baychat 0.30.0 → 0.32.0

package/dist/denied/confirm.js

@@ -0,0 +1,131 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmGrant = confirmGrant;
+exports.takeBackStaleUnconfirmed = takeBackStaleUnconfirmed;
+// `baychat permissions confirm --grant <id>` — the deferred half of the denied-command card's proof.
+//
+// Claude Code 2.1.299 writes a denied call to the transcript only after the PermissionDenied hook
+// returns (transcript.ts), so the hook accepts such a call on the live-session proof
+// (live-session.ts) and records the owner's grant as UNCONFIRMED. Just before printing `retry` it
+// starts this command detached (like `permissions sweep`), which polls the transcript for the
+// original `tool_use_id` for up to CONFIRM_WAIT_MS:
+//
+//   • found, and the same call → the grant is marked confirmed and stands;
+//   • not found, or another call under that id → the grant's rules are taken back out of the file
+//     they went into, and the owner gets an info card saying so.
+//
+// A confirmation that never finishes (the child killed, the computer asleep) is caught by the next
+// run of either hook or of a sweep: an unconfirmed grant older than UNCONFIRMED_STALE_MS is taken
+// back the same way (`takeBackStaleUnconfirmed`).
+const os = __importStar(require("os"));
+const approval_wait_1 = require("../approval-wait");
+const config_1 = require("../config");
+const grants_1 = require("./grants");
+const notice_1 = require("./notice");
+const transcript_1 = require("./transcript");
+const LOG_LABEL = "baychat permissions confirm";
+/** Confirm grant `id` against the transcript, or take it back. NEVER THROWS. */
+async function confirmGrant(id, deps = {}) {
+    const log = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const grant = (0, grants_1.findGrant)(id);
+        if (!grant) {
+            log(`${LOG_LABEL}: grant ${id} is already gone; nothing to confirm.`);
+            return "missing";
+        }
+        const pending = grant.unconfirmed;
+        if (!pending) {
+            log(`${LOG_LABEL}: grant ${id} was proven up front; nothing to confirm.`);
+            return "not-pending";
+        }
+        const verify = deps.verify ?? ((ref) => (0, transcript_1.verifyDeniedCall)(ref, { waitMs: transcript_1.CONFIRM_WAIT_MS }));
+        const verdict = await verify({
+            transcriptPath: pending.transcriptPath,
+            agentId: pending.agentId,
+            toolUseId: pending.toolUseId,
+            toolName: pending.toolName,
+            call: grant.call,
+        });
+        if (verdict.ok) {
+            const still = await (0, grants_1.markConfirmed)(id);
+            log(`${LOG_LABEL}: grant ${id} confirmed — the call is in the session's transcript${still ? "" : " (its once-rule was already used and removed)"}.`);
+            return "confirmed";
+        }
+        const revoked = await (0, grants_1.revokeGrant)(id);
+        log(`${LOG_LABEL}: grant ${id} NOT confirmed (${verdict.why}); ${revoked ? "its rules were removed" : "it was already gone"}.`);
+        // A once-grant gone by now was used by the retried call: the owner still has to hear of it.
+        if (revoked || grant.kind === "once")
+            await notifyOwner([{ grant, why: verdict.why, used: !revoked }], deps, log);
+        return "revoked";
+    }
+    catch (err) {
+        log(`${LOG_LABEL}: grant ${id} could not be confirmed (${(0, approval_wait_1.reasonOf)(err)}); a later hook run takes it back when it goes stale.`);
+        return "missing";
+    }
+}
+/** Take back every unconfirmed grant whose confirmation should have finished, and tell the owner.
+ *  Returns how many. NEVER THROWS. */
+async function takeBackStaleUnconfirmed(deps = {}) {
+    const log = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const doomed = await (0, grants_1.sweepStaleUnconfirmed)((deps.now ?? Date.now)());
+        for (const grant of doomed)
+            log(`${LOG_LABEL}: grant ${grant.id} was never confirmed in time; its rules were removed.`);
+        if (doomed.length)
+            await notifyOwner(doomed.map((grant) => ({ grant, why: "its confirmation never finished", used: false })), deps, log);
+        return doomed.length;
+    }
+    catch (err) {
+        log(`${LOG_LABEL}: stale unconfirmed grants could not be swept (${(0, approval_wait_1.reasonOf)(err)}).`);
+        return 0;
+    }
+}
+async function notifyOwner(items, deps, log) {
+    const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
+    if (!device) {
+        log(`${LOG_LABEL}: not logged in to BayChat, so the owner could not be told.`);
+        return;
+    }
+    const noticeDeps = {
+        now: deps.now ?? Date.now,
+        sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+        log,
+    };
+    const host = (deps.hostname ?? os.hostname)();
+    for (const { grant, why, used } of items) {
+        await (0, notice_1.postNotice)(device, grant.session, (0, notice_1.unconfirmedNotice)(grant, host, why, used), noticeDeps, LOG_LABEL);
+    }
+}

package/dist/denied/grants.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ONCE_TTL_MS = void 0;
+exports.UNCONFIRMED_STALE_MS = exports.ONCE_TTL_MS = void 0;
 exports.grantRules = grantRules;
 exports.listGrants = listGrants;
 exports.coveringGrant = coveringGrant;
@@ -42,6 +42,12 @@ exports.revokeGrant = revokeGrant;
 exports.consumeOnceGrants = consumeOnceGrants;
 exports.sweepExpiredGrants = sweepExpiredGrants;
 exports.hasOnceGrants = hasOnceGrants;
+exports.hasGrantsToSweep = hasGrantsToSweep;
+exports.findGrant = findGrant;
+exports.markConfirmed = markConfirmed;
+exports.isStaleUnconfirmed = isStaleUnconfirmed;
+exports.hasStaleUnconfirmed = hasStaleUnconfirmed;
+exports.sweepStaleUnconfirmed = sweepStaleUnconfirmed;
 // The permission rules BayChat itself wrote on this computer, and the one owner of every change to
 // them (`~/.baychat/permission-grants.json`, 0600).
 //
@@ -61,10 +67,15 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const permission_rule_1 = require("./permission-rule");
+const transcript_1 = require("./transcript");
 const settings_rules_1 = require("./settings-rules");
 /** How long a once-rule may outlive its card when the retried call never reports back. The retry
  *  starts within seconds; this only bounds a rule left behind by a session that went away. */
 exports.ONCE_TTL_MS = 5 * 60_000;
+/** An unconfirmed grant older than this lost its confirmation (the child was killed, or never
+ *  started) and is taken back by the next hook run or sweep. The confirmation's own wait
+ *  (CONFIRM_WAIT_MS) plus room for its start-up. */
+exports.UNCONFIRMED_STALE_MS = transcript_1.CONFIRM_WAIT_MS + 30_000;
 const LOCK_WAIT_MS = 5_000;
 const LOCK_POLL_MS = 50;
 const STALE_LOCK_MS = 30_000;
@@ -85,6 +96,7 @@ async function grantRules(request, now = Date.now()) {
             kind: request.kind,
             rules: added,
             settingsFile: request.settingsFile,
+            scope: request.scope,
             call: request.call,
             shown: request.shown,
             claudeSessionId: request.claudeSessionId,
@@ -92,6 +104,7 @@ async function grantRules(request, now = Date.now()) {
             addedAt: new Date(now).toISOString(),
             ...(request.kind === "once" ? { expiresAt: new Date(now + exports.ONCE_TTL_MS).toISOString() } : {}),
             retries: 0,
+            ...(request.unconfirmed ? { unconfirmed: { ...request.unconfirmed, since: new Date(now).toISOString() } } : {}),
         };
         try {
             writeGrants([...readGrants(), grant]);
@@ -140,10 +153,55 @@ async function consumeOnceGrants(claudeSessionId, call) {
 async function sweepExpiredGrants(now = Date.now()) {
     return revokeWhere((g) => g.kind === "once" && isExpired(g, now));
 }
-/** Is there any once-grant at all? The after-hook's fast exit, read without the lock. */
+/** Is there any once-grant at all? Read without the lock. */
 function hasOnceGrants() {
     return readGrants().some((g) => g.kind === "once");
 }
+/** Anything a sweep could act on — a once-grant, or one still unconfirmed? The after-hook's fast
+ *  exit, read without the lock. */
+function hasGrantsToSweep() {
+    return readGrants().some((g) => g.kind === "once" || g.unconfirmed !== undefined);
+}
+/** One grant by id, read without the lock. */
+function findGrant(id) {
+    return readGrants().find((g) => g.id === id);
+}
+/** The call was found in the transcript: the grant stands. False: no such grant (any more). */
+async function markConfirmed(id) {
+    return withGrantsLock(() => {
+        const grants = readGrants();
+        if (!grants.some((g) => g.id === id))
+            return false;
+        writeGrants(grants.map((g) => (g.id === id ? withoutUnconfirmed(g) : g)));
+        return true;
+    });
+}
+/** Is this grant still waiting for a confirmation that should have finished by `now`? */
+function isStaleUnconfirmed(grant, now = Date.now()) {
+    if (!grant.unconfirmed)
+        return false;
+    const since = Date.parse(grant.unconfirmed.since);
+    // Unreadable: it can only be taken back early.
+    return !Number.isFinite(since) || since + exports.UNCONFIRMED_STALE_MS <= now;
+}
+/** Is any grant's confirmation overdue? Read without the lock (the after-hook's cheap check). */
+function hasStaleUnconfirmed(now = Date.now()) {
+    return readGrants().some((g) => isStaleUnconfirmed(g, now));
+}
+/** Take back every grant whose confirmation never finished. Returns them, for the owner's notice. */
+async function sweepStaleUnconfirmed(now = Date.now()) {
+    return withGrantsLock(() => {
+        let grants = readGrants();
+        const doomed = grants.filter((g) => isStaleUnconfirmed(g, now));
+        for (const grant of doomed)
+            grants = revokeLocked(grant, grants);
+        return doomed;
+    });
+}
+function withoutUnconfirmed(grant) {
+    const { unconfirmed: _done, ...rest } = grant;
+    return rest;
+}
 async function revokeWhere(match) {
     return withGrantsLock(() => {
         let grants = readGrants();

package/dist/denied/hook-log.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deniedHookLogPath = deniedHookLogPath;
+exports.appendHookLog = appendHookLog;
+exports.logBoth = logBoth;
+// `~/.baychat/denied-hook.log` — the denied-command card's own log.
+//
+// Claude Code ignores a PermissionDenied hook's stderr, so without a file a silent hook is
+// undiagnosable: "no card came" could mean never called, not joined, unproven call, or a failed
+// post. Shared by the hook and by the detached `baychat permissions confirm` it starts, so one
+// file tells the whole story of a denial. One line per step, NEVER the tool input (it can hold
+// secrets), kept small.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const HOOK_LOG_MAX_BYTES = 256 * 1024;
+function deniedHookLogPath() {
+    return path.join((0, config_1.configDir)(), "denied-hook.log");
+}
+/** Append one line, rotating at HOOK_LOG_MAX_BYTES. NEVER THROWS. */
+function appendHookLog(line) {
+    try {
+        const file = deniedHookLogPath();
+        try {
+            if (fs.statSync(file).size > HOOK_LOG_MAX_BYTES)
+                fs.renameSync(file, `${file}.1`);
+        }
+        catch {
+            // No log yet: nothing to rotate.
+        }
+        fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+        fs.appendFileSync(file, `${new Date().toISOString()} ${line}\n`, { mode: 0o600 });
+    }
+    catch (err) {
+        process.stderr.write(`baychat denied-hook: could not write its log (${err instanceof Error ? err.message : String(err)}).\n`);
+    }
+}
+/** stderr and the log file: what every denied-command process logs through. */
+function logBoth(line) {
+    process.stderr.write(`${line}\n`);
+    appendHookLog(line);
+}

package/dist/denied/live-session.js

@@ -0,0 +1,154 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.proveLiveSession = proveLiveSession;
+exports.readClaudeSessionFile = readClaudeSessionFile;
+// The second proof a denial is real, for the moment the transcript cannot give the first: the
+// event came from the live Claude Code that runs the session it names.
+//
+// WHY THIS EXISTS. Claude Code 2.1.299 writes the denied `tool_use` to the transcript only after
+// the PermissionDenied hook returns (measured; transcript.ts), so the hook can never find it
+// while it waits. What the hook CAN check while it waits:
+//
+//   (a) the event's `transcript_path` is a file in Claude Code's own `projects/` folder (followed
+//       through symlinks) named `<session_id>.jsonl` — the session's own transcript, not one the
+//       event made up; and
+//   (b) one of the hook's own ancestors (≤ MAX_CLAUDE_HOPS from its parent) is a LIVE Claude Code
+//       whose `~/.claude/sessions/<pid>.json` (Claude Code writes it for every running session)
+//       says `sessionId` = the event's `session_id`, and that file belongs to the process that has
+//       the pid now, not to an earlier one that died and left its pid to be reused.
+//
+// WHAT IT DOES NOT PROVE. The agent's own Bash tool is a child of the same Claude Code, so an
+// `echo '{…}' | baychat denied-hook` it runs passes (b) as well. That is why a call accepted this
+// way is CONFIRMED afterwards against the transcript (confirm.ts) and taken back when it never
+// shows up, and why the boundary remains the owner's tap on the exact command the card shows.
+//
+// PID REUSE. The file carries `startedAt` (ms) and, on Linux, `procStart` = field 22 of
+// `/proc/<pid>/stat` (start time in clock ticks). When both that and the live value exist they
+// must be EQUAL. Otherwise `startedAt` must lie within a few seconds of the start `ps` reports.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("../approve-hook");
+const claude_link_1 = require("../channel/claude-link");
+const transcript_1 = require("./transcript");
+/** `ps -o etime` has whole seconds, and the clock is read twice: this much early is the same start. */
+const STARTED_EARLY_SLACK_MS = 3_000;
+/** Claude Code writes its session file once it has started — 4.4 s after the kernel's start time
+ *  on this VPS (2026-10-14); a busy disk makes it slower. Later than this is not that process's. */
+const STARTED_LATE_SLACK_MS = 30_000;
+/** A session id or agent id is one path segment of safe characters, never a path. */
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+/** Did this event come from the live Claude Code of the session it names? NEVER THROWS. */
+function proveLiveSession(ref, deps = {}) {
+    const claudeDir = (0, transcript_1.claudeConfigDir)(deps.claudeDir);
+    const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
+    const parentOf = deps.parentOf ?? approve_hook_1.psParentOf;
+    const isAlive = deps.isAlive ?? claude_link_1.pidAlive;
+    const readSessionFile = deps.readSessionFile ?? ((pid) => readClaudeSessionFile(claudeDir, pid));
+    const procStart = deps.procStart ?? approve_hook_1.procStartTicks;
+    const ageMs = deps.ageMs ?? approve_hook_1.psAgeMs;
+    const now = deps.now ?? Date.now;
+    try {
+        // (a) The session's own transcript, in Claude Code's own folder.
+        if (!SAFE_ID.test(ref.sessionId))
+            return { ok: false, why: "the event's session id is not one Claude Code writes" };
+        if (ref.agentId !== undefined && !SAFE_ID.test(ref.agentId))
+            return { ok: false, why: "the event's agent id is not one Claude Code writes" };
+        const expected = `${ref.sessionId}.jsonl`;
+        if (!path.isAbsolute(ref.transcriptPath) || path.basename(ref.transcriptPath) !== expected) {
+            return { ok: false, why: `the event's transcript is not named ${expected}` };
+        }
+        const projects = realpath(path.join(claudeDir, "projects"));
+        let real;
+        try {
+            real = realpath(ref.transcriptPath);
+        }
+        catch {
+            // Not written yet (a session's very first turn): its folder must still be Claude Code's.
+            real = path.join(realpath(path.dirname(ref.transcriptPath)), expected);
+        }
+        if (!real.startsWith(projects + path.sep) || path.basename(real) !== expected) {
+            return { ok: false, why: "the event's transcript is not in Claude Code's own folder" };
+        }
+        // (b) The nearest Claude Code above this process runs that session.
+        let pid = deps.ppid ?? process.ppid;
+        for (let hop = 0; hop < approve_hook_1.MAX_CLAUDE_HOPS && pid !== undefined && pid > 1; hop++) {
+            const file = readSessionFile(pid);
+            if (file && isAlive(pid)) {
+                // The nearest one decides: a hook runs under exactly one Claude Code.
+                if (file.sessionId !== ref.sessionId) {
+                    return { ok: false, why: `the Claude Code this hook runs under (pid ${pid}) is another session` };
+                }
+                if (file.pid !== undefined && file.pid !== pid) {
+                    return { ok: false, why: `the session file of pid ${pid} names another pid` };
+                }
+                const started = startMatches(pid, file, procStart, ageMs, now);
+                return started === true ? { ok: true, pid } : { ok: false, why: started };
+            }
+            pid = parentOf(pid);
+        }
+        return { ok: false, why: `no live Claude Code of this session among the hook's ${approve_hook_1.MAX_CLAUDE_HOPS} nearest ancestors` };
+    }
+    catch (err) {
+        return { ok: false, why: `the session could not be checked (${err instanceof Error ? err.message : String(err)})` };
+    }
+}
+/** True when `file` was written by the process that has `pid` now; otherwise why not. */
+function startMatches(pid, file, procStart, ageMs, now) {
+    const recorded = typeof file.procStart === "string" || typeof file.procStart === "number" ? String(file.procStart) : undefined;
+    const live = recorded === undefined ? undefined : procStart(pid);
+    if (recorded !== undefined && live !== undefined) {
+        return recorded === live ? true : `pid ${pid} is a newer process than its session file (start ${live}, file ${recorded})`;
+    }
+    const startedAt = typeof file.startedAt === "number" ? file.startedAt : Number.NaN;
+    const age = ageMs(pid);
+    if (!Number.isFinite(startedAt) || age === undefined)
+        return `when pid ${pid} started cannot be told`;
+    const processStart = now() - age;
+    if (startedAt < processStart - STARTED_EARLY_SLACK_MS || startedAt > processStart + STARTED_LATE_SLACK_MS) {
+        return `pid ${pid}'s session file was written by another process (started ${new Date(startedAt).toISOString()}, the process ${new Date(processStart).toISOString()})`;
+    }
+    return true;
+}
+/** `<claudeDir>/sessions/<pid>.json`, or undefined when absent or not a JSON object. */
+function readClaudeSessionFile(claudeDir, pid) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(path.join(claudeDir, "sessions", `${pid}.json`), "utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/denied/notice.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NOTICE_OPTIONS = void 0;
+exports.postNotice = postNotice;
+exports.unconfirmedNotice = unconfirmedNotice;
+// A card that only informs: posted to the owner's private chat with the session, never waited on.
+// Shared by the hook and by the processes that take a grant back after it (confirm.ts).
+const approval_wait_1 = require("../approval-wait");
+/** The single button of a card that only informs: nothing can be allowed from it. */
+exports.NOTICE_OPTIONS = ["OK"];
+/** Post `question` as an info card. NEVER THROWS (askOwnerAndWait does not); its deadline is now. */
+async function postNotice(device, session, question, deps, label) {
+    const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: exports.NOTICE_OPTIONS }, deps.now(), deps, label);
+    if (outcome.kind === "failed")
+        deps.log(`${label}: the notice could not be posted (${outcome.reason}).`);
+}
+/**
+ * The owner's notice when BayChat took back a grant it could not confirm. `used`: a once-grant
+ * whose rule the retried call had already used (and the after-hook removed) by then.
+ */
+function unconfirmedNotice(grant, host, why, used) {
+    const who = grant.session ? `session "${grant.session}"` : "a Claude Code session";
+    return (`BayChat removed the rule you allowed for ${who} on ${host}:\n\n${grant.shown}\n\n` +
+        `It could not confirm that the block came from that session — Claude Code's auto mode never recorded ` +
+        `this call in the session's transcript (${why}).` +
+        (used ? " The rule had already been used once." : "") +
+        "\n\nIf you did not expect this card, check what is running on that computer. If you still want the call " +
+        "allowed, approve it at the computer (/permissions → Recently denied).");
+}

package/dist/denied/permission-rule.js

@@ -49,7 +49,7 @@ function planDeniedCall(toolName, toolInput) {
             shown: `${toolName} ${clipJson(input)}`,
             onceRules: [toolName],
             alwaysAllowed: false,
-            limitation: "A rule for an MCP tool allows every use of that tool, so BayChat only allows it once.",
+            limitation: "\"Always\" isn't offered: a rule for an MCP tool would allow every use of it, so BayChat only allows it once.",
             call: { tool: toolName, subject: toolName },
         };
     }
@@ -88,16 +88,19 @@ function planBash(command) {
             shown,
             onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
             alwaysAllowed: false,
-            limitation: `It chains ${parts.length} commands, so BayChat only allows it once.`,
+            // One plain line on WHY, because the usual cause is the agent's own habit (`cd … && x | tail`)
+            // and the fix is for the session to run the command by itself.
+            limitation: `"Always" isn't offered: this chains ${parts.length} commands, and a saved rule only ever covers one plain ` +
+                `command. Run it on its own (no cd … &&, no | tail) to be offered "Always".`,
             call,
         };
     }
     const refusal = redacted
-        ? "It carries what looks like a secret, and a saved rule would keep it in a settings file, so BayChat only allows it once."
+        ? "\"Always\" isn't offered: it carries what looks like a secret, and a saved rule would keep it in a settings file."
         : command.includes("$")
-            ? "It expands a variable, so the same text could run something different later; BayChat only allows it once."
+            ? "\"Always\" isn't offered: it expands a variable, so the same text could run something different later."
             : /[<>]/.test(command)
-                ? "It redirects to or from a file, so BayChat only allows it once."
+                ? "\"Always\" isn't offered: it redirects to or from a file."
                 : "";
     return { shown, onceRules: [`Bash(${command})`], alwaysAllowed: refusal === "", limitation: refusal, call };
 }
@@ -116,7 +119,7 @@ function planWebFetch(url) {
         shown,
         onceRules: [`WebFetch(domain:${host})`],
         alwaysAllowed: false,
-        limitation: `A WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
+        limitation: `"Always" isn't offered: a WebFetch rule covers the whole of ${host}, so BayChat only allows it once.`,
         call: { tool: "WebFetch", subject: host },
     };
 }

package/dist/denied/settings-rules.js

@@ -35,6 +35,8 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addAllowRules = addAllowRules;
 exports.removeAllowRules = removeAllowRules;
+exports.chooseSettingsFile = chooseSettingsFile;
+exports.settingsFileWritable = settingsFileWritable;
 exports.localSettingsFile = localSettingsFile;
 // Adding and removing exact `permissions.allow` entries in ONE Claude Code settings file — and
 // touching nothing else in it.
@@ -118,6 +120,65 @@ function writeAllow(edit, allow, io) {
     // A new file is private: a once-rule can carry a command's own arguments.
     io.write(edit.target, `${JSON.stringify(next, null, indent)}\n`, io.mode(edit.target) ?? 0o600);
 }
+/**
+ * The settings file a rule for a session started in `projectDir` goes into.
+ *
+ * The project's local file when this user can write it. Otherwise — a repository owned by another
+ * user, the first real run's case (a session as `karmen` in `/var/www/baychat`, owned by `manuel`) —
+ * the user's own `~/.claude/settings.json`, which Claude Code also reloads live, and the card says
+ * so (it then applies to every project). When neither can be written there is nothing to offer, and
+ * the card must not draw an Allow button that can only fail.
+ */
+function chooseSettingsFile(projectDir, deps = {}) {
+    const writable = deps.writable ?? settingsFileWritable;
+    const project = (deps.localFile ?? localSettingsFile)(projectDir);
+    if (writable(project))
+        return { scope: "project", file: project };
+    const user = (deps.userFile ?? claude_settings_1.claudeSettingsPath)();
+    if (writable(user))
+        return { scope: "user", file: user, why: `${project} isn't writable for you` };
+    return { scope: "none", why: `neither ${project} nor ${user} is writable for you` };
+}
+/**
+ * Could `addAllowRules` write `file` as this user? The write is a temp file beside the real file
+ * and a rename, so what has to be writable is its FOLDER (or the nearest folder that exists, which
+ * `mkdir` would create it in); an existing file must also be readable. A folder that cannot be
+ * looked into is not writable — stat's error, not a missing folder (RECURRING_MISTAKES §26).
+ * NEVER THROWS: any doubt is "no".
+ */
+function settingsFileWritable(file, io = claude_settings_1.nodeSettingsIo) {
+    try {
+        const target = io.realpath(file);
+        try {
+            fs.accessSync(target, fs.constants.R_OK);
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                return false;
+        }
+        let dir = path.dirname(target);
+        for (;;) {
+            try {
+                if (!fs.statSync(dir).isDirectory())
+                    return false;
+                break;
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    return false;
+                const up = path.dirname(dir);
+                if (up === dir)
+                    return false;
+                dir = up;
+            }
+        }
+        fs.accessSync(dir, fs.constants.W_OK | fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * The `.claude/settings.local.json` Claude Code reads for a session started in `projectDir`.
  *