baychat 0.29.9 → 0.31.0

package/dist/denied/grants.js

@@ -0,0 +1,292 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNCONFIRMED_STALE_MS = exports.ONCE_TTL_MS = void 0;
+exports.grantRules = grantRules;
+exports.listGrants = listGrants;
+exports.coveringGrant = coveringGrant;
+exports.noteRetry = noteRetry;
+exports.revokeGrant = revokeGrant;
+exports.consumeOnceGrants = consumeOnceGrants;
+exports.sweepExpiredGrants = sweepExpiredGrants;
+exports.hasOnceGrants = hasOnceGrants;
+exports.hasGrantsToSweep = hasGrantsToSweep;
+exports.findGrant = findGrant;
+exports.markConfirmed = markConfirmed;
+exports.isStaleUnconfirmed = isStaleUnconfirmed;
+exports.hasStaleUnconfirmed = hasStaleUnconfirmed;
+exports.sweepStaleUnconfirmed = sweepStaleUnconfirmed;
+// The permission rules BayChat itself wrote on this computer, and the one owner of every change to
+// them (`~/.baychat/permission-grants.json`, 0600).
+//
+// A GRANT is what one "Allow once" or "Always allow this exact command" answer did: the exact rules
+// it added to which settings file, and the call they were for. Recording it is what lets BayChat
+// take a once-rule back out after the retried call (or its TTL), list what it keeps
+// (`baychat permissions list`) and remove one again (`baychat permissions remove`) — without ever
+// touching a rule the person wrote themselves: a rule that was already in the file is not added,
+// so it is not recorded, so it is never removed.
+//
+// ONE LOCK FOR ALL OF IT. The hook, the after-hook, the TTL sweeper and the command can run at the
+// same time (two denials in one turn, a sweep while a retry lands), and each is a read-modify-write
+// of two files. Every operation below runs under `permission-grants.lock` (an O_EXCL file, broken
+// when older than STALE_LOCK_MS), so they queue instead of losing each other's writes.
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const permission_rule_1 = require("./permission-rule");
+const transcript_1 = require("./transcript");
+const settings_rules_1 = require("./settings-rules");
+/** How long a once-rule may outlive its card when the retried call never reports back. The retry
+ *  starts within seconds; this only bounds a rule left behind by a session that went away. */
+exports.ONCE_TTL_MS = 5 * 60_000;
+/** An unconfirmed grant older than this lost its confirmation (the child was killed, or never
+ *  started) and is taken back by the next hook run or sweep. The confirmation's own wait
+ *  (CONFIRM_WAIT_MS) plus room for its start-up. */
+exports.UNCONFIRMED_STALE_MS = transcript_1.CONFIRM_WAIT_MS + 30_000;
+const LOCK_WAIT_MS = 5_000;
+const LOCK_POLL_MS = 50;
+const STALE_LOCK_MS = 30_000;
+const grantsFile = () => path.join((0, config_1.configDir)(), "permission-grants.json");
+const lockFile = () => path.join((0, config_1.configDir)(), "permission-grants.lock");
+/**
+ * Write the rules into the settings file and record the grant. All or nothing: when the record
+ * cannot be written the rules are taken back out, and when the rules cannot be written nothing is
+ * recorded.
+ *
+ * @throws with nothing changed (as far as the filesystem allows) when either write fails.
+ */
+async function grantRules(request, now = Date.now()) {
+    return withGrantsLock(() => {
+        const added = (0, settings_rules_1.addAllowRules)(request.settingsFile, request.rules);
+        const grant = {
+            id: crypto.randomBytes(4).toString("hex"),
+            kind: request.kind,
+            rules: added,
+            settingsFile: request.settingsFile,
+            scope: request.scope,
+            call: request.call,
+            shown: request.shown,
+            claudeSessionId: request.claudeSessionId,
+            ...(request.session ? { session: request.session } : {}),
+            addedAt: new Date(now).toISOString(),
+            ...(request.kind === "once" ? { expiresAt: new Date(now + exports.ONCE_TTL_MS).toISOString() } : {}),
+            retries: 0,
+            ...(request.unconfirmed ? { unconfirmed: { ...request.unconfirmed, since: new Date(now).toISOString() } } : {}),
+        };
+        try {
+            writeGrants([...readGrants(), grant]);
+        }
+        catch (err) {
+            (0, settings_rules_1.removeAllowRules)(request.settingsFile, added);
+            throw err;
+        }
+        return grant;
+    });
+}
+/** Every recorded grant, once-grants included. */
+function listGrants() {
+    return readGrants();
+}
+/**
+ * The live grant that already covers this call, if any: an always-grant from any session, or a
+ * once-grant of this Claude Code session that has not expired.
+ */
+function coveringGrant(claudeSessionId, call, now = Date.now()) {
+    return readGrants().find((g) => (0, permission_rule_1.sameCall)(g.call, call) &&
+        (g.kind === "always" || (g.claudeSessionId === claudeSessionId && !isExpired(g, now))));
+}
+/** Count one silent retry against a grant. */
+async function noteRetry(id) {
+    await withGrantsLock(() => {
+        writeGrants(readGrants().map((g) => (g.id === id ? { ...g, retries: g.retries + 1 } : g)));
+    });
+}
+/** Take a grant back: its rules out of the settings file, then its record. False: no such grant. */
+async function revokeGrant(id) {
+    return withGrantsLock(() => {
+        const grants = readGrants();
+        const grant = grants.find((g) => g.id === id);
+        if (!grant)
+            return false;
+        revokeLocked(grant, grants);
+        return true;
+    });
+}
+/** After a call finished: take back the once-grants of this session that were for it. */
+async function consumeOnceGrants(claudeSessionId, call) {
+    return revokeWhere((g) => g.kind === "once" && g.claudeSessionId === claudeSessionId && (0, permission_rule_1.sameCall)(g.call, call));
+}
+/** Take back every once-grant whose TTL has passed. */
+async function sweepExpiredGrants(now = Date.now()) {
+    return revokeWhere((g) => g.kind === "once" && isExpired(g, now));
+}
+/** Is there any once-grant at all? Read without the lock. */
+function hasOnceGrants() {
+    return readGrants().some((g) => g.kind === "once");
+}
+/** Anything a sweep could act on — a once-grant, or one still unconfirmed? The after-hook's fast
+ *  exit, read without the lock. */
+function hasGrantsToSweep() {
+    return readGrants().some((g) => g.kind === "once" || g.unconfirmed !== undefined);
+}
+/** One grant by id, read without the lock. */
+function findGrant(id) {
+    return readGrants().find((g) => g.id === id);
+}
+/** The call was found in the transcript: the grant stands. False: no such grant (any more). */
+async function markConfirmed(id) {
+    return withGrantsLock(() => {
+        const grants = readGrants();
+        if (!grants.some((g) => g.id === id))
+            return false;
+        writeGrants(grants.map((g) => (g.id === id ? withoutUnconfirmed(g) : g)));
+        return true;
+    });
+}
+/** Is this grant still waiting for a confirmation that should have finished by `now`? */
+function isStaleUnconfirmed(grant, now = Date.now()) {
+    if (!grant.unconfirmed)
+        return false;
+    const since = Date.parse(grant.unconfirmed.since);
+    // Unreadable: it can only be taken back early.
+    return !Number.isFinite(since) || since + exports.UNCONFIRMED_STALE_MS <= now;
+}
+/** Is any grant's confirmation overdue? Read without the lock (the after-hook's cheap check). */
+function hasStaleUnconfirmed(now = Date.now()) {
+    return readGrants().some((g) => isStaleUnconfirmed(g, now));
+}
+/** Take back every grant whose confirmation never finished. Returns them, for the owner's notice. */
+async function sweepStaleUnconfirmed(now = Date.now()) {
+    return withGrantsLock(() => {
+        let grants = readGrants();
+        const doomed = grants.filter((g) => isStaleUnconfirmed(g, now));
+        for (const grant of doomed)
+            grants = revokeLocked(grant, grants);
+        return doomed;
+    });
+}
+function withoutUnconfirmed(grant) {
+    const { unconfirmed: _done, ...rest } = grant;
+    return rest;
+}
+async function revokeWhere(match) {
+    return withGrantsLock(() => {
+        let grants = readGrants();
+        const doomed = grants.filter(match);
+        for (const grant of doomed)
+            grants = revokeLocked(grant, grants);
+        return doomed.length;
+    });
+}
+/** Remove `grant`'s rules — except any another remaining grant also holds — then its record.
+ *  Returns the remaining grants. Caller holds the lock. */
+function revokeLocked(grant, grants) {
+    const rest = grants.filter((g) => g.id !== grant.id);
+    const stillHeld = new Set(rest.filter((g) => g.settingsFile === grant.settingsFile).flatMap((g) => g.rules));
+    (0, settings_rules_1.removeAllowRules)(grant.settingsFile, grant.rules.filter((r) => !stillHeld.has(r)));
+    writeGrants(rest);
+    return rest;
+}
+function isExpired(grant, now) {
+    const at = grant.expiresAt ? Date.parse(grant.expiresAt) : Number.NaN;
+    // A once-grant with no readable expiry is treated as expired: it can only be taken back early.
+    return grant.kind === "once" && (!Number.isFinite(at) || at <= now);
+}
+// ─── The file ────────────────────────────────────────────────────────────────
+function readGrants() {
+    let text;
+    try {
+        text = fs.readFileSync(grantsFile(), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return [];
+        throw err;
+    }
+    const parsed = JSON.parse(text);
+    const grants = parsed?.grants;
+    if (!Array.isArray(grants))
+        throw new Error(`${grantsFile()} is not a BayChat grants file.`);
+    return grants;
+}
+function writeGrants(grants) {
+    const file = grantsFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify({ version: 1, grants }, null, 2)}\n`, { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/**
+ * Run `fn` holding the grants lock. The lock is an exclusive-create file; one older than
+ * STALE_LOCK_MS belonged to a process that died holding it and is broken. Gives up (throws) after
+ * LOCK_WAIT_MS rather than waiting forever — every caller fails closed on a throw.
+ */
+async function withGrantsLock(fn) {
+    const file = lockFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const giveUpAt = Date.now() + LOCK_WAIT_MS;
+    for (;;) {
+        try {
+            fs.closeSync(fs.openSync(file, "wx", 0o600));
+            break;
+        }
+        catch (err) {
+            if (err.code !== "EEXIST")
+                throw err;
+            if (lockAge(file) > STALE_LOCK_MS) {
+                fs.rmSync(file, { force: true });
+                continue;
+            }
+            if (Date.now() >= giveUpAt)
+                throw new Error(`Another BayChat process holds ${file}; try again.`);
+            await new Promise((r) => setTimeout(r, LOCK_POLL_MS));
+        }
+    }
+    try {
+        return fn();
+    }
+    finally {
+        fs.rmSync(file, { force: true });
+    }
+}
+function lockAge(file) {
+    try {
+        return Date.now() - fs.statSync(file).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}

package/dist/denied/hook-log.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedHookLogPath = deniedHookLogPath;
+exports.appendHookLog = appendHookLog;
+exports.logBoth = logBoth;
+// `~/.baychat/denied-hook.log` — the denied-command card's own log.
+//
+// Claude Code ignores a PermissionDenied hook's stderr, so without a file a silent hook is
+// undiagnosable: "no card came" could mean never called, not joined, unproven call, or a failed
+// post. Shared by the hook and by the detached `baychat permissions confirm` it starts, so one
+// file tells the whole story of a denial. One line per step, NEVER the tool input (it can hold
+// secrets), kept small.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const HOOK_LOG_MAX_BYTES = 256 * 1024;
+function deniedHookLogPath() {
+    return path.join((0, config_1.configDir)(), "denied-hook.log");
+}
+/** Append one line, rotating at HOOK_LOG_MAX_BYTES. NEVER THROWS. */
+function appendHookLog(line) {
+    try {
+        const file = deniedHookLogPath();
+        try {
+            if (fs.statSync(file).size > HOOK_LOG_MAX_BYTES)
+                fs.renameSync(file, `${file}.1`);
+        }
+        catch {
+            // No log yet: nothing to rotate.
+        }
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.appendFileSync(file, `${new Date().toISOString()} ${line}\n`, { mode: 0o600 });
+    }
+    catch (err) {
+        process.stderr.write(`baychat denied-hook: could not write its log (${err instanceof Error ? err.message : String(err)}).\n`);
+    }
+}
+/** stderr and the log file: what every denied-command process logs through. */
+function logBoth(line) {
+    process.stderr.write(`${line}\n`);
+    appendHookLog(line);
+}

package/dist/denied/live-session.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proveLiveSession = proveLiveSession;
+exports.readClaudeSessionFile = readClaudeSessionFile;
+// The second proof a denial is real, for the moment the transcript cannot give the first: the
+// event came from the live Claude Code that runs the session it names.
+//
+// WHY THIS EXISTS. Claude Code 2.1.299 writes the denied `tool_use` to the transcript only after
+// the PermissionDenied hook returns (measured; transcript.ts), so the hook can never find it
+// while it waits. What the hook CAN check while it waits:
+//
+//   (a) the event's `transcript_path` is a file in Claude Code's own `projects/` folder (followed
+//       through symlinks) named `<session_id>.jsonl` — the session's own transcript, not one the
+//       event made up; and
+//   (b) one of the hook's own ancestors (≤ MAX_CLAUDE_HOPS from its parent) is a LIVE Claude Code
+//       whose `~/.claude/sessions/<pid>.json` (Claude Code writes it for every running session)
+//       says `sessionId` = the event's `session_id`, and that file belongs to the process that has
+//       the pid now, not to an earlier one that died and left its pid to be reused.
+//
+// WHAT IT DOES NOT PROVE. The agent's own Bash tool is a child of the same Claude Code, so an
+// `echo '{…}' | baychat denied-hook` it runs passes (b) as well. That is why a call accepted this
+// way is CONFIRMED afterwards against the transcript (confirm.ts) and taken back when it never
+// shows up, and why the boundary remains the owner's tap on the exact command the card shows.
+//
+// PID REUSE. The file carries `startedAt` (ms) and, on Linux, `procStart` = field 22 of
+// `/proc/<pid>/stat` (start time in clock ticks). When both that and the live value exist they
+// must be EQUAL. Otherwise `startedAt` must lie within a few seconds of the start `ps` reports.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("../approve-hook");
+const claude_link_1 = require("../channel/claude-link");
+const transcript_1 = require("./transcript");
+/** `ps -o etime` has whole seconds, and the clock is read twice: this much early is the same start. */
+const STARTED_EARLY_SLACK_MS = 3_000;
+/** Claude Code writes its session file once it has started — 4.4 s after the kernel's start time
+ *  on this VPS (2026-10-14); a busy disk makes it slower. Later than this is not that process's. */
+const STARTED_LATE_SLACK_MS = 30_000;
+/** A session id or agent id is one path segment of safe characters, never a path. */
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+/** Did this event come from the live Claude Code of the session it names? NEVER THROWS. */
+function proveLiveSession(ref, deps = {}) {
+    const claudeDir = (0, transcript_1.claudeConfigDir)(deps.claudeDir);
+    const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
+    const parentOf = deps.parentOf ?? approve_hook_1.psParentOf;
+    const isAlive = deps.isAlive ?? claude_link_1.pidAlive;
+    const readSessionFile = deps.readSessionFile ?? ((pid) => readClaudeSessionFile(claudeDir, pid));
+    const procStart = deps.procStart ?? approve_hook_1.procStartTicks;
+    const ageMs = deps.ageMs ?? approve_hook_1.psAgeMs;
+    const now = deps.now ?? Date.now;
+    try {
+        // (a) The session's own transcript, in Claude Code's own folder.
+        if (!SAFE_ID.test(ref.sessionId))
+            return { ok: false, why: "the event's session id is not one Claude Code writes" };
+        if (ref.agentId !== undefined && !SAFE_ID.test(ref.agentId))
+            return { ok: false, why: "the event's agent id is not one Claude Code writes" };
+        const expected = `${ref.sessionId}.jsonl`;
+        if (!path.isAbsolute(ref.transcriptPath) || path.basename(ref.transcriptPath) !== expected) {
+            return { ok: false, why: `the event's transcript is not named ${expected}` };
+        }
+        const projects = realpath(path.join(claudeDir, "projects"));
+        let real;
+        try {
+            real = realpath(ref.transcriptPath);
+        }
+        catch {
+            // Not written yet (a session's very first turn): its folder must still be Claude Code's.
+            real = path.join(realpath(path.dirname(ref.transcriptPath)), expected);
+        }
+        if (!real.startsWith(projects + path.sep) || path.basename(real) !== expected) {
+            return { ok: false, why: "the event's transcript is not in Claude Code's own folder" };
+        }
+        // (b) The nearest Claude Code above this process runs that session.
+        let pid = deps.ppid ?? process.ppid;
+        for (let hop = 0; hop < approve_hook_1.MAX_CLAUDE_HOPS && pid !== undefined && pid > 1; hop++) {
+            const file = readSessionFile(pid);
+            if (file && isAlive(pid)) {
+                // The nearest one decides: a hook runs under exactly one Claude Code.
+                if (file.sessionId !== ref.sessionId) {
+                    return { ok: false, why: `the Claude Code this hook runs under (pid ${pid}) is another session` };
+                }
+                if (file.pid !== undefined && file.pid !== pid) {
+                    return { ok: false, why: `the session file of pid ${pid} names another pid` };
+                }
+                const started = startMatches(pid, file, procStart, ageMs, now);
+                return started === true ? { ok: true, pid } : { ok: false, why: started };
+            }
+            pid = parentOf(pid);
+        }
+        return { ok: false, why: `no live Claude Code of this session among the hook's ${approve_hook_1.MAX_CLAUDE_HOPS} nearest ancestors` };
+    }
+    catch (err) {
+        return { ok: false, why: `the session could not be checked (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+/** True when `file` was written by the process that has `pid` now; otherwise why not. */
+function startMatches(pid, file, procStart, ageMs, now) {
+    const recorded = typeof file.procStart === "string" || typeof file.procStart === "number" ? String(file.procStart) : undefined;
+    const live = recorded === undefined ? undefined : procStart(pid);
+    if (recorded !== undefined && live !== undefined) {
+        return recorded === live ? true : `pid ${pid} is a newer process than its session file (start ${live}, file ${recorded})`;
+    }
+    const startedAt = typeof file.startedAt === "number" ? file.startedAt : Number.NaN;
+    const age = ageMs(pid);
+    if (!Number.isFinite(startedAt) || age === undefined)
+        return `when pid ${pid} started cannot be told`;
+    const processStart = now() - age;
+    if (startedAt < processStart - STARTED_EARLY_SLACK_MS || startedAt > processStart + STARTED_LATE_SLACK_MS) {
+        return `pid ${pid}'s session file was written by another process (started ${new Date(startedAt).toISOString()}, the process ${new Date(processStart).toISOString()})`;
+    }
+    return true;
+}
+/** `<claudeDir>/sessions/<pid>.json`, or undefined when absent or not a JSON object. */
+function readClaudeSessionFile(claudeDir, pid) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(claudeDir, "sessions", `${pid}.json`), "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/denied/notice.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NOTICE_OPTIONS = void 0;
+exports.postNotice = postNotice;
+exports.unconfirmedNotice = unconfirmedNotice;
+// A card that only informs: posted to the owner's private chat with the session, never waited on.
+// Shared by the hook and by the processes that take a grant back after it (confirm.ts).
+const approval_wait_1 = require("../approval-wait");
+/** The single button of a card that only informs: nothing can be allowed from it. */
+exports.NOTICE_OPTIONS = ["OK"];
+/** Post `question` as an info card. NEVER THROWS (askOwnerAndWait does not); its deadline is now. */
+async function postNotice(device, session, question, deps, label) {
+    const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: exports.NOTICE_OPTIONS }, deps.now(), deps, label);
+    if (outcome.kind === "failed")
+        deps.log(`${label}: the notice could not be posted (${outcome.reason}).`);
+}
+/**
+ * The owner's notice when BayChat took back a grant it could not confirm. `used`: a once-grant
+ * whose rule the retried call had already used (and the after-hook removed) by then.
+ */
+function unconfirmedNotice(grant, host, why, used) {
+    const who = grant.session ? `session "${grant.session}"` : "a Claude Code session";
+    return (`BayChat removed the rule you allowed for ${who} on ${host}:\n\n${grant.shown}\n\n` +
+        `It could not confirm that the block came from that session — Claude Code's auto mode never recorded ` +
+        `this call in the session's transcript (${why}).` +
+        (used ? " The rule had already been used once." : "") +
+        "\n\nIf you did not expect this card, check what is running on that computer. If you still want the call " +
+        "allowed, approve it at the computer (/permissions → Recently denied).");
+}

package/dist/denied/opt-in.js

@@ -0,0 +1,68 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedCardEnabled = deniedCardEnabled;
+exports.enableDeniedCard = enableDeniedCard;
+exports.disableDeniedCard = disableDeniedCard;
+// Whether this computer's owner turned the denied-command card on (`baychat permissions on`).
+//
+// OFF UNTIL SOMEBODY ASKS FOR IT, like approve-hook was: the card lets a phone add a permission
+// rule on this computer, so it exists only after a deliberate act. The switch is a file in
+// `~/.baychat`, read when BayChat's launcher writes a session's `--settings` file
+// (relay/launcher/approval-settings.ts), so it takes effect for sessions started after it changes.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const optInFile = () => path.join((0, config_1.configDir)(), "denied-card.json");
+/** True only when the switch file says so. Any doubt — missing, unreadable, malformed — is off. */
+function deniedCardEnabled() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(optInFile(), "utf8"));
+        return parsed?.enabled === true;
+    }
+    catch (err) {
+        if (err.code !== "ENOENT") {
+            process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
+        }
+        return false;
+    }
+}
+function enableDeniedCard(now = new Date()) {
+    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled: true, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
+}
+function disableDeniedCard() {
+    fs.rmSync(optInFile(), { force: true });
+}