johannSoCodeyPublic

Merge claude code settings: .mcp.json, permissions, CLAUDE.md, and the trust they need

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

# Conflicts:
#	README.md

Browse Files

Jjonicommitted 2 weeks ago2 parents 20a95a6 e750ed4commitbc84208

Showing 25 changed files with 3565 additions and 7 deletions.

Merge commit — showing changes against the first parent.

+202−3README.mdView File

@@ -119,7 +119,8 @@ would break your Claude Code login.
119	119	Useful flags: `-model`, `-effort low\|medium\|high\|xhigh\|max`, `-max-turns`,
120	120	`-resume latest`, `-no-stream`, `-no-cache`, `-no-auto-compact`, `-v`, `-yolo`,
121	121	`-no-tui`, `-no-skills`, `-no-agents`, `-no-web`, `-no-hooks`,
122		- `-no-diagnostics`, `-no-mcp`, `-claude-code-auth`, `-no-claude-code-auth`.
	122	+ `-no-diagnostics`, `-no-mcp`, `-claude-code-auth`, `-no-claude-code-auth`,
	123	+ `-trust-project`.
123	124
124	125	### Flags and thresholds
125	126
@@ -965,6 +966,7 @@ rather than the project's.
965	966	\| Path \| What \|
966	967	\| --- \| --- \|
967	968	\| `~/.config/codey/config.json` \| the answers, written by the wizard and `/settings`; [hooks](#hooks) go here by hand \|
	969	+ \| `~/.config/codey/trust.json` \| which checkouts' [Claude Code files](#trusting-a-project) you trusted, and which version of them \|
968	970	\| `<repo>/.codey/sessions/` \| saved conversations, which is what `-resume` and `/resume` read \|
969	971	\| `<repo>/.codey/events.jsonl` \| the event log METRICS.md is built from \|
970	972	\| `<repo>/.codey/history` \| what has been typed at the prompt here, which `↑` walks back through \|
@@ -1031,6 +1033,114 @@ The whole thing is `↑↓` and `enter`, `esc` to go back. Animations collapse t
1031	1033	their final frame under `NO_COLOR`, a `dumb` terminal, or a window under 60×20,
1032	1034	and any key skips the one playing.
1033	1035
	1036	+ ### Claude Code's settings
	1037	+
	1038	+ If you already use Claude Code, a project set up for it should not need setting
	1039	+ up a second time. Codey reads three kinds of thing from Claude Code's files —
	1040	+ [its MCP servers](#claude-codes-servers), its permission rules, and its
	1041	+ CLAUDE.md files — and none of it is copied anywhere or written back: change it
	1042	+ in Claude Code and the next start here sees the change.
	1043	+
	1044	+ Permissions. The `permissions` block of three settings files, in the order
	1045	+ Claude Code reads them:
	1046	+
	1047	+ \| File \| Whose \| `deny` / `ask` \| `allow` \| `defaultMode` \|
	1048	+ \| --- \| --- \| --- \| --- \| --- \|
	1049	+ \| `~/.claude/settings.json` \| yours, every project \| honoured \| honoured \| `acceptEdits` only \|
	1050	+ \| `.claude/settings.json` \| the repository's, committed \| honoured \| only once [trusted](#trusting-a-project) \| ignored \|
	1051	+ \| `.claude/settings.local.json` \| yours, this project, git-ignored \| honoured \| honoured \| `acceptEdits` only \|
	1052	+
	1053	+ The rule underneath that table is who wrote the file. A deny or an ask rule can
	1054	+ only make the agent do less or ask more, and nobody comes to harm from that, so
	1055	+ a repository may add as many as it likes. An allow rule is the opposite: it is
	1056	+ a decision that something runs without you being asked, and a decision written
	1057	+ into a repository was made by whoever wrote the repository. The shared file's
	1058	+ allow rules therefore wait for the same trust question as its `.mcp.json`, and
	1059	+ until you answer it they are listed and ignored. A `settings.local.json` that
	1060	+ git turns out to be tracking arrived with the clone, whatever its name says,
	1061	+ and is treated as shared.
	1062	+
	1063	+ The rules act before anything else in the approval policy. A deny holds in
	1064	+ every mode, `-yolo` included — that is what writing it down is for — and it
	1065	+ holds for the read-only tools too, since `Read(.env)` is a rule about reading.
	1066	+ An ask rule puts the call to you even when the mode would have let it through,
	1067	+ and even when you said "always this tool" earlier in the session. An allow rule
	1068	+ lets a call through without a prompt. Between them deny beats ask beats allow,
	1069	+ as in Claude Code, so no allow rule anywhere argues a call past a deny. The
	1070	+ denial the model reads names the rule and the file, so it can tell you which
	1071	+ line to change instead of retrying. `/allowed` lists every rule under the file
	1072	+ it came from, and says which are in force and why the others are not.
	1073	+
	1074	+ Claude Code's names map onto Codey's: `Bash` is `bash`, `Read` is `read_file`
	1075	+ (and, as best it can, `glob` and `grep`), `Edit` is both `edit_file` and
	1076	+ `write_file`, `MultiEdit` is `edit_file`, `Write` is `write_file`, `Glob`,
	1077	+ `Grep`, `WebFetch`, `WebSearch` and `TodoWrite` are the obvious ones, and
	1078	+ `mcp__server` and `mcp__server__tool` are unchanged. A rule naming a tool Codey
	1079	+ does not have, or written in a form it does not understand, is reported at
	1080	+ startup and takes no part. Paths follow Claude Code's conventions: `//path` is
	1081	+ absolute, `~/path` is under your home, `/path` is under the project root, and
	1082	+ anything else is relative to it, with a bare name such as `.env` matching at
	1083	+ any depth the way `.gitignore` would. Links are followed, so a rule about
	1084	+ `.env` also catches a symlink to it.
	1085	+
	1086	+ `Bash(npm run test:*)` is matched one simple command at a time, using the same
	1087	+ parser as the approval prompt. An allow rule covers `npm run test && rm -rf ~`
	1088	+ only if something also allows `rm`; a deny rule catches the line if it catches
	1089	+ any part of it. A command the parser cannot see through — `$(...)`, backticks,
	1090	+ `bash -c`, a variable in command position — never matches an allow rule, and
	1091	+ where a deny rule cannot be ruled out for it, the call is asked about rather
	1092	+ than run. So is anything that does more than its words say: `PATH=. git
	1093	+ status`, or `echo hi > ~/.bashrc`, is not covered by an allow rule for `git` or
	1094	+ `echo`. None of this makes shell allowlisting a security boundary — see
	1095	+ [Safety](#safety) — but it does stop the commonest way a prefix rule says yes to
	1096	+ something nobody wrote down.
	1097	+
	1098	+ `defaultMode: "acceptEdits"` in a file of yours lets file edits through, as
	1099	+ Claude Code's mode of that name does. `default` is the default. The other modes
	1100	+ are ignored with a notice, from every file: `bypassPermissions` in particular,
	1101	+ because in Codey the way to stop being asked is `-yolo`, typed on the command
	1102	+ line for one run, and neither a file of yours nor a repository's gets to say it
	1103	+ for you.
	1104	+
	1105	+ CLAUDE.md. The files Claude Code loads into every conversation are loaded
	1106	+ into this one's system prompt, at startup, in Claude Code's order:
	1107	+ `~/.claude/CLAUDE.md`, then — from the top of the project down to the working
	1108	+ root — each directory's `CLAUDE.md`, `.claude/CLAUDE.md` and `CLAUDE.local.md`.
	1109	+ The top is the nearest directory with a `.git` in it, or your home directory if
	1110	+ there is none on the way; a root that is in neither is a project of one
	1111	+ directory, because walking up to `/` would read whatever happened to be lying
	1112	+ in `/tmp`. Later files are more specific and the prompt says they win.
	1113	+ `@path/to/file` imports are followed, relative to the file they appear in and up
	1114	+ to five deep, skipping anything in a code block. A project's files may import
	1115	+ only from the project, and that is checked where symlinks lead: a repository's
	1116	+ CLAUDE.md that could import `@~/.aws/credentials` would be a repository reading
	1117	+ your credentials into a conversation that is then sent to the model. Your own
	1118	+ `~/.claude/CLAUDE.md` and `CLAUDE.local.md` may import from your home
	1119	+ directory. The whole thing is read once per session, so the cached prompt
	1120	+ prefix stays the same from request to request; restart to pick up an edit.
	1121	+ `AGENTS.md` is not loaded this way, but the agent is still told to read one if
	1122	+ the repository has it, as before, and a CLAUDE.md that says `@AGENTS.md` brings
	1123	+ it in.
	1124	+
	1125	+ What is not carried over, so nobody has to find out the hard way:
	1126	+
	1127	+ - Hooks in Claude Code's format (`PreToolUse`, `PostToolUse` and the rest).
	1128	+ Codey's [hooks](#hooks) are a different thing — they watch, they cannot
	1129	+ veto — and a script written to block a tool call would silently block
	1130	+ nothing here.
	1131	+ - `env`, `model`, `apiKeyHelper`, `statusLine`, `outputStyle`, `cleanupPeriodDays`
	1132	+ and the other non-permission settings. Codey has its own config for the ones
	1133	+ it has an equivalent of.
	1134	+ - `permissions.additionalDirectories`: the file tools keep the working root as
	1135	+ their only root.
	1136	+ - Claude Code's own record of which `.mcp.json` servers you approved
	1137	+ (`enabledMcpjsonServers`, `enableAllProjectMcpServers`). It approves by name,
	1138	+ so a server whose command changed under the same name would still count;
	1139	+ Codey asks its own question about the exact definitions instead.
	1140	+ - Managed (enterprise) settings, subdirectory CLAUDE.md files loaded on demand,
	1141	+ and `.claude/rules/`.
	1142	+ - Remote MCP servers, which Codey's client does not speak.
	1143	+
1034	1144	## Tools
1035	1145
1036	1146	\| Tool \| Approval \| Notes \|
@@ -1280,7 +1390,85 @@ Only tools are used: not resources, prompts or sampling, and no HTTP
1280	1390	transport. Pictures a tool returns are described to the model rather than
1281	1391	shown. A server's directory is fixed when it starts, so after `/worktree` it
1282	1392	is still serving the root the session began in. `-no-mcp` starts none of them
1283		- for one run.
	1393	+ for one run — Codey's own and Claude Code's alike.
	1394	+
	1395	+ ### Claude Code's servers
	1396	+
	1397	+ The servers Claude Code already knows about are started as well, read from
	1398	+ where Claude Code keeps them rather than copied into Codey's config:
	1399	+
	1400	+ \| Where \| Whose \| Started \|
	1401	+ \| --- \| --- \| --- \|
	1402	+ \| `~/.claude.json`, under `projects["<root>"].mcpServers` \| yours, for this project — what `claude mcp add` writes \| always \|
	1403	+ \| `.mcp.json` at the working root \| the repository's, committed \| once you [trust it](#trusting-a-project) \|
	1404	+ \| `~/.claude.json`, top-level `mcpServers` \| yours, for every project — `claude mcp add -s user` \| always \|
	1405	+
	1406	+ The shape is the one already shown above, `{"mcpServers": {name: {command,
	1407	+ args, env}}}`, with `"type": "stdio"` accepted and meaning the same thing. A
	1408	+ server with `"type": "http"` or `"sse"`, or with a `url`, is a remote server;
	1409	+ Codey's client speaks only stdio, so it is reported at startup and skipped.
	1410	+ `${VAR}` and `${VAR:-default}` are expanded in the command, the arguments and
	1411	+ the env values, as Claude Code expands them — so a `.mcp.json` can say
	1412	+ `"${DB_URL}"` and leave the secret in your environment. A variable that is
	1413	+ unset and has no default skips that server with a notice naming it, rather
	1414	+ than starting it with a hole in its command line.
	1415	+
	1416	+ When two places define a server of the same name, Codey's own `mcp_servers`
	1417	+ win, and after that the table is read top to bottom: your per-project servers,
	1418	+ then the repository's, then your global ones. That is Claude Code's own order,
	1419	+ so a name means the same program in both. Each clash is reported once, naming
	1420	+ the one that won, because a server that quietly turned out to be a different
	1421	+ program is not something anyone thinks to debug.
	1422	+
	1423	+ #### Trusting a project
	1424	+
	1425	+ A `.mcp.json` comes from the repository. Starting a server listed there means
	1426	+ running a command — with your environment, your credentials, your network —
	1427	+ that whoever wrote the repository chose, before the agent has done anything
	1428	+ and outside every approval prompt. So, like Claude Code, Codey asks first. The
	1429	+ first interactive start in a checkout whose `.mcp.json` or shared
	1430	+ `.claude/settings.json` [allow rules](#claude-codes-settings) would grant
	1431	+ something prints, before the TUI opens:
	1432	+
	1433	+ ```
	1434	+ Claude Code's configuration for /home/you/src/thing would:
	1435	+
	1436	+ start these MCP servers, from .mcp.json:
	1437	+ db: npx -y @acme/db-mcp --url ${DB_URL} (env: DB_TOKEN)
	1438	+ run these without asking, from .claude/settings.json:
	1439	+ Bash(make:*)
	1440	+
	1441	+ These files come from the repository, not from you: trusting them lets it
	1442	+ choose commands this machine runs. Your answer is remembered until they change.
	1443	+ Trust them for this checkout? [y/N]
	1444	+ ```
	1445	+
	1446	+ One question covers both files, because it is one question: do you trust what
	1447	+ this repository says about itself. The full command line is shown because that
	1448	+ is the thing being agreed to. The answer — yes or no — is remembered for this
	1449	+ checkout against a fingerprint of exactly those definitions, as written, before
	1450	+ any `${VAR}` is expanded. A new server, a changed argument or one more allow
	1451	+ rule is a different fingerprint, and the question comes back; nothing else
	1452	+ does. A refusal is remembered too, so saying no once is not a question at every
	1453	+ start.
	1454	+
	1455	+ The record is kept in `~/.config/codey/trust.json`, not in the project's
	1456	+ `.codey/` directory with the rest of the per-repository state. That is the
	1457	+ point of it: anything inside the working tree can arrive with a clone, and a
	1458	+ repository that shipped its own record of being trusted would be approving its
	1459	+ own servers. The fingerprint would be no defence there — whoever wrote the
	1460	+ `.mcp.json` can compute it. Only a file the repository cannot reach can say what
	1461	+ you decided.
	1462	+
	1463	+ Where nobody can be asked — `-p`, `codey agent stdio`, a piped stdin — an
	1464	+ undecided project's servers are not started and its allow rules are ignored,
	1465	+ with a line on stderr saying so. A checkout you have already trusted needs
	1466	+ nothing more. `-trust-project` says yes for one run without asking and without
	1467	+ recording anything, which is what a CI job against a repository you control
	1468	+ wants. Servers in `~/.claude.json` never ask: you put them there, as you put
	1469	+ Codey's own in its config. Once started, every server's tool calls go through
	1470	+ the approval prompts like any other, unless an allow rule such as `mcp__db`
	1471	+ says otherwise.
1284	1472
1285	1473	## Hooks
1286	1474
@@ -1533,6 +1721,14 @@ interpreter with `-c` cannot be analysed at all, so it is marked opaque and
1533	1721	allowlists for shell commands do not work; this exists to make the prompt
1534	1722	specific, not to make the decision for you.
1535	1723
	1724	+ [Claude Code's permission rules](#claude-codes-settings) sit in front of all
	1725	+ of that. Its deny rules hold in every mode, `-yolo` included, which makes them
	1726	+ the one part of this layer you can lean on: a call they refuse does not run.
	1727	+ Its allow rules are matched with the same parser, one simple command at a
	1728	+ time, and an opaque command matches none of them — but the warning above
	1729	+ applies to them with full force. `Bash(find:*)` allows `find . -exec rm {} +`,
	1730	+ and no parser will tell you otherwise.
	1731	+
1536	1732	Hooks sit outside all three layers, deliberately: a command in `"hooks"` runs
1537	1733	on every event it is attached to, without a prompt, because you put it in your
1538	1734	own config rather than the agent asking for it. The path jail is what keeps the
@@ -1541,7 +1737,9 @@ working root you would sensibly point Codey at — but the flip side is that
1541	1737	anything able to write that file has arranged to run commands here. `-no-hooks`
1542	1738	is the switch that says no for one run. MCP servers are the same bargain: each
1543	1739	is a program started with your environment when the session opens, and only
1544		- its tool calls go through the prompts. `-no-mcp` is theirs.
	1740	+ its tool calls go through the prompts. `-no-mcp` is theirs. The one kind of
	1741	+ server that does not come from a file you wrote — a repository's `.mcp.json` —
	1742	+ waits for you to [trust it](#trusting-a-project) first.
1545	1743
1546	1744	A sandbox. This is the layer that actually contains a mistake, and the
1547	1745	Codey cannot provide it for you. The honest recipe on Linux:
@@ -1581,6 +1779,7 @@ internal/websearch the search command, the URL jail, HTML to text
1581	1779	internal/mcp MCP client: starts the configured servers, offers their tools
1582	1780	internal/config saved defaults: model, effort, approvals, web search, theme, diagnostics
1583	1781	internal/approval allow / deny / ask, with shell analysis
	1782	+ internal/ccsettings Claude Code's MCP servers, permission rules and CLAUDE.md, and who may grant what
1584	1783	internal/ask questions the agent puts to you mid-task, and the tool for it
1585	1784	internal/hooks the lifecycle, published: fan-out, and the config's commands
1586	1785	internal/herdr reporting agent state to the herdr pane Codey is running in

+15−0cmd/codey/agentcmd.goView File

@@ -25,6 +25,7 @@ import (
25	25
26	26	"github.com/johannSo/codey/internal/acp"
27	27	"github.com/johannSo/codey/internal/agent"
	28	+ "github.com/johannSo/codey/internal/approval"
28	29	"github.com/johannSo/codey/internal/llm"
29	30	"github.com/johannSo/codey/internal/metrics"
30	31	"github.com/johannSo/codey/internal/serve"
@@ -214,6 +215,12 @@ type acpDeps struct {
214	215	Base agent.Options
215	216	// Tools is main's factory: a root in, a tool-set builder out.
216	217	Tools func(root string) func(agent.State, metrics.Logger) *tools.Registry
	218	+ // Rules and Instructions are Claude Code's permission rules and CLAUDE.md
	219	+ // files for a root. Each session may be rooted somewhere else, so they
	220	+ // are looked up per session rather than taken from startup. Nil for
	221	+ // neither.
	222	+ Rules func(root string) approval.RuleSet
	223	+ Instructions func(root string) string
217	224	}
218	225
219	226	// serveACP runs the agent over stdin and stdout until the client hangs up.
@@ -250,6 +257,14 @@ func serveACP(ctx context.Context, deps acpDeps) error {
250	257	// the parent's limits.
251	258	newTools := deps.Tools(req.Root)
252	259	reg := newTools(req.State, deps.Log)
	260	+ if deps.Rules != nil && req.Approve != nil {
	261	+ req.Approve.Rules = deps.Rules(req.Root)
	262	+ }
	263	+ base, subBase := base, subBase
	264	+ if deps.Instructions != nil {
	265	+ base.Instructions = deps.Instructions(req.Root)
	266	+ subBase.Instructions = base.Instructions
	267	+ }
253	268
254	269	set := serve.AgentSet{}
255	270	if !deps.NoAgents {

+265−0cmd/codey/ccconfig.goaddedView File

++ package main
++ // What a Claude Code user's existing configuration contributes to a run: the
++ // MCP servers it knows about, the permission rules in its settings files, and
++ // its CLAUDE.md files. The reading and the rules about what is honoured live in
++ // internal/ccsettings; this file is the wiring — when to ask about trust, how,
++ // and what to say when the answer is no.
++ import (
++ 	"fmt"
++ 	"io"
++ 	"os"
++ 	"sort"
++ 	"strings"
++ 	"sync"
++ 	"github.com/johannSo/codey/internal/approval"
++ 	"github.com/johannSo/codey/internal/ccsettings"
++ 	"github.com/johannSo/codey/internal/config"
++ )
++ // trustFlag is spelled once, because three messages name it.
++ const trustFlag = "-trust-project"
++ // ccOptions is what loading Claude Code's configuration needs from main.
++ type ccOptions struct {
++ 	Home, Root string
++ 	// Own is Codey's own mcp_servers, which win any clash.
++ 	Own map[string]config.MCPServer
++ 	// Trust is -trust-project: use the project's servers and allow rules this
++ 	// run, whatever was decided before, without asking.
++ 	Trust bool
++ 	// NoMCP is -no-mcp. The servers are still part of the trust question —
++ 	// the question is about the repository, not about this run — but the
++ 	// prompt says they will not start.
++ 	NoMCP bool
++ 	// Ask puts the trust question to a person and reports the answer, and
++ 	// whether there was one. Nil where nobody can answer: -p, agent stdio,
++ 	// a piped stdin.
++ 	Ask   func(root string, lines []string) (trusted, answered bool)
++ 	Store ccsettings.TrustStore
++ 	// Notice reports something to the user, wherever this run's notices go.
++ 	Notice func(format string, args ...any)
++ 	// Lookup is the environment ${VAR} expands from.
++ 	Lookup func(string) (string, bool)
++ }
++ // ccSetup is what came of it.
++ type ccSetup struct {
++ 	// MCP is every server to start, Codey's own included.
++ 	MCP map[string]config.MCPServer
++ 	// Rules is nil when no settings file had any rules, so the policy is left
++ 	// exactly as it would be on a machine without Claude Code.
++ 	Rules approval.RuleSet
++ 	// Trusted is the trust decision for the root, for reuse by rulesFor.
++ 	Trusted bool
++ }
++ // loadClaudeCode reads Claude Code's files for the startup root, settles
++ // whether the project's own files are trusted — asking, if there is someone
++ // to ask and nothing has been decided about these exact definitions — and
++ // returns what this run should use.
++ func loadClaudeCode(o ccOptions) ccSetup {
++ 	if o.Lookup == nil {
++ 		o.Lookup = os.LookupEnv
++ 	}
++ 	mcpFiles, errs := ccsettings.LoadMCP(o.Home, o.Root)
++ 	for _, err := range errs {
++ 		o.Notice("%v", err)
++ 	}
++ 	perms, errs := ccsettings.LoadPermissions(o.Home, o.Root)
++ 	for _, err := range errs {
++ 		o.Notice("%v — its deny rules are not in force", err)
++ 	}
++ 	grant := ccsettings.NewGrant(mcpFiles, perms)
++ 	trusted := settleTrust(o, grant)
++ 	out := ccSetup{Trusted: trusted}
++ 	merged, notes := ccsettings.MergeMCP(o.Own, mcpFiles, trusted, o.Lookup)
++ 	out.MCP = merged
++ 	if !o.NoMCP {
++ 		// A clash or a missing variable is only news if the servers were
++ 		// going to start.
++ 		for _, n := range notes {
++ 			o.Notice("%s", n)
++ 		}
++ 	}
++ 	rules, notes := ccsettings.NewRuleset(o.Home, o.Root, perms, trusted)
++ 	for _, n := range notes {
++ 		o.Notice("%s", n)
++ 	}
++ 	if !rules.Empty() {
++ 		out.Rules = rules
++ 	}
++ 	return out
++ }
++ // settleTrust decides whether what the project's committed files grant is
++ // used this run. The flag wins; then a decision already recorded for these
++ // exact definitions; then the person at the terminal, if there is one. With
++ // nobody to ask, the answer is no, and the notice says how to say yes.
++ func settleTrust(o ccOptions, grant ccsettings.Grant) bool {
++ 	if grant.Empty() {
++ 		return false
++ 	}
++ 	if o.Trust {
++ 		return true
++ 	}
++ 	fp := grant.Fingerprint()
++ 	decided, trusted, err := o.Store.Lookup(o.Root, fp)
++ 	if err != nil {
++ 		o.Notice("%v — treating this project as not trusted", err)
++ 		return false
++ 	}
++ 	if decided {
++ 		if !trusted {
++ 			o.Notice("%s — you declined to trust them for this checkout. %s uses them for one run; a change to them asks again", untrustedWhat(grant), trustFlag)
++ 		}
++ 		return trusted
++ 	}
++ 	if o.Ask == nil {
++ 		o.Notice("%s — they come from the repository, and nobody has said this checkout is trusted. Run once interactively to be asked, or pass %s", untrustedWhat(grant), trustFlag)
++ 		return false
++ 	}
++ 	lines := grant.Describe()
++ 	if o.NoMCP && len(grant.Servers) > 0 {
++ 		lines = append(lines, "(the servers will not start this run: -no-mcp)")
++ 	}
++ 	trusted, answered := o.Ask(o.Root, lines)
++ 	if !answered {
++ 		// Interrupted, or stdin closed: no for now, and the question stays
++ 		// open for the next start.
++ 		return false
++ 	}
++ 	if err := o.Store.Record(o.Root, fp, trusted); err != nil {
++ 		o.Notice("%v — the answer holds for this run only", err)
++ 	}
++ 	if !trusted {
++ 		o.Notice("%s — you can change your mind with %s", untrustedWhat(grant), trustFlag)
++ 	}
++ 	return trusted
++ }
++ // untrustedWhat names what is being left out, for a notice.
++ func untrustedWhat(g ccsettings.Grant) string {
++ 	var parts []string
++ 	if len(g.Servers) > 0 {
++ 		names := make([]string, 0, len(g.Servers))
++ 		for n := range g.Servers {
++ 			names = append(names, n)
++ 		}
++ 		sort.Strings(names)
++ 		parts = append(parts, fmt.Sprintf("the MCP servers in %s (%s) were not started", ccsettings.ProjectMCP, strings.Join(names, ", ")))
++ 	}
++ 	if len(g.Allow) > 0 {
++ 		parts = append(parts, fmt.Sprintf("the allow rules in %s are ignored", strings.Join(g.AllowFrom, " and ")))
++ 	}
++ 	return strings.Join(parts, ", and ")
++ }
++ // askTrustOnTerminal is the trust question, asked on the terminal before the
++ // TUI takes it over — the same moment Claude Code asks its own. It goes to
++ // stderr and reads stdin a byte at a time, so nothing typed after the answer
++ // is swallowed into a buffer the TUI never sees.
++ func askTrustOnTerminal(in io.Reader, out io.Writer) func(string, []string) (bool, bool) {
++ 	return func(root string, lines []string) (bool, bool) {
++ 		fmt.Fprintf(out, "\nClaude Code's configuration for %s would:\n\n", root)
++ 		for _, l := range lines {
++ 			fmt.Fprintln(out, "  "+l)
++ 		}
++ 		fmt.Fprint(out, "\nThese files come from the repository, not from you: trusting them lets it\n"+
++ 			"choose commands this machine runs. Your answer is remembered until they change.\n"+
++ 			"Trust them for this checkout? [y/N] ")
++ 		line, err := readLine(in)
++ 		if err != nil {
++ 			fmt.Fprintln(out)
++ 			return false, false
++ 		}
++ 		switch strings.ToLower(strings.TrimSpace(line)) {
++ 		case "y", "yes":
++ 			return true, true
++ 		default:
++ 			return false, true
++ 		}
++ 	}
++ }
++ // readLine reads up to a newline without reading past it.
++ func readLine(r io.Reader) (string, error) {
++ 	var b strings.Builder
++ 	buf := make([]byte, 1)
++ 	for {
++ 		n, err := r.Read(buf)
++ 		if n == 1 {
++ 			if buf[0] == '\n' {
++ 				return b.String(), nil
++ 			}
++ 			b.WriteByte(buf[0])
++ 		}
++ 		if err != nil {
++ 			if err == io.EOF && b.Len() > 0 {
++ 				return b.String(), nil
++ 			}
++ 			return "", err
++ 		}
++ 	}
++ }
++ // rulesFor builds the rule set for a root other than the one Codey started
++ // in — an ACP client hands each thread a directory of its own. Nobody can be
++ // asked from there, so the project's allow rules count only if trust was
++ // already recorded for them, or -trust-project was given. Each root is read
++ // once; a model switch rebuilds the agent, and the same notices twice would
++ // be noise.
++ func rulesFor(o ccOptions, startRoot string, start ccSetup) func(root string) approval.RuleSet {
++ 	var mu sync.Mutex
++ 	cache := map[string]approval.RuleSet{startRoot: start.Rules}
++ 	return func(root string) approval.RuleSet {
++ 		mu.Lock()
++ 		defer mu.Unlock()
++ 		if rs, ok := cache[root]; ok {
++ 			return rs
++ 		}
++ 		ro := o
++ 		ro.Root, ro.Ask = root, nil
++ 		mcpFiles, _ := ccsettings.LoadMCP(o.Home, root)
++ 		perms, errs := ccsettings.LoadPermissions(o.Home, root)
++ 		for _, err := range errs {
++ 			o.Notice("%v — its deny rules are not in force", err)
++ 		}
++ 		trusted := settleTrust(ro, ccsettings.NewGrant(mcpFiles, perms))
++ 		rules, notes := ccsettings.NewRuleset(o.Home, root, perms, trusted)
++ 		for _, n := range notes {
++ 			o.Notice("%s", n)
++ 		}
++ 		var rs approval.RuleSet
++ 		if !rules.Empty() {
++ 			rs = rules
++ 		}
++ 		cache[root] = rs
++ 		return rs
++ 	}
++ }
++ // instructionsFor reads the CLAUDE.md files for a root, formatted for the
++ // system prompt, reporting what could not be read.
++ func instructionsFor(home string, notice func(string, ...any)) func(root string) string {
++ 	var mu sync.Mutex
++ 	cache := map[string]string{}
++ 	return func(root string) string {
++ 		mu.Lock()
++ 		defer mu.Unlock()
++ 		if s, ok := cache[root]; ok {
++ 			return s
++ 		}
++ 		files, errs := ccsettings.LoadInstructions(home, root)
++ 		for _, err := range errs {
++ 			notice("%v", err)
++ 		}
++ 		s := ccsettings.FormatInstructions(files)
++ 		cache[root] = s
++ 		return s
++ 	}
++ }

+274−0cmd/codey/ccconfig_test.goaddedView File

++ package main
++ import (
++ 	"fmt"
++ 	"os"
++ 	"path/filepath"
++ 	"strings"
++ 	"testing"
++ 	"github.com/johannSo/codey/internal/approval"
++ 	"github.com/johannSo/codey/internal/ccsettings"
++ 	"github.com/johannSo/codey/internal/config"
++ )
++ // ccFixture is a home and a project under a temp directory — never the real
++ // ~/.claude* — with a project .mcp.json, a shared allow rule, and a server of
++ // the user's own.
++ type ccFixture struct {
++ 	home, root string
++ 	store      ccsettings.TrustStore
++ 	notices    []string
++ 	asked      int
++ }
++ func newCCFixture(t *testing.T) *ccFixture {
++ 	t.Helper()
++ 	base := t.TempDir()
++ 	f := &ccFixture{
++ 		home:  filepath.Join(base, "home"),
++ 		root:  filepath.Join(base, "home", "proj"),
++ 		store: ccsettings.TrustStore{Path: filepath.Join(base, "config", "codey", ccsettings.TrustFilename)},
++ 	}
++ 	f.write(t, f.root, ".mcp.json", `{"mcpServers":{"repo-tool":{"command":"repo-mcp","args":["--root","."]}}}`)
++ 	f.write(t, f.root, ".claude/settings.json", `{"permissions":{"allow":["Bash(make:*)"],"deny":["Bash(rm:*)"]}}`)
++ 	f.write(t, f.home, ".claude.json", `{"mcpServers":{"mine":{"command":"my-mcp"}}}`)
++ 	return f
++ }
++ func (f *ccFixture) write(t *testing.T, dir, rel, body string) {
++ 	t.Helper()
++ 	path := filepath.Join(dir, rel)
++ 	os.MkdirAll(filepath.Dir(path), 0o755)
++ 	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
++ 		t.Fatal(err)
++ 	}
++ }
++ // opts builds the options; answer nil means nobody can be asked.
++ func (f *ccFixture) opts(answer *bool) ccOptions {
++ 	o := ccOptions{
++ 		Home:   f.home,
++ 		Root:   f.root,
++ 		Own:    map[string]config.MCPServer{"codey-own": {Command: "own"}},
++ 		Store:  f.store,
++ 		Lookup: func(string) (string, bool) { return "", false },
++ 		Notice: func(format string, args ...any) { f.notices = append(f.notices, fmt.Sprintf(format, args...)) },
++ 	}
++ 	if answer != nil {
++ 		o.Ask = func(string, []string) (bool, bool) { f.asked++; return *answer, true }
++ 	}
++ 	return o
++ }
++ func (f *ccFixture) said(s string) bool {
++ 	for _, n := range f.notices {
++ 		if strings.Contains(n, s) {
++ 			return true
++ 		}
++ 	}
++ 	return false
++ }
++ func allowed(rs approval.RuleSet, cmd string) approval.Verdict {
++ 	if rs == nil {
++ 		return approval.NoVerdict
++ 	}
++ 	return rs.Check("bash", []byte(fmt.Sprintf(`{"command":%q}`, cmd))).Verdict
++ }
++ func yes() *bool { v := true; return &v }
++ func no() *bool  { v := false; return &v }
++ // Headless — -p, agent stdio — nothing from the repository is used, the user's
++ // own servers still start, the repository's deny rules still hold, and the
++ // notice names the flag that says otherwise.
++ func TestUntrustedHeadless(t *testing.T) {
++ 	f := newCCFixture(t)
++ 	got := loadClaudeCode(f.opts(nil))
++ 	if _, ok := got.MCP["repo-tool"]; ok {
++ 		t.Error("an untrusted project server would start")
++ 	}
++ 	for _, name := range []string{"mine", "codey-own"} {
++ 		if _, ok := got.MCP[name]; !ok {
++ 			t.Errorf("%s should start: it is the user's own", name)
++ 		}
++ 	}
++ 	if v := allowed(got.Rules, "make build"); v != approval.NoVerdict {
++ 		t.Errorf("an untrusted project allow rule was honoured: %v", v)
++ 	}
++ 	if v := allowed(got.Rules, "rm -rf x"); v != approval.VerdictDeny {
++ 		t.Errorf("the project's deny rule should hold untrusted: %v", v)
++ 	}
++ 	if !f.said(trustFlag) || !f.said("repo-tool") {
++ 		t.Errorf("notices %q should name the server and %s", f.notices, trustFlag)
++ 	}
++ }
++ func TestTrustFlag(t *testing.T) {
++ 	f := newCCFixture(t)
++ 	o := f.opts(no())
++ 	o.Trust = true
++ 	got := loadClaudeCode(o)
++ 	if _, ok := got.MCP["repo-tool"]; !ok || f.asked != 0 {
++ 		t.Errorf("-trust-project should start the project's servers without asking (asked %d)", f.asked)
++ 	}
++ 	if v := allowed(got.Rules, "make build"); v != approval.VerdictAllow {
++ 		t.Errorf("-trust-project should honour the project's allow rules: %v", v)
++ 	}
++ 	// The flag is for one run: nothing is recorded.
++ 	if decided, _, _ := f.store.Lookup(f.root, ccsettings.NewGrant(mustMCP(t, f), mustPerms(t, f)).Fingerprint()); decided {
++ 		t.Error("the flag should not record a decision")
++ 	}
++ }
++ func TestTrustIsAskedOnceAndRemembered(t *testing.T) {
++ 	f := newCCFixture(t)
++ 	got := loadClaudeCode(f.opts(yes()))
++ 	if f.asked != 1 {
++ 		t.Fatalf("asked %d times, want 1", f.asked)
++ 	}
++ 	if _, ok := got.MCP["repo-tool"]; !ok {
++ 		t.Error("a trusted project server should start")
++ 	}
++ 	if v := allowed(got.Rules, "make build"); v != approval.VerdictAllow {
++ 		t.Errorf("a trusted project allow rule should be honoured: %v", v)
++ 	}
++ 	// The next start, interactive or not, does not ask again.
++ 	got = loadClaudeCode(f.opts(yes()))
++ 	if f.asked != 1 {
++ 		t.Errorf("asked again for the same definitions")
++ 	}
++ 	got = loadClaudeCode(f.opts(nil))
++ 	if _, ok := got.MCP["repo-tool"]; !ok {
++ 		t.Error("a recorded trust should hold for a headless run")
++ 	}
++ 	// A changed .mcp.json is a new question.
++ 	f.write(t, f.root, ".mcp.json", `{"mcpServers":{"repo-tool":{"command":"curl","args":["evil.example"]}}}`)
++ 	got = loadClaudeCode(f.opts(nil))
++ 	if _, ok := got.MCP["repo-tool"]; ok {
++ 		t.Error("a changed server started on the old trust")
++ 	}
++ 	loadClaudeCode(f.opts(yes()))
++ 	if f.asked != 2 {
++ 		t.Errorf("a changed .mcp.json should ask again (asked %d)", f.asked)
++ 	}
++ 	// So is a changed allow list.
++ 	f.write(t, f.root, ".claude/settings.json", `{"permissions":{"allow":["Bash(make:*)","Bash"]}}`)
++ 	got = loadClaudeCode(f.opts(nil))
++ 	if v := allowed(got.Rules, "make build"); v != approval.NoVerdict {
++ 		t.Errorf("a changed allow list kept the old trust: %v", v)
++ 	}
++ }
++ func TestDeclinedTrustIsRemembered(t *testing.T) {
++ 	f := newCCFixture(t)
++ 	got := loadClaudeCode(f.opts(no()))
++ 	if _, ok := got.MCP["repo-tool"]; ok {
++ 		t.Error("a declined project server would start")
++ 	}
++ 	f.notices = nil
++ 	loadClaudeCode(f.opts(yes()))
++ 	if f.asked != 1 {
++ 		t.Errorf("a refusal should not be asked again (asked %d)", f.asked)
++ 	}
++ 	if !f.said("declined") || !f.said(trustFlag) {
++ 		t.Errorf("notices %q should say it was declined and name %s", f.notices, trustFlag)
++ 	}
++ }
++ // Nothing to trust is nothing to ask.
++ func TestNoProjectFilesNoQuestion(t *testing.T) {
++ 	f := newCCFixture(t)
++ 	os.Remove(filepath.Join(f.root, ".mcp.json"))
++ 	f.write(t, f.root, ".claude/settings.json", `{"permissions":{"deny":["Bash(rm:*)"]}}`)
++ 	got := loadClaudeCode(f.opts(yes()))
++ 	if f.asked != 0 {
++ 		t.Error("asked about a project that grants nothing")
++ 	}
++ 	if v := allowed(got.Rules, "rm x"); v != approval.VerdictDeny {
++ 		t.Errorf("deny = %v", v)
++ 	}
++ }
++ // A machine without Claude Code leaves the policy exactly as it was.
++ func TestNoClaudeCodeNoRules(t *testing.T) {
++ 	base := t.TempDir()
++ 	o := ccOptions{Home: filepath.Join(base, "h"), Root: filepath.Join(base, "r"), Notice: func(string, ...any) {}, Lookup: func(string) (string, bool) { return "", false }}
++ 	got := loadClaudeCode(o)
++ 	if got.Rules != nil {
++ 		t.Errorf("rules = %#v, want nil", got.Rules)
++ 	}
++ }
++ // A root other than the startup one — an ACP thread in a worktree — is never
++ // asked about, and uses only what was already trusted.
++ func TestRulesForAnotherRoot(t *testing.T) {
++ 	f := newCCFixture(t)
++ 	start := loadClaudeCode(f.opts(nil))
++ 	other := filepath.Join(f.home, "other")
++ 	f.write(t, other, ".claude/settings.json", `{"permissions":{"allow":["Bash(make:*)"]}}`)
++ 	o := f.opts(yes())
++ 	lookup := rulesFor(o, f.root, start)
++ 	if v := allowed(lookup(other), "make"); v != approval.NoVerdict || f.asked != 0 {
++ 		t.Errorf("verdict %v, asked %d: another root must not be asked about", v, f.asked)
++ 	}
++ 	g := ccsettings.NewGrant(nil, []ccsettings.Permissions{{Scope: ccsettings.ScopeProject, Allow: []string{"Bash(make:*)"}}})
++ 	f.store.Record(other, g.Fingerprint(), true)
++ 	lookup = rulesFor(o, f.root, start)
++ 	if v := allowed(lookup(other), "make"); v != approval.VerdictAllow {
++ 		t.Errorf("a recorded trust for the other root should count: %v", v)
++ 	}
++ }
++ func TestAskTrustOnTerminal(t *testing.T) {
++ 	tests := []struct {
++ 		in                string
++ 		trusted, answered bool
++ 	}{
++ 		{"y\n", true, true},
++ 		{"YES\n", true, true},
++ 		{"n\n", false, true},
++ 		{"\n", false, true},
++ 		{"", false, false},
++ 	}
++ 	for _, tc := range tests {
++ 		var out strings.Builder
++ 		ask := askTrustOnTerminal(strings.NewReader(tc.in), &out)
++ 		trusted, answered := ask("/src/proj", []string{"start these MCP servers, from .mcp.json:", "  db: db-mcp"})
++ 		if trusted != tc.trusted || answered != tc.answered {
++ 			t.Errorf("%q: got %v %v, want %v %v", tc.in, trusted, answered, tc.trusted, tc.answered)
++ 		}
++ 		if !strings.Contains(out.String(), "db: db-mcp") || !strings.Contains(out.String(), "[y/N]") {
++ 			t.Errorf("prompt did not show the definitions:\n%s", out.String())
++ 		}
++ 	}
++ }
++ // The answer is read without reading past it: whatever is typed next belongs
++ // to the TUI.
++ func TestReadLineStopsAtTheNewline(t *testing.T) {
++ 	r := strings.NewReader("y\nnext")
++ 	line, err := readLine(r)
++ 	if line != "y" || err != nil {
++ 		t.Fatalf("%q %v", line, err)
++ 	}
++ 	rest := make([]byte, 8)
++ 	n, _ := r.Read(rest)
++ 	if string(rest[:n]) != "next" {
++ 		t.Errorf("rest = %q", rest[:n])
++ 	}
++ }
++ func mustMCP(t *testing.T, f *ccFixture) []ccsettings.MCPFile {
++ 	files, _ := ccsettings.LoadMCP(f.home, f.root)
++ 	return files
++ }
++ func mustPerms(t *testing.T, f *ccFixture) []ccsettings.Permissions {
++ 	p, _ := ccsettings.LoadPermissions(f.home, f.root)
++ 	return p
++ }

+41−2cmd/codey/main.goView File

@@ -17,6 +17,7 @@ import (
17	17	"github.com/johannSo/codey/internal/agent"
18	18	"github.com/johannSo/codey/internal/approval"
19	19	"github.com/johannSo/codey/internal/ask"
	20	+ "github.com/johannSo/codey/internal/ccsettings"
20	21	"github.com/johannSo/codey/internal/claudecode"
21	22	"github.com/johannSo/codey/internal/config"
22	23	"github.com/johannSo/codey/internal/diag"
@@ -95,6 +96,7 @@ func run() error {
95	96	noHooks := flag.Bool("no-hooks", false, "do not run the hooks in the config, and do not report agent state to herdr")
96	97	noDiagnostics := flag.Bool("no-diagnostics", false, "do not check an edited file with the language server or linter installed for it")
97	98	noMCP := flag.Bool("no-mcp", false, "do not start the MCP servers in the config, so their tools are not offered")
	99	+ trustProject := flag.Bool(strings.TrimPrefix(trustFlag, "-"), false, "use this project's .mcp.json servers and the allow rules in its .claude/settings.json for one run, without asking")
98	100
99	101	// Read the line before the flag package does. Three invocations belong to
100	102	// a program driving Codey rather than to a person — see agentcmd.go — and
@@ -376,9 +378,34 @@ func run() error {
376	378	// in and stay there across /worktree, since a server's working directory
377	379	// is fixed when it starts. A server that will not start is reported and
378	380	// left out; the session goes on without its tools.
	381	+ // Claude Code's configuration for this root: its MCP servers merged under
	382	+ // Codey's own, and its permission rules. The project's committed files
	383	+ // are used only if this checkout is trusted, which is asked here — on the
	384	+ // terminal, before the TUI owns it — when there is a person to ask and
	385	+ // nothing has been decided about these exact definitions. -p and agent
	386	+ // runs are not asked; see ccconfig.go.
	387	+ ccOpts := ccOptions{
	388	+ Home: home,
	389	+ Root: root,
	390	+ Own: cfg.MCPServers,
	391	+ Trust: *trustProject,
	392	+ NoMCP: *noMCP,
	393	+ Notice: notice,
	394	+ }
	395	+ if cfgPath, err := config.Path(); err == nil {
	396	+ ccOpts.Store = ccsettings.DefaultTrustStore(cfgPath)
	397	+ }
	398	+ if inv.Kind == invNormal && *prompt == "" && interactive() {
	399	+ ccOpts.Ask = askTrustOnTerminal(os.Stdin, os.Stderr)
	400	+ }
	401	+ cc := loadClaudeCode(ccOpts)
	402	+ instructions := instructionsFor(home, notice)
	403	+
379	404	var mcpTools []tools.Tool
380		- if len(cfg.MCPServers) > 0 && !*noMCP {
381		- ts, closer, errs := mcp.Connect(context.Background(), root, cfg)
	405	+ if len(cc.MCP) > 0 && !*noMCP {
	406	+ mcpCfg := cfg
	407	+ mcpCfg.MCPServers = cc.MCP
	408	+ ts, closer, errs := mcp.Connect(context.Background(), root, mcpCfg)
382	409	defer closer.Close()
383	410	for _, err := range errs {
384	411	notice("%v", err)
@@ -448,6 +475,7 @@ func run() error {
448	475	render := &ui.Renderer{W: os.Stdout, Verbose: *verbose}
449	476	approver := &ui.Approver{In: in, Out: os.Stdout}
450	477	policy := approval.New(approver.Prompt)
	478	+ policy.Rules = cc.Rules
451	479
452	480	// Questions go to the line front end until a TUI takes them over in
453	481	// tui.Run. The tool belongs to the session's own agent and is registered
@@ -479,6 +507,7 @@ func run() error {
479	507	Skills: found,
480	508	ServerTools: serverTools,
481	509	SystemPrefix: systemPrefix,
	510	+ Instructions: instructions(root),
482	511	}
483	512
484	513	// An agent run hands the whole thing over to the protocol and never comes
@@ -501,6 +530,9 @@ func run() error {
501	530	Log: log,
502	531	Base: base,
503	532	Tools: toolsIn,
	533	+
	534	+ Rules: rulesFor(ccOpts, root, cc),
	535	+ Instructions: instructions,
504	536	})
505	537	}
506	538
@@ -681,6 +713,7 @@ func run() error {
681	713	// to come up in the tab whose agent is asking.
682	714	pol := approval.New(nil)
683	715	pol.YOLO = acceptAll
	716	+ pol.Rules = cc.Rules
684	717
685	718	var tabSup *subagent.Supervisor
686	719	if !*noAgents {
@@ -851,6 +884,12 @@ func run() error {
851	884	for _, a := range allowed {
852	885	fmt.Println(" " + a)
853	886	}
	887	+ if rules := policy.RuleLines(); len(rules) > 0 {
	888	+ fmt.Println("from Claude Code's settings:")
	889	+ for _, r := range rules {
	890	+ fmt.Println(" " + r)
	891	+ }
	892	+ }
854	893	continue
855	894	}
856	895	if err := once(ctx, a, render, sessionDir, session, root, client, line); err != nil {

+8−0internal/agent/loop.goView File

@@ -321,6 +321,13 @@ type Options struct {
321	321	NoCache bool
322	322	// Stream uses the SSE endpoint so output appears as it is produced.
323	323	Stream bool
	324	+ // Instructions is the project's standing instructions — the CLAUDE.md
	325	+ // files, already formatted as a section of the system prompt — appended
	326	+ // after Codey's own. Read once at startup by whoever builds the agent, so
	327	+ // it is constant for the session like everything else in the prefix.
	328	+ // Empty leaves the prompt as it was: the model is still told to read a
	329	+ // CLAUDE.md or AGENTS.md for itself.
	330	+ Instructions string
324	331	// Skills are the instruction sets discovered at startup. Their names and
325	332	// descriptions are appended to the system prompt; the bodies are loaded on
326	333	// demand by the skill tool.
@@ -553,6 +560,7 @@ func New(client llm.Client, reg tools.Registry, state State, log metrics.Log
553	560	if opts.System == "" {
554	561	opts.System = defaultSystem
555	562	}
	563	+ opts.System += opts.Instructions
556	564	opts.System += skillListing(opts.Skills)
557	565	opts.System += modelListing(opts.Models)
558	566	return &Agent{client: client, tools: reg, state: state, log: log, opts: opts}

+17−0internal/agent/loop_test.goView File

@@ -815,6 +815,23 @@ func TestSystemPromptListsSkills(t *testing.T) {
815	815	}
816	816	}
817	817
	818	+ // The project's instructions follow Codey's own and come before the skill
	819	+ // listing, so the defaults they outrank are the ones already read.
	820	+ func TestSystemPromptCarriesInstructions(t *testing.T) {
	821	+ const section = "\n\n# Instructions from CLAUDE.md\n\nRun make test."
	822	+ a := New(nil, tools.NewRegistry(nil), NewState(), nil, Options{
	823	+ Instructions: section,
	824	+ Skills: []skills.Skill{{Name: "s", Description: "d"}},
	825	+ })
	826	+ sys := a.opts.System
	827	+ if !strings.HasPrefix(sys, defaultSystem+section) {
	828	+ t.Errorf("instructions not appended straight after the default prompt:\n%s", sys)
	829	+ }
	830	+ if !strings.Contains(sys, "s: d") {
	831	+ t.Error("the skill listing was lost")
	832	+ }
	833	+ }
	834	+
818	835	func TestSystemPromptUnchangedWithoutSkills(t *testing.T) {
819	836	a := New(nil, tools.NewRegistry(nil), NewState(), nil, Options{})
820	837	if a.opts.System != defaultSystem {

+35−2internal/approval/policy.goView File

@@ -36,6 +36,11 @@ type Request struct {
36	36	// agent. Several agents share one prompt box, so a request that does not
37	37	// say who is asking cannot be decided on.
38	38	Agent string
	39	+ // Forced names the standing rule that insisted on this prompt — an ask
	40	+ // rule in a settings file — and is empty for an ordinary one. A front end
	41	+ // that settles some prompts by itself, as an ACP permission floor does,
	42	+ // must not settle these: the rule exists to stop exactly that.
	43	+ Forced string
39	44	}
40	45
41	46	// Prompt asks a human. Returning an error aborts the turn.
@@ -90,6 +95,13 @@ type Policy struct {
90	95	// fired around the prompt rather than around Approve, so a call allowed
91	96	// outright or remembered from earlier says nothing.
92	97	Hooks *hooks.Hooks
	98	+
	99	+ // Rules are standing rules from a settings file, consulted before
	100	+ // anything else: before YOLO, before the read-only list and before the
	101	+ // session's memory. A deny there holds in every mode, which is what makes
	102	+ // it worth writing down; an ask there forces a prompt the mode would have
	103	+ // skipped. Nil means none.
	104	+ Rules RuleSet
93	105	}
94	106
95	107	// New builds a policy.
@@ -108,14 +120,35 @@ func (p *Policy) Approve(ctx context.Context, tool string, input json.RawMessage
108	120	// remembered for the whole session, not per agent: "always allow bash" is a
109	121	// statement about this working tree, and an agent id is not a trust boundary.
110	122	func (p *Policy) ApproveAs(ctx context.Context, agent, tool string, input json.RawMessage) error {
111		- if p == nil \|\| p.YOLO \|\| readOnly[tool] {
	123	+ if p == nil {
	124	+ return nil
	125	+ }
	126	+ // Standing rules first. A deny is the one thing even -yolo does not
	127	+ // override: somebody wrote it down so that it would hold whatever mode the
	128	+ // session happened to be in. A read-only tool is not exempt either — a
	129	+ // rule against reading .env is about reading.
	130	+ ruling := p.check(tool, input)
	131	+ switch ruling.Verdict {
	132	+ case VerdictDeny:
	133	+ return fmt.Errorf("%s was not run: it is denied by the rule %s. Do not retry it; find another way, or tell the user what you need", tool, ruling.because())
	134	+ case VerdictAllow:
	135	+ return nil
	136	+ }
	137	+ forced := ruling.Verdict == VerdictAsk
	138	+ if !forced && (p.YOLO \|\| readOnly[tool]) {
112	139	return nil
113	140	}
114	141	req := Describe(tool, input)
115	142	req.Agent = agent
	143	+ if forced {
	144	+ req.Forced = ruling.because()
	145	+ req.Summary += " — asked because of " + req.Forced
	146	+ }
116	147
	148	+ // An ask rule outranks the session's memory too: "always this tool" given
	149	+ // to an earlier prompt was not an answer to a rule that says always ask.
117	150	p.mu.Lock()
118		- allowed := p.tools[tool] \|\| (req.Rememberable && p.commands[memoryKey(tool, req.Detail)])
	151	+ allowed := !forced && (p.tools[tool] \|\| (req.Rememberable && p.commands[memoryKey(tool, req.Detail)]))
119	152	p.mu.Unlock()
120	153	if allowed {
121	154	return nil

+73−0internal/approval/ruleset.goaddedView File

++ package approval
++ import "encoding/json"
++ // Verdict is what a set of standing rules says about one tool call, before
++ // anyone is asked and before anything the session remembers is consulted.
++ type Verdict int
++ const (
++ 	// NoVerdict means no rule spoke, and the call is decided the ordinary way:
++ 	// the mode, the session's memory, and then a prompt.
++ 	NoVerdict Verdict = iota
++ 	// VerdictAllow lets the call through without a prompt.
++ 	VerdictAllow
++ 	// VerdictAsk puts the call to a human even when the mode would have let
++ 	// it through, and even when the session remembers allowing it.
++ 	VerdictAsk
++ 	// VerdictDeny refuses the call outright, in every mode, -yolo included.
++ 	VerdictDeny
++ )
++ // Ruling is a verdict and the rule that produced it, for the message the model
++ // reads and the prompt a human reads. "Denied" with no reason is a dead end;
++ // "denied by Bash(rm:*) in ~/.claude/settings.json" is something to fix.
++ type Ruling struct {
++ 	Verdict Verdict
++ 	// Rule is the rule as it was written, e.g. Bash(npm run test:*).
++ 	Rule string
++ 	// Source is where the rule was written, e.g. ~/.claude/settings.json.
++ 	Source string
++ }
++ // RuleSet is a set of standing rules that act before the session's own
++ // memory: rules written down in a settings file rather than given as an
++ // answer to a prompt. Claude Code's permissions.allow, deny and ask are the
++ // ones that exist so far.
++ //
++ // It is an interface so this package stays ignorant of where rules come from
++ // and of the grammar they are written in. Whoever loads them decides which
++ // files are honoured; the policy only acts on what they say.
++ type RuleSet interface {
++ 	// Check rules on one call. Deny outranks ask, which outranks allow, so a
++ 	// single rule set can never be argued out of a refusal by a broader
++ 	// permission elsewhere in it.
++ 	Check(tool string, input json.RawMessage) Ruling
++ 	// Lines describe the rules for /allowed, grouped by where they came from.
++ 	Lines() []string
++ }
++ // check is Rules.Check, tolerating a policy with no rules.
++ func (p *Policy) check(tool string, input json.RawMessage) Ruling {
++ 	if p.Rules == nil {
++ 		return Ruling{}
++ 	}
++ 	return p.Rules.Check(tool, input)
++ }
++ // RuleLines is what /allowed shows under the session's own memory: the
++ // standing rules, and the files they came from. Nil when there are none.
++ func (p *Policy) RuleLines() []string {
++ 	if p == nil || p.Rules == nil {
++ 		return nil
++ 	}
++ 	return p.Rules.Lines()
++ }
++ // because names the rule behind a ruling, for a message.
++ func (r Ruling) because() string {
++ 	if r.Source == "" {
++ 		return r.Rule
++ 	}
++ 	return r.Rule + " in " + r.Source
++ }

+143−0internal/approval/ruleset_test.goaddedView File

++ package approval
++ import (
++ 	"context"
++ 	"encoding/json"
++ 	"reflect"
++ 	"strings"
++ 	"testing"
++ )
++ // fixedRules rules the same way on every call to one tool.
++ type fixedRules struct {
++ 	tool    string
++ 	verdict Verdict
++ }
++ func (f fixedRules) Check(tool string, _ json.RawMessage) Ruling {
++ 	if tool != f.tool {
++ 		return Ruling{}
++ 	}
++ 	return Ruling{Verdict: f.verdict, Rule: "Rule(x)", Source: "settings.json"}
++ }
++ func (f fixedRules) Lines() []string { return []string{"settings.json", "  rule"} }
++ func TestStandingRules(t *testing.T) {
++ 	tests := []struct {
++ 		name       string
++ 		tool       string
++ 		verdict    Verdict
++ 		yolo       bool
++ 		remembered bool
++ 		wantErr    bool
++ 		wantPrompt int
++ 	}{
++ 		{name: "deny holds under yolo", tool: "bash", verdict: VerdictDeny, yolo: true, wantErr: true},
++ 		{name: "deny holds for a read-only tool", tool: "read_file", verdict: VerdictDeny, wantErr: true},
++ 		{name: "deny beats session memory", tool: "bash", verdict: VerdictDeny, remembered: true, wantErr: true},
++ 		{name: "allow skips the prompt", tool: "bash", verdict: VerdictAllow},
++ 		{name: "ask prompts under yolo", tool: "bash", verdict: VerdictAsk, yolo: true, wantPrompt: 1},
++ 		{name: "ask prompts for a read-only tool", tool: "read_file", verdict: VerdictAsk, wantPrompt: 1},
++ 		{name: "ask beats session memory", tool: "bash", verdict: VerdictAsk, remembered: true, wantPrompt: 1},
++ 		{name: "no verdict prompts as usual", tool: "bash", verdict: NoVerdict, wantPrompt: 1},
++ 		{name: "no verdict still honours memory", tool: "bash", verdict: NoVerdict, remembered: true},
++ 	}
++ 	for _, tc := range tests {
++ 		t.Run(tc.name, func(t *testing.T) {
++ 			var asked int
++ 			var forced string
++ 			p := New(func(_ context.Context, r Request) (Decision, error) {
++ 				asked++
++ 				forced = r.Forced
++ 				return Once, nil
++ 			})
++ 			p.YOLO = tc.yolo
++ 			p.Rules = fixedRules{tool: tc.tool, verdict: tc.verdict}
++ 			if tc.remembered {
++ 				p.tools[tc.tool] = true
++ 			}
++ 			err := approve(t, p, tc.tool, `{"command":"ls","path":"a"}`)
++ 			if (err != nil) != tc.wantErr {
++ 				t.Fatalf("err = %v, want error %v", err, tc.wantErr)
++ 			}
++ 			if err != nil && !strings.Contains(err.Error(), "Rule(x) in settings.json") {
++ 				t.Errorf("denial %q should name the rule and its file", err)
++ 			}
++ 			if asked != tc.wantPrompt {
++ 				t.Errorf("prompted %d times, want %d", asked, tc.wantPrompt)
++ 			}
++ 			if tc.verdict == VerdictAsk && forced == "" {
++ 				t.Error("a prompt an ask rule forced should say so")
++ 			}
++ 		})
++ 	}
++ }
++ // Headless, an ask rule is a refusal with nobody to put the question to —
++ // which is what the rule asked for.
++ func TestAskRuleHeadlessDenies(t *testing.T) {
++ 	p := New(nil)
++ 	p.YOLO = true
++ 	p.Rules = fixedRules{tool: "bash", verdict: VerdictAsk}
++ 	if err := approve(t, p, "bash", `{"command":"ls"}`); err == nil {
++ 		t.Error("an ask rule with no prompt should not run the call")
++ 	}
++ }
++ func TestRuleLines(t *testing.T) {
++ 	var p *Policy
++ 	if p.RuleLines() != nil {
++ 		t.Error("nil policy")
++ 	}
++ 	p = New(nil)
++ 	if p.RuleLines() != nil {
++ 		t.Error("no rules")
++ 	}
++ 	p.Rules = fixedRules{}
++ 	if len(p.RuleLines()) != 2 {
++ 		t.Error("lines not passed through")
++ 	}
++ }
++ func TestSimpleCommands(t *testing.T) {
++ 	tests := []struct {
++ 		script string
++ 		want   []string
++ 		pinned []bool
++ 		opaque bool
++ 	}{
++ 		{"git status", []string{"git status"}, []bool{true}, false},
++ 		{"go build ./... && go test ./...", []string{"go build ./...", "go test ./..."}, []bool{true, true}, false},
++ 		{"ls | grep x; echo done", []string{"ls", "grep x", "echo done"}, []bool{true, true, true}, false},
++ 		{"(cd sub && make)", []string{"cd sub", "make"}, []bool{true, true}, false},
++ 		{`git commit -m "fix: the thing"`, []string{"git commit -m fix: the thing"}, []bool{true}, false},
++ 		{"rm $FILE", []string{"rm <expanded>"}, []bool{true}, false},
++ 		{"ls *.go", []string{"ls <expanded>"}, []bool{true}, false},
++ 		{"FOO=1 make", []string{"make"}, []bool{false}, false},
++ 		{"echo x > out.txt", []string{"echo x"}, []bool{false}, false},
++ 		{"echo x >> out.txt", []string{"echo x"}, []bool{false}, false},
++ 		{"echo x 2>&1 >/dev/null", []string{"echo x"}, []bool{true}, false},
++ 		{"export A=1", []string{"export"}, []bool{false}, false},
++ 		{"echo $(whoami)", []string{"echo <expanded>", "whoami"}, []bool{true, true}, true},
++ 		{"diff <(ls a) <(ls b)", []string{"diff <expanded> <expanded>", "ls a", "ls b"}, []bool{true, true, true}, true},
++ 	}
++ 	for _, tc := range tests {
++ 		cmds, info := SimpleCommands(tc.script)
++ 		var got []string
++ 		var pinned []bool
++ 		for _, c := range cmds {
++ 			got = append(got, c.Text())
++ 			pinned = append(pinned, c.Pinned)
++ 		}
++ 		if !reflect.DeepEqual(got, tc.want) || !reflect.DeepEqual(pinned, tc.pinned) {
++ 			t.Errorf("%q: got %q %v, want %q %v", tc.script, got, pinned, tc.want, tc.pinned)
++ 		}
++ 		if info.Opaque != tc.opaque {
++ 			t.Errorf("%q: opaque %v, want %v", tc.script, info.Opaque, tc.opaque)
++ 		}
++ 	}
++ 	if cmds, info := SimpleCommands("echo 'open"); cmds != nil || info.ParseError == nil {
++ 		t.Error("a parse error should yield nothing")
++ 	}
++ }

+158−0internal/approval/simple.goaddedView File

++ package approval
++ import (
++ 	"strings"
++ 	"mvdan.cc/sh/v3/syntax"
++ )
++ // SimpleCommand is one command a shell script runs, as its words.
++ //
++ // It exists for rules written as command prefixes — Claude Code's
++ // Bash(npm run test:*) — which can only be matched honestly one simple command
++ // at a time. Matched against the whole line, "npm run test && rm -rf ~" starts
++ // with "npm run test", and an allow rule written for the first half would
++ // quietly allow the second.
++ type SimpleCommand struct {
++ 	// Words are the command's words after quote removal: "git", "commit",
++ 	// "-m", "fix it". A word the shell would build at run time — a variable,
++ 	// a glob, a backslash escape this reader does not undo — is left empty,
++ 	// and Literal says so.
++ 	Words []string
++ 	// Literal is parallel to Words: true where the word is fixed text.
++ 	Literal []bool
++ 	// Pinned is false when something about this command is decided by more
++ 	// than its words: a variable assignment in front of it, which can change
++ 	// what the name resolves to (PATH=. git), or an output redirection to a
++ 	// file, which writes somewhere no prefix of the words mentions.
++ 	Pinned bool
++ }
++ // Text is the command as words joined by single spaces, with a placeholder
++ // where a word is not fixed. It is for messages, not for matching.
++ func (c SimpleCommand) Text() string {
++ 	out := make([]string, len(c.Words))
++ 	for i, w := range c.Words {
++ 		if !c.Literal[i] {
++ 			w = "<expanded>"
++ 		}
++ 		out[i] = w
++ 	}
++ 	return strings.Join(out, " ")
++ }
++ // SimpleCommands splits a script into every simple command it contains,
++ // however they are joined: ;, &&, ||, pipes, subshells, the bodies of loops,
++ // conditionals and functions. The ShellInfo is Analyze's for the same script;
++ // when it is opaque, the list is what could be seen and not necessarily
++ // everything that will run, so a caller deciding to allow something must
++ // treat an opaque script as matching nothing.
++ func SimpleCommands(script string) ([]SimpleCommand, ShellInfo) {
++ 	info := Analyze(script)
++ 	if info.ParseError != nil {
++ 		return nil, info
++ 	}
++ 	f, err := syntax.NewParser().Parse(strings.NewReader(script), "")
++ 	if err != nil {
++ 		return nil, info
++ 	}
++ 	var out []SimpleCommand
++ 	syntax.Walk(f, func(node syntax.Node) bool {
++ 		switch n := node.(type) {
++ 		case *syntax.ProcSubst:
++ 			// <(cmd) runs cmd as surely as $(cmd) does, and Analyze does not
++ 			// look for it, so it is marked here.
++ 			info.Opaque, info.Reason = true, "it contains process substitution, so what runs is decided at run time"
++ 		case *syntax.Stmt:
++ 			call, ok := n.Cmd.(*syntax.CallExpr)
++ 			if ok && len(call.Args) > 0 {
++ 				out = append(out, simple(call, n.Redirs))
++ 				return true
++ 			}
++ 			if decl, ok := n.Cmd.(*syntax.DeclClause); ok {
++ 				// export, local, declare: a builtin with assignments for
++ 				// arguments. Kept as a command so a rule must account for it,
++ 				// never pinned, because an assignment is what it does.
++ 				out = append(out, SimpleCommand{Words: []string{decl.Variant.Value}, Literal: []bool{true}})
++ 			}
++ 		}
++ 		return true
++ 	})
++ 	return out, info
++ }
++ func simple(call *syntax.CallExpr, redirs []*syntax.Redirect) SimpleCommand {
++ 	c := SimpleCommand{Pinned: len(call.Assigns) == 0}
++ 	for _, w := range call.Args {
++ 		text, ok := unquote(w)
++ 		c.Words = append(c.Words, text)
++ 		c.Literal = append(c.Literal, ok)
++ 	}
++ 	for _, r := range redirs {
++ 		if writesFile(r) {
++ 			c.Pinned = false
++ 		}
++ 	}
++ 	return c
++ }
++ // unquote returns a word's text after quote removal when the text is fixed,
++ // and false when any part of it is expanded at run time.
++ func unquote(w *syntax.Word) (string, bool) {
++ 	var b strings.Builder
++ 	for _, part := range w.Parts {
++ 		switch p := part.(type) {
++ 		case *syntax.Lit:
++ 			// A backslash in an unquoted literal is an escape the shell will
++ 			// remove; rather than reimplement that, the word is not fixed.
++ 			// Globs and a leading ~ are expanded by the shell, so they are
++ 			// not fixed either.
++ 			if strings.ContainsAny(p.Value, "\\*?[") || (b.Len() == 0 && strings.HasPrefix(p.Value, "~")) {
++ 				return "", false
++ 			}
++ 			b.WriteString(p.Value)
++ 		case *syntax.SglQuoted:
++ 			if p.Dollar {
++ 				return "", false
++ 			}
++ 			b.WriteString(p.Value)
++ 		case *syntax.DblQuoted:
++ 			for _, inner := range p.Parts {
++ 				lit, ok := inner.(*syntax.Lit)
++ 				if !ok || strings.Contains(lit.Value, "\\") {
++ 					return "", false
++ 				}
++ 				b.WriteString(lit.Value)
++ 			}
++ 		default:
++ 			return "", false
++ 		}
++ 	}
++ 	return b.String(), true
++ }
++ // writesFile reports whether a redirection writes to a file. Duplicating a
++ // descriptor (2>&1) and throwing output away (>/dev/null) do not.
++ func writesFile(r *syntax.Redirect) bool {
++ 	switch r.Op {
++ 	case syntax.RdrIn, syntax.Hdoc, syntax.DashHdoc, syntax.WordHdoc, syntax.DplIn:
++ 		return false
++ 	case syntax.DplOut:
++ 		target, ok := unquote(r.Word)
++ 		return !ok || !(target == "-" || isDigits(target))
++ 	}
++ 	target, ok := unquote(r.Word)
++ 	return !ok || target != "/dev/null"
++ }
++ func isDigits(s string) bool {
++ 	if s == "" {
++ 		return false
++ 	}
++ 	for _, r := range s {
++ 		if r < '0' || r > '9' {
++ 			return false
++ 		}
++ 	}
++ 	return true
++ }

+96−0internal/ccsettings/ccsettings.goaddedView File

++ // Package ccsettings reads the configuration Claude Code keeps for a user and
++ // for a project, so that someone who already set Claude Code up does not have
++ // to set Codey up a second time: the MCP servers it knows about, the
++ // permission rules in its settings files, and the CLAUDE.md files it loads
++ // into every conversation.
++ //
++ // Reading is the easy half. The half that needs care is what is honoured, and
++ // it turns on who wrote each file. ~/.claude.json and ~/.claude/settings.json
++ // are the user's own, written by the user or by `claude` on their behalf, and
++ // they carry the same weight as Codey's own config. A project's .mcp.json and
++ // .claude/settings.json are committed to the repository, which means they were
++ // written by whoever wrote the repository: starting a server listed there is
++ // running a command a stranger chose, and an allow rule there is a stranger
++ // deciding what runs without asking. Those two are honoured only once the user
++ // has said, for this checkout and these exact definitions, that they trust
++ // them — the same bargain Claude Code's own trust dialog strikes. Anything
++ // that can only take power away — a deny rule, an ask rule — is honoured from
++ // every file, because nobody is harmed by an agent that asks more often.
++ //
++ // Nothing here writes to Claude Code's files. The one file this package
++ // writes is Codey's own record of those trust decisions.
++ package ccsettings
++ import (
++ 	"encoding/json"
++ 	"errors"
++ 	"fmt"
++ 	"io/fs"
++ 	"os"
++ 	"path/filepath"
++ 	"strings"
++ )
++ // Scope is who a setting belongs to, which is what decides whether it is
++ // honoured without asking.
++ type Scope string
++ const (
++ 	// ScopeUser is the user's own, for every project: ~/.claude/settings.json,
++ 	// and the top-level servers in ~/.claude.json.
++ 	ScopeUser Scope = "user"
++ 	// ScopeProject is committed to the repository: .mcp.json and
++ 	// .claude/settings.json at the working root. Written by whoever wrote the
++ 	// repository, so what it grants waits for trust.
++ 	ScopeProject Scope = "project"
++ 	// ScopeLocal is the user's own, for this project only:
++ 	// .claude/settings.local.json, which Claude Code keeps out of git, and the
++ 	// per-project servers in ~/.claude.json, which `claude mcp add` writes.
++ 	ScopeLocal Scope = "local"
++ )
++ // File names, relative to the home directory or the working root.
++ const (
++ 	ClaudeJSON        = ".claude.json"
++ 	UserSettings      = ".claude/settings.json"
++ 	ProjectSettings   = ".claude/settings.json"
++ 	LocalSettings     = ".claude/settings.local.json"
++ 	ProjectMCP        = ".mcp.json"
++ 	UserInstructions  = ".claude/CLAUDE.md"
++ 	instructionsName  = "CLAUDE.md"
++ 	localInstructions = "CLAUDE.local.md"
++ )
++ // readJSON decodes a file into v. A missing file is (false, nil): every file
++ // here is optional, and most machines have none of them.
++ func readJSON(path string, v any) (bool, error) {
++ 	raw, err := os.ReadFile(path)
++ 	if errors.Is(err, fs.ErrNotExist) {
++ 		return false, nil
++ 	}
++ 	if err != nil {
++ 		return false, err
++ 	}
++ 	if err := json.Unmarshal(raw, v); err != nil {
++ 		return false, fmt.Errorf("%s is not valid JSON: %w", path, err)
++ 	}
++ 	return true, nil
++ }
++ // shown is how a path is written in a message: under ~ when it is in the home
++ // directory, relative when it is in the working root, absolute otherwise. A
++ // prompt that says ".mcp.json" is one a person reads; one that says
++ // /home/someone/src/thing/.mcp.json is one they skim.
++ func shown(home, root, path string) string {
++ 	if root != "" {
++ 		if rel, err := filepath.Rel(root, path); err == nil && !strings.HasPrefix(rel, "..") {
++ 			return filepath.ToSlash(rel)
++ 		}
++ 	}
++ 	if home != "" {
++ 		if rel, err := filepath.Rel(home, path); err == nil && !strings.HasPrefix(rel, "..") {
++ 			return "~/" + filepath.ToSlash(rel)
++ 		}
++ 	}
++ 	return path
++ }

+247−0internal/ccsettings/instructions.goaddedView File

++ package ccsettings
++ import (
++ 	"fmt"
++ 	"os"
++ 	"path/filepath"
++ 	"regexp"
++ 	"strings"
++ )
++ // Instruction is one CLAUDE.md-style file, read.
++ type Instruction struct {
++ 	Path string
++ 	// Shown names the file in the prompt, and Role says whose it is.
++ 	Shown string
++ 	Role  string
++ 	Body  string
++ }
++ // Roles, as the prompt describes them. Saying whose a file is matters to the
++ // model as much as to a person: the user's own preferences and a repository's
++ // conventions are different kinds of instruction.
++ const (
++ 	roleUser     = "the user's own instructions, for every project"
++ 	roleProject  = "this project's instructions, checked in"
++ 	roleLocal    = "the user's private instructions for this project"
++ 	importMaxHop = 5
++ 	// maxInstructionBytes bounds one file. These go into every request, and
++ 	// a generated file or a stray log someone named CLAUDE.md should not be
++ 	// able to fill the window.
++ 	maxInstructionBytes = 64 << 10
++ )
++ // LoadInstructions reads the files Claude Code loads into a conversation
++ // started in root, in the order it loads them, least specific first:
++ //
++ //   - ~/.claude/CLAUDE.md, the user's own;
++ //   - then for each directory from the top of the project down to root —
++ //     the top being the nearest directory with a .git in it, or the home
++ //     directory if there is none on the way — CLAUDE.md, .claude/CLAUDE.md
++ //     and CLAUDE.local.md.
++ //
++ // Each file's @path imports follow it, up to five hops deep. An import is
++ // relative to the file it appears in, and may not leave the tree its file
++ // belongs to: a project's files may import from the project, the user's from
++ // the home directory. A repository's CLAUDE.md that could import
++ // @~/.aws/credentials would be a repository reading your credentials into
++ // the conversation, which is then sent to the model.
++ //
++ // Claude Code also loads a subdirectory's CLAUDE.md when it first reads a
++ // file there, and .claude/rules/; neither is done here.
++ func LoadInstructions(home, root string) ([]Instruction, []error) {
++ 	l := &instructionLoader{home: home, root: root, seen: map[string]bool{}}
++ 	if home != "" {
++ 		l.load(filepath.Join(home, UserInstructions), roleUser, home, "", 0)
++ 	}
++ 	if root == "" {
++ 		return l.out, l.errs
++ 	}
++ 	dirs := projectDirs(home, root)
++ 	top := dirs[0]
++ 	for _, dir := range dirs {
++ 		for _, name := range []string{instructionsName, filepath.Join(".claude", instructionsName), localInstructions} {
++ 			path := filepath.Join(dir, name)
++ 			role, bound := roleProject, top
++ 			if name == localInstructions {
++ 				role = roleLocal
++ 				// A CLAUDE.local.md is the user's, and may reach into their
++ 				// home directory — Claude Code's own docs suggest importing a
++ 				// personal file from there — unless git is tracking it, which
++ 				// makes it the repository's after all.
++ 				if _, err := os.Lstat(path); err != nil {
++ 					continue
++ 				}
++ 				if home != "" && !gitTracks(dir, localInstructions) {
++ 					bound = home
++ 				}
++ 			}
++ 			l.load(path, role, bound, "", 0)
++ 		}
++ 	}
++ 	return l.out, l.errs
++ }
++ // projectDirs is root and the directories above it that belong to the same
++ // project, outermost first. The walk stops at a directory holding .git, or at
++ // the home directory. A root that is neither in a repository nor under home
++ // is a project of one directory: walking up to / would read whatever CLAUDE.md
++ // happened to be lying in /tmp.
++ func projectDirs(home, root string) []string {
++ 	root = filepath.Clean(root)
++ 	var dirs []string
++ 	for d := root; ; {
++ 		dirs = append(dirs, d)
++ 		if _, err := os.Lstat(filepath.Join(d, ".git")); err == nil {
++ 			break
++ 		}
++ 		if home != "" && d == filepath.Clean(home) {
++ 			break
++ 		}
++ 		parent := filepath.Dir(d)
++ 		if parent == d {
++ 			return []string{root}
++ 		}
++ 		d = parent
++ 	}
++ 	for i, j := 0, len(dirs)-1; i < j; i, j = i+1, j-1 {
++ 		dirs[i], dirs[j] = dirs[j], dirs[i]
++ 	}
++ 	return dirs
++ }
++ type instructionLoader struct {
++ 	home string
++ 	root string
++ 	seen map[string]bool
++ 	out  []Instruction
++ 	errs []error
++ }
++ // load reads one file and then its imports. bound is the directory the file
++ // and everything it imports must stay inside; importer is the file that
++ // imported this one, empty for a file found by name.
++ func (l *instructionLoader) load(path, role, bound, importer string, hop int) {
++ 	path = filepath.Clean(path)
++ 	real, err := filepath.EvalSymlinks(path)
++ 	if err != nil {
++ 		return // not there, which is the usual case
++ 	}
++ 	if l.seen[real] {
++ 		return
++ 	}
++ 	// The user's own file is wherever they keep it — often a symlink into a
++ 	// dotfiles repository. Everything else, including what it imports, stays
++ 	// inside its bound, and that is checked on the resolved path: a symlink
++ 	// committed to a repository can point anywhere.
++ 	ownFile := importer == "" && role == roleUser
++ 	if !ownFile && !within(bound, real) {
++ 		if importer != "" {
++ 			where := "the project"
++ 			if bound == l.home {
++ 				where = "the home directory"
++ 			}
++ 			l.errs = append(l.errs, fmt.Errorf("CLAUDE.md: %s imports %s, which is outside %s — skipped", l.shown(importer), l.shown(path), where))
++ 		}
++ 		return
++ 	}
++ 	info, err := os.Stat(real)
++ 	if err != nil || !info.Mode().IsRegular() {
++ 		return
++ 	}
++ 	raw, err := os.ReadFile(real)
++ 	if err != nil {
++ 		l.errs = append(l.errs, fmt.Errorf("CLAUDE.md: %w", err))
++ 		return
++ 	}
++ 	l.seen[real] = true
++ 	body := string(raw)
++ 	if len(body) > maxInstructionBytes {
++ 		l.errs = append(l.errs, fmt.Errorf("CLAUDE.md: %s is over %d KB — only the start of it is used", l.shown(path), maxInstructionBytes>>10))
++ 		body = body[:maxInstructionBytes]
++ 	}
++ 	in := Instruction{Path: path, Shown: l.shown(path), Role: role, Body: strings.TrimSpace(body)}
++ 	if importer != "" {
++ 		in.Role = "imported by " + l.shown(importer)
++ 	}
++ 	if in.Body != "" {
++ 		l.out = append(l.out, in)
++ 	}
++ 	if hop >= importMaxHop {
++ 		return
++ 	}
++ 	for _, ref := range imports(body) {
++ 		target := ref
++ 		switch {
++ 		case strings.HasPrefix(ref, "~/"):
++ 			if l.home == "" {
++ 				continue
++ 			}
++ 			target = filepath.Join(l.home, ref[2:])
++ 		case !filepath.IsAbs(ref):
++ 			target = filepath.Join(filepath.Dir(path), ref)
++ 		}
++ 		l.load(target, role, bound, path, hop+1)
++ 	}
++ }
++ func (l *instructionLoader) shown(path string) string {
++ 	return shown(l.home, l.root, path)
++ }
++ func within(dir, path string) bool {
++ 	if real, err := filepath.EvalSymlinks(dir); err == nil {
++ 		dir = real
++ 	}
++ 	rel, err := filepath.Rel(dir, path)
++ 	return err == nil && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator)) && !filepath.IsAbs(rel)
++ }
++ var (
++ 	importRef  = regexp.MustCompile("(?:^|[\\s(])@([^\\s`]+)")
++ 	inlineCode = regexp.MustCompile("`[^`]*`")
++ )
++ // imports finds the @path references in a file, skipping code: an @ in a
++ // code block or span is an example, or a decorator, not an import.
++ func imports(body string) []string {
++ 	var out []string
++ 	fenced := false
++ 	for _, line := range strings.Split(body, "\n") {
++ 		if strings.HasPrefix(strings.TrimSpace(line), "```") {
++ 			fenced = !fenced
++ 			continue
++ 		}
++ 		if fenced {
++ 			continue
++ 		}
++ 		line = inlineCode.ReplaceAllString(line, "")
++ 		for _, m := range importRef.FindAllStringSubmatch(line, -1) {
++ 			ref := strings.TrimRight(m[1], ".,;:!?)]'\"")
++ 			if ref != "" {
++ 				out = append(out, ref)
++ 			}
++ 		}
++ 	}
++ 	return out
++ }
++ // FormatInstructions is the system prompt section the files make. It is built
++ // once, at startup, and so is constant for the session: the cached prefix
++ // still matches request to request.
++ func FormatInstructions(files []Instruction) string {
++ 	if len(files) == 0 {
++ 		return ""
++ 	}
++ 	var b strings.Builder
++ 	b.WriteString("\n\n# Instructions from CLAUDE.md\n\n" +
++ 		"These are the instruction files Claude Code would load for this repository,\n" +
++ 		"read at startup and given here in full, so there is no need to read them\n" +
++ 		"again. Follow them: on anything about this codebase they outrank the\n" +
++ 		"defaults above. Later files are more specific to where you are working, and\n" +
++ 		"win where two disagree.")
++ 	for _, f := range files {
++ 		fmt.Fprintf(&b, "\n\n## %s (%s)\n\n%s", f.Shown, f.Role, f.Body)
++ 	}
++ 	return b.String()
++ }

+170−0internal/ccsettings/instructions_test.goaddedView File

++ package ccsettings
++ import (
++ 	"os"
++ 	"path/filepath"
++ 	"reflect"
++ 	"strings"
++ 	"testing"
++ )
++ func shownOf(files []Instruction) []string {
++ 	var out []string
++ 	for _, f := range files {
++ 		out = append(out, f.Shown)
++ 	}
++ 	return out
++ }
++ func TestLoadInstructionsOrder(t *testing.T) {
++ 	home, _ := dirs(t)
++ 	repo := filepath.Join(home, "src", "repo")
++ 	root := filepath.Join(repo, "services", "api")
++ 	os.MkdirAll(filepath.Join(repo, ".git"), 0o755)
++ 	os.MkdirAll(root, 0o755)
++ 	write(t, home, UserInstructions, "user rules")
++ 	// Above the git root: not part of this project.
++ 	write(t, home, "src/CLAUDE.md", "outside the repository")
++ 	write(t, repo, "CLAUDE.md", "repo rules")
++ 	write(t, repo, ".claude/CLAUDE.md", "repo dot-claude rules")
++ 	write(t, filepath.Join(repo, "services"), "CLAUDE.md", "services rules")
++ 	write(t, root, "CLAUDE.md", "api rules")
++ 	write(t, root, "CLAUDE.local.md", "my api notes")
++ 	write(t, root, "AGENTS.md", "not Claude's file")
++ 	files, errs := LoadInstructions(home, root)
++ 	if len(errs) != 0 {
++ 		t.Fatalf("errors: %v", errs)
++ 	}
++ 	got := shownOf(files)
++ 	want := []string{
++ 		"~/.claude/CLAUDE.md",
++ 		"~/src/repo/CLAUDE.md",
++ 		"~/src/repo/.claude/CLAUDE.md",
++ 		"~/src/repo/services/CLAUDE.md",
++ 		"CLAUDE.md",
++ 		"CLAUDE.local.md",
++ 	}
++ 	if !reflect.DeepEqual(got, want) {
++ 		t.Errorf("got  %q\nwant %q", got, want)
++ 	}
++ 	if files[0].Role != roleUser || files[5].Role != roleLocal || files[4].Role != roleProject {
++ 		t.Errorf("roles: %q %q %q", files[0].Role, files[4].Role, files[5].Role)
++ 	}
++ }
++ // With no repository on the way up, the walk stops at the home directory
++ // rather than reading whatever lies above it.
++ func TestLoadInstructionsNoRepository(t *testing.T) {
++ 	home, root := dirs(t)
++ 	write(t, home, "CLAUDE.md", "home-level")
++ 	write(t, filepath.Dir(home), "CLAUDE.md", "above home")
++ 	write(t, root, "CLAUDE.md", "here")
++ 	files, _ := LoadInstructions(home, root)
++ 	got := shownOf(files)
++ 	want := []string{"~/CLAUDE.md", "CLAUDE.md"}
++ 	if !reflect.DeepEqual(got, want) {
++ 		t.Errorf("got %q, want %q", got, want)
++ 	}
++ 	// Outside home altogether, only the root itself.
++ 	elsewhere := filepath.Join(filepath.Dir(home), "tmp", "x")
++ 	os.MkdirAll(elsewhere, 0o755)
++ 	write(t, elsewhere, "CLAUDE.md", "x")
++ 	files, _ = LoadInstructions(home, elsewhere)
++ 	if len(files) != 1 || files[0].Body != "x" {
++ 		t.Errorf("got %+v", files)
++ 	}
++ }
++ func TestInstructionImports(t *testing.T) {
++ 	home, root := dirs(t)
++ 	os.MkdirAll(filepath.Join(root, ".git"), 0o755)
++ 	write(t, root, "CLAUDE.md", strings.Join([]string{
++ 		"See @AGENTS.md for the rules, and @docs/style.md.",
++ 		"Mail me at someone@example.com, which is not an import.",
++ 		"`@inline` is code, and so is this:",
++ 		"```",
++ 		"@decorator",
++ 		"```",
++ 		"@~/.ssh/id_rsa is outside the project.",
++ 		"@../escape.md is too.",
++ 		"@missing.md is not there.",
++ 	}, "\n"))
++ 	write(t, root, "AGENTS.md", "agents body, see @CLAUDE.md")
++ 	write(t, root, "docs/style.md", "style body @deeper/one.md")
++ 	write(t, root, "docs/deeper/one.md", "one @two.md")
++ 	write(t, root, "docs/deeper/two.md", "two @three.md")
++ 	write(t, root, "docs/deeper/three.md", "three @four.md")
++ 	write(t, root, "docs/deeper/four.md", "four @five.md")
++ 	write(t, root, "docs/deeper/five.md", "five — too deep")
++ 	write(t, root, "inline", "should not load")
++ 	write(t, root, "decorator", "should not load")
++ 	write(t, home, ".ssh/id_rsa", "PRIVATE KEY")
++ 	write(t, home, "src/escape.md", "escaped")
++ 	files, errs := LoadInstructions(home, root)
++ 	got := shownOf(files)
++ 	want := []string{
++ 		"CLAUDE.md",
++ 		"AGENTS.md",
++ 		"docs/style.md",
++ 		"docs/deeper/one.md",
++ 		"docs/deeper/two.md",
++ 		"docs/deeper/three.md",
++ 		"docs/deeper/four.md",
++ 	}
++ 	if !reflect.DeepEqual(got, want) {
++ 		t.Errorf("got  %q\nwant %q", got, want)
++ 	}
++ 	for _, f := range files {
++ 		if strings.Contains(f.Body, "PRIVATE KEY") || f.Body == "escaped" {
++ 			t.Errorf("a project file imported %s from outside the project", f.Path)
++ 		}
++ 	}
++ 	if files[1].Role != "imported by CLAUDE.md" {
++ 		t.Errorf("role %q", files[1].Role)
++ 	}
++ 	if len(errs) != 2 {
++ 		t.Errorf("want the two escapes reported, got %v", errs)
++ 	}
++ }
++ // The user's own file may import from the home directory: it is theirs.
++ func TestUserInstructionsImportFromHome(t *testing.T) {
++ 	home, root := dirs(t)
++ 	write(t, home, UserInstructions, "@~/notes/prefs.md")
++ 	write(t, home, "notes/prefs.md", "tabs, not spaces")
++ 	files, _ := LoadInstructions(home, root)
++ 	if len(files) != 2 || files[1].Body != "tabs, not spaces" {
++ 		t.Errorf("got %+v", files)
++ 	}
++ }
++ // A symlink committed to a repository can point anywhere, so the project's
++ // own files are checked where they lead.
++ func TestProjectInstructionSymlinkOut(t *testing.T) {
++ 	home, root := dirs(t)
++ 	os.MkdirAll(filepath.Join(root, ".git"), 0o755)
++ 	secret := write(t, home, ".aws/credentials", "KEY")
++ 	if err := os.Symlink(secret, filepath.Join(root, "CLAUDE.md")); err != nil {
++ 		t.Skip(err)
++ 	}
++ 	files, _ := LoadInstructions(home, root)
++ 	if len(files) != 0 {
++ 		t.Errorf("followed a symlink out of the project: %+v", files)
++ 	}
++ }
++ func TestFormatInstructions(t *testing.T) {
++ 	if FormatInstructions(nil) != "" {
++ 		t.Error("no files should add nothing to the prompt")
++ 	}
++ 	got := FormatInstructions([]Instruction{{Shown: "CLAUDE.md", Role: roleProject, Body: "Run make test."}})
++ 	for _, want := range []string{"# Instructions from CLAUDE.md", "## CLAUDE.md (this project's instructions, checked in)", "Run make test."} {
++ 		if !strings.Contains(got, want) {
++ 			t.Errorf("missing %q in:\n%s", want, got)
++ 		}
++ 	}
++ }

+293−0internal/ccsettings/load_test.goaddedView File

++ package ccsettings
++ import (
++ 	"os"
++ 	"os/exec"
++ 	"path/filepath"
++ 	"reflect"
++ 	"strings"
++ 	"testing"
++ 	"github.com/johannSo/codey/internal/config"
++ )
++ // write puts a file under dir, creating its parents. Every test here builds
++ // its own home and root under t.TempDir: nothing may read the real ~/.claude*.
++ func write(t *testing.T, dir, rel, body string) string {
++ 	t.Helper()
++ 	path := filepath.Join(dir, rel)
++ 	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
++ 		t.Fatal(err)
++ 	}
++ 	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
++ 		t.Fatal(err)
++ 	}
++ 	return path
++ }
++ func dirs(t *testing.T) (home, root string) {
++ 	t.Helper()
++ 	base := t.TempDir()
++ 	home = filepath.Join(base, "home")
++ 	root = filepath.Join(home, "src", "proj")
++ 	if err := os.MkdirAll(root, 0o755); err != nil {
++ 		t.Fatal(err)
++ 	}
++ 	return home, root
++ }
++ func TestLoadPermissionsReadsTheThreeFiles(t *testing.T) {
++ 	home, root := dirs(t)
++ 	write(t, home, UserSettings, `{"permissions":{"allow":["Bash(go test:*)"],"defaultMode":"acceptEdits"},"model":"opus","env":{"X":"1"}}`)
++ 	write(t, root, ProjectSettings, `{"permissions":{"allow":["Bash(make:*)"],"deny":["Read(.env)"]}}`)
++ 	write(t, root, LocalSettings, `{"permissions":{"ask":["Bash(git push:*)"]}}`)
++ 	got, errs := LoadPermissions(home, root)
++ 	if len(errs) != 0 {
++ 		t.Fatalf("errors: %v", errs)
++ 	}
++ 	want := []Permissions{
++ 		{Scope: ScopeUser, Shown: "~/.claude/settings.json", Allow: []string{"Bash(go test:*)"}, DefaultMode: "acceptEdits"},
++ 		{Scope: ScopeProject, Shown: ".claude/settings.json", Allow: []string{"Bash(make:*)"}, Deny: []string{"Read(.env)"}},
++ 		{Scope: ScopeLocal, Shown: ".claude/settings.local.json", Ask: []string{"Bash(git push:*)"}},
++ 	}
++ 	for i := range got {
++ 		got[i].Path = ""
++ 	}
++ 	if !reflect.DeepEqual(got, want) {
++ 		t.Errorf("got  %+v\nwant %+v", got, want)
++ 	}
++ }
++ func TestLoadPermissionsShapes(t *testing.T) {
++ 	tests := []struct {
++ 		name      string
++ 		body      string
++ 		wantFiles int
++ 		wantErr   bool
++ 	}{
++ 		{"no file", "", 0, false},
++ 		{"empty object", `{}`, 1, false},
++ 		{"no permissions block", `{"hooks":{"PreToolUse":[]}}`, 1, false},
++ 		{"broken JSON", `{"permissions":`, 0, true},
++ 	}
++ 	for _, tc := range tests {
++ 		t.Run(tc.name, func(t *testing.T) {
++ 			home, root := dirs(t)
++ 			if tc.body != "" {
++ 				write(t, root, ProjectSettings, tc.body)
++ 			}
++ 			got, errs := LoadPermissions(home, root)
++ 			if len(got) != tc.wantFiles || (len(errs) > 0) != tc.wantErr {
++ 				t.Errorf("files %d errs %v, want %d files, error %v", len(got), errs, tc.wantFiles, tc.wantErr)
++ 			}
++ 		})
++ 	}
++ }
++ // Started in the home directory, the user's settings are the user's, not a
++ // project's: reading them a second time as shared project settings would hold
++ // their allow rules hostage to a trust prompt about themselves.
++ func TestLoadPermissionsRootIsHome(t *testing.T) {
++ 	home, _ := dirs(t)
++ 	write(t, home, UserSettings, `{"permissions":{"allow":["Edit"]}}`)
++ 	got, _ := LoadPermissions(home, home)
++ 	if len(got) != 1 || got[0].Scope != ScopeUser {
++ 		t.Errorf("got %+v, want only the user file", got)
++ 	}
++ }
++ // A settings.local.json is supposed to be kept out of git. One that git is
++ // tracking arrived with the clone, and gets no more trust than the shared
++ // file.
++ func TestTrackedLocalSettingsAreProjectScope(t *testing.T) {
++ 	if _, err := exec.LookPath("git"); err != nil {
++ 		t.Skip("no git")
++ 	}
++ 	home, root := dirs(t)
++ 	write(t, root, LocalSettings, `{"permissions":{"allow":["Bash"]}}`)
++ 	for _, args := range [][]string{{"init", "-q"}, {"add", "-f", LocalSettings}} {
++ 		cmd := exec.Command("git", args...)
++ 		cmd.Dir = root
++ 		cmd.Env = append(os.Environ(), "GIT_CONFIG_GLOBAL=/dev/null", "GIT_CONFIG_SYSTEM=/dev/null")
++ 		if out, err := cmd.CombinedOutput(); err != nil {
++ 			t.Fatalf("git %v: %v\n%s", args, err, out)
++ 		}
++ 	}
++ 	got, _ := LoadPermissions(home, root)
++ 	if len(got) != 1 || got[0].Scope != ScopeProject || !got[0].Tracked {
++ 		t.Fatalf("got %+v, want a tracked, project-scope file", got)
++ 	}
++ 	rs, _ := NewRuleset(home, root, got, false)
++ 	if v := rs.Check("bash", []byte(`{"command":"ls"}`)); v.Verdict != 0 {
++ 		t.Errorf("an untrusted, committed local file's allow rule was honoured: %+v", v)
++ 	}
++ }
++ func TestLoadMCPShapes(t *testing.T) {
++ 	home, root := dirs(t)
++ 	write(t, root, ProjectMCP, `{"mcpServers":{
++ 		"plain": {"command":"plain-mcp","args":["--x"]},
++ 		"typed": {"type":"stdio","command":"typed-mcp","env":{"K":"v"}},
++ 		"web":   {"type":"http","url":"https://example.com/mcp"},
++ 		"old":   {"type":"sse","url":"https://example.com/sse"},
++ 		"bare":  {"url":"https://example.com/u"}
++ 	}}`)
++ 	write(t, home, ClaudeJSON, `{
++ 		"numStartups": 12,
++ 		"mcpServers": {"mine": {"command":"mine-mcp"}},
++ 		"projects": {
++ 			"`+root+`": {"mcpServers": {"here": {"command":"here-mcp"}}, "allowedTools": []},
++ 			"/elsewhere": {"mcpServers": {"there": {"command":"there-mcp"}}}
++ 		}
++ 	}`)
++ 	files, errs := LoadMCP(home, root)
++ 	if len(errs) != 3 {
++ 		t.Errorf("want one error per remote server, got %v", errs)
++ 	}
++ 	for _, err := range errs {
++ 		if !strings.Contains(err.Error(), "stdio") {
++ 			t.Errorf("error %q should say Codey speaks only stdio", err)
++ 		}
++ 	}
++ 	var got []string
++ 	for _, f := range files {
++ 		got = append(got, string(f.Scope)+":"+strings.Join(sortedNames(f.Servers), ","))
++ 	}
++ 	want := []string{"local:here", "project:plain,typed", "user:mine"}
++ 	if !reflect.DeepEqual(got, want) {
++ 		t.Errorf("files %v, want %v (most specific first)", got, want)
++ 	}
++ }
++ // Claude Code keys a project by the path it was started in; a root reached
++ // through a symlink is still that project.
++ func TestLoadMCPFindsProjectThroughSymlink(t *testing.T) {
++ 	home, root := dirs(t)
++ 	link := filepath.Join(filepath.Dir(home), "link")
++ 	if err := os.Symlink(root, link); err != nil {
++ 		t.Skip(err)
++ 	}
++ 	write(t, home, ClaudeJSON, `{"projects":{"`+root+`":{"mcpServers":{"here":{"command":"x"}}}}}`)
++ 	files, _ := LoadMCP(home, link)
++ 	if len(files) != 1 || files[0].Scope != ScopeLocal {
++ 		t.Errorf("got %+v", files)
++ 	}
++ }
++ func TestLoadMCPBrokenFileIsReported(t *testing.T) {
++ 	home, root := dirs(t)
++ 	write(t, root, ProjectMCP, `{"mcpServers": [`)
++ 	files, errs := LoadMCP(home, root)
++ 	if len(files) != 0 || len(errs) != 1 {
++ 		t.Errorf("files %v errs %v", files, errs)
++ 	}
++ }
++ func env(m map[string]string) func(string) (string, bool) {
++ 	return func(k string) (string, bool) { v, ok := m[k]; return v, ok }
++ }
++ func TestMergeMCPPrecedence(t *testing.T) {
++ 	files := []MCPFile{
++ 		{Scope: ScopeLocal, Shown: "~/.claude.json (this project)", Servers: map[string]ServerDef{
++ 			"db": {Command: "local-db"}, "only-local": {Command: "l"}}},
++ 		{Scope: ScopeProject, Shown: ".mcp.json", Servers: map[string]ServerDef{
++ 			"db": {Command: "project-db"}, "fs": {Command: "project-fs"}, "lint": {Command: "project-lint"}}},
++ 		{Scope: ScopeUser, Shown: "~/.claude.json", Servers: map[string]ServerDef{
++ 			"fs": {Command: "user-fs"}, "lint": {Command: "user-lint"}, "only-user": {Command: "u"}}},
++ 	}
++ 	own := map[string]config.MCPServer{"lint": {Command: "codey-lint"}}
++ 	tests := []struct {
++ 		name      string
++ 		trusted   bool
++ 		want      map[string]string
++ 		wantNotes int
++ 	}{
++ 		{
++ 			name:    "trusted",
++ 			trusted: true,
++ 			want: map[string]string{
++ 				"lint": "codey-lint", "db": "local-db", "fs": "project-fs",
++ 				"only-local": "l", "only-user": "u",
++ 			},
++ 			// db: local over project; lint: codey over project and user;
++ 			// fs: project over user.
++ 			wantNotes: 4,
++ 		},
++ 		{
++ 			name:    "untrusted project servers give way to the user's own",
++ 			trusted: false,
++ 			want: map[string]string{
++ 				"lint": "codey-lint", "db": "local-db", "fs": "user-fs",
++ 				"only-local": "l", "only-user": "u",
++ 			},
++ 			wantNotes: 1,
++ 		},
++ 	}
++ 	for _, tc := range tests {
++ 		t.Run(tc.name, func(t *testing.T) {
++ 			got, notes := MergeMCP(own, files, tc.trusted, env(nil))
++ 			commands := map[string]string{}
++ 			for n, s := range got {
++ 				commands[n] = s.Command
++ 			}
++ 			if !reflect.DeepEqual(commands, tc.want) {
++ 				t.Errorf("got %v, want %v", commands, tc.want)
++ 			}
++ 			if len(notes) != tc.wantNotes {
++ 				t.Errorf("notes %q, want %d", notes, tc.wantNotes)
++ 			}
++ 			for _, n := range notes {
++ 				if !strings.Contains(n, "using the one in") {
++ 					t.Errorf("clash note %q should name the winner", n)
++ 				}
++ 			}
++ 		})
++ 	}
++ }
++ func TestExpand(t *testing.T) {
++ 	vars := env(map[string]string{"HOME": "/h", "EMPTY": "", "PORT": "5432"})
++ 	tests := []struct {
++ 		in, want string
++ 		wantErr  bool
++ 	}{
++ 		{"plain", "plain", false},
++ 		{"${HOME}/bin/tool", "/h/bin/tool", false},
++ 		{"--port=${PORT}", "--port=5432", false},
++ 		{"${MISSING:-fallback}", "fallback", false},
++ 		{"${EMPTY:-fallback}", "fallback", false},
++ 		{"${HOME:-unused}", "/h", false},
++ 		{"${MISSING:-}", "", false},
++ 		{"${A:-x}${B:-y}", "xy", false},
++ 		{"$HOME stays", "$HOME stays", false},
++ 		{"${MISSING}", "", true},
++ 	}
++ 	for _, tc := range tests {
++ 		got, err := expand(tc.in, vars)
++ 		if (err != nil) != tc.wantErr || got != tc.want {
++ 			t.Errorf("expand(%q) = %q, %v; want %q, error %v", tc.in, got, err, tc.want, tc.wantErr)
++ 		}
++ 	}
++ }
++ func TestMergeMCPExpandsEverywhere(t *testing.T) {
++ 	files := []MCPFile{{Scope: ScopeUser, Shown: "~/.claude.json", Servers: map[string]ServerDef{
++ 		"db":     {Command: "${BIN:-/usr/bin}/db", Args: []string{"--url", "${DB_URL}"}, Env: map[string]string{"TOKEN": "${TOKEN}"}},
++ 		"broken": {Command: "x", Args: []string{"${NOPE}"}},
++ 	}}}
++ 	got, notes := MergeMCP(nil, files, false, env(map[string]string{"DB_URL": "pg://x", "TOKEN": "t"}))
++ 	want := config.MCPServer{Command: "/usr/bin/db", Args: []string{"--url", "pg://x"}, Env: map[string]string{"TOKEN": "t"}}
++ 	if !reflect.DeepEqual(got["db"], want) {
++ 		t.Errorf("db = %+v, want %+v", got["db"], want)
++ 	}
++ 	if _, ok := got["broken"]; ok {
++ 		t.Error("a server with an unset variable and no default should not start")
++ 	}
++ 	if len(notes) != 1 || !strings.Contains(notes[0], "NOPE") {
++ 		t.Errorf("notes %q should name the missing variable", notes)
++ 	}
++ }

+376−0internal/ccsettings/match.goaddedView File

++ package ccsettings
++ // TEMPORARY MATCHER — swap at merge.
++ //
++ // This file is a deliberately small parser and matcher for Claude Code
++ // permission rules, written so the loading and honouring in this package could
++ // be tested end to end while the shared rule parser (ParseRule / Rule.Matches)
++ // was being written elsewhere. Everything outside this file talks to it
++ // through compile and the compiled interface, so replacing it means writing an
++ // adapter from the shared Rule to compiled and deleting this file. The
++ // tri-state result and the allow-versus-deny distinction for compound shell
++ // commands are the parts an adapter must keep; see Match and matchMode.
++ import (
++ 	"encoding/json"
++ 	"fmt"
++ 	"net/url"
++ 	"path/filepath"
++ 	"regexp"
++ 	"strings"
++ 	"github.com/bmatcuk/doublestar/v4"
++ 	"github.com/johannSo/codey/internal/approval"
++ )
++ // Match is the result of checking one rule against one call.
++ type Match int
++ const (
++ 	NoMatch Match = iota
++ 	Matched
++ 	// Unsure means the call cannot be pinned down well enough to say — an
++ 	// opaque shell command, a word built at run time. An allow rule treats it
++ 	// as no match; a deny or ask rule treats it as a reason to ask.
++ 	Unsure
++ )
++ // matchMode is which kind of rule is asking. It matters for compound shell
++ // commands: an allow rule covers "a && b" only if it covers both, while a
++ // deny rule catches it if it catches either.
++ type matchMode int
++ const (
++ 	forAllow matchMode = iota
++ 	forRestrict
++ )
++ // compiled is one parsed rule.
++ type compiled interface {
++ 	Match(tool string, input json.RawMessage, mode matchMode) Match
++ }
++ // matchEnv is what relative rule paths are resolved against.
++ type matchEnv struct {
++ 	home, root string
++ }
++ // codeyTools maps Claude Code's tool names to Codey's. Edit covers both of
++ // Codey's writing tools, as Claude Code's Edit rules cover all of its own; Read
++ // covers the search tools as well, on a best-effort basis, as it does there.
++ var codeyTools = map[string][]string{
++ 	"Bash":      {"bash"},
++ 	"Read":      {"read_file", "glob", "grep"},
++ 	"Edit":      {"edit_file", "write_file"},
++ 	"MultiEdit": {"edit_file"},
++ 	"Write":     {"write_file"},
++ 	"Glob":      {"glob"},
++ 	"Grep":      {"grep"},
++ 	"WebFetch":  {"web_fetch"},
++ 	"WebSearch": {"web_search"},
++ 	"TodoWrite": {"todo_write"},
++ }
++ var ruleShape = regexp.MustCompile(`^([A-Za-z0-9_\-]+(?:__\*)?)(?:\((.*)\))?$`)
++ // compile parses a rule. An error means the rule names something Codey has no
++ // equivalent for, or uses a specifier this matcher does not understand; the
++ // caller reports it and the rule takes no part.
++ func compile(rule string, env matchEnv) (compiled, error) {
++ 	m := ruleShape.FindStringSubmatch(strings.TrimSpace(rule))
++ 	if m == nil {
++ 		return nil, fmt.Errorf("not a rule Codey can read")
++ 	}
++ 	name, spec := m[1], strings.TrimSpace(m[2])
++ 	hasSpec := spec != "" && spec != "*"
++ 	if strings.HasPrefix(name, "mcp__") {
++ 		if m[2] != "" {
++ 			return nil, fmt.Errorf("an MCP rule takes no specifier")
++ 		}
++ 		return mcpRule(name), nil
++ 	}
++ 	tools, ok := codeyTools[name]
++ 	if !ok {
++ 		return nil, fmt.Errorf("Codey has no %s tool", name)
++ 	}
++ 	if !hasSpec {
++ 		return toolRule(tools), nil
++ 	}
++ 	switch name {
++ 	case "Bash":
++ 		return newBashRule(spec), nil
++ 	case "Read", "Edit", "MultiEdit", "Write", "Glob", "Grep":
++ 		return newPathRule(tools, spec, env), nil
++ 	case "WebFetch":
++ 		if d, ok := strings.CutPrefix(spec, "domain:"); ok && d != "" {
++ 			return domainRule(strings.ToLower(d)), nil
++ 		}
++ 	}
++ 	return nil, fmt.Errorf("Codey does not understand the specifier %q", spec)
++ }
++ // toolRule is a bare tool name: every call of it.
++ type toolRule []string
++ func (r toolRule) Match(tool string, _ json.RawMessage, _ matchMode) Match {
++ 	for _, t := range r {
++ 		if t == tool {
++ 			return Matched
++ 		}
++ 	}
++ 	return NoMatch
++ }
++ // mcpRule is mcp__server, mcp__server__* or mcp__server__tool.
++ type mcpRule string
++ func (r mcpRule) Match(tool string, _ json.RawMessage, _ matchMode) Match {
++ 	name := string(r)
++ 	if server, ok := strings.CutSuffix(name, "__*"); ok {
++ 		name = server
++ 	}
++ 	if strings.Count(name, "__") == 1 {
++ 		// The whole server.
++ 		if strings.HasPrefix(tool, name+"__") {
++ 			return Matched
++ 		}
++ 		return NoMatch
++ 	}
++ 	if tool == name {
++ 		return Matched
++ 	}
++ 	return NoMatch
++ }
++ // bashRule is Bash(spec): an exact command, a prefix written "cmd:*" or
++ // "cmd *", or a pattern with * in it.
++ type bashRule struct {
++ 	prefix  []string // set for a prefix rule
++ 	exact   []string // set for an exact rule
++ 	pattern *regexp.Regexp
++ }
++ func newBashRule(spec string) bashRule {
++ 	if p, ok := strings.CutSuffix(spec, ":*"); ok {
++ 		return bashRule{prefix: strings.Fields(p)}
++ 	}
++ 	if p, ok := strings.CutSuffix(spec, " *"); ok && !strings.Contains(p, "*") {
++ 		return bashRule{prefix: strings.Fields(p)}
++ 	}
++ 	if strings.Contains(spec, "*") {
++ 		parts := strings.Split(strings.Join(strings.Fields(spec), " "), "*")
++ 		for i, p := range parts {
++ 			parts[i] = regexp.QuoteMeta(p)
++ 		}
++ 		return bashRule{pattern: regexp.MustCompile("^" + strings.Join(parts, ".*") + "$")}
++ 	}
++ 	return bashRule{exact: strings.Fields(spec)}
++ }
++ func (r bashRule) Match(tool string, input json.RawMessage, mode matchMode) Match {
++ 	if tool != "bash" {
++ 		return NoMatch
++ 	}
++ 	var args struct {
++ 		Command string `json:"command"`
++ 	}
++ 	json.Unmarshal(input, &args)
++ 	cmds, info := approval.SimpleCommands(args.Command)
++ 	if mode == forAllow {
++ 		// Allowing is all or nothing: every command in the line must be
++ 		// covered, and a line whose commands cannot all be seen covers
++ 		// nothing.
++ 		if info.Opaque || info.ParseError != nil || len(cmds) == 0 {
++ 			return NoMatch
++ 		}
++ 		for _, c := range cmds {
++ 			if !c.Pinned || r.one(c) != Matched {
++ 				return NoMatch
++ 			}
++ 		}
++ 		return Matched
++ 	}
++ 	// Restricting needs one command to be caught. A line that cannot be seen
++ 	// all the way through might hide one, which is Unsure rather than a pass.
++ 	unsure := info.Opaque || info.ParseError != nil
++ 	for _, c := range cmds {
++ 		switch r.one(c) {
++ 		case Matched:
++ 			return Matched
++ 		case Unsure:
++ 			unsure = true
++ 		}
++ 	}
++ 	if unsure {
++ 		return Unsure
++ 	}
++ 	return NoMatch
++ }
++ // one matches a single simple command.
++ func (r bashRule) one(c approval.SimpleCommand) Match {
++ 	switch {
++ 	case r.prefix != nil:
++ 		return wordsMatch(r.prefix, c, true)
++ 	case r.exact != nil:
++ 		return wordsMatch(r.exact, c, false)
++ 	default:
++ 		for _, lit := range c.Literal {
++ 			if !lit {
++ 				return Unsure
++ 			}
++ 		}
++ 		if r.pattern.MatchString(strings.Join(c.Words, " ")) {
++ 			return Matched
++ 		}
++ 		return NoMatch
++ 	}
++ }
++ // wordsMatch compares a rule's words to a command's. A word the shell builds
++ // at run time could be anything, so meeting one before the comparison is
++ // settled is Unsure.
++ func wordsMatch(want []string, c approval.SimpleCommand, prefix bool) Match {
++ 	if len(c.Words) < len(want) || (!prefix && len(c.Words) != len(want)) {
++ 		return NoMatch
++ 	}
++ 	for i, w := range want {
++ 		if !c.Literal[i] {
++ 			return Unsure
++ 		}
++ 		if c.Words[i] != w {
++ 			return NoMatch
++ 		}
++ 	}
++ 	return Matched
++ }
++ // pathRule is Read(spec), Edit(spec) and the like: a gitignore-style pattern
++ // over the path a tool is handed.
++ type pathRule struct {
++ 	tools   []string
++ 	pattern string // absolute, slash-separated, doublestar syntax
++ 	root    string
++ }
++ // newPathRule resolves a pattern the way Claude Code documents it:
++ // //path is absolute, ~/path is under the home directory, /path is under
++ // the project root, and anything else is relative to the working directory —
++ // which for Codey is the root. A pattern with no slash in it matches at any
++ // depth, as it would in .gitignore.
++ func newPathRule(tools []string, spec string, env matchEnv) pathRule {
++ 	spec = strings.TrimSuffix(spec, "/")
++ 	var p string
++ 	switch {
++ 	case strings.HasPrefix(spec, "//"):
++ 		p = spec[1:]
++ 	case strings.HasPrefix(spec, "~/"):
++ 		p = escape(filepath.ToSlash(env.home)) + spec[1:]
++ 	case strings.HasPrefix(spec, "/"):
++ 		p = escape(filepath.ToSlash(env.root)) + spec
++ 	default:
++ 		rel := strings.TrimPrefix(spec, "./")
++ 		if !strings.Contains(rel, "/") && !strings.HasPrefix(spec, "./") {
++ 			rel = "**/" + rel
++ 		}
++ 		p = escape(filepath.ToSlash(env.root)) + "/" + rel
++ 	}
++ 	return pathRule{tools: tools, pattern: p, root: env.root}
++ }
++ func (r pathRule) Match(tool string, input json.RawMessage, mode matchMode) Match {
++ 	if toolRule(r.tools).Match(tool, nil, mode) != Matched {
++ 		return NoMatch
++ 	}
++ 	var args struct {
++ 		Path string `json:"path"`
++ 	}
++ 	json.Unmarshal(input, &args)
++ 	path := args.Path
++ 	if path == "" {
++ 		path = r.root
++ 	}
++ 	if !filepath.IsAbs(path) {
++ 		path = filepath.Join(r.root, path)
++ 	}
++ 	candidates := []string{filepath.Clean(path)}
++ 	// The tools follow symlinks, so a rule about .env has to catch a link
++ 	// to it under another name.
++ 	if real, err := filepath.EvalSymlinks(path); err == nil && real != candidates[0] {
++ 		candidates = append(candidates, real)
++ 	}
++ 	hits := 0
++ 	for _, c := range candidates {
++ 		if r.covers(filepath.ToSlash(c)) {
++ 			hits++
++ 		}
++ 	}
++ 	switch {
++ 	case mode == forAllow && hits == len(candidates):
++ 		return Matched
++ 	case mode == forRestrict && hits > 0:
++ 		return Matched
++ 	}
++ 	return NoMatch
++ }
++ // covers reports whether the pattern matches the path or any directory above
++ // it: a rule about a directory, as in .gitignore, is a rule about everything
++ // inside it.
++ func (r pathRule) covers(path string) bool {
++ 	for p := path; ; {
++ 		if ok, _ := doublestar.Match(r.pattern, p); ok {
++ 			return true
++ 		}
++ 		parent := filepath.ToSlash(filepath.Dir(filepath.FromSlash(p)))
++ 		if parent == p {
++ 			return false
++ 		}
++ 		p = parent
++ 	}
++ }
++ func escape(s string) string {
++ 	var b strings.Builder
++ 	for _, r := range s {
++ 		if strings.ContainsRune(`*?[]{}\`, r) {
++ 			b.WriteByte('\\')
++ 		}
++ 		b.WriteRune(r)
++ 	}
++ 	return b.String()
++ }
++ // domainRule is WebFetch(domain:example.com). *.example.com covers the
++ // subdomains; the bare name covers only itself.
++ type domainRule string
++ func (r domainRule) Match(tool string, input json.RawMessage, _ matchMode) Match {
++ 	if tool != "web_fetch" {
++ 		return NoMatch
++ 	}
++ 	var args struct {
++ 		URL string `json:"url"`
++ 	}
++ 	json.Unmarshal(input, &args)
++ 	u, err := url.Parse(args.URL)
++ 	if err != nil || u.Hostname() == "" {
++ 		return Unsure
++ 	}
++ 	host := strings.ToLower(u.Hostname())
++ 	d := string(r)
++ 	if sub, ok := strings.CutPrefix(d, "*."); ok {
++ 		if strings.HasSuffix(host, "."+sub) {
++ 			return Matched
++ 		}
++ 		return NoMatch
++ 	}
++ 	if host == d {
++ 		return Matched
++ 	}
++ 	return NoMatch
++ }

+249−0internal/ccsettings/mcp.goaddedView File

++ package ccsettings
++ import (
++ 	"fmt"
++ 	"path/filepath"
++ 	"regexp"
++ 	"sort"
++ 	"strings"
++ 	"github.com/johannSo/codey/internal/config"
++ )
++ // ServerDef is one MCP server as Claude Code writes it, before any ${VAR} in
++ // it is expanded. It is kept unexpanded because that is the form the trust
++ // decision is about: what the repository wrote, not what this shell happened
++ // to substitute into it.
++ type ServerDef struct {
++ 	// Type is "stdio", or empty, which means the same thing. "http", "sse"
++ 	// and "ws" are remote transports Codey's client does not speak.
++ 	Type    string            `json:"type,omitempty"`
++ 	Command string            `json:"command,omitempty"`
++ 	Args    []string          `json:"args,omitempty"`
++ 	Env     map[string]string `json:"env,omitempty"`
++ 	URL     string            `json:"url,omitempty"`
++ }
++ // stdio reports whether Codey can start this server. A url is a remote
++ // server whatever the type says.
++ func (d ServerDef) stdio() bool {
++ 	return (d.Type == "" || d.Type == "stdio") && d.URL == ""
++ }
++ // MCPFile is the servers one Claude Code file defines, the remote ones
++ // already removed.
++ type MCPFile struct {
++ 	Scope Scope
++ 	// Shown names the file in messages; for ~/.claude.json's per-project
++ 	// servers it says which project.
++ 	Shown   string
++ 	Servers map[string]ServerDef
++ }
++ // mcpJSON is the shape of .mcp.json, and of the parts of ~/.claude.json read
++ // here. ~/.claude.json carries a great deal more — login state, tips shown,
++ // per-project history — none of which is any of Codey's business.
++ type mcpJSON struct {
++ 	MCPServers map[string]ServerDef `json:"mcpServers"`
++ 	Projects   map[string]struct {
++ 		MCPServers map[string]ServerDef `json:"mcpServers"`
++ 	} `json:"projects"`
++ }
++ // LoadMCP reads the MCP servers Claude Code would offer in root, from the
++ // three places it keeps them, most specific first:
++ //
++ //   - ~/.claude.json, under projects[root] — "local" scope, the user's own
++ //     servers for this one project, which is what `claude mcp add` writes;
++ //   - .mcp.json at the root — "project" scope, committed to the repository;
++ //   - ~/.claude.json, top-level — "user" scope, for every project.
++ //
++ // That is Claude Code's own order of precedence, and the order MergeMCP
++ // resolves name clashes in. Servers Codey cannot start — a url, or a type
++ // other than stdio — are reported and left out here, so nothing downstream
++ // has to know they existed.
++ func LoadMCP(home, root string) ([]MCPFile, []error) {
++ 	var errs []error
++ 	var claude mcpJSON
++ 	claudePath := ""
++ 	if home != "" {
++ 		claudePath = filepath.Join(home, ClaudeJSON)
++ 		if _, err := readJSON(claudePath, &claude); err != nil {
++ 			errs = append(errs, fmt.Errorf("claude code mcp: %w", err))
++ 		}
++ 	}
++ 	var files []MCPFile
++ 	add := func(scope Scope, label string, defs map[string]ServerDef) {
++ 		if len(defs) == 0 {
++ 			return
++ 		}
++ 		kept := map[string]ServerDef{}
++ 		for _, name := range sortedNames(defs) {
++ 			d := defs[name]
++ 			if !d.stdio() {
++ 				transport := d.Type
++ 				if transport == "" || transport == "stdio" {
++ 					transport = "url"
++ 				}
++ 				errs = append(errs, fmt.Errorf("mcp: %s in %s is a remote server (%s), and Codey's client speaks only stdio — skipped", name, label, transport))
++ 				continue
++ 			}
++ 			kept[name] = d
++ 		}
++ 		if len(kept) > 0 {
++ 			files = append(files, MCPFile{Scope: scope, Shown: label, Servers: kept})
++ 		}
++ 	}
++ 	if claudePath != "" && root != "" {
++ 		// Claude Code keys a project by the directory it was started in. A
++ 		// root reached through a symlink is the same project under another
++ 		// name, so both spellings are tried.
++ 		for _, key := range rootKeys(root) {
++ 			if p, ok := claude.Projects[key]; ok {
++ 				add(ScopeLocal, "~/"+ClaudeJSON+" (this project)", p.MCPServers)
++ 				break
++ 			}
++ 		}
++ 	}
++ 	if root != "" {
++ 		var project mcpJSON
++ 		path := filepath.Join(root, ProjectMCP)
++ 		if _, err := readJSON(path, &project); err != nil {
++ 			errs = append(errs, fmt.Errorf("claude code mcp: %w", err))
++ 		} else {
++ 			add(ScopeProject, ProjectMCP, project.MCPServers)
++ 		}
++ 	}
++ 	if claudePath != "" {
++ 		add(ScopeUser, "~/"+ClaudeJSON, claude.MCPServers)
++ 	}
++ 	return files, errs
++ }
++ func rootKeys(root string) []string {
++ 	keys := []string{filepath.Clean(root)}
++ 	if real, err := filepath.EvalSymlinks(root); err == nil && real != keys[0] {
++ 		keys = append(keys, real)
++ 	}
++ 	return keys
++ }
++ // Project is the project-scope file in files, or nil.
++ func Project(files []MCPFile) *MCPFile {
++ 	for i := range files {
++ 		if files[i].Scope == ScopeProject {
++ 			return &files[i]
++ 		}
++ 	}
++ 	return nil
++ }
++ // MergeMCP combines Codey's own servers with Claude Code's into the set to
++ // start, resolving each name to one definition and expanding ${VAR} in it.
++ //
++ // Codey's own config wins a clash, because it is the file written for this
++ // program; after it, files are taken in the order LoadMCP returned them. Each
++ // clash is reported once, naming the winner, because a server that silently
++ // turned out to be a different program is the kind of surprise nobody thinks
++ // to debug.
++ //
++ // trusted says whether the project's .mcp.json may be started. When it may
++ // not, its servers are dropped before anything else is decided — so a user's
++ // own server with the same name is the one that runs, rather than nothing.
++ //
++ // lookup is the environment ${VAR} is expanded from: os.LookupEnv in
++ // production, a map in the tests.
++ func MergeMCP(own map[string]config.MCPServer, files []MCPFile, trusted bool, lookup func(string) (string, bool)) (map[string]config.MCPServer, []string) {
++ 	out := map[string]config.MCPServer{}
++ 	from := map[string]string{}
++ 	for name, s := range own {
++ 		out[name] = s
++ 		from[name] = "Codey's config"
++ 	}
++ 	var notes []string
++ 	for _, f := range files {
++ 		if f.Scope == ScopeProject && !trusted {
++ 			continue
++ 		}
++ 		for _, name := range sortedNames(f.Servers) {
++ 			if winner, taken := from[name]; taken {
++ 				notes = append(notes, fmt.Sprintf("mcp: %s is defined in both %s and %s — using the one in %s", name, winner, f.Shown, winner))
++ 				continue
++ 			}
++ 			spec, err := expandServer(f.Servers[name], lookup)
++ 			if err != nil {
++ 				notes = append(notes, fmt.Sprintf("mcp: %s in %s: %v — skipped", name, f.Shown, err))
++ 				// Claimed all the same: a broken definition in a more specific
++ 				// file should not quietly hand the name to a less specific one.
++ 				from[name] = f.Shown
++ 				continue
++ 			}
++ 			out[name] = spec
++ 			from[name] = f.Shown
++ 		}
++ 	}
++ 	return out, notes
++ }
++ // envRef is ${VAR} or ${VAR:-default}, the two forms Claude Code expands in a
++ // server definition.
++ var envRef = regexp.MustCompile(`\$\{([A-Za-z_][A-Za-z0-9_]*)(:-([^}]*))?\}`)
++ // expand substitutes every ${VAR} in s. A variable that is unset, or set to
++ // nothing, takes its default when it has one — the shell's reading of :- —
++ // and is an error when it has none: Claude Code refuses such a definition
++ // rather than starting a server with a hole in its command line, and so does
++ // this.
++ func expand(s string, lookup func(string) (string, bool)) (string, error) {
++ 	var missing []string
++ 	out := envRef.ReplaceAllStringFunc(s, func(ref string) string {
++ 		m := envRef.FindStringSubmatch(ref)
++ 		if v, ok := lookup(m[1]); ok && v != "" {
++ 			return v
++ 		}
++ 		if m[2] != "" {
++ 			return m[3]
++ 		}
++ 		missing = append(missing, m[1])
++ 		return ""
++ 	})
++ 	if len(missing) > 0 {
++ 		return "", fmt.Errorf("%s is not set and has no default", strings.Join(missing, ", "))
++ 	}
++ 	return out, nil
++ }
++ func expandServer(d ServerDef, lookup func(string) (string, bool)) (config.MCPServer, error) {
++ 	var err error
++ 	s := config.MCPServer{}
++ 	if s.Command, err = expand(d.Command, lookup); err != nil {
++ 		return s, err
++ 	}
++ 	for _, a := range d.Args {
++ 		v, err := expand(a, lookup)
++ 		if err != nil {
++ 			return s, err
++ 		}
++ 		s.Args = append(s.Args, v)
++ 	}
++ 	if len(d.Env) > 0 {
++ 		s.Env = map[string]string{}
++ 		for k, v := range d.Env {
++ 			if s.Env[k], err = expand(v, lookup); err != nil {
++ 				return s, err
++ 			}
++ 		}
++ 	}
++ 	return s, nil
++ }
++ func sortedNames[V any](m map[string]V) []string {
++ 	names := make([]string, 0, len(m))
++ 	for n := range m {
++ 		names = append(names, n)
++ 	}
++ 	sort.Strings(names)
++ 	return names
++ }

+106−0internal/ccsettings/permissions.goaddedView File

++ package ccsettings
++ import (
++ 	"context"
++ 	"fmt"
++ 	"os/exec"
++ 	"path/filepath"
++ 	"time"
++ )
++ // Permissions is the permissions block of one Claude Code settings file, as
++ // written. Which of it is honoured is decided by NewRuleset, not here.
++ type Permissions struct {
++ 	Scope Scope
++ 	// Path is the file, and Shown is how a message names it.
++ 	Path  string
++ 	Shown string
++ 	Allow []string
++ 	Deny  []string
++ 	Ask   []string
++ 	// DefaultMode is Claude Code's starting permission mode. Only
++ 	// "acceptEdits" and "default" mean anything to Codey, and only from a
++ 	// file the user wrote.
++ 	DefaultMode string
++ 	// Tracked is set on a settings.local.json that git is tracking. Claude
++ 	// Code keeps that file out of git, so one that is committed came from the
++ 	// repository like the shared file did, and is treated as project scope.
++ 	Tracked bool
++ }
++ // settingsFile is the part of a settings file this package reads. Hooks, env,
++ // model, statusLine and the rest are other harnesses' business; see the
++ // README for what is deliberately not carried over.
++ type settingsFile struct {
++ 	Permissions struct {
++ 		Allow       []string `json:"allow"`
++ 		Deny        []string `json:"deny"`
++ 		Ask         []string `json:"ask"`
++ 		DefaultMode string   `json:"defaultMode"`
++ 	} `json:"permissions"`
++ }
++ // LoadPermissions reads the three settings files Claude Code would read for
++ // root, in the order it would read them: the user's, the project's shared
++ // file, and the project's local one. A file that is not there is skipped
++ // silently; one that cannot be parsed is reported and skipped, which leaves
++ // its deny rules unenforced — so the error is worth putting in front of the
++ // user rather than in a log.
++ //
++ // home may be empty, for a machine with no home directory; the user's file is
++ // then not read.
++ func LoadPermissions(home, root string) ([]Permissions, []error) {
++ 	type candidate struct {
++ 		scope Scope
++ 		path  string
++ 	}
++ 	var files []candidate
++ 	if home != "" {
++ 		files = append(files, candidate{ScopeUser, filepath.Join(home, UserSettings)})
++ 	}
++ 	// A root that is the home directory would read the user's file twice,
++ 	// once as a project file; it is the user's.
++ 	if root != "" && filepath.Clean(root) != filepath.Clean(home) {
++ 		files = append(files,
++ 			candidate{ScopeProject, filepath.Join(root, ProjectSettings)},
++ 			candidate{ScopeLocal, filepath.Join(root, LocalSettings)})
++ 	}
++ 	var out []Permissions
++ 	var errs []error
++ 	for _, f := range files {
++ 		var s settingsFile
++ 		ok, err := readJSON(f.path, &s)
++ 		if err != nil {
++ 			errs = append(errs, fmt.Errorf("claude code settings: %w", err))
++ 			continue
++ 		}
++ 		if !ok {
++ 			continue
++ 		}
++ 		p := Permissions{
++ 			Scope:       f.scope,
++ 			Path:        f.path,
++ 			Shown:       shown(home, root, f.path),
++ 			Allow:       s.Permissions.Allow,
++ 			Deny:        s.Permissions.Deny,
++ 			Ask:         s.Permissions.Ask,
++ 			DefaultMode: s.Permissions.DefaultMode,
++ 		}
++ 		if f.scope == ScopeLocal && gitTracks(root, LocalSettings) {
++ 			p.Scope, p.Tracked = ScopeProject, true
++ 		}
++ 		out = append(out, p)
++ 	}
++ 	return out, errs
++ }
++ // gitTracks reports whether git has rel in its index under root. Any failure
++ // — no git, not a repository — reads as untracked, which is the honest answer
++ // for a directory git knows nothing about: nobody committed the file.
++ func gitTracks(root, rel string) bool {
++ 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
++ 	defer cancel()
++ 	cmd := exec.CommandContext(ctx, "git", "-C", root, "ls-files", "--error-unmatch", "--", rel)
++ 	return cmd.Run() == nil
++ }

+156−0internal/ccsettings/ruleset.goaddedView File