baychat 0.29.9 → 0.30.0

package/dist/denied/grants.js

@@ -0,0 +1,234 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ONCE_TTL_MS = void 0;
+exports.grantRules = grantRules;
+exports.listGrants = listGrants;
+exports.coveringGrant = coveringGrant;
+exports.noteRetry = noteRetry;
+exports.revokeGrant = revokeGrant;
+exports.consumeOnceGrants = consumeOnceGrants;
+exports.sweepExpiredGrants = sweepExpiredGrants;
+exports.hasOnceGrants = hasOnceGrants;
+// The permission rules BayChat itself wrote on this computer, and the one owner of every change to
+// them (`~/.baychat/permission-grants.json`, 0600).
+//
+// A GRANT is what one "Allow once" or "Always allow this exact command" answer did: the exact rules
+// it added to which settings file, and the call they were for. Recording it is what lets BayChat
+// take a once-rule back out after the retried call (or its TTL), list what it keeps
+// (`baychat permissions list`) and remove one again (`baychat permissions remove`) — without ever
+// touching a rule the person wrote themselves: a rule that was already in the file is not added,
+// so it is not recorded, so it is never removed.
+//
+// ONE LOCK FOR ALL OF IT. The hook, the after-hook, the TTL sweeper and the command can run at the
+// same time (two denials in one turn, a sweep while a retry lands), and each is a read-modify-write
+// of two files. Every operation below runs under `permission-grants.lock` (an O_EXCL file, broken
+// when older than STALE_LOCK_MS), so they queue instead of losing each other's writes.
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const permission_rule_1 = require("./permission-rule");
+const settings_rules_1 = require("./settings-rules");
+/** How long a once-rule may outlive its card when the retried call never reports back. The retry
+ *  starts within seconds; this only bounds a rule left behind by a session that went away. */
+exports.ONCE_TTL_MS = 5 * 60_000;
+const LOCK_WAIT_MS = 5_000;
+const LOCK_POLL_MS = 50;
+const STALE_LOCK_MS = 30_000;
+const grantsFile = () => path.join((0, config_1.configDir)(), "permission-grants.json");
+const lockFile = () => path.join((0, config_1.configDir)(), "permission-grants.lock");
+/**
+ * Write the rules into the settings file and record the grant. All or nothing: when the record
+ * cannot be written the rules are taken back out, and when the rules cannot be written nothing is
+ * recorded.
+ *
+ * @throws with nothing changed (as far as the filesystem allows) when either write fails.
+ */
+async function grantRules(request, now = Date.now()) {
+    return withGrantsLock(() => {
+        const added = (0, settings_rules_1.addAllowRules)(request.settingsFile, request.rules);
+        const grant = {
+            id: crypto.randomBytes(4).toString("hex"),
+            kind: request.kind,
+            rules: added,
+            settingsFile: request.settingsFile,
+            call: request.call,
+            shown: request.shown,
+            claudeSessionId: request.claudeSessionId,
+            ...(request.session ? { session: request.session } : {}),
+            addedAt: new Date(now).toISOString(),
+            ...(request.kind === "once" ? { expiresAt: new Date(now + exports.ONCE_TTL_MS).toISOString() } : {}),
+            retries: 0,
+        };
+        try {
+            writeGrants([...readGrants(), grant]);
+        }
+        catch (err) {
+            (0, settings_rules_1.removeAllowRules)(request.settingsFile, added);
+            throw err;
+        }
+        return grant;
+    });
+}
+/** Every recorded grant, once-grants included. */
+function listGrants() {
+    return readGrants();
+}
+/**
+ * The live grant that already covers this call, if any: an always-grant from any session, or a
+ * once-grant of this Claude Code session that has not expired.
+ */
+function coveringGrant(claudeSessionId, call, now = Date.now()) {
+    return readGrants().find((g) => (0, permission_rule_1.sameCall)(g.call, call) &&
+        (g.kind === "always" || (g.claudeSessionId === claudeSessionId && !isExpired(g, now))));
+}
+/** Count one silent retry against a grant. */
+async function noteRetry(id) {
+    await withGrantsLock(() => {
+        writeGrants(readGrants().map((g) => (g.id === id ? { ...g, retries: g.retries + 1 } : g)));
+    });
+}
+/** Take a grant back: its rules out of the settings file, then its record. False: no such grant. */
+async function revokeGrant(id) {
+    return withGrantsLock(() => {
+        const grants = readGrants();
+        const grant = grants.find((g) => g.id === id);
+        if (!grant)
+            return false;
+        revokeLocked(grant, grants);
+        return true;
+    });
+}
+/** After a call finished: take back the once-grants of this session that were for it. */
+async function consumeOnceGrants(claudeSessionId, call) {
+    return revokeWhere((g) => g.kind === "once" && g.claudeSessionId === claudeSessionId && (0, permission_rule_1.sameCall)(g.call, call));
+}
+/** Take back every once-grant whose TTL has passed. */
+async function sweepExpiredGrants(now = Date.now()) {
+    return revokeWhere((g) => g.kind === "once" && isExpired(g, now));
+}
+/** Is there any once-grant at all? The after-hook's fast exit, read without the lock. */
+function hasOnceGrants() {
+    return readGrants().some((g) => g.kind === "once");
+}
+async function revokeWhere(match) {
+    return withGrantsLock(() => {
+        let grants = readGrants();
+        const doomed = grants.filter(match);
+        for (const grant of doomed)
+            grants = revokeLocked(grant, grants);
+        return doomed.length;
+    });
+}
+/** Remove `grant`'s rules — except any another remaining grant also holds — then its record.
+ *  Returns the remaining grants. Caller holds the lock. */
+function revokeLocked(grant, grants) {
+    const rest = grants.filter((g) => g.id !== grant.id);
+    const stillHeld = new Set(rest.filter((g) => g.settingsFile === grant.settingsFile).flatMap((g) => g.rules));
+    (0, settings_rules_1.removeAllowRules)(grant.settingsFile, grant.rules.filter((r) => !stillHeld.has(r)));
+    writeGrants(rest);
+    return rest;
+}
+function isExpired(grant, now) {
+    const at = grant.expiresAt ? Date.parse(grant.expiresAt) : Number.NaN;
+    // A once-grant with no readable expiry is treated as expired: it can only be taken back early.
+    return grant.kind === "once" && (!Number.isFinite(at) || at <= now);
+}
+// ─── The file ────────────────────────────────────────────────────────────────
+function readGrants() {
+    let text;
+    try {
+        text = fs.readFileSync(grantsFile(), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const parsed = JSON.parse(text);
+    const grants = parsed?.grants;
+    if (!Array.isArray(grants))
+        throw new Error(`${grantsFile()} is not a BayChat grants file.`);
+    return grants;
+}
+function writeGrants(grants) {
+    const file = grantsFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify({ version: 1, grants }, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/**
+ * Run `fn` holding the grants lock. The lock is an exclusive-create file; one older than
+ * STALE_LOCK_MS belonged to a process that died holding it and is broken. Gives up (throws) after
+ * LOCK_WAIT_MS rather than waiting forever — every caller fails closed on a throw.
+ */
+async function withGrantsLock(fn) {
+    const file = lockFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const giveUpAt = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            fs.closeSync(fs.openSync(file, "wx", 0o600));
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            if (lockAge(file) > STALE_LOCK_MS) {
+                fs.rmSync(file, { force: true });
+                continue;
+            }
+            if (Date.now() >= giveUpAt)
+                throw new Error(`Another BayChat process holds ${file}; try again.`);
+            await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        fs.rmSync(file, { force: true });
+    }
+}
+function lockAge(file) {
+    try {
+        return Date.now() - fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}

package/dist/denied/opt-in.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedCardEnabled = deniedCardEnabled;
+exports.enableDeniedCard = enableDeniedCard;
+exports.disableDeniedCard = disableDeniedCard;
+// Whether this computer's owner turned the denied-command card on (`baychat permissions on`).
+//
+// OFF UNTIL SOMEBODY ASKS FOR IT, like approve-hook was: the card lets a phone add a permission
+// rule on this computer, so it exists only after a deliberate act. The switch is a file in
+// `~/.baychat`, read when BayChat's launcher writes a session's `--settings` file
+// (relay/launcher/approval-settings.ts), so it takes effect for sessions started after it changes.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const optInFile = () => path.join((0, config_1.configDir)(), "denied-card.json");
+/** True only when the switch file says so. Any doubt — missing, unreadable, malformed — is off. */
+function deniedCardEnabled() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(optInFile(), "utf8"));
+        return parsed?.enabled === true;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
+        }
+        return false;
+    }
+}
+function enableDeniedCard(now = new Date()) {
+    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled: true, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
+}
+function disableDeniedCard() {
+    fs.rmSync(optInFile(), { force: true });
+}

package/dist/denied/permission-rule.js

@@ -0,0 +1,183 @@
+"use strict";
+// What BayChat may write into Claude Code's settings for ONE call that auto mode denied — and,
+// just as important, what it refuses to write. Pure: no files, no network.
+//
+// THE RULE WE WRITE IS THE CALL, AND NOTHING WIDER. Claude Code resolves a matching
+// `permissions.allow` rule before its auto-mode classifier (permission-modes docs, "How the
+// classifier evaluates actions", step 1), so a rule is a real grant: whatever it matches runs
+// without review. Its syntax is a pattern language — `Bash(<text>)` matches the whole command
+// text with `*` as a wildcard, and a rule must match each subcommand of a chain on its own
+// (permissions docs, "Compound commands"). So:
+//
+//   • a command containing `*` is never turned into a rule: the star would be read as a wildcard
+//     and the rule would allow more than the person saw;
+//   • a command that runs another command inside it (backticks, `$( )`, brackets, a newline) has
+//     no exact rule at all — nothing is offered;
+//   • a chain (`a && b`, `a | b`, `a; b`) can only be allowed ONCE, as one rule per subcommand,
+//     and only when it holds no quotes, because splitting quoted shell text by hand is how a
+//     parser and a person end up disagreeing about what runs;
+//   • "Always" is offered only for ONE plain command with no variable expansion, no redirection
+//     and nothing that looks like a secret (a saved rule would keep that secret in a file).
+//
+// The card text is built from `shown`, which masks obvious secrets; the rule is built from the
+// real text, because a rule that differs from the call matches nothing.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RULE_COMMAND_LENGTH = void 0;
+exports.planDeniedCall = planDeniedCall;
+exports.callKeyOf = callKeyOf;
+exports.sameCall = sameCall;
+exports.redactSecrets = redactSecrets;
+/** Longer than this is not a command a person can check on a phone, nor one a rule should hold. */
+exports.MAX_RULE_COMMAND_LENGTH = 1000;
+/** Claude Code itself saves at most five rules for one approved chain (permissions docs). */
+const MAX_CHAIN_PARTS = 5;
+/** `&&`, `||`, `|&`, `;`, `|`, and a lone `&` that is not part of a redirection (`2>&1`, `&>`). */
+const CHAIN_OPERATOR = /&&|\|\||\|&|;|\||(?<![>&])&(?![>&])/;
+const CHAIN_SPLIT = /\s*(?:&&|\|\||\|&|;|\||(?<![>&])&(?![>&]))\s*/;
+const NESTED_COMMAND = /`|\$\(|[()]/;
+const MCP_TOOL = /^mcp__[A-Za-z0-9_-]+__[A-Za-z0-9_.-]+$/;
+const str = (v) => (typeof v === "string" ? v : "");
+/** Plan the rules for one denied call. Never throws. */
+function planDeniedCall(toolName, toolInput) {
+    const input = (toolInput && typeof toolInput === "object" ? toolInput : {});
+    if (toolName === "Bash")
+        return planBash(str(input.command).trim());
+    if (toolName === "WebFetch")
+        return planWebFetch(str(input.url).trim());
+    if (MCP_TOOL.test(toolName)) {
+        return {
+            shown: `${toolName} ${clipJson(input)}`,
+            onceRules: [toolName],
+            alwaysAllowed: false,
+            limitation: "A rule for an MCP tool allows every use of that tool, so BayChat only allows it once.",
+            call: { tool: toolName, subject: toolName },
+        };
+    }
+    return nothing(`${toolName} ${clipJson(input)}`, "BayChat can only allow shell commands, web fetches and MCP tools from your phone; " +
+        "approve this one at the computer (/permissions → Recently denied).");
+}
+function planBash(command) {
+    const { text: shown, redacted } = redactSecrets(command);
+    if (!command)
+        return nothing("(no command)", "The blocked call carried no command.");
+    if (command.length > exports.MAX_RULE_COMMAND_LENGTH) {
+        return nothing(clip(shown), "It is too long to allow as one exact command; approve it at the computer.");
+    }
+    if (/[\r\n]/.test(command)) {
+        return nothing(shown, "It spans several lines, which no exact rule can describe; approve it at the computer.");
+    }
+    if (NESTED_COMMAND.test(command)) {
+        return nothing(shown, "It runs a command inside another (backticks, $( ) or brackets), which no exact rule can describe; " +
+            "approve it at the computer.");
+    }
+    if (command.includes("*")) {
+        return nothing(shown, "It contains *, which Claude Code reads as a wildcard, so a rule would allow more than this command; " +
+            "approve it at the computer.");
+    }
+    const call = { tool: "Bash", subject: command };
+    if (CHAIN_OPERATOR.test(command)) {
+        if (/["'\\]/.test(command)) {
+            return nothing(shown, "It chains several commands and quotes text, so BayChat cannot split it safely; ask the session to " +
+                "run them one at a time.");
+        }
+        const parts = command.split(CHAIN_SPLIT);
+        if (parts.some((p) => p === "") || parts.length > MAX_CHAIN_PARTS) {
+            return nothing(shown, "BayChat cannot split this chain into exact commands; approve it at the computer.");
+        }
+        return {
+            shown,
+            onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
+            alwaysAllowed: false,
+            limitation: `It chains ${parts.length} commands, so BayChat only allows it once.`,
+            call,
+        };
+    }
+    const refusal = redacted
+        ? "It carries what looks like a secret, and a saved rule would keep it in a settings file, so BayChat only allows it once."
+        : command.includes("$")
+            ? "It expands a variable, so the same text could run something different later; BayChat only allows it once."
+            : /[<>]/.test(command)
+                ? "It redirects to or from a file, so BayChat only allows it once."
+                : "";
+    return { shown, onceRules: [`Bash(${command})`], alwaysAllowed: refusal === "", limitation: refusal, call };
+}
+function planWebFetch(url) {
+    let host = "";
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        /* not a URL: nothing to allow */
+    }
+    const shown = redactSecrets(url).text;
+    if (!host || !/^[A-Za-z0-9.-]+$/.test(host))
+        return nothing(shown || "(no URL)", "The blocked fetch has no usable address.");
+    return {
+        shown,
+        onceRules: [`WebFetch(domain:${host})`],
+        alwaysAllowed: false,
+        limitation: `A WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
+        call: { tool: "WebFetch", subject: host },
+    };
+}
+/** The key a call is matched by — the same for the denied call and the retried one. */
+function callKeyOf(toolName, toolInput) {
+    const input = (toolInput && typeof toolInput === "object" ? toolInput : {});
+    if (toolName === "Bash") {
+        const command = str(input.command).trim();
+        return command ? { tool: "Bash", subject: command } : undefined;
+    }
+    if (toolName === "WebFetch") {
+        try {
+            return { tool: "WebFetch", subject: new URL(str(input.url).trim()).hostname };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return MCP_TOOL.test(toolName) ? { tool: toolName, subject: toolName } : undefined;
+}
+function sameCall(a, b) {
+    return a.tool === b.tool && a.subject === b.subject;
+}
+function nothing(shown, limitation) {
+    return { shown, onceRules: [], alwaysAllowed: false, limitation };
+}
+// ─── Redaction ───────────────────────────────────────────────────────────────
+const MASK = "[redacted]";
+/** `scheme://user:password@host` → `scheme://[redacted]@host`. */
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+/** Shapes that are a credential wherever they appear. */
+const KNOWN_TOKENS = /\b(?:bay_[A-Za-z0-9_]{8,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|npm_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})/g;
+/** `Bearer <x>`, `Basic <x>`, `token <x>` (an Authorization header's value). */
+const AUTH_SCHEME = /\b(Bearer|Basic|token)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+/** `--token x`, `--api-key=x`, `-password x`, `--client-secret "x"`, … */
+const SECRET_FLAG = /(--?[A-Za-z0-9_-]*(?:token|secret|passw(?:or)?d|pass|api[-_]?key|apikey|auth|credential|private[-_]?key)[A-Za-z0-9_-]*)(=|\s+)("[^"]*"|'[^']*'|[^\s;&|]+)/gi;
+/** `FOO=…` at the start of a word: an environment assignment, whatever its name. */
+const ENV_ASSIGNMENT = /(^|[\s;&|])([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]+)/g;
+/**
+ * The text with obvious secrets masked, and whether anything was. Errs towards masking: a card is
+ * read on a lock screen and stored in a chat, and a masked word costs nothing but a glance.
+ * It is not a guarantee — an unusual secret in a positional argument passes — which is one more
+ * reason "Always" is never offered for a command this changes.
+ */
+function redactSecrets(text) {
+    const out = text
+        .replace(URL_CREDENTIALS, `$1${MASK}@`)
+        .replace(KNOWN_TOKENS, MASK)
+        .replace(AUTH_SCHEME, `$1 ${MASK}`)
+        .replace(SECRET_FLAG, (_m, flag, sep) => `${flag}${sep}${MASK}`)
+        .replace(ENV_ASSIGNMENT, (_m, lead, name) => `${lead}${name}=${MASK}`);
+    return { text: out, redacted: out !== text };
+}
+function clip(text, max = 600) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+function clipJson(value) {
+    try {
+        return clip(redactSecrets(JSON.stringify(value)).text, 400);
+    }
+    catch {
+        return "(its parameters could not be displayed)";
+    }
+}

package/dist/denied/settings-rules.js

@@ -0,0 +1,160 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addAllowRules = addAllowRules;
+exports.removeAllowRules = removeAllowRules;
+exports.localSettingsFile = localSettingsFile;
+// Adding and removing exact `permissions.allow` entries in ONE Claude Code settings file — and
+// touching nothing else in it.
+//
+// THE ONLY EDIT THIS MODULE MAKES is to append a string to `permissions.allow`, or to take a
+// string BayChat put there back out. `deny`, `ask`, `defaultMode`, `hooks` and every other key are
+// carried through untouched, in the file's own indentation. A file that does not parse, is not a
+// JSON object, or has a `permissions`/`allow` of the wrong shape is REFUSED and left exactly as it
+// was: a permission file we half-understood is not one we get to rewrite.
+//
+// Writes are atomic (a temp file beside the target, then a rename — `nodeSettingsIo`, shared with
+// claude-settings.ts) and keep the file's mode. A symlinked settings file is followed, as Claude
+// Code follows it, and a dangling link is refused.
+//
+// WHICH FILE. The project's `.claude/settings.local.json`: the file Claude Code itself saves "Yes,
+// and don't ask again" into, which it watches and reloads during a session, which applies to this
+// project only, and which Claude Code keeps out of git. See `localSettingsFile` for where exactly.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const claude_settings_1 = require("../claude-settings");
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+/** Add each rule that is not already allowed. Returns the ones this call added (none: unchanged).
+ *  @throws with the file untouched when it cannot be read as a settings object. */
+function addAllowRules(file, rules, io = claude_settings_1.nodeSettingsIo) {
+    const edit = readSettings(file, io);
+    const allow = allowListOf(edit.settings, edit.target);
+    const added = rules.filter((rule, i) => !allow.includes(rule) && rules.indexOf(rule) === i);
+    if (added.length === 0)
+        return [];
+    writeAllow(edit, [...allow, ...added], io);
+    return added;
+}
+/** Take each rule out of `permissions.allow`. Idempotent: an absent file or rule is already gone.
+ *  @throws with the file untouched when it cannot be read as a settings object. */
+function removeAllowRules(file, rules, io = claude_settings_1.nodeSettingsIo) {
+    const edit = readSettings(file, io);
+    if (edit.text === null)
+        return;
+    const allow = allowListOf(edit.settings, edit.target);
+    const kept = allow.filter((rule) => !rules.includes(rule));
+    if (kept.length === allow.length)
+        return;
+    writeAllow(edit, kept, io);
+}
+function readSettings(file, io) {
+    const target = io.realpath(file);
+    const text = io.read(target);
+    if (text === null || text.trim() === "")
+        return { target, text, settings: {} };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${target} is not valid JSON, so BayChat left it untouched.`);
+    }
+    if (!isRecord(parsed))
+        throw new Error(`${target} is not a JSON object, so BayChat left it untouched.`);
+    return { target, text, settings: parsed };
+}
+function allowListOf(settings, target) {
+    const permissions = settings.permissions;
+    if (permissions === undefined)
+        return [];
+    if (!isRecord(permissions))
+        throw new Error(`${target}: "permissions" is not an object, so BayChat left it untouched.`);
+    const allow = permissions.allow;
+    if (allow === undefined)
+        return [];
+    if (!Array.isArray(allow) || !allow.every((r) => typeof r === "string")) {
+        throw new Error(`${target}: "permissions.allow" is not a list of rules, so BayChat left it untouched.`);
+    }
+    return allow;
+}
+function writeAllow(edit, allow, io) {
+    const permissions = isRecord(edit.settings.permissions) ? edit.settings.permissions : {};
+    const next = { ...edit.settings, permissions: { ...permissions, allow } };
+    const indent = edit.text ? (0, claude_settings_1.detectIndent)(edit.text) : 2;
+    // A new file is private: a once-rule can carry a command's own arguments.
+    io.write(edit.target, `${JSON.stringify(next, null, indent)}\n`, io.mode(edit.target) ?? 0o600);
+}
+/**
+ * The `.claude/settings.local.json` Claude Code reads for a session started in `projectDir`.
+ *
+ * Mirrors the settings docs ("Yes, and don't ask again" → `.claude/settings.local.json`): Claude
+ * Code keeps that file at the GIT REPOSITORY ROOT (in a worktree, the main checkout's root), and
+ * beside `.claude/settings.json` in the starting directory instead when there is no repository,
+ * when the root is the home directory, on Windows, or when the root, its `.git` or its `.claude`
+ * is not owned by this user.
+ */
+function localSettingsFile(projectDir, deps = {}) {
+    const home = deps.home ?? os.homedir();
+    const platform = deps.platform ?? process.platform;
+    const ownedByMe = deps.ownedByMe ?? isOwnedByMe;
+    const exists = deps.exists ?? fs.existsSync;
+    const commonDir = (deps.gitCommonDir ?? gitCommonDir)(projectDir);
+    const gitDir = commonDir ? path.resolve(projectDir, commonDir) : undefined;
+    const root = gitDir && path.basename(gitDir) === ".git" ? path.dirname(gitDir) : undefined;
+    const usable = root !== undefined &&
+        platform !== "win32" &&
+        path.resolve(root) !== path.resolve(home) &&
+        ownedByMe(root) &&
+        ownedByMe(path.join(root, ".git")) &&
+        (!exists(path.join(root, ".claude")) || ownedByMe(path.join(root, ".claude")));
+    return path.join(usable ? root : projectDir, ".claude", "settings.local.json");
+}
+function gitCommonDir(dir) {
+    const r = (0, child_process_1.spawnSync)("git", ["rev-parse", "--git-common-dir"], { cwd: dir, encoding: "utf8", timeout: 5_000 });
+    if (r.error || r.status !== 0)
+        return undefined;
+    return String(r.stdout ?? "").trim() || undefined;
+}
+function isOwnedByMe(p) {
+    try {
+        const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+        return uid === undefined || fs.statSync(p).uid === uid;
+    }
+    catch {
+        return false;
+    }
+}