baychat 0.21.4 → 0.22.0

package/dist/doctor.js

@@ -57,13 +57,17 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildReport = buildReport;
 exports.mailboxCheck = mailboxCheck;
+exports.acpChecks = acpChecks;
 exports.exitCodeFor = exitCodeFor;
 exports.renderReport = renderReport;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const mailbox_1 = require("./relay/mailbox");
 const parent_watch_1 = require("./relay/parent-watch");
 const client_paths_1 = require("./client-paths");
+const agents_1 = require("./relay/acp/agents");
+const policy_1 = require("./relay/acp/policy");
 const runtime_binary_1 = require("./runtime-binary");
 const runtimes_1 = require("./runtimes");
 /**
@@ -106,6 +110,7 @@ function buildReport(env) {
         mailbox: mailboxCheck(),
         staleCredentials: staleCredentialCheck(env),
         runtimes: REPORTED.map((runtime) => runtimeReport(runtime, env)),
+        agents: acpChecks({ resolveBinary: env.resolveBinary, targets: env.targets, homedir: env.home }),
         pending: pendingCheck(env),
     };
 }
@@ -168,6 +173,84 @@ function mailboxCheck() {
     // where the truth is established, honestly, as pending-or-delivered.
     return { name: "mailbox", status: "pass", detail: `registered a mailbox FIFO: ${live.join(", ")}` };
 }
+/**
+ * Relay-run (ACP) agents: is each one startable, inside its rules, and able to reach a model?
+ *
+ * Takes `targets` rather than the full `DoctorEnv` for the same testability reason every other
+ * check here does — see `DoctorEnv.targets` for why these come from the persisted registry and
+ * not from `relay.sessions`.
+ *
+ * ONE finding per relay-owned session (not one report for the feature), because a machine
+ * running two dsh sessions in two folders can have one healthy and one not, and collapsing them
+ * would hide whichever came second.
+ *
+ * DeepSeek Harness is experimental and has not been security-audited (R11/R17): every line that
+ * gets far enough to say a version repeats DeepSeek's own recommendation to run it disposably —
+ * one short clause, not a paragraph, because the reader has already seen it once from `connect`.
+ */
+function acpChecks(env) {
+    const owned = env.targets.filter((t) => t.relayOwned && t.acp);
+    if (owned.length === 0) {
+        return [{ name: "relay-run agents", status: "skip", detail: "none — `baychat connect dsh` sets one up" }];
+    }
+    const policy = (0, policy_1.loadPolicy)();
+    return owned.map((t) => {
+        const name = `agent ${t.name}`;
+        const row = (0, agents_1.acpAgent)(t.acp.agent);
+        if (!row) {
+            return {
+                name,
+                status: "fail",
+                detail: `unknown agent "${t.acp.agent}"`,
+                remedy: "Update baychat, then run `baychat connect dsh` again.",
+            };
+        }
+        const bin = env.resolveBinary(row.bin);
+        if (!bin.ok) {
+            return {
+                name,
+                status: "fail",
+                detail: `${row.label} is not installed where the relay can find it`,
+                remedy: row.installHint,
+            };
+        }
+        const folder = (0, policy_1.checkFolder)(policy, row.id, t.acp.cwd);
+        if (!folder.ok) {
+            return {
+                name,
+                status: "fail",
+                detail: folder.reason,
+                remedy: "Run `baychat connect dsh` in the folder it should work in.",
+            };
+        }
+        const home = env.homedir ?? os.homedir();
+        // EXISTENCE only. The key is dsh's; BayChat never opens the file that holds it, and never
+        // logs it — the check is "is there a file there", not "what does it say".
+        const keySeen = Boolean(process.env.DEEPSEEK_API_KEY) ||
+            fs.existsSync(path.join(process.env.DSH_HOME ?? path.join(home, ".dsh"), ".credentials.yaml"));
+        const line = `${row.label} ${bin.version} · ${t.acp.cwd} · mode ${t.acp.mode} (ceiling ${folder.maxMode})` +
+            " — DeepSeek recommends a disposable VM or container";
+        if (!keySeen) {
+            return {
+                name,
+                status: "warn",
+                detail: `${line} — no DeepSeek key found`,
+                remedy: "Run `dsh web` and add the key on the Models page.",
+            };
+        }
+        // R20: a substring check lets a later release ("0.1.5-rc.20") pass silently as the tested
+        // one ("0.1.5-rc.2"). `matchesTestedVersion` bounds the match to a whole version token.
+        if (!(0, agents_1.matchesTestedVersion)(bin.version, row.testedVersion)) {
+            return {
+                name,
+                status: "warn",
+                detail: `${line} — BayChat was tested with ${row.testedVersion}`,
+                remedy: "If it misbehaves, install the tested version or update baychat.",
+            };
+        }
+        return { name, status: "pass", detail: line };
+    });
+}
 /**
  * The process exit code for a report.
  *
@@ -198,6 +281,8 @@ function renderReport(report) {
         for (const check of rest)
             lines.push(...renderGroupCheck("", check));
     }
+    for (const check of report.agents)
+        lines.push(...renderSummaryCheck(check));
     lines.push(...renderSummaryCheck(report.pending));
     return lines;
 }
@@ -513,7 +598,15 @@ function withRemedy(line, check) {
     return [line, `${" ".repeat(LABEL_WIDTH + 2 + CHECK_WIDTH)}→ ${check.remedy}`];
 }
 function allChecks(report) {
-    return [report.credentials, report.staleCredentials, report.relay, report.mailbox, ...report.runtimes.flatMap((r) => r.checks), report.pending];
+    return [
+        report.credentials,
+        report.staleCredentials,
+        report.relay,
+        report.mailbox,
+        ...report.runtimes.flatMap((r) => r.checks),
+        ...report.agents,
+        report.pending,
+    ];
 }
 /** Shorten a path under the user's home, which is where nearly all of these are. */
 function display(filePath, env) {

package/dist/dsh-config.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeBayChatEntry = mergeBayChatEntry;
+exports.writeDshMcpEntry = writeDshMcpEntry;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+// dsh composes every profile from layers, and `~/.dsh/cordis.patch.yml` applies to all of them —
+// its equivalent of `~/.codex/config.toml`. The entry below was hand-wired and RUN on
+// 2026-09-18 (docs/planning/2026-09-18-deepseek-harness-step-by-step.md).
+//
+// WHY A MARKED TEXT BLOCK AND NOT A YAML MERGE. The client's file may contain dsh's `!!js` tags,
+// which a generic YAML parser rejects or, worse, round-trips wrongly. We never parse their file:
+// we own the lines between two markers and nothing else, and we back the file up before writing.
+//
+// The token is a literal, as it is in Codex's config — the file is 0600. `connect` rewrites the
+// block on every run, so a re-issued token replaces the old one rather than leaving it behind.
+const START = "# >>> baychat (managed by `baychat connect dsh` — edits between these lines are overwritten)";
+const END = "# <<< baychat";
+const CORRUPT_BLOCK_MESSAGE = "~/.dsh/cordis.patch.yml has a damaged BayChat block (a start marker without its end, or " +
+    "duplicates). Remove the lines between '# >>> baychat' and '# <<< baychat' by hand, then run " +
+    "`baychat connect dsh` again.";
+/**
+ * Refuse to interpolate anything that could break out of the block's YAML.
+ *
+ * Device tokens are `bay_u_` + hex and the MCP url is ours, so neither check should ever fire in
+ * practice — but a value we did not generate should never be trusted to hold still inside a
+ * double-quoted YAML scalar just because it happens to today.
+ */
+function validateEntry(entry) {
+    if (!/^[A-Za-z0-9_]+$/.test(entry.token)) {
+        throw new Error("Refusing to write a BayChat MCP entry: the device token contains characters other than letters, digits and underscore.");
+    }
+    if (/["'\s]/.test(entry.url)) {
+        throw new Error("Refusing to write a BayChat MCP entry: the MCP URL contains a quote, newline or whitespace.");
+    }
+}
+/**
+ * Find the single well-formed managed block in `existing`, or `null` when there is none at all.
+ *
+ * RULING R22: a START with no END after it, an END with no START, or more than one of either
+ * marker is CORRUPT — the file was hand-edited into a shape we cannot safely replace. Silently
+ * appending a second block on top of that would leave the old one, stale token included, in the
+ * file forever, so this throws instead of guessing.
+ */
+function findManagedBlock(existing) {
+    const firstStart = existing.indexOf(START);
+    const lastStart = existing.lastIndexOf(START);
+    const firstEnd = existing.indexOf(END);
+    const lastEnd = existing.lastIndexOf(END);
+    const hasStart = firstStart >= 0;
+    const hasEnd = firstEnd >= 0;
+    if (!hasStart && !hasEnd)
+        return null;
+    if (hasStart !== hasEnd)
+        throw new Error(CORRUPT_BLOCK_MESSAGE);
+    if (firstStart !== lastStart || firstEnd !== lastEnd)
+        throw new Error(CORRUPT_BLOCK_MESSAGE);
+    if (firstEnd < firstStart)
+        throw new Error(CORRUPT_BLOCK_MESSAGE);
+    return { from: firstStart, to: firstEnd };
+}
+function mergeBayChatEntry(existing, entry) {
+    validateEntry(entry);
+    const block = [
+        START,
+        "- insert:",
+        "    - id: mcp-baychat",
+        "      name: '@deepseek-ai/dsh-mcp-client'",
+        "      config:",
+        "        serverName: baychat",
+        "        transport: streamable-http",
+        `        url: ${entry.url}`,
+        "        headers:",
+        `          Authorization: "Bearer ${entry.token}"`,
+        END,
+        "",
+    ].join("\n");
+    const found = findManagedBlock(existing);
+    if (found) {
+        const after = existing.slice(found.to + END.length).replace(/^\n/, "");
+        return `${existing.slice(0, found.from)}${block}${after}`;
+    }
+    const head = existing === "" || existing.endsWith("\n") ? existing : `${existing}\n`;
+    return `${head}${block}`;
+}
+function writeDshMcpEntry(entry, home = os.homedir()) {
+    const file = path.join(home, ".dsh", "cordis.patch.yml");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const existing = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+    // Computed BEFORE anything is written: a corrupt block, or an unsafe entry, throws here and
+    // leaves the file — and any backup — untouched.
+    const next = mergeBayChatEntry(existing, entry);
+    let backup;
+    if (existing) {
+        backup = `${file}.baychat-backup`;
+        fs.writeFileSync(backup, existing, { mode: 0o600 });
+    }
+    // Atomic: write to a temp file in the same directory, then rename over the target. A reader —
+    // or a crash mid-write — never sees a half-written config. Same pattern as `writeModePatches`
+    // in relay/acp/agents.ts and `writeHermesMcp` in hermes-mcp.ts.
+    const temp = `${file}.${process.pid}.${(0, crypto_1.randomUUID)()}.tmp`;
+    try {
+        fs.writeFileSync(temp, next, { mode: 0o600, flag: "wx" });
+        fs.chmodSync(temp, 0o600); // `mode` above is filtered by the umask
+        fs.renameSync(temp, file);
+    }
+    catch (err) {
+        fs.rmSync(temp, { force: true });
+        throw err;
+    }
+    return { file, backup };
+}

package/dist/index.js

@@ -4,10 +4,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./commands");
 const approve_hook_1 = require("./approve-hook");
 const session_name_1 = require("./session-name");
+const start_command_1 = require("./start-command");
+const update_command_1 = require("./update-command");
 const session_command_1 = require("./session-command");
 const doctor_command_1 = require("./doctor-command");
 const hermes_1 = require("./hermes");
 const connect_1 = require("./connect");
+const connect_plan_1 = require("./connect-plan");
+const runtimes_1 = require("./runtimes");
 const mcp_1 = require("./mcp");
 const mcp_config_1 = require("./mcp-config");
 const commands_2 = require("./relay/commands");
@@ -29,8 +33,19 @@ Exit 0: step succeeded; 2: awaiting approval or expired; 1: error.
 const HELP = `baychat — BayChat connector CLI for agent sessions (Claude Code, Codex)
 
 Usage:
+  baychat                               Start a session. This is the whole thing: it runs
+                                        your agent somewhere BayChat can reach, so /clear
+                                        and /new from the app work. Sign in once with
+                                        \`baychat login\` first
+  baychat start [name] [--runtime <runtime>]
+                                        The same, with a name for the session
+  baychat update                        Bring this machine onto the current version —
+                                        the package, every connected client's config, and
+                                        the relay daemon (which otherwise keeps running
+                                        old code). \`baychat\` does this for you once a day
   baychat join [name] [group] [--sessions | --private | --group <title>] [--runtime <runtime>]
   baychat join --session <name> --group <title> --runtime codex
+  baychat skill --runtime codex|claude   Read the current packaged skill workflow
                                         Join and connect incoming messages in this terminal
   baychat session-name --runtime <runtime>
                                         Stable automatic name for this verified session
@@ -167,9 +182,15 @@ function numberFlag(args, name) {
 }
 async function main() {
     const [command, ...args] = process.argv.slice(2);
+    // BARE `baychat` STARTS A SESSION. The bar is "download BayChat, start a session, nothing
+    // else", and a usage dump printed at somebody who typed the product's own name is the
+    // "something else". `--help` still prints the help, and `start` refuses with one sentence
+    // when this machine is not signed in, so nothing is launched from an unusable state.
+    if (command === undefined)
+        return (0, start_command_1.cmdStart)([]);
     // Setup help must be side-effect free. Do not apply this to chat commands:
     // a sent message may legitimately contain the literal text "--help".
-    if (["login", "link", "connect", "pair", "join"].includes(command) &&
+    if (["login", "link", "connect", "pair", "join", "skill"].includes(command) &&
         args.some((arg) => arg === "--help" || arg === "-h")) {
         console.log(command === "login" ? LOGIN_HELP : HELP);
         return 0;
@@ -181,6 +202,19 @@ async function main() {
             return 0;
         case "join":
             return (0, session_command_1.cmdJoinSession)(args);
+        case "start":
+            return (0, start_command_1.cmdStart)(args);
+        case "update":
+            return (0, update_command_1.cmdUpdate)();
+        case "skill": {
+            const runtime = args[1];
+            if (args.length !== 2 ||
+                args[0] !== "--runtime" ||
+                (runtime !== "codex" && runtime !== "claude"))
+                throw new Error("Usage: baychat skill --runtime codex|claude");
+            console.log((0, runtimes_1.renderCommandFor)(runtime));
+            return 0;
+        }
         case "session-name": {
             (0, args_1.rejectUnknownFlags)(args, ["--runtime"], "baychat session-name --runtime <runtime>");
             const runtime = (0, args_1.flag)(args, "--runtime") ?? (0, owner_pid_1.detectRuntime)(profiles_1.RUNTIME_PROFILES);
@@ -393,7 +427,8 @@ async function main() {
         case "connect": {
             // A bare `connect` prints the client menu; positional() skips a leading flag
             // so `connect --base x codex` still finds the client.
-            return await (0, connect_1.cmdConnect)((0, args_1.positional)(args), { base: (0, args_1.flag)(args, "--base") });
+            const { client, ...options } = (0, connect_plan_1.parseConnectArgs)(args);
+            return await (0, connect_1.cmdConnect)(client, options);
         }
         case "mcp-config": {
             // `--client` with no value is a typo, not a request for the menu: pass the

package/dist/relay/acp/agents.js

@@ -0,0 +1,186 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACP_AGENTS = exports.DSH_LOCAL_TOOLS = void 0;
+exports.acpAgent = acpAgent;
+exports.matchesTestedVersion = matchesTestedVersion;
+exports.modeAllowedHere = modeAllowedHere;
+exports.acpPatchDir = acpPatchDir;
+exports.patchPath = patchPath;
+exports.writeModePatches = writeModePatches;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../../config");
+const modes_1 = require("./modes");
+// Every tool plugin in dsh's `acp` profile (`--profile acp --dump-config`, 0.1.5-rc.2) [run].
+// MCP clients are mounted per ACP session by dsh-acp itself and are untouched by these.
+// Confirmed against docs/planning/2026-09-19-acp-research/dump-acp-default.yml — the tool-* ids
+// there match this list exactly, in the same order.
+exports.DSH_LOCAL_TOOLS = [
+    "tool-bash", "tool-pwsh", "tool-jobs", "tool-fs", "tool-fs-search", "tool-skill",
+    "tool-subagent-control", "tool-subagent-list-agents", "tool-subagent", "tool-subagent-fork",
+    "tool-workflow", "tool-todo", "tool-goal", "tool-ralph", "tool-web",
+];
+const disable = (ids, why) => [`# Written by BayChat. ${why}`, ...ids.flatMap((id) => [`- id: ${id}`, "  disabled: true"]), ""].join("\n");
+const dsh = {
+    id: "dsh",
+    label: "DeepSeek Harness",
+    bin: "dsh",
+    patches: {
+        chat: disable(exports.DSH_LOCAL_TOOLS, "chat mode: no local tools at all."),
+        read: disable(exports.DSH_LOCAL_TOOLS.filter((id) => id !== "tool-fs" && id !== "tool-fs-search"), "read mode: file read and search only — no shell, no subagents, no web."),
+    },
+    launch(mode, patchDir) {
+        const args = ["--profile", "acp"];
+        if (this.patches[mode])
+            args.push("--patch", patchPath(this, mode, patchDir));
+        // `danger-full-access` is deliberately unreachable from here: no mode maps to it.
+        return { args, env: { DSH_PERMISSION_MODE: mode === "full" ? "workspace-write" : "read-only" } };
+    },
+    // dsh's Windows sandbox reports itself `partial` (Everyone-writable objects, NTFS hard links)
+    // [source], so the modes that RELY on it are withheld there. `chat` needs no sandbox and
+    // `read`'s write fence is an in-process check.
+    modesFor: (platform) => (platform === "win32" ? ["chat", "read"] : ["chat", "read", "ask", "full"]),
+    classifyError(message) {
+        if (/no API key|MISSING_CREDENTIAL|INVALID_CREDENTIAL/i.test(message))
+            return "missing-key";
+        if (/mcp-client\(baychat\)/i.test(message))
+            return "baychat-unreachable";
+        if (/already active|session is active/i.test(message))
+            return "busy";
+        if (/session cwd does not match/i.test(message))
+            return "session";
+        return undefined;
+    },
+    keyHint: "DeepSeek has no API key on that computer. There, run `dsh web` and add the key on the Models page.",
+    installHint: "Install it with `npm install -g @deepseek-ai/dsh`, then run `baychat connect dsh` again.",
+    confidence: "run",
+    checked: "2026-09-19",
+    testedVersion: "0.1.5-rc.2",
+};
+exports.ACP_AGENTS = [dsh];
+function acpAgent(id) {
+    return exports.ACP_AGENTS.find((row) => row.id === id);
+}
+/** A version-string character: digits, letters, dot, plus, hyphen — the semver/rc alphabet. */
+const VERSION_TOKEN_CHAR = /[0-9A-Za-z.+-]/;
+/**
+ * Does `version` (raw `--version` output) contain `tested` as a WHOLE version token, not merely
+ * as a substring?
+ *
+ * `"0.1.5-rc.20".includes("0.1.5-rc.2")` is `true` — a plain substring check silently passes a
+ * different release and the mismatch warning this exists for never shows. So `tested` must be
+ * bounded: the character before it is the start of the string, something that is not part of a
+ * version token, or a leading `v` (allowed unconditionally — a version prefix, not a token
+ * character to fence against); the character after it is the end of the string or something that
+ * is not part of a version token. `--version` output varies by CLI — `"0.1.5-rc.2"`,
+ * `"dsh 0.1.5-rc.2"`, `"v0.1.5-rc.2"`, `"0.1.5-rc.2 (linux-x64)"` — and this matches all of them
+ * while refusing `"0.1.5-rc.20"`, `"10.1.5-rc.2"`, `"0.1.5-rc.2.1"` and `"0.1.5-rc.2-beta"`.
+ */
+function matchesTestedVersion(version, tested) {
+    if (!tested)
+        return false;
+    let from = 0;
+    for (;;) {
+        const at = version.indexOf(tested, from);
+        if (at === -1)
+            return false;
+        const before = at === 0 ? undefined : version[at - 1];
+        const after = version[at + tested.length];
+        const boundedBefore = before === undefined || before === "v" || !VERSION_TOKEN_CHAR.test(before);
+        const boundedAfter = after === undefined || !VERSION_TOKEN_CHAR.test(after);
+        if (boundedBefore && boundedAfter)
+            return true;
+        from = at + 1;
+    }
+}
+/**
+ * May a session of this agent run in `mode`, in a folder whose ceiling is `maxMode`, on this
+ * platform? The ONE rule: `/mode` from the chat and `acp-register` from `connect` both ask it.
+ */
+function modeAllowedHere(row, mode, maxMode, platform) {
+    if ((0, modes_1.modeRank)(mode) > (0, modes_1.modeRank)(maxMode)) {
+        return { ok: false, reason: `${mode} is above the highest mode allowed for that folder (${maxMode}). That ceiling is set on the computer, never from a chat: run \`baychat connect ${row.id}\` there to change it.` };
+    }
+    if (!row.modesFor(platform).includes(mode)) {
+        return { ok: false, reason: `${mode} is not offered on that computer's operating system, because ${row.label}'s sandbox cannot fully enforce it there.` };
+    }
+    return { ok: true };
+}
+/** Where mode patches live: `~/.baychat/acp/`. */
+function acpPatchDir() {
+    return path.join((0, config_1.configDir)(), "acp");
+}
+function patchPath(row, mode, dir) {
+    return path.join(dir, `${row.id}-${mode}.yml`);
+}
+/**
+ * (Re)write this agent's mode patches. Idempotent; called by `connect`, at daemon start and
+ * before every turn.
+ *
+ * NEVER TRUNCATE IN PLACE. Two sessions drain concurrently, so one session's rewrite can land
+ * while another's freshly spawned agent is reading the same patch — and an empty `chat` patch is
+ * an agent with every local tool. A patch that is already right is left alone; one that is not is
+ * written beside it and renamed over it, so a reader sees the old file or the new, never half.
+ */
+function writeModePatches(row, dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    for (const [mode, content] of Object.entries(row.patches)) {
+        const file = patchPath(row, mode, dir);
+        if (readOrUndefined(file) === content) {
+            fs.chmodSync(file, 0o600); // permissions only — the content and the inode stay as they are
+            continue;
+        }
+        const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+        try {
+            fs.writeFileSync(tmp, content, { mode: 0o600, flag: "wx" });
+            fs.chmodSync(tmp, 0o600); // `mode` is filtered by the umask
+            fs.renameSync(tmp, file);
+        }
+        catch (err) {
+            fs.rmSync(tmp, { force: true });
+            throw err;
+        }
+    }
+}
+/** A read error (absent, unreadable) means "write it". */
+function readOrUndefined(file) {
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/relay/acp/approval.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.askPhone = askPhone;
+const api_1 = require("../../api");
+const approve_hook_1 = require("../../approve-hook");
+const HOLD_SECONDS = 25; // under the usual 60s proxy idle timeout — same as approve-hook
+const MAX_CONSECUTIVE_FAILURES = 3;
+const RETRY_DELAY_MS = 2_000;
+const ALLOW_INDEX = 0; // the ONLY index that means yes
+/**
+ * Put a decision card on the owner's phone and wait for the tap.
+ *
+ * NEVER THROWS, and every path that is not an explicit "Allow this once" is a refusal: an
+ * unreachable server, a status we do not know, a withdrawn card, the deadline. The card itself
+ * never expires server-side; our deadline exists so a turn cannot hold a process forever, and
+ * reaching it REFUSES. Silence is never a yes.
+ */
+async function askPhone(params, deps = {}) {
+    const request = deps.request ?? api_1.apiRequest;
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const waitSeconds = params.waitSeconds ?? approve_hook_1.DEFAULT_WAIT_SECONDS;
+    const deadline = now() + waitSeconds * 1000;
+    const hold = () => Math.max(1, Math.min(HOLD_SECONDS, Math.ceil((deadline - now()) / 1000)));
+    const no = (reason) => ({ allowed: false, reason });
+    try {
+        let reply = await request(params.auth, "POST", "/api/device-api/approvals", {
+            session: params.session,
+            conversationId: params.conversationId,
+            question: params.question,
+            options: [...approve_hook_1.APPROVE_OPTIONS],
+            wait: hold(),
+        });
+        const requestId = typeof reply.requestId === "string" ? reply.requestId : "";
+        if (!requestId)
+            return no("BayChat did not return an approval id");
+        let failures = 0;
+        for (;;) {
+            if (reply.status === "answered") {
+                return reply.answerIndex === ALLOW_INDEX
+                    ? { allowed: true, reason: "approved in BayChat" }
+                    : no(`answered "${reply.answer ?? approve_hook_1.APPROVE_OPTIONS[1]}" in BayChat`);
+            }
+            if (reply.status === "cancelled")
+                return no("the decision was withdrawn in BayChat");
+            if (reply.status !== "waiting")
+                return no(`BayChat answered with a status this relay does not understand ("${String(reply.status)}")`);
+            if (deadline - now() <= 0)
+                return no(`nobody answered within ${waitSeconds}s — the card is still in BayChat, and this request was refused`);
+            try {
+                reply = await request(params.auth, "GET", `/api/device-api/approvals/${encodeURIComponent(requestId)}?wait=${hold()}`);
+                failures = 0;
+            }
+            catch (err) {
+                if (err instanceof api_1.ApiError && err.status < 500 && err.status !== 429)
+                    return no(`BayChat refused the wait — ${err.message}`);
+                failures += 1;
+                if (failures >= MAX_CONSECUTIVE_FAILURES)
+                    return no(`BayChat became unreachable while waiting — ${err instanceof Error ? err.message : String(err)}`);
+                await sleep(RETRY_DELAY_MS);
+            }
+        }
+    }
+    catch (err) {
+        return no(`BayChat could not be asked — ${err instanceof Error ? err.message : String(err)}`);
+    }
+}