ccperm 1.12.1 → 1.14.0

package/README.ko.md

@@ -6,7 +6,7 @@
 
 Claude Code는 프로젝트마다 `.claude/settings*.json`에 허용한 권한(Bash 명령, WebFetch 도메인, MCP 도구 등)을 저장합니다. 여러 프로젝트를 오가다 보면 어디서 뭘 허용했는지 파악하기 어려운데, **ccperm**은 홈 디렉토리 전체를 스캔해서 모든 설정 파일을 찾고, 인터랙티브 TUI 또는 텍스트로 보여줍니다.
 
-<img src="./screenshot.png" width="600" />
+<img src="./demo.gif" width="600" />
 
 ## 빠른 시작
 
@@ -41,25 +41,24 @@ ccperm
 
 TTY 환경(기본)에서는 박스 프레임 TUI가 실행됩니다:
 
-**목록 뷰** — 프로젝트가 권한 수 기준으로 정렬됩니다. 상단에 `~/.claude` 섹션이 구분선과 함께 표시됩니다. 각 행은 카테고리별 개수(Bash, WebFetch, MCP, Tools)와 `shared`/`local` 라벨로 `settings.json`과 `settings.local.json`을 구분합니다.
+**목록 뷰** — 프로젝트가 권한 수 기준으로 정렬됩니다. 컬럼: Bash, MCP, Tools, TOTAL, `!` (위험도 경고), `†` (deprecated `:*` 패턴).
 
 ```
-┌ ccperm ──────────────────────────────── 1/8 ┐
-│ PROJECT          Bash  WebFetch   MCP  TOTAL │
-├──────────────────────────────────────────────┤
-│  ~/.claude                        2       2 │
-├──────────────────────────────────────────────┤
-│▸ my-project  local  5       3     ·      8  │
-│  other-app   shared 2       ·     3      5  │
-│  ...                                        │
-└ [↑↓] navigate  [Enter] detail  [q] quit ────┘
+┌ ccperm ──────────────────────────── 1/8 ┐
+│   PROJECT         Bash MCP Tools TOTAL  │
+├─────────────────────────────────────────┤
+│   ~/.claude                  2      2   │
+├─────────────────────────────────────────┤
+│ ▸ my-project  local  5   ·    3    8    │
+│   other-app   shared 2   3    ·    5    │
+└ [↑↓] navigate  [Enter] detail  [q] quit┘
 ```
 
-**상세 뷰** — Enter로 프로젝트를 펼칩니다. 카테고리를 Enter로 접고 펼 수 있습니다.
+**상세 뷰** — Enter로 프로젝트를 펼칩니다. 카테고리를 Enter로 접고 펼 수 있습니다. `[d]`로 권한 삭제, `[g]`로 글로벌 설정에 복사할 수 있습니다.
 
-**정보 모드** — `[i]`를 누르면 각 권한에 대한 설명이 나타납니다.
+**정보 모드** — `[i]`를 누르면 각 권한의 위험도와 설명이 나타납니다.
 
-키 조작: `↑↓` 이동, `Enter` 선택/펼치기, `[i]` 정보 토글, `Esc`/`Backspace` 뒤로, `q`/`Ctrl+C` 종료.
+키 조작: `↑↓` 이동, `Enter` 선택/펼치기, `[i]` 정보, `[d]` 삭제, `[g]` 글로벌 복사, `Esc` 뒤로, `q` 종료.
 
 ## 텍스트 출력
 

package/README.md

@@ -6,7 +6,7 @@ Audit Claude Code permissions across all your projects.
 
 Claude Code stores allowed permissions (Bash commands, WebFetch domains, MCP tools, etc.) in `.claude/settings*.json` per project. As you work across many projects, these permissions pile up silently. **ccperm** scans your home directory, finds every settings file, and shows what you've allowed — in an interactive TUI or static text output.
 
-<img src="./screenshot.png" width="600" />
+<img src="./demo.gif" width="600" />
 
 ## Quick Start
 
@@ -41,25 +41,24 @@ By default, ccperm scans all projects under `~` and launches an interactive TUI.
 
 When running in a TTY (the default), ccperm opens a box-frame TUI:
 
-**List view** — Projects sorted by permission count. `~/.claude` section at top with a separator. Each row shows category counts (Bash, WebFetch, MCP, Tools) and a `shared`/`local` label distinguishing `settings.json` vs `settings.local.json`.
+**List view** — Projects sorted by permission count. Columns: Bash, MCP, Tools, TOTAL, `!` (risk warnings), `†` (deprecated `:*` patterns).
 
 ```
-┌ ccperm ──────────────────────────────── 1/8 ┐
-│ PROJECT          Bash  WebFetch   MCP  TOTAL │
-├──────────────────────────────────────────────┤
-│  ~/.claude                        2       2 │
-├──────────────────────────────────────────────┤
-│▸ my-project  local  5       3     ·      8  │
-│  other-app   shared 2       ·     3      5  │
-│  ...                                        │
-└ [↑↓] navigate  [Enter] detail  [q] quit ────┘
+┌ ccperm ──────────────────────────── 1/8 ┐
+│   PROJECT         Bash MCP Tools TOTAL  │
+├─────────────────────────────────────────┤
+│   ~/.claude                  2      2   │
+├─────────────────────────────────────────┤
+│ ▸ my-project  local  5   ·    3    8    │
+│   other-app   shared 2   3    ·    5    │
+└ [↑↓] navigate  [Enter] detail  [q] quit┘
 ```
 
-**Detail view** — Press Enter to expand a project. Categories are collapsible; press Enter to toggle.
+**Detail view** — Press Enter to expand a project. Categories are collapsible; press Enter to toggle. Press `[d]` to delete a permission, `[g]` to copy it to global settings.
 
-**Info mode** — Press `[i]` to show descriptions for each permission.
+**Info mode** — Press `[i]` to show risk level and description for each permission.
 
-Keys: `↑↓` navigate, `Enter` select/expand, `[i]` toggle info, `Esc`/`Backspace` back, `q`/`Ctrl+C` quit.
+Keys: `↑↓` navigate, `Enter` select/expand, `[i]` info, `[d]` delete, `[g]` copy to global, `Esc` back, `q` quit.
 
 ## Static Output
 

package/dist/interactive.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.startInteractive = startInteractive;
 const node_readline_1 = __importDefault(require("node:readline"));
 const colors_js_1 = require("./colors.js");
+const scanner_js_1 = require("./scanner.js");
 const explain_js_1 = require("./explain.js");
 function severityTag(s) {
     const labels = {
@@ -41,20 +42,62 @@ function boxLine(text, width) {
 }
 function boxTop(title, info, width) {
     const inner = width - 2;
-    const titlePart = ` ${title} `;
     const infoPart = info ? ` ${info} ` : '';
-    const fill = Math.max(0, inner - titlePart.length - infoPart.length);
+    const maxTitle = inner - infoPart.length - 2; // 2 for spaces around title
+    let truncTitle = title;
+    if (visLen(truncTitle) > maxTitle) {
+        // strip ANSI, truncate, re-wrap won't work cleanly — truncate the raw string
+        const plain = truncTitle.replace(/\x1b\[[0-9;]*m/g, '');
+        truncTitle = plain.slice(0, maxTitle - 1) + '…';
+    }
+    const titlePart = ` ${truncTitle} `;
+    const fill = Math.max(0, inner - visLen(titlePart) - infoPart.length);
     return `${colors_js_1.DIM}┌${titlePart}${'─'.repeat(fill)}${infoPart}┐${colors_js_1.NC}`;
 }
 function boxBottom(hint, width) {
     const inner = width - 2;
     const hintPart = ` ${hint} `;
-    const fill = Math.max(0, inner - hintPart.length);
+    const fill = Math.max(0, inner - visLen(hintPart));
     return `${colors_js_1.DIM}└${'─'.repeat(fill)}${hintPart}┘${colors_js_1.NC}`;
 }
+function boxBottom2(line1, line2, width) {
+    return boxLine(line1, width) + '\n' + boxBottom(line2, width);
+}
 function boxSep(width) {
     return `${colors_js_1.DIM}├${'─'.repeat(width - 2)}┤${colors_js_1.NC}`;
 }
+function refreshProject(results, withPerms, idx, filePath) {
+    const ri = results.findIndex((r) => r.path === filePath);
+    if (ri >= 0) {
+        const updated = (0, scanner_js_1.scanFile)(filePath);
+        if (updated) {
+            results[ri] = updated;
+            const entry = withPerms[idx];
+            entry.totalCount = updated.totalCount;
+            entry.groups = new Map();
+            for (const g of updated.groups)
+                entry.groups.set(g.category, g.items.length);
+        }
+    }
+}
+function buildDupMap(results) {
+    const globalResult = results.find((r) => r.isGlobal);
+    const globalPerms = globalResult ? globalResult.permissions : [];
+    const map = new Map();
+    for (const r of results) {
+        if (r.isGlobal)
+            continue;
+        const dup = (0, scanner_js_1.findDuplicates)(r.path, globalPerms);
+        const total = dup.exact.length + dup.globalDup.length;
+        if (total > 0)
+            map.set(r.display, { exact: dup.exact.length, global: dup.globalDup.length });
+    }
+    return map;
+}
+function getGlobalPerms(results) {
+    const globalResult = results.find((r) => r.isGlobal);
+    return globalResult ? globalResult.permissions : [];
+}
 function startInteractive(merged, results) {
     return new Promise((resolve) => {
         const globals = merged.filter((r) => r.isGlobal);
@@ -63,12 +106,13 @@ function startInteractive(merged, results) {
         const emptyCount = merged.filter((r) => r.totalCount === 0 && !r.isGlobal).length;
         const riskMap = buildRiskMap(results);
         const depMap = buildDeprecatedMap(results);
+        let dupMap = buildDupMap(results);
         if (withPerms.length === 0) {
             console.log(`\n  ${colors_js_1.GREEN}No projects with permissions found.${colors_js_1.NC}\n`);
             resolve();
             return;
         }
-        const state = { view: 'list', cursor: 0, scrollOffset: 0, selectedProject: 0, detailCursor: 0, detailScroll: 0, expanded: new Set(), showInfo: false };
+        const state = { view: 'list', cursor: 0, scrollOffset: 0, selectedProject: 0, detailCursor: 0, detailScroll: 0, expanded: new Set(), showInfo: false, searchActive: false, searchQuery: '' };
         node_readline_1.default.emitKeypressEvents(process.stdin);
         if (process.stdin.isTTY)
             process.stdin.setRawMode(true);
@@ -84,21 +128,83 @@ function startInteractive(merged, results) {
         const onSigint = () => { cleanup(); process.exit(0); };
         process.on('SIGINT', onSigint);
         const render = () => {
-            process.stdout.write('\x1b[2J\x1b[H\x1b[?25l');
-            if (state.view === 'list')
-                renderList(state, withPerms, emptyCount, riskMap, depMap);
+            process.stdout.write('\x1b[2J\x1b[H');
+            process.stdout.write(state.searchActive ? '\x1b[?25h' : '\x1b[?25l');
+            if (state.view === 'search')
+                renderSearch(state, withPerms, results);
+            else if (state.view === 'list')
+                renderList(state, withPerms, emptyCount, riskMap, depMap, dupMap);
             else
-                renderDetail(state, withPerms, results);
+                renderDetail(state, withPerms, results, dupMap);
         };
         const onKey = (_str, key) => {
             if (!key)
                 return;
+            // Search typing mode (active in search view)
+            if (state.searchActive) {
+                if (key.name === 'escape') {
+                    state.searchActive = false;
+                    state.searchQuery = '';
+                    state.view = 'list';
+                    state.cursor = 0;
+                    state.scrollOffset = 0;
+                }
+                else if (key.name === 'return') {
+                    // Navigate to selected hit's project
+                    const hits = buildSearchHits(state.searchQuery, withPerms, results);
+                    const hit = hits[state.cursor];
+                    if (hit && !hit.isHeader) {
+                        state.searchActive = false;
+                        state.selectedProject = hit.projectIdx;
+                        state.detailCursor = 0;
+                        state.detailScroll = 0;
+                        state.expanded = new Set();
+                        state.searchQuery = '';
+                        state.view = 'detail';
+                    }
+                }
+                else if (key.name === 'backspace') {
+                    state.searchQuery = state.searchQuery.slice(0, -1);
+                    state.cursor = 0;
+                    state.scrollOffset = 0;
+                }
+                else if (key.name === 'up' || key.name === 'down') {
+                    const hits = buildSearchHits(state.searchQuery, withPerms, results);
+                    if (key.name === 'up') {
+                        do {
+                            state.cursor = Math.max(0, state.cursor - 1);
+                        } while (state.cursor > 0 && hits[state.cursor]?.isHeader);
+                    }
+                    else {
+                        do {
+                            state.cursor = Math.min(hits.length - 1, state.cursor + 1);
+                        } while (state.cursor < hits.length - 1 && hits[state.cursor]?.isHeader);
+                    }
+                }
+                else if (_str && _str.length === 1 && !key.ctrl && !key.meta) {
+                    state.searchQuery += _str;
+                    state.cursor = 0;
+                    state.scrollOffset = 0;
+                }
+                render();
+                return;
+            }
             if (key.name === 'q' || (key.name === 'c' && key.ctrl)) {
                 cleanup();
                 console.log('');
                 resolve();
                 return;
             }
+            // `/` activates search from list or search view
+            if (_str === '/' && (state.view === 'list' || state.view === 'search') && !state.confirmDelete && !state.confirmGlobal) {
+                state.searchActive = true;
+                state.searchQuery = '';
+                state.view = 'search';
+                state.cursor = 0;
+                state.scrollOffset = 0;
+                render();
+                return;
+            }
             if (state.view === 'list') {
                 if (key.name === 'up')
                     state.cursor = Math.max(0, state.cursor - 1);
@@ -112,11 +218,76 @@ function startInteractive(merged, results) {
                     state.view = 'detail';
                 }
             }
+            else if (state.view === 'search') {
+                const hits = buildSearchHits(state.searchQuery, withPerms, results);
+                if (key.name === 'escape') {
+                    state.view = 'list';
+                    state.cursor = 0;
+                    state.scrollOffset = 0;
+                    state.searchQuery = '';
+                }
+                else if (key.name === 'up') {
+                    do {
+                        state.cursor = Math.max(0, state.cursor - 1);
+                    } while (state.cursor > 0 && hits[state.cursor]?.isHeader);
+                }
+                else if (key.name === 'down') {
+                    do {
+                        state.cursor = Math.min(hits.length - 1, state.cursor + 1);
+                    } while (state.cursor < hits.length - 1 && hits[state.cursor]?.isHeader);
+                }
+                else if (key.name === 'return') {
+                    const hit = hits[state.cursor];
+                    if (hit && !hit.isHeader) {
+                        state.selectedProject = hit.projectIdx;
+                        state.detailCursor = 0;
+                        state.detailScroll = 0;
+                        state.expanded = new Set();
+                        state.searchQuery = '';
+                        state.view = 'detail';
+                    }
+                }
+            }
             else {
-                if (key.name === 'escape' || key.name === 'backspace') {
+                // detail view
+                if (state.confirmDelete) {
+                    if (key.name === 'y') {
+                        const { rawPerm, filePath } = state.confirmDelete;
+                        if ((0, scanner_js_1.removePerm)(filePath, rawPerm)) {
+                            refreshProject(results, withPerms, state.selectedProject, filePath);
+                            dupMap = buildDupMap(results);
+                            state.flash = `${colors_js_1.GREEN}✔ Deleted${colors_js_1.NC}`;
+                        }
+                        state.confirmDelete = undefined;
+                    }
+                    else {
+                        state.confirmDelete = undefined;
+                    }
+                }
+                else if (state.confirmGlobal) {
+                    if (key.name === 'y') {
+                        if ((0, scanner_js_1.addPermToGlobal)(state.confirmGlobal.rawPerm)) {
+                            // Refresh global scan result so dupMap picks up new global perm
+                            const globalIdx = results.findIndex((r) => r.isGlobal);
+                            if (globalIdx >= 0) {
+                                const updated = (0, scanner_js_1.scanFile)(results[globalIdx].path);
+                                if (updated)
+                                    results[globalIdx] = updated;
+                            }
+                            dupMap = buildDupMap(results);
+                            state.flash = `${colors_js_1.GREEN}✔ Added to global${colors_js_1.NC}`;
+                        }
+                        else {
+                            state.flash = `${colors_js_1.DIM}· Already in global${colors_js_1.NC}`;
+                        }
+                    }
+                    state.confirmGlobal = undefined;
+                }
+                else if (key.name === 'escape' || key.name === 'backspace') {
                     state.view = 'list';
                     state.detailCursor = 0;
                     state.detailScroll = 0;
+                    state.searchQuery = '';
                 }
                 else if (key.name === 'up') {
                     state.detailCursor = Math.max(0, state.detailCursor - 1);
@@ -130,6 +301,19 @@ function startInteractive(merged, results) {
                 else if (key.name === 'i') {
                     state.showInfo = !state.showInfo;
                 }
+                else if (key.name === 'd') {
+                    state._delete = true;
+                }
+                else if (key.name === 'g') {
+                    state._global = true;
+                }
+                else if (_str === '/' && !state.confirmDelete && !state.confirmGlobal) {
+                    state.searchActive = true;
+                    state.searchQuery = '';
+                    state.view = 'search';
+                    state.cursor = 0;
+                    state.scrollOffset = 0;
+                }
             }
             render();
         };
@@ -167,27 +351,27 @@ function buildRiskMap(results) {
     }
     return map;
 }
-function renderList(state, withPerms, emptyCount, riskMap, depMap) {
+function renderList(state, withPerms, emptyCount, riskMap, depMap, dupMap) {
     const rows = process.stdout.rows || 24;
     const cols = process.stdout.columns || 80;
     const cats = ['Bash', 'MCP', 'Tools'];
     const catsPresent = cats.filter((c) => withPerms.some((r) => r.groups.has(c)));
     const hasRisk = [...riskMap.values()].some((v) => v.critical > 0 || v.high > 0);
     const hasDep = depMap.size > 0;
+    const hasDup = dupMap.size > 0;
     const riskColWidth = hasRisk ? 3 : 0;
     const depColWidth = hasDep ? 3 : 0;
+    const dupColWidth = hasDup ? 4 : 0;
     const catColWidth = catsPresent.length * 7;
     const typeColWidth = 7;
     const maxName = Math.max(...withPerms.map((r) => r.shortName.length), 7);
     const nameColWidth = Math.min(maxName + typeColWidth, 35);
     const nameWidth = nameColWidth - typeColWidth;
-    // content: marker(2) + nameCol + gap(2) + catCols + gap(2) + total(5) + riskCol(3) + depCol(3)
-    const contentWidth = 2 + nameColWidth + 2 + catColWidth + 2 + 5 + (hasRisk ? riskColWidth : 0) + (hasDep ? depColWidth : 0);
+    const contentWidth = 2 + nameColWidth + 2 + catColWidth + 2 + 5 + (hasRisk ? riskColWidth : 0) + (hasDep ? depColWidth : 0) + (hasDup ? dupColWidth : 0);
     const w = Math.min(cols, contentWidth + 4);
-    const inner = w - 4;
     const hasGlobalSep = withPerms.some((r) => r.isGlobal) && withPerms.some((r) => !r.isGlobal);
-    // box takes: top(1) + header(2) + sep(1) + content + globalSep?(1) + emptyLine?(1) + bottom(1)
-    const chrome = 5 + (hasGlobalSep ? 1 : 0) + (emptyCount > 0 ? 1 : 0);
+    const hasLegend = hasRisk || hasDep || hasDup;
+    const chrome = 5 + (hasGlobalSep ? 1 : 0) + (emptyCount > 0 ? 1 : 0) + (hasLegend ? 1 : 0);
     const visibleRows = Math.min(25, Math.max(1, rows - chrome));
     if (state.cursor < state.scrollOffset)
         state.scrollOffset = state.cursor;
@@ -198,9 +382,9 @@ function renderList(state, withPerms, emptyCount, riskMap, depMap) {
     lines.push(boxTop('ccperm', scrollInfo, w));
     const riskHeader = hasRisk ? ` ${rpad('!', 2)}` : '';
     const depHeader = hasDep ? ` ${rpad('†', 2)}` : '';
-    lines.push(boxLine(`${colors_js_1.DIM}  ${pad('PROJECT', nameColWidth)}  ${catsPresent.map((c) => rpad(c, 5)).join('  ')}  ${rpad('TOTAL', 5)}${riskHeader}${depHeader}${colors_js_1.NC}`, w));
+    const dupHeader = hasDup ? ` ${rpad('G', 3)}` : '';
+    lines.push(boxLine(`${colors_js_1.DIM}  ${pad('PROJECT', nameColWidth)}  ${catsPresent.map((c) => rpad(c, 5)).join('  ')}  ${rpad('TOTAL', 5)}${riskHeader}${depHeader}${dupHeader}${colors_js_1.NC}`, w));
     lines.push(boxSep(w));
-    const globalCount = withPerms.filter((r) => r.isGlobal).length;
     const end = Math.min(state.scrollOffset + visibleRows, withPerms.length);
     for (let i = state.scrollOffset; i < end; i++) {
         const r = withPerms[i];
@@ -235,7 +419,17 @@ function renderList(state, withPerms, emptyCount, riskMap, depMap) {
             else
                 depCol = ` ${colors_js_1.DIM}${rpad('·', 2)}${colors_js_1.NC}`;
         }
-        lines.push(boxLine(`${nameCol}  ${catCols}  ${totalCol}${riskCol}${depCol}`, w));
+        let dupCol = '';
+        if (hasDup) {
+            const dup = dupMap.get(r.display);
+            if (dup && dup.global > 0) {
+                dupCol = ` ${colors_js_1.YELLOW}${rpad(dup.global, 3)}${colors_js_1.NC}`;
+            }
+            else {
+                dupCol = ` ${colors_js_1.DIM}${rpad('·', 3)}${colors_js_1.NC}`;
+            }
+        }
+        lines.push(boxLine(`${nameCol}  ${catCols}  ${totalCol}${riskCol}${depCol}${dupCol}`, w));
         // separator after global section
         if (r.isGlobal && i + 1 < withPerms.length && !withPerms[i + 1].isGlobal) {
             lines.push(boxSep(w));
@@ -244,10 +438,93 @@ function renderList(state, withPerms, emptyCount, riskMap, depMap) {
     if (emptyCount > 0) {
         lines.push(boxLine(`${colors_js_1.DIM}+ ${emptyCount} projects with no permissions${colors_js_1.NC}`, w));
     }
-    lines.push(boxBottom('[↑↓] navigate  [Enter] detail  [q] quit', w));
+    const legendParts = [];
+    if (hasRisk)
+        legendParts.push(`${colors_js_1.RED}!${colors_js_1.NC} risk`);
+    if (hasDep)
+        legendParts.push(`${colors_js_1.DIM}†${colors_js_1.NC} deprecated`);
+    if (hasDup)
+        legendParts.push(`${colors_js_1.YELLOW}G${colors_js_1.NC} in global`);
+    if (legendParts.length > 0) {
+        const legendStr = legendParts.join('  ');
+        const legendVisLen = visLen(legendStr);
+        const padLeft = Math.max(0, w - 4 - legendVisLen);
+        lines.push(boxLine(`${' '.repeat(padLeft)}${legendStr}`, w));
+        lines.push(boxBottom('[↑↓] navigate  [Enter] detail  [/] search  [q] quit', w));
+    }
+    else {
+        lines.push(boxBottom('[↑↓] navigate  [Enter] detail  [/] search  [q] quit', w));
+    }
     process.stdout.write(lines.join('\n') + '\n');
 }
-function renderDetail(state, withPerms, results) {
+function buildSearchHits(query, withPerms, results) {
+    if (!query)
+        return [];
+    const q = query.toLowerCase();
+    const hits = [];
+    for (let pi = 0; pi < withPerms.length; pi++) {
+        const entry = withPerms[pi];
+        const r = results.find((r) => r.display === entry.display);
+        if (!r)
+            continue;
+        const matched = r.permissions.filter((p) => p.toLowerCase().includes(q));
+        if (matched.length === 0)
+            continue;
+        hits.push({ projectName: entry.shortName, projectIdx: pi, perm: '', rawPerm: '', filePath: r.path, isHeader: true });
+        for (const p of matched) {
+            hits.push({ projectName: entry.shortName, projectIdx: pi, perm: p, rawPerm: p, filePath: r.path, isHeader: false });
+        }
+    }
+    return hits;
+}
+function renderSearch(state, withPerms, results) {
+    const rows = process.stdout.rows || 24;
+    const cols = process.stdout.columns || 80;
+    const w = Math.min(cols, 82);
+    const hits = buildSearchHits(state.searchQuery, withPerms, results);
+    const permCount = hits.filter((h) => !h.isHeader).length;
+    if (state.cursor >= hits.length)
+        state.cursor = Math.max(0, hits.length - 1);
+    // Skip header rows when navigating
+    if (hits[state.cursor]?.isHeader && state.cursor + 1 < hits.length)
+        state.cursor++;
+    const chrome = 3; // top + bottom + search bar
+    const visibleRows = Math.max(1, rows - chrome);
+    if (state.cursor < state.scrollOffset)
+        state.scrollOffset = state.cursor;
+    if (state.cursor >= state.scrollOffset + visibleRows)
+        state.scrollOffset = state.cursor - visibleRows + 1;
+    const lines = [];
+    const scrollInfo = hits.length > visibleRows ? `${state.cursor + 1}/${hits.length}` : '';
+    lines.push(boxTop(`search: ${state.searchQuery}  ${permCount} permissions`, scrollInfo, w));
+    const end = Math.min(state.scrollOffset + visibleRows, hits.length);
+    for (let i = state.scrollOffset; i < end; i++) {
+        const hit = hits[i];
+        const isCursor = i === state.cursor;
+        if (hit.isHeader) {
+            const tag = withPerms[hit.projectIdx]?.isGlobal ? 'global' : withPerms[hit.projectIdx]?.fileType || '';
+            lines.push(boxLine(`${colors_js_1.YELLOW}  ${hit.projectName}${colors_js_1.NC} ${colors_js_1.DIM}${tag}${colors_js_1.NC}`, w));
+        }
+        else {
+            const prefix = isCursor ? `${colors_js_1.CYAN}▸ ` : '  ';
+            const clean = cleanLabel(hit.perm);
+            const maxLen = w - 8;
+            const name = clean.length > maxLen ? clean.slice(0, maxLen - 1) + '…' : clean;
+            lines.push(boxLine(`${prefix}  ${colors_js_1.DIM}${name}${colors_js_1.NC}`, w));
+        }
+    }
+    if (hits.length === 0 && state.searchQuery) {
+        lines.push(boxLine(`${colors_js_1.DIM}  No matches${colors_js_1.NC}`, w));
+    }
+    if (state.searchActive) {
+        lines.push(boxBottom(`/ ${state.searchQuery}█ (${permCount} matches)`, w));
+    }
+    else {
+        lines.push(boxBottom(`[↑↓] navigate  [Enter] go to project  [/] new search  [Esc] back`, w));
+    }
+    process.stdout.write(lines.join('\n') + '\n');
+}
+function renderDetail(state, withPerms, results, dupMap) {
     const rows = process.stdout.rows || 24;
     const cols = process.stdout.columns || 80;
     const w = Math.min(cols, 82);
@@ -257,33 +534,47 @@ function renderDetail(state, withPerms, results) {
     const fileResult = results.find((r) => r.display === project.display);
     if (!fileResult || fileResult.totalCount === 0)
         return;
+    // Compute dup info for this file
+    const globalPerms = getGlobalPerms(results);
+    const dupInfo = project.isGlobal ? { exact: [], globalDup: [] } : (0, scanner_js_1.findDuplicates)(fileResult.path, globalPerms);
+    const exactSet = new Set(dupInfo.exact);
+    const globalDupSet = new Set(dupInfo.globalDup);
     // build navigable rows
-    const navRows = [];
+    const allNavRows = [];
     for (const group of fileResult.groups) {
         const key = `${fileResult.path}:${group.category}`;
         const isOpen = state.expanded.has(key);
         const arrow = isOpen ? '▾' : '▸';
-        navRows.push({ text: `${colors_js_1.YELLOW}${arrow} ${group.category}${colors_js_1.NC} ${colors_js_1.DIM}(${group.items.length})${colors_js_1.NC}`, key });
+        allNavRows.push({ text: `${colors_js_1.YELLOW}${arrow} ${group.category}${colors_js_1.NC} ${colors_js_1.DIM}(${group.items.length})${colors_js_1.NC}`, key });
         if (isOpen) {
             for (const item of group.items) {
                 const clean = cleanLabel(item.name);
+                const rawPerm = fileResult.permissions.find((p) => p.includes(item.name)) || '';
+                // Dup tag
+                let dupTag = '';
+                if (globalDupSet.has(rawPerm))
+                    dupTag = ` ${colors_js_1.YELLOW}(in global)${colors_js_1.NC}`;
+                else if (exactSet.has(rawPerm))
+                    dupTag = ` ${colors_js_1.DIM}(dup)${colors_js_1.NC}`;
                 if (state.showInfo) {
                     const info = (0, explain_js_1.explain)(group.category, item.name);
                     const tag = severityTag(info.risk);
-                    const tagLen = info.risk.length + 2; // tag visual width (e.g. "CRITICAL" + 2 spaces)
+                    const tagLen = info.risk.length + 2;
                     const nameMax = Math.min(30, w - tagLen - 14);
                     const name = clean.length > nameMax ? clean.slice(0, nameMax - 1) + '…' : clean;
                     const desc = info.description ? `${colors_js_1.DIM}${info.description}${colors_js_1.NC}` : '';
-                    navRows.push({ text: `  ${pad(name, nameMax)} ${tag} ${desc}`, perm: item.name });
+                    allNavRows.push({ text: `  ${pad(name, nameMax)} ${tag} ${desc}${dupTag}`, perm: item.name, rawPerm });
                 }
                 else {
-                    const maxLen = w - 8;
+                    const dupTagVis = dupTag ? 10 : 0; // reserve space for tag
+                    const maxLen = w - 8 - dupTagVis;
                     const name = clean.length > maxLen ? clean.slice(0, maxLen - 1) + '…' : clean;
-                    navRows.push({ text: `  ${colors_js_1.DIM}${name}${colors_js_1.NC}`, perm: item.name });
+                    allNavRows.push({ text: `  ${colors_js_1.DIM}${name}${colors_js_1.NC}${dupTag}`, perm: item.name, rawPerm });
                 }
             }
         }
     }
+    const navRows = allNavRows;
     // handle toggle
     if (state._toggle) {
         delete state._toggle;
@@ -293,14 +584,31 @@ function renderDetail(state, withPerms, results) {
                 state.expanded.delete(row.key);
             else
                 state.expanded.add(row.key);
-            renderDetail(state, withPerms, results);
+            renderDetail(state, withPerms, results, dupMap);
             return;
         }
     }
+    // handle delete
+    if (state._delete) {
+        delete state._delete;
+        const row = navRows[state.detailCursor];
+        if (row?.rawPerm) {
+            state.confirmDelete = { perm: row.perm, rawPerm: row.rawPerm, filePath: fileResult.path };
+        }
+    }
+    // handle global copy
+    if (state._global) {
+        delete state._global;
+        const row = navRows[state.detailCursor];
+        if (row?.rawPerm && !project.isGlobal) {
+            state.confirmGlobal = { perm: row.perm, rawPerm: row.rawPerm };
+        }
+    }
     if (state.detailCursor >= navRows.length)
         state.detailCursor = Math.max(0, navRows.length - 1);
-    // box chrome: top(1) + sep(1) + bottom(1) = 3
-    const visibleRows = Math.max(1, rows - 3);
+    // top(1) + bottom(2 for hint, or 1 for flash/confirm/search)
+    const bottomChrome = (!state.flash && !state.confirmDelete && !state.confirmGlobal && !state.searchActive) ? 4 : 3;
+    const visibleRows = Math.max(1, rows - bottomChrome);
     if (state.detailCursor < state.detailScroll)
         state.detailScroll = state.detailCursor;
     if (state.detailCursor >= state.detailScroll + visibleRows)
@@ -309,7 +617,10 @@ function renderDetail(state, withPerms, results) {
     const scrollInfo = navRows.length > visibleRows ? `${state.detailCursor + 1}/${navRows.length}` : '';
     const lines = [];
     const typeTag = project.fileType === 'global' ? 'global' : project.fileType;
-    lines.push(boxTop(`${project.shortName} (${typeTag})  ${project.totalCount} permissions`, scrollInfo, w));
+    const dupCount = dupMap.get(project.display);
+    const globalCount = dupCount?.global || 0;
+    const dupSuffix = globalCount > 0 ? `  ${colors_js_1.YELLOW}${globalCount} in global${colors_js_1.NC}` : '';
+    lines.push(boxTop(`${project.shortName} (${typeTag})  ${project.totalCount} permissions${dupSuffix}`, scrollInfo, w));
     for (let i = 0; i < visible.length; i++) {
         const globalIdx = state.detailScroll + i;
         const isCursor = globalIdx === state.detailCursor;
@@ -317,8 +628,28 @@ function renderDetail(state, withPerms, results) {
         const prefix = isCursor ? `${colors_js_1.CYAN}▸ ` : '  ';
         lines.push(boxLine(`${prefix}${row.text}`, w));
     }
-    const infoHint = state.showInfo ? '[i] hide info' : '[i] info';
-    lines.push(boxBottom(`[↑↓] navigate  [Enter] expand  ${infoHint}  [Esc] back  [q] quit`, w));
+    if (state.flash) {
+        lines.push(boxBottom(state.flash, w));
+        state.flash = undefined;
+    }
+    else if (state.confirmDelete) {
+        const name = cleanLabel(state.confirmDelete.perm);
+        const truncName = name.length > 30 ? name.slice(0, 29) + '…' : name;
+        lines.push(boxBottom(`${colors_js_1.RED}Delete "${truncName}"? [y/N]${colors_js_1.NC}`, w));
+    }
+    else if (state.confirmGlobal) {
+        const name = cleanLabel(state.confirmGlobal.perm);
+        const truncName = name.length > 30 ? name.slice(0, 29) + '…' : name;
+        lines.push(boxBottom(`${colors_js_1.CYAN}Copy "${truncName}" to global? [y/N]${colors_js_1.NC}`, w));
+    }
+    else if (state.searchActive) {
+        lines.push(boxBottom(`/ ${state.searchQuery}█ (${navRows.length} matches)`, w));
+    }
+    else {
+        const infoHint = state.showInfo ? '[i] hide info' : '[i] info';
+        const globalHint = project.isGlobal ? '' : '  [g] +global';
+        lines.push(boxBottom2(`${colors_js_1.DIM}[↑↓] navigate  [Enter] expand  ${infoHint}  [d] delete${globalHint}${colors_js_1.NC}`, `[/] search  [Esc] back  [q] quit`, w));
+    }
     process.stdout.write(lines.join('\n') + '\n');
 }
 function pad(s, n) {

package/dist/scanner.js

@@ -3,6 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.removePerm = removePerm;
+exports.addPermToGlobal = addPermToGlobal;
+exports.findDuplicates = findDuplicates;
 exports.countDeprecated = countDeprecated;
 exports.findSettingsFiles = findSettingsFiles;
 exports.scanFile = scanFile;
@@ -11,6 +14,104 @@ const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
 const PERM_RE = /"(Bash|Write|Edit|Read|Glob|Grep|WebSearch|WebFetch|mcp_)[^"]*"/g;
 const DEPRECATED_RE = /:\*\)|:\*"/g;
+const AUDIT_DIR = node_path_1.default.join(node_os_1.default.homedir(), '.ccperm', 'audit');
+function writeAudit(action, filePath, perm, before, after) {
+    try {
+        node_fs_1.default.mkdirSync(AUDIT_DIR, { recursive: true });
+        const ts = new Date().toISOString().replace(/[:.]/g, '-');
+        const entry = { action, file: filePath, perm, before, after, timestamp: new Date().toISOString() };
+        node_fs_1.default.writeFileSync(node_path_1.default.join(AUDIT_DIR, `${ts}_${action}.json`), JSON.stringify(entry, null, 2) + '\n');
+    }
+    catch { /* audit is best-effort */ }
+}
+function removePerm(filePath, rawPerm) {
+    let content;
+    try {
+        content = node_fs_1.default.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return false;
+    }
+    let json;
+    try {
+        json = JSON.parse(content);
+    }
+    catch {
+        return false;
+    }
+    const allow = json?.permissions?.allow;
+    if (!Array.isArray(allow))
+        return false;
+    const idx = allow.indexOf(rawPerm);
+    if (idx === -1)
+        return false;
+    const before = [...allow];
+    allow.splice(idx, 1);
+    node_fs_1.default.writeFileSync(filePath, JSON.stringify(json, null, 2) + '\n', 'utf8');
+    writeAudit('DELETE', filePath, rawPerm, before, allow);
+    return true;
+}
+function addPermToGlobal(rawPerm) {
+    const globalPath = node_path_1.default.join(node_os_1.default.homedir(), '.claude', 'settings.json');
+    let content;
+    try {
+        content = node_fs_1.default.readFileSync(globalPath, 'utf8');
+    }
+    catch {
+        content = '{}';
+    }
+    let json;
+    try {
+        json = JSON.parse(content);
+    }
+    catch {
+        return false;
+    }
+    if (!json.permissions)
+        json.permissions = {};
+    if (!Array.isArray(json.permissions.allow))
+        json.permissions.allow = [];
+    const allow = json.permissions.allow;
+    if (allow.includes(rawPerm))
+        return false; // already exists
+    const before = [...allow];
+    allow.push(rawPerm);
+    node_fs_1.default.writeFileSync(globalPath, JSON.stringify(json, null, 2) + '\n', 'utf8');
+    writeAudit('COPY_TO_GLOBAL', globalPath, rawPerm, before, allow);
+    return true;
+}
+function findDuplicates(filePath, globalPerms) {
+    let content;
+    try {
+        content = node_fs_1.default.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return { exact: [], globalDup: [] };
+    }
+    let json;
+    try {
+        json = JSON.parse(content);
+    }
+    catch {
+        return { exact: [], globalDup: [] };
+    }
+    const allow = json?.permissions?.allow;
+    if (!Array.isArray(allow))
+        return { exact: [], globalDup: [] };
+    const exact = [];
+    const seen = new Set();
+    for (const p of allow) {
+        if (seen.has(p)) {
+            if (!exact.includes(p))
+                exact.push(p);
+        }
+        else
+            seen.add(p);
+    }
+    const globalSet = new Set(globalPerms);
+    const globalDup = [...new Set(allow)].filter((p) => globalSet.has(p));
+    return { exact, globalDup };
+}
 function countDeprecated(results) {
     const out = [];
     for (const r of results) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccperm",
-  "version": "1.12.1",
+  "version": "1.14.0",
   "description": "Audit Claude Code permissions across all your projects",
   "bin": {
     "ccperm": "bin/ccperm.js"
@@ -24,7 +24,7 @@
   "files": [
     "bin/ccperm.js",
     "dist",
-    "screenshot.png"
+    "demo.gif"
   ],
   "devDependencies": {
     "@types/node": "^25.3.0",