ccdesk 0.2.2 → 0.2.4

package/dist/{server → core}/scan/settings.js

@@ -2,8 +2,11 @@ import { lstat } from "node:fs/promises";
 import { join } from "node:path";
 import { allowedScopes, EVERY_FILE, ignoredReason } from "../../shared/scopes.js";
 import {} from "../../shared/types.js";
+import { redactSecrets } from "../secrets.js";
 import {} from "./env.js";
-import { isRecord, listDir, mainWorktreeRoot, readJsonObject, redactSecrets } from "./files.js";
+import { isFile, listDir, readJsonObject } from "./files.js";
+import { isRecord } from "./data.js";
+import { mainWorktreeRoot } from "./git.js";
 import { sandboxFilter } from "./sandbox.js";
 /** Lowest precedence first, so later layers override earlier ones. */
 const PRECEDENCE = ["user", "project", "local", "managed"];
@@ -132,12 +135,15 @@ export async function settingsFiles(env, dir) {
     files.push({ scope: "user", path: userFile });
     return files;
 }
-/** Settings files that apply in `dir`, highest precedence first. */
-export async function readSettingsLayers(env, dir) {
+/**
+ * Settings files that apply in `dir`, highest precedence first. `managed` is what
+ * readManagedSettings read, so a scan reads the managed files once.
+ */
+export async function readSettingsLayers(env, dir, managed) {
     const layers = [];
     for (const file of await settingsFiles(env, dir)) {
         if (file.scope === "managed") {
-            layers.push(await readManagedLayer(env, file.path));
+            layers.push(managedLayer(file.path, managed));
             continue;
         }
         const result = await readJsonObject(env, file.path);
@@ -183,10 +189,17 @@ export async function readManagedSettings(env) {
         sources.push(source);
         data = data ? mergeSettings(data, result.data) : result.data;
     }
-    return { data, sources, dropIns, errors, blocksStart };
+    // Server-managed settings, then MDM, outrank the files; by default Claude Code uses the first
+    // source that sets a policy key and skips the rest (docs: managed-settings#how-claude-code-combines-managed-sources).
+    const candidates = [join(env.claudeDir, "remote-settings.json"), ...(env.managedProfiles ?? [])];
+    const higher = [];
+    for (const source of candidates)
+        if (await isFile(source))
+            higher.push(source);
+    return { data, sources, dropIns, higher, errors, blocksStart };
 }
-async function readManagedLayer(env, path) {
-    const { data, sources, dropIns, errors, blocksStart } = await readManagedSettings(env);
+function managedLayer(path, managed) {
+    const { data, sources, dropIns, higher, errors, blocksStart } = managed;
     const layer = { scope: "managed", path, exists: false, data: null };
     if (data)
         layer.data = redactSecrets(data);
@@ -197,6 +210,8 @@ async function readManagedLayer(env, path) {
         layer.error = errors.join("; ");
     if (blocksStart)
         layer.blocksStart = true;
+    if (higher.length > 0)
+        layer.higherSources = higher;
     return layer;
 }
 /** The value Claude Code ends up with for each top-level key, and where it came from. */
@@ -211,90 +226,80 @@ export function effectiveSettings(layers) {
     }
     const keys = new Set([...byScope.values()].flatMap((data) => Object.keys(data)));
     const filterSandbox = sandboxFilter((key, scope) => allowedScopes(key).includes(scope) ? byScope.get(scope)?.[key] : undefined);
-    const out = [];
-    for (const key of [...keys].sort()) {
-        const allowed = allowedScopes(key);
-        const present = PRECEDENCE.filter((scope) => byScope.get(scope)?.[key] !== undefined);
-        const valueIn = (scope) => byScope.get(scope)?.[key];
-        const ignored = present
-            .filter((scope) => !allowed.includes(scope))
-            .map((scope) => ({ scope, value: valueIn(scope), reason: ignoredReason(key) }));
-        let defined = present.filter((scope) => allowed.includes(scope));
-        // A managed availableModels list is applied as-is; other files' entries are ignored.
-        if (key === "availableModels" && defined.includes("managed")) {
-            for (const scope of defined.filter((s) => s !== "managed"))
-                ignored.push({
-                    scope,
-                    value: valueIn(scope),
-                    reason: "Managed settings set availableModels, so Claude Code uses that list as-is",
-                });
-            defined = ["managed"];
-        }
-        if (defined.length === 0) {
-            out.push({ key, value: undefined, from: [], merged: false, overridden: [], ignored });
-            continue;
-        }
-        const values = defined.map((scope) => {
-            const { value, dropped } = withoutIgnoredFields(key, scope, valueIn(scope), filterSandbox);
-            for (const d of dropped)
-                ignored.push({ scope, ...d });
-            return { scope, value };
-        });
-        const top = values[values.length - 1];
-        if (!top)
-            continue;
-        const mergeable = !WHOLE_VALUE_KEYS.has(key) &&
-            values.every((v) => Array.isArray(v.value) || isRecord(v.value));
-        const strict = STRICTEST[key];
-        const decided = strict && strictWinner(strict, values);
-        if (strict && decided) {
-            const { winner } = decided;
-            // Only files that may just tighten it set the key, and none tightens it past the default.
-            if (!winner)
-                for (const v of values)
-                    ignored.push({ ...v, reason: "it is not stricter than Claude Code's default" });
-            out.push({
-                key,
-                value: winner?.value,
-                from: winner ? [winner.scope] : [],
-                merged: false,
-                overridden: winner ? values.filter((v) => v !== winner).reverse() : [],
-                ignored,
-                note: strictNote(strict),
-            });
-        }
-        else if (mergeable && values.length > 1) {
-            out.push({
-                key,
-                value: withStrictFields(key, values.slice(1).reduce((acc, v) => mergeKey(key, acc, v.value), values[0]?.value), values),
-                from: defined,
-                merged: true,
-                overridden: [],
-                ignored,
-            });
-        }
-        else if (isRecord(top.value)) {
-            out.push({
-                key,
-                value: withStrictFields(key, top.value, values),
-                from: [top.scope],
-                merged: false,
-                overridden: values.slice(0, -1).reverse(),
-                ignored,
-            });
-        }
-        else {
-            out.push({
-                key,
-                value: top.value,
-                from: [top.scope],
-                merged: false,
-                overridden: values.slice(0, -1).reverse(),
-                ignored,
-            });
-        }
+    return [...keys]
+        .sort()
+        .map((key) => effectiveSetting(key, (scope) => byScope.get(scope)?.[key], filterSandbox));
+}
+/** One key's value, from its value in each scope, lowest precedence first. */
+function effectiveSetting(key, valueIn, filterSandbox) {
+    const { defined, ignored } = scopesThatCount(key, valueIn);
+    const values = defined.map((scope) => {
+        const { value, dropped } = withoutIgnoredFields(key, scope, valueIn(scope), filterSandbox);
+        for (const d of dropped)
+            ignored.push({ scope, ...d });
+        return { scope, value };
+    });
+    const top = values.at(-1);
+    if (!top)
+        return { key, value: undefined, from: [], merged: false, overridden: [], ignored };
+    const strict = STRICTEST[key];
+    const decided = strict && strictWinner(strict, values);
+    if (strict && decided) {
+        const { winner } = decided;
+        // Only files that may just tighten it set the key, and none tightens it past the default.
+        if (!winner)
+            for (const v of values)
+                ignored.push({ ...v, reason: "it is not stricter than Claude Code's default" });
+        return {
+            key,
+            value: winner?.value,
+            from: winner ? [winner.scope] : [],
+            merged: false,
+            overridden: winner ? values.filter((v) => v !== winner).reverse() : [],
+            ignored,
+            note: strictNote(strict),
+        };
     }
-    return out;
+    const mergeable = !WHOLE_VALUE_KEYS.has(key) && values.every((v) => Array.isArray(v.value) || isRecord(v.value));
+    if (mergeable && values.length > 1)
+        return {
+            key,
+            value: withStrictFields(key, values.slice(1).reduce((acc, v) => mergeKey(key, acc, v.value), values[0]?.value), values),
+            from: defined,
+            merged: true,
+            overridden: [],
+            ignored,
+        };
+    return {
+        key,
+        value: withStrictFields(key, top.value, values),
+        from: [top.scope],
+        merged: false,
+        overridden: values.slice(0, -1).reverse(),
+        ignored,
+    };
+}
+/**
+ * The scopes whose value for `key` counts, lowest precedence first, and the values Claude Code
+ * ignores: ones from files the key is not read from, and, once managed settings set
+ * availableModels, every other file's list, since Claude Code uses the managed one as-is.
+ */
+function scopesThatCount(key, valueIn) {
+    const allowed = allowedScopes(key);
+    const present = PRECEDENCE.filter((scope) => valueIn(scope) !== undefined);
+    const ignored = present
+        .filter((scope) => !allowed.includes(scope))
+        .map((scope) => ({ scope, value: valueIn(scope), reason: ignoredReason(key) }));
+    const defined = present.filter((scope) => allowed.includes(scope));
+    if (key !== "availableModels" || !defined.includes("managed"))
+        return { defined, ignored };
+    for (const scope of defined.filter((s) => s !== "managed"))
+        ignored.push({
+            scope,
+            value: valueIn(scope),
+            reason: "Managed settings set availableModels, so Claude Code uses that list as-is",
+        });
+    return { defined: ["managed"], ignored };
 }
 /** An object setting with each nested strictness exception (such as permissions.x) applied. */
 function withStrictFields(key, value, values) {
@@ -305,9 +310,9 @@ function withStrictFields(key, value, values) {
         const [head, field] = path.split(".");
         if (head !== key || !field)
             continue;
-        const fieldValues = values
-            .filter((v) => isRecord(v.value) && v.value[field] !== undefined)
-            .map((v) => ({ scope: v.scope, value: v.value[field] }));
+        const fieldValues = values.flatMap((v) => isRecord(v.value) && v.value[field] !== undefined
+            ? [{ scope: v.scope, value: v.value[field] }]
+            : []);
         const decided = strictWinner(strict, fieldValues);
         if (decided)
             out = { ...out, [field]: decided.winner?.value };

package/dist/core/scan/tools.d.ts

@@ -0,0 +1,10 @@
+import { type BuiltinTool, type Hook, type Permission, type PermissionList } from "../../shared/types.ts";
+/** `Tool` or `Tool(specifier)`; `Tool(*)` names the whole tool too (docs: permissions#permission-rule-syntax). */
+export declare function parseRule(rule: string): {
+    tool: string;
+    specifier: string | null;
+};
+/** Deny and ask rules may glob the tool name; allow rules name it exactly (docs: permissions#tool-name-wildcards). */
+export declare function namesTool(list: PermissionList, tool: string, name: string): boolean;
+/** Every built-in tool, with the rules and hooks that apply to it here. */
+export declare function builtinTools(permissions: Permission[], hooks: Hook[]): BuiltinTool[];

package/dist/{server → core}/scan/tools.js

@@ -50,31 +50,39 @@ function matcherCovers(matcher, name) {
         return false;
     }
 }
+/**
+ * The rules about one tool: `whole` name the tool itself and decide it, `scoped` apply to some of
+ * its calls only. EndConversation ignores rules (see builtinTools).
+ */
+function rulesFor(name, rules) {
+    const whole = [];
+    const scoped = [];
+    if (name === EXEMPT)
+        return { whole, scoped };
+    for (const r of rules) {
+        const { tool, specifier } = parseRule(r.rule);
+        if (specifier === null) {
+            if (namesTool(r.list, tool, name))
+                whole.push(r);
+            // Monitor's commands follow the Bash rules; its WebSocket watches do not
+            // (docs: tools-reference#monitor-tool).
+            else if (name === "Monitor" && namesTool(r.list, tool, "Bash"))
+                scoped.push(r);
+        }
+        else if (tool === name && UNCHECKED_PATH_RULE_TOOLS.has(tool)) {
+            scoped.push({ ...r, unchecked: true });
+        }
+        else if (tool === name || coveredTools(tool, r.list).includes(name))
+            scoped.push(r);
+    }
+    return { whole, scoped };
+}
 /** Every built-in tool, with the rules and hooks that apply to it here. */
 export function builtinTools(permissions, hooks) {
     const rules = permissions.flatMap((p) => p.kind === "rule" && p.inEffect ? [{ list: p.list, rule: p.rule, scope: p.scope }] : []);
     const preToolUse = hooks.filter((h) => h.active && h.event === "PreToolUse");
     const tools = table.tools.map(({ name, description, asks }) => {
-        const whole = [];
-        const scoped = [];
-        for (const r of rules) {
-            if (name === EXEMPT)
-                break;
-            const { tool, specifier } = parseRule(r.rule);
-            if (specifier === null) {
-                if (namesTool(r.list, tool, name))
-                    whole.push(r);
-                // Monitor's commands follow the Bash rules; its WebSocket watches do not
-                // (docs: tools-reference#monitor-tool).
-                else if (name === "Monitor" && namesTool(r.list, tool, "Bash"))
-                    scoped.push(r);
-            }
-            else if (tool === name && UNCHECKED_PATH_RULE_TOOLS.has(tool)) {
-                scoped.push({ ...r, unchecked: true });
-            }
-            else if (tool === name || coveredTools(tool, r.list).includes(name))
-                scoped.push(r);
-        }
+        const { whole, scoped } = rulesFor(name, rules);
         const decidedBy = CHECK_ORDER.map((list) => whole.find((r) => r.list === list)).find(Boolean);
         const tool = {
             name,

package/dist/core/scan/usage.d.ts

@@ -0,0 +1,19 @@
+import { type PermissionList, type Usage } from "../../shared/types.ts";
+import { type ScanEnv } from "./env.ts";
+/** A rule in effect here, as the scan found it. */
+export interface RuleInEffect {
+    list: PermissionList;
+    rule: string;
+}
+/** A count that stopped before it finished, because it took too long or nobody wanted it. */
+export declare class CountStopped extends Error {
+}
+/**
+ * A counter with its own cache of transcripts and its own queue: counts made through it run one at
+ * a time and reuse what earlier ones read. Each core has one.
+ */
+export declare function usageCounter(): (env: ScanEnv, dir: string, rules: RuleInEffect[], { signal, timeLimitMs, maxCachedCalls, }?: {
+    signal?: AbortSignal;
+    timeLimitMs?: number;
+    maxCachedCalls?: number;
+}) => Promise<Usage>;