cc-safety-net 2.2.1 → 2.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +5 -51
- package/dist/amp/cc-safety-net/index.ts +24 -24
- package/dist/bin/cc-safety-net.js +3 -3
- package/dist/chunks/{index-64gcamd4.js → index-j6a67cs3.js} +1 -1
- package/dist/index.js +1 -1
- package/dist/openclaw/cc-safety-net/index.js +2 -2
- package/dist/openclaw/cc-safety-net/openclaw.plugin.json +1 -1
- package/dist/openclaw/cc-safety-net/package.json +1 -1
- package/dist/pi/index.js +1 -1
- package/package.json +2 -2
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
import{b as Uo,c as Go,d as G,e as Bo,f as Xn,g as tt,h as Ae,i as gr,j as pe,k as Fi,l as xr,m as Jt,n as Hi,o as Mi,p as Yt}from"../chunks/index-
|
|
2
|
+
import{b as Uo,c as Go,d as G,e as Bo,f as Xn,g as tt,h as Ae,i as gr,j as pe,k as Fi,l as xr,m as Jt,n as Hi,o as Mi,p as Yt}from"../chunks/index-j6a67cs3.js";import{$ as V,$a as ad,A as De,Aa as br,B as Je,Ba as wr,C as Gc,Ca as ki,D as ii,Da as xi,E as si,Ea as Jo,F as ai,Fa as Qe,G as yt,Ga as or,H as tr,Ha as ir,I as ur,Ia as di,J as li,Ja as Ke,Ka as nd,L as ci,La as Zo,M as Q,Ma as Xo,Na as kr,O as ee,Oa as Qo,P as Ze,Pa as ei,Q as Xe,Qa as Z,R as Lt,Ra as sr,S as _c,Sa as fr,T as te,Ta as mr,U as Y,Ua as X,V as pr,Va as rd,W as nr,Wa as kt,X as Wt,Xa as od,Y as rr,Ya as No,Za as id,_ as me,_a as sd,aa as Zi,ab as Tn,bb as ld,ca as Ee,cb as cd,da as Zt,db as Ci,ea as St,eb as Si,fa as vt,fb as Di,ga as Pe,gb as Ri,ha as hr,hb as Fc,ia as fe,ib as ui,ja as ji,jb as pi,ka as Cr,kb as ar,la as Bi,lb as fi,ma as qi,mb as mi,na as yr,nb as ve,oa as Li,ob as Re,pa as Ko,pb as de,qa as vi,qb as gi,ra as bi,rb as B,s as Ct,sa as wi,sb as xt,t as yi,ta as Lr,tb as bt,u as H,ua as Wo,ub as Gi,v as k,va as S,w as gt,wa as vr,x as w,xa as Ui,y as Se,ya as ue,z as oi,za as wt}from"../chunks/index-z08yh4sm.js";var gd=["-h","--help"];function _(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.fromEntries(n.map(([d])=>[d,!1])),i={},s=[],a=[],l=!1,c=-1;for(let[d,p]of t.entries()){if(d<=c)continue;if(p==="--"){s.push(...t.slice(d+1));break}if(gd.includes(p)){l=!0;continue}let g=n.find(([,m])=>m.includes(p));if(g){o[g[0]]=!0;continue}let u=r.find(([,m])=>m.includes(p));if(u){let m=t[d+1];if(m===void 0||m.startsWith("-")){a.push(`${p} requires a value`);continue}i[u[0]]=m,c=d+1;continue}if(p.startsWith("-")){a.push(`Unknown option for ${e.label}: ${p}`);continue}if(e.positionals==="tail"){s.push(...t.slice(d));break}s.push(p)}if(e.positionals!=="list"&&e.positionals!=="tail")a.push(...s.map((d)=>`Unexpected argument for ${e.label}: ${d}`));return{flags:o,values:i,positionals:s,help:l,errors:a}}function le(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as tu,statSync as Ei,unlinkSync as nu}from"node:fs";import{basename as Pi,dirname as ru,join as ou,resolve as iu}from"node:path";function O(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var Wn=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},qe=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as hd,readdirSync as yd,readFileSync as Ld}from"node:fs";import{join as vd}from"node:path";function Le(e,t){try{return yd(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=vd(e,n.name);if(n.isDirectory())return Le(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&hd(e))t.count++;return[]}}function Jn(e){let t=(o)=>`${o.sessionId}
|
|
3
3
|
${qe(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o)=>o.sessionId).reduce((o,i)=>o.set(t(i),(o.get(t(i))??0)+1),new Map);return new Set(n.filter((o)=>o.failureStage||(r.get(t(o))??0)>=2))}var bd=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function wd(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(typeof t.ts!=="string"||typeof t.command!=="string")return!1;return bd.every((n)=>t[n]===void 0||typeof t[n]==="string")}function Ce(e,t){try{return Ld(e,"utf-8").split(`
|
|
4
4
|
`).filter(Boolean).flatMap((n)=>{try{let r=JSON.parse(n);if(!wd(r)){if(t)t.count++;return[]}return[r]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as Kd}from"node:path";var kd=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function qo(e){let t=0,n={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(r){e.record({kind:"step",scope:"global",step:r})},recordSegment(r,o=n.currentSegmentIndex){if(o===void 0)return;e.record({kind:"step",scope:"segment",segmentIndex:o,step:r})}};return n}function Vo(e={}){let t=[],n=e.maxEvents??512,r={maxTextLength:e.maxTextLength??2048,maxListLength:e.maxListLength??128,maxObjectProperties:e.maxObjectProperties??e.maxListLength??128,maxDepth:e.maxDepth??16},o=0,i,s=new Set;return{record(a){if(i)return;try{if(!a||t.length>=n){o++;return}t.push(Zn(xd(a,r,s)))}catch{o++}},finish(a){if(i)return i;try{i=Zn({events:Object.freeze(t),droppedEvents:o,terminal:Cd(a,r,s)})}catch{o++,i=Object.freeze({events:Object.freeze(t),droppedEvents:o,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,r.maxTextLength),segment:"trace unavailable".slice(0,r.maxTextLength)})})}return i}}}function xd(e,t,n){if(e.kind!=="step")throw TypeError("invalid trace event");let{scope:r,step:o}=e;zt(o,n,t);let i=Ve(o,t,n);if(r==="global")return{kind:"step",scope:"global",step:i};if(r!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:e.segmentIndex,step:i}}function Cd(e,t,n){let r=e.result;if(r==="allowed")return Object.freeze({result:"allowed"});if(r!=="blocked")throw TypeError("invalid trace terminal");let o=e.ruleId;return Object.freeze({result:"blocked",reason:Ve(e.reason,t,n),segment:Ve(e.segment,t,n),...o?{ruleId:Ve(o,t,n)}:{}})}function zt(e,t,n,r=0,o=new WeakSet){if(typeof e==="string"){let a=e.slice(0,n.maxTextLength);if(!Xn(a))return;for(let l of Bo(a))for(let c of l.match(/[^\s"'()$]+/g)??[])t.add(zo(c));return}if(!e||typeof e!=="object"||r>=n.maxDepth||o.has(e))return;if(o.add(e),Array.isArray(e)){let a=Math.min(e.length,n.maxListLength);for(let l=0;l<a;l++)zt(e[l],t,n,r+1,o);return}let i=0,s=new Set;for(let a in e){if(!Object.hasOwn(e,a))continue;if(i>=n.maxObjectProperties)break;i++,zt(a,t,n);let l=Yn(a,n,t);if(s.has(l))continue;s.add(l),zt(e[a],t,n,r+1,o)}}function Ve(e,t,n,r=0,o=new WeakSet){if(typeof e==="string")return Yn(e,t,n);if(!e||typeof e!=="object")return e;if(r>=t.maxDepth)return;if(o.has(e))return;if(o.add(e),Array.isArray(e)){let a=[],l=Math.min(e.length,t.maxListLength);for(let c=0;c<l;c++)a.push(Ve(e[c],t,n,r+1,o));return a}let i={},s=0;for(let a in e){if(!Object.hasOwn(e,a))continue;if(s>=t.maxObjectProperties)break;s++;let l=Yn(a,t,n);if(Object.hasOwn(i,l))continue;Object.defineProperty(i,l,{value:Ve(e[a],t,n,r+1,o),enumerable:!0,configurable:!0,writable:!0})}return i}function Yn(e,t,n){let r=e.slice(0,t.maxTextLength),o=Xn(r)?Go(r):r,i=n.size>0?Dd(o,n):o;return(Sd(i)?Uo(i):i).slice(0,t.maxTextLength)}function Sd(e){return e.includes("PRIVATE KEY")||e.includes("://")||e.includes("eyJ")||e.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(e)||e.length>=14&&kd.some((t)=>e.includes(t))||e.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(e)}function Dd(e,t){return e.replace(/[^\s"'()$]+/g,(n)=>t.has(zo(n))?"<redacted>":n)}function zo(e){let t=2166136261,n=2166136261;for(let r=0;r<e.length;r++)t=Math.imul(t^e.charCodeAt(r),16777619),n=Math.imul(n^e.charCodeAt(e.length-r-1),16777619);return`${t>>>0}:${n>>>0}:${e.length}`}function Zn(e){if(e&&typeof e==="object"&&!Object.isFrozen(e)){for(let t of Object.values(e))Zn(t);Object.freeze(e)}return e}function Yo(e,t,n){let r=n??Ko(),o=r.getCommandProgram(e,t.shell??"auto"),i=Vo(),s=qo(i),a=o.dialect==="powershell"?r.getCommandProgram(e,"posix"):o,l=Wo(a);s.recordGlobal({type:"parse",input:e,segments:l.map((p)=>[...p])});let c=Jo(e,{...t,analyzePartialProgram:!0,trace:s},o,r),d=s.getNextSegmentIndex();if(c&&d>0&&d<l.length)s.recordSegment({type:"segment-skipped",index:d,reason:"prior-segment-blocked"},d);return Object.freeze({decision:c,trace:i.finish(c?{result:"blocked",reason:c.reason,segment:c.evidence.find((p)=>p.kind==="command")?.segment??e,...c.ruleId?{ruleId:c.ruleId}:{}}:{result:"allowed"}),program:o})}import{resolve as Rd}from"node:path";function Qn(e){let t=Zo().safeParse(e);return{errors:t.success?[]:Qo(t.error.issues),ruleNames:new Set(Xo(e).map((n)=>n.toLowerCase()))}}function er(e){let t=ti(e);if(!t.ok)return t.result;return Qn(t.parsed)}function ti(e){let t=[],n=new Set;try{let r=typeof e==="string"?gt(e):e,o=w(r);if(o===null)return t.push(`File not found: ${r.path}`),{ok:!1,result:{errors:t,ruleNames:n}};if(!o.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:n}};return{ok:!0,parsed:JSON.parse(o)}}catch(r){if(r instanceof H)return t.push(r.message),{ok:!1,result:{errors:t,ruleNames:n}};let o=r instanceof Error?r.message:String(r);return t.push(r instanceof SyntaxError?"Invalid JSON":o),{ok:!1,result:{errors:t,ruleNames:n}}}}function ni(e){return Rd(e??process.cwd(),".safety-net.json")}function ce(e){let t=ti(e);if(!t.ok)return t.result;let n=ei(t.parsed);return{errors:n.errors,ruleNames:n.sources}}import{isAbsolute as Ad,join as ht,relative as Ed,resolve as ri,sep as Pd}from"node:path";async function Ye(e={}){let t=cr(e);return Td(t,await Kt(t,Ke()))}function Td(e,t){if(!t.ok)return t;let n=Y(e),r=[...new Set(de(n.configPath,n.lockPath,e,n.filesystemScope))];if(r.length===0)return t;return{ok:!1,errors:r,warnings:t.warnings,entries:t.entries}}async function Kt(e,t,n,r={}){let o=null,i=!1;try{let s=Y(e),a=sr(s.configTarget);if(!a.ok)return a.result;let l=a.config;if(e.check)return Fd(l,s,e);o={target:s.lockTarget,content:w(s.lockTarget)};let c=ar(s.lockTarget);if(c.errors.some((L)=>L.startsWith("Unable to access ")))return{ok:!1,errors:c.errors,warnings:[],entries:[]};if(e.only&&c.errors.length>0)return{ok:!1,errors:c.errors,warnings:[],entries:[]};let d=c.errors.length>0?null:c.lock,p=e.only?ui(l,d,e.only):{ok:!0,specs:l.rules};if(!p.ok)return p.result;if(e.only&&!d&&p.specs.length<l.rules.length)return{ok:!1,errors:[`No lockfile available for partial update; run ${ci}`],warnings:[],entries:[]};let g=(await _d(p.specs,(L)=>fi(L,s.configDir,e,d,s.filesystemScope,t),t)).map((L)=>Hd(L,d,n));for(let L of g)Ud(L.content,L.entry,s.configDir,e,s.filesystemScope);let u=e.only?Md(l,d,g):g.map((L)=>L.entry);i=!0,X(s.lockTarget,{version:1,rulebooks:u},void 0,r._testAfterPolicyRename);let m=new Map(g.map((L)=>[L.entry.spec,L.rulebook.rules.length])),f=Gd(u,s.configDir,e,s.filesystemScope,r);return{ok:!0,errors:[],warnings:f,entries:u.map((L)=>jd(L,m))}}catch(s){if(i&&o)try{ze(o.target,o.content)}catch(a){return We(a)}return We(s)}}async function lr(e,t={}){return Id(e,cr(t),Ke())}async function Id(e,t,n,r={}){let o=null,i=!1;try{let s=Y(t),a=w(s.configTarget);o={target:s.configTarget,content:a};let l=sr(s.configTarget);if(!l.ok)return l.result;let c=l.config,d=li(e)?await mi(e,n):[{spec:e}],p=d.map((m)=>m.spec),g=[...new Set([...c.rules,...p])];if(g.length>or)return Od();if(g.length!==c.rules.length)i=!0,X(s.configTarget,{version:1,rules:g,overrides:c.overrides??{},transparent_wrappers:c.transparent_wrappers??[]},void 0,r._testAfterPolicyRename);let u=await Kt(t,n,new Map(d.filter((m)=>!!m.display_ref).map((m)=>[m.spec,m.display_ref])),r);if(!u.ok)ze(s.configTarget,a);return u}catch(s){if(i&&o)try{ze(o.target,o.content)}catch(a){return We(a)}return We(s)}}async function _d(e,t,n=Ke()){if(e.length>or)throw Error(ir);let r=Array(e.length),o=0,i,s=Array.from({length:Math.min(e.length,di.concurrency)},async()=>{while(!i){let a=o;if(a>=e.length)return;o++;try{r[a]=await t(e[a],a,n.controller.signal)}catch(l){if(!i)i={value:l},o=e.length,n.controller.abort(l);return}}});if(await Promise.all(s),i)throw i.value;return r}function Od(){return{ok:!1,errors:[ir],warnings:[],entries:[]}}function cr(e){return{cwd:e.cwd,cacheConfigDir:e.cacheConfigDir,userConfigDir:e.userConfigDir,userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,global:e.global,check:e.check,only:e.only,refresh:e.refresh}}function $d(e){return{...cr(e),deleteSource:e.deleteSource}}async function dr(e,t={}){try{return await Nd(e,$d(t),{})}catch(n){return We(n)}}async function Nd(e,t,n){let r=Y(t),o=Z(r.configTarget);if(o.errors.length>0)return{ok:!1,errors:o.errors,warnings:[],entries:[]};if(!o.config)return{ok:!1,errors:[`No config found at ${r.configPath}`],warnings:[],entries:[]};let i=ar(r.lockTarget);if(i.errors.length>0)return{ok:!1,errors:i.errors,warnings:[],entries:[]};let s=pi(o.config.rules,i.lock,e);if(!s.ok)return s.result;let a=t.deleteSource?Bd(r.configDir,s.specs,i.lock,r.filesystemScope):{ok:!0,dirs:[]};if(!a.ok)return a.result;let l=w(r.configTarget);if(l===null)return We(Error("Rules config is unavailable."));try{X(r.configTarget,{version:1,rules:o.config.rules.filter((p)=>!s.specs.includes(p)),overrides:o.config.overrides??{},transparent_wrappers:o.config.transparent_wrappers??[]},void 0,n._testAfterPolicyRename)}catch(p){throw ze(r.configTarget,l),p}let c=await Kt(t,Ke(),void 0,n);if(!c.ok)return ze(r.configTarget,l),c;let d=qd(r.configDir,a.dirs,n,r.filesystemScope);if(!d.ok){ze(r.configTarget,l);let p=await Kt(t,Ke(),void 0,n);if(!p.ok)return{ok:!1,errors:[...d.result.errors,...p.errors],warnings:p.warnings,entries:p.entries};return d.result}return c}async function Fd(e,t,n){let r=gi(e,t.lockPath,t.configDir,n,n.global?"user":"project",t.filesystemScope);return{ok:r.errors.length===0&&r.warnings.length===0,errors:[...r.errors,...r.warnings],warnings:[],entries:r.entries}}function Hd(e,t,n){let r=t?.rulebooks.find((i)=>i.spec===e.entry.spec&&i.kind==="github"),o=n?.get(e.entry.spec)??(r?.kind==="github"?r.display_ref:void 0);if(!o||e.entry.kind!=="github")return e;return{...e,entry:{...e.entry,display_ref:o}}}function Md(e,t,n){let r=new Set(e.rules),o=new Set(t?.rulebooks.map((s)=>s.spec)??[]),i=new Map(n.map((s)=>[s.entry.spec,s.entry]));return[...(t?.rulebooks.filter((s)=>r.has(s.spec))??[]).map((s)=>i.get(s.spec)??s),...n.filter((s)=>!o.has(s.entry.spec)).map((s)=>s.entry)]}function jd(e,t){return{...e,ruleCount:t.get(e.spec)}}function Ud(e,t,n,r,o){let i=nr(t,rr(n,r));Se(k(o,i),e)}function Gd(e,t,n,r,o){let i=rr(t,n),s=Wt(i),a=k(r,s),l=De(a);if(!l)return[];let c=e.map((p)=>k(r,nr(p,i))),d=l.filter((p)=>p.kind==="directory").map((p)=>({directory:k(r,ht(s,p.name)),identity:k(r,ht(s,p.name,tr))})).filter((p)=>!c.some((g)=>oi(p.identity,g))).map((p)=>p.directory);for(let p of d)ai(p);return d.flatMap((p)=>{try{return Vd(p,o),[]}catch{return["Unable to prune rules policy cache safely."]}})}function Bd(e,t,n,r){let o=new Map(n?.rulebooks.map((c)=>[c.spec,c])??[]),i=t.flatMap((c)=>{let d=o.get(c);if(!d)return yt.test(c)?[]:["--delete-source can only delete local rulebook sources"];return d.kind==="local-directory"?[]:["--delete-source can only delete local rulebook sources"]}),s=t.map((c)=>{let d=o.get(c);return ht(e,d?.kind==="local-directory"?d.path:c)}),a=i.length>0?[]:s.flatMap((c)=>hi(e,c,r)),l=[...i,...a];return l.length>0?{ok:!1,result:{ok:!1,errors:l,warnings:[],entries:[]}}:{ok:!0,dirs:s}}function hi(e,t,n){let r=ri(e),o=ri(t),i=Ed(r,o);if(i===""||i===".."||i.startsWith(`..${Pd}`)||Ad(i))return[`Refusing to delete local rulebook source outside ${e}: ${t}`];let s=k(n,o),a=De(s);if(!a)return[`Local rulebook source directory not found: ${t}`];let l=a.find((c)=>c.name==="rulebook.json");if(!l)return[`Local rulebook source directory is missing rulebook.json: ${t}`];if(l.kind!=="file")throw new H(n.label);if(w(k(n,ht(o,"rulebook.json"))),a.length>1)return[`Local rulebook source directory contains extra files: ${t}. delete manually if you really want to remove the directory.`];return[]}function qd(e,t,n,r){let o=t.flatMap((i)=>{try{if(!De(k(r,i)))return[];let s=hi(e,i,r);if(s.length>0)return s;return zd(i,n,r),[]}catch(s){return[`Failed to delete local rulebook source ${i}: ${s instanceof Error?s.message:String(s)}`]}});return o.length>0?{ok:!1,result:{ok:!1,errors:o,warnings:[],entries:[]}}:{ok:!0}}function Vd(e,t){if(t._testPruneRulebookCacheDir){t._testPruneRulebookCacheDir(e.path);return}ii(e)}function zd(e,t,n){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(e);return}Je(k(n,ht(e,tr))),si(k(n,e))}function ze(e,t){if(t===null){Je(e);return}Se(e,t)}function We(e){return{ok:!1,errors:[e instanceof Error?e.message:String(e)],warnings:[],entries:[]}}function et(e,t){let n=Jd(t),r=ki(n),o={effectiveLevel:r.effectiveLevel,selectedPreset:n.policySnapshot.policy.safety.level??"standard",effectiveCapabilities:r.effectiveCapabilities,destructiveCommandRuleOverrides:n.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:i,configValid:s}=Wd({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!e||!e.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:i,configValid:s,...o};let a=Yd(e,n);if(a)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:a.rule,matched:!0,reason:a.reason}]}]},result:"blocked",reason:G(a.reason),segment:G(a.target),...a.ruleId?{ruleId:G(a.ruleId)}:{},configSource:i,configValid:s,...o};let l=Yo(e,n),c=l.decision,d=c?.ruleId??Zd(e,n),p=vt.find((u)=>u.id===d&&u.activationCapability),g=p?r.policy.effectiveDestructiveCommandRules[p.id]:void 0;return{trace:Qd(l.trace),result:c?"blocked":"allowed",reason:c?G(c.reason):void 0,segment:c?G(c.evidence.find((u)=>u.kind==="command")?.segment??e):void 0,ruleId:c?.ruleId?G(c.ruleId):void 0,customRule:Xd(eu(c?.ruleId,n.policySnapshot)),configSource:i,configValid:s,...o,...p&&g?{ruleActivation:{id:p.id,...g}}:{}}}function Wd(e){let t=Q(e?.cwd),n=e?.userConfigPath??ee(e),r=te({cwd:e?.cwd,userConfigDir:e?.userConfigDir,userConfigPath:e?.userConfigPath});try{if(w(r.projectConfigTarget)!==null){if(ce(r.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(o){if(o instanceof H)return{configSource:t,configValid:!1};throw o}try{if(w(r.userConfigTarget)!==null){let o=ce(r.userConfigTarget);return{configSource:n,configValid:o.errors.length===0}}return{configSource:null,configValid:!0}}catch(o){if(o instanceof H)return{configSource:n,configValid:!1};throw o}}function Jd(e){let t=Kd(e?.cwd??process.cwd()),n=e?.policySnapshot??B({cwd:t,userConfigDir:e?.userConfigDir}),r=ue(n.policy);return{cwd:t,effectiveCwd:t,policySnapshot:n,environment:yi(),protectedGitMetadata:wi([t]),effectiveCapabilities:r.capabilities,strict:e?.strict??r.strict,paranoidRm:r.paranoidRm,paranoidInterpreters:r.paranoidInterpreters,worktreeMode:r.worktreeMode}}function Yd(e,t){let n=t.cwd??process.cwd(),r=Li(Qe("",{command:e},{kind:"command",shell:"posix"},{executionCwd:n,configCwd:n},e)),o=Si(r);if(o)return{reason:Ci,target:o.target,ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};let i=bi(r,t.protectedGitMetadata);if(i)return{reason:vi,target:i.target,ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};let s=t.policySnapshot.policy,a=s.secretProtection.enabled===!1?null:Ri(r,s.secretProtection,{strict:t.strict});if(a)return{reason:Di,target:a.target,ruleId:a.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"};return null}function Zd(e,t){let n=t.policySnapshot.policy,r=bt({...n,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...n.destructiveCommandRuleOverrides,...Object.fromEntries(vt.flatMap((o)=>o.activationCapability?[[o.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return xi(e,{...t,policySnapshot:r,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function Xd(e){if(!e)return;return{id:G(e.id),...e.rulebook?{rulebook:{name:G(e.rulebook.name),version:G(e.rulebook.version)}}:{},...e.source?{source:G(e.source)}:{},...e.override?{override:{type:"reason",reason:G(e.override.reason)}}:{}}}function Qd(e){let t=e.events.flatMap((r)=>r.kind==="step"&&r.scope==="global"?[r.step]:[]),n=new Map;for(let r of e.events){if(r.kind!=="step"||r.scope!=="segment")continue;let o=n.get(r.segmentIndex)??{index:r.segmentIndex,steps:[]};o.steps.push(r.step),n.set(r.segmentIndex,o)}return{steps:t,segments:[...n.values()]}}function eu(e,t){let n=e?.replace(/^custom\./,"");if(!n||!t.policy.rules.some((r)=>r.name===n))return;return t.ruleMetadata[n]??Object.freeze({id:n})}function su(e){let t=tt(),n=_({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},e);if(le(n.errors))return null;if(n.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(n.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let r=n.values.limit===void 0?20:Ai(n.values.limit);if(r===null)return console.error("--limit must be a positive number"),null;let o=n.values.since===void 0?Math.min(30,t):Ai(n.values.since);if(o===null||o>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let i={limit:r,limitExplicit:n.values.limit!==void 0,since:o,sinceExplicit:n.values.since!==void 0,all:n.flags.all,json:n.flags.json,suspect:n.flags.suspect,pruneLegacy:n.flags.pruneLegacy,dryRun:n.flags.dryRun,id:n.values.id,agent:n.values.agent,rule:n.values.rule,session:n.values.session,project:n.values.project===void 0?void 0:iu(n.values.project)};if(i.id&&(i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.sinceExplicit||i.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(i.pruneLegacy&&(i.id!==void 0||i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.all||i.sinceExplicit||i.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(i.dryRun&&!i.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return i}async function Ti(e,t={}){let n=su(e);if(!n)return 1;let r=t.logsDir??pe();if(n.pruneLegacy)return au(r,n.json,n.dryRun);if(!r)return console.log(n.json?"[]":n.id?`No retained audit log entry found for id ${O(n.id)}.`:"No audit log entries found."),0;Ae(r);let o={count:0},i=Le(r,o).flatMap((d)=>Ce(d,o).map((p)=>({entry:p,file:d})));if(o.count>0)console.error(`warning: ${o.count} audit log ${o.count===1?"source":"sources"} could not be read; these results are incomplete`);if(n.id)return uu(i,n,t.timeZone);let s=Date.now()-n.since*24*60*60*1000,a=i.filter((d)=>pu(d,n,r,s)),l=n.suspect?Jn(a.map((d)=>d.entry)):null,c=(l?a.filter((d)=>l.has(d.entry)):a).sort((d,p)=>Date.parse(p.entry.ts)-Date.parse(d.entry.ts)).slice(0,n.limit);if(n.json)return console.log(JSON.stringify(c.map((d)=>d.entry),null,2)),0;if(c.length===0)return console.log("No audit log entries found."),0;for(let d of c)console.log(gu(d.entry,t.timeZone));return 0}function au(e,t,n){let r=e?cu(e).map((a)=>ou(e,a)):[];if(n)return lu(r,t);let o=[],i=0,s=0;for(let a of r){let l=Ei(a,{throwIfNoEntry:!1})?.size??0,c=du(a);if(c){o.push(`${Pi(a)}: ${c}`);continue}i++,s+=l}if(t)return console.log(JSON.stringify({removedFiles:i,removedBytes:s,failedFiles:o.length})),o.length===0?0:1;console.log(i===0&&o.length===0?"No legacy audit log files found.":`Removed ${i} legacy audit log ${i===1?"file":"files"} (${Ii(s)}).`);for(let a of o)console.error(`Could not remove ${O(a)}`);if(console.log("Nested v2 audit logs were not changed."),i>0)console.log("This deletion cannot be undone.");return o.length===0?0:1}function lu(e,t){let n=e.reduce((r,o)=>r+(Ei(o,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:e.length,bytes:n})),0;if(console.log(e.length===0?"No legacy audit log files found.":`Would remove ${e.length} legacy audit log ${e.length===1?"file":"files"} (${Ii(n)}).`),console.log("Nested v2 audit logs are not included."),e.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function cu(e){try{return tu(e,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function du(e){try{return nu(e),null}catch(t){return t instanceof Error?t.message:String(t)}}function Ii(e){let t=["B","KiB","MiB","GiB"],n=Math.min(Math.floor(Math.log2(Math.max(e,1))/10),t.length-1);return`${Math.round(e/1024**n*10)/10} ${t[n]}`}function uu(e,t,n){let r=e.filter((i)=>i.entry.id===t.id);if(r.length>1)return console.error(`Multiple audit log entries found for id ${O(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(r.map((i)=>i.entry),null,2)),0;let o=r[0];if(!o)return console.log(`No retained audit log entry found for id ${O(t.id??"")}.`),0;return console.log(hu(o.entry,n)),0}function pu(e,t,n,r){if(!t.all&&e.entry.decision==="allow")return!1;if(Date.parse(e.entry.ts)<r)return!1;if(t.agent!==void 0&&e.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&e.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!fu(e,n,t.session))return!1;if(t.project!==void 0&&!mu(e.entry.cwd,t.project))return!1;return!0}function fu(e,t,n){if(e.entry.sessionId===n)return!0;return ru(e.file)===t&&Pi(e.file,".jsonl")===n}function mu(e,t){if(!e)return!1;return e===t||e.startsWith(`${t}/`)}function gu(e,t){let n=O(e.id??"-"),r=O(e.decision??"deny"),o=e.cwd?` [${O(e.cwd)}]`:"",i=e.segment||e.command,s=i===e.command?"":"↳ ",a=i.length>50?`${i.slice(0,50)}…`:i;return`${n.padEnd(16)} ${O(_i(e.ts,t))} ${r.padEnd(5)} ${O(e.agent??"-").padEnd(15)} ${O(e.ruleId??"-").padEnd(20)} ${s}${O(a)}${o}`}function hu(e,t){let n=(o)=>O(o===void 0||o===null||o===""?"-":o),r=e.shape?`${e.agent??"-"} (shape: ${e.shape})`:e.agent??"-";return[`id: ${n(e.id)}`,`ts: ${n(_i(e.ts,t))}`,`decision: ${n(e.decision)}`,`agent: ${n(r)}`,`level: ${n(e.level)}`,`tool: ${n(e.toolName)}`,`rule: ${n(e.ruleId)}`,`intent: ${n(e.intent)}`,`stage: ${n(e.failureStage)}`,`error: ${n(e.errorCode)}`,`session: ${n(e.sessionId)}`,`cwd: ${n(e.cwd)}`,`version: ${n(e.v)}`,`truncated: ${n(e.truncated===!0?"yes":void 0)}`,`reason: ${n(e.reason)}`,`command: ${n(e.command)}`,`segment: ${n(e.segment)}`].join(`
|
|
5
5
|
`)}function _i(e,t){let n=new Date(e);if(Number.isNaN(n.getTime()))return e;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:t}).format(n)}function Ai(e){let t=Number(e);return Number.isFinite(t)&&t>0?t:null}var Oi={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var $i={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var Ni={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};import{isAbsolute as Vi,join as Ru,relative as Au}from"node:path";var yu=8388608;function Lu(e,t){console.log(JSON.stringify(e(Hi(t))))}async function vu(e){let t;try{t=(await Sr(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return Dr(t,e,"Failed to parse hook input JSON.")}async function Sr(e){let t=[],n=0;for await(let r of e){let o=typeof r==="string"?Buffer.from(r,"utf-8"):Buffer.from(r.buffer,r.byteOffset,r.byteLength);if(n+=o.byteLength,n>yu)throw bu(e),Error("hook input byte limit exceeded");t.push(o)}return Buffer.concat(t,n).toString("utf-8")}function bu(e){let t=e.destroy??e.cancel;if(!t)return;try{Promise.resolve(t.call(e)).catch(()=>{})}catch{}}function Dr(e,t,n){try{return JSON.parse(e)}catch{t({reason:n});return}}function N(e,t){let n=t.get(e);return n?{kind:"command",shell:n}:{kind:ji(e)}}function ne(e,t,n,r){let o=e===void 0?process.cwd():e,i=typeof o==="string"&&o.trim()!==""?V([o]):void 0;if(i)return{configCwd:i,executionCwd:i};return P(r,t,n,Cu(o)),null}function P(e,t,n,r){let o;try{o=Cr(t)}catch(i){if(!(i instanceof fe))throw i}e(Jt({command:o,segment:r,toolName:n}))}async function wu(e){let t=await vu(e.outputDeny);if(t===void 0)return;if(!t||typeof t!=="object"||Array.isArray(t)){P(e.outputDeny);return}if(!e.isSupported(t))return;let n=e.getAgent?.(t)??e.agent,r=e.agent===n?void 0:e.agent,o=Du(t),i=(u,m)=>{Fi(u,()=>e.getSessionId(t),{agent:n,shape:r,toolName:m,cwd:o}),e.outputDeny(u)},s=e.getToolName(t);if(typeof s!=="string"||s.trim()===""){P((u)=>i(u),Su(t));return}let a=s,l=(u)=>i(u,a),c;try{c=e.getToolInput(t,a,l)}catch(u){if(!(u instanceof fe))throw u;P(l,void 0,a);return}if(!c.ok)return;let d=e.getContext(t,c.input,a,l);if(!d)return;let p;try{p=Cr(c.input)}catch(u){if(!(u instanceof fe))throw u;P(l,void 0,a);return}let g=Qe(a,c.input,c.route,d,p??null);try{let u=Yt(g,{guard:{auditAllowed:Ui(),dependencies:e.guardDependencies},audit:{agent:n,shape:r,getSessionId:()=>e.getSessionId(t)}}),m=xr(u,{includeEvidence:!0,toolName:u.stage==="command-analysis"?void 0:a});if(m){e.outputDeny(m);return}e.outputAllow?.()}catch(u){if(!(u instanceof Gi))throw u;ku(u);let m=xr(u.evaluation,{includeEvidence:!0,toolName:u.evaluation.stage==="command-analysis"?void 0:a});if(m)e.outputDeny(m);return}}function ku(e){if(!wt(S.debug))return;console.error(`CC Safety Net debug: ${xu(e.stage)}: ${Mi(e.cause)}`)}function xu(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function Cu(e){return typeof e==="string"?e:void 0}function Su(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Du(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function F(e){let t=(o)=>Lu(e.createDenyOutput,o),n=e.createAllowOutput;await wu({...e,outputDeny:t,outputAllow:n?()=>console.log(JSON.stringify(n())):void 0})}function Dt(e){return Ru(e,".gemini","config","hooks.json")}var Eu=new Map([["run_command","auto"]]),Pu=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function zi(e){return N(e,Eu)}async function Ki(){await F({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:$u(e.toolCall?.args,t),route:zi(t)}),getContext:Tu,getSessionId:(e)=>e.conversationId})}function Tu(e,t,n,r){let i=Ou(e).flatMap((c)=>{let d=V([c]);return d?[d]:[]});if(!i[0])return Te(r,t,n),null;if(n!=="run_command"){let c;try{c=Iu(t,n,i)}catch(d){if(d instanceof fe)return Te(r,void 0,n),null;if(!(d instanceof Ee))throw d;return Te(r,t,n),null}if(!c)return Te(r,t,n),null;return{configCwd:c,executionCwd:c}}let s=e.toolCall?.args;if(!s||!Object.hasOwn(s,"Cwd"))return{configCwd:i[0],executionCwd:i[0]};let a=s.Cwd;if(typeof a!=="string"||a.trim()==="")return Te(r,t,n),null;let l=me(a,i);if(l){let c=Wi(l,i);if(!c)return Te(r,t,n,a),null;return{configCwd:c,executionCwd:l}}return Te(r,t,n,a),null}function Iu(e,t,n){let r=zi(t),o=[...Bi(e,Pu),...r.kind==="patch"?qi(e):[]].filter(Vi),i=Zt(),s=new Set(o.flatMap((a)=>{let l=Wi(St(a,Ct,i),n);return l?[l]:[]}));if(s.size>1)return null;return[...s][0]??n[0]??null}function Wi(e,t){return t.filter((n)=>_u(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function _u(e,t){let n=Au(t,e);return n===""||!n.startsWith("..")&&!Vi(n)}function Te(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(Jt({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function Ou(e){if(e.workspacePaths===void 0)return[process.cwd()];let t=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((n)=>typeof n==="string"&&n.trim()!==""):[];return V(t)?t:[]}function $u(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var Rt=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:5,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:4,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:8,runtime:{order:6,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:9,runtime:{order:7,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:10,runtime:{order:8,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:11,install:{order:11,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:12,install:{order:12,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:13,install:{order:13,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:3,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],Xt=Rt.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Ji=Rt.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),z=Rt.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),Oh=Object.fromEntries(Rt.map((e)=>[e.id,e.displayName]));function R(e){return Rt.find((t)=>t.id===e)?.displayName??e}import{homedir as Nu}from"node:os";import{isAbsolute as Yi,join as Rr}from"node:path";function Xi(e){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!Yi(e))return"unknown";try{let t=Zt(),n=typeof e==="string"&&e?St(e,Ct,t):void 0,r=process.env.HOME||Nu(),o=[["codex",process.env.CODEX_HOME||Rr(r,".codex")],["copilot-cli",process.env.COPILOT_HOME||Rr(r,".copilot")],["claude-code",process.env.CLAUDE_CONFIG_DIR||Rr(r,".claude")]],i=n?o.flatMap(([s,a])=>{if(!Yi(a))return[];return Zi(n,St(a,Ct,t))?[s]:[]}):[];if(i.length===1)return i[0]??"unknown";if(i.length>1)return"unknown"}catch(t){if(t instanceof Ee)return"unknown";return"unknown"}if(process.env.CLAUDECODE==="1"||Boolean(process.env.CLAUDE_CODE_ENTRYPOINT))return"claude-code";return"unknown"}var Ar="PreToolUse",Qi="BeforeTool",es="pre_tool_call",Er="PreToolUse";var Fu=new Map([["Bash","posix"],["PowerShell","powershell"]]);function Hu(e){return N(e,Fu)}async function ts(){await F({agent:"claude-code",getAgent:(e)=>Xi(e.transcript_path),createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:Ar,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===Ar,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Hu(t)}),getContext:(e,t,n,r)=>ne(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}var Mu=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function ju(e){return N(e,Mu)}async function ns(){await F({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=Dr(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:ju(t)}},getContext:(e,t,n,r)=>ne(e.cwd,t,n,r),getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var Uu=new Map([["Shell","auto"]]);function Gu(e){return N(e,Uu)}async function rs(){await F({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Gu(t)}),getContext:Bu,getSessionId:(e)=>e.conversation_id})}function Bu(e,t,n,r){let o=qu(e);if(!o[0])return P(r,t,n),null;let i=me(zu(e.cwd),o);if(!i)return P(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:i,executionCwd:i};if(!Object.hasOwn(t,"working_directory"))return{configCwd:i,executionCwd:i};let s=t.working_directory;if(typeof s!=="string"||s.trim()==="")return P(r,t,n),null;let a=me(s,o);if(!a)return P(r,t,n,s),null;return{configCwd:i,executionCwd:a}}function qu(e){return Vu(e).flatMap((t)=>{let n=V([t]);return n?[n]:[]})}function Vu(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function zu(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Ku=new Map([["run_shell_command","auto"]]);function Wu(e){return N(e,Ku)}async function os(){await F({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===Qi,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Wu(t)}),getContext:(e,t,n,r)=>ne(e.cwd,t,n,r),getSessionId:(e)=>e.session_id})}var Ju=new Map([["run_terminal_command","auto"]]);function Yu(e){return N(e,Ju)}async function is(){await F({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return P(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:Yu(t)}},getContext:Zu,getSessionId:(e)=>e.sessionId})}function Zu(e,t,n,r){let o=V(Xu(e));if(!o)return P(r,t,n),null;let i=me(Qu(e.cwd),[o]);if(!i)return P(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;return{configCwd:i,executionCwd:i}}function Xu(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?[t]:[]}function Qu(e){return typeof e==="string"&&e.trim()!==""?e:"."}import{resolve as ep}from"node:path";var tp=new Map([["terminal","posix"]]);async function ss(){await F({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===es,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:N(t,tp)}),getContext:np,getSessionId:(e)=>e.session_id})}function np(e,t,n,r){let o=ne(e.cwd,t,n,r);if(!o)return null;if(!t||typeof t!=="object"||Array.isArray(t))return o;if(!Object.hasOwn(t,"workdir"))return o;let i=t.workdir;if(typeof i!=="string"||i.trim()==="")return P(r,t,n),null;let s=V([ep(o.configCwd,i)]);if(!s)return P(r,t,n,i),null;return{...o,executionCwd:s}}var as=new Map([["Bash","posix"]]);function rp(e){return N(e,as)}async function ls(){await F({agent:"kimi-code",createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:Er,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===Er,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:rp(t)}),getContext:(e,t,n,r)=>{let o=ne(e.cwd,t,n,r);if(!o)return null;let i=e.tool_input;if(!as.has(n)||!i||!Object.hasOwn(i,"cwd"))return o;let s=i.cwd;if(typeof s!=="string"||s.trim()==="")return P(r,t,n),null;let a=me(s,[o.configCwd]);if(!a)return P(r,t,n,s),null;return{configCwd:o.configCwd,executionCwd:a}},getSessionId:(e)=>e.session_id})}var op={"antigravity-cli":Ki,"claude-code":ts,"copilot-cli":ns,cursor:rs,"gemini-cli":os,"grok-build":is,"hermes-agent":ss,"kimi-code":ls},nt=Ji.map((e)=>({...e,run:op[e.id]}));function cs(e){let t=_({label:"hook",booleans:Object.fromEntries(nt.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=nt.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function ds(e){return nt.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}var ip=nt.map((e)=>({flags:e.flags.join(", "),description:e.description})),sp=nt.flatMap((e)=>e.flags.map((t)=>`cc-safety-net hook ${t}`)),us={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...ip,{flags:"-h, --help",description:"Show this help"}],examples:sp};var ps={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...z.map((e)=>({flags:e.flag,description:`Install ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...z.map((e)=>`cc-safety-net install ${e.flag}`)]},fs={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...z.map((e)=>({flags:e.flag,description:`Uninstall ${R(e.id)} ${e.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...z.map((e)=>`cc-safety-net uninstall ${e.flag}`)]},ms={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var gs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var rt={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add <source>",description:"Add a rulebook source and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Refresh rulebook lock/cache state"},{usage:"sync",description:"Sync configured rulebooks"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--check",description:"Check without changing lock/cache state"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule add project-rules","cc-safety-net rule sync","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var hs={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var ys={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var Qt=[hs,Oi,gs,$i,rt,ps,ms,fs,us,Ni,ys];function ap(e){return e.aliases??[]}function en(e){let t=e.toLowerCase();return Qt.find((n)=>n.name.toLowerCase()===t||ap(n).some((r)=>r.toLowerCase()===t))}import{basename as lp}from"node:path";function tn(e=7,t=pe()){let n=Date.now()-e*24*60*60*1000,r=[],o=new Set,i=0,s,a,l,c;if(t)Ae(t);let d={count:0},p=t?Le(t,d):[];for(let u of p)for(let m of Ce(u,d)){if(m.decision==="allow")continue;let f=new Date(m.ts).getTime();if(f>=n){if(i++,o.add(m.sessionId??lp(u,".jsonl")),a===void 0||f<=a)s=m.ts,a=f;if(c===void 0||f>c)l=m.ts,c=f;cp(r,m,f)}}let g=r.map((u)=>({timestamp:u.ts,command:u.command,reason:u.reason,relativeTime:Wn(new Date(u.ts))}));return{totalBlocked:i,sessionCount:o.size,recentEntries:g,oldestEntry:s,newestEntry:l,unreadable:d.count}}function cp(e,t,n){let r=e.findIndex((o)=>n>new Date(o.ts).getTime());if(r===-1){if(e.length<3)e.push(t);return}if(e.splice(r,0,t),e.length>3)e.pop()}import{dirname as dp}from"node:path";function Ls(e,t,n,r,o){let i;try{if(w(r)===null)return{path:e,exists:!1,valid:!1,ruleCount:0};i=ce(r),i.errors.push(...de(e,t,{userConfigDir:n},o))}catch(s){if(!(s instanceof H))throw s;i={errors:[s.message],ruleNames:new Set}}return{path:e,exists:!0,valid:i.errors.length===0,ruleCount:i.ruleNames.size,...i.errors.length>0?{errors:i.errors}:{}}}function up(e,t){return{source:t,name:e.name,command:e.command,subcommand:e.subcommand,blockArgs:[...e.block_args],reason:e.reason}}function vs(e,t){let n=t?.userConfigPath??ee(),r=t?.projectConfigPath??Q(e),o=dp(n),i=ve({cwd:e,userConfigPath:n,projectConfigPath:r,userConfigDir:o}),s=te({cwd:e,userConfigPath:n,projectConfigPath:r,userConfigDir:o}),a=new Map(i.rulebooks.flatMap((l)=>l.rules.map((c)=>[c,l.source])));return{userConfig:Ls(n,Ze({userConfigPath:n}),o,s.userConfigTarget,s.userScope),projectConfig:Ls(r,Xe(r),o,s.projectConfigTarget,s.projectScope),effectiveRules:i.rules.map((l)=>up(l,a.get(l.name)??"project")),shadowedRules:[]}}var pp=[{flag:S.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:S.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:S.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:S.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:S.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:S.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:S.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:S.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function bs(){return[...pp.map((e)=>({name:e.flag.name,value:br(e.flag),isSet:wr(e.flag),legacyName:e.flag.legacyName,legacyValue:e.flag.legacyName?process.env[e.flag.legacyName]:void 0,legacyIsSet:e.flag.legacyName?process.env[e.flag.legacyName]!==void 0:void 0,description:e.description,defaultBehavior:e.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:process.env.CC_SAFETY_NET_HOME,isSet:process.env.CC_SAFETY_NET_HOME!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var ws={error:0,warning:1,info:2},fp=["policy","config","audit"];function mp(e){return e.map((t)=>{if(t==="ownership")return"is not owned by the current user";if(t==="permissions")return"has unsafe permissions";if(t==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var gp=[{derive:(e)=>e.hooks.length>0&&e.hooks.every((t)=>!t.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(e)=>e.hooks.filter((t)=>t.inspectionStatus==="failed").map((t)=>{let n=R(t.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${n} inspection failed`,detail:`Doctor could not verify the ${n} integration configuration.`,fixHint:`Correct the reported ${n} configuration error, then run \`cc-safety-net doctor\` again.`,integration:t.platform}})},{derive:(e)=>e.userConfig.exists&&!e.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:e.userConfig.path}]:[]},{derive:(e)=>e.projectConfig.exists&&!e.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:e.projectConfig.path}]:[]},{derive:(e)=>e.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${e.configState.reason}`,fixHint:"Correct the named source, run `cc-safety-net rule sync` for a rule source, then rerun doctor."}]:[]},{derive:(e)=>{let t=e.environment.find((n)=>n.name==="CC_SAFETY_NET_AUDIT_SCOPE");return vr(t?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...fp.map((e)=>({derive:(t)=>t.posture.directories.filter((n)=>n.kind===e&&n.status==="unsafe").map((n)=>({checkId:`posture.${e}-directory-unsafe`,severity:"error",title:`${e[0]?.toUpperCase()}${e.slice(1)} directory is unsafe`,detail:`The ${e} directory ${mp(n.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...n.path?{path:n.path}:{}}))})),{derive:(e)=>{let t=[...e.effectiveSafety.weakenedRuleOverrides].sort();return t.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${t.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${t.join(", ")}.`}]:[]}}];function ks(e){return gp.flatMap((t,n)=>t.derive(e).map((r,o)=>({finding:r,catalogOrder:n,occurrence:o}))).sort((t,n)=>ws[t.finding.severity]-ws[n.finding.severity]||t.catalogOrder-n.catalogOrder||t.occurrence-n.occurrence).map((t)=>t.finding)}function re(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var hp=(e)=>re()?`\x1B[32m${e}\x1B[0m`:e,yp=(e)=>re()?`\x1B[33m${e}\x1B[0m`:e,Lp=(e)=>re()?`\x1B[34m${e}\x1B[0m`:e,vp=(e)=>re()?`\x1B[35m${e}\x1B[0m`:e,bp=(e)=>re()?`\x1B[36m${e}\x1B[0m`:e,wp=(e)=>re()?`\x1B[31m${e}\x1B[0m`:e,kp=(e)=>re()?`\x1B[2m${e}\x1B[0m`:e,xp=(e)=>re()?`\x1B[1m${e}\x1B[0m`:e,h={green:hp,yellow:yp,blue:Lp,magenta:vp,cyan:bp,red:wp,dim:kp,bold:xp},Cp="\x1B[0m",Sp=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Dp(e){let t=e;return()=>(t=(t*1664525+1013904223)%4294967296,t/4294967296)}function Rp(e){let t=[...Sp],n=Dp(e);for(let r=t.length-1;r>0;r--){let o=Math.floor(n()*(r+1)),i=t[r];t[r]=t[o],t[o]=i}return t}function Ap(e,t=0){if(!re())return"";let n=Rp(t);return`\x1B[38;5;${n[e%n.length]}m`}function xs(e,t,n=0){if(!re())return`"${e}"`;return`${Ap(t,n)}"${e}"${Cp}`}var Ep=new RegExp("\x1B\\[[0-9;]*m","g"),Pr=(e)=>e.replace(Ep,"").length;function Ie(e){let t=(e.headers??e.rows[0]??[]).map((s,a)=>{let l=Math.max(...e.rows.map((c)=>Pr(c[a]??"")));return Math.max(Pr(s),l)}),n=(s,a)=>s+" ".repeat(Math.max(0,a-Pr(s))),r=(s,a)=>a[0]+t.map((l)=>s.repeat(l+2)).join(a[1])+a[2],o=(s)=>`│ ${s.map((a,l)=>n(a,t[l]??0)).join(" │ ")} │`,i=e.headers?[` ${o(e.headers)}`,` ${r("─",["├","┼","┤"])}`]:[];return[` ${r("─",["┌","┬","┐"])}`,...i,...e.rows.map((s)=>` ${o(s)}`),` ${r("─",["└","┴","┘"])}`].join(`
|
|
@@ -18,7 +18,7 @@ ${qe(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o
|
|
|
18
18
|
`)}function nn(e){return Ie({rows:e})}function Is(e){let t=[];return t.push("System Info"),t.push($p(e)),t.join(`
|
|
19
19
|
`)}function $p(e){let t=["Component","Version"],n=(i)=>{if(i===null)return h.dim("not found");return i},o=[{label:"cc-safety-net",value:e.version},...Xt.map((i)=>({label:R(i),value:e.versions[i]??null})),{label:"Node.js",value:e.nodeVersion},{label:"npm",value:e.npmVersion},{label:"Bun",value:e.bunVersion},{label:"Platform",value:e.platform}].map((i)=>[i.label,n(i.value)]);return Ie({headers:t,rows:o})}function _s(e){if(e.findings.length===0)return h.green(`
|
|
20
20
|
No findings from inspected doctor facts.`);let t={error:e.findings.filter((i)=>i.severity==="error").length,warning:e.findings.filter((i)=>i.severity==="warning").length,info:e.findings.filter((i)=>i.severity==="info").length},n=["error","warning","info"].filter((i)=>t[i]>0).map((i)=>`${t[i]} ${i}`),r=e.findings.length===1?"finding":"findings",o=`
|
|
21
|
-
${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return h.red(o);if(t.warning>0)return h.yellow(o);return h.blue(o)}import{lstatSync as Np}from"node:fs";import{dirname as Tr}from"node:path";function Ir(e,t){try{let n=Np(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function Os(e){let t=pe();return{directories:[Ir("policy",Tr(Tr(e))),Ir("config",Tr(e)),...t?[Ir("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Fp}from"node:child_process";import{existsSync as $s}from"node:fs";import{delimiter as Hp,extname as Mp,join as jp}from"node:path";import{stripVTControlCharacters as Ns}from"node:util";var Hs="2.2.
|
|
21
|
+
${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return h.red(o);if(t.warning>0)return h.yellow(o);return h.blue(o)}import{lstatSync as Np}from"node:fs";import{dirname as Tr}from"node:path";function Ir(e,t){try{let n=Np(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function Os(e){let t=pe();return{directories:[Ir("policy",Tr(Tr(e))),Ir("config",Tr(e)),...t?[Ir("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Fp}from"node:child_process";import{existsSync as $s}from"node:fs";import{delimiter as Hp,extname as Mp,join as jp}from"node:path";import{stripVTControlCharacters as Ns}from"node:util";var Hs="2.2.2",Up=5000,Gp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function T(){return Hs}function _r(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function Bp(e){return(_r(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function qp(e,t){let n=Mp(e)?[e]:[...Bp(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>$s(r))??e;return(_r(t,"PATH")??"").split(Hp).flatMap((r)=>n.map((o)=>jp(r,o))).find((r)=>$s(r))??e}function Fs(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function _e(e,t){let[n,...r]=e,o=t[Gp]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=qp(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:_r(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Fs(i),...r.map(Fs)].join(" ")]}}var ot=async(e,t=Up)=>{let n=await Vp(e,{timeoutMs:t});if(n.code!==0)return null;return Ns(n.stdout).trim()||Ns(n.stderr).trim()||null};function Vp(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=_e([n,...r],process.env),s=Fp(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(g)=>{l+=g.toString()}),s.stderr.on("data",(g)=>{c+=g.toString()});let d=(g)=>{if(a)return;a=!0,clearTimeout(p),o(g)},p=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(g)=>{d({code:g,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function rn(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
|
|
22
22
|
`)[0]?.trim()||null}async function At(e=ot){let[t,n,r,o,i,s]=await Promise.all([Promise.all(z.map(async(a)=>[a.id,rn(await e([...a.probeCommand]))])),e(["codex","plugin","list"],30000),e(["amp","plugins","list"],30000),e(["node","--version"]),e(["npm","--version"]),e(["bun","--version"])]);return{version:Hs,versions:Object.fromEntries(t),codexPluginListOutput:n,ampPluginListOutput:r,nodeVersion:rn(o),npmVersion:rn(i),bunVersion:rn(s),platform:`${process.platform} ${process.arch}`}}function Or(e,t){if(t==="dev")return!1;let n=e.split(".").map(Number),r=t.split(".").map(Number),[o=0,i=0,s=0]=n,[a=0,l=0,c=0]=r;if(o!==a)return o>a;if(i!==l)return i>l;return s>c}async function be(){let e=T(),t=new AbortController,n=setTimeout(()=>t.abort(),3000);try{let r=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!r.ok)return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${r.status}`};let o=await r.json(),i=Or(o.version,e);return{currentVersion:e,latestVersion:o.version,updateAvailable:i}}catch(r){return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:r instanceof Error?r.message:"Network error"}}finally{clearTimeout(n)}}import*as zs from"node:readline";var Gs=(e)=>`\x1B[${e}B`,zp=(e)=>`\x1B[${e}A`;var Ms=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function Kp(e){return new Promise((t)=>setTimeout(t,e))}function Wp(e,t,n){if(!n)return t(e);if(n.aborted)return Promise.resolve();return new Promise((r,o)=>{let i=()=>n.removeEventListener("abort",s),s=()=>{i(),r()};n.addEventListener("abort",s,{once:!0}),t(e).then(()=>{i(),r()},(a)=>{i(),o(a)})})}function Et(e,t){return e&&e>0?e:t}function on(e){return Math.max(0,Math.min(1,e))}function it(e){return Math.max(0,Math.min(255,Math.round(e)))}function $r(e){return e<=0.0031308?12.92*e:1.055*e**0.4166666666666667-0.055}function Jp(e,t,n){let r=n*Math.PI/180,o=t*Math.cos(r),i=t*Math.sin(r),s=(e+0.3963377774*o+0.2158037573*i)**3,a=(e-0.1055613458*o-0.0638541728*i)**3,l=(e-0.0894841775*o-1.291485548*i)**3;return{blue:it($r(on(-0.0041960863*s-0.7034186147*a+1.707614701*l))*255),green:it($r(on(-1.2684380046*s+2.6097574011*a-0.3413193965*l))*255),red:it($r(on(4.0767416621*s-3.3077115913*a+0.2309699292*l))*255)}}function Nr(e,t){let n=(t*e*180/Math.PI%360+360)%360;return Jp(0.72,0.15,n)}function Bs(e,t=0.1){let n=Nr(t,e);return`\x1B[38;2;${n.red};${n.green};${n.blue}m`}function Yp(e,t){return{blue:it(e.blue+(255-e.blue)*t),green:it(e.green+(255-e.green)*t),red:it(e.red+(255-e.red)*t)}}function qs(e,t,n){let r=Math.imul(e+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(n+374761393,2654435761),o=r^r>>>15,i=Math.imul(o,739982445),s=i^i>>>12,a=Math.imul(s,695872825);return((a^a>>>15)>>>0)/4294967296}function Zp(e,t,n){let r=Math.floor(qs(e,t,n)*Ms.length);return Ms[r]??"░"}function js(e){let t=on(e);return t*t*t*(t*(t*6-15)+10)}function Xp(e){if(e.length===0)return"";let t=[],n=!1,r="";for(let o of e){let i=`${o.red};${o.green};${o.blue}`;if(o.bold!==n)t.push(o.bold?"\x1B[1m":"\x1B[22m"),n=o.bold;if(i!==r)t.push(`\x1B[38;2;${i}m`),r=i;t.push(o.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function Qp(e,t,n,r,o){return e.map((i,s)=>({...Nr(n,r+t+s/o),bold:!1,character:i}))}function e2(e,t,n,r,o,i,s,a){let l=Math.max(1,r*0.75),c=Math.min(1,n/l),d=o*js(c),p=Math.max(0,(n-l)/Math.max(1,r-l)),g=(1-js(n/r))*a*2,u=0.35*Math.max(0,1-p*2),m=c>=1,f=Math.min(e.length,Math.ceil(d+2+1));return e.slice(0,f).map((L,v)=>{let x=Nr(i,s+t+v/a+g),y=v+qs(t,v,7919)*2-1;if(y>d+2)return{...x,bold:!1,character:" "};let C=d-y,j=0.8*Math.exp(-(C*C)/12.5),ye=Math.min(0.9,j+u),zn=!m&&y>d-4;return{...Yp(x,ye),bold:ye>0.3,character:zn?Zp(t,v,n):L}})}function Us(e){return`\x1B[?2026h${e.map((t,n)=>`\x1B8${n>0?Gs(n):""}${Xp(t)}`).join("")}\x1B[?2026l`}async function Fr(e,t={}){if(!e)return;let n=t.output??process.stdout,r=t.sleep??Kp,o=Et(t.frequency,0.1),i=t.seed??0,s=Et(t.speed,40),a=Et(t.spread,3),l=Et(t.frameRate,60),c=Math.max(1,Math.floor(Et(t.duration,12))),d=e.split(`
|
|
23
23
|
`).map((f)=>Array.from(f)),p=Math.max(...d.map((f)=>f.length)),g=1000*c*d.filter((f)=>f.length>0).length/s,u=p>0?Math.max(1,Math.ceil(g/(1000/l))):0,m=u>0?g/u:0;n.write(`\x1B[?25l${d.length>1?`${`
|
|
24
24
|
`.repeat(d.length-1)}${zp(d.length-1)}`:""}\x1B7`);try{for(let f=1;f<=u;f+=1){if(t.signal?.aborted)break;n.write(Us(d.map((L,v)=>e2(L,v,f,u,p,o,i,a)))),await Wp(m,r,t.signal)}}finally{if(n.write(Us(d.map((f,L)=>Qp(f,L,o,i,a)))),n.write("\x1B8"),d.length>1)n.write(Gs(d.length-1));n.write(`
|
|
@@ -187,7 +187,7 @@ ${a()}`.trim())))}),i.on("close",(d)=>{if(clearTimeout(c),d!==0){r(Error(eo(e,d,
|
|
|
187
187
|
`));return{path:n??Rf(e),alreadyInstalled:!1}}function yl(e){let t=[],n=Dn(e.homeDir),r=["opencode.json","opencode.jsonc"];for(let o of r){let i=Nf(n,o);if(Of(i))try{let s=$f(i,"utf-8"),a=q(s);if((JSON.parse(a).plugin??[]).some((p)=>p.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:i,errors:t.length>0?t:void 0}}catch(s){t.push(`Failed to parse ${o}: ${s instanceof Error?s.message:String(s)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as Ff}from"node:path";function co(e){return Ff(e,".pi","agent","settings.json")}function uo(e){if(typeof e!=="string")return!1;return e==="npm:cc-safety-net"||e.startsWith("npm:cc-safety-net@")}function Ll(e){let t=co(e.homeDir),n=oe(t);if(n.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(n.kind==="missing")return{platform:"pi",status:"n/a"};let r=b(n.value,"packages");if(!Array.isArray(r))return{platform:"pi",status:"n/a"};let o=r.find((a)=>uo(typeof a==="string"?a:b(a,"source")));if(o===void 0)return{platform:"pi",status:"n/a"};let i=b(o,"extensions");if(Array.isArray(i)&&i.some((a)=>typeof a==="string"&&a.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var Mf={amp:Js,"antigravity-cli":Ys,"claude-code":ea,codex:ta,"copilot-cli":pa,cursor:ba,"gemini-cli":wa,"grok-build":Ta,"hermes-agent":Ba,"kimi-code":Ft,openclaw:rl,opencode:yl,pi:Ll};function dt(e,t){let n={...t,cwd:e,homeDir:t?.homeDir??Hf()};return Xt.map((r)=>jf(Mf[r](n)))}function jf(e){if(e.status==="not-inspected")return{platform:e.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:e.platform,detected:e.status!=="n/a",configured:e.status==="configured",inspectionStatus:e.status!=="n/a"?"verified":e.errors&&e.errors.length>0?"failed":"not-applicable",method:e.method,configPath:e.configPath,configPaths:e.configPaths,errors:e.errors}}import{tmpdir as Uf}from"node:os";import{join as Gf}from"node:path";var Bf=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),qf=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),Vf={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function vl(){let e=Gf(Uf(),"cc-safety-net-self-test"),t=Bf.map((n)=>{let r=Yt(Qe("self-test",{command:n.command},{kind:"command",shell:"auto"},{configCwd:e,executionCwd:e},n.command),{guard:{dependencies:{loadPolicySnapshot:()=>qf,getModes:()=>Vf,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),o=n.expectBlocked?"blocked":"allowed",i=r.decision.kind==="deny"?"blocked":"allowed";return{command:n.command,description:n.description,expected:o,actual:i,passed:o===i,reason:r.decision.kind==="deny"?r.decision.reason:void 0,ruleId:r.decision.kind==="deny"?r.decision.ruleId:void 0}});return{passed:t.filter((n)=>n.passed).length,failed:t.filter((n)=>!n.passed).length,total:t.length,results:t}}function po(e){let t=_({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},e);if(le(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function bl(e={}){let t=await Tt(!e.json,()=>{let n=zf(e);return{ready:n,finish:()=>n}},()=>Pt(),{loadingMessage:"Checking system status…"});if(e.json)console.log(JSON.stringify(t,null,2));else Kf(t);return t.engineSelfTest.failed>0||t.findings.some((n)=>n.severity==="error")?1:0}async function zf(e){let t=e.cwd??process.cwd(),n=await At(),r=dt(t,{ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.versions["copilot-cli"]}),o=vs(t),i=bs(),s=B({cwd:t}),a=s.policy,l=ue(a),c=Pe(a,l.capabilities),d=tn(7),p=e.skipUpdateCheck?{currentVersion:T(),latestVersion:null,updateAvailable:!1}:await be(),g={hooks:r,engineSelfTest:vl(),userConfig:o.userConfig,projectConfig:o.projectConfig,configState:xt(s),effectiveRules:o.effectiveRules,shadowedRules:o.shadowedRules,environment:i,effectiveSafety:{selectedPreset:a.safety.level??"standard",level:l.effectiveLevel,capabilities:l.capabilities,ruleOverrides:a.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(c).filter(([,u])=>u.source==="rule_override"&&u.override==="off"&&u.inheritedEnabled&&u.changesInherited).map(([u])=>u),ruleCounts:{stored:Object.keys(a.destructiveCommandRuleOverrides).length,effective:Object.values(c).filter((u)=>u.changesInherited).length}},posture:Os(o.userConfig.path),activity:d,update:p,system:n};return{...g,findings:ks(g)}}function Kf(e){console.log(),console.log(Cs(e.hooks)),console.log(),console.log(Ss(e.engineSelfTest)),console.log(),console.log(Ds(e)),console.log(),console.log(Rs(e.environment)),console.log(),console.log(As(e)),console.log(),console.log(Es(e.findings)),console.log(),console.log(Ps(e.activity)),console.log(),console.log(Is(e.system)),console.log(),console.log(Ts(e.update)),console.log(_s(e))}import{existsSync as Wf}from"node:fs";var Jf=/^[A-Za-z0-9_@%+=:,./-]+$/,wl="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function fo(e){let t=_({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},e);if(le(t.errors))return console.error(wl),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!Wf(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let n=t.positionals.length===1?t.positionals[0]:t.positionals.map((r)=>Jf.test(r)?r:`'${r.replaceAll("'","'\\''")}'`).join(" ");if(!n)return console.error("Error: No command provided"),console.error(wl),null;return{json:t.flags.json,cwd:t.values.cwd,command:n}}function kl(e){if(e)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function xl(e,t){let r=t-18;return[`${e.dtl}${e.dh.repeat(t)}${e.dtr}`,`${e.dv} Command Analysis${" ".repeat(r)}${e.dv}`,`${e.dbl}${e.dh.repeat(t)}${e.dbr}`]}function mo(e){return JSON.stringify(e)}function Cl(e,t=0){return`[${e.map((r,o)=>xs(r,o,t)).join(",")}]`}function An(e,t,n=70){let r=e.split(" "),o=[],i="";for(let s of r)if(i&&i.length+s.length+1>n)o.push(i),i=s;else i=i?`${i} ${s}`:s;if(i)o.push(i);return o.map((s,a)=>a===0?s:`${t}${s}`)}function Sl(e,t,n){let r=[];switch(e.type){case"parse":return null;case"env-strip":return r.push(""),r.push(`STEP ${t} ${n.h} Strip environment variables`),r.push(` Removed: ${e.envVars.map((o)=>`${o}=<redacted>`).join(", ")}`),r.push(` Tokens: ${mo(e.output)}`),{lines:r,incrementStep:!0};case"leading-tokens-stripped":return r.push(""),r.push(`STEP ${t} ${n.h} Strip wrappers`),r.push(` Removed: ${e.removed.join(", ")}`),r.push(` Tokens: ${mo(e.output)}`),{lines:r,incrementStep:!0};case"shell-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Detect shell wrapper`),r.push(` Wrapper: ${e.wrapper} -c`),r.push(` Inner: ${e.innerCommand}`),{lines:r,incrementStep:!0};case"interpreter":{if(r.push(""),r.push(`STEP ${t} ${n.h} Detect interpreter`),r.push(` Interpreter: ${e.interpreter}`),r.push(` Code: ${e.codeArg}`),e.paranoidBlocked)r.push(" Result: ✗ BLOCKED (paranoid mode)");return{lines:r,incrementStep:!0}}case"busybox":return r.push(""),r.push(`STEP ${t} ${n.h} Busybox wrapper`),r.push(` Subcommand: ${e.subcommand}`),{lines:r,incrementStep:!0};case"transparent-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Transparent wrapper`),r.push(` Wrapper: ${e.wrapper}`),r.push(` Tokens: ${mo(e.output)}`),{lines:r,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(r.push(""),r.push(`STEP ${t} ${n.h} Match rules`),r.push(` Rule: ${e.rule}()`),e.matched)r.push(" Result: MATCHED");else r.push(" Result: No match");return{lines:r,incrementStep:!0}}case"worktree-relaxation":return r.push(""),r.push(`STEP ${t} ${n.h} Worktree relaxation`),r.push(` Mode: ${S.worktree.name}`),r.push(` Git cwd: ${e.gitCwd}`),r.push(" Result: Allowed local discard in linked worktree"),{lines:r,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(e.embeddedCommandFound)return r.push(""),r.push(`STEP ${t} ${n.h} Fallback scan`),r.push(` Found: ${e.embeddedCommandFound}`),{lines:r,incrementStep:!0};return null}case"custom-rules-check":{if(e.rulesChecked){if(r.push(""),r.push(`STEP ${t} ${n.h} Custom rules`),e.matched)r.push(" Result: MATCHED");else r.push(" Result: No match");return{lines:r,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(e.matched)return r.push(""),r.push(`STEP ${t} ${n.h} Dangerous text check`),r.push(` Token: ${e.token}`),r.push(" Result: MATCHED"),{lines:r,incrementStep:!0};return null}case"strict-unparseable":return r.push(""),r.push(`STEP ${t} ${n.h} Strict mode check`),r.push(` Command: ${e.rawCommand}`),r.push(" Result: ✗ UNPARSEABLE"),{lines:r,incrementStep:!0};case"segment-skipped":return null;case"error":return r.push(""),r.push(`ERROR: ${e.message}`),{lines:r,incrementStep:!1};default:return e}}function go(e,t){let n=kl(t?.asciiOnly??!1),r=58,o=[],i=1;o.push(...xl(n,58)),o.push("");let s=e.trace.steps.find((u)=>u.type==="error");if(s&&s.type==="error"){o.push("ERROR"),o.push(` ${s.message}`),o.push(""),o.push("RESULT"),o.push(` Status: ${e.result==="blocked"?h.red("BLOCKED"):h.green("ALLOWED")}`),o.push(""),o.push("CONFIG");let u=e.configSource??"none";return o.push(` Path: ${u}`),o.join(`
|
|
188
188
|
`)}let a=e.trace.steps.find((u)=>u.type==="parse");if(a&&a.type==="parse"){o.push("INPUT"),o.push(` ${a.input}`),o.push(""),o.push(`STEP ${i} ${n.h} Split shell commands`),i++;for(let u=0;u<a.segments.length;u++){let m=a.segments[u];if(m){let f=Math.random();o.push(` Segment ${u+1}: ${Cl(m,f)}`)}}}let l=e.trace.segments,c=l.length>1;for(let u of l){if(c){o.push("");let v="";if(a&&a.type==="parse"){let Kn=a.segments[u.index];if(Kn)v=Kn.join(" ")}let x=54,y=v,C=` Segment ${u.index+1}: `,j=" ";if(v){if(C.length+v.length+j.length>x){let md=x-C.length-j.length;y=`${v.substring(0,md-1)}…`}}let ye=v?`${C}${y}${j}`:` Segment ${u.index+1} `,zn=v?`${C}${h.cyan(y)}${j}`:ye,Mo=58-ye.length,jo=Math.floor(Mo/2),fd=Mo-jo;o.push(`${n.sh.repeat(jo)}${zn}${n.sh.repeat(fd)}`)}if(u.steps.find((v)=>v.type==="segment-skipped")){o.push(""),o.push(" (skipped — prior segment blocked)");continue}let f=!1,L=!1;for(let v of u.steps){let x=Sl(v,i,n);if(x){if(L=!0,v.type==="recurse"){o.push("");let y=" RECURSING ",C=58-y.length-4;o.push(` ${n.tl}${n.h}${y}${n.h.repeat(C)}`),o.push(` ${n.v}`),f=!0;continue}for(let y of x.lines)if(f)o.push(` ${n.v} ${y}`);else o.push(y);if(x.incrementStep)i++}}if(f)o.push(` ${n.v}`),o.push(` ${n.bl}${n.h.repeat(56)}`),f=!1;if(!L)o.push(""),o.push(` ${h.green("✓")} Allowed (no matching rules)`)}if(o.push(""),o.push("RESULT"),e.result==="blocked"){if(o.push(` Status: ${h.red("BLOCKED")}`),e.customRule){if(o.push(` Rule: ${e.customRule.id}`),e.customRule.rulebook)o.push(` Rulebook: ${e.customRule.rulebook.name} ${e.customRule.rulebook.version}`);if(e.customRule.source)o.push(` Source: ${e.customRule.source}`);if(e.customRule.override)o.push(` Override: reason ${e.customRule.override.reason}`)}if(e.reason){let u=An(e.reason," ");o.push(` Reason: ${u[0]}`);for(let m=1;m<u.length;m++)o.push(u[m]??"")}}else o.push(` Status: ${h.green("ALLOWED")}`);o.push(""),o.push("CONFIG");let d=e.configSource??"none",p=e.configValid?"":" (invalid)";o.push(` Path: ${d}${p}`),o.push(` Safety preset: ${e.selectedPreset??"standard"}`),o.push(` Effective capabilities: ${e.effectiveLevel}`);let g=Object.entries(e.destructiveCommandRuleOverrides??{});if(o.push(` Rule customizations: ${g.length}`),e.ruleActivation)o.push(` Rule activation: ${e.ruleActivation.id} — ${e.ruleActivation.enabled?"on":"off"} via ${e.ruleActivation.source}`);return o.join(`
|
|
189
189
|
`)}function ho(e){return JSON.stringify(e,null,2)}function Dl(e){return new Promise((t)=>{process.stdout.write(`${e}
|
|
190
|
-
`,()=>t())})}async function Rl(e){let t=fo(e);if(!t)return 1;try{let n=et(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Dl(t.json?ho(n):go(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof yr)&&!(n instanceof Ee)&&!(n instanceof fe))throw n;if(t.json)return await Dl(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var Al="2.2.
|
|
190
|
+
`,()=>t())})}async function Rl(e){let t=fo(e);if(!t)return 1;try{let n=et(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Dl(t.json?ho(n):go(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof yr)&&!(n instanceof Ee)&&!(n instanceof fe))throw n;if(t.json)return await Dl(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var Al="2.2.2",J=" ",Fe="cc-safety-net";function El(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function Yf(e){return Math.max(...e.map((t)=>El(t).length))}function Zf(e){return Math.max(...e.map((t)=>t.usage.length))}function Xf(e){return Math.max(...e.map((t)=>`${Fe} ${t.usage}`.length))}function Qf(e,t){let n=`${Fe} ${e.usage}`;return`${J}${n.padEnd(t+2)}${e.description}`}function he(e,t){return`${J}${e.padEnd(Math.max(40,e.length+2))}${t}`}function En(e,t=console.log){let n=[];if(n.push(`${Fe} ${e.name}`),n.push(""),n.push(`${J}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${J}${Fe} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=Zf(e.subcommands);for(let o of e.subcommands)n.push(`${J}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=Yf(e.options);for(let o of e.options){let i=El(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${J}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${J}${r}`)}t(n.join(`
|
|
191
191
|
`))}function yo(){let e=Xf(Qt),t=[];t.push(`${Fe} v${Al}`),t.push(""),t.push("Blocks destructive commands and secret access."),t.push(""),t.push("COMMANDS:");for(let n of Qt)t.push(Qf(n,e));t.push(""),t.push("GLOBAL OPTIONS:"),t.push(`${J}-h, --help Show help (use with command for command-specific help)`),t.push(`${J}-V, --version Show version`),t.push(""),t.push("HELP:"),t.push(`${J}${Fe} help <command> Show help for a specific command`),t.push(`${J}${Fe} <command> --help Show help for a specific command`),t.push(""),t.push("ENVIRONMENT VARIABLES:"),t.push(he(`${S.level.name}=standard|strict|paranoid`,"Set session safety level")),t.push(he(`${S.worktree.name}=1`,"Allow local git discards in linked worktrees")),t.push(he(`${S.debug.name}=1`,"Print diagnostic messages to stderr")),t.push(he(`${S.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),t.push(he("CC_SAFETY_NET_HOME","Override rule config home directory")),t.push(""),t.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),t.push(he(`${S.strict.name}=1`,"Force safety.overrides.fail_closed on")),t.push(he(`${S.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),t.push(he(`${S.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),t.push(he(`${S.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),t.push(""),t.push("Documentation: https://ccsafetynet.com/docs"),console.log(t.join(`
|
|
192
192
|
`))}function Pl(){console.log(Al)}function jt(e,t=console.log){let n=en(e);if(!n)return!1;if(n.name.toLowerCase()!==e.toLowerCase())return!1;return En(n,t),!0}import{existsSync as Eo,readFileSync as kc}from"node:fs";import{homedir as Ym,tmpdir as Zm}from"node:os";import{join as Ro}from"node:path";import*as ke from"node:readline";function em(e){return e==="install"?"Install":"Uninstall"}function tm(e){return e==="install"?"Installing":"Uninstalling"}function nm(e){return e==="install"?"into":"from"}function _l(e){return e?.available===!0}function rm(e,t){let n=new Set(t);return e.filter((r)=>n.has(r.target)).map((r)=>r.target)}function Tl(e,t,n){if(e.length===0||e.every((r)=>!r.available))return t;return Array.from({length:e.length},(r,o)=>o+1).map((r)=>(t+r*n+e.length)%e.length).find((r)=>_l(e[r]))}function om(e,t,n){if(n.ctrl&&n.name==="c")return"interrupt";if(n.name==="escape"||t==="q")return"abort";if(e==="install"&&(t==="u"||t==="U"))return"update";if(n.name==="up"||t==="k")return"up";if(n.name==="down"||t==="j")return"down";if(n.name==="space"||t===" ")return"toggle";if(n.name==="return"||n.name==="enter")return"confirm";return null}function im(e){return{cursor:e.findIndex((t)=>t.available),selected:[]}}function sm(e,t,n){if(n==="confirm"||n==="update"||n==="abort"||n==="interrupt")return{state:e,done:n};if(n==="up")return{state:{...e,cursor:Tl(t,e.cursor,-1)}};if(n==="down")return{state:{...e,cursor:Tl(t,e.cursor,1)}};let r=t[e.cursor];if(!_l(r))return{state:e};let o=e.selected.includes(r.target)?e.selected.filter((i)=>i!==r.target):rm(t,[...e.selected,r.target]);return{state:{...e,selected:o}}}var Ol="◉",$l="◯",Nl=">",Fl=" ";function am(e,t,n,r={}){let o=r.color!==!1,i=o?h.dim:(l)=>l,s=o?h.green:(l)=>l,a=o?h.bold:(l)=>l;return["",`${em(e)} CC Safety Net ${nm(e)}:`,"",...t.map((l,c)=>{let d=n.selected.includes(l.target),p=c===n.cursor,g=d?Ol:$l,u=p?Nl:Fl,m=l.available?"":` (${l.unavailableReason??"not installed"})`,f=`${g} ${l.label}${m}`,L=!l.available?i(f):d?s(f):p?a(f):f;return`${u} ${L}`}),"",e==="install"?"Space: select Enter: confirm u: update installed Up/Down: move q/Esc: cancel":t.some((l)=>l.available)?"Space: select Enter: confirm Up/Down: move q/Esc: cancel":`No selectable integrations found for ${e}. q/Esc: close`].join(`
|
|
193
193
|
`)}var Il=["global-hook","plugin"];function lm(e,t,n={}){let r=n.color!==!1?h.bold:(i)=>i;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((i,s)=>{let a=s===e,l=`${a?Ol:$l} ${i}`;return`${a?Nl:Fl} ${a?r(l):l}`}),"","Enter: confirm Up/Down: move q/Esc: cancel"].join(`
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import{K as F,N as O,ba as Y,ca as _,ia as m,na as U,q as C,r as w,ub as h,vb as W}from"./index-z08yh4sm.js";import{lstatSync as N,readdirSync as J,readFileSync as x,rmdirSync as X,statSync as v,unlinkSync as q,utimesSync as ee,writeFileSync as te}from"node:fs";import{dirname as ne,join as u}from"node:path";var A=86400000,re=".last-prune",ie=/^\d{4}-\d{2}$/,oe=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,k=(e)=>Math.floor(e/A);function ae(e){try{let n=u(ne(O(e)),F),t=JSON.parse(x(n,"utf-8"));return w(t?.audit?.retention_days)}catch{return C}}function R(e,n=()=>new Date){try{let t=n().getTime();if(!v(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=u(e,re),i=v(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&k(i)===k(t))return;let o=t-ae()*A,s=new Date(t).toISOString().slice(0,7);for(let a of p(e)){if(a.isDirectory()){se(u(e,a.name),o,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))ce(u(e,a.name),o)}te(r,"",{mode:384}),ee(r,t/1000,t/1000)}catch{}}function se(e,n,t){for(let r of p(e)){if(!r.isDirectory()||!ie.test(r.name))continue;let i=u(e,r.name);for(let o of p(i)){if(!o.isFile())continue;let s=oe.exec(o.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(a)||a>=n)continue;L(u(i,o.name))}if(r.name!==t)T(i)}T(e)}function ce(e,n){try{let t=N(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
|
|
2
|
-
`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.2.
|
|
2
|
+
`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.2.2",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
|
|
3
3
|
`,{encoding:"utf-8",mode:384}),R(c,o.now)}catch{}}function l(e,n){return{value:e.slice(0,n),truncated:e.length>n}}function Z(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let n=e||Ee()||ye().homedir;return n&&_e(n)?n:null}function ke(e=Z()){return e?E(e,".cc-safety-net","logs"):null}function B(e,n,t,r=!0,i){if(n.decision.kind==="allow"){if(!t||e.route.kind!=="command")return;let a=M(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{}}}let o=n.decision.evidence.find((a)=>a.kind==="command"),s=o?.command??(r?M(e):"");return{decision:"deny",command:s,segment:o?.segment??s,reason:n.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{},ruleId:n.decision.ruleId,intent:n.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function M(e){return"command"in e?e.command??"":""}function P(e,n,t){if(!e)return;let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command,e.segment,e.reason,e.cwd,{homeDir:t.homeDir,decision:e.decision,agent:t.agent,shape:t.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function We(e,n,t){let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command??"",e.segment??e.command??"",e.reason,t.cwd??null,{homeDir:t.homeDir,decision:"deny",agent:t.agent,shape:t.shape,toolName:t.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function K(e){let{reason:n,command:t,segment:r,toolName:i}=e,o=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
|
|
4
4
|
|
|
5
5
|
Reason: ${s(n)}`;if(e.ruleId)a+=`
|
package/dist/index.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
import{a as d}from"./chunks/index-25nh5wqs.js";import{k as w,l as y,m as l,n as h,p as R}from"./chunks/index-
|
|
1
|
+
import{a as d}from"./chunks/index-25nh5wqs.js";import{k as w,l as y,m as l,n as h,p as R}from"./chunks/index-j6a67cs3.js";import{Fa as k,Z as p,ia as E,ja as v,ka as D,ub as P,xa as x}from"./chunks/index-z08yh4sm.js";import{resolve as T}from"node:path";function f(){return{"cc-safety-net":{description:"Manage CC Safety Net rulebooks",template:d.slice(d.indexOf("## Workflow"))}}}var z=new Set(["powershell","pwsh"]),B=new Set(["bash","dash","ksh","sh","zsh"]);function S(o={}){return async({directory:r,homeDir:t})=>{let n=T(r),a;return{config:async(i)=>{a=i;let c=f(),s=i.command??{};i.command={...c,...s}},"tool.execute.before":async(i,c)=>{let s=(e,O,_=n)=>{w(e,()=>i.sessionID,{agent:"opencode",toolName:O,cwd:_,homeDir:t}),A(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")s(l());let u=c.args,m;try{m=D(u)}catch(e){if(!(e instanceof E))throw e;s(l({toolName:i.tool}),i.tool)}let I=U(a?.shell),b=G(i.tool,I),g=W(n,u);if(!p(n)||!g)return s(l({command:m,toolName:i.tool}),i.tool);let L={configCwd:n,executionCwd:g},N=k(i.tool,u,b,L,m??null);try{let e=R(N,{guard:{auditAllowed:x(),dependencies:o},audit:{agent:"opencode",homeDir:t,getSessionId:()=>i.sessionID}});C(e,!0)}catch(e){if(!(e instanceof P))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;C(e.evaluation,!0);return}}}}}function U(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let a=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!a)return"auto";if(z.has(a))return"powershell";if(B.has(a))return"posix";return"auto"}function G(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:v(o)}}function W(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?Z(t):t,a=T(o,n);return p(a)?a:null}function Z(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function C(o,r){let t=y(o,{includeEvidence:r});if(t)A(t)}function A(o){throw Error(h(o))}var io=S();export{io as CCSafetyNetPlugin};
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
|
|
2
|
-
// version: 2.2.
|
|
2
|
+
// version: 2.2.2
|
|
3
3
|
var Pw=Object.defineProperty;var kw=(e)=>e;function Aw(e,t){this[e]=kw.bind(null,t)}var mn=(e,t)=>{for(var n in t)Pw(e,n,{get:t[n],enumerable:!0,configurable:!0,set:Aw.bind(t,n)})};var zh={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};import{randomBytes as PE}from"node:crypto";import{appendFileSync as kE,mkdirSync as AE}from"node:fs";import{homedir as TE,userInfo as IE}from"node:os";import{isAbsolute as OE,join as Nl}from"node:path";var Tw=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function Tt(e){let t=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return Iw(t)}function Iw(e){let t=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let n of Tw)t=t.replace(n,"<redacted>");return t.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}import{lstatSync as Kh,readdirSync as pE,readFileSync as Xh,rmdirSync as gE,statSync as qh,unlinkSync as hE,utimesSync as yE,writeFileSync as bE}from"node:fs";import{dirname as vE,join as qn}from"node:path";var Ti=30,Cl=1,wl=365;function Ii(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}import{homedir as Qw}from"node:os";import{dirname as jt,isAbsolute as eE,join as Ht,relative as tE,resolve as zt,sep as nE}from"node:path";import{lstatSync as Ow,realpathSync as zw}from"node:fs";import{homedir as Nw,tmpdir as Dw}from"node:os";var Ue={realpath:(e)=>{try{return zw(e)}catch{return null}},entryKind:(e)=>{let t=Ow(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function Te(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function fn(){return Te(process.env.HOME||Nw())}function It(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:fn(),tmpdir:Dw(),paths:Ue}}import{closeSync as $w,constants as Nh,fstatSync as Mw,fsyncSync as LM,lstatSync as Dh,mkdirSync as WM,openSync as Lw,readdirSync as FM,readFileSync as Ww,realpathSync as Oi,renameSync as GM,rmdirSync as ZM,statSync as Fw,unlinkSync as BM,writeFileSync as UM}from"node:fs";import{isAbsolute as $h,join as Mh,normalize as Gw,parse as Zw,relative as El,resolve as Rl,sep as Pl}from"node:path";var Bw=Symbol("PolicyFilesystemScope"),Uw=Symbol("PolicyFilesystemTarget"),jw=Nh.O_NOFOLLOW??0;class ae extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function Ut(e,t){return{[Bw]:!0,root:Rl(e),label:t}}function Lh(e,t){let n=Gw(t);if(t===""||$h(t)||n===".."||n.startsWith(`..${Pl}`))throw new ae(e.label);return{[Uw]:!0,scope:e,relativePath:n,path:Mh(e.root,n)}}function Ot(e,t){let n=El(e.root,Rl(t));return Lh(e,n)}function Ni(e,t="rules policy"){let n=Rl(e),r=Zw(n).dir;return Lh(Ut(r,t),El(r,n))}function pn(e){try{if(!zi(e,!1).exists)return null;let n=Lw(e.path,Nh.O_RDONLY|jw);try{let r=Mw(n);if(!r.isFile())throw new ae(e.scope.label);let o=Ww(n,"utf-8"),i=Dh(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new ae(e.scope.label);return zi(e,!1),o}finally{$w(n)}}catch(t){Kw(e.scope.label,t)}}function Wh(e,t){if(e.path===t.path)return!0;try{if(!zi(e,!1).exists||!zi(t,!1).exists)return!1;return Oi(e.path)===Oi(t.path)}catch(n){if(n instanceof ae)throw n;throw new ae(e.scope.label)}}function zi(e,t,n="file"){let r=Hw(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(Pl);for(let i of o.keys()){let s=Mh(e.scope.root,...o.slice(0,i+1)),a=Fh(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new ae(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new ae(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new ae(e.scope.label);Vw(r,Oi(s),e.scope.label)}return{exists:!0}}function Hw(e){if(!Fh(e.root))return null;if(!Fw(e.root).isDirectory())throw new ae(e.label);return Oi(e.root)}function Vw(e,t,n){let r=El(e,t);if(r===".."||r.startsWith(`..${Pl}`)||$h(r))throw new ae(n)}function Fh(e){try{return Dh(e)}catch(t){if(qw(t)&&t.code==="ENOENT")return null;throw t}}function Kw(e,t){if(t instanceof ae)throw t;throw new ae(e)}function qw(e){return e instanceof Error&&"code"in e}var dt=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,kl="rulebook.json",Al=".cc-safety-net/rules";var Gh=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var Yw=/^[A-Za-z0-9._-]+$/,Jw=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Xw="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Zh=new RegExp(`^${Jw}/(${dt.source.slice(1,-1)})/${Xw}$`);function Bh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Qr(e){if($i(e))try{return Di(e),null}catch(t){return t instanceof Error?t.message:String(t)}return dt.test(e)?null:`Local rulebook sources must be bare names matching ${dt}: ${e}`}function Di(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Gh);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let[n,r,...o]=t[3].split("/");if(!n||!Yw.test(n))throw Error(`GitHub rulebook refs must be a single path segment: ${e}`);if(!r||o.length>0||!dt.test(r))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:n,path:Bh(r),name:r}}function $i(e){return Gh.test(e)}var jh="rule.json",Mi="policy.json",rE="rule.lock";var Hh=".cc-safety-net",oE="rules",Uh="cache",iE="CC_SAFETY_NET_HOME",Vt="`cc-safety-net rule sync`";function sE(e){return zt(e??process.cwd(),Al)}function aE(e){return Ht(sE(e),jh)}function gn(e){return e?.userConfigDir??(e?.userConfigPath?jt(e.userConfigPath):Ht(cE(),oE))}function cE(){let e=process.env[iE];return e?zt(Te(e)):Ht(Qw(),Hh)}function lE(e){return Ht(gn(e),jh)}function eo(e){return Ht(jt(e),rE)}function Vh(e){let t=e.userConfigPath??lE(e),n=e.projectConfigPath??aE(e.cwd),r=uE(t,e),o=dE(n,e);return{userConfigPath:t,projectConfigPath:n,userLockPath:eo(t),projectLockPath:eo(n),userScope:r,projectScope:o,userConfigTarget:Ot(r,t),projectConfigTarget:Ot(o,n),userLockTarget:Ot(r,eo(t)),projectLockTarget:Ot(o,eo(n))}}function uE(e,t){let n=t.userConfigPath?jt(jt(zt(t.userConfigPath))):jt(zt(t.userConfigDir??gn(t)));return Ut(n,"user policy")}function dE(e,t){let n=zt(t.cwd??process.cwd()),r=zt(e),o=tE(n,r);if(o!==".."&&!o.startsWith(`..${nE}`)&&!eE(o))return Ut(n,"project policy");return Ut(jt(jt(r)),"project policy")}function Tl(e,t){let n=e.digest.startsWith("sha256:")?e.digest.slice(7):e.digest;return Ht(fE(t),"rulebooks",`${mE(e)}--${n.slice(0,12)}`,kl)}function Il(e,t){let n=t;return{cacheConfigDir:e,cwd:t.cwd,global:n.global}}function mE(e){return(e.kind==="github"&&e.display_ref?`${e.owner}/${e.repo}#${e.display_ref}/${e.name}`:e.spec).toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"rulebook"}function fE(e){let t=e?.cacheConfigDir??gn(e),n=e;if(n&&!n.global&&n.cwd&&zt(t)===zt(n.cwd))return Ht(zt(n.cwd),Hh,Uh);return Ht(jt(t),Uh)}var zl=86400000,SE=".last-prune",_E=/^\d{4}-\d{2}$/,xE=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Yh=(e)=>Math.floor(e/zl);function CE(e){try{let t=qn(vE(gn(e)),Mi),n=JSON.parse(Xh(t,"utf-8"));return Ii(n?.audit?.retention_days)}catch{return Ti}}function Qh(e,t=()=>new Date){try{let n=t().getTime();if(!qh(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=qn(e,SE),o=qh(r,{throwIfNoEntry:!1})?.mtimeMs;if(o!==void 0&&Yh(o)===Yh(n))return;let i=n-CE()*zl,s=new Date(n).toISOString().slice(0,7);for(let a of Ol(e)){if(a.isDirectory()){wE(qn(e,a.name),i,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))EE(qn(e,a.name),i)}bE(r,"",{mode:384}),yE(r,n/1000,n/1000)}catch{}}function wE(e,t,n){for(let r of Ol(e)){if(!r.isDirectory()||!_E.test(r.name))continue;let o=qn(e,r.name);for(let i of Ol(o)){if(!i.isFile())continue;let s=xE.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+zl;if(!Number.isFinite(a)||a>=t)continue;ey(qn(o,i.name))}if(r.name!==n)Jh(o)}Jh(e)}function EE(e,t){try{let n=Kh(e);if(n.mtimeMs>=t)return;let r=Xh(e,"utf-8").split(`
|
|
4
|
-
`).filter((o)=>o.trim()).map(RE);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Kh(e).mtimeMs!==n.mtimeMs)return;ey(e)}catch{}}function RE(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Ol(e){try{return pE(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function ey(e){try{hE(e)}catch{}}function Jh(e){try{gE(e)}catch{}}var zE="2.2.
|
|
4
|
+
`).filter((o)=>o.trim()).map(RE);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(Kh(e).mtimeMs!==n.mtimeMs)return;ey(e)}catch{}}function RE(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Ol(e){try{return pE(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function ey(e){try{hE(e)}catch{}}function Jh(e){try{gE(e)}catch{}}var zE="2.2.2",NE=1e4,DE=2000,$E=256,ME=32768;function LE(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function WE(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Dl(e,t,n,r,o,i={}){let s=LE(e);if(!s)return;let a=i.homeDir??ty();if(!a)return;let c=FE(a);if(!c)return;try{let l=(i.now??(()=>new Date))().toISOString(),u=Li(Tt(t),i.failureStage?Number.POSITIVE_INFINITY:NE),d=Li(Tt(n),DE),f=i.toolName?Li(Tt(i.toolName),$E):void 0,m=o===null?void 0:Li(Tt(o),ME),p=Nl(c,WE(m?.value??null),l.slice(0,7));AE(p,{recursive:!0,mode:448});let h=Nl(p,`${l.slice(0,10)}-${s}.jsonl`),b={ts:l,id:(i.createId??(()=>PE(8).toString("hex")))(),v:zE,sessionId:s,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:f?.value,command:u.value,segment:d.value,...u.truncated||d.truncated||f?.truncated||m?.truncated?{truncated:!0}:{},reason:r,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:m?.value??null};kE(h,`${JSON.stringify(b)}
|
|
5
5
|
`,{encoding:"utf-8",mode:384}),Qh(c,i.now)}catch{}}function Li(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ty(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let t=e||TE()||IE().homedir;return t&&OE(t)?t:null}function FE(e=ty()){return e?Nl(e,".cc-safety-net","logs"):null}function ry(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=ny(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?ny(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function ny(e){return"command"in e?e.command??"":""}function oy(e,t,n){if(!e)return;let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;Dl(r,e.command,e.segment,e.reason,e.cwd,{homeDir:n.homeDir,decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function iy(e,t,n){let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;Dl(r,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{homeDir:n.homeDir,decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}import{accessSync as SL,constants as _L,realpathSync as KE,statSync as qE}from"node:fs";import{isAbsolute as ay,relative as YE,resolve as JE,sep as XE}from"node:path";import{dirname as GE,isAbsolute as ZE,parse as BE,sep as UE}from"node:path";function hn(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Kt(e,t,n){if(hn(t))throw Error("Unsupported Windows namespace path");let r=ZE(t)?HE(t):"",o=r||e;for(let i of VE(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=GE(o);continue}let s=jE(o,i),a=n.entryKind(s),c=a==="symlink"?n.realpath(s):s;if(a==="missing"||c===null)throw Error(`Cannot resolve path component: ${s}`);o=c}return o}function jE(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${UE}${t}`}function HE(e){return BE(e).root}function VE(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function Wi(e,t){if(hn(e))return;let n=t.flatMap((o)=>sy(o));if(!n[0])return;let r=sy(ay(e)?e:JE(n[0],e))[0];if(!r)return;return n.some((o)=>cy(r,o))?r:void 0}function sy(e){try{let t=KE(e);return qE(t).isDirectory()?[t]:[]}catch{return[]}}function cy(e,t){let n=YE(t,e);return n===""||n!==".."&&!n.startsWith(`..${XE}`)&&!ay(n)}var qt="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",Nt="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",ly="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",uy="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Fi="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function my(e){let{reason:t,command:n,segment:r,toolName:o}=e,i=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
|
|
6
6
|
|
|
7
7
|
Reason: ${s(t)}`;if(e.ruleId)a+=`
|
package/dist/pi/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{a}from"../chunks/index-25nh5wqs.js";import{k as u,l as c,m as f,n as C,o as g,p as E}from"../chunks/index-
|
|
1
|
+
import{a}from"../chunks/index-25nh5wqs.js";import{k as u,l as c,m as f,n as C,o as g,p as E}from"../chunks/index-j6a67cs3.js";import{Fa as d,_ as p,ja as P,ub as v,va as y,xa as T,za as w}from"../chunks/index-z08yh4sm.js";var D="cc-safety-net",I="Manage CC Safety Net rulebooks",M="Help me configure CC Safety Net.";function s(e){e.registerCommand(D,{description:I,handler:async(n,o)=>{e.sendUserMessage(S(n),o.isIdle()?void 0:{deliverAs:"followUp"})}})}function S(e){return`${a.slice(a.indexOf("## Workflow")).trimEnd()}
|
|
2
2
|
|
|
3
3
|
## User request
|
|
4
4
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cc-safety-net",
|
|
3
|
-
"version": "2.2.
|
|
3
|
+
"version": "2.2.2",
|
|
4
4
|
"description": "A coding agent CLI hook - block destructive commands and secret file access",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"types": "dist/index.d.ts",
|
|
@@ -109,5 +109,5 @@
|
|
|
109
109
|
"grok",
|
|
110
110
|
"grok-build"
|
|
111
111
|
],
|
|
112
|
-
"gitHead": "
|
|
112
|
+
"gitHead": "1bc02194c293b72c06a6530fe7129704b5b2051d"
|
|
113
113
|
}
|