cc-safety-net 2.3.0 → 2.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +72 -100
- package/dist/amp/cc-safety-net/index.ts +52 -52
- package/dist/api.js +1 -1
- package/dist/bin/cc-safety-net.js +3 -3
- package/dist/chunks/{index-qxyh7m59.js → index-2z9vsvqb.js} +2 -2
- package/dist/chunks/{index-et11dxs1.js → index-6fvz7zfr.js} +36 -36
- package/dist/index.js +1 -1
- package/dist/openclaw/cc-safety-net/index.js +52 -52
- package/dist/openclaw/cc-safety-net/openclaw.plugin.json +1 -1
- package/dist/openclaw/cc-safety-net/package.json +1 -1
- package/dist/pi/index.js +1 -1
- package/package.json +2 -2
package/dist/api.js
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
import{$ as n,Bb as a,Cb as d,Ia as t,X as r}from"./chunks/index-
|
|
1
|
+
import{$ as n,Bb as a,Cb as d,Ia as t,X as r}from"./chunks/index-6fvz7zfr.js";import{isAbsolute as m,resolve as i}from"node:path";function p(e){if(typeof e!=="object"||e===null)throw TypeError("checkCommand requires an input object with command and cwd");if(typeof e.command!=="string"||e.command.trim()==="")throw TypeError("command must be a non-empty string");if(typeof e.cwd!=="string"||e.cwd.trim()===""||!m(e.cwd))throw TypeError("cwd must be an absolute directory path");let o=i(e.cwd);if(!r(o))return{kind:"deny",reason:n};return l(c(t("library-api",{command:e.command},{kind:"command",shell:"auto"},{configCwd:o,executionCwd:o},e.command)))}function c(e){try{return d(e).decision}catch(o){if(!(o instanceof a))throw o;return o.evaluation.decision}}function l(e){if(e.kind==="allow")return{kind:"allow"};return{kind:"deny",reason:e.reason,...e.ruleId===void 0?{}:{ruleId:e.ruleId}}}export{p as checkCommand};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
import{b as fi,c as mi,d as V,e as gi,f as vr,g as ct,h as He,i as Hr,j as be,k as Ss,l as zr,m as vn,n as Rs,o as Ds,p as bn}from"../chunks/index-
|
|
2
|
+
import{b as fi,c as mi,d as V,e as gi,f as vr,g as ct,h as He,i as Hr,j as be,k as Ss,l as zr,m as vn,n as Rs,o as Ds,p as bn}from"../chunks/index-2z9vsvqb.js";import{$a as Er,A as it,Aa as As,Ab as Ot,B as he,Ba as ye,Bb as Es,C as Oa,Ca as Nt,D as Yi,Da as qr,E as De,Ea as Vr,F as yn,Fa as ss,G as Dt,Ga as as,H as kr,Ha as wi,I as je,Ia as st,J as Se,Ja as ls,K as Ne,Ka as cs,L as re,La as Pr,M as xr,Ma as Ar,Na as Zi,O as oe,Oa as Sr,P as se,Pa as ge,Qa as Xi,R as ie,Ra as Ui,S as It,Sa as Gi,T as Fd,Ta as ru,U as Ae,Ua as xi,V as U,Va as Ci,W as Re,Wa as Ee,Xa as Si,Y as we,Ya as Ge,Z,Za as Ri,_ as Hs,_a as q,aa as Me,ab as Or,ba as Ln,bb as Fr,ca as Ut,cb as J,da as Ai,db as ou,ea as Ei,eb as ve,fa as $t,fb as iu,ga as Ue,gb as cn,ha as Mr,hb as su,ia as _i,ib as au,ja as Ti,jb as lu,ka as Le,kb as Be,la as Ps,lb as Y,ma as Kr,mb as cu,na as _s,nb as du,oa as Ts,ob as ds,pa as Ur,pb as us,qa as ns,qb as ps,ra as bi,rb as fs,s as Mt,sa as rs,sb as Pt,t as ts,ta as os,tb as Pe,u as H,ua as is,ub as W,v as Rt,va as Gr,vb as Qi,w as x,wa as Li,wb as Dr,x as St,xa as Ii,xb as _t,y as w,ya as S,yb as z,z as B,za as Br,zb as Ht}from"../chunks/index-6fvz7zfr.js";var vu=["-h","--help"];function E(e,t){let n=Object.entries(e.booleans??{}),r=Object.entries(e.values??{}),o=Object.entries(e.lists??{}),i=Object.fromEntries(n.map(([g])=>[g,!1])),s={},a=Object.fromEntries(o.map(([g])=>[g,[]])),l=[],c=[],d=!1,m=-1;for(let[g,u]of t.entries()){if(g<=m)continue;if(u==="--"){l.push(...t.slice(g+1));break}if(vu.includes(u)){d=!0;continue}let p=n.find(([,L])=>L.includes(u));if(p){i[p[0]]=!0;continue}let f=r.find(([,L])=>L.includes(u));if(f){let L=t[g+1];if(L===void 0||L.startsWith("-")){c.push(`${u} requires a value`);continue}s[f[0]]=L,m=g+1;continue}let b=o.find(([,L])=>L.includes(u));if(b){let L=t.slice(g+1),h=L.findIndex((v)=>v.startsWith("-")),R=L.slice(0,h===-1?L.length:h);if(R.length===0){c.push(`${u} requires at least one value`);continue}a[b[0]]=[...a[b[0]]??[],...R],m=g+R.length;continue}if(u.startsWith("-")){c.push(`Unknown option for ${e.label}: ${u}`);continue}if(e.positionals==="tail"){l.push(...t.slice(g));break}l.push(u)}if(e.positionals!=="list"&&e.positionals!=="tail")c.push(...l.map((g)=>`Unexpected argument for ${e.label}: ${g}`));return{flags:i,values:s,lists:a,positionals:l,help:d,errors:c}}function fe(e){for(let t of e)console.error(t);return e.length>0}import{readdirSync as bp,statSync as ys,unlinkSync as Lp}from"node:fs";import{basename as vs,dirname as wp,join as kp,resolve as xp}from"node:path";function F(e){return Array.from(e,(t)=>{let n=t.charCodeAt(0);if(n<=31||n>=127&&n<=159)return`\\x${n.toString(16).padStart(2,"0")}`;return t}).join("")}var mr=(e)=>{let t=Date.now()-new Date(e).getTime();if(!Number.isFinite(t))return"";let n=Math.floor(t/60000),r=Math.floor(n/60),o=Math.floor(r/24);if(o>0)return`${o}d ago`;if(r>0)return`${r}h ago`;if(n>0)return`${n}m ago`;return"just now"},rt=(e)=>{let t=(e??"").trim().split(/\s+/).filter((o)=>o&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(o)),n=t[0]?.split("/").pop();if(!n)return null;let r=t[1];return r&&/^[a-z][a-z0-9-]*$/.test(r)?`${n} ${r}`:n};import{existsSync as bu,readdirSync as Lu,readFileSync as wu}from"node:fs";import{join as ku}from"node:path";function Ce(e,t){try{return Lu(e,{withFileTypes:!0,encoding:"utf8"}).flatMap((n)=>{let r=ku(e,n.name);if(n.isDirectory())return Ce(r,t);if(n.name.endsWith(".jsonl"))return[r];return[]})}catch{if(t&&bu(e))t.count++;return[]}}function gr(e){let t=(o)=>`${o.sessionId}
|
|
3
3
|
${rt(o.segment||o.command)}`,n=e.filter((o)=>o.decision!=="allow"),r=n.filter((o)=>o.sessionId).reduce((o,i)=>o.set(t(i),(o.get(t(i))??0)+1),new Map);return new Set(n.filter((o)=>o.failureStage||(r.get(t(o))??0)>=2))}var xu=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function Cu(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(typeof t.ts!=="string"||typeof t.command!=="string")return!1;return xu.every((n)=>t[n]===void 0||typeof t[n]==="string")}function Fe(e,t){try{return wu(e,"utf-8").split(`
|
|
4
4
|
`).filter(Boolean).flatMap((n)=>{try{let r=JSON.parse(n);if(!Cu(r)){if(t)t.count++;return[]}return[r]}catch{if(t)t.count++;return[]}})}catch{if(t)t.count++;return[]}}import{resolve as cp}from"node:path";var Su=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function hi(e){let t=0,n={allocateSegment(){return t++},getNextSegmentIndex(){return t},recordGlobal(r){e.record({kind:"step",scope:"global",step:r})},recordSegment(r,o=n.currentSegmentIndex){if(o===void 0)return;e.record({kind:"step",scope:"segment",segmentIndex:o,step:r})}};return n}function yi(e={}){let t=[],n=e.maxEvents??512,r={maxTextLength:e.maxTextLength??2048,maxListLength:e.maxListLength??128,maxObjectProperties:e.maxObjectProperties??e.maxListLength??128,maxDepth:e.maxDepth??16},o=0,i,s=new Set;return{record(a){if(i)return;try{if(!a||t.length>=n){o++;return}t.push(yr(Ru(a,r,s)))}catch{o++}},finish(a){if(i)return i;try{i=yr({events:Object.freeze(t),droppedEvents:o,terminal:Du(a,r,s)})}catch{o++,i=Object.freeze({events:Object.freeze(t),droppedEvents:o,terminal:Object.freeze({result:"blocked",reason:"trace unavailable".slice(0,r.maxTextLength),segment:"trace unavailable".slice(0,r.maxTextLength)})})}return i}}}function Ru(e,t,n){if(e.kind!=="step")throw TypeError("invalid trace event");let{scope:r,step:o}=e;pn(o,n,t);let i=ot(o,t,n);if(r==="global")return{kind:"step",scope:"global",step:i};if(r!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:e.segmentIndex,step:i}}function Du(e,t,n){let r=e.result;if(r==="allowed")return Object.freeze({result:"allowed"});if(r!=="blocked")throw TypeError("invalid trace terminal");let o=e.ruleId;return Object.freeze({result:"blocked",reason:ot(e.reason,t,n),segment:ot(e.segment,t,n),...o?{ruleId:ot(o,t,n)}:{}})}function pn(e,t,n,r=0,o=new WeakSet){if(typeof e==="string"){let a=e.slice(0,n.maxTextLength);if(!vr(a))return;for(let l of gi(a))for(let c of l.match(/[^\s"'()$]+/g)??[])t.add(vi(c));return}if(!e||typeof e!=="object"||r>=n.maxDepth||o.has(e))return;if(o.add(e),Array.isArray(e)){let a=Math.min(e.length,n.maxListLength);for(let l=0;l<a;l++)pn(e[l],t,n,r+1,o);return}let i=0,s=new Set;for(let a in e){if(!Object.hasOwn(e,a))continue;if(i>=n.maxObjectProperties)break;i++,pn(a,t,n);let l=hr(a,n,t);if(s.has(l))continue;s.add(l),pn(e[a],t,n,r+1,o)}}function ot(e,t,n,r=0,o=new WeakSet){if(typeof e==="string")return hr(e,t,n);if(!e||typeof e!=="object")return e;if(r>=t.maxDepth)return;if(o.has(e))return;if(o.add(e),Array.isArray(e)){let a=[],l=Math.min(e.length,t.maxListLength);for(let c=0;c<l;c++)a.push(ot(e[c],t,n,r+1,o));return a}let i={},s=0;for(let a in e){if(!Object.hasOwn(e,a))continue;if(s>=t.maxObjectProperties)break;s++;let l=hr(a,t,n);if(Object.hasOwn(i,l))continue;Object.defineProperty(i,l,{value:ot(e[a],t,n,r+1,o),enumerable:!0,configurable:!0,writable:!0})}return i}function hr(e,t,n){let r=e.slice(0,t.maxTextLength),o=vr(r)?mi(r):r,i=n.size>0?Au(o,n):o;return(Pu(i)?fi(i):i).slice(0,t.maxTextLength)}function Pu(e){return e.includes("PRIVATE KEY")||e.includes("://")||e.includes("eyJ")||e.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(e)||e.length>=14&&Su.some((t)=>e.includes(t))||e.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(e)}function Au(e,t){return e.replace(/[^\s"'()$]+/g,(n)=>t.has(vi(n))?"<redacted>":n)}function vi(e){let t=2166136261,n=2166136261;for(let r=0;r<e.length;r++)t=Math.imul(t^e.charCodeAt(r),16777619),n=Math.imul(n^e.charCodeAt(e.length-r-1),16777619);return`${t>>>0}:${n>>>0}:${e.length}`}function yr(e){if(e&&typeof e==="object"&&!Object.isFrozen(e)){for(let t of Object.values(e))yr(t);Object.freeze(e)}return e}function ki(e,t,n){let r=n??bi(),o=r.getCommandProgram(e,t.shell??"auto"),i=yi(),s=hi(i),a=o.dialect==="powershell"?r.getCommandProgram(e,"posix"):o,l=Li(a);s.recordGlobal({type:"parse",input:e,segments:l.map((m)=>[...m])});let c=wi(e,{...t,analyzePartialProgram:!0,trace:s},o,r),d=s.getNextSegmentIndex();if(c&&d>0&&d<l.length)s.recordSegment({type:"segment-skipped",index:d,reason:"prior-segment-blocked"},d);return Object.freeze({decision:c,trace:i.finish(c?{result:"blocked",reason:c.reason,segment:c.evidence.find((m)=>m.kind==="command")?.segment??e,...c.ruleId?{ruleId:c.ruleId}:{}}:{result:"allowed"})})}import{resolve as Eu}from"node:path";function br(e){let t=xi().safeParse(e);return{errors:t.success?[]:Si(t.error.issues),ruleNames:new Set(Ci(e).map((n)=>n.toLowerCase()))}}function Lr(e){let t=Di(e);if(!t.ok)return t.result;return br(t.parsed)}function Di(e){let t=[],n=new Set;try{let r=typeof e==="string"?St(e):e,o=w(r);if(o===null)return t.push(`File not found: ${r.path}`),{ok:!1,result:{errors:t,ruleNames:n}};if(!o.trim())return t.push("Config file is empty"),{ok:!1,result:{errors:t,ruleNames:n}};return{ok:!0,parsed:JSON.parse(o)}}catch(r){if(r instanceof H)return t.push(r.message),{ok:!1,result:{errors:t,ruleNames:n}};let o=r instanceof Error?r.message:String(r);return t.push(r instanceof SyntaxError?"Invalid JSON":o),{ok:!1,result:{errors:t,ruleNames:n}}}}function Pi(e){return Eu(e??process.cwd(),".safety-net.json")}function me(e){let t=Di(e);if(!t.ok)return t.result;let n=Ri(t.parsed);return{errors:n.errors,ruleNames:n.sources}}import{join as _r,resolve as Gu}from"node:path";import{dirname as mn}from"node:path";var _u="custom.";function fn(e){if(e.rulebook_version!==2)return[];let t=e.rules.map((n)=>({name:n.name,command:n.command,block_args:[],match:n.match,reason:n.reason,intent:n.intent}));return(e.tests??[]).flatMap((n,r)=>{let o=wr(Ti(n.command));if(o.length===0)return[`tests[${r}]: could not parse fixture command: ${n.command}`];let i=o.reduce((s,a)=>s??Ii(a,t)?.id.slice(_u.length),void 0);if(n.expect==="blocked"){if(i===n.rule)return[];let s=i?`"${i}" matched first`:"no rule matched";return[`tests[${r}]: expected "${n.rule}" to block "${n.command}" but ${s}`]}return i?[`tests[${r}]: expected "${n.command}" to be allowed but "${i}" matched`]:[]})}function wr(e){return e.nodes.flatMap((t)=>{if(t.kind==="group"||t.kind==="function")return wr(t.body);if(t.kind!=="command")return[];let n=_i(Ei(t.dialect,t.words)).words.map(Ai);return[...n.length>0?[n]:[],...t.nested.flatMap((r)=>wr(r))]})}var Tu=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;function $i(e,t){let n=ji(e.rules,t);if(n.length>0)return{ok:!0,specs:n};return Fi(e.rules,t)}function Oi(e,t){let n=ji(e,t);if(n.length>0)return{ok:!0,specs:n};let r=$u(e,t);if(r.length>0)return{ok:!0,specs:r};let o=Ou(e,t);if(!o.ok)return o;if(o.specs.length>0)return{ok:!0,specs:o.specs};return Fi(e,t)}function Fi(e,t){let n=e.filter((r)=>Cr(r)?.name===t);if(n.length===1)return{ok:!0,specs:n};return Iu(t,n)}function Iu(e,t){return{ok:!1,result:{ok:!1,errors:t.length===0?[`No configured rulebook matches ${e}`]:[`Ambiguous rulebook match ${e}: ${t.join(", ")}`],entries:[]}}}function ji(e,t){return e.filter((n)=>n===t)}function $u(e,t){let n=t.match(Tu),r=n?.[1],o=n?.[2],i=n?.[3];if(!r||!o||!i||!Ne(i))return[];return Ni(e,(s)=>s.owner===r&&s.repo===o&&s.ref===i)}function Ou(e,t){if(!Se(t))return{ok:!0,specs:[]};let[n,r]=t.split("/"),o=Ni(e,(s)=>s.owner===n&&s.repo===r);if(new Set(o.map((s)=>Cr(s)?.ref).filter((s)=>!!s)).size<2)return{ok:!0,specs:o};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${t}. Use an explicit ref:`,` cc-safety-net rule remove ${t}#<ref>`],entries:[]}}}function Cr(e){try{return je(e)}catch{return null}}function Ni(e,t){return e.filter((n)=>{let r=Cr(n);return r?t(r):!1})}var Bi=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function Hi(e,t,n=Rt(mn(mn(t)),"rules policy"),r=ge()){if(re(e))return Hu(e,r);return Nu(e,t,n)}async function qi(e,t,n,r,o,i){if(!re(e))return Hi(e,t,n,r);let s=o?null:Fu(e,t,n);if(s)return s;if(!o&&!i)throw Error(`${e} is not vendored; run rule update ${e} to vendor it`);return Hi(e,t,n,r)}function Fu(e,t,n=Rt(mn(mn(t)),"rules policy")){let r=je(e),o=Re(t,r.name),i=w(x(n,o));if(i===null)return null;let s=Pt(Rr(i,`Invalid rulebook ${o}.`));if(s.name!==r.name)throw Error(`rulebook name "${s.name}" in ${o} must match "${r.name}"`);return{spec:e,rulebook:s,content:i}}async function Vi(e,t={}){if(!Se(e))throw Error(`Invalid GitHub repository source: ${e}`);let[n,r]=e.split("/");if(!n||!r)throw Error(`Invalid GitHub repository source: ${e}`);if(t.ref!==void 0&&!Ne(t.ref))throw Error(`GitHub rulebook refs must use valid path segments: ${t.ref}`);let o=t.operation??ge(),i=t.ref??await ju(n,r,e,o),s=await Ki(n,r,i,e,o),a=await gn(`https://api.github.com/repos/${n}/${r}/git/trees/${s}?recursive=1`,"tree",o),l=a.response;if(!l.ok)throw Error(`Failed to inspect ${e}: GitHub tree returned ${l.status}`);let c=JSON.parse(a.content);if(!Array.isArray(c?.tree))throw Error(`Failed to inspect ${e}: unexpected GitHub tree response`);let d=c.tree,m=[...new Set(d.flatMap((g)=>{if(!g||typeof g!=="object")return[];let u=g;if(u.type!=="blob"||typeof u.path!=="string")return[];let p=u.path.match(kr);return p?.[1]?[p[1]]:[]}))].sort();if(m.length===0)throw Error(`No rulebooks found in ${e} under ${Dt}/`);return{source:e,owner:n,repo:r,ref:i,commit:s,names:m}}async function ju(e,t,n,r){let o=await gn(`https://api.github.com/repos/${e}/${t}`,"metadata",r),i=o.response;if(!i.ok)throw Error(`Failed to inspect ${n}: GitHub returned ${i.status}`);let a=JSON.parse(o.content)?.default_branch;if(typeof a!=="string"||a==="")throw Error(`Failed to inspect ${n}: missing default branch`);if(!Ne(a))throw Error(`GitHub returned an invalid default branch: ${a}`);return a}function Nu(e,t,n){xr(e);let r=Re(t,e),o=w(x(n,r));if(o===null)throw Error(`Rulebook source not found: ${e}`);let i=zi(Rr(o,"Invalid local rulebook source."));if(i.name!==e)throw Error(`rulebook name "${i.name}" must match local source "${e}"`);return{spec:e,rulebook:i,content:o}}async function Hu(e,t){let n=je(e),r=await Ki(n.owner,n.repo,n.ref,e,t),o=await gn(`https://raw.githubusercontent.com/${n.owner}/${n.repo}/${r}/${n.path}`,"raw",t),i=o.response;if(!i.ok)throw Error(`Failed to fetch ${e}: GitHub raw returned ${i.status}`);let s=o.content,a=zi(Rr(s,"Invalid GitHub rulebook response."));if(a.name!==n.name)throw Error(`rulebook name "${a.name}" must match GitHub source "${n.name}"`);return{spec:e,rulebook:a,content:s}}function zi(e){let t=Pt(e),n=fn(t);if(n.length>0)throw Error(n.join("; "));return t}function Rr(e,t){try{return JSON.parse(e)}catch{throw Error(t)}}async function Ki(e,t,n,r,o){let i=await gn(`https://api.github.com/repos/${e}/${t}/commits/${encodeURIComponent(n)}`,"commit",o),s=i.response;if(!s.ok)throw Error(`Failed to resolve ${r}: GitHub returned ${s.status}`);let a=JSON.parse(i.content);if(typeof a?.sha!=="string"||a.sha==="")throw Error(`Failed to resolve commit for ${r}`);return a.sha}async function Mu(e,t,n={}){if(n.signal?.aborted)throw n.signal.reason;let r=n.budget??Sr(),o=new AbortController,i=()=>o.abort(n.signal?.reason);n.signal?.addEventListener("abort",i,{once:!0});let s=!1,a=setTimeout(()=>{if(o.signal.aborted)return;s=!0,o.abort()},n.timeoutMs??Bi.timeoutMs);try{if(n.signal?.aborted)throw n.signal.reason;Ui(r);let l=await(n.fetch??fetch)(e,{signal:o.signal,redirect:"error"});if(!l.ok)return Ji(l),{response:l,content:""};return{response:l,content:await Uu(l,t,r,()=>o.abort())}}catch(l){if(s)throw Error("GitHub request timed out",{cause:l});if(n.signal?.aborted)throw n.signal.reason;throw l}finally{clearTimeout(a),n.signal?.removeEventListener("abort",i)}}function gn(e,t,n){return Mu(n.resolveUrl?.(e)??e,t,{budget:n.budget,signal:n.controller.signal})}async function Uu(e,t,n=Sr(),r){let o=Bi[`${t}Bytes`],i=Number(e.headers.get("content-length"));if(Number.isFinite(i)&&i>o)throw Ji(e),Error(`GitHub ${t} response exceeds ${o} bytes`);if(!e.body)return"";let s=e.body.getReader(),a=[],l=0;while(!0){let c=await s.read();if(c.done)break;try{Gi(n,c.value.byteLength)}catch(d){throw r?.(),Mi(s),d}if(l+=c.value.byteLength,l>o)throw r?.(),Mi(s),Error(`GitHub ${t} response exceeds ${o} bytes`);a.push(Buffer.from(c.value))}return Buffer.concat(a,l).toString("utf-8")}function Ji(e){if(!e.body)return;Wi(()=>e.body?.cancel())}function Mi(e){Wi(()=>e.cancel())}function Wi(e){try{Promise.resolve(e()).catch(()=>{})}catch{}}async function Tt(e={}){let t=Ir(e);return Bu(t,await hn(t,ge()))}function Bu(e,t){if(!t.ok)return t;let n=U(e),r=[...new Set(W(n.configPath,n.filesystemScope))];if(r.length===0)return t;return{ok:!1,errors:r,entries:t.entries}}async function hn(e,t,n={},r=new Set,o=new Set){try{let i=U(e),s=Er(i.configTarget);if(!s.ok)return s.result;let a=s.config;if(e.check)return ip(a,i,e);let l=e.only?$i(a,e.only):{ok:!0,specs:a.rules};if(!l.ok)return l.result;let c=new Set([...e.refresh?l.specs:[],...r]),d=(v)=>qi(v,i.configDir,i.filesystemScope,t,c.has(v),!e.refresh||c.has(v)),m=await ep(a.rules,e.refresh?(v)=>d(v).then((D)=>({ok:!0,item:D})).catch((D)=>{if(Xi(D))throw D;return{ok:!1,spec:v,message:D instanceof Error?D.message:String(D)}}):async(v)=>({ok:!0,item:await d(v)}),t),g=m.filter((v)=>!v.ok),u=m.filter((v)=>v.ok).map((v)=>v.item),p=u.flatMap((v)=>qu(v,a.rules)),f=u.flatMap((v)=>Vu(v,o,i)),b=new Set([...p,...f].map((v)=>v.spec)),L=[...g,...p,...f],h=[],R=Ku(h,()=>u.flatMap((v)=>b.has(v.spec)||L.length>0&&o.has(v.spec)?[]:zu(v,i,n,h)));return{ok:L.length===0,errors:L.map((v)=>`Failed to update ${v.spec}: ${v.message}`),entries:u.map(Wu),changes:R}}catch(i){return Et(i)}}function qu(e,t){if(!re(e.spec))return[];let n=Dr(e.spec),r=t.filter((o)=>o!==e.spec&&Dr(o).toLowerCase()===n.toLowerCase());if(r.length===0)return[];return[{ok:!1,spec:e.spec,message:`rulebook name "${n}" is also claimed by ${r.join(", ")}; rename one of them`}]}function Vu(e,t,n){if(!t.has(e.spec)||!re(e.spec))return[];let r=Re(n.configDir,e.rulebook.name),o=w(x(n.filesystemScope,r));if(o===null||o===e.content)return[];return[{ok:!1,spec:e.spec,message:`${r} already exists and no configured source claims it; remove or rename the file, then re-run rule add`}]}function zu(e,t,n,r){if(!re(e.spec))return[];let o=Re(t.configDir,e.rulebook.name),i=x(t.filesystemScope,o),s=w(i);if(s===e.content)return[];return r?.push({target:i,previous:s}),B(i,e.content,void 0,n._testAfterPolicyRename),Ju(e,s)}function Ku(e,t){try{return t()}catch(n){for(let r of[...e].reverse()){if(r.previous===null){he(r.target);continue}B(r.target,r.previous)}throw n}}function Ju(e,t){if(t===null)return[`Vendored ${e.spec} (${e.rulebook.version})`];let n=_t(t),r="problem"in n?null:n.rulebook,o=new Map(r?.rules.map((s)=>[s.name,JSON.stringify(s)])??[]),i=new Set(e.rulebook.rules.map((s)=>s.name));return[`Updated ${e.spec} (${r?.version??"unreadable"} -> ${e.rulebook.version})`,...[...i].filter((s)=>!o.has(s)).map((s)=>` + ${s}`),...[...o.keys()].filter((s)=>!i.has(s)).map((s)=>` - ${s}`),...e.rulebook.rules.filter((s)=>{let a=o.get(s.name);return a!==void 0&&a!==JSON.stringify(s)}).map((s)=>` ~ ${s.name}`)]}function Wu(e){return{spec:e.spec,name:e.rulebook.name,version:e.rulebook.version,ruleCount:e.rulebook.rules.length}}async function Tr(e,t={}){return Yu(e,np(t),ge())}async function Yu(e,t,n,r={}){let o=null,i=!1;try{let s=U(t),a=w(s.configTarget);o={target:s.configTarget,content:a};let l=Er(s.configTarget);if(!l.ok)return l.result;let c=l.config,d=Se(e);Zu(e,t,d);let m=d?await Vi(e,{ref:t.ref,operation:n}):null,g=m?Xu(m,t.rulebooks):[],u=m?g.map((h)=>Qu(c.rules,m,h)??`${e}#${m.ref}/${h}`):[e],p=u.filter((h)=>!c.rules.includes(h)),f=[...c.rules,...p];if(f.length>Pr)return tp();if(f.length!==c.rules.length)i=!0,J(s.configTarget,{version:1,rules:f,overrides:c.overrides??{},transparent_wrappers:c.transparent_wrappers??[]},void 0,r._testAfterPolicyRename);let b=await hn(t,n,r,new Set(p),new Set(p));if(!b.ok)At(s.configTarget,a);if(!b.ok||!m)return b;let L=g.filter((h,R)=>p.includes(u[R]??""));return{...b,add:{source:e,ref:m.ref,selected:g,added:L,alreadyConfigured:g.filter((h)=>!L.includes(h)),commits:p.length>0?[m.commit]:[]}}}catch(s){if(i&&o)try{At(o.target,o.content)}catch(a){return Et(a)}return Et(s)}}function Zu(e,t,n){if(!n&&t.rulebooks!==void 0)throw Error("--only can only select rulebooks from an owner/repo source");if(!n&&t.ref)throw Error(`--ref can only select a ref for an owner/repo source: ${e}`);if(t.rulebooks?.length===0)throw Error("--only requires at least one rulebook name");let r=t.rulebooks?.filter((o)=>!De.test(o))??[];if(r.length>0)throw Error(`Invalid rulebook names: ${r.join(", ")}`)}function Xu(e,t){let n=t?[...new Set(t)]:e.names,r=n.filter((o)=>!e.names.includes(o));if(r.length>0)throw Error(`Rulebooks not found in ${e.source} at ${e.ref}: ${r.join(", ")}
|
|
5
5
|
Available rulebooks: ${e.names.join(", ")}`);return n}function Qu(e,t,n){let r=`${t.source}#${t.ref}/${n}`;if(e.includes(r))return r;let o=`${t.source}#${t.commit}/${n}`;return e.find((i)=>i===o)}async function ep(e,t,n=ge()){if(e.length>Pr)throw Error(Ar);let r=Array(e.length),o=0,i,s=Array.from({length:Math.min(e.length,Zi.concurrency)},async()=>{while(!i){let a=o;if(a>=e.length)return;o++;try{r[a]=await t(e[a],a,n.controller.signal)}catch(l){if(!i)i={value:l},o=e.length,n.controller.abort(l);return}}});if(await Promise.all(s),i)throw i.value;return r}function tp(){return{ok:!1,errors:[Ar],entries:[]}}function Ir(e){return{cwd:e.cwd,userConfigDir:e.userConfigDir,userConfigPath:e.userConfigPath,projectConfigPath:e.projectConfigPath,global:e.global,check:e.check,only:e.only,refresh:e.refresh}}function np(e){return{...Ir(e),ref:e.ref,rulebooks:e.rulebooks}}function rp(e){return{...Ir(e),deleteSource:e.deleteSource}}async function $r(e,t={}){try{return await op(e,rp(t),{})}catch(n){return Et(n)}}async function op(e,t,n){let r=U(t),o=q(r.configTarget);if(o.errors.length>0)return{ok:!1,errors:o.errors,entries:[]};if(!o.config)return{ok:!1,errors:[`No config found at ${r.configPath}`],entries:[]};let i=Oi(o.config.rules,e);if(!i.ok)return i.result;let s=t.deleteSource?sp(r.configDir,i.specs,r.filesystemScope):{ok:!0,dirs:[]};if(!s.ok)return s.result;let a=w(r.configTarget);if(a===null)return Et(Error("Rules config is unavailable."));try{J(r.configTarget,{version:1,rules:o.config.rules.filter((d)=>!i.specs.includes(d)),overrides:o.config.overrides??{},transparent_wrappers:o.config.transparent_wrappers??[]},void 0,n._testAfterPolicyRename)}catch(d){throw At(r.configTarget,a),d}let l=await hn(t,ge(),n);if(!l.ok)return At(r.configTarget,a),l;let c=ap(s.dirs,n,r.filesystemScope);if(!c.ok){At(r.configTarget,a);let d=await hn(t,ge(),n);if(!d.ok)return{ok:!1,errors:[...c.result.errors,...d.errors],entries:d.entries};return c.result}return l}async function ip(e,t,n){let r=Qi(e,t.configDir,n.global?"user":"project",t.filesystemScope);return{ok:r.errors.length===0&&r.warnings.length===0,errors:[...r.errors,...r.warnings],entries:r.entries}}function sp(e,t,n){let r=t.flatMap((a)=>De.test(a)?[]:["--delete-source can only delete local rulebook sources"]),o=t.map((a)=>_r(e,a)),i=r.length>0?[]:o.flatMap((a)=>es(a,n)),s=[...r,...i];return s.length>0?{ok:!1,result:{ok:!1,errors:s,entries:[]}}:{ok:!0,dirs:o}}function es(e,t){let n=Gu(e),r=x(t,n),o=it(r);if(!o)return[`Local rulebook source directory not found: ${e}`];let i=o.find((s)=>s.name==="rulebook.json");if(!i)return[`Local rulebook source directory is missing rulebook.json: ${e}`];if(i.kind!=="file")throw new H(t.label);if(w(x(t,_r(n,"rulebook.json"))),o.length>1)return[`Local rulebook source directory contains extra files: ${e}. delete manually if you really want to remove the directory.`];return[]}function ap(e,t,n){let r=e.flatMap((o)=>{try{if(!it(x(n,o)))return[];let i=es(o,n);if(i.length>0)return i;return lp(o,t,n),[]}catch(i){return[`Failed to delete local rulebook source ${o}: ${i instanceof Error?i.message:String(i)}`]}});return r.length>0?{ok:!1,result:{ok:!1,errors:r,entries:[]}}:{ok:!0}}function lp(e,t,n){if(t._testDeleteLocalSourceDir){t._testDeleteLocalSourceDir(e);return}he(x(n,_r(e,yn))),Yi(x(n,e))}function At(e,t){if(t===null){he(e);return}B(e,t)}function Et(e){return{ok:!1,errors:[e instanceof Error?e.message:String(e)],entries:[]}}function at(e,t){let n=up(t),r=ss(n),o={effectiveLevel:r.effectiveLevel,selectedPreset:n.policySnapshot.policy.safety.level??"standard",...n.policySnapshot.policyScopes?{safetyPresetScope:n.policySnapshot.policyScopes.levelScope}:{},effectiveCapabilities:r.effectiveCapabilities,destructiveCommandRuleOverrides:n.policySnapshot.policy.destructiveCommandRuleOverrides},{configSource:i,configValid:s}=dp({cwd:t?.cwd,userConfigDir:t?.userConfigDir});if(!e||!e.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:i,configValid:s,...o};let a=pp(e,n);if(a)return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:a.rule,matched:!0,reason:a.reason}]}]},result:"blocked",reason:V(a.reason),segment:V(a.target),...a.ruleId?{ruleId:V(a.ruleId)}:{},configSource:i,configValid:s,...o};let l=ki(e,n),c=l.decision,d=c?.ruleId??fp(e,n),m=$t.find((u)=>u.id===d&&u.activationCapability),g=m?r.policy.effectiveDestructiveCommandRules[m.id]:void 0;return{trace:gp(l.trace),result:c?"blocked":"allowed",reason:c?V(c.reason):void 0,segment:c?V(c.evidence.find((u)=>u.kind==="command")?.segment??e):void 0,ruleId:c?.ruleId?V(c.ruleId):void 0,customRule:mp(hp(c?.ruleId,n.policySnapshot)),configSource:i,configValid:s,...o,...m&&g?{ruleActivation:{id:m.id,...g}}:{}}}function dp(e){let t=oe(e?.cwd),n=e?.userConfigPath??ie(e),r=Ae({cwd:e?.cwd,userConfigDir:e?.userConfigDir,userConfigPath:e?.userConfigPath});try{if(w(r.projectConfigTarget)!==null){if(me(r.projectConfigTarget).errors.length===0)return{configSource:t,configValid:!0};return{configSource:t,configValid:!1}}}catch(o){if(o instanceof H)return{configSource:t,configValid:!1};throw o}try{if(w(r.userConfigTarget)!==null){let o=me(r.userConfigTarget);return{configSource:n,configValid:o.errors.length===0}}return{configSource:null,configValid:!0}}catch(o){if(o instanceof H)return{configSource:n,configValid:!1};throw o}}function up(e){let t=cp(e?.cwd??process.cwd()),n=e?.policySnapshot??z({cwd:t,userConfigDir:e?.userConfigDir}),r=ye(n.policy);return{cwd:t,effectiveCwd:t,policySnapshot:n,environment:ts(),protectedGitMetadata:is([t]),effectiveCapabilities:r.capabilities,strict:e?.strict??r.strict,paranoidRm:r.paranoidRm,paranoidInterpreters:r.paranoidInterpreters,worktreeMode:r.worktreeMode}}function pp(e,t){let n=t.cwd??process.cwd(),r=ns(st("",{command:e},{kind:"command",shell:"posix"},{executionCwd:n,configCwd:n},e)),o=us(r);if(o)return{reason:ds,target:o.target,ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};let i=cs(r);if(i)return{reason:ls,target:i.target,ruleId:"policy-apply-protection",rule:"policy-apply-protection:findPolicyApplyInvocationInSemanticFacts"};let s=os(r,t.protectedGitMetadata);if(s)return{reason:rs,target:s.target,ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};let a=t.policySnapshot.policy,l=a.secretProtection.enabled===!1?null:fs(r,a.secretProtection,{strict:t.strict});if(l)return{reason:ps,target:l.target,ruleId:l.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"};return null}function fp(e,t){let n=t.policySnapshot.policy,r=Ot({...n,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...n.destructiveCommandRuleOverrides,...Object.fromEntries($t.flatMap((o)=>o.activationCapability?[[o.id,"on"]]:[]))}},t.policySnapshot.state==="degraded"?{diagnostics:t.policySnapshot.diagnostics,reason:t.policySnapshot.reason}:void 0);return as(e,{...t,policySnapshot:r,strict:!0,paranoidRm:!0,paranoidInterpreters:!0})?.ruleId}function mp(e){if(!e)return;return{id:V(e.id),...e.rulebook?{rulebook:{name:V(e.rulebook.name),version:V(e.rulebook.version)}}:{},...e.source?{source:V(e.source)}:{},...e.override?{override:{type:"reason",reason:V(e.override.reason)}}:{}}}function gp(e){let t=e.events.flatMap((r)=>r.kind==="step"&&r.scope==="global"?[r.step]:[]),n=new Map;for(let r of e.events){if(r.kind!=="step"||r.scope!=="segment")continue;let o=n.get(r.segmentIndex)??{index:r.segmentIndex,steps:[]};o.steps.push(r.step),n.set(r.segmentIndex,o)}return{steps:t,segments:[...n.values()]}}function hp(e,t){let n=e?.replace(/^custom\./,"");if(!n||!t.policy.rules.some((r)=>r.name===n))return;return t.ruleMetadata[n]??Object.freeze({id:n})}import{existsSync as gs,readFileSync as yp}from"node:fs";function ms(e,t){return{"safety.level":e.safety.level,...jr("safety.overrides",e.safety.overrides),"workflow.worktree_mode":String(e.workflow.worktree_mode),"destructive_command_protection.enabled":String(e.destructive_command_protection.enabled),...jr("destructive_command_protection.overrides",e.destructive_command_protection.overrides),"destructive_command_protection.allow_paths":Nr(e.destructive_command_protection.allow_paths),"secret_protection.enabled":String(e.secret_protection.enabled),...jr("secret_protection.overrides",e.secret_protection.overrides),"secret_protection.deny_paths":Nr(e.secret_protection.deny_paths),"secret_protection.allow_paths":Nr(e.secret_protection.allow_paths),...t?{"audit.retention_days":String(e.audit.retention_days)}:{}}}function Ft(e,t,n){let r=ms(e,n),o=ms(t,n);return[...new Set([...Object.keys(r),...Object.keys(o)])].flatMap((i)=>r[i]===o[i]?[]:[{field:i,before:r[i],after:o[i]}])}function lt(e){let t=ve(e);if(!gs(t))return{baseline:Y(globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__),diagnostics:[]};let n=_e(t);return{baseline:Y(n.value),diagnostics:n.errors.length>0?n.errors:Ee(n.value)}}function _e(e){if(!gs(e))return{errors:[`${e}: file not found`]};try{return{value:JSON.parse(yp(e,"utf-8")),errors:[]}}catch(t){let n=t instanceof Error?t.message:String(t);return{errors:[`${e}: ${t instanceof SyntaxError?`Invalid JSON: ${n}`:n}`]}}}function jt(e,t){let n=vp(e)?e:{};return{version:t.version,...Object.fromEntries(["safety","workflow","destructive_command_protection","secret_protection"].filter((r)=>n[r]!==void 0).map((r)=>[r,n[r]]))}}function jr(e,t){return Object.fromEntries(Object.entries(t).flatMap(([n,r])=>r===void 0?[]:[[`${e}.${n}`,String(r)]]))}function Nr(e){return e.length===0?"(none)":e.join(", ")}function vp(e){return!!e&&typeof e==="object"&&!Array.isArray(e)}function Cp(e){let t=ct(),n=E({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},e);if(fe(n.errors))return null;if(n.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(n.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let r=n.values.limit===void 0?20:hs(n.values.limit);if(r===null)return console.error("--limit must be a positive number"),null;let o=n.values.since===void 0?Math.min(30,t):hs(n.values.since);if(o===null||o>t)return console.error(`--since must be a positive number of days no greater than ${t}`),null;let i={limit:r,limitExplicit:n.values.limit!==void 0,since:o,sinceExplicit:n.values.since!==void 0,all:n.flags.all,json:n.flags.json,suspect:n.flags.suspect,pruneLegacy:n.flags.pruneLegacy,dryRun:n.flags.dryRun,id:n.values.id,agent:n.values.agent,rule:n.values.rule,session:n.values.session,project:n.values.project===void 0?void 0:xp(n.values.project)};if(i.id&&(i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.sinceExplicit||i.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(i.pruneLegacy&&(i.id!==void 0||i.agent!==void 0||i.rule!==void 0||i.session!==void 0||i.project!==void 0||i.suspect||i.all||i.sinceExplicit||i.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(i.dryRun&&!i.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return i}async function bs(e,t={}){let n=Cp(e);if(!n)return 1;let r=t.logsDir??be();if(n.pruneLegacy)return Sp(r,n.json,n.dryRun);if(!r)return console.log(n.json?"[]":n.id?`No retained audit log entry found for id ${F(n.id)}.`:"No audit log entries found."),0;He(r);let o={count:0},i=Ce(r,o).flatMap((d)=>Fe(d,o).map((m)=>({entry:m,file:d})));if(o.count>0)console.error(`warning: ${o.count} audit log ${o.count===1?"source":"sources"} could not be read; these results are incomplete`);if(n.id)return Ap(i,n,t.timeZone);let s=Date.now()-n.since*24*60*60*1000,a=i.filter((d)=>Ep(d,n,r,s)),l=n.suspect?gr(a.map((d)=>d.entry)):null,c=(l?a.filter((d)=>l.has(d.entry)):a).sort((d,m)=>Date.parse(m.entry.ts)-Date.parse(d.entry.ts)).slice(0,n.limit);if(n.json)return console.log(JSON.stringify(c.map((d)=>d.entry),null,2)),0;if(c.length===0)return console.log("No audit log entries found."),0;for(let d of c)console.log(Ip(d.entry,t.timeZone));return 0}function Sp(e,t,n){let r=e?Dp(e).map((a)=>kp(e,a)):[];if(n)return Rp(r,t);let o=[],i=0,s=0;for(let a of r){let l=ys(a,{throwIfNoEntry:!1})?.size??0,c=Pp(a);if(c){o.push(`${vs(a)}: ${c}`);continue}i++,s+=l}if(t)return console.log(JSON.stringify({removedFiles:i,removedBytes:s,failedFiles:o.length})),o.length===0?0:1;console.log(i===0&&o.length===0?"No legacy audit log files found.":`Removed ${i} legacy audit log ${i===1?"file":"files"} (${Ls(s)}).`);for(let a of o)console.error(`Could not remove ${F(a)}`);if(console.log("Nested v2 audit logs were not changed."),i>0)console.log("This deletion cannot be undone.");return o.length===0?0:1}function Rp(e,t){let n=e.reduce((r,o)=>r+(ys(o,{throwIfNoEntry:!1})?.size??0),0);if(t)return console.log(JSON.stringify({dryRun:!0,files:e.length,bytes:n})),0;if(console.log(e.length===0?"No legacy audit log files found.":`Would remove ${e.length} legacy audit log ${e.length===1?"file":"files"} (${Ls(n)}).`),console.log("Nested v2 audit logs are not included."),e.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Dp(e){try{return bp(e,{withFileTypes:!0}).filter((t)=>t.isFile()&&t.name.endsWith(".jsonl")).map((t)=>t.name)}catch{return[]}}function Pp(e){try{return Lp(e),null}catch(t){return t instanceof Error?t.message:String(t)}}function Ls(e){let t=["B","KiB","MiB","GiB"],n=Math.min(Math.floor(Math.log2(Math.max(e,1))/10),t.length-1);return`${Math.round(e/1024**n*10)/10} ${t[n]}`}function Ap(e,t,n){let r=e.filter((i)=>i.entry.id===t.id);if(r.length>1)return console.error(`Multiple audit log entries found for id ${F(t.id??"")}.`),1;if(t.json)return console.log(JSON.stringify(r.map((i)=>i.entry),null,2)),0;let o=r[0];if(!o)return console.log(`No retained audit log entry found for id ${F(t.id??"")}.`),0;return console.log($p(o.entry,n)),0}function Ep(e,t,n,r){if(!t.all&&e.entry.decision==="allow")return!1;if(Date.parse(e.entry.ts)<r)return!1;if(t.agent!==void 0&&e.entry.agent!==t.agent)return!1;if(t.rule!==void 0&&e.entry.ruleId!==t.rule)return!1;if(t.session!==void 0&&!_p(e,n,t.session))return!1;if(t.project!==void 0&&!Tp(e.entry.cwd,t.project))return!1;return!0}function _p(e,t,n){if(e.entry.sessionId===n)return!0;return wp(e.file)===t&&vs(e.file,".jsonl")===n}function Tp(e,t){if(!e)return!1;return e===t||e.startsWith(`${t}/`)}function Ip(e,t){let n=F(e.id??"-"),r=F(e.decision??"deny"),o=e.cwd?` [${F(e.cwd)}]`:"",i=e.segment||e.command,s=i===e.command?"":"↳ ",a=i.length>50?`${i.slice(0,50)}…`:i;return`${n.padEnd(16)} ${F(ws(e.ts,t))} ${r.padEnd(5)} ${F(e.agent??"-").padEnd(15)} ${F(e.ruleId??"-").padEnd(20)} ${s}${F(a)}${o}`}function $p(e,t){let n=(o)=>F(o===void 0||o===null||o===""?"-":o),r=e.shape?`${e.agent??"-"} (shape: ${e.shape})`:e.agent??"-";return[`id: ${n(e.id)}`,`ts: ${n(ws(e.ts,t))}`,`decision: ${n(e.decision)}`,`agent: ${n(r)}`,`level: ${n(e.level)}`,`tool: ${n(e.toolName)}`,`rule: ${n(e.ruleId)}`,`intent: ${n(e.intent)}`,`stage: ${n(e.failureStage)}`,`error: ${n(e.errorCode)}`,`session: ${n(e.sessionId)}`,`cwd: ${n(e.cwd)}`,`version: ${n(e.v)}`,`truncated: ${n(e.truncated===!0?"yes":void 0)}`,`reason: ${n(e.reason)}`,`command: ${n(e.command)}`,`segment: ${n(e.segment)}`].join(`
|
|
@@ -19,7 +19,7 @@ Available rulebooks: ${e.names.join(", ")}`);return n}function Qu(e,t,n){let r=`
|
|
|
19
19
|
`)}function Dn(e){return Ve({rows:e})}function La(e){let t=[];return t.push("System Info"),t.push(Q2(e)),t.join(`
|
|
20
20
|
`)}function Q2(e){let t=["Component","Version"],n=(i)=>{if(i===null)return y.dim("not found");return i},o=[{label:"cc-safety-net",value:e.version},...wn.map((i)=>({label:P(i),value:e.versions[i]??null})),{label:"Node.js",value:e.nodeVersion},{label:"npm",value:e.npmVersion},{label:"Bun",value:e.bunVersion},{label:"Platform",value:e.platform}].map((i)=>[i.label,n(i.value)]);return Ve({headers:t,rows:o})}function wa(e){if(e.findings.length===0)return y.green(`
|
|
21
21
|
No findings from inspected doctor facts.`);let t={error:e.findings.filter((i)=>i.severity==="error").length,warning:e.findings.filter((i)=>i.severity==="warning").length,info:e.findings.filter((i)=>i.severity==="info").length},n=["error","warning","info"].filter((i)=>t[i]>0).map((i)=>`${t[i]} ${i}`),r=e.findings.length===1?"finding":"findings",o=`
|
|
22
|
-
${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return y.red(o);if(t.warning>0)return y.yellow(o);return y.blue(o)}import{lstatSync as ef}from"node:fs";import{dirname as no}from"node:path";function ro(e,t){try{let n=ef(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function ka(e){let t=be();return{directories:[ro("policy",no(no(e))),ro("config",no(e)),...t?[ro("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as tf}from"node:child_process";import{existsSync as xa}from"node:fs";import{delimiter as nf,extname as rf,join as of}from"node:path";import{stripVTControlCharacters as Ca}from"node:util";var Ra="2.3.
|
|
22
|
+
${e.findings.length} ${r}: ${n.join(", ")}.`;if(t.error>0)return y.red(o);if(t.warning>0)return y.yellow(o);return y.blue(o)}import{lstatSync as ef}from"node:fs";import{dirname as no}from"node:path";function ro(e,t){try{let n=ef(t);if(n.isSymbolicLink())return{kind:e,path:t,status:"unsafe",issues:["symlink"]};if(!n.isDirectory())return{kind:e,path:t,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:e,path:t,status:"unknown",issues:[]};let r=[...n.uid!==process.getuid()?["ownership"]:[],...(n.mode&18)!==0?["permissions"]:[]];return{kind:e,path:t,status:r.length>0?"unsafe":"safe",issues:r}}catch(n){if(typeof n==="object"&&n!==null&&"code"in n&&n.code==="ENOENT")return{kind:e,path:t,status:"not-applicable",issues:[]};return{kind:e,path:t,status:"unknown",issues:[]}}}function ka(e){let t=be();return{directories:[ro("policy",no(no(e))),ro("config",no(e)),...t?[ro("audit",t)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as tf}from"node:child_process";import{existsSync as xa}from"node:fs";import{delimiter as nf,extname as rf,join as of}from"node:path";import{stripVTControlCharacters as Ca}from"node:util";var Ra="2.3.1",sf=5000,af="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function I(){return Ra}function oo(e,t){let n=e[t];if(n)return n;let r=Object.keys(e).find((o)=>o.toLowerCase()===t.toLowerCase()&&!!e[o]);return r?e[r]:n}function lf(e){return(oo(e,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((t)=>t.length>0)}function cf(e,t){let n=rf(e)?[e]:[...lf(t).map((r)=>`${e}${r}`),e];if(e.includes("/")||e.includes("\\"))return n.find((r)=>xa(r))??e;return(oo(t,"PATH")??"").split(nf).flatMap((r)=>n.map((o)=>of(r,o))).find((r)=>xa(r))??e}function Sa(e){if(!/[\s"&|<>^]/.test(e))return e;return`"${e.replace(/"/g,'""')}"`}function ze(e,t){let[n,...r]=e,o=t[af]==="win32"?"win32":process.platform;if(!n||o!=="win32")return{cmd:n??"",args:r};let i=cf(n,t);if(!/\.(?:bat|cmd)$/i.test(i))return{cmd:i,args:r};return{cmd:oo(t,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Sa(i),...r.map(Sa)].join(" ")]}}var pt=async(e,t=sf)=>{let n=await df(e,{timeoutMs:t});if(n.code!==0)return null;return Ca(n.stdout).trim()||Ca(n.stderr).trim()||null};function df(e,t){let[n,...r]=e;if(!n)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((o)=>{try{let i=ze([n,...r],process.env),s=tf(i.cmd,i.args,{stdio:["ignore","pipe","pipe"]}),a=!1,l="",c="";s.stdout.on("data",(g)=>{l+=g.toString()}),s.stderr.on("data",(g)=>{c+=g.toString()});let d=(g)=>{if(a)return;a=!0,clearTimeout(m),o(g)},m=setTimeout(()=>{s.kill(),d({code:null,stdout:l,stderr:c})},t.timeoutMs);s.on("close",(g)=>{d({code:g,stdout:l,stderr:c})}),s.on("error",()=>{d({code:null,stdout:l,stderr:c})})}catch{o({code:null,stdout:"",stderr:""})}})}function Pn(e){if(!e)return null;let t=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(e);if(t)return t[1]??null;let n=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(e);if(n)return n[1]??null;return e.split(`
|
|
23
23
|
`)[0]?.trim()||null}async function qt(e=pt){let[t,n,r,o,i,s]=await Promise.all([Promise.all(X.map(async(a)=>[a.id,Pn(await e([...a.probeCommand]))])),e(["codex","plugin","list"],30000),e(["amp","plugins","list"],30000),e(["node","--version"]),e(["npm","--version"]),e(["bun","--version"])]);return{version:Ra,versions:Object.fromEntries(t),codexPluginListOutput:n,ampPluginListOutput:r,nodeVersion:Pn(o),npmVersion:Pn(i),bunVersion:Pn(s),platform:`${process.platform} ${process.arch}`}}function io(e,t){if(t==="dev")return!1;let n=e.split(".").map(Number),r=t.split(".").map(Number),[o=0,i=0,s=0]=n,[a=0,l=0,c=0]=r;if(o!==a)return o>a;if(i!==l)return i>l;return s>c}async function Te(){let e=I(),t=new AbortController,n=setTimeout(()=>t.abort(),3000);try{let r=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:t.signal});if(!r.ok)return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${r.status}`};let o=await r.json(),i=io(o.version,e);return{currentVersion:e,latestVersion:o.version,updateAvailable:i}}catch(r){return{currentVersion:e,latestVersion:null,updateAvailable:!1,error:r instanceof Error?r.message:"Network error"}}finally{clearTimeout(n)}}import*as $a from"node:readline";var Ea=(e)=>`\x1B[${e}B`,uf=(e)=>`\x1B[${e}A`;var Da=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function pf(e){return new Promise((t)=>setTimeout(t,e))}function ff(e,t,n){if(!n)return t(e);if(n.aborted)return Promise.resolve();return new Promise((r,o)=>{let i=()=>n.removeEventListener("abort",s),s=()=>{i(),r()};n.addEventListener("abort",s,{once:!0}),t(e).then(()=>{i(),r()},(a)=>{i(),o(a)})})}function Vt(e,t){return e&&e>0?e:t}function An(e){return Math.max(0,Math.min(1,e))}function ft(e){return Math.max(0,Math.min(255,Math.round(e)))}function so(e){return e<=0.0031308?12.92*e:1.055*e**0.4166666666666667-0.055}function mf(e,t,n){let r=n*Math.PI/180,o=t*Math.cos(r),i=t*Math.sin(r),s=(e+0.3963377774*o+0.2158037573*i)**3,a=(e-0.1055613458*o-0.0638541728*i)**3,l=(e-0.0894841775*o-1.291485548*i)**3;return{blue:ft(so(An(-0.0041960863*s-0.7034186147*a+1.707614701*l))*255),green:ft(so(An(-1.2684380046*s+2.6097574011*a-0.3413193965*l))*255),red:ft(so(An(4.0767416621*s-3.3077115913*a+0.2309699292*l))*255)}}function ao(e,t){let n=(t*e*180/Math.PI%360+360)%360;return mf(0.72,0.15,n)}function _a(e,t=0.1){let n=ao(t,e);return`\x1B[38;2;${n.red};${n.green};${n.blue}m`}function gf(e,t){return{blue:ft(e.blue+(255-e.blue)*t),green:ft(e.green+(255-e.green)*t),red:ft(e.red+(255-e.red)*t)}}function Ta(e,t,n){let r=Math.imul(e+2654435769,2246822507)^Math.imul(t+3266489909,668265263)^Math.imul(n+374761393,2654435761),o=r^r>>>15,i=Math.imul(o,739982445),s=i^i>>>12,a=Math.imul(s,695872825);return((a^a>>>15)>>>0)/4294967296}function hf(e,t,n){let r=Math.floor(Ta(e,t,n)*Da.length);return Da[r]??"░"}function Pa(e){let t=An(e);return t*t*t*(t*(t*6-15)+10)}function yf(e){if(e.length===0)return"";let t=[],n=!1,r="";for(let o of e){let i=`${o.red};${o.green};${o.blue}`;if(o.bold!==n)t.push(o.bold?"\x1B[1m":"\x1B[22m"),n=o.bold;if(i!==r)t.push(`\x1B[38;2;${i}m`),r=i;t.push(o.character)}return`${t.join("")}\x1B[22m\x1B[39m`}function vf(e,t,n,r,o){return e.map((i,s)=>({...ao(n,r+t+s/o),bold:!1,character:i}))}function bf(e,t,n,r,o,i,s,a){let l=Math.max(1,r*0.75),c=Math.min(1,n/l),d=o*Pa(c),m=Math.max(0,(n-l)/Math.max(1,r-l)),g=(1-Pa(n/r))*a*2,u=0.35*Math.max(0,1-m*2),p=c>=1,f=Math.min(e.length,Math.ceil(d+2+1));return e.slice(0,f).map((b,L)=>{let h=ao(i,s+t+L/a+g),R=L+Ta(t,L,7919)*2-1;if(R>d+2)return{...h,bold:!1,character:" "};let v=d-R,D=0.8*Math.exp(-(v*v)/12.5),ne=Math.min(0.9,D+u),un=!p&&R>d-4;return{...gf(h,ne),bold:ne>0.3,character:un?hf(t,L,n):b}})}function Aa(e){return`\x1B[?2026h${e.map((t,n)=>`\x1B8${n>0?Ea(n):""}${yf(t)}`).join("")}\x1B[?2026l`}async function lo(e,t={}){if(!e)return;let n=t.output??process.stdout,r=t.sleep??pf,o=Vt(t.frequency,0.1),i=t.seed??0,s=Vt(t.speed,40),a=Vt(t.spread,3),l=Vt(t.frameRate,60),c=Math.max(1,Math.floor(Vt(t.duration,12))),d=e.split(`
|
|
24
24
|
`).map((f)=>Array.from(f)),m=Math.max(...d.map((f)=>f.length)),g=1000*c*d.filter((f)=>f.length>0).length/s,u=m>0?Math.max(1,Math.ceil(g/(1000/l))):0,p=u>0?g/u:0;n.write(`\x1B[?25l${d.length>1?`${`
|
|
25
25
|
`.repeat(d.length-1)}${uf(d.length-1)}`:""}\x1B7`);try{for(let f=1;f<=u;f+=1){if(t.signal?.aborted)break;n.write(Aa(d.map((b,L)=>bf(b,L,f,u,m,o,i,a)))),await ff(p,r,t.signal)}}finally{if(n.write(Aa(d.map((f,b)=>vf(f,b,o,i,a)))),n.write("\x1B8"),d.length>1)n.write(Ea(d.length-1));n.write(`
|
|
@@ -188,7 +188,7 @@ ${a()}`.trim())))}),i.on("close",(d)=>{if(clearTimeout(c),d!==0){r(Error(Ro(e,d,
|
|
|
188
188
|
`));return{path:n??rg(e),alreadyInstalled:!1}}function pc(e){let t=[],n=Zn(e.homeDir),r=["opencode.json","opencode.jsonc"];for(let o of r){let i=pg(n,o);if(dg(i))try{let s=ug(i,"utf-8"),a=K(s);if((JSON.parse(a).plugin??[]).some((m)=>m.includes("cc-safety-net")))return{platform:"opencode",status:"configured",method:"plugin array",configPath:i,errors:t.length>0?t:void 0}}catch(s){t.push(`Failed to parse ${o}: ${s instanceof Error?s.message:String(s)}`)}}return{platform:"opencode",status:"n/a",errors:t.length>0?t:void 0}}import{join as fg}from"node:path";function Oo(e){return fg(e,".pi","agent","settings.json")}function Fo(e){if(typeof e!=="string")return!1;return e==="npm:cc-safety-net"||e.startsWith("npm:cc-safety-net@")}function fc(e){let t=Oo(e.homeDir),n=ce(t);if(n.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(n.kind==="missing")return{platform:"pi",status:"n/a"};let r=k(n.value,"packages");if(!Array.isArray(r))return{platform:"pi",status:"n/a"};let o=r.find((a)=>Fo(typeof a==="string"?a:k(a,"source")));if(o===void 0)return{platform:"pi",status:"n/a"};let i=k(o,"extensions");if(Array.isArray(i)&&i.some((a)=>typeof a==="string"&&a.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:t,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:t}}var gg={amp:qa,"antigravity-cli":Va,"claude-code":Wa,codex:Ya,"copilot-cli":al,cursor:gl,"gemini-cli":hl,"grok-build":Rl,"hermes-agent":Nl,"kimi-code":Qt,openclaw:Xl,opencode:pc,pi:fc};function vt(e,t){let n={...t,cwd:e,homeDir:t?.homeDir??mg()};return wn.map((r)=>hg(gg[r](n)))}function hg(e){if(e.status==="not-inspected")return{platform:e.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:e.platform,detected:e.status!=="n/a",configured:e.status==="configured",inspectionStatus:e.status!=="n/a"?"verified":e.errors&&e.errors.length>0?"failed":"not-applicable",method:e.method,configPath:e.configPath,configPaths:e.configPaths,errors:e.errors}}import{tmpdir as yg}from"node:os";import{join as vg}from"node:path";var bg=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),Lg=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),wg={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function mc(){let e=vg(yg(),"cc-safety-net-self-test"),t=bg.map((n)=>{let r=bn(st("self-test",{command:n.command},{kind:"command",shell:"auto"},{configCwd:e,executionCwd:e},n.command),{guard:{dependencies:{loadPolicySnapshot:()=>Lg,getModes:()=>wg,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),o=n.expectBlocked?"blocked":"allowed",i=r.decision.kind==="deny"?"blocked":"allowed";return{command:n.command,description:n.description,expected:o,actual:i,passed:o===i,reason:r.decision.kind==="deny"?r.decision.reason:void 0,ruleId:r.decision.kind==="deny"?r.decision.ruleId:void 0}});return{passed:t.filter((n)=>n.passed).length,failed:t.filter((n)=>!n.passed).length,total:t.length,results:t}}function jo(e){let t=E({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},e);if(fe(t.errors))return null;return{json:t.flags.json,skipUpdateCheck:t.flags.skipUpdateCheck}}async function gc(e={}){let t=await Kt(!e.json,()=>{let n=kg(e);return{ready:n,finish:()=>n}},()=>zt(),{loadingMessage:"Checking system status…"});if(e.json)console.log(JSON.stringify(t,null,2));else xg(t);return t.engineSelfTest.failed>0||t.findings.some((n)=>n.severity==="error")?1:0}async function kg(e){let t=e.cwd??process.cwd(),n=await qt(),r=vt(t,{ampPluginListOutput:n.ampPluginListOutput,codexPluginListOutput:n.codexPluginListOutput,copilotCliVersion:n.versions["copilot-cli"]}),o=aa(t),i=la(),s=z({cwd:t}),a=s.policy,l=ye(a),c=Ue(a,l.capabilities),d=Sn(7),m=Ha(t),g=e.skipUpdateCheck?{currentVersion:I(),latestVersion:null,updateAvailable:!1}:await Te(),u={hooks:r,engineSelfTest:mc(),userConfig:o.userConfig,projectConfig:o.projectConfig,configState:Ht(s),effectiveRules:o.effectiveRules,shadowedRules:o.shadowedRules,environment:i,effectiveSafety:{selectedPreset:a.safety.level??"standard",level:l.effectiveLevel,capabilities:l.capabilities,ruleOverrides:a.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(c).filter(([,p])=>p.source==="rule_override"&&p.override==="off"&&p.inheritedEnabled&&p.changesInherited).map(([p])=>p),ruleCounts:{stored:Object.keys(a.destructiveCommandRuleOverrides).length,effective:Object.values(c).filter((p)=>p.changesInherited).length},...s.policyScopes?{policyScopes:s.policyScopes}:{}},...m.length>0?{v2Leftovers:m}:{},posture:ka(o.userConfig.path),activity:d,update:g,system:n};return{...u,findings:da(u)}}function xg(e){console.log(),console.log(pa(e.hooks)),console.log(),console.log(fa(e.engineSelfTest)),console.log(),console.log(ma(e)),console.log(),console.log(ga(e.environment)),console.log(),console.log(ha(e)),console.log(),console.log(ya(e.findings)),console.log(),console.log(va(e.activity)),console.log(),console.log(La(e.system)),console.log(),console.log(ba(e.update)),console.log(wa(e))}import{existsSync as Cg}from"node:fs";var Sg=/^[A-Za-z0-9_@%+=:,./-]+$/,hc="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function No(e){let t=E({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},e);if(fe(t.errors))return console.error(hc),console.error("Pass -- before a command that starts with dashes."),null;if(t.values.cwd!==void 0&&!Cg(t.values.cwd))return console.error(`Error: --cwd path does not exist: ${t.values.cwd}`),null;let n=t.positionals.length===1?t.positionals[0]:t.positionals.map((r)=>Sg.test(r)?r:`'${r.replaceAll("'","'\\''")}'`).join(" ");if(!n)return console.error("Error: No command provided"),console.error(hc),null;return{json:t.flags.json,cwd:t.values.cwd,command:n}}function yc(e){if(e)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function vc(e,t){let r=t-18;return[`${e.dtl}${e.dh.repeat(t)}${e.dtr}`,`${e.dv} Command Analysis${" ".repeat(r)}${e.dv}`,`${e.dbl}${e.dh.repeat(t)}${e.dbr}`]}function Ho(e){return JSON.stringify(e)}function bc(e,t=0){return`[${e.map((r,o)=>ua(r,o,t)).join(",")}]`}function nn(e,t,n=70){let r=e.split(" "),o=[],i="";for(let s of r)if(i&&i.length+s.length+1>n)o.push(i),i=s;else i=i?`${i} ${s}`:s;if(i)o.push(i);return o.map((s,a)=>a===0?s:`${t}${s}`)}function Lc(e,t,n){let r=[];switch(e.type){case"parse":return null;case"env-strip":return r.push(""),r.push(`STEP ${t} ${n.h} Strip environment variables`),r.push(` Removed: ${e.envVars.map((o)=>`${o}=<redacted>`).join(", ")}`),r.push(` Tokens: ${Ho(e.output)}`),{lines:r,incrementStep:!0};case"leading-tokens-stripped":return r.push(""),r.push(`STEP ${t} ${n.h} Strip wrappers`),r.push(` Removed: ${e.removed.join(", ")}`),r.push(` Tokens: ${Ho(e.output)}`),{lines:r,incrementStep:!0};case"shell-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Detect shell wrapper`),r.push(` Wrapper: ${e.wrapper} -c`),r.push(` Inner: ${e.innerCommand}`),{lines:r,incrementStep:!0};case"interpreter":{if(r.push(""),r.push(`STEP ${t} ${n.h} Detect interpreter`),r.push(` Interpreter: ${e.interpreter}`),r.push(` Code: ${e.codeArg}`),e.paranoidBlocked)r.push(" Result: ✗ BLOCKED (paranoid mode)");return{lines:r,incrementStep:!0}}case"busybox":return r.push(""),r.push(`STEP ${t} ${n.h} Busybox wrapper`),r.push(` Subcommand: ${e.subcommand}`),{lines:r,incrementStep:!0};case"transparent-wrapper":return r.push(""),r.push(`STEP ${t} ${n.h} Transparent wrapper`),r.push(` Wrapper: ${e.wrapper}`),r.push(` Tokens: ${Ho(e.output)}`),{lines:r,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(r.push(""),r.push(`STEP ${t} ${n.h} Match rules`),r.push(` Rule: ${e.rule}()`),e.matched)r.push(" Result: MATCHED");else r.push(" Result: No match");return{lines:r,incrementStep:!0}}case"worktree-relaxation":return r.push(""),r.push(`STEP ${t} ${n.h} Worktree relaxation`),r.push(` Mode: ${S.worktree.name}`),r.push(` Git cwd: ${e.gitCwd}`),r.push(" Result: Allowed local discard in linked worktree"),{lines:r,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(e.embeddedCommandFound)return r.push(""),r.push(`STEP ${t} ${n.h} Fallback scan`),r.push(` Found: ${e.embeddedCommandFound}`),{lines:r,incrementStep:!0};return null}case"custom-rules-check":{if(e.rulesChecked){if(r.push(""),r.push(`STEP ${t} ${n.h} Custom rules`),e.matched)r.push(" Result: MATCHED");else r.push(" Result: No match");return{lines:r,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(e.matched)return r.push(""),r.push(`STEP ${t} ${n.h} Dangerous text check`),r.push(` Token: ${e.token}`),r.push(" Result: MATCHED"),{lines:r,incrementStep:!0};return null}case"strict-unparseable":return r.push(""),r.push(`STEP ${t} ${n.h} Strict mode check`),r.push(` Command: ${e.rawCommand}`),r.push(" Result: ✗ UNPARSEABLE"),{lines:r,incrementStep:!0};case"segment-skipped":return null;case"error":return r.push(""),r.push(`ERROR: ${e.message}`),{lines:r,incrementStep:!1};default:return e}}function Mo(e,t){let n=yc(t?.asciiOnly??!1),r=58,o=[],i=1;o.push(...vc(n,58)),o.push("");let s=e.trace.steps.find((p)=>p.type==="error");if(s&&s.type==="error"){o.push("ERROR"),o.push(` ${s.message}`),o.push(""),o.push("RESULT"),o.push(` Status: ${e.result==="blocked"?y.red("BLOCKED"):y.green("ALLOWED")}`),o.push(""),o.push("CONFIG");let p=e.configSource??"none";return o.push(` Path: ${p}`),o.join(`
|
|
189
189
|
`)}let a=e.trace.steps.find((p)=>p.type==="parse");if(a&&a.type==="parse"){o.push("INPUT"),o.push(` ${a.input}`),o.push(""),o.push(`STEP ${i} ${n.h} Split shell commands`),i++;for(let p=0;p<a.segments.length;p++){let f=a.segments[p];if(f){let b=Math.random();o.push(` Segment ${p+1}: ${bc(f,b)}`)}}}let l=e.trace.segments,c=l.length>1;for(let p of l){if(c){o.push("");let h="";if(a&&a.type==="parse"){let fr=a.segments[p.index];if(fr)h=fr.join(" ")}let R=54,v=h,D=` Segment ${p.index+1}: `,ne=" ";if(h){if(D.length+h.length+ne.length>R){let yu=R-D.length-ne.length;v=`${h.substring(0,yu-1)}…`}}let un=h?`${D}${v}${ne}`:` Segment ${p.index+1} `,gu=h?`${D}${y.cyan(v)}${ne}`:un,ui=58-un.length,pi=Math.floor(ui/2),hu=ui-pi;o.push(`${n.sh.repeat(pi)}${gu}${n.sh.repeat(hu)}`)}if(p.steps.find((h)=>h.type==="segment-skipped")){o.push(""),o.push(" (skipped — prior segment blocked)");continue}let b=!1,L=!1;for(let h of p.steps){let R=Lc(h,i,n);if(R){if(L=!0,h.type==="recurse"){o.push("");let v=" RECURSING ",D=58-v.length-4;o.push(` ${n.tl}${n.h}${v}${n.h.repeat(D)}`),o.push(` ${n.v}`),b=!0;continue}for(let v of R.lines)if(b)o.push(` ${n.v} ${v}`);else o.push(v);if(R.incrementStep)i++}}if(b)o.push(` ${n.v}`),o.push(` ${n.bl}${n.h.repeat(56)}`),b=!1;if(!L)o.push(""),o.push(` ${y.green("✓")} Allowed (no matching rules)`)}if(o.push(""),o.push("RESULT"),e.result==="blocked"){if(o.push(` Status: ${y.red("BLOCKED")}`),e.customRule){if(o.push(` Rule: ${e.customRule.id}`),e.customRule.rulebook)o.push(` Rulebook: ${e.customRule.rulebook.name} ${e.customRule.rulebook.version}`);if(e.customRule.source)o.push(` Source: ${e.customRule.source}`);if(e.customRule.override)o.push(` Override: reason ${e.customRule.override.reason}`)}if(e.reason){let p=nn(e.reason," ");o.push(` Reason: ${p[0]}`);for(let f=1;f<p.length;f++)o.push(p[f]??"")}}else o.push(` Status: ${y.green("ALLOWED")}`);o.push(""),o.push("CONFIG");let d=e.configSource??"none",m=e.configValid?"":" (invalid)";o.push(` Path: ${d}${m}`);let g=e.safetyPresetScope;o.push(` Safety preset: ${e.selectedPreset??"standard"}${g?` (${Rn(g)})`:""}`),o.push(` Effective capabilities: ${e.effectiveLevel}`);let u=Object.entries(e.destructiveCommandRuleOverrides??{});if(o.push(` Rule customizations: ${u.length}`),e.ruleActivation)o.push(` Rule activation: ${e.ruleActivation.id} — ${e.ruleActivation.enabled?"on":"off"} via ${e.ruleActivation.source}`);return o.join(`
|
|
190
190
|
`)}function Uo(e){return JSON.stringify(e,null,2)}function wc(e){return new Promise((t)=>{process.stdout.write(`${e}
|
|
191
|
-
`,()=>t())})}async function kc(e){let t=No(e);if(!t)return 1;try{let n=at(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await wc(t.json?Uo(n):Mo(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof Ur)&&!(n instanceof Me)&&!(n instanceof Le))throw n;if(t.json)return await wc(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var xc="2.3.
|
|
191
|
+
`,()=>t())})}async function kc(e){let t=No(e);if(!t)return 1;try{let n=at(t.command,{cwd:t.cwd}),r=!!process.env.NO_COLOR||!process.stdout.isTTY;return await wc(t.json?Uo(n):Mo(n,{asciiOnly:r})),0}catch(n){if(!(n instanceof Ur)&&!(n instanceof Me)&&!(n instanceof Le))throw n;if(t.json)return await wc(JSON.stringify({error:n.message})),1;return console.error(n.message),1}}var xc="2.3.1",te=" ",Ye="cc-safety-net";function Cc(e){return e.argument?`${e.flags} ${e.argument}`:e.flags}function Rg(e){return Math.max(...e.map((t)=>Cc(t).length))}function Dg(e){return Math.max(...e.map((t)=>t.usage.length))}function Pg(e){return Math.max(...e.map((t)=>`${Ye} ${t.usage}`.length))}function Ag(e,t){let n=`${Ye} ${e.usage}`;return`${te}${n.padEnd(t+2)}${e.description}`}function xe(e,t){return`${te}${e.padEnd(Math.max(40,e.length+2))}${t}`}function bt(e,t=console.log){let n=[];if(n.push(`${Ye} ${e.name}`),n.push(""),n.push(`${te}${e.description}`),n.push(""),n.push("USAGE:"),n.push(`${te}${Ye} ${e.usage}`),n.push(""),e.subcommands&&e.subcommands.length>0){n.push("SUBCOMMANDS:");let r=Dg(e.subcommands);for(let o of e.subcommands)n.push(`${te}${o.usage.padEnd(r+2)}${o.description}`);n.push("")}if(e.options.length>0){n.push("OPTIONS:");let r=Rg(e.options);for(let o of e.options){let i=Cc(o),s=o.default?`${o.description} (default: ${o.default})`:o.description;n.push(`${te}${i.padEnd(r+2)}${s}`)}n.push("")}if(e.examples&&e.examples.length>0){n.push("EXAMPLES:");for(let r of e.examples)n.push(`${te}${r}`)}t(n.join(`
|
|
192
192
|
`))}function Go(){let e=Pg(xn),t=[];t.push(`${Ye} v${xc}`),t.push(""),t.push("Blocks destructive commands and secret access."),t.push(""),t.push("COMMANDS:");for(let n of xn)t.push(Ag(n,e));t.push(""),t.push("GLOBAL OPTIONS:"),t.push(`${te}-h, --help Show help (use with command for command-specific help)`),t.push(`${te}-V, --version Show version`),t.push(""),t.push("HELP:"),t.push(`${te}${Ye} help <command> Show help for a specific command`),t.push(`${te}${Ye} <command> --help Show help for a specific command`),t.push(""),t.push("ENVIRONMENT VARIABLES:"),t.push(xe(`${S.level.name}=standard|strict|paranoid`,"Set session safety level")),t.push(xe(`${S.worktree.name}=1`,"Allow local git discards in linked worktrees")),t.push(xe(`${S.debug.name}=1`,"Print diagnostic messages to stderr")),t.push(xe(`${S.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),t.push(xe("CC_SAFETY_NET_HOME","Override rule config home directory")),t.push(""),t.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),t.push(xe(`${S.strict.name}=1`,"Force safety.overrides.fail_closed on")),t.push(xe(`${S.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),t.push(xe(`${S.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),t.push(xe(`${S.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),t.push(""),t.push("Documentation: https://ccsafetynet.com/docs"),console.log(t.join(`
|
|
193
193
|
`))}function Sc(){console.log(xc)}function rn(e,t=console.log){let n=Cn(e);if(!n)return!1;if(n.name.toLowerCase()!==e.toLowerCase())return!1;return bt(n,t),!0}import{existsSync as ei,readFileSync as yd}from"node:fs";import{homedir as Rh,tmpdir as Dh}from"node:os";import{join as Xo}from"node:path";import*as $e from"node:readline";function Eg(e){return e==="install"?"Install":"Uninstall"}function _g(e){return e==="install"?"Installing":"Uninstalling"}function Tg(e){return e==="install"?"into":"from"}function Pc(e){return e?.available===!0}function Ig(e,t){let n=new Set(t);return e.filter((r)=>n.has(r.target)).map((r)=>r.target)}function Rc(e,t,n){if(e.length===0||e.every((r)=>!r.available))return t;return Array.from({length:e.length},(r,o)=>o+1).map((r)=>(t+r*n+e.length)%e.length).find((r)=>Pc(e[r]))}function $g(e,t,n){if(n.ctrl&&n.name==="c")return"interrupt";if(n.name==="escape"||t==="q")return"abort";if(e==="install"&&(t==="u"||t==="U"))return"update";if(n.name==="up"||t==="k")return"up";if(n.name==="down"||t==="j")return"down";if(n.name==="space"||t===" ")return"toggle";if(n.name==="return"||n.name==="enter")return"confirm";return null}function Og(e){return{cursor:e.findIndex((t)=>t.available),selected:[]}}function Fg(e,t,n){if(n==="confirm"||n==="update"||n==="abort"||n==="interrupt")return{state:e,done:n};if(n==="up")return{state:{...e,cursor:Rc(t,e.cursor,-1)}};if(n==="down")return{state:{...e,cursor:Rc(t,e.cursor,1)}};let r=t[e.cursor];if(!Pc(r))return{state:e};let o=e.selected.includes(r.target)?e.selected.filter((i)=>i!==r.target):Ig(t,[...e.selected,r.target]);return{state:{...e,selected:o}}}var Ac="◉",Ec="◯",_c=">",Tc=" ";function jg(e,t,n,r={}){let o=r.color!==!1,i=o?y.dim:(l)=>l,s=o?y.green:(l)=>l,a=o?y.bold:(l)=>l;return["",`${Eg(e)} CC Safety Net ${Tg(e)}:`,"",...t.map((l,c)=>{let d=n.selected.includes(l.target),m=c===n.cursor,g=d?Ac:Ec,u=m?_c:Tc,p=l.available?"":` (${l.unavailableReason??"not installed"})`,f=`${g} ${l.label}${p}`,b=!l.available?i(f):d?s(f):m?a(f):f;return`${u} ${b}`}),"",e==="install"?"Space: select Enter: confirm u: update installed Up/Down: move q/Esc: cancel":t.some((l)=>l.available)?"Space: select Enter: confirm Up/Down: move q/Esc: cancel":`No selectable integrations found for ${e}. q/Esc: close`].join(`
|
|
194
194
|
`)}var Dc=["global-hook","plugin"];function Ng(e,t,n={}){let r=n.color!==!1?y.bold:(i)=>i;return["","Install the Kimi Code integration as:","",...[`Global hook — ${t?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((i,s)=>{let a=s===e,l=`${a?Ac:Ec} ${i}`;return`${a?_c:Tc} ${a?r(l):l}`}),"","Enter: confirm Up/Down: move q/Esc: cancel"].join(`
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import{$ as Y,Bb as h,Cb as W,N as F,Q as O,aa as _,ka as m,pa as U,q as C,r as w}from"./index-
|
|
2
|
-
`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.3.
|
|
1
|
+
import{$ as Y,Bb as h,Cb as W,N as F,Q as O,aa as _,ka as m,pa as U,q as C,r as w}from"./index-6fvz7zfr.js";import{lstatSync as N,readdirSync as J,readFileSync as x,rmdirSync as X,statSync as v,unlinkSync as q,utimesSync as ee,writeFileSync as te}from"node:fs";import{dirname as ne,join as u}from"node:path";var A=86400000,re=".last-prune",ie=/^\d{4}-\d{2}$/,oe=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,k=(e)=>Math.floor(e/A);function ae(e){try{let n=u(ne(O(e)),F),t=JSON.parse(x(n,"utf-8"));return w(t?.audit?.retention_days)}catch{return C}}function R(e,n=()=>new Date){try{let t=n().getTime();if(!v(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=u(e,re),i=v(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&k(i)===k(t))return;let o=t-ae()*A,s=new Date(t).toISOString().slice(0,7);for(let a of p(e)){if(a.isDirectory()){se(u(e,a.name),o,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))ce(u(e,a.name),o)}te(r,"",{mode:384}),ee(r,t/1000,t/1000)}catch{}}function se(e,n,t){for(let r of p(e)){if(!r.isDirectory()||!ie.test(r.name))continue;let i=u(e,r.name);for(let o of p(i)){if(!o.isFile())continue;let s=oe.exec(o.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(a)||a>=n)continue;L(u(i,o.name))}if(r.name!==t)T(i)}T(e)}function ce(e,n){try{let t=N(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
|
|
2
|
+
`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.3.1",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
|
|
3
3
|
`,{encoding:"utf-8",mode:384}),R(c,o.now)}catch{}}function l(e,n){return{value:e.slice(0,n),truncated:e.length>n}}function Z(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let n=e||Ee()||ye().homedir;return n&&_e(n)?n:null}function ke(e=Z()){return e?E(e,".cc-safety-net","logs"):null}function B(e,n,t,r=!0,i){if(n.decision.kind==="allow"){if(!t||e.route.kind!=="command")return;let a=M(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{}}}let o=n.decision.evidence.find((a)=>a.kind==="command"),s=o?.command??(r?M(e):"");return{decision:"deny",command:s,segment:o?.segment??s,reason:n.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{},ruleId:n.decision.ruleId,intent:n.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function M(e){return"command"in e?e.command??"":""}function P(e,n,t){if(!e)return;let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command,e.segment,e.reason,e.cwd,{homeDir:t.homeDir,decision:e.decision,agent:t.agent,shape:t.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function We(e,n,t){let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command??"",e.segment??e.command??"",e.reason,t.cwd??null,{homeDir:t.homeDir,decision:"deny",agent:t.agent,shape:t.shape,toolName:t.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function K(e){let{reason:n,command:t,segment:r,toolName:i}=e,o=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
|
|
4
4
|
|
|
5
5
|
Reason: ${s(n)}`;if(e.ruleId)a+=`
|