baychat 0.24.0 → 0.25.1

package/dist/relay/compact-command.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPACT_COMMAND = exports.sanitizeCompactFocus = exports.COMPACT_FOCUS_MAX = exports.COMPACT_TRIGGER = void 0;
+exports.parseCompactCommand = parseCompactCommand;
+exports.compactKeys = compactKeys;
+const compact_focus_1 = require("./compact-focus");
+Object.defineProperty(exports, "COMPACT_FOCUS_MAX", { enumerable: true, get: function () { return compact_focus_1.COMPACT_FOCUS_MAX; } });
+Object.defineProperty(exports, "sanitizeCompactFocus", { enumerable: true, get: function () { return compact_focus_1.sanitizeCompactFocus; } });
+/**
+ * `/compact [focus]` — tidy a session's context now, optionally saying what to keep.
+ *
+ * ── 🔒 THE ONE COMMAND WITH AN ARGUMENT, AND WHY IT IS SAFE TO HAVE ONE ─────────────────
+ *
+ * Every other session command obeys "the wire carries a command NAME, never keystrokes"
+ * (session-commands.ts). This one carries one line of text, because Claude Code's own
+ * `/compact` takes instructions ("/compact keep the API decisions") and a tidy without them
+ * throws away what the person cared about. So the text is allowed in, and caged — the cage is
+ * `compact-focus.ts`, a twin the API applies too when the app asks for a tidy — and it is typed
+ * LITERALLY (`send-keys -l`, via `typeIntoPane`, which refuses `^`, `\` and control characters
+ * again on its own). Anything outside the cage is refused, by reason, and nothing is typed.
+ * Only Claude Code takes a focus; Codex's `/compact` takes none (checked against codex-cli
+ * 0.154.0's command list), so a focus sent to Codex is refused rather than silently dropped.
+ */
+exports.COMPACT_TRIGGER = "/compact";
+exports.COMPACT_COMMAND = {
+    id: "compact",
+    trigger: exports.COMPACT_TRIGGER,
+    summary: `Tidy this session's context now (Claude Code, Codex). Claude Code takes a one-line focus: /compact keep the API decisions — letters, numbers, spaces and ${compact_focus_1.COMPACT_FOCUS_PUNCTUATION}, up to ${compact_focus_1.COMPACT_FOCUS_MAX} characters.`,
+};
+/**
+ * `/compact` or `/compact <focus>` → the parse; anything else → undefined (it is chat).
+ *
+ * The command word is matched exactly and case-insensitively, as the other commands are:
+ * "can you /compact please" and "/compacting" are sentences, not commands.
+ */
+function parseCompactCommand(text) {
+    const trimmed = text.trimStart();
+    if (trimmed.slice(0, exports.COMPACT_TRIGGER.length).toLowerCase() !== exports.COMPACT_TRIGGER)
+        return undefined;
+    // Trailing whitespace only: a SECOND line has non-space after its newline, so it survives
+    // this and is refused below.
+    const tail = trimmed.slice(exports.COMPACT_TRIGGER.length).trimEnd();
+    if (tail === "")
+        return { kind: "compact" };
+    // "/compacting" is a word, not the command: a separator must follow the trigger.
+    if (!/^\s/u.test(tail))
+        return undefined;
+    const checked = (0, compact_focus_1.sanitizeCompactFocus)(tail);
+    if (!checked.ok)
+        return { kind: "refused", reason: `/compact was not run: ${checked.reason}` };
+    return checked.focus ? { kind: "compact", focus: checked.focus } : { kind: "compact" };
+}
+/** What to type for this runtime, or why nothing can be. */
+function compactKeys(runtime, focus) {
+    if (runtime === "claude")
+        return { ok: true, keys: focus ? `${exports.COMPACT_TRIGGER} ${focus}` : exports.COMPACT_TRIGGER };
+    if (runtime === "codex") {
+        return focus
+            ? { ok: false, reason: "Codex's /compact takes no focus. Send /compact on its own to tidy it." }
+            : { ok: true, keys: exports.COMPACT_TRIGGER };
+    }
+    return { ok: false, reason: `/compact is only for Claude Code and Codex sessions; this one runs ${runtime}.` };
+}

package/dist/relay/compact-focus.attacks.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPACT_FOCUS_ATTACKS = void 0;
+/**
+ * Focus texts BOTH the relay and the API must refuse — the injection attempts the cage in
+ * `compact-focus.ts` exists for. Each is what follows `/compact` in a message (a leading space
+ * included where a person would type one). A twin, byte-identical in
+ * `packages/cli/src/relay/` and `apps/api/src/lib/`; each side runs every entry through its own
+ * copy of `sanitizeCompactFocus`, and the parity test holds the two files together.
+ *
+ * It imports nothing (the two packages resolve imports differently), so the refusal codes are
+ * spelled out here; they are `CompactFocusRefusal`'s, checked by the tests that use them.
+ */
+exports.COMPACT_FOCUS_ATTACKS = [
+    { focus: " keep this\n/clear", code: "MULTILINE", reason: /single line/ },
+    { focus: " keep this\r\nrm -rf ~", code: "MULTILINE", reason: /single line/ },
+    { focus: "\nrm -rf ~", code: "MULTILINE", reason: /single line/ },
+    { focus: " keep\u2028this", code: "MULTILINE", reason: /single line/ },
+    { focus: " keep\u2029this", code: "MULTILINE", reason: /single line/ },
+    { focus: " \u001b[2J\u001b[31mred", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " keep\tthis", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " a\u0003b", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " safe\u202Eesrever", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " zero\u200Bwidth", code: "CONTROL", reason: /control or invisible/ },
+    { focus: " $(rm -rf ~)", code: "CHARACTER", reason: /"\$" is not allowed/ },
+    { focus: " `id`", code: "CHARACTER", reason: /"`" is not allowed/ },
+    { focus: " keep ^C", code: "CHARACTER", reason: /"\^" is not allowed/ },
+    { focus: " back\\slash", code: "CHARACTER", reason: /"\\" is not allowed/ },
+    { focus: " read @~/.ssh/id_rsa", code: "CHARACTER", reason: /"@" is not allowed/ },
+    { focus: " a | b", code: "CHARACTER", reason: /"\|" is not allowed/ },
+    { focus: " a > /etc/passwd", code: "CHARACTER", reason: /">" is not allowed/ },
+    { focus: " #memory", code: "CHARACTER", reason: /"#" is not allowed/ },
+    { focus: " {x}", code: "CHARACTER", reason: /"\{" is not allowed/ },
+    { focus: " /clear", code: "LEADING_SLASH", reason: /cannot start with \// },
+    { focus: ` ${"a".repeat(201)}`, code: "TOO_LONG", reason: /longer than 200/ },
+];

package/dist/relay/compact-focus.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * The cage a `/compact` focus goes through before anyone types it into a terminal.
+ *
+ * ── A TWIN, BYTE-IDENTICAL IN TWO PLACES ──────────────────────────────────────────────
+ *
+ *   packages/cli/src/relay/compact-focus.ts   — the relay, which TYPES the focus (send-keys -l)
+ *   apps/api/src/lib/compact-focus.ts         — the API, which refuses a bad focus at the door
+ *                                               ("tidy up now" from the app)
+ *
+ * The API's check is not the safety: the relay re-checks everything it types, whoever sent
+ * it. It exists so the app can say WHY at once instead of the relay saying it in the chat
+ * later — and a server that judged a focus differently from the relay would accept what the
+ * relay then refuses, or refuse what it would type. So there is one rule, in one file, copied
+ * verbatim (it imports nothing) and held together by `apps/api/src/lib/compact-focus.parity.test.ts`.
+ * The attack strings both sides must refuse live beside it, twinned the same way
+ * (`compact-focus.attacks.ts`). Change one copy, change both.
+ *
+ * ── THE RULES ─────────────────────────────────────────────────────────────────────────
+ *
+ *   - ONE line: no CR, LF, or Unicode line/paragraph separators. A newline would be Enter,
+ *     and Enter followed by anything is a second command typed into someone's terminal.
+ *   - PRINTABLE only: no control, format or invisible characters (`\p{C}` — escape
+ *     sequences, tabs, zero-width joiners, right-to-left overrides that make a line read
+ *     differently from what it types).
+ *   - A SMALL ALPHABET: letters, marks and digits of any language, spaces, and
+ *     . , ; : ' " ( ) - _ / ? ! + & % =. No `@` (Claude Code opens a file picker on it, and
+ *     Enter would pick a file instead of submitting), no `\` or `^` (screen's `stuff` parses
+ *     them), no `$` or backtick, no `#`, `<`, `>`, `|`, braces or brackets.
+ *   - 200 characters at most, after runs of spaces are collapsed to one.
+ *   - It cannot start with `/`, so the line can only ever be `/compact <words>`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPACT_FOCUS_PUNCTUATION = exports.COMPACT_FOCUS_MAX = void 0;
+exports.sanitizeCompactFocus = sanitizeCompactFocus;
+exports.COMPACT_FOCUS_MAX = 200;
+exports.COMPACT_FOCUS_PUNCTUATION = `. , ; : ' " ( ) - _ / ? ! + & % =`;
+const FOCUS_ALPHABET = /^[\p{L}\p{M}\p{N} .,;:'"()\-_/?!+&%=]+$/u;
+/** Is this focus text safe to type? Returns it normalised (undefined when blank), or why not. */
+function sanitizeCompactFocus(raw) {
+    if (/[\r\n\u2028\u2029]/.test(raw))
+        return { ok: false, code: "MULTILINE", reason: "the focus must be a single line." };
+    if (/\p{C}/u.test(raw)) {
+        return { ok: false, code: "CONTROL", reason: "the focus contains control or invisible characters." };
+    }
+    const focus = raw.replace(/\p{Zs}+/gu, " ").trim();
+    if (!focus)
+        return { ok: true };
+    if ([...focus].length > exports.COMPACT_FOCUS_MAX) {
+        return { ok: false, code: "TOO_LONG", reason: `the focus is longer than ${exports.COMPACT_FOCUS_MAX} characters.` };
+    }
+    if (focus.startsWith("/"))
+        return { ok: false, code: "LEADING_SLASH", reason: "the focus cannot start with /." };
+    if (!FOCUS_ALPHABET.test(focus)) {
+        const bad = [...focus].find((ch) => !FOCUS_ALPHABET.test(ch));
+        return {
+            ok: false,
+            code: "CHARACTER",
+            reason: `the focus may only use letters, numbers, spaces and ${exports.COMPACT_FOCUS_PUNCTUATION}${bad ? ` — "${bad}" is not allowed` : ""}.`,
+            ...(bad ? { character: bad } : {}),
+        };
+    }
+    return { ok: true, focus };
+}

package/dist/relay/context-notice.js

@@ -0,0 +1,144 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CarriedNotices = void 0;
+exports.contextNoticeFrom = contextNoticeFrom;
+exports.formatContextNotice = formatContextNotice;
+exports.laterNotice = laterNotice;
+exports.carryNotice = carryNotice;
+exports.carriedNoticesPath = carriedNoticesPath;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+const terminal_text_1 = require("./terminal-text");
+/** The server's `notice` beside an event, parsed leniently; undefined when absent or unusable. */
+function contextNoticeFrom(raw) {
+    if (!raw || typeof raw !== "object")
+        return undefined;
+    const { kind, percent, text } = raw;
+    if (kind !== "context_high" || typeof percent !== "number" || !Number.isFinite(percent) || typeof text !== "string")
+        return undefined;
+    return { kind, percent: Math.max(0, Math.min(100, Math.round(percent))), text };
+}
+function oneLine(text) {
+    return (0, terminal_text_1.cleanTerminalText)(text)
+        .replace(/[\u0080-\u009f‎‏‪-‮⁦-⁩]/g, "")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+/** The block in front of the message, as lines (no trailing newline). */
+function formatContextNotice(notice) {
+    return [`BayChat notice (memory ${notice.percent}% full): ${oneLine(notice.text)}`, "---"].join("\n");
+}
+/** The newer of two notices (a later crossing replaces an earlier one). */
+function laterNotice(a, b) {
+    return b ?? a;
+}
+/**
+ * Hand a notice whose own message will not reach the session to the first of `later` (any chat:
+ * the notice is about the session, not a room).
+ *
+ * @returns true when it found a home.
+ */
+function carryNotice(notice, later) {
+    const next = later[0];
+    if (!next)
+        return false;
+    next.notice = laterNotice(notice, next.notice);
+    return true;
+}
+function carriedNoticesPath() {
+    return path.join((0, config_1.configDir)(), "carried-notices.json");
+}
+/** Notices kept for a session until its next message goes out. ON DISK, 0600, like the carried briefs. */
+class CarriedNotices {
+    file;
+    held;
+    constructor(file = carriedNoticesPath()) {
+        this.file = file;
+    }
+    keep(session, notice) {
+        this.load().set(session, notice);
+        this.save();
+    }
+    /** Put a kept notice on the first message of this batch (mutates the batch). */
+    apply(session, batch) {
+        const kept = this.load().get(session);
+        if (!kept || batch.length === 0)
+            return;
+        this.held.delete(session);
+        batch[0].notice = laterNotice(kept, batch[0].notice);
+        this.save();
+    }
+    /** Forget it: the session started fresh or ended, and the notice was about its old memory. */
+    forget(session) {
+        if (this.load().delete(session))
+            this.save();
+    }
+    load() {
+        if (this.held)
+            return this.held;
+        this.held = new Map();
+        let raw;
+        try {
+            raw = JSON.parse(fs.readFileSync(this.file, "utf8"));
+        }
+        catch (err) {
+            if (err.code !== "ENOENT") {
+                process.stderr.write(`baychat relay: could not read carried notices — ${err instanceof Error ? err.message : String(err)}\n`);
+            }
+            return this.held;
+        }
+        if (raw && typeof raw === "object") {
+            for (const [session, value] of Object.entries(raw)) {
+                const notice = contextNoticeFrom(value);
+                if (notice)
+                    this.held.set(session, notice);
+            }
+        }
+        return this.held;
+    }
+    save() {
+        try {
+            fs.mkdirSync(path.dirname(this.file), { recursive: true });
+            fs.writeFileSync(this.file, JSON.stringify(Object.fromEntries(this.held ?? new Map())), { mode: 0o600 });
+            fs.chmodSync(this.file, 0o600);
+        }
+        catch (err) {
+            process.stderr.write(`baychat relay: could not persist carried notices — ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    }
+}
+exports.CarriedNotices = CarriedNotices;