cc-safety-net 2.4.0 → 2.4.1

package/dist/amp/cc-safety-net/index.ts

@@ -1,5 +1,5 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.4.0
+// version: 2.4.1
 // @bun
 var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",In="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ci={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},bp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},xt={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},Tn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Pr={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},P=Object.freeze({realpathAttempts:{cap:16384,...Ci},processedCandidateBytes:{cap:4194304,...Ci},pathEnvironmentExpansion:{cap:64,...Ci},structuralShellSyntax:bp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Tn},trackedHeredocFiles:{cap:64,...Tn},controlFlowStates:{cap:64,...Tn},wrapperPeelIterations:{cap:20,...Tn},derivedCommandShape:Tn,parallelChildAnalyses:{cap:1024,...Pr},parallelDerivedTokens:{cap:16384,...Pr},parallelDerivedBytes:{cap:1048576,...Pr},parallelPlaceholderReplacements:{cap:16384,...Pr},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...xt},toolInputNodes:{cap:1e4,...xt},toolInputKeys:{cap:1e4,...xt},toolInputStringBytes:{cap:1048576,...xt},toolInputAggregateStringBytes:{cap:4194304,...xt},toolInputGitDiffCandidates:{cap:64,...xt},toolInputShape:xt});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(P[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>P[t].cap)throw new F(t)}}}var vp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function ct(e){return Ep(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ep(e){return vp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Rp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function xp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,Rp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
@@ -48,5 +48,5 @@ var bi="CC Safety Net could not analyze the command because it exceeds safe anal
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Q_(e,t,n,r,o,i){let s=Et(e);if(s.length===0||lt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=jt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,Va]:l.map((m)=>m.split(c).join(Va));return pi(d,t,n,r,o,i).some((m)=>m.target.includes(Va))}function ew(e){let t=Et(e);if(t.length===0)return null;let n=lt(t[0]??"").toLowerCase();if(!or(n))return null;return tw(n,t.slice(1))?n:null}function tw(e,t){let n=Xa(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Zf.has(o)||ep(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(j_.get(n)?.has(o))r++;continue}return!1}return!0}function Xa(e){return/^python\d/.test(e)?"python":e}function nw(e){let t=[];for(let n of e){if(np(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Uf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function rw(e,t){if(!t||!Uf.test(e))return e;return`~${e.replace(Uf,"").replace(/\\/g,"/")}`}function at(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ow(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>at("jq",i))}return e.flatMap((r,o)=>o===t?[]:at("jq",r))}function iw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>at("git",i))];if(t.push(...at("git",r)),!le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:at("git",o)),n++}return t}function sw(e){return e.flatMap((t,n)=>{let r=lw(t);if(r!==null)return Hf(r.flag,r.value);let o=aw(e[n-1]);return o===null?[]:Hf(o,t)})}function Hf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Ka(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Ka(t.slice(n+1))}return t.startsWith("@")?Ka(t.slice(1)):[]}function aw(e){if(e===void 0)return null;if(Yf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function lw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Yf.has(r)?{flag:r,value:e.slice(n+1)}:null}function Ka(e){return e===""||e==="-"?[]:[e]}function cw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!__.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((f)=>w_.has(f)),m=d===-1?c:c.slice(0,d),u=pi(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...u.filter((f)=>f!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!P_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function uw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Zf.has(c)||ep(e,c)){let m=t[l+1];if(m!==void 0)a.push(...mi(e,m,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...mi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function ep(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return k_.get(t[t.length-1]??"")?.has(Xa(e))??!1}function dw(e,t,n,r,o,i){if(!e.includes("system"))return[];return ra(e)?.commands.flatMap((s)=>Xt(t.getShellSyntax(s),t,n,r,o,i))??[]}function mw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function fw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(qa)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Ja),...n]}function mi(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=gw(t,pw(e));if(l===null)return fw(t).map(a);let c=l.masked.match(B_)!==null||l.literals.some((f)=>$_.test(l.masked.slice(0,f.start))),d=l.masked.match(U_)!==null||l.literals.some((f)=>H_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!nr.has(e),u=m&&!(Cw(l.masked)||c||d)?[]:l.literals;return[...u.map((f)=>f.text).filter((f)=>f!=="").map(a),...u.flatMap((f)=>Ja(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((f)=>Ya(f.text,n,r,o,i,s)??[a(f.text)]):[],...d?l.literals.flatMap((f)=>mi(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
 `:h),n,r,o,i,s)):[],...(l.masked.match(qa)??[]).filter((f)=>f!=="process.versions.sqlite").map(a)]}function pw(e){let t=Xa(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function gw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(G_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&Sw(e,o))return null;let a=t==="python"?hw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=yw(e,c,l);if(d===null)return null;let m=e.slice(c,d);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&z_.test(m))return null;r.push({start:c,text:m});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function hw(e,t){return F_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function yw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function Sw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function Cw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(T_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>I_.has(i)))continue;if(o.length>1)return!0;if(bw(e,r)===".")return!0;if(vw(e,r+n.length)==="(")return!0}return!1}function bw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function vw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Ew(e,t,n,r,o,i){return Aw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Xt(a,t,{...n,capturedOutput:!0},r,o,i),...Rw(a,r)?xw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function Rw(e,t){let n=ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||lt(tt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=tt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function xw(e,t){return ko(e).flatMap((n)=>n.kind==="word"?[tt(n.text,t)]:n.kind==="redirection"&&n.target?[tt(n.target,t)]:[]).flatMap(Ja)}function Ja(e){let t=ww(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||_w(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function _w(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function ww(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function Aw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Gn(o,n))continue;if(tp(e,r,n)){let i=Pw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Tw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Pw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Gn(i,n))continue;if(tp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Tw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function tp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function Iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let m=d[1]??"",u=d[2];if(m===M_)o=!0;if(N_.has(m))r=!0;if(u!==void 0){if(m===Gf)t.push(u);continue}if(W_.has(m)){let f=e[l+1];if(m===Gf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),u="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(D_.has(g))r=!0;if(L_.has(g)){u=g,f=m.slice(h+1);break}}if(u==="")continue;if(f.length>0){if(u===Ff)t.push(f);continue}let p=e[l+1];if(u===Ff&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Et(e){let t=e.findIndex((n)=>!np(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function np(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var kw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Ow=".env.",Mw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Dw=[".env.example.",".env.sample."];function Nw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Lw(e){return e.length>0&&!/\s/.test(e)}function Ww(e,t,n,r){try{let o=xr(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof F)throw o;return!1}}var Fw=new Set(["node_modules","__pycache__"]),Gw=[["vendor","bundle"],["vendor","cache"]];function zw(e,t,n,r,o){if(Nw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>Lw(s)||Ww(e,t,r,o);if(Mw.has(s)||Dw.some((u)=>s.startsWith(u)))return null;let c=H(Vw(e,t,r,o));for(let u of es){let f=`~/${u.suffixParts.join("/")}`;if((Vf(a,f)||Vf(c,f))&&st(u.id,n))return u.id}let d=Bw(i,t,n,r,o);if(d)return d;if(kw.has(s))return null;for(let u of Qi)if(s===u.basename&&st(u.id,n))return u.id;if(s.startsWith(Ow)&&st(qr.id,n)&&l())return qr.id;for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let f=s.slice(u.prefix.length)[0];if((f==="-"||f==="_")&&st(u.id,n)&&l())return u.id}for(let u of ns)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&st(u.id,n))return u.id}if(Hw(a))return null;if(!s.includes(".")&&zn.pattern.test(s)&&st(zn.id,n))return zn.id;let m=jw(s,n);if(m)return m;return null}function Bw(e,t,n,r,o){return Yr.find((i)=>{if(!st(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Rr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Er(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Rr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Er(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Er(e,s,["credentials"])||Er(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>Rr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?U(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?Rr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,qe(d,t,r,o),l))}case"secret.cli.pi":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Er(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(qe("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Rr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(U(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&Jt(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var jf=new WeakMap;function U(e,t,n,r,o){let i=jf.get(o)??new Map;jf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>rp(e,ae(t,r)))}function Er(e,t,n){return n.some((r)=>Jt(H(e),H(ae(t,r))))}function Rr(e,t,n,r,o){return rp(e,qe(t,n,r,o))}function rp(e,t){return H(e)===H(t)}function ae(e,...t){return He([e,...t].filter(Boolean).join("/"))}function $w(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));return n.some((a)=>Jt(s,H(xr(a,r,o,i))))}function Uw(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(xr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(B(be(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),m=H(d?He(B(fi(be(d)),o.paths,i)):l&&He(B(`${l}/.cc-safety-net`,o.paths,i)));if(m&&Jt(s,m))return!1;return n.some((u)=>{let f=H(xr(u,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return Jt(s,f)})}function Hw(e){let t=e.split("/");return t.some((n)=>Fw.has(n))||Gw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function jw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of rs)if(r===o.extension&&st(o.id,t))return o.id;for(let o of os)if(o.pattern.test(r)&&st(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function st(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";if(!o)return i;let s=el(i,o),a=di(s)?s:He(fi(t,s)),l=He(B(a,n.paths,r));if(!Jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Vf(e,t){return e===t||e.startsWith(`${t}/`)}function Vw(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i||!o)return"";let s=el(i,o),a=v_.normalize(di(s)?s:He(fi(t,s))),l=He(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let m=a.slice(d.length);return m?`~${m}`:"~"}function xr(e,t,n,r){let{home:o,normalized:i}=Qa(e,n,r);if(!i)return"";let s=o?el(i,o):i;return He(B(di(s)?s:fi(t,s),n.paths,r))}function Qa(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(B(be(r),t.paths,n)):"",i=He(be(Kw(tt(e,t))));return{home:o,normalized:i}}function Kw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return R_(e)}catch{return e}}function el(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function qw(e){if(process.platform==="win32")return!0;return E_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&qw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function lt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Yw={findPolicyMutation:Nf,findGitMetadataMutation:md,resolveGitMetadata:Zw,loadPolicySnapshot:eu,findSensitiveTarget:Xf,analyzeCommand:wf,getModes:Pi};function op(e,t){let n={...Yw,...t.dependencies},r=Qw(e),o=_r(e)?e.command:r,i=Rt("policy-protection",o,()=>ir(e,t.factParserDependencies)),s=ue(i,"input-candidate"),a=ue(i,"declared-command");if(_r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Od,intent:"stop_and_explain",evidence:[]}};let l=Ce(),c=Rt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Rt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Df,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let m=Rt("policy-protection",o,()=>If(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Tf,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:m.target}]}}}let u=Rt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let f=Rt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...Xw(f)},y=p.secretProtection.enabled===!1?null:Rt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:_r(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Kf,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!_r(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...tl("command-validation",o),...g};let v=Rt("command-analysis",o,()=>Af(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Jw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Zw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Xw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Jw(e){return ue(e,"declared-command")?.program}function Qw(e){try{return Ln(e.input)}catch(t){let n=_r(e)?e.command:void 0;throw new Qt("policy-protection",tl("policy-protection",t instanceof Xe?void 0:n,t),t)}}function Rt(e,t,n){try{return n()}catch(r){throw new Qt(e,tl(e,r instanceof Xe?void 0:t,r),r)}}function tl(e,t,n){let r=n instanceof F||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?bi:In,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function _r(e){return e.route.kind==="command"}import{appendFileSync as mA,mkdirSync as fA}from"fs";import{isAbsolute as pA,join as ol}from"path";import{lstatSync as sp,readdirSync as eA,readFileSync as tA,rmdirSync as nA,statSync as ap,unlinkSync as rA,utimesSync as oA,writeFileSync as iA}from"fs";import{join as wr}from"path";function ip(e,t={}){return to(ln(e,t),e.home).policy.audit.retention_days}var rl=86400000,sA=".last-prune",aA=/^\d{4}-\d{2}$/,lA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,lp=(e)=>Math.floor(e/rl);function up(e,t,n=()=>new Date){try{let r=n().getTime();if(!ap(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=wr(t,sA),i=ap(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&lp(i)===lp(r))return;let s=r-ip(e)*rl,a=new Date(r).toISOString().slice(0,7);for(let l of nl(t)){if(l.isDirectory()){cA(wr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))uA(wr(t,l.name),s)}iA(o,"",{mode:384}),oA(o,r/1000,r/1000)}catch{}}function cA(e,t,n){for(let r of nl(e)){if(!r.isDirectory()||!aA.test(r.name))continue;let o=wr(e,r.name);for(let i of nl(o)){if(!i.isFile())continue;let s=lA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+rl;if(!Number.isFinite(a)||a>=t)continue;dp(wr(o,i.name))}if(r.name!==n)cp(o)}cp(e)}function uA(e,t){try{let n=sp(e);if(n.mtimeMs>=t)return;let r=tA(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(dA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sp(e).mtimeMs!==n.mtimeMs)return;dp(e)}catch{}}function dA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function nl(e){try{return eA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dp(e){try{rA(e)}catch{}}function cp(e){try{nA(e)}catch{}}var gA="2.4.0",hA=1e4,yA=2000,SA=256,CA=32768;function bA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function il(e,t,n,r,o,i,s={}){let a=bA(t);if(!a)return;let l=RA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=gi(ct(r),yA),u=s.toolName?gi(ct(s.toolName),SA):void 0,f=i===null?void 0:gi(ct(i),CA),p=ol(l,vA(f?.value??null),c.slice(0,7));fA(p,{recursive:!0,mode:448});let h=ol(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Li)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};mA(h,`${JSON.stringify(g)}
+`).filter((o)=>o.trim()).map(dA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sp(e).mtimeMs!==n.mtimeMs)return;dp(e)}catch{}}function dA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function nl(e){try{return eA(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dp(e){try{rA(e)}catch{}}function cp(e){try{nA(e)}catch{}}var gA="2.4.1",hA=1e4,yA=2000,SA=256,CA=32768;function bA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function vA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function il(e,t,n,r,o,i,s={}){let a=bA(t);if(!a)return;let l=RA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(ct(n),s.failureStage?Number.POSITIVE_INFINITY:hA),m=gi(ct(r),yA),u=s.toolName?gi(ct(s.toolName),SA):void 0,f=i===null?void 0:gi(ct(i),CA),p=ol(l,vA(f?.value??null),c.slice(0,7));fA(p,{recursive:!0,mode:448});let h=ol(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Li)(),v:gA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:m.value,...d.truncated||m.truncated||u?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};mA(h,`${JSON.stringify(g)}
 `,{encoding:"utf-8",mode:384}),up(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function EA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&pA(n)?n:null}function RA(e){let t=EA(e);return t?ol(t,".cc-safety-net","logs"):null}function fp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=mp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?mp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function mp(e){return"command"in e?e.command??"":""}function pp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function gp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;il(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function yp(e,t,n){try{let r=op(t,{environment:e,...n.guard});return hp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw hp(e,t,r.evaluation,n,!(r.cause instanceof Xe),{stage:r.stage,errorCode:xA(r.cause)}),r}}function hp(e,t,n,r,o=!0,i){pp(e,fp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function xA(e){if(e instanceof F)return P[e.kind].errorCode;if(e instanceof Xe)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}var Cp=wA();function wA(e={}){return(t,n)=>{try{return AA(t,n,e)}catch(r){return console.error("CC Safety Net error:",r),sl(Tr())}}}function AA(e,t,n){let r=wl(),o=PA(e,t,r.paths),i=()=>kA(e);if("malformed"in o)return gp(r,o.denial,i,{agent:"amp",toolName:o.denial.toolName,cwd:o.cwd}),sl(o.denial);try{let s=yp(r,o,{guard:{auditAllowed:Al(r.env),dependencies:n.guardDependencies},audit:{agent:"amp",getSessionId:i}});return Sp(s,!0)}catch(s){if(!(s instanceof Qt))throw s;if(At(ee.debug,r.env))console.error(`CC Safety Net debug: amp tool.call analysis failed: ${fl(s.cause)}`);return Sp(s.evaluation,o.route.kind==="command")}}function PA(e,t,n){if(!e||typeof e!=="object")return Pn(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return Pn(null);if(!r.input||typeof r.input!=="object")return Pn(null,r.tool);let o=TA(t,n);if(!o)return Pn(null,r.tool);let i=IA(t,e);if(!i.ok)return Pn(o,r.tool);if(!i.command)return an(r.tool,r.input,{kind:Mi(r.tool)},{configCwd:o,executionCwd:o},null);if(typeof i.command.command!=="string"||i.command.command.trim()==="")return Pn(o,r.tool);let s=typeof i.command.dir==="string"?jl(i.command.dir,o,n):o;if(!s)return{malformed:!0,denial:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",command:i.command.command,segment:i.command.dir,toolName:r.tool},cwd:o};return an(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:o,executionCwd:s},i.command.command)}function TA(e,t){let n=e.system.workspaceRoot;if(!n)return;try{let r=e.helpers.filePathFromURI(n);if(typeof r!=="string"||r.trim()==="")return;return Hl(".",[r],t)}catch{return}}function IA(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function kA(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function Pn(e,t){return{malformed:!0,denial:Tr({toolName:t}),cwd:e}}function Sp(e,t){let n=dl(e,{includeEvidence:t});return n?sl(n):{action:"allow"}}function sl(e){return{action:"reject-and-continue",message:ml(e)}}function OA(e){e.on("tool.call",(t)=>Cp(t,e))}export{OA as default};

package/dist/bin/hook.js

@@ -46,5 +46,5 @@ var Gp=["-h","--help"];function Kr(e,t){let n=Object.entries(e.booleans??{}),r=O
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function P_(e,t,n,r,o,i){let s=Ht(e);if(s.length===0||xt(s[0]??"").toLowerCase()!=="xargs")return!1;let a=an(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,il]:l.map((m)=>m.split(c).join(il));return Ii(u,t,n,r,o,i).some((m)=>m.target.includes(il))}function T_(e){let t=Ht(e);if(t.length===0)return null;let n=xt(t[0]??"").toLowerCase();if(!Er(n))return null;return I_(n,t.slice(1))?n:null}function I_(e,t){let n=ul(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(ep.has(o)||op(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(b_.get(n)?.has(o))r++;continue}return!1}return!0}function ul(e){return/^python\d/.test(e)?"python":e}function k_(e){let t=[];for(let n of e){if(sp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Vf=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function O_(e,t){if(!t||!Vf.test(e))return e;return`~${e.replace(Vf,"").replace(/\\/g,"/")}`}function Rt(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function M_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Rt("jq",i))}return e.flatMap((r,o)=>o===t?[]:Rt("jq",r))}function D_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>Rt("git",i))];if(t.push(...Rt("git",r)),!be.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Rt("git",o)),n++}return t}function N_(e){return e.flatMap((t,n)=>{let r=W_(t);if(r!==null)return Kf(r.flag,r.value);let o=L_(e[n-1]);return o===null?[]:Kf(o,t)})}function Kf(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return sl(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return sl(t.slice(n+1))}return t.startsWith("@")?sl(t.slice(1)):[]}function L_(e){if(e===void 0)return null;if(Qf.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function W_(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Qf.has(r)?{flag:r,value:e.slice(n+1)}:null}function sl(e){return e===""||e==="-"?[]:[e]}function F_(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!e_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((f)=>t_.has(f)),m=u===-1?c:c.slice(0,u),d=Ii(m,t,n,r,o,i).map((f)=>f.target);if(a.push(...d.filter((f)=>f!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((f,p,h)=>{if(!r_.has(f))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function G_(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(ep.has(c)||op(e,c)){let m=t[l+1];if(m!==void 0)a.push(...Ti(e,m,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...Ti(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function op(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return s_.get(t[t.length-1]??"")?.has(ul(e))??!1}function z_(e,t,n,r,o,i){if(!e.includes("system"))return[];return ha(e)?.commands.flatMap((s)=>fn(t.getShellSyntax(s),t,n,r,o,i))??[]}function B_(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function H_(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(al)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(dl),...n]}function Ti(e,t,n,r,o,i,s){let a=(f)=>({target:f,cwd:i}),l=$_(t,U_(e));if(l===null)return H_(t).map(a);let c=l.masked.match(h_)!==null||l.literals.some((f)=>y_.test(l.masked.slice(0,f.start))),u=l.masked.match(C_)!==null||l.literals.some((f)=>S_.test(l.masked.slice(0,f.start))),m=r.refineInlineData===!0&&!br.has(e),d=m&&!(q_(l.masked)||c||u)?[]:l.literals;return[...d.map((f)=>f.text).filter((f)=>f!=="").map(a),...d.flatMap((f)=>dl(f.text)).map(a),...m?[]:l.literals.flatMap((f)=>f.text.match(al)??[]).filter((f)=>f!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((f)=>ll(f.text,n,r,o,i,s)??[a(f.text)]):[],...u?l.literals.flatMap((f)=>Ti(e,f.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
 `:h),n,r,o,i,s)):[],...(l.masked.match(al)??[]).filter((f)=>f!=="process.versions.sqlite").map(a)]}function U_(e){let t=ul(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function $_(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(p_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&K_(e,o))return null;let a=t==="python"?j_(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=V_(e,c,l);if(u===null)return null;let m=e.slice(c,u);if(/[fF]/.test(a)&&m.includes("{"))return null;if(t==="simple"&&s==='"'&&g_.test(m))return null;r.push({start:c,text:m});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function j_(e,t){return f_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function V_(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function K_(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function q_(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(o_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>i_.has(i)))continue;if(o.length>1)return!0;if(Y_(e,r)===".")return!0;if(Z_(e,r+n.length)==="(")return!0}return!1}function Y_(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function Z_(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function X_(e,t,n,r,o,i){return nw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...fn(a,t,{...n,capturedOutput:!0},r,o,i),...J_(a,r)?Q_(a,r).map((l)=>({target:l,cwd:o})):[]]})}function J_(e,t){let n=Xo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||xt(yt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=yt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Q_(e,t){return Xo(e).flatMap((n)=>n.kind==="word"?[yt(n.text,t)]:n.kind==="redirection"&&n.target?[yt(n.target,t)]:[]).flatMap(dl)}function dl(e){let t=tw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||ew(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function ew(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function tw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function nw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(er(o,n))continue;if(ip(e,r,n)){let i=rw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=ow(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function rw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(er(i,n))continue;if(ip(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function ow(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function ip(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function iw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let m=u[1]??"",d=u[2];if(m===l_)o=!0;if(u_.has(m))r=!0;if(d!==void 0){if(m===Hf)t.push(d);continue}if(m_.has(m)){let f=e[l+1];if(m===Hf&&f!==void 0)t.push(f);l++}continue}if(c.startsWith("-")&&c.length>1){let m=c.slice(1),d="",f="";for(let h=0;h<m.length;h++){let g=m[h]??"";if(c_.has(g))r=!0;if(d_.has(g)){d=g,f=m.slice(h+1);break}}if(d==="")continue;if(f.length>0){if(d===Bf)t.push(f);continue}let p=e[l+1];if(d===Bf&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Ht(e){let t=e.findIndex((n)=>!sp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function sp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var sw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),aw=".env.",lw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),cw=[".env.example.",".env.sample."];function uw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function dw(e){return e.length>0&&!/\s/.test(e)}function mw(e,t,n,r){try{let o=$r(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof D)throw o;return!1}}var fw=new Set(["node_modules","__pycache__"]),pw=[["vendor","bundle"],["vendor","cache"]];function gw(e,t,n,r,o){if(uw(e))return null;let i=ut(e,t,r,o);if(!i)return null;let s=q(i.split("/").pop()??""),a=q(i),l=()=>dw(s)||mw(e,t,r,o);if(lw.has(s)||cw.some((d)=>s.startsWith(d)))return null;let c=q(vw(e,t,r,o));for(let d of hs){let f=`~/${d.suffixParts.join("/")}`;if((Yf(a,f)||Yf(c,f))&&Et(d.id,n))return d.id}let u=hw(i,t,n,r,o);if(u)return u;if(sw.has(s))return null;for(let d of gs)if(s===d.basename&&Et(d.id,n))return d.id;if(s.startsWith(aw)&&Et(go.id,n)&&l())return go.id;for(let d of ys)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let f=s.slice(d.prefix.length)[0];if((f==="-"||f==="_")&&Et(d.id,n)&&l())return d.id}for(let d of Cs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&Et(d.id,n))return d.id}if(Sw(a))return null;if(!s.includes(".")&&nr.pattern.test(s)&&Et(nr.id,n))return nr.id;let m=bw(s,n);if(m)return m;return null}function hw(e,t,n,r,o){return ho.find((i)=>{if(!Et(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return H(e,K(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=q(e).split("/");return H(e,K(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Ur(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return H(e,ut("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=K(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return H(e,s,["auth.json",".credentials.json"])||Hr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=K(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=q(e).split("/").at(-1)??"";return H(e,s,["config.toml"])||a.endsWith(".config.toml")&&H(e,s,[a])}case"secret.cli.gemini":return H(e,ye(K(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=q(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ye(K(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return H(e,ye(K(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Ur(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>H(e,ut(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=K(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return H(e,s,["config.json"])||Hr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return H(e,K(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=K(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=K(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return H(e,s,["server.token"])||Hr(e,s,["credentials"])||Hr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=q(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||H(e,K(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||H(e,K(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ye(K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=q(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return H(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&H(e,s,[a])||c.some((u)=>Ur(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?K(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ye(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ye(K(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(q(e).split("/").at(-1)??"")||H(e,s,l)||(c?.trim()?Ur(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>H(e,ut(u,t,r,o),l))}case"secret.cli.pi":return H(e,K(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return H(e,K(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=ut("~",t,r,o);return[ye(K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ye(s,".local","share","amp")].some((l)=>H(e,l,["secrets.json"]))||Hr(e,ye(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ye(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ye(ut("~",t,r,o),".config","amp")],l=q(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>H(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Ur(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ye(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ye(K(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return H(e,ut("~/.cursor",t,r,o),["auth.json"])||H(e,s,["auth.json"])||q(e).split("/").at(-1)==="mcp-auth.json"&&pn(q(e),q(a))}case"secret.cli.cursor.config":{let s=q(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return H(e,K(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=q(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||H(e,K(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||H(e,ut("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var qf=new WeakMap;function K(e,t,n,r,o){let i=qf.get(o)??new Map;qf.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=ut(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function H(e,t,n){return n.some((r)=>ap(e,ye(t,r)))}function Hr(e,t,n){return n.some((r)=>pn(q(e),q(ye(t,r))))}function Ur(e,t,n,r,o){return ap(e,ut(t,n,r,o))}function ap(e,t){return q(e)===q(t)}function ye(e,...t){return it([e,...t].filter(Boolean).join("/"))}function yw(e,t,n,r,o,i){if(n.length===0)return!1;let s=q($r(e,t,o,i));return n.some((a)=>pn(s,q($r(a,r,o,i))))}function Cw(e,t,n,r,o,i){if(n.length===0)return!1;let s=q($r(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?it(N(Me(a),o.paths,i)):"",c=q(l),u=o.env.get("CC_SAFETY_NET_HOME"),m=q(u?it(N(Oe.resolve(Me(u)),o.paths,i)):l&&it(N(`${l}/.cc-safety-net`,o.paths,i)));if(m&&pn(s,m))return!1;return n.some((d)=>{let f=q($r(d,r,o,i));if(!f)return!1;if(c&&(c===f||c.startsWith(f.endsWith("/")?f:`${f}/`)))return!1;return pn(s,f)})}function Sw(e){let t=e.split("/");return t.some((n)=>fw.has(n))||pw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function bw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Ss)if(r===o.extension&&Et(o.id,t))return o.id;for(let o of bs)if(o.pattern.test(r)&&Et(o.id,t))return o.id;return null}function q(e){return e.toLowerCase()}function Et(e,t){return!t?.disabledRules?.includes(e)}function ut(e,t,n,r){let{home:o,normalized:i}=ml(e,n,r);if(!i)return"";if(!o)return i;let s=fl(i,o),a=Oe.isAbsolute(s)?s:it(Oe.resolve(t,s)),l=it(N(a,n.paths,r));if(!pn(l,o)){if(Oe.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Yf(e,t){return e===t||e.startsWith(`${t}/`)}function vw(e,t,n,r){let{home:o,normalized:i}=ml(e,n,r);if(!i||!o)return"";let s=fl(i,o),a=Oe.posix.normalize(Oe.isAbsolute(s)?s:it(Oe.resolve(t,s))),l=it(Me(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&pn(c(a),c(d)));if(u===void 0)return"";let m=a.slice(u.length);return m?`~${m}`:"~"}function $r(e,t,n,r){let{home:o,normalized:i}=ml(e,n,r);if(!i)return"";let s=o?fl(i,o):i;return it(N(Oe.isAbsolute(s)?s:Oe.resolve(t,s),n.paths,r))}function ml(e,t,n){let r=t.env.get("HOME")??t.home,o=r?it(N(Me(r),t.paths,n)):"",i=it(Me(Ew(yt(e,t))));return{home:o,normalized:i}}function Ew(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Zf.fileURLToPath(e)}catch{return e}}function fl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ye(t,e.slice(2));return e}function Rw(e){if(process.platform==="win32")return!0;return Oe.win32.parse(e).root.length>1}function it(e){let t=e.trim(),n=(t.includes("\\")&&Rw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function pn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function xt(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class gn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var xw={findPolicyMutation:Ff,findGitMetadataMutation:yd,resolveGitMetadata:_w,loadPolicySnapshot:cu,findSensitiveTarget:tp,analyzeCommand:Tf,getModes:es};function lp(e,t){let n={...xw,...t.dependencies},r=Pw(e),o=jr(e)?e.command:r,i=Ut("policy-protection",o,()=>Rr(e,t.factParserDependencies)),s=Ee(i,"input-candidate"),a=Ee(i,"declared-command");if(jr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:st,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Md,intent:"stop_and_explain",evidence:[]}};let l=me(),c=Ut("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Ut("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Wf,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let m=Ut("policy-protection",o,()=>Mf(i,t.environment,l));if(m){let E=o??m.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Of,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:m.target}]}}}let d=Ut("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:$e,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let f=Ut("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=f.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...ww(f)},y=p.secretProtection.enabled===!1?null:Ut("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:jr(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Xf,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!jr(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...pl("command-validation",o),...g};let v=Ut("command-analysis",o,()=>If(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:f,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Aw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function _w(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function ww(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Aw(e){return Ee(e,"declared-command")?.program}function Pw(e){try{return At(e.input)}catch(t){let n=jr(e)?e.command:void 0;throw new gn("policy-protection",pl("policy-protection",t instanceof Se?void 0:n,t),t)}}function Ut(e,t,n){try{return n()}catch(r){throw new gn(e,pl(e,r instanceof Se?void 0:t,r),r)}}function pl(e,t,n){let r=n instanceof D||n instanceof Qe;return{stage:e,decision:{kind:"deny",reason:r?zi:Kn,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function jr(e){return e.route.kind==="command"}var Oi=require("node:fs"),$n=require("node:path");var ce=require("node:fs"),Un=require("node:path");function cp(e,t={}){return Eo(Rn(e,t),e.home).policy.audit.retention_days}var hl=86400000,Tw=".last-prune",Iw=/^\d{4}-\d{2}$/,kw=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,up=(e)=>Math.floor(e/hl);function mp(e,t,n=()=>new Date){try{let r=n().getTime();if(!ce.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Un.join(t,Tw),i=ce.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&up(i)===up(r))return;let s=r-cp(e)*hl,a=new Date(r).toISOString().slice(0,7);for(let l of gl(t)){if(l.isDirectory()){Ow(Un.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))Mw(Un.join(t,l.name),s)}ce.writeFileSync(o,"",{mode:384}),ce.utimesSync(o,r/1000,r/1000)}catch{}}function Ow(e,t,n){for(let r of gl(e)){if(!r.isDirectory()||!Iw.test(r.name))continue;let o=Un.join(e,r.name);for(let i of gl(o)){if(!i.isFile())continue;let s=kw.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+hl;if(!Number.isFinite(a)||a>=t)continue;fp(Un.join(o,i.name))}if(r.name!==n)dp(o)}dp(e)}function Mw(e,t){try{let n=ce.lstatSync(e);if(n.mtimeMs>=t)return;let r=ce.readFileSync(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(Dw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ce.lstatSync(e).mtimeMs!==n.mtimeMs)return;fp(e)}catch{}}function Dw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function gl(e){try{return ce.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function fp(e){try{ce.unlinkSync(e)}catch{}}function dp(e){try{ce.rmdirSync(e)}catch{}}var Nw="2.4.0",Lw=1e4,Ww=2000,Fw=256,Gw=32768;function zw(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function Bw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function yl(e,t,n,r,o,i,s={}){let a=zw(t);if(!a)return;let l=Uw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=ki(_t(n),s.failureStage?Number.POSITIVE_INFINITY:Lw),m=ki(_t(r),Ww),d=s.toolName?ki(_t(s.toolName),Fw):void 0,f=i===null?void 0:ki(_t(i),Gw),p=$n.join(l,Bw(f?.value??null),c.slice(0,7));Oi.mkdirSync(p,{recursive:!0,mode:448});let h=$n.join(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??ns)(),v:Nw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Oi.appendFileSync(h,`${JSON.stringify(g)}
+`).filter((o)=>o.trim()).map(Dw);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ce.lstatSync(e).mtimeMs!==n.mtimeMs)return;fp(e)}catch{}}function Dw(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function gl(e){try{return ce.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function fp(e){try{ce.unlinkSync(e)}catch{}}function dp(e){try{ce.rmdirSync(e)}catch{}}var Nw="2.4.1",Lw=1e4,Ww=2000,Fw=256,Gw=32768;function zw(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function Bw(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function yl(e,t,n,r,o,i,s={}){let a=zw(t);if(!a)return;let l=Uw(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=ki(_t(n),s.failureStage?Number.POSITIVE_INFINITY:Lw),m=ki(_t(r),Ww),d=s.toolName?ki(_t(s.toolName),Fw):void 0,f=i===null?void 0:ki(_t(i),Gw),p=$n.join(l,Bw(f?.value??null),c.slice(0,7));Oi.mkdirSync(p,{recursive:!0,mode:448});let h=$n.join(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??ns)(),v:Nw,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:m.value,...u.truncated||m.truncated||d?.truncated||f?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:f?.value??null};Oi.appendFileSync(h,`${JSON.stringify(g)}
 `,{encoding:"utf-8",mode:384}),mp(e,l,s.now)}catch{}}function ki(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function Hw(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&$n.isAbsolute(n)?n:null}function Uw(e){let t=Hw(e);return t?$n.join(t,".cc-safety-net","logs"):null}function gp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=pp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?pp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function pp(e){return"command"in e?e.command??"":""}function hp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;yl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function yp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;yl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Sp(e,t,n){try{let r=lp(t,{environment:e,...n.guard});return Cp(e,t,r,n),r}catch(r){if(!(r instanceof gn))throw r;throw Cp(e,t,r.evaluation,n,!(r.cause instanceof Se),{stage:r.stage,errorCode:$w(r.cause)}),r}}function Cp(e,t,n,r,o=!0,i){hp(e,gp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function $w(e){if(e instanceof D)return P[e.kind].errorCode;if(e instanceof Se)return"tool-input-limit";if(e instanceof Qe)return"structural-shell-syntax-limit";return"unexpected-error"}var Mi=(e,t,n,r,o)=>Pt(e.cwd,t,n,r,o.paths,process.cwd());function jw(e,t){console.log(JSON.stringify(e(_l(t))))}async function Vw(e){let t;try{t=(await Vl(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return eo(t,e,"Failed to parse hook input JSON.")}async function Kw(e){let t=nc(),n=await Vw(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){ne(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=Xw(n),s=(p,h)=>{yp(t,p,()=>e.getSessionId(n),{agent:r,shape:o,toolName:h,cwd:i}),e.outputDeny(p)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){ne((p)=>s(p),Zw(n));return}let l=a,c=(p)=>s(p,l),u;try{u=e.getToolInput(n,l,c,t)}catch(p){if(!(p instanceof Se))throw p;ne(c,void 0,l);return}if(!u.ok)return;let m=e.getContext(n,u.input,l,c,t);if(!m)return;let d;try{d=At(u.input)}catch(p){if(!(p instanceof Se))throw p;ne(c,void 0,l);return}let f=Xn(l,u.input,u.route,m,d??null);try{let p=Sp(t,f,{guard:{auditAllowed:rc(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),h=Bi(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:l});if(h){e.outputDeny(h);return}e.outputAllow?.()}catch(p){if(!(p instanceof gn))throw p;qw(p,t.env);let h=Bi(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:l});if(h)e.outputDeny(h);return}}function qw(e,t){if(!Vt(le.debug,t))return;console.error(`CC Safety Net debug: ${Yw(e.stage)}: ${wl(e.cause)}`)}function Yw(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function Zw(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function Xw(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function Ce(e){let t=(o)=>jw(e.createDenyOutput,o),n=e.createAllowOutput,r=n?()=>console.log(JSON.stringify(n())):void 0;try{await Kw({...e,outputDeny:t,outputAllow:r})}catch(o){console.error("CC Safety Net error:",o),t(Sn())}}var Jw=new Map([["run_command","auto"]]),Qw=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function bp(e){return ae(e,Jw)}async function vp(){await Ce({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:oA(e.toolCall?.args,t),route:bp(t)}),getContext:eA,getSessionId:(e)=>e.conversationId})}function eA(e,t,n,r,o){let s=rA(e,o.paths).flatMap((u)=>{let m=lt([u],o.paths);return m?[m]:[]});if(!s[0])return hn(r,t,n),null;if(n!=="run_command"){let u;try{u=tA(t,n,s,o.paths)}catch(m){if(m instanceof Se)return hn(r,void 0,n),null;if(!(m instanceof D))throw m;return hn(r,t,n),null}if(!u)return hn(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return hn(r,t,n),null;let c=ft(l,s,o.paths);if(c){let u=Ep(c,s);if(!u)return hn(r,t,n,l),null;return{configCwd:u,executionCwd:c}}return hn(r,t,n,l),null}function tA(e,t,n,r){let o=bp(t),i=[...Jr(e,Qw),...o.kind==="patch"?Qr(e):[]].filter(jn.isAbsolute),s=me(),a=new Set(i.flatMap((l)=>{let c=Ep(N(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function Ep(e,t){return t.filter((n)=>nA(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function nA(e,t){let n=jn.relative(t,e);return n===""||!n.startsWith("..")&&!jn.isAbsolute(n)}function hn(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0;e(Sn({command:typeof o==="string"?o:void 0,segment:r,toolName:n}))}function rA(e,t){if(e.workspacePaths===void 0)return[process.cwd()];let n=Array.isArray(e.workspacePaths)?e.workspacePaths.filter((r)=>typeof r==="string"&&r.trim()!==""):[];return lt(n,t)?n:[]}function oA(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var Di=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:7,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:7,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:6,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:6,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:8,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:9,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:10,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:11,install:{order:11,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:12,install:{order:12,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:13,install:{order:13,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],LN=Di.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Rp=Di.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),WN=Di.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),FN=Object.fromEntries(Di.map((e)=>[e.id,e.displayName]));var yn=require("node:path");function xp(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!yn.isAbsolute(e))return"unknown";try{let n=me(),r=typeof e==="string"&&e?N(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||yn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||yn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||yn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!yn.isAbsolute(l))return[];return Zi(r,N(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch(n){if(n instanceof D)return"unknown";return"unknown"}if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var Cl="PreToolUse",_p="BeforeTool",wp="pre_tool_call",Sl="PreToolUse";async function Ni(e){await Ce({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:Cl,permissionDecision:"deny",permissionDecisionReason:t}}),isSupported:(t)=>t.hook_event_name===Cl,getToolName:(t)=>t.tool_name,getToolInput:(t,n)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n)}),getContext:Mi,getSessionId:(t)=>t.session_id})}var iA=new Map([["Bash","posix"],["PowerShell","powershell"]]);function sA(e){return ae(e,iA)}async function Ap(){await Ni({agent:"claude-code",getAgent:(e,t)=>xp(e.transcript_path,t),getToolRoute:sA})}var aA=new Map([["Bash","auto"]]);async function Pp(){await Ni({agent:"codex",getToolRoute:(e)=>ae(e,aA)})}var lA=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function cA(e){return ae(e,lA)}async function Tp(){await Ce({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};let r=eo(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(r===void 0)return{ok:!1};return{ok:!0,input:r,route:cA(t)}},getContext:(e,t,n,r,o)=>Pt(e.cwd,t,n,r,o.paths,process.cwd()),getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var uA=new Map([["Shell","auto"]]);function dA(e){return ae(e,uA)}async function Ip(){await Ce({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:dA(t)}),getContext:mA,getSessionId:(e)=>e.conversation_id})}function mA(e,t,n,r,o){let i=fA(e,o.paths);if(!i[0])return ne(r,t,n),null;let s=ft(gA(e.cwd),i,o.paths);if(!s)return ne(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:s,executionCwd:s};if(!Object.hasOwn(t,"working_directory"))return{configCwd:s,executionCwd:s};let a=t.working_directory;if(typeof a!=="string"||a.trim()==="")return ne(r,t,n),null;let l=ft(a,i,o.paths);if(!l)return ne(r,t,n,a),null;return{configCwd:s,executionCwd:l}}function fA(e,t){return pA(e).flatMap((n)=>{let r=lt([n],t);return r?[r]:[]})}function pA(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[e.cwd]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="")}function gA(e){return typeof e==="string"&&e.trim()!==""?e:"."}var hA=new Map([["run_shell_command","auto"]]);function yA(e){return ae(e,hA)}async function kp(){await Ce({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===_p,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:yA(t)}),getContext:Mi,getSessionId:(e)=>e.session_id})}var CA=new Map([["run_terminal_command","auto"]]);function SA(e){return ae(e,CA)}async function Op(){await Ce({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return ne(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:SA(t)}},getContext:bA,getSessionId:(e)=>e.sessionId})}function bA(e,t,n,r,o){let i=lt(vA(e),o.paths);if(!i)return ne(r,t,n),null;let s=ft(EA(e.cwd),[i],o.paths);if(!s)return ne(r,t,n,typeof e.cwd==="string"?e.cwd:void 0),null;return{configCwd:s,executionCwd:s}}function vA(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?[t]:[]}function EA(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Mp=require("node:path");var RA=new Map([["terminal","posix"]]);async function Dp(){await Ce({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===wp,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:ae(t,RA)}),getContext:xA,getSessionId:(e)=>e.session_id})}function xA(e,t,n,r,o){let i=Pt(e.cwd,t,n,r,o.paths,process.cwd());if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return ne(r,t,n),null;let a=lt([Mp.resolve(i.configCwd,s)],o.paths);if(!a)return ne(r,t,n,s),null;return{...i,executionCwd:a}}var Np=new Map([["Bash","posix"]]);function _A(e){return ae(e,Np)}async function Lp(){await Ce({agent:"kimi-code",createDenyOutput:(e)=>({hookSpecificOutput:{hookEventName:Sl,permissionDecision:"deny",permissionDecisionReason:e}}),isSupported:(e)=>e.hook_event_name===Sl,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:_A(t)}),getContext:(e,t,n,r,o)=>{let i=Pt(e.cwd,t,n,r,o.paths,process.cwd());if(!i)return null;let s=e.tool_input;if(!Np.has(n)||!s||!Object.hasOwn(s,"cwd"))return i;let a=s.cwd;if(typeof a!=="string"||a.trim()==="")return ne(r,t,n),null;let l=ft(a,[i.configCwd],o.paths);if(!l)return ne(r,t,n,a),null;return{configCwd:i.configCwd,executionCwd:l}},getSessionId:(e)=>e.session_id})}var wA={"antigravity-cli":vp,"claude-code":Ap,codex:Pp,"copilot-cli":Tp,cursor:Ip,"gemini-cli":kp,"grok-build":Op,"hermes-agent":Dp,"kimi-code":Lp},bl=Rp.map((e)=>({...e,run:wA[e.id]}));function Wp(e){let t=Kr({label:"hook",booleans:Object.fromEntries(bl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=bl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Fp(e){return bl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function AA(){let e=process.argv.slice(2),t=e[0],n=Kr({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=Wp(e.slice(1));if(i){await i.run();return}}let o=Fp(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}AA().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});

package/dist/chunks/{index-ver1bgty.js → index-31w7hfwv.js}

@@ -1,4 +1,4 @@
 import{n,a,K,f,Ne,d,He,b,p,V}from"./index-chc1n91k.js";import{appendFileSync as re,mkdirSync as oe}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as D,readdirSync as j,readFileSync as U,rmdirSync as B,statSync as C,unlinkSync as X,utimesSync as z,writeFileSync as Y}from"node:fs";import{join as m}from"node:path";function ne(t,e={}){return He(d(t,e),t.home).policy.audit.retention_days}var A=86400000,Z=".last-prune",J=/^\d{4}-\d{2}$/,Q=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,L=(t)=>Math.floor(t/A);function q(t,e,o=()=>new Date){try{let r=o().getTime();if(!C(e,{throwIfNoEntry:!1})?.isDirectory())return;let i=m(e,Z),u=C(i,{throwIfNoEntry:!1})?.mtimeMs;if(u!==void 0&&L(u)===L(r))return;let c=r-ne(t)*A,s=new Date(r).toISOString().slice(0,7);for(let l of v(e)){if(l.isDirectory()){W(m(e,l.name),c,s);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))ee(m(e,l.name),c)}Y(i,"",{mode:384}),z(i,r/1000,r/1000)}catch{}}function W(t,e,o){for(let r of v(t)){if(!r.isDirectory()||!J.test(r.name))continue;let i=m(t,r.name);for(let u of v(i)){if(!u.isFile())continue;let c=Q.exec(u.name);if(!c||c[2]!==r.name)continue;let s=Date.parse(`${c[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(s)||s>=e)continue;G(m(i,u.name))}if(r.name!==o)O(i)}O(t)}function ee(t,e){try{let o=D(t);if(o.mtimeMs>=e)return;let r=U(t,"utf-8").split(`
-`).filter((i)=>i.trim()).map(te);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=e))return;if(D(t).mtimeMs!==o.mtimeMs)return;G(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,o=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(o)?o:void 0}catch{return}}function v(t){try{return j(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function G(t){try{X(t)}catch{}}function O(t){try{B(t)}catch{}}var ae="2.4.0",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let o=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(o=o.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!o||o==="."||o==="..")return null;return o}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,o,r,i,u,c={}){let s=le(e);if(!s)return;let l=M(t);if(!l)return;try{let y=(c.now??(()=>new Date))().toISOString(),_=g(K(o),c.failureStage?Number.POSITIVE_INFINITY:ce),N=g(K(r),de),h=c.toolName?g(K(c.toolName),ue):void 0,E=u===null?void 0:g(K(u),se),w=S(l,me(E?.value??null),y.slice(0,7));oe(w,{recursive:!0,mode:448});let H=S(w,`${y.slice(0,10)}-${s}.jsonl`),P={ts:y,id:(c.createId??Ne)(),v:ae,sessionId:s,decision:c.decision??"deny",agent:c.agent,shape:c.shape,level:c.level,configFallback:c.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:i,ruleId:c.ruleId,intent:c.intent,failureStage:c.failureStage,errorCode:c.errorCode,cwd:E?.value??null};re(H,`${JSON.stringify(P)}
+`).filter((i)=>i.trim()).map(te);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=e))return;if(D(t).mtimeMs!==o.mtimeMs)return;G(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,o=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(o)?o:void 0}catch{return}}function v(t){try{return j(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function G(t){try{X(t)}catch{}}function O(t){try{B(t)}catch{}}var ae="2.4.1",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let o=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(o=o.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!o||o==="."||o==="..")return null;return o}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,o,r,i,u,c={}){let s=le(e);if(!s)return;let l=M(t);if(!l)return;try{let y=(c.now??(()=>new Date))().toISOString(),_=g(K(o),c.failureStage?Number.POSITIVE_INFINITY:ce),N=g(K(r),de),h=c.toolName?g(K(c.toolName),ue):void 0,E=u===null?void 0:g(K(u),se),w=S(l,me(E?.value??null),y.slice(0,7));oe(w,{recursive:!0,mode:448});let H=S(w,`${y.slice(0,10)}-${s}.jsonl`),P={ts:y,id:(c.createId??Ne)(),v:ae,sessionId:s,decision:c.decision??"deny",agent:c.agent,shape:c.shape,level:c.level,configFallback:c.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:i,ruleId:c.ruleId,intent:c.intent,failureStage:c.failureStage,errorCode:c.errorCode,cwd:E?.value??null};re(H,`${JSON.stringify(P)}
 `,{encoding:"utf-8",mode:384}),q(t,l,c.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function Ke(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let o=e||t.home;return o&&ie(o)?o:null}function M(t){let e=Ke(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,o,r=!0,i){if(e.decision.kind==="allow"){if(!o||t.route.kind!=="command")return;let s=T(t);return{decision:"allow",command:s,segment:s,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let u=e.decision.evidence.find((s)=>s.kind==="command"),c=u?.command??(r?T(t):"");return{decision:"deny",command:c,segment:u?.segment??c,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function T(t){return"command"in t?t.command??"":""}function x(t,e,o,r){if(!e)return;let i;try{i=o()}catch{return}if(typeof i!=="string"||!i.trim())return;I(t,i,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:r.agent,shape:r.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function we(t,e,o,r){let i;try{i=o()}catch{return}if(typeof i!=="string"||!i.trim())return;I(t,i,e.command??"",e.segment??e.command??"",e.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function F(t,e,o){try{let r=V(e,{environment:t,...o.guard});return R(t,e,r,o),r}catch(r){if(!(r instanceof p))throw r;throw R(t,e,r.evaluation,o,!(r.cause instanceof f),{stage:r.stage,errorCode:fe(r.cause)}),r}}function R(t,e,o,r,i=!0,u){x(t,k(e,o,r.guard?.auditAllowed??!1,i,u),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function fe(t){if(t instanceof a)return n[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof b)return"structural-shell-syntax-limit";return"unexpected-error"}
 export{ne,q,Ke,M,we,F};