baychat 0.13.0 → 0.14.0

package/dist/relay/daemon.js

@@ -36,10 +36,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RelayDaemon = void 0;
 const fs = __importStar(require("fs"));
 const net = __importStar(require("net"));
+const path = __importStar(require("path"));
 const config_1 = require("../config");
+const runtime_binary_1 = require("../runtime-binary");
 const adapters_1 = require("./adapters");
 const queue_1 = require("./queue");
 const registry_1 = require("./registry");
+const mailbox_1 = require("./mailbox");
+const mailbox_watcher_1 = require("./mailbox-watcher");
 const socket_1 = require("./socket");
 const transport_1 = require("./transport");
 const watermarks_1 = require("./watermarks");
@@ -57,6 +61,9 @@ class RelayDaemon {
     abort = new AbortController();
     /** Live attach sockets by session name. */
     attached = new Map();
+    /** Sessions reachable over a mailbox FIFO, by session name. */
+    mailboxes = new Map();
+    mailboxWatchers;
     /** Per (session, conversation) delivery positions — the 409 catch-up baseline. */
     watermarks = new watermarks_1.Watermarks();
     pending = [];
@@ -75,11 +82,58 @@ class RelayDaemon {
     discoveryReasons = new Map();
     discovery;
     spawnHeadless;
+    resolveBinary;
+    runTurn;
+    /**
+     * Resolutions already proven this process, by runtime binary name.
+     *
+     * Resolution costs a `--version` spawn per candidate, which must not be paid
+     * per message. The entry is dropped whenever a headless turn fails, so a user
+     * who installs the missing runtime is believed on the next message rather
+     * than after a relay restart nothing would have told them to perform.
+     */
+    binaries = new Map();
     log;
     constructor(opts = {}) {
         this.log = opts.log ?? ((line) => console.log(`[relay] ${line}`));
+        // EVERY candidate root, because the daemon cannot know which one the agent's
+        // sandbox turned out to permit — it may have fallen back past the one this
+        // process would have chosen.
+        this.mailboxWatchers = (0, mailbox_1.mailboxRootCandidates)().map((root) => new mailbox_watcher_1.MailboxWatcher({
+            root,
+            onRegister: (reg) => {
+                this.registry.upsert((0, mailbox_1.registrationToTarget)(reg));
+                // A session that names itself supersedes anything discovery guessed,
+                // exactly as an attach frame does.
+                if (reg.resumeId)
+                    this.discoveryReasons.delete(reg.session);
+                // The daemon makes the FIFO, because the agent cannot: creating one
+                // needs `mkfifo(1)` spawned, and a sandbox that lets an agent write
+                // files still refuses it a helper process. This side has the privilege,
+                // so this side does the privileged step.
+                try {
+                    // ENSURE, never recreate: a re-arm must not unlink the FIFO a live
+                    // reader is already blocked on. See `ensureWakeFifo`.
+                    (0, mailbox_1.ensureWakeFifo)(path.dirname(reg.fifo));
+                }
+                catch (err) {
+                    this.log(`could not create the wake FIFO for ${reg.session}: ${errText(err)}`);
+                    return;
+                }
+                this.mailboxes.set(reg.session, reg);
+                this.registry.setAttached(reg.session, true);
+                this.log(`attached via mailbox: ${reg.session} (${reg.runtime}) at ${reg.fifo}`);
+            },
+            onDrop: (session, reason) => {
+                this.mailboxes.delete(session);
+                this.registry.setAttached(session, false);
+                this.log(`detached: ${session} — ${reason}`);
+            },
+        }));
         this.discovery = opts.discovery ?? {};
         this.spawnHeadless = opts.spawnHeadless ?? adapters_1.runHeadless;
+        this.resolveBinary = opts.resolveBinary ?? ((name) => (0, runtime_binary_1.resolveRuntimeBinary)(name, (0, runtime_binary_1.currentBinaryEnv)()));
+        this.runTurn = opts.runTurn;
         this.queue = new queue_1.SessionQueue((session, batch) => this.deliver(session, batch), (session, err) => {
             this.lastError = `delivery failed for ${session}: ${errText(err)}`;
             this.log(this.lastError);
@@ -104,6 +158,10 @@ class RelayDaemon {
             throw new Error(`a relay is already listening on ${sockPath} — run \`baychat relay status\``);
         }
         (0, socket_1.unlinkStaleSocket)(sockPath);
+        // Sandboxed agents cannot reach the socket below, so the mailbox has to be
+        // watched from the moment the daemon is up — not lazily on first delivery.
+        for (const w of this.mailboxWatchers)
+            w.start();
         this.server = net.createServer((sock) => this.onConnection(sock));
         await new Promise((resolve, reject) => {
             this.server.once("error", reject);
@@ -189,6 +247,26 @@ class RelayDaemon {
     async deliver(session, batch) {
         const target = this.registry.get(session);
         if (!target) {
+            // NOT reported as pending, though an earlier version of this did.
+            //
+            // `liveSessions` lists every session of the USER, not of this machine. A
+            // person with WSL and Windows side by side has BOTH relays receiving
+            // events for BOTH machines' sessions, because the server fans out per
+            // credential and a session's host is not something it records. Treating
+            // "live for this user" as "ours" made each relay report DELIVERY PENDING
+            // for sessions the other machine was serving perfectly well — and a false
+            // pending is worse than none, because the entire value of that signal is
+            // that it means something is genuinely wrong.
+            //
+            // A session in the registry cannot reach here at all (`target` would be
+            // set), so there is no local evidence to appeal to: this name has never
+            // been seen on this machine. Another device is very likely handling it,
+            // and silence is the honest answer.
+            //
+            // The genuinely uncovered case — a session that joined a room and never
+            // attached ANYWHERE — is per-machine, not per-message, and belongs in
+            // `doctor`, which can compare the Bay's live sessions against this
+            // machine's registry without ever firing a false alarm.
             this.record({ kind: "ignored", reason: `unknown session ${session}` }, session, batch);
             return;
         }
@@ -202,10 +280,98 @@ class RelayDaemon {
             return;
         }
         const adapter = (0, adapters_1.adapterFor)(target.runtime);
+        // ORDERED ABOVE THE FIFO, deliberately.
+        //
+        // A FIFO hands bytes to a blocked `relay attach`, which prints them and
+        // exits. Where the harness re-invokes on that exit (Claude) it is a wake;
+        // for an interactive TUI it is only a PRINT — the text appears and nothing
+        // makes the agent act on it. Measured 2026-08-31 01:08: delivered via fifo
+        // to a live Codex, which then said nothing.
+        //
+        // `codex queue` puts the message in the session's own turn queue, so the
+        // agent ACTS. Prefer the transport that produces an ANSWER over the one
+        // that only produces a delivery.
+        // RUNG 2: the runtime's OWN inter-session queue, where it has one.
+        //
+        // Preferred over the headless spawn below because it reaches the LIVE
+        // session, where the human already is — so approvals work normally and the
+        // relay never acquires a privilege on a chat message's behalf. The headless
+        // rung must run `approvalPolicy: "never"`, which blocks Codex's own BayChat
+        // write path: observed 2026-08-31, a headlessly-woken Codex read the room
+        // and was structurally unable to answer it.
+        const resolvedForQueue = await this.resolveResume(target);
+        if (adapter.queueMessage && resolvedForQueue.resumeId) {
+            // Same rule as the headless spawn: an ABSOLUTE runtimeBin came from the
+            // session itself and is never re-resolved; only a bare name is looked up.
+            const declared = resolvedForQueue.runtimeBin ?? target.runtime;
+            let queueBin = declared;
+            if (!path.isAbsolute(declared)) {
+                const resolved = this.binaryFor(declared);
+                queueBin = resolved.ok ? resolved.path : "";
+            }
+            if (!queueBin) {
+                this.log(`queue unavailable for ${session}: no usable ${target.runtime} binary`);
+            }
+            else {
+                const outcome = await adapter.queueMessage({
+                    binaryPath: queueBin,
+                    target: resolvedForQueue,
+                    message: (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch, undefined),
+                });
+                if (outcome.kind === "queued") {
+                    this.record({ kind: "woken", via: "queue", session }, session, batch);
+                    return;
+                }
+                // EVERY non-success falls through, including `failed`.
+                //
+                // The queue is an OPTIMISATION, not a gate: it reaches the live session so
+                // approvals work, but the headless rung below is strictly more capable —
+                // it carries the Windows `.cmd` spawn plan, the app-server transport, and
+                // the binary resolution this path does not replicate. A rung that could
+                // not deliver must never shadow one that might; that exact mistake made a
+                // stale FIFO swallow three messages earlier tonight, and it would be the
+                // same mistake to repeat here for a different reason.
+                this.log(`queue did not deliver for ${session} (${outcome.reason}) — falling through to headless`);
+            }
+        }
         // A target with no resume id is the unbounded failure this whole path
         // exists to close: without one, `canResume` says no and the message waits
         // for a human. Ask the runtime's own on-disk state who this session is
         // before accepting that answer.
+        // RUNG 3: a session whose sandbox refuses the socket, waiting on a FIFO.
+        //
+        // Ordered after the socket and before headless because it means the SAME
+        // thing the socket does — a live session is waiting — while headless means
+        // the opposite. `writeWake` never blocks: a FIFO write with no reader would
+        // otherwise stall this daemon on one detached agent and stop it serving
+        // every other session, which is worse than the bug this rung fixes.
+        const mailbox = this.mailboxes.get(session);
+        if (mailbox) {
+            const payload = `${JSON.stringify({ type: "wake", conversationId: batch[0].conversationId, messages: batch })}\n`;
+            const written = (0, mailbox_1.writeWake)(mailbox.fifo, payload);
+            if (written.ok) {
+                // The one rung where `delivered` is EVIDENCED rather than assumed: a
+                // FIFO write completes only when a reader takes the bytes.
+                this.record({ kind: "woken", via: "fifo", session }, session, batch);
+                return;
+            }
+            // NOBODY IS WAITING — so FALL THROUGH, do not stop here.
+            //
+            // A registration is not a listener. The daemon cannot tell a stale
+            // registration from a live one on this rung, because a sandboxed agent
+            // records a NAMESPACED pid that `processIsAlive` reports alive forever
+            // (spec §13). Measured 2026-08-31 00:04: a stale mailbox intercepted three
+            // deliveries in a row and recorded each `pending`, while the session had a
+            // perfectly good resume id and could have been woken headlessly the whole
+            // time. A dead rung was shadowing a working one.
+            //
+            // ENXIO is the only trustworthy evidence available here, and what it
+            // proves is exactly "no live session is waiting" — which is the condition
+            // the rung below exists for. So we take it.
+            this.log(`mailbox for ${session} has no reader (${written.reason}) — falling through to headless`);
+            this.mailboxes.delete(session);
+            this.registry.setAttached(session, false);
+        }
         const resolved = await this.resolveResume(target);
         const check = adapter.canResume(resolved);
         if (!check.ok) {
@@ -215,13 +381,75 @@ class RelayDaemon {
             this.record({ kind: "pending", session, reason }, session, batch);
             return;
         }
-        const prompt = (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch);
+        // The daemon knows both absolute paths because it IS them — and a session it
+        // resumes inherits ITS environment, where neither `node` nor `baychat` is on
+        // PATH. Without this the woken session is told to re-arm with a command it
+        // cannot run, answers once, and goes quiet.
+        const prompt = (0, adapters_1.buildWakePrompt)(session, batch[0].conversationId, batch, {
+            node: process.execPath,
+            cli: process.argv[1] ?? "",
+            runtime: target.runtime,
+            // A session that last armed over a mailbox is sandboxed, and a sandboxed
+            // session cannot background its re-arm. Telling it to would hand it an
+            // instruction that silently does nothing.
+            transport: target.transport,
+        });
         const { file, args } = adapter.headlessCommand(resolved, prompt);
+        // An ABSOLUTE path came from `SessionTarget.runtimeBin` — recorded by
+        // `attach`, inside the session, because the binary a session was launched
+        // with is knowable there and nowhere else. Re-resolving it against the
+        // daemon's PATH is precisely the guess that rule exists to forbid, and
+        // doing so broke a live session: the path ended in `claude.exe`, PATH
+        // resolution was asked for a file of that name, and every wake died with
+        // "not found on PATH".
+        //
+        // A BARE NAME has no such provenance, and is where PATH gets it wrong —
+        // a Windows shim ahead of the real binary under WSL. That one is resolved.
+        let executable = file;
+        if (!path.isAbsolute(file)) {
+            const binary = this.binaryFor(file);
+            if (!binary.ok) {
+                this.record({ kind: "pending", session, reason: (0, runtime_binary_1.summarizeResolutionFailure)(binary) }, session, batch);
+                return;
+            }
+            executable = binary.path;
+        }
+        // A runtime with a richer transport than "spawn a command" gets to use it.
+        // Only a transport that could not be used AT ALL falls through to the spawn:
+        // a failure that is a real answer about this session — an id that names no
+        // thread, a turn the runtime refused — would say exactly the same thing
+        // again down the older path, more slowly and less clearly.
+        const richTransport = this.runTurn
+            ? (input) => this.runTurn({ runtime: target.runtime, ...input })
+            : adapter.runTurn?.bind(adapter);
+        if (richTransport) {
+            const outcome = await richTransport({ binaryPath: executable, target: resolved, prompt });
+            if (outcome.kind === "completed") {
+                this.record({ kind: "woken", via: "headless", session, exitCode: 0 }, session, batch);
+                return;
+            }
+            if (!outcome.transportUnusable) {
+                this.record({ kind: "pending", session, reason: outcome.reason }, session, batch);
+                return;
+            }
+            this.log(`${target.runtime}: falling back to a plain spawn — ${outcome.reason}`);
+        }
+        // A Windows .cmd needs its interpreter named explicitly, whatever produced
+        // the path — resolution or the session's own runtimeBin — so the decision
+        // lives here, after both, rather than inside either. Never a shell: these
+        // args carry the wake prompt, and therefore other people's message text.
+        const plan = (0, runtime_binary_1.spawnPlanFor)(executable, process.platform);
         // The session's own directory when we know it: `cwd` is only where the
         // attach process ran, and `codex exec` refuses to start outside a trusted
         // directory at all.
-        const { exitCode, stderr } = await this.spawnHeadless(file, args, { cwd: resolved.resumeCwd ?? resolved.cwd });
+        const { exitCode, stderr } = await this.spawnHeadless(plan.file, [...plan.prefixArgs, ...args], {
+            cwd: resolved.resumeCwd ?? resolved.cwd,
+        });
         if (exitCode !== 0) {
+            // The binary ran and the turn still failed, so what we resolved may be
+            // stale — a half-finished upgrade, a runtime removed since. Drop it and
+            // prove it again next time rather than trusting it for the process's life.
+            this.binaries.delete(file);
             // A non-zero headless turn did not necessarily reply. Recording it as
             // delivered would claim an answer we cannot evidence.
             this.record({ kind: "pending", session, reason: `headless ${target.runtime} exited ${exitCode}: ${stderr.slice(0, 200)}` }, session, batch);
@@ -229,6 +457,21 @@ class RelayDaemon {
         }
         this.record({ kind: "woken", via: "headless", session, exitCode }, session, batch);
     }
+    /**
+     * The proven executable for a runtime, resolved at most once per process
+     * until something gives us reason to doubt it.
+     */
+    binaryFor(name) {
+        const known = this.binaries.get(name);
+        if (known)
+            return known;
+        const resolved = this.resolveBinary(name);
+        this.binaries.set(name, resolved);
+        this.log(resolved.ok
+            ? `${name} resolved to ${resolved.path} (${resolved.version})`
+            : `${name} unresolved: ${(0, runtime_binary_1.summarizeResolutionFailure)(resolved)}`);
+        return resolved;
+    }
     /**
      * Fill in a missing resume id from the runtime's on-disk state, at most once
      * every `DISCOVERY_INTERVAL_MS` per session.
@@ -309,6 +552,16 @@ class RelayDaemon {
                 // for it, so drop the throttle and let the next wake use the new id.
                 if (frame.resumeId)
                     this.discoveryReasons.delete(frame.session);
+                // EVICT THE PREVIOUS HOLDER. A session name has exactly one listener,
+                // and `set` alone would leave the old socket open and its process
+                // running — which is how two orphaned attaches came to be stacked on
+                // one name on 2026-08-30, each one a place a wake could vanish into.
+                // Destroying it makes the displaced attach exit instead of lingering.
+                const previous = this.attached.get(frame.session);
+                if (previous && previous !== sock) {
+                    this.log(`replacing attach for ${frame.session}: dropping the previous one`);
+                    previous.destroy();
+                }
                 this.attached.set(frame.session, sock);
                 this.registry.setAttached(frame.session, true);
                 (0, socket_1.writeFrame)(sock, { type: "attached", session: frame.session });
@@ -340,7 +593,8 @@ class RelayDaemon {
     status() {
         const sessions = this.registry.all().map((t) => ({
             ...t,
-            attached: this.attached.has(t.name),
+            attached: this.attached.has(t.name) || this.mailboxes.has(t.name),
+            transport: this.attached.has(t.name) ? "socket" : this.mailboxes.has(t.name) ? "fifo" : undefined,
         }));
         return {
             running: true,
@@ -362,6 +616,8 @@ class RelayDaemon {
             sock.destroy();
         this.attached.clear();
         await this.queue.idle();
+        for (const w of this.mailboxWatchers)
+            w.stop();
         await new Promise((resolve) => (this.server ? this.server.close(() => resolve()) : resolve()));
         (0, socket_1.unlinkStaleSocket)((0, socket_1.socketPath)());
         try {

package/dist/relay/mailbox-watcher.js

@@ -0,0 +1,118 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MailboxWatcher = void 0;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const mailbox_1 = require("./mailbox");
+const parent_watch_1 = require("./parent-watch");
+/**
+ * Watch the mailbox root for sessions arming and dying.
+ *
+ * `fs.watch` AND a periodic sweep, not one or the other. `fs.watch` gives
+ * instant pickup but is unreliable across filesystems — notably a tmpfs
+ * directory the agent created moments earlier — and a sweep alone would add
+ * seconds to every arming. The sweep is also the only thing that can notice a
+ * registration whose process has since died, because nothing on disk changes
+ * when a process exits and there is no event to watch for.
+ */
+class MailboxWatcher {
+    opts;
+    seen = new Map();
+    isAlive;
+    sweepMs;
+    watcher;
+    timer;
+    constructor(opts) {
+        this.opts = opts;
+        this.isAlive = opts.isAlive ?? parent_watch_1.processIsAlive;
+        this.sweepMs = opts.sweepMs ?? 2_000;
+    }
+    start() {
+        fs.mkdirSync(this.opts.root, { recursive: true, mode: 0o700 });
+        try {
+            this.watcher = fs.watch(this.opts.root, { recursive: true }, () => this.sweep());
+        }
+        catch {
+            // Not every platform or filesystem supports recursive watching. The sweep
+            // below is the floor, so this degrades to slower pickup, never to none.
+        }
+        this.timer = setInterval(() => this.sweep(), this.sweepMs);
+        this.timer.unref();
+        this.sweep();
+    }
+    stop() {
+        this.watcher?.close();
+        if (this.timer)
+            clearInterval(this.timer);
+    }
+    sweep() {
+        let entries;
+        try {
+            entries = fs.readdirSync(this.opts.root, { withFileTypes: true });
+        }
+        catch {
+            return; // No root yet: nothing has armed. Not a fault.
+        }
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const dir = path.join(this.opts.root, entry.name);
+            const reg = (0, mailbox_1.readRegistration)(dir);
+            if (!reg)
+                continue;
+            if (!this.isAlive(reg.pid)) {
+                this.seen.delete(reg.session);
+                fs.rmSync(dir, { recursive: true, force: true });
+                this.opts.onDrop(reg.session, `mailbox process ${reg.pid} is no longer running`);
+                continue;
+            }
+            // Identity is the registration's CONTENT, not its timestamp.
+            //
+            // `registeredAt` has millisecond resolution, so two armings inside one
+            // millisecond share a timestamp — which in a test is a flake and in
+            // production is a re-arm that goes unannounced. Hashing the content is
+            // exact: anything the daemon would act on differently is a different hash,
+            // and a byte-identical rewrite is one the daemon already has right.
+            const stamp = crypto.createHash("sha256").update(JSON.stringify(reg)).digest("hex");
+            if (this.seen.get(reg.session) === stamp)
+                continue;
+            this.seen.set(reg.session, stamp);
+            this.opts.onRegister(reg);
+        }
+    }
+}
+exports.MailboxWatcher = MailboxWatcher;