ccdesk 0.1.0 → 0.2.1

package/dist/server/scan/path-test.js

@@ -23,12 +23,14 @@ function firstMatch(globs, path) {
  * What Claude Code adds to context once Claude reads or edits `file` in a session started in `dir`:
  * path-scoped rules, skills with matching `paths`, and CLAUDE.md files in the folders between.
  */
-export async function testPath(env, dir, file) {
+export async function testPath(env, dir, file, 
+/** The view of the start directory; a server passes one that reuses a current scan. */
+viewOf = (cwd) => scanDirectory(env, cwd)) {
     const cwd = resolve(dir);
     const target = isAbsolute(file) ? resolve(file) : resolve(cwd, file);
     if (target === cwd || !isWithin(cwd, target))
         return { file: target, inside: false, exists: false, matches: [] };
-    const view = await scanDirectory(env, cwd);
+    const view = await viewOf(cwd);
     const projectRoot = view.gitRoot ?? cwd;
     const matches = [];
     const excludes = stringsIn(view.effective.find((e) => e.key === "claudeMdExcludes")?.value);
@@ -46,13 +48,14 @@ export async function testPath(env, dir, file) {
     }
     // Folders below the start directory load their own instructions, rules and skills on demand.
     const mode = view.agentsMdMode;
+    const startSkills = new Set(view.inventory.skills.filter((s) => s.scope !== "plugin").map((s) => s.name));
     const between = [];
     for (let d = dirname(target); d !== cwd && isWithin(cwd, d); d = dirname(d))
         between.unshift(d);
     for (const folder of between) {
         const nested = async (name, scope) => {
             const path = join(folder, name);
-            if (excluded(path) || !(await readTextFile(path)))
+            if (excluded(path) || !(await readTextFile(env, path)))
                 return false;
             matches.push({ kind: "nested", path, scope });
             return true;
@@ -69,7 +72,7 @@ export async function testPath(env, dir, file) {
         if (agents)
             await nested("AGENTS.md", "project");
         for (const path of await walkMarkdown(join(folder, ".claude", "rules"))) {
-            const text = await readTextFile(path);
+            const text = await readTextFile(env, path);
             if (!text || excluded(path))
                 continue;
             const globs = toStringList(parseFrontmatter(text.text).data.paths);
@@ -77,23 +80,42 @@ export async function testPath(env, dir, file) {
             if (globs.length === 0 || glob)
                 matches.push({ kind: "nested", path, scope: "project", ...(glob ? { glob } : {}) });
         }
-        // Only skills Claude may pick itself: not off, user-invocable-only or disable-model-invocation.
+        // Only skills Claude may pick itself: not off, user-invocable-only or disable-model-invocation;
+        // one with paths only for a matching file, its globs read from its folder like a rule's.
         for (const name of await listDir(join(folder, ".claude", "skills"))) {
-            const skill = await readSkill(join(folder, ".claude", "skills", name), "project");
+            const skill = await readSkill(env, join(folder, ".claude", "skills", name), "project");
             if (!skill)
                 continue;
             applySkillOverrides([skill], overrides);
-            if (skill.listed !== false)
-                matches.push({ kind: "skill", path: skill.path, scope: "project", name: skill.name });
+            if (skill.listed === false)
+                continue;
+            const glob = skill.paths && firstMatch(skill.paths, slashed(relative(folder, target)));
+            if (skill.paths && !glob)
+                continue;
+            // A nested skill whose folder name another skill has is called by its folder as well, as
+            // apps/web:deploy (docs: skills#how-a-skill-gets-its-command-name).
+            matches.push({
+                kind: "skill",
+                path: skill.path,
+                scope: "project",
+                name: startSkills.has(name) ? `${slashed(relative(cwd, folder))}:${name}` : skill.name,
+                ...(glob ? { glob } : {}),
+            });
         }
     }
     // Skills Claude can pick on its own; one with disable-model-invocation only runs when you call it.
     for (const skill of view.inventory.skills) {
-        if (!skill.paths || skill.listed === false)
+        if (!skill.paths || skill.listed === false || skill.shadowedBy)
             continue;
         const glob = firstMatch(skill.paths, slashed(relative(projectRoot, target)));
         if (glob)
-            matches.push({ kind: "skill", path: skill.path, scope: skill.scope, glob, name: skill.name });
+            matches.push({
+                kind: "skill",
+                path: skill.path,
+                scope: skill.scope,
+                glob,
+                name: skill.id ?? skill.name,
+            });
     }
     return { file: target, inside: true, exists: await isFile(target), matches };
 }

package/dist/server/scan/permissions.js

@@ -3,17 +3,27 @@ import {} from "../../shared/types.js";
 import { isRecord, stringsIn } from "./files.js";
 import { ignoredModeReason } from "./settings.js";
 /**
- * Whether a file's trust-gated settings (permission grants, hooks, autoMemoryDirectory) wait for
+ * Whether a file's trust-gated settings (permission grants, autoMemoryDirectory) wait for
  * the workspace trust dialog. Claude Code runs git to tell a private local file from a committed one
- * only once the folder or a parent is trusted, so until then the local file waits too, except in
- * your configuration home; a committed local file waits like project settings.
+ * only once the folder or a parent is trusted, or in claude -p and the SDK, which count as accepted;
+ * until then the local file waits too, except in your configuration home. A committed local file
+ * waits like project settings, which -p and the SDK never apply in a folder you have not trusted
+ * (docs: permissions#when-your-local-settings-file-needs-trust, #what-runs-before-you-trust-a-folder).
  */
-export function trustWaits({ trust, inConfigHome, localFromRepository, }) {
-    const localWaits = !inConfigHome && (trust.trusted ? false : !trust.inheritedFrom || localFromRepository);
+export function trustWaits({ trust, inConfigHome, localFromRepository, profile, }) {
+    const gitChecked = profile === "print" || trust.inheritedFrom !== undefined;
+    const localWaits = !inConfigHome && !trust.trusted && (!gitChecked || localFromRepository);
     return (scope) => (scope === "project" && !trust.trusted) || (scope === "local" && localWaits);
 }
+/**
+ * An MCP rule with a parameter, which Claude Code skips when it reads a settings file; such a rule
+ * works only from --disallowedTools (docs: permissions#match-specific-tool-uses).
+ */
+export function isSkippedMcpRule(rule) {
+    return /^mcp__[^(]*\(/.test(rule);
+}
 /** Claude Code checks every file's rules together: deny, then ask, then allow (docs: permissions). */
-const CHECK_ORDER = ["deny", "ask", "allow"];
+export const CHECK_ORDER = ["deny", "ask", "allow"];
 /**
  * Every permission entry from every settings file, each marked with whether Claude Code applies it
  * (docs: permissions#project-allow-rules-and-workspace-trust, settings-reference#permissions-defaultmode,
@@ -33,6 +43,12 @@ export function permissionsOf(layers, options) {
     const notTrusted = "Waits until you trust this folder in Claude Code";
     const rules = sources.flatMap(({ scope, path, permissions }) => CHECK_ORDER.flatMap((list) => stringsIn(permissions[list]).map((rule) => {
         const base = { kind: "rule", list, rule, scope, path };
+        if (isSkippedMcpRule(rule))
+            return {
+                ...base,
+                inEffect: false,
+                note: "Claude Code skips an MCP rule with parentheses in a settings file; pass it with --disallowedTools",
+            };
         if (managedOnly && scope !== "managed")
             return {
                 ...base,

package/dist/server/scan/plugins.js

@@ -6,13 +6,20 @@ import { isRecord, isWithin, readJsonObject, resolvedPath, stringField } from ".
 function manifestPath(plugin) {
     return join(plugin.installPath, ".claude-plugin", "plugin.json");
 }
-async function manifest(plugin) {
-    const result = await readJsonObject(manifestPath(plugin));
+async function manifest(env, plugin) {
+    const result = await readJsonObject(env, manifestPath(plugin));
     return result.ok ? result.data : {};
 }
+/**
+ * The prefix of a plugin's skills, commands and agents: the manifest's name, which wins over the
+ * name the plugin is enabled under (docs: plugins-reference#name, #metadata-precedence).
+ */
+export async function pluginNamespace(env, plugin) {
+    return stringField(await manifest(env, plugin), "name") || (plugin.id.split("@")[0] ?? plugin.id);
+}
 /** Installed plugins that apply in `projectDir`, with whether each is enabled and by which file. */
 export async function readPlugins(env, layers, projectDir, gitRoot) {
-    const installed = await readJsonObject(join(env.claudeDir, "plugins", "installed_plugins.json"));
+    const installed = await readJsonObject(env, join(env.claudeDir, "plugins", "installed_plugins.json"));
     if (!installed.ok || !isRecord(installed.data.plugins))
         return [];
     const out = [];
@@ -46,7 +53,7 @@ export async function readPlugins(env, layers, projectDir, gitRoot) {
             plugin.note = `${plugin.enabled ? "Enabled" : "Turned off"} in ${setting.scope} settings`;
         }
         else {
-            plugin.enabled = (await manifest(plugin)).defaultEnabled !== false;
+            plugin.enabled = (await manifest(env, plugin)).defaultEnabled !== false;
             plugin.note = plugin.enabled
                 ? "On by default (no enabledPlugins entry)"
                 : "Off by default (no enabledPlugins entry)";
@@ -62,8 +69,8 @@ async function inside(plugin, path) {
     return isWithin(root, await resolvedPath(target)) ? target : null;
 }
 /** The paths a manifest key names (one path or a list), inside the plugin; null when unset. */
-export async function manifestPaths(plugin, key) {
-    const value = (await manifest(plugin))[key];
+export async function manifestPaths(env, plugin, key) {
+    const value = (await manifest(env, plugin))[key];
     const list = typeof value === "string" ? [value] : Array.isArray(value) ? value : null;
     if (!list)
         return null;
@@ -78,8 +85,8 @@ export async function manifestPaths(plugin, key) {
     return out;
 }
 /** The value of a manifest key that is a path, an inline object, or a list of either. */
-export async function manifestConfigs(plugin, key) {
-    const value = (await manifest(plugin))[key];
+export async function manifestConfigs(env, plugin, key) {
+    const value = (await manifest(env, plugin))[key];
     const out = [];
     for (const item of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
         if (isRecord(item))
@@ -87,15 +94,15 @@ export async function manifestConfigs(plugin, key) {
         if (typeof item !== "string")
             continue;
         const path = await inside(plugin, item);
-        const file = path ? await readJsonObject(path) : null;
+        const file = path ? await readJsonObject(env, path) : null;
         if (path && file?.ok)
             out.push({ value: file.data[key] ?? file.data, path });
     }
     return out;
 }
 /** The manifest's `commands` object form: command name to a file or inline content. */
-export async function manifestCommandMap(plugin) {
-    const value = (await manifest(plugin)).commands;
+export async function manifestCommandMap(env, plugin) {
+    const value = (await manifest(env, plugin)).commands;
     if (!isRecord(value))
         return [];
     const out = [];

package/dist/server/scan/projects.js

@@ -2,10 +2,11 @@ import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { createInterface } from "node:readline";
+import { storeDirName } from "../../shared/memory.js";
 import {} from "../../shared/types.js";
 import {} from "./env.js";
-import { isDir, isRecord, leadsToSecret, listDir } from "./files.js";
-import { readMemoryStore, storeDirName } from "./memory.js";
+import { isCredentials, isDir, isRecord, listDir } from "./files.js";
+import { readMemoryStore } from "./memory.js";
 /** Directories Claude Code has been used in: its project stores, `~/.claude.json`, and the launch directory. */
 export async function listProjects(env, claudeJson, launchDir) {
     const byPath = new Map();
@@ -17,11 +18,11 @@ export async function listProjects(env, claudeJson, launchDir) {
             continue;
         const sessions = await newestFirst(storeDir, (await listDir(storeDir)).filter((f) => f.endsWith(".jsonl")));
         const path = knownPaths.find((p) => storeDirName(p) === name) ??
-            (await sessionCwd(storeDir, sessions)) ??
+            (await sessionCwd(env, storeDir, sessions)) ??
             null;
         if (!path)
             continue;
-        const store = await readMemoryStore(join(storeDir, "memory"), path);
+        const store = await readMemoryStore(env, join(storeDir, "memory"), path);
         byPath.set(path, {
             path,
             store,
@@ -70,9 +71,9 @@ async function newestFirst(dir, files) {
     return out.sort((a, b) => b.mtime - a.mtime);
 }
 /** The `cwd` recorded in the newest transcripts, for store names that do not map back cleanly. */
-async function sessionCwd(storeDir, sessions) {
+async function sessionCwd(env, storeDir, sessions) {
     for (const { file } of sessions.slice(0, 3)) {
-        if (await leadsToSecret(join(storeDir, file)))
+        if (await isCredentials(env, join(storeDir, file)))
             continue;
         const input = createReadStream(join(storeDir, file), { encoding: "utf8" });
         const lines = createInterface({ input });

package/dist/server/scan/sandbox.js

@@ -0,0 +1,161 @@
+import {} from "../../shared/types.js";
+import { isRecord, stringsIn } from "./files.js";
+const REPOSITORY = ["project", "local"];
+const NOT_MANAGED = ["user", "project", "local"];
+function at(value, path) {
+    return path.reduce((o, k) => (isRecord(o) ? o[k] : undefined), value);
+}
+function nested(path, leaf) {
+    return path.reduceRight((acc, k) => ({ [k]: acc }), leaf);
+}
+/**
+ * `value` with the field at `path` set to `leaf`, or removed when `leaf` is undefined, along with
+ * any object that removal leaves empty.
+ */
+function replaced(value, path, leaf) {
+    const [head, ...rest] = path;
+    if (head === undefined)
+        return value;
+    const out = { ...value };
+    const child = out[head];
+    if (rest.length > 0 && !isRecord(child))
+        return value;
+    const next = isRecord(child) && rest.length > 0 ? replaced(child, rest, leaf) : leaf;
+    if (next === undefined || (isRecord(next) && Object.keys(next).length === 0))
+        delete out[head];
+    else
+        out[head] = next;
+    return out;
+}
+/**
+ * Which `sandbox` fields Claude Code ignores from which files, given every file's `sandbox` and
+ * `permissions` values (docs: settings-reference#sandbox-settings, sandboxing#keep-developers-from-widening-the-policy).
+ * Locks that depend on paths, such as allowRead entries under a path that managed settings deny
+ * reading, and anything the --settings flag sets, are not modelled.
+ */
+function rulesFor(valueIn) {
+    const managed = valueIn("sandbox", "managed");
+    const user = valueIn("sandbox", "user");
+    const managedSays = (path, value) => at(managed, path.split(".")) === value;
+    const rules = [];
+    const add = (fields, from, reason, drops) => {
+        for (const field of fields)
+            rules.push({ field, from, reason, ...(drops ? { drops } : {}) });
+    };
+    // Keys read from fewer files (docs: settings-reference, each key's Scope).
+    for (const field of [
+        "filesystem.allowManagedReadPathsOnly",
+        "network.allowManagedDomainsOnly",
+        "bwrapPath",
+        "socatPath",
+    ])
+        add([field], NOT_MANAGED, `Claude Code reads sandbox.${field} only from managed settings`);
+    for (const field of [
+        "allowAppleEvents",
+        "ripgrep",
+        "credentials.allowPlaintextInject",
+        "credentials.awsPairs",
+        "credentials.sigv4",
+        "network.strictAllowlist",
+        "network.tlsTerminate",
+    ])
+        add([field], REPOSITORY, `Claude Code reads sandbox.${field} only from user or managed settings`);
+    // docs: sandboxing#which-settings-can-disable-it
+    const managedFiles = at(managed, ["credentials", "files"]);
+    const filesystemLocked = isRecord(at(managed, ["filesystem"])) ||
+        (Array.isArray(managedFiles) && managedFiles.some((f) => isRecord(f) && f.mode === "deny"));
+    add(["filesystem.disabled"], filesystemLocked ? NOT_MANAGED : REPOSITORY, filesystemLocked
+        ? "Managed settings configure the sandbox filesystem, so only they can turn it off"
+        : "Claude Code reads sandbox.filesystem.disabled only from user or managed settings");
+    add(["credentials.files", "credentials.envVars"], REPOSITORY, "Claude Code drops mask entries from repository settings", { entries: (e) => isRecord(e) && e.mode === "mask" });
+    // docs: sandboxing#turn-off-the-retry-with-strict-sandbox-mode
+    if (managedSays("allowUnsandboxedCommands", false) ||
+        at(user, ["allowUnsandboxedCommands"]) === false)
+        add(["allowUnsandboxedCommands"], REPOSITORY, "A false in user or managed settings holds against a repository's true", { value: true });
+    // Managed-only locks (docs: sandboxing#keep-developers-from-widening-the-policy).
+    if (managedSays("filesystem.allowManagedReadPathsOnly", true))
+        add(["filesystem.allowRead"], NOT_MANAGED, "Managed settings honor only their own allowRead entries (allowManagedReadPathsOnly)");
+    const domainsLocked = managedSays("network.allowManagedDomainsOnly", true);
+    if (domainsLocked)
+        add(["network.allowedDomains", "network.httpProxyPort", "network.socksProxyPort"], NOT_MANAGED, "Managed settings honor only their own domains and proxy ports (allowManagedDomainsOnly)");
+    // docs: sandboxing#repository-settings-under-an-admin-required-sandbox
+    if (managedSays("allowUnsandboxedCommands", false) || domainsLocked) {
+        const reason = "Managed settings require the sandbox, so Claude Code ignores repository settings that loosen it";
+        add([
+            "excludedCommands",
+            "ignoreViolations",
+            "network.allowedDomains",
+            "network.allowUnixSockets",
+            "network.allowMachLookup",
+            "network.httpProxyPort",
+            "network.socksProxyPort",
+            "filesystem.allowWrite",
+        ], REPOSITORY, reason);
+        add([
+            "enableWeakerNestedSandbox",
+            "enableWeakerNetworkIsolation",
+            "network.allowAllUnixSockets",
+            "network.allowLocalBinding",
+        ], REPOSITORY, reason, { value: true });
+        for (const field of ["enabled", "failIfUnavailable"])
+            if (at(user, [field]) === true)
+                add([field], REPOSITORY, reason, { value: false });
+    }
+    // docs: sandboxing#locks-that-apply-without-an-admin-required-sandbox
+    const managedDeny = stringsIn(at(valueIn("permissions", "managed"), ["deny"]));
+    if (stringsIn(at(managed, ["network", "deniedDomains"])).length > 0 ||
+        managedDeny.some((rule) => rule.startsWith("WebFetch(domain:")))
+        add(["network.httpProxyPort", "network.socksProxyPort"], REPOSITORY, "Managed settings deny domains, so a repository cannot set a proxy port");
+    const strictAllowlist = at(managed, ["network", "strictAllowlist"]) ?? at(user, ["network", "strictAllowlist"]);
+    if (strictAllowlist === true)
+        add(["network.allowedDomains", "network.httpProxyPort", "network.socksProxyPort"], REPOSITORY, "strictAllowlist is on, so Claude Code ignores a repository's domains and proxy ports");
+    // While the block covers sandboxed commands, repository allowRead and allowWrite entries do not
+    // count; it does not when filesystem isolation is off or allowManagedReadPathsOnly is set
+    // (docs: settings-reference#sandboxed-commands-under-the-block).
+    const blocked = ["user", "project", "local", "managed"].some((s) => at(valueIn("permissions", s), ["blockReadsOutsideWorkingDirectories"]) === true);
+    const filesystemOff = (filesystemLocked ? [managed] : [managed, user])
+        .map((v) => at(v, ["filesystem", "disabled"]))
+        .find((v) => v !== undefined) === true;
+    if (blocked && !filesystemOff && !managedSays("filesystem.allowManagedReadPathsOnly", true))
+        add(["filesystem.allowRead", "filesystem.allowWrite"], REPOSITORY, "blockReadsOutsideWorkingDirectories is on, so repository allowRead and allowWrite entries do not count");
+    return rules;
+}
+/**
+ * A filter for each file's `sandbox` value: what is left once the fields Claude Code ignores from
+ * that file are taken out, and what was taken out.
+ */
+export function sandboxFilter(valueIn) {
+    const rules = rulesFor(valueIn);
+    return (scope, value) => {
+        if (!isRecord(value))
+            return { value, dropped: [] };
+        let out = value;
+        const dropped = [];
+        for (const rule of rules) {
+            if (!rule.from.includes(scope))
+                continue;
+            const path = rule.field.split(".");
+            const field = at(out, path);
+            if (field === undefined)
+                continue;
+            const drops = rule.drops;
+            let removed = field;
+            let kept;
+            if (drops && "value" in drops) {
+                if (field !== drops.value)
+                    continue;
+            }
+            else if (drops) {
+                if (!Array.isArray(field))
+                    continue;
+                removed = field.filter(drops.entries);
+                if (removed.length === 0)
+                    continue;
+                kept = field.filter((e) => !drops.entries(e));
+            }
+            out = replaced(out, path, kept);
+            dropped.push({ value: nested(path, removed), reason: rule.reason });
+        }
+        return { value: out, dropped };
+    };
+}

package/dist/server/scan/settings.js

@@ -1,28 +1,28 @@
 import { lstat } from "node:fs/promises";
 import { join } from "node:path";
-import { allowedScopes, ignoredReason } from "../../shared/scopes.js";
+import { allowedScopes, EVERY_FILE, ignoredReason } from "../../shared/scopes.js";
 import {} from "../../shared/types.js";
 import {} from "./env.js";
 import { isRecord, listDir, mainWorktreeRoot, readJsonObject, redactSecrets } from "./files.js";
+import { sandboxFilter } from "./sandbox.js";
 /** Lowest precedence first, so later layers override earlier ones. */
 const PRECEDENCE = ["user", "project", "local", "managed"];
 /** Keys whose whole value comes from the highest layer that sets it, even though they are lists. */
 const WHOLE_VALUE_KEYS = new Set(["fallbackModel", "modelPicker"]);
 /** Maps whose entries are taken whole from the highest layer that has them, never field by field. */
 const WHOLE_ENTRY_KEYS = new Set(["managedMcpServers", "extraKnownMarketplaces", "modelSettings"]);
-const ANY_FILE = ["user", "project", "local", "managed"];
 /**
  * Keys, some nested, where Claude Code honours the more restrictive value from some files even over
  * a higher file (docs: settings#exceptions-to-managed-settings-precedence).
  */
 const STRICTEST = {
-    disableClaudeAiConnectors: { ladder: [false, true], from: ANY_FILE },
-    isolatePeerMachines: { ladder: [false, true], from: ANY_FILE },
-    enableArtifact: { ladder: [true, false], from: ANY_FILE },
-    disableArtifact: { ladder: [false, true], from: ANY_FILE },
-    "permissions.blockReadsOutsideWorkingDirectories": { ladder: [false, true], from: ANY_FILE },
+    disableClaudeAiConnectors: { ladder: [false, true], from: EVERY_FILE },
+    isolatePeerMachines: { ladder: [false, true], from: EVERY_FILE },
+    enableArtifact: { ladder: [true, false], from: EVERY_FILE },
+    disableArtifact: { ladder: [false, true], from: EVERY_FILE },
+    "permissions.blockReadsOutsideWorkingDirectories": { ladder: [false, true], from: EVERY_FILE },
     "autoMode.classifyAllShell": { ladder: [false, true], from: ["user"] },
-    maxEffortLevel: { ladder: ["max", "xhigh", "high", "medium", "low"], from: ANY_FILE },
+    maxEffortLevel: { ladder: ["max", "xhigh", "high", "medium", "low"], from: EVERY_FILE },
     useAutoModeDuringPlan: { ladder: [true, false], from: ["managed", "user", "local"] },
     syncClaudeAiSkills: { ladder: [true, false], from: ["managed", "user", "local"] },
     syncClaudeAiPlugins: { ladder: [true, false], from: ["managed", "user", "local"] },
@@ -44,14 +44,16 @@ export function ignoredModeReason(scope, mode) {
     return undefined;
 }
 /** A file's value for `key` without nested fields Claude Code ignores from that file, and what was dropped. */
-function withoutIgnoredFields(key, scope, value) {
+function withoutIgnoredFields(key, scope, value, filterSandbox) {
+    if (key === "sandbox")
+        return filterSandbox(scope, value);
     if (key !== "permissions" || !isRecord(value))
-        return { value };
+        return { value, dropped: [] };
     const reason = ignoredModeReason(scope, value.defaultMode);
     if (!reason)
-        return { value };
+        return { value, dropped: [] };
     const { defaultMode, ...rest } = value;
-    return { value: rest, dropped: { value: { defaultMode }, reason } };
+    return { value: rest, dropped: [{ value: { defaultMode }, reason }] };
 }
 /**
  * The value that wins for a key with a strictness exception, given its values lowest precedence
@@ -138,7 +140,7 @@ export async function readSettingsLayers(env, dir) {
             layers.push(await readManagedLayer(env, file.path));
             continue;
         }
-        const result = await readJsonObject(file.path);
+        const result = await readJsonObject(env, file.path);
         if (file.legacy && !result.ok && result.missing)
             continue;
         const layer = { scope: file.scope, path: file.path, exists: true, data: null };
@@ -166,21 +168,25 @@ export async function readManagedSettings(env) {
         .map((name) => join(dropInDir, name));
     const sources = [];
     const errors = [];
+    let blocksStart = false;
     let data = null;
     for (const source of [join(env.managedDir, "managed-settings.json"), ...dropIns]) {
-        const result = await readJsonObject(source);
+        // An empty managed file counts as {}.
+        const result = await readJsonObject(env, source, { emptyIsObject: true });
         if (!result.ok) {
             if (!result.missing)
                 errors.push(`${source}: ${result.error}`);
+            if (result.unparsed)
+                blocksStart = true;
             continue;
         }
         sources.push(source);
         data = data ? mergeSettings(data, result.data) : result.data;
     }
-    return { data, sources, dropIns, errors };
+    return { data, sources, dropIns, errors, blocksStart };
 }
 async function readManagedLayer(env, path) {
-    const { data, sources, dropIns, errors } = await readManagedSettings(env);
+    const { data, sources, dropIns, errors, blocksStart } = await readManagedSettings(env);
     const layer = { scope: "managed", path, exists: false, data: null };
     if (data)
         layer.data = redactSecrets(data);
@@ -189,6 +195,8 @@ async function readManagedLayer(env, path) {
         layer.sources = sources;
     if (errors.length > 0)
         layer.error = errors.join("; ");
+    if (blocksStart)
+        layer.blocksStart = true;
     return layer;
 }
 /** The value Claude Code ends up with for each top-level key, and where it came from. */
@@ -202,6 +210,7 @@ export function effectiveSettings(layers) {
         byScope.set(layer.scope, higher ? mergeSettings(layer.data, higher) : layer.data);
     }
     const keys = new Set([...byScope.values()].flatMap((data) => Object.keys(data)));
+    const filterSandbox = sandboxFilter((key, scope) => allowedScopes(key).includes(scope) ? byScope.get(scope)?.[key] : undefined);
     const out = [];
     for (const key of [...keys].sort()) {
         const allowed = allowedScopes(key);
@@ -226,9 +235,9 @@ export function effectiveSettings(layers) {
             continue;
         }
         const values = defined.map((scope) => {
-            const { value, dropped } = withoutIgnoredFields(key, scope, valueIn(scope));
-            if (dropped)
-                ignored.push({ scope, ...dropped });
+            const { value, dropped } = withoutIgnoredFields(key, scope, valueIn(scope), filterSandbox);
+            for (const d of dropped)
+                ignored.push({ scope, ...d });
             return { scope, value };
         });
         const top = values[values.length - 1];
@@ -240,12 +249,16 @@ export function effectiveSettings(layers) {
         const decided = strict && strictWinner(strict, values);
         if (strict && decided) {
             const { winner } = decided;
+            // Only files that may just tighten it set the key, and none tightens it past the default.
+            if (!winner)
+                for (const v of values)
+                    ignored.push({ ...v, reason: "it is not stricter than Claude Code's default" });
             out.push({
                 key,
                 value: winner?.value,
                 from: winner ? [winner.scope] : [],
                 merged: false,
-                overridden: values.filter((v) => v !== winner).reverse(),
+                overridden: winner ? values.filter((v) => v !== winner).reverse() : [],
                 ignored,
                 note: strictNote(strict),
             });

package/dist/server/scan/tools.js

@@ -1,6 +1,7 @@
 import table from "../../shared/builtin-tools.json" with { type: "json" };
 import {} from "../../shared/types.js";
 import { wildcard } from "./files.js";
+import { CHECK_ORDER } from "./permissions.js";
 /**
  * The other tools a rule for some uses covers: Bash rules apply to Monitor, Claude Code checks file
  * paths against Edit and Read rules only, and a Read deny also blocks Edit and Write on that path
@@ -49,7 +50,6 @@ function matcherCovers(matcher, name) {
         return false;
     }
 }
-const ORDER = ["deny", "ask", "allow"];
 /** Every built-in tool, with the rules and hooks that apply to it here. */
 export function builtinTools(permissions, hooks) {
     const rules = permissions.flatMap((p) => p.kind === "rule" && p.inEffect ? [{ list: p.list, rule: p.rule, scope: p.scope }] : []);
@@ -64,6 +64,10 @@ export function builtinTools(permissions, hooks) {
             if (specifier === null) {
                 if (namesTool(r.list, tool, name))
                     whole.push(r);
+                // Monitor's commands follow the Bash rules; its WebSocket watches do not
+                // (docs: tools-reference#monitor-tool).
+                else if (name === "Monitor" && namesTool(r.list, tool, "Bash"))
+                    scoped.push(r);
             }
             else if (tool === name && UNCHECKED_PATH_RULE_TOOLS.has(tool)) {
                 scoped.push({ ...r, unchecked: true });
@@ -71,7 +75,7 @@ export function builtinTools(permissions, hooks) {
             else if (tool === name || coveredTools(tool, r.list).includes(name))
                 scoped.push(r);
         }
-        const decidedBy = ORDER.map((list) => whole.find((r) => r.list === list)).find(Boolean);
+        const decidedBy = CHECK_ORDER.map((list) => whole.find((r) => r.list === list)).find(Boolean);
         const tool = {
             name,
             description,
@@ -79,7 +83,7 @@ export function builtinTools(permissions, hooks) {
             verdict: decidedBy
                 ? { deny: "denied", ask: "asks", allow: "allowed" }[decidedBy.list]
                 : "default",
-            scoped: scoped.sort((a, b) => ORDER.indexOf(a.list) - ORDER.indexOf(b.list)),
+            scoped: scoped.sort((a, b) => CHECK_ORDER.indexOf(a.list) - CHECK_ORDER.indexOf(b.list)),
             hooks: name === EXEMPT ? 0 : preToolUse.filter((h) => matcherCovers(h.matcher, name)).length,
         };
         if (decidedBy)