baychat 0.21.5 → 0.23.0

package/dist/relay/acp/client.js

@@ -0,0 +1,265 @@
+"use strict";
+// One ACP turn: spawn the agent, open its session, send one prompt, report what happened.
+//
+// WHY A PROCESS PER TURN. Same trade `codex-app-server.ts` made and for the same reasons: a held
+// agent process buys ~0.6 s and costs a supervision problem — restarts, health, a wedged child
+// holding a session's queue, cleanup at shutdown — for a path that runs at human speed. ACP lets
+// us pay that nothing: `session/resume` reopens the conversation with its memory by id.
+//
+// NEVER THROWS. Every failure is an outcome with a cause the runner can act on and a reason a
+// person can read. NO SHELL, EVER: the prompt carries text written by other people in a room.
+//
+// THE CREDENTIAL. BayChat's MCP endpoint and the device token reach the agent inside the
+// `session/new` / `session/resume` request, i.e. on its stdin. Not argv (visible in `ps`), not
+// env (inherited by every command the agent runs), not a file.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAcpTurn = runAcpTurn;
+const stream_1 = require("stream");
+const runtime_binary_1 = require("../../runtime-binary");
+const sdk_1 = require("./sdk");
+const TURN_TIMEOUT_MS = 10 * 60_000;
+const HANDSHAKE_TIMEOUT_MS = 30_000;
+/** An error that already knows its cause — thrown inside `drive`, never out of `runAcpTurn`. */
+class TurnFailure extends Error {
+    cause;
+    constructor(cause, message) {
+        super(message);
+        this.cause = cause;
+    }
+}
+const isRecord = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function errorText(err) {
+    if (!(err instanceof Error))
+        return String(err);
+    const data = err.data;
+    const details = isRecord(data) ? data.details : undefined;
+    return typeof details === "string" ? `${err.message}: ${details}` : err.message;
+}
+/** Reasons and logs carry agent text, and reasons are posted in the room: never the credential. */
+const redact = (text) => text.replace(/Bearer\s+\S+/g, "Bearer [redacted]").replace(/bay_[A-Za-z0-9_]+/g, "bay_[redacted]");
+async function runAcpTurn(req, deps) {
+    const log = (line) => deps.log?.(redact(line));
+    const failed = (cause, reason, sessionId) => ({
+        kind: "failed",
+        cause,
+        reason: redact(reason),
+        ...(sessionId ? { sessionId } : {}),
+    });
+    // Stopped before it began: start nothing. A real spawn reports a bad binary as a LATER
+    // 'error' event, and with no listener yet that event would crash the daemon.
+    if (req.signal?.aborted)
+        return failed("cancelled", "stopped from the chat");
+    const turnTimeout = deps.turnTimeoutMs ?? TURN_TIMEOUT_MS;
+    const handshakeTimeout = deps.handshakeTimeoutMs ?? HANDSHAKE_TIMEOUT_MS;
+    // A classifier that throws must not strand the turn with its process still running.
+    const classify = (message) => {
+        try {
+            return req.classifyError(message);
+        }
+        catch (err) {
+            log(`acp: error classifier failed — ${errorText(err)}`);
+            return undefined;
+        }
+    };
+    let sdk;
+    try {
+        sdk = await (0, sdk_1.loadAcpSdk)();
+    }
+    catch (err) {
+        return failed("spawn", `the ACP library could not be loaded: ${errorText(err)}`);
+    }
+    let child;
+    try {
+        // A Windows `.cmd` shim needs its interpreter named — same fix as `codex-app-server.ts`.
+        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform);
+        child = deps.spawn(plan.file, [...plan.prefixArgs, ...req.args], {
+            cwd: req.cwd,
+            env: req.env,
+            shell: false,
+            windowsHide: true,
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+    }
+    catch (err) {
+        return failed("spawn", `the agent could not be started: ${errorText(err)}`);
+    }
+    if (!child.stdin || !child.stdout) {
+        child.kill("SIGTERM");
+        return failed("spawn", "the agent started without stdio pipes");
+    }
+    const stdin = child.stdin;
+    const stdout = child.stdout;
+    return new Promise((resolve) => {
+        let settled = false;
+        let phase = "handshake";
+        let sessionId;
+        /** True while `session/load` replays old history — those updates are not this turn's. */
+        let replaying = false;
+        let stderrTail = "";
+        let timer;
+        /** Permission questions waiting on a person. The turn clock runs only while this is zero. */
+        let asking = 0;
+        const calls = new Map();
+        const finish = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            req.signal?.removeEventListener("abort", onAbort);
+            child.kill("SIGTERM");
+            // A child that ignores the polite signal must not outlive the turn and keep acting.
+            setTimeout(() => child.kill("SIGKILL"), 5_000).unref();
+            resolve(outcome);
+        };
+        const fail = (cause, reason) => finish(failed(cause, reason, sessionId));
+        const arm = (ms, cause, reason) => {
+            clearTimeout(timer);
+            // Never after the end, never while a person is being asked: a stray timer would hold the
+            // event loop open for the whole turn budget and fire into a finished turn.
+            if (settled || asking > 0)
+                return;
+            timer = setTimeout(() => fail(cause, reason), ms);
+        };
+        const onAbort = () => fail("cancelled", "stopped from the chat");
+        child.on("error", (err) => fail("spawn", `the agent could not be started: ${errorText(err)}`));
+        child.on("exit", (code) => fail(phase === "handshake" ? "handshake" : "turn", `the agent exited (code ${code ?? "?"}) before the turn finished${stderrTail ? `: ${stderrTail.trim().slice(-300)}` : ""}`));
+        // Writing into a pipe whose reader died is an EPIPE 'error' event; unheard, it crashes the daemon.
+        stdin.on("error", (err) => log(`acp: agent stdin closed — ${errorText(err)}`));
+        child.stderr?.on("data", (d) => {
+            stderrTail = (stderrTail + d.toString()).slice(-600);
+        });
+        // Aborted while the SDK loaded: the child exists now, so stop only after its listeners are on.
+        if (req.signal?.aborted)
+            return onAbort();
+        req.signal?.addEventListener("abort", onAbort, { once: true });
+        const remember = (update) => {
+            const id = update.toolCallId;
+            if (typeof id !== "string")
+                return;
+            const known = calls.get(id);
+            const call = {
+                toolCallId: id,
+                title: typeof update.title === "string" ? update.title : (known?.title ?? ""),
+                rawInput: isRecord(update.rawInput) ? update.rawInput : (known?.rawInput ?? {}),
+            };
+            calls.set(id, call);
+            // Cursor announces a call bare ("MCP: tool", no input) and names it in a later update, so
+            // an update that carries a title or an input is news; a status-only update is not.
+            if (known && typeof update.title !== "string" && !isRecord(update.rawInput))
+                return;
+            try {
+                req.onToolCall?.(call);
+            }
+            catch (err) {
+                log(`acp: tool-call observer failed — ${errorText(err)}`);
+            }
+        };
+        const client = {
+            async sessionUpdate(params) {
+                if (replaying || !isRecord(params.update))
+                    return;
+                const kind = params.update.sessionUpdate;
+                if (kind === "tool_call" || kind === "tool_call_update")
+                    remember(params.update);
+            },
+            async requestPermission(params) {
+                // The clock stops while a person is being asked: a card may wait an hour, and that is
+                // the owner's time, not a wedged agent's.
+                clearTimeout(timer);
+                asking++;
+                let verdict = "reject";
+                try {
+                    verdict = await req.onPermission(calls.get(params.toolCall?.toolCallId ?? ""));
+                }
+                catch (err) {
+                    log(`acp: permission handler failed, refusing — ${errorText(err)}`);
+                }
+                finally {
+                    asking--;
+                }
+                arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
+                // ONLY the single-use kinds. `allow_always` would turn one tap into a standing grant.
+                const want = verdict === "allow" ? "allow_once" : "reject_once";
+                const option = (params.options ?? []).find((o) => o.kind === want);
+                return option
+                    ? { outcome: { outcome: "selected", optionId: option.optionId } }
+                    : { outcome: { outcome: "cancelled" } };
+            },
+        };
+        const drive = async () => {
+            const conn = new sdk.ClientSideConnection(() => client, sdk.ndJsonStream(stream_1.Writable.toWeb(stdin), stream_1.Readable.toWeb(stdout)));
+            arm(handshakeTimeout, "handshake", `the agent did not complete the ACP handshake within ${Math.round(handshakeTimeout / 1000)}s`);
+            const init = await conn.initialize({
+                protocolVersion: sdk.PROTOCOL_VERSION,
+                // We offer the agent nothing of ours: no file access through us, no terminal through us.
+                clientCapabilities: { fs: { readTextFile: false, writeTextFile: false }, terminal: false },
+            });
+            const caps = (init.agentCapabilities ?? {});
+            if (!caps.mcpCapabilities?.http)
+                throw new TurnFailure("unsupported", "this agent cannot connect to an HTTP MCP server, so it could never reach BayChat's tools");
+            const canResume = caps.sessionCapabilities?.resume !== undefined && caps.sessionCapabilities.resume !== null;
+            const canLoad = caps.loadSession === true;
+            phase = "session";
+            let fresh = false;
+            let memoryLost = false;
+            const open = { cwd: req.cwd, mcpServers: req.mcpServers };
+            if (req.sessionId) {
+                if (!canResume && !canLoad) {
+                    // Starting fresh on every message would answer the room as an agent with no memory of
+                    // it, every time — worse than not answering.
+                    throw new TurnFailure("unsupported", "this agent can neither resume nor load a session, so it cannot keep a conversation between messages");
+                }
+                try {
+                    if (canResume)
+                        await conn.resumeSession({ sessionId: req.sessionId, ...open });
+                    else {
+                        replaying = true;
+                        await conn.loadSession({ sessionId: req.sessionId, ...open });
+                    }
+                    sessionId = req.sessionId;
+                }
+                catch (err) {
+                    const text = errorText(err);
+                    const cause = classify(text);
+                    // A KNOWN reason (busy in a terminal, wrong folder, BayChat unreachable, no key) is an
+                    // answer about this session and must not be papered over with a fresh one.
+                    if (cause) {
+                        sessionId = req.sessionId;
+                        throw new TurnFailure(cause, text);
+                    }
+                    log(`acp: could not reopen session ${req.sessionId} (${text}) — starting a new one`);
+                    memoryLost = true;
+                }
+                finally {
+                    replaying = false;
+                }
+            }
+            if (!sessionId) {
+                const created = await conn.newSession(open);
+                sessionId = created.sessionId;
+                fresh = true;
+            }
+            if (req.sessionModeId) {
+                // Never prompt in a mode we did not choose: an agent left in another mode (Cursor's
+                // `ask` refuses BayChat's own write tools) would fail the room in a way nobody sees.
+                try {
+                    await conn.setSessionMode({ sessionId, modeId: req.sessionModeId });
+                }
+                catch (err) {
+                    throw new TurnFailure("session", `the agent would not switch to its "${req.sessionModeId}" mode: ${errorText(err)}`);
+                }
+            }
+            phase = "turn";
+            arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
+            const text = fresh && req.freshPreamble ? `${req.freshPreamble}\n\n${req.prompt}` : req.prompt;
+            const result = await conn.prompt({ sessionId, prompt: [{ type: "text", text }] });
+            return { kind: "completed", sessionId, stopReason: String(result.stopReason ?? "unknown"), fresh, memoryLost };
+        };
+        drive().then(finish, (err) => {
+            if (err instanceof TurnFailure)
+                return fail(err.cause, err.message);
+            const text = errorText(err);
+            fail(classify(text) ?? (phase === "turn" ? "turn" : phase), text);
+        });
+    });
+}

package/dist/relay/acp/commands.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAcpSessionCommand = runAcpSessionCommand;
+const agents_1 = require("./agents");
+/**
+ * The session commands that mean something different — or only mean something — for a session
+ * the relay runs over ACP. Kept out of `daemon.ts`, which only calls in.
+ *
+ * Returns true when the command was answered here; false hands it back to the daemon's own
+ * branches, which are then exactly what they were before ACP existed. A non-ACP session only
+ * ever reaches this for `/mode-*` and `/stop`, and gets a refusal that says why.
+ *
+ * Every path replies, as in `runSessionCommand`: a command produces no agent turn, so silence
+ * would be indistinguishable from failure.
+ */
+async function runAcpSessionCommand(acp, session, target, message, command, say) {
+    if (command.mode) {
+        // Anyone with COMMAND ACCESS — the owner, or a Bay owner/admin she granted (Karmen's
+        // decision, 19 Sep 2026; owner-only before). The daemon only routes a command here when the
+        // server said `commandAuthorized === true`, so this is a second, defensive check, not the
+        // gate. Absent is no. The rule-file ceiling and the platform still cap it, in `setMode`.
+        if (message.commandAuthorized !== true && message.senderIsOwner !== true) {
+            await say(`You need command access (from the owner of "${session}") to change what it may do.`);
+            return true;
+        }
+        // `setMode` holds the one rule (rule-file ceiling, then platform) — not re-implemented here.
+        const result = acp.setMode(session, command.mode);
+        const row = target.acp ? (0, agents_1.acpAgent)(target.acp.agent) : undefined;
+        await say(result.ok ? `"${session}" is now in ${(0, agents_1.describeAgentMode)(row, result.mode)}` : result.reason);
+        return true;
+    }
+    if (command.id === "stop") {
+        if (!target.acp) {
+            // Not "is not doing anything": the relay cannot see a terminal agent's turn at all.
+            await say(`"${session}" is not run by the relay, so /stop cannot reach it. Stop it in its own terminal.`);
+            return true;
+        }
+        await say(acp.stop(session)
+            ? `Stopped "${session}". Anything it had already done stays done.`
+            : `"${session}" is not doing anything right now.`);
+        return true;
+    }
+    if (command.id === "status" && target.acp) {
+        const row = (0, agents_1.acpAgent)(target.acp.agent);
+        const s = acp.status(session);
+        await say([
+            `Session "${session}" — run by the relay, no terminal`,
+            `  agent: ${row?.label ?? target.acp.agent}${row ? ` (tested with ${row.testedVersion})` : ""}`,
+            `  mode: ${(0, agents_1.describeAgentMode)(row, target.acp.mode)}`,
+            `  folder: ${target.acp.cwd}`,
+            `  now: ${s.running ? "working on a turn" : "idle"}, ${s.queued} message(s) waiting`,
+            `  memory: ${target.acp.sessionId ? "kept between messages" : "fresh on the next message"}`,
+        ].join("\n"));
+        return true;
+    }
+    if (command.id === "exit" && target.relayOwned) {
+        await say(`"${session}" is run by the relay on that computer and has no terminal to detach. Use /stop to cancel a running turn.`);
+        return true;
+    }
+    if (target.acp && (command.id === "clear" || command.id === "new")) {
+        // There is no terminal to type into: forgetting the ACP session id IS the fresh chat. The
+        // running turn is stopped first, or it would finish into the memory being closed.
+        acp.stop(session);
+        acp.reset(session);
+        await say(`"${session}" will start a fresh conversation with your next message. Its earlier memory is closed.`);
+        return true;
+    }
+    return false;
+}

package/dist/relay/acp/cursor.js

@@ -0,0 +1,271 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cursor = void 0;
+exports.cursorSessionDir = cursorSessionDir;
+exports.cursorOverrideRefusal = cursorOverrideRefusal;
+exports.watchCursorOverrides = watchCursorOverrides;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const modes_1 = require("./modes");
+const permissions_1 = require("./permissions");
+const types_1 = require("./types");
+// Cursor's CLI (`agent acp`) [run, 19 Sep 2026, CLI 2026.09.18-9a7762b — the spikes and Karmen's
+// decision are in docs/superpowers/plans/2026-09-19-acp-cursor.md]. Its ACP modes are not ours:
+// its own `ask` still READ files inside and outside the folder, so every mode runs Cursor as its
+// `agent` and takes tools away with a config deny list instead. Deny beats allow within that one
+// file, and BayChat's allowlist is empty, so every shell command raises a permission request.
+//
+// Cursor reads that config from `CURSOR_CONFIG_DIR` (undocumented; found in the CLI bundle and
+// RUN). The same folder holds Cursor's ACP chat store (`acp-sessions/`) [run, Spike 3], so it is
+// one folder per SESSION — never per mode (a `/mode-*` would lose the conversation) and never
+// per turn (every turn would). Its `cli-config.json` is rewritten for the turn's mode before each
+// turn. Nothing is written into the person's project, and the "Allow always" rules of their own
+// Cursor never reach a relay session. The sandbox is off because, run on Linux, it confined
+// nothing — the deny list and the permission rule are the whole boundary.
+const CURSOR_DENY = {
+    chat: ["Read(**)", "Read(/**)", "Write(**)", "Write(/**)", "Shell(*)", "WebFetch(*)"],
+    read: ["Write(**)", "Write(/**)", "Shell(*)", "WebFetch(*)"],
+    // `.cursor/**`: its edit tool must not plant an override file (below) [run, Spike 3: refused
+    // with "Write permission denied"; the shell fallback asked, and the permission rule refuses it].
+    ask: ["Write(.cursor/**)", "Write(**/.cursor/**)", "WebFetch(*)"],
+};
+const cursorConfig = (deny) => `${JSON.stringify({ version: 1, approvalMode: "allowlist", sandbox: { mode: "disabled" }, permissions: { allow: [], deny } }, null, 2)}\n`;
+/** Characters a session name keeps as they are in its folder name. Lower case only: see below. */
+const KEPT = /^[a-z0-9_-]$/;
+/**
+ * The folder name for a session's Cursor config. INJECTIVE and path-safe on every filesystem:
+ * every UTF-8 byte outside `[a-z0-9_-]` — upper case included, because macOS and Windows fold
+ * case, and `%` itself — becomes `%xx`, so two names can never share a folder and no name can
+ * spell `..`, a separator or a reserved device name (the `s-` prefix sees to `con`, `nul`, …).
+ */
+function cursorSessionDir(session) {
+    let encoded = "s-";
+    for (const byte of Buffer.from(session, "utf8")) {
+        const char = String.fromCharCode(byte);
+        encoded += KEPT.test(char) ? char : `%${byte.toString(16).padStart(2, "0")}`;
+    }
+    // A folder name longer than the filesystems allow would fail late and obscurely; say why now.
+    if (encoded.length > 200)
+        throw new Error(`The session name "${session.slice(0, 40)}…" is too long for its Cursor config folder. Choose a shorter one.`);
+    return encoded;
+}
+exports.cursor = {
+    id: "cursor",
+    label: "Cursor",
+    bin: "agent",
+    patches: Object.fromEntries(Object.entries(CURSOR_DENY).map(([mode, deny]) => [mode, cursorConfig(deny)])),
+    patchFile: (_mode, session) => path.join("cursor", cursorSessionDir(session), "cli-config.json"),
+    // Cursor rewrites this file itself (it adds `model`, `privacyCache`, …) and keeps `permissions`
+    // exactly [run]. Comparing bytes would rewrite it before every turn; comparing nothing would
+    // trust whatever is there. So: the fields BayChat's safety rests on, and nothing else.
+    patchIsCurrent: (onDisk, wanted) => {
+        const current = cursorSecurityFields(onDisk);
+        return current !== undefined && current === cursorSecurityFields(wanted);
+    },
+    launch(mode, patchDir, session) {
+        // No mode maps to `full`: `modesFor` never offers it, and a launch that reached here anyway
+        // must not quietly run with some other mode's config.
+        if (!this.patches[mode])
+            throw new Error(`Cursor has no ${mode} mode in BayChat`);
+        return { args: ["acp"], env: { CURSOR_CONFIG_DIR: path.join(patchDir, path.dirname(this.patchFile(mode, session))) } };
+    },
+    // Its `ask` mode refuses BayChat's own write tools ("I'm in Ask mode") [run], so an agent that
+    // must answer the room runs as `agent`, with the deny list doing the limiting.
+    acpModeId: "agent",
+    // A deny list does not rest on an OS sandbox, so `chat` and `read` hold everywhere. `ask` was
+    // only RUN on Linux, and a row ships only what has been run.
+    modesFor: (platform) => (platform === "linux" ? ["chat", "read", "ask"] : ["chat", "read"]),
+    // Only these two were named in the spike; Cursor's texts for no plan/quota, a busy session and
+    // a bad folder were not collected, so they stay unclassified (a generic line in the room).
+    classifyError(message) {
+        if (/not logged in|authenticat|login required/i.test(message))
+            return "missing-key";
+        if (/mcp.*baychat|baychat.*(unreachable|failed)/i.test(message))
+            return "baychat-unreachable";
+        return undefined;
+    },
+    // Cursor names the server of every MCP call it asks about, and the rule approves by that name.
+    // A project's own `.cursor/mcp.json` could define a server called "baychat" (in Spike 3 it was
+    // not started — but that is not a guarantee), so the name is random and new every turn.
+    mcpServerName: () => `${types_1.BAYCHAT_MCP_SERVER}-${(0, crypto_1.randomBytes)(4).toString("hex")}`,
+    toolNote: (server) => `Your BayChat tools this turn are on the MCP server "${server}" (shown as "${server}: send_message" and so on). Wherever your instructions say mcp__baychat__<tool>, use that server's <tool>. A BayChat server under any other name is not this turn's, and its calls are refused.`,
+    turnRefusal: cursorOverrideRefusal,
+    guardTurn: (cwd, onBreach) => watchCursorOverrides(cwd, onBreach),
+    decidePermission: permissions_1.decideCursorPermission,
+    keyHint: "Cursor is not logged in on that computer. There, run `agent login`.",
+    installHint: "Install it with `curl https://cursor.com/install -fsS | bash`, then run `baychat connect cursor-cli` again.",
+    // `agent` is a name any program could have. Cursor's CLI answers `--version` with a dated build
+    // id alone ("2026.09.18-9a7762b" [run]), so anything else is not started.
+    versionPattern: /^\d{4}\.\d{2}\.\d{2}-[0-9a-f]{7,}$/,
+    // Not `connect cursor`: that word already configures the Cursor EDITOR's MCP file, and the
+    // relay-run CLI must not take it over (it would silently stop doing what it does today).
+    connectCommand: "baychat connect cursor-cli",
+    // Edits cannot be ASKED in Cursor, only allowed or denied [run], so its `ask` is not dsh's.
+    modeDescriptions: {
+        ask: `ask — it edits files inside its folder without asking; edits outside it are refused; every command asks you on your phone first. ${modes_1.READS_ANYTHING}`,
+    },
+    confidence: "run",
+    checked: "2026-09-19",
+    testedVersion: "2026.09.18-9a7762b",
+};
+/**
+ * Project files under `.cursor/` that Cursor reads beside BayChat's config, and why each is refused.
+ *
+ * `cli.json` [run, Spike 3]: a project `.cursor/cli.json` allowing `Shell(*)` OVERRODE the relay's
+ * config — with BayChat's chat config (deny read, write, shell, fetch) Cursor ran a command with
+ * no permission request. "Deny beats allow" holds only inside one file. Cursor looks in the
+ * folder and its parents, so every ancestor is checked. `hooks.json`: hooks run commands on
+ * Cursor's events; not run against the relay, refused to be safe.
+ */
+const CURSOR_OVERRIDES = [
+    { name: "cli.json", why: "Cursor lets that project file override BayChat's limits for this session" },
+    {
+        name: "hooks.json",
+        why: "Cursor hooks run commands on its events, which could override BayChat's limits (this has not been tested with the relay, so it is refused to be safe)",
+    },
+];
+/**
+ * Why Cursor must not start in `cwd`: one of its override files exists there or in any folder
+ * above it, up to the filesystem root — or could not be checked. Undefined when none is there.
+ */
+function cursorOverrideRefusal(cwd) {
+    const found = findCursorOverride(cwd, presence);
+    return found && `Cursor was not started: ${found}`;
+}
+/** What was found, as a sentence that names the file and the way out — or undefined. */
+function findCursorOverride(cwd, look) {
+    for (let dir = path.resolve(cwd);; dir = path.dirname(dir)) {
+        for (const { name, why } of CURSOR_OVERRIDES) {
+            const file = path.join(dir, ".cursor", name);
+            const seen = look(file);
+            if (seen === "present")
+                return `${file} exists, and ${why}. Remove or rename it to use this session.`;
+            if (seen !== "absent")
+                return `could not check whether ${file} exists (${seen}). A file there could override BayChat's limits, so Cursor is not run until it can be checked.`;
+        }
+        if (path.dirname(dir) === dir)
+            return undefined;
+    }
+}
+/** How often a turn's guard looks, when no filesystem event has told it to look sooner. */
+const GUARD_POLL_MS = 250;
+/**
+ * For the length of ONE turn, look for what `cursorOverrideRefusal` refuses — the refusal only
+ * sees the disk as it was before the turn, and Cursor could write the file during it. Calls
+ * `onBreach` once with what it found, then stops looking. Returns how to stop.
+ *
+ * A poll is the guarantee; filesystem events on the session folder and its `.cursor` (when
+ * there) only make it sooner. Nothing is created to be watched: the folder is the person's.
+ */
+function watchCursorOverrides(cwd, onBreach, deps = REAL_WATCH) {
+    let done = false;
+    const unwatch = [];
+    let watchingDotCursor = false;
+    const stop = () => {
+        done = true;
+        clearInterval(timer);
+        for (const close of unwatch.splice(0))
+            close();
+    };
+    const check = () => {
+        if (done)
+            return;
+        if (!watchingDotCursor && deps.look(path.join(cwd, ".cursor")) === "present") {
+            watchingDotCursor = true;
+            unwatch.push(deps.watch(path.join(cwd, ".cursor"), check));
+        }
+        const found = findCursorOverride(cwd, deps.look);
+        if (!found)
+            return;
+        stop();
+        onBreach(found);
+    };
+    const timer = setInterval(check, deps.pollMs);
+    timer.unref?.();
+    unwatch.push(deps.watch(cwd, check));
+    check();
+    return stop;
+}
+const REAL_WATCH = {
+    look: presence,
+    watch(dir, onEvent) {
+        try {
+            const watcher = fs.watch(dir, { persistent: false }, onEvent);
+            watcher.on("error", () => watcher.close()); // the poll carries on without it
+            return () => watcher.close();
+        }
+        catch {
+            return () => undefined; // unwatchable here (some filesystems): the poll is the guarantee
+        }
+    },
+    pollMs: GUARD_POLL_MS,
+};
+/**
+ * Is there anything at `file`? `lstat`, so a symlink counts even when it leads nowhere. Only
+ * "no such file" is absence: a folder we may not look into could hold the file (RECURRING_MISTAKES
+ * §26), so any other error is returned as its code.
+ */
+function presence(file) {
+    try {
+        fs.lstatSync(file);
+        return "present";
+    }
+    catch (err) {
+        const code = err.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? "absent" : (code ?? "unknown error");
+    }
+}
+/** The security fields of a Cursor config, in one canonical text — or undefined if unparseable. */
+function cursorSecurityFields(text) {
+    let config;
+    try {
+        config = JSON.parse(text);
+    }
+    catch {
+        return undefined; // unparseable is "not current": it is rewritten
+    }
+    if (!config || typeof config !== "object" || Array.isArray(config))
+        return undefined;
+    const { approvalMode, sandbox, permissions } = config;
+    return canonicalJson({ approvalMode, sandbox, permissions });
+}
+/** JSON with every object's keys sorted, so key order never reads as a difference. */
+function canonicalJson(value) {
+    return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : v);
+}