verify-cc-safety-net

# Verify cc-safety-net cc-safety-net is a CLI (`cc-safety-net` / `ccsn`) that coding-agent CLIs invoke as a pre-tool-use hook: JSON describing a tool call arrives on stdin, an allow/deny decision leaves on stdout, and every decision is appended to an audit log under the active home. Users also run diagnostic commands (`status`, `doctor`, `explain`, `logs`) and a local web GUI (`gui`). **Safety invariants for every run:** - Command strings under test (`git reset --hard`, `rm -rf /`, …) are analyzer INPUT. They go into a JSON payload or an `explain` argument. Never execute one in a shell. - Never run the CLI against the real home. Every invocation goes through `./ccsn-isolated` (see Helpers), which redirects `HOME`, `CC_SAFETY_NET_HOME`, and `CC_SAFETY_NET_AUDIT_HOME` into a disposable directory. A bare `bun run src/cli/cc-safety-net.ts` writes to the developer's real `~/.cc-safety-net/logs`. - Never drive `install`, `update`, or `uninstall` (CLI or GUI Integrations tab) in a verification run: install detection and npx-cache clearing reach real machine state beyond `$HOME`. ## Launch No build step: the CLI runs from source with bun. Set up one isolated run: ```bash REPO=/Users/kenryu/Developer/420024-lab/cc-safety-net # or `git rev-parse --show-toplevel` RUN_ID=verify-$(date +%Y%m%d-%H%M%S) export CCSN_VERIFY_HOME=$REPO/artifacts/verify-homes/$RUN_ID # disposable fake $HOME EVIDENCE=$REPO/artifacts/verify/$RUN_ID # proof artifacts (git...