baychat 0.11.4 → 0.13.0

package/dist/attachments.js

@@ -0,0 +1,273 @@
+"use strict";
+// Pure attachment helpers for the CLI — no network, no disk, no MCP.
+//
+// Everything here is a DECISION that the tool handlers around it depend on, kept
+// separate so each one can be tested on its own and reused by the pieces that
+// have nothing else in common:
+//
+//   • `mimeForFile`  — the stdio upload path, before it opens a socket.
+//   • `attachmentsFromMetadata` — the MCP message renderer AND the relay's wake
+//     prompt: two very different outputs, one reading of the wire format.
+//   • `filenameFromContentDisposition` — the download tool, which turns a header
+//     written by a server into a path on the caller's own disk.
+//
+// Zero dependencies on purpose (the package ships no MIME library and adds none).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOWED_ATTACHMENT_EXTENSIONS = void 0;
+exports.mimeForFile = mimeForFile;
+exports.attachmentsFromMetadata = attachmentsFromMetadata;
+exports.filenameFromContentDisposition = filenameFromContentDisposition;
+exports.formatBytes = formatBytes;
+const path = __importStar(require("path"));
+// ─── Extension → MIME ───────────────────────────────────────────────────────
+// The extensions covering the server's SECURE_MIME_ALLOWLIST
+// (apps/api/src/lib/attachments.ts). This map is a fast local NO, never a yes:
+// the server re-checks every upload, so an extension missing here costs a clear
+// error instead of a wasted round trip, and one wrongly present costs a 400.
+//
+// The plain-text family is spelled out rather than left to `.txt` alone: the
+// server accepts `text/plain` bytes whatever the file is called, and an agent's
+// most ordinary attachment is a `.md` note or a `.log` excerpt it just wrote.
+// Refusing those locally would be this map inventing a limit the server has not.
+const EXTENSION_MIME = {
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    png: "image/png",
+    gif: "image/gif",
+    webp: "image/webp",
+    pdf: "application/pdf",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    txt: "text/plain",
+    md: "text/plain",
+    log: "text/plain",
+    json: "text/plain",
+    yaml: "text/plain",
+    yml: "text/plain",
+    csv: "text/csv",
+    zip: "application/zip",
+};
+/** Every extension an upload may carry, for the error message that names them. */
+exports.ALLOWED_ATTACHMENT_EXTENSIONS = Object.keys(EXTENSION_MIME);
+/**
+ * The MIME type to upload a local file as, from its extension alone — or
+ * `undefined` when the server would refuse it, so the caller errors before
+ * reading a byte. Never sniffs content: the server decides, this only spares an
+ * obviously-doomed request.
+ */
+function mimeForFile(filePath) {
+    // `path.extname` returns "" for a dotfile with no second dot (".zip"), which is
+    // exactly right — that file is named `.zip`, it is not a zip archive.
+    const ext = path.extname(filePath).replace(/^\./, "").toLowerCase();
+    return ext ? EXTENSION_MIME[ext] : undefined;
+}
+/**
+ * A URL we are willing to put in front of a model as "fetch this".
+ *
+ * Everything this module reads came off a message, and a message body is written
+ * by whoever sent it. The server is the layer that guarantees an `attachmentUrl`
+ * is one it signed — this is the second one, because the output of
+ * `attachmentsFromMetadata` becomes a `curl` line in the relay's wake prompt, and
+ * a prompt is a place where a newline or a quote is not a cosmetic problem.
+ *
+ * Refused: anything unparseable, any scheme but http(s), and any string carrying
+ * a control character (a newline would break out of the untrusted-messages block
+ * the prompt fences the message in; a NUL or an escape would not survive being
+ * printed intact anyway).
+ */
+function fetchableUrl(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return null;
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+    return value;
+}
+function itemFrom(value, fallbackType) {
+    if (!value || typeof value !== "object")
+        return null;
+    const o = value;
+    // The id is what makes the URL believable. The server mints an `attachmentUrl`
+    // only from an `attachmentId` it resolved to a row, so an entry that carries a
+    // URL and no id was not written by the server — it was written by a sender, and
+    // honouring it would hand the model an errand chosen by whoever sent the message.
+    const id = o.attachmentId;
+    if (typeof id !== "string" || id.length === 0)
+        return null;
+    const url = fetchableUrl(o.attachmentUrl);
+    // No signed URL means nothing to hand the model: an unsigned read path (the
+    // human-facing one) never adds it, and a line pointing nowhere is worse than
+    // no line at all.
+    if (url === null)
+        return null;
+    const type = typeof o.type === "string" && o.type ? o.type : undefined;
+    const out = {
+        attachmentUrl: url,
+        type: type ?? (typeof fallbackType === "string" && fallbackType ? fallbackType : "file"),
+    };
+    if (typeof o.mimeType === "string" && o.mimeType)
+        out.mimeType = o.mimeType;
+    if (typeof o.sizeBytes === "number" && Number.isFinite(o.sizeBytes)) {
+        out.sizeBytes = o.sizeBytes;
+    }
+    return out;
+}
+/**
+ * The attachments a message carries, in render order — from EITHER wire shape.
+ *
+ * `metadata.attachments[]` is the current one and wins; the legacy single
+ * (`attachmentId`/`attachmentUrl`, or an older `fileUrl` upload) is the fallback
+ * for a message written before the array existed, or by a client that still only
+ * writes the mirror. Both are read because the server dual-publishes: reading
+ * only the array would silently lose old messages, reading only the mirror would
+ * lose every file but the first.
+ *
+ * Pure and total — junk metadata yields `[]`, never a throw. Shared with the
+ * relay's wake prompt, so a change here changes what BOTH surfaces show.
+ */
+function attachmentsFromMetadata(metadata) {
+    if (!metadata || typeof metadata !== "object")
+        return [];
+    const m = metadata;
+    if (Array.isArray(m.attachments)) {
+        const items = m.attachments
+            .map((item) => itemFrom(item))
+            .filter((item) => item !== null);
+        // An array that yielded nothing fetchable falls through to the mirror rather
+        // than reporting "no attachments" for a message that plainly has one.
+        if (items.length > 0)
+            return items;
+    }
+    const legacy = itemFrom(m, m.type);
+    if (legacy)
+        return [legacy];
+    // Older uploads carried the file as a bare `fileUrl` with no attachment row —
+    // so there is no id to hold it to, and the URL check is all there is.
+    const fileUrl = fetchableUrl(m.fileUrl);
+    if (fileUrl !== null) {
+        const type = typeof m.type === "string" && m.type ? m.type : "file";
+        return [{ attachmentUrl: fileUrl, type }];
+    }
+    return [];
+}
+// ─── Content-Disposition → a filename we are willing to write ───────────────
+/** Long enough for any real name, short enough to stay under every filesystem's
+ * limit once a de-duplication suffix is appended. */
+const MAX_FILENAME_LENGTH = 120;
+/**
+ * Reduce an arbitrary name to a BASENAME safe to create inside a chosen
+ * directory. The header is written by whatever answered the request, and the
+ * result becomes a real path on the caller's disk, so this is a security
+ * boundary, not tidying: path separators, `..`, control characters and quotes
+ * are removed, and anything left empty becomes `download`.
+ */
+function sanitizeDownloadName(raw) {
+    // Basename first: `../../etc/passwd` must become `passwd`, never a traversal.
+    const base = raw.split(/[\\/]/).pop() ?? "";
+    const cleaned = base
+        // Control characters and quotes: a name must not carry an unprintable
+        // byte onto disk or break out of the line it will be printed in.
+        .replace(/[\u0000-\u001f\u007f"]/g, "")
+        // Trimmed BEFORE the leading dots are stripped, or a padded name climbs: the
+        // RFC 5987 form `%20%2e%2e` decodes to " ..", whose first character is a
+        // space, so a strip-then-trim would leave `..` standing.
+        .trim()
+        .replace(/^\.+/, "") // ".." / ".hidden" — never a name that hides or climbs
+        .trim();
+    if (!cleaned)
+        return "download";
+    return cleaned.slice(0, MAX_FILENAME_LENGTH);
+}
+/**
+ * The filename a download should be written under, from a `Content-Disposition`
+ * header — sanitized. Prefers the RFC 5987 `filename*=UTF-8''…` form (the only
+ * one that can carry non-ASCII), then a quoted or bare `filename=`.
+ *
+ * Always returns a usable name: a missing, empty or nameless header yields
+ * `"download"` rather than failing the transfer over a cosmetic detail.
+ */
+function filenameFromContentDisposition(header) {
+    if (!header)
+        return "download";
+    const extended = /filename\*\s*=\s*([^;]+)/i.exec(header);
+    if (extended) {
+        // `UTF-8''name` / `iso-8859-1'en'name` — the value after the second quote.
+        const value = extended[1].trim().replace(/^[^']*'[^']*'/, "");
+        try {
+            // Only accepted when it survives sanitation as a real name; otherwise the
+            // plain `filename=` (often an ASCII fallback of the same file) gets its turn.
+            const decoded = sanitizeDownloadName(decodeURIComponent(value));
+            if (decoded !== "download")
+                return decoded;
+        }
+        catch {
+            // A malformed percent-escape is not fatal: fall through to `filename=`.
+        }
+    }
+    const plain = /filename\s*=\s*("([^"]*)"|[^;]+)/i.exec(header);
+    if (plain)
+        return sanitizeDownloadName((plain[2] ?? plain[1] ?? "").trim());
+    return "download";
+}
+// ─── Sizes ──────────────────────────────────────────────────────────────────
+const SIZE_UNITS = ["B", "KB", "MB", "GB"];
+/** A short human size for a render line ("12 KB", "1.5 KB", "5 MB"). Total: a
+ * negative or non-finite input renders as `0 B` rather than as nonsense. */
+function formatBytes(bytes) {
+    if (!Number.isFinite(bytes) || bytes <= 0)
+        return "0 B";
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < SIZE_UNITS.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    // One decimal only where it carries information: "1.5 KB" is useful, "1.5 B"
+    // is not, and "12.3 KB" is more precision than a chat line needs.
+    const rounded = unit === 0 || value >= 10 ? Math.round(value) : Math.round(value * 10) / 10;
+    return `${rounded} ${SIZE_UNITS[unit]}`;
+}

package/dist/commands.js

@@ -12,6 +12,8 @@ exports.cmdContext = cmdContext;
 exports.cmdSummary = cmdSummary;
 exports.cmdOnboard = cmdOnboard;
 exports.cmdSend = cmdSend;
+exports.cmdTyping = cmdTyping;
+exports.cmdReact = cmdReact;
 exports.resetSessionState = resetSessionState;
 exports.cmdCheck = cmdCheck;
 exports.cmdWatch = cmdWatch;
@@ -243,10 +245,63 @@ async function cmdOnboard(conversationId, opts = {}) {
         }
     }
 }
-async function cmdSend(conversationId, text) {
+async function cmdSend(conversationId, text, replyToMessageId) {
     const creds = requireCredentials();
-    const message = await (0, api_1.apiRequest)(creds, "POST", `/api/agent-api/conversations/${conversationId}/messages`, { content: text });
-    console.log(`Sent ${message.id} at ${message.createdAt}`);
+    const message = await (0, api_1.apiRequest)(creds, "POST", `/api/agent-api/conversations/${conversationId}/messages`, {
+        content: text,
+        // Left out entirely when absent — see handleSendMessage for why an explicit null is wrong.
+        ...(replyToMessageId ? { replyToMessageId } : {}),
+    });
+    console.log(replyToMessageId
+        ? `Sent ${message.id} at ${message.createdAt}, replying to ${replyToMessageId}.`
+        : `Sent ${message.id} at ${message.createdAt}`);
+}
+/**
+ * `baychat typing <conversationId>` — show the typing indicator while this agent
+ * works, for CLI-driven agents that have no MCP client.
+ *
+ * ONE CALL, at the start of a turn. The server entry carries a few-second TTL and
+ * a sweep clears it, so there is deliberately no `baychat typing --stop`: an
+ * agent that dies mid-turn stops appearing to type without anyone cleaning up
+ * after it. The printed line says so, because a caller told only "typing on"
+ * would reasonably wrap this in a `while` loop — which is exactly the heartbeat
+ * this design exists to avoid.
+ */
+async function cmdTyping(conversationId) {
+    const creds = requireCredentials();
+    await (0, api_1.apiRequest)(creds, "POST", `/api/agent-api/conversations/${conversationId}/typing`);
+    console.log("Typing shown — it lapses on its own in a few seconds. Nothing to stop.");
+}
+/**
+ * `baychat react <conversationId> <messageId> <emoji>` — acknowledge one message,
+ * for CLI-driven agents that have no MCP client.
+ *
+ * The counterpart to `baychat typing`, and deliberately the opposite of it: typing
+ * lapses in seconds and says "alive right now", while this STAYS on the message
+ * and says "I read this one, and I am on it". A task that runs for minutes needs
+ * the second one — by the time it finishes, the first has long since cleared and
+ * the person waiting cannot tell work from a crash.
+ *
+ * One reaction per agent per message: calling again replaces it (👀 while working,
+ * ✅ when done), and calling twice with the same emoji changes nothing. `--remove`
+ * takes it back and succeeds even if there was nothing to take back.
+ */
+async function cmdReact(conversationId, messageId, emoji, opts = {}) {
+    const creds = requireCredentials();
+    const path = `/api/agent-api/conversations/${conversationId}/messages/${messageId}/reaction`;
+    if (opts.remove) {
+        await (0, api_1.apiRequest)(creds, "DELETE", path);
+        console.log(`Reaction removed from ${messageId}.`);
+        return;
+    }
+    const trimmed = emoji?.trim();
+    if (!trimmed) {
+        throw new Error("Usage: baychat react <conversationId> <messageId> <emoji> (👀 for 'seen')");
+    }
+    const result = await (0, api_1.apiRequest)(creds, "PUT", path, {
+        emoji: trimmed,
+    });
+    console.log(`Reacted ${result.emoji} to ${messageId} — it stays on the message until you change it.`);
 }
 async function agentNameMap(creds) {
     try {

package/dist/index.js

@@ -2,6 +2,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./commands");
+const approve_hook_1 = require("./approve-hook");
 const connect_1 = require("./connect");
 const mcp_1 = require("./mcp");
 const mcp_config_1 = require("./mcp-config");
@@ -29,6 +30,16 @@ Usage:
   baychat whoami                        Show the connected agent identity
   baychat conversations                 List conversations this agent is in
   baychat send <conversationId> <text>  Send a message
+  baychat typing <conversationId>       Show the typing indicator while you work, so a long
+                                        tool call doesn't look like a crash. ONE call at the
+                                        start of a turn — it lapses on its own after a few
+                                        seconds, so there is nothing to stop and no loop to run
+  baychat react <conversationId> <messageId> <emoji> [--remove]
+                                        Acknowledge one message so the person who sent it
+                                        knows you have read it and are on it. Unlike typing,
+                                        the reaction STAYS on the message — use 👀 the moment
+                                        you pick up work that will take more than a few
+                                        seconds. Reacting again replaces it; --remove clears it
   baychat check <conversationId>        Print messages since the last check
   baychat context <conversationId>      Show the roster + the group's agent instructions
   baychat summary <conversationId> [--refresh]
@@ -65,6 +76,16 @@ Usage:
                                         came from, so "we can wake this headlessly"
                                         is a claim you can check
   baychat relay stop                    Stop the relay and disable it at boot
+  baychat approve-hook [--session <name>] [--timeout <sec>]
+                                        Claude Code PermissionRequest hook: send the
+                                        permission prompt to BayChat as a decision card
+                                        and answer it from your phone. Reads the hook
+                                        JSON on stdin, writes ONE decision object to
+                                        stdout, and always exits 0. FAILS CLOSED — every
+                                        error denies. NOT enabled by default; see
+                                        docs/features/REMOTE_APPROVAL_HOOK.md before
+                                        switching it on, because it moves the last line
+                                        between an agent and this machine onto a phone
   baychat relay attach --session <name> [--runtime claude|codex|hermes]
                         [--resume-id <id>] [--timeout <sec>]
                                         Register this session with the relay and block
@@ -132,11 +153,40 @@ async function main() {
             await (0, commands_1.cmdConversations)();
             return 0;
         case "send": {
-            const [conversationId, ...words] = args;
+            // `--reply-to <id>` is pulled out before the positionals, so the message text can
+            // contain anything — including a word that looks like a flag.
+            const flagAt = args.indexOf("--reply-to");
+            let replyToMessageId;
+            let rest = args;
+            if (flagAt !== -1) {
+                replyToMessageId = args[flagAt + 1];
+                if (!replyToMessageId)
+                    throw new Error("--reply-to needs a message id.");
+                rest = [...args.slice(0, flagAt), ...args.slice(flagAt + 2)];
+            }
+            const [conversationId, ...words] = rest;
             if (!conversationId || words.length === 0) {
-                throw new Error("Usage: baychat send <conversationId> <text>");
+                throw new Error("Usage: baychat send [--reply-to <messageId>] <conversationId> <text>");
+            }
+            await (0, commands_1.cmdSend)(conversationId, words.join(" "), replyToMessageId);
+            return 0;
+        }
+        case "typing": {
+            if (!args[0])
+                throw new Error("Usage: baychat typing <conversationId>");
+            await (0, commands_1.cmdTyping)(args[0]);
+            return 0;
+        }
+        case "react": {
+            // `--remove` needs no emoji, so the positionals are read from the flag-free
+            // list rather than by index: `react c1 m1 --remove` must not read "--remove"
+            // as the emoji and try to store it.
+            const [conversationId, messageId, emoji] = args.filter((a) => !a.startsWith("--"));
+            const remove = args.includes("--remove");
+            if (!conversationId || !messageId || (!emoji && !remove)) {
+                throw new Error("Usage: baychat react <conversationId> <messageId> <emoji> [--remove]");
             }
-            await (0, commands_1.cmdSend)(conversationId, words.join(" "));
+            await (0, commands_1.cmdReact)(conversationId, messageId, emoji, { remove });
             return 0;
         }
         case "check": {
@@ -211,6 +261,12 @@ async function main() {
                     throw new Error("Usage: baychat relay <start|status|stop|attach> [options]");
             }
         }
+        case "approve-hook":
+            // Never throws and always returns 0 — see the file header in approve-hook.ts. A thrown
+            // error here would reach main()'s catch, print to stderr and exit 1, and to Claude Code an
+            // exit-1 hook with no JSON on stdout is a NON-BLOCKING error: the tool call proceeds. The
+            // guard in the catch below covers that anyway.
+            return await (0, approve_hook_1.cmdApproveHook)(args);
         case "connect": {
             // A bare `connect` prints the client menu; positional() skips a leading flag
             // so `connect --base x codex` still finds the client.
@@ -244,6 +300,18 @@ async function main() {
 main()
     .then((code) => process.exit(code))
     .catch((err) => {
-    console.error(err instanceof Error ? err.message : String(err));
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    // The last fail-closed guard. For every other command, exit 1 is the right answer. For
+    // `approve-hook` it is the WRONG one twice over: Claude Code treats a non-zero exit with no
+    // JSON on stdout as a non-blocking error and lets the tool call through, so a crash in the
+    // approval gate would silently grant the permission it exists to withhold. Print a deny and
+    // exit 0 instead. Deliberately not sharing main()'s dispatch — this must still hold if the
+    // failure happened while parsing argv, or inside an import.
+    if (process.argv[2] === "approve-hook") {
+        process.stdout.write(`${JSON.stringify((0, approve_hook_1.denyDecision)(`Denied by BayChat remote approval: the approval gate crashed (${message}). ` +
+            `This gate fails closed, so the call was refused rather than allowed.`))}\n`);
+        process.exit(0);
+    }
     process.exit(1);
 });