@pennyfarthing/cyclist 9.3.0 → 10.0.0

package/dist/api/hook-request.d.ts

@@ -16,6 +16,16 @@
  */
 import { Router } from 'express';
 import { WebSocket } from 'ws';
+export type HookSeverity = 'safe' | 'normal' | 'destructive';
+interface SeverityResult {
+    severity: HookSeverity;
+    warning?: string;
+}
+/**
+ * Classify the severity of a hook request server-side.
+ * Combines tool-name classification with dangerous-path detection.
+ */
+export declare function classifyHookSeverity(toolName: string, input: Record<string, unknown>): SeverityResult;
 export declare function getHookClients(): Set<WebSocket>;
 export declare function addHookClient(ws: WebSocket): void;
 /**
@@ -27,4 +37,5 @@ export declare function resolveApproval(toolId: string, approved: boolean, data?
  */
 export declare function handleHookWebSocketMessage(ws: WebSocket, message: string): void;
 export declare function createHookRequestRouter(): Router;
+export {};
 //# sourceMappingURL=hook-request.d.ts.map

package/dist/api/hook-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook-request.d.ts","sourceRoot":"","sources":["../../src/api/hook-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAuE/B,wBAAgB,cAAc,IAAI,GAAG,CAAC,SAAS,CAAC,CAE/C;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAGjD;AA4BD;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAcT;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAU/E;AA0ED,wBAAgB,uBAAuB,IAAI,MAAM,CAkBhD"}
+{"version":3,"file":"hook-request.d.ts","sourceRoot":"","sources":["../../src/api/hook-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AA2E/B,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE7D,UAAU,cAAc;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAuBD;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,cAAc,CAkDhB;AAMD,wBAAgB,cAAc,IAAI,GAAG,CAAC,SAAS,CAAC,CAE/C;AAED,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,IAAI,CAGjD;AA+BD;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,EACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAcT;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CA6B/E;AAwFD,wBAAgB,uBAAuB,IAAI,MAAM,CAkBhD"}

package/dist/api/hook-request.js

@@ -16,6 +16,8 @@
  */
 import { Router } from 'express';
 import { WebSocket } from 'ws';
+import { checkGrant, isAllowlisted, addGrant } from '../settings-store.js';
+import { isDangerousPath, getPathCategory, extractBashTargetPaths } from '../dangerous-path.js';
 // =============================================================================
 // State
 // =============================================================================
@@ -26,24 +28,90 @@ const hookClients = new Set();
 // Approval timeout (2 minutes)
 const APPROVAL_TIMEOUT_MS = 120000;
 // =============================================================================
-// Allowlist and Grants (imported from settings-store when available)
+// Scope Extraction (MSSCI-14321)
 // =============================================================================
-// Temporary allowlist for common safe commands
-const SAFE_COMMAND_PATTERNS = [
-    /^ls\b/,
-    /^pwd$/,
-    /^echo\b/,
-    /^cat\b.*\.(md|txt|json|yaml|yml|ts|js|py|sh)$/,
-    /^git status/,
-    /^git diff/,
-    /^git log/,
-    /^git branch/,
-    /^npm run (build|test|lint)/,
-    /^node --version/,
-    /^npm --version/,
+/**
+ * Extract the scope identifier from tool input for grant matching.
+ * Modeled after getToolScope() in approval-gate.ts.
+ */
+function extractToolScope(toolName, input) {
+    switch (toolName) {
+        case 'Bash':
+            return input.command || '';
+        case 'WebFetch':
+            return input.url || '';
+        case 'Edit':
+        case 'Write':
+        case 'Read':
+            return input.file_path || '';
+        default:
+            return JSON.stringify(input);
+    }
+}
+const SAFE_TOOLS = new Set(['Read', 'Grep', 'Glob', 'WebSearch']);
+const DESTRUCTIVE_BASH_PATTERNS = [
+    /rm\s+(-[rf]+\s+)*/,
+    /git\s+(reset\s+--hard|push\s+--force|clean\s+-[fd])/,
+    /drop\s+database/i,
+    /truncate\s+table/i,
 ];
-function isCommandAllowlisted(command) {
-    return SAFE_COMMAND_PATTERNS.some(pattern => pattern.test(command.trim()));
+const SAFE_BASH_PATTERNS = [
+    /^(ls|cat|head|tail|grep|find|pwd|echo|which|type|file|stat|wc|diff)\b/,
+    /^git\s+(status|log|diff|show|branch|remote)\b/,
+];
+const CATEGORY_WARNINGS = {
+    secrets: 'Modifying sensitive secrets/credentials file',
+    git: 'Modifying git internals',
+    dependencies: 'Modifying dependency files',
+    system: 'Modifying system files',
+};
+/**
+ * Classify the severity of a hook request server-side.
+ * Combines tool-name classification with dangerous-path detection.
+ */
+export function classifyHookSeverity(toolName, input) {
+    // Safe tools are always safe
+    if (SAFE_TOOLS.has(toolName)) {
+        return { severity: 'safe' };
+    }
+    // Check dangerous paths for Write/Edit
+    if (toolName === 'Write' || toolName === 'Edit') {
+        const filePath = input.file_path || '';
+        if (filePath && isDangerousPath(filePath)) {
+            const category = getPathCategory(filePath);
+            return {
+                severity: 'destructive',
+                warning: category ? CATEGORY_WARNINGS[category] : 'Modifying sensitive path',
+            };
+        }
+        return { severity: 'normal' };
+    }
+    // Bash command classification
+    if (toolName === 'Bash') {
+        const command = input.command || '';
+        // Check for destructive bash patterns
+        if (DESTRUCTIVE_BASH_PATTERNS.some(p => p.test(command))) {
+            return { severity: 'destructive', warning: 'Destructive command detected' };
+        }
+        // Check for bash redirecting to dangerous paths
+        const targetPaths = extractBashTargetPaths(command);
+        for (const targetPath of targetPaths) {
+            if (isDangerousPath(targetPath)) {
+                const category = getPathCategory(targetPath);
+                return {
+                    severity: 'destructive',
+                    warning: category ? CATEGORY_WARNINGS[category] : 'Redirecting to sensitive path',
+                };
+            }
+        }
+        // Check for safe bash patterns
+        if (SAFE_BASH_PATTERNS.some(p => p.test(command))) {
+            return { severity: 'safe' };
+        }
+        return { severity: 'normal' };
+    }
+    // Default: normal
+    return { severity: 'normal' };
 }
 // =============================================================================
 // WebSocket Client Management
@@ -92,6 +160,24 @@ export function handleHookWebSocketMessage(ws, message) {
     try {
         const data = JSON.parse(message);
         if (data.type === 'hook-response') {
+            // Store grant if user approved with a grantScope (MSSCI-14321 AC8)
+            if (data.approved && data.data?.grantScope) {
+                const pending = pendingApprovals.get(data.toolId);
+                const scope = pending
+                    ? extractToolScope(pending.toolName, pending.input)
+                    : '';
+                const grant = {
+                    tool: pending?.toolName || '',
+                    scope,
+                    grant_type: data.data.grantScope,
+                    granted_at: new Date().toISOString(),
+                };
+                // Include agent from the original request if present
+                if (pending?.agent) {
+                    grant.agent = pending.agent;
+                }
+                addGrant(grant);
+            }
             resolveApproval(data.toolId, data.approved, data.data);
         }
     }
@@ -103,21 +189,27 @@ export function handleHookWebSocketMessage(ws, message) {
 // Request Handler
 // =============================================================================
 async function handleHookRequest(req, res) {
-    const { toolName, toolId, input, sessionId: _sessionId, context } = req.body;
+    const { toolName, toolId, input, sessionId: _sessionId, agent, context } = req.body;
     if (!toolName || !toolId) {
         res.status(400).json({ error: 'Missing required fields: toolName, toolId' });
         return;
     }
-    // Check for auto-approval
-    if (toolName === 'Bash') {
-        const command = input?.command || '';
-        if (isCommandAllowlisted(command)) {
-            res.json({
-                decision: 'allow',
-                reason: 'Command matches safe pattern allowlist',
-            });
-            return;
-        }
+    // Check for auto-approval via grants (all tool types)
+    const scope = extractToolScope(toolName, input || {});
+    if (checkGrant(toolName, scope, agent)) {
+        res.json({
+            decision: 'allow',
+            reason: 'Granted by permission grant',
+        });
+        return;
+    }
+    // Check Bash allowlist for backward compatibility
+    if (toolName === 'Bash' && isAllowlisted(scope)) {
+        res.json({
+            decision: 'allow',
+            reason: 'Command matches allowlist pattern',
+        });
+        return;
     }
     // No clients connected - fall through to Claude Code's built-in approval
     if (hookClients.size === 0) {
@@ -133,6 +225,7 @@ async function handleHookRequest(req, res) {
             resolve,
             toolName,
             input: input || {},
+            agent,
             timestamp: Date.now(),
         });
         // Set timeout
@@ -146,12 +239,17 @@ async function handleHookRequest(req, res) {
             }
         }, APPROVAL_TIMEOUT_MS);
     });
-    // Broadcast to clients (include context for UI display)
+    // Classify severity before broadcast (MSSCI-14323)
+    const { severity, warning } = classifyHookSeverity(toolName, input || {});
+    // Broadcast to clients (include context, severity, and agent for UI display)
     broadcastHookRequest({
         type: 'hook-request',
         toolId,
         toolName,
         input: input || {},
+        severity,
+        warning,
+        agent,
         context,
     });
     // Wait for response

package/dist/api/hook-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-request.js","sourceRoot":"","sources":["../../src/api/hook-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AA+B/B,gFAAgF;AAChF,QAAQ;AACR,gFAAgF;AAEhF,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,2CAA2C;AAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAa,CAAC;AAEzC,+BAA+B;AAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,gFAAgF;AAChF,qEAAqE;AACrE,gFAAgF;AAEhF,+CAA+C;AAC/C,MAAM,qBAAqB,GAAG;IAC5B,OAAO;IACP,OAAO;IACP,SAAS;IACT,+CAA+C;IAC/C,aAAa;IACb,WAAW;IACX,UAAU;IACV,aAAa;IACb,4BAA4B;IAC5B,iBAAiB;IACjB,gBAAgB;CACjB,CAAC;AAEF,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAa;IACzC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAU7B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,QAAiB,EACjB,IAA8B;IAE9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACrC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;QAC1D,IAAI;KACL,CAAC,CAAC;IAEH,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAa,EAAE,OAAe;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa;IAC1D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAmB,CAAC;IAE5F,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,0BAA0B;IAC1B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAI,KAAK,EAAE,OAAkB,IAAI,EAAE,CAAC;QACjD,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,wCAAwC;aACjD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,wDAAwD;SACjE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,uCAAuC;IACvC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;QAC5D,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE;YAC3B,OAAO;YACP,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,EAAE;YAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,cAAc;QACd,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,CAAC;oBACN,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,4CAA4C;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,wDAAwD;IACxD,oBAAoB,CAAC;QACnB,IAAI,EAAE,cAAc;QACpB,MAAM;QACN,QAAQ;QACR,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,OAAO;KACR,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;IACvC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAEpC,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS;SAC9B,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"hook-request.js","sourceRoot":"","sources":["../../src/api/hook-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAuB,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAiChG,gFAAgF;AAChF,QAAQ;AACR,gFAAgF;AAEhF,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE5D,2CAA2C;AAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAa,CAAC;AAEzC,+BAA+B;AAC/B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF;;;GAGG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAA8B;IACxE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAQ,KAAK,CAAC,OAAkB,IAAI,EAAE,CAAC;QACzC,KAAK,UAAU;YACb,OAAQ,KAAK,CAAC,GAAc,IAAI,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAQ,KAAK,CAAC,SAAoB,IAAI,EAAE,CAAC;QAC3C;YACE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAaD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAElE,MAAM,yBAAyB,GAAG;IAChC,mBAAmB;IACnB,qDAAqD;IACrD,kBAAkB;IAClB,mBAAmB;CACpB,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,uEAAuE;IACvE,+CAA+C;CAChD,CAAC;AAEF,MAAM,iBAAiB,GAA2B;IAChD,OAAO,EAAE,8CAA8C;IACvD,GAAG,EAAE,yBAAyB;IAC9B,YAAY,EAAE,4BAA4B;IAC1C,MAAM,EAAE,wBAAwB;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,KAA8B;IAE9B,6BAA6B;IAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,uCAAuC;IACvC,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAI,KAAK,CAAC,SAAoB,IAAI,EAAE,CAAC;QACnD,IAAI,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO;gBACL,QAAQ,EAAE,aAAa;gBACvB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,0BAA0B;aAC7E,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,8BAA8B;IAC9B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAI,KAAK,CAAC,OAAkB,IAAI,EAAE,CAAC;QAEhD,sCAAsC;QACtC,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QAC9E,CAAC;QAED,gDAAgD;QAChD,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;gBAC7C,OAAO;oBACL,QAAQ,EAAE,aAAa;oBACvB,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,+BAA+B;iBAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IAChC,CAAC;IAED,kBAAkB;IAClB,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAa;IACzC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,IAa7B;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,QAAiB,EACjB,IAA8B;IAE9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACrC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB;QAC1D,IAAI;KACL,CAAC,CAAC;IAEH,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,EAAa,EAAE,OAAe;IACvE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAClC,mEAAmE;YACnE,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAO;oBACnB,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;oBACnD,CAAC,CAAC,EAAE,CAAC;gBACP,MAAM,KAAK,GAAmC;oBAC5C,IAAI,EAAE,OAAO,EAAE,QAAQ,IAAI,EAAE;oBAC7B,KAAK;oBACL,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAA4B;oBAClD,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACrC,CAAC;gBACF,qDAAqD;gBACrD,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;oBACnB,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC9B,CAAC;gBACD,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAED,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,kBAAkB;AAClB,gFAAgF;AAEhF,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,GAAa;IAC1D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAmB,CAAC;IAEnG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,sDAAsD;IACtD,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,6BAA6B;SACtC,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,kDAAkD;IAClD,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,wDAAwD;SACjE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,uCAAuC;IACvC,MAAM,eAAe,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;QAC5D,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE;YAC3B,OAAO;YACP,QAAQ;YACR,KAAK,EAAE,KAAK,IAAI,EAAE;YAClB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;QAEH,cAAc;QACd,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,CAAC;oBACN,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,4CAA4C;iBACrD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EAAE,mBAAmB,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;IAE1E,6EAA6E;IAC7E,oBAAoB,CAAC;QACnB,IAAI,EAAE,cAAc;QACpB,MAAM;QACN,QAAQ;QACR,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,QAAQ;QACR,OAAO;QACP,KAAK;QACL,OAAO;KACR,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC;IACvC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACrB,CAAC;AAED,gFAAgF;AAChF,SAAS;AACT,gFAAgF;AAEhF,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,yDAAyD;IACzD,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAEpC,yEAAyE;IACzE,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvE,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS;SAC9B,CAAC,CAAC,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/hotspots.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+export declare function createHotspotsRouter(getProjectDir: () => string): Router;
+//# sourceMappingURL=hotspots.d.ts.map

package/dist/api/hotspots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hotspots.d.ts","sourceRoot":"","sources":["../../src/api/hotspots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAKjC,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,MAAM,MAAM,GAAG,MAAM,CAqDxE"}

package/dist/api/hotspots.js

@@ -0,0 +1,54 @@
+import { Router } from 'express';
+import { execFile } from 'child_process';
+import { join } from 'path';
+// Create hotspots API router
+export function createHotspotsRouter(getProjectDir) {
+    const router = Router();
+    // GET /api/hotspots?days=90&repo=pennyfarthing
+    router.get('/', (req, res) => {
+        const projectDir = getProjectDir();
+        const days = String(req.query.days || '90');
+        const repo = req.query.repo;
+        const args = [
+            '-m', 'pennyfarthing_scripts.hotspots',
+            'analyze',
+            '--format', 'json',
+            '--days', days,
+        ];
+        if (repo) {
+            args.push('--repo', repo);
+        }
+        else {
+            args.push('--path', projectDir);
+        }
+        // Find python in the project's pennyfarthing dir
+        const pythonPath = join(projectDir, 'pennyfarthing');
+        execFile('python3', args, {
+            cwd: pythonPath,
+            env: { ...process.env, PYTHONPATH: pythonPath },
+            timeout: 30000,
+        }, (err, stdout, stderr) => {
+            if (err) {
+                console.error('[Hotspots] Analysis failed:', stderr || err.message);
+                res.status(500).json({
+                    success: false,
+                    error: stderr || err.message,
+                });
+                return;
+            }
+            try {
+                const data = JSON.parse(stdout);
+                res.json(data);
+            }
+            catch (parseErr) {
+                console.error('[Hotspots] JSON parse failed:', parseErr);
+                res.status(500).json({
+                    success: false,
+                    error: 'Failed to parse hotspot analysis output',
+                });
+            }
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=hotspots.js.map

package/dist/api/hotspots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hotspots.js","sourceRoot":"","sources":["../../src/api/hotspots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,6BAA6B;AAC7B,MAAM,UAAU,oBAAoB,CAAC,aAA2B;IAC9D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,+CAA+C;IAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAA0B,CAAC;QAElD,MAAM,IAAI,GAAG;YACX,IAAI,EAAE,gCAAgC;YACtC,SAAS;YACT,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,IAAI;SACf,CAAC;QAEF,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAClC,CAAC;QAED,iDAAiD;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAErD,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE;YACxB,GAAG,EAAE,UAAU;YACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE;YAC/C,OAAO,EAAE,KAAK;SACf,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACzB,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,OAAO;iBAC7B,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,QAAQ,CAAC,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,yCAAyC;iBACjD,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/index.d.ts

@@ -5,6 +5,7 @@ export { createGitRouter, getGitInfo, getAllReposGitInfo, getGitInfoAsync, getAl
 export type { GitInfo } from './git.js';
 export { createOTLPRouter } from './otlp.js';
 export { createStoryRouter } from './story.js';
+export { createHotspotsRouter } from './hotspots.js';
 export { createFileBrowserRouter } from './file-browser.js';
 export { createTokenStatsRouter, broadcastTokenStats, getTokenStatsClients, initTokenStatsBroadcast } from './token-stats.js';
 export { createContextRouter, getContextUsage } from './context.js';
@@ -24,4 +25,5 @@ export { createIdentityRouter } from './identity.js';
 export type { IdentityInfo } from './identity.js';
 export { createTodosRouter, setWebModeTodos, getWebModeTodos } from './todos.js';
 export { createAuditLogRouter } from './audit-log.js';
+export { createPermissionsRouter } from './permissions.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACrH,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC1D,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEzJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAExI,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AACrH,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC5E,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC1D,YAAY,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAGzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAEzJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAElE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAExI,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/api/index.js

@@ -5,6 +5,7 @@ export { createPersonaRouter, broadcastPersona, getPersonaClients } from './pers
 export { createGitRouter, getGitInfo, getAllReposGitInfo, getGitInfoAsync, getAllReposGitInfoAsync } from './git.js';
 export { createOTLPRouter } from './otlp.js';
 export { createStoryRouter } from './story.js';
+export { createHotspotsRouter } from './hotspots.js';
 export { createFileBrowserRouter } from './file-browser.js';
 export { createTokenStatsRouter, broadcastTokenStats, getTokenStatsClients, initTokenStatsBroadcast } from './token-stats.js';
 export { createContextRouter, getContextUsage } from './context.js';
@@ -29,4 +30,6 @@ export { createIdentityRouter } from './identity.js';
 export { createTodosRouter, setWebModeTodos, getWebModeTodos } from './todos.js';
 // Audit log API
 export { createAuditLogRouter } from './audit-log.js';
+// MSSCI-14325: Permissions API (grant management)
+export { createPermissionsRouter } from './permissions.js';
 //# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAErH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,2FAA2F;AAC3F,6CAA6C;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,8BAA8B;AAC9B,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACzJ,kCAAkC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,gCAAgC;AAChC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClE,yDAAyD;AACzD,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACxI,4CAA4C;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,kCAAkC;AAClC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACjF,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA,qBAAqB;AACrB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAErH,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC9H,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE5E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,2FAA2F;AAC3F,6CAA6C;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,8BAA8B;AAC9B,OAAO,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AACzJ,kCAAkC;AAClC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,gCAAgC;AAChC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClE,yDAAyD;AACzD,OAAO,EAAE,uBAAuB,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AACxI,4CAA4C;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,kCAAkC;AAClC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACjF,gBAAgB;AAChB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,kDAAkD;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/api/permissions.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Permissions API Router
+ *
+ * Bridges the /permissions skill to settings-store.ts grant management.
+ *
+ * Story: MSSCI-14325 - Connect /permissions skill to grant store
+ *
+ * Routes:
+ * - GET /              List all active grants
+ * - POST /grant        Add a permission grant
+ * - DELETE /revoke/:tool  Revoke grants for a tool
+ * - GET /show/:tool    Show grants for a specific tool
+ */
+import { Router } from 'express';
+export declare function createPermissionsRouter(): Router;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/api/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/api/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAKpD,wBAAgB,uBAAuB,IAAI,MAAM,CAiEhD"}

package/dist/api/permissions.js

@@ -0,0 +1,67 @@
+/**
+ * Permissions API Router
+ *
+ * Bridges the /permissions skill to settings-store.ts grant management.
+ *
+ * Story: MSSCI-14325 - Connect /permissions skill to grant store
+ *
+ * Routes:
+ * - GET /              List all active grants
+ * - POST /grant        Add a permission grant
+ * - DELETE /revoke/:tool  Revoke grants for a tool
+ * - GET /show/:tool    Show grants for a specific tool
+ */
+import { Router } from 'express';
+import { getGrants, addGrant, removeGrant } from '../settings-store.js';
+const VALID_GRANT_TYPES = ['once', 'session', 'always'];
+export function createPermissionsRouter() {
+    const router = Router();
+    // GET / - List all active grants
+    router.get('/', (_req, res) => {
+        res.json({ grants: getGrants() });
+    });
+    // POST /grant - Add a permission grant
+    router.post('/grant', (req, res) => {
+        const { tool, scope, grant_type } = req.body;
+        if (!tool || typeof tool !== 'string') {
+            res.status(400).json({ error: 'Missing required field: tool' });
+            return;
+        }
+        if (!scope || typeof scope !== 'string') {
+            res.status(400).json({ error: 'Missing required field: scope' });
+            return;
+        }
+        const grantType = grant_type || 'session';
+        if (!VALID_GRANT_TYPES.includes(grantType)) {
+            res.status(400).json({ error: `Invalid grant_type: ${grantType}. Must be one of: ${VALID_GRANT_TYPES.join(', ')}` });
+            return;
+        }
+        const grant = {
+            tool,
+            scope,
+            grant_type: grantType,
+            granted_at: new Date().toISOString(),
+        };
+        addGrant(grant);
+        res.status(201).json({ grant });
+    });
+    // DELETE /revoke/:tool - Revoke grants for a tool
+    router.delete('/revoke/:tool', (req, res) => {
+        const { tool } = req.params;
+        const scopeFilter = req.query.scope;
+        const allGrants = getGrants();
+        const toRemove = allGrants.filter((g) => g.tool === tool && (!scopeFilter || g.scope === scopeFilter));
+        for (const grant of toRemove) {
+            removeGrant(grant);
+        }
+        res.json({ removed: toRemove.length });
+    });
+    // GET /show/:tool - Show grants for a specific tool
+    router.get('/show/:tool', (req, res) => {
+        const { tool } = req.params;
+        const grants = getGrants().filter((g) => g.tool === tool);
+        res.json({ grants });
+    });
+    return router;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/api/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/api/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAA6C,MAAM,sBAAsB,CAAC;AAEnH,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAExD,MAAM,UAAU,uBAAuB;IACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IAExB,iCAAiC;IACjC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,uCAAuC;IACvC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAE7C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAmB,UAAU,IAAI,SAAS,CAAC;QAE1D,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,SAAS,qBAAqB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAoB;YAC7B,IAAI;YACJ,KAAK;YACL,UAAU,EAAE,SAAS;YACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACrC,CAAC;QAEF,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;QAE1D,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC,CACpE,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,oDAAoD;IACpD,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACxD,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/settings.d.ts

@@ -46,7 +46,7 @@ export declare function createErrorResponse(code: ErrorCode, message: string): E
  * Get settings for WebSocket broadcast
  * Used by websocket.ts for /ws/settings endpoint
  */
-export declare function getSettingsForWebSocket(projectDir: string | null): Promise<SettingsResponse>;
+export declare function getSettingsForWebSocket(projectDir: string | null): Promise<Record<string, unknown>>;
 /**
  * Create the settings router
  */

package/dist/api/settings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/api/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAwC,KAAK,eAAe,EAAsB,MAAM,gBAAgB,CAAC;AAShH;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;IACzE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG;QACtC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAMD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,CAAC;AAEjG;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAMnF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsClG;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAya7C"}
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/api/settings.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAwC,KAAK,eAAe,EAAsB,MAAM,gBAAgB,CAAC;AAShH;;;;;GAKG;AACH,MAAM,WAAW,gBAAiB,SAAQ,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC;IACzE,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GAAG;QACtC,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;IACF,aAAa,CAAC,EAAE;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAMD;;GAEG;AACH,MAAM,MAAM,SAAS,GAAG,kBAAkB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,CAAC;AAEjG;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,CAMnF;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAmDzG;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAob7C"}

package/dist/api/settings.js

@@ -31,24 +31,33 @@ export function createErrorResponse(code, message) {
  */
 export async function getSettingsForWebSocket(projectDir) {
     const settings = getCurrentSettings();
-    // Read theme, handoff_mode, and bell_mode from config.local.yaml
+    // Read config.local.yaml as single source of truth
     let theme = 'alice-in-wonderland';
     let handoffMode = 'manual';
     let bellMode = false;
+    let display;
+    let notifications;
     if (projectDir) {
         try {
             const configPath = path.join(projectDir, '.pennyfarthing', 'config.local.yaml');
             if (fs.existsSync(configPath)) {
                 const content = fs.readFileSync(configPath, 'utf-8');
                 const parsed = parse(content);
-                if (parsed?.theme) {
+                if (parsed?.theme && typeof parsed.theme === 'string') {
                     theme = parsed.theme;
                 }
-                if (parsed?.workflow?.handoff_mode) {
-                    handoffMode = parsed.workflow.handoff_mode;
+                const workflow = parsed?.workflow;
+                if (workflow?.handoff_mode) {
+                    handoffMode = workflow.handoff_mode;
                 }
-                if (parsed?.workflow?.bell_mode !== undefined) {
-                    bellMode = parsed.workflow.bell_mode;
+                if (workflow?.bell_mode !== undefined) {
+                    bellMode = workflow.bell_mode;
+                }
+                if (parsed?.display && typeof parsed.display === 'object') {
+                    display = parsed.display;
+                }
+                if (parsed?.notifications && typeof parsed.notifications === 'object') {
+                    notifications = parsed.notifications;
                 }
             }
         }
@@ -56,7 +65,7 @@ export async function getSettingsForWebSocket(projectDir) {
             // Ignore project config errors - use defaults
         }
     }
-    return {
+    const response = {
         ...settings,
         workflow: {
             ...settings.workflow,
@@ -65,6 +74,11 @@ export async function getSettingsForWebSocket(projectDir) {
         },
         pennyfarthing: { theme },
     };
+    if (display)
+        response.display = display;
+    if (notifications)
+        response.notifications = notifications;
+    return response;
 }
 /**
  * Create the settings router
@@ -79,10 +93,12 @@ export function createSettingsRouter() {
     router.get('/', async (_req, res) => {
         try {
             const settings = getCurrentSettings();
-            // Read theme, handoff_mode, and bell_mode from config.local.yaml (single source of truth)
-            let theme = 'alice-in-wonderland'; // Default fallback
-            let handoffMode = 'manual'; // Default fallback
-            let bellMode = false; // Default fallback
+            // Read config.local.yaml as single source of truth for all project settings
+            let theme = 'alice-in-wonderland';
+            let handoffMode = 'manual';
+            let bellMode = false;
+            let display;
+            let notifications;
             const projectDir = getProjectDirectory();
             if (projectDir) {
                 try {
@@ -90,14 +106,21 @@ export function createSettingsRouter() {
                     if (fs.existsSync(configPath)) {
                         const content = fs.readFileSync(configPath, 'utf-8');
                         const parsed = parse(content);
-                        if (parsed?.theme) {
+                        if (parsed?.theme && typeof parsed.theme === 'string') {
                             theme = parsed.theme;
                         }
-                        if (parsed?.workflow?.handoff_mode) {
-                            handoffMode = parsed.workflow.handoff_mode;
+                        const workflow = parsed?.workflow;
+                        if (workflow?.handoff_mode) {
+                            handoffMode = workflow.handoff_mode;
+                        }
+                        if (workflow?.bell_mode !== undefined) {
+                            bellMode = workflow.bell_mode;
+                        }
+                        if (parsed?.display && typeof parsed.display === 'object') {
+                            display = parsed.display;
                         }
-                        if (parsed?.workflow?.bell_mode !== undefined) {
-                            bellMode = parsed.workflow.bell_mode;
+                        if (parsed?.notifications && typeof parsed.notifications === 'object') {
+                            notifications = parsed.notifications;
                         }
                     }
                 }
@@ -105,7 +128,7 @@ export function createSettingsRouter() {
                     // Ignore project config errors - use defaults
                 }
             }
-            // Construct response with theme, handoff_mode, and bell_mode added
+            // Construct response with all persisted settings
             const response = {
                 ...settings,
                 workflow: {
@@ -115,6 +138,10 @@ export function createSettingsRouter() {
                 },
                 pennyfarthing: { theme },
             };
+            if (display)
+                response.display = display;
+            if (notifications)
+                response.notifications = notifications;
             res.json(response);
         }
         catch (error) {