cc-safety-net 2.6.8 → 2.6.10

package/dist/chunks/index-0m5hdtv4.js

@@ -0,0 +1,2 @@
+import{ke,N,_,Y,c,Re,m,x,ie,fe,l,f}from"./index-szahvnh8.js";import{re}from"./index-5ht7pdm3.js";import{Ee,G}from"./index-nkbb32a2.js";import{join as T,resolve as w}from"node:path";function Oe(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:re.slice(re.indexOf("# CC Safety Net"))}}}var O=new Set(["powershell","pwsh"]),Ke="bash",we="shell";function pt(n={}){return async({directory:t,homeDir:i})=>{let e=w(t),o;return{config:async(a)=>{o=a;let s=Oe(),u=a.command??{};a.command={...s,...u}},"tool.execute.before":async(a,s)=>{Je({configCwd:e,homeDir:i,tool:a.tool,sessionID:a.sessionID,toolInput:s.args,route:k(a.tool,Ye(o?.shell)),guardDependencies:n})}}}}function Je({configCwd:n,homeDir:t,expandHomeWorkdir:i=!1,tool:e,sessionID:o,toolInput:a,route:s,guardDependencies:u={}}){let C=t===void 0?c():{...c(),home:t},d=(r,v,E=n)=>{Ee(C,r,()=>o,{agent:"opencode",toolName:v,cwd:E}),h(r)};if(typeof e!=="string"||e.trim()==="")d(N());let p;try{p=ie(a)}catch(r){if(!(r instanceof m))throw r;d(N({toolName:e}),e)}if(!fe(n)){d(_({directory:"session",problem:"unusable",cwd:n},{command:p,toolName:e}),e);return}let g=P(n,a,i?C.home:void 0);if(g===null){d(N({command:p,toolName:e}),e);return}if(typeof g!=="string"){d(_(g,{command:p,toolName:e}),e,g.cwd);return}let D=l(e,a,s,{configCwd:n,executionCwd:g},p??null);try{let r=G(C,D,{guard:{auditAllowed:Re(C.env),dependencies:u},audit:{agent:"opencode",getSessionId:()=>o}});y(r)}catch(r){if(!(r instanceof f))throw r;if(r.stage==="policy-protection"||r.stage==="config-load"||r.stage==="secret-protection")throw r.cause;y(r.evaluation);return}}function Ye(n,t=process.platform,i=process.env.SHELL){if(typeof n!=="string"&&t==="win32")return"powershell";let e=typeof n==="string"?n:i;if(typeof e!=="string")return"auto";let o=e.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(O.has(o))return"powershell";return o==="cmd"?"auto":"posix"}function k(n,t){if(n===Ke)return{kind:"command",shell:t};return{kind:x(n)}}function P(n,t,i){if(!t||typeof t!=="object"||Array.isArray(t))return n;if(!Object.hasOwn(t,"workdir"))return n;let e=t.workdir;if(typeof e!=="string"||e.trim()==="")return null;let o=process.platform==="win32"?A(e):e,a=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),s=i===void 0?o:o==="~"?i:a?T(i,o.slice(2)):o,u=w(n,s);return fe(u)?u:{directory:"requested",problem:"unusable",cwd:e}}function A(n){return n.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(i,e)=>`${e.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(i,e)=>`${e.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(i,e)=>`${e.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(i,e)=>`${e.toUpperCase()}:/`)}function y(n){let t=ke(n,{includeEvidence:!0});if(t)h(t)}function h(n){throw Error(Y(n))}
+export{Oe,Ke,we,pt,Je,Ye};

package/dist/chunks/index-ba8pkj4y.js

@@ -0,0 +1,2 @@
+import{Y,x,bt,l}from"./index-szahvnh8.js";import{j,de,Ce}from"./index-ezd6m8rs.js";var Ze=new Map([["bash","posix"],["powershell","powershell"]]),u={agent:"pi",debugLabel:"pi tool_call",extract:(o,e,r)=>p(o,e,r),getSessionId:(o,e)=>e.sessionManager.getSessionId(),allow:void 0,block:(o)=>C(o),includeEvidenceOnError:(o)=>o.route.kind==="command"};function ft(o){o.on("tool_call",s)}var s=m();function m(o={}){return Ce(u,o)}function p(o,e,r){if(!o||typeof o!=="object")return;let n=o;if(n.type!==void 0&&n.type!=="tool_call")return;if(typeof n.toolName!=="string"||n.toolName.trim()==="")return i(e);if(typeof e.cwd!=="string"||e.cwd.trim()==="")return i(e,n.toolName);let t=bt(".",[e.cwd],r);if(!t)return de({directory:"session",problem:"unusable",cwd:e.cwd},{toolName:n.toolName});let a=Ze.get(n.toolName);if(!n.input||typeof n.input!=="object")return a?i(e,n.toolName):void 0;if(!a)return l(n.toolName,n.input,{kind:x(n.toolName)},{configCwd:t,executionCwd:t},null);let d=n.input.command;if(typeof d!=="string"||d.trim()==="")return i(e,n.toolName);return l(n.toolName,n.input,{kind:"command",shell:a},{configCwd:t,executionCwd:t},d)}function i(o,e){return j(typeof o.cwd==="string"&&o.cwd.trim()?o.cwd:null,{toolName:e})}function C(o){return{block:!0,reason:Y(o)}}
+export{Ze,ft};

package/dist/chunks/index-ezd6m8rs.js

@@ -0,0 +1,2 @@
+import{ke,N,_,ht,c,n,Re,S,f}from"./index-szahvnh8.js";import{Ee,G}from"./index-nkbb32a2.js";function j(t,o={}){return{malformed:!0,denial:N(o),cwd:t}}function de(t,o){return{malformed:!0,denial:_(t,o),cwd:t.cwd}}function Ce(t,o={}){return(e,i)=>{try{return m(e,i,t,o)}catch(a){return console.error("CC Safety Net error:",a),t.block(N())}}}function m(t,o,e,i){let a=c();if(e.cancelled?.(o))return e.block(N());let l=e.extract(t,o,a.paths);if(!l)return e.allow;let d=()=>e.getSessionId(t,o);if("malformed"in l)return Ee(a,l.denial,d,{agent:e.agent,toolName:l.denial.toolName,cwd:l.cwd}),e.block(l.denial);let u=(r,p)=>{let s=ke(r,{includeEvidence:p});return s?e.block(s):e.allow};try{let r=G(a,l,{guard:{auditAllowed:Re(a.env),policyOptions:i.policyOptions,dependencies:i.guardDependencies},audit:{agent:e.agent,getSessionId:d}});return u(r,!0)}catch(r){if(!(r instanceof f))throw r;if(S(n.debug,a.env))console.error(`CC Safety Net debug: ${e.debugLabel} analysis failed: ${ht(r.cause)}`);return u(r.evaluation,e.includeEvidenceOnError(l))}}
+export{j,de,Ce};

package/dist/chunks/index-g4mrvgys.js

@@ -0,0 +1,2 @@
+import{Y,x,rt,l}from"./index-szahvnh8.js";import{j,de,Ce}from"./index-ezd6m8rs.js";import{resolve as f}from"node:path";var Xe=new Map([["bash","posix"],["pwsh","powershell"]]),g={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,i,r)=>w(e,i,r),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>Y(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function mt(e){let i=k();e.tools.guard((r)=>i(r,process.cwd()))}function k(e={}){return Ce(g,e)}function w(e,i,r){if(!e||typeof e!=="object")return j(null);let d=e,n=d.name;if(typeof n!=="string"||n.trim()==="")return j(null);let u=d.agent?.session.header.cwd??i,o=rt([u],r);if(!o)return de({directory:"session",problem:"unusable",cwd:u},{toolName:n});let t=d.arguments,c=Xe.get(n);if(!c)return l(n,t,{kind:x(n)},{configCwd:o,executionCwd:o},null);if(!t||typeof t!=="object"||Array.isArray(t))return j(o,{toolName:n});let p=t,a=p.command;if(typeof a!=="string"||a.trim()==="")return j(o,{toolName:n});let s=p.workdir;if(s!==void 0&&(typeof s!=="string"||s.trim()===""))return j(o,{command:a,toolName:n});let m=s===void 0?o:rt([f(o,s)],r);if(!m)return de({directory:"requested",problem:"unusable",cwd:s},{command:a,toolName:n});return l(n,t,{kind:"command",shell:c},{configCwd:o,executionCwd:m},a)}
+export{Xe,mt};

package/dist/chunks/{index-0d9zqgyg.js → index-nkbb32a2.js}

@@ -1,4 +1,4 @@
-import{a,s,J,f,Ie,l,Me,b,p,q}from"./index-j7c6979z.js";import{appendFileSync as ne,mkdirSync as re}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as F,readdirSync as P,readFileSync as j,rmdirSync as V,statSync as D,unlinkSync as B,utimesSync as X,writeFileSync as z}from"node:fs";import{join as m}from"node:path";function oe(t,e={}){return Me(l(t,e),t.home).policy.audit.retention_days}var A=86400000,Y=".last-prune",Z=/^\d{4}-\d{2}$/,Q=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,C=(t)=>Math.floor(t/A);function K(t,e,r=()=>new Date){try{let n=r().getTime();if(!D(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=m(e,Y),c=D(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&C(c)===C(n))return;let i=n-oe(t)*A,d=new Date(n).toISOString().slice(0,7);for(let u of v(e)){if(u.isDirectory()){W(m(e,u.name),i,d);continue}if(u.isFile()&&u.name.endsWith(".jsonl"))ee(m(e,u.name),i)}z(o,"",{mode:384}),X(o,n/1000,n/1000)}catch{}}function W(t,e,r){for(let n of v(t)){if(!n.isDirectory()||!Z.test(n.name))continue;let o=m(t,n.name);for(let c of v(o)){if(!c.isFile())continue;let i=Q.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(d)||d>=e)continue;O(m(o,c.name))}if(n.name!==r)L(o)}L(t)}function ee(t,e){try{let r=F(t);if(r.mtimeMs>=e)return;let n=j(t,"utf-8").split(`
-`).filter((o)=>o.trim()).map(te);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(F(t).mtimeMs!==r.mtimeMs)return;O(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return P(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function O(t){try{B(t)}catch{}}function L(t){try{V(t)}catch{}}var ae="2.6.8",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let u=U(t);if(!u)return;try{let y=(i.now??(()=>new Date))().toISOString(),_=g(J(r),i.failureStage?Number.POSITIVE_INFINITY:ce),N=g(J(n),de),h=i.toolName?g(J(i.toolName),ue):void 0,E=c===null?void 0:g(J(c),se),w=S(u,me(E?.value??null),y.slice(0,7));re(w,{recursive:!0,mode:448});let R=S(w,`${y.slice(0,10)}-${d}.jsonl`),H={ts:y,id:(i.createId??Ie)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:E?.value??null};ne(R,`${JSON.stringify(H)}
-`,{encoding:"utf-8",mode:384}),K(t,u,i.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function We(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function U(t){let e=We(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=T(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?T(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function T(t){return"command"in t?t.command??"":""}function x(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function we(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function G(t,e,r){try{let n=q(e,{environment:t,...r.guard});return M(t,e,n,r),n}catch(n){if(!(n instanceof p))throw n;throw M(t,e,n.evaluation,r,!(n.cause instanceof f),{stage:n.stage,errorCode:fe(n.cause)}),n}}function M(t,e,r,n,o=!0,c){x(t,k(e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function fe(t){if(t instanceof s)return a[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof b)return"structural-shell-syntax-limit";return"unexpected-error"}
-export{oe,K,We,U,we,G};
+import{a,s,J,m,Ne,u,Ge,b,f,q}from"./index-szahvnh8.js";import{appendFileSync as ne,mkdirSync as re}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as F,readdirSync as P,readFileSync as j,rmdirSync as V,statSync as D,unlinkSync as B,utimesSync as X,writeFileSync as z}from"node:fs";import{join as g}from"node:path";function oe(t,e={}){return Ge(u(t,e),t.home).policy.audit.retention_days}var A=86400000,Y=".last-prune",Z=/^\d{4}-\d{2}$/,Q=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,C=(t)=>Math.floor(t/A);function K(t,e,r=()=>new Date){try{let n=r().getTime();if(!D(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=g(e,Y),c=D(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&C(c)===C(n))return;let i=n-oe(t)*A,d=new Date(n).toISOString().slice(0,7);for(let l of v(e)){if(l.isDirectory()){W(g(e,l.name),i,d);continue}if(l.isFile()&&l.name.endsWith(".jsonl"))ee(g(e,l.name),i)}z(o,"",{mode:384}),X(o,n/1000,n/1000)}catch{}}function W(t,e,r){for(let n of v(t)){if(!n.isDirectory()||!Z.test(n.name))continue;let o=g(t,n.name);for(let c of v(o)){if(!c.isFile())continue;let i=Q.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(d)||d>=e)continue;O(g(o,c.name))}if(n.name!==r)L(o)}L(t)}function ee(t,e){try{let r=F(t);if(r.mtimeMs>=e)return;let n=j(t,"utf-8").split(`
+`).filter((o)=>o.trim()).map(te);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(F(t).mtimeMs!==r.mtimeMs)return;O(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return P(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function O(t){try{B(t)}catch{}}function L(t){try{V(t)}catch{}}var ae="2.6.10",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let l=U(t);if(!l)return;try{let y=(i.now??(()=>new Date))().toISOString(),_=p(J(r),i.failureStage?Number.POSITIVE_INFINITY:ce),N=p(J(n),de),h=i.toolName?p(J(i.toolName),ue):void 0,E=c===null?void 0:p(J(c),se),w=S(l,me(E?.value??null),y.slice(0,7));re(w,{recursive:!0,mode:448});let R=S(w,`${y.slice(0,10)}-${d}.jsonl`),H={ts:y,id:(i.createId??Ne)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:E?.value??null};ne(R,`${JSON.stringify(H)}
+`,{encoding:"utf-8",mode:384}),K(t,l,i.now)}catch{}}function p(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function Qe(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function U(t){let e=Qe(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=T(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?T(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function T(t){return"command"in t?t.command??"":""}function x(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function Ee(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function G(t,e,r){try{let n=q(e,{environment:t,...r.guard});return M(t,e,n,r),n}catch(n){if(!(n instanceof f))throw n;throw M(t,e,n.evaluation,r,!(n.cause instanceof m),{stage:n.stage,errorCode:fe(n.cause)}),n}}function M(t,e,r,n,o=!0,c){x(t,k(r.promotedInvocation??e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function fe(t){if(t instanceof s)return a[t.kind].errorCode;if(t instanceof m)return"tool-input-limit";if(t instanceof b)return"structural-shell-syntax-limit";return"unexpected-error"}
+export{oe,K,Qe,U,Ee,G};