cc-safety-net 2.3.2 → 2.3.4

package/dist/chunks/index-zqqsva7r.js

@@ -0,0 +1,18 @@
+import{Ge,He,me,ge,he,s,a,w,d,Fe}from"./index-e7vaxtyk.js";import{lstatSync as v,readdirSync as H,readFileSync as x,rmdirSync as U,statSync as k,unlinkSync as W,utimesSync as Q,writeFileSync as J}from"node:fs";import{dirname as X,join as g}from"node:path";var _=86400000,ne=".last-prune",re=/^\d{4}-\d{2}$/,ie=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,C=(e)=>Math.floor(e/_);function de(e){try{let n=g(X(ge(e)),me),t=JSON.parse(x(n,"utf-8"));return He(t?.audit?.retention_days)}catch{return Ge}}function q(e,n=()=>new Date){try{let t=n().getTime();if(!k(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=g(e,ne),i=k(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&C(i)===C(t))return;let o=t-de()*_,u=new Date(t).toISOString().slice(0,7);for(let c of y(e)){if(c.isDirectory()){oe(g(e,c.name),o,u);continue}if(c.isFile()&&c.name.endsWith(".jsonl"))ae(g(e,c.name),o)}J(r,"",{mode:384}),Q(r,t/1000,t/1000)}catch{}}function oe(e,n,t){for(let r of y(e)){if(!r.isDirectory()||!re.test(r.name))continue;let i=g(e,r.name);for(let o of y(i)){if(!o.isFile())continue;let u=ie.exec(o.name);if(!u||u[2]!==r.name)continue;let c=Date.parse(`${u[1]}T00:00:00.000Z`)+_;if(!Number.isFinite(c)||c>=n)continue;R(g(i,o.name))}if(r.name!==t)O(i)}O(e)}function ae(e,n){try{let t=v(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
+`).filter((i)=>i.trim()).map(se);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(v(e).mtimeMs!==t.mtimeMs)return;R(e)}catch{}}function se(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function y(e){try{return H(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function R(e){try{W(e)}catch{}}function O(e){try{U(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as Se,join as h}from"node:path";var ce=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function m(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return je(n)}function je(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ce)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function it(e){return L(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function A(e){return je(it(e))}function yt(e){return L(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function st(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function L(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let u=i+r[0].length;if(u>=e.length)continue;n.push({valueStart:u,valueEnd:ue(e,u)})}return n}function ue(e,n){if(e.startsWith("$(",n))return le(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function le(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var be="2.3.4",Ie=1e4,De=2000,Ne=256,ve=32768;function ke(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function Te(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function S(e,n,t,r,i,o={}){let u=ke(e);if(!u)return;let c=o.homeDir??Pe();if(!c)return;let l=F(c);if(!l)return;try{let p=(o.now??(()=>new Date))().toISOString(),b=f(m(n),o.failureStage?Number.POSITIVE_INFINITY:Ie),I=f(m(t),De),D=o.toolName?f(m(o.toolName),Ne):void 0,E=i===null?void 0:f(m(i),ve),N=h(l,Te(E?.value??null),p.slice(0,7));Ae(N,{recursive:!0,mode:448});let V=h(N,`${p.slice(0,10)}-${u}.jsonl`),Y={ts:p,id:(o.createId??(()=>fe(8).toString("hex")))(),v:be,sessionId:u,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:D?.value,command:b.value,segment:I.value,...b.truncated||I.truncated||D?.truncated||E?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:E?.value??null};pe(V,`${JSON.stringify(Y)}
+`,{encoding:"utf-8",mode:384}),q(l,o.now)}catch{}}function f(e,n){return{value:e.slice(0,n),truncated:e.length>n}}function Pe(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let n=e||Ee()||ye().homedir;return n&&Se(n)?n:null}function F(e=Pe()){return e?h(e,".cc-safety-net","logs"):null}function G(e,n,t,r=!0,i){if(n.decision.kind==="allow"){if(!t||e.route.kind!=="command")return;let c=z(e);return{decision:"allow",command:c,segment:c,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{}}}let o=n.decision.evidence.find((c)=>c.kind==="command"),u=o?.command??(r?z(e):"");return{decision:"deny",command:u,segment:o?.segment??u,reason:n.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{},ruleId:n.decision.ruleId,intent:n.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function z(e){return"command"in e?e.command??"":""}function Z(e,n,t){if(!e)return;let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;S(r,e.command,e.segment,e.reason,e.cwd,{homeDir:t.homeDir,decision:e.decision,agent:t.agent,shape:t.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function ee(e,n,t){let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;S(r,e.command??"",e.segment??e.command??"",e.reason,t.cwd??null,{homeDir:t.homeDir,decision:"deny",agent:t.agent,shape:t.shape,toolName:t.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function B(e){let{reason:n,command:t,segment:r,toolName:i}=e,o=e.maxLen??200,u=e.redact??((l)=>l),c=`BLOCKED by CC Safety Net
+
+Reason: ${u(n)}`;if(e.ruleId)c+=`
+
+Rule: ${e.ruleId}`;if(i)c+=`
+
+Tool: ${i}`;if(t){let l=u(t);c+=`
+
+Command: ${M(l,o)}`}if(r&&r!==t){let l=u(r);c+=`
+
+Segment: ${M(l,o)}`}if(e.configWarning)c+=`
+
+Config warning: ${u(e.configWarning)}`;return c+=`
+
+${Ce(e.intent??"manual_only")}`,c}function Ce(e){switch(e){case"hard_stop":return"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.";case"use_alternative":return"Do not retry the blocked form. Continue the task using the safer alternative described above.";case"scope_down":return"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.";case"manual_only":return"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.";case"stop_and_explain":return"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."}}function M(e,n){return e.length>n?`${e.slice(0,n)}...`:e}function K(e,n){if(e.decision.kind!=="deny")return;let t=n.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:t?.command,segment:t?.segment,toolName:n.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function T(e={}){return{reason:he,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function te(e){return B({...e,redact:m})}function _e(e){return m(e instanceof Error?e.message:String(e))}function j(e,n){try{let t=Fe(e,n.guard);return P(e,t,n),t}catch(t){if(!(t instanceof d))throw t;throw P(e,t.evaluation,n,!(t.cause instanceof a),{stage:t.stage,errorCode:we(t.cause)}),t}}function P(e,n,t,r=!0,i){Z(G(e,n,t.guard?.auditAllowed??!1,r,i),t.audit.getSessionId,{agent:t.audit.agent,shape:t.audit.shape,homeDir:t.audit.homeDir})}function we(e){if(e instanceof s)return"path-canonicalization-limit";if(e instanceof a)return"tool-input-limit";if(e instanceof w)return"structural-shell-syntax-limit";return"unexpected-error"}
+export{je,it,A,yt,st,de,q,Pe,F,ee,K,T,te,_e,j};

package/dist/index.js

@@ -1 +1 @@
-import{a as d}from"./chunks/index-y9vmf6ts.js";import{k as w,l as y,m as l,n as h,p as R}from"./chunks/index-jnb1nckj.js";import{Aa as x,Bb as P,Ia as k,X as p,ka as E,la as v,ma as D}from"./chunks/index-6fvz7zfr.js";import{resolve as S}from"node:path";function f(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:d.slice(d.indexOf("# CC Safety Net"))}}}var z=new Set(["powershell","pwsh"]),B=new Set(["bash","dash","ksh","sh","zsh"]);function T(o={}){return async({directory:r,homeDir:t})=>{let n=S(r),a;return{config:async(i)=>{a=i;let c=f(),s=i.command??{};i.command={...c,...s}},"tool.execute.before":async(i,c)=>{let s=(e,L,_=n)=>{w(e,()=>i.sessionID,{agent:"opencode",toolName:L,cwd:_,homeDir:t}),A(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")s(l());let u=c.args,m;try{m=D(u)}catch(e){if(!(e instanceof E))throw e;s(l({toolName:i.tool}),i.tool)}let I=U(a?.shell),b=G(i.tool,I),g=W(n,u);if(!p(n)||!g)return s(l({command:m,toolName:i.tool}),i.tool);let N={configCwd:n,executionCwd:g},O=k(i.tool,u,b,N,m??null);try{let e=R(O,{guard:{auditAllowed:x(),dependencies:o},audit:{agent:"opencode",homeDir:t,getSessionId:()=>i.sessionID}});C(e,!0)}catch(e){if(!(e instanceof P))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;C(e.evaluation,!0);return}}}}}function U(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let a=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!a)return"auto";if(z.has(a))return"powershell";if(B.has(a))return"posix";return"auto"}function G(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:v(o)}}function W(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?Z(t):t,a=S(o,n);return p(a)?a:null}function Z(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function C(o,r){let t=y(o,{includeEvidence:r});if(t)A(t)}function A(o){throw Error(h(o))}var io=T();export{io as CCSafetyNetPlugin};
+import{Se,a,ie,B,se,c,d}from"./chunks/index-e7vaxtyk.js";import{ce}from"./chunks/index-68v9n663.js";import{ee,K,T,te,j}from"./chunks/index-zqqsva7r.js";import{resolve as w}from"node:path";function f(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:ce.slice(ce.indexOf("# CC Safety Net"))}}}var R=new Set(["powershell","pwsh"]),S=new Set(["bash","dash","ksh","sh","zsh"]);function y(o={}){return async({directory:r,homeDir:t})=>{let n=w(r),s;return{config:async(i)=>{s=i;let u=f(),l=i.command??{};i.command={...u,...l}},"tool.execute.before":async(i,u)=>{let l=(e,k,P=n)=>{ee(e,()=>i.sessionID,{agent:"opencode",toolName:k,cwd:P,homeDir:t}),h(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")l(T());let m=u.args,p;try{p=B(m)}catch(e){if(!(e instanceof a))throw e;l(T({toolName:i.tool}),i.tool)}let E=A(s?.shell),v=I(i.tool,E),g=b(n,m);if(!Se(n)||!g)return l(T({command:p,toolName:i.tool}),i.tool);let D={configCwd:n,executionCwd:g},x=c(i.tool,m,v,D,p??null);try{let e=j(x,{guard:{auditAllowed:se(),dependencies:o},audit:{agent:"opencode",homeDir:t,getSessionId:()=>i.sessionID}});C(e,!0)}catch(e){if(!(e instanceof d))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;C(e.evaluation,!0);return}}}}}function A(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let s=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!s)return"auto";if(R.has(s))return"powershell";if(S.has(s))return"posix";return"auto"}function I(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:ie(o)}}function b(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?N(t):t,s=w(o,n);return Se(s)?s:null}function N(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function C(o,r){let t=K(o,{includeEvidence:r});if(t)h(t)}function h(o){throw Error(te(o))}var V=y();export{V as CCSafetyNetPlugin};