baychat 0.25.3 → 0.26.0

package/README.md

@@ -50,6 +50,24 @@ setup runs inside the session; device approval or a client reload may still need
 you. For a first installation without the skill, `baychat connect codex` or
 `baychat connect claude` installs it once. Updating npm does not deploy remote MCP.
 
+### Several Bays on one computer
+
+If you own an Enterprise Bay with Team Bays, one approval of `baychat login` signs this
+computer in to **every** one of them: your Personal Bay and each Team Bay you are in.
+(Free and Pro, and people invited into a Team Bay, get the one Bay they approved in — as
+before.) Each Bay is its own connection, and a session uses exactly one:
+
+```text
+/baychat Scout "Coding"                 # the default Bay (your Personal Bay unless you chose another)
+/baychat Scout "Coding" --bay Harbor    # the Team Bay "Harbor" — its own MCP entry, baychat-harbor
+baychat bays                            # list this computer's Bay logins
+baychat bays default Harbor             # make Harbor the default instead
+```
+
+Claude Code and every connected client get `baychat` (the default Bay) and one
+`baychat-<bay>` entry per other Bay. With one Bay nothing changes: only `baychat`.
+The relay runs one connection per Bay, so the same session name in two Bays never collides.
+
 ## What the package and MCP each do
 
 The npm package contains the CLI, installed runtime commands, local relay,
@@ -273,6 +291,7 @@ one where remembering to re-arm falls to the agent.
 | Command | Description |
 |---------|-------------|
 | `baychat login [--start \| --finish \| --token <PAT>] [--base <url>]` | Log this computer in. Agents use `--start` to show an approval link immediately and `--finish` once approved; interactive login displays a QR and waits |
+| `baychat bays [default <name>]` | List this computer's Bay logins (one approval signs an Enterprise owner in to the Personal Bay and its Team Bays), or choose the default Bay — the one a session joins when it names none |
 | `baychat onboard [<conv>]` | **Run first.** Print the agent protocol + your live identity, conversations, and (a) room's context |
 | `baychat pair <code> [--base <url>]` | Redeem a pairing code and store credentials |
 | `baychat hermes init [--home <dir>] [--enable]` | Install the BayChat platform plugin into a Hermes agent (`~/.hermes`) and put your paired token in the `.env` its adapter reads. `--enable` also runs the two `hermes` commands that switch it on |

package/dist/bay-mcp.js

@@ -0,0 +1,177 @@
+"use strict";
+// Writing the per-Bay MCP entries (docs/features/MULTI_BAY_DEVICE_LOGIN.md).
+//
+// The default Bay stays the `baychat` server every client already has — written exactly as
+// before by the code that always wrote it. THIS file adds the OTHER Bays as `baychat-<bay>`
+// beside it, and removes ones it wrote earlier that are no longer wanted (a Bay that went
+// away, or the Bay that just became the default).
+//
+// Two invariants:
+//   1. A one-Bay computer is untouched. `extraBayEntries` is empty below two Bays, and with
+//      nothing stale this writes nothing and spawns nothing.
+//   2. REFRESH IS NOT CONNECT (credential-refresh.ts): a client config file is only edited
+//      when it already names BayChat. Writing into a client the person never connected would
+//      configure software they did not ask us to touch.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renameServerInConfig = renameServerInConfig;
+exports.syncBayClientConfigs = syncBayClientConfigs;
+exports.claudeBayAddArgs = claudeBayAddArgs;
+exports.realClaudeRun = realClaudeRun;
+exports.syncBayEntriesWithClaude = syncBayEntriesWithClaude;
+exports.applyBayEntries = applyBayEntries;
+const node_child_process_1 = require("node:child_process");
+const client_config_writer_1 = require("./client-config-writer");
+const client_paths_1 = require("./client-paths");
+const mcp_dialects_1 = require("./mcp-dialects");
+const bays_1 = require("./bays");
+/**
+ * The same client config, under another server name. `buildClientConfig` (shared verbatim
+ * with the mobile app, so not edited here) always names the server `baychat`; a per-Bay entry
+ * is that config with the name swapped and nothing else changed.
+ */
+function renameServerInConfig(config, name) {
+    if (config.format === "toml") {
+        const body = config.body.replace(new RegExp(`^(\\s*\\[\\s*mcp_servers\\.)${bays_1.DEFAULT_MCP_ENTRY}(?=\\s*[\\].])`, "gm"), `$1${name}`);
+        return { ...config, body };
+    }
+    const parsed = JSON.parse(config.body);
+    const entry = parsed.mcpServers[bays_1.DEFAULT_MCP_ENTRY];
+    return { ...config, body: JSON.stringify({ ...parsed, mcpServers: { [name]: entry } }, null, 2) };
+}
+/**
+ * Bring every ALREADY-CONNECTED client config file onto the wanted per-Bay entries.
+ *
+ * @returns the paths actually changed, for the caller to report.
+ */
+function syncBayClientConfigs(url, extras, stale, io, env) {
+    if (extras.length === 0 && stale.length === 0)
+        return [];
+    const changed = [];
+    for (const client of mcp_dialects_1.MCP_CLIENTS) {
+        for (const path of (0, client_paths_1.inspectableConfigPaths)(client, env)) {
+            const existing = io.readFile(path);
+            if (existing === null || !existing.includes(bays_1.DEFAULT_MCP_ENTRY))
+                continue;
+            try {
+                const next = syncOneFile(client, existing, url, extras, stale);
+                if (next === existing)
+                    continue;
+                io.copyFile(path, (0, client_config_writer_1.backupPathFor)(path));
+                io.writeFile(path, next);
+                changed.push(path);
+            }
+            catch {
+                // One unreadable config must not stop the others; `doctor` names it. Same rule as the
+                // default entry's refresh in credential-refresh.ts.
+            }
+        }
+    }
+    return changed;
+}
+function syncOneFile(client, existing, url, extras, stale) {
+    let content = existing;
+    for (const name of stale) {
+        const removed = client === "codex" ? (0, client_config_writer_1.removeTomlServer)(content, name) : (0, client_config_writer_1.removeJsonServer)(content, name);
+        if (removed !== null)
+            content = removed;
+    }
+    for (const extra of extras) {
+        const config = renameServerInConfig((0, mcp_dialects_1.buildClientConfig)(client, { url, token: extra.bay.token }), extra.name);
+        content = (0, client_config_writer_1.mergeClientConfig)(config, content, extra.name).content;
+    }
+    return content;
+}
+/** `claude mcp …` argv for one named server. The token rides argv exactly as for `baychat`. */
+function claudeBayAddArgs(name, baseUrl, token) {
+    return [
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        "--scope",
+        "user",
+        name,
+        `${baseUrl}/api/mcp`,
+        "--header",
+        `Authorization: Bearer ${token}`,
+    ];
+}
+/** Characters cmd.exe quoting cannot hold (commands.ts `WINDOWS_UNSAFE`). */
+const WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
+/** Run `claude <args>` the way `registerWithClaude` does, or null when it cannot run safely. */
+function realClaudeRun(platform = process.platform) {
+    return (args) => {
+        const shell = platform === "win32";
+        if (shell && args.some((a) => WINDOWS_UNSAFE.test(a))) {
+            return { status: null, stderr: "", error: new Error("unsafe argument for cmd.exe") };
+        }
+        const res = (0, node_child_process_1.spawnSync)("claude", shell ? args.map((a) => `"${a}"`) : args, {
+            encoding: "utf8",
+            stdio: ["ignore", "ignore", "pipe"],
+            timeout: 15_000,
+            killSignal: "SIGKILL",
+            shell,
+        });
+        return { status: res.status, stderr: String(res.stderr ?? ""), ...(res.error ? { error: res.error } : {}) };
+    };
+}
+/**
+ * Register each extra Bay with Claude Code as `baychat-<bay>`, and remove stale ones.
+ *
+ * A renewal re-adds: Claude refuses `add` for an existing name, so "already exists" is
+ * answered by remove + add — the same rule `registerWithClaude` follows for `baychat`.
+ *
+ * @returns names added and names that could not be — never throws (the login is saved).
+ */
+function syncBayEntriesWithClaude(baseUrl, extras, stale, run = realClaudeRun()) {
+    const out = { added: [], removed: [], failed: [] };
+    for (const name of stale) {
+        const res = run(["mcp", "remove", name]);
+        if (res.status === 0)
+            out.removed.push(name);
+        // Absent is the common case and not a failure: there was nothing to remove.
+    }
+    for (const extra of extras) {
+        const args = claudeBayAddArgs(extra.name, baseUrl, extra.bay.token);
+        let res = run(args);
+        if (res.status !== 0 && /already exists/i.test(res.stderr)) {
+            const removed = run(["mcp", "remove", extra.name]);
+            if (removed.status === 0)
+                res = run(args);
+        }
+        if (res.status === 0)
+            out.added.push(extra.name);
+        else
+            out.failed.push(extra.name);
+    }
+    return out;
+}
+/**
+ * After a login or a default switch: write the per-Bay entries everywhere this computer is
+ * already connected, and say what changed. Best-effort and always reported — the login itself
+ * is already saved, and a person told their login failed would redo it into the same place.
+ */
+function applyBayEntries(baseUrl, previous, current, opts) {
+    const log = opts.log ?? ((line) => console.log(line));
+    const extras = (0, bays_1.extraBayEntries)(current);
+    const stale = (0, bays_1.staleBayEntryNames)(previous, current);
+    if (extras.length === 0 && stale.length === 0)
+        return;
+    try {
+        for (const path of syncBayClientConfigs(`${baseUrl}/api/mcp`, extras, stale, opts.io, opts.env)) {
+            log(`✓ Updated ${path} with your other Bays`);
+        }
+    }
+    catch (err) {
+        log(`  Could not update client configs for your other Bays: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (!opts.claude)
+        return;
+    const result = syncBayEntriesWithClaude(baseUrl, extras, stale, opts.run);
+    for (const name of result.added)
+        log(`✓ BayChat ${name} added to Claude Code`);
+    for (const name of result.failed) {
+        log(`  Could not add ${name} to Claude Code — run \`baychat login\` again, or add it by hand:`);
+        log(`    claude mcp add --transport http --scope user ${name} ${baseUrl}/api/mcp --header "Authorization: Bearer <token>"`);
+    }
+}

package/dist/bays-command.js

@@ -0,0 +1,60 @@
+"use strict";
+// `baychat bays` — the Bay logins on this computer, and which one is the default
+// (docs/features/MULTI_BAY_DEVICE_LOGIN.md).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BAYS_USAGE = void 0;
+exports.cmdBays = cmdBays;
+const config_1 = require("./config");
+const bays_1 = require("./bays");
+const bay_mcp_1 = require("./bay-mcp");
+const commands_1 = require("./commands");
+const client_paths_1 = require("./client-paths");
+exports.BAYS_USAGE = `Usage: baychat bays                 List the Bay logins on this computer
+       baychat bays default <name>  Make <name> the default Bay (a session that names
+                                    no Bay joins it; older clients use it)`;
+/**
+ * `baychat bays [default <name>]`.
+ *
+ * Switching the default is LOCAL: no server call, no new credential. It moves which stored
+ * token `device` holds, rewrites the `baychat` MCP entry to that Bay and the `baychat-<bay>`
+ * entries to the others. Every token still opens exactly its own Bay.
+ */
+function cmdBays(args) {
+    const [sub, ...rest] = args;
+    if (sub === undefined) {
+        for (const line of (0, bays_1.renderBayList)((0, config_1.loadBayLogins)(), (0, config_1.loadDeviceCredentials)()))
+            console.log(line);
+        return 0;
+    }
+    if (sub !== "default")
+        throw new Error(exports.BAYS_USAGE);
+    const name = rest.join(" ").trim();
+    if (!name)
+        throw new Error(exports.BAYS_USAGE);
+    const device = (0, config_1.loadDeviceCredentials)();
+    const bays = (0, config_1.loadBayLogins)();
+    if (!device)
+        throw new Error("This computer is not logged in to BayChat — run `baychat login`.");
+    if (bays.length < 2) {
+        throw new Error("This computer has one Bay login, so it is already the default. An Enterprise owner with Team Bays gets every Bay at `baychat login`.");
+    }
+    const target = (0, bays_1.findBayLogin)(bays, name);
+    if (target.isDefault) {
+        console.log(`${target.bayName} is already this computer's default Bay.`);
+        return 0;
+    }
+    const next = (0, bays_1.withDefaultBay)(bays, device, target);
+    (0, config_1.saveDeviceCredentials)(next.device, next.bays);
+    console.log(`✓ ${target.bayName} is now this computer's default Bay.`);
+    // The default is the `baychat` entry: every connected client gets the new token there, and
+    // the Bay that WAS the default moves to its own `baychat-<bay>` entry.
+    (0, commands_1.refreshConnectedClients)(next.device.baseUrl, next.device.token);
+    (0, commands_1.registerWithClaude)(next.device.baseUrl, next.device.token);
+    (0, bay_mcp_1.applyBayEntries)(next.device.baseUrl, bays, next.bays, {
+        claude: true,
+        io: commands_1.realConfigIo,
+        env: (0, client_paths_1.currentPathEnv)(),
+    });
+    console.log("  Restart your agent clients (and `baychat relay stop && baychat relay start` if the relay runs) to pick it up.");
+    return 0;
+}

package/dist/bays.js

@@ -0,0 +1,145 @@
+"use strict";
+// One computer, one login per Bay (docs/features/MULTI_BAY_DEVICE_LOGIN.md) — the CLI's half.
+//
+// One approval on the phone can sign this computer in to several Bays. The server mints one
+// ORDINARY single-Bay credential per Bay; nothing about a token changed. What changes here is
+// only how this computer keeps them and offers them:
+//
+//   - credentials.json keeps `device` = the DEFAULT Bay (every older reader is unchanged) and
+//     the whole set under `bays` (config.ts).
+//   - Each MCP client gets the default Bay as the `baychat` server it always had, and every
+//     OTHER Bay as `baychat-<bay>` — written ONLY when there is more than one Bay, so a one-Bay
+//     user's client config is byte-identical to before.
+//   - A session picks its Bay at start: `--bay <name>`, or the default.
+//
+// This file is the PURE part — names, lookups, the default switch. No I/O.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_MCP_ENTRY = void 0;
+exports.baySlug = baySlug;
+exports.bayEntryName = bayEntryName;
+exports.extraBayEntries = extraBayEntries;
+exports.staleBayEntryNames = staleBayEntryNames;
+exports.findBayLogin = findBayLogin;
+exports.withDefaultBay = withDefaultBay;
+exports.renderBayList = renderBayList;
+/** The MCP server name every client has always had: the default Bay. */
+exports.DEFAULT_MCP_ENTRY = "baychat";
+/** How a Bay name becomes part of an MCP server name: `[a-z0-9-]`, no edge dashes, short. */
+function baySlug(name) {
+    const slug = name
+        .normalize("NFKD")
+        .replace(/[̀-ͯ]/g, "")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 32)
+        .replace(/-+$/g, "");
+    return slug || "bay";
+}
+/** A Bay id, reduced to what an MCP server name may carry. */
+function idSuffix(bayId) {
+    return bayId.toLowerCase().replace(/[^a-z0-9]/g, "").slice(-6) || "x";
+}
+/**
+ * The MCP server name for one Bay among the computer's Bays: `baychat-<slug>`.
+ *
+ * Stable for a given set of Bay names; when two of this person's Bays slug to the same text
+ * (two Bays called "Work"), BOTH get a short id suffix, so neither name depends on which one
+ * happened to be listed first. Claude Code exposes the tools as `mcp__baychat-<slug>__…`.
+ */
+function bayEntryName(bay, all) {
+    const slug = baySlug(bay.bayName);
+    const clash = all.some((other) => other.bayId !== bay.bayId && baySlug(other.bayName) === slug);
+    return `${exports.DEFAULT_MCP_ENTRY}-${clash ? `${slug}-${idSuffix(bay.bayId)}` : slug}`;
+}
+/**
+ * The `baychat-<bay>` entries for the NON-default Bays — and none at all with fewer than two
+ * Bays, which is what keeps a one-Bay computer's client configs exactly as they were.
+ */
+function extraBayEntries(bays) {
+    if (bays.length < 2)
+        return [];
+    return bays.filter((b) => !b.isDefault).map((bay) => ({ name: bayEntryName(bay, bays), bay }));
+}
+/**
+ * Entry names THIS CLI wrote for the previous set of Bays and must now remove: the previous
+ * extras minus the ones still wanted (a Bay that went away, or the Bay that just became the
+ * default and is `baychat` now). Only ever names this CLI itself derived and wrote — never a
+ * server it did not write, never the default `baychat` entry — and none at all for a computer
+ * that had one Bay before, so a one-Bay login never even asks a client to remove anything.
+ */
+function staleBayEntryNames(previous, current) {
+    const wanted = new Set(extraBayEntries(current).map((e) => e.name));
+    return extraBayEntries(previous)
+        .map((e) => e.name)
+        .filter((n) => !wanted.has(n) && n !== exports.DEFAULT_MCP_ENTRY)
+        .sort();
+}
+/**
+ * Find a Bay login by what a person would type: its name (any case), its MCP entry name or
+ * slug, or its id. Ambiguity is an error, never a guess — the wrong Bay is the wrong room.
+ *
+ * @throws naming the Bays that exist, when nothing (or more than one) matches.
+ */
+function findBayLogin(bays, query) {
+    const q = query.trim();
+    const lower = q.toLowerCase();
+    const tiers = [
+        (b) => b.bayId === q,
+        (b) => b.bayName.trim().toLowerCase() === lower,
+        (b) => bayEntryName(b, bays) === lower || bayEntryName(b, bays) === `${exports.DEFAULT_MCP_ENTRY}-${lower}`,
+        (b) => baySlug(b.bayName) === baySlug(q),
+    ];
+    for (const match of tiers) {
+        const found = bays.filter(match);
+        if (found.length === 1)
+            return found[0];
+        if (found.length > 1) {
+            throw new Error(`"${q}" matches more than one Bay (${found.map((b) => `"${b.bayName}"`).join(", ")}) — use the entry name from \`baychat bays\`.`);
+        }
+    }
+    const known = bays.map((b) => `"${b.bayName}"`).join(", ");
+    throw new Error(bays.length
+        ? `No Bay login named "${q}" on this computer. Bays here: ${known}. Run \`baychat bays\`.`
+        : `This computer has one BayChat login and no other Bays — run \`baychat login\` to pick up more.`);
+}
+/**
+ * Make `target` the default Bay: the set with `isDefault` moved, and the `device` record now
+ * holding the target's token. Pure — the caller saves both and rewrites the client configs.
+ */
+function withDefaultBay(bays, device, target) {
+    return {
+        bays: bays.map((b) => ({ ...b, isDefault: b.bayId === target.bayId })),
+        device: { ...device, token: target.token, expiresAt: target.expiresAt },
+    };
+}
+/** `baychat bays` — one line per Bay login, the default marked. Pure, for testing. */
+function renderBayList(bays, device, now = Date.now()) {
+    if (bays.length === 0) {
+        if (!device)
+            return ["This computer is not logged in to BayChat — run `baychat login`."];
+        return [
+            `One login on this computer (as ${device.user.name}), in the Bay it was approved in.`,
+            "An Enterprise owner with Team Bays gets every Bay here — run `baychat login` again after updating.",
+        ];
+    }
+    const lines = ["Bay logins on this computer:"];
+    const width = Math.max(...bays.map((b) => b.bayName.length));
+    for (const bay of bays) {
+        const entry = bay.isDefault || bays.length < 2 ? exports.DEFAULT_MCP_ENTRY : bayEntryName(bay, bays);
+        lines.push(`  ${bay.isDefault ? "*" : " "} ${bay.bayName.padEnd(width)}  ${expiryText(bay.expiresAt, now)}  MCP: ${entry}`);
+    }
+    lines.push("* = default Bay (a session that names no Bay joins it).");
+    if (bays.length > 1)
+        lines.push("Change it: baychat bays default <name>. Join another: /baychat <name> --bay <Bay>.");
+    return lines;
+}
+function expiryText(expiresAt, now) {
+    const ms = Date.parse(expiresAt) - now;
+    if (Number.isNaN(ms))
+        return "expiry unknown";
+    if (ms <= 0)
+        return "EXPIRED — run baychat login";
+    const days = Math.floor(ms / 86_400_000);
+    return days >= 1 ? `expires in ${days} day(s)` : `expires in ${Math.max(1, Math.round(ms / 3_600_000))}h`;
+}

package/dist/claude-onboarding.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_REACHABILITY = exports.CLAUDE_JOIN_STEPS = void 0;
+exports.BAY_CHOICE = exports.CLAUDE_REACHABILITY = exports.CLAUDE_JOIN_STEPS = void 0;
 /** Claude's native entry point. An expired local relay login says nothing about a separately configured MCP connection. */
 exports.CLAUDE_JOIN_STEPS = `1. Use **remote BayChat MCP + native WebSocket Monitor**. Search deferred tools once
    if needed, for \`join_session\`, \`listen_messages\`, \`get_delivery_status\`,
@@ -25,9 +25,10 @@ exports.CLAUDE_JOIN_STEPS = `1. Use **remote BayChat MCP + native WebSocket Moni
    If blocked, state the exact requested title and needed action in your reply.
 3. Call \`listen_messages({session: "<confirmed name>"})\`. Pass its returned
    \`monitor\` object directly to the native **Monitor** tool: it contains
-   \`ws: {url, protocols}\` and \`persistent: true\`. Keep its ticket private.
-   This is a native WebSocket source, not a shell command. No terminal, relay,
-   attach loop or manual re-arming is needed while this listener remains open.
+   \`ws: {url, protocols}\` and \`timeout_ms\`. If your Monitor offers a
+   \`persistent\` option, also set \`persistent: true\`. Keep its ticket private.
+   This is a native WebSocket source, not a shell command. No terminal, relay or
+   attach loop is needed; when its deadline ends it, reopen it (below).
 4. Call \`get_delivery_status({session: "<confirmed name>"})\`. Only \`connected\`
    confirms incoming delivery. \`awaiting_connection\` means a ticket was created
    but Monitor has not connected; show that exact state, not "ready".
@@ -56,11 +57,17 @@ obey \`shouldRespond\`, acknowledge slow work with 👀, and answer in BayChat.
 Use \`contact_agent\` for directed replies to peers. A delivery event is not a
 model acknowledgement; never claim a message is read just because it arrived.
 
-A \`reset\` event means catch up through history. If the socket closes, Monitor
-has ended: \`persistent: true\` does not reconnect a closed socket by itself.
-Close code **4000** means intentionally stopped or replaced: **do not reconnect**.
-For other closes, call \`listen_messages\` with this session and the last cursor,
-open one replacement native Monitor, and confirm \`get_delivery_status\` again.
+A \`reset\` event means catch up through history. Close code **4000** means
+intentionally stopped or replaced: **do not reconnect**.
+
+**The Monitor has a deadline.** Claude Code ends every Monitor after at most 30
+minutes ("Monitor timed out" / "Monitor expired"), whether or not anything
+arrived. That is the runtime's limit, not a stop: **every time it happens, and on
+any other close**, call \`listen_messages\` with this session and the last cursor
+(from \`ready\` or \`messages\`), open one replacement native Monitor, and confirm
+\`get_delivery_status\` again. The reopened feed replays what it missed, so no
+\`get_messages\` catch-up is needed unless a \`reset\` arrives. Skipping this
+leaves the session deaf to the Bay with its terminal still open.
 Keep the last cursor in this conversation; do not save tickets in files.
 
 \`stop_listening\` stops incoming delivery without ending membership.
@@ -68,3 +75,29 @@ Keep the last cursor in this conversation; do not save tickets in files.
 that has been closed cannot answer until resumed. Do not promise instant model
 replies: show connected delivery separately from actual reading and answering.
 `;
+/**
+ * Picking the Bay (docs/features/MULTI_BAY_DEVICE_LOGIN.md). One approval can sign a computer
+ * in to several Bays, and each is its own MCP connection — `baychat` for the default Bay,
+ * `baychat-<bay>` for each other. A session belongs to exactly one, for every call: tools of
+ * two Bays mixed in one session would post in a different Bay than the one it joined.
+ */
+exports.BAY_CHOICE = `## Which Bay
+
+This computer may be logged in to more than one Bay (one approval gives an
+Enterprise owner their Personal Bay and its Team Bays). Each Bay is its own
+BayChat MCP connection: \`baychat\` is the default Bay, and every other Bay is
+\`baychat-<bay>\` (for example \`baychat-harbor\`). \`baychat bays\` lists them.
+
+- If the user named a Bay (\`--bay <Bay>\`, or "join Harbor"), use THAT Bay's
+  connection for EVERY BayChat call in this session — in Claude Code its tools are
+  \`mcp__baychat-<bay>__…\` (e.g. \`mcp__baychat-harbor__join_session\`), not the
+  plain \`mcp__baychat__…\` ones. Never mix two Bays' tools in one session: a call
+  through another Bay's connection reaches a different Bay.
+- If no Bay was named and more than one \`baychat…\` connection is available, ask the
+  user ONCE which Bay before joining. With only \`baychat\`, use it.
+- \`join_session\` reports the Bay it joined (\`bay.name\`). Say it in your one-line
+  confirmation; if it is not the Bay that was asked for, stop and say so.
+- Shell commands take the same choice: \`baychat join … --bay "<Bay>"\`.
+- A Bay named that has no connection here: say so and suggest \`baychat bays\`
+  (or \`baychat login\` to pick up new Bays). Never fall back to another Bay.
+`;

package/dist/client-config-writer.js

@@ -23,7 +23,9 @@
 //   - Callers back up first (`backupPathFor`), so there is always a way back.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mergeTomlConfig = mergeTomlConfig;
+exports.removeTomlServer = removeTomlServer;
 exports.mergeJsonConfig = mergeJsonConfig;
+exports.removeJsonServer = removeJsonServer;
 exports.mergeClientConfig = mergeClientConfig;
 exports.backupPathFor = backupPathFor;
 exports.expandHome = expandHome;
@@ -31,9 +33,12 @@ exports.expandHome = expandHome;
  * The TOML table header this owns, and the only span it may replace.
  *
  * Sub-tables (`[mcp_servers.baychat.env]`) belong to the same server and are
- * replaced with it; a header for any OTHER server ends the span.
+ * replaced with it; a header for any OTHER server ends the span — including a
+ * per-Bay `[mcp_servers.baychat-harbor]` (MULTI_BAY_DEVICE_LOGIN.md), which is
+ * its own server with its own name and never part of `baychat`'s span.
  */
 const TOML_TABLE = "mcp_servers.baychat";
+const tomlTable = (serverName) => `mcp_servers.${serverName}`;
 /** Matches a top-level TOML table header line, capturing its dotted key. */
 const TOML_HEADER = /^\s*\[\s*([^\]]+?)\s*\]\s*$/;
 /**
@@ -42,12 +47,26 @@ const TOML_HEADER = /^\s*\[\s*([^\]]+?)\s*\]\s*$/;
  * @param existing current file content, or null when the file does not exist yet
  * @param body the `[mcp_servers.baychat]` block to install
  */
-function mergeTomlConfig(existing, body) {
+function mergeTomlConfig(existing, body, serverName = "baychat") {
     const block = body.trimEnd();
     if (existing === null || existing.trim() === "") {
         return { content: `${block}\n`, action: "created" };
     }
     const lines = existing.split("\n");
+    const { start, end } = tomlSpan(lines, serverName === "baychat" ? TOML_TABLE : tomlTable(serverName));
+    if (start === -1) {
+        // Not present — append, keeping exactly one blank line as a separator so the
+        // result is readable whether or not the file ended with a newline.
+        const prefix = existing.endsWith("\n") ? existing.replace(/\n+$/, "\n") : `${existing}\n`;
+        return { content: `${prefix}\n${block}\n`, action: "appended" };
+    }
+    const before = lines.slice(0, start);
+    const after = lines.slice(end);
+    const merged = [...before, ...block.split("\n"), ...after].join("\n");
+    return { content: merged.endsWith("\n") ? merged : `${merged}\n`, action: "updated" };
+}
+/** The line span `[start, end)` of one server's table (and its sub-tables); start -1 = absent. */
+function tomlSpan(lines, table) {
     let start = -1;
     let end = lines.length;
     for (let i = 0; i < lines.length; i += 1) {
@@ -55,7 +74,7 @@ function mergeTomlConfig(existing, body) {
         if (!match)
             continue;
         const key = (match[1] ?? "").replace(/\s+/g, "");
-        const ours = key === TOML_TABLE || key.startsWith(`${TOML_TABLE}.`);
+        const ours = key === table || key.startsWith(`${table}.`);
         if (start === -1) {
             if (ours)
                 start = i;
@@ -67,16 +86,24 @@ function mergeTomlConfig(existing, body) {
             break;
         }
     }
-    if (start === -1) {
-        // Not present — append, keeping exactly one blank line as a separator so the
-        // result is readable whether or not the file ended with a newline.
-        const prefix = existing.endsWith("\n") ? existing.replace(/\n+$/, "\n") : `${existing}\n`;
-        return { content: `${prefix}\n${block}\n`, action: "appended" };
-    }
+    return { start, end };
+}
+/**
+ * Remove one server's table (and sub-tables) from a TOML config, or `null` when it is not
+ * there. Used only for the `baychat-<bay>` entries this CLI wrote itself.
+ */
+function removeTomlServer(existing, serverName) {
+    const lines = existing.split("\n");
+    const { start, end } = tomlSpan(lines, tomlTable(serverName));
+    if (start === -1)
+        return null;
     const before = lines.slice(0, start);
     const after = lines.slice(end);
-    const merged = [...before, ...block.split("\n"), ...after].join("\n");
-    return { content: merged.endsWith("\n") ? merged : `${merged}\n`, action: "updated" };
+    // Drop the blank separator the append left above it, so add+remove round-trips cleanly.
+    while (before.length > 0 && before[before.length - 1].trim() === "")
+        before.pop();
+    const merged = [...before, ...(after.length && before.length ? [""] : []), ...after].join("\n").replace(/\n+$/, "");
+    return merged === "" ? "" : `${merged}\n`;
 }
 /**
  * Merge the BayChat server entry into a JSON MCP config (Cursor, Claude Desktop).
@@ -86,13 +113,13 @@ function mergeTomlConfig(existing, body) {
  * including a file that is merely mid-edit. Refusing lets the CLI say which file
  * to look at.
  */
-function mergeJsonConfig(existing, body) {
+function mergeJsonConfig(existing, body, serverName = "baychat") {
     // `body` is ours, produced by buildClientConfig — a parse failure here is a bug
     // in this package, not user input, so it is allowed to throw plainly.
     const incoming = JSON.parse(body);
-    const entry = incoming.mcpServers?.baychat;
+    const entry = incoming.mcpServers?.[serverName];
     if (entry === undefined) {
-        throw new Error("Generated config has no mcpServers.baychat entry — this is a bug.");
+        throw new Error(`Generated config has no mcpServers.${serverName} entry — this is a bug.`);
     }
     if (existing === null || existing.trim() === "") {
         return { content: `${JSON.stringify(incoming, null, 2)}\n`, action: "created" };
@@ -109,19 +136,40 @@ function mergeJsonConfig(existing, body) {
     }
     const current = parsed;
     const servers = { ...(current.mcpServers ?? {}) };
-    const had = Object.prototype.hasOwnProperty.call(servers, "baychat");
-    servers.baychat = entry;
+    const had = Object.prototype.hasOwnProperty.call(servers, serverName);
+    servers[serverName] = entry;
     const merged = { ...current, mcpServers: servers };
     return {
         content: `${JSON.stringify(merged, null, 2)}\n`,
         action: had ? "updated" : "appended",
     };
 }
+/**
+ * Remove one server entry from a JSON MCP config, or `null` when it is not there (or the file
+ * is not a JSON object — which is left alone, exactly as the merge leaves it alone).
+ */
+function removeJsonServer(existing, serverName) {
+    let parsed;
+    try {
+        parsed = JSON.parse(existing);
+    }
+    catch {
+        return null;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed))
+        return null;
+    const current = parsed;
+    if (!current.mcpServers || !Object.prototype.hasOwnProperty.call(current.mcpServers, serverName))
+        return null;
+    const servers = { ...current.mcpServers };
+    delete servers[serverName];
+    return `${JSON.stringify({ ...current, mcpServers: servers }, null, 2)}\n`;
+}
 /** Merge by dialect. Keeps the format decision in one place. */
-function mergeClientConfig(config, existing) {
+function mergeClientConfig(config, existing, serverName = "baychat") {
     return config.format === "toml"
-        ? mergeTomlConfig(existing, config.body)
-        : mergeJsonConfig(existing, config.body);
+        ? mergeTomlConfig(existing, config.body, serverName)
+        : mergeJsonConfig(existing, config.body, serverName);
 }
 /**
  * Where to copy a file before rewriting it.