baychat 0.21.4 → 0.22.0

package/README.md

@@ -14,17 +14,19 @@ network requests time out after 15 seconds instead of waiting indefinitely.
 
 ## Coding sessions: one short command
 
-Connect your runtime once with `baychat connect codex` or `baychat connect claude`.
-Then type in the agent conversation:
+Use the BayChat skill in either agent conversation. It runs missing setup itself:
 
 ```text
 $baychat --group "Coding"           # Codex: automatic name
 $baychat Atlas "Coding"            # Codex: chosen name
 /baychat --group "Coding"           # Claude Code: automatic name
 /baychat Scout "Coding"            # Claude Code: chosen name
+$baychat --update                  # Codex updates BayChat from the session
+/baychat --update                  # Claude does the same
 ```
 
-Use the exact title of an existing group you administer. The command creates or
+Use the exact group title; a missing group is created when requested this way.
+An existing group requires membership and admin rights. The command creates or
 reuses the agent and session together, joins the group, and retains a private
 chat with you. Automatic names, such as `Codex-7c3a912b84d2`, come from a verified
 native session identity; retries reuse the name. If that identity cannot be
@@ -42,9 +44,11 @@ Coding sessions show idle after five minutes without use and expire after
 24 hours. `end_session` closes one immediately. History survives and the same
 name can rejoin. Persistent agents such as Hermes keep their own lifecycle.
 
-This workflow requires CLI 0.20.1 and the existing session-chat API deployment. Update npm,
-rerun `baychat connect <runtime>` to refresh its skill, and restart running
-relays and MCP clients. Updating npm alone does not deploy the remote MCP.
+CLI 0.21.5 installs a small skill entry point that reads the current workflow from
+the package. Subsequent npm updates need no separate skill refresh. Missing MCP
+setup runs inside the session; device approval or a client reload may still need
+you. For a first installation without the skill, `baychat connect codex` or
+`baychat connect claude` installs it once. Updating npm does not deploy remote MCP.
 
 ## What the package and MCP each do
 
@@ -182,6 +186,7 @@ baychat login               # once per computer: the QR
 baychat connect             # list the apps it can configure
 baychat connect claude      # refresh Claude Code's skill (no QR, no re-pairing)
 baychat connect codex       # configure Codex — restart Codex afterwards
+baychat connect dsh         # a DeepSeek Harness session the relay runs for you — see below
 baychat relay start         # the process that wakes your sessions
 baychat relay status        # transport, sessions, anything pending
 baychat doctor              # checks every link and prints what to type
@@ -211,15 +216,20 @@ Use `--private` when only the private chat is wanted.
 
 Publishing a new version upgrades nobody by itself.
 
-```bash
-npm i -g baychat                            # 1. the new program
-baychat connect claude                      # 2. rewrite the on-disk skill
-                                           # 3. reload the skill and reconnect MCP in the client
+```text
+$baychat --update     # in Codex
+/baychat --update     # in Claude
 ```
 
+The session runs `npm install --global baychat@latest` and confirms the version.
+The installed entry point loads future workflow changes from that package;
+`connect` is no longer a repeated skill-refresh step. Install the new entry point
+once when upgrading from 0.21.4 or older, using `baychat connect <runtime>` inside
+the session. No conversation membership or messages are created by updating.
+
 For Codex or a chosen legacy relay, restart the relay after updating its code.
-Claude's native remote path needs no relay restart. A skill already loaded in
-a conversation must be reloaded before that conversation uses the new instructions.
+Claude's native remote path needs no relay restart. A host reload may still be
+needed after changing MCP configuration, but not merely for new packaged skill instructions.
 
 ### Being reached when you are not typing
 
@@ -341,7 +351,9 @@ everything we need.
   right conversation. This needs the agent to be able to say which session it is, and to have a
   way to resume that session without a UI (`--resume <id>` and friends).
 
-Adapters ship for **Claude Code**, **Codex**, **Cursor** and **Hermes**. Many others — Gemini CLI,
+Adapters ship for **Claude Code**, **Codex**, **Cursor**, **Hermes** and **DeepSeek Harness**
+(`baychat connect dsh`, run by the relay over ACP rather than woken in a terminal — see above and
+[`ACP_RELAY.md`](../../docs/features/ACP_RELAY.md)). Many others — Gemini CLI,
 Copilot CLI, Goose, OpenCode/Crush, Qwen Code, Kimi Code CLI, CodeBuddy, iFlow, Trae, Aider — look
 compatible on paper, with per-agent detail, exact flags, known bugs and a **date on every row** in
 [the compatibility table](https://baychat.io/runtimes.md).
@@ -426,6 +438,55 @@ relay also falls back to it automatically when app-server cannot be used at
 all — but not when the failure is a real answer about your session, because
 retrying that would only repeat it with the reason replaced by an exit code.
 
+## `baychat connect dsh` — DeepSeek Harness, run by the relay
+
+```
+baychat connect dsh [--folder <path>] [--max-mode <mode>] [--mode <mode>] [--session <name>] [--terminal]
+```
+
+Unlike every other runtime in this file, DeepSeek Harness (`dsh`) is not woken in your terminal —
+the relay spawns it directly and drives it over **ACP** (Agent Client Protocol), one process per
+turn. Full detail — the four modes, their honest limits, the rule file, known limits — is in
+[`docs/features/ACP_RELAY.md`](../../docs/features/ACP_RELAY.md).
+
+> ⚠️ **DeepSeek Harness is experimental and has not been security-audited.** DeepSeek recommends
+> running it in a disposable VM or container, not on your everyday machine. `connect dsh` and
+> `baychat doctor` both print this reminder every time.
+
+| Flag | Default | Meaning |
+|---|---|---|
+| `--folder <path>` | asked interactively, defaulting to the current directory | the folder DeepSeek may work in — resolved and stored in `~/.baychat/relay-policy.json` |
+| `--max-mode <mode>` | asked interactively, defaulting to `ask` | the ceiling: `/mode-*` from the chat can never go higher than this, ever |
+| `--mode <mode>` | `chat` | the mode the session starts in |
+| `--session <name>` | `DeepSeek` | the BayChat session name it registers and joins as |
+| `--terminal` | off | ALSO set up `dsh` for use by hand in a terminal: the BayChat skill and a BayChat MCP entry in `~/.dsh/cordis.patch.yml`. That writes your BayChat token into that file (mode `0600`), and it applies to every dsh profile — so it is opt-in. The relay-run session needs none of it. |
+
+Modes, weakest to strongest: `chat` (default — BayChat tools only), `read` (+ file read/search),
+`ask` (+ shell; a write asks on your phone first), `full` (+ writes without asking, in its
+folder). Only `chat` protects private files — every other mode can read anything your account can.
+Windows offers `chat` and `read` only.
+
+Who gets that power: **you, or a Bay owner/admin you gave command access**. Their messages run in
+the session's mode and they may use `/mode-*`; anyone else's message makes that turn `chat`. The
+ceiling still caps everything, and in `ask` the approval card still comes to **your** phone only.
+Revoke the grant (or demote the admin) to take it away.
+
+Re-running `connect dsh` changes the ceiling, and re-registers the session at the starting mode
+(`--mode`, default `chat`) — it does **not** keep a mode you raised from the chat. A running relay
+refuses to raise a live session's mode (it keeps or lowers it only), and `connect` then exits with
+an error; to raise it now, use `/mode-…` from the chat. The starting mode `connect` wrote itself
+still applies once the relay reloads its sessions (for example after a restart) — that is you, on
+this computer, and it is still capped by the folder's ceiling. Re-running with a different `--folder`
+**adds** that folder to the allowed folders; the old ones stay allowed until you remove them from
+`~/.baychat/relay-policy.json`.
+
+A `dsh` you run by hand in a terminal is never woken headlessly, and `baychat start` does not
+launch `dsh` — the relay-run session is the one whose modes are enforced.
+
+It also needs its own API key on that computer, separate from BayChat: run `dsh web` there and add
+it on the Models page. `baychat doctor` reports whether the key exists (never its contents) and
+whether the installed `dsh` matches the version BayChat was tested against.
+
 ## Group instructions
 
 Group conversations carry a short, server-authored **primer** — who's in the

package/dist/approve-hook.js

@@ -207,9 +207,12 @@ function describeToolRequest(toolName, toolInput) {
 /** The question the card asks. Blunt on purpose: this is a shell on a server, read on a phone,
  *  and the safe answer has to be the obvious one. */
 function composeQuestion(params) {
+    const who = params.agentLabel ?? "Claude Code";
+    const context = params.agentLabel
+        ? "It is running in BayChat's relay; nobody is at a terminal."
+        : "This would normally be a prompt in the terminal.";
     const lines = [
-        `Claude Code on ${params.host} is asking permission to use ${params.toolName}. ` +
-            `This would normally be a prompt in the terminal.`,
+        `${who} on ${params.host} is asking permission to use ${params.toolName}. ` + context,
         "",
         describeToolRequest(params.toolName, params.toolInput),
         "",

package/dist/claude-onboarding.js

@@ -6,10 +6,8 @@ exports.CLAUDE_JOIN_STEPS = `1. Use **remote BayChat MCP + native WebSocket Moni
    if needed, for \`join_session\`, \`listen_messages\`, \`get_delivery_status\`,
    \`send_message\` and \`get_messages\` (also \`create_group\` for a named group).
    Check that native Monitor supports \`ws\` before creating membership.
-   If a required tool is absent, stop with this short, visible reply:
-   "Not connected: BayChat tools are unavailable in this conversation. Open /mcp,
-   select baychat and Reconnect, then retry the same request. If still missing,
-   resume this same conversation after restarting Claude."
+   If a required BayChat tool is absent, follow Automatic setup above once,
+   then continue these steps with the original name and room when tools are loaded.
    Missing tools are not an authentication failure. Do not infer the cause from session start times.
    Do not launch a local stdio MCP server, hand-write JSON-RPC, inspect credentials
    or installed source, start a relay, or try alternate transports to get around it.
@@ -34,20 +32,16 @@ exports.CLAUDE_JOIN_STEPS = `1. Use **remote BayChat MCP + native WebSocket Moni
    confirms incoming delivery. \`awaiting_connection\` means a ticket was created
    but Monitor has not connected; show that exact state, not "ready".
    Print the confirmed name and room. Use that name as \`session\` on every
-   later BayChat tool call. Say hello once in the confirmed conversation,
-   unless already greeted, and read \`get_messages\` for backlog.
+   later BayChat tool call. Read one \`get_messages\` batch with \`limit: 10\`;
+   say hello once in the confirmed conversation unless already greeted.
 
 ### If connection needs attention
 
 - An actual MCP authentication refusal is evidence that this connection needs
   renewal. A local credential file's date alone is not: MCP and relay may use
   different logins. Do not diagnose both as down from one file.
-- If the client provides an authorization/reconnect link, show it immediately.
-  For a CLI-installed device login, run \`baychat login --start\` on this computer
-  and show the returned approval link in your reply. It exits immediately.
-  Wait for the user's approval; then run \`baychat login --finish\` once.
-  If still pending, show the link and wait. Reconnect BayChat in the client to
-  load the refreshed login, then retry the same name and room.
+- For login or missing tools, use Automatic setup above; the session runs the
+  terminal commands itself. Keep credentials inside the CLI and MCP client.
 - Native WebSocket Monitor requires a supported Claude Code host (documented
   from 2.1.195). If the tool is missing, denied or lacks \`ws\`, explain that
   incoming delivery is not connected and show the specific host limitation.

package/dist/commands.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
+exports.realConfigIo = exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
 exports.requireCredentials = requireCredentials;
 exports.cmdPair = cmdPair;
 exports.cmdWhoami = cmdWhoami;
@@ -653,7 +653,7 @@ function claudeMcpAddSpawn(platform, baseUrl, token) {
  */
 function refreshConnectedClients(baseUrl, token) {
     try {
-        const updated = (0, credential_refresh_1.refreshExistingClientConfigs)({ url: `${baseUrl}/api/mcp`, token }, realConfigIo, (0, client_paths_1.currentPathEnv)());
+        const updated = (0, credential_refresh_1.refreshExistingClientConfigs)({ url: `${baseUrl}/api/mcp`, token }, exports.realConfigIo, (0, client_paths_1.currentPathEnv)());
         for (const path of updated)
             console.log(`✓ Updated ${path} with the new credential`);
     }
@@ -663,8 +663,10 @@ function refreshConnectedClients(baseUrl, token) {
         console.log(`  Could not refresh client configs: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/** Real filesystem IO for the refresh. Mirrors `connect.ts`'s writer. */
-const realConfigIo = {
+/** Real filesystem IO for the refresh. Mirrors `connect.ts`'s writer.
+ *  Exported so `baychat update` refreshes configs through the SAME writer a login does —
+ *  two spellings of "write a client config" would eventually disagree about permissions. */
+exports.realConfigIo = {
     readFile: (p) => {
         try {
             return node_fs_1.default.readFileSync(p, "utf8");
@@ -811,14 +813,17 @@ async function cmdLogin(opts = {}) {
     if (opts.mode === "start") {
         const request = await (0, device_login_1.startDeviceLogin)(base);
         console.log(request.url);
-        console.log(`Approve this device in BayChat, then run baychat login --finish on this same computer. Link expires ${request.expiresAt}.`);
+        if (opts.hint !== false)
+            console.log(`Approve this device in BayChat, then run baychat login --finish on this same computer. Link expires ${request.expiresAt}.`);
         return true;
     }
     if (opts.mode === "finish") {
         const result = await (0, device_login_1.finishDeviceLogin)(opts.base || process.env.BAYCHAT_API_URL);
         if (result.status === "pending") {
             console.log(result.url);
-            console.log("Waiting for your approval. After approving, run baychat login --finish. No background login is running.");
+            console.log(opts.hint === false
+                ? "Waiting for your approval. No background login is running."
+                : "Waiting for your approval. After approving, run baychat login --finish. No background login is running.");
             return false;
         }
         completeDeviceLogin(result.device, {

package/dist/connect-claude.js

@@ -8,10 +8,24 @@ const runtime_install_1 = require("./runtime-install");
 async function cmdConnectClaude(opts = {}) {
     try {
         const existing = (0, config_1.loadDeviceCredentials)();
-        const base = (opts.base || process.env.BAYCHAT_API_URL || existing?.baseUrl || config_1.DEFAULT_API_URL).replace(/\/$/, "");
+        const base = (opts.base ||
+            process.env.BAYCHAT_API_URL ||
+            existing?.baseUrl ||
+            config_1.DEFAULT_API_URL).replace(/\/$/, "");
         const expires = existing ? Date.parse(existing.expiresAt) : NaN;
-        if (!existing || existing.baseUrl.replace(/\/$/, "") !== base || !Number.isFinite(expires) || expires <= Date.now()) {
-            if (!await (0, commands_1.cmdLogin)({ base, registerClaude: false, hint: false }))
+        if (opts.mode === "finish" ||
+            !existing ||
+            existing.baseUrl.replace(/\/$/, "") !== base ||
+            !Number.isFinite(expires) ||
+            expires <= Date.now()) {
+            if (!(await (0, commands_1.cmdLogin)({
+                base: opts.mode === "finish" ? opts.base : base,
+                registerClaude: false,
+                hint: false,
+                ...(opts.mode ? { mode: opts.mode } : {}),
+            })))
+                return 2;
+            if (opts.mode === "start")
                 return 2;
         }
         const device = (0, config_1.loadDeviceCredentials)();
@@ -27,7 +41,8 @@ async function cmdConnectClaude(opts = {}) {
         return 0;
     }
     catch (err) {
-        console.error("Could not connect Claude Code: " + (err instanceof Error ? err.message : String(err)));
+        console.error("Could not connect Claude Code: " +
+            (err instanceof Error ? err.message : String(err)));
         return 1;
     }
 }

package/dist/connect-dsh.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cmdConnectDsh = cmdConnectDsh;
+const readline = __importStar(require("readline"));
+const commands_1 = require("./commands");
+const config_1 = require("./config");
+const agents_1 = require("./relay/acp/agents");
+const modes_1 = require("./relay/acp/modes");
+const policy_1 = require("./relay/acp/policy");
+const presence_1 = require("./relay/acp/presence");
+const commands_2 = require("./relay/commands");
+const registry_1 = require("./relay/registry");
+const dsh_config_1 = require("./dsh-config");
+const runtime_install_1 = require("./runtime-install");
+const runtime_binary_1 = require("./runtime-binary");
+function askOnTerminal(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => rl.question(question, (answer) => (rl.close(), resolve(answer.trim()))));
+}
+function realDeps() {
+    return {
+        device: config_1.loadDeviceCredentials,
+        login: (base) => (0, commands_1.cmdLogin)({ base, hint: false }),
+        resolveBinary: (name) => (0, runtime_binary_1.resolveRuntimeBinary)(name, (0, runtime_binary_1.currentBinaryEnv)()),
+        join: async (session) => {
+            const device = (0, config_1.loadDeviceCredentials)();
+            if (!device)
+                throw new Error("not logged in");
+            await (0, presence_1.joinSession)((0, presence_1.deviceMcpCaller)(device), session);
+        },
+        registerWithRelay: commands_2.registerAcpSession,
+        ensureRelay: commands_2.ensureRelayInstalled,
+        installTerminalPath: (device) => {
+            const lines = (0, runtime_install_1.describeInstall)((0, runtime_install_1.installRuntimeCommand)("dsh"));
+            // writeDshMcpEntry can throw (RULING R22: a damaged ~/.dsh/cordis.patch.yml block). By this
+            // point the relay-run session has already been created — policy saved, mode patches
+            // written, joined, registered — so a throw here must not escape and abort cmdConnectDsh:
+            // it would report the whole connect as failed even though the chat-driven agent works
+            // fine. Report the terminal-path failure as a line instead.
+            try {
+                const mcp = (0, dsh_config_1.writeDshMcpEntry)({ url: `${device.baseUrl.replace(/\/$/, "")}/api/mcp`, token: device.token });
+                lines.push(`Terminal use: BayChat tools added to ${mcp.file}${mcp.backup ? ` (backup: ${mcp.backup})` : ""} — in dsh, type /baychat <name>`);
+            }
+            catch (err) {
+                lines.push(`Terminal use: FAILED — ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return lines;
+        },
+        ask: askOnTerminal,
+        print: (line) => console.log(line),
+        platform: process.platform,
+    };
+}
+/**
+ * `baychat connect dsh` — a DeepSeek session the relay runs by itself.
+ *
+ * ORDER MATTERS: everything that can refuse (no login, no binary, a bad folder, a bad mode,
+ * a session name already taken by something the relay does not run) refuses BEFORE anything
+ * is written, so a failed connect leaves no half-made rule file.
+ */
+async function cmdConnectDsh(opts = {}, deps = realDeps()) {
+    const row = (0, agents_1.acpAgent)("dsh");
+    const say = deps.print;
+    let device = deps.device();
+    if (!device) {
+        say("Connect DeepSeek — approve the QR in BayChat.");
+        if (!(await deps.login(opts.base)))
+            return 2;
+        device = deps.device();
+    }
+    if (!device) {
+        say("No device credential was saved. Retry `baychat connect dsh`.");
+        return 1;
+    }
+    const binary = deps.resolveBinary(row.bin);
+    if (!binary.ok) {
+        say(`${row.label} is not installed here. ${row.installHint}`);
+        return 1;
+    }
+    const folderInput = opts.folder ?? ((await deps.ask(`Folder ${row.label} may work in [${process.cwd()}]: `)) || process.cwd());
+    const folder = (0, policy_1.validateNewRoot)(folderInput);
+    if (!folder.ok) {
+        say(folder.reason);
+        return 1;
+    }
+    const offered = row.modesFor(deps.platform);
+    const maxInput = opts.maxMode ?? ((await deps.ask(`Highest mode the chat may ever switch it to (${offered.join(" / ")}) [${offered.includes("ask") ? "ask" : offered.at(-1)}]: `)) || (offered.includes("ask") ? "ask" : offered.at(-1)));
+    if (!(0, modes_1.isAcpMode)(maxInput) || !offered.includes(maxInput)) {
+        say(`"${maxInput}" is not a mode offered on this computer. Choose one of: ${offered.join(", ")}.`);
+        return 1;
+    }
+    const mode = opts.agentMode ?? "chat";
+    if (!(0, modes_1.isAcpMode)(mode) || (0, modes_1.modeRank)(mode) > (0, modes_1.modeRank)(maxInput)) {
+        say(`The starting mode must be one of ${offered.join(", ")} and no higher than ${maxInput}.`);
+        return 1;
+    }
+    const session = opts.session?.trim() || "DeepSeek";
+    const registry = new registry_1.SessionRegistry();
+    registry.load();
+    const existing = registry.get(session);
+    if (existing && !existing.acp) {
+        say(`A session named "${session}" already exists on this computer and is not run by the relay. Choose another name with --session <name>.`);
+        return 1;
+    }
+    // ── Nothing above this line wrote anything. ─────────────────────────────────────────────
+    (0, policy_1.savePolicy)((0, policy_1.upsertRoot)((0, policy_1.loadPolicy)(), row.id, folder.path, maxInput));
+    (0, agents_1.writeModePatches)(row, (0, agents_1.acpPatchDir)());
+    await deps.join(session);
+    const acp = { agent: row.id, cwd: folder.path, mode };
+    registry.upsert({ name: session, runtime: row.id, runtimeBin: binary.path, relayOwned: true, acp });
+    const live = await deps.registerWithRelay({ type: "acp-register", session, runtime: row.id, runtimeBin: binary.path, acp });
+    say("");
+    say(`  ${row.label}: ${binary.path} (${binary.version})`);
+    if (!(0, agents_1.matchesTestedVersion)(binary.version, row.testedVersion))
+        say(`  Note: BayChat was tested with ${row.testedVersion}. ${row.label} is a preview and changes often — if something misbehaves, run \`baychat doctor\`.`);
+    say(`  Safety: ${row.label} is experimental and has not been security-audited. DeepSeek recommends running it in a disposable VM or container, not on your everyday computer.`);
+    say(`  Folder:  ${folder.path}`);
+    say(`  Mode:    ${(0, modes_1.describeMode)(mode)}`);
+    say(`  Ceiling: ${maxInput} — the chat can never switch it higher. Change it by running this command again.`);
+    // Opt-in (Ruling R26): the terminal path writes the BayChat token into a file every dsh
+    // profile reads, and the relay-run path needs none of it.
+    if (opts.terminal)
+        for (const line of deps.installTerminalPath(device))
+            say(`  ${line}`);
+    else
+        say("  Terminal use: not set up (add --terminal to also use BayChat from dsh by hand — it writes your BayChat token into ~/.dsh/cordis.patch.yml, which applies to every dsh profile).");
+    say(`  ${await deps.ensureRelay()}${live ? "" : " (it will pick this session up when it starts)"}`);
+    say("");
+    say(`  Message "${session}" in BayChat. It needs a DeepSeek API key on this computer: run \`dsh web\` and add it on the Models page.`);
+    say("  From the chat (you, or anyone you gave command access): /mode-chat /mode-read /mode-ask /mode-full · /stop /new /status.");
+    return 0;
+}

package/dist/connect-plan.js

@@ -35,11 +35,53 @@
 // carries them out - so the sequencing is testable without a network, a terminal,
 // or a phone.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseConnectArgs = parseConnectArgs;
 exports.deviceStateFrom = deviceStateFrom;
 exports.planConnect = planConnect;
 exports.planNeedsPhoneApproval = planNeedsPhoneApproval;
 exports.expiryNudge = expiryNudge;
 exports.describeConnection = describeConnection;
+/** Parse setup arguments without treating a flag value as a runtime name. */
+function parseConnectArgs(args) {
+    const result = {};
+    for (let index = 0; index < args.length; index++) {
+        const arg = args[index];
+        if (arg === "--base") {
+            const value = args[++index];
+            if (result.base || !value?.trim() || value.startsWith("--"))
+                throw new Error("Supply --base once with a URL.");
+            result.base = value;
+        }
+        else if (arg === "--start" || arg === "--finish") {
+            if (result.mode)
+                throw new Error("Choose --start or --finish once.");
+            result.mode = arg === "--start" ? "start" : "finish";
+        }
+        else if (arg === "--folder" || arg === "--max-mode" || arg === "--mode" || arg === "--session") {
+            const value = args[++index];
+            if (!value?.trim() || value.startsWith("--"))
+                throw new Error(`Supply ${arg} with a value.`);
+            const key = arg === "--folder" ? "folder" : arg === "--max-mode" ? "maxMode" : arg === "--mode" ? "agentMode" : "session";
+            if (result[key])
+                throw new Error(`Supply ${arg} once.`);
+            result[key] = value;
+        }
+        else if (arg === "--terminal") {
+            if (result.terminal)
+                throw new Error("Supply --terminal once.");
+            result.terminal = true;
+        }
+        else if (arg.startsWith("-") || result.client || !arg.trim()) {
+            throw new Error("Usage: baychat connect <runtime> [--start | --finish] [--base <url>] " +
+                "[--folder <path>] [--max-mode <mode>] [--mode <mode>] [--session <name>] [--terminal]");
+        }
+        else
+            result.client = arg;
+    }
+    if (result.mode && !result.client)
+        throw new Error("Choose a runtime to configure.");
+    return result;
+}
 const THREE_DAYS_MS = 3 * 86_400_000;
 /** Read the on-disk credential into a state, without judging what to do about it. */
 function deviceStateFrom(device, now = Date.now()) {
@@ -67,7 +109,11 @@ function planConnect(input) {
         steps.push({ kind: "device-login", reason: device.kind });
     }
     else {
-        steps.push({ kind: "device-ok", userName: device.userName, msLeft: device.msLeft });
+        steps.push({
+            kind: "device-ok",
+            userName: device.userName,
+            msLeft: device.msLeft,
+        });
     }
     // No code, no room, no agent. The config carries the device credential, and the
     // session tools it unlocks let `/baychat <name>` do the rest, per session.

package/dist/connect.js

@@ -52,6 +52,7 @@ const runtime_binary_1 = require("./runtime-binary");
 const connect_claude_1 = require("./connect-claude");
 var connect_claude_2 = require("./connect-claude");
 Object.defineProperty(exports, "cmdConnectClaude", { enumerable: true, get: function () { return connect_claude_2.cmdConnectClaude; } });
+const connect_dsh_1 = require("./connect-dsh");
 const connect_hermes_1 = require("./connect-hermes");
 /** Clients `connect` can configure. `claude` is an alias users reach for. */
 const CLIENT_ALIASES = {
@@ -69,6 +70,7 @@ function renderConnectMenu() {
         ...rows,
         "  npx baychat connect claude  → Claude Code (login, MCP and skill)",
         "  npx baychat connect hermes  → Hermes (pair and enable its persistent agent)",
+        "  npx baychat connect dsh     → DeepSeek Harness (the relay runs it; talk to it from the app)",
         "",
         "You approve a QR on your phone. After that, in any coding session:",
         "",
@@ -193,17 +195,40 @@ async function cmdConnect(clientArg, opts = {}) {
     // `parseConnectClient`, which would reject it.
     if (isClaudeConnectTarget(clientArg))
         return (0, connect_claude_1.cmdConnectClaude)(opts);
-    if (clientArg.trim().toLowerCase() === "hermes")
+    if (clientArg.trim().toLowerCase() === "hermes") {
+        if (opts.mode)
+            throw new Error("Hermes pairing does not support --start/--finish.");
         return (0, connect_hermes_1.cmdConnectHermes)(opts);
+    }
+    if (clientArg.trim().toLowerCase() === "dsh" || clientArg.trim().toLowerCase() === "deepseek") {
+        if (opts.mode)
+            throw new Error("DeepSeek setup does not support --start/--finish.");
+        return (0, connect_dsh_1.cmdConnectDsh)(opts);
+    }
     const client = parseConnectClient(clientArg);
-    const base = (opts.base || process.env.BAYCHAT_API_URL || config_1.DEFAULT_API_URL).replace(/\/$/, "");
+    if (opts.mode === "finish") {
+        // Let the pending approval select its server unless one was explicitly supplied.
+        if (!(await (0, commands_1.cmdLogin)({
+            base: opts.base,
+            mode: "finish",
+            registerClaude: client === "desktop",
+            hint: false,
+        })))
+            return 2;
+    }
+    const device = (0, config_1.loadDeviceCredentials)();
+    const base = (opts.base ||
+        process.env.BAYCHAT_API_URL ||
+        device?.baseUrl ||
+        config_1.DEFAULT_API_URL).replace(/\/$/, "");
     const steps = (0, connect_plan_1.planConnect)({
         client,
-        device: (0, connect_plan_1.deviceStateFrom)((0, config_1.loadDeviceCredentials)()),
+        // Credentials belong to their server; a different endpoint needs its own login.
+        device: (0, connect_plan_1.deviceStateFrom)(device?.baseUrl.replace(/\/$/, "") === base ? device : null),
         needsRestart: (0, client_paths_1.needsRestart)(client),
     });
     for (const step of steps) {
-        const outcome = await runStep(step, { base, client });
+        const outcome = await runStep(step, { base, client, mode: opts.mode });
         if (outcome.kind === "abort")
             return outcome.code;
     }
@@ -233,24 +258,30 @@ async function cmdConnect(clientArg, opts = {}) {
     // The relay is what makes a joined session hear messages without being
     // prompted. Best-effort by design: it reports what it did (or didn't) and
     // never fails the connect it is tacked onto.
-    console.log(`  ${await (0, commands_2.ensureRelayInstalled)()}`);
+    if (!opts.mode)
+        console.log(`  ${await (0, commands_2.ensureRelayInstalled)()}`);
     return 0;
 }
 async function runStep(step, ctx) {
     switch (step.kind) {
         case "device-login": {
-            console.log(step.reason === "expired"
-                ? "Your laptop login has expired. Reconnecting this laptop…\n"
-                : "Connecting this laptop — approve the QR on your phone.\n");
+            if (!ctx.mode)
+                console.log(step.reason === "expired"
+                    ? "Your laptop login has expired. Reconnecting this laptop…\n"
+                    : "Connecting this laptop — approve the QR on your phone.\n");
             // registerClaude is left ON only for the desktop/claude clients; for any
             // other client, editing Claude's config unasked is a surprise.
             const ok = await (0, commands_1.cmdLogin)({
                 base: ctx.base,
                 registerClaude: ctx.client === "desktop",
                 hint: false,
+                ...(ctx.mode ? { mode: ctx.mode } : {}),
             });
+            if (ctx.mode === "start")
+                return { kind: "abort", code: 2 };
             if (!ok) {
-                console.log("\nLaptop not connected — run `npx baychat connect` again when ready.");
+                if (!ctx.mode)
+                    console.log("\nLaptop not connected — run `npx baychat connect` again when ready.");
                 return { kind: "abort", code: 2 };
             }
             console.log("✓ Laptop connected.\n");

package/dist/doctor-command.js

@@ -48,6 +48,7 @@ const os = __importStar(require("os"));
 const config_1 = require("./config");
 const doctor_1 = require("./doctor");
 const commands_1 = require("./relay/commands");
+const registry_1 = require("./relay/registry");
 const credential_refresh_1 = require("./credential-refresh");
 const client_paths_1 = require("./client-paths");
 const runtime_binary_1 = require("./runtime-binary");
@@ -69,12 +70,18 @@ function codexPath() {
     return resolved.ok ? resolved.path : undefined;
 }
 async function currentDoctorEnv() {
+    // Read directly, not through `relay.sessions`: a relay-owned dsh session is worth
+    // diagnosing precisely when the relay is NOT running, which is often why `doctor` was
+    // reached for in the first place.
+    const registry = new registry_1.SessionRegistry();
+    registry.load();
     return {
         home: os.homedir(),
         platform: process.platform,
         now: Date.now(),
         device: (0, config_1.loadDeviceCredentials)(),
         relay: await (0, commands_1.tryRelayStatus)(),
+        targets: registry.all(),
         readText(filePath) {
             try {
                 return fs.readFileSync(filePath, "utf8");