cc-safety-net 2.6.8 → 2.6.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/amp/cc-safety-net/index.ts +44 -43
- package/dist/api.js +1 -1
- package/dist/bin/hook.js +43 -42
- package/dist/chunks/{index-j7c6979z.js → index-0kd1ygaw.js} +42 -41
- package/dist/chunks/{index-zwavdh1s.js → index-vnz6t1vd.js} +1 -1
- package/dist/chunks/{index-0d9zqgyg.js → index-xrc55d5p.js} +2 -2
- package/dist/cli.js +3 -3
- package/dist/deepseek-harness/index.js +1 -1
- package/dist/index.js +1 -1
- package/dist/openclaw/cc-safety-net/index.js +44 -43
- package/dist/openclaw/cc-safety-net/openclaw.plugin.json +1 -1
- package/dist/openclaw/cc-safety-net/package.json +1 -1
- package/dist/pi/index.js +1 -1
- package/package.json +2 -2
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{Ce,O,D,rt,c,n,Ee,v,p}from"./index-
|
|
1
|
+
import{Ce,O,D,rt,c,n,Ee,v,p}from"./index-0kd1ygaw.js";import{we,G}from"./index-xrc55d5p.js";function j(t,o={}){return{malformed:!0,denial:O(o),cwd:t}}function de(t,o){return{malformed:!0,denial:D(t,o),cwd:t.cwd}}function Se(t,o={}){return(e,i)=>{try{return g(e,i,t,o)}catch(a){return console.error("CC Safety Net error:",a),t.block(O())}}}function g(t,o,e,i){let a=c();if(e.cancelled?.(o))return e.block(O());let l=e.extract(t,o,a.paths);if(!l)return e.allow;let d=()=>e.getSessionId(t,o);if("malformed"in l)return we(a,l.denial,d,{agent:e.agent,toolName:l.denial.toolName,cwd:l.cwd}),e.block(l.denial);let u=(r,m)=>{let s=Ce(r,{includeEvidence:m});return s?e.block(s):e.allow};try{let r=G(a,l,{guard:{auditAllowed:Ee(a.env),policyOptions:i.policyOptions,dependencies:i.guardDependencies},audit:{agent:e.agent,getSessionId:d}});return u(r,!0)}catch(r){if(!(r instanceof p))throw r;if(v(n.debug,a.env))console.error(`CC Safety Net debug: ${e.debugLabel} analysis failed: ${rt(r.cause)}`);return u(r.evaluation,e.includeEvidenceOnError(l))}}
|
|
2
2
|
export{j,de,Se};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{a,s,J,f,Ie,l,Me,b,p,q}from"./index-
|
|
2
|
-
`).filter((o)=>o.trim()).map(te);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(F(t).mtimeMs!==r.mtimeMs)return;O(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return P(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function O(t){try{B(t)}catch{}}function L(t){try{V(t)}catch{}}var ae="2.6.
|
|
1
|
+
import{a,s,J,f,Ie,l,Me,b,p,q}from"./index-0kd1ygaw.js";import{appendFileSync as ne,mkdirSync as re}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as F,readdirSync as P,readFileSync as j,rmdirSync as V,statSync as D,unlinkSync as B,utimesSync as X,writeFileSync as z}from"node:fs";import{join as m}from"node:path";function oe(t,e={}){return Me(l(t,e),t.home).policy.audit.retention_days}var A=86400000,Y=".last-prune",Z=/^\d{4}-\d{2}$/,Q=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,C=(t)=>Math.floor(t/A);function K(t,e,r=()=>new Date){try{let n=r().getTime();if(!D(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=m(e,Y),c=D(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&C(c)===C(n))return;let i=n-oe(t)*A,d=new Date(n).toISOString().slice(0,7);for(let u of v(e)){if(u.isDirectory()){W(m(e,u.name),i,d);continue}if(u.isFile()&&u.name.endsWith(".jsonl"))ee(m(e,u.name),i)}z(o,"",{mode:384}),X(o,n/1000,n/1000)}catch{}}function W(t,e,r){for(let n of v(t)){if(!n.isDirectory()||!Z.test(n.name))continue;let o=m(t,n.name);for(let c of v(o)){if(!c.isFile())continue;let i=Q.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(d)||d>=e)continue;O(m(o,c.name))}if(n.name!==r)L(o)}L(t)}function ee(t,e){try{let r=F(t);if(r.mtimeMs>=e)return;let n=j(t,"utf-8").split(`
|
|
2
|
+
`).filter((o)=>o.trim()).map(te);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(F(t).mtimeMs!==r.mtimeMs)return;O(t)}catch{}}function te(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return P(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function O(t){try{B(t)}catch{}}function L(t){try{V(t)}catch{}}var ae="2.6.9",ce=1e4,de=2000,ue=256,se=32768;function le(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function me(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,r,n,o,c,i={}){let d=le(e);if(!d)return;let u=U(t);if(!u)return;try{let y=(i.now??(()=>new Date))().toISOString(),_=g(J(r),i.failureStage?Number.POSITIVE_INFINITY:ce),N=g(J(n),de),h=i.toolName?g(J(i.toolName),ue):void 0,E=c===null?void 0:g(J(c),se),w=S(u,me(E?.value??null),y.slice(0,7));re(w,{recursive:!0,mode:448});let R=S(w,`${y.slice(0,10)}-${d}.jsonl`),H={ts:y,id:(i.createId??Ie)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:h?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||h?.truncated||E?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:E?.value??null};ne(R,`${JSON.stringify(H)}
|
|
3
3
|
`,{encoding:"utf-8",mode:384}),K(t,u,i.now)}catch{}}function g(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function We(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function U(t){let e=We(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=T(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?T(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function T(t){return"command"in t?t.command??"":""}function x(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function we(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function G(t,e,r){try{let n=q(e,{environment:t,...r.guard});return M(t,e,n,r),n}catch(n){if(!(n instanceof p))throw n;throw M(t,e,n.evaluation,r,!(n.cause instanceof f),{stage:n.stage,errorCode:fe(n.cause)}),n}}function M(t,e,r,n,o=!0,c){x(t,k(e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function fe(t){if(t instanceof s)return a[t.kind].errorCode;if(t instanceof f)return"tool-input-limit";if(t instanceof b)return"structural-shell-syntax-limit";return"unexpected-error"}
|
|
4
4
|
export{oe,K,We,U,we,G};
|
package/dist/cli.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{a,s,Pe,Be,R,nt,ze,c,n,Ve,T,v,pe,ot,f,Ke,u,o,S,i,se,r,g,me,H,st,at,d,ge,he,ct,N,Z,ae,w,lt,_,h,ke,W,l,L,X,Je,Ye,M,C,I,ye,be,Ae,ut,m,e,Oe,Re,Ze,Xe,ce,Te,le,De,Q,B,Ne,xe,z,Qe,V,ee,te,ue,et,tt,E,F,Le,Fe,$e,k,je,_e,Ue,y,t,ne,ve,b,x,A,dt,Ge,He,p,q}from"./chunks/index-
|
|
1
|
+
import{a,s,Pe,Be,R,nt,ze,c,n,Ve,T,v,pe,ot,f,Ke,u,o,S,i,se,r,g,me,H,st,at,d,ge,he,ct,N,Z,ae,w,lt,_,h,ke,W,l,L,X,Je,Ye,M,C,I,ye,be,Ae,ut,m,e,Oe,Re,Ze,Xe,ce,Te,le,De,Q,B,Ne,xe,z,Qe,V,ee,te,ue,et,tt,E,F,Le,Fe,$e,k,je,_e,Ue,y,t,ne,ve,b,x,A,dt,Ge,He,p,q}from"./chunks/index-0kd1ygaw.js";import{oe,K,We,U,G}from"./chunks/index-xrc55d5p.js";var cp=["-h","--help"];function yn(P,O){let D=Object.entries(P.booleans??{}),j=Object.entries(P.values??{}),J=Object.entries(P.lists??{}),Y=Object.fromEntries(D.map(([Se])=>[Se,!1])),re={},ie=Object.fromEntries(J.map(([Se])=>[Se,[]])),de=[],fe=[],we=!1,Ce=-1;for(let[Se,Ie]of O.entries()){if(Se<=Ce)continue;if(Ie==="--"){de.push(...O.slice(Se+1));break}if(cp.includes(Ie)){we=!0;continue}let Ee=D.find(([,en])=>en.includes(Ie));if(Ee){Y[Ee[0]]=!0;continue}let qe=j.find(([,en])=>en.includes(Ie));if(qe){let en=O[Se+1];if(en===void 0||en.startsWith("-")){fe.push(`${Ie} requires a value`);continue}re[qe[0]]=en,Ce=Se+1;continue}let Me=J.find(([,en])=>en.includes(Ie));if(Me){let en=O.slice(Se+1),on=en.findIndex((an)=>an.startsWith("-")),sn=en.slice(0,on===-1?en.length:on);if(sn.length===0){fe.push(`${Ie} requires at least one value`);continue}ie[Me[0]]=[...ie[Me[0]]??[],...sn],Ce=Se+sn.length;continue}if(Ie.startsWith("-")){fe.push(`Unknown option for ${P.label}: ${Ie}`);continue}if(P.positionals==="tail"){de.push(...O.slice(Se));break}de.push(Ie)}if(P.positionals!=="list"&&P.positionals!=="tail")fe.push(...de.map((Se)=>`Unexpected argument for ${P.label}: ${Se}`));return{flags:Y,values:re,lists:ie,positionals:de,help:we,errors:fe}}function Dn(P){for(let O of P)console.error(O);return P.length>0}import{readdirSync as yp,statSync as Ps,unlinkSync as hp}from"node:fs";import{basename as Rs,dirname as vp,isAbsolute as bp,join as wp,relative as kp,resolve as xp,sep as Cp}from"node:path";var xs=(P)=>{let O=Date.now()-new Date(P).getTime();if(!Number.isFinite(O))return"";let D=Math.floor(O/60000),j=Math.floor(D/60),J=Math.floor(j/24);if(J>0)return`${J}d ago`;if(j>0)return`${j}h ago`;if(D>0)return`${D}m ago`;return"just now"},Ro=(P)=>{let O=(P??"").trim().split(/\s+/).filter((J)=>J&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(J)),D=O[0]?.split("/").pop();if(!D)return null;let j=O[1];return j&&/^[a-z][a-z0-9-]*$/.test(j)?`${D} ${j}`:D};function Cs(P){let O=(J)=>`${J.sessionId}
|
|
2
2
|
${Ro(J.segment||J.command)}`,D=P.filter((J)=>J.decision!=="allow"),j=D.filter((J)=>J.sessionId).reduce((J,Y)=>J.set(O(Y),(J.get(O(Y))??0)+1),new Map);return new Set(D.filter((J)=>J.failureStage||(j.get(O(J))??0)>=2))}import{existsSync as dp,readdirSync as up,readFileSync as pp}from"node:fs";import{join as fp}from"node:path";function Kn(P,O){try{return up(P,{withFileTypes:!0,encoding:"utf8"}).flatMap((D)=>{let j=fp(P,D.name);if(D.isDirectory())return Kn(j,O);if(D.name.endsWith(".jsonl"))return[j];return[]})}catch{if(O&&dp(P))O.count++;return[]}}var mp=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function gp(P){if(!P||typeof P!=="object"||Array.isArray(P))return!1;let O=P;if(typeof O.ts!=="string"||typeof O.command!=="string")return!1;return mp.every((D)=>O[D]===void 0||typeof O[D]==="string")}function kt(P,O){try{return pp(P,"utf-8").split(`
|
|
3
3
|
`).filter(Boolean).flatMap((D)=>{try{let j=JSON.parse(D);if(!gp(j)){if(O)O.count++;return[]}return[j]}catch{if(O)O.count++;return[]}})}catch{if(O)O.count++;return[]}}function hn(P){return Array.from(P,(O)=>{let D=O.charCodeAt(0);if(D<=31||D>=127&&D<=159)return`\\x${D.toString(16).padStart(2,"0")}`;return O}).join("")}function Sp(P,O){let D=oe(P),j=yn({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},O);if(Dn(j.errors))return null;if(j.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(j.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let J=j.values.limit===void 0?20:Ss(j.values.limit);if(J===null)return console.error("--limit must be a positive number"),null;let Y=j.values.since===void 0?Math.min(30,D):Ss(j.values.since);if(Y===null||Y>D)return console.error(`--since must be a positive number of days no greater than ${D}`),null;let re={limit:J,limitExplicit:j.values.limit!==void 0,since:Y,sinceExplicit:j.values.since!==void 0,all:j.flags.all,json:j.flags.json,suspect:j.flags.suspect,pruneLegacy:j.flags.pruneLegacy,dryRun:j.flags.dryRun,id:j.values.id,agent:j.values.agent,rule:j.values.rule,session:j.values.session,project:j.values.project===void 0?void 0:xp(j.values.project)};if(re.id&&(re.agent!==void 0||re.rule!==void 0||re.session!==void 0||re.project!==void 0||re.suspect||re.sinceExplicit||re.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(re.pruneLegacy&&(re.id!==void 0||re.agent!==void 0||re.rule!==void 0||re.session!==void 0||re.project!==void 0||re.suspect||re.all||re.sinceExplicit||re.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(re.dryRun&&!re.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return re}async function Es(P,O,D={}){let j=Sp(P,O);if(!j)return 1;let J=D.logsDir??U(P);if(j.pruneLegacy)return Pp(J,j.json,j.dryRun);if(!J)return console.log(j.json?"[]":j.id?`No retained audit log entry found for id ${hn(j.id)}.`:"No audit log entries found."),0;K(P,J);let Y={count:0},re=Kn(J,Y).flatMap((Ce)=>kt(Ce,Y).map((Se)=>({entry:Se,file:Ce})));if(Y.count>0)console.error(`warning: ${Y.count} audit log ${Y.count===1?"source":"sources"} could not be read; these results are incomplete`);if(j.id)return Ap(re,j,D.timeZone);let ie=Date.now()-j.since*24*60*60*1000,de=re.filter((Ce)=>Tp(Ce,j,J,ie)),fe=j.suspect?Cs(de.map((Ce)=>Ce.entry)):null,we=(fe?de.filter((Ce)=>fe.has(Ce.entry)):de).sort((Ce,Se)=>Date.parse(Se.entry.ts)-Date.parse(Ce.entry.ts)).slice(0,j.limit);if(j.json)return console.log(JSON.stringify(we.map((Ce)=>Ce.entry),null,2)),0;if(we.length===0)return console.log("No audit log entries found."),0;for(let Ce of we)console.log(Op(Ce.entry,D.timeZone));return 0}function Pp(P,O,D){let j=P?Ep(P).map((ie)=>wp(P,ie)):[];if(D)return Rp(j,O);let J=[],Y=0,re=0;for(let ie of j){let de=Ps(ie,{throwIfNoEntry:!1})?.size??0,fe=_p(ie);if(fe){J.push(`${Rs(ie)}: ${fe}`);continue}Y++,re+=de}if(O)return console.log(JSON.stringify({removedFiles:Y,removedBytes:re,failedFiles:J.length})),J.length===0?0:1;console.log(Y===0&&J.length===0?"No legacy audit log files found.":`Removed ${Y} legacy audit log ${Y===1?"file":"files"} (${_s(re)}).`);for(let ie of J)console.error(`Could not remove ${hn(ie)}`);if(console.log("Nested v2 audit logs were not changed."),Y>0)console.log("This deletion cannot be undone.");return J.length===0?0:1}function Rp(P,O){let D=P.reduce((j,J)=>j+(Ps(J,{throwIfNoEntry:!1})?.size??0),0);if(O)return console.log(JSON.stringify({dryRun:!0,files:P.length,bytes:D})),0;if(console.log(P.length===0?"No legacy audit log files found.":`Would remove ${P.length} legacy audit log ${P.length===1?"file":"files"} (${_s(D)}).`),console.log("Nested v2 audit logs are not included."),P.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Ep(P){try{return yp(P,{withFileTypes:!0}).filter((O)=>O.isFile()&&O.name.endsWith(".jsonl")).map((O)=>O.name)}catch{return[]}}function _p(P){try{return hp(P),null}catch(O){return O instanceof Error?O.message:String(O)}}function _s(P){let O=["B","KiB","MiB","GiB"],D=Math.min(Math.floor(Math.log2(Math.max(P,1))/10),O.length-1);return`${Math.round(P/1024**D*10)/10} ${O[D]}`}function Ap(P,O,D){let j=P.filter((Y)=>Y.entry.id===O.id);if(j.length>1)return console.error(`Multiple audit log entries found for id ${hn(O.id??"")}.`),1;if(O.json)return console.log(JSON.stringify(j.map((Y)=>Y.entry),null,2)),0;let J=j[0];if(!J)return console.log(`No retained audit log entry found for id ${hn(O.id??"")}.`),0;return console.log(Dp(J.entry,D)),0}function Tp(P,O,D,j){if(!O.all&&P.entry.decision==="allow")return!1;if(Date.parse(P.entry.ts)<j)return!1;if(O.agent!==void 0&&P.entry.agent!==O.agent)return!1;if(O.rule!==void 0&&P.entry.ruleId!==O.rule)return!1;if(O.session!==void 0&&!Ip(P,D,O.session))return!1;if(O.project!==void 0&&!$p(P.entry.cwd,O.project))return!1;return!0}function Ip(P,O,D){if(P.entry.sessionId===D)return!0;return vp(P.file)===O&&Rs(P.file,".jsonl")===D}function $p(P,O){if(!P)return!1;let D=kp(O,P);return D!==".."&&!D.startsWith(`..${Cp}`)&&!bp(D)}function Op(P,O){let D=hn(P.id??"-"),j=hn(P.decision??"deny"),J=P.cwd?` [${hn(P.cwd)}]`:"",Y=P.segment||P.command,re=Y===P.command?"":"↳ ",ie=Y.length>50?`${Y.slice(0,50)}…`:Y;return`${D.padEnd(16)} ${hn(As(P.ts,O))} ${j.padEnd(5)} ${hn(P.agent??"-").padEnd(15)} ${hn(P.ruleId??"-").padEnd(20)} ${re}${hn(ie)}${J}`}function Dp(P,O){let D=(J)=>hn(J===void 0||J===null||J===""?"-":J),j=P.shape?`${P.agent??"-"} (shape: ${P.shape})`:P.agent??"-";return[`id: ${D(P.id)}`,`ts: ${D(As(P.ts,O))}`,`decision: ${D(P.decision)}`,`agent: ${D(j)}`,`level: ${D(P.level)}`,`tool: ${D(P.toolName)}`,`rule: ${D(P.ruleId)}`,`intent: ${D(P.intent)}`,`stage: ${D(P.failureStage)}`,`error: ${D(P.errorCode)}`,`session: ${D(P.sessionId)}`,`cwd: ${D(P.cwd)}`,`version: ${D(P.v)}`,`truncated: ${D(P.truncated===!0?"yes":void 0)}`,`reason: ${D(P.reason)}`,`command: ${D(P.command)}`,`segment: ${D(P.segment)}`].join(`
|
|
4
4
|
`)}function As(P,O){let D=new Date(P);if(Number.isNaN(D.getTime()))return P;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:O}).format(D)}function Ss(P){let O=Number(P);return Number.isFinite(O)&&O>0?O:null}var Ts={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var Is={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"']};var $s={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};var Eo=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],Os=["cursor-agent","--version"],mr=[{id:"antigravity-cli",displayName:"Antigravity CLI",doctorOrder:3,runtime:{order:1,flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:2,flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",doctorOrder:1,runtime:{order:2,displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{order:3,flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",doctorOrder:4,runtime:{order:3,flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{order:4,flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",doctorOrder:10,runtime:{order:8,flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{order:10,flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",doctorOrder:9,runtime:{order:7,flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{order:9,flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",doctorOrder:11,runtime:{order:9,flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{order:11,flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",doctorOrder:12,runtime:{order:10,flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{order:12,flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",doctorOrder:13,runtime:{order:11,flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{order:13,flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",doctorOrder:14,install:{order:14,flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",doctorOrder:15,install:{order:15,flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",doctorOrder:16,install:{order:16,flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",doctorOrder:5,runtime:{order:4,flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{order:5,flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",doctorOrder:6,install:{order:6,flag:"--deepseek-harness",artifactKind:"package",probeCommand:Eo}},{id:"devin",displayName:"Devin CLI",doctorOrder:7,runtime:{order:5,flags:["-dv","--devin"],description:"Run as Devin CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{order:7,flag:"--devin",artifactKind:"hook config",probeCommand:["devin","--version"]}},{id:"droid",displayName:"Factory Droid",doctorOrder:8,runtime:{order:6,flags:["-fd","--droid"],description:"Run as Factory Droid PreToolUse hook",legacyTopLevelFlags:[]},install:{order:8,flag:"--droid",artifactKind:"hook config",probeCommand:["droid","--version"]}},{id:"amp",displayName:"Amp Code",doctorOrder:2,install:{order:1,flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],gr=mr.slice().sort((P,O)=>P.doctorOrder-O.doctorOrder).map((P)=>P.id),Ht=mr.filter((P)=>("runtime"in P)).slice().sort((P,O)=>P.runtime.order-O.runtime.order).map((P)=>({id:P.id,displayName:"displayName"in P.runtime?P.runtime.displayName:P.displayName,flags:P.runtime.flags,legacyFlags:"legacyFlags"in P.runtime?P.runtime.legacyFlags:[],description:P.runtime.description,legacyTopLevelFlags:P.runtime.legacyTopLevelFlags})),En=mr.slice().sort((P,O)=>P.install.order-O.install.order).map((P)=>({id:P.id,...P.install})).map(({order:P,...O})=>O),Lp=Object.fromEntries(mr.map((P)=>[P.id,P.displayName]));function mn(P){return Lp[P]}var Np=Ht.map((P)=>({flags:P.flags.join(", "),description:P.description})),jp=Ht.flatMap((P)=>P.flags.map((O)=>`cc-safety-net hook ${O}`)),Ds={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Np,{flags:"-h, --help",description:"Show this help"}],examples:jp};var Ls={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...En.map((P)=>({flags:P.flag,description:`Install ${mn(P.id)} ${P.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...En.map((P)=>`cc-safety-net install ${P.flag}`)]},Ns={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...En.map((P)=>({flags:P.flag,description:`Uninstall ${mn(P.id)} ${P.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...En.map((P)=>`cc-safety-net uninstall ${P.flag}`)]},js={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var Fs={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var yr={name:"policy",description:"Check and apply project or user policy proposals",usage:"policy <subcommand>",subcommands:[{usage:"check <file>",description:"Validate a policy proposal and print its diff"},{usage:"apply <file>",description:"Apply a proposal after confirming in a terminal"}],options:[{flags:"-g, --global",description:"Use the user-scope policy instead of the project one"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net policy check proposal.json","cc-safety-net policy apply proposal.json","cc-safety-net policy apply proposal.json --global"]};var _o=[{flags:"--ref",argument:"<ref>",description:"Use a branch, tag, or commit"},{flags:"--only",argument:"<rulebook...>",description:"Add only these repository rulebooks"},{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"-h, --help",description:"Show this help"}],Ao=["cc-safety-net rule add project-rules","cc-safety-net rule add acme/safety-rules","cc-safety-net rule add acme/safety-rules --only aws gcloud","cc-safety-net rule add acme/safety-rules --ref v2 --only aws","cc-safety-net rule add --only terraform aws"],xt={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add [source] [--ref <ref>] [--only <rulebook...>]",description:"Add rulebook sources and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Re-fetch and vendor remote rulebooks"},{usage:"sync",description:"Deprecated: migrate lock and cache leftovers"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},..._o.slice(0,2),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk",...Ao,"cc-safety-net rule update","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var Hs={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var Ms={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var hr=[Hs,Ts,Fs,Is,xt,yr,Ls,js,Ns,Ds,$s,Ms];function Fp(P){return P.aliases??[]}function vr(P){let O=P.toLowerCase();return hr.find((D)=>D.name.toLowerCase()===O||Fp(D).some((j)=>j.toLowerCase()===O))}import{existsSync as xy}from"node:fs";import{basename as Hp}from"node:path";function br(P,O=7,D=U(P)){let j=Date.now()-O*24*60*60*1000,J=[],Y=new Set,re=0,ie,de,fe,we;if(D)K(P,D);let Ce={count:0},Se=D?Kn(D,Ce):[];for(let Ee of Se)for(let qe of kt(Ee,Ce)){if(qe.decision==="allow")continue;let Me=new Date(qe.ts).getTime();if(Me>=j){if(re++,Y.add(qe.sessionId??Hp(Ee,".jsonl")),de===void 0||Me<=de)ie=qe.ts,de=Me;if(we===void 0||Me>we)fe=qe.ts,we=Me;Mp(J,qe,Me)}}let Ie=J.map((Ee)=>({timestamp:Ee.ts,command:Ee.command,reason:Ee.reason,relativeTime:xs(new Date(Ee.ts))}));return{totalBlocked:re,sessionCount:Y.size,recentEntries:Ie,oldestEntry:ie,newestEntry:fe,unreadable:Ce.count}}function Mp(P,O,D){let j=P.findIndex((J)=>D>new Date(J.ts).getTime());if(j===-1){if(P.length<3)P.push(O);return}if(P.splice(j,0,O),P.length>3)P.pop()}import{dirname as Xp}from"node:path";import{dirname as Up,join as Gp,resolve as qp}from"node:path";var Bp="config.json";function wn(P,O,D,j){g(Vp(P),`${JSON.stringify(O,null,2)}
|
|
@@ -18,7 +18,7 @@ ${Ro(J.segment||J.command)}`,D=P.filter((J)=>J.decision!=="allow"),j=D.filter((J
|
|
|
18
18
|
`)}function xr(P){return Wn({rows:P})}function oa(P){let O=[];return O.push("System Info"),O.push(Cf(P)),O.join(`
|
|
19
19
|
`)}function Cf(P){let O=["Component","Version"],D=(Y)=>{if(Y===null)return nn.dim("not found");return Y},J=[{label:"cc-safety-net",value:P.version},...gr.map((Y)=>({label:mn(Y),value:P.versions[Y]??null})),{label:"Node.js",value:P.nodeVersion},{label:"npm",value:P.npmVersion},{label:"Bun",value:P.bunVersion},{label:"Platform",value:P.platform}].map((Y)=>[Y.label,D(Y.value)]);return Wn({headers:O,rows:J})}function ia(P){if(P.findings.length===0)return nn.green(`
|
|
20
20
|
No findings from inspected doctor facts.`);let O={error:P.findings.filter((Y)=>Y.severity==="error").length,warning:P.findings.filter((Y)=>Y.severity==="warning").length,info:P.findings.filter((Y)=>Y.severity==="info").length},D=["error","warning","info"].filter((Y)=>O[Y]>0).map((Y)=>`${O[Y]} ${Y}`),j=P.findings.length===1?"finding":"findings",J=`
|
|
21
|
-
${P.findings.length} ${j}: ${D.join(", ")}.`;if(O.error>0)return nn.red(J);if(O.warning>0)return nn.yellow(J);return nn.blue(J)}import{lstatSync as Sf}from"node:fs";import{dirname as Do}from"node:path";function Lo(P,O){try{let D=Sf(O);if(D.isSymbolicLink())return{kind:P,path:O,status:"unsafe",issues:["symlink"]};if(!D.isDirectory())return{kind:P,path:O,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:P,path:O,status:"unknown",issues:[]};let j=[...D.uid!==process.getuid()?["ownership"]:[],...(D.mode&18)!==0?["permissions"]:[]];return{kind:P,path:O,status:j.length>0?"unsafe":"safe",issues:j}}catch(D){if(typeof D==="object"&&D!==null&&"code"in D&&D.code==="ENOENT")return{kind:P,path:O,status:"not-applicable",issues:[]};return{kind:P,path:O,status:"unknown",issues:[]}}}function sa(P,O){let D=U(P);return{directories:[Lo("policy",Do(Do(O))),Lo("config",Do(O)),...D?[Lo("audit",D)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Pf}from"node:child_process";import{existsSync as aa}from"node:fs";import{delimiter as Rf,extname as Ef,join as _f}from"node:path";import{stripVTControlCharacters as la}from"node:util";var da="2.6.
|
|
21
|
+
${P.findings.length} ${j}: ${D.join(", ")}.`;if(O.error>0)return nn.red(J);if(O.warning>0)return nn.yellow(J);return nn.blue(J)}import{lstatSync as Sf}from"node:fs";import{dirname as Do}from"node:path";function Lo(P,O){try{let D=Sf(O);if(D.isSymbolicLink())return{kind:P,path:O,status:"unsafe",issues:["symlink"]};if(!D.isDirectory())return{kind:P,path:O,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:P,path:O,status:"unknown",issues:[]};let j=[...D.uid!==process.getuid()?["ownership"]:[],...(D.mode&18)!==0?["permissions"]:[]];return{kind:P,path:O,status:j.length>0?"unsafe":"safe",issues:j}}catch(D){if(typeof D==="object"&&D!==null&&"code"in D&&D.code==="ENOENT")return{kind:P,path:O,status:"not-applicable",issues:[]};return{kind:P,path:O,status:"unknown",issues:[]}}}function sa(P,O){let D=U(P);return{directories:[Lo("policy",Do(Do(O))),Lo("config",Do(O)),...D?[Lo("audit",D)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as Pf}from"node:child_process";import{existsSync as aa}from"node:fs";import{delimiter as Rf,extname as Ef,join as _f}from"node:path";import{stripVTControlCharacters as la}from"node:util";var da="2.6.9",Af=5000,Tf="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function pn(){return da}function No(P,O){let D=P[O];if(D)return D;let j=Object.keys(P).find((J)=>J.toLowerCase()===O.toLowerCase()&&!!P[J]);return j?P[j]:D}function If(P){return(No(P,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((O)=>O.length>0)}function $f(P,O){let D=Ef(P)?[P]:[...If(O).map((j)=>`${P}${j}`),P];if(P.includes("/")||P.includes("\\"))return D.find((j)=>aa(j))??P;return(No(O,"PATH")??"").split(Rf).flatMap((j)=>D.map((J)=>_f(j,J))).find((j)=>aa(j))??P}function ca(P){if(!/[\s"&|<>^]/.test(P))return P;return`"${P.replace(/"/g,'""')}"`}function zn(P,O){let[D,...j]=P,J=O[Tf]==="win32"?"win32":process.platform;if(!D||J!=="win32")return{cmd:D??"",args:j};let Y=$f(D,O);if(!/\.(?:bat|cmd)$/i.test(Y))return{cmd:Y,args:j};return{cmd:No(O,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",ca(Y),...j.map(ca)].join(" ")]}}var St=async(P,O=Af)=>{let D=await Of(P,{timeoutMs:O});if(D.code!==0)return null;return la(D.stdout).trim()||la(D.stderr).trim()||null};function Of(P,O){let[D,...j]=P;if(!D)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((J)=>{try{let Y=zn([D,...j],process.env),re=Pf(Y.cmd,Y.args,{stdio:["ignore","pipe","pipe"]}),ie=!1,de="",fe="";re.stdout.on("data",(Se)=>{de+=Se.toString()}),re.stderr.on("data",(Se)=>{fe+=Se.toString()});let we=(Se)=>{if(ie)return;ie=!0,clearTimeout(Ce),J(Se)},Ce=setTimeout(()=>{re.kill(),we({code:null,stdout:de,stderr:fe})},O.timeoutMs);re.on("close",(Se)=>{we({code:Se,stdout:de,stderr:fe})}),re.on("error",()=>{we({code:null,stdout:de,stderr:fe})})}catch{J({code:null,stdout:"",stderr:""})}})}function Cr(P){if(!P)return null;let O=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(P);if(O)return O[1]??null;let D=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(P);if(D)return D[1]??null;return P.split(`
|
|
22
22
|
`)[0]?.trim()||null}async function Sr(P,O=St,D=process.cwd()){let j=Promise.all(En.map(async(Ce)=>[Ce.id,Cr(await O([...Ce.probeCommand]))])),[J,Y,re,ie,de,fe,we]=await Promise.all([j,j.then(async(Ce)=>{let Se=Ce.find(([qe])=>qe==="opencode")?.[1];if(!Se?.startsWith("2.")||!P(Se))return null;let Ie=["--param",`location[directory]=${D}`],Ee=["opencode","api","integration.list",...Ie];return await O(Ee,30000),O(["opencode","api","plugin.list",...Ie],30000)}),O(["codex","plugin","list"],30000),O(["amp","plugins","list"],30000),O(["node","--version"]),O(["npm","--version"]),O(["bun","--version"])]);return{version:da,versions:Object.fromEntries(J),codexPluginListOutput:re,ampPluginListOutput:ie,openCodePluginListOutput:Y,nodeVersion:Cr(de),npmVersion:Cr(fe),bunVersion:Cr(we),platform:`${process.platform} ${process.arch}`}}function jo(P,O){if(O==="dev")return!1;let D=P.split(".").map(Number),j=O.split(".").map(Number),[J=0,Y=0,re=0]=D,[ie=0,de=0,fe=0]=j;if(J!==ie)return J>ie;if(Y!==de)return Y>de;return re>fe}async function Gn(){let P=pn(),O=new AbortController,D=setTimeout(()=>O.abort(),3000);try{let j=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:O.signal});if(!j.ok)return{currentVersion:P,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${j.status}`};let J=await j.json(),Y=jo(J.version,P);return{currentVersion:P,latestVersion:J.version,updateAvailable:Y}}catch(j){return{currentVersion:P,latestVersion:null,updateAvailable:!1,error:j instanceof Error?j.message:"Network error"}}finally{clearTimeout(D)}}import*as va from"node:readline";var ma=(P)=>`\x1B[${P}B`,Df=(P)=>`\x1B[${P}A`;var ua=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function Lf(P){return new Promise((O)=>setTimeout(O,P))}function Nf(P,O,D){if(!D)return O(P);if(D.aborted)return Promise.resolve();return new Promise((j,J)=>{let Y=()=>D.removeEventListener("abort",re),re=()=>{Y(),j()};D.addEventListener("abort",re,{once:!0}),O(P).then(()=>{Y(),j()},(ie)=>{Y(),J(ie)})})}function Pr(P){return Math.max(0,Math.min(1,P))}function Pt(P){return Math.max(0,Math.min(255,Math.round(P)))}function Fo(P){return P<=0.0031308?12.92*P:1.055*P**0.4166666666666667-0.055}function jf(P,O,D){let j=D*Math.PI/180,J=O*Math.cos(j),Y=O*Math.sin(j),re=(P+0.3963377774*J+0.2158037573*Y)**3,ie=(P-0.1055613458*J-0.0638541728*Y)**3,de=(P-0.0894841775*J-1.291485548*Y)**3;return{blue:Pt(Fo(Pr(-0.0041960863*re-0.7034186147*ie+1.707614701*de))*255),green:Pt(Fo(Pr(-1.2684380046*re+2.6097574011*ie-0.3413193965*de))*255),red:Pt(Fo(Pr(4.0767416621*re-3.3077115913*ie+0.2309699292*de))*255)}}function Ho(P,O){let D=(O*P*180/Math.PI%360+360)%360;return jf(0.72,0.15,D)}function ga(P,O=0.1){let D=Ho(O,P);return`\x1B[38;2;${D.red};${D.green};${D.blue}m`}function Ff(P,O){return{blue:Pt(P.blue+(255-P.blue)*O),green:Pt(P.green+(255-P.green)*O),red:Pt(P.red+(255-P.red)*O)}}function ya(P,O,D){let j=Math.imul(P+2654435769,2246822507)^Math.imul(O+3266489909,668265263)^Math.imul(D+374761393,2654435761),J=j^j>>>15,Y=Math.imul(J,739982445),re=Y^Y>>>12,ie=Math.imul(re,695872825);return((ie^ie>>>15)>>>0)/4294967296}function Hf(P,O,D){let j=Math.floor(ya(P,O,D)*ua.length);return ua[j]??"░"}function pa(P){let O=Pr(P);return O*O*O*(O*(O*6-15)+10)}function Mf(P){if(P.length===0)return"";let O=[],D=!1,j="";for(let J of P){let Y=`${J.red};${J.green};${J.blue}`;if(J.bold!==D)O.push(J.bold?"\x1B[1m":"\x1B[22m"),D=J.bold;if(Y!==j)O.push(`\x1B[38;2;${Y}m`),j=Y;O.push(J.character)}return`${O.join("")}\x1B[22m\x1B[39m`}function Uf(P,O,D,j,J){return P.map((Y,re)=>({...Ho(D,j+O+re/J),bold:!1,character:Y}))}function Gf(P,O,D,j,J,Y,re,ie){let de=Math.max(1,j*0.75),fe=Math.min(1,D/de),we=J*pa(fe),Ce=Math.max(0,(D-de)/Math.max(1,j-de)),Se=(1-pa(D/j))*ie*2,Ie=0.35*Math.max(0,1-Ce*2),Ee=fe>=1,qe=Math.min(P.length,Math.ceil(we+2+1));return P.slice(0,qe).map((Me,en)=>{let on=Ho(Y,re+O+en/ie+Se),sn=en+ya(O,en,7919)*2-1;if(sn>we+2)return{...on,bold:!1,character:" "};let an=we-sn,rn=0.8*Math.exp(-(an*an)/12.5),fn=Math.min(0.9,rn+Ie),On=!Ee&&sn>we-4;return{...Ff(on,fn),bold:fn>0.3,character:On?Hf(O,en,D):Me}})}function fa(P){return`\x1B[?2026h${P.map((O,D)=>`\x1B8${D>0?ma(D):""}${Mf(O)}`).join("")}\x1B[?2026l`}async function Mo(P,O={}){if(!P)return;let D=O.output??process.stdout,j=O.sleep??Lf,J=O.seed??0,Y=P.split(`
|
|
23
23
|
`).map((we)=>Array.from(we)),re=Math.max(...Y.map((we)=>we.length)),ie=12000*Y.filter((we)=>we.length>0).length/40,de=re>0?Math.max(1,Math.ceil(ie/16.666666666666668)):0,fe=de>0?ie/de:0;D.write(`\x1B[?25l${Y.length>1?`${`
|
|
24
24
|
`.repeat(Y.length-1)}${Df(Y.length-1)}`:""}\x1B7`);try{for(let we=1;we<=de;we+=1){if(O.signal?.aborted)break;D.write(fa(Y.map((Ce,Se)=>Gf(Ce,Se,we,de,re,0.1,J,3)))),await Nf(fe,j,O.signal)}}finally{if(D.write(fa(Y.map((we,Ce)=>Uf(we,Ce,0.1,J,3)))),D.write("\x1B8"),Y.length>1)D.write(ma(Y.length-1));D.write(`
|
|
@@ -223,7 +223,7 @@ def register(ctx):
|
|
|
223
223
|
`));return{path:J[0]??D??Tn(Ei(P),Ri[0]),alreadyInstalled:J.length>0}}function Ot(P){let O=[];for(let D of P.openCodeVersion?.startsWith("2.")?_i(P.environment):Ai(P.environment))if(fy(D))try{let j=my(D,"utf-8"),J=vn(j),Y=JSON.parse(J);if($i(Y)){let re=Ti(P.openCodePluginListOutput);if(re)return{platform:"opencode",status:"disabled",method:"opencode api plugin.list",configPath:D,errors:[...O,re]};return{platform:"opencode",status:"configured",method:"plugin array",configPath:D,errors:O.length>0?O:void 0}}}catch(j){O.push(`Failed to parse ${gy(D)}: ${j instanceof Error?j.message:String(j)}`)}return{platform:"opencode",status:"n/a",errors:O.length>0?O:void 0}}import{join as yc}from"node:path";function Oi(P){let O=P.env.get("PI_CODING_AGENT_DIR");return yc(O?Nn(O,P.home):yc(P.home,".pi","agent"),"settings.json")}function Di(P){if(typeof P!=="string")return!1;return P==="npm:cc-safety-net"||P.startsWith("npm:cc-safety-net@")}function hc(P){let O=Oi(P.environment),D=xn(O);if(D.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(D.kind==="missing")return{platform:"pi",status:"n/a"};let j=tn(D.value,"packages");if(!Array.isArray(j))return{platform:"pi",status:"n/a"};let J=j.find((ie)=>Di(typeof ie==="string"?ie:tn(ie,"source")));if(J===void 0)return{platform:"pi",status:"n/a"};let Y=tn(J,"extensions");if(Array.isArray(Y)&&Y.some((ie)=>typeof ie==="string"&&ie.startsWith("-")))return{platform:"pi",status:"disabled",method:"package config",configPath:O,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:O}}var yy={amp:Aa,"antigravity-cli":Ta,"claude-code":Oa,codex:La,"copilot-cli":Za,cursor:sl,"deepseek-harness":ll,devin:yl,droid:Pl,"gemini-cli":Rl,"grok-build":Ll,"hermes-agent":Kl,"kimi-code":Yt,openclaw:sc,opencode:Ot,pi:hc};function Dt(P,O,D){let j={...D,cwd:O,environment:P};return gr.map((J)=>hy(yy[J](j)))}function hy(P){if(P.status==="not-inspected")return{platform:P.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:P.platform,detected:P.status!=="n/a",configured:P.status==="configured",inspectionStatus:P.status!=="n/a"?"verified":P.errors&&P.errors.length>0?"failed":"not-applicable",method:P.method,configPath:P.configPath,configPaths:P.configPaths,errors:P.errors}}import{join as vy}from"node:path";var by=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),wy=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),safety:Object.freeze({}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),ky={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function vc(P){let O=vy(P.tmpdir,"cc-safety-net-self-test"),D=by.map((j)=>{let J=G(P,u("self-test",{command:j.command},{kind:"command",shell:"auto"},{configCwd:O,executionCwd:O},j.command),{guard:{dependencies:{loadPolicySnapshot:()=>wy,getModes:()=>ky,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),Y=j.expectBlocked?"blocked":"allowed",re=J.decision.kind==="deny"?"blocked":"allowed";return{command:j.command,description:j.description,expected:Y,actual:re,passed:Y===re,reason:J.decision.kind==="deny"?J.decision.reason:void 0,ruleId:J.decision.kind==="deny"?J.decision.ruleId:void 0}});return{passed:D.filter((j)=>j.passed).length,failed:D.filter((j)=>!j.passed).length,total:D.length,results:D}}function Li(P){let O=yn({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},P);if(Dn(O.errors))return null;return{json:O.flags.json,skipUpdateCheck:O.flags.skipUpdateCheck}}async function bc(P,O={}){let D=await Ut(!O.json,()=>{let j=Cy(P,O);return{ready:j,finish:()=>j}},()=>Mt(),{loadingMessage:"Checking system status…"});if(O.json)console.log(JSON.stringify(D,null,2));else Sy(D);return D.engineSelfTest.failed>0||D.findings.some((j)=>j.severity==="error")?1:0}async function Cy(P,O){let D=O.cwd??process.cwd(),j=await Sr((Me)=>Ot({environment:P,cwd:D,openCodeVersion:Me}).status!=="n/a",void 0,D),J=Dt(P,D,{ampPluginListOutput:j.ampPluginListOutput,codexPluginListOutput:j.codexPluginListOutput,copilotCliVersion:j.versions["copilot-cli"],openCodeVersion:j.versions.opencode,openCodePluginListOutput:j.openCodePluginListOutput}),Y=Vs(P,D),re=Js(P),ie=k(P,{cwd:D}),de=ie.policy,fe=T(de,P.env),we=V(de,fe.capabilities),Ce=br(P,7),Se=Sa(P,D),Ie=[wr(D),Ct(P)].filter((Me)=>xy(Me)),Ee=O.skipUpdateCheck?{currentVersion:pn(),latestVersion:null,updateAvailable:!1}:await Gn(),qe={hooks:J,engineSelfTest:vc(P),userConfig:Y.userConfig,projectConfig:Y.projectConfig,configState:je(ie),effectiveRules:Y.effectiveRules,environment:re,effectiveSafety:{selectedPreset:de.safety.level??"standard",level:fe.effectiveLevel,capabilities:fe.capabilities,ruleOverrides:de.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(we).filter(([,Me])=>Me.source==="rule_override"&&Me.override==="off"&&Me.inheritedEnabled&&Me.changesInherited).map(([Me])=>Me),ruleCounts:{stored:Object.keys(de.destructiveCommandRuleOverrides).length,effective:Object.values(we).filter((Me)=>Me.changesInherited).length},...ie.policyScopes?{policyScopes:ie.policyScopes}:{}},...Se.length>0?{v2Leftovers:Se}:{},...Ie.length>0?{legacyConfigs:Ie}:{},posture:sa(P,Y.userConfig.path),activity:Ce,update:Ee,system:j};return{...qe,findings:Ws(qe)}}function Sy(P){console.log(),console.log(Ys(P.hooks)),console.log(),console.log(Zs(P.engineSelfTest)),console.log(),console.log(Xs(P)),console.log(),console.log(Qs(P.environment)),console.log(),console.log(ea(P)),console.log(),console.log(na(P.findings)),console.log(),console.log(ta(P.activity)),console.log(),console.log(oa(P.system)),console.log(),console.log(ra(P.update)),console.log(ia(P))}import{existsSync as Py}from"node:fs";var Ry=/^[A-Za-z0-9_@%+=:,./-]+$/,wc="Usage: cc-safety-net explain [--json] [--cwd <path>] <command>";function Ni(P){let O=yn({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"]},positionals:"tail"},P);if(Dn(O.errors))return console.error(wc),console.error("Pass -- before a command that starts with dashes."),null;if(O.values.cwd!==void 0&&!Py(O.values.cwd))return console.error(`Error: --cwd path does not exist: ${O.values.cwd}`),null;let D=O.positionals.length===1?O.positionals[0]:O.positionals.map((j)=>Ry.test(j)?j:`'${j.replaceAll("'","'\\''")}'`).join(" ");if(!D)return console.error("Error: No command provided"),console.error(wc),null;return{json:O.flags.json,cwd:O.values.cwd,command:D}}function kc(P){if(P)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function xc(P,O){let j=O-18;return[`${P.dtl}${P.dh.repeat(O)}${P.dtr}`,`${P.dv} Command Analysis${" ".repeat(j)}${P.dv}`,`${P.dbl}${P.dh.repeat(O)}${P.dbr}`]}function ji(P){return JSON.stringify(P)}function Cc(P,O=0){return`[${P.map((j,J)=>zs(j,J,O)).join(",")}]`}function er(P,O,D=70){let j=P.split(" "),J=[],Y="";for(let re of j)if(Y&&Y.length+re.length+1>D)J.push(Y),Y=re;else Y=Y?`${Y} ${re}`:re;if(Y)J.push(Y);return J.map((re,ie)=>ie===0?re:`${O}${re}`)}function Sc(P,O,D){let j=[];switch(P.type){case"parse":return null;case"env-strip":return j.push(""),j.push(`STEP ${O} ${D.h} Strip environment variables`),j.push(` Removed: ${P.envVars.map((J)=>`${J}=<redacted>`).join(", ")}`),j.push(` Tokens: ${ji(P.output)}`),{lines:j,incrementStep:!0};case"leading-tokens-stripped":return j.push(""),j.push(`STEP ${O} ${D.h} Strip wrappers`),j.push(` Removed: ${P.removed.join(", ")}`),j.push(` Tokens: ${ji(P.output)}`),{lines:j,incrementStep:!0};case"shell-wrapper":return j.push(""),j.push(`STEP ${O} ${D.h} Detect shell wrapper`),j.push(` Wrapper: ${P.wrapper} -c`),j.push(` Inner: ${P.innerCommand}`),{lines:j,incrementStep:!0};case"interpreter":{if(j.push(""),j.push(`STEP ${O} ${D.h} Detect interpreter`),j.push(` Interpreter: ${P.interpreter}`),j.push(` Code: ${P.codeArg}`),P.paranoidBlocked)j.push(" Result: ✗ BLOCKED (paranoid mode)");return{lines:j,incrementStep:!0}}case"busybox":return j.push(""),j.push(`STEP ${O} ${D.h} Busybox wrapper`),j.push(` Subcommand: ${P.subcommand}`),{lines:j,incrementStep:!0};case"transparent-wrapper":return j.push(""),j.push(`STEP ${O} ${D.h} Transparent wrapper`),j.push(` Wrapper: ${P.wrapper}`),j.push(` Tokens: ${ji(P.output)}`),{lines:j,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"rule-check":{if(j.push(""),j.push(`STEP ${O} ${D.h} Match rules`),j.push(` Rule: ${P.rule}()`),P.matched)j.push(" Result: MATCHED");else j.push(" Result: No match");return{lines:j,incrementStep:!0}}case"worktree-relaxation":return j.push(""),j.push(`STEP ${O} ${D.h} Worktree relaxation`),j.push(` Mode: ${n.worktree.name}`),j.push(` Git cwd: ${P.gitCwd}`),j.push(" Result: Allowed local discard in linked worktree"),{lines:j,incrementStep:!0};case"temp-root-relaxation":return j.push(""),j.push(`STEP ${O} ${D.h} Temp-root relaxation`),j.push(` Git cwd: ${P.gitCwd}`),j.push(" Result: Allowed git discard in a temp-root repository"),{lines:j,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(P.embeddedCommandFound)return j.push(""),j.push(`STEP ${O} ${D.h} Fallback scan`),j.push(` Found: ${P.embeddedCommandFound}`),{lines:j,incrementStep:!0};return null}case"custom-rules-check":{if(P.rulesChecked){if(j.push(""),j.push(`STEP ${O} ${D.h} Custom rules`),P.matched)j.push(" Result: MATCHED");else j.push(" Result: No match");return{lines:j,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(P.matched)return j.push(""),j.push(`STEP ${O} ${D.h} Dangerous text check`),j.push(` Token: ${P.token}`),j.push(" Result: MATCHED"),{lines:j,incrementStep:!0};return null}case"strict-unparseable":return j.push(""),j.push(`STEP ${O} ${D.h} Strict mode check`),j.push(` Command: ${P.rawCommand}`),j.push(" Result: ✗ UNPARSEABLE"),{lines:j,incrementStep:!0};case"segment-skipped":return null;case"error":return j.push(""),j.push(`ERROR: ${P.message}`),{lines:j,incrementStep:!1};default:return P}}function Fi(P,O){let D=kc(O?.asciiOnly??!1),j=58,J=[],Y=1;J.push(...xc(D,58)),J.push("");let re=P.trace.steps.find((Ee)=>Ee.type==="error");if(re&&re.type==="error"){J.push("ERROR"),J.push(` ${re.message}`),J.push(""),J.push("RESULT"),J.push(` Status: ${P.result==="blocked"?nn.red("BLOCKED"):nn.green("ALLOWED")}`),J.push(""),J.push("CONFIG");let Ee=P.configSource??"none";return J.push(` Path: ${Ee}`),J.join(`
|
|
224
224
|
`)}let ie=P.trace.steps.find((Ee)=>Ee.type==="parse");if(ie&&ie.type==="parse"){J.push("INPUT"),J.push(` ${ie.input}`),J.push(""),J.push(`STEP ${Y} ${D.h} Split shell commands`),Y++;for(let Ee=0;Ee<ie.segments.length;Ee++){let qe=ie.segments[Ee];if(qe){let Me=Math.random();J.push(` Segment ${Ee+1}: ${Cc(qe,Me)}`)}}}let de=P.trace.segments,fe=de.length>1;for(let Ee of de){if(fe){J.push("");let on="";if(ie&&ie.type==="parse"){let Po=ie.segments[Ee.index];if(Po)on=Po.join(" ")}let sn=54,an=on,rn=` Segment ${Ee.index+1}: `,fn=" ";if(on){if(rn.length+on.length+fn.length>sn){let lp=sn-rn.length-fn.length;an=`${on.substring(0,lp-1)}…`}}let On=on?`${rn}${an}${fn}`:` Segment ${Ee.index+1} `,sp=on?`${rn}${nn.cyan(an)}${fn}`:On,ws=58-On.length,ks=Math.floor(ws/2),ap=ws-ks;J.push(`${D.sh.repeat(ks)}${sp}${D.sh.repeat(ap)}`)}if(Ee.steps.find((on)=>on.type==="segment-skipped")){J.push(""),J.push(" (skipped — prior segment blocked)");continue}let Me=!1,en=!1;for(let on of Ee.steps){let sn=Sc(on,Y,D);if(sn){if(en=!0,on.type==="recurse"){J.push("");let an=" RECURSING ",rn=58-an.length-4;J.push(` ${D.tl}${D.h}${an}${D.h.repeat(rn)}`),J.push(` ${D.v}`),Me=!0;continue}for(let an of sn.lines)if(Me)J.push(` ${D.v} ${an}`);else J.push(an);if(sn.incrementStep)Y++}}if(Me)J.push(` ${D.v}`),J.push(` ${D.bl}${D.h.repeat(56)}`);if(!en)J.push(""),J.push(` ${nn.green("✓")} Allowed (no matching rules)`)}if(J.push(""),J.push("RESULT"),P.result==="blocked"){if(J.push(` Status: ${nn.red("BLOCKED")}`),P.customRule){if(J.push(` Rule: ${P.customRule.id}`),P.customRule.rulebook)J.push(` Rulebook: ${P.customRule.rulebook.name} ${P.customRule.rulebook.version}`);if(P.customRule.source)J.push(` Source: ${P.customRule.source}`);if(P.customRule.override)J.push(` Override: reason ${P.customRule.override.reason}`)}if(P.reason){let Ee=er(P.reason," ");J.push(` Reason: ${Ee[0]}`);for(let qe=1;qe<Ee.length;qe++)J.push(Ee[qe]??"")}}else J.push(` Status: ${nn.green("ALLOWED")}`);J.push(""),J.push("CONFIG");let we=P.configSource??"none",Ce=P.configValid?"":" (invalid)";J.push(` Path: ${we}${Ce}`);let Se=P.safetyPresetScope;J.push(` Safety preset: ${P.selectedPreset??"standard"}${Se?` (${kr(Se)})`:""}`),J.push(` Effective capabilities: ${P.effectiveLevel}`);let Ie=Object.entries(P.destructiveCommandRuleOverrides??{});if(J.push(` Rule customizations: ${Ie.length}`),P.ruleActivation)J.push(` Rule activation: ${P.ruleActivation.id} — ${P.ruleActivation.enabled?"on":"off"} via ${P.ruleActivation.source}`);return J.join(`
|
|
225
225
|
`)}function Hi(P){return JSON.stringify(P,null,2)}import{resolve as Iy}from"node:path";var Ey=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function Pc(P){let O=0,D={allocateSegment(){return O++},getNextSegmentIndex(){return O},recordGlobal(j){P.record({kind:"step",scope:"global",step:j})},recordSegment(j,J=D.currentSegmentIndex){if(J===void 0)return;P.record({kind:"step",scope:"segment",segmentIndex:J,step:j})}};return D}function Rc(P={}){let O=[],D=P.maxEvents??512,j={maxTextLength:P.maxTextLength??2048,maxListLength:P.maxListLength??128,maxObjectProperties:P.maxObjectProperties??P.maxListLength??128,maxDepth:P.maxDepth??16},J,Y=new Set;return{record(re){if(J)return;if(!re||O.length>=D)return;try{O.push(Gi(_y(re,j,Y)))}catch{}},finish(){if(J)return J;return J=Gi({events:Object.freeze(O)}),J}}}function _y(P,O,D){if(P.kind!=="step")throw TypeError("invalid trace event");let{scope:j,step:J}=P;no(J,D,O);let Y=Mi(J,O,D);if(j==="global")return{kind:"step",scope:"global",step:Y};if(j!=="segment")throw TypeError("invalid trace event scope");return{kind:"step",scope:"segment",segmentIndex:P.segmentIndex,step:Y}}function no(P,O,D,j=0,J=new WeakSet){if(typeof P==="string"){let ie=P.slice(0,D.maxTextLength);if(!ze(ie))return;for(let de of nt(ie))for(let fe of de.match(/[^\s"'()$]+/g)??[])O.add(Ec(fe));return}if(!P||typeof P!=="object"||j>=D.maxDepth||J.has(P))return;if(J.add(P),Array.isArray(P)){let ie=Math.min(P.length,D.maxListLength);for(let de=0;de<ie;de++)no(P[de],O,D,j+1,J);return}let Y=0,re=new Set;for(let ie in P){if(!Object.hasOwn(P,ie))continue;if(Y>=D.maxObjectProperties)break;Y++,no(ie,O,D);let de=Ui(ie,D,O);if(re.has(de))continue;re.add(de),no(P[ie],O,D,j+1,J)}}function Mi(P,O,D,j=0,J=new WeakSet){if(typeof P==="string")return Ui(P,O,D);if(!P||typeof P!=="object")return P;if(j>=O.maxDepth)return;if(J.has(P))return;if(J.add(P),Array.isArray(P)){let ie=[],de=Math.min(P.length,O.maxListLength);for(let fe=0;fe<de;fe++)ie.push(Mi(P[fe],O,D,j+1,J));return ie}let Y={},re=0;for(let ie in P){if(!Object.hasOwn(P,ie))continue;if(re>=O.maxObjectProperties)break;re++;let de=Ui(ie,O,D);if(Object.hasOwn(Y,de))continue;Object.defineProperty(Y,de,{value:Mi(P[ie],O,D,j+1,J),enumerable:!0,configurable:!0,writable:!0})}return Y}function Ui(P,O,D){let j=P.slice(0,O.maxTextLength),J=ze(j)?Be(j):j,Y=D.size>0?Ty(J,D):J;return(Ay(Y)?Pe(Y):Y).slice(0,O.maxTextLength)}function Ay(P){return P.includes("PRIVATE KEY")||P.includes("://")||P.includes("eyJ")||P.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(P)||P.length>=14&&Ey.some((O)=>P.includes(O))||P.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(P)}function Ty(P,O){return P.replace(/[^\s"'()$]+/g,(D)=>O.has(Ec(D))?"<redacted>":D)}function Ec(P){let O=2166136261,D=2166136261;for(let j=0;j<P.length;j++)O=Math.imul(O^P.charCodeAt(j),16777619),D=Math.imul(D^P.charCodeAt(P.length-j-1),16777619);return`${O>>>0}:${D>>>0}:${P.length}`}function Gi(P){if(P&&typeof P==="object"&&!Object.isFrozen(P)){for(let O of Object.values(P))Gi(O);Object.freeze(P)}return P}function nr(P,O={},D){let j=Iy(O.cwd??process.cwd()),J=O.policySnapshot??k(D,{cwd:j,userConfigDir:O.userConfigDir}),Y=T(J.policy,D.env),re=Ue({policySnapshot:J,effectiveCapabilities:Y.capabilities,strict:Y.strict,paranoidRm:Y.paranoidRm,paranoidInterpreters:Y.paranoidInterpreters,worktreeMode:Y.worktreeMode}),ie={effectiveLevel:re.effectiveLevel,selectedPreset:J.policy.safety.level??"standard",...J.policyScopes?{safetyPresetScope:J.policyScopes.levelScope}:{},effectiveCapabilities:re.effectiveCapabilities,destructiveCommandRuleOverrides:J.policy.destructiveCommandRuleOverrides},{configSource:de,configValid:fe}=Oy(D,{cwd:j,userConfigDir:O.userConfigDir});if(!P||!P.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:de,configValid:fe,...ie};let we=y(P,"auto");if(we.status==="limited")throw new b;let Ce=we.dialect==="powershell"?y(P,"posix"):we,Se=dt(Ce),Ie=Rc(),Ee=Pc(Ie);Ee.recordGlobal({type:"parse",input:P,segments:Se.map((On)=>[...On])});let qe=u("Bash",{command:P},{kind:"command",shell:"auto"},{configCwd:j,executionCwd:j},P),Me=q(qe,{environment:D,trace:Ee,dependencies:{loadPolicySnapshot:()=>J}}),en=Me.decision.kind==="deny"?Me.decision:null;if(en&&(Me.stage==="policy-protection"||Me.stage==="secret-protection"))return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:$y(en),matched:!0,reason:en.reason}]}]},result:"blocked",reason:R(en.reason),segment:R(_c(en,P)),ruleId:R(en.ruleId),configSource:de,configValid:fe,...ie};let on=Ee.getNextSegmentIndex();if(en&&on>0&&on<Se.length)Ee.recordSegment({type:"segment-skipped",index:on,reason:"prior-segment-blocked"},on);let sn=Ie.finish(),an=en?.ruleId??Dy(qe,J,Y,D),rn=z.find((On)=>On.id===an&&On.activationCapability),fn=rn?re.policy.effectiveDestructiveCommandRules[rn.id]:void 0;return{trace:Ny(sn),result:en?"blocked":"allowed",reason:en?R(en.reason):void 0,segment:en?R(_c(en,P)):void 0,ruleId:en?R(en.ruleId):void 0,customRule:Ly(jy(en?.ruleId,J)),configSource:de,configValid:fe,...ie,...rn&&fn?{ruleActivation:{id:rn.id,...fn}}:{}}}function _c(P,O){return P.evidence?.segment??O}function $y(P){if(P.reason===He)return"policy-protection:findPolicyConfigMutationTargetInSemanticFacts";if(P.reason===Ge)return"policy-apply-protection:findPolicyApplyInvocationInSemanticFacts";if(P.reason===x)return"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts";return"secret-protection:findSensitiveTargetInSemanticFacts"}function Oy(P,O){let D=_(O.cwd),j=W(P,O),J=X(P,{cwd:O.cwd,userConfigDir:O.userConfigDir});try{if(r(J.projectConfigTarget)!==null){if(Un(J.projectConfigTarget).errors.length===0)return{configSource:D,configValid:!0};return{configSource:D,configValid:!1}}}catch(Y){if(Y instanceof o)return{configSource:D,configValid:!1};throw Y}try{if(r(J.userConfigTarget)!==null){let Y=Un(J.userConfigTarget);return{configSource:j,configValid:Y.errors.length===0}}return{configSource:null,configValid:!0}}catch(Y){if(Y instanceof o)return{configSource:j,configValid:!1};throw Y}}function Dy(P,O,D,j){let J=O.policy,Y=_e({...J,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...J.destructiveCommandRuleOverrides,...Object.fromEntries(z.flatMap((ie)=>ie.activationCapability?[[ie.id,"on"]]:[]))}},O.state==="degraded"?{diagnostics:O.diagnostics,reason:O.reason}:void 0),re=q(P,{environment:j,dependencies:{loadPolicySnapshot:()=>Y,getModes:()=>({...D,strict:!0,paranoidRm:!0,paranoidInterpreters:!0}),findSensitiveTarget:()=>null}});return re.decision.kind==="deny"?re.decision.ruleId:void 0}function Ly(P){if(!P)return;return{id:R(P.id),...P.rulebook?{rulebook:{name:R(P.rulebook.name),version:R(P.rulebook.version)}}:{},...P.source?{source:R(P.source)}:{},...P.override?{override:{type:"reason",reason:R(P.override.reason)}}:{}}}function Ny(P){let O=P.events.flatMap((j)=>j.kind==="step"&&j.scope==="global"?[j.step]:[]),D=new Map;for(let j of P.events){if(j.kind!=="step"||j.scope!=="segment")continue;let J=D.get(j.segmentIndex)??{index:j.segmentIndex,steps:[]};J.steps.push(j.step),D.set(j.segmentIndex,J)}return{steps:O,segments:[...D.values()]}}function jy(P,O){let D=P?.replace(/^custom\./,"");if(!D||!O.policy.rules.some((j)=>j.name===D))return;return O.ruleMetadata[D]??Object.freeze({id:D})}function Ac(P){return new Promise((O)=>{process.stdout.write(`${P}
|
|
226
|
-
`,()=>O())})}async function Tc(P,O){let D=Ni(O);if(!D)return 1;try{let j=nr(D.command,{cwd:D.cwd},P),J=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Ac(D.json?Hi(j):Fi(j,{asciiOnly:J})),0}catch(j){let J=Fy(j instanceof p?j.cause:j);if(J===void 0)throw j;if(D.json)return await Ac(JSON.stringify({error:J})),1;return console.error(J),1}}function Fy(P){if(P instanceof b)return P.message;if(P instanceof f)return P.message;if(P instanceof s&&a[P.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var Ic="2.6.
|
|
226
|
+
`,()=>O())})}async function Tc(P,O){let D=Ni(O);if(!D)return 1;try{let j=nr(D.command,{cwd:D.cwd},P),J=!!process.env.NO_COLOR||!process.stdout.isTTY;return await Ac(D.json?Hi(j):Fi(j,{asciiOnly:J})),0}catch(j){let J=Fy(j instanceof p?j.cause:j);if(J===void 0)throw j;if(D.json)return await Ac(JSON.stringify({error:J})),1;return console.error(J),1}}function Fy(P){if(P instanceof b)return P.message;if(P instanceof f)return P.message;if(P instanceof s&&a[P.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var Ic="2.6.9",_n=" ",ft="cc-safety-net";function $c(P){return P.argument?`${P.flags} ${P.argument}`:P.flags}function Hy(P){return Math.max(...P.map((O)=>$c(O).length))}function My(P){return Math.max(...P.map((O)=>O.usage.length))}function Uy(P){return Math.max(...P.map((O)=>`${ft} ${O.usage}`.length))}function Gy(P,O){let D=`${ft} ${P.usage}`;return`${_n}${D.padEnd(O+2)}${P.description}`}function In(P,O){return`${_n}${P.padEnd(Math.max(40,P.length+2))}${O}`}function Lt(P,O=console.log){let D=[];if(D.push(`${ft} ${P.name}`),D.push(""),D.push(`${_n}${P.description}`),D.push(""),D.push("USAGE:"),D.push(`${_n}${ft} ${P.usage}`),D.push(""),P.subcommands&&P.subcommands.length>0){D.push("SUBCOMMANDS:");let j=My(P.subcommands);for(let J of P.subcommands)D.push(`${_n}${J.usage.padEnd(j+2)}${J.description}`);D.push("")}if(P.options.length>0){D.push("OPTIONS:");let j=Hy(P.options);for(let J of P.options){let Y=$c(J),re=J.default?`${J.description} (default: ${J.default})`:J.description;D.push(`${_n}${Y.padEnd(j+2)}${re}`)}D.push("")}if(P.examples&&P.examples.length>0){D.push("EXAMPLES:");for(let j of P.examples)D.push(`${_n}${j}`)}O(D.join(`
|
|
227
227
|
`))}function qi(){let P=Uy(hr),O=[];O.push(`${ft} v${Ic}`),O.push(""),O.push("Blocks destructive commands and secret access."),O.push(""),O.push("COMMANDS:");for(let D of hr)O.push(Gy(D,P));O.push(""),O.push("GLOBAL OPTIONS:"),O.push(`${_n}-h, --help Show help (use with command for command-specific help)`),O.push(`${_n}-V, --version Show version`),O.push(""),O.push("HELP:"),O.push(`${_n}${ft} help <command> Show help for a specific command`),O.push(`${_n}${ft} <command> --help Show help for a specific command`),O.push(""),O.push("ENVIRONMENT VARIABLES:"),O.push(In(`${n.level.name}=standard|strict|paranoid`,"Set session safety level")),O.push(In(`${n.worktree.name}=1`,"Allow local git discards in linked worktrees")),O.push(In(`${n.debug.name}=1`,"Print diagnostic messages to stderr")),O.push(In(`${n.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),O.push(In(`${n.projectTightenOnly.name}=1`,"Ignore project policy settings that weaken the user policy")),O.push(In("CC_SAFETY_NET_HOME","Override rule config home directory")),O.push(""),O.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),O.push(In(`${n.strict.name}=1`,"Force safety.overrides.fail_closed on")),O.push(In(`${n.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),O.push(In(`${n.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),O.push(In(`${n.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),O.push(""),O.push("Documentation: https://ccsafetynet.com/docs"),console.log(O.join(`
|
|
228
228
|
`))}function Oc(){console.log(Ic)}function tr(P,O=console.log){let D=vr(P);if(!D)return!1;if(D.name.toLowerCase()!==P.toLowerCase())return!1;return Lt(D,O),!0}import{existsSync as co,readFileSync as Hd}from"node:fs";import{join as lo}from"node:path";import*as Bn from"node:readline";function qy(P){return P==="install"?"Install":"Uninstall"}function By(P){return P==="install"?"Installing":"Uninstalling"}function Vy(P){return P==="install"?"into":"from"}function Nc(P){return P?.available===!0}function Jy(P,O){let D=new Set(O);return P.filter((j)=>D.has(j.target)).map((j)=>j.target)}function Dc(P,O,D){if(P.every((j)=>!j.available))return O;return Array.from({length:P.length},(j,J)=>J+1).map((j)=>(O+j*D+P.length)%P.length).find((j)=>Nc(P[j]))}function Ky(P,O,D){if(D.ctrl&&D.name==="c")return"interrupt";if(D.name==="escape"||O==="q")return"abort";if(P==="install"&&(O==="u"||O==="U"))return"update";if(D.name==="up"||O==="k")return"up";if(D.name==="down"||O==="j")return"down";if(D.name==="space"||O===" ")return"toggle";if(D.name==="return"||D.name==="enter")return"confirm";return null}function Wy(P){return{cursor:P.findIndex((O)=>O.available),selected:[]}}function zy(P,O,D){if(D==="confirm"||D==="update"||D==="abort"||D==="interrupt")return{state:P,done:D};if(D==="up")return{state:{...P,cursor:Dc(O,P.cursor,-1)}};if(D==="down")return{state:{...P,cursor:Dc(O,P.cursor,1)}};let j=O[P.cursor];if(!Nc(j))return{state:P};let J=P.selected.includes(j.target)?P.selected.filter((Y)=>Y!==j.target):Jy(O,[...P.selected,j.target]);return{state:{...P,selected:J}}}var jc="◉",Fc="◯",Hc=">",Mc=" ";function Yy(P,O,D){return["",`${qy(P)} CC Safety Net ${Vy(P)}:`,"",...O.map((j,J)=>{let Y=D.selected.includes(j.target),re=J===D.cursor,ie=Y?jc:Fc,de=re?Hc:Mc,fe=j.available?"":` (${j.unavailableReason??"not installed"})`,we=`${ie} ${j.label}${fe}`,Ce=!j.available?nn.dim(we):Y?nn.green(we):re?nn.bold(we):we;return`${de} ${Ce}`}),"",P==="install"?"Space: select Enter: confirm u: update installed Up/Down: move q/Esc: cancel":O.some((j)=>j.available)?"Space: select Enter: confirm Up/Down: move q/Esc: cancel":`No selectable integrations found for ${P}. q/Esc: close`].join(`
|
|
229
229
|
`)}var Lc=["global-hook","plugin"];function Zy(P,O,D={}){let j=D.color!==!1?nn.bold:(Y)=>Y;return["","Install the Kimi Code integration as:","",...[`Global hook — ${O?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((Y,re)=>{let ie=re===P,de=`${ie?jc:Fc} ${Y}`;return`${ie?Hc:Mc} ${ie?j(de):de}`}),"","Enter: confirm Up/Down: move q/Esc: cancel"].join(`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import{Y,P,qe,u}from"../chunks/index-
|
|
1
|
+
import{Y,P,qe,u}from"../chunks/index-0kd1ygaw.js";import{j,de,Se}from"../chunks/index-vnz6t1vd.js";import"../chunks/index-xrc55d5p.js";import{resolve as g}from"node:path";var k=new Map([["bash","posix"],["pwsh","powershell"]]),w={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,i,r)=>T(e,i,r),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>Y(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function f(e){let i=C();e.tools.guard((r)=>i(r,process.cwd()))}function C(e={}){return Se(w,e)}function T(e,i,r){if(!e||typeof e!=="object")return j(null);let l=e,n=l.name;if(typeof n!=="string"||n.trim()==="")return j(null);let d=l.agent?.session.header.cwd??i,o=qe([d],r);if(!o)return de({directory:"session",problem:"unusable",cwd:d},{toolName:n});let t=l.arguments,c=k.get(n);if(!c)return u(n,t,{kind:P(n)},{configCwd:o,executionCwd:o},null);if(!t||typeof t!=="object"||Array.isArray(t))return j(o,{toolName:n});let p=t,a=p.command;if(typeof a!=="string"||a.trim()==="")return j(o,{toolName:n});let s=p.workdir;if(s!==void 0&&(typeof s!=="string"||s.trim()===""))return j(o,{command:a,toolName:n});let m=s===void 0?o:qe([g(o,s)],r);if(!m)return de({directory:"requested",problem:"unusable",cwd:s},{command:a,toolName:n});return u(n,t,{kind:"command",shell:c},{configCwd:o,executionCwd:m},a)}var v={name:"cc-safety-net",inject:["tools"],apply:f};export{v as default};
|
package/dist/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{Ce,O,D,Y,c,Ee,f,P,ie,fe,u,p}from"./chunks/index-j7c6979z.js";import{re}from"./chunks/index-5ht7pdm3.js";import{we,G}from"./chunks/index-0d9zqgyg.js";import{join as qc,resolve as _s}from"node:path";function vr(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:re.slice(re.indexOf("# CC Safety Net"))}}}var Jc=new Set(["powershell","pwsh"]);function As(e={}){return async({directory:t,homeDir:r})=>{let n=_s(t),o;return{config:async(s)=>{o=s;let a=vr(),l=s.command??{};s.command={...a,...l}},"tool.execute.before":async(s,a)=>{_n({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:Gc(s.tool,An(o?.shell)),guardDependencies:e})}}}}function _n({configCwd:e,homeDir:t,expandHomeWorkdir:r=!1,tool:n,sessionID:o,toolInput:s,route:a,guardDependencies:l={}}){let m=t===void 0?c():{...c(),home:t},i=(h,I,d=e)=>{we(m,h,()=>o,{agent:"opencode",toolName:I,cwd:d}),Fs(h)};if(typeof n!=="string"||n.trim()==="")i(O());let x;try{x=ie(s)}catch(h){if(!(h instanceof f))throw h;i(O({toolName:n}),n)}if(!fe(e)){i(D({directory:"session",problem:"unusable",cwd:e},{command:x,toolName:n}),n);return}let S=Kc(e,s,r?m.home:void 0);if(S===null){i(O({command:x,toolName:n}),n);return}if(typeof S!=="string"){i(D(S,{command:x,toolName:n}),n,S.cwd);return}let g=u(n,s,a,{configCwd:e,executionCwd:S},x??null);try{let h=G(m,g,{guard:{auditAllowed:Ee(m.env),dependencies:l},audit:{agent:"opencode",getSessionId:()=>o}});Rs(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Rs(h.evaluation);return}}function An(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(Jc.has(o))return"powershell";return o==="cmd"?"auto":"posix"}function Gc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:P(e)}}function Kc(e,t,r){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let n=t.workdir;if(typeof n!=="string"||n.trim()==="")return null;let o=process.platform==="win32"?zc(n):n,s=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),a=r===void 0?o:o==="~"?r:s?qc(r,o.slice(2)):o,l=_s(e,a);return fe(l)?l:{directory:"requested",problem:"unusable",cwd:n}}function zc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Rs(e){let t=Ce(e,{includeEvidence:!0});if(t)Fs(t)}function Fs(e){throw Error(Y(e))}import{execFile as Yf}from"node:child_process";var me=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Hc={pipe(){return me(this,arguments)}},qt=function(){function e(){}return e.prototype=Hc,e}();var C=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ue=(e)=>e;var Ps=(e)=>()=>e;var yt=Ps(void 0),Ds=yt;function nt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Tt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var Jt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Gt=new WeakSet;function Kt(e){return typeof e==="string"}function Fn(e){return typeof e==="number"}function Us(e){return typeof e==="symbol"}function Or(e){return Kt(e)||Fn(e)||Us(e)}function Et(e){return typeof e==="function"}function Pn(e){return e!==void 0}function Dn(e){return e!=null}function Ns(e){return!0}function Un(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function kr(e){return typeof e==="object"&&e!==null||Et(e)}var A=C(2,(e,t)=>kr(e)&&(t in e));function Ms(e){return e instanceof Error}var Q="~effect/interfaces/Hash",U=(e)=>{switch(typeof e){case"number":return Fr(e);case"bigint":return z(e.toString(10));case"boolean":return z(String(e));case"symbol":return z(String(e));case"string":return z(e);case"undefined":return z("undefined");case"function":case"object":if(e===null)return z("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return z("Invalid Date");return z(e.toISOString())}else if(e instanceof RegExp)return z(e.toString());else{if(Gt.has(e))return Rr(e);if(Mn.has(e))return Mn.get(e);let t=Xc(e,()=>{if(Wc(e))return e[Q]();else if(typeof e==="function")return Rr(e);else if(e instanceof DataView)return _r(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return _r(e);else if(e instanceof Map)return Zc(e);else if(e instanceof Set)return Yc(e);return Vc(e)});return Mn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Rr=(e)=>{if(!Nn.has(e))Nn.set(e,Fr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Nn.get(e)},le=C(2,(e,t)=>e*53^t),Ar=(e)=>e&3221225471|e>>>1&1073741824,Wc=(e)=>A(e,Q),Fr=(e)=>{if(e!==e)return z("NaN");if(e===1/0)return z("Infinity");if(e===-1/0)return z("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return Ar(t)},z=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return Ar(t)},$n=(e,t)=>{let r=12289;for(let n of t)r^=le(U(n),U(e[n]));return Ar(r)},Vc=(e)=>$n(e,Jt(e)),Bn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return Ar(n)},_r=Bn(6151,U),Zc=Bn(z("Map"),([e,t])=>le(U(e),U(t))),Yc=Bn(z("Set"),U),Nn=new WeakMap,Mn=new WeakMap,Ln=new WeakSet;function Xc(e,t){if(Ln.has(e))return z("[Circular]");Ln.add(e);let r=t();return Ln.delete(e),r}var ee="~effect/interfaces/Equal";function V(){if(arguments.length===1)return(e)=>st(e,arguments[0]);return st(arguments[0],arguments[1])}function st(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Gt.has(e)||Gt.has(t))return!1;return tu(e,t,eu)}function Qc(e,t,r){let n=jn.has(e),o=qn.has(t);if(n&&o)return!0;if(n||o)return!1;jn.add(e),qn.add(t);let s=r();return jn.delete(e),qn.delete(t),s}var jn=new WeakSet,qn=new WeakSet;function eu(e,t){if(U(e)!==U(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=$s(e),n=$s(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Qc(e,t,()=>{if(o)return e[ee](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return ru(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Ls(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Ls(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return su(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return iu(e,t)}return nu(e,t)})}function tu(e,t,r){let n=Pr.get(e);if(!n)n=new WeakMap,Pr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Pr.get(t);if(!s)s=new WeakMap,Pr.set(t,s);return s.set(e,o),o}var Pr=new WeakMap;function ru(e,t){for(let r=0;r<e.length;r++)if(!st(e[r],t[r]))return!1;return!0}function Ls(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function nu(e,t){let r=Jt(e),n=Jt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!st(e[o],t[o]))return!1;return!0}function ou(e,t){return function(n,o){let s=Array.from(o);for(let[a,l]of n){let m=!1;for(let i=0;i<s.length;i++){let[x,S]=s[i];if(e(a,x)&&t(l,S)){s[i]=s[s.length-1],s.pop(),m=!0;break}}if(!m)return!1}return!0}}var su=ou(st,st);function au(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let l=0;l<o.length;l++){let m=o[l];if(e(s,m)){o[l]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var iu=au(st),$s=(e)=>A(e,ee);var zt=Symbol.for("~effect/Redactable"),cu=(e)=>A(e,zt);function It(e){if(cu(e))return Jn(e);return e}function Jn(e){return e[zt](globalThis[vt]?.context??uu)}var vt="~effect/Fiber/currentFiber",Bs=new Map,uu={"~effect/Context":{},base:Bs,depth:0,mapUnsafe:Bs,pipe(){return me(this,arguments)}};function M(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let S=i?.constructor;return S&&S!==Object.prototype.constructor&&S.name?`${S.name}(${x})`:x},l=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function m(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return lu;n.add(i);let S;if(zt in i)S=m(Jn(i),x);else if(Array.isArray(i))S=!o||i.length<=1?`[${i.map((y)=>m(y,x)).join(",")}]`:`[
|
|
1
|
+
import{Ce,O,D,Y,c,Ee,f,P,ie,fe,u,p}from"./chunks/index-0kd1ygaw.js";import{re}from"./chunks/index-5ht7pdm3.js";import{we,G}from"./chunks/index-xrc55d5p.js";import{join as qc,resolve as _s}from"node:path";function vr(){return{"cc-safety-net":{description:"Operate CC Safety Net: explain blocks, rules, integrations, diagnostics",template:re.slice(re.indexOf("# CC Safety Net"))}}}var Jc=new Set(["powershell","pwsh"]);function As(e={}){return async({directory:t,homeDir:r})=>{let n=_s(t),o;return{config:async(s)=>{o=s;let a=vr(),l=s.command??{};s.command={...a,...l}},"tool.execute.before":async(s,a)=>{_n({configCwd:n,homeDir:r,tool:s.tool,sessionID:s.sessionID,toolInput:a.args,route:Gc(s.tool,An(o?.shell)),guardDependencies:e})}}}}function _n({configCwd:e,homeDir:t,expandHomeWorkdir:r=!1,tool:n,sessionID:o,toolInput:s,route:a,guardDependencies:l={}}){let m=t===void 0?c():{...c(),home:t},i=(h,I,d=e)=>{we(m,h,()=>o,{agent:"opencode",toolName:I,cwd:d}),Fs(h)};if(typeof n!=="string"||n.trim()==="")i(O());let x;try{x=ie(s)}catch(h){if(!(h instanceof f))throw h;i(O({toolName:n}),n)}if(!fe(e)){i(D({directory:"session",problem:"unusable",cwd:e},{command:x,toolName:n}),n);return}let S=Kc(e,s,r?m.home:void 0);if(S===null){i(O({command:x,toolName:n}),n);return}if(typeof S!=="string"){i(D(S,{command:x,toolName:n}),n,S.cwd);return}let g=u(n,s,a,{configCwd:e,executionCwd:S},x??null);try{let h=G(m,g,{guard:{auditAllowed:Ee(m.env),dependencies:l},audit:{agent:"opencode",getSessionId:()=>o}});Rs(h)}catch(h){if(!(h instanceof p))throw h;if(h.stage==="policy-protection"||h.stage==="config-load"||h.stage==="secret-protection")throw h.cause;Rs(h.evaluation);return}}function An(e,t=process.platform,r=process.env.SHELL){if(typeof e!=="string"&&t==="win32")return"powershell";let n=typeof e==="string"?e:r;if(typeof n!=="string")return"auto";let o=n.trim().split(/[\\/]/).at(-1)?.toLowerCase().replace(/\.exe$/,"");if(!o)return"auto";if(Jc.has(o))return"powershell";return o==="cmd"?"auto":"posix"}function Gc(e,t){if(e==="bash")return{kind:"command",shell:t};return{kind:P(e)}}function Kc(e,t,r){if(!t||typeof t!=="object"||Array.isArray(t))return e;if(!Object.hasOwn(t,"workdir"))return e;let n=t.workdir;if(typeof n!=="string"||n.trim()==="")return null;let o=process.platform==="win32"?zc(n):n,s=o.startsWith("~/")||process.platform==="win32"&&o.startsWith("~\\"),a=r===void 0?o:o==="~"?r:s?qc(r,o.slice(2)):o,l=_s(e,a);return fe(l)?l:{directory:"requested",problem:"unusable",cwd:n}}function zc(e){return e.replace(/^\/([a-zA-Z]):(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/cygdrive\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`).replace(/^\/mnt\/([a-zA-Z])(?:[\\/]|$)/,(r,n)=>`${n.toUpperCase()}:/`)}function Rs(e){let t=Ce(e,{includeEvidence:!0});if(t)Fs(t)}function Fs(e){throw Error(Y(e))}import{execFile as Yf}from"node:child_process";var me=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Hc={pipe(){return me(this,arguments)}},qt=function(){function e(){}return e.prototype=Hc,e}();var C=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var ue=(e)=>e;var Ps=(e)=>()=>e;var yt=Ps(void 0),Ds=yt;function nt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function Tt(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var Jt=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Gt=new WeakSet;function Kt(e){return typeof e==="string"}function Fn(e){return typeof e==="number"}function Us(e){return typeof e==="symbol"}function Or(e){return Kt(e)||Fn(e)||Us(e)}function Et(e){return typeof e==="function"}function Pn(e){return e!==void 0}function Dn(e){return e!=null}function Ns(e){return!0}function Un(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function kr(e){return typeof e==="object"&&e!==null||Et(e)}var A=C(2,(e,t)=>kr(e)&&(t in e));function Ms(e){return e instanceof Error}var Q="~effect/interfaces/Hash",U=(e)=>{switch(typeof e){case"number":return Fr(e);case"bigint":return z(e.toString(10));case"boolean":return z(String(e));case"symbol":return z(String(e));case"string":return z(e);case"undefined":return z("undefined");case"function":case"object":if(e===null)return z("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return z("Invalid Date");return z(e.toISOString())}else if(e instanceof RegExp)return z(e.toString());else{if(Gt.has(e))return Rr(e);if(Mn.has(e))return Mn.get(e);let t=Xc(e,()=>{if(Wc(e))return e[Q]();else if(typeof e==="function")return Rr(e);else if(e instanceof DataView)return _r(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return _r(e);else if(e instanceof Map)return Zc(e);else if(e instanceof Set)return Yc(e);return Vc(e)});return Mn.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Rr=(e)=>{if(!Nn.has(e))Nn.set(e,Fr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return Nn.get(e)},le=C(2,(e,t)=>e*53^t),Ar=(e)=>e&3221225471|e>>>1&1073741824,Wc=(e)=>A(e,Q),Fr=(e)=>{if(e!==e)return z("NaN");if(e===1/0)return z("Infinity");if(e===-1/0)return z("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return Ar(t)},z=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return Ar(t)},$n=(e,t)=>{let r=12289;for(let n of t)r^=le(U(n),U(e[n]));return Ar(r)},Vc=(e)=>$n(e,Jt(e)),Bn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return Ar(n)},_r=Bn(6151,U),Zc=Bn(z("Map"),([e,t])=>le(U(e),U(t))),Yc=Bn(z("Set"),U),Nn=new WeakMap,Mn=new WeakMap,Ln=new WeakSet;function Xc(e,t){if(Ln.has(e))return z("[Circular]");Ln.add(e);let r=t();return Ln.delete(e),r}var ee="~effect/interfaces/Equal";function V(){if(arguments.length===1)return(e)=>st(e,arguments[0]);return st(arguments[0],arguments[1])}function st(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Gt.has(e)||Gt.has(t))return!1;return tu(e,t,eu)}function Qc(e,t,r){let n=jn.has(e),o=qn.has(t);if(n&&o)return!0;if(n||o)return!1;jn.add(e),qn.add(t);let s=r();return jn.delete(e),qn.delete(t),s}var jn=new WeakSet,qn=new WeakSet;function eu(e,t){if(U(e)!==U(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=$s(e),n=$s(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Qc(e,t,()=>{if(o)return e[ee](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return ru(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return Ls(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return Ls(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return su(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return iu(e,t)}return nu(e,t)})}function tu(e,t,r){let n=Pr.get(e);if(!n)n=new WeakMap,Pr.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Pr.get(t);if(!s)s=new WeakMap,Pr.set(t,s);return s.set(e,o),o}var Pr=new WeakMap;function ru(e,t){for(let r=0;r<e.length;r++)if(!st(e[r],t[r]))return!1;return!0}function Ls(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function nu(e,t){let r=Jt(e),n=Jt(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!st(e[o],t[o]))return!1;return!0}function ou(e,t){return function(n,o){let s=Array.from(o);for(let[a,l]of n){let m=!1;for(let i=0;i<s.length;i++){let[x,S]=s[i];if(e(a,x)&&t(l,S)){s[i]=s[s.length-1],s.pop(),m=!0;break}}if(!m)return!1}return!0}}var su=ou(st,st);function au(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let l=0;l<o.length;l++){let m=o[l];if(e(s,m)){o[l]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var iu=au(st),$s=(e)=>A(e,ee);var zt=Symbol.for("~effect/Redactable"),cu=(e)=>A(e,zt);function It(e){if(cu(e))return Jn(e);return e}function Jn(e){return e[zt](globalThis[vt]?.context??uu)}var vt="~effect/Fiber/currentFiber",Bs=new Map,uu={"~effect/Context":{},base:Bs,depth:0,mapUnsafe:Bs,pipe(){return me(this,arguments)}};function M(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,x)=>{let S=i?.constructor;return S&&S!==Object.prototype.constructor&&S.name?`${S.name}(${x})`:x},l=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function m(i,x=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return lu;n.add(i);let S;if(zt in i)S=m(Jn(i),x);else if(Array.isArray(i))S=!o||i.length<=1?`[${i.map((y)=>m(y,x)).join(",")}]`:`[
|
|
2
2
|
${s(x+1)}${i.map((y)=>m(y,x+1)).join(`,
|
|
3
3
|
`+s(x+1))}
|
|
4
4
|
${s(x)}]`;else if(i instanceof Date)S=js(i);else if(!t?.ignoreToString&&A(i,"toString")&&typeof i.toString==="function"&&i.toString!==Object.prototype.toString&&i.toString!==Array.prototype.toString){let y=fu(i);S=i instanceof Error&&i.cause?`${y} (cause: ${m(i.cause,x)})`:y}else if(Symbol.iterator in i)S=`${i.constructor.name}(${m(Array.from(i),x)})`;else{let y=l(i);if(!o||y.length<=1){let g=`{${y.map((h)=>`${Ht(h)}:${m(i[h],x)}`).join(",")}}`;S=a(i,g)}else{let g=`{
|