baychat 0.30.0 → 0.31.0

package/dist/denied-hook.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RELOAD_SETTLE_MS = void 0;
+exports.RELOAD_SETTLE_MS = exports.deniedHookLogPath = void 0;
 exports.retryOutput = retryOutput;
 exports.composeDeniedQuestion = composeDeniedQuestion;
 exports.offeredMeanings = offeredMeanings;
@@ -62,9 +62,17 @@ exports.cmdDeniedHook = cmdDeniedHook;
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 //
 // Unlike approve-hook, silence is safe: no output leaves the denial standing. Every abnormal path
-// — no credential, no transcript proof, BayChat unreachable, an unanswered card, a settings file
-// we cannot parse, an exception — prints nothing and writes no rule. A rule is written only after
-// the card's owner tapped a yes, and `retry` is printed only after the rule was written.
+// — no credential, no proof, BayChat unreachable, an unanswered card, a settings file we cannot
+// parse, an exception — prints nothing and writes no rule. A rule is written only after the card's
+// owner tapped a yes, and `retry` is printed only after the rule was written.
+//
+// PROOF, IN TWO HALVES. Claude Code 2.1.299 writes the denied call to the transcript only after
+// this hook returns (measured; denied/transcript.ts), so the transcript is looked at only briefly.
+// Found → proven. Found as a DIFFERENT call → refused. Not there yet → the event must come from
+// the live Claude Code of the session it names (denied/live-session.ts), and a yes is recorded as
+// UNCONFIRMED and checked against the transcript afterwards by a detached
+// `baychat permissions confirm` (denied/confirm.ts), which takes the rule back out — and tells the
+// owner — when the call never shows up.
 //
 // THE PROCESS BLOCKS THE SESSION WHILE IT WAITS, like approve-hook: hooks are awaited, so the
 // session stops until the owner answers or our deadline passes. That is the reliable shape: the
@@ -80,10 +88,16 @@ const approve_hook_1 = require("./approve-hook");
 const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
+const confirm_1 = require("./denied/confirm");
 const grants_1 = require("./denied/grants");
+const hook_log_1 = require("./denied/hook-log");
+const live_session_1 = require("./denied/live-session");
+const notice_1 = require("./denied/notice");
 const permission_rule_1 = require("./denied/permission-rule");
 const settings_rules_1 = require("./denied/settings-rules");
 const transcript_1 = require("./denied/transcript");
+var hook_log_2 = require("./denied/hook-log");
+Object.defineProperty(exports, "deniedHookLogPath", { enumerable: true, get: function () { return hook_log_2.deniedHookLogPath; } });
 function retryOutput() {
     return { hookSpecificOutput: { hookEventName: "PermissionDenied", retry: true } };
 }
@@ -94,8 +108,6 @@ const LABEL = {
     always: "Always allow this exact command",
     no: "No",
 };
-/** The single button of a card that only informs: nothing can be allowed from BayChat. */
-const NOTICE_OPTIONS = ["OK"];
 /** The card's own limits (apps/api/src/lib/cards.ts), used only to TRIM. */
 const QUESTION_MAX = 2000;
 const SHOWN_MAX = 900;
@@ -117,11 +129,21 @@ function isNoVerdict(reason) {
 /** The card's question. A person decides from this text alone, on a lock screen. */
 function composeDeniedQuestion(q) {
     const shown = q.plan.shown.length <= SHOWN_MAX ? q.plan.shown : `${q.plan.shown.slice(0, SHOWN_MAX - 1)}…`;
+    const one = q.plan.onceRules.length === 1;
+    const user = q.target.scope === "user";
+    // The user scope reaches every project on this computer, so the card says where the rule goes
+    // and why — never only a path the person has to decode on a lock screen.
+    const where = user ? `your user settings (${tildePath(q.target.file)})` : q.target.file;
     const offers = q.plan.onceRules.length
         ? [
-            `Allow once: BayChat adds ${q.plan.onceRules.length === 1 ? "this exact rule" : "these exact rules"} to ` +
-                `${q.settingsFile} for the retry, then takes ${q.plan.onceRules.length === 1 ? "it" : "them"} out.`,
-            q.plan.alwaysAllowed ? "Always: BayChat keeps the rule there (`baychat permissions list` shows it)." : "",
+            `Allow once: BayChat adds ${one ? "this exact rule" : "these exact rules"} to ${where} for the retry, ` +
+                `then takes ${one ? "it" : "them"} out${user ? " — the project folder isn't writable for you" : ""}.`,
+            q.plan.alwaysAllowed
+                ? user
+                    ? "Always: BayChat keeps the rule in your user settings, so it applies to every project on this computer " +
+                        "(`baychat permissions list` shows it)."
+                    : "Always: BayChat keeps the rule there, for this project (`baychat permissions list` shows it)."
+                : "",
         ]
         : [];
     const lines = [
@@ -138,6 +160,11 @@ function composeDeniedQuestion(q) {
     const text = lines.filter((l) => l !== undefined).join("\n").replace(/\n{3,}/g, "\n\n").trim();
     return text.length <= QUESTION_MAX ? text : `${text.slice(0, QUESTION_MAX - 1)}…`;
 }
+/** `/home/k/.claude/settings.json` → `~/.claude/settings.json`. */
+function tildePath(file) {
+    const home = os.homedir();
+    return file === home || file.startsWith(home + path.sep) ? `~${file.slice(home.length)}` : file;
+}
 /** The buttons for a plan: every option it allows, and always a way to say no. */
 function offeredMeanings(plan) {
     if (plan.onceRules.length === 0)
@@ -205,23 +232,44 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
             return null;
         }
+        // Every run takes back what is overdue first, so a stale grant never covers this call.
+        try {
+            await (deps.sweepGrants ?? defaultSweepGrants)(device);
+        }
+        catch (err) {
+            log(`${LOG_LABEL}: the grants sweep failed (${(0, approval_wait_1.reasonOf)(err)}).`);
+        }
         // Only a call the model really made may put a card on anybody's phone.
-        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({
-            transcriptPath: str(input.transcript_path),
-            agentId: str(input.agent_id) || undefined,
-            toolUseId: str(input.tool_use_id),
-            toolName,
-            toolInput: input.tool_input,
-        });
-        if (!proof.ok) {
-            log(`${LOG_LABEL}: ${proof.why}; no card was posted and the denial stands.`);
+        const transcriptPath = str(input.transcript_path);
+        const agentId = str(input.agent_id) || undefined;
+        const toolUseId = str(input.tool_use_id);
+        const proofStarted = now();
+        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({ transcriptPath, agentId, toolUseId, toolName, toolInput: input.tool_input });
+        // Set when the call is accepted before it is in the transcript: a yes is then confirmed later.
+        let unconfirmed;
+        if (proof.ok) {
+            log(`${LOG_LABEL}: proven — the call is in the transcript (after ${now() - proofStarted} ms).`);
+        }
+        else if (!proof.absent || !toolUseId || !call) {
+            log(`${LOG_LABEL}: refused — ${proof.why} (after ${now() - proofStarted} ms); no card was posted and the denial stands.`);
             return null;
         }
+        else {
+            const live = (deps.liveSession ?? live_session_1.proveLiveSession)({ sessionId: claudeSessionId, transcriptPath, agentId });
+            if (!live.ok) {
+                log(`${LOG_LABEL}: refused — the call is not in the transcript yet (after ${now() - proofStarted} ms) and ` +
+                    `the event is not from this session's live Claude Code: ${live.why}; no card was posted and the denial stands.`);
+                return null;
+            }
+            log(`${LOG_LABEL}: accepted — the call is not in the transcript yet (after ${now() - proofStarted} ms), and the ` +
+                `event comes from this session's live Claude Code (pid ${live.pid}); a yes is confirmed against the transcript afterwards.`);
+            unconfirmed = { transcriptPath, ...(agentId ? { agentId } : {}), toolUseId, toolName };
+        }
         const host = (deps.hostname ?? os.hostname)();
         const who = session ? `Session "${session}"` : "A Claude Code session";
         const waitDeps = { now, sleep, log };
         // A card that only informs: posted, never waited on (its deadline is already now).
-        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
+        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: notice_1.NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
         // ── Already allowed, and denied again: the reload race, or a rule that does not match.
         const covering = call ? (0, grants_1.coveringGrant)(claudeSessionId, call, now()) : undefined;
         if (covering) {
@@ -242,9 +290,28 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             log(`${LOG_LABEL}: no project directory to keep a rule in; the denial stands.`);
             return null;
         }
-        const settingsFile = (deps.settingsFileFor ?? settings_rules_1.localSettingsFile)(projectDir);
-        const plan = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
-        const question = composeDeniedQuestion({ who, host, plan, reason, cwd: str(input.cwd), settingsFile });
+        // Decided BEFORE the card: an Allow button for a file this user cannot write can only fail.
+        const choice = (deps.settingsChoiceFor ?? settings_rules_1.chooseSettingsFile)(projectDir);
+        const planned = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
+        const plan = choice.scope === "none" && planned.onceRules.length > 0
+            ? {
+                ...planned,
+                onceRules: [],
+                alwaysAllowed: false,
+                limitation: `BayChat can't allow it from here: ${choice.why}, so no rule can be saved. ` +
+                    "Approve it at the computer (/permissions → Recently denied).",
+            }
+            : planned;
+        const target = choice.scope === "none" ? undefined : choice;
+        const question = composeDeniedQuestion({
+            who,
+            host,
+            plan,
+            reason,
+            cwd: str(input.cwd),
+            // Any target will do for a card that offers nothing: no write line is drawn.
+            target: target ?? { scope: "project", file: "" },
+        });
         const meanings = offeredMeanings(plan);
         if (meanings.length === 0) {
             // Nothing can be allowed from BayChat; the owner still learns why the session stopped.
@@ -268,18 +335,20 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             return null;
         }
         const meaning = (outcome.index !== null ? meanings[outcome.index] : undefined) ?? "no";
-        if (meaning === "no" || !plan.call)
+        if (meaning === "no" || !plan.call || !target)
             return null;
         let grant;
         try {
             grant = await (0, grants_1.grantRules)({
                 kind: meaning,
                 rules: plan.onceRules,
-                settingsFile,
+                settingsFile: target.file,
+                scope: target.scope,
                 call: plan.call,
                 shown: plan.shown,
                 claudeSessionId,
                 session,
+                ...(unconfirmed ? { unconfirmed } : {}),
             }, now());
         }
         catch (err) {
@@ -290,6 +359,11 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
         if (grant.kind === "once" && grant.expiresAt) {
             (deps.scheduleSweep ?? scheduleSweep)(Date.parse(grant.expiresAt));
         }
+        if (grant.unconfirmed) {
+            // Started before `retry`, so it holds the grant before the retried call can use it up.
+            (deps.scheduleConfirm ?? scheduleConfirm)(grant.id);
+            log(`${LOG_LABEL}: grant ${grant.id} (${grant.kind}) is unconfirmed; its confirmation was started.`);
+        }
         await sleep(exports.RELOAD_SETTLE_MS);
         return retryOutput();
     }
@@ -304,26 +378,54 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
  * after-hook and every later hook run sweep too.
  */
 function scheduleSweep(atMs) {
+    spawnDetached(["permissions", "sweep", "--at", String(atMs)], "schedule the once-rule's removal");
+}
+/**
+ * Start `baychat permissions confirm --grant <id>` detached: it waits for the denied call to reach
+ * the transcript and takes the grant back when it does not (denied/confirm.ts). Best effort: a
+ * confirmation that never runs is caught as a stale unconfirmed grant by every later hook run.
+ */
+function scheduleConfirm(grantId) {
+    spawnDetached(["permissions", "confirm", "--grant", grantId], "start the grant's confirmation");
+}
+function spawnDetached(args, what) {
     try {
         const entry = fs.realpathSync(process.argv[1] ?? "");
-        const child = (0, child_process_1.spawn)(process.execPath, [entry, "permissions", "sweep", "--at", String(atMs)], {
-            detached: true,
-            stdio: "ignore",
-        });
+        const child = (0, child_process_1.spawn)(process.execPath, [entry, ...args], { detached: true, stdio: "ignore" });
         child.unref();
     }
     catch (err) {
-        process.stderr.write(`${LOG_LABEL}: could not schedule the once-rule's removal (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+        process.stderr.write(`${LOG_LABEL}: could not ${what} (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+        (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: could not ${what} (${(0, approval_wait_1.reasonOf)(err)}).`);
     }
 }
+async function defaultSweepGrants(device) {
+    await (0, grants_1.sweepExpiredGrants)();
+    await (0, confirm_1.takeBackStaleUnconfirmed)({ loadDevice: () => device, log: hook_log_1.logBoth });
+}
 /**
  * `baychat denied-hook [--session <name> | --session-from-claude] [--timeout <seconds>]`
  *
  * Always returns 0 (Claude Code ignores this event's exit code). Prints `retry` or nothing.
  */
 async function cmdDeniedHook(argv = [], stdin = process.stdin) {
-    const output = await decideDenied(await (0, hook_stdin_1.readStdin)(stdin), argv);
+    const raw = await (0, hook_stdin_1.readStdin)(stdin);
+    const log = hook_log_1.logBoth;
+    (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: called (${eventSummary(raw)})`);
+    const output = await decideDenied(raw, argv, { log });
+    (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: ${output ? "retry" : "no retry"}`);
     if (output)
         process.stdout.write(`${JSON.stringify(output)}\n`);
     return 0;
 }
+// ─── The hook's own log (denied/hook-log.ts) ──────────────────────────────────
+/** Event name, tool, session id and which fields came — never the tool input itself. */
+function eventSummary(raw) {
+    try {
+        const e = JSON.parse(raw);
+        return `event=${String(e.hook_event_name)} tool=${String(e.tool_name)} session=${String(e.session_id)} call=${String(e.tool_use_id)} keys=${Object.keys(e).join(",")}`;
+    }
+    catch {
+        return `unreadable stdin, ${raw.length} bytes`;
+    }
+}

package/dist/doctor-command.js

@@ -55,6 +55,9 @@ const credential_refresh_1 = require("./credential-refresh");
 const client_paths_1 = require("./client-paths");
 const runtime_binary_1 = require("./runtime-binary");
 const ws_1 = require("./relay/ws");
+const describe_1 = require("./auto-update/describe");
+const store_1 = require("./auto-update/store");
+const self_upgrade_1 = require("./self-upgrade");
 /** How long `claude mcp list` may take before we treat it as unanswerable. */
 const MCP_LIST_TIMEOUT_MS = 15_000;
 /**
@@ -88,6 +91,7 @@ async function currentDoctorEnv() {
             bayRelayAlive[bay.bayId] = await (0, socket_1.probeSocket)((0, bay_relays_1.bayRelayScope)(bay.bayId, (0, config_1.configDir)(), (0, socket_1.socketPath)()).socket);
         }
     }
+    const relay = await (0, commands_1.tryRelayStatus)();
     return {
         bays,
         bayRelayAlive,
@@ -95,7 +99,9 @@ async function currentDoctorEnv() {
         platform: process.platform,
         now: Date.now(),
         device: (0, config_1.loadDeviceCredentials)(),
-        relay: await (0, commands_1.tryRelayStatus)(),
+        relay,
+        // The running relay's own account when it gives one; else what its files say.
+        autoUpdate: relay?.autoUpdate ?? (0, describe_1.statusFromFiles)({ state: (0, store_1.loadAutoUpdateState)(), setting: (0, store_1.loadAutoSetting)(), env: process.env, current: (0, self_upgrade_1.ownVersion)() }),
         node: { version: process.version, webSocket: (0, ws_1.hasBuiltInWebSocket)() },
         // APPDATA, LOCALAPPDATA and a directory lister: without them a Windows report cannot
         // see Claude Desktop's config at all, Store copy or classic.

package/dist/doctor.js

@@ -61,6 +61,7 @@ exports.acpChecks = acpChecks;
 exports.exitCodeFor = exitCodeFor;
 exports.renderReport = renderReport;
 exports.bayChecks = bayChecks;
+exports.autoUpdateCheck = autoUpdateCheck;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -76,6 +77,8 @@ const launch_1 = require("./channel/launch");
 const plugin_1 = require("./channel/plugin");
 const transport_1 = require("./relay/transport");
 const ws_1 = require("./relay/ws");
+const describe_1 = require("./auto-update/describe");
+const self_upgrade_1 = require("./self-upgrade");
 /**
  * The runtimes worth reporting on.
  *
@@ -122,6 +125,7 @@ function buildReport(env) {
         credentials: credentialsCheck(env),
         bays: bayChecks(env),
         relay: relayCheck(env),
+        autoUpdate: autoUpdateCheck(env),
         mailbox: mailboxCheck(),
         staleCredentials: staleCredentialCheck(env),
         runtimes: REPORTED.map((runtime) => runtimeReport(runtime, env)),
@@ -293,6 +297,7 @@ function renderReport(report) {
         lines.push(...renderSummaryCheck(check));
     lines.push(...renderSummaryCheck(report.staleCredentials));
     lines.push(...renderSummaryCheck(report.relay));
+    lines.push(...renderSummaryCheck(report.autoUpdate));
     lines.push(...renderSummaryCheck(report.mailbox));
     for (const block of report.runtimes) {
         const [first, ...rest] = block.checks;
@@ -443,6 +448,28 @@ function relayCheck(env) {
     }
     return { name: "relay", status: "pass", detail: `running (pid ${env.relay.pid})${transport}` };
 }
+/**
+ * Is this computer keeping itself current? A warning only when something needs the person: a
+ * newer version this copy cannot install by itself, a card waiting on the phone, or an automatic
+ * install that failed. Off is a choice, not a fault, so it is reported and never nagged about.
+ */
+function autoUpdateCheck(env) {
+    const name = "auto-update";
+    const status = env.autoUpdate;
+    if (!status)
+        return { name, status: "skip", detail: "not inspected" };
+    const detail = (0, describe_1.describeAutoUpdate)(status, env.now);
+    const behind = !!status.latest && (0, self_upgrade_1.compareVersions)(status.current, status.latest) === -1;
+    if (status.mode === "off" || status.mode === "none")
+        return { name, status: "skip", detail };
+    if (status.failure)
+        return { name, status: "warn", detail, remedy: "baychat update" };
+    if (status.cardVersion)
+        return { name, status: "warn", detail, remedy: "answer the card in BayChat, or run baychat update" };
+    if (status.mode === "notify" && behind)
+        return { name, status: "warn", detail, remedy: "baychat update" };
+    return { name, status: "pass", detail };
+}
 function pendingCheck(env) {
     if (!env.relay) {
         return { name: "pending", status: "skip", detail: "relay not running — nothing to report" };
@@ -783,6 +810,7 @@ function allChecks(report) {
         ...report.bays,
         report.staleCredentials,
         report.relay,
+        report.autoUpdate,
         report.mailbox,
         ...report.runtimes.flatMap((r) => r.checks),
         ...report.agents,

package/dist/main.js

@@ -9,6 +9,7 @@ const context_hooks_command_1 = require("./context-hooks-command");
 const session_name_1 = require("./session-name");
 const start_command_1 = require("./start-command");
 const update_command_1 = require("./update-command");
+const notice_1 = require("./auto-update/notice");
 const session_command_1 = require("./session-command");
 const doctor_command_1 = require("./doctor-command");
 const bays_command_1 = require("./bays-command");
@@ -56,8 +57,13 @@ async function main() {
     // else", and a usage dump printed at somebody who typed the product's own name is the
     // "something else". `--help` still prints the help, and `start` refuses with one sentence
     // when this machine is not signed in, so nothing is launched from an unusable state.
-    if (command === undefined)
+    if (command === undefined) {
+        (0, notice_1.printUpdateNotice)(command);
         return (0, start_command_1.cmdStart)([]);
+    }
+    // "BayChat updated itself to …": the relay's one line for the terminal, shown once, on a command
+    // a person typed (never into a hook's or an MCP server's output).
+    (0, notice_1.printUpdateNotice)(command);
     // Asking for help never acts: `--help`/`-h` on any command prints its usage and runs nothing
     // (cli-help.ts says which commands' arguments are not ours to read — `claude`, `send`, …).
     const help = (0, cli_help_1.helpRequest)(command, args);
@@ -76,7 +82,10 @@ async function main() {
             return (0, start_command_1.cmdStart)(args);
         case "update":
             // `--quiet` is how an old version hands a `start`-driven update to the new one.
-            return (0, update_command_1.cmdUpdate)({ quiet: args.includes("--quiet") });
+            (0, args_1.rejectUnknownFlags)(args, ["--quiet", "--auto"], "baychat update [--auto on|off]");
+            if (args.includes("--auto") && !(0, args_1.flag)(args, "--auto"))
+                throw new Error("Usage: baychat update --auto on|off");
+            return (0, update_command_1.cmdUpdate)({ quiet: args.includes("--quiet"), auto: (0, args_1.flag)(args, "--auto") });
         case "skill": {
             const runtime = args[1];
             if (args.length !== 2 ||

package/dist/permissions-command.js

@@ -7,10 +7,15 @@ exports.cmdPermissions = cmdPermissions;
 //   baychat permissions remove <id>   take one back out of its settings file
 //   baychat permissions on | off      the card itself, for sessions BayChat starts from now on
 //   baychat permissions sweep         (internal) take back once-rules whose time is up
+//   baychat permissions confirm --grant <id>
+//                                     (internal) confirm an unconfirmed grant against the
+//                                     session's transcript, or take it back (denied/confirm.ts)
 //
 // Only rules BayChat wrote are listed or removed. A rule the person wrote themselves never
 // appears here, because a rule that was already in the file was never recorded (denied/grants.ts).
+const confirm_1 = require("./denied/confirm");
 const grants_1 = require("./denied/grants");
+const hook_log_1 = require("./denied/hook-log");
 const opt_in_1 = require("./denied/opt-in");
 /** The longest a scheduled sweep may sleep: a once-rule's TTL is minutes, never hours. */
 const MAX_SWEEP_DELAY_MS = 60 * 60_000;
@@ -71,6 +76,17 @@ async function cmdPermissions(args, deps = {}) {
                 await (deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(delay + 1000);
             }
             await (0, grants_1.sweepExpiredGrants)(now());
+            await (0, confirm_1.takeBackStaleUnconfirmed)({ log: hook_log_1.logBoth, ...deps.confirm });
+            return 0;
+        }
+        case "confirm": {
+            // Started detached by denied-hook (never by a person); not in USAGE on purpose.
+            const id = rest[rest.indexOf("--grant") + 1];
+            if (!rest.includes("--grant") || !id) {
+                err("Usage: baychat permissions confirm --grant <id>");
+                return 1;
+            }
+            await (0, confirm_1.confirmGrant)(id, { log: hook_log_1.logBoth, ...deps.confirm });
             return 0;
         }
         default:
@@ -83,5 +99,6 @@ function describeGrant(grant) {
     // A once-rule can carry a secret from the command (it is never offered as "always" then), so it
     // is listed as the card showed it, masked; an always-rule never holds one and is listed as written.
     const rules = grant.kind === "once" ? grant.shown : grant.rules.length ? grant.rules.join(", ") : "(the rule was already there)";
-    return `${grant.id}  ${rules}\n          ${when} · ${grant.settingsFile}${grant.session ? ` · ${grant.session}` : ""}`;
+    const scope = grant.scope === "user" ? "user settings, every project" : "this project";
+    return `${grant.id}  ${rules}\n          ${when} · ${scope} · ${grant.settingsFile}${grant.session ? ` · ${grant.session}` : ""}`;
 }

package/dist/refresh-clients.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refreshConnectedClients = refreshConnectedClients;
+const child_process_1 = require("child_process");
+const client_paths_1 = require("./client-paths");
+const commands_1 = require("./commands");
+const credential_refresh_1 = require("./credential-refresh");
+/**
+ * Steps 2 and 3 of an update, shared with the relay's automatic update (which runs them from the
+ * NEW code once it has restarted onto it): every connected client's copy of the credential and
+ * endpoint, then Claude Code, which is not an MCP-config client and registers through its own CLI.
+ * Returns what was done, one line each. Never throws: the steps are independent, and a machine
+ * that failed one is better off doing the other than stopping at the first.
+ */
+function refreshConnectedClients(device, say) {
+    const done = [];
+    try {
+        const updated = (0, credential_refresh_1.refreshExistingClientConfigs)({ url: `${device.baseUrl}/api/mcp`, token: device.token }, commands_1.realConfigIo, (0, client_paths_1.currentPathEnv)());
+        for (const file of updated)
+            done.push(`refreshed ${file}`);
+    }
+    catch (err) {
+        say(`  Could not refresh client configs: ${errText(err)}`);
+    }
+    if (hasBinary("claude") && (0, commands_1.registerWithClaude)(device.baseUrl, device.token)) {
+        done.push("re-registered BayChat with Claude Code");
+    }
+    return done;
+}
+function hasBinary(name) {
+    const probe = (0, child_process_1.spawnSync)(name, ["--version"], { stdio: "ignore", timeout: 15_000 });
+    return !probe.error && probe.status === 0;
+}
+function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/relay/acp/runner.js

@@ -201,6 +201,10 @@ class AcpSessionRunner {
     status(session) {
         return { running: this.running.has(session), queued: this.deps.queue.depth(session) };
     }
+    /** Sessions with a turn running or waiting to run. */
+    activeSessions() {
+        return [...this.loops.keys()];
+    }
     async idle() {
         while (this.loops.size > 0)
             await Promise.all([...this.loops.values()]);

package/dist/relay/commands.js

@@ -62,6 +62,9 @@ const terminal_pane_1 = require("./terminal-pane");
 const owner_pid_1 = require("./owner-pid");
 const parent_watch_1 = require("./parent-watch");
 const daemon_1 = require("./daemon");
+const relay_glue_1 = require("../auto-update/relay-glue");
+const describe_1 = require("../auto-update/describe");
+const self_upgrade_1 = require("../self-upgrade");
 const bay_relays_1 = require("./bay-relays");
 const config_1 = require("../config");
 const resume_1 = require("./resume");
@@ -135,11 +138,22 @@ async function cmdRelayStart(opts = {}) {
                 baseConfigDir: (0, config_1.configDir)(),
                 baseSocket: (0, socket_1.socketPath)(),
             });
-        const daemon = new daemon_1.RelayDaemon({ onListening: () => supervisor?.start() });
-        const shutdown = () => {
+        // The automatic update (docs/features/CLI_AUTO_UPDATE.md) runs in the supervising relay only;
+        // a per-Bay child restarts with its parent. Started once this relay owns its socket.
+        let updater;
+        const daemon = new daemon_1.RelayDaemon({
+            onListening: () => {
+                supervisor?.start();
+                if (!child)
+                    updater = (0, relay_glue_1.startRelayUpdater)({ daemon, log: (line) => console.log(`[relay] ${line}`), shutdown });
+            },
+            autoUpdateStatus: child ? undefined : () => updater?.status() ?? { mode: "none", reason: "starting", current: (0, self_upgrade_1.ownVersion)() },
+        });
+        function shutdown() {
+            updater?.stop();
             supervisor?.stop();
             void daemon.stop().then(() => process.exit(0));
-        };
+        }
         process.on("SIGINT", shutdown);
         process.on("SIGTERM", shutdown);
         const parentPid = Number(process.env[bay_relays_1.BAY_RELAY_PARENT_ENV]);
@@ -294,6 +308,8 @@ async function cmdRelayStatus() {
     console.log(`  polls: ${status.polls}   delivered: ${status.delivered}   cursor: ${status.cursor ?? "—"}`);
     if (status.lastError)
         console.log(`  last error: ${status.lastError}`);
+    if (status.autoUpdate)
+        console.log(`  auto-update: ${(0, describe_1.describeAutoUpdate)(status.autoUpdate, Date.now())}`);
     for (const line of await bayRelayLines())
         console.log(line);
     // Computed before the session list so a line can report its own last failure.

package/dist/relay/daemon.js

@@ -193,10 +193,16 @@ class RelayDaemon {
     startLauncherFn;
     /** Aborted on stop(): ends the launcher's long-poll. */
     launcherAbort = new AbortController();
+    autoUpdateStatus;
+    /** When a message last reached this relay or was delivered — the automatic update's quiet window. */
+    lastActivityAt;
+    /** A launch from BayChat is being carried out (the launcher's `onLaunch`). */
+    launching = false;
     constructor(opts = {}) {
         this.log = opts.log ?? ((line) => console.log(`[relay] ${line}`));
         this.onListening = opts.onListening;
         this.startLauncherFn = opts.startLauncher ?? loop_1.startLauncher;
+        this.autoUpdateStatus = opts.autoUpdateStatus;
         // EVERY candidate root, because the daemon cannot know which one the agent's
         // sandbox turned out to permit — it may have fallen back past the one this
         // process would have chosen.
@@ -341,7 +347,14 @@ class RelayDaemon {
         this.codexContext.start();
         if (!(0, bay_relays_1.isBayRelayChild)()) {
             // Never awaited and never fatal: the launcher retries its own network failures until stop().
-            void this.startLauncherFn({ auth, log: (line) => this.log(line), signal: this.launcherAbort.signal }).catch((err) => this.log(`launcher stopped: ${err instanceof Error ? err.message : String(err)}`));
+            void this.startLauncherFn({
+                auth,
+                log: (line) => this.log(line),
+                signal: this.launcherAbort.signal,
+                onLaunch: (busy) => {
+                    this.launching = busy;
+                },
+            }).catch((err) => this.log(`launcher stopped: ${err instanceof Error ? err.message : String(err)}`));
         }
         this.log(`listening on ${sockPath} (pid ${process.pid}) as device "${device.user.name}"`);
         this.log(`${this.registry.all().length} known session target(s)`);
@@ -406,6 +419,7 @@ class RelayDaemon {
         // behind must not have its recovery window truncated by a session that was
         // ahead. An event with no session still registers the room — see Watermarks.
         this.watermarks.record(sessionName, conversationId, message.createdAt);
+        this.lastActivityAt = Date.now();
         if (!sessionName) {
             this.log(`event ${message.id} carries no session (renamed or ended mid-poll) — ignoring`);
             return;
@@ -1330,6 +1344,7 @@ class RelayDaemon {
         return updated;
     }
     record(outcome, session, batch) {
+        this.lastActivityAt = Date.now();
         if (outcome.kind === "woken") {
             this.delivered += batch.length;
             const room = batch.at(-1)?.conversationId;
@@ -1635,8 +1650,29 @@ class RelayDaemon {
             pending: this.pending,
             held: this.held.summary(),
             lastError: this.lastError,
+            autoUpdate: this.autoUpdateStatus?.(),
         };
     }
+    /** What this relay is doing right now, for deciding whether it may restart (auto-update/policy.ts). */
+    activity() {
+        return {
+            deliveries: this.queue.activeSessions(),
+            headless: [...this.headlessInFlight],
+            acp: this.acp.activeSessions(),
+            heldAt: this.held.summary().map((h) => h.heldAt),
+            launching: this.launching,
+            lastActivityAt: this.lastActivityAt,
+        };
+    }
+    /**
+     * Sessions running on THIS computer that the server lists as live — the ones a card can be asked
+     * through. Attached ones first: their owner is most likely looking at them.
+     */
+    hostedLiveSessions() {
+        const hosted = this.registry.all().filter((t) => this.liveSessions.includes(t.name));
+        const reachable = (name) => this.attached.has(name) || this.mailboxes.has(name) || this.channelLinked(name);
+        return hosted.sort((a, b) => Number(reachable(b.name)) - Number(reachable(a.name))).map((t) => t.name);
+    }
     async stop() {
         clearInterval(this.acpKeepAlive);
         this.launcherAbort.abort();

package/dist/relay/launcher/loop.js

@@ -66,7 +66,7 @@ const BACKOFF_MAX_MS = 60_000;
 const CAPABILITIES_REFRESH_MS = 10 * 60_000;
 /** A long-poll holds for WAIT_SECONDS; give the request this much beyond it before calling it dead. */
 const REQUEST_GRACE_MS = 15_000;
-async function startLauncher({ auth, log, signal, deps: overrides }) {
+async function startLauncher({ auth, log, signal, onLaunch, deps: overrides }) {
     const deps = { ...realLoopDeps(log, signal), ...overrides };
     let advertised;
     let unreported;
@@ -76,6 +76,7 @@ async function startLauncher({ auth, log, signal, deps: overrides }) {
             if (unreported) {
                 await deps.request(auth, "POST", `/api/device-api/launches/${encodeURIComponent(unreported.id)}/report`, unreported.report, signal);
                 unreported = undefined;
+                onLaunch?.(false);
             }
             const stamp = deps.policyStamp();
             if (!advertised || advertised.stamp !== stamp || deps.now() - advertised.at >= CAPABILITIES_REFRESH_MS) {
@@ -93,9 +94,11 @@ async function startLauncher({ auth, log, signal, deps: overrides }) {
                 else {
                     // Kept until delivered: a report lost to the network is sent before the next poll.
                     const io = launchIo(deps, auth, id, signal);
+                    onLaunch?.(true);
                     unreported = { id, report: launch ? await safeHandle(deps, launch, io, log) : { status: "REFUSED", reason: "BAD_REQUEST" } };
                     await deps.request(auth, "POST", `/api/device-api/launches/${encodeURIComponent(id)}/report`, unreported.report, signal);
                     unreported = undefined;
+                    onLaunch?.(false);
                 }
             }
             backoff = BACKOFF_MIN_MS;