ccperm 1.12.0 → 1.13.0

package/dist/advisor.js

@@ -134,7 +134,21 @@ function analyze(results) {
         const topStr = top.map(([p, c]) => `${p} (${c})`).join(', ');
         hints.push(`${heredocTotal} one-time/heredoc permissions found (${topStr}). Safe to remove.`);
     }
-    // 3. Global check
+    // 3. WebFetch → suggest global wildcard
+    let webFetchTotal = 0;
+    let webFetchProjects = 0;
+    for (const r of results) {
+        const wf = r.groups.find((g) => g.category === 'WebFetch');
+        if (wf) {
+            webFetchTotal += wf.items.length;
+            webFetchProjects++;
+        }
+    }
+    const hasGlobalWebFetch = results.some((r) => r.isGlobal && r.groups.some((g) => g.category === 'WebFetch'));
+    if (webFetchProjects >= 3 && !hasGlobalWebFetch) {
+        hints.push(`WebFetch permissions found in ${webFetchProjects} projects (${webFetchTotal} domains total). WebFetch is read-only — add \`"WebFetch(*)"\` to ~/.claude/settings.json to skip per-domain approval globally.`);
+    }
+    // 4. Global check
     const globalEntries = entries.filter((e) => e.isGlobal);
     const globalPerms = globalEntries.reduce((sum, e) => sum + e.totalCount, 0);
     if (globalPerms === 0 && frequent.length > 0) {

package/dist/cli.js

@@ -95,12 +95,23 @@ async function main() {
     }
     console.log(`  ${colors_js_1.GREEN}✔${colors_js_1.NC} Found ${colors_js_1.CYAN}${files.length}${colors_js_1.NC} settings files\n`);
     const results = files.map(scanner_js_1.scanFile).filter((r) => r !== null);
-    const entries = (0, aggregator_js_1.toFileEntries)(results);
-    const summary = (0, aggregator_js_1.summarize)(results);
     if (args.includes('--hey-claude-witness-me')) {
         console.log((0, advisor_js_1.analyze)(results));
         return;
     }
+    const entries = (0, aggregator_js_1.toFileEntries)(results);
+    const summary = (0, aggregator_js_1.summarize)(results);
+    if (args.includes('--fix')) {
+        const affected = (0, scanner_js_1.countDeprecated)(results);
+        if (affected.length === 0) {
+            console.log(`  ${colors_js_1.GREEN}✔ Nothing to fix.${colors_js_1.NC}\n`);
+            return;
+        }
+        const { totalPatterns, fixedFiles } = (0, fixer_js_1.fixFiles)(affected);
+        console.log(`  ${colors_js_1.GREEN}✔ Fixed ${totalPatterns} patterns in ${fixedFiles} files.${colors_js_1.NC}`);
+        console.log(`  ${colors_js_1.DIM}Restart Claude Code for changes to take effect.${colors_js_1.NC}\n`);
+        return;
+    }
     if (!isStatic) {
         await (0, interactive_js_1.startInteractive)(entries, results);
         return;
@@ -112,16 +123,6 @@ async function main() {
         (0, renderer_js_1.printCompact)(entries, summary);
     }
     (0, renderer_js_1.printFooter)(summary);
-    if (args.includes('--fix')) {
-        const affected = (0, scanner_js_1.countDeprecated)(results);
-        if (affected.length === 0) {
-            console.log(`\n  ${colors_js_1.GREEN}✔ Nothing to fix.${colors_js_1.NC}\n`);
-            return;
-        }
-        const { totalPatterns, fixedFiles } = (0, fixer_js_1.fixFiles)(affected);
-        console.log(`\n  ${colors_js_1.GREEN}✔ Fixed ${totalPatterns} patterns in ${fixedFiles} files.${colors_js_1.NC}`);
-        console.log(`  ${colors_js_1.DIM}Restart Claude Code for changes to take effect.${colors_js_1.NC}\n`);
-    }
 }
 main();
 (0, updater_js_1.notifyUpdate)();

package/dist/explain.js

@@ -266,11 +266,12 @@ function explainTool(label) {
 function explain(category, label) {
     if (category === 'Bash')
         return explainBash(label);
-    if (category === 'WebFetch')
-        return explainWebFetch(label);
     if (category === 'MCP')
         return explainMcp(label);
-    if (category === 'Tools')
+    if (category === 'Tools') {
+        if (label.startsWith('WebFetch'))
+            return explainWebFetch(label);
         return explainTool(label);
+    }
     return { description: '', risk: 'medium' };
 }

package/dist/interactive.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.startInteractive = startInteractive;
 const node_readline_1 = __importDefault(require("node:readline"));
 const colors_js_1 = require("./colors.js");
+const scanner_js_1 = require("./scanner.js");
 const explain_js_1 = require("./explain.js");
 function severityTag(s) {
     const labels = {
@@ -27,8 +28,7 @@ function cleanLabel(label) {
     // Truncate inline scripts with \n
     if (s.includes('\\n'))
         s = s.replace(/\\n.*$/, '…');
-    // Strip :* and trailing * suffix
-    s = s.replace(/:\*$/, ' *');
+    // Show deprecated :* as-is (don't normalize to space)
     return s;
 }
 // strip ANSI escape codes for visible length
@@ -50,7 +50,7 @@ function boxTop(title, info, width) {
 function boxBottom(hint, width) {
     const inner = width - 2;
     const hintPart = ` ${hint} `;
-    const fill = Math.max(0, inner - hintPart.length);
+    const fill = Math.max(0, inner - visLen(hintPart));
     return `${colors_js_1.DIM}└${'─'.repeat(fill)}${hintPart}┘${colors_js_1.NC}`;
 }
 function boxSep(width) {
@@ -63,6 +63,7 @@ function startInteractive(merged, results) {
         const withPerms = [...globals, ...projects];
         const emptyCount = merged.filter((r) => r.totalCount === 0 && !r.isGlobal).length;
         const riskMap = buildRiskMap(results);
+        const depMap = buildDeprecatedMap(results);
         if (withPerms.length === 0) {
             console.log(`\n  ${colors_js_1.GREEN}No projects with permissions found.${colors_js_1.NC}\n`);
             resolve();
@@ -86,7 +87,7 @@ function startInteractive(merged, results) {
         const render = () => {
             process.stdout.write('\x1b[2J\x1b[H\x1b[?25l');
             if (state.view === 'list')
-                renderList(state, withPerms, emptyCount, riskMap);
+                renderList(state, withPerms, emptyCount, riskMap, depMap);
             else
                 renderDetail(state, withPerms, results);
         };
@@ -113,7 +114,42 @@ function startInteractive(merged, results) {
                 }
             }
             else {
-                if (key.name === 'escape' || key.name === 'backspace') {
+                if (state.confirmDelete) {
+                    if (key.name === 'y') {
+                        const { rawPerm, filePath } = state.confirmDelete;
+                        if ((0, scanner_js_1.removePerm)(filePath, rawPerm)) {
+                            const idx = results.findIndex((r) => r.path === filePath);
+                            if (idx >= 0) {
+                                const updated = (0, scanner_js_1.scanFile)(filePath);
+                                if (updated) {
+                                    results[idx] = updated;
+                                    const entry = withPerms[state.selectedProject];
+                                    entry.totalCount = updated.totalCount;
+                                    entry.groups = new Map();
+                                    for (const g of updated.groups)
+                                        entry.groups.set(g.category, g.items.length);
+                                }
+                            }
+                            state.flash = `${colors_js_1.GREEN}✔ Deleted${colors_js_1.NC}`;
+                        }
+                        state.confirmDelete = undefined;
+                    }
+                    else {
+                        state.confirmDelete = undefined;
+                    }
+                }
+                else if (state.confirmGlobal) {
+                    if (key.name === 'y') {
+                        if ((0, scanner_js_1.addPermToGlobal)(state.confirmGlobal.rawPerm)) {
+                            state.flash = `${colors_js_1.GREEN}✔ Copied to global${colors_js_1.NC}`;
+                        }
+                        else {
+                            state.flash = `${colors_js_1.DIM}· Already in global${colors_js_1.NC}`;
+                        }
+                    }
+                    state.confirmGlobal = undefined;
+                }
+                else if (key.name === 'escape' || key.name === 'backspace') {
                     state.view = 'list';
                     state.detailCursor = 0;
                     state.detailScroll = 0;
@@ -130,6 +166,12 @@ function startInteractive(merged, results) {
                 else if (key.name === 'i') {
                     state.showInfo = !state.showInfo;
                 }
+                else if (key.name === 'd') {
+                    state._delete = true;
+                }
+                else if (key.name === 'g') {
+                    state._global = true;
+                }
             }
             render();
         };
@@ -137,6 +179,19 @@ function startInteractive(merged, results) {
         render();
     });
 }
+function buildDeprecatedMap(results) {
+    const map = new Map();
+    for (const r of results) {
+        let count = 0;
+        for (const p of r.permissions) {
+            if (p.includes(':*'))
+                count++;
+        }
+        if (count > 0)
+            map.set(r.display, count);
+    }
+    return map;
+}
 function buildRiskMap(results) {
     const map = new Map();
     for (const r of results) {
@@ -154,20 +209,22 @@ function buildRiskMap(results) {
     }
     return map;
 }
-function renderList(state, withPerms, emptyCount, riskMap) {
+function renderList(state, withPerms, emptyCount, riskMap, depMap) {
     const rows = process.stdout.rows || 24;
     const cols = process.stdout.columns || 80;
-    const cats = ['Bash', 'WebFetch', 'MCP', 'Tools'];
+    const cats = ['Bash', 'MCP', 'Tools'];
     const catsPresent = cats.filter((c) => withPerms.some((r) => r.groups.has(c)));
     const hasRisk = [...riskMap.values()].some((v) => v.critical > 0 || v.high > 0);
+    const hasDep = depMap.size > 0;
     const riskColWidth = hasRisk ? 3 : 0;
+    const depColWidth = hasDep ? 3 : 0;
     const catColWidth = catsPresent.length * 7;
     const typeColWidth = 7;
     const maxName = Math.max(...withPerms.map((r) => r.shortName.length), 7);
     const nameColWidth = Math.min(maxName + typeColWidth, 35);
     const nameWidth = nameColWidth - typeColWidth;
-    // content: marker(2) + nameCol + gap(2) + catCols + gap(2) + total(5) + gap(1) + riskCol
-    const contentWidth = 2 + nameColWidth + 2 + catColWidth + 2 + 5 + (hasRisk ? 1 + riskColWidth : 0);
+    // content: marker(2) + nameCol + gap(2) + catCols + gap(2) + total(5) + riskCol(3) + depCol(3)
+    const contentWidth = 2 + nameColWidth + 2 + catColWidth + 2 + 5 + (hasRisk ? riskColWidth : 0) + (hasDep ? depColWidth : 0);
     const w = Math.min(cols, contentWidth + 4);
     const inner = w - 4;
     const hasGlobalSep = withPerms.some((r) => r.isGlobal) && withPerms.some((r) => !r.isGlobal);
@@ -181,8 +238,9 @@ function renderList(state, withPerms, emptyCount, riskMap) {
     const scrollInfo = withPerms.length > visibleRows ? `${state.cursor + 1}/${withPerms.length}` : '';
     const lines = [];
     lines.push(boxTop('ccperm', scrollInfo, w));
-    const riskHeader = hasRisk ? ` ${colors_js_1.DIM}⚠${colors_js_1.NC}` : '';
-    lines.push(boxLine(`${colors_js_1.DIM}${pad('PROJECT', nameColWidth)}  ${catsPresent.map((c) => rpad(c, 5)).join('  ')}  TOTAL${colors_js_1.NC}${riskHeader}`, w));
+    const riskHeader = hasRisk ? ` ${rpad('!', 2)}` : '';
+    const depHeader = hasDep ? ` ${rpad('†', 2)}` : '';
+    lines.push(boxLine(`${colors_js_1.DIM}  ${pad('PROJECT', nameColWidth)}  ${catsPresent.map((c) => rpad(c, 5)).join('  ')}  ${rpad('TOTAL', 5)}${riskHeader}${depHeader}${colors_js_1.NC}`, w));
     lines.push(boxSep(w));
     const globalCount = withPerms.filter((r) => r.isGlobal).length;
     const end = Math.min(state.scrollOffset + visibleRows, withPerms.length);
@@ -211,7 +269,15 @@ function renderList(state, withPerms, emptyCount, riskMap) {
             else
                 riskCol = ` ${colors_js_1.DIM}${rpad('·', 2)}${colors_js_1.NC}`;
         }
-        lines.push(boxLine(`${nameCol}  ${catCols}  ${totalCol}${riskCol}`, w));
+        let depCol = '';
+        if (hasDep) {
+            const dep = depMap.get(r.display) || 0;
+            if (dep > 0)
+                depCol = ` ${colors_js_1.DIM}${rpad(dep, 2)}${colors_js_1.NC}`;
+            else
+                depCol = ` ${colors_js_1.DIM}${rpad('·', 2)}${colors_js_1.NC}`;
+        }
+        lines.push(boxLine(`${nameCol}  ${catCols}  ${totalCol}${riskCol}${depCol}`, w));
         // separator after global section
         if (r.isGlobal && i + 1 < withPerms.length && !withPerms[i + 1].isGlobal) {
             lines.push(boxSep(w));
@@ -243,6 +309,8 @@ function renderDetail(state, withPerms, results) {
         if (isOpen) {
             for (const item of group.items) {
                 const clean = cleanLabel(item.name);
+                // Find the raw permission string from the original permissions array
+                const rawPerm = fileResult.permissions.find((p) => p.includes(item.name)) || '';
                 if (state.showInfo) {
                     const info = (0, explain_js_1.explain)(group.category, item.name);
                     const tag = severityTag(info.risk);
@@ -250,12 +318,12 @@ function renderDetail(state, withPerms, results) {
                     const nameMax = Math.min(30, w - tagLen - 14);
                     const name = clean.length > nameMax ? clean.slice(0, nameMax - 1) + '…' : clean;
                     const desc = info.description ? `${colors_js_1.DIM}${info.description}${colors_js_1.NC}` : '';
-                    navRows.push({ text: `  ${pad(name, nameMax)} ${tag} ${desc}`, perm: item.name });
+                    navRows.push({ text: `  ${pad(name, nameMax)} ${tag} ${desc}`, perm: item.name, rawPerm });
                 }
                 else {
                     const maxLen = w - 8;
                     const name = clean.length > maxLen ? clean.slice(0, maxLen - 1) + '…' : clean;
-                    navRows.push({ text: `  ${colors_js_1.DIM}${name}${colors_js_1.NC}`, perm: item.name });
+                    navRows.push({ text: `  ${colors_js_1.DIM}${name}${colors_js_1.NC}`, perm: item.name, rawPerm });
                 }
             }
         }
@@ -273,6 +341,22 @@ function renderDetail(state, withPerms, results) {
             return;
         }
     }
+    // handle delete
+    if (state._delete) {
+        delete state._delete;
+        const row = navRows[state.detailCursor];
+        if (row?.rawPerm) {
+            state.confirmDelete = { perm: row.perm, rawPerm: row.rawPerm, filePath: fileResult.path };
+        }
+    }
+    // handle global copy
+    if (state._global) {
+        delete state._global;
+        const row = navRows[state.detailCursor];
+        if (row?.rawPerm && !project.isGlobal) {
+            state.confirmGlobal = { perm: row.perm, rawPerm: row.rawPerm };
+        }
+    }
     if (state.detailCursor >= navRows.length)
         state.detailCursor = Math.max(0, navRows.length - 1);
     // box chrome: top(1) + sep(1) + bottom(1) = 3
@@ -293,8 +377,25 @@ function renderDetail(state, withPerms, results) {
         const prefix = isCursor ? `${colors_js_1.CYAN}▸ ` : '  ';
         lines.push(boxLine(`${prefix}${row.text}`, w));
     }
-    const infoHint = state.showInfo ? '[i] hide info' : '[i] info';
-    lines.push(boxBottom(`[↑↓] navigate  [Enter] expand  ${infoHint}  [Esc] back  [q] quit`, w));
+    if (state.flash) {
+        lines.push(boxBottom(state.flash, w));
+        state.flash = undefined;
+    }
+    else if (state.confirmDelete) {
+        const name = cleanLabel(state.confirmDelete.perm);
+        const truncName = name.length > 30 ? name.slice(0, 29) + '…' : name;
+        lines.push(boxBottom(`${colors_js_1.RED}Delete "${truncName}"? [y/N]${colors_js_1.NC}`, w));
+    }
+    else if (state.confirmGlobal) {
+        const name = cleanLabel(state.confirmGlobal.perm);
+        const truncName = name.length > 30 ? name.slice(0, 29) + '…' : name;
+        lines.push(boxBottom(`${colors_js_1.CYAN}Copy "${truncName}" to global? [y/N]${colors_js_1.NC}`, w));
+    }
+    else {
+        const infoHint = state.showInfo ? '[i] hide info' : '[i] info';
+        const globalHint = project.isGlobal ? '' : '  [g] global';
+        lines.push(boxBottom(`[↑↓] navigate  [Enter] expand  ${infoHint}  [d] delete${globalHint}  [Esc] back  [q] quit`, w));
+    }
     process.stdout.write(lines.join('\n') + '\n');
 }
 function pad(s, n) {

package/dist/renderer.js

@@ -12,7 +12,7 @@ function rpad(s, n) {
     return str.length >= n ? str : ' '.repeat(n - str.length) + str;
 }
 function printCompact(entries, summary) {
-    const cats = ['Bash', 'WebFetch', 'MCP', 'Tools'];
+    const cats = ['Bash', 'MCP', 'Tools'];
     const catsPresent = cats.filter((c) => entries.some((r) => r.groups.has(c)));
     const globals = entries.filter((r) => r.isGlobal);
     const projects = entries.filter((r) => r.totalCount > 0 && !r.isGlobal).sort((a, b) => b.totalCount - a.totalCount);

package/dist/scanner.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.removePerm = removePerm;
+exports.addPermToGlobal = addPermToGlobal;
 exports.countDeprecated = countDeprecated;
 exports.findSettingsFiles = findSettingsFiles;
 exports.scanFile = scanFile;
@@ -11,6 +13,72 @@ const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
 const PERM_RE = /"(Bash|Write|Edit|Read|Glob|Grep|WebSearch|WebFetch|mcp_)[^"]*"/g;
 const DEPRECATED_RE = /:\*\)|:\*"/g;
+const AUDIT_DIR = node_path_1.default.join(node_os_1.default.homedir(), '.ccperm', 'audit');
+function writeAudit(action, filePath, perm, before, after) {
+    try {
+        node_fs_1.default.mkdirSync(AUDIT_DIR, { recursive: true });
+        const ts = new Date().toISOString().replace(/[:.]/g, '-');
+        const entry = { action, file: filePath, perm, before, after, timestamp: new Date().toISOString() };
+        node_fs_1.default.writeFileSync(node_path_1.default.join(AUDIT_DIR, `${ts}_${action}.json`), JSON.stringify(entry, null, 2) + '\n');
+    }
+    catch { /* audit is best-effort */ }
+}
+function removePerm(filePath, rawPerm) {
+    let content;
+    try {
+        content = node_fs_1.default.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return false;
+    }
+    let json;
+    try {
+        json = JSON.parse(content);
+    }
+    catch {
+        return false;
+    }
+    const allow = json?.permissions?.allow;
+    if (!Array.isArray(allow))
+        return false;
+    const idx = allow.indexOf(rawPerm);
+    if (idx === -1)
+        return false;
+    const before = [...allow];
+    allow.splice(idx, 1);
+    node_fs_1.default.writeFileSync(filePath, JSON.stringify(json, null, 2) + '\n', 'utf8');
+    writeAudit('DELETE', filePath, rawPerm, before, allow);
+    return true;
+}
+function addPermToGlobal(rawPerm) {
+    const globalPath = node_path_1.default.join(node_os_1.default.homedir(), '.claude', 'settings.json');
+    let content;
+    try {
+        content = node_fs_1.default.readFileSync(globalPath, 'utf8');
+    }
+    catch {
+        content = '{}';
+    }
+    let json;
+    try {
+        json = JSON.parse(content);
+    }
+    catch {
+        return false;
+    }
+    if (!json.permissions)
+        json.permissions = {};
+    if (!Array.isArray(json.permissions.allow))
+        json.permissions.allow = [];
+    const allow = json.permissions.allow;
+    if (allow.includes(rawPerm))
+        return false; // already exists
+    const before = [...allow];
+    allow.push(rawPerm);
+    node_fs_1.default.writeFileSync(globalPath, JSON.stringify(json, null, 2) + '\n', 'utf8');
+    writeAudit('COPY_TO_GLOBAL', globalPath, rawPerm, before, allow);
+    return true;
+}
 function countDeprecated(results) {
     const out = [];
     for (const r of results) {
@@ -111,14 +179,10 @@ function categorize(perm) {
         const m = perm.match(/^Bash\((.+)\)$/) || perm.match(/^Bash\((.+)/);
         return { category: 'Bash', label: m ? m[1] : perm };
     }
-    if (perm.startsWith('WebFetch')) {
-        const m = perm.match(/^WebFetch\(domain:(.+)\)$/);
-        return { category: 'WebFetch', label: m ? m[1] : perm };
-    }
     if (perm.startsWith('mcp_') || perm.startsWith('mcp__')) {
         return { category: 'MCP', label: perm };
     }
-    if (/^(Read|Write|Edit|Glob|Grep|WebSearch)/.test(perm)) {
+    if (/^(Read|Write|Edit|Glob|Grep|WebSearch|WebFetch)/.test(perm)) {
         return { category: 'Tools', label: perm };
     }
     return { category: 'Other', label: perm };
@@ -131,6 +195,6 @@ function groupPermissions(perms) {
             map.set(category, []);
         map.get(category).push({ name: label });
     }
-    const order = ['Bash', 'WebFetch', 'MCP', 'Tools', 'Other'];
+    const order = ['Bash', 'MCP', 'Tools', 'Other'];
     return order.filter((c) => map.has(c)).map((c) => ({ category: c, items: map.get(c) }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccperm",
-  "version": "1.12.0",
+  "version": "1.13.0",
   "description": "Audit Claude Code permissions across all your projects",
   "bin": {
     "ccperm": "bin/ccperm.js"