baychat 0.21.5 → 0.22.0

package/dist/index.js

@@ -4,6 +4,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./commands");
 const approve_hook_1 = require("./approve-hook");
 const session_name_1 = require("./session-name");
+const start_command_1 = require("./start-command");
+const update_command_1 = require("./update-command");
 const session_command_1 = require("./session-command");
 const doctor_command_1 = require("./doctor-command");
 const hermes_1 = require("./hermes");
@@ -31,6 +33,16 @@ Exit 0: step succeeded; 2: awaiting approval or expired; 1: error.
 const HELP = `baychat — BayChat connector CLI for agent sessions (Claude Code, Codex)
 
 Usage:
+  baychat                               Start a session. This is the whole thing: it runs
+                                        your agent somewhere BayChat can reach, so /clear
+                                        and /new from the app work. Sign in once with
+                                        \`baychat login\` first
+  baychat start [name] [--runtime <runtime>]
+                                        The same, with a name for the session
+  baychat update                        Bring this machine onto the current version —
+                                        the package, every connected client's config, and
+                                        the relay daemon (which otherwise keeps running
+                                        old code). \`baychat\` does this for you once a day
   baychat join [name] [group] [--sessions | --private | --group <title>] [--runtime <runtime>]
   baychat join --session <name> --group <title> --runtime codex
   baychat skill --runtime codex|claude   Read the current packaged skill workflow
@@ -170,6 +182,12 @@ function numberFlag(args, name) {
 }
 async function main() {
     const [command, ...args] = process.argv.slice(2);
+    // BARE `baychat` STARTS A SESSION. The bar is "download BayChat, start a session, nothing
+    // else", and a usage dump printed at somebody who typed the product's own name is the
+    // "something else". `--help` still prints the help, and `start` refuses with one sentence
+    // when this machine is not signed in, so nothing is launched from an unusable state.
+    if (command === undefined)
+        return (0, start_command_1.cmdStart)([]);
     // Setup help must be side-effect free. Do not apply this to chat commands:
     // a sent message may legitimately contain the literal text "--help".
     if (["login", "link", "connect", "pair", "join", "skill"].includes(command) &&
@@ -184,6 +202,10 @@ async function main() {
             return 0;
         case "join":
             return (0, session_command_1.cmdJoinSession)(args);
+        case "start":
+            return (0, start_command_1.cmdStart)(args);
+        case "update":
+            return (0, update_command_1.cmdUpdate)();
         case "skill": {
             const runtime = args[1];
             if (args.length !== 2 ||

package/dist/relay/acp/agents.js

@@ -0,0 +1,186 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACP_AGENTS = exports.DSH_LOCAL_TOOLS = void 0;
+exports.acpAgent = acpAgent;
+exports.matchesTestedVersion = matchesTestedVersion;
+exports.modeAllowedHere = modeAllowedHere;
+exports.acpPatchDir = acpPatchDir;
+exports.patchPath = patchPath;
+exports.writeModePatches = writeModePatches;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../../config");
+const modes_1 = require("./modes");
+// Every tool plugin in dsh's `acp` profile (`--profile acp --dump-config`, 0.1.5-rc.2) [run].
+// MCP clients are mounted per ACP session by dsh-acp itself and are untouched by these.
+// Confirmed against docs/planning/2026-09-19-acp-research/dump-acp-default.yml — the tool-* ids
+// there match this list exactly, in the same order.
+exports.DSH_LOCAL_TOOLS = [
+    "tool-bash", "tool-pwsh", "tool-jobs", "tool-fs", "tool-fs-search", "tool-skill",
+    "tool-subagent-control", "tool-subagent-list-agents", "tool-subagent", "tool-subagent-fork",
+    "tool-workflow", "tool-todo", "tool-goal", "tool-ralph", "tool-web",
+];
+const disable = (ids, why) => [`# Written by BayChat. ${why}`, ...ids.flatMap((id) => [`- id: ${id}`, "  disabled: true"]), ""].join("\n");
+const dsh = {
+    id: "dsh",
+    label: "DeepSeek Harness",
+    bin: "dsh",
+    patches: {
+        chat: disable(exports.DSH_LOCAL_TOOLS, "chat mode: no local tools at all."),
+        read: disable(exports.DSH_LOCAL_TOOLS.filter((id) => id !== "tool-fs" && id !== "tool-fs-search"), "read mode: file read and search only — no shell, no subagents, no web."),
+    },
+    launch(mode, patchDir) {
+        const args = ["--profile", "acp"];
+        if (this.patches[mode])
+            args.push("--patch", patchPath(this, mode, patchDir));
+        // `danger-full-access` is deliberately unreachable from here: no mode maps to it.
+        return { args, env: { DSH_PERMISSION_MODE: mode === "full" ? "workspace-write" : "read-only" } };
+    },
+    // dsh's Windows sandbox reports itself `partial` (Everyone-writable objects, NTFS hard links)
+    // [source], so the modes that RELY on it are withheld there. `chat` needs no sandbox and
+    // `read`'s write fence is an in-process check.
+    modesFor: (platform) => (platform === "win32" ? ["chat", "read"] : ["chat", "read", "ask", "full"]),
+    classifyError(message) {
+        if (/no API key|MISSING_CREDENTIAL|INVALID_CREDENTIAL/i.test(message))
+            return "missing-key";
+        if (/mcp-client\(baychat\)/i.test(message))
+            return "baychat-unreachable";
+        if (/already active|session is active/i.test(message))
+            return "busy";
+        if (/session cwd does not match/i.test(message))
+            return "session";
+        return undefined;
+    },
+    keyHint: "DeepSeek has no API key on that computer. There, run `dsh web` and add the key on the Models page.",
+    installHint: "Install it with `npm install -g @deepseek-ai/dsh`, then run `baychat connect dsh` again.",
+    confidence: "run",
+    checked: "2026-09-19",
+    testedVersion: "0.1.5-rc.2",
+};
+exports.ACP_AGENTS = [dsh];
+function acpAgent(id) {
+    return exports.ACP_AGENTS.find((row) => row.id === id);
+}
+/** A version-string character: digits, letters, dot, plus, hyphen — the semver/rc alphabet. */
+const VERSION_TOKEN_CHAR = /[0-9A-Za-z.+-]/;
+/**
+ * Does `version` (raw `--version` output) contain `tested` as a WHOLE version token, not merely
+ * as a substring?
+ *
+ * `"0.1.5-rc.20".includes("0.1.5-rc.2")` is `true` — a plain substring check silently passes a
+ * different release and the mismatch warning this exists for never shows. So `tested` must be
+ * bounded: the character before it is the start of the string, something that is not part of a
+ * version token, or a leading `v` (allowed unconditionally — a version prefix, not a token
+ * character to fence against); the character after it is the end of the string or something that
+ * is not part of a version token. `--version` output varies by CLI — `"0.1.5-rc.2"`,
+ * `"dsh 0.1.5-rc.2"`, `"v0.1.5-rc.2"`, `"0.1.5-rc.2 (linux-x64)"` — and this matches all of them
+ * while refusing `"0.1.5-rc.20"`, `"10.1.5-rc.2"`, `"0.1.5-rc.2.1"` and `"0.1.5-rc.2-beta"`.
+ */
+function matchesTestedVersion(version, tested) {
+    if (!tested)
+        return false;
+    let from = 0;
+    for (;;) {
+        const at = version.indexOf(tested, from);
+        if (at === -1)
+            return false;
+        const before = at === 0 ? undefined : version[at - 1];
+        const after = version[at + tested.length];
+        const boundedBefore = before === undefined || before === "v" || !VERSION_TOKEN_CHAR.test(before);
+        const boundedAfter = after === undefined || !VERSION_TOKEN_CHAR.test(after);
+        if (boundedBefore && boundedAfter)
+            return true;
+        from = at + 1;
+    }
+}
+/**
+ * May a session of this agent run in `mode`, in a folder whose ceiling is `maxMode`, on this
+ * platform? The ONE rule: `/mode` from the chat and `acp-register` from `connect` both ask it.
+ */
+function modeAllowedHere(row, mode, maxMode, platform) {
+    if ((0, modes_1.modeRank)(mode) > (0, modes_1.modeRank)(maxMode)) {
+        return { ok: false, reason: `${mode} is above the highest mode allowed for that folder (${maxMode}). That ceiling is set on the computer, never from a chat: run \`baychat connect ${row.id}\` there to change it.` };
+    }
+    if (!row.modesFor(platform).includes(mode)) {
+        return { ok: false, reason: `${mode} is not offered on that computer's operating system, because ${row.label}'s sandbox cannot fully enforce it there.` };
+    }
+    return { ok: true };
+}
+/** Where mode patches live: `~/.baychat/acp/`. */
+function acpPatchDir() {
+    return path.join((0, config_1.configDir)(), "acp");
+}
+function patchPath(row, mode, dir) {
+    return path.join(dir, `${row.id}-${mode}.yml`);
+}
+/**
+ * (Re)write this agent's mode patches. Idempotent; called by `connect`, at daemon start and
+ * before every turn.
+ *
+ * NEVER TRUNCATE IN PLACE. Two sessions drain concurrently, so one session's rewrite can land
+ * while another's freshly spawned agent is reading the same patch — and an empty `chat` patch is
+ * an agent with every local tool. A patch that is already right is left alone; one that is not is
+ * written beside it and renamed over it, so a reader sees the old file or the new, never half.
+ */
+function writeModePatches(row, dir) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    for (const [mode, content] of Object.entries(row.patches)) {
+        const file = patchPath(row, mode, dir);
+        if (readOrUndefined(file) === content) {
+            fs.chmodSync(file, 0o600); // permissions only — the content and the inode stay as they are
+            continue;
+        }
+        const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+        try {
+            fs.writeFileSync(tmp, content, { mode: 0o600, flag: "wx" });
+            fs.chmodSync(tmp, 0o600); // `mode` is filtered by the umask
+            fs.renameSync(tmp, file);
+        }
+        catch (err) {
+            fs.rmSync(tmp, { force: true });
+            throw err;
+        }
+    }
+}
+/** A read error (absent, unreadable) means "write it". */
+function readOrUndefined(file) {
+    try {
+        return fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/relay/acp/approval.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.askPhone = askPhone;
+const api_1 = require("../../api");
+const approve_hook_1 = require("../../approve-hook");
+const HOLD_SECONDS = 25; // under the usual 60s proxy idle timeout — same as approve-hook
+const MAX_CONSECUTIVE_FAILURES = 3;
+const RETRY_DELAY_MS = 2_000;
+const ALLOW_INDEX = 0; // the ONLY index that means yes
+/**
+ * Put a decision card on the owner's phone and wait for the tap.
+ *
+ * NEVER THROWS, and every path that is not an explicit "Allow this once" is a refusal: an
+ * unreachable server, a status we do not know, a withdrawn card, the deadline. The card itself
+ * never expires server-side; our deadline exists so a turn cannot hold a process forever, and
+ * reaching it REFUSES. Silence is never a yes.
+ */
+async function askPhone(params, deps = {}) {
+    const request = deps.request ?? api_1.apiRequest;
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const waitSeconds = params.waitSeconds ?? approve_hook_1.DEFAULT_WAIT_SECONDS;
+    const deadline = now() + waitSeconds * 1000;
+    const hold = () => Math.max(1, Math.min(HOLD_SECONDS, Math.ceil((deadline - now()) / 1000)));
+    const no = (reason) => ({ allowed: false, reason });
+    try {
+        let reply = await request(params.auth, "POST", "/api/device-api/approvals", {
+            session: params.session,
+            conversationId: params.conversationId,
+            question: params.question,
+            options: [...approve_hook_1.APPROVE_OPTIONS],
+            wait: hold(),
+        });
+        const requestId = typeof reply.requestId === "string" ? reply.requestId : "";
+        if (!requestId)
+            return no("BayChat did not return an approval id");
+        let failures = 0;
+        for (;;) {
+            if (reply.status === "answered") {
+                return reply.answerIndex === ALLOW_INDEX
+                    ? { allowed: true, reason: "approved in BayChat" }
+                    : no(`answered "${reply.answer ?? approve_hook_1.APPROVE_OPTIONS[1]}" in BayChat`);
+            }
+            if (reply.status === "cancelled")
+                return no("the decision was withdrawn in BayChat");
+            if (reply.status !== "waiting")
+                return no(`BayChat answered with a status this relay does not understand ("${String(reply.status)}")`);
+            if (deadline - now() <= 0)
+                return no(`nobody answered within ${waitSeconds}s — the card is still in BayChat, and this request was refused`);
+            try {
+                reply = await request(params.auth, "GET", `/api/device-api/approvals/${encodeURIComponent(requestId)}?wait=${hold()}`);
+                failures = 0;
+            }
+            catch (err) {
+                if (err instanceof api_1.ApiError && err.status < 500 && err.status !== 429)
+                    return no(`BayChat refused the wait — ${err.message}`);
+                failures += 1;
+                if (failures >= MAX_CONSECUTIVE_FAILURES)
+                    return no(`BayChat became unreachable while waiting — ${err instanceof Error ? err.message : String(err)}`);
+                await sleep(RETRY_DELAY_MS);
+            }
+        }
+    }
+    catch (err) {
+        return no(`BayChat could not be asked — ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/dist/relay/acp/client.js

@@ -0,0 +1,253 @@
+"use strict";
+// One ACP turn: spawn the agent, open its session, send one prompt, report what happened.
+//
+// WHY A PROCESS PER TURN. Same trade `codex-app-server.ts` made and for the same reasons: a held
+// agent process buys ~0.6 s and costs a supervision problem — restarts, health, a wedged child
+// holding a session's queue, cleanup at shutdown — for a path that runs at human speed. ACP lets
+// us pay that nothing: `session/resume` reopens the conversation with its memory by id.
+//
+// NEVER THROWS. Every failure is an outcome with a cause the runner can act on and a reason a
+// person can read. NO SHELL, EVER: the prompt carries text written by other people in a room.
+//
+// THE CREDENTIAL. BayChat's MCP endpoint and the device token reach the agent inside the
+// `session/new` / `session/resume` request, i.e. on its stdin. Not argv (visible in `ps`), not
+// env (inherited by every command the agent runs), not a file.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAcpTurn = runAcpTurn;
+const stream_1 = require("stream");
+const runtime_binary_1 = require("../../runtime-binary");
+const sdk_1 = require("./sdk");
+const TURN_TIMEOUT_MS = 10 * 60_000;
+const HANDSHAKE_TIMEOUT_MS = 30_000;
+/** An error that already knows its cause — thrown inside `drive`, never out of `runAcpTurn`. */
+class TurnFailure extends Error {
+    cause;
+    constructor(cause, message) {
+        super(message);
+        this.cause = cause;
+    }
+}
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function errorText(err) {
+    if (!(err instanceof Error))
+        return String(err);
+    const data = err.data;
+    const details = isRecord(data) ? data.details : undefined;
+    return typeof details === "string" ? `${err.message}: ${details}` : err.message;
+}
+/** Reasons and logs carry agent text, and reasons are posted in the room: never the credential. */
+const redact = (text) => text.replace(/Bearer\s+\S+/g, "Bearer [redacted]").replace(/bay_[A-Za-z0-9_]+/g, "bay_[redacted]");
+async function runAcpTurn(req, deps) {
+    const log = (line) => deps.log?.(redact(line));
+    const failed = (cause, reason, sessionId) => ({
+        kind: "failed",
+        cause,
+        reason: redact(reason),
+        ...(sessionId ? { sessionId } : {}),
+    });
+    // Stopped before it began: start nothing. A real spawn reports a bad binary as a LATER
+    // 'error' event, and with no listener yet that event would crash the daemon.
+    if (req.signal?.aborted)
+        return failed("cancelled", "stopped from the chat");
+    const turnTimeout = deps.turnTimeoutMs ?? TURN_TIMEOUT_MS;
+    const handshakeTimeout = deps.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    // A classifier that throws must not strand the turn with its process still running.
+    const classify = (message) => {
+        try {
+            return req.classifyError(message);
+        }
+        catch (err) {
+            log(`acp: error classifier failed — ${errorText(err)}`);
+            return undefined;
+        }
+    };
+    let sdk;
+    try {
+        sdk = await (0, sdk_1.loadAcpSdk)();
+    }
+    catch (err) {
+        return failed("spawn", `the ACP library could not be loaded: ${errorText(err)}`);
+    }
+    let child;
+    try {
+        // A Windows `.cmd` shim needs its interpreter named — same fix as `codex-app-server.ts`.
+        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform);
+        child = deps.spawn(plan.file, [...plan.prefixArgs, ...req.args], {
+            cwd: req.cwd,
+            env: req.env,
+            shell: false,
+            windowsHide: true,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    catch (err) {
+        return failed("spawn", `the agent could not be started: ${errorText(err)}`);
+    }
+    if (!child.stdin || !child.stdout) {
+        child.kill("SIGTERM");
+        return failed("spawn", "the agent started without stdio pipes");
+    }
+    const stdin = child.stdin;
+    const stdout = child.stdout;
+    return new Promise((resolve) => {
+        let settled = false;
+        let phase = "handshake";
+        let sessionId;
+        /** True while `session/load` replays old history — those updates are not this turn's. */
+        let replaying = false;
+        let stderrTail = "";
+        let timer;
+        /** Permission questions waiting on a person. The turn clock runs only while this is zero. */
+        let asking = 0;
+        const calls = new Map();
+        const finish = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            req.signal?.removeEventListener("abort", onAbort);
+            child.kill("SIGTERM");
+            // A child that ignores the polite signal must not outlive the turn and keep acting.
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref();
+            resolve(outcome);
+        };
+        const fail = (cause, reason) => finish(failed(cause, reason, sessionId));
+        const arm = (ms, cause, reason) => {
+            clearTimeout(timer);
+            // Never after the end, never while a person is being asked: a stray timer would hold the
+            // event loop open for the whole turn budget and fire into a finished turn.
+            if (settled || asking > 0)
+                return;
+            timer = setTimeout(() => fail(cause, reason), ms);
+        };
+        const onAbort = () => fail("cancelled", "stopped from the chat");
+        child.on("error", (err) => fail("spawn", `the agent could not be started: ${errorText(err)}`));
+        child.on("exit", (code) => fail(phase === "handshake" ? "handshake" : "turn", `the agent exited (code ${code ?? "?"}) before the turn finished${stderrTail ? `: ${stderrTail.trim().slice(-300)}` : ""}`));
+        // Writing into a pipe whose reader died is an EPIPE 'error' event; unheard, it crashes the daemon.
+        stdin.on("error", (err) => log(`acp: agent stdin closed — ${errorText(err)}`));
+        child.stderr?.on("data", (d) => {
+            stderrTail = (stderrTail + d.toString()).slice(-600);
+        });
+        // Aborted while the SDK loaded: the child exists now, so stop only after its listeners are on.
+        if (req.signal?.aborted)
+            return onAbort();
+        req.signal?.addEventListener("abort", onAbort, { once: true });
+        const remember = (update) => {
+            const id = update.toolCallId;
+            if (typeof id !== "string")
+                return;
+            const known = calls.get(id);
+            const call = {
+                toolCallId: id,
+                title: typeof update.title === "string" ? update.title : (known?.title ?? ""),
+                rawInput: isRecord(update.rawInput) ? update.rawInput : (known?.rawInput ?? {}),
+            };
+            calls.set(id, call);
+            if (known)
+                return;
+            try {
+                req.onToolCall?.(call);
+            }
+            catch (err) {
+                log(`acp: tool-call observer failed — ${errorText(err)}`);
+            }
+        };
+        const client = {
+            async sessionUpdate(params) {
+                if (replaying || !isRecord(params.update))
+                    return;
+                const kind = params.update.sessionUpdate;
+                if (kind === "tool_call" || kind === "tool_call_update")
+                    remember(params.update);
+            },
+            async requestPermission(params) {
+                // The clock stops while a person is being asked: a card may wait an hour, and that is
+                // the owner's time, not a wedged agent's.
+                clearTimeout(timer);
+                asking++;
+                let verdict = "reject";
+                try {
+                    verdict = await req.onPermission(calls.get(params.toolCall?.toolCallId ?? ""));
+                }
+                catch (err) {
+                    log(`acp: permission handler failed, refusing — ${errorText(err)}`);
+                }
+                finally {
+                    asking--;
+                }
+                arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
+                // ONLY the single-use kinds. `allow_always` would turn one tap into a standing grant.
+                const want = verdict === "allow" ? "allow_once" : "reject_once";
+                const option = (params.options ?? []).find((o) => o.kind === want);
+                return option
+                    ? { outcome: { outcome: "selected", optionId: option.optionId } }
+                    : { outcome: { outcome: "cancelled" } };
+            },
+        };
+        const drive = async () => {
+            const conn = new sdk.ClientSideConnection(() => client, sdk.ndJsonStream(stream_1.Writable.toWeb(stdin), stream_1.Readable.toWeb(stdout)));
+            arm(handshakeTimeout, "handshake", `the agent did not complete the ACP handshake within ${Math.round(handshakeTimeout / 1000)}s`);
+            const init = await conn.initialize({
+                protocolVersion: sdk.PROTOCOL_VERSION,
+                // We offer the agent nothing of ours: no file access through us, no terminal through us.
+                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
+            });
+            const caps = (init.agentCapabilities ?? {});
+            if (!caps.mcpCapabilities?.http)
+                throw new TurnFailure("unsupported", "this agent cannot connect to an HTTP MCP server, so it could never reach BayChat's tools");
+            const canResume = caps.sessionCapabilities?.resume !== undefined && caps.sessionCapabilities.resume !== null;
+            const canLoad = caps.loadSession === true;
+            phase = "session";
+            let fresh = false;
+            let memoryLost = false;
+            const open = { cwd: req.cwd, mcpServers: req.mcpServers };
+            if (req.sessionId) {
+                if (!canResume && !canLoad) {
+                    // Starting fresh on every message would answer the room as an agent with no memory of
+                    // it, every time — worse than not answering.
+                    throw new TurnFailure("unsupported", "this agent can neither resume nor load a session, so it cannot keep a conversation between messages");
+                }
+                try {
+                    if (canResume)
+                        await conn.resumeSession({ sessionId: req.sessionId, ...open });
+                    else {
+                        replaying = true;
+                        await conn.loadSession({ sessionId: req.sessionId, ...open });
+                    }
+                    sessionId = req.sessionId;
+                }
+                catch (err) {
+                    const text = errorText(err);
+                    const cause = classify(text);
+                    // A KNOWN reason (busy in a terminal, wrong folder, BayChat unreachable, no key) is an
+                    // answer about this session and must not be papered over with a fresh one.
+                    if (cause) {
+                        sessionId = req.sessionId;
+                        throw new TurnFailure(cause, text);
+                    }
+                    log(`acp: could not reopen session ${req.sessionId} (${text}) — starting a new one`);
+                    memoryLost = true;
+                }
+                finally {
+                    replaying = false;
+                }
+            }
+            if (!sessionId) {
+                const created = await conn.newSession(open);
+                sessionId = created.sessionId;
+                fresh = true;
+            }
+            phase = "turn";
+            arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
+            const text = fresh && req.freshPreamble ? `${req.freshPreamble}\n\n${req.prompt}` : req.prompt;
+            const result = await conn.prompt({ sessionId, prompt: [{ type: "text", text }] });
+            return { kind: "completed", sessionId, stopReason: String(result.stopReason ?? "unknown"), fresh, memoryLost };
+        };
+        drive().then(finish, (err) => {
+            if (err instanceof TurnFailure)
+                return fail(err.cause, err.message);
+            const text = errorText(err);
+            fail(classify(text) ?? (phase === "turn" ? "turn" : phase), text);
+        });
+    });
+}

package/dist/relay/acp/commands.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAcpSessionCommand = runAcpSessionCommand;
+const agents_1 = require("./agents");
+const modes_1 = require("./modes");
+/**
+ * The session commands that mean something different — or only mean something — for a session
+ * the relay runs over ACP. Kept out of `daemon.ts`, which only calls in.
+ *
+ * Returns true when the command was answered here; false hands it back to the daemon's own
+ * branches, which are then exactly what they were before ACP existed. A non-ACP session only
+ * ever reaches this for `/mode-*` and `/stop`, and gets a refusal that says why.
+ *
+ * Every path replies, as in `runSessionCommand`: a command produces no agent turn, so silence
+ * would be indistinguishable from failure.
+ */
+async function runAcpSessionCommand(acp, session, target, message, command, say) {
+    if (command.mode) {
+        // Anyone with COMMAND ACCESS — the owner, or a Bay owner/admin she granted (Karmen's
+        // decision, 19 Sep 2026; owner-only before). The daemon only routes a command here when the
+        // server said `commandAuthorized === true`, so this is a second, defensive check, not the
+        // gate. Absent is no. The rule-file ceiling and the platform still cap it, in `setMode`.
+        if (message.commandAuthorized !== true && message.senderIsOwner !== true) {
+            await say(`You need command access (from the owner of "${session}") to change what it may do.`);
+            return true;
+        }
+        // `setMode` holds the one rule (rule-file ceiling, then platform) — not re-implemented here.
+        const result = acp.setMode(session, command.mode);
+        await say(result.ok ? `"${session}" is now in ${(0, modes_1.describeMode)(result.mode)}` : result.reason);
+        return true;
+    }
+    if (command.id === "stop") {
+        if (!target.acp) {
+            // Not "is not doing anything": the relay cannot see a terminal agent's turn at all.
+            await say(`"${session}" is not run by the relay, so /stop cannot reach it. Stop it in its own terminal.`);
+            return true;
+        }
+        await say(acp.stop(session)
+            ? `Stopped "${session}". Anything it had already done stays done.`
+            : `"${session}" is not doing anything right now.`);
+        return true;
+    }
+    if (command.id === "status" && target.acp) {
+        const row = (0, agents_1.acpAgent)(target.acp.agent);
+        const s = acp.status(session);
+        await say([
+            `Session "${session}" — run by the relay, no terminal`,
+            `  agent: ${row?.label ?? target.acp.agent}${row ? ` (tested with ${row.testedVersion})` : ""}`,
+            `  mode: ${(0, modes_1.describeMode)(target.acp.mode)}`,
+            `  folder: ${target.acp.cwd}`,
+            `  now: ${s.running ? "working on a turn" : "idle"}, ${s.queued} message(s) waiting`,
+            `  memory: ${target.acp.sessionId ? "kept between messages" : "fresh on the next message"}`,
+        ].join("\n"));
+        return true;
+    }
+    if (command.id === "exit" && target.relayOwned) {
+        await say(`"${session}" is run by the relay on that computer and has no terminal to detach. Use /stop to cancel a running turn.`);
+        return true;
+    }
+    if (target.acp && (command.id === "clear" || command.id === "new")) {
+        // There is no terminal to type into: forgetting the ACP session id IS the fresh chat. The
+        // running turn is stopped first, or it would finish into the memory being closed.
+        acp.stop(session);
+        acp.reset(session);
+        await say(`"${session}" will start a fresh conversation with your next message. Its earlier memory is closed.`);
+        return true;
+    }
+    return false;
+}