ccdesk 0.2.1 → 0.2.3

package/dist/{server → core}/scan/mcp.js

@@ -1,12 +1,14 @@
 import { join } from "node:path";
+import { Compile } from "typebox/compile";
 import {} from "../../shared/types.js";
+import { redactSecrets, shownUrl } from "../secrets.js";
 import { isConfigHome } from "./env.js";
-import { isRecord, readJsonObject, redactSecrets, shownUrl, stringField, stringsIn, wildcard, } from "./files.js";
+import { readJsonOrReport, stringField, stringsIn, wildcard } from "./files.js";
+import { isRecord } from "./data.js";
 import { manifestConfigs } from "./plugins.js";
 import serverSchema from "../../shared/mcp-server.schema.json" with { type: "json" };
-import { ajv, schemaErrors } from "../schema.js";
-import { readManagedSettings } from "./settings.js";
-const validateServer = ajv.compile(serverSchema);
+import { schemaErrors } from "../schema.js";
+const validateServer = Compile(serverSchema);
 /**
  * What makes a server definition one Claude Code cannot start: a missing command or url, a type it
  * does not know, or a field the docs define holding the wrong kind of value (docs: mcp). It checks
@@ -29,13 +31,20 @@ export function serverProblems(definition) {
         problems.push(`A ${type} server needs a "url".`);
     return [...problems, ...schemaErrors(validateServer, definition, "")];
 }
+/** What the page shows a server connects to: its URL, or its command line with values hidden. */
+function targetOf(url, command, definition) {
+    if (url)
+        return shownUrl(url);
+    if (!command)
+        return "";
+    return [command[0], ...stringsIn(definition.args)].join(" ");
+}
 function define(servers, scope, sourcePath, organisation = false) {
     if (!isRecord(servers))
         return [];
-    return Object.entries(servers)
-        .filter(([, config]) => isRecord(config))
-        .map(([name, config]) => {
-        const c = config;
+    return Object.entries(servers).flatMap(([name, c]) => {
+        if (!isRecord(c))
+            return [];
         const type = stringField(c, "type");
         const url = stringField(c, "url") || null;
         const command = stringField(c, "command")
@@ -47,11 +56,7 @@ function define(servers, scope, sourcePath, organisation = false) {
             scope,
             // An entry without a type is read as stdio, even one with a url (docs: mcp).
             transport: type || "stdio",
-            target: url
-                ? shownUrl(url)
-                : command
-                    ? [command[0], ...stringsIn(definition.args)].join(" ")
-                    : "",
+            target: targetOf(url, command, definition),
             sourcePath,
             status: "active",
             definition,
@@ -63,12 +68,14 @@ function define(servers, scope, sourcePath, organisation = false) {
         }
         // A ${VAR} in an organisation entry means it still has to pass the allowlist.
         const usesVariables = JSON.stringify(c).includes("${");
-        return {
-            server,
-            command: type && type !== "stdio" ? null : command,
-            url: type ? url : null,
-            organisation: organisation && !usesVariables,
-        };
+        return [
+            {
+                server,
+                command: type && type !== "stdio" ? null : command,
+                url: type ? url : null,
+                organisation: organisation && !usesVariables,
+            },
+        ];
     });
 }
 /** Control and invisible formatting characters, such as zero-width spaces and bidi overrides. */
@@ -108,6 +115,8 @@ function managedEntryProblem(name, config) {
 }
 /** managedMcpServers from managed settings, with entries Claude Code drops marked invalid. */
 function defineManaged(servers, sourcePath) {
+    if (!isRecord(servers))
+        return [];
     const defined = define(servers, "managed", sourcePath, true);
     for (const d of defined) {
         const problem = managedEntryProblem(d.server.name, servers[d.server.name]);
@@ -143,6 +152,10 @@ function policyEntries(value) {
             typeof e.serverUrl === "string"));
 }
 /** A `serverUrl` pattern (docs: managed-mcp#how-serverurl-entries-match). */
+const DEFAULT_PORTS = new Map([
+    ["https", "443"],
+    ["http", "80"],
+]);
 function urlMatches(pattern, url) {
     const p = /^([^:/]+):\/\/([^/:]+)(?::([^/]*))?(\/.*)?$/.exec(pattern);
     let u;
@@ -160,7 +173,7 @@ function urlMatches(pattern, url) {
         return false;
     if (!wildcard(host.replace(/\.$/, ""), "i").test(u.hostname.replace(/\.$/, "")))
         return false;
-    const actualPort = u.port || (scheme_ === "https" ? "443" : scheme_ === "http" ? "80" : "");
+    const actualPort = u.port || (DEFAULT_PORTS.get(scheme_) ?? "");
     // No port: a full hostname means the default port only, a wildcard hostname any port.
     if (port !== undefined) {
         if (!wildcard(port).test(actualPort))
@@ -191,64 +204,132 @@ function allowed(list, d) {
  * server is one that is configured and allowed, not one that is known to work.
  */
 export async function readMcpServers(input, plugins) {
-    const { env, projectDir, layers, claudeJson, trust, profile } = input;
+    const { env, layers, claudeJson, trust, profile, problems } = input;
     const projects = isRecord(claudeJson?.projects) ? claudeJson.projects : {};
     // Local servers live in the entry under the trust key, even from a subdirectory: claude mcp add
     // --scope local writes there and claude mcp list reads only that entry, ignoring one for the
     // subdirectory (observed with v2.1.296; the docs do not say).
     const entry = projects[trust.root];
     const project = isRecord(entry) ? entry : {};
-    const managed = layers.find((l) => l.scope === "managed");
-    // Checked as written: the layer has header values hidden, which would hide a ${VAR} in one.
-    const managedServers = (await readManagedSettings(env)).data?.managedMcpServers;
     const managedFile = join(env.managedDir, "managed-mcp.json");
-    const managedJson = await readJsonObject(env, managedFile);
-    const mcpJson = join(projectDir, ".mcp.json");
-    const shared = await readJsonObject(env, mcpJson);
+    const managedJson = await readJsonOrReport(env, managedFile, problems);
     const defined = [
-        ...(managedJson.ok ? define(managedJson.data.mcpServers, "managed", managedFile, true) : []),
-        ...defineManaged(managedServers, managed?.path ?? ""),
+        ...(await configuredServers(input, project, managedFile, managedJson)),
+        ...(await pluginServers(env, plugins, problems)),
+    ];
+    // A managed-mcp.json that does not parse is reported; ccdesk cannot tell which servers it lists,
+    // so it does not show it taking control.
+    const exclusive = managedJson !== null;
+    const policy = policyOf(layers);
+    const disabledHere = stringsIn(project.disabledMcpServers);
+    const answersFor = approvalAnswers(input, project);
+    const byName = new Map();
+    const enabledEndpoints = new Map();
+    for (const d of defined) {
+        const { server } = d;
+        if (server.status === "invalid")
+            continue;
+        if (exclusive && !d.organisation && server.scope !== "managed") {
+            set(server, "blocked", "managed-mcp.json takes exclusive control of MCP servers");
+            continue;
+        }
+        // Scopes dedupe by name; plugins by endpoint against the enabled servers above them.
+        const earlier = server.scope === "plugin" ? enabledEndpoints.get(endpoint(d)) : byName.get(server.name);
+        if (earlier) {
+            set(server, "shadowed", `The ${earlier.server.scope} definition of ${earlier.server.name} is used instead`);
+            continue;
+        }
+        if (server.scope !== "plugin")
+            byName.set(server.name, d);
+        const blocked = policy.blocks(d);
+        if (blocked)
+            set(server, "blocked", blocked);
+        else if (disabledHere.includes(server.name))
+            set(server, "disabled", "Turned off for this project in /mcp");
+        else if (server.scope === "project")
+            approve(server, answersFor(server.name), profile);
+        if (server.status === "active" || server.status === "pending")
+            enabledEndpoints.set(endpoint(d), d);
+    }
+    return defined.map((d) => d.server);
+}
+function set(server, status, note) {
+    server.status = status;
+    server.note = note;
+}
+/** The servers your settings, ~/.claude.json and the project define, in precedence order. */
+async function configuredServers(input, project, managedFile, managedJson) {
+    const { env, projectDir, layers, claudeJson, problems } = input;
+    const managed = layers.find((l) => l.scope === "managed");
+    const mcpJson = join(projectDir, ".mcp.json");
+    const shared = await readJsonOrReport(env, mcpJson, problems);
+    return [
+        ...(managedJson ? define(managedJson.mcpServers, "managed", managedFile, true) : []),
+        // Checked as written: the layer has header values hidden, which would hide a ${VAR} in one.
+        ...defineManaged(input.managed?.managedMcpServers, managed?.path ?? ""),
         ...define(project.mcpServers, "local", env.claudeJson),
-        ...(shared.ok ? define(shared.data.mcpServers, "project", mcpJson) : []),
+        ...(shared ? define(shared.mcpServers, "project", mcpJson) : []),
         ...define(claudeJson?.mcpServers, "user", env.claudeJson),
     ];
-    for (const plugin of plugins) {
+}
+/** The servers each enabled plugin brings, from its .mcp.json and its manifest. */
+async function pluginServers(env, plugins, problems) {
+    const defined = [];
+    for (const loaded of plugins) {
+        const { plugin } = loaded;
         const path = join(plugin.installPath, ".mcp.json");
-        const file = await readJsonObject(env, path);
+        const file = await readJsonOrReport(env, path, problems);
         // A server name declared later in the same plugin replaces an earlier one.
         const own = new Map();
         const add = (list) => {
             for (const d of list)
                 own.set(d.server.name, d);
         };
-        if (file.ok)
-            add(define(file.data.mcpServers ?? file.data, "plugin", path));
-        for (const part of await manifestConfigs(env, plugin, "mcpServers"))
+        if (file)
+            add(define(file.mcpServers ?? file, "plugin", path));
+        for (const part of await manifestConfigs(env, loaded, "mcpServers", problems))
             add(define(part.value, "plugin", part.path));
         for (const d of own.values())
             d.server.plugin = plugin.id;
         defined.push(...own.values());
     }
-    const exclusive = managedJson.ok;
+    return defined;
+}
+/** deniedMcpServers and allowedMcpServers across the settings: why a server is blocked, if it is. */
+function policyOf(layers) {
     const denied = layers.flatMap((l) => policyEntries(l.data?.deniedMcpServers));
-    const managedOnly = managed?.data?.allowManagedMcpServersOnly === true;
+    const managedOnly = layers.find((l) => l.scope === "managed")?.data?.allowManagedMcpServersOnly === true;
     const allowLayers = layers.filter((l) => !managedOnly || l.scope === "managed");
     const allowSet = allowLayers.some((l) => Array.isArray(l.data?.allowedMcpServers));
     const allowList = allowLayers.flatMap((l) => policyEntries(l.data?.allowedMcpServers));
-    const disabledHere = stringsIn(project.disabledMcpServers);
-    // A cloned repository cannot approve its own servers: project and local approvals count once the
-    // folder is trusted, local ones in your configuration home right away (docs: mcp#project-server-approvals-and-workspace-trust).
-    // A disabledMcpjsonServers entry in any file rejects the server.
+    return {
+        blocks: (d) => {
+            if (denied.some((e) => matches(e, d)))
+                return "Blocked by deniedMcpServers";
+            if (allowSet && !d.organisation && !allowed(allowList, d))
+                return managedOnly ? "Not in the managed allowedMcpServers" : "Not in allowedMcpServers";
+            return null;
+        },
+    };
+}
+/**
+ * The answers about a .mcp.json server, each with whether it counts here. A cloned repository
+ * cannot approve its own servers: project and local approvals count once the folder is trusted,
+ * local ones in your configuration home right away (docs: mcp#project-server-approvals-and-workspace-trust).
+ * A disabledMcpjsonServers entry in any file rejects the server. Your answers to the .mcp.json
+ * prompt sit in the project entry: claude mcp list counts an enableAllProjectMcpServers there, and
+ * claude mcp reset-project-choices clears it (v2.1.296).
+ */
+function approvalAnswers(input, project) {
+    const { env, projectDir, layers, trust } = input;
     const approvalCounts = (scope) => (scope !== "project" && scope !== "local") ||
         trust.trusted ||
         (scope === "local" && isConfigHome(env, projectDir));
-    // Your answers to the .mcp.json prompt sit in the project entry: claude mcp list counts an
-    // enableAllProjectMcpServers there, and claude mcp reset-project-choices clears it (v2.1.296).
     const sources = [
         ...layers.flatMap((l) => (l.data ? [{ source: l.scope, path: l.path, data: l.data }] : [])),
         { source: "claude-json", path: env.claudeJson, data: project },
     ];
-    const answersFor = (name) => sources.flatMap(({ source, path, data }) => {
+    return (name) => sources.flatMap(({ source, path, data }) => {
         const counts = source === "claude-json" || approvalCounts(source);
         const out = [];
         if (data.enableAllProjectMcpServers === true)
@@ -259,55 +340,31 @@ export async function readMcpServers(input, plugins) {
             out.push({ key: "disabledMcpjsonServers", source, path, counts: true });
         return out;
     });
-    const from = (a) => a.source === "claude-json" ? "your answer in ~/.claude.json" : `${a.source} settings`;
-    const set = (server, status, note) => {
-        server.status = status;
-        server.note = note;
-    };
-    const byName = new Map();
-    const enabledEndpoints = new Map();
-    for (const d of defined) {
-        const { server } = d;
-        if (server.status === "invalid")
-            continue;
-        if (exclusive && !d.organisation && server.scope !== "managed") {
-            set(server, "blocked", "managed-mcp.json takes exclusive control of MCP servers");
-            continue;
-        }
-        // Scopes dedupe by name; plugins by endpoint against the enabled servers above them.
-        const earlier = server.scope === "plugin" ? enabledEndpoints.get(endpoint(d)) : byName.get(server.name);
-        if (earlier) {
-            set(server, "shadowed", `The ${earlier.server.scope} definition of ${earlier.server.name} is used instead`);
-            continue;
-        }
-        if (server.scope !== "plugin")
-            byName.set(server.name, d);
-        if (denied.some((e) => matches(e, d)))
-            set(server, "blocked", "Blocked by deniedMcpServers");
-        else if (allowSet && !d.organisation && !allowed(allowList, d))
-            set(server, "blocked", managedOnly ? "Not in the managed allowedMcpServers" : "Not in allowedMcpServers");
-        else if (disabledHere.includes(server.name))
-            set(server, "disabled", "Turned off for this project in /mcp");
-        else if (server.scope === "project") {
-            const answers = answersFor(server.name);
-            if (answers.length > 0)
-                server.approvals = answers;
-            const rejection = answers.find((a) => a.key === "disabledMcpjsonServers");
-            const waiting = answers.find((a) => a.key !== "disabledMcpjsonServers" && !a.counts);
-            const approved = answers.some((a) => a.key !== "disabledMcpjsonServers" && a.counts);
-            if (rejection)
-                set(server, "rejected", `Rejected by disabledMcpjsonServers in ${from(rejection)}`);
-            // claude -p connects them without asking, approved or not (docs: permissions#what-runs-before-you-trust-a-folder).
-            else if (!approved && profile === "print")
-                server.note =
-                    "Not approved, but claude -p connects .mcp.json servers without asking; the SDK does when settingSources includes project";
-            else if (!approved)
-                set(server, "pending", waiting
-                    ? `Claude Code asks before starting it: ${waiting.key} in ${from(waiting)} counts once you trust this folder`
-                    : "Claude Code asks before starting servers from .mcp.json: answer its prompt, or list the server in enabledMcpjsonServers in your user settings");
-        }
-        if (server.status === "active" || server.status === "pending")
-            enabledEndpoints.set(endpoint(d), d);
+}
+/** Where an approval answer was given, as the page names it. */
+function answerSource(a) {
+    return a.source === "claude-json" ? "your answer in ~/.claude.json" : `${a.source} settings`;
+}
+/** Marks a .mcp.json server rejected, waiting for approval, or left active by its answers. */
+function approve(server, answers, profile) {
+    if (answers.length > 0)
+        server.approvals = answers;
+    const rejection = answers.find((a) => a.key === "disabledMcpjsonServers");
+    const waiting = answers.find((a) => a.key !== "disabledMcpjsonServers" && !a.counts);
+    const approved = answers.some((a) => a.key !== "disabledMcpjsonServers" && a.counts);
+    if (rejection) {
+        set(server, "rejected", `Rejected by disabledMcpjsonServers in ${answerSource(rejection)}`);
+        return;
     }
-    return defined.map((d) => d.server);
+    if (approved)
+        return;
+    // claude -p connects them without asking, approved or not (docs: permissions#what-runs-before-you-trust-a-folder).
+    if (profile === "print") {
+        server.note =
+            "Not approved, but claude -p connects .mcp.json servers without asking; the SDK does when settingSources includes project";
+        return;
+    }
+    set(server, "pending", waiting
+        ? `Claude Code asks before starting it: ${waiting.key} in ${answerSource(waiting)} counts once you trust this folder`
+        : "Claude Code asks before starting servers from .mcp.json: answer its prompt, or list the server in enabledMcpjsonServers in your user settings");
 }

package/dist/core/scan/memory.d.ts

@@ -0,0 +1,8 @@
+import { type MemoryStore, type Problem } from "../../shared/types.ts";
+import { type ScanEnv } from "./env.ts";
+/** The memory files in `dir`; a file that is there but cannot be read goes into `problems`. */
+export declare function readMemoryStore(env: ScanEnv, dir: string, projectPath: string | null, problems?: Problem[]): Promise<MemoryStore | null>;
+/** Memory files an index line links to that are not in the store. */
+export declare function deadLinks(line: string, files: string[]): string[];
+/** Whether MEMORY.md text points at a memory file, as a Markdown link or a [[name]] link. */
+export declare function indexMentions(index: string, file: string): boolean;

package/dist/{server → core}/scan/memory.js

@@ -1,33 +1,33 @@
 import { join } from "node:path";
 import {} from "../../shared/types.js";
 import {} from "./env.js";
-import { isDir, listDir, parseFrontmatter, readTextFile, revisionOf, shortHash, stringField, } from "./files.js";
+import { isDir, listDir, readTextFile, revisionOf, shortHash, stringField } from "./files.js";
+import { isRecord, parseFrontmatter } from "./data.js";
 const INDEX_FILE = "MEMORY.md";
 /** Claude Code reads only this much of MEMORY.md at session start (docs: memory#auto-memory). */
 const INDEX_LINE_LIMIT = 200;
 const INDEX_BYTE_LIMIT = 25 * 1024;
 const TYPES = ["user", "feedback", "project", "reference"];
-export async function readMemoryStore(env, dir, projectPath) {
+/** The memory files in `dir`; a file that is there but cannot be read goes into `problems`. */
+export async function readMemoryStore(env, dir, projectPath, problems) {
     if (!(await isDir(dir)))
         return null;
-    const indexFile = await readTextFile(env, join(dir, INDEX_FILE));
+    const indexFile = await readTextFile(env, join(dir, INDEX_FILE), problems);
     const files = (await listDir(dir)).filter((f) => f.endsWith(".md") && f !== INDEX_FILE);
     const memories = [];
     for (const file of files) {
-        const text = await readTextFile(env, join(dir, file));
+        const text = await readTextFile(env, join(dir, file), problems);
         if (!text)
             continue;
         const { data, body } = parseFrontmatter(text.text);
-        const metadata = typeof data.metadata === "object" && data.metadata !== null
-            ? data.metadata
-            : {};
+        const metadata = isRecord(data.metadata) ? data.metadata : {};
         const rawType = stringField(metadata, "type") || stringField(data, "type");
         memories.push({
             file,
             path: text.path,
             name: stringField(data, "name") || file.replace(/\.md$/, ""),
             description: stringField(data, "description"),
-            type: TYPES.includes(rawType) ? rawType : "unknown",
+            type: TYPES.find((t) => t === rawType) ?? "unknown",
             body,
             mtime: text.mtime,
             bytes: text.bytes,

package/dist/core/scan/path-test.d.ts

@@ -0,0 +1,9 @@
+import { type DirectoryView, type PathTest } from "../../shared/types.ts";
+import { type ScanEnv } from "./env.ts";
+/**
+ * What Claude Code adds to context once Claude reads or edits `file` in a session started in `dir`:
+ * path-scoped rules, skills with matching `paths`, and CLAUDE.md files in the folders between.
+ */
+export declare function testPath(env: ScanEnv, dir: string, file: string, 
+/** The view of the start directory; a server passes one that reuses a current scan. */
+viewOf?: (cwd: string) => Promise<DirectoryView>): Promise<PathTest>;

package/dist/core/scan/path-test.js

@@ -0,0 +1,156 @@
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import {} from "../../shared/types.js";
+import {} from "./env.js";
+import { isFile, isWithin, listDir, MAX_TEXT_BYTES, readTextFile, resolvedPath, stringsIn, toStringList, walkMarkdown, } from "./files.js";
+import { parseFrontmatter } from "./data.js";
+import { scanDirectory } from "./index.js";
+import { AGENTS_MD_NAMES, agentsMdLoads, CLAUDE_MD_NAMES, isExcluded, linkedRuleBlock, ruleTarget, safeMatch, } from "./instructions.js";
+import { applySkillOverrides, readSkill } from "./inventory.js";
+/** Globs are written with forward slashes on every platform. */
+function slashed(path) {
+    return path.split(sep).join("/");
+}
+/** An invalid pattern matches nothing; the others still count (docs: memory#path-specific-rules). */
+function firstMatch(globs, path) {
+    return globs.find((glob) => safeMatch(path, glob));
+}
+/**
+ * What Claude Code adds to context once Claude reads or edits `file` in a session started in `dir`:
+ * path-scoped rules, skills with matching `paths`, and CLAUDE.md files in the folders between.
+ */
+export async function testPath(env, dir, file, 
+/** The view of the start directory; a server passes one that reuses a current scan. */
+viewOf = (cwd) => scanDirectory(env, cwd)) {
+    const cwd = resolve(dir);
+    const target = isAbsolute(file) ? resolve(file) : resolve(cwd, file);
+    if (target === cwd || !isWithin(cwd, target))
+        return { file: target, inside: false, exists: false, matches: [] };
+    const view = await viewOf(cwd);
+    const projectRoot = view.gitRoot ?? cwd;
+    const test = {
+        env,
+        cwd,
+        target,
+        realCwd: await resolvedPath(cwd),
+        approved: view.trust.externalImports === "approved",
+        mode: view.agentsMdMode,
+        excludes: stringsIn(view.effective.find((e) => e.key === "claudeMdExcludes")?.value),
+        overrides: view.effective.find((e) => e.key === "skillOverrides")?.value,
+        startSkills: new Set(view.inventory.skills.filter((s) => s.scope !== "plugin").map((s) => s.name)),
+    };
+    const matches = startRuleMatches(view, target, projectRoot);
+    // Folders below the start directory load their own instructions, rules and skills on demand.
+    const between = [];
+    for (let d = dirname(target); d !== cwd && isWithin(cwd, d); d = dirname(d))
+        between.unshift(d);
+    for (const folder of between)
+        matches.push(...(await nestedInstructions(test, folder)), ...(await nestedRules(test, folder)), ...(await nestedSkills(test, folder)));
+    matches.push(...startSkillMatches(view, target, projectRoot));
+    return { file: target, inside: true, exists: await isFile(target), matches };
+}
+/** Path rules Claude Code would use at all: not excluded, not waiting for approval. */
+function startRuleMatches(view, target, projectRoot) {
+    const matches = [];
+    for (const rule of view.instructions) {
+        if (!rule.paths || rule.status !== "on-match")
+            continue;
+        // A project rule's globs are relative to the folder holding its .claude; others to the project.
+        const base = rule.scope === "project" || rule.scope === "local" ? rule.dir : projectRoot;
+        const glob = firstMatch(rule.paths, slashed(relative(base, target)));
+        if (glob)
+            matches.push({ kind: "rule", path: rule.path, scope: rule.scope, glob });
+    }
+    return matches;
+}
+/** A folder's CLAUDE.md, CLAUDE.local.md and AGENTS.md files that load on demand. */
+async function nestedInstructions(test, folder) {
+    const { env, excludes, mode } = test;
+    const matches = [];
+    /** Whether the file is there; an excluded one or one over the limit is there but not loaded. */
+    const nested = async (name, scope) => {
+        const path = join(folder, name);
+        const text = await readTextFile(env, path);
+        if (!text)
+            return false;
+        if (!isExcluded(excludes, path, text.realPath) && text.bytes <= MAX_TEXT_BYTES)
+            matches.push({ kind: "nested", path, scope });
+        return true;
+    };
+    // managed-only leaves out files at launch, but a subfolder's CLAUDE.md and rules still load
+    // on demand (docs: memory#choose-which-instruction-files-load).
+    let hasClaudeMd = false;
+    for (const name of CLAUDE_MD_NAMES)
+        if (await nested(name, "project"))
+            hasClaudeMd = true;
+    if (mode !== "managed-only" && (await nested("CLAUDE.local.md", "local")))
+        hasClaudeMd = true;
+    if (agentsMdLoads(mode, hasClaudeMd))
+        for (const name of AGENTS_MD_NAMES)
+            await nested(name, "project");
+    return matches;
+}
+/** A folder's rules that load for the file: ones without paths, and ones whose paths match it. */
+async function nestedRules(test, folder) {
+    const { env, target, realCwd, approved, excludes } = test;
+    const matches = [];
+    for (const path of await walkMarkdown(join(folder, ".claude", "rules"))) {
+        const text = await readTextFile(env, path);
+        if (!text || text.bytes > MAX_TEXT_BYTES)
+            continue;
+        // As at startup: excluded by its target's path too, and one linked from outside the project
+        // waits for your approval, then loads only without paths.
+        const linked = await ruleTarget(text, folder, realCwd);
+        if (isExcluded(excludes, path, linked))
+            continue;
+        const globs = toStringList(parseFrontmatter(text.text).data.paths);
+        if (linkedRuleBlock(linked, realCwd, approved, globs.length > 0))
+            continue;
+        const glob = globs.length === 0 ? undefined : firstMatch(globs, slashed(relative(folder, target)));
+        if (globs.length === 0 || glob)
+            matches.push({ kind: "nested", path, scope: "project", ...(glob ? { glob } : {}) });
+    }
+    return matches;
+}
+/**
+ * A folder's skills Claude may pick itself: not off, user-invocable-only or
+ * disable-model-invocation; one with paths only for a matching file, its globs read from its
+ * folder like a rule's.
+ */
+async function nestedSkills(test, folder) {
+    const { env, cwd, target, overrides, startSkills } = test;
+    const matches = [];
+    for (const name of await listDir(join(folder, ".claude", "skills"))) {
+        const skill = await readSkill(env, join(folder, ".claude", "skills", name), "project");
+        if (!skill)
+            continue;
+        applySkillOverrides([skill], overrides);
+        if (skill.listed === false)
+            continue;
+        const glob = skill.paths && firstMatch(skill.paths, slashed(relative(folder, target)));
+        if (skill.paths && !glob)
+            continue;
+        // A nested skill whose folder name another skill has is called by its folder as well, as
+        // apps/web:deploy (docs: skills#how-a-skill-gets-its-command-name).
+        matches.push({
+            kind: "skill",
+            path: skill.path,
+            scope: "project",
+            name: startSkills.has(name) ? `${slashed(relative(cwd, folder))}:${name}` : skill.name,
+            ...(glob ? { glob } : {}),
+        });
+    }
+    return matches;
+}
+/** Skills Claude can pick on its own; one with disable-model-invocation only runs when you call it. */
+function startSkillMatches(view, target, projectRoot) {
+    return view.inventory.skills.flatMap((skill) => {
+        if (!skill.paths || skill.listed === false || skill.shadowedBy)
+            return [];
+        const glob = firstMatch(skill.paths, slashed(relative(projectRoot, target)));
+        if (!glob)
+            return [];
+        return [
+            { kind: "skill", path: skill.path, scope: skill.scope, glob, name: skill.id ?? skill.name },
+        ];
+    });
+}

package/dist/core/scan/permissions.d.ts

@@ -0,0 +1,31 @@
+import { type Permission, type PermissionList, type Scope, type SessionProfile, type SettingsLayer, type Trust } from "../../shared/types.ts";
+/**
+ * Whether a file's trust-gated settings (permission grants, autoMemoryDirectory) wait for
+ * the workspace trust dialog. Claude Code runs git to tell a private local file from a committed one
+ * only once the folder or a parent is trusted, or in claude -p and the SDK, which count as accepted;
+ * until then the local file waits too, except in your configuration home. A committed local file
+ * waits like project settings, which -p and the SDK never apply in a folder you have not trusted
+ * (docs: permissions#when-your-local-settings-file-needs-trust, #what-runs-before-you-trust-a-folder).
+ */
+export declare function trustWaits({ trust, inConfigHome, localFromRepository, profile, }: Options): (scope: Scope) => boolean;
+/**
+ * An MCP rule with a parameter, which Claude Code skips when it reads a settings file; such a rule
+ * works only from --disallowedTools (docs: permissions#match-by-input-parameter).
+ */
+export declare function isSkippedMcpRule(rule: string): boolean;
+/** Claude Code checks every file's rules together: deny, then ask, then allow (docs: permissions). */
+export declare const CHECK_ORDER: PermissionList[];
+export interface Options {
+    trust: Trust;
+    /** Claude Code started in your configuration home, where the local file applies without the trust step. */
+    inConfigHome: boolean;
+    /** The local settings file is tracked in git, so Claude Code treats it like repository settings. */
+    localFromRepository: boolean;
+    profile: SessionProfile;
+}
+/**
+ * Every permission entry from every settings file, each marked with whether Claude Code applies it
+ * (docs: permissions#project-allow-rules-and-workspace-trust, settings-reference#permissions-defaultmode,
+ * #allowmanagedpermissionrulesonly).
+ */
+export declare function permissionsOf(layers: SettingsLayer[], options: Options): Permission[];

package/dist/{server → core}/scan/permissions.js

@@ -1,6 +1,7 @@
 import { HIGHEST_FIRST } from "../../shared/scopes.js";
 import {} from "../../shared/types.js";
-import { isRecord, stringsIn } from "./files.js";
+import { stringsIn } from "./files.js";
+import { isRecord } from "./data.js";
 import { ignoredModeReason } from "./settings.js";
 /**
  * Whether a file's trust-gated settings (permission grants, autoMemoryDirectory) wait for
@@ -17,7 +18,7 @@ export function trustWaits({ trust, inConfigHome, localFromRepository, profile,
 }
 /**
  * An MCP rule with a parameter, which Claude Code skips when it reads a settings file; such a rule
- * works only from --disallowedTools (docs: permissions#match-specific-tool-uses).
+ * works only from --disallowedTools (docs: permissions#match-by-input-parameter).
  */
 export function isSkippedMcpRule(rule) {
     return /^mcp__[^(]*\(/.test(rule);
@@ -30,13 +31,9 @@ export const CHECK_ORDER = ["deny", "ask", "allow"];
  * #allowmanagedpermissionrulesonly).
  */
 export function permissionsOf(layers, options) {
-    const sources = HIGHEST_FIRST.flatMap((scope) => layers
-        .filter((l) => l.scope === scope && isRecord(l.data?.permissions))
-        .map((l) => ({
-        scope,
-        path: l.path,
-        permissions: l.data?.permissions,
-    })));
+    const sources = HIGHEST_FIRST.flatMap((scope) => layers.flatMap((l) => l.scope === scope && isRecord(l.data?.permissions)
+        ? [{ scope, path: l.path, permissions: l.data.permissions }]
+        : []));
     const managedOnly = layers.some((l) => l.scope === "managed" && l.data?.allowManagedPermissionRulesOnly === true);
     // Grants from repository files wait for the workspace trust dialog; deny and ask apply at once.
     const waitsForTrust = trustWaits(options);