baychat 0.30.0 → 0.32.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "displayName": "BayChat",
   "description": "Wakes this Claude Code session the moment a BayChat message arrives: no Monitor, no 30-minute deadline. Uses the baychat CLI already on this computer (npm install -g baychat, then baychat login).",
   "author": {

package/README.md

@@ -289,7 +289,7 @@ Read these as *how often you do it*, not as steps you repeat.
 ### In a plain shell
 
 ```bash
-npm i -g baychat            # install or upgrade — nothing updates itself
+npm i -g baychat            # install once — from 0.31.0 the relay keeps it current
 baychat login               # once per computer: the QR
 baychat connect             # list the apps it can configure
 baychat connect claude      # refresh Claude Code's skill (no QR, no re-pairing)
@@ -321,9 +321,42 @@ Cursor         no command — ask it: "join BayChat as Session-C"
 A group or Sessions join creates no private owner chat; one you already have stays
 under the same agent and session. Use `--private` for the private chat.
 
-### Upgrading, in order
+### Staying up to date
 
-Publishing a new version upgrades nobody by itself.
+From 0.31.0 **the relay updates BayChat by itself**, the way Claude Code does. About once a
+day it asks npm for the newest `baychat`; a patch or minor release is installed with the same
+command `baychat update` uses, in a quiet moment — never while an agent turn is being delivered,
+a session command is running, a session is being started from BayChat, or a card on your phone
+is waiting for an answer. Then the relay restarts onto the new code and your next `baychat`
+command says so in one line:
+
+```text
+BayChat updated itself to 0.31.1 (from 0.31.0).
+```
+
+A new major version, or a release marked as needing you, is not installed by itself: your phone
+gets a card, *"New BayChat for your computer (…): <reason> · Update now / Later"*. Only you can
+answer it. "Later" asks again in three days.
+
+If an install fails, the version you have keeps running and it tries again a day later.
+
+```bash
+baychat update --auto off   # switch automatic updates off for this computer
+baychat update --auto on    # and back on (the default)
+baychat doctor              # shows the state: on/off, last check, latest version
+```
+
+`BAYCHAT_AUTO_UPDATE=0` also switches them off, for CI and managed machines — but only for
+processes that see it; for the relay itself, use `baychat update --auto off`.
+
+Only a **global npm install** whose relay runs under systemd or launchd (what
+`baychat relay start` sets up on Linux and macOS) updates itself. On **Windows** the relay only
+tells you for now — install with `baychat update`. An `npx` copy, a project install, a relay
+started by hand with `--foreground`, or one running as root is also only told about new versions.
+
+### Upgrading by hand
+
+`baychat update` still does the whole update at once, any time.
 
 ```text
 $baychat --update     # in Codex

package/dist/approval-wait.js

@@ -15,6 +15,7 @@ exports.reasonOf = reasonOf;
 // hook that prints nothing ALLOWS, a PermissionDenied hook that prints nothing leaves the denial
 // standing. Each caller turns every outcome below into its own fail-closed answer.
 const api_1 = require("./api");
+const waiting_cards_1 = require("./waiting-cards");
 /** One HTTP hold. The server clamps to 30; asking for less than it allows leaves headroom for a
  *  proxy with its own idle timeout. */
 const POLL_WAIT_SECONDS = 25;
@@ -60,39 +61,14 @@ async function askOwnerAndWait(device, ask, deadlineMs, deps, label) {
         const requestId = typeof reply.requestId === "string" ? reply.requestId : "";
         if (!requestId)
             return { kind: "failed", reason: "BayChat did not return an approval id" };
-        // Wait. Re-arm across the bounded holds exactly as `await_approval` does.
-        let failures = 0;
-        for (;;) {
-            const status = typeof reply.status === "string" ? reply.status : "";
-            if (status === "answered") {
-                return {
-                    kind: "answered",
-                    requestId,
-                    index: typeof reply.answerIndex === "number" ? reply.answerIndex : null,
-                    answer: typeof reply.answer === "string" ? reply.answer : null,
-                };
-            }
-            if (status === "cancelled")
-                return { kind: "cancelled", requestId };
-            if (status !== "waiting")
-                return { kind: "unrecognised", requestId, status };
-            const remaining = deadlineMs - deps.now();
-            if (remaining <= 0)
-                return { kind: "deadline", requestId };
-            try {
-                reply = await (0, api_1.apiRequest)(device, "GET", `/api/device-api/approvals/${encodeURIComponent(requestId)}?wait=${holdSeconds(remaining)}`);
-                failures = 0;
-            }
-            catch (err) {
-                if (isDefinite(err))
-                    return { kind: "failed", reason: `BayChat refused the wait — ${reasonOf(err)}` };
-                failures += 1;
-                deps.log(`${label}: waiting failed (${reasonOf(err)}) — attempt ${failures}`);
-                if (failures >= MAX_CONSECUTIVE_POLL_FAILURES) {
-                    return { kind: "failed", reason: `BayChat became unreachable while waiting — ${reasonOf(err)}` };
-                }
-                await deps.sleep(POLL_RETRY_DELAY_MS);
-            }
+        // Wait. Re-arm across the bounded holds exactly as `await_approval` does. Marked while it
+        // waits, so the relay's automatic update never restarts BayChat under an open question.
+        const unmark = (0, waiting_cards_1.markWaitingCard)(requestId);
+        try {
+            return await waitForAnswer(device, requestId, reply, deadlineMs, deps, label);
+        }
+        finally {
+            unmark();
         }
     }
     catch (err) {
@@ -101,6 +77,43 @@ async function askOwnerAndWait(device, ask, deadlineMs, deps, label) {
         return { kind: "failed", reason: `waiting for BayChat failed unexpectedly — ${reasonOf(err)}` };
     }
 }
+/** Park on an existing card until it is answered, withdrawn, unreachable or past the deadline. */
+async function waitForAnswer(device, requestId, first, deadlineMs, deps, label) {
+    let reply = first;
+    let failures = 0;
+    for (;;) {
+        const status = typeof reply.status === "string" ? reply.status : "";
+        if (status === "answered") {
+            return {
+                kind: "answered",
+                requestId,
+                index: typeof reply.answerIndex === "number" ? reply.answerIndex : null,
+                answer: typeof reply.answer === "string" ? reply.answer : null,
+            };
+        }
+        if (status === "cancelled")
+            return { kind: "cancelled", requestId };
+        if (status !== "waiting")
+            return { kind: "unrecognised", requestId, status };
+        const remaining = deadlineMs - deps.now();
+        if (remaining <= 0)
+            return { kind: "deadline", requestId };
+        try {
+            reply = await (0, api_1.apiRequest)(device, "GET", `/api/device-api/approvals/${encodeURIComponent(requestId)}?wait=${holdSeconds(remaining)}`);
+            failures = 0;
+        }
+        catch (err) {
+            if (isDefinite(err))
+                return { kind: "failed", reason: `BayChat refused the wait — ${reasonOf(err)}` };
+            failures += 1;
+            deps.log(`${label}: waiting failed (${reasonOf(err)}) — attempt ${failures}`);
+            if (failures >= MAX_CONSECUTIVE_POLL_FAILURES) {
+                return { kind: "failed", reason: `BayChat became unreachable while waiting — ${reasonOf(err)}` };
+            }
+            await deps.sleep(POLL_RETRY_DELAY_MS);
+        }
+    }
+}
 /**
  * Take back a card nobody will act on any more (the waiting process is about to give up). Best
  * effort and NEVER THROWS: a card left pending is harmless — the answer would reach nobody — so

package/dist/approve-hook.js

@@ -40,6 +40,10 @@ exports.describeToolRequest = describeToolRequest;
 exports.composeQuestion = composeQuestion;
 exports.decideApproval = decideApproval;
 exports.sessionFromClaude = sessionFromClaude;
+exports.procStatFields = procStatFields;
+exports.procStartTicks = procStartTicks;
+exports.psParentOf = psParentOf;
+exports.psAgeMs = psAgeMs;
 exports.parseEtime = parseEtime;
 exports.decideApprovalOrDefer = decideApprovalOrDefer;
 exports.cmdApproveHook = cmdApproveHook;
@@ -93,6 +97,7 @@ exports.cmdApproveHook = cmdApproveHook;
 // exactly like a terminal prompt. Our deadline bounds only how long THIS PROCESS waits, and it
 // exists solely because the alternative (being killed by the handler timeout) would allow.
 const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
@@ -371,10 +376,39 @@ function psField(pid, field) {
     const out = String(r.stdout ?? "").trim();
     return out || undefined;
 }
+/**
+ * The fields of `/proc/<pid>/stat` (Linux only), numbered as proc(5) numbers them: `[1]` is the
+ * pid, `[4]` the parent, `[22]` the start time in clock ticks since boot. The command name
+ * (field 2) may itself hold spaces and parentheses, so the split starts after its LAST `)`.
+ * Undefined anywhere else, or when the process is gone.
+ */
+function procStatFields(pid, read = (f) => fs.readFileSync(f, "utf8")) {
+    if (process.platform !== "linux" || !Number.isInteger(pid) || pid <= 0)
+        return undefined;
+    try {
+        const text = read(`/proc/${pid}/stat`);
+        const close = text.lastIndexOf(")");
+        if (close < 0)
+            return undefined;
+        // Index 0 unused, 1 = pid, 2 = comm, then field 3 onwards from after the parenthesis.
+        return ["", String(pid), text.slice(text.indexOf("(") + 1, close), ...text.slice(close + 1).trim().split(/\s+/)];
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The process's start time as `/proc/<pid>/stat` field 22 (clock ticks since boot), Linux only. */
+function procStartTicks(pid) {
+    const start = procStatFields(pid)?.[22];
+    return start && /^\d+$/.test(start) ? start : undefined;
+}
+/** The parent of `pid`: `/proc` on Linux (no process spawned), `ps` elsewhere. */
 function psParentOf(pid) {
-    const n = Number(psField(pid, "ppid"));
+    const fromProc = Number(procStatFields(pid)?.[4]);
+    const n = Number.isInteger(fromProc) && fromProc > 0 ? fromProc : Number(psField(pid, "ppid"));
     return Number.isInteger(n) && n > 0 ? n : undefined;
 }
+/** How long `pid` has been running, from `ps -o etime` (whole seconds). */
 function psAgeMs(pid) {
     const etime = psField(pid, "etime");
     return etime ? parseEtime(etime) : undefined;

package/dist/auto-update/describe.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeAutoUpdate = describeAutoUpdate;
+exports.statusFromFiles = statusFromFiles;
+const self_upgrade_1 = require("../self-upgrade");
+const policy_1 = require("./policy");
+/**
+ * The automatic update in one line, for `relay status` and `baychat doctor`. One wording for both,
+ * so the two can never describe the same machine differently.
+ */
+function describeAutoUpdate(status, now) {
+    const checked = status.lastCheckAt ? `, checked ${ago(now - status.lastCheckAt)}` : ", not checked yet";
+    const latest = status.latest && (0, self_upgrade_1.compareVersions)(status.current, status.latest) === -1 ? `${status.latest} is out` : `${status.current} is the latest`;
+    switch (status.mode) {
+        case "off":
+            return `off (${status.reason}) — running ${status.current}`;
+        case "none":
+            return `not used here (${status.reason ?? "not an npm install"})`;
+        case "notify":
+            // The reason reads on from "notify only": "on Windows (install with `baychat update`)".
+            return `notify only ${status.reason} — ${status.latest ? latest : `running ${status.current}`}${checked}`;
+        case "auto": {
+            if (status.failure)
+                return `on — the last automatic install failed: ${status.failure}`;
+            const waiting = status.cardVersion
+                ? ` — ${status.cardVersion} is waiting for you on your phone`
+                : status.waitingFor
+                    ? ` — waiting: ${status.waitingFor}`
+                    : "";
+            return `on — ${latest}${checked}${waiting}`;
+        }
+    }
+}
+/**
+ * The status as the files say, for `doctor` (which runs whether or not a relay is up). The relay
+ * writes its mode into the state on every look; the person's switch and the environment are read
+ * fresh, because they may have changed since.
+ */
+function statusFromFiles(input) {
+    const { state, setting, env, current } = input;
+    const off = (0, policy_1.autoUpdateOffReason)(env, setting);
+    const base = {
+        current,
+        latest: state.latest,
+        lastCheckAt: state.lastCheckAt,
+        waitingFor: state.waitingFor,
+        cardVersion: state.card?.requestId ? state.card.version : undefined,
+        failure: state.failure?.reason,
+    };
+    if (off)
+        return { ...base, mode: "off", reason: off };
+    if (!state.mode)
+        return { ...base, mode: "none", reason: "the relay has not run a version with automatic updates yet" };
+    if (state.mode === "off")
+        return { ...base, mode: "none", reason: "just turned on; the relay picks it up within a minute" };
+    return { ...base, mode: state.mode, reason: state.modeReason };
+}
+function ago(ms) {
+    const minutes = Math.max(0, Math.round(ms / 60_000));
+    if (minutes < 60)
+        return `${minutes} min ago`;
+    const hours = Math.round(minutes / 60);
+    if (hours < 48)
+        return `${hours} h ago`;
+    return `${Math.round(hours / 24)} days ago`;
+}

package/dist/auto-update/notice.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printUpdateNotice = printUpdateNotice;
+const store_1 = require("./store");
+/**
+ * Show the relay's one line about updates ("BayChat updated itself to 0.31.1 (from 0.31.0).") on
+ * the next `baychat` command a PERSON runs — the way Claude Code says it updated.
+ *
+ * Only to a terminal: on stderr, and only when stderr is a TTY, so a hook's verdict, an MCP
+ * server's JSON-RPC, a status line or anything piped never carries it. Commands run by a client
+ * rather than typed are skipped outright, and so is `update` (it answers the notice itself). The
+ * notice is taken when shown, so it is shown once.
+ */
+const NOT_FOR_PEOPLE = new Set([
+    "mcp",
+    "channel",
+    "approve-hook",
+    "denied-hook",
+    "denied-after",
+    "context-statusline",
+    "context-hook",
+    "context-flush",
+    "skill",
+    "session-name",
+    "update",
+]);
+function printUpdateNotice(command, stream = process.stderr, take = store_1.takeUpdateNotice) {
+    if ((command !== undefined && NOT_FOR_PEOPLE.has(command)) || !stream.isTTY)
+        return;
+    let text;
+    try {
+        text = take();
+    }
+    catch {
+        // An unreadable notice is not worth failing the command the person actually asked for.
+        return;
+    }
+    if (text)
+        stream.write(`${text}\n`);
+}

package/dist/auto-update/policy.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELD_FRESH_MS = exports.QUIET_MS = exports.CARD_POLL_MS = exports.ASK_AGAIN_MS = exports.CHECK_INTERVAL_MS = exports.AUTO_UPDATE_ENV = void 0;
+exports.planUpdate = planUpdate;
+exports.autoUpdateOffReason = autoUpdateOffReason;
+exports.nextCheckAt = nextCheckAt;
+exports.installAllowedAt = installAllowedAt;
+exports.busyReason = busyReason;
+const self_upgrade_1 = require("../self-upgrade");
+/** Longest reason a card or terminal line carries when several releases each said something. */
+const REASON_MAX_CHARS = 300;
+function planUpdate(current, release) {
+    const order = (0, self_upgrade_1.compareVersions)(current, release.version);
+    // Already there, newer (a local build), or a version that does not parse (a dev build like
+    // 0.31.0-dev): never install over it.
+    if (order === undefined || order >= 0)
+        return { kind: "current" };
+    // Every release this machine would cross that asked for the person, newest first.
+    const crossed = Object.entries(release.attention)
+        .filter(([version]) => (0, self_upgrade_1.compareVersions)(version, current) === 1 && ((0, self_upgrade_1.compareVersions)(version, release.version) ?? 1) <= 0)
+        .sort(([a], [b]) => (0, self_upgrade_1.compareVersions)(b, a) ?? 0)
+        .map(([, reason]) => reason);
+    const major = (v) => Number(v.split(".")[0]);
+    if (major(release.version) > major(current))
+        crossed.push(`a new major version (${major(release.version)}.x)`);
+    if (crossed.length === 0)
+        return { kind: "auto", version: release.version };
+    return { kind: "ask", version: release.version, reason: clip(crossed.join("; "), REASON_MAX_CHARS) };
+}
+/** Environment values that switch automatic updates off (for CI and companies). */
+const ENV_OFF = new Set(["0", "off", "false", "no"]);
+exports.AUTO_UPDATE_ENV = "BAYCHAT_AUTO_UPDATE";
+/** Why automatic updates are off, or undefined when they are on. The environment wins. */
+function autoUpdateOffReason(env, setting) {
+    const raw = env[exports.AUTO_UPDATE_ENV];
+    if (raw !== undefined && ENV_OFF.has(raw.trim().toLowerCase()))
+        return `${exports.AUTO_UPDATE_ENV}=${raw.trim()}`;
+    if (setting === "off")
+        return "baychat update --auto off";
+    return undefined;
+}
+// ─── Timing ───────────────────────────────────────────────────────────────────────────────
+const MINUTE = 60_000;
+const HOUR = 60 * MINUTE;
+const DAY = 24 * HOUR;
+/** About once a day — invisible on the registry, and soon enough that nobody runs `update`. */
+exports.CHECK_INTERVAL_MS = DAY;
+/** Spread across an hour so a fleet of relays started together never asks npm together. */
+const CHECK_SPREAD_MS = HOUR;
+/** The first check after a start: soon, but not in the busy first minutes. */
+const FIRST_CHECK_MIN_MS = 5 * MINUTE;
+const FIRST_CHECK_SPREAD_MS = 10 * MINUTE;
+/** A check that failed (offline, npm down) is tried again sooner than a day, then backs off. */
+const CHECK_RETRY_MS = HOUR;
+/** A failed install of one version waits a day, then two, … up to a week. A newer version resets it. */
+const INSTALL_RETRY_MS = DAY;
+const INSTALL_RETRY_MAX_MS = 7 * DAY;
+/** "Later" on the card: asked again after this long. */
+exports.ASK_AGAIN_MS = 3 * DAY;
+/** How often a waiting card is looked at. A tap on "Update now" lands within this. */
+exports.CARD_POLL_MS = 5 * MINUTE;
+/** No message for this long before a restart: an agent woken just now is likely mid-turn. */
+exports.QUIET_MS = 10 * MINUTE;
+/** A held message younger than this is a session mid-turn; an older one is a session that died. */
+exports.HELD_FRESH_MS = 30 * MINUTE;
+/**
+ * When the next registry check is due. `random` is in [0, 1) and spreads relays apart; it is a
+ * parameter so a test can pin it.
+ */
+function nextCheckAt(timing, startedAt, random) {
+    const firstAfterStart = startedAt + FIRST_CHECK_MIN_MS + random * FIRST_CHECK_SPREAD_MS;
+    if (timing.lastCheckAt === undefined)
+        return firstAfterStart;
+    const failures = timing.checkFailures ?? 0;
+    const wait = failures > 0 ? Math.min(CHECK_RETRY_MS * 2 ** (failures - 1), exports.CHECK_INTERVAL_MS) : exports.CHECK_INTERVAL_MS + random * CHECK_SPREAD_MS;
+    return Math.max(timing.lastCheckAt + wait, firstAfterStart);
+}
+/** When installing `version` may be tried again after failing; 0 when nothing holds it back. */
+function installAllowedAt(failure, version) {
+    if (!failure || failure.version !== version || failure.count < 1)
+        return 0;
+    return failure.at + Math.min(INSTALL_RETRY_MS * 2 ** (failure.count - 1), INSTALL_RETRY_MAX_MS);
+}
+/**
+ * Why the relay must not restart now, or undefined when it may. Fail closed on everything the
+ * relay can see: a restart is never worth an interrupted turn, a lost session command, or a card
+ * whose answer would arrive at a relay that is not there.
+ */
+function busyReason({ activity, cardsWaiting, dependents, now }) {
+    if (activity.deliveries.length)
+        return `delivering to ${activity.deliveries.join(", ")}`;
+    if (activity.headless.length)
+        return `a headless turn is running for ${activity.headless.join(", ")}`;
+    if (activity.acp.length)
+        return `an agent turn is running for ${activity.acp.join(", ")}`;
+    if (activity.launching)
+        return "a session is being started from BayChat";
+    if (cardsWaiting > 0)
+        return `${cardsWaiting} card(s) on the phone are waiting for an answer`;
+    if (activity.heldAt.some((at) => now - Date.parse(at) < exports.HELD_FRESH_MS))
+        return "a session is mid-turn with messages waiting for it";
+    if (activity.lastActivityAt !== undefined && now - activity.lastActivityAt < exports.QUIET_MS)
+        return "messages arrived in the last 10 minutes";
+    if (dependents.length)
+        return `processes the relay started are still running (pid ${dependents.slice(0, 3).join(", ")})`;
+    return undefined;
+}
+function clip(text, max) {
+    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
+}

package/dist/auto-update/relay-glue.js

@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startRelayUpdater = startRelayUpdater;
+const api_1 = require("../api");
+const config_1 = require("../config");
+const self_restart_1 = require("../relay/self-restart");
+const session_reply_1 = require("../relay/session-reply");
+const self_upgrade_1 = require("../self-upgrade");
+const refresh_clients_1 = require("../refresh-clients");
+const waiting_cards_1 = require("../waiting-cards");
+const policy_1 = require("./policy");
+const store_1 = require("./store");
+const updater_1 = require("./updater");
+/**
+ * The automatic update wired to a real relay: npm, the disk, the device API for the card, and the
+ * init system for the restart. Everything that decides is in `updater.ts` and `policy.ts`; this
+ * file only connects it. Run by the SUPERVISING relay only — a per-Bay child restarts with it.
+ */
+function startRelayUpdater(opts) {
+    const supervisor = (0, self_restart_1.detectSupervisor)(self_restart_1.realSupervisorProbe);
+    const install = (0, self_upgrade_1.classifyInstall)((0, self_upgrade_1.currentEntry)());
+    const current = (0, self_upgrade_1.ownVersion)();
+    const deps = {
+        now: Date.now,
+        random: Math.random,
+        log: opts.log,
+        current,
+        ability: { install, supervised: supervisor !== undefined, root: process.getuid?.() === 0, platform: process.platform },
+        env: process.env,
+        setting: store_1.loadAutoSetting,
+        loadState: store_1.loadAutoUpdateState,
+        saveState: store_1.saveAutoUpdateState,
+        notify: store_1.writeUpdateNotice,
+        lookupLatest: () => (0, self_upgrade_1.lookupLatest)(self_upgrade_1.realNpm),
+        installVersion: (version) => installGlobal(install, version, current, opts.log),
+        busyReason: () => (0, policy_1.busyReason)({
+            activity: opts.daemon.activity(),
+            cardsWaiting: (0, waiting_cards_1.countWaitingCards)(),
+            dependents: supervisor === "systemd" ? (0, self_restart_1.processesEndedByRestart)(self_restart_1.realSupervisorProbe) : [],
+            now: Date.now(),
+        }),
+        restart: async () => restartUnder(supervisor, opts.shutdown),
+        refreshClients: async () => {
+            const device = (0, config_1.loadDeviceCredentials)();
+            if (device)
+                for (const line of (0, refresh_clients_1.refreshConnectedClients)(device, opts.log))
+                    opts.log(`auto-update: ${line}`);
+        },
+        cards: deviceCards(opts.daemon, opts.log),
+    };
+    const updater = new updater_1.AutoUpdater(deps);
+    updater.start();
+    return updater;
+}
+/**
+ * Install `version` over the running global copy, holding the install lock. If npm failed in a way
+ * that left something other than the running version on disk, put the running version back, so a
+ * relay that restarts later (a reboot) still starts working code.
+ */
+async function installGlobal(install, version, current, log) {
+    if (install.kind !== "global")
+        return { ok: false, reason: `a ${install.kind} copy is never updated automatically` };
+    const unlock = (0, store_1.acquireUpdateLock)();
+    if (!unlock)
+        return { ok: false, reason: "another update of baychat is running" };
+    try {
+        const deps = { npm: self_upgrade_1.realNpm, readVersion: self_upgrade_1.readPackageVersion, install };
+        const installed = await (0, self_upgrade_1.installRelease)(deps, version);
+        if (installed.ok || (0, self_upgrade_1.readPackageVersion)(install.packageRoot) === current)
+            return installed;
+        const restored = await (0, self_upgrade_1.installRelease)(deps, current);
+        log(`auto-update: ${restored.ok ? `put ${current} back on disk` : `could not put ${current} back (${restored.reason})`}`);
+        return installed;
+    }
+    finally {
+        unlock();
+    }
+}
+function restartUnder(supervisor, shutdown) {
+    // `mode` is never "auto" without a supervisor, so this is an invariant, not a branch.
+    if (!supervisor)
+        throw new Error("refusing to restart: no init system would start the relay again");
+    (0, self_restart_1.arrangeRestart)(supervisor);
+    shutdown();
+}
+/** The decision card, over the device API — the same endpoint the hooks use, owner-only answers. */
+function deviceCards(daemon, log) {
+    const device = () => {
+        const creds = (0, config_1.loadDeviceCredentials)();
+        if (!creds)
+            throw new Error("this computer is not signed in to BayChat");
+        return creds;
+    };
+    return {
+        async ask(question) {
+            const session = daemon.hostedLiveSessions()[0];
+            if (!session)
+                return undefined; // A card goes to the private chat with a session; none is live.
+            try {
+                const reply = await (0, api_1.apiRequest)(device(), "POST", "/api/device-api/approvals", {
+                    session,
+                    question,
+                    options: [...updater_1.UPDATE_OPTIONS],
+                    direct: true,
+                    wait: 1,
+                });
+                if (typeof reply.requestId !== "string" || !reply.requestId)
+                    return undefined;
+                return {
+                    requestId: reply.requestId,
+                    conversationId: typeof reply.conversationId === "string" ? reply.conversationId : undefined,
+                    session: typeof reply.sessionName === "string" ? reply.sessionName : session,
+                };
+            }
+            catch (err) {
+                log(`auto-update: could not put the update card up (${err instanceof Error ? err.message : String(err)})`);
+                return undefined;
+            }
+        },
+        async answer(requestId) {
+            try {
+                const reply = await (0, api_1.apiRequest)(device(), "GET", `/api/device-api/approvals/${encodeURIComponent(requestId)}?wait=1`);
+                if (reply.status === "waiting")
+                    return { kind: "waiting" };
+                if (reply.status === "answered")
+                    return { kind: reply.answerIndex === updater_1.UPDATE_NOW_INDEX ? "update" : "later" };
+                return { kind: "gone" };
+            }
+            catch (err) {
+                // The card no longer exists for us: gone. A blip: ask again on the next poll.
+                if (err instanceof api_1.ApiError && (err.status === 404 || err.status === 403))
+                    return { kind: "gone" };
+                return { kind: "waiting" };
+            }
+        },
+        async withdraw(requestId) {
+            await (0, api_1.apiRequest)(device(), "POST", `/api/device-api/approvals/${encodeURIComponent(requestId)}/withdraw`, {});
+        },
+        async say(conversationId, session, text) {
+            await (0, session_reply_1.postSessionReply)(device(), conversationId, session, text);
+        },
+    };
+}