cc-safety-net 2.4.9 → 2.4.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/amp/cc-safety-net/index.ts +2 -2
- package/dist/bin/hook.js +1 -1
- package/dist/chunks/{index-g2gqgqzy.js → index-8z99qpz1.js} +1 -1
- package/dist/cli.js +25 -25
- package/dist/index.js +1 -1
- package/dist/openclaw/cc-safety-net/index.js +2 -2
- package/dist/openclaw/cc-safety-net/openclaw.plugin.json +1 -1
- package/dist/openclaw/cc-safety-net/package.json +1 -1
- package/dist/pi/index.js +1 -1
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{ye,P,be,c,xe,f,V,ne,ce,d,p}from"./chunks/index-fvtsm6ez.js";import{Q}from"./chunks/index-rr4ytenf.js";import{he,D}from"./chunks/index-g2gqgqzy.js";import{resolve as Os}from"node:path";function Ir(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:Q.slice(Q.indexOf("# CC Safety Net"))}}}var $c=new Set(["powershell","pwsh"]),Bc=new Set(["bash","dash","ksh","sh","zsh"]);function ks(e={}){return async({directory:t,homeDir:r})=>{let n=Os(t),o;return{config:async(s)=>{o=s;let a=Ir(),u=s.command??{};s.command={...a,...u}},"tool.execute.before":async(s,a)=>{Rn({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:jc(s.tool,_n(o?.shell)),guardDependencies:e})}}}}function Rn({configCwd:e,homeDir:t,tool:r,sessionID:n,toolInput:o,route:s,guardDependencies:a={}}){let u=t===void 0?c():{...c(),home:t},l=(h,g,I=e)=>{he(u,h,()=>n,{agent:"opencode",toolName:g,cwd:I}),Rs(h)};if(typeof r!=="string"||r.trim()==="")l(P());let i;try{i=ne(o)}catch(h){if(!(h instanceof f))throw h;l(P({toolName:r}),r)}let x=qc(e,o);if(!ce(e)||!x){l(P({command:i,toolName:r}),r);return}let S=d(r,o,s,{configCwd:e,executionCwd:x},i??null);try{let h=D(u,S,{guard:{auditAllowed:xe(u.env),dependencies:a},audit:{agent:"opencode",getSessionId:()=>n}});Cs(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Cs(h.evaluation);return}}function _n(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if($c.has(o))return"powershell";if(Bc.has(o))return"posix";return"auto"}function jc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:V(e)}}function qc(e,t){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return null;let n=process.platform==="win32"?Jc(r):r,o=Os(e,n);return ce(o)?o:null}function Jc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Cs(e){let t=ye(e,{includeEvidence:!0});if(t)Rs(t)}function Rs(e){throw Error(be(e))}var fe=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Gc={pipe(){return fe(this,arguments)}},Bt=function(){function e(){}return e.prototype=Gc,e}();var C=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ie=(e)=>e;var _s=(e)=>()=>e;var St=_s(void 0),As=St;function rt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function yt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var jt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},qt=new WeakSet;function Jt(e){return typeof e==="string"}function An(e){return typeof e==="number"}function Fs(e){return typeof e==="symbol"}function Cr(e){return Jt(e)||An(e)||Fs(e)}function Tt(e){return typeof e==="function"}function Fn(e){return e!==void 0}function Pn(e){return e!=null}function Ps(e){return!0}function Dn(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Or(e){return typeof e==="object"&&e!==null||Tt(e)}var _=C(2,(e,t)=>Or(e)&&(t in e));function Ds(e){return e instanceof Error}var Y="~effect/interfaces/Hash",F=(e)=>{switch(typeof e){case"number":return Ar(e);case"bigint":return G(e.toString(10));case"boolean":return G(String(e));case"symbol":return G(String(e));case"string":return G(e);case"undefined":return G("undefined");case"function":case"object":if(e===null)return G("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return G("Invalid Date");return G(e.toISOString())}else if(e instanceof RegExp)return G(e.toString());else{if(qt.has(e))return kr(e);if(Nn.has(e))return Nn.get(e);let t=Wc(e,()=>{if(Kc(e))return e[Y]();else if(typeof e==="function")return kr(e);else if(e instanceof DataView)return Rr(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return Rr(e);else if(e instanceof Map)return Vc(e);else if(e instanceof Set)return Hc(e);return zc(e)});return Nn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},kr=(e)=>{if(!Un.has(e))Un.set(e,Ar(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Un.get(e)},ue=C(2,(e,t)=>e*53^t),_r=(e)=>e&3221225471|e>>>1&1073741824,Kc=(e)=>_(e,Y),Ar=(e)=>{if(e!==e)return G("NaN");if(e===1/0)return G("Infinity");if(e===-1/0)return G("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return _r(t)},G=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return _r(t)},Ln=(e,t)=>{let r=12289;for(let n of t)r^=ue(F(n),F(e[n]));return _r(r)},zc=(e)=>Ln(e,jt(e)),$n=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return _r(n)},Rr=$n(6151,F),Vc=$n(G("Map"),([e,t])=>ue(F(e),F(t))),Hc=$n(G("Set"),F),Un=new WeakMap,Nn=new WeakMap,Mn=new WeakSet;function Wc(e,t){if(Mn.has(e))return G("[Circular]");Mn.add(e);let r=t();return Mn.delete(e),r}var X="~effect/interfaces/Equal";function H(){if(arguments.length===1)return(e)=>ot(e,arguments[0]);return ot(arguments[0],arguments[1])}function ot(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(qt.has(e)||qt.has(t))return!1;return Xc(e,t,Yc)}function Zc(e,t,r){let n=Bn.has(e),o=jn.has(t);if(n&&o)return!0;if(n||o)return!1;Bn.add(e),jn.add(t);let s=r();return Bn.delete(e),jn.delete(t),s}var Bn=new WeakSet,jn=new WeakSet;function Yc(e,t){if(F(e)!==F(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=Ns(e),n=Ns(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Zc(e,t,()=>{if(o)return e[X](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return Qc(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Us(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Us(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return ru(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return ou(e,t)}return eu(e,t)})}function Xc(e,t,r){let n=Fr.get(e);if(!n)n=new WeakMap,Fr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Fr.get(t);if(!s)s=new WeakMap,Fr.set(t,s);return s.set(e,o),o}var Fr=new WeakMap;function Qc(e,t){for(let r=0;r<e.length;r++)if(!ot(e[r],t[r]))return!1;return!0}function Us(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function eu(e,t){let r=jt(e),n=jt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!ot(e[o],t[o]))return!1;return!0}function tu(e,t){return function(n,o){let s=Array.from(o);for(let[a,u]of n){let l=!1;for(let i=0;i<s.length;i++){let[x,T]=s[i];if(e(a,x)&&t(u,T)){s[i]=s[s.length-1],s.pop(),l=!0;break}}if(!l)return!1}return!0}}var ru=tu(ot,ot);function nu(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let u=0;u<o.length;u++){let l=o[u];if(e(s,l)){o[u]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var ou=nu(ot),Ns=(e)=>_(e,X);var Gt=Symbol.for("~effect/Redactable"),su=(e)=>_(e,Gt);function wt(e){if(su(e))return qn(e);return e}function qn(e){return e[Gt](globalThis[It]?.context??au)}var It="~effect/Fiber/currentFiber",Ms=new Map,au={"~effect/Context":{},base:Ms,depth:0,mapUnsafe:Ms,pipe(){return fe(this,arguments)}};function N(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let T=i?.constructor;return T&&T!==Object.prototype.constructor&&T.name?`${T.name}(${x})`:x},u=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function l(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return iu;n.add(i);let T;if(Gt in i)T=l(qn(i),x);else if(Array.isArray(i))T=!o||i.length<=1?`[${i.map((S)=>l(S,x)).join(",")}]`:`[
|
|
1
|
+
import{ye,P,be,c,xe,f,V,ne,ce,d,p}from"./chunks/index-fvtsm6ez.js";import{Q}from"./chunks/index-rr4ytenf.js";import{he,D}from"./chunks/index-8z99qpz1.js";import{resolve as Os}from"node:path";function Ir(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:Q.slice(Q.indexOf("# CC Safety Net"))}}}var $c=new Set(["powershell","pwsh"]),Bc=new Set(["bash","dash","ksh","sh","zsh"]);function ks(e={}){return async({directory:t,homeDir:r})=>{let n=Os(t),o;return{config:async(s)=>{o=s;let a=Ir(),u=s.command??{};s.command={...a,...u}},"tool.execute.before":async(s,a)=>{Rn({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:jc(s.tool,_n(o?.shell)),guardDependencies:e})}}}}function Rn({configCwd:e,homeDir:t,tool:r,sessionID:n,toolInput:o,route:s,guardDependencies:a={}}){let u=t===void 0?c():{...c(),home:t},l=(h,g,I=e)=>{he(u,h,()=>n,{agent:"opencode",toolName:g,cwd:I}),Rs(h)};if(typeof r!=="string"||r.trim()==="")l(P());let i;try{i=ne(o)}catch(h){if(!(h instanceof f))throw h;l(P({toolName:r}),r)}let x=qc(e,o);if(!ce(e)||!x){l(P({command:i,toolName:r}),r);return}let S=d(r,o,s,{configCwd:e,executionCwd:x},i??null);try{let h=D(u,S,{guard:{auditAllowed:xe(u.env),dependencies:a},audit:{agent:"opencode",getSessionId:()=>n}});Cs(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Cs(h.evaluation);return}}function _n(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if($c.has(o))return"powershell";if(Bc.has(o))return"posix";return"auto"}function jc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:V(e)}}function qc(e,t){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return null;let n=process.platform==="win32"?Jc(r):r,o=Os(e,n);return ce(o)?o:null}function Jc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Cs(e){let t=ye(e,{includeEvidence:!0});if(t)Rs(t)}function Rs(e){throw Error(be(e))}var fe=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Gc={pipe(){return fe(this,arguments)}},Bt=function(){function e(){}return e.prototype=Gc,e}();var C=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ie=(e)=>e;var _s=(e)=>()=>e;var St=_s(void 0),As=St;function rt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function yt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var jt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},qt=new WeakSet;function Jt(e){return typeof e==="string"}function An(e){return typeof e==="number"}function Fs(e){return typeof e==="symbol"}function Cr(e){return Jt(e)||An(e)||Fs(e)}function Tt(e){return typeof e==="function"}function Fn(e){return e!==void 0}function Pn(e){return e!=null}function Ps(e){return!0}function Dn(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Or(e){return typeof e==="object"&&e!==null||Tt(e)}var _=C(2,(e,t)=>Or(e)&&(t in e));function Ds(e){return e instanceof Error}var Y="~effect/interfaces/Hash",F=(e)=>{switch(typeof e){case"number":return Ar(e);case"bigint":return G(e.toString(10));case"boolean":return G(String(e));case"symbol":return G(String(e));case"string":return G(e);case"undefined":return G("undefined");case"function":case"object":if(e===null)return G("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return G("Invalid Date");return G(e.toISOString())}else if(e instanceof RegExp)return G(e.toString());else{if(qt.has(e))return kr(e);if(Nn.has(e))return Nn.get(e);let t=Wc(e,()=>{if(Kc(e))return e[Y]();else if(typeof e==="function")return kr(e);else if(e instanceof DataView)return Rr(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return Rr(e);else if(e instanceof Map)return Vc(e);else if(e instanceof Set)return Hc(e);return zc(e)});return Nn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},kr=(e)=>{if(!Un.has(e))Un.set(e,Ar(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Un.get(e)},ue=C(2,(e,t)=>e*53^t),_r=(e)=>e&3221225471|e>>>1&1073741824,Kc=(e)=>_(e,Y),Ar=(e)=>{if(e!==e)return G("NaN");if(e===1/0)return G("Infinity");if(e===-1/0)return G("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return _r(t)},G=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return _r(t)},Ln=(e,t)=>{let r=12289;for(let n of t)r^=ue(F(n),F(e[n]));return _r(r)},zc=(e)=>Ln(e,jt(e)),$n=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return _r(n)},Rr=$n(6151,F),Vc=$n(G("Map"),([e,t])=>ue(F(e),F(t))),Hc=$n(G("Set"),F),Un=new WeakMap,Nn=new WeakMap,Mn=new WeakSet;function Wc(e,t){if(Mn.has(e))return G("[Circular]");Mn.add(e);let r=t();return Mn.delete(e),r}var X="~effect/interfaces/Equal";function H(){if(arguments.length===1)return(e)=>ot(e,arguments[0]);return ot(arguments[0],arguments[1])}function ot(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(qt.has(e)||qt.has(t))return!1;return Xc(e,t,Yc)}function Zc(e,t,r){let n=Bn.has(e),o=jn.has(t);if(n&&o)return!0;if(n||o)return!1;Bn.add(e),jn.add(t);let s=r();return Bn.delete(e),jn.delete(t),s}var Bn=new WeakSet,jn=new WeakSet;function Yc(e,t){if(F(e)!==F(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=Ns(e),n=Ns(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Zc(e,t,()=>{if(o)return e[X](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return Qc(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Us(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Us(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return ru(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return ou(e,t)}return eu(e,t)})}function Xc(e,t,r){let n=Fr.get(e);if(!n)n=new WeakMap,Fr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Fr.get(t);if(!s)s=new WeakMap,Fr.set(t,s);return s.set(e,o),o}var Fr=new WeakMap;function Qc(e,t){for(let r=0;r<e.length;r++)if(!ot(e[r],t[r]))return!1;return!0}function Us(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function eu(e,t){let r=jt(e),n=jt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!ot(e[o],t[o]))return!1;return!0}function tu(e,t){return function(n,o){let s=Array.from(o);for(let[a,u]of n){let l=!1;for(let i=0;i<s.length;i++){let[x,T]=s[i];if(e(a,x)&&t(u,T)){s[i]=s[s.length-1],s.pop(),l=!0;break}}if(!l)return!1}return!0}}var ru=tu(ot,ot);function nu(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let u=0;u<o.length;u++){let l=o[u];if(e(s,l)){o[u]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var ou=nu(ot),Ns=(e)=>_(e,X);var Gt=Symbol.for("~effect/Redactable"),su=(e)=>_(e,Gt);function wt(e){if(su(e))return qn(e);return e}function qn(e){return e[Gt](globalThis[It]?.context??au)}var It="~effect/Fiber/currentFiber",Ms=new Map,au={"~effect/Context":{},base:Ms,depth:0,mapUnsafe:Ms,pipe(){return fe(this,arguments)}};function N(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let T=i?.constructor;return T&&T!==Object.prototype.constructor&&T.name?`${T.name}(${x})`:x},u=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function l(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return iu;n.add(i);let T;if(Gt in i)T=l(qn(i),x);else if(Array.isArray(i))T=!o||i.length<=1?`[${i.map((S)=>l(S,x)).join(",")}]`:`[
|
|
2
2
|
${s(x+1)}${i.map((S)=>l(S,x+1)).join(`,
|
|
3
3
|
`+s(x+1))}
|
|
4
4
|
${s(x)}]`;else if(i instanceof Date)T=Ls(i);else if(!t?.ignoreToString&&_(i,"toString")&&typeof i.toString==="function"&&i.toString!==Object.prototype.toString&&i.toString!==Array.prototype.toString){let S=cu(i);T=i instanceof Error&&i.cause?`${S} (cause: ${l(i.cause,x)})`:S}else if(Symbol.iterator in i)T=`${i.constructor.name}(${l(Array.from(i),x)})`;else{let S=u(i);if(!o||S.length<=1){let h=`{${S.map((g)=>`${Kt(g)}:${l(i[g],x)}`).join(",")}}`;T=a(i,h)}else{let h=`{
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
|
|
2
|
-
// version: 2.4.
|
|
2
|
+
// version: 2.4.10
|
|
3
3
|
var gl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var bi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",He="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",_n="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var Ci={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Rn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},V=Object.freeze({realpathAttempts:{cap:16384,...Ci},processedCandidateBytes:{cap:4194304,...Ci},pathEnvironmentExpansion:{cap:64,...Ci},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Rn},trackedHeredocFiles:{cap:64,...Rn},controlFlowStates:{cap:64,...Rn},wrapperPeelIterations:{cap:20,...Rn},derivedCommandShape:Rn});class N extends Error{kind;name="AnalysisLimit";constructor(e){super(V[e].reason);this.kind=e}}function Ce(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>V[t].cap)throw new N(t)}}}var wp=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function at(e){return Ap(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function Ap(e){return wp.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Pp={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Tp(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Pp[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
|
|
4
4
|
|
|
5
5
|
`)}function hl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.ask?{ask:!0}:{}}}function wn(e={}){return{reason:_n,intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}function yl(e){return Tp({...e,redact:at})}function Cl(e){return at(e instanceof Error?e.message:String(e))}import{isAbsolute as zl,relative as rg,resolve as og,sep as ig}from"node:path";import{basename as vl,dirname as Ip,isAbsolute as kp,join as Op,normalize as Mp,resolve as bl}from"node:path";var Np=256,wr=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function be(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function lt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function xi(e,t){return Si(e,0,t)}function Si(e,t,n){let r="",o=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let s=vi(e,o+2),a=Dp(e,o,t);if(a===null){if(wr.has(s))throw new N("pathEnvironmentExpansion");r+=e.slice(o);break}let l=e.slice(o,a+1);r+=Lp(l,t,n),o=a+1;continue}let i=vi(e,o+1);if(!i){r+="$",o++;continue}r+=Ei(i,n)??`$${i}`,o+=i.length+1}return r}function Dp(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>V.pathEnvironmentExpansion.cap)throw new N("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function Lp(e,t,n){let r=e.slice(2,-1),o=vi(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Ei(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(wr.has(o))throw new N("pathEnvironmentExpansion");return e}if(!wr.has(o))return e;if(s.endsWith("="))throw new N("pathEnvironmentExpansion");let a=Ei(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new N("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Si(i.slice(s.length),t+1,n);return l?Si(i.slice(s.length),t+1,n):""}function vi(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Ei(e,t){if(!wr.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function z(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){El(n,i);let s=t.realpath(i);if(s!==null)return Sl(n,e,s,o);let a=Ip(i);if(a===i||o.length>=Np)return Sl(n,e,i,o);o.push(vl(i)),i=a}}function Sl(e,t,n,r){let o=r.length===0?n:Op(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Wp(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;El(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function El(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function se(e,t,n,r){let o=Rl(e,t,n);if(!o)return"";return z(o,n.paths,r).replace(/\\/g,"/")}function xl(e,t,n,r,o){let i=Rl(e,t,n);if(!i)return null;if(o(vl(i)))return z(i,n.paths,r).replace(/\\/g,"/");let s=Wp(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function Rl(e,t,n){let r=n.home,o=xi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?bl(r,o.slice(2)):o,s=be(i);return Mp(kp(s)?s:bl(t,s))}import{types as Gp}from"node:util";var Fp=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),zp=new Set(["command","diff","input","patch","patchtext"]),_l=new TextEncoder,Bp=new TextDecoder,$p=/\s/,Up=64;class Ye extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var An=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Hp(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function Pr(e){return Fp.has(Hp(e))}function Tn(e){if(!e||typeof e!=="object")return;Ll(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)je();return}if(t.get||t.set)je();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Il(e,t){return kl(e,t,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function kl(e,t,n,r){let o=Dl(e,n,r);if(!o)return[];let i=o.entries.flatMap(([s,a])=>{let l=kl(a,t,n,r+1);return typeof a==="string"&&t.has(Ol(s))?[a]:l});return n.ancestors.delete(o.object),i}function Ol(e){return e.replace(/-/g,"_").toLowerCase()}function Ml(e){return Nl(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap(Vp)}function Nl(e,t,n,r){let o=Dl(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>Nl(a,o.array?t:zp.has(Ol(s)),n,r+1));return n.ancestors.delete(o.object),i}function jp(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>An.maxDepth||t.nodes>An.maxNodes)je();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>An.maxStringBytes||t.stringBytes>An.maxAggregateStringBytes)je()}function Dl(e,t,n){if(jp(e,t,n),!e||typeof e!=="object")return null;let r=Ll(e);if(t.ancestors.has(e))je();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>An.maxKeys)je();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)je();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function Ll(e){if(Gp.isProxy(e))je();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)je();return t}function je(){throw new Ye}function Vp(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Kp(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Ri(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Ri(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...wi(Ar(c.slice(4),!0),Ar(u.slice(4),!0))),l++;continue}if(!r)t.push(...Ri(c))}return t}function Kp(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Ri(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Tl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Tl(n[1]);if(e.startsWith("diff --git "))return qp(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Pl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Pl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return tg(i[1]);return[]}function qp(e){let t=Yp(e);if(t.length===2&&t[0]&&t[1])return wi(t[0],t[1]);let n=Zp(e);return n?wi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Yp(e){let t=[],n=0;while(n<e.length&&t.length<2){while(xt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!xt(e[n]))n++;t.push(e.slice(i,n));continue}let o=Wl(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(xt(e[n]))n++;return n===e.length?t:[]}function Zp(e){let t=0;while(t<e.length&&xt(e[t]))t++;let n=e.length;while(n>t&&xt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!xt(e[o])){o++;continue}let i=o;while(o<n&&xt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Up)je();if(Xp(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Xp(e,t,n,r,o){if(_i(e,t,n,r,o))return!0;let i=wl(e,"/",t,n),s=wl(e,"/",r,o);if(i<=t||s<=r)return!1;if(_i(e,t,i,r,s))return!1;return _i(e,i+1,n,s+1,o)}function _i(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function wl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function xt(e){return e!==void 0&&$p.test(e)}function Wl(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Bp.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(..._l.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(..._l.encode(Jp(s[0]??""))),o+=2}return null}function Jp(e){return{a:"\x07",b:"\b",f:"\f",n:`
|
|
@@ -44,5 +44,5 @@ var gl={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive c
|
|
|
44
44
|
`).replace(/\\t/g,"\t").replace(/\\r/g,"\r")}function Y_(e,t,n,r,o,i){let s=st(e);if(s.length===0||Ue(s[0]??"").toLowerCase()!=="xargs")return!1;let a=Ut(s),l=s.slice(a.childStart);if(l.length===0)return!1;if(a.replacementToken==="")return!1;let c=a.replacementToken,u=c===null?[...l,Ya]:l.map((f)=>f.split(c).join(Ya));return mi(u,t,n,r,o,i).some((f)=>f.target.includes(Ya))}function Z_(e){let t=st(e);if(t.length===0)return null;let n=Ue(t[0]??"").toLowerCase();if(!nr(n))return null;return X_(n,t.slice(1))?n:null}function X_(e,t){let n=rl(e);for(let r=0;r<t.length;r++){let o=t[r];if(o===void 0)break;if(ep.has(o)||op(e,o)||/^--(?:eval|exec)=/.test(o))return!1;if(o==="-")return!0;if(o.startsWith("-")){if(n==="python"&&o==="-m")return!1;if(z_.get(n)?.has(o))r++;continue}return!1}return!0}function rl(e){return/^python\d/.test(e)?"python":e}function J_(e){let t=[];for(let n of e){if(sp(n))continue;let r=/^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(n);if(r===null)break;if(r[1]!==void 0&&r[1]!=="")t.push(r[1])}return t}var Vm=/^(?:\$\{home\}|\$\{env:(?:userprofile|home)\}|~)(?=[\\/])/i;function Q_(e,t){if(!t||!Vm.test(e))return e;return`~${e.replace(Vm,"").replace(/\\/g,"/")}`}function Ke(e,t){if(t==="--")return[];let n=[],r=t.indexOf("=");if(r>0&&r<t.length-1)n.push(t.slice(r+1));if(t.startsWith("-"))return n;if(e==="tar"&&/\.(?:tar|tgz|tar\.gz|zip)$/i.test(t))return n;if(e==="zip"&&/\.zip$/i.test(t))return n;return n.push(t),n}function ew(e){let t=-1,n=!1;for(let r=0;r<e.length;r++){let o=e[r]??"";if(!n&&o==="--"){n=!0;continue}if(n||!/^-(?:[A-Za-z]|-)/.test(o)){if(t===-1)t=r;continue}if(/^--(?:arg|argjson|argfile|rawfile|slurpfile)$/.test(o)){r+=2;continue}if(o==="--indent"||o==="-L"){r++;continue}if(o.startsWith("-L"))continue;if(/^-[srjcCMaSRnbehV]+$/.test(o)||/^--(?:slurp|raw-output0?|join-output|compact-output|color-output|monochrome-output|ascii-output|unbuffered|sort-keys|raw-input|null-input|binary|tab|seq|stream|stream-errors|exit-status|args|jsonargs|help|version|build-configuration)$/.test(o))continue;return e.flatMap((i)=>Ke("jq",i))}return e.flatMap((r,o)=>o===t?[]:Ke("jq",r))}function tw(e){let t=[];for(let n=0;n<e.length;n++){let r=e[n]??"";if(r==="--"||!r.startsWith("-"))return[...t,...A_.has(r)?Ja("git",e.slice(n).map((i)=>/^-[aeinopqsv]+m$/.test(i)?"-m":i),P_):Ja("git",e.slice(n),T_)];if(t.push(...Ke("git",r)),!Se.has(r))continue;let o=e[n+1];if(o===void 0)break;t.push(...r==="-c"&&o.includes("=")?[o.slice(o.indexOf("=")+1)]:Ke("git",o)),n++}return t}function Ja(e,t,n){let r=[];for(let o=0;o<t.length;o++){let i=t[o]??"";if(i==="--")return[...r,...t.slice(o).flatMap((s)=>Ke(e,s))];if(n.has(i)){o++;continue}if(i.includes("=")&&n.has(i.slice(0,i.indexOf("="))))continue;r.push(...Ke(e,i))}return r}function nw(e){return e.flatMap((t,n)=>{let r=ow(t);if(r!==null)return Km(r.flag,r.value);let o=rw(e[n-1]);return o===null?[]:Km(o,t)})}function Km(e,t){if(e==="-F"||e==="--form"){let n=t.indexOf("="),r=n===-1?t:t.slice(n+1);if(!r.startsWith("@")&&!r.startsWith("<"))return[];return Za(r.slice(1).split(";")[0]??"")}if(e==="--data-urlencode"){let n=t.indexOf("@"),r=t.indexOf("=");if(n===-1||r!==-1&&r<n)return[];return Za(t.slice(n+1))}return t.startsWith("@")?Za(t.slice(1)):[]}function rw(e){if(e===void 0)return null;if(Qm.has(e))return e;return/^-[A-Za-z]+[dF]$/.test(e)?`-${e.slice(-1)}`:null}function ow(e){let t=e.slice(0,2);if(e.length>2&&(t==="-d"||t==="-F"))return{flag:t,value:e.slice(2)};let n=e.indexOf("=");if(n===-1)return null;let r=e.slice(0,n);return Qm.has(r)?{flag:r,value:e.slice(n+1)}:null}function Za(e){return e===""||e==="-"?[]:[e]}function iw(e,t,n,r,o,i){let s=e.findIndex((l)=>l.startsWith("-")||l==="("||l==="!"||l===";"),a=[...e.slice(0,s===-1?e.length:s),...e.flatMap((l,c)=>l==="-files0-from"&&e[c+1]!==void 0?[e[c+1]??""]:[])];for(let l=0;l<e.length;l++){if(!C_.has(e[l]??""))continue;let c=e.slice(l+1),u=c.findIndex((m)=>b_.has(m)),f=u===-1?c:c.slice(0,u),d=mi(f,t,n,r,o,i).map((m)=>m.target);if(a.push(...d.filter((m)=>m!=="{}")),!d.includes("{}"))continue;a.push(...e.slice(0,l).flatMap((m,p,g)=>{if(!v_.has(m))return[];let h=g[p+1];return h===void 0?[]:[h,h.replace(/^\*+\//,"").replace(/\/\*+$/g,"").replace(/^\*+/,"").replace(/\*+$/g,"")]}))}return a}function sw(e,t,n,r,o,i,s){let a=[];for(let l=0;l<t.length;l++){let c=t[l];if(c===void 0)break;if(ep.has(c)||op(e,c)){let f=t[l+1];if(f!==void 0)a.push(...di(e,f,n,r,o,i,s)),l++;continue}let u=/^--(?:eval|exec)=(.*)$/.exec(c);if(u!==null&&u[1]!==void 0){a.push(...di(e,u[1],n,r,o,i,s));continue}if(!c.startsWith("-"))a.push({target:c,cwd:i})}return a}function op(e,t){if(!t.startsWith("-")||t.startsWith("--")||t.length<=2)return!1;return R_.get(t[t.length-1]??"")?.has(rl(e))??!1}function aw(e,t,n,r,o,i){if(!e.includes("system"))return[];return da(e)?.commands.flatMap((s)=>xn(t.getShellSyntax(s),t,n,r,o,i))??[]}function lw(e){return Array.from(e.matchAll(/\bgetline(?:\s+[A-Za-z_][A-Za-z0-9_]*)?\s*<\s*"((?:\\.|[^"\\])*)"/g)).map((t)=>t[1]).filter((t)=>t!==void 0&&t!=="")}function cw(e){let t=Array.from(e.matchAll(/(['"`])((?:\\.|(?!\1).)*)\1/g)).map((n)=>n[2]).filter((n)=>n!==void 0&&n!=="");return[...t,...t.flatMap(ol),...e.match(Xa)??[]]}function di(e,t,n,r,o,i,s){let a=(g)=>({target:g,cwd:i}),l=dw(t,uw(e));if(l===null)return cw(t).map(a);let c=l.masked.match($m)!==null||l.literals.some((g)=>Um.test(l.masked.slice(0,g.start))),u=l.masked.match(G_)!==null||l.literals.some((g)=>F_.test(l.masked.slice(0,g.start))),f=r.standard===!0&&!er.has(e),d=f&&!(gw(l.masked)||c||u)?[]:l.literals,m=f?Array.from(l.masked.matchAll($m),(g)=>{let h=g.index+g[0].length;return{start:h,end:js(l.masked,h)}}):[],p=!f||m.some((g)=>Vs(l.masked,g.start))?l.literals:l.literals.filter((g)=>Um.test(l.masked.slice(0,g.start))||m.some((h)=>g.start>=h.start&&g.start<h.end));return[...d.map((g)=>g.text).filter((g)=>g!=="").map(a),...d.flatMap((g)=>ol(g.text)).map(a),...f?[]:l.literals.flatMap((g)=>g.text.match(Xa)??[]).map(a),...c?p.flatMap((g)=>tl(g.text,n,r,o,i,s)??[a(g.text)]):[],...u?l.literals.flatMap((g)=>di(e,g.text.replace(/\\(.)/g,(h,y)=>y==="n"?`
|
|
45
45
|
`:y),n,r,o,i,s)):[],...(l.masked.match(Xa)??[]).map(a)]}function uw(e){let t=rl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}function dw(e,t){if(t==="opaque")return null;let n=e.split(""),r=[];for(let o=0;o<e.length;o++){let i=e[o]??"";if(t==="simple"&&(i==="`"||i==="%"||i==="<")){if(L_.test(e.slice(o)))return null}let s=i==="'"||i==='"'||t==="javascript"&&i==="`"?i:null;if(s===null)continue;if(s==="`"&&pw(e,o))return null;let a=t==="python"?fw(e,o):"",l=t==="python"&&e.startsWith(s.repeat(3),o)?s.repeat(3):s,c=o+l.length,u=mw(e,c,l);if(u===null)return null;let f=e.slice(c,u);if(/[fF]/.test(a)&&f.includes("{"))return null;if(t==="simple"&&s==='"'&&W_.test(f))return null;r.push({start:c,text:f});for(let d=o;d<u+l.length;d++)n[d]=" ";o=u+l.length-1}return{masked:n.join(""),literals:r}}function fw(e,t){return D_.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function mw(e,t,n){let r=n==="`",o=r||n.length===3;for(let i=t;i<e.length;i++){let s=e[i];if(s==="\\"){i++;continue}if(r&&s==="$"&&e[i+1]==="{")return null;if(!o&&(s===`
|
|
46
46
|
`||s==="\r"))return null;if(e.startsWith(n,i))return i}return null}function pw(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function gw(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(E_.has(n.toLowerCase()))return!0;let o=n.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((i)=>i.toLowerCase());if(!o.some((i)=>x_.has(i)))continue;if(o.length>1)return!0;if(hw(e,r)===".")return!0;if(yw(e,r+n.length)==="(")return!0}return!1}function hw(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return e[n];return}function yw(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return e[n];return}function Cw(e,t,n,r,o,i){return xw(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...xn(a,t,{...n,capturedOutput:!0},r,o,i),...bw(a,r)?Sw(a,r).map((l)=>({target:l,cwd:o})):[]]})}function bw(e,t){let n=_o(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||Ue(Qe(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Qe(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function Sw(e,t){return _o(e).flatMap((n)=>n.kind==="word"?[Qe(n.text,t)]:n.kind==="redirection"&&n.target?[Qe(n.target,t)]:[]).flatMap(ol)}function ol(e){let t=Ew(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||vw(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function vw(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function Ew(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function xw(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Wn(o,n))continue;if(ip(e,r,n)){let i=Rw(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=_w(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function Rw(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Wn(i,n))continue;if(ip(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function _w(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function ip(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function ww(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===I_)o=!0;if(O_.has(f))r=!0;if(d!==void 0){if(f===Bm)t.push(d);continue}if(N_.has(f)){let m=e[l+1];if(f===Bm&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(k_.has(h))r=!0;if(M_.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===zm)t.push(m);continue}let p=e[l+1];if(d===zm&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function st(e){let t=e.findIndex((n)=>!sp(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function sp(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var Aw=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),Pw=".env.",Tw=new Set([".env.example",".env.sample",".env.template",".env.defaults"]),Iw=[".env.example.",".env.sample."];function kw(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function Ow(e){return e.length>0&&!/\s/.test(e)}function Qa(e,t,n,r){let o=ap(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function ap(e,t,n,r){try{return Er(e,t,n,r)}catch(o){if(o instanceof N)throw o;return""}}var Mw=new Set(["node_modules","__pycache__"]),Nw=[["vendor","bundle"],["vendor","cache"]];function Dw(e,t,n,r,o){if(kw(e))return null;let i=Ve(e,t,r,o);if(!i)return null;let s=F(i.split("/").pop()??""),a=F(i),l=()=>Ow(s)||Qa(e,t,r,o);if(Tw.has(s)||Iw.some((d)=>s.startsWith(d)))return null;let c=F(Bw(e,t,r,o));for(let d of ss){let m=`~/${d.suffixParts.join("/")}`;if((Ym(a,m)||Ym(c,m))&&it(d.id,n))return d.id}let u=Lw(i,t,n,r,o);if(u)return u;if(Aw.has(s))return null;for(let d of is)if(s===d.basename&&it(d.id,n))return d.id;if(s.startsWith(Pw)&&it($r.id,n)&&l())return $r.id;for(let d of as)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&it(d.id,n)&&l())return d.id}for(let d of ls)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&it(d.id,n))return d.id}if(Fw(a))return null;if(!s.includes(".")&&Gn.pattern.test(s)&&it(Gn.id,n))return Gn.id;let f=zw(s,n);if(f)return f;return null}function Lw(e,t,n,r,o){return Ur.find((i)=>{if(!it(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=F(e).split("/");return W(e,B(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||vr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return W(e,Ve("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return W(e,s,["auth.json",".credentials.json"])||Sr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=B(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=F(e).split("/").at(-1)??"";return W(e,s,["config.toml"])||a.endsWith(".config.toml")&&W(e,s,[a])}case"secret.cli.gemini":return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=F(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return W(e,ce(B(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?vr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>W(e,Ve(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return W(e,s,["config.json"])||Sr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return W(e,B(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return W(e,s,["server.token"])||Sr(e,s,["credentials"])||Sr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=F(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||W(e,B(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||W(e,B(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=F(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return W(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&W(e,s,[a])||c.some((u)=>vr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=r.env.get("OPENCODE_CONFIG_DIR")?B(r.env.get("OPENCODE_CONFIG_DIR"),"~/.config/opencode",t,r,o):ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(B(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(F(e).split("/").at(-1)??"")||W(e,s,l)||(c?.trim()?vr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>W(e,Ve(u,t,r,o),l))}case"secret.cli.pi":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return W(e,B(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Ve("~",t,r,o);return[ce(B(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>W(e,l,["secrets.json"]))||Sr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(Ve("~",t,r,o),".config","amp")],l=F(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>W(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?vr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(B(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(B(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return W(e,Ve("~/.cursor",t,r,o),["auth.json"])||W(e,s,["auth.json"])||F(e).split("/").at(-1)==="mcp-auth.json"&&Vt(F(e),F(a))}case"secret.cli.cursor.config":{let s=F(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=F(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||W(e,B(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||W(e,Ve("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}default:return!1}})?.id??null}var qm=new WeakMap;function B(e,t,n,r,o){let i=qm.get(o)??new Map;qm.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Ve(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function W(e,t,n){return n.some((r)=>lp(e,ce(t,r)))}function Sr(e,t,n){return n.some((r)=>Vt(F(e),F(ce(t,r))))}function vr(e,t,n,r,o){return lp(e,Ve(t,n,r,o))}function lp(e,t){return F(e)===F(t)}function ce(e,...t){return $e([e,...t].filter(Boolean).join("/"))}function Ww(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Er(e,t,o,i));return n.some((a)=>Vt(s,F(Er(a,r,o,i))))}function Gw(e,t,n,r,o,i){if(n.length===0)return!1;let s=F(Er(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?$e(z(be(a),o.paths,i)):"",c=F(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=F(u?$e(z(fi(be(u)),o.paths,i)):l&&$e(z(`${l}/.cc-safety-net`,o.paths,i)));if(f&&Vt(s,f))return!1;return n.some((d)=>{let m=ms(d);if(m&&Zm.basename(s)!==F(m.name))return!1;let p=F(Er(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return Vt(s,p)&&!(m&&s===p)})}function Fw(e){let t=e.split("/");return t.some((n)=>Mw.has(n))||Nw.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function zw(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of cs)if(r===o.extension&&it(o.id,t))return o.id;for(let o of us)if(o.pattern.test(r)&&it(o.id,t))return o.id;return null}function F(e){return e.toLowerCase()}function it(e,t){return!t?.disabledRules?.includes(e)}function Ve(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i)return"";if(!o)return i;let s=sl(i,o),a=ui(s)?s:$e(fi(t,s)),l=$e(z(a,n.paths,r));if(!Vt(l,o)){if(ui(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Ym(e,t){return e===t||e.startsWith(`${t}/`)}function Bw(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i||!o)return"";let s=sl(i,o),a=Zm.normalize(ui(s)?s:$e(fi(t,s))),l=$e(be(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&Vt(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function Er(e,t,n,r){let{home:o,normalized:i}=il(e,n,r);if(!i)return"";let s=o?sl(i,o):i;return $e(z(ui(s)?s:fi(t,s),n.paths,r))}function il(e,t,n){let r=t.env.get("HOME")??t.home,o=r?$e(z(be(r),t.paths,n)):"",i=$e(be($w(Qe(e,t))));return{home:o,normalized:i}}function $w(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return g_(e)}catch{return e}}function sl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function Uw(e){if(process.platform==="win32")return!0;return p_.parse(e).root.length>1}function $e(e){let t=e.trim(),n=(t.includes("\\")&&Uw(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function Vt(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function Ue(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class Kt extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var Hw={findPolicyMutation:Wm,findGitMetadataMutation:gd,resolveGitMetadata:jw,loadPolicySnapshot:nu,findSensitiveTarget:tp,analyzeCommand:Pm,getModes:Ni};function cp(e,t){let n={...Hw,...t.dependencies},r=qw(e),o=xr(e)?e.command:r,i=vt("policy-protection",o,()=>rr(e)),s=ge(i,"input-candidate"),a=ge(i,"declared-command");if(xr(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:He,intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:Nd,intent:"stop_and_explain"}};let l=Ce(),c=vt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=vt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let E=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Lm,intent:"hard_stop",evidence:{command:E,segment:u.target}}}}let f=vt("policy-protection",o,()=>Om(i,t.environment,l));if(f){let E=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:km,intent:"hard_stop",evidence:{command:E,segment:f.target}}}}let d=vt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let E=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Te,intent:"hard_stop",evidence:{command:E,segment:d.target}}}}let m=vt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...Vw(m)},y=p.secretProtection.enabled===!1?null:vt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:xr(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let E=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Xm,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:E,segment:y.target}}}}if(!xr(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...al("command-validation",o),...h};let S=vt("command-analysis",o,()=>Tm(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},Kw(i),i.store),e.command,t.trace));if(S.decision){let E=!g.strict&&S.decision.kind==="deny"&&(S.decision.ruleId==="raw-text.dangerous-command"||S.decision.reason===ar&&!/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/.test(S.decision.evidence?.segment??"")&&Ae(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in S?{errorCode:S.errorCode}:{},decision:E?{...S.decision,ask:!0}:S.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function jw(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function Vw(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function Kw(e){return ge(e,"declared-command")?.program}function qw(e){try{return Tn(e.input)}catch(t){let n=xr(e)?e.command:void 0;throw new Kt("policy-protection",al("policy-protection",t instanceof Ye?void 0:n,t),t)}}function vt(e,t,n){try{return n()}catch(r){throw new Kt(e,al(e,r instanceof Ye?void 0:t,r),r)}}function al(e,t,n){let r=n instanceof N||n instanceof Ge;return{stage:e,decision:{kind:"deny",reason:r?bi:_n,intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function xr(e){return e.route.kind==="command"}import{appendFileSync as aA,mkdirSync as lA}from"node:fs";import{isAbsolute as cA,join as ul}from"node:path";import{lstatSync as dp,readdirSync as Yw,readFileSync as Zw,rmdirSync as Xw,statSync as fp,unlinkSync as Jw,utimesSync as Qw,writeFileSync as eA}from"node:fs";import{join as Rr}from"node:path";function up(e,t={}){return Jr(Qt(e,t),e.home).policy.audit.retention_days}var cl=86400000,tA=".last-prune",nA=/^\d{4}-\d{2}$/,rA=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,mp=(e)=>Math.floor(e/cl);function gp(e,t,n=()=>new Date){try{let r=n().getTime();if(!fp(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Rr(t,tA),i=fp(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&mp(i)===mp(r))return;let s=r-up(e)*cl,a=new Date(r).toISOString().slice(0,7);for(let l of ll(t)){if(l.isDirectory()){oA(Rr(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))iA(Rr(t,l.name),s)}eA(o,"",{mode:384}),Qw(o,r/1000,r/1000)}catch{}}function oA(e,t,n){for(let r of ll(e)){if(!r.isDirectory()||!nA.test(r.name))continue;let o=Rr(e,r.name);for(let i of ll(o)){if(!i.isFile())continue;let s=rA.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+cl;if(!Number.isFinite(a)||a>=t)continue;hp(Rr(o,i.name))}if(r.name!==n)pp(o)}pp(e)}function iA(e,t){try{let n=dp(e);if(n.mtimeMs>=t)return;let r=Zw(e,"utf-8").split(`
|
|
47
|
-
`).filter((o)=>o.trim()).map(sA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(dp(e).mtimeMs!==n.mtimeMs)return;hp(e)}catch{}}function sA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ll(e){try{return Yw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function hp(e){try{Jw(e)}catch{}}function pp(e){try{Xw(e)}catch{}}var uA="2.4.
|
|
47
|
+
`).filter((o)=>o.trim()).map(sA);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(dp(e).mtimeMs!==n.mtimeMs)return;hp(e)}catch{}}function sA(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function ll(e){try{return Yw(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function hp(e){try{Jw(e)}catch{}}function pp(e){try{Xw(e)}catch{}}var uA="2.4.10",dA=1e4,fA=2000,mA=256,pA=32768;function gA(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function hA(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function dl(e,t,n,r,o,i,s={}){let a=gA(t);if(!a)return;let l=CA(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=pi(at(n),s.failureStage?Number.POSITIVE_INFINITY:dA),f=pi(at(r),fA),d=s.toolName?pi(at(s.toolName),mA):void 0,m=i===null?void 0:pi(at(i),pA),p=ul(l,hA(m?.value??null),c.slice(0,7));lA(p,{recursive:!0,mode:448});let g=ul(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Li)(),v:uA,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};aA(g,`${JSON.stringify(h)}
|
|
48
48
|
`,{encoding:"utf-8",mode:384}),gp(e,l,s.now)}catch{}}function pi(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function yA(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&cA(n)?n:null}function CA(e){let t=yA(e);return t?ul(t,".cc-safety-net","logs"):null}function Cp(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=yp(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?yp(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function yp(e){return"command"in e?e.command??"":""}function bp(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;dl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function Sp(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;dl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Ep(e,t,n){try{let r=cp(t,{environment:e,...n.guard});return vp(e,t,r,n),r}catch(r){if(!(r instanceof Kt))throw r;throw vp(e,t,r.evaluation,n,!(r.cause instanceof Ye),{stage:r.stage,errorCode:bA(r.cause)}),r}}function vp(e,t,n,r,o=!0,i){bp(e,Cp(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function bA(e){if(e instanceof N)return V[e.kind].errorCode;if(e instanceof Ye)return"tool-input-limit";if(e instanceof Ge)return"structural-shell-syntax-limit";return"unexpected-error"}function Et(e,t={}){return{malformed:!0,denial:wn(t),cwd:e}}function xp(e,t={}){return(n,r)=>{try{return SA(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(wn())}}}function SA(e,t,n,r){let o=Kl();if(n.cancelled?.(t))return n.block(wn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return Sp(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=hl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=Ep(o,i,{guard:{auditAllowed:ql(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof Kt))throw l;if(Rt(Q.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Cl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Rp="exec",vA=new Set(["auto","gateway"]);function _p(e){e.on("before_tool_call",EA(e),{matcher:[Rp],priority:50})}function EA(e,t={}){return xp({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>xA(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>wA(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function xA(e,t,n,r){if(!e||typeof e!=="object")return Et(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Et(null);if(o!==Rp)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Et(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Et(null,{toolName:o});if(s.host!==void 0&&!vA.has(s.host))return Et(null,{command:a,toolName:o});let l=RA(n,t.agentId,r);if(!l)return Et(null,{command:a,toolName:o});let c=_A(l,s,r);if(!c)return Et(l,{command:a,segment:typeof s.workdir==="string"?s.workdir:void 0,toolName:o});return In(o,s,{kind:"command",shell:"auto"},{configCwd:l,executionCwd:c},a)}function RA(e,t,n){if(typeof t!=="string"||t.trim()==="")return;try{let r=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);if(typeof r!=="string"||r.trim()==="")return;return Ai(".",[r],n)}catch{return}}function _A(e,t,n){if(!Object.hasOwn(t,"workdir")||t.workdir===void 0)return e;let r=t.workdir;if(typeof r!=="string"||r.trim()==="")return;return Ai(r,[e],n)}function wA(e){return{block:!0,blockReason:yl(e)}}var zL={...gl,register:_p};export{zL as default};
|
package/dist/pi/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{ye,P,be,Xe,c,o,xe,L,V,et,d,p}from"../chunks/index-fvtsm6ez.js";import{Q}from"../chunks/index-rr4ytenf.js";import{he,D}from"../chunks/index-
|
|
1
|
+
import{ye,P,be,Xe,c,o,xe,L,V,et,d,p}from"../chunks/index-fvtsm6ez.js";import{Q}from"../chunks/index-rr4ytenf.js";import{he,D}from"../chunks/index-8z99qpz1.js";var E="cc-safety-net",x="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",w="Help me with CC Safety Net.";function f(e){e.registerCommand(E,{description:x,handler:async(n,l)=>{e.sendUserMessage(N(n),l.isIdle()?void 0:{deliverAs:"followUp"})}})}function N(e){return`${Q.slice(Q.indexOf("# CC Safety Net")).trimEnd()}
|
|
2
2
|
|
|
3
3
|
## User request
|
|
4
4
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "cc-safety-net",
|
|
3
|
-
"version": "2.4.
|
|
3
|
+
"version": "2.4.10",
|
|
4
4
|
"description": "A coding agent CLI hook - block destructive commands and secret file access",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"amp",
|
|
@@ -121,5 +121,5 @@
|
|
|
121
121
|
"./dist/pi/index.js"
|
|
122
122
|
]
|
|
123
123
|
},
|
|
124
|
-
"gitHead": "
|
|
124
|
+
"gitHead": "223691cfeefcedb181a4865d8e734a025b6aef06"
|
|
125
125
|
}
|