cc-safety-net 2.3.1 → 2.3.2

package/dist/chunks/{index-2z9vsvqb.js → index-jnb1nckj.js}

@@ -1,5 +1,5 @@
 import{$ as Y,Bb as h,Cb as W,N as F,Q as O,aa as _,ka as m,pa as U,q as C,r as w}from"./index-6fvz7zfr.js";import{lstatSync as N,readdirSync as J,readFileSync as x,rmdirSync as X,statSync as v,unlinkSync as q,utimesSync as ee,writeFileSync as te}from"node:fs";import{dirname as ne,join as u}from"node:path";var A=86400000,re=".last-prune",ie=/^\d{4}-\d{2}$/,oe=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,k=(e)=>Math.floor(e/A);function ae(e){try{let n=u(ne(O(e)),F),t=JSON.parse(x(n,"utf-8"));return w(t?.audit?.retention_days)}catch{return C}}function R(e,n=()=>new Date){try{let t=n().getTime();if(!v(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=u(e,re),i=v(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&k(i)===k(t))return;let o=t-ae()*A,s=new Date(t).toISOString().slice(0,7);for(let a of p(e)){if(a.isDirectory()){se(u(e,a.name),o,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))ce(u(e,a.name),o)}te(r,"",{mode:384}),ee(r,t/1000,t/1000)}catch{}}function se(e,n,t){for(let r of p(e)){if(!r.isDirectory()||!ie.test(r.name))continue;let i=u(e,r.name);for(let o of p(i)){if(!o.isFile())continue;let s=oe.exec(o.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(a)||a>=n)continue;L(u(i,o.name))}if(r.name!==t)T(i)}T(e)}function ce(e,n){try{let t=N(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
-`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.3.1",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
+`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.3.2",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
 `,{encoding:"utf-8",mode:384}),R(c,o.now)}catch{}}function l(e,n){return{value:e.slice(0,n),truncated:e.length>n}}function Z(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let n=e||Ee()||ye().homedir;return n&&_e(n)?n:null}function ke(e=Z()){return e?E(e,".cc-safety-net","logs"):null}function B(e,n,t,r=!0,i){if(n.decision.kind==="allow"){if(!t||e.route.kind!=="command")return;let a=M(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{}}}let o=n.decision.evidence.find((a)=>a.kind==="command"),s=o?.command??(r?M(e):"");return{decision:"deny",command:s,segment:o?.segment??s,reason:n.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{},ruleId:n.decision.ruleId,intent:n.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function M(e){return"command"in e?e.command??"":""}function P(e,n,t){if(!e)return;let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command,e.segment,e.reason,e.cwd,{homeDir:t.homeDir,decision:e.decision,agent:t.agent,shape:t.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function We(e,n,t){let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command??"",e.segment??e.command??"",e.reason,t.cwd??null,{homeDir:t.homeDir,decision:"deny",agent:t.agent,shape:t.shape,toolName:t.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function K(e){let{reason:n,command:t,segment:r,toolName:i}=e,o=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
 
 Reason: ${s(n)}`;if(e.ruleId)a+=`

package/dist/index.js

@@ -1 +1 @@
-import{a as d}from"./chunks/index-y9vmf6ts.js";import{k as w,l as y,m as l,n as h,p as R}from"./chunks/index-2z9vsvqb.js";import{Aa as x,Bb as P,Ia as k,X as p,ka as E,la as v,ma as D}from"./chunks/index-6fvz7zfr.js";import{resolve as S}from"node:path";function f(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:d.slice(d.indexOf("# CC Safety Net"))}}}var z=new Set(["powershell","pwsh"]),B=new Set(["bash","dash","ksh","sh","zsh"]);function T(o={}){return async({directory:r,homeDir:t})=>{let n=S(r),a;return{config:async(i)=>{a=i;let c=f(),s=i.command??{};i.command={...c,...s}},"tool.execute.before":async(i,c)=>{let s=(e,L,_=n)=>{w(e,()=>i.sessionID,{agent:"opencode",toolName:L,cwd:_,homeDir:t}),A(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")s(l());let u=c.args,m;try{m=D(u)}catch(e){if(!(e instanceof E))throw e;s(l({toolName:i.tool}),i.tool)}let I=U(a?.shell),b=G(i.tool,I),g=W(n,u);if(!p(n)||!g)return s(l({command:m,toolName:i.tool}),i.tool);let N={configCwd:n,executionCwd:g},O=k(i.tool,u,b,N,m??null);try{let e=R(O,{guard:{auditAllowed:x(),dependencies:o},audit:{agent:"opencode",homeDir:t,getSessionId:()=>i.sessionID}});C(e,!0)}catch(e){if(!(e instanceof P))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;C(e.evaluation,!0);return}}}}}function U(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let a=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!a)return"auto";if(z.has(a))return"powershell";if(B.has(a))return"posix";return"auto"}function G(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:v(o)}}function W(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?Z(t):t,a=S(o,n);return p(a)?a:null}function Z(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function C(o,r){let t=y(o,{includeEvidence:r});if(t)A(t)}function A(o){throw Error(h(o))}var io=T();export{io as CCSafetyNetPlugin};
+import{a as d}from"./chunks/index-y9vmf6ts.js";import{k as w,l as y,m as l,n as h,p as R}from"./chunks/index-jnb1nckj.js";import{Aa as x,Bb as P,Ia as k,X as p,ka as E,la as v,ma as D}from"./chunks/index-6fvz7zfr.js";import{resolve as S}from"node:path";function f(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:d.slice(d.indexOf("# CC Safety Net"))}}}var z=new Set(["powershell","pwsh"]),B=new Set(["bash","dash","ksh","sh","zsh"]);function T(o={}){return async({directory:r,homeDir:t})=>{let n=S(r),a;return{config:async(i)=>{a=i;let c=f(),s=i.command??{};i.command={...c,...s}},"tool.execute.before":async(i,c)=>{let s=(e,L,_=n)=>{w(e,()=>i.sessionID,{agent:"opencode",toolName:L,cwd:_,homeDir:t}),A(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")s(l());let u=c.args,m;try{m=D(u)}catch(e){if(!(e instanceof E))throw e;s(l({toolName:i.tool}),i.tool)}let I=U(a?.shell),b=G(i.tool,I),g=W(n,u);if(!p(n)||!g)return s(l({command:m,toolName:i.tool}),i.tool);let N={configCwd:n,executionCwd:g},O=k(i.tool,u,b,N,m??null);try{let e=R(O,{guard:{auditAllowed:x(),dependencies:o},audit:{agent:"opencode",homeDir:t,getSessionId:()=>i.sessionID}});C(e,!0)}catch(e){if(!(e instanceof P))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;C(e.evaluation,!0);return}}}}}function U(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let a=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!a)return"auto";if(z.has(a))return"powershell";if(B.has(a))return"posix";return"auto"}function G(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:v(o)}}function W(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?Z(t):t,a=S(o,n);return p(a)?a:null}function Z(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function C(o,r){let t=y(o,{includeEvidence:r});if(t)A(t)}function A(o){throw Error(h(o))}var io=T();export{io as CCSafetyNetPlugin};

package/dist/openclaw/cc-safety-net/index.js

@@ -1,7 +1,7 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.3.1
+// version: 2.3.2
 var YE=Object.defineProperty;var JE=(e)=>e;function XE(e,t){this[e]=JE.bind(null,t)}var cn=(e,t)=>{for(var n in t)YE(e,n,{get:t[n],enumerable:!0,configurable:!0,set:XE.bind(t,n)})};var Dh={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};import{randomBytes as Hw}from"node:crypto";import{appendFileSync as Kw,mkdirSync as qw}from"node:fs";import{homedir as Yw,userInfo as Jw}from"node:os";import{isAbsolute as Xw,join as Ol}from"node:path";var QE=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function Tt(e){let t=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return ew(t)}function ew(e){let t=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let n of QE)t=t.replace(n,"<redacted>");return t.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}import{lstatSync as ey,readdirSync as Nw,readFileSync as oy,rmdirSync as Dw,statSync as ty,unlinkSync as Mw,utimesSync as $w,writeFileSync as Lw}from"node:fs";import{dirname as Ww,join as Kn}from"node:path";var Oi=30,El=1,wl=365;function zi(e){if(typeof e!=="number"||!Number.isInteger(e))return 30;if(e<1)return 1;return e>365?365:e}import{homedir as xw}from"node:os";import{dirname as Bn,isAbsolute as Cw,join as Vn,relative as Ew,resolve as mn,sep as ww}from"node:path";import{lstatSync as tw,realpathSync as nw}from"node:fs";import{homedir as rw,tmpdir as ow}from"node:os";var Be={realpath:(e)=>{try{return nw(e)}catch{return null}},entryKind:(e)=>{let t=tw(e,{throwIfNoEntry:!1});if(!t)return"missing";return t.isSymbolicLink()?"symlink":"present"}};function ze(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ln(){return ze(process.env.HOME||rw())}function Qe(){return{env:new Map(Object.entries(process.env).flatMap(([e,t])=>t===void 0?[]:[[e,t]])),home:ln(),tmpdir:ow(),paths:Be}}import{closeSync as iw,constants as Mh,fstatSync as sw,fsyncSync as gL,lstatSync as $h,mkdirSync as hL,openSync as aw,readdirSync as yL,readFileSync as cw,realpathSync as Ni,renameSync as bL,rmdirSync as vL,statSync as lw,unlinkSync as _L,writeFileSync as SL}from"node:fs";import{isAbsolute as Lh,join as Wh,normalize as uw,parse as dw,relative as Rl,resolve as Pl,sep as Al}from"node:path";var mw=Symbol("PolicyFilesystemScope"),fw=Symbol("PolicyFilesystemTarget"),pw=Mh.O_NOFOLLOW??0;class pe extends Error{constructor(e){super(`Unable to access ${e} filesystem safely.`);this.name="PolicyFilesystemError"}}function un(e,t){return{[mw]:!0,root:Pl(e),label:t}}function Fh(e,t){let n=uw(t);if(t===""||Lh(t)||n===".."||n.startsWith(`..${Al}`))throw new pe(e.label);return{[fw]:!0,scope:e,relativePath:n,path:Wh(e.root,n)}}function Yr(e,t){let n=Rl(e.root,Pl(t));return Fh(e,n)}function Gh(e,t="rules policy"){let n=Pl(e),r=dw(n).dir;return Fh(un(r,t),Rl(r,n))}function Mi(e){try{if(!Di(e,!1).exists)return null;let n=aw(e.path,Mh.O_RDONLY|pw);try{let r=sw(n);if(!r.isFile())throw new pe(e.scope.label);let o=cw(n,"utf-8"),i=$h(e.path);if(!i.isFile()||i.isSymbolicLink()||r.dev!==i.dev||r.ino!==i.ino)throw new pe(e.scope.label);return Di(e,!1),o}finally{iw(n)}}catch(t){yw(e.scope.label,t)}}function Zh(e,t){if(e.path===t.path)return!0;try{if(!Di(e,!1).exists||!Di(t,!1).exists)return!1;return Ni(e.path)===Ni(t.path)}catch(n){if(n instanceof pe)throw n;throw new pe(e.scope.label)}}function Di(e,t,n="file"){let r=gw(e.scope);if(!r)return{exists:!1};let o=e.relativePath.split(Al);for(let i of o.keys()){let s=Wh(e.scope.root,...o.slice(0,i+1)),a=Uh(s);if(!a){if(i===o.length-1&&t)return{exists:!1};return{exists:!1}}if(a.isSymbolicLink())throw new pe(e.scope.label);if(i<o.length-1&&!a.isDirectory())throw new pe(e.scope.label);if(i===o.length-1&&(n==="file"?!a.isFile():!a.isDirectory()))throw new pe(e.scope.label);hw(r,Ni(s),e.scope.label)}return{exists:!0}}function gw(e){if(!Uh(e.root))return null;if(!lw(e.root).isDirectory())throw new pe(e.label);return Ni(e.root)}function hw(e,t,n){let r=Rl(e,t);if(r===".."||r.startsWith(`..${Al}`)||Lh(r))throw new pe(n)}function Uh(e){try{return $h(e)}catch(t){if(bw(t)&&t.code==="ENOENT")return null;throw t}}function yw(e,t){if(t instanceof pe)throw t;throw new pe(e)}function bw(e){return e instanceof Error&&"code"in e}var dn=/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/,jh="rulebook.json",Bh=".cc-safety-net/rules";var Vh=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;var vw=/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/,_w=".cc-safety-net/rules".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),Sw="rulebook.json".replace(/[.*+?^${}()|[\]\\]/g,"\\$&"),EL=new RegExp(`^${_w}/(${dn.source.slice(1,-1)})/${Sw}$`);function Hh(e){return`.cc-safety-net/rules/${e}/rulebook.json`}function Kh(e){if($i(e))try{return kl(e),null}catch(t){return t instanceof Error?t.message:String(t)}return dn.test(e)?null:`Local rulebook sources must be bare names matching ${dn}: ${e}`}function kl(e){if(e.startsWith("github:"))throw Error(`Invalid rulebook source: ${e}`);let t=e.match(Vh);if(!t?.[1]||!t[2]||!t[3])throw Error(`Invalid GitHub rulebook source: ${e}`);let n=t[3].lastIndexOf("/");if(n<1)throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);let r=t[3].slice(0,n),o=t[3].slice(n+1);if(!r||!vw.test(r))throw Error(`GitHub rulebook refs must use valid path segments: ${e}`);if(!o||!dn.test(o))throw Error(`GitHub rulebook sources must be owner/repo#ref/<rulebook-name>: ${e}`);return{owner:t[1],repo:t[2],ref:r,path:Hh(o),name:o}}function $i(e){return Vh.test(e)}var qh="rule.json",fn="policy.json";var Yh=".cc-safety-net",Rw="rules",Pw="CC_SAFETY_NET_HOME",Jh="`cc-safety-net rule update`";function Aw(e){return mn(e??process.cwd(),Bh)}function kw(e){return Vn(Aw(e),qh)}function Jr(e){return Vn(mn(e??process.cwd()),Yh,fn)}function Hn(e){return e?.userConfigDir??(e?.userConfigPath?Bn(e.userConfigPath):Vn(Tw(),Rw))}function Tw(){let e=process.env[Pw];return e?mn(ze(e)):Vn(xw(),Yh)}function Iw(e){return Vn(Hn(e),qh)}function Xh(e){let t=e.userConfigPath??Iw(e),n=e.projectConfigPath??kw(e.cwd),r=Ow(t,e),o=zw(n,e);return{userConfigPath:t,projectConfigPath:n,userScope:r,projectScope:o,userConfigTarget:Yr(r,t),projectConfigTarget:Yr(o,n)}}function Ow(e,t){let n=t.userConfigPath?Bn(Bn(mn(t.userConfigPath))):Bn(mn(t.userConfigDir??Hn(t)));return un(n,"user policy")}function zw(e,t){let n=mn(t.cwd??process.cwd()),r=mn(e),o=Ew(n,r);if(o!==".."&&!o.startsWith(`..${ww}`)&&!Cw(o))return un(n,"project policy");return un(Bn(Bn(r)),"project policy")}function Qh(e,t){return Vn(e,t,jh)}var Il=86400000,Fw=".last-prune",Gw=/^\d{4}-\d{2}$/,Zw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,ny=(e)=>Math.floor(e/Il);function Uw(e){try{let t=Kn(Ww(Hn(e)),fn),n=JSON.parse(oy(t,"utf-8"));return zi(n?.audit?.retention_days)}catch{return Oi}}function iy(e,t=()=>new Date){try{let n=t().getTime();if(!ty(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=Kn(e,Fw),o=ty(r,{throwIfNoEntry:!1})?.mtimeMs;if(o!==void 0&&ny(o)===ny(n))return;let i=n-Uw()*Il,s=new Date(n).toISOString().slice(0,7);for(let a of Tl(e)){if(a.isDirectory()){jw(Kn(e,a.name),i,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))Bw(Kn(e,a.name),i)}Lw(r,"",{mode:384}),$w(r,n/1000,n/1000)}catch{}}function jw(e,t,n){for(let r of Tl(e)){if(!r.isDirectory()||!Gw.test(r.name))continue;let o=Kn(e,r.name);for(let i of Tl(o)){if(!i.isFile())continue;let s=Zw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Il;if(!Number.isFinite(a)||a>=t)continue;sy(Kn(o,i.name))}if(r.name!==n)ry(o)}ry(e)}function Bw(e,t){try{let n=ey(e);if(n.mtimeMs>=t)return;let r=oy(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(Vw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ey(e).mtimeMs!==n.mtimeMs)return;sy(e)}catch{}}function Vw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Tl(e){try{return Nw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function sy(e){try{Mw(e)}catch{}}function ry(e){try{Dw(e)}catch{}}var Qw="2.3.1",eR=1e4,tR=2000,nR=256,rR=32768;function oR(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function iR(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function zl(e,t,n,r,o,i={}){let s=oR(e);if(!s)return;let a=i.homeDir??ay();if(!a)return;let c=sR(a);if(!c)return;try{let l=(i.now??(()=>new Date))().toISOString(),u=Li(Tt(t),i.failureStage?Number.POSITIVE_INFINITY:eR),d=Li(Tt(n),tR),m=i.toolName?Li(Tt(i.toolName),nR):void 0,f=o===null?void 0:Li(Tt(o),rR),p=Ol(c,iR(f?.value??null),l.slice(0,7));qw(p,{recursive:!0,mode:448});let h=Ol(p,`${l.slice(0,10)}-${s}.jsonl`),y={ts:l,id:(i.createId??(()=>Hw(8).toString("hex")))(),v:Qw,sessionId:s,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:m?.value,command:u.value,segment:d.value,...u.truncated||d.truncated||m?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:f?.value??null};Kw(h,`${JSON.stringify(y)}
+`).filter((o)=>o.trim()).map(Vw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ey(e).mtimeMs!==n.mtimeMs)return;sy(e)}catch{}}function Vw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Tl(e){try{return Nw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function sy(e){try{Mw(e)}catch{}}function ry(e){try{Dw(e)}catch{}}var Qw="2.3.2",eR=1e4,tR=2000,nR=256,rR=32768;function oR(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function iR(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function zl(e,t,n,r,o,i={}){let s=oR(e);if(!s)return;let a=i.homeDir??ay();if(!a)return;let c=sR(a);if(!c)return;try{let l=(i.now??(()=>new Date))().toISOString(),u=Li(Tt(t),i.failureStage?Number.POSITIVE_INFINITY:eR),d=Li(Tt(n),tR),m=i.toolName?Li(Tt(i.toolName),nR):void 0,f=o===null?void 0:Li(Tt(o),rR),p=Ol(c,iR(f?.value??null),l.slice(0,7));qw(p,{recursive:!0,mode:448});let h=Ol(p,`${l.slice(0,10)}-${s}.jsonl`),y={ts:l,id:(i.createId??(()=>Hw(8).toString("hex")))(),v:Qw,sessionId:s,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:m?.value,command:u.value,segment:d.value,...u.truncated||d.truncated||m?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:f?.value??null};Kw(h,`${JSON.stringify(y)}
 `,{encoding:"utf-8",mode:384}),iy(c,i.now)}catch{}}function Li(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function ay(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let t=e||Yw()||Jw().homedir;return t&&Xw(t)?t:null}function sR(e=ay()){return e?Ol(e,".cc-safety-net","logs"):null}function ly(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=cy(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?cy(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function cy(e){return"command"in e?e.command??"":""}function uy(e,t,n){if(!e)return;let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;zl(r,e.command,e.segment,e.reason,e.cwd,{homeDir:n.homeDir,decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function dy(e,t,n){let r;try{r=t()}catch{return}if(typeof r!=="string"||!r.trim())return;zl(r,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{homeDir:n.homeDir,decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}import{accessSync as XL,constants as QL,realpathSync as pR,statSync as gR}from"node:fs";import{isAbsolute as fy,relative as hR,resolve as yR,sep as bR}from"node:path";import{dirname as aR,isAbsolute as cR,parse as lR,sep as uR}from"node:path";function pn(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Zt(e,t,n){if(pn(t))throw Error("Unsupported Windows namespace path");let r=cR(t)?mR(t):"",o=r||e;for(let i of fR(r?t.slice(r.length):t)){if(i===""||i===".")continue;if(i===".."){o=aR(o);continue}let s=dR(o,i),a=n.entryKind(s),c=a==="symlink"?n.realpath(s):s;if(a==="missing"||c===null)throw Error(`Cannot resolve path component: ${s}`);o=c}return o}function dR(e,t){return e.endsWith("/")||e.endsWith("\\")?`${e}${t}`:`${e}${uR}${t}`}function mR(e){return lR(e).root}function fR(e){let t=process.platform==="win32"?/[\\/]+/:/\/+/;return e.split(t)}function Wi(e,t){if(pn(e))return;let n=t.flatMap((o)=>my(o));if(!n[0])return;let r=my(fy(e)?e:yR(n[0],e))[0];if(!r)return;return n.some((o)=>py(r,o))?r:void 0}function my(e){try{let t=pR(e);return gR(t).isDirectory()?[t]:[]}catch{return[]}}function py(e,t){let n=hR(t,e);return n===""||n!==".."&&!n.startsWith(`..${bR}`)&&!fy(n)}var Ut="Command could not be safely analyzed (strict mode). Simplify the command and retry, or ask the user to verify.",It="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",gy="CC Safety Net could not validate the command because its structure exceeds safe analysis limits.",hy="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Fi="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";function by(e){let{reason:t,command:n,segment:r,toolName:o}=e,i=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
 
 Reason: ${s(t)}`;if(e.ruleId)a+=`

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,4 +1,4 @@
-import{a}from"../chunks/index-y9vmf6ts.js";import{k as u,l as c,m as f,n as C,o as g,p as N}from"../chunks/index-2z9vsvqb.js";import{Aa as T,Bb as v,Ca as w,Ia as d,Y as p,la as P,ya as y}from"../chunks/index-6fvz7zfr.js";var D="cc-safety-net",S="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",I="Help me with CC Safety Net.";function s(o){o.registerCommand(D,{description:S,handler:async(n,e)=>{o.sendUserMessage(h(n),e.isIdle()?void 0:{deliverAs:"followUp"})}})}function h(o){return`${a.slice(a.indexOf("# CC Safety Net")).trimEnd()}
+import{a}from"../chunks/index-y9vmf6ts.js";import{k as u,l as c,m as f,n as C,o as g,p as N}from"../chunks/index-jnb1nckj.js";import{Aa as T,Bb as v,Ca as w,Ia as d,Y as p,la as P,ya as y}from"../chunks/index-6fvz7zfr.js";var D="cc-safety-net",S="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",I="Help me with CC Safety Net.";function s(o){o.registerCommand(D,{description:S,handler:async(n,e)=>{o.sendUserMessage(h(n),e.isIdle()?void 0:{deliverAs:"followUp"})}})}function h(o){return`${a.slice(a.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -109,5 +109,5 @@
     "grok",
     "grok-build"
   ],
-  "gitHead": "3e171d6a27838fe5b8e1d21ac8eeea16c68c2790"
+  "gitHead": "775de25611e01205acf579b00a4d34f53b2908be"
 }