baychat 0.29.9 → 0.31.0

package/dist/denied/permission-rule.js

@@ -0,0 +1,186 @@
+"use strict";
+// What BayChat may write into Claude Code's settings for ONE call that auto mode denied — and,
+// just as important, what it refuses to write. Pure: no files, no network.
+//
+// THE RULE WE WRITE IS THE CALL, AND NOTHING WIDER. Claude Code resolves a matching
+// `permissions.allow` rule before its auto-mode classifier (permission-modes docs, "How the
+// classifier evaluates actions", step 1), so a rule is a real grant: whatever it matches runs
+// without review. Its syntax is a pattern language — `Bash(<text>)` matches the whole command
+// text with `*` as a wildcard, and a rule must match each subcommand of a chain on its own
+// (permissions docs, "Compound commands"). So:
+//
+//   • a command containing `*` is never turned into a rule: the star would be read as a wildcard
+//     and the rule would allow more than the person saw;
+//   • a command that runs another command inside it (backticks, `$( )`, brackets, a newline) has
+//     no exact rule at all — nothing is offered;
+//   • a chain (`a && b`, `a | b`, `a; b`) can only be allowed ONCE, as one rule per subcommand,
+//     and only when it holds no quotes, because splitting quoted shell text by hand is how a
+//     parser and a person end up disagreeing about what runs;
+//   • "Always" is offered only for ONE plain command with no variable expansion, no redirection
+//     and nothing that looks like a secret (a saved rule would keep that secret in a file).
+//
+// The card text is built from `shown`, which masks obvious secrets; the rule is built from the
+// real text, because a rule that differs from the call matches nothing.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RULE_COMMAND_LENGTH = void 0;
+exports.planDeniedCall = planDeniedCall;
+exports.callKeyOf = callKeyOf;
+exports.sameCall = sameCall;
+exports.redactSecrets = redactSecrets;
+/** Longer than this is not a command a person can check on a phone, nor one a rule should hold. */
+exports.MAX_RULE_COMMAND_LENGTH = 1000;
+/** Claude Code itself saves at most five rules for one approved chain (permissions docs). */
+const MAX_CHAIN_PARTS = 5;
+/** `&&`, `||`, `|&`, `;`, `|`, and a lone `&` that is not part of a redirection (`2>&1`, `&>`). */
+const CHAIN_OPERATOR = /&&|\|\||\|&|;|\||(?<![>&])&(?![>&])/;
+const CHAIN_SPLIT = /\s*(?:&&|\|\||\|&|;|\||(?<![>&])&(?![>&]))\s*/;
+const NESTED_COMMAND = /`|\$\(|[()]/;
+const MCP_TOOL = /^mcp__[A-Za-z0-9_-]+__[A-Za-z0-9_.-]+$/;
+const str = (v) => (typeof v === "string" ? v : "");
+/** Plan the rules for one denied call. Never throws. */
+function planDeniedCall(toolName, toolInput) {
+    const input = (toolInput && typeof toolInput === "object" ? toolInput : {});
+    if (toolName === "Bash")
+        return planBash(str(input.command).trim());
+    if (toolName === "WebFetch")
+        return planWebFetch(str(input.url).trim());
+    if (MCP_TOOL.test(toolName)) {
+        return {
+            shown: `${toolName} ${clipJson(input)}`,
+            onceRules: [toolName],
+            alwaysAllowed: false,
+            limitation: "\"Always\" isn't offered: a rule for an MCP tool would allow every use of it, so BayChat only allows it once.",
+            call: { tool: toolName, subject: toolName },
+        };
+    }
+    return nothing(`${toolName} ${clipJson(input)}`, "BayChat can only allow shell commands, web fetches and MCP tools from your phone; " +
+        "approve this one at the computer (/permissions → Recently denied).");
+}
+function planBash(command) {
+    const { text: shown, redacted } = redactSecrets(command);
+    if (!command)
+        return nothing("(no command)", "The blocked call carried no command.");
+    if (command.length > exports.MAX_RULE_COMMAND_LENGTH) {
+        return nothing(clip(shown), "It is too long to allow as one exact command; approve it at the computer.");
+    }
+    if (/[\r\n]/.test(command)) {
+        return nothing(shown, "It spans several lines, which no exact rule can describe; approve it at the computer.");
+    }
+    if (NESTED_COMMAND.test(command)) {
+        return nothing(shown, "It runs a command inside another (backticks, $( ) or brackets), which no exact rule can describe; " +
+            "approve it at the computer.");
+    }
+    if (command.includes("*")) {
+        return nothing(shown, "It contains *, which Claude Code reads as a wildcard, so a rule would allow more than this command; " +
+            "approve it at the computer.");
+    }
+    const call = { tool: "Bash", subject: command };
+    if (CHAIN_OPERATOR.test(command)) {
+        if (/["'\\]/.test(command)) {
+            return nothing(shown, "It chains several commands and quotes text, so BayChat cannot split it safely; ask the session to " +
+                "run them one at a time.");
+        }
+        const parts = command.split(CHAIN_SPLIT);
+        if (parts.some((p) => p === "") || parts.length > MAX_CHAIN_PARTS) {
+            return nothing(shown, "BayChat cannot split this chain into exact commands; approve it at the computer.");
+        }
+        return {
+            shown,
+            onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
+            alwaysAllowed: false,
+            // One plain line on WHY, because the usual cause is the agent's own habit (`cd … && x | tail`)
+            // and the fix is for the session to run the command by itself.
+            limitation: `"Always" isn't offered: this chains ${parts.length} commands, and a saved rule only ever covers one plain ` +
+                `command. Run it on its own (no cd … &&, no | tail) to be offered "Always".`,
+            call,
+        };
+    }
+    const refusal = redacted
+        ? "\"Always\" isn't offered: it carries what looks like a secret, and a saved rule would keep it in a settings file."
+        : command.includes("$")
+            ? "\"Always\" isn't offered: it expands a variable, so the same text could run something different later."
+            : /[<>]/.test(command)
+                ? "\"Always\" isn't offered: it redirects to or from a file."
+                : "";
+    return { shown, onceRules: [`Bash(${command})`], alwaysAllowed: refusal === "", limitation: refusal, call };
+}
+function planWebFetch(url) {
+    let host = "";
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        /* not a URL: nothing to allow */
+    }
+    const shown = redactSecrets(url).text;
+    if (!host || !/^[A-Za-z0-9.-]+$/.test(host))
+        return nothing(shown || "(no URL)", "The blocked fetch has no usable address.");
+    return {
+        shown,
+        onceRules: [`WebFetch(domain:${host})`],
+        alwaysAllowed: false,
+        limitation: `"Always" isn't offered: a WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
+        call: { tool: "WebFetch", subject: host },
+    };
+}
+/** The key a call is matched by — the same for the denied call and the retried one. */
+function callKeyOf(toolName, toolInput) {
+    const input = (toolInput && typeof toolInput === "object" ? toolInput : {});
+    if (toolName === "Bash") {
+        const command = str(input.command).trim();
+        return command ? { tool: "Bash", subject: command } : undefined;
+    }
+    if (toolName === "WebFetch") {
+        try {
+            return { tool: "WebFetch", subject: new URL(str(input.url).trim()).hostname };
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return MCP_TOOL.test(toolName) ? { tool: toolName, subject: toolName } : undefined;
+}
+function sameCall(a, b) {
+    return a.tool === b.tool && a.subject === b.subject;
+}
+function nothing(shown, limitation) {
+    return { shown, onceRules: [], alwaysAllowed: false, limitation };
+}
+// ─── Redaction ───────────────────────────────────────────────────────────────
+const MASK = "[redacted]";
+/** `scheme://user:password@host` → `scheme://[redacted]@host`. */
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi;
+/** Shapes that are a credential wherever they appear. */
+const KNOWN_TOKENS = /\b(?:bay_[A-Za-z0-9_]{8,}|sk-[A-Za-z0-9_-]{16,}|ghp_[A-Za-z0-9]{20,}|gho_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|npm_[A-Za-z0-9]{20,}|eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,})/g;
+/** `Bearer <x>`, `Basic <x>`, `token <x>` (an Authorization header's value). */
+const AUTH_SCHEME = /\b(Bearer|Basic|token)\s+[A-Za-z0-9._~+/=-]{8,}/gi;
+/** `--token x`, `--api-key=x`, `-password x`, `--client-secret "x"`, … */
+const SECRET_FLAG = /(--?[A-Za-z0-9_-]*(?:token|secret|passw(?:or)?d|pass|api[-_]?key|apikey|auth|credential|private[-_]?key)[A-Za-z0-9_-]*)(=|\s+)("[^"]*"|'[^']*'|[^\s;&|]+)/gi;
+/** `FOO=…` at the start of a word: an environment assignment, whatever its name. */
+const ENV_ASSIGNMENT = /(^|[\s;&|])([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|[^\s;&|]+)/g;
+/**
+ * The text with obvious secrets masked, and whether anything was. Errs towards masking: a card is
+ * read on a lock screen and stored in a chat, and a masked word costs nothing but a glance.
+ * It is not a guarantee — an unusual secret in a positional argument passes — which is one more
+ * reason "Always" is never offered for a command this changes.
+ */
+function redactSecrets(text) {
+    const out = text
+        .replace(URL_CREDENTIALS, `$1${MASK}@`)
+        .replace(KNOWN_TOKENS, MASK)
+        .replace(AUTH_SCHEME, `$1 ${MASK}`)
+        .replace(SECRET_FLAG, (_m, flag, sep) => `${flag}${sep}${MASK}`)
+        .replace(ENV_ASSIGNMENT, (_m, lead, name) => `${lead}${name}=${MASK}`);
+    return { text: out, redacted: out !== text };
+}
+function clip(text, max = 600) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}
+function clipJson(value) {
+    try {
+        return clip(redactSecrets(JSON.stringify(value)).text, 400);
+    }
+    catch {
+        return "(its parameters could not be displayed)";
+    }
+}

package/dist/denied/settings-rules.js

@@ -0,0 +1,221 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.addAllowRules = addAllowRules;
+exports.removeAllowRules = removeAllowRules;
+exports.chooseSettingsFile = chooseSettingsFile;
+exports.settingsFileWritable = settingsFileWritable;
+exports.localSettingsFile = localSettingsFile;
+// Adding and removing exact `permissions.allow` entries in ONE Claude Code settings file — and
+// touching nothing else in it.
+//
+// THE ONLY EDIT THIS MODULE MAKES is to append a string to `permissions.allow`, or to take a
+// string BayChat put there back out. `deny`, `ask`, `defaultMode`, `hooks` and every other key are
+// carried through untouched, in the file's own indentation. A file that does not parse, is not a
+// JSON object, or has a `permissions`/`allow` of the wrong shape is REFUSED and left exactly as it
+// was: a permission file we half-understood is not one we get to rewrite.
+//
+// Writes are atomic (a temp file beside the target, then a rename — `nodeSettingsIo`, shared with
+// claude-settings.ts) and keep the file's mode. A symlinked settings file is followed, as Claude
+// Code follows it, and a dangling link is refused.
+//
+// WHICH FILE. The project's `.claude/settings.local.json`: the file Claude Code itself saves "Yes,
+// and don't ask again" into, which it watches and reloads during a session, which applies to this
+// project only, and which Claude Code keeps out of git. See `localSettingsFile` for where exactly.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const claude_settings_1 = require("../claude-settings");
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+/** Add each rule that is not already allowed. Returns the ones this call added (none: unchanged).
+ *  @throws with the file untouched when it cannot be read as a settings object. */
+function addAllowRules(file, rules, io = claude_settings_1.nodeSettingsIo) {
+    const edit = readSettings(file, io);
+    const allow = allowListOf(edit.settings, edit.target);
+    const added = rules.filter((rule, i) => !allow.includes(rule) && rules.indexOf(rule) === i);
+    if (added.length === 0)
+        return [];
+    writeAllow(edit, [...allow, ...added], io);
+    return added;
+}
+/** Take each rule out of `permissions.allow`. Idempotent: an absent file or rule is already gone.
+ *  @throws with the file untouched when it cannot be read as a settings object. */
+function removeAllowRules(file, rules, io = claude_settings_1.nodeSettingsIo) {
+    const edit = readSettings(file, io);
+    if (edit.text === null)
+        return;
+    const allow = allowListOf(edit.settings, edit.target);
+    const kept = allow.filter((rule) => !rules.includes(rule));
+    if (kept.length === allow.length)
+        return;
+    writeAllow(edit, kept, io);
+}
+function readSettings(file, io) {
+    const target = io.realpath(file);
+    const text = io.read(target);
+    if (text === null || text.trim() === "")
+        return { target, text, settings: {} };
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`${target} is not valid JSON, so BayChat left it untouched.`);
+    }
+    if (!isRecord(parsed))
+        throw new Error(`${target} is not a JSON object, so BayChat left it untouched.`);
+    return { target, text, settings: parsed };
+}
+function allowListOf(settings, target) {
+    const permissions = settings.permissions;
+    if (permissions === undefined)
+        return [];
+    if (!isRecord(permissions))
+        throw new Error(`${target}: "permissions" is not an object, so BayChat left it untouched.`);
+    const allow = permissions.allow;
+    if (allow === undefined)
+        return [];
+    if (!Array.isArray(allow) || !allow.every((r) => typeof r === "string")) {
+        throw new Error(`${target}: "permissions.allow" is not a list of rules, so BayChat left it untouched.`);
+    }
+    return allow;
+}
+function writeAllow(edit, allow, io) {
+    const permissions = isRecord(edit.settings.permissions) ? edit.settings.permissions : {};
+    const next = { ...edit.settings, permissions: { ...permissions, allow } };
+    const indent = edit.text ? (0, claude_settings_1.detectIndent)(edit.text) : 2;
+    // A new file is private: a once-rule can carry a command's own arguments.
+    io.write(edit.target, `${JSON.stringify(next, null, indent)}\n`, io.mode(edit.target) ?? 0o600);
+}
+/**
+ * The settings file a rule for a session started in `projectDir` goes into.
+ *
+ * The project's local file when this user can write it. Otherwise — a repository owned by another
+ * user, the first real run's case (a session as `karmen` in `/var/www/baychat`, owned by `manuel`) —
+ * the user's own `~/.claude/settings.json`, which Claude Code also reloads live, and the card says
+ * so (it then applies to every project). When neither can be written there is nothing to offer, and
+ * the card must not draw an Allow button that can only fail.
+ */
+function chooseSettingsFile(projectDir, deps = {}) {
+    const writable = deps.writable ?? settingsFileWritable;
+    const project = (deps.localFile ?? localSettingsFile)(projectDir);
+    if (writable(project))
+        return { scope: "project", file: project };
+    const user = (deps.userFile ?? claude_settings_1.claudeSettingsPath)();
+    if (writable(user))
+        return { scope: "user", file: user, why: `${project} isn't writable for you` };
+    return { scope: "none", why: `neither ${project} nor ${user} is writable for you` };
+}
+/**
+ * Could `addAllowRules` write `file` as this user? The write is a temp file beside the real file
+ * and a rename, so what has to be writable is its FOLDER (or the nearest folder that exists, which
+ * `mkdir` would create it in); an existing file must also be readable. A folder that cannot be
+ * looked into is not writable — stat's error, not a missing folder (RECURRING_MISTAKES §26).
+ * NEVER THROWS: any doubt is "no".
+ */
+function settingsFileWritable(file, io = claude_settings_1.nodeSettingsIo) {
+    try {
+        const target = io.realpath(file);
+        try {
+            fs.accessSync(target, fs.constants.R_OK);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                return false;
+        }
+        let dir = path.dirname(target);
+        for (;;) {
+            try {
+                if (!fs.statSync(dir).isDirectory())
+                    return false;
+                break;
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    return false;
+                const up = path.dirname(dir);
+                if (up === dir)
+                    return false;
+                dir = up;
+            }
+        }
+        fs.accessSync(dir, fs.constants.W_OK | fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The `.claude/settings.local.json` Claude Code reads for a session started in `projectDir`.
+ *
+ * Mirrors the settings docs ("Yes, and don't ask again" → `.claude/settings.local.json`): Claude
+ * Code keeps that file at the GIT REPOSITORY ROOT (in a worktree, the main checkout's root), and
+ * beside `.claude/settings.json` in the starting directory instead when there is no repository,
+ * when the root is the home directory, on Windows, or when the root, its `.git` or its `.claude`
+ * is not owned by this user.
+ */
+function localSettingsFile(projectDir, deps = {}) {
+    const home = deps.home ?? os.homedir();
+    const platform = deps.platform ?? process.platform;
+    const ownedByMe = deps.ownedByMe ?? isOwnedByMe;
+    const exists = deps.exists ?? fs.existsSync;
+    const commonDir = (deps.gitCommonDir ?? gitCommonDir)(projectDir);
+    const gitDir = commonDir ? path.resolve(projectDir, commonDir) : undefined;
+    const root = gitDir && path.basename(gitDir) === ".git" ? path.dirname(gitDir) : undefined;
+    const usable = root !== undefined &&
+        platform !== "win32" &&
+        path.resolve(root) !== path.resolve(home) &&
+        ownedByMe(root) &&
+        ownedByMe(path.join(root, ".git")) &&
+        (!exists(path.join(root, ".claude")) || ownedByMe(path.join(root, ".claude")));
+    return path.join(usable ? root : projectDir, ".claude", "settings.local.json");
+}
+function gitCommonDir(dir) {
+    const r = (0, child_process_1.spawnSync)("git", ["rev-parse", "--git-common-dir"], { cwd: dir, encoding: "utf8", timeout: 5_000 });
+    if (r.error || r.status !== 0)
+        return undefined;
+    return String(r.stdout ?? "").trim() || undefined;
+}
+function isOwnedByMe(p) {
+    try {
+        const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+        return uid === undefined || fs.statSync(p).uid === uid;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/denied/transcript.js

@@ -0,0 +1,173 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONFIRM_WAIT_MS = exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.claudeConfigDir = claudeConfigDir;
+exports.transcriptFileOf = transcriptFileOf;
+exports.verifyDeniedCall = verifyDeniedCall;
+exports.findToolUse = findToolUse;
+// Proof that a denial really happened: the denied call must be in the session's own transcript.
+//
+// WHY. `baychat denied-hook` reads its event from stdin, and stdin is something anybody can
+// write — including the agent, by running `echo '{…}' | baychat denied-hook` itself. A forged
+// event would put a card on the owner's phone claiming a block that never occurred. So the call
+// the event names (`tool_use_id`, `tool_name`, and the command or target) must appear as a tool
+// call the MODEL made, in the transcript Claude Code keeps under `~/.claude/projects/` — a
+// protected path the agent cannot write without a prompt. Before the card when it is already
+// there; otherwise after the owner's yes, which is then taken back when it never appears.
+//
+// It is defence in depth, not the boundary: the owner's answer is. A card the agent somehow did
+// cause still writes nothing unless the owner taps a yes.
+//
+// THE CALL IS NOT THERE YET WHILE THE HOOK RUNS. Measured on Claude Code 2.1.299 (2026-10-14, a
+// file watcher on the transcript): the assistant line holding the denied `tool_use` — and the
+// denial's result — reach the file only AFTER the PermissionDenied hook returns. The hook gave up
+// at 15:32:46.742Z after waiting 45 s; the line landed at 15:32:47.029Z. Same for an MCP call. So
+// waiting longer can never prove a denial up front. The hook now looks only briefly
+// (TRANSCRIPT_WAIT_MS, for a Claude Code that does write first), and an absent call is proven the
+// other way — the event came from the live Claude Code of that very session (live-session.ts) —
+// and checked here AFTERWARDS, by `baychat permissions confirm` (confirm.ts, CONFIRM_WAIT_MS),
+// which takes the rule back out when the call never shows up.
+//
+// For a subagent's call the hook still gets the MAIN transcript (with `agent_id`); its calls are
+// in `<session>/subagents/agent-<id>.jsonl` beside it.
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const permission_rule_1 = require("./permission-rule");
+/** The hook's own look at the transcript: brief, because Claude Code 2.1.299 writes the denied call
+ *  only after the hook returns (above), so this succeeds only on a Claude Code that writes first. */
+exports.TRANSCRIPT_WAIT_MS = 2_000;
+/** How long the deferred confirmation (`baychat permissions confirm`) waits for the call to reach
+ *  the transcript after the owner's yes. Measured: well under a second after the hook returns. */
+exports.CONFIRM_WAIT_MS = 90_000;
+const TRANSCRIPT_POLL_MS = 250;
+/** Only the end of the file is read: the denied call is the newest thing in it. */
+const TAIL_BYTES = 4 * 1024 * 1024;
+/** Claude Code's config directory: `$CLAUDE_CONFIG_DIR`, else `~/.claude`. */
+function claudeConfigDir(claudeDir) {
+    return claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
+}
+/** The file a call is written to: the main transcript, or a subagent's own beside it. */
+function transcriptFileOf(transcriptPath, agentId) {
+    return agentId
+        ? path.join(transcriptPath.slice(0, -".jsonl".length), "subagents", `${agentId.startsWith("agent-") ? agentId : `agent-${agentId}`}.jsonl`)
+        : transcriptPath;
+}
+/** Did the model really make this call in this session? NEVER THROWS. */
+async function verifyDeniedCall(ref, deps = {}) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
+    const readTail = deps.readTail ?? readFileTail;
+    try {
+        const projects = realpath(path.join(claudeConfigDir(deps.claudeDir), "projects"));
+        const wanted = ref.call ?? (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
+        if (!ref.toolUseId || !wanted)
+            return { ok: false, why: "the event names no call that can be checked" };
+        if (!path.isAbsolute(ref.transcriptPath) || !ref.transcriptPath.endsWith(".jsonl")) {
+            return { ok: false, why: "the event carries no transcript" };
+        }
+        const file = transcriptFileOf(ref.transcriptPath, ref.agentId);
+        const giveUpAt = now() + (deps.waitMs ?? exports.TRANSCRIPT_WAIT_MS);
+        for (;;) {
+            let real;
+            try {
+                real = realpath(file);
+            }
+            catch {
+                real = undefined; // not written yet
+            }
+            if (real !== undefined && !real.startsWith(projects + path.sep)) {
+                return { ok: false, why: "the transcript is not in Claude Code's own folder" };
+            }
+            const tail = real === undefined ? undefined : readTail(real);
+            const found = tail === undefined ? undefined : findToolUse(tail, ref.toolUseId);
+            if (found) {
+                const key = (0, permission_rule_1.callKeyOf)(found.name, found.input);
+                return found.name === ref.toolName && key !== undefined && (0, permission_rule_1.sameCall)(key, wanted)
+                    ? { ok: true }
+                    : { ok: false, why: "the transcript's call is not the one the event names" };
+            }
+            if (now() >= giveUpAt)
+                return { ok: false, why: "the call is not in the session's transcript", absent: true };
+            await sleep(TRANSCRIPT_POLL_MS);
+        }
+    }
+    catch (err) {
+        return { ok: false, why: `the transcript could not be read (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+/** The model's tool call with this id, from transcript JSONL text. */
+function findToolUse(text, toolUseId) {
+    for (const line of text.split("\n")) {
+        if (!line.includes(toolUseId))
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue; // the cut-off first line of a tail, or a line being written
+        }
+        const e = entry;
+        if (e.type !== "assistant" || !Array.isArray(e.message?.content))
+            continue;
+        for (const block of e.message.content) {
+            if (block?.type === "tool_use" && block.id === toolUseId && typeof block.name === "string") {
+                return { name: block.name, input: block.input };
+            }
+        }
+    }
+    return undefined;
+}
+function readFileTail(file) {
+    let fd;
+    try {
+        fd = fs.openSync(file, "r");
+        const size = fs.fstatSync(fd).size;
+        const length = Math.min(size, TAIL_BYTES);
+        const buf = Buffer.alloc(length);
+        fs.readSync(fd, buf, 0, length, size - length);
+        return buf.toString("utf8");
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}