baychat 0.14.0 → 0.16.0

package/dist/relay/mailbox.js

@@ -185,6 +185,7 @@ function registrationToTarget(reg) {
         resumeCwd: reg.resumeCwd,
         cwd: reg.cwd,
         runtimeBin: reg.runtimeBin,
+        ownerPid: reg.ownerPid,
         // Persisted, so a LATER headless resume still knows this session is
         // sandboxed and must be told to re-arm in the foreground. `status()`
         // recomputes the live rung for display; this is the remembered one.

package/dist/relay/owner-pid.js

@@ -0,0 +1,169 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.procTable = void 0;
+exports.ownerPidFor = ownerPidFor;
+exports.isRuntimeCommand = isRuntimeCommand;
+exports.currentOwnerPid = currentOwnerPid;
+exports.detectRuntime = detectRuntime;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** How far to walk before giving up. Deep enough for shell wrappers, bounded so a cycle cannot hang an attach. */
+const MAX_HOPS = 12;
+/**
+ * The nearest ancestor that IS this runtime, or undefined when none is found.
+ *
+ * Undefined rather than a fallback to `ppid` on purpose: a witness that lies is
+ * worse than no witness. With none, the daemon keeps its previous behaviour and
+ * may spawn headlessly — the old bug. With a wrong one it spawns headlessly
+ * while the session is alive — the worse bug, and a silent one.
+ */
+function ownerPidFor(runtime, startPid, table) {
+    let pid = startPid;
+    const seen = new Set();
+    for (let hop = 0; hop < MAX_HOPS; hop++) {
+        if (pid <= 1 || seen.has(pid))
+            return undefined;
+        seen.add(pid);
+        if (isRuntimeCommand(table.commandOf(pid), runtime))
+            return pid;
+        const parent = table.parentOf(pid);
+        if (parent === undefined)
+            return undefined;
+        pid = parent;
+    }
+    return undefined;
+}
+/**
+ * Whether a command line IS the runtime, rather than merely mentioning it.
+ *
+ * Only the first two tokens are considered — the executable, and the script when
+ * that executable is an interpreter. The attach process itself runs
+ * `node …/baychat relay attach --runtime claude`, which CONTAINS "claude" as an
+ * argument; matching anywhere on the line would make every attach its own owner
+ * and defeat the check entirely.
+ */
+function isRuntimeCommand(command, runtime) {
+    if (!command)
+        return false;
+    const tokens = command.trim().split(/\s+/).filter(Boolean);
+    if (tokens.length === 0)
+        return false;
+    if (namesRuntime(tokens[0], runtime))
+        return true;
+    // An interpreter's SCRIPT is the real executable: `node …/codex/bin/codex.js`
+    // is Codex. Only consulted behind an interpreter, and only for something that
+    // looks like a path — otherwise `grep claude syslog` would match its own
+    // search term, and every attach would match its own `--runtime claude`.
+    if (!INTERPRETERS.has(path.basename(tokens[0]).toLowerCase()))
+        return false;
+    const script = tokens[1];
+    if (!script || !/[\\/]/.test(script))
+        return false;
+    return namesRuntime(script, runtime);
+}
+const INTERPRETERS = new Set(["node", "node.exe", "bun", "deno", "python", "python3"]);
+/** `claude`, `claude.exe`, `codex.js` — the runtime's binary, however spelled. Not `claudette`. */
+function namesRuntime(token, runtime) {
+    const base = path.basename(token).toLowerCase();
+    return base === runtime || base.startsWith(`${runtime}.`);
+}
+/** Reads the live process tree from /proc. Returns nothing where /proc is absent (macOS, Windows). */
+exports.procTable = {
+    parentOf(pid) {
+        try {
+            // Field 4 of /proc/<pid>/stat is ppid. Read past the comm field, which is
+            // parenthesised and may itself contain spaces.
+            const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf8");
+            const after = stat.slice(stat.lastIndexOf(")") + 1).trim().split(/\s+/);
+            const ppid = Number(after[1]);
+            return Number.isFinite(ppid) ? ppid : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    },
+    commandOf(pid) {
+        try {
+            return fs.readFileSync(`/proc/${pid}/cmdline`, "utf8").replace(/\0/g, " ").trim() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    },
+};
+/** The owning runtime process for THIS attach, read from the live tree. */
+function currentOwnerPid(runtime) {
+    return ownerPidFor(runtime, process.ppid, exports.procTable);
+}
+/**
+ * Which agent are we running INSIDE?
+ *
+ * Asked of the process tree rather than the environment, and that choice is the
+ * whole point. Guessing environment-variable names for a dozen agents would put
+ * a claim in the code for every one of them, and a variable that does not expand
+ * produces a confident wrong answer — the failure this codebase keeps meeting.
+ * An ancestor process named `gemini` is not a guess; it is the agent, observed.
+ *
+ * Reuses the same walk and the same "IS the runtime, not merely mentions it"
+ * test as `ownerPidFor`, so a `--runtime kimi` argument on our own command line
+ * cannot make us detect ourselves.
+ *
+ * Returns undefined freely. Undetected is a fine outcome — the user can say
+ * `--runtime <name>`, and an unnamed runtime is still served at Level 1. A wrong
+ * detection would be far worse: it would attach the session to another agent's
+ * resume rules.
+ */
+function detectRuntime(candidates, startPid = process.ppid, table = exports.procTable) {
+    let pid = startPid;
+    const seen = new Set();
+    for (let hop = 0; hop < MAX_HOPS; hop++) {
+        if (pid <= 1 || seen.has(pid))
+            return undefined;
+        seen.add(pid);
+        const command = table.commandOf(pid);
+        // NEAREST ancestor wins. An agent launched from inside another agent should
+        // resolve to the one actually running this session, not the outer shell's.
+        for (const candidate of candidates) {
+            if (isRuntimeCommand(command, candidate.bin))
+                return candidate.id;
+        }
+        const parent = table.parentOf(pid);
+        if (parent === undefined)
+            return undefined;
+        pid = parent;
+    }
+    return undefined;
+}

package/dist/relay/profiles.js

@@ -0,0 +1,210 @@
+"use strict";
+/**
+ * Built-in knowledge of agent runtimes we did not write an adapter for.
+ *
+ * The point of this file is that **a person connecting a new agent should not
+ * have to write anything.** They cannot be expected to know what a resume flag
+ * is, and asking them to describe their own agent in a config file is the same
+ * demand wearing a friendlier hat. So the knowledge lives here, shipped, and
+ * the CLI recognises the agent it is running inside.
+ *
+ * What the research found (2026-08-31, sources on each entry): the SHAPE is
+ * universal and only the spelling differs. Almost every serious agent CLI has a
+ * run-without-a-UI flag and a resume-a-session flag. So a runtime is DATA — a
+ * binary name and an argv template — not a program. That is why adding one here
+ * is a table row rather than an adapter.
+ *
+ * ## Two levels, and most agents only reach the first
+ *
+ * - **Level 1** — reachable while its `relay attach` is running. Needs nothing
+ *   from the agent but the ability to run a command and wait. Every profile here
+ *   gets this, including ones with no entry at all.
+ * - **Level 2** — reachable when nothing is listening, by resuming the session.
+ *   Needs BOTH a `headless` template AND a way to know the session's id.
+ *
+ * ## The rule this file must not break
+ *
+ * **Never advertise something we have not confirmed.** A profile claiming an
+ * environment variable that does not expand produces an attach that records
+ * nothing and looks exactly like success — the failure mode this codebase has
+ * been bitten by more than once. So `sessionId` is `flag-only` unless the
+ * variable is known to exist, and `headless` is omitted entirely where the
+ * vendor's resume path is unconfirmed or known broken. An entry that offers
+ * less than the agent can do costs a little reach; one that offers more costs
+ * silence, which is far worse.
+ *
+ * `confidence` says which of those two we are on. Only `claude` and `codex` are
+ * `run`; everything else is `docs` — read from the vendor, never executed here.
+ * See `docs/features/RUNTIME_COMPATIBILITY.md`, which is generated from the same
+ * research and carries the same dates.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNTIME_PROFILES = exports.BUILTIN_RUNTIMES = void 0;
+exports.profileFor = profileFor;
+exports.reachesLevel2 = reachesLevel2;
+exports.fillTemplate = fillTemplate;
+/**
+ * Runtimes with a hand-written adapter in `adapters.ts`. Not in this table —
+ * they do more than a template can express (Codex's app-server and queue,
+ * Claude's transcript discovery).
+ */
+exports.BUILTIN_RUNTIMES = ["claude", "codex", "cursor", "hermes"];
+exports.RUNTIME_PROFILES = [
+    {
+        id: "gemini",
+        label: "Gemini CLI",
+        bin: "gemini",
+        sessionId: {
+            kind: "flag-only",
+            how: "`gemini --list-sessions` prints them; sessions live under ~/.gemini/tmp/<project-hash>/chats/. Exposing the id to a running session is an open request (google-gemini/gemini-cli#14435).",
+        },
+        headless: { args: ["-r", "{id}", "{prompt}"] },
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://github.com/google-gemini/gemini-cli/blob/main/docs/cli/session-management.md",
+    },
+    {
+        id: "copilot",
+        label: "GitHub Copilot CLI",
+        bin: "copilot",
+        sessionId: {
+            kind: "flag-only",
+            how: "The id is printed after a non-interactive run, and `/session` shows it interactively. Exposing it to the session itself is an open request (github/copilot-cli#895, #807).",
+        },
+        // NOTE: deliberately WITHOUT `--allow-all-tools`. That flag hands an agent
+        // every tool unattended, and a chat message must never be the thing that
+        // grants a privilege. If a user wants it, that is their decision to make in
+        // their own configuration, not one this table makes silently on their behalf.
+        headless: { args: ["-p", "{prompt}", "--resume", "{id}"] },
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://docs.github.com/en/copilot/how-tos/copilot-sdk/features/session-persistence",
+    },
+    {
+        id: "goose",
+        label: "Goose",
+        bin: "goose",
+        // The whole reason Goose is the best Level 2 candidate here: the handle is
+        // a name the human picked, and BayChat already asked for one.
+        sessionId: { kind: "session-name" },
+        headless: { args: ["run", "--resume", "--name", "{id}", "-t", "{prompt}"] },
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://goose-docs.ai/docs/guides/goose-cli-commands/",
+    },
+    {
+        id: "kimi",
+        label: "Kimi Code CLI",
+        bin: "kimi",
+        sessionId: {
+            kind: "flag-only",
+            how: "Ids exist — `kimi export <session_id>` takes one, and the CLI prints a resume hint when a session exits — but whether a running session can read its own is not documented.",
+        },
+        headless: { args: ["-p", "{prompt}", "--resume", "{id}"] },
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://moonshotai.github.io/kimi-cli/en/reference/kimi-command.html",
+    },
+    {
+        id: "opencode",
+        label: "OpenCode",
+        bin: "opencode",
+        sessionId: { kind: "flag-only", how: "Ids are accepted by `--session`; how a session reads its own is not documented." },
+        headless: { args: ["--session", "{id}", "--prompt", "{prompt}"] },
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://open-code.ai/en/docs/cli",
+    },
+    {
+        id: "qwen",
+        label: "Qwen Code",
+        bin: "qwen",
+        // Gate 1 solved unusually well — by asking the CLI rather than the session.
+        // Gate 2 is the missing half: `/resume` is documented as an IN-SESSION slash
+        // command, and a slash command cannot be typed by a daemon.
+        sessionId: { kind: "flag-only", how: "`qwen sessions list --json` and `qwen sessions ps --json` expose `sessionId`." },
+        noHeadlessReason: "resume is documented as the in-session `/resume` command, not a startup flag — so there is no confirmed way to continue a specific session non-interactively",
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://qwenlm.github.io/qwen-code-docs/en/users/features/commands/",
+    },
+    {
+        id: "codebuddy",
+        label: "CodeBuddy (Tencent Cloud)",
+        bin: "codebuddy",
+        sessionId: { kind: "flag-only", how: "`codebuddy -r <session-id>` accepts one; how a session reads its own is not documented." },
+        noHeadlessReason: "`-r <session-id>` resumes interactively; no non-interactive prompt flag is documented alongside it, so a wake would open a UI nobody is watching",
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://www.codebuddy.ai/docs/cli/reference",
+    },
+    {
+        id: "iflow",
+        label: "iFlow CLI",
+        bin: "iflow",
+        sessionId: { kind: "flag-only", how: "`iflow --resume` browses them interactively." },
+        // Documented, and broken in exactly the mode we would use. This entry is
+        // why the compatibility table carries dates: without one it would read as
+        // supported.
+        noHeadlessReason: "`-r <session_id>` HANGS in headless mode — it drops into interactive and waits for input forever, even with `-y` (iflow-ai/iflow-cli#196). `-c` resumes only the previous session, which is not an identification.",
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://github.com/iflow-ai/iflow-cli/issues/196",
+    },
+    {
+        id: "trae",
+        label: "Trae Agent (ByteDance)",
+        bin: "trae-cli",
+        sessionId: { kind: "flag-only", how: "Trajectories are recorded per run; a resumable session id is not documented." },
+        noHeadlessReason: "a headless interface is on the project's roadmap and has not shipped",
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://github.com/bytedance/trae-agent/blob/main/docs/roadmap.md",
+    },
+    {
+        id: "aider",
+        label: "Aider",
+        bin: "aider",
+        sessionId: { kind: "flag-only", how: "Aider has no session ids at all." },
+        noHeadlessReason: "`--restore-chat-history` restores THE history for a repository, not a chosen session — so there is nothing to identify and nothing to resume",
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://aider.chat/docs/config/options.html",
+    },
+    {
+        id: "pi",
+        label: "Pi",
+        bin: "pi",
+        // Pi documents PI_SESSION_ID as injected into the bash tool it calls, which
+        // is precisely the self-identification shape. Still `docs`, not `run`.
+        sessionId: { kind: "env", variable: "PI_SESSION_ID" },
+        noHeadlessReason: "Pi exposes its session id, but a non-interactive resume command is not documented — half of Level 2, honestly reported",
+        confidence: "docs",
+        checked: "2026-08-31",
+        source: "https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/environment-variables.md",
+    },
+];
+function profileFor(id) {
+    return exports.RUNTIME_PROFILES.find((p) => p.id === id);
+}
+/** Can this profile be woken when nothing is listening? */
+function reachesLevel2(profile) {
+    return profile.headless !== undefined;
+}
+/**
+ * Fill a headless template.
+ *
+ * Substitutes whole argv entries rather than doing string interpolation: an
+ * argument is either exactly `{prompt}` and becomes the prompt, or it is passed
+ * through untouched. A prompt containing quotes, newlines or `$(…)` is
+ * therefore inert — it is one argv element, never part of a command line.
+ */
+function fillTemplate(args, values) {
+    return args.map((arg) => {
+        if (arg === "{id}")
+            return values.id;
+        if (arg === "{prompt}")
+            return values.prompt;
+        return arg;
+    });
+}

package/dist/relay/provider-env.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * A session pointed at somebody else's model provider, and what the daemon can
+ * honestly do about it.
+ *
+ * ## The problem
+ *
+ * People run Claude Code against GLM, Kimi, DeepSeek and others by setting two
+ * variables in their own shell: a base URL and a credential. Those live in
+ * THAT terminal. The relay daemon is a background service with a different
+ * environment entirely — the same fact that made a headless wake die on
+ * `spawn claude ENOENT` in August, arriving again by a new door.
+ *
+ * While the session is attached this never shows: the message is handed to a
+ * process that already has its own settings. It only bites on a headless wake,
+ * where the daemon STARTS the agent and it comes up pointed at the default
+ * provider — failing, or worse, quietly answering from an account the person
+ * did not intend to spend.
+ *
+ * ## Why we do not fix it by carrying the settings over
+ *
+ * The obvious fix is to record them at attach time, the way `runtimeBin` and
+ * the resume id already are. One of the two is an **API key**, and Karmen's
+ * call on 2026-09-01 was that writing somebody's key into a file is a security
+ * cost not worth the convenience — a judgement this module exists to enforce
+ * rather than re-argue.
+ *
+ * So we record the BASE URL, which is a public endpoint and not a secret, and
+ * we never record a credential. What that buys is not automation but HONESTY:
+ * the daemon can see that a session had an override, notice that it has no
+ * credential of its own to start that agent with, and refuse with an
+ * instruction — instead of spawning something destined to fail and filing it as
+ * a delivery.
+ *
+ * ⚠️ Nothing here may ever return, log, or persist a value read from a
+ * credential variable. `provider-env.test.ts` pins that.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_KEY_VARS = exports.PROVIDER_URL_VARS = void 0;
+exports.providerOverrideFrom = providerOverrideFrom;
+exports.daemonHasProviderCredential = daemonHasProviderCredential;
+exports.providerConfiguredOnDisk = providerConfiguredOnDisk;
+exports.providerWakeBlocker = providerWakeBlocker;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/** Base-URL variables. Public endpoints — safe to record and to print. */
+exports.PROVIDER_URL_VARS = [
+    "ANTHROPIC_BASE_URL",
+    "ANTHROPIC_API_URL",
+    "OPENAI_BASE_URL",
+    "OPENAI_API_BASE",
+];
+/**
+ * Credential variables. Their NAMES are used; their VALUES are never read.
+ *
+ * Kept as a list rather than a pattern so that adding a provider is a
+ * deliberate edit — a regex like /KEY|TOKEN/ would silently start matching
+ * variables nobody has thought about.
+ */
+exports.PROVIDER_KEY_VARS = [
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+];
+/**
+ * Is this session pointed somewhere other than its runtime's default?
+ *
+ * Reads only URL variables. A session with a key set but no base URL is using
+ * its runtime's normal provider with its own account, which is not an override
+ * and needs nothing from us.
+ */
+function providerOverrideFrom(env) {
+    for (const variable of exports.PROVIDER_URL_VARS) {
+        const url = env[variable];
+        if (url && url.trim())
+            return { variable, url: url.trim() };
+    }
+    return undefined;
+}
+/** Does the DAEMON hold a credential it could start such an agent with? */
+function daemonHasProviderCredential(env) {
+    return exports.PROVIDER_KEY_VARS.some((v) => Boolean(env[v]?.trim()));
+}
+/**
+ * Has the RUNTIME been configured on disk, where a spawned copy will find it?
+ *
+ * This is the question that makes ordinary Claude Code work at all: its login
+ * lives in `~/.claude/.credentials.json`, so a `claude` the daemon starts reads
+ * the same file and needs nothing handed to it. Environment variables are the
+ * opposite — they exist only in the shell they were typed into.
+ *
+ * Claude Code reads an `env` block from `~/.claude/settings.json` too, so a
+ * person can configure another provider THERE instead of in their shell. That
+ * configuration survives a spawn exactly like the credential does, and refusing
+ * such a wake would decline one that was going to work.
+ *
+ * Which is the rule this function exists to honour: **unknown must not cost a
+ * live session its delivery — only a definite "no" declines.** Where we cannot
+ * read a runtime's configuration we return `undefined`, and the caller must
+ * treat that as "let it try", never as "no".
+ */
+function providerConfiguredOnDisk(runtime, variable, readFile = (p) => fs.readFileSync(p, "utf8"), home = os.homedir()) {
+    // Only Claude Code's settings file is documented and stable enough to read.
+    // Every other runtime is genuinely unknown, and says so.
+    if (runtime !== "claude")
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFile(path.join(home, ".claude", "settings.json")));
+        const env = parsed?.env;
+        if (!env || typeof env !== "object")
+            return false;
+        return Boolean(env[variable]?.trim());
+    }
+    catch {
+        // No file, or unreadable. "No file" is a definite no for THIS mechanism, but
+        // a parse failure is not — and distinguishing them costs more than it buys,
+        // so both come back as unknown and the wake is attempted.
+        return undefined;
+    }
+}
+/**
+ * Why a headless wake would fail for this session, and exactly what to do — or
+ * undefined when it would be fine.
+ *
+ * Said as a `pending` reason rather than discovered from a failed turn, because
+ * a wake that dies inside a spawned process leaves a person with nothing to
+ * read. The whole point of refusing here is that the refusal can carry the fix.
+ */
+function providerWakeBlocker(target, daemonEnv, onDisk = providerConfiguredOnDisk) {
+    if (!target.providerVar)
+        return undefined;
+    if (daemonHasProviderCredential(daemonEnv))
+        return undefined;
+    // The runtime may already be configured where a spawned copy will find it —
+    // which is exactly how ordinary Claude Code works without anyone handing it
+    // anything. `undefined` means we could not tell, and NOT being able to tell
+    // must not cost a delivery.
+    if (target.runtime && onDisk(target.runtime, target.providerVar) !== false)
+        return undefined;
+    return (`this session runs against ${target.providerUrl ?? "a custom provider"} (${target.providerVar}), ` +
+        `and the relay has no credential of its own to start it with — so a headless wake would come up ` +
+        `on the DEFAULT provider instead of yours. Your key is deliberately not stored by BayChat. ` +
+        `Add it to the relay service once (systemd: \`systemctl --user edit baychat-relay\`, then ` +
+        `\`[Service]\` / \`Environment=${exports.PROVIDER_KEY_VARS[0]}=...\` and \`Environment=${target.providerVar}=${target.providerUrl ?? "..."}\`), ` +
+        `or keep this session attached, where it is reached without being restarted.`);
+}

package/dist/relay/registry.js

@@ -121,6 +121,17 @@ class SessionRegistry {
         if (t)
             t.attached = attached;
     }
+    /**
+     * Record that a delivery to this session actually landed.
+     *
+     * Separate from `setAttached` because it means something stronger: attached is
+     * a state that can be claimed, this is an event that was observed.
+     */
+    markDelivered(name, at) {
+        const t = this.sessions.get(name);
+        if (t)
+            t.lastDeliveredAt = at;
+    }
     /**
      * Drop targets whose session is no longer live server-side.
      *

package/dist/relay/socket.js

@@ -39,6 +39,7 @@ exports.isNamedPipe = isNamedPipe;
 exports.pidFilePath = pidFilePath;
 exports.createFrameReader = createFrameReader;
 exports.writeFrame = writeFrame;
+exports.writeFrameAck = writeFrameAck;
 exports.probeSocketDetailed = probeSocketDetailed;
 exports.probeSocket = probeSocket;
 exports.describeProbeFailure = describeProbeFailure;
@@ -156,6 +157,53 @@ function createFrameReader(onFrame, onBad) {
 function writeFrame(sock, frame) {
     sock.write(JSON.stringify(frame) + "\n");
 }
+/**
+ * Write a frame and WAIT for the socket to take it, surfacing the failure if it
+ * does not.
+ *
+ * `writeFrame` is fire-and-forget. `sock.write()` buffers and returns, so a peer
+ * that has already gone produces an EPIPE on the socket's `error` event LATER —
+ * by which time the caller has recorded `woken`. That is a lost message filed as
+ * delivered, which is the single outcome `relay status` exists to make
+ * impossible: every other failure is at least visible as pending.
+ *
+ * Three ways this settles, and all three are needed. The write callback covers
+ * the ordinary case; the `error` event covers an EPIPE that arrives without one;
+ * `close` covers a peer that vanishes while the bytes are still buffered, which
+ * reports no error at all.
+ *
+ * HONEST LIMIT — this is a FLUSH confirmation, not a receiver acknowledgement.
+ * It proves the bytes left this process, not that the agent read them. A true
+ * end-to-end ack needs an `ack` frame back from the attach client, and every
+ * already-installed client would have to be taught to send one before the
+ * daemon could require it. What this closes is the failure that was actually
+ * observed — a dead peer recorded as woken — not the whole class.
+ */
+function writeFrameAck(sock, frame) {
+    return new Promise((resolve, reject) => {
+        if (sock.destroyed || sock.writableEnded) {
+            reject(new Error("the attach socket is already closed"));
+            return;
+        }
+        let settled = false;
+        const settle = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            sock.off("error", onError);
+            sock.off("close", onClose);
+            if (err)
+                reject(err);
+            else
+                resolve();
+        };
+        const onError = (err) => settle(err);
+        const onClose = () => settle(new Error("the attach socket closed before the frame was flushed"));
+        sock.once("error", onError);
+        sock.once("close", onClose);
+        sock.write(JSON.stringify(frame) + "\n", (err) => settle(err ?? undefined));
+    });
+}
 /**
  * Probe the attach endpoint, KEEPING THE REASON IT FAILED.
  *

package/dist/runtime-binary.js

@@ -173,6 +173,20 @@ function joinPath(dir, file, platform) {
  * @returns file + prefix args to spawn it with, always `shell: false`
  */
 function spawnPlanFor(candidate, platform) {
+    // A SCRIPT NEEDS ITS INTERPRETER, on every platform.
+    //
+    // The managed Codex fallback records `<CODEX_MANAGED_PACKAGE_ROOT>/bin/codex.js`
+    // — the file the npm install is actually running — and a `.js` cannot be
+    // spawned directly. On Unix that needs a shebang AND the execute bit, neither
+    // of which an npm package guarantees; on Windows there is no execute bit at
+    // all, and only `.cmd`/`.bat` were wrapped. So the recorded path was one the
+    // daemon could not run, which is the 2026-08-30 ENOENT failure in a new place.
+    //
+    // `process.execPath` is the Node running this CLI. Deliberately NOT a bare
+    // "node": the daemon's PATH may not have one — that is the whole reason
+    // `runtimeBin` is recorded by the session in the first place.
+    if (/\.(mjs|cjs|js)$/i.test(candidate))
+        return { file: process.execPath, prefixArgs: [candidate] };
     const needsInterpreter = platform === "win32" && /\.(cmd|bat)$/i.test(candidate);
     if (!needsInterpreter)
         return { file: candidate, prefixArgs: [] };