baychat 0.27.1 → 0.29.0

package/dist/relay/channel-sessions.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CHANNEL_REPLACED = void 0;
+exports.channelRegisterRefusal = channelRegisterRefusal;
+exports.channelGoneReason = channelGoneReason;
+exports.channelExitReply = channelExitReply;
+exports.channelCommandsLine = channelCommandsLine;
+const daemon_glue_1 = require("./acp/daemon-glue");
+/**
+ * Claude Code sessions that hear the Bay through the BayChat CHANNEL, as the relay sees them.
+ *
+ * ── WHAT THE RELAY DOES FOR SUCH A SESSION, AND WHAT IT NEVER DOES ─────────────────────
+ *
+ * The channel (packages/cli/src/channel/) already pushes every message into the session, so
+ * the relay never wakes, resumes, holds or queues one: a second delivery would make the agent
+ * answer twice, and a headless resume would clone a session that is alive. What only the relay
+ * can do is TYPE: `/clear`, `/new`, `/compact` and the fresh start's clear need the session's
+ * terminal, and a channel event is a prompt, which Claude Code never reads as a slash command.
+ * So the channel registers the session with its computer's relay for COMMANDS ONLY
+ * (`channel-register`, delivery "channel"), and keeps that socket open for the session's life.
+ *
+ * ── WHY THE SOCKET STAYS OPEN ──────────────────────────────────────────────────────────
+ *
+ *  - Its close is the session's death certificate. Claude Code closes the channel server's
+ *    stdin when it exits, the server exits, the socket closes: the registration stops being
+ *    believed at once, and nothing is ever typed into a pane a later shell now holds. (The pane
+ *    check in terminal-pane.ts still runs before every keystroke, as for any session.)
+ *  - It carries the fresh start's note request back to the session (`handoff-note`): the
+ *    channel hands it over as an event, the one way to make a channel session's agent act.
+ */
+/** Said to a channel link displaced by a newer registration of the same session name. */
+exports.CHANNEL_REPLACED = "replaced by a newer registration of this session";
+/** Why a `channel-register` frame is refused, or undefined when it is accepted. */
+function channelRegisterRefusal(frame, registry) {
+    if (frame.runtime !== "claude")
+        return `only a Claude Code session registers through its channel, not ${frame.runtime}`;
+    if (!frame.session.trim())
+        return "a channel registration needs the session's name";
+    return (0, daemon_glue_1.acpAttachRefusal)(registry, frame.session);
+}
+/** Why a command cannot be typed for this channel session right now, or undefined when it can. */
+function channelGoneReason(session) {
+    return (`"${session}" hears the Bay through its Claude Code channel, and that channel is not connected to this relay — ` +
+        `the session has probably ended. Nothing was typed. If it is still open, it reconnects within a minute; try again then.`);
+}
+/** The reply to `/exit` for a channel session: the relay does not hold its feed, so it cannot detach it. */
+function channelExitReply(session) {
+    return (`"${session}" hears the Bay through its Claude Code channel, which this relay does not hold, so /exit cannot detach it. ` +
+        `End the session from Settings → Sessions, or close Claude Code in its terminal.`);
+}
+/**
+ * One line on whether `/clear`, `/new` and `/compact` reach this channel session — for
+ * `relay status` and `/status`. `attached` is the channel's live link to this relay.
+ */
+function channelCommandsLine(target) {
+    if (!target.attached)
+        return "commands: not ready — its Claude Code channel is not connected to this relay (the session ended, or is reconnecting)";
+    const pane = target.pane;
+    if (!pane)
+        return "commands: not ready — not inside tmux or screen, so /clear and /new have nothing to type into (start it with `baychat claude`)";
+    if (pane.kind === "tmux")
+        return `commands: ready (tmux pane ${pane.pane})`;
+    if (pane.kind === "screen")
+        return `commands: ready (screen ${pane.session}, window ${pane.window})`;
+    return `commands: not ready — ${pane.kind} cannot be typed into yet (tmux and screen can)`;
+}

package/dist/relay/commands.js

@@ -68,6 +68,7 @@ const resume_1 = require("./resume");
 const mailbox_1 = require("./mailbox");
 const socket_1 = require("./socket");
 const parent_watch_2 = require("./parent-watch");
+const channel_sessions_1 = require("./channel-sessions");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /** Connect to a running daemon, or explain that there isn't one. */
 async function connectOrFail() {
@@ -334,12 +335,14 @@ async function cmdRelayStatus() {
     }
     console.log(`\nSessions (${status.sessions.length}):`);
     if (status.sessions.length === 0) {
-        console.log("  none — a session registers itself by running `baychat relay attach`");
+        console.log("  none — a session registers itself by running `baychat relay attach`, or by listening through its Claude Code channel");
     }
     for (const s of status.sessions) {
         const state = sessionState(s, lastFailureFor.get(s.name));
         console.log(`  ${s.name}  [${s.runtime}]  ${state}`);
-        console.log(`     ${resumeLabel(s)}`);
+        // A channel session is never resumed by the relay, so its second line is whether the
+        // commands reach it — the one thing the relay does for it.
+        console.log(`     ${s.delivery === "channel" ? (0, channel_sessions_1.channelCommandsLine)(s) : resumeLabel(s)}`);
     }
     // HELD is a THIRD state and prints as itself.
     //
@@ -622,6 +625,10 @@ async function readWakeBounded(fifo, deadline, pollMs = 25) {
 }
 /** The state half of one `relay status` session line. */
 function sessionState(s, lastWakeFailure) {
+    // The channel delivers this session's messages; the relay holds only its commands link.
+    if (s.delivery === "channel") {
+        return s.attached ? "Claude Code channel — connected (this relay runs its commands only)" : "Claude Code channel — NOT connected (the session ended, or is reconnecting)";
+    }
     // "registered", not "attached", for the FIFO rung — and the difference is not
     // pedantry. A socket attach IS a held connection, so `attached` is an
     // observation. A mailbox registration is a file on disk; whether the agent is

package/dist/relay/daemon.js

@@ -33,7 +33,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FRESH_START_SETTLE_MS = exports.RelayDaemon = void 0;
+exports.SESSION_COMMAND_MAX_AGE_MS = exports.FRESH_START_SETTLE_MS = exports.RelayDaemon = void 0;
+exports.withoutStaleCommands = withoutStaleCommands;
+exports.commandTypedReply = commandTypedReply;
 exports.splitSessionCommands = splitSessionCommands;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
@@ -55,6 +57,7 @@ const daemon_glue_1 = require("./acp/daemon-glue");
 const runner_1 = require("./acp/runner");
 const turn_queue_1 = require("./acp/turn-queue");
 const session_reply_1 = require("./session-reply");
+const channel_sessions_1 = require("./channel-sessions");
 const runtime_binary_1 = require("../runtime-binary");
 const adapters_1 = require("./adapters");
 const parent_watch_1 = require("./parent-watch");
@@ -68,6 +71,8 @@ const mailbox_watcher_1 = require("./mailbox-watcher");
 const socket_1 = require("./socket");
 const transport_1 = require("./transport");
 const watermarks_1 = require("./watermarks");
+const bay_relays_1 = require("./bay-relays");
+const loop_1 = require("./launcher/loop");
 /**
  * How long a failed resume-id discovery is believed before it is retried.
  *
@@ -99,6 +104,11 @@ class RelayDaemon {
     abort = new AbortController();
     /** Live attach sockets by session name. */
     attached = new Map();
+    /**
+     * Claude Code channels registered for commands only (channel-sessions.ts), by session name.
+     * Never a delivery rung: nothing in the wake ladder reads this map.
+     */
+    channels = new Map();
     /** Sessions reachable over a mailbox FIFO, by session name. */
     mailboxes = new Map();
     mailboxWatchers;
@@ -179,9 +189,13 @@ class RelayDaemon {
     binaries = new Map();
     log;
     onListening;
+    startLauncherFn;
+    /** Aborted on stop(): ends the launcher's long-poll. */
+    launcherAbort = new AbortController();
     constructor(opts = {}) {
         this.log = opts.log ?? ((line) => console.log(`[relay] ${line}`));
         this.onListening = opts.onListening;
+        this.startLauncherFn = opts.startLauncher ?? loop_1.startLauncher;
         // EVERY candidate root, because the daemon cannot know which one the agent's
         // sandbox turned out to permit — it may have fallen back past the one this
         // process would have chosen.
@@ -260,6 +274,7 @@ class RelayDaemon {
             onPending: (session, batch, reason) => this.record({ kind: "pending", session, reason }, session, batch),
             runTurn: opts.acpRunTurn,
             caller: opts.acpCaller,
+            binaryVersion: opts.acpBinaryVersion,
             reportContext: (session, event) => this.reportContext(session, event),
         });
     }
@@ -323,6 +338,10 @@ class RelayDaemon {
         // After the socket is ours: a relay refused as a duplicate must not keep sessions alive.
         this.acpKeepAlive = (0, daemon_glue_1.startAcpUpkeep)(this.acpAlive.run);
         this.codexContext.start();
+        if (!(0, bay_relays_1.isBayRelayChild)()) {
+            // Never awaited and never fatal: the launcher retries its own network failures until stop().
+            void this.startLauncherFn({ auth, log: (line) => this.log(line), signal: this.launcherAbort.signal }).catch((err) => this.log(`launcher stopped: ${err instanceof Error ? err.message : String(err)}`));
+        }
         this.log(`listening on ${sockPath} (pid ${process.pid}) as device "${device.user.name}"`);
         this.log(`${this.registry.all().length} known session target(s)`);
         // The event SOURCE is pluggable (socket preferred, long-poll floor); every
@@ -452,7 +471,11 @@ class RelayDaemon {
         };
         const target = this.registry.get(session);
         if (!target) {
-            await say(`This relay does not know a session called "${session}" on this machine.`);
+            // SILENT. Every relay of a person is handed every live session's events, so a session this
+            // relay does not know is normally another computer's — and that computer's relay answers.
+            // Saying "I do not know it" from each of the others put one wrong reply per computer in the
+            // room (seen 2026-10-05: a Mac and a WSL relay beside the VPS). Same rule as `deliver()`.
+            this.log(`session command ${command.trigger} for ${session}: not a session on this machine — left to its own relay`);
             return;
         }
         this.log(`session command ${command.trigger} for ${session} from ${message.senderId}`);
@@ -480,12 +503,21 @@ class RelayDaemon {
                 `Session "${session}"`,
                 `  runtime: ${target.runtime}`,
                 `  terminal: ${where}`,
-                `  attached: ${target.attached ? `yes (${target.transport ?? "socket"})` : "no"}`,
-                `  can resume: ${target.resumeId ? `yes (${target.resumeSource ?? "recorded"})` : "no"}`,
+                ...(target.delivery === "channel"
+                    ? [
+                        "  delivery: its Claude Code channel — this relay runs commands only",
+                        `  ${(0, channel_sessions_1.channelCommandsLine)({ pane: target.pane, attached: this.channelLinked(session) })}`,
+                    ]
+                    : [
+                        `  attached: ${target.attached ? `yes (${target.transport ?? "socket"})` : "no"}`,
+                        `  can resume: ${target.resumeId ? `yes (${target.resumeSource ?? "recorded"})` : "no"}`,
+                    ]),
             ].join("\n"));
             return;
         }
         if (command.id === "exit") {
+            if (target.delivery === "channel")
+                return say((0, channel_sessions_1.channelExitReply)(session));
             // DETACH, never kill. Ending somebody's terminal agent from a phone is not a thing
             // the relay should be able to do by itself, and "stop being reachable" is the part it
             // genuinely owns and can undo. The reply says which one happened, because "exit" will
@@ -500,6 +532,12 @@ class RelayDaemon {
             return;
         }
         // What is left types into the terminal.
+        if (target.delivery === "channel" && !this.channelLinked(session)) {
+            // Its channel's link closed: Claude Code has (almost certainly) exited, and its pane may
+            // hold a shell or a different session by now.
+            await say((0, channel_sessions_1.channelGoneReason)(session));
+            return;
+        }
         if (!target.pane) {
             await say((0, session_commands_1.noTerminalReason)());
             return;
@@ -532,9 +570,10 @@ class RelayDaemon {
             // …and whatever was kept to show it (briefs, notes deltas, the notice) described that memory.
             this.forgetCarried(session);
         }
-        await say(command.id === "compact"
-            ? `Typed ${keys} into "${session}". It is tidying its context now.`
-            : `Typed ${keys} into "${session}". Its context is cleared.`);
+        // HONEST about what typing proves. A runtime in the middle of a reply QUEUES typed input
+        // (Claude Code: "Press up to edit queued messages"), so the command runs when that reply
+        // ends, not now. Seen on the VPS 2026-10-05, where "Its context is cleared" was untrue.
+        await say(commandTypedReply(keys, session, command.id === "compact" ? "tidies its context" : "starts with a cleared context"));
     }
     /**
      * One step of "Fresh start with a handoff" (fresh-start.ts).
@@ -566,8 +605,16 @@ class RelayDaemon {
             await report({ handoffId: fresh.handoffId, status: "failed", reason: plan.reason });
             return;
         }
+        if (target.delivery === "channel" && !this.channelLinked(session)) {
+            this.log(`fresh start ${fresh.handoffId} for ${session}: its channel is not connected — not started`);
+            done();
+            await report({ handoffId: fresh.handoffId, status: "failed", reason: "SESSION_GONE" });
+            return;
+        }
         if (fresh.phase === "note") {
             done();
+            if (target.delivery === "channel")
+                return this.askChannelForNote(session, message, fresh.handoffId, report);
             chat.push((0, fresh_start_1.noteRequestAsChat)(message, fresh.handoffId));
             return;
         }
@@ -713,8 +760,19 @@ class RelayDaemon {
         // obey something its HARNESS owns — `/clear` is read by the runtime's TUI, and no model
         // can run it for itself. So the commands are executed here and everything else wakes
         // the session exactly as it always did.
-        const { commands, chat, dropped } = splitSessionCommands(batch);
+        const split = splitSessionCommands(batch);
+        const { chat, dropped } = split;
+        // A command REPLAYED long after it was sent (a relay restart resuming its cursor, a long
+        // outage) is not run or answered: typing `/clear` minutes later surprises whoever is now at the
+        // terminal. Dropped with a log line, never turned into chat.
+        const { commands, stale } = withoutStaleCommands(split.commands, Date.now());
+        for (const message of stale) {
+            this.log(`session command ${message.id} for ${session} dropped: sent ${message.createdAt}, older than ${exports.SESSION_COMMAND_MAX_AGE_MS / 1000}s — replayed, not run`);
+        }
+        dropped.push(...stale);
         for (const message of dropped) {
+            if (stale.includes(message))
+                continue;
             this.log(`session command ${message.id} for ${session} dropped: its sender may no longer command this session`);
         }
         // What rode on a COMMAND — the project brief, the notes delta, BayChat's notice — never reaches
@@ -755,6 +813,12 @@ class RelayDaemon {
         if (chat.length === 0)
             return;
         batch = chat;
+        if (this.registry.get(session)?.delivery === "channel") {
+            // The channel has already pushed these to the session (channel-sessions.ts). A wake, a
+            // resume or a hold here would make it answer twice — or clone it.
+            this.record({ kind: "ignored", reason: `${session} hears the Bay through its Claude Code channel` }, session, batch);
+            return;
+        }
         // A registration from the server feed may still be corroborating: the roster that
         // carried it always precedes the session's first event, but checking a thread id reads
         // the disk. Wait for it rather than drop a message for a session we are registering.
@@ -1317,6 +1381,9 @@ class RelayDaemon {
             providerVar: frame.providerVar,
             serverRegisteredAt: frame.serverRegisteredAt,
         });
+        // A terminal attaching under a name a channel registered takes delivery back from it.
+        if (this.registry.get(frame.session)?.delivery === "channel")
+            this.registry.setDelivery(frame.session, frame.delivery);
         // A session that names itself supersedes anything discovery guessed
         // for it, so drop the throttle and let the next wake use the new id.
         if (frame.resumeId)
@@ -1458,6 +1525,14 @@ class RelayDaemon {
                 (0, socket_1.writeFrame)(sock, { type: "status-result", status: this.status() });
                 return;
             }
+            if (frame.type === "channel-register") {
+                const refusal = (0, channel_sessions_1.channelRegisterRefusal)(frame, this.registry);
+                if (refusal)
+                    return void (0, socket_1.writeFrame)(sock, { type: "error", message: refusal });
+                session = frame.session;
+                this.registerChannel(frame, sock);
+                return;
+            }
             if (frame.type === "acp-register") {
                 const result = (0, daemon_glue_1.registerAcpFrame)(frame, { registry: this.registry, log: this.log, resolveBinary: this.resolveBinary });
                 (0, socket_1.writeFrame)(sock, result.ok ? { type: "status-result", status: this.status() } : { type: "error", message: result.message });
@@ -1480,14 +1555,61 @@ class RelayDaemon {
                 this.registry.setAttached(session, false);
                 this.log(`detached: ${session}`);
             }
+            if (session && this.channels.get(session) === sock) {
+                this.channels.delete(session);
+                this.registry.setAttached(session, false);
+                this.log(`channel disconnected: ${session} — its commands are refused until it reconnects`);
+            }
         };
         sock.on("close", drop);
         sock.on("error", drop);
     }
+    /**
+     * A Claude Code channel registering its session for commands only (channel-sessions.ts).
+     * Recorded WHOLE, so a pane from an earlier registration never survives one without it. One
+     * name, one channel: a displaced link is told why, so it stops retrying instead of fighting.
+     */
+    registerChannel(frame, sock) {
+        const previous = this.channels.get(frame.session);
+        if (previous && previous !== sock) {
+            this.log(`replacing channel for ${frame.session}: dropping the previous one`);
+            (0, socket_1.writeFrame)(previous, { type: "error", message: channel_sessions_1.CHANNEL_REPLACED });
+            previous.end();
+        }
+        this.registry.replace({ name: frame.session, runtime: frame.runtime, delivery: "channel", pane: frame.pane, ownerPid: frame.ownerPid });
+        this.channels.set(frame.session, sock);
+        this.registry.setAttached(frame.session, true);
+        (0, socket_1.writeFrame)(sock, { type: "attached", session: frame.session, delivery: "channel" });
+        const where = frame.pane?.kind === "tmux" ? `tmux pane ${frame.pane.pane}` : (frame.pane?.kind ?? "no multiplexer");
+        this.log(`channel registered: ${frame.session} (${frame.runtime}, commands only, ${where})`);
+    }
+    channelLinked(session) {
+        const sock = this.channels.get(session);
+        return !!sock && !sock.destroyed;
+    }
+    /**
+     * The fresh start's note request, for a session its CHANNEL delivers to: the relay drops that
+     * session's chat, and this request exists only on the relay's feed — so it goes back over the
+     * channel's own link, which hands it to the session as an event. Unreachable → SESSION_GONE.
+     */
+    async askChannelForNote(session, message, handoffId, report) {
+        try {
+            const link = this.channels.get(session);
+            if (!link)
+                throw new Error("the channel is not connected");
+            await (0, socket_1.writeFrameAck)(link, { type: "handoff-note", session, conversationId: message.conversationId, handoffId, content: message.content });
+            this.log(`fresh start ${handoffId}: asked ${session} for its note through its channel`);
+        }
+        catch (err) {
+            this.log(`fresh start ${handoffId}: could not reach ${session}'s channel — ${errText(err)}`);
+            await report({ handoffId, status: "failed", reason: "SESSION_GONE" });
+        }
+    }
     status() {
         const sessions = this.registry.all().map((t) => ({
             ...t,
-            attached: this.attached.has(t.name) || this.mailboxes.has(t.name),
+            attached: this.attached.has(t.name) || this.mailboxes.has(t.name) || this.channelLinked(t.name),
+            // A channel link is not a delivery transport: `delivery: "channel"` says what it is.
             transport: this.attached.has(t.name)
                 ? "socket"
                 : this.mailboxes.has(t.name)
@@ -1511,6 +1633,7 @@ class RelayDaemon {
     }
     async stop() {
         clearInterval(this.acpKeepAlive);
+        this.launcherAbort.abort();
         this.codexContext.stop();
         this.context.close();
         this.acp.shutdown();
@@ -1518,6 +1641,9 @@ class RelayDaemon {
         for (const sock of this.attached.values())
             sock.destroy();
         this.attached.clear();
+        for (const sock of this.channels.values())
+            sock.destroy();
+        this.channels.clear();
         await this.queue.idle();
         await this.acp.idle();
         for (const w of this.mailboxWatchers)
@@ -1536,6 +1662,31 @@ class RelayDaemon {
 exports.RelayDaemon = RelayDaemon;
 /** How long a runtime's TUI is given to clear itself before the fresh session's first prompt. */
 exports.FRESH_START_SETTLE_MS = 1_500;
+/** A session command older than this (server `createdAt` to now) is a replay: dropped, not run. */
+exports.SESSION_COMMAND_MAX_AGE_MS = 2 * 60_000;
+/**
+ * Split off the commands that arrive too late to run. Measured from the message's SERVER
+ * timestamp, never local arrival, so a relay restart that resumes its cursor cannot replay a
+ * `/clear` from minutes ago. A fresh-start step is exempt: it is deduplicated on disk by handoff id
+ * and the server bounds it (the clear's `expiresAt`, the note's 15-minute wait). An unreadable
+ * timestamp is treated as fresh: the server always sends one.
+ */
+function withoutStaleCommands(commands, now) {
+    const live = [];
+    const stale = [];
+    for (const command of commands) {
+        const sent = Date.parse(command.message.createdAt);
+        if (!command.fresh && Number.isFinite(sent) && now - sent > exports.SESSION_COMMAND_MAX_AGE_MS)
+            stale.push(command.message);
+        else
+            live.push(command);
+    }
+    return { commands: live, stale };
+}
+/** The room's reply once a command was typed: what typing proves, and no more. */
+function commandTypedReply(keys, session, effect) {
+    return `Typed ${keys} into "${session}". It ${effect} now — or, if it is in the middle of a reply, as soon as that reply ends.`;
+}
 function splitSessionCommands(batch) {
     const commands = [];
     const chat = [];

package/dist/relay/launcher/approval-settings.js

@@ -0,0 +1,140 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TERMINAL_SETTINGS_FILE = exports.JOIN_ALLOW = void 0;
+exports.approvalPathFor = approvalPathFor;
+exports.launchDir = launchDir;
+exports.approvalSettingsPath = approvalSettingsPath;
+exports.approvalSettings = approvalSettings;
+exports.terminalApprovalSettings = terminalApprovalSettings;
+exports.approvalsDir = approvalsDir;
+exports.writeTerminalApprovalSettings = writeTerminalApprovalSettings;
+exports.currentCliLaunch = currentCliLaunch;
+exports.writeApprovalSettings = writeApprovalSettings;
+exports.removeApprovalSettings = removeApprovalSettings;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("../../approve-hook");
+const config_1 = require("../../config");
+/** Always `"hook"` for now: Claude Code's channel permission relay is behind a flag that is off. */
+function approvalPathFor(_sessionName) {
+    return "hook";
+}
+function launchDir() {
+    return path.join((0, config_1.configDir)(), "launch");
+}
+function approvalSettingsPath(sessionName, dir = launchDir()) {
+    return path.join(dir, `${sessionName}.settings.json`);
+}
+/**
+ * What a launched session may do WITHOUT a card, so it can join before any card can be answered.
+ * `Bash(<prefix>:*)` is Claude Code's prefix rule and `mcp__<server>__*` covers every tool of that
+ * one server. Measured on Claude Code 2.1.289 (2026-10-05): a bare `mcp__<server>` did NOT allow
+ * the server's tools (the hook was asked), while `mcp__<server>__*` did. The two channel entries are the plugin's and the hand-registered
+ * server's names for the same channel (channel/detect.ts); `mcp__baychat__*` is the default Bay's
+ * remote connection, the one a launched session joins on.
+ */
+exports.JOIN_ALLOW = [
+    "Bash(baychat skill:*)",
+    "Bash(baychat session-name:*)",
+    "mcp__baychat__*",
+    "mcp__baychat_channel__*",
+    "mcp__plugin_baychat_channel__*",
+];
+/** The PermissionRequest hook block, running approve-hook by absolute node + entry with `flags`. */
+function permissionHook(cli, flags) {
+    return {
+        PermissionRequest: [
+            {
+                matcher: "*",
+                hooks: [
+                    {
+                        type: "command",
+                        // Exec form (command + args): each element is one argument, no shell, no quoting.
+                        // By absolute path: a missing `baychat` on PATH would silently disable the gate.
+                        command: cli.node,
+                        args: [cli.entry, "approve-hook", ...flags, "--timeout", String(approve_hook_1.DEFAULT_WAIT_SECONDS)],
+                        timeout: approve_hook_1.RECOMMENDED_HANDLER_TIMEOUT_SECONDS,
+                        statusMessage: "Waiting for approval in BayChat…",
+                    },
+                ],
+            },
+        ],
+    };
+}
+/** The settings object for a session started from BayChat. Pure; the test pins its exact content. */
+function approvalSettings(sessionName, cli) {
+    return {
+        permissions: { allow: [...exports.JOIN_ALLOW] },
+        hooks: permissionHook(cli, ["--session", sessionName]),
+    };
+}
+/** The settings object for `baychat claude` / `baychat start`: the hook only, no allowlist. */
+function terminalApprovalSettings(cli) {
+    return { hooks: permissionHook(cli, ["--session-from-claude"]) };
+}
+/** `~/.baychat/approvals`: where the terminal launches' settings file lives. */
+function approvalsDir() {
+    return path.join((0, config_1.configDir)(), "approvals");
+}
+exports.TERMINAL_SETTINGS_FILE = "claude-terminal.settings.json";
+/**
+ * Write (or refresh — the CLI may have moved since last time) the terminal launches' settings
+ * file, 0600 in a 0700 folder, and return its path.
+ */
+function writeTerminalApprovalSettings(cli, dir = approvalsDir()) {
+    const file = path.join(dir, exports.TERMINAL_SETTINGS_FILE);
+    writePrivateJson(dir, file, terminalApprovalSettings(cli));
+    return file;
+}
+function writePrivateJson(dir, file, value) {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+}
+/** This CLI by absolute path: the node running it and its entry script. */
+function currentCliLaunch() {
+    return { node: fs.realpathSync(process.execPath), entry: fs.realpathSync(process.argv[1] ?? "") };
+}
+/** Write the session's settings file (0600) and return its path. `sessionName` must already be validated. */
+function writeApprovalSettings(sessionName, cli, dir = launchDir()) {
+    const file = approvalSettingsPath(sessionName, dir);
+    writePrivateJson(dir, file, approvalSettings(sessionName, cli));
+    return file;
+}
+/** Delete the session's settings file. Idempotent: an absent file is already deleted. */
+function removeApprovalSettings(sessionName, dir = launchDir()) {
+    fs.rmSync(approvalSettingsPath(sessionName, dir), { force: true });
+}

package/dist/relay/launcher/argv.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAUNCH_SESSION_PREFIX = void 0;
+exports.multiplexerSessionName = multiplexerSessionName;
+exports.baychatPrompt = baychatPrompt;
+exports.buildLaunchCommand = buildLaunchCommand;
+exports.launchNameProblem = launchNameProblem;
+exports.roomTitleProblem = roomTitleProblem;
+/**
+ * The exact process a launch runs — pure, so the security-relevant shape is testable without
+ * ever starting tmux.
+ *
+ * ── NO SHELL, ANYWHERE ────────────────────────────────────────────────────────────────
+ * The result is spawned with `shell: false`. The room title arrives from the network and travels
+ * as ONE argv element (inside the `/baychat …` prompt Claude Code receives as its first message);
+ * it is never interpolated into a command string, so `"; rm -rf ~` is just a strange title.
+ * tmux and screen exec the program and its arguments directly when given more than one word
+ * after the session options.
+ *
+ * ONE LAUNCHER: the multiplexer argv itself comes from multiplexer-launch.ts, the module
+ * `baychat start` and `baychat claude` use, as its `detached` kind. So the binary, the
+ * `channelLaunchFor` flags, and the `env K=V … <claude>` exec that carries the channel marker and
+ * PATH into the pane are the same code on every path. What differs here is only that a launch is
+ * DETACHED (`-d` / `-dm`) — nobody is at the terminal — and carries `--settings` for approvals.
+ */
+const multiplexer_launch_1 = require("../../multiplexer-launch");
+/** Every launcher-made multiplexer session is named `bc-<session name>`. */
+exports.LAUNCH_SESSION_PREFIX = "bc-";
+function multiplexerSessionName(sessionName) {
+    return `${exports.LAUNCH_SESSION_PREFIX}${sessionName}`;
+}
+/** The first message Claude Code receives: the BayChat skill, joining the chosen room. */
+function baychatPrompt(sessionName, join) {
+    if (!join)
+        return `/baychat ${sessionName}`;
+    if ("sessions" in join)
+        return `/baychat ${sessionName} --sessions`;
+    return `/baychat ${sessionName} --group "${join.group}"`;
+}
+function buildLaunchCommand(input) {
+    const name = multiplexerSessionName(input.sessionName);
+    const args = (0, multiplexer_launch_1.multiplexerArgv)(input.multiplexer, { kind: "detached", name, cwd: input.folder }, {
+        binary: input.claudeBin,
+        args: [
+            ...input.channelArgs,
+            ...(input.settingsFile ? ["--settings", input.settingsFile] : []),
+            baychatPrompt(input.sessionName, input.join),
+        ],
+        env: input.env,
+    });
+    return { file: input.multiplexer, args, cwd: input.folder, env: input.env };
+}
+const SESSION_NAME_MAX = 60;
+/**
+ * The server's rule (apps/api session.service.ts SESSION_NAME_RE: 1-60 chars, no ':') narrowed
+ * to what is also safe as a tmux target, a file name (`<name>.settings.json`) and one word of the
+ * `/baychat` prompt: letters, digits, `_` and `-`, not starting with `-`.
+ */
+const LAUNCH_NAME_RE = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/;
+/** Why `name` cannot be launched, or undefined when it can. */
+function launchNameProblem(name) {
+    if (name.length === 0 || name.length > SESSION_NAME_MAX)
+        return `A session name is 1-${SESSION_NAME_MAX} characters.`;
+    if (!LAUNCH_NAME_RE.test(name))
+        return "A session started from BayChat is named with letters, digits, '_' and '-' only.";
+    return undefined;
+}
+const ROOM_TITLE_MAX = 80;
+/** C0/C1 controls (line breaks and tabs included), DEL, line/paragraph separators, bidi marks. */
+const UNSAFE_TITLE_CHARS = new RegExp("[\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029\\u200e\\u200f\\u202a-\\u202e\\u2066-\\u2069]", "u");
+/**
+ * Why a group title cannot be put in the prompt, or undefined when it can. A line break would
+ * end the `/baychat` line and start a message of its own; a `"` would end the quoted title early.
+ */
+function roomTitleProblem(title) {
+    if (title.trim().length === 0 || title.length > ROOM_TITLE_MAX)
+        return `A group title is 1-${ROOM_TITLE_MAX} characters.`;
+    if (UNSAFE_TITLE_CHARS.test(title))
+        return "A group title cannot contain line breaks or control characters.";
+    if (title.includes('"'))
+        return 'A group title started from BayChat cannot contain a double quote (").';
+    return undefined;
+}