baychat 0.29.9 → 0.30.0

package/dist/denied/transcript.js

@@ -0,0 +1,150 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.verifyDeniedCall = verifyDeniedCall;
+exports.findToolUse = findToolUse;
+// Proof that a denial really happened: the denied call must be in the session's own transcript.
+//
+// WHY. `baychat denied-hook` reads its event from stdin, and stdin is something anybody can
+// write — including the agent, by running `echo '{…}' | baychat denied-hook` itself. A forged
+// event would put a card on the owner's phone claiming a block that never occurred. So before
+// anything is posted, the call the event names (`tool_use_id`, `tool_name`, and the command or
+// target) must appear as a tool call the MODEL made, in the transcript Claude Code keeps under
+// `~/.claude/projects/` — a protected path the agent cannot write without a prompt.
+//
+// It is defence in depth, not the boundary: the owner's answer is. A card the agent somehow did
+// cause still writes nothing unless the owner taps a yes.
+//
+// THE TRANSCRIPT CAN LAG. The hooks reference says it "is written asynchronously and may lag the
+// in-memory conversation", so a missing call is polled for, briefly, before it counts as absent.
+// For a subagent's call the hook still gets the MAIN transcript (with `agent_id`); its calls are
+// in `<session>/subagents/agent-<id>.jsonl` beside it.
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const permission_rule_1 = require("./permission-rule");
+/** How long a call may take to reach the transcript before it counts as never made. */
+exports.TRANSCRIPT_WAIT_MS = 10_000;
+const TRANSCRIPT_POLL_MS = 250;
+/** Only the end of the file is read: the denied call is the newest thing in it. */
+const TAIL_BYTES = 4 * 1024 * 1024;
+/** Did the model really make this call in this session? NEVER THROWS. */
+async function verifyDeniedCall(ref, deps = {}) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
+    const readTail = deps.readTail ?? readFileTail;
+    try {
+        const projects = realpath(path.join(deps.claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "projects"));
+        const wanted = (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
+        if (!ref.toolUseId || !wanted)
+            return { ok: false, why: "the event names no call that can be checked" };
+        if (!path.isAbsolute(ref.transcriptPath) || !ref.transcriptPath.endsWith(".jsonl")) {
+            return { ok: false, why: "the event carries no transcript" };
+        }
+        const file = ref.agentId
+            ? path.join(ref.transcriptPath.slice(0, -".jsonl".length), "subagents", `${ref.agentId.startsWith("agent-") ? ref.agentId : `agent-${ref.agentId}`}.jsonl`)
+            : ref.transcriptPath;
+        const giveUpAt = now() + exports.TRANSCRIPT_WAIT_MS;
+        for (;;) {
+            let real;
+            try {
+                real = realpath(file);
+            }
+            catch {
+                real = undefined; // not written yet
+            }
+            if (real !== undefined && !real.startsWith(projects + path.sep)) {
+                return { ok: false, why: "the transcript is not in Claude Code's own folder" };
+            }
+            const tail = real === undefined ? undefined : readTail(real);
+            const found = tail === undefined ? undefined : findToolUse(tail, ref.toolUseId);
+            if (found) {
+                const key = (0, permission_rule_1.callKeyOf)(found.name, found.input);
+                return found.name === ref.toolName && key !== undefined && (0, permission_rule_1.sameCall)(key, wanted)
+                    ? { ok: true }
+                    : { ok: false, why: "the transcript's call is not the one the event names" };
+            }
+            if (now() >= giveUpAt)
+                return { ok: false, why: "the call is not in the session's transcript" };
+            await sleep(TRANSCRIPT_POLL_MS);
+        }
+    }
+    catch (err) {
+        return { ok: false, why: `the transcript could not be read (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+/** The model's tool call with this id, from transcript JSONL text. */
+function findToolUse(text, toolUseId) {
+    for (const line of text.split("\n")) {
+        if (!line.includes(toolUseId))
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue; // the cut-off first line of a tail, or a line being written
+        }
+        const e = entry;
+        if (e.type !== "assistant" || !Array.isArray(e.message?.content))
+            continue;
+        for (const block of e.message.content) {
+            if (block?.type === "tool_use" && block.id === toolUseId && typeof block.name === "string") {
+                return { name: block.name, input: block.input };
+            }
+        }
+    }
+    return undefined;
+}
+function readFileTail(file) {
+    let fd;
+    try {
+        fd = fs.openSync(file, "r");
+        const size = fs.fstatSync(fd).size;
+        const length = Math.min(size, TAIL_BYTES);
+        const buf = Buffer.alloc(length);
+        fs.readSync(fd, buf, 0, length, size - length);
+        return buf.toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}

package/dist/denied-hook.js

@@ -0,0 +1,329 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELOAD_SETTLE_MS = void 0;
+exports.retryOutput = retryOutput;
+exports.composeDeniedQuestion = composeDeniedQuestion;
+exports.offeredMeanings = offeredMeanings;
+exports.decideDenied = decideDenied;
+exports.cmdDeniedHook = cmdDeniedHook;
+// `baychat denied-hook` — the Claude Code PermissionDenied hook that turns an auto-mode block into
+// a card on the owner's phone, and the owner's "yes" into the one exact permission rule that lets
+// the session run that call.
+//
+// WHY THIS EXISTS. Auto mode's classifier HARD-denies some calls — `npx eas-cli build …`, a release
+// script, `npm publish`. A hard denial draws no prompt, so approve-hook (a PermissionRequest hook)
+// never runs, and the only way through was to walk to the computer and type `/permissions`. Karmen:
+// "We have to have this possibility as people have to use BayChat also when not near computer".
+// See docs/features/DENIED_COMMAND_CARD.md.
+//
+// WHAT CLAUDE CODE GIVES US (hooks reference, "PermissionDenied"): the event fires only in auto
+// mode, after the denial; "Exit code and stderr are ignored because the denial already occurred";
+// the one output read is `hookSpecificOutput.retry: true`, which "adds a message to the
+// conversation telling the model it may retry the tool call" — it does not reverse the denial. So
+// the retry only succeeds because, before printing it, THIS PROCESS (never the agent) writes an
+// allow rule that matches exactly that call into the project's `.claude/settings.local.json`,
+// which Claude Code reloads live and checks before the classifier.
+//
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// FAIL-CLOSED HERE MEANS "PRINT NOTHING".
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+//
+// Unlike approve-hook, silence is safe: no output leaves the denial standing. Every abnormal path
+// — no credential, no transcript proof, BayChat unreachable, an unanswered card, a settings file
+// we cannot parse, an exception — prints nothing and writes no rule. A rule is written only after
+// the card's owner tapped a yes, and `retry` is printed only after the rule was written.
+//
+// THE PROCESS BLOCKS THE SESSION WHILE IT WAITS, like approve-hook: hooks are awaited, so the
+// session stops until the owner answers or our deadline passes. That is the reliable shape: the
+// rule is in place before the model hears "you may retry", and the retry happens at once, in the
+// same turn. Being killed by the handler timeout is harmless here (the denial stands), but the
+// same 3600 s / 3900 s pair as approve-hook keeps our own deadline first, so the card is withdrawn
+// rather than left looking answerable.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("./approve-hook");
+const approval_wait_1 = require("./approval-wait");
+const config_1 = require("./config");
+const hook_stdin_1 = require("./hook-stdin");
+const grants_1 = require("./denied/grants");
+const permission_rule_1 = require("./denied/permission-rule");
+const settings_rules_1 = require("./denied/settings-rules");
+const transcript_1 = require("./denied/transcript");
+function retryOutput() {
+    return { hookSpecificOutput: { hookEventName: "PermissionDenied", retry: true } };
+}
+// ─── The card ────────────────────────────────────────────────────────────────
+const LOG_LABEL = "baychat denied-hook";
+const LABEL = {
+    once: "Allow once",
+    always: "Always allow this exact command",
+    no: "No",
+};
+/** The single button of a card that only informs: nothing can be allowed from BayChat. */
+const NOTICE_OPTIONS = ["OK"];
+/** The card's own limits (apps/api/src/lib/cards.ts), used only to TRIM. */
+const QUESTION_MAX = 2000;
+const SHOWN_MAX = 900;
+/**
+ * Give Claude Code's settings watcher this long to load the new rule before the model is told to
+ * retry. Claude Code does not say how fast its watcher is; this is a margin, and a retry that
+ * still meets the old settings is handled (see `MAX_SILENT_RETRIES`).
+ */
+exports.RELOAD_SETTLE_MS = 1500;
+/** A call denied AGAIN while a grant already covers it is retried this many times without a new
+ *  card (the watcher was slower than RELOAD_SETTLE_MS). After that the rule evidently does not
+ *  match how Claude Code reads the call, and the owner is told so. */
+const MAX_SILENT_RETRIES = 1;
+/** The classifier gave no verdict: Claude Code ignores `retry` for these, and a rule written for a
+ *  transient failure would outlive it. Texts from the hooks reference. */
+function isNoVerdict(reason) {
+    return reason.startsWith("Auto mode could not evaluate") || reason === "Classifier unavailable";
+}
+/** The card's question. A person decides from this text alone, on a lock screen. */
+function composeDeniedQuestion(q) {
+    const shown = q.plan.shown.length <= SHOWN_MAX ? q.plan.shown : `${q.plan.shown.slice(0, SHOWN_MAX - 1)}…`;
+    const offers = q.plan.onceRules.length
+        ? [
+            `Allow once: BayChat adds ${q.plan.onceRules.length === 1 ? "this exact rule" : "these exact rules"} to ` +
+                `${q.settingsFile} for the retry, then takes ${q.plan.onceRules.length === 1 ? "it" : "them"} out.`,
+            q.plan.alwaysAllowed ? "Always: BayChat keeps the rule there (`baychat permissions list` shows it)." : "",
+        ]
+        : [];
+    const lines = [
+        `${q.who} on ${q.host} was blocked by Claude Code's auto mode:`,
+        "",
+        shown,
+        "",
+        q.reason ? `Reason: ${q.reason}` : "",
+        q.cwd ? `Working directory: ${q.cwd}` : "",
+        "",
+        ...offers,
+        q.plan.limitation,
+    ];
+    const text = lines.filter((l) => l !== undefined).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+    return text.length <= QUESTION_MAX ? text : `${text.slice(0, QUESTION_MAX - 1)}…`;
+}
+/** The buttons for a plan: every option it allows, and always a way to say no. */
+function offeredMeanings(plan) {
+    if (plan.onceRules.length === 0)
+        return [];
+    return plan.alwaysAllowed ? ["once", "always", "no"] : ["once", "no"];
+}
+function parseArgs(argv) {
+    const at = (name) => {
+        const i = argv.indexOf(name);
+        return i >= 0 && i + 1 < argv.length ? argv[i + 1] : undefined;
+    };
+    const rawTimeout = Number(at("--timeout"));
+    return {
+        session: at("--session"),
+        fromClaude: argv.includes("--session-from-claude"),
+        waitSeconds: Number.isFinite(rawTimeout) && rawTimeout > 0 ? rawTimeout : approve_hook_1.DEFAULT_WAIT_SECONDS,
+    };
+}
+const str = (v) => (typeof v === "string" ? v : "");
+/**
+ * Turn one PermissionDenied event into `retry` — or into nothing, which leaves the denial
+ * standing. NEVER THROWS. `retry` is returned only after the owner allowed the call and the rule
+ * that matches it is written.
+ */
+async function decideDenied(rawStdin, argv = [], deps = {}) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const log = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const opts = parseArgs(argv);
+        let input;
+        try {
+            const parsed = JSON.parse(rawStdin);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("not an object");
+            input = parsed;
+        }
+        catch {
+            log(`${LOG_LABEL}: the event could not be read from stdin; the denial stands.`);
+            return null;
+        }
+        if (input.hook_event_name !== "PermissionDenied") {
+            log(`${LOG_LABEL}: not a PermissionDenied event (${String(input.hook_event_name)}); the denial stands.`);
+            return null;
+        }
+        const reason = str(input.reason);
+        if (isNoVerdict(reason)) {
+            log(`${LOG_LABEL}: auto mode gave no verdict ("${reason}"), so Claude Code would ignore a retry.`);
+            return null;
+        }
+        const toolName = str(input.tool_name);
+        const claudeSessionId = str(input.session_id);
+        const call = (0, permission_rule_1.callKeyOf)(toolName, input.tool_input);
+        if (!toolName || !claudeSessionId) {
+            log(`${LOG_LABEL}: the event has no tool or session (keys: ${Object.keys(input).join(", ")}).`);
+            return null;
+        }
+        const session = opts.session ?? (opts.fromClaude ? (0, approve_hook_1.sessionFromClaude)(deps.claude) : undefined);
+        if (opts.fromClaude && session === undefined) {
+            log(`${LOG_LABEL}: this session has not joined BayChat yet; the denial stands.`);
+            return null;
+        }
+        const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
+        if (!device) {
+            log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
+            return null;
+        }
+        // Only a call the model really made may put a card on anybody's phone.
+        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({
+            transcriptPath: str(input.transcript_path),
+            agentId: str(input.agent_id) || undefined,
+            toolUseId: str(input.tool_use_id),
+            toolName,
+            toolInput: input.tool_input,
+        });
+        if (!proof.ok) {
+            log(`${LOG_LABEL}: ${proof.why}; no card was posted and the denial stands.`);
+            return null;
+        }
+        const host = (deps.hostname ?? os.hostname)();
+        const who = session ? `Session "${session}"` : "A Claude Code session";
+        const waitDeps = { now, sleep, log };
+        // A card that only informs: posted, never waited on (its deadline is already now).
+        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
+        // ── Already allowed, and denied again: the reload race, or a rule that does not match.
+        const covering = call ? (0, grants_1.coveringGrant)(claudeSessionId, call, now()) : undefined;
+        if (covering) {
+            if (covering.retries < MAX_SILENT_RETRIES) {
+                await (0, grants_1.noteRetry)(covering.id);
+                await sleep(exports.RELOAD_SETTLE_MS * 2);
+                return retryOutput();
+            }
+            if (covering.kind === "once")
+                await (0, grants_1.revokeGrant)(covering.id);
+            await notify(`${who} on ${host} is still blocked although you allowed it:\n\n${(0, permission_rule_1.planDeniedCall)(toolName, input.tool_input).shown}\n\n` +
+                "Claude Code did not accept the rule BayChat wrote for it. Approve it at the computer " +
+                "(/permissions → Recently denied).");
+            return null;
+        }
+        const projectDir = deps.projectDir ?? (process.env.CLAUDE_PROJECT_DIR || str(input.cwd));
+        if (!projectDir || !path.isAbsolute(projectDir)) {
+            log(`${LOG_LABEL}: no project directory to keep a rule in; the denial stands.`);
+            return null;
+        }
+        const settingsFile = (deps.settingsFileFor ?? settings_rules_1.localSettingsFile)(projectDir);
+        const plan = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
+        const question = composeDeniedQuestion({ who, host, plan, reason, cwd: str(input.cwd), settingsFile });
+        const meanings = offeredMeanings(plan);
+        if (meanings.length === 0) {
+            // Nothing can be allowed from BayChat; the owner still learns why the session stopped.
+            await notify(question);
+            return null;
+        }
+        const deadline = now() + opts.waitSeconds * 1000;
+        const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, {
+            session,
+            question,
+            options: meanings.map((m) => LABEL[m]),
+            guardedOptions: meanings.flatMap((m, i) => (m === "always" ? [i] : [])),
+        }, deadline, waitDeps, LOG_LABEL);
+        if (outcome.kind === "deadline") {
+            await (0, approval_wait_1.withdrawOwnerQuestion)(device, outcome.requestId, log);
+            log(`${LOG_LABEL}: nobody answered within ${opts.waitSeconds}s; the card was withdrawn and the denial stands.`);
+            return null;
+        }
+        if (outcome.kind !== "answered") {
+            log(`${LOG_LABEL}: ${outcome.kind === "failed" ? outcome.reason : outcome.kind}; the denial stands.`);
+            return null;
+        }
+        const meaning = (outcome.index !== null ? meanings[outcome.index] : undefined) ?? "no";
+        if (meaning === "no" || !plan.call)
+            return null;
+        let grant;
+        try {
+            grant = await (0, grants_1.grantRules)({
+                kind: meaning,
+                rules: plan.onceRules,
+                settingsFile,
+                call: plan.call,
+                shown: plan.shown,
+                claudeSessionId,
+                session,
+            }, now());
+        }
+        catch (err) {
+            log(`${LOG_LABEL}: the rule could not be written (${(0, approval_wait_1.reasonOf)(err)}); the denial stands.`);
+            await notify(`BayChat could not save the rule you allowed, so ${who.toLowerCase()} stays blocked:\n\n${(0, approval_wait_1.reasonOf)(err)}`);
+            return null;
+        }
+        if (grant.kind === "once" && grant.expiresAt) {
+            (deps.scheduleSweep ?? scheduleSweep)(Date.parse(grant.expiresAt));
+        }
+        await sleep(exports.RELOAD_SETTLE_MS);
+        return retryOutput();
+    }
+    catch (err) {
+        log(`${LOG_LABEL}: unexpected failure (${(0, approval_wait_1.reasonOf)(err)}); the denial stands.`);
+        return null;
+    }
+}
+/**
+ * Start `baychat permissions sweep --at <ms>` detached, so a once-rule is taken back at its TTL
+ * even when the retried call never reports back and no other hook runs. Best effort: the
+ * after-hook and every later hook run sweep too.
+ */
+function scheduleSweep(atMs) {
+    try {
+        const entry = fs.realpathSync(process.argv[1] ?? "");
+        const child = (0, child_process_1.spawn)(process.execPath, [entry, "permissions", "sweep", "--at", String(atMs)], {
+            detached: true,
+            stdio: "ignore",
+        });
+        child.unref();
+    }
+    catch (err) {
+        process.stderr.write(`${LOG_LABEL}: could not schedule the once-rule's removal (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+    }
+}
+/**
+ * `baychat denied-hook [--session <name> | --session-from-claude] [--timeout <seconds>]`
+ *
+ * Always returns 0 (Claude Code ignores this event's exit code). Prints `retry` or nothing.
+ */
+async function cmdDeniedHook(argv = [], stdin = process.stdin) {
+    const output = await decideDenied(await (0, hook_stdin_1.readStdin)(stdin), argv);
+    if (output)
+        process.stdout.write(`${JSON.stringify(output)}\n`);
+    return 0;
+}

package/dist/help-topics.js

@@ -136,10 +136,11 @@ A session is one terminal, named by you. It appears in the app as an agent your
 messages can reach, and it survives being parked.
 
     join_session({ session: "Session-A" })                      → a 1:1 with you
-    join_session({ session: "Session-A", group: "Ad Review" })   → that group + your private chat
+    join_session({ session: "Session-A", group: "Ad Review" })   → that group only
 
-**The group form also keeps a private chat with you**, under the same agent and
-session name. The join result includes its directConversationId.
+**A group join creates no private chat.** If you already have one with this
+session (same agent, same name), the result names it as directConversationId;
+otherwise there is none until you start one.
 
     list_sessions()   → name, live or idle, last seen
     end_session(...)  → park it; the chat and its history survive, and rejoining
@@ -167,7 +168,14 @@ a decision that expires silently is worse than one that waits.
 cards. It is on only for Claude Code sessions BayChat starts (from the phone,
 \`baychat claude\` or \`baychat start\`), never for a plain \`claude\`, and it moves
 the last line between an agent and your machine onto a phone — read
-docs/features/REMOTE_APPROVAL_HOOK.md. It fails CLOSED: every error denies.`,
+docs/features/REMOTE_APPROVAL_HOOK.md. It fails CLOSED: every error denies.
+
+When auto mode blocks a call outright there is no prompt to answer. With
+\`baychat permissions on\` (off by default), BayChat-started sessions then put a
+card in BayChat — Allow once / Always allow this exact command / No — and a yes
+writes that one exact rule to the project's .claude/settings.local.json and lets
+the session retry. \`baychat permissions\` lists and removes what it kept. See
+docs/features/DENIED_COMMAND_CARD.md.`,
 };
 exports.HELP_TOPICS = [GROUPS, SESSIONS, TOOLS, APPROVALS];
 /** Exact name first, then keyword, then a substring of the body. */

package/dist/hook-stdin.js

@@ -0,0 +1,35 @@
+"use strict";
+// A Claude Code hook's JSON input, read from stdin with a deadline. Imports nothing but Node, so
+// the fast-path hooks (denied/after-hook.ts) can use it without loading the CLI.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readStdin = readStdin;
+/**
+ * The hook's JSON input.
+ *
+ * Bounded, because a stdin that never closes would stall us until the handler timeout kills the
+ * process — and for approve-hook being killed ALLOWS. On timeout we return what arrived (usually
+ * nothing), which fails to parse, which each hook turns into its own fail-closed answer.
+ */
+function readStdin(stream = process.stdin, timeoutMs = 10_000) {
+    return new Promise((resolve) => {
+        let text = "";
+        let done = false;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(text);
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        // Do not hold the process open on the timer alone.
+        if (typeof timer.unref === "function")
+            timer.unref();
+        stream.setEncoding?.("utf8");
+        stream.on("data", (chunk) => {
+            text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        });
+        stream.on("end", finish);
+        stream.on("error", finish);
+    });
+}

package/dist/index.js

@@ -12,7 +12,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 /** Kept in step with `FAST_CONTEXT_COMMANDS` in claude-context.ts (a test pins the two). */
 const FAST_COMMANDS = new Set(["context-statusline", "context-hook", "context-flush"]);
 const command = process.argv[2];
-if (command !== undefined && FAST_COMMANDS.has(command)) {
+if (command === "denied-after") {
+    // The denied-command card's after-hook runs on every matching tool call (as an async hook), so
+    // it too must not load the CLI. It imports only its own files and Node.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const after = require("./denied/after-hook");
+    after.cmdDeniedAfter().then((code) => {
+        process.exitCode = code;
+    }, (err) => {
+        process.stderr.write(`baychat denied-after: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exitCode = 0;
+    });
+}
+else if (command !== undefined && FAST_COMMANDS.has(command)) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const fast = require("./claude-context");
     fast.runFastContextCommand(command, process.argv.slice(3)).then(

package/dist/main.js

@@ -3,6 +3,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./commands");
 const approve_hook_1 = require("./approve-hook");
+const denied_hook_1 = require("./denied-hook");
+const permissions_command_1 = require("./permissions-command");
 const context_hooks_command_1 = require("./context-hooks-command");
 const session_name_1 = require("./session-name");
 const start_command_1 = require("./start-command");
@@ -301,6 +303,13 @@ async function main() {
             // exit-1 hook with no JSON on stdout is a NON-BLOCKING error: the tool call proceeds. The
             // guard in the catch below covers that anyway.
             return await (0, approve_hook_1.cmdApproveHook)(args);
+        case "denied-hook":
+            // Never throws and always returns 0; prints `retry` or nothing (see denied-hook.ts). For
+            // this event Claude Code ignores the exit code, and printing nothing leaves the denial
+            // standing — so a crash here is already the safe outcome.
+            return await (0, denied_hook_1.cmdDeniedHook)(args);
+        case "permissions":
+            return await (0, permissions_command_1.cmdPermissions)(args);
         case "context-hooks":
             return await (0, context_hooks_command_1.cmdContextHooks)(args);
         case "doctor":