baychat 0.30.0 → 0.31.0

package/dist/denied/grants.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ONCE_TTL_MS = void 0;
+exports.UNCONFIRMED_STALE_MS = exports.ONCE_TTL_MS = void 0;
 exports.grantRules = grantRules;
 exports.listGrants = listGrants;
 exports.coveringGrant = coveringGrant;
@@ -42,6 +42,12 @@ exports.revokeGrant = revokeGrant;
 exports.consumeOnceGrants = consumeOnceGrants;
 exports.sweepExpiredGrants = sweepExpiredGrants;
 exports.hasOnceGrants = hasOnceGrants;
+exports.hasGrantsToSweep = hasGrantsToSweep;
+exports.findGrant = findGrant;
+exports.markConfirmed = markConfirmed;
+exports.isStaleUnconfirmed = isStaleUnconfirmed;
+exports.hasStaleUnconfirmed = hasStaleUnconfirmed;
+exports.sweepStaleUnconfirmed = sweepStaleUnconfirmed;
 // The permission rules BayChat itself wrote on this computer, and the one owner of every change to
 // them (`~/.baychat/permission-grants.json`, 0600).
 //
@@ -61,10 +67,15 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const permission_rule_1 = require("./permission-rule");
+const transcript_1 = require("./transcript");
 const settings_rules_1 = require("./settings-rules");
 /** How long a once-rule may outlive its card when the retried call never reports back. The retry
  *  starts within seconds; this only bounds a rule left behind by a session that went away. */
 exports.ONCE_TTL_MS = 5 * 60_000;
+/** An unconfirmed grant older than this lost its confirmation (the child was killed, or never
+ *  started) and is taken back by the next hook run or sweep. The confirmation's own wait
+ *  (CONFIRM_WAIT_MS) plus room for its start-up. */
+exports.UNCONFIRMED_STALE_MS = transcript_1.CONFIRM_WAIT_MS + 30_000;
 const LOCK_WAIT_MS = 5_000;
 const LOCK_POLL_MS = 50;
 const STALE_LOCK_MS = 30_000;
@@ -85,6 +96,7 @@ async function grantRules(request, now = Date.now()) {
             kind: request.kind,
             rules: added,
             settingsFile: request.settingsFile,
+            scope: request.scope,
             call: request.call,
             shown: request.shown,
             claudeSessionId: request.claudeSessionId,
@@ -92,6 +104,7 @@ async function grantRules(request, now = Date.now()) {
             addedAt: new Date(now).toISOString(),
             ...(request.kind === "once" ? { expiresAt: new Date(now + exports.ONCE_TTL_MS).toISOString() } : {}),
             retries: 0,
+            ...(request.unconfirmed ? { unconfirmed: { ...request.unconfirmed, since: new Date(now).toISOString() } } : {}),
         };
         try {
             writeGrants([...readGrants(), grant]);
@@ -140,10 +153,55 @@ async function consumeOnceGrants(claudeSessionId, call) {
 async function sweepExpiredGrants(now = Date.now()) {
     return revokeWhere((g) => g.kind === "once" && isExpired(g, now));
 }
-/** Is there any once-grant at all? The after-hook's fast exit, read without the lock. */
+/** Is there any once-grant at all? Read without the lock. */
 function hasOnceGrants() {
     return readGrants().some((g) => g.kind === "once");
 }
+/** Anything a sweep could act on — a once-grant, or one still unconfirmed? The after-hook's fast
+ *  exit, read without the lock. */
+function hasGrantsToSweep() {
+    return readGrants().some((g) => g.kind === "once" || g.unconfirmed !== undefined);
+}
+/** One grant by id, read without the lock. */
+function findGrant(id) {
+    return readGrants().find((g) => g.id === id);
+}
+/** The call was found in the transcript: the grant stands. False: no such grant (any more). */
+async function markConfirmed(id) {
+    return withGrantsLock(() => {
+        const grants = readGrants();
+        if (!grants.some((g) => g.id === id))
+            return false;
+        writeGrants(grants.map((g) => (g.id === id ? withoutUnconfirmed(g) : g)));
+        return true;
+    });
+}
+/** Is this grant still waiting for a confirmation that should have finished by `now`? */
+function isStaleUnconfirmed(grant, now = Date.now()) {
+    if (!grant.unconfirmed)
+        return false;
+    const since = Date.parse(grant.unconfirmed.since);
+    // Unreadable: it can only be taken back early.
+    return !Number.isFinite(since) || since + exports.UNCONFIRMED_STALE_MS <= now;
+}
+/** Is any grant's confirmation overdue? Read without the lock (the after-hook's cheap check). */
+function hasStaleUnconfirmed(now = Date.now()) {
+    return readGrants().some((g) => isStaleUnconfirmed(g, now));
+}
+/** Take back every grant whose confirmation never finished. Returns them, for the owner's notice. */
+async function sweepStaleUnconfirmed(now = Date.now()) {
+    return withGrantsLock(() => {
+        let grants = readGrants();
+        const doomed = grants.filter((g) => isStaleUnconfirmed(g, now));
+        for (const grant of doomed)
+            grants = revokeLocked(grant, grants);
+        return doomed;
+    });
+}
+function withoutUnconfirmed(grant) {
+    const { unconfirmed: _done, ...rest } = grant;
+    return rest;
+}
 async function revokeWhere(match) {
     return withGrantsLock(() => {
         let grants = readGrants();

package/dist/denied/hook-log.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedHookLogPath = deniedHookLogPath;
+exports.appendHookLog = appendHookLog;
+exports.logBoth = logBoth;
+// `~/.baychat/denied-hook.log` — the denied-command card's own log.
+//
+// Claude Code ignores a PermissionDenied hook's stderr, so without a file a silent hook is
+// undiagnosable: "no card came" could mean never called, not joined, unproven call, or a failed
+// post. Shared by the hook and by the detached `baychat permissions confirm` it starts, so one
+// file tells the whole story of a denial. One line per step, NEVER the tool input (it can hold
+// secrets), kept small.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const HOOK_LOG_MAX_BYTES = 256 * 1024;
+function deniedHookLogPath() {
+    return path.join((0, config_1.configDir)(), "denied-hook.log");
+}
+/** Append one line, rotating at HOOK_LOG_MAX_BYTES. NEVER THROWS. */
+function appendHookLog(line) {
+    try {
+        const file = deniedHookLogPath();
+        try {
+            if (fs.statSync(file).size > HOOK_LOG_MAX_BYTES)
+                fs.renameSync(file, `${file}.1`);
+        }
+        catch {
+            // No log yet: nothing to rotate.
+        }
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.appendFileSync(file, `${new Date().toISOString()} ${line}\n`, { mode: 0o600 });
+    }
+    catch (err) {
+        process.stderr.write(`baychat denied-hook: could not write its log (${err instanceof Error ? err.message : String(err)}).\n`);
+    }
+}
+/** stderr and the log file: what every denied-command process logs through. */
+function logBoth(line) {
+    process.stderr.write(`${line}\n`);
+    appendHookLog(line);
+}

package/dist/denied/live-session.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proveLiveSession = proveLiveSession;
+exports.readClaudeSessionFile = readClaudeSessionFile;
+// The second proof a denial is real, for the moment the transcript cannot give the first: the
+// event came from the live Claude Code that runs the session it names.
+//
+// WHY THIS EXISTS. Claude Code 2.1.299 writes the denied `tool_use` to the transcript only after
+// the PermissionDenied hook returns (measured; transcript.ts), so the hook can never find it
+// while it waits. What the hook CAN check while it waits:
+//
+//   (a) the event's `transcript_path` is a file in Claude Code's own `projects/` folder (followed
+//       through symlinks) named `<session_id>.jsonl` — the session's own transcript, not one the
+//       event made up; and
+//   (b) one of the hook's own ancestors (≤ MAX_CLAUDE_HOPS from its parent) is a LIVE Claude Code
+//       whose `~/.claude/sessions/<pid>.json` (Claude Code writes it for every running session)
+//       says `sessionId` = the event's `session_id`, and that file belongs to the process that has
+//       the pid now, not to an earlier one that died and left its pid to be reused.
+//
+// WHAT IT DOES NOT PROVE. The agent's own Bash tool is a child of the same Claude Code, so an
+// `echo '{…}' | baychat denied-hook` it runs passes (b) as well. That is why a call accepted this
+// way is CONFIRMED afterwards against the transcript (confirm.ts) and taken back when it never
+// shows up, and why the boundary remains the owner's tap on the exact command the card shows.
+//
+// PID REUSE. The file carries `startedAt` (ms) and, on Linux, `procStart` = field 22 of
+// `/proc/<pid>/stat` (start time in clock ticks). When both that and the live value exist they
+// must be EQUAL. Otherwise `startedAt` must lie within a few seconds of the start `ps` reports.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("../approve-hook");
+const claude_link_1 = require("../channel/claude-link");
+const transcript_1 = require("./transcript");
+/** `ps -o etime` has whole seconds, and the clock is read twice: this much early is the same start. */
+const STARTED_EARLY_SLACK_MS = 3_000;
+/** Claude Code writes its session file once it has started — 4.4 s after the kernel's start time
+ *  on this VPS (2026-10-14); a busy disk makes it slower. Later than this is not that process's. */
+const STARTED_LATE_SLACK_MS = 30_000;
+/** A session id or agent id is one path segment of safe characters, never a path. */
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+/** Did this event come from the live Claude Code of the session it names? NEVER THROWS. */
+function proveLiveSession(ref, deps = {}) {
+    const claudeDir = (0, transcript_1.claudeConfigDir)(deps.claudeDir);
+    const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
+    const parentOf = deps.parentOf ?? approve_hook_1.psParentOf;
+    const isAlive = deps.isAlive ?? claude_link_1.pidAlive;
+    const readSessionFile = deps.readSessionFile ?? ((pid) => readClaudeSessionFile(claudeDir, pid));
+    const procStart = deps.procStart ?? approve_hook_1.procStartTicks;
+    const ageMs = deps.ageMs ?? approve_hook_1.psAgeMs;
+    const now = deps.now ?? Date.now;
+    try {
+        // (a) The session's own transcript, in Claude Code's own folder.
+        if (!SAFE_ID.test(ref.sessionId))
+            return { ok: false, why: "the event's session id is not one Claude Code writes" };
+        if (ref.agentId !== undefined && !SAFE_ID.test(ref.agentId))
+            return { ok: false, why: "the event's agent id is not one Claude Code writes" };
+        const expected = `${ref.sessionId}.jsonl`;
+        if (!path.isAbsolute(ref.transcriptPath) || path.basename(ref.transcriptPath) !== expected) {
+            return { ok: false, why: `the event's transcript is not named ${expected}` };
+        }
+        const projects = realpath(path.join(claudeDir, "projects"));
+        let real;
+        try {
+            real = realpath(ref.transcriptPath);
+        }
+        catch {
+            // Not written yet (a session's very first turn): its folder must still be Claude Code's.
+            real = path.join(realpath(path.dirname(ref.transcriptPath)), expected);
+        }
+        if (!real.startsWith(projects + path.sep) || path.basename(real) !== expected) {
+            return { ok: false, why: "the event's transcript is not in Claude Code's own folder" };
+        }
+        // (b) The nearest Claude Code above this process runs that session.
+        let pid = deps.ppid ?? process.ppid;
+        for (let hop = 0; hop < approve_hook_1.MAX_CLAUDE_HOPS && pid !== undefined && pid > 1; hop++) {
+            const file = readSessionFile(pid);
+            if (file && isAlive(pid)) {
+                // The nearest one decides: a hook runs under exactly one Claude Code.
+                if (file.sessionId !== ref.sessionId) {
+                    return { ok: false, why: `the Claude Code this hook runs under (pid ${pid}) is another session` };
+                }
+                if (file.pid !== undefined && file.pid !== pid) {
+                    return { ok: false, why: `the session file of pid ${pid} names another pid` };
+                }
+                const started = startMatches(pid, file, procStart, ageMs, now);
+                return started === true ? { ok: true, pid } : { ok: false, why: started };
+            }
+            pid = parentOf(pid);
+        }
+        return { ok: false, why: `no live Claude Code of this session among the hook's ${approve_hook_1.MAX_CLAUDE_HOPS} nearest ancestors` };
+    }
+    catch (err) {
+        return { ok: false, why: `the session could not be checked (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+/** True when `file` was written by the process that has `pid` now; otherwise why not. */
+function startMatches(pid, file, procStart, ageMs, now) {
+    const recorded = typeof file.procStart === "string" || typeof file.procStart === "number" ? String(file.procStart) : undefined;
+    const live = recorded === undefined ? undefined : procStart(pid);
+    if (recorded !== undefined && live !== undefined) {
+        return recorded === live ? true : `pid ${pid} is a newer process than its session file (start ${live}, file ${recorded})`;
+    }
+    const startedAt = typeof file.startedAt === "number" ? file.startedAt : Number.NaN;
+    const age = ageMs(pid);
+    if (!Number.isFinite(startedAt) || age === undefined)
+        return `when pid ${pid} started cannot be told`;
+    const processStart = now() - age;
+    if (startedAt < processStart - STARTED_EARLY_SLACK_MS || startedAt > processStart + STARTED_LATE_SLACK_MS) {
+        return `pid ${pid}'s session file was written by another process (started ${new Date(startedAt).toISOString()}, the process ${new Date(processStart).toISOString()})`;
+    }
+    return true;
+}
+/** `<claudeDir>/sessions/<pid>.json`, or undefined when absent or not a JSON object. */
+function readClaudeSessionFile(claudeDir, pid) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(claudeDir, "sessions", `${pid}.json`), "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/denied/notice.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NOTICE_OPTIONS = void 0;
+exports.postNotice = postNotice;
+exports.unconfirmedNotice = unconfirmedNotice;
+// A card that only informs: posted to the owner's private chat with the session, never waited on.
+// Shared by the hook and by the processes that take a grant back after it (confirm.ts).
+const approval_wait_1 = require("../approval-wait");
+/** The single button of a card that only informs: nothing can be allowed from it. */
+exports.NOTICE_OPTIONS = ["OK"];
+/** Post `question` as an info card. NEVER THROWS (askOwnerAndWait does not); its deadline is now. */
+async function postNotice(device, session, question, deps, label) {
+    const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: exports.NOTICE_OPTIONS }, deps.now(), deps, label);
+    if (outcome.kind === "failed")
+        deps.log(`${label}: the notice could not be posted (${outcome.reason}).`);
+}
+/**
+ * The owner's notice when BayChat took back a grant it could not confirm. `used`: a once-grant
+ * whose rule the retried call had already used (and the after-hook removed) by then.
+ */
+function unconfirmedNotice(grant, host, why, used) {
+    const who = grant.session ? `session "${grant.session}"` : "a Claude Code session";
+    return (`BayChat removed the rule you allowed for ${who} on ${host}:\n\n${grant.shown}\n\n` +
+        `It could not confirm that the block came from that session — Claude Code's auto mode never recorded ` +
+        `this call in the session's transcript (${why}).` +
+        (used ? " The rule had already been used once." : "") +
+        "\n\nIf you did not expect this card, check what is running on that computer. If you still want the call " +
+        "allowed, approve it at the computer (/permissions → Recently denied).");
+}

package/dist/denied/permission-rule.js

@@ -49,7 +49,7 @@ function planDeniedCall(toolName, toolInput) {
             shown: `${toolName} ${clipJson(input)}`,
             onceRules: [toolName],
             alwaysAllowed: false,
-            limitation: "A rule for an MCP tool allows every use of that tool, so BayChat only allows it once.",
+            limitation: "\"Always\" isn't offered: a rule for an MCP tool would allow every use of it, so BayChat only allows it once.",
             call: { tool: toolName, subject: toolName },
         };
     }
@@ -88,16 +88,19 @@ function planBash(command) {
             shown,
             onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
             alwaysAllowed: false,
-            limitation: `It chains ${parts.length} commands, so BayChat only allows it once.`,
+            // One plain line on WHY, because the usual cause is the agent's own habit (`cd … && x | tail`)
+            // and the fix is for the session to run the command by itself.
+            limitation: `"Always" isn't offered: this chains ${parts.length} commands, and a saved rule only ever covers one plain ` +
+                `command. Run it on its own (no cd … &&, no | tail) to be offered "Always".`,
             call,
         };
     }
     const refusal = redacted
-        ? "It carries what looks like a secret, and a saved rule would keep it in a settings file, so BayChat only allows it once."
+        ? "\"Always\" isn't offered: it carries what looks like a secret, and a saved rule would keep it in a settings file."
         : command.includes("$")
-            ? "It expands a variable, so the same text could run something different later; BayChat only allows it once."
+            ? "\"Always\" isn't offered: it expands a variable, so the same text could run something different later."
             : /[<>]/.test(command)
-                ? "It redirects to or from a file, so BayChat only allows it once."
+                ? "\"Always\" isn't offered: it redirects to or from a file."
                 : "";
     return { shown, onceRules: [`Bash(${command})`], alwaysAllowed: refusal === "", limitation: refusal, call };
 }
@@ -116,7 +119,7 @@ function planWebFetch(url) {
         shown,
         onceRules: [`WebFetch(domain:${host})`],
         alwaysAllowed: false,
-        limitation: `A WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
+        limitation: `"Always" isn't offered: a WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
         call: { tool: "WebFetch", subject: host },
     };
 }

package/dist/denied/settings-rules.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addAllowRules = addAllowRules;
 exports.removeAllowRules = removeAllowRules;
+exports.chooseSettingsFile = chooseSettingsFile;
+exports.settingsFileWritable = settingsFileWritable;
 exports.localSettingsFile = localSettingsFile;
 // Adding and removing exact `permissions.allow` entries in ONE Claude Code settings file — and
 // touching nothing else in it.
@@ -118,6 +120,65 @@ function writeAllow(edit, allow, io) {
     // A new file is private: a once-rule can carry a command's own arguments.
     io.write(edit.target, `${JSON.stringify(next, null, indent)}\n`, io.mode(edit.target) ?? 0o600);
 }
+/**
+ * The settings file a rule for a session started in `projectDir` goes into.
+ *
+ * The project's local file when this user can write it. Otherwise — a repository owned by another
+ * user, the first real run's case (a session as `karmen` in `/var/www/baychat`, owned by `manuel`) —
+ * the user's own `~/.claude/settings.json`, which Claude Code also reloads live, and the card says
+ * so (it then applies to every project). When neither can be written there is nothing to offer, and
+ * the card must not draw an Allow button that can only fail.
+ */
+function chooseSettingsFile(projectDir, deps = {}) {
+    const writable = deps.writable ?? settingsFileWritable;
+    const project = (deps.localFile ?? localSettingsFile)(projectDir);
+    if (writable(project))
+        return { scope: "project", file: project };
+    const user = (deps.userFile ?? claude_settings_1.claudeSettingsPath)();
+    if (writable(user))
+        return { scope: "user", file: user, why: `${project} isn't writable for you` };
+    return { scope: "none", why: `neither ${project} nor ${user} is writable for you` };
+}
+/**
+ * Could `addAllowRules` write `file` as this user? The write is a temp file beside the real file
+ * and a rename, so what has to be writable is its FOLDER (or the nearest folder that exists, which
+ * `mkdir` would create it in); an existing file must also be readable. A folder that cannot be
+ * looked into is not writable — stat's error, not a missing folder (RECURRING_MISTAKES §26).
+ * NEVER THROWS: any doubt is "no".
+ */
+function settingsFileWritable(file, io = claude_settings_1.nodeSettingsIo) {
+    try {
+        const target = io.realpath(file);
+        try {
+            fs.accessSync(target, fs.constants.R_OK);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                return false;
+        }
+        let dir = path.dirname(target);
+        for (;;) {
+            try {
+                if (!fs.statSync(dir).isDirectory())
+                    return false;
+                break;
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    return false;
+                const up = path.dirname(dir);
+                if (up === dir)
+                    return false;
+                dir = up;
+            }
+        }
+        fs.accessSync(dir, fs.constants.W_OK | fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The `.claude/settings.local.json` Claude Code reads for a session started in `projectDir`.
  *

package/dist/denied/transcript.js

@@ -33,34 +33,59 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.CONFIRM_WAIT_MS = exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.claudeConfigDir = claudeConfigDir;
+exports.transcriptFileOf = transcriptFileOf;
 exports.verifyDeniedCall = verifyDeniedCall;
 exports.findToolUse = findToolUse;
 // Proof that a denial really happened: the denied call must be in the session's own transcript.
 //
 // WHY. `baychat denied-hook` reads its event from stdin, and stdin is something anybody can
 // write — including the agent, by running `echo '{…}' | baychat denied-hook` itself. A forged
-// event would put a card on the owner's phone claiming a block that never occurred. So before
-// anything is posted, the call the event names (`tool_use_id`, `tool_name`, and the command or
-// target) must appear as a tool call the MODEL made, in the transcript Claude Code keeps under
-// `~/.claude/projects/` — a protected path the agent cannot write without a prompt.
+// event would put a card on the owner's phone claiming a block that never occurred. So the call
+// the event names (`tool_use_id`, `tool_name`, and the command or target) must appear as a tool
+// call the MODEL made, in the transcript Claude Code keeps under `~/.claude/projects/` — a
+// protected path the agent cannot write without a prompt. Before the card when it is already
+// there; otherwise after the owner's yes, which is then taken back when it never appears.
 //
 // It is defence in depth, not the boundary: the owner's answer is. A card the agent somehow did
 // cause still writes nothing unless the owner taps a yes.
 //
-// THE TRANSCRIPT CAN LAG. The hooks reference says it "is written asynchronously and may lag the
-// in-memory conversation", so a missing call is polled for, briefly, before it counts as absent.
+// THE CALL IS NOT THERE YET WHILE THE HOOK RUNS. Measured on Claude Code 2.1.299 (2026-10-14, a
+// file watcher on the transcript): the assistant line holding the denied `tool_use` — and the
+// denial's result — reach the file only AFTER the PermissionDenied hook returns. The hook gave up
+// at 15:32:46.742Z after waiting 45 s; the line landed at 15:32:47.029Z. Same for an MCP call. So
+// waiting longer can never prove a denial up front. The hook now looks only briefly
+// (TRANSCRIPT_WAIT_MS, for a Claude Code that does write first), and an absent call is proven the
+// other way — the event came from the live Claude Code of that very session (live-session.ts) —
+// and checked here AFTERWARDS, by `baychat permissions confirm` (confirm.ts, CONFIRM_WAIT_MS),
+// which takes the rule back out when the call never shows up.
+//
 // For a subagent's call the hook still gets the MAIN transcript (with `agent_id`); its calls are
 // in `<session>/subagents/agent-<id>.jsonl` beside it.
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const permission_rule_1 = require("./permission-rule");
-/** How long a call may take to reach the transcript before it counts as never made. */
-exports.TRANSCRIPT_WAIT_MS = 10_000;
+/** The hook's own look at the transcript: brief, because Claude Code 2.1.299 writes the denied call
+ *  only after the hook returns (above), so this succeeds only on a Claude Code that writes first. */
+exports.TRANSCRIPT_WAIT_MS = 2_000;
+/** How long the deferred confirmation (`baychat permissions confirm`) waits for the call to reach
+ *  the transcript after the owner's yes. Measured: well under a second after the hook returns. */
+exports.CONFIRM_WAIT_MS = 90_000;
 const TRANSCRIPT_POLL_MS = 250;
 /** Only the end of the file is read: the denied call is the newest thing in it. */
 const TAIL_BYTES = 4 * 1024 * 1024;
+/** Claude Code's config directory: `$CLAUDE_CONFIG_DIR`, else `~/.claude`. */
+function claudeConfigDir(claudeDir) {
+    return claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
+}
+/** The file a call is written to: the main transcript, or a subagent's own beside it. */
+function transcriptFileOf(transcriptPath, agentId) {
+    return agentId
+        ? path.join(transcriptPath.slice(0, -".jsonl".length), "subagents", `${agentId.startsWith("agent-") ? agentId : `agent-${agentId}`}.jsonl`)
+        : transcriptPath;
+}
 /** Did the model really make this call in this session? NEVER THROWS. */
 async function verifyDeniedCall(ref, deps = {}) {
     const now = deps.now ?? Date.now;
@@ -68,17 +93,15 @@ async function verifyDeniedCall(ref, deps = {}) {
     const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
     const readTail = deps.readTail ?? readFileTail;
     try {
-        const projects = realpath(path.join(deps.claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "projects"));
-        const wanted = (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
+        const projects = realpath(path.join(claudeConfigDir(deps.claudeDir), "projects"));
+        const wanted = ref.call ?? (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
         if (!ref.toolUseId || !wanted)
             return { ok: false, why: "the event names no call that can be checked" };
         if (!path.isAbsolute(ref.transcriptPath) || !ref.transcriptPath.endsWith(".jsonl")) {
             return { ok: false, why: "the event carries no transcript" };
         }
-        const file = ref.agentId
-            ? path.join(ref.transcriptPath.slice(0, -".jsonl".length), "subagents", `${ref.agentId.startsWith("agent-") ? ref.agentId : `agent-${ref.agentId}`}.jsonl`)
-            : ref.transcriptPath;
-        const giveUpAt = now() + exports.TRANSCRIPT_WAIT_MS;
+        const file = transcriptFileOf(ref.transcriptPath, ref.agentId);
+        const giveUpAt = now() + (deps.waitMs ?? exports.TRANSCRIPT_WAIT_MS);
         for (;;) {
             let real;
             try {
@@ -99,7 +122,7 @@ async function verifyDeniedCall(ref, deps = {}) {
                     : { ok: false, why: "the transcript's call is not the one the event names" };
             }
             if (now() >= giveUpAt)
-                return { ok: false, why: "the call is not in the session's transcript" };
+                return { ok: false, why: "the call is not in the session's transcript", absent: true };
             await sleep(TRANSCRIPT_POLL_MS);
         }
     }