baychat 0.21.4 → 0.22.0

package/dist/relay/acp/client.js

@@ -0,0 +1,253 @@
+"use strict";
+// One ACP turn: spawn the agent, open its session, send one prompt, report what happened.
+//
+// WHY A PROCESS PER TURN. Same trade `codex-app-server.ts` made and for the same reasons: a held
+// agent process buys ~0.6 s and costs a supervision problem — restarts, health, a wedged child
+// holding a session's queue, cleanup at shutdown — for a path that runs at human speed. ACP lets
+// us pay that nothing: `session/resume` reopens the conversation with its memory by id.
+//
+// NEVER THROWS. Every failure is an outcome with a cause the runner can act on and a reason a
+// person can read. NO SHELL, EVER: the prompt carries text written by other people in a room.
+//
+// THE CREDENTIAL. BayChat's MCP endpoint and the device token reach the agent inside the
+// `session/new` / `session/resume` request, i.e. on its stdin. Not argv (visible in `ps`), not
+// env (inherited by every command the agent runs), not a file.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAcpTurn = runAcpTurn;
+const stream_1 = require("stream");
+const runtime_binary_1 = require("../../runtime-binary");
+const sdk_1 = require("./sdk");
+const TURN_TIMEOUT_MS = 10 * 60_000;
+const HANDSHAKE_TIMEOUT_MS = 30_000;
+/** An error that already knows its cause — thrown inside `drive`, never out of `runAcpTurn`. */
+class TurnFailure extends Error {
+    cause;
+    constructor(cause, message) {
+        super(message);
+        this.cause = cause;
+    }
+}
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function errorText(err) {
+    if (!(err instanceof Error))
+        return String(err);
+    const data = err.data;
+    const details = isRecord(data) ? data.details : undefined;
+    return typeof details === "string" ? `${err.message}: ${details}` : err.message;
+}
+/** Reasons and logs carry agent text, and reasons are posted in the room: never the credential. */
+const redact = (text) => text.replace(/Bearer\s+\S+/g, "Bearer [redacted]").replace(/bay_[A-Za-z0-9_]+/g, "bay_[redacted]");
+async function runAcpTurn(req, deps) {
+    const log = (line) => deps.log?.(redact(line));
+    const failed = (cause, reason, sessionId) => ({
+        kind: "failed",
+        cause,
+        reason: redact(reason),
+        ...(sessionId ? { sessionId } : {}),
+    });
+    // Stopped before it began: start nothing. A real spawn reports a bad binary as a LATER
+    // 'error' event, and with no listener yet that event would crash the daemon.
+    if (req.signal?.aborted)
+        return failed("cancelled", "stopped from the chat");
+    const turnTimeout = deps.turnTimeoutMs ?? TURN_TIMEOUT_MS;
+    const handshakeTimeout = deps.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    // A classifier that throws must not strand the turn with its process still running.
+    const classify = (message) => {
+        try {
+            return req.classifyError(message);
+        }
+        catch (err) {
+            log(`acp: error classifier failed — ${errorText(err)}`);
+            return undefined;
+        }
+    };
+    let sdk;
+    try {
+        sdk = await (0, sdk_1.loadAcpSdk)();
+    }
+    catch (err) {
+        return failed("spawn", `the ACP library could not be loaded: ${errorText(err)}`);
+    }
+    let child;
+    try {
+        // A Windows `.cmd` shim needs its interpreter named — same fix as `codex-app-server.ts`.
+        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform);
+        child = deps.spawn(plan.file, [...plan.prefixArgs, ...req.args], {
+            cwd: req.cwd,
+            env: req.env,
+            shell: false,
+            windowsHide: true,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    catch (err) {
+        return failed("spawn", `the agent could not be started: ${errorText(err)}`);
+    }
+    if (!child.stdin || !child.stdout) {
+        child.kill("SIGTERM");
+        return failed("spawn", "the agent started without stdio pipes");
+    }
+    const stdin = child.stdin;
+    const stdout = child.stdout;
+    return new Promise((resolve) => {
+        let settled = false;
+        let phase = "handshake";
+        let sessionId;
+        /** True while `session/load` replays old history — those updates are not this turn's. */
+        let replaying = false;
+        let stderrTail = "";
+        let timer;
+        /** Permission questions waiting on a person. The turn clock runs only while this is zero. */
+        let asking = 0;
+        const calls = new Map();
+        const finish = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            req.signal?.removeEventListener("abort", onAbort);
+            child.kill("SIGTERM");
+            // A child that ignores the polite signal must not outlive the turn and keep acting.
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref();
+            resolve(outcome);
+        };
+        const fail = (cause, reason) => finish(failed(cause, reason, sessionId));
+        const arm = (ms, cause, reason) => {
+            clearTimeout(timer);
+            // Never after the end, never while a person is being asked: a stray timer would hold the
+            // event loop open for the whole turn budget and fire into a finished turn.
+            if (settled || asking > 0)
+                return;
+            timer = setTimeout(() => fail(cause, reason), ms);
+        };
+        const onAbort = () => fail("cancelled", "stopped from the chat");
+        child.on("error", (err) => fail("spawn", `the agent could not be started: ${errorText(err)}`));
+        child.on("exit", (code) => fail(phase === "handshake" ? "handshake" : "turn", `the agent exited (code ${code ?? "?"}) before the turn finished${stderrTail ? `: ${stderrTail.trim().slice(-300)}` : ""}`));
+        // Writing into a pipe whose reader died is an EPIPE 'error' event; unheard, it crashes the daemon.
+        stdin.on("error", (err) => log(`acp: agent stdin closed — ${errorText(err)}`));
+        child.stderr?.on("data", (d) => {
+            stderrTail = (stderrTail + d.toString()).slice(-600);
+        });
+        // Aborted while the SDK loaded: the child exists now, so stop only after its listeners are on.
+        if (req.signal?.aborted)
+            return onAbort();
+        req.signal?.addEventListener("abort", onAbort, { once: true });
+        const remember = (update) => {
+            const id = update.toolCallId;
+            if (typeof id !== "string")
+                return;
+            const known = calls.get(id);
+            const call = {
+                toolCallId: id,
+                title: typeof update.title === "string" ? update.title : (known?.title ?? ""),
+                rawInput: isRecord(update.rawInput) ? update.rawInput : (known?.rawInput ?? {}),
+            };
+            calls.set(id, call);
+            if (known)
+                return;
+            try {
+                req.onToolCall?.(call);
+            }
+            catch (err) {
+                log(`acp: tool-call observer failed — ${errorText(err)}`);
+            }
+        };
+        const client = {
+            async sessionUpdate(params) {
+                if (replaying || !isRecord(params.update))
+                    return;
+                const kind = params.update.sessionUpdate;
+                if (kind === "tool_call" || kind === "tool_call_update")
+                    remember(params.update);
+            },
+            async requestPermission(params) {
+                // The clock stops while a person is being asked: a card may wait an hour, and that is
+                // the owner's time, not a wedged agent's.
+                clearTimeout(timer);
+                asking++;
+                let verdict = "reject";
+                try {
+                    verdict = await req.onPermission(calls.get(params.toolCall?.toolCallId ?? ""));
+                }
+                catch (err) {
+                    log(`acp: permission handler failed, refusing — ${errorText(err)}`);
+                }
+                finally {
+                    asking--;
+                }
+                arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
+                // ONLY the single-use kinds. `allow_always` would turn one tap into a standing grant.
+                const want = verdict === "allow" ? "allow_once" : "reject_once";
+                const option = (params.options ?? []).find((o) => o.kind === want);
+                return option
+                    ? { outcome: { outcome: "selected", optionId: option.optionId } }
+                    : { outcome: { outcome: "cancelled" } };
+            },
+        };
+        const drive = async () => {
+            const conn = new sdk.ClientSideConnection(() => client, sdk.ndJsonStream(stream_1.Writable.toWeb(stdin), stream_1.Readable.toWeb(stdout)));
+            arm(handshakeTimeout, "handshake", `the agent did not complete the ACP handshake within ${Math.round(handshakeTimeout / 1000)}s`);
+            const init = await conn.initialize({
+                protocolVersion: sdk.PROTOCOL_VERSION,
+                // We offer the agent nothing of ours: no file access through us, no terminal through us.
+                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
+            });
+            const caps = (init.agentCapabilities ?? {});
+            if (!caps.mcpCapabilities?.http)
+                throw new TurnFailure("unsupported", "this agent cannot connect to an HTTP MCP server, so it could never reach BayChat's tools");
+            const canResume = caps.sessionCapabilities?.resume !== undefined && caps.sessionCapabilities.resume !== null;
+            const canLoad = caps.loadSession === true;
+            phase = "session";
+            let fresh = false;
+            let memoryLost = false;
+            const open = { cwd: req.cwd, mcpServers: req.mcpServers };
+            if (req.sessionId) {
+                if (!canResume && !canLoad) {
+                    // Starting fresh on every message would answer the room as an agent with no memory of
+                    // it, every time — worse than not answering.
+                    throw new TurnFailure("unsupported", "this agent can neither resume nor load a session, so it cannot keep a conversation between messages");
+                }
+                try {
+                    if (canResume)
+                        await conn.resumeSession({ sessionId: req.sessionId, ...open });
+                    else {
+                        replaying = true;
+                        await conn.loadSession({ sessionId: req.sessionId, ...open });
+                    }
+                    sessionId = req.sessionId;
+                }
+                catch (err) {
+                    const text = errorText(err);
+                    const cause = classify(text);
+                    // A KNOWN reason (busy in a terminal, wrong folder, BayChat unreachable, no key) is an
+                    // answer about this session and must not be papered over with a fresh one.
+                    if (cause) {
+                        sessionId = req.sessionId;
+                        throw new TurnFailure(cause, text);
+                    }
+                    log(`acp: could not reopen session ${req.sessionId} (${text}) — starting a new one`);
+                    memoryLost = true;
+                }
+                finally {
+                    replaying = false;
+                }
+            }
+            if (!sessionId) {
+                const created = await conn.newSession(open);
+                sessionId = created.sessionId;
+                fresh = true;
+            }
+            phase = "turn";
+            arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
+            const text = fresh && req.freshPreamble ? `${req.freshPreamble}\n\n${req.prompt}` : req.prompt;
+            const result = await conn.prompt({ sessionId, prompt: [{ type: "text", text }] });
+            return { kind: "completed", sessionId, stopReason: String(result.stopReason ?? "unknown"), fresh, memoryLost };
+        };
+        drive().then(finish, (err) => {
+            if (err instanceof TurnFailure)
+                return fail(err.cause, err.message);
+            const text = errorText(err);
+            fail(classify(text) ?? (phase === "turn" ? "turn" : phase), text);
+        });
+    });
+}

package/dist/relay/acp/commands.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAcpSessionCommand = runAcpSessionCommand;
+const agents_1 = require("./agents");
+const modes_1 = require("./modes");
+/**
+ * The session commands that mean something different — or only mean something — for a session
+ * the relay runs over ACP. Kept out of `daemon.ts`, which only calls in.
+ *
+ * Returns true when the command was answered here; false hands it back to the daemon's own
+ * branches, which are then exactly what they were before ACP existed. A non-ACP session only
+ * ever reaches this for `/mode-*` and `/stop`, and gets a refusal that says why.
+ *
+ * Every path replies, as in `runSessionCommand`: a command produces no agent turn, so silence
+ * would be indistinguishable from failure.
+ */
+async function runAcpSessionCommand(acp, session, target, message, command, say) {
+    if (command.mode) {
+        // Anyone with COMMAND ACCESS — the owner, or a Bay owner/admin she granted (Karmen's
+        // decision, 19 Sep 2026; owner-only before). The daemon only routes a command here when the
+        // server said `commandAuthorized === true`, so this is a second, defensive check, not the
+        // gate. Absent is no. The rule-file ceiling and the platform still cap it, in `setMode`.
+        if (message.commandAuthorized !== true && message.senderIsOwner !== true) {
+            await say(`You need command access (from the owner of "${session}") to change what it may do.`);
+            return true;
+        }
+        // `setMode` holds the one rule (rule-file ceiling, then platform) — not re-implemented here.
+        const result = acp.setMode(session, command.mode);
+        await say(result.ok ? `"${session}" is now in ${(0, modes_1.describeMode)(result.mode)}` : result.reason);
+        return true;
+    }
+    if (command.id === "stop") {
+        if (!target.acp) {
+            // Not "is not doing anything": the relay cannot see a terminal agent's turn at all.
+            await say(`"${session}" is not run by the relay, so /stop cannot reach it. Stop it in its own terminal.`);
+            return true;
+        }
+        await say(acp.stop(session)
+            ? `Stopped "${session}". Anything it had already done stays done.`
+            : `"${session}" is not doing anything right now.`);
+        return true;
+    }
+    if (command.id === "status" && target.acp) {
+        const row = (0, agents_1.acpAgent)(target.acp.agent);
+        const s = acp.status(session);
+        await say([
+            `Session "${session}" — run by the relay, no terminal`,
+            `  agent: ${row?.label ?? target.acp.agent}${row ? ` (tested with ${row.testedVersion})` : ""}`,
+            `  mode: ${(0, modes_1.describeMode)(target.acp.mode)}`,
+            `  folder: ${target.acp.cwd}`,
+            `  now: ${s.running ? "working on a turn" : "idle"}, ${s.queued} message(s) waiting`,
+            `  memory: ${target.acp.sessionId ? "kept between messages" : "fresh on the next message"}`,
+        ].join("\n"));
+        return true;
+    }
+    if (command.id === "exit" && target.relayOwned) {
+        await say(`"${session}" is run by the relay on that computer and has no terminal to detach. Use /stop to cancel a running turn.`);
+        return true;
+    }
+    if (target.acp && (command.id === "clear" || command.id === "new")) {
+        // There is no terminal to type into: forgetting the ACP session id IS the fresh chat. The
+        // running turn is stopped first, or it would finish into the memory being closed.
+        acp.stop(session);
+        acp.reset(session);
+        await say(`"${session}" will start a fresh conversation with your next message. Its earlier memory is closed.`);
+        return true;
+    }
+    return false;
+}

package/dist/relay/acp/daemon-glue.js

@@ -0,0 +1,201 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACP_LAPSED_FLOOR_MS = exports.ACP_KEEPALIVE_MS = void 0;
+exports.keepAcpSessionsAlive = keepAcpSessionsAlive;
+exports.startAcpUpkeep = startAcpUpkeep;
+exports.hasLapsedAcpSession = hasLapsedAcpSession;
+exports.acpKeepAliveScheduler = acpKeepAliveScheduler;
+exports.registerAcpFrame = registerAcpFrame;
+exports.acpAttachRefusal = acpAttachRefusal;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const agents_1 = require("./agents");
+const modes_1 = require("./modes");
+const policy_1 = require("./policy");
+const presence_1 = require("./presence");
+/**
+ * The daemon's ACP upkeep, kept out of `daemon.ts` so that file only calls in.
+ *
+ * Everything here is reached from a thin call site in the daemon: start-up (patches and the
+ * keep-alive), the live-session list (a lapsed relay-owned session), and the `acp-register`
+ * socket frame. None of it runs for a session without `acp`.
+ */
+/** The server stops feeding a session idle for 24 h, and only an MCP call refreshes it. */
+exports.ACP_KEEPALIVE_MS = 12 * 60 * 60_000;
+const errText = (err) => (err instanceof Error ? err.message : String(err));
+/** Refresh (or re-join) every relay-owned session. Failures are logged, never thrown. */
+async function keepAcpSessionsAlive(deps) {
+    if (!deps.auth)
+        return;
+    const caller = (deps.caller ?? presence_1.deviceMcpCaller)(deps.auth);
+    for (const target of deps.registry.all()) {
+        if (!target.relayOwned)
+            continue;
+        try {
+            const how = await (0, presence_1.keepSessionAlive)(caller, target.name);
+            if (how === "rejoined")
+                deps.log(`acp: re-joined ${target.name}`);
+        }
+        catch (err) {
+            deps.log(`acp: could not keep ${target.name} alive — ${errText(err)}`);
+        }
+    }
+}
+/**
+ * Daemon start: (re)write every agent's mode patches, refresh relay-owned sessions now, and
+ * again every 12 h — a quiet relay-owned session would otherwise go deaf overnight. Returns
+ * the timer for `stop()` to clear; it is unref'd so it never holds the process open.
+ */
+function startAcpUpkeep(keepAlive, log) {
+    for (const row of agents_1.ACP_AGENTS) {
+        try {
+            (0, agents_1.writeModePatches)(row, (0, agents_1.acpPatchDir)());
+        }
+        catch (err) {
+            // Not fatal: the runner rewrites them before every turn and reports its own failure.
+            log(`acp: could not write ${row.id}'s mode patches — ${errText(err)}`);
+        }
+    }
+    void keepAlive();
+    const timer = setInterval(() => void keepAlive(), exports.ACP_KEEPALIVE_MS);
+    timer.unref();
+    return timer;
+}
+/** A relay-owned session missing from the server's live list has lapsed: re-join it now. */
+function hasLapsedAcpSession(registry, liveNames) {
+    return registry.all().some((t) => t.relayOwned && !liveNames.includes(t.name));
+}
+/** A lapsed session is re-joined at most this often: the feed reports live sessions every poll. */
+exports.ACP_LAPSED_FLOOR_MS = 5 * 60_000;
+/**
+ * One keep-alive at a time, and the lapsed trigger throttled.
+ *
+ * `run` is the start-up and 12 h path: never throttled, but a call while a run is in flight joins
+ * that run instead of starting a second. `lapsed` is the per-poll path: while a relay-owned
+ * session stays missing from the live list it would otherwise fire on EVERY poll (~25 s).
+ */
+function acpKeepAliveScheduler(keepAlive, now = Date.now) {
+    let inFlight;
+    let lastLapsed = -Infinity;
+    const run = () => (inFlight ??= keepAlive().finally(() => {
+        inFlight = undefined;
+    }));
+    return {
+        run,
+        lapsed(registry, liveNames) {
+            if (!hasLapsedAcpSession(registry, liveNames) || now() - lastLapsed < exports.ACP_LAPSED_FLOOR_MS)
+                return Promise.resolve();
+            lastLapsed = now();
+            return run();
+        },
+    };
+}
+/**
+ * Register a relay-owned ACP session from an `acp-register` frame — or refuse it.
+ *
+ * The socket is this user's own, but the frame still cannot grant more than the rule file: the
+ * same folder check the runner makes before every turn is made before registering, and the mode
+ * must be an ACP mode. Nor can the frame choose what runs or raise what runs (Ruling R25): its
+ * `runtimeBin` is IGNORED — the daemon resolves the agent's binary itself, and an existing
+ * session keeps the one it has — and an existing session's mode may be kept or lowered here,
+ * never raised; raising is a `/mode-…` from the chat (the owner, or anyone with command access). The frame is parsed JSON, so its
+ * shape is checked here too rather than trusted from the type.
+ */
+function registerAcpFrame(frame, deps) {
+    const refused = { ok: false, message: "That ACP session could not be registered." };
+    const acp = frame.acp;
+    if (!acp || typeof frame.session !== "string" || frame.session === "" || typeof acp.agent !== "string" || typeof acp.cwd !== "string") {
+        return refused;
+    }
+    const row = (0, agents_1.acpAgent)(acp.agent);
+    if (!row || !(0, modes_1.isAcpMode)(acp.mode) || !path.isAbsolute(acp.cwd))
+        return refused;
+    const folder = (0, policy_1.checkFolder)((deps.loadPolicy ?? policy_1.loadPolicy)(), row.id, acp.cwd);
+    if (!folder.ok)
+        return { ok: false, message: folder.reason };
+    let cwd;
+    try {
+        cwd = fs.realpathSync(acp.cwd); // stored resolved: a link swapped later cannot move the session
+    }
+    catch {
+        return refused; // checkFolder has just resolved it, so only a race lands here
+    }
+    // `upsert` MERGES, so registering over a terminal session (Claude, Codex…) would keep its
+    // resume id, add `acp`, and hand its name to this agent from then on. Refused instead.
+    const current = deps.registry.get(frame.session);
+    if (current && !current.acp) {
+        return { ok: false, message: `A session named "${frame.session}" already exists on this computer and is not run by the relay. Choose another name (baychat connect dsh --session <name>).` };
+    }
+    const existing = current?.acp;
+    if (existing && (0, modes_1.modeRank)(acp.mode) > (0, modes_1.modeRank)(existing.mode)) {
+        return { ok: false, message: `A running session's mode can only be raised from the chat, with /mode-${acp.mode} (you, or anyone you gave command access).` };
+    }
+    // The same rule `/mode` applies: a registration cannot start above the folder's ceiling or in
+    // a mode this platform's sandbox cannot enforce. Checked for a kept mode too — the ceiling may
+    // have been lowered since.
+    const allowed = (0, agents_1.modeAllowedHere)(row, acp.mode, folder.maxMode, deps.platform ?? process.platform);
+    if (!allowed.ok)
+        return { ok: false, message: allowed.reason };
+    let runtimeBin = current?.runtimeBin;
+    if (!runtimeBin) {
+        const found = deps.resolveBinary(row.bin);
+        if (!found.ok || !path.isAbsolute(found.path)) {
+            return { ok: false, message: `${row.label} is not installed where the relay can find it. ${row.installHint}` };
+        }
+        runtimeBin = found.path;
+    }
+    // The agent's own session id survives a re-register in the same folder; a moved folder
+    // starts fresh, because that id names a conversation held in the old one.
+    const keep = existing?.cwd === cwd && existing.sessionId ? { sessionId: existing.sessionId } : {};
+    deps.registry.upsert({
+        name: frame.session,
+        runtime: row.id, // from the agent row, never from the frame
+        runtimeBin,
+        relayOwned: true,
+        acp: { agent: row.id, cwd, mode: acp.mode, ...keep },
+    });
+    deps.log(`acp: registered ${frame.session} (${row.id}, ${acp.mode}, ${cwd})`);
+    return { ok: true };
+}
+/**
+ * The refusal for an `attach` frame that names a relay-run session, or undefined to attach as
+ * ever. `upsert` merges, so an attach over it would keep `acp` and give the name two drivers.
+ */
+function acpAttachRefusal(registry, session) {
+    return registry.get(session)?.acp
+        ? `"${session}" is run by the relay on this computer; attach a terminal under a different session name.`
+        : undefined;
+}

package/dist/relay/acp/dump-config.js

@@ -0,0 +1,31 @@
+"use strict";
+// Reads a `dsh --dump-config` YAML dump (a flat list of plugin entries) and answers, for one
+// plugin id, whether ITS OWN entry carries `disabled: true`.
+//
+// WHY NOT A SINGLE REGEX OVER THE WHOLE TEXT. `id: tool-subagent` is a PREFIX of
+// `id: tool-subagent-control`, `id: tool-subagent-list-agents` and `id: tool-subagent-fork` — and
+// `\b` (a word/non-word boundary) sits right at the hyphen after "subagent", so a regex like
+// `id: ${id}\b[\s\S]{0,200}?disabled: true` matches the START of any of those longer ids too. In
+// the recorded chat-mode dump every id in that family happens to be disabled together, so the bug
+// passed by coincidence — it was checking "is SOME entry starting with this prefix disabled",
+// not "is THIS entry disabled". This module finds the entry by its own exact `- id: <id>` line
+// and looks only inside that entry's own lines (up to the next top-level `- ` list item).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pluginDisabled = pluginDisabled;
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * Is the plugin whose dump entry starts `- id: <id>` disabled in `dumpText`?
+ *
+ * `undefined` means the id has no entry at all in this dump — distinct from `false`, which means
+ * the entry exists and is not disabled.
+ */
+function pluginDisabled(dumpText, id) {
+    const idLine = new RegExp(`^- id: ${escapeRegExp(id)}\\s*$`, "m");
+    const start = idLine.exec(dumpText);
+    if (!start)
+        return undefined;
+    const rest = dumpText.slice(start.index + start[0].length);
+    const nextEntry = /^- /m.exec(rest);
+    const entry = nextEntry ? rest.slice(0, nextEntry.index) : rest;
+    return /disabled: true/.test(entry);
+}

package/dist/relay/acp/modes.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACP_MODES = void 0;
+exports.isAcpMode = isAcpMode;
+exports.modeRank = modeRank;
+exports.clampMode = clampMode;
+exports.usesLocalTools = usesLocalTools;
+exports.describeMode = describeMode;
+/** Weakest first. The ORDER is the security model: a ceiling is "no higher than this index". */
+exports.ACP_MODES = ["chat", "read", "ask", "full"];
+function isAcpMode(value) {
+    return typeof value === "string" && exports.ACP_MODES.includes(value);
+}
+function modeRank(mode) {
+    return exports.ACP_MODES.indexOf(mode);
+}
+/** The lower of the two. A ceiling can only ever take power away. */
+function clampMode(wanted, ceiling) {
+    return modeRank(wanted) <= modeRank(ceiling) ? wanted : ceiling;
+}
+function usesLocalTools(mode) {
+    return mode !== "chat";
+}
+// Said in the room whenever a mode is set, and printed by `connect`. The limit is stated every
+// time because the agent's sandbox confines WRITES and never reads — a person choosing `read`
+// must not believe it means "only this folder".
+const READS_ANYTHING = "It can read any file your account can, not only this folder — only `chat` protects private files.";
+const DESCRIPTIONS = {
+    chat: "chat — BayChat tools only. It cannot read, write or run anything on this computer.",
+    read: `read — it can read and search files, and cannot run commands or write. ${READS_ANYTHING}`,
+    ask: `ask — it can run commands; every write, and anything needing more rights, asks you on your phone first. Commands that only read run without asking. ${READS_ANYTHING}`,
+    full: `full — it can write and run commands inside its folder without asking. ${READS_ANYTHING}`,
+};
+function describeMode(mode) {
+    return DESCRIPTIONS[mode];
+}

package/dist/relay/acp/permissions.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decidePermission = decidePermission;
+const approve_hook_1 = require("../../approve-hook");
+/**
+ * What to do with an agent's permission request. PURE — the asking is the caller's.
+ *
+ * dsh asks only when a call ESCALATES out of its sandbox, and the model names the level it
+ * wants in `rawInput.sandbox_permissions` [run]. "Allow once" approves that whole level for the
+ * call, so the level is what we gate on:
+ *
+ *  - `workspace-write`, in `ask` mode → the owner decides, on their phone.
+ *  - `danger-full-access` → refused without a card, always. At that level the command runs with
+ *    no sandbox at all; it is not a thing a chat message may ever be the cause of, and showing
+ *    it on a card would make one tired tap the only thing between a room and the whole disk.
+ *  - missing, unknown, or a call we never saw → refused. We do not approve what we cannot name.
+ *
+ * `ctx.agentLabel` (Ruling R9) is who the card says is asking — `composeQuestion` defaults to
+ * "Claude Code" when it is absent, which would misname a dsh session.
+ */
+function decidePermission(mode, call, ctx) {
+    if (!call)
+        return { kind: "refuse", reason: "the agent asked permission for a tool call this relay never saw" };
+    const level = call.rawInput.sandbox_permissions;
+    if (level !== "workspace-write") {
+        const asked = typeof level === "string" ? level : "an unnamed level of access";
+        return { kind: "refuse", reason: `"${call.title}" asked for ${asked}, which is never granted from a chat` };
+    }
+    if (mode !== "ask")
+        return { kind: "refuse", reason: `"${call.title}" needs write access, and this session's mode (${mode}) does not ask` };
+    return {
+        kind: "card",
+        question: (0, approve_hook_1.composeQuestion)({
+            toolName: call.title,
+            toolInput: call.rawInput,
+            cwd: ctx.cwd,
+            host: ctx.host,
+            permissionMode: "ask",
+            agentLabel: ctx.agentLabel,
+        }),
+    };
+}