cc-safety-net 2.4.0 → 2.4.1

package/dist/index.js

@@ -1 +1 @@
-import{Ce,j,Se,l,xe,f,ce,oe,de,u,p}from"./chunks/index-chc1n91k.js";import{te}from"./chunks/index-n0tze7vr.js";import{we,F}from"./chunks/index-ver1bgty.js";import{resolve as h}from"node:path";function w(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:te.slice(te.indexOf("# CC Safety Net"))}}}var T=new Set(["powershell","pwsh"]),A=new Set(["bash","dash","ksh","sh","zsh"]);function v(o={}){return async({directory:r,homeDir:t})=>{let n=h(r),a;return{config:async(i)=>{a=i;let c=w(),s=i.command??{};i.command={...c,...s}},"tool.execute.before":async(i,c)=>{let s=t===void 0?l():{...l(),home:t},m=(e,R,S=n)=>{we(s,e,()=>i.sessionID,{agent:"opencode",toolName:R,cwd:S}),E(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")m(j());let d=c.args,g;try{g=oe(d)}catch(e){if(!(e instanceof f))throw e;m(j({toolName:i.tool}),i.tool)}let D=I(a?.shell),x=b(i.tool,D),C=N(n,d);if(!de(n)||!C)return m(j({command:g,toolName:i.tool}),i.tool);let P={configCwd:n,executionCwd:C},k=u(i.tool,d,x,P,g??null);try{let e=F(s,k,{guard:{auditAllowed:xe(s.env),dependencies:o},audit:{agent:"opencode",getSessionId:()=>i.sessionID}});y(e,!0)}catch(e){if(!(e instanceof p))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;y(e.evaluation,!0);return}}}}}function I(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let a=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!a)return"auto";if(T.has(a))return"powershell";if(A.has(a))return"posix";return"auto"}function b(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:ce(o)}}function N(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?O(t):t,a=h(o,n);return de(a)?a:null}function O(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function y(o,r){let t=Ce(o,{includeEvidence:r});if(t)E(t)}function E(o){throw Error(Se(o))}var Q=v();export{Q as CCSafetyNetPlugin};
+import{Ce,j,Se,l,xe,f,ce,oe,de,u,p}from"./chunks/index-chc1n91k.js";import{te}from"./chunks/index-n0tze7vr.js";import{we,F}from"./chunks/index-31w7hfwv.js";import{resolve as h}from"node:path";function w(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:te.slice(te.indexOf("# CC Safety Net"))}}}var T=new Set(["powershell","pwsh"]),A=new Set(["bash","dash","ksh","sh","zsh"]);function v(o={}){return async({directory:r,homeDir:t})=>{let n=h(r),a;return{config:async(i)=>{a=i;let c=w(),s=i.command??{};i.command={...c,...s}},"tool.execute.before":async(i,c)=>{let s=t===void 0?l():{...l(),home:t},m=(e,R,S=n)=>{we(s,e,()=>i.sessionID,{agent:"opencode",toolName:R,cwd:S}),E(e)};if(typeof i.tool!=="string"||i.tool.trim()==="")m(j());let d=c.args,g;try{g=oe(d)}catch(e){if(!(e instanceof f))throw e;m(j({toolName:i.tool}),i.tool)}let D=I(a?.shell),x=b(i.tool,D),C=N(n,d);if(!de(n)||!C)return m(j({command:g,toolName:i.tool}),i.tool);let P={configCwd:n,executionCwd:C},k=u(i.tool,d,x,P,g??null);try{let e=F(s,k,{guard:{auditAllowed:xe(s.env),dependencies:o},audit:{agent:"opencode",getSessionId:()=>i.sessionID}});y(e,!0)}catch(e){if(!(e instanceof p))throw e;if(e.stage==="policy-protection"||e.stage==="config-load"||e.stage==="secret-protection")throw e.cause;y(e.evaluation,!0);return}}}}}function I(o,r=process.platform,t=process.env.SHELL){if(typeof o!=="string"&&r==="win32")return"powershell";let n=typeof o==="string"?o:t;if(typeof n!=="string")return"auto";let a=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!a)return"auto";if(T.has(a))return"powershell";if(A.has(a))return"posix";return"auto"}function b(o,r){if(o==="bash")return{kind:"command",shell:r};return{kind:ce(o)}}function N(o,r){if(!r||typeof r!=="object"||Array.isArray(r))return o;if(!Object.hasOwn(r,"workdir"))return o;let t=r.workdir;if(typeof t!=="string"||t.trim()==="")return null;let n=process.platform==="win32"?O(t):t,a=h(o,n);return de(a)?a:null}function O(o){return o.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(t,n)=>`${n.toUpperCase()}:/`)}function y(o,r){let t=Ce(o,{includeEvidence:r});if(t)E(t)}function E(o){throw Error(Se(o))}var Q=v();export{Q as CCSafetyNetPlugin};

package/dist/openclaw/cc-safety-net/index.js

@@ -1,5 +1,5 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.4.0
+// version: 2.4.1
 var cl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var vi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",je="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",Tn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var bi={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Cp={errorCode:"structural-shell-syntax-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},xt={errorCode:"tool-input-limit",reason:"CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user."},An={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},Tr={errorCode:"structural-shell-syntax-limit",reason:"Parallel command expands beyond CC Safety Net's analysis limits. Reduce the template or explicit argument list and retry."},A=Object.freeze({realpathAttempts:{cap:16384,...bi},processedCandidateBytes:{cap:4194304,...bi},pathEnvironmentExpansion:{cap:64,...bi},structuralShellSyntax:Cp,recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...An},trackedHeredocFiles:{cap:64,...An},controlFlowStates:{cap:64,...An},wrapperPeelIterations:{cap:20,...An},derivedCommandShape:An,parallelChildAnalyses:{cap:1024,...Tr},parallelDerivedTokens:{cap:16384,...Tr},parallelDerivedBytes:{cap:1048576,...Tr},parallelPlaceholderReplacements:{cap:16384,...Tr},hookInputBytes:{cap:8388608,errorCode:"tool-input-limit",reason:"Failed to parse hook input JSON."},toolInputDepth:{cap:64,...xt},toolInputNodes:{cap:1e4,...xt},toolInputKeys:{cap:1e4,...xt},toolInputStringBytes:{cap:1048576,...xt},toolInputAggregateStringBytes:{cap:4194304,...xt},toolInputGitDiffCandidates:{cap:64,...xt},toolInputShape:xt});class F extends Error{kind;name="AnalysisLimit";constructor(e){super(A[e].reason);this.kind=e}}function Se(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>A[t].cap)throw new F(t)}}}var Sp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function lt(e){return bp(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function bp(e){return Sp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var vp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Ep(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return["BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,vp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
 `)}function ul(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence.find((r)=>r.kind==="command"):void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{}}}function In(e={}){return{reason:Tn,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function dl(e){return Ep({...e,redact:lt})}function fl(e){return lt(e instanceof Error?e.message:String(e))}import{lstatSync as ag,realpathSync as lg,statSync as cg}from"node:fs";import{homedir as ug,tmpdir as dg}from"node:os";import{statSync as og}from"node:fs";import{join as ig}from"node:path";import{basename as gl,dirname as Rp,isAbsolute as xp,join as _p,normalize as wp,resolve as ml}from"node:path";var Pp=256,Ir=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function ct(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function _i(e,t){return Ei(e,0,t)}function Ei(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=Ri(e,o+2),a=Ap(e,o,t);if(a===null){if(Ir.has(s))throw new F("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Tp(l,t,n),o=a+1;continue}let i=Ri(e,o+1);if(!i){r+="$",o++;continue}r+=xi(i,n)??`$${i}`,o+=i.length+1}return r}function Ap(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>A.pathEnvironmentExpansion.cap)throw new F("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Tp(e,t,n){let r=e.slice(2,-1),o=Ri(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return xi(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ir.has(o))throw new F("pathEnvironmentExpansion");return e}if(!Ir.has(o))return e;if(s.endsWith("="))throw new F("pathEnvironmentExpansion");let a=xi(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new F("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Ei(i.slice(s.length),t+1,n);return l?Ei(i.slice(s.length),t+1,n):""}function Ri(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function xi(e,t){if(!Ir.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function B(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){hl(n,i);let s=t.realpath(i);if(s!==null)return pl(n,e,s,o);let a=Rp(i);if(a===i||o.length>=Pp)return pl(n,e,i,o);o.push(gl(i)),i=a}}function pl(e,t,n,r){let o=r.length===0?n:_p(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Ip(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;hl(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function hl(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ie(e,t,n,r){let o=Cl(e,t,n);if(!o)return"";return B(o,n.paths,r).replace(/\\/g,"/")}function yl(e,t,n,r,o){let i=Cl(e,t,n);if(!i)return null;if(o(gl(i)))return B(i,n.paths,r).replace(/\\/g,"/");let s=Ip(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Cl(e,t,n){let r=n.home,o=_i(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?ml(r,o.slice(2)):o,s=be(i);return wp(xp(s)?s:ml(t,s))}import{spawnSync as kp}from"node:child_process";import{existsSync as rn,lstatSync as Op,readFileSync as wt,realpathSync as nn,statSync as kn}from"node:fs";import{dirname as kr,isAbsolute as On,join as _t,resolve as on}from"node:path";var Mp=["/usr/bin/git","/usr/local/bin/git","/opt/homebrew/bin/git","C:\\Program Files\\Git\\cmd\\git.exe","C:\\Program Files\\Git\\bin\\git.exe"],Np=5000;function bl(e,t=Xp(),n=Np){let r=Dp(e);if(r===null||!Lp(r))return null;let o=Yp(r,t,n);return o===null?null:{recursiveSubmodules:o}}function Dp(e){try{let t=nn(on(e));return kn(t).isDirectory()?t:null}catch{return null}}function Lp(e){let t=qp(e);if(!t)return!1;try{let n=Op(t);if(n.isSymbolicLink()||!n.isFile())return!1;let r=wi(t);if(!r?.commonDir)return!1;if(!Gp(r.gitDir,t))return!1;return zp(r.gitDir,kr(t))}catch{return!1}}function wi(e){try{let t=Wp(e);if(!t)return null;let n=nn(On(t)?t:on(kr(e),t));if(!kn(n).isDirectory())return null;return{gitDir:n,commonDir:Fp(n)}}catch{return null}}function Wp(e){let t=wt(e,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";if(!t.startsWith("gitdir:"))return null;return t.slice(7).trim()||null}function Fp(e){try{let t=wt(_t(e,"commondir"),"utf-8").split(/\r?\n/,1)[0]?.trim();if(!t)return null;let n=nn(On(t)?t:on(e,t));return kn(n).isDirectory()?n:null}catch{return null}}function Gp(e,t){let n=Bp(e);return n===null?!1:vl(e,n,t)}function zp(e,t){let n=$p(e);return n===null?!0:vl(e,n,t)}function Bp(e){let t=_t(e,"gitdir");if(!rn(t))return null;let n=wt(t,"utf-8").split(/\r?\n/,1)[0]?.trim()??"";return n===""?null:n}function $p(e){let t=_t(e,"config.worktree");return rn(t)?Hp(t):null}function vl(e,t,n){try{return Up(On(t)?t:on(e,t),n)}catch{return!1}}function Up(e,t){try{let n=kn(e),r=kn(t);if(n.ino!==0&&r.ino!==0&&n.dev===r.dev&&n.ino===r.ino)return!0}catch{}return Sl(nn.native(e))===Sl(nn.native(t))}function Sl(e){let t=e.replace(/^\\\\\?\\UNC\\/i,"//").replace(/^\\\\\?\\/i,"").replace(/\\/g,"/"),n=t.length>1&&t.endsWith("/")?t.slice(0,-1):t;return process.platform==="win32"?n.toLowerCase():n}function Hp(e){let t=wt(e,"utf-8"),n=!1,r=null;for(let o of t.split(/\r?\n/)){let i=o.trim();if(i===""||i.startsWith("#")||i.startsWith(";"))continue;if(i.startsWith("[")){n=/^\[core\]$/i.test(i);continue}if(!n)continue;let s=i.match(/^worktree\s*=\s*(.*)$/i);if(s)r=jp(s[1]??"")}return r}function jp(e){let t=e.trim();if(!t.startsWith('"')||!t.endsWith('"'))return t;return Kp(t.slice(1,-1))}var Vp={"\\":"\\",'"':'"',n:`
@@ -47,5 +47,5 @@ var cl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive c
 `).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function K_(e,t,n,r,o,i){let s=Et(e);if(s.length===0||at(s[0]??"").toLowerCase()!=="xargs")return!1;let a=jt(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,d=c===null?[...l,ja]:l.map((f)=>f.split(c).join(ja));return pi(d,t,n,r,o,i).some((f)=>f.target.includes(ja))}function q_(e){let t=Et(e);if(t.length===0)return null;let n=at(t[0]??"").toLowerCase();if(!ir(n))return null;return Y_(n,t.slice(1))?n:null}function Y_(e,t){let n=Za(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(Km.has(o)||Xm(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(G_.get(n)?.has(o))r++;continue}return!1}return!0}function Za(e){return/^python\d/.test(e)?"python":e}function Z_(e){let t=[];for(let n of e){if(Qm(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var zm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function X_(e,t){if(!t||!zm.test(e))return e;return`~${e.replace(zm,"").replace(/\\/g,"/")}`}function st(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function J_(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>st("jq",i))}return e.flatMap((r,o)=>o===t?[]:st("jq",r))}function Q_(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...e.slice(n).flatMap((i)=>st("git",i))];if(t.push(...st("git",r)),!le.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:st("git",o)),n++}return t}function ew(e){return e.flatMap((t,n)=>{let r=nw(t);if(r!==null)return Bm(r.flag,r.value);let o=tw(e[n-1]);return o===null?[]:Bm(o,t)})}function Bm(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Va(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Va(t.slice(n+1))}return t.startsWith("@")?Va(t.slice(1)):[]}function tw(e){if(e===void 0)return null;if(Vm.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function nw(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Vm.has(r)?{flag:r,value:e.slice(n+1)}:null}function Va(e){return e===""||e==="-"?[]:[e]}function rw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s)];for(let l=0;l<e.length;l++){if(!S_.has(e[l]??""))continue;let c=e.slice(l+1),d=c.findIndex((m)=>b_.has(m)),f=d===-1?c:c.slice(0,d),u=pi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...u.filter((m)=>m!=="{}")),!u.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,h)=>{if(!E_.has(m))return[];let g=h[p+1];return g===void 0?[]:[g,g.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function ow(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(Km.has(c)||Xm(e,c)){let f=t[l+1];if(f!==void 0)a.push(...fi(e,f,n,r,o,i,s)),l++;continue}let d=/^--(?:eval|exec)=(.*)$/.exec(c);if(d!==null&&d[1]!==void 0){a.push(...fi(e,d[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function Xm(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return __.get(t[t.length-1]??"")?.has(Za(e))??!1}function iw(e,t,n,r,o,i){if(!e.includes("system"))return[];return na(e)?.commands.flatMap((s)=>Xt(t.getShellSyntax(s),t,n,r,o,i))??[]}function sw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function aw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((r)=>r[2]).filter((r)=>r!==void 0&&r!==""),n=(e.match(Ka)??[]).filter((r)=>r!=="process.versions.sqlite"||t.some((o)=>o.includes(r)));return[...t,...t.flatMap(Xa),...n]}function fi(e,t,n,r,o,i,s){let a=(m)=>({target:m,cwd:i}),l=cw(t,lw(e));if(l===null)return aw(t).map(a);let c=l.masked.match(D_)!==null||l.literals.some((m)=>L_.test(l.masked.slice(0,m.start))),d=l.masked.match(W_)!==null||l.literals.some((m)=>F_.test(l.masked.slice(0,m.start))),f=r.refineInlineData===!0&&!rr.has(e),u=f&&!(mw(l.masked)||c||d)?[]:l.literals;return[...u.map((m)=>m.text).filter((m)=>m!=="").map(a),...u.flatMap((m)=>Xa(m.text)).map(a),...f?[]:l.literals.flatMap((m)=>m.text.match(Ka)??[]).filter((m)=>m!=="process.versions.sqlite").map(a),...c?l.literals.flatMap((m)=>qa(m.text,n,r,o,i,s)??[a(m.text)]):[],...d?l.literals.flatMap((m)=>fi(e,m.text.replace(/\\(.)/g,(p,h)=>h==="n"?`
 `:h),n,r,o,i,s)):[],...(l.masked.match(Ka)??[]).filter((m)=>m!=="process.versions.sqlite").map(a)]}function lw(e){let t=Za(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function cw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(M_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&fw(e,o))return null;let a=t==="python"?uw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,d=dw(e,c,l);if(d===null)return null;let f=e.slice(c,d);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&N_.test(f))return null;r.push({start:c,text:f});for(let u=o;u<d+l.length;u++)n[u]=" ";o=d+l.length-1}return{masked:n.join(""),literals:r}}function uw(e,t){return O_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function dw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
 `||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function fw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function mw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(R_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>x_.has(i)))continue;if(o.length>1)return!0;if(pw(e,r)===".")return!0;if(gw(e,r+n.length)==="(")return!0}return!1}function pw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function gw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function hw(e,t,n,r,o,i){return vw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Xt(a,t,{...n,capturedOutput:!0},r,o,i),...yw(a,r)?Cw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function yw(e,t){let n=ko(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||at(et(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=et(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Cw(e,t){return ko(e).flatMap((n)=>n.kind==="word"?[et(n.text,t)]:n.kind==="redirection"&&n.target?[et(n.target,t)]:[]).flatMap(Xa)}function Xa(e){let t=bw(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||Sw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function Sw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function bw(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function vw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(zn(o,n))continue;if(Jm(e,r,n)){let i=Ew(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=Rw(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Ew(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(zn(i,n))continue;if(Jm(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function Rw(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Jm(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function xw(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let d=/^--([^=]+)(?:=(.*))?$/.exec(c);if(d!==null){let f=d[1]??"",u=d[2];if(f===P_)o=!0;if(T_.has(f))r=!0;if(u!==void 0){if(f===Lm)t.push(u);continue}if(k_.has(f)){let m=e[l+1];if(f===Lm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),u="",m="";for(let h=0;h<f.length;h++){let g=f[h]??"";if(A_.has(g))r=!0;if(I_.has(g)){u=g,m=f.slice(h+1);break}}if(u==="")continue;if(m.length>0){if(u===Dm)t.push(m);continue}let p=e[l+1];if(u===Dm&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Et(e){let t=e.findIndex((n)=>!Qm(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:[...e.slice(t)]}function Qm(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var _w=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),ww=".env.",Pw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Aw=[".env.example.",".env.sample."];function Tw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Iw(e){return e.length>0&&!/\s/.test(e)}function kw(e,t,n,r){try{let o=_r(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}catch(o){if(o instanceof F)throw o;return!1}}var Ow=new Set(["node_modules","__pycache__"]),Mw=[["vendor","bundle"],["vendor","cache"]];function Nw(e,t,n,r,o){if(Tw(e))return null;let i=qe(e,t,r,o);if(!i)return null;let s=H(i.split("/").pop()??""),a=H(i),l=()=>Iw(s)||kw(e,t,r,o);if(Pw.has(s)||Aw.some((u)=>s.startsWith(u)))return null;let c=H(zw(e,t,r,o));for(let u of Qi){let m=`~/${u.suffixParts.join("/")}`;if((Um(a,m)||Um(c,m))&&it(u.id,n))return u.id}let d=Dw(i,t,n,r,o);if(d)return d;if(_w.has(s))return null;for(let u of Ji)if(s===u.basename&&it(u.id,n))return u.id;if(s.startsWith(ww)&&it(qr.id,n)&&l())return qr.id;for(let u of es)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){let m=s.slice(u.prefix.length)[0];if((m==="-"||m==="_")&&it(u.id,n)&&l())return u.id}for(let u of ts)if(s.length>u.prefix.length&&s.startsWith(u.prefix)){if(s.slice(u.prefix.length)===u.suffix&&it(u.id,n))return u.id}if(Fw(a))return null;if(!s.includes(".")&&Bn.pattern.test(s)&&it(Bn.id,n))return Bn.id;let f=Gw(s,n);if(f)return f;return null}function Dw(e,t,n,r,o){return Yr.find((i)=>{if(!it(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=H(e).split("/");return W(e,U(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||xr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,qe("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Rr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=U(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=H(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=H(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ae(U(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?xr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,qe(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Rr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,U(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Rr(e,s,["credentials"])||Rr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=H(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,U(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,U(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=H(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((d)=>xr(e,d,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?U(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ae(U(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(H(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?xr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((d)=>W(e,qe(d,t,r,o),l))}case"secret.cli.pi":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,U(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=qe("~",t,r,o);return[ae(U(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ae(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Rr(e,ae(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ae(qe("~",t,r,o),".config","amp")],l=H(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((d)=>W(e,d,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?xr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ae(U(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ae(U(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,qe("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||H(e).split("/").at(-1)==="mcp-auth.json"&&Jt(H(e),H(a))}case"secret.cli.cursor.config":{let s=H(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=H(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,U(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,qe("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var $m=new WeakMap;function U(e,t,n,r,o){let i=$m.get(o)??new Map;$m.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=qe(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>ep(e,ae(t,r)))}function Rr(e,t,n){return n.some((r)=>Jt(H(e),H(ae(t,r))))}function xr(e,t,n,r,o){return ep(e,qe(t,n,r,o))}function ep(e,t){return H(e)===H(t)}function ae(e,...t){return He([e,...t].filter(Boolean).join("/"))}function Lw(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(_r(e,t,o,i));return n.some((a)=>Jt(s,H(_r(a,r,o,i))))}function Ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=H(_r(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?He(B(be(a),o.paths,i)):"",c=H(l),d=o.env.get("CC_SAFETY_NET_HOME"),f=H(d?He(B(mi(be(d)),o.paths,i)):l&&He(B(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Jt(s,f))return!1;return n.some((u)=>{let m=H(_r(u,r,o,i));if(!m)return!1;if(c&&(c===m||c.startsWith(m.endsWith("/")?m:`${m}/`)))return!1;return Jt(s,m)})}function Fw(e){let t=e.split("/");return t.some((n)=>Ow.has(n))||Mw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function Gw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ns)if(r===o.extension&&it(o.id,t))return o.id;for(let o of rs)if(o.pattern.test(r)&&it(o.id,t))return o.id;return null}function H(e){return e.toLowerCase()}function it(e,t){return!t?.disabledRules?.includes(e)}function qe(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i)return"";if(!o)return i;let s=Qa(i,o),a=di(s)?s:He(mi(t,s)),l=He(B(a,n.paths,r));if(!Jt(l,o)){if(di(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Um(e,t){return e===t||e.startsWith(`${t}/`)}function zw(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i||!o)return"";let s=Qa(i,o),a=g_.normalize(di(s)?s:He(mi(t,s))),l=He(be(n.env.get("HOME")??n.home)),c=(u)=>process.platform==="win32"?u.toLowerCase():u,d=[o,l].find((u)=>u!==""&&Jt(c(a),c(u)));if(d===void 0)return"";let f=a.slice(d.length);return f?`~${f}`:"~"}function _r(e,t,n,r){let{home:o,normalized:i}=Ja(e,n,r);if(!i)return"";let s=o?Qa(i,o):i;return He(B(di(s)?s:mi(t,s),n.paths,r))}function Ja(e,t,n){let r=t.env.get("HOME")??t.home,o=r?He(B(be(r),t.paths,n)):"",i=He(be(Bw(et(e,t))));return{home:o,normalized:i}}function Bw(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return y_(e)}catch{return e}}function Qa(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ae(t,e.slice(2));return e}function $w(e){if(process.platform==="win32")return!0;return h_.parse(e).root.length>1}function He(e){let t=e.trim(),n=(t.includes("\\")&&$w(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Jt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function at(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Qt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Uw={findPolicyMutation:Om,findGitMetadataMutation:cd,resolveGitMetadata:Hw,loadPolicySnapshot:Xc,findSensitiveTarget:qm,analyzeCommand:Rm,getModes:Ti};function tp(e,t){let n={...Uw,...t.dependencies},r=Kw(e),o=wr(e)?e.command:r,i=Rt("policy-protection",o,()=>sr(e,t.factParserDependencies)),s=ue(i,"input-candidate"),a=ue(i,"declared-command");if(wr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:je,intent:"stop_and_explain",evidence:[{kind:"command",command:e.command,segment:e.command}]}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Td,intent:"stop_and_explain",evidence:[]}};let l=Se(),c=Rt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),d=Rt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:km,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:d.target}]}}}let f=Rt("policy-protection",o,()=>Pm(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:wm,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:f.target}]}}}let u=Rt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:[{kind:"command",command:E,segment:u.target}]}}}let m=Rt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,h=n.getModes(p,t.environment.env),g={level:h.effectiveLevel,...jw(m)},y=p.secretProtection.enabled===!1?null:Rt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:wr(e)||s?.program.dialect==="powershell"?h.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...g,decision:{kind:"deny",reason:Hm,intent:"hard_stop",ruleId:y.ruleId,evidence:[{kind:"command",command:E,segment:y.target}]}}}if(!wr(e))return{stage:"non-command",...g,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...el("command-validation",o),...g};let v=Rt("command-analysis",o,()=>xm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:h.capabilities,strict:h.strict,paranoidRm:h.paranoidRm,paranoidInterpreters:h.paranoidInterpreters,worktreeMode:h.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Vw(i),i.store),e.command,t.trace));if(v.decision)return{stage:"command-analysis",...g,..."errorCode"in v?{errorCode:v.errorCode}:{},decision:v.decision};return{stage:"command-analysis",...g,decision:{kind:"allow"}}}function Hw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function jw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Vw(e){return ue(e,"declared-command")?.program}function Kw(e){try{return Ln(e.input)}catch(t){let n=wr(e)?e.command:void 0;throw new Qt("policy-protection",el("policy-protection",t instanceof Ze?void 0:n,t),t)}}function Rt(e,t,n){try{return n()}catch(r){throw new Qt(e,el(e,r instanceof Ze?void 0:t,r),r)}}function el(e,t,n){let r=n instanceof F||n instanceof Fe;return{stage:e,decision:{kind:"deny",reason:r?vi:Tn,intent:"stop_and_explain",evidence:t?[{kind:"command",command:t,segment:t}]:[]}}}function wr(e){return e.route.kind==="command"}import{appendFileSync as sP,mkdirSync as aP}from"node:fs";import{isAbsolute as lP,join as rl}from"node:path";import{lstatSync as rp,readdirSync as qw,readFileSync as Yw,rmdirSync as Zw,statSync as op,unlinkSync as Xw,utimesSync as Jw,writeFileSync as Qw}from"node:fs";import{join as Pr}from"node:path";function np(e,t={}){return to(ln(e,t),e.home).policy.audit.retention_days}var nl=86400000,eP=".last-prune",tP=/^\d{4}-\d{2}$/,nP=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,ip=(e)=>Math.floor(e/nl);function ap(e,t,n=()=>new Date){try{let r=n().getTime();if(!op(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Pr(t,eP),i=op(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&ip(i)===ip(r))return;let s=r-np(e)*nl,a=new Date(r).toISOString().slice(0,7);for(let l of tl(t)){if(l.isDirectory()){rP(Pr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))oP(Pr(t,l.name),s)}Qw(o,"",{mode:384}),Jw(o,r/1000,r/1000)}catch{}}function rP(e,t,n){for(let r of tl(e)){if(!r.isDirectory()||!tP.test(r.name))continue;let o=Pr(e,r.name);for(let i of tl(o)){if(!i.isFile())continue;let s=nP.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+nl;if(!Number.isFinite(a)||a>=t)continue;lp(Pr(o,i.name))}if(r.name!==n)sp(o)}sp(e)}function oP(e,t){try{let n=rp(e);if(n.mtimeMs>=t)return;let r=Yw(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(iP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(rp(e).mtimeMs!==n.mtimeMs)return;lp(e)}catch{}}function iP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function tl(e){try{return qw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function lp(e){try{Xw(e)}catch{}}function sp(e){try{Zw(e)}catch{}}var cP="2.4.0",uP=1e4,dP=2000,fP=256,mP=32768;function pP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function gP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function ol(e,t,n,r,o,i,s={}){let a=pP(t);if(!a)return;let l=yP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:uP),f=gi(lt(r),dP),u=s.toolName?gi(lt(s.toolName),fP):void 0,m=i===null?void 0:gi(lt(i),mP),p=rl(l,gP(m?.value??null),c.slice(0,7));aP(p,{recursive:!0,mode:448});let h=rl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:cP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};sP(h,`${JSON.stringify(g)}
+`).filter((o)=>o.trim()).map(iP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(rp(e).mtimeMs!==n.mtimeMs)return;lp(e)}catch{}}function iP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function tl(e){try{return qw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function lp(e){try{Xw(e)}catch{}}function sp(e){try{Zw(e)}catch{}}var cP="2.4.1",uP=1e4,dP=2000,fP=256,mP=32768;function pP(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function gP(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function ol(e,t,n,r,o,i,s={}){let a=pP(t);if(!a)return;let l=yP(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),d=gi(lt(n),s.failureStage?Number.POSITIVE_INFINITY:uP),f=gi(lt(r),dP),u=s.toolName?gi(lt(s.toolName),fP):void 0,m=i===null?void 0:gi(lt(i),mP),p=rl(l,gP(m?.value??null),c.slice(0,7));aP(p,{recursive:!0,mode:448});let h=rl(p,`${c.slice(0,10)}-${a}.jsonl`),g={ts:c,id:(s.createId??Di)(),v:cP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:u?.value,command:d.value,segment:f.value,...d.truncated||f.truncated||u?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};sP(h,`${JSON.stringify(g)}
 `,{encoding:"utf-8",mode:384}),ap(e,l,s.now)}catch{}}function gi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function hP(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&lP(n)?n:null}function yP(e){let t=hP(e);return t?rl(t,".cc-safety-net","logs"):null}function up(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=cp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence.find((a)=>a.kind==="command"),s=i?.command??(r?cp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function cp(e){return"command"in e?e.command??"":""}function dp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ol(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function fp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;ol(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function pp(e,t,n){try{let r=tp(t,{environment:e,...n.guard});return mp(e,t,r,n),r}catch(r){if(!(r instanceof Qt))throw r;throw mp(e,t,r.evaluation,n,!(r.cause instanceof Ze),{stage:r.stage,errorCode:CP(r.cause)}),r}}function mp(e,t,n,r,o=!0,i){dp(e,up(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function CP(e){if(e instanceof F)return A[e.kind].errorCode;if(e instanceof Ze)return"tool-input-limit";if(e instanceof Fe)return"structural-shell-syntax-limit";return"unexpected-error"}var hp="exec",SP=new Set(["auto","gateway"]);function yp(e){e.on("before_tool_call",bP(e),{matcher:[hp],priority:50})}function bP(e,t={}){return(n,r)=>{try{return vP(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),hi(In())}}}function vP(e,t,n,r){let o=_l();if(t.abortSignal?.aborted)return hi(In());let i=EP(e,t,n,o.paths);if(!i)return;let s=()=>t.sessionId??t.sessionKey;if("malformed"in i)return fp(o,i.denial,s,{agent:"openclaw",toolName:i.denial.toolName,cwd:i.cwd}),hi(i.denial);try{let a=pp(o,i,{guard:{auditAllowed:wl(o.env),dependencies:r.guardDependencies},audit:{agent:"openclaw",getSessionId:s}});return gp(a,!0)}catch(a){if(!(a instanceof Qt))throw a;if(Pt(ee.debug,o.env))console.error(`CC Safety Net debug: openclaw before_tool_call analysis failed: ${fl(a.cause)}`);return gp(a.evaluation,!0)}}function EP(e,t,n,r){if(!e||typeof e!=="object")return en(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return en(null);if(o!==hp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return en(null,o);let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return en(null,o);if(s.host!==void 0&&!SP.has(s.host))return en(null,o,a);let l=RP(n,t.agentId,r);if(!l)return en(null,o,a);let c=xP(l,s,r);if(!c)return en(l,o,a,typeof s.workdir==="string"?s.workdir:void 0);return Wn(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function RP(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Ni(".",[r],n)}catch{return}}function xP(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Ni(r,[e],n)}function en(e,t,n,r){return{malformed:!0,denial:In({command:n,segment:r,toolName:t}),cwd:e}}function gp(e,t){let n=ul(e,{includeEvidence:t});return n?hi(n):void 0}function hi(e){return{block:!0,blockReason:dl(e)}}var mL={...cl,register:yp};export{mL as default};

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,4 +1,4 @@
-import{Ce,j,Se,it,l,i,xe,_,ce,at,u,p}from"../chunks/index-chc1n91k.js";import{te}from"../chunks/index-n0tze7vr.js";import{we,F}from"../chunks/index-ver1bgty.js";var g="cc-safety-net",P="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",y="Help me with CC Safety Net.";function c(e){e.registerCommand(g,{description:P,handler:async(n,r)=>{e.sendUserMessage(T(n),r.isIdle()?void 0:{deliverAs:"followUp"})}})}function T(e){return`${te.slice(te.indexOf("# CC Safety Net")).trimEnd()}
+import{Ce,j,Se,it,l,i,xe,_,ce,at,u,p}from"../chunks/index-chc1n91k.js";import{te}from"../chunks/index-n0tze7vr.js";import{we,F}from"../chunks/index-31w7hfwv.js";var g="cc-safety-net",P="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",y="Help me with CC Safety Net.";function c(e){e.registerCommand(g,{description:P,handler:async(n,r)=>{e.sendUserMessage(T(n),r.isIdle()?void 0:{deliverAs:"followUp"})}})}function T(e){return`${te.slice(te.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.0",
+  "version": "2.4.1",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -44,6 +44,7 @@
     "test:e2e:live": "CC_SAFETY_NET_E2E_LIVE=1 bun test tests/e2e-live",
     "test:coverage": "AGENT=1 bun test tests --path-ignore-patterns 'tests/e2e-live/**' --coverage --coverage-reporter=text --coverage-reporter=lcov",
     "cc-safety-net": "bun run src/entries/bin.ts",
+    "ccsn": "bun run src/entries/bin.ts",
     "eval": "claude plugin eval . --ablation with-without --judge-model sonnet --allow-tools \"Bash(npx -y cc-safety-net:*)\" \"Bash(npx cc-safety-net:*)\""
   },
   "author": {
@@ -105,5 +106,5 @@
     "grok",
     "grok-build"
   ],
-  "gitHead": "7622a12456f8332648164207235cd9d0df37a15c"
+  "gitHead": "879ed64316014198ccbe54b9a9152432f596f969"
 }