baychat 0.22.0 → 0.23.0

package/dist/relay/acp/agents.js

@@ -35,15 +35,22 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ACP_AGENTS = exports.DSH_LOCAL_TOOLS = void 0;
 exports.acpAgent = acpAgent;
+exports.describeAgentMode = describeAgentMode;
+exports.otherAgentRefusal = otherAgentRefusal;
+exports.binaryIdentified = binaryIdentified;
+exports.unidentifiedBinary = unidentifiedBinary;
+exports.connectCommandFor = connectCommandFor;
 exports.matchesTestedVersion = matchesTestedVersion;
 exports.modeAllowedHere = modeAllowedHere;
 exports.acpPatchDir = acpPatchDir;
 exports.patchPath = patchPath;
-exports.writeModePatches = writeModePatches;
+exports.writeModePatch = writeModePatch;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../../config");
 const modes_1 = require("./modes");
+const cursor_1 = require("./cursor");
+const permissions_1 = require("./permissions");
 // Every tool plugin in dsh's `acp` profile (`--profile acp --dump-config`, 0.1.5-rc.2) [run].
 // MCP clients are mounted per ACP session by dsh-acp itself and are untouched by these.
 // Confirmed against docs/planning/2026-09-19-acp-research/dump-acp-default.yml — the tool-* ids
@@ -62,10 +69,11 @@ const dsh = {
         chat: disable(exports.DSH_LOCAL_TOOLS, "chat mode: no local tools at all."),
         read: disable(exports.DSH_LOCAL_TOOLS.filter((id) => id !== "tool-fs" && id !== "tool-fs-search"), "read mode: file read and search only — no shell, no subagents, no web."),
     },
-    launch(mode, patchDir) {
+    patchFile: (mode) => `dsh-${mode}.yml`, // shared by every dsh session: its patches name no session
+    launch(mode, patchDir, session) {
         const args = ["--profile", "acp"];
         if (this.patches[mode])
-            args.push("--patch", patchPath(this, mode, patchDir));
+            args.push("--patch", patchPath(this, mode, session, patchDir));
         // `danger-full-access` is deliberately unreachable from here: no mode maps to it.
         return { args, env: { DSH_PERMISSION_MODE: mode === "full" ? "workspace-write" : "read-only" } };
     },
@@ -84,16 +92,48 @@ const dsh = {
             return "session";
         return undefined;
     },
+    decidePermission: permissions_1.decideDshPermission,
     keyHint: "DeepSeek has no API key on that computer. There, run `dsh web` and add the key on the Models page.",
     installHint: "Install it with `npm install -g @deepseek-ai/dsh`, then run `baychat connect dsh` again.",
+    connectCommand: "baychat connect dsh",
+    credentialSeen: (home) => Boolean(process.env.DEEPSEEK_API_KEY) ||
+        fs.existsSync(path.join(process.env.DSH_HOME ?? path.join(home, ".dsh"), ".credentials.yaml")),
+    // Experimental and not security-audited (R11/R17).
+    safetyNote: "DeepSeek recommends a disposable VM or container",
     confidence: "run",
     checked: "2026-09-19",
     testedVersion: "0.1.5-rc.2",
 };
-exports.ACP_AGENTS = [dsh];
+exports.ACP_AGENTS = [dsh, cursor_1.cursor];
 function acpAgent(id) {
     return exports.ACP_AGENTS.find((row) => row.id === id);
 }
+/** How `mode` is described for a session of this agent: its own words if it has them, else the shared ones. */
+function describeAgentMode(row, mode) {
+    return row?.modeDescriptions?.[mode] ?? (0, modes_1.describeMode)(mode);
+}
+/**
+ * The refusal for giving `row` a session name another agent's relay-run session already holds,
+ * or undefined when the name is free or already this agent's. A session id, a binary and a mode
+ * belong to the agent that made them; handing them to a different agent is never a re-register.
+ */
+function otherAgentRefusal(row, session, heldBy) {
+    if (heldBy === undefined || heldBy === row.id)
+        return undefined;
+    return `"${session}" is already run by the relay for ${acpAgent(heldBy)?.label ?? heldBy}. Choose another name (${row.connectCommand} --session <name>).`;
+}
+/** Is `version` (a binary's `--version` first line) this agent's? True for a row with no pattern. */
+function binaryIdentified(row, version) {
+    return row.versionPattern?.test(version) ?? true;
+}
+/** Said when the binary found under the agent's name is not the agent. Names the fix. */
+function unidentifiedBinary(row, binaryPath, version) {
+    return `${binaryPath} does not look like ${row.label}'s CLI (\`--version\` said "${version}"). ${row.installHint}`;
+}
+/** The setup command to name for `agent` — a neutral one when this relay does not know it. */
+function connectCommandFor(agent) {
+    return (agent !== undefined ? acpAgent(agent)?.connectCommand : undefined) ?? "baychat connect <agent>";
+}
 /** A version-string character: digits, letters, dot, plus, hyphen — the semver/rc alphabet. */
 const VERSION_TOKEN_CHAR = /[0-9A-Za-z.+-]/;
 /**
@@ -132,7 +172,7 @@ function matchesTestedVersion(version, tested) {
  */
 function modeAllowedHere(row, mode, maxMode, platform) {
     if ((0, modes_1.modeRank)(mode) > (0, modes_1.modeRank)(maxMode)) {
-        return { ok: false, reason: `${mode} is above the highest mode allowed for that folder (${maxMode}). That ceiling is set on the computer, never from a chat: run \`baychat connect ${row.id}\` there to change it.` };
+        return { ok: false, reason: `${mode} is above the highest mode allowed for that folder (${maxMode}). That ceiling is set on the computer, never from a chat: run \`${row.connectCommand}\` there to change it.` };
     }
     if (!row.modesFor(platform).includes(mode)) {
         return { ok: false, reason: `${mode} is not offered on that computer's operating system, because ${row.label}'s sandbox cannot fully enforce it there.` };
@@ -143,36 +183,41 @@ function modeAllowedHere(row, mode, maxMode, platform) {
 function acpPatchDir() {
     return path.join((0, config_1.configDir)(), "acp");
 }
-function patchPath(row, mode, dir) {
-    return path.join(dir, `${row.id}-${mode}.yml`);
+function patchPath(row, mode, session, dir) {
+    return path.join(dir, row.patchFile(mode, session));
 }
 /**
- * (Re)write this agent's mode patches. Idempotent; called by `connect`, at daemon start and
- * before every turn.
+ * (Re)write the overlay a turn of `session` in `mode` reads, if the agent needs one there.
+ * Idempotent; called by `connect` and before every turn, so an upgrade that changes an overlay,
+ * or a `/mode-*` that changes which one applies, takes effect at the next turn.
  *
- * NEVER TRUNCATE IN PLACE. Two sessions drain concurrently, so one session's rewrite can land
- * while another's freshly spawned agent is reading the same patch — and an empty `chat` patch is
- * an agent with every local tool. A patch that is already right is left alone; one that is not is
- * written beside it and renamed over it, so a reader sees the old file or the new, never half.
+ * NEVER TRUNCATE IN PLACE. dsh's overlays are shared by its sessions, which drain concurrently,
+ * so one session's rewrite can land while another's freshly spawned agent is reading the same
+ * file — and an empty `chat` patch is an agent with every local tool. An overlay that is already
+ * right is left alone; one that is not is written beside it and renamed over it, so a reader sees
+ * the old file or the new, never half.
  */
-function writeModePatches(row, dir) {
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    for (const [mode, content] of Object.entries(row.patches)) {
-        const file = patchPath(row, mode, dir);
-        if (readOrUndefined(file) === content) {
-            fs.chmodSync(file, 0o600); // permissions only — the content and the inode stay as they are
-            continue;
-        }
-        const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-        try {
-            fs.writeFileSync(tmp, content, { mode: 0o600, flag: "wx" });
-            fs.chmodSync(tmp, 0o600); // `mode` is filtered by the umask
-            fs.renameSync(tmp, file);
-        }
-        catch (err) {
-            fs.rmSync(tmp, { force: true });
-            throw err;
-        }
+function writeModePatch(row, mode, session, dir) {
+    const content = row.patches[mode];
+    if (content === undefined)
+        return;
+    const file = patchPath(row, mode, session, dir);
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const onDisk = readOrUndefined(file);
+    const isCurrent = row.patchIsCurrent ?? ((current, wanted) => current === wanted);
+    if (onDisk !== undefined && isCurrent(onDisk, content)) {
+        fs.chmodSync(file, 0o600); // permissions only — the content and the inode stay as they are
+        return;
+    }
+    const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    try {
+        fs.writeFileSync(tmp, content, { mode: 0o600, flag: "wx" });
+        fs.chmodSync(tmp, 0o600); // `mode` is filtered by the umask
+        fs.renameSync(tmp, file);
+    }
+    catch (err) {
+        fs.rmSync(tmp, { force: true });
+        throw err;
     }
 }
 /** A read error (absent, unreadable) means "write it". */

package/dist/relay/acp/client.js

@@ -143,7 +143,9 @@ async function runAcpTurn(req, deps) {
                 rawInput: isRecord(update.rawInput) ? update.rawInput : (known?.rawInput ?? {}),
             };
             calls.set(id, call);
-            if (known)
+            // Cursor announces a call bare ("MCP: tool", no input) and names it in a later update, so
+            // an update that carries a title or an input is news; a status-only update is not.
+            if (known && typeof update.title !== "string" && !isRecord(update.rawInput))
                 return;
             try {
                 req.onToolCall?.(call);
@@ -237,6 +239,16 @@ async function runAcpTurn(req, deps) {
                 sessionId = created.sessionId;
                 fresh = true;
             }
+            if (req.sessionModeId) {
+                // Never prompt in a mode we did not choose: an agent left in another mode (Cursor's
+                // `ask` refuses BayChat's own write tools) would fail the room in a way nobody sees.
+                try {
+                    await conn.setSessionMode({ sessionId, modeId: req.sessionModeId });
+                }
+                catch (err) {
+                    throw new TurnFailure("session", `the agent would not switch to its "${req.sessionModeId}" mode: ${errorText(err)}`);
+                }
+            }
             phase = "turn";
             arm(turnTimeout, "timeout", `the turn did not finish within ${Math.round(turnTimeout / 1000)}s`);
             const text = fresh && req.freshPreamble ? `${req.freshPreamble}\n\n${req.prompt}` : req.prompt;

package/dist/relay/acp/commands.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runAcpSessionCommand = runAcpSessionCommand;
 const agents_1 = require("./agents");
-const modes_1 = require("./modes");
 /**
  * The session commands that mean something different — or only mean something — for a session
  * the relay runs over ACP. Kept out of `daemon.ts`, which only calls in.
@@ -26,7 +25,8 @@ async function runAcpSessionCommand(acp, session, target, message, command, say)
         }
         // `setMode` holds the one rule (rule-file ceiling, then platform) — not re-implemented here.
         const result = acp.setMode(session, command.mode);
-        await say(result.ok ? `"${session}" is now in ${(0, modes_1.describeMode)(result.mode)}` : result.reason);
+        const row = target.acp ? (0, agents_1.acpAgent)(target.acp.agent) : undefined;
+        await say(result.ok ? `"${session}" is now in ${(0, agents_1.describeAgentMode)(row, result.mode)}` : result.reason);
         return true;
     }
     if (command.id === "stop") {
@@ -46,7 +46,7 @@ async function runAcpSessionCommand(acp, session, target, message, command, say)
         await say([
             `Session "${session}" — run by the relay, no terminal`,
             `  agent: ${row?.label ?? target.acp.agent}${row ? ` (tested with ${row.testedVersion})` : ""}`,
-            `  mode: ${(0, modes_1.describeMode)(target.acp.mode)}`,
+            `  mode: ${(0, agents_1.describeAgentMode)(row, target.acp.mode)}`,
             `  folder: ${target.acp.cwd}`,
             `  now: ${s.running ? "working on a turn" : "idle"}, ${s.queued} message(s) waiting`,
             `  memory: ${target.acp.sessionId ? "kept between messages" : "fresh on the next message"}`,

package/dist/relay/acp/cursor.js

@@ -0,0 +1,271 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cursor = void 0;
+exports.cursorSessionDir = cursorSessionDir;
+exports.cursorOverrideRefusal = cursorOverrideRefusal;
+exports.watchCursorOverrides = watchCursorOverrides;
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const modes_1 = require("./modes");
+const permissions_1 = require("./permissions");
+const types_1 = require("./types");
+// Cursor's CLI (`agent acp`) [run, 19 Sep 2026, CLI 2026.09.18-9a7762b — the spikes and Karmen's
+// decision are in docs/superpowers/plans/2026-09-19-acp-cursor.md]. Its ACP modes are not ours:
+// its own `ask` still READ files inside and outside the folder, so every mode runs Cursor as its
+// `agent` and takes tools away with a config deny list instead. Deny beats allow within that one
+// file, and BayChat's allowlist is empty, so every shell command raises a permission request.
+//
+// Cursor reads that config from `CURSOR_CONFIG_DIR` (undocumented; found in the CLI bundle and
+// RUN). The same folder holds Cursor's ACP chat store (`acp-sessions/`) [run, Spike 3], so it is
+// one folder per SESSION — never per mode (a `/mode-*` would lose the conversation) and never
+// per turn (every turn would). Its `cli-config.json` is rewritten for the turn's mode before each
+// turn. Nothing is written into the person's project, and the "Allow always" rules of their own
+// Cursor never reach a relay session. The sandbox is off because, run on Linux, it confined
+// nothing — the deny list and the permission rule are the whole boundary.
+const CURSOR_DENY = {
+    chat: ["Read(**)", "Read(/**)", "Write(**)", "Write(/**)", "Shell(*)", "WebFetch(*)"],
+    read: ["Write(**)", "Write(/**)", "Shell(*)", "WebFetch(*)"],
+    // `.cursor/**`: its edit tool must not plant an override file (below) [run, Spike 3: refused
+    // with "Write permission denied"; the shell fallback asked, and the permission rule refuses it].
+    ask: ["Write(.cursor/**)", "Write(**/.cursor/**)", "WebFetch(*)"],
+};
+const cursorConfig = (deny) => `${JSON.stringify({ version: 1, approvalMode: "allowlist", sandbox: { mode: "disabled" }, permissions: { allow: [], deny } }, null, 2)}\n`;
+/** Characters a session name keeps as they are in its folder name. Lower case only: see below. */
+const KEPT = /^[a-z0-9_-]$/;
+/**
+ * The folder name for a session's Cursor config. INJECTIVE and path-safe on every filesystem:
+ * every UTF-8 byte outside `[a-z0-9_-]` — upper case included, because macOS and Windows fold
+ * case, and `%` itself — becomes `%xx`, so two names can never share a folder and no name can
+ * spell `..`, a separator or a reserved device name (the `s-` prefix sees to `con`, `nul`, …).
+ */
+function cursorSessionDir(session) {
+    let encoded = "s-";
+    for (const byte of Buffer.from(session, "utf8")) {
+        const char = String.fromCharCode(byte);
+        encoded += KEPT.test(char) ? char : `%${byte.toString(16).padStart(2, "0")}`;
+    }
+    // A folder name longer than the filesystems allow would fail late and obscurely; say why now.
+    if (encoded.length > 200)
+        throw new Error(`The session name "${session.slice(0, 40)}…" is too long for its Cursor config folder. Choose a shorter one.`);
+    return encoded;
+}
+exports.cursor = {
+    id: "cursor",
+    label: "Cursor",
+    bin: "agent",
+    patches: Object.fromEntries(Object.entries(CURSOR_DENY).map(([mode, deny]) => [mode, cursorConfig(deny)])),
+    patchFile: (_mode, session) => path.join("cursor", cursorSessionDir(session), "cli-config.json"),
+    // Cursor rewrites this file itself (it adds `model`, `privacyCache`, …) and keeps `permissions`
+    // exactly [run]. Comparing bytes would rewrite it before every turn; comparing nothing would
+    // trust whatever is there. So: the fields BayChat's safety rests on, and nothing else.
+    patchIsCurrent: (onDisk, wanted) => {
+        const current = cursorSecurityFields(onDisk);
+        return current !== undefined && current === cursorSecurityFields(wanted);
+    },
+    launch(mode, patchDir, session) {
+        // No mode maps to `full`: `modesFor` never offers it, and a launch that reached here anyway
+        // must not quietly run with some other mode's config.
+        if (!this.patches[mode])
+            throw new Error(`Cursor has no ${mode} mode in BayChat`);
+        return { args: ["acp"], env: { CURSOR_CONFIG_DIR: path.join(patchDir, path.dirname(this.patchFile(mode, session))) } };
+    },
+    // Its `ask` mode refuses BayChat's own write tools ("I'm in Ask mode") [run], so an agent that
+    // must answer the room runs as `agent`, with the deny list doing the limiting.
+    acpModeId: "agent",
+    // A deny list does not rest on an OS sandbox, so `chat` and `read` hold everywhere. `ask` was
+    // only RUN on Linux, and a row ships only what has been run.
+    modesFor: (platform) => (platform === "linux" ? ["chat", "read", "ask"] : ["chat", "read"]),
+    // Only these two were named in the spike; Cursor's texts for no plan/quota, a busy session and
+    // a bad folder were not collected, so they stay unclassified (a generic line in the room).
+    classifyError(message) {
+        if (/not logged in|authenticat|login required/i.test(message))
+            return "missing-key";
+        if (/mcp.*baychat|baychat.*(unreachable|failed)/i.test(message))
+            return "baychat-unreachable";
+        return undefined;
+    },
+    // Cursor names the server of every MCP call it asks about, and the rule approves by that name.
+    // A project's own `.cursor/mcp.json` could define a server called "baychat" (in Spike 3 it was
+    // not started — but that is not a guarantee), so the name is random and new every turn.
+    mcpServerName: () => `${types_1.BAYCHAT_MCP_SERVER}-${(0, crypto_1.randomBytes)(4).toString("hex")}`,
+    toolNote: (server) => `Your BayChat tools this turn are on the MCP server "${server}" (shown as "${server}: send_message" and so on). Wherever your instructions say mcp__baychat__<tool>, use that server's <tool>. A BayChat server under any other name is not this turn's, and its calls are refused.`,
+    turnRefusal: cursorOverrideRefusal,
+    guardTurn: (cwd, onBreach) => watchCursorOverrides(cwd, onBreach),
+    decidePermission: permissions_1.decideCursorPermission,
+    keyHint: "Cursor is not logged in on that computer. There, run `agent login`.",
+    installHint: "Install it with `curl https://cursor.com/install -fsS | bash`, then run `baychat connect cursor-cli` again.",
+    // `agent` is a name any program could have. Cursor's CLI answers `--version` with a dated build
+    // id alone ("2026.09.18-9a7762b" [run]), so anything else is not started.
+    versionPattern: /^\d{4}\.\d{2}\.\d{2}-[0-9a-f]{7,}$/,
+    // Not `connect cursor`: that word already configures the Cursor EDITOR's MCP file, and the
+    // relay-run CLI must not take it over (it would silently stop doing what it does today).
+    connectCommand: "baychat connect cursor-cli",
+    // Edits cannot be ASKED in Cursor, only allowed or denied [run], so its `ask` is not dsh's.
+    modeDescriptions: {
+        ask: `ask — it edits files inside its folder without asking; edits outside it are refused; every command asks you on your phone first. ${modes_1.READS_ANYTHING}`,
+    },
+    confidence: "run",
+    checked: "2026-09-19",
+    testedVersion: "2026.09.18-9a7762b",
+};
+/**
+ * Project files under `.cursor/` that Cursor reads beside BayChat's config, and why each is refused.
+ *
+ * `cli.json` [run, Spike 3]: a project `.cursor/cli.json` allowing `Shell(*)` OVERRODE the relay's
+ * config — with BayChat's chat config (deny read, write, shell, fetch) Cursor ran a command with
+ * no permission request. "Deny beats allow" holds only inside one file. Cursor looks in the
+ * folder and its parents, so every ancestor is checked. `hooks.json`: hooks run commands on
+ * Cursor's events; not run against the relay, refused to be safe.
+ */
+const CURSOR_OVERRIDES = [
+    { name: "cli.json", why: "Cursor lets that project file override BayChat's limits for this session" },
+    {
+        name: "hooks.json",
+        why: "Cursor hooks run commands on its events, which could override BayChat's limits (this has not been tested with the relay, so it is refused to be safe)",
+    },
+];
+/**
+ * Why Cursor must not start in `cwd`: one of its override files exists there or in any folder
+ * above it, up to the filesystem root — or could not be checked. Undefined when none is there.
+ */
+function cursorOverrideRefusal(cwd) {
+    const found = findCursorOverride(cwd, presence);
+    return found && `Cursor was not started: ${found}`;
+}
+/** What was found, as a sentence that names the file and the way out — or undefined. */
+function findCursorOverride(cwd, look) {
+    for (let dir = path.resolve(cwd);; dir = path.dirname(dir)) {
+        for (const { name, why } of CURSOR_OVERRIDES) {
+            const file = path.join(dir, ".cursor", name);
+            const seen = look(file);
+            if (seen === "present")
+                return `${file} exists, and ${why}. Remove or rename it to use this session.`;
+            if (seen !== "absent")
+                return `could not check whether ${file} exists (${seen}). A file there could override BayChat's limits, so Cursor is not run until it can be checked.`;
+        }
+        if (path.dirname(dir) === dir)
+            return undefined;
+    }
+}
+/** How often a turn's guard looks, when no filesystem event has told it to look sooner. */
+const GUARD_POLL_MS = 250;
+/**
+ * For the length of ONE turn, look for what `cursorOverrideRefusal` refuses — the refusal only
+ * sees the disk as it was before the turn, and Cursor could write the file during it. Calls
+ * `onBreach` once with what it found, then stops looking. Returns how to stop.
+ *
+ * A poll is the guarantee; filesystem events on the session folder and its `.cursor` (when
+ * there) only make it sooner. Nothing is created to be watched: the folder is the person's.
+ */
+function watchCursorOverrides(cwd, onBreach, deps = REAL_WATCH) {
+    let done = false;
+    const unwatch = [];
+    let watchingDotCursor = false;
+    const stop = () => {
+        done = true;
+        clearInterval(timer);
+        for (const close of unwatch.splice(0))
+            close();
+    };
+    const check = () => {
+        if (done)
+            return;
+        if (!watchingDotCursor && deps.look(path.join(cwd, ".cursor")) === "present") {
+            watchingDotCursor = true;
+            unwatch.push(deps.watch(path.join(cwd, ".cursor"), check));
+        }
+        const found = findCursorOverride(cwd, deps.look);
+        if (!found)
+            return;
+        stop();
+        onBreach(found);
+    };
+    const timer = setInterval(check, deps.pollMs);
+    timer.unref?.();
+    unwatch.push(deps.watch(cwd, check));
+    check();
+    return stop;
+}
+const REAL_WATCH = {
+    look: presence,
+    watch(dir, onEvent) {
+        try {
+            const watcher = fs.watch(dir, { persistent: false }, onEvent);
+            watcher.on("error", () => watcher.close()); // the poll carries on without it
+            return () => watcher.close();
+        }
+        catch {
+            return () => undefined; // unwatchable here (some filesystems): the poll is the guarantee
+        }
+    },
+    pollMs: GUARD_POLL_MS,
+};
+/**
+ * Is there anything at `file`? `lstat`, so a symlink counts even when it leads nowhere. Only
+ * "no such file" is absence: a folder we may not look into could hold the file (RECURRING_MISTAKES
+ * §26), so any other error is returned as its code.
+ */
+function presence(file) {
+    try {
+        fs.lstatSync(file);
+        return "present";
+    }
+    catch (err) {
+        const code = err.code;
+        return code === "ENOENT" || code === "ENOTDIR" ? "absent" : (code ?? "unknown error");
+    }
+}
+/** The security fields of a Cursor config, in one canonical text — or undefined if unparseable. */
+function cursorSecurityFields(text) {
+    let config;
+    try {
+        config = JSON.parse(text);
+    }
+    catch {
+        return undefined; // unparseable is "not current": it is rewritten
+    }
+    if (!config || typeof config !== "object" || Array.isArray(config))
+        return undefined;
+    const { approvalMode, sandbox, permissions } = config;
+    return canonicalJson({ approvalMode, sandbox, permissions });
+}
+/** JSON with every object's keys sorted, so key order never reads as a difference. */
+function canonicalJson(value) {
+    return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v)
+        ? Object.fromEntries(Object.entries(v).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)))
+        : v);
+}

package/dist/relay/acp/daemon-glue.js

@@ -49,7 +49,7 @@ const presence_1 = require("./presence");
 /**
  * The daemon's ACP upkeep, kept out of `daemon.ts` so that file only calls in.
  *
- * Everything here is reached from a thin call site in the daemon: start-up (patches and the
+ * Everything here is reached from a thin call site in the daemon: start-up (the
  * keep-alive), the live-session list (a lapsed relay-owned session), and the `acp-register`
  * socket frame. None of it runs for a session without `acp`.
  */
@@ -75,20 +75,12 @@ async function keepAcpSessionsAlive(deps) {
     }
 }
 /**
- * Daemon start: (re)write every agent's mode patches, refresh relay-owned sessions now, and
- * again every 12 h — a quiet relay-owned session would otherwise go deaf overnight. Returns
- * the timer for `stop()` to clear; it is unref'd so it never holds the process open.
+ * Daemon start: refresh relay-owned sessions now, and again every 12 h — a quiet relay-owned
+ * session would otherwise go deaf overnight. (Mode overlays are written by the runner before
+ * every turn, for that turn's session and mode.) Returns the timer for `stop()` to clear; it is
+ * unref'd so it never holds the process open.
  */
-function startAcpUpkeep(keepAlive, log) {
-    for (const row of agents_1.ACP_AGENTS) {
-        try {
-            (0, agents_1.writeModePatches)(row, (0, agents_1.acpPatchDir)());
-        }
-        catch (err) {
-            // Not fatal: the runner rewrites them before every turn and reports its own failure.
-            log(`acp: could not write ${row.id}'s mode patches — ${errText(err)}`);
-        }
-    }
+function startAcpUpkeep(keepAlive) {
     void keepAlive();
     const timer = setInterval(() => void keepAlive(), exports.ACP_KEEPALIVE_MS);
     timer.unref();
@@ -157,8 +149,11 @@ function registerAcpFrame(frame, deps) {
     // resume id, add `acp`, and hand its name to this agent from then on. Refused instead.
     const current = deps.registry.get(frame.session);
     if (current && !current.acp) {
-        return { ok: false, message: `A session named "${frame.session}" already exists on this computer and is not run by the relay. Choose another name (baychat connect dsh --session <name>).` };
+        return { ok: false, message: `A session named "${frame.session}" already exists on this computer and is not run by the relay. Choose another name (${row.connectCommand} --session <name>).` };
     }
+    const otherAgent = (0, agents_1.otherAgentRefusal)(row, frame.session, current?.acp?.agent);
+    if (otherAgent)
+        return { ok: false, message: otherAgent };
     const existing = current?.acp;
     if (existing && (0, modes_1.modeRank)(acp.mode) > (0, modes_1.modeRank)(existing.mode)) {
         return { ok: false, message: `A running session's mode can only be raised from the chat, with /mode-${acp.mode} (you, or anyone you gave command access).` };
@@ -175,6 +170,8 @@ function registerAcpFrame(frame, deps) {
         if (!found.ok || !path.isAbsolute(found.path)) {
             return { ok: false, message: `${row.label} is not installed where the relay can find it. ${row.installHint}` };
         }
+        if (!(0, agents_1.binaryIdentified)(row, found.version))
+            return { ok: false, message: (0, agents_1.unidentifiedBinary)(row, found.path, found.version) };
         runtimeBin = found.path;
     }
     // The agent's own session id survives a re-register in the same folder; a moved folder

package/dist/relay/acp/modes.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACP_MODES = void 0;
+exports.READS_ANYTHING = exports.ACP_MODES = void 0;
 exports.isAcpMode = isAcpMode;
 exports.modeRank = modeRank;
 exports.clampMode = clampMode;
@@ -24,12 +24,12 @@ function usesLocalTools(mode) {
 // Said in the room whenever a mode is set, and printed by `connect`. The limit is stated every
 // time because the agent's sandbox confines WRITES and never reads — a person choosing `read`
 // must not believe it means "only this folder".
-const READS_ANYTHING = "It can read any file your account can, not only this folder — only `chat` protects private files.";
+exports.READS_ANYTHING = "It can read any file your account can, not only this folder — only `chat` protects private files.";
 const DESCRIPTIONS = {
     chat: "chat — BayChat tools only. It cannot read, write or run anything on this computer.",
-    read: `read — it can read and search files, and cannot run commands or write. ${READS_ANYTHING}`,
-    ask: `ask — it can run commands; every write, and anything needing more rights, asks you on your phone first. Commands that only read run without asking. ${READS_ANYTHING}`,
-    full: `full — it can write and run commands inside its folder without asking. ${READS_ANYTHING}`,
+    read: `read — it can read and search files, and cannot run commands or write. ${exports.READS_ANYTHING}`,
+    ask: `ask — it can run commands; every write, and anything needing more rights, asks you on your phone first. Commands that only read run without asking. ${exports.READS_ANYTHING}`,
+    full: `full — it can write and run commands inside its folder without asking. ${exports.READS_ANYTHING}`,
 };
 function describeMode(mode) {
     return DESCRIPTIONS[mode];