baychat 0.21.5 → 0.22.0

package/README.md

@@ -186,6 +186,7 @@ baychat login               # once per computer: the QR
 baychat connect             # list the apps it can configure
 baychat connect claude      # refresh Claude Code's skill (no QR, no re-pairing)
 baychat connect codex       # configure Codex — restart Codex afterwards
+baychat connect dsh         # a DeepSeek Harness session the relay runs for you — see below
 baychat relay start         # the process that wakes your sessions
 baychat relay status        # transport, sessions, anything pending
 baychat doctor              # checks every link and prints what to type
@@ -350,7 +351,9 @@ everything we need.
   right conversation. This needs the agent to be able to say which session it is, and to have a
   way to resume that session without a UI (`--resume <id>` and friends).
 
-Adapters ship for **Claude Code**, **Codex**, **Cursor** and **Hermes**. Many others — Gemini CLI,
+Adapters ship for **Claude Code**, **Codex**, **Cursor**, **Hermes** and **DeepSeek Harness**
+(`baychat connect dsh`, run by the relay over ACP rather than woken in a terminal — see above and
+[`ACP_RELAY.md`](../../docs/features/ACP_RELAY.md)). Many others — Gemini CLI,
 Copilot CLI, Goose, OpenCode/Crush, Qwen Code, Kimi Code CLI, CodeBuddy, iFlow, Trae, Aider — look
 compatible on paper, with per-agent detail, exact flags, known bugs and a **date on every row** in
 [the compatibility table](https://baychat.io/runtimes.md).
@@ -435,6 +438,55 @@ relay also falls back to it automatically when app-server cannot be used at
 all — but not when the failure is a real answer about your session, because
 retrying that would only repeat it with the reason replaced by an exit code.
 
+## `baychat connect dsh` — DeepSeek Harness, run by the relay
+
+```
+baychat connect dsh [--folder <path>] [--max-mode <mode>] [--mode <mode>] [--session <name>] [--terminal]
+```
+
+Unlike every other runtime in this file, DeepSeek Harness (`dsh`) is not woken in your terminal —
+the relay spawns it directly and drives it over **ACP** (Agent Client Protocol), one process per
+turn. Full detail — the four modes, their honest limits, the rule file, known limits — is in
+[`docs/features/ACP_RELAY.md`](../../docs/features/ACP_RELAY.md).
+
+> ⚠️ **DeepSeek Harness is experimental and has not been security-audited.** DeepSeek recommends
+> running it in a disposable VM or container, not on your everyday machine. `connect dsh` and
+> `baychat doctor` both print this reminder every time.
+
+| Flag | Default | Meaning |
+|---|---|---|
+| `--folder <path>` | asked interactively, defaulting to the current directory | the folder DeepSeek may work in — resolved and stored in `~/.baychat/relay-policy.json` |
+| `--max-mode <mode>` | asked interactively, defaulting to `ask` | the ceiling: `/mode-*` from the chat can never go higher than this, ever |
+| `--mode <mode>` | `chat` | the mode the session starts in |
+| `--session <name>` | `DeepSeek` | the BayChat session name it registers and joins as |
+| `--terminal` | off | ALSO set up `dsh` for use by hand in a terminal: the BayChat skill and a BayChat MCP entry in `~/.dsh/cordis.patch.yml`. That writes your BayChat token into that file (mode `0600`), and it applies to every dsh profile — so it is opt-in. The relay-run session needs none of it. |
+
+Modes, weakest to strongest: `chat` (default — BayChat tools only), `read` (+ file read/search),
+`ask` (+ shell; a write asks on your phone first), `full` (+ writes without asking, in its
+folder). Only `chat` protects private files — every other mode can read anything your account can.
+Windows offers `chat` and `read` only.
+
+Who gets that power: **you, or a Bay owner/admin you gave command access**. Their messages run in
+the session's mode and they may use `/mode-*`; anyone else's message makes that turn `chat`. The
+ceiling still caps everything, and in `ask` the approval card still comes to **your** phone only.
+Revoke the grant (or demote the admin) to take it away.
+
+Re-running `connect dsh` changes the ceiling, and re-registers the session at the starting mode
+(`--mode`, default `chat`) — it does **not** keep a mode you raised from the chat. A running relay
+refuses to raise a live session's mode (it keeps or lowers it only), and `connect` then exits with
+an error; to raise it now, use `/mode-…` from the chat. The starting mode `connect` wrote itself
+still applies once the relay reloads its sessions (for example after a restart) — that is you, on
+this computer, and it is still capped by the folder's ceiling. Re-running with a different `--folder`
+**adds** that folder to the allowed folders; the old ones stay allowed until you remove them from
+`~/.baychat/relay-policy.json`.
+
+A `dsh` you run by hand in a terminal is never woken headlessly, and `baychat start` does not
+launch `dsh` — the relay-run session is the one whose modes are enforced.
+
+It also needs its own API key on that computer, separate from BayChat: run `dsh web` there and add
+it on the Models page. `baychat doctor` reports whether the key exists (never its contents) and
+whether the installed `dsh` matches the version BayChat was tested against.
+
 ## Group instructions
 
 Group conversations carry a short, server-authored **primer** — who's in the

package/dist/approve-hook.js

@@ -207,9 +207,12 @@ function describeToolRequest(toolName, toolInput) {
 /** The question the card asks. Blunt on purpose: this is a shell on a server, read on a phone,
  *  and the safe answer has to be the obvious one. */
 function composeQuestion(params) {
+    const who = params.agentLabel ?? "Claude Code";
+    const context = params.agentLabel
+        ? "It is running in BayChat's relay; nobody is at a terminal."
+        : "This would normally be a prompt in the terminal.";
     const lines = [
-        `Claude Code on ${params.host} is asking permission to use ${params.toolName}. ` +
-            `This would normally be a prompt in the terminal.`,
+        `${who} on ${params.host} is asking permission to use ${params.toolName}. ` + context,
         "",
         describeToolRequest(params.toolName, params.toolInput),
         "",

package/dist/commands.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
+exports.realConfigIo = exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
 exports.requireCredentials = requireCredentials;
 exports.cmdPair = cmdPair;
 exports.cmdWhoami = cmdWhoami;
@@ -653,7 +653,7 @@ function claudeMcpAddSpawn(platform, baseUrl, token) {
  */
 function refreshConnectedClients(baseUrl, token) {
     try {
-        const updated = (0, credential_refresh_1.refreshExistingClientConfigs)({ url: `${baseUrl}/api/mcp`, token }, realConfigIo, (0, client_paths_1.currentPathEnv)());
+        const updated = (0, credential_refresh_1.refreshExistingClientConfigs)({ url: `${baseUrl}/api/mcp`, token }, exports.realConfigIo, (0, client_paths_1.currentPathEnv)());
         for (const path of updated)
             console.log(`✓ Updated ${path} with the new credential`);
     }
@@ -663,8 +663,10 @@ function refreshConnectedClients(baseUrl, token) {
         console.log(`  Could not refresh client configs: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/** Real filesystem IO for the refresh. Mirrors `connect.ts`'s writer. */
-const realConfigIo = {
+/** Real filesystem IO for the refresh. Mirrors `connect.ts`'s writer.
+ *  Exported so `baychat update` refreshes configs through the SAME writer a login does —
+ *  two spellings of "write a client config" would eventually disagree about permissions. */
+exports.realConfigIo = {
     readFile: (p) => {
         try {
             return node_fs_1.default.readFileSync(p, "utf8");

package/dist/connect-dsh.js

@@ -0,0 +1,165 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cmdConnectDsh = cmdConnectDsh;
+const readline = __importStar(require("readline"));
+const commands_1 = require("./commands");
+const config_1 = require("./config");
+const agents_1 = require("./relay/acp/agents");
+const modes_1 = require("./relay/acp/modes");
+const policy_1 = require("./relay/acp/policy");
+const presence_1 = require("./relay/acp/presence");
+const commands_2 = require("./relay/commands");
+const registry_1 = require("./relay/registry");
+const dsh_config_1 = require("./dsh-config");
+const runtime_install_1 = require("./runtime-install");
+const runtime_binary_1 = require("./runtime-binary");
+function askOnTerminal(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => rl.question(question, (answer) => (rl.close(), resolve(answer.trim()))));
+}
+function realDeps() {
+    return {
+        device: config_1.loadDeviceCredentials,
+        login: (base) => (0, commands_1.cmdLogin)({ base, hint: false }),
+        resolveBinary: (name) => (0, runtime_binary_1.resolveRuntimeBinary)(name, (0, runtime_binary_1.currentBinaryEnv)()),
+        join: async (session) => {
+            const device = (0, config_1.loadDeviceCredentials)();
+            if (!device)
+                throw new Error("not logged in");
+            await (0, presence_1.joinSession)((0, presence_1.deviceMcpCaller)(device), session);
+        },
+        registerWithRelay: commands_2.registerAcpSession,
+        ensureRelay: commands_2.ensureRelayInstalled,
+        installTerminalPath: (device) => {
+            const lines = (0, runtime_install_1.describeInstall)((0, runtime_install_1.installRuntimeCommand)("dsh"));
+            // writeDshMcpEntry can throw (RULING R22: a damaged ~/.dsh/cordis.patch.yml block). By this
+            // point the relay-run session has already been created — policy saved, mode patches
+            // written, joined, registered — so a throw here must not escape and abort cmdConnectDsh:
+            // it would report the whole connect as failed even though the chat-driven agent works
+            // fine. Report the terminal-path failure as a line instead.
+            try {
+                const mcp = (0, dsh_config_1.writeDshMcpEntry)({ url: `${device.baseUrl.replace(/\/$/, "")}/api/mcp`, token: device.token });
+                lines.push(`Terminal use: BayChat tools added to ${mcp.file}${mcp.backup ? ` (backup: ${mcp.backup})` : ""} — in dsh, type /baychat <name>`);
+            }
+            catch (err) {
+                lines.push(`Terminal use: FAILED — ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return lines;
+        },
+        ask: askOnTerminal,
+        print: (line) => console.log(line),
+        platform: process.platform,
+    };
+}
+/**
+ * `baychat connect dsh` — a DeepSeek session the relay runs by itself.
+ *
+ * ORDER MATTERS: everything that can refuse (no login, no binary, a bad folder, a bad mode,
+ * a session name already taken by something the relay does not run) refuses BEFORE anything
+ * is written, so a failed connect leaves no half-made rule file.
+ */
+async function cmdConnectDsh(opts = {}, deps = realDeps()) {
+    const row = (0, agents_1.acpAgent)("dsh");
+    const say = deps.print;
+    let device = deps.device();
+    if (!device) {
+        say("Connect DeepSeek — approve the QR in BayChat.");
+        if (!(await deps.login(opts.base)))
+            return 2;
+        device = deps.device();
+    }
+    if (!device) {
+        say("No device credential was saved. Retry `baychat connect dsh`.");
+        return 1;
+    }
+    const binary = deps.resolveBinary(row.bin);
+    if (!binary.ok) {
+        say(`${row.label} is not installed here. ${row.installHint}`);
+        return 1;
+    }
+    const folderInput = opts.folder ?? ((await deps.ask(`Folder ${row.label} may work in [${process.cwd()}]: `)) || process.cwd());
+    const folder = (0, policy_1.validateNewRoot)(folderInput);
+    if (!folder.ok) {
+        say(folder.reason);
+        return 1;
+    }
+    const offered = row.modesFor(deps.platform);
+    const maxInput = opts.maxMode ?? ((await deps.ask(`Highest mode the chat may ever switch it to (${offered.join(" / ")}) [${offered.includes("ask") ? "ask" : offered.at(-1)}]: `)) || (offered.includes("ask") ? "ask" : offered.at(-1)));
+    if (!(0, modes_1.isAcpMode)(maxInput) || !offered.includes(maxInput)) {
+        say(`"${maxInput}" is not a mode offered on this computer. Choose one of: ${offered.join(", ")}.`);
+        return 1;
+    }
+    const mode = opts.agentMode ?? "chat";
+    if (!(0, modes_1.isAcpMode)(mode) || (0, modes_1.modeRank)(mode) > (0, modes_1.modeRank)(maxInput)) {
+        say(`The starting mode must be one of ${offered.join(", ")} and no higher than ${maxInput}.`);
+        return 1;
+    }
+    const session = opts.session?.trim() || "DeepSeek";
+    const registry = new registry_1.SessionRegistry();
+    registry.load();
+    const existing = registry.get(session);
+    if (existing && !existing.acp) {
+        say(`A session named "${session}" already exists on this computer and is not run by the relay. Choose another name with --session <name>.`);
+        return 1;
+    }
+    // ── Nothing above this line wrote anything. ─────────────────────────────────────────────
+    (0, policy_1.savePolicy)((0, policy_1.upsertRoot)((0, policy_1.loadPolicy)(), row.id, folder.path, maxInput));
+    (0, agents_1.writeModePatches)(row, (0, agents_1.acpPatchDir)());
+    await deps.join(session);
+    const acp = { agent: row.id, cwd: folder.path, mode };
+    registry.upsert({ name: session, runtime: row.id, runtimeBin: binary.path, relayOwned: true, acp });
+    const live = await deps.registerWithRelay({ type: "acp-register", session, runtime: row.id, runtimeBin: binary.path, acp });
+    say("");
+    say(`  ${row.label}: ${binary.path} (${binary.version})`);
+    if (!(0, agents_1.matchesTestedVersion)(binary.version, row.testedVersion))
+        say(`  Note: BayChat was tested with ${row.testedVersion}. ${row.label} is a preview and changes often — if something misbehaves, run \`baychat doctor\`.`);
+    say(`  Safety: ${row.label} is experimental and has not been security-audited. DeepSeek recommends running it in a disposable VM or container, not on your everyday computer.`);
+    say(`  Folder:  ${folder.path}`);
+    say(`  Mode:    ${(0, modes_1.describeMode)(mode)}`);
+    say(`  Ceiling: ${maxInput} — the chat can never switch it higher. Change it by running this command again.`);
+    // Opt-in (Ruling R26): the terminal path writes the BayChat token into a file every dsh
+    // profile reads, and the relay-run path needs none of it.
+    if (opts.terminal)
+        for (const line of deps.installTerminalPath(device))
+            say(`  ${line}`);
+    else
+        say("  Terminal use: not set up (add --terminal to also use BayChat from dsh by hand — it writes your BayChat token into ~/.dsh/cordis.patch.yml, which applies to every dsh profile).");
+    say(`  ${await deps.ensureRelay()}${live ? "" : " (it will pick this session up when it starts)"}`);
+    say("");
+    say(`  Message "${session}" in BayChat. It needs a DeepSeek API key on this computer: run \`dsh web\` and add it on the Models page.`);
+    say("  From the chat (you, or anyone you gave command access): /mode-chat /mode-read /mode-ask /mode-full · /stop /new /status.");
+    return 0;
+}

package/dist/connect-plan.js

@@ -57,8 +57,23 @@ function parseConnectArgs(args) {
                 throw new Error("Choose --start or --finish once.");
             result.mode = arg === "--start" ? "start" : "finish";
         }
+        else if (arg === "--folder" || arg === "--max-mode" || arg === "--mode" || arg === "--session") {
+            const value = args[++index];
+            if (!value?.trim() || value.startsWith("--"))
+                throw new Error(`Supply ${arg} with a value.`);
+            const key = arg === "--folder" ? "folder" : arg === "--max-mode" ? "maxMode" : arg === "--mode" ? "agentMode" : "session";
+            if (result[key])
+                throw new Error(`Supply ${arg} once.`);
+            result[key] = value;
+        }
+        else if (arg === "--terminal") {
+            if (result.terminal)
+                throw new Error("Supply --terminal once.");
+            result.terminal = true;
+        }
         else if (arg.startsWith("-") || result.client || !arg.trim()) {
-            throw new Error("Usage: baychat connect <runtime> [--start | --finish] [--base <url>]");
+            throw new Error("Usage: baychat connect <runtime> [--start | --finish] [--base <url>] " +
+                "[--folder <path>] [--max-mode <mode>] [--mode <mode>] [--session <name>] [--terminal]");
         }
         else
             result.client = arg;

package/dist/connect.js

@@ -52,6 +52,7 @@ const runtime_binary_1 = require("./runtime-binary");
 const connect_claude_1 = require("./connect-claude");
 var connect_claude_2 = require("./connect-claude");
 Object.defineProperty(exports, "cmdConnectClaude", { enumerable: true, get: function () { return connect_claude_2.cmdConnectClaude; } });
+const connect_dsh_1 = require("./connect-dsh");
 const connect_hermes_1 = require("./connect-hermes");
 /** Clients `connect` can configure. `claude` is an alias users reach for. */
 const CLIENT_ALIASES = {
@@ -69,6 +70,7 @@ function renderConnectMenu() {
         ...rows,
         "  npx baychat connect claude  → Claude Code (login, MCP and skill)",
         "  npx baychat connect hermes  → Hermes (pair and enable its persistent agent)",
+        "  npx baychat connect dsh     → DeepSeek Harness (the relay runs it; talk to it from the app)",
         "",
         "You approve a QR on your phone. After that, in any coding session:",
         "",
@@ -198,6 +200,11 @@ async function cmdConnect(clientArg, opts = {}) {
             throw new Error("Hermes pairing does not support --start/--finish.");
         return (0, connect_hermes_1.cmdConnectHermes)(opts);
     }
+    if (clientArg.trim().toLowerCase() === "dsh" || clientArg.trim().toLowerCase() === "deepseek") {
+        if (opts.mode)
+            throw new Error("DeepSeek setup does not support --start/--finish.");
+        return (0, connect_dsh_1.cmdConnectDsh)(opts);
+    }
     const client = parseConnectClient(clientArg);
     if (opts.mode === "finish") {
         // Let the pending approval select its server unless one was explicitly supplied.

package/dist/doctor-command.js

@@ -48,6 +48,7 @@ const os = __importStar(require("os"));
 const config_1 = require("./config");
 const doctor_1 = require("./doctor");
 const commands_1 = require("./relay/commands");
+const registry_1 = require("./relay/registry");
 const credential_refresh_1 = require("./credential-refresh");
 const client_paths_1 = require("./client-paths");
 const runtime_binary_1 = require("./runtime-binary");
@@ -69,12 +70,18 @@ function codexPath() {
     return resolved.ok ? resolved.path : undefined;
 }
 async function currentDoctorEnv() {
+    // Read directly, not through `relay.sessions`: a relay-owned dsh session is worth
+    // diagnosing precisely when the relay is NOT running, which is often why `doctor` was
+    // reached for in the first place.
+    const registry = new registry_1.SessionRegistry();
+    registry.load();
     return {
         home: os.homedir(),
         platform: process.platform,
         now: Date.now(),
         device: (0, config_1.loadDeviceCredentials)(),
         relay: await (0, commands_1.tryRelayStatus)(),
+        targets: registry.all(),
         readText(filePath) {
             try {
                 return fs.readFileSync(filePath, "utf8");

package/dist/doctor.js

@@ -57,13 +57,17 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildReport = buildReport;
 exports.mailboxCheck = mailboxCheck;
+exports.acpChecks = acpChecks;
 exports.exitCodeFor = exitCodeFor;
 exports.renderReport = renderReport;
 const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const mailbox_1 = require("./relay/mailbox");
 const parent_watch_1 = require("./relay/parent-watch");
 const client_paths_1 = require("./client-paths");
+const agents_1 = require("./relay/acp/agents");
+const policy_1 = require("./relay/acp/policy");
 const runtime_binary_1 = require("./runtime-binary");
 const runtimes_1 = require("./runtimes");
 /**
@@ -106,6 +110,7 @@ function buildReport(env) {
         mailbox: mailboxCheck(),
         staleCredentials: staleCredentialCheck(env),
         runtimes: REPORTED.map((runtime) => runtimeReport(runtime, env)),
+        agents: acpChecks({ resolveBinary: env.resolveBinary, targets: env.targets, homedir: env.home }),
         pending: pendingCheck(env),
     };
 }
@@ -168,6 +173,84 @@ function mailboxCheck() {
     // where the truth is established, honestly, as pending-or-delivered.
     return { name: "mailbox", status: "pass", detail: `registered a mailbox FIFO: ${live.join(", ")}` };
 }
+/**
+ * Relay-run (ACP) agents: is each one startable, inside its rules, and able to reach a model?
+ *
+ * Takes `targets` rather than the full `DoctorEnv` for the same testability reason every other
+ * check here does — see `DoctorEnv.targets` for why these come from the persisted registry and
+ * not from `relay.sessions`.
+ *
+ * ONE finding per relay-owned session (not one report for the feature), because a machine
+ * running two dsh sessions in two folders can have one healthy and one not, and collapsing them
+ * would hide whichever came second.
+ *
+ * DeepSeek Harness is experimental and has not been security-audited (R11/R17): every line that
+ * gets far enough to say a version repeats DeepSeek's own recommendation to run it disposably —
+ * one short clause, not a paragraph, because the reader has already seen it once from `connect`.
+ */
+function acpChecks(env) {
+    const owned = env.targets.filter((t) => t.relayOwned && t.acp);
+    if (owned.length === 0) {
+        return [{ name: "relay-run agents", status: "skip", detail: "none — `baychat connect dsh` sets one up" }];
+    }
+    const policy = (0, policy_1.loadPolicy)();
+    return owned.map((t) => {
+        const name = `agent ${t.name}`;
+        const row = (0, agents_1.acpAgent)(t.acp.agent);
+        if (!row) {
+            return {
+                name,
+                status: "fail",
+                detail: `unknown agent "${t.acp.agent}"`,
+                remedy: "Update baychat, then run `baychat connect dsh` again.",
+            };
+        }
+        const bin = env.resolveBinary(row.bin);
+        if (!bin.ok) {
+            return {
+                name,
+                status: "fail",
+                detail: `${row.label} is not installed where the relay can find it`,
+                remedy: row.installHint,
+            };
+        }
+        const folder = (0, policy_1.checkFolder)(policy, row.id, t.acp.cwd);
+        if (!folder.ok) {
+            return {
+                name,
+                status: "fail",
+                detail: folder.reason,
+                remedy: "Run `baychat connect dsh` in the folder it should work in.",
+            };
+        }
+        const home = env.homedir ?? os.homedir();
+        // EXISTENCE only. The key is dsh's; BayChat never opens the file that holds it, and never
+        // logs it — the check is "is there a file there", not "what does it say".
+        const keySeen = Boolean(process.env.DEEPSEEK_API_KEY) ||
+            fs.existsSync(path.join(process.env.DSH_HOME ?? path.join(home, ".dsh"), ".credentials.yaml"));
+        const line = `${row.label} ${bin.version} · ${t.acp.cwd} · mode ${t.acp.mode} (ceiling ${folder.maxMode})` +
+            " — DeepSeek recommends a disposable VM or container";
+        if (!keySeen) {
+            return {
+                name,
+                status: "warn",
+                detail: `${line} — no DeepSeek key found`,
+                remedy: "Run `dsh web` and add the key on the Models page.",
+            };
+        }
+        // R20: a substring check lets a later release ("0.1.5-rc.20") pass silently as the tested
+        // one ("0.1.5-rc.2"). `matchesTestedVersion` bounds the match to a whole version token.
+        if (!(0, agents_1.matchesTestedVersion)(bin.version, row.testedVersion)) {
+            return {
+                name,
+                status: "warn",
+                detail: `${line} — BayChat was tested with ${row.testedVersion}`,
+                remedy: "If it misbehaves, install the tested version or update baychat.",
+            };
+        }
+        return { name, status: "pass", detail: line };
+    });
+}
 /**
  * The process exit code for a report.
  *
@@ -198,6 +281,8 @@ function renderReport(report) {
         for (const check of rest)
             lines.push(...renderGroupCheck("", check));
     }
+    for (const check of report.agents)
+        lines.push(...renderSummaryCheck(check));
     lines.push(...renderSummaryCheck(report.pending));
     return lines;
 }
@@ -513,7 +598,15 @@ function withRemedy(line, check) {
     return [line, `${" ".repeat(LABEL_WIDTH + 2 + CHECK_WIDTH)}→ ${check.remedy}`];
 }
 function allChecks(report) {
-    return [report.credentials, report.staleCredentials, report.relay, report.mailbox, ...report.runtimes.flatMap((r) => r.checks), report.pending];
+    return [
+        report.credentials,
+        report.staleCredentials,
+        report.relay,
+        report.mailbox,
+        ...report.runtimes.flatMap((r) => r.checks),
+        ...report.agents,
+        report.pending,
+    ];
 }
 /** Shorten a path under the user's home, which is where nearly all of these are. */
 function display(filePath, env) {

package/dist/dsh-config.js

@@ -0,0 +1,147 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeBayChatEntry = mergeBayChatEntry;
+exports.writeDshMcpEntry = writeDshMcpEntry;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+// dsh composes every profile from layers, and `~/.dsh/cordis.patch.yml` applies to all of them —
+// its equivalent of `~/.codex/config.toml`. The entry below was hand-wired and RUN on
+// 2026-09-18 (docs/planning/2026-09-18-deepseek-harness-step-by-step.md).
+//
+// WHY A MARKED TEXT BLOCK AND NOT A YAML MERGE. The client's file may contain dsh's `!!js` tags,
+// which a generic YAML parser rejects or, worse, round-trips wrongly. We never parse their file:
+// we own the lines between two markers and nothing else, and we back the file up before writing.
+//
+// The token is a literal, as it is in Codex's config — the file is 0600. `connect` rewrites the
+// block on every run, so a re-issued token replaces the old one rather than leaving it behind.
+const START = "# >>> baychat (managed by `baychat connect dsh` — edits between these lines are overwritten)";
+const END = "# <<< baychat";
+const CORRUPT_BLOCK_MESSAGE = "~/.dsh/cordis.patch.yml has a damaged BayChat block (a start marker without its end, or " +
+    "duplicates). Remove the lines between '# >>> baychat' and '# <<< baychat' by hand, then run " +
+    "`baychat connect dsh` again.";
+/**
+ * Refuse to interpolate anything that could break out of the block's YAML.
+ *
+ * Device tokens are `bay_u_` + hex and the MCP url is ours, so neither check should ever fire in
+ * practice — but a value we did not generate should never be trusted to hold still inside a
+ * double-quoted YAML scalar just because it happens to today.
+ */
+function validateEntry(entry) {
+    if (!/^[A-Za-z0-9_]+$/.test(entry.token)) {
+        throw new Error("Refusing to write a BayChat MCP entry: the device token contains characters other than letters, digits and underscore.");
+    }
+    if (/["'\s]/.test(entry.url)) {
+        throw new Error("Refusing to write a BayChat MCP entry: the MCP URL contains a quote, newline or whitespace.");
+    }
+}
+/**
+ * Find the single well-formed managed block in `existing`, or `null` when there is none at all.
+ *
+ * RULING R22: a START with no END after it, an END with no START, or more than one of either
+ * marker is CORRUPT — the file was hand-edited into a shape we cannot safely replace. Silently
+ * appending a second block on top of that would leave the old one, stale token included, in the
+ * file forever, so this throws instead of guessing.
+ */
+function findManagedBlock(existing) {
+    const firstStart = existing.indexOf(START);
+    const lastStart = existing.lastIndexOf(START);
+    const firstEnd = existing.indexOf(END);
+    const lastEnd = existing.lastIndexOf(END);
+    const hasStart = firstStart >= 0;
+    const hasEnd = firstEnd >= 0;
+    if (!hasStart && !hasEnd)
+        return null;
+    if (hasStart !== hasEnd)
+        throw new Error(CORRUPT_BLOCK_MESSAGE);
+    if (firstStart !== lastStart || firstEnd !== lastEnd)
+        throw new Error(CORRUPT_BLOCK_MESSAGE);
+    if (firstEnd < firstStart)
+        throw new Error(CORRUPT_BLOCK_MESSAGE);
+    return { from: firstStart, to: firstEnd };
+}
+function mergeBayChatEntry(existing, entry) {
+    validateEntry(entry);
+    const block = [
+        START,
+        "- insert:",
+        "    - id: mcp-baychat",
+        "      name: '@deepseek-ai/dsh-mcp-client'",
+        "      config:",
+        "        serverName: baychat",
+        "        transport: streamable-http",
+        `        url: ${entry.url}`,
+        "        headers:",
+        `          Authorization: "Bearer ${entry.token}"`,
+        END,
+        "",
+    ].join("\n");
+    const found = findManagedBlock(existing);
+    if (found) {
+        const after = existing.slice(found.to + END.length).replace(/^\n/, "");
+        return `${existing.slice(0, found.from)}${block}${after}`;
+    }
+    const head = existing === "" || existing.endsWith("\n") ? existing : `${existing}\n`;
+    return `${head}${block}`;
+}
+function writeDshMcpEntry(entry, home = os.homedir()) {
+    const file = path.join(home, ".dsh", "cordis.patch.yml");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const existing = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+    // Computed BEFORE anything is written: a corrupt block, or an unsafe entry, throws here and
+    // leaves the file — and any backup — untouched.
+    const next = mergeBayChatEntry(existing, entry);
+    let backup;
+    if (existing) {
+        backup = `${file}.baychat-backup`;
+        fs.writeFileSync(backup, existing, { mode: 0o600 });
+    }
+    // Atomic: write to a temp file in the same directory, then rename over the target. A reader —
+    // or a crash mid-write — never sees a half-written config. Same pattern as `writeModePatches`
+    // in relay/acp/agents.ts and `writeHermesMcp` in hermes-mcp.ts.
+    const temp = `${file}.${process.pid}.${(0, crypto_1.randomUUID)()}.tmp`;
+    try {
+        fs.writeFileSync(temp, next, { mode: 0o600, flag: "wx" });
+        fs.chmodSync(temp, 0o600); // `mode` above is filtered by the umask
+        fs.renameSync(temp, file);
+    }
+    catch (err) {
+        fs.rmSync(temp, { force: true });
+        throw err;
+    }
+    return { file, backup };
+}