ccdesk 0.2.3 → 0.2.4

package/dist/core/scan/usage.js

@@ -75,8 +75,6 @@ export function usageCounter() {
         return current.promise;
     };
 }
-/** Counts with a cache and queue shared by every caller in the process; use a core's instead. */
-export const readUsage = usageCounter();
 function stoppedBecause(signal) {
     return new CountStopped(signal.reason instanceof DOMException && signal.reason.name === "TimeoutError"
         ? "Counting tool calls took too long and stopped; what was read is kept, so the next count continues."
@@ -334,8 +332,13 @@ function approvals(calls, rules) {
     for (const c of calls) {
         if (c.byYou !== true)
             continue;
-        if (c.rule)
-            groups.set(c.rule, [...(groups.get(c.rule) ?? []), c]);
+        if (!c.rule)
+            continue;
+        const group = groups.get(c.rule);
+        if (group)
+            group.push(c);
+        else
+            groups.set(c.rule, [c]);
     }
     const refused = calls.filter((c) => c.byYou === false);
     const out = [];

package/dist/core/secrets.d.ts

@@ -38,7 +38,8 @@ export declare function hasHiddenValues(value: unknown): boolean;
 export declare function hiddenValues(text: string | null): string | null;
 /**
  * The secret text in a value, to take out of a message that may quote it: an env or header value
- * or a hidden argument whole, the part after `=` of `--token=value`, and a URL's user name,
- * password and query. Longest first, so a secret that contains another is taken out whole.
+ * or a hidden argument whole, the hidden end of one whose start is shown (`--token=value`,
+ * `Authorization: Bearer value`), and a URL's user name, password and query. Longest first, so a
+ * secret that contains another is taken out whole.
  */
 export declare function secretTexts(value: unknown): string[];

package/dist/core/secrets.js

@@ -1,5 +1,5 @@
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-import { FRONTMATTER, isRecord } from "./scan/data.js";
+import { FRONTMATTER, isRecord, parseJson } from "./scan/data.js";
 /**
  * A server URL as ccdesk shows it: a user name, password or query string can carry a key, so they
  * are hidden, as Claude Code hides the URL in its own status output (docs: mcp).
@@ -21,34 +21,52 @@ export function shownUrl(url) {
         return url.replace(/\/\/[^/@]*@/, "//•••@").replace(/\?.*$/, "?•••");
     }
 }
-/** A flag whose value is a secret, such as `--token` or `--api-key`. */
-const SECRET_FLAG = /^--(token|api[-_]?key|apikey|password|secret|auth|key)$/i;
+/** A flag whose value is a secret, such as `--token`, `--api-key`, `--client-secret` or `--auth-token`. */
+const SECRET_FLAG = /^--([\w-]*[-_])?(token|api[-_]?key|apikey|password|secret|auth\w*|key)$/i;
+/** A flag whose value is an HTTP header, as mcp-remote takes `--header "Authorization: Bearer …"`. */
+const HEADER_FLAG = /^(--header|-H)$/;
+/** An argument that is itself a credential header or an Authorization value. */
+const SECRET_HEADER = /^([\w-]*(authorization|api-key|token|cookie)\s*:|(bearer|basic)\s+\S)/i;
 /** A value that starts like a common API key or token. */
 const KEY_PREFIX = /^(sk-|ghp_|gho_|ghu_|ghs_|ghr_|github_pat_|xox[bp]-|glpat-|AKIA[0-9A-Z]{16})/;
+/** A header as ccdesk shows it: the name and the `Bearer` or `Basic` scheme stay, the rest is hidden. */
+function shownHeader(header) {
+    const kept = /^([^:]*:\s*)?((bearer|basic)\s+)?/i.exec(header)?.[0] ?? "";
+    return `${kept}•••`;
+}
 /**
  * A server's command-line arguments as ccdesk shows them: the value after a secret flag, given as
- * `--token value` or `--token=value`, a value that starts like a known key, and the credentials in
- * a URL are hidden.
+ * `--token value` or `--token=value`, a header's value after `--header` or `-H`, a credential
+ * header or Authorization value on its own, a value that starts like a known key, and the
+ * credentials in a URL are hidden.
  */
 function shownArgs(args) {
-    return args.map((arg, i) => {
-        if (typeof arg !== "string")
-            return arg;
-        const previous = args[i - 1];
-        if (typeof previous === "string" && SECRET_FLAG.test(previous) && !arg.startsWith("-"))
-            return "•••";
-        const equals = arg.indexOf("=");
-        if (equals > 0) {
-            const name = arg.slice(0, equals);
-            if (SECRET_FLAG.test(name) || KEY_PREFIX.test(arg.slice(equals + 1)))
-                return `${name}=•••`;
-        }
-        if (KEY_PREFIX.test(arg))
+    return args.map((arg, i) => (typeof arg === "string" ? shownArg(arg, args[i - 1]) : arg));
+}
+/** One argument as ccdesk shows it, given the one before it. */
+function shownArg(arg, previous) {
+    if (typeof previous === "string" && !arg.startsWith("-")) {
+        if (SECRET_FLAG.test(previous))
             return "•••";
-        if (/^https?:\/\//i.test(arg))
-            return shownUrl(arg);
-        return arg;
-    });
+        if (HEADER_FLAG.test(previous))
+            return shownHeader(arg);
+    }
+    const equals = arg.indexOf("=");
+    if (equals > 0) {
+        const name = arg.slice(0, equals);
+        const value = arg.slice(equals + 1);
+        if (HEADER_FLAG.test(name))
+            return `${name}=${shownHeader(value)}`;
+        if (SECRET_FLAG.test(name) || KEY_PREFIX.test(value))
+            return `${name}=•••`;
+    }
+    if (SECRET_HEADER.test(arg))
+        return shownHeader(arg);
+    if (KEY_PREFIX.test(arg))
+        return "•••";
+    if (/^https?:\/\//i.test(arg))
+        return shownUrl(arg);
+    return arg;
 }
 export function redactSecrets(value) {
     if (Array.isArray(value))
@@ -86,7 +104,7 @@ export function shownText(text) {
         return null;
     let data;
     try {
-        data = JSON.parse(text);
+        data = parseJson(text);
     }
     catch {
         return shownFrontmatter(text);
@@ -114,7 +132,7 @@ function shownFrontmatter(text) {
 /** A file named .json that does not parse is not shown: its text could still hold a secret. */
 export function shownJsonFile(text) {
     try {
-        JSON.parse(text);
+        parseJson(text);
     }
     catch {
         return "(a JSON file ccdesk could not parse, so its text is not shown; open it to see it)\n";
@@ -156,7 +174,7 @@ export function hasHiddenValues(value) {
  */
 export function hiddenValues(text) {
     try {
-        const data = text === null ? null : JSON.parse(text);
+        const data = text === null ? null : parseJson(text);
         return JSON.stringify(hiddenIn(data).map(({ path, raw }) => [path, raw]));
     }
     catch {
@@ -165,8 +183,9 @@ export function hiddenValues(text) {
 }
 /**
  * The secret text in a value, to take out of a message that may quote it: an env or header value
- * or a hidden argument whole, the part after `=` of `--token=value`, and a URL's user name,
- * password and query. Longest first, so a secret that contains another is taken out whole.
+ * or a hidden argument whole, the hidden end of one whose start is shown (`--token=value`,
+ * `Authorization: Bearer value`), and a URL's user name, password and query. Longest first, so a
+ * secret that contains another is taken out whole.
  */
 export function secretTexts(value) {
     const found = hiddenIn(value).flatMap(({ raw, shown: hidden }) => {
@@ -174,8 +193,9 @@ export function secretTexts(value) {
             return [];
         if (hidden === "•••")
             return [raw];
-        if (typeof hidden === "string" && hidden.endsWith("=•••"))
-            return [raw.slice(raw.indexOf("=") + 1)];
+        // The start was kept, as in `--token=•••` or `Authorization: Bearer •••`: the rest is the secret.
+        if (typeof hidden === "string" && hidden.endsWith("•••") && raw.startsWith(hidden.slice(0, -3)))
+            return [raw.slice(hidden.length - 3)];
         if (shownUrl(raw) === raw)
             return [];
         const url = URL.parse(raw);

package/dist/core/settings-edit.d.ts

@@ -2,8 +2,8 @@ import { type Change, type HookEdit, type PermissionEdit, type SettingsEdit, typ
 import { type ScanEnv } from "./scan/env.ts";
 import { type Serially } from "./write.ts";
 export declare function previewSettingsEdit(env: ScanEnv, edit: SettingsEdit): Promise<SettingsEditPreview>;
-export declare function saveSettingsEdit(env: ScanEnv, edit: SettingsEdit, expectedRevision: string, queue?: Serially): Promise<Change>;
+export declare function saveSettingsEdit(env: ScanEnv, edit: SettingsEdit, expectedRevision: string, queue: Serially): Promise<Change>;
 export declare function previewPermissionEdit(env: ScanEnv, edit: PermissionEdit): Promise<SettingsEditPreview>;
-export declare function savePermissionEdit(env: ScanEnv, edit: PermissionEdit, expectedRevision: string, queue?: Serially): Promise<Change>;
+export declare function savePermissionEdit(env: ScanEnv, edit: PermissionEdit, expectedRevision: string, queue: Serially): Promise<Change>;
 export declare function previewHookEdit(env: ScanEnv, edit: HookEdit): Promise<SettingsEditPreview>;
-export declare function saveHookEdit(env: ScanEnv, edit: HookEdit, expectedRevision: string, queue?: Serially): Promise<Change>;
+export declare function saveHookEdit(env: ScanEnv, edit: HookEdit, expectedRevision: string, queue: Serially): Promise<Change>;

package/dist/core/settings-edit.js

@@ -11,7 +11,7 @@ import { isSkippedMcpRule } from "./scan/permissions.js";
 import { settingsFiles } from "./scan/settings.js";
 import { schemaErrors } from "./schema.js";
 import { hasHiddenValues, redactSecrets, shown } from "./secrets.js";
-import { RefusedError, readJsonObject, recordChange, saveReviewed, serially, writeAtomic, } from "./write.js";
+import { RefusedError, readJsonObject, recordChange, saveReviewed, writeAtomic, } from "./write.js";
 const properties = schema.definitions.ClaudeCodeSettings.properties;
 const validators = new Map();
 function validatorFor(key) {
@@ -199,18 +199,18 @@ const CHANGED = "The file changed since you reviewed this edit; review it again.
 export async function previewSettingsEdit(env, edit) {
     return (await planSettingsEdit(env, edit)).preview;
 }
-export function saveSettingsEdit(env, edit, expectedRevision, queue = serially) {
+export function saveSettingsEdit(env, edit, expectedRevision, queue) {
     return saveReviewed(queue, () => planSettingsEdit(env, edit), expectedRevision, CHANGED);
 }
 export async function previewPermissionEdit(env, edit) {
     return (await planPermissionEdit(env, edit)).preview;
 }
-export function savePermissionEdit(env, edit, expectedRevision, queue = serially) {
+export function savePermissionEdit(env, edit, expectedRevision, queue) {
     return saveReviewed(queue, () => planPermissionEdit(env, edit), expectedRevision, CHANGED);
 }
 export async function previewHookEdit(env, edit) {
     return (await planHookEdit(env, edit)).preview;
 }
-export function saveHookEdit(env, edit, expectedRevision, queue = serially) {
+export function saveHookEdit(env, edit, expectedRevision, queue) {
     return saveReviewed(queue, () => planHookEdit(env, edit), expectedRevision, CHANGED);
 }

package/dist/core/write.d.ts

@@ -14,8 +14,6 @@ export declare class StaleError extends RefusedError {
 export type Serially = <T>(change: () => Promise<T>) => Promise<T>;
 /** A new, empty queue of changes. Each core has its own. */
 export declare function changeQueue(): Serially;
-/** The queue the save functions use when they are called without a core's. */
-export declare const serially: Serially;
 /** What every change's review has: the revision it was worked out from and why it cannot be saved. */
 interface Review {
     /** Fingerprint of everything the change was worked out from. */

package/dist/core/write.js

@@ -3,7 +3,7 @@ import { chmod, link, lstat, mkdir, open, readFile, realpath, rename, rm, writeF
 import { basename, dirname, join } from "node:path";
 import { Type } from "typebox";
 import { BACKUP_KINDS } from "../shared/types.js";
-import { isRecord } from "./scan/data.js";
+import { isRecord, parseJson } from "./scan/data.js";
 import {} from "./scan/env.js";
 import { isCredentials, isSecretPath, revisionOf } from "./scan/files.js";
 import { jsonSyntaxError } from "./secrets.js";
@@ -24,8 +24,6 @@ export function changeQueue() {
         return run;
     };
 }
-/** The queue the save functions use when they are called without a core's. */
-export const serially = changeQueue();
 /**
  * Plans a change again and makes it, but only when it has no errors and everything it was worked
  * out from is as reviewed; `changed` is the refusal otherwise. Planning and saving share one turn
@@ -91,7 +89,7 @@ export async function readJsonObject(env, path) {
         return { raw, data: {}, reformats: false };
     let parsed;
     try {
-        parsed = JSON.parse(raw);
+        parsed = parseJson(raw);
     }
     catch (error) {
         throw new RefusedError(`${path} is ${jsonSyntaxError(error)}; fix it by hand first.`);

package/dist/shared/memory.d.ts

@@ -1,2 +1,6 @@
-/** Claude Code names a project's store after its path with every non-alphanumeric character as "-". */
+/**
+ * Claude Code names a project's store after its path with every non-alphanumeric character as "-".
+ * A name over 200 characters is cut there and ends with "-" and a hash of the whole path, so deep
+ * paths that share a start get different stores (observed in the SDK 0.3.296; the docs do not say).
+ */
 export declare function storeDirName(projectPath: string): string;

package/dist/shared/memory.js

@@ -1,4 +1,20 @@
-/** Claude Code names a project's store after its path with every non-alphanumeric character as "-". */
+/** Longest store name Claude Code keeps as it is; a longer one is cut and given a hash of the path. */
+const MAX_STORE_NAME = 200;
+/**
+ * Claude Code names a project's store after its path with every non-alphanumeric character as "-".
+ * A name over 200 characters is cut there and ends with "-" and a hash of the whole path, so deep
+ * paths that share a start get different stores (observed in the SDK 0.3.296; the docs do not say).
+ */
 export function storeDirName(projectPath) {
-    return projectPath.replace(/[^a-zA-Z0-9]/g, "-");
+    const name = projectPath.replace(/[^a-zA-Z0-9]/g, "-");
+    if (name.length <= MAX_STORE_NAME)
+        return name;
+    return `${name.slice(0, MAX_STORE_NAME)}-${Math.abs(pathHash(projectPath)).toString(36)}`;
+}
+/** Java's 32-bit string hash, over UTF-16 code units, as Claude Code computes it. */
+function pathHash(text) {
+    let hash = 0;
+    for (let i = 0; i < text.length; i++)
+        hash = ((hash << 5) - hash + text.charCodeAt(i)) | 0;
+    return hash;
 }

package/dist/shared/types.d.ts

@@ -100,6 +100,11 @@ export interface SettingsLayer {
     error?: string;
     /** For managed settings: a file that is not a JSON object, so Claude Code refuses to start. */
     blocksStart?: boolean;
+    /**
+     * For managed settings: managed sources that rank above these files and that ccdesk does not
+     * read, such as the server-managed settings cache or a macOS configuration profile.
+     */
+    higherSources?: string[];
 }
 export interface EffectiveSetting {
     key: string;