baychat 0.30.0 → 0.31.0

package/dist/relay/self-restart.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realSupervisorProbe = exports.WINDOWS_SELF_UPDATE_ENABLED = void 0;
+exports.selfUpdateAllowedOn = selfUpdateAllowedOn;
+exports.detectSupervisor = detectSupervisor;
+exports.processesEndedByRestart = processesEndedByRestart;
+exports.arrangeRestart = arrangeRestart;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const autostart_1 = require("./autostart");
+/**
+ * ⚠️ WINDOWS SHIPS NOTIFY-ONLY. Enable after a verified restart on a real Windows machine.
+ *
+ * The Task Scheduler restart below (a detached helper running `schtasks /run` after the relay
+ * exits) has never been watched working: if Task Scheduler ends the helper together with the task,
+ * the relay stays down until the next logon — worse than running an old version. Until someone
+ * has seen it come back on Windows, a Windows relay only says a new version is out. The whole path
+ * stays in place; flipping this one constant turns it on.
+ */
+exports.WINDOWS_SELF_UPDATE_ENABLED = false;
+/** May a relay on `platform` install an update and restart itself? (Only the gate above says no.) */
+function selfUpdateAllowedOn(platform) {
+    return platform !== "win32" || exports.WINDOWS_SELF_UPDATE_ENABLED;
+}
+/** Which init system is supervising THIS process, or undefined when none will restart it. */
+function detectSupervisor(probe) {
+    if (probe.platform === "linux") {
+        // Our own cgroup names the unit we run in: exact, and nothing else can fake it for us.
+        const cgroup = probe.readFile("/proc/self/cgroup") ?? "";
+        return cgroup.split("\n").some((line) => line.trim().endsWith(`/${autostart_1.SYSTEMD_UNIT_NAME}`)) ? "systemd" : undefined;
+    }
+    if (probe.platform === "darwin")
+        return probe.env.XPC_SERVICE_NAME === autostart_1.SERVICE_LABEL ? "launchd" : undefined;
+    // Task Scheduler stamps nothing on the process it starts. But only one relay can hold the socket,
+    // and this one does: if the relay task is RUNNING, this is its relay (a second, task-started relay
+    // would have failed to bind and exited). `Get-ScheduledTask` names the state unlocalised.
+    if (probe.platform === "win32")
+        return probe.taskState() === "Running" ? "task-scheduler" : undefined;
+    return undefined;
+}
+exports.realSupervisorProbe = {
+    platform: process.platform,
+    env: process.env,
+    taskState() {
+        try {
+            // A constant command: the task's fixed name, no value from anywhere else.
+            return (0, child_process_1.execFileSync)("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", `(Get-ScheduledTask -TaskName '${autostart_1.SERVICE_LABEL}').State`], { encoding: "utf8", timeout: 20_000, windowsHide: true, stdio: ["ignore", "pipe", "ignore"] }).trim();
+        }
+        catch {
+            // No task, no PowerShell: not supervised as far as we can prove.
+            return undefined;
+        }
+    },
+    readFile(file) {
+        try {
+            return fs.readFileSync(file, "utf8");
+        }
+        catch {
+            // Not Linux, or no /proc: no cgroup to read.
+            return undefined;
+        }
+    },
+};
+/**
+ * Processes a restart would end with this relay: under systemd, every other process in the unit's
+ * cgroup (the default `KillMode=control-group` stops them all when the main process exits) — a tmux
+ * server the launcher started, an agent still running. The relay's own per-Bay child relays are not
+ * counted: they restart with it. Empty elsewhere (launchd and Task Scheduler leave detached
+ * processes alone) and wherever the cgroup cannot be read.
+ */
+function processesEndedByRestart(probe, selfPid = process.pid) {
+    const cgroup = probe.readFile("/proc/self/cgroup") ?? "";
+    // cgroup v2: "0::/user.slice/…/baychat-relay.service". v1 has no single path to read.
+    const unified = cgroup.split("\n").find((line) => line.startsWith("0::"));
+    if (!unified || !unified.trim().endsWith(`/${autostart_1.SYSTEMD_UNIT_NAME}`))
+        return [];
+    const procs = probe.readFile(`/sys/fs/cgroup${unified.slice(3).trim()}/cgroup.procs`) ?? "";
+    return procs
+        .split("\n")
+        .map((line) => Number(line.trim()))
+        .filter((pid) => Number.isInteger(pid) && pid > 1 && pid !== selfPid)
+        .filter((pid) => !isRelayProcess(probe.readFile(`/proc/${pid}/cmdline`)));
+}
+/** A `… relay start --foreground` process: one of this relay's per-Bay children. */
+function isRelayProcess(cmdline) {
+    const argv = (cmdline ?? "").split("\0");
+    const at = argv.indexOf("relay");
+    return at >= 0 && argv[at + 1] === "start" && argv.includes("--foreground");
+}
+/**
+ * Arrange for the supervisor to start the relay again once this process exits. The caller exits
+ * right after (gracefully: the daemon's own stop). Nothing to arrange for systemd and launchd.
+ */
+function arrangeRestart(supervisor) {
+    if (supervisor !== "task-scheduler")
+        return;
+    // A constant script and constant arguments (the task's fixed name, our pid): no shell, nothing
+    // from outside reaches it. Detached, so it outlives this process.
+    const helper = (0, child_process_1.spawn)(process.execPath, ["-e", WINDOWS_RESTART_HELPER, String(process.pid), autostart_1.SERVICE_LABEL], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+    });
+    helper.unref();
+}
+/** Wait (up to a minute) for the old relay to exit, then run the relay's scheduled task again. */
+const WINDOWS_RESTART_HELPER = `
+const pid = Number(process.argv[1]);
+const task = process.argv[2];
+const deadline = Date.now() + 60000;
+const gone = () => { try { process.kill(pid, 0); return false; } catch { return true; } };
+(function wait() {
+  if (!gone() && Date.now() < deadline) return setTimeout(wait, 500);
+  require("child_process").execFile("schtasks", ["/run", "/tn", task], { windowsHide: true }, () => undefined);
+})();
+`;

package/dist/relay/terminal-pane.js

@@ -37,6 +37,68 @@ function detectPane(env = process.env) {
 function expectedCommand(runtime) {
     return (0, profiles_1.profileFor)(runtime)?.bin ?? runtime;
 }
+/**
+ * A second file name a runtime's own binary runs under, and the path that proves it is that
+ * binary rather than something that happens to share the name.
+ *
+ * Claude Code's native installer (seen on macOS after its self-update, 2026-10-14) runs
+ * `…/claude-code/bin/claude.exe` behind a `claude` symlink, so tmux names the pane's program
+ * `claude.exe` and every session command was refused ("pane %8 is running claude.exe, not
+ * claude"). The NAME alone is never enough to type: the process must also be that build — its
+ * executable path, or its argv[0] being the `claude` symlink it was started through.
+ */
+const NATIVE_BUILDS = {
+    claude: { name: "claude.exe", path: /[\\/]claude-code[\\/]bin[\\/]claude\.exe$/ },
+};
+/** The last path segment: macOS `ps -o comm=` prints a full path, Linux a bare name. */
+function baseName(file) {
+    return file.split(/[\\/]/).pop() ?? file;
+}
+/** Is `name` (a pane's program, a process's comm) the runtime's native build's file name? */
+function isNativeBuildName(runtime, name) {
+    const build = NATIVE_BUILDS[runtime];
+    return !!build && baseName(name) === build.name;
+}
+/**
+ * Is `pid` the runtime's native build, proven by more than its name?
+ *
+ * Accepted when its executable path (`comm` on macOS) or its argv[0] is the build's path, or its
+ * argv[0] is the runtime's own command (`claude`, the symlink the build is started through). A
+ * process merely CALLED `claude.exe` and started as itself proves nothing and is refused.
+ */
+function isNativeBuildProcess(pid, runtime, run) {
+    const build = NATIVE_BUILDS[runtime];
+    if (!build || !Number.isInteger(pid) || pid <= 0)
+        return false;
+    try {
+        const comm = run("ps", ["-p", String(pid), "-o", "comm="]).trim();
+        if (baseName(comm) !== build.name)
+            return false;
+        const argv0 = run("ps", ["-p", String(pid), "-o", "args="]).trim().split(/\s+/)[0] ?? "";
+        return build.path.test(comm) || build.path.test(argv0) || baseName(argv0) === expectedCommand(runtime);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Is the pane's FOREGROUND process the runtime's native build? The foreground process group of
+ * the pane's terminal (`tpgid` of the pane's first process) is led by the program a keystroke
+ * reaches, and that leader is the process checked.
+ */
+function foregroundIsNativeBuild(panePid, runtime, run) {
+    const pid = Number(panePid);
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    let tpgid;
+    try {
+        tpgid = Number(run("ps", ["-o", "tpgid=", "-p", String(pid)]).trim());
+    }
+    catch {
+        return false;
+    }
+    return isNativeBuildProcess(tpgid, runtime, run);
+}
 /**
  * Is this pane still the session we recorded?
  *
@@ -81,7 +143,7 @@ function verifyPane(handle, runtime, run = (file, args) => (0, child_process_1.e
             "-p",
             "-t",
             handle.pane,
-            "#{pane_dead} #{pane_current_command} #{pane_tty}",
+            "#{pane_dead} #{pane_current_command} #{pane_tty} #{pane_pid}",
         ]).trim();
     }
     catch (err) {
@@ -90,10 +152,15 @@ function verifyPane(handle, runtime, run = (file, args) => (0, child_process_1.e
             reason: `tmux could not find pane ${handle.pane} any more (${errText(err)}).`,
         };
     }
-    const [dead, current, paneTty] = out.split(/\s+/);
+    const [dead, current, paneTty, panePid] = out.split(/\s+/);
     if (dead !== "0")
         return { ok: false, reason: `pane ${handle.pane} has exited.` };
     const want = expectedCommand(runtime);
+    // The runtime under its native build's file name (Claude Code's `claude.exe`): allowed only
+    // when the pane's foreground process proves to be that build — never on the name alone.
+    if (current !== want && current && isNativeBuildName(runtime, current) && foregroundIsNativeBuild(panePid, runtime, run)) {
+        return { ok: true };
+    }
     // A launcher that stayed the pane's foreground program: `baychat claude` or `baychat start`
     // run INSIDE tmux keeps `node` as the parent of the agent (Node cannot exec), so tmux names
     // `node`. Typing is still safe when the session's OWN recorded process is alive, is the
@@ -152,6 +219,11 @@ function runtimeStillRunning(pid, runtime, run) {
     // `comm` is truncated to 15 characters by the kernel, so compare on that basis rather
     // than demanding equality — "claude" and "codex" are short, but a longer runtime name
     // would otherwise never match itself.
+    if (isNativeBuildName(runtime, comm)) {
+        return isNativeBuildProcess(pid, runtime, run)
+            ? { ok: true }
+            : { ok: false, reason: `that process is ${comm}, but not ${want}'s own build — refusing to type into it.` };
+    }
     if (comm !== want && !want.startsWith(comm)) {
         return { ok: false, reason: `that process is ${comm}, not ${want} — refusing to type into it.` };
     }

package/dist/self-upgrade.js

@@ -33,11 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.RELEASE_VERSION = void 0;
 exports.resolveEntry = resolveEntry;
 exports.currentEntry = currentEntry;
 exports.classifyInstall = classifyInstall;
 exports.compareVersions = compareVersions;
 exports.upgradePackage = upgradePackage;
+exports.lookupLatest = lookupLatest;
+exports.installRelease = installRelease;
 exports.describeOutcome = describeOutcome;
 exports.realNpm = realNpm;
 exports.readPackageVersion = readPackageVersion;
@@ -100,8 +103,12 @@ function compareVersions(a, b) {
 }
 const VIEW_TIMEOUT_MS = 30_000;
 const INSTALL_TIMEOUT_MS = 180_000;
+/** A release version we will act on: plain `x.y.z`. Prereleases and anything else are refused. */
+exports.RELEASE_VERSION = /^\d+\.\d+\.\d+$/;
+/** A reason is shown on a card and in a terminal: one short line. */
+const ATTENTION_MAX_CHARS = 200;
 /** Upgrade the running package where it can be upgraded, and say exactly what happened. */
-function upgradePackage(deps) {
+async function upgradePackage(deps) {
     const { install, current } = deps;
     if (install.kind === "npx")
         return { outcome: "npx", current };
@@ -112,38 +119,89 @@ function upgradePackage(deps) {
     // Ask first, install only when there is something newer. Besides saving a slow npm run a
     // day, this is what lets a machine whose global folder needs sudo finish `baychat update`
     // after the one `sudo npm i -g` — otherwise every run would retry the write and fail.
-    const view = deps.npm(["view", "baychat", "version"], VIEW_TIMEOUT_MS);
-    const latest = view.stdout.trim();
-    if (view.error || view.status !== 0 || !/^\d+\.\d+\.\d+$/.test(latest)) {
-        return { outcome: "unchecked", current, reason: npmFailure(view) };
-    }
-    const order = compareVersions(current, latest);
+    const latest = await lookupLatest(deps.npm);
+    if (!latest.ok)
+        return { outcome: "unchecked", current, reason: latest.reason };
+    const order = compareVersions(current, latest.release.version);
     if (order === 0 || order === 1)
         return { outcome: "current", current };
-    // `--prefer-online`: `npm view` above always revalidates, but `install` trusts a cached
-    // packument for its max-age (~5 minutes). Straight after a publish — exactly when people run
-    // `update` — that cache can predate the version view just named, and install dies ETARGET.
-    const result = deps.npm(["install", "--global", "--prefer-online", "--prefix", install.prefix, `baychat@${latest}`], INSTALL_TIMEOUT_MS);
+    const installed = await installRelease({ ...deps, install }, latest.release.version);
+    if (!installed.ok)
+        return { outcome: "failed", current, reason: installed.reason };
+    return { outcome: "upgraded", from: current, to: installed.to, packageRoot: installed.packageRoot };
+}
+/**
+ * Ask the registry for the newest `baychat` — the ONLY source an update ever comes from. Nothing
+ * the BayChat server says can name a version, a package or a URL. The answer is validated here,
+ * at the trust boundary: a version that is not plain `x.y.z` is "could not check", and the
+ * attention notes keep only exact versions and one sanitised line each.
+ */
+async function lookupLatest(npm) {
+    const view = await npm(["view", "baychat@latest", "version", "baychat", "--json"], VIEW_TIMEOUT_MS);
+    if (view.error || view.status !== 0)
+        return { ok: false, reason: npmFailure(view) };
+    let parsed;
+    try {
+        parsed = JSON.parse(view.stdout);
+    }
+    catch {
+        return { ok: false, reason: "npm answered with something that is not JSON" };
+    }
+    // One field asked for and present → npm prints it bare; several → an object of them.
+    const fields = typeof parsed === "string" ? { version: parsed } : parsed;
+    const version = typeof fields?.version === "string" ? fields.version.trim() : "";
+    if (!exports.RELEASE_VERSION.test(version))
+        return { ok: false, reason: `npm named no release version (${JSON.stringify(version)})` };
+    return { ok: true, release: { version, attention: attentionNotes(fields?.baychat) } };
+}
+/**
+ * Install exactly `version` over the running global copy, in its own prefix, and believe only the
+ * disk. Touches nothing but `baychat` in that prefix. On failure nothing claims success; the
+ * caller decides what to tell people.
+ */
+async function installRelease(deps, version) {
+    if (!exports.RELEASE_VERSION.test(version))
+        return { ok: false, reason: `refusing to install ${JSON.stringify(version)}: not a release version` };
+    const { install } = deps;
+    // `--prefer-online`: `npm view` always revalidates, but `install` trusts a cached packument
+    // for its max-age (~5 minutes). Straight after a publish — exactly when people run `update` —
+    // that cache can predate the version view just named, and install dies ETARGET.
+    const result = await deps.npm(["install", "--global", "--prefer-online", "--prefix", install.prefix, `baychat@${version}`], INSTALL_TIMEOUT_MS);
     if (result.error || result.status !== 0) {
         const denied = /\b(EACCES|EPERM)\b/.test(`${result.stderr}\n${result.error?.message ?? ""}`);
         const reason = denied
-            ? `npm is not allowed to write to ${install.prefix}. Run \`${sudoHint(deps, install.prefix)}\` ` +
+            ? `npm is not allowed to write to ${install.prefix}. Run \`${await sudoHint(deps.npm, install.prefix)}\` ` +
                 "(or give npm a folder you own: https://docs.npmjs.com/resolving-eacces-permissions-errors-when-installing-packages-globally), " +
                 "then `baychat update` again."
             : npmFailure(result);
-        return { outcome: "failed", current, reason };
+        return { ok: false, reason };
     }
     // npm said yes. Believe the file on disk, not the exit code: this is the very step that
     // used to report success over an unchanged install.
     const onDisk = deps.readVersion(install.packageRoot);
-    if (onDisk !== latest) {
+    if (onDisk !== version) {
         return {
-            outcome: "failed",
-            current,
-            reason: `npm reported success, but ${install.packageRoot} holds ${onDisk ?? "no readable package.json"}, not ${latest}.`,
+            ok: false,
+            reason: `npm reported success, but ${install.packageRoot} holds ${onDisk ?? "no readable package.json"}, not ${version}.`,
         };
     }
-    return { outcome: "upgraded", from: current, to: onDisk, packageRoot: install.packageRoot };
+    return { ok: true, to: onDisk, packageRoot: install.packageRoot };
+}
+/** The attention notes a release carries, validated: exact versions only, one short plain line each. */
+function attentionNotes(raw) {
+    const notes = {};
+    const attention = raw && typeof raw === "object" ? raw.attention : undefined;
+    if (!attention || typeof attention !== "object" || Array.isArray(attention))
+        return notes;
+    for (const [version, reason] of Object.entries(attention)) {
+        if (!exports.RELEASE_VERSION.test(version) || typeof reason !== "string")
+            continue;
+        // eslint-disable-next-line no-control-regex
+        const line = reason.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim().slice(0, ATTENTION_MAX_CHARS);
+        if (line)
+            notes[version] = line;
+    }
+    return notes;
 }
 /** What a person reads for each outcome. `ok: false` means: do not claim this machine is updated. */
 function describeOutcome(o) {
@@ -176,9 +234,9 @@ function describeOutcome(o) {
             };
     }
 }
-function sudoHint(deps, prefix) {
+async function sudoHint(npm, prefix) {
     // Plain `sudo npm i -g` is only right when npm's own global prefix IS this install's.
-    const own = deps.npm(["prefix", "--global"], VIEW_TIMEOUT_MS);
+    const own = await npm(["prefix", "--global"], VIEW_TIMEOUT_MS);
     const ownPrefix = !own.error && own.status === 0 ? own.stdout.trim() : "";
     return ownPrefix && resolveEntry(ownPrefix) === resolveEntry(prefix)
         ? "sudo npm i -g baychat@latest"
@@ -191,18 +249,25 @@ function npmFailure(r) {
     const lines = r.stderr.split("\n").map((l) => l.trim()).filter(Boolean);
     return lines.slice(-3).join(" ") || `npm exited with ${r.status}`;
 }
-/** Run npm for real. Windows' npm is a `.cmd` shim, which Node will only start through a shell. */
+/** Run npm for real, without blocking the event loop (the relay keeps serving while npm runs).
+ *  Windows' npm is a `.cmd` shim, which Node will only start through a shell, so every argument
+ *  is first checked against what cmd.exe could misread and then quoted. */
 function realNpm(args, timeoutMs) {
     const windows = process.platform === "win32";
     if (windows && args.some((a) => commands_1.WINDOWS_UNSAFE.test(a))) {
-        return { status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") };
+        return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") });
     }
-    const r = (0, child_process_1.spawnSync)("npm", windows ? args.map(commands_1.quoteForCmd) : args, {
-        encoding: "utf8",
-        timeout: timeoutMs,
-        shell: windows,
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)("npm", windows ? args.map(commands_1.quoteForCmd) : args, { encoding: "utf8", timeout: timeoutMs, shell: windows, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (!err)
+                return resolve({ status: 0, stdout, stderr });
+            const code = err.code;
+            // A number is npm's own exit status; anything else (ENOENT, a timeout's kill) never ran it to the end.
+            if (typeof code === "number")
+                return resolve({ status: code, stdout, stderr });
+            resolve({ status: null, stdout: stdout ?? "", stderr: stderr ?? "", error: err });
+        });
     });
-    return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "", error: r.error };
 }
 function readPackageVersion(packageRoot) {
     try {

package/dist/start-command.js

@@ -43,6 +43,9 @@ const multiplexer_launch_1 = require("./multiplexer-launch");
 const profiles_1 = require("./relay/profiles");
 const runtime_binary_1 = require("./runtime-binary");
 const update_command_1 = require("./update-command");
+const policy_1 = require("./auto-update/policy");
+const store_1 = require("./auto-update/store");
+const commands_1 = require("./relay/commands");
 const launch_1 = require("./channel/launch");
 /**
  * `baychat start [name]` — the whole product in one command.
@@ -105,7 +108,11 @@ async function cmdStart(args) {
     // is swallowed: the agent starts anyway. An update is an improvement to a session, never
     // a precondition for one, and a person who cannot start their agent because a background
     // refresh failed would rightly never trust this command again.
-    if (!args.includes("--no-update") && (0, update_command_1.autoUpdateDue)()) {
+    //
+    // Since 0.31.0 the relay updates this computer by itself (docs/features/CLI_AUTO_UPDATE.md), in
+    // a quiet moment and without restarting under a running turn. When it says it does, `start`
+    // leaves updating to it; when the person switched automatic updates off, `start` honours that.
+    if (!args.includes("--no-update") && (0, update_command_1.autoUpdateDue)() && (await startShouldUpdate())) {
         try {
             await (0, update_command_1.cmdUpdate)({ quiet: true });
         }
@@ -140,6 +147,13 @@ async function cmdStart(args) {
     // A NAMED session: running `baychat start` again returns you to the agent already running.
     return (0, multiplexer_launch_1.launchAgent)({ binary: binary.path, args: agentArgs, env: channel?.env ?? {} }, { kind: "reattach", name: name || "baychat" });
 }
+/** Is the daily update `start`'s job here, rather than the relay's or nobody's? */
+async function startShouldUpdate() {
+    if ((0, policy_1.autoUpdateOffReason)(process.env, (0, store_1.loadAutoSetting)()))
+        return false;
+    const relay = await (0, commands_1.tryRelayStatus)();
+    return relay?.autoUpdate?.mode !== "auto";
+}
 /**
  * Which agent to start.
  *

package/dist/update-command.js

@@ -39,10 +39,10 @@ const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("./config");
-const credential_refresh_1 = require("./credential-refresh");
-const commands_1 = require("./commands");
-const client_paths_1 = require("./client-paths");
-const commands_2 = require("./relay/commands");
+const refresh_clients_1 = require("./refresh-clients");
+const commands_1 = require("./relay/commands");
+const policy_1 = require("./auto-update/policy");
+const store_1 = require("./auto-update/store");
 const self_upgrade_1 = require("./self-upgrade");
 /**
  * `baychat update` — bring this whole machine onto the current version, in one word.
@@ -76,6 +76,8 @@ const self_upgrade_1 = require("./self-upgrade");
 const AUTO_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
 const STAMP_FILE = "last-update-check.json";
 async function cmdUpdate(opts = {}) {
+    if (opts.auto !== undefined)
+        return setAutoUpdate(opts.auto);
     const say = (line) => {
         if (!opts.quiet)
             console.log(line);
@@ -93,12 +95,24 @@ async function cmdUpdate(opts = {}) {
         done.push(`upgraded baychat ${upgradedFrom} → ${(0, self_upgrade_1.ownVersion)()}`);
     }
     else {
-        const outcome = (0, self_upgrade_1.upgradePackage)({
-            install: (0, self_upgrade_1.classifyInstall)((0, self_upgrade_1.currentEntry)()),
-            current: (0, self_upgrade_1.ownVersion)(),
-            npm: self_upgrade_1.realNpm,
-            readVersion: self_upgrade_1.readPackageVersion,
-        });
+        // One npm install over this baychat at a time: the relay may be installing one by itself.
+        const unlock = (0, store_1.acquireUpdateLock)();
+        if (!unlock) {
+            console.error("BayChat is updating itself right now (the relay is installing a new version). Try again in a minute.");
+            return 1;
+        }
+        let outcome;
+        try {
+            outcome = await (0, self_upgrade_1.upgradePackage)({
+                install: (0, self_upgrade_1.classifyInstall)((0, self_upgrade_1.currentEntry)()),
+                current: (0, self_upgrade_1.ownVersion)(),
+                npm: self_upgrade_1.realNpm,
+                readVersion: self_upgrade_1.readPackageVersion,
+            });
+        }
+        finally {
+            unlock();
+        }
         const told = (0, self_upgrade_1.describeOutcome)(outcome);
         if (!told.ok) {
             // Never "Updated this machine" over a package that did not move. Stop before the relay
@@ -122,33 +136,22 @@ async function cmdUpdate(opts = {}) {
         if (told.done)
             done.push(told.done);
     }
-    // 2. EVERY CONNECTED CLIENT's copy of the credential and endpoint.
-    try {
-        const updated = (0, credential_refresh_1.refreshExistingClientConfigs)({ url: `${device.baseUrl}/api/mcp`, token: device.token }, commands_1.realConfigIo, (0, client_paths_1.currentPathEnv)());
-        for (const file of updated)
-            done.push(`refreshed ${file}`);
-    }
-    catch (err) {
-        // Never fatal: the next steps are independent, and a machine that failed one of four
-        // is better off doing the other three than stopping at the first.
-        say(`  Could not refresh client configs: ${errText(err)}`);
-    }
-    // 3. CLAUDE CODE, which is not an MCP-config client and registers through its own CLI.
-    if (hasBinary("claude") && (0, commands_1.registerWithClaude)(device.baseUrl, device.token)) {
-        done.push("re-registered BayChat with Claude Code");
-    }
+    // 2 + 3. EVERY CONNECTED CLIENT, and Claude Code.
+    done.push(...(0, refresh_clients_1.refreshConnectedClients)(device, say));
     // 4. THE RELAY — the step people forget, and the one that silently keeps old code
     //    running. Stopped and started rather than signalled: the daemon loads its code at
     //    process start, so nothing short of a restart picks up a new version.
     try {
-        await (0, commands_2.cmdRelayStop)();
+        await (0, commands_1.cmdRelayStop)();
     }
     catch {
         // Not running is the normal case on a fresh boot, and is not a failure to report.
     }
-    const relay = await (0, commands_2.ensureRelayInstalled)();
+    const relay = await (0, commands_1.ensureRelayInstalled)();
     done.push(relay.startsWith("Relay:") ? relay.toLowerCase() : relay);
     writeStamp();
+    // Whatever the relay left for the terminal ("x is available", "updated itself") is answered now.
+    (0, store_1.takeUpdateNotice)();
     if (done.length === 0) {
         say("Everything was already up to date.");
         return 0;
@@ -164,6 +167,27 @@ async function cmdUpdate(opts = {}) {
         console.log(`  ✓ ${line}`);
     return 0;
 }
+/**
+ * `baychat update --auto on|off` — the relay's automatic updates for this computer (default on).
+ * Read by the relay on its next look, within a minute; nothing needs restarting.
+ */
+function setAutoUpdate(value) {
+    if (value !== "on" && value !== "off") {
+        console.error("Usage: baychat update --auto on|off");
+        return 1;
+    }
+    (0, store_1.saveAutoSetting)(value);
+    const envOff = (0, policy_1.autoUpdateOffReason)(process.env, "on");
+    if (value === "off") {
+        console.log("Automatic updates are off on this computer. Update with `baychat update` when you choose; `baychat update --auto on` turns them back on.");
+    }
+    else {
+        console.log("Automatic updates are on: the relay installs new BayChat versions by itself in a quiet moment, and asks on your phone first when a version needs you.");
+        if (envOff)
+            console.log(`Note: ${envOff} is set here, which keeps them off for anything started from this shell.`);
+    }
+    return 0;
+}
 /**
  * Has it been long enough for `start` to check again?
  *
@@ -217,10 +241,6 @@ function runOnNewCode(packageRoot, from, quiet) {
     }
     return child.status ?? 1;
 }
-function hasBinary(name) {
-    const probe = (0, child_process_1.spawnSync)(name, ["--version"], { stdio: "ignore", timeout: 15_000 });
-    return !probe.error && probe.status === 0;
-}
 function errText(err) {
     return err instanceof Error ? err.message : String(err);
 }