baychat 0.29.8 → 0.30.0

package/dist/connect.js

@@ -36,9 +36,9 @@ exports.renderConnectMenu = renderConnectMenu;
 exports.isClaudeConnectTarget = isClaudeConnectTarget;
 exports.parseConnectClient = parseConnectClient;
 exports.writeClientConfig = writeClientConfig;
+exports.describeWrittenConfigs = describeWrittenConfigs;
 exports.cmdConnect = cmdConnect;
 const node_fs_1 = __importDefault(require("node:fs"));
-const node_path_1 = __importDefault(require("node:path"));
 const client_config_writer_1 = require("./client-config-writer");
 const client_paths_1 = require("./client-paths");
 const commands_1 = require("./commands");
@@ -139,12 +139,33 @@ function writeClientConfig(client, endpoint, io, env = (0, client_paths_1.curren
         if (existing !== null && existing.trim() !== "") {
             io.copyFile(target, (0, client_config_writer_1.backupPathFor)(target));
         }
-        io.mkdirp(node_path_1.default.dirname(target));
+        io.mkdirp((0, client_paths_1.configDirOf)(target));
         io.writeFile(target, merged.content);
         return { path: target, action: merged.action };
     });
     const [primary, ...rest] = written;
-    return { ...primary, alsoWritten: rest.map((r) => r.path) };
+    return { ...primary, alsoWritten: rest.map((r) => r.path), written };
+}
+/**
+ * What `connect` prints about the files it wrote: every one, by full path.
+ *
+ * Every file is named, not just the first: a user who later edits one needs to
+ * know the others exist, or they change a setting and see no effect. And a
+ * Microsoft Store copy of Claude Desktop is SAID to be one, because its path
+ * (`…\Packages\Claude_…\LocalCache\…`) is not where anyone would look, and
+ * being able to open the file Claude actually reads is the whole verification.
+ */
+function describeWrittenConfigs(written) {
+    const lines = [];
+    for (const [i, file] of written.entries()) {
+        const verb = file.action === "created" ? "Created" : file.action === "updated" ? "Updated" : "Added to";
+        const store = (0, client_paths_1.isClaudeStoreConfigPath)(file.path) ? " (Microsoft Store Claude)" : "";
+        lines.push(i === 0 ? `✓ ${verb} ${file.path}${store}` : `✓ Also ${verb.toLowerCase()} ${file.path}${store}`);
+        if (file.action !== "created") {
+            lines.push(`  A copy of the previous file is at ${(0, client_config_writer_1.backupPathFor)(file.path)}`);
+        }
+    }
+    return lines;
 }
 /**
  * Where this client's executable actually is, when it has one.
@@ -316,19 +337,12 @@ async function runStep(step, ctx) {
                 // comment because writing an empty bearer fails silently inside a client.
                 throw new Error("Internal: no device credential to write — login must run first.");
             }
-            const { path: written, action, alsoWritten } = writeClientConfig(step.client, { url: `${ctx.base}/api/mcp`, token: device.token }, realIo, 
+            const { written } = writeClientConfig(step.client, { url: `${ctx.base}/api/mcp`, token: device.token }, realIo, 
             // The resolved binary is what reveals a snap install, and a snap install
             // reads a different file than the one this client "keeps its config" in.
             { ...(0, client_paths_1.currentPathEnv)(), binaryPath: activeBinaryPath(step.client) });
-            const verb = action === "created" ? "Created" : action === "updated" ? "Updated" : "Added to";
-            console.log(`✓ ${verb} ${written}`);
-            if (action !== "created") {
-                console.log(`  A copy of the previous file is at ${(0, client_config_writer_1.backupPathFor)(written)}`);
-            }
-            // Named rather than silent: a user who later edits one file needs to know
-            // the other exists, or they will change a setting and see no effect.
-            for (const extra of alsoWritten)
-                console.log(`✓ Also written to ${extra}`);
+            for (const line of describeWrittenConfigs(written))
+                console.log(line);
             return { kind: "ok" };
         }
         case "restart-note":

package/dist/credential-refresh.js

@@ -35,12 +35,12 @@ const mcp_dialects_1 = require("./mcp-dialects");
  */
 function staleClientConfigs(token, io, env) {
     const stale = [];
-    for (const path of everyKnownConfigPath(env)) {
-        const contents = io.readFile(path);
+    for (const filePath of everyKnownConfigPath(env)) {
+        const contents = io.readFile(filePath);
         if (contents === null || !contents.includes("baychat"))
             continue;
         if (!contents.includes(token))
-            stale.push(path);
+            stale.push(filePath);
     }
     return stale;
 }
@@ -55,16 +55,28 @@ function staleClientConfigs(token, io, env) {
 function refreshExistingClientConfigs(endpoint, io, env) {
     const updated = [];
     for (const client of mcp_dialects_1.MCP_CLIENTS) {
-        for (const path of (0, client_paths_1.inspectableConfigPaths)(client, env)) {
-            const existing = io.readFile(path);
-            // Only files that already name BayChat. See the header: refresh is not
-            // connect.
-            if (existing === null || !existing.includes("baychat"))
+        const paths = (0, client_paths_1.inspectableConfigPaths)(client, env);
+        const contents = new Map(paths.map((p) => [p, io.readFile(p)]));
+        const names = (text) => !!text && text.includes("baychat");
+        // Only a client that already names BayChat somewhere. See the header:
+        // refresh is not connect.
+        if (![...contents.values()].some(names))
+            continue;
+        // ONE APP, SEVERAL FILES. Claude Desktop from the Microsoft Store reads its
+        // own virtualised copy, and an older `connect` wrote only the classic
+        // `%APPDATA%` file — so the user DID connect Claude Desktop, and the copy it
+        // reads has no BayChat. Once any of its files names BayChat, every location
+        // `connect desktop` would write is that same connected app, and is brought
+        // up to date with it. Codex and Cursor stay file-by-file.
+        const sameApp = client === "desktop" ? (0, client_paths_1.configPathsFor)(client, env) : [];
+        for (const filePath of paths) {
+            const existing = contents.get(filePath) ?? null;
+            if (!names(existing) && !sameApp.includes(filePath))
                 continue;
-            if (existing.includes(endpoint.token))
+            if (existing?.includes(endpoint.token))
                 continue;
-            if (rewrite(client, path, existing, endpoint, io))
-                updated.push(path);
+            if (rewrite(client, filePath, existing, endpoint, io))
+                updated.push(filePath);
         }
     }
     return updated;
@@ -78,11 +90,16 @@ function refreshExistingClientConfigs(endpoint, io, env) {
  * Codex being refreshed. A partial renewal is far better than none, and the
  * caller reports what it managed.
  */
-function rewrite(client, path, existing, endpoint, io) {
+function rewrite(client, filePath, existing, endpoint, io) {
     try {
         const merged = (0, client_config_writer_1.mergeClientConfig)((0, mcp_dialects_1.buildClientConfig)(client, endpoint), existing);
-        io.copyFile(path, (0, client_config_writer_1.backupPathFor)(path));
-        io.writeFile(path, merged.content);
+        // Backed up only when there was something to lose — the Store copy of
+        // Claude Desktop may not exist yet.
+        if (existing !== null && existing.trim() !== "")
+            io.copyFile(filePath, (0, client_config_writer_1.backupPathFor)(filePath));
+        else
+            io.mkdirp((0, client_paths_1.configDirOf)(filePath));
+        io.writeFile(filePath, merged.content);
         return true;
     }
     catch {

package/dist/denied/after-hook.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.afterCall = afterCall;
+exports.cmdDeniedAfter = cmdDeniedAfter;
+// `baychat denied-after` — the PostToolUse / PostToolUseFailure hook that takes an "Allow once"
+// rule back out as soon as the retried call has run.
+//
+// It is installed beside `denied-hook` (relay/launcher/approval-settings.ts) as an ASYNC hook:
+// Claude Code starts it and moves on, so it adds nothing to any tool call's latency, and it prints
+// nothing. It runs on every matching tool call, so it is routed by index.ts without loading the
+// CLI, and it returns at once when no once-grant exists — the common case by far.
+//
+// The TTL sweep (grants.ts, ONCE_TTL_MS) is the backstop for a retried call that never finishes,
+// and every run here sweeps too.
+const hook_stdin_1 = require("../hook-stdin");
+const grants_1 = require("./grants");
+const permission_rule_1 = require("./permission-rule");
+/** Handle one finished call. NEVER THROWS; diagnostics go to stderr. */
+async function afterCall(rawStdin, log = defaultLog) {
+    try {
+        if (!(0, grants_1.hasOnceGrants)())
+            return;
+        const input = JSON.parse(rawStdin);
+        const call = typeof input.tool_name === "string" ? (0, permission_rule_1.callKeyOf)(input.tool_name, input.tool_input) : undefined;
+        if (call && typeof input.session_id === "string")
+            await (0, grants_1.consumeOnceGrants)(input.session_id, call);
+        await (0, grants_1.sweepExpiredGrants)();
+    }
+    catch (err) {
+        log(`baychat denied-after: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+function defaultLog(line) {
+    process.stderr.write(`${line}\n`);
+}
+/** The command. Always 0: nothing this hook could say would change the call that already ran. */
+async function cmdDeniedAfter(stdin = process.stdin) {
+    await afterCall(await (0, hook_stdin_1.readStdin)(stdin, 5_000));
+    return 0;
+}

package/dist/denied/grants.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ONCE_TTL_MS = void 0;
+exports.grantRules = grantRules;
+exports.listGrants = listGrants;
+exports.coveringGrant = coveringGrant;
+exports.noteRetry = noteRetry;
+exports.revokeGrant = revokeGrant;
+exports.consumeOnceGrants = consumeOnceGrants;
+exports.sweepExpiredGrants = sweepExpiredGrants;
+exports.hasOnceGrants = hasOnceGrants;
+// The permission rules BayChat itself wrote on this computer, and the one owner of every change to
+// them (`~/.baychat/permission-grants.json`, 0600).
+//
+// A GRANT is what one "Allow once" or "Always allow this exact command" answer did: the exact rules
+// it added to which settings file, and the call they were for. Recording it is what lets BayChat
+// take a once-rule back out after the retried call (or its TTL), list what it keeps
+// (`baychat permissions list`) and remove one again (`baychat permissions remove`) — without ever
+// touching a rule the person wrote themselves: a rule that was already in the file is not added,
+// so it is not recorded, so it is never removed.
+//
+// ONE LOCK FOR ALL OF IT. The hook, the after-hook, the TTL sweeper and the command can run at the
+// same time (two denials in one turn, a sweep while a retry lands), and each is a read-modify-write
+// of two files. Every operation below runs under `permission-grants.lock` (an O_EXCL file, broken
+// when older than STALE_LOCK_MS), so they queue instead of losing each other's writes.
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const permission_rule_1 = require("./permission-rule");
+const settings_rules_1 = require("./settings-rules");
+/** How long a once-rule may outlive its card when the retried call never reports back. The retry
+ *  starts within seconds; this only bounds a rule left behind by a session that went away. */
+exports.ONCE_TTL_MS = 5 * 60_000;
+const LOCK_WAIT_MS = 5_000;
+const LOCK_POLL_MS = 50;
+const STALE_LOCK_MS = 30_000;
+const grantsFile = () => path.join((0, config_1.configDir)(), "permission-grants.json");
+const lockFile = () => path.join((0, config_1.configDir)(), "permission-grants.lock");
+/**
+ * Write the rules into the settings file and record the grant. All or nothing: when the record
+ * cannot be written the rules are taken back out, and when the rules cannot be written nothing is
+ * recorded.
+ *
+ * @throws with nothing changed (as far as the filesystem allows) when either write fails.
+ */
+async function grantRules(request, now = Date.now()) {
+    return withGrantsLock(() => {
+        const added = (0, settings_rules_1.addAllowRules)(request.settingsFile, request.rules);
+        const grant = {
+            id: crypto.randomBytes(4).toString("hex"),
+            kind: request.kind,
+            rules: added,
+            settingsFile: request.settingsFile,
+            call: request.call,
+            shown: request.shown,
+            claudeSessionId: request.claudeSessionId,
+            ...(request.session ? { session: request.session } : {}),
+            addedAt: new Date(now).toISOString(),
+            ...(request.kind === "once" ? { expiresAt: new Date(now + exports.ONCE_TTL_MS).toISOString() } : {}),
+            retries: 0,
+        };
+        try {
+            writeGrants([...readGrants(), grant]);
+        }
+        catch (err) {
+            (0, settings_rules_1.removeAllowRules)(request.settingsFile, added);
+            throw err;
+        }
+        return grant;
+    });
+}
+/** Every recorded grant, once-grants included. */
+function listGrants() {
+    return readGrants();
+}
+/**
+ * The live grant that already covers this call, if any: an always-grant from any session, or a
+ * once-grant of this Claude Code session that has not expired.
+ */
+function coveringGrant(claudeSessionId, call, now = Date.now()) {
+    return readGrants().find((g) => (0, permission_rule_1.sameCall)(g.call, call) &&
+        (g.kind === "always" || (g.claudeSessionId === claudeSessionId && !isExpired(g, now))));
+}
+/** Count one silent retry against a grant. */
+async function noteRetry(id) {
+    await withGrantsLock(() => {
+        writeGrants(readGrants().map((g) => (g.id === id ? { ...g, retries: g.retries + 1 } : g)));
+    });
+}
+/** Take a grant back: its rules out of the settings file, then its record. False: no such grant. */
+async function revokeGrant(id) {
+    return withGrantsLock(() => {
+        const grants = readGrants();
+        const grant = grants.find((g) => g.id === id);
+        if (!grant)
+            return false;
+        revokeLocked(grant, grants);
+        return true;
+    });
+}
+/** After a call finished: take back the once-grants of this session that were for it. */
+async function consumeOnceGrants(claudeSessionId, call) {
+    return revokeWhere((g) => g.kind === "once" && g.claudeSessionId === claudeSessionId && (0, permission_rule_1.sameCall)(g.call, call));
+}
+/** Take back every once-grant whose TTL has passed. */
+async function sweepExpiredGrants(now = Date.now()) {
+    return revokeWhere((g) => g.kind === "once" && isExpired(g, now));
+}
+/** Is there any once-grant at all? The after-hook's fast exit, read without the lock. */
+function hasOnceGrants() {
+    return readGrants().some((g) => g.kind === "once");
+}
+async function revokeWhere(match) {
+    return withGrantsLock(() => {
+        let grants = readGrants();
+        const doomed = grants.filter(match);
+        for (const grant of doomed)
+            grants = revokeLocked(grant, grants);
+        return doomed.length;
+    });
+}
+/** Remove `grant`'s rules — except any another remaining grant also holds — then its record.
+ *  Returns the remaining grants. Caller holds the lock. */
+function revokeLocked(grant, grants) {
+    const rest = grants.filter((g) => g.id !== grant.id);
+    const stillHeld = new Set(rest.filter((g) => g.settingsFile === grant.settingsFile).flatMap((g) => g.rules));
+    (0, settings_rules_1.removeAllowRules)(grant.settingsFile, grant.rules.filter((r) => !stillHeld.has(r)));
+    writeGrants(rest);
+    return rest;
+}
+function isExpired(grant, now) {
+    const at = grant.expiresAt ? Date.parse(grant.expiresAt) : Number.NaN;
+    // A once-grant with no readable expiry is treated as expired: it can only be taken back early.
+    return grant.kind === "once" && (!Number.isFinite(at) || at <= now);
+}
+// ─── The file ────────────────────────────────────────────────────────────────
+function readGrants() {
+    let text;
+    try {
+        text = fs.readFileSync(grantsFile(), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const parsed = JSON.parse(text);
+    const grants = parsed?.grants;
+    if (!Array.isArray(grants))
+        throw new Error(`${grantsFile()} is not a BayChat grants file.`);
+    return grants;
+}
+function writeGrants(grants) {
+    const file = grantsFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify({ version: 1, grants }, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/**
+ * Run `fn` holding the grants lock. The lock is an exclusive-create file; one older than
+ * STALE_LOCK_MS belonged to a process that died holding it and is broken. Gives up (throws) after
+ * LOCK_WAIT_MS rather than waiting forever — every caller fails closed on a throw.
+ */
+async function withGrantsLock(fn) {
+    const file = lockFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const giveUpAt = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            fs.closeSync(fs.openSync(file, "wx", 0o600));
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            if (lockAge(file) > STALE_LOCK_MS) {
+                fs.rmSync(file, { force: true });
+                continue;
+            }
+            if (Date.now() >= giveUpAt)
+                throw new Error(`Another BayChat process holds ${file}; try again.`);
+            await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        fs.rmSync(file, { force: true });
+    }
+}
+function lockAge(file) {
+    try {
+        return Date.now() - fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}

package/dist/denied/opt-in.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedCardEnabled = deniedCardEnabled;
+exports.enableDeniedCard = enableDeniedCard;
+exports.disableDeniedCard = disableDeniedCard;
+// Whether this computer's owner turned the denied-command card on (`baychat permissions on`).
+//
+// OFF UNTIL SOMEBODY ASKS FOR IT, like approve-hook was: the card lets a phone add a permission
+// rule on this computer, so it exists only after a deliberate act. The switch is a file in
+// `~/.baychat`, read when BayChat's launcher writes a session's `--settings` file
+// (relay/launcher/approval-settings.ts), so it takes effect for sessions started after it changes.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const optInFile = () => path.join((0, config_1.configDir)(), "denied-card.json");
+/** True only when the switch file says so. Any doubt — missing, unreadable, malformed — is off. */
+function deniedCardEnabled() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(optInFile(), "utf8"));
+        return parsed?.enabled === true;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
+        }
+        return false;
+    }
+}
+function enableDeniedCard(now = new Date()) {
+    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled: true, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
+}
+function disableDeniedCard() {
+    fs.rmSync(optInFile(), { force: true });
+}

package/dist/denied/permission-rule.js

@@ -0,0 +1,183 @@
+"use strict";
+// What BayChat may write into Claude Code's settings for ONE call that auto mode denied — and,
+// just as important, what it refuses to write. Pure: no files, no network.
+//
+// THE RULE WE WRITE IS THE CALL, AND NOTHING WIDER. Claude Code resolves a matching
+// `permissions.allow` rule before its auto-mode classifier (permission-modes docs, "How the
+// classifier evaluates actions", step 1), so a rule is a real grant: whatever it matches runs
+// without review. Its syntax is a pattern language — `Bash(<text>)` matches the whole command
+// text with `*` as a wildcard, and a rule must match each subcommand of a chain on its own
+// (permissions docs, "Compound commands"). So:
+//
+//   • a command containing `*` is never turned into a rule: the star would be read as a wildcard
+//     and the rule would allow more than the person saw;
+//   • a command that runs another command inside it (backticks, `$( )`, brackets, a newline) has
+//     no exact rule at all — nothing is offered;
+//   • a chain (`a && b`, `a | b`, `a; b`) can only be allowed ONCE, as one rule per subcommand,
+//     and only when it holds no quotes, because splitting quoted shell text by hand is how a
+//     parser and a person end up disagreeing about what runs;
+//   • "Always" is offered only for ONE plain command with no variable expansion, no redirection
+//     and nothing that looks like a secret (a saved rule would keep that secret in a file).
+//
+// The card text is built from `shown`, which masks obvious secrets; the rule is built from the
+// real text, because a rule that differs from the call matches nothing.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RULE_COMMAND_LENGTH = void 0;
+exports.planDeniedCall = planDeniedCall;
+exports.callKeyOf = callKeyOf;
+exports.sameCall = sameCall;
+exports.redactSecrets = redactSecrets;
+/** Longer than this is not a command a person can check on a phone, nor one a rule should hold. */
+exports.MAX_RULE_COMMAND_LENGTH = 1000;
+/** Claude Code itself saves at most five rules for one approved chain (permissions docs). */
+const MAX_CHAIN_PARTS = 5;
+/** `&&`, `||`, `|&`, `;`, `|`, and a lone `&` that is not part of a redirection (`2>&1`, `&>`). */
+const CHAIN_OPERATOR = /&&|\|\||\|&|;|\||(?<![>&])&(?![>&])/;
+const CHAIN_SPLIT = /\s*(?:&&|\|\||\|&|;|\||(?<![>&])&(?![>&]))\s*/;
+const NESTED_COMMAND = /`|\$\(|[()]/;
+const MCP_TOOL = /^mcp__[A-Za-z0-9_-]+__[A-Za-z0-9_.-]+$/;
+const str = (v) => (typeof v === "string" ? v : "");
+/** Plan the rules for one denied call. Never throws. */
+function planDeniedCall(toolName, toolInput) {
+    const input = (toolInput && typeof toolInput === "object" ? toolInput : {});
+    if (toolName === "Bash")
+        return planBash(str(input.command).trim());
+    if (toolName === "WebFetch")
+        return planWebFetch(str(input.url).trim());
+    if (MCP_TOOL.test(toolName)) {
+        return {
+            shown: `${toolName} ${clipJson(input)}`,
+            onceRules: [toolName],
+            alwaysAllowed: false,
+            limitation: "A rule for an MCP tool allows every use of that tool, so BayChat only allows it once.",
+            call: { tool: toolName, subject: toolName },
+        };
+    }
+    return nothing(`${toolName} ${clipJson(input)}`, "BayChat can only allow shell commands, web fetches and MCP tools from your phone; " +
+        "approve this one at the computer (/permissions → Recently denied).");
+}
+function planBash(command) {
+    const { text: shown, redacted } = redactSecrets(command);
+    if (!command)
+        return nothing("(no command)", "The blocked call carried no command.");
+    if (command.length > exports.MAX_RULE_COMMAND_LENGTH) {
+        return nothing(clip(shown), "It is too long to allow as one exact command; approve it at the computer.");
+    }
+    if (/[\r\n]/.test(command)) {
+        return nothing(shown, "It spans several lines, which no exact rule can describe; approve it at the computer.");
+    }
+    if (NESTED_COMMAND.test(command)) {
+        return nothing(shown, "It runs a command inside another (backticks, $( ) or brackets), which no exact rule can describe; " +
+            "approve it at the computer.");
+    }
+    if (command.includes("*")) {
+        return nothing(shown, "It contains *, which Claude Code reads as a wildcard, so a rule would allow more than this command; " +
+            "approve it at the computer.");
+    }
+    const call = { tool: "Bash", subject: command };
+    if (CHAIN_OPERATOR.test(command)) {
+        if (/["'\\]/.test(command)) {
+            return nothing(shown, "It chains several commands and quotes text, so BayChat cannot split it safely; ask the session to " +
+                "run them one at a time.");
+        }
+        const parts = command.split(CHAIN_SPLIT);
+        if (parts.some((p) => p === "") || parts.length > MAX_CHAIN_PARTS) {
+            return nothing(shown, "BayChat cannot split this chain into exact commands; approve it at the computer.");
+        }
+        return {
+            shown,
+            onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
+            alwaysAllowed: false,
+            limitation: `It chains ${parts.length} commands, so BayChat only allows it once.`,
+            call,
+        };
+    }
+    const refusal = redacted
+        ? "It carries what looks like a secret, and a saved rule would keep it in a settings file, so BayChat only allows it once."
+        : command.includes("$")
+            ? "It expands a variable, so the same text could run something different later; BayChat only allows it once."
+            : /[<>]/.test(command)
+                ? "It redirects to or from a file, so BayChat only allows it once."
+                : "";
+    return { shown, onceRules: [`Bash(${command})`], alwaysAllowed: refusal === "", limitation: refusal, call };
+}
+function planWebFetch(url) {
+    let host = "";
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        /* not a URL: nothing to allow */
+    }
+    const shown = redactSecrets(url).text;
+    if (!host || !/^[A-Za-z0-9.-]+$/.test(host))
+        return nothing(shown || "(no URL)", "The blocked fetch has no usable address.");
+    return {
+        shown,
+        onceRules: [`WebFetch(domain:${host})`],
+        alwaysAllowed: false,
+        limitation: `A WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
+        call: { tool: "WebFetch", subject: host },
+    };
+}
+/** The key a call is matched by — the same for the denied call and the retried one. */
+function callKeyOf(toolName, toolInput) {
+    const input = (toolInput && typeof toolInput === "object" ? toolInput : {});
+    if (toolName === "Bash") {
+        const command = str(input.command).trim();
+        return command ? { tool: "Bash", subject: command } : undefined;
+    }
+    if (toolName === "WebFetch") {
+        try {
+            return { tool: "WebFetch", subject: new URL(str(input.url).trim()).hostname };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return MCP_TOOL.test(toolName) ? { tool: toolName, subject: toolName } : undefined;
+}
+function sameCall(a, b) {
+    return a.tool === b.tool && a.subject === b.subject;
+}
+function nothing(shown, limitation) {
+    return { shown, onceRules: [], alwaysAllowed: false, limitation };
+}
+// ─── Redaction ───────────────────────────────────────────────────────────────
+const MASK = "[redacted]";
+/** `scheme://user:password@host` → `scheme://[redacted]@host`. */
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+/** Shapes that are a credential wherever they appear. */
+const KNOWN_TOKENS = /\b(?:bay_[A-Za-z0-9_]{8,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|npm_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})/g;
+/** `Bearer <x>`, `Basic <x>`, `token <x>` (an Authorization header's value). */
+const AUTH_SCHEME = /\b(Bearer|Basic|token)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+/** `--token x`, `--api-key=x`, `-password x`, `--client-secret "x"`, … */
+const SECRET_FLAG = /(--?[A-Za-z0-9_-]*(?:token|secret|passw(?:or)?d|pass|api[-_]?key|apikey|auth|credential|private[-_]?key)[A-Za-z0-9_-]*)(=|\s+)("[^"]*"|'[^']*'|[^\s;&|]+)/gi;
+/** `FOO=…` at the start of a word: an environment assignment, whatever its name. */
+const ENV_ASSIGNMENT = /(^|[\s;&|])([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]+)/g;
+/**
+ * The text with obvious secrets masked, and whether anything was. Errs towards masking: a card is
+ * read on a lock screen and stored in a chat, and a masked word costs nothing but a glance.
+ * It is not a guarantee — an unusual secret in a positional argument passes — which is one more
+ * reason "Always" is never offered for a command this changes.
+ */
+function redactSecrets(text) {
+    const out = text
+        .replace(URL_CREDENTIALS, `$1${MASK}@`)
+        .replace(KNOWN_TOKENS, MASK)
+        .replace(AUTH_SCHEME, `$1 ${MASK}`)
+        .replace(SECRET_FLAG, (_m, flag, sep) => `${flag}${sep}${MASK}`)
+        .replace(ENV_ASSIGNMENT, (_m, lead, name) => `${lead}${name}=${MASK}`);
+    return { text: out, redacted: out !== text };
+}
+function clip(text, max = 600) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+function clipJson(value) {
+    try {
+        return clip(redactSecrets(JSON.stringify(value)).text, 400);
+    }
+    catch {
+        return "(its parameters could not be displayed)";
+    }
+}