@threadbase-sh/streamer 1.49.0 → 1.50.0

package/dist/cli.cjs

@@ -1490,6 +1490,10 @@ function isPermissionMode(value) {
 function isDangerousPermissionMode(mode) {
   return DANGEROUS_PERMISSION_MODES.includes(mode);
 }
+function effectivePermissionMode(flags, fallback) {
+  const candidate = flags?.permissionMode ?? fallback;
+  return isPermissionMode(candidate) ? candidate : void 0;
+}
 function isEffortLevel(value) {
   return typeof value === "string" && EFFORT_LEVELS.includes(value);
 }
@@ -157474,6 +157478,17 @@ program2.command("serve").description("Start the streamer server").option("-p, -
       takeoverProd2({ port: plan.port, repoToplevel });
     }
   }
+  const spawnMode = effectivePermissionMode(
+    claudeFlags,
+    resolvedDefaultPermissionMode ?? loadDefaultPermissionMode()
+  );
+  if (spawnMode !== void 0 && isDangerousPermissionMode(spawnMode)) {
+    log14.warn(
+      `[WARN] permission mode is ${spawnMode} \u2014 spawned sessions run without confirmation prompts, so anyone holding the API key can execute arbitrary code on this machine. There is no spend limit.`,
+      void 0,
+      "console"
+    );
+  }
   const server = new StreamerServer({
     port: resolvedPort,
     apiKey,