baychat 0.30.0 → 0.32.0

package/dist/denied/transcript.js

@@ -33,34 +33,59 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.CONFIRM_WAIT_MS = exports.TRANSCRIPT_WAIT_MS = void 0;
+exports.claudeConfigDir = claudeConfigDir;
+exports.transcriptFileOf = transcriptFileOf;
 exports.verifyDeniedCall = verifyDeniedCall;
 exports.findToolUse = findToolUse;
 // Proof that a denial really happened: the denied call must be in the session's own transcript.
 //
 // WHY. `baychat denied-hook` reads its event from stdin, and stdin is something anybody can
 // write — including the agent, by running `echo '{…}' | baychat denied-hook` itself. A forged
-// event would put a card on the owner's phone claiming a block that never occurred. So before
-// anything is posted, the call the event names (`tool_use_id`, `tool_name`, and the command or
-// target) must appear as a tool call the MODEL made, in the transcript Claude Code keeps under
-// `~/.claude/projects/` — a protected path the agent cannot write without a prompt.
+// event would put a card on the owner's phone claiming a block that never occurred. So the call
+// the event names (`tool_use_id`, `tool_name`, and the command or target) must appear as a tool
+// call the MODEL made, in the transcript Claude Code keeps under `~/.claude/projects/` — a
+// protected path the agent cannot write without a prompt. Before the card when it is already
+// there; otherwise after the owner's yes, which is then taken back when it never appears.
 //
 // It is defence in depth, not the boundary: the owner's answer is. A card the agent somehow did
 // cause still writes nothing unless the owner taps a yes.
 //
-// THE TRANSCRIPT CAN LAG. The hooks reference says it "is written asynchronously and may lag the
-// in-memory conversation", so a missing call is polled for, briefly, before it counts as absent.
+// THE CALL IS NOT THERE YET WHILE THE HOOK RUNS. Measured on Claude Code 2.1.299 (2026-10-14, a
+// file watcher on the transcript): the assistant line holding the denied `tool_use` — and the
+// denial's result — reach the file only AFTER the PermissionDenied hook returns. The hook gave up
+// at 15:32:46.742Z after waiting 45 s; the line landed at 15:32:47.029Z. Same for an MCP call. So
+// waiting longer can never prove a denial up front. The hook now looks only briefly
+// (TRANSCRIPT_WAIT_MS, for a Claude Code that does write first), and an absent call is proven the
+// other way — the event came from the live Claude Code of that very session (live-session.ts) —
+// and checked here AFTERWARDS, by `baychat permissions confirm` (confirm.ts, CONFIRM_WAIT_MS),
+// which takes the rule back out when the call never shows up.
+//
 // For a subagent's call the hook still gets the MAIN transcript (with `agent_id`); its calls are
 // in `<session>/subagents/agent-<id>.jsonl` beside it.
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const permission_rule_1 = require("./permission-rule");
-/** How long a call may take to reach the transcript before it counts as never made. */
-exports.TRANSCRIPT_WAIT_MS = 10_000;
+/** The hook's own look at the transcript: brief, because Claude Code 2.1.299 writes the denied call
+ *  only after the hook returns (above), so this succeeds only on a Claude Code that writes first. */
+exports.TRANSCRIPT_WAIT_MS = 2_000;
+/** How long the deferred confirmation (`baychat permissions confirm`) waits for the call to reach
+ *  the transcript after the owner's yes. Measured: well under a second after the hook returns. */
+exports.CONFIRM_WAIT_MS = 90_000;
 const TRANSCRIPT_POLL_MS = 250;
 /** Only the end of the file is read: the denied call is the newest thing in it. */
 const TAIL_BYTES = 4 * 1024 * 1024;
+/** Claude Code's config directory: `$CLAUDE_CONFIG_DIR`, else `~/.claude`. */
+function claudeConfigDir(claudeDir) {
+    return claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude");
+}
+/** The file a call is written to: the main transcript, or a subagent's own beside it. */
+function transcriptFileOf(transcriptPath, agentId) {
+    return agentId
+        ? path.join(transcriptPath.slice(0, -".jsonl".length), "subagents", `${agentId.startsWith("agent-") ? agentId : `agent-${agentId}`}.jsonl`)
+        : transcriptPath;
+}
 /** Did the model really make this call in this session? NEVER THROWS. */
 async function verifyDeniedCall(ref, deps = {}) {
     const now = deps.now ?? Date.now;
@@ -68,17 +93,15 @@ async function verifyDeniedCall(ref, deps = {}) {
     const realpath = deps.realpath ?? ((f) => fs.realpathSync(f));
     const readTail = deps.readTail ?? readFileTail;
     try {
-        const projects = realpath(path.join(deps.claudeDir ?? process.env.CLAUDE_CONFIG_DIR ?? path.join(os.homedir(), ".claude"), "projects"));
-        const wanted = (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
+        const projects = realpath(path.join(claudeConfigDir(deps.claudeDir), "projects"));
+        const wanted = ref.call ?? (0, permission_rule_1.callKeyOf)(ref.toolName, ref.toolInput);
         if (!ref.toolUseId || !wanted)
             return { ok: false, why: "the event names no call that can be checked" };
         if (!path.isAbsolute(ref.transcriptPath) || !ref.transcriptPath.endsWith(".jsonl")) {
             return { ok: false, why: "the event carries no transcript" };
         }
-        const file = ref.agentId
-            ? path.join(ref.transcriptPath.slice(0, -".jsonl".length), "subagents", `${ref.agentId.startsWith("agent-") ? ref.agentId : `agent-${ref.agentId}`}.jsonl`)
-            : ref.transcriptPath;
-        const giveUpAt = now() + exports.TRANSCRIPT_WAIT_MS;
+        const file = transcriptFileOf(ref.transcriptPath, ref.agentId);
+        const giveUpAt = now() + (deps.waitMs ?? exports.TRANSCRIPT_WAIT_MS);
         for (;;) {
             let real;
             try {
@@ -99,7 +122,7 @@ async function verifyDeniedCall(ref, deps = {}) {
                     : { ok: false, why: "the transcript's call is not the one the event names" };
             }
             if (now() >= giveUpAt)
-                return { ok: false, why: "the call is not in the session's transcript" };
+                return { ok: false, why: "the call is not in the session's transcript", absent: true };
             await sleep(TRANSCRIPT_POLL_MS);
         }
     }

package/dist/denied-hook.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RELOAD_SETTLE_MS = void 0;
+exports.RELOAD_SETTLE_MS = exports.deniedHookLogPath = void 0;
 exports.retryOutput = retryOutput;
 exports.composeDeniedQuestion = composeDeniedQuestion;
 exports.offeredMeanings = offeredMeanings;
@@ -62,9 +62,17 @@ exports.cmdDeniedHook = cmdDeniedHook;
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 //
 // Unlike approve-hook, silence is safe: no output leaves the denial standing. Every abnormal path
-// — no credential, no transcript proof, BayChat unreachable, an unanswered card, a settings file
-// we cannot parse, an exception — prints nothing and writes no rule. A rule is written only after
-// the card's owner tapped a yes, and `retry` is printed only after the rule was written.
+// — no credential, no proof, BayChat unreachable, an unanswered card, a settings file we cannot
+// parse, an exception — prints nothing and writes no rule. A rule is written only after the card's
+// owner tapped a yes, and `retry` is printed only after the rule was written.
+//
+// PROOF, IN TWO HALVES. Claude Code 2.1.299 writes the denied call to the transcript only after
+// this hook returns (measured; denied/transcript.ts), so the transcript is looked at only briefly.
+// Found → proven. Found as a DIFFERENT call → refused. Not there yet → the event must come from
+// the live Claude Code of the session it names (denied/live-session.ts), and a yes is recorded as
+// UNCONFIRMED and checked against the transcript afterwards by a detached
+// `baychat permissions confirm` (denied/confirm.ts), which takes the rule back out — and tells the
+// owner — when the call never shows up.
 //
 // THE PROCESS BLOCKS THE SESSION WHILE IT WAITS, like approve-hook: hooks are awaited, so the
 // session stops until the owner answers or our deadline passes. That is the reliable shape: the
@@ -80,10 +88,16 @@ const approve_hook_1 = require("./approve-hook");
 const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
+const confirm_1 = require("./denied/confirm");
 const grants_1 = require("./denied/grants");
+const hook_log_1 = require("./denied/hook-log");
+const live_session_1 = require("./denied/live-session");
+const notice_1 = require("./denied/notice");
 const permission_rule_1 = require("./denied/permission-rule");
 const settings_rules_1 = require("./denied/settings-rules");
 const transcript_1 = require("./denied/transcript");
+var hook_log_2 = require("./denied/hook-log");
+Object.defineProperty(exports, "deniedHookLogPath", { enumerable: true, get: function () { return hook_log_2.deniedHookLogPath; } });
 function retryOutput() {
     return { hookSpecificOutput: { hookEventName: "PermissionDenied", retry: true } };
 }
@@ -94,8 +108,6 @@ const LABEL = {
     always: "Always allow this exact command",
     no: "No",
 };
-/** The single button of a card that only informs: nothing can be allowed from BayChat. */
-const NOTICE_OPTIONS = ["OK"];
 /** The card's own limits (apps/api/src/lib/cards.ts), used only to TRIM. */
 const QUESTION_MAX = 2000;
 const SHOWN_MAX = 900;
@@ -117,11 +129,21 @@ function isNoVerdict(reason) {
 /** The card's question. A person decides from this text alone, on a lock screen. */
 function composeDeniedQuestion(q) {
     const shown = q.plan.shown.length <= SHOWN_MAX ? q.plan.shown : `${q.plan.shown.slice(0, SHOWN_MAX - 1)}…`;
+    const one = q.plan.onceRules.length === 1;
+    const user = q.target.scope === "user";
+    // The user scope reaches every project on this computer, so the card says where the rule goes
+    // and why — never only a path the person has to decode on a lock screen.
+    const where = user ? `your user settings (${tildePath(q.target.file)})` : q.target.file;
     const offers = q.plan.onceRules.length
         ? [
-            `Allow once: BayChat adds ${q.plan.onceRules.length === 1 ? "this exact rule" : "these exact rules"} to ` +
-                `${q.settingsFile} for the retry, then takes ${q.plan.onceRules.length === 1 ? "it" : "them"} out.`,
-            q.plan.alwaysAllowed ? "Always: BayChat keeps the rule there (`baychat permissions list` shows it)." : "",
+            `Allow once: BayChat adds ${one ? "this exact rule" : "these exact rules"} to ${where} for the retry, ` +
+                `then takes ${one ? "it" : "them"} out${user ? " — the project folder isn't writable for you" : ""}.`,
+            q.plan.alwaysAllowed
+                ? user
+                    ? "Always: BayChat keeps the rule in your user settings, so it applies to every project on this computer " +
+                        "(`baychat permissions list` shows it)."
+                    : "Always: BayChat keeps the rule there, for this project (`baychat permissions list` shows it)."
+                : "",
         ]
         : [];
     const lines = [
@@ -138,6 +160,11 @@ function composeDeniedQuestion(q) {
     const text = lines.filter((l) => l !== undefined).join("\n").replace(/\n{3,}/g, "\n\n").trim();
     return text.length <= QUESTION_MAX ? text : `${text.slice(0, QUESTION_MAX - 1)}…`;
 }
+/** `/home/k/.claude/settings.json` → `~/.claude/settings.json`. */
+function tildePath(file) {
+    const home = os.homedir();
+    return file === home || file.startsWith(home + path.sep) ? `~${file.slice(home.length)}` : file;
+}
 /** The buttons for a plan: every option it allows, and always a way to say no. */
 function offeredMeanings(plan) {
     if (plan.onceRules.length === 0)
@@ -205,23 +232,44 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
             return null;
         }
+        // Every run takes back what is overdue first, so a stale grant never covers this call.
+        try {
+            await (deps.sweepGrants ?? defaultSweepGrants)(device);
+        }
+        catch (err) {
+            log(`${LOG_LABEL}: the grants sweep failed (${(0, approval_wait_1.reasonOf)(err)}).`);
+        }
         // Only a call the model really made may put a card on anybody's phone.
-        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({
-            transcriptPath: str(input.transcript_path),
-            agentId: str(input.agent_id) || undefined,
-            toolUseId: str(input.tool_use_id),
-            toolName,
-            toolInput: input.tool_input,
-        });
-        if (!proof.ok) {
-            log(`${LOG_LABEL}: ${proof.why}; no card was posted and the denial stands.`);
+        const transcriptPath = str(input.transcript_path);
+        const agentId = str(input.agent_id) || undefined;
+        const toolUseId = str(input.tool_use_id);
+        const proofStarted = now();
+        const proof = await (deps.verify ?? transcript_1.verifyDeniedCall)({ transcriptPath, agentId, toolUseId, toolName, toolInput: input.tool_input });
+        // Set when the call is accepted before it is in the transcript: a yes is then confirmed later.
+        let unconfirmed;
+        if (proof.ok) {
+            log(`${LOG_LABEL}: proven — the call is in the transcript (after ${now() - proofStarted} ms).`);
+        }
+        else if (!proof.absent || !toolUseId || !call) {
+            log(`${LOG_LABEL}: refused — ${proof.why} (after ${now() - proofStarted} ms); no card was posted and the denial stands.`);
             return null;
         }
+        else {
+            const live = (deps.liveSession ?? live_session_1.proveLiveSession)({ sessionId: claudeSessionId, transcriptPath, agentId });
+            if (!live.ok) {
+                log(`${LOG_LABEL}: refused — the call is not in the transcript yet (after ${now() - proofStarted} ms) and ` +
+                    `the event is not from this session's live Claude Code: ${live.why}; no card was posted and the denial stands.`);
+                return null;
+            }
+            log(`${LOG_LABEL}: accepted — the call is not in the transcript yet (after ${now() - proofStarted} ms), and the ` +
+                `event comes from this session's live Claude Code (pid ${live.pid}); a yes is confirmed against the transcript afterwards.`);
+            unconfirmed = { transcriptPath, ...(agentId ? { agentId } : {}), toolUseId, toolName };
+        }
         const host = (deps.hostname ?? os.hostname)();
         const who = session ? `Session "${session}"` : "A Claude Code session";
         const waitDeps = { now, sleep, log };
         // A card that only informs: posted, never waited on (its deadline is already now).
-        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
+        const notify = (question) => (0, approval_wait_1.askOwnerAndWait)(device, { session, question, options: notice_1.NOTICE_OPTIONS }, now(), waitDeps, LOG_LABEL);
         // ── Already allowed, and denied again: the reload race, or a rule that does not match.
         const covering = call ? (0, grants_1.coveringGrant)(claudeSessionId, call, now()) : undefined;
         if (covering) {
@@ -242,9 +290,28 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             log(`${LOG_LABEL}: no project directory to keep a rule in; the denial stands.`);
             return null;
         }
-        const settingsFile = (deps.settingsFileFor ?? settings_rules_1.localSettingsFile)(projectDir);
-        const plan = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
-        const question = composeDeniedQuestion({ who, host, plan, reason, cwd: str(input.cwd), settingsFile });
+        // Decided BEFORE the card: an Allow button for a file this user cannot write can only fail.
+        const choice = (deps.settingsChoiceFor ?? settings_rules_1.chooseSettingsFile)(projectDir);
+        const planned = (0, permission_rule_1.planDeniedCall)(toolName, input.tool_input);
+        const plan = choice.scope === "none" && planned.onceRules.length > 0
+            ? {
+                ...planned,
+                onceRules: [],
+                alwaysAllowed: false,
+                limitation: `BayChat can't allow it from here: ${choice.why}, so no rule can be saved. ` +
+                    "Approve it at the computer (/permissions → Recently denied).",
+            }
+            : planned;
+        const target = choice.scope === "none" ? undefined : choice;
+        const question = composeDeniedQuestion({
+            who,
+            host,
+            plan,
+            reason,
+            cwd: str(input.cwd),
+            // Any target will do for a card that offers nothing: no write line is drawn.
+            target: target ?? { scope: "project", file: "" },
+        });
         const meanings = offeredMeanings(plan);
         if (meanings.length === 0) {
             // Nothing can be allowed from BayChat; the owner still learns why the session stopped.
@@ -268,18 +335,20 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             return null;
         }
         const meaning = (outcome.index !== null ? meanings[outcome.index] : undefined) ?? "no";
-        if (meaning === "no" || !plan.call)
+        if (meaning === "no" || !plan.call || !target)
             return null;
         let grant;
         try {
             grant = await (0, grants_1.grantRules)({
                 kind: meaning,
                 rules: plan.onceRules,
-                settingsFile,
+                settingsFile: target.file,
+                scope: target.scope,
                 call: plan.call,
                 shown: plan.shown,
                 claudeSessionId,
                 session,
+                ...(unconfirmed ? { unconfirmed } : {}),
             }, now());
         }
         catch (err) {
@@ -290,6 +359,11 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
         if (grant.kind === "once" && grant.expiresAt) {
             (deps.scheduleSweep ?? scheduleSweep)(Date.parse(grant.expiresAt));
         }
+        if (grant.unconfirmed) {
+            // Started before `retry`, so it holds the grant before the retried call can use it up.
+            (deps.scheduleConfirm ?? scheduleConfirm)(grant.id);
+            log(`${LOG_LABEL}: grant ${grant.id} (${grant.kind}) is unconfirmed; its confirmation was started.`);
+        }
         await sleep(exports.RELOAD_SETTLE_MS);
         return retryOutput();
     }
@@ -304,26 +378,54 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
  * after-hook and every later hook run sweep too.
  */
 function scheduleSweep(atMs) {
+    spawnDetached(["permissions", "sweep", "--at", String(atMs)], "schedule the once-rule's removal");
+}
+/**
+ * Start `baychat permissions confirm --grant <id>` detached: it waits for the denied call to reach
+ * the transcript and takes the grant back when it does not (denied/confirm.ts). Best effort: a
+ * confirmation that never runs is caught as a stale unconfirmed grant by every later hook run.
+ */
+function scheduleConfirm(grantId) {
+    spawnDetached(["permissions", "confirm", "--grant", grantId], "start the grant's confirmation");
+}
+function spawnDetached(args, what) {
     try {
         const entry = fs.realpathSync(process.argv[1] ?? "");
-        const child = (0, child_process_1.spawn)(process.execPath, [entry, "permissions", "sweep", "--at", String(atMs)], {
-            detached: true,
-            stdio: "ignore",
-        });
+        const child = (0, child_process_1.spawn)(process.execPath, [entry, ...args], { detached: true, stdio: "ignore" });
         child.unref();
     }
     catch (err) {
-        process.stderr.write(`${LOG_LABEL}: could not schedule the once-rule's removal (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+        process.stderr.write(`${LOG_LABEL}: could not ${what} (${(0, approval_wait_1.reasonOf)(err)}).\n`);
+        (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: could not ${what} (${(0, approval_wait_1.reasonOf)(err)}).`);
     }
 }
+async function defaultSweepGrants(device) {
+    await (0, grants_1.sweepExpiredGrants)();
+    await (0, confirm_1.takeBackStaleUnconfirmed)({ loadDevice: () => device, log: hook_log_1.logBoth });
+}
 /**
  * `baychat denied-hook [--session <name> | --session-from-claude] [--timeout <seconds>]`
  *
  * Always returns 0 (Claude Code ignores this event's exit code). Prints `retry` or nothing.
  */
 async function cmdDeniedHook(argv = [], stdin = process.stdin) {
-    const output = await decideDenied(await (0, hook_stdin_1.readStdin)(stdin), argv);
+    const raw = await (0, hook_stdin_1.readStdin)(stdin);
+    const log = hook_log_1.logBoth;
+    (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: called (${eventSummary(raw)})`);
+    const output = await decideDenied(raw, argv, { log });
+    (0, hook_log_1.appendHookLog)(`${LOG_LABEL}: ${output ? "retry" : "no retry"}`);
     if (output)
         process.stdout.write(`${JSON.stringify(output)}\n`);
     return 0;
 }
+// ─── The hook's own log (denied/hook-log.ts) ──────────────────────────────────
+/** Event name, tool, session id and which fields came — never the tool input itself. */
+function eventSummary(raw) {
+    try {
+        const e = JSON.parse(raw);
+        return `event=${String(e.hook_event_name)} tool=${String(e.tool_name)} session=${String(e.session_id)} call=${String(e.tool_use_id)} keys=${Object.keys(e).join(",")}`;
+    }
+    catch {
+        return `unreadable stdin, ${raw.length} bytes`;
+    }
+}

package/dist/doctor-command.js

@@ -55,6 +55,9 @@ const credential_refresh_1 = require("./credential-refresh");
 const client_paths_1 = require("./client-paths");
 const runtime_binary_1 = require("./runtime-binary");
 const ws_1 = require("./relay/ws");
+const describe_1 = require("./auto-update/describe");
+const store_1 = require("./auto-update/store");
+const self_upgrade_1 = require("./self-upgrade");
 /** How long `claude mcp list` may take before we treat it as unanswerable. */
 const MCP_LIST_TIMEOUT_MS = 15_000;
 /**
@@ -88,6 +91,7 @@ async function currentDoctorEnv() {
             bayRelayAlive[bay.bayId] = await (0, socket_1.probeSocket)((0, bay_relays_1.bayRelayScope)(bay.bayId, (0, config_1.configDir)(), (0, socket_1.socketPath)()).socket);
         }
     }
+    const relay = await (0, commands_1.tryRelayStatus)();
     return {
         bays,
         bayRelayAlive,
@@ -95,7 +99,9 @@ async function currentDoctorEnv() {
         platform: process.platform,
         now: Date.now(),
         device: (0, config_1.loadDeviceCredentials)(),
-        relay: await (0, commands_1.tryRelayStatus)(),
+        relay,
+        // The running relay's own account when it gives one; else what its files say.
+        autoUpdate: relay?.autoUpdate ?? (0, describe_1.statusFromFiles)({ state: (0, store_1.loadAutoUpdateState)(), setting: (0, store_1.loadAutoSetting)(), env: process.env, current: (0, self_upgrade_1.ownVersion)() }),
         node: { version: process.version, webSocket: (0, ws_1.hasBuiltInWebSocket)() },
         // APPDATA, LOCALAPPDATA and a directory lister: without them a Windows report cannot
         // see Claude Desktop's config at all, Store copy or classic.

package/dist/doctor.js

@@ -61,6 +61,7 @@ exports.acpChecks = acpChecks;
 exports.exitCodeFor = exitCodeFor;
 exports.renderReport = renderReport;
 exports.bayChecks = bayChecks;
+exports.autoUpdateCheck = autoUpdateCheck;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
@@ -76,6 +77,8 @@ const launch_1 = require("./channel/launch");
 const plugin_1 = require("./channel/plugin");
 const transport_1 = require("./relay/transport");
 const ws_1 = require("./relay/ws");
+const describe_1 = require("./auto-update/describe");
+const self_upgrade_1 = require("./self-upgrade");
 /**
  * The runtimes worth reporting on.
  *
@@ -122,6 +125,7 @@ function buildReport(env) {
         credentials: credentialsCheck(env),
         bays: bayChecks(env),
         relay: relayCheck(env),
+        autoUpdate: autoUpdateCheck(env),
         mailbox: mailboxCheck(),
         staleCredentials: staleCredentialCheck(env),
         runtimes: REPORTED.map((runtime) => runtimeReport(runtime, env)),
@@ -293,6 +297,7 @@ function renderReport(report) {
         lines.push(...renderSummaryCheck(check));
     lines.push(...renderSummaryCheck(report.staleCredentials));
     lines.push(...renderSummaryCheck(report.relay));
+    lines.push(...renderSummaryCheck(report.autoUpdate));
     lines.push(...renderSummaryCheck(report.mailbox));
     for (const block of report.runtimes) {
         const [first, ...rest] = block.checks;
@@ -443,6 +448,28 @@ function relayCheck(env) {
     }
     return { name: "relay", status: "pass", detail: `running (pid ${env.relay.pid})${transport}` };
 }
+/**
+ * Is this computer keeping itself current? A warning only when something needs the person: a
+ * newer version this copy cannot install by itself, a card waiting on the phone, or an automatic
+ * install that failed. Off is a choice, not a fault, so it is reported and never nagged about.
+ */
+function autoUpdateCheck(env) {
+    const name = "auto-update";
+    const status = env.autoUpdate;
+    if (!status)
+        return { name, status: "skip", detail: "not inspected" };
+    const detail = (0, describe_1.describeAutoUpdate)(status, env.now);
+    const behind = !!status.latest && (0, self_upgrade_1.compareVersions)(status.current, status.latest) === -1;
+    if (status.mode === "off" || status.mode === "none")
+        return { name, status: "skip", detail };
+    if (status.failure)
+        return { name, status: "warn", detail, remedy: "baychat update" };
+    if (status.cardVersion)
+        return { name, status: "warn", detail, remedy: "answer the card in BayChat, or run baychat update" };
+    if (status.mode === "notify" && behind)
+        return { name, status: "warn", detail, remedy: "baychat update" };
+    return { name, status: "pass", detail };
+}
 function pendingCheck(env) {
     if (!env.relay) {
         return { name: "pending", status: "skip", detail: "relay not running — nothing to report" };
@@ -783,6 +810,7 @@ function allChecks(report) {
         ...report.bays,
         report.staleCredentials,
         report.relay,
+        report.autoUpdate,
         report.mailbox,
         ...report.runtimes.flatMap((r) => r.checks),
         ...report.agents,

package/dist/main.js

@@ -9,6 +9,7 @@ const context_hooks_command_1 = require("./context-hooks-command");
 const session_name_1 = require("./session-name");
 const start_command_1 = require("./start-command");
 const update_command_1 = require("./update-command");
+const notice_1 = require("./auto-update/notice");
 const session_command_1 = require("./session-command");
 const doctor_command_1 = require("./doctor-command");
 const bays_command_1 = require("./bays-command");
@@ -56,8 +57,13 @@ async function main() {
     // else", and a usage dump printed at somebody who typed the product's own name is the
     // "something else". `--help` still prints the help, and `start` refuses with one sentence
     // when this machine is not signed in, so nothing is launched from an unusable state.
-    if (command === undefined)
+    if (command === undefined) {
+        (0, notice_1.printUpdateNotice)(command);
         return (0, start_command_1.cmdStart)([]);
+    }
+    // "BayChat updated itself to …": the relay's one line for the terminal, shown once, on a command
+    // a person typed (never into a hook's or an MCP server's output).
+    (0, notice_1.printUpdateNotice)(command);
     // Asking for help never acts: `--help`/`-h` on any command prints its usage and runs nothing
     // (cli-help.ts says which commands' arguments are not ours to read — `claude`, `send`, …).
     const help = (0, cli_help_1.helpRequest)(command, args);
@@ -76,7 +82,10 @@ async function main() {
             return (0, start_command_1.cmdStart)(args);
         case "update":
             // `--quiet` is how an old version hands a `start`-driven update to the new one.
-            return (0, update_command_1.cmdUpdate)({ quiet: args.includes("--quiet") });
+            (0, args_1.rejectUnknownFlags)(args, ["--quiet", "--auto"], "baychat update [--auto on|off]");
+            if (args.includes("--auto") && !(0, args_1.flag)(args, "--auto"))
+                throw new Error("Usage: baychat update --auto on|off");
+            return (0, update_command_1.cmdUpdate)({ quiet: args.includes("--quiet"), auto: (0, args_1.flag)(args, "--auto") });
         case "skill": {
             const runtime = args[1];
             if (args.length !== 2 ||

package/dist/permissions-command.js

@@ -7,10 +7,15 @@ exports.cmdPermissions = cmdPermissions;
 //   baychat permissions remove <id>   take one back out of its settings file
 //   baychat permissions on | off      the card itself, for sessions BayChat starts from now on
 //   baychat permissions sweep         (internal) take back once-rules whose time is up
+//   baychat permissions confirm --grant <id>
+//                                     (internal) confirm an unconfirmed grant against the
+//                                     session's transcript, or take it back (denied/confirm.ts)
 //
 // Only rules BayChat wrote are listed or removed. A rule the person wrote themselves never
 // appears here, because a rule that was already in the file was never recorded (denied/grants.ts).
+const confirm_1 = require("./denied/confirm");
 const grants_1 = require("./denied/grants");
+const hook_log_1 = require("./denied/hook-log");
 const opt_in_1 = require("./denied/opt-in");
 /** The longest a scheduled sweep may sleep: a once-rule's TTL is minutes, never hours. */
 const MAX_SWEEP_DELAY_MS = 60 * 60_000;
@@ -71,6 +76,17 @@ async function cmdPermissions(args, deps = {}) {
                 await (deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))))(delay + 1000);
             }
             await (0, grants_1.sweepExpiredGrants)(now());
+            await (0, confirm_1.takeBackStaleUnconfirmed)({ log: hook_log_1.logBoth, ...deps.confirm });
+            return 0;
+        }
+        case "confirm": {
+            // Started detached by denied-hook (never by a person); not in USAGE on purpose.
+            const id = rest[rest.indexOf("--grant") + 1];
+            if (!rest.includes("--grant") || !id) {
+                err("Usage: baychat permissions confirm --grant <id>");
+                return 1;
+            }
+            await (0, confirm_1.confirmGrant)(id, { log: hook_log_1.logBoth, ...deps.confirm });
             return 0;
         }
         default:
@@ -83,5 +99,6 @@ function describeGrant(grant) {
     // A once-rule can carry a secret from the command (it is never offered as "always" then), so it
     // is listed as the card showed it, masked; an always-rule never holds one and is listed as written.
     const rules = grant.kind === "once" ? grant.shown : grant.rules.length ? grant.rules.join(", ") : "(the rule was already there)";
-    return `${grant.id}  ${rules}\n          ${when} · ${grant.settingsFile}${grant.session ? ` · ${grant.session}` : ""}`;
+    const scope = grant.scope === "user" ? "user settings, every project" : "this project";
+    return `${grant.id}  ${rules}\n          ${when} · ${scope} · ${grant.settingsFile}${grant.session ? ` · ${grant.session}` : ""}`;
 }