baychat 0.29.8 → 0.30.0

package/dist/denied/settings-rules.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addAllowRules = addAllowRules;
+exports.removeAllowRules = removeAllowRules;
+exports.localSettingsFile = localSettingsFile;
+// Adding and removing exact `permissions.allow` entries in ONE Claude Code settings file — and
+// touching nothing else in it.
+//
+// THE ONLY EDIT THIS MODULE MAKES is to append a string to `permissions.allow`, or to take a
+// string BayChat put there back out. `deny`, `ask`, `defaultMode`, `hooks` and every other key are
+// carried through untouched, in the file's own indentation. A file that does not parse, is not a
+// JSON object, or has a `permissions`/`allow` of the wrong shape is REFUSED and left exactly as it
+// was: a permission file we half-understood is not one we get to rewrite.
+//
+// Writes are atomic (a temp file beside the target, then a rename — `nodeSettingsIo`, shared with
+// claude-settings.ts) and keep the file's mode. A symlinked settings file is followed, as Claude
+// Code follows it, and a dangling link is refused.
+//
+// WHICH FILE. The project's `.claude/settings.local.json`: the file Claude Code itself saves "Yes,
+// and don't ask again" into, which it watches and reloads during a session, which applies to this
+// project only, and which Claude Code keeps out of git. See `localSettingsFile` for where exactly.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const claude_settings_1 = require("../claude-settings");
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+/** Add each rule that is not already allowed. Returns the ones this call added (none: unchanged).
+ *  @throws with the file untouched when it cannot be read as a settings object. */
+function addAllowRules(file, rules, io = claude_settings_1.nodeSettingsIo) {
+    const edit = readSettings(file, io);
+    const allow = allowListOf(edit.settings, edit.target);
+    const added = rules.filter((rule, i) => !allow.includes(rule) && rules.indexOf(rule) === i);
+    if (added.length === 0)
+        return [];
+    writeAllow(edit, [...allow, ...added], io);
+    return added;
+}
+/** Take each rule out of `permissions.allow`. Idempotent: an absent file or rule is already gone.
+ *  @throws with the file untouched when it cannot be read as a settings object. */
+function removeAllowRules(file, rules, io = claude_settings_1.nodeSettingsIo) {
+    const edit = readSettings(file, io);
+    if (edit.text === null)
+        return;
+    const allow = allowListOf(edit.settings, edit.target);
+    const kept = allow.filter((rule) => !rules.includes(rule));
+    if (kept.length === allow.length)
+        return;
+    writeAllow(edit, kept, io);
+}
+function readSettings(file, io) {
+    const target = io.realpath(file);
+    const text = io.read(target);
+    if (text === null || text.trim() === "")
+        return { target, text, settings: {} };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${target} is not valid JSON, so BayChat left it untouched.`);
+    }
+    if (!isRecord(parsed))
+        throw new Error(`${target} is not a JSON object, so BayChat left it untouched.`);
+    return { target, text, settings: parsed };
+}
+function allowListOf(settings, target) {
+    const permissions = settings.permissions;
+    if (permissions === undefined)
+        return [];
+    if (!isRecord(permissions))
+        throw new Error(`${target}: "permissions" is not an object, so BayChat left it untouched.`);
+    const allow = permissions.allow;
+    if (allow === undefined)
+        return [];
+    if (!Array.isArray(allow) || !allow.every((r) => typeof r === "string")) {
+        throw new Error(`${target}: "permissions.allow" is not a list of rules, so BayChat left it untouched.`);
+    }
+    return allow;
+}
+function writeAllow(edit, allow, io) {
+    const permissions = isRecord(edit.settings.permissions) ? edit.settings.permissions : {};
+    const next = { ...edit.settings, permissions: { ...permissions, allow } };
+    const indent = edit.text ? (0, claude_settings_1.detectIndent)(edit.text) : 2;
+    // A new file is private: a once-rule can carry a command's own arguments.
+    io.write(edit.target, `${JSON.stringify(next, null, indent)}\n`, io.mode(edit.target) ?? 0o600);
+}
+/**
+ * The `.claude/settings.local.json` Claude Code reads for a session started in `projectDir`.
+ *
+ * Mirrors the settings docs ("Yes, and don't ask again" → `.claude/settings.local.json`): Claude
+ * Code keeps that file at the GIT REPOSITORY ROOT (in a worktree, the main checkout's root), and
+ * beside `.claude/settings.json` in the starting directory instead when there is no repository,
+ * when the root is the home directory, on Windows, or when the root, its `.git` or its `.claude`
+ * is not owned by this user.
+ */
+function localSettingsFile(projectDir, deps = {}) {
+    const home = deps.home ?? os.homedir();
+    const platform = deps.platform ?? process.platform;
+    const ownedByMe = deps.ownedByMe ?? isOwnedByMe;
+    const exists = deps.exists ?? fs.existsSync;
+    const commonDir = (deps.gitCommonDir ?? gitCommonDir)(projectDir);
+    const gitDir = commonDir ? path.resolve(projectDir, commonDir) : undefined;
+    const root = gitDir && path.basename(gitDir) === ".git" ? path.dirname(gitDir) : undefined;
+    const usable = root !== undefined &&
+        platform !== "win32" &&
+        path.resolve(root) !== path.resolve(home) &&
+        ownedByMe(root) &&
+        ownedByMe(path.join(root, ".git")) &&
+        (!exists(path.join(root, ".claude")) || ownedByMe(path.join(root, ".claude")));
+    return path.join(usable ? root : projectDir, ".claude", "settings.local.json");
+}
+function gitCommonDir(dir) {
+    const r = (0, child_process_1.spawnSync)("git", ["rev-parse", "--git-common-dir"], { cwd: dir, encoding: "utf8", timeout: 5_000 });
+    if (r.error || r.status !== 0)
+        return undefined;
+    return String(r.stdout ?? "").trim() || undefined;
+}
+function isOwnedByMe(p) {
+    try {
+        const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+        return uid === undefined || fs.statSync(p).uid === uid;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/denied/transcript.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.verifyDeniedCall = verifyDeniedCall;
+exports.findToolUse = findToolUse;
+// Proof that a denial really happened: the denied call must be in the session's own transcript.
+//
+// WHY. `baychat denied-hook` reads its event from stdin, and stdin is something anybody can
+// write — including the agent, by running `echo '{…}' | baychat denied-hook` itself. A forged
+// event would put a card on the owner's phone claiming a block that never occurred. So before
+// anything is posted, the call the event names (`tool_use_id`, `tool_name`, and the command or
+// target) must appear as a tool call the MODEL made, in the transcript Claude Code keeps under
+// `~/.claude/projects/` — a protected path the agent cannot write without a prompt.
+//
+// It is defence in depth, not the boundary: the owner's answer is. A card the agent somehow did
+// cause still writes nothing unless the owner taps a yes.
+//
+// THE TRANSCRIPT CAN LAG. The hooks reference says it "is written asynchronously and may lag the
+// in-memory conversation", so a missing call is polled for, briefly, before it counts as absent.
+// For a subagent's call the hook still gets the MAIN transcript (with `agent_id`); its calls are
+// in `<session>/subagents/agent-<id>.jsonl` beside it.
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const permission_rule_1 = require("./permission-rule");
+/** How long a call may take to reach the transcript before it counts as never made. */
+exports.TRANSCRIPT_WAIT_MS = 10_000;
+const TRANSCRIPT_POLL_MS = 250;
+/** Only the end of the file is read: the denied call is the newest thing in it. */
+const TAIL_BYTES = 4 * 1024 * 1024;
+/** Did the model really make this call in this session? NEVER THROWS. */
+async function verifyDeniedCall(ref, deps = {}) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
+    const readTail = deps.readTail ?? readFileTail;
+    try {
+        const projects = realpath(path.join(deps.claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "projects"));
+        const wanted = (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
+        if (!ref.toolUseId || !wanted)
+            return { ok: false, why: "the event names no call that can be checked" };
+        if (!path.isAbsolute(ref.transcriptPath) || !ref.transcriptPath.endsWith(".jsonl")) {
+            return { ok: false, why: "the event carries no transcript" };
+        }
+        const file = ref.agentId
+            ? path.join(ref.transcriptPath.slice(0, -".jsonl".length), "subagents", `${ref.agentId.startsWith("agent-") ? ref.agentId : `agent-${ref.agentId}`}.jsonl`)
+            : ref.transcriptPath;
+        const giveUpAt = now() + exports.TRANSCRIPT_WAIT_MS;
+        for (;;) {
+            let real;
+            try {
+                real = realpath(file);
+            }
+            catch {
+                real = undefined; // not written yet
+            }
+            if (real !== undefined && !real.startsWith(projects + path.sep)) {
+                return { ok: false, why: "the transcript is not in Claude Code's own folder" };
+            }
+            const tail = real === undefined ? undefined : readTail(real);
+            const found = tail === undefined ? undefined : findToolUse(tail, ref.toolUseId);
+            if (found) {
+                const key = (0, permission_rule_1.callKeyOf)(found.name, found.input);
+                return found.name === ref.toolName && key !== undefined && (0, permission_rule_1.sameCall)(key, wanted)
+                    ? { ok: true }
+                    : { ok: false, why: "the transcript's call is not the one the event names" };
+            }
+            if (now() >= giveUpAt)
+                return { ok: false, why: "the call is not in the session's transcript" };
+            await sleep(TRANSCRIPT_POLL_MS);
+        }
+    }
+    catch (err) {
+        return { ok: false, why: `the transcript could not be read (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+/** The model's tool call with this id, from transcript JSONL text. */
+function findToolUse(text, toolUseId) {
+    for (const line of text.split("\n")) {
+        if (!line.includes(toolUseId))
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue; // the cut-off first line of a tail, or a line being written
+        }
+        const e = entry;
+        if (e.type !== "assistant" || !Array.isArray(e.message?.content))
+            continue;
+        for (const block of e.message.content) {
+            if (block?.type === "tool_use" && block.id === toolUseId && typeof block.name === "string") {
+                return { name: block.name, input: block.input };
+            }
+        }
+    }
+    return undefined;
+}
+function readFileTail(file) {
+    let fd;
+    try {
+        fd = fs.openSync(file, "r");
+        const size = fs.fstatSync(fd).size;
+        const length = Math.min(size, TAIL_BYTES);
+        const buf = Buffer.alloc(length);
+        fs.readSync(fd, buf, 0, length, size - length);
+        return buf.toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}

package/dist/denied-hook.js

@@ -0,0 +1,329 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELOAD_SETTLE_MS = void 0;
+exports.retryOutput = retryOutput;
+exports.composeDeniedQuestion = composeDeniedQuestion;
+exports.offeredMeanings = offeredMeanings;
+exports.decideDenied = decideDenied;
+exports.cmdDeniedHook = cmdDeniedHook;
+// `baychat denied-hook` — the Claude Code PermissionDenied hook that turns an auto-mode block into
+// a card on the owner's phone, and the owner's "yes" into the one exact permission rule that lets
+// the session run that call.
+//
+// WHY THIS EXISTS. Auto mode's classifier HARD-denies some calls — `npx eas-cli build …`, a release
+// script, `npm publish`. A hard denial draws no prompt, so approve-hook (a PermissionRequest hook)
+// never runs, and the only way through was to walk to the computer and type `/permissions`. Karmen:
+// "We have to have this possibility as people have to use BayChat also when not near computer".
+// See docs/features/DENIED_COMMAND_CARD.md.
+//
+// WHAT CLAUDE CODE GIVES US (hooks reference, "PermissionDenied"): the event fires only in auto
+// mode, after the denial; "Exit code and stderr are ignored because the denial already occurred";
+// the one output read is `hookSpecificOutput.retry: true`, which "adds a message to the
+// conversation telling the model it may retry the tool call" — it does not reverse the denial. So
+// the retry only succeeds because, before printing it, THIS PROCESS (never the agent) writes an
+// allow rule that matches exactly that call into the project's `.claude/settings.local.json`,
+// which Claude Code reloads live and checks before the classifier.
+//
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// FAIL-CLOSED HERE MEANS "PRINT NOTHING".
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+//
+// Unlike approve-hook, silence is safe: no output leaves the denial standing. Every abnormal path
+// — no credential, no transcript proof, BayChat unreachable, an unanswered card, a settings file
+// we cannot parse, an exception — prints nothing and writes no rule. A rule is written only after
+// the card's owner tapped a yes, and `retry` is printed only after the rule was written.
+//
+// THE PROCESS BLOCKS THE SESSION WHILE IT WAITS, like approve-hook: hooks are awaited, so the
+// session stops until the owner answers or our deadline passes. That is the reliable shape: the
+// rule is in place before the model hears "you may retry", and the retry happens at once, in the
+// same turn. Being killed by the handler timeout is harmless here (the denial stands), but the
+// same 3600 s / 3900 s pair as approve-hook keeps our own deadline first, so the card is withdrawn
+// rather than left looking answerable.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("./approve-hook");
+const approval_wait_1 = require("./approval-wait");
+const config_1 = require("./config");
+const hook_stdin_1 = require("./hook-stdin");
+const grants_1 = require("./denied/grants");
+const permission_rule_1 = require("./denied/permission-rule");
+const settings_rules_1 = require("./denied/settings-rules");
+const transcript_1 = require("./denied/transcript");
+function retryOutput() {
+    return { hookSpecificOutput: { hookEventName: "PermissionDenied", retry: true } };
+}
+// ─── The card ────────────────────────────────────────────────────────────────
+const LOG_LABEL = "baychat denied-hook";
+const LABEL = {
+    once: "Allow once",
+    always: "Always allow this exact command",
+    no: "No",
+};
+/** The single button of a card that only informs: nothing can be allowed from BayChat. */
+const NOTICE_OPTIONS = ["OK"];
+/** The card's own limits (apps/api/src/lib/cards.ts), used only to TRIM. */
+const QUESTION_MAX = 2000;
+const SHOWN_MAX = 900;
+/**
+ * Give Claude Code's settings watcher this long to load the new rule before the model is told to
+ * retry. Claude Code does not say how fast its watcher is; this is a margin, and a retry that
+ * still meets the old settings is handled (see `MAX_SILENT_RETRIES`).
+ */
+exports.RELOAD_SETTLE_MS = 1500;
+/** A call denied AGAIN while a grant already covers it is retried this many times without a new
+ *  card (the watcher was slower than RELOAD_SETTLE_MS). After that the rule evidently does not
+ *  match how Claude Code reads the call, and the owner is told so. */
+const MAX_SILENT_RETRIES = 1;
+/** The classifier gave no verdict: Claude Code ignores `retry` for these, and a rule written for a
+ *  transient failure would outlive it. Texts from the hooks reference. */
+function isNoVerdict(reason) {
+    return reason.startsWith("Auto mode could not evaluate") || reason === "Classifier unavailable";
+}
+/** The card's question. A person decides from this text alone, on a lock screen. */
+function composeDeniedQuestion(q) {
+    const shown = q.plan.shown.length <= SHOWN_MAX ? q.plan.shown : `${q.plan.shown.slice(0, SHOWN_MAX - 1)}…`;
+    const offers = q.plan.onceRules.length
+        ? [
+            `Allow once: BayChat adds ${q.plan.onceRules.length === 1 ? "this exact rule" : "these exact rules"} to ` +
+                `${q.settingsFile} for the retry, then takes ${q.plan.onceRules.length === 1 ? "it" : "them"} out.`,
+            q.plan.alwaysAllowed ? "Always: BayChat keeps the rule there (`baychat permissions list` shows it)." : "",
+        ]
+        : [];
+    const lines = [
+        `${q.who} on ${q.host} was blocked by Claude Code's auto mode:`,
+        "",
+        shown,
+        "",
+        q.reason ? `Reason: ${q.reason}` : "",
+        q.cwd ? `Working directory: ${q.cwd}` : "",
+        "",
+        ...offers,
+        q.plan.limitation,
+    ];
+    const text = lines.filter((l) => l !== undefined).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+    return text.length <= QUESTION_MAX ? text : `${text.slice(0, QUESTION_MAX - 1)}…`;
+}
+/** The buttons for a plan: every option it allows, and always a way to say no. */
+function offeredMeanings(plan) {
+    if (plan.onceRules.length === 0)
+        return [];
+    return plan.alwaysAllowed ? ["once", "always", "no"] : ["once", "no"];
+}
+function parseArgs(argv) {
+    const at = (name) => {
+        const i = argv.indexOf(name);
+        return i >= 0 && i + 1 < argv.length ? argv[i + 1] : undefined;
+    };
+    const rawTimeout = Number(at("--timeout"));
+    return {
+        session: at("--session"),
+        fromClaude: argv.includes("--session-from-claude"),
+        waitSeconds: Number.isFinite(rawTimeout) && rawTimeout > 0 ? rawTimeout : approve_hook_1.DEFAULT_WAIT_SECONDS,
+    };
+}
+const str = (v) => (typeof v === "string" ? v : "");
+/**
+ * Turn one PermissionDenied event into `retry` — or into nothing, which leaves the denial
+ * standing. NEVER THROWS. `retry` is returned only after the owner allowed the call and the rule
+ * that matches it is written.
+ */
+async function decideDenied(rawStdin, argv = [], deps = {}) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const log = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const opts = parseArgs(argv);
+        let input;
+        try {
+            const parsed = JSON.parse(rawStdin);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("not an object");
+            input = parsed;
+        }
+        catch {
+            log(`${LOG_LABEL}: the event could not be read from stdin; the denial stands.`);
+            return null;
+        }
+        if (input.hook_event_name !== "PermissionDenied") {
+            log(`${LOG_LABEL}: not a PermissionDenied event (${String(input.hook_event_name)}); the denial stands.`);
+            return null;
+        }
+        const reason = str(input.reason);
+        if (isNoVerdict(reason)) {
+            log(`${LOG_LABEL}: auto mode gave no verdict ("${reason}"), so Claude Code would ignore a retry.`);
+            return null;
+        }
+        const toolName = str(input.tool_name);
+        const claudeSessionId = str(input.session_id);
+        const call = (0, permission_rule_1.callKeyOf)(toolName, input.tool_input);
+        if (!toolName || !claudeSessionId) {
+            log(`${LOG_LABEL}: the event has no tool or session (keys: ${Object.keys(input).join(", ")}).`);
+            return null;
+        }
+        const session = opts.session ?? (opts.fromClaude ? (0, approve_hook_1.sessionFromClaude)(deps.claude) : undefined);
+        if (opts.fromClaude && session === undefined) {
+            log(`${LOG_LABEL}: this session has not joined BayChat yet; the denial stands.`);
+            return null;
+        }
+        const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
+        if (!device) {
+            log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
+            return null;
+        }
+        // Only a call the model really made may put a card on anybody's phone.
+        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({
+            transcriptPath: str(input.transcript_path),
+            agentId: str(input.agent_id) || undefined,
+            toolUseId: str(input.tool_use_id),
+            toolName,
+            toolInput: input.tool_input,
+        });
+        if (!proof.ok) {
+            log(`${LOG_LABEL}: ${proof.why}; no card was posted and the denial stands.`);
+            return null;
+        }
+        const host = (deps.hostname ?? os.hostname)();
+        const who = session ? `Session "${session}"` : "A Claude Code session";
+        const waitDeps = { now, sleep, log };
+        // A card that only informs: posted, never waited on (its deadline is already now).
+        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
+        // ── Already allowed, and denied again: the reload race, or a rule that does not match.
+        const covering = call ? (0, grants_1.coveringGrant)(claudeSessionId, call, now()) : undefined;
+        if (covering) {
+            if (covering.retries < MAX_SILENT_RETRIES) {
+                await (0, grants_1.noteRetry)(covering.id);
+                await sleep(exports.RELOAD_SETTLE_MS * 2);
+                return retryOutput();
+            }
+            if (covering.kind === "once")
+                await (0, grants_1.revokeGrant)(covering.id);
+            await notify(`${who} on ${host} is still blocked although you allowed it:\n\n${(0, permission_rule_1.planDeniedCall)(toolName, input.tool_input).shown}\n\n` +
+                "Claude Code did not accept the rule BayChat wrote for it. Approve it at the computer " +
+                "(/permissions → Recently denied).");
+            return null;
+        }
+        const projectDir = deps.projectDir ?? (process.env.CLAUDE_PROJECT_DIR || str(input.cwd));
+        if (!projectDir || !path.isAbsolute(projectDir)) {
+            log(`${LOG_LABEL}: no project directory to keep a rule in; the denial stands.`);
+            return null;
+        }
+        const settingsFile = (deps.settingsFileFor ?? settings_rules_1.localSettingsFile)(projectDir);
+        const plan = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
+        const question = composeDeniedQuestion({ who, host, plan, reason, cwd: str(input.cwd), settingsFile });
+        const meanings = offeredMeanings(plan);
+        if (meanings.length === 0) {
+            // Nothing can be allowed from BayChat; the owner still learns why the session stopped.
+            await notify(question);
+            return null;
+        }
+        const deadline = now() + opts.waitSeconds * 1000;
+        const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, {
+            session,
+            question,
+            options: meanings.map((m) => LABEL[m]),
+            guardedOptions: meanings.flatMap((m, i) => (m === "always" ? [i] : [])),
+        }, deadline, waitDeps, LOG_LABEL);
+        if (outcome.kind === "deadline") {
+            await (0, approval_wait_1.withdrawOwnerQuestion)(device, outcome.requestId, log);
+            log(`${LOG_LABEL}: nobody answered within ${opts.waitSeconds}s; the card was withdrawn and the denial stands.`);
+            return null;
+        }
+        if (outcome.kind !== "answered") {
+            log(`${LOG_LABEL}: ${outcome.kind === "failed" ? outcome.reason : outcome.kind}; the denial stands.`);
+            return null;
+        }
+        const meaning = (outcome.index !== null ? meanings[outcome.index] : undefined) ?? "no";
+        if (meaning === "no" || !plan.call)
+            return null;
+        let grant;
+        try {
+            grant = await (0, grants_1.grantRules)({
+                kind: meaning,
+                rules: plan.onceRules,
+                settingsFile,
+                call: plan.call,
+                shown: plan.shown,
+                claudeSessionId,
+                session,
+            }, now());
+        }
+        catch (err) {
+            log(`${LOG_LABEL}: the rule could not be written (${(0, approval_wait_1.reasonOf)(err)}); the denial stands.`);
+            await notify(`BayChat could not save the rule you allowed, so ${who.toLowerCase()} stays blocked:\n\n${(0, approval_wait_1.reasonOf)(err)}`);
+            return null;
+        }
+        if (grant.kind === "once" && grant.expiresAt) {
+            (deps.scheduleSweep ?? scheduleSweep)(Date.parse(grant.expiresAt));
+        }
+        await sleep(exports.RELOAD_SETTLE_MS);
+        return retryOutput();
+    }
+    catch (err) {
+        log(`${LOG_LABEL}: unexpected failure (${(0, approval_wait_1.reasonOf)(err)}); the denial stands.`);
+        return null;
+    }
+}
+/**
+ * Start `baychat permissions sweep --at <ms>` detached, so a once-rule is taken back at its TTL
+ * even when the retried call never reports back and no other hook runs. Best effort: the
+ * after-hook and every later hook run sweep too.
+ */
+function scheduleSweep(atMs) {
+    try {
+        const entry = fs.realpathSync(process.argv[1] ?? "");
+        const child = (0, child_process_1.spawn)(process.execPath, [entry, "permissions", "sweep", "--at", String(atMs)], {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.unref();
+    }
+    catch (err) {
+        process.stderr.write(`${LOG_LABEL}: could not schedule the once-rule's removal (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+    }
+}
+/**
+ * `baychat denied-hook [--session <name> | --session-from-claude] [--timeout <seconds>]`
+ *
+ * Always returns 0 (Claude Code ignores this event's exit code). Prints `retry` or nothing.
+ */
+async function cmdDeniedHook(argv = [], stdin = process.stdin) {
+    const output = await decideDenied(await (0, hook_stdin_1.readStdin)(stdin), argv);
+    if (output)
+        process.stdout.write(`${JSON.stringify(output)}\n`);
+    return 0;
+}

package/dist/doctor-command.js

@@ -97,6 +97,9 @@ async function currentDoctorEnv() {
         device: (0, config_1.loadDeviceCredentials)(),
         relay: await (0, commands_1.tryRelayStatus)(),
         node: { version: process.version, webSocket: (0, ws_1.hasBuiltInWebSocket)() },
+        // APPDATA, LOCALAPPDATA and a directory lister: without them a Windows report cannot
+        // see Claude Desktop's config at all, Store copy or classic.
+        pathEnv: (0, client_paths_1.currentPathEnv)(),
         targets: registry.all(),
         readText(filePath) {
             try {