cc-safety-net 2.2.0 → 2.2.2

package/dist/api.js

@@ -1 +1 @@
-import{Fa as t,Z as r,ba as n,ub as a,vb as d}from"./chunks/index-pb6n3mp5.js";import{isAbsolute as m,resolve as i}from"node:path";function p(e){if(typeof e!=="object"||e===null)throw TypeError("checkCommand requires an input object with command and cwd");if(typeof e.command!=="string"||e.command.trim()==="")throw TypeError("command must be a non-empty string");if(typeof e.cwd!=="string"||e.cwd.trim()===""||!m(e.cwd))throw TypeError("cwd must be an absolute directory path");let o=i(e.cwd);if(!r(o))return{kind:"deny",reason:n};return l(c(t("library-api",{command:e.command},{kind:"command",shell:"auto"},{configCwd:o,executionCwd:o},e.command)))}function c(e){try{return d(e).decision}catch(o){if(!(o instanceof a))throw o;return o.evaluation.decision}}function l(e){if(e.kind==="allow")return{kind:"allow"};return{kind:"deny",reason:e.reason,...e.ruleId===void 0?{}:{ruleId:e.ruleId}}}export{p as checkCommand};
+import{Fa as t,Z as r,ba as n,ub as a,vb as d}from"./chunks/index-z08yh4sm.js";import{isAbsolute as m,resolve as i}from"node:path";function p(e){if(typeof e!=="object"||e===null)throw TypeError("checkCommand requires an input object with command and cwd");if(typeof e.command!=="string"||e.command.trim()==="")throw TypeError("command must be a non-empty string");if(typeof e.cwd!=="string"||e.cwd.trim()===""||!m(e.cwd))throw TypeError("cwd must be an absolute directory path");let o=i(e.cwd);if(!r(o))return{kind:"deny",reason:n};return l(c(t("library-api",{command:e.command},{kind:"command",shell:"auto"},{configCwd:o,executionCwd:o},e.command)))}function c(e){try{return d(e).decision}catch(o){if(!(o instanceof a))throw o;return o.evaluation.decision}}function l(e){if(e.kind==="allow")return{kind:"allow"};return{kind:"deny",reason:e.reason,...e.ruleId===void 0?{}:{ruleId:e.ruleId}}}export{p as checkCommand};

package/dist/bin/cc-safety-net.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{b as Uo,c as Go,d as G,e as Bo,f as Xn,g as tt,h as Ae,i as gr,j as pe,k as Fi,l as xr,m as Jt,n as Hi,o as Mi,p as Yt}from"../chunks/index-t98xeq4f.js";import{$ as V,$a as ad,A as De,Aa as br,B as Je,Ba as wr,C as Gc,Ca as ki,D as ii,Da as xi,E as si,Ea as Jo,F as ai,Fa as Qe,G as yt,Ga as or,H as tr,Ha as ir,I as ur,Ia as di,J as li,Ja as Ke,Ka as nd,L as ci,La as Zo,M as Q,Ma as Xo,Na as kr,O as ee,Oa as Qo,P as Ze,Pa as ei,Q as Xe,Qa as Z,R as Lt,Ra as sr,S as _c,Sa as fr,T as te,Ta as mr,U as Y,Ua as X,V as pr,Va as rd,W as nr,Wa as kt,X as Wt,Xa as od,Y as rr,Ya as No,Za as id,_ as me,_a as sd,aa as Zi,ab as Tn,bb as ld,ca as Ee,cb as cd,da as Zt,db as Ci,ea as St,eb as Si,fa as vt,fb as Di,ga as Pe,gb as Ri,ha as hr,hb as Fc,ia as fe,ib as ui,ja as ji,jb as pi,ka as Cr,kb as ar,la as Bi,lb as fi,ma as qi,mb as mi,na as yr,nb as ve,oa as Li,ob as Re,pa as Ko,pb as de,qa as vi,qb as gi,ra as bi,rb as B,s as Ct,sa as wi,sb as xt,t as yi,ta as Lr,tb as bt,u as H,ua as Wo,ub as Gi,v as k,va as S,w as gt,wa as vr,x as w,xa as Ui,y as Se,ya as ue,z as oi,za as wt}from"../chunks/index-pb6n3mp5.js";var gd=["-h","--help"];function _(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.fromEntries(n.map(([d])=>[d,!1])),i={},s=[],a=[],l=!1,c=-1;for(let[d,p]of t.entries()){if(d<=c)continue;if(p==="--"){s.push(...t.slice(d+1));break}if(gd.includes(p)){l=!0;continue}let g=n.find(([,m])=>m.includes(p));if(g){o[g[0]]=!0;continue}let u=r.find(([,m])=>m.includes(p));if(u){let m=t[d+1];if(m===void 0||m.startsWith("-")){a.push(`${p} requires a value`);continue}i[u[0]]=m,c=d+1;continue}if(p.startsWith("-")){a.push(`Unknown option for ${e.label}: ${p}`);continue}if(e.positionals==="tail"){s.push(...t.slice(d));break}s.push(p)}if(e.positionals!=="list"&&e.positionals!=="tail")a.push(...s.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:o,values:i,positionals:s,help:l,errors:a}}function le(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as tu,statSync as Ei,unlinkSync as nu}from"node:fs";import{basename as Pi,dirname as ru,join as ou,resolve as iu}from"node:path";function O(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var Wn=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},qe=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as hd,readdirSync as yd,readFileSync as Ld}from"node:fs";import{join as vd}from"node:path";function Le(e,t){try{return yd(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=vd(e,n.name);if(n.isDirectory())return Le(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&hd(e))t.count++;return[]}}function Jn(e){let t=(o)=>`${o.sessionId}
+import{b as Uo,c as Go,d as G,e as Bo,f as Xn,g as tt,h as Ae,i as gr,j as pe,k as Fi,l as xr,m as Jt,n as Hi,o as Mi,p as Yt}from"../chunks/index-j6a67cs3.js";import{$ as V,$a as ad,A as De,Aa as br,B as Je,Ba as wr,C as Gc,Ca as ki,D as ii,Da as xi,E as si,Ea as Jo,F as ai,Fa as Qe,G as yt,Ga as or,H as tr,Ha as ir,I as ur,Ia as di,J as li,Ja as Ke,Ka as nd,L as ci,La as Zo,M as Q,Ma as Xo,Na as kr,O as ee,Oa as Qo,P as Ze,Pa as ei,Q as Xe,Qa as Z,R as Lt,Ra as sr,S as _c,Sa as fr,T as te,Ta as mr,U as Y,Ua as X,V as pr,Va as rd,W as nr,Wa as kt,X as Wt,Xa as od,Y as rr,Ya as No,Za as id,_ as me,_a as sd,aa as Zi,ab as Tn,bb as ld,ca as Ee,cb as cd,da as Zt,db as Ci,ea as St,eb as Si,fa as vt,fb as Di,ga as Pe,gb as Ri,ha as hr,hb as Fc,ia as fe,ib as ui,ja as ji,jb as pi,ka as Cr,kb as ar,la as Bi,lb as fi,ma as qi,mb as mi,na as yr,nb as ve,oa as Li,ob as Re,pa as Ko,pb as de,qa as vi,qb as gi,ra as bi,rb as B,s as Ct,sa as wi,sb as xt,t as yi,ta as Lr,tb as bt,u as H,ua as Wo,ub as Gi,v as k,va as S,w as gt,wa as vr,x as w,xa as Ui,y as Se,ya as ue,z as oi,za as wt}from"../chunks/index-z08yh4sm.js";var gd=["-h","--help"];function _(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.fromEntries(n.map(([d])=>[d,!1])),i={},s=[],a=[],l=!1,c=-1;for(let[d,p]of t.entries()){if(d<=c)continue;if(p==="--"){s.push(...t.slice(d+1));break}if(gd.includes(p)){l=!0;continue}let g=n.find(([,m])=>m.includes(p));if(g){o[g[0]]=!0;continue}let u=r.find(([,m])=>m.includes(p));if(u){let m=t[d+1];if(m===void 0||m.startsWith("-")){a.push(`${p} requires a value`);continue}i[u[0]]=m,c=d+1;continue}if(p.startsWith("-")){a.push(`Unknown option for ${e.label}: ${p}`);continue}if(e.positionals==="tail"){s.push(...t.slice(d));break}s.push(p)}if(e.positionals!=="list"&&e.positionals!=="tail")a.push(...s.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:o,values:i,positionals:s,help:l,errors:a}}function le(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as tu,statSync as Ei,unlinkSync as nu}from"node:fs";import{basename as Pi,dirname as ru,join as ou,resolve as iu}from"node:path";function O(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var Wn=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},qe=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as hd,readdirSync as yd,readFileSync as Ld}from"node:fs";import{join as vd}from"node:path";function Le(e,t){try{return yd(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=vd(e,n.name);if(n.isDirectory())return Le(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&hd(e))t.count++;return[]}}function Jn(e){let t=(o)=>`${o.sessionId}
 ${qe(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o)=>o.sessionId).reduce((o,i)=>o.set(t(i),(o.get(t(i))??0)+1),new Map);return new Set(n.filter((o)=>o.failureStage||(r.get(t(o))??0)>=2))}var bd=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function wd(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(typeof t.ts!=="string"||typeof t.command!=="string")return!1;return bd.every((n)=>t[n]===void 0||typeof t[n]==="string")}function Ce(e,t){try{return Ld(e,"utf-8").split(`
 `).filter(Boolean).flatMap((n)=>{try{let r=JSON.parse(n);if(!wd(r)){if(t)t.count++;return[]}return[r]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as Kd}from"node:path";var kd=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function qo(e){let t=0,n={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(r){e.record({kind:"step",scope:"global",step:r})},recordSegment(r,o=n.currentSegmentIndex){if(o===void 0)return;e.record({kind:"step",scope:"segment",segmentIndex:o,step:r})}};return n}function Vo(e={}){let t=[],n=e.maxEvents??512,r={maxTextLength:e.maxTextLength??2048,maxListLength:e.maxListLength??128,maxObjectProperties:e.maxObjectProperties??e.maxListLength??128,maxDepth:e.maxDepth??16},o=0,i,s=new Set;return{record(a){if(i)return;try{if(!a||t.length>=n){o++;return}t.push(Zn(xd(a,r,s)))}catch{o++}},finish(a){if(i)return i;try{i=Zn({events:Object.freeze(t),droppedEvents:o,terminal:Cd(a,r,s)})}catch{o++,i=Object.freeze({events:Object.freeze(t),droppedEvents:o,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,r.maxTextLength),segment:"trace unavailable".slice(0,r.maxTextLength)})})}return i}}}function xd(e,t,n){if(e.kind!=="step")throw TypeError("invalid trace event");let{scope:r,step:o}=e;zt(o,n,t);let i=Ve(o,t,n);if(r==="global")return{kind:"step",scope:"global",step:i};if(r!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:e.segmentIndex,step:i}}function Cd(e,t,n){let r=e.result;if(r==="allowed")return Object.freeze({result:"allowed"});if(r!=="blocked")throw TypeError("invalid trace terminal");let o=e.ruleId;return Object.freeze({result:"blocked",reason:Ve(e.reason,t,n),segment:Ve(e.segment,t,n),...o?{ruleId:Ve(o,t,n)}:{}})}function zt(e,t,n,r=0,o=new WeakSet){if(typeof e==="string"){let a=e.slice(0,n.maxTextLength);if(!Xn(a))return;for(let l of Bo(a))for(let c of l.match(/[^\s"'()$]+/g)??[])t.add(zo(c));return}if(!e||typeof e!=="object"||r>=n.maxDepth||o.has(e))return;if(o.add(e),Array.isArray(e)){let a=Math.min(e.length,n.maxListLength);for(let l=0;l<a;l++)zt(e[l],t,n,r+1,o);return}let i=0,s=new Set;for(let a in e){if(!Object.hasOwn(e,a))continue;if(i>=n.maxObjectProperties)break;i++,zt(a,t,n);let l=Yn(a,n,t);if(s.has(l))continue;s.add(l),zt(e[a],t,n,r+1,o)}}function Ve(e,t,n,r=0,o=new WeakSet){if(typeof e==="string")return Yn(e,t,n);if(!e||typeof e!=="object")return e;if(r>=t.maxDepth)return;if(o.has(e))return;if(o.add(e),Array.isArray(e)){let a=[],l=Math.min(e.length,t.maxListLength);for(let c=0;c<l;c++)a.push(Ve(e[c],t,n,r+1,o));return a}let i={},s=0;for(let a in e){if(!Object.hasOwn(e,a))continue;if(s>=t.maxObjectProperties)break;s++;let l=Yn(a,t,n);if(Object.hasOwn(i,l))continue;Object.defineProperty(i,l,{value:Ve(e[a],t,n,r+1,o),enumerable:!0,configurable:!0,writable:!0})}return i}function Yn(e,t,n){let r=e.slice(0,t.maxTextLength),o=Xn(r)?Go(r):r,i=n.size>0?Dd(o,n):o;return(Sd(i)?Uo(i):i).slice(0,t.maxTextLength)}function Sd(e){return e.includes("PRIVATE KEY")||e.includes("://")||e.includes("eyJ")||e.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(e)||e.length>=14&&kd.some((t)=>e.includes(t))||e.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(e)}function Dd(e,t){return e.replace(/[^\s"'()$]+/g,(n)=>t.has(zo(n))?"<redacted>":n)}function zo(e){let t=2166136261,n=2166136261;for(let r=0;r<e.length;r++)t=Math.imul(t^e.charCodeAt(r),16777619),n=Math.imul(n^e.charCodeAt(e.length-r-1),16777619);return`${t>>>0}:${n>>>0}:${e.length}`}function Zn(e){if(e&&typeof e==="object"&&!Object.isFrozen(e)){for(let t of Object.values(e))Zn(t);Object.freeze(e)}return e}function Yo(e,t,n){let r=n??Ko(),o=r.getCommandProgram(e,t.shell??"auto"),i=Vo(),s=qo(i),a=o.dialect==="powershell"?r.getCommandProgram(e,"posix"):o,l=Wo(a);s.recordGlobal({type:"parse",input:e,segments:l.map((p)=>[...p])});let c=Jo(e,{...t,analyzePartialProgram:!0,trace:s},o,r),d=s.getNextSegmentIndex();if(c&&d>0&&d<l.length)s.recordSegment({type:"segment-skipped",index:d,reason:"prior-segment-blocked"},d);return Object.freeze({decision:c,trace:i.finish(c?{result:"blocked",reason:c.reason,segment:c.evidence.find((p)=>p.kind==="command")?.segment??e,...c.ruleId?{ruleId:c.ruleId}:{}}:{result:"allowed"}),program:o})}import{resolve as Rd}from"node:path";function Qn(e){let t=Zo().safeParse(e);return{errors:t.success?[]:Qo(t.error.issues),ruleNames:new Set(Xo(e).map((n)=>n.toLowerCase()))}}function er(e){let t=ti(e);if(!t.ok)return t.result;return Qn(t.parsed)}function ti(e){let t=[],n=new Set;try{let r=typeof e==="string"?gt(e):e,o=w(r);if(o===null)return t.push(`File not found: ${r.path}`),{ok:!1,result:{errors:t,ruleNames:n}};if(!o.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:n}};return{ok:!0,parsed:JSON.parse(o)}}catch(r){if(r instanceof H)return t.push(r.message),{ok:!1,result:{errors:t,ruleNames:n}};let o=r instanceof Error?r.message:String(r);return t.push(r instanceof SyntaxError?"Invalid JSON":o),{ok:!1,result:{errors:t,ruleNames:n}}}}function ni(e){return Rd(e??process.cwd(),".safety-net.json")}function ce(e){let t=ti(e);if(!t.ok)return t.result;let n=ei(t.parsed);return{errors:n.errors,ruleNames:n.sources}}import{isAbsolute as Ad,join as ht,relative as Ed,resolve as ri,sep as Pd}from"node:path";async function Ye(e={}){let t=cr(e);return Td(t,await Kt(t,Ke()))}function Td(e,t){if(!t.ok)return t;let n=Y(e),r=[...new Set(de(n.configPath,n.lockPath,e,n.filesystemScope))];if(r.length===0)return t;return{ok:!1,errors:r,warnings:t.warnings,entries:t.entries}}async function Kt(e,t,n,r={}){let o=null,i=!1;try{let s=Y(e),a=sr(s.configTarget);if(!a.ok)return a.result;let l=a.config;if(e.check)return Fd(l,s,e);o={target:s.lockTarget,content:w(s.lockTarget)};let c=ar(s.lockTarget);if(c.errors.some((L)=>L.startsWith("Unable to access ")))return{ok:!1,errors:c.errors,warnings:[],entries:[]};if(e.only&&c.errors.length>0)return{ok:!1,errors:c.errors,warnings:[],entries:[]};let d=c.errors.length>0?null:c.lock,p=e.only?ui(l,d,e.only):{ok:!0,specs:l.rules};if(!p.ok)return p.result;if(e.only&&!d&&p.specs.length<l.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${ci}`],warnings:[],entries:[]};let g=(await _d(p.specs,(L)=>fi(L,s.configDir,e,d,s.filesystemScope,t),t)).map((L)=>Hd(L,d,n));for(let L of g)Ud(L.content,L.entry,s.configDir,e,s.filesystemScope);let u=e.only?Md(l,d,g):g.map((L)=>L.entry);i=!0,X(s.lockTarget,{version:1,rulebooks:u},void 0,r._testAfterPolicyRename);let m=new Map(g.map((L)=>[L.entry.spec,L.rulebook.rules.length])),f=Gd(u,s.configDir,e,s.filesystemScope,r);return{ok:!0,errors:[],warnings:f,entries:u.map((L)=>jd(L,m))}}catch(s){if(i&&o)try{ze(o.target,o.content)}catch(a){return We(a)}return We(s)}}async function lr(e,t={}){return Id(e,cr(t),Ke())}async function Id(e,t,n,r={}){let o=null,i=!1;try{let s=Y(t),a=w(s.configTarget);o={target:s.configTarget,content:a};let l=sr(s.configTarget);if(!l.ok)return l.result;let c=l.config,d=li(e)?await mi(e,n):[{spec:e}],p=d.map((m)=>m.spec),g=[...new Set([...c.rules,...p])];if(g.length>or)return Od();if(g.length!==c.rules.length)i=!0,X(s.configTarget,{version:1,rules:g,overrides:c.overrides??{},transparent_wrappers:c.transparent_wrappers??[]},void 0,r._testAfterPolicyRename);let u=await Kt(t,n,new Map(d.filter((m)=>!!m.display_ref).map((m)=>[m.spec,m.display_ref])),r);if(!u.ok)ze(s.configTarget,a);return u}catch(s){if(i&&o)try{ze(o.target,o.content)}catch(a){return We(a)}return We(s)}}async function _d(e,t,n=Ke()){if(e.length>or)throw Error(ir);let r=Array(e.length),o=0,i,s=Array.from({length:Math.min(e.length,di.concurrency)},async()=>{while(!i){let a=o;if(a>=e.length)return;o++;try{r[a]=await t(e[a],a,n.controller.signal)}catch(l){if(!i)i={value:l},o=e.length,n.controller.abort(l);return}}});if(await Promise.all(s),i)throw i.value;return r}function Od(){return{ok:!1,errors:[ir],warnings:[],entries:[]}}function cr(e){return{cwd:e.cwd,cacheConfigDir:e.cacheConfigDir,userConfigDir:e.userConfigDir,userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,global:e.global,check:e.check,only:e.only,refresh:e.refresh}}function $d(e){return{...cr(e),deleteSource:e.deleteSource}}async function dr(e,t={}){try{return await Nd(e,$d(t),{})}catch(n){return We(n)}}async function Nd(e,t,n){let r=Y(t),o=Z(r.configTarget);if(o.errors.length>0)return{ok:!1,errors:o.errors,warnings:[],entries:[]};if(!o.config)return{ok:!1,errors:[`No config found at ${r.configPath}`],warnings:[],entries:[]};let i=ar(r.lockTarget);if(i.errors.length>0)return{ok:!1,errors:i.errors,warnings:[],entries:[]};let s=pi(o.config.rules,i.lock,e);if(!s.ok)return s.result;let a=t.deleteSource?Bd(r.configDir,s.specs,i.lock,r.filesystemScope):{ok:!0,dirs:[]};if(!a.ok)return a.result;let l=w(r.configTarget);if(l===null)return We(Error("Rules config is unavailable."));try{X(r.configTarget,{version:1,rules:o.config.rules.filter((p)=>!s.specs.includes(p)),overrides:o.config.overrides??{},transparent_wrappers:o.config.transparent_wrappers??[]},void 0,n._testAfterPolicyRename)}catch(p){throw ze(r.configTarget,l),p}let c=await Kt(t,Ke(),void 0,n);if(!c.ok)return ze(r.configTarget,l),c;let d=qd(r.configDir,a.dirs,n,r.filesystemScope);if(!d.ok){ze(r.configTarget,l);let p=await Kt(t,Ke(),void 0,n);if(!p.ok)return{ok:!1,errors:[...d.result.errors,...p.errors],warnings:p.warnings,entries:p.entries};return d.result}return c}async function Fd(e,t,n){let r=gi(e,t.lockPath,t.configDir,n,n.global?"user":"project",t.filesystemScope);return{ok:r.errors.length===0&&r.warnings.length===0,errors:[...r.errors,...r.warnings],warnings:[],entries:r.entries}}function Hd(e,t,n){let r=t?.rulebooks.find((i)=>i.spec===e.entry.spec&&i.kind==="github"),o=n?.get(e.entry.spec)??(r?.kind==="github"?r.display_ref:void 0);if(!o||e.entry.kind!=="github")return e;return{...e,entry:{...e.entry,display_ref:o}}}function Md(e,t,n){let r=new Set(e.rules),o=new Set(t?.rulebooks.map((s)=>s.spec)??[]),i=new Map(n.map((s)=>[s.entry.spec,s.entry]));return[...(t?.rulebooks.filter((s)=>r.has(s.spec))??[]).map((s)=>i.get(s.spec)??s),...n.filter((s)=>!o.has(s.entry.spec)).map((s)=>s.entry)]}function jd(e,t){return{...e,ruleCount:t.get(e.spec)}}function Ud(e,t,n,r,o){let i=nr(t,rr(n,r));Se(k(o,i),e)}function Gd(e,t,n,r,o){let i=rr(t,n),s=Wt(i),a=k(r,s),l=De(a);if(!l)return[];let c=e.map((p)=>k(r,nr(p,i))),d=l.filter((p)=>p.kind==="directory").map((p)=>({directory:k(r,ht(s,p.name)),identity:k(r,ht(s,p.name,tr))})).filter((p)=>!c.some((g)=>oi(p.identity,g))).map((p)=>p.directory);for(let p of d)ai(p);return d.flatMap((p)=>{try{return Vd(p,o),[]}catch{return["Unable to prune rules policy cache safely."]}})}function Bd(e,t,n,r){let o=new Map(n?.rulebooks.map((c)=>[c.spec,c])??[]),i=t.flatMap((c)=>{let d=o.get(c);if(!d)return yt.test(c)?[]:["--delete-source can only delete local rulebook sources"];return d.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),s=t.map((c)=>{let d=o.get(c);return ht(e,d?.kind==="local-directory"?d.path:c)}),a=i.length>0?[]:s.flatMap((c)=>hi(e,c,r)),l=[...i,...a];return l.length>0?{ok:!1,result:{ok:!1,errors:l,warnings:[],entries:[]}}:{ok:!0,dirs:s}}function hi(e,t,n){let r=ri(e),o=ri(t),i=Ed(r,o);if(i===""||i===".."||i.startsWith(`..${Pd}`)||Ad(i))return[`Refusing to delete local rulebook source outside ${e}: ${t}`];let s=k(n,o),a=De(s);if(!a)return[`Local rulebook source directory not found: ${t}`];let l=a.find((c)=>c.name==="rulebook.json");if(!l)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(l.kind!=="file")throw new H(n.label);if(w(k(n,ht(o,"rulebook.json"))),a.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function qd(e,t,n,r){let o=t.flatMap((i)=>{try{if(!De(k(r,i)))return[];let s=hi(e,i,r);if(s.length>0)return s;return zd(i,n,r),[]}catch(s){return[`Failed to delete local rulebook source ${i}: ${s instanceof Error?s.message:String(s)}`]}});return o.length>0?{ok:!1,result:{ok:!1,errors:o,warnings:[],entries:[]}}:{ok:!0}}function Vd(e,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(e.path);return}ii(e)}function zd(e,t,n){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(e);return}Je(k(n,ht(e,tr))),si(k(n,e))}function ze(e,t){if(t===null){Je(e);return}Se(e,t)}function We(e){return{ok:!1,errors:[e instanceof Error?e.message:String(e)],warnings:[],entries:[]}}function et(e,t){let n=Jd(t),r=ki(n),o={effectiveLevel:r.effectiveLevel,selectedPreset:n.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:r.effectiveCapabilities,destructiveCommandRuleOverrides:n.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:i,configValid:s}=Wd({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!e||!e.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:i,configValid:s,...o};let a=Yd(e,n);if(a)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:a.rule,matched:!0,reason:a.reason}]}]},result:"blocked",reason:G(a.reason),segment:G(a.target),...a.ruleId?{ruleId:G(a.ruleId)}:{},configSource:i,configValid:s,...o};let l=Yo(e,n),c=l.decision,d=c?.ruleId??Zd(e,n),p=vt.find((u)=>u.id===d&&u.activationCapability),g=p?r.policy.effectiveDestructiveCommandRules[p.id]:void 0;return{trace:Qd(l.trace),result:c?"blocked":"allowed",reason:c?G(c.reason):void 0,segment:c?G(c.evidence.find((u)=>u.kind==="command")?.segment??e):void 0,ruleId:c?.ruleId?G(c.ruleId):void 0,customRule:Xd(eu(c?.ruleId,n.policySnapshot)),configSource:i,configValid:s,...o,...p&&g?{ruleActivation:{id:p.id,...g}}:{}}}function Wd(e){let t=Q(e?.cwd),n=e?.userConfigPath??ee(e),r=te({cwd:e?.cwd,userConfigDir:e?.userConfigDir,userConfigPath:e?.userConfigPath});try{if(w(r.projectConfigTarget)!==null){if(ce(r.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(o){if(o instanceof H)return{configSource:t,configValid:!1};throw o}try{if(w(r.userConfigTarget)!==null){let o=ce(r.userConfigTarget);return{configSource:n,configValid:o.errors.length===0}}return{configSource:null,configValid:!0}}catch(o){if(o instanceof H)return{configSource:n,configValid:!1};throw o}}function Jd(e){let t=Kd(e?.cwd??process.cwd()),n=e?.policySnapshot??B({cwd:t,userConfigDir:e?.userConfigDir}),r=ue(n.policy);return{cwd:t,effectiveCwd:t,policySnapshot:n,environment:yi(),protectedGitMetadata:wi([t]),effectiveCapabilities:r.capabilities,strict:e?.strict??r.strict,paranoidRm:r.paranoidRm,paranoidInterpreters:r.paranoidInterpreters,worktreeMode:r.worktreeMode}}function Yd(e,t){let n=t.cwd??process.cwd(),r=Li(Qe("",{command:e},{kind:"command",shell:"posix"},{executionCwd:n,configCwd:n},e)),o=Si(r);if(o)return{reason:Ci,target:o.target,ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};let i=bi(r,t.protectedGitMetadata);if(i)return{reason:vi,target:i.target,ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};let s=t.policySnapshot.policy,a=s.secretProtection.enabled===!1?null:Ri(r,s.secretProtection,{strict:t.strict});if(a)return{reason:Di,target:a.target,ruleId:a.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"};return null}function Zd(e,t){let n=t.policySnapshot.policy,r=bt({...n,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...n.destructiveCommandRuleOverrides,...Object.fromEntries(vt.flatMap((o)=>o.activationCapability?[[o.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return xi(e,{...t,policySnapshot:r,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function Xd(e){if(!e)return;return{id:G(e.id),...e.rulebook?{rulebook:{name:G(e.rulebook.name),version:G(e.rulebook.version)}}:{},...e.source?{source:G(e.source)}:{},...e.override?{override:{type:"reason",reason:G(e.override.reason)}}:{}}}function Qd(e){let t=e.events.flatMap((r)=>r.kind==="step"&&r.scope==="global"?[r.step]:[]),n=new Map;for(let r of e.events){if(r.kind!=="step"||r.scope!=="segment")continue;let o=n.get(r.segmentIndex)??{index:r.segmentIndex,steps:[]};o.steps.push(r.step),n.set(r.segmentIndex,o)}return{steps:t,segments:[...n.values()]}}function eu(e,t){let n=e?.replace(/^custom\./,"");if(!n||!t.policy.rules.some((r)=>r.name===n))return;return t.ruleMetadata[n]??Object.freeze({id:n})}function su(e){let t=tt(),n=_({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},e);if(le(n.errors))return null;if(n.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(n.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let r=n.values.limit===void 0?20:Ai(n.values.limit);if(r===null)return console.error("--limit must be a positive number"),null;let o=n.values.since===void 0?Math.min(30,t):Ai(n.values.since);if(o===null||o>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let i={limit:r,limitExplicit:n.values.limit!==void 0,since:o,sinceExplicit:n.values.since!==void 0,all:n.flags.all,json:n.flags.json,suspect:n.flags.suspect,pruneLegacy:n.flags.pruneLegacy,dryRun:n.flags.dryRun,id:n.values.id,agent:n.values.agent,rule:n.values.rule,session:n.values.session,project:n.values.project===void 0?void 0:iu(n.values.project)};if(i.id&&(i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.sinceExplicit||i.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(i.pruneLegacy&&(i.id!==void 0||i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.all||i.sinceExplicit||i.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(i.dryRun&&!i.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return i}async function Ti(e,t={}){let n=su(e);if(!n)return 1;let r=t.logsDir??pe();if(n.pruneLegacy)return au(r,n.json,n.dryRun);if(!r)return console.log(n.json?"[]":n.id?`No retained audit log entry found for id ${O(n.id)}.`:"No audit log entries found."),0;Ae(r);let o={count:0},i=Le(r,o).flatMap((d)=>Ce(d,o).map((p)=>({entry:p,file:d})));if(o.count>0)console.error(`warning: ${o.count} audit log ${o.count===1?"source":"sources"} could not be read; these results are incomplete`);if(n.id)return uu(i,n,t.timeZone);let s=Date.now()-n.since*24*60*60*1000,a=i.filter((d)=>pu(d,n,r,s)),l=n.suspect?Jn(a.map((d)=>d.entry)):null,c=(l?a.filter((d)=>l.has(d.entry)):a).sort((d,p)=>Date.parse(p.entry.ts)-Date.parse(d.entry.ts)).slice(0,n.limit);if(n.json)return console.log(JSON.stringify(c.map((d)=>d.entry),null,2)),0;if(c.length===0)return console.log("No audit log entries found."),0;for(let d of c)console.log(gu(d.entry,t.timeZone));return 0}function au(e,t,n){let r=e?cu(e).map((a)=>ou(e,a)):[];if(n)return lu(r,t);let o=[],i=0,s=0;for(let a of r){let l=Ei(a,{throwIfNoEntry:!1})?.size??0,c=du(a);if(c){o.push(`${Pi(a)}: ${c}`);continue}i++,s+=l}if(t)return console.log(JSON.stringify({removedFiles:i,removedBytes:s,failedFiles:o.length})),o.length===0?0:1;console.log(i===0&&o.length===0?"No legacy audit log files found.":`Removed ${i} legacy audit log ${i===1?"file":"files"} (${Ii(s)}).`);for(let a of o)console.error(`Could not remove ${O(a)}`);if(console.log("Nested v2 audit logs were not changed."),i>0)console.log("This deletion cannot be undone.");return o.length===0?0:1}function lu(e,t){let n=e.reduce((r,o)=>r+(Ei(o,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:e.length,bytes:n})),0;if(console.log(e.length===0?"No legacy audit log files found.":`Would remove ${e.length} legacy audit log ${e.length===1?"file":"files"} (${Ii(n)}).`),console.log("Nested v2 audit logs are not included."),e.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function cu(e){try{return tu(e,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function du(e){try{return nu(e),null}catch(t){return t instanceof Error?t.message:String(t)}}function Ii(e){let t=["B","KiB","MiB","GiB"],n=Math.min(Math.floor(Math.log2(Math.max(e,1))/10),t.length-1);return`${Math.round(e/1024**n*10)/10} ${t[n]}`}function uu(e,t,n){let r=e.filter((i)=>i.entry.id===t.id);if(r.length>1)return console.error(`Multiple audit log entries found for id ${O(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(r.map((i)=>i.entry),null,2)),0;let o=r[0];if(!o)return console.log(`No retained audit log entry found for id ${O(t.id??"")}.`),0;return console.log(hu(o.entry,n)),0}function pu(e,t,n,r){if(!t.all&&e.entry.decision==="allow")return!1;if(Date.parse(e.entry.ts)<r)return!1;if(t.agent!==void 0&&e.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&e.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!fu(e,n,t.session))return!1;if(t.project!==void 0&&!mu(e.entry.cwd,t.project))return!1;return!0}function fu(e,t,n){if(e.entry.sessionId===n)return!0;return ru(e.file)===t&&Pi(e.file,".jsonl")===n}function mu(e,t){if(!e)return!1;return e===t||e.startsWith(`${t}/`)}function gu(e,t){let n=O(e.id??"-"),r=O(e.decision??"deny"),o=e.cwd?`  [${O(e.cwd)}]`:"",i=e.segment||e.command,s=i===e.command?"":"↳ ",a=i.length>50?`${i.slice(0,50)}…`:i;return`${n.padEnd(16)}  ${O(_i(e.ts,t))}  ${r.padEnd(5)}  ${O(e.agent??"-").padEnd(15)}  ${O(e.ruleId??"-").padEnd(20)}  ${s}${O(a)}${o}`}function hu(e,t){let n=(o)=>O(o===void 0||o===null||o===""?"-":o),r=e.shape?`${e.agent??"-"} (shape: ${e.shape})`:e.agent??"-";return[`id:        ${n(e.id)}`,`ts:        ${n(_i(e.ts,t))}`,`decision:  ${n(e.decision)}`,`agent:     ${n(r)}`,`level:     ${n(e.level)}`,`tool:      ${n(e.toolName)}`,`rule:      ${n(e.ruleId)}`,`intent:    ${n(e.intent)}`,`stage:     ${n(e.failureStage)}`,`error:     ${n(e.errorCode)}`,`session:   ${n(e.sessionId)}`,`cwd:       ${n(e.cwd)}`,`version:   ${n(e.v)}`,`truncated: ${n(e.truncated===!0?"yes":void 0)}`,`reason:    ${n(e.reason)}`,`command:   ${n(e.command)}`,`segment:   ${n(e.segment)}`].join(`
 `)}function _i(e,t){let n=new Date(e);if(Number.isNaN(n.getTime()))return e;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(n)}function Ai(e){let t=Number(e);return Number.isFinite(t)&&t>0?t:null}var Oi={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var $i={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var Ni={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as Vi,join as Ru,relative as Au}from"node:path";var yu=8388608;function Lu(e,t){console.log(JSON.stringify(e(Hi(t))))}async function vu(e){let t;try{t=(await Sr(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return Dr(t,e,"Failed to parse hook input JSON.")}async function Sr(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>yu)throw bu(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function bu(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function Dr(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function N(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:ji(e)}}function ne(e,t,n,r){let o=e===void 0?process.cwd():e,i=typeof o==="string"&&o.trim()!==""?V([o]):void 0;if(i)return{configCwd:i,executionCwd:i};return P(r,t,n,Cu(o)),null}function P(e,t,n,r){let o;try{o=Cr(t)}catch(i){if(!(i instanceof fe))throw i}e(Jt({command:o,segment:r,toolName:n}))}async function wu(e){let t=await vu(e.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){P(e.outputDeny);return}if(!e.isSupported(t))return;let n=e.getAgent?.(t)??e.agent,r=e.agent===n?void 0:e.agent,o=Du(t),i=(u,m)=>{Fi(u,()=>e.getSessionId(t),{agent:n,shape:r,toolName:m,cwd:o}),e.outputDeny(u)},s=e.getToolName(t);if(typeof s!=="string"||s.trim()===""){P((u)=>i(u),Su(t));return}let a=s,l=(u)=>i(u,a),c;try{c=e.getToolInput(t,a,l)}catch(u){if(!(u instanceof fe))throw u;P(l,void 0,a);return}if(!c.ok)return;let d=e.getContext(t,c.input,a,l);if(!d)return;let p;try{p=Cr(c.input)}catch(u){if(!(u instanceof fe))throw u;P(l,void 0,a);return}let g=Qe(a,c.input,c.route,d,p??null);try{let u=Yt(g,{guard:{auditAllowed:Ui(),dependencies:e.guardDependencies},audit:{agent:n,shape:r,getSessionId:()=>e.getSessionId(t)}}),m=xr(u,{includeEvidence:!0,toolName:u.stage==="command-analysis"?void 0:a});if(m){e.outputDeny(m);return}e.outputAllow?.()}catch(u){if(!(u instanceof Gi))throw u;ku(u);let m=xr(u.evaluation,{includeEvidence:!0,toolName:u.evaluation.stage==="command-analysis"?void 0:a});if(m)e.outputDeny(m);return}}function ku(e){if(!wt(S.debug))return;console.error(`CC Safety Net debug: ${xu(e.stage)}: ${Mi(e.cause)}`)}function xu(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function Cu(e){return typeof e==="string"?e:void 0}function Su(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Du(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function F(e){let t=(o)=>Lu(e.createDenyOutput,o),n=e.createAllowOutput;await wu({...e,outputDeny:t,outputAllow:n?()=>console.log(JSON.stringify(n())):void 0})}function Dt(e){return Ru(e,".gemini","config","hooks.json")}var Eu=new Map([["run_command","auto"]]),Pu=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function zi(e){return N(e,Eu)}async function Ki(){await F({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:$u(e.toolCall?.args,t),route:zi(t)}),getContext:Tu,getSessionId:(e)=>e.conversationId})}function Tu(e,t,n,r){let i=Ou(e).flatMap((c)=>{let d=V([c]);return d?[d]:[]});if(!i[0])return Te(r,t,n),null;if(n!=="run_command"){let c;try{c=Iu(t,n,i)}catch(d){if(d instanceof fe)return Te(r,void 0,n),null;if(!(d instanceof Ee))throw d;return Te(r,t,n),null}if(!c)return Te(r,t,n),null;return{configCwd:c,executionCwd:c}}let s=e.toolCall?.args;if(!s||!Object.hasOwn(s,"Cwd"))return{configCwd:i[0],executionCwd:i[0]};let a=s.Cwd;if(typeof a!=="string"||a.trim()==="")return Te(r,t,n),null;let l=me(a,i);if(l){let c=Wi(l,i);if(!c)return Te(r,t,n,a),null;return{configCwd:c,executionCwd:l}}return Te(r,t,n,a),null}function Iu(e,t,n){let r=zi(t),o=[...Bi(e,Pu),...r.kind==="patch"?qi(e):[]].filter(Vi),i=Zt(),s=new Set(o.flatMap((a)=>{let l=Wi(St(a,Ct,i),n);return l?[l]:[]}));if(s.size>1)return null;return[...s][0]??n[0]??null}function Wi(e,t){return t.filter((n)=>_u(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function _u(e,t){let n=Au(t,e);return n===""||!n.startsWith("..")&&!Vi(n)}function Te(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(Jt({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function Ou(e){if(e.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((n)=>typeof n==="string"&&n.trim()!==""):[];return V(t)?t:[]}function $u(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var Rt=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:8,runtime:{order:6,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:9,runtime:{order:7,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:10,runtime:{order:8,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:11,install:{order:11,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:12,install:{order:12,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:13,install:{order:13,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],Xt=Rt.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Ji=Rt.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),z=Rt.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),Oh=Object.fromEntries(Rt.map((e)=>[e.id,e.displayName]));function R(e){return Rt.find((t)=>t.id===e)?.displayName??e}import{homedir as Nu}from"node:os";import{isAbsolute as Yi,join as Rr}from"node:path";function Xi(e){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!Yi(e))return"unknown";try{let t=Zt(),n=typeof e==="string"&&e?St(e,Ct,t):void 0,r=process.env.HOME||Nu(),o=[["codex",process.env.CODEX_HOME||Rr(r,".codex")],["copilot-cli",process.env.COPILOT_HOME||Rr(r,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||Rr(r,".claude")]],i=n?o.flatMap(([s,a])=>{if(!Yi(a))return[];return Zi(n,St(a,Ct,t))?[s]:[]}):[];if(i.length===1)return i[0]??"unknown";if(i.length>1)return"unknown"}catch(t){if(t instanceof Ee)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var Ar="PreToolUse",Qi="BeforeTool",es="pre_tool_call",Er="PreToolUse";var Fu=new Map([["Bash","posix"],["PowerShell","powershell"]]);function Hu(e){return N(e,Fu)}async function ts(){await F({agent:"claude-code",getAgent:(e)=>Xi(e.transcript_path),createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:Ar,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===Ar,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Hu(t)}),getContext:(e,t,n,r)=>ne(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}var Mu=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function ju(e){return N(e,Mu)}async function ns(){await F({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=Dr(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:ju(t)}},getContext:(e,t,n,r)=>ne(e.cwd,t,n,r),getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var Uu=new Map([["Shell","auto"]]);function Gu(e){return N(e,Uu)}async function rs(){await F({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Gu(t)}),getContext:Bu,getSessionId:(e)=>e.conversation_id})}function Bu(e,t,n,r){let o=qu(e);if(!o[0])return P(r,t,n),null;let i=me(zu(e.cwd),o);if(!i)return P(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:i,executionCwd:i};if(!Object.hasOwn(t,"working_directory"))return{configCwd:i,executionCwd:i};let s=t.working_directory;if(typeof s!=="string"||s.trim()==="")return P(r,t,n),null;let a=me(s,o);if(!a)return P(r,t,n,s),null;return{configCwd:i,executionCwd:a}}function qu(e){return Vu(e).flatMap((t)=>{let n=V([t]);return n?[n]:[]})}function Vu(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function zu(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Ku=new Map([["run_shell_command","auto"]]);function Wu(e){return N(e,Ku)}async function os(){await F({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===Qi,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Wu(t)}),getContext:(e,t,n,r)=>ne(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}var Ju=new Map([["run_terminal_command","auto"]]);function Yu(e){return N(e,Ju)}async function is(){await F({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return P(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:Yu(t)}},getContext:Zu,getSessionId:(e)=>e.sessionId})}function Zu(e,t,n,r){let o=V(Xu(e));if(!o)return P(r,t,n),null;let i=me(Qu(e.cwd),[o]);if(!i)return P(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;return{configCwd:i,executionCwd:i}}function Xu(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?[t]:[]}function Qu(e){return typeof e==="string"&&e.trim()!==""?e:"."}import{resolve as ep}from"node:path";var tp=new Map([["terminal","posix"]]);async function ss(){await F({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===es,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:N(t,tp)}),getContext:np,getSessionId:(e)=>e.session_id})}function np(e,t,n,r){let o=ne(e.cwd,t,n,r);if(!o)return null;if(!t||typeof t!=="object"||Array.isArray(t))return o;if(!Object.hasOwn(t,"workdir"))return o;let i=t.workdir;if(typeof i!=="string"||i.trim()==="")return P(r,t,n),null;let s=V([ep(o.configCwd,i)]);if(!s)return P(r,t,n,i),null;return{...o,executionCwd:s}}var as=new Map([["Bash","posix"]]);function rp(e){return N(e,as)}async function ls(){await F({agent:"kimi-code",createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:Er,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===Er,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:rp(t)}),getContext:(e,t,n,r)=>{let o=ne(e.cwd,t,n,r);if(!o)return null;let i=e.tool_input;if(!as.has(n)||!i||!Object.hasOwn(i,"cwd"))return o;let s=i.cwd;if(typeof s!=="string"||s.trim()==="")return P(r,t,n),null;let a=me(s,[o.configCwd]);if(!a)return P(r,t,n,s),null;return{configCwd:o.configCwd,executionCwd:a}},getSessionId:(e)=>e.session_id})}var op={"antigravity-cli":Ki,"claude-code":ts,"copilot-cli":ns,cursor:rs,"gemini-cli":os,"grok-build":is,"hermes-agent":ss,"kimi-code":ls},nt=Ji.map((e)=>({...e,run:op[e.id]}));function cs(e){let t=_({label:"hook",booleans:Object.fromEntries(nt.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=nt.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function ds(e){return nt.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}var ip=nt.map((e)=>({flags:e.flags.join(", "),description:e.description})),sp=nt.flatMap((e)=>e.flags.map((t)=>`cc-safety-net hook ${t}`)),us={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...ip,{flags:"-h, --help",description:"Show this help"}],examples:sp};var ps={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...z.map((e)=>({flags:e.flag,description:`Install ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...z.map((e)=>`cc-safety-net install ${e.flag}`)]},fs={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...z.map((e)=>({flags:e.flag,description:`Uninstall ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...z.map((e)=>`cc-safety-net uninstall ${e.flag}`)]},ms={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var gs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var rt={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var hs={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var ys={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var Qt=[hs,Oi,gs,$i,rt,ps,ms,fs,us,Ni,ys];function ap(e){return e.aliases??[]}function en(e){let t=e.toLowerCase();return Qt.find((n)=>n.name.toLowerCase()===t||ap(n).some((r)=>r.toLowerCase()===t))}import{basename as lp}from"node:path";function tn(e=7,t=pe()){let n=Date.now()-e*24*60*60*1000,r=[],o=new Set,i=0,s,a,l,c;if(t)Ae(t);let d={count:0},p=t?Le(t,d):[];for(let u of p)for(let m of Ce(u,d)){if(m.decision==="allow")continue;let f=new Date(m.ts).getTime();if(f>=n){if(i++,o.add(m.sessionId??lp(u,".jsonl")),a===void 0||f<=a)s=m.ts,a=f;if(c===void 0||f>c)l=m.ts,c=f;cp(r,m,f)}}let g=r.map((u)=>({timestamp:u.ts,command:u.command,reason:u.reason,relativeTime:Wn(new Date(u.ts))}));return{totalBlocked:i,sessionCount:o.size,recentEntries:g,oldestEntry:s,newestEntry:l,unreadable:d.count}}function cp(e,t,n){let r=e.findIndex((o)=>n>new Date(o.ts).getTime());if(r===-1){if(e.length<3)e.push(t);return}if(e.splice(r,0,t),e.length>3)e.pop()}import{dirname as dp}from"node:path";function Ls(e,t,n,r,o){let i;try{if(w(r)===null)return{path:e,exists:!1,valid:!1,ruleCount:0};i=ce(r),i.errors.push(...de(e,t,{userConfigDir:n},o))}catch(s){if(!(s instanceof H))throw s;i={errors:[s.message],ruleNames:new Set}}return{path:e,exists:!0,valid:i.errors.length===0,ruleCount:i.ruleNames.size,...i.errors.length>0?{errors:i.errors}:{}}}function up(e,t){return{source:t,name:e.name,command:e.command,subcommand:e.subcommand,blockArgs:[...e.block_args],reason:e.reason}}function vs(e,t){let n=t?.userConfigPath??ee(),r=t?.projectConfigPath??Q(e),o=dp(n),i=ve({cwd:e,userConfigPath:n,projectConfigPath:r,userConfigDir:o}),s=te({cwd:e,userConfigPath:n,projectConfigPath:r,userConfigDir:o}),a=new Map(i.rulebooks.flatMap((l)=>l.rules.map((c)=>[c,l.source])));return{userConfig:Ls(n,Ze({userConfigPath:n}),o,s.userConfigTarget,s.userScope),projectConfig:Ls(r,Xe(r),o,s.projectConfigTarget,s.projectScope),effectiveRules:i.rules.map((l)=>up(l,a.get(l.name)??"project")),shadowedRules:[]}}var pp=[{flag:S.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:S.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:S.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:S.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:S.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:S.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:S.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:S.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function bs(){return[...pp.map((e)=>({name:e.flag.name,value:br(e.flag),isSet:wr(e.flag),legacyName:e.flag.legacyName,legacyValue:e.flag.legacyName?process.env[e.flag.legacyName]:void 0,legacyIsSet:e.flag.legacyName?process.env[e.flag.legacyName]!==void 0:void 0,description:e.description,defaultBehavior:e.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:process.env.CC_SAFETY_NET_HOME,isSet:process.env.CC_SAFETY_NET_HOME!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var ws={error:0,warning:1,info:2},fp=["policy","config","audit"];function mp(e){return e.map((t)=>{if(t==="ownership")return"is not owned by the current user";if(t==="permissions")return"has unsafe permissions";if(t==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var gp=[{derive:(e)=>e.hooks.length>0&&e.hooks.every((t)=>!t.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(e)=>e.hooks.filter((t)=>t.inspectionStatus==="failed").map((t)=>{let n=R(t.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${n} inspection failed`,detail:`Doctor could not verify the ${n} integration configuration.`,fixHint:`Correct the reported ${n} configuration error, then run \`cc-safety-net doctor\` again.`,integration:t.platform}})},{derive:(e)=>e.userConfig.exists&&!e.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:e.userConfig.path}]:[]},{derive:(e)=>e.projectConfig.exists&&!e.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:e.projectConfig.path}]:[]},{derive:(e)=>e.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${e.configState.reason}`,fixHint:"Correct the named source, run `cc-safety-net rule sync` for a rule source, then rerun doctor."}]:[]},{derive:(e)=>{let t=e.environment.find((n)=>n.name==="CC_SAFETY_NET_AUDIT_SCOPE");return vr(t?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...fp.map((e)=>({derive:(t)=>t.posture.directories.filter((n)=>n.kind===e&&n.status==="unsafe").map((n)=>({checkId:`posture.${e}-directory-unsafe`,severity:"error",title:`${e[0]?.toUpperCase()}${e.slice(1)} directory is unsafe`,detail:`The ${e} directory ${mp(n.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...n.path?{path:n.path}:{}}))})),{derive:(e)=>{let t=[...e.effectiveSafety.weakenedRuleOverrides].sort();return t.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${t.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${t.join(", ")}.`}]:[]}}];function ks(e){return gp.flatMap((t,n)=>t.derive(e).map((r,o)=>({finding:r,catalogOrder:n,occurrence:o}))).sort((t,n)=>ws[t.finding.severity]-ws[n.finding.severity]||t.catalogOrder-n.catalogOrder||t.occurrence-n.occurrence).map((t)=>t.finding)}function re(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var hp=(e)=>re()?`\x1B[32m${e}\x1B[0m`:e,yp=(e)=>re()?`\x1B[33m${e}\x1B[0m`:e,Lp=(e)=>re()?`\x1B[34m${e}\x1B[0m`:e,vp=(e)=>re()?`\x1B[35m${e}\x1B[0m`:e,bp=(e)=>re()?`\x1B[36m${e}\x1B[0m`:e,wp=(e)=>re()?`\x1B[31m${e}\x1B[0m`:e,kp=(e)=>re()?`\x1B[2m${e}\x1B[0m`:e,xp=(e)=>re()?`\x1B[1m${e}\x1B[0m`:e,h={green:hp,yellow:yp,blue:Lp,magenta:vp,cyan:bp,red:wp,dim:kp,bold:xp},Cp="\x1B[0m",Sp=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Dp(e){let t=e;return()=>(t=(t*1664525+1013904223)%4294967296,t/4294967296)}function Rp(e){let t=[...Sp],n=Dp(e);for(let r=t.length-1;r>0;r--){let o=Math.floor(n()*(r+1)),i=t[r];t[r]=t[o],t[o]=i}return t}function Ap(e,t=0){if(!re())return"";let n=Rp(t);return`\x1B[38;5;${n[e%n.length]}m`}function xs(e,t,n=0){if(!re())return`"${e}"`;return`${Ap(t,n)}"${e}"${Cp}`}var Ep=new RegExp("\x1B\\[[0-9;]*m","g"),Pr=(e)=>e.replace(Ep,"").length;function Ie(e){let t=(e.headers??e.rows[0]??[]).map((s,a)=>{let l=Math.max(...e.rows.map((c)=>Pr(c[a]??"")));return Math.max(Pr(s),l)}),n=(s,a)=>s+" ".repeat(Math.max(0,a-Pr(s))),r=(s,a)=>a[0]+t.map((l)=>s.repeat(l+2)).join(a[1])+a[2],o=(s)=>`│ ${s.map((a,l)=>n(a,t[l]??0)).join(" │ ")} │`,i=e.headers?[`   ${o(e.headers)}`,`   ${r("─",["├","┼","┤"])}`]:[];return[`   ${r("─",["┌","┬","┐"])}`,...i,...e.rows.map((s)=>`   ${o(s)}`),`   ${r("─",["└","┴","┘"])}`].join(`
@@ -18,7 +18,7 @@ ${qe(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o
 `)}function nn(e){return Ie({rows:e})}function Is(e){let t=[];return t.push("System Info"),t.push($p(e)),t.join(`
 `)}function $p(e){let t=["Component","Version"],n=(i)=>{if(i===null)return h.dim("not found");return i},o=[{label:"cc-safety-net",value:e.version},...Xt.map((i)=>({label:R(i),value:e.versions[i]??null})),{label:"Node.js",value:e.nodeVersion},{label:"npm",value:e.npmVersion},{label:"Bun",value:e.bunVersion},{label:"Platform",value:e.platform}].map((i)=>[i.label,n(i.value)]);return Ie({headers:t,rows:o})}function _s(e){if(e.findings.length===0)return h.green(`
 No findings from inspected doctor facts.`);let t={error:e.findings.filter((i)=>i.severity==="error").length,warning:e.findings.filter((i)=>i.severity==="warning").length,info:e.findings.filter((i)=>i.severity==="info").length},n=["error","warning","info"].filter((i)=>t[i]>0).map((i)=>`${t[i]} ${i}`),r=e.findings.length===1?"finding":"findings",o=`
-${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return h.red(o);if(t.warning>0)return h.yellow(o);return h.blue(o)}import{lstatSync as Np}from"node:fs";import{dirname as Tr}from"node:path";function Ir(e,t){try{let n=Np(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function Os(e){let t=pe();return{directories:[Ir("policy",Tr(Tr(e))),Ir("config",Tr(e)),...t?[Ir("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Fp}from"node:child_process";import{existsSync as $s}from"node:fs";import{delimiter as Hp,extname as Mp,join as jp}from"node:path";import{stripVTControlCharacters as Ns}from"node:util";var Hs="2.2.0",Up=5000,Gp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function T(){return Hs}function _r(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function Bp(e){return(_r(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function qp(e,t){let n=Mp(e)?[e]:[...Bp(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>$s(r))??e;return(_r(t,"PATH")??"").split(Hp).flatMap((r)=>n.map((o)=>jp(r,o))).find((r)=>$s(r))??e}function Fs(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function _e(e,t){let[n,...r]=e,o=t[Gp]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=qp(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:_r(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Fs(i),...r.map(Fs)].join(" ")]}}var ot=async(e,t=Up)=>{let n=await Vp(e,{timeoutMs:t});if(n.code!==0)return null;return Ns(n.stdout).trim()||Ns(n.stderr).trim()||null};function Vp(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=_e([n,...r],process.env),s=Fp(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(g)=>{l+=g.toString()}),s.stderr.on("data",(g)=>{c+=g.toString()});let d=(g)=>{if(a)return;a=!0,clearTimeout(p),o(g)},p=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(g)=>{d({code:g,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function rn(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
+${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return h.red(o);if(t.warning>0)return h.yellow(o);return h.blue(o)}import{lstatSync as Np}from"node:fs";import{dirname as Tr}from"node:path";function Ir(e,t){try{let n=Np(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function Os(e){let t=pe();return{directories:[Ir("policy",Tr(Tr(e))),Ir("config",Tr(e)),...t?[Ir("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Fp}from"node:child_process";import{existsSync as $s}from"node:fs";import{delimiter as Hp,extname as Mp,join as jp}from"node:path";import{stripVTControlCharacters as Ns}from"node:util";var Hs="2.2.2",Up=5000,Gp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function T(){return Hs}function _r(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function Bp(e){return(_r(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function qp(e,t){let n=Mp(e)?[e]:[...Bp(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>$s(r))??e;return(_r(t,"PATH")??"").split(Hp).flatMap((r)=>n.map((o)=>jp(r,o))).find((r)=>$s(r))??e}function Fs(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function _e(e,t){let[n,...r]=e,o=t[Gp]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=qp(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:_r(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Fs(i),...r.map(Fs)].join(" ")]}}var ot=async(e,t=Up)=>{let n=await Vp(e,{timeoutMs:t});if(n.code!==0)return null;return Ns(n.stdout).trim()||Ns(n.stderr).trim()||null};function Vp(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=_e([n,...r],process.env),s=Fp(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(g)=>{l+=g.toString()}),s.stderr.on("data",(g)=>{c+=g.toString()});let d=(g)=>{if(a)return;a=!0,clearTimeout(p),o(g)},p=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(g)=>{d({code:g,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function rn(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
 `)[0]?.trim()||null}async function At(e=ot){let[t,n,r,o,i,s]=await Promise.all([Promise.all(z.map(async(a)=>[a.id,rn(await e([...a.probeCommand]))])),e(["codex","plugin","list"],30000),e(["amp","plugins","list"],30000),e(["node","--version"]),e(["npm","--version"]),e(["bun","--version"])]);return{version:Hs,versions:Object.fromEntries(t),codexPluginListOutput:n,ampPluginListOutput:r,nodeVersion:rn(o),npmVersion:rn(i),bunVersion:rn(s),platform:`${process.platform} ${process.arch}`}}function Or(e,t){if(t==="dev")return!1;let n=e.split(".").map(Number),r=t.split(".").map(Number),[o=0,i=0,s=0]=n,[a=0,l=0,c=0]=r;if(o!==a)return o>a;if(i!==l)return i>l;return s>c}async function be(){let e=T(),t=new AbortController,n=setTimeout(()=>t.abort(),3000);try{let r=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!r.ok)return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${r.status}`};let o=await r.json(),i=Or(o.version,e);return{currentVersion:e,latestVersion:o.version,updateAvailable:i}}catch(r){return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:r instanceof Error?r.message:"Network error"}}finally{clearTimeout(n)}}import*as zs from"node:readline";var Gs=(e)=>`\x1B[${e}B`,zp=(e)=>`\x1B[${e}A`;var Ms=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function Kp(e){return new Promise((t)=>setTimeout(t,e))}function Wp(e,t,n){if(!n)return t(e);if(n.aborted)return Promise.resolve();return new Promise((r,o)=>{let i=()=>n.removeEventListener("abort",s),s=()=>{i(),r()};n.addEventListener("abort",s,{once:!0}),t(e).then(()=>{i(),r()},(a)=>{i(),o(a)})})}function Et(e,t){return e&&e>0?e:t}function on(e){return Math.max(0,Math.min(1,e))}function it(e){return Math.max(0,Math.min(255,Math.round(e)))}function $r(e){return e<=0.0031308?12.92*e:1.055*e**0.4166666666666667-0.055}function Jp(e,t,n){let r=n*Math.PI/180,o=t*Math.cos(r),i=t*Math.sin(r),s=(e+0.3963377774*o+0.2158037573*i)**3,a=(e-0.1055613458*o-0.0638541728*i)**3,l=(e-0.0894841775*o-1.291485548*i)**3;return{blue:it($r(on(-0.0041960863*s-0.7034186147*a+1.707614701*l))*255),green:it($r(on(-1.2684380046*s+2.6097574011*a-0.3413193965*l))*255),red:it($r(on(4.0767416621*s-3.3077115913*a+0.2309699292*l))*255)}}function Nr(e,t){let n=(t*e*180/Math.PI%360+360)%360;return Jp(0.72,0.15,n)}function Bs(e,t=0.1){let n=Nr(t,e);return`\x1B[38;2;${n.red};${n.green};${n.blue}m`}function Yp(e,t){return{blue:it(e.blue+(255-e.blue)*t),green:it(e.green+(255-e.green)*t),red:it(e.red+(255-e.red)*t)}}function qs(e,t,n){let r=Math.imul(e+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(n+374761393,2654435761),o=r^r>>>15,i=Math.imul(o,739982445),s=i^i>>>12,a=Math.imul(s,695872825);return((a^a>>>15)>>>0)/4294967296}function Zp(e,t,n){let r=Math.floor(qs(e,t,n)*Ms.length);return Ms[r]??"░"}function js(e){let t=on(e);return t*t*t*(t*(t*6-15)+10)}function Xp(e){if(e.length===0)return"";let t=[],n=!1,r="";for(let o of e){let i=`${o.red};${o.green};${o.blue}`;if(o.bold!==n)t.push(o.bold?"\x1B[1m":"\x1B[22m"),n=o.bold;if(i!==r)t.push(`\x1B[38;2;${i}m`),r=i;t.push(o.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function Qp(e,t,n,r,o){return e.map((i,s)=>({...Nr(n,r+t+s/o),bold:!1,character:i}))}function e2(e,t,n,r,o,i,s,a){let l=Math.max(1,r*0.75),c=Math.min(1,n/l),d=o*js(c),p=Math.max(0,(n-l)/Math.max(1,r-l)),g=(1-js(n/r))*a*2,u=0.35*Math.max(0,1-p*2),m=c>=1,f=Math.min(e.length,Math.ceil(d+2+1));return e.slice(0,f).map((L,v)=>{let x=Nr(i,s+t+v/a+g),y=v+qs(t,v,7919)*2-1;if(y>d+2)return{...x,bold:!1,character:" "};let C=d-y,j=0.8*Math.exp(-(C*C)/12.5),ye=Math.min(0.9,j+u),zn=!m&&y>d-4;return{...Yp(x,ye),bold:ye>0.3,character:zn?Zp(t,v,n):L}})}function Us(e){return`\x1B[?2026h${e.map((t,n)=>`\x1B8${n>0?Gs(n):""}${Xp(t)}`).join("")}\x1B[?2026l`}async function Fr(e,t={}){if(!e)return;let n=t.output??process.stdout,r=t.sleep??Kp,o=Et(t.frequency,0.1),i=t.seed??0,s=Et(t.speed,40),a=Et(t.spread,3),l=Et(t.frameRate,60),c=Math.max(1,Math.floor(Et(t.duration,12))),d=e.split(`
 `).map((f)=>Array.from(f)),p=Math.max(...d.map((f)=>f.length)),g=1000*c*d.filter((f)=>f.length>0).length/s,u=p>0?Math.max(1,Math.ceil(g/(1000/l))):0,m=u>0?g/u:0;n.write(`\x1B[?25l${d.length>1?`${`
 `.repeat(d.length-1)}${zp(d.length-1)}`:""}\x1B7`);try{for(let f=1;f<=u;f+=1){if(t.signal?.aborted)break;n.write(Us(d.map((L,v)=>e2(L,v,f,u,p,o,i,a)))),await Wp(m,r,t.signal)}}finally{if(n.write(Us(d.map((f,L)=>Qp(f,L,o,i,a)))),n.write("\x1B8"),d.length>1)n.write(Gs(d.length-1));n.write(`
@@ -187,7 +187,7 @@ ${a()}`.trim())))}),i.on("close",(d)=>{if(clearTimeout(c),d!==0){r(Error(eo(e,d,
 `));return{path:n??Rf(e),alreadyInstalled:!1}}function yl(e){let t=[],n=Dn(e.homeDir),r=["opencode.json","opencode.jsonc"];for(let o of r){let i=Nf(n,o);if(Of(i))try{let s=$f(i,"utf-8"),a=q(s);if((JSON.parse(a).plugin??[]).some((p)=>p.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:i,errors:t.length>0?t:void 0}}catch(s){t.push(`Failed to parse ${o}: ${s instanceof Error?s.message:String(s)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as Ff}from"node:path";function co(e){return Ff(e,".pi","agent","settings.json")}function uo(e){if(typeof e!=="string")return!1;return e==="npm:cc-safety-net"||e.startsWith("npm:cc-safety-net@")}function Ll(e){let t=co(e.homeDir),n=oe(t);if(n.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(n.kind==="missing")return{platform:"pi",status:"n/a"};let r=b(n.value,"packages");if(!Array.isArray(r))return{platform:"pi",status:"n/a"};let o=r.find((a)=>uo(typeof a==="string"?a:b(a,"source")));if(o===void 0)return{platform:"pi",status:"n/a"};let i=b(o,"extensions");if(Array.isArray(i)&&i.some((a)=>typeof a==="string"&&a.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var Mf={amp:Js,"antigravity-cli":Ys,"claude-code":ea,codex:ta,"copilot-cli":pa,cursor:ba,"gemini-cli":wa,"grok-build":Ta,"hermes-agent":Ba,"kimi-code":Ft,openclaw:rl,opencode:yl,pi:Ll};function dt(e,t){let n={...t,cwd:e,homeDir:t?.homeDir??Hf()};return Xt.map((r)=>jf(Mf[r](n)))}function jf(e){if(e.status==="not-inspected")return{platform:e.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:e.platform,detected:e.status!=="n/a",configured:e.status==="configured",inspectionStatus:e.status!=="n/a"?"verified":e.errors&&e.errors.length>0?"failed":"not-applicable",method:e.method,configPath:e.configPath,configPaths:e.configPaths,errors:e.errors}}import{tmpdir as Uf}from"node:os";import{join as Gf}from"node:path";var Bf=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),qf=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),Vf={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function vl(){let e=Gf(Uf(),"cc-safety-net-self-test"),t=Bf.map((n)=>{let r=Yt(Qe("self-test",{command:n.command},{kind:"command",shell:"auto"},{configCwd:e,executionCwd:e},n.command),{guard:{dependencies:{loadPolicySnapshot:()=>qf,getModes:()=>Vf,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),o=n.expectBlocked?"blocked":"allowed",i=r.decision.kind==="deny"?"blocked":"allowed";return{command:n.command,description:n.description,expected:o,actual:i,passed:o===i,reason:r.decision.kind==="deny"?r.decision.reason:void 0,ruleId:r.decision.kind==="deny"?r.decision.ruleId:void 0}});return{passed:t.filter((n)=>n.passed).length,failed:t.filter((n)=>!n.passed).length,total:t.length,results:t}}function po(e){let t=_({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},e);if(le(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function bl(e={}){let t=await Tt(!e.json,()=>{let n=zf(e);return{ready:n,finish:()=>n}},()=>Pt(),{loadingMessage:"Checking system status…"});if(e.json)console.log(JSON.stringify(t,null,2));else Kf(t);return t.engineSelfTest.failed>0||t.findings.some((n)=>n.severity==="error")?1:0}async function zf(e){let t=e.cwd??process.cwd(),n=await At(),r=dt(t,{ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.versions["copilot-cli"]}),o=vs(t),i=bs(),s=B({cwd:t}),a=s.policy,l=ue(a),c=Pe(a,l.capabilities),d=tn(7),p=e.skipUpdateCheck?{currentVersion:T(),latestVersion:null,updateAvailable:!1}:await be(),g={hooks:r,engineSelfTest:vl(),userConfig:o.userConfig,projectConfig:o.projectConfig,configState:xt(s),effectiveRules:o.effectiveRules,shadowedRules:o.shadowedRules,environment:i,effectiveSafety:{selectedPreset:a.safety.level??"standard",level:l.effectiveLevel,capabilities:l.capabilities,ruleOverrides:a.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(c).filter(([,u])=>u.source==="rule_override"&&u.override==="off"&&u.inheritedEnabled&&u.changesInherited).map(([u])=>u),ruleCounts:{stored:Object.keys(a.destructiveCommandRuleOverrides).length,effective:Object.values(c).filter((u)=>u.changesInherited).length}},posture:Os(o.userConfig.path),activity:d,update:p,system:n};return{...g,findings:ks(g)}}function Kf(e){console.log(),console.log(Cs(e.hooks)),console.log(),console.log(Ss(e.engineSelfTest)),console.log(),console.log(Ds(e)),console.log(),console.log(Rs(e.environment)),console.log(),console.log(As(e)),console.log(),console.log(Es(e.findings)),console.log(),console.log(Ps(e.activity)),console.log(),console.log(Is(e.system)),console.log(),console.log(Ts(e.update)),console.log(_s(e))}import{existsSync as Wf}from"node:fs";var Jf=/^[A-Za-z0-9_@%+=:,./-]+$/,wl="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function fo(e){let t=_({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},e);if(le(t.errors))return console.error(wl),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!Wf(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let n=t.positionals.length===1?t.positionals[0]:t.positionals.map((r)=>Jf.test(r)?r:`'${r.replaceAll("'","'\\''")}'`).join(" ");if(!n)return console.error("Error: No command provided"),console.error(wl),null;return{json:t.flags.json,cwd:t.values.cwd,command:n}}function kl(e){if(e)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function xl(e,t){let r=t-18;return[`${e.dtl}${e.dh.repeat(t)}${e.dtr}`,`${e.dv}  Command Analysis${" ".repeat(r)}${e.dv}`,`${e.dbl}${e.dh.repeat(t)}${e.dbr}`]}function mo(e){return JSON.stringify(e)}function Cl(e,t=0){return`[${e.map((r,o)=>xs(r,o,t)).join(",")}]`}function An(e,t,n=70){let r=e.split(" "),o=[],i="";for(let s of r)if(i&&i.length+s.length+1>n)o.push(i),i=s;else i=i?`${i} ${s}`:s;if(i)o.push(i);return o.map((s,a)=>a===0?s:`${t}${s}`)}function Sl(e,t,n){let r=[];switch(e.type){case"parse":return null;case"env-strip":return r.push(""),r.push(`STEP ${t} ${n.h} Strip environment variables`),r.push(`  Removed: ${e.envVars.map((o)=>`${o}=<redacted>`).join(", ")}`),r.push(`  Tokens:  ${mo(e.output)}`),{lines:r,incrementStep:!0};case"leading-tokens-stripped":return r.push(""),r.push(`STEP ${t} ${n.h} Strip wrappers`),r.push(`  Removed: ${e.removed.join(", ")}`),r.push(`  Tokens:  ${mo(e.output)}`),{lines:r,incrementStep:!0};case"shell-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Detect shell wrapper`),r.push(`  Wrapper: ${e.wrapper} -c`),r.push(`  Inner:   ${e.innerCommand}`),{lines:r,incrementStep:!0};case"interpreter":{if(r.push(""),r.push(`STEP ${t} ${n.h} Detect interpreter`),r.push(`  Interpreter: ${e.interpreter}`),r.push(`  Code:        ${e.codeArg}`),e.paranoidBlocked)r.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:r,incrementStep:!0}}case"busybox":return r.push(""),r.push(`STEP ${t} ${n.h} Busybox wrapper`),r.push(`  Subcommand: ${e.subcommand}`),{lines:r,incrementStep:!0};case"transparent-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Transparent wrapper`),r.push(`  Wrapper: ${e.wrapper}`),r.push(`  Tokens:  ${mo(e.output)}`),{lines:r,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(r.push(""),r.push(`STEP ${t} ${n.h} Match rules`),r.push(`  Rule:   ${e.rule}()`),e.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}case"worktree-relaxation":return r.push(""),r.push(`STEP ${t} ${n.h} Worktree relaxation`),r.push(`  Mode:   ${S.worktree.name}`),r.push(`  Git cwd: ${e.gitCwd}`),r.push("  Result: Allowed local discard in linked worktree"),{lines:r,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(e.embeddedCommandFound)return r.push(""),r.push(`STEP ${t} ${n.h} Fallback scan`),r.push(`  Found: ${e.embeddedCommandFound}`),{lines:r,incrementStep:!0};return null}case"custom-rules-check":{if(e.rulesChecked){if(r.push(""),r.push(`STEP ${t} ${n.h} Custom rules`),e.matched)r.push("  Result: MATCHED");else r.push("  Result: No match");return{lines:r,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(e.matched)return r.push(""),r.push(`STEP ${t} ${n.h} Dangerous text check`),r.push(`  Token:  ${e.token}`),r.push("  Result: MATCHED"),{lines:r,incrementStep:!0};return null}case"strict-unparseable":return r.push(""),r.push(`STEP ${t} ${n.h} Strict mode check`),r.push(`  Command: ${e.rawCommand}`),r.push("  Result:  ✗ UNPARSEABLE"),{lines:r,incrementStep:!0};case"segment-skipped":return null;case"error":return r.push(""),r.push(`ERROR: ${e.message}`),{lines:r,incrementStep:!1};default:return e}}function go(e,t){let n=kl(t?.asciiOnly??!1),r=58,o=[],i=1;o.push(...xl(n,58)),o.push("");let s=e.trace.steps.find((u)=>u.type==="error");if(s&&s.type==="error"){o.push("ERROR"),o.push(`  ${s.message}`),o.push(""),o.push("RESULT"),o.push(`  Status: ${e.result==="blocked"?h.red("BLOCKED"):h.green("ALLOWED")}`),o.push(""),o.push("CONFIG");let u=e.configSource??"none";return o.push(`  Path: ${u}`),o.join(`
 `)}let a=e.trace.steps.find((u)=>u.type==="parse");if(a&&a.type==="parse"){o.push("INPUT"),o.push(`  ${a.input}`),o.push(""),o.push(`STEP ${i} ${n.h} Split shell commands`),i++;for(let u=0;u<a.segments.length;u++){let m=a.segments[u];if(m){let f=Math.random();o.push(`  Segment ${u+1}: ${Cl(m,f)}`)}}}let l=e.trace.segments,c=l.length>1;for(let u of l){if(c){o.push("");let v="";if(a&&a.type==="parse"){let Kn=a.segments[u.index];if(Kn)v=Kn.join(" ")}let x=54,y=v,C=` Segment ${u.index+1}: `,j=" ";if(v){if(C.length+v.length+j.length>x){let md=x-C.length-j.length;y=`${v.substring(0,md-1)}…`}}let ye=v?`${C}${y}${j}`:` Segment ${u.index+1} `,zn=v?`${C}${h.cyan(y)}${j}`:ye,Mo=58-ye.length,jo=Math.floor(Mo/2),fd=Mo-jo;o.push(`${n.sh.repeat(jo)}${zn}${n.sh.repeat(fd)}`)}if(u.steps.find((v)=>v.type==="segment-skipped")){o.push(""),o.push("  (skipped — prior segment blocked)");continue}let f=!1,L=!1;for(let v of u.steps){let x=Sl(v,i,n);if(x){if(L=!0,v.type==="recurse"){o.push("");let y=" RECURSING ",C=58-y.length-4;o.push(`  ${n.tl}${n.h}${y}${n.h.repeat(C)}`),o.push(`  ${n.v}`),f=!0;continue}for(let y of x.lines)if(f)o.push(`  ${n.v} ${y}`);else o.push(y);if(x.incrementStep)i++}}if(f)o.push(`  ${n.v}`),o.push(`  ${n.bl}${n.h.repeat(56)}`),f=!1;if(!L)o.push(""),o.push(`  ${h.green("✓")} Allowed (no matching rules)`)}if(o.push(""),o.push("RESULT"),e.result==="blocked"){if(o.push(`  Status: ${h.red("BLOCKED")}`),e.customRule){if(o.push(`  Rule: ${e.customRule.id}`),e.customRule.rulebook)o.push(`  Rulebook: ${e.customRule.rulebook.name} ${e.customRule.rulebook.version}`);if(e.customRule.source)o.push(`  Source: ${e.customRule.source}`);if(e.customRule.override)o.push(`  Override: reason ${e.customRule.override.reason}`)}if(e.reason){let u=An(e.reason,"          ");o.push(`  Reason: ${u[0]}`);for(let m=1;m<u.length;m++)o.push(u[m]??"")}}else o.push(`  Status: ${h.green("ALLOWED")}`);o.push(""),o.push("CONFIG");let d=e.configSource??"none",p=e.configValid?"":" (invalid)";o.push(`  Path: ${d}${p}`),o.push(`  Safety preset: ${e.selectedPreset??"standard"}`),o.push(`  Effective capabilities: ${e.effectiveLevel}`);let g=Object.entries(e.destructiveCommandRuleOverrides??{});if(o.push(`  Rule customizations: ${g.length}`),e.ruleActivation)o.push(`  Rule activation: ${e.ruleActivation.id} — ${e.ruleActivation.enabled?"on":"off"} via ${e.ruleActivation.source}`);return o.join(`
 `)}function ho(e){return JSON.stringify(e,null,2)}function Dl(e){return new Promise((t)=>{process.stdout.write(`${e}
-`,()=>t())})}async function Rl(e){let t=fo(e);if(!t)return 1;try{let n=et(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Dl(t.json?ho(n):go(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof yr)&&!(n instanceof Ee)&&!(n instanceof fe))throw n;if(t.json)return await Dl(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var Al="2.2.0",J="  ",Fe="cc-safety-net";function El(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function Yf(e){return Math.max(...e.map((t)=>El(t).length))}function Zf(e){return Math.max(...e.map((t)=>t.usage.length))}function Xf(e){return Math.max(...e.map((t)=>`${Fe} ${t.usage}`.length))}function Qf(e,t){let n=`${Fe} ${e.usage}`;return`${J}${n.padEnd(t+2)}${e.description}`}function he(e,t){return`${J}${e.padEnd(Math.max(40,e.length+2))}${t}`}function En(e,t=console.log){let n=[];if(n.push(`${Fe} ${e.name}`),n.push(""),n.push(`${J}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${J}${Fe} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=Zf(e.subcommands);for(let o of e.subcommands)n.push(`${J}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=Yf(e.options);for(let o of e.options){let i=El(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${J}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${J}${r}`)}t(n.join(`
+`,()=>t())})}async function Rl(e){let t=fo(e);if(!t)return 1;try{let n=et(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Dl(t.json?ho(n):go(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof yr)&&!(n instanceof Ee)&&!(n instanceof fe))throw n;if(t.json)return await Dl(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var Al="2.2.2",J="  ",Fe="cc-safety-net";function El(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function Yf(e){return Math.max(...e.map((t)=>El(t).length))}function Zf(e){return Math.max(...e.map((t)=>t.usage.length))}function Xf(e){return Math.max(...e.map((t)=>`${Fe} ${t.usage}`.length))}function Qf(e,t){let n=`${Fe} ${e.usage}`;return`${J}${n.padEnd(t+2)}${e.description}`}function he(e,t){return`${J}${e.padEnd(Math.max(40,e.length+2))}${t}`}function En(e,t=console.log){let n=[];if(n.push(`${Fe} ${e.name}`),n.push(""),n.push(`${J}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${J}${Fe} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=Zf(e.subcommands);for(let o of e.subcommands)n.push(`${J}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=Yf(e.options);for(let o of e.options){let i=El(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${J}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${J}${r}`)}t(n.join(`
 `))}function yo(){let e=Xf(Qt),t=[];t.push(`${Fe} v${Al}`),t.push(""),t.push("Blocks destructive commands and secret access."),t.push(""),t.push("COMMANDS:");for(let n of Qt)t.push(Qf(n,e));t.push(""),t.push("GLOBAL OPTIONS:"),t.push(`${J}-h, --help       Show help (use with command for command-specific help)`),t.push(`${J}-V, --version    Show version`),t.push(""),t.push("HELP:"),t.push(`${J}${Fe} help <command>     Show help for a specific command`),t.push(`${J}${Fe} <command> --help   Show help for a specific command`),t.push(""),t.push("ENVIRONMENT VARIABLES:"),t.push(he(`${S.level.name}=standard|strict|paranoid`,"Set session safety level")),t.push(he(`${S.worktree.name}=1`,"Allow local git discards in linked worktrees")),t.push(he(`${S.debug.name}=1`,"Print diagnostic messages to stderr")),t.push(he(`${S.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),t.push(he("CC_SAFETY_NET_HOME","Override rule config home directory")),t.push(""),t.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),t.push(he(`${S.strict.name}=1`,"Force safety.overrides.fail_closed on")),t.push(he(`${S.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),t.push(he(`${S.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),t.push(he(`${S.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),t.push(""),t.push("Documentation:        https://ccsafetynet.com/docs"),console.log(t.join(`
 `))}function Pl(){console.log(Al)}function jt(e,t=console.log){let n=en(e);if(!n)return!1;if(n.name.toLowerCase()!==e.toLowerCase())return!1;return En(n,t),!0}import{existsSync as Eo,readFileSync as kc}from"node:fs";import{homedir as Ym,tmpdir as Zm}from"node:os";import{join as Ro}from"node:path";import*as ke from"node:readline";function em(e){return e==="install"?"Install":"Uninstall"}function tm(e){return e==="install"?"Installing":"Uninstalling"}function nm(e){return e==="install"?"into":"from"}function _l(e){return e?.available===!0}function rm(e,t){let n=new Set(t);return e.filter((r)=>n.has(r.target)).map((r)=>r.target)}function Tl(e,t,n){if(e.length===0||e.every((r)=>!r.available))return t;return Array.from({length:e.length},(r,o)=>o+1).map((r)=>(t+r*n+e.length)%e.length).find((r)=>_l(e[r]))}function om(e,t,n){if(n.ctrl&&n.name==="c")return"interrupt";if(n.name==="escape"||t==="q")return"abort";if(e==="install"&&(t==="u"||t==="U"))return"update";if(n.name==="up"||t==="k")return"up";if(n.name==="down"||t==="j")return"down";if(n.name==="space"||t===" ")return"toggle";if(n.name==="return"||n.name==="enter")return"confirm";return null}function im(e){return{cursor:e.findIndex((t)=>t.available),selected:[]}}function sm(e,t,n){if(n==="confirm"||n==="update"||n==="abort"||n==="interrupt")return{state:e,done:n};if(n==="up")return{state:{...e,cursor:Tl(t,e.cursor,-1)}};if(n==="down")return{state:{...e,cursor:Tl(t,e.cursor,1)}};let r=t[e.cursor];if(!_l(r))return{state:e};let o=e.selected.includes(r.target)?e.selected.filter((i)=>i!==r.target):rm(t,[...e.selected,r.target]);return{state:{...e,selected:o}}}var Ol="◉",$l="◯",Nl=">",Fl=" ";function am(e,t,n,r={}){let o=r.color!==!1,i=o?h.dim:(l)=>l,s=o?h.green:(l)=>l,a=o?h.bold:(l)=>l;return["",`${em(e)} CC Safety Net ${nm(e)}:`,"",...t.map((l,c)=>{let d=n.selected.includes(l.target),p=c===n.cursor,g=d?Ol:$l,u=p?Nl:Fl,m=l.available?"":` (${l.unavailableReason??"not installed"})`,f=`${g} ${l.label}${m}`,L=!l.available?i(f):d?s(f):p?a(f):f;return`${u} ${L}`}),"",e==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":t.some((l)=>l.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${e}. q/Esc: close`].join(`
 `)}var Il=["global-hook","plugin"];function lm(e,t,n={}){let r=n.color!==!1?h.bold:(i)=>i;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((i,s)=>{let a=s===e,l=`${a?Ol:$l} ${i}`;return`${a?Nl:Fl} ${a?r(l):l}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`

package/dist/chunks/{index-t98xeq4f.js → index-j6a67cs3.js}

@@ -1,5 +1,5 @@
-import{K as F,N as O,ba as Y,ca as _,ia as m,na as U,q as C,r as w,ub as h,vb as W}from"./index-pb6n3mp5.js";import{lstatSync as N,readdirSync as J,readFileSync as x,rmdirSync as X,statSync as v,unlinkSync as q,utimesSync as ee,writeFileSync as te}from"node:fs";import{dirname as ne,join as u}from"node:path";var A=86400000,re=".last-prune",ie=/^\d{4}-\d{2}$/,oe=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,k=(e)=>Math.floor(e/A);function ae(e){try{let n=u(ne(O(e)),F),t=JSON.parse(x(n,"utf-8"));return w(t?.audit?.retention_days)}catch{return C}}function R(e,n=()=>new Date){try{let t=n().getTime();if(!v(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=u(e,re),i=v(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&k(i)===k(t))return;let o=t-ae()*A,s=new Date(t).toISOString().slice(0,7);for(let a of p(e)){if(a.isDirectory()){se(u(e,a.name),o,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))ce(u(e,a.name),o)}te(r,"",{mode:384}),ee(r,t/1000,t/1000)}catch{}}function se(e,n,t){for(let r of p(e)){if(!r.isDirectory()||!ie.test(r.name))continue;let i=u(e,r.name);for(let o of p(i)){if(!o.isFile())continue;let s=oe.exec(o.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(a)||a>=n)continue;L(u(i,o.name))}if(r.name!==t)T(i)}T(e)}function ce(e,n){try{let t=N(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
-`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.2.0",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
+import{K as F,N as O,ba as Y,ca as _,ia as m,na as U,q as C,r as w,ub as h,vb as W}from"./index-z08yh4sm.js";import{lstatSync as N,readdirSync as J,readFileSync as x,rmdirSync as X,statSync as v,unlinkSync as q,utimesSync as ee,writeFileSync as te}from"node:fs";import{dirname as ne,join as u}from"node:path";var A=86400000,re=".last-prune",ie=/^\d{4}-\d{2}$/,oe=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,k=(e)=>Math.floor(e/A);function ae(e){try{let n=u(ne(O(e)),F),t=JSON.parse(x(n,"utf-8"));return w(t?.audit?.retention_days)}catch{return C}}function R(e,n=()=>new Date){try{let t=n().getTime();if(!v(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=u(e,re),i=v(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&k(i)===k(t))return;let o=t-ae()*A,s=new Date(t).toISOString().slice(0,7);for(let a of p(e)){if(a.isDirectory()){se(u(e,a.name),o,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))ce(u(e,a.name),o)}te(r,"",{mode:384}),ee(r,t/1000,t/1000)}catch{}}function se(e,n,t){for(let r of p(e)){if(!r.isDirectory()||!ie.test(r.name))continue;let i=u(e,r.name);for(let o of p(i)){if(!o.isFile())continue;let s=oe.exec(o.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(a)||a>=n)continue;L(u(i,o.name))}if(r.name!==t)T(i)}T(e)}function ce(e,n){try{let t=N(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
+`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.2.2",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
 `,{encoding:"utf-8",mode:384}),R(c,o.now)}catch{}}function l(e,n){return{value:e.slice(0,n),truncated:e.length>n}}function Z(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let n=e||Ee()||ye().homedir;return n&&_e(n)?n:null}function ke(e=Z()){return e?E(e,".cc-safety-net","logs"):null}function B(e,n,t,r=!0,i){if(n.decision.kind==="allow"){if(!t||e.route.kind!=="command")return;let a=M(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{}}}let o=n.decision.evidence.find((a)=>a.kind==="command"),s=o?.command??(r?M(e):"");return{decision:"deny",command:s,segment:o?.segment??s,reason:n.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{},ruleId:n.decision.ruleId,intent:n.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function M(e){return"command"in e?e.command??"":""}function P(e,n,t){if(!e)return;let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command,e.segment,e.reason,e.cwd,{homeDir:t.homeDir,decision:e.decision,agent:t.agent,shape:t.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function We(e,n,t){let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command??"",e.segment??e.command??"",e.reason,t.cwd??null,{homeDir:t.homeDir,decision:"deny",agent:t.agent,shape:t.shape,toolName:t.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function K(e){let{reason:n,command:t,segment:r,toolName:i}=e,o=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
 
 Reason: ${s(n)}`;if(e.ruleId)a+=`