@lenne.tech/cli 1.50.6 → 1.51.0

package/build/extensions/template.js

@@ -10,6 +10,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TemplateHelper = void 0;
+const exec_args_1 = require("../lib/exec-args");
 /**
  * Template helper functions for project scaffolding
  * Provides reusable methods for copying, linking, and cloning templates
@@ -77,7 +78,7 @@ class TemplateHelper {
      */
     linkLocal(source_1, dest_1) {
         return __awaiter(this, arguments, void 0, function* (source, dest, options = {}) {
-            const { filesystem, print: { error, info }, system, } = this.toolbox;
+            const { filesystem, print: { error, info }, } = this.toolbox;
             const opts = Object.assign({ showInfo: true, showWarning: true }, options);
             const templatePath = filesystem.path(source);
             if (!filesystem.isDirectory(templatePath)) {
@@ -85,7 +86,8 @@ class TemplateHelper {
                 return { method: 'link', path: templatePath, success: false };
             }
             try {
-                yield system.run(`ln -s "${templatePath}" "${dest}"`);
+                // No shell: the template path comes from a --*-link flag or lt.config (see exec-args.ts).
+                yield (0, exec_args_1.execArgs)('ln', ['-s', '--', templatePath, dest]);
                 if (opts.showInfo) {
                     info(`Symlinked to: ${templatePath}`);
                 }
@@ -110,11 +112,12 @@ class TemplateHelper {
      */
     cloneRemote(repoUrl_1, dest_1) {
         return __awaiter(this, arguments, void 0, function* (repoUrl, dest, options = {}) {
-            const { filesystem, print: { error, info }, system, } = this.toolbox;
+            const { filesystem, print: { error, info }, } = this.toolbox;
             const opts = Object.assign({ removeGit: true, showInfo: true }, options);
-            const branchArg = opts.branch ? ` -b ${opts.branch}` : '';
             try {
-                yield system.run(`git clone${branchArg} ${repoUrl} "${dest}"`);
+                // Argument list, no shell: branch and URL come from CLI flags and lt.config files (see
+                // exec-args.ts). `--` keeps a URL that starts with `-` from being read as an option.
+                yield (0, exec_args_1.execArgs)('git', ['clone', ...(opts.branch ? ['-b', opts.branch] : []), '--', repoUrl, dest]);
                 if (opts.removeGit && filesystem.exists(`${dest}/.git`)) {
                     filesystem.remove(`${dest}/.git`);
                 }

package/build/extensions/typescript.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Typescript = void 0;
 const fs = __importStar(require("fs"));
 const path_1 = require("path");
+const exec_args_1 = require("../lib/exec-args");
 /**
  * Common helper functions
  */
@@ -81,7 +82,7 @@ class Typescript {
             const cloneSpin = spin(`Init project ${name}`);
             // Init gts
             fs.mkdirSync(dir);
-            yield run(`cd ${dir} && npm init -y && npx gts init && npm install -D ts-node`);
+            yield run('npm init -y && npx gts init && npm install -D ts-node', { cwd: dir });
             // Prepare package.json
             const { data, path } = yield npm.getPackageJson({
                 cwd: dir,
@@ -145,14 +146,14 @@ class Typescript {
             // Clone
             const repository = 'https://github.com/chinchang/web-maker.git';
             const cloneSpin = spin(`Cloning web-maker: ${repository}`);
-            yield run(`git clone ${repository} ${dir}`);
+            yield (0, exec_args_1.execArgs)('git', ['clone', '--', repository, dir]);
             cloneSpin.succeed();
             // Install packages
             if (yield npm.install({ cwd: dir, showError: true })) {
                 return;
             }
             // Start
-            yield run(`cd ${dir} && npm start`);
+            yield run('npm start', { cwd: dir });
         });
     }
 }

package/build/lib/caddy.js

@@ -12,6 +12,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.paths = void 0;
 exports.caddyAvailable = caddyAvailable;
 exports.caddyDaemonRunning = caddyDaemonRunning;
+exports.ensureLoopbackBind = ensureLoopbackBind;
+exports.healLoopbackBind = healLoopbackBind;
 exports.readCaddyfile = readCaddyfile;
 exports.reloadCaddy = reloadCaddy;
 exports.removeProjectBlock = removeProjectBlock;
@@ -45,6 +47,14 @@ const CADDYFILE_PATH = process.env.LT_DEV_CADDYFILE || (0, path_1.join)((0, os_1
 /** Upstream connection cap per route — well below the 128 of macOS `somaxconn` (see `renderProjectBlock`). */
 const UPSTREAM_MAX_CONNS = 32;
 const HEADER = '# Managed by `lt dev`. Per-project blocks are bounded by `# >>> lt-dev:<slug> >>>` markers.';
+/**
+ * Global options block that keeps Caddy on the loopback interfaces. Without it every site block
+ * listens on `*:443`/`*:80`, so a running stack answers anyone on the same network who sends
+ * the right Host header (`curl --resolve`), including the `lt dev test` stack with its seeded
+ * admin, whose password is in this public repository (`TEST_INITIAL_ADMIN_ENV`). `*.localhost`
+ * does not resolve on other machines anyway, so nothing legitimate is lost.
+ */
+const LOOPBACK_BIND = 'default_bind 127.0.0.1 [::1]';
 /** Detect whether `caddy` is on PATH. */
 function caddyAvailable() {
     return __awaiter(this, void 0, void 0, function* () {
@@ -70,6 +80,63 @@ function caddyDaemonRunning() {
         return (yield (0, dev_process_1.httpStatus)('http://127.0.0.1:2019/config/', 2000)) !== null;
     });
 }
+/**
+ * Make sure a Caddyfile binds to loopback only. Pure and idempotent.
+ *
+ * - No global options block: one is inserted after the leading comments (the global block
+ *   must be the first block of a Caddyfile).
+ * - A global block without `default_bind`: the option is added inside it, the rest is kept.
+ * - A global block that already sets `default_bind`: unchanged, whatever it binds to. That is
+ *   a deliberate choice of the user, not something to overwrite.
+ * @param content - Caddyfile content
+ * @returns Content with a loopback `default_bind`
+ */
+function ensureLoopbackBind(content) {
+    const lines = content.split('\n');
+    const first = lines.findIndex((line) => line.trim() !== '' && !line.trim().startsWith('#'));
+    if (first !== -1 && lines[first].trim() === '{') {
+        let depth = 0;
+        let end = lines.length - 1;
+        for (let i = first; i < lines.length; i++) {
+            const code = lines[i].replace(/#.*$/, '');
+            depth += (code.match(/\{/g) || []).length - (code.match(/\}/g) || []).length;
+            if (depth === 0) {
+                end = i;
+                break;
+            }
+        }
+        if (lines.slice(first + 1, end).some((line) => /^\s*default_bind\b/.test(line))) {
+            return content;
+        }
+        return [...lines.slice(0, first + 1), `\t${LOOPBACK_BIND}`, ...lines.slice(first + 1)].join('\n');
+    }
+    // Insert before the first site block AND before the first project marker: a block placed
+    // between `# >>> lt-dev:<slug> >>>` and its site would be removed with that project.
+    const block = ['{', `\t${LOOPBACK_BIND}`, '}'];
+    const insertAt = lines.findIndex((line) => line.trim() !== '' && (!line.trim().startsWith('#') || line.trim().startsWith('# >>> lt-dev:')));
+    if (insertAt === -1) {
+        const body = content.replace(/\n+$/, '');
+        return body ? `${body}\n\n${block.join('\n')}\n` : `${block.join('\n')}\n`;
+    }
+    const head = lines.slice(0, insertAt);
+    while (head.length > 0 && head[head.length - 1].trim() === '')
+        head.pop();
+    return [...head, ...(head.length > 0 ? [''] : []), ...block, '', ...lines.slice(insertAt)].join('\n');
+}
+/**
+ * Add the loopback bind to an existing Caddyfile that lacks it. For paths that do not upsert a
+ * project block, such as `lt dev up` on a stack that is already running: without this, a stack
+ * started before the bind existed stays reachable from the LAN until its next restart.
+ * @returns true if the Caddyfile was changed (the caller reloads Caddy)
+ */
+function healLoopbackBind() {
+    const current = readCaddyfile();
+    if (!current || ensureLoopbackBind(current) === current) {
+        return false;
+    }
+    writeCaddyfile(current);
+    return true;
+}
 /** Read the current Caddyfile (or empty string). */
 function readCaddyfile() {
     if (!(0, fs_1.existsSync)(CADDYFILE_PATH))
@@ -165,7 +232,10 @@ function upsertProjectBlock(slug, routes) {
     else {
         next = current.length > 0 ? `${current.replace(/\n+$/, '')}\n\n${block}` : block;
     }
-    if (next === current.replace(/\s+$/, ''))
+    // Also heals a Caddyfile written before the loopback bind existed: the reload that follows
+    // every upsert then moves the running Caddy off the LAN interfaces.
+    next = ensureLoopbackBind(next);
+    if (next.replace(/\s+$/, '') === current.replace(/\s+$/, ''))
         return false;
     writeCaddyfile(next);
     return true;
@@ -179,7 +249,7 @@ function validateCaddyfile() {
 /** Write the Caddyfile, ensuring the parent directory exists. */
 function writeCaddyfile(content) {
     (0, fs_1.mkdirSync)((0, path_1.dirname)(CADDYFILE_PATH), { recursive: true });
-    const next = content.startsWith('#') ? content : `${HEADER}\n\n${content}`;
+    const next = ensureLoopbackBind(content.startsWith('#') ? content : `${HEADER}\n\n${content}`);
     (0, fs_1.writeFileSync)(CADDYFILE_PATH, next.endsWith('\n') ? next : `${next}\n`, 'utf8');
 }
 /** Run a caddy subcommand and capture stdout/stderr. */

package/build/lib/claude-cli.js

@@ -4,6 +4,7 @@ exports.CLAUDE_KNOWN_MARKETPLACES_PATH = exports.CLAUDE_MARKETPLACES_DIR = void
 exports.checkCommandExists = checkCommandExists;
 exports.checkMarketplaceExists = checkMarketplaceExists;
 exports.findClaudeCli = findClaudeCli;
+exports.getClaudeConfigDir = getClaudeConfigDir;
 exports.listKnownMarketplaceNames = listKnownMarketplaceNames;
 exports.readKnownMarketplaces = readKnownMarketplaces;
 exports.runClaudeCommand = runClaudeCommand;
@@ -18,11 +19,11 @@ const platform_1 = require("./platform");
 /**
  * Path to Claude plugins marketplaces directory
  */
-exports.CLAUDE_MARKETPLACES_DIR = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'plugins', 'marketplaces');
+exports.CLAUDE_MARKETPLACES_DIR = (0, path_1.join)(getClaudeConfigDir(), 'plugins', 'marketplaces');
 /**
  * Path to the Claude CLI's registry of known marketplaces (name → source).
  */
-exports.CLAUDE_KNOWN_MARKETPLACES_PATH = (0, path_1.join)((0, os_1.homedir)(), '.claude', 'plugins', 'known_marketplaces.json');
+exports.CLAUDE_KNOWN_MARKETPLACES_PATH = (0, path_1.join)(getClaudeConfigDir(), 'plugins', 'known_marketplaces.json');
 /**
  * Check if a shell command exists and succeeds
  * @param command - Command to check (e.g., 'which typescript-language-server')
@@ -62,6 +63,20 @@ function findClaudeCli(options = {}) {
         : [path_1.posix.join(home, '.claude', 'local', 'claude'), '/usr/local/bin/claude', '/usr/bin/claude'];
     return (0, platform_1.findExecutable)('claude', Object.assign(Object.assign({}, options), { candidates, env, platform }));
 }
+/**
+ * Claude Code's configuration directory: `CLAUDE_CONFIG_DIR` when set, else `~/.claude`.
+ * settings.json, the marketplace clones and the plugin cache all live below it, and the
+ * `claude` child processes this CLI starts inherit the variable, so every Claude path the
+ * CLI derives has to start here or it reads and writes a different installation.
+ * @param env - Environment to read (injectable for tests)
+ * @param home - Home directory (injectable for tests)
+ * @returns Absolute path of the configuration directory
+ */
+function getClaudeConfigDir(env = process.env, home = (0, os_1.homedir)()) {
+    var _a;
+    const configured = (_a = env.CLAUDE_CONFIG_DIR) === null || _a === void 0 ? void 0 : _a.trim();
+    return configured ? (0, path_1.resolve)(configured) : (0, path_1.join)(home, '.claude');
+}
 /**
  * List the names of all marketplaces known to the Claude CLI.
  * @returns Array of marketplace names

package/build/lib/exec-args.js

@@ -0,0 +1,117 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.execArgs = execArgs;
+exports.hasCmdShimHazard = hasCmdShimHazard;
+exports.isSafeRef = isSafeRef;
+exports.safeRef = safeRef;
+exports.spawnArgs = spawnArgs;
+/**
+ * Run a program with an argument list, without a shell.
+ *
+ * gluegun's `system.run` hands its whole string to `child_process.exec`, i.e. to `/bin/sh` or
+ * `cmd.exe`. Every value interpolated into that string is shell syntax there: a branch named
+ * `main;curl …|sh`, a remote URL, a commit message, a value from a repository's `lt.config.json`.
+ * Quoting does not fix it portably (`cmd.exe` has no single quotes), and validation cannot cover
+ * free text. Git itself allows `;`, `|`, `$`, `(` and backticks in ref names, so even a name read
+ * back from git output is not safe to interpolate. With an argument list nothing is parsed.
+ */
+const child_process_1 = require("child_process");
+const platform_1 = require("./platform");
+/**
+ * Run `command` with `args` and resolve with its stdout. Rejects like gluegun's `system.run`:
+ * with the child_process error (message `Command failed: …` plus stderr) carrying `stdout`
+ * and `stderr`, so existing error handling keeps working unchanged.
+ * @param command - Program to run, looked up on PATH (no shell, so no `.cmd` shims on Windows)
+ * @param args - Arguments, passed through verbatim
+ * @param options - Working directory, environment, trimming
+ * @returns stdout of the program
+ */
+function execArgs(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        var _a;
+        (0, child_process_1.execFile)(command, [...args], { cwd: options.cwd, env: (_a = options.env) !== null && _a !== void 0 ? _a : process.env, maxBuffer: 1024 * 1024, windowsHide: true }, (error, stdout, stderr) => {
+            if (error) {
+                Object.assign(error, { stderr, stdout });
+                reject(error);
+                return;
+            }
+            const out = String(stdout !== null && stdout !== void 0 ? stdout : '');
+            resolve(options.trim ? out.trim() : out);
+        });
+    });
+}
+/**
+ * Whether a value is unsafe as an argument to {@link spawnArgs} on Windows. cross-spawn runs a
+ * `.cmd` shim through `cmd.exe` with escaped arguments, but the shim re-parses its `%*`: a `"`
+ * ends the quoting, `%` expands variables and a line break ends the command. On macOS and
+ * Linux there is no shell and every value is safe.
+ * @param value - Argument from a flag or a config file
+ * @param platform - `process.platform`
+ * @returns true if the value must be refused before it reaches a Windows shim
+ */
+function hasCmdShimHazard(value, platform = process.platform) {
+    return platform === 'win32' && /["%\r\n]/.test(value);
+}
+/**
+ * Whether a value can be passed to git as a ref argument (see {@link safeRef}). Surrounding
+ * whitespace is ignored: values read back from git output end in a newline.
+ * @param ref - Ref name from a flag, a config file or git output
+ * @returns false if the ref is empty, starts with `-`, or contains whitespace or control characters
+ */
+function isSafeRef(ref) {
+    // String(): gluegun hands a digits-only value over as a number (`lt git create 2314 main`).
+    const value = String(ref !== null && ref !== void 0 ? ref : '').trim();
+    const hasControlChar = [...value].some((char) => char.charCodeAt(0) < 0x20 || char.charCodeAt(0) === 0x7f);
+    return Boolean(value) && !value.startsWith('-') && !/\s/.test(value) && !hasControlChar;
+}
+/**
+ * Guard a git ref (branch, tag, base) that is passed as a positional argument. Without a shell
+ * the value cannot run a command, but git would still read a leading `-` as an option
+ * (`git checkout --orphan=x`). Git refuses such branch names itself, as it refuses whitespace
+ * and control characters, so no legitimate ref is rejected.
+ * @param ref - Ref name from a flag, a config file or git output
+ * @returns The ref without surrounding whitespace (git output ends in a newline, which the
+ *   former shell strings silently treated as the end of the command)
+ * @throws If the ref is empty, starts with `-`, or contains whitespace or control characters
+ */
+function safeRef(ref) {
+    if (!isSafeRef(ref)) {
+        throw new Error(`Refusing "${ref}" as a git ref: it is empty, starts with "-", or contains whitespace`);
+    }
+    return String(ref).trim();
+}
+/**
+ * {@link execArgs} for programs that are npm `.cmd` shims on Windows (npm, pnpm, npx, a `bun`
+ * or any CLI installed with `npm i -g`): `execFile` cannot start a `.cmd`. Delegates to
+ * cross-spawn, which uses no shell on macOS/Linux and escaped `cmd.exe` arguments on Windows,
+ * where callers must refuse values that {@link hasCmdShimHazard} reports. Asynchronous on
+ * purpose: a synchronous spawn under a running spinner blocks Ctrl+C until the child exits.
+ * @param command - Program to run
+ * @param args - Arguments, passed through verbatim
+ * @param options - Working directory and environment
+ * @returns stdout of the program
+ */
+function spawnArgs(command, args, options = {}) {
+    return new Promise((resolve, reject) => {
+        var _a, _b, _c;
+        const child = (0, platform_1.spawnCmd)(command, args, {
+            cwd: options.cwd,
+            env: (_a = options.env) !== null && _a !== void 0 ? _a : process.env,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        let stdout = '';
+        let stderr = '';
+        (_b = child.stdout) === null || _b === void 0 ? void 0 : _b.on('data', (chunk) => (stdout += String(chunk)));
+        (_c = child.stderr) === null || _c === void 0 ? void 0 : _c.on('data', (chunk) => (stderr += String(chunk)));
+        child.on('error', reject);
+        child.on('close', (code) => {
+            if (code === 0) {
+                resolve(stdout);
+                return;
+            }
+            const error = new Error(`Command failed: ${command} ${args.join(' ')}\n${stderr}`);
+            reject(Object.assign(error, { code, stderr, stdout }));
+        });
+    });
+}

package/build/lib/plugin-permissions.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getPermissionLedgerPath = getPermissionLedgerPath;
+exports.hasPluginRootVariable = hasPluginRootVariable;
+exports.planPermissionSync = planPermissionSync;
+exports.pluginCacheRootPattern = pluginCacheRootPattern;
+exports.pluginPermissionKey = pluginPermissionKey;
+exports.readLedgerEntries = readLedgerEntries;
+exports.recordLedgerEntry = recordLedgerEntry;
+exports.resolvePluginRootVariable = resolvePluginRootVariable;
+/**
+ * Permission rules that `lt claude plugins` writes into Claude Code's user settings.json.
+ *
+ * Those rules apply in every project, and in auto mode an allow rule takes effect before
+ * the classifier sees the call. Appending the rules a plugin ships is therefore not enough:
+ *
+ * - A rule a plugin stops shipping has to leave settings.json again. The ledger
+ *   (`~/.lenneTech/claude-plugin-permissions.json`) records, per settings file and plugin,
+ *   which rules lt wrote. Each run removes the recorded rules the plugin no longer lists.
+ *   A rule the user wrote is never recorded, so it stays.
+ * - Rules lt wrote before the ledger existed are not recorded anywhere. Each plugin names
+ *   them in `formerPatterns` of its permissions.json, so this public CLI carries no list of
+ *   them (an internal plugin's former rules name internal hosts). Each one is applied once.
+ * - A rule with `${CLAUDE_PLUGIN_ROOT}` is never written. Claude Code does not expand the
+ *   variable in permission rules, so the rule as shipped never matches. Resolving it to the
+ *   cache directory needs a wildcard for the version folder, and Claude Code neither
+ *   normalises paths nor stops a wildcard at `/`. A rule allowing `bash <cache>/<plugin>/`
+ *   followed by any version and `/scripts/` and any name also allowed
+ *   `bash <cache>/<plugin>/1.0.0/scripts/../../../../../../dev/stdin`, which ran piped code
+ *   without a prompt (measured 2026-10-18, also for node). Such rules are removed in both
+ *   spellings.
+ */
+const fs_1 = require("fs");
+const path_1 = require("path");
+const json_utils_1 = require("./json-utils");
+const marketplace_config_1 = require("./marketplace-config");
+const LEDGER_VERSION = 1;
+/**
+ * `${CLAUDE_PLUGIN_ROOT}` and the bare `$CLAUDE_PLUGIN_ROOT`
+ */
+const PLUGIN_ROOT_VARIABLE = /\$\{CLAUDE_PLUGIN_ROOT\}|\$CLAUDE_PLUGIN_ROOT(?!\w)/g;
+/**
+ * Path of the ledger. Resolved at call time so tests can redirect it.
+ * @returns Absolute path to claude-plugin-permissions.json
+ */
+function getPermissionLedgerPath() {
+    return process.env.LT_CLAUDE_PERMISSION_LEDGER || (0, path_1.join)((0, marketplace_config_1.getLtConfigDir)(), 'claude-plugin-permissions.json');
+}
+/**
+ * Whether a rule contains `${CLAUDE_PLUGIN_ROOT}`
+ * @param rule - Permission rule as the plugin ships it
+ * @returns true if the rule still needs resolving
+ */
+function hasPluginRootVariable(rule) {
+    // `search` ignores the g flag and lastIndex, so the shared regex stays stateless here.
+    return rule.search(PLUGIN_ROOT_VARIABLE) !== -1;
+}
+/**
+ * Decide what a run changes in `permissions.allow` for one plugin. Pure.
+ *
+ * Adds every listed rule that is missing. Removes a rule only when lt wrote it for this
+ * plugin, the plugin no longer lists it and the ledger does not record it for another
+ * plugin. "lt wrote it" means: the ledger records it, or the plugin names it in
+ * `formerPatterns` and it has not been applied before, or it is a withdrawn rule. Rules
+ * nobody recorded are the user's.
+ *
+ * Each former rule is applied once, whenever it first shows up, not only on the first run:
+ * a CLI that meets a plugin before the marketplace ships `formerPatterns` must not close
+ * the window for good. Once applied, a rule the user adds back by hand stays.
+ *
+ * Without a ledger entry the listed rules already present are adopted as lt's: lt has been
+ * their installer. A user who wrote an identical rule by hand may then see it removed once
+ * the plugin drops it, which costs a prompt. Leaving a broad rule lt wrote in place would
+ * cost more.
+ * @param input - Current settings, ledger state and the plugin's rules
+ * @returns Rules to add and remove, the next allow list and the next ledger entry
+ */
+function planPermissionSync(input) {
+    var _a, _b;
+    const listed = [...new Set(input.listed)];
+    const present = new Set(input.allow);
+    const added = listed.filter((rule) => !present.has(rule));
+    const existing = listed.filter((rule) => present.has(rule));
+    const applied = new Set(input.formerApplied);
+    const formerDue = input.formerRules.filter((rule) => !applied.has(rule));
+    const writtenByLt = new Set([...((_a = input.owned) !== null && _a !== void 0 ? _a : []), ...formerDue, ...input.withdrawnRules]);
+    const keep = new Set([...listed, ...input.ownedByOthers]);
+    const removed = [...writtenByLt].filter((rule) => present.has(rule) && !keep.has(rule));
+    const removedSet = new Set(removed);
+    const ownedBefore = new Set([...((_b = input.owned) !== null && _b !== void 0 ? _b : existing), ...added]);
+    return {
+        added,
+        allow: [...input.allow.filter((rule) => !removedSet.has(rule)), ...added],
+        existing,
+        ledger: {
+            formerApplied: [...new Set([...input.formerApplied, ...input.formerRules])],
+            owned: listed.filter((rule) => ownedBefore.has(rule)),
+        },
+        removed,
+    };
+}
+/**
+ * The plugin's cache directory (`<config dir>/plugins/cache/<marketplace>/<plugin>/<version>/`)
+ * with a wildcard for the version folder: the form a pre-release build put in place of
+ * `${CLAUDE_PLUGIN_ROOT}`. Used only to recognise and remove such rules. NEVER write a rule
+ * built from it: the `*` also matches `../`, so the rule allows any file (see the file header).
+ * @param claudeConfigDir - Claude Code's configuration directory
+ * @param marketplaceName - Name of the marketplace
+ * @param pluginName - Name of the plugin
+ * @returns Absolute path pattern ending in the version wildcard
+ */
+function pluginCacheRootPattern(claudeConfigDir, marketplaceName, pluginName) {
+    return (0, path_1.join)(claudeConfigDir, 'plugins', 'cache', marketplaceName, pluginName, '*');
+}
+/**
+ * Key of a plugin in the ledger
+ * @param marketplaceName - Name of the marketplace
+ * @param pluginName - Name of the plugin
+ * @returns `<marketplace>/<plugin>`
+ */
+function pluginPermissionKey(marketplaceName, pluginName) {
+    return `${marketplaceName}/${pluginName}`;
+}
+/**
+ * Ledger entries for one settings file. Never throws: a missing or unreadable ledger reads
+ * as empty, which only means every plugin is treated as seen for the first time.
+ * @param ledgerPath - Path of the ledger
+ * @param settingsPath - settings.json the rules were written to
+ * @returns `<marketplace>/<plugin>` → entry
+ */
+function readLedgerEntries(ledgerPath, settingsPath) {
+    var _a;
+    return (_a = readLedger(ledgerPath).settings[settingsPath]) !== null && _a !== void 0 ? _a : {};
+}
+/**
+ * Record a plugin's ledger entry. Written via temp file + rename, so an interrupted run
+ * cannot leave a truncated ledger.
+ * @param ledgerPath - Path of the ledger
+ * @param settingsPath - settings.json the rules were written to
+ * @param pluginKey - `<marketplace>/<plugin>`
+ * @param entry - The plugin's entry
+ */
+function recordLedgerEntry(ledgerPath, settingsPath, pluginKey, entry) {
+    const ledger = readLedger(ledgerPath);
+    ledger.settings[settingsPath] = Object.assign(Object.assign({}, ledger.settings[settingsPath]), { [pluginKey]: entry });
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(ledgerPath), { recursive: true });
+    const tmpPath = `${ledgerPath}.${process.pid}.tmp`;
+    (0, fs_1.writeFileSync)(tmpPath, `${JSON.stringify(ledger, null, 2)}\n`);
+    (0, fs_1.renameSync)(tmpPath, ledgerPath);
+}
+/**
+ * Replace `${CLAUDE_PLUGIN_ROOT}` in a rule. A rule without the variable comes back unchanged.
+ * @param rule - Permission rule as the plugin ships it
+ * @param pluginRoot - Replacement, usually {@link pluginCacheRootPattern}
+ * @returns The rule as it has to be written to settings.json
+ */
+function resolvePluginRootVariable(rule, pluginRoot) {
+    // A replacer function, so a `$` in the path is not read as a replacement pattern.
+    return rule.replace(PLUGIN_ROOT_VARIABLE, () => pluginRoot);
+}
+/**
+ * Read and validate the ledger. Entries of the wrong shape are dropped.
+ * @param ledgerPath - Path of the ledger
+ * @returns The ledger, empty when missing or unreadable
+ */
+function readLedger(ledgerPath) {
+    const ledger = { settings: {}, version: LEDGER_VERSION };
+    let parsed = null;
+    try {
+        parsed = (0, fs_1.existsSync)(ledgerPath)
+            ? (0, json_utils_1.safeJsonParse)((0, fs_1.readFileSync)(ledgerPath, 'utf-8'))
+            : null;
+    }
+    catch (_a) {
+        return ledger;
+    }
+    if (!parsed || typeof parsed.settings !== 'object' || parsed.settings === null) {
+        return ledger;
+    }
+    for (const [settingsPath, plugins] of Object.entries(parsed.settings)) {
+        if (typeof plugins !== 'object' || plugins === null) {
+            continue;
+        }
+        const entries = {};
+        for (const [pluginKey, entry] of Object.entries(plugins)) {
+            if (typeof entry === 'object' && entry !== null && Array.isArray(entry.owned)) {
+                entries[pluginKey] = { formerApplied: stringsOf(entry.formerApplied), owned: stringsOf(entry.owned) };
+            }
+        }
+        ledger.settings[settingsPath] = entries;
+    }
+    return ledger;
+}
+/**
+ * The string elements of a value that should be a string list
+ * @param value - Parsed JSON value
+ * @returns Its strings, or an empty list
+ */
+function stringsOf(value) {
+    return Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+}