cc-safety-net 2.7.1 → 2.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/amp/cc-safety-net/index.ts +49 -49
- package/dist/api.js +1 -1
- package/dist/bin/hook.js +44 -44
- package/dist/chunks/{index-5p131ry7.js → index-09qa5y78.js} +1 -1
- package/dist/chunks/{index-3vjdy9zd.js → index-38xbyz1h.js} +1 -1
- package/dist/chunks/index-3xe319mt.js +53 -0
- package/dist/chunks/{index-cvbsj3sd.js → index-7rakvb2n.js} +1 -1
- package/dist/chunks/{index-cv33hcr9.js → index-bn4xwa1w.js} +2 -2
- package/dist/chunks/{index-q82n8yca.js → index-s5gfmv1q.js} +1 -1
- package/dist/cli.js +3 -3
- package/dist/deepseek-harness/index.js +1 -1
- package/dist/index.js +1 -1
- package/dist/openclaw/cc-safety-net/index.js +45 -45
- package/dist/openclaw/cc-safety-net/openclaw.plugin.json +1 -1
- package/dist/openclaw/cc-safety-net/package.json +1 -1
- package/dist/pi/index.js +1 -1
- package/package.json +4 -2
- package/dist/chunks/index-rh1b7fd5.js +0 -53
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{ne,b,It,d}from"./index-
|
|
1
|
+
import{ne,b,It,d}from"./index-3xe319mt.js";import{X,Ne,be,Le}from"./index-38xbyz1h.js";var ct=new Map([["bash","posix"],["powershell","powershell"]]),u={agent:"pi",debugLabel:"pi tool_call",extract:(o,e,t)=>C(o,e,t),getSessionId:(o,e)=>e.sessionManager.getSessionId(),allow:void 0,block:(o)=>p(o),includeEvidenceOnError:(o)=>o.route.kind==="command"};function kt(o){o.on("tool_call",s)}var s=m();function m(o={}){return Le(u,o)}function C(o,e,t){if(!o||typeof o!=="object")return;let l=o;if(l.type!==void 0&&l.type!=="tool_call")return;if(typeof l.toolName!=="string"||l.toolName.trim()==="")return a(e);if(typeof e.cwd!=="string"||e.cwd.trim()==="")return Ne(null,{toolName:l.toolName});let n=It(".",[e.cwd],t);if(!n)return be({directory:"session",problem:"unusable",cwd:e.cwd},{toolName:l.toolName});let i=ct.get(l.toolName);if(!l.input||typeof l.input!=="object")return i?a(e,l.toolName):void 0;if(!i)return d(l.toolName,l.input,{kind:b(l.toolName)},{configCwd:n,executionCwd:n},null);let r=l.input.command;if(typeof r!=="string"||r.trim()==="")return a(e,l.toolName);return d(l.toolName,l.input,{kind:"command",shell:i},{configCwd:n,executionCwd:n},r)}function a(o,e){return X(typeof o.cwd==="string"&&o.cwd.trim()?o.cwd:null,{toolName:e})}function p(o){return{block:!0,reason:ne(o)}}
|
|
2
2
|
export{ct,kt};
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{l,a,ee,h,qe,p,et,E,H,g,G}from"./index-
|
|
2
|
-
`).filter((o)=>o.trim()).map(ne);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(D(t).mtimeMs!==r.mtimeMs)return;T(t)}catch{}}function ne(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return U(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function T(t){try{B(t)}catch{}}function O(t){try{V(t)}catch{}}var ae="2.7.
|
|
1
|
+
import{l,a,ee,h,qe,p,et,E,H,g,G}from"./index-3xe319mt.js";import{appendFileSync as re,mkdirSync as oe}from"node:fs";import{isAbsolute as ie,join as S}from"node:path";import{lstatSync as D,readdirSync as U,readFileSync as j,rmdirSync as V,statSync as C,unlinkSync as B,utimesSync as K,writeFileSync as X}from"node:fs";import{join as s}from"node:path";function ue(t,e={}){return et(p(t,e),t.home).policy.audit.retention_days}var A=86400000,Y=".last-prune",Z=/^\d{4}-\d{2}$/,J=/^((\d{4}-\d{2})-\d{2})-.+\.jsonl$/,L=(t)=>Math.floor(t/A);function Q(t,e,r=()=>new Date){try{let n=r().getTime();if(!C(e,{throwIfNoEntry:!1})?.isDirectory())return;let o=s(e,Y),c=C(o,{throwIfNoEntry:!1})?.mtimeMs;if(c!==void 0&&L(c)===L(n))return;let i=n-ue(t)*A,d=new Date(n).toISOString().slice(0,7);for(let u of v(e)){if(u.isDirectory()){q(s(e,u.name),i,d);continue}if(u.isFile()&&u.name.endsWith(".jsonl"))te(s(e,u.name),i)}X(o,"",{mode:384}),K(o,n/1000,n/1000)}catch{}}function q(t,e,r){for(let n of v(t)){if(!n.isDirectory()||!Z.test(n.name))continue;let o=s(t,n.name);for(let c of v(o)){if(!c.isFile())continue;let i=J.exec(c.name);if(!i||i[2]!==n.name)continue;let d=Date.parse(`${i[1]}T00:00:00.000Z`)+A;if(!Number.isFinite(d)||d>=e)continue;T(s(o,c.name))}if(n.name!==r)O(o)}O(t)}function te(t,e){try{let r=D(t);if(r.mtimeMs>=e)return;let n=j(t,"utf-8").split(`
|
|
2
|
+
`).filter((o)=>o.trim()).map(ne);if(n.length===0)return;if(n.some((o)=>o===void 0||o>=e))return;if(D(t).mtimeMs!==r.mtimeMs)return;T(t)}catch{}}function ne(t){try{let e=JSON.parse(t).ts,r=typeof e==="string"?Date.parse(e):Number.NaN;return Number.isFinite(r)?r:void 0}catch{return}}function v(t){try{return U(t,{withFileTypes:!0,encoding:"utf8"})}catch{return[]}}function T(t){try{B(t)}catch{}}function O(t){try{V(t)}catch{}}var ae="2.7.2",ce=1e4,de=2000,se=256,le=32768;function me(t){let e=t.trim();if(!e)return null;let r=e.replace(/[^A-Za-z0-9_.-]+/g,"_");if(r=r.replace(/^[._-]+|[._-]+$/g,"").slice(0,128),!r||r==="."||r==="..")return null;return r}function fe(t){return(t??"").replace(/[^A-Za-z0-9]/g,"-").slice(0,180)||"no-cwd"}function I(t,e,r,n,o,c,i={}){let d=me(e);if(!d)return;let u=W(t);if(!u)return;try{let f=(i.now??(()=>new Date))().toISOString(),_=m(ee(r),i.failureStage?Number.POSITIVE_INFINITY:ce),N=m(ee(n),de),w=i.toolName?m(ee(i.toolName),se):void 0,y=c===null?void 0:m(ee(c),le),F=S(u,fe(y?.value??null),f.slice(0,7));oe(F,{recursive:!0,mode:448});let R=S(F,`${f.slice(0,10)}-${d}.jsonl`),P={ts:f,id:(i.createId??qe)(),v:ae,sessionId:d,decision:i.decision??"deny",agent:i.agent,shape:i.shape,level:i.level,configFallback:i.configFallback,toolName:w?.value,command:_.value,segment:N.value,..._.truncated||N.truncated||w?.truncated||y?.truncated?{truncated:!0}:{},reason:o,ruleId:i.ruleId,intent:i.intent,failureStage:i.failureStage,errorCode:i.errorCode,cwd:y?.value??null};re(R,`${JSON.stringify(P)}
|
|
3
3
|
`,{encoding:"utf-8",mode:384}),Q(t,u,i.now)}catch{}}function m(t,e){return{value:t.slice(0,e),truncated:t.length>e}}function ut(t){let e=t.env.get("CC_SAFETY_NET_AUDIT_HOME");if(t.env.get("NODE_ENV")==="test"&&!e)return null;let r=e||t.home;return r&&ie(r)?r:null}function W(t){let e=ut(t);return e?S(e,".cc-safety-net","logs"):null}function k(t,e,r,n=!0,o){if(e.decision.kind==="allow"){if(!r||t.route.kind!=="command")return;let d=b(t);return{decision:"allow",command:d,segment:d,reason:"allowed",cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{}}}let c=e.decision.evidence,i=c?.command??(n?b(t):"");return{decision:"deny",command:i,segment:c?.segment??i,reason:e.decision.reason,cwd:t.context.executionCwd,toolName:t.toolName,level:e.level,...e.configFallback?{configFallback:!0}:{},ruleId:e.decision.ruleId,intent:e.decision.intent,failureStage:o?.stage,errorCode:o?.errorCode}}function b(t){return"command"in t?t.command??"":""}function x(t,e,r,n){if(!e)return;let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command,e.segment,e.reason,e.cwd,{decision:e.decision,agent:n.agent,shape:n.shape,level:e.level,configFallback:e.configFallback,toolName:e.toolName,ruleId:e.ruleId,intent:e.intent,failureStage:e.failureStage,errorCode:e.errorCode})}function Me(t,e,r,n){let o;try{o=r()}catch{return}if(typeof o!=="string"||!o.trim())return;I(t,o,e.command??"",e.segment??e.command??"",e.reason,n.cwd??null,{decision:"deny",agent:n.agent,shape:n.shape,toolName:n.toolName??e.toolName,ruleId:e.ruleId,intent:e.intent})}function z(t,e,r){try{let n=G(e,{environment:t,...r.guard});return M(t,e,n,r),n}catch(n){if(!(n instanceof g))throw n;throw M(t,e,n.evaluation,r,!(n.cause instanceof h),{stage:n.stage,errorCode:ge(n.cause)}),n}}function M(t,e,r,n,o=!0,c){x(t,k(r.promotedInvocation??e,r,n.guard?.auditAllowed??!1,o,c),n.audit.getSessionId,{agent:n.audit.agent,shape:n.audit.shape})}function ge(t){if(t instanceof a)return l[t.kind].errorCode;if(t instanceof h)return"tool-input-limit";if(t instanceof E)return"structural-shell-syntax-limit";if(t instanceof H)return"unparseable-command";return"unexpected-error"}
|
|
4
4
|
export{ue,Q,ut,W,Me,z};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{ne,c,b,mt,d,w}from"./index-
|
|
1
|
+
import{ne,c,b,mt,d,w}from"./index-3xe319mt.js";import{X,Ne,be,Le}from"./index-38xbyz1h.js";import{existsSync as S,lstatSync as x,readFileSync as H}from"node:fs";import{join as C}from"node:path";function v(e,t=(s)=>s){if(!S(e))return{kind:"missing"};try{return{kind:"ok",value:JSON.parse(t(H(e,"utf-8")))}}catch{return{kind:"unreadable"}}}function B(e,t){if(e==="~")return t;if(e.startsWith("~/")||e.startsWith("~\\"))return C(t,e.slice(2));return e}function u(e){try{return x(e)}catch{return}}function We(e,t){let s=u(t);if(!s)return{platform:e,status:"n/a",configPath:t};if(!s.isSymbolicLink()&&s.isDirectory())return;return{platform:e,status:"n/a",configPath:t,errors:[`${t} is a symlink or not a directory; move or remove it before installing`]}}function n(e,t){return typeof e==="object"&&e!==null?e[t]:void 0}import{readdirSync as P}from"node:fs";import{join as k,resolve as T}from"node:path";var h="cc-safety-net";function De(e){let t=e.env.get("DSH_HOME");return k(t?.trim()?T(B(t,e.home)):k(e.home,".dsh"),"profiles")}function D(e){let t=De(e),s=u(t)?.isDirectory()?P(t,{withFileTypes:!0}).filter((o)=>o.isDirectory()&&o.name!=="node_modules").map((o)=>{let r=k(t,o.name,"package.json");return{name:o.name,configPath:r,manifest:v(r)}}):[];return{installed:s.flatMap((o)=>{if(o.manifest.kind!=="ok")return[];let r=o.manifest.value;if(n(n(r,"dependencies"),h)===void 0)return[];let i=n(n(n(r,"dsh"),"profile"),"bundles");return[{name:o.name,configPath:o.configPath,enabled:Array.isArray(i)&&i.includes(h)}]}),unreadable:s.some((o)=>o.manifest.kind==="unreadable")}}function lt(e){return D(e).installed}function Rt(e){let t=D(e.environment),s=t.installed.filter((r)=>r.enabled),a=t.installed.filter((r)=>!r.enabled),o=a.map((r)=>`${h} is installed in the ${r.name} profile but its bundle is disabled`);if(s.length>0)return{platform:"deepseek-harness",status:"configured",method:"dsh bundle",configPaths:s.map((r)=>r.configPath),...o.length>0?{errors:o}:{}};if(a.length>0)return{platform:"deepseek-harness",status:"disabled",method:"dsh bundle",configPaths:a.map((r)=>r.configPath),errors:o};return t.unreadable?{platform:"deepseek-harness",status:"not-inspected"}:{platform:"deepseek-harness",status:"n/a"}}import{randomUUID as E}from"node:crypto";import{resolve as O}from"node:path";var ze=new Map([["bash","posix"],["pwsh","powershell"]]),j={agent:"deepseek-harness",debugLabel:"deepseek-harness tool guard",extract:(e,t,s)=>_(e,t,s),getSessionId:(e)=>e?.agent?.session.header.id,allow:void 0,block:(e)=>ne(e),includeEvidenceOnError:(e)=>e.route.kind==="command"};function Tt(e){let t=I();e.tools.guard((a)=>t(a,process.cwd()));let s=new Set;e.on("tools/post-execute",async(a,o,r)=>{let i=await r(),l=A(a,s);if(!l)return i;return{...i,additionalContexts:[l,...i.additionalContexts??[]]}})}function A(e,t){try{let s=e,a=s?.agent?.session.header,o=s?.name,i=s?.arguments?.command;if(!a||typeof o!=="string"||ze.has(o)||b(o)!=="unknown"||typeof i!=="string"||i.trim()==="")return;let l=JSON.stringify([a.id,o]);if(t.has(l))return;let p=c();if(w(p,{cwd:a.cwd??process.cwd()}).policy.commandTools.some((m)=>m.name===o))return;t.add(l);let f=De(p);return Object.freeze({id:E(),role:"user",content:Object.freeze([Object.freeze({type:"text",text:`CC Safety Net did not check the command \`${o}\` just ran. It checks a plugin's shell tool only after the tool is declared. First find out where \`${o}\` runs its commands: check its tool description, and if that doesn't say, read its plugin's source under \`${f}/<profile>/node_modules\`. If it runs them on this machine, declare it with \`npx -y cc-safety-net rule tool add ${o}\`. Add \`--cwd-arg <name>\` if it takes its working directory in an argument other than \`workdir\`, \`cwd\` or \`working_directory\`. Don't test the declaration by running a destructive command; \`npx -y cc-safety-net rule tool list\` confirms it. If it runs them somewhere else, such as a remote host, or you can't tell, don't declare it. Either way, tell the user what you found and what you did.`})]),source:Object.freeze({kind:"cc-safety-net",form:"notice",summary:`${o} commands are not checked`})})}catch{return}}function I(e={}){return Le(j,e)}function _(e,t,s){if(!e||typeof e!=="object")return Ne(null);let a=e,o=a.agent?.session.header.cwd??t,r=mt([o],s),i=a.name;if(typeof i!=="string"||i.trim()==="")return X(r??null);if(!r)return be({directory:"session",problem:"unusable",cwd:o},{toolName:i});let l=a.arguments,p=ze.get(i);if(!p)return d(i,l,{kind:b(i)},{configCwd:r,executionCwd:r},null);if(!l||typeof l!=="object"||Array.isArray(l))return X(r,{toolName:i});let g=l,f=g.command;if(typeof f!=="string"||f.trim()==="")return X(r,{toolName:i});let m=g.workdir;if(m!==void 0&&(typeof m!=="string"||m.trim()===""))return X(r,{command:f,toolName:i});let y=m===void 0?r:mt([O(r,m)],s);if(!y)return be({directory:"requested",problem:"unusable",cwd:m},{command:f,toolName:i});return d(i,l,{kind:"command",shell:p},{configCwd:r,executionCwd:y},f)}
|
|
2
2
|
export{v,B,u,We,n,De,lt,Rt,ze,Tt};
|
package/dist/cli.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{l,a,Ve,dt,A,Pt,pt,c,r,ft,O,k,xe,At,h,je,b,gt,d,i,R,s,pe,o,x,we,q,Ot,Dt,m,Ce,Ee,Nt,j,re,fe,T,Lt,D,S,me,K,p,L,oe,ht,yt,U,P,M,ke,Re,Ke,ge,f,e,Je,Ue,Ye,Te,vt,bt,he,He,ye,Ze,ie,J,Xe,Pe,Y,xt,Z,se,ae,ve,St,wt,_,N,Qe,Ct,tt,w,nt,Ge,_e,C,t,ce,Ae,E,H,y,F,Mt,rt,ot,g,G}from"./chunks/index-
|
|
1
|
+
import{l,a,Ve,dt,A,Pt,pt,c,r,ft,O,k,xe,At,h,je,b,gt,d,i,R,s,pe,o,x,we,q,Ot,Dt,m,Ce,Ee,Nt,j,re,fe,T,Lt,D,S,me,K,p,L,oe,ht,yt,U,P,M,ke,Re,Ke,ge,f,e,Je,Ue,Ye,Te,vt,bt,he,He,ye,Ze,ie,J,Xe,Pe,Y,xt,Z,se,ae,ve,St,wt,_,N,Qe,Ct,tt,w,nt,Ge,_e,C,t,ce,Ae,E,H,y,F,Mt,rt,ot,g,G}from"./chunks/index-3xe319mt.js";import{ct}from"./chunks/index-7rakvb2n.js";import{it,Oe}from"./chunks/index-09qa5y78.js";import{v,B,u,We,n,De,lt,Rt,ze}from"./chunks/index-s5gfmv1q.js";import"./chunks/index-38xbyz1h.js";import{ue,Q,ut,W,z}from"./chunks/index-bn4xwa1w.js";var vf=["-h","--help"];function fn(I,V){let X=Object.entries(I.booleans??{}),ee=Object.entries(I.values??{}),ne=Object.entries(I.lists??{}),te=Object.fromEntries(X.map(([Le])=>[Le,!1])),le={},de=Object.fromEntries(ne.map(([Le])=>[Le,[]])),be=[],Se=[],Ie=!1,$e=-1;for(let[Le,Ne]of V.entries()){if(Le<=$e)continue;if(Ne==="--"){be.push(...V.slice(Le+1));break}if(vf.includes(Ne)){Ie=!0;continue}let Fe=X.find(([,tn])=>tn.includes(Ne));if(Fe){te[Fe[0]]=!0;continue}let Be=ee.find(([,tn])=>tn.includes(Ne));if(Be){let tn=V[Le+1];if(tn===void 0||tn.startsWith("-")){Se.push(`${Ne} requires a value`);continue}le[Be[0]]=tn,$e=Le+1;continue}let Me=ne.find(([,tn])=>tn.includes(Ne));if(Me){let tn=V.slice(Le+1),en=tn.findIndex((ln)=>ln.startsWith("-")),on=tn.slice(0,en===-1?tn.length:en);if(on.length===0){Se.push(`${Ne} requires at least one value`);continue}de[Me[0]]=[...de[Me[0]]??[],...on],$e=Le+on.length;continue}if(Ne.startsWith("-")){Se.push(`Unknown option for ${I.label}: ${Ne}`);continue}if(I.positionals==="tail"){be.push(...V.slice(Le));break}be.push(Ne)}if(I.positionals!=="list"&&I.positionals!=="tail")Se.push(...be.map((Le)=>`Unexpected argument for ${I.label}: ${Le}`));return{flags:te,values:le,lists:de,positionals:be,help:Ie,errors:Se}}function In(I){for(let V of I)console.error(V);return I.length>0}import{readdirSync as Sf,statSync as Qs,unlinkSync as Rf}from"node:fs";import{basename as ea,dirname as Ef,isAbsolute as Tf,join as Af,relative as _f,resolve as If,sep as Of}from"node:path";var Ys=(I)=>{let V=Date.now()-new Date(I).getTime();if(!Number.isFinite(V))return"";let X=Math.floor(V/60000),ee=Math.floor(X/60),ne=Math.floor(ee/24);if(ne>0)return`${ne}d ago`;if(ee>0)return`${ee}h ago`;if(X>0)return`${X}m ago`;return"just now"},Jo=(I)=>{let V=(I??"").trim().split(/\s+/).filter((ne)=>ne&&!/^[A-Za-z_][A-Za-z0-9_]*=/.test(ne)),X=V[0]?.split("/").pop();if(!X)return null;let ee=V[1];return ee&&/^[a-z][a-z0-9-]*$/.test(ee)?`${X} ${ee}`:X};function Zs(I){let V=(ne)=>`${ne.sessionId}
|
|
2
2
|
${Jo(ne.segment||ne.command)}`,X=I.filter((ne)=>ne.decision!=="allow"),ee=X.filter((ne)=>ne.sessionId).reduce((ne,te)=>ne.set(V(te),(ne.get(V(te))??0)+1),new Map);return new Set(X.filter((ne)=>ne.failureStage||(ee.get(V(ne))??0)>=2))}import{existsSync as bf,readdirSync as wf,readFileSync as kf}from"node:fs";import{join as Cf}from"node:path";function Jn(I,V){try{return wf(I,{withFileTypes:!0,encoding:"utf8"}).flatMap((X)=>{let ee=Cf(I,X.name);if(X.isDirectory())return Jn(ee,V);if(X.name.endsWith(".jsonl"))return[ee];return[]})}catch{if(V&&bf(I))V.count++;return[]}}var xf=["segment","reason","sessionId","decision","agent","ruleId","failureStage"];function Pf(I){if(!I||typeof I!=="object"||Array.isArray(I))return!1;let V=I;if(typeof V.ts!=="string"||typeof V.command!=="string")return!1;return xf.every((X)=>V[X]===void 0||typeof V[X]==="string")}function Ft(I,V){try{return kf(I,"utf-8").split(`
|
|
3
3
|
`).filter(Boolean).flatMap((X)=>{try{let ee=JSON.parse(X);if(!Pf(ee)){if(V)V.count++;return[]}return[ee]}catch{if(V)V.count++;return[]}})}catch{if(V)V.count++;return[]}}function mn(I){return Array.from(I,(V)=>{let X=V.charCodeAt(0);if(X<=31||X>=127&&X<=159)return`\\x${X.toString(16).padStart(2,"0")}`;return V}).join("")}function $f(I,V){let X=ue(I),ee=fn({label:"logs",booleans:{all:["--all"],suspect:["--suspect"],json:["--json"],pruneLegacy:["--prune-legacy"],dryRun:["--dry-run"]},values:{id:["--id"],limit:["--limit"],since:["--since"],agent:["--agent"],rule:["--rule"],session:["--session"],project:["--project"]}},V);if(In(ee.errors))return null;if(ee.values.id!==void 0&&!/^[a-f0-9]{16}$/.test(ee.values.id))return console.error("--id must be 16 hexadecimal characters"),null;let ne=ee.values.limit===void 0?20:Xs(ee.values.limit);if(ne===null)return console.error("--limit must be a positive number"),null;let te=ee.values.since===void 0?Math.min(30,X):Xs(ee.values.since);if(te===null||te>X)return console.error(`--since must be a positive number of days no greater than ${X}`),null;let le={limit:ne,limitExplicit:ee.values.limit!==void 0,since:te,sinceExplicit:ee.values.since!==void 0,all:ee.flags.all,json:ee.flags.json,suspect:ee.flags.suspect,pruneLegacy:ee.flags.pruneLegacy,dryRun:ee.flags.dryRun,id:ee.values.id,agent:ee.values.agent,rule:ee.values.rule,session:ee.values.session,project:ee.values.project===void 0?void 0:If(ee.values.project)};if(le.id&&(le.agent!==void 0||le.rule!==void 0||le.session!==void 0||le.project!==void 0||le.suspect||le.sinceExplicit||le.limitExplicit))return console.error("--id cannot be combined with --agent, --rule, --session, --project, --suspect, --since, or --limit"),null;if(le.pruneLegacy&&(le.id!==void 0||le.agent!==void 0||le.rule!==void 0||le.session!==void 0||le.project!==void 0||le.suspect||le.all||le.sinceExplicit||le.limitExplicit))return console.error("--prune-legacy cannot be combined with --id, --agent, --rule, --session, --project, --suspect, --all, --since, or --limit"),null;if(le.dryRun&&!le.pruneLegacy)return console.error("--dry-run requires --prune-legacy"),null;return le}async function na(I,V,X={}){let ee=$f(I,V);if(!ee)return 1;let ne=X.logsDir??W(I);if(ee.pruneLegacy)return Df(ne,ee.json,ee.dryRun);if(!ne)return console.log(ee.json?"[]":ee.id?`No retained audit log entry found for id ${mn(ee.id)}.`:"No audit log entries found."),0;Q(I,ne);let te={count:0},le=Jn(ne,te).flatMap(($e)=>Ft($e,te).map((Le)=>({entry:Le,file:$e})));if(te.count>0)console.error(`warning: ${te.count} audit log ${te.count===1?"source":"sources"} could not be read; these results are incomplete`);if(ee.id)return Ff(le,ee,X.timeZone);let de=Date.now()-ee.since*24*60*60*1000,be=le.filter(($e)=>Hf($e,ee,ne,de)),Se=ee.suspect?Zs(be.map(($e)=>$e.entry)):null,Ie=(Se?be.filter(($e)=>Se.has($e.entry)):be).sort(($e,Le)=>Date.parse(Le.entry.ts)-Date.parse($e.entry.ts)).slice(0,ee.limit);if(ee.json)return console.log(JSON.stringify(Ie.map(($e)=>$e.entry),null,2)),0;if(Ie.length===0)return console.log("No audit log entries found."),0;for(let $e of Ie)console.log(Bf($e.entry,X.timeZone));return 0}function Df(I,V,X){let ee=I?Lf(I).map((de)=>Af(I,de)):[];if(X)return Nf(ee,V);let ne=[],te=0,le=0;for(let de of ee){let be=Qs(de,{throwIfNoEntry:!1})?.size??0,Se=jf(de);if(Se){ne.push(`${ea(de)}: ${Se}`);continue}te++,le+=be}if(V)return console.log(JSON.stringify({removedFiles:te,removedBytes:le,failedFiles:ne.length})),ne.length===0?0:1;console.log(te===0&&ne.length===0?"No legacy audit log files found.":`Removed ${te} legacy audit log ${te===1?"file":"files"} (${ta(le)}).`);for(let de of ne)console.error(`Could not remove ${mn(de)}`);if(console.log("Nested v2 audit logs were not changed."),te>0)console.log("This deletion cannot be undone.");return ne.length===0?0:1}function Nf(I,V){let X=I.reduce((ee,ne)=>ee+(Qs(ne,{throwIfNoEntry:!1})?.size??0),0);if(V)return console.log(JSON.stringify({dryRun:!0,files:I.length,bytes:X})),0;if(console.log(I.length===0?"No legacy audit log files found.":`Would remove ${I.length} legacy audit log ${I.length===1?"file":"files"} (${ta(X)}).`),console.log("Nested v2 audit logs are not included."),I.length>0)console.log("Run the same command without --dry-run to delete them.");return 0}function Lf(I){try{return Sf(I,{withFileTypes:!0}).filter((V)=>V.isFile()&&V.name.endsWith(".jsonl")).map((V)=>V.name)}catch{return[]}}function jf(I){try{return Rf(I),null}catch(V){return V instanceof Error?V.message:String(V)}}function ta(I){let V=["B","KiB","MiB","GiB"],X=Math.min(Math.floor(Math.log2(Math.max(I,1))/10),V.length-1);return`${Math.round(I/1024**X*10)/10} ${V[X]}`}function Ff(I,V,X){let ee=I.filter((te)=>te.entry.id===V.id);if(ee.length>1)return console.error(`Multiple audit log entries found for id ${mn(V.id??"")}.`),1;if(V.json)return console.log(JSON.stringify(ee.map((te)=>te.entry),null,2)),0;let ne=ee[0];if(!ne)return console.log(`No retained audit log entry found for id ${mn(V.id??"")}.`),0;return console.log(Gf(ne.entry,X)),0}function Hf(I,V,X,ee){if(!V.all&&I.entry.decision==="allow")return!1;if(Date.parse(I.entry.ts)<ee)return!1;if(V.agent!==void 0&&I.entry.agent!==V.agent)return!1;if(V.rule!==void 0&&I.entry.ruleId!==V.rule)return!1;if(V.session!==void 0&&!Mf(I,X,V.session))return!1;if(V.project!==void 0&&!Uf(I.entry.cwd,V.project))return!1;return!0}function Mf(I,V,X){if(I.entry.sessionId===X)return!0;return Ef(I.file)===V&&ea(I.file,".jsonl")===X}function Uf(I,V){if(!I)return!1;let X=_f(V,I);return X!==".."&&!X.startsWith(`..${Of}`)&&!Tf(X)}function Bf(I,V){let X=mn(I.id??"-"),ee=mn(I.decision??"deny"),ne=I.cwd?` [${mn(I.cwd)}]`:"",te=I.segment||I.command,le=te===I.command?"":"↳ ",de=te.length>50?`${te.slice(0,50)}…`:te;return`${X.padEnd(16)} ${mn(ra(I.ts,V))} ${ee.padEnd(5)} ${mn(I.agent??"-").padEnd(15)} ${mn(I.ruleId??"-").padEnd(20)} ${le}${mn(de)}${ne}`}function Gf(I,V){let X=(ne)=>mn(ne===void 0||ne===null||ne===""?"-":ne),ee=I.shape?`${I.agent??"-"} (shape: ${I.shape})`:I.agent??"-";return[`id: ${X(I.id)}`,`ts: ${X(ra(I.ts,V))}`,`decision: ${X(I.decision)}`,`agent: ${X(ee)}`,`level: ${X(I.level)}`,`tool: ${X(I.toolName)}`,`rule: ${X(I.ruleId)}`,`intent: ${X(I.intent)}`,`stage: ${X(I.failureStage)}`,`error: ${X(I.errorCode)}`,`session: ${X(I.sessionId)}`,`cwd: ${X(I.cwd)}`,`version: ${X(I.v)}`,`truncated: ${X(I.truncated===!0?"yes":void 0)}`,`reason: ${X(I.reason)}`,`command: ${X(I.command)}`,`segment: ${X(I.segment)}`].join(`
|
|
4
4
|
`)}function ra(I,V){let X=new Date(I);if(Number.isNaN(X.getTime()))return I;return new Intl.DateTimeFormat("sv-SE",{year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",hourCycle:"h23",timeZone:V}).format(X)}function Xs(I){let V=Number(I);return Number.isFinite(V)&&V>0?V:null}var oa={name:"doctor",aliases:["--doctor"],description:"Run diagnostic checks to verify installation and configuration",usage:"doctor [options]",options:[{flags:"--json",description:"Output diagnostics as JSON"},{flags:"--skip-update-check",description:"Skip npm registry version check"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net doctor","cc-safety-net doctor --json","cc-safety-net doctor --skip-update-check"]};var ia={name:"explain",description:"Show step-by-step analysis trace of how a command would be analyzed",usage:"explain [options] <command>",argument:"<command>",options:[{flags:"--json",description:"Output analysis as JSON"},{flags:"--cwd",argument:"<path>",description:"Use custom working directory"},{flags:"--shell",argument:"<auto|posix|powershell>",description:"Parse the command as this shell (default: auto)"},{flags:"-h, --help",description:"Show this help"}],examples:['cc-safety-net explain "git reset --hard"','cc-safety-net explain --json "rm -rf /"','cc-safety-net explain --cwd /tmp "git status"',"cc-safety-net explain --shell posix 'rmdir /s /q d:\\'"]};var sa={name:"gui",description:"Open the local policy editor GUI",usage:"gui [options]",options:[{flags:"--no-open",description:"Print the URL without opening a browser"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net gui","cc-safety-net gui --no-open"]};var zo=["npx","--offline","--no-install","@deepseek-ai/dsh","--version"],aa=["cursor-agent","--version"],la=[{id:"antigravity-cli",displayName:"Antigravity CLI",runtime:{flags:["-ac","--agy-cli"],description:"Run as Antigravity CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--agy-cli",artifactKind:"hook config",probeCommand:["agy","--version"]}},{id:"claude-code",displayName:"Claude Code",runtime:{displayName:"Coding CLI",flags:["-cc","--coding-cli"],legacyFlags:["--claude-code"],description:"Run as Coding CLI PreToolUse hook",legacyTopLevelFlags:["-cc","--claude-code"]},install:{flag:"--claude-code",artifactKind:"plugin",probeCommand:["claude","--version"]}},{id:"codex",displayName:"Codex",runtime:{flags:["-cx","--codex"],description:"Run as a Codex PreToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--codex",artifactKind:"plugin",probeCommand:["codex","--version"]}},{id:"copilot-cli",displayName:"GitHub Copilot CLI",runtime:{flags:["-cp","--copilot-cli"],description:"Run as GitHub Copilot CLI PreToolUse hook",legacyTopLevelFlags:["-cp","--copilot-cli"]},install:{flag:"--copilot-cli",artifactKind:"plugin",probeCommand:["copilot","--binary-version"]}},{id:"gemini-cli",displayName:"Gemini CLI",runtime:{flags:["-gc","--gemini-cli"],description:"Run as Gemini CLI BeforeTool hook",legacyTopLevelFlags:["-gc","--gemini-cli"]},install:{flag:"--gemini-cli",artifactKind:"extension",probeCommand:["gemini","--version"]}},{id:"grok-build",displayName:"Grok Build",runtime:{flags:["-gb","--grok-build"],description:"Run as Grok Build PreToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--grok-build",artifactKind:"hook config",probeCommand:["grok","--version"]}},{id:"hermes-agent",displayName:"Hermes Agent",runtime:{flags:["-ha","--hermes-agent"],description:"Run as Hermes Agent pre_tool_call hook",legacyTopLevelFlags:[]},install:{flag:"--hermes-agent",artifactKind:"plugin",probeCommand:["hermes","--version"]}},{id:"kimi-code",displayName:"Kimi Code",runtime:{flags:["-kc","--kimi-code"],description:"Run as Kimi Code PreToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--kimi-code",artifactKind:"hook config",probeCommand:["kimi","--version"]}},{id:"openclaw",displayName:"OpenClaw",install:{flag:"--openclaw",artifactKind:"plugin",probeCommand:["openclaw","--version"]}},{id:"opencode",displayName:"OpenCode",install:{flag:"--opencode",artifactKind:"plugin",probeCommand:["opencode","--version"]}},{id:"pi",displayName:"Pi",install:{flag:"--pi",artifactKind:"package",probeCommand:["pi","--version"]}},{id:"cursor",displayName:"Cursor",runtime:{flags:["-cu","--cursor"],description:"Run as Cursor preToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--cursor",artifactKind:"hook config",probeCommand:["cursor","--version"]}},{id:"deepseek-harness",displayName:"DeepSeek Harness",install:{flag:"--deepseek-harness",artifactKind:"package",probeCommand:zo}},{id:"devin",displayName:"Devin CLI",runtime:{flags:["-dv","--devin"],description:"Run as Devin CLI PreToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--devin",artifactKind:"hook config",probeCommand:["devin","--version"]}},{id:"droid",displayName:"Factory Droid",runtime:{flags:["-fd","--droid"],description:"Run as Factory Droid PreToolUse hook",legacyTopLevelFlags:[]},install:{flag:"--droid",artifactKind:"hook config",probeCommand:["droid","--version"]}},{id:"amp",displayName:"Amp Code",install:{flag:"--amp",artifactKind:"plugin",probeCommand:["amp","--version"]}}],Wo=la.slice().sort((I,V)=>I.displayName.localeCompare(V.displayName,"en")),Or=Wo.map((I)=>I.id).sort((I,V)=>Number(V==="claude-code")-Number(I==="claude-code")),ir=Wo.filter((I)=>("runtime"in I)).map((I)=>({id:I.id,displayName:"displayName"in I.runtime?I.runtime.displayName:I.displayName,flags:I.runtime.flags,legacyFlags:"legacyFlags"in I.runtime?I.runtime.legacyFlags:[],description:I.runtime.description,legacyTopLevelFlags:I.runtime.legacyTopLevelFlags})),xn=Wo.map((I)=>({id:I.id,...I.install})),qf=Object.fromEntries(la.map((I)=>[I.id,I.displayName]));function cn(I){return qf[I]}var Vf=ir.map((I)=>({flags:I.flags.join(", "),description:I.description})),Kf=ir.flatMap((I)=>I.flags.map((V)=>`cc-safety-net hook ${V}`)),ca={name:"hook",description:"Run as an agent CLI hook (reads JSON from stdin)",usage:"hook INTEGRATION_FLAG",options:[...Vf,{flags:"-h, --help",description:"Show this help"}],examples:Kf};var da={name:"install",description:"Install CC Safety Net into a coding agent CLI",usage:"install [TARGET_FLAG]",options:[...xn.map((I)=>({flags:I.flag,description:`Install ${cn(I.id)} ${I.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net install",...xn.map((I)=>`cc-safety-net install ${I.flag}`)]},ua={name:"uninstall",description:"Uninstall CC Safety Net from a coding agent CLI",usage:"uninstall [TARGET_FLAG]",options:[...xn.map((I)=>({flags:I.flag,description:`Uninstall ${cn(I.id)} ${I.artifactKind}`})),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net uninstall",...xn.map((I)=>`cc-safety-net uninstall ${I.flag}`)]},pa={name:"update",description:"Update every installed CC Safety Net integration to the latest version",usage:"update",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net update"]};var fa={name:"logs",description:"Browse audit log entries recorded by hooks",usage:"logs [options]",options:[{flags:"--id",argument:"<id>",description:"Show one entry from retained history by its 16-character id (not guaranteed once it is older than the configured retention)"},{flags:"--limit",argument:"<n>",description:"Maximum entries to print",default:"20"},{flags:"--since",argument:"<days>",description:"Only include entries newer than this many days (max: the configured audit retention, 1-365)",default:"30"},{flags:"--agent",argument:"<name>",description:"Filter by agent name"},{flags:"--rule",argument:"<ruleId>",description:"Filter by rule id"},{flags:"--session",argument:"<id>",description:"Filter by session id"},{flags:"--project",argument:"<path>",description:"Filter by project path"},{flags:"--suspect",description:"Only denials that look like false positives"},{flags:"--all",description:"Include allow entries"},{flags:"--prune-legacy",description:"Permanently delete all legacy root-level logs; nested logs are untouched"},{flags:"--dry-run",description:"With --prune-legacy, report what would be deleted and delete nothing"},{flags:"--json",description:"Output entries as JSON"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net logs --id 3fa9c2d1a70e8b42","cc-safety-net logs --agent claude-code","cc-safety-net logs --project . --since 7","cc-safety-net logs --suspect --since 7","cc-safety-net logs --json","cc-safety-net logs --prune-legacy --dry-run","cc-safety-net logs --prune-legacy"]};var $r={name:"policy",description:"Check and apply project or user policy proposals",usage:"policy <subcommand>",subcommands:[{usage:"check <file>",description:"Validate a policy proposal and print its diff"},{usage:"apply <file>",description:"Apply a proposal after confirming in a terminal"}],options:[{flags:"-g, --global",description:"Use the user-scope policy instead of the project one"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net policy check proposal.json","cc-safety-net policy apply proposal.json","cc-safety-net policy apply proposal.json --global"]};var Yo=[{flags:"--ref",argument:"<ref>",description:"Use a branch, tag, or commit"},{flags:"--only",argument:"<rulebook...>",description:"Add only these repository rulebooks"},{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"-h, --help",description:"Show this help"}],Zo=["cc-safety-net rule add project-rules","cc-safety-net rule add acme/safety-rules","cc-safety-net rule add acme/safety-rules --only aws gcloud","cc-safety-net rule add acme/safety-rules --ref v2 --only aws","cc-safety-net rule add --only terraform aws"],Ht={name:"rule",description:"Manage CC Safety Net rule config and rulebook sources",usage:"rule <subcommand>",subcommands:[{usage:"init [--example]",description:"Create inert rule config"},{usage:"add [source] [--ref <ref>] [--only <rulebook...>]",description:"Add rulebook sources and sync"},{usage:"remove <source>",description:"Remove a rulebook source and sync"},{usage:"update [source]",description:"Re-fetch and vendor remote rulebooks"},{usage:"sync",description:"Deprecated: migrate lock and cache leftovers"},{usage:"list",description:"List active rulebooks"},{usage:"wrapper add <command>",description:"Trust a transparent command wrapper"},{usage:"wrapper remove <command>",description:"Remove a transparent command wrapper"},{usage:"wrapper list",description:"List transparent command wrappers"},{usage:"tool add <name...> [--cwd-arg <name>] [--project]",description:"Analyze community shell tools (user scope by default)"},{usage:"tool remove <name...> [--project]",description:"Stop analyzing declared tools"},{usage:"tool list",description:"List declared command tools in both scopes"},{usage:"migrate [--cleanup]",description:"Migrate legacy inline rules"},{usage:"doc",description:"Print the rulebook authoring guide"},{usage:"verify",description:"Validate rule config files"}],options:[{flags:"-g, --global",description:"Use user-scope rule config"},{flags:"--cleanup",description:"Delete legacy files after rule migrate verifies them"},{flags:"--delete-source",description:"Delete clean local source directory on remove"},{flags:"--example",description:"Create an inactive example rulebook with rule init"},{flags:"--project",description:"Use project-scope rule config with rule tool"},{flags:"--cwd-arg",argument:"<name>",description:"Name the working-directory argument with rule tool add"},...Yo.slice(0,2),{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net rule init","cc-safety-net rule init --example","cc-safety-net rule wrapper add rtk","cc-safety-net rule tool add ops_bash","cc-safety-net rule tool add ops_run_background --cwd-arg cwd --project",...Zo,"cc-safety-net rule update","cc-safety-net rule migrate --cleanup","cc-safety-net rule verify"]};var ma={name:"status",description:"Show what the runtime is enforcing right now",usage:"status",options:[{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net status"]};var ga={name:"statusline",description:"Print status line with mode indicators for shell integration",usage:"statusline --claude-code",options:[{flags:"-cc, --claude-code",description:"Print status line for Claude Code"},{flags:"-h, --help",description:"Show this help"}],examples:["cc-safety-net statusline -cc","cc-safety-net statusline --claude-code"]};var Dr=[ma,oa,fa,ia,Ht,$r,da,pa,ua,ca,sa,ga];function Jf(I){return I.aliases??[]}function Nr(I){let V=I.toLowerCase();return Dr.find((X)=>X.name.toLowerCase()===V||Jf(X).some((ee)=>ee.toLowerCase()===V))}import{existsSync as Dy}from"node:fs";import{basename as zf}from"node:path";function Lr(I,V=7,X=W(I)){let ee=Date.now()-V*24*60*60*1000,ne=[],te=new Set,le=0,de,be,Se,Ie;if(X)Q(I,X);let $e={count:0},Le=X?Jn(X,$e):[];for(let Fe of Le)for(let Be of Ft(Fe,$e)){if(Be.decision==="allow")continue;let Me=new Date(Be.ts).getTime();if(Me>=ee){if(le++,te.add(Be.sessionId??zf(Fe,".jsonl")),be===void 0||Me<=be)de=Be.ts,be=Me;if(Ie===void 0||Me>Ie)Se=Be.ts,Ie=Me;Wf(ne,Be,Me)}}let Ne=ne.map((Fe)=>({timestamp:Fe.ts,command:Fe.command,reason:Fe.reason,relativeTime:Ys(new Date(Fe.ts))}));return{totalBlocked:le,sessionCount:te.size,recentEntries:Ne,oldestEntry:de,newestEntry:Se,unreadable:$e.count}}function Wf(I,V,X){let ee=I.findIndex((ne)=>X>new Date(ne.ts).getTime());if(ee===-1){if(I.length<3)I.push(V);return}if(I.splice(ee,0,V),I.length>3)I.pop()}import{dirname as am}from"node:path";import{dirname as Yf,join as Zf,resolve as Xf}from"node:path";var Qf="config.json";function yn(I,V,X,ee){x(em(I),`${JSON.stringify(V,null,2)}
|
|
@@ -18,7 +18,7 @@ ${Jo(ne.segment||ne.command)}`,X=I.filter((ne)=>ne.decision!=="allow"),ee=X.filt
|
|
|
18
18
|
`)}function Fr(I){return zn({rows:I})}function $a(I){let V=[];return V.push("System Info"),V.push(Im(I)),V.join(`
|
|
19
19
|
`)}function Im(I){let V=["Component","Version"],X=(te)=>{if(te===null)return qe.dim("not found");return te},ne=[{label:"cc-safety-net",value:I.version},...Or.map((te)=>({label:cn(te),value:I.versions[te]??null})),{label:"Node.js",value:I.nodeVersion},{label:"npm",value:I.npmVersion},{label:"Bun",value:I.bunVersion},{label:"Platform",value:I.platform}].map((te)=>[te.label,X(te.value)]);return zn({headers:V,rows:ne})}function Da(I){if(I.findings.length===0)return qe.green(`
|
|
20
20
|
No findings from inspected doctor facts.`);let V={error:I.findings.filter((te)=>te.severity==="error").length,warning:I.findings.filter((te)=>te.severity==="warning").length,info:I.findings.filter((te)=>te.severity==="info").length},X=["error","warning","info"].filter((te)=>V[te]>0).map((te)=>`${V[te]} ${te}`),ee=I.findings.length===1?"finding":"findings",ne=`
|
|
21
|
-
${I.findings.length} ${ee}: ${X.join(", ")}.`;if(V.error>0)return qe.red(ne);if(V.warning>0)return qe.yellow(ne);return qe.blue(ne)}import{lstatSync as Om}from"node:fs";import{dirname as ti}from"node:path";function ri(I,V){try{let X=Om(V);if(X.isSymbolicLink())return{kind:I,path:V,status:"unsafe",issues:["symlink"]};if(!X.isDirectory())return{kind:I,path:V,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:I,path:V,status:"unknown",issues:[]};let ee=[...X.uid!==process.getuid()?["ownership"]:[],...(X.mode&18)!==0?["permissions"]:[]];return{kind:I,path:V,status:ee.length>0?"unsafe":"safe",issues:ee}}catch(X){if(typeof X==="object"&&X!==null&&"code"in X&&X.code==="ENOENT")return{kind:I,path:V,status:"not-applicable",issues:[]};return{kind:I,path:V,status:"unknown",issues:[]}}}function Na(I,V){let X=W(I);return{directories:[ri("policy",ti(ti(V))),ri("config",ti(V)),...X?[ri("audit",X)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as $m}from"node:child_process";import{existsSync as La}from"node:fs";import{delimiter as Dm,extname as Nm,join as Lm}from"node:path";import{stripVTControlCharacters as ja}from"node:util";var Ha="2.7.
|
|
21
|
+
${I.findings.length} ${ee}: ${X.join(", ")}.`;if(V.error>0)return qe.red(ne);if(V.warning>0)return qe.yellow(ne);return qe.blue(ne)}import{lstatSync as Om}from"node:fs";import{dirname as ti}from"node:path";function ri(I,V){try{let X=Om(V);if(X.isSymbolicLink())return{kind:I,path:V,status:"unsafe",issues:["symlink"]};if(!X.isDirectory())return{kind:I,path:V,status:"unsafe",issues:["not-directory"]};if(process.platform==="win32"||typeof process.getuid!=="function")return{kind:I,path:V,status:"unknown",issues:[]};let ee=[...X.uid!==process.getuid()?["ownership"]:[],...(X.mode&18)!==0?["permissions"]:[]];return{kind:I,path:V,status:ee.length>0?"unsafe":"safe",issues:ee}}catch(X){if(typeof X==="object"&&X!==null&&"code"in X&&X.code==="ENOENT")return{kind:I,path:V,status:"not-applicable",issues:[]};return{kind:I,path:V,status:"unknown",issues:[]}}}function Na(I,V){let X=W(I);return{directories:[ri("policy",ti(ti(V))),ri("config",ti(V)),...X?[ri("audit",X)]:[{kind:"audit",status:"unknown",issues:[]}]]}}import{spawn as $m}from"node:child_process";import{existsSync as La}from"node:fs";import{delimiter as Dm,extname as Nm,join as Lm}from"node:path";import{stripVTControlCharacters as ja}from"node:util";var Ha="2.7.2",jm=5000,Fm="_CC_SAFETY_NET_TEST_SPAWN_PLATFORM";function un(){return Ha}function oi(I,V){let X=I[V];if(X)return X;let ee=Object.keys(I).find((ne)=>ne.toLowerCase()===V.toLowerCase()&&!!I[ne]);return ee?I[ee]:X}function Hm(I){return(oi(I,"PATHEXT")||".COM;.EXE;.BAT;.CMD").split(";").filter((V)=>V.length>0)}function Mm(I,V){let X=Nm(I)?[I]:[...Hm(V).map((ee)=>`${I}${ee}`),I];if(I.includes("/")||I.includes("\\"))return X.find((ee)=>La(ee))??I;return(oi(V,"PATH")??"").split(Dm).flatMap((ee)=>X.map((ne)=>Lm(ee,ne))).find((ee)=>La(ee))??I}function Fa(I){if(!/[\s"&|<>^]/.test(I))return I;return`"${I.replace(/"/g,'""')}"`}function Wn(I,V){let[X,...ee]=I,ne=V[Fm]==="win32"?"win32":process.platform;if(!X||ne!=="win32")return{cmd:X??"",args:ee};let te=Mm(X,V);if(!/\.(?:bat|cmd)$/i.test(te))return{cmd:te,args:ee};return{cmd:oi(V,"COMSPEC")??"cmd.exe",args:["/d","/c",["call",Fa(te),...ee.map(Fa)].join(" ")]}}var Gt=async(I,V=jm)=>{let X=await Um(I,{timeoutMs:V});if(X.code!==0)return null;return ja(X.stdout).trim()||ja(X.stderr).trim()||null};function Um(I,V){let[X,...ee]=I;if(!X)return Promise.resolve({code:null,stdout:"",stderr:""});return new Promise((ne)=>{try{let te=Wn([X,...ee],process.env),le=$m(te.cmd,te.args,{stdio:["ignore","pipe","pipe"]}),de=!1,be="",Se="";le.stdout.on("data",(Le)=>{be+=Le.toString()}),le.stderr.on("data",(Le)=>{Se+=Le.toString()});let Ie=(Le)=>{if(de)return;de=!0,clearTimeout($e),ne(Le)},$e=setTimeout(()=>{le.kill(),Ie({code:null,stdout:be,stderr:Se})},V.timeoutMs);le.on("close",(Le)=>{Ie({code:Le,stdout:be,stderr:Se})}),le.on("error",()=>{Ie({code:null,stdout:be,stderr:Se})})}catch{ne({code:null,stdout:"",stderr:""})}})}function Hr(I){if(!I)return null;let V=/Claude Code\s+(\d+\.\d+\.\d+)/i.exec(I);if(V)return V[1]??null;let X=/v?(\d+\.\d+\.\d+(?:-[a-zA-Z0-9.]+)?)/i.exec(I);if(X)return X[1]??null;return I.split(`
|
|
22
22
|
`)[0]?.trim()||null}async function Mr(I,V=Gt,X=process.cwd()){let ee=Promise.all(xn.map(async($e)=>[$e.id,Hr(await V([...$e.probeCommand]))])),[ne,te,le,de,be,Se,Ie]=await Promise.all([ee,ee.then(async($e)=>{let Le=$e.find(([Be])=>Be==="opencode")?.[1];if(!Le?.startsWith("2.")||!I(Le))return null;let Ne=["--param",`location[directory]=${X}`],Fe=["opencode","api","integration.list",...Ne];return await V(Fe,30000),V(["opencode","api","plugin.list",...Ne],30000)}),V(["codex","plugin","list"],30000),V(["amp","plugins","list"],30000),V(["node","--version"]),V(["npm","--version"]),V(["bun","--version"])]);return{version:Ha,versions:Object.fromEntries(ne),codexPluginListOutput:le,ampPluginListOutput:de,openCodePluginListOutput:te,nodeVersion:Hr(be),npmVersion:Hr(Se),bunVersion:Hr(Ie),platform:`${process.platform} ${process.arch}`}}function ii(I,V){if(V==="dev")return!1;let X=I.split(".").map(Number),ee=V.split(".").map(Number),[ne=0,te=0,le=0]=X,[de=0,be=0,Se=0]=ee;if(ne!==de)return ne>de;if(te!==be)return te>be;return le>Se}async function Hn(){let I=un(),V=new AbortController,X=setTimeout(()=>V.abort(),3000);try{let ee=await fetch("https://registry.npmjs.org/cc-safety-net/latest",{signal:V.signal});if(!ee.ok)return{currentVersion:I,latestVersion:null,updateAvailable:!1,error:`npm registry returned ${ee.status}`};let ne=await ee.json(),te=ii(ne.version,I);return{currentVersion:I,latestVersion:ne.version,updateAvailable:te}}catch(ee){return{currentVersion:I,latestVersion:null,updateAvailable:!1,error:ee instanceof Error?ee.message:"Network error"}}finally{clearTimeout(X)}}import*as Ja from"node:readline";var Ga=(I)=>`\x1B[${I}B`,Bm=(I)=>`\x1B[${I}A`;var Ma=["░","▒","▓","╱","╲","┃","━","┏","┓","┗","┛","╋"];function Gm(I){return new Promise((V)=>setTimeout(V,I))}function qm(I,V,X){if(!X)return V(I);if(X.aborted)return Promise.resolve();return new Promise((ee,ne)=>{let te=()=>X.removeEventListener("abort",le),le=()=>{te(),ee()};X.addEventListener("abort",le,{once:!0}),V(I).then(()=>{te(),ee()},(de)=>{te(),ne(de)})})}function Ur(I){return Math.max(0,Math.min(1,I))}function qt(I){return Math.max(0,Math.min(255,Math.round(I)))}function si(I){return I<=0.0031308?12.92*I:1.055*I**0.4166666666666667-0.055}function Vm(I,V,X){let ee=X*Math.PI/180,ne=V*Math.cos(ee),te=V*Math.sin(ee),le=(I+0.3963377774*ne+0.2158037573*te)**3,de=(I-0.1055613458*ne-0.0638541728*te)**3,be=(I-0.0894841775*ne-1.291485548*te)**3;return{blue:qt(si(Ur(-0.0041960863*le-0.7034186147*de+1.707614701*be))*255),green:qt(si(Ur(-1.2684380046*le+2.6097574011*de-0.3413193965*be))*255),red:qt(si(Ur(4.0767416621*le-3.3077115913*de+0.2309699292*be))*255)}}function ai(I,V){let X=(V*I*180/Math.PI%360+360)%360;return Vm(0.72,0.15,X)}function qa(I,V=0.1){let X=ai(V,I);return`\x1B[38;2;${X.red};${X.green};${X.blue}m`}function Km(I,V){return{blue:qt(I.blue+(255-I.blue)*V),green:qt(I.green+(255-I.green)*V),red:qt(I.red+(255-I.red)*V)}}function Va(I,V,X){let ee=Math.imul(I+2654435769,2246822507)^Math.imul(V+3266489909,668265263)^Math.imul(X+374761393,2654435761),ne=ee^ee>>>15,te=Math.imul(ne,739982445),le=te^te>>>12,de=Math.imul(le,695872825);return((de^de>>>15)>>>0)/4294967296}function Jm(I,V,X){let ee=Math.floor(Va(I,V,X)*Ma.length);return Ma[ee]??"░"}function Ua(I){let V=Ur(I);return V*V*V*(V*(V*6-15)+10)}function zm(I){if(I.length===0)return"";let V=[],X=!1,ee="";for(let ne of I){let te=`${ne.red};${ne.green};${ne.blue}`;if(ne.bold!==X)V.push(ne.bold?"\x1B[1m":"\x1B[22m"),X=ne.bold;if(te!==ee)V.push(`\x1B[38;2;${te}m`),ee=te;V.push(ne.character)}return`${V.join("")}\x1B[22m\x1B[39m`}function Wm(I,V,X,ee,ne){return I.map((te,le)=>({...ai(X,ee+V+le/ne),bold:!1,character:te}))}function Ym(I,V,X,ee,ne,te,le,de){let be=Math.max(1,ee*0.75),Se=Math.min(1,X/be),Ie=ne*Ua(Se),$e=Math.max(0,(X-be)/Math.max(1,ee-be)),Le=(1-Ua(X/ee))*de*2,Ne=0.35*Math.max(0,1-$e*2),Fe=Se>=1,Be=Math.min(I.length,Math.ceil(Ie+2+1));return I.slice(0,Be).map((Me,tn)=>{let en=ai(te,le+V+tn/de+Le),on=tn+Va(V,tn,7919)*2-1;if(on>Ie+2)return{...en,bold:!1,character:" "};let ln=Ie-on,nn=0.8*Math.exp(-(ln*ln)/12.5),sn=Math.min(0.9,nn+Ne),Sn=!Fe&&on>Ie-4;return{...Km(en,sn),bold:sn>0.3,character:Sn?Jm(V,tn,X):Me}})}function Ba(I){return`\x1B[?2026h${I.map((V,X)=>`\x1B8${X>0?Ga(X):""}${zm(V)}`).join("")}\x1B[?2026l`}async function li(I,V={}){if(!I)return;let X=V.output??process.stdout,ee=V.sleep??Gm,ne=V.seed??0,te=I.split(`
|
|
23
23
|
`).map((Ie)=>Array.from(Ie)),le=Math.max(...te.map((Ie)=>Ie.length)),de=12000*te.filter((Ie)=>Ie.length>0).length/40,be=le>0?Math.max(1,Math.ceil(de/16.666666666666668)):0,Se=be>0?de/be:0;X.write(`\x1B[?25l${te.length>1?`${`
|
|
24
24
|
`.repeat(te.length-1)}${Bm(te.length-1)}`:""}\x1B7`);try{for(let Ie=1;Ie<=be;Ie+=1){if(V.signal?.aborted)break;X.write(Ba(te.map(($e,Le)=>Ym($e,Le,Ie,be,le,0.1,ne,3)))),await qm(Se,ee,V.signal)}}finally{if(X.write(Ba(te.map((Ie,$e)=>Wm(Ie,$e,0.1,ne,3)))),X.write("\x1B8"),te.length>1)X.write(Ga(te.length-1));X.write(`
|
|
@@ -227,7 +227,7 @@ def register(ctx):
|
|
|
227
227
|
`));return{path:ne[0]??X??Tn(Qi(I),Xi[0]),alreadyInstalled:ne.length>0}}function Xt(I){let V=[];for(let X of I.openCodeVersion?.startsWith("2.")?es(I.environment):ns(I.environment))if(xy(X))try{let ee=Py(X,"utf-8"),ne=gn(ee),te=JSON.parse(ne);if(os(te)){let le=ts(I.openCodePluginListOutput);if(le)return{platform:"opencode",status:"disabled",method:"opencode api plugin.list",configPath:X,errors:[...V,le]};return{platform:"opencode",status:"configured",method:"plugin array",configPath:X,errors:V.length>0?V:void 0}}}catch(ee){V.push(`Failed to parse ${Sy(X)}: ${ee instanceof Error?ee.message:String(ee)}`)}return{platform:"opencode",status:"n/a",errors:V.length>0?V:void 0}}import{join as Wc}from"node:path";var Zc="dist/pi/index.js",Yc=new Set([Zc,"index.js"]),Ry=/[*?[\]{}]/;function is(I){let V=I.env.get("PI_CODING_AGENT_DIR");return Wc(V?B(V,I.home):Wc(I.home,".pi","agent"),"settings.json")}function ss(I){if(typeof I!=="string")return!1;return I==="npm:cc-safety-net"||I.startsWith("npm:cc-safety-net@")}function Ey(I){if(!Array.isArray(I)||I.length===0)return!1;if(!I.every((ee)=>typeof ee==="string"))return!1;let V=(ee)=>I.some((ne)=>ne.startsWith(ee)&&ne.slice(1).replace(/^\.[/\\]/,"")===Zc);if(V("-"))return!1;if(V("+"))return!0;let X=I.filter((ee)=>!/^[-+!]/.test(ee));return(X.length===0||X.some((ee)=>Yc.has(ee)))&&!I.some((ee)=>ee.startsWith("!")&&(Yc.has(ee.slice(1))||Ry.test(ee)))}function Xc(I){let V=is(I.environment),X=v(V);if(X.kind==="unreadable")return{platform:"pi",status:"not-inspected"};if(X.kind==="missing")return{platform:"pi",status:"n/a"};let ee=n(X.value,"packages");if(!Array.isArray(ee))return{platform:"pi",status:"n/a"};let ne=ee.find((le)=>ss(typeof le==="string"?le:n(le,"source")));if(ne===void 0)return{platform:"pi",status:"n/a"};let te=n(ne,"extensions");if(te!==void 0&&!Ey(te))return{platform:"pi",status:"disabled",method:"package config",configPath:V,errors:["npm:cc-safety-net is installed but its extension is disabled in Pi settings"]};return{platform:"pi",status:"configured",method:"package config",configPath:V}}var Ty={amp:rl,"antigravity-cli":al,"claude-code":pl,codex:ml,"copilot-cli":Ol,cursor:Ul,"deepseek-harness":Rt,devin:Wl,droid:rc,"gemini-cli":oc,"grok-build":mc,"hermes-agent":Rc,"kimi-code":ho,openclaw:Mc,opencode:Xt,pi:Xc};function Qt(I,V,X){let ee={...X,cwd:V,environment:I};return Or.map((ne)=>Ay(Ty[ne](ee)))}function Ay(I){if(I.status==="not-inspected")return{platform:I.platform,detected:!1,configured:!1,inspectionStatus:"not-inspected"};return{platform:I.platform,detected:I.status!=="n/a",configured:I.status==="configured",inspectionStatus:I.status!=="n/a"?"verified":I.errors&&I.errors.length>0?"failed":"not-applicable",method:I.method,configPath:I.configPath,configPaths:I.configPaths,errors:I.errors}}import{join as _y}from"node:path";var Iy=Object.freeze([{command:"git reset --hard",description:"git reset --hard",expectBlocked:!0},{command:"rm -rf /",description:"rm -rf /",expectBlocked:!0},{command:"rm -rf ./node_modules",description:"rm in cwd (safe)",expectBlocked:!1}]),Oy=Object.freeze({state:"ready",diagnostics:Object.freeze([]),ruleMetadata:Object.freeze({}),policy:Object.freeze({rules:Object.freeze([]),transparentWrappers:Object.freeze([]),commandTools:Object.freeze([]),safety:Object.freeze({level:"standard"}),worktreeMode:!1,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:Object.freeze({}),destructiveCommandAllowPaths:Object.freeze([]),secretProtection:Object.freeze({enabled:!0,disabledRules:Object.freeze([]),denyPaths:Object.freeze([]),allowPaths:Object.freeze([])})})}),$y={strict:!1,paranoidRm:!1,paranoidInterpreters:!1,worktreeMode:!1,effectiveLevel:"standard",capabilities:{fail_closed:{enabled:!1,source:"preset",sources:[]},paranoid_rm:{enabled:!1,source:"preset",sources:[]},paranoid_interpreters:{enabled:!1,source:"preset",sources:[]}}};function Qc(I){let V=_y(I.tmpdir,"cc-safety-net-self-test"),X=Iy.map((ee)=>{let ne=z(I,d("self-test",{command:ee.command},{kind:"command",shell:"auto"},{configCwd:V,executionCwd:V},ee.command),{guard:{dependencies:{loadPolicySnapshot:()=>Oy,getModes:()=>$y,findPolicyMutation:()=>null}},audit:{agent:"self-test",getSessionId:()=>{return}}}),te=ee.expectBlocked?"blocked":"allowed",le=ne.decision.kind==="deny"?"blocked":"allowed";return{command:ee.command,description:ee.description,expected:te,actual:le,passed:te===le,reason:ne.decision.kind==="deny"?ne.decision.reason:void 0,ruleId:ne.decision.kind==="deny"?ne.decision.ruleId:void 0}});return{passed:X.filter((ee)=>ee.passed).length,failed:X.filter((ee)=>!ee.passed).length,total:X.length,results:X}}function as(I){let V=fn({label:"doctor",booleans:{json:["--json"],skipUpdateCheck:["--skip-update-check"]}},I);if(In(V.errors))return null;return{json:V.flags.json,skipUpdateCheck:V.flags.skipUpdateCheck}}async function ed(I,V={}){let X=await ar(!V.json,()=>{let ee=Ny(I,V);return{ready:ee,finish:()=>ee}},()=>sr(),{loadingMessage:"Checking system status…"});if(V.json)console.log(JSON.stringify(X,null,2));else Ly(X);return X.engineSelfTest.failed>0||X.findings.some((ee)=>ee.severity==="error")?1:0}async function Ny(I,V){let X=V.cwd??process.cwd(),ee=await Mr((Me)=>Xt({environment:I,cwd:X,openCodeVersion:Me}).status!=="n/a",void 0,X),ne=Qt(I,X,{ampPluginListOutput:ee.ampPluginListOutput,codexPluginListOutput:ee.codexPluginListOutput,copilotCliVersion:ee.versions["copilot-cli"],openCodeVersion:ee.versions.opencode,openCodePluginListOutput:ee.openCodePluginListOutput}),te=wa(I,X),le=ka(I),de=w(I,{cwd:X}),be=de.policy,Se=O(be,I.env),Ie=Z(be,Se.capabilities),$e=Lr(I,7),Le=Xa(I,X),Ne=[Ut(X),Bt(I)].filter((Me)=>Dy(Me)),Fe=V.skipUpdateCheck?{currentVersion:un(),latestVersion:null,updateAvailable:!1}:await Hn(),Be={hooks:ne,engineSelfTest:Qc(I),userConfig:te.userConfig,projectConfig:te.projectConfig,configState:nt(de),effectiveRules:te.effectiveRules,environment:le,effectiveSafety:{selectedPreset:be.safety.level,level:Se.effectiveLevel,capabilities:Se.capabilities,ruleOverrides:be.destructiveCommandRuleOverrides,weakenedRuleOverrides:Object.entries(Ie).filter(([,Me])=>Me.source==="rule_override"&&Me.override==="off"&&Me.inheritedEnabled&&Me.changesInherited).map(([Me])=>Me),ruleCounts:{stored:Object.keys(be.destructiveCommandRuleOverrides).length,effective:Object.values(Ie).filter((Me)=>Me.changesInherited).length},...de.policyScopes?{policyScopes:de.policyScopes}:{}},...Le.length>0?{v2Leftovers:Le}:{},...Ne.length>0?{legacyConfigs:Ne}:{},posture:Na(I,te.userConfig.path),activity:$e,update:Fe,system:ee};return{...Be,findings:xa(Be)}}function Ly(I){console.log(),console.log(Sa(I.hooks)),console.log(),console.log(Ra(I.engineSelfTest)),console.log(),console.log(Ea(I)),console.log(),console.log(Ta(I.environment)),console.log(),console.log(Aa(I)),console.log(),console.log(_a(I.findings)),console.log(),console.log(Ia(I.activity)),console.log(),console.log($a(I.system)),console.log(),console.log(Oa(I.update)),console.log(Da(I))}import{existsSync as jy}from"node:fs";var Fy=/^[A-Za-z0-9_@%+=:,./-]+$/,ls="Usage: cc-safety-net explain [--json] [--cwd <path>] [--shell <auto|posix|powershell>] <command>",Hy=["auto","posix","powershell"];function cs(I){let V=fn({label:"explain",booleans:{json:["--json"]},values:{cwd:["--cwd"],shell:["--shell"]},positionals:"tail"},I);if(In(V.errors))return console.error(ls),console.error("Pass -- before a command that starts with dashes."),null;if(V.values.cwd!==void 0&&!jy(V.values.cwd))return console.error(`Error: --cwd path does not exist: ${V.values.cwd}`),null;let X=Hy.find((ne)=>ne===V.values.shell);if(V.values.shell!==void 0&&!X)return console.error(`Error: --shell must be auto, posix, or powershell, got: ${V.values.shell}`),console.error(ls),null;let ee=V.positionals.length===1?V.positionals[0]:V.positionals.map((ne)=>Fy.test(ne)?ne:`'${ne.replaceAll("'",X==="powershell"?"''":"'\\''")}'`).join(" ");if(!ee)return console.error("Error: No command provided"),console.error(ls),null;return{json:V.flags.json,cwd:V.values.cwd,shell:X,command:ee}}function nd(I){if(I)return{dh:"=",dv:"|",dtl:"+",dtr:"+",dbl:"+",dbr:"+",h:"-",v:"|",tl:"+",tr:"+",bl:"+",br:"+",sh:"="};return{dh:"═",dv:"║",dtl:"╔",dtr:"╗",dbl:"╚",dbr:"╝",h:"─",v:"│",tl:"┌",tr:"┐",bl:"└",br:"┘",sh:"━"}}function td(I,V){let ee=V-18;return[`${I.dtl}${I.dh.repeat(V)}${I.dtr}`,`${I.dv} Command Analysis${" ".repeat(ee)}${I.dv}`,`${I.dbl}${I.dh.repeat(V)}${I.dbr}`]}function ds(I){return JSON.stringify(I)}function rd(I,V=0){return`[${I.map((ee,ne)=>Pa(ee,ne,V)).join(",")}]`}function br(I,V,X=70){let ee=I.split(" "),ne=[],te="";for(let le of ee)if(te&&te.length+le.length+1>X)ne.push(te),te=le;else te=te?`${te} ${le}`:le;if(te)ne.push(te);return ne.map((le,de)=>de===0?le:`${V}${le}`)}function od(I,V,X){let ee=[];switch(I.type){case"parse":return null;case"env-strip":return ee.push(""),ee.push(`STEP ${V} ${X.h} Strip environment variables`),ee.push(` Removed: ${I.envVars.map((ne)=>`${ne}=<redacted>`).join(", ")}`),ee.push(` Tokens: ${ds(I.output)}`),{lines:ee,incrementStep:!0};case"leading-tokens-stripped":return ee.push(""),ee.push(`STEP ${V} ${X.h} Strip wrappers`),ee.push(` Removed: ${I.removed.join(", ")}`),ee.push(` Tokens: ${ds(I.output)}`),{lines:ee,incrementStep:!0};case"shell-wrapper":return ee.push(""),ee.push(`STEP ${V} ${X.h} Detect shell wrapper`),ee.push(` Wrapper: ${I.wrapper} -c`),ee.push(` Inner: ${I.innerCommand}`),{lines:ee,incrementStep:!0};case"interpreter":{if(ee.push(""),ee.push(`STEP ${V} ${X.h} Detect interpreter`),ee.push(` Interpreter: ${I.interpreter}`),ee.push(` Code: ${I.codeArg}`),I.paranoidBlocked)ee.push(" Result: ✗ BLOCKED (paranoid mode)");return{lines:ee,incrementStep:!0}}case"busybox":return ee.push(""),ee.push(`STEP ${V} ${X.h} Busybox wrapper`),ee.push(` Subcommand: ${I.subcommand}`),{lines:ee,incrementStep:!0};case"transparent-wrapper":return ee.push(""),ee.push(`STEP ${V} ${X.h} Transparent wrapper`),ee.push(` Wrapper: ${I.wrapper}`),ee.push(` Tokens: ${ds(I.output)}`),{lines:ee,incrementStep:!0};case"recurse":return{lines:[],incrementStep:!1};case"script-file":return ee.push(""),ee.push(`STEP ${V} ${X.h} Read script file`),ee.push(` Path: ${I.path}`),ee.push(` Size: ${I.bytes} bytes`),{lines:ee,incrementStep:!0};case"rule-check":{if(ee.push(""),ee.push(`STEP ${V} ${X.h} Match rules`),ee.push(` Rule: ${I.rule}()`),I.matched)ee.push(" Result: MATCHED");else ee.push(" Result: No match");return{lines:ee,incrementStep:!0}}case"worktree-relaxation":return ee.push(""),ee.push(`STEP ${V} ${X.h} Worktree relaxation`),ee.push(` Mode: ${r.worktree.name}`),ee.push(` Git cwd: ${I.gitCwd}`),ee.push(" Result: Allowed local discard in linked worktree"),{lines:ee,incrementStep:!0};case"temp-root-relaxation":return ee.push(""),ee.push(`STEP ${V} ${X.h} Temp-root relaxation`),ee.push(` Git cwd: ${I.gitCwd}`),ee.push(" Result: Allowed git discard in a temp-root repository"),{lines:ee,incrementStep:!0};case"tmpdir-check":return null;case"fallback-scan":{if(I.embeddedCommandFound)return ee.push(""),ee.push(`STEP ${V} ${X.h} Fallback scan`),ee.push(` Found: ${I.embeddedCommandFound}`),{lines:ee,incrementStep:!0};return null}case"custom-rules-check":{if(I.rulesChecked){if(ee.push(""),ee.push(`STEP ${V} ${X.h} Custom rules`),I.matched)ee.push(" Result: MATCHED");else ee.push(" Result: No match");return{lines:ee,incrementStep:!0}}return null}case"cwd-change":return null;case"dangerous-text":{if(I.matched)return ee.push(""),ee.push(`STEP ${V} ${X.h} Dangerous text check`),ee.push(` Token: ${I.token}`),ee.push(" Result: MATCHED"),{lines:ee,incrementStep:!0};return null}case"strict-unparseable":return ee.push(""),ee.push(`STEP ${V} ${X.h} Strict mode check`),ee.push(` Command: ${I.rawCommand}`),ee.push(" Result: ✗ UNPARSEABLE"),{lines:ee,incrementStep:!0};case"segment-skipped":return null;case"error":return ee.push(""),ee.push(`ERROR: ${I.message}`),{lines:ee,incrementStep:!1};default:return I}}function us(I,V){let X=nd(V?.asciiOnly??!1),ee=58,ne=[],te=1;ne.push(...td(X,58)),ne.push("");let le=I.trace.steps.find((Fe)=>Fe.type==="error");if(le&&le.type==="error"){ne.push("ERROR"),ne.push(` ${le.message}`),ne.push(""),ne.push("RESULT"),ne.push(` Status: ${I.result==="blocked"?qe.red("BLOCKED"):qe.green("ALLOWED")}`),ne.push(""),ne.push("CONFIG");let Fe=I.configSource??"none";return ne.push(` Path: ${Fe}`),ne.join(`
|
|
228
228
|
`)}let de=I.trace.steps.find((Fe)=>Fe.type==="parse");if(de&&de.type==="parse"){ne.push("INPUT"),ne.push(` ${de.input}`),ne.push(""),ne.push(`STEP ${te} ${X.h} Split shell commands`),te++;for(let Fe=0;Fe<de.segments.length;Fe++){let Be=de.segments[Fe];if(Be){let Me=Math.random();ne.push(` Segment ${Fe+1}: ${rd(Be,Me)}`)}}}let be=I.trace.segments,Se=be.length>1;for(let Fe of be){if(Se){ne.push("");let en="";if(de&&de.type==="parse"){let Ko=de.segments[Fe.index];if(Ko)en=Ko.join(" ")}let on=54,ln=en,nn=` Segment ${Fe.index+1}: `,sn=" ";if(en){if(nn.length+en.length+sn.length>on){let yf=on-nn.length-sn.length;ln=`${en.substring(0,yf-1)}…`}}let Sn=en?`${nn}${ln}${sn}`:` Segment ${Fe.index+1} `,jt=en?`${nn}${qe.cyan(ln)}${sn}`:Sn,zs=58-Sn.length,Ws=Math.floor(zs/2),hf=zs-Ws;ne.push(`${X.sh.repeat(Ws)}${jt}${X.sh.repeat(hf)}`)}if(Fe.steps.find((en)=>en.type==="segment-skipped")){ne.push(""),ne.push(" (skipped — prior segment blocked)");continue}let Me=!1,tn=!1;for(let en of Fe.steps){let on=od(en,te,X);if(on){if(tn=!0,en.type==="recurse"){ne.push("");let ln=" RECURSING ",nn=58-ln.length-4;ne.push(` ${X.tl}${X.h}${ln}${X.h.repeat(nn)}`),ne.push(` ${X.v}`),Me=!0;continue}for(let ln of on.lines)if(Me)ne.push(` ${X.v} ${ln}`);else ne.push(ln);if(on.incrementStep)te++}}if(Me)ne.push(` ${X.v}`),ne.push(` ${X.bl}${X.h.repeat(56)}`);if(!tn)ne.push(""),ne.push(` ${qe.green("✓")} Allowed (no matching rules)`)}if(ne.push(""),ne.push("RESULT"),I.result==="blocked"){if(ne.push(` Status: ${qe.red("BLOCKED")}`),I.customRule){if(ne.push(` Rule: ${I.customRule.id}`),I.customRule.rulebook)ne.push(` Rulebook: ${I.customRule.rulebook.name} ${I.customRule.rulebook.version}`);if(I.customRule.source)ne.push(` Source: ${I.customRule.source}`);if(I.customRule.override)ne.push(` Override: reason ${I.customRule.override.reason}`)}if(I.reason){let Fe=br(I.reason," ");ne.push(` Reason: ${Fe[0]}`);for(let Be=1;Be<Fe.length;Be++)ne.push(Fe[Be]??"")}}else ne.push(` Status: ${qe.green("ALLOWED")}`);ne.push(""),ne.push("CONFIG");let Ie=I.configSource??"none",$e=I.configValid?"":" (invalid)";ne.push(` Path: ${Ie}${$e}`);let Le=I.safetyPresetScope;ne.push(` Safety preset: ${I.selectedPreset??"standard"}${Le?` (${jr(Le)})`:""}`),ne.push(` Effective capabilities: ${I.effectiveLevel}`);let Ne=Object.entries(I.destructiveCommandRuleOverrides??{});if(ne.push(` Rule customizations: ${Ne.length}`),I.ruleActivation)ne.push(` Rule activation: ${I.ruleActivation.id} — ${I.ruleActivation.enabled?"on":"off"} via ${I.ruleActivation.source}`);return ne.join(`
|
|
229
229
|
`)}function ps(I){return JSON.stringify(I,null,2)}import{resolve as Gy}from"node:path";var id=512,sd={maxTextLength:2048,maxListLength:128,maxObjectProperties:128,maxDepth:16},My=["AKIA","ASIA","ghp_","gho_","ghu_","ghs_","ghr_","github_pat_","glpat-","xox","npm_","pypi-","rk_","sk-","sk_","gsk_","xai-","pplx-","bastn_","tgp_v1_","flp_","wfr_","fw_","fwp_","tp-","psk-"];function gs(I){let V=0,X={allocateSegment(){return V++},getNextSegmentIndex(){return V},branch(){let ee=I.fork(),ne=gs(ee);return{trace:ne,adopt(){I.replaceSegmentEvents(ee.finish().events),V=ne.getNextSegmentIndex()}}},recordGlobal(ee){I.record({scope:"global",step:ee})},recordSegment(ee,ne=X.currentSegmentIndex){if(ne===void 0)return;I.record({scope:"segment",segmentIndex:ne,step:ee})}};return X}function hs(I=new Set){let V=[];return{record(X){if(V.length>=id)return;ko(X.step,I,sd),V.push({...X,step:fs(X.step,sd,I)})},fork(){return hs(I)},replaceSegmentEvents(X){V.splice(0,V.length,...[...V.filter((ee)=>ee.scope==="global"),...X].slice(0,id))},finish(){return{events:V}}}}function ko(I,V,X,ee=0,ne=new WeakSet){if(typeof I==="string"){let de=I.slice(0,X.maxTextLength);if(!pt(de))return;for(let be of Pt(de))for(let Se of be.match(/[^\s"'()$]+/g)??[])V.add(ad(Se));return}if(!I||typeof I!=="object"||ee>=X.maxDepth||ne.has(I))return;if(ne.add(I),Array.isArray(I)){let de=Math.min(I.length,X.maxListLength);for(let be=0;be<de;be++)ko(I[be],V,X,ee+1,ne);return}let te=0,le=new Set;for(let de in I){if(!Object.hasOwn(I,de))continue;if(te>=X.maxObjectProperties)break;te++,ko(de,V,X);let be=ms(de,X,V);if(le.has(be))continue;le.add(be),ko(I[de],V,X,ee+1,ne)}}function fs(I,V,X,ee=0,ne=new WeakSet){if(typeof I==="string")return ms(I,V,X);if(!I||typeof I!=="object")return I;if(ee>=V.maxDepth)return;if(ne.has(I))return;if(ne.add(I),Array.isArray(I)){let de=[],be=Math.min(I.length,V.maxListLength);for(let Se=0;Se<be;Se++)de.push(fs(I[Se],V,X,ee+1,ne));return de}let te={},le=0;for(let de in I){if(!Object.hasOwn(I,de))continue;if(le>=V.maxObjectProperties)break;le++;let be=ms(de,V,X);if(Object.hasOwn(te,be))continue;Object.defineProperty(te,be,{value:fs(I[de],V,X,ee+1,ne),enumerable:!0,configurable:!0,writable:!0})}return te}function ms(I,V,X){let ee=I.slice(0,V.maxTextLength),ne=pt(ee)?dt(ee):ee,te=X.size>0?By(ne,X):ne;return(Uy(te)?Ve(te):te).slice(0,V.maxTextLength)}function Uy(I){return I.includes("PRIVATE KEY")||I.includes("://")||I.includes("eyJ")||I.includes(":")&&/(?:authorization|cookie|x-api-key|api-key|(?:^|\s)(?:-u|--user)(?:\s|=))/i.test(I)||I.length>=14&&My.some((V)=>I.includes(V))||I.length>=49&&/\b[a-f0-9]{32}\.[A-Za-z0-9]{16}\b/.test(I)}function By(I,V){return I.replace(/[^\s"'()$]+/g,(X)=>V.has(ad(X))?"<redacted>":X)}function ad(I){let V=2166136261,X=2166136261;for(let ee=0;ee<I.length;ee++)V=Math.imul(V^I.charCodeAt(ee),16777619),X=Math.imul(X^I.charCodeAt(I.length-ee-1),16777619);return`${V>>>0}:${X>>>0}:${I.length}`}function wr(I,V={},X){let ee=Gy(V.cwd??process.cwd()),ne=V.policySnapshot??w(X,{cwd:ee,userConfigDir:V.userConfigDir}),te=O(ne.policy,X.env),le=_e({policySnapshot:ne,effectiveCapabilities:te.capabilities,worktreeMode:te.worktreeMode}),de={effectiveLevel:le.effectiveLevel,selectedPreset:ne.policy.safety.level,...ne.policyScopes?{safetyPresetScope:ne.policyScopes.levelScope}:{},effectiveCapabilities:le.effectiveCapabilities,destructiveCommandRuleOverrides:ne.policy.destructiveCommandRuleOverrides},{configSource:be,configValid:Se}=Vy(X,{cwd:ee,userConfigDir:V.userConfigDir});if(!I||!I.trim())return{trace:{steps:[{type:"error",message:"No command provided"}],segments:[]},result:"allowed",configSource:be,configValid:Se,...de};let Ie=V.shell??"auto",$e=C(I,Ie);if($e.status==="limited")throw new E;let Le=$e.dialect==="powershell"?C(I,"posix"):$e,Ne=Mt(Le),Fe=hs(),Be=gs(Fe);Be.recordGlobal({type:"parse",input:I,segments:Ne.map((jt)=>[...jt])});let Me=d("Bash",{command:I},{kind:"command",shell:Ie},{configCwd:ee,executionCwd:ee},I),tn=G(Me,{environment:X,trace:Be,dependencies:{loadPolicySnapshot:()=>ne}}),en=tn.decision.kind==="deny"?tn.decision:null;if(en&&(tn.stage==="policy-protection"||tn.stage==="secret-protection"))return{trace:{steps:[],segments:[{index:0,steps:[{type:"rule-check",rule:qy(en),matched:!0,reason:en.reason}]}]},result:"blocked",reason:A(en.reason),segment:A(ld(en,I)),ruleId:A(en.ruleId),configSource:be,configValid:Se,...de};let on=Be.getNextSegmentIndex();if(en&&on>0&&on<Ne.length)Be.recordSegment({type:"segment-skipped",index:on,reason:"prior-segment-blocked"},on);let ln=Fe.finish(),nn=en?.ruleId??Ky(Me,ne,te,X),sn=Y.find((jt)=>jt.id===nn&&jt.activationCapability),Sn=sn?le.policy.effectiveDestructiveCommandRules[sn.id]:void 0;return{trace:zy(ln),result:en?"blocked":"allowed",reason:en?A(en.reason):void 0,segment:en?A(ld(en,I)):void 0,ruleId:en?A(en.ruleId):void 0,customRule:Jy(Wy(en?.ruleId,ne)),configSource:be,configValid:Se,...de,...sn&&Sn?{ruleActivation:{id:sn.id,...Sn}}:{}}}function ld(I,V){return I.evidence?.segment??V}function qy(I){if(I.reason===ot)return"policy-protection:findPolicyConfigMutationTargetInSemanticFacts";if(I.reason===rt)return"policy-apply-protection:findPolicyApplyInvocationInSemanticFacts";if(I.reason===y)return"git-metadata-protection:findGitMetadataMutationTargetInSemanticFacts";return"secret-protection:findSensitiveTargetInSemanticFacts"}function Vy(I,V){let X=D(V.cwd),ee=K(I,V),ne=oe(I,{cwd:V.cwd,userConfigDir:V.userConfigDir});try{if(o(ne.projectConfigTarget)!==null){if(Fn(ne.projectConfigTarget).errors.length===0)return{configSource:X,configValid:!0};return{configSource:X,configValid:!1}}}catch(te){if(te instanceof i)return{configSource:X,configValid:!1};throw te}try{if(o(ne.userConfigTarget)!==null){let te=Fn(ne.userConfigTarget);return{configSource:ee,configValid:te.errors.length===0}}return{configSource:null,configValid:!0}}catch(te){if(te instanceof i)return{configSource:ee,configValid:!1};throw te}}function Ky(I,V,X,ee){let ne=V.policy,te=Ge({...ne,destructiveCommandProtectionEnabled:!0,destructiveCommandRuleOverrides:{...ne.destructiveCommandRuleOverrides,...Object.fromEntries(Y.flatMap((de)=>de.activationCapability?[[de.id,"on"]]:[]))}},V.state==="degraded"?{diagnostics:V.diagnostics,reason:V.reason}:void 0),le=G(I,{environment:ee,dependencies:{loadPolicySnapshot:()=>te,getModes:()=>({...X,strict:!0,paranoidRm:!0,paranoidInterpreters:!0,capabilities:{fail_closed:{...X.capabilities.fail_closed,enabled:!0},paranoid_rm:{...X.capabilities.paranoid_rm,enabled:!0},paranoid_interpreters:{...X.capabilities.paranoid_interpreters,enabled:!0}}}),findSensitiveTarget:()=>null}});return le.decision.kind==="deny"?le.decision.ruleId:void 0}function Jy(I){if(!I)return;return{id:A(I.id),...I.rulebook?{rulebook:{name:A(I.rulebook.name),version:A(I.rulebook.version)}}:{},...I.source?{source:A(I.source)}:{},...I.override?{override:{type:"reason",reason:A(I.override.reason)}}:{}}}function zy(I){let V=I.events.flatMap((ee)=>ee.scope==="global"?[ee.step]:[]),X=new Map;for(let ee of I.events){if(ee.scope!=="segment")continue;let ne=X.get(ee.segmentIndex)??{index:ee.segmentIndex,steps:[]};ne.steps.push(ee.step),X.set(ee.segmentIndex,ne)}return{steps:V,segments:[...X.values()]}}function Wy(I,V){let X=I?.replace(/^custom\./,"");if(!X||!V.policy.rules.some((ee)=>ee.name===X))return;return V.ruleMetadata[X]??Object.freeze({id:X})}function cd(I){return new Promise((V)=>{process.stdout.write(`${I}
|
|
230
|
-
`,()=>V())})}async function dd(I,V){let X=cs(V);if(!X)return 1;try{let ee=wr(X.command,{cwd:X.cwd,shell:X.shell},I),ne=!!process.env.NO_COLOR||!process.stdout.isTTY;return await cd(X.json?ps(ee):us(ee,{asciiOnly:ne})),0}catch(ee){let ne=Yy(ee instanceof g?ee.cause:ee);if(ne===void 0)throw ee;if(X.json)return await cd(JSON.stringify({error:ne})),1;return console.error(ne),1}}function Yy(I){if(I instanceof E)return I.message;if(I instanceof H)return I.message;if(I instanceof h)return I.message;if(I instanceof a&&l[I.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var ud="2.7.
|
|
230
|
+
`,()=>V())})}async function dd(I,V){let X=cs(V);if(!X)return 1;try{let ee=wr(X.command,{cwd:X.cwd,shell:X.shell},I),ne=!!process.env.NO_COLOR||!process.stdout.isTTY;return await cd(X.json?ps(ee):us(ee,{asciiOnly:ne})),0}catch(ee){let ne=Yy(ee instanceof g?ee.cause:ee);if(ne===void 0)throw ee;if(X.json)return await cd(JSON.stringify({error:ne})),1;return console.error(ne),1}}function Yy(I){if(I instanceof E)return I.message;if(I instanceof H)return I.message;if(I instanceof h)return I.message;if(I instanceof a&&l[I.kind].errorCode==="path-canonicalization-limit")return"Path canonicalization work limit exceeded.";return}var ud="2.7.2",Pn=" ",mt="cc-safety-net";function pd(I){return I.argument?`${I.flags} ${I.argument}`:I.flags}function Zy(I){return Math.max(...I.map((V)=>pd(V).length))}function Xy(I){return Math.max(...I.map((V)=>V.usage.length))}function Qy(I){return Math.max(...I.map((V)=>`${mt} ${V.usage}`.length))}function ev(I,V){let X=`${mt} ${I.usage}`;return`${Pn}${X.padEnd(V+2)}${I.description}`}function An(I,V){return`${Pn}${I.padEnd(Math.max(40,I.length+2))}${V}`}function er(I,V=console.log){let X=[];if(X.push(`${mt} ${I.name}`),X.push(""),X.push(`${Pn}${I.description}`),X.push(""),X.push("USAGE:"),X.push(`${Pn}${mt} ${I.usage}`),X.push(""),I.subcommands&&I.subcommands.length>0){X.push("SUBCOMMANDS:");let ee=Xy(I.subcommands);for(let ne of I.subcommands)X.push(`${Pn}${ne.usage.padEnd(ee+2)}${ne.description}`);X.push("")}if(I.options.length>0){X.push("OPTIONS:");let ee=Zy(I.options);for(let ne of I.options){let te=pd(ne),le=ne.default?`${ne.description} (default: ${ne.default})`:ne.description;X.push(`${Pn}${te.padEnd(ee+2)}${le}`)}X.push("")}if(I.examples&&I.examples.length>0){X.push("EXAMPLES:");for(let ee of I.examples)X.push(`${Pn}${ee}`)}V(X.join(`
|
|
231
231
|
`))}function ys(){let I=Qy(Dr),V=[];V.push(`${mt} v${ud}`),V.push(""),V.push("Blocks destructive commands and secret access."),V.push(""),V.push("COMMANDS:");for(let X of Dr)V.push(ev(X,I));V.push(""),V.push("GLOBAL OPTIONS:"),V.push(`${Pn}-h, --help Show help (use with command for command-specific help)`),V.push(`${Pn}-V, --version Show version`),V.push(""),V.push("HELP:"),V.push(`${Pn}${mt} help <command> Show help for a specific command`),V.push(`${Pn}${mt} <command> --help Show help for a specific command`),V.push(""),V.push("ENVIRONMENT VARIABLES:"),V.push(An(`${r.level.name}=standard|strict|paranoid`,"Set session safety level")),V.push(An(`${r.worktree.name}=1`,"Allow local git discards in linked worktrees")),V.push(An(`${r.debug.name}=1`,"Print diagnostic messages to stderr")),V.push(An(`${r.auditScope.name}=all|blocked`,"Record all command decisions, or denials only")),V.push(An(`${r.projectTightenOnly.name}=1`,"Ignore project policy settings that weaken the user policy")),V.push(An("CC_SAFETY_NET_HOME","Override rule config home directory")),V.push(""),V.push("LEGACY ENVIRONMENT VARIABLES (STILL SUPPORTED):"),V.push(An(`${r.strict.name}=1`,"Force safety.overrides.fail_closed on")),V.push(An(`${r.paranoid.name}=1`,"Force paranoid_rm and paranoid_interpreters on")),V.push(An(`${r.paranoidRm.name}=1`,"Force safety.overrides.paranoid_rm on")),V.push(An(`${r.paranoidInterpreters.name}=1`,"Force safety.overrides.paranoid_interpreters on")),V.push(""),V.push("Documentation: https://ccsafetynet.com/docs"),console.log(V.join(`
|
|
232
232
|
`))}function fd(){console.log(ud)}function kr(I,V=console.log){let X=Nr(I);if(!X)return!1;if(X.name.toLowerCase()!==I.toLowerCase())return!1;return er(X,V),!0}import{existsSync as Ao,readFileSync as bu}from"node:fs";import{join as To}from"node:path";import*as Bn from"node:readline";function nv(I){return I==="install"?"Install":"Uninstall"}function tv(I){return I==="install"?"Installing":"Uninstalling"}function rv(I){return I==="install"?"into":"from"}function hd(I){return I?.available===!0}function ov(I,V){let X=new Set(V);return I.filter((ee)=>X.has(ee.target)).map((ee)=>ee.target)}function md(I,V,X){if(I.every((ee)=>!ee.available))return V;return Array.from({length:I.length},(ee,ne)=>ne+1).map((ee)=>(V+ee*X+I.length)%I.length).find((ee)=>hd(I[ee]))}function iv(I,V,X){if(X.ctrl&&X.name==="c")return"interrupt";if(X.name==="escape"||V==="q")return"abort";if(I==="install"&&(V==="u"||V==="U"))return"update";if(X.name==="up"||V==="k")return"up";if(X.name==="down"||V==="j")return"down";if(X.name==="space"||V===" ")return"toggle";if(X.name==="return"||X.name==="enter")return"confirm";return null}function sv(I){return{cursor:I.findIndex((V)=>V.available),selected:[]}}function av(I,V,X){if(X==="confirm"||X==="update"||X==="abort"||X==="interrupt")return{state:I,done:X};if(X==="up")return{state:{...I,cursor:md(V,I.cursor,-1)}};if(X==="down")return{state:{...I,cursor:md(V,I.cursor,1)}};let ee=V[I.cursor];if(!hd(ee))return{state:I};let ne=I.selected.includes(ee.target)?I.selected.filter((te)=>te!==ee.target):ov(V,[...I.selected,ee.target]);return{state:{...I,selected:ne}}}var yd="◉",vd="◯",bd=">",wd=" ";function lv(I,V,X){return["",`${nv(I)} CC Safety Net ${rv(I)}:`,"",...V.map((ee,ne)=>{let te=X.selected.includes(ee.target),le=ne===X.cursor,de=te?yd:vd,be=le?bd:wd,Se=ee.available?"":` (${ee.unavailableReason??"not installed"})`,Ie=`${de} ${ee.label}${Se}`,$e=!ee.available?qe.dim(Ie):te?qe.green(Ie):le?qe.bold(Ie):Ie;return`${be} ${$e}`}),"",I==="install"?"Space: select Enter: confirm u: update installed Up/Down: move q/Esc: cancel":V.some((ee)=>ee.available)?"Space: select Enter: confirm Up/Down: move q/Esc: cancel":`No selectable integrations found for ${I}. q/Esc: close`].join(`
|
|
233
233
|
`)}var gd=["global-hook","plugin"];function cv(I,V,X={}){let ee=X.color!==!1?qe.bold:(te)=>te;return["","Install the Kimi Code integration as:","",...[`Global hook — ${V?"already installed; selecting it reports the current state":"write the hook into ~/.kimi-code/config.toml now"}`,"Native Kimi plugin — print the steps to run inside Kimi Code"].map((te,le)=>{let de=le===I,be=`${de?yd:vd} ${te}`;return`${de?bd:wd} ${de?ee(be):be}`}),"","Enter: confirm Up/Down: move q/Esc: cancel"].join(`
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import"../chunks/index-
|
|
1
|
+
import"../chunks/index-3xe319mt.js";import{Tt}from"../chunks/index-s5gfmv1q.js";import"../chunks/index-38xbyz1h.js";import"../chunks/index-bn4xwa1w.js";var t={name:"cc-safety-net",inject:["tools"],apply:Tt};export{t as default};
|
package/dist/index.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import{b,Ie}from"./chunks/index-
|
|
1
|
+
import{b,Ie}from"./chunks/index-3xe319mt.js";import{Be,Oe,Et,st,at}from"./chunks/index-09qa5y78.js";import"./chunks/index-bn4xwa1w.js";import{execFile as Af}from"node:child_process";var re=(e,t)=>{switch(t.length){case 0:return e;case 1:return t[0](e);case 2:return t[1](t[0](e));case 3:return t[2](t[1](t[0](e)));case 4:return t[3](t[2](t[1](t[0](e))));case 5:return t[4](t[3](t[2](t[1](t[0](e)))));case 6:return t[5](t[4](t[3](t[2](t[1](t[0](e))))));case 7:return t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))));case 8:return t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e))))))));case 9:return t[8](t[7](t[6](t[5](t[4](t[3](t[2](t[1](t[0](e)))))))));default:{let r=e;for(let n=0,o=t.length;n<o;n++)r=t[n](r);return r}}},Cc={pipe(){return re(this,arguments)}},Dt=function(){function e(){}return e.prototype=Cc,e}();var w=function(e,t){if(typeof e==="function")return function(){return e(arguments)?t.apply(this,arguments):(r)=>t(r,...arguments)};switch(e){case 0:case 1:throw RangeError(`Invalid arity ${e}`);case 2:return function(r,n){if(arguments.length>=2)return t(r,n);return function(o){return t(o,r)}};case 3:return function(r,n,o){if(arguments.length>=3)return t(r,n,o);return function(s){return t(s,r,n)}};default:return function(){if(arguments.length>=e)return t.apply(this,arguments);let r=arguments;return function(n){return t(n,...r)}}}};var Q=(e)=>e;var Ss=(e)=>()=>e;var lt=Ss(void 0),ys=lt;function ze(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),o}}function ft(e){let t=new WeakMap;return(r)=>{let n=t.get(r);if(n!==void 0)return n;let o=e(r);return t.set(r,o),t.set(o,o),o}}var Ut=(e)=>{let t=new Set(Reflect.ownKeys(e));if(e.constructor===Object)return t;if(e instanceof Error)t.delete("stack");let r=Object.getPrototypeOf(e),n=r;while(n!==null&&n!==Object.prototype){let o=Reflect.ownKeys(n);for(let s=0;s<o.length;s++)t.add(o[s]);n=Object.getPrototypeOf(n)}if(t.has("constructor")&&typeof e.constructor==="function"&&r===e.constructor.prototype)t.delete("constructor");return t},Mt=new WeakSet;function Nt(e){return typeof e==="string"}function En(e){return typeof e==="number"}function Ts(e){return typeof e==="symbol"}function Sr(e){return Nt(e)||En(e)||Ts(e)}function pt(e){return typeof e==="function"}function bn(e){return e!==void 0}function wn(e){return e!=null}function Es(e){return!0}function In(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function yr(e){return typeof e==="object"&&e!==null||pt(e)}var C=w(2,(e,t)=>yr(e)&&(t in e));function bs(e){return e instanceof Error}var G="~effect/interfaces/Hash",R=(e)=>{switch(typeof e){case"number":return wr(e);case"bigint":return L(e.toString(10));case"boolean":return L(String(e));case"symbol":return L(String(e));case"string":return L(e);case"undefined":return L("undefined");case"function":case"object":if(e===null)return L("null");else if(e instanceof Date){if(Number.isNaN(e.getTime()))return L("Invalid Date");return L(e.toISOString())}else if(e instanceof RegExp)return L(e.toString());else{if(Mt.has(e))return Tr(e);if(On.has(e))return On.get(e);let t=Fc(e,()=>{if(kc(e))return e[G]();else if(typeof e==="function")return Tr(e);else if(e instanceof DataView)return Er(new Uint8Array(e.buffer,e.byteOffset,e.byteLength));else if(Array.isArray(e)||ArrayBuffer.isView(e))return Er(e);else if(e instanceof Map)return _c(e);else if(e instanceof Set)return Ac(e);return Rc(e)});return On.set(e,t),t}default:throw Error(`BUG: unhandled typeof ${typeof e} - please report an issue at https://github.com/Effect-TS/effect/issues`)}},Tr=(e)=>{if(!vn.has(e))vn.set(e,wr(Math.floor(Math.random()*Number.MAX_SAFE_INTEGER)));return vn.get(e)},ee=w(2,(e,t)=>e*53^t),br=(e)=>e&3221225471|e>>>1&1073741824,kc=(e)=>C(e,G),wr=(e)=>{if(e!==e)return L("NaN");if(e===1/0)return L("Infinity");if(e===-1/0)return L("-Infinity");let t=e|0;if(t!==e)t^=e*4294967295;while(e>4294967295)t^=e/=4294967295;return br(t)},L=(e)=>{let t=5381,r=e.length;while(r)t=t*33^e.charCodeAt(--r);return br(t)},kn=(e,t)=>{let r=12289;for(let n of t)r^=ee(R(n),R(e[n]));return br(r)},Rc=(e)=>kn(e,Ut(e)),Rn=(e,t)=>(r)=>{let n=e;for(let o of r)n^=t(o);return br(n)},Er=Rn(6151,R),_c=Rn(L("Map"),([e,t])=>ee(R(e),R(t))),Ac=Rn(L("Set"),R),vn=new WeakMap,On=new WeakMap,Cn=new WeakSet;function Fc(e,t){if(Cn.has(e))return L("[Circular]");Cn.add(e);let r=t();return Cn.delete(e),r}var z="~effect/interfaces/Equal";function q(){if(arguments.length===1)return(e)=>He(e,arguments[0]);return He(arguments[0],arguments[1])}function He(e,t){if(e===t)return!0;if(e==null||t==null)return!1;let r=typeof e;if(r!==typeof t)return!1;if(r==="number"&&e!==e&&t!==t)return!0;if(r!=="object"&&r!=="function")return!1;if(Mt.has(e)||Mt.has(t))return!1;return Uc(e,t,Dc)}function Pc(e,t,r){let n=_n.has(e),o=An.has(t);if(n&&o)return!0;if(n||o)return!1;_n.add(e),An.add(t);let s=r();return _n.delete(e),An.delete(t),s}var _n=new WeakSet,An=new WeakSet;function Dc(e,t){if(R(e)!==R(t))return!1;else if(e instanceof Date){if(!(t instanceof Date))return!1;let s=e.getTime(),a=t.getTime();return s===a||Number.isNaN(s)&&Number.isNaN(a)}else if(e instanceof RegExp){if(!(t instanceof RegExp))return!1;return e.toString()===t.toString()}let r=Is(e),n=Is(t);if(r!==n)return!1;let o=r&&n;if(typeof e==="function"&&!o)return!1;return Pc(e,t,()=>{if(o)return e[z](t);else if(Array.isArray(e)){if(!Array.isArray(t)||e.length!==t.length)return!1;return Mc(e,t)}else if(ArrayBuffer.isView(e)){let s=e instanceof DataView;if(!ArrayBuffer.isView(t)||e.byteLength!==t.byteLength||s!==t instanceof DataView)return!1;if(s){let a=t;return ws(new Uint8Array(e.buffer,e.byteOffset,e.byteLength),new Uint8Array(a.buffer,a.byteOffset,a.byteLength))}return ws(e,t)}else if(e instanceof Map){if(!(t instanceof Map)||e.size!==t.size)return!1;return $c(e,t)}else if(e instanceof Set){if(!(t instanceof Set)||e.size!==t.size)return!1;return jc(e,t)}return Nc(e,t)})}function Uc(e,t,r){let n=Ir.get(e);if(!n)n=new WeakMap,Ir.set(e,n);else if(n.has(t))return n.get(t);let o=r(e,t);n.set(t,o);let s=Ir.get(t);if(!s)s=new WeakMap,Ir.set(t,s);return s.set(e,o),o}var Ir=new WeakMap;function Mc(e,t){for(let r=0;r<e.length;r++)if(!He(e[r],t[r]))return!1;return!0}function ws(e,t){if(e.length!==t.length)return!1;for(let r=0;r<e.length;r++)if(e[r]!==t[r])return!1;return!0}function Nc(e,t){let r=Ut(e),n=Ut(t);if(r.size!==n.size)return!1;for(let o of r)if(!n.has(o)||!He(e[o],t[o]))return!1;return!0}function Lc(e,t){return function(n,o){let s=Array.from(o);for(let[a,c]of n){let u=!1;for(let i=0;i<s.length;i++){let[f,x]=s[i];if(e(a,f)&&t(c,x)){s[i]=s[s.length-1],s.pop(),u=!0;break}}if(!u)return!1}return!0}}var $c=Lc(He,He);function Bc(e){return function(r,n){let o=Array.from(n);for(let s of r){let a=!1;for(let c=0;c<o.length;c++){let u=o[c];if(e(s,u)){o[c]=o[o.length-1],o.pop(),a=!0;break}}if(!a)return!1}return!0}}var jc=Bc(He),Is=(e)=>C(e,z);var Lt=Symbol.for("~effect/Redactable"),qc=(e)=>C(e,Lt);function ht(e){if(qc(e))return Fn(e);return e}function Fn(e){return e[Lt](globalThis[xt]?.context??Jc)}var xt="~effect/Fiber/currentFiber",vs=new Map,Jc={"~effect/Context":{},base:vs,depth:0,mapUnsafe:vs,pipe(){return re(this,arguments)}};function A(e,t){let r=t?.space??0,n=new WeakSet,o=!r?"":typeof r==="number"?" ".repeat(r):r,s=(i)=>o.repeat(i),a=(i,f)=>{let x=i?.constructor;return x&&x!==Object.prototype.constructor&&x.name?`${x.name}(${f})`:f},c=(i)=>{try{return Reflect.ownKeys(i)}catch{return["[ownKeys threw]"]}};function u(i,f=0){if(typeof i==="string")return JSON.stringify(i);if(typeof i==="number"||i==null||typeof i==="boolean"||typeof i==="symbol")return String(i);if(typeof i==="bigint")return String(i)+"n";if(typeof i==="object"||typeof i==="function"){if(n.has(i))return Kc;n.add(i);let x;if(Lt in i)x=u(Fn(i),f);else if(Array.isArray(i))x=!o||i.length<=1?`[${i.map((h)=>u(h,f)).join(",")}]`:`[
|
|
2
2
|
${s(f+1)}${i.map((h)=>u(h,f+1)).join(`,
|
|
3
3
|
`+s(f+1))}
|
|
4
4
|
${s(f)}]`;else if(i instanceof Date)x=Os(i);else if(!t?.ignoreToString&&C(i,"toString")&&typeof i.toString==="function"&&i.toString!==Object.prototype.toString&&i.toString!==Array.prototype.toString){let h=Gc(i);x=i instanceof Error&&i.cause?`${h} (cause: ${u(i.cause,f)})`:h}else if(Symbol.iterator in i)x=`${i.constructor.name}(${u(Array.from(i),f)})`;else{let h=c(i);if(!o||h.length<=1){let m=`{${h.map((p)=>`${$t(p)}:${u(i[p],f)}`).join(",")}}`;x=a(i,m)}else{let m=`{
|