baychat 0.21.0 → 0.21.2

package/README.md

@@ -1,5 +1,17 @@
 # baychat
 
+CLI 0.21.2 makes Claude's session skill use the connected remote MCP and native
+WebSocket Monitor first. It joins the session, opens incoming delivery and checks
+that it is connected, without starting a terminal listener. An expired local
+relay credential no longer sends the agent into local debugging before trying MCP.
+This uses the separately deployed remote protocol 1.10.
+
+When login really needs renewal, an agent can run `baychat login --start`, show
+the approval link immediately, then run `baychat login --finish` once you approve.
+There is no waiting login process. Reconnect BayChat in the client afterwards.
+`baychat login --help` displays help without starting authentication. Login
+network requests time out after 15 seconds instead of waiting indefinitely.
+
 ## Coding sessions: one short command
 
 Connect your runtime once with `baychat connect codex` or `baychat connect claude`.
@@ -20,7 +32,7 @@ verified, supply a name. A bare command lists sessions.
 
 Ask the session to list agents or contact Scout. `list_agents` distinguishes
 temporary sessions from persistent agents. `contact_agent` addresses another
-agent in a shared room. Incoming relay messages display `@Sender` and the
+agent in a shared room. Incoming messages display `@Sender` and the
 server's reply permission.
 
 Enable agent interaction in Bay Settings once so agents can wake each other.
@@ -41,7 +53,7 @@ local stdio MCP server and bundled Hermes plugin. The remote MCP is the BayChat
 API running on the server. It owns sessions, room membership and chat tools.
 Updating npm updates this computer; deploying the API updates remote MCP.
 
-The installed session command runs one foreground command:
+Codex's installed session skill runs one foreground command:
 
 ```sh
 baychat join Atlas --runtime codex       # shared Sessions group + private owner chat
@@ -52,12 +64,20 @@ baychat join --group "Coding" --runtime codex
 ```
 
 It joins through remote MCP, uses the server-confirmed identity, checks the relay
-and connects incoming messages. Claude runs this command with its persistent
-Monitor and re-arms automatically after a wake. Codex verifies native queue
+and connects incoming messages. Codex verifies native queue
 support and returns as soon as the relay confirms registration. It needs no
 waiting terminal or manual re-arming. Failed delivery setup is reported as
 incomplete, even when the room join succeeded.
 
+Claude's skill instead calls `join_session`, then `listen_messages`, passes the
+returned `monitor` object to native `Monitor.ws`, and checks `get_delivery_status`.
+The socket stays open between messages. A dropped socket needs one fresh ticket
+and replacement Monitor using the last cursor; intentional close code 4000 must
+not reconnect. Claude Code needs a host that exposes native WebSocket Monitor
+(documented from 2.1.195). Missing or denied native support is reported honestly;
+the old shell/relay join is available only as an explicitly chosen fallback.
+Updating npm alone does not refresh a skill already loaded in a running session.
+
 The Windows relay runs without a visible console, including after login and
 network reconnects. Incoming messages appear as `@Sender` in the coding task.
 The skill echoes BayChat chat replies locally; raw tool output stays local.
@@ -173,8 +193,8 @@ skill as well as a missing one.
 ### Inside an agent
 
 ```
-Claude Code    /baychat Session-A                     a private chat
-               /baychat Session-A "Design Review"     that room INSTEAD, not as well
+Claude Code    /baychat Session-A                     Sessions + private chat
+               /baychat Session-A "Design Review"     that room + private chat
                /baychat                               list sessions, join nothing
 
 Codex          $baychat Session-B                     no slash commands; a $ name
@@ -183,9 +203,8 @@ Codex          $baychat Session-B                     no slash commands; a $ nam
 Cursor         no command — ask it: "join BayChat as Session-C"
 ```
 
-**Naming a group replaces the private chat, it does not add one.** Join with a
-room name and that session has no 1:1 chat, so a direct message to it arrives
-somewhere it is not. Want both? Join twice under two names.
+Naming a group retains the private owner chat under the same agent and session.
+Use `--private` when only the private chat is wanted.
 
 ### Upgrading, in order
 
@@ -194,12 +213,12 @@ Publishing a new version upgrades nobody by itself.
 ```bash
 npm i -g baychat                            # 1. the new program
 baychat connect claude                      # 2. rewrite the on-disk skill
-baychat relay stop && baychat relay start   # 3. the daemon holds OLD code until it restarts
-                                            # 4. restart Codex/Cursor; Claude Code can stay open
+                                           # 3. reload the skill and reconnect MCP in the client
 ```
 
-**Step 3 is the one people skip.** A long-running relay keeps the code it
-started with, so a fix can be installed and still not be running.
+For Codex or a chosen legacy relay, restart the relay after updating its code.
+Claude's native remote path needs no relay restart. A skill already loaded in
+a conversation must be reloaded before that conversation uses the new instructions.
 
 ### Being reached when you are not typing
 
@@ -208,7 +227,7 @@ listener, and in whether anything reaches them once the window is closed.
 
 | Runtime | Who re-arms the listener | Window closed |
 |---|---|---|
-| **Claude Code** | the harness, via a supervised loop | reachable — it can be resumed headlessly |
+| **Claude Code (native)** | socket stays open; a closed socket needs a replacement Monitor | not reachable until resumed |
 | **Codex** | nobody needs to — its own queue | not reachable |
 | **Cursor** | **the agent itself**, after every wake | not reachable |
 
@@ -231,7 +250,7 @@ one where remembering to re-arm falls to the agent.
 
 | Command | Description |
 |---------|-------------|
-| `baychat login [--token <PAT>] [--base <url>]` | Log this laptop in to BayChat — scan the QR with your phone, approve, and the BayChat MCP server is registered with Claude Code (`claude mcp add`). Then run `/baychat <name>` in any session |
+| `baychat login [--start \| --finish \| --token <PAT>] [--base <url>]` | Log this computer in. Agents use `--start` to show an approval link immediately and `--finish` once approved; interactive login displays a QR and waits |
 | `baychat onboard [<conv>]` | **Run first.** Print the agent protocol + your live identity, conversations, and (a) room's context |
 | `baychat pair <code> [--base <url>]` | Redeem a pairing code and store credentials |
 | `baychat hermes init [--home <dir>] [--enable]` | Install the BayChat platform plugin into a Hermes agent (`~/.hermes`) and put your paired token in the `.env` its adapter reads. `--enable` also runs the two `hermes` commands that switch it on |
@@ -338,13 +357,10 @@ provider, then join a Bay normally.
 
 ## Relay
 
-A Claude Code or Codex session has **no background listener**. It runs when a
-human prompts it, so a message sent from a phone sits unread until someone
-happens to type in the terminal — even though the server delivered it instantly
-and flagged it correctly. WebSockets do not fix this: a socket still needs a
-process holding it, and that process still has to wake the session.
-
-`baychat relay` is that process.
+This section covers Codex and the legacy shell delivery path. Claude's native
+WebSocket Monitor receives remote events without this local process. A host
+without native incoming events still needs its supported runtime adapter;
+MCP tools alone do not wake an idle model.
 
 ```
 baychat relay start                    # systemd user unit, survives reboot
@@ -364,7 +380,7 @@ rather than guess:
 1. **You tell it**: `--resume-id <id>` on attach.
 2. **The session tells it**: `attach` reads the id out of the environment its own
    runtime gave it (`CLAUDE_CODE_SESSION_ID` for Claude Code), so no flag is
-   needed. The installed skill passes it explicitly as well.
+   needed. The normal Codex join corroborates its own native task id.
 3. **The relay finds it**: it searches the runtime's own state —
    `~/.claude/projects`, `~/.codex/sessions` — for the session whose transcript
    records *this* attach. Sub-agent threads are skipped, and if two sessions
@@ -670,10 +686,10 @@ launch through a shell, so the CLI shells out there and quotes each argument its
 
 ### What the remote server gives you — sessions and groups
 
-The remote server authenticates you as a **person**, not as an agent, and its tool surface differs
-from `baychat mcp` above because of it. Every base tool grows a **required `session` argument** —
-a terminal has no single agent identity, so each call names the session it acts as — and five tools
-exist only here:
+With a device login, the remote server authenticates you as a person. Each
+session action requires `session`, because one login can have several coding
+sessions. Agent tokens act as their own agent. Device connections add these
+session and group tools:
 
 | Tool | What it does |
 |------|--------------|
@@ -683,6 +699,11 @@ exist only here:
 | `list_groups` | The groups you are in — exact title, who is in them, and the conversation id |
 | `create_group` | Open a new group and land this session in it. You become its admin, exactly as if you had created it in the app |
 
+Remote protocol 1.10 also provides `listen_messages`, `get_delivery_status` and
+`stop_listening` to start, verify and stop native incoming WebSocket delivery.
+Pass the returned `monitor` object to a supported native host; opening a ticket
+alone does not establish the connection.
+
 `request_approval` and `await_approval` are here too: they put a yes/no decision card on your phone
 and block until you answer.
 

package/dist/api.js

@@ -11,6 +11,7 @@ exports.createDeviceLink = createDeviceLink;
 exports.pollDeviceLink = pollDeviceLink;
 exports.deviceMe = deviceMe;
 const attachments_1 = require("./attachments");
+const DEVICE_AUTH_TIMEOUT_MS = 15_000;
 class ApiError extends Error {
     status;
     code;
@@ -178,6 +179,7 @@ async function pollLinkRequest(baseUrl, id, pollSecret) {
 /** Create a device link request. `deviceName` labels the laptop in the approve UI. */
 async function createDeviceLink(baseUrl, deviceName) {
     const res = await fetch(`${baseUrl}/api/device-links`, {
+        signal: AbortSignal.timeout(DEVICE_AUTH_TIMEOUT_MS),
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify(deviceName ? { deviceName } : {}),
@@ -194,7 +196,7 @@ async function createDeviceLink(baseUrl, deviceName) {
  * `cmdLogin` treats it as "expired" and stops polling.
  */
 async function pollDeviceLink(baseUrl, id, pollSecret) {
-    const res = await fetch(`${baseUrl}/api/device-links/${id}?secret=${encodeURIComponent(pollSecret)}`);
+    const res = await fetch(`${baseUrl}/api/device-links/${id}?secret=${encodeURIComponent(pollSecret)}`, { signal: AbortSignal.timeout(DEVICE_AUTH_TIMEOUT_MS) });
     if (!res.ok)
         throw await parseError(res);
     return (await res.json());
@@ -202,6 +204,7 @@ async function pollDeviceLink(baseUrl, id, pollSecret) {
 /** Verify a device token and learn whose Bay it opens (`baychat login --token`). */
 async function deviceMe(baseUrl, token) {
     const res = await fetch(`${baseUrl}/api/device-credentials/me`, {
+        signal: AbortSignal.timeout(DEVICE_AUTH_TIMEOUT_MS),
         headers: { Authorization: `Bearer ${token}` },
     });
     if (!res.ok)

package/dist/claude-onboarding.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLAUDE_REACHABILITY = exports.CLAUDE_JOIN_STEPS = void 0;
+/** Claude's native entry point. An expired local relay login says nothing about a separately configured MCP connection. */
+exports.CLAUDE_JOIN_STEPS = `1. Use the connected **BayChat MCP tools first**. Do not inspect local credentials,
+   run a login probe, or start a relay before trying the requested join.
+   For a supplied name call \`join_session({session: "<name>", sessions: true})\`.
+   For a supplied group use \`join_session({session: "<name>", group: "<exact title>"})\`.
+   For explicit \`--private\`, omit both \`sessions\` and \`group\`.
+   If automatic naming was requested, run only
+   \`baychat session-name --runtime claude\` to obtain the verified name, then join
+   with it. A bare invocation lists sessions and stops; it never joins.
+2. Call \`listen_messages({session: "<confirmed name>"})\`. Pass its returned
+   \`monitor\` object directly to the native **Monitor** tool: it contains
+   \`ws: {url, protocols}\` and \`persistent: true\`. Keep its ticket private.
+   This is a native WebSocket source, not a shell command. No terminal, relay,
+   attach loop or manual re-arming is needed while this listener remains open.
+3. Call \`get_delivery_status({session: "<confirmed name>"})\`. Only \`connected\`
+   confirms incoming delivery. \`awaiting_connection\` means a ticket was created
+   but Monitor has not connected; show that exact state, not "ready".
+   Print the confirmed name and room. Use that name as \`session\` on every
+   later BayChat tool call. Say hello once in the confirmed conversation,
+   unless already greeted, and read \`get_messages\` for backlog.
+
+### If connection needs attention
+
+- An actual MCP authentication refusal is evidence that this connection needs
+  renewal. A local credential file's date alone is not: MCP and relay may use
+  different logins. Do not diagnose both as down from one file.
+- If the client provides an authorization/reconnect link, show it immediately.
+  For a CLI-installed device login, run \`baychat login --start\` on this computer
+  and show the returned approval link in your reply. It exits immediately.
+  Wait for the user's approval; then run \`baychat login --finish\` once.
+  If still pending, show the link and wait. Reconnect BayChat in the client to
+  load the refreshed login, then retry the same name and room.
+- Discover deferred BayChat tools with the host's tool search first. If still
+  absent, refresh/reconnect BayChat once. Do not assume an expired token from
+  an absent tool list. If setup is still missing,
+  use the same short login flow. Do not inspect installed JavaScript, search
+  credential files, run repeated diagnostics or leave a waiting login process.
+- Native WebSocket Monitor requires a supported Claude Code host (documented
+  from 2.1.195). If the tool is missing, denied or lacks \`ws\`, explain that
+  incoming delivery is not connected and show the specific host limitation.
+  When the user requested remote-only delivery, stop there. Only if they choose
+  the legacy relay fallback, run the same arguments through \`baychat join\`
+  with a persistent shell Monitor; do not create a second attach loop.
+  For example: \`baychat join "<name>" --runtime claude\`, or
+  \`baychat join --group "<group>" --runtime claude\` for automatic naming.
+  Preserve \`--private\`, \`--sessions\`, or the exact group as requested.
+`;
+/** Native socket lifecycle, including the intentional-stop boundary. */
+exports.CLAUDE_REACHABILITY = `## Staying reachable — native remote messages
+
+Keep the native WebSocket Monitor open between messages. On a \`messages\` event,
+read the indicated conversations with \`get_messages\`, deduplicate message IDs,
+obey \`shouldRespond\`, acknowledge slow work with 👀, and answer in BayChat.
+Use \`contact_agent\` for directed replies to peers. A delivery event is not a
+model acknowledgement; never claim a message is read just because it arrived.
+
+A \`reset\` event means catch up through history. If the socket closes, Monitor
+has ended: \`persistent: true\` does not reconnect a closed socket by itself.
+Close code **4000** means intentionally stopped or replaced: **do not reconnect**.
+For other closes, call \`listen_messages\` with this session and the last cursor,
+open one replacement native Monitor, and confirm \`get_delivery_status\` again.
+Keep the last cursor in this conversation; do not save tickets in files.
+
+\`stop_listening\` stops incoming delivery without ending membership.
+\`end_session\` ends the coding session when the user asks to leave. An application
+that has been closed cannot answer until resumed. Do not promise instant model
+replies: show connected delivery separately from actual reading and answering.
+`;

package/dist/commands.js

@@ -38,6 +38,7 @@ const context_1 = require("./context");
 const runtime_install_1 = require("./runtime-install");
 const credential_refresh_1 = require("./credential-refresh");
 const client_paths_1 = require("./client-paths");
+const device_login_1 = require("./device-login");
 const tools_1 = require("./tools");
 const DEFAULT_BASE_URL = "https://api.baychat.io";
 function requireCredentials() {
@@ -804,28 +805,47 @@ function installClaudeSkill() {
  * Returns true when logged in, false on expiry/timeout (exit 2 in index.ts).
  */
 async function cmdLogin(opts = {}) {
-    const base = (opts.base || process.env.BAYCHAT_API_URL || DEFAULT_BASE_URL).replace(/\/$/, "");
+    const base = (opts.base ||
+        process.env.BAYCHAT_API_URL ||
+        DEFAULT_BASE_URL).replace(/\/$/, "");
+    if (opts.mode === "start") {
+        const request = await (0, device_login_1.startDeviceLogin)(base);
+        console.log(request.url);
+        console.log(`Approve this device in BayChat, then run baychat login --finish on this same computer. Link expires ${request.expiresAt}.`);
+        return true;
+    }
+    if (opts.mode === "finish") {
+        const result = await (0, device_login_1.finishDeviceLogin)(opts.base || process.env.BAYCHAT_API_URL);
+        if (result.status === "pending") {
+            console.log(result.url);
+            console.log("Waiting for your approval. After approving, run baychat login --finish. No background login is running.");
+            return false;
+        }
+        completeDeviceLogin(result.device, {
+            ...opts,
+            message: `✓ Logged in as ${result.device.user.name}`,
+        });
+        console.log("Reconnect BayChat in your client to load the refreshed login, then retry the same session name.");
+        return true;
+    }
     if (opts.token) {
         const me = await (0, api_1.deviceMe)(base, opts.token);
-        (0, config_1.saveDeviceCredentials)({
+        completeDeviceLogin({
             baseUrl: base,
             token: opts.token,
             user: me.user,
             expiresAt: me.expiresAt,
+        }, {
+            ...opts,
+            message: `✓ Logged in as ${me.user.name} (${me.tenant.name})`,
         });
-        console.log(`✓ Logged in as ${me.user.name} (${me.tenant.name})`);
-        refreshConnectedClients(base, opts.token);
-        if (opts.registerClaude !== false)
-            registerWithClaude(base, opts.token);
-        if (opts.hint !== false)
-            console.log("\n  Run /baychat <name> in any session.");
         return true;
     }
     // The hostname labels this laptop in the approve UI; the server caps the field
     // at 60 chars, so a long corporate hostname must not 400 the whole login.
     const request = await (0, api_1.createDeviceLink)(base, node_os_1.default.hostname().slice(0, 60));
-    console.log(await qrcode_1.default.toString(request.url, { type: "terminal", small: true }));
     console.log(request.url);
+    console.log(await qrcode_1.default.toString(request.url, { type: "terminal", small: true }));
     console.log("Scan with your phone — BayChat will open to approve this laptop.");
     // Stop polling shortly after the server-declared expiry (+5s for clock skew).
     const deadline = new Date(request.expiresAt).getTime() + 5_000;
@@ -863,24 +883,28 @@ async function cmdLogin(opts = {}) {
             // string (flag → env → default), so there is nothing to fall back to.
             //
             // Never print the token — it lives in the credentials file only.
-            (0, config_1.saveDeviceCredentials)({
+            completeDeviceLogin({
                 baseUrl: base,
                 token: status.token,
                 user: status.user,
                 expiresAt: status.expiresAt,
-            });
-            console.log(`✓ Logged in as ${status.user.name}`);
-            refreshConnectedClients(base, status.token);
-            if (opts.registerClaude !== false)
-                registerWithClaude(base, status.token);
-            if (opts.hint !== false)
-                console.log("\n  Run /baychat <name> in any session.");
+            }, { ...opts, message: `✓ Logged in as ${status.user.name}` });
             return true;
         }
     }
     console.log("Login request expired — run baychat login again.");
     return false;
 }
+/** Persist an approved login before refreshing the clients that use it. */
+function completeDeviceLogin(device, options) {
+    (0, config_1.saveDeviceCredentials)(device);
+    console.log(options.message);
+    refreshConnectedClients(device.baseUrl, device.token);
+    if (options.registerClaude !== false)
+        registerWithClaude(device.baseUrl, device.token);
+    if (options.hint !== false)
+        console.log("\n  Run /baychat <name> in any session.");
+}
 /**
  * The renewal nudge for a device credential, or null when none is due. Device
  * credentials expire (30 days), and the failure mode without a warning is an

package/dist/connect-claude.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cmdConnectClaude = cmdConnectClaude;
 const commands_1 = require("./commands");
 const config_1 = require("./config");
-const commands_2 = require("./relay/commands");
 const runtime_install_1 = require("./runtime-install");
 /** One-time Claude setup reuses a valid login, registers MCP, and refreshes its skill. */
 async function cmdConnectClaude(opts = {}) {
@@ -23,7 +22,7 @@ async function cmdConnectClaude(opts = {}) {
             console.log("  " + line);
         if (!registered)
             return 1;
-        console.log("  " + await (0, commands_2.ensureRelayInstalled)());
+        console.log("  Incoming messages use native WebSocket Monitor; the session will verify its connection after joining.");
         console.log('  Restart Claude Code once, then use /baychat <name> "<group>".');
         return 0;
     }

package/dist/device-login.js

@@ -0,0 +1,192 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startDeviceLogin = startDeviceLogin;
+exports.finishDeviceLogin = finishDeviceLogin;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const zod_1 = require("zod");
+const api_1 = require("./api");
+const config_1 = require("./config");
+const deviceSchema = zod_1.z.object({
+    baseUrl: zod_1.z.string().url(),
+    token: zod_1.z.string().min(1),
+    user: zod_1.z.object({ id: zod_1.z.string().min(1), name: zod_1.z.string() }),
+    expiresAt: zod_1.z.string().datetime(),
+});
+const pendingSchema = zod_1.z.object({
+    baseUrl: zod_1.z.string().url(),
+    id: zod_1.z.string().min(1),
+    pollSecret: zod_1.z.string().min(1),
+    url: zod_1.z.string().url(),
+    expiresAt: zod_1.z.string().datetime(),
+    approved: deviceSchema.optional(),
+});
+const LOCK_EXPIRY_MS = 60_000; // Each login request has a 15-second network deadline.
+/** Create or reuse an approval link, without polling or exposing its pickup secret. */
+async function startDeviceLogin(baseUrl) {
+    return withLoginLock(async () => {
+        const base = normalizeBase(baseUrl);
+        const previous = readPending();
+        if (previous?.approved)
+            throw new Error("A login was approved. Run baychat login --finish to save it first.");
+        if (previous?.baseUrl === base &&
+            Date.parse(previous.expiresAt) > Date.now()) {
+            return { url: previous.url, expiresAt: previous.expiresAt };
+        }
+        const request = await (0, api_1.createDeviceLink)(base, os.hostname().slice(0, 60));
+        const parsed = pendingSchema.safeParse({ ...request, baseUrl: base });
+        if (!parsed.success)
+            throw new Error("BayChat returned an invalid login link. Try baychat login --start again.");
+        writePending(parsed.data);
+        return { url: parsed.data.url, expiresAt: parsed.data.expiresAt };
+    });
+}
+/** Check approval once. Save a consumed credential before removing its recovery record. */
+async function finishDeviceLogin(baseUrl) {
+    return withLoginLock(async () => {
+        const pending = readPending();
+        if (!pending)
+            throw new Error("No usable login request. Run baychat login --start.");
+        if (baseUrl && normalizeBase(baseUrl) !== pending.baseUrl) {
+            throw new Error("This login was started for a different server. Finish without --base, or start a new login for that server.");
+        }
+        let device = pending.approved;
+        if (!device) {
+            if (Date.parse(pending.expiresAt) <= Date.now())
+                throw new Error("Login request expired. Run baychat login --start.");
+            let status;
+            try {
+                status = await (0, api_1.pollDeviceLink)(pending.baseUrl, pending.id, pending.pollSecret);
+            }
+            catch (error) {
+                if (error instanceof api_1.ApiError && error.status === 404) {
+                    throw new Error("Login request expired or was already collected. Run baychat login --start.");
+                }
+                throw error;
+            }
+            if (status.status === "pending")
+                return { status: "pending", url: pending.url };
+            if (status.status !== "approved")
+                throw new Error("BayChat returned an invalid login status. Run baychat login --start again.");
+            const parsed = deviceSchema.safeParse({
+                ...status,
+                baseUrl: pending.baseUrl,
+            });
+            if (!parsed.success)
+                throw new Error("BayChat returned an invalid login approval. Run baychat login --start again.");
+            device = parsed.data;
+            // Pickup is single-use. Retain the approved credential if merging the user's
+            // existing credentials fails; the next finish must not consume it again.
+            writePending({ ...pending, approved: device });
+        }
+        (0, config_1.saveDeviceCredentials)(device);
+        fs.unlinkSync(pendingPath());
+        return { status: "approved", device };
+    });
+}
+function pendingPath() {
+    return path.join((0, config_1.configDir)(), "login-pending.json");
+}
+function normalizeBase(base) {
+    const url = new URL(base);
+    if (!["http:", "https:"].includes(url.protocol) ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash) {
+        throw new Error("Login server must be an HTTP(S) URL without credentials, query or fragment.");
+    }
+    return url.toString().replace(/\/$/, "");
+}
+function readPending() {
+    try {
+        const parsed = pendingSchema.safeParse(JSON.parse(fs.readFileSync(pendingPath(), "utf8")));
+        return parsed.success ? parsed.data : undefined;
+    }
+    catch (error) {
+        if (error instanceof SyntaxError ||
+            error.code === "ENOENT")
+            return undefined;
+        throw new Error("Cannot read the pending BayChat login. Check access to your BayChat configuration directory.");
+    }
+}
+/** Atomic private storage; an interrupted write cannot truncate a live approval. */
+function writePending(pending) {
+    const file = pendingPath();
+    const temporary = `${file}.${(0, node_crypto_1.randomUUID)()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, JSON.stringify(pending), {
+            mode: 0o600,
+            flag: "wx",
+        });
+        fs.renameSync(temporary, file);
+        fs.chmodSync(file, 0o600);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+/** Serialize local login attempts so two sessions cannot consume the same approval. */
+async function withLoginLock(action) {
+    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
+    const lock = path.join((0, config_1.configDir)(), "login.lock");
+    try {
+        if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_EXPIRY_MS)
+            fs.unlinkSync(lock);
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    let descriptor;
+    try {
+        descriptor = fs.openSync(lock, "wx", 0o600);
+    }
+    catch (error) {
+        if (error.code === "EEXIST")
+            throw new Error("Another BayChat login is running. Retry when it finishes (a stopped login clears within one minute).");
+        throw error;
+    }
+    try {
+        return await action();
+    }
+    finally {
+        fs.closeSync(descriptor);
+        fs.rmSync(lock, { force: true });
+    }
+}