ccdesk 0.0.0-stage → 0.2.0

package/dist/server/scan/mcp.js

@@ -0,0 +1,313 @@
+import { join } from "node:path";
+import {} from "../../shared/types.js";
+import { isConfigHome } from "./env.js";
+import { isRecord, readJsonObject, redactSecrets, shownUrl, stringField, stringsIn, wildcard, } from "./files.js";
+import { manifestConfigs } from "./plugins.js";
+import serverSchema from "../../shared/mcp-server.schema.json" with { type: "json" };
+import { ajv, schemaErrors } from "../schema.js";
+import { readManagedSettings } from "./settings.js";
+const validateServer = ajv.compile(serverSchema);
+/**
+ * What makes a server definition one Claude Code cannot start: a missing command or url, a type it
+ * does not know, or a field the docs define holding the wrong kind of value (docs: mcp). It checks
+ * the rest when it starts the server.
+ */
+export function serverProblems(definition) {
+    if (!isRecord(definition))
+        return ["A server must be a JSON object."];
+    const type = typeof definition.type === "string" ? definition.type : "";
+    if (type === "sdk")
+        return ['Only an SDK host application can register a "sdk" server; Claude Code skips it here.'];
+    const problems = [];
+    if (type === "" || type === "stdio") {
+        if (typeof definition.command !== "string" || definition.command.trim() === "")
+            problems.push(typeof definition.url === "string"
+                ? 'A server with a url needs a "type", such as "http"; without one it is read as a stdio server.'
+                : 'A stdio server needs a "command".');
+    }
+    else if (typeof definition.url !== "string" || definition.url === "")
+        problems.push(`A ${type} server needs a "url".`);
+    return [...problems, ...schemaErrors(validateServer, definition, "")];
+}
+function define(servers, scope, sourcePath, organisation = false) {
+    if (!isRecord(servers))
+        return [];
+    return Object.entries(servers)
+        .filter(([, config]) => isRecord(config))
+        .map(([name, config]) => {
+        const c = config;
+        const type = stringField(c, "type");
+        const url = stringField(c, "url") || null;
+        const command = stringField(c, "command")
+            ? [stringField(c, "command"), ...stringsIn(c.args)]
+            : null;
+        const definition = redactSecrets(c);
+        const server = {
+            name,
+            scope,
+            // An entry without a type is read as stdio, even one with a url (docs: mcp).
+            transport: type || "stdio",
+            target: url
+                ? shownUrl(url)
+                : command
+                    ? [command[0], ...stringsIn(definition.args)].join(" ")
+                    : "",
+            sourcePath,
+            status: "active",
+            definition,
+        };
+        const [problem] = serverProblems(c);
+        if (problem) {
+            server.status = "invalid";
+            server.note = problem;
+        }
+        // A ${VAR} in an organisation entry means it still has to pass the allowlist.
+        const usesVariables = JSON.stringify(c).includes("${");
+        return {
+            server,
+            command: type && type !== "stdio" ? null : command,
+            url: type ? url : null,
+            organisation: organisation && !usesVariables,
+        };
+    });
+}
+/** Control and invisible formatting characters, such as zero-width spaces and bidi overrides. */
+const INVISIBLE = /[\p{Cc}\p{Cf}]/u;
+/** Every key and string value in a JSON value, the entry's name included by the caller. */
+function textsIn(value) {
+    if (typeof value === "string")
+        return [value];
+    if (Array.isArray(value))
+        return value.flatMap(textsIn);
+    if (!isRecord(value))
+        return [];
+    return Object.entries(value).flatMap(([key, inner]) => [key, ...textsIn(inner)]);
+}
+/**
+ * Why Claude Code drops a managedMcpServers entry, or null when it loads it
+ * (docs: managed-mcp#what-an-entry-can-contain). `config` is the entry as written, headers included.
+ */
+function managedEntryProblem(name, config) {
+    if (!isRecord(config))
+        return "Not an object";
+    const type = stringField(config, "type");
+    if (!["http", "sse", "streamable-http"].includes(type))
+        return "managedMcpServers entries must be http or sse servers";
+    if (!stringField(config, "url").startsWith("https://"))
+        return "managedMcpServers entries need an https:// URL";
+    const member = ["command", "args", "env", "headersHelper"].find((key) => key in config);
+    if (member)
+        return `managedMcpServers entries may not have "${member}"`;
+    if (JSON.stringify(config).includes("${"))
+        return "managedMcpServers entries may not use environment variable references";
+    if (!/^[\w-]+$/.test(name))
+        return "A managedMcpServers name may hold only letters, numbers, hyphens and underscores";
+    if (textsIn(config).some((text) => INVISIBLE.test(text)))
+        return "managedMcpServers entries may not contain control or invisible characters";
+    return null;
+}
+/** managedMcpServers from managed settings, with entries Claude Code drops marked invalid. */
+function defineManaged(servers, sourcePath) {
+    const defined = define(servers, "managed", sourcePath, true);
+    for (const d of defined) {
+        const problem = managedEntryProblem(d.server.name, servers[d.server.name]);
+        if (problem) {
+            d.server.status = "invalid";
+            d.server.note = problem;
+        }
+    }
+    return defined;
+}
+/** Two URLs are one endpoint when they differ only in scheme or host case, a default port or a trailing slash. */
+function endpoint(d) {
+    if (d.command)
+        return `command:${JSON.stringify(d.command)}`;
+    if (!d.url)
+        return `none:${d.server.name}`;
+    try {
+        const u = new URL(d.url);
+        const path = u.pathname.replace(/\/$/, "");
+        const user = u.username ? `${u.username}${u.password ? `:${u.password}` : ""}@` : "";
+        return `url:${u.protocol}//${user}${u.host}${path}${u.search}`;
+    }
+    catch {
+        return `url:${d.url}`;
+    }
+}
+function policyEntries(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((e) => isRecord(e) &&
+        (typeof e.serverName === "string" ||
+            (Array.isArray(e.serverCommand) && e.serverCommand.every((p) => typeof p === "string")) ||
+            typeof e.serverUrl === "string"));
+}
+/** A `serverUrl` pattern (docs: managed-mcp#how-serverurl-entries-match). */
+function urlMatches(pattern, url) {
+    const p = /^([^:/]+):\/\/([^/:]+)(?::([^/]*))?(\/.*)?$/.exec(pattern);
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (!p)
+        return false;
+    const [, scheme = "", host = "", port, path] = p;
+    const scheme_ = u.protocol.slice(0, -1);
+    if (!wildcard(scheme).test(scheme_))
+        return false;
+    if (!wildcard(host.replace(/\.$/, ""), "i").test(u.hostname.replace(/\.$/, "")))
+        return false;
+    const actualPort = u.port || (scheme_ === "https" ? "443" : scheme_ === "http" ? "80" : "");
+    // No port: a full hostname means the default port only, a wildcard hostname any port.
+    if (port !== undefined) {
+        if (!wildcard(port).test(actualPort))
+            return false;
+    }
+    else if (!host.includes("*") && u.port !== "")
+        return false;
+    return path === undefined || wildcard(path).test(u.pathname + u.search);
+}
+function matches(entry, d) {
+    if ("serverName" in entry)
+        return entry.serverName === d.server.name;
+    if ("serverCommand" in entry)
+        return d.command !== null && JSON.stringify(entry.serverCommand) === JSON.stringify(d.command);
+    return d.url !== null && urlMatches(entry.serverUrl, d.url);
+}
+/** The allowlist check by server type (docs: managed-mcp#how-a-server-is-evaluated). */
+function allowed(list, d) {
+    const kind = d.url ? "serverUrl" : "serverCommand";
+    const byKind = list.filter((e) => kind in e);
+    if (byKind.some((e) => matches(e, d)))
+        return true;
+    return byKind.length === 0 && list.some((e) => "serverName" in e && matches(e, d));
+}
+/**
+ * Every MCP server definition, each marked with whether Claude Code would start it here
+ * (docs: mcp#scope-hierarchy-and-precedence, managed-mcp). ccdesk never connects, so an active
+ * server is one that is configured and allowed, not one that is known to work.
+ */
+export async function readMcpServers(input, plugins) {
+    const { env, projectDir, layers, claudeJson, trust, profile } = input;
+    const projects = isRecord(claudeJson?.projects) ? claudeJson.projects : {};
+    // Local servers live in the entry under the trust key, even from a subdirectory: claude mcp add
+    // --scope local writes there and claude mcp list reads only that entry, ignoring one for the
+    // subdirectory (observed with v2.1.296; the docs do not say).
+    const entry = projects[trust.root];
+    const project = isRecord(entry) ? entry : {};
+    const managed = layers.find((l) => l.scope === "managed");
+    // Checked as written: the layer has header values hidden, which would hide a ${VAR} in one.
+    const managedServers = (await readManagedSettings(env)).data?.managedMcpServers;
+    const managedFile = join(env.managedDir, "managed-mcp.json");
+    const managedJson = await readJsonObject(env, managedFile);
+    const mcpJson = join(projectDir, ".mcp.json");
+    const shared = await readJsonObject(env, mcpJson);
+    const defined = [
+        ...(managedJson.ok ? define(managedJson.data.mcpServers, "managed", managedFile, true) : []),
+        ...defineManaged(managedServers, managed?.path ?? ""),
+        ...define(project.mcpServers, "local", env.claudeJson),
+        ...(shared.ok ? define(shared.data.mcpServers, "project", mcpJson) : []),
+        ...define(claudeJson?.mcpServers, "user", env.claudeJson),
+    ];
+    for (const plugin of plugins) {
+        const path = join(plugin.installPath, ".mcp.json");
+        const file = await readJsonObject(env, path);
+        // A server name declared later in the same plugin replaces an earlier one.
+        const own = new Map();
+        const add = (list) => {
+            for (const d of list)
+                own.set(d.server.name, d);
+        };
+        if (file.ok)
+            add(define(file.data.mcpServers ?? file.data, "plugin", path));
+        for (const part of await manifestConfigs(env, plugin, "mcpServers"))
+            add(define(part.value, "plugin", part.path));
+        for (const d of own.values())
+            d.server.plugin = plugin.id;
+        defined.push(...own.values());
+    }
+    const exclusive = managedJson.ok;
+    const denied = layers.flatMap((l) => policyEntries(l.data?.deniedMcpServers));
+    const managedOnly = managed?.data?.allowManagedMcpServersOnly === true;
+    const allowLayers = layers.filter((l) => !managedOnly || l.scope === "managed");
+    const allowSet = allowLayers.some((l) => Array.isArray(l.data?.allowedMcpServers));
+    const allowList = allowLayers.flatMap((l) => policyEntries(l.data?.allowedMcpServers));
+    const disabledHere = stringsIn(project.disabledMcpServers);
+    // A cloned repository cannot approve its own servers: project and local approvals count once the
+    // folder is trusted, local ones in your configuration home right away (docs: mcp#project-server-approvals-and-workspace-trust).
+    // A disabledMcpjsonServers entry in any file rejects the server.
+    const approvalCounts = (scope) => (scope !== "project" && scope !== "local") ||
+        trust.trusted ||
+        (scope === "local" && isConfigHome(env, projectDir));
+    // Your answers to the .mcp.json prompt sit in the project entry: claude mcp list counts an
+    // enableAllProjectMcpServers there, and claude mcp reset-project-choices clears it (v2.1.296).
+    const sources = [
+        ...layers.flatMap((l) => (l.data ? [{ source: l.scope, path: l.path, data: l.data }] : [])),
+        { source: "claude-json", path: env.claudeJson, data: project },
+    ];
+    const answersFor = (name) => sources.flatMap(({ source, path, data }) => {
+        const counts = source === "claude-json" || approvalCounts(source);
+        const out = [];
+        if (data.enableAllProjectMcpServers === true)
+            out.push({ key: "enableAllProjectMcpServers", source, path, counts });
+        if (stringsIn(data.enabledMcpjsonServers).includes(name))
+            out.push({ key: "enabledMcpjsonServers", source, path, counts });
+        if (stringsIn(data.disabledMcpjsonServers).includes(name))
+            out.push({ key: "disabledMcpjsonServers", source, path, counts: true });
+        return out;
+    });
+    const from = (a) => a.source === "claude-json" ? "your answer in ~/.claude.json" : `${a.source} settings`;
+    const set = (server, status, note) => {
+        server.status = status;
+        server.note = note;
+    };
+    const byName = new Map();
+    const enabledEndpoints = new Map();
+    for (const d of defined) {
+        const { server } = d;
+        if (server.status === "invalid")
+            continue;
+        if (exclusive && !d.organisation && server.scope !== "managed") {
+            set(server, "blocked", "managed-mcp.json takes exclusive control of MCP servers");
+            continue;
+        }
+        // Scopes dedupe by name; plugins by endpoint against the enabled servers above them.
+        const earlier = server.scope === "plugin" ? enabledEndpoints.get(endpoint(d)) : byName.get(server.name);
+        if (earlier) {
+            set(server, "shadowed", `The ${earlier.server.scope} definition of ${earlier.server.name} is used instead`);
+            continue;
+        }
+        if (server.scope !== "plugin")
+            byName.set(server.name, d);
+        if (denied.some((e) => matches(e, d)))
+            set(server, "blocked", "Blocked by deniedMcpServers");
+        else if (allowSet && !d.organisation && !allowed(allowList, d))
+            set(server, "blocked", managedOnly ? "Not in the managed allowedMcpServers" : "Not in allowedMcpServers");
+        else if (disabledHere.includes(server.name))
+            set(server, "disabled", "Turned off for this project in /mcp");
+        else if (server.scope === "project") {
+            const answers = answersFor(server.name);
+            if (answers.length > 0)
+                server.approvals = answers;
+            const rejection = answers.find((a) => a.key === "disabledMcpjsonServers");
+            const waiting = answers.find((a) => a.key !== "disabledMcpjsonServers" && !a.counts);
+            const approved = answers.some((a) => a.key !== "disabledMcpjsonServers" && a.counts);
+            if (rejection)
+                set(server, "rejected", `Rejected by disabledMcpjsonServers in ${from(rejection)}`);
+            // claude -p connects them without asking, approved or not (docs: permissions#what-runs-before-you-trust-a-folder).
+            else if (!approved && profile === "print")
+                server.note =
+                    "Not approved, but claude -p connects .mcp.json servers without asking; the SDK does when settingSources includes project";
+            else if (!approved)
+                set(server, "pending", waiting
+                    ? `Claude Code asks before starting it: ${waiting.key} in ${from(waiting)} counts once you trust this folder`
+                    : "Claude Code asks before starting servers from .mcp.json: answer its prompt, or list the server in enabledMcpjsonServers in your user settings");
+        }
+        if (server.status === "active" || server.status === "pending")
+            enabledEndpoints.set(endpoint(d), d);
+    }
+    return defined.map((d) => d.server);
+}

package/dist/server/scan/memory.js

@@ -0,0 +1,90 @@
+import { join } from "node:path";
+import {} from "../../shared/types.js";
+import {} from "./env.js";
+import { isDir, listDir, parseFrontmatter, readTextFile, revisionOf, shortHash, stringField, } from "./files.js";
+const INDEX_FILE = "MEMORY.md";
+/** Claude Code reads only this much of MEMORY.md at session start (docs: memory#auto-memory). */
+const INDEX_LINE_LIMIT = 200;
+const INDEX_BYTE_LIMIT = 25 * 1024;
+const TYPES = ["user", "feedback", "project", "reference"];
+export async function readMemoryStore(env, dir, projectPath) {
+    if (!(await isDir(dir)))
+        return null;
+    const indexFile = await readTextFile(env, join(dir, INDEX_FILE));
+    const files = (await listDir(dir)).filter((f) => f.endsWith(".md") && f !== INDEX_FILE);
+    const memories = [];
+    for (const file of files) {
+        const text = await readTextFile(env, join(dir, file));
+        if (!text)
+            continue;
+        const { data, body } = parseFrontmatter(text.text);
+        const metadata = typeof data.metadata === "object" && data.metadata !== null
+            ? data.metadata
+            : {};
+        const rawType = stringField(metadata, "type") || stringField(data, "type");
+        memories.push({
+            file,
+            path: text.path,
+            name: stringField(data, "name") || file.replace(/\.md$/, ""),
+            description: stringField(data, "description"),
+            type: TYPES.includes(rawType) ? rawType : "unknown",
+            body,
+            mtime: text.mtime,
+            bytes: text.bytes,
+            revision: revisionOf(text.text),
+            inIndex: indexFile ? indexMentions(indexFile.text, file) : false,
+            hash: shortHash(body.trim()),
+            links: wikiLinks(body),
+            brokenLinks: [],
+            linkedFrom: [],
+        });
+    }
+    const names = new Set(memories.map((m) => m.name));
+    for (const memory of memories) {
+        memory.brokenLinks = memory.links.filter((link) => !names.has(link));
+        for (const link of memory.links) {
+            const target = memories.find((m) => m.name === link);
+            if (target && target !== memory && !target.linkedFrom.includes(memory.name))
+                target.linkedFrom.push(memory.name);
+        }
+    }
+    return {
+        dir,
+        loaded: true,
+        projectPath,
+        index: indexFile ? summarizeIndex(indexFile, files) : null,
+        memories,
+    };
+}
+function summarizeIndex(file, files) {
+    // A file's last newline ends its last line; it does not start another one.
+    const lines = file.text.replace(/\n$/, "").split("\n");
+    let loadedLines = 0;
+    let bytes = 0;
+    for (const line of lines) {
+        bytes += Buffer.byteLength(line, "utf8") + 1;
+        if (loadedLines >= INDEX_LINE_LIMIT || bytes > INDEX_BYTE_LIMIT)
+            break;
+        loadedLines++;
+    }
+    return {
+        ...file,
+        revision: revisionOf(file.text),
+        truncated: loadedLines < lines.length,
+        loadedLines,
+        missingFiles: [...new Set(file.text.split("\n").flatMap((l) => deadLinks(l, files)))],
+    };
+}
+/** Memory files an index line links to that are not in the store. */
+export function deadLinks(line, files) {
+    return [...line.matchAll(/\]\(([^)\s/\\]+\.md)\)/g)]
+        .map((m) => m[1] ?? "")
+        .filter((f) => !files.includes(f));
+}
+/** Whether MEMORY.md text points at a memory file, as a Markdown link or a [[name]] link. */
+export function indexMentions(index, file) {
+    return index.includes(`(${file})`) || index.includes(`[[${file.replace(/\.md$/, "")}]]`);
+}
+function wikiLinks(body) {
+    return [...new Set([...body.matchAll(/\[\[([^\]\n|]+)\]\]/g)].map((m) => (m[1] ?? "").trim()))];
+}

package/dist/server/scan/path-test.js

@@ -0,0 +1,121 @@
+import { dirname, isAbsolute, join, matchesGlob, relative, resolve, sep } from "node:path";
+import {} from "../../shared/types.js";
+import {} from "./env.js";
+import { isFile, isWithin, listDir, parseFrontmatter, readTextFile, stringsIn, toStringList, walkMarkdown, } from "./files.js";
+import { scanDirectory } from "./index.js";
+import { applySkillOverrides, readSkill } from "./inventory.js";
+/** Globs are written with forward slashes on every platform. */
+function slashed(path) {
+    return path.split(sep).join("/");
+}
+function firstMatch(globs, path) {
+    return globs.find((glob) => {
+        try {
+            return matchesGlob(path, glob);
+        }
+        catch {
+            // An invalid pattern matches nothing; the others still count (docs: memory#path-specific-rules).
+            return false;
+        }
+    });
+}
+/**
+ * What Claude Code adds to context once Claude reads or edits `file` in a session started in `dir`:
+ * path-scoped rules, skills with matching `paths`, and CLAUDE.md files in the folders between.
+ */
+export async function testPath(env, dir, file, 
+/** The view of the start directory; a server passes one that reuses a current scan. */
+viewOf = (cwd) => scanDirectory(env, cwd)) {
+    const cwd = resolve(dir);
+    const target = isAbsolute(file) ? resolve(file) : resolve(cwd, file);
+    if (target === cwd || !isWithin(cwd, target))
+        return { file: target, inside: false, exists: false, matches: [] };
+    const view = await viewOf(cwd);
+    const projectRoot = view.gitRoot ?? cwd;
+    const matches = [];
+    const excludes = stringsIn(view.effective.find((e) => e.key === "claudeMdExcludes")?.value);
+    const overrides = view.effective.find((e) => e.key === "skillOverrides")?.value;
+    const excluded = (path) => excludes.some((glob) => firstMatch([glob], path) !== undefined);
+    // Path rules Claude Code would use at all: not excluded, not waiting for approval.
+    for (const rule of view.instructions) {
+        if (!rule.paths || rule.status !== "on-match")
+            continue;
+        // A project rule's globs are relative to the folder holding its .claude; others to the project.
+        const base = rule.scope === "project" || rule.scope === "local" ? rule.dir : projectRoot;
+        const glob = firstMatch(rule.paths, slashed(relative(base, target)));
+        if (glob)
+            matches.push({ kind: "rule", path: rule.path, scope: rule.scope, glob });
+    }
+    // Folders below the start directory load their own instructions, rules and skills on demand.
+    const mode = view.agentsMdMode;
+    const startSkills = new Set(view.inventory.skills.filter((s) => s.scope !== "plugin").map((s) => s.name));
+    const between = [];
+    for (let d = dirname(target); d !== cwd && isWithin(cwd, d); d = dirname(d))
+        between.unshift(d);
+    for (const folder of between) {
+        const nested = async (name, scope) => {
+            const path = join(folder, name);
+            if (excluded(path) || !(await readTextFile(env, path)))
+                return false;
+            matches.push({ kind: "nested", path, scope });
+            return true;
+        };
+        // managed-only leaves out files at launch, but a subfolder's CLAUDE.md and rules still load
+        // on demand (docs: memory#choose-which-instruction-files-load).
+        let hasClaudeMd = false;
+        for (const name of ["CLAUDE.md", ".claude/CLAUDE.md"])
+            if (await nested(name, "project"))
+                hasClaudeMd = true;
+        if (mode !== "managed-only" && (await nested("CLAUDE.local.md", "local")))
+            hasClaudeMd = true;
+        const agents = mode === "claude-md-and-agents-md" || (mode === "claude-md-or-agents-md" && !hasClaudeMd);
+        if (agents)
+            await nested("AGENTS.md", "project");
+        for (const path of await walkMarkdown(join(folder, ".claude", "rules"))) {
+            const text = await readTextFile(env, path);
+            if (!text || excluded(path))
+                continue;
+            const globs = toStringList(parseFrontmatter(text.text).data.paths);
+            const glob = globs.length === 0 ? undefined : firstMatch(globs, slashed(relative(folder, target)));
+            if (globs.length === 0 || glob)
+                matches.push({ kind: "nested", path, scope: "project", ...(glob ? { glob } : {}) });
+        }
+        // Only skills Claude may pick itself: not off, user-invocable-only or disable-model-invocation;
+        // one with paths only for a matching file, its globs read from its folder like a rule's.
+        for (const name of await listDir(join(folder, ".claude", "skills"))) {
+            const skill = await readSkill(env, join(folder, ".claude", "skills", name), "project");
+            if (!skill)
+                continue;
+            applySkillOverrides([skill], overrides);
+            if (skill.listed === false)
+                continue;
+            const glob = skill.paths && firstMatch(skill.paths, slashed(relative(folder, target)));
+            if (skill.paths && !glob)
+                continue;
+            // A nested skill whose folder name another skill has is called by its folder as well, as
+            // apps/web:deploy (docs: skills#how-a-skill-gets-its-command-name).
+            matches.push({
+                kind: "skill",
+                path: skill.path,
+                scope: "project",
+                name: startSkills.has(name) ? `${slashed(relative(cwd, folder))}:${name}` : skill.name,
+                ...(glob ? { glob } : {}),
+            });
+        }
+    }
+    // Skills Claude can pick on its own; one with disable-model-invocation only runs when you call it.
+    for (const skill of view.inventory.skills) {
+        if (!skill.paths || skill.listed === false || skill.shadowedBy)
+            continue;
+        const glob = firstMatch(skill.paths, slashed(relative(projectRoot, target)));
+        if (glob)
+            matches.push({
+                kind: "skill",
+                path: skill.path,
+                scope: skill.scope,
+                glob,
+                name: skill.id ?? skill.name,
+            });
+    }
+    return { file: target, inside: true, exists: await isFile(target), matches };
+}

package/dist/server/scan/permissions.js

@@ -0,0 +1,101 @@
+import { HIGHEST_FIRST } from "../../shared/scopes.js";
+import {} from "../../shared/types.js";
+import { isRecord, stringsIn } from "./files.js";
+import { ignoredModeReason } from "./settings.js";
+/**
+ * Whether a file's trust-gated settings (permission grants, autoMemoryDirectory) wait for
+ * the workspace trust dialog. Claude Code runs git to tell a private local file from a committed one
+ * only once the folder or a parent is trusted, or in claude -p and the SDK, which count as accepted;
+ * until then the local file waits too, except in your configuration home. A committed local file
+ * waits like project settings, which -p and the SDK never apply in a folder you have not trusted
+ * (docs: permissions#when-your-local-settings-file-needs-trust, #what-runs-before-you-trust-a-folder).
+ */
+export function trustWaits({ trust, inConfigHome, localFromRepository, profile, }) {
+    const gitChecked = profile === "print" || trust.inheritedFrom !== undefined;
+    const localWaits = !inConfigHome && !trust.trusted && (!gitChecked || localFromRepository);
+    return (scope) => (scope === "project" && !trust.trusted) || (scope === "local" && localWaits);
+}
+/**
+ * An MCP rule with a parameter, which Claude Code skips when it reads a settings file; such a rule
+ * works only from --disallowedTools (docs: permissions#match-specific-tool-uses).
+ */
+export function isSkippedMcpRule(rule) {
+    return /^mcp__[^(]*\(/.test(rule);
+}
+/** Claude Code checks every file's rules together: deny, then ask, then allow (docs: permissions). */
+export const CHECK_ORDER = ["deny", "ask", "allow"];
+/**
+ * Every permission entry from every settings file, each marked with whether Claude Code applies it
+ * (docs: permissions#project-allow-rules-and-workspace-trust, settings-reference#permissions-defaultmode,
+ * #allowmanagedpermissionrulesonly).
+ */
+export function permissionsOf(layers, options) {
+    const sources = HIGHEST_FIRST.flatMap((scope) => layers
+        .filter((l) => l.scope === scope && isRecord(l.data?.permissions))
+        .map((l) => ({
+        scope,
+        path: l.path,
+        permissions: l.data?.permissions,
+    })));
+    const managedOnly = layers.some((l) => l.scope === "managed" && l.data?.allowManagedPermissionRulesOnly === true);
+    // Grants from repository files wait for the workspace trust dialog; deny and ask apply at once.
+    const waitsForTrust = trustWaits(options);
+    const notTrusted = "Waits until you trust this folder in Claude Code";
+    const rules = sources.flatMap(({ scope, path, permissions }) => CHECK_ORDER.flatMap((list) => stringsIn(permissions[list]).map((rule) => {
+        const base = { kind: "rule", list, rule, scope, path };
+        if (isSkippedMcpRule(rule))
+            return {
+                ...base,
+                inEffect: false,
+                note: "Claude Code skips an MCP rule with parentheses in a settings file; pass it with --disallowedTools",
+            };
+        if (managedOnly && scope !== "managed")
+            return {
+                ...base,
+                inEffect: false,
+                note: "Managed settings allow only their own permission rules",
+            };
+        if (list === "allow" && waitsForTrust(scope))
+            return { ...base, inEffect: false, note: notTrusted };
+        return { ...base, inEffect: true };
+    })));
+    for (const r of rules) {
+        if (!r.inEffect)
+            continue;
+        const first = CHECK_ORDER.map((list) => rules.find((o) => o.inEffect && o.list === list && o.rule === r.rule)).find((o) => o !== undefined);
+        if (first && first.list !== r.list)
+            r.decidedBy = { list: first.list, scope: first.scope };
+    }
+    const out = [...rules];
+    let modeTaken = false;
+    for (const { scope, permissions } of sources) {
+        const mode = permissions.defaultMode;
+        if (typeof mode !== "string")
+            continue;
+        let note = ignoredModeReason(scope, mode);
+        if (!note && modeTaken)
+            note = "A higher settings file sets the default mode";
+        out.push({
+            kind: "defaultMode",
+            value: mode,
+            scope,
+            inEffect: !note,
+            ...(note ? { note } : {}),
+        });
+        if (!note)
+            modeTaken = true;
+    }
+    for (const { scope, permissions } of sources) {
+        for (const dir of stringsIn(permissions.additionalDirectories)) {
+            const note = waitsForTrust(scope) ? notTrusted : undefined;
+            out.push({
+                kind: "additionalDirectories",
+                value: dir,
+                scope,
+                inEffect: !note,
+                ...(note ? { note } : {}),
+            });
+        }
+    }
+    return out;
+}