vibesafu 0.1.24 → 0.1.25

package/dist/index.js

@@ -84,7 +84,7 @@ async function uninstall() {
 }
 
 // src/cli/config.ts
-import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile2, mkdir as mkdir2, chmod } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 import { createInterface } from "readline";
@@ -109,10 +109,20 @@ var DEFAULT_CONFIG = {
     path: join2(CONFIG_DIR, "logs")
   }
 };
+function mergeConfig(defaults, user) {
+  return {
+    anthropic: { ...defaults.anthropic, ...user.anthropic },
+    models: { ...defaults.models, ...user.models },
+    trustedDomains: user.trustedDomains ?? defaults.trustedDomains,
+    customPatterns: { ...defaults.customPatterns, ...user.customPatterns },
+    allowedMCPTools: user.allowedMCPTools ?? defaults.allowedMCPTools,
+    logging: { ...defaults.logging, ...user.logging }
+  };
+}
 async function readConfig() {
   try {
     const content = await readFile2(CONFIG_PATH, "utf-8");
-    return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
+    return mergeConfig(DEFAULT_CONFIG, JSON.parse(content));
   } catch {
     return DEFAULT_CONFIG;
   }
@@ -120,6 +130,7 @@ async function readConfig() {
 async function writeConfig(config2) {
   await mkdir2(CONFIG_DIR, { recursive: true });
   await writeFile2(CONFIG_PATH, JSON.stringify(config2, null, 2));
+  await chmod(CONFIG_PATH, 384);
 }
 function prompt(question) {
   const rl = createInterface({
@@ -811,6 +822,7 @@ var CHECKPOINT_PATTERNS = [
   { pattern: /\.ssh/i, type: "file_sensitive", description: "SSH directory access" },
   { pattern: /\.aws/i, type: "file_sensitive", description: "AWS credentials access" },
   { pattern: /credentials/i, type: "file_sensitive", description: "Credentials file access" },
+  { pattern: /CLAUDE\.md/i, type: "file_sensitive", description: "CLAUDE.md modification" },
   // Sensitive file copy/move (indirect path bypass)
   { pattern: /(cp|mv)\s+.*\.ssh\//i, type: "file_sensitive", description: "Copying/moving SSH files" },
   { pattern: /(cp|mv)\s+.*\.aws\//i, type: "file_sensitive", description: "Copying/moving AWS credentials" },
@@ -1280,6 +1292,13 @@ var WRITE_SENSITIVE_PATHS = [
     legitimateUses: ["Configuring PyPI", "Publishing packages"]
   },
   // Claude Code config - Critical (could disable security)
+  {
+    pattern: /CLAUDE\.md$/i,
+    description: "Claude instructions file",
+    severity: "critical",
+    risk: "Can modify AI behavior and disable security rules",
+    legitimateUses: ["Updating project instructions", "Configuring Claude behavior"]
+  },
   {
     pattern: /^~?\/?\.claude\//i,
     description: "Claude config directory",
@@ -1535,7 +1554,7 @@ function sanitizeForPrompt(command) {
   if (sanitized.length > MAX_COMMAND_LENGTH) {
     sanitized = sanitized.slice(0, MAX_COMMAND_LENGTH) + "... [truncated]";
   }
-  sanitized = sanitized.replace(/</g, "&lt;").replace(/>/g, "&gt;");
+  sanitized = sanitized.replace(/]]>/g, "]]&gt;");
   sanitized = sanitized.replace(/\n{3,}/g, "\n\n");
   return sanitized;
 }
@@ -1582,7 +1601,7 @@ function shouldForceEscalate(command) {
 }
 
 // src/guard/haiku-triage.ts
-var HAIKU_MODEL = "claude-haiku-4-20250514";
+var DEFAULT_HAIKU_MODEL = "claude-haiku-4-20250514";
 var API_TIMEOUT_MS = 3e4;
 var TRIAGE_SYSTEM_PROMPT = `You are a security triage agent for an autonomous coding system.
 Your ONLY job is to classify commands as SELF_HANDLE, ESCALATE, or BLOCK.
@@ -1629,7 +1648,7 @@ var FORCE_ESCALATE_TYPES = [
   "package_install"
   // Supply chain attacks via postinstall scripts
 ];
-async function triageWithHaiku(client, checkpoint) {
+async function triageWithHaiku(client, checkpoint, model) {
   if (FORCE_ESCALATE_TYPES.includes(checkpoint.type)) {
     return {
       classification: "ESCALATE",
@@ -1644,7 +1663,7 @@ async function triageWithHaiku(client, checkpoint) {
     const timeoutId = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
     const response = await client.messages.create(
       {
-        model: HAIKU_MODEL,
+        model: model ?? DEFAULT_HAIKU_MODEL,
         max_tokens: 500,
         system: TRIAGE_SYSTEM_PROMPT,
         messages: [{ role: "user", content: userPrompt }]
@@ -1706,7 +1725,7 @@ async function triageWithHaiku(client, checkpoint) {
 }
 
 // src/guard/sonnet-review.ts
-var SONNET_MODEL = "claude-sonnet-4-20250514";
+var DEFAULT_SONNET_MODEL = "claude-sonnet-4-20250514";
 var API_TIMEOUT_MS2 = 6e4;
 var REVIEW_SYSTEM_PROMPT = `You are a senior security engineer reviewing potentially risky operations.
 Your job is to analyze commands and determine if they are safe to execute.
@@ -1778,7 +1797,7 @@ BLOCK - Do not allow:
   "user_message": "Concise message explaining the security risk to the user (2-3 sentences max). Do NOT include timing or instructions - those are added automatically."
 }
 </response_format>`;
-async function reviewWithSonnet(client, checkpoint, triage) {
+async function reviewWithSonnet(client, checkpoint, triage, model) {
   const sanitizedCommand = sanitizeForPrompt(checkpoint.command);
   const userPrompt = REVIEW_USER_PROMPT.replace("{command}", escapeXml(sanitizedCommand)).replace("{checkpoint_type}", escapeXml(checkpoint.type)).replace("{context}", escapeXml(checkpoint.description)).replace("{triage_reason}", escapeXml(triage.reason)).replace("{risk_indicators}", escapeXml(triage.riskIndicators.join(", ") || "none"));
   try {
@@ -1786,7 +1805,7 @@ async function reviewWithSonnet(client, checkpoint, triage) {
     const timeoutId = setTimeout(() => controller.abort(), API_TIMEOUT_MS2);
     const response = await client.messages.create(
       {
-        model: SONNET_MODEL,
+        model: model ?? DEFAULT_SONNET_MODEL,
         max_tokens: 1e3,
         system: REVIEW_SYSTEM_PROMPT,
         messages: [{ role: "user", content: userPrompt }]
@@ -1855,6 +1874,7 @@ var TIMEOUT_SECONDS = 7;
 var PLAN_MODE_TIMEOUT_SECONDS = 72 * 60 * 60;
 var SAFE_NON_BASH_TOOLS = ["WebFetch", "WebSearch", "Task", "Glob", "Grep", "LS", "TodoRead", "TodoWrite", "NotebookRead"];
 async function processPermissionRequest(input, anthropicClient) {
+  const config2 = await readConfig();
   if (input.tool_name === "Write" || input.tool_name === "Edit" || input.tool_name === "Read") {
     const fileCheck = checkFileTool(input.tool_name, input.tool_input);
     if (fileCheck.blocked) {
@@ -1917,8 +1937,7 @@ This will auto-reject if not approved.`,
       };
     }
     if (input.tool_name.startsWith("mcp__")) {
-      const config3 = await readConfig();
-      const isAllowed = config3.allowedMCPTools.some((pattern) => {
+      const isAllowed = config2.allowedMCPTools.some((pattern) => {
         if (pattern.endsWith("*")) {
           const prefix = pattern.slice(0, -1);
           return input.tool_name.startsWith(prefix);
@@ -1962,7 +1981,6 @@ Auto-reject in ${TIMEOUT_SECONDS}s.`
     };
   }
   const command = input.tool_input.command;
-  const config2 = await readConfig();
   for (const pattern of config2.customPatterns.allow) {
     try {
       if (new RegExp(pattern, "i").test(command)) {
@@ -2043,7 +2061,7 @@ Only proceed if you know what you're doing.`
     };
   }
   process.stderr.write("\x1B[90m[vibesafu] Assessing security risks...\x1B[0m\n");
-  const triage = await triageWithHaiku(anthropicClient, checkpoint);
+  const triage = await triageWithHaiku(anthropicClient, checkpoint, config2.models.triage);
   if (triage.classification === "BLOCK") {
     return {
       decision: "deny",
@@ -2059,7 +2077,7 @@ Only proceed if you know what you're doing.`
     };
   }
   process.stderr.write("\x1B[90m[vibesafu] Escalating to deep analysis...\x1B[0m\n");
-  const review = await reviewWithSonnet(anthropicClient, checkpoint, triage);
+  const review = await reviewWithSonnet(anthropicClient, checkpoint, triage, config2.models.review);
   if (review.verdict === "BLOCK") {
     const result2 = {
       decision: "deny",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibesafu",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "description": "Better Claude Code workflow with smart safety checks. Safe YOLO mode without --dangerously-skip-permission",
   "type": "module",
   "main": "dist/index.js",