cc-safety-net 2.0.9 → 2.0.10

package/dist/bin/cc-safety-net.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{$ as gr,$a as Xn,A as gt,Aa as Go,B as dc,Ba as Bo,C as ee,Ca as fr,D as J,Da as qo,E as rr,Ea as Vo,F as Kn,Fa as Y,G as Bt,Ga as Zn,H as Wn,Ha as or,I as Je,Ia as ir,J as ke,Ja as Z,K as sr,Ka as Oc,L as ue,La as vt,M as Di,Ma as $c,N as mr,Na as Ro,O as qt,Oa as Nc,P as Ri,Pa as Fc,Q as Ai,Qa as Hc,R as Se,Ra as wn,S as zt,Sa as Mc,T as wt,Ta as jc,U as xt,Ua as fi,V as si,Va as mi,W as ht,Wa as gi,X as De,Xa as hi,Y as ar,Ya as mc,Z as pe,Za as ti,_ as Ei,_a as ni,aa as Ii,ab as ri,b as Io,ba as _i,bb as oi,c as _o,ca as lr,cb as Le,d as G,da as ai,db as Ce,e as Oo,ea as Ho,eb as ce,f as Bn,fa as li,fb as ii,g as N,ga as ci,gb as B,h as k,ha as di,hb as bt,i as pt,ia as cr,ib as yt,j as x,ja as Mo,jb as Ti,k as xe,ka as S,kb as Ae,l as Jo,la as dr,lb as fe,m as Be,ma as Pi,mb as ji,n as ft,na as de,nb as Vt,o as vc,oa as Lt,p as zn,pa as ur,q as Yo,qa as pr,r as mt,ra as ui,s as Zo,sa as pi,t as nr,ta as jo,u as Xo,ua as Ke,v as Qo,va as Jn,w as X,wa as Yn,x as Q,xa as ei,y as Ve,ya as Ue,z as ze,za as _c}from"../chunks/index-tdm5076r.js";var zc=["-h","--help"];function T(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.fromEntries(n.map(([d])=>[d,!1])),i={},s=[],a=[],l=!1,c=-1;for(let[d,p]of t.entries()){if(d<=c)continue;if(p==="--"){s.push(...t.slice(d+1));break}if(zc.includes(p)){l=!0;continue}let m=n.find(([,h])=>h.includes(p));if(m){o[m[0]]=!0;continue}let u=r.find(([,h])=>h.includes(p));if(u){let h=t[d+1];if(h===void 0||h.startsWith("-")){a.push(`${p} requires a value`);continue}i[u[0]]=h,c=d+1;continue}if(p.startsWith("-")){a.push(`Unknown option for ${e.label}: ${p}`);continue}if(e.positionals==="tail"){s.push(...t.slice(d));break}s.push(p)}if(e.positionals!=="list"&&e.positionals!=="tail")a.push(...s.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:o,values:i,positionals:s,help:l,errors:a}}function ae(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as Td,statSync as Li,unlinkSync as Id}from"node:fs";import{basename as vi,dirname as _d,join as Od,resolve as $d}from"node:path";function I(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var Mn=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},He=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as Kc,readdirSync as Wc,readFileSync as Jc}from"node:fs";import{join as Yc}from"node:path";function ye(e,t){try{return Wc(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=Yc(e,n.name);if(n.isDirectory())return ye(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&Kc(e))t.count++;return[]}}function jn(e){let t=(o)=>`${o.sessionId}
+import{$ as gr,$a as Xn,A as gt,Aa as Go,B as dc,Ba as Bo,C as ee,Ca as fr,D as J,Da as qo,E as rr,Ea as Vo,F as Kn,Fa as Y,G as Bt,Ga as Zn,H as Wn,Ha as or,I as Je,Ia as ir,J as ke,Ja as Z,K as sr,Ka as Oc,L as ue,La as vt,M as Di,Ma as $c,N as mr,Na as Ro,O as qt,Oa as Nc,P as Ri,Pa as Fc,Q as Ai,Qa as Hc,R as Se,Ra as wn,S as zt,Sa as Mc,T as wt,Ta as jc,U as xt,Ua as fi,V as si,Va as mi,W as ht,Wa as gi,X as De,Xa as hi,Y as ar,Ya as mc,Z as pe,Za as ti,_ as Ei,_a as ni,aa as Ii,ab as ri,b as Io,ba as _i,bb as oi,c as _o,ca as lr,cb as Le,d as G,da as ai,db as Ce,e as Oo,ea as Ho,eb as ce,f as Bn,fa as li,fb as ii,g as N,ga as ci,gb as B,h as k,ha as di,hb as bt,i as pt,ia as cr,ib as yt,j as x,ja as Mo,jb as Ti,k as xe,ka as S,kb as Ae,l as Jo,la as dr,lb as fe,m as Be,ma as Pi,mb as ji,n as ft,na as de,nb as Vt,o as vc,oa as Lt,p as zn,pa as ur,q as Yo,qa as pr,r as mt,ra as ui,s as Zo,sa as pi,t as nr,ta as jo,u as Xo,ua as Ke,v as Qo,va as Jn,w as X,wa as Yn,x as Q,xa as ei,y as Ve,ya as Ue,z as ze,za as _c}from"../chunks/index-dnak4vk0.js";var zc=["-h","--help"];function T(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.fromEntries(n.map(([d])=>[d,!1])),i={},s=[],a=[],l=!1,c=-1;for(let[d,p]of t.entries()){if(d<=c)continue;if(p==="--"){s.push(...t.slice(d+1));break}if(zc.includes(p)){l=!0;continue}let m=n.find(([,h])=>h.includes(p));if(m){o[m[0]]=!0;continue}let u=r.find(([,h])=>h.includes(p));if(u){let h=t[d+1];if(h===void 0||h.startsWith("-")){a.push(`${p} requires a value`);continue}i[u[0]]=h,c=d+1;continue}if(p.startsWith("-")){a.push(`Unknown option for ${e.label}: ${p}`);continue}if(e.positionals==="tail"){s.push(...t.slice(d));break}s.push(p)}if(e.positionals!=="list"&&e.positionals!=="tail")a.push(...s.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:o,values:i,positionals:s,help:l,errors:a}}function ae(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as Td,statSync as Li,unlinkSync as Id}from"node:fs";import{basename as vi,dirname as _d,join as Od,resolve as $d}from"node:path";function I(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var Mn=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},He=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as Kc,readdirSync as Wc,readFileSync as Jc}from"node:fs";import{join as Yc}from"node:path";function ye(e,t){try{return Wc(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=Yc(e,n.name);if(n.isDirectory())return ye(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&Kc(e))t.count++;return[]}}function jn(e){let t=(o)=>`${o.sessionId}
 ${He(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o)=>o.sessionId).reduce((o,i)=>o.set(t(i),(o.get(t(i))??0)+1),new Map);return new Set(n.filter((o)=>o.failureStage||(r.get(t(o))??0)>=2))}function ut(e,t){try{return Jc(e,"utf-8").split(`
 `).filter(Boolean).flatMap((n)=>{try{return[JSON.parse(n)]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as Cd}from"node:path";var Zc=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function $o(e){let t=0,n={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(r){e.record({kind:"step",scope:"global",step:r})},recordSegment(r,o=n.currentSegmentIndex){if(o===void 0)return;e.record({kind:"step",scope:"segment",segmentIndex:o,step:r})}};return n}function No(e={}){let t=[],n=e.maxEvents??512,r={maxTextLength:e.maxTextLength??2048,maxListLength:e.maxListLength??128,maxObjectProperties:e.maxObjectProperties??e.maxListLength??128,maxDepth:e.maxDepth??16},o=0,i,s=new Set;return{record(a){if(i)return;try{if(!a||t.length>=n){o++;return}t.push(Gn(Xc(a,r,s)))}catch{o++}},finish(a){if(i)return i;try{i=Gn({events:Object.freeze(t),droppedEvents:o,terminal:Qc(a,r,s)})}catch{o++,i=Object.freeze({events:Object.freeze(t),droppedEvents:o,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,r.maxTextLength),segment:"trace unavailable".slice(0,r.maxTextLength)})})}return i}}}function Xc(e,t,n){if(e.kind!=="step")throw TypeError("invalid trace event");let{scope:r,step:o}=e;jt(o,n,t);let i=Me(o,t,n);if(r==="global")return{kind:"step",scope:"global",step:i};if(r!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:e.segmentIndex,step:i}}function Qc(e,t,n){let r=e.result;if(r==="allowed")return Object.freeze({result:"allowed"});if(r!=="blocked")throw TypeError("invalid trace terminal");let o=e.ruleId;return Object.freeze({result:"blocked",reason:Me(e.reason,t,n),segment:Me(e.segment,t,n),...o?{ruleId:Me(o,t,n)}:{}})}function jt(e,t,n,r=0,o=new WeakSet){if(typeof e==="string"){let a=e.slice(0,n.maxTextLength);if(!Bn(a))return;for(let l of Oo(a))for(let c of l.match(/[^\s"'()$]+/g)??[])t.add(Fo(c));return}if(!e||typeof e!=="object"||r>=n.maxDepth||o.has(e))return;if(o.add(e),Array.isArray(e)){let a=Math.min(e.length,n.maxListLength);for(let l=0;l<a;l++)jt(e[l],t,n,r+1,o);return}let i=0,s=new Set;for(let a in e){if(!Object.hasOwn(e,a))continue;if(i>=n.maxObjectProperties)break;i++,jt(a,t,n);let l=Un(a,n,t);if(s.has(l))continue;s.add(l),jt(e[a],t,n,r+1,o)}}function Me(e,t,n,r=0,o=new WeakSet){if(typeof e==="string")return Un(e,t,n);if(!e||typeof e!=="object")return e;if(r>=t.maxDepth)return;if(o.has(e))return;if(o.add(e),Array.isArray(e)){let a=[],l=Math.min(e.length,t.maxListLength);for(let c=0;c<l;c++)a.push(Me(e[c],t,n,r+1,o));return a}let i={},s=0;for(let a in e){if(!Object.hasOwn(e,a))continue;if(s>=t.maxObjectProperties)break;s++;let l=Un(a,t,n);if(Object.hasOwn(i,l))continue;Object.defineProperty(i,l,{value:Me(e[a],t,n,r+1,o),enumerable:!0,configurable:!0,writable:!0})}return i}function Un(e,t,n){let r=e.slice(0,t.maxTextLength),o=Bn(r)?_o(r):r,i=n.size>0?td(o,n):o;return(ed(i)?Io(i):i).slice(0,t.maxTextLength)}function ed(e){return e.includes("PRIVATE KEY")||e.includes("://")||e.includes("eyJ")||e.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(e)||e.length>=14&&Zc.some((t)=>e.includes(t))||e.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(e)}function td(e,t){return e.replace(/[^\s"'()$]+/g,(n)=>t.has(Fo(n))?"<redacted>":n)}function Fo(e){let t=2166136261,n=2166136261;for(let r=0;r<e.length;r++)t=Math.imul(t^e.charCodeAt(r),16777619),n=Math.imul(n^e.charCodeAt(e.length-r-1),16777619);return`${t>>>0}:${n>>>0}:${e.length}`}function Gn(e){if(e&&typeof e==="object"&&!Object.isFrozen(e)){for(let t of Object.values(e))Gn(t);Object.freeze(e)}return e}function Uo(e,t,n){let r=n??Ho(),o=r.getCommandProgram(e,t.shell??"auto"),i=No(),s=$o(i),a=o.dialect==="powershell"?r.getCommandProgram(e,"posix"):o,l=Mo(a);s.recordGlobal({type:"parse",input:e,segments:l.map((p)=>[...p])});let c=jo(e,{...t,analyzePartialProgram:!0,trace:s},o,r),d=s.getNextSegmentIndex();if(c&&d>0&&d<l.length)s.recordSegment({type:"segment-skipped",index:d,reason:"prior-segment-blocked"},d);return Object.freeze({decision:c,trace:i.finish(c?{result:"blocked",reason:c.reason,segment:c.evidence.find((p)=>p.kind==="command")?.segment??e,...c.ruleId?{ruleId:c.ruleId}:{}}:{result:"allowed"}),program:o})}import{resolve as nd}from"node:path";function qn(e){let t=Go().safeParse(e);return{errors:t.success?[]:qo(t.error.issues),ruleNames:new Set(Bo(e).map((n)=>n.toLowerCase()))}}function Vn(e){let t=zo(e);if(!t.ok)return t.result;return qn(t.parsed)}function zo(e){let t=[],n=new Set;try{let r=typeof e==="string"?pt(e):e,o=x(r);if(o===null)return t.push(`File not found: ${r.path}`),{ok:!1,result:{errors:t,ruleNames:n}};if(!o.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:n}};return{ok:!0,parsed:JSON.parse(o)}}catch(r){if(r instanceof N)return t.push(r.message),{ok:!1,result:{errors:t,ruleNames:n}};let o=r instanceof Error?r.message:String(r);return t.push(r instanceof SyntaxError?"Invalid JSON":o),{ok:!1,result:{errors:t,ruleNames:n}}}}function Ko(e){return nd(e??process.cwd(),".safety-net.json")}function le(e){let t=zo(e);if(!t.ok)return t.result;let n=Vo(t.parsed);return{errors:n.errors,ruleNames:n.sources}}import{isAbsolute as rd,join as Ut,relative as od,resolve as Wo,sep as id}from"node:path";async function qe(e={}){let t=er(e);return sd(t,await Gt(t,Ue()))}function sd(e,t){if(!t.ok)return t;let n=J(e),r=[...new Set(ce(n.configPath,n.lockPath,e,n.filesystemScope))];if(r.length===0)return t;return{ok:!1,errors:r,warnings:t.warnings,entries:t.entries}}async function Gt(e,t,n,r={}){let o=null,i=!1;try{let s=J(e),a=Zn(s.configTarget);if(!a.ok)return a.result;let l=a.config;if(e.check)return pd(l,s,e);o={target:s.lockTarget,content:x(s.lockTarget)};let c=Xn(s.lockTarget);if(c.errors.some((L)=>L.startsWith("Unable to access ")))return{ok:!1,errors:c.errors,warnings:[],entries:[]};if(e.only&&c.errors.length>0)return{ok:!1,errors:c.errors,warnings:[],entries:[]};let d=c.errors.length>0?null:c.lock,p=e.only?ti(l,d,e.only):{ok:!0,specs:l.rules};if(!p.ok)return p.result;if(e.only&&!d&&p.specs.length<l.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${Qo}`],warnings:[],entries:[]};let m=(await ld(p.specs,(L)=>ri(L,s.configDir,e,d,s.filesystemScope,t),t)).map((L)=>fd(L,d,n));for(let L of m)hd(L.content,L.entry,s.configDir,e,s.filesystemScope);let u=e.only?md(l,d,m):m.map((L)=>L.entry);i=!0,Z(s.lockTarget,{version:1,rulebooks:u},void 0,r._testAfterPolicyRename);let h=new Map(m.map((L)=>[L.entry.spec,L.rulebook.rules.length])),f=yd(u,s.configDir,e,s.filesystemScope,r);return{ok:!0,errors:[],warnings:f,entries:u.map((L)=>gd(L,h))}}catch(s){if(i&&o)try{je(o.target,o.content)}catch(a){return Ge(a)}return Ge(s)}}async function Qn(e,t={}){return ad(e,er(t),Ue())}async function ad(e,t,n,r={}){let o=null,i=!1;try{let s=J(t),a=x(s.configTarget);o={target:s.configTarget,content:a};let l=Zn(s.configTarget);if(!l.ok)return l.result;let c=l.config,d=Xo(e)?await oi(e,n):[{spec:e}],p=d.map((h)=>h.spec),m=[...new Set([...c.rules,...p])];if(m.length>Jn)return cd();if(m.length!==c.rules.length)i=!0,Z(s.configTarget,{version:1,rules:m,overrides:c.overrides??{},transparent_wrappers:c.transparent_wrappers??[]},void 0,r._testAfterPolicyRename);let u=await Gt(t,n,new Map(d.filter((h)=>!!h.display_ref).map((h)=>[h.spec,h.display_ref])),r);if(!u.ok)je(s.configTarget,a);return u}catch(s){if(i&&o)try{je(o.target,o.content)}catch(a){return Ge(a)}return Ge(s)}}async function ld(e,t,n=Ue()){if(e.length>Jn)throw Error(Yn);let r=Array(e.length),o=0,i,s=Array.from({length:Math.min(e.length,ei.concurrency)},async()=>{while(!i){let a=o;if(a>=e.length)return;o++;try{r[a]=await t(e[a],a,n.controller.signal)}catch(l){if(!i)i={value:l},o=e.length,n.controller.abort(l);return}}});if(await Promise.all(s),i)throw i.value;return r}function cd(){return{ok:!1,errors:[Yn],warnings:[],entries:[]}}function er(e){return{cwd:e.cwd,cacheConfigDir:e.cacheConfigDir,userConfigDir:e.userConfigDir,userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,global:e.global,check:e.check,only:e.only,refresh:e.refresh}}function dd(e){return{...er(e),deleteSource:e.deleteSource}}async function tr(e,t={}){try{return await ud(e,dd(t),{})}catch(n){return Ge(n)}}async function ud(e,t,n){let r=J(t),o=Y(r.configTarget);if(o.errors.length>0)return{ok:!1,errors:o.errors,warnings:[],entries:[]};if(!o.config)return{ok:!1,errors:[`No config found at ${r.configPath}`],warnings:[],entries:[]};let i=Xn(r.lockTarget);if(i.errors.length>0)return{ok:!1,errors:i.errors,warnings:[],entries:[]};let s=ni(o.config.rules,i.lock,e);if(!s.ok)return s.result;let a=t.deleteSource?Ld(r.configDir,s.specs,i.lock,r.filesystemScope):{ok:!0,dirs:[]};if(!a.ok)return a.result;let l=x(r.configTarget);if(l===null)return Ge(Error("Rules config is unavailable."));try{Z(r.configTarget,{version:1,rules:o.config.rules.filter((p)=>!s.specs.includes(p)),overrides:o.config.overrides??{},transparent_wrappers:o.config.transparent_wrappers??[]},void 0,n._testAfterPolicyRename)}catch(p){throw je(r.configTarget,l),p}let c=await Gt(t,Ue(),void 0,n);if(!c.ok)return je(r.configTarget,l),c;let d=bd(a.dirs,n,r.filesystemScope);if(!d.ok){je(r.configTarget,l);let p=await Gt(t,Ue(),void 0,n);if(!p.ok)return{ok:!1,errors:[...d.result.errors,...p.errors],warnings:p.warnings,entries:p.entries};return d.result}return c}async function pd(e,t,n){let r=ii(e,t.lockPath,t.configDir,n,n.global?"user":"project",t.filesystemScope);return{ok:r.errors.length===0&&r.warnings.length===0,errors:[...r.errors,...r.warnings],warnings:[],entries:r.entries}}function fd(e,t,n){let r=t?.rulebooks.find((i)=>i.spec===e.entry.spec&&i.kind==="github"),o=n?.get(e.entry.spec)??(r?.kind==="github"?r.display_ref:void 0);if(!o||e.entry.kind!=="github")return e;return{...e,entry:{...e.entry,display_ref:o}}}function md(e,t,n){let r=new Set(e.rules),o=new Set(t?.rulebooks.map((s)=>s.spec)??[]),i=new Map(n.map((s)=>[s.entry.spec,s.entry]));return[...(t?.rulebooks.filter((s)=>r.has(s.spec))??[]).map((s)=>i.get(s.spec)??s),...n.filter((s)=>!o.has(s.entry.spec)).map((s)=>s.entry)]}function gd(e,t){return{...e,ruleCount:t.get(e.spec)}}function hd(e,t,n,r,o){let i=Kn(t,Wn(n,r));xe(k(o,i),e)}function yd(e,t,n,r,o){let i=Wn(t,n),s=Bt(i),a=k(r,s),l=Be(a);if(!l)return[];let c=e.map((p)=>k(r,Kn(p,i))),d=l.filter((p)=>p.kind==="directory").map((p)=>({directory:k(r,Ut(s,p.name)),identity:k(r,Ut(s,p.name,Zo))})).filter((p)=>!c.some((m)=>Jo(p.identity,m))).map((p)=>p.directory);for(let p of d)Yo(p);return d.flatMap((p)=>{try{return wd(p,o),[]}catch{return["Unable to prune rules policy cache safely."]}})}function Ld(e,t,n,r){let o=new Map(n?.rulebooks.map((c)=>[c.spec,c])??[]),i=t.flatMap((c)=>{let d=o.get(c);if(!d)return mt.test(c)?[]:["--delete-source can only delete local rulebook sources"];return d.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),s=t.map((c)=>{let d=o.get(c);return Ut(e,d?.kind==="local-directory"?d.path:c)}),a=i.length>0?[]:s.flatMap((c)=>vd(e,c,r)),l=[...i,...a];return l.length>0?{ok:!1,result:{ok:!1,errors:l,warnings:[],entries:[]}}:{ok:!0,dirs:s}}function vd(e,t,n){let r=Wo(e),o=Wo(t),i=od(r,o);if(i===""||i===".."||i.startsWith(`..${id}`)||rd(i))return[`Refusing to delete local rulebook source outside ${e}: ${t}`];let s=k(n,o),a=Be(s);if(!a)return[`Local rulebook source directory not found: ${t}`];let l=a.find((c)=>c.name==="rulebook.json");if(!l)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(l.kind!=="file")throw new N(n.label);if(x(k(n,Ut(o,"rulebook.json"))),a.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function bd(e,t,n){let r=e.flatMap((o)=>{try{return xd(k(n,o),t),[]}catch(i){return[`Failed to delete local rulebook source ${o}: ${i instanceof Error?i.message:String(i)}`]}});return r.length>0?{ok:!1,result:{ok:!1,errors:r,warnings:[],entries:[]}}:{ok:!0}}function wd(e,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(e.path);return}zn(e)}function xd(e,t){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(e.path);return}zn(e)}function je(e,t){if(t===null){ft(e);return}xe(e,t)}function Ge(e){return{ok:!1,errors:[e instanceof Error?e.message:String(e)],warnings:[],entries:[]}}function We(e,t){let n=Sd(t),r=ui(n),o={effectiveLevel:r.effectiveLevel,selectedPreset:n.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:r.effectiveCapabilities,destructiveCommandRuleOverrides:n.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:i,configValid:s}=kd({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!e||!e.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:i,configValid:s,...o};let a=Dd(e,n);if(a)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:a.rule,matched:!0,reason:a.reason}]}]},result:"blocked",reason:G(a.reason),segment:G(a.target),...a.ruleId?{ruleId:G(a.ruleId)}:{},configSource:i,configValid:s,...o};let l=Uo(e,n),c=l.decision,d=c?.ruleId??Rd(e,n),p=ht.find((u)=>u.id===d&&u.activationCapability),m=p?r.policy.effectiveDestructiveCommandRules[p.id]:void 0;return{trace:Ed(l.trace),result:c?"blocked":"allowed",reason:c?G(c.reason):void 0,segment:c?G(c.evidence.find((u)=>u.kind==="command")?.segment??e):void 0,ruleId:c?.ruleId?G(c.ruleId):void 0,customRule:Ad(Pd(c?.ruleId,n.policySnapshot)),configSource:i,configValid:s,...o,...p&&m?{ruleActivation:{id:p.id,...m}}:{}}}function kd(e){let t=X(e?.cwd),n=e?.userConfigPath??Q(e),r=ee({cwd:e?.cwd,userConfigDir:e?.userConfigDir,userConfigPath:e?.userConfigPath});try{if(x(r.projectConfigTarget)!==null){if(le(r.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(o){if(o instanceof N)return{configSource:t,configValid:!1};throw o}try{if(x(r.userConfigTarget)!==null){let o=le(r.userConfigTarget);return{configSource:n,configValid:o.errors.length===0}}return{configSource:null,configValid:!0}}catch(o){if(o instanceof N)return{configSource:n,configValid:!1};throw o}}function Sd(e){let t=Cd(e?.cwd??process.cwd()),n=e?.policySnapshot??B({cwd:t,userConfigDir:e?.userConfigDir}),r=de(n.policy);return{cwd:t,effectiveCwd:t,policySnapshot:n,environment:si(),protectedGitMetadata:di(t),effectiveCapabilities:r.capabilities,strict:e?.strict??r.strict,paranoidRm:r.paranoidRm,paranoidInterpreters:r.paranoidInterpreters,worktreeMode:r.worktreeMode}}function Dd(e,t){let n=t.cwd??process.cwd(),r=ai(Ke("",{command:e},{kind:"command",shell:"posix"},{executionCwd:n,configCwd:n},e)),o=mi(r);if(o)return{reason:fi,target:o.target,ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};let i=ci(r,t.protectedGitMetadata);if(i)return{reason:li,target:i.target,ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};let s=t.policySnapshot.policy,a=s.secretProtection.enabled===!1?null:hi(r,s.secretProtection,{strict:t.strict});if(a)return{reason:gi,target:a.target,ruleId:a.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"};return null}function Rd(e,t){let n=t.policySnapshot.policy,r=yt({...n,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...n.destructiveCommandRuleOverrides,...Object.fromEntries(ht.flatMap((o)=>o.activationCapability?[[o.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return pi(e,{...t,policySnapshot:r,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function Ad(e){if(!e)return;return{id:G(e.id),...e.rulebook?{rulebook:{name:G(e.rulebook.name),version:G(e.rulebook.version)}}:{},...e.source?{source:G(e.source)}:{},...e.override?{override:{type:"reason",reason:G(e.override.reason)}}:{}}}function Ed(e){let t=e.events.flatMap((r)=>r.kind==="step"&&r.scope==="global"?[r.step]:[]),n=new Map;for(let r of e.events){if(r.kind!=="step"||r.scope!=="segment")continue;let o=n.get(r.segmentIndex)??{index:r.segmentIndex,steps:[]};o.steps.push(r.step),n.set(r.segmentIndex,o)}return{steps:t,segments:[...n.values()]}}function Pd(e,t){let n=e?.replace(/^custom\./,"");if(!n||!t.policy.rules.some((r)=>r.name===n))return;return t.ruleMetadata[n]??Object.freeze({id:n})}function Nd(e){let t=Je(),n=T({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},e);if(ae(n.errors))return null;if(n.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(n.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let r=n.values.limit===void 0?20:yi(n.values.limit);if(r===null)return console.error("--limit must be a positive number"),null;let o=n.values.since===void 0?Math.min(30,t):yi(n.values.since);if(o===null||o>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let i={limit:r,limitExplicit:n.values.limit!==void 0,since:o,sinceExplicit:n.values.since!==void 0,all:n.flags.all,json:n.flags.json,suspect:n.flags.suspect,pruneLegacy:n.flags.pruneLegacy,dryRun:n.flags.dryRun,id:n.values.id,agent:n.values.agent,rule:n.values.rule,session:n.values.session,project:n.values.project===void 0?void 0:$d(n.values.project)};if(i.id&&(i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.sinceExplicit||i.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(i.pruneLegacy&&(i.id!==void 0||i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.all||i.sinceExplicit||i.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(i.dryRun&&!i.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return i}async function bi(e,t={}){let n=Nd(e);if(!n)return 1;let r=t.logsDir??ue();if(n.pruneLegacy)return Fd(r,n.json,n.dryRun);if(!r)return console.log(n.json?"[]":n.id?`No retained audit log entry found for id ${I(n.id)}.`:"No audit log entries found."),0;ke(r);let o={count:0},i=ye(r,o).flatMap((d)=>ut(d,o).map((p)=>({entry:p,file:d})));if(o.count>0)console.error(`warning: ${o.count} audit log ${o.count===1?"source":"sources"} could not be read; these results are incomplete`);if(n.id)return Ud(i,n,t.timeZone);let s=Date.now()-n.since*24*60*60*1000,a=i.filter((d)=>Gd(d,n,r,s)),l=n.suspect?jn(a.map((d)=>d.entry)):null,c=(l?a.filter((d)=>l.has(d.entry)):a).sort((d,p)=>Date.parse(p.entry.ts)-Date.parse(d.entry.ts)).slice(0,n.limit);if(n.json)return console.log(JSON.stringify(c.map((d)=>d.entry),null,2)),0;if(c.length===0)return console.log("No audit log entries found."),0;for(let d of c)console.log(Vd(d.entry,t.timeZone));return 0}function Fd(e,t,n){let r=e?Md(e).map((a)=>Od(e,a)):[];if(n)return Hd(r,t);let o=[],i=0,s=0;for(let a of r){let l=Li(a,{throwIfNoEntry:!1})?.size??0,c=jd(a);if(c){o.push(`${vi(a)}: ${c}`);continue}i++,s+=l}if(t)return console.log(JSON.stringify({removedFiles:i,removedBytes:s,failedFiles:o.length})),o.length===0?0:1;console.log(i===0&&o.length===0?"No legacy audit log files found.":`Removed ${i} legacy audit log ${i===1?"file":"files"} (${wi(s)}).`);for(let a of o)console.error(`Could not remove ${I(a)}`);if(console.log("Nested v2 audit logs were not changed."),i>0)console.log("This deletion cannot be undone.");return o.length===0?0:1}function Hd(e,t){let n=e.reduce((r,o)=>r+(Li(o,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:e.length,bytes:n})),0;if(console.log(e.length===0?"No legacy audit log files found.":`Would remove ${e.length} legacy audit log ${e.length===1?"file":"files"} (${wi(n)}).`),console.log("Nested v2 audit logs are not included."),e.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Md(e){try{return Td(e,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function jd(e){try{return Id(e),null}catch(t){return t instanceof Error?t.message:String(t)}}function wi(e){let t=["B","KiB","MiB","GiB"],n=Math.min(Math.floor(Math.log2(Math.max(e,1))/10),t.length-1);return`${Math.round(e/1024**n*10)/10} ${t[n]}`}function Ud(e,t,n){let r=e.filter((i)=>i.entry.id===t.id);if(r.length>1)return console.error(`Multiple audit log entries found for id ${I(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(r.map((i)=>i.entry),null,2)),0;let o=r[0];if(!o)return console.log(`No retained audit log entry found for id ${I(t.id??"")}.`),0;return console.log(zd(o.entry,n)),0}function Gd(e,t,n,r){if(!t.all&&e.entry.decision==="allow")return!1;if(Date.parse(e.entry.ts)<r)return!1;if(t.agent!==void 0&&e.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&e.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!Bd(e,n,t.session))return!1;if(t.project!==void 0&&!qd(e.entry.cwd,t.project))return!1;return!0}function Bd(e,t,n){if(e.entry.sessionId===n)return!0;return _d(e.file)===t&&vi(e.file,".jsonl")===n}function qd(e,t){if(!e)return!1;return e===t||e.startsWith(`${t}/`)}function Vd(e,t){let n=I(e.id??"-"),r=I(e.decision??"deny"),o=e.cwd?`  [${I(e.cwd)}]`:"",i=e.segment||e.command,s=i===e.command?"":"↳ ",a=i.length>50?`${i.slice(0,50)}…`:i;return`${n.padEnd(16)}  ${I(xi(e.ts,t))}  ${r.padEnd(5)}  ${I(e.agent??"-").padEnd(15)}  ${I(e.ruleId??"-").padEnd(20)}  ${s}${I(a)}${o}`}function zd(e,t){let n=(o)=>I(o===void 0||o===null||o===""?"-":o),r=e.shape?`${e.agent??"-"} (shape: ${e.shape})`:e.agent??"-";return[`id:        ${n(e.id)}`,`ts:        ${n(xi(e.ts,t))}`,`decision:  ${n(e.decision)}`,`agent:     ${n(r)}`,`level:     ${n(e.level)}`,`tool:      ${n(e.toolName)}`,`rule:      ${n(e.ruleId)}`,`intent:    ${n(e.intent)}`,`stage:     ${n(e.failureStage)}`,`error:     ${n(e.errorCode)}`,`session:   ${n(e.sessionId)}`,`cwd:       ${n(e.cwd)}`,`version:   ${n(e.v)}`,`truncated: ${n(e.truncated===!0?"yes":void 0)}`,`reason:    ${n(e.reason)}`,`command:   ${n(e.command)}`,`segment:   ${n(e.segment)}`].join(`
 `)}function xi(e,t){let n=new Date(e);if(Number.isNaN(n.getTime()))return e;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(n)}function yi(e){let t=Number(e);return Number.isFinite(t)&&t>0?t:null}var Ci={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var ki={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var Si={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as Oi,join as ru,relative as ou}from"node:path";var Kd=8388608;function Wd(e,t){console.log(JSON.stringify(e(Ri(t))))}async function Jd(e){let t;try{t=(await hr(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return yr(t,e,"Failed to parse hook input JSON.")}async function hr(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>Kd)throw Yd(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function Yd(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function yr(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function M(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:Ei(e)}}function te(e,t,n,r){let o=e===void 0?process.cwd():e,i=typeof o==="string"&&o.trim()!==""?fe([o]):void 0;if(i)return{configCwd:i,executionCwd:i};return O(r,t,n,eu(o)),null}function O(e,t,n,r){let o;try{o=gr(t)}catch(i){if(!(i instanceof pe))throw i}e(qt({command:o,segment:r,toolName:n}))}async function Zd(e){let t=await Jd(e.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){O(e.outputDeny);return}if(!e.isSupported(t))return;let n=e.getAgent?.(t)??e.agent,r=e.agent===n?void 0:e.agent,o=nu(t),i=(u,h)=>{Di(u,()=>e.getSessionId(t),{agent:n,shape:r,toolName:h,cwd:o}),e.outputDeny(u)},s=e.getToolName(t);if(typeof s!=="string"||s.trim()===""){O((u)=>i(u),tu(t));return}let a=s,l=(u)=>i(u,a),c;try{c=e.getToolInput(t,a,l)}catch(u){if(!(u instanceof pe))throw u;O(l,void 0,a);return}if(!c.ok)return;let d=e.getContext(t,c.input,a,l);if(!d)return;let p;try{p=gr(c.input)}catch(u){if(!(u instanceof pe))throw u;O(l,void 0,a);return}let m=Ke(a,c.input,c.route,d,p??null);try{let u=Vt(m,{guard:{auditAllowed:Pi(),dependencies:e.guardDependencies},audit:{agent:n,shape:r,getSessionId:()=>e.getSessionId(t)}}),h=mr(u,{includeEvidence:!0,toolName:u.stage==="command-analysis"?void 0:a});if(h){e.outputDeny(h);return}e.outputAllow?.()}catch(u){if(!(u instanceof Ti))throw u;Xd(u);let h=mr(u.evaluation,{includeEvidence:!0,toolName:u.evaluation.stage==="command-analysis"?void 0:a});if(h)e.outputDeny(h);return}}function Xd(e){if(!Lt(S.debug))return;console.error(`CC Safety Net debug: ${Qd(e.stage)}: ${Ai(e.cause)}`)}function Qd(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function eu(e){return typeof e==="string"?e:void 0}function tu(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function nu(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function j(e){let t=(o)=>Wd(e.createDenyOutput,o),n=e.createAllowOutput;await Zd({...e,outputDeny:t,outputAllow:n?()=>console.log(JSON.stringify(n())):void 0})}function Ct(e){return ru(e,".gemini","config","hooks.json")}var iu=new Map([["run_command","auto"]]),su=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function $i(e){return M(e,iu)}async function Ni(){await j({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:uu(e.toolCall?.args,t),route:$i(t)}),getContext:au,getSessionId:(e)=>e.conversationId})}function au(e,t,n,r){let i=du(e).flatMap((c)=>{let d=fe([c]);return d?[d]:[]});if(!i[0])return Re(r,t,n),null;if(n!=="run_command"){let c;try{c=lu(t,n,i)}catch(d){if(d instanceof pe)return Re(r,void 0,n),null;if(!(d instanceof Se))throw d;return Re(r,t,n),null}if(!c)return Re(r,t,n),null;return{configCwd:c,executionCwd:c}}let s=e.toolCall?.args;if(!s||!Object.hasOwn(s,"Cwd"))return{configCwd:i[0],executionCwd:i[0]};let a=s.Cwd;if(typeof a!=="string"||a.trim()==="")return Re(r,t,n),null;let l=Ae(a,i);if(l){let c=Fi(l,i);if(!c)return Re(r,t,n,a),null;return{configCwd:c,executionCwd:l}}return Re(r,t,n,a),null}function lu(e,t,n){let r=$i(t),o=[...Ii(e,su),...r.kind==="patch"?_i(e):[]].filter(Oi),i=zt(),s=new Set(o.flatMap((a)=>{let l=Fi(wt(a,xt,i),n);return l?[l]:[]}));if(s.size>1)return null;return[...s][0]??n[0]??null}function Fi(e,t){return t.filter((n)=>cu(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function cu(e,t){let n=ou(t,e);return n===""||!n.startsWith("..")&&!Oi(n)}function Re(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(qt({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function du(e){if(e.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((n)=>typeof n==="string"&&n.trim()!==""):[];return fe(t)?t:[]}function uu(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var kt=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:8,runtime:{order:6,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:9,runtime:{order:7,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:10,install:{order:10,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:11,install:{order:11,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:12,install:{order:12,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],Kt=kt.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Hi=kt.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),V=kt.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),K0=Object.fromEntries(kt.map((e)=>[e.id,e.displayName]));function R(e){return kt.find((t)=>t.id===e)?.displayName??e}import{homedir as pu}from"node:os";import{isAbsolute as Mi,join as Lr}from"node:path";function Ui(e){if(e!==void 0&&e!==null&&!Mi(e))return"unknown";try{let t=zt(),n=e?wt(e,xt,t):void 0,r=process.env.HOME||pu(),o=[["codex",process.env.CODEX_HOME||Lr(r,".codex")],["copilot-cli",process.env.COPILOT_HOME||Lr(r,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||Lr(r,".claude")]],i=n?o.flatMap(([s,a])=>{if(!Mi(a))return[];return ji(n,wt(a,xt,t))?[s]:[]}):[];if(i.length===1)return i[0]??"unknown";if(i.length>1)return"unknown"}catch(t){if(t instanceof Se)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var vr="PreToolUse",Gi="BeforeTool",Bi="pre_tool_call",br="PreToolUse";var fu=new Map([["Bash","posix"],["PowerShell","powershell"]]);function mu(e){return M(e,fu)}async function qi(){await j({agent:"claude-code",getAgent:(e)=>Ui(e.transcript_path),createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:vr,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===vr,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:mu(t)}),getContext:(e,t,n,r)=>te(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}var gu=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function hu(e){return M(e,gu)}async function Vi(){await j({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=yr(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:hu(t)}},getContext:(e,t,n,r)=>te(e.cwd,t,n,r),getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var yu=new Map([["Shell","auto"]]);function Lu(e){return M(e,yu)}async function zi(){await j({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Lu(t)}),getContext:vu,getSessionId:(e)=>e.conversation_id})}function vu(e,t,n,r){let o=bu(e);if(!o[0])return O(r,t,n),null;let i=Ae(xu(e.cwd),o);if(!i)return O(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:i,executionCwd:i};if(!Object.hasOwn(t,"working_directory"))return{configCwd:i,executionCwd:i};let s=t.working_directory;if(typeof s!=="string"||s.trim()==="")return O(r,t,n),null;let a=Ae(s,o);if(!a)return O(r,t,n,s),null;return{configCwd:i,executionCwd:a}}function bu(e){return wu(e).flatMap((t)=>{let n=fe([t]);return n?[n]:[]})}function wu(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function xu(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Cu=new Map([["run_shell_command","auto"]]);function ku(e){return M(e,Cu)}async function Ki(){await j({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===Gi,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:ku(t)}),getContext:(e,t,n,r)=>te(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}import{resolve as Su}from"node:path";var Du=new Map([["terminal","posix"]]);async function Wi(){await j({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===Bi,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:M(t,Du)}),getContext:Ru,getSessionId:(e)=>e.session_id})}function Ru(e,t,n,r){let o=te(e.cwd,t,n,r);if(!o)return null;if(!t||typeof t!=="object"||Array.isArray(t))return o;if(!Object.hasOwn(t,"workdir"))return o;let i=t.workdir;if(typeof i!=="string"||i.trim()==="")return O(r,t,n),null;let s=fe([Su(o.configCwd,i)]);if(!s)return O(r,t,n,i),null;return{...o,executionCwd:s}}var Ji=new Map([["Bash","posix"]]);function Au(e){return M(e,Ji)}async function Yi(){await j({agent:"kimi-code",createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:br,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===br,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Au(t)}),getContext:(e,t,n,r)=>{let o=te(e.cwd,t,n,r);if(!o)return null;let i=e.tool_input;if(!Ji.has(n)||!i||!Object.hasOwn(i,"cwd"))return o;let s=i.cwd;if(typeof s!=="string"||s.trim()==="")return O(r,t,n),null;let a=Ae(s,[o.configCwd]);if(!a)return O(r,t,n,s),null;return{configCwd:o.configCwd,executionCwd:a}},getSessionId:(e)=>e.session_id})}var Eu={"antigravity-cli":Ni,"claude-code":qi,"copilot-cli":Vi,cursor:zi,"gemini-cli":Ki,"hermes-agent":Wi,"kimi-code":Yi},Ye=Hi.map((e)=>({...e,run:Eu[e.id]}));function Zi(e){let t=T({label:"hook",booleans:Object.fromEntries(Ye.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=Ye.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Xi(e){return Ye.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}var Pu=Ye.map((e)=>({flags:e.flags.join(", "),description:e.description})),Tu=Ye.flatMap((e)=>e.flags.map((t)=>`cc-safety-net hook ${t}`)),Qi={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Pu,{flags:"-h, --help",description:"Show this help"}],examples:Tu};var es={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...V.map((e)=>({flags:e.flag,description:`Install ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...V.map((e)=>`cc-safety-net install ${e.flag}`)]},ts={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...V.map((e)=>({flags:e.flag,description:`Uninstall ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...V.map((e)=>`cc-safety-net uninstall ${e.flag}`)]},ns={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var rs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var Ze={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var os={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var is={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var Wt=[os,Ci,rs,ki,Ze,es,ns,ts,Qi,Si,is];function Iu(e){return e.aliases??[]}function Jt(e){let t=e.toLowerCase();return Wt.find((n)=>n.name.toLowerCase()===t||Iu(n).some((r)=>r.toLowerCase()===t))}import{readFileSync as _u}from"node:fs";import{basename as Ou}from"node:path";function Yt(e=7,t=ue()){let n=Date.now()-e*24*60*60*1000,r=[],o=new Set,i=0,s,a,l,c;if(t)ke(t);let d={count:0},p=t?ye(t,d):[];for(let u of p)try{let f=_u(u,"utf-8").trim().split(`
@@ -19,7 +19,7 @@ ${He(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o
 `)}function Zt(e){return Ee({rows:e})}function bs(e){let t=[];return t.push("System Info"),t.push(ap(e)),t.join(`
 `)}function ap(e){let t=["Component","Version"],n=(i)=>{if(i===null)return g.dim("not found");return i},o=[{label:"cc-safety-net",value:e.version},...Kt.map((i)=>({label:R(i),value:e.versions[i]??null})),{label:"Node.js",value:e.nodeVersion},{label:"npm",value:e.npmVersion},{label:"Bun",value:e.bunVersion},{label:"Platform",value:e.platform}].map((i)=>[i.label,n(i.value)]);return Ee({headers:t,rows:o})}function ws(e){if(e.findings.length===0)return g.green(`
 No findings from inspected doctor facts.`);let t={error:e.findings.filter((i)=>i.severity==="error").length,warning:e.findings.filter((i)=>i.severity==="warning").length,info:e.findings.filter((i)=>i.severity==="info").length},n=["error","warning","info"].filter((i)=>t[i]>0).map((i)=>`${t[i]} ${i}`),r=e.findings.length===1?"finding":"findings",o=`
-${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return g.red(o);if(t.warning>0)return g.yellow(o);return g.blue(o)}import{lstatSync as lp}from"node:fs";import{dirname as xr}from"node:path";function Cr(e,t){try{let n=lp(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function xs(e){let t=ue();return{directories:[Cr("policy",xr(xr(e))),Cr("config",xr(e)),...t?[Cr("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as cp}from"node:child_process";import{existsSync as Cs}from"node:fs";import{delimiter as dp,extname as up,join as pp}from"node:path";import{stripVTControlCharacters as ks}from"node:util";var Ds="2.0.9",fp=5000,mp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function P(){return Ds}function kr(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function gp(e){return(kr(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function hp(e,t){let n=up(e)?[e]:[...gp(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>Cs(r))??e;return(kr(t,"PATH")??"").split(dp).flatMap((r)=>n.map((o)=>pp(r,o))).find((r)=>Cs(r))??e}function Ss(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function Pe(e,t){let[n,...r]=e,o=t[mp]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=hp(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:kr(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Ss(i),...r.map(Ss)].join(" ")]}}var Xe=async(e,t=fp)=>{let n=await yp(e,{timeoutMs:t});if(n.code!==0)return null;return ks(n.stdout).trim()||ks(n.stderr).trim()||null};function yp(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=Pe([n,...r],process.env),s=cp(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(m)=>{l+=m.toString()}),s.stderr.on("data",(m)=>{c+=m.toString()});let d=(m)=>{if(a)return;a=!0,clearTimeout(p),o(m)},p=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(m)=>{d({code:m,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function Xt(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
+${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return g.red(o);if(t.warning>0)return g.yellow(o);return g.blue(o)}import{lstatSync as lp}from"node:fs";import{dirname as xr}from"node:path";function Cr(e,t){try{let n=lp(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function xs(e){let t=ue();return{directories:[Cr("policy",xr(xr(e))),Cr("config",xr(e)),...t?[Cr("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as cp}from"node:child_process";import{existsSync as Cs}from"node:fs";import{delimiter as dp,extname as up,join as pp}from"node:path";import{stripVTControlCharacters as ks}from"node:util";var Ds="2.0.10",fp=5000,mp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function P(){return Ds}function kr(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function gp(e){return(kr(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function hp(e,t){let n=up(e)?[e]:[...gp(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>Cs(r))??e;return(kr(t,"PATH")??"").split(dp).flatMap((r)=>n.map((o)=>pp(r,o))).find((r)=>Cs(r))??e}function Ss(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function Pe(e,t){let[n,...r]=e,o=t[mp]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=hp(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:kr(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Ss(i),...r.map(Ss)].join(" ")]}}var Xe=async(e,t=fp)=>{let n=await yp(e,{timeoutMs:t});if(n.code!==0)return null;return ks(n.stdout).trim()||ks(n.stderr).trim()||null};function yp(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=Pe([n,...r],process.env),s=cp(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(m)=>{l+=m.toString()}),s.stderr.on("data",(m)=>{c+=m.toString()});let d=(m)=>{if(a)return;a=!0,clearTimeout(p),o(m)},p=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(m)=>{d({code:m,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function Xt(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
 `)[0]?.trim()||null}async function St(e=Xe){let[t,n,r,o,i,s]=await Promise.all([Promise.all(V.map(async(a)=>[a.id,Xt(await e([...a.probeCommand]))])),e(["codex","plugin","list"],30000),e(["amp","plugins","list"],30000),e(["node","--version"]),e(["npm","--version"]),e(["bun","--version"])]);return{version:Ds,versions:Object.fromEntries(t),codexPluginListOutput:n,ampPluginListOutput:r,nodeVersion:Xt(o),npmVersion:Xt(i),bunVersion:Xt(s),platform:`${process.platform} ${process.arch}`}}function Sr(e,t){if(t==="dev")return!1;let n=e.split(".").map(Number),r=t.split(".").map(Number),[o=0,i=0,s=0]=n,[a=0,l=0,c=0]=r;if(o!==a)return o>a;if(i!==l)return i>l;return s>c}async function Qe(){let e=P(),t=new AbortController,n=setTimeout(()=>t.abort(),3000);try{let r=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!r.ok)return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${r.status}`};let o=await r.json(),i=Sr(o.version,e);return{currentVersion:e,latestVersion:o.version,updateAvailable:i}}catch(r){return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:r instanceof Error?r.message:"Network error"}}finally{clearTimeout(n)}}import*as Os from"node:readline";var Ps=(e)=>`\x1B[${e}B`,Lp=(e)=>`\x1B[${e}A`;var Rs=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function vp(e){return new Promise((t)=>setTimeout(t,e))}function bp(e,t,n){if(!n)return t(e);if(n.aborted)return Promise.resolve();return new Promise((r,o)=>{let i=()=>n.removeEventListener("abort",s),s=()=>{i(),r()};n.addEventListener("abort",s,{once:!0}),t(e).then(()=>{i(),r()},(a)=>{i(),o(a)})})}function Dt(e,t){return e&&e>0?e:t}function Qt(e){return Math.max(0,Math.min(1,e))}function et(e){return Math.max(0,Math.min(255,Math.round(e)))}function Dr(e){return e<=0.0031308?12.92*e:1.055*e**0.4166666666666667-0.055}function wp(e,t,n){let r=n*Math.PI/180,o=t*Math.cos(r),i=t*Math.sin(r),s=(e+0.3963377774*o+0.2158037573*i)**3,a=(e-0.1055613458*o-0.0638541728*i)**3,l=(e-0.0894841775*o-1.291485548*i)**3;return{blue:et(Dr(Qt(-0.0041960863*s-0.7034186147*a+1.707614701*l))*255),green:et(Dr(Qt(-1.2684380046*s+2.6097574011*a-0.3413193965*l))*255),red:et(Dr(Qt(4.0767416621*s-3.3077115913*a+0.2309699292*l))*255)}}function Rr(e,t){let n=(t*e*180/Math.PI%360+360)%360;return wp(0.72,0.15,n)}function Ts(e,t=0.1){let n=Rr(t,e);return`\x1B[38;2;${n.red};${n.green};${n.blue}m`}function xp(e,t){return{blue:et(e.blue+(255-e.blue)*t),green:et(e.green+(255-e.green)*t),red:et(e.red+(255-e.red)*t)}}function Is(e,t,n){let r=Math.imul(e+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(n+374761393,2654435761),o=r^r>>>15,i=Math.imul(o,739982445),s=i^i>>>12,a=Math.imul(s,695872825);return((a^a>>>15)>>>0)/4294967296}function Cp(e,t,n){let r=Math.floor(Is(e,t,n)*Rs.length);return Rs[r]??"░"}function As(e){let t=Qt(e);return t*t*t*(t*(t*6-15)+10)}function kp(e){if(e.length===0)return"";let t=[],n=!1,r="";for(let o of e){let i=`${o.red};${o.green};${o.blue}`;if(o.bold!==n)t.push(o.bold?"\x1B[1m":"\x1B[22m"),n=o.bold;if(i!==r)t.push(`\x1B[38;2;${i}m`),r=i;t.push(o.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function Sp(e,t,n,r,o){return e.map((i,s)=>({...Rr(n,r+t+s/o),bold:!1,character:i}))}function Dp(e,t,n,r,o,i,s,a){let l=Math.max(1,r*0.75),c=Math.min(1,n/l),d=o*As(c),p=Math.max(0,(n-l)/Math.max(1,r-l)),m=(1-As(n/r))*a*2,u=0.35*Math.max(0,1-p*2),h=c>=1,f=Math.min(e.length,Math.ceil(d+2+1));return e.slice(0,f).map((L,v)=>{let w=Rr(i,s+t+v/a+m),y=v+Is(t,v,7919)*2-1;if(y>d+2)return{...w,bold:!1,character:" "};let C=d-y,H=0.8*Math.exp(-(C*C)/12.5),he=Math.min(0.9,H+u),Fn=!h&&y>d-4;return{...xp(w,he),bold:he>0.3,character:Fn?Cp(t,v,n):L}})}function Es(e){return`\x1B[?2026h${e.map((t,n)=>`\x1B8${n>0?Ps(n):""}${kp(t)}`).join("")}\x1B[?2026l`}async function Ar(e,t={}){if(!e)return;let n=t.output??process.stdout,r=t.sleep??vp,o=Dt(t.frequency,0.1),i=t.seed??0,s=Dt(t.speed,40),a=Dt(t.spread,3),l=Dt(t.frameRate,60),c=Math.max(1,Math.floor(Dt(t.duration,12))),d=e.split(`
 `).map((f)=>Array.from(f)),p=Math.max(...d.map((f)=>f.length)),m=1000*c*d.filter((f)=>f.length>0).length/s,u=p>0?Math.max(1,Math.ceil(m/(1000/l))):0,h=u>0?m/u:0;n.write(`\x1B[?25l${d.length>1?`${`
 `.repeat(d.length-1)}${Lp(d.length-1)}`:""}\x1B7`);try{for(let f=1;f<=u;f+=1){if(t.signal?.aborted)break;n.write(Es(d.map((L,v)=>Dp(L,v,f,u,p,o,i,a)))),await bp(h,r,t.signal)}}finally{if(n.write(Es(d.map((f,L)=>Sp(f,L,o,i,a)))),n.write("\x1B8"),d.length>1)n.write(Ps(d.length-1));n.write(`
@@ -187,7 +187,7 @@ ${a()}`.trim())))}),i.on("close",(d)=>{if(clearTimeout(c),d!==0){r(Error(Vr(e,d,
 `));return{path:n??q2(e),alreadyInstalled:!1}}function Ja(e){let t=[],n=hn(e.homeDir),r=["opencode.json","opencode.jsonc"];for(let o of r){let i=Q2(n,o);if(Z2(i))try{let s=X2(i,"utf-8"),a=q(s);if((JSON.parse(a).plugin??[]).some((p)=>p.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:i,errors:t.length>0?t:void 0}}catch(s){t.push(`Failed to parse ${o}: ${s instanceof Error?s.message:String(s)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as ef}from"node:path";function eo(e){return ef(e,".pi","agent","settings.json")}function to(e){if(typeof e!=="string")return!1;return e==="npm:cc-safety-net"||e.startsWith("npm:cc-safety-net@")}function Ya(e){let t=eo(e.homeDir),n=re(t);if(n.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(n.kind==="missing")return{platform:"pi",status:"n/a"};let r=b(n.value,"packages");if(!Array.isArray(r))return{platform:"pi",status:"n/a"};let o=r.find((a)=>to(typeof a==="string"?a:b(a,"source")));if(o===void 0)return{platform:"pi",status:"n/a"};let i=b(o,"extensions");if(Array.isArray(i)&&i.some((a)=>typeof a==="string"&&a.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var nf={amp:Fs,"antigravity-cli":Hs,"claude-code":Gs,codex:Bs,"copilot-cli":ea,cursor:la,"gemini-cli":ca,"hermes-agent":wa,"kimi-code":It,openclaw:$a,opencode:Ja,pi:Ya};function it(e,t){let n={...t,cwd:e,homeDir:t?.homeDir??tf()};return Kt.map((r)=>rf(nf[r](n)))}function rf(e){if(e.status==="not-inspected")return{platform:e.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:e.platform,detected:e.status!=="n/a",configured:e.status==="configured",inspectionStatus:e.status!=="n/a"?"verified":e.errors&&e.errors.length>0?"failed":"not-applicable",method:e.method,configPath:e.configPath,configPaths:e.configPaths,errors:e.errors}}import{tmpdir as of}from"node:os";import{join as sf}from"node:path";var af=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),lf=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),cf={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function Za(){let e=sf(of(),"cc-safety-net-self-test"),t=af.map((n)=>{let r=Vt(Ke("self-test",{command:n.command},{kind:"command",shell:"auto"},{configCwd:e,executionCwd:e},n.command),{guard:{dependencies:{loadPolicySnapshot:()=>lf,getModes:()=>cf,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),o=n.expectBlocked?"blocked":"allowed",i=r.decision.kind==="deny"?"blocked":"allowed";return{command:n.command,description:n.description,expected:o,actual:i,passed:o===i,reason:r.decision.kind==="deny"?r.decision.reason:void 0,ruleId:r.decision.kind==="deny"?r.decision.ruleId:void 0}});return{passed:t.filter((n)=>n.passed).length,failed:t.filter((n)=>!n.passed).length,total:t.length,results:t}}function no(e){let t=T({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},e);if(ae(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function Xa(e={}){let t=await At(!e.json,()=>{let n=df(e);return{ready:n,finish:()=>n}},()=>Rt(),{loadingMessage:"Checking system status…"});if(e.json)console.log(JSON.stringify(t,null,2));else pf(t);return uf(t.hooks,t.engineSelfTest,{userConfig:t.userConfig,projectConfig:t.projectConfig})?1:0}async function df(e){let t=e.cwd??process.cwd(),n=await St(),r=it(t,{ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.versions["copilot-cli"]}),o=as(t),i=ls(),s=B({cwd:t}),a=s.policy,l=de(a),c=De(a,l.capabilities),d=Yt(7),p=e.skipUpdateCheck?{currentVersion:P(),latestVersion:null,updateAvailable:!1}:await Qe(),m={hooks:r,engineSelfTest:Za(),userConfig:o.userConfig,projectConfig:o.projectConfig,configState:bt(s),effectiveRules:o.effectiveRules,shadowedRules:o.shadowedRules,environment:i,effectiveSafety:{selectedPreset:a.safety.level??"standard",level:l.effectiveLevel,capabilities:l.capabilities,ruleOverrides:a.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(c).filter(([,u])=>u.source==="rule_override"&&u.override==="off"&&u.inheritedEnabled&&u.changesInherited).map(([u])=>u),ruleCounts:{stored:Object.keys(a.destructiveCommandRuleOverrides).length,effective:Object.values(c).filter((u)=>u.changesInherited).length}},posture:xs(o.userConfig.path),activity:d,update:p,system:n};return{...m,findings:ds(m)}}function uf(e,t,n){return e.length>0&&e.every((r)=>!r.configured)||e.some((r)=>r.inspectionStatus==="failed")||t.failed>0||n.userConfig.exists&&!n.userConfig.valid||n.projectConfig.exists&&!n.projectConfig.valid}function pf(e){console.log(),console.log(ps(e.hooks)),console.log(),console.log(fs(e.engineSelfTest)),console.log(),console.log(ms(e)),console.log(),console.log(gs(e.environment)),console.log(),console.log(hs(e)),console.log(),console.log(ys(e.findings)),console.log(),console.log(Ls(e.activity)),console.log(),console.log(bs(e.system)),console.log(),console.log(vs(e.update)),console.log(ws(e))}import{existsSync as ff}from"node:fs";var mf=/^[A-Za-z0-9_@%+=:,./-]+$/,Qa="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function ro(e){let t=T({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},e);if(ae(t.errors))return console.error(Qa),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!ff(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let n=t.positionals.length===1?t.positionals[0]:t.positionals.map((r)=>mf.test(r)?r:`'${r.replaceAll("'","'\\''")}'`).join(" ");if(!n)return console.error("Error: No command provided"),console.error(Qa),null;return{json:t.flags.json,cwd:t.values.cwd,command:n}}function el(e){if(e)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function tl(e,t){let r=t-18;return[`${e.dtl}${e.dh.repeat(t)}${e.dtr}`,`${e.dv}  Command Analysis${" ".repeat(r)}${e.dv}`,`${e.dbl}${e.dh.repeat(t)}${e.dbr}`]}function oo(e){return JSON.stringify(e)}function nl(e,t=0){return`[${e.map((r,o)=>us(r,o,t)).join(",")}]`}function Ln(e,t,n=70){let r=e.split(" "),o=[],i="";for(let s of r)if(i&&i.length+s.length+1>n)o.push(i),i=s;else i=i?`${i} ${s}`:s;if(i)o.push(i);return o.map((s,a)=>a===0?s:`${t}${s}`)}function rl(e,t,n){let r=[];switch(e.type){case"parse":return null;case"env-strip":return r.push(""),r.push(`STEP ${t} ${n.h} Strip environment variables`),r.push(`  Removed: ${e.envVars.map((o)=>`${o}=<redacted>`).join(", ")}`),r.push(`  Tokens:  ${oo(e.output)}`),{lines:r,incrementStep:!0};case"leading-tokens-stripped":return r.push(""),r.push(`STEP ${t} ${n.h} Strip wrappers`),r.push(`  Removed: ${e.removed.join(", ")}`),r.push(`  Tokens:  ${oo(e.output)}`),{lines:r,incrementStep:!0};case"shell-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Detect shell wrapper`),r.push(`  Wrapper: ${e.wrapper} -c`),r.push(`  Inner:   ${e.innerCommand}`),{lines:r,incrementStep:!0};case"interpreter":{if(r.push(""),r.push(`STEP ${t} ${n.h} Detect interpreter`),r.push(`  Interpreter: ${e.interpreter}`),r.push(`  Code:        ${e.codeArg}`),e.paranoidBlocked)r.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:r,incrementStep:!0}}case"busybox":return r.push(""),r.push(`STEP ${t} ${n.h} Busybox wrapper`),r.push(`  Subcommand: ${e.subcommand}`),{lines:r,incrementStep:!0};case"transparent-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Transparent wrapper`),r.push(`  Wrapper: ${e.wrapper}`),r.push(`  Tokens:  ${oo(e.output)}`),{lines:r,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(r.push(""),r.push(`STEP ${t} ${n.h} Match rules`),r.push(`  Rule:   ${e.rule}()`),e.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}case"worktree-relaxation":return r.push(""),r.push(`STEP ${t} ${n.h} Worktree relaxation`),r.push(`  Mode:   ${S.worktree.name}`),r.push(`  Git cwd: ${e.gitCwd}`),r.push("  Result: Allowed local discard in linked worktree"),{lines:r,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(e.embeddedCommandFound)return r.push(""),r.push(`STEP ${t} ${n.h} Fallback scan`),r.push(`  Found: ${e.embeddedCommandFound}`),{lines:r,incrementStep:!0};return null}case"custom-rules-check":{if(e.rulesChecked){if(r.push(""),r.push(`STEP ${t} ${n.h} Custom rules`),e.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(e.matched)return r.push(""),r.push(`STEP ${t} ${n.h} Dangerous text check`),r.push(`  Token:  ${e.token}`),r.push("  Result: MATCHED"),{lines:r,incrementStep:!0};return null}case"strict-unparseable":return r.push(""),r.push(`STEP ${t} ${n.h} Strict mode check`),r.push(`  Command: ${e.rawCommand}`),r.push("  Result:  ✗ UNPARSEABLE"),{lines:r,incrementStep:!0};case"segment-skipped":return null;case"error":return r.push(""),r.push(`ERROR: ${e.message}`),{lines:r,incrementStep:!1};default:return null}}function io(e,t){let n=el(t?.asciiOnly??!1),r=58,o=[],i=1;o.push(...tl(n,58)),o.push("");let s=e.trace.steps.find((u)=>u.type==="error");if(s&&s.type==="error"){o.push("ERROR"),o.push(`  ${s.message}`),o.push(""),o.push("RESULT"),o.push(`  Status: ${e.result==="blocked"?g.red("BLOCKED"):g.green("ALLOWED")}`),o.push(""),o.push("CONFIG");let u=e.configSource??"none";return o.push(`  Path: ${u}`),o.join(`
 `)}let a=e.trace.steps.find((u)=>u.type==="parse");if(a&&a.type==="parse"){o.push("INPUT"),o.push(`  ${a.input}`),o.push(""),o.push(`STEP ${i} ${n.h} Split shell commands`),i++;for(let u=0;u<a.segments.length;u++){let h=a.segments[u];if(h){let f=Math.random();o.push(`  Segment ${u+1}: ${nl(h,f)}`)}}}let l=e.trace.segments,c=l.length>1;for(let u of l){if(c){o.push("");let v="";if(a&&a.type==="parse"){let Hn=a.segments[u.index];if(Hn)v=Hn.join(" ")}let w=54,y=v,C=` Segment ${u.index+1}: `,H=" ";if(v){if(C.length+v.length+H.length>w){let Vc=w-C.length-H.length;y=`${v.substring(0,Vc-1)}…`}}let he=v?`${C}${y}${H}`:` Segment ${u.index+1} `,Fn=v?`${C}${g.cyan(y)}${H}`:he,Po=58-he.length,To=Math.floor(Po/2),qc=Po-To;o.push(`${n.sh.repeat(To)}${Fn}${n.sh.repeat(qc)}`)}if(u.steps.find((v)=>v.type==="segment-skipped")){o.push(""),o.push("  (skipped — prior segment blocked)");continue}let f=!1,L=!1;for(let v of u.steps){let w=rl(v,i,n);if(w){if(L=!0,v.type==="recurse"){o.push("");let y=" RECURSING ",C=58-y.length-4;o.push(`  ${n.tl}${n.h}${y}${n.h.repeat(C)}`),o.push(`  ${n.v}`),f=!0;continue}for(let y of w.lines)if(f)o.push(`  ${n.v} ${y}`);else o.push(y);if(w.incrementStep)i++}}if(f)o.push(`  ${n.v}`),o.push(`  ${n.bl}${n.h.repeat(56)}`),f=!1;if(!L)o.push(""),o.push(`  ${g.green("✓")} Allowed (no matching rules)`)}if(o.push(""),o.push("RESULT"),e.result==="blocked"){if(o.push(`  Status: ${g.red("BLOCKED")}`),e.customRule){if(o.push(`  Rule: ${e.customRule.id}`),e.customRule.rulebook)o.push(`  Rulebook: ${e.customRule.rulebook.name} ${e.customRule.rulebook.version}`);if(e.customRule.source)o.push(`  Source: ${e.customRule.source}`);if(e.customRule.override)o.push(`  Override: reason ${e.customRule.override.reason}`)}if(e.reason){let u=Ln(e.reason,"          ");o.push(`  Reason: ${u[0]}`);for(let h=1;h<u.length;h++)o.push(u[h]??"")}}else o.push(`  Status: ${g.green("ALLOWED")}`);o.push(""),o.push("CONFIG");let d=e.configSource??"none",p=e.configValid?"":" (invalid)";o.push(`  Path: ${d}${p}`),o.push(`  Safety preset: ${e.selectedPreset??"standard"}`),o.push(`  Effective capabilities: ${e.effectiveLevel}`);let m=Object.entries(e.destructiveCommandRuleOverrides??{});if(o.push(`  Rule customizations: ${m.length}`),e.ruleActivation)o.push(`  Rule activation: ${e.ruleActivation.id} — ${e.ruleActivation.enabled?"on":"off"} via ${e.ruleActivation.source}`);return o.join(`
 `)}function so(e){return JSON.stringify(e,null,2)}function ol(e){return new Promise((t)=>{process.stdout.write(`${e}
-`,()=>t())})}async function il(e){let t=ro(e);if(!t)return 1;try{let n=We(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await ol(t.json?so(n):io(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof lr)&&!(n instanceof Se)&&!(n instanceof pe))throw n;if(t.json)return await ol(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var sl="2.0.9",W="  ",_e="cc-safety-net";function al(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function gf(e){return Math.max(...e.map((t)=>al(t).length))}function hf(e){return Math.max(...e.map((t)=>t.usage.length))}function yf(e){return Math.max(...e.map((t)=>`${_e} ${t.usage}`.length))}function Lf(e,t){let n=`${_e} ${e.usage}`;return`${W}${n.padEnd(t+2)}${e.description}`}function ge(e,t){return`${W}${e.padEnd(Math.max(40,e.length+2))}${t}`}function vn(e,t=console.log){let n=[];if(n.push(`${_e} ${e.name}`),n.push(""),n.push(`${W}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${W}${_e} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=hf(e.subcommands);for(let o of e.subcommands)n.push(`${W}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=gf(e.options);for(let o of e.options){let i=al(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${W}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${W}${r}`)}t(n.join(`
+`,()=>t())})}async function il(e){let t=ro(e);if(!t)return 1;try{let n=We(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await ol(t.json?so(n):io(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof lr)&&!(n instanceof Se)&&!(n instanceof pe))throw n;if(t.json)return await ol(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var sl="2.0.10",W="  ",_e="cc-safety-net";function al(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function gf(e){return Math.max(...e.map((t)=>al(t).length))}function hf(e){return Math.max(...e.map((t)=>t.usage.length))}function yf(e){return Math.max(...e.map((t)=>`${_e} ${t.usage}`.length))}function Lf(e,t){let n=`${_e} ${e.usage}`;return`${W}${n.padEnd(t+2)}${e.description}`}function ge(e,t){return`${W}${e.padEnd(Math.max(40,e.length+2))}${t}`}function vn(e,t=console.log){let n=[];if(n.push(`${_e} ${e.name}`),n.push(""),n.push(`${W}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${W}${_e} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=hf(e.subcommands);for(let o of e.subcommands)n.push(`${W}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=gf(e.options);for(let o of e.options){let i=al(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${W}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${W}${r}`)}t(n.join(`
 `))}function ao(){let e=yf(Wt),t=[];t.push(`${_e} v${sl}`),t.push(""),t.push("Blocks destructive commands and secret access."),t.push(""),t.push("COMMANDS:");for(let n of Wt)t.push(Lf(n,e));t.push(""),t.push("GLOBAL OPTIONS:"),t.push(`${W}-h, --help       Show help (use with command for command-specific help)`),t.push(`${W}-V, --version    Show version`),t.push(""),t.push("HELP:"),t.push(`${W}${_e} help <command>     Show help for a specific command`),t.push(`${W}${_e} <command> --help   Show help for a specific command`),t.push(""),t.push("ENVIRONMENT VARIABLES:"),t.push(ge(`${S.level.name}=standard|strict|paranoid`,"Set session safety level")),t.push(ge(`${S.worktree.name}=1`,"Allow local git discards in linked worktrees")),t.push(ge(`${S.debug.name}=1`,"Print diagnostic messages to stderr")),t.push(ge(`${S.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),t.push(ge("CC_SAFETY_NET_HOME","Override rule config home directory")),t.push(""),t.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),t.push(ge(`${S.strict.name}=1`,"Force safety.overrides.fail_closed on")),t.push(ge(`${S.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),t.push(ge(`${S.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),t.push(ge(`${S.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),t.push(""),t.push("Documentation:        https://ccsafetynet.com/docs"),console.log(t.join(`
 `))}function ll(){console.log(sl)}function $t(e,t=console.log){let n=Jt(e);if(!n)return!1;if(n.name.toLowerCase()!==e.toLowerCase())return!1;return vn(n,t),!0}import{existsSync as bo,readFileSync as Ql}from"node:fs";import{homedir as um}from"node:os";import{join as Lo}from"node:path";import*as be from"node:readline";function vf(e){return e==="install"?"Install":"Uninstall"}function bf(e){return e==="install"?"Installing":"Uninstalling"}function wf(e){return e==="install"?"into":"from"}function ul(e){return e?.available===!0}function xf(e,t){let n=new Set(t);return e.filter((r)=>n.has(r.target)).map((r)=>r.target)}function cl(e,t,n){if(e.length===0||e.every((r)=>!r.available))return t;return Array.from({length:e.length},(r,o)=>o+1).map((r)=>(t+r*n+e.length)%e.length).find((r)=>ul(e[r]))}function Cf(e,t,n){if(n.ctrl&&n.name==="c")return"interrupt";if(n.name==="escape"||t==="q")return"abort";if(e==="install"&&(t==="u"||t==="U"))return"update";if(n.name==="up"||t==="k")return"up";if(n.name==="down"||t==="j")return"down";if(n.name==="space"||t===" ")return"toggle";if(n.name==="return"||n.name==="enter")return"confirm";return null}function kf(e){return{cursor:e.findIndex((t)=>t.available),selected:[]}}function Sf(e,t,n){if(n==="confirm"||n==="update"||n==="abort"||n==="interrupt")return{state:e,done:n};if(n==="up")return{state:{...e,cursor:cl(t,e.cursor,-1)}};if(n==="down")return{state:{...e,cursor:cl(t,e.cursor,1)}};let r=t[e.cursor];if(!ul(r))return{state:e};let o=e.selected.includes(r.target)?e.selected.filter((i)=>i!==r.target):xf(t,[...e.selected,r.target]);return{state:{...e,selected:o}}}var pl="◉",fl="◯",ml=">",gl=" ";function Df(e,t,n,r={}){let o=r.color!==!1,i=o?g.dim:(l)=>l,s=o?g.green:(l)=>l,a=o?g.bold:(l)=>l;return["",`${vf(e)} CC Safety Net ${wf(e)}:`,"",...t.map((l,c)=>{let d=n.selected.includes(l.target),p=c===n.cursor,m=d?pl:fl,u=p?ml:gl,h=l.available?"":` (${l.unavailableReason??"not installed"})`,f=`${m} ${l.label}${h}`,L=!l.available?i(f):d?s(f):p?a(f):f;return`${u} ${L}`}),"",e==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":t.some((l)=>l.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${e}. q/Esc: close`].join(`
 `)}var dl=["global-hook","plugin"];function Rf(e,t,n={}){let r=n.color!==!1?g.bold:(i)=>i;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((i,s)=>{let a=s===e,l=`${a?pl:fl} ${i}`;return`${a?ml:gl} ${a?r(l):l}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`