cc-safety-net 2.4.1 → 2.4.3

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/opencode-v2.d.ts

@@ -0,0 +1,3 @@
+import type { Plugin } from '@opencode/plugin/effect/plugin';
+declare const plugin: Plugin;
+export default plugin;

package/dist/pi/index.js

@@ -1,5 +1,5 @@
-import{Ce,j,Se,it,l,i,xe,_,ce,at,u,p}from"../chunks/index-chc1n91k.js";import{te}from"../chunks/index-n0tze7vr.js";import{we,F}from"../chunks/index-31w7hfwv.js";var g="cc-safety-net",P="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",y="Help me with CC Safety Net.";function c(e){e.registerCommand(g,{description:P,handler:async(n,r)=>{e.sendUserMessage(T(n),r.isIdle()?void 0:{deliverAs:"followUp"})}})}function T(e){return`${te.slice(te.indexOf("# CC Safety Net")).trimEnd()}
+import{ye,P,be,Xe,c,o,xe,R,V,et,d,p}from"../chunks/index-26getn55.js";import{Q}from"../chunks/index-p4h81vth.js";import{he,D}from"../chunks/index-sp43p448.js";var E="cc-safety-net",x="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",w="Help me with CC Safety Net.";function f(e){e.registerCommand(E,{description:x,handler:async(n,l)=>{e.sendUserMessage(N(n),l.isIdle()?void 0:{deliverAs:"followUp"})}})}function N(e){return`${Q.slice(Q.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 
-${e.trim()||y}`}var v=new Map([["bash","posix"]]);function C(e){e.on("tool_call",w)}var w=N();function N(e={}){return(n,r)=>{try{return E(n,r,e)}catch(o){return console.error("CC Safety Net error:",o),m(j())}}}function E(e,n,r){let o=l(),t=h(e,n,o.paths);if(!t)return;if("malformed"in t)return we(o,t.denial,()=>n.sessionManager.getSessionId(),{agent:"pi",toolName:t.denial.toolName,cwd:t.cwd}),m(t.denial);try{let a=F(o,t,{guard:{auditAllowed:xe(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:"pi",getSessionId:()=>n.sessionManager.getSessionId()}});return f(a,!0)}catch(a){if(!(a instanceof p))throw a;if(_(i.debug,o.env))console.error(`CC Safety Net debug: pi tool_call analysis failed: ${it(a.cause)}`);return f(a.evaluation,t.route.kind==="command")}}function h(e,n,r){if(!e||typeof e!=="object")return;let o=e;if(o.type!==void 0&&o.type!=="tool_call")return;if(typeof o.toolName!=="string"||o.toolName.trim()==="")return d(n);let t=typeof n.cwd==="string"&&n.cwd.trim()!==""?at(".",[n.cwd],r):void 0;if(!t)return d(n,o.toolName);let a=v.get(o.toolName);if(!o.input||typeof o.input!=="object")return a?d(n,o.toolName):void 0;if(!a)return u(o.toolName,o.input,{kind:ce(o.toolName)},{configCwd:t,executionCwd:t},null);let s=o.input.command;if(typeof s!=="string"||s.trim()==="")return d(n,o.toolName);return u(o.toolName,o.input,{kind:"command",shell:a},{configCwd:t,executionCwd:t},s)}function d(e,n){return{malformed:!0,denial:j({toolName:n}),cwd:typeof e.cwd==="string"&&e.cwd.trim()?e.cwd:null}}function f(e,n){let r=Ce(e,{includeEvidence:n});return r?m(r):void 0}function m(e){return{block:!0,reason:Se(e)}}function A(e){C(e),c(e)}export{A as default};
+${e.trim()||w}`}function g(e,n={}){return{malformed:!0,denial:P(n),cwd:e}}function T(e,n={}){return(l,t)=>{try{return I(l,t,e,n)}catch(i){return console.error("CC Safety Net error:",i),e.block(P())}}}function I(e,n,l,t){let i=c();if(l.cancelled?.(n))return l.block(P());let r=l.extract(e,n,i.paths);if(!r)return l.allow;let s=()=>l.getSessionId(e,n);if("malformed"in r)return he(i,r.denial,s,{agent:l.agent,toolName:r.denial.toolName,cwd:r.cwd}),l.block(r.denial);let m=(a,y)=>{let C=ye(a,{includeEvidence:y});return C?l.block(C):l.allow};try{let a=D(i,r,{guard:{auditAllowed:xe(i.env),policyOptions:t.policyOptions,dependencies:t.guardDependencies},audit:{agent:l.agent,getSessionId:s}});return m(a,!0)}catch(a){if(!(a instanceof p))throw a;if(R(o.debug,i.env))console.error(`CC Safety Net debug: ${l.debugLabel} analysis failed: ${Xe(a.cause)}`);return m(a.evaluation,l.includeEvidenceOnError(r))}}var b=new Map([["bash","posix"]]),O={agent:"pi",debugLabel:"pi tool_call",extract:(e,n,l)=>k(e,n,l),getSessionId:(e,n)=>n.sessionManager.getSessionId(),allow:void 0,block:(e)=>M(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function v(e){e.on("tool_call",S)}var S=A();function A(e={}){return T(O,e)}function k(e,n,l){if(!e||typeof e!=="object")return;let t=e;if(t.type!==void 0&&t.type!=="tool_call")return;if(typeof t.toolName!=="string"||t.toolName.trim()==="")return u(n);let i=typeof n.cwd==="string"&&n.cwd.trim()!==""?et(".",[n.cwd],l):void 0;if(!i)return u(n,t.toolName);let r=b.get(t.toolName);if(!t.input||typeof t.input!=="object")return r?u(n,t.toolName):void 0;if(!r)return d(t.toolName,t.input,{kind:V(t.toolName)},{configCwd:i,executionCwd:i},null);let s=t.input.command;if(typeof s!=="string"||s.trim()==="")return u(n,t.toolName);return d(t.toolName,t.input,{kind:"command",shell:r},{configCwd:i,executionCwd:i},s)}function u(e,n){return g(typeof e.cwd==="string"&&e.cwd.trim()?e.cwd:null,{toolName:n})}function M(e){return{block:!0,reason:be(e)}}function _(e){v(e),f(e)}export{_ as default};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.1",
+  "version": "2.4.3",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,6 +14,10 @@
       "types": "./dist/api.d.ts",
       "import": "./dist/api.js"
     },
+    "./opencode/v2": {
+      "types": "./dist/opencode-v2.d.ts",
+      "import": "./dist/index.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {
@@ -39,12 +43,10 @@
     "knip": "knip-bun --production",
     "check-duplicates": "bunx jscpd src tests --no-tips --exit-code 1 --reporters ai --ignore '**/*.svg' --ignore 'src/gui/frontend/**' --ignore-pattern 'import\\s[\\s\\S]*?from\\s[^;]*;'",
     "test": "bun test",
-    "test:e2e": "bun test tests/e2e",
     "test:e2e:stability": "bun test tests/e2e --randomize --rerun-each 3",
     "test:e2e:live": "CC_SAFETY_NET_E2E_LIVE=1 bun test tests/e2e-live",
     "test:coverage": "AGENT=1 bun test tests --path-ignore-patterns 'tests/e2e-live/**' --coverage --coverage-reporter=text --coverage-reporter=lcov",
     "cc-safety-net": "bun run src/entries/bin.ts",
-    "ccsn": "bun run src/entries/bin.ts",
     "eval": "claude plugin eval . --ablation with-without --judge-model sonnet --allow-tools \"Bash(npx -y cc-safety-net:*)\" \"Bash(npx cc-safety-net:*)\""
   },
   "author": {
@@ -63,19 +65,26 @@
   "devDependencies": {
     "@ampcode/plugin": "0.0.0-20260724002649-ga3413e7",
     "@biomejs/biome": "2.3.10",
-    "@opencode-ai/plugin": "^1.18.3",
+    "@opencode-ai/plugin": "^1.18.29",
+    "@opencode/plugin": "2.0.6",
+    "@opencode/schema": "2.0.6",
     "@types/bun": "latest",
+    "effect": "4.0.0-rc.112",
     "jscpd": "^5.0.14",
     "knip": "^6.32.0",
     "lefthook": "^2.1.10",
     "typescript": "7.0.2"
   },
   "peerDependencies": {
-    "@opencode-ai/plugin": "^1.18.3"
+    "@opencode-ai/plugin": "^1.18.29",
+    "@opencode/plugin": "^2.0.6"
   },
   "peerDependenciesMeta": {
     "@opencode-ai/plugin": {
       "optional": true
+    },
+    "@opencode/plugin": {
+      "optional": true
     }
   },
   "pi": {
@@ -84,6 +93,7 @@
     ]
   },
   "overrides": {
+    "@opentelemetry/core": "2.8.0",
     "js-yaml": "^4.3.1",
     "picomatch@^2.3.1": "2.3.2",
     "picomatch@^4.0.1": "^4.0.5",
@@ -106,5 +116,5 @@
     "grok",
     "grok-build"
   ],
-  "gitHead": "879ed64316014198ccbe54b9a9152432f596f969"
+  "gitHead": "49be587b269b435362c68aeb5ba90c3b0334b3d0"
 }

package/dist/chunks/index-31w7hfwv.js

@@ -1,4 +0,0 @@
-import{n,a,K,f,Ne,d,He,b,p,V}from"./index-chc1n91k.js";import{appendFileSync as re,mkdirSync as oe}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as D,readdirSync as j,readFileSync as U,rmdirSync as B,statSync as C,unlinkSync as X,utimesSync as z,writeFileSync as Y}from"node:fs";import{join as m}from"node:path";function ne(t,e={}){return He(d(t,e),t.home).policy.audit.retention_days}var A=86400000,Z=".last-prune",J=/^\d{4}-\d{2}$/,Q=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,L=(t)=>Math.floor(t/A);function q(t,e,o=()=>new Date){try{let r=o().getTime();if(!C(e,{throwIfNoEntry:!1})?.isDirectory())return;let i=m(e,Z),u=C(i,{throwIfNoEntry:!1})?.mtimeMs;if(u!==void 0&&L(u)===L(r))return;let c=r-ne(t)*A,s=new Date(r).toISOString().slice(0,7);for(let l of v(e)){if(l.isDirectory()){W(m(e,l.name),c,s);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))ee(m(e,l.name),c)}Y(i,"",{mode:384}),z(i,r/1000,r/1000)}catch{}}function W(t,e,o){for(let r of v(t)){if(!r.isDirectory()||!J.test(r.name))continue;let i=m(t,r.name);for(let u of v(i)){if(!u.isFile())continue;let c=Q.exec(u.name);if(!c||c[2]!==r.name)continue;let s=Date.parse(`${c[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(s)||s>=e)continue;G(m(i,u.name))}if(r.name!==o)O(i)}O(t)}function ee(t,e){try{let o=D(t);if(o.mtimeMs>=e)return;let r=U(t,"utf-8").split(`
-`).filter((i)=>i.trim()).map(te);if(r.length===0)return;if(r.some((i)=>i===void 0||i>=e))return;if(D(t).mtimeMs!==o.mtimeMs)return;G(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,o=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(o)?o:void 0}catch{return}}function v(t){try{return j(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function G(t){try{X(t)}catch{}}function O(t){try{B(t)}catch{}}var ae="2.4.1",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let o=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(o=o.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!o||o==="."||o==="..")return null;return o}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,o,r,i,u,c={}){let s=le(e);if(!s)return;let l=M(t);if(!l)return;try{let y=(c.now??(()=>new Date))().toISOString(),_=g(K(o),c.failureStage?Number.POSITIVE_INFINITY:ce),N=g(K(r),de),h=c.toolName?g(K(c.toolName),ue):void 0,E=u===null?void 0:g(K(u),se),w=S(l,me(E?.value??null),y.slice(0,7));oe(w,{recursive:!0,mode:448});let H=S(w,`${y.slice(0,10)}-${s}.jsonl`),P={ts:y,id:(c.createId??Ne)(),v:ae,sessionId:s,decision:c.decision??"deny",agent:c.agent,shape:c.shape,level:c.level,configFallback:c.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:i,ruleId:c.ruleId,intent:c.intent,failureStage:c.failureStage,errorCode:c.errorCode,cwd:E?.value??null};re(H,`${JSON.stringify(P)}
-`,{encoding:"utf-8",mode:384}),q(t,l,c.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function Ke(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let o=e||t.home;return o&&ie(o)?o:null}function M(t){let e=Ke(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,o,r=!0,i){if(e.decision.kind==="allow"){if(!o||t.route.kind!=="command")return;let s=T(t);return{decision:"allow",command:s,segment:s,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let u=e.decision.evidence.find((s)=>s.kind==="command"),c=u?.command??(r?T(t):"");return{decision:"deny",command:c,segment:u?.segment??c,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:i?.stage,errorCode:i?.errorCode}}function T(t){return"command"in t?t.command??"":""}function x(t,e,o,r){if(!e)return;let i;try{i=o()}catch{return}if(typeof i!=="string"||!i.trim())return;I(t,i,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:r.agent,shape:r.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function we(t,e,o,r){let i;try{i=o()}catch{return}if(typeof i!=="string"||!i.trim())return;I(t,i,e.command??"",e.segment??e.command??"",e.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function F(t,e,o){try{let r=V(e,{environment:t,...o.guard});return R(t,e,r,o),r}catch(r){if(!(r instanceof p))throw r;throw R(t,e,r.evaluation,o,!(r.cause instanceof f),{stage:r.stage,errorCode:fe(r.cause)}),r}}function R(t,e,o,r,i=!0,u){x(t,k(e,o,r.guard?.auditAllowed??!1,i,u),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function fe(t){if(t instanceof a)return n[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof b)return"structural-shell-syntax-limit";return"unexpected-error"}
-export{ne,q,Ke,M,we,F};