cc-safety-net 2.6.5 → 2.6.6

package/dist/amp/cc-safety-net/index.ts

@@ -1,5 +1,5 @@
 // cc-safety-net managed Amp plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --amp
-// version: 2.6.5
+// version: 2.6.6
 // @bun
 var Oi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",qe="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",jn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var ki={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Hn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},j=Object.freeze({realpathAttempts:{cap:16384,...ki},processedCandidateBytes:{cap:4194304,...ki},pathEnvironmentExpansion:{cap:64,...ki},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Hn},trackedHeredocFiles:{cap:64,...Hn},controlFlowStates:{cap:64,...Hn},wrapperPeelIterations:{cap:20,...Hn},derivedCommandShape:Hn});class W extends Error{kind;name="AnalysisLimit";constructor(e){super(j[e].reason);this.kind=e}}function ke(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>j[t].cap)throw new W(t)}}}var Sg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function pt(e){return vg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function vg(e){return Sg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Eg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Rg(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Eg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
@@ -49,5 +49,5 @@ var Oi="CC Safety Net could not analyze the command because it exceeds safe anal
 `).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function CP(e){return Array.from(e.matchAll(/[A-Za-z_$][\w$]*/g),(t)=>Qp(t[0])).some((t)=>t.some((n)=>hP.test(n)))}var bP=new Set(["cmd","powershell","pwsh"]);function SP(e,t){let n=$n(e.masked,t),r=wl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice($n(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(bl.has(s.text)||Rn(fe(s.text).toLowerCase())||bP.has(fe(s.text).toLowerCase().replace(/\.exe$/,""))))}function vP(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in wl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function EP(e,t,n,r){let o=n[t.tokenStart]??-1,i=e[o]??"",s=zn(e,t.tokenStart),a=$n(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,s-3),s+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(a,a+8)))return!0;if(r&&(i==="["||i==="("))return!1;let l=e[s],c=e[a];if(i==="{"&&l===":")return TP(e,s);let u=(l===i||l===",")&&(c===","||c===wl[i]||i==="{"&&c===":");if(i!=="(")return u&&i!=="";return u&&(l===","||c===",")&&IP(e,o)}var RP=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,xP=/^\s*\.\s*write_(?:text|bytes)\s*\(/,wP=/(?:^|[^\w$.])open\s*$/,_P=/^[bt]*[awx][abtwx]*$/,AP=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function PP(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=zn(e.masked,t.tokenStart),i=$n(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(RP.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&xP.test(e.masked.slice(Oo(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(AP.test(a))return!0;if(!wP.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&_P.test(l.text)&&/^[,)]/.test(e.masked.slice($n(e.masked,l.tokenEnd)))}function TP(e,t){let n=zn(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[zn(e,n+1-r.length)];return o==="{"||o===","}function IP(e,t){let n=zn(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||pP.test(r)}function kP(e){let t=xl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var OP={python:"#",javascript:"/"};function MP(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return Jp(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function Jp(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===OP[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if(zA.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&WP(e,s))return null;let c=n==="python"?NP(e,s):"",u=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+u.length,d=l==="`"||/[fF]/.test(c),m=s-c.length,p=d?DP(e,m,f,u,n,r):LP(e,f,u);if(p===null)return null;if(!d){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&$A.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+u.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+u.length),s=p+u.length-1}return o?null:e.length}function DP(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let u=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(u===`
 `||u==="\r"))return null;let f=o==="python"&&(u==="{"||u==="}")&&e[c+1]===u;if(!f&&e.startsWith(s,c)){let p=Jp(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=u==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function NP(e,t){return GA.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function LP(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
 `||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function WP(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function FP(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(RA.has(n.toLowerCase()))return!0;let o=Qp(n);if(!o.some((i)=>xA.has(i)))continue;if(o.length>1)return!0;if(e[zn(e,r)]===".")return!0;if(e[$n(e,r+n.length)]==="(")return!0}return!1}function Qp(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function zn(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function $n(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function GP(e,t,n,r,o,i){return HP(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Bn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...zP(a,r)?$P(a,r).map((l)=>({target:l,cwd:o})):[]]})}function zP(e,t){let n=Bo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||fe(at(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=at(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function $P(e,t){return Bo(e).flatMap((n)=>n.kind==="word"?[at(n.text,t)]:n.kind==="redirection"&&n.target?[at(n.target,t)]:[]).flatMap(_l)}function _l(e){let t=UP(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||BP(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function BP(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function UP(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function HP(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(tr(o,n))continue;if(eg(e,r,n)){let i=jP(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=VP(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function jP(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(tr(i,n))continue;if(eg(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function VP(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function eg(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function qP(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===DA)o=!0;if(LA.has(f))r=!0;if(d!==void 0){if(f===Tp)t.push(d);continue}if(FA.has(f)){let m=e[l+1];if(f===Tp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(NA.has(h))r=!0;if(WA.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===Pp)t.push(m);continue}let p=e[l+1];if(d===Pp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Je(e){let t=e.findIndex((n)=>!tg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function tg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var KP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),YP=".env.",ZP=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),XP=[".env.example.",".env.sample."];function JP(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function QP(e){return e.length>0&&!/\s/.test(e)}function Ai(e,t,n,r){let o=ng(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function ng(e,t,n,r){try{return zr(e,t,n,r)}catch(o){if(o instanceof W)throw o;return""}}var eT=/[?&][^?&=/]+=/,tT=new Set(["node_modules","__pycache__"]),nT=[["vendor","bundle"],["vendor","cache"]];function rT(e,t,n,r,o){if(JP(e))return null;let i=Se(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>QP(s)||Ai(e,t,r,o),c=B(cT(e,t,r,o));for(let d of Es){let m=`~/${d.suffixParts.join("/")}`;if((Wp(a,m)||Wp(c,m))&&ft(d.id,n))return d.id}if(ZP.has(s)||XP.some((d)=>s.startsWith(d)))return null;let u=oT(i,t,n,r,o);if(u)return u;if(KP.has(s))return null;for(let d of vs)if(s===d.basename&&ft(d.id,n))return d.id;if(s.startsWith(YP)&&ft(so.id,n)&&l())return so.id;for(let d of Rs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&ft(d.id,n)&&l())return d.id}for(let d of xs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ft(d.id,n))return d.id}if(aT(a))return null;if(!s.includes(".")&&nr.pattern.test(s)&&ft(nr.id,n))return nr.id;if(eT.test(e)&&!Ai(e,t,r,o))return null;let f=lT(s,n);if(f)return f;return null}function oT(e,t,n,r,o){return ao.find((i)=>{if(!ft(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return L(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return L(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Fr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return L(e,Se("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return L(e,s,["auth.json",".credentials.json"])||Gn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return L(e,s,["config.toml"])||a.endsWith(".config.toml")&&L(e,s,[a])}case"secret.cli.gemini":return L(e,ne(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ne(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return L(e,ne(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Fr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>L(e,Se(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return L(e,s,["config.json"])||Gn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return L(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return L(e,s,["server.token"])||Gn(e,s,["credentials"])||Gn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||L(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||L(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ne(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return L(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&L(e,s,[a])||c.some((u)=>Fr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ne(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ne(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||L(e,s,["config.json"])||(c?.trim()?Fr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>L(e,Se(u,t,r,o),l))}case"secret.cli.pi":return L(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return L(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Se("~",t,r,o);return[ne(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ne(s,".local","share","amp")].some((l)=>L(e,l,["secrets.json"]))||Gn(e,ne(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ne(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ne(Se("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>L(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Fr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ne(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ne(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return L(e,Se("~/.cursor",t,r,o),["auth.json"])||L(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&nn(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return L(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||L(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||L(e,Se("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return L(e,Se("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||L(e,Se("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),Se("~/.local/share",t,r,o)].some((s)=>L(e,ne(s,"devin"),["credentials.toml"])||Gn(e,ne(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),Se("~/.config",t,r,o)].some((s)=>L(e,ne(s,"devin"),["config.json"]));default:return!1}})?.id??null}var Lp=new WeakMap;function H(e,t,n,r,o){let i=Lp.get(o)??new Map;Lp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Se(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function L(e,t,n){return n.some((r)=>rg(e,ne(t,r)))}function Gn(e,t,n){return n.some((r)=>nn(B(e),B(ne(t,r))))}function Fr(e,t,n,r,o){return rg(e,Se(t,n,r,o))}function rg(e,t){return B(e)===B(t)}function ne(e,...t){return Ve([e,...t].filter(Boolean).join("/"))}function iT(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(zr(e,t,o,i));return n.some((a)=>nn(s,B(zr(a,r,o,i))))}function sT(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(zr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ve(N(ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=B(u?Ve(N(Pi(ce(u)),o.paths,i)):l&&Ve(N(`${l}/.cc-safety-net`,o.paths,i)));if(f&&nn(s,f))return!1;return n.some((d)=>{let m=Ts(d);if(m&&Fp.basename(s)!==B(m.name))return!1;let p=B(zr(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return nn(s,p)&&!(m&&s===p)})}function aT(e){let t=e.split("/");return t.some((n)=>tT.has(n))||nT.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function lT(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ws)if(r===o.extension&&ft(o.id,t))return o.id;for(let o of _s)if(o.pattern.test(r)&&ft(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ft(e,t){return!t?.disabledRules?.includes(e)}function Se(e,t,n,r){let{home:o,normalized:i}=Al(e,n,r);if(!i)return"";if(!o)return i;let s=Pl(i,o),a=wi(s)?s:Ve(Pi(t,s)),l=Ve(N(a,n.paths,r));if(!nn(l,o)){if(wi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Wp(e,t){return e===t||e.startsWith(`${t}/`)}function cT(e,t,n,r){let{home:o,normalized:i}=Al(e,n,r);if(!i||!o)return"";let s=Pl(i,o),a=Fp.normalize(wi(s)?s:Ve(Pi(t,s))),l=Ve(ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&nn(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function zr(e,t,n,r){let{home:o,normalized:i}=Al(e,n,r);if(!i)return"";let s=o?Pl(i,o):i;return Ve(N(wi(s)?s:Pi(t,s),n.paths,r))}function Al(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ve(N(ce(r),t.paths,n)):"",i=Ve(ce(uT(at(e,t))));return{home:o,normalized:i}}function uT(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return hA(e)}catch{return e}}function Pl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ne(t,e.slice(2));return e}function dT(e){if(process.platform==="win32")return!0;return gA.parse(e).root.length>1}function Ve(e){let t=e.trim(),n=(t.includes("\\")&&dT(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function nn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function fe(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class rn extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var mT={findPolicyMutation:wp,findGitMetadataMutation:qd,resolveGitMetadata:pT,loadPolicySnapshot:Tu,findSensitiveTarget:Up,analyzeCommand:hp,getModes:Xi},fT=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function og(e,t){let n={...mT,...t.dependencies},r=yT(e),o=$r(e)?e.command:r,i=Tt("policy-protection",o,()=>Ud(e)),s=ye(i,"input-candidate"),a=ye(i,"declared-command");if($r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:qe,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:fm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=ke(),c=Tt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Tt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:xp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=Tt("policy-protection",o,()=>Sp(i,t.environment,l));if(f){let C=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:bp,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:C,segment:f.target}}}}let d=Tt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=Tt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...gT(m)},y=p.secretProtection.enabled===!1?null:Tt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:$r(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Gp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!$r(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Tl("command-validation",o),...h};let b=Tt("command-analysis",o,()=>yp(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},hT(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===_r&&!fT.test(b.decision.evidence?.segment??"")&&Me(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function pT(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function gT(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function hT(e){return ye(e,"declared-command")?.program}function yT(e){try{return Yn(e.input)}catch(t){let n=$r(e)?e.command:void 0;throw new rn("policy-protection",Tl("policy-protection",t instanceof tt?void 0:n,t),t)}}function Tt(e,t,n){try{return n()}catch(r){throw new rn(e,Tl(e,r instanceof tt?void 0:t,r),r)}}function Tl(e,t,n){let r=n instanceof W||n instanceof Ue;return{stage:e,decision:{kind:"deny",reason:r?Oi:jn,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function $r(e){return e.route.kind==="command"}import{appendFileSync as IT,mkdirSync as kT}from"fs";import{isAbsolute as OT,join as Ol}from"path";import{lstatSync as sg,readdirSync as CT,readFileSync as bT,rmdirSync as ST,statSync as ag,unlinkSync as vT,utimesSync as ET,writeFileSync as RT}from"fs";import{join as Br}from"path";function ig(e,t={}){return ho(Wt(e,t),e.home).policy.audit.retention_days}var kl=86400000,xT=".last-prune",wT=/^\d{4}-\d{2}$/,_T=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,lg=(e)=>Math.floor(e/kl);function ug(e,t,n=()=>new Date){try{let r=n().getTime();if(!ag(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Br(t,xT),i=ag(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&lg(i)===lg(r))return;let s=r-ig(e)*kl,a=new Date(r).toISOString().slice(0,7);for(let l of Il(t)){if(l.isDirectory()){AT(Br(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))PT(Br(t,l.name),s)}RT(o,"",{mode:384}),ET(o,r/1000,r/1000)}catch{}}function AT(e,t,n){for(let r of Il(e)){if(!r.isDirectory()||!wT.test(r.name))continue;let o=Br(e,r.name);for(let i of Il(o)){if(!i.isFile())continue;let s=_T.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+kl;if(!Number.isFinite(a)||a>=t)continue;dg(Br(o,i.name))}if(r.name!==n)cg(o)}cg(e)}function PT(e,t){try{let n=sg(e);if(n.mtimeMs>=t)return;let r=bT(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(TT);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sg(e).mtimeMs!==n.mtimeMs)return;dg(e)}catch{}}function TT(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Il(e){try{return CT(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dg(e){try{vT(e)}catch{}}function cg(e){try{ST(e)}catch{}}var MT="2.6.5",DT=1e4,NT=2000,LT=256,WT=32768;function FT(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function GT(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ml(e,t,n,r,o,i,s={}){let a=FT(t);if(!a)return;let l=$T(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Ti(pt(n),s.failureStage?Number.POSITIVE_INFINITY:DT),f=Ti(pt(r),NT),d=s.toolName?Ti(pt(s.toolName),LT):void 0,m=i===null?void 0:Ti(pt(i),WT),p=Ol(l,GT(m?.value??null),c.slice(0,7));kT(p,{recursive:!0,mode:448});let g=Ol(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Ji)(),v:MT,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};IT(g,`${JSON.stringify(h)}
+`).filter((o)=>o.trim()).map(TT);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(sg(e).mtimeMs!==n.mtimeMs)return;dg(e)}catch{}}function TT(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Il(e){try{return CT(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function dg(e){try{vT(e)}catch{}}function cg(e){try{ST(e)}catch{}}var MT="2.6.6",DT=1e4,NT=2000,LT=256,WT=32768;function FT(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function GT(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ml(e,t,n,r,o,i,s={}){let a=FT(t);if(!a)return;let l=$T(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Ti(pt(n),s.failureStage?Number.POSITIVE_INFINITY:DT),f=Ti(pt(r),NT),d=s.toolName?Ti(pt(s.toolName),LT):void 0,m=i===null?void 0:Ti(pt(i),WT),p=Ol(l,GT(m?.value??null),c.slice(0,7));kT(p,{recursive:!0,mode:448});let g=Ol(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Ji)(),v:MT,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};IT(g,`${JSON.stringify(h)}
 `,{encoding:"utf-8",mode:384}),ug(e,l,s.now)}catch{}}function Ti(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function zT(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&OT(n)?n:null}function $T(e){let t=zT(e);return t?Ol(t,".cc-safety-net","logs"):null}function fg(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=mg(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?mg(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function mg(e){return"command"in e?e.command??"":""}function pg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ml(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function gg(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ml(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function yg(e,t,n){try{let r=og(t,{environment:e,...n.guard});return hg(e,t,r,n),r}catch(r){if(!(r instanceof rn))throw r;throw hg(e,t,r.evaluation,n,!(r.cause instanceof tt),{stage:r.stage,errorCode:BT(r.cause)}),r}}function hg(e,t,n,r,o=!0,i){pg(e,fg(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function BT(e){if(e instanceof W)return j[e.kind].errorCode;if(e instanceof tt)return"tool-input-limit";if(e instanceof Ue)return"structural-shell-syntax-limit";return"unexpected-error"}function on(e,t={}){return{malformed:!0,denial:Vn(t),cwd:e}}function Dl(e,t){return{malformed:!0,denial:Mi(e,t),cwd:e.cwd}}function Cg(e,t={}){return(n,r)=>{try{return UT(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Vn())}}}function UT(e,t,n,r){let o=hc();if(n.cancelled?.(t))return n.block(Vn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return gg(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Wl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=yg(o,i,{guard:{auditAllowed:Sc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof rn))throw l;if(rt(Z.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Gl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var HT={agent:"amp",debugLabel:"amp tool.call",extract:(e,t,n)=>VT(e,t,n),getSessionId:(e)=>YT(e),allow:{action:"allow"},block:(e)=>ZT(e),includeEvidenceOnError:(e)=>e.route.kind==="command"},bg=jT();function jT(e={}){return Cg(HT,e)}function VT(e,t,n){if(!e||typeof e!=="object")return on(null);let r=e;if(typeof r.tool!=="string"||r.tool.trim()==="")return on(null);if(!r.input||typeof r.input!=="object")return on(null,{toolName:r.tool});let o=qT(t);if(!o)return on(null,{toolName:r.tool});let i=lc(".",[o],n);if(!i)return Dl({directory:"session",problem:"unusable",cwd:o},{toolName:r.tool});let s=KT(t,e);if(!s.ok)return on(i,{toolName:r.tool});if(!s.command)return Hi(r.tool,r.input,{kind:Wi(r.tool)},{configCwd:i,executionCwd:i},null);if(typeof s.command.command!=="string"||s.command.command.trim()==="")return on(i,{toolName:r.tool});let a=typeof s.command.dir==="string"?s.command.dir:".",l=cc(a,i,n);if(!l)return Dl({directory:"requested",problem:"unusable",cwd:a},{command:s.command.command,toolName:r.tool});return Hi(r.tool,r.input,{kind:"command",shell:"posix"},{configCwd:i,executionCwd:l},s.command.command)}function qT(e){let t=e.system.workspaceRoot;if(!t)return;try{let n=e.helpers.filePathFromURI(t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function KT(e,t){try{return{ok:!0,command:e.helpers.shellCommandFromToolCall(t)}}catch{return{ok:!1}}}function YT(e){if(!e||typeof e!=="object")return;let t=e.thread?.id;return typeof t==="string"&&t.trim()!==""?t:void 0}function ZT(e){return{action:"reject-and-continue",message:Fl(e)}}function XT(e){e.on("tool.call",(t)=>bg(t,e))}export{XT as default};

package/dist/bin/hook.js

@@ -47,5 +47,5 @@ var Zg=["-h","--help"];function ho(e,t){let n=Object.entries(e.booleans??{}),r=O
 `).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function VA(e){return Array.from(e.matchAll(/[A-Za-z_$][\w$]*/g),(t)=>dg(t[0])).some((t)=>t.some((n)=>UA.test(n)))}var KA=new Set(["cmd","powershell","pwsh"]);function qA(e,t){let n=ur(e.masked,t),r=Bl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice(ur(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(Ll.has(s.text)||Vn(xe(s.text).toLowerCase())||KA.has(xe(s.text).toLowerCase().replace(/\.exe$/,""))))}function YA(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in Bl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function ZA(e,t,n,r){let o=n[t.tokenStart]??-1,i=e[o]??"",s=cr(e,t.tokenStart),a=ur(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,s-3),s+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(a,a+8)))return!0;if(r&&(i==="["||i==="("))return!1;let l=e[s],c=e[a];if(i==="{"&&l===":")return rP(e,s);let u=(l===i||l===",")&&(c===","||c===Bl[i]||i==="{"&&c===":");if(i!=="(")return u&&i!=="";return u&&(l===","||c===",")&&oP(e,o)}var XA=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,JA=/^\s*\.\s*write_(?:text|bytes)\s*\(/,QA=/(?:^|[^\w$.])open\s*$/,eP=/^[bt]*[awx][abtwx]*$/,tP=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function nP(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=cr(e.masked,t.tokenStart),i=ur(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(XA.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&JA.test(e.masked.slice(ci(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(tP.test(a))return!0;if(!QA.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&eP.test(l.text)&&/^[,)]/.test(e.masked.slice(ur(e.masked,l.tokenEnd)))}function rP(e,t){let n=cr(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[cr(e,n+1-r.length)];return o==="{"||o===","}function oP(e,t){let n=cr(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||BA.test(r)}function iP(e){let t=Hl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var sP={python:"#",javascript:"/"};function aP(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return ug(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function ug(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===sP[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if(pA.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&dP(e,s))return null;let c=n==="python"?cP(e,s):"",u=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+u.length,d=l==="`"||/[fF]/.test(c),m=s-c.length,p=d?lP(e,m,f,u,n,r):uP(e,f,u);if(p===null)return null;if(!d){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&gA.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+u.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+u.length),s=p+u.length-1}return o?null:e.length}function lP(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let u=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(u===`
 `||u==="\r"))return null;let f=o==="python"&&(u==="{"||u==="}")&&e[c+1]===u;if(!f&&e.startsWith(s,c)){let p=ug(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=u==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function cP(e,t){return fA.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function uP(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
 `||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function dP(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function mP(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(Xx.has(n.toLowerCase()))return!0;let o=dg(n);if(!o.some((i)=>Jx.has(i)))continue;if(o.length>1)return!0;if(e[cr(e,r)]===".")return!0;if(e[ur(e,r+n.length)]==="(")return!0}return!1}function dg(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function cr(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function ur(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function fP(e,t,n,r,o,i){return CP(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...dr(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...pP(a,r)?gP(a,r).map((l)=>({target:l,cwd:o})):[]]})}function pP(e,t){let n=bi(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||xe(Tt(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=Tt(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function gP(e,t){return bi(e).flatMap((n)=>n.kind==="word"?[Tt(n.text,t)]:n.kind==="redirection"&&n.target?[Tt(n.target,t)]:[]).flatMap($l)}function $l(e){let t=yP(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||hP(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function hP(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function yP(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function CP(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(Rr(o,n))continue;if(mg(e,r,n)){let i=bP(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=SP(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function bP(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(Rr(i,n))continue;if(mg(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function SP(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function mg(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function vP(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===lA)o=!0;if(uA.has(f))r=!0;if(d!==void 0){if(f===Hp)t.push(d);continue}if(mA.has(f)){let m=e[l+1];if(f===Hp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(cA.has(h))r=!0;if(dA.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===zp)t.push(m);continue}let p=e[l+1];if(d===zp&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function yt(e){let t=e.findIndex((n)=>!fg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function fg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var EP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),wP=".env.",RP=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),_P=[".env.example.",".env.sample."];function xP(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function AP(e){return e.length>0&&!/\s/.test(e)}function ns(e,t,n,r){let o=pg(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function pg(e,t,n,r){try{return po(e,t,n,r)}catch(o){if(o instanceof L)throw o;return""}}var PP=/[?&][^?&=/]+=/,TP=new Set(["node_modules","__pycache__"]),kP=[["vendor","bundle"],["vendor","cache"]];function IP(e,t,n,r,o){if(xP(e))return null;let i=De(e,t,r,o);if(!i)return null;let s=j(i.split("/").pop()??""),a=j(i),l=()=>AP(s)||ns(e,t,r,o),c=j(WP(e,t,r,o));for(let d of Hs){let m=`~/${d.suffixParts.join("/")}`;if((Yp(a,m)||Yp(c,m))&&Lt(d.id,n))return d.id}if(RP.has(s)||_P.some((d)=>s.startsWith(d)))return null;let u=OP(i,t,n,r,o);if(u)return u;if(EP.has(s))return null;for(let d of zs)if(s===d.basename&&Lt(d.id,n))return d.id;if(s.startsWith(wP)&&Lt(Fo.id,n)&&l())return Fo.id;for(let d of Bs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&Lt(d.id,n)&&l())return d.id}for(let d of $s)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&Lt(d.id,n))return d.id}if(NP(a))return null;if(!s.includes(".")&&xr.pattern.test(s)&&Lt(xr.id,n))return xr.id;if(PP.test(e)&&!ns(e,t,r,o))return null;let f=LP(s,n);if(f)return f;return null}function OP(e,t,n,r,o){return Go.find((i)=>{if(!Lt(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return F(e,K(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=j(e).split("/");return F(e,K(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||mo(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return F(e,De("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=K(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return F(e,s,["auth.json",".credentials.json"])||lr(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=K(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=j(e).split("/").at(-1)??"";return F(e,s,["config.toml"])||a.endsWith(".config.toml")&&F(e,s,[a])}case"secret.cli.gemini":return F(e,ce(K(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=j(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ce(K(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return F(e,ce(K(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?mo(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>F(e,De(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=K(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return F(e,s,["config.json"])||lr(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return F(e,K(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=K(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=K(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return F(e,s,["server.token"])||lr(e,s,["credentials"])||lr(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=j(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||F(e,K(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||F(e,K(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ce(K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=j(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return F(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&F(e,s,[a])||c.some((u)=>mo(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ce(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ce(K(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(j(e).split("/").at(-1)??"")||F(e,s,["config.json"])||(c?.trim()?mo(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>F(e,De(u,t,r,o),l))}case"secret.cli.pi":return F(e,K(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return F(e,K(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=De("~",t,r,o);return[ce(K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ce(s,".local","share","amp")].some((l)=>F(e,l,["secrets.json"]))||lr(e,ce(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ce(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ce(De("~",t,r,o),".config","amp")],l=j(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>F(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?mo(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ce(K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ce(K(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return F(e,De("~/.cursor",t,r,o),["auth.json"])||F(e,s,["auth.json"])||j(e).split("/").at(-1)==="mcp-auth.json"&&xn(j(e),j(a))}case"secret.cli.cursor.config":{let s=j(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return F(e,K(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=j(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||F(e,K(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||F(e,De("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return F(e,De("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=j(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||F(e,De("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[K(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),De("~/.local/share",t,r,o)].some((s)=>F(e,ce(s,"devin"),["credentials.toml"])||lr(e,ce(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[K(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),De("~/.config",t,r,o)].some((s)=>F(e,ce(s,"devin"),["config.json"]));default:return!1}})?.id??null}var qp=new WeakMap;function K(e,t,n,r,o){let i=qp.get(o)??new Map;qp.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=De(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function F(e,t,n){return n.some((r)=>gg(e,ce(t,r)))}function lr(e,t,n){return n.some((r)=>xn(j(e),j(ce(t,r))))}function mo(e,t,n,r,o){return gg(e,De(t,n,r,o))}function gg(e,t){return j(e)===j(t)}function ce(e,...t){return ut([e,...t].filter(Boolean).join("/"))}function MP(e,t,n,r,o,i){if(n.length===0)return!1;let s=j(po(e,t,o,i));return n.some((a)=>xn(s,j(po(a,r,o,i))))}function DP(e,t,n,r,o,i){if(n.length===0)return!1;let s=j(po(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?ut(M(Ce(a),o.paths,i)):"",c=j(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=j(u?ut(M(_e.resolve(Ce(u)),o.paths,i)):l&&ut(M(`${l}/.cc-safety-net`,o.paths,i)));if(f&&xn(s,f))return!1;return n.some((d)=>{let m=Ks(d);if(m&&_e.posix.basename(s)!==j(m.name))return!1;let p=j(po(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return xn(s,p)&&!(m&&s===p)})}function NP(e){let t=e.split("/");return t.some((n)=>TP.has(n))||kP.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function LP(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of Us)if(r===o.extension&&Lt(o.id,t))return o.id;for(let o of js)if(o.pattern.test(r)&&Lt(o.id,t))return o.id;return null}function j(e){return e.toLowerCase()}function Lt(e,t){return!t?.disabledRules?.includes(e)}function De(e,t,n,r){let{home:o,normalized:i}=Ul(e,n,r);if(!i)return"";if(!o)return i;let s=jl(i,o),a=_e.isAbsolute(s)?s:ut(_e.resolve(t,s)),l=ut(M(a,n.paths,r));if(!xn(l,o)){if(_e.isAbsolute(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Yp(e,t){return e===t||e.startsWith(`${t}/`)}function WP(e,t,n,r){let{home:o,normalized:i}=Ul(e,n,r);if(!i||!o)return"";let s=jl(i,o),a=_e.posix.normalize(_e.isAbsolute(s)?s:ut(_e.resolve(t,s))),l=ut(Ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&xn(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function po(e,t,n,r){let{home:o,normalized:i}=Ul(e,n,r);if(!i)return"";let s=o?jl(i,o):i;return ut(M(_e.isAbsolute(s)?s:_e.resolve(t,s),n.paths,r))}function Ul(e,t,n){let r=t.env.get("HOME")??t.home,o=r?ut(M(Ce(r),t.paths,n)):"",i=ut(Ce(FP(Tt(e,t))));return{home:o,normalized:i}}function FP(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return Zp.fileURLToPath(e)}catch{return e}}function jl(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ce(t,e.slice(2));return e}function GP(e){if(process.platform==="win32")return!0;return _e.win32.parse(e).root.length>1}function ut(e){let t=e.trim(),n=(t.includes("\\")&&GP(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function xn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function xe(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class An extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var zP={findPolicyMutation:Wp,findGitMetadataMutation:am,resolveGitMetadata:BP,loadPolicySnapshot:Ku,findSensitiveTarget:tg,analyzeCommand:Pp,getModes:ws},HP=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function hg(e,t){let n={...zP,...t.dependencies},r=jP(e),o=go(e)?e.command:r,i=Qt("policy-protection",o,()=>im(e)),s=Ie(i,"input-candidate"),a=Ie(i,"declared-command");if(go(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:dt,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:wm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=ye(),c=Qt("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=Qt("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Lp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=Qt("policy-protection",o,()=>Op(i,t.environment,l));if(f){let C=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ip,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:C,segment:f.target}}}}let d=Qt("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Be,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=Qt("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...$P(m)},y=p.secretProtection.enabled===!1?null:Qt("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:go(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Xp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!go(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Vl("command-validation",o),...h};let b=Qt("command-analysis",o,()=>Tp(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},UP(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===Jr&&!HP.test(b.decision.evidence?.segment??"")&&Ye(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function BP(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function $P(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function UP(e){return Ie(e,"declared-command")?.program}function jP(e){try{return Ft(e.input)}catch(t){let n=go(e)?e.command:void 0;throw new An("policy-protection",Vl("policy-protection",t instanceof Ee?void 0:n,t),t)}}function Qt(e,t,n){try{return n()}catch(r){throw new An(e,Vl(e,r instanceof Ee?void 0:t,r),r)}}function Vl(e,t,n){let r=n instanceof L||n instanceof at;return{stage:e,decision:{kind:"deny",reason:r?cs:yr,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function go(e){return e.route.kind==="command"}var os=require("node:fs"),fr=require("node:path");var ue=require("node:fs"),mr=require("node:path");function yg(e,t={}){return Ko(ln(e,t),e.home).policy.audit.retention_days}var ql=86400000,VP=".last-prune",KP=/^\d{4}-\d{2}$/,qP=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,Cg=(e)=>Math.floor(e/ql);function Sg(e,t,n=()=>new Date){try{let r=n().getTime();if(!ue.statSync(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=mr.join(t,VP),i=ue.statSync(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&Cg(i)===Cg(r))return;let s=r-yg(e)*ql,a=new Date(r).toISOString().slice(0,7);for(let l of Kl(t)){if(l.isDirectory()){YP(mr.join(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))ZP(mr.join(t,l.name),s)}ue.writeFileSync(o,"",{mode:384}),ue.utimesSync(o,r/1000,r/1000)}catch{}}function YP(e,t,n){for(let r of Kl(e)){if(!r.isDirectory()||!KP.test(r.name))continue;let o=mr.join(e,r.name);for(let i of Kl(o)){if(!i.isFile())continue;let s=qP.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+ql;if(!Number.isFinite(a)||a>=t)continue;vg(mr.join(o,i.name))}if(r.name!==n)bg(o)}bg(e)}function ZP(e,t){try{let n=ue.lstatSync(e);if(n.mtimeMs>=t)return;let r=ue.readFileSync(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(XP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ue.lstatSync(e).mtimeMs!==n.mtimeMs)return;vg(e)}catch{}}function XP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Kl(e){try{return ue.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function vg(e){try{ue.unlinkSync(e)}catch{}}function bg(e){try{ue.rmdirSync(e)}catch{}}var JP="2.6.5",QP=1e4,eT=2000,tT=256,nT=32768;function rT(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oT(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Yl(e,t,n,r,o,i,s={}){let a=rT(t);if(!a)return;let l=sT(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=rs(St(n),s.failureStage?Number.POSITIVE_INFINITY:QP),f=rs(St(r),eT),d=s.toolName?rs(St(s.toolName),tT):void 0,m=i===null?void 0:rs(St(i),nT),p=fr.join(l,oT(m?.value??null),c.slice(0,7));os.mkdirSync(p,{recursive:!0,mode:448});let g=fr.join(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Rs)(),v:JP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};os.appendFileSync(g,`${JSON.stringify(h)}
+`).filter((o)=>o.trim()).map(XP);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ue.lstatSync(e).mtimeMs!==n.mtimeMs)return;vg(e)}catch{}}function XP(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Kl(e){try{return ue.readdirSync(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function vg(e){try{ue.unlinkSync(e)}catch{}}function bg(e){try{ue.rmdirSync(e)}catch{}}var JP="2.6.6",QP=1e4,eT=2000,tT=256,nT=32768;function rT(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function oT(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Yl(e,t,n,r,o,i,s={}){let a=rT(t);if(!a)return;let l=sT(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=rs(St(n),s.failureStage?Number.POSITIVE_INFINITY:QP),f=rs(St(r),eT),d=s.toolName?rs(St(s.toolName),tT):void 0,m=i===null?void 0:rs(St(i),nT),p=fr.join(l,oT(m?.value??null),c.slice(0,7));os.mkdirSync(p,{recursive:!0,mode:448});let g=fr.join(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Rs)(),v:JP,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};os.appendFileSync(g,`${JSON.stringify(h)}
 `,{encoding:"utf-8",mode:384}),Sg(e,l,s.now)}catch{}}function rs(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function iT(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&fr.isAbsolute(n)?n:null}function sT(e){let t=iT(e);return t?fr.join(t,".cc-safety-net","logs"):null}function wg(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=Eg(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?Eg(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function Eg(e){return"command"in e?e.command??"":""}function Rg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Yl(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function _g(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Yl(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function Ag(e,t,n){try{let r=hg(t,{environment:e,...n.guard});return xg(e,t,r,n),r}catch(r){if(!(r instanceof An))throw r;throw xg(e,t,r.evaluation,n,!(r.cause instanceof Ee),{stage:r.stage,errorCode:aT(r.cause)}),r}}function xg(e,t,n,r,o=!0,i){Rg(e,wg(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function aT(e){if(e instanceof L)return Y[e.kind].errorCode;if(e instanceof Ee)return"tool-input-limit";if(e instanceof at)return"structural-shell-syntax-limit";return"unexpected-error"}var Wt=(e,t,n,r,o)=>Rc(e.cwd,t,n,r,o.paths,process.cwd()),is=(e,t,n)=>(r,o,i,s,a)=>{let l=Wt(r,o,i,s,a);if(!l)return null;let c=r.tool_input;if(!t.has(i)||!c||!Object.hasOwn(c,e))return l;let u=c[e];if(n?.emptyMeansSessionCwd&&u==="")return l;if(typeof u!=="string"||u.trim()==="")return we(s,o,i),null;let f=n?.allowOutsideSessionCwd?Cs(u,l.configCwd,a.paths):Et(u,[l.configCwd],a.paths);if(f)return{configCwd:l.configCwd,executionCwd:f};return Ke(s,o,i,{directory:"requested",problem:Rt(u,l.configCwd,a.paths),cwd:u}),null};function lT(e,t){console.log(JSON.stringify(e(tc(t))))}async function cT(e){let t;try{t=(await wc(process.stdin)).trim()}catch{e({reason:"Failed to parse hook input JSON."});return}if(!t){e({reason:"Missing hook input JSON."});return}return Ro(t,e,"Failed to parse hook input JSON.")}async function uT(e){let t=Nc(),n=await cT(e.outputDeny);if(n===void 0)return;if(!n||typeof n!=="object"||Array.isArray(n)){we(e.outputDeny);return}if(!e.isSupported(n))return;let r=e.getAgent?.(n,t)??e.agent,o=e.agent===r?void 0:e.agent,i=pT(n),s=(p,g)=>{_g(t,p,()=>e.getSessionId(n),{agent:r,shape:o,toolName:g,cwd:p.cwd??i}),e.outputDeny(p)},a=e.getToolName(n);if(typeof a!=="string"||a.trim()===""){we((p)=>s(p),fT(n));return}let l=a,c=(p)=>s(p,l),u;try{u=e.getToolInput(n,l,c,t)}catch(p){if(!(p instanceof Ee))throw p;we(c,void 0,l);return}if(!u.ok)return;let f=e.getContext(n,u.input,l,c,t);if(!f)return;let d;try{d=Ft(u.input)}catch(p){if(!(p instanceof Ee))throw p;we(c,void 0,l);return}let m=zc(l,u.input,u.route,f,d??null);try{let p=Ag(t,m,{guard:{auditAllowed:Gc(t.env),dependencies:e.guardDependencies},audit:{agent:r,shape:o,getSessionId:()=>e.getSessionId(n)}}),g=us(p,{includeEvidence:!0,toolName:p.stage==="command-analysis"?void 0:l});if(g){if(g.unverifiedByStandardMode&&e.outputAsk&&e.canPromptPerson?.(n)){e.outputAsk(g);return}e.outputDeny(g);return}e.outputAllow?.()}catch(p){if(!(p instanceof An))throw p;dT(p,t.env);let g=us(p.evaluation,{includeEvidence:!0,toolName:p.evaluation.stage==="command-analysis"?void 0:l});if(g)e.outputDeny(g);return}}function dT(e,t){if(!_t(ne.debug,t))return;console.error(`CC Safety Net debug: ${mT(e.stage)}: ${rc(e.cause)}`)}function mT(e){if(e==="policy-protection")return"hook policy protection failed";if(e==="config-load")return"hook config loading failed";if(e==="secret-protection")return"hook secret protection failed";return"hook analysis failed"}function fT(e){if(!e||typeof e!=="object"||Array.isArray(e))return;if(Object.hasOwn(e,"tool_input"))return e.tool_input;let t=e.toolCall;if(t&&typeof t==="object"&&!Array.isArray(t))return t.args;return}function pT(e){if(!e||typeof e!=="object"||Array.isArray(e))return null;let t=e.cwd;if(typeof t==="string")return t;let n=e.toolCall;if(!n||typeof n!=="object"||Array.isArray(n))return null;let r=n.args;if(!r||typeof r!=="object"||Array.isArray(r))return null;let o=r.Cwd;return typeof o==="string"?o:null}async function ve(e){let t=(s)=>lT(e.createDenyOutput,s),n=e.createAskOutput,r=n?(s)=>console.log(JSON.stringify(n(nc(s)))):void 0,o=e.createAllowOutput,i=o?()=>console.log(JSON.stringify(o())):void 0;try{await uT({...e,outputDeny:t,outputAsk:r,outputAllow:i})}catch(s){console.error("CC Safety Net error:",s),t(kn())}}var gT=new Map([["run_command","auto"]]),hT=new Set(["absolutepath","directorypath","file_path","filepath","path","searchdirectory","searchpath","target_file","targetfile"]);function Pg(e){return Q(e,gT)}async function Tg(){await ve({agent:"antigravity-cli",createDenyOutput:(e)=>({decision:"deny",reason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolCall?.name,getToolInput:(e,t)=>({ok:!0,input:ST(e.toolCall?.args,t),route:Pg(t)}),getContext:yT,getSessionId:(e)=>e.conversationId})}function yT(e,t,n,r,o){let i=bT(e);if(!i[0])return en(r,t,n),null;let s=i.flatMap((u)=>{let f=wt([u],o.paths);return f?[f]:[]});if(!s[0])return en(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;if(n!=="run_command"){let u;try{u=CT(t,n,s,o.paths)}catch(f){if(f instanceof Ee)return en(r,void 0,n),null;if(!(f instanceof L))throw f;return en(r,t,n),null}if(!u)return en(r,t,n),null;return{configCwd:u,executionCwd:u}}let a=e.toolCall?.args;if(!a||!Object.hasOwn(a,"Cwd"))return{configCwd:s[0],executionCwd:s[0]};let l=a.Cwd;if(typeof l!=="string"||l.trim()==="")return en(r,t,n),null;let c=Et(l,s,o.paths);if(c){let u=kg(c,s);if(!u)return en(r,t,n),null;return{configCwd:u,executionCwd:c}}return en(r,t,n,{directory:"requested",problem:Rt(l,s[0],o.paths),cwd:l}),null}function CT(e,t,n,r){let o=Pg(t),i=[...vo(e,hT),...o.kind==="patch"?Eo(e):[]].filter(Zl.isAbsolute),s=ye(),a=new Set(i.flatMap((l)=>{let c=kg(M(l,r,s),n);return c?[c]:[]}));if(a.size>1)return null;return[...a][0]??n[0]??null}function kg(e,t){return t.filter((n)=>vr(e,n)).reduce((n,r)=>r.length>n.length?r:n,"")||null}function en(e,t,n,r){let o=t&&typeof t==="object"?t.command:void 0,i={command:typeof o==="string"?o:void 0,toolName:n};e(r?yo(r,i):kn(i))}function bT(e){if(e.workspacePaths===void 0)return[process.cwd()];return Array.isArray(e.workspacePaths)?e.workspacePaths.filter((t)=>typeof t==="string"&&t.trim()!==""):[]}function ST(e,t){if(!e)return;if(t!=="run_command")return e;return{...e,command:typeof e.CommandLine==="string"&&e.CommandLine!==""?e.CommandLine:void 0}}var vT=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"];var ss=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:10,runtime:{order:8,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:10,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:9,runtime:{order:7,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:9,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:11,runtime:{order:9,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:12,runtime:{order:10,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:12,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:13,runtime:{order:11,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:13,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:14,install:{order:14,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:15,install:{order:15,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:16,install:{order:16,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:vT}},{id:"devin",displayName:"Devin CLI",doctorOrder:7,runtime:{order:5,flags:["-dv","--devin"],description:"Run as Devin CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:7,flag:"--devin",artifactKind:"hook config",probeCommand:["devin","--version"]}},{id:"droid",displayName:"Factory Droid",doctorOrder:8,runtime:{order:6,flags:["-fd","--droid"],description:"Run as Factory Droid PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--droid",artifactKind:"hook config",probeCommand:["droid","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],WW=ss.slice().sort((e,t)=>e.doctorOrder-t.doctorOrder).map((e)=>e.id),Ig=ss.filter((e)=>("runtime"in e)).slice().sort((e,t)=>e.runtime.order-t.runtime.order).map((e)=>({id:e.id,displayName:"displayName"in e.runtime?e.runtime.displayName:e.displayName,flags:e.runtime.flags,legacyFlags:"legacyFlags"in e.runtime?e.runtime.legacyFlags:[],description:e.runtime.description,legacyTopLevelFlags:e.runtime.legacyTopLevelFlags})),FW=ss.slice().sort((e,t)=>e.install.order-t.install.order).map((e)=>({id:e.id,...e.install})).map(({order:e,...t})=>t),GW=Object.fromEntries(ss.map((e)=>[e.id,e.displayName]));var Pn=require("node:path");function Og(e,t){if(e!==void 0&&e!==null&&typeof e!=="string")return"unknown";if(typeof e==="string"&&!Pn.isAbsolute(e))return"unknown";try{let n=ye(),r=typeof e==="string"&&e?M(e,t.paths,n):void 0,o=t.home,i=[["codex",t.env.get("CODEX_HOME")||Pn.join(o,".codex")],["copilot-cli",t.env.get("COPILOT_HOME")||Pn.join(o,".copilot")],["claude-code",t.env.get("CLAUDE_CONFIG_DIR")||Pn.join(o,".claude")]],s=r?i.flatMap(([a,l])=>{if(!Pn.isAbsolute(l))return[];return vr(r,M(l,t.paths,n))?[a]:[]}):[];if(s.length===1)return s[0]??"unknown";if(s.length>1)return"unknown"}catch{return"unknown"}if(t.env.get("COPILOT_CLI")==="1")return"copilot-cli";if(t.env.get("CLAUDECODE")==="1"||Boolean(t.env.get("CLAUDE_CODE_ENTRYPOINT")))return"claude-code";return"unknown"}var pr="PreToolUse",Mg="BeforeTool",Dg="pre_tool_call";async function tn(e){await ve({agent:e.agent,...e.getAgent?{getAgent:e.getAgent}:{},createDenyOutput:(t)=>({hookSpecificOutput:{hookEventName:pr,permissionDecision:"deny",permissionDecisionReason:t}}),...e.canPromptPerson?{canPromptPerson:e.canPromptPerson,createAskOutput:(t)=>({hookSpecificOutput:{hookEventName:pr,permissionDecision:"ask",permissionDecisionReason:t}})}:{},isSupported:(t)=>t.hook_event_name===pr,getToolName:(t)=>t.tool_name,getToolInput:(t,n,r,o)=>({ok:!0,input:t.tool_input,route:e.getToolRoute(n,t.tool_input,o)}),getContext:e.getContext??Wt,getSessionId:(t)=>t.session_id})}var ET=new Map([["Bash","posix"],["PowerShell","powershell"],["Monitor","posix"]]);function wT(e,t,n){if(e==="Bash"&&n.env.get("COPILOT_CLI")==="1")return{kind:"command",shell:"auto"};return e==="Monitor"&&t?.command===void 0?Q(e,new Map):Q(e,ET)}async function Ng(){await tn({agent:"claude-code",getAgent:(e,t)=>Og(e.transcript_path,t),canPromptPerson:(e)=>["default","acceptEdits","plan"].includes(e.permission_mode??""),getToolRoute:wT})}var RT=new Map([["Bash","auto"]]);async function Lg(){await tn({agent:"codex",getToolRoute:(e)=>Q(e,RT)})}var _T=new Map([["bash","auto"],["Bash","auto"],["powershell","powershell"],["PowerShell","powershell"]]);function xT(e){return Q(e,_T)}async function Wg(){await ve({agent:"copilot-cli",createDenyOutput:(e)=>({permissionDecision:"deny",permissionDecisionReason:e}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{let r=xT(t);if(typeof e.toolArgs==="object"&&e.toolArgs!==null)return{ok:!0,input:e.toolArgs,route:r};if(typeof e.toolArgs!=="string")return n({reason:"Failed to parse toolArgs JSON."}),{ok:!1};if(r.kind==="patch"&&e.toolArgs.trimStart().startsWith("*** Begin Patch"))return{ok:!0,input:e.toolArgs,route:r};let i=Ro(e.toolArgs,n,"Failed to parse toolArgs JSON.");if(i===void 0)return{ok:!1};return{ok:!0,input:i,route:r}},getContext:Wt,getSessionId:(e)=>typeof e.sessionId==="string"&&e.sessionId.trim()?e.sessionId:void 0})}var AT=new Map([["Shell","auto"]]);function PT(e){return Q(e,AT)}async function Fg(){await ve({agent:"cursor",createDenyOutput:(e)=>({permission:"deny",user_message:e,agent_message:e}),createAllowOutput:()=>({permission:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:PT(t)}),getContext:TT,getSessionId:(e)=>e.conversation_id})}function TT(e,t,n,r,o){let i=kT(e);if(!i[0])return we(r,t,n),null;let s=i.flatMap((d)=>{let m=wt([d],o.paths);return m?[m]:[]});if(!s[0])return Ke(r,t,n,{directory:"session",problem:"unusable",cwd:i[0]}),null;let a=IT(e.cwd),l=Et(a,s,o.paths);if(!l)return Ke(r,t,n,{directory:"session",problem:Rt(a,s[0],o.paths),cwd:a}),null;if(t===null||typeof t!=="object"||Array.isArray(t))return{configCwd:l,executionCwd:l};if(!Object.hasOwn(t,"working_directory"))return{configCwd:l,executionCwd:l};let c=t.working_directory;if(typeof c!=="string"||c.trim()==="")return we(r,t,n),null;let u=Cr(c),f=Et(u,s,o.paths);if(!f)return Ke(r,t,n,{directory:"requested",problem:Rt(u,s[0],o.paths),cwd:u}),null;return{configCwd:l,executionCwd:f}}function kT(e){if(e.workspace_roots===void 0)return typeof e.cwd==="string"&&e.cwd.trim()!==""?[Cr(e.cwd)]:[];if(!Array.isArray(e.workspace_roots))return[];return e.workspace_roots.filter((t)=>typeof t==="string"&&t.trim()!=="").map((t)=>Cr(t))}function IT(e){return typeof e==="string"&&e.trim()!==""?Cr(e):"."}var OT=new Map([["exec","auto"]]);function MT(e,t){if(e!=="write_to_process"||typeof t!=="object"||t===null)return;let n=t.text_input;return typeof n==="string"&&n!==""?n:void 0}async function Gg(){await ve({agent:"devin",createDenyOutput:(e)=>({decision:"block",reason:e}),isSupported:(e)=>e.hook_event_name===pr,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>{let n=MT(t,e.tool_input);if(n===void 0)return{ok:!0,input:e.tool_input,route:Q(t,OT)};return{ok:!0,input:{command:n},route:{kind:"command",shell:"auto"}}},getContext:(e,...t)=>Wt({},...t),getSessionId:(e)=>typeof e.session_id==="string"&&e.session_id!==""?e.session_id:void 0})}var DT=new Map([["Execute","auto"]]);async function zg(){await tn({agent:"droid",getToolRoute:(e)=>Q(e,DT)})}var Hg=new Map([["run_shell_command","auto"]]);function NT(e){return Q(e,Hg)}async function Bg(){await ve({agent:"gemini-cli",createDenyOutput:(e)=>({decision:"deny",reason:e,systemMessage:e}),isSupported:(e)=>e.hook_event_name===Mg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:NT(t)}),getContext:is("dir_path",Hg,{emptyMeansSessionCwd:!0,allowOutsideSessionCwd:!0}),getSessionId:(e)=>e.session_id})}var LT=new Map([["run_terminal_command","auto"],["monitor","auto"]]);function WT(e){return Q(e,LT)}async function $g(){await ve({agent:"grok-build",createDenyOutput:(e)=>({decision:"deny",reason:e}),createAllowOutput:()=>({decision:"allow"}),isSupported:()=>!0,getToolName:(e)=>e.toolName,getToolInput:(e,t,n)=>{if(e.toolInputTruncated===!0)return we(n,e.toolInput,t),{ok:!1};return{ok:!0,input:e.toolInput,route:WT(t)}},getContext:FT,getSessionId:(e)=>e.sessionId})}function FT(e,t,n,r,o){let i=GT(e);if(!i)return we(r,t,n),null;let s=wt([i],o.paths);if(!s)return Ke(r,t,n,{directory:"session",problem:"unusable",cwd:i}),null;let a=zT(e.cwd),l=Et(a,[s],o.paths);if(!l)return Ke(r,t,n,{directory:"session",problem:Rt(a,s,o.paths),cwd:a}),null;return{configCwd:l,executionCwd:l}}function GT(e){let t=e.workspaceRoot===void 0?e.cwd:e.workspaceRoot;return typeof t==="string"&&t.trim()!==""?t:void 0}function zT(e){return typeof e==="string"&&e.trim()!==""?e:"."}var Ug=require("node:path");var HT=new Map([["terminal","posix"]]);async function jg(){await ve({agent:"hermes-agent",createDenyOutput:(e)=>({action:"block",message:e}),isSupported:(e)=>e.hook_event_name===Dg,getToolName:(e)=>e.tool_name,getToolInput:(e,t)=>({ok:!0,input:e.tool_input,route:Q(t,HT)}),getContext:BT,getSessionId:(e)=>e.session_id})}function BT(e,t,n,r,o){let i=Wt(e,t,n,r,o);if(!i)return null;if(!t||typeof t!=="object"||Array.isArray(t))return i;if(!Object.hasOwn(t,"workdir"))return i;let s=t.workdir;if(typeof s!=="string"||s.trim()==="")return we(r,t,n),null;let a=wt([Ug.resolve(i.configCwd,s)],o.paths);if(!a)return Ke(r,t,n,{directory:"requested",problem:"unusable",cwd:s}),null;return{...i,executionCwd:a}}var Vg=new Map([["Bash","posix"]]);function $T(e){return Q(e,Vg)}async function Kg(){await tn({agent:"kimi-code",getToolRoute:$T,getContext:is("cwd",Vg)})}var UT={"antigravity-cli":Tg,"claude-code":Ng,codex:Lg,"copilot-cli":Wg,cursor:Fg,devin:Gg,droid:zg,"gemini-cli":Bg,"grok-build":$g,"hermes-agent":jg,"kimi-code":Kg},Xl=Ig.map((e)=>({...e,run:UT[e.id]}));function qg(e){let t=ho({label:"hook",booleans:Object.fromEntries(Xl.map((r)=>[r.id,[...r.flags,...r.legacyFlags]]))},e);if(t.errors.length>0)return;let n=Xl.filter((r)=>t.flags[r.id]);return n.length===1?n[0]:void 0}function Yg(e){return Xl.find((t)=>t.legacyTopLevelFlags.some((n)=>n===e))}async function jT(){let e=process.argv.slice(2),t=e[0],n=ho({label:"cc-safety-net",booleans:{version:["-V","--version"]},positionals:"list"},e);if(!n.help&&!n.flags.version){if(t?.toLowerCase()==="hook"){let i=qg(e.slice(1));if(i){await i.run();return}}let o=Yg(t);if(o){await o.run();return}}let r=await import("../cli.js");await r.runCli(e)}jT().catch((e)=>{console.error("CC Safety Net error:",e),process.exit(1)});

package/dist/chunks/{index-x6wv93z4.js → index-21maj91f.js}

@@ -1,4 +1,4 @@
 import{a,s,J,f,Ie,l,Me,b,p,q}from"./index-t1vhmn90.js";import{appendFileSync as ne,mkdirSync as re}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as F,readdirSync as P,readFileSync as j,rmdirSync as V,statSync as D,unlinkSync as B,utimesSync as X,writeFileSync as z}from"node:fs";import{join as m}from"node:path";function oe(t,e={}){return Me(l(t,e),t.home).policy.audit.retention_days}var A=86400000,Y=".last-prune",Z=/^\d{4}-\d{2}$/,Q=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,C=(t)=>Math.floor(t/A);function K(t,e,r=()=>new Date){try{let n=r().getTime();if(!D(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=m(e,Y),c=D(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&C(c)===C(n))return;let i=n-oe(t)*A,d=new Date(n).toISOString().slice(0,7);for(let u of v(e)){if(u.isDirectory()){W(m(e,u.name),i,d);continue}if(u.isFile()&&u.name.endsWith(".jsonl"))ee(m(e,u.name),i)}z(o,"",{mode:384}),X(o,n/1000,n/1000)}catch{}}function W(t,e,r){for(let n of v(t)){if(!n.isDirectory()||!Z.test(n.name))continue;let o=m(t,n.name);for(let c of v(o)){if(!c.isFile())continue;let i=Q.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(d)||d>=e)continue;O(m(o,c.name))}if(n.name!==r)L(o)}L(t)}function ee(t,e){try{let r=F(t);if(r.mtimeMs>=e)return;let n=j(t,"utf-8").split(`
-`).filter((o)=>o.trim()).map(te);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(F(t).mtimeMs!==r.mtimeMs)return;O(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return P(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function O(t){try{B(t)}catch{}}function L(t){try{V(t)}catch{}}var ae="2.6.5",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let u=U(t);if(!u)return;try{let y=(i.now??(()=>new Date))().toISOString(),_=g(J(r),i.failureStage?Number.POSITIVE_INFINITY:ce),N=g(J(n),de),h=i.toolName?g(J(i.toolName),ue):void 0,E=c===null?void 0:g(J(c),se),w=S(u,me(E?.value??null),y.slice(0,7));re(w,{recursive:!0,mode:448});let R=S(w,`${y.slice(0,10)}-${d}.jsonl`),H={ts:y,id:(i.createId??Ie)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:E?.value??null};ne(R,`${JSON.stringify(H)}
+`).filter((o)=>o.trim()).map(te);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(F(t).mtimeMs!==r.mtimeMs)return;O(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return P(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function O(t){try{B(t)}catch{}}function L(t){try{V(t)}catch{}}var ae="2.6.6",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let u=U(t);if(!u)return;try{let y=(i.now??(()=>new Date))().toISOString(),_=g(J(r),i.failureStage?Number.POSITIVE_INFINITY:ce),N=g(J(n),de),h=i.toolName?g(J(i.toolName),ue):void 0,E=c===null?void 0:g(J(c),se),w=S(u,me(E?.value??null),y.slice(0,7));re(w,{recursive:!0,mode:448});let R=S(w,`${y.slice(0,10)}-${d}.jsonl`),H={ts:y,id:(i.createId??Ie)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:E?.value??null};ne(R,`${JSON.stringify(H)}
 `,{encoding:"utf-8",mode:384}),K(t,u,i.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function We(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function U(t){let e=We(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=T(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?T(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function T(t){return"command"in t?t.command??"":""}function x(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function we(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function G(t,e,r){try{let n=q(e,{environment:t,...r.guard});return M(t,e,n,r),n}catch(n){if(!(n instanceof p))throw n;throw M(t,e,n.evaluation,r,!(n.cause instanceof f),{stage:n.stage,errorCode:fe(n.cause)}),n}}function M(t,e,r,n,o=!0,c){x(t,k(e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function fe(t){if(t instanceof s)return a[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof b)return"structural-shell-syntax-limit";return"unexpected-error"}
 export{oe,K,We,U,we,G};

package/dist/chunks/{index-6awd86n5.js → index-e1j1weef.js}

@@ -1,2 +1,2 @@
-import{Ce,O,D,rt,c,n,Ee,v,p}from"./index-t1vhmn90.js";import{we,G}from"./index-x6wv93z4.js";function j(t,o={}){return{malformed:!0,denial:O(o),cwd:t}}function de(t,o){return{malformed:!0,denial:D(t,o),cwd:t.cwd}}function Se(t,o={}){return(e,i)=>{try{return g(e,i,t,o)}catch(a){return console.error("CC Safety Net error:",a),t.block(O())}}}function g(t,o,e,i){let a=c();if(e.cancelled?.(o))return e.block(O());let l=e.extract(t,o,a.paths);if(!l)return e.allow;let d=()=>e.getSessionId(t,o);if("malformed"in l)return we(a,l.denial,d,{agent:e.agent,toolName:l.denial.toolName,cwd:l.cwd}),e.block(l.denial);let u=(r,m)=>{let s=Ce(r,{includeEvidence:m});return s?e.block(s):e.allow};try{let r=G(a,l,{guard:{auditAllowed:Ee(a.env),policyOptions:i.policyOptions,dependencies:i.guardDependencies},audit:{agent:e.agent,getSessionId:d}});return u(r,!0)}catch(r){if(!(r instanceof p))throw r;if(v(n.debug,a.env))console.error(`CC Safety Net debug: ${e.debugLabel} analysis failed: ${rt(r.cause)}`);return u(r.evaluation,e.includeEvidenceOnError(l))}}
+import{Ce,O,D,rt,c,n,Ee,v,p}from"./index-t1vhmn90.js";import{we,G}from"./index-21maj91f.js";function j(t,o={}){return{malformed:!0,denial:O(o),cwd:t}}function de(t,o){return{malformed:!0,denial:D(t,o),cwd:t.cwd}}function Se(t,o={}){return(e,i)=>{try{return g(e,i,t,o)}catch(a){return console.error("CC Safety Net error:",a),t.block(O())}}}function g(t,o,e,i){let a=c();if(e.cancelled?.(o))return e.block(O());let l=e.extract(t,o,a.paths);if(!l)return e.allow;let d=()=>e.getSessionId(t,o);if("malformed"in l)return we(a,l.denial,d,{agent:e.agent,toolName:l.denial.toolName,cwd:l.cwd}),e.block(l.denial);let u=(r,m)=>{let s=Ce(r,{includeEvidence:m});return s?e.block(s):e.allow};try{let r=G(a,l,{guard:{auditAllowed:Ee(a.env),policyOptions:i.policyOptions,dependencies:i.guardDependencies},audit:{agent:e.agent,getSessionId:d}});return u(r,!0)}catch(r){if(!(r instanceof p))throw r;if(v(n.debug,a.env))console.error(`CC Safety Net debug: ${e.debugLabel} analysis failed: ${rt(r.cause)}`);return u(r.evaluation,e.includeEvidenceOnError(l))}}
 export{j,de,Se};

package/dist/cli.js

@@ -1,4 +1,4 @@
-import{a,s,Pe,Be,R,nt,ze,c,n,Ve,T,v,pe,ot,f,Ke,u,o,S,i,se,r,g,me,H,st,at,d,ge,he,ct,N,Z,ae,w,lt,_,h,ke,W,l,L,X,Je,Ye,M,C,I,ye,be,Ae,ut,m,e,Oe,Re,Ze,Xe,ce,Te,le,De,Q,B,Ne,xe,z,Qe,V,ee,te,ue,et,tt,E,F,Le,Fe,$e,k,je,_e,Ue,y,t,ne,ve,b,x,A,dt,Ge,He,p,q}from"./chunks/index-t1vhmn90.js";import{oe,K,We,U,G}from"./chunks/index-x6wv93z4.js";var cp=["-h","--help"];function yn(P,O){let D=Object.entries(P.booleans??{}),j=Object.entries(P.values??{}),J=Object.entries(P.lists??{}),Y=Object.fromEntries(D.map(([Se])=>[Se,!1])),re={},ie=Object.fromEntries(J.map(([Se])=>[Se,[]])),de=[],fe=[],we=!1,Ce=-1;for(let[Se,Ie]of O.entries()){if(Se<=Ce)continue;if(Ie==="--"){de.push(...O.slice(Se+1));break}if(cp.includes(Ie)){we=!0;continue}let Ee=D.find(([,en])=>en.includes(Ie));if(Ee){Y[Ee[0]]=!0;continue}let qe=j.find(([,en])=>en.includes(Ie));if(qe){let en=O[Se+1];if(en===void 0||en.startsWith("-")){fe.push(`${Ie} requires a value`);continue}re[qe[0]]=en,Ce=Se+1;continue}let Me=J.find(([,en])=>en.includes(Ie));if(Me){let en=O.slice(Se+1),on=en.findIndex((an)=>an.startsWith("-")),sn=en.slice(0,on===-1?en.length:on);if(sn.length===0){fe.push(`${Ie} requires at least one value`);continue}ie[Me[0]]=[...ie[Me[0]]??[],...sn],Ce=Se+sn.length;continue}if(Ie.startsWith("-")){fe.push(`Unknown option for ${P.label}: ${Ie}`);continue}if(P.positionals==="tail"){de.push(...O.slice(Se));break}de.push(Ie)}if(P.positionals!=="list"&&P.positionals!=="tail")fe.push(...de.map((Se)=>`Unexpected argument for ${P.label}: ${Se}`));return{flags:Y,values:re,lists:ie,positionals:de,help:we,errors:fe}}function Dn(P){for(let O of P)console.error(O);return P.length>0}import{readdirSync as yp,statSync as Ps,unlinkSync as hp}from"node:fs";import{basename as Rs,dirname as vp,isAbsolute as bp,join as wp,relative as kp,resolve as xp,sep as Cp}from"node:path";var xs=(P)=>{let O=Date.now()-new Date(P).getTime();if(!Number.isFinite(O))return"";let D=Math.floor(O/60000),j=Math.floor(D/60),J=Math.floor(j/24);if(J>0)return`${J}d ago`;if(j>0)return`${j}h ago`;if(D>0)return`${D}m ago`;return"just now"},Ro=(P)=>{let O=(P??"").trim().split(/\s+/).filter((J)=>J&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(J)),D=O[0]?.split("/").pop();if(!D)return null;let j=O[1];return j&&/^[a-z][a-z0-9-]*$/.test(j)?`${D} ${j}`:D};function Cs(P){let O=(J)=>`${J.sessionId}
+import{a,s,Pe,Be,R,nt,ze,c,n,Ve,T,v,pe,ot,f,Ke,u,o,S,i,se,r,g,me,H,st,at,d,ge,he,ct,N,Z,ae,w,lt,_,h,ke,W,l,L,X,Je,Ye,M,C,I,ye,be,Ae,ut,m,e,Oe,Re,Ze,Xe,ce,Te,le,De,Q,B,Ne,xe,z,Qe,V,ee,te,ue,et,tt,E,F,Le,Fe,$e,k,je,_e,Ue,y,t,ne,ve,b,x,A,dt,Ge,He,p,q}from"./chunks/index-t1vhmn90.js";import{oe,K,We,U,G}from"./chunks/index-21maj91f.js";var cp=["-h","--help"];function yn(P,O){let D=Object.entries(P.booleans??{}),j=Object.entries(P.values??{}),J=Object.entries(P.lists??{}),Y=Object.fromEntries(D.map(([Se])=>[Se,!1])),re={},ie=Object.fromEntries(J.map(([Se])=>[Se,[]])),de=[],fe=[],we=!1,Ce=-1;for(let[Se,Ie]of O.entries()){if(Se<=Ce)continue;if(Ie==="--"){de.push(...O.slice(Se+1));break}if(cp.includes(Ie)){we=!0;continue}let Ee=D.find(([,en])=>en.includes(Ie));if(Ee){Y[Ee[0]]=!0;continue}let qe=j.find(([,en])=>en.includes(Ie));if(qe){let en=O[Se+1];if(en===void 0||en.startsWith("-")){fe.push(`${Ie} requires a value`);continue}re[qe[0]]=en,Ce=Se+1;continue}let Me=J.find(([,en])=>en.includes(Ie));if(Me){let en=O.slice(Se+1),on=en.findIndex((an)=>an.startsWith("-")),sn=en.slice(0,on===-1?en.length:on);if(sn.length===0){fe.push(`${Ie} requires at least one value`);continue}ie[Me[0]]=[...ie[Me[0]]??[],...sn],Ce=Se+sn.length;continue}if(Ie.startsWith("-")){fe.push(`Unknown option for ${P.label}: ${Ie}`);continue}if(P.positionals==="tail"){de.push(...O.slice(Se));break}de.push(Ie)}if(P.positionals!=="list"&&P.positionals!=="tail")fe.push(...de.map((Se)=>`Unexpected argument for ${P.label}: ${Se}`));return{flags:Y,values:re,lists:ie,positionals:de,help:we,errors:fe}}function Dn(P){for(let O of P)console.error(O);return P.length>0}import{readdirSync as yp,statSync as Ps,unlinkSync as hp}from"node:fs";import{basename as Rs,dirname as vp,isAbsolute as bp,join as wp,relative as kp,resolve as xp,sep as Cp}from"node:path";var xs=(P)=>{let O=Date.now()-new Date(P).getTime();if(!Number.isFinite(O))return"";let D=Math.floor(O/60000),j=Math.floor(D/60),J=Math.floor(j/24);if(J>0)return`${J}d ago`;if(j>0)return`${j}h ago`;if(D>0)return`${D}m ago`;return"just now"},Ro=(P)=>{let O=(P??"").trim().split(/\s+/).filter((J)=>J&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(J)),D=O[0]?.split("/").pop();if(!D)return null;let j=O[1];return j&&/^[a-z][a-z0-9-]*$/.test(j)?`${D} ${j}`:D};function Cs(P){let O=(J)=>`${J.sessionId}
 ${Ro(J.segment||J.command)}`,D=P.filter((J)=>J.decision!=="allow"),j=D.filter((J)=>J.sessionId).reduce((J,Y)=>J.set(O(Y),(J.get(O(Y))??0)+1),new Map);return new Set(D.filter((J)=>J.failureStage||(j.get(O(J))??0)>=2))}import{existsSync as dp,readdirSync as up,readFileSync as pp}from"node:fs";import{join as fp}from"node:path";function Kn(P,O){try{return up(P,{withFileTypes:!0,encoding:"utf8"}).flatMap((D)=>{let j=fp(P,D.name);if(D.isDirectory())return Kn(j,O);if(D.name.endsWith(".jsonl"))return[j];return[]})}catch{if(O&&dp(P))O.count++;return[]}}var mp=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function gp(P){if(!P||typeof P!=="object"||Array.isArray(P))return!1;let O=P;if(typeof O.ts!=="string"||typeof O.command!=="string")return!1;return mp.every((D)=>O[D]===void 0||typeof O[D]==="string")}function kt(P,O){try{return pp(P,"utf-8").split(`
 `).filter(Boolean).flatMap((D)=>{try{let j=JSON.parse(D);if(!gp(j)){if(O)O.count++;return[]}return[j]}catch{if(O)O.count++;return[]}})}catch{if(O)O.count++;return[]}}function hn(P){return Array.from(P,(O)=>{let D=O.charCodeAt(0);if(D<=31||D>=127&&D<=159)return`\\x${D.toString(16).padStart(2,"0")}`;return O}).join("")}function Sp(P,O){let D=oe(P),j=yn({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},O);if(Dn(j.errors))return null;if(j.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(j.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let J=j.values.limit===void 0?20:Ss(j.values.limit);if(J===null)return console.error("--limit must be a positive number"),null;let Y=j.values.since===void 0?Math.min(30,D):Ss(j.values.since);if(Y===null||Y>D)return console.error(`--since must be a positive number of days no greater than ${D}`),null;let re={limit:J,limitExplicit:j.values.limit!==void 0,since:Y,sinceExplicit:j.values.since!==void 0,all:j.flags.all,json:j.flags.json,suspect:j.flags.suspect,pruneLegacy:j.flags.pruneLegacy,dryRun:j.flags.dryRun,id:j.values.id,agent:j.values.agent,rule:j.values.rule,session:j.values.session,project:j.values.project===void 0?void 0:xp(j.values.project)};if(re.id&&(re.agent!==void 0||re.rule!==void 0||re.session!==void 0||re.project!==void 0||re.suspect||re.sinceExplicit||re.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(re.pruneLegacy&&(re.id!==void 0||re.agent!==void 0||re.rule!==void 0||re.session!==void 0||re.project!==void 0||re.suspect||re.all||re.sinceExplicit||re.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(re.dryRun&&!re.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return re}async function Es(P,O,D={}){let j=Sp(P,O);if(!j)return 1;let J=D.logsDir??U(P);if(j.pruneLegacy)return Pp(J,j.json,j.dryRun);if(!J)return console.log(j.json?"[]":j.id?`No retained audit log entry found for id ${hn(j.id)}.`:"No audit log entries found."),0;K(P,J);let Y={count:0},re=Kn(J,Y).flatMap((Ce)=>kt(Ce,Y).map((Se)=>({entry:Se,file:Ce})));if(Y.count>0)console.error(`warning: ${Y.count} audit log ${Y.count===1?"source":"sources"} could not be read; these results are incomplete`);if(j.id)return Ap(re,j,D.timeZone);let ie=Date.now()-j.since*24*60*60*1000,de=re.filter((Ce)=>Tp(Ce,j,J,ie)),fe=j.suspect?Cs(de.map((Ce)=>Ce.entry)):null,we=(fe?de.filter((Ce)=>fe.has(Ce.entry)):de).sort((Ce,Se)=>Date.parse(Se.entry.ts)-Date.parse(Ce.entry.ts)).slice(0,j.limit);if(j.json)return console.log(JSON.stringify(we.map((Ce)=>Ce.entry),null,2)),0;if(we.length===0)return console.log("No audit log entries found."),0;for(let Ce of we)console.log(Op(Ce.entry,D.timeZone));return 0}function Pp(P,O,D){let j=P?Ep(P).map((ie)=>wp(P,ie)):[];if(D)return Rp(j,O);let J=[],Y=0,re=0;for(let ie of j){let de=Ps(ie,{throwIfNoEntry:!1})?.size??0,fe=_p(ie);if(fe){J.push(`${Rs(ie)}: ${fe}`);continue}Y++,re+=de}if(O)return console.log(JSON.stringify({removedFiles:Y,removedBytes:re,failedFiles:J.length})),J.length===0?0:1;console.log(Y===0&&J.length===0?"No legacy audit log files found.":`Removed ${Y} legacy audit log ${Y===1?"file":"files"} (${_s(re)}).`);for(let ie of J)console.error(`Could not remove ${hn(ie)}`);if(console.log("Nested v2 audit logs were not changed."),Y>0)console.log("This deletion cannot be undone.");return J.length===0?0:1}function Rp(P,O){let D=P.reduce((j,J)=>j+(Ps(J,{throwIfNoEntry:!1})?.size??0),0);if(O)return console.log(JSON.stringify({dryRun:!0,files:P.length,bytes:D})),0;if(console.log(P.length===0?"No legacy audit log files found.":`Would remove ${P.length} legacy audit log ${P.length===1?"file":"files"} (${_s(D)}).`),console.log("Nested v2 audit logs are not included."),P.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Ep(P){try{return yp(P,{withFileTypes:!0}).filter((O)=>O.isFile()&&O.name.endsWith(".jsonl")).map((O)=>O.name)}catch{return[]}}function _p(P){try{return hp(P),null}catch(O){return O instanceof Error?O.message:String(O)}}function _s(P){let O=["B","KiB","MiB","GiB"],D=Math.min(Math.floor(Math.log2(Math.max(P,1))/10),O.length-1);return`${Math.round(P/1024**D*10)/10} ${O[D]}`}function Ap(P,O,D){let j=P.filter((Y)=>Y.entry.id===O.id);if(j.length>1)return console.error(`Multiple audit log entries found for id ${hn(O.id??"")}.`),1;if(O.json)return console.log(JSON.stringify(j.map((Y)=>Y.entry),null,2)),0;let J=j[0];if(!J)return console.log(`No retained audit log entry found for id ${hn(O.id??"")}.`),0;return console.log(Dp(J.entry,D)),0}function Tp(P,O,D,j){if(!O.all&&P.entry.decision==="allow")return!1;if(Date.parse(P.entry.ts)<j)return!1;if(O.agent!==void 0&&P.entry.agent!==O.agent)return!1;if(O.rule!==void 0&&P.entry.ruleId!==O.rule)return!1;if(O.session!==void 0&&!Ip(P,D,O.session))return!1;if(O.project!==void 0&&!$p(P.entry.cwd,O.project))return!1;return!0}function Ip(P,O,D){if(P.entry.sessionId===D)return!0;return vp(P.file)===O&&Rs(P.file,".jsonl")===D}function $p(P,O){if(!P)return!1;let D=kp(O,P);return D!==".."&&!D.startsWith(`..${Cp}`)&&!bp(D)}function Op(P,O){let D=hn(P.id??"-"),j=hn(P.decision??"deny"),J=P.cwd?`  [${hn(P.cwd)}]`:"",Y=P.segment||P.command,re=Y===P.command?"":"↳ ",ie=Y.length>50?`${Y.slice(0,50)}…`:Y;return`${D.padEnd(16)}  ${hn(As(P.ts,O))}  ${j.padEnd(5)}  ${hn(P.agent??"-").padEnd(15)}  ${hn(P.ruleId??"-").padEnd(20)}  ${re}${hn(ie)}${J}`}function Dp(P,O){let D=(J)=>hn(J===void 0||J===null||J===""?"-":J),j=P.shape?`${P.agent??"-"} (shape: ${P.shape})`:P.agent??"-";return[`id:        ${D(P.id)}`,`ts:        ${D(As(P.ts,O))}`,`decision:  ${D(P.decision)}`,`agent:     ${D(j)}`,`level:     ${D(P.level)}`,`tool:      ${D(P.toolName)}`,`rule:      ${D(P.ruleId)}`,`intent:    ${D(P.intent)}`,`stage:     ${D(P.failureStage)}`,`error:     ${D(P.errorCode)}`,`session:   ${D(P.sessionId)}`,`cwd:       ${D(P.cwd)}`,`version:   ${D(P.v)}`,`truncated: ${D(P.truncated===!0?"yes":void 0)}`,`reason:    ${D(P.reason)}`,`command:   ${D(P.command)}`,`segment:   ${D(P.segment)}`].join(`
 `)}function As(P,O){let D=new Date(P);if(Number.isNaN(D.getTime()))return P;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:O}).format(D)}function Ss(P){let O=Number(P);return Number.isFinite(O)&&O>0?O:null}var Ts={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var Is={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var $s={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};var Eo=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],Os=["cursor-agent","--version"],mr=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:10,runtime:{order:8,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:10,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:9,runtime:{order:7,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:9,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:11,runtime:{order:9,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:12,runtime:{order:10,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:12,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:13,runtime:{order:11,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:13,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:14,install:{order:14,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:15,install:{order:15,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:16,install:{order:16,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:Eo}},{id:"devin",displayName:"Devin CLI",doctorOrder:7,runtime:{order:5,flags:["-dv","--devin"],description:"Run as Devin CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:7,flag:"--devin",artifactKind:"hook config",probeCommand:["devin","--version"]}},{id:"droid",displayName:"Factory Droid",doctorOrder:8,runtime:{order:6,flags:["-fd","--droid"],description:"Run as Factory Droid PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--droid",artifactKind:"hook config",probeCommand:["droid","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],gr=mr.slice().sort((P,O)=>P.doctorOrder-O.doctorOrder).map((P)=>P.id),Ht=mr.filter((P)=>("runtime"in P)).slice().sort((P,O)=>P.runtime.order-O.runtime.order).map((P)=>({id:P.id,displayName:"displayName"in P.runtime?P.runtime.displayName:P.displayName,flags:P.runtime.flags,legacyFlags:"legacyFlags"in P.runtime?P.runtime.legacyFlags:[],description:P.runtime.description,legacyTopLevelFlags:P.runtime.legacyTopLevelFlags})),En=mr.slice().sort((P,O)=>P.install.order-O.install.order).map((P)=>({id:P.id,...P.install})).map(({order:P,...O})=>O),Lp=Object.fromEntries(mr.map((P)=>[P.id,P.displayName]));function mn(P){return Lp[P]}var Np=Ht.map((P)=>({flags:P.flags.join(", "),description:P.description})),jp=Ht.flatMap((P)=>P.flags.map((O)=>`cc-safety-net hook ${O}`)),Ds={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Np,{flags:"-h, --help",description:"Show this help"}],examples:jp};var Ls={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...En.map((P)=>({flags:P.flag,description:`Install ${mn(P.id)} ${P.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...En.map((P)=>`cc-safety-net install ${P.flag}`)]},Ns={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...En.map((P)=>({flags:P.flag,description:`Uninstall ${mn(P.id)} ${P.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...En.map((P)=>`cc-safety-net uninstall ${P.flag}`)]},js={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var Fs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var yr={name:"policy",description:"Check and apply project or user policy proposals",usage:"policy <subcommand>",subcommands:[{usage:"check <file>",description:"Validate a policy proposal and print its diff"},{usage:"apply <file>",description:"Apply a proposal after confirming in a terminal"}],options:[{flags:"-g, --global",description:"Use the user-scope policy instead of the project one"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net policy check proposal.json","cc-safety-net policy apply proposal.json","cc-safety-net policy apply proposal.json --global"]};var _o=[{flags:"--ref",argument:"<ref>",description:"Use a branch, tag, or commit"},{flags:"--only",argument:"<rulebook...>",description:"Add only these repository rulebooks"},{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"-h, --help",description:"Show this help"}],Ao=["cc-safety-net rule add project-rules","cc-safety-net rule add acme/safety-rules","cc-safety-net rule add acme/safety-rules --only aws gcloud","cc-safety-net rule add acme/safety-rules --ref v2 --only aws","cc-safety-net rule add --only terraform aws"],xt={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add [source] [--ref <ref>] [--only <rulebook...>]",description:"Add rulebook sources and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Re-fetch and vendor remote rulebooks"},{usage:"sync",description:"Deprecated: migrate lock and cache leftovers"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},..._o.slice(0,2),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk",...Ao,"cc-safety-net rule update","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var Hs={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var Ms={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var hr=[Hs,Ts,Fs,Is,xt,yr,Ls,js,Ns,Ds,$s,Ms];function Fp(P){return P.aliases??[]}function vr(P){let O=P.toLowerCase();return hr.find((D)=>D.name.toLowerCase()===O||Fp(D).some((j)=>j.toLowerCase()===O))}import{existsSync as xy}from"node:fs";import{basename as Hp}from"node:path";function br(P,O=7,D=U(P)){let j=Date.now()-O*24*60*60*1000,J=[],Y=new Set,re=0,ie,de,fe,we;if(D)K(P,D);let Ce={count:0},Se=D?Kn(D,Ce):[];for(let Ee of Se)for(let qe of kt(Ee,Ce)){if(qe.decision==="allow")continue;let Me=new Date(qe.ts).getTime();if(Me>=j){if(re++,Y.add(qe.sessionId??Hp(Ee,".jsonl")),de===void 0||Me<=de)ie=qe.ts,de=Me;if(we===void 0||Me>we)fe=qe.ts,we=Me;Mp(J,qe,Me)}}let Ie=J.map((Ee)=>({timestamp:Ee.ts,command:Ee.command,reason:Ee.reason,relativeTime:xs(new Date(Ee.ts))}));return{totalBlocked:re,sessionCount:Y.size,recentEntries:Ie,oldestEntry:ie,newestEntry:fe,unreadable:Ce.count}}function Mp(P,O,D){let j=P.findIndex((J)=>D>new Date(J.ts).getTime());if(j===-1){if(P.length<3)P.push(O);return}if(P.splice(j,0,O),P.length>3)P.pop()}import{dirname as Xp}from"node:path";import{dirname as Up,join as Gp,resolve as qp}from"node:path";var Bp="config.json";function wn(P,O,D,j){g(Vp(P),`${JSON.stringify(O,null,2)}
@@ -18,7 +18,7 @@ ${Ro(J.segment||J.command)}`,D=P.filter((J)=>J.decision!=="allow"),j=D.filter((J
 `)}function xr(P){return Wn({rows:P})}function oa(P){let O=[];return O.push("System Info"),O.push(Cf(P)),O.join(`
 `)}function Cf(P){let O=["Component","Version"],D=(Y)=>{if(Y===null)return nn.dim("not found");return Y},J=[{label:"cc-safety-net",value:P.version},...gr.map((Y)=>({label:mn(Y),value:P.versions[Y]??null})),{label:"Node.js",value:P.nodeVersion},{label:"npm",value:P.npmVersion},{label:"Bun",value:P.bunVersion},{label:"Platform",value:P.platform}].map((Y)=>[Y.label,D(Y.value)]);return Wn({headers:O,rows:J})}function ia(P){if(P.findings.length===0)return nn.green(`
 No findings from inspected doctor facts.`);let O={error:P.findings.filter((Y)=>Y.severity==="error").length,warning:P.findings.filter((Y)=>Y.severity==="warning").length,info:P.findings.filter((Y)=>Y.severity==="info").length},D=["error","warning","info"].filter((Y)=>O[Y]>0).map((Y)=>`${O[Y]} ${Y}`),j=P.findings.length===1?"finding":"findings",J=`
-${P.findings.length} ${j}: ${D.join(", ")}.`;if(O.error>0)return nn.red(J);if(O.warning>0)return nn.yellow(J);return nn.blue(J)}import{lstatSync as Sf}from"node:fs";import{dirname as Do}from"node:path";function Lo(P,O){try{let D=Sf(O);if(D.isSymbolicLink())return{kind:P,path:O,status:"unsafe",issues:["symlink"]};if(!D.isDirectory())return{kind:P,path:O,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:P,path:O,status:"unknown",issues:[]};let j=[...D.uid!==process.getuid()?["ownership"]:[],...(D.mode&18)!==0?["permissions"]:[]];return{kind:P,path:O,status:j.length>0?"unsafe":"safe",issues:j}}catch(D){if(typeof D==="object"&&D!==null&&"code"in D&&D.code==="ENOENT")return{kind:P,path:O,status:"not-applicable",issues:[]};return{kind:P,path:O,status:"unknown",issues:[]}}}function sa(P,O){let D=U(P);return{directories:[Lo("policy",Do(Do(O))),Lo("config",Do(O)),...D?[Lo("audit",D)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Pf}from"node:child_process";import{existsSync as aa}from"node:fs";import{delimiter as Rf,extname as Ef,join as _f}from"node:path";import{stripVTControlCharacters as la}from"node:util";var da="2.6.5",Af=5000,Tf="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function pn(){return da}function No(P,O){let D=P[O];if(D)return D;let j=Object.keys(P).find((J)=>J.toLowerCase()===O.toLowerCase()&&!!P[J]);return j?P[j]:D}function If(P){return(No(P,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((O)=>O.length>0)}function $f(P,O){let D=Ef(P)?[P]:[...If(O).map((j)=>`${P}${j}`),P];if(P.includes("/")||P.includes("\\"))return D.find((j)=>aa(j))??P;return(No(O,"PATH")??"").split(Rf).flatMap((j)=>D.map((J)=>_f(j,J))).find((j)=>aa(j))??P}function ca(P){if(!/[\s"&|<>^]/.test(P))return P;return`"${P.replace(/"/g,'""')}"`}function zn(P,O){let[D,...j]=P,J=O[Tf]==="win32"?"win32":process.platform;if(!D||J!=="win32")return{cmd:D??"",args:j};let Y=$f(D,O);if(!/\.(?:bat|cmd)$/i.test(Y))return{cmd:Y,args:j};return{cmd:No(O,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",ca(Y),...j.map(ca)].join(" ")]}}var St=async(P,O=Af)=>{let D=await Of(P,{timeoutMs:O});if(D.code!==0)return null;return la(D.stdout).trim()||la(D.stderr).trim()||null};function Of(P,O){let[D,...j]=P;if(!D)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((J)=>{try{let Y=zn([D,...j],process.env),re=Pf(Y.cmd,Y.args,{stdio:["ignore","pipe","pipe"]}),ie=!1,de="",fe="";re.stdout.on("data",(Se)=>{de+=Se.toString()}),re.stderr.on("data",(Se)=>{fe+=Se.toString()});let we=(Se)=>{if(ie)return;ie=!0,clearTimeout(Ce),J(Se)},Ce=setTimeout(()=>{re.kill(),we({code:null,stdout:de,stderr:fe})},O.timeoutMs);re.on("close",(Se)=>{we({code:Se,stdout:de,stderr:fe})}),re.on("error",()=>{we({code:null,stdout:de,stderr:fe})})}catch{J({code:null,stdout:"",stderr:""})}})}function Cr(P){if(!P)return null;let O=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(P);if(O)return O[1]??null;let D=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(P);if(D)return D[1]??null;return P.split(`
+${P.findings.length} ${j}: ${D.join(", ")}.`;if(O.error>0)return nn.red(J);if(O.warning>0)return nn.yellow(J);return nn.blue(J)}import{lstatSync as Sf}from"node:fs";import{dirname as Do}from"node:path";function Lo(P,O){try{let D=Sf(O);if(D.isSymbolicLink())return{kind:P,path:O,status:"unsafe",issues:["symlink"]};if(!D.isDirectory())return{kind:P,path:O,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:P,path:O,status:"unknown",issues:[]};let j=[...D.uid!==process.getuid()?["ownership"]:[],...(D.mode&18)!==0?["permissions"]:[]];return{kind:P,path:O,status:j.length>0?"unsafe":"safe",issues:j}}catch(D){if(typeof D==="object"&&D!==null&&"code"in D&&D.code==="ENOENT")return{kind:P,path:O,status:"not-applicable",issues:[]};return{kind:P,path:O,status:"unknown",issues:[]}}}function sa(P,O){let D=U(P);return{directories:[Lo("policy",Do(Do(O))),Lo("config",Do(O)),...D?[Lo("audit",D)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Pf}from"node:child_process";import{existsSync as aa}from"node:fs";import{delimiter as Rf,extname as Ef,join as _f}from"node:path";import{stripVTControlCharacters as la}from"node:util";var da="2.6.6",Af=5000,Tf="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function pn(){return da}function No(P,O){let D=P[O];if(D)return D;let j=Object.keys(P).find((J)=>J.toLowerCase()===O.toLowerCase()&&!!P[J]);return j?P[j]:D}function If(P){return(No(P,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((O)=>O.length>0)}function $f(P,O){let D=Ef(P)?[P]:[...If(O).map((j)=>`${P}${j}`),P];if(P.includes("/")||P.includes("\\"))return D.find((j)=>aa(j))??P;return(No(O,"PATH")??"").split(Rf).flatMap((j)=>D.map((J)=>_f(j,J))).find((j)=>aa(j))??P}function ca(P){if(!/[\s"&|<>^]/.test(P))return P;return`"${P.replace(/"/g,'""')}"`}function zn(P,O){let[D,...j]=P,J=O[Tf]==="win32"?"win32":process.platform;if(!D||J!=="win32")return{cmd:D??"",args:j};let Y=$f(D,O);if(!/\.(?:bat|cmd)$/i.test(Y))return{cmd:Y,args:j};return{cmd:No(O,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",ca(Y),...j.map(ca)].join(" ")]}}var St=async(P,O=Af)=>{let D=await Of(P,{timeoutMs:O});if(D.code!==0)return null;return la(D.stdout).trim()||la(D.stderr).trim()||null};function Of(P,O){let[D,...j]=P;if(!D)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((J)=>{try{let Y=zn([D,...j],process.env),re=Pf(Y.cmd,Y.args,{stdio:["ignore","pipe","pipe"]}),ie=!1,de="",fe="";re.stdout.on("data",(Se)=>{de+=Se.toString()}),re.stderr.on("data",(Se)=>{fe+=Se.toString()});let we=(Se)=>{if(ie)return;ie=!0,clearTimeout(Ce),J(Se)},Ce=setTimeout(()=>{re.kill(),we({code:null,stdout:de,stderr:fe})},O.timeoutMs);re.on("close",(Se)=>{we({code:Se,stdout:de,stderr:fe})}),re.on("error",()=>{we({code:null,stdout:de,stderr:fe})})}catch{J({code:null,stdout:"",stderr:""})}})}function Cr(P){if(!P)return null;let O=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(P);if(O)return O[1]??null;let D=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(P);if(D)return D[1]??null;return P.split(`
 `)[0]?.trim()||null}async function Sr(P,O=St,D=process.cwd()){let j=Promise.all(En.map(async(Ce)=>[Ce.id,Cr(await O([...Ce.probeCommand]))])),[J,Y,re,ie,de,fe,we]=await Promise.all([j,j.then(async(Ce)=>{let Se=Ce.find(([qe])=>qe==="opencode")?.[1];if(!Se?.startsWith("2.")||!P(Se))return null;let Ie=["--param",`location[directory]=${D}`],Ee=["opencode","api","integration.list",...Ie];return await O(Ee,30000),O(["opencode","api","plugin.list",...Ie],30000)}),O(["codex","plugin","list"],30000),O(["amp","plugins","list"],30000),O(["node","--version"]),O(["npm","--version"]),O(["bun","--version"])]);return{version:da,versions:Object.fromEntries(J),codexPluginListOutput:re,ampPluginListOutput:ie,openCodePluginListOutput:Y,nodeVersion:Cr(de),npmVersion:Cr(fe),bunVersion:Cr(we),platform:`${process.platform} ${process.arch}`}}function jo(P,O){if(O==="dev")return!1;let D=P.split(".").map(Number),j=O.split(".").map(Number),[J=0,Y=0,re=0]=D,[ie=0,de=0,fe=0]=j;if(J!==ie)return J>ie;if(Y!==de)return Y>de;return re>fe}async function Gn(){let P=pn(),O=new AbortController,D=setTimeout(()=>O.abort(),3000);try{let j=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:O.signal});if(!j.ok)return{currentVersion:P,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${j.status}`};let J=await j.json(),Y=jo(J.version,P);return{currentVersion:P,latestVersion:J.version,updateAvailable:Y}}catch(j){return{currentVersion:P,latestVersion:null,updateAvailable:!1,error:j instanceof Error?j.message:"Network error"}}finally{clearTimeout(D)}}import*as va from"node:readline";var ma=(P)=>`\x1B[${P}B`,Df=(P)=>`\x1B[${P}A`;var ua=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function Lf(P){return new Promise((O)=>setTimeout(O,P))}function Nf(P,O,D){if(!D)return O(P);if(D.aborted)return Promise.resolve();return new Promise((j,J)=>{let Y=()=>D.removeEventListener("abort",re),re=()=>{Y(),j()};D.addEventListener("abort",re,{once:!0}),O(P).then(()=>{Y(),j()},(ie)=>{Y(),J(ie)})})}function Pr(P){return Math.max(0,Math.min(1,P))}function Pt(P){return Math.max(0,Math.min(255,Math.round(P)))}function Fo(P){return P<=0.0031308?12.92*P:1.055*P**0.4166666666666667-0.055}function jf(P,O,D){let j=D*Math.PI/180,J=O*Math.cos(j),Y=O*Math.sin(j),re=(P+0.3963377774*J+0.2158037573*Y)**3,ie=(P-0.1055613458*J-0.0638541728*Y)**3,de=(P-0.0894841775*J-1.291485548*Y)**3;return{blue:Pt(Fo(Pr(-0.0041960863*re-0.7034186147*ie+1.707614701*de))*255),green:Pt(Fo(Pr(-1.2684380046*re+2.6097574011*ie-0.3413193965*de))*255),red:Pt(Fo(Pr(4.0767416621*re-3.3077115913*ie+0.2309699292*de))*255)}}function Ho(P,O){let D=(O*P*180/Math.PI%360+360)%360;return jf(0.72,0.15,D)}function ga(P,O=0.1){let D=Ho(O,P);return`\x1B[38;2;${D.red};${D.green};${D.blue}m`}function Ff(P,O){return{blue:Pt(P.blue+(255-P.blue)*O),green:Pt(P.green+(255-P.green)*O),red:Pt(P.red+(255-P.red)*O)}}function ya(P,O,D){let j=Math.imul(P+2654435769,2246822507)^Math.imul(O+3266489909,668265263)^Math.imul(D+374761393,2654435761),J=j^j>>>15,Y=Math.imul(J,739982445),re=Y^Y>>>12,ie=Math.imul(re,695872825);return((ie^ie>>>15)>>>0)/4294967296}function Hf(P,O,D){let j=Math.floor(ya(P,O,D)*ua.length);return ua[j]??"░"}function pa(P){let O=Pr(P);return O*O*O*(O*(O*6-15)+10)}function Mf(P){if(P.length===0)return"";let O=[],D=!1,j="";for(let J of P){let Y=`${J.red};${J.green};${J.blue}`;if(J.bold!==D)O.push(J.bold?"\x1B[1m":"\x1B[22m"),D=J.bold;if(Y!==j)O.push(`\x1B[38;2;${Y}m`),j=Y;O.push(J.character)}return`${O.join("")}\x1B[22m\x1B[39m`}function Uf(P,O,D,j,J){return P.map((Y,re)=>({...Ho(D,j+O+re/J),bold:!1,character:Y}))}function Gf(P,O,D,j,J,Y,re,ie){let de=Math.max(1,j*0.75),fe=Math.min(1,D/de),we=J*pa(fe),Ce=Math.max(0,(D-de)/Math.max(1,j-de)),Se=(1-pa(D/j))*ie*2,Ie=0.35*Math.max(0,1-Ce*2),Ee=fe>=1,qe=Math.min(P.length,Math.ceil(we+2+1));return P.slice(0,qe).map((Me,en)=>{let on=Ho(Y,re+O+en/ie+Se),sn=en+ya(O,en,7919)*2-1;if(sn>we+2)return{...on,bold:!1,character:" "};let an=we-sn,rn=0.8*Math.exp(-(an*an)/12.5),fn=Math.min(0.9,rn+Ie),On=!Ee&&sn>we-4;return{...Ff(on,fn),bold:fn>0.3,character:On?Hf(O,en,D):Me}})}function fa(P){return`\x1B[?2026h${P.map((O,D)=>`\x1B8${D>0?ma(D):""}${Mf(O)}`).join("")}\x1B[?2026l`}async function Mo(P,O={}){if(!P)return;let D=O.output??process.stdout,j=O.sleep??Lf,J=O.seed??0,Y=P.split(`
 `).map((we)=>Array.from(we)),re=Math.max(...Y.map((we)=>we.length)),ie=12000*Y.filter((we)=>we.length>0).length/40,de=re>0?Math.max(1,Math.ceil(ie/16.666666666666668)):0,fe=de>0?ie/de:0;D.write(`\x1B[?25l${Y.length>1?`${`
 `.repeat(Y.length-1)}${Df(Y.length-1)}`:""}\x1B7`);try{for(let we=1;we<=de;we+=1){if(O.signal?.aborted)break;D.write(fa(Y.map((Ce,Se)=>Gf(Ce,Se,we,de,re,0.1,J,3)))),await Nf(fe,j,O.signal)}}finally{if(D.write(fa(Y.map((we,Ce)=>Uf(we,Ce,0.1,J,3)))),D.write("\x1B8"),Y.length>1)D.write(ma(Y.length-1));D.write(`
@@ -223,7 +223,7 @@ def register(ctx):
 `));return{path:J[0]??D??Tn(Ei(P),Ri[0]),alreadyInstalled:J.length>0}}function Ot(P){let O=[];for(let D of P.openCodeVersion?.startsWith("2.")?_i(P.environment):Ai(P.environment))if(fy(D))try{let j=my(D,"utf-8"),J=vn(j),Y=JSON.parse(J);if($i(Y)){let re=Ti(P.openCodePluginListOutput);if(re)return{platform:"opencode",status:"disabled",method:"opencode api plugin.list",configPath:D,errors:[...O,re]};return{platform:"opencode",status:"configured",method:"plugin array",configPath:D,errors:O.length>0?O:void 0}}}catch(j){O.push(`Failed to parse ${gy(D)}: ${j instanceof Error?j.message:String(j)}`)}return{platform:"opencode",status:"n/a",errors:O.length>0?O:void 0}}import{join as yc}from"node:path";function Oi(P){let O=P.env.get("PI_CODING_AGENT_DIR");return yc(O?Nn(O,P.home):yc(P.home,".pi","agent"),"settings.json")}function Di(P){if(typeof P!=="string")return!1;return P==="npm:cc-safety-net"||P.startsWith("npm:cc-safety-net@")}function hc(P){let O=Oi(P.environment),D=xn(O);if(D.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(D.kind==="missing")return{platform:"pi",status:"n/a"};let j=tn(D.value,"packages");if(!Array.isArray(j))return{platform:"pi",status:"n/a"};let J=j.find((ie)=>Di(typeof ie==="string"?ie:tn(ie,"source")));if(J===void 0)return{platform:"pi",status:"n/a"};let Y=tn(J,"extensions");if(Array.isArray(Y)&&Y.some((ie)=>typeof ie==="string"&&ie.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:O,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:O}}var yy={amp:Aa,"antigravity-cli":Ta,"claude-code":Oa,codex:La,"copilot-cli":Za,cursor:sl,"deepseek-harness":ll,devin:yl,droid:Pl,"gemini-cli":Rl,"grok-build":Ll,"hermes-agent":Kl,"kimi-code":Yt,openclaw:sc,opencode:Ot,pi:hc};function Dt(P,O,D){let j={...D,cwd:O,environment:P};return gr.map((J)=>hy(yy[J](j)))}function hy(P){if(P.status==="not-inspected")return{platform:P.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:P.platform,detected:P.status!=="n/a",configured:P.status==="configured",inspectionStatus:P.status!=="n/a"?"verified":P.errors&&P.errors.length>0?"failed":"not-applicable",method:P.method,configPath:P.configPath,configPaths:P.configPaths,errors:P.errors}}import{join as vy}from"node:path";var by=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),wy=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),ky={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function vc(P){let O=vy(P.tmpdir,"cc-safety-net-self-test"),D=by.map((j)=>{let J=G(P,u("self-test",{command:j.command},{kind:"command",shell:"auto"},{configCwd:O,executionCwd:O},j.command),{guard:{dependencies:{loadPolicySnapshot:()=>wy,getModes:()=>ky,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),Y=j.expectBlocked?"blocked":"allowed",re=J.decision.kind==="deny"?"blocked":"allowed";return{command:j.command,description:j.description,expected:Y,actual:re,passed:Y===re,reason:J.decision.kind==="deny"?J.decision.reason:void 0,ruleId:J.decision.kind==="deny"?J.decision.ruleId:void 0}});return{passed:D.filter((j)=>j.passed).length,failed:D.filter((j)=>!j.passed).length,total:D.length,results:D}}function Li(P){let O=yn({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},P);if(Dn(O.errors))return null;return{json:O.flags.json,skipUpdateCheck:O.flags.skipUpdateCheck}}async function bc(P,O={}){let D=await Ut(!O.json,()=>{let j=Cy(P,O);return{ready:j,finish:()=>j}},()=>Mt(),{loadingMessage:"Checking system status…"});if(O.json)console.log(JSON.stringify(D,null,2));else Sy(D);return D.engineSelfTest.failed>0||D.findings.some((j)=>j.severity==="error")?1:0}async function Cy(P,O){let D=O.cwd??process.cwd(),j=await Sr((Me)=>Ot({environment:P,cwd:D,openCodeVersion:Me}).status!=="n/a",void 0,D),J=Dt(P,D,{ampPluginListOutput:j.ampPluginListOutput,codexPluginListOutput:j.codexPluginListOutput,copilotCliVersion:j.versions["copilot-cli"],openCodeVersion:j.versions.opencode,openCodePluginListOutput:j.openCodePluginListOutput}),Y=Vs(P,D),re=Js(P),ie=k(P,{cwd:D}),de=ie.policy,fe=T(de,P.env),we=V(de,fe.capabilities),Ce=br(P,7),Se=Sa(P,D),Ie=[wr(D),Ct(P)].filter((Me)=>xy(Me)),Ee=O.skipUpdateCheck?{currentVersion:pn(),latestVersion:null,updateAvailable:!1}:await Gn(),qe={hooks:J,engineSelfTest:vc(P),userConfig:Y.userConfig,projectConfig:Y.projectConfig,configState:je(ie),effectiveRules:Y.effectiveRules,environment:re,effectiveSafety:{selectedPreset:de.safety.level??"standard",level:fe.effectiveLevel,capabilities:fe.capabilities,ruleOverrides:de.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(we).filter(([,Me])=>Me.source==="rule_override"&&Me.override==="off"&&Me.inheritedEnabled&&Me.changesInherited).map(([Me])=>Me),ruleCounts:{stored:Object.keys(de.destructiveCommandRuleOverrides).length,effective:Object.values(we).filter((Me)=>Me.changesInherited).length},...ie.policyScopes?{policyScopes:ie.policyScopes}:{}},...Se.length>0?{v2Leftovers:Se}:{},...Ie.length>0?{legacyConfigs:Ie}:{},posture:sa(P,Y.userConfig.path),activity:Ce,update:Ee,system:j};return{...qe,findings:Ws(qe)}}function Sy(P){console.log(),console.log(Ys(P.hooks)),console.log(),console.log(Zs(P.engineSelfTest)),console.log(),console.log(Xs(P)),console.log(),console.log(Qs(P.environment)),console.log(),console.log(ea(P)),console.log(),console.log(na(P.findings)),console.log(),console.log(ta(P.activity)),console.log(),console.log(oa(P.system)),console.log(),console.log(ra(P.update)),console.log(ia(P))}import{existsSync as Py}from"node:fs";var Ry=/^[A-Za-z0-9_@%+=:,./-]+$/,wc="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function Ni(P){let O=yn({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},P);if(Dn(O.errors))return console.error(wc),console.error("Pass -- before a command that starts with dashes."),null;if(O.values.cwd!==void 0&&!Py(O.values.cwd))return console.error(`Error: --cwd path does not exist: ${O.values.cwd}`),null;let D=O.positionals.length===1?O.positionals[0]:O.positionals.map((j)=>Ry.test(j)?j:`'${j.replaceAll("'","'\\''")}'`).join(" ");if(!D)return console.error("Error: No command provided"),console.error(wc),null;return{json:O.flags.json,cwd:O.values.cwd,command:D}}function kc(P){if(P)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function xc(P,O){let j=O-18;return[`${P.dtl}${P.dh.repeat(O)}${P.dtr}`,`${P.dv}  Command Analysis${" ".repeat(j)}${P.dv}`,`${P.dbl}${P.dh.repeat(O)}${P.dbr}`]}function ji(P){return JSON.stringify(P)}function Cc(P,O=0){return`[${P.map((j,J)=>zs(j,J,O)).join(",")}]`}function er(P,O,D=70){let j=P.split(" "),J=[],Y="";for(let re of j)if(Y&&Y.length+re.length+1>D)J.push(Y),Y=re;else Y=Y?`${Y} ${re}`:re;if(Y)J.push(Y);return J.map((re,ie)=>ie===0?re:`${O}${re}`)}function Sc(P,O,D){let j=[];switch(P.type){case"parse":return null;case"env-strip":return j.push(""),j.push(`STEP ${O} ${D.h} Strip environment variables`),j.push(`  Removed: ${P.envVars.map((J)=>`${J}=<redacted>`).join(", ")}`),j.push(`  Tokens:  ${ji(P.output)}`),{lines:j,incrementStep:!0};case"leading-tokens-stripped":return j.push(""),j.push(`STEP ${O} ${D.h} Strip wrappers`),j.push(`  Removed: ${P.removed.join(", ")}`),j.push(`  Tokens:  ${ji(P.output)}`),{lines:j,incrementStep:!0};case"shell-wrapper":return j.push(""),j.push(`STEP ${O} ${D.h} Detect shell wrapper`),j.push(`  Wrapper: ${P.wrapper} -c`),j.push(`  Inner:   ${P.innerCommand}`),{lines:j,incrementStep:!0};case"interpreter":{if(j.push(""),j.push(`STEP ${O} ${D.h} Detect interpreter`),j.push(`  Interpreter: ${P.interpreter}`),j.push(`  Code:        ${P.codeArg}`),P.paranoidBlocked)j.push("  Result:      ✗ BLOCKED (paranoid mode)");return{lines:j,incrementStep:!0}}case"busybox":return j.push(""),j.push(`STEP ${O} ${D.h} Busybox wrapper`),j.push(`  Subcommand: ${P.subcommand}`),{lines:j,incrementStep:!0};case"transparent-wrapper":return j.push(""),j.push(`STEP ${O} ${D.h} Transparent wrapper`),j.push(`  Wrapper: ${P.wrapper}`),j.push(`  Tokens:  ${ji(P.output)}`),{lines:j,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(j.push(""),j.push(`STEP ${O} ${D.h} Match rules`),j.push(`  Rule:   ${P.rule}()`),P.matched)j.push("  Result: MATCHED");else j.push("  Result: No match");return{lines:j,incrementStep:!0}}case"worktree-relaxation":return j.push(""),j.push(`STEP ${O} ${D.h} Worktree relaxation`),j.push(`  Mode:   ${n.worktree.name}`),j.push(`  Git cwd: ${P.gitCwd}`),j.push("  Result: Allowed local discard in linked worktree"),{lines:j,incrementStep:!0};case"temp-root-relaxation":return j.push(""),j.push(`STEP ${O} ${D.h} Temp-root relaxation`),j.push(`  Git cwd: ${P.gitCwd}`),j.push("  Result: Allowed git discard in a temp-root repository"),{lines:j,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(P.embeddedCommandFound)return j.push(""),j.push(`STEP ${O} ${D.h} Fallback scan`),j.push(`  Found: ${P.embeddedCommandFound}`),{lines:j,incrementStep:!0};return null}case"custom-rules-check":{if(P.rulesChecked){if(j.push(""),j.push(`STEP ${O} ${D.h} Custom rules`),P.matched)j.push("  Result: MATCHED");else j.push("  Result: No match");return{lines:j,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(P.matched)return j.push(""),j.push(`STEP ${O} ${D.h} Dangerous text check`),j.push(`  Token:  ${P.token}`),j.push("  Result: MATCHED"),{lines:j,incrementStep:!0};return null}case"strict-unparseable":return j.push(""),j.push(`STEP ${O} ${D.h} Strict mode check`),j.push(`  Command: ${P.rawCommand}`),j.push("  Result:  ✗ UNPARSEABLE"),{lines:j,incrementStep:!0};case"segment-skipped":return null;case"error":return j.push(""),j.push(`ERROR: ${P.message}`),{lines:j,incrementStep:!1};default:return P}}function Fi(P,O){let D=kc(O?.asciiOnly??!1),j=58,J=[],Y=1;J.push(...xc(D,58)),J.push("");let re=P.trace.steps.find((Ee)=>Ee.type==="error");if(re&&re.type==="error"){J.push("ERROR"),J.push(`  ${re.message}`),J.push(""),J.push("RESULT"),J.push(`  Status: ${P.result==="blocked"?nn.red("BLOCKED"):nn.green("ALLOWED")}`),J.push(""),J.push("CONFIG");let Ee=P.configSource??"none";return J.push(`  Path: ${Ee}`),J.join(`
 `)}let ie=P.trace.steps.find((Ee)=>Ee.type==="parse");if(ie&&ie.type==="parse"){J.push("INPUT"),J.push(`  ${ie.input}`),J.push(""),J.push(`STEP ${Y} ${D.h} Split shell commands`),Y++;for(let Ee=0;Ee<ie.segments.length;Ee++){let qe=ie.segments[Ee];if(qe){let Me=Math.random();J.push(`  Segment ${Ee+1}: ${Cc(qe,Me)}`)}}}let de=P.trace.segments,fe=de.length>1;for(let Ee of de){if(fe){J.push("");let on="";if(ie&&ie.type==="parse"){let Po=ie.segments[Ee.index];if(Po)on=Po.join(" ")}let sn=54,an=on,rn=` Segment ${Ee.index+1}: `,fn=" ";if(on){if(rn.length+on.length+fn.length>sn){let lp=sn-rn.length-fn.length;an=`${on.substring(0,lp-1)}…`}}let On=on?`${rn}${an}${fn}`:` Segment ${Ee.index+1} `,sp=on?`${rn}${nn.cyan(an)}${fn}`:On,ws=58-On.length,ks=Math.floor(ws/2),ap=ws-ks;J.push(`${D.sh.repeat(ks)}${sp}${D.sh.repeat(ap)}`)}if(Ee.steps.find((on)=>on.type==="segment-skipped")){J.push(""),J.push("  (skipped — prior segment blocked)");continue}let Me=!1,en=!1;for(let on of Ee.steps){let sn=Sc(on,Y,D);if(sn){if(en=!0,on.type==="recurse"){J.push("");let an=" RECURSING ",rn=58-an.length-4;J.push(`  ${D.tl}${D.h}${an}${D.h.repeat(rn)}`),J.push(`  ${D.v}`),Me=!0;continue}for(let an of sn.lines)if(Me)J.push(`  ${D.v} ${an}`);else J.push(an);if(sn.incrementStep)Y++}}if(Me)J.push(`  ${D.v}`),J.push(`  ${D.bl}${D.h.repeat(56)}`);if(!en)J.push(""),J.push(`  ${nn.green("✓")} Allowed (no matching rules)`)}if(J.push(""),J.push("RESULT"),P.result==="blocked"){if(J.push(`  Status: ${nn.red("BLOCKED")}`),P.customRule){if(J.push(`  Rule: ${P.customRule.id}`),P.customRule.rulebook)J.push(`  Rulebook: ${P.customRule.rulebook.name} ${P.customRule.rulebook.version}`);if(P.customRule.source)J.push(`  Source: ${P.customRule.source}`);if(P.customRule.override)J.push(`  Override: reason ${P.customRule.override.reason}`)}if(P.reason){let Ee=er(P.reason,"          ");J.push(`  Reason: ${Ee[0]}`);for(let qe=1;qe<Ee.length;qe++)J.push(Ee[qe]??"")}}else J.push(`  Status: ${nn.green("ALLOWED")}`);J.push(""),J.push("CONFIG");let we=P.configSource??"none",Ce=P.configValid?"":" (invalid)";J.push(`  Path: ${we}${Ce}`);let Se=P.safetyPresetScope;J.push(`  Safety preset: ${P.selectedPreset??"standard"}${Se?` (${kr(Se)})`:""}`),J.push(`  Effective capabilities: ${P.effectiveLevel}`);let Ie=Object.entries(P.destructiveCommandRuleOverrides??{});if(J.push(`  Rule customizations: ${Ie.length}`),P.ruleActivation)J.push(`  Rule activation: ${P.ruleActivation.id} — ${P.ruleActivation.enabled?"on":"off"} via ${P.ruleActivation.source}`);return J.join(`
 `)}function Hi(P){return JSON.stringify(P,null,2)}import{resolve as Iy}from"node:path";var Ey=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function Pc(P){let O=0,D={allocateSegment(){return O++},getNextSegmentIndex(){return O},recordGlobal(j){P.record({kind:"step",scope:"global",step:j})},recordSegment(j,J=D.currentSegmentIndex){if(J===void 0)return;P.record({kind:"step",scope:"segment",segmentIndex:J,step:j})}};return D}function Rc(P={}){let O=[],D=P.maxEvents??512,j={maxTextLength:P.maxTextLength??2048,maxListLength:P.maxListLength??128,maxObjectProperties:P.maxObjectProperties??P.maxListLength??128,maxDepth:P.maxDepth??16},J,Y=new Set;return{record(re){if(J)return;if(!re||O.length>=D)return;try{O.push(Gi(_y(re,j,Y)))}catch{}},finish(){if(J)return J;return J=Gi({events:Object.freeze(O)}),J}}}function _y(P,O,D){if(P.kind!=="step")throw TypeError("invalid trace event");let{scope:j,step:J}=P;no(J,D,O);let Y=Mi(J,O,D);if(j==="global")return{kind:"step",scope:"global",step:Y};if(j!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:P.segmentIndex,step:Y}}function no(P,O,D,j=0,J=new WeakSet){if(typeof P==="string"){let ie=P.slice(0,D.maxTextLength);if(!ze(ie))return;for(let de of nt(ie))for(let fe of de.match(/[^\s"'()$]+/g)??[])O.add(Ec(fe));return}if(!P||typeof P!=="object"||j>=D.maxDepth||J.has(P))return;if(J.add(P),Array.isArray(P)){let ie=Math.min(P.length,D.maxListLength);for(let de=0;de<ie;de++)no(P[de],O,D,j+1,J);return}let Y=0,re=new Set;for(let ie in P){if(!Object.hasOwn(P,ie))continue;if(Y>=D.maxObjectProperties)break;Y++,no(ie,O,D);let de=Ui(ie,D,O);if(re.has(de))continue;re.add(de),no(P[ie],O,D,j+1,J)}}function Mi(P,O,D,j=0,J=new WeakSet){if(typeof P==="string")return Ui(P,O,D);if(!P||typeof P!=="object")return P;if(j>=O.maxDepth)return;if(J.has(P))return;if(J.add(P),Array.isArray(P)){let ie=[],de=Math.min(P.length,O.maxListLength);for(let fe=0;fe<de;fe++)ie.push(Mi(P[fe],O,D,j+1,J));return ie}let Y={},re=0;for(let ie in P){if(!Object.hasOwn(P,ie))continue;if(re>=O.maxObjectProperties)break;re++;let de=Ui(ie,O,D);if(Object.hasOwn(Y,de))continue;Object.defineProperty(Y,de,{value:Mi(P[ie],O,D,j+1,J),enumerable:!0,configurable:!0,writable:!0})}return Y}function Ui(P,O,D){let j=P.slice(0,O.maxTextLength),J=ze(j)?Be(j):j,Y=D.size>0?Ty(J,D):J;return(Ay(Y)?Pe(Y):Y).slice(0,O.maxTextLength)}function Ay(P){return P.includes("PRIVATE KEY")||P.includes("://")||P.includes("eyJ")||P.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(P)||P.length>=14&&Ey.some((O)=>P.includes(O))||P.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(P)}function Ty(P,O){return P.replace(/[^\s"'()$]+/g,(D)=>O.has(Ec(D))?"<redacted>":D)}function Ec(P){let O=2166136261,D=2166136261;for(let j=0;j<P.length;j++)O=Math.imul(O^P.charCodeAt(j),16777619),D=Math.imul(D^P.charCodeAt(P.length-j-1),16777619);return`${O>>>0}:${D>>>0}:${P.length}`}function Gi(P){if(P&&typeof P==="object"&&!Object.isFrozen(P)){for(let O of Object.values(P))Gi(O);Object.freeze(P)}return P}function nr(P,O={},D){let j=Iy(O.cwd??process.cwd()),J=O.policySnapshot??k(D,{cwd:j,userConfigDir:O.userConfigDir}),Y=T(J.policy,D.env),re=Ue({policySnapshot:J,effectiveCapabilities:Y.capabilities,strict:Y.strict,paranoidRm:Y.paranoidRm,paranoidInterpreters:Y.paranoidInterpreters,worktreeMode:Y.worktreeMode}),ie={effectiveLevel:re.effectiveLevel,selectedPreset:J.policy.safety.level??"standard",...J.policyScopes?{safetyPresetScope:J.policyScopes.levelScope}:{},effectiveCapabilities:re.effectiveCapabilities,destructiveCommandRuleOverrides:J.policy.destructiveCommandRuleOverrides},{configSource:de,configValid:fe}=Oy(D,{cwd:j,userConfigDir:O.userConfigDir});if(!P||!P.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:de,configValid:fe,...ie};let we=y(P,"auto");if(we.status==="limited")throw new b;let Ce=we.dialect==="powershell"?y(P,"posix"):we,Se=dt(Ce),Ie=Rc(),Ee=Pc(Ie);Ee.recordGlobal({type:"parse",input:P,segments:Se.map((On)=>[...On])});let qe=u("Bash",{command:P},{kind:"command",shell:"auto"},{configCwd:j,executionCwd:j},P),Me=q(qe,{environment:D,trace:Ee,dependencies:{loadPolicySnapshot:()=>J}}),en=Me.decision.kind==="deny"?Me.decision:null;if(en&&(Me.stage==="policy-protection"||Me.stage==="secret-protection"))return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:$y(en),matched:!0,reason:en.reason}]}]},result:"blocked",reason:R(en.reason),segment:R(_c(en,P)),ruleId:R(en.ruleId),configSource:de,configValid:fe,...ie};let on=Ee.getNextSegmentIndex();if(en&&on>0&&on<Se.length)Ee.recordSegment({type:"segment-skipped",index:on,reason:"prior-segment-blocked"},on);let sn=Ie.finish(),an=en?.ruleId??Dy(qe,J,Y,D),rn=z.find((On)=>On.id===an&&On.activationCapability),fn=rn?re.policy.effectiveDestructiveCommandRules[rn.id]:void 0;return{trace:Ny(sn),result:en?"blocked":"allowed",reason:en?R(en.reason):void 0,segment:en?R(_c(en,P)):void 0,ruleId:en?R(en.ruleId):void 0,customRule:Ly(jy(en?.ruleId,J)),configSource:de,configValid:fe,...ie,...rn&&fn?{ruleActivation:{id:rn.id,...fn}}:{}}}function _c(P,O){return P.evidence?.segment??O}function $y(P){if(P.reason===He)return"policy-protection:findPolicyConfigMutationTargetInSemanticFacts";if(P.reason===Ge)return"policy-apply-protection:findPolicyApplyInvocationInSemanticFacts";if(P.reason===x)return"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts";return"secret-protection:findSensitiveTargetInSemanticFacts"}function Oy(P,O){let D=_(O.cwd),j=W(P,O),J=X(P,{cwd:O.cwd,userConfigDir:O.userConfigDir});try{if(r(J.projectConfigTarget)!==null){if(Un(J.projectConfigTarget).errors.length===0)return{configSource:D,configValid:!0};return{configSource:D,configValid:!1}}}catch(Y){if(Y instanceof o)return{configSource:D,configValid:!1};throw Y}try{if(r(J.userConfigTarget)!==null){let Y=Un(J.userConfigTarget);return{configSource:j,configValid:Y.errors.length===0}}return{configSource:null,configValid:!0}}catch(Y){if(Y instanceof o)return{configSource:j,configValid:!1};throw Y}}function Dy(P,O,D,j){let J=O.policy,Y=_e({...J,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...J.destructiveCommandRuleOverrides,...Object.fromEntries(z.flatMap((ie)=>ie.activationCapability?[[ie.id,"on"]]:[]))}},O.state==="degraded"?{diagnostics:O.diagnostics,reason:O.reason}:void 0),re=q(P,{environment:j,dependencies:{loadPolicySnapshot:()=>Y,getModes:()=>({...D,strict:!0,paranoidRm:!0,paranoidInterpreters:!0}),findSensitiveTarget:()=>null}});return re.decision.kind==="deny"?re.decision.ruleId:void 0}function Ly(P){if(!P)return;return{id:R(P.id),...P.rulebook?{rulebook:{name:R(P.rulebook.name),version:R(P.rulebook.version)}}:{},...P.source?{source:R(P.source)}:{},...P.override?{override:{type:"reason",reason:R(P.override.reason)}}:{}}}function Ny(P){let O=P.events.flatMap((j)=>j.kind==="step"&&j.scope==="global"?[j.step]:[]),D=new Map;for(let j of P.events){if(j.kind!=="step"||j.scope!=="segment")continue;let J=D.get(j.segmentIndex)??{index:j.segmentIndex,steps:[]};J.steps.push(j.step),D.set(j.segmentIndex,J)}return{steps:O,segments:[...D.values()]}}function jy(P,O){let D=P?.replace(/^custom\./,"");if(!D||!O.policy.rules.some((j)=>j.name===D))return;return O.ruleMetadata[D]??Object.freeze({id:D})}function Ac(P){return new Promise((O)=>{process.stdout.write(`${P}
-`,()=>O())})}async function Tc(P,O){let D=Ni(O);if(!D)return 1;try{let j=nr(D.command,{cwd:D.cwd},P),J=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Ac(D.json?Hi(j):Fi(j,{asciiOnly:J})),0}catch(j){let J=Fy(j instanceof p?j.cause:j);if(J===void 0)throw j;if(D.json)return await Ac(JSON.stringify({error:J})),1;return console.error(J),1}}function Fy(P){if(P instanceof b)return P.message;if(P instanceof f)return P.message;if(P instanceof s&&a[P.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var Ic="2.6.5",_n="  ",ft="cc-safety-net";function $c(P){return P.argument?`${P.flags} ${P.argument}`:P.flags}function Hy(P){return Math.max(...P.map((O)=>$c(O).length))}function My(P){return Math.max(...P.map((O)=>O.usage.length))}function Uy(P){return Math.max(...P.map((O)=>`${ft} ${O.usage}`.length))}function Gy(P,O){let D=`${ft} ${P.usage}`;return`${_n}${D.padEnd(O+2)}${P.description}`}function In(P,O){return`${_n}${P.padEnd(Math.max(40,P.length+2))}${O}`}function Lt(P,O=console.log){let D=[];if(D.push(`${ft} ${P.name}`),D.push(""),D.push(`${_n}${P.description}`),D.push(""),D.push("USAGE:"),D.push(`${_n}${ft} ${P.usage}`),D.push(""),P.subcommands&&P.subcommands.length>0){D.push("SUBCOMMANDS:");let j=My(P.subcommands);for(let J of P.subcommands)D.push(`${_n}${J.usage.padEnd(j+2)}${J.description}`);D.push("")}if(P.options.length>0){D.push("OPTIONS:");let j=Hy(P.options);for(let J of P.options){let Y=$c(J),re=J.default?`${J.description} (default: ${J.default})`:J.description;D.push(`${_n}${Y.padEnd(j+2)}${re}`)}D.push("")}if(P.examples&&P.examples.length>0){D.push("EXAMPLES:");for(let j of P.examples)D.push(`${_n}${j}`)}O(D.join(`
+`,()=>O())})}async function Tc(P,O){let D=Ni(O);if(!D)return 1;try{let j=nr(D.command,{cwd:D.cwd},P),J=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Ac(D.json?Hi(j):Fi(j,{asciiOnly:J})),0}catch(j){let J=Fy(j instanceof p?j.cause:j);if(J===void 0)throw j;if(D.json)return await Ac(JSON.stringify({error:J})),1;return console.error(J),1}}function Fy(P){if(P instanceof b)return P.message;if(P instanceof f)return P.message;if(P instanceof s&&a[P.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var Ic="2.6.6",_n="  ",ft="cc-safety-net";function $c(P){return P.argument?`${P.flags} ${P.argument}`:P.flags}function Hy(P){return Math.max(...P.map((O)=>$c(O).length))}function My(P){return Math.max(...P.map((O)=>O.usage.length))}function Uy(P){return Math.max(...P.map((O)=>`${ft} ${O.usage}`.length))}function Gy(P,O){let D=`${ft} ${P.usage}`;return`${_n}${D.padEnd(O+2)}${P.description}`}function In(P,O){return`${_n}${P.padEnd(Math.max(40,P.length+2))}${O}`}function Lt(P,O=console.log){let D=[];if(D.push(`${ft} ${P.name}`),D.push(""),D.push(`${_n}${P.description}`),D.push(""),D.push("USAGE:"),D.push(`${_n}${ft} ${P.usage}`),D.push(""),P.subcommands&&P.subcommands.length>0){D.push("SUBCOMMANDS:");let j=My(P.subcommands);for(let J of P.subcommands)D.push(`${_n}${J.usage.padEnd(j+2)}${J.description}`);D.push("")}if(P.options.length>0){D.push("OPTIONS:");let j=Hy(P.options);for(let J of P.options){let Y=$c(J),re=J.default?`${J.description} (default: ${J.default})`:J.description;D.push(`${_n}${Y.padEnd(j+2)}${re}`)}D.push("")}if(P.examples&&P.examples.length>0){D.push("EXAMPLES:");for(let j of P.examples)D.push(`${_n}${j}`)}O(D.join(`
 `))}function qi(){let P=Uy(hr),O=[];O.push(`${ft} v${Ic}`),O.push(""),O.push("Blocks destructive commands and secret access."),O.push(""),O.push("COMMANDS:");for(let D of hr)O.push(Gy(D,P));O.push(""),O.push("GLOBAL OPTIONS:"),O.push(`${_n}-h, --help       Show help (use with command for command-specific help)`),O.push(`${_n}-V, --version    Show version`),O.push(""),O.push("HELP:"),O.push(`${_n}${ft} help <command>     Show help for a specific command`),O.push(`${_n}${ft} <command> --help   Show help for a specific command`),O.push(""),O.push("ENVIRONMENT VARIABLES:"),O.push(In(`${n.level.name}=standard|strict|paranoid`,"Set session safety level")),O.push(In(`${n.worktree.name}=1`,"Allow local git discards in linked worktrees")),O.push(In(`${n.debug.name}=1`,"Print diagnostic messages to stderr")),O.push(In(`${n.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),O.push(In(`${n.projectTightenOnly.name}=1`,"Ignore project policy settings that weaken the user policy")),O.push(In("CC_SAFETY_NET_HOME","Override rule config home directory")),O.push(""),O.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),O.push(In(`${n.strict.name}=1`,"Force safety.overrides.fail_closed on")),O.push(In(`${n.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),O.push(In(`${n.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),O.push(In(`${n.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),O.push(""),O.push("Documentation:        https://ccsafetynet.com/docs"),console.log(O.join(`
 `))}function Oc(){console.log(Ic)}function tr(P,O=console.log){let D=vr(P);if(!D)return!1;if(D.name.toLowerCase()!==P.toLowerCase())return!1;return Lt(D,O),!0}import{existsSync as co,readFileSync as Hd}from"node:fs";import{join as lo}from"node:path";import*as Bn from"node:readline";function qy(P){return P==="install"?"Install":"Uninstall"}function By(P){return P==="install"?"Installing":"Uninstalling"}function Vy(P){return P==="install"?"into":"from"}function Nc(P){return P?.available===!0}function Jy(P,O){let D=new Set(O);return P.filter((j)=>D.has(j.target)).map((j)=>j.target)}function Dc(P,O,D){if(P.every((j)=>!j.available))return O;return Array.from({length:P.length},(j,J)=>J+1).map((j)=>(O+j*D+P.length)%P.length).find((j)=>Nc(P[j]))}function Ky(P,O,D){if(D.ctrl&&D.name==="c")return"interrupt";if(D.name==="escape"||O==="q")return"abort";if(P==="install"&&(O==="u"||O==="U"))return"update";if(D.name==="up"||O==="k")return"up";if(D.name==="down"||O==="j")return"down";if(D.name==="space"||O===" ")return"toggle";if(D.name==="return"||D.name==="enter")return"confirm";return null}function Wy(P){return{cursor:P.findIndex((O)=>O.available),selected:[]}}function zy(P,O,D){if(D==="confirm"||D==="update"||D==="abort"||D==="interrupt")return{state:P,done:D};if(D==="up")return{state:{...P,cursor:Dc(O,P.cursor,-1)}};if(D==="down")return{state:{...P,cursor:Dc(O,P.cursor,1)}};let j=O[P.cursor];if(!Nc(j))return{state:P};let J=P.selected.includes(j.target)?P.selected.filter((Y)=>Y!==j.target):Jy(O,[...P.selected,j.target]);return{state:{...P,selected:J}}}var jc="◉",Fc="◯",Hc=">",Mc=" ";function Yy(P,O,D){return["",`${qy(P)} CC Safety Net ${Vy(P)}:`,"",...O.map((j,J)=>{let Y=D.selected.includes(j.target),re=J===D.cursor,ie=Y?jc:Fc,de=re?Hc:Mc,fe=j.available?"":` (${j.unavailableReason??"not installed"})`,we=`${ie} ${j.label}${fe}`,Ce=!j.available?nn.dim(we):Y?nn.green(we):re?nn.bold(we):we;return`${de} ${Ce}`}),"",P==="install"?"Space: select  Enter: confirm  u: update installed  Up/Down: move  q/Esc: cancel":O.some((j)=>j.available)?"Space: select  Enter: confirm  Up/Down: move  q/Esc: cancel":`No selectable integrations found for ${P}. q/Esc: close`].join(`
 `)}var Lc=["global-hook","plugin"];function Zy(P,O,D={}){let j=D.color!==!1?nn.bold:(Y)=>Y;return["","Install the Kimi Code integration as:","",...[`Global hook — ${O?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((Y,re)=>{let ie=re===P,de=`${ie?jc:Fc} ${Y}`;return`${ie?Hc:Mc} ${ie?j(de):de}`}),"","Enter: confirm  Up/Down: move  q/Esc: cancel"].join(`

package/dist/deepseek-harness/index.js

@@ -1 +1 @@
-import{Y,P,qe,u}from"../chunks/index-t1vhmn90.js";import{j,de,Se}from"../chunks/index-6awd86n5.js";import"../chunks/index-x6wv93z4.js";import{resolve as g}from"node:path";var k=new Map([["bash","posix"],["pwsh","powershell"]]),w={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,i,r)=>T(e,i,r),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>Y(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function f(e){let i=C();e.tools.guard((r)=>i(r,process.cwd()))}function C(e={}){return Se(w,e)}function T(e,i,r){if(!e||typeof e!=="object")return j(null);let l=e,n=l.name;if(typeof n!=="string"||n.trim()==="")return j(null);let d=l.agent?.session.header.cwd??i,o=qe([d],r);if(!o)return de({directory:"session",problem:"unusable",cwd:d},{toolName:n});let t=l.arguments,c=k.get(n);if(!c)return u(n,t,{kind:P(n)},{configCwd:o,executionCwd:o},null);if(!t||typeof t!=="object"||Array.isArray(t))return j(o,{toolName:n});let p=t,a=p.command;if(typeof a!=="string"||a.trim()==="")return j(o,{toolName:n});let s=p.workdir;if(s!==void 0&&(typeof s!=="string"||s.trim()===""))return j(o,{command:a,toolName:n});let m=s===void 0?o:qe([g(o,s)],r);if(!m)return de({directory:"requested",problem:"unusable",cwd:s},{command:a,toolName:n});return u(n,t,{kind:"command",shell:c},{configCwd:o,executionCwd:m},a)}var v={name:"cc-safety-net",inject:["tools"],apply:f};export{v as default};
+import{Y,P,qe,u}from"../chunks/index-t1vhmn90.js";import{j,de,Se}from"../chunks/index-e1j1weef.js";import"../chunks/index-21maj91f.js";import{resolve as g}from"node:path";var k=new Map([["bash","posix"],["pwsh","powershell"]]),w={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,i,r)=>T(e,i,r),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>Y(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function f(e){let i=C();e.tools.guard((r)=>i(r,process.cwd()))}function C(e={}){return Se(w,e)}function T(e,i,r){if(!e||typeof e!=="object")return j(null);let l=e,n=l.name;if(typeof n!=="string"||n.trim()==="")return j(null);let d=l.agent?.session.header.cwd??i,o=qe([d],r);if(!o)return de({directory:"session",problem:"unusable",cwd:d},{toolName:n});let t=l.arguments,c=k.get(n);if(!c)return u(n,t,{kind:P(n)},{configCwd:o,executionCwd:o},null);if(!t||typeof t!=="object"||Array.isArray(t))return j(o,{toolName:n});let p=t,a=p.command;if(typeof a!=="string"||a.trim()==="")return j(o,{toolName:n});let s=p.workdir;if(s!==void 0&&(typeof s!=="string"||s.trim()===""))return j(o,{command:a,toolName:n});let m=s===void 0?o:qe([g(o,s)],r);if(!m)return de({directory:"requested",problem:"unusable",cwd:s},{command:a,toolName:n});return u(n,t,{kind:"command",shell:c},{configCwd:o,executionCwd:m},a)}var v={name:"cc-safety-net",inject:["tools"],apply:f};export{v as default};

package/dist/index.js

@@ -1,4 +1,4 @@
-import{Ce,O,D,Y,c,Ee,f,P,ie,fe,u,p}from"./chunks/index-t1vhmn90.js";import{re}from"./chunks/index-5ht7pdm3.js";import{we,G}from"./chunks/index-x6wv93z4.js";import{join as qc,resolve as _s}from"node:path";function vr(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:re.slice(re.indexOf("# CC Safety Net"))}}}var Jc=new Set(["powershell","pwsh"]);function As(e={}){return async({directory:t,homeDir:r})=>{let n=_s(t),o;return{config:async(s)=>{o=s;let a=vr(),l=s.command??{};s.command={...a,...l}},"tool.execute.before":async(s,a)=>{_n({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:Gc(s.tool,An(o?.shell)),guardDependencies:e})}}}}function _n({configCwd:e,homeDir:t,expandHomeWorkdir:r=!1,tool:n,sessionID:o,toolInput:s,route:a,guardDependencies:l={}}){let m=t===void 0?c():{...c(),home:t},i=(h,I,d=e)=>{we(m,h,()=>o,{agent:"opencode",toolName:I,cwd:d}),Fs(h)};if(typeof n!=="string"||n.trim()==="")i(O());let x;try{x=ie(s)}catch(h){if(!(h instanceof f))throw h;i(O({toolName:n}),n)}if(!fe(e)){i(D({directory:"session",problem:"unusable",cwd:e},{command:x,toolName:n}),n);return}let S=Kc(e,s,r?m.home:void 0);if(S===null){i(O({command:x,toolName:n}),n);return}if(typeof S!=="string"){i(D(S,{command:x,toolName:n}),n,S.cwd);return}let g=u(n,s,a,{configCwd:e,executionCwd:S},x??null);try{let h=G(m,g,{guard:{auditAllowed:Ee(m.env),dependencies:l},audit:{agent:"opencode",getSessionId:()=>o}});Rs(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Rs(h.evaluation);return}}function An(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(Jc.has(o))return"powershell";return o==="cmd"?"auto":"posix"}function Gc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:P(e)}}function Kc(e,t,r){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let n=t.workdir;if(typeof n!=="string"||n.trim()==="")return null;let o=process.platform==="win32"?zc(n):n,s=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),a=r===void 0?o:o==="~"?r:s?qc(r,o.slice(2)):o,l=_s(e,a);return fe(l)?l:{directory:"requested",problem:"unusable",cwd:n}}function zc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Rs(e){let t=Ce(e,{includeEvidence:!0});if(t)Fs(t)}function Fs(e){throw Error(Y(e))}import{execFile as Yf}from"node:child_process";var me=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Hc={pipe(){return me(this,arguments)}},qt=function(){function e(){}return e.prototype=Hc,e}();var C=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ue=(e)=>e;var Ps=(e)=>()=>e;var yt=Ps(void 0),Ds=yt;function nt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Tt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var Jt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Gt=new WeakSet;function Kt(e){return typeof e==="string"}function Fn(e){return typeof e==="number"}function Us(e){return typeof e==="symbol"}function Or(e){return Kt(e)||Fn(e)||Us(e)}function Et(e){return typeof e==="function"}function Pn(e){return e!==void 0}function Dn(e){return e!=null}function Ns(e){return!0}function Un(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function kr(e){return typeof e==="object"&&e!==null||Et(e)}var A=C(2,(e,t)=>kr(e)&&(t in e));function Ms(e){return e instanceof Error}var Q="~effect/interfaces/Hash",U=(e)=>{switch(typeof e){case"number":return Fr(e);case"bigint":return z(e.toString(10));case"boolean":return z(String(e));case"symbol":return z(String(e));case"string":return z(e);case"undefined":return z("undefined");case"function":case"object":if(e===null)return z("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return z("Invalid Date");return z(e.toISOString())}else if(e instanceof RegExp)return z(e.toString());else{if(Gt.has(e))return Rr(e);if(Mn.has(e))return Mn.get(e);let t=Xc(e,()=>{if(Wc(e))return e[Q]();else if(typeof e==="function")return Rr(e);else if(e instanceof DataView)return _r(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return _r(e);else if(e instanceof Map)return Zc(e);else if(e instanceof Set)return Yc(e);return Vc(e)});return Mn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Rr=(e)=>{if(!Nn.has(e))Nn.set(e,Fr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Nn.get(e)},le=C(2,(e,t)=>e*53^t),Ar=(e)=>e&3221225471|e>>>1&1073741824,Wc=(e)=>A(e,Q),Fr=(e)=>{if(e!==e)return z("NaN");if(e===1/0)return z("Infinity");if(e===-1/0)return z("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return Ar(t)},z=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return Ar(t)},$n=(e,t)=>{let r=12289;for(let n of t)r^=le(U(n),U(e[n]));return Ar(r)},Vc=(e)=>$n(e,Jt(e)),Bn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return Ar(n)},_r=Bn(6151,U),Zc=Bn(z("Map"),([e,t])=>le(U(e),U(t))),Yc=Bn(z("Set"),U),Nn=new WeakMap,Mn=new WeakMap,Ln=new WeakSet;function Xc(e,t){if(Ln.has(e))return z("[Circular]");Ln.add(e);let r=t();return Ln.delete(e),r}var ee="~effect/interfaces/Equal";function V(){if(arguments.length===1)return(e)=>st(e,arguments[0]);return st(arguments[0],arguments[1])}function st(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Gt.has(e)||Gt.has(t))return!1;return tu(e,t,eu)}function Qc(e,t,r){let n=jn.has(e),o=qn.has(t);if(n&&o)return!0;if(n||o)return!1;jn.add(e),qn.add(t);let s=r();return jn.delete(e),qn.delete(t),s}var jn=new WeakSet,qn=new WeakSet;function eu(e,t){if(U(e)!==U(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=$s(e),n=$s(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Qc(e,t,()=>{if(o)return e[ee](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return ru(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Ls(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Ls(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return su(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return iu(e,t)}return nu(e,t)})}function tu(e,t,r){let n=Pr.get(e);if(!n)n=new WeakMap,Pr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Pr.get(t);if(!s)s=new WeakMap,Pr.set(t,s);return s.set(e,o),o}var Pr=new WeakMap;function ru(e,t){for(let r=0;r<e.length;r++)if(!st(e[r],t[r]))return!1;return!0}function Ls(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function nu(e,t){let r=Jt(e),n=Jt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!st(e[o],t[o]))return!1;return!0}function ou(e,t){return function(n,o){let s=Array.from(o);for(let[a,l]of n){let m=!1;for(let i=0;i<s.length;i++){let[x,S]=s[i];if(e(a,x)&&t(l,S)){s[i]=s[s.length-1],s.pop(),m=!0;break}}if(!m)return!1}return!0}}var su=ou(st,st);function au(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let l=0;l<o.length;l++){let m=o[l];if(e(s,m)){o[l]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var iu=au(st),$s=(e)=>A(e,ee);var zt=Symbol.for("~effect/Redactable"),cu=(e)=>A(e,zt);function It(e){if(cu(e))return Jn(e);return e}function Jn(e){return e[zt](globalThis[vt]?.context??uu)}var vt="~effect/Fiber/currentFiber",Bs=new Map,uu={"~effect/Context":{},base:Bs,depth:0,mapUnsafe:Bs,pipe(){return me(this,arguments)}};function M(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let S=i?.constructor;return S&&S!==Object.prototype.constructor&&S.name?`${S.name}(${x})`:x},l=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function m(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return lu;n.add(i);let S;if(zt in i)S=m(Jn(i),x);else if(Array.isArray(i))S=!o||i.length<=1?`[${i.map((y)=>m(y,x)).join(",")}]`:`[
+import{Ce,O,D,Y,c,Ee,f,P,ie,fe,u,p}from"./chunks/index-t1vhmn90.js";import{re}from"./chunks/index-5ht7pdm3.js";import{we,G}from"./chunks/index-21maj91f.js";import{join as qc,resolve as _s}from"node:path";function vr(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:re.slice(re.indexOf("# CC Safety Net"))}}}var Jc=new Set(["powershell","pwsh"]);function As(e={}){return async({directory:t,homeDir:r})=>{let n=_s(t),o;return{config:async(s)=>{o=s;let a=vr(),l=s.command??{};s.command={...a,...l}},"tool.execute.before":async(s,a)=>{_n({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:Gc(s.tool,An(o?.shell)),guardDependencies:e})}}}}function _n({configCwd:e,homeDir:t,expandHomeWorkdir:r=!1,tool:n,sessionID:o,toolInput:s,route:a,guardDependencies:l={}}){let m=t===void 0?c():{...c(),home:t},i=(h,I,d=e)=>{we(m,h,()=>o,{agent:"opencode",toolName:I,cwd:d}),Fs(h)};if(typeof n!=="string"||n.trim()==="")i(O());let x;try{x=ie(s)}catch(h){if(!(h instanceof f))throw h;i(O({toolName:n}),n)}if(!fe(e)){i(D({directory:"session",problem:"unusable",cwd:e},{command:x,toolName:n}),n);return}let S=Kc(e,s,r?m.home:void 0);if(S===null){i(O({command:x,toolName:n}),n);return}if(typeof S!=="string"){i(D(S,{command:x,toolName:n}),n,S.cwd);return}let g=u(n,s,a,{configCwd:e,executionCwd:S},x??null);try{let h=G(m,g,{guard:{auditAllowed:Ee(m.env),dependencies:l},audit:{agent:"opencode",getSessionId:()=>o}});Rs(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Rs(h.evaluation);return}}function An(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(Jc.has(o))return"powershell";return o==="cmd"?"auto":"posix"}function Gc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:P(e)}}function Kc(e,t,r){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let n=t.workdir;if(typeof n!=="string"||n.trim()==="")return null;let o=process.platform==="win32"?zc(n):n,s=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),a=r===void 0?o:o==="~"?r:s?qc(r,o.slice(2)):o,l=_s(e,a);return fe(l)?l:{directory:"requested",problem:"unusable",cwd:n}}function zc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Rs(e){let t=Ce(e,{includeEvidence:!0});if(t)Fs(t)}function Fs(e){throw Error(Y(e))}import{execFile as Yf}from"node:child_process";var me=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Hc={pipe(){return me(this,arguments)}},qt=function(){function e(){}return e.prototype=Hc,e}();var C=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ue=(e)=>e;var Ps=(e)=>()=>e;var yt=Ps(void 0),Ds=yt;function nt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Tt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var Jt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Gt=new WeakSet;function Kt(e){return typeof e==="string"}function Fn(e){return typeof e==="number"}function Us(e){return typeof e==="symbol"}function Or(e){return Kt(e)||Fn(e)||Us(e)}function Et(e){return typeof e==="function"}function Pn(e){return e!==void 0}function Dn(e){return e!=null}function Ns(e){return!0}function Un(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function kr(e){return typeof e==="object"&&e!==null||Et(e)}var A=C(2,(e,t)=>kr(e)&&(t in e));function Ms(e){return e instanceof Error}var Q="~effect/interfaces/Hash",U=(e)=>{switch(typeof e){case"number":return Fr(e);case"bigint":return z(e.toString(10));case"boolean":return z(String(e));case"symbol":return z(String(e));case"string":return z(e);case"undefined":return z("undefined");case"function":case"object":if(e===null)return z("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return z("Invalid Date");return z(e.toISOString())}else if(e instanceof RegExp)return z(e.toString());else{if(Gt.has(e))return Rr(e);if(Mn.has(e))return Mn.get(e);let t=Xc(e,()=>{if(Wc(e))return e[Q]();else if(typeof e==="function")return Rr(e);else if(e instanceof DataView)return _r(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return _r(e);else if(e instanceof Map)return Zc(e);else if(e instanceof Set)return Yc(e);return Vc(e)});return Mn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Rr=(e)=>{if(!Nn.has(e))Nn.set(e,Fr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Nn.get(e)},le=C(2,(e,t)=>e*53^t),Ar=(e)=>e&3221225471|e>>>1&1073741824,Wc=(e)=>A(e,Q),Fr=(e)=>{if(e!==e)return z("NaN");if(e===1/0)return z("Infinity");if(e===-1/0)return z("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return Ar(t)},z=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return Ar(t)},$n=(e,t)=>{let r=12289;for(let n of t)r^=le(U(n),U(e[n]));return Ar(r)},Vc=(e)=>$n(e,Jt(e)),Bn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return Ar(n)},_r=Bn(6151,U),Zc=Bn(z("Map"),([e,t])=>le(U(e),U(t))),Yc=Bn(z("Set"),U),Nn=new WeakMap,Mn=new WeakMap,Ln=new WeakSet;function Xc(e,t){if(Ln.has(e))return z("[Circular]");Ln.add(e);let r=t();return Ln.delete(e),r}var ee="~effect/interfaces/Equal";function V(){if(arguments.length===1)return(e)=>st(e,arguments[0]);return st(arguments[0],arguments[1])}function st(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Gt.has(e)||Gt.has(t))return!1;return tu(e,t,eu)}function Qc(e,t,r){let n=jn.has(e),o=qn.has(t);if(n&&o)return!0;if(n||o)return!1;jn.add(e),qn.add(t);let s=r();return jn.delete(e),qn.delete(t),s}var jn=new WeakSet,qn=new WeakSet;function eu(e,t){if(U(e)!==U(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=$s(e),n=$s(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Qc(e,t,()=>{if(o)return e[ee](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return ru(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Ls(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Ls(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return su(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return iu(e,t)}return nu(e,t)})}function tu(e,t,r){let n=Pr.get(e);if(!n)n=new WeakMap,Pr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Pr.get(t);if(!s)s=new WeakMap,Pr.set(t,s);return s.set(e,o),o}var Pr=new WeakMap;function ru(e,t){for(let r=0;r<e.length;r++)if(!st(e[r],t[r]))return!1;return!0}function Ls(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function nu(e,t){let r=Jt(e),n=Jt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!st(e[o],t[o]))return!1;return!0}function ou(e,t){return function(n,o){let s=Array.from(o);for(let[a,l]of n){let m=!1;for(let i=0;i<s.length;i++){let[x,S]=s[i];if(e(a,x)&&t(l,S)){s[i]=s[s.length-1],s.pop(),m=!0;break}}if(!m)return!1}return!0}}var su=ou(st,st);function au(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let l=0;l<o.length;l++){let m=o[l];if(e(s,m)){o[l]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var iu=au(st),$s=(e)=>A(e,ee);var zt=Symbol.for("~effect/Redactable"),cu=(e)=>A(e,zt);function It(e){if(cu(e))return Jn(e);return e}function Jn(e){return e[zt](globalThis[vt]?.context??uu)}var vt="~effect/Fiber/currentFiber",Bs=new Map,uu={"~effect/Context":{},base:Bs,depth:0,mapUnsafe:Bs,pipe(){return me(this,arguments)}};function M(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let S=i?.constructor;return S&&S!==Object.prototype.constructor&&S.name?`${S.name}(${x})`:x},l=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function m(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return lu;n.add(i);let S;if(zt in i)S=m(Jn(i),x);else if(Array.isArray(i))S=!o||i.length<=1?`[${i.map((y)=>m(y,x)).join(",")}]`:`[
 ${s(x+1)}${i.map((y)=>m(y,x+1)).join(`,
 `+s(x+1))}
 ${s(x)}]`;else if(i instanceof Date)S=js(i);else if(!t?.ignoreToString&&A(i,"toString")&&typeof i.toString==="function"&&i.toString!==Object.prototype.toString&&i.toString!==Array.prototype.toString){let y=fu(i);S=i instanceof Error&&i.cause?`${y} (cause: ${m(i.cause,x)})`:y}else if(Symbol.iterator in i)S=`${i.constructor.name}(${m(Array.from(i),x)})`;else{let y=l(i);if(!o||y.length<=1){let g=`{${y.map((h)=>`${Ht(h)}:${m(i[h],x)}`).join(",")}}`;S=a(i,g)}else{let g=`{

package/dist/openclaw/cc-safety-net/index.js

@@ -1,5 +1,5 @@
 // cc-safety-net managed OpenClaw plugin. Do not edit. Reinstall with: npx -y cc-safety-net install --openclaw
-// version: 2.6.5
+// version: 2.6.6
 var Ll={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive commands and secret-file access before OpenClaw runs a tool."};var Oi="CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry.",Ke="Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry.",jn="CC Safety Net failed closed because command analysis failed unexpectedly. This is not caused by your command. Report it to the user.";var ki={errorCode:"path-canonicalization-limit",reason:"CC Safety Net could not analyze the command because it exceeds safe analysis limits. Simplify or split the command and retry."},Hn={errorCode:"structural-shell-syntax-limit",reason:"Command analysis exceeds CC Safety Net's derived-command work limit. Reduce nested or embedded command complexity and retry."},j=Object.freeze({realpathAttempts:{cap:16384,...ki},processedCandidateBytes:{cap:4194304,...ki},pathEnvironmentExpansion:{cap:64,...ki},recursionDepth:{cap:10,errorCode:"structural-shell-syntax-limit",reason:"Command exceeds maximum recursion depth and cannot be safely analyzed. Flatten the nesting and retry."},derivedTokens:{cap:16384,...Hn},trackedHeredocFiles:{cap:64,...Hn},controlFlowStates:{cap:64,...Hn},wrapperPeelIterations:{cap:20,...Hn},derivedCommandShape:Hn});class W extends Error{kind;name="AnalysisLimit";constructor(e){super(j[e].reason);this.kind=e}}function ke(){let e=new Map;return{counters:e,resolvedPaths:new Map,charge(t,n=1){let r=(e.get(t)??0)+n;if(e.set(t,r),r>j[t].cap)throw new W(t)}}}var Sg=[/\bgh[pousr]_[A-Za-z0-9]{20,}\b/g,/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g,/\bglpat-[A-Za-z0-9_-]{20,}\b/g,/\bxox[abeprs]-[A-Za-z0-9-]{20,}\b/g,/\bnpm_[A-Za-z0-9_]{20,}\b/g,/\bpypi-[A-Za-z0-9_-]{20,}\b/g,/\b[rs]k_(?:live|test)_[A-Za-z0-9_]{20,}\b/g,/\bsk-[A-Za-z0-9_-]{20,}\b/g,/\bsk_[A-Za-z0-9]{20,}\b/g,/\bgsk_[A-Za-z0-9]{52,}\b/g,/\bxai-[A-Za-z0-9_-]{80,}\b/g,/\bpplx-[A-Za-z0-9_-]{20,}\b/g,/\bbastn_[A-Za-z0-9]{16,}\b/g,/\btgp_v1_[A-Za-z0-9_-]{43,}\b/g,/\bflp_[A-Za-z0-9]{10,}\b/g,/\bwfr_[A-Za-z0-9]{20,}\b/g,/\bfwp?_[A-Za-z0-9_-]{20,}\b/g,/\btp-[A-Za-z0-9_-]{20,}\b/g,/\bpsk-[A-Za-z0-9_-]{8,}-[A-Za-z0-9_-]{8,}\b/g,/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/g];function pt(e){return vg(e.replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_DSN|CONNECTION_STRING)=("[^"]*"|'[^']*'|[^\s]+(?:\s+[A-Z_][A-Z0-9_]*=[^\s]+)*)/gi,"$1=<redacted>").replace(/\b((?:DATABASE|POSTGRES|POSTGRESQL|MYSQL|MARIADB|REDIS|MONGO(?:DB)?|DB)_(?:URL|URI|CONNECTION_STRING))=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>").replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASS|KEY|CREDENTIALS)[A-Z0-9_]*)=("[^"]*"|'[^']*'|[^\s]+)/gi,"$1=<redacted>"))}function vg(e){return Sg.reduce((t,n)=>t.replace(n,"<redacted>"),e.replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/gi,"<redacted>").replace(/((?:(['"])(?:authorization|cookie|x-api-key|api-key)\2|(?:authorization|cookie|x-api-key|api-key))\s*:\s*)(['"])(?:\\[^\r\n]|(?!\3)[^\\\r\n])*\3/gi,"$1$3<redacted>$3").replace(/(['"]?\s*(?:authorization|cookie|x-api-key|api-key)\s*:(?!\s*(?:"<redacted>"|'<redacted>'))\s*)([^'"\r\n]+)(['"]?)/gi,"$1<redacted>$3").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/:@]+):([^\s@/]+)@/gi,"$1<redacted>:<redacted>@").replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+)@/gi,"$1<redacted>@").replace(/(^|[\s?&;|])((?:x-amz-signature|x-goog-signature|sig|signature)=)(?:"[^"\r\n]*"|'[^'\r\n]*'|[^&#\s'"`;|<>()]*)/gi,"$1$2<redacted>").replace(/(^|\s)((?:-u|--user)(?:\s+|=))([^\s:]+):([^\s]+)/g,"$1$2<redacted>:<redacted>")).replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g,"<redacted>").replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,"<redacted>")}var Eg={hard_stop:"Do not retry this operation or attempt any workaround (other tools, flags, or paths). Report the block to the user and continue with the rest of the task.",use_alternative:"Do not retry the blocked form. Continue the task using the safer alternative described above.",scope_down:"Retry with a narrower, explicit target as described above. Escalate to the user if the broad operation is truly required.",manual_only:"If this operation is truly needed, ask the user for explicit permission and have them run the command manually.",stop_and_explain:"Do not brute-force variants. Simplify or restructure the command so it can be analyzed, or report the block to the user."};function Rg(e){let t=e.maxLen??200,n=e.redact??((o)=>o),r=(o)=>o.length>t?`${o.slice(0,t)}...`:o;return[e.askUser?"CC Safety Net could not verify this command":"BLOCKED by CC Safety Net",`Reason: ${n(e.reason)}`,e.ruleId?`Rule: ${e.ruleId}`:void 0,e.toolName?`Tool: ${e.toolName}`:void 0,e.command?`Command: ${r(n(e.command))}`:void 0,e.segment&&e.segment!==e.command?`Segment: ${r(n(e.segment))}`:void 0,e.cwd?`Working directory: ${r(n(e.cwd))}`:void 0,e.configWarning?`Config warning: ${n(e.configWarning)}`:void 0,e.askUser?"Approve only if you expected this command.":Eg[e.intent??"manual_only"]].filter((o)=>o!==void 0).join(`
 
 `)}function Wl(e,t){if(e.decision.kind!=="deny")return;let n=t.includeEvidence?e.decision.evidence:void 0;return{reason:e.decision.reason,ruleId:e.decision.ruleId,intent:e.decision.intent,command:n?.command,segment:n?.segment,toolName:t.toolName,...e.configFallback?{configWarning:e.configFallback.reason}:{},...e.decision.unverifiedByStandardMode?{unverifiedByStandardMode:!0}:{}}}function Vn(e={}){return{reason:jn,ruleId:"analysis.failed-closed",intent:"stop_and_explain",command:e.command,segment:e.segment??e.command,toolName:e.toolName}}var wg={session:{unusable:{reason:"CC Safety Net cannot check tool calls because the session's working directory or workspace root no longer exists, is inaccessible, is not a directory, or uses an unsupported path form. Ask the user to restart the session from an existing directory.",intent:"hard_stop",ruleId:"cwd.session-unusable"},"outside-workspace":{reason:"CC Safety Net cannot check tool calls because the session's working directory is outside its workspace roots. Ask the user to restart the session from a directory inside the workspace.",intent:"hard_stop",ruleId:"cwd.session-outside-workspace"}},requested:{unusable:{reason:"CC Safety Net could not use the requested working directory because it does not exist, is inaccessible, is not a directory, or uses an unsupported path form. Use an existing accessible working directory. If the requested directory is missing, create it from an accessible location before retrying the command.",intent:"use_alternative",ruleId:"cwd.requested-unusable"},"outside-workspace":{reason:"CC Safety Net could not use the requested working directory because it is outside the session's workspace. Use a working directory inside the workspace.",intent:"use_alternative",ruleId:"cwd.requested-outside-workspace"}}};function Mi(e,t={}){return{...wg[e.directory][e.problem],command:t.command,toolName:t.toolName,cwd:e.cwd}}function Gl(e){return Rg({...e,redact:pt})}function Fl(e){return pt(e instanceof Error?e.message:String(e))}import{isAbsolute as Bi,relative as Jg,resolve as sc,sep as Qg}from"node:path";import{basename as Bl,dirname as xg,isAbsolute as _g,join as Ag,normalize as Pg,resolve as zl}from"node:path";var Ig=256,Ur=new Set(["CC_SAFETY_NET_HOME","CLAUDE_CONFIG_DIR","CODEX_HOME","COPILOT_HOME","GEMINI_CLI_HOME","GROK_HOME","HOME","KIMI_CODE_HOME","KIMI_SHARE_DIR","OPENCODE_CONFIG","OPENCODE_CONFIG_DIR","PI_CODING_AGENT_DIR","ProgramData","TMPDIR","XDG_CONFIG_HOME","XDG_DATA_HOME"]);function ce(e,t=process.platform){if(t!=="win32")return e;return e.replace(/^\/([A-Za-z])(?:\/|$)/,"$1:/")}function tt(e,t=process.platform){if(t!=="win32")return!1;return(e[0]==="/"||e[0]==="\\")&&(e[1]==="/"||e[1]==="\\")}function Wi(e,t){return Di(e,0,t)}function Di(e,t,n){let r="",o=0,i=0;while(o<e.length){if(e[o]!=="$"){r+=e[o],o++;continue}if(e[o+1]==="{"){let a=Ni(e,o+2),l=Tg(e,o,t);if(l===null){if(Ur.has(a))throw new W("pathEnvironmentExpansion");if(i++,i>j.pathEnvironmentExpansion.cap)throw new W("pathEnvironmentExpansion");r+="${",o+=2;continue}let c=e.slice(o,l+1);r+=kg(c,t,n),o=l+1;continue}let s=Ni(e,o+1);if(!s){r+="$",o++;continue}r+=Li(s,n)??`$${s}`,o+=s.length+1}return r}function Tg(e,t,n){let r=1;for(let o=t+2;o<e.length;o++){if(e[o]==="\\"){o++;continue}if(e[o]==="$"&&e[o+1]==="{"){if(r++,n+r>j.pathEnvironmentExpansion.cap)throw new W("pathEnvironmentExpansion");o++;continue}if(e[o]!=="}")continue;if(r--,r===0)return o}return null}function kg(e,t,n){let r=e.slice(2,-1),o=Ni(r,0);if(!o)return e;let i=r.slice(o.length);if(!i)return Li(o,n)??e;let s=[":-",":+",":=",":?","-","+","=","?"].find((c)=>i.startsWith(c));if(!s){if(Ur.has(o))throw new W("pathEnvironmentExpansion");return e}if(!Ur.has(o))return e;if(s.endsWith("="))throw new W("pathEnvironmentExpansion");let a=Li(o,n),l=s.startsWith(":")?a!==null&&a!=="":a!==null;if(s.endsWith("?")&&!l)throw new W("pathEnvironmentExpansion");if(s.endsWith("-")||s.endsWith("?"))return l?a??"":Di(i.slice(s.length),t+1,n);return l?Di(i.slice(s.length),t+1,n):""}function Ni(e,t){if(!/[A-Za-z_]/.test(e[t]??""))return"";let n=t+1;while(/[A-Za-z0-9_]/.test(e[n]??""))n++;return e.slice(t,n)}function Li(e,t){if(!Ur.has(e))return null;if(e==="HOME")return t.env.get("HOME")??t.home;return t.env.get(e)??null}function N(e,t,n){if(!e)return e;let r=n.resolvedPaths.get(e);if(r!==void 0)return r;let o=[],i=e;while(!0){Ul(n,i);let s=t.realpath(i);if(s!==null)return $l(n,e,s,o);let a=xg(i);if(a===i||o.length>=Ig)return $l(n,e,i,o);o.push(Bl(i)),i=a}}function $l(e,t,n,r){let o=r.length===0?n:Ag(n,...r.reverse());return e.resolvedPaths.set(t,o),o}function Og(e,t,n){let r=n.resolvedPaths.get(e);if(r!==void 0)return r;Ul(n,e);let o=t.realpath(e);if(o!==null)n.resolvedPaths.set(e,o);return o}function Ul(e,t){e.charge("realpathAttempts"),e.charge("processedCandidateBytes",Buffer.byteLength(t))}function ue(e,t,n,r){let o=jl(e,t,n);if(!o)return"";return N(o,n.paths,r).replace(/\\/g,"/")}function Hl(e,t,n,r,o){let i=jl(e,t,n);if(!i)return null;if(o(Bl(i)))return N(i,n.paths,r).replace(/\\/g,"/");let s=Og(i,n.paths,r);return s===null?null:s.replace(/\\/g,"/")}function jl(e,t,n){let r=n.home,o=Wi(e.trim(),n).replace(/\\/g,"/");if(!o)return"";let i=o==="~"?r:o.startsWith("~/")?zl(r,o.slice(2)):o,s=ce(i);return Pg(_g(s)?s:zl(t,s))}import{types as Mg}from"node:util";var Dg=new Set(["find","findbyname","glob","grep","grepsearch","listdir","listpermissions","ls","read","readfile","readurlcontent","searchweb","view","viewfile"]),Ng=new Set(["command","diff","input","patch","patchtext"]),Vl=new TextEncoder,Lg=new TextDecoder,Wg=/\s/,Gg=64;class nt extends Error{name="ToolInputLimitError";constructor(){super("tool input traversal limit exceeded")}}var Kn=Object.freeze({maxDepth:64,maxNodes:1e4,maxKeys:1e4,maxStringBytes:1048576,maxAggregateStringBytes:4194304});function Fg(e){return e.replace(/[-_\s]/g,"").toLowerCase()}function jr(e){return Dg.has(Fg(e))}function Yn(e){if(!e||typeof e!=="object")return;rc(e);let t=Object.getOwnPropertyDescriptor(e,"command");if(!t){if("command"in e)qe();return}if(t.get||t.set)qe();let n=t.value;return typeof n==="string"&&n!==""?n:void 0}function Xl(e,t){return Jl(e,t,!1,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1)}function Jl(e,t,n,r,o){let i=nc(e,r,o);if(typeof e==="string")return n?[e]:[];if(!i)return[];let s=i.entries.flatMap(([a,l])=>Jl(l,t,i.array?n:t.has(Ql(a)),r,o+1));return r.ancestors.delete(i.object),s}function Ql(e){return e.replace(/-/g,"_").toLowerCase()}function ec(e){return tc(e,!0,{nodes:0,keys:0,stringBytes:0,ancestors:new Set},1).flatMap($g)}function tc(e,t,n,r){let o=nc(e,n,r);if(typeof e==="string")return t?[e]:[];if(!o)return[];let i=o.entries.flatMap(([s,a])=>tc(a,o.array?t:Ng.has(Ql(s)),n,r+1));return n.ancestors.delete(o.object),i}function zg(e,t,n){if(t.nodes++,e!==null&&typeof e==="object"&&n>Kn.maxDepth||t.nodes>Kn.maxNodes)qe();if(typeof e!=="string")return;let r=Buffer.byteLength(e);if(t.stringBytes+=r,r>Kn.maxStringBytes||t.stringBytes>Kn.maxAggregateStringBytes)qe()}function nc(e,t,n){if(zg(e,t,n),!e||typeof e!=="object")return null;let r=rc(e);if(t.ancestors.has(e))qe();let o=Reflect.ownKeys(e);if(t.keys+=o.length,t.keys>Kn.maxKeys)qe();let i=o.flatMap((s)=>{let a=Object.getOwnPropertyDescriptor(e,s);if(!a||a.get||a.set)qe();return typeof s==="string"&&a.enumerable?[[s,a.value]]:[]});return t.ancestors.add(e),{object:e,array:r,entries:i}}function rc(e){if(Mg.isProxy(e))qe();let t=Array.isArray(e),n=Object.getPrototypeOf(e);if(t&&n!==Array.prototype||!t&&n!==Object.prototype&&n!==null)qe();return t}function qe(){throw new nt}function $g(e){let t=[],n=e.split(/\r?\n/),r=!1,o=!1,i=null,s=null,a=()=>{o=!1,i=null,s=null};for(let l=0;l<n.length;l++){let c=n[l]??"";if(c==="*** Begin Patch"){r=!0,a();continue}if(c==="*** End Patch"){r=!1,a();continue}if(c.startsWith("@@")){let u=Bg(c);if(o=!0,i=u?.oldLines??null,s=u?.newLines??null,i===0&&s===0)a();continue}if(o&&i!==null&&s!==null){let u=c.startsWith(" ")||c.startsWith("-")?1:0,f=c.startsWith(" ")||c.startsWith("+")?1:0;if(i=Math.max(0,i-u),s=Math.max(0,s-f),i===0&&s===0)a();continue}if(c.startsWith("*** ")){a(),t.push(...Gi(c));continue}if(o)continue;if(c.startsWith("diff --git ")){t.push(...Gi(c));continue}if(c.startsWith("--- ")){let u=n[l+1]??"";if(!u.startsWith("+++ "))continue;t.push(...zi(Hr(c.slice(4),!0),Hr(u.slice(4),!0))),l++;continue}if(!r)t.push(...Gi(c))}return t}function Bg(e){let t=/^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/.exec(e);if(!t)return null;return{oldLines:Number(t[1]??1),newLines:Number(t[2]??1)}}function Gi(e){let t=/^\*\*\* (?:Add|Update|Delete) File: (.+)$/.exec(e);if(t?.[1])return Zl(t[1]);let n=/^\*\*\* Move to: (.+)$/.exec(e);if(n?.[1])return Zl(n[1]);if(e.startsWith("diff --git "))return Ug(e.slice(11));let r=/^--- (.+)$/.exec(e);if(r?.[1])return Yl(r[1]);let o=/^\+\+\+ (.+)$/.exec(e);if(o?.[1])return Yl(o[1]);let i=/^(?:rename|copy) (?:from|to) (.+)$/.exec(e);if(i?.[1])return Zg(i[1]);return[]}function Ug(e){let t=Hg(e);if(t.length===2&&t[0]&&t[1])return zi(t[0],t[1]);let n=jg(e);return n?zi(e.slice(n.oldStart,n.oldEnd),e.slice(n.newStart,n.newEnd)):[]}function Hg(e){let t=[],n=0;while(n<e.length&&t.length<2){while(Mt(e[n]))n++;if(n>=e.length)break;let r=e[n]==='"'||e[n]==="'"?e[n]:void 0;if(!r){let i=n;while(n<e.length&&!Mt(e[n]))n++;t.push(e.slice(i,n));continue}let o=oc(e,n,r);if(!o)return[];t.push(o.value),n=o.end}while(Mt(e[n]))n++;return n===e.length?t:[]}function jg(e){let t=0;while(t<e.length&&Mt(e[t]))t++;let n=e.length;while(n>t&&Mt(e[n-1]))n--;let r=0,o=t;while(o<n){if(!Mt(e[o])){o++;continue}let i=o;while(o<n&&Mt(e[o]))o++;if(i===t||o===n)continue;if(r++,r>Gg)qe();if(Vg(e,t,i,o,n))return{oldStart:t,oldEnd:i,newStart:o,newEnd:n}}return null}function Vg(e,t,n,r,o){if(Fi(e,t,n,r,o))return!0;let i=Kl(e,"/",t,n),s=Kl(e,"/",r,o);if(i<=t||s<=r)return!1;if(Fi(e,t,i,r,s))return!1;return Fi(e,i+1,n,s+1,o)}function Fi(e,t,n,r,o){if(n-t!==o-r)return!1;for(let i=0;i<n-t;i++)if(e[t+i]!==e[r+i])return!1;return!0}function Kl(e,t,n,r){for(let o=n;o<r;o++)if(e[o]===t)return o;return-1}function Mt(e){return e!==void 0&&Wg.test(e)}function oc(e,t,n){let r=[],o=t+1;while(o<e.length){let i=String.fromCodePoint(e.codePointAt(o)??0);if(i===n)return{value:Lg.decode(Uint8Array.from(r)),end:o+1};if(i!=="\\"||n==="'"){r.push(...Vl.encode(i)),o+=i.length;continue}let s=e.slice(o+1),a=/^[0-7]{1,3}/.exec(s)?.[0];if(a){r.push(Number.parseInt(a,8)),o+=a.length+1;continue}r.push(...Vl.encode(Kg(s[0]??""))),o+=2}return null}function Kg(e){return{a:"\x07",b:"\b",f:"\f",n:`
@@ -48,5 +48,5 @@ var Ll={id:"cc-safety-net",name:"CC Safety Net",description:"Block destructive c
 `).some((n)=>{let r=n.indexOf(t);return r>=0&&/[()[\]{}]/.test(n.slice(r))})}function hP(e){return Array.from(e.matchAll(/[A-Za-z_$][\w$]*/g),(t)=>Jp(t[0])).some((t)=>t.some((n)=>pP.test(n)))}var yP=new Set(["cmd","powershell","pwsh"]);function CP(e,t){let n=$n(e.masked,t),r=wl[e.masked[n]??""];if(r===void 0||r==="}")return!1;let o=e.masked.indexOf(r,n+1),i=e.masked.slice(n+1,o);return o!==-1&&/^\s*,[\w\s,]*$/.test(i)&&/^[,)]/.test(e.masked.slice($n(e.masked,o+1)))&&!e.literals.some((s)=>s.tokenStart>n&&s.tokenStart<o&&(Cl.has(s.text)||Rn(fe(s.text).toLowerCase())||yP.has(fe(s.text).toLowerCase().replace(/\.exe$/,""))))}function bP(e){let t=[];return e.split("").map((n,r)=>{let o=t.at(-1)??-1;if(n in wl)t.push(r);if(n===")"||n==="]"||n==="}")t.pop();return o})}function SP(e,t,n,r){let o=n[t.tokenStart]??-1,i=e[o]??"",s=zn(e,t.tokenStart),a=$n(e,t.tokenEnd);if(/(?:^|[^\w$])in$|[=!]=$/.test(e.slice(Math.max(0,s-3),s+1)))return!0;if(/^(?:(?:not\s+)?in(?![\w$])|[=!]=)/.test(e.slice(a,a+8)))return!0;if(r&&(i==="["||i==="("))return!1;let l=e[s],c=e[a];if(i==="{"&&l===":")return AP(e,s);let u=(l===i||l===",")&&(c===","||c===wl[i]||i==="{"&&c===":");if(i!=="(")return u&&i!=="";return u&&(l===","||c===",")&&PP(e,o)}var vP=/(?:^|[^\w$.])(?:pathlib\s*\.\s*)?Path\s*$/,EP=/^\s*\.\s*write_(?:text|bytes)\s*\(/,RP=/(?:^|[^\w$.])open\s*$/,wP=/^[bt]*[awx][abtwx]*$/,xP=/(?:^|[^\w$])(?:writeFile|writeFileSync|appendFile|appendFileSync|Bun\s*\.\s*write)\s*$/;function _P(e,t,n){let r=n[t.tokenStart]??-1;if(e.masked[r]!=="(")return!1;let o=zn(e.masked,t.tokenStart),i=$n(e.masked,t.tokenEnd),s=e.masked[i],a=e.masked.slice(Math.max(0,r-40),r);if(vP.test(a))return(o===r||e.masked[o]===",")&&(s===","||s===")")&&!e.literals.some((c)=>c.tokenStart>r&&c.tokenStart<t.tokenStart)&&EP.test(e.masked.slice(Oo(e.masked,r+1)+1));if(o!==r||s!==",")return!1;if(xP.test(a))return!0;if(!RP.test(a))return!1;let l=e.literals.find((c)=>/^,\s*(?:mode\s*=\s*)?$/.test(e.masked.slice(i,c.tokenStart)));return l!==void 0&&wP.test(l.text)&&/^[,)]/.test(e.masked.slice($n(e.masked,l.tokenEnd)))}function AP(e,t){let n=zn(e,t),r=/[\w$]*$/.exec(e.slice(Math.max(0,n-63),n+1))?.[0]??"",o=e[zn(e,n+1-r.length)];return o==="{"||o===","}function PP(e,t){let n=zn(e,t),r=e.slice(Math.max(0,n-7),n+1);return!/[\w$)\]]$/.test(r)||mP.test(r)}function IP(e){let t=Rl(e);if(t==="python")return"python";if(t==="osascript")return"opaque";return t==="node"||t==="bun"||t==="deno"?"javascript":"simple"}var TP={python:"#",javascript:"/"};function kP(e,t){if(t==="opaque")return{kind:"unmaskable"};let n={masked:e.split(""),literals:[]};return Xp(e,0,t,n,!1)===null?{kind:"unmaskable"}:{kind:"masked",masked:n.masked.join(""),literals:n.literals}}function Xp(e,t,n,r,o){let i=0;for(let s=t;s<e.length;s++){let a=e[s]??"";if(o&&a==="}"&&i===0)return s;if(o&&a===TP[n])return null;if(a==="{")i++;if(a==="}")i--;if(n==="simple"&&(a==="`"||a==="%"||a==="<")){if(GA.test(e.slice(s)))return null}let l=a==="'"||a==='"'||n==="javascript"&&a==="`"?a:null;if(l===null)continue;if(l==="`"&&NP(e,s))return null;let c=n==="python"?MP(e,s):"",u=n==="python"&&e.startsWith(l.repeat(3),s)?l.repeat(3):l,f=s+u.length,d=l==="`"||/[fF]/.test(c),m=s-c.length,p=d?OP(e,m,f,u,n,r):DP(e,f,u);if(p===null)return null;if(!d){let g=e.slice(f,p);if(n==="simple"&&l==='"'&&FA.test(g))return null;r.literals.push({start:f,text:g,tokenStart:m,tokenEnd:p+u.length}),r.masked.fill(" ",f,p)}r.masked.fill(" ",s,f),r.masked.fill(" ",p,p+u.length),s=p+u.length-1}return o?null:e.length}function OP(e,t,n,r,o,i){let s=o==="python"?"{":"${",a=r==="`"||r.length===3,l="";for(let c=n;c<e.length;c++){let u=e[c]??"";if(e.startsWith(r,c))return i.literals.push({start:n,text:l,tokenStart:t,tokenEnd:c+r.length}),c;if(!a&&(u===`
 `||u==="\r"))return null;let f=o==="python"&&(u==="{"||u==="}")&&e[c+1]===u;if(!f&&e.startsWith(s,c)){let p=Xp(e,c+s.length,o,i,!0);if(p===null)return null;l+=`${s}}`,i.masked.fill(" ",c,c+s.length),i.masked[p]=" ",c=p;continue}let m=u==="\\"&&!(o==="python"&&e[c+1]==="{")||f?2:1;l+=e.slice(c,c+m),i.masked.fill(" ",c,c+m),c+=m-1}return null}function MP(e,t){return WA.exec(e.slice(Math.max(0,t-3),t))?.[1]??""}function DP(e,t,n){let r=n.length===3;for(let o=t;o<e.length;o++){let i=e[o];if(i==="\\"){o++;continue}if(!r&&(i===`
 `||i==="\r"))return null;if(e.startsWith(n,o))return o}return null}function NP(e,t){for(let n=t-1;n>=0;n--){let r=e[n];if(!r||/\s/.test(r))continue;return/[\w$\])]/.test(r)}return!1}function LP(e){for(let t of e.matchAll(/[A-Za-z_$][A-Za-z0-9_$]*/g)){let n=t[0],r=t.index;if(vA.has(n.toLowerCase()))return!0;let o=Jp(n);if(!o.some((i)=>EA.has(i)))continue;if(o.length>1)return!0;if(e[zn(e,r)]===".")return!0;if(e[$n(e,r+n.length)]==="(")return!0}return!1}function Jp(e){return e.replace(/([a-z0-9])([A-Z])/g,"$1 $2").split(/[_$\s]+/).map((t)=>t.toLowerCase())}function zn(e,t){for(let n=t-1;n>=0;n--)if(!/\s/.test(e[n]??""))return n;return-1}function $n(e,t){for(let n=t;n<e.length;n++)if(!/\s/.test(e[n]??""))return n;return e.length}function WP(e,t,n,r,o,i){return BP(e).flatMap((s)=>{let a=t.getShellSyntax(s);if(a.status==="invalid")return[];return[...Bn(a,t,{...n,displayOperandsAreCapturedOutput:!0},r,o,i),...GP(a,r)?FP(a,r).map((l)=>({target:l,cwd:o})):[]]})}function GP(e,t){let n=Bo(e);for(let r=0;r<n.length;r++){let o=n[r];if(o?.kind!=="word"||fe(at(o.text,t)).toLowerCase()!=="base64")continue;for(let i=r+1;i<n.length;i++){let s=n[i];if(s?.kind==="operator")break;if(s?.kind!=="word")continue;let a=at(s.text,t);if(a==="--decode"||!a.startsWith("--")&&a.startsWith("-")&&/[dD]/.test(a))return!0}}return!1}function FP(e,t){return Bo(e).flatMap((n)=>n.kind==="word"?[at(n.text,t)]:n.kind==="redirection"&&n.target?[at(n.target,t)]:[]).flatMap(xl)}function xl(e){let t=$P(e);if(t===null)return[];let n=Buffer.from(t,"base64").toString("utf8");if(n===""||zP(n))return[];return Buffer.from(n,"utf8").toString("base64").replace(/=+$/g,"")===t.replace(/=+$/g,"")?[n]:[]}function zP(e){return Array.from(e).some((t)=>{let n=t.charCodeAt(0);return n<32||n===127})}function $P(e){if(e.length<8||!/^[A-Za-z0-9+/_-]+={0,2}$/.test(e))return null;if(/=/.test(e.replace(/=+$/g,"")))return null;let t=e.replace(/=+$/g,"");if(t.length%4===1)return null;return`${t.replace(/-/g,"+").replace(/_/g,"/")}${"=".repeat((4-t.length%4)%4)}`}function BP(e){let t=[],n={inSingle:!1,inDouble:!1,escaped:!1};for(let r=0;r<e.length;r++){let o=e[r];if(!o)break;if(tr(o,n))continue;if(Qp(e,r,n)){let i=UP(e,r+1);if(i!==null)t.push(i.body),r=i.endIndex;continue}if(!n.inSingle&&o==="`"){let i=HP(e,r);if(i!==null)t.push(i.body),r=i.endIndex}}return t}function UP(e,t){let n={inSingle:!1,inDouble:!1,escaped:!1},r=1;for(let o=t+1;o<e.length;o++){let i=e[o];if(!i)break;if(tr(i,n))continue;if(Qp(e,o,n)){r++,o++;continue}if(!n.inSingle&&!n.inDouble&&i===")"){if(r--,r===0)return{body:e.slice(t+1,o),endIndex:o}}}return null}function HP(e,t){let n=!1;for(let r=t+1;r<e.length;r++){let o=e[r];if(!o)break;if(n){n=!1;continue}if(o==="\\"){n=!0;continue}if(o==="`")return{body:e.slice(t+1,r),endIndex:r}}return null}function Qp(e,t,n){return!n.inSingle&&e[t]==="$"&&e[t+1]==="("&&e[t+2]!=="("}function jP(e){let t=[],n=[],r=!1,o=!1,i=!1;for(let l=0;l<e.length;l++){let c=e[l];if(c===void 0)break;if(!i&&c==="--"){i=!0;continue}if(i){n.push(c);continue}let u=/^--([^=]+)(?:=(.*))?$/.exec(c);if(u!==null){let f=u[1]??"",d=u[2];if(f===OA)o=!0;if(DA.has(f))r=!0;if(d!==void 0){if(f===Pp)t.push(d);continue}if(LA.has(f)){let m=e[l+1];if(f===Pp&&m!==void 0)t.push(m);l++}continue}if(c.startsWith("-")&&c.length>1){let f=c.slice(1),d="",m="";for(let g=0;g<f.length;g++){let h=f[g]??"";if(MA.has(h))r=!0;if(NA.has(h)){d=h,m=f.slice(g+1);break}}if(d==="")continue;if(m.length>0){if(d===Ap)t.push(m);continue}let p=e[l+1];if(d===Ap&&p!==void 0)t.push(p);l++;continue}n.push(c)}let a=!r&&!o?n.slice(1):n;return[...t,...a]}function Je(e){let t=e.findIndex((n)=>!eg(n)&&!/^[A-Za-z_][A-Za-z0-9_]*=.*/.test(n));return t===-1?[]:e.slice(t)}function eg(e){return e==="env"||e==="command"||e==="builtin"||e==="sudo"}var VP=new Set(["id_rsa.pub","id_ed25519.pub","id_ecdsa.pub"]),KP=".env.",qP=new Set([".env.example",".env.sample",".env.template",".env.tpl",".env.defaults"]),YP=[".env.example.",".env.sample."];function ZP(e){let t;try{t=new URL(e.trim())}catch{return!1}return t.protocol!=="file:"&&t.host!==""}function XP(e){return e.length>0&&!/\s/.test(e)}function Ai(e,t,n,r){let o=tg(e,t,n,r);return o!==""&&n.paths.entryKind(o)!=="missing"}function tg(e,t,n,r){try{return zr(e,t,n,r)}catch(o){if(o instanceof W)throw o;return""}}var JP=/[?&][^?&=/]+=/,QP=new Set(["node_modules","__pycache__"]),eI=[["vendor","bundle"],["vendor","cache"]];function tI(e,t,n,r,o){if(ZP(e))return null;let i=Se(e,t,r,o);if(!i)return null;let s=B(i.split("/").pop()??""),a=B(i),l=()=>XP(s)||Ai(e,t,r,o),c=B(aI(e,t,r,o));for(let d of vs){let m=`~/${d.suffixParts.join("/")}`;if((Lp(a,m)||Lp(c,m))&&ft(d.id,n))return d.id}if(qP.has(s)||YP.some((d)=>s.startsWith(d)))return null;let u=nI(i,t,n,r,o);if(u)return u;if(VP.has(s))return null;for(let d of Ss)if(s===d.basename&&ft(d.id,n))return d.id;if(s.startsWith(KP)&&ft(so.id,n)&&l())return so.id;for(let d of Es)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){let m=s.slice(d.prefix.length)[0];if((m==="-"||m==="_")&&ft(d.id,n)&&l())return d.id}for(let d of Rs)if(s.length>d.prefix.length&&s.startsWith(d.prefix)){if(s.slice(d.prefix.length)===d.suffix&&ft(d.id,n))return d.id}if(iI(a))return null;if(!s.includes(".")&&nr.pattern.test(s)&&ft(nr.id,n))return nr.id;if(JP.test(e)&&!Ai(e,t,r,o))return null;let f=sI(s,n);if(f)return f;return null}function nI(e,t,n,r,o){return ao.find((i)=>{if(!ft(i.id,n))return!1;switch(i.id){case"secret.cli.claude-code":return L(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),[".credentials.json"]);case"secret.cli.claude-code.config":{let s=B(e).split("/");return L(e,H(r.env.get("CLAUDE_CONFIG_DIR"),"~/.claude",t,r,o),["settings.json","settings.local.json"])||Gr(e,"~/.claude.json",t,r,o)||s.at(-1)==="settings.local.json"&&s.at(-2)===".claude"||s.at(-1)===".mcp.json"}case"secret.cli.antigravity":return L(e,Se("~/.gemini/config",t,r,o),["hooks.json","mcp_config.json"]);case"secret.cli.codex":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o);return L(e,s,["auth.json",".credentials.json"])||Fn(e,s,["secrets",".sandbox-secrets"])}case"secret.cli.codex.config":{let s=H(r.env.get("CODEX_HOME"),"~/.codex",t,r,o),a=B(e).split("/").at(-1)??"";return L(e,s,["config.toml"])||a.endsWith(".config.toml")&&L(e,s,[a])}case"secret.cli.gemini":return L(e,ne(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["oauth_creds.json","mcp-oauth-tokens.json","a2a-oauth-tokens.json","gemini-credentials.json"]);case"secret.cli.gemini.config":{let s=B(e).split("/"),a=r.env.get("GEMINI_CLI_SYSTEM_SETTINGS_PATH"),l=r.env.get("ProgramData")?[ne(H(r.env.get("ProgramData"),"",t,r,o),"gemini-cli")]:[];return L(e,ne(H(r.env.get("GEMINI_CLI_HOME"),"~",t,r,o),".gemini"),["settings.json","google_accounts.json"])||s.at(-1)==="settings.json"&&s.at(-2)===".gemini"||(a?.trim()?Gr(e,a,t,r,o):!1)||["/Library/Application Support/GeminiCli","/etc/gemini-cli",...l].some((c)=>L(e,Se(c,t,r,o),["settings.json"]))}case"secret.cli.copilot-cli":{let s=H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o);return L(e,s,["config.json"])||Fn(e,s,["mcp-oauth-config","mcp-secrets"])}case"secret.cli.copilot-cli.config":return L(e,H(r.env.get("COPILOT_HOME"),"~/.copilot",t,r,o),["mcp-config.json"]);case"secret.cli.kimi-code":{let s=H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),a=H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o);return L(e,s,["server.token"])||Fn(e,s,["credentials"])||Fn(e,a,["credentials","mcp-oauth"])}case"secret.cli.kimi-code.config":{let s=["config.toml","mcp.json"],a=B(e).split("/");return a.at(-1)==="mcp.json"&&a.at(-2)===".kimi-code"||L(e,H(r.env.get("KIMI_CODE_HOME"),"~/.kimi-code",t,r,o),s)||L(e,H(r.env.get("KIMI_SHARE_DIR"),"~/.kimi",t,r,o),[...s,"config.json","config.json.bak"])}case"secret.cli.opencode":{let s=ne(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"opencode"),a=B(e).split("/").at(-1)??"",l=r.env.get("OPENCODE_DB")?.trim(),c=l&&l!==":memory:"?[l,`${l}-wal`,`${l}-shm`]:[];return L(e,s,["auth.json","mcp-auth.json"])||/^opencode(-.+)?\.db(-wal|-shm)?$/.test(a)&&L(e,s,[a])||c.some((u)=>Gr(e,u,t,r,o))}case"secret.cli.opencode.config":{let s=ne(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"opencode"),a=r.env.get("ProgramData")?[ne(H(r.env.get("ProgramData"),"",t,r,o),"opencode")]:[],l=["opencode.json","opencode.jsonc"],c=r.env.get("OPENCODE_CONFIG");return l.includes(B(e).split("/").at(-1)??"")||L(e,s,["config.json"])||(c?.trim()?Gr(e,c,t,r,o):!1)||["/Library/Application Support/opencode","/etc/opencode",...a].some((u)=>L(e,Se(u,t,r,o),l))}case"secret.cli.pi":return L(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["auth.json"]);case"secret.cli.pi.config":return L(e,H(r.env.get("PI_CODING_AGENT_DIR"),"~/.pi/agent",t,r,o),["models.json"]);case"secret.cli.amp":{let s=Se("~",t,r,o);return[ne(H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),"amp"),ne(s,".local","share","amp")].some((l)=>L(e,l,["secrets.json"]))||Fn(e,ne(s,".amp"),["oauth"])}case"secret.cli.amp.config":{let s=["settings.json","settings.jsonc"],a=[ne(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"amp"),ne(Se("~",t,r,o),".config","amp")],l=B(e).split("/"),c=r.env.get("AMP_SETTINGS_FILE");return a.some((u)=>L(e,u,s))||l.at(-2)===".amp"&&s.includes(l.at(-1)??"")||(c?.trim()?Gr(e,c,t,r,o):!1)}case"secret.cli.cursor":{let s=ne(H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),"cursor"),a=ne(H(r.env.get("CURSOR_DATA_DIR"),"~/.cursor",t,r,o),"projects");return L(e,Se("~/.cursor",t,r,o),["auth.json"])||L(e,s,["auth.json"])||B(e).split("/").at(-1)==="mcp-auth.json"&&rn(B(e),B(a))}case"secret.cli.cursor.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".cursor"}case"secret.cli.grok-build":return L(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["auth.json","mcp_credentials.json"]);case"secret.cli.grok-build.config":{let s=B(e).split("/");return s.at(-1)==="config.toml"&&s.at(-2)===".grok"||L(e,H(r.env.get("GROK_HOME"),"~/.grok",t,r,o),["config.toml","managed_config.toml","requirements.toml"])||L(e,Se("/etc/grok",t,r,o),["managed_config.toml","requirements.toml"])}case"secret.cli.droid":return L(e,Se("~/.factory",t,r,o),["auth.encrypted","auth.v2.file","auth.v2.key","auth.v2.loginkeychain"]);case"secret.cli.droid.config":{let s=B(e).split("/");return s.at(-1)==="mcp.json"&&s.at(-2)===".factory"||L(e,Se("~/.factory",t,r,o),["settings.json","hooks.json"])}case"secret.cli.devin":return[H(r.env.get("XDG_DATA_HOME"),"~/.local/share",t,r,o),Se("~/.local/share",t,r,o)].some((s)=>L(e,ne(s,"devin"),["credentials.toml"])||Fn(e,ne(s,"devin","mcp"),["oauth"]));case"secret.cli.devin.config":return[H(r.env.get("XDG_CONFIG_HOME"),"~/.config",t,r,o),Se("~/.config",t,r,o)].some((s)=>L(e,ne(s,"devin"),["config.json"]));default:return!1}})?.id??null}var Np=new WeakMap;function H(e,t,n,r,o){let i=Np.get(o)??new Map;Np.set(o,i);let s=`${n}\x00${e??""}\x00${t}`,a=i.get(s);if(a!==void 0)return a;let l=Se(e?.trim()?e:t,n,r,o);return i.set(s,l),l}function L(e,t,n){return n.some((r)=>ng(e,ne(t,r)))}function Fn(e,t,n){return n.some((r)=>rn(B(e),B(ne(t,r))))}function Gr(e,t,n,r,o){return ng(e,Se(t,n,r,o))}function ng(e,t){return B(e)===B(t)}function ne(e,...t){return Ve([e,...t].filter(Boolean).join("/"))}function rI(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(zr(e,t,o,i));return n.some((a)=>rn(s,B(zr(a,r,o,i))))}function oI(e,t,n,r,o,i){if(n.length===0)return!1;let s=B(zr(e,t,o,i));if(!s)return!1;let a=o.env.get("HOME")??o.home,l=a?Ve(N(ce(a),o.paths,i)):"",c=B(l),u=o.env.get("CC_SAFETY_NET_HOME"),f=B(u?Ve(N(Pi(ce(u)),o.paths,i)):l&&Ve(N(`${l}/.cc-safety-net`,o.paths,i)));if(f&&rn(s,f))return!1;return n.some((d)=>{let m=Ps(d);if(m&&Wp.basename(s)!==B(m.name))return!1;let p=B(zr(m?.root??d,r,o,i));if(!p)return!1;if(c&&(c===p||c.startsWith(p.endsWith("/")?p:`${p}/`)))return!1;return rn(s,p)&&!(m&&s===p)})}function iI(e){let t=e.split("/");return t.some((n)=>QP.has(n))||eI.some(([n,r])=>t.some((o,i)=>o===n&&t[i+1]===r))}function sI(e,t){let n=e.lastIndexOf("."),r=n>0&&n<e.length-1?e.slice(n+1):"";if(r==="")return null;for(let o of ws)if(r===o.extension&&ft(o.id,t))return o.id;for(let o of xs)if(o.pattern.test(r)&&ft(o.id,t))return o.id;return null}function B(e){return e.toLowerCase()}function ft(e,t){return!t?.disabledRules?.includes(e)}function Se(e,t,n,r){let{home:o,normalized:i}=_l(e,n,r);if(!i)return"";if(!o)return i;let s=Al(i,o),a=xi(s)?s:Ve(Pi(t,s)),l=Ve(N(a,n.paths,r));if(!rn(l,o)){if(xi(s))return l;return l===a?i:l}let c=l.slice(o.length);return c?`~${c}`:"~"}function Lp(e,t){return e===t||e.startsWith(`${t}/`)}function aI(e,t,n,r){let{home:o,normalized:i}=_l(e,n,r);if(!i||!o)return"";let s=Al(i,o),a=Wp.normalize(xi(s)?s:Ve(Pi(t,s))),l=Ve(ce(n.env.get("HOME")??n.home)),c=(d)=>process.platform==="win32"?d.toLowerCase():d,u=[o,l].find((d)=>d!==""&&rn(c(a),c(d)));if(u===void 0)return"";let f=a.slice(u.length);return f?`~${f}`:"~"}function zr(e,t,n,r){let{home:o,normalized:i}=_l(e,n,r);if(!i)return"";let s=o?Al(i,o):i;return Ve(N(xi(s)?s:Pi(t,s),n.paths,r))}function _l(e,t,n){let r=t.env.get("HOME")??t.home,o=r?Ve(N(ce(r),t.paths,n)):"",i=Ve(ce(lI(at(e,t))));return{home:o,normalized:i}}function lI(e){if(!e.trim().toLowerCase().startsWith("file:"))return e;try{return pA(e)}catch{return e}}function Al(e,t){if(e==="~")return t;if(e.startsWith("~/"))return ne(t,e.slice(2));return e}function cI(e){if(process.platform==="win32")return!0;return fA.parse(e).root.length>1}function Ve(e){let t=e.trim(),n=(t.includes("\\")&&cI(t)?t.replace(/\\/g,"/"):t).replace(/\/{2,}/g,"/").replace(/^\.\//,"");if(n==="/")return n;return n.replace(/\/+$/g,"")}function rn(e,t){return e===t||e.startsWith(t.endsWith("/")?t:`${t}/`)}function fe(e){return e.split(/[\\/]/).pop()?.replace(/\.exe$/i,"")??e}class on extends Error{stage;evaluation;name="GuardEvaluationError";constructor(e,t,n){super(`CC Safety Net ${e} dependency failed`,{cause:n});this.stage=e;this.evaluation=t}}var uI={findPolicyMutation:wp,findGitMetadataMutation:Vd,resolveGitMetadata:mI,loadPolicySnapshot:Pu,findSensitiveTarget:Bp,analyzeCommand:gp,getModes:Zi},dI=/^(?:\S*\/)?(?:ba|da|z|k)?sh(?:\s+-[A-Za-z-]*)*$/;function rg(e,t){let n={...uI,...t.dependencies},r=gI(e),o=$r(e)?e.command:r,i=It("policy-protection",o,()=>Bd(e)),s=ye(i,"input-candidate"),a=ye(i,"declared-command");if($r(e)&&e.command?.trim()&&a?.program.status==="limited")return{stage:"command-analysis",decision:{kind:"deny",reason:Ke,ruleId:"analysis.recursion-limit",intent:"stop_and_explain",evidence:{command:e.command,segment:e.command}}};if(s?.program.status==="limited")return{stage:"command-validation",decision:{kind:"deny",reason:mm,ruleId:"analysis.structural-limit",intent:"stop_and_explain"}};let l=ke(),c=It("policy-protection",o,()=>n.resolveGitMetadata([e.context.executionCwd,e.context.configCwd],t.environment)),u=It("policy-protection",o,()=>n.findPolicyMutation(i,t.environment,l));if(u){let C=o??u.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Rp,ruleId:"guard.policy-config",intent:"hard_stop",evidence:{command:C,segment:u.target}}}}let f=It("policy-protection",o,()=>bp(i,t.environment,l));if(f){let C=o??f.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Cp,ruleId:"guard.policy-apply",intent:"hard_stop",evidence:{command:C,segment:f.target}}}}let d=It("policy-protection",o,()=>n.findGitMetadataMutation(i,c,t.environment,l));if(d){let C=o??d.target;return{stage:"policy-protection",decision:{kind:"deny",reason:Ae,ruleId:"guard.git-metadata",intent:"hard_stop",evidence:{command:C,segment:d.target}}}}let m=It("config-load",o,()=>n.loadPolicySnapshot(t.environment,{...t.policyOptions,cwd:e.context.configCwd})),p=m.policy,g=n.getModes(p,t.environment.env),h={level:g.effectiveLevel,...fI(m)},y=p.secretProtection.enabled===!1?null:It("secret-protection",o,()=>n.findSensitiveTarget(i,p.secretProtection,t.environment,l,{strict:$r(e)||s?.program.dialect==="powershell"?g.strict:void 0}));if(y){let C=o??y.target;return{stage:"secret-protection",...h,decision:{kind:"deny",reason:Gp,intent:"hard_stop",ruleId:y.ruleId,evidence:{command:C,segment:y.target}}}}if(!$r(e))return{stage:"non-command",...h,decision:{kind:"allow"}};if(!e.command||e.command.trim()==="")return{...Pl("command-validation",o),...h};let b=It("command-analysis",o,()=>hp(()=>n.analyzeCommand(e.command,{cwd:e.context.executionCwd,shell:e.route.shell,policySnapshot:m,environment:t.environment,protectedGitMetadata:c,effectiveCapabilities:g.capabilities,strict:g.strict,paranoidRm:g.paranoidRm,paranoidInterpreters:g.paranoidInterpreters,worktreeMode:g.worktreeMode,budget:l,...t.trace?{trace:t.trace}:{}},pI(i),i.store),e.command,t.trace));if(b.decision){let C=!g.strict&&(b.decision.ruleId==="raw-text.dangerous-command"||b.decision.reason===_r&&!dI.test(b.decision.evidence?.segment??"")&&Me(e.command)===null);return{stage:"command-analysis",...h,..."errorCode"in b?{errorCode:b.errorCode}:{},decision:C?{...b.decision,unverifiedByStandardMode:!0}:b.decision}}return{stage:"command-analysis",...h,decision:{kind:"allow"}}}function mI(e,t){let n=[...new Set(e.filter((r)=>typeof r==="string"&&r!==""))].flatMap((r)=>t.gitMetadata(r)??[]);if(n.length===0)return null;return Object.freeze({entries:Object.freeze([...new Set(n.flatMap((r)=>r.entries))]),markerFiles:Object.freeze([...new Set(n.flatMap((r)=>r.markerFiles))]),directories:Object.freeze([...new Set(n.flatMap((r)=>r.directories))]),hooksDirectories:Object.freeze([...new Set(n.flatMap((r)=>r.hooksDirectories))])})}function fI(e){if(e.state==="ready")return{};return{configFallback:{reason:e.reason}}}function pI(e){return ye(e,"declared-command")?.program}function gI(e){try{return Yn(e.input)}catch(t){let n=$r(e)?e.command:void 0;throw new on("policy-protection",Pl("policy-protection",t instanceof nt?void 0:n,t),t)}}function It(e,t,n){try{return n()}catch(r){throw new on(e,Pl(e,r instanceof nt?void 0:t,r),r)}}function Pl(e,t,n){let r=n instanceof W||n instanceof Ue;return{stage:e,decision:{kind:"deny",reason:r?Oi:jn,ruleId:r?"analysis.limit":"analysis.failed-closed",intent:"stop_and_explain",...t?{evidence:{command:t,segment:t}}:{}}}}function $r(e){return e.route.kind==="command"}import{appendFileSync as PI,mkdirSync as II}from"node:fs";import{isAbsolute as TI,join as kl}from"node:path";import{lstatSync as ig,readdirSync as hI,readFileSync as yI,rmdirSync as CI,statSync as sg,unlinkSync as bI,utimesSync as SI,writeFileSync as vI}from"node:fs";import{join as Br}from"node:path";function og(e,t={}){return ho(Gt(e,t),e.home).policy.audit.retention_days}var Tl=86400000,EI=".last-prune",RI=/^\d{4}-\d{2}$/,wI=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,ag=(e)=>Math.floor(e/Tl);function cg(e,t,n=()=>new Date){try{let r=n().getTime();if(!sg(t,{throwIfNoEntry:!1})?.isDirectory())return;let o=Br(t,EI),i=sg(o,{throwIfNoEntry:!1})?.mtimeMs;if(i!==void 0&&ag(i)===ag(r))return;let s=r-og(e)*Tl,a=new Date(r).toISOString().slice(0,7);for(let l of Il(t)){if(l.isDirectory()){xI(Br(t,l.name),s,a);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))_I(Br(t,l.name),s)}vI(o,"",{mode:384}),SI(o,r/1000,r/1000)}catch{}}function xI(e,t,n){for(let r of Il(e)){if(!r.isDirectory()||!RI.test(r.name))continue;let o=Br(e,r.name);for(let i of Il(o)){if(!i.isFile())continue;let s=wI.exec(i.name);if(!s||s[2]!==r.name)continue;let a=Date.parse(`${s[1]}T00:00:00.000Z`)+Tl;if(!Number.isFinite(a)||a>=t)continue;ug(Br(o,i.name))}if(r.name!==n)lg(o)}lg(e)}function _I(e,t){try{let n=ig(e);if(n.mtimeMs>=t)return;let r=yI(e,"utf-8").split(`
-`).filter((o)=>o.trim()).map(AI);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ig(e).mtimeMs!==n.mtimeMs)return;ug(e)}catch{}}function AI(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Il(e){try{return hI(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function ug(e){try{bI(e)}catch{}}function lg(e){try{CI(e)}catch{}}var kI="2.6.5",OI=1e4,MI=2000,DI=256,NI=32768;function LI(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function WI(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ol(e,t,n,r,o,i,s={}){let a=LI(t);if(!a)return;let l=FI(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Ii(pt(n),s.failureStage?Number.POSITIVE_INFINITY:OI),f=Ii(pt(r),MI),d=s.toolName?Ii(pt(s.toolName),DI):void 0,m=i===null?void 0:Ii(pt(i),NI),p=kl(l,WI(m?.value??null),c.slice(0,7));II(p,{recursive:!0,mode:448});let g=kl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Xi)(),v:kI,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};PI(g,`${JSON.stringify(h)}
+`).filter((o)=>o.trim()).map(AI);if(r.length===0)return;if(r.some((o)=>o===void 0||o>=t))return;if(ig(e).mtimeMs!==n.mtimeMs)return;ug(e)}catch{}}function AI(e){try{let t=JSON.parse(e).ts,n=typeof t==="string"?Date.parse(t):Number.NaN;return Number.isFinite(n)?n:void 0}catch{return}}function Il(e){try{return hI(e,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function ug(e){try{bI(e)}catch{}}function lg(e){try{CI(e)}catch{}}var kI="2.6.6",OI=1e4,MI=2000,DI=256,NI=32768;function LI(e){let t=e.trim();if(!t)return null;let n=t.replace(/[^A-Za-z0-9_.-]+/g,"_");if(n=n.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!n||n==="."||n==="..")return null;return n}function WI(e){return(e??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function Ol(e,t,n,r,o,i,s={}){let a=LI(t);if(!a)return;let l=FI(e);if(!l)return;try{let c=(s.now??(()=>new Date))().toISOString(),u=Ii(pt(n),s.failureStage?Number.POSITIVE_INFINITY:OI),f=Ii(pt(r),MI),d=s.toolName?Ii(pt(s.toolName),DI):void 0,m=i===null?void 0:Ii(pt(i),NI),p=kl(l,WI(m?.value??null),c.slice(0,7));II(p,{recursive:!0,mode:448});let g=kl(p,`${c.slice(0,10)}-${a}.jsonl`),h={ts:c,id:(s.createId??Xi)(),v:kI,sessionId:a,decision:s.decision??"deny",agent:s.agent,shape:s.shape,level:s.level,configFallback:s.configFallback,toolName:d?.value,command:u.value,segment:f.value,...u.truncated||f.truncated||d?.truncated||m?.truncated?{truncated:!0}:{},reason:o,ruleId:s.ruleId,intent:s.intent,failureStage:s.failureStage,errorCode:s.errorCode,cwd:m?.value??null};PI(g,`${JSON.stringify(h)}
 `,{encoding:"utf-8",mode:384}),cg(e,l,s.now)}catch{}}function Ii(e,t){return{value:e.slice(0,t),truncated:e.length>t}}function GI(e){let t=e.env.get("CC_SAFETY_NET_AUDIT_HOME");if(e.env.get("NODE_ENV")==="test"&&!t)return null;let n=t||e.home;return n&&TI(n)?n:null}function FI(e){let t=GI(e);return t?kl(t,".cc-safety-net","logs"):null}function mg(e,t,n,r=!0,o){if(t.decision.kind==="allow"){if(!n||e.route.kind!=="command")return;let a=dg(e);return{decision:"allow",command:a,segment:a,reason:"allowed",cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{}}}let i=t.decision.evidence,s=i?.command??(r?dg(e):"");return{decision:"deny",command:s,segment:i?.segment??s,reason:t.decision.reason,cwd:e.context.executionCwd,toolName:e.toolName,level:t.level,...t.configFallback?{configFallback:!0}:{},ruleId:t.decision.ruleId,intent:t.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function dg(e){return"command"in e?e.command??"":""}function fg(e,t,n,r){if(!t)return;let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ol(e,o,t.command,t.segment,t.reason,t.cwd,{decision:t.decision,agent:r.agent,shape:r.shape,level:t.level,configFallback:t.configFallback,toolName:t.toolName,ruleId:t.ruleId,intent:t.intent,failureStage:t.failureStage,errorCode:t.errorCode})}function pg(e,t,n,r){let o;try{o=n()}catch{return}if(typeof o!=="string"||!o.trim())return;Ol(e,o,t.command??"",t.segment??t.command??"",t.reason,r.cwd??null,{decision:"deny",agent:r.agent,shape:r.shape,toolName:r.toolName??t.toolName,ruleId:t.ruleId,intent:t.intent})}function hg(e,t,n){try{let r=rg(t,{environment:e,...n.guard});return gg(e,t,r,n),r}catch(r){if(!(r instanceof on))throw r;throw gg(e,t,r.evaluation,n,!(r.cause instanceof nt),{stage:r.stage,errorCode:zI(r.cause)}),r}}function gg(e,t,n,r,o=!0,i){fg(e,mg(t,n,r.guard?.auditAllowed??!1,o,i),r.audit.getSessionId,{agent:r.audit.agent,shape:r.audit.shape})}function zI(e){if(e instanceof W)return j[e.kind].errorCode;if(e instanceof nt)return"tool-input-limit";if(e instanceof Ue)return"structural-shell-syntax-limit";return"unexpected-error"}function Tt(e,t={}){return{malformed:!0,denial:Vn(t),cwd:e}}function Ml(e,t){return{malformed:!0,denial:Mi(e,t),cwd:e.cwd}}function yg(e,t={}){return(n,r)=>{try{return $I(n,r,e,t)}catch(o){return console.error("CC Safety Net error:",o),e.block(Vn())}}}function $I(e,t,n,r){let o=gc();if(n.cancelled?.(t))return n.block(Vn());let i=n.extract(e,t,o.paths);if(!i)return n.allow;let s=()=>n.getSessionId(e,t);if("malformed"in i)return pg(o,i.denial,s,{agent:n.agent,toolName:i.denial.toolName,cwd:i.cwd}),n.block(i.denial);let a=(l,c)=>{let u=Wl(l,{includeEvidence:c});return u?n.block(u):n.allow};try{let l=hg(o,i,{guard:{auditAllowed:bc(o.env),policyOptions:r.policyOptions,dependencies:r.guardDependencies},audit:{agent:n.agent,getSessionId:s}});return a(l,!0)}catch(l){if(!(l instanceof on))throw l;if(rt(Z.debug,o.env))console.error(`CC Safety Net debug: ${n.debugLabel} analysis failed: ${Fl(l.cause)}`);return a(l.evaluation,n.includeEvidenceOnError(i))}}var Cg="exec",BI=new Set(["auto","gateway"]);function bg(e){e.on("before_tool_call",UI(e),{matcher:[Cg],priority:50})}function UI(e,t={}){return yg({agent:"openclaw",debugLabel:"openclaw before_tool_call",extract:(r,o,i)=>HI(r,o,e,i),getSessionId:(r,o)=>o.sessionId??o.sessionKey,allow:void 0,block:(r)=>VI(r),includeEvidenceOnError:()=>!0,cancelled:(r)=>r.abortSignal?.aborted===!0},t)}function HI(e,t,n,r){if(!e||typeof e!=="object")return Tt(null);let o=e.toolName;if(typeof o!=="string"||o.trim()==="")return Tt(null);if(o!==Cg)return;if(e.toolKind!==void 0)return;let i=e.params;if(!i||typeof i!=="object"||Array.isArray(i))return Tt(null,{toolName:o});let s=i,a=s.command;if(typeof a!=="string"||a.trim()==="")return Tt(null,{toolName:o});if(s.host!==void 0&&!BI.has(s.host))return Tt(null,{command:a,toolName:o});let l=jI(n,t.agentId);if(!l)return Tt(null,{command:a,toolName:o});let c=Ui(".",[l],r);if(!c)return Ml({directory:"session",problem:"unusable",cwd:l},{command:a,toolName:o});let u=s.workdir;if(u!==void 0&&(typeof u!=="string"||u.trim()===""))return Tt(c,{command:a,toolName:o});let f=typeof u==="string"?u:".",d=Ui(f,[c],r);if(!d)return Ml({directory:"requested",problem:ac(f,c,r),cwd:f},{command:a,toolName:o});return lc(o,s,{kind:"command",shell:"auto"},{configCwd:c,executionCwd:d},a)}function jI(e,t){if(typeof t!=="string"||t.trim()==="")return;try{let n=e.runtime.agent.resolveAgentWorkspaceDir(e.config,t);return typeof n==="string"&&n.trim()!==""?n:void 0}catch{return}}function VI(e){return{block:!0,blockReason:Gl(e)}}var w0={...Ll,register:bg};export{w0 as default};

package/dist/openclaw/cc-safety-net/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "cc-safety-net",
   "name": "CC Safety Net",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
-  "version": "2.6.5",
+  "version": "2.6.6",
   "activation": {
     "onStartup": true
   },

package/dist/openclaw/cc-safety-net/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.6.5",
+  "version": "2.6.6",
   "description": "Block destructive commands and secret-file access before OpenClaw runs a tool.",
   "type": "module",
   "openclaw": {

package/dist/pi/index.js

@@ -1,4 +1,4 @@
-import{Y,P,it,u}from"../chunks/index-t1vhmn90.js";import{re}from"../chunks/index-5ht7pdm3.js";import{j,de,Se}from"../chunks/index-6awd86n5.js";import"../chunks/index-x6wv93z4.js";var m="cc-safety-net",C="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",p="Help me with CC Safety Net.";function s(o){o.registerCommand(m,{description:C,handler:async(n,t)=>{o.sendUserMessage(c(n),t.isIdle()?void 0:{deliverAs:"followUp"})}})}function c(o){return`${re.slice(re.indexOf("# CC Safety Net")).trimEnd()}
+import{Y,P,it,u}from"../chunks/index-t1vhmn90.js";import{re}from"../chunks/index-5ht7pdm3.js";import{j,de,Se}from"../chunks/index-e1j1weef.js";import"../chunks/index-21maj91f.js";var m="cc-safety-net",C="Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",p="Help me with CC Safety Net.";function s(o){o.registerCommand(m,{description:C,handler:async(n,t)=>{o.sendUserMessage(c(n),t.isIdle()?void 0:{deliverAs:"followUp"})}})}function c(o){return`${re.slice(re.indexOf("# CC Safety Net")).trimEnd()}
 
 ## User request
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-safety-net",
-  "version": "2.6.5",
+  "version": "2.6.6",
   "description": "A coding agent CLI hook - block destructive commands and secret file access",
   "keywords": [
     "amp",
@@ -135,5 +135,5 @@
       "./dist/pi/index.js"
     ]
   },
-  "gitHead": "a6eef353356bf7cd740e0c25db7cd73bd1e00742"
+  "gitHead": "d718f4b3f7169fb3abf499c31d79b1453aa834f5"
 }