Adds a cc-safety-net/api library entry so Node.js hosts can check a command in-process without installing an agent integration, and hardens --delete-source so it can no longer remove files a concurrent process added.
Added
- Added the
cc-safety-net/apipackage entry exportingcheckCommand({ command, cwd }), which returns anallowordenydecision for a single shell command without executing it, writing audit data, changing configuration, or making network requests. Denials include a displayreasonand an optionalruleId. (#89) - Added an absolute-path
cwdrequirement tocheckCommand, which anchors relative command targets and selects the project policy so the check never falls back to hidden process state. An unusable directory fails closed with a deny. (#89) - Added TypeScript declarations for the new entry, so
checkCommandandCheckCommandResulttype-check fromcc-safety-net/apialone without any optional agent-integration packages installed. The entry requires Node.js 18 or later and ESM; there is no CommonJS build. (#89)
Fixed
- Fixed
--delete-sourcerecursively deleting files that a concurrent process added to a rulebook source directory after the pre-sync safeguard ran but before the delete. The safeguard now re-runs at delete time, an unexpected file refuses the delete with the existing "delete manually" error and a clean configuration rollback, and only the validatedrulebook.jsonplus the then-empty directory are removed. (#88) - Fixed
--delete-sourcereporting a failure when the source directory was already removed during the sync, which is the requested end state. (#88)