baychat 0.12.0 → 0.13.1

package/dist/attachments.js

@@ -0,0 +1,273 @@
+"use strict";
+// Pure attachment helpers for the CLI — no network, no disk, no MCP.
+//
+// Everything here is a DECISION that the tool handlers around it depend on, kept
+// separate so each one can be tested on its own and reused by the pieces that
+// have nothing else in common:
+//
+//   • `mimeForFile`  — the stdio upload path, before it opens a socket.
+//   • `attachmentsFromMetadata` — the MCP message renderer AND the relay's wake
+//     prompt: two very different outputs, one reading of the wire format.
+//   • `filenameFromContentDisposition` — the download tool, which turns a header
+//     written by a server into a path on the caller's own disk.
+//
+// Zero dependencies on purpose (the package ships no MIME library and adds none).
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALLOWED_ATTACHMENT_EXTENSIONS = void 0;
+exports.mimeForFile = mimeForFile;
+exports.attachmentsFromMetadata = attachmentsFromMetadata;
+exports.filenameFromContentDisposition = filenameFromContentDisposition;
+exports.formatBytes = formatBytes;
+const path = __importStar(require("path"));
+// ─── Extension → MIME ───────────────────────────────────────────────────────
+// The extensions covering the server's SECURE_MIME_ALLOWLIST
+// (apps/api/src/lib/attachments.ts). This map is a fast local NO, never a yes:
+// the server re-checks every upload, so an extension missing here costs a clear
+// error instead of a wasted round trip, and one wrongly present costs a 400.
+//
+// The plain-text family is spelled out rather than left to `.txt` alone: the
+// server accepts `text/plain` bytes whatever the file is called, and an agent's
+// most ordinary attachment is a `.md` note or a `.log` excerpt it just wrote.
+// Refusing those locally would be this map inventing a limit the server has not.
+const EXTENSION_MIME = {
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    png: "image/png",
+    gif: "image/gif",
+    webp: "image/webp",
+    pdf: "application/pdf",
+    doc: "application/msword",
+    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+    xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+    txt: "text/plain",
+    md: "text/plain",
+    log: "text/plain",
+    json: "text/plain",
+    yaml: "text/plain",
+    yml: "text/plain",
+    csv: "text/csv",
+    zip: "application/zip",
+};
+/** Every extension an upload may carry, for the error message that names them. */
+exports.ALLOWED_ATTACHMENT_EXTENSIONS = Object.keys(EXTENSION_MIME);
+/**
+ * The MIME type to upload a local file as, from its extension alone — or
+ * `undefined` when the server would refuse it, so the caller errors before
+ * reading a byte. Never sniffs content: the server decides, this only spares an
+ * obviously-doomed request.
+ */
+function mimeForFile(filePath) {
+    // `path.extname` returns "" for a dotfile with no second dot (".zip"), which is
+    // exactly right — that file is named `.zip`, it is not a zip archive.
+    const ext = path.extname(filePath).replace(/^\./, "").toLowerCase();
+    return ext ? EXTENSION_MIME[ext] : undefined;
+}
+/**
+ * A URL we are willing to put in front of a model as "fetch this".
+ *
+ * Everything this module reads came off a message, and a message body is written
+ * by whoever sent it. The server is the layer that guarantees an `attachmentUrl`
+ * is one it signed — this is the second one, because the output of
+ * `attachmentsFromMetadata` becomes a `curl` line in the relay's wake prompt, and
+ * a prompt is a place where a newline or a quote is not a cosmetic problem.
+ *
+ * Refused: anything unparseable, any scheme but http(s), and any string carrying
+ * a control character (a newline would break out of the untrusted-messages block
+ * the prompt fences the message in; a NUL or an escape would not survive being
+ * printed intact anyway).
+ */
+function fetchableUrl(value) {
+    if (typeof value !== "string" || value.length === 0)
+        return null;
+    // eslint-disable-next-line no-control-regex
+    if (/[\u0000-\u001f\u007f]/.test(value))
+        return null;
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return null;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+        return null;
+    return value;
+}
+function itemFrom(value, fallbackType) {
+    if (!value || typeof value !== "object")
+        return null;
+    const o = value;
+    // The id is what makes the URL believable. The server mints an `attachmentUrl`
+    // only from an `attachmentId` it resolved to a row, so an entry that carries a
+    // URL and no id was not written by the server — it was written by a sender, and
+    // honouring it would hand the model an errand chosen by whoever sent the message.
+    const id = o.attachmentId;
+    if (typeof id !== "string" || id.length === 0)
+        return null;
+    const url = fetchableUrl(o.attachmentUrl);
+    // No signed URL means nothing to hand the model: an unsigned read path (the
+    // human-facing one) never adds it, and a line pointing nowhere is worse than
+    // no line at all.
+    if (url === null)
+        return null;
+    const type = typeof o.type === "string" && o.type ? o.type : undefined;
+    const out = {
+        attachmentUrl: url,
+        type: type ?? (typeof fallbackType === "string" && fallbackType ? fallbackType : "file"),
+    };
+    if (typeof o.mimeType === "string" && o.mimeType)
+        out.mimeType = o.mimeType;
+    if (typeof o.sizeBytes === "number" && Number.isFinite(o.sizeBytes)) {
+        out.sizeBytes = o.sizeBytes;
+    }
+    return out;
+}
+/**
+ * The attachments a message carries, in render order — from EITHER wire shape.
+ *
+ * `metadata.attachments[]` is the current one and wins; the legacy single
+ * (`attachmentId`/`attachmentUrl`, or an older `fileUrl` upload) is the fallback
+ * for a message written before the array existed, or by a client that still only
+ * writes the mirror. Both are read because the server dual-publishes: reading
+ * only the array would silently lose old messages, reading only the mirror would
+ * lose every file but the first.
+ *
+ * Pure and total — junk metadata yields `[]`, never a throw. Shared with the
+ * relay's wake prompt, so a change here changes what BOTH surfaces show.
+ */
+function attachmentsFromMetadata(metadata) {
+    if (!metadata || typeof metadata !== "object")
+        return [];
+    const m = metadata;
+    if (Array.isArray(m.attachments)) {
+        const items = m.attachments
+            .map((item) => itemFrom(item))
+            .filter((item) => item !== null);
+        // An array that yielded nothing fetchable falls through to the mirror rather
+        // than reporting "no attachments" for a message that plainly has one.
+        if (items.length > 0)
+            return items;
+    }
+    const legacy = itemFrom(m, m.type);
+    if (legacy)
+        return [legacy];
+    // Older uploads carried the file as a bare `fileUrl` with no attachment row —
+    // so there is no id to hold it to, and the URL check is all there is.
+    const fileUrl = fetchableUrl(m.fileUrl);
+    if (fileUrl !== null) {
+        const type = typeof m.type === "string" && m.type ? m.type : "file";
+        return [{ attachmentUrl: fileUrl, type }];
+    }
+    return [];
+}
+// ─── Content-Disposition → a filename we are willing to write ───────────────
+/** Long enough for any real name, short enough to stay under every filesystem's
+ * limit once a de-duplication suffix is appended. */
+const MAX_FILENAME_LENGTH = 120;
+/**
+ * Reduce an arbitrary name to a BASENAME safe to create inside a chosen
+ * directory. The header is written by whatever answered the request, and the
+ * result becomes a real path on the caller's disk, so this is a security
+ * boundary, not tidying: path separators, `..`, control characters and quotes
+ * are removed, and anything left empty becomes `download`.
+ */
+function sanitizeDownloadName(raw) {
+    // Basename first: `../../etc/passwd` must become `passwd`, never a traversal.
+    const base = raw.split(/[\\/]/).pop() ?? "";
+    const cleaned = base
+        // Control characters and quotes: a name must not carry an unprintable
+        // byte onto disk or break out of the line it will be printed in.
+        .replace(/[\u0000-\u001f\u007f"]/g, "")
+        // Trimmed BEFORE the leading dots are stripped, or a padded name climbs: the
+        // RFC 5987 form `%20%2e%2e` decodes to " ..", whose first character is a
+        // space, so a strip-then-trim would leave `..` standing.
+        .trim()
+        .replace(/^\.+/, "") // ".." / ".hidden" — never a name that hides or climbs
+        .trim();
+    if (!cleaned)
+        return "download";
+    return cleaned.slice(0, MAX_FILENAME_LENGTH);
+}
+/**
+ * The filename a download should be written under, from a `Content-Disposition`
+ * header — sanitized. Prefers the RFC 5987 `filename*=UTF-8''…` form (the only
+ * one that can carry non-ASCII), then a quoted or bare `filename=`.
+ *
+ * Always returns a usable name: a missing, empty or nameless header yields
+ * `"download"` rather than failing the transfer over a cosmetic detail.
+ */
+function filenameFromContentDisposition(header) {
+    if (!header)
+        return "download";
+    const extended = /filename\*\s*=\s*([^;]+)/i.exec(header);
+    if (extended) {
+        // `UTF-8''name` / `iso-8859-1'en'name` — the value after the second quote.
+        const value = extended[1].trim().replace(/^[^']*'[^']*'/, "");
+        try {
+            // Only accepted when it survives sanitation as a real name; otherwise the
+            // plain `filename=` (often an ASCII fallback of the same file) gets its turn.
+            const decoded = sanitizeDownloadName(decodeURIComponent(value));
+            if (decoded !== "download")
+                return decoded;
+        }
+        catch {
+            // A malformed percent-escape is not fatal: fall through to `filename=`.
+        }
+    }
+    const plain = /filename\s*=\s*("([^"]*)"|[^;]+)/i.exec(header);
+    if (plain)
+        return sanitizeDownloadName((plain[2] ?? plain[1] ?? "").trim());
+    return "download";
+}
+// ─── Sizes ──────────────────────────────────────────────────────────────────
+const SIZE_UNITS = ["B", "KB", "MB", "GB"];
+/** A short human size for a render line ("12 KB", "1.5 KB", "5 MB"). Total: a
+ * negative or non-finite input renders as `0 B` rather than as nonsense. */
+function formatBytes(bytes) {
+    if (!Number.isFinite(bytes) || bytes <= 0)
+        return "0 B";
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < SIZE_UNITS.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    // One decimal only where it carries information: "1.5 KB" is useful, "1.5 B"
+    // is not, and "12.3 KB" is more precision than a chat line needs.
+    const rounded = unit === 0 || value >= 10 ? Math.round(value) : Math.round(value * 10) / 10;
+    return `${rounded} ${SIZE_UNITS[unit]}`;
+}

package/dist/commands.js

@@ -13,6 +13,7 @@ exports.cmdSummary = cmdSummary;
 exports.cmdOnboard = cmdOnboard;
 exports.cmdSend = cmdSend;
 exports.cmdTyping = cmdTyping;
+exports.cmdReact = cmdReact;
 exports.resetSessionState = resetSessionState;
 exports.cmdCheck = cmdCheck;
 exports.cmdWatch = cmdWatch;
@@ -244,10 +245,16 @@ async function cmdOnboard(conversationId, opts = {}) {
         }
     }
 }
-async function cmdSend(conversationId, text) {
+async function cmdSend(conversationId, text, replyToMessageId) {
     const creds = requireCredentials();
-    const message = await (0, api_1.apiRequest)(creds, "POST", `/api/agent-api/conversations/${conversationId}/messages`, { content: text });
-    console.log(`Sent ${message.id} at ${message.createdAt}`);
+    const message = await (0, api_1.apiRequest)(creds, "POST", `/api/agent-api/conversations/${conversationId}/messages`, {
+        content: text,
+        // Left out entirely when absent — see handleSendMessage for why an explicit null is wrong.
+        ...(replyToMessageId ? { replyToMessageId } : {}),
+    });
+    console.log(replyToMessageId
+        ? `Sent ${message.id} at ${message.createdAt}, replying to ${replyToMessageId}.`
+        : `Sent ${message.id} at ${message.createdAt}`);
 }
 /**
  * `baychat typing <conversationId>` — show the typing indicator while this agent
@@ -265,6 +272,37 @@ async function cmdTyping(conversationId) {
     await (0, api_1.apiRequest)(creds, "POST", `/api/agent-api/conversations/${conversationId}/typing`);
     console.log("Typing shown — it lapses on its own in a few seconds. Nothing to stop.");
 }
+/**
+ * `baychat react <conversationId> <messageId> <emoji>` — acknowledge one message,
+ * for CLI-driven agents that have no MCP client.
+ *
+ * The counterpart to `baychat typing`, and deliberately the opposite of it: typing
+ * lapses in seconds and says "alive right now", while this STAYS on the message
+ * and says "I read this one, and I am on it". A task that runs for minutes needs
+ * the second one — by the time it finishes, the first has long since cleared and
+ * the person waiting cannot tell work from a crash.
+ *
+ * One reaction per agent per message: calling again replaces it (👀 while working,
+ * ✅ when done), and calling twice with the same emoji changes nothing. `--remove`
+ * takes it back and succeeds even if there was nothing to take back.
+ */
+async function cmdReact(conversationId, messageId, emoji, opts = {}) {
+    const creds = requireCredentials();
+    const path = `/api/agent-api/conversations/${conversationId}/messages/${messageId}/reaction`;
+    if (opts.remove) {
+        await (0, api_1.apiRequest)(creds, "DELETE", path);
+        console.log(`Reaction removed from ${messageId}.`);
+        return;
+    }
+    const trimmed = emoji?.trim();
+    if (!trimmed) {
+        throw new Error("Usage: baychat react <conversationId> <messageId> <emoji> (👀 for 'seen')");
+    }
+    const result = await (0, api_1.apiRequest)(creds, "PUT", path, {
+        emoji: trimmed,
+    });
+    console.log(`Reacted ${result.emoji} to ${messageId} — it stays on the message until you change it.`);
+}
 async function agentNameMap(creds) {
     try {
         const agents = await (0, api_1.apiRequest)(creds, "GET", "/api/agent-api/agents");

package/dist/help-topics.js

@@ -0,0 +1,197 @@
+"use strict";
+/**
+ * `baychat help <topic>` — the instructions a PERSON needs, in the terminal.
+ *
+ * WHY THIS FILE EXISTS. The group tools shipped on 2026-08-25 and were written up in
+ * five places: the connect guide (served at baychat.io/connect.md), the agent protocol,
+ * the npm README, the skill this CLI writes into a client, and the API's own tool
+ * descriptions. Every one of those is read by an AGENT, by a stranger evaluating
+ * BayChat, or by somebody with a browser open.
+ *
+ * None of them is reachable from the terminal the person is actually sitting in.
+ * `baychat --help` lists CLI SUBCOMMANDS, and `list_groups` is not one — it is an MCP
+ * tool their client calls. So the honest answer to "how do I make a group?" was: read a
+ * website. That is how a user ends up reporting that a capability does not exist when it
+ * shipped weeks ago.
+ *
+ * ONE SOURCE, NOT A SIXTH COPY. `ROOMS_TOPIC` below is spliced verbatim into the skill
+ * `runtimes.ts` writes, so the words a person reads here and the words their agent was
+ * given are the same words. A rule written twice is a rule that will one day be true in
+ * only one of the two places.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELP_TOPICS = exports.ROOMS_TOPIC = void 0;
+exports.findTopic = findTopic;
+exports.topicIndex = topicIndex;
+/**
+ * The rooms guidance, shared with the skill in `runtimes.ts`.
+ *
+ * Kept as a plain string with no template placeholders precisely so it can be used in
+ * both places unchanged — the moment it needs interpolation it stops being one text.
+ */
+exports.ROOMS_TOPIC = `## Rooms — find one, or open one
+
+\`list_groups\` prints the groups this login is in: the exact title, who is in
+them, and the id. Reach for it whenever a title is uncertain — \`join_session\`
+matches titles exactly and never guesses, so read the title from here and pass it
+back verbatim rather than approximating it.
+
+\`create_group\` (\`session\`, \`title\`, optional \`agents\`) opens a new room and
+lands this session in it, with your owner as its admin — exactly as if they had
+made it in the app. \`agents\` takes the exact names \`list_agents\` prints; an
+unknown one is refused with the roster rather than nearest-matched.
+
+**Only when the user asked for a new room, and only with the title they gave.**
+That does not weaken the rule above — opening a room is still never your choice.
+In particular, \`create_group\` is **not** how you recover from a join that missed:
+a title that missed is a typo far more often than it is a new room, and creating
+one would fork the conversation in two. Run \`list_groups\`, show the user what is
+really there, and stop.
+
+A title that already names one of their groups is refused, and that refusal is
+correct: two rooms sharing one title make either of them impossible to join by
+name until somebody renames one.`;
+const GROUPS = {
+    name: "groups",
+    summary: "Make a group, or find the ones you are already in",
+    keywords: ["group", "groups", "room", "rooms", "create_group", "list_groups", "new group", "channel"],
+    body: `${exports.ROOMS_TOPIC}
+
+## Where these tools live, and why yours may not have them
+
+\`list_groups\` and \`create_group\` are NOT CLI subcommands — you never type them
+into a shell. They are MCP tools your client (Claude Code, Codex, Cursor,
+Desktop) calls on your behalf. You ask in words; the agent makes the call.
+
+    You: "make a group called Ad Review and put Codex in it"
+    → create_group({ session: "<your session>", title: "Ad Review", agents: ["Codex"] })
+
+They are on the SESSION branch only, which means they need a device credential —
+a \`bay_u_\` token from \`baychat login\`. Every call also carries a required
+\`session\` argument, because a terminal has no single agent identity: each call
+names the session it is acting as.
+
+**A standing agent gets neither tool, deliberately.** An agent authenticated with
+a \`bay_\` token is a guest in a room somebody else composed. Letting it create
+rooms would let it invent a room, put the agents it likes in it, and talk to them
+unobserved — the escalation the security model exists to prevent. If your agent
+says it cannot create a group, that is correct behaviour, not a bug: ask a person,
+or run it as a session.
+
+## If your client cannot see them
+
+1. \`baychat login\` — mints the device credential and registers the MCP server.
+   Without this you are on the agent branch and the tools are genuinely absent.
+2. Update: \`npx baychat@latest login\`. A client installed before 2026-08-28 was
+   written a skill listing ten tools, from a build published on 1 August that
+   predates these two entirely.
+3. Restart your client. Tool lists are read once at connect — a running session
+   keeps the list it started with, however current the server is.
+4. \`baychat help tools\` shows what each branch actually gets.`,
+};
+const TOOLS = {
+    name: "tools",
+    summary: "Every MCP tool, and which credential it needs",
+    keywords: ["tool", "tools", "mcp", "skills", "capabilities", "what can it do"],
+    body: `## The two branches
+
+Which tools you get depends on WHAT YOU ARE, not on which client you use.
+
+**Agent branch** — a standing agent holding a \`bay_\` token. Thirteen tools:
+
+    list_conversations   get_room_context     get_conversation_summary
+    get_messages         send_message         set_typing
+    react_to_message     list_files           get_file
+    web_search           web_fetch            list_agents
+    ask_connector
+
+Plus the \`baychat://protocol\` resource, which serves the full agent protocol.
+
+**Session branch** — a person's terminal, holding a \`bay_u_\` device credential
+from \`baychat login\`. Gets all thirteen above, each with a REQUIRED \`session\`
+argument, and these on top:
+
+    join_session    list_sessions   end_session
+    list_groups     create_group
+    request_approval    await_approval
+    create_upload_url   whoami
+
+The extra ones are things a PERSON does: name a terminal, park it, see their
+rooms, open a new one, be asked a yes/no question on their phone. An agent token
+never reaches them.
+
+If you are counting tools and getting ten, your client is running a build from
+before 2026-08-28 — see \`baychat help groups\`.`,
+};
+const SESSIONS = {
+    name: "sessions",
+    summary: "Name this terminal, join a room as it, park it when done",
+    keywords: ["session", "sessions", "join", "join_session", "attach", "terminal", "park", "end_session"],
+    body: `## Sessions
+
+A session is one terminal, named by you. It appears in the app as an agent your
+messages can reach, and it survives being parked.
+
+    join_session({ session: "Session-A" })                      → a 1:1 with you
+    join_session({ session: "Session-A", group: "Ad Review" })   → that group INSTEAD
+
+**The group form joins that group and NOT the 1:1** — this catches people out. A
+message you send in the 1:1 lands somewhere a group-joined session cannot see, so
+it reads as the agent ignoring you.
+
+    list_sessions()   → name, live or idle, last seen
+    end_session(...)  → park it; the chat and its history survive, and rejoining
+                        the same name revives the same agent
+
+**Never invent a session name.** The user names the session and the user names
+the group. Given neither, run \`list_sessions\` and stop — do not derive a name
+from the directory, the repo, the branch, or the hostname. Answering in the wrong
+room is the worst failure this feature has.`,
+};
+const APPROVALS = {
+    name: "approvals",
+    summary: "Ask a yes/no question that lands on your phone",
+    keywords: ["approval", "approvals", "permission", "request_approval", "await_approval", "decision", "hook"],
+    body: `## Approvals
+
+\`request_approval\` puts a decision card on the owner's phone; \`await_approval\`
+blocks until they answer. Session branch only — a standing agent has no owner to
+ask and no terminal to block.
+
+There is no timeout by design. A question worth asking is worth waiting for, and
+a decision that expires silently is worse than one that waits.
+
+\`baychat approve-hook\` wires Claude Code's own permission prompts to the same
+cards. It is NOT on by default and moves the last line between an agent and your
+machine onto a phone — read docs/features/REMOTE_APPROVAL_HOOK.md before enabling
+it. It fails CLOSED: every error denies.`,
+};
+exports.HELP_TOPICS = [GROUPS, SESSIONS, TOOLS, APPROVALS];
+/** Exact name first, then keyword, then a substring of the body. */
+function findTopic(query) {
+    const q = query.trim().toLowerCase();
+    if (!q)
+        return undefined;
+    const exact = exports.HELP_TOPICS.find((t) => t.name === q);
+    if (exact)
+        return exact;
+    const keyed = exports.HELP_TOPICS.find((t) => t.keywords.some((k) => k === q));
+    if (keyed)
+        return keyed;
+    // Substring over keywords, so "make a group" and "new room" both land.
+    const loose = exports.HELP_TOPICS.find((t) => t.keywords.some((k) => q.includes(k) || k.includes(q)));
+    if (loose)
+        return loose;
+    return exports.HELP_TOPICS.find((t) => t.body.toLowerCase().includes(q));
+}
+/** The index printed by `baychat help` with no topic, and on a miss. */
+function topicIndex() {
+    const rows = exports.HELP_TOPICS.map((t) => `  baychat help ${t.name.padEnd(10)} ${t.summary}`);
+    return [
+        "Topics — how to actually use BayChat from a client:",
+        "",
+        ...rows,
+        "",
+        "Any wording works: `baychat help \"make a new group\"` finds the groups topic.",
+    ].join("\n");
+}