cc-safety-net 2.3.3 → 2.4.0

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.3.3",
+  "version": "2.4.0",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.3.3",
+  "version": "2.4.0",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,5 +1,5 @@
-import{a}from"../chunks/index-y9vmf6ts.js";import{k as u,l as c,m as f,n as C,o as g,p as N}from"../chunks/index-ebfx04sr.js";import{Aa as T,Bb as v,Ca as w,Ia as d,Y as p,la as P,ya as y}from"../chunks/index-tm5km50k.js";var D="cc-safety-net",S="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",I="Help me with CC Safety Net.";function s(o){o.registerCommand(D,{description:S,handler:async(n,e)=>{o.sendUserMessage(h(n),e.isIdle()?void 0:{deliverAs:"followUp"})}})}function h(o){return`${a.slice(a.indexOf("# CC Safety Net")).trimEnd()}
+import{Ce,j,Se,it,l,i,xe,_,ce,at,u,p}from"../chunks/index-chc1n91k.js";import{te}from"../chunks/index-n0tze7vr.js";import{we,F}from"../chunks/index-ver1bgty.js";var g="cc-safety-net",P="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",y="Help me with CC Safety Net.";function c(e){e.registerCommand(g,{description:P,handler:async(n,r)=>{e.sendUserMessage(T(n),r.isIdle()?void 0:{deliverAs:"followUp"})}})}function T(e){return`${te.slice(te.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 
-${o.trim()||I}`}var x=new Map([["bash","posix"]]);function E(o){o.on("tool_call",M)}var M=O();function O(o={}){return(n,e)=>_(n,e,o)}function _(o,n,e){let t=b(o,n);if(!t)return;if("malformed"in t)return u(t.denial,()=>n.sessionManager.getSessionId(),{agent:"pi",toolName:t.denial.toolName,cwd:t.cwd}),A(t.denial);try{let i=N(t,{guard:{auditAllowed:T(),policyOptions:e.policyOptions,dependencies:e.guardDependencies},audit:{agent:"pi",getSessionId:()=>n.sessionManager.getSessionId()}});return m(i,!0)}catch(i){if(!(i instanceof v))throw i;if(w(y.debug))console.error(`CC Safety Net debug: pi tool_call analysis failed: ${g(i.cause)}`);return m(i.evaluation,t.route.kind==="command")}}function b(o,n){if(!o||typeof o!=="object")return;let e=o;if(e.type!==void 0&&e.type!=="tool_call")return;if(typeof e.toolName!=="string"||e.toolName.trim()==="")return l(n);let t=typeof n.cwd==="string"&&n.cwd.trim()!==""?p(".",[n.cwd]):void 0;if(!t)return l(n,e.toolName);let i=x.get(e.toolName);if(!e.input||typeof e.input!=="object")return i?l(n,e.toolName):void 0;if(!i)return d(e.toolName,e.input,{kind:P(e.toolName)},{configCwd:t,executionCwd:t},null);let r=e.input.command;if(typeof r!=="string"||r.trim()==="")return l(n,e.toolName);return d(e.toolName,e.input,{kind:"command",shell:i},{configCwd:t,executionCwd:t},r)}function l(o,n){return{malformed:!0,denial:f({toolName:n}),cwd:typeof o.cwd==="string"&&o.cwd.trim()?o.cwd:null}}function m(o,n){let e=c(o,{includeEvidence:n});return e?A(e):void 0}function A(o){return{block:!0,reason:C(o)}}function k(o){E(o),s(o)}export{k as default};
+${e.trim()||y}`}var v=new Map([["bash","posix"]]);function C(e){e.on("tool_call",w)}var w=N();function N(e={}){return(n,r)=>{try{return E(n,r,e)}catch(o){return console.error("CC Safety Net error:",o),m(j())}}}function E(e,n,r){let o=l(),t=h(e,n,o.paths);if(!t)return;if("malformed"in t)return we(o,t.denial,()=>n.sessionManager.getSessionId(),{agent:"pi",toolName:t.denial.toolName,cwd:t.cwd}),m(t.denial);try{let a=F(o,t,{guard:{auditAllowed:xe(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:"pi",getSessionId:()=>n.sessionManager.getSessionId()}});return f(a,!0)}catch(a){if(!(a instanceof p))throw a;if(_(i.debug,o.env))console.error(`CC Safety Net debug: pi tool_call analysis failed: ${it(a.cause)}`);return f(a.evaluation,t.route.kind==="command")}}function h(e,n,r){if(!e||typeof e!=="object")return;let o=e;if(o.type!==void 0&&o.type!=="tool_call")return;if(typeof o.toolName!=="string"||o.toolName.trim()==="")return d(n);let t=typeof n.cwd==="string"&&n.cwd.trim()!==""?at(".",[n.cwd],r):void 0;if(!t)return d(n,o.toolName);let a=v.get(o.toolName);if(!o.input||typeof o.input!=="object")return a?d(n,o.toolName):void 0;if(!a)return u(o.toolName,o.input,{kind:ce(o.toolName)},{configCwd:t,executionCwd:t},null);let s=o.input.command;if(typeof s!=="string"||s.trim()==="")return d(n,o.toolName);return u(o.toolName,o.input,{kind:"command",shell:a},{configCwd:t,executionCwd:t},s)}function d(e,n){return{malformed:!0,denial:j({toolName:n}),cwd:typeof e.cwd==="string"&&e.cwd.trim()?e.cwd:null}}function f(e,n){let r=Ce(e,{includeEvidence:n});return r?m(r):void 0}function m(e){return{block:!0,reason:Se(e)}}function A(e){C(e),c(e)}export{A as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.3.3",
+  "version": "2.4.0",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,31 +21,30 @@
     "ccsn": "dist/bin/cc-safety-net.js"
   },
   "files": [
-    "dist",
-    "THIRD_PARTY_LICENSES.txt"
+    "dist"
   ],
   "scripts": {
     "audit:dependencies": "bun audit",
-    "build": "bun run clean && bun run scripts/build.ts",
+    "build": "bun run clean && bun scripts/project-bun.ts scripts/build.ts",
     "build:types": "tsc --project tsconfig.build.json --emitDeclarationOnly --declaration",
-    "build:schema": "bun run scripts/build-schema.ts",
     "verify:package": "bun run scripts/verify-package.ts",
     "verify:repository-plugin": "bun run scripts/verify-repository-plugin.ts",
     "verify:coverage": "bun run scripts/verify-coverage.ts",
     "clean": "rm -rf dist",
     "check": "bun run lint && bun run typecheck && bun run knip && bun run check-duplicates && bun run test:coverage && bun run verify:coverage",
     "check:ci": "bun run lint:ci && bun run typecheck && bun run knip && bun run check-duplicates && bun run test:coverage && bun run verify:coverage",
-    "lint": "biome check --write",
-    "lint:ci": "biome ci .",
+    "lint": "biome check --write --error-on-warnings",
+    "lint:ci": "biome ci --error-on-warnings .",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.gui.json --noEmit",
     "knip": "knip-bun --production",
-    "check-duplicates": "bunx jscpd src tests --no-tips --exit-code 1 --reporters ai --ignore '**/*.svg'",
+    "check-duplicates": "bunx jscpd src tests --no-tips --exit-code 1 --reporters ai --ignore '**/*.svg' --ignore 'src/gui/frontend/**' --ignore-pattern 'import\\s[\\s\\S]*?from\\s[^;]*;'",
     "test": "bun test",
     "test:e2e": "bun test tests/e2e",
     "test:e2e:stability": "bun test tests/e2e --randomize --rerun-each 3",
     "test:e2e:live": "CC_SAFETY_NET_E2E_LIVE=1 bun test tests/e2e-live",
     "test:coverage": "AGENT=1 bun test tests --path-ignore-patterns 'tests/e2e-live/**' --coverage --coverage-reporter=text --coverage-reporter=lcov",
-    "cc-safety-net": "bun run src/cli/cc-safety-net.ts"
+    "cc-safety-net": "bun run src/entries/bin.ts",
+    "eval": "claude plugin eval . --ablation with-without --judge-model sonnet --allow-tools \"Bash(npx -y cc-safety-net:*)\" \"Bash(npx cc-safety-net:*)\""
   },
   "author": {
     "name": "J Liew",
@@ -83,9 +82,6 @@
       "./dist/pi/index.js"
     ]
   },
-  "dependencies": {
-    "zod": "4.3.5"
-  },
   "overrides": {
     "js-yaml": "^4.3.1",
     "picomatch@^2.3.1": "2.3.2",
@@ -96,7 +92,7 @@
   "engines": {
     "node": ">=18"
   },
-  "packageManager": "bun@1.4.0",
+  "packageManager": "bun@1.4.2",
   "keywords": [
     "claude-code",
     "opencode",
@@ -109,5 +105,5 @@
     "grok",
     "grok-build"
   ],
-  "gitHead": "329a2fa04408064a5a8776db525c624a03616ff6"
+  "gitHead": "7622a12456f8332648164207235cd9d0df37a15c"
 }

package/THIRD_PARTY_LICENSES.txt

@@ -1,23 +0,0 @@
-zod 4.3.5
-
-MIT License
-
-Copyright (c) 2025 Colin McDonnell
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/chunks/index-ebfx04sr.js

@@ -1,18 +0,0 @@
-import{$ as Y,Bb as h,Cb as W,N as F,Q as O,aa as _,ka as m,pa as U,q as C,r as w}from"./index-tm5km50k.js";import{lstatSync as N,readdirSync as J,readFileSync as x,rmdirSync as X,statSync as v,unlinkSync as q,utimesSync as ee,writeFileSync as te}from"node:fs";import{dirname as ne,join as u}from"node:path";var A=86400000,re=".last-prune",ie=/^\d{4}-\d{2}$/,oe=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,k=(e)=>Math.floor(e/A);function ae(e){try{let n=u(ne(O(e)),F),t=JSON.parse(x(n,"utf-8"));return w(t?.audit?.retention_days)}catch{return C}}function R(e,n=()=>new Date){try{let t=n().getTime();if(!v(e,{throwIfNoEntry:!1})?.isDirectory())return;let r=u(e,re),i=v(r,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&k(i)===k(t))return;let o=t-ae()*A,s=new Date(t).toISOString().slice(0,7);for(let a of p(e)){if(a.isDirectory()){se(u(e,a.name),o,s);continue}if(a.isFile()&&a.name.endsWith(".jsonl"))ce(u(e,a.name),o)}te(r,"",{mode:384}),ee(r,t/1000,t/1000)}catch{}}function se(e,n,t){for(let r of p(e)){if(!r.isDirectory()||!ie.test(r.name))continue;let i=u(e,r.name);for(let o of p(i)){if(!o.isFile())continue;let s=oe.exec(o.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(a)||a>=n)continue;L(u(i,o.name))}if(r.name!==t)T(i)}T(e)}function ce(e,n){try{let t=N(e);if(t.mtimeMs>=n)return;let r=x(e,"utf-8").split(`
-`).filter((i)=>i.trim()).map(de);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=n))return;if(N(e).mtimeMs!==t.mtimeMs)return;L(e)}catch{}}function de(e){try{let n=JSON.parse(e).ts,t=typeof n==="string"?Date.parse(n):Number.NaN;return Number.isFinite(t)?t:void 0}catch{return}}function p(e){try{return J(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function L(e){try{q(e)}catch{}}function T(e){try{X(e)}catch{}}import{randomBytes as fe}from"node:crypto";import{appendFileSync as pe,mkdirSync as Ae}from"node:fs";import{homedir as Ee,userInfo as ye}from"node:os";import{isAbsolute as _e,join as E}from"node:path";var ue=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function d(e){let n=e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>");return z(n)}function z(e){let n=e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>");for(let t of ue)n=n.replace(t,"<redacted>");return n.replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}function le(e){return G(e).reduceRight((t,r)=>`${t.slice(0,r.valueStart)}<redacted>${t.slice(r.valueEnd)}`,e)}function Le(e){return z(le(e))}function ze(e){return G(e).map((n)=>e.slice(n.valueStart,n.valueEnd))}function Ge(e){return/[A-Za-z_][A-Za-z0-9_]*=/.test(e)}function G(e){let n=[],t=/[A-Za-z_][A-Za-z0-9_]*=/g;for(let r of e.matchAll(t)){let i=r.index,o=e[i-1];if(i>0&&o&&!/[\s"'([{]/.test(o))continue;let s=i+r[0].length;if(s>=e.length)continue;n.push({valueStart:s,valueEnd:me(e,s)})}return n}function me(e,n){if(e.startsWith("$(",n))return ge(e,n);let t=e[n];if(t==='"'||t==="'"){for(let i=n+1;i<e.length;i++)if(t==='"'&&e[i]==="\\")i++;else if(e[i]===t)return i+1}let r=n;while(r<e.length&&!/\s/.test(e[r]??""))r++;return r}function ge(e,n){let t=0,r;for(let i=n;i<e.length;i++){let o=e[i];if(r){if(r==='"'&&o==="\\")i++;else if(o===r)r=void 0;continue}if(o==='"'||o==="'"){r=o;continue}if(o==="$"&&e[i+1]==="("){t++,i++;continue}if(o!==")")continue;if(t--,t===0)return i+1}return e.length}var he="2.3.3",Se=1e4,be=2000,Ie=256,De=32768;function Ne(e){let n=e.trim();if(!n)return null;let t=n.replace(/[^A-Za-z0-9_.-]+/g,"_");if(t=t.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!t||t==="."||t==="..")return null;return t}function ve(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function y(e,n,t,r,i,o={}){let s=Ne(e);if(!s)return;let a=o.homeDir??Z();if(!a)return;let c=ke(a);if(!c)return;try{let g=(o.now??(()=>new Date))().toISOString(),S=l(d(n),o.failureStage?Number.POSITIVE_INFINITY:Se),b=l(d(t),be),I=o.toolName?l(d(o.toolName),Ie):void 0,f=i===null?void 0:l(d(i),De),D=E(c,ve(f?.value??null),g.slice(0,7));Ae(D,{recursive:!0,mode:448});let j=E(D,`${g.slice(0,10)}-${s}.jsonl`),Q={ts:g,id:(o.createId??(()=>fe(8).toString("hex")))(),v:he,sessionId:s,decision:o.decision??"deny",agent:o.agent,shape:o.shape,level:o.level,configFallback:o.configFallback,toolName:I?.value,command:S.value,segment:b.value,...S.truncated||b.truncated||I?.truncated||f?.truncated?{truncated:!0}:{},reason:r,ruleId:o.ruleId,intent:o.intent,failureStage:o.failureStage,errorCode:o.errorCode,cwd:f?.value??null};pe(j,`${JSON.stringify(Q)}
-`,{encoding:"utf-8",mode:384}),R(c,o.now)}catch{}}function l(e,n){return{value:e.slice(0,n),truncated:e.length>n}}function Z(e=process.env.CC_SAFETY_NET_AUDIT_HOME||process.env.HOME){let n=e||Ee()||ye().homedir;return n&&_e(n)?n:null}function ke(e=Z()){return e?E(e,".cc-safety-net","logs"):null}function B(e,n,t,r=!0,i){if(n.decision.kind==="allow"){if(!t||e.route.kind!=="command")return;let a=M(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{}}}let o=n.decision.evidence.find((a)=>a.kind==="command"),s=o?.command??(r?M(e):"");return{decision:"deny",command:s,segment:o?.segment??s,reason:n.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:n.level,...n.configFallback?{configFallback:!0}:{},ruleId:n.decision.ruleId,intent:n.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function M(e){return"command"in e?e.command??"":""}function P(e,n,t){if(!e)return;let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command,e.segment,e.reason,e.cwd,{homeDir:t.homeDir,decision:e.decision,agent:t.agent,shape:t.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function We(e,n,t){let r;try{r=n()}catch{return}if(typeof r!=="string"||!r.trim())return;y(r,e.command??"",e.segment??e.command??"",e.reason,t.cwd??null,{homeDir:t.homeDir,decision:"deny",agent:t.agent,shape:t.shape,toolName:t.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function K(e){let{reason:n,command:t,segment:r,toolName:i}=e,o=e.maxLen??200,s=e.redact??((c)=>c),a=`BLOCKED by CC Safety Net
-
-Reason: ${s(n)}`;if(e.ruleId)a+=`
-
-Rule: ${e.ruleId}`;if(i)a+=`
-
-Tool: ${i}`;if(t){let c=s(t);a+=`
-
-Command: ${V(c,o)}`}if(r&&r!==t){let c=s(r);a+=`
-
-Segment: ${V(c,o)}`}if(e.configWarning)a+=`
-
-Config warning: ${s(e.configWarning)}`;return a+=`
-
-${Te(e.intent??"manual_only")}`,a}function Te(e){switch(e){case"hard_stop":return"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.";case"use_alternative":return"Do not retry the blocked form. Continue the task using the safer alternative described above.";case"scope_down":return"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.";case"manual_only":return"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.";case"stop_and_explain":return"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."}}function V(e,n){return e.length>n?`${e.slice(0,n)}...`:e}function et(e,n){if(e.decision.kind!=="deny")return;let t=n.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:t?.command,segment:t?.segment,toolName:n.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function tt(e={}){return{reason:Y,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function nt(e){return K({...e,redact:d})}function rt(e){return d(e instanceof Error?e.message:String(e))}function It(e,n){try{let t=W(e,n.guard);return H(e,t,n),t}catch(t){if(!(t instanceof h))throw t;throw H(e,t.evaluation,n,!(t.cause instanceof m),{stage:t.stage,errorCode:Ce(t.cause)}),t}}function H(e,n,t,r=!0,i){P(B(e,n,t.guard?.auditAllowed??!1,r,i),t.audit.getSessionId,{agent:t.audit.agent,shape:t.audit.shape,homeDir:t.audit.homeDir})}function Ce(e){if(e instanceof _)return"path-canonicalization-limit";if(e instanceof m)return"tool-input-limit";if(e instanceof U)return"structural-shell-syntax-limit";return"unexpected-error"}
-export{z as b,le as c,Le as d,ze as e,Ge as f,ae as g,R as h,Z as i,ke as j,We as k,et as l,tt as m,nt as n,rt as o,It as p};