baychat 0.29.9 → 0.31.0

package/dist/denied-hook.js

@@ -0,0 +1,431 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELOAD_SETTLE_MS = exports.deniedHookLogPath = void 0;
+exports.retryOutput = retryOutput;
+exports.composeDeniedQuestion = composeDeniedQuestion;
+exports.offeredMeanings = offeredMeanings;
+exports.decideDenied = decideDenied;
+exports.cmdDeniedHook = cmdDeniedHook;
+// `baychat denied-hook` — the Claude Code PermissionDenied hook that turns an auto-mode block into
+// a card on the owner's phone, and the owner's "yes" into the one exact permission rule that lets
+// the session run that call.
+//
+// WHY THIS EXISTS. Auto mode's classifier HARD-denies some calls — `npx eas-cli build …`, a release
+// script, `npm publish`. A hard denial draws no prompt, so approve-hook (a PermissionRequest hook)
+// never runs, and the only way through was to walk to the computer and type `/permissions`. Karmen:
+// "We have to have this possibility as people have to use BayChat also when not near computer".
+// See docs/features/DENIED_COMMAND_CARD.md.
+//
+// WHAT CLAUDE CODE GIVES US (hooks reference, "PermissionDenied"): the event fires only in auto
+// mode, after the denial; "Exit code and stderr are ignored because the denial already occurred";
+// the one output read is `hookSpecificOutput.retry: true`, which "adds a message to the
+// conversation telling the model it may retry the tool call" — it does not reverse the denial. So
+// the retry only succeeds because, before printing it, THIS PROCESS (never the agent) writes an
+// allow rule that matches exactly that call into the project's `.claude/settings.local.json`,
+// which Claude Code reloads live and checks before the classifier.
+//
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// FAIL-CLOSED HERE MEANS "PRINT NOTHING".
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+//
+// Unlike approve-hook, silence is safe: no output leaves the denial standing. Every abnormal path
+// — no credential, no proof, BayChat unreachable, an unanswered card, a settings file we cannot
+// parse, an exception — prints nothing and writes no rule. A rule is written only after the card's
+// owner tapped a yes, and `retry` is printed only after the rule was written.
+//
+// PROOF, IN TWO HALVES. Claude Code 2.1.299 writes the denied call to the transcript only after
+// this hook returns (measured; denied/transcript.ts), so the transcript is looked at only briefly.
+// Found → proven. Found as a DIFFERENT call → refused. Not there yet → the event must come from
+// the live Claude Code of the session it names (denied/live-session.ts), and a yes is recorded as
+// UNCONFIRMED and checked against the transcript afterwards by a detached
+// `baychat permissions confirm` (denied/confirm.ts), which takes the rule back out — and tells the
+// owner — when the call never shows up.
+//
+// THE PROCESS BLOCKS THE SESSION WHILE IT WAITS, like approve-hook: hooks are awaited, so the
+// session stops until the owner answers or our deadline passes. That is the reliable shape: the
+// rule is in place before the model hears "you may retry", and the retry happens at once, in the
+// same turn. Being killed by the handler timeout is harmless here (the denial stands), but the
+// same 3600 s / 3900 s pair as approve-hook keeps our own deadline first, so the card is withdrawn
+// rather than left looking answerable.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const approve_hook_1 = require("./approve-hook");
+const approval_wait_1 = require("./approval-wait");
+const config_1 = require("./config");
+const hook_stdin_1 = require("./hook-stdin");
+const confirm_1 = require("./denied/confirm");
+const grants_1 = require("./denied/grants");
+const hook_log_1 = require("./denied/hook-log");
+const live_session_1 = require("./denied/live-session");
+const notice_1 = require("./denied/notice");
+const permission_rule_1 = require("./denied/permission-rule");
+const settings_rules_1 = require("./denied/settings-rules");
+const transcript_1 = require("./denied/transcript");
+var hook_log_2 = require("./denied/hook-log");
+Object.defineProperty(exports, "deniedHookLogPath", { enumerable: true, get: function () { return hook_log_2.deniedHookLogPath; } });
+function retryOutput() {
+    return { hookSpecificOutput: { hookEventName: "PermissionDenied", retry: true } };
+}
+// ─── The card ────────────────────────────────────────────────────────────────
+const LOG_LABEL = "baychat denied-hook";
+const LABEL = {
+    once: "Allow once",
+    always: "Always allow this exact command",
+    no: "No",
+};
+/** The card's own limits (apps/api/src/lib/cards.ts), used only to TRIM. */
+const QUESTION_MAX = 2000;
+const SHOWN_MAX = 900;
+/**
+ * Give Claude Code's settings watcher this long to load the new rule before the model is told to
+ * retry. Claude Code does not say how fast its watcher is; this is a margin, and a retry that
+ * still meets the old settings is handled (see `MAX_SILENT_RETRIES`).
+ */
+exports.RELOAD_SETTLE_MS = 1500;
+/** A call denied AGAIN while a grant already covers it is retried this many times without a new
+ *  card (the watcher was slower than RELOAD_SETTLE_MS). After that the rule evidently does not
+ *  match how Claude Code reads the call, and the owner is told so. */
+const MAX_SILENT_RETRIES = 1;
+/** The classifier gave no verdict: Claude Code ignores `retry` for these, and a rule written for a
+ *  transient failure would outlive it. Texts from the hooks reference. */
+function isNoVerdict(reason) {
+    return reason.startsWith("Auto mode could not evaluate") || reason === "Classifier unavailable";
+}
+/** The card's question. A person decides from this text alone, on a lock screen. */
+function composeDeniedQuestion(q) {
+    const shown = q.plan.shown.length <= SHOWN_MAX ? q.plan.shown : `${q.plan.shown.slice(0, SHOWN_MAX - 1)}…`;
+    const one = q.plan.onceRules.length === 1;
+    const user = q.target.scope === "user";
+    // The user scope reaches every project on this computer, so the card says where the rule goes
+    // and why — never only a path the person has to decode on a lock screen.
+    const where = user ? `your user settings (${tildePath(q.target.file)})` : q.target.file;
+    const offers = q.plan.onceRules.length
+        ? [
+            `Allow once: BayChat adds ${one ? "this exact rule" : "these exact rules"} to ${where} for the retry, ` +
+                `then takes ${one ? "it" : "them"} out${user ? " — the project folder isn't writable for you" : ""}.`,
+            q.plan.alwaysAllowed
+                ? user
+                    ? "Always: BayChat keeps the rule in your user settings, so it applies to every project on this computer " +
+                        "(`baychat permissions list` shows it)."
+                    : "Always: BayChat keeps the rule there, for this project (`baychat permissions list` shows it)."
+                : "",
+        ]
+        : [];
+    const lines = [
+        `${q.who} on ${q.host} was blocked by Claude Code's auto mode:`,
+        "",
+        shown,
+        "",
+        q.reason ? `Reason: ${q.reason}` : "",
+        q.cwd ? `Working directory: ${q.cwd}` : "",
+        "",
+        ...offers,
+        q.plan.limitation,
+    ];
+    const text = lines.filter((l) => l !== undefined).join("\n").replace(/\n{3,}/g, "\n\n").trim();
+    return text.length <= QUESTION_MAX ? text : `${text.slice(0, QUESTION_MAX - 1)}…`;
+}
+/** `/home/k/.claude/settings.json` → `~/.claude/settings.json`. */
+function tildePath(file) {
+    const home = os.homedir();
+    return file === home || file.startsWith(home + path.sep) ? `~${file.slice(home.length)}` : file;
+}
+/** The buttons for a plan: every option it allows, and always a way to say no. */
+function offeredMeanings(plan) {
+    if (plan.onceRules.length === 0)
+        return [];
+    return plan.alwaysAllowed ? ["once", "always", "no"] : ["once", "no"];
+}
+function parseArgs(argv) {
+    const at = (name) => {
+        const i = argv.indexOf(name);
+        return i >= 0 && i + 1 < argv.length ? argv[i + 1] : undefined;
+    };
+    const rawTimeout = Number(at("--timeout"));
+    return {
+        session: at("--session"),
+        fromClaude: argv.includes("--session-from-claude"),
+        waitSeconds: Number.isFinite(rawTimeout) && rawTimeout > 0 ? rawTimeout : approve_hook_1.DEFAULT_WAIT_SECONDS,
+    };
+}
+const str = (v) => (typeof v === "string" ? v : "");
+/**
+ * Turn one PermissionDenied event into `retry` — or into nothing, which leaves the denial
+ * standing. NEVER THROWS. `retry` is returned only after the owner allowed the call and the rule
+ * that matches it is written.
+ */
+async function decideDenied(rawStdin, argv = [], deps = {}) {
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const log = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const opts = parseArgs(argv);
+        let input;
+        try {
+            const parsed = JSON.parse(rawStdin);
+            if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+                throw new Error("not an object");
+            input = parsed;
+        }
+        catch {
+            log(`${LOG_LABEL}: the event could not be read from stdin; the denial stands.`);
+            return null;
+        }
+        if (input.hook_event_name !== "PermissionDenied") {
+            log(`${LOG_LABEL}: not a PermissionDenied event (${String(input.hook_event_name)}); the denial stands.`);
+            return null;
+        }
+        const reason = str(input.reason);
+        if (isNoVerdict(reason)) {
+            log(`${LOG_LABEL}: auto mode gave no verdict ("${reason}"), so Claude Code would ignore a retry.`);
+            return null;
+        }
+        const toolName = str(input.tool_name);
+        const claudeSessionId = str(input.session_id);
+        const call = (0, permission_rule_1.callKeyOf)(toolName, input.tool_input);
+        if (!toolName || !claudeSessionId) {
+            log(`${LOG_LABEL}: the event has no tool or session (keys: ${Object.keys(input).join(", ")}).`);
+            return null;
+        }
+        const session = opts.session ?? (opts.fromClaude ? (0, approve_hook_1.sessionFromClaude)(deps.claude) : undefined);
+        if (opts.fromClaude && session === undefined) {
+            log(`${LOG_LABEL}: this session has not joined BayChat yet; the denial stands.`);
+            return null;
+        }
+        const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
+        if (!device) {
+            log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
+            return null;
+        }
+        // Every run takes back what is overdue first, so a stale grant never covers this call.
+        try {
+            await (deps.sweepGrants ?? defaultSweepGrants)(device);
+        }
+        catch (err) {
+            log(`${LOG_LABEL}: the grants sweep failed (${(0, approval_wait_1.reasonOf)(err)}).`);
+        }
+        // Only a call the model really made may put a card on anybody's phone.
+        const transcriptPath = str(input.transcript_path);
+        const agentId = str(input.agent_id) || undefined;
+        const toolUseId = str(input.tool_use_id);
+        const proofStarted = now();
+        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({ transcriptPath, agentId, toolUseId, toolName, toolInput: input.tool_input });
+        // Set when the call is accepted before it is in the transcript: a yes is then confirmed later.
+        let unconfirmed;
+        if (proof.ok) {
+            log(`${LOG_LABEL}: proven — the call is in the transcript (after ${now() - proofStarted} ms).`);
+        }
+        else if (!proof.absent || !toolUseId || !call) {
+            log(`${LOG_LABEL}: refused — ${proof.why} (after ${now() - proofStarted} ms); no card was posted and the denial stands.`);
+            return null;
+        }
+        else {
+            const live = (deps.liveSession ?? live_session_1.proveLiveSession)({ sessionId: claudeSessionId, transcriptPath, agentId });
+            if (!live.ok) {
+                log(`${LOG_LABEL}: refused — the call is not in the transcript yet (after ${now() - proofStarted} ms) and ` +
+                    `the event is not from this session's live Claude Code: ${live.why}; no card was posted and the denial stands.`);
+                return null;
+            }
+            log(`${LOG_LABEL}: accepted — the call is not in the transcript yet (after ${now() - proofStarted} ms), and the ` +
+                `event comes from this session's live Claude Code (pid ${live.pid}); a yes is confirmed against the transcript afterwards.`);
+            unconfirmed = { transcriptPath, ...(agentId ? { agentId } : {}), toolUseId, toolName };
+        }
+        const host = (deps.hostname ?? os.hostname)();
+        const who = session ? `Session "${session}"` : "A Claude Code session";
+        const waitDeps = { now, sleep, log };
+        // A card that only informs: posted, never waited on (its deadline is already now).
+        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: notice_1.NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
+        // ── Already allowed, and denied again: the reload race, or a rule that does not match.
+        const covering = call ? (0, grants_1.coveringGrant)(claudeSessionId, call, now()) : undefined;
+        if (covering) {
+            if (covering.retries < MAX_SILENT_RETRIES) {
+                await (0, grants_1.noteRetry)(covering.id);
+                await sleep(exports.RELOAD_SETTLE_MS * 2);
+                return retryOutput();
+            }
+            if (covering.kind === "once")
+                await (0, grants_1.revokeGrant)(covering.id);
+            await notify(`${who} on ${host} is still blocked although you allowed it:\n\n${(0, permission_rule_1.planDeniedCall)(toolName, input.tool_input).shown}\n\n` +
+                "Claude Code did not accept the rule BayChat wrote for it. Approve it at the computer " +
+                "(/permissions → Recently denied).");
+            return null;
+        }
+        const projectDir = deps.projectDir ?? (process.env.CLAUDE_PROJECT_DIR || str(input.cwd));
+        if (!projectDir || !path.isAbsolute(projectDir)) {
+            log(`${LOG_LABEL}: no project directory to keep a rule in; the denial stands.`);
+            return null;
+        }
+        // Decided BEFORE the card: an Allow button for a file this user cannot write can only fail.
+        const choice = (deps.settingsChoiceFor ?? settings_rules_1.chooseSettingsFile)(projectDir);
+        const planned = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
+        const plan = choice.scope === "none" && planned.onceRules.length > 0
+            ? {
+                ...planned,
+                onceRules: [],
+                alwaysAllowed: false,
+                limitation: `BayChat can't allow it from here: ${choice.why}, so no rule can be saved. ` +
+                    "Approve it at the computer (/permissions → Recently denied).",
+            }
+            : planned;
+        const target = choice.scope === "none" ? undefined : choice;
+        const question = composeDeniedQuestion({
+            who,
+            host,
+            plan,
+            reason,
+            cwd: str(input.cwd),
+            // Any target will do for a card that offers nothing: no write line is drawn.
+            target: target ?? { scope: "project", file: "" },
+        });
+        const meanings = offeredMeanings(plan);
+        if (meanings.length === 0) {
+            // Nothing can be allowed from BayChat; the owner still learns why the session stopped.
+            await notify(question);
+            return null;
+        }
+        const deadline = now() + opts.waitSeconds * 1000;
+        const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, {
+            session,
+            question,
+            options: meanings.map((m) => LABEL[m]),
+            guardedOptions: meanings.flatMap((m, i) => (m === "always" ? [i] : [])),
+        }, deadline, waitDeps, LOG_LABEL);
+        if (outcome.kind === "deadline") {
+            await (0, approval_wait_1.withdrawOwnerQuestion)(device, outcome.requestId, log);
+            log(`${LOG_LABEL}: nobody answered within ${opts.waitSeconds}s; the card was withdrawn and the denial stands.`);
+            return null;
+        }
+        if (outcome.kind !== "answered") {
+            log(`${LOG_LABEL}: ${outcome.kind === "failed" ? outcome.reason : outcome.kind}; the denial stands.`);
+            return null;
+        }
+        const meaning = (outcome.index !== null ? meanings[outcome.index] : undefined) ?? "no";
+        if (meaning === "no" || !plan.call || !target)
+            return null;
+        let grant;
+        try {
+            grant = await (0, grants_1.grantRules)({
+                kind: meaning,
+                rules: plan.onceRules,
+                settingsFile: target.file,
+                scope: target.scope,
+                call: plan.call,
+                shown: plan.shown,
+                claudeSessionId,
+                session,
+                ...(unconfirmed ? { unconfirmed } : {}),
+            }, now());
+        }
+        catch (err) {
+            log(`${LOG_LABEL}: the rule could not be written (${(0, approval_wait_1.reasonOf)(err)}); the denial stands.`);
+            await notify(`BayChat could not save the rule you allowed, so ${who.toLowerCase()} stays blocked:\n\n${(0, approval_wait_1.reasonOf)(err)}`);
+            return null;
+        }
+        if (grant.kind === "once" && grant.expiresAt) {
+            (deps.scheduleSweep ?? scheduleSweep)(Date.parse(grant.expiresAt));
+        }
+        if (grant.unconfirmed) {
+            // Started before `retry`, so it holds the grant before the retried call can use it up.
+            (deps.scheduleConfirm ?? scheduleConfirm)(grant.id);
+            log(`${LOG_LABEL}: grant ${grant.id} (${grant.kind}) is unconfirmed; its confirmation was started.`);
+        }
+        await sleep(exports.RELOAD_SETTLE_MS);
+        return retryOutput();
+    }
+    catch (err) {
+        log(`${LOG_LABEL}: unexpected failure (${(0, approval_wait_1.reasonOf)(err)}); the denial stands.`);
+        return null;
+    }
+}
+/**
+ * Start `baychat permissions sweep --at <ms>` detached, so a once-rule is taken back at its TTL
+ * even when the retried call never reports back and no other hook runs. Best effort: the
+ * after-hook and every later hook run sweep too.
+ */
+function scheduleSweep(atMs) {
+    spawnDetached(["permissions", "sweep", "--at", String(atMs)], "schedule the once-rule's removal");
+}
+/**
+ * Start `baychat permissions confirm --grant <id>` detached: it waits for the denied call to reach
+ * the transcript and takes the grant back when it does not (denied/confirm.ts). Best effort: a
+ * confirmation that never runs is caught as a stale unconfirmed grant by every later hook run.
+ */
+function scheduleConfirm(grantId) {
+    spawnDetached(["permissions", "confirm", "--grant", grantId], "start the grant's confirmation");
+}
+function spawnDetached(args, what) {
+    try {
+        const entry = fs.realpathSync(process.argv[1] ?? "");
+        const child = (0, child_process_1.spawn)(process.execPath, [entry, ...args], { detached: true, stdio: "ignore" });
+        child.unref();
+    }
+    catch (err) {
+        process.stderr.write(`${LOG_LABEL}: could not ${what} (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+        (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: could not ${what} (${(0, approval_wait_1.reasonOf)(err)}).`);
+    }
+}
+async function defaultSweepGrants(device) {
+    await (0, grants_1.sweepExpiredGrants)();
+    await (0, confirm_1.takeBackStaleUnconfirmed)({ loadDevice: () => device, log: hook_log_1.logBoth });
+}
+/**
+ * `baychat denied-hook [--session <name> | --session-from-claude] [--timeout <seconds>]`
+ *
+ * Always returns 0 (Claude Code ignores this event's exit code). Prints `retry` or nothing.
+ */
+async function cmdDeniedHook(argv = [], stdin = process.stdin) {
+    const raw = await (0, hook_stdin_1.readStdin)(stdin);
+    const log = hook_log_1.logBoth;
+    (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: called (${eventSummary(raw)})`);
+    const output = await decideDenied(raw, argv, { log });
+    (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: ${output ? "retry" : "no retry"}`);
+    if (output)
+        process.stdout.write(`${JSON.stringify(output)}\n`);
+    return 0;
+}
+// ─── The hook's own log (denied/hook-log.ts) ──────────────────────────────────
+/** Event name, tool, session id and which fields came — never the tool input itself. */
+function eventSummary(raw) {
+    try {
+        const e = JSON.parse(raw);
+        return `event=${String(e.hook_event_name)} tool=${String(e.tool_name)} session=${String(e.session_id)} call=${String(e.tool_use_id)} keys=${Object.keys(e).join(",")}`;
+    }
+    catch {
+        return `unreadable stdin, ${raw.length} bytes`;
+    }
+}

package/dist/doctor-command.js

@@ -55,6 +55,9 @@ const credential_refresh_1 = require("./credential-refresh");
 const client_paths_1 = require("./client-paths");
 const runtime_binary_1 = require("./runtime-binary");
 const ws_1 = require("./relay/ws");
+const describe_1 = require("./auto-update/describe");
+const store_1 = require("./auto-update/store");
+const self_upgrade_1 = require("./self-upgrade");
 /** How long `claude mcp list` may take before we treat it as unanswerable. */
 const MCP_LIST_TIMEOUT_MS = 15_000;
 /**
@@ -88,6 +91,7 @@ async function currentDoctorEnv() {
             bayRelayAlive[bay.bayId] = await (0, socket_1.probeSocket)((0, bay_relays_1.bayRelayScope)(bay.bayId, (0, config_1.configDir)(), (0, socket_1.socketPath)()).socket);
         }
     }
+    const relay = await (0, commands_1.tryRelayStatus)();
     return {
         bays,
         bayRelayAlive,
@@ -95,7 +99,9 @@ async function currentDoctorEnv() {
         platform: process.platform,
         now: Date.now(),
         device: (0, config_1.loadDeviceCredentials)(),
-        relay: await (0, commands_1.tryRelayStatus)(),
+        relay,
+        // The running relay's own account when it gives one; else what its files say.
+        autoUpdate: relay?.autoUpdate ?? (0, describe_1.statusFromFiles)({ state: (0, store_1.loadAutoUpdateState)(), setting: (0, store_1.loadAutoSetting)(), env: process.env, current: (0, self_upgrade_1.ownVersion)() }),
         node: { version: process.version, webSocket: (0, ws_1.hasBuiltInWebSocket)() },
         // APPDATA, LOCALAPPDATA and a directory lister: without them a Windows report cannot
         // see Claude Desktop's config at all, Store copy or classic.

package/dist/doctor.js

@@ -61,6 +61,7 @@ exports.acpChecks = acpChecks;
 exports.exitCodeFor = exitCodeFor;
 exports.renderReport = renderReport;
 exports.bayChecks = bayChecks;
+exports.autoUpdateCheck = autoUpdateCheck;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -76,6 +77,8 @@ const launch_1 = require("./channel/launch");
 const plugin_1 = require("./channel/plugin");
 const transport_1 = require("./relay/transport");
 const ws_1 = require("./relay/ws");
+const describe_1 = require("./auto-update/describe");
+const self_upgrade_1 = require("./self-upgrade");
 /**
  * The runtimes worth reporting on.
  *
@@ -122,6 +125,7 @@ function buildReport(env) {
         credentials: credentialsCheck(env),
         bays: bayChecks(env),
         relay: relayCheck(env),
+        autoUpdate: autoUpdateCheck(env),
         mailbox: mailboxCheck(),
         staleCredentials: staleCredentialCheck(env),
         runtimes: REPORTED.map((runtime) => runtimeReport(runtime, env)),
@@ -293,6 +297,7 @@ function renderReport(report) {
         lines.push(...renderSummaryCheck(check));
     lines.push(...renderSummaryCheck(report.staleCredentials));
     lines.push(...renderSummaryCheck(report.relay));
+    lines.push(...renderSummaryCheck(report.autoUpdate));
     lines.push(...renderSummaryCheck(report.mailbox));
     for (const block of report.runtimes) {
         const [first, ...rest] = block.checks;
@@ -443,6 +448,28 @@ function relayCheck(env) {
     }
     return { name: "relay", status: "pass", detail: `running (pid ${env.relay.pid})${transport}` };
 }
+/**
+ * Is this computer keeping itself current? A warning only when something needs the person: a
+ * newer version this copy cannot install by itself, a card waiting on the phone, or an automatic
+ * install that failed. Off is a choice, not a fault, so it is reported and never nagged about.
+ */
+function autoUpdateCheck(env) {
+    const name = "auto-update";
+    const status = env.autoUpdate;
+    if (!status)
+        return { name, status: "skip", detail: "not inspected" };
+    const detail = (0, describe_1.describeAutoUpdate)(status, env.now);
+    const behind = !!status.latest && (0, self_upgrade_1.compareVersions)(status.current, status.latest) === -1;
+    if (status.mode === "off" || status.mode === "none")
+        return { name, status: "skip", detail };
+    if (status.failure)
+        return { name, status: "warn", detail, remedy: "baychat update" };
+    if (status.cardVersion)
+        return { name, status: "warn", detail, remedy: "answer the card in BayChat, or run baychat update" };
+    if (status.mode === "notify" && behind)
+        return { name, status: "warn", detail, remedy: "baychat update" };
+    return { name, status: "pass", detail };
+}
 function pendingCheck(env) {
     if (!env.relay) {
         return { name: "pending", status: "skip", detail: "relay not running — nothing to report" };
@@ -783,6 +810,7 @@ function allChecks(report) {
         ...report.bays,
         report.staleCredentials,
         report.relay,
+        report.autoUpdate,
         report.mailbox,
         ...report.runtimes.flatMap((r) => r.checks),
         ...report.agents,

package/dist/help-topics.js

@@ -136,10 +136,11 @@ A session is one terminal, named by you. It appears in the app as an agent your
 messages can reach, and it survives being parked.
 
     join_session({ session: "Session-A" })                      → a 1:1 with you
-    join_session({ session: "Session-A", group: "Ad Review" })   → that group + your private chat
+    join_session({ session: "Session-A", group: "Ad Review" })   → that group only
 
-**The group form also keeps a private chat with you**, under the same agent and
-session name. The join result includes its directConversationId.
+**A group join creates no private chat.** If you already have one with this
+session (same agent, same name), the result names it as directConversationId;
+otherwise there is none until you start one.
 
     list_sessions()   → name, live or idle, last seen
     end_session(...)  → park it; the chat and its history survive, and rejoining
@@ -167,7 +168,14 @@ a decision that expires silently is worse than one that waits.
 cards. It is on only for Claude Code sessions BayChat starts (from the phone,
 \`baychat claude\` or \`baychat start\`), never for a plain \`claude\`, and it moves
 the last line between an agent and your machine onto a phone — read
-docs/features/REMOTE_APPROVAL_HOOK.md. It fails CLOSED: every error denies.`,
+docs/features/REMOTE_APPROVAL_HOOK.md. It fails CLOSED: every error denies.
+
+When auto mode blocks a call outright there is no prompt to answer. With
+\`baychat permissions on\` (off by default), BayChat-started sessions then put a
+card in BayChat — Allow once / Always allow this exact command / No — and a yes
+writes that one exact rule to the project's .claude/settings.local.json and lets
+the session retry. \`baychat permissions\` lists and removes what it kept. See
+docs/features/DENIED_COMMAND_CARD.md.`,
 };
 exports.HELP_TOPICS = [GROUPS, SESSIONS, TOOLS, APPROVALS];
 /** Exact name first, then keyword, then a substring of the body. */

package/dist/hook-stdin.js

@@ -0,0 +1,35 @@
+"use strict";
+// A Claude Code hook's JSON input, read from stdin with a deadline. Imports nothing but Node, so
+// the fast-path hooks (denied/after-hook.ts) can use it without loading the CLI.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readStdin = readStdin;
+/**
+ * The hook's JSON input.
+ *
+ * Bounded, because a stdin that never closes would stall us until the handler timeout kills the
+ * process — and for approve-hook being killed ALLOWS. On timeout we return what arrived (usually
+ * nothing), which fails to parse, which each hook turns into its own fail-closed answer.
+ */
+function readStdin(stream = process.stdin, timeoutMs = 10_000) {
+    return new Promise((resolve) => {
+        let text = "";
+        let done = false;
+        const finish = () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            resolve(text);
+        };
+        const timer = setTimeout(finish, timeoutMs);
+        // Do not hold the process open on the timer alone.
+        if (typeof timer.unref === "function")
+            timer.unref();
+        stream.setEncoding?.("utf8");
+        stream.on("data", (chunk) => {
+            text += typeof chunk === "string" ? chunk : chunk.toString("utf8");
+        });
+        stream.on("end", finish);
+        stream.on("error", finish);
+    });
+}

package/dist/index.js

@@ -12,7 +12,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 /** Kept in step with `FAST_CONTEXT_COMMANDS` in claude-context.ts (a test pins the two). */
 const FAST_COMMANDS = new Set(["context-statusline", "context-hook", "context-flush"]);
 const command = process.argv[2];
-if (command !== undefined && FAST_COMMANDS.has(command)) {
+if (command === "denied-after") {
+    // The denied-command card's after-hook runs on every matching tool call (as an async hook), so
+    // it too must not load the CLI. It imports only its own files and Node.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const after = require("./denied/after-hook");
+    after.cmdDeniedAfter().then((code) => {
+        process.exitCode = code;
+    }, (err) => {
+        process.stderr.write(`baychat denied-after: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exitCode = 0;
+    });
+}
+else if (command !== undefined && FAST_COMMANDS.has(command)) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const fast = require("./claude-context");
     fast.runFastContextCommand(command, process.argv.slice(3)).then(