cc-safety-net 2.4.14 → 2.5.0

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.4.14",
+  "version": "2.5.0",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.14",
+  "version": "2.5.0",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,5 +1,5 @@
-import{ye,P,A,be,Xe,c,o,xe,L,q,et,d,p}from"../chunks/index-qbhpx1zs.js";import{ee}from"../chunks/index-pm924a1e.js";import{he,N}from"../chunks/index-jb96wweh.js";var E="cc-safety-net",x="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",b="Help me with CC Safety Net.";function f(e){e.registerCommand(E,{description:x,handler:async(n,l)=>{e.sendUserMessage(I(n),l.isIdle()?void 0:{deliverAs:"followUp"})}})}function I(e){return`${ee.slice(ee.indexOf("# CC Safety Net")).trimEnd()}
+import{J,_,ot,l}from"../chunks/index-8cqwk53d.js";import{ne}from"../chunks/index-1sddy8kp.js";import{L,ue,xe}from"../chunks/index-yya83mcj.js";import"../chunks/index-mrn9mahg.js";var C="cc-safety-net",u="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",p="Help me with CC Safety Net.";function d(o){o.registerCommand(C,{description:u,handler:async(n,t)=>{o.sendUserMessage(c(n),t.isIdle()?void 0:{deliverAs:"followUp"})}})}function c(o){return`${ne.slice(ne.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 
-${e.trim()||b}`}function g(e,n={}){return{malformed:!0,denial:P(n),cwd:e}}function T(e,n){return{malformed:!0,denial:A(e,n),cwd:e.cwd}}function y(e,n={}){return(l,t)=>{try{return D(l,t,e,n)}catch(i){return console.error("CC Safety Net error:",i),e.block(P())}}}function D(e,n,l,t){let i=c();if(l.cancelled?.(n))return l.block(P());let r=l.extract(e,n,i.paths);if(!r)return l.allow;let s=()=>l.getSessionId(e,n);if("malformed"in r)return he(i,r.denial,s,{agent:l.agent,toolName:r.denial.toolName,cwd:r.cwd}),l.block(r.denial);let m=(a,w)=>{let C=ye(a,{includeEvidence:w});return C?l.block(C):l.allow};try{let a=N(i,r,{guard:{auditAllowed:xe(i.env),policyOptions:t.policyOptions,dependencies:t.guardDependencies},audit:{agent:l.agent,getSessionId:s}});return m(a,!0)}catch(a){if(!(a instanceof p))throw a;if(L(o.debug,i.env))console.error(`CC Safety Net debug: ${l.debugLabel} analysis failed: ${Xe(a.cause)}`);return m(a.evaluation,l.includeEvidenceOnError(r))}}var R=new Map([["bash","posix"],["powershell","powershell"]]),O={agent:"pi",debugLabel:"pi tool_call",extract:(e,n,l)=>M(e,n,l),getSessionId:(e,n)=>n.sessionManager.getSessionId(),allow:void 0,block:(e)=>_(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function v(e){e.on("tool_call",S)}var S=k();function k(e={}){return y(O,e)}function M(e,n,l){if(!e||typeof e!=="object")return;let t=e;if(t.type!==void 0&&t.type!=="tool_call")return;if(typeof t.toolName!=="string"||t.toolName.trim()==="")return u(n);if(typeof n.cwd!=="string"||n.cwd.trim()==="")return u(n,t.toolName);let i=et(".",[n.cwd],l);if(!i)return T({directory:"session",problem:"unusable",cwd:n.cwd},{toolName:t.toolName});let r=R.get(t.toolName);if(!t.input||typeof t.input!=="object")return r?u(n,t.toolName):void 0;if(!r)return d(t.toolName,t.input,{kind:q(t.toolName)},{configCwd:i,executionCwd:i},null);let s=t.input.command;if(typeof s!=="string"||s.trim()==="")return u(n,t.toolName);return d(t.toolName,t.input,{kind:"command",shell:r},{configCwd:i,executionCwd:i},s)}function u(e,n){return g(typeof e.cwd==="string"&&e.cwd.trim()?e.cwd:null,{toolName:n})}function _(e){return{block:!0,reason:be(e)}}function H(e){v(e),f(e)}export{H as default};
+${o.trim()||p}`}var f=new Map([["bash","posix"],["powershell","powershell"]]),g={agent:"pi",debugLabel:"pi tool_call",extract:(o,n,t)=>y(o,n,t),getSessionId:(o,n)=>n.sessionManager.getSessionId(),allow:void 0,block:(o)=>w(o),includeEvidenceOnError:(o)=>o.route.kind==="command"};function m(o){o.on("tool_call",T)}var T=P();function P(o={}){return xe(g,o)}function y(o,n,t){if(!o||typeof o!=="object")return;let e=o;if(e.type!==void 0&&e.type!=="tool_call")return;if(typeof e.toolName!=="string"||e.toolName.trim()==="")return r(n);if(typeof n.cwd!=="string"||n.cwd.trim()==="")return r(n,e.toolName);let i=ot(".",[n.cwd],t);if(!i)return ue({directory:"session",problem:"unusable",cwd:n.cwd},{toolName:e.toolName});let a=f.get(e.toolName);if(!e.input||typeof e.input!=="object")return a?r(n,e.toolName):void 0;if(!a)return l(e.toolName,e.input,{kind:_(e.toolName)},{configCwd:i,executionCwd:i},null);let s=e.input.command;if(typeof s!=="string"||s.trim()==="")return r(n,e.toolName);return l(e.toolName,e.input,{kind:"command",shell:a},{configCwd:i,executionCwd:i},s)}function r(o,n){return L(typeof o.cwd==="string"&&o.cwd.trim()?o.cwd:null,{toolName:n})}function w(o){return{block:!0,reason:J(o)}}function v(o){m(o),d(o)}export{v as default};

package/package.json

@@ -1,11 +1,12 @@
 {
   "name": "cc-safety-net",
-  "version": "2.4.14",
+  "version": "2.5.0",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "keywords": [
     "amp",
     "claude-code",
     "cursor",
+    "deepseek-harness",
     "grok",
     "grok-build",
     "opencode",
@@ -118,10 +119,15 @@
     "node": ">=18"
   },
   "packageManager": "bun@1.4.2",
+  "dsh": {
+    "bundle": {
+      "patch": "./dist/deepseek-harness/cordis.patch.yml"
+    }
+  },
   "pi": {
     "extensions": [
       "./dist/pi/index.js"
     ]
   },
-  "gitHead": "f9bfeca0ecf361ac3240e10bbb36dca68fe17a38"
+  "gitHead": "f9b1fa860cbb5c678555b6126a6ef15f1bce01ff"
 }

package/dist/chunks/index-jb96wweh.js

@@ -1,4 +0,0 @@
-import{a,s,V,f,Re,u,Ie,y,p,B}from"./index-qbhpx1zs.js";import{appendFileSync as re,mkdirSync as oe}from"node:fs";import{isAbsolute as ie,join as I}from"node:path";import{lstatSync as L,readdirSync as j,readFileSync as U,rmdirSync as K,statSync as O,unlinkSync as X,utimesSync as Y,writeFileSync as Z}from"node:fs";import{join as m}from"node:path";function te(t,e={}){return Ie(u(t,e),t.home).policy.audit.retention_days}var S=86400000,J=".last-prune",Q=/^\d{4}-\d{2}$/,W=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,G=(t)=>Math.floor(t/S);function z(t,e,r=()=>new Date){try{let n=r().getTime();if(!O(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=m(e,J),c=O(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&G(c)===G(n))return;let i=n-te(t)*S,d=new Date(n).toISOString().slice(0,7);for(let l of A(e)){if(l.isDirectory()){q(m(e,l.name),i,d);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))ee(m(e,l.name),i)}Z(o,"",{mode:384}),Y(o,n/1000,n/1000)}catch{}}function q(t,e,r){for(let n of A(t)){if(!n.isDirectory()||!Q.test(n.name))continue;let o=m(t,n.name);for(let c of A(o)){if(!c.isFile())continue;let i=W.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+S;if(!Number.isFinite(d)||d>=e)continue;b(m(o,c.name))}if(n.name!==r)T(o)}T(t)}function ee(t,e){try{let r=L(t);if(r.mtimeMs>=e)return;let n=U(t,"utf-8").split(`
-`).filter((o)=>o.trim()).map(ne);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(L(t).mtimeMs!==r.mtimeMs)return;b(t)}catch{}}function ne(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function A(t){try{return j(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function b(t){try{X(t)}catch{}}function T(t){try{K(t)}catch{}}var ae="2.4.14",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function _(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let l=D(t);if(!l)return;try{let E=(i.now??(()=>new Date))().toISOString(),h=g(V(r),i.failureStage?Number.POSITIVE_INFINITY:ce),w=g(V(n),de),F=i.toolName?g(V(i.toolName),ue):void 0,v=c===null?void 0:g(V(c),se),C=I(l,me(v?.value??null),E.slice(0,7));oe(C,{recursive:!0,mode:448});let H=I(C,`${E.slice(0,10)}-${d}.jsonl`),P={ts:E,id:(i.createId??Re)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:F?.value,command:h.value,segment:w.value,...h.truncated||w.truncated||F?.truncated||v?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:v?.value??null};re(H,`${JSON.stringify(P)}
-`,{encoding:"utf-8",mode:384}),z(t,l,i.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function je(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function D(t){let e=je(t);return e?I(e,".cc-safety-net","logs"):null}function x(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=k(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?k(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function k(t){return"command"in t?t.command??"":""}function M(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;_(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function he(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;_(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function N(t,e,r){try{let n=B(e,{environment:t,...r.guard});return R(t,e,n,r),n}catch(n){if(!(n instanceof p))throw n;throw R(t,e,n.evaluation,r,!(n.cause instanceof f),{stage:n.stage,errorCode:fe(n.cause)}),n}}function R(t,e,r,n,o=!0,c){M(t,x(e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function fe(t){if(t instanceof s)return a[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof y)return"structural-shell-syntax-limit";return"unexpected-error"}
-export{te,z,je,D,he,N};