getFullYear(),f.getMonth(),f.getDate()).getTime(),r=n(new Date),o=new Date(r);o.setDate(o.getDate()-(e-1));let i=o.getTime(),s=[],a={count:0};for(let f of t?ye(t,a):[])for(let L of ut(f,a)){if(!L||typeof L.ts!=="string"||typeof L.command!=="string")continue;let v=new Date(L.ts).getTime();if(!Number.isFinite(v))continue;if(v>=i)s.push(L)}s.sort((f,L)=>new Date(L.ts).getTime()-new Date(f.ts).getTime());let l=Array.from({length:e},()=>0),c=Array.from({length:e},()=>0),d={},p={},m={},u=0,h=0;for(let f of s){let L=f.agent||"unknown";d[L]=(d[L]??0)+1;let v=Math.round((r-n(new Date(f.ts)))/86400000),w=e-1-v,y=v>=0&&v<e;if(y)c[w]=(c[w]??0)+1;if(f.decision!=="allow"){if(u++,f.ruleId)p[f.ruleId]=(p[f.ruleId]??0)+1;let C=He(f.segment||f.command);if(C)m[C]=(m[C]??0)+1;if(f.failureStage)h++;if(y)l[w]=(l[w]??0)+1}}return{days:e,logsDir:t,homeDir:Sg(),totalInWindow:s.length,truncated:s.length>_n,unreadable:a.count,counts:{blocked:u,allowed:s.length-u,agents:d,blockedByDay:l,analyzedByDay:c,rules:p,commands:m,errors:h},entries:Dg(s).sort((f,L)=>new Date(L.ts).getTime()-new Date(f.ts).getTime())}}import{spawn as Rg}from"node:child_process";import{existsSync as kc,statSync as Ag}from"node:fs";import{delimiter as Eg,join as Pg}from"node:path";var Tg=120000,On="Choose the project folder",Ig=`try
+  return POSIX path of (choose folder with prompt "${On}")
 on error number -128
   return ""
-end try`,S8=`Add-Type -AssemblyName System.Windows.Forms
+end try`,_g=`Add-Type -AssemblyName System.Windows.Forms
 $dialog = New-Object System.Windows.Forms.FolderBrowserDialog
-$dialog.Description = '${Zt}'
-if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write($dialog.SelectedPath) }`,ql=[{binary:"zenity",args:["--file-selection","--directory",`--title=${Zt}`]},{binary:"kdialog",args:["--getexistingdirectory",".","--title",Zt]}],jl=(n,t)=>(t.PATH??"").split(Z8).some((r)=>r.length>0&&kl(Q8(r,n)));function zl(n,t){if(n==="darwin"||n==="win32")return!0;if(n!=="linux")return!1;if(!t.DISPLAY&&!t.WAYLAND_DISPLAY)return!1;return ql.some((r)=>jl(r.binary,t))}function H8(n,t){if(n==="darwin")return{cmd:"osascript",args:["-e",Y8]};if(n==="win32")return{cmd:"powershell.exe",args:["-NoProfile","-STA","-Command",S8]};let r=ql.find((e)=>jl(e.binary,t));return r?{cmd:r.binary,args:r.args}:null}function Fl(n=process.platform,t=process.env){let r=H8(n,t);if(!r)return Promise.resolve({error:"No folder dialog is available on this system"});return new Promise((e)=>{let a=B8(r.cmd,r.args,{env:t,stdio:["ignore","pipe","pipe"]}),l="",s=!1,d=(L)=>{if(s)return;s=!0,clearTimeout(c),e(L)},c=setTimeout(()=>{a.kill(),d({error:"The folder dialog timed out"})},X8);a.stdout.on("data",(L)=>{l+=L.toString()}),a.on("error",()=>d({error:`Could not open the folder dialog (${r.cmd})`})),a.on("close",()=>{let L=l.trim().replace(/\/+$/,"");if(!L)return d({cancelled:!0});if(!kl(L)||!J8(L).isDirectory())return d({error:"That selection is not a folder on disk"});d({path:L})})})}var Bl=`<!doctype html>
+$dialog.Description = '${On}'
+if ($dialog.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write($dialog.SelectedPath) }`,Sc=[{binary:"zenity",args:["--file-selection","--directory",`--title=${On}`]},{binary:"kdialog",args:["--getexistingdirectory",".","--title",On]}],Dc=(e,t)=>(t.PATH??"").split(Eg).some((n)=>n.length>0&&kc(Pg(n,e)));function Rc(e,t){if(e==="darwin"||e==="win32")return!0;if(e!=="linux")return!1;if(!t.DISPLAY&&!t.WAYLAND_DISPLAY)return!1;return Sc.some((n)=>Dc(n.binary,t))}function Og(e,t){if(e==="darwin")return{cmd:"osascript",args:["-e",Ig]};if(e==="win32")return{cmd:"powershell.exe",args:["-NoProfile","-STA","-Command",_g]};let n=Sc.find((r)=>Dc(r.binary,t));return n?{cmd:n.binary,args:n.args}:null}function Ac(e=process.platform,t=process.env){let n=Og(e,t);if(!n)return Promise.resolve({error:"No folder dialog is available on this system"});return new Promise((r)=>{let o=Rg(n.cmd,n.args,{env:t,stdio:["ignore","pipe","pipe"]}),i="",s=!1,a=(c)=>{if(s)return;s=!0,clearTimeout(l),r(c)},l=setTimeout(()=>{o.kill(),a({error:"The folder dialog timed out"})},Tg);o.stdout.on("data",(c)=>{i+=c.toString()}),o.on("error",()=>a({error:`Could not open the folder dialog (${n.cmd})`})),o.on("close",()=>{let c=i.trim().replace(/\/+$/,"");if(!c)return a({cancelled:!0});if(!kc(c)||!Ag(c).isDirectory())return a({error:"That selection is not a folder on disk"});a({path:c})})})}var Ec=`<!doctype html>
 <html lang="en">
 <head>
   <meta charset="utf-8">
@@ -3361,7 +3361,6 @@ var requestJson = async (path, init) => {
 var errorText = (result) => result.error ?? (Array.isArray(result.data?.errors) && result.data.errors.length ? result.data.errors.join(\`
 \`) : null) ?? result.data?.error ?? \`Request failed (status \${result.status}).\`;
 var isWriteSuccess = (result) => result.ok && !(Array.isArray(result.data?.errors) && result.data.errors.length > 0);
-var isPolicyState = (value) => !!value && typeof value === "object" && !!value.policy && typeof value.policy === "object" && !!value.policy.safety && !!value.policy.workflow && !!value.policy.secret_protection && Array.isArray(value.destructiveCommandRules) && Array.isArray(value.secretPatterns) && (value.preview === null || value.preview && typeof value.preview === "object") && Array.isArray(value.errors);
 var qs = (id) => document.getElementById(id);
 var setDetailStatus = (text, kind = "") => {
   qs("status").textContent = text;
@@ -3484,7 +3483,6 @@ var applyView = () => {
   if (view === "rules" && rulesData && pendingRuleFocus)
     renderRules();
 };
-var isActivityFeed = (value) => !!value && typeof value === "object" && Array.isArray(value.entries) && !!value.counts && typeof value.counts === "object";
 var agentLabels = integrationDisplayNames;
 var tierCountHtml = (segments) => {
   const parts = segments.filter(([count]) => count > 0).map(([count, label, tone]) => tone ? \`<span class="count-\${tone}">\${count} \${label}</span>\` : \`\${count} \${label}\`);
@@ -3590,9 +3588,10 @@ var renderTopList = (containerId, counts, className, dataAttr) => {
   const top = Object.entries(counts).sort((a, b) => b[1] - a[1]).slice(0, 5);
   qs(containerId).innerHTML = top.length === 0 ? '<p class="empty">No blocked commands in this window.</p>' : top.map(([key, count]) => \`<button type="button" class="\${className}" \${dataAttr}="\${escapeHtml(key)}"><code class="rule-id">\${escapeHtml(key)}</code><span class="chip-count">\${count.toLocaleString("en-US")}</span></button>\`).join("");
 };
-var renderTopRules = () => {
+var renderTopLists = () => {
   if (!overview)
     return;
+  renderTopList("top-commands", overview.counts.commands, "top-command", "data-command");
   renderTopList("top-rules", overview.counts.rules, "top-rule", "data-rule-id");
 };
 var findSuspects = (entries) => {
@@ -3620,15 +3619,6 @@ var jumpToActivityRule = (ruleId) => {
   }
   location.hash = "activity";
 };
-var renderTopCommands = () => {
-  if (!overview)
-    return;
-  renderTopList("top-commands", overview.counts.commands, "top-command", "data-command");
-};
-var renderTopLists = () => {
-  renderTopCommands();
-  renderTopRules();
-};
 var renderGuardErrors = () => {
   if (!overview)
     return;
@@ -3694,7 +3684,7 @@ var renderActivityFeed = () => {
 };
 var loadOverview = async () => {
   const result = await requestJson(\`/api/activity?days=\${overviewDays()}\`);
-  if (!result.ok || !isActivityFeed(result.data)) {
+  if (!result.ok || !result.data) {
     const message = \`<p class="empty">Could not load activity: \${escapeHtml(errorText(result))}</p>\`;
     qs("overview-window").textContent = "";
     qs("overview-tiles").innerHTML = "";
@@ -3702,7 +3692,8 @@ var loadOverview = async () => {
     qs("guard-errors").hidden = true;
     return;
   }
-  overview = result.data;
+  const feed = result.data;
+  overview = feed;
   qs("logs-path").textContent = overview.logsDir ?? "Not available";
   renderOverviewActivity();
   renderTopLists();
@@ -3710,13 +3701,14 @@ var loadOverview = async () => {
 };
 var loadActivity = async () => {
   const result = await requestJson(\`/api/activity?days=\${activityFilters.days}\`);
-  if (!result.ok || !isActivityFeed(result.data)) {
+  if (!result.ok || !result.data) {
     const message = \`<p class="empty">Could not load activity: \${escapeHtml(errorText(result))}</p>\`;
     qs("activity-feed").innerHTML = message;
     qs("activity-count").textContent = "";
     return;
   }
-  activity = result.data;
+  const feed = result.data;
+  activity = feed;
   suspects = findSuspects(activity.entries);
   if (activityFilters.agent !== "all" && !(activityFilters.agent in activity.counts.agents)) {
     activityFilters.agent = "all";
@@ -3730,20 +3722,20 @@ var loadActivity = async () => {
   renderActivityControls();
   renderActivityFeed();
 };
-var refreshActivity = async () => {
-  const button = qs("activity-refresh");
+var runRefresh = async (buttonId, reload) => {
+  const button = qs(buttonId);
   if (button.disabled)
     return;
   button.disabled = true;
   button.classList.add("spinning");
-  await Promise.all([
-    loadOverview(),
-    loadActivity(),
-    new Promise((resolve) => setTimeout(resolve, 600))
-  ]);
-  button.classList.remove("spinning");
-  button.disabled = false;
+  try {
+    await Promise.all([reload(), new Promise((resolve) => setTimeout(resolve, 600))]);
+  } finally {
+    button.classList.remove("spinning");
+    button.disabled = false;
+  }
 };
+var refreshActivity = () => runRefresh("activity-refresh", () => Promise.all([loadOverview(), loadActivity()]));
 var renderIntegrations = () => {
   const loaded = integrations;
   if (!loaded)
@@ -3800,17 +3792,10 @@ var loadIntegrations = async () => {
   qs("integrations-platform").textContent = result.data.system.platform;
   qs("integrations-system").hidden = false;
 };
-var refreshIntegrations = async () => {
-  const button = qs("integrations-refresh");
-  if (button.disabled)
-    return;
-  button.disabled = true;
-  button.classList.add("spinning");
+var refreshIntegrations = () => runRefresh("integrations-refresh", () => {
   integrationsRequested = true;
-  await Promise.all([loadIntegrations(), new Promise((resolve) => setTimeout(resolve, 600))]);
-  button.classList.remove("spinning");
-  button.disabled = false;
-};
+  return loadIntegrations();
+});
 var renderRules = () => {
   const loaded = rulesData;
   if (!loaded)
@@ -3862,17 +3847,10 @@ var loadRules = async () => {
   rulesData = result.data;
   renderRules();
 };
-var refreshRules = async () => {
-  const button = qs("rules-refresh");
-  if (button.disabled)
-    return;
-  button.disabled = true;
-  button.classList.add("spinning");
+var refreshRules = () => runRefresh("rules-refresh", () => {
   rulesRequested = true;
-  await Promise.all([loadRules(), new Promise((resolve) => setTimeout(resolve, 600))]);
-  button.classList.remove("spinning");
-  button.disabled = false;
-};
+  return loadRules();
+});
 var jumpToRulesRule = (ruleId) => {
   pendingRuleFocus = ruleId.replace(/^custom\\./, "");
   location.hash = "rules";
@@ -4278,6 +4256,14 @@ var createPathList = (prefix, config) => {
   };
   return { render, add, remove };
 };
+var validatePathAdditions = async (patch) => {
+  const candidate = collectFormPolicy();
+  patch(candidate);
+  const result = await requestPolicyPreview(candidate);
+  if (result.ok && result.data?.preview)
+    return null;
+  return errorText(result);
+};
 var pathLists = {
   "deny-paths": createPathList("deny-paths", {
     getPaths: () => draftPolicy.secret_protection.deny_paths,
@@ -4286,17 +4272,9 @@ var pathLists = {
     },
     isDisabled: () => !draftPolicy.secret_protection.enabled,
     itemLabel: "deny path",
-    validateAdditions: async (paths) => {
-      const candidate = collectFormPolicy();
-      candidate.secret_protection = {
-        ...candidate.secret_protection,
-        deny_paths: paths
-      };
-      const result = await requestPolicyPreview(candidate);
-      if (result.ok && result.data?.preview)
-        return null;
-      return errorText(result);
-    }
+    validateAdditions: (paths) => validatePathAdditions((candidate) => {
+      candidate.secret_protection = { ...candidate.secret_protection, deny_paths: paths };
+    })
   }),
   "secret-allow-paths": createPathList("secret-allow-paths", {
     getPaths: () => draftPolicy.secret_protection.allow_paths,
@@ -4305,17 +4283,9 @@ var pathLists = {
     },
     isDisabled: () => !draftPolicy.secret_protection.enabled,
     itemLabel: "allow path",
-    validateAdditions: async (paths) => {
-      const candidate = collectFormPolicy();
-      candidate.secret_protection = {
-        ...candidate.secret_protection,
-        allow_paths: paths
-      };
-      const result = await requestPolicyPreview(candidate);
-      if (result.ok && result.data?.preview)
-        return null;
-      return errorText(result);
-    }
+    validateAdditions: (paths) => validatePathAdditions((candidate) => {
+      candidate.secret_protection = { ...candidate.secret_protection, allow_paths: paths };
+    })
   }),
   "allow-paths": createPathList("allow-paths", {
     getPaths: () => draftPolicy.destructive_command_protection.allow_paths,
@@ -4324,17 +4294,12 @@ var pathLists = {
     },
     isDisabled: () => !draftPolicy.destructive_command_protection.enabled,
     itemLabel: "allow path",
-    validateAdditions: async (paths) => {
-      const candidate = collectFormPolicy();
+    validateAdditions: (paths) => validatePathAdditions((candidate) => {
       candidate.destructive_command_protection = {
         ...candidate.destructive_command_protection,
         allow_paths: paths
       };
-      const result = await requestPolicyPreview(candidate);
-      if (result.ok && result.data?.preview)
-        return null;
-      return errorText(result);
-    }
+    })
   })
 };
 var pathListFor = (name) => name === "deny-paths" || name === "allow-paths" || name === "secret-allow-paths" ? pathLists[name] : null;
@@ -4713,7 +4678,7 @@ var restoreDraft = () => {
 };
 async function load() {
   const result = await requestJson("/api/policy");
-  if (!isPolicyState(result.data)) {
+  if (!result.ok || !result.data) {
     setAppStatus("Load failed", "error");
     setDetailStatus(\`Error: Could not load policy: \${errorText(result)}\`, "error");
     return false;
@@ -4773,6 +4738,22 @@ document.addEventListener("paste", (event) => {
   list.add(\`\${input.value}
 \${text}\`);
 });
+var writePolicy = async (path, body, failureStatus) => {
+  const result = await requestJson(path, { method: "POST", body });
+  if (isWriteSuccess(result))
+    return result;
+  setAppStatus(failureStatus, "error");
+  setDetailStatus(\`Error: \${errorText(result)}\`, "error");
+  return null;
+};
+var reloadAfterWrite = async () => {
+  sessionStorage.removeItem("cc-safety-net-draft");
+  if (!await load())
+    return false;
+  dirty = false;
+  setDetailStatus("");
+  return true;
+};
 var saveRetentionDays = async (days) => {
   const saved = state;
   if (!saved)
@@ -4805,14 +4786,8 @@ var saveRetentionDays = async (days) => {
   await runExclusive("Saving...", async () => {
     const policy = clonePolicy(saved.policy);
     policy.audit.retention_days = days;
-    const result = await requestJson("/api/policy", {
-      method: "POST",
-      body: JSON.stringify(policy)
-    });
-    if (!isWriteSuccess(result)) {
+    if (!await writePolicy("/api/policy", JSON.stringify(policy), "Save failed")) {
       qs("retention-days").value = String(current);
-      setAppStatus("Save failed", "error");
-      setDetailStatus(\`Error: \${errorText(result)}\`, "error");
       return;
     }
     if (!await load())
@@ -5228,22 +5203,11 @@ qs("save").onclick = () => {
   }
   const policy = collectFormPolicy();
   runExclusive("Saving...", async () => {
-    const result = await requestJson("/api/policy", {
-      method: "POST",
-      body: JSON.stringify(policy)
-    });
-    if (!isWriteSuccess(result)) {
-      setAppStatus("Save failed", "error");
-      setDetailStatus(\`Error: \${errorText(result)}\`, "error");
+    const result = await writePolicy("/api/policy", JSON.stringify(policy), "Save failed");
+    if (!result)
       return;
-    }
-    const savedPath = result.data.path;
-    sessionStorage.removeItem("cc-safety-net-draft");
-    if (await load()) {
-      dirty = false;
-      setAppStatus(\`Saved \${savedPath}.\`, "ok");
-      setDetailStatus("");
-    }
+    if (await reloadAfterWrite())
+      setAppStatus(\`Saved \${result.data.path}.\`, "ok");
   });
 };
 qs("repair").onclick = async () => {
@@ -5267,19 +5231,11 @@ qs("repair").onclick = async () => {
     return;
   }
   runExclusive("Repairing...", async () => {
-    const result = await requestJson("/api/repair", { method: "POST", body: "{}" });
-    if (!isWriteSuccess(result)) {
-      setAppStatus("Repair failed", "error");
-      setDetailStatus(\`Error: \${errorText(result)}\`, "error");
+    const result = await writePolicy("/api/repair", "{}", "Repair failed");
+    if (!result)
       return;
-    }
-    const repairedPath = result.data.path;
-    sessionStorage.removeItem("cc-safety-net-draft");
-    if (await load()) {
-      dirty = false;
-      setAppStatus(\`Repaired \${repairedPath}.\`, "ok");
-      setDetailStatus("");
-    }
+    if (await reloadAfterWrite())
+      setAppStatus(\`Repaired \${result.data.path}.\`, "ok");
   });
 };
 qs("reset").onclick = async () => {
@@ -5297,19 +5253,11 @@ qs("reset").onclick = async () => {
     return;
   }
   runExclusive("Resetting...", async () => {
-    const result = await requestJson("/api/reset", { method: "POST", body: "{}" });
-    if (!isWriteSuccess(result)) {
-      setAppStatus("Reset failed", "error");
-      setDetailStatus(\`Error: \${errorText(result)}\`, "error");
+    const result = await writePolicy("/api/reset", "{}", "Reset failed");
+    if (!result)
       return;
-    }
-    const resetPath = result.data.path;
-    sessionStorage.removeItem("cc-safety-net-draft");
-    if (await load()) {
-      dirty = false;
-      setAppStatus(\`Reset \${resetPath} to defaults.\`, "ok");
-      setDetailStatus("");
-    }
+    if (await reloadAfterWrite())
+      setAppStatus(\`Reset \${result.data.path} to defaults.\`, "ok");
   });
 };
 setRawCopyCopied(false);
@@ -5361,5 +5309,5 @@ load().then((loaded) => {
   </script>
 </body>
 </html>
-`;var Jl='<script id="ccsn-data" type="application/json">';function Zl(n){return Bl.replace(Jl,()=>Jl+JSON.stringify({token:n}).replaceAll("<","\\u003c"))}var Xt="kenryu42/cc-safety-net",V8=`https://github.com/${Xt}`,jr=1e4,A8=7;async function Ml(n,t={}){let r=J({label:"gui",booleans:{noOpen:["--no-open"]}},n),e=t.log??console.log,a=t.error??console.error;if(r.errors.length>0){for(let s of r.errors)a(s);return a("Usage: cc-safety-net gui [--no-open]"),1}let l=await M8(t);if(e(`CC Safety Net policy GUI: ${l.url}`),!r.flags.noOpen)try{await(t.openBrowser??P8)(l.url)}catch(s){a(`Failed to open browser: ${s instanceof Error?s.message:String(s)}`),a(`Open this URL manually: ${l.url}`)}if(t.keepAlive===!1)return await l.close(),0;return await E8(l),0}async function M8(n={}){let t=n.token??W8(24).toString("base64url"),r=K8((l,s)=>{G8(l,s,t,n)});await new Promise((l,s)=>{r.once("error",s),r.listen(0,"127.0.0.1",()=>{r.off("error",s),l()})});let a=`http://127.0.0.1:${r.address().port}`;return{origin:a,token:t,url:`${a}/?token=${encodeURIComponent(t)}`,close:()=>_8(r)}}async function G8(n,t,r,e){let a=new URL(n.url??"/","http://127.0.0.1");if(n.method==="GET"&&a.pathname==="/favicon.ico"){t.writeHead(204,{"cache-control":"no-store"}),t.end();return}if(!O8(n,a,r)){q(t,403,{error:"Forbidden"});return}if(n.method==="GET"&&a.pathname==="/"){T8(t,Zl(r));return}if(n.method==="GET"&&a.pathname==="/api/policy"){let l=Sl(e);q(t,200,{...l,configState:xn(A(e)),destructiveCommandRules:fn,secretPatterns:Xl,version:B(),preview:l.errors.length>0?null:Wl(l.policy)});return}if(n.method==="POST"&&a.pathname==="/api/policy/preview"){let l=await Qt(n);if(!l.ok){q(t,400,{errors:[l.error]});return}let s=Hl(l.value);q(t,s.errors.length>0?400:200,s);return}if(n.method==="POST"&&a.pathname==="/api/policy/explain"){let l=await Qt(n);if(!l.ok){q(t,400,{errors:[l.error]});return}let s=l.value;if(s===null||typeof s.command!=="string"){q(t,400,{errors:["command must be a string"]});return}let d=p1(s.policy);if(d.length>0){q(t,400,{errors:d});return}q(t,200,U8(s.command,s.policy,e));return}if(n.method==="POST"&&a.pathname==="/api/policy"){let l=await Qt(n);if(!l.ok){q(t,400,{errors:[l.error]});return}let s=kr(l.value,e);q(t,s.errors.length>0?400:200,s);return}if(n.method==="POST"&&a.pathname==="/api/reset"){q(t,200,kr(Yl,e));return}if(n.method==="POST"&&a.pathname==="/api/repair"){q(t,200,Kl(e));return}if(n.method==="GET"&&a.pathname==="/api/activity"){let l=T2(e),s=C8(a.searchParams.get("days"),l);if(s===null){q(t,400,{error:`days must be an integer between 1 and ${l}`});return}q(t,200,gl(s,e.activityLogsDir));return}if(n.method==="POST"&&a.pathname==="/api/rules/choose-directory"){q(t,200,await Fl());return}if(n.method==="GET"&&a.pathname==="/api/rules"){let l=y2(e),s=new Map(l.rules.map((d)=>[d.name,d]));q(t,200,{projectPath:e.cwd??process.cwd(),canPickDirectory:zl(process.platform,process.env),rulebooks:l.rulebooks.map((d)=>({source:d.source,spec:d.spec,name:d.name,version:d.version,rules:d.rules.flatMap((c)=>{let L=s.get(c);if(!L)return[];return[{name:L.name,command:L.command,subcommand:L.subcommand,block_args:L.block_args,reason:L.reason}]})})),errors:l.errors,warnings:l.warnings});return}if(n.method==="GET"&&a.pathname==="/api/star/context"){q(t,200,await(e.fetchStarContext??(()=>r4({logsDir:e.activityLogsDir})))());return}if(n.method==="POST"&&a.pathname==="/api/star"){let l=await(e.starRepo??I8)();q(t,200,l.ok?{ok:!0}:{ok:!1,fallbackUrl:V8});return}if(n.method==="GET"&&a.pathname==="/api/integrations"){q(t,200,await(e.fetchIntegrations??N8)());return}if(n.method==="GET"&&a.pathname==="/api/health"){q(t,200,await(e.fetchHealth??n4)());return}if(n.method==="POST"&&(a.pathname==="/api/install"||a.pathname==="/api/uninstall")){let l=await Qt(n);if(!l.ok){q(t,400,{errors:[l.error]});return}let s=l.value?.target;if(typeof s!=="string"||!T.some((c)=>c.target===s)){q(t,400,{error:"unknown target"});return}let d=a.pathname==="/api/install"?"install":"uninstall";q(t,200,await(e.runIntegration??t4)(d,s));return}q(t,404,{error:"Not found"})}function U8(n,t,r){let e=wt(t),a=A(r),l=yn({rules:a.policy.rules,transparentWrappers:a.policy.transparentWrappers,safety:Vl(e.safety),worktreeMode:e.workflow.worktree_mode,destructiveCommandProtectionEnabled:e.destructive_command_protection.enabled,destructiveCommandRuleOverrides:e.destructive_command_protection.overrides,destructiveCommandAllowPaths:e.destructive_command_protection.allow_paths,secretProtection:{enabled:e.secret_protection.enabled,disabledRules:[...Rl(e.secret_protection.overrides)],denyPaths:e.secret_protection.deny_paths,allowPaths:e.secret_protection.allow_paths}});return O2(n,{policySnapshot:l,cwd:r.cwd,userConfigDir:r.userConfigDir})}function C8(n,t){if(n===null)return Math.min(A8,t);let r=Number(n);if(!Number.isInteger(r)||r<1||r>t)return null;return r}function O8(n,t,r){if(t.searchParams.get("token")!==r)return!1;if(n.method!=="POST")return!0;return n.headers["x-cc-safety-net-token"]===r}async function Qt(n){let t=[];for await(let r of n)t.push(r);try{return{ok:!0,value:JSON.parse(Buffer.concat(t).toString("utf-8")||"{}")}}catch(r){return{ok:!1,error:`Invalid JSON: ${r instanceof Error?r.message:String(r)}`}}}function T8(n,t){n.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),n.end(t)}function q(n,t,r){n.writeHead(t,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),n.end(JSON.stringify(r))}function _8(n){return new Promise((t,r)=>{n.close((e)=>e?r(e):t())})}function E8(n){return new Promise((t)=>{let r=()=>{process.off("SIGINT",e),process.off("SIGTERM",e)},e=()=>{r(),n.close().then(t)};process.once("SIGINT",e),process.once("SIGTERM",e)})}function P8(n){let t=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",r=process.platform==="win32"?["/c","start","",n]:[n];return new Promise((e,a)=>{let l=Al(t,r,{detached:!0,stdio:"ignore"}),s=(c)=>{l.off("spawn",d),a(c)},d=()=>{l.off("error",s),l.unref(),e()};l.once("error",s),l.once("spawn",d)})}async function I8(n="gh",t=jr){return{ok:await qr(n,["api","-X","PUT",`/user/starred/${Xt}`],t)===0}}async function N8(n={}){let t=await gn(n.fetcher),r=Gl(t,n.homeDir);return{targets:G.map((e)=>{let a=r.find((l)=>l.platform===e.id);return{target:e.id,label:j(e.id),version:t.versions[e.id]??null,status:a?.configured?"active":a?.detected?"disabled":a?.inspectionStatus==="not-inspected"?"not-inspected":"not-installed"}}),system:{version:t.version,nodeVersion:t.nodeVersion,platform:t.platform}}}function Gl(n,t){return an(process.cwd(),{homeDir:t,ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.versions["copilot-cli"]})}async function n4(n={}){let[t,r]=await Promise.all([gn(n.fetcher),(n.checkUpdates??I2)()]);return{hooks:Gl(t,n.homeDir).filter((e)=>e.detected).map((e)=>({platform:e.platform,label:j(e.platform),configured:e.configured})),update:{currentVersion:r.currentVersion,latestVersion:r.latestVersion??null,updateAvailable:r.updateAvailable}}}var Ql=Promise.resolve();function t4(n,t,r={}){let e=async()=>{let l=[],s=console.log,d=console.error;console.log=(...c)=>l.push(c.map(String).join(" ")),console.error=console.log;try{return{ok:await Wn(n,[],{selectTargets:async()=>[t],output:new R8({write(L,i,v){l.push(String(L).replace(/\n$/,"")),v()}}),...r})===0,output:l.join(`
-`)}}finally{console.log=s,console.error=d}},a=Ql.then(e);return Ql=a.then(()=>{return},()=>{return}),a}async function r4(n={}){let[t,r,e]=await Promise.all([e4(n.command),a4(n.fetchRepo),Promise.resolve(_n(T2(),n.logsDir).totalBlocked)]);return{starred:t,starCount:r,blockedTotal:e}}async function e4(n="gh",t=jr){if(await qr(n,["auth","status"],t)!==0)return null;let r=await qr(n,["api",`/user/starred/${Xt}`],t);if(r===0)return!0;if(r===null)return null;return!1}function qr(n,t,r){return new Promise((e)=>{let a=Al(n,t,{stdio:"ignore",windowsHide:!0}),l=!1,s,d=(c)=>{if(l)return;if(l=!0,s)clearTimeout(s);e(c)};a.once("error",()=>d(null)),a.once("close",d),s=setTimeout(()=>{a.kill(),d(null)},r)})}async function a4(n=fetch){try{let t=await n(`https://api.github.com/repos/${Xt}`,{headers:{accept:"application/vnd.github+json"},signal:AbortSignal.timeout(jr)});if(!t.ok)return null;let r=await t.json();return typeof r.stargazers_count==="number"?r.stargazers_count:null}catch{return null}}function l4(n){if(n[0]!=="help")return!1;let t=n[1];if(!t)lr(),process.exit(0);if(Yn(t))process.exit(0);console.error(`Unknown command: ${t}`),console.error("Run 'cc-safety-net --help' for available commands."),process.exit(1)}var s4={hook:async(n)=>{let t=_e(n);if(t){await t.run();return}console.error("hook requires exactly one integration flag. Try: cc-safety-net hook --kimi-code"),Yn("hook",console.error),process.exit(1)},install:async(n)=>{process.exit(await Wn("install",n))},update:async(n)=>{process.exit(await xr(n))},uninstall:async(n)=>{process.exit(await Wn("uninstall",n))},rule:async(n)=>{process.exit(await $l(n))},status:async(n)=>{if(s2(J({label:"status"},n).errors))process.exit(1);ml()},statusline:async(n)=>{let t=J({label:"statusline",booleans:{claudeCode:["-cc","--claude-code"]}},n);if(t.errors.length===0&&t.flags.claudeCode){await gr();return}if(s2(t.errors),!t.flags.claudeCode)console.error("statusline requires --claude-code (-cc)");Yn("statusline",console.error),process.exit(1)},doctor:async(n)=>{let t=nr(n);if(!t)process.exit(1);let r=await I0({json:t.json,skipUpdateCheck:t.skipUpdateCheck});process.exit(r)},logs:async(n)=>{process.exit(await he(n))},gui:async(n)=>{process.exit(await Ml(n))},explain:async(n)=>{process.exit(await l3(n))}};async function d4(){let n=process.argv.slice(2),t=J({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},n);if(l4(n))return;let r=n[0],e=r?Tn(r):void 0;if(t.help&&e&&e.name!=="rule")Yn(e.name),process.exit(0);if(!r||t.help&&!e)lr(),process.exit(0);if(t.flags.version)c3(),process.exit(0);if(e){await s4[e.name](n.slice(1));return}let a=Ee(r);if(a){await a.run();return}if(r==="--statusline"){await gr();return}console.error(r.startsWith("-")?`Unknown option: ${r}`:`Unknown command: ${r}`),console.error("Run 'cc-safety-net --help' for usage."),process.exit(1)}d4().catch((n)=>{console.error("CC Safety Net error:",n),process.exit(1)});
+`;var Pc='<script id="ccsn-data" type="application/json">';function Tc(e){return Ec.replace(Pc,()=>Pc+JSON.stringify({token:e}).replaceAll("<","\\u003c"))}var Nn="kenryu42/cc-safety-net",Hg=`https://github.com/${Nn}`,Eo=1e4,Mg=7;async function Gc(e,t={}){let n=T({label:"gui",booleans:{noOpen:["--no-open"]}},e),r=t.log??console.log,o=t.error??console.error;if(n.errors.length>0){for(let s of n.errors)o(s);return o("Usage: cc-safety-net gui [--no-open]"),1}let i=await jg(t);if(r(`CC Safety Net policy GUI: ${i.url}`),!n.flags.noOpen)try{await(t.openBrowser??Wg)(i.url)}catch(s){o(`Failed to open browser: ${s instanceof Error?s.message:String(s)}`),o(`Open this URL manually: ${i.url}`)}if(t.keepAlive===!1)return await i.close(),0;return await Kg(i),0}async function jg(e={}){let t=$g(24).toString("base64url"),n=Ng((i,s)=>{Ug(i,s,t,e)});await new Promise((i,s)=>{n.once("error",s),n.listen(0,"127.0.0.1",()=>{n.off("error",s),i()})});let o=`http://127.0.0.1:${n.address().port}`;return{origin:o,token:t,url:`${o}/?token=${encodeURIComponent(t)}`,close:()=>zg(n)}}async function Ug(e,t,n,r){let o=new URL(e.url??"/","http://127.0.0.1");if(e.method==="GET"&&o.pathname==="/favicon.ico"){t.writeHead(204,{"cache-control":"no-store"}),t.end();return}if(!qg(e,o,n)){D(t,403,{error:"Forbidden"});return}if(e.method==="GET"&&o.pathname==="/"){Vg(t,Tc(n));return}if(e.method==="GET"&&o.pathname==="/api/policy"){let i=$c(r);D(t,200,{...i,configState:bt(B(r)),destructiveCommandRules:ht,secretPatterns:_c,version:P(),preview:i.errors.length>0?null:Fc(i.policy)});return}if(e.method==="POST"&&o.pathname==="/api/policy/preview"){let i=await $n(e);if(!i.ok){D(t,400,{errors:[i.error]});return}let s=Nc(i.value);D(t,s.errors.length>0?400:200,s);return}if(e.method==="POST"&&o.pathname==="/api/policy/explain"){let i=await $n(e);if(!i.ok){D(t,400,{errors:[i.error]});return}let s=i.value;if(s===null||typeof s.command!=="string"){D(t,400,{errors:["command must be a string"]});return}let a=fr(s.policy);if(a.length>0){D(t,400,{errors:a});return}D(t,200,Gg(s.command,s.policy,r));return}if(e.method==="POST"&&o.pathname==="/api/policy"){let i=await $n(e);if(!i.ok){D(t,400,{errors:[i.error]});return}let s=Ro(i.value,r);D(t,s.errors.length>0?400:200,s);return}if(e.method==="POST"&&o.pathname==="/api/reset"){D(t,200,Ro(Oc,r));return}if(e.method==="POST"&&o.pathname==="/api/repair"){D(t,200,Hc(r));return}if(e.method==="GET"&&o.pathname==="/api/activity"){let i=Je(r),s=Bg(o.searchParams.get("days"),i);if(s===null){D(t,400,{error:`days must be an integer between 1 and ${i}`});return}D(t,200,Cc(s,r.activityLogsDir));return}if(e.method==="POST"&&o.pathname==="/api/rules/choose-directory"){D(t,200,await Ac());return}if(e.method==="GET"&&o.pathname==="/api/rules"){let i=Le(r),s=new Map(i.rules.map((a)=>[a.name,a]));D(t,200,{projectPath:r.cwd??process.cwd(),canPickDirectory:Rc(process.platform,process.env),rulebooks:i.rulebooks.map((a)=>({source:a.source,spec:a.spec,name:a.name,version:a.version,rules:a.rules.flatMap((l)=>{let c=s.get(l);if(!c)return[];return[{name:c.name,command:c.command,subcommand:c.subcommand,block_args:c.block_args,reason:c.reason}]})})),errors:i.errors,warnings:i.warnings});return}if(e.method==="GET"&&o.pathname==="/api/star/context"){D(t,200,await(r.fetchStarContext??(()=>Qg({logsDir:r.activityLogsDir})))());return}if(e.method==="POST"&&o.pathname==="/api/star"){let i=await(r.starRepo??Jg)();D(t,200,i.ok?{ok:!0}:{ok:!1,fallbackUrl:Hg});return}if(e.method==="GET"&&o.pathname==="/api/integrations"){D(t,200,await(r.fetchIntegrations??Yg)());return}if(e.method==="GET"&&o.pathname==="/api/health"){D(t,200,await(r.fetchHealth??Zg)());return}if(e.method==="POST"&&(o.pathname==="/api/install"||o.pathname==="/api/uninstall")){let i=await $n(e);if(!i.ok){D(t,400,{errors:[i.error]});return}let s=i.value?.target;if(typeof s!=="string"||!se.some((l)=>l.target===s)){D(t,400,{error:"unknown target"});return}let a=o.pathname==="/api/install"?"install":"uninstall";D(t,200,await(r.runIntegration??Xg)(a,s));return}D(t,404,{error:"Not found"})}function Gg(e,t,n){let r=wn(t),o=B(n),i=yt({rules:o.policy.rules,transparentWrappers:o.policy.transparentWrappers,safety:jc(r.safety),worktreeMode:r.workflow.worktree_mode,destructiveCommandProtectionEnabled:r.destructive_command_protection.enabled,destructiveCommandRuleOverrides:r.destructive_command_protection.overrides,destructiveCommandAllowPaths:r.destructive_command_protection.allow_paths,secretProtection:{enabled:r.secret_protection.enabled,disabledRules:Mc(r.secret_protection.overrides),denyPaths:r.secret_protection.deny_paths,allowPaths:r.secret_protection.allow_paths}});return We(e,{policySnapshot:i,cwd:n.cwd,userConfigDir:n.userConfigDir})}function Bg(e,t){if(e===null)return Math.min(Mg,t);let n=Number(e);if(!Number.isInteger(n)||n<1||n>t)return null;return n}function qg(e,t,n){if(t.searchParams.get("token")!==n)return!1;if(e.method!=="POST")return!0;return e.headers["x-cc-safety-net-token"]===n}async function $n(e){let t=[];for await(let n of e)t.push(n);try{return{ok:!0,value:JSON.parse(Buffer.concat(t).toString("utf-8")||"{}")}}catch(n){return{ok:!1,error:`Invalid JSON: ${n instanceof Error?n.message:String(n)}`}}}function Vg(e,t){e.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),e.end(t)}function D(e,t,n){e.writeHead(t,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),e.end(JSON.stringify(n))}function zg(e){return new Promise((t,n)=>{e.close((r)=>r?n(r):t())})}function Kg(e){return new Promise((t)=>{let n=()=>{process.off("SIGINT",r),process.off("SIGTERM",r)},r=()=>{n(),e.close().then(t)};process.once("SIGINT",r),process.once("SIGTERM",r)})}function Wg(e){let t=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",n=process.platform==="win32"?["/c","start","",e]:[e];return new Promise((r,o)=>{let i=Uc(t,n,{detached:!0,stdio:"ignore"}),s=(l)=>{i.off("spawn",a),o(l)},a=()=>{i.off("error",s),i.unref(),r()};i.once("error",s),i.once("spawn",a)})}async function Jg(e="gh",t=Eo){return{ok:await Ao(e,["api","-X","PUT",`/user/starred/${Nn}`],t)===0}}async function Yg(e={}){let t=await St(e.fetcher),n=Bc(t,e.homeDir);return{targets:V.map((r)=>{let o=n.find((i)=>i.platform===r.id);return{target:r.id,label:R(r.id),version:t.versions[r.id]??null,status:o?.configured?"active":o?.detected?"disabled":o?.inspectionStatus==="not-inspected"?"not-inspected":"not-installed"}}),system:{version:t.version,nodeVersion:t.nodeVersion,platform:t.platform}}}function Bc(e,t){return it(process.cwd(),{homeDir:t,ampPluginListOutput:e.ampPluginListOutput,codexPluginListOutput:e.codexPluginListOutput,copilotCliVersion:e.versions["copilot-cli"]})}async function Zg(e={}){let[t,n]=await Promise.all([St(e.fetcher),(e.checkUpdates??Qe)()]);return{hooks:Bc(t,e.homeDir).filter((r)=>r.detected).map((r)=>({platform:r.platform,label:R(r.platform),configured:r.configured})),update:{currentVersion:n.currentVersion,latestVersion:n.latestVersion??null,updateAvailable:n.updateAvailable}}}var Ic=Promise.resolve();function Xg(e,t,n={}){let r=async()=>{let i=[],s=console.log,a=console.error;console.log=(...l)=>i.push(l.map(String).join(" ")),console.error=console.log;try{return{ok:await Ht(e,[],{selectTargets:async()=>[t],output:new Fg({write(c,d,p){i.push(String(c).replace(/\n$/,"")),p()}}),...n})===0,output:i.join(`
+`)}}finally{console.log=s,console.error=a}},o=Ic.then(r);return Ic=o.then(()=>{return},()=>{return}),o}async function Qg(e={}){let[t,n,r]=await Promise.all([e1(e.command),t1(e.fetchRepo),Promise.resolve(Yt(Je(),e.logsDir).totalBlocked)]);return{starred:t,starCount:n,blockedTotal:r}}async function e1(e="gh",t=Eo){if(await Ao(e,["auth","status"],t)!==0)return null;let n=await Ao(e,["api",`/user/starred/${Nn}`],t);if(n===0)return!0;if(n===null)return null;return!1}function Ao(e,t,n){return new Promise((r)=>{let o=Uc(e,t,{stdio:"ignore",windowsHide:!0}),i=!1,s,a=(l)=>{if(i)return;if(i=!0,s)clearTimeout(s);r(l)};o.once("error",()=>a(null)),o.once("close",a),s=setTimeout(()=>{o.kill(),a(null)},n)})}async function t1(e=fetch){try{let t=await e(`https://api.github.com/repos/${Nn}`,{headers:{accept:"application/vnd.github+json"},signal:AbortSignal.timeout(Eo)});if(!t.ok)return null;let n=await t.json();return typeof n.stargazers_count==="number"?n.stargazers_count:null}catch{return null}}function n1(e){if(e[0]!=="help")return!1;let t=e[1];if(!t)ao(),process.exit(0);if($t(t))process.exit(0);console.error(`Unknown command: ${t}`),console.error("Run 'cc-safety-net --help' for available commands."),process.exit(1)}var r1={hook:async(e)=>{let t=Zi(e);if(t){await t.run();return}console.error("hook requires exactly one integration flag. Try: cc-safety-net hook --kimi-code"),$t("hook",console.error),process.exit(1)},install:async(e)=>{process.exit(await Ht("install",e))},update:async(e)=>{process.exit(await xo(e))},uninstall:async(e)=>{process.exit(await Ht("uninstall",e))},rule:async(e)=>{process.exit(await bc(e))},status:async(e)=>{if(ae(T({label:"status"},e).errors))process.exit(1);xc()},statusline:async(e)=>{let t=T({label:"statusline",booleans:{claudeCode:["-cc","--claude-code"]}},e);if(t.errors.length===0&&t.flags.claudeCode){await Do();return}if(ae(t.errors),!t.flags.claudeCode)console.error("statusline requires --claude-code (-cc)");$t("statusline",console.error),process.exit(1)},doctor:async(e)=>{let t=no(e);if(!t)process.exit(1);let n=await Xa({json:t.json,skipUpdateCheck:t.skipUpdateCheck});process.exit(n)},logs:async(e)=>{process.exit(await bi(e))},gui:async(e)=>{process.exit(await Gc(e))},explain:async(e)=>{process.exit(await il(e))}};async function o1(){let e=process.argv.slice(2),t=T({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(n1(e))return;let n=e[0],r=n?Jt(n):void 0;if(t.help&&r&&r.name!=="rule")$t(r.name),process.exit(0);if(!n||t.help&&!r)ao(),process.exit(0);if(t.flags.version)ll(),process.exit(0);if(r){await r1[r.name](e.slice(1));return}let o=Xi(n);if(o){await o.run();return}if(n==="--statusline"){await Do();return}console.error(n.startsWith("-")?`Unknown option: ${n}`:`Unknown command: ${n}`),console.error("Run 'cc-safety-net --help' for usage."),process.exit(1)}o1().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});