cc-safety-net 2.5.0 → 2.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +14 -2
- package/dist/amp/cc-safety-net/index.ts +2 -2
- package/dist/bin/hook.js +1 -1
- package/dist/chunks/{index-mrn9mahg.js → index-3rm5n91g.js} +1 -1
- package/dist/chunks/{index-yya83mcj.js → index-w2aadm3e.js} +1 -1
- package/dist/cli.js +31 -31
- package/dist/deepseek-harness/index.js +1 -1
- package/dist/index.js +1 -1
- package/dist/openclaw/cc-safety-net/index.js +2 -2
- package/dist/openclaw/cc-safety-net/openclaw.plugin.json +1 -1
- package/dist/openclaw/cc-safety-net/package.json +1 -1
- package/dist/pi/index.js +1 -1
- package/package.json +2 -2
package/dist/cli.js
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
|
-
import{a,s,_e,We,k,tt,Be,c,o,ze,R,T,Ce,rt,f,qe,l,r,v,i,ie,n,g,pe,j,it,st,u,fe,me,at,D,Y,se,S,ct,U,b,Ee,G,d,Z,Ke,Je,N,w,P,ge,he,Ae,lt,m,e,Ie,ke,Ye,Ze,ae,Re,ce,Oe,X,H,De,ye,W,Xe,B,Q,ee,le,Qe,et,C,z,Ne,Fe,Me,E,$e,Te,je,h,t,te,be,y,x,A,ut,Ue,Ge,p,V}from"./chunks/index-8cqwk53d.js";import{re,q,He,F,M}from"./chunks/index-
|
|
1
|
+
import{a,s,_e,We,k,tt,Be,c,o,ze,R,T,Ce,rt,f,qe,l,r,v,i,ie,n,g,pe,j,it,st,u,fe,me,at,D,Y,se,S,ct,U,b,Ee,G,d,Z,Ke,Je,N,w,P,ge,he,Ae,lt,m,e,Ie,ke,Ye,Ze,ae,Re,ce,Oe,X,H,De,ye,W,Xe,B,Q,ee,le,Qe,et,C,z,Ne,Fe,Me,E,$e,Te,je,h,t,te,be,y,x,A,ut,Ue,Ge,p,V}from"./chunks/index-8cqwk53d.js";import{re,q,He,F,M}from"./chunks/index-3rm5n91g.js";var wu=["-h","--help"];function gn(_,I){let O=Object.entries(_.booleans??{}),L=Object.entries(_.values??{}),J=Object.entries(_.lists??{}),K=Object.fromEntries(O.map(([Se])=>[Se,!1])),ne={},oe=Object.fromEntries(J.map(([Se])=>[Se,[]])),de=[],ue=[],ve=!1,xe=-1;for(let[Se,Pe]of I.entries()){if(Se<=xe)continue;if(Pe==="--"){de.push(...I.slice(Se+1));break}if(wu.includes(Pe)){ve=!0;continue}let we=O.find(([,Ve])=>Ve.includes(Pe));if(we){K[we[0]]=!0;continue}let Le=L.find(([,Ve])=>Ve.includes(Pe));if(Le){let Ve=I[Se+1];if(Ve===void 0||Ve.startsWith("-")){ue.push(`${Pe} requires a value`);continue}ne[Le[0]]=Ve,xe=Se+1;continue}let en=J.find(([,Ve])=>Ve.includes(Pe));if(en){let Ve=I.slice(Se+1),on=Ve.findIndex((an)=>an.startsWith("-")),sn=Ve.slice(0,on===-1?Ve.length:on);if(sn.length===0){ue.push(`${Pe} requires at least one value`);continue}oe[en[0]]=[...oe[en[0]]??[],...sn],xe=Se+sn.length;continue}if(Pe.startsWith("-")){ue.push(`Unknown option for ${_.label}: ${Pe}`);continue}if(_.positionals==="tail"){de.push(...I.slice(Se));break}de.push(Pe)}if(_.positionals!=="list"&&_.positionals!=="tail")ue.push(...de.map((Se)=>`Unexpected argument for ${_.label}: ${Se}`));return{flags:K,values:ne,lists:oe,positionals:de,help:ve,errors:ue}}function On(_){for(let I of _)console.error(I);return _.length>0}import{readdirSync as Eu,statSync as ns,unlinkSync as Au}from"node:fs";import{basename as ts,dirname as _u,isAbsolute as Iu,join as Tu,relative as $u,resolve as Ou,sep as Du}from"node:path";var Xi=(_)=>{let I=Date.now()-new Date(_).getTime();if(!Number.isFinite(I))return"";let O=Math.floor(I/60000),L=Math.floor(O/60),J=Math.floor(L/24);if(J>0)return`${J}d ago`;if(L>0)return`${L}h ago`;if(O>0)return`${O}m ago`;return"just now"},co=(_)=>{let I=(_??"").trim().split(/\s+/).filter((J)=>J&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(J)),O=I[0]?.split("/").pop();if(!O)return null;let L=I[1];return L&&/^[a-z][a-z0-9-]*$/.test(L)?`${O} ${L}`:O};function Qi(_){let I=(J)=>`${J.sessionId}
|
|
2
2
|
${co(J.segment||J.command)}`,O=_.filter((J)=>J.decision!=="allow"),L=O.filter((J)=>J.sessionId).reduce((J,K)=>J.set(I(K),(J.get(I(K))??0)+1),new Map);return new Set(O.filter((J)=>J.failureStage||(L.get(I(J))??0)>=2))}import{existsSync as ku,readdirSync as xu,readFileSync as Su}from"node:fs";import{join as Cu}from"node:path";function zn(_,I){try{return xu(_,{withFileTypes:!0,encoding:"utf8"}).flatMap((O)=>{let L=Cu(_,O.name);if(O.isDirectory())return zn(L,I);if(O.name.endsWith(".jsonl"))return[L];return[]})}catch{if(I&&ku(_))I.count++;return[]}}var Ru=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function Pu(_){if(!_||typeof _!=="object"||Array.isArray(_))return!1;let I=_;if(typeof I.ts!=="string"||typeof I.command!=="string")return!1;return Ru.every((O)=>I[O]===void 0||typeof I[O]==="string")}function ht(_,I){try{return Su(_,"utf-8").split(`
|
|
3
3
|
`).filter(Boolean).flatMap((O)=>{try{let L=JSON.parse(O);if(!Pu(L)){if(I)I.count++;return[]}return[L]}catch{if(I)I.count++;return[]}})}catch{if(I)I.count++;return[]}}function hn(_){return Array.from(_,(I)=>{let O=I.charCodeAt(0);if(O<=31||O>=127&&O<=159)return`\\x${O.toString(16).padStart(2,"0")}`;return I}).join("")}function Lu(_,I){let O=re(_),L=gn({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},I);if(On(L.errors))return null;if(L.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(L.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let J=L.values.limit===void 0?20:es(L.values.limit);if(J===null)return console.error("--limit must be a positive number"),null;let K=L.values.since===void 0?Math.min(30,O):es(L.values.since);if(K===null||K>O)return console.error(`--since must be a positive number of days no greater than ${O}`),null;let ne={limit:J,limitExplicit:L.values.limit!==void 0,since:K,sinceExplicit:L.values.since!==void 0,all:L.flags.all,json:L.flags.json,suspect:L.flags.suspect,pruneLegacy:L.flags.pruneLegacy,dryRun:L.flags.dryRun,id:L.values.id,agent:L.values.agent,rule:L.values.rule,session:L.values.session,project:L.values.project===void 0?void 0:Ou(L.values.project)};if(ne.id&&(ne.agent!==void 0||ne.rule!==void 0||ne.session!==void 0||ne.project!==void 0||ne.suspect||ne.sinceExplicit||ne.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(ne.pruneLegacy&&(ne.id!==void 0||ne.agent!==void 0||ne.rule!==void 0||ne.session!==void 0||ne.project!==void 0||ne.suspect||ne.all||ne.sinceExplicit||ne.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(ne.dryRun&&!ne.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return ne}async function rs(_,I,O={}){let L=Lu(_,I);if(!L)return 1;let J=O.logsDir??F(_);if(L.pruneLegacy)return Nu(J,L.json,L.dryRun);if(!J)return console.log(L.json?"[]":L.id?`No retained audit log entry found for id ${hn(L.id)}.`:"No audit log entries found."),0;q(_,J);let K={count:0},ne=zn(J,K).flatMap((xe)=>ht(xe,K).map((Se)=>({entry:Se,file:xe})));if(K.count>0)console.error(`warning: ${K.count} audit log ${K.count===1?"source":"sources"} could not be read; these results are incomplete`);if(L.id)return Mu(ne,L,O.timeZone);let oe=Date.now()-L.since*24*60*60*1000,de=ne.filter((xe)=>Uu(xe,L,J,oe)),ue=L.suspect?Qi(de.map((xe)=>xe.entry)):null,ve=(ue?de.filter((xe)=>ue.has(xe.entry)):de).sort((xe,Se)=>Date.parse(Se.entry.ts)-Date.parse(xe.entry.ts)).slice(0,L.limit);if(L.json)return console.log(JSON.stringify(ve.map((xe)=>xe.entry),null,2)),0;if(ve.length===0)return console.log("No audit log entries found."),0;for(let xe of ve)console.log(qu(xe.entry,O.timeZone));return 0}function Nu(_,I,O){let L=_?Fu(_).map((oe)=>Tu(_,oe)):[];if(O)return ju(L,I);let J=[],K=0,ne=0;for(let oe of L){let de=ns(oe,{throwIfNoEntry:!1})?.size??0,ue=Hu(oe);if(ue){J.push(`${ts(oe)}: ${ue}`);continue}K++,ne+=de}if(I)return console.log(JSON.stringify({removedFiles:K,removedBytes:ne,failedFiles:J.length})),J.length===0?0:1;console.log(K===0&&J.length===0?"No legacy audit log files found.":`Removed ${K} legacy audit log ${K===1?"file":"files"} (${os(ne)}).`);for(let oe of J)console.error(`Could not remove ${hn(oe)}`);if(console.log("Nested v2 audit logs were not changed."),K>0)console.log("This deletion cannot be undone.");return J.length===0?0:1}function ju(_,I){let O=_.reduce((L,J)=>L+(ns(J,{throwIfNoEntry:!1})?.size??0),0);if(I)return console.log(JSON.stringify({dryRun:!0,files:_.length,bytes:O})),0;if(console.log(_.length===0?"No legacy audit log files found.":`Would remove ${_.length} legacy audit log ${_.length===1?"file":"files"} (${os(O)}).`),console.log("Nested v2 audit logs are not included."),_.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Fu(_){try{return Eu(_,{withFileTypes:!0}).filter((I)=>I.isFile()&&I.name.endsWith(".jsonl")).map((I)=>I.name)}catch{return[]}}function Hu(_){try{return Au(_),null}catch(I){return I instanceof Error?I.message:String(I)}}function os(_){let I=["B","KiB","MiB","GiB"],O=Math.min(Math.floor(Math.log2(Math.max(_,1))/10),I.length-1);return`${Math.round(_/1024**O*10)/10} ${I[O]}`}function Mu(_,I,O){let L=_.filter((K)=>K.entry.id===I.id);if(L.length>1)return console.error(`Multiple audit log entries found for id ${hn(I.id??"")}.`),1;if(I.json)return console.log(JSON.stringify(L.map((K)=>K.entry),null,2)),0;let J=L[0];if(!J)return console.log(`No retained audit log entry found for id ${hn(I.id??"")}.`),0;return console.log(Vu(J.entry,O)),0}function Uu(_,I,O,L){if(!I.all&&_.entry.decision==="allow")return!1;if(Date.parse(_.entry.ts)<L)return!1;if(I.agent!==void 0&&_.entry.agent!==I.agent)return!1;if(I.rule!==void 0&&_.entry.ruleId!==I.rule)return!1;if(I.session!==void 0&&!Gu(_,O,I.session))return!1;if(I.project!==void 0&&!Bu(_.entry.cwd,I.project))return!1;return!0}function Gu(_,I,O){if(_.entry.sessionId===O)return!0;return _u(_.file)===I&&ts(_.file,".jsonl")===O}function Bu(_,I){if(!_)return!1;let O=$u(I,_);return O!==".."&&!O.startsWith(`..${Du}`)&&!Iu(O)}function qu(_,I){let O=hn(_.id??"-"),L=hn(_.decision??"deny"),J=_.cwd?` [${hn(_.cwd)}]`:"",K=_.segment||_.command,ne=K===_.command?"":"↳ ",oe=K.length>50?`${K.slice(0,50)}…`:K;return`${O.padEnd(16)} ${hn(is(_.ts,I))} ${L.padEnd(5)} ${hn(_.agent??"-").padEnd(15)} ${hn(_.ruleId??"-").padEnd(20)} ${ne}${hn(oe)}${J}`}function Vu(_,I){let O=(J)=>hn(J===void 0||J===null||J===""?"-":J),L=_.shape?`${_.agent??"-"} (shape: ${_.shape})`:_.agent??"-";return[`id: ${O(_.id)}`,`ts: ${O(is(_.ts,I))}`,`decision: ${O(_.decision)}`,`agent: ${O(L)}`,`level: ${O(_.level)}`,`tool: ${O(_.toolName)}`,`rule: ${O(_.ruleId)}`,`intent: ${O(_.intent)}`,`stage: ${O(_.failureStage)}`,`error: ${O(_.errorCode)}`,`session: ${O(_.sessionId)}`,`cwd: ${O(_.cwd)}`,`version: ${O(_.v)}`,`truncated: ${O(_.truncated===!0?"yes":void 0)}`,`reason: ${O(_.reason)}`,`command: ${O(_.command)}`,`segment: ${O(_.segment)}`].join(`
|
|
4
|
-
`)}function is(_,I){let O=new Date(_);if(Number.isNaN(O.getTime()))return _;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:I}).format(O)}function es(_){let I=Number(_);return Number.isFinite(I)&&I>0?I:null}var ss={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var as={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var ls={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};var uo=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],ir=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:8,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:8,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:7,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:7,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:9,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:10,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:11,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:12,install:{order:12,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:13,install:{order:13,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:14,install:{order:14,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:uo}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],sr=ir.slice().sort((_,I)=>_.doctorOrder-I.doctorOrder).map((_)=>_.id),It=ir.filter((_)=>("runtime"in _)).slice().sort((_,I)=>_.runtime.order-I.runtime.order).map((_)=>({id:_.id,displayName:"displayName"in _.runtime?_.runtime.displayName:_.displayName,flags:_.runtime.flags,legacyFlags:"legacyFlags"in _.runtime?_.runtime.legacyFlags:[],description:_.runtime.description,legacyTopLevelFlags:_.runtime.legacyTopLevelFlags})),En=ir.slice().sort((_,I)=>_.install.order-I.install.order).map((_)=>({id:_.id,..._.install})).map(({order:_,...I})=>I),zu=Object.fromEntries(ir.map((_)=>[_.id,_.displayName]));function pn(_){return zu[_]}var Ju=It.map((_)=>({flags:_.flags.join(", "),description:_.description})),Wu=It.flatMap((_)=>_.flags.map((I)=>`cc-safety-net hook ${I}`)),cs={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Ju,{flags:"-h, --help",description:"Show this help"}],examples:Wu};var ds={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...En.map((_)=>({flags:_.flag,description:`Install ${pn(_.id)} ${_.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...En.map((_)=>`cc-safety-net install ${_.flag}`)]},us={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...En.map((_)=>({flags:_.flag,description:`Uninstall ${pn(_.id)} ${_.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...En.map((_)=>`cc-safety-net uninstall ${_.flag}`)]},ps={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var fs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var ar={name:"policy",description:"Check and apply project or user policy proposals",usage:"policy <subcommand>",subcommands:[{usage:"check <file>",description:"Validate a policy proposal and print its diff"},{usage:"apply <file>",description:"Apply a proposal after confirming in a terminal"}],options:[{flags:"-g, --global",description:"Use the user-scope policy instead of the project one"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net policy check proposal.json","cc-safety-net policy apply proposal.json","cc-safety-net policy apply proposal.json --global"]};var po=[{flags:"--ref",argument:"<ref>",description:"Use a branch, tag, or commit"},{flags:"--only",argument:"<rulebook...>",description:"Add only these repository rulebooks"},{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"-h, --help",description:"Show this help"}],fo=["cc-safety-net rule add project-rules","cc-safety-net rule add acme/safety-rules","cc-safety-net rule add acme/safety-rules --only aws gcloud","cc-safety-net rule add acme/safety-rules --ref v2 --only aws","cc-safety-net rule add --only terraform aws"],yt={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add [source] [--ref <ref>] [--only <rulebook...>]",description:"Add rulebook sources and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Re-fetch and vendor remote rulebooks"},{usage:"sync",description:"Deprecated: migrate lock and cache leftovers"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},...po.slice(0,2),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk",...fo,"cc-safety-net rule update","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var ms={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var gs={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var lr=[ms,ss,fs,as,yt,ar,ds,ps,us,cs,ls,gs];function Ku(_){return _.aliases??[]}function cr(_){let I=_.toLowerCase();return lr.find((O)=>O.name.toLowerCase()===I||Ku(O).some((L)=>L.toLowerCase()===I))}import{basename as Yu}from"node:path";function dr(_,I=7,O=F(_)){let L=Date.now()-I*24*60*60*1000,J=[],K=new Set,ne=0,oe,de,ue,ve;if(O)q(_,O);let xe={count:0},Se=O?zn(O,xe):[];for(let we of Se)for(let Le of ht(we,xe)){if(Le.decision==="allow")continue;let en=new Date(Le.ts).getTime();if(en>=L){if(ne++,K.add(Le.sessionId??Yu(we,".jsonl")),de===void 0||en<=de)oe=Le.ts,de=en;if(ve===void 0||en>ve)ue=Le.ts,ve=en;Zu(J,Le,en)}}let Pe=J.map((we)=>({timestamp:we.ts,command:we.command,reason:we.reason,relativeTime:Xi(new Date(we.ts))}));return{totalBlocked:ne,sessionCount:K.size,recentEntries:Pe,oldestEntry:oe,newestEntry:ue,unreadable:xe.count}}function Zu(_,I,O){let L=_.findIndex((J)=>O>new Date(J.ts).getTime());if(L===-1){if(_.length<3)_.push(I);return}if(_.splice(L,0,I),_.length>3)_.pop()}import{dirname as cp}from"node:path";import{dirname as Xu,join as Qu,resolve as ep}from"node:path";var np="config.json";function bn(_,I,O,L){g(tp(_),`${JSON.stringify(I,null,2)}
|
|
5
|
-
`,O,L)}function tp(_){return typeof _==="string"?ie(_):_}function go(_){return{errors:ae(op(_),": "," "),ruleNames:new Set(Oe(_).map((I)=>I.toLowerCase()))}}var rp="must match pattern (letters, numbers, hyphens, underscores; max 64 chars)",hs="must match pattern (letters, numbers, hyphens, underscores)";function op(_){if(!ys(_))return[e([],"Config must be an object")];return[..._.version===1?[]:[e(["version"],"must be 1")],...ip(_.rules)]}function ip(_){if(_===void 0)return[];if(!Array.isArray(_))return[e(["rules"],"must be an array")];return[..._.flatMap((I,O)=>ys(I)?sp(I,["rules",O]):[e(["rules",O],"must be an object")]),...Ie(_)]}function sp(_,I){return[...mo(_.name,[...I,"name"],"required string",u,rp),...mo(_.command,[...I,"command"],"required string",w,hs),..._.subcommand===void 0?[]:mo(_.subcommand,[...I,"subcommand"],"must be a string if provided",w,hs),...ap(_.block_args,[...I,"block_args"]),...lp(_.reason,[...I,"reason"]),..._.intent===void 0||Re(_.intent)?[]:[e([...I,"intent"],ke)]]}function mo(_,I,O,L,J){if(typeof _!=="string")return[e(I,O)];return L.test(_)?[]:[e(I,J)]}function ap(_,I){if(!Array.isArray(_))return[e(I,"required array")];if(_.length===0)return[e(I,"must have at least one element")];return _.flatMap((O,L)=>{if(typeof O!=="string")return[e([...I,L],"must be a string")];return O===""?[e([...I,L],"must not be empty")]:[]})}function lp(_,I){if(typeof _!=="string")return[e(I,"required string")];if(_==="")return[e(I,"must not be empty")];return _.length>P?[e(I,`must be at most ${P} characters`)]:[]}function ys(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}function ho(_){let I=vs(_);if(!I.ok)return I.result;return go(I.parsed)}function vs(_){let I=[],O=new Set;try{let L=typeof _==="string"?ie(_):_,J=n(L);if(J===null)return I.push(`File not found: ${L.path}`),{ok:!1,result:{errors:I,ruleNames:O}};if(!J.trim())return I.push("Config file is empty"),{ok:!1,result:{errors:I,ruleNames:O}};return{ok:!0,parsed:JSON.parse(J)}}catch(L){if(L instanceof r)return I.push(L.message),{ok:!1,result:{errors:I,ruleNames:O}};let J=L instanceof Error?L.message:String(L);return I.push(L instanceof SyntaxError?"Invalid JSON":J),{ok:!1,result:{errors:I,ruleNames:O}}}}function bs(_){return ep(_,".safety-net.json")}function Un(_){let I=vs(_);if(!I.ok)return I.result;let O=Ye(I.parsed);return{errors:O.errors,ruleNames:O.sources}}function ur(_,I={}){return Qu(Xu(Ee(_,I)),np)}function ws(_,I,O){let L;try{if(n(I)===null)return{path:_,exists:!1,valid:!1,ruleCount:0};L=Un(I),L.errors.push(...H(_,O))}catch(J){if(!(J instanceof r))throw J;L={errors:[J.message],ruleNames:new Set}}return{path:_,exists:!0,valid:L.errors.length===0,ruleCount:L.ruleNames.size,...L.errors.length>0?{errors:L.errors}:{}}}function dp(_,I){return{source:I,name:_.name,command:_.command,subcommand:_.subcommand,blockArgs:[..._.block_args],reason:_.reason}}function ks(_,I){let O=G(_),L=U(I),J=cp(O),K=X(_,{cwd:I,userConfigPath:O,projectConfigPath:L,userConfigDir:J}),ne=Z(_,{cwd:I,userConfigPath:O,projectConfigPath:L,userConfigDir:J}),oe=new Map(K.rulebooks.flatMap((de)=>de.rules.map((ue)=>[ue,de.source])));return{userConfig:ws(O,ne.userConfigTarget,ne.userScope),projectConfig:ws(L,ne.projectConfigTarget,ne.projectScope),effectiveRules:K.rules.map((de)=>dp(de,oe.get(de.name)??"project"))}}var up=[{flag:o.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:o.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:o.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:o.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:o.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:o.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:o.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:o.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function xs(_){return[...up.map((I)=>({name:I.flag.name,value:Ce(I.flag,_.env),isSet:rt(I.flag,_.env),legacyName:I.flag.legacyName,legacyValue:I.flag.legacyName?_.env.get(I.flag.legacyName):void 0,legacyIsSet:I.flag.legacyName?_.env.get(I.flag.legacyName)!==void 0:void 0,description:I.description,defaultBehavior:I.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:_.env.get("CC_SAFETY_NET_HOME"),isSet:_.env.get("CC_SAFETY_NET_HOME")!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var Ss={error:0,warning:1,info:2},pp=["policy","config","audit"];function fp(_){return _.map((I)=>{if(I==="ownership")return"is not owned by the current user";if(I==="permissions")return"has unsafe permissions";if(I==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var mp=[{derive:(_)=>_.hooks.length>0&&_.hooks.every((I)=>!I.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(_)=>_.hooks.filter((I)=>I.inspectionStatus==="failed").map((I)=>{let O=pn(I.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${O} inspection failed`,detail:`Doctor could not verify the ${O} integration configuration.`,fixHint:`Correct the reported ${O} configuration error, then run \`cc-safety-net doctor\` again.`,integration:I.platform}})},{derive:(_)=>_.userConfig.exists&&!_.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:_.userConfig.path}]:[]},{derive:(_)=>_.projectConfig.exists&&!_.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:_.projectConfig.path}]:[]},{derive:(_)=>_.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${_.configState.reason}`,fixHint:"Fix the file named in the reason, or run `cc-safety-net rule update` to vendor a remote source, then rerun doctor."}]:[]},{derive:(_)=>_.v2Leftovers&&_.v2Leftovers.length>0?[{checkId:"config.v2-leftovers",severity:"info",title:"Rulebook lock and cache leftovers detected",detail:`Files an earlier version left behind are no longer read: ${_.v2Leftovers.join(", ")}.`,fixHint:"Run `cc-safety-net rule sync` (add `--global` for user scope) to migrate them, then rerun doctor."}]:[]},{derive:(_)=>{let I=_.environment.find((O)=>O.name==="CC_SAFETY_NET_AUDIT_SCOPE");return ze(I?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...pp.map((_)=>({derive:(I)=>I.posture.directories.filter((O)=>O.kind===_&&O.status==="unsafe").map((O)=>({checkId:`posture.${_}-directory-unsafe`,severity:"error",title:`${_[0]?.toUpperCase()}${_.slice(1)} directory is unsafe`,detail:`The ${_} directory ${fp(O.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...O.path?{path:O.path}:{}}))})),{derive:(_)=>{let I=[..._.effectiveSafety.weakenedRuleOverrides].sort();return I.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${I.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${I.join(", ")}.`}]:[]}}];function Cs(_){return mp.flatMap((I,O)=>I.derive(_).map((L,J)=>({finding:L,catalogOrder:O,occurrence:J}))).sort((I,O)=>Ss[I.finding.severity]-Ss[O.finding.severity]||I.catalogOrder-O.catalogOrder||I.occurrence-O.occurrence).map((I)=>I.finding)}function Dn(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var gp=(_)=>Dn()?`\x1B[32m${_}\x1B[0m`:_,hp=(_)=>Dn()?`\x1B[33m${_}\x1B[0m`:_,yp=(_)=>Dn()?`\x1B[34m${_}\x1B[0m`:_,vp=(_)=>Dn()?`\x1B[36m${_}\x1B[0m`:_,bp=(_)=>Dn()?`\x1B[31m${_}\x1B[0m`:_,wp=(_)=>Dn()?`\x1B[2m${_}\x1B[0m`:_,kp=(_)=>Dn()?`\x1B[1m${_}\x1B[0m`:_,nn={green:gp,yellow:hp,blue:yp,cyan:vp,red:bp,dim:wp,bold:kp},xp="\x1B[0m",Sp=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Cp(_){let I=_;return()=>(I=(I*1664525+1013904223)%4294967296,I/4294967296)}function Rp(_){let I=[...Sp],O=Cp(_);for(let L=I.length-1;L>0;L--){let J=Math.floor(O()*(L+1)),K=I[L];I[L]=I[J],I[J]=K}return I}function Pp(_,I=0){if(!Dn())return"";let O=Rp(I);return`\x1B[38;5;${O[_%O.length]}m`}function Rs(_,I,O=0){if(!Dn())return`"${_}"`;return`${Pp(I,O)}"${_}"${xp}`}function pr(_){return _==="default"?"built-in default":`${_} policy`}var Ep=new RegExp("\x1B\\[[0-9;]*m","g"),yo=(_)=>_.replace(Ep,"").length;function Jn(_){let I=(_.headers??_.rows[0]??[]).map((ne,oe)=>{let de=Math.max(..._.rows.map((ue)=>yo(ue[oe]??"")));return Math.max(yo(ne),de)}),O=(ne,oe)=>ne+" ".repeat(Math.max(0,oe-yo(ne))),L=(ne,oe)=>oe[0]+I.map((de)=>ne.repeat(de+2)).join(oe[1])+oe[2],J=(ne)=>`│ ${ne.map((oe,de)=>O(oe,I[de]??0)).join(" │ ")} │`,K=_.headers?[` ${J(_.headers)}`,` ${L("─",["├","┼","┤"])}`]:[];return[` ${L("─",["┌","┬","┐"])}`,...K,..._.rows.map((ne)=>` ${J(ne)}`),` ${L("─",["└","┴","┘"])}`].join(`
|
|
6
|
-
`)}function Ps(_){let I=[];I.push("Hook Integration"),I.push(Ap(_));let O=[],L=[];for(let J of _){let K=
|
|
7
|
-
`)}function Ap(_){let I=["Platform","Discovery","Configuration","Inspection"],O=_.map((L)=>{let J=
|
|
4
|
+
`)}function is(_,I){let O=new Date(_);if(Number.isNaN(O.getTime()))return _;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:I}).format(O)}function es(_){let I=Number(_);return Number.isFinite(I)&&I>0?I:null}var ss={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var as={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var ls={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};var uo=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],ir=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:8,runtime:{order:6,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:8,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:7,runtime:{order:5,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:7,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:9,runtime:{order:7,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:9,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:10,runtime:{order:8,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:10,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:11,runtime:{order:9,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:12,install:{order:12,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:13,install:{order:13,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:14,install:{order:14,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:uo}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],sr=ir.slice().sort((_,I)=>_.doctorOrder-I.doctorOrder).map((_)=>_.id),It=ir.filter((_)=>("runtime"in _)).slice().sort((_,I)=>_.runtime.order-I.runtime.order).map((_)=>({id:_.id,displayName:"displayName"in _.runtime?_.runtime.displayName:_.displayName,flags:_.runtime.flags,legacyFlags:"legacyFlags"in _.runtime?_.runtime.legacyFlags:[],description:_.runtime.description,legacyTopLevelFlags:_.runtime.legacyTopLevelFlags})),En=ir.slice().sort((_,I)=>_.install.order-I.install.order).map((_)=>({id:_.id,..._.install})).map(({order:_,...I})=>I),zu=Object.fromEntries(ir.map((_)=>[_.id,_.displayName]));function fn(_){return zu[_]}var Ju=It.map((_)=>({flags:_.flags.join(", "),description:_.description})),Wu=It.flatMap((_)=>_.flags.map((I)=>`cc-safety-net hook ${I}`)),cs={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Ju,{flags:"-h, --help",description:"Show this help"}],examples:Wu};var ds={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...En.map((_)=>({flags:_.flag,description:`Install ${fn(_.id)} ${_.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...En.map((_)=>`cc-safety-net install ${_.flag}`)]},us={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...En.map((_)=>({flags:_.flag,description:`Uninstall ${fn(_.id)} ${_.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...En.map((_)=>`cc-safety-net uninstall ${_.flag}`)]},ps={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var fs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var ar={name:"policy",description:"Check and apply project or user policy proposals",usage:"policy <subcommand>",subcommands:[{usage:"check <file>",description:"Validate a policy proposal and print its diff"},{usage:"apply <file>",description:"Apply a proposal after confirming in a terminal"}],options:[{flags:"-g, --global",description:"Use the user-scope policy instead of the project one"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net policy check proposal.json","cc-safety-net policy apply proposal.json","cc-safety-net policy apply proposal.json --global"]};var po=[{flags:"--ref",argument:"<ref>",description:"Use a branch, tag, or commit"},{flags:"--only",argument:"<rulebook...>",description:"Add only these repository rulebooks"},{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"-h, --help",description:"Show this help"}],fo=["cc-safety-net rule add project-rules","cc-safety-net rule add acme/safety-rules","cc-safety-net rule add acme/safety-rules --only aws gcloud","cc-safety-net rule add acme/safety-rules --ref v2 --only aws","cc-safety-net rule add --only terraform aws"],yt={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add [source] [--ref <ref>] [--only <rulebook...>]",description:"Add rulebook sources and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Re-fetch and vendor remote rulebooks"},{usage:"sync",description:"Deprecated: migrate lock and cache leftovers"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},...po.slice(0,2),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk",...fo,"cc-safety-net rule update","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var ms={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var gs={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var lr=[ms,ss,fs,as,yt,ar,ds,ps,us,cs,ls,gs];function Ku(_){return _.aliases??[]}function cr(_){let I=_.toLowerCase();return lr.find((O)=>O.name.toLowerCase()===I||Ku(O).some((L)=>L.toLowerCase()===I))}import{basename as Yu}from"node:path";function dr(_,I=7,O=F(_)){let L=Date.now()-I*24*60*60*1000,J=[],K=new Set,ne=0,oe,de,ue,ve;if(O)q(_,O);let xe={count:0},Se=O?zn(O,xe):[];for(let we of Se)for(let Le of ht(we,xe)){if(Le.decision==="allow")continue;let en=new Date(Le.ts).getTime();if(en>=L){if(ne++,K.add(Le.sessionId??Yu(we,".jsonl")),de===void 0||en<=de)oe=Le.ts,de=en;if(ve===void 0||en>ve)ue=Le.ts,ve=en;Zu(J,Le,en)}}let Pe=J.map((we)=>({timestamp:we.ts,command:we.command,reason:we.reason,relativeTime:Xi(new Date(we.ts))}));return{totalBlocked:ne,sessionCount:K.size,recentEntries:Pe,oldestEntry:oe,newestEntry:ue,unreadable:xe.count}}function Zu(_,I,O){let L=_.findIndex((J)=>O>new Date(J.ts).getTime());if(L===-1){if(_.length<3)_.push(I);return}if(_.splice(L,0,I),_.length>3)_.pop()}import{dirname as cp}from"node:path";import{dirname as Xu,join as Qu,resolve as ep}from"node:path";var np="config.json";function bn(_,I,O,L){g(tp(_),`${JSON.stringify(I,null,2)}
|
|
5
|
+
`,O,L)}function tp(_){return typeof _==="string"?ie(_):_}function go(_){return{errors:ae(op(_),": "," "),ruleNames:new Set(Oe(_).map((I)=>I.toLowerCase()))}}var rp="must match pattern (letters, numbers, hyphens, underscores; max 64 chars)",hs="must match pattern (letters, numbers, hyphens, underscores)";function op(_){if(!ys(_))return[e([],"Config must be an object")];return[..._.version===1?[]:[e(["version"],"must be 1")],...ip(_.rules)]}function ip(_){if(_===void 0)return[];if(!Array.isArray(_))return[e(["rules"],"must be an array")];return[..._.flatMap((I,O)=>ys(I)?sp(I,["rules",O]):[e(["rules",O],"must be an object")]),...Ie(_)]}function sp(_,I){return[...mo(_.name,[...I,"name"],"required string",u,rp),...mo(_.command,[...I,"command"],"required string",w,hs),..._.subcommand===void 0?[]:mo(_.subcommand,[...I,"subcommand"],"must be a string if provided",w,hs),...ap(_.block_args,[...I,"block_args"]),...lp(_.reason,[...I,"reason"]),..._.intent===void 0||Re(_.intent)?[]:[e([...I,"intent"],ke)]]}function mo(_,I,O,L,J){if(typeof _!=="string")return[e(I,O)];return L.test(_)?[]:[e(I,J)]}function ap(_,I){if(!Array.isArray(_))return[e(I,"required array")];if(_.length===0)return[e(I,"must have at least one element")];return _.flatMap((O,L)=>{if(typeof O!=="string")return[e([...I,L],"must be a string")];return O===""?[e([...I,L],"must not be empty")]:[]})}function lp(_,I){if(typeof _!=="string")return[e(I,"required string")];if(_==="")return[e(I,"must not be empty")];return _.length>P?[e(I,`must be at most ${P} characters`)]:[]}function ys(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}function ho(_){let I=vs(_);if(!I.ok)return I.result;return go(I.parsed)}function vs(_){let I=[],O=new Set;try{let L=typeof _==="string"?ie(_):_,J=n(L);if(J===null)return I.push(`File not found: ${L.path}`),{ok:!1,result:{errors:I,ruleNames:O}};if(!J.trim())return I.push("Config file is empty"),{ok:!1,result:{errors:I,ruleNames:O}};return{ok:!0,parsed:JSON.parse(J)}}catch(L){if(L instanceof r)return I.push(L.message),{ok:!1,result:{errors:I,ruleNames:O}};let J=L instanceof Error?L.message:String(L);return I.push(L instanceof SyntaxError?"Invalid JSON":J),{ok:!1,result:{errors:I,ruleNames:O}}}}function bs(_){return ep(_,".safety-net.json")}function Mn(_){let I=vs(_);if(!I.ok)return I.result;let O=Ye(I.parsed);return{errors:O.errors,ruleNames:O.sources}}function ur(_,I={}){return Qu(Xu(Ee(_,I)),np)}function ws(_,I,O){let L;try{if(n(I)===null)return{path:_,exists:!1,valid:!1,ruleCount:0};L=Mn(I),L.errors.push(...H(_,O))}catch(J){if(!(J instanceof r))throw J;L={errors:[J.message],ruleNames:new Set}}return{path:_,exists:!0,valid:L.errors.length===0,ruleCount:L.ruleNames.size,...L.errors.length>0?{errors:L.errors}:{}}}function dp(_,I){return{source:I,name:_.name,command:_.command,subcommand:_.subcommand,blockArgs:[..._.block_args],reason:_.reason}}function ks(_,I){let O=G(_),L=U(I),J=cp(O),K=X(_,{cwd:I,userConfigPath:O,projectConfigPath:L,userConfigDir:J}),ne=Z(_,{cwd:I,userConfigPath:O,projectConfigPath:L,userConfigDir:J}),oe=new Map(K.rulebooks.flatMap((de)=>de.rules.map((ue)=>[ue,de.source])));return{userConfig:ws(O,ne.userConfigTarget,ne.userScope),projectConfig:ws(L,ne.projectConfigTarget,ne.projectScope),effectiveRules:K.rules.map((de)=>dp(de,oe.get(de.name)??"project"))}}var up=[{flag:o.level,description:"Safety level preset: standard, strict, or paranoid",defaultBehavior:"standard"},{flag:o.strict,description:"Legacy; equivalent to safety.overrides.fail_closed",defaultBehavior:"permissive"},{flag:o.paranoid,description:"Legacy; equivalent to safety.overrides.paranoid_rm and paranoid_interpreters",defaultBehavior:"off"},{flag:o.paranoidRm,description:"Legacy; equivalent to safety.overrides.paranoid_rm",defaultBehavior:"off"},{flag:o.paranoidInterpreters,description:"Legacy; equivalent to safety.overrides.paranoid_interpreters",defaultBehavior:"off"},{flag:o.worktree,description:"Allow local git discards in linked worktrees",defaultBehavior:"off"},{flag:o.debug,description:"Print diagnostic messages to stderr",defaultBehavior:"off"},{flag:o.auditScope,description:"Command decisions recorded: all, or blocked (privacy-minimizing, denials only)",defaultBehavior:"all"}];function xs(_){return[...up.map((I)=>({name:I.flag.name,value:Ce(I.flag,_.env),isSet:rt(I.flag,_.env),legacyName:I.flag.legacyName,legacyValue:I.flag.legacyName?_.env.get(I.flag.legacyName):void 0,legacyIsSet:I.flag.legacyName?_.env.get(I.flag.legacyName)!==void 0:void 0,description:I.description,defaultBehavior:I.defaultBehavior})),{name:"CC_SAFETY_NET_HOME",value:_.env.get("CC_SAFETY_NET_HOME"),isSet:_.env.get("CC_SAFETY_NET_HOME")!==void 0,description:"Override user-scope config/cache directory",defaultBehavior:"~/.cc-safety-net"}]}var Ss={error:0,warning:1,info:2},pp=["policy","config","audit"];function fp(_){return _.map((I)=>{if(I==="ownership")return"is not owned by the current user";if(I==="permissions")return"has unsafe permissions";if(I==="symlink")return"is a symbolic link";return"is not a directory"}).join(" and ")}var mp=[{derive:(_)=>_.hooks.length>0&&_.hooks.every((I)=>!I.configured)?[{checkId:"integration.none-configured",severity:"error",title:"No integration configured",detail:"CC Safety Net is not connected to any supported coding-agent integration.",fixHint:"Run `cc-safety-net install` and configure at least one integration."}]:[]},{derive:(_)=>_.hooks.filter((I)=>I.inspectionStatus==="failed").map((I)=>{let O=fn(I.platform);return{checkId:"integration.inspection-failed",severity:"error",title:`${O} inspection failed`,detail:`Doctor could not verify the ${O} integration configuration.`,fixHint:`Correct the reported ${O} configuration error, then run \`cc-safety-net doctor\` again.`,integration:I.platform}})},{derive:(_)=>_.userConfig.exists&&!_.userConfig.valid?[{checkId:"config.user-invalid",severity:"error",title:"User configuration is invalid",detail:"Doctor could not load a valid user rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:_.userConfig.path}]:[]},{derive:(_)=>_.projectConfig.exists&&!_.projectConfig.valid?[{checkId:"config.project-invalid",severity:"error",title:"Project configuration is invalid",detail:"Doctor could not load a valid project rules configuration.",fixHint:"Run `cc-safety-net rule verify`, correct the reported error, then rerun doctor.",path:_.projectConfig.path}]:[]},{derive:(_)=>_.configState.state==="degraded"?[{checkId:"config.runtime-degraded",severity:"warning",title:"Runtime is enforcing a fallback configuration",detail:`The rejected candidate configuration is not active: ${_.configState.reason}`,fixHint:"Fix the file named in the reason, or run `cc-safety-net rule update` to vendor a remote source, then rerun doctor."}]:[]},{derive:(_)=>_.v2Leftovers&&_.v2Leftovers.length>0?[{checkId:"config.v2-leftovers",severity:"info",title:"Rulebook lock and cache leftovers detected",detail:`Files an earlier version left behind are no longer read: ${_.v2Leftovers.join(", ")}.`,fixHint:"Run `cc-safety-net rule sync` (add `--global` for user scope) to migrate them, then rerun doctor."}]:[]},{derive:(_)=>{let I=_.environment.find((O)=>O.name==="CC_SAFETY_NET_AUDIT_SCOPE");return ze(I?.value)==="invalid"?[{checkId:"environment.audit-scope-invalid",severity:"warning",title:"Audit scope value is invalid",detail:"CC_SAFETY_NET_AUDIT_SCOPE is not `all` or `blocked`, so allowed command decisions are not recorded.",fixHint:"Set CC_SAFETY_NET_AUDIT_SCOPE to `all` or `blocked`, then restart the integration."}]:[]}},...pp.map((_)=>({derive:(I)=>I.posture.directories.filter((O)=>O.kind===_&&O.status==="unsafe").map((O)=>({checkId:`posture.${_}-directory-unsafe`,severity:"error",title:`${_[0]?.toUpperCase()}${_.slice(1)} directory is unsafe`,detail:`The ${_} directory ${fp(O.issues)}.`,fixHint:"Ensure this is a real directory owned by the current user with no group or other write access, then rerun doctor.",...O.path?{path:O.path}:{}}))})),{derive:(_)=>{let I=[..._.effectiveSafety.weakenedRuleOverrides].sort();return I.length>0?[{checkId:"posture.rule-overrides-weaken-preset",severity:"warning",title:"Rule overrides weaken the selected preset",detail:`Explicit overrides disable rules the resolved preset would enable: ${I.join(", ")}.`,fixHint:`Remove these \`off\` overrides or set them to \`on\`: ${I.join(", ")}.`}]:[]}}];function Cs(_){return mp.flatMap((I,O)=>I.derive(_).map((L,J)=>({finding:L,catalogOrder:O,occurrence:J}))).sort((I,O)=>Ss[I.finding.severity]-Ss[O.finding.severity]||I.catalogOrder-O.catalogOrder||I.occurrence-O.occurrence).map((I)=>I.finding)}function Dn(){return Boolean(process.stdout.isTTY&&!process.env.NO_COLOR)}var gp=(_)=>Dn()?`\x1B[32m${_}\x1B[0m`:_,hp=(_)=>Dn()?`\x1B[33m${_}\x1B[0m`:_,yp=(_)=>Dn()?`\x1B[34m${_}\x1B[0m`:_,vp=(_)=>Dn()?`\x1B[36m${_}\x1B[0m`:_,bp=(_)=>Dn()?`\x1B[31m${_}\x1B[0m`:_,wp=(_)=>Dn()?`\x1B[2m${_}\x1B[0m`:_,kp=(_)=>Dn()?`\x1B[1m${_}\x1B[0m`:_,nn={green:gp,yellow:hp,blue:yp,cyan:vp,red:bp,dim:wp,bold:kp},xp="\x1B[0m",Sp=[39,82,198,226,208,51,196,46,201,214,93,154,220,27,49,190,200,33,129,227,45,160,63,118,123,202];function Cp(_){let I=_;return()=>(I=(I*1664525+1013904223)%4294967296,I/4294967296)}function Rp(_){let I=[...Sp],O=Cp(_);for(let L=I.length-1;L>0;L--){let J=Math.floor(O()*(L+1)),K=I[L];I[L]=I[J],I[J]=K}return I}function Pp(_,I=0){if(!Dn())return"";let O=Rp(I);return`\x1B[38;5;${O[_%O.length]}m`}function Rs(_,I,O=0){if(!Dn())return`"${_}"`;return`${Pp(I,O)}"${_}"${xp}`}function pr(_){return _==="default"?"built-in default":`${_} policy`}var Ep=new RegExp("\x1B\\[[0-9;]*m","g"),yo=(_)=>_.replace(Ep,"").length;function Jn(_){let I=(_.headers??_.rows[0]??[]).map((ne,oe)=>{let de=Math.max(..._.rows.map((ue)=>yo(ue[oe]??"")));return Math.max(yo(ne),de)}),O=(ne,oe)=>ne+" ".repeat(Math.max(0,oe-yo(ne))),L=(ne,oe)=>oe[0]+I.map((de)=>ne.repeat(de+2)).join(oe[1])+oe[2],J=(ne)=>`│ ${ne.map((oe,de)=>O(oe,I[de]??0)).join(" │ ")} │`,K=_.headers?[` ${J(_.headers)}`,` ${L("─",["├","┼","┤"])}`]:[];return[` ${L("─",["┌","┬","┐"])}`,...K,..._.rows.map((ne)=>` ${J(ne)}`),` ${L("─",["└","┴","┘"])}`].join(`
|
|
6
|
+
`)}function Ps(_){let I=[];I.push("Hook Integration"),I.push(Ap(_));let O=[],L=[];for(let J of _){let K=fn(J.platform);if(J.errors&&J.errors.length>0)for(let ne of J.errors)if(J.configured)O.push({platform:K,message:ne});else L.push({platform:K,message:ne})}for(let J of O)I.push(` Warning (${J.platform}): ${J.message}`);for(let J of L)I.push(nn.red(` Error (${J.platform}): ${J.message}`));return I.join(`
|
|
7
|
+
`)}function Ap(_){let I=["Platform","Discovery","Configuration","Inspection"],O=_.map((L)=>{let J=fn(L.platform);if(L.inspectionStatus==="not-inspected"){let de=nn.dim("Not inspected");return[J,de,de,de]}let K=L.detected?nn.green("Detected"):L.inspectionStatus==="failed"?nn.red("Unknown"):nn.dim("Not detected"),ne=L.configured?nn.green("Configured"):L.detected?nn.yellow("Not configured"):L.inspectionStatus==="failed"?nn.red("Unknown"):nn.dim("Not applicable"),oe=L.inspectionStatus==="verified"?nn.green("Verified"):L.inspectionStatus==="failed"?nn.red("Failed"):nn.dim("Not applicable");return[J,K,ne,oe]});return Jn({headers:I,rows:O})}function Es(_){let O=["Guard Engine Verification",` Synthetic self-test: ${_.failed>0?nn.red(`${_.passed}/${_.total} FAIL`):nn.green(`${_.passed}/${_.total} passed`)}`],L=_.results.filter((J)=>!J.passed);if(L.length>0){O.push(""),O.push(nn.red(" Failures:"));for(let J of L)O.push(nn.red(` • ${J.description}`)),O.push(nn.red(` expected ${J.expected}, got ${J.actual}`))}return O.join(`
|
|
8
8
|
`)}function _p(_){if(_.length===0)return" (no custom rules)";let I=["Source","Name","Command","Block Args"],O=_.map((L)=>[L.source,L.name,L.subcommand?`${L.command} ${L.subcommand}`:L.command,L.blockArgs.join(", ")]);return Jn({headers:I,rows:O})}function As(_){let I=[];if(I.push("Configuration"),I.push(Ip(_.userConfig,_.projectConfig)),I.push(""),_.effectiveRules.length>0)I.push(` Effective rules (${_.effectiveRules.length} total):`),I.push(_p(_.effectiveRules));else I.push(" Effective rules: (none - using built-in rules only)");return I.join(`
|
|
9
9
|
`)}function Ip(_,I){let O=["Scope","Status"],L=(K)=>{if(!K.exists)return nn.dim("N/A");if(!K.valid)return nn.red(`Invalid (${K.errors?.[0]??"unknown error"})`);return nn.green("Configured")},J=[["User",L(_)],["Project",L(I)]];return Jn({headers:O,rows:J})}function _s(_){let I=[];return I.push("Environment"),I.push(Tp(_)),I.join(`
|
|
10
10
|
`)}function Is(_){let I=_.effectiveSafety.policyScopes,O=["Effective Safety",` Selected preset: ${_.effectiveSafety.selectedPreset}${I?` (${pr(I.levelScope)})`:""}`,` Effective: ${_.effectiveSafety.level}`],L=[["fail_closed","fail_closed"],["paranoid_rm","paranoid_rm"],["paranoid_interpreters","paranoid_interpreters"]];for(let[J,K]of L){let ne=_.effectiveSafety.capabilities[J],oe=ne.enabled?nn.green("ON"):nn.dim("OFF"),de=ne.sources.length>0?` (${ne.sources.join(", ")})`:"";O.push(` ${K}: ${oe} via ${ne.source}${de}`)}if(I&&I.weakenings.length>0){O.push(" Project policy deltas:");for(let J of I.weakenings)O.push(` ${J}`)}O.push(` Stored rule customizations: ${_.effectiveSafety.ruleCounts.stored}`),O.push(` Effective rule customizations: ${_.effectiveSafety.ruleCounts.effective}`);for(let[J,K]of Object.entries(_.effectiveSafety.ruleOverrides))O.push(` ${J}: ${K}`);return O.join(`
|
|
@@ -16,10 +16,10 @@ ${co(J.segment||J.command)}`,O=_.filter((J)=>J.decision!=="allow"),L=O.filter((J
|
|
|
16
16
|
`);if(_.updateAvailable)return I.push(fr([["Status",`${nn.yellow("⚠")} Update Available`],["Current",_.currentVersion],["Latest",nn.green(_.latestVersion??"")]])),I.push(""),I.push(" Run: bunx cc-safety-net@latest doctor"),I.push(" Or: npx cc-safety-net@latest doctor"),I.join(`
|
|
17
17
|
`);return I.push(fr([["Status",`${nn.green("✓")} Up to date`],["Version",_.currentVersion]])),I.join(`
|
|
18
18
|
`)}function fr(_){return Jn({rows:_})}function Ds(_){let I=[];return I.push("System Info"),I.push(Op(_)),I.join(`
|
|
19
|
-
`)}function Op(_){let I=["Component","Version"],O=(K)=>{if(K===null)return nn.dim("not found");return K},J=[{label:"cc-safety-net",value:_.version},...sr.map((K)=>({label:
|
|
19
|
+
`)}function Op(_){let I=["Component","Version"],O=(K)=>{if(K===null)return nn.dim("not found");return K},J=[{label:"cc-safety-net",value:_.version},...sr.map((K)=>({label:fn(K),value:_.versions[K]??null})),{label:"Node.js",value:_.nodeVersion},{label:"npm",value:_.npmVersion},{label:"Bun",value:_.bunVersion},{label:"Platform",value:_.platform}].map((K)=>[K.label,O(K.value)]);return Jn({headers:I,rows:J})}function Ls(_){if(_.findings.length===0)return nn.green(`
|
|
20
20
|
No findings from inspected doctor facts.`);let I={error:_.findings.filter((K)=>K.severity==="error").length,warning:_.findings.filter((K)=>K.severity==="warning").length,info:_.findings.filter((K)=>K.severity==="info").length},O=["error","warning","info"].filter((K)=>I[K]>0).map((K)=>`${I[K]} ${K}`),L=_.findings.length===1?"finding":"findings",J=`
|
|
21
|
-
${_.findings.length} ${L}: ${O.join(", ")}.`;if(I.error>0)return nn.red(J);if(I.warning>0)return nn.yellow(J);return nn.blue(J)}import{lstatSync as Dp}from"node:fs";import{dirname as vo}from"node:path";function bo(_,I){try{let O=Dp(I);if(O.isSymbolicLink())return{kind:_,path:I,status:"unsafe",issues:["symlink"]};if(!O.isDirectory())return{kind:_,path:I,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:_,path:I,status:"unknown",issues:[]};let L=[...O.uid!==process.getuid()?["ownership"]:[],...(O.mode&18)!==0?["permissions"]:[]];return{kind:_,path:I,status:L.length>0?"unsafe":"safe",issues:L}}catch(O){if(typeof O==="object"&&O!==null&&"code"in O&&O.code==="ENOENT")return{kind:_,path:I,status:"not-applicable",issues:[]};return{kind:_,path:I,status:"unknown",issues:[]}}}function Ns(_,I){let O=F(_);return{directories:[bo("policy",vo(vo(I))),bo("config",vo(I)),...O?[bo("audit",O)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Lp}from"node:child_process";import{existsSync as js}from"node:fs";import{delimiter as Np,extname as jp,join as Fp}from"node:path";import{stripVTControlCharacters as Fs}from"node:util";var Ms="2.5.
|
|
22
|
-
`)[0]?.trim()||null}async function gr(_,I=vt,O=process.cwd()){let L=Promise.all(En.map(async(xe)=>[xe.id,mr(await I([...xe.probeCommand]))])),[J,K,ne,oe,de,ue,ve]=await Promise.all([L,L.then(async(xe)=>{let Se=xe.find(([Le])=>Le==="opencode")?.[1];if(!Se?.startsWith("2.")||!_(Se))return null;let Pe=["--param",`location[directory]=${O}`],we=["opencode","api","integration.list",...Pe];return await I(we,30000),I(["opencode","api","plugin.list",...Pe],30000)}),I(["codex","plugin","list"],30000),I(["amp","plugins","list"],30000),I(["node","--version"]),I(["npm","--version"]),I(["bun","--version"])]);return{version:Ms,versions:Object.fromEntries(J),codexPluginListOutput:ne,ampPluginListOutput:oe,openCodePluginListOutput:K,nodeVersion:mr(de),npmVersion:mr(ue),bunVersion:mr(ve),platform:`${process.platform} ${process.arch}`}}function ko(_,I){if(I==="dev")return!1;let O=_.split(".").map(Number),L=I.split(".").map(Number),[J=0,K=0,ne=0]=O,[oe=0,de=0,ue=0]=L;if(J!==oe)return J>oe;if(K!==de)return K>de;return ne>ue}async function
|
|
21
|
+
${_.findings.length} ${L}: ${O.join(", ")}.`;if(I.error>0)return nn.red(J);if(I.warning>0)return nn.yellow(J);return nn.blue(J)}import{lstatSync as Dp}from"node:fs";import{dirname as vo}from"node:path";function bo(_,I){try{let O=Dp(I);if(O.isSymbolicLink())return{kind:_,path:I,status:"unsafe",issues:["symlink"]};if(!O.isDirectory())return{kind:_,path:I,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:_,path:I,status:"unknown",issues:[]};let L=[...O.uid!==process.getuid()?["ownership"]:[],...(O.mode&18)!==0?["permissions"]:[]];return{kind:_,path:I,status:L.length>0?"unsafe":"safe",issues:L}}catch(O){if(typeof O==="object"&&O!==null&&"code"in O&&O.code==="ENOENT")return{kind:_,path:I,status:"not-applicable",issues:[]};return{kind:_,path:I,status:"unknown",issues:[]}}}function Ns(_,I){let O=F(_);return{directories:[bo("policy",vo(vo(I))),bo("config",vo(I)),...O?[bo("audit",O)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Lp}from"node:child_process";import{existsSync as js}from"node:fs";import{delimiter as Np,extname as jp,join as Fp}from"node:path";import{stripVTControlCharacters as Fs}from"node:util";var Ms="2.5.1",Hp=5000,Mp="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function un(){return Ms}function wo(_,I){let O=_[I];if(O)return O;let L=Object.keys(_).find((J)=>J.toLowerCase()===I.toLowerCase()&&!!_[J]);return L?_[L]:O}function Up(_){return(wo(_,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((I)=>I.length>0)}function Gp(_,I){let O=jp(_)?[_]:[...Up(I).map((L)=>`${_}${L}`),_];if(_.includes("/")||_.includes("\\"))return O.find((L)=>js(L))??_;return(wo(I,"PATH")??"").split(Np).flatMap((L)=>O.map((J)=>Fp(L,J))).find((L)=>js(L))??_}function Hs(_){if(!/[\s"&|<>^]/.test(_))return _;return`"${_.replace(/"/g,'""')}"`}function Wn(_,I){let[O,...L]=_,J=I[Mp]==="win32"?"win32":process.platform;if(!O||J!=="win32")return{cmd:O??"",args:L};let K=Gp(O,I);if(!/\.(?:bat|cmd)$/i.test(K))return{cmd:K,args:L};return{cmd:wo(I,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Hs(K),...L.map(Hs)].join(" ")]}}var vt=async(_,I=Hp)=>{let O=await Bp(_,{timeoutMs:I});if(O.code!==0)return null;return Fs(O.stdout).trim()||Fs(O.stderr).trim()||null};function Bp(_,I){let[O,...L]=_;if(!O)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((J)=>{try{let K=Wn([O,...L],process.env),ne=Lp(K.cmd,K.args,{stdio:["ignore","pipe","pipe"]}),oe=!1,de="",ue="";ne.stdout.on("data",(Se)=>{de+=Se.toString()}),ne.stderr.on("data",(Se)=>{ue+=Se.toString()});let ve=(Se)=>{if(oe)return;oe=!0,clearTimeout(xe),J(Se)},xe=setTimeout(()=>{ne.kill(),ve({code:null,stdout:de,stderr:ue})},I.timeoutMs);ne.on("close",(Se)=>{ve({code:Se,stdout:de,stderr:ue})}),ne.on("error",()=>{ve({code:null,stdout:de,stderr:ue})})}catch{J({code:null,stdout:"",stderr:""})}})}function mr(_){if(!_)return null;let I=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(_);if(I)return I[1]??null;let O=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(_);if(O)return O[1]??null;return _.split(`
|
|
22
|
+
`)[0]?.trim()||null}async function gr(_,I=vt,O=process.cwd()){let L=Promise.all(En.map(async(xe)=>[xe.id,mr(await I([...xe.probeCommand]))])),[J,K,ne,oe,de,ue,ve]=await Promise.all([L,L.then(async(xe)=>{let Se=xe.find(([Le])=>Le==="opencode")?.[1];if(!Se?.startsWith("2.")||!_(Se))return null;let Pe=["--param",`location[directory]=${O}`],we=["opencode","api","integration.list",...Pe];return await I(we,30000),I(["opencode","api","plugin.list",...Pe],30000)}),I(["codex","plugin","list"],30000),I(["amp","plugins","list"],30000),I(["node","--version"]),I(["npm","--version"]),I(["bun","--version"])]);return{version:Ms,versions:Object.fromEntries(J),codexPluginListOutput:ne,ampPluginListOutput:oe,openCodePluginListOutput:K,nodeVersion:mr(de),npmVersion:mr(ue),bunVersion:mr(ve),platform:`${process.platform} ${process.arch}`}}function ko(_,I){if(I==="dev")return!1;let O=_.split(".").map(Number),L=I.split(".").map(Number),[J=0,K=0,ne=0]=O,[oe=0,de=0,ue=0]=L;if(J!==oe)return J>oe;if(K!==de)return K>de;return ne>ue}async function Un(){let _=un(),I=new AbortController,O=setTimeout(()=>I.abort(),3000);try{let L=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:I.signal});if(!L.ok)return{currentVersion:_,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${L.status}`};let J=await L.json(),K=ko(J.version,_);return{currentVersion:_,latestVersion:J.version,updateAvailable:K}}catch(L){return{currentVersion:_,latestVersion:null,updateAvailable:!1,error:L instanceof Error?L.message:"Network error"}}finally{clearTimeout(O)}}import*as Ws from"node:readline";var qs=(_)=>`\x1B[${_}B`,qp=(_)=>`\x1B[${_}A`;var Us=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function Vp(_){return new Promise((I)=>setTimeout(I,_))}function zp(_,I,O){if(!O)return I(_);if(O.aborted)return Promise.resolve();return new Promise((L,J)=>{let K=()=>O.removeEventListener("abort",ne),ne=()=>{K(),L()};O.addEventListener("abort",ne,{once:!0}),I(_).then(()=>{K(),L()},(oe)=>{K(),J(oe)})})}function hr(_){return Math.max(0,Math.min(1,_))}function bt(_){return Math.max(0,Math.min(255,Math.round(_)))}function xo(_){return _<=0.0031308?12.92*_:1.055*_**0.4166666666666667-0.055}function Jp(_,I,O){let L=O*Math.PI/180,J=I*Math.cos(L),K=I*Math.sin(L),ne=(_+0.3963377774*J+0.2158037573*K)**3,oe=(_-0.1055613458*J-0.0638541728*K)**3,de=(_-0.0894841775*J-1.291485548*K)**3;return{blue:bt(xo(hr(-0.0041960863*ne-0.7034186147*oe+1.707614701*de))*255),green:bt(xo(hr(-1.2684380046*ne+2.6097574011*oe-0.3413193965*de))*255),red:bt(xo(hr(4.0767416621*ne-3.3077115913*oe+0.2309699292*de))*255)}}function So(_,I){let O=(I*_*180/Math.PI%360+360)%360;return Jp(0.72,0.15,O)}function Vs(_,I=0.1){let O=So(I,_);return`\x1B[38;2;${O.red};${O.green};${O.blue}m`}function Wp(_,I){return{blue:bt(_.blue+(255-_.blue)*I),green:bt(_.green+(255-_.green)*I),red:bt(_.red+(255-_.red)*I)}}function zs(_,I,O){let L=Math.imul(_+2654435769,2246822507)^Math.imul(I+3266489909,668265263)^Math.imul(O+374761393,2654435761),J=L^L>>>15,K=Math.imul(J,739982445),ne=K^K>>>12,oe=Math.imul(ne,695872825);return((oe^oe>>>15)>>>0)/4294967296}function Kp(_,I,O){let L=Math.floor(zs(_,I,O)*Us.length);return Us[L]??"░"}function Gs(_){let I=hr(_);return I*I*I*(I*(I*6-15)+10)}function Yp(_){if(_.length===0)return"";let I=[],O=!1,L="";for(let J of _){let K=`${J.red};${J.green};${J.blue}`;if(J.bold!==O)I.push(J.bold?"\x1B[1m":"\x1B[22m"),O=J.bold;if(K!==L)I.push(`\x1B[38;2;${K}m`),L=K;I.push(J.character)}return`${I.join("")}\x1B[22m\x1B[39m`}function Zp(_,I,O,L,J){return _.map((K,ne)=>({...So(O,L+I+ne/J),bold:!1,character:K}))}function Xp(_,I,O,L,J,K,ne,oe){let de=Math.max(1,L*0.75),ue=Math.min(1,O/de),ve=J*Gs(ue),xe=Math.max(0,(O-de)/Math.max(1,L-de)),Se=(1-Gs(O/L))*oe*2,Pe=0.35*Math.max(0,1-xe*2),we=ue>=1,Le=Math.min(_.length,Math.ceil(ve+2+1));return _.slice(0,Le).map((en,Ve)=>{let on=So(K,ne+I+Ve/oe+Se),sn=Ve+zs(I,Ve,7919)*2-1;if(sn>ve+2)return{...on,bold:!1,character:" "};let an=ve-sn,rn=0.8*Math.exp(-(an*an)/12.5),pn=Math.min(0.9,rn+Pe),xn=!we&&sn>ve-4;return{...Wp(on,pn),bold:pn>0.3,character:xn?Kp(I,Ve,O):en}})}function Bs(_){return`\x1B[?2026h${_.map((I,O)=>`\x1B8${O>0?qs(O):""}${Yp(I)}`).join("")}\x1B[?2026l`}async function Co(_,I={}){if(!_)return;let O=I.output??process.stdout,L=I.sleep??Vp,J=I.seed??0,K=_.split(`
|
|
23
23
|
`).map((ve)=>Array.from(ve)),ne=Math.max(...K.map((ve)=>ve.length)),oe=12000*K.filter((ve)=>ve.length>0).length/40,de=ne>0?Math.max(1,Math.ceil(oe/16.666666666666668)):0,ue=de>0?oe/de:0;O.write(`\x1B[?25l${K.length>1?`${`
|
|
24
24
|
`.repeat(K.length-1)}${qp(K.length-1)}`:""}\x1B7`);try{for(let ve=1;ve<=de;ve+=1){if(I.signal?.aborted)break;O.write(Bs(K.map((xe,Se)=>Xp(xe,Se,ve,de,ne,0.1,J,3)))),await zp(ue,L,I.signal)}}finally{if(O.write(Bs(K.map((ve,xe)=>Zp(ve,xe,0.1,J,3)))),O.write("\x1B8"),K.length>1)O.write(qs(K.length-1));O.write(`
|
|
25
25
|
\x1B[0m\x1B[?25h`)}}var Js=["┏━┛┏━┛ ┏━┛┏━┃┏━┛┏━┛━┏┛┃ ┃ ┏━ ┏━┛━┏┛","┃ ┃ ━━┃┏━┃┏━┛┏━┛ ┃ ━┏┛ ┃ ┃┏━┛ ┃ ","━━┛━━┛ ━━┛┛ ┛┛ ━━┛ ┛ ┛ ┛ ┛━━┛ ┛ "].join(`
|
|
@@ -30,7 +30,7 @@ ${_.findings.length} ${L}: ${O.join(", ")}.`;if(I.error>0)return nn.red(J);if(I.
|
|
|
30
30
|
`,I)+1;return/^[ \t]*/.exec(_.slice(O))?.[0]??""}function Sr(_,I){let O=I.end+(/^\s*/.exec(_.slice(I.end))?.[0].length??0);if(_[O]===","){let ne=_[O+1]===`
|
|
31
31
|
`?O+2:O+1;return`${_.slice(0,I.start)}${_.slice(ne)}`}let L=_.slice(0,I.start).search(/\s*$/)-1;if(_[L]!==",")return`${_.slice(0,I.start)}${_.slice(I.end)}`;let J=_.lastIndexOf(`
|
|
32
32
|
`,L-1),K=J!==-1&&/^\s*$/.test(_.slice(J+1,L))?J:L;return`${_.slice(0,K)}${_.slice(I.end)}`}function Ao(_,I){if(_.startsWith("//",I)){let O=_.indexOf(`
|
|
33
|
-
`,I+2);return O===-1?_.length:O+1}if(_.startsWith("/*",I)){let O=_.indexOf("*/",I+2);return O===-1?_.length:O+2}return I}function pa(_,I){let O=I;while(O<_.length){if(/\s/.test(_[O]??"")){O++;continue}let L=Ao(_,O);if(L===O)return O;O=L}return O}function ga(_,I,O){let L=0,J=0;while(J<_.length){let K=Ao(_,J);if(K!==J){J=K;continue}if(_[J]==='"'){let ne=fa(_,J,O.stringError);if(L===1&&JSON.parse(_.slice(J,ne))===I){let oe=pa(_,ne),de=pa(_,oe+1);if(_[oe]===":"&&_[de]==="[")return{start:de,end:_o(_,de,{skipComment:Ao,...O})}}J=ne;continue}if(_[J]==="{"||_[J]==="[")L++;if(_[J]==="}"||_[J]==="]")L--;J++}return}var _n="cc-safety-net@cc-marketplace",Cr=["cc-marketplace","cc-safety-net"],ha=["_direct","copilot-safety-net"],ya=["cc-marketplace","safety-net"],va="safety-net@cc-marketplace";function Rr(_,I){let O=I.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(^|[^a-z0-9-])${O}([^a-z0-9-]|$)`,"m").test(_??"")}function ba(_){return Rr(_,"cc-safety-net@cc-marketplace")}function wa(_){return Rr(_,"cc-marketplace")}function ka(_){return Rr(_,"copilot-safety-net")}function xa(_){return Rr(_,"safety-net@cc-marketplace")}function Pr(_){if(!_?.includes("cc-safety-net"))return!1;return/(^|\s)hook\s+(?:[^\s]+\s+)*(--copilot-cli|-cp)(\s|$)/.test(_)}function Ca(_,I){if(!_)return null;let O=_.match(/(\d+)\.(\d+)\.(\d+)/);if(!O)return null;let L=[Number(O[1]),Number(O[2]),Number(O[3])];for(let J=0;J<I.length;J++){let K=L[J]??0,ne=I[J]??0;if(K!==ne)return K>ne}return!0}function Mf(_){return Ca(_,[0,0,422])}function Uf(_){return Ca(_,[1,0,8])}function Lt(_){return _.env.get("COPILOT_HOME")||vn(_.home,".copilot")}function Io(_){return(_.hooks?.preToolUse??[]).some((O)=>{if(O.type!==void 0&&O.type!=="command")return!1;return Pr(O.command)||Pr(O.bash)||Pr(O.powershell)||Pr(O.exec&&[O.exec,...O.args??[]].join(" "))})}function Dt(_){return _===void 0||typeof _==="string"}function Gf(_){return _===void 0||Array.isArray(_)&&_.every((I)=>typeof I==="string")}function Bf(_){if(!_||typeof _!=="object"||Array.isArray(_))return!1;let I=_;if(I.disableAllHooks!==void 0&&typeof I.disableAllHooks!=="boolean")return!1;if(I.hooks===void 0)return!0;if(!I.hooks||typeof I.hooks!=="object"||Array.isArray(I.hooks))return!1;let O=I.hooks.preToolUse;if(O===void 0)return!0;return Array.isArray(O)&&O.every((L)=>L!==null&&typeof L==="object"&&!Array.isArray(L)&&Dt(L.type)&&Dt(L.command)&&Dt(L.bash)&&Dt(L.powershell)&&Dt(L.exec)&&Gf(L.args))}function To(_,I){try{let O=JSON.parse(Sn(Hf(_,"utf-8")));if(!Bf(O)){I?.push(`Invalid hook config ${_}: hooks.preToolUse must be an array of hook objects`);return}return O}catch(O){I?.push(`Failed to parse ${_}: ${O instanceof Error?O.message:String(O)}`);return}}function Ra(_,I){try{return Ff(_).filter((O)=>O.endsWith(".json")).sort((O,L)=>O.localeCompare(L))}catch(O){return I?.push(`Failed to read ${_}: ${O instanceof Error?O.message:String(O)}`),[]}}function qf(_,I){if(!Er(_))return[];let O=[];for(let L of Ra(_,I)){let J=vn(_,L),K=To(J,I);if(K&&Io(K))O.push(J)}return O}function wt(_,I){if(!Er(_))return;let O=To(_,I);if(!O)return;return{path:_,config:O}}function Sa(_,I,O,L){if(I){_.push(`GitHub Copilot CLI ${I} does not support ${O}; requires ${L}+`);return}_.push(`GitHub Copilot CLI version unavailable; skipping ${O} because it requires ${L}+`)}function Vf(_){for(let I of _){if(I?.config.disableAllHooks===!0)return I.path;if(I?.config.disableAllHooks===!1)return}return}function zf(_,I,O,L){let J=Lt(_),K=vn(I,".github","hooks"),ne=vn(J,"hooks"),oe=vn(I,".github","copilot"),de=vn(I,".claude"),ue=Uf(O),ve=ue===!0?L:void 0,xe=[wt(vn(oe,"settings.local.json"),ve),wt(vn(oe,"settings.json"),ve),wt(vn(de,"settings.local.json"),ve),wt(vn(de,"settings.json"),ve)],Se=[wt(vn(J,"settings.json"),ve),wt(vn(J,"config.json"),ve)];if(ue!==!1){let an=Vf([...xe,...Se]);if(an){if(ue===null)L.push(`GitHub Copilot CLI version unavailable; treating disableAllHooks in ${an} as active`);return{activeConfigPaths:[],repoInlineSources:xe,disabledBy:an}}}let Pe=qf(K,L),we=Mf(O),Le=we===!0?L:void 0,en=Er(ne)?Ra(ne,Le):[],Ve=[];for(let an of en){let rn=vn(ne,an),
|
|
33
|
+
`,I+2);return O===-1?_.length:O+1}if(_.startsWith("/*",I)){let O=_.indexOf("*/",I+2);return O===-1?_.length:O+2}return I}function pa(_,I){let O=I;while(O<_.length){if(/\s/.test(_[O]??"")){O++;continue}let L=Ao(_,O);if(L===O)return O;O=L}return O}function ga(_,I,O){let L=0,J=0;while(J<_.length){let K=Ao(_,J);if(K!==J){J=K;continue}if(_[J]==='"'){let ne=fa(_,J,O.stringError);if(L===1&&JSON.parse(_.slice(J,ne))===I){let oe=pa(_,ne),de=pa(_,oe+1);if(_[oe]===":"&&_[de]==="[")return{start:de,end:_o(_,de,{skipComment:Ao,...O})}}J=ne;continue}if(_[J]==="{"||_[J]==="[")L++;if(_[J]==="}"||_[J]==="]")L--;J++}return}var _n="cc-safety-net@cc-marketplace",Cr=["cc-marketplace","cc-safety-net"],ha=["_direct","copilot-safety-net"],ya=["cc-marketplace","safety-net"],va="safety-net@cc-marketplace";function Rr(_,I){let O=I.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(^|[^a-z0-9-])${O}([^a-z0-9-]|$)`,"m").test(_??"")}function ba(_){return Rr(_,"cc-safety-net@cc-marketplace")}function wa(_){return Rr(_,"cc-marketplace")}function ka(_){return Rr(_,"copilot-safety-net")}function xa(_){return Rr(_,"safety-net@cc-marketplace")}function Pr(_){if(!_?.includes("cc-safety-net"))return!1;return/(^|\s)hook\s+(?:[^\s]+\s+)*(--copilot-cli|-cp)(\s|$)/.test(_)}function Ca(_,I){if(!_)return null;let O=_.match(/(\d+)\.(\d+)\.(\d+)/);if(!O)return null;let L=[Number(O[1]),Number(O[2]),Number(O[3])];for(let J=0;J<I.length;J++){let K=L[J]??0,ne=I[J]??0;if(K!==ne)return K>ne}return!0}function Mf(_){return Ca(_,[0,0,422])}function Uf(_){return Ca(_,[1,0,8])}function Lt(_){return _.env.get("COPILOT_HOME")||vn(_.home,".copilot")}function Io(_){return(_.hooks?.preToolUse??[]).some((O)=>{if(O.type!==void 0&&O.type!=="command")return!1;return Pr(O.command)||Pr(O.bash)||Pr(O.powershell)||Pr(O.exec&&[O.exec,...O.args??[]].join(" "))})}function Dt(_){return _===void 0||typeof _==="string"}function Gf(_){return _===void 0||Array.isArray(_)&&_.every((I)=>typeof I==="string")}function Bf(_){if(!_||typeof _!=="object"||Array.isArray(_))return!1;let I=_;if(I.disableAllHooks!==void 0&&typeof I.disableAllHooks!=="boolean")return!1;if(I.hooks===void 0)return!0;if(!I.hooks||typeof I.hooks!=="object"||Array.isArray(I.hooks))return!1;let O=I.hooks.preToolUse;if(O===void 0)return!0;return Array.isArray(O)&&O.every((L)=>L!==null&&typeof L==="object"&&!Array.isArray(L)&&Dt(L.type)&&Dt(L.command)&&Dt(L.bash)&&Dt(L.powershell)&&Dt(L.exec)&&Gf(L.args))}function To(_,I){try{let O=JSON.parse(Sn(Hf(_,"utf-8")));if(!Bf(O)){I?.push(`Invalid hook config ${_}: hooks.preToolUse must be an array of hook objects`);return}return O}catch(O){I?.push(`Failed to parse ${_}: ${O instanceof Error?O.message:String(O)}`);return}}function Ra(_,I){try{return Ff(_).filter((O)=>O.endsWith(".json")).sort((O,L)=>O.localeCompare(L))}catch(O){return I?.push(`Failed to read ${_}: ${O instanceof Error?O.message:String(O)}`),[]}}function qf(_,I){if(!Er(_))return[];let O=[];for(let L of Ra(_,I)){let J=vn(_,L),K=To(J,I);if(K&&Io(K))O.push(J)}return O}function wt(_,I){if(!Er(_))return;let O=To(_,I);if(!O)return;return{path:_,config:O}}function Sa(_,I,O,L){if(I){_.push(`GitHub Copilot CLI ${I} does not support ${O}; requires ${L}+`);return}_.push(`GitHub Copilot CLI version unavailable; skipping ${O} because it requires ${L}+`)}function Vf(_){for(let I of _){if(I?.config.disableAllHooks===!0)return I.path;if(I?.config.disableAllHooks===!1)return}return}function zf(_,I,O,L){let J=Lt(_),K=vn(I,".github","hooks"),ne=vn(J,"hooks"),oe=vn(I,".github","copilot"),de=vn(I,".claude"),ue=Uf(O),ve=ue===!0?L:void 0,xe=[wt(vn(oe,"settings.local.json"),ve),wt(vn(oe,"settings.json"),ve),wt(vn(de,"settings.local.json"),ve),wt(vn(de,"settings.json"),ve)],Se=[wt(vn(J,"settings.json"),ve),wt(vn(J,"config.json"),ve)];if(ue!==!1){let an=Vf([...xe,...Se]);if(an){if(ue===null)L.push(`GitHub Copilot CLI version unavailable; treating disableAllHooks in ${an} as active`);return{activeConfigPaths:[],repoInlineSources:xe,disabledBy:an}}}let Pe=qf(K,L),we=Mf(O),Le=we===!0?L:void 0,en=Er(ne)?Ra(ne,Le):[],Ve=[];for(let an of en){let rn=vn(ne,an),pn=To(rn,Le);if(pn&&Io(pn))Ve.push(rn)}if(we!==!0&&Ve.length>0)Sa(L,O,`user hook files in ${ne}`,"0.0.422"),Ve.length=0;let on=[];for(let an of[...xe,...Se]){if(!an)continue;if(!Io(an.config))continue;if(ue===!0){on.push(an);continue}Sa(L,O,"inline hook definitions in Copilot config files","1.0.8");break}let sn=(an)=>an.filter((rn)=>!!rn&&on.includes(rn)).map((rn)=>rn.path);return{activeConfigPaths:[...sn(xe),...Pe,...sn(Se),...Ve],repoInlineSources:xe}}function Pa(_){let I=[],O=zf(_.environment,_.cwd,_.copilotCliVersion,I);if(O.disabledBy)return{platform:"copilot-cli",status:"disabled",method:"hook config",configPath:O.disabledBy,configPaths:[O.disabledBy],errors:I.length>0?I:void 0};let L=Lt(_.environment),J=vn(L,"installed-plugins",...Cr),K=Er(J),ne=vn(L,"settings.json"),oe=Rn(ne,Sn),de=(Pe)=>tn(tn(Pe,"enabledPlugins"),_n),ue=O.repoInlineSources.find((Pe)=>typeof de(Pe?.config)==="boolean"),ve=ue??(oe.kind==="ok"?{path:ne,config:oe.value}:void 0);if(K&&!ue&&oe.kind==="unreadable")return{platform:"copilot-cli",status:"not-inspected"};let xe=K&&ve!==void 0&&de(ve.config)===!1;if(xe&&O.activeConfigPaths.length===0)return{platform:"copilot-cli",status:"disabled",method:"plugin config",configPath:ve.path,errors:[`${_n} is installed but not enabled in Copilot CLI`]};let Se=K&&!xe;if(Se||O.activeConfigPaths.length>0){let Pe=O.activeConfigPaths[0];return{platform:"copilot-cli",status:"configured",method:Se?"plugin config":"hook config",configPath:Pe??(Se?J:void 0),configPaths:O.activeConfigPaths.length>0?O.activeConfigPaths:void 0,errors:I.length>0?I:void 0}}return{platform:"copilot-cli",status:"n/a",errors:I.length>0?I:void 0}}import{existsSync as tm,readFileSync as rm}from"node:fs";import{existsSync as Ea,mkdirSync as Kf,readFileSync as Yf}from"node:fs";import{dirname as Zf,join as Xf}from"node:path";import{renameSync as Jf,writeFileSync as Wf}from"node:fs";function mn(_,I){let O=`${_}.${process.pid}.tmp`;Wf(O,I),Jf(O,_)}var In=Object.fromEntries(It.map((_)=>[_.id,`npx -y cc-safety-net hook ${_.flags[1]}`]));var Nt=In.cursor,Aa=30;function _r(_){return Xf(_.home,".cursor","hooks.json")}function Kn(_){return typeof _==="object"&&_!==null&&!Array.isArray(_)}function $o(){return{command:Nt,timeout:Aa,failClosed:!0}}function Ar(_){return Kn(_)&&_.command===Nt}function Qf(_){return Object.keys(_).length===3&&_.command===Nt&&_.timeout===Aa&&_.failClosed===!0}function em(_){try{return JSON.parse(Yf(_,"utf-8"))}catch(I){if(I instanceof SyntaxError)throw Error(`Failed to parse Cursor hooks config ${_}: ${I.message}`);throw I}}function _a(_){let I=em(_);if(!Kn(I))throw Error(`Cursor hooks config ${_} must be a JSON object`);if(I.version!==1)throw Error(`Cursor hooks config ${_} must set "version": 1`);if(I.hooks!==void 0&&!Kn(I.hooks))throw Error(`Cursor hooks config ${_} "hooks" must be an object`);let O=Kn(I.hooks)?I.hooks.preToolUse:void 0;if(O!==void 0&&!Array.isArray(O))throw Error(`Cursor hooks config ${_} "hooks.preToolUse" must be an array`);return I}function Ia(_){let I=Kn(_.hooks)?_.hooks.preToolUse:void 0;return Array.isArray(I)?I:[]}function nm(_){if(!_.some(Ar))return[..._,$o()];return _.reduce((I,O)=>{if(!Ar(O))return I.result.push(O),I;if(!I.inserted)I.result.push($o()),I.inserted=!0;return I},{result:[],inserted:!1}).result}function Ta(_,I,O){let L=Kn(I.hooks)?I.hooks:{},J={...I,hooks:{...L,preToolUse:O}};mn(_,`${JSON.stringify(J,null,2)}
|
|
34
34
|
`)}function $a(_){let I=_r(_);if(!Ea(I))return Kf(Zf(I),{recursive:!0}),mn(I,`${JSON.stringify({version:1,hooks:{preToolUse:[$o()]}},null,2)}
|
|
35
35
|
`),{path:I,alreadyInstalled:!1};let O=_a(I),L=Ia(O),J=L.filter(Ar);if(Kn(O.hooks)&&Array.isArray(O.hooks.preToolUse)&&J.length===1&&J[0]!==void 0&&Qf(J[0]))return{path:I,alreadyInstalled:!0};return Ta(I,O,nm(L)),{path:I,alreadyInstalled:!1}}function Oa(_){let I=_r(_);if(!Ea(I))return{path:I,alreadyInstalled:!1};let O=_a(I),L=Ia(O),J=L.filter((K)=>!Ar(K));if(J.length===L.length)return{path:I,alreadyInstalled:!1};return Ta(I,O,J),{path:I,alreadyInstalled:!0}}function om(_){if(!_||typeof _!=="object"||Array.isArray(_))return[];let I=_.hooks;if(!I||typeof I!=="object"||Array.isArray(I))return[];let O=I.preToolUse;if(!Array.isArray(O))return[];return O.filter((L)=>!!L&&typeof L==="object"&&!Array.isArray(L)&&L.command===Nt)}function im(_){let I=[];if(_.length>1)I.push("Multiple managed cc-safety-net hooks found; reinstall to collapse duplicates");let O=_[0];if(O&&O.failClosed!==!0)I.push('Managed hook is missing "failClosed": true; reinstall to repair');if(O&&O.timeout!==30)I.push('Managed hook "timeout" is not 30; reinstall to repair');return I}function Da(_){let I=_r(_.environment);if(!tm(I))return{platform:"cursor",status:"n/a",configPath:I};let O;try{O=JSON.parse(rm(I,"utf-8"))}catch(K){return{platform:"cursor",status:"n/a",configPath:I,errors:[`Failed to parse Cursor hooks config ${I}: ${K instanceof Error?K.message:String(K)}`]}}let L=om(O);if(L.length===0)return{platform:"cursor",status:"n/a",configPath:I};let J=im(L);return{platform:"cursor",status:"configured",method:"hook config",configPath:I,errors:J.length>0?J:void 0}}import{readdirSync as sm}from"node:fs";import{join as Oo,resolve as am}from"node:path";var Do="cc-safety-net";function Lo(_){let I=_.env.get("DSH_HOME");return Oo(I?.trim()?am(Ln(I,_.home)):Oo(_.home,".dsh"),"profiles")}function La(_){let I=Lo(_),O=cn(I)?.isDirectory()?sm(I,{withFileTypes:!0}).filter((J)=>J.isDirectory()&&J.name!=="node_modules").map((J)=>{let K=Oo(I,J.name,"package.json");return{name:J.name,configPath:K,manifest:Rn(K)}}):[];return{installed:O.flatMap((J)=>{if(J.manifest.kind!=="ok")return[];let K=J.manifest.value;if(tn(tn(K,"dependencies"),Do)===void 0)return[];let ne=tn(tn(tn(K,"dsh"),"profile"),"bundles");return[{name:J.name,configPath:J.configPath,enabled:Array.isArray(ne)&&ne.includes(Do)}]}),unreadable:O.some((J)=>J.manifest.kind==="unreadable")}}function No(_){return La(_).installed}function Na(_){let I=La(_.environment),O=I.installed.filter((K)=>K.enabled),L=I.installed.filter((K)=>!K.enabled),J=L.map((K)=>`${Do} is installed in the ${K.name} profile but its bundle is disabled`);if(O.length>0)return{platform:"deepseek-harness",status:"configured",method:"dsh bundle",configPaths:O.map((K)=>K.configPath),...J.length>0?{errors:J}:{}};if(L.length>0)return{platform:"deepseek-harness",status:"disabled",method:"dsh bundle",configPaths:L.map((K)=>K.configPath),errors:J};return I.unreadable?{platform:"deepseek-harness",status:"not-inspected"}:{platform:"deepseek-harness",status:"n/a"}}import{existsSync as lm}from"node:fs";import{join as jo}from"node:path";var Fo="gemini-safety-net";function Ho(_){let I=jo(_.home,".gemini","extensions"),O=jo(I,Fo);if(!lm(O))return{platform:"gemini-cli",status:"n/a"};let L=jo(I,"extension-enablement.json"),J=Rn(L);if(J.kind==="unreadable")return{platform:"gemini-cli",status:"not-inspected"};let K=J.kind==="ok"?tn(tn(J.value,Fo),"overrides"):void 0;if(Array.isArray(K)&&K.some((oe)=>typeof oe==="string"&&oe.startsWith("!")))return{platform:"gemini-cli",status:"disabled",method:"extension config",configPath:L,errors:[`${Fo} is disabled in Gemini CLI`]};return{platform:"gemini-cli",status:"configured",method:"extension config",configPath:O}}function ja(_){return Ho(_.environment)}import{existsSync as pm,readFileSync as fm}from"node:fs";import{existsSync as Ha,mkdirSync as cm,readFileSync as Ma,rmSync as dm}from"node:fs";import{dirname as um,join as Fa}from"node:path";var jt=In["grok-build"],$r=30;function Or(_){return Fa(_.env.get("GROK_HOME")??Fa(_.home,".grok"),"hooks","cc-safety-net.json")}function Yn(_){return typeof _==="object"&&_!==null&&!Array.isArray(_)}function Ir(){return{hooks:[{type:"command",command:jt,timeout:$r}]}}function Ua(_){return Yn(_)&&_.command===jt}function Ga(_){return _.flatMap((I)=>{if(!Yn(I)||!Array.isArray(I.hooks))return[I];let O=I.hooks.filter((L)=>!Ua(L));if(O.length===I.hooks.length)return[I];return O.length===0?[]:[{...I,hooks:O}]})}function Ba(_){try{let I=JSON.parse(_);return Yn(I)?I:null}catch{return null}}function qa(_){let I=Yn(_.hooks)?_.hooks.PreToolUse:void 0;return Array.isArray(I)?I:[]}function Tr(_,I,O){let L=Yn(I.hooks)?I.hooks:{};mn(_,`${JSON.stringify({...I,hooks:{...L,PreToolUse:O}},null,2)}
|
|
36
36
|
`)}function Va(_){let I=Or(_);if(!Ha(I))return cm(um(I),{recursive:!0}),Tr(I,{},[Ir()]),{path:I,alreadyInstalled:!1};let O=Ba(Ma(I,"utf-8"));if(!O)return Tr(I,{},[Ir()]),{path:I,alreadyInstalled:!1};let L=qa(O),J=L.filter((K)=>Yn(K)&&Array.isArray(K.hooks)&&K.hooks.some(Ua));if(J.length===1&&JSON.stringify(J[0])===JSON.stringify(Ir()))return{path:I,alreadyInstalled:!0};return Tr(I,O,[...Ga(L),Ir()]),{path:I,alreadyInstalled:!1}}function za(_){let I=Or(_);if(!Ha(I))return{path:I,alreadyInstalled:!1};let O=Ba(Ma(I,"utf-8"));if(!O)return{path:I,alreadyInstalled:!1};let L=qa(O),J=Ga(L);if(JSON.stringify(J)===JSON.stringify(L))return{path:I,alreadyInstalled:!1};let K=Yn(O.hooks)?O.hooks:{};if(J.length===0&&Object.keys(O).length===1&&Object.keys(K).length===1)return dm(I),{path:I,alreadyInstalled:!0};return Tr(I,O,J),{path:I,alreadyInstalled:!0}}function Ft(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}function mm(_){if(!Ft(_)||!Ft(_.hooks))return[];let I=_.hooks.PreToolUse;if(!Array.isArray(I))return[];return I.filter((O)=>Ft(O)&&Array.isArray(O.hooks)&&O.hooks.some((L)=>Ft(L)&&L.command===jt))}function gm(_){let O=(Array.isArray(_.hooks)?_.hooks.filter(Ft):[]).find((L)=>L.command===jt);return[..._.matcher===void 0||_.matcher===""||_.matcher==="*"?[]:['Managed hook has a "matcher" that narrows coverage; reinstall to repair'],...O?.type==="command"?[]:['Managed hook "type" is not "command"; reinstall to repair'],...O?.timeout===$r?[]:[`Managed hook "timeout" is not ${$r}; reinstall to repair`]]}function Ja(_){let I=Or(_.environment);if(!pm(I))return{platform:"grok-build",status:"n/a",configPath:I};let O;try{O=JSON.parse(fm(I,"utf-8"))}catch(K){return{platform:"grok-build",status:"n/a",configPath:I,errors:[`Failed to parse Grok Build hooks config ${I}: ${K instanceof Error?K.message:String(K)}`]}}let L=mm(O)[0];if(!L)return{platform:"grok-build",status:"n/a",configPath:I};let J=gm(L);return{platform:"grok-build",status:"configured",method:"hook config",configPath:I,errors:J.length>0?J:void 0}}import{readFileSync as tl}from"node:fs";import{join as rl}from"node:path";var Pn="cc-safety-net",Mo="# cc-safety-net managed Hermes Agent plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --hermes-agent",hm=30;function Wa(_){return`${Mo}
|
|
@@ -211,20 +211,20 @@ def _pre_tool_call(tool_name="", args=None, session_id="", task_id="", **_):
|
|
|
211
211
|
|
|
212
212
|
def register(ctx):
|
|
213
213
|
ctx.register_hook("pre_tool_call", _pre_tool_call)
|
|
214
|
-
`}function Ht(_){return[{name:"__init__.py",content:vm(_)},{name:"plugin.yaml",content:ym(_)}]}import{mkdirSync as bm,readdirSync as wm,readFileSync as Ka,rmSync as Uo}from"node:fs";import{basename as km,dirname as xm,join as Nn}from"node:path";var Sm="__pycache__",Cm=/^[a-z0-9][a-z0-9_-]{0,63}$/;function Rm(_){try{return Ka(_,"utf-8").trim()}catch{return}}function Go(_){let I=_.env.get("HERMES_HOME")?.trim();if(I&&km(xm(I))==="profiles")return I;let O=I||Nn(_.home,".hermes"),L=Nn(O,"active_profile"),J=Rm(L),K=J?.toLowerCase();if(!K||K==="default")return O;if(!Cm.test(K))throw Error(`Invalid Hermes profile name "${J}" in ${L}; run \`hermes profile use <name>\` with a valid profile.`);return Nn(O,"profiles",K)}function Bo(_){return Nn(Go(_),"plugins",Pn)}function qo(_){return _.startsWith(Mo)}function Vo(_,I){let O=Bo(_),L=cn(O);if(L&&(L.isSymbolicLink()||!L.isDirectory()))throw Error(`Refusing to ${I} ${O}: not a regular directory. Move or remove it and rerun ${I==="install"?"install":"uninstall"} --hermes-agent.`);return O}function Ya(_,I){let O=cn(_);if(!O)return;if(O.isSymbolicLink()||!O.isFile())throw Error(`Refusing to ${I} ${_}: not a regular file. Move or remove it.`);let L=Ka(_,"utf-8");if(!qo(L))throw Error(`Refusing to ${I} unmanaged file at ${_}. Move or remove it.`);return L}function Za(_){let I=Vo(_,"install"),O=Ht(
|
|
214
|
+
`}function Ht(_){return[{name:"__init__.py",content:vm(_)},{name:"plugin.yaml",content:ym(_)}]}import{mkdirSync as bm,readdirSync as wm,readFileSync as Ka,rmSync as Uo}from"node:fs";import{basename as km,dirname as xm,join as Nn}from"node:path";var Sm="__pycache__",Cm=/^[a-z0-9][a-z0-9_-]{0,63}$/;function Rm(_){try{return Ka(_,"utf-8").trim()}catch{return}}function Go(_){let I=_.env.get("HERMES_HOME")?.trim();if(I&&km(xm(I))==="profiles")return I;let O=I||Nn(_.home,".hermes"),L=Nn(O,"active_profile"),J=Rm(L),K=J?.toLowerCase();if(!K||K==="default")return O;if(!Cm.test(K))throw Error(`Invalid Hermes profile name "${J}" in ${L}; run \`hermes profile use <name>\` with a valid profile.`);return Nn(O,"profiles",K)}function Bo(_){return Nn(Go(_),"plugins",Pn)}function qo(_){return _.startsWith(Mo)}function Vo(_,I){let O=Bo(_),L=cn(O);if(L&&(L.isSymbolicLink()||!L.isDirectory()))throw Error(`Refusing to ${I} ${O}: not a regular directory. Move or remove it and rerun ${I==="install"?"install":"uninstall"} --hermes-agent.`);return O}function Ya(_,I){let O=cn(_);if(!O)return;if(O.isSymbolicLink()||!O.isFile())throw Error(`Refusing to ${I} ${_}: not a regular file. Move or remove it.`);let L=Ka(_,"utf-8");if(!qo(L))throw Error(`Refusing to ${I} unmanaged file at ${_}. Move or remove it.`);return L}function Za(_){let I=Vo(_,"install"),O=Ht(un());if(O.map((J)=>Ya(Nn(I,J.name),"overwrite")).every((J,K)=>J===O[K]?.content))return{path:I,alreadyInstalled:!0};return bm(I,{recursive:!0}),O.forEach((J)=>{mn(Nn(I,J.name),J.content)}),{path:I,alreadyInstalled:!1}}function zo(_){let I=Vo(_,"remove");if(!cn(I))return[];return Ht(un()).filter((O)=>Ya(Nn(I,O.name),"remove")!==void 0)}function Xa(_){let I=Vo(_,"remove");if(!cn(I))return{path:I,alreadyInstalled:!1};let O=zo(_);if(O.forEach((L)=>{Uo(Nn(I,L.name))}),Uo(Nn(I,Sm),{recursive:!0,force:!0}),wm(I).length===0)Uo(I,{recursive:!0});return{path:I,alreadyInstalled:O.length>0}}var Mt="hermes-agent",Qa=/^([^\s#][^:]*):/,Pm=/^\s+([A-Za-z_][\w-]*):/,el=/^\s+-\s*(.*)$/;function Em(_){return _.trim().replace(/^(["'])(.*)\1$/,"$2")}function Am(_){let I=_.split(/\r?\n/),O=I.findIndex((K)=>Qa.exec(K)?.[1]?.trim()==="plugins");if(O===-1)return[];let L=I.slice(O+1),J=L.findIndex((K)=>Qa.test(K));return J===-1?L:L.slice(0,J)}function nl(_,I){let O=Am(_),L=O.findIndex((ne)=>Pm.exec(ne)?.[1]===I);if(L===-1)return[];let J=O.slice(L+1),K=J.findIndex((ne)=>!el.test(ne));return(K===-1?J:J.slice(0,K)).map((ne)=>Em(el.exec(ne)?.[1]??""))}function _m(_){try{return tl(rl(Go(_),"config.yaml"),"utf-8")}catch{return}}function Jo(_){let I=_m(_)??"";return nl(I,"enabled").includes(Pn)&&!nl(I,"disabled").includes(Pn)}function ol(_){return/^# version:\s*(.+)$/m.exec(_)?.[1]?.trim()}function Im(_,I){let O=cn(_);if(!O)return{error:`${I.name} is missing from ${_}; run install --hermes-agent`};if(O.isSymbolicLink()||!O.isFile())return{error:`${_} is a symlink or not a regular file; move or remove it`};try{let L=tl(_,"utf-8");if(!qo(L))return{error:`Unmanaged ${I.name} occupies ${_}; move or remove it`};if(ol(L)===un()&&L!==I.content)return{error:`Modified ${I.name} occupies ${_}; run install --hermes-agent to restore it`};return{content:L}}catch(L){return{error:`Failed to read ${_}: ${L instanceof Error?L.message:String(L)}`}}}function Tm(_){try{return{path:Bo(_)}}catch(I){return{error:I instanceof Error?I.message:String(I)}}}function il(_){let I=Tm(_.environment);if("error"in I)return{platform:Mt,status:"n/a",errors:[I.error]};let O=I.path,L=wr(Mt,O);if(L)return L;let J=Ht(un()).map((de)=>Im(rl(O,de.name),de)),K=J.flatMap((de)=>("error"in de)?[de.error]:[]);if(K.length>0)return{platform:Mt,status:"n/a",configPath:O,errors:K};let ne=J.some((de)=>("content"in de)&&ol(de.content)!==un()),oe=ne?["Installed Hermes Agent plugin is outdated; run install --hermes-agent to update"]:[];if(!Jo(_.environment))return{platform:Mt,status:"disabled",method:"plugin directory",configPath:O,errors:[`${Pn} is not enabled in Hermes; run \`hermes plugins enable ${Pn}\``,...oe]};return{platform:Mt,status:"configured",method:"plugin directory",configPath:O,errors:ne?oe:void 0}}import{existsSync as $m,readFileSync as Om}from"node:fs";import{join as sl}from"node:path";var Dm=/cc-safety-net\s+hook\s+(?:[^\s]+\s+)*--kimi-code(\s|["']|$)/;function Lm(_){return sl(_.env.get("KIMI_CODE_HOME")||sl(_.home,".kimi-code"),"config.toml")}function Ut(_){let I=Lm(_.environment);if(!$m(I))return{platform:"kimi-code",status:"n/a",configPath:I};try{if(!Dm.test(Om(I,"utf-8")))return{platform:"kimi-code",status:"n/a",configPath:I}}catch(O){return{platform:"kimi-code",status:"n/a",configPath:I,errors:[`Failed to read ${I}: ${O instanceof Error?O.message:String(O)}`]}}return{platform:"kimi-code",status:"configured",method:"hook config",configPath:I}}import{readFileSync as hl}from"node:fs";import{join as Bt}from"node:path";var dn="cc-safety-net",Cn="index.js",kt="openclaw.plugin.json",xt="package.json";var Dr="// cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw";import{existsSync as Fm,lstatSync as Hm,readdirSync as Mm,readFileSync as Um}from"node:fs";import{dirname as ll,join as Gn}from"node:path";import{fileURLToPath as Gm}from"node:url";import{spawn as Nm}from"node:child_process";function jm(_){return _.join(" ")}function Wo(_,I,O){return[`Failed to run ${jm(_)}${I===null?"":` (exit ${I})`}.`,O.trim()].filter(Boolean).join(`
|
|
215
215
|
`)}function Ko(_){let I={stdout:"",stderr:""};return _.stdout.setEncoding("utf-8"),_.stderr.setEncoding("utf-8"),_.stdout.on("data",(O)=>{I.stdout+=O}),_.stderr.on("data",(O)=>{I.stderr+=O}),I}function yn(_,I){return new Promise((O,L)=>{let J=Wn([..._],process.env),K=Nm(J.cmd,J.args,{stdio:["ignore","pipe","pipe"]}),ne=Ko(K),oe=()=>[ne.stdout,ne.stderr].filter(Boolean).join(`
|
|
216
216
|
`),de=I?.timeoutMs??120000,ue=setTimeout(()=>{K.kill(),L(Error(Wo(_,null,`Timed out after ${de}ms.
|
|
217
217
|
${oe()}`.trim())))},de);K.on("error",(ve)=>{clearTimeout(ue),L(Error(Wo(_,null,`${ve.message}
|
|
218
|
-
${oe()}`.trim())))}),K.on("close",(ve)=>{if(clearTimeout(ue),ve!==0){L(Error(Wo(_,ve,oe())));return}O(I?.stdoutOnly?ne.stdout:oe())})})}async function Yo(_){for(let I of _)await yn(I)}async function al(_){for(let I of _)try{await yn(I)}catch(O){console.warn(O instanceof Error?O.message:String(O))}}var Zo=
|
|
218
|
+
${oe()}`.trim())))}),K.on("close",(ve)=>{if(clearTimeout(ue),ve!==0){L(Error(Wo(_,ve,oe())));return}O(I?.stdoutOnly?ne.stdout:oe())})})}async function Yo(_){for(let I of _)await yn(I)}async function al(_){for(let I of _)try{await yn(I)}catch(O){console.warn(O instanceof Error?O.message:String(O))}}var Zo=Gn("openclaw",dn),Zn=`run \`openclaw plugins enable ${dn}\``,Bm="config reload superseded by a newer runtime config source",qm=[Cn,kt,xt];function cl(_){let I=_.env.get("OPENCLAW_HOME")?.trim();return I?Ln(I,_.home):_.home}function dl(_){let I=cl(_),O=_.env.get("OPENCLAW_STATE_DIR")?.trim();if(O)return Ln(O,I);let L=_.env.get("OPENCLAW_CONFIG_PATH")?.trim();return L?ll(Ln(L,I)):Gn(I,".openclaw")}function ul(_){let I=_.env.get("OPENCLAW_CONFIG_PATH")?.trim();return I?Ln(I,cl(_)):Gn(dl(_),"openclaw.json")}function Gt(_){return Gn(dl(_),"extensions",dn)}function Vm(_){let I=Mm(_);if(I.length===0)return!0;if(I.some((J)=>!qm.includes(J)))return!1;let O=Gn(_,Cn),L=cn(O);return L!==void 0&&!L.isSymbolicLink()&&L.isFile()&&Um(O,"utf-8").startsWith(Dr)}function Xo(_){let I=Gt(_),O=cn(I);if(!O)return;if(!O.isSymbolicLink()&&O.isDirectory()&&Vm(I))return;throw Error(`Refusing to modify ${I}: it does not hold a cc-safety-net managed OpenClaw plugin. Move or remove it, then run the command again.`)}function pl(){let _=ll(Gm(import.meta.url));return[Gn(_,Zo),Gn(_,"..",Zo),Gn(_,"..","..","..","dist",Zo)]}function Qo(_=pl()){return _.find((I)=>Fm(I)&&Hm(I).isDirectory())}function zm(_=pl()){let I=Qo(_);if(!I)throw Error("Packaged OpenClaw plugin directory not found. Reinstall cc-safety-net and try again.");return I}function fl(_=zm()){return[["openclaw","plugins","install",_,"--force","--accept-capabilities"]]}function Jm(_){let I=(()=>{try{return JSON.parse(_)}catch{return}})(),O=tn(tn(I,"plugin"),"status");return typeof O==="string"?O:void 0}async function Wm(){await yn(["openclaw","plugins","enable",dn]).catch((_)=>{if(!(_ instanceof Error&&_.message.includes(Bm)))throw _})}async function ml(_){let I=async()=>Jm(await yn(["openclaw","plugins","inspect",dn,"--runtime","--json"],{stdoutOnly:!0})),O=await I(),L=O==="disabled"&&_;if(L)await Wm();let J=L?await I():O;if(J==="loaded")return;throw Error(`${J===void 0?`The ${dn} plugin's load state could not be verified: OpenClaw's runtime inspect report was unreadable.`:J==="disabled"?`OpenClaw reports the ${dn} plugin with status "disabled"; ${Zn}.`:`OpenClaw reports the ${dn} plugin with status "${J}".`} Run \`openclaw plugins inspect ${dn} --runtime\` for details.`)}var Lr="openclaw";function St(_,I){let O=Bt(_,I),L=cn(O);if(!L)return{error:`${I} is missing from ${O}; run install --openclaw`};if(L.isSymbolicLink()||!L.isFile())return{error:`${O} is a symlink or not a regular file; move or remove it`};try{return{content:hl(O,"utf-8")}}catch(J){return{error:`Failed to read ${O}: ${J instanceof Error?J.message:String(J)}`}}}function yl(_){try{return JSON.parse(Sn(_))}catch{return}}function Km(_){let I=St(_,kt);if("error"in I)return I.error;if(tn(yl(I.content),"id")===dn)return;return`${Bt(_,kt)} is not a valid ${dn} manifest; run install --openclaw`}function Ym(_){let I=St(_,xt);if("error"in I)return I.error;let O=tn(tn(yl(I.content),"openclaw"),"extensions");if(Array.isArray(O)&&O.includes(`./${Cn}`))return;return`${Bt(_,xt)} does not point OpenClaw at ${Cn}; run install --openclaw`}function gl(_){return Array.isArray(_)?_.filter((I)=>typeof I==="string"):[]}function Zm(_){let I=ul(_);if(!cn(I))return`${dn} is not enabled; ${Zn}`;let O=(()=>{try{return JSON.parse(Sn(hl(I,"utf-8")))}catch{return}})();if(O===void 0)return`Failed to read ${I}; fix it, then ${Zn}`;let L=tn(O,"plugins");if(tn(L,"enabled")===!1)return`plugins.enabled is false in ${I}; no OpenClaw plugin loads`;let J=tn(tn(tn(L,"entries"),dn),"enabled");if(gl(tn(L,"deny")).includes(dn)||J===!1)return`${dn} is disabled in ${I}; ${Zn}`;let K=gl(tn(L,"allow"));if(K.length>0&&!K.includes(dn))return`plugins.allow in ${I} does not list ${dn}; add it, then ${Zn}`;if(K.includes(dn)||J===!0)return;return`${dn} is not enabled; ${Zn}`}function vl(_){return/^\/\/ version:\s*(.+)$/m.exec(_)?.[1]?.trim()}function Xm(_,I,O){if(O===void 0)return[];let L=St(O,Cn);if(!(("content"in L)&&vl(L.content)===I))return[];return[Cn,kt,xt].flatMap((K)=>{let ne=St(_,K),oe=St(O,K);if("error"in ne||"error"in oe||ne.content===oe.content)return[];return[`Modified ${K} occupies ${Bt(_,K)}; run install --openclaw to restore it`]})}function bl(_){let I=Gt(_.environment),O=wr(Lr,I);if(O)return O;let L=St(I,Cn),K=["error"in L?L.error:L.content.startsWith(Dr)?void 0:`Unmanaged ${Cn} occupies ${Bt(I,Cn)}; move or remove it`,Km(I),Ym(I)].filter((ve)=>ve!==void 0),ne="content"in L?vl(L.content):void 0,oe=K.length>0?K:Xm(I,ne,Qo());if(oe.length>0)return{platform:Lr,status:"n/a",configPath:I,errors:oe};let de=ne===un()?[]:["Installed OpenClaw plugin is outdated; run install --openclaw to update"],ue=Zm(_.environment);if(ue)return{platform:Lr,status:"disabled",method:"plugin directory",configPath:I,errors:[ue,...de]};return{platform:Lr,status:"configured",method:"plugin directory",configPath:I,errors:de.length>0?de:void 0}}import{existsSync as ag,readFileSync as lg}from"node:fs";import{basename as cg}from"node:path";import{existsSync as Nr,readFileSync as ei,rmSync as Qm}from"node:fs";import{join as Tn}from"node:path";import{pathToFileURL as eg}from"node:url";var qt="cc-safety-net",Xn=`${qt}@latest`,ni=["opencode.json","opencode.jsonc"],ng=60,tg=250,wl="CCSafetyNetPlugin",rg={stringError:"Unterminated string in OpenCode config",bracketError:"Unmatched plugin array in OpenCode config"};function kl(_){return Tn(_.env.get("XDG_CONFIG_HOME")||Tn(_.home,".config"),"opencode")}function ti(_){return _.env.get("OPENCODE_CONFIG_DIR")||kl(_)}function ri(_){return ni.map((I)=>Tn(ti(_),I))}function oi(_){return[...new Set([ti(_),kl(_)])].flatMap((I)=>ni.map((O)=>Tn(I,O)))}function xl(_){return Tn(_.env.get("XDG_CACHE_HOME")||Tn(_.home,".cache"),"opencode","packages",Xn)}function Sl(_){Qm(xl(_),{recursive:!0,force:!0})}async function Cl(_){let I=(await yn(["opencode","--version"],{stdoutOnly:!0})).trim(),O=/^(?:opencode\s+)?v?(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(I),L=Number(O?.[1]),J=Number(O?.[2]),K=Number(O?.[3]);if(!O||L!==1&&L!==2||L===1&&(J<18||J===18&&K<29)||L===2&&J===0&&K<6)throw Error(`OpenCode 1.18.29+ or 2.0.6+ is required; found ${I||"an unknown version"}.`);if(L===2){for(let ne of ri(_)){if(!Nr(ne))continue;let oe=si(ei(ne,"utf-8"),ne);if(["plugin","plugins"].some((ue)=>{let ve=tn(oe,ue);return Array.isArray(ve)&&ve.some((xe)=>jr(xe)&&(typeof xe==="string"?xe:tn(xe,"package"))!==Xn)}))throw Error(`Change the cc-safety-net package spec in ${ne} to ${Xn}, preserving its options, then retry. Adding another spec would create a duplicate plugin ID.`)}return{commands:[],afterInstall:async()=>{if((await yn(["opencode","plugin","add",Xn],{stdoutOnly:!0})).includes("is already configured in"))await yn(["opencode","plugin","update",Xn]);let oe=await El();if(!/^cc-safety-net\s+\S+\s+cc-safety-net@latest\s*$/m.test(oe))throw Error("OpenCode did not load cc-safety-net from cc-safety-net@latest. Run `opencode plugin list` for details.");let de=["--param",`location[directory]=${process.cwd()}`];await yn(["opencode","api","integration.list",...de]);let ue=await yn(["opencode","api","plugin.list",...de],{stdoutOnly:!0}),ve=ii(ue);if(ve)throw Error(ve);if(!Rl(ue).some(Pl))throw Error("OpenCode lists no active cc-safety-net for this directory. Run `opencode api plugin.list` for details.")}}}return Sl(_),{commands:[["opencode","plugin","-g","-f",Xn]],afterInstall:()=>ig(_)}}function Rl(_){return og(_).filter((I)=>tn(I,"id")===qt||jr(tn(tn(I,"source"),"target"))).map((I)=>tn(I,"state"))}function Pl(_){return tn(_,"status")==="active"}function ii(_){let I=Rl(_);if(I.some(Pl))return;let O=I.find((L)=>tn(L,"status")==="failed");if(!O)return;return`OpenCode reports cc-safety-net failed: ${String(tn(O,"error")).split(`
|
|
219
219
|
`)[0]}`}function og(_){if(!_)return[];try{let I=tn(JSON.parse(_),"data");return Array.isArray(I)?I:[]}catch{return[]}}async function El(_=1){let I=await yn(["opencode","plugin","list"],{stdoutOnly:!0});if(/^cc-safety-net\s|\scc-safety-net@latest\s*$/m.test(I)||_===ng)return I;return await new Promise((O)=>setTimeout(O,tg)),El(_+1)}async function ig(_){let I=Tn(xl(_),"node_modules",qt),O=Tn(I,"package.json");if(!Nr(O))throw Error(`The OpenCode plugin cache at ${I} is missing its package, so OpenCode would load nothing and fail open. Run \`opencode plugin -g -f ${Xn}\` for details.`);let L=tn(JSON.parse(ei(O,"utf-8")),"main");if(typeof L!=="string")throw Error(`The cached OpenCode plugin at ${I} declares no "main" entry.`);let J=Tn(I,L);if(typeof(await import(eg(J).href))[wl]==="function")return;throw Error(`The cached OpenCode plugin at ${J} does not export a callable ${wl}, so OpenCode would load nothing and fail open.`)}function si(_,I){try{return JSON.parse(Sn(_))}catch(O){if(O instanceof SyntaxError)throw Error(`Failed to parse OpenCode config ${I}: ${O.message}`);throw O}}function jr(_){let I=typeof _==="string"?_:tn(_,"package");return typeof I==="string"&&(I===qt||I.startsWith(`${qt}@`))}function ai(_){return["plugin","plugins"].some((I)=>{let O=tn(_,I);return Array.isArray(O)&&O.some(jr)})}function sg(_,I){let L=["plugin","plugins"].flatMap((J)=>{let K=ga(_,J,rg);if(!K)return[];let ne=[],oe=0,de=K.start+1,ue=_.slice(K.start+1,K.end).matchAll(/\/\/[^\n]*|\/\*[\s\S]*?\*\/|"(?:\\.|[^"\\])*"|[^"\s{}[\],/]+|[{}[\],]/g);for(let ve of ue){if(ve[0].startsWith("//")||ve[0].startsWith("/*"))continue;let xe=K.start+1+ve.index;if(oe===0)de=xe;if(ve[0]==="{"||ve[0]==="[")oe++;if(ve[0]==="}"||ve[0]==="]")oe--;if(oe!==0||ve[0]===",")continue;let Se=xe+ve[0].length;if(jr(JSON.parse(Sn(_.slice(de,Se)))))ne.push({start:de,end:Se})}return ne}).sort((J,K)=>J.start-K.start).reverse().reduce((J,K)=>{let ne=/^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*,/.exec(J.slice(K.end));if(ne?.[0].includes("/")){let oe=K.end+ne[0].length-1;return J.slice(0,K.start)+J.slice(K.end,oe)+J.slice(oe+1)}return Sr(J,K)},_);return si(L,I),L}function Al(_){Sl(_);let I=oi(_),O=I.find((K)=>Nr(K)),L=[],J=[];for(let K of I){if(!Nr(K))continue;try{let ne=ei(K,"utf-8");if(!ai(si(ne,K)))continue;mn(K,sg(ne,K)),J.push(K)}catch(ne){L.push(ne instanceof Error?ne.message:String(ne))}}if(L.length>0)throw Error(L.join(`
|
|
220
|
-
`));return{path:J[0]??O??Tn(ti(_),ni[0]),alreadyInstalled:J.length>0}}function Ct(_){let I=[];for(let O of _.openCodeVersion?.startsWith("2.")?ri(_.environment):oi(_.environment))if(ag(O))try{let L=lg(O,"utf-8"),J=Sn(L),K=JSON.parse(J);if(ai(K)){let ne=ii(_.openCodePluginListOutput);if(ne)return{platform:"opencode",status:"disabled",method:"opencode api plugin.list",configPath:O,errors:[...I,ne]};return{platform:"opencode",status:"configured",method:"plugin array",configPath:O,errors:I.length>0?I:void 0}}}catch(L){I.push(`Failed to parse ${cg(O)}: ${L instanceof Error?L.message:String(L)}`)}return{platform:"opencode",status:"n/a",errors:I.length>0?I:void 0}}import{join as _l}from"node:path";function li(_){let I=_.env.get("PI_CODING_AGENT_DIR");return _l(I?Ln(I,_.home):_l(_.home,".pi","agent"),"settings.json")}function ci(_){if(typeof _!=="string")return!1;return _==="npm:cc-safety-net"||_.startsWith("npm:cc-safety-net@")}function Il(_){let I=li(_.environment),O=Rn(I);if(O.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(O.kind==="missing")return{platform:"pi",status:"n/a"};let L=tn(O.value,"packages");if(!Array.isArray(L))return{platform:"pi",status:"n/a"};let J=L.find((oe)=>ci(typeof oe==="string"?oe:tn(oe,"source")));if(J===void 0)return{platform:"pi",status:"n/a"};let K=tn(J,"extensions");if(Array.isArray(K)&&K.some((oe)=>typeof oe==="string"&&oe.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:I,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:I}}var dg={amp:ia,"antigravity-cli":sa,"claude-code":ca,codex:ua,"copilot-cli":Pa,cursor:Da,"deepseek-harness":Na,"gemini-cli":ja,"grok-build":Ja,"hermes-agent":il,"kimi-code":Ut,openclaw:bl,opencode:Ct,pi:Il};function Rt(_,I,O){let L={...O,cwd:I,environment:_};return sr.map((J)=>ug(dg[J](L)))}function ug(_){if(_.status==="not-inspected")return{platform:_.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:_.platform,detected:_.status!=="n/a",configured:_.status==="configured",inspectionStatus:_.status!=="n/a"?"verified":_.errors&&_.errors.length>0?"failed":"not-applicable",method:_.method,configPath:_.configPath,configPaths:_.configPaths,errors:_.errors}}import{join as pg}from"node:path";var fg=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),mg=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),gg={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function Tl(_){let I=pg(_.tmpdir,"cc-safety-net-self-test"),O=fg.map((L)=>{let J=M(_,l("self-test",{command:L.command},{kind:"command",shell:"auto"},{configCwd:I,executionCwd:I},L.command),{guard:{dependencies:{loadPolicySnapshot:()=>mg,getModes:()=>gg,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),K=L.expectBlocked?"blocked":"allowed",ne=J.decision.kind==="deny"?"blocked":"allowed";return{command:L.command,description:L.description,expected:K,actual:ne,passed:K===ne,reason:J.decision.kind==="deny"?J.decision.reason:void 0,ruleId:J.decision.kind==="deny"?J.decision.ruleId:void 0}});return{passed:O.filter((L)=>L.passed).length,failed:O.filter((L)=>!L.passed).length,total:O.length,results:O}}function di(_){let I=gn({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},_);if(On(I.errors))return null;return{json:I.flags.json,skipUpdateCheck:I.flags.skipUpdateCheck}}async function $l(_,I={}){let O=await $t(!I.json,()=>{let L=hg(_,I);return{ready:L,finish:()=>L}},()=>Tt(),{loadingMessage:"Checking system status…"});if(I.json)console.log(JSON.stringify(O,null,2));else yg(O);return O.engineSelfTest.failed>0||O.findings.some((L)=>L.severity==="error")?1:0}async function hg(_,I){let O=I.cwd??process.cwd(),L=await gr((Le)=>Ct({environment:_,cwd:O,openCodeVersion:Le}).status!=="n/a",void 0,O),J=Rt(_,O,{ampPluginListOutput:L.ampPluginListOutput,codexPluginListOutput:L.codexPluginListOutput,copilotCliVersion:L.versions["copilot-cli"],openCodeVersion:L.versions.opencode,openCodePluginListOutput:L.openCodePluginListOutput}),K=ks(_,O),ne=xs(_),oe=E(_,{cwd:O}),de=oe.policy,ue=R(de,_.env),ve=B(de,ue.capabilities),xe=dr(_,7),Se=ea(_,O),Pe=I.skipUpdateCheck?{currentVersion:fn(),latestVersion:null,updateAvailable:!1}:await Gn(),we={hooks:J,engineSelfTest:Tl(_),userConfig:K.userConfig,projectConfig:K.projectConfig,configState:$e(oe),effectiveRules:K.effectiveRules,environment:ne,effectiveSafety:{selectedPreset:de.safety.level??"standard",level:ue.effectiveLevel,capabilities:ue.capabilities,ruleOverrides:de.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(ve).filter(([,Le])=>Le.source==="rule_override"&&Le.override==="off"&&Le.inheritedEnabled&&Le.changesInherited).map(([Le])=>Le),ruleCounts:{stored:Object.keys(de.destructiveCommandRuleOverrides).length,effective:Object.values(ve).filter((Le)=>Le.changesInherited).length},...oe.policyScopes?{policyScopes:oe.policyScopes}:{}},...Se.length>0?{v2Leftovers:Se}:{},posture:Ns(_,K.userConfig.path),activity:xe,update:Pe,system:L};return{...we,findings:Cs(we)}}function yg(_){console.log(),console.log(Ps(_.hooks)),console.log(),console.log(Es(_.engineSelfTest)),console.log(),console.log(As(_)),console.log(),console.log(_s(_.environment)),console.log(),console.log(Is(_)),console.log(),console.log(Ts(_.findings)),console.log(),console.log($s(_.activity)),console.log(),console.log(Ds(_.system)),console.log(),console.log(Os(_.update)),console.log(Ls(_))}import{existsSync as vg}from"node:fs";var bg=/^[A-Za-z0-9_@%+=:,./-]+$/,Ol="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function ui(_){let I=gn({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},_);if(On(I.errors))return console.error(Ol),console.error("Pass -- before a command that starts with dashes."),null;if(I.values.cwd!==void 0&&!vg(I.values.cwd))return console.error(`Error: --cwd path does not exist: ${I.values.cwd}`),null;let O=I.positionals.length===1?I.positionals[0]:I.positionals.map((L)=>bg.test(L)?L:`'${L.replaceAll("'","'\\''")}'`).join(" ");if(!O)return console.error("Error: No command provided"),console.error(Ol),null;return{json:I.flags.json,cwd:I.values.cwd,command:O}}function Dl(_){if(_)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function Ll(_,I){let L=I-18;return[`${_.dtl}${_.dh.repeat(I)}${_.dtr}`,`${_.dv} Command Analysis${" ".repeat(L)}${_.dv}`,`${_.dbl}${_.dh.repeat(I)}${_.dbr}`]}function pi(_){return JSON.stringify(_)}function Nl(_,I=0){return`[${_.map((L,J)=>Rs(L,J,I)).join(",")}]`}function Vt(_,I,O=70){let L=_.split(" "),J=[],K="";for(let ne of L)if(K&&K.length+ne.length+1>O)J.push(K),K=ne;else K=K?`${K} ${ne}`:ne;if(K)J.push(K);return J.map((ne,oe)=>oe===0?ne:`${I}${ne}`)}function jl(_,I,O){let L=[];switch(_.type){case"parse":return null;case"env-strip":return L.push(""),L.push(`STEP ${I} ${O.h} Strip environment variables`),L.push(` Removed: ${_.envVars.map((J)=>`${J}=<redacted>`).join(", ")}`),L.push(` Tokens: ${pi(_.output)}`),{lines:L,incrementStep:!0};case"leading-tokens-stripped":return L.push(""),L.push(`STEP ${I} ${O.h} Strip wrappers`),L.push(` Removed: ${_.removed.join(", ")}`),L.push(` Tokens: ${pi(_.output)}`),{lines:L,incrementStep:!0};case"shell-wrapper":return L.push(""),L.push(`STEP ${I} ${O.h} Detect shell wrapper`),L.push(` Wrapper: ${_.wrapper} -c`),L.push(` Inner: ${_.innerCommand}`),{lines:L,incrementStep:!0};case"interpreter":{if(L.push(""),L.push(`STEP ${I} ${O.h} Detect interpreter`),L.push(` Interpreter: ${_.interpreter}`),L.push(` Code: ${_.codeArg}`),_.paranoidBlocked)L.push(" Result: ✗ BLOCKED (paranoid mode)");return{lines:L,incrementStep:!0}}case"busybox":return L.push(""),L.push(`STEP ${I} ${O.h} Busybox wrapper`),L.push(` Subcommand: ${_.subcommand}`),{lines:L,incrementStep:!0};case"transparent-wrapper":return L.push(""),L.push(`STEP ${I} ${O.h} Transparent wrapper`),L.push(` Wrapper: ${_.wrapper}`),L.push(` Tokens: ${pi(_.output)}`),{lines:L,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(L.push(""),L.push(`STEP ${I} ${O.h} Match rules`),L.push(` Rule: ${_.rule}()`),_.matched)L.push(" Result: MATCHED");else L.push(" Result: No match");return{lines:L,incrementStep:!0}}case"worktree-relaxation":return L.push(""),L.push(`STEP ${I} ${O.h} Worktree relaxation`),L.push(` Mode: ${o.worktree.name}`),L.push(` Git cwd: ${_.gitCwd}`),L.push(" Result: Allowed local discard in linked worktree"),{lines:L,incrementStep:!0};case"temp-root-relaxation":return L.push(""),L.push(`STEP ${I} ${O.h} Temp-root relaxation`),L.push(` Git cwd: ${_.gitCwd}`),L.push(" Result: Allowed git discard in a temp-root repository"),{lines:L,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(_.embeddedCommandFound)return L.push(""),L.push(`STEP ${I} ${O.h} Fallback scan`),L.push(` Found: ${_.embeddedCommandFound}`),{lines:L,incrementStep:!0};return null}case"custom-rules-check":{if(_.rulesChecked){if(L.push(""),L.push(`STEP ${I} ${O.h} Custom rules`),_.matched)L.push(" Result: MATCHED");else L.push(" Result: No match");return{lines:L,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(_.matched)return L.push(""),L.push(`STEP ${I} ${O.h} Dangerous text check`),L.push(` Token: ${_.token}`),L.push(" Result: MATCHED"),{lines:L,incrementStep:!0};return null}case"strict-unparseable":return L.push(""),L.push(`STEP ${I} ${O.h} Strict mode check`),L.push(` Command: ${_.rawCommand}`),L.push(" Result: ✗ UNPARSEABLE"),{lines:L,incrementStep:!0};case"segment-skipped":return null;case"error":return L.push(""),L.push(`ERROR: ${_.message}`),{lines:L,incrementStep:!1};default:return _}}function fi(_,I){let O=Dl(I?.asciiOnly??!1),L=58,J=[],K=1;J.push(...Ll(O,58)),J.push("");let ne=_.trace.steps.find((we)=>we.type==="error");if(ne&&ne.type==="error"){J.push("ERROR"),J.push(` ${ne.message}`),J.push(""),J.push("RESULT"),J.push(` Status: ${_.result==="blocked"?nn.red("BLOCKED"):nn.green("ALLOWED")}`),J.push(""),J.push("CONFIG");let we=_.configSource??"none";return J.push(` Path: ${we}`),J.join(`
|
|
221
|
-
`)}let oe=_.trace.steps.find((we)=>we.type==="parse");if(oe&&oe.type==="parse"){J.push("INPUT"),J.push(` ${oe.input}`),J.push(""),J.push(`STEP ${K} ${O.h} Split shell commands`),K++;for(let we=0;we<oe.segments.length;we++){let Le=oe.segments[we];if(Le){let en=Math.random();J.push(` Segment ${we+1}: ${Nl(Le,en)}`)}}}let de=_.trace.segments,ue=de.length>1;for(let we of de){if(ue){J.push("");let on="";if(oe&&oe.type==="parse"){let lo=oe.segments[we.index];if(lo)on=lo.join(" ")}let sn=54,an=on,rn=` Segment ${we.index+1}: `,
|
|
222
|
-
`)}function mi(_){return JSON.stringify(_,null,2)}import{resolve as Cg}from"node:path";var wg=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function Fl(_){let I=0,O={allocateSegment(){return I++},getNextSegmentIndex(){return I},recordGlobal(L){_.record({kind:"step",scope:"global",step:L})},recordSegment(L,J=O.currentSegmentIndex){if(J===void 0)return;_.record({kind:"step",scope:"segment",segmentIndex:J,step:L})}};return O}function Hl(_={}){let I=[],O=_.maxEvents??512,L={maxTextLength:_.maxTextLength??2048,maxListLength:_.maxListLength??128,maxObjectProperties:_.maxObjectProperties??_.maxListLength??128,maxDepth:_.maxDepth??16},J,K=new Set;return{record(ne){if(J)return;if(!ne||I.length>=O)return;try{I.push(yi(kg(ne,L,K)))}catch{}},finish(){if(J)return J;return J=yi({events:Object.freeze(I)}),J}}}function kg(_,I,O){if(_.kind!=="step")throw TypeError("invalid trace event");let{scope:L,step:J}=_;Fr(J,O,I);let K=gi(J,I,O);if(L==="global")return{kind:"step",scope:"global",step:K};if(L!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:_.segmentIndex,step:K}}function Fr(_,I,O,L=0,J=new WeakSet){if(typeof _==="string"){let oe=_.slice(0,O.maxTextLength);if(!Be(oe))return;for(let de of tt(oe))for(let ue of de.match(/[^\s"'()$]+/g)??[])I.add(Ml(ue));return}if(!_||typeof _!=="object"||L>=O.maxDepth||J.has(_))return;if(J.add(_),Array.isArray(_)){let oe=Math.min(_.length,O.maxListLength);for(let de=0;de<oe;de++)Fr(_[de],I,O,L+1,J);return}let K=0,ne=new Set;for(let oe in _){if(!Object.hasOwn(_,oe))continue;if(K>=O.maxObjectProperties)break;K++,Fr(oe,I,O);let de=hi(oe,O,I);if(ne.has(de))continue;ne.add(de),Fr(_[oe],I,O,L+1,J)}}function gi(_,I,O,L=0,J=new WeakSet){if(typeof _==="string")return hi(_,I,O);if(!_||typeof _!=="object")return _;if(L>=I.maxDepth)return;if(J.has(_))return;if(J.add(_),Array.isArray(_)){let oe=[],de=Math.min(_.length,I.maxListLength);for(let ue=0;ue<de;ue++)oe.push(gi(_[ue],I,O,L+1,J));return oe}let K={},ne=0;for(let oe in _){if(!Object.hasOwn(_,oe))continue;if(ne>=I.maxObjectProperties)break;ne++;let de=hi(oe,I,O);if(Object.hasOwn(K,de))continue;Object.defineProperty(K,de,{value:gi(_[oe],I,O,L+1,J),enumerable:!0,configurable:!0,writable:!0})}return K}function hi(_,I,O){let L=_.slice(0,I.maxTextLength),J=Be(L)?We(L):L,K=O.size>0?Sg(J,O):J;return(xg(K)?_e(K):K).slice(0,I.maxTextLength)}function xg(_){return _.includes("PRIVATE KEY")||_.includes("://")||_.includes("eyJ")||_.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(_)||_.length>=14&&wg.some((I)=>_.includes(I))||_.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(_)}function Sg(_,I){return _.replace(/[^\s"'()$]+/g,(O)=>I.has(Ml(O))?"<redacted>":O)}function Ml(_){let I=2166136261,O=2166136261;for(let L=0;L<_.length;L++)I=Math.imul(I^_.charCodeAt(L),16777619),O=Math.imul(O^_.charCodeAt(_.length-L-1),16777619);return`${I>>>0}:${O>>>0}:${_.length}`}function yi(_){if(_&&typeof _==="object"&&!Object.isFrozen(_)){for(let I of Object.values(_))yi(I);Object.freeze(_)}return _}function zt(_,I={},O){let L=Cg(I.cwd??process.cwd()),J=I.policySnapshot??E(O,{cwd:L,userConfigDir:I.userConfigDir}),K=R(J.policy,O.env),ne=je({policySnapshot:J,effectiveCapabilities:K.capabilities,strict:K.strict,paranoidRm:K.paranoidRm,paranoidInterpreters:K.paranoidInterpreters,worktreeMode:K.worktreeMode}),oe={effectiveLevel:ne.effectiveLevel,selectedPreset:J.policy.safety.level??"standard",...J.policyScopes?{safetyPresetScope:J.policyScopes.levelScope}:{},effectiveCapabilities:ne.effectiveCapabilities,destructiveCommandRuleOverrides:J.policy.destructiveCommandRuleOverrides},{configSource:de,configValid:ue}=Pg(O,{cwd:L,userConfigDir:I.userConfigDir});if(!_||!_.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:de,configValid:ue,...oe};let ve=h(_,"auto");if(ve.status==="limited")throw new y;let xe=ve.dialect==="powershell"?h(_,"posix"):ve,Se=ut(xe),Pe=Hl(),we=Fl(Pe);we.recordGlobal({type:"parse",input:_,segments:Se.map((xn)=>[...xn])});let Le=l("Bash",{command:_},{kind:"command",shell:"auto"},{configCwd:L,executionCwd:L},_),en=V(Le,{environment:O,trace:we,dependencies:{loadPolicySnapshot:()=>J}}),Ve=en.decision.kind==="deny"?en.decision:null;if(Ve&&(en.stage==="policy-protection"||en.stage==="secret-protection")){let xn=Rg(Ve);return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:xn.rule,matched:!0,reason:Ve.reason}]}]},result:"blocked",reason:k(Ve.reason),segment:k(Ul(Ve,_)),...xn.ruleId?{ruleId:k(xn.ruleId)}:{},configSource:de,configValid:ue,...oe}}let on=we.getNextSegmentIndex();if(Ve&&on>0&&on<Se.length)we.recordSegment({type:"segment-skipped",index:on,reason:"prior-segment-blocked"},on);let sn=Pe.finish(),an=Ve?.ruleId??Eg(Le,J,K,O),rn=W.find((xn)=>xn.id===an&&xn.activationCapability),
|
|
223
|
-
`,()=>I())})}async function Bl(_,I){let O=ui(I);if(!O)return 1;try{let L=zt(O.command,{cwd:O.cwd},_),J=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Gl(O.json?mi(L):fi(L,{asciiOnly:J})),0}catch(L){let J=Tg(L instanceof p?L.cause:L);if(J===void 0)throw L;if(O.json)return await Gl(JSON.stringify({error:J})),1;return console.error(J),1}}function Tg(_){if(_ instanceof y)return _.message;if(_ instanceof f)return _.message;if(_ instanceof s&&a[_.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var ql="2.5.
|
|
220
|
+
`));return{path:J[0]??O??Tn(ti(_),ni[0]),alreadyInstalled:J.length>0}}function Ct(_){let I=[];for(let O of _.openCodeVersion?.startsWith("2.")?ri(_.environment):oi(_.environment))if(ag(O))try{let L=lg(O,"utf-8"),J=Sn(L),K=JSON.parse(J);if(ai(K)){let ne=ii(_.openCodePluginListOutput);if(ne)return{platform:"opencode",status:"disabled",method:"opencode api plugin.list",configPath:O,errors:[...I,ne]};return{platform:"opencode",status:"configured",method:"plugin array",configPath:O,errors:I.length>0?I:void 0}}}catch(L){I.push(`Failed to parse ${cg(O)}: ${L instanceof Error?L.message:String(L)}`)}return{platform:"opencode",status:"n/a",errors:I.length>0?I:void 0}}import{join as _l}from"node:path";function li(_){let I=_.env.get("PI_CODING_AGENT_DIR");return _l(I?Ln(I,_.home):_l(_.home,".pi","agent"),"settings.json")}function ci(_){if(typeof _!=="string")return!1;return _==="npm:cc-safety-net"||_.startsWith("npm:cc-safety-net@")}function Il(_){let I=li(_.environment),O=Rn(I);if(O.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(O.kind==="missing")return{platform:"pi",status:"n/a"};let L=tn(O.value,"packages");if(!Array.isArray(L))return{platform:"pi",status:"n/a"};let J=L.find((oe)=>ci(typeof oe==="string"?oe:tn(oe,"source")));if(J===void 0)return{platform:"pi",status:"n/a"};let K=tn(J,"extensions");if(Array.isArray(K)&&K.some((oe)=>typeof oe==="string"&&oe.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:I,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:I}}var dg={amp:ia,"antigravity-cli":sa,"claude-code":ca,codex:ua,"copilot-cli":Pa,cursor:Da,"deepseek-harness":Na,"gemini-cli":ja,"grok-build":Ja,"hermes-agent":il,"kimi-code":Ut,openclaw:bl,opencode:Ct,pi:Il};function Rt(_,I,O){let L={...O,cwd:I,environment:_};return sr.map((J)=>ug(dg[J](L)))}function ug(_){if(_.status==="not-inspected")return{platform:_.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:_.platform,detected:_.status!=="n/a",configured:_.status==="configured",inspectionStatus:_.status!=="n/a"?"verified":_.errors&&_.errors.length>0?"failed":"not-applicable",method:_.method,configPath:_.configPath,configPaths:_.configPaths,errors:_.errors}}import{join as pg}from"node:path";var fg=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),mg=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),gg={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function Tl(_){let I=pg(_.tmpdir,"cc-safety-net-self-test"),O=fg.map((L)=>{let J=M(_,l("self-test",{command:L.command},{kind:"command",shell:"auto"},{configCwd:I,executionCwd:I},L.command),{guard:{dependencies:{loadPolicySnapshot:()=>mg,getModes:()=>gg,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),K=L.expectBlocked?"blocked":"allowed",ne=J.decision.kind==="deny"?"blocked":"allowed";return{command:L.command,description:L.description,expected:K,actual:ne,passed:K===ne,reason:J.decision.kind==="deny"?J.decision.reason:void 0,ruleId:J.decision.kind==="deny"?J.decision.ruleId:void 0}});return{passed:O.filter((L)=>L.passed).length,failed:O.filter((L)=>!L.passed).length,total:O.length,results:O}}function di(_){let I=gn({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},_);if(On(I.errors))return null;return{json:I.flags.json,skipUpdateCheck:I.flags.skipUpdateCheck}}async function $l(_,I={}){let O=await $t(!I.json,()=>{let L=hg(_,I);return{ready:L,finish:()=>L}},()=>Tt(),{loadingMessage:"Checking system status…"});if(I.json)console.log(JSON.stringify(O,null,2));else yg(O);return O.engineSelfTest.failed>0||O.findings.some((L)=>L.severity==="error")?1:0}async function hg(_,I){let O=I.cwd??process.cwd(),L=await gr((Le)=>Ct({environment:_,cwd:O,openCodeVersion:Le}).status!=="n/a",void 0,O),J=Rt(_,O,{ampPluginListOutput:L.ampPluginListOutput,codexPluginListOutput:L.codexPluginListOutput,copilotCliVersion:L.versions["copilot-cli"],openCodeVersion:L.versions.opencode,openCodePluginListOutput:L.openCodePluginListOutput}),K=ks(_,O),ne=xs(_),oe=E(_,{cwd:O}),de=oe.policy,ue=R(de,_.env),ve=B(de,ue.capabilities),xe=dr(_,7),Se=ea(_,O),Pe=I.skipUpdateCheck?{currentVersion:un(),latestVersion:null,updateAvailable:!1}:await Un(),we={hooks:J,engineSelfTest:Tl(_),userConfig:K.userConfig,projectConfig:K.projectConfig,configState:$e(oe),effectiveRules:K.effectiveRules,environment:ne,effectiveSafety:{selectedPreset:de.safety.level??"standard",level:ue.effectiveLevel,capabilities:ue.capabilities,ruleOverrides:de.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(ve).filter(([,Le])=>Le.source==="rule_override"&&Le.override==="off"&&Le.inheritedEnabled&&Le.changesInherited).map(([Le])=>Le),ruleCounts:{stored:Object.keys(de.destructiveCommandRuleOverrides).length,effective:Object.values(ve).filter((Le)=>Le.changesInherited).length},...oe.policyScopes?{policyScopes:oe.policyScopes}:{}},...Se.length>0?{v2Leftovers:Se}:{},posture:Ns(_,K.userConfig.path),activity:xe,update:Pe,system:L};return{...we,findings:Cs(we)}}function yg(_){console.log(),console.log(Ps(_.hooks)),console.log(),console.log(Es(_.engineSelfTest)),console.log(),console.log(As(_)),console.log(),console.log(_s(_.environment)),console.log(),console.log(Is(_)),console.log(),console.log(Ts(_.findings)),console.log(),console.log($s(_.activity)),console.log(),console.log(Ds(_.system)),console.log(),console.log(Os(_.update)),console.log(Ls(_))}import{existsSync as vg}from"node:fs";var bg=/^[A-Za-z0-9_@%+=:,./-]+$/,Ol="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function ui(_){let I=gn({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},_);if(On(I.errors))return console.error(Ol),console.error("Pass -- before a command that starts with dashes."),null;if(I.values.cwd!==void 0&&!vg(I.values.cwd))return console.error(`Error: --cwd path does not exist: ${I.values.cwd}`),null;let O=I.positionals.length===1?I.positionals[0]:I.positionals.map((L)=>bg.test(L)?L:`'${L.replaceAll("'","'\\''")}'`).join(" ");if(!O)return console.error("Error: No command provided"),console.error(Ol),null;return{json:I.flags.json,cwd:I.values.cwd,command:O}}function Dl(_){if(_)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function Ll(_,I){let L=I-18;return[`${_.dtl}${_.dh.repeat(I)}${_.dtr}`,`${_.dv} Command Analysis${" ".repeat(L)}${_.dv}`,`${_.dbl}${_.dh.repeat(I)}${_.dbr}`]}function pi(_){return JSON.stringify(_)}function Nl(_,I=0){return`[${_.map((L,J)=>Rs(L,J,I)).join(",")}]`}function Vt(_,I,O=70){let L=_.split(" "),J=[],K="";for(let ne of L)if(K&&K.length+ne.length+1>O)J.push(K),K=ne;else K=K?`${K} ${ne}`:ne;if(K)J.push(K);return J.map((ne,oe)=>oe===0?ne:`${I}${ne}`)}function jl(_,I,O){let L=[];switch(_.type){case"parse":return null;case"env-strip":return L.push(""),L.push(`STEP ${I} ${O.h} Strip environment variables`),L.push(` Removed: ${_.envVars.map((J)=>`${J}=<redacted>`).join(", ")}`),L.push(` Tokens: ${pi(_.output)}`),{lines:L,incrementStep:!0};case"leading-tokens-stripped":return L.push(""),L.push(`STEP ${I} ${O.h} Strip wrappers`),L.push(` Removed: ${_.removed.join(", ")}`),L.push(` Tokens: ${pi(_.output)}`),{lines:L,incrementStep:!0};case"shell-wrapper":return L.push(""),L.push(`STEP ${I} ${O.h} Detect shell wrapper`),L.push(` Wrapper: ${_.wrapper} -c`),L.push(` Inner: ${_.innerCommand}`),{lines:L,incrementStep:!0};case"interpreter":{if(L.push(""),L.push(`STEP ${I} ${O.h} Detect interpreter`),L.push(` Interpreter: ${_.interpreter}`),L.push(` Code: ${_.codeArg}`),_.paranoidBlocked)L.push(" Result: ✗ BLOCKED (paranoid mode)");return{lines:L,incrementStep:!0}}case"busybox":return L.push(""),L.push(`STEP ${I} ${O.h} Busybox wrapper`),L.push(` Subcommand: ${_.subcommand}`),{lines:L,incrementStep:!0};case"transparent-wrapper":return L.push(""),L.push(`STEP ${I} ${O.h} Transparent wrapper`),L.push(` Wrapper: ${_.wrapper}`),L.push(` Tokens: ${pi(_.output)}`),{lines:L,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(L.push(""),L.push(`STEP ${I} ${O.h} Match rules`),L.push(` Rule: ${_.rule}()`),_.matched)L.push(" Result: MATCHED");else L.push(" Result: No match");return{lines:L,incrementStep:!0}}case"worktree-relaxation":return L.push(""),L.push(`STEP ${I} ${O.h} Worktree relaxation`),L.push(` Mode: ${o.worktree.name}`),L.push(` Git cwd: ${_.gitCwd}`),L.push(" Result: Allowed local discard in linked worktree"),{lines:L,incrementStep:!0};case"temp-root-relaxation":return L.push(""),L.push(`STEP ${I} ${O.h} Temp-root relaxation`),L.push(` Git cwd: ${_.gitCwd}`),L.push(" Result: Allowed git discard in a temp-root repository"),{lines:L,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(_.embeddedCommandFound)return L.push(""),L.push(`STEP ${I} ${O.h} Fallback scan`),L.push(` Found: ${_.embeddedCommandFound}`),{lines:L,incrementStep:!0};return null}case"custom-rules-check":{if(_.rulesChecked){if(L.push(""),L.push(`STEP ${I} ${O.h} Custom rules`),_.matched)L.push(" Result: MATCHED");else L.push(" Result: No match");return{lines:L,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(_.matched)return L.push(""),L.push(`STEP ${I} ${O.h} Dangerous text check`),L.push(` Token: ${_.token}`),L.push(" Result: MATCHED"),{lines:L,incrementStep:!0};return null}case"strict-unparseable":return L.push(""),L.push(`STEP ${I} ${O.h} Strict mode check`),L.push(` Command: ${_.rawCommand}`),L.push(" Result: ✗ UNPARSEABLE"),{lines:L,incrementStep:!0};case"segment-skipped":return null;case"error":return L.push(""),L.push(`ERROR: ${_.message}`),{lines:L,incrementStep:!1};default:return _}}function fi(_,I){let O=Dl(I?.asciiOnly??!1),L=58,J=[],K=1;J.push(...Ll(O,58)),J.push("");let ne=_.trace.steps.find((we)=>we.type==="error");if(ne&&ne.type==="error"){J.push("ERROR"),J.push(` ${ne.message}`),J.push(""),J.push("RESULT"),J.push(` Status: ${_.result==="blocked"?nn.red("BLOCKED"):nn.green("ALLOWED")}`),J.push(""),J.push("CONFIG");let we=_.configSource??"none";return J.push(` Path: ${we}`),J.join(`
|
|
221
|
+
`)}let oe=_.trace.steps.find((we)=>we.type==="parse");if(oe&&oe.type==="parse"){J.push("INPUT"),J.push(` ${oe.input}`),J.push(""),J.push(`STEP ${K} ${O.h} Split shell commands`),K++;for(let we=0;we<oe.segments.length;we++){let Le=oe.segments[we];if(Le){let en=Math.random();J.push(` Segment ${we+1}: ${Nl(Le,en)}`)}}}let de=_.trace.segments,ue=de.length>1;for(let we of de){if(ue){J.push("");let on="";if(oe&&oe.type==="parse"){let lo=oe.segments[we.index];if(lo)on=lo.join(" ")}let sn=54,an=on,rn=` Segment ${we.index+1}: `,pn=" ";if(on){if(rn.length+on.length+pn.length>sn){let bu=sn-rn.length-pn.length;an=`${on.substring(0,bu-1)}…`}}let xn=on?`${rn}${an}${pn}`:` Segment ${we.index+1} `,yu=on?`${rn}${nn.cyan(an)}${pn}`:xn,Yi=58-xn.length,Zi=Math.floor(Yi/2),vu=Yi-Zi;J.push(`${O.sh.repeat(Zi)}${yu}${O.sh.repeat(vu)}`)}if(we.steps.find((on)=>on.type==="segment-skipped")){J.push(""),J.push(" (skipped — prior segment blocked)");continue}let en=!1,Ve=!1;for(let on of we.steps){let sn=jl(on,K,O);if(sn){if(Ve=!0,on.type==="recurse"){J.push("");let an=" RECURSING ",rn=58-an.length-4;J.push(` ${O.tl}${O.h}${an}${O.h.repeat(rn)}`),J.push(` ${O.v}`),en=!0;continue}for(let an of sn.lines)if(en)J.push(` ${O.v} ${an}`);else J.push(an);if(sn.incrementStep)K++}}if(en)J.push(` ${O.v}`),J.push(` ${O.bl}${O.h.repeat(56)}`);if(!Ve)J.push(""),J.push(` ${nn.green("✓")} Allowed (no matching rules)`)}if(J.push(""),J.push("RESULT"),_.result==="blocked"){if(J.push(` Status: ${nn.red("BLOCKED")}`),_.customRule){if(J.push(` Rule: ${_.customRule.id}`),_.customRule.rulebook)J.push(` Rulebook: ${_.customRule.rulebook.name} ${_.customRule.rulebook.version}`);if(_.customRule.source)J.push(` Source: ${_.customRule.source}`);if(_.customRule.override)J.push(` Override: reason ${_.customRule.override.reason}`)}if(_.reason){let we=Vt(_.reason," ");J.push(` Reason: ${we[0]}`);for(let Le=1;Le<we.length;Le++)J.push(we[Le]??"")}}else J.push(` Status: ${nn.green("ALLOWED")}`);J.push(""),J.push("CONFIG");let ve=_.configSource??"none",xe=_.configValid?"":" (invalid)";J.push(` Path: ${ve}${xe}`);let Se=_.safetyPresetScope;J.push(` Safety preset: ${_.selectedPreset??"standard"}${Se?` (${pr(Se)})`:""}`),J.push(` Effective capabilities: ${_.effectiveLevel}`);let Pe=Object.entries(_.destructiveCommandRuleOverrides??{});if(J.push(` Rule customizations: ${Pe.length}`),_.ruleActivation)J.push(` Rule activation: ${_.ruleActivation.id} — ${_.ruleActivation.enabled?"on":"off"} via ${_.ruleActivation.source}`);return J.join(`
|
|
222
|
+
`)}function mi(_){return JSON.stringify(_,null,2)}import{resolve as Cg}from"node:path";var wg=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function Fl(_){let I=0,O={allocateSegment(){return I++},getNextSegmentIndex(){return I},recordGlobal(L){_.record({kind:"step",scope:"global",step:L})},recordSegment(L,J=O.currentSegmentIndex){if(J===void 0)return;_.record({kind:"step",scope:"segment",segmentIndex:J,step:L})}};return O}function Hl(_={}){let I=[],O=_.maxEvents??512,L={maxTextLength:_.maxTextLength??2048,maxListLength:_.maxListLength??128,maxObjectProperties:_.maxObjectProperties??_.maxListLength??128,maxDepth:_.maxDepth??16},J,K=new Set;return{record(ne){if(J)return;if(!ne||I.length>=O)return;try{I.push(yi(kg(ne,L,K)))}catch{}},finish(){if(J)return J;return J=yi({events:Object.freeze(I)}),J}}}function kg(_,I,O){if(_.kind!=="step")throw TypeError("invalid trace event");let{scope:L,step:J}=_;Fr(J,O,I);let K=gi(J,I,O);if(L==="global")return{kind:"step",scope:"global",step:K};if(L!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:_.segmentIndex,step:K}}function Fr(_,I,O,L=0,J=new WeakSet){if(typeof _==="string"){let oe=_.slice(0,O.maxTextLength);if(!Be(oe))return;for(let de of tt(oe))for(let ue of de.match(/[^\s"'()$]+/g)??[])I.add(Ml(ue));return}if(!_||typeof _!=="object"||L>=O.maxDepth||J.has(_))return;if(J.add(_),Array.isArray(_)){let oe=Math.min(_.length,O.maxListLength);for(let de=0;de<oe;de++)Fr(_[de],I,O,L+1,J);return}let K=0,ne=new Set;for(let oe in _){if(!Object.hasOwn(_,oe))continue;if(K>=O.maxObjectProperties)break;K++,Fr(oe,I,O);let de=hi(oe,O,I);if(ne.has(de))continue;ne.add(de),Fr(_[oe],I,O,L+1,J)}}function gi(_,I,O,L=0,J=new WeakSet){if(typeof _==="string")return hi(_,I,O);if(!_||typeof _!=="object")return _;if(L>=I.maxDepth)return;if(J.has(_))return;if(J.add(_),Array.isArray(_)){let oe=[],de=Math.min(_.length,I.maxListLength);for(let ue=0;ue<de;ue++)oe.push(gi(_[ue],I,O,L+1,J));return oe}let K={},ne=0;for(let oe in _){if(!Object.hasOwn(_,oe))continue;if(ne>=I.maxObjectProperties)break;ne++;let de=hi(oe,I,O);if(Object.hasOwn(K,de))continue;Object.defineProperty(K,de,{value:gi(_[oe],I,O,L+1,J),enumerable:!0,configurable:!0,writable:!0})}return K}function hi(_,I,O){let L=_.slice(0,I.maxTextLength),J=Be(L)?We(L):L,K=O.size>0?Sg(J,O):J;return(xg(K)?_e(K):K).slice(0,I.maxTextLength)}function xg(_){return _.includes("PRIVATE KEY")||_.includes("://")||_.includes("eyJ")||_.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(_)||_.length>=14&&wg.some((I)=>_.includes(I))||_.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(_)}function Sg(_,I){return _.replace(/[^\s"'()$]+/g,(O)=>I.has(Ml(O))?"<redacted>":O)}function Ml(_){let I=2166136261,O=2166136261;for(let L=0;L<_.length;L++)I=Math.imul(I^_.charCodeAt(L),16777619),O=Math.imul(O^_.charCodeAt(_.length-L-1),16777619);return`${I>>>0}:${O>>>0}:${_.length}`}function yi(_){if(_&&typeof _==="object"&&!Object.isFrozen(_)){for(let I of Object.values(_))yi(I);Object.freeze(_)}return _}function zt(_,I={},O){let L=Cg(I.cwd??process.cwd()),J=I.policySnapshot??E(O,{cwd:L,userConfigDir:I.userConfigDir}),K=R(J.policy,O.env),ne=je({policySnapshot:J,effectiveCapabilities:K.capabilities,strict:K.strict,paranoidRm:K.paranoidRm,paranoidInterpreters:K.paranoidInterpreters,worktreeMode:K.worktreeMode}),oe={effectiveLevel:ne.effectiveLevel,selectedPreset:J.policy.safety.level??"standard",...J.policyScopes?{safetyPresetScope:J.policyScopes.levelScope}:{},effectiveCapabilities:ne.effectiveCapabilities,destructiveCommandRuleOverrides:J.policy.destructiveCommandRuleOverrides},{configSource:de,configValid:ue}=Pg(O,{cwd:L,userConfigDir:I.userConfigDir});if(!_||!_.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:de,configValid:ue,...oe};let ve=h(_,"auto");if(ve.status==="limited")throw new y;let xe=ve.dialect==="powershell"?h(_,"posix"):ve,Se=ut(xe),Pe=Hl(),we=Fl(Pe);we.recordGlobal({type:"parse",input:_,segments:Se.map((xn)=>[...xn])});let Le=l("Bash",{command:_},{kind:"command",shell:"auto"},{configCwd:L,executionCwd:L},_),en=V(Le,{environment:O,trace:we,dependencies:{loadPolicySnapshot:()=>J}}),Ve=en.decision.kind==="deny"?en.decision:null;if(Ve&&(en.stage==="policy-protection"||en.stage==="secret-protection")){let xn=Rg(Ve);return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:xn.rule,matched:!0,reason:Ve.reason}]}]},result:"blocked",reason:k(Ve.reason),segment:k(Ul(Ve,_)),...xn.ruleId?{ruleId:k(xn.ruleId)}:{},configSource:de,configValid:ue,...oe}}let on=we.getNextSegmentIndex();if(Ve&&on>0&&on<Se.length)we.recordSegment({type:"segment-skipped",index:on,reason:"prior-segment-blocked"},on);let sn=Pe.finish(),an=Ve?.ruleId??Eg(Le,J,K,O),rn=W.find((xn)=>xn.id===an&&xn.activationCapability),pn=rn?ne.policy.effectiveDestructiveCommandRules[rn.id]:void 0;return{trace:_g(sn),result:Ve?"blocked":"allowed",reason:Ve?k(Ve.reason):void 0,segment:Ve?k(Ul(Ve,_)):void 0,ruleId:Ve?.ruleId?k(Ve.ruleId):void 0,customRule:Ag(Ig(Ve?.ruleId,J)),configSource:de,configValid:ue,...oe,...rn&&pn?{ruleActivation:{id:rn.id,...pn}}:{}}}function Ul(_,I){return _.evidence?.segment??I}function Rg(_){if(_.reason===Ge)return{ruleId:"policy-protection",rule:"policy-protection:findPolicyConfigMutationTargetInSemanticFacts"};if(_.reason===Ue)return{ruleId:"policy-apply-protection",rule:"policy-apply-protection:findPolicyApplyInvocationInSemanticFacts"};if(_.reason===x)return{ruleId:"git-metadata-protection",rule:"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts"};return{ruleId:_.ruleId,rule:"secret-protection:findSensitiveTargetInSemanticFacts"}}function Pg(_,I){let O=U(I.cwd),L=G(_,I),J=Z(_,{cwd:I.cwd,userConfigDir:I.userConfigDir});try{if(n(J.projectConfigTarget)!==null){if(Mn(J.projectConfigTarget).errors.length===0)return{configSource:O,configValid:!0};return{configSource:O,configValid:!1}}}catch(K){if(K instanceof r)return{configSource:O,configValid:!1};throw K}try{if(n(J.userConfigTarget)!==null){let K=Mn(J.userConfigTarget);return{configSource:L,configValid:K.errors.length===0}}return{configSource:null,configValid:!0}}catch(K){if(K instanceof r)return{configSource:L,configValid:!1};throw K}}function Eg(_,I,O,L){let J=I.policy,K=Te({...J,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...J.destructiveCommandRuleOverrides,...Object.fromEntries(W.flatMap((oe)=>oe.activationCapability?[[oe.id,"on"]]:[]))}},I.state==="degraded"?{diagnostics:I.diagnostics,reason:I.reason}:void 0),ne=V(_,{environment:L,dependencies:{loadPolicySnapshot:()=>K,getModes:()=>({...O,strict:!0,paranoidRm:!0,paranoidInterpreters:!0}),findSensitiveTarget:()=>null}});return ne.decision.kind==="deny"?ne.decision.ruleId:void 0}function Ag(_){if(!_)return;return{id:k(_.id),..._.rulebook?{rulebook:{name:k(_.rulebook.name),version:k(_.rulebook.version)}}:{},..._.source?{source:k(_.source)}:{},..._.override?{override:{type:"reason",reason:k(_.override.reason)}}:{}}}function _g(_){let I=_.events.flatMap((L)=>L.kind==="step"&&L.scope==="global"?[L.step]:[]),O=new Map;for(let L of _.events){if(L.kind!=="step"||L.scope!=="segment")continue;let J=O.get(L.segmentIndex)??{index:L.segmentIndex,steps:[]};J.steps.push(L.step),O.set(L.segmentIndex,J)}return{steps:I,segments:[...O.values()]}}function Ig(_,I){let O=_?.replace(/^custom\./,"");if(!O||!I.policy.rules.some((L)=>L.name===O))return;return I.ruleMetadata[O]??Object.freeze({id:O})}function Gl(_){return new Promise((I)=>{process.stdout.write(`${_}
|
|
223
|
+
`,()=>I())})}async function Bl(_,I){let O=ui(I);if(!O)return 1;try{let L=zt(O.command,{cwd:O.cwd},_),J=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Gl(O.json?mi(L):fi(L,{asciiOnly:J})),0}catch(L){let J=Tg(L instanceof p?L.cause:L);if(J===void 0)throw L;if(O.json)return await Gl(JSON.stringify({error:J})),1;return console.error(J),1}}function Tg(_){if(_ instanceof y)return _.message;if(_ instanceof f)return _.message;if(_ instanceof s&&a[_.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var ql="2.5.1",An=" ",Qn="cc-safety-net";function Vl(_){return _.argument?`${_.flags} ${_.argument}`:_.flags}function $g(_){return Math.max(..._.map((I)=>Vl(I).length))}function Og(_){return Math.max(..._.map((I)=>I.usage.length))}function Dg(_){return Math.max(..._.map((I)=>`${Qn} ${I.usage}`.length))}function Lg(_,I){let O=`${Qn} ${_.usage}`;return`${An}${O.padEnd(I+2)}${_.description}`}function jn(_,I){return`${An}${_.padEnd(Math.max(40,_.length+2))}${I}`}function Pt(_,I=console.log){let O=[];if(O.push(`${Qn} ${_.name}`),O.push(""),O.push(`${An}${_.description}`),O.push(""),O.push("USAGE:"),O.push(`${An}${Qn} ${_.usage}`),O.push(""),_.subcommands&&_.subcommands.length>0){O.push("SUBCOMMANDS:");let L=Og(_.subcommands);for(let J of _.subcommands)O.push(`${An}${J.usage.padEnd(L+2)}${J.description}`);O.push("")}if(_.options.length>0){O.push("OPTIONS:");let L=$g(_.options);for(let J of _.options){let K=Vl(J),ne=J.default?`${J.description} (default: ${J.default})`:J.description;O.push(`${An}${K.padEnd(L+2)}${ne}`)}O.push("")}if(_.examples&&_.examples.length>0){O.push("EXAMPLES:");for(let L of _.examples)O.push(`${An}${L}`)}I(O.join(`
|
|
224
224
|
`))}function vi(){let _=Dg(lr),I=[];I.push(`${Qn} v${ql}`),I.push(""),I.push("Blocks destructive commands and secret access."),I.push(""),I.push("COMMANDS:");for(let O of lr)I.push(Lg(O,_));I.push(""),I.push("GLOBAL OPTIONS:"),I.push(`${An}-h, --help Show help (use with command for command-specific help)`),I.push(`${An}-V, --version Show version`),I.push(""),I.push("HELP:"),I.push(`${An}${Qn} help <command> Show help for a specific command`),I.push(`${An}${Qn} <command> --help Show help for a specific command`),I.push(""),I.push("ENVIRONMENT VARIABLES:"),I.push(jn(`${o.level.name}=standard|strict|paranoid`,"Set session safety level")),I.push(jn(`${o.worktree.name}=1`,"Allow local git discards in linked worktrees")),I.push(jn(`${o.debug.name}=1`,"Print diagnostic messages to stderr")),I.push(jn(`${o.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),I.push(jn("CC_SAFETY_NET_HOME","Override rule config home directory")),I.push(""),I.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),I.push(jn(`${o.strict.name}=1`,"Force safety.overrides.fail_closed on")),I.push(jn(`${o.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),I.push(jn(`${o.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),I.push(jn(`${o.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),I.push(""),I.push("Documentation: https://ccsafetynet.com/docs"),console.log(I.join(`
|
|
225
|
-
`))}function zl(){console.log(ql)}function Jt(_,I=console.log){let O=cr(_);if(!O)return!1;if(O.name.toLowerCase()!==_.toLowerCase())return!1;return Pt(O,I),!0}import{existsSync as zr,readFileSync as Xc}from"node:fs";import{join as Vr}from"node:path";import*as
|
|
225
|
+
`))}function zl(){console.log(ql)}function Jt(_,I=console.log){let O=cr(_);if(!O)return!1;if(O.name.toLowerCase()!==_.toLowerCase())return!1;return Pt(O,I),!0}import{existsSync as zr,readFileSync as Xc}from"node:fs";import{join as Vr}from"node:path";import*as Bn from"node:readline";function Ng(_){return _==="install"?"Install":"Uninstall"}function jg(_){return _==="install"?"Installing":"Uninstalling"}function Fg(_){return _==="install"?"into":"from"}function Kl(_){return _?.available===!0}function Hg(_,I){let O=new Set(I);return _.filter((L)=>O.has(L.target)).map((L)=>L.target)}function Jl(_,I,O){if(_.every((L)=>!L.available))return I;return Array.from({length:_.length},(L,J)=>J+1).map((L)=>(I+L*O+_.length)%_.length).find((L)=>Kl(_[L]))}function Mg(_,I,O){if(O.ctrl&&O.name==="c")return"interrupt";if(O.name==="escape"||I==="q")return"abort";if(_==="install"&&(I==="u"||I==="U"))return"update";if(O.name==="up"||I==="k")return"up";if(O.name==="down"||I==="j")return"down";if(O.name==="space"||I===" ")return"toggle";if(O.name==="return"||O.name==="enter")return"confirm";return null}function Ug(_){return{cursor:_.findIndex((I)=>I.available),selected:[]}}function Gg(_,I,O){if(O==="confirm"||O==="update"||O==="abort"||O==="interrupt")return{state:_,done:O};if(O==="up")return{state:{..._,cursor:Jl(I,_.cursor,-1)}};if(O==="down")return{state:{..._,cursor:Jl(I,_.cursor,1)}};let L=I[_.cursor];if(!Kl(L))return{state:_};let J=_.selected.includes(L.target)?_.selected.filter((K)=>K!==L.target):Hg(I,[..._.selected,L.target]);return{state:{..._,selected:J}}}var Yl="◉",Zl="◯",Xl=">",Ql=" ";function Bg(_,I,O,L={}){let J=L.color!==!1,K=J?nn.dim:(de)=>de,ne=J?nn.green:(de)=>de,oe=J?nn.bold:(de)=>de;return["",`${Ng(_)} CC Safety Net ${Fg(_)}:`,"",...I.map((de,ue)=>{let ve=O.selected.includes(de.target),xe=ue===O.cursor,Se=ve?Yl:Zl,Pe=xe?Xl:Ql,we=de.available?"":` (${de.unavailableReason??"not installed"})`,Le=`${Se} ${de.label}${we}`,en=!de.available?K(Le):ve?ne(Le):xe?oe(Le):Le;return`${Pe} ${en}`}),"",_==="install"?"Space: select Enter: confirm u: update installed Up/Down: move q/Esc: cancel":I.some((de)=>de.available)?"Space: select Enter: confirm Up/Down: move q/Esc: cancel":`No selectable integrations found for ${_}. q/Esc: close`].join(`
|
|
226
226
|
`)}var Wl=["global-hook","plugin"];function qg(_,I,O={}){let L=O.color!==!1?nn.bold:(K)=>K;return["","Install the Kimi Code integration as:","",...[`Global hook — ${I?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((K,ne)=>{let oe=ne===_,de=`${oe?Yl:Zl} ${K}`;return`${oe?Xl:Ql} ${oe?L(de):de}`}),"","Enter: confirm Up/Down: move q/Esc: cancel"].join(`
|
|
227
|
-
`)}function ec(_){let{input:I,output:O}=_;
|
|
227
|
+
`)}function ec(_){let{input:I,output:O}=_;Bn.emitKeypressEvents(I);let L=I.isRaw===!0;I.setRawMode(!0),I.resume();let J=0,K=()=>{if(J===0)return;Bn.moveCursor(O,0,-J),Bn.cursorTo(O,0),Bn.clearScreenDown(O)},ne=()=>{K();let oe=_.render();O.write(`${oe}
|
|
228
228
|
`),J=oe.split(`
|
|
229
229
|
`).length};return new Promise((oe)=>{let de=(ve)=>{I.off("keypress",ue),I.setRawMode(L),I.pause(),K(),oe(ve)};function ue(ve,xe){_.onKey(ve,xe,{finish:de,draw:ne})}I.on("keypress",ue),ne()})}function nc(_={}){let I=0;return ec({input:_.input??process.stdin,output:_.output??process.stdout,render:()=>qg(I,_.globalHookInstalled===!0),onKey:(O,L,J)=>{if(L.ctrl&&L.name==="c"){J.finish(null),(_.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(L.name==="escape"||O==="q")return J.finish(null);if(L.name==="return"||L.name==="enter")return J.finish(Wl[I]);if(L.name==="up"||L.name==="down"||O==="k"||O==="j")I=(I+1)%Wl.length,J.draw()}})}function bi(_=process.stdin,I=process.stdout){return Boolean(_.isTTY&&I.isTTY&&typeof _.setRawMode==="function")}function tc(_,I,O={}){let L=O.output??process.stdout,J=Ug(I);return ec({input:O.input??process.stdin,output:L,render:()=>Bg(_,I,J),onKey:(K,ne,oe)=>{let de=Mg(_,K,ne);if(!de)return;let ue=Gg(J,I,de);if(J=ue.state,ue.done==="interrupt"){oe.finish(null),(O.onInterrupt??(()=>process.kill(process.pid,"SIGINT")))();return}if(ue.done==="abort")return oe.finish(null);if(ue.done==="update")return oe.finish("update");if(ue.done==="confirm"){if(J.selected.length===0){L.write("\x07"),oe.draw();return}oe.finish([...J.selected]),L.write(`${jg(_)} selected integrations...
|
|
230
230
|
`);return}oe.draw()}})}import{existsSync as rc,lstatSync as zg,mkdirSync as Jg,mkdtempSync as Wg,readdirSync as Kg,readFileSync as At,rmSync as Mr}from"node:fs";import{basename as Yg,dirname as Zg,join as kn}from"node:path";import{fileURLToPath as Xg}from"node:url";var wi="// cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp",nt="cc-safety-net",ot="cc-safety-net/index.ts";import{spawn as Vg}from"node:child_process";var ki=(_,I)=>{let O=Wn([..._],process.env);return new Promise((L)=>{let J=Vg(O.cmd,O.args,{cwd:I,stdio:["ignore","pipe","pipe"]}),K=Ko(J),ne=!1,oe=setTimeout(()=>{ne=!0,J.kill()},120000);J.on("error",(de)=>{clearTimeout(oe),L({status:null,errorCode:de.code,stdout:K.stdout,stderr:[de.message,K.stderr].filter(Boolean).join(`
|
|
@@ -234,9 +234,9 @@ ${oe()}`.trim())))}),K.on("close",(ve)=>{if(clearTimeout(ue),ve!==0){L(Error(Wo(
|
|
|
234
234
|
${I.stderr}`.trim());if(I.status!==0)throw Error(`Failed to run amp plugins repositories --json (exit ${I.status}). Sign in with "amp login" and rerun install --amp.
|
|
235
235
|
${[I.stdout,I.stderr].filter(Boolean).join(`
|
|
236
236
|
`)}`.trim());let O=oc(I.stdout),L=(Array.isArray(O)?O:[]).filter((J)=>tn(J,"scope")==="user"&&tn(J,"exists")===!0&&tn(J,"viewerCanWrite")===!0).map((J)=>tn(J,"cloneRef")).find((J)=>typeof J==="string"&&J.length>0);if(!L)throw Error('Your Amp account has no writable Personal Plugins repository. Sign in with "amp login", open Amp once to create it, and rerun install --amp.');return L}async function sc(_,I,O){let L=Wg(kn(I.tmpdir,"cc-safety-net-amp-"));try{return await Wt(_,["amp","clone","user-plugins",L]),await O(L)}finally{Mr(L,{recursive:!0,force:!0})}}function Si(_){return`rerun ${_==="overwrite"?"install":"uninstall"} --amp`}function ac(_,I,O){let L=kn(_,I),J=cn(L);if(!J)return;if(J.isSymbolicLink()||!J.isFile())throw Error(`Refusing to ${O} ${I} in your Amp personal plugins repository: not a regular file. Remove it there and ${Si(O)}.`);let K=At(L);if(Ur(K))return K;throw Error(`Refusing to ${O} unmanaged file ${I} in your Amp personal plugins repository. Remove it there and ${Si(O)}.`)}function lc(_,I){let O=kn(_,nt),L=cn(O);if(!L)return;if(L.isSymbolicLink()||!L.isDirectory())throw Error(`Refusing to ${I} ${nt} in your Amp personal plugins repository: not a regular directory. Remove it there and ${Si(I)}.`);return ac(_,ot,I)}function th(_){let I=kn(_,Et),O=cn(I);if(!O||O.isSymbolicLink()||!O.isFile())return;let L=At(I);return Ur(L)?L:void 0}async function cc(_,I,O,L){if(await Wt(_,O,I),(await Wt(_,["git","status","--porcelain"],I)).stdout.trim()==="")return!1;return await Wt(_,["git","-c","commit.gpgsign=false","-c","user.name=cc-safety-net","-c","user.email=cc-safety-net@localhost","commit","-m",L],I),await Wt(_,["git","push","origin","HEAD"],I),!0}function Hr(_,I){rh(_,I),oh(_,I)}function dc(_,I){if(I==="keep")return;throw Error(`Local Amp plugin ${_} is not a managed copy and masks the personal plugin. Remove it and rerun install --amp.`)}function rh(_,I){let O=Qg(_),L=cn(O);if(!L)return;if(!L.isSymbolicLink()&&L.isFile()&&Ur(At(O))){Mr(O);return}dc(O,I)}function oh(_,I){let O=kn(_.home,".config","amp","plugins",nt),L=cn(O);if(!L)return;if(!L.isSymbolicLink()&&L.isDirectory()&&ih(O)){Mr(O,{recursive:!0});return}dc(O,I)}function ih(_){let I=Yg(ot);if(Kg(_).join("\x00")!==I)return!1;let O=kn(_,I),L=cn(O);return!!L&&!L.isSymbolicLink()&&L.isFile()&&Ur(At(O))}function sh(_){let I=d(_);if(!rc(I))return"";let O=oc(At(I,"utf-8"));if(!O||typeof O!=="object"||Array.isArray(O))return"";return`;globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__ = ${JSON.stringify(C(O,_.home))};
|
|
237
|
-
`}async function uc(_,I=nh(),O=ki){let L=Buffer.concat([At(I),Buffer.from(sh(_),"utf-8")]),J=await ic(O);return sc(O,_,async(K)=>{let ne=`${J}/${nt}`,oe=lc(K,"overwrite"),de=ac(K,Et,"overwrite");if(oe?.equals(L)&&!de)return Hr(_,"fail"),{path:ne,alreadyInstalled:!0};if(Jg(kn(K,nt),{recursive:!0}),mn(kn(K,ot),L),de)Mr(kn(K,Et));let ue=await cc(O,K,["git","add","--",ot,...de?[Et]:[]],`chore: update cc-safety-net plugin to v${
|
|
238
|
-
`)}function yc(_){let I=Ot(_.home);if(ah(ch(I),{recursive:!0}),!fc(I))return Gr(I,{[dt]:Br()}),{path:I,alreadyInstalled:!1};let O=mc(I);if(dh(O))return{path:I,alreadyInstalled:!0};if(uh(O))return Gr(I,O),{path:I,alreadyInstalled:!1};return ph(O),Gr(I,O),{path:I,alreadyInstalled:!1}}function vc(_){let I=Ot(_.home);if(!fc(I))return{path:I,alreadyInstalled:!1};let O=mc(I);if(!fh(O))return{path:I,alreadyInstalled:!1};return Gr(I,O),{path:I,alreadyInstalled:!0}}import{existsSync as Ei,readlinkSync as hh}from"node:fs";import{join as
|
|
239
|
-
`)}}function Rc(_){return`${_.map((I)=>I.label).join(" and ")} profile${_.length>1?"s":""}`}function Tc(_,I={}){let O=new Set(No(_).map((K)=>K.name));if(!O.has("desktop")&&!O.has("web"))throw Error(`${
|
|
237
|
+
`}async function uc(_,I=nh(),O=ki){let L=Buffer.concat([At(I),Buffer.from(sh(_),"utf-8")]),J=await ic(O);return sc(O,_,async(K)=>{let ne=`${J}/${nt}`,oe=lc(K,"overwrite"),de=ac(K,Et,"overwrite");if(oe?.equals(L)&&!de)return Hr(_,"fail"),{path:ne,alreadyInstalled:!0};if(Jg(kn(K,nt),{recursive:!0}),mn(kn(K,ot),L),de)Mr(kn(K,Et));let ue=await cc(O,K,["git","add","--",ot,...de?[Et]:[]],`chore: update cc-safety-net plugin to v${un()}`);return Hr(_,"fail"),{path:ne,alreadyInstalled:!ue}})}async function pc(_,I=ki){let O=await ic(I);return sc(I,_,async(L)=>{let J=lc(L,"remove"),K=th(L),ne=`${O}/${K&&!J?Et:nt}`;if(!J&&!K)return Hr(_,"keep"),{path:ne,alreadyInstalled:!1};return await cc(I,L,["git","rm","--",...J?[ot]:[],...K?[Et]:[]],`chore: remove cc-safety-net plugin v${un()}`),Hr(_,"keep"),{path:ne,alreadyInstalled:!0}})}import{existsSync as fc,mkdirSync as ah,readFileSync as lh}from"node:fs";import{dirname as ch}from"node:path";var Ci=In["antigravity-cli"],dt="cc-safety-net";function pt(_){return Boolean(_)&&typeof _==="object"&&!Array.isArray(_)}function Br(){return{PreToolUse:[{hooks:[{type:"command",command:Ci,timeout:30}]}]}}function mc(_){try{let I=JSON.parse(lh(_,"utf-8"));if(!I||typeof I!=="object"||Array.isArray(I))throw Error("Antigravity hooks config must be a JSON object");return I}catch(I){if(I instanceof SyntaxError)throw Error(`Failed to parse Antigravity hooks config ${_}: ${I.message}`);throw I}}function gc(_){let I=_[dt];if(I===void 0){let L=Br();return _[dt]=L,{definition:L,preToolUse:L.PreToolUse??[]}}if(!pt(I))throw Error(`Antigravity hooks config entry "${dt}" must be an object`);let O=Array.isArray(I.PreToolUse)?I.PreToolUse:[];return I.PreToolUse=O,{definition:I,preToolUse:O}}function hc(_){if(!Array.isArray(_.PreToolUse))return!1;return _.PreToolUse.some((I)=>pt(I)&&Array.isArray(I.hooks)&&I.hooks.some((O)=>pt(O)&&O.command===Ci))}function dh(_){return Object.values(_).some((I)=>pt(I)&&I.enabled!==!1&&hc(I))}function uh(_){if(_[dt]===void 0)return!1;let I=gc(_);if(I.definition.enabled!==!1||!hc(I.definition))return!1;return I.definition.enabled=!0,!0}function ph(_){if(_[dt]===void 0){_[dt]=Br();return}let I=gc(_);I.definition.enabled=!0,I.preToolUse.push(Br().PreToolUse?.[0]??{hooks:[]})}function fh(_){let I=!1;for(let O of Object.values(_)){if(!pt(O)||!Array.isArray(O.PreToolUse))continue;O.PreToolUse=O.PreToolUse.flatMap((L)=>{if(!pt(L)||!Array.isArray(L.hooks))return[L];let J=L.hooks.filter((K)=>!pt(K)||K.command!==Ci);if(J.length!==L.hooks.length)I=!0;return J.length===0?[]:[{...L,hooks:J}]})}return I}function Gr(_,I){mn(_,`${JSON.stringify(I,null,2)}
|
|
238
|
+
`)}function yc(_){let I=Ot(_.home);if(ah(ch(I),{recursive:!0}),!fc(I))return Gr(I,{[dt]:Br()}),{path:I,alreadyInstalled:!1};let O=mc(I);if(dh(O))return{path:I,alreadyInstalled:!0};if(uh(O))return Gr(I,O),{path:I,alreadyInstalled:!1};return ph(O),Gr(I,O),{path:I,alreadyInstalled:!1}}function vc(_){let I=Ot(_.home);if(!fc(I))return{path:I,alreadyInstalled:!1};let O=mc(I);if(!fh(O))return{path:I,alreadyInstalled:!1};return Gr(I,O),{path:I,alreadyInstalled:!0}}import{existsSync as Ei,readlinkSync as hh}from"node:fs";import{join as qn}from"node:path";import{spawn as mh}from"node:child_process";var $n=En.map((_)=>({target:_.id,flag:_.flag,label:fn(_.id),probeCommand:_.probeCommand}));function Ri(_){let I=new Set(_);return $n.map((O)=>O.target).filter((O)=>I.has(O))}async function bc(_,I){for(let O of _)await I(O)}var gh=5000;function Kt(_,I=gh){return new Promise((O)=>{let L=Wn([..._],process.env),J=mh(L.cmd,L.args,{env:process.env,stdio:"ignore"}),K=!1,ne=(de)=>{if(K)return;K=!0,clearTimeout(oe),O(de)},oe=setTimeout(()=>{J.kill(),ne(!1)},I);J.on("error",()=>ne(!1)),J.on("close",(de)=>ne(de===0))})}function wc(_=Kt,I={}){let O=new Set(I.configuredTargets??[]);return Promise.all($n.map(async(L)=>({target:L.target,flag:L.flag,label:L.label,...xc(I.action,await _(L.probeCommand),O.has(L.target))})))}function kc(_,I){let O=new Set(I.configuredTargets??[]);return _.map((L)=>({...L,...xc(I.action,L.available,O.has(L.target))}))}function xc(_,I,O){if(_==="uninstall")return O?{available:!0}:{available:!1,unavailableReason:"not installed"};if(_==="install"&&O)return{available:!1,unavailableReason:"already installed"};if(!I)return{available:!1,unavailableReason:"CLI not installed"};return{available:!0}}var Vn="cc-safety-net",Pc=["npx","-y","@deepseek-ai/dsh"],Sc="DeepSeek Harness",Cc=["@deepseek-ai","dsh-desktop"],Ec="Quit DeepSeek Harness Desktop, then run this command again: Desktop plugins can only change while it is closed.",Pi=(_)=>`DeepSeek Harness Desktop is not in its default location, so ${_} ${Vn} from its Plugins page.`,Ac=(_,I)=>Ei(qn(Lo(_),I,"package.json"));function Ai(_,I){let O=I.platform??process.platform,L=Ac(_,"desktop"),J=O==="darwin"?[qn(_.home,"Applications"),I.systemApplications??"/Applications"].map((K)=>qn(K,`${Sc}.app`,"Contents","Resources","runtime","cli","bin","dsh")):O==="win32"?[qn(_.env.get("LOCALAPPDATA")||qn(_.home,"AppData","Local"),"Programs",Sc,"resources","runtime","cli","bin","dsh.cmd")]:[];return{profile:L,cli:L?J.find((K)=>Ei(K)):void 0}}function _c(_,I=process.platform){if(I==="win32")return Ei(qn(_.env.get("APPDATA")||qn(_.home,"AppData","Roaming"),...Cc,"lockfile"));let O=yh(qn(_.home,"Library","Application Support",...Cc,"SingletonLock")),L=Number(/-(\d+)$/.exec(O??"")?.[1]);return Number.isInteger(L)&&L>0&&vh(L)}function yh(_){try{return hh(_)}catch{return}}function vh(_){try{return process.kill(_,0),!0}catch(I){return I.code==="EPERM"}}async function Ic(_,I={}){let O=Ai(_,I);if(O.cli&&_c(_,I.platform))throw Error(Ec);let L=!O.cli||Ac(_,"web")||await(I.probe??Kt)(uo),J=[...O.cli?[{profile:"desktop",label:"Desktop",dsh:[O.cli]}]:[],...L?[{profile:"web",label:"web",dsh:Pc}]:[]];return{commands:J.map((K)=>[...K.dsh,"plugin","--profile",K.profile,"add",`${Vn}@${un()}`]),afterInstall:async()=>{let K=new Set(No(_).filter((oe)=>oe.enabled).map((oe)=>oe.name)),ne=J.filter((oe)=>!K.has(oe.profile));if(ne.length>0)throw Error(`DeepSeek Harness installed ${Vn} in the ${Rc(ne)} but did not enable it. Enable it from the Plugins page.`)},message:[`Added ${Vn} to the DeepSeek Harness ${Rc(J)}.`,...O.profile&&!O.cli?[Pi("add")]:[]].join(`
|
|
239
|
+
`)}}function Rc(_){return`${_.map((I)=>I.label).join(" and ")} profile${_.length>1?"s":""}`}function Tc(_,I={}){let O=new Set(No(_).map((K)=>K.name));if(!O.has("desktop")&&!O.has("web"))throw Error(`${Vn} is not installed in the DeepSeek Harness web or Desktop profile`);let L=O.has("desktop")?Ai(_,I).cli:void 0,J=O.has("desktop")&&!L;if(J&&!O.has("web"))throw Error(Pi("remove"));if(L&&_c(_,I.platform))throw Error(Ec);return{commands:[...L?[[L,"plugin","--profile","desktop","remove",Vn]]:[],...O.has("web")?[[...Pc,"plugin","--profile","web","remove",Vn]]:[]],...J?{afterUninstall:()=>{throw Error(`Removed ${Vn} from the DeepSeek Harness web profile, but ${Pi("remove")}`)}}:{}}}function $c(_,I,O={}){let L=Ai(I,O).cli!==void 0;return _.map((J)=>J.target==="deepseek-harness"&&L?{...J,available:!0,unavailableReason:void 0}:J)}import{existsSync as bh,readdirSync as wh,rmSync as kh}from"node:fs";import{join as xh}from"node:path";function Oc(_,I=process.platform,O){if(!bh(_))return;let L=I==="win32"?/^bunx-\d+-cc-safety-net@/:new RegExp(`^bunx-${process.getuid?.()??0}-cc-safety-net@`);wh(_).filter((J)=>J!==O&&L.test(J)).forEach((J)=>{kh(xh(_,J),{recursive:!0,force:!0})})}import{existsSync as Dc,readdirSync as Sh,rmSync as Ch}from"node:fs";import{join as _t}from"node:path";function qr(_,I=process.platform){let O=_t(_.env.get("npm_config_cache")||(I==="win32"?_t(_.env.get("LOCALAPPDATA")||_t(_.home,"AppData","Local"),"npm-cache"):_t(_.home,".npm")),"_npx");if(!Dc(O))return;Sh(O).filter((L)=>Dc(_t(O,L,"node_modules","cc-safety-net"))).forEach((L)=>{Ch(_t(O,L),{recursive:!0,force:!0})})}import{existsSync as Mc,mkdirSync as Ph,readFileSync as Uc}from"node:fs";import{dirname as Eh,join as Hc}from"node:path";function Rh(_,I){if(_[I]!=="#")return I;let O=_.indexOf(`
|
|
240
240
|
`,I+1);return O===-1?_.length:O+1}function _i(_,I,O){let L=new RegExp(`^(\\s*)${I}\\s*=\\s*\\[`),J=0;for(let K of _.split(`
|
|
241
241
|
`)){if(/^\s*\[/.test(K))return;let ne=L.exec(K);if(ne){let oe=J+ne[0].lastIndexOf("[");return{start:oe,end:_o(_,oe,{skipComment:Rh,...O})}}J+=K.length+1}return}function Lc(_,I,O){let L=_.slice(0,I.end).trimEnd(),J=ma(_,I.end),K=J===""?" ":`${J} `,ne=!L.endsWith("[")&&!L.endsWith(",");return`${L}${ne?",":""}
|
|
242
242
|
${K}${O}${_.slice(I.end)}`}function Nc(_,I,O){let L=_.indexOf(O,I.start);if(L===-1||L>I.end)return _;return Sr(_,{start:L,end:L+O.length})}function jc(_,I){let O=new RegExp(`^\\s*${I}\\s*=\\s*\\[\\s*]\\s*(?:#.*)?$`),L=_.split(`
|
|
@@ -252,26 +252,26 @@ ${Ii}
|
|
|
252
252
|
`;return mn(I,J),{path:I,alreadyInstalled:!0}}var Ti="safety-net@cc-marketplace",Jc=new Set(["claude-code","codex","copilot-cli","gemini-cli","hermes-agent","openclaw","opencode","pi"]),Wc=new Set(["antigravity-cli","cursor","grok-build","hermes-agent","kimi-code"]);function $i(_){return/^\s*safety-net@cc-marketplace[^a-z0-9-][^\n]*installed,/m.test(_??"")}function Qc(_){return/^\s*cc-safety-net[^a-z0-9-][^\n]*installed,/m.test(_??"")}function _h(_){return/^Marketplace `cc-marketplace`\s*$/m.test(_??"")}var ed={"claude-code":{installCommands:(_)=>{let I=xr(_,"cc-safety-net@cc-marketplace");return{commands:[...I?[["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","update","cc-safety-net@cc-marketplace"]]:[["claude","plugin","marketplace","add","kenryu42/cc-marketplace"],["claude","plugin","marketplace","update","cc-marketplace"],["claude","plugin","install","cc-safety-net@cc-marketplace"]],...Eo(_).status==="disabled"?[["claude","plugin","enable","cc-safety-net@cc-marketplace"]]:[]],cleanupCommands:xr(_,Ti)?[["claude","plugin","uninstall",Ti]]:[],update:I}},uninstallCommands:[["claude","plugin","uninstall","cc-safety-net@cc-marketplace"],["claude","plugin","marketplace","remove","cc-marketplace"]]},codex:{installCommands:async(_,I)=>{let O=I??await yn(["codex","plugin","list"]),L=Qc(O);return{commands:[L||_h(O)?["codex","plugin","marketplace","upgrade","cc-marketplace"]:["codex","plugin","marketplace","add","kenryu42/cc-marketplace"],["codex","plugin","add","cc-safety-net@cc-marketplace"]],cleanupCommands:$i(O)?[["codex","plugin","remove","safety-net@cc-marketplace"]]:[],update:L}},uninstallCommands:[["codex","plugin","remove","cc-safety-net@cc-marketplace"],["codex","plugin","marketplace","remove","cc-marketplace"]],postInstallMessage:da},"copilot-cli":{installCommands:async()=>{let _=await yn(["copilot","plugin","list"]),I=[...ka(_)?[["copilot","plugin","uninstall","copilot-safety-net"]]:[],...xa(_)?[["copilot","plugin","uninstall",va]]:[]];if(ba(_))return{commands:[["copilot","plugin","marketplace","update","cc-marketplace"],["copilot","plugin","update",_n]],cleanupCommands:I,update:!0};return{commands:[wa(await yn(["copilot","plugin","marketplace","list"]))?["copilot","plugin","marketplace","update","cc-marketplace"]:["copilot","plugin","marketplace","add","kenryu42/cc-marketplace"],["copilot","plugin","install",_n]],cleanupCommands:I}},uninstallCommands:[["copilot","plugin","uninstall","cc-safety-net@cc-marketplace"],["copilot","plugin","marketplace","remove","cc-marketplace"]]},"gemini-cli":{installCommands:(_)=>{let I=Ho(_);if(I.status==="configured")return{commands:[["gemini","extensions","update","gemini-safety-net"]],update:!0};if(I.status==="disabled")return{commands:[["gemini","extensions","update","gemini-safety-net"],["gemini","extensions","enable","gemini-safety-net"]],update:!0};return{commands:[["gemini","extensions","install","https://github.com/kenryu42/gemini-safety-net","--consent"]]}},uninstallCommands:[["gemini","extensions","uninstall","gemini-safety-net"]]},openclaw:{beforeInstall:Xo,installCommands:(_)=>{let I=!zr(Vr(Gt(_),Cn));return{commands:fl(),afterInstall:()=>ml(I)}},uninstallCommands:[["openclaw","plugins","uninstall",dn,"--force"]],postInstallMessage:["Restart the OpenClaw Gateway to apply the change.","If plugins.allow is set in openclaw.json, it must also list cc-safety-net."].join(`
|
|
253
253
|
`)},opencode:{installCommands:Cl},pi:{installCommands:[["pi","install","npm:cc-safety-net"]],uninstallCommands:[["pi","uninstall","npm:cc-safety-net"]]},"deepseek-harness":{installCommands:(_)=>Ic(_),uninstallCommands:(_)=>Tc(_)}};function nd(_,I=(O)=>O){try{let O=JSON.parse(I(Xc(_,"utf-8")));if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`Settings file ${_} must be a JSON object`);return O}catch(O){if(O instanceof SyntaxError)throw Error(`Failed to parse ${_}: ${O.message}`);throw O}}function Ih(_){let I=Vr(Lt(_),"settings.json");if(!zr(I))return;let O=nd(I,Sn),L=O.enabledPlugins;if(!L||typeof L!=="object"||Array.isArray(L))return;if(L[_n]!==!1)return;let J=Xc(I,"utf-8"),K=J.replace(new RegExp(`("${_n}"\\s*:\\s*)false`),"$1true");return L[_n]=!0,mn(I,K!==J?K:`${JSON.stringify(O,null,2)}
|
|
254
254
|
`),`Enabled ${_n} plugin in ${I}`}function Th(_){let I=li(_);if(!zr(I))return;let O=nd(I);if(!Array.isArray(O.packages))return;let L=O.packages.find((J)=>!!J&&typeof J==="object"&&!Array.isArray(J)&&ci(J.source)&&("extensions"in J));if(!L)return;return delete L.extensions,mn(I,`${JSON.stringify(O,null,2)}
|
|
255
|
-
`),`Enabled npm:cc-safety-net extensions in ${I}`}function Kc(_,I){let O=gn({label:I,booleans:Object.fromEntries($n.map((K)=>[K.target,[K.flag]]))},_),L=O.errors[0];if(L)throw Error(L);let J=$n.filter((K)=>O.flags[K.target]).map((K)=>K.target);if(J.length!==1)throw Error(`Choose exactly one ${I} target: ${$n.map((K)=>K.flag).join(", ")}`);return J[0]}async function td(_,I=vt){let[O,L,J]=await Promise.all([I(["amp","plugins","list"],30000),I(["codex","plugin","list"],30000),I(["copilot","--binary-version"])]);return{codexPluginListOutput:L,hooks:Rt(_,process.cwd(),{ampPluginListOutput:O,codexPluginListOutput:L,copilotCliVersion:J})}}async function $h(_,I,O=vt){let L=await td(_,O);return L.hooks.filter((J)=>I==="install"?J.configured:J.detected||J.inspectionStatus==="not-inspected").filter((J)=>J.platform!=="codex"||!$i(L.codexPluginListOutput)||Qc(L.codexPluginListOutput)).map((J)=>J.platform)}function Oh(_,I,O,L){if(O.length>0)return{finish:async()=>[Kc(O,I)]};if(!L.selectTargets&&!bi(L.input,L.output))return{finish:async()=>[Kc(O,I)]};let J=L.detectConfiguredTargets??(()=>$h(_,I,L.fetchVersion)),K=Promise.all([wc(L.probeTargets).then((ne)=>$c(ne,_)),J()]);return{ready:K,finish:async()=>{let[ne,oe]=await K,de=kc(ne,{action:I,configuredTargets:oe}),ue=L.selectTargets?await L.selectTargets(I,Zc(I,de)):await tc(I,Zc(I,de),{input:L.input,output:L.output});if(ue==="update")return ue;if(!ue||ue.length===0)return null;return Ri(ue)}}}async function Dh(_,I,O=!1,L){let J=ed[_];J.beforeInstall?.(I);let K=typeof J.installCommands==="function"?await J.installCommands(I,L):{commands:J.installCommands};return await Yo(K.commands),await al(K.cleanupCommands??[]),await K.afterInstall?.(),[`${K.update||O?"Updated":"Installed"} ${
|
|
256
|
-
`)}async function Lh(_,I){let O=ed[_];if(!O.uninstallCommands)throw Error(`${
|
|
257
|
-
Removing the plugin files anyway; ${Pn} may still be listed in the Hermes config.`)}},restartNote:"Restart Hermes to apply the change."}};async function Fh(_,I,O,L=!1){let J=od[I];if(_==="uninstall")await J.beforeUninstall?.(O);let K=_==="install"?await J.install(O):await J.uninstall(O),ne=_==="install"&&await J.afterInstall?.(O),oe=
|
|
255
|
+
`),`Enabled npm:cc-safety-net extensions in ${I}`}function Kc(_,I){let O=gn({label:I,booleans:Object.fromEntries($n.map((K)=>[K.target,[K.flag]]))},_),L=O.errors[0];if(L)throw Error(L);let J=$n.filter((K)=>O.flags[K.target]).map((K)=>K.target);if(J.length!==1)throw Error(`Choose exactly one ${I} target: ${$n.map((K)=>K.flag).join(", ")}`);return J[0]}async function td(_,I=vt){let[O,L,J]=await Promise.all([I(["amp","plugins","list"],30000),I(["codex","plugin","list"],30000),I(["copilot","--binary-version"])]);return{codexPluginListOutput:L,hooks:Rt(_,process.cwd(),{ampPluginListOutput:O,codexPluginListOutput:L,copilotCliVersion:J})}}async function $h(_,I,O=vt){let L=await td(_,O);return L.hooks.filter((J)=>I==="install"?J.configured:J.detected||J.inspectionStatus==="not-inspected").filter((J)=>J.platform!=="codex"||!$i(L.codexPluginListOutput)||Qc(L.codexPluginListOutput)).map((J)=>J.platform)}function Oh(_,I,O,L){if(O.length>0)return{finish:async()=>[Kc(O,I)]};if(!L.selectTargets&&!bi(L.input,L.output))return{finish:async()=>[Kc(O,I)]};let J=L.detectConfiguredTargets??(()=>$h(_,I,L.fetchVersion)),K=Promise.all([wc(L.probeTargets).then((ne)=>$c(ne,_)),J()]);return{ready:K,finish:async()=>{let[ne,oe]=await K,de=kc(ne,{action:I,configuredTargets:oe}),ue=L.selectTargets?await L.selectTargets(I,Zc(I,de)):await tc(I,Zc(I,de),{input:L.input,output:L.output});if(ue==="update")return ue;if(!ue||ue.length===0)return null;return Ri(ue)}}}async function Dh(_,I,O=!1,L){let J=ed[_];J.beforeInstall?.(I);let K=typeof J.installCommands==="function"?await J.installCommands(I,L):{commands:J.installCommands};return await Yo(K.commands),await al(K.cleanupCommands??[]),await K.afterInstall?.(),[`${K.update||O?"Updated":"Installed"} ${fn(_)} integration`,K.message??J.postInstallMessage].filter(Boolean).join(`
|
|
256
|
+
`)}async function Lh(_,I){let O=ed[_];if(!O.uninstallCommands)throw Error(`${fn(_)} uninstall is not supported`);let L=typeof O.uninstallCommands==="function"?O.uninstallCommands(I):{commands:O.uninstallCommands};return await Yo(L.commands),L.afterUninstall?.(),`Uninstalled ${fn(_)} integration`}function Nh(_){let I=Al(_);return I.alreadyInstalled?`Uninstalled OpenCode plugin from ${I.path}`:`OpenCode plugin not installed in ${I.path}`}var rd={"antigravity-cli":{install:yc,uninstall:vc},cursor:{install:$a,uninstall:Oa},"grok-build":{install:Va,uninstall:za},"kimi-code":{install:Vc,uninstall:zc}};function jh(_,I,O,L=!1){if(_==="install"&&!L)qr(O);let J=rd[I][_](O),K=fn(I),ne=_!=="install"?"Uninstalled":L?"Updated":"Installed";return _==="install"&&J.alreadyInstalled?L?`${K} hook up to date in ${J.path}`:`${K} hook already installed in ${J.path}`:_==="uninstall"&&!J.alreadyInstalled?`${K} hook not installed in ${J.path}`:`${ne} ${K} hook ${_==="install"?"in":"from"} ${J.path}`}var od={amp:{install:uc,uninstall:pc,restartNote:'Amp personal plugins apply to every Amp session, including Orb threads. Restart Amp or run "plugins: reload" to apply the change.'},"hermes-agent":{install:Za,uninstall:Xa,afterInstall:async(_)=>{let I=Jo(_);return await yn(["hermes","plugins","enable",Pn,"--no-allow-tool-override"]),!I},beforeUninstall:async(_)=>{zo(_);try{await yn(["hermes","plugins","disable",Pn])}catch(I){console.warn(`${I instanceof Error?I.message:String(I)}
|
|
257
|
+
Removing the plugin files anyway; ${Pn} may still be listed in the Hermes config.`)}},restartNote:"Restart Hermes to apply the change."}};async function Fh(_,I,O,L=!1){let J=od[I];if(_==="uninstall")await J.beforeUninstall?.(O);let K=_==="install"?await J.install(O):await J.uninstall(O),ne=_==="install"&&await J.afterInstall?.(O),oe=fn(I),de=!ne&&(_==="install"&&K.alreadyInstalled||_==="uninstall"&&!K.alreadyInstalled);return[de?_==="install"?`${oe} plugin ${L?"up to date":"already installed"} at ${K.path}`:`${oe} plugin not installed at ${K.path}`:`${_!=="install"?"Uninstalled":L?"Updated":"Installed"} ${oe} plugin ${_==="install"?"at":"from"} ${K.path}`,de?void 0:J.restartNote].filter(Boolean).join(`
|
|
258
258
|
`)}var Hh={"copilot-cli":{afterInstall:Ih},"hermes-agent":{beforeInstall:(_,I)=>{if(!I)qr(_)}},openclaw:{beforeUninstall:Xo},pi:{afterInstall:Th}};function Mh(_){return _ in rd}function Uh(_){return _ in od}var Yc=["Install CC Safety Net as a native Kimi Code plugin:",""," 1. Start Kimi Code and run: /plugins install https://github.com/kenryu42/cc-safety-net"," Confirm the trust prompt; it defaults to cancel."," 2. Run /reload, or start a new session.","","Note: Kimi Code hooks are fail-open. When the hook process cannot start, crashes, or times","out, Kimi Code allows the tool call."].join(`
|
|
259
259
|
`);function Gh(_){if(Ut({environment:_,cwd:process.cwd()}).status!=="configured")return Yc;return[Yc,"",nn.red(["CAUTION: the global Kimi Code hook is installed and will run alongside the plugin.","After the plugin is active, remove it with: cc-safety-net uninstall --kimi-code"].join(`
|
|
260
260
|
`))].join(`
|
|
261
261
|
`)}function Zc(_,I){return I.map((O)=>_==="install"&&O.target==="kimi-code"&&O.unavailableReason==="already installed"?{...O,available:!0,unavailableReason:void 0,label:`${O.label} (global hook installed)`}:O)}function Bh(_,I){if(_.selectKimiInstallMethod)return _.selectKimiInstallMethod();if(!bi(_.input,_.output))return Promise.resolve("global-hook");return nc({input:_.input,output:_.output,globalHookInstalled:Ut({environment:I,cwd:process.cwd()}).status==="configured"})}async function id(_,I,O,L=!1,J){let K=Hh[I];if(_==="install")K?.beforeInstall?.(O,L);if(_==="uninstall")K?.beforeUninstall?.(O);if(Mh(I))return jh(_,I,O,L);if(Uh(I))return Fh(_,I,O,L);if(_==="uninstall")return I==="opencode"?Nh(O):Lh(I,O);return[await Dh(I,O,L,J),await K?.afterInstall?.(O)].filter(Boolean).join(`
|
|
262
|
-
`)}function qh(_){let I=gn({label:"update"},_).errors[0];if(I)throw Error(I)}async function Vh(_,I=vt){let O=await td(_,I),L=Vr(Lt(_),"installed-plugins");return{targets:Ri([...O.hooks.filter((K)=>K.platform!=="copilot-cli"&&K.detected).map((K)=>K.platform),...[Cr,ya,ha].flatMap((K)=>zr(Vr(L,...K))?["copilot-cli"]:[]),...xr(_,Ti)?["claude-code"]:[],...$i(O.codexPluginListOutput)?["codex"]:[]]),codexPluginListOutput:O.codexPluginListOutput}}async function zh(_){let I=c(),O=_.output??process.stdout,L=(_.scriptPath??process.argv[1]??"").split(/[\\/]/),J=L.find((Pe)=>/^bunx-\d+-/.test(Pe)),K=J!==void 0||L.includes("_npx")?null:(_.checkLatestVersion??
|
|
262
|
+
`)}function qh(_){let I=gn({label:"update"},_).errors[0];if(I)throw Error(I)}async function Vh(_,I=vt){let O=await td(_,I),L=Vr(Lt(_),"installed-plugins");return{targets:Ri([...O.hooks.filter((K)=>K.platform!=="copilot-cli"&&K.detected).map((K)=>K.platform),...[Cr,ya,ha].flatMap((K)=>zr(Vr(L,...K))?["copilot-cli"]:[]),...xr(_,Ti)?["claude-code"]:[],...$i(O.codexPluginListOutput)?["codex"]:[]]),codexPluginListOutput:O.codexPluginListOutput}}async function zh(_){let I=c(),O=_.output??process.stdout,L=(_.scriptPath??process.argv[1]??"").split(/[\\/]/),J=L.find((Pe)=>/^bunx-\d+-/.test(Pe)),K=J!==void 0||L.includes("_npx")?null:(_.checkLatestVersion??Un)(),ne=async()=>{let Pe=K&&await K;if(Pe?.updateAvailable)O.write(`
|
|
263
263
|
Update available: cc-safety-net ${Pe.currentVersion} → ${Pe.latestVersion}. Update this CLI with your package manager, e.g. \`npm i -g cc-safety-net@latest\` for a global install.
|
|
264
|
-
`)},oe=Vh(I,_.fetchVersion??vt).then(async(Pe)=>{let we=new Set(Pe.targets);return{targets:Pe.targets,codexPluginListOutput:Pe.codexPluginListOutput,available:new Map(await Promise.all($n.filter((Le)=>we.has(Le.target)&&Jc.has(Le.target)).map(async(Le)=>[Le.target,await Kt(Le.probeCommand)])))}}),de=await $t(_.showBanner??!0,()=>({ready:oe,finish:()=>oe}),()=>Tt({input:_.input??process.stdin,output:O}),{loadingMessage:"Checking installed integrations…",output:O}),ue=await Promise.resolve().then(()=>(Oc(I.tmpdir,process.platform,J),null)).catch((Pe)=>Zt(Pe));if(de.targets.length===0){if(O.write("No installed integrations found. Run `cc-safety-net install` to set one up.\n"),ue!==null)console.error(ue);return await ne(),ue===null?0:1}let ve=de.targets.some((Pe)=>Wc.has(Pe))?await Promise.resolve().then(()=>(qr(I),null)).catch((Pe)=>Zt(Pe)):null,xe=await vr(Promise.all(de.targets.map((Pe)=>{if(Jc.has(Pe)&&!de.available.get(Pe))return Promise.resolve({message:`${
|
|
264
|
+
`)},oe=Vh(I,_.fetchVersion??vt).then(async(Pe)=>{let we=new Set(Pe.targets);return{targets:Pe.targets,codexPluginListOutput:Pe.codexPluginListOutput,available:new Map(await Promise.all($n.filter((Le)=>we.has(Le.target)&&Jc.has(Le.target)).map(async(Le)=>[Le.target,await Kt(Le.probeCommand)])))}}),de=await $t(_.showBanner??!0,()=>({ready:oe,finish:()=>oe}),()=>Tt({input:_.input??process.stdin,output:O}),{loadingMessage:"Checking installed integrations…",output:O}),ue=await Promise.resolve().then(()=>(Oc(I.tmpdir,process.platform,J),null)).catch((Pe)=>Zt(Pe));if(de.targets.length===0){if(O.write("No installed integrations found. Run `cc-safety-net install` to set one up.\n"),ue!==null)console.error(ue);return await ne(),ue===null?0:1}let ve=de.targets.some((Pe)=>Wc.has(Pe))?await Promise.resolve().then(()=>(qr(I),null)).catch((Pe)=>Zt(Pe)):null,xe=await vr(Promise.all(de.targets.map((Pe)=>{if(Jc.has(Pe)&&!de.available.get(Pe))return Promise.resolve({message:`${fn(Pe)} not found; skipped`,failed:!1});if(ve!==null&&Wc.has(Pe))return Promise.resolve({message:ve,failed:!0});return id("install",Pe,I,!0,de.codexPluginListOutput).then((we)=>({message:we,failed:!1}),(we)=>({message:Zt(we),failed:!0}))})),{loadingMessage:`Updating ${de.targets.length} integration${de.targets.length===1?"":"s"}…`,output:O}),Se=ue===null?xe:[...xe,{message:ue,failed:!0}];return Se.forEach((Pe)=>Pe.failed?console.error(Pe.message):O.write(`${Pe.message}
|
|
265
265
|
`)),await ne(),Se.some((Pe)=>Pe.failed)?1:0}function Oi(_,I={}){return Promise.resolve().then(()=>qh(_)).then(()=>zh(I)).catch((O)=>(console.error(Zt(O)),1))}async function Xt(_,I,O={}){try{let L=c(),J=await $t(!0,()=>Oh(L,_,I,O),()=>Tt({input:O.input??process.stdin,output:O.output??process.stdout}),{loadingMessage:_==="install"?"Checking available integrations…":"Checking installed integrations…",output:O.output??process.stdout});if(!J)return(O.output??process.stdout).write(`Cancelled: nothing was ${_}ed.
|
|
266
266
|
`),0;if(J==="update")return(O.runUpdate??(()=>Oi([],{fetchVersion:O.fetchVersion,input:O.input,output:O.output,showBanner:!1})))();let K=O.output??process.stdout;return await bc(J,async(ne)=>{if(ne==="kimi-code"&&_==="install"){let de=await Bh(O,L);if(de===null){K.write(`Cancelled: Kimi Code integration was not installed.
|
|
267
267
|
`);return}if(de==="plugin"){K.write(`${Gh(L)}
|
|
268
|
-
`);return}}let oe=await vr(id(_,ne,L),{loadingMessage:`${_==="install"?"Installing":"Uninstalling"} ${
|
|
268
|
+
`);return}}let oe=await vr(id(_,ne,L),{loadingMessage:`${_==="install"?"Installing":"Uninstalling"} ${fn(ne)} integration…`,output:K});K.write(`${oe}
|
|
269
269
|
`)}),0}catch(L){return console.error(Zt(L)),1}}function Zt(_){let I=_ instanceof Error?_.message:String(_),O=typeof _==="object"&&_!==null&&"code"in _?_.code:null;if(O==="EACCES"||O==="EPERM")return`${I}
|
|
270
270
|
Check file permissions for the target config file and parent directory.`;if(O==="ENOENT")return`${I}
|
|
271
271
|
Check that the target config path and parent directory exist.`;if(O==="ENOTDIR")return`${I}
|
|
272
|
-
Check that every parent path component is a directory.`;return I}import{mkdirSync as Xh}from"node:fs";import{dirname as Qh}from"node:path";import{createInterface as ey}from"node:readline";import{existsSync as ad,readFileSync as Jh}from"node:fs";function ft(_,I){let O=et(_,I);return{policy:O.policy,errors:ae(Ze(O.issues,Qe,(L)=>L.kind==="custom")," "," ")}}function Qt(_,I){return ft(_,I).errors}function sd(_,I){return{"safety.level":_.safety.level,...Di("safety.overrides",_.safety.overrides),"workflow.worktree_mode":String(_.workflow.worktree_mode),"destructive_command_protection.enabled":String(_.destructive_command_protection.enabled),...Di("destructive_command_protection.overrides",_.destructive_command_protection.overrides),"destructive_command_protection.allow_paths":Li(_.destructive_command_protection.allow_paths),"secret_protection.enabled":String(_.secret_protection.enabled),...Di("secret_protection.overrides",_.secret_protection.overrides),"secret_protection.deny_paths":Li(_.secret_protection.deny_paths),"secret_protection.allow_paths":Li(_.secret_protection.allow_paths),...I?{"audit.retention_days":String(_.audit.retention_days)}:{}}}function Jr(_,I,O){let L=sd(_,O),J=sd(I,O);return[...new Set([...Object.keys(L),...Object.keys(J)])].flatMap((K)=>L[K]===J[K]?[]:[{field:K,before:L[K],after:J[K]}])}function er(_,I){let O=d(_,I);if(!ad(O))return{baseline:C(globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__,_.home),diagnostics:[]};let L=mt(O),J=ft(L.value,_.home);return{baseline:J.policy,diagnostics:L.errors.length>0?L.errors:J.errors}}function mt(_){if(!ad(_))return{errors:[`${_}: file not found`]};try{return{value:JSON.parse(Jh(_,"utf-8")),errors:[]}}catch(I){let O=I instanceof Error?I.message:String(I);return{errors:[`${_}: ${I instanceof SyntaxError?`Invalid JSON: ${O}`:O}`]}}}function Wr(_,I){let O=Wh(_)?_:{};return{version:I.version,...Object.fromEntries(["safety","workflow","destructive_command_protection","secret_protection"].filter((L)=>O[L]!==void 0).map((L)=>[L,O[L]]))}}function Di(_,I){return Object.fromEntries(Object.entries(I).flatMap(([O,L])=>L===void 0?[]:[[`${_}.${O}`,String(L)]]))}function Li(_){return _.length===0?"(none)":_.join(", ")}function Wh(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}import{chmodSync as Kh,existsSync as ld,mkdirSync as Yh,readFileSync as cd}from"node:fs";import{dirname as Zh}from"node:path";function dd(_,I={}){let O=d(_,I);if(!ld(O))return{path:O,exists:!1,raw:"",policy:z(),errors:[]};let L=cd(O,"utf-8");if(!L.trim())return{path:O,exists:!0,raw:L,policy:z(),errors:["Config file is empty"]};try{let J=ft(JSON.parse(L),_.home);return{path:O,exists:!0,raw:L,policy:J.policy,errors:J.errors}}catch(J){return{path:O,exists:!0,raw:L,policy:z(),errors:[`Invalid JSON: ${J instanceof Error?J.message:String(J)}`]}}}function
|
|
273
|
-
`,384),Kh(L,384),{path:L,policy:K,errors:[]}}function ud(_,I){let O=ft(I,_.home);if(O.errors.length>0)return{errors:O.errors};return{preview:Ne(O.policy,_.env),errors:[]}}function pd(_,I={}){let O=d(_,I);if(!ld(O))return Hn(_,ee,I);let L=cd(O,"utf-8");if(!L.trim())return Hn(_,ee,I);try{return Hn(_,C(JSON.parse(L),_.home),I)}catch{return Hn(_,ee,I)}}var fd=new Set(["check","apply"]),md="(unset)";async function hd(_,I,O={}){let L=gn({label:"policy",booleans:{global:["-g","--global"]},positionals:"list"},I),J=L.positionals[0],K=[...L.errors,...J&&!fd.has(J)?[`Unknown policy subcommand: ${J}`]:[],...J&&fd.has(J)&&!L.positionals[1]?[`policy ${J} requires a file`]:[],...L.positionals.slice(2).map((we)=>`Unexpected policy argument: ${we}`)];if(K.length>0){for(let we of K)console.error(we);return 1}let ne=L.positionals[1];if(!J||!ne)return Pt(ar,console.error),1;let oe=L.flags.global?d(_):b(O.cwd??process.cwd()),de=mt(ne),ue=[...de.errors,...Qt(de.value,_.home).map((we)=>`${ne}: ${we}`),...!L.flags.global&&ry(de.value)&&de.value.audit!==void 0?[`${ne}: audit settings are user scope only; remove the audit section from a project proposal`]:[]];if(ue.length>0){for(let we of ue)console.error(we);return 1}let ve=C(de.value,_.home);if(console.log(`Scope: ${L.flags.global?"user":"project"} (${oe})`),console.log(`Proposal: ${ne}`),L.flags.global)gd(C(mt(oe).value,_.home),ve,!0);if(!L.flags.global){let we=er(_).baseline;console.log("Effective policy (user + project merged):"),gd(Q(we,le(mt(oe).value,_.home).policy).policy,Q(we,le(de.value,_.home).policy).policy,!1)}if(J==="check")return 0;let xe=O.input??process.stdin,Se=O.output??process.stdout;if(!xe.isTTY||!Se.isTTY)return console.error("policy apply confirms interactively; run this yourself in a terminal:"),console.error(` cc-safety-net policy apply ${ne}${L.flags.global?" --global":""}`),1;if(!await ny(`Apply this policy to ${oe}? [y/N] `,xe,Se))return console.log("Cancelled; nothing was written."),0;return ty(_,oe,de.value,ve,L.flags.global),console.log(`Policy applied: ${oe}`),0}function ny(_,I,O){let L=ey({input:I,output:O,terminal:!1});return new Promise((J)=>{L.once("close",()=>J(!1)),L.question(_,(K)=>{J(/^y(es)?$/i.test(K.trim())),L.close()})})}function ty(_,I,O,L,J){if(J){Hn(_,L);return}Xh(Qh(I),{recursive:!0}),bn(I,Wr(O,L))}function gd(_,I,O){let L=Jr(_,I,O);if(L.length===0){console.log("No changes.");return}console.log(`Changes (${L.length}):`);for(let J of L)console.log(` ${J.field}: ${J.before??md} -> ${J.after??md}`)}function ry(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}import{join as hv}from"node:path";var yd="# Custom Rules Reference\n\nAgent reference for generating CC Safety Net rulebook configuration.\n\n## Config Locations\n\n| Scope | Config path | Rulebook path | Priority |\n|-------|-------------|---------------|----------|\n| User | `~/.cc-safety-net/rules/rule.json` | `~/.cc-safety-net/rules/<rulebook-name>/rulebook.json` | First |\n| Project | `.cc-safety-net/rules/rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` | Second |\n| GitHub source | Listed in a local `rule.json` | Vendored into the consumer's `<rulebook-name>/rulebook.json` by `rule add` | Source order |\n\nEvery rulebook is a live file: the runtime reads it on each tool call, so an edit applies to the next command with no publishing step.\n\nUser scope is evaluated before project scope; within a scope, sources apply in `rules` array order. A duplicate active rulebook name keeps the first claim and ignores the later rulebook with a warning, so a user-scoped name shadows a project-scoped one.\n\nUse `cc-safety-net rule init` to create an inert local config. Use `--global` for user scope. Use `cc-safety-net rule init --example` to also create an inactive example rulebook. `CC_SAFETY_NET_HOME` overrides the `~/.cc-safety-net` user root.\n\nLegacy inline `.safety-net.json` and `~/.cc-safety-net/config.json` files are not loaded at runtime. Convert them with `cc-safety-net rule migrate`.\n\n## rule.json Schema\n\n```json\n{\n \"version\": 1,\n \"rules\": [\"project-rules\", \"owner/repo#main/team-rules\"],\n \"overrides\": {\n \"project-rules/block-docker-system-prune\": {\n \"reason\": \"Use targeted Docker cleanup commands.\"\n },\n \"team-rules/block-npm-global\": \"off\"\n },\n \"transparent_wrappers\": [\"rtk\"]\n}\n```\n\n- `version`: Required. Must be `1`.\n- `$schema`: Optional. `cc-safety-net rule verify` inserts it into a valid `rule.json` that lacks it.\n- `rules`: Optional array of rulebook source strings. Missing `rules` is treated as `[]`.\n- `overrides`: Optional object keyed by `<rulebook-name>/<rule-name>`.\n- `overrides` values are either `\"off\"` to disable a rule or an object with a required `reason` (replacement block reason) and an optional `intent` (one of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain`).\n- A project override cannot target a user-scoped rule: only that override is ignored, the user rule keeps its configured state, and `rule verify` reports the diagnostic as a failure.\n- `transparent_wrappers`: Optional array of command names that transparently execute a visible child command.\n- `exec`, `nice`, `nohup`, `setsid`, `stdbuf`, `time`, and `timeout` are built-in transparent wrappers and need no configuration. Configure only other wrappers you intentionally trust, such as `\"rtk\"`.\n- Use `cc-safety-net rule wrapper add rtk` to configure RTK without manually editing `rule.json`.\n\n## Rulebook Sources\n\n- Local sources are bare rulebook names such as `project-rules`; the rulebook file is `.cc-safety-net/rules/project-rules/rulebook.json`.\n- Run `cc-safety-net rule add owner/repo` to add every rulebook currently present on the repository's default branch.\n- Use `--only` to select one or more rulebooks while preserving their order: `cc-safety-net rule add owner/repo --only aws gcloud`.\n- Use `--ref` to select a branch, tag, or commit instead of the default branch: `cc-safety-net rule add owner/repo --ref v2 --only aws`.\n- GitHub sources are stored in canonical form as `owner/repo#ref/<rulebook-name>`. That form remains valid in `rule.json` and as direct CLI input.\n- GitHub refs may contain `/`-separated path segments, such as `feature/rulebook-v2`.\n- The GitHub source name, the repository directory name, and the rulebook `name` must match exactly.\n- Rulebook source strings must be unique in a config.\n\n## rulebook.json Schema\n\n```json\n{\n \"rulebook_version\": 1,\n \"name\": \"project-rules\",\n \"version\": \"1.0.0\",\n \"description\": \"Project-specific CC Safety Net rules.\",\n \"author\": \"project\",\n \"allowed_commands\": [\"docker\"],\n \"rules\": [\n {\n \"name\": \"block-docker-system-prune\",\n \"command\": \"docker\",\n \"subcommand\": \"system\",\n \"block_args\": [\"prune\"],\n \"reason\": \"Use targeted cleanup instead.\"\n }\n ],\n \"tests\": [\n {\n \"command\": \"docker system prune\",\n \"expect\": \"blocked\",\n \"rule\": \"block-docker-system-prune\"\n },\n {\n \"command\": \"docker ps\",\n \"expect\": \"allowed\"\n }\n ]\n}\n```\n\n### Rulebook Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `rulebook_version` | Yes | Must be `1` or `2` |\n| `name` | Yes | `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$` |\n| `version` | Yes | Non-empty string |\n| `description` | No | Free text; not type-checked at runtime |\n| `author` | No | Free text; not type-checked at runtime |\n| `allowed_commands` | Yes | Unique command names matching `^[a-zA-Z][a-zA-Z0-9_-]*$` |\n| `rules` | Yes | Array of rule objects |\n| `tests` | No | Array of fixtures |\n\n### Rule Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Unique within the rulebook (case-insensitive); same pattern as rulebook `name` |\n| `command` | Yes | Must be listed in `allowed_commands`; basename only, not path |\n| `subcommand` | No | Same pattern as `command`; omit to match any subcommand |\n| `intent` | No | One of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain` |\n| `block_args` | Yes | Non-empty array of non-empty strings |\n| `reason` | Yes | Non-empty string, max 256 chars |\n\n### Rule Fields (`rulebook_version` 2)\n\nVersion 2 replaces `subcommand` and `block_args` with an exact-token `match` object. Version 1 rulebooks keep their fields and their behavior; a client that does not support version 2 rejects the rulebook instead of applying broader version 1 semantics.\n\n```json\n{\n \"name\": \"block-terraform-apply-destroy\",\n \"command\": \"terraform\",\n \"match\": {\n \"command_path\": [\"apply\"],\n \"any_args\": [\"-destroy\", \"--destroy\"]\n },\n \"reason\": \"Review a destroy plan first with 'terraform plan -destroy'.\",\n \"intent\": \"use_alternative\"\n}\n```\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Same as version 1 |\n| `command` | Yes | Same as version 1 |\n| `match.command_path` | Yes | Non-empty array of non-empty command words |\n| `match.any_args` | No | Non-empty array of unique non-empty argument tokens |\n| `match.exclude_args` | No | Non-empty array of unique non-empty argument tokens |\n| `intent` | No | Same as version 1 |\n| `reason` | Yes | Same as version 1 |\n\n### Matching Behavior (`rulebook_version` 2)\n\n- **Command**: Normalized to lowercase basename, as in version 1.\n- **Command path**: After recognized global options and their values are skipped, the next command words must equal `command_path` exactly. AWS, gcloud, and Azure CLI value-taking global options are built in; Terraform's `-chdir=dir` is `=`-joined and is skipped with its own token.\n- **Unrecognized options**: A token starting with `-` that is not a recognized global option is skipped without consuming a value, so an unlisted value-taking option with a separate value (`--newflag value`) makes the rule miss. This fails open deliberately; document such gaps in the rulebook.\n- **`any_args`**: At least one listed token must appear literally among the arguments.\n- **`exclude_args`**: Any listed token appearing literally among the arguments prevents the match, which is how a safe preview such as `aws s3 rm --dryrun` stays allowed.\n- **No short-option expansion**: Arguments compare as exact tokens, so list every accepted spelling (`\"-destroy\"` and `\"--destroy\"`).\n- **Literal and case-sensitive**: No regex, glob, or substring matching. The first matching rule wins.\n- Release channels are separate rules: `gcloud beta compute instances delete` needs its own `command_path`.\n\n### Test Fixture Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `command` | Yes | Non-empty shell command string |\n| `expect` | Yes | `\"blocked\"` or `\"allowed\"` |\n| `rule` | Required for blocked fixtures | Rule name expected to block the command |\n\nFixtures are optional documentation of intended behavior. Version 1 fixtures are shape-validated only. Version 2 fixtures are evaluated against the rulebook's own rules when a source is fetched by `rule add` or `rule update`, and by `rule verify`; a failing fixture rejects that source before it is written. Loading a rulebook does not re-evaluate fixtures. CC Safety Net never executes fixture commands; they are analyzer inputs only.\n\n## Matching Behavior\n\nThe subcommand, argument, and option rules below describe `rulebook_version` 1 rules; version 2 rules match as described in Matching Behavior (`rulebook_version` 2). Execution order and transparent wrappers apply to both.\n\n- **Command**: Normalized to lowercase basename with any trailing `.exe` removed (`/usr/bin/git` → `git`).\n- **Subcommand**: The first command token after recognized Git and Docker global options and their values; `--` ends option parsing. An unrecognized option without `=` may consume the following token as its value.\n- **Arguments**: Each `block_args` value is compared literally against every command token, including expanded short options. The command is blocked if **any** item matches.\n- **Short options**: Expanded (`-Ap` matches `-A`).\n- **Long options**: Exact match (`--all-files` does not match `--all`).\n- **Execution order**: Built-in rules first, then custom rulebooks. Custom rules only add restrictions.\n- **Transparent wrappers**: A configured wrapper such as `rtk` lets `rtk git commit` be analyzed as `git commit` only when `git` is protected by built-in analyzers or active custom rules. `rtk -- git commit` is also supported.\n\n## Workflow\n\n1. Run `cc-safety-net rule init` or create `rule.json` manually.\n2. Optionally run `cc-safety-net rule init --example` to create an inactive example rulebook.\n3. Use `cc-safety-net rule wrapper add rtk` for trusted transparent wrappers.\n4. Run `cc-safety-net rule add <source>` after creating or choosing a rulebook source; add `--only <rulebook...>` or `--ref <ref>` for repository selection. The command adds the selected sources and syncs them.\n5. Edit a local rulebook whenever you like: the edit is enforced on the next command, so there is nothing to run afterwards.\n6. Run `cc-safety-net rule update [source]` to re-fetch remote sources and rewrite the vendored copies; the command prints what changed. A source with an ordinary update failure keeps its vendored copy while the other selected sources still update. Resource-limit failures remain fatal for the whole update.\n7. Run `cc-safety-net rule verify` to validate config, local rulebooks, and shareable GitHub-source rulebook directories in the current repository (it does not fetch remote content).\n8. Run `cc-safety-net rule list` to inspect active rulebooks and transparent wrappers.\n\nA missing or invalid rulebook file makes that source inactive, and an unreadable or invalid `rule.json` makes every source in its scope inactive. Inactive sources stop applying their rules while other custom rules and all built-in protections stay active. Fix the file named in the diagnostic, or run `cc-safety-net rule update` when a remote source has not been vendored yet. Run `cc-safety-net status` to see degraded sources.\n";function Kr(_,I){if(!_.ok){xd(_);return}wd(_,I)}function bd(_,I,O){if(_.ok)console.log(O);if(!_.add){Kr(_,`Added rulebook source: ${I}`);return}if(!_.ok){xd(_);return}if(_.add.added.length>0)console.log(`Added ${_.add.added.length} ${_.add.added.length===1?"rulebook":"rulebooks"} from ${_.add.source} at ${_.add.ref}:`),_.add.added.forEach((L)=>{console.log(` - ${L}`)});if(_.add.alreadyConfigured.length>0)console.log(`Rulebooks already configured from ${_.add.source} at ${_.add.ref}: ${_.add.alreadyConfigured.join(", ")}`);if(_.add.commits.length>0)console.log(`Vendored at ${_.add.commits.map((L)=>L.slice(0,7)).join(", ")}.`);wd(_,"Rule config updated.")}function wd(_,I){for(let O of _.changes??[])console.log(O);console.log(I),console.log(""),oy(_.entries)}function oy(_){if(_.length===0){console.log("Active rulebooks: (none)");return}console.log(`Active rulebooks (${_.length}):`);for(let I of _)console.log(` - ${I.name} ${I.version} (${iy(I.ruleCount)})`),console.log(` Source: ${I.spec}`)}function iy(_){return`${_} ${_===1?"rule":"rules"}`}function kd(_){gt("Active sources",_.rulebooks,(I)=>[`[${I.source}] ${I.name} ${I.version}`,` Source: ${I.spec}`]),gt("Active rules",_.rules,(I)=>[`[${ay(_,I.name)}] ${I.name}`,...sy(I),` Reason: ${I.reason}`]),gt("Disabled rules",vd(_,"off"),(I)=>[I.key]),gt("Reason overrides",vd(_,"reason"),(I)=>[I.key,` Reason: ${I.value.reason}`]),gt("Transparent wrappers",_.transparent_wrappers,(I)=>[I]),gt("Issues",_.errors,(I)=>[I]),gt("Warnings",_.warnings,(I)=>[I])}function gt(_,I,O){if(I.length===0){console.log(`${_}: (none)`);return}console.log(`${_} (${I.length}):`);for(let L of I){let[J,...K]=O(L);console.log(` - ${J}`);for(let ne of K)console.log(` ${ne}`)}}function sy(_){if(!_.match)return[` Command: ${_.subcommand?`${_.command} ${_.subcommand}`:_.command}`,` Block args: ${_.block_args.join(", ")}`];return[` Command: ${[_.command,..._.match.command_path].join(" ")}`,..._.match.any_args?[` Any args: ${_.match.any_args.join(", ")}`]:[],..._.match.exclude_args?[` Exclude args: ${_.match.exclude_args.join(", ")}`]:[]]}function ay(_,I){return _.rulebooks.find((O)=>O.rules.includes(I))?.source??"project"}function vd(_,I){return Object.entries({..._.userConfig?.overrides,..._.projectConfig?.overrides}).filter((O)=>{if(I==="off")return O[1]==="off";return!!O[1]&&typeof O[1]==="object"}).map(([O,L])=>({key:O,value:L}))}function xd(_){for(let I of _.errors)console.error(I)}import{dirname as Vd,join as ro}from"node:path";import{join as Mi,resolve as by}from"node:path";function Ni(_){let I=m(_);if(I.errors.length>0)return{ok:!1,result:{ok:!1,errors:I.errors,entries:[]}};return{ok:!0,config:I.config??lt}}function Sd(_){bn(_,{version:1,rules:[],overrides:{},transparent_wrappers:[]})}function Cd(_){bn(_,{rulebook_version:1,name:"example-rules",version:"1.0.0",description:"Project-specific CC Safety Net rules.",author:"project",allowed_commands:["docker"],rules:[{name:"block-docker-system-prune",command:"docker",subcommand:"system",block_args:["prune"],reason:"Use targeted cleanup instead."}],tests:[{command:"docker system prune",expect:"blocked",rule:"block-docker-system-prune"}]})}import{dirname as Qr}from"node:path";var ly="custom.";function Yr(_){if(_.rulebook_version!==2)return[];let I=_.rules.map((O)=>({name:O.name,command:O.command,block_args:[],match:O.match,reason:O.reason,intent:O.intent}));return(_.tests??[]).flatMap((O,L)=>{let J=ji(h(O.command));if(J.length===0)return[`tests[${L}]: could not parse fixture command: ${O.command}`];let K=J.reduce((ne,oe)=>ne??A(oe,I)?.id.slice(ly.length),void 0);if(O.expect==="blocked"){if(K===O.rule)return[];let ne=K?`"${K}" matched first`:"no rule matched";return[`tests[${L}]: expected "${O.rule}" to block "${O.command}" but ${ne}`]}return K?[`tests[${L}]: expected "${O.command}" to be allowed but "${K}" matched`]:[]})}function ji(_){return _.nodes.flatMap((I)=>{if(I.kind==="group"||I.kind==="function")return ji(I.body);if(I.kind!=="command")return[];let O=be(te(I.dialect,I.words)).words.map(t);return[...O.length>0?[O]:[],...I.nested.flatMap((L)=>ji(L))]})}var Zr=Object.freeze({concurrency:4,maxRequests:131,maxResponseBytes:67108864});function Xr(_={}){return{requests:0,responseBytes:0,maxRequests:_.maxRequests??Zr.maxRequests,maxResponseBytes:_.maxResponseBytes??Zr.maxResponseBytes}}function Mn(_){return{controller:new AbortController,budget:Xr(),resolveUrl:_}}function Rd(_){return _ instanceof Error&&_.message==="Rule synchronization exceeds CC Safety Net's safe resource limits."}function Pd(_){if(_.requests>=_.maxRequests)throw Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");_.requests++}function Ed(_,I){if(I>_.maxResponseBytes-_.responseBytes)throw _.responseBytes+=I,Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");_.responseBytes+=I}var Id=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function Ad(_,I,O=v(Qr(Qr(I)),"rules policy"),L=Mn()){if(S(_))return py(_,L);return uy(_,I,O)}async function Td(_,I,O,L,J,K){if(!S(_))return Ad(_,I,O,L);let ne=J?null:cy(_,I,O);if(ne)return ne;if(!J&&!K)throw Error(`${_} is not vendored; run rule update ${_} to vendor it`);return Ad(_,I,O,L)}function cy(_,I,O=v(Qr(Qr(I)),"rules policy")){let L=D(_),J=N(I,L.name),K=n(i(O,J));if(K===null)return null;let ne=ce(Fi(K,`Invalid rulebook ${J}.`));if(ne.name!==L.name)throw Error(`rulebook name "${ne.name}" in ${J} must match "${L.name}"`);return{spec:_,rulebook:ne,content:K}}async function $d(_,I={}){if(!Y(_))throw Error(`Invalid GitHub repository source: ${_}`);let[O,L]=_.split("/");if(!O||!L)throw Error(`Invalid GitHub repository source: ${_}`);if(I.ref!==void 0&&!se(I.ref))throw Error(`GitHub rulebook refs must use valid path segments: ${I.ref}`);let J=I.operation??Mn(),K=I.ref??await dy(O,L,_,J),ne=await Dd(O,L,K,_,J),oe=await eo(`https://api.github.com/repos/${O}/${L}/git/trees/${ne}?recursive=1`,"tree",J),de=oe.response;if(!de.ok)throw Error(`Failed to inspect ${_}: GitHub tree returned ${de.status}`);let ue=JSON.parse(oe.content);if(!Array.isArray(ue?.tree))throw Error(`Failed to inspect ${_}: unexpected GitHub tree response`);let ve=ue.tree,xe=[...new Set(ve.flatMap((Se)=>{if(!Se||typeof Se!=="object")return[];let Pe=Se;if(Pe.type!=="blob"||typeof Pe.path!=="string")return[];let we=Pe.path.match(at);return we?.[1]?[we[1]]:[]}))].sort();if(xe.length===0)throw Error(`No rulebooks found in ${_} under ${me}/`);return{source:_,owner:O,repo:L,ref:K,commit:ne,names:xe}}async function dy(_,I,O,L){let J=await eo(`https://api.github.com/repos/${_}/${I}`,"metadata",L),K=J.response;if(!K.ok)throw Error(`Failed to inspect ${O}: GitHub returned ${K.status}`);let oe=JSON.parse(J.content)?.default_branch;if(typeof oe!=="string"||oe==="")throw Error(`Failed to inspect ${O}: missing default branch`);if(!se(oe))throw Error(`GitHub returned an invalid default branch: ${oe}`);return oe}function uy(_,I,O){ct(_);let L=N(I,_),J=n(i(O,L));if(J===null)throw Error(`Rulebook source not found: ${_}`);let K=Od(Fi(J,"Invalid local rulebook source."));if(K.name!==_)throw Error(`rulebook name "${K.name}" must match local source "${_}"`);return{spec:_,rulebook:K,content:J}}async function py(_,I){let O=D(_),L=await Dd(O.owner,O.repo,O.ref,_,I),J=await eo(`https://raw.githubusercontent.com/${O.owner}/${O.repo}/${L}/${O.path}`,"raw",I),K=J.response;if(!K.ok)throw Error(`Failed to fetch ${_}: GitHub raw returned ${K.status}`);let ne=J.content,oe=Od(Fi(ne,"Invalid GitHub rulebook response."));if(oe.name!==O.name)throw Error(`rulebook name "${oe.name}" must match GitHub source "${O.name}"`);return{spec:_,rulebook:oe,content:ne}}function Od(_){let I=ce(_),O=Yr(I);if(O.length>0)throw Error(O.join("; "));return I}function Fi(_,I){try{return JSON.parse(_)}catch{throw Error(I)}}async function Dd(_,I,O,L,J){let K=await eo(`https://api.github.com/repos/${_}/${I}/commits/${encodeURIComponent(O)}`,"commit",J),ne=K.response;if(!ne.ok)throw Error(`Failed to resolve ${L}: GitHub returned ${ne.status}`);let oe=JSON.parse(K.content);if(typeof oe?.sha!=="string"||oe.sha==="")throw Error(`Failed to resolve commit for ${L}`);return oe.sha}async function fy(_,I,O={}){if(O.signal?.aborted)throw O.signal.reason;let L=O.budget??Xr(),J=new AbortController,K=()=>J.abort(O.signal?.reason);O.signal?.addEventListener("abort",K,{once:!0});let ne=!1,oe=setTimeout(()=>{if(J.signal.aborted)return;ne=!0,J.abort()},O.timeoutMs??Id.timeoutMs);try{if(O.signal?.aborted)throw O.signal.reason;Pd(L);let de=await fetch(_,{signal:J.signal,redirect:"error"});if(!de.ok)return Ld(de),{response:de,content:""};return{response:de,content:await my(de,I,L,()=>J.abort())}}catch(de){if(ne)throw Error("GitHub request timed out",{cause:de});if(O.signal?.aborted)throw O.signal.reason;throw de}finally{clearTimeout(oe),O.signal?.removeEventListener("abort",K)}}function eo(_,I,O){return fy(O.resolveUrl?.(_)??_,I,{budget:O.budget,signal:O.controller.signal})}async function my(_,I,O=Xr(),L){let J=Id[`${I}Bytes`],K=Number(_.headers.get("content-length"));if(Number.isFinite(K)&&K>J)throw Ld(_),Error(`GitHub ${I} response exceeds ${J} bytes`);if(!_.body)return"";let ne=_.body.getReader(),oe=[],de=0;while(!0){let ue=await ne.read();if(ue.done)break;try{Ed(O,ue.value.byteLength)}catch(ve){throw L?.(),_d(ne),ve}if(de+=ue.value.byteLength,de>J)throw L?.(),_d(ne),Error(`GitHub ${I} response exceeds ${J} bytes`);oe.push(Buffer.from(ue.value))}return Buffer.concat(oe,de).toString("utf-8")}function Ld(_){if(!_.body)return;Nd(()=>_.body?.cancel())}function _d(_){Nd(()=>_.cancel())}function Nd(_){try{Promise.resolve(_()).catch(()=>{})}catch{}}var gy=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;function jd(_,I){let O=Md(_.rules,I);if(O.length>0)return{ok:!0,specs:O};return Hd(_.rules,I)}function Fd(_,I){let O=Md(_,I);if(O.length>0)return{ok:!0,specs:O};let L=yy(_,I);if(L.length>0)return{ok:!0,specs:L};let J=vy(_,I);if(!J.ok)return J;if(J.specs.length>0)return{ok:!0,specs:J.specs};return Hd(_,I)}function Hd(_,I){let O=_.filter((L)=>Hi(L)?.name===I);if(O.length===1)return{ok:!0,specs:O};return hy(I,O)}function hy(_,I){return{ok:!1,result:{ok:!1,errors:I.length===0?[`No configured rulebook matches ${_}`]:[`Ambiguous rulebook match ${_}: ${I.join(", ")}`],entries:[]}}}function Md(_,I){return _.filter((O)=>O===I)}function yy(_,I){let O=I.match(gy),L=O?.[1],J=O?.[2],K=O?.[3];if(!L||!J||!K||!se(K))return[];return Ud(_,(ne)=>ne.owner===L&&ne.repo===J&&ne.ref===K)}function vy(_,I){if(!Y(I))return{ok:!0,specs:[]};let[O,L]=I.split("/"),J=Ud(_,(ne)=>ne.owner===O&&ne.repo===L);if(new Set(J.map((ne)=>Hi(ne)?.ref).filter((ne)=>!!ne)).size<2)return{ok:!0,specs:J};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${I}. Use an explicit ref:`,` cc-safety-net rule remove ${I}#<ref>`],entries:[]}}}function Hi(_){try{return D(_)}catch{return null}}function Ud(_,I){return _.filter((O)=>{let L=Hi(O);return L?I(L):!1})}async function to(_,I={}){let O=Ui(I);return wy(_,O,await no(_,O,Mn()))}function wy(_,I,O){if(!O.ok)return O;let L=wn(_,I),J=[...new Set(H(L.configPath,L.filesystemScope))];if(J.length===0)return O;return{ok:!1,errors:J,entries:O.entries}}async function no(_,I,O,L={},J=new Set,K=new Set){try{let ne=wn(_,I),oe=Ni(ne.configTarget);if(!oe.ok)return oe.result;let de=oe.config,ue=I.only?jd(de,I.only):{ok:!0,specs:de.rules};if(!ue.ok)return ue.result;let ve=new Set([...I.refresh?ue.specs:[],...J]),xe=(rn)=>Td(rn,ne.configDir,ne.filesystemScope,O,ve.has(rn),!I.refresh||ve.has(rn)),Se=await Ty(de.rules,I.refresh?(rn)=>xe(rn).then((un)=>({ok:!0,item:un})).catch((un)=>{if(Rd(un))throw un;return{ok:!1,spec:rn,message:un instanceof Error?un.message:String(un)}}):async(rn)=>({ok:!0,item:await xe(rn)}),O),Pe=Se.filter((rn)=>!rn.ok),we=Se.filter((rn)=>rn.ok).map((rn)=>rn.item),Le=we.flatMap((rn)=>ky(rn,de.rules)),en=we.flatMap((rn)=>xy(rn,K,ne)),Ve=new Set([...Le,...en].map((rn)=>rn.spec)),on=[...Pe,...Le,...en],sn=[],an=Cy(sn,()=>we.flatMap((rn)=>Ve.has(rn.spec)||on.length>0&&K.has(rn.spec)?[]:Sy(rn,ne,L,sn)));return{ok:on.length===0,errors:on.map((rn)=>`Failed to update ${rn.spec}: ${rn.message}`),entries:we.map(Py),changes:an}}catch(ne){return tr(ne)}}function ky(_,I){if(!S(_.spec))return[];let O=De(_.spec),L=I.filter((J)=>J!==_.spec&&De(J).toLowerCase()===O.toLowerCase());if(L.length===0)return[];return[{ok:!1,spec:_.spec,message:`rulebook name "${O}" is also claimed by ${L.join(", ")}; rename one of them`}]}function xy(_,I,O){if(!I.has(_.spec)||!S(_.spec))return[];let L=N(O.configDir,_.rulebook.name),J=n(i(O.filesystemScope,L));if(J===null||J===_.content)return[];return[{ok:!1,spec:_.spec,message:`${L} already exists and no configured source claims it; remove or rename the file, then re-run rule add`}]}function Sy(_,I,O,L){if(!S(_.spec))return[];let J=N(I.configDir,_.rulebook.name),K=i(I.filesystemScope,J),ne=n(K);if(ne===_.content)return[];return L?.push({target:K,previous:ne}),g(K,_.content,void 0,O._testAfterPolicyRename),Ry(_,ne)}function Cy(_,I){try{return I()}catch(O){for(let L of[..._].reverse()){if(L.previous===null){j(L.target);continue}g(L.target,L.previous)}throw O}}function Ry(_,I){if(I===null)return[`Vendored ${_.spec} (${_.rulebook.version})`];let O=ye(I),L="problem"in O?null:O.rulebook,J=new Map(L?.rules.map((ne)=>[ne.name,JSON.stringify(ne)])??[]),K=new Set(_.rulebook.rules.map((ne)=>ne.name));return[`Updated ${_.spec} (${L?.version??"unreadable"} -> ${_.rulebook.version})`,...[...K].filter((ne)=>!J.has(ne)).map((ne)=>` + ${ne}`),...[...J.keys()].filter((ne)=>!K.has(ne)).map((ne)=>` - ${ne}`),..._.rulebook.rules.filter((ne)=>{let oe=J.get(ne.name);return oe!==void 0&&oe!==JSON.stringify(ne)}).map((ne)=>` ~ ${ne.name}`)]}function Py(_){return{spec:_.spec,name:_.rulebook.name,version:_.rulebook.version,ruleCount:_.rulebook.rules.length}}async function Gd(_,I,O={}){return Ey(_,I,Oy(O),Mn())}async function Ey(_,I,O,L,J={}){let K=null,ne=!1;try{let oe=wn(_,O),de=n(oe.configTarget);K={target:oe.configTarget,content:de};let ue=Ni(oe.configTarget);if(!ue.ok)return ue.result;let ve=ue.config,xe=Y(I);Ay(I,O,xe);let Se=xe?await $d(I,{ref:O.ref,operation:L}):null,Pe=Se?_y(Se,O.rulebooks):[],we=Se?Pe.map((sn)=>Iy(ve.rules,Se,sn)??`${I}#${Se.ref}/${sn}`):[I],Le=we.filter((sn)=>!ve.rules.includes(sn)),en=[...ve.rules,...Le];if(en.length>ge)return $y();if(en.length!==ve.rules.length)ne=!0,bn(oe.configTarget,{version:1,rules:en,overrides:ve.overrides??{},transparent_wrappers:ve.transparent_wrappers??[]},void 0,J._testAfterPolicyRename);let Ve=await no(_,O,L,J,new Set(Le),new Set(Le));if(!Ve.ok)nr(oe.configTarget,de);if(!Ve.ok||!Se)return Ve;let on=Pe.filter((sn,an)=>Le.includes(we[an]??""));return{...Ve,add:{source:I,ref:Se.ref,selected:Pe,added:on,alreadyConfigured:Pe.filter((sn)=>!on.includes(sn)),commits:Le.length>0?[Se.commit]:[]}}}catch(oe){if(ne&&K)try{nr(K.target,K.content)}catch(de){return tr(de)}return tr(oe)}}function Ay(_,I,O){if(!O&&I.rulebooks!==void 0)throw Error("--only can only select rulebooks from an owner/repo source");if(!O&&I.ref)throw Error(`--ref can only select a ref for an owner/repo source: ${_}`);if(I.rulebooks?.length===0)throw Error("--only requires at least one rulebook name");let L=I.rulebooks?.filter((J)=>!u.test(J))??[];if(L.length>0)throw Error(`Invalid rulebook names: ${L.join(", ")}`)}function _y(_,I){let O=I?[...new Set(I)]:_.names,L=O.filter((J)=>!_.names.includes(J));if(L.length>0)throw Error(`Rulebooks not found in ${_.source} at ${_.ref}: ${L.join(", ")}
|
|
274
|
-
Available rulebooks: ${_.names.join(", ")}`);return O}function Iy(_,I,O){let L=`${I.source}#${I.ref}/${O}`;if(_.includes(L))return L;let J=`${I.source}#${I.commit}/${O}`;return _.find((K)=>K===J)}async function Ty(_,I,O=
|
|
272
|
+
Check that every parent path component is a directory.`;return I}import{mkdirSync as Xh}from"node:fs";import{dirname as Qh}from"node:path";import{createInterface as ey}from"node:readline";import{existsSync as ad,readFileSync as Jh}from"node:fs";function ft(_,I){let O=et(_,I);return{policy:O.policy,errors:ae(Ze(O.issues,Qe,(L)=>L.kind==="custom")," "," ")}}function Qt(_,I){return ft(_,I).errors}function sd(_,I){return{"safety.level":_.safety.level,...Di("safety.overrides",_.safety.overrides),"workflow.worktree_mode":String(_.workflow.worktree_mode),"destructive_command_protection.enabled":String(_.destructive_command_protection.enabled),...Di("destructive_command_protection.overrides",_.destructive_command_protection.overrides),"destructive_command_protection.allow_paths":Li(_.destructive_command_protection.allow_paths),"secret_protection.enabled":String(_.secret_protection.enabled),...Di("secret_protection.overrides",_.secret_protection.overrides),"secret_protection.deny_paths":Li(_.secret_protection.deny_paths),"secret_protection.allow_paths":Li(_.secret_protection.allow_paths),...I?{"audit.retention_days":String(_.audit.retention_days)}:{}}}function Jr(_,I,O){let L=sd(_,O),J=sd(I,O);return[...new Set([...Object.keys(L),...Object.keys(J)])].flatMap((K)=>L[K]===J[K]?[]:[{field:K,before:L[K],after:J[K]}])}function er(_,I){let O=d(_,I);if(!ad(O))return{baseline:C(globalThis.__CC_SAFETY_NET_EMBEDDED_POLICY__,_.home),diagnostics:[]};let L=mt(O),J=ft(L.value,_.home);return{baseline:J.policy,diagnostics:L.errors.length>0?L.errors:J.errors}}function mt(_){if(!ad(_))return{errors:[`${_}: file not found`]};try{return{value:JSON.parse(Jh(_,"utf-8")),errors:[]}}catch(I){let O=I instanceof Error?I.message:String(I);return{errors:[`${_}: ${I instanceof SyntaxError?`Invalid JSON: ${O}`:O}`]}}}function Wr(_,I){let O=Wh(_)?_:{};return{version:I.version,...Object.fromEntries(["safety","workflow","destructive_command_protection","secret_protection"].filter((L)=>O[L]!==void 0).map((L)=>[L,O[L]]))}}function Di(_,I){return Object.fromEntries(Object.entries(I).flatMap(([O,L])=>L===void 0?[]:[[`${_}.${O}`,String(L)]]))}function Li(_){return _.length===0?"(none)":_.join(", ")}function Wh(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}import{chmodSync as Kh,existsSync as ld,mkdirSync as Yh,readFileSync as cd}from"node:fs";import{dirname as Zh}from"node:path";function dd(_,I={}){let O=d(_,I);if(!ld(O))return{path:O,exists:!1,raw:"",policy:z(),errors:[]};let L=cd(O,"utf-8");if(!L.trim())return{path:O,exists:!0,raw:L,policy:z(),errors:["Config file is empty"]};try{let J=ft(JSON.parse(L),_.home);return{path:O,exists:!0,raw:L,policy:J.policy,errors:J.errors}}catch(J){return{path:O,exists:!0,raw:L,policy:z(),errors:[`Invalid JSON: ${J instanceof Error?J.message:String(J)}`]}}}function Fn(_,I,O={}){let L=d(_,O),J=ft(I,_.home);if(J.errors.length>0)return{path:L,policy:z(),errors:J.errors};let K=J.policy;return Yh(Zh(L),{recursive:!0,mode:448}),g(ie(L),`${JSON.stringify(K,null,2)}
|
|
273
|
+
`,384),Kh(L,384),{path:L,policy:K,errors:[]}}function ud(_,I){let O=ft(I,_.home);if(O.errors.length>0)return{errors:O.errors};return{preview:Ne(O.policy,_.env),errors:[]}}function pd(_,I={}){let O=d(_,I);if(!ld(O))return Fn(_,ee,I);let L=cd(O,"utf-8");if(!L.trim())return Fn(_,ee,I);try{return Fn(_,C(JSON.parse(L),_.home),I)}catch{return Fn(_,ee,I)}}var fd=new Set(["check","apply"]),md="(unset)";async function hd(_,I,O={}){let L=gn({label:"policy",booleans:{global:["-g","--global"]},positionals:"list"},I),J=L.positionals[0],K=[...L.errors,...J&&!fd.has(J)?[`Unknown policy subcommand: ${J}`]:[],...J&&fd.has(J)&&!L.positionals[1]?[`policy ${J} requires a file`]:[],...L.positionals.slice(2).map((we)=>`Unexpected policy argument: ${we}`)];if(K.length>0){for(let we of K)console.error(we);return 1}let ne=L.positionals[1];if(!J||!ne)return Pt(ar,console.error),1;let oe=L.flags.global?d(_):b(O.cwd??process.cwd()),de=mt(ne),ue=[...de.errors,...Qt(de.value,_.home).map((we)=>`${ne}: ${we}`),...!L.flags.global&&ry(de.value)&&de.value.audit!==void 0?[`${ne}: audit settings are user scope only; remove the audit section from a project proposal`]:[]];if(ue.length>0){for(let we of ue)console.error(we);return 1}let ve=C(de.value,_.home);if(console.log(`Scope: ${L.flags.global?"user":"project"} (${oe})`),console.log(`Proposal: ${ne}`),L.flags.global)gd(C(mt(oe).value,_.home),ve,!0);if(!L.flags.global){let we=er(_).baseline;console.log("Effective policy (user + project merged):"),gd(Q(we,le(mt(oe).value,_.home).policy).policy,Q(we,le(de.value,_.home).policy).policy,!1)}if(J==="check")return 0;let xe=O.input??process.stdin,Se=O.output??process.stdout;if(!xe.isTTY||!Se.isTTY)return console.error("policy apply confirms interactively; run this yourself in a terminal:"),console.error(` cc-safety-net policy apply ${ne}${L.flags.global?" --global":""}`),1;if(!await ny(`Apply this policy to ${oe}? [y/N] `,xe,Se))return console.log("Cancelled; nothing was written."),0;return ty(_,oe,de.value,ve,L.flags.global),console.log(`Policy applied: ${oe}`),0}function ny(_,I,O){let L=ey({input:I,output:O,terminal:!1});return new Promise((J)=>{L.once("close",()=>J(!1)),L.question(_,(K)=>{J(/^y(es)?$/i.test(K.trim())),L.close()})})}function ty(_,I,O,L,J){if(J){Fn(_,L);return}Xh(Qh(I),{recursive:!0}),bn(I,Wr(O,L))}function gd(_,I,O){let L=Jr(_,I,O);if(L.length===0){console.log("No changes.");return}console.log(`Changes (${L.length}):`);for(let J of L)console.log(` ${J.field}: ${J.before??md} -> ${J.after??md}`)}function ry(_){return!!_&&typeof _==="object"&&!Array.isArray(_)}import{join as hv}from"node:path";var yd="# Custom Rules Reference\n\nAgent reference for generating CC Safety Net rulebook configuration.\n\n## Config Locations\n\n| Scope | Config path | Rulebook path | Priority |\n|-------|-------------|---------------|----------|\n| User | `~/.cc-safety-net/rules/rule.json` | `~/.cc-safety-net/rules/<rulebook-name>/rulebook.json` | First |\n| Project | `.cc-safety-net/rules/rule.json` | `.cc-safety-net/rules/<rulebook-name>/rulebook.json` | Second |\n| GitHub source | Listed in a local `rule.json` | Vendored into the consumer's `<rulebook-name>/rulebook.json` by `rule add` | Source order |\n\nEvery rulebook is a live file: the runtime reads it on each tool call, so an edit applies to the next command with no publishing step.\n\nUser scope is evaluated before project scope; within a scope, sources apply in `rules` array order. A duplicate active rulebook name keeps the first claim and ignores the later rulebook with a warning, so a user-scoped name shadows a project-scoped one.\n\nUse `cc-safety-net rule init` to create an inert local config. Use `--global` for user scope. Use `cc-safety-net rule init --example` to also create an inactive example rulebook. `CC_SAFETY_NET_HOME` overrides the `~/.cc-safety-net` user root.\n\nLegacy inline `.safety-net.json` and `~/.cc-safety-net/config.json` files are not loaded at runtime. Convert them with `cc-safety-net rule migrate`.\n\n## rule.json Schema\n\n```json\n{\n \"version\": 1,\n \"rules\": [\"project-rules\", \"owner/repo#main/team-rules\"],\n \"overrides\": {\n \"project-rules/block-docker-system-prune\": {\n \"reason\": \"Use targeted Docker cleanup commands.\"\n },\n \"team-rules/block-npm-global\": \"off\"\n },\n \"transparent_wrappers\": [\"rtk\"]\n}\n```\n\n- `version`: Required. Must be `1`.\n- `$schema`: Optional. `cc-safety-net rule verify` inserts it into a valid `rule.json` that lacks it.\n- `rules`: Optional array of rulebook source strings. Missing `rules` is treated as `[]`.\n- `overrides`: Optional object keyed by `<rulebook-name>/<rule-name>`.\n- `overrides` values are either `\"off\"` to disable a rule or an object with a required `reason` (replacement block reason) and an optional `intent` (one of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain`).\n- A project override cannot target a user-scoped rule: only that override is ignored, the user rule keeps its configured state, and `rule verify` reports the diagnostic as a failure.\n- `transparent_wrappers`: Optional array of command names that transparently execute a visible child command.\n- `exec`, `nice`, `nohup`, `setsid`, `stdbuf`, `time`, and `timeout` are built-in transparent wrappers and need no configuration. Configure only other wrappers you intentionally trust, such as `\"rtk\"`.\n- Use `cc-safety-net rule wrapper add rtk` to configure RTK without manually editing `rule.json`.\n\n## Rulebook Sources\n\n- Local sources are bare rulebook names such as `project-rules`; the rulebook file is `.cc-safety-net/rules/project-rules/rulebook.json`.\n- Run `cc-safety-net rule add owner/repo` to add every rulebook currently present on the repository's default branch.\n- Use `--only` to select one or more rulebooks while preserving their order: `cc-safety-net rule add owner/repo --only aws gcloud`.\n- Use `--ref` to select a branch, tag, or commit instead of the default branch: `cc-safety-net rule add owner/repo --ref v2 --only aws`.\n- GitHub sources are stored in canonical form as `owner/repo#ref/<rulebook-name>`. That form remains valid in `rule.json` and as direct CLI input.\n- GitHub refs may contain `/`-separated path segments, such as `feature/rulebook-v2`.\n- The GitHub source name, the repository directory name, and the rulebook `name` must match exactly.\n- Rulebook source strings must be unique in a config.\n\n## rulebook.json Schema\n\n```json\n{\n \"rulebook_version\": 1,\n \"name\": \"project-rules\",\n \"version\": \"1.0.0\",\n \"description\": \"Project-specific CC Safety Net rules.\",\n \"author\": \"project\",\n \"allowed_commands\": [\"docker\"],\n \"rules\": [\n {\n \"name\": \"block-docker-system-prune\",\n \"command\": \"docker\",\n \"subcommand\": \"system\",\n \"block_args\": [\"prune\"],\n \"reason\": \"Use targeted cleanup instead.\"\n }\n ],\n \"tests\": [\n {\n \"command\": \"docker system prune\",\n \"expect\": \"blocked\",\n \"rule\": \"block-docker-system-prune\"\n },\n {\n \"command\": \"docker ps\",\n \"expect\": \"allowed\"\n }\n ]\n}\n```\n\n### Rulebook Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `rulebook_version` | Yes | Must be `1` or `2` |\n| `name` | Yes | `^[a-zA-Z][a-zA-Z0-9_-]{0,63}$` |\n| `version` | Yes | Non-empty string |\n| `description` | No | Free text; not type-checked at runtime |\n| `author` | No | Free text; not type-checked at runtime |\n| `allowed_commands` | Yes | Unique command names matching `^[a-zA-Z][a-zA-Z0-9_-]*$` |\n| `rules` | Yes | Array of rule objects |\n| `tests` | No | Array of fixtures |\n\n### Rule Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Unique within the rulebook (case-insensitive); same pattern as rulebook `name` |\n| `command` | Yes | Must be listed in `allowed_commands`; basename only, not path |\n| `subcommand` | No | Same pattern as `command`; omit to match any subcommand |\n| `intent` | No | One of `hard_stop`, `use_alternative`, `scope_down`, `manual_only`, `stop_and_explain` |\n| `block_args` | Yes | Non-empty array of non-empty strings |\n| `reason` | Yes | Non-empty string, max 256 chars |\n\n### Rule Fields (`rulebook_version` 2)\n\nVersion 2 replaces `subcommand` and `block_args` with an exact-token `match` object. Version 1 rulebooks keep their fields and their behavior; a client that does not support version 2 rejects the rulebook instead of applying broader version 1 semantics.\n\n```json\n{\n \"name\": \"block-terraform-apply-destroy\",\n \"command\": \"terraform\",\n \"match\": {\n \"command_path\": [\"apply\"],\n \"any_args\": [\"-destroy\", \"--destroy\"]\n },\n \"reason\": \"Review a destroy plan first with 'terraform plan -destroy'.\",\n \"intent\": \"use_alternative\"\n}\n```\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `name` | Yes | Same as version 1 |\n| `command` | Yes | Same as version 1 |\n| `match.command_path` | Yes | Non-empty array of non-empty command words |\n| `match.any_args` | No | Non-empty array of unique non-empty argument tokens |\n| `match.exclude_args` | No | Non-empty array of unique non-empty argument tokens |\n| `intent` | No | Same as version 1 |\n| `reason` | Yes | Same as version 1 |\n\n### Matching Behavior (`rulebook_version` 2)\n\n- **Command**: Normalized to lowercase basename, as in version 1.\n- **Command path**: After recognized global options and their values are skipped, the next command words must equal `command_path` exactly. AWS, gcloud, and Azure CLI value-taking global options are built in; Terraform's `-chdir=dir` is `=`-joined and is skipped with its own token.\n- **Unrecognized options**: A token starting with `-` that is not a recognized global option is skipped without consuming a value, so an unlisted value-taking option with a separate value (`--newflag value`) makes the rule miss. This fails open deliberately; document such gaps in the rulebook.\n- **`any_args`**: At least one listed token must appear literally among the arguments.\n- **`exclude_args`**: Any listed token appearing literally among the arguments prevents the match, which is how a safe preview such as `aws s3 rm --dryrun` stays allowed.\n- **No short-option expansion**: Arguments compare as exact tokens, so list every accepted spelling (`\"-destroy\"` and `\"--destroy\"`).\n- **Literal and case-sensitive**: No regex, glob, or substring matching. The first matching rule wins.\n- Release channels are separate rules: `gcloud beta compute instances delete` needs its own `command_path`.\n\n### Test Fixture Fields\n\n| Field | Required | Constraints |\n|-------|----------|-------------|\n| `command` | Yes | Non-empty shell command string |\n| `expect` | Yes | `\"blocked\"` or `\"allowed\"` |\n| `rule` | Required for blocked fixtures | Rule name expected to block the command |\n\nFixtures are optional documentation of intended behavior. Version 1 fixtures are shape-validated only. Version 2 fixtures are evaluated against the rulebook's own rules when a source is fetched by `rule add` or `rule update`, and by `rule verify`; a failing fixture rejects that source before it is written. Loading a rulebook does not re-evaluate fixtures. CC Safety Net never executes fixture commands; they are analyzer inputs only.\n\n## Matching Behavior\n\nThe subcommand, argument, and option rules below describe `rulebook_version` 1 rules; version 2 rules match as described in Matching Behavior (`rulebook_version` 2). Execution order and transparent wrappers apply to both.\n\n- **Command**: Normalized to lowercase basename with any trailing `.exe` removed (`/usr/bin/git` → `git`).\n- **Subcommand**: The first command token after recognized Git and Docker global options and their values; `--` ends option parsing. An unrecognized option without `=` may consume the following token as its value.\n- **Arguments**: Each `block_args` value is compared literally against every command token, including expanded short options. The command is blocked if **any** item matches.\n- **Short options**: Expanded (`-Ap` matches `-A`).\n- **Long options**: Exact match (`--all-files` does not match `--all`).\n- **Execution order**: Built-in rules first, then custom rulebooks. Custom rules only add restrictions.\n- **Transparent wrappers**: A configured wrapper such as `rtk` lets `rtk git commit` be analyzed as `git commit` only when `git` is protected by built-in analyzers or active custom rules. `rtk -- git commit` is also supported.\n\n## Workflow\n\n1. Run `cc-safety-net rule init` or create `rule.json` manually.\n2. Optionally run `cc-safety-net rule init --example` to create an inactive example rulebook.\n3. Use `cc-safety-net rule wrapper add rtk` for trusted transparent wrappers.\n4. Run `cc-safety-net rule add <source>` after creating or choosing a rulebook source; add `--only <rulebook...>` or `--ref <ref>` for repository selection. The command adds the selected sources and syncs them.\n5. Edit a local rulebook whenever you like: the edit is enforced on the next command, so there is nothing to run afterwards.\n6. Run `cc-safety-net rule update [source]` to re-fetch remote sources and rewrite the vendored copies; the command prints what changed. A source with an ordinary update failure keeps its vendored copy while the other selected sources still update. Resource-limit failures remain fatal for the whole update.\n7. Run `cc-safety-net rule verify` to validate config, local rulebooks, and shareable GitHub-source rulebook directories in the current repository (it does not fetch remote content).\n8. Run `cc-safety-net rule list` to inspect active rulebooks and transparent wrappers.\n\nA missing or invalid rulebook file makes that source inactive, and an unreadable or invalid `rule.json` makes every source in its scope inactive. Inactive sources stop applying their rules while other custom rules and all built-in protections stay active. Fix the file named in the diagnostic, or run `cc-safety-net rule update` when a remote source has not been vendored yet. Run `cc-safety-net status` to see degraded sources.\n";function Kr(_,I){if(!_.ok){xd(_);return}wd(_,I)}function bd(_,I,O){if(_.ok)console.log(O);if(!_.add){Kr(_,`Added rulebook source: ${I}`);return}if(!_.ok){xd(_);return}if(_.add.added.length>0)console.log(`Added ${_.add.added.length} ${_.add.added.length===1?"rulebook":"rulebooks"} from ${_.add.source} at ${_.add.ref}:`),_.add.added.forEach((L)=>{console.log(` - ${L}`)});if(_.add.alreadyConfigured.length>0)console.log(`Rulebooks already configured from ${_.add.source} at ${_.add.ref}: ${_.add.alreadyConfigured.join(", ")}`);if(_.add.commits.length>0)console.log(`Vendored at ${_.add.commits.map((L)=>L.slice(0,7)).join(", ")}.`);wd(_,"Rule config updated.")}function wd(_,I){for(let O of _.changes??[])console.log(O);console.log(I),console.log(""),oy(_.entries)}function oy(_){if(_.length===0){console.log("Active rulebooks: (none)");return}console.log(`Active rulebooks (${_.length}):`);for(let I of _)console.log(` - ${I.name} ${I.version} (${iy(I.ruleCount)})`),console.log(` Source: ${I.spec}`)}function iy(_){return`${_} ${_===1?"rule":"rules"}`}function kd(_){gt("Active sources",_.rulebooks,(I)=>[`[${I.source}] ${I.name} ${I.version}`,` Source: ${I.spec}`]),gt("Active rules",_.rules,(I)=>[`[${ay(_,I.name)}] ${I.name}`,...sy(I),` Reason: ${I.reason}`]),gt("Disabled rules",vd(_,"off"),(I)=>[I.key]),gt("Reason overrides",vd(_,"reason"),(I)=>[I.key,` Reason: ${I.value.reason}`]),gt("Transparent wrappers",_.transparent_wrappers,(I)=>[I]),gt("Issues",_.errors,(I)=>[I]),gt("Warnings",_.warnings,(I)=>[I])}function gt(_,I,O){if(I.length===0){console.log(`${_}: (none)`);return}console.log(`${_} (${I.length}):`);for(let L of I){let[J,...K]=O(L);console.log(` - ${J}`);for(let ne of K)console.log(` ${ne}`)}}function sy(_){if(!_.match)return[` Command: ${_.subcommand?`${_.command} ${_.subcommand}`:_.command}`,` Block args: ${_.block_args.join(", ")}`];return[` Command: ${[_.command,..._.match.command_path].join(" ")}`,..._.match.any_args?[` Any args: ${_.match.any_args.join(", ")}`]:[],..._.match.exclude_args?[` Exclude args: ${_.match.exclude_args.join(", ")}`]:[]]}function ay(_,I){return _.rulebooks.find((O)=>O.rules.includes(I))?.source??"project"}function vd(_,I){return Object.entries({..._.userConfig?.overrides,..._.projectConfig?.overrides}).filter((O)=>{if(I==="off")return O[1]==="off";return!!O[1]&&typeof O[1]==="object"}).map(([O,L])=>({key:O,value:L}))}function xd(_){for(let I of _.errors)console.error(I)}import{dirname as Vd,join as ro}from"node:path";import{join as Mi,resolve as by}from"node:path";function Ni(_){let I=m(_);if(I.errors.length>0)return{ok:!1,result:{ok:!1,errors:I.errors,entries:[]}};return{ok:!0,config:I.config??lt}}function Sd(_){bn(_,{version:1,rules:[],overrides:{},transparent_wrappers:[]})}function Cd(_){bn(_,{rulebook_version:1,name:"example-rules",version:"1.0.0",description:"Project-specific CC Safety Net rules.",author:"project",allowed_commands:["docker"],rules:[{name:"block-docker-system-prune",command:"docker",subcommand:"system",block_args:["prune"],reason:"Use targeted cleanup instead."}],tests:[{command:"docker system prune",expect:"blocked",rule:"block-docker-system-prune"}]})}import{dirname as Qr}from"node:path";var ly="custom.";function Yr(_){if(_.rulebook_version!==2)return[];let I=_.rules.map((O)=>({name:O.name,command:O.command,block_args:[],match:O.match,reason:O.reason,intent:O.intent}));return(_.tests??[]).flatMap((O,L)=>{let J=ji(h(O.command));if(J.length===0)return[`tests[${L}]: could not parse fixture command: ${O.command}`];let K=J.reduce((ne,oe)=>ne??A(oe,I)?.id.slice(ly.length),void 0);if(O.expect==="blocked"){if(K===O.rule)return[];let ne=K?`"${K}" matched first`:"no rule matched";return[`tests[${L}]: expected "${O.rule}" to block "${O.command}" but ${ne}`]}return K?[`tests[${L}]: expected "${O.command}" to be allowed but "${K}" matched`]:[]})}function ji(_){return _.nodes.flatMap((I)=>{if(I.kind==="group"||I.kind==="function")return ji(I.body);if(I.kind!=="command")return[];let O=be(te(I.dialect,I.words)).words.map(t);return[...O.length>0?[O]:[],...I.nested.flatMap((L)=>ji(L))]})}var Zr=Object.freeze({concurrency:4,maxRequests:131,maxResponseBytes:67108864});function Xr(_={}){return{requests:0,responseBytes:0,maxRequests:_.maxRequests??Zr.maxRequests,maxResponseBytes:_.maxResponseBytes??Zr.maxResponseBytes}}function Hn(_){return{controller:new AbortController,budget:Xr(),resolveUrl:_}}function Rd(_){return _ instanceof Error&&_.message==="Rule synchronization exceeds CC Safety Net's safe resource limits."}function Pd(_){if(_.requests>=_.maxRequests)throw Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");_.requests++}function Ed(_,I){if(I>_.maxResponseBytes-_.responseBytes)throw _.responseBytes+=I,Error("Rule synchronization exceeds CC Safety Net's safe resource limits.");_.responseBytes+=I}var Id=Object.freeze({timeoutMs:15000,metadataBytes:524288,commitBytes:262144,treeBytes:16777216,rawBytes:4194304});async function Ad(_,I,O=v(Qr(Qr(I)),"rules policy"),L=Hn()){if(S(_))return py(_,L);return uy(_,I,O)}async function Td(_,I,O,L,J,K){if(!S(_))return Ad(_,I,O,L);let ne=J?null:cy(_,I,O);if(ne)return ne;if(!J&&!K)throw Error(`${_} is not vendored; run rule update ${_} to vendor it`);return Ad(_,I,O,L)}function cy(_,I,O=v(Qr(Qr(I)),"rules policy")){let L=D(_),J=N(I,L.name),K=n(i(O,J));if(K===null)return null;let ne=ce(Fi(K,`Invalid rulebook ${J}.`));if(ne.name!==L.name)throw Error(`rulebook name "${ne.name}" in ${J} must match "${L.name}"`);return{spec:_,rulebook:ne,content:K}}async function $d(_,I={}){if(!Y(_))throw Error(`Invalid GitHub repository source: ${_}`);let[O,L]=_.split("/");if(!O||!L)throw Error(`Invalid GitHub repository source: ${_}`);if(I.ref!==void 0&&!se(I.ref))throw Error(`GitHub rulebook refs must use valid path segments: ${I.ref}`);let J=I.operation??Hn(),K=I.ref??await dy(O,L,_,J),ne=await Dd(O,L,K,_,J),oe=await eo(`https://api.github.com/repos/${O}/${L}/git/trees/${ne}?recursive=1`,"tree",J),de=oe.response;if(!de.ok)throw Error(`Failed to inspect ${_}: GitHub tree returned ${de.status}`);let ue=JSON.parse(oe.content);if(!Array.isArray(ue?.tree))throw Error(`Failed to inspect ${_}: unexpected GitHub tree response`);let ve=ue.tree,xe=[...new Set(ve.flatMap((Se)=>{if(!Se||typeof Se!=="object")return[];let Pe=Se;if(Pe.type!=="blob"||typeof Pe.path!=="string")return[];let we=Pe.path.match(at);return we?.[1]?[we[1]]:[]}))].sort();if(xe.length===0)throw Error(`No rulebooks found in ${_} under ${me}/`);return{source:_,owner:O,repo:L,ref:K,commit:ne,names:xe}}async function dy(_,I,O,L){let J=await eo(`https://api.github.com/repos/${_}/${I}`,"metadata",L),K=J.response;if(!K.ok)throw Error(`Failed to inspect ${O}: GitHub returned ${K.status}`);let oe=JSON.parse(J.content)?.default_branch;if(typeof oe!=="string"||oe==="")throw Error(`Failed to inspect ${O}: missing default branch`);if(!se(oe))throw Error(`GitHub returned an invalid default branch: ${oe}`);return oe}function uy(_,I,O){ct(_);let L=N(I,_),J=n(i(O,L));if(J===null)throw Error(`Rulebook source not found: ${_}`);let K=Od(Fi(J,"Invalid local rulebook source."));if(K.name!==_)throw Error(`rulebook name "${K.name}" must match local source "${_}"`);return{spec:_,rulebook:K,content:J}}async function py(_,I){let O=D(_),L=await Dd(O.owner,O.repo,O.ref,_,I),J=await eo(`https://raw.githubusercontent.com/${O.owner}/${O.repo}/${L}/${O.path}`,"raw",I),K=J.response;if(!K.ok)throw Error(`Failed to fetch ${_}: GitHub raw returned ${K.status}`);let ne=J.content,oe=Od(Fi(ne,"Invalid GitHub rulebook response."));if(oe.name!==O.name)throw Error(`rulebook name "${oe.name}" must match GitHub source "${O.name}"`);return{spec:_,rulebook:oe,content:ne}}function Od(_){let I=ce(_),O=Yr(I);if(O.length>0)throw Error(O.join("; "));return I}function Fi(_,I){try{return JSON.parse(_)}catch{throw Error(I)}}async function Dd(_,I,O,L,J){let K=await eo(`https://api.github.com/repos/${_}/${I}/commits/${encodeURIComponent(O)}`,"commit",J),ne=K.response;if(!ne.ok)throw Error(`Failed to resolve ${L}: GitHub returned ${ne.status}`);let oe=JSON.parse(K.content);if(typeof oe?.sha!=="string"||oe.sha==="")throw Error(`Failed to resolve commit for ${L}`);return oe.sha}async function fy(_,I,O={}){if(O.signal?.aborted)throw O.signal.reason;let L=O.budget??Xr(),J=new AbortController,K=()=>J.abort(O.signal?.reason);O.signal?.addEventListener("abort",K,{once:!0});let ne=!1,oe=setTimeout(()=>{if(J.signal.aborted)return;ne=!0,J.abort()},O.timeoutMs??Id.timeoutMs);try{if(O.signal?.aborted)throw O.signal.reason;Pd(L);let de=await fetch(_,{signal:J.signal,redirect:"error"});if(!de.ok)return Ld(de),{response:de,content:""};return{response:de,content:await my(de,I,L,()=>J.abort())}}catch(de){if(ne)throw Error("GitHub request timed out",{cause:de});if(O.signal?.aborted)throw O.signal.reason;throw de}finally{clearTimeout(oe),O.signal?.removeEventListener("abort",K)}}function eo(_,I,O){return fy(O.resolveUrl?.(_)??_,I,{budget:O.budget,signal:O.controller.signal})}async function my(_,I,O=Xr(),L){let J=Id[`${I}Bytes`],K=Number(_.headers.get("content-length"));if(Number.isFinite(K)&&K>J)throw Ld(_),Error(`GitHub ${I} response exceeds ${J} bytes`);if(!_.body)return"";let ne=_.body.getReader(),oe=[],de=0;while(!0){let ue=await ne.read();if(ue.done)break;try{Ed(O,ue.value.byteLength)}catch(ve){throw L?.(),_d(ne),ve}if(de+=ue.value.byteLength,de>J)throw L?.(),_d(ne),Error(`GitHub ${I} response exceeds ${J} bytes`);oe.push(Buffer.from(ue.value))}return Buffer.concat(oe,de).toString("utf-8")}function Ld(_){if(!_.body)return;Nd(()=>_.body?.cancel())}function _d(_){Nd(()=>_.cancel())}function Nd(_){try{Promise.resolve(_()).catch(()=>{})}catch{}}var gy=/^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)#(.+)$/;function jd(_,I){let O=Md(_.rules,I);if(O.length>0)return{ok:!0,specs:O};return Hd(_.rules,I)}function Fd(_,I){let O=Md(_,I);if(O.length>0)return{ok:!0,specs:O};let L=yy(_,I);if(L.length>0)return{ok:!0,specs:L};let J=vy(_,I);if(!J.ok)return J;if(J.specs.length>0)return{ok:!0,specs:J.specs};return Hd(_,I)}function Hd(_,I){let O=_.filter((L)=>Hi(L)?.name===I);if(O.length===1)return{ok:!0,specs:O};return hy(I,O)}function hy(_,I){return{ok:!1,result:{ok:!1,errors:I.length===0?[`No configured rulebook matches ${_}`]:[`Ambiguous rulebook match ${_}: ${I.join(", ")}`],entries:[]}}}function Md(_,I){return _.filter((O)=>O===I)}function yy(_,I){let O=I.match(gy),L=O?.[1],J=O?.[2],K=O?.[3];if(!L||!J||!K||!se(K))return[];return Ud(_,(ne)=>ne.owner===L&&ne.repo===J&&ne.ref===K)}function vy(_,I){if(!Y(I))return{ok:!0,specs:[]};let[O,L]=I.split("/"),J=Ud(_,(ne)=>ne.owner===O&&ne.repo===L);if(new Set(J.map((ne)=>Hi(ne)?.ref).filter((ne)=>!!ne)).size<2)return{ok:!0,specs:J};return{ok:!1,result:{ok:!1,errors:[`Multiple refs are configured for ${I}. Use an explicit ref:`,` cc-safety-net rule remove ${I}#<ref>`],entries:[]}}}function Hi(_){try{return D(_)}catch{return null}}function Ud(_,I){return _.filter((O)=>{let L=Hi(O);return L?I(L):!1})}async function to(_,I={}){let O=Ui(I);return wy(_,O,await no(_,O,Hn()))}function wy(_,I,O){if(!O.ok)return O;let L=wn(_,I),J=[...new Set(H(L.configPath,L.filesystemScope))];if(J.length===0)return O;return{ok:!1,errors:J,entries:O.entries}}async function no(_,I,O,L={},J=new Set,K=new Set){try{let ne=wn(_,I),oe=Ni(ne.configTarget);if(!oe.ok)return oe.result;let de=oe.config,ue=I.only?jd(de,I.only):{ok:!0,specs:de.rules};if(!ue.ok)return ue.result;let ve=new Set([...I.refresh?ue.specs:[],...J]),xe=(rn)=>Td(rn,ne.configDir,ne.filesystemScope,O,ve.has(rn),!I.refresh||ve.has(rn)),Se=await Ty(de.rules,I.refresh?(rn)=>xe(rn).then((pn)=>({ok:!0,item:pn})).catch((pn)=>{if(Rd(pn))throw pn;return{ok:!1,spec:rn,message:pn instanceof Error?pn.message:String(pn)}}):async(rn)=>({ok:!0,item:await xe(rn)}),O),Pe=Se.filter((rn)=>!rn.ok),we=Se.filter((rn)=>rn.ok).map((rn)=>rn.item),Le=we.flatMap((rn)=>ky(rn,de.rules)),en=we.flatMap((rn)=>xy(rn,K,ne)),Ve=new Set([...Le,...en].map((rn)=>rn.spec)),on=[...Pe,...Le,...en],sn=[],an=Cy(sn,()=>we.flatMap((rn)=>Ve.has(rn.spec)||on.length>0&&K.has(rn.spec)?[]:Sy(rn,ne,L,sn)));return{ok:on.length===0,errors:on.map((rn)=>`Failed to update ${rn.spec}: ${rn.message}`),entries:we.map(Py),changes:an}}catch(ne){return tr(ne)}}function ky(_,I){if(!S(_.spec))return[];let O=De(_.spec),L=I.filter((J)=>J!==_.spec&&De(J).toLowerCase()===O.toLowerCase());if(L.length===0)return[];return[{ok:!1,spec:_.spec,message:`rulebook name "${O}" is also claimed by ${L.join(", ")}; rename one of them`}]}function xy(_,I,O){if(!I.has(_.spec)||!S(_.spec))return[];let L=N(O.configDir,_.rulebook.name),J=n(i(O.filesystemScope,L));if(J===null||J===_.content)return[];return[{ok:!1,spec:_.spec,message:`${L} already exists and no configured source claims it; remove or rename the file, then re-run rule add`}]}function Sy(_,I,O,L){if(!S(_.spec))return[];let J=N(I.configDir,_.rulebook.name),K=i(I.filesystemScope,J),ne=n(K);if(ne===_.content)return[];return L?.push({target:K,previous:ne}),g(K,_.content,void 0,O._testAfterPolicyRename),Ry(_,ne)}function Cy(_,I){try{return I()}catch(O){for(let L of[..._].reverse()){if(L.previous===null){j(L.target);continue}g(L.target,L.previous)}throw O}}function Ry(_,I){if(I===null)return[`Vendored ${_.spec} (${_.rulebook.version})`];let O=ye(I),L="problem"in O?null:O.rulebook,J=new Map(L?.rules.map((ne)=>[ne.name,JSON.stringify(ne)])??[]),K=new Set(_.rulebook.rules.map((ne)=>ne.name));return[`Updated ${_.spec} (${L?.version??"unreadable"} -> ${_.rulebook.version})`,...[...K].filter((ne)=>!J.has(ne)).map((ne)=>` + ${ne}`),...[...J.keys()].filter((ne)=>!K.has(ne)).map((ne)=>` - ${ne}`),..._.rulebook.rules.filter((ne)=>{let oe=J.get(ne.name);return oe!==void 0&&oe!==JSON.stringify(ne)}).map((ne)=>` ~ ${ne.name}`)]}function Py(_){return{spec:_.spec,name:_.rulebook.name,version:_.rulebook.version,ruleCount:_.rulebook.rules.length}}async function Gd(_,I,O={}){return Ey(_,I,Oy(O),Hn())}async function Ey(_,I,O,L,J={}){let K=null,ne=!1;try{let oe=wn(_,O),de=n(oe.configTarget);K={target:oe.configTarget,content:de};let ue=Ni(oe.configTarget);if(!ue.ok)return ue.result;let ve=ue.config,xe=Y(I);Ay(I,O,xe);let Se=xe?await $d(I,{ref:O.ref,operation:L}):null,Pe=Se?_y(Se,O.rulebooks):[],we=Se?Pe.map((sn)=>Iy(ve.rules,Se,sn)??`${I}#${Se.ref}/${sn}`):[I],Le=we.filter((sn)=>!ve.rules.includes(sn)),en=[...ve.rules,...Le];if(en.length>ge)return $y();if(en.length!==ve.rules.length)ne=!0,bn(oe.configTarget,{version:1,rules:en,overrides:ve.overrides??{},transparent_wrappers:ve.transparent_wrappers??[]},void 0,J._testAfterPolicyRename);let Ve=await no(_,O,L,J,new Set(Le),new Set(Le));if(!Ve.ok)nr(oe.configTarget,de);if(!Ve.ok||!Se)return Ve;let on=Pe.filter((sn,an)=>Le.includes(we[an]??""));return{...Ve,add:{source:I,ref:Se.ref,selected:Pe,added:on,alreadyConfigured:Pe.filter((sn)=>!on.includes(sn)),commits:Le.length>0?[Se.commit]:[]}}}catch(oe){if(ne&&K)try{nr(K.target,K.content)}catch(de){return tr(de)}return tr(oe)}}function Ay(_,I,O){if(!O&&I.rulebooks!==void 0)throw Error("--only can only select rulebooks from an owner/repo source");if(!O&&I.ref)throw Error(`--ref can only select a ref for an owner/repo source: ${_}`);if(I.rulebooks?.length===0)throw Error("--only requires at least one rulebook name");let L=I.rulebooks?.filter((J)=>!u.test(J))??[];if(L.length>0)throw Error(`Invalid rulebook names: ${L.join(", ")}`)}function _y(_,I){let O=I?[...new Set(I)]:_.names,L=O.filter((J)=>!_.names.includes(J));if(L.length>0)throw Error(`Rulebooks not found in ${_.source} at ${_.ref}: ${L.join(", ")}
|
|
274
|
+
Available rulebooks: ${_.names.join(", ")}`);return O}function Iy(_,I,O){let L=`${I.source}#${I.ref}/${O}`;if(_.includes(L))return L;let J=`${I.source}#${I.commit}/${O}`;return _.find((K)=>K===J)}async function Ty(_,I,O=Hn()){if(_.length>ge)throw Error(he);let L=[],J=0,K,ne=Array.from({length:Math.min(_.length,Zr.concurrency)},async()=>{while(!K){let oe=J;if(oe>=_.length)return;J++;try{L[oe]=await I(_[oe],oe,O.controller.signal)}catch(de){if(!K)K={value:de},J=_.length,O.controller.abort(de);return}}});if(await Promise.all(ne),K)throw K.value;return L}function $y(){return{ok:!1,errors:[he],entries:[]}}function Ui(_){return{cwd:_.cwd,userConfigDir:_.userConfigDir,userConfigPath:_.userConfigPath,projectConfigPath:_.projectConfigPath,global:_.global,only:_.only,refresh:_.refresh}}function Oy(_){return{...Ui(_),ref:_.ref,rulebooks:_.rulebooks}}function Dy(_){return{...Ui(_),deleteSource:_.deleteSource}}async function Bd(_,I,O={}){try{return await Ly(_,I,Dy(O),{})}catch(L){return tr(L)}}async function Ly(_,I,O,L){let J=wn(_,O),K=m(J.configTarget);if(K.errors.length>0)return{ok:!1,errors:K.errors,entries:[]};if(!K.config)return{ok:!1,errors:[`No config found at ${J.configPath}`],entries:[]};let ne=Fd(K.config.rules,I);if(!ne.ok)return ne.result;let oe=O.deleteSource?Ny(J.configDir,ne.specs,J.filesystemScope):{ok:!0,dirs:[]};if(!oe.ok)return oe.result;let de=n(J.configTarget);if(de===null)return tr(Error("Rules config is unavailable."));try{bn(J.configTarget,{version:1,rules:K.config.rules.filter((xe)=>!ne.specs.includes(xe)),overrides:K.config.overrides??{},transparent_wrappers:K.config.transparent_wrappers??[]},void 0,L._testAfterPolicyRename)}catch(xe){throw nr(J.configTarget,de),xe}let ue=await no(_,O,Hn(),L);if(!ue.ok)return nr(J.configTarget,de),ue;let ve=jy(oe.dirs,L,J.filesystemScope);if(!ve.ok){nr(J.configTarget,de);let xe=await no(_,O,Hn(),L);if(!xe.ok)return{ok:!1,errors:[...ve.result.errors,...xe.errors],entries:xe.entries};return ve.result}return ue}function Ny(_,I,O){let L=I.flatMap((oe)=>u.test(oe)?[]:["--delete-source can only delete local rulebook sources"]),J=I.map((oe)=>Mi(_,oe)),K=L.length>0?[]:J.flatMap((oe)=>qd(oe,O)),ne=[...L,...K];return ne.length>0?{ok:!1,result:{ok:!1,errors:ne,entries:[]}}:{ok:!0,dirs:J}}function qd(_,I){let O=by(_),L=i(I,O),J=pe(L);if(!J)return[`Local rulebook source directory not found: ${_}`];let K=J.find((ne)=>ne.name==="rulebook.json");if(!K)return[`Local rulebook source directory is missing rulebook.json: ${_}`];if(K.kind!=="file")throw new r(I.label);if(n(i(I,Mi(O,"rulebook.json"))),J.length>1)return[`Local rulebook source directory contains extra files: ${_}. delete manually if you really want to remove the directory.`];return[]}function jy(_,I,O){let L=_.flatMap((J)=>{try{if(!pe(i(O,J)))return[];let K=qd(J,O);if(K.length>0)return K;return Fy(J,I,O),[]}catch(K){return[`Failed to delete local rulebook source ${J}: ${K instanceof Error?K.message:String(K)}`]}});return L.length>0?{ok:!1,result:{ok:!1,errors:L,entries:[]}}:{ok:!0}}function Fy(_,I,O){if(I._testDeleteLocalSourceDir){I._testDeleteLocalSourceDir(_);return}j(i(O,Mi(_,fe))),st(i(O,_))}function nr(_,I){if(I===null){j(_);return}g(_,I)}function tr(_){return{ok:!1,errors:[_ instanceof Error?_.message:String(_)],entries:[]}}var Hy=".safety-net.json",My="~/.cc-safety-net/config.json";async function Wd(_,I){return[await zd(_,{legacyPath:Ys({cwd:I.cwd}),configPath:U(I.cwd),defaultRulebookName:"project-rules",migratedFrom:Hy,cleanup:I.cleanup,syncOptions:{cwd:I.cwd}}),await zd(_,{legacyPath:ur(_),configPath:G(_),defaultRulebookName:"user-rules",migratedFrom:My,cleanup:I.cleanup,syncOptions:{cwd:I.cwd,global:!0}})].every((L)=>L)?0:1}async function zd(_,I){let O=wn(_,I.syncOptions),L=i(O.filesystemScope,I.legacyPath),J=n(L);if(J===null)return console.log(`No legacy config found at ${I.legacyPath}`),!0;let K=Gy(J);if(!K.ok){for(let Pe of K.errors)console.error(Pe);return!1}let ne=m(O.configTarget);if(ne.errors.length>0){for(let Pe of ne.errors)console.error(Pe);return!1}let oe=ne.config??{version:1,rules:[],overrides:{},transparent_wrappers:[]},de=By(Vd(I.configPath),oe.rules,I.defaultRulebookName,I.migratedFrom,O.filesystemScope),ue=ro(Vd(I.configPath),de,"rulebook.json"),ve=i(O.filesystemScope,ue),xe=[Jd(O.configTarget),Jd(ve)],Se=await Uy(_,I,O.configTarget,ve,de,K.config.rules,oe.rules.includes(de)?oe.rules:[...oe.rules,de],oe.overrides??{},oe.transparent_wrappers??[]);if(!Se.ok){zy(xe);for(let Pe of Se.errors)console.error(Pe);return!1}if(!I.cleanup)return console.log(`Migrated legacy config at ${I.legacyPath}. Legacy file is no longer used.`),!0;if(!Vy(O.configTarget,ve,de,I.migratedFrom,K.config.rules))return console.error(`Migration cleanup verification failed for ${I.legacyPath}`),!1;return j(L),console.log(`Deleted legacy config at ${I.legacyPath}`),!0}async function Uy(_,I,O,L,J,K,ne,oe,de){try{return bn(O,{version:1,rules:ne,overrides:oe,transparent_wrappers:de}),bn(L,qy(J,I.migratedFrom,K)),await to(_,I.syncOptions)}catch(ue){return{ok:!1,errors:[ue instanceof Error?ue.message:String(ue)]}}}function Gy(_){try{let I=JSON.parse(_),O=go(I);if(O.errors.length>0)return{ok:!1,errors:O.errors};return{ok:!0,config:{version:1,rules:I.rules??[]}}}catch{return{ok:!1,errors:["Invalid JSON"]}}}function By(_,I,O,L,J){let K=I.find((ne)=>Jy(i(J,ro(_,ne,"rulebook.json")))===L);if(K)return K;if(n(i(J,ro(_,O,"rulebook.json")))===null)return O;for(let ne=2;;ne++){let oe=`${O}-${ne}`;if(n(i(J,ro(_,oe,"rulebook.json")))===null)return oe}}function qy(_,I,O){return{rulebook_version:1,name:_,version:"1.0.0",description:"Migrated CC Safety Net rules.",author:"project",migrated_from:I,allowed_commands:[...new Set(O.map((L)=>L.command))],rules:O,tests:O.map((L)=>({command:[L.command,L.subcommand,L.block_args[0]].filter(Boolean).join(" "),expect:"blocked",rule:L.name}))}}function Vy(_,I,O,L,J){if(!m(_).config?.rules.includes(O))return!1;try{let ne=n(I);if(ne===null)return!1;let oe=JSON.parse(ne);return oe.migrated_from===L&&JSON.stringify(oe.rules)===JSON.stringify(J)}catch{return!1}}function Jd(_){return{target:_,content:n(_)}}function zy(_){for(let I of _){if(I.content===null){j(I.target);continue}g(I.target,I.content)}}function Jy(_){let I=n(_);if(I===null)return null;try{let O=JSON.parse(I);return typeof O.migrated_from==="string"?O.migrated_from:null}catch{return null}}import{mkdir as Wy,readFile as Ky,writeFile as Yy}from"node:fs/promises";import{dirname as Zy,join as Xy}from"node:path";var Qy=86400000,ev=604800000;async function Yd(_,I=Date.now()){if(_.env.get("CC_SAFETY_NET_NO_UPDATE_CHECK"))return null;let O=He(_);if(!O)return null;let L=Xy(O,".cc-safety-net","update-check.json"),J=await nv(L,I);if(!J.lastCheck||I-J.lastCheck>Qy){let oe=await Un();if(J.lastCheck=I,oe.latestVersion)J.latestVersion=oe.latestVersion;if(!await Kd(L,J))return null;if(oe.error)return null}let K=J.latestVersion,ne=un();if(!K||!ko(K,ne))return null;if(J.notifiedVersion===K&&J.notifiedAt!==void 0&&I-J.notifiedAt<ev)return null;if(J.notifiedVersion=K,J.notifiedAt=I,!await Kd(L,J))return null;return`UPDATE_AVAILABLE: cc-safety-net v${K} is available (running v${ne}). Ask the user once whether to run \`npx -y cc-safety-net@latest update\`; continue the current task either way and do not raise this again.`}async function nv(_,I){let O=await Ky(_,"utf8").then((K)=>JSON.parse(K)).catch(()=>{return});if(!O||typeof O!=="object"||Array.isArray(O))return{};let L=O,J=(K)=>typeof K==="number"&&Number.isFinite(K)&&K<=I?K:void 0;return{lastCheck:J(L.lastCheck),latestVersion:typeof L.latestVersion==="string"?L.latestVersion:void 0,notifiedVersion:typeof L.notifiedVersion==="string"?L.notifiedVersion:void 0,notifiedAt:J(L.notifiedAt)}}async function Kd(_,I){return Wy(Zy(_),{recursive:!0,mode:448}).then(()=>Yy(_,JSON.stringify(I),{mode:384})).then(()=>!0).catch(()=>!1)}import{join as tv,resolve as Gi}from"node:path";var Zd="CC Safety Net Config",rv="═".repeat(Zd.length),ov="https://raw.githubusercontent.com/kenryu42/cc-safety-net/main/assets/cc-safety-net.schema.json",iv=new Set(["rule.json","rule.lock","cache"]);function Xd(_,I={}){try{return sv(_,I)}catch(O){if(O instanceof r)return console.error(O.message),1;throw O}}function sv(_,I){let O=I.cwd??process.cwd(),L=Z(_,{cwd:O}),J=ur(_),K=bs(O),ne=Gi(O,me),oe=i(L.userScope,J),de=i(L.projectScope,K),ue=!1,ve=!1,xe=[],Se=[],Pe=av(i(L.projectScope,ne));if(cv(),n(L.userConfigTarget)!==null){let we=Mn(L.userConfigTarget);if(we.errors.push(...H(L.userConfigPath,L.userScope)),xe.push({scope:"User",path:L.userConfigPath,result:we,schema:"rules",target:L.userConfigTarget}),we.errors.length>0)ue=!0}if(n(oe)!==null)if(ve=!0,n(L.userConfigTarget)!==null)Se.push(oo("user","cleanup"));else{let we=ho(oe);if(xe.push({scope:"User",path:J,result:we,schema:"legacy",inactive:!0,target:oe}),Se.push(oo("user",we.errors.length>0?"fix-or-delete":"migrate")),we.errors.length>0)ue=!0}if(n(L.projectConfigTarget)!==null){let we=Mn(L.projectConfigTarget);if(we.errors.push(...H(L.projectConfigPath,L.projectScope)),xe.push({scope:"Project",path:Gi(L.projectConfigPath),result:we,schema:"rules",target:L.projectConfigTarget}),we.errors.length>0)ue=!0;if(n(de)!==null)ve=!0,Se.push(oo("project","cleanup"))}else if(n(de)!==null){ve=!0,ue=!0;let we=ho(de);xe.push({scope:"Project",path:Gi(K),result:we,schema:"legacy",inactive:!0,target:de}),Se.push(oo("project",we.errors.length>0?"fix-or-delete":"migrate"))}if(Pe?.result.errors.length)ue=!0;if(xe.length===0&&!Pe)return console.log(`
|
|
275
275
|
No config files found. Using built-in rules only.`),0;for(let we of xe)if(we.inactive)uv(we.scope,we.path,we.result);else if(we.result.errors.length>0)pv(we.scope,we.path,we.result.errors);else{if(we.schema==="rules"&&gv(we.target))console.log(`
|
|
276
276
|
Added $schema to ${we.scope.toLowerCase()} config.`);dv(we.scope,we.path,we.result,we.schema)}for(let we of Se)console.error(`
|
|
277
277
|
${nn.red(we)}`);if(Pe)if(Pe.result.errors.length>0)mv(Pe.path,Pe.result.errors);else fv(Pe.path,Pe.result);if(ue)return console.error(`
|
|
@@ -5931,6 +5931,6 @@ load().then((loaded) => {
|
|
|
5931
5931
|
</script>
|
|
5932
5932
|
</body>
|
|
5933
5933
|
</html>
|
|
5934
|
-
`;var cu='<script id="ccsn-data" type="application/json">';function du(_){return lu.replace(cu,()=>cu+JSON.stringify({token:_}).replaceAll("<","\\u003c"))}var ao="kenryu42/cc-safety-net",Jv=`https://github.com/${ao}`,Ki=1e4,Wv=7,Kv="The project draft directory changed; reload the draft before applying.",Yv="audit settings are user scope only; remove the audit section from a project proposal";async function gu(_,I={}){let O=gn({label:"gui",booleans:{noOpen:["--no-open"]}},_),L=I.log??console.log,J=I.error??console.error;if(O.errors.length>0){for(let ne of O.errors)J(ne);return J("Usage: cc-safety-net gui [--no-open]"),1}let K=await Zv(c,I);if(L(`CC Safety Net policy GUI: ${K.url}`),!O.flags.noOpen)try{await(I.openBrowser??lb)(K.url)}catch(ne){J(`Failed to open browser: ${ne instanceof Error?ne.message:String(ne)}`),J(`Open this URL manually: ${K.url}`)}if(I.keepAlive===!1)return await K.close(),0;return await ab(K),0}async function Zv(_,I={}){let O=Bv(24).toString("base64url"),L={dir:null,revision:0},J=Vv((oe,de)=>{Xv(_,oe,de,O,I,L)});await new Promise((oe,de)=>{J.once("error",de),J.listen(0,"127.0.0.1",()=>{J.off("error",de),oe()})});let ne=`http://127.0.0.1:${J.address().port}`;return{origin:ne,token:O,url:`${ne}/?token=${encodeURIComponent(O)}`,close:()=>sb(J)}}async function Xv(_,I,O,L,J,K){let ne=_(),oe=new URL(I.url??"/","http://127.0.0.1");if(I.method==="GET"&&oe.pathname==="/favicon.ico"){O.writeHead(204,{"cache-control":"no-store"}),O.end();return}if(!rb(I,oe,L)){ln(O,403,{error:"Forbidden"});return}if(I.method==="GET"&&oe.pathname==="/"){ib(O,du(L));return}if(I.method==="GET"&&oe.pathname==="/api/policy"){let de=dd(ne,J),ue=E(ne,Ji(J));ln(O,200,{...de,configState:$e(ue),...ue.policyScopes?{projectPolicy:{path:b(J.cwd??process.cwd()),weakenings:ue.policyScopes.weakenings}}:{},destructiveCommandRules:W,secretPatterns:Xe,version:
|
|
5935
|
-
`),{path:L,errors:[]}}catch(K){return{path:L,errors:[K instanceof Error?K.message:String(K)]}}}function nb(_,I,O,L){let J=C(O,_.home),K=E(_,Ji(L)),ne=Te({rules:K.policy.rules,transparentWrappers:K.policy.transparentWrappers,safety:Me(J.safety),worktreeMode:J.workflow.worktree_mode,destructiveCommandProtectionEnabled:J.destructive_command_protection.enabled,destructiveCommandRuleOverrides:J.destructive_command_protection.overrides,destructiveCommandAllowPaths:J.destructive_command_protection.allow_paths,secretProtection:{enabled:J.secret_protection.enabled,disabledRules:Fe(J.secret_protection.overrides),denyPaths:J.secret_protection.deny_paths,allowPaths:J.secret_protection.allow_paths}});return zt(I,{policySnapshot:ne,cwd:L.cwd,userConfigDir:L.userConfigDir},_)}function tb(_,I){if(_===null)return Math.min(Wv,I);let O=Number(_);if(!Number.isInteger(O)||O<1||O>I)return null;return O}function rb(_,I,O){if(I.searchParams.get("token")!==O)return!1;if(_.method!=="POST")return!0;return _.headers["x-cc-safety-net-token"]===O}var ob=1048576;async function or(_){let I=[],O=0;for await(let L of _){let J=L;if(O+=J.byteLength,O>ob)return{ok:!1,status:413,error:"Request body is too large"};I.push(J)}try{return{ok:!0,value:JSON.parse(Buffer.concat(I).toString("utf-8")||"{}")}}catch(L){return{ok:!1,status:400,error:`Invalid JSON: ${L instanceof Error?L.message:String(L)}`}}}function ib(_,I){_.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),_.end(I)}function ln(_,I,O){_.writeHead(I,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),_.end(JSON.stringify(O))}function sb(_){return new Promise((I,O)=>{_.close((L)=>L?O(L):I())})}function ab(_){return new Promise((I)=>{let O=()=>{process.off("SIGINT",L),process.off("SIGTERM",L)},L=()=>{O(),_.close().then(I)};process.once("SIGINT",L),process.once("SIGTERM",L)})}function lb(_){let I=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",O=process.platform==="win32"?["/c","start","",_]:[_];return new Promise((L,J)=>{let K=mu(I,O,{detached:!0,stdio:"ignore"}),ne=(de)=>{K.off("spawn",oe),J(de)},oe=()=>{K.off("error",ne),K.unref(),L()};K.once("error",ne),K.once("spawn",oe)})}async function cb(_="gh",I=Ki){return{ok:await Wi(_,["api","-X","PUT",`/user/starred/${ao}`],I)===0}}async function db(_,I={}){let O=await gr((J)=>Ct({environment:_,cwd:process.cwd(),openCodeVersion:J}).status!=="n/a",I.fetcher),L=ub(_,O);return{targets:En.map((J)=>{let K=L.find((ne)=>ne.platform===J.id);return{target:J.id,label:
|
|
5934
|
+
`;var cu='<script id="ccsn-data" type="application/json">';function du(_){return lu.replace(cu,()=>cu+JSON.stringify({token:_}).replaceAll("<","\\u003c"))}var ao="kenryu42/cc-safety-net",Jv=`https://github.com/${ao}`,Ki=1e4,Wv=7,Kv="The project draft directory changed; reload the draft before applying.",Yv="audit settings are user scope only; remove the audit section from a project proposal";async function gu(_,I={}){let O=gn({label:"gui",booleans:{noOpen:["--no-open"]}},_),L=I.log??console.log,J=I.error??console.error;if(O.errors.length>0){for(let ne of O.errors)J(ne);return J("Usage: cc-safety-net gui [--no-open]"),1}let K=await Zv(c,I);if(L(`CC Safety Net policy GUI: ${K.url}`),!O.flags.noOpen)try{await(I.openBrowser??lb)(K.url)}catch(ne){J(`Failed to open browser: ${ne instanceof Error?ne.message:String(ne)}`),J(`Open this URL manually: ${K.url}`)}if(I.keepAlive===!1)return await K.close(),0;return await ab(K),0}async function Zv(_,I={}){let O=Bv(24).toString("base64url"),L={dir:null,revision:0},J=Vv((oe,de)=>{Xv(_,oe,de,O,I,L)});await new Promise((oe,de)=>{J.once("error",de),J.listen(0,"127.0.0.1",()=>{J.off("error",de),oe()})});let ne=`http://127.0.0.1:${J.address().port}`;return{origin:ne,token:O,url:`${ne}/?token=${encodeURIComponent(O)}`,close:()=>sb(J)}}async function Xv(_,I,O,L,J,K){let ne=_(),oe=new URL(I.url??"/","http://127.0.0.1");if(I.method==="GET"&&oe.pathname==="/favicon.ico"){O.writeHead(204,{"cache-control":"no-store"}),O.end();return}if(!rb(I,oe,L)){ln(O,403,{error:"Forbidden"});return}if(I.method==="GET"&&oe.pathname==="/"){ib(O,du(L));return}if(I.method==="GET"&&oe.pathname==="/api/policy"){let de=dd(ne,J),ue=E(ne,Ji(J));ln(O,200,{...de,configState:$e(ue),...ue.policyScopes?{projectPolicy:{path:b(J.cwd??process.cwd()),weakenings:ue.policyScopes.weakenings}}:{},destructiveCommandRules:W,secretPatterns:Xe,version:un(),preview:de.errors.length>0?null:Ne(de.policy,ne.env)});return}if(I.method==="POST"&&oe.pathname==="/api/policy/preview"){let de=await or(I);if(!de.ok){ln(O,de.status,{errors:[de.error]});return}let ue=ud(ne,de.value);ln(O,ue.errors.length>0?400:200,ue);return}if(I.method==="POST"&&oe.pathname==="/api/policy/explain"){let de=await or(I);if(!de.ok){ln(O,de.status,{errors:[de.error]});return}let ue=de.value;if(ue===null||typeof ue.command!=="string"){ln(O,400,{errors:["command must be a string"]});return}let ve=Qt(ue.policy,ne.home);if(ve.length>0){ln(O,400,{errors:ve});return}ln(O,200,nb(ne,ue.command,ue.policy,J));return}if(I.method==="POST"&&oe.pathname==="/api/policy"){let de=await or(I);if(!de.ok){ln(O,de.status,{errors:[de.error]});return}let ue=Fn(ne,de.value,J);ln(O,ue.errors.length>0?400:200,ue);return}if(I.method==="POST"&&oe.pathname==="/api/reset"){ln(O,200,Fn(ne,ee,J));return}if(I.method==="POST"&&oe.pathname==="/api/repair"){ln(O,200,pd(ne,J));return}if(I.method==="POST"&&oe.pathname==="/api/policy/project/choose-directory"){let de=await(J.chooseDirectory??zi)();if("path"in de)K.dir=de.path,K.revision+=1;ln(O,200,{cancelled:"cancelled"in de,..."error"in de?{error:de.error}:{}});return}if(I.method==="GET"&&oe.pathname==="/api/policy/project"){let de=hu(K,J),ue=uu(de,ne.home),ve=er(ne,J);ln(O,200,{path:b(de),revision:K.revision,baseline:ve.baseline,userPolicyDiagnostics:ve.diagnostics,projection:ue.projection,projectionDiagnostics:ue.diagnostics,canPickDirectory:Vi(process.platform,process.env)});return}if(I.method==="POST"&&oe.pathname==="/api/policy/project/diff"){let de=await pu(ne,I,O,K,J);if(!de)return;let ue=uu(de.dir,ne.home),ve=er(ne,J).baseline,xe=Q(ve,le(de.proposal,ne.home).policy);ln(O,200,{rows:Jr(Q(ve,ue.projection).policy,xe.policy,!1),weakenings:xe.weakenings,existingFileDiagnostics:ue.diagnostics});return}if(I.method==="POST"&&oe.pathname==="/api/policy/project/apply"){let de=await pu(ne,I,O,K,J);if(!de)return;let ue=eb(de.dir,de.proposal,ne.home);ln(O,ue.errors.length>0?500:200,ue);return}if(I.method==="GET"&&oe.pathname==="/api/activity"){let de=re(ne,J),ue=tb(oe.searchParams.get("days"),de);if(ue===null){ln(O,400,{error:`days must be an integer between 1 and ${de}`});return}ln(O,200,ou(ne,ue,J.activityLogsDir));return}if(I.method==="POST"&&oe.pathname==="/api/rules/choose-directory"){ln(O,200,await zi());return}if(I.method==="GET"&&oe.pathname==="/api/rules"){let de=X(ne,Ji(J)),ue=new Map(de.rules.map((ve)=>[ve.name,ve]));ln(O,200,{projectPath:J.cwd??process.cwd(),canPickDirectory:Vi(process.platform,process.env),rulebooks:de.rulebooks.map((ve)=>({source:ve.source,spec:ve.spec,name:ve.name,version:ve.version,rules:ve.rules.flatMap((xe)=>{let Se=ue.get(xe);if(!Se)return[];return[{name:Se.name,command:Se.command,subcommand:Se.subcommand,block_args:Se.block_args,reason:Se.reason}]})})),errors:de.errors,warnings:de.warnings});return}if(I.method==="GET"&&oe.pathname==="/api/star/context"){ln(O,200,await(J.fetchStarContext??(()=>mb(ne,{logsDir:J.activityLogsDir})))());return}if(I.method==="POST"&&oe.pathname==="/api/star"){let de=await(J.starRepo??cb)();ln(O,200,de.ok?{ok:!0}:{ok:!1,fallbackUrl:Jv});return}if(I.method==="GET"&&oe.pathname==="/api/integrations"){ln(O,200,await(J.fetchIntegrations??(()=>db(ne)))());return}if(I.method==="GET"&&oe.pathname==="/api/health"){ln(O,200,await(J.fetchHealth??pb)());return}if(I.method==="POST"&&(oe.pathname==="/api/install"||oe.pathname==="/api/uninstall")){let de=await or(I);if(!de.ok){ln(O,de.status,{errors:[de.error]});return}let ue=de.value?.target;if(typeof ue!=="string"||!$n.some((xe)=>xe.target===ue)){ln(O,400,{error:"unknown target"});return}let ve=oe.pathname==="/api/install"?"install":"uninstall";ln(O,200,await(J.runIntegration??fb)(ve,ue));return}ln(O,404,{error:"Not found"})}function Ji(_){return{..._,cwd:_.cwd??process.cwd()}}function hu(_,I){return _.dir??I.cwd??process.cwd()}function uu(_,I){let O=b(_),L=qv(O)?mt(O):{value:void 0,errors:[]},J=le(L.value,I);return{projection:J.policy,diagnostics:[...L.errors,...J.diagnostics]}}async function pu(_,I,O,L,J){let K=hu(L,J),ne=L.revision,oe=await or(I);if(!oe.ok)return ln(O,oe.status,{errors:[oe.error]}),null;let de=oe.value;if(typeof de?.revision!=="number")return ln(O,400,{errors:["revision must be a number"]}),null;if(de.revision!==ne)return ln(O,409,{errors:[Kv]}),null;let ue=Qv(de.proposal,_.home);if(ue.length>0)return ln(O,400,{errors:ue}),null;return{dir:K,proposal:de.proposal}}function Qv(_,I){let O=Qt(_,I);if(O.length>0)return O;return _?.audit===void 0?[]:[Yv]}function eb(_,I,O){let L=b(_),J=Wr(I,C(I,O));try{return g(i(v(_,"project policy"),L),`${JSON.stringify(J,null,2)}
|
|
5935
|
+
`),{path:L,errors:[]}}catch(K){return{path:L,errors:[K instanceof Error?K.message:String(K)]}}}function nb(_,I,O,L){let J=C(O,_.home),K=E(_,Ji(L)),ne=Te({rules:K.policy.rules,transparentWrappers:K.policy.transparentWrappers,safety:Me(J.safety),worktreeMode:J.workflow.worktree_mode,destructiveCommandProtectionEnabled:J.destructive_command_protection.enabled,destructiveCommandRuleOverrides:J.destructive_command_protection.overrides,destructiveCommandAllowPaths:J.destructive_command_protection.allow_paths,secretProtection:{enabled:J.secret_protection.enabled,disabledRules:Fe(J.secret_protection.overrides),denyPaths:J.secret_protection.deny_paths,allowPaths:J.secret_protection.allow_paths}});return zt(I,{policySnapshot:ne,cwd:L.cwd,userConfigDir:L.userConfigDir},_)}function tb(_,I){if(_===null)return Math.min(Wv,I);let O=Number(_);if(!Number.isInteger(O)||O<1||O>I)return null;return O}function rb(_,I,O){if(I.searchParams.get("token")!==O)return!1;if(_.method!=="POST")return!0;return _.headers["x-cc-safety-net-token"]===O}var ob=1048576;async function or(_){let I=[],O=0;for await(let L of _){let J=L;if(O+=J.byteLength,O>ob)return{ok:!1,status:413,error:"Request body is too large"};I.push(J)}try{return{ok:!0,value:JSON.parse(Buffer.concat(I).toString("utf-8")||"{}")}}catch(L){return{ok:!1,status:400,error:`Invalid JSON: ${L instanceof Error?L.message:String(L)}`}}}function ib(_,I){_.writeHead(200,{"content-type":"text/html; charset=utf-8","cache-control":"no-store"}),_.end(I)}function ln(_,I,O){_.writeHead(I,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),_.end(JSON.stringify(O))}function sb(_){return new Promise((I,O)=>{_.close((L)=>L?O(L):I())})}function ab(_){return new Promise((I)=>{let O=()=>{process.off("SIGINT",L),process.off("SIGTERM",L)},L=()=>{O(),_.close().then(I)};process.once("SIGINT",L),process.once("SIGTERM",L)})}function lb(_){let I=process.platform==="darwin"?"open":process.platform==="win32"?"cmd":"xdg-open",O=process.platform==="win32"?["/c","start","",_]:[_];return new Promise((L,J)=>{let K=mu(I,O,{detached:!0,stdio:"ignore"}),ne=(de)=>{K.off("spawn",oe),J(de)},oe=()=>{K.off("error",ne),K.unref(),L()};K.once("error",ne),K.once("spawn",oe)})}async function cb(_="gh",I=Ki){return{ok:await Wi(_,["api","-X","PUT",`/user/starred/${ao}`],I)===0}}async function db(_,I={}){let O=await gr((J)=>Ct({environment:_,cwd:process.cwd(),openCodeVersion:J}).status!=="n/a",I.fetcher),L=ub(_,O);return{targets:En.map((J)=>{let K=L.find((ne)=>ne.platform===J.id);return{target:J.id,label:fn(J.id),version:O.versions[J.id]??null,status:K?.configured?"active":K?.detected?"disabled":K?.inspectionStatus==="not-inspected"?"not-inspected":"not-installed"}}),system:{version:O.version,nodeVersion:O.nodeVersion,platform:O.platform}}}function ub(_,I){return Rt(_,process.cwd(),{ampPluginListOutput:I.ampPluginListOutput,codexPluginListOutput:I.codexPluginListOutput,copilotCliVersion:I.versions["copilot-cli"],openCodeVersion:I.versions.opencode,openCodePluginListOutput:I.openCodePluginListOutput})}async function pb(_={}){let I=await(_.checkUpdates??Un)();return{update:{latestVersion:I.latestVersion??null,updateAvailable:I.updateAvailable}}}var fu=Promise.resolve();function fb(_,I,O={}){let L=async()=>{let K=[],{log:ne,error:oe}=console;console.log=(...de)=>K.push(de.map(String).join(" ")),console.error=console.log;try{return{ok:await Xt(_,[],{selectTargets:async()=>[I],output:new zv({write(ue,ve,xe){K.push(String(ue).replace(/\n$/,"")),xe()}}),...O})===0,output:K.join(`
|
|
5936
5936
|
`)}}finally{console.log=ne,console.error=oe}},J=fu.then(L);return fu=J.then(()=>{return},()=>{return}),J}async function mb(_,I={}){let[O,L,J]=await Promise.all([gb(I.command),hb(I.fetchRepo),Promise.resolve(dr(_,re(_),I.logsDir).totalBlocked)]);return{starred:O,starCount:L,blockedTotal:J}}async function gb(_="gh",I=Ki){if(await Wi(_,["auth","status"],I)!==0)return null;let O=await Wi(_,["api",`/user/starred/${ao}`],I);if(O===0)return!0;if(O===null)return null;return!1}function Wi(_,I,O){return new Promise((L)=>{let J=mu(_,I,{stdio:"ignore",windowsHide:!0}),K=!1,ne=setTimeout(()=>{J.kill(),oe(null)},O),oe=(de)=>{if(K)return;K=!0,clearTimeout(ne),L(de)};J.once("error",()=>oe(null)),J.once("close",oe)})}async function hb(_=fetch){try{let I=await _(`https://api.github.com/repos/${ao}`,{headers:{accept:"application/vnd.github+json"},signal:AbortSignal.timeout(Ki)});if(!I.ok)return null;let O=await I.json();return typeof O.stargazers_count==="number"?O.stargazers_count:null}catch{return null}}function yb(_){if(_[0]!=="help")return!1;let I=_[1];if(!I)vi(),process.exit(0);if(Jt(I))process.exit(0);console.error(`Unknown command: ${I}`),console.error("Run 'cc-safety-net --help' for available commands."),process.exit(1)}var vb={hook:async()=>{console.error("hook requires exactly one integration flag. Try: cc-safety-net hook --kimi-code"),Jt("hook",console.error),process.exit(1)},install:async(_)=>{process.exit(await Xt("install",_))},update:async(_)=>{process.exit(await Oi(_))},uninstall:async(_)=>{process.exit(await Xt("uninstall",_))},rule:async(_)=>{process.exit(await nu(c(),_))},policy:async(_)=>{process.exit(await hd(c(),_))},status:async(_)=>{if(On(gn({label:"status"},_).errors))process.exit(1);ru(c())},statusline:async(_)=>{let I=gn({label:"statusline",booleans:{claudeCode:["-cc","--claude-code"]}},_);if(I.errors.length===0&&I.flags.claudeCode){await qi(c());return}if(On(I.errors),!I.flags.claudeCode)console.error("statusline requires --claude-code (-cc)");Jt("statusline",console.error),process.exit(1)},doctor:async(_)=>{let I=di(_);if(!I)process.exit(1);let O=await $l(c(),{json:I.json,skipUpdateCheck:I.skipUpdateCheck});process.exit(O)},logs:async(_)=>{process.exit(await rs(c(),_))},gui:async(_)=>{process.exit(await gu(_))},explain:async(_)=>{process.exit(await Bl(c(),_))}};async function bb(_){let I=gn({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},_);if(yb(_))return;let O=_[0],L=O?cr(O):void 0;if(I.help&&L&&L.name!=="rule")Jt(L.name),process.exit(0);if(!O||I.help&&!L)vi(),process.exit(0);if(I.flags.version)zl(),process.exit(0);if(L){await vb[L.name](_.slice(1));return}if(O==="--statusline"){await qi(c());return}console.error(O.startsWith("-")?`Unknown option: ${O}`:`Unknown command: ${O}`),console.error("Run 'cc-safety-net --help' for usage."),process.exit(1)}export{bb as runCli};
|