ccperm 1.11.3 → 1.12.1

package/dist/advisor.js

@@ -134,7 +134,21 @@ function analyze(results) {
         const topStr = top.map(([p, c]) => `${p} (${c})`).join(', ');
         hints.push(`${heredocTotal} one-time/heredoc permissions found (${topStr}). Safe to remove.`);
     }
-    // 3. Global check
+    // 3. WebFetch → suggest global wildcard
+    let webFetchTotal = 0;
+    let webFetchProjects = 0;
+    for (const r of results) {
+        const wf = r.groups.find((g) => g.category === 'WebFetch');
+        if (wf) {
+            webFetchTotal += wf.items.length;
+            webFetchProjects++;
+        }
+    }
+    const hasGlobalWebFetch = results.some((r) => r.isGlobal && r.groups.some((g) => g.category === 'WebFetch'));
+    if (webFetchProjects >= 3 && !hasGlobalWebFetch) {
+        hints.push(`WebFetch permissions found in ${webFetchProjects} projects (${webFetchTotal} domains total). WebFetch is read-only — add \`"WebFetch(*)"\` to ~/.claude/settings.json to skip per-domain approval globally.`);
+    }
+    // 4. Global check
     const globalEntries = entries.filter((e) => e.isGlobal);
     const globalPerms = globalEntries.reduce((sum, e) => sum + e.totalCount, 0);
     if (globalPerms === 0 && frequent.length > 0) {

package/dist/cli.js

@@ -95,12 +95,23 @@ async function main() {
     }
     console.log(`  ${colors_js_1.GREEN}✔${colors_js_1.NC} Found ${colors_js_1.CYAN}${files.length}${colors_js_1.NC} settings files\n`);
     const results = files.map(scanner_js_1.scanFile).filter((r) => r !== null);
-    const entries = (0, aggregator_js_1.toFileEntries)(results);
-    const summary = (0, aggregator_js_1.summarize)(results);
     if (args.includes('--hey-claude-witness-me')) {
         console.log((0, advisor_js_1.analyze)(results));
         return;
     }
+    const entries = (0, aggregator_js_1.toFileEntries)(results);
+    const summary = (0, aggregator_js_1.summarize)(results);
+    if (args.includes('--fix')) {
+        const affected = (0, scanner_js_1.countDeprecated)(results);
+        if (affected.length === 0) {
+            console.log(`  ${colors_js_1.GREEN}✔ Nothing to fix.${colors_js_1.NC}\n`);
+            return;
+        }
+        const { totalPatterns, fixedFiles } = (0, fixer_js_1.fixFiles)(affected);
+        console.log(`  ${colors_js_1.GREEN}✔ Fixed ${totalPatterns} patterns in ${fixedFiles} files.${colors_js_1.NC}`);
+        console.log(`  ${colors_js_1.DIM}Restart Claude Code for changes to take effect.${colors_js_1.NC}\n`);
+        return;
+    }
     if (!isStatic) {
         await (0, interactive_js_1.startInteractive)(entries, results);
         return;
@@ -112,16 +123,6 @@ async function main() {
         (0, renderer_js_1.printCompact)(entries, summary);
     }
     (0, renderer_js_1.printFooter)(summary);
-    if (args.includes('--fix')) {
-        const affected = (0, scanner_js_1.countDeprecated)(results);
-        if (affected.length === 0) {
-            console.log(`\n  ${colors_js_1.GREEN}✔ Nothing to fix.${colors_js_1.NC}\n`);
-            return;
-        }
-        const { totalPatterns, fixedFiles } = (0, fixer_js_1.fixFiles)(affected);
-        console.log(`\n  ${colors_js_1.GREEN}✔ Fixed ${totalPatterns} patterns in ${fixedFiles} files.${colors_js_1.NC}`);
-        console.log(`  ${colors_js_1.DIM}Restart Claude Code for changes to take effect.${colors_js_1.NC}\n`);
-    }
 }
 main();
 (0, updater_js_1.notifyUpdate)();

package/dist/explain.js

@@ -266,11 +266,12 @@ function explainTool(label) {
 function explain(category, label) {
     if (category === 'Bash')
         return explainBash(label);
-    if (category === 'WebFetch')
-        return explainWebFetch(label);
     if (category === 'MCP')
         return explainMcp(label);
-    if (category === 'Tools')
+    if (category === 'Tools') {
+        if (label.startsWith('WebFetch'))
+            return explainWebFetch(label);
         return explainTool(label);
+    }
     return { description: '', risk: 'medium' };
 }

package/dist/interactive.js

@@ -27,8 +27,7 @@ function cleanLabel(label) {
     // Truncate inline scripts with \n
     if (s.includes('\\n'))
         s = s.replace(/\\n.*$/, '…');
-    // Strip :* and trailing * suffix
-    s = s.replace(/:\*$/, ' *');
+    // Show deprecated :* as-is (don't normalize to space)
     return s;
 }
 // strip ANSI escape codes for visible length
@@ -62,6 +61,8 @@ function startInteractive(merged, results) {
         const projects = merged.filter((r) => r.totalCount > 0 && !r.isGlobal).sort((a, b) => b.totalCount - a.totalCount);
         const withPerms = [...globals, ...projects];
         const emptyCount = merged.filter((r) => r.totalCount === 0 && !r.isGlobal).length;
+        const riskMap = buildRiskMap(results);
+        const depMap = buildDeprecatedMap(results);
         if (withPerms.length === 0) {
             console.log(`\n  ${colors_js_1.GREEN}No projects with permissions found.${colors_js_1.NC}\n`);
             resolve();
@@ -85,7 +86,7 @@ function startInteractive(merged, results) {
         const render = () => {
             process.stdout.write('\x1b[2J\x1b[H\x1b[?25l');
             if (state.view === 'list')
-                renderList(state, withPerms, emptyCount);
+                renderList(state, withPerms, emptyCount, riskMap, depMap);
             else
                 renderDetail(state, withPerms, results);
         };
@@ -136,19 +137,53 @@ function startInteractive(merged, results) {
         render();
     });
 }
-function renderList(state, withPerms, emptyCount) {
+function buildDeprecatedMap(results) {
+    const map = new Map();
+    for (const r of results) {
+        let count = 0;
+        for (const p of r.permissions) {
+            if (p.includes(':*'))
+                count++;
+        }
+        if (count > 0)
+            map.set(r.display, count);
+    }
+    return map;
+}
+function buildRiskMap(results) {
+    const map = new Map();
+    for (const r of results) {
+        let crit = 0, hi = 0;
+        for (const g of r.groups) {
+            for (const item of g.items) {
+                const info = (0, explain_js_1.explain)(g.category, item.name);
+                if (info.risk === 'critical')
+                    crit++;
+                else if (info.risk === 'high')
+                    hi++;
+            }
+        }
+        map.set(r.display, { critical: crit, high: hi });
+    }
+    return map;
+}
+function renderList(state, withPerms, emptyCount, riskMap, depMap) {
     const rows = process.stdout.rows || 24;
     const cols = process.stdout.columns || 80;
-    const cats = ['Bash', 'WebFetch', 'MCP', 'Tools'];
+    const cats = ['Bash', 'MCP', 'Tools'];
     const catsPresent = cats.filter((c) => withPerms.some((r) => r.groups.has(c)));
+    const hasRisk = [...riskMap.values()].some((v) => v.critical > 0 || v.high > 0);
+    const hasDep = depMap.size > 0;
+    const riskColWidth = hasRisk ? 3 : 0;
+    const depColWidth = hasDep ? 3 : 0;
     const catColWidth = catsPresent.length * 7;
-    const typeColWidth = 7; // " local " or " shared"
+    const typeColWidth = 7;
     const maxName = Math.max(...withPerms.map((r) => r.shortName.length), 7);
-    const nameColWidth = Math.min(maxName + typeColWidth, 35); // name + type combined
+    const nameColWidth = Math.min(maxName + typeColWidth, 35);
     const nameWidth = nameColWidth - typeColWidth;
-    // content: marker(2) + nameCol(nameColWidth) + gap(2) + catCols + gap(2) + total(5)
-    const contentWidth = 2 + nameColWidth + 2 + catColWidth + 2 + 5;
-    const w = Math.min(cols, contentWidth + 4); // +4 for box borders + padding
+    // content: marker(2) + nameCol + gap(2) + catCols + gap(2) + total(5) + riskCol(3) + depCol(3)
+    const contentWidth = 2 + nameColWidth + 2 + catColWidth + 2 + 5 + (hasRisk ? riskColWidth : 0) + (hasDep ? depColWidth : 0);
+    const w = Math.min(cols, contentWidth + 4);
     const inner = w - 4;
     const hasGlobalSep = withPerms.some((r) => r.isGlobal) && withPerms.some((r) => !r.isGlobal);
     // box takes: top(1) + header(2) + sep(1) + content + globalSep?(1) + emptyLine?(1) + bottom(1)
@@ -161,7 +196,9 @@ function renderList(state, withPerms, emptyCount) {
     const scrollInfo = withPerms.length > visibleRows ? `${state.cursor + 1}/${withPerms.length}` : '';
     const lines = [];
     lines.push(boxTop('ccperm', scrollInfo, w));
-    lines.push(boxLine(`${colors_js_1.DIM}${pad('PROJECT', nameColWidth)}  ${catsPresent.map((c) => rpad(c, 5)).join('  ')}  TOTAL${colors_js_1.NC}`, w));
+    const riskHeader = hasRisk ? ` ${rpad('!', 2)}` : '';
+    const depHeader = hasDep ? ` ${rpad('†', 2)}` : '';
+    lines.push(boxLine(`${colors_js_1.DIM}  ${pad('PROJECT', nameColWidth)}  ${catsPresent.map((c) => rpad(c, 5)).join('  ')}  ${rpad('TOTAL', 5)}${riskHeader}${depHeader}${colors_js_1.NC}`, w));
     lines.push(boxSep(w));
     const globalCount = withPerms.filter((r) => r.isGlobal).length;
     const end = Math.min(state.scrollOffset + visibleRows, withPerms.length);
@@ -180,7 +217,25 @@ function renderList(state, withPerms, emptyCount) {
             return `${colors_js_1.DIM}${rpad('·', 5)}${colors_js_1.NC}`;
         }).join('  ');
         const totalCol = isCursor ? `${colors_js_1.BOLD}${rpad(r.totalCount, 5)}${colors_js_1.NC}` : rpad(r.totalCount, 5);
-        lines.push(boxLine(`${nameCol}  ${catCols}  ${totalCol}`, w));
+        let riskCol = '';
+        if (hasRisk) {
+            const risk = riskMap.get(r.display) || { critical: 0, high: 0 };
+            if (risk.critical > 0)
+                riskCol = ` ${colors_js_1.RED}${rpad(risk.critical, 2)}${colors_js_1.NC}`;
+            else if (risk.high > 0)
+                riskCol = ` ${colors_js_1.YELLOW}${rpad(risk.high, 2)}${colors_js_1.NC}`;
+            else
+                riskCol = ` ${colors_js_1.DIM}${rpad('·', 2)}${colors_js_1.NC}`;
+        }
+        let depCol = '';
+        if (hasDep) {
+            const dep = depMap.get(r.display) || 0;
+            if (dep > 0)
+                depCol = ` ${colors_js_1.DIM}${rpad(dep, 2)}${colors_js_1.NC}`;
+            else
+                depCol = ` ${colors_js_1.DIM}${rpad('·', 2)}${colors_js_1.NC}`;
+        }
+        lines.push(boxLine(`${nameCol}  ${catCols}  ${totalCol}${riskCol}${depCol}`, w));
         // separator after global section
         if (r.isGlobal && i + 1 < withPerms.length && !withPerms[i + 1].isGlobal) {
             lines.push(boxSep(w));

package/dist/renderer.js

@@ -12,7 +12,7 @@ function rpad(s, n) {
     return str.length >= n ? str : ' '.repeat(n - str.length) + str;
 }
 function printCompact(entries, summary) {
-    const cats = ['Bash', 'WebFetch', 'MCP', 'Tools'];
+    const cats = ['Bash', 'MCP', 'Tools'];
     const catsPresent = cats.filter((c) => entries.some((r) => r.groups.has(c)));
     const globals = entries.filter((r) => r.isGlobal);
     const projects = entries.filter((r) => r.totalCount > 0 && !r.isGlobal).sort((a, b) => b.totalCount - a.totalCount);

package/dist/scanner.js

@@ -111,14 +111,10 @@ function categorize(perm) {
         const m = perm.match(/^Bash\((.+)\)$/) || perm.match(/^Bash\((.+)/);
         return { category: 'Bash', label: m ? m[1] : perm };
     }
-    if (perm.startsWith('WebFetch')) {
-        const m = perm.match(/^WebFetch\(domain:(.+)\)$/);
-        return { category: 'WebFetch', label: m ? m[1] : perm };
-    }
     if (perm.startsWith('mcp_') || perm.startsWith('mcp__')) {
         return { category: 'MCP', label: perm };
     }
-    if (/^(Read|Write|Edit|Glob|Grep|WebSearch)/.test(perm)) {
+    if (/^(Read|Write|Edit|Glob|Grep|WebSearch|WebFetch)/.test(perm)) {
         return { category: 'Tools', label: perm };
     }
     return { category: 'Other', label: perm };
@@ -131,6 +127,6 @@ function groupPermissions(perms) {
             map.set(category, []);
         map.get(category).push({ name: label });
     }
-    const order = ['Bash', 'WebFetch', 'MCP', 'Tools', 'Other'];
+    const order = ['Bash', 'MCP', 'Tools', 'Other'];
     return order.filter((c) => map.has(c)).map((c) => ({ category: c, items: map.get(c) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccperm",
-  "version": "1.11.3",
+  "version": "1.12.1",
   "description": "Audit Claude Code permissions across all your projects",
   "bin": {
     "ccperm": "bin/ccperm.js"