baychat 0.29.9 → 0.31.0

package/dist/relay/daemon.js

@@ -193,10 +193,16 @@ class RelayDaemon {
     startLauncherFn;
     /** Aborted on stop(): ends the launcher's long-poll. */
     launcherAbort = new AbortController();
+    autoUpdateStatus;
+    /** When a message last reached this relay or was delivered — the automatic update's quiet window. */
+    lastActivityAt;
+    /** A launch from BayChat is being carried out (the launcher's `onLaunch`). */
+    launching = false;
     constructor(opts = {}) {
         this.log = opts.log ?? ((line) => console.log(`[relay] ${line}`));
         this.onListening = opts.onListening;
         this.startLauncherFn = opts.startLauncher ?? loop_1.startLauncher;
+        this.autoUpdateStatus = opts.autoUpdateStatus;
         // EVERY candidate root, because the daemon cannot know which one the agent's
         // sandbox turned out to permit — it may have fallen back past the one this
         // process would have chosen.
@@ -341,7 +347,14 @@ class RelayDaemon {
         this.codexContext.start();
         if (!(0, bay_relays_1.isBayRelayChild)()) {
             // Never awaited and never fatal: the launcher retries its own network failures until stop().
-            void this.startLauncherFn({ auth, log: (line) => this.log(line), signal: this.launcherAbort.signal }).catch((err) => this.log(`launcher stopped: ${err instanceof Error ? err.message : String(err)}`));
+            void this.startLauncherFn({
+                auth,
+                log: (line) => this.log(line),
+                signal: this.launcherAbort.signal,
+                onLaunch: (busy) => {
+                    this.launching = busy;
+                },
+            }).catch((err) => this.log(`launcher stopped: ${err instanceof Error ? err.message : String(err)}`));
         }
         this.log(`listening on ${sockPath} (pid ${process.pid}) as device "${device.user.name}"`);
         this.log(`${this.registry.all().length} known session target(s)`);
@@ -406,6 +419,7 @@ class RelayDaemon {
         // behind must not have its recovery window truncated by a session that was
         // ahead. An event with no session still registers the room — see Watermarks.
         this.watermarks.record(sessionName, conversationId, message.createdAt);
+        this.lastActivityAt = Date.now();
         if (!sessionName) {
             this.log(`event ${message.id} carries no session (renamed or ended mid-poll) — ignoring`);
             return;
@@ -1330,6 +1344,7 @@ class RelayDaemon {
         return updated;
     }
     record(outcome, session, batch) {
+        this.lastActivityAt = Date.now();
         if (outcome.kind === "woken") {
             this.delivered += batch.length;
             const room = batch.at(-1)?.conversationId;
@@ -1635,8 +1650,29 @@ class RelayDaemon {
             pending: this.pending,
             held: this.held.summary(),
             lastError: this.lastError,
+            autoUpdate: this.autoUpdateStatus?.(),
         };
     }
+    /** What this relay is doing right now, for deciding whether it may restart (auto-update/policy.ts). */
+    activity() {
+        return {
+            deliveries: this.queue.activeSessions(),
+            headless: [...this.headlessInFlight],
+            acp: this.acp.activeSessions(),
+            heldAt: this.held.summary().map((h) => h.heldAt),
+            launching: this.launching,
+            lastActivityAt: this.lastActivityAt,
+        };
+    }
+    /**
+     * Sessions running on THIS computer that the server lists as live — the ones a card can be asked
+     * through. Attached ones first: their owner is most likely looking at them.
+     */
+    hostedLiveSessions() {
+        const hosted = this.registry.all().filter((t) => this.liveSessions.includes(t.name));
+        const reachable = (name) => this.attached.has(name) || this.mailboxes.has(name) || this.channelLinked(name);
+        return hosted.sort((a, b) => Number(reachable(b.name)) - Number(reachable(a.name))).map((t) => t.name);
+    }
     async stop() {
         clearInterval(this.acpKeepAlive);
         this.launcherAbort.abort();

package/dist/relay/launcher/approval-settings.js

@@ -37,6 +37,8 @@ exports.TERMINAL_SETTINGS_FILE = exports.UNATTENDED_SETTINGS = exports.JOIN_ALLO
 exports.approvalPathFor = approvalPathFor;
 exports.launchDir = launchDir;
 exports.approvalSettingsPath = approvalSettingsPath;
+exports.deniedCardHooks = deniedCardHooks;
+exports.withDeniedCard = withDeniedCard;
 exports.approvalSettings = approvalSettings;
 exports.terminalApprovalSettings = terminalApprovalSettings;
 exports.approvalsDir = approvalsDir;
@@ -48,6 +50,7 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const approve_hook_1 = require("../../approve-hook");
 const config_1 = require("../../config");
+const opt_in_1 = require("../../denied/opt-in");
 /** Always `"hook"` for now: Claude Code's channel permission relay is behind a flag that is off. */
 function approvalPathFor(_sessionName) {
     return "hook";
@@ -94,6 +97,57 @@ function permissionHook(cli, flags) {
         ],
     };
 }
+/** The tools the after-hook watches: the ones a once-rule can be written for (permission-rule.ts). */
+const DENIED_AFTER_MATCHER = "Bash|WebFetch|mcp__.*";
+/** The after-hook is async and returns in milliseconds; this bounds only a wedged one. */
+const DENIED_AFTER_TIMEOUT_SECONDS = 30;
+/**
+ * The denied-command card's hooks (docs/features/DENIED_COMMAND_CARD.md). `flags` are the same
+ * session flags approve-hook gets in that file.
+ */
+function deniedCardHooks(cli, flags) {
+    const after = {
+        matcher: DENIED_AFTER_MATCHER,
+        hooks: [
+            {
+                type: "command",
+                command: cli.node,
+                args: [cli.entry, "denied-after"],
+                // Never in a tool call's way: Claude Code starts it and carries on.
+                async: true,
+                timeout: DENIED_AFTER_TIMEOUT_SECONDS,
+            },
+        ],
+    };
+    return {
+        PermissionDenied: [
+            {
+                matcher: "*",
+                hooks: [
+                    {
+                        type: "command",
+                        command: cli.node,
+                        args: [cli.entry, "denied-hook", ...flags, "--timeout", String(approve_hook_1.DEFAULT_WAIT_SECONDS)],
+                        // Our own deadline (which withdraws the card) lands first; being killed would only
+                        // leave the denial standing, but also the card looking answerable.
+                        timeout: approve_hook_1.RECOMMENDED_HANDLER_TIMEOUT_SECONDS,
+                        statusMessage: "Blocked by auto mode — asking in BayChat…",
+                    },
+                ],
+            },
+        ],
+        PostToolUse: [after],
+        PostToolUseFailure: [after],
+    };
+}
+/** `settings` with the denied-command card's hooks added beside its own. Pure. */
+function withDeniedCard(settings, cli, flags) {
+    return { ...settings, hooks: { ...(settings.hooks ?? {}), ...deniedCardHooks(cli, flags) } };
+}
+/** The file's settings, with the card's hooks when the owner turned it on. */
+function withOptIn(settings, cli, flags) {
+    return (0, opt_in_1.deniedCardEnabled)() ? withDeniedCard(settings, cli, flags) : settings;
+}
 /**
  * Claude Code nudges that stop a session with a menu nobody can answer, switched off for
  * launched sessions only. "Teach auto mode about your environment?" (1 Yes / 2 Not now / 3 Don't
@@ -130,7 +184,7 @@ exports.TERMINAL_SETTINGS_FILE = "claude-terminal.settings.json";
  */
 function writeTerminalApprovalSettings(cli, dir = approvalsDir()) {
     const file = path.join(dir, exports.TERMINAL_SETTINGS_FILE);
-    writePrivateJson(dir, file, terminalApprovalSettings(cli));
+    writePrivateJson(dir, file, withOptIn(terminalApprovalSettings(cli), cli, ["--session-from-claude"]));
     return file;
 }
 function writePrivateJson(dir, file, value) {
@@ -145,7 +199,7 @@ function currentCliLaunch() {
 /** Write the session's settings file (0600) and return its path. `sessionName` must already be validated. */
 function writeApprovalSettings(sessionName, cli, dir = launchDir(), bayEntry) {
     const file = approvalSettingsPath(sessionName, dir);
-    writePrivateJson(dir, file, approvalSettings(sessionName, cli, bayEntry));
+    writePrivateJson(dir, file, withOptIn(approvalSettings(sessionName, cli, bayEntry), cli, ["--session", sessionName]));
     return file;
 }
 /** Delete the session's settings file. Idempotent: an absent file is already deleted. */

package/dist/relay/launcher/loop.js

@@ -66,7 +66,7 @@ const BACKOFF_MAX_MS = 60_000;
 const CAPABILITIES_REFRESH_MS = 10 * 60_000;
 /** A long-poll holds for WAIT_SECONDS; give the request this much beyond it before calling it dead. */
 const REQUEST_GRACE_MS = 15_000;
-async function startLauncher({ auth, log, signal, deps: overrides }) {
+async function startLauncher({ auth, log, signal, onLaunch, deps: overrides }) {
     const deps = { ...realLoopDeps(log, signal), ...overrides };
     let advertised;
     let unreported;
@@ -76,6 +76,7 @@ async function startLauncher({ auth, log, signal, deps: overrides }) {
             if (unreported) {
                 await deps.request(auth, "POST", `/api/device-api/launches/${encodeURIComponent(unreported.id)}/report`, unreported.report, signal);
                 unreported = undefined;
+                onLaunch?.(false);
             }
             const stamp = deps.policyStamp();
             if (!advertised || advertised.stamp !== stamp || deps.now() - advertised.at >= CAPABILITIES_REFRESH_MS) {
@@ -93,9 +94,11 @@ async function startLauncher({ auth, log, signal, deps: overrides }) {
                 else {
                     // Kept until delivered: a report lost to the network is sent before the next poll.
                     const io = launchIo(deps, auth, id, signal);
+                    onLaunch?.(true);
                     unreported = { id, report: launch ? await safeHandle(deps, launch, io, log) : { status: "REFUSED", reason: "BAD_REQUEST" } };
                     await deps.request(auth, "POST", `/api/device-api/launches/${encodeURIComponent(id)}/report`, unreported.report, signal);
                     unreported = undefined;
+                    onLaunch?.(false);
                 }
             }
             backoff = BACKOFF_MIN_MS;

package/dist/relay/self-restart.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realSupervisorProbe = exports.WINDOWS_SELF_UPDATE_ENABLED = void 0;
+exports.selfUpdateAllowedOn = selfUpdateAllowedOn;
+exports.detectSupervisor = detectSupervisor;
+exports.processesEndedByRestart = processesEndedByRestart;
+exports.arrangeRestart = arrangeRestart;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const autostart_1 = require("./autostart");
+/**
+ * ⚠️ WINDOWS SHIPS NOTIFY-ONLY. Enable after a verified restart on a real Windows machine.
+ *
+ * The Task Scheduler restart below (a detached helper running `schtasks /run` after the relay
+ * exits) has never been watched working: if Task Scheduler ends the helper together with the task,
+ * the relay stays down until the next logon — worse than running an old version. Until someone
+ * has seen it come back on Windows, a Windows relay only says a new version is out. The whole path
+ * stays in place; flipping this one constant turns it on.
+ */
+exports.WINDOWS_SELF_UPDATE_ENABLED = false;
+/** May a relay on `platform` install an update and restart itself? (Only the gate above says no.) */
+function selfUpdateAllowedOn(platform) {
+    return platform !== "win32" || exports.WINDOWS_SELF_UPDATE_ENABLED;
+}
+/** Which init system is supervising THIS process, or undefined when none will restart it. */
+function detectSupervisor(probe) {
+    if (probe.platform === "linux") {
+        // Our own cgroup names the unit we run in: exact, and nothing else can fake it for us.
+        const cgroup = probe.readFile("/proc/self/cgroup") ?? "";
+        return cgroup.split("\n").some((line) => line.trim().endsWith(`/${autostart_1.SYSTEMD_UNIT_NAME}`)) ? "systemd" : undefined;
+    }
+    if (probe.platform === "darwin")
+        return probe.env.XPC_SERVICE_NAME === autostart_1.SERVICE_LABEL ? "launchd" : undefined;
+    // Task Scheduler stamps nothing on the process it starts. But only one relay can hold the socket,
+    // and this one does: if the relay task is RUNNING, this is its relay (a second, task-started relay
+    // would have failed to bind and exited). `Get-ScheduledTask` names the state unlocalised.
+    if (probe.platform === "win32")
+        return probe.taskState() === "Running" ? "task-scheduler" : undefined;
+    return undefined;
+}
+exports.realSupervisorProbe = {
+    platform: process.platform,
+    env: process.env,
+    taskState() {
+        try {
+            // A constant command: the task's fixed name, no value from anywhere else.
+            return (0, child_process_1.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `(Get-ScheduledTask -TaskName '${autostart_1.SERVICE_LABEL}').State`], { encoding: "utf8", timeout: 20_000, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }).trim();
+        }
+        catch {
+            // No task, no PowerShell: not supervised as far as we can prove.
+            return undefined;
+        }
+    },
+    readFile(file) {
+        try {
+            return fs.readFileSync(file, "utf8");
+        }
+        catch {
+            // Not Linux, or no /proc: no cgroup to read.
+            return undefined;
+        }
+    },
+};
+/**
+ * Processes a restart would end with this relay: under systemd, every other process in the unit's
+ * cgroup (the default `KillMode=control-group` stops them all when the main process exits) — a tmux
+ * server the launcher started, an agent still running. The relay's own per-Bay child relays are not
+ * counted: they restart with it. Empty elsewhere (launchd and Task Scheduler leave detached
+ * processes alone) and wherever the cgroup cannot be read.
+ */
+function processesEndedByRestart(probe, selfPid = process.pid) {
+    const cgroup = probe.readFile("/proc/self/cgroup") ?? "";
+    // cgroup v2: "0::/user.slice/…/baychat-relay.service". v1 has no single path to read.
+    const unified = cgroup.split("\n").find((line) => line.startsWith("0::"));
+    if (!unified || !unified.trim().endsWith(`/${autostart_1.SYSTEMD_UNIT_NAME}`))
+        return [];
+    const procs = probe.readFile(`/sys/fs/cgroup${unified.slice(3).trim()}/cgroup.procs`) ?? "";
+    return procs
+        .split("\n")
+        .map((line) => Number(line.trim()))
+        .filter((pid) => Number.isInteger(pid) && pid > 1 && pid !== selfPid)
+        .filter((pid) => !isRelayProcess(probe.readFile(`/proc/${pid}/cmdline`)));
+}
+/** A `… relay start --foreground` process: one of this relay's per-Bay children. */
+function isRelayProcess(cmdline) {
+    const argv = (cmdline ?? "").split("\0");
+    const at = argv.indexOf("relay");
+    return at >= 0 && argv[at + 1] === "start" && argv.includes("--foreground");
+}
+/**
+ * Arrange for the supervisor to start the relay again once this process exits. The caller exits
+ * right after (gracefully: the daemon's own stop). Nothing to arrange for systemd and launchd.
+ */
+function arrangeRestart(supervisor) {
+    if (supervisor !== "task-scheduler")
+        return;
+    // A constant script and constant arguments (the task's fixed name, our pid): no shell, nothing
+    // from outside reaches it. Detached, so it outlives this process.
+    const helper = (0, child_process_1.spawn)(process.execPath, ["-e", WINDOWS_RESTART_HELPER, String(process.pid), autostart_1.SERVICE_LABEL], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+    });
+    helper.unref();
+}
+/** Wait (up to a minute) for the old relay to exit, then run the relay's scheduled task again. */
+const WINDOWS_RESTART_HELPER = `
+const pid = Number(process.argv[1]);
+const task = process.argv[2];
+const deadline = Date.now() + 60000;
+const gone = () => { try { process.kill(pid, 0); return false; } catch { return true; } };
+(function wait() {
+  if (!gone() && Date.now() < deadline) return setTimeout(wait, 500);
+  require("child_process").execFile("schtasks", ["/run", "/tn", task], { windowsHide: true }, () => undefined);
+})();
+`;

package/dist/relay/terminal-pane.js

@@ -37,6 +37,68 @@ function detectPane(env = process.env) {
 function expectedCommand(runtime) {
     return (0, profiles_1.profileFor)(runtime)?.bin ?? runtime;
 }
+/**
+ * A second file name a runtime's own binary runs under, and the path that proves it is that
+ * binary rather than something that happens to share the name.
+ *
+ * Claude Code's native installer (seen on macOS after its self-update, 2026-10-14) runs
+ * `…/claude-code/bin/claude.exe` behind a `claude` symlink, so tmux names the pane's program
+ * `claude.exe` and every session command was refused ("pane %8 is running claude.exe, not
+ * claude"). The NAME alone is never enough to type: the process must also be that build — its
+ * executable path, or its argv[0] being the `claude` symlink it was started through.
+ */
+const NATIVE_BUILDS = {
+    claude: { name: "claude.exe", path: /[\\/]claude-code[\\/]bin[\\/]claude\.exe$/ },
+};
+/** The last path segment: macOS `ps -o comm=` prints a full path, Linux a bare name. */
+function baseName(file) {
+    return file.split(/[\\/]/).pop() ?? file;
+}
+/** Is `name` (a pane's program, a process's comm) the runtime's native build's file name? */
+function isNativeBuildName(runtime, name) {
+    const build = NATIVE_BUILDS[runtime];
+    return !!build && baseName(name) === build.name;
+}
+/**
+ * Is `pid` the runtime's native build, proven by more than its name?
+ *
+ * Accepted when its executable path (`comm` on macOS) or its argv[0] is the build's path, or its
+ * argv[0] is the runtime's own command (`claude`, the symlink the build is started through). A
+ * process merely CALLED `claude.exe` and started as itself proves nothing and is refused.
+ */
+function isNativeBuildProcess(pid, runtime, run) {
+    const build = NATIVE_BUILDS[runtime];
+    if (!build || !Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        const comm = run("ps", ["-p", String(pid), "-o", "comm="]).trim();
+        if (baseName(comm) !== build.name)
+            return false;
+        const argv0 = run("ps", ["-p", String(pid), "-o", "args="]).trim().split(/\s+/)[0] ?? "";
+        return build.path.test(comm) || build.path.test(argv0) || baseName(argv0) === expectedCommand(runtime);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Is the pane's FOREGROUND process the runtime's native build? The foreground process group of
+ * the pane's terminal (`tpgid` of the pane's first process) is led by the program a keystroke
+ * reaches, and that leader is the process checked.
+ */
+function foregroundIsNativeBuild(panePid, runtime, run) {
+    const pid = Number(panePid);
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    let tpgid;
+    try {
+        tpgid = Number(run("ps", ["-o", "tpgid=", "-p", String(pid)]).trim());
+    }
+    catch {
+        return false;
+    }
+    return isNativeBuildProcess(tpgid, runtime, run);
+}
 /**
  * Is this pane still the session we recorded?
  *
@@ -81,7 +143,7 @@ function verifyPane(handle, runtime, run = (file, args) => (0, child_process_1.e
             "-p",
             "-t",
             handle.pane,
-            "#{pane_dead} #{pane_current_command} #{pane_tty}",
+            "#{pane_dead} #{pane_current_command} #{pane_tty} #{pane_pid}",
         ]).trim();
     }
     catch (err) {
@@ -90,10 +152,15 @@ function verifyPane(handle, runtime, run = (file, args) => (0, child_process_1.e
             reason: `tmux could not find pane ${handle.pane} any more (${errText(err)}).`,
         };
     }
-    const [dead, current, paneTty] = out.split(/\s+/);
+    const [dead, current, paneTty, panePid] = out.split(/\s+/);
     if (dead !== "0")
         return { ok: false, reason: `pane ${handle.pane} has exited.` };
     const want = expectedCommand(runtime);
+    // The runtime under its native build's file name (Claude Code's `claude.exe`): allowed only
+    // when the pane's foreground process proves to be that build — never on the name alone.
+    if (current !== want && current && isNativeBuildName(runtime, current) && foregroundIsNativeBuild(panePid, runtime, run)) {
+        return { ok: true };
+    }
     // A launcher that stayed the pane's foreground program: `baychat claude` or `baychat start`
     // run INSIDE tmux keeps `node` as the parent of the agent (Node cannot exec), so tmux names
     // `node`. Typing is still safe when the session's OWN recorded process is alive, is the
@@ -152,6 +219,11 @@ function runtimeStillRunning(pid, runtime, run) {
     // `comm` is truncated to 15 characters by the kernel, so compare on that basis rather
     // than demanding equality — "claude" and "codex" are short, but a longer runtime name
     // would otherwise never match itself.
+    if (isNativeBuildName(runtime, comm)) {
+        return isNativeBuildProcess(pid, runtime, run)
+            ? { ok: true }
+            : { ok: false, reason: `that process is ${comm}, but not ${want}'s own build — refusing to type into it.` };
+    }
     if (comm !== want && !want.startsWith(comm)) {
         return { ok: false, reason: `that process is ${comm}, not ${want} — refusing to type into it.` };
     }

package/dist/runtimes.js

@@ -181,13 +181,13 @@ ${ctx.invocation}
 \`\`\`
 
 - The supplied name becomes both your BayChat agent name and session name automatically.
-- With a name only: the shared Sessions group in your Bay, plus your private owner chat.
+- With a name only: the shared Sessions group in your Bay. No private chat is created.
 - With \`--sessions\` and no name: automatically name this verified session and join Sessions.
 - With \`<name> --private\`: join only your private owner chat.
 - With a name and a group title: join that exact group, or create it if missing.
 - With a name and a group id (\`--group "<id>"\`, as a session started from the
   BayChat app gets): join that group; never create one.
-  Joining an existing group requires membership and admin rights. Your private chat stays available under the same name.
+  Joining an existing group requires membership and admin rights. A group join creates no private chat; one you already have stays available under the same name.
   \`list_groups\` prints the exact titles.
 - With \`--group "<title>"\` and no name: automatic naming is explicitly requested.
   The join command chooses a name from this verified native session. It stays

package/dist/self-upgrade.js

@@ -33,11 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELEASE_VERSION = void 0;
 exports.resolveEntry = resolveEntry;
 exports.currentEntry = currentEntry;
 exports.classifyInstall = classifyInstall;
 exports.compareVersions = compareVersions;
 exports.upgradePackage = upgradePackage;
+exports.lookupLatest = lookupLatest;
+exports.installRelease = installRelease;
 exports.describeOutcome = describeOutcome;
 exports.realNpm = realNpm;
 exports.readPackageVersion = readPackageVersion;
@@ -100,8 +103,12 @@ function compareVersions(a, b) {
 }
 const VIEW_TIMEOUT_MS = 30_000;
 const INSTALL_TIMEOUT_MS = 180_000;
+/** A release version we will act on: plain `x.y.z`. Prereleases and anything else are refused. */
+exports.RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
+/** A reason is shown on a card and in a terminal: one short line. */
+const ATTENTION_MAX_CHARS = 200;
 /** Upgrade the running package where it can be upgraded, and say exactly what happened. */
-function upgradePackage(deps) {
+async function upgradePackage(deps) {
     const { install, current } = deps;
     if (install.kind === "npx")
         return { outcome: "npx", current };
@@ -112,38 +119,89 @@ function upgradePackage(deps) {
     // Ask first, install only when there is something newer. Besides saving a slow npm run a
     // day, this is what lets a machine whose global folder needs sudo finish `baychat update`
     // after the one `sudo npm i -g` — otherwise every run would retry the write and fail.
-    const view = deps.npm(["view", "baychat", "version"], VIEW_TIMEOUT_MS);
-    const latest = view.stdout.trim();
-    if (view.error || view.status !== 0 || !/^\d+\.\d+\.\d+$/.test(latest)) {
-        return { outcome: "unchecked", current, reason: npmFailure(view) };
-    }
-    const order = compareVersions(current, latest);
+    const latest = await lookupLatest(deps.npm);
+    if (!latest.ok)
+        return { outcome: "unchecked", current, reason: latest.reason };
+    const order = compareVersions(current, latest.release.version);
     if (order === 0 || order === 1)
         return { outcome: "current", current };
-    // `--prefer-online`: `npm view` above always revalidates, but `install` trusts a cached
-    // packument for its max-age (~5 minutes). Straight after a publish — exactly when people run
-    // `update` — that cache can predate the version view just named, and install dies ETARGET.
-    const result = deps.npm(["install", "--global", "--prefer-online", "--prefix", install.prefix, `baychat@${latest}`], INSTALL_TIMEOUT_MS);
+    const installed = await installRelease({ ...deps, install }, latest.release.version);
+    if (!installed.ok)
+        return { outcome: "failed", current, reason: installed.reason };
+    return { outcome: "upgraded", from: current, to: installed.to, packageRoot: installed.packageRoot };
+}
+/**
+ * Ask the registry for the newest `baychat` — the ONLY source an update ever comes from. Nothing
+ * the BayChat server says can name a version, a package or a URL. The answer is validated here,
+ * at the trust boundary: a version that is not plain `x.y.z` is "could not check", and the
+ * attention notes keep only exact versions and one sanitised line each.
+ */
+async function lookupLatest(npm) {
+    const view = await npm(["view", "baychat@latest", "version", "baychat", "--json"], VIEW_TIMEOUT_MS);
+    if (view.error || view.status !== 0)
+        return { ok: false, reason: npmFailure(view) };
+    let parsed;
+    try {
+        parsed = JSON.parse(view.stdout);
+    }
+    catch {
+        return { ok: false, reason: "npm answered with something that is not JSON" };
+    }
+    // One field asked for and present → npm prints it bare; several → an object of them.
+    const fields = typeof parsed === "string" ? { version: parsed } : parsed;
+    const version = typeof fields?.version === "string" ? fields.version.trim() : "";
+    if (!exports.RELEASE_VERSION.test(version))
+        return { ok: false, reason: `npm named no release version (${JSON.stringify(version)})` };
+    return { ok: true, release: { version, attention: attentionNotes(fields?.baychat) } };
+}
+/**
+ * Install exactly `version` over the running global copy, in its own prefix, and believe only the
+ * disk. Touches nothing but `baychat` in that prefix. On failure nothing claims success; the
+ * caller decides what to tell people.
+ */
+async function installRelease(deps, version) {
+    if (!exports.RELEASE_VERSION.test(version))
+        return { ok: false, reason: `refusing to install ${JSON.stringify(version)}: not a release version` };
+    const { install } = deps;
+    // `--prefer-online`: `npm view` always revalidates, but `install` trusts a cached packument
+    // for its max-age (~5 minutes). Straight after a publish — exactly when people run `update` —
+    // that cache can predate the version view just named, and install dies ETARGET.
+    const result = await deps.npm(["install", "--global", "--prefer-online", "--prefix", install.prefix, `baychat@${version}`], INSTALL_TIMEOUT_MS);
     if (result.error || result.status !== 0) {
         const denied = /\b(EACCES|EPERM)\b/.test(`${result.stderr}\n${result.error?.message ?? ""}`);
         const reason = denied
-            ? `npm is not allowed to write to ${install.prefix}. Run \`${sudoHint(deps, install.prefix)}\` ` +
+            ? `npm is not allowed to write to ${install.prefix}. Run \`${await sudoHint(deps.npm, install.prefix)}\` ` +
                 "(or give npm a folder you own: https://docs.npmjs.com/resolving-eacces-permissions-errors-when-installing-packages-globally), " +
                 "then `baychat update` again."
             : npmFailure(result);
-        return { outcome: "failed", current, reason };
+        return { ok: false, reason };
     }
     // npm said yes. Believe the file on disk, not the exit code: this is the very step that
     // used to report success over an unchanged install.
     const onDisk = deps.readVersion(install.packageRoot);
-    if (onDisk !== latest) {
+    if (onDisk !== version) {
         return {
-            outcome: "failed",
-            current,
-            reason: `npm reported success, but ${install.packageRoot} holds ${onDisk ?? "no readable package.json"}, not ${latest}.`,
+            ok: false,
+            reason: `npm reported success, but ${install.packageRoot} holds ${onDisk ?? "no readable package.json"}, not ${version}.`,
         };
     }
-    return { outcome: "upgraded", from: current, to: onDisk, packageRoot: install.packageRoot };
+    return { ok: true, to: onDisk, packageRoot: install.packageRoot };
+}
+/** The attention notes a release carries, validated: exact versions only, one short plain line each. */
+function attentionNotes(raw) {
+    const notes = {};
+    const attention = raw && typeof raw === "object" ? raw.attention : undefined;
+    if (!attention || typeof attention !== "object" || Array.isArray(attention))
+        return notes;
+    for (const [version, reason] of Object.entries(attention)) {
+        if (!exports.RELEASE_VERSION.test(version) || typeof reason !== "string")
+            continue;
+        // eslint-disable-next-line no-control-regex
+        const line = reason.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, ATTENTION_MAX_CHARS);
+        if (line)
+            notes[version] = line;
+    }
+    return notes;
 }
 /** What a person reads for each outcome. `ok: false` means: do not claim this machine is updated. */
 function describeOutcome(o) {
@@ -176,9 +234,9 @@ function describeOutcome(o) {
             };
     }
 }
-function sudoHint(deps, prefix) {
+async function sudoHint(npm, prefix) {
     // Plain `sudo npm i -g` is only right when npm's own global prefix IS this install's.
-    const own = deps.npm(["prefix", "--global"], VIEW_TIMEOUT_MS);
+    const own = await npm(["prefix", "--global"], VIEW_TIMEOUT_MS);
     const ownPrefix = !own.error && own.status === 0 ? own.stdout.trim() : "";
     return ownPrefix && resolveEntry(ownPrefix) === resolveEntry(prefix)
         ? "sudo npm i -g baychat@latest"
@@ -191,18 +249,25 @@ function npmFailure(r) {
     const lines = r.stderr.split("\n").map((l) => l.trim()).filter(Boolean);
     return lines.slice(-3).join(" ") || `npm exited with ${r.status}`;
 }
-/** Run npm for real. Windows' npm is a `.cmd` shim, which Node will only start through a shell. */
+/** Run npm for real, without blocking the event loop (the relay keeps serving while npm runs).
+ *  Windows' npm is a `.cmd` shim, which Node will only start through a shell, so every argument
+ *  is first checked against what cmd.exe could misread and then quoted. */
 function realNpm(args, timeoutMs) {
     const windows = process.platform === "win32";
     if (windows && args.some((a) => commands_1.WINDOWS_UNSAFE.test(a))) {
-        return { status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") };
+        return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") });
     }
-    const r = (0, child_process_1.spawnSync)("npm", windows ? args.map(commands_1.quoteForCmd) : args, {
-        encoding: "utf8",
-        timeout: timeoutMs,
-        shell: windows,
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)("npm", windows ? args.map(commands_1.quoteForCmd) : args, { encoding: "utf8", timeout: timeoutMs, shell: windows, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (!err)
+                return resolve({ status: 0, stdout, stderr });
+            const code = err.code;
+            // A number is npm's own exit status; anything else (ENOENT, a timeout's kill) never ran it to the end.
+            if (typeof code === "number")
+                return resolve({ status: code, stdout, stderr });
+            resolve({ status: null, stdout: stdout ?? "", stderr: stderr ?? "", error: err });
+        });
     });
-    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "", error: r.error };
 }
 function readPackageVersion(packageRoot) {
     try {