baychat 0.29.9 → 0.30.0

package/dist/relay/launcher/approval-settings.js

@@ -37,6 +37,8 @@ exports.TERMINAL_SETTINGS_FILE = exports.UNATTENDED_SETTINGS = exports.JOIN_ALLO
 exports.approvalPathFor = approvalPathFor;
 exports.launchDir = launchDir;
 exports.approvalSettingsPath = approvalSettingsPath;
+exports.deniedCardHooks = deniedCardHooks;
+exports.withDeniedCard = withDeniedCard;
 exports.approvalSettings = approvalSettings;
 exports.terminalApprovalSettings = terminalApprovalSettings;
 exports.approvalsDir = approvalsDir;
@@ -48,6 +50,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const approve_hook_1 = require("../../approve-hook");
 const config_1 = require("../../config");
+const opt_in_1 = require("../../denied/opt-in");
 /** Always `"hook"` for now: Claude Code's channel permission relay is behind a flag that is off. */
 function approvalPathFor(_sessionName) {
     return "hook";
@@ -94,6 +97,57 @@ function permissionHook(cli, flags) {
         ],
     };
 }
+/** The tools the after-hook watches: the ones a once-rule can be written for (permission-rule.ts). */
+const DENIED_AFTER_MATCHER = "Bash|WebFetch|mcp__.*";
+/** The after-hook is async and returns in milliseconds; this bounds only a wedged one. */
+const DENIED_AFTER_TIMEOUT_SECONDS = 30;
+/**
+ * The denied-command card's hooks (docs/features/DENIED_COMMAND_CARD.md). `flags` are the same
+ * session flags approve-hook gets in that file.
+ */
+function deniedCardHooks(cli, flags) {
+    const after = {
+        matcher: DENIED_AFTER_MATCHER,
+        hooks: [
+            {
+                type: "command",
+                command: cli.node,
+                args: [cli.entry, "denied-after"],
+                // Never in a tool call's way: Claude Code starts it and carries on.
+                async: true,
+                timeout: DENIED_AFTER_TIMEOUT_SECONDS,
+            },
+        ],
+    };
+    return {
+        PermissionDenied: [
+            {
+                matcher: "*",
+                hooks: [
+                    {
+                        type: "command",
+                        command: cli.node,
+                        args: [cli.entry, "denied-hook", ...flags, "--timeout", String(approve_hook_1.DEFAULT_WAIT_SECONDS)],
+                        // Our own deadline (which withdraws the card) lands first; being killed would only
+                        // leave the denial standing, but also the card looking answerable.
+                        timeout: approve_hook_1.RECOMMENDED_HANDLER_TIMEOUT_SECONDS,
+                        statusMessage: "Blocked by auto mode — asking in BayChat…",
+                    },
+                ],
+            },
+        ],
+        PostToolUse: [after],
+        PostToolUseFailure: [after],
+    };
+}
+/** `settings` with the denied-command card's hooks added beside its own. Pure. */
+function withDeniedCard(settings, cli, flags) {
+    return { ...settings, hooks: { ...(settings.hooks ?? {}), ...deniedCardHooks(cli, flags) } };
+}
+/** The file's settings, with the card's hooks when the owner turned it on. */
+function withOptIn(settings, cli, flags) {
+    return (0, opt_in_1.deniedCardEnabled)() ? withDeniedCard(settings, cli, flags) : settings;
+}
 /**
  * Claude Code nudges that stop a session with a menu nobody can answer, switched off for
  * launched sessions only. "Teach auto mode about your environment?" (1 Yes / 2 Not now / 3 Don't
@@ -130,7 +184,7 @@ exports.TERMINAL_SETTINGS_FILE = "claude-terminal.settings.json";
  */
 function writeTerminalApprovalSettings(cli, dir = approvalsDir()) {
     const file = path.join(dir, exports.TERMINAL_SETTINGS_FILE);
-    writePrivateJson(dir, file, terminalApprovalSettings(cli));
+    writePrivateJson(dir, file, withOptIn(terminalApprovalSettings(cli), cli, ["--session-from-claude"]));
     return file;
 }
 function writePrivateJson(dir, file, value) {
@@ -145,7 +199,7 @@ function currentCliLaunch() {
 /** Write the session's settings file (0600) and return its path. `sessionName` must already be validated. */
 function writeApprovalSettings(sessionName, cli, dir = launchDir(), bayEntry) {
     const file = approvalSettingsPath(sessionName, dir);
-    writePrivateJson(dir, file, approvalSettings(sessionName, cli, bayEntry));
+    writePrivateJson(dir, file, withOptIn(approvalSettings(sessionName, cli, bayEntry), cli, ["--session", sessionName]));
     return file;
 }
 /** Delete the session's settings file. Idempotent: an absent file is already deleted. */

package/dist/runtimes.js

@@ -181,13 +181,13 @@ ${ctx.invocation}
 \`\`\`
 
 - The supplied name becomes both your BayChat agent name and session name automatically.
-- With a name only: the shared Sessions group in your Bay, plus your private owner chat.
+- With a name only: the shared Sessions group in your Bay. No private chat is created.
 - With \`--sessions\` and no name: automatically name this verified session and join Sessions.
 - With \`<name> --private\`: join only your private owner chat.
 - With a name and a group title: join that exact group, or create it if missing.
 - With a name and a group id (\`--group "<id>"\`, as a session started from the
   BayChat app gets): join that group; never create one.
-  Joining an existing group requires membership and admin rights. Your private chat stays available under the same name.
+  Joining an existing group requires membership and admin rights. A group join creates no private chat; one you already have stays available under the same name.
   \`list_groups\` prints the exact titles.
 - With \`--group "<title>"\` and no name: automatic naming is explicitly requested.
   The join command chooses a name from this verified native session. It stays

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.29.9",
+  "version": "0.30.0",
   "description": "BayChat connector CLI — pair an agent session (Claude Code, Codex, Cursor) with BayChat, or have the relay run DeepSeek or the Cursor CLI for you",
   "bin": {
     "baychat": "dist/index.js"