baychat 0.33.0 → 0.33.2

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.33.0",
+  "version": "0.33.2",
   "displayName": "BayChat",
   "description": "Wakes this Claude Code session the moment a BayChat message arrives: no Monitor, no 30-minute deadline. Uses the baychat CLI already on this computer (npm install -g baychat, then baychat login).",
   "author": {

package/dist/auto-update/hint.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.onReleaseAnnounced = onReleaseAnnounced;
+exports.announceRelease = announceRelease;
+let listener;
+let log = (line) => console.error(line);
+function onReleaseAnnounced(fn, logLine) {
+    listener = fn;
+    if (logLine)
+        log = logLine;
+}
+function announceRelease(version) {
+    try {
+        listener?.(version);
+    }
+    catch (err) {
+        // A hint that cannot be taken is a hint missed; the daily check still comes.
+        log(`auto-update: could not take the server's release hint (${err instanceof Error ? err.message : String(err)})`);
+    }
+}

package/dist/auto-update/policy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HELD_FRESH_MS = exports.QUIET_MS = exports.CARD_POLL_MS = exports.ASK_AGAIN_MS = exports.CHECK_INTERVAL_MS = exports.AUTO_UPDATE_ENV = void 0;
+exports.HELD_FRESH_MS = exports.QUIET_MS = exports.CARD_POLL_MS = exports.ASK_AGAIN_MS = exports.HINT_COOLDOWN_MS = exports.HINT_SPREAD_MS = exports.HINT_MIN_MS = exports.CHECK_INTERVAL_MS = exports.AUTO_UPDATE_ENV = void 0;
 exports.planUpdate = planUpdate;
 exports.autoUpdateOffReason = autoUpdateOffReason;
 exports.nextCheckAt = nextCheckAt;
@@ -50,6 +50,13 @@ const CHECK_SPREAD_MS = HOUR;
 /** The first check after a start: soon, but not in the busy first minutes. */
 const FIRST_CHECK_MIN_MS = 5 * MINUTE;
 const FIRST_CHECK_SPREAD_MS = 10 * MINUTE;
+/** The server named a newer release in the feed's `ready` frame (hint.ts): npm is asked within
+ *  1–5 minutes — spread so a fleet that hears the same frame never asks npm together. */
+exports.HINT_MIN_MS = MINUTE;
+exports.HINT_SPREAD_MS = 4 * MINUTE;
+/** A hint right after a check is not taken: a server that names a release on every reconnect
+ *  must not become an npm query on every reconnect. */
+exports.HINT_COOLDOWN_MS = 15 * MINUTE;
 /** A check that failed (offline, npm down) is tried again sooner than a day, then backs off. */
 const CHECK_RETRY_MS = HOUR;
 /** A failed install of one version waits a day, then two, … up to a week. A newer version resets it. */

package/dist/auto-update/relay-glue.js

@@ -10,6 +10,7 @@ const refresh_clients_1 = require("../refresh-clients");
 const waiting_cards_1 = require("../waiting-cards");
 const policy_1 = require("./policy");
 const store_1 = require("./store");
+const hint_1 = require("./hint");
 const updater_1 = require("./updater");
 /**
  * The automatic update wired to a real relay: npm, the disk, the device API for the card, and the
@@ -50,6 +51,8 @@ function startRelayUpdater(opts) {
     };
     const updater = new updater_1.AutoUpdater(deps);
     updater.start();
+    // The server's feed names the newest release in each `ready` frame: check npm soon, not tomorrow.
+    (0, hint_1.onReleaseAnnounced)((version) => updater.hint(version), opts.log);
     return updater;
 }
 /**

package/dist/auto-update/updater.js

@@ -17,6 +17,10 @@ class AutoUpdater {
     running = false;
     stopped = false;
     lastCardPoll = 0;
+    /** A release the server named (hint.ts), and when npm is asked about it. In memory only: a
+     *  restarted relay hears the next `ready` frame anyway. */
+    hinted;
+    hintCheckAt;
     constructor(deps) {
         this.deps = deps;
         this.startedAt = deps.now();
@@ -46,6 +50,35 @@ class AutoUpdater {
             failure: state.failure?.reason,
         };
     }
+    /**
+     * The server's feed named `version` as the newest BayChat (hint.ts). Newer than this copy, and
+     * newer than what npm last said: ask npm in 1–5 minutes instead of at the daily check. Only the
+     * moment moves — npm still names the version, and planUpdate still decides what happens.
+     *
+     * The moment never moves earlier than the backoff allows: not within HINT_COOLDOWN_MS of the
+     * last check, and not while a failed check waits out its retry (npm down stays npm down,
+     * however often the server reconnects).
+     */
+    hint(version) {
+        const { mode } = this.mode();
+        if (mode === "off" || mode === "none")
+            return;
+        const ahead = (0, self_upgrade_1.compareVersions)(version, this.deps.current);
+        if (ahead === undefined || ahead <= 0 || this.hinted === version)
+            return;
+        const state = this.deps.loadState();
+        const known = state.latest ? (0, self_upgrade_1.compareVersions)(state.latest, version) : undefined;
+        if (known !== undefined && known >= 0)
+            return; // npm already named it (or newer)
+        const now = this.deps.now();
+        if (state.lastCheckAt !== undefined && now - state.lastCheckAt < policy_1.HINT_COOLDOWN_MS)
+            return;
+        if ((state.checkFailures ?? 0) > 0 && now < (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread))
+            return;
+        this.hinted = version;
+        this.hintCheckAt = now + policy_1.HINT_MIN_MS + this.deps.random() * policy_1.HINT_SPREAD_MS;
+        this.deps.log(`auto-update: the server names ${version}; asking npm within minutes`);
+    }
     /** One look at the state. Never throws; never runs twice at once. */
     async tick() {
         await this.runExclusive(async () => {
@@ -64,8 +97,11 @@ class AutoUpdater {
             if (mode === "off" || mode === "none")
                 return;
             const now = this.deps.now();
-            if (now >= (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread))
+            const hinted = this.hintCheckAt !== undefined && now >= this.hintCheckAt;
+            if (hinted || now >= (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread)) {
+                this.hintCheckAt = undefined;
                 await this.check(state, mode);
+            }
             if (mode !== "auto")
                 return;
             if (state.card?.requestId && now - this.lastCardPoll >= policy_1.CARD_POLL_MS)

package/dist/bay-mcp.js

@@ -20,6 +20,7 @@ exports.realClaudeRun = realClaudeRun;
 exports.syncBayEntriesWithClaude = syncBayEntriesWithClaude;
 exports.applyBayEntries = applyBayEntries;
 const node_child_process_1 = require("node:child_process");
+const windows_cmd_1 = require("./windows-cmd");
 const client_config_writer_1 = require("./client-config-writer");
 const client_paths_1 = require("./client-paths");
 const mcp_dialects_1 = require("./mcp-dialects");
@@ -96,21 +97,20 @@ function claudeBayAddArgs(name, baseUrl, token) {
         `Authorization: Bearer ${token}`,
     ];
 }
-/** Characters cmd.exe quoting cannot hold (commands.ts `WINDOWS_UNSAFE`). */
-const WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
 /** Run `claude <args>` the way `registerWithClaude` does, or null when it cannot run safely. */
 function realClaudeRun(platform = process.platform) {
     return (args) => {
-        const shell = platform === "win32";
-        if (shell && args.some((a) => WINDOWS_UNSAFE.test(a))) {
+        const windows = platform === "win32";
+        if (windows && args.some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a))) {
             return { status: null, stderr: "", error: new Error("unsafe argument for cmd.exe") };
         }
-        const res = (0, node_child_process_1.spawnSync)("claude", shell ? args.map((a) => `"${a}"`) : args, {
+        const run = windows ? (0, windows_cmd_1.cmdExeSpawn)("claude", args.map(windows_cmd_1.quoteForCmd)) : { command: "claude", args };
+        const res = (0, node_child_process_1.spawnSync)(run.command, run.args, {
             encoding: "utf8",
             stdio: ["ignore", "ignore", "pipe"],
             timeout: 15_000,
             killSignal: "SIGKILL",
-            shell,
+            windowsVerbatimArguments: windows,
         });
         return { status: res.status, stderr: String(res.stderr ?? ""), ...(res.error ? { error: res.error } : {}) };
     };

package/dist/channel/launch.js

@@ -113,7 +113,11 @@ function channelLaunchFor(claudePath, deps = {}) {
     return { on: true, args: [detect_1.DEV_CHANNELS_FLAG, ...entries], env: { ...exports.CHANNEL_ENV } };
 }
 function probeVersion(claudePath) {
-    const probe = (0, node_child_process_1.spawnSync)(claudePath, ["--version"], { encoding: "utf8", timeout: 10_000 });
+    // claude.cmd on Windows cannot be spawned as is (EINVAL), and then the channel stayed off.
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(claudePath, process.platform), ["--version"]);
+    if (!run.ok)
+        return undefined;
+    const probe = (0, node_child_process_1.spawnSync)(run.file, run.args, { encoding: "utf8", timeout: 10_000, windowsVerbatimArguments: run.verbatim });
     return probe.error || probe.status !== 0 ? undefined : String(probe.stdout ?? "");
 }
 /**

package/dist/commands.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.realConfigIo = exports.WINDOWS_UNSAFE = exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
+exports.realConfigIo = exports.WINDOWS_UNSAFE = exports.quoteForCmd = exports.cmdExeSpawn = exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
 exports.requireCredentials = requireCredentials;
 exports.cmdPair = cmdPair;
 exports.cmdWhoami = cmdWhoami;
@@ -18,7 +18,7 @@ exports.resetSessionState = resetSessionState;
 exports.cmdCheck = cmdCheck;
 exports.cmdWatch = cmdWatch;
 exports.cmdLink = cmdLink;
-exports.quoteForCmd = quoteForCmd;
+exports.claudeSpawn = claudeSpawn;
 exports.claudeMcpAddSpawn = claudeMcpAddSpawn;
 exports.refreshConnectedClients = refreshConnectedClients;
 exports.registerWithClaude = registerWithClaude;
@@ -37,6 +37,7 @@ const protocol_1 = require("./protocol");
 const connection_qr_1 = require("./connection-qr");
 const config_1 = require("./config");
 const bay_mcp_1 = require("./bay-mcp");
+const windows_cmd_1 = require("./windows-cmd");
 const context_1 = require("./context");
 const runtime_install_1 = require("./runtime-install");
 const credential_refresh_1 = require("./credential-refresh");
@@ -570,44 +571,37 @@ function printManualMcpAdd(baseUrl) {
     console.log(`  claude mcp add --transport http --scope user baychat ${baseUrl}/api/mcp \\`);
     console.log(`    --header "Authorization: Bearer <your token — in ~/.baychat/credentials.json under device.token>"`);
 }
+var windows_cmd_2 = require("./windows-cmd");
+Object.defineProperty(exports, "cmdExeSpawn", { enumerable: true, get: function () { return windows_cmd_2.cmdExeSpawn; } });
+Object.defineProperty(exports, "quoteForCmd", { enumerable: true, get: function () { return windows_cmd_2.quoteForCmd; } });
+Object.defineProperty(exports, "WINDOWS_UNSAFE", { enumerable: true, get: function () { return windows_cmd_2.WINDOWS_UNSAFE; } });
 /**
- * cmd.exe quoting: wrap the whole argument so spaces, `&`, `|` and `>` inside it
- * stay literal. Only usable on values `WINDOWS_UNSAFE` has already cleared.
- */
-function quoteForCmd(arg) {
-    return `"${arg}"`;
-}
-/**
- * Characters that survive — or break out of — cmd.exe double quotes.
- *
- * A `"` ends the wrapper, so everything after it is parsed as shell syntax. A
- * `%NAME%` is expanded *inside* quotes. A newline ends the command line. Nothing
- * else in cmd's metacharacter set (`&`, `|`, `<`, `>`, `^`) is interpreted while
- * quoted, and `!` only expands under delayed expansion, which `cmd /d /s /c` —
- * what Node's `shell: true` invokes — does not enable.
- */
-exports.WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
-/**
- * The spawn recipe for `claude mcp add`, or null when it cannot be run safely.
+ * The spawn recipe for `claude <args>`, or null when it cannot be run safely.
  *
  * On Windows `claude` is a `.cmd` shim, and Node has refused to spawn `.bat` /
- * `.cmd` without `shell: true` since the CVE-2024-27980 fix (18.20.2 /
- * 20.12.2+) — it throws EINVAL. Every runtime this package supports (node >=20)
- * is past that fix, so naming `claude.cmd` explicitly cannot work either: a
- * shell is the only route.
+ * `.cmd` directly since the CVE-2024-27980 fix (18.20.2 / 20.12.2+) — it throws
+ * EINVAL. Every runtime this package supports (node >=20) is past that fix, so
+ * naming `claude.cmd` explicitly cannot work either: cmd.exe is the only route
+ * (`cmdExeSpawn`, the same line `shell: true` used to build).
  *
- * The cost of a shell is that arguments become shell syntax. Node does NOT
- * escape them — with `shell: true` on Windows it joins argv with spaces and
- * hands the string to `cmd.exe /d /s /c` verbatim — so `Authorization: Bearer
- * <token>` would arrive as three separate arguments, and a `&` in an
- * interpolated value would arrive as a command separator. Hence: quote every
- * argument here, and refuse outright when an interpolated value contains
- * something quoting cannot contain. Refusing costs the user one manual paste;
- * guessing would run their token through a command interpreter.
+ * The cost of cmd.exe is that arguments become shell syntax. It gets one string
+ * of argv joined with spaces, so `Authorization: Bearer <token>` would arrive as
+ * three separate arguments, and a `&` in an interpolated value would arrive as a
+ * command separator. Hence: quote every argument here, and refuse outright when
+ * a value contains something quoting cannot contain. Refusing costs the user one
+ * manual paste; guessing would run their token through a command interpreter.
  *
  * POSIX keeps `execve` semantics — argv is passed verbatim, there is no shell to
  * interpret it, and so nothing to quote or refuse.
  */
+function claudeSpawn(platform, args) {
+    if (platform !== "win32")
+        return { command: "claude", args, viaCmd: false };
+    if (args.some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a)))
+        return null;
+    return { ...(0, windows_cmd_1.cmdExeSpawn)("claude", args.map(windows_cmd_1.quoteForCmd)), viaCmd: true };
+}
+/** `claude mcp add` for the remote BayChat server — see `claudeSpawn`. */
 function claudeMcpAddSpawn(platform, baseUrl, token) {
     const args = [
         "mcp",
@@ -621,11 +615,7 @@ function claudeMcpAddSpawn(platform, baseUrl, token) {
         "--header",
         `Authorization: Bearer ${token}`,
     ];
-    if (platform !== "win32")
-        return { command: "claude", args, shell: false };
-    if (args.some((a) => exports.WINDOWS_UNSAFE.test(a)))
-        return null;
-    return { command: "claude", args: args.map(quoteForCmd), shell: true };
+    return claudeSpawn(platform, args);
 }
 /**
  * Register the remote BayChat MCP server with Claude Code, carrying the device
@@ -705,9 +695,9 @@ function registerWithClaude(baseUrl, token) {
         stdio: ["ignore", "ignore", "pipe"],
         timeout: 15_000,
         killSignal: "SIGKILL",
-        shell: recipe.shell,
+        windowsVerbatimArguments: recipe.viaCmd,
     });
-    // 9009 is cmd.exe's "'claude' is not recognized": with a shell there is no
+    // 9009 is cmd.exe's "'claude' is not recognized": through cmd.exe there is no
     // ENOENT to catch, and reporting a missing binary as a generic failure would
     // point the user at the renewal advice below instead of at installing it.
     // "already exists" is what a RENEWAL looks like, and it was being reported as
@@ -716,18 +706,20 @@ function registerWithClaude(baseUrl, token) {
     // scheduled state of a credential with an expiry, so it is handled, not
     // reported.
     if (res.status !== 0 && /already exists/i.test(String(res.stderr ?? ""))) {
-        const removed = (0, node_child_process_1.spawnSync)(recipe.command, ["mcp", "remove", "baychat"], {
+        // Fixed words only, so this recipe is never null where `recipe` was not.
+        const remove = claudeSpawn(process.platform, ["mcp", "remove", "baychat"]);
+        const removed = (0, node_child_process_1.spawnSync)(remove.command, remove.args, {
             encoding: "utf8",
             stdio: ["ignore", "ignore", "pipe"],
             timeout: 15_000,
-            shell: recipe.shell,
+            windowsVerbatimArguments: remove.viaCmd,
         });
         if (removed.status === 0) {
             const readded = (0, node_child_process_1.spawnSync)(recipe.command, recipe.args, {
                 encoding: "utf8",
                 stdio: ["ignore", "ignore", "pipe"],
                 timeout: 15_000,
-                shell: recipe.shell,
+                windowsVerbatimArguments: recipe.viaCmd,
             });
             if (readded.status === 0) {
                 console.log("✓ BayChat re-registered with Claude Code (credential renewed)");
@@ -736,7 +728,7 @@ function registerWithClaude(baseUrl, token) {
             }
         }
     }
-    if (recipe.shell && res.status === 9009) {
+    if (recipe.viaCmd && res.status === 9009) {
         console.log("\nClaude Code CLI not found — add BayChat manually:");
         printManualMcpAdd(baseUrl);
         return false;

package/dist/connect-cursor.js

@@ -25,9 +25,11 @@ function cursorLoginState(statusOutput) {
 }
 function runAgentStatus(binaryPath) {
     // No shell: the path came from PATH resolution. A Windows `.cmd` shim needs its interpreter named.
-    const plan = (0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform);
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform), ["status"]);
+    if (!run.ok)
+        return Promise.resolve(run.reason);
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)(plan.file, [...plan.prefixArgs, "status"], { timeout: STATUS_TIMEOUT_MS, windowsHide: true, shell: false }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(run.file, run.args, { timeout: STATUS_TIMEOUT_MS, windowsHide: true, shell: false, windowsVerbatimArguments: run.verbatim }, (err, stdout, stderr) => {
             const said = `${stdout ?? ""}${stderr ?? ""}`;
             // A failed run is still an answer: "Not logged in" may come with a non-zero exit.
             resolve(said || (err ? err.message : ""));

package/dist/doctor-command.js

@@ -147,9 +147,14 @@ async function currentDoctorEnv() {
             // Same .cmd rule as the probe: an npm-installed CLI on Windows is a shim
             // that cannot be spawned without a shell, and this call would otherwise
             // throw EINVAL and be reported as "could not run `codex mcp list`".
-            const plan = (0, runtime_binary_1.spawnPlanFor)(resolved.path, process.platform);
+            const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(resolved.path, process.platform), ["mcp", "list"]);
+            if (!run.ok)
+                return null;
+            // execFileSync passes this on to spawnSync, which honours it; its option type leaves it out.
+            const verbatim = { windowsVerbatimArguments: run.verbatim };
             try {
-                return (0, child_process_1.execFileSync)(plan.file, [...plan.prefixArgs, "mcp", "list"], {
+                return (0, child_process_1.execFileSync)(run.file, run.args, {
+                    ...verbatim,
                     encoding: "utf8",
                     timeout: MCP_LIST_TIMEOUT_MS,
                     stdio: ["ignore", "pipe", "pipe"],

package/dist/multiplexer-launch.js

@@ -74,6 +74,7 @@ const path = __importStar(require("path"));
 const readline = __importStar(require("readline"));
 const config_1 = require("./config");
 const terminal_pane_1 = require("./relay/terminal-pane");
+const runtime_binary_1 = require("./runtime-binary");
 /**
  * Start `program` where session commands can reach it — inside tmux or screen when possible —
  * and return its exit status. Never refuses to start the agent: every failure on the way falls
@@ -93,9 +94,16 @@ async function launchAgent(program, naming, deps = realLaunchDeps()) {
         return runHere(program, deps);
     return result.status ?? 0;
 }
-/** Run the agent in this terminal, as it would run without BayChat. */
+/** Run the agent in this terminal, as it would run without BayChat. On Windows an npm-installed
+ *  agent is a `.cmd` shim, which Node will not spawn directly (EINVAL): `spawnPlanFor` starts
+ *  what the shim runs. */
 function runHere(program, deps = realLaunchDeps()) {
-    const result = deps.run(program.binary, program.args, { ...deps.env, ...program.env });
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(program.binary, deps.platform), program.args);
+    if (!run.ok) {
+        deps.say(`Could not start ${path.basename(program.binary)}: ${run.reason}.`);
+        return 1;
+    }
+    const result = deps.run(run.file, run.args, { ...deps.env, ...program.env }, run.verbatim);
     if (result.error) {
         deps.say(`Could not start ${path.basename(program.binary)}: ${result.error.message}`);
         return 1;
@@ -222,8 +230,8 @@ function realLaunchDeps() {
         env: process.env,
         atTerminal: !!process.stdin.isTTY && !!process.stdout.isTTY,
         pid: process.pid,
-        run: (file, args, env) => {
-            const r = (0, child_process_1.spawnSync)(file, args, { stdio: "inherit", env });
+        run: (file, args, env, verbatim) => {
+            const r = (0, child_process_1.spawnSync)(file, args, { stdio: "inherit", env, windowsVerbatimArguments: verbatim });
             return { status: r.status, ...(r.error ? { error: r.error } : {}) };
         },
         works: (program) => {

package/dist/relay/acp/client.js

@@ -71,11 +71,14 @@ async function runAcpTurn(req, deps) {
     let child;
     try {
         // A Windows `.cmd` shim needs its interpreter named — same fix as `codex-app-server.ts`.
-        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform);
-        child = deps.spawn(plan.file, [...plan.prefixArgs, ...req.args], {
+        const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform), req.args);
+        if (!run.ok)
+            return failed("spawn", `the agent could not be started: ${run.reason}`);
+        child = deps.spawn(run.file, run.args, {
             cwd: req.cwd,
             env: req.env,
             shell: false,
+            windowsVerbatimArguments: run.verbatim,
             windowsHide: true,
             stdio: ["pipe", "pipe", "pipe"],
         });

package/dist/relay/adapters.js

@@ -397,6 +397,7 @@ function runHeadless(file, args, opts = {}) {
     return new Promise((resolve) => {
         const child = (0, child_process_1.spawn)(file, args, {
             windowsHide: true,
+            windowsVerbatimArguments: opts.windowsVerbatimArguments,
             cwd: opts.cwd,
             // An npm-installed runtime is a script with a `#!/usr/bin/env node`
             // shebang, and the daemon's systemd PATH has no node. See ./spawn-env.ts.

package/dist/relay/codex-app-server.js

@@ -53,9 +53,13 @@ function runCodexTurn(req, deps) {
         // `delivery failed for CodexTest: spawn EINVAL` on every wake — the
         // transport failing before the handshake, on a machine where Codex was
         // installed and working.
-        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, process.platform);
-        const child = spawn(plan.file, [...plan.prefixArgs, "app-server"], {
+        // `app-server` is a fixed word, so a plan always yields argv — `!ok` is unreachable here.
+        const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(req.binaryPath, process.platform), ["app-server"]);
+        if (!run.ok)
+            return resolve({ kind: "failed", transportUnusable: true, reason: run.reason });
+        const child = spawn(run.file, run.args, {
             windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
             cwd: req.cwd,
             // Same reason as `runHeadless`: an npm-installed codex is a script with a
             // `#!/usr/bin/env node` shebang and the daemon's PATH has no node. Both

package/dist/relay/codex-queue.js

@@ -39,18 +39,14 @@ function queueToThread(input) {
     // interpreter is named explicitly. NEVER `shell: true`: the message is text
     // written by other people in the room, and a shell string would make `$(…)`
     // in a chat message run on this box.
-    const plan = (0, runtime_binary_1.spawnPlanFor)(input.binaryPath, input.platform ?? process.platform);
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(input.binaryPath, input.platform ?? process.platform), ["queue", "--thread", input.threadId, "--message", input.message]);
+    if (!run.ok)
+        return Promise.resolve({ kind: "failed", reason: run.reason });
     return new Promise((resolve) => {
-        runner(plan.file, [
-            ...plan.prefixArgs,
-            "queue",
-            "--thread",
-            input.threadId,
-            "--message",
-            input.message,
-        ], {
+        runner(run.file, run.args, {
             cwd: input.cwd,
             windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
             env: (0, spawn_env_1.headlessSpawnEnv)(),
             timeout: input.timeoutMs ?? QUEUE_TIMEOUT_MS,
             maxBuffer: 1024 * 1024,
@@ -80,11 +76,14 @@ function queueToThread(input) {
 }
 /** Verify native queue support without submitting a message or changing a task. */
 function verifyCodexQueue(binaryPath) {
-    const plan = (0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform);
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform), ["queue", "--help"]);
+    if (!run.ok)
+        return Promise.reject(new Error(run.reason));
     return new Promise((resolve, reject) => {
-        (0, child_process_1.execFile)(plan.file, [...plan.prefixArgs, "queue", "--help"], {
+        (0, child_process_1.execFile)(run.file, run.args, {
             env: (0, spawn_env_1.headlessSpawnEnv)(),
             windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
             timeout: 5_000,
             maxBuffer: 64 * 1024,
         }, (error, stdout) => {

package/dist/relay/daemon.js

@@ -1281,12 +1281,19 @@ class RelayDaemon {
             // the path — resolution or the session's own runtimeBin — so the decision
             // lives here, after both, rather than inside either. Never a shell: these
             // args carry the wake prompt, and therefore other people's message text.
-            const plan = (0, runtime_binary_1.spawnPlanFor)(executable, process.platform);
+            const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(executable, process.platform), args);
+            if (!run.ok) {
+                // A .cmd we cannot start directly, and a prompt cmd.exe would read as syntax: say so
+                // rather than run it through cmd.exe anyway.
+                this.record({ kind: "pending", session, reason: run.reason }, session, batch);
+                return;
+            }
             // The session's own directory when we know it: `cwd` is only where the
             // attach process ran, and `codex exec` refuses to start outside a trusted
             // directory at all.
-            const { exitCode, stderr } = await this.spawnHeadless(plan.file, [...plan.prefixArgs, ...args], {
+            const { exitCode, stderr } = await this.spawnHeadless(run.file, run.args, {
                 cwd: resolved.resumeCwd ?? resolved.cwd,
+                ...(run.verbatim ? { windowsVerbatimArguments: true } : {}),
             });
             if (exitCode !== 0) {
                 // The binary ran and the turn still failed, so what we resolved may be

package/dist/relay/ws.js

@@ -27,6 +27,7 @@ const context_notice_1 = require("./context-notice");
 const project_notes_1 = require("./project-notes");
 const updates_1 = require("./updates");
 const server_registration_1 = require("./server-registration");
+const hint_1 = require("../auto-update/hint");
 /** The published endpoint. Changing it breaks every deployed server — a wire constant. */
 exports.AGENT_WS_PATH = "/api/agent-api/ws";
 /** How long we wait for the server's `ready` after sending `hello`. */
@@ -132,6 +133,8 @@ function runWebSocketFeed(opts) {
                         onSessions?.(frame.sessions, frame.registrations);
                     if (frame.cursor)
                         onCursor?.(frame.cursor);
+                    if (frame.latestCli)
+                        (0, hint_1.announceRelease)(frame.latestCli);
                     onReady?.(frame.cursor ?? null);
                     return;
                 }
@@ -288,6 +291,8 @@ function parseFrame(raw) {
                 cursor: str(frame.cursor),
                 sessions: names(frame.sessions),
                 registrations: (0, server_registration_1.parseRegistrations)(frame.registrations),
+                // Plain x.y.z only; anything else is dropped (a hint, never what installs: auto-update/hint.ts).
+                latestCli: typeof frame.latestCli === "string" && /^\d+\.\d+\.\d+$/.test(frame.latestCli) ? frame.latestCli : undefined,
             };
         case "cursor":
             return {

package/dist/runtime-binary.js

@@ -36,10 +36,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveRuntimeBinary = resolveRuntimeBinary;
 exports.describeResolution = describeResolution;
 exports.spawnPlanFor = spawnPlanFor;
+exports.planArgv = planArgv;
 exports.probeBinaryVersion = probeBinaryVersion;
 exports.summarizeProbe = summarizeProbe;
 exports.currentBinaryEnv = currentBinaryEnv;
 exports.summarizeResolutionFailure = summarizeResolutionFailure;
+const windows_cmd_1 = require("./windows-cmd");
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const spawn_env_1 = require("./relay/spawn-env");
@@ -190,9 +192,9 @@ function joinPath(dir, file, platform) {
 }
 /**
  * @param candidate an executable path already resolved by `resolveRuntimeBinary`
- * @returns file + prefix args to spawn it with, always `shell: false`
+ * @returns what to spawn; turn it into argv with `planArgv`, always `shell: false`
  */
-function spawnPlanFor(candidate, platform) {
+function spawnPlanFor(candidate, platform, io = windows_cmd_1.realShimIo) {
     // A SCRIPT NEEDS ITS INTERPRETER, on every platform.
     //
     // The managed Codex fallback records `<CODEX_MANAGED_PACKAGE_ROOT>/bin/codex.js`
@@ -207,10 +209,31 @@ function spawnPlanFor(candidate, platform) {
     // `runtimeBin` is recorded by the session in the first place.
     if (/\.(mjs|cjs|js)$/i.test(candidate))
         return { file: process.execPath, prefixArgs: [candidate] };
-    const needsInterpreter = platform === "win32" && /\.(cmd|bat)$/i.test(candidate);
-    if (!needsInterpreter)
+    if (platform !== "win32" || !/\.(cmd|bat)$/i.test(candidate))
         return { file: candidate, prefixArgs: [] };
-    return { file: "cmd.exe", prefixArgs: ["/d", "/s", "/c", candidate] };
+    const target = (0, windows_cmd_1.npmShimTarget)(candidate, io);
+    if (target?.kind === "exe")
+        return { file: target.path, prefixArgs: [] };
+    if (target?.kind === "node")
+        return { file: target.node ?? process.execPath, prefixArgs: [target.script] };
+    return { file: candidate, prefixArgs: [], viaCmd: true };
+}
+/**
+ * The argv for a plan. For a `.cmd` run through cmd.exe, one quoted line passed verbatim — and a
+ * refusal, never a guess, when an argument holds `"`, `%` or a line break, which cmd.exe would read
+ * as syntax inside quotes too.
+ */
+function planArgv(plan, args) {
+    if (!plan.viaCmd)
+        return { ok: true, file: plan.file, args: [...plan.prefixArgs, ...args], verbatim: false };
+    if ([plan.file, ...args].some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a))) {
+        return {
+            ok: false,
+            reason: `${plan.file} is a .cmd BayChat cannot start directly, and an argument holds " or % or a line break, which cannot be passed safely through cmd.exe`,
+        };
+    }
+    const line = (0, windows_cmd_1.cmdExeSpawn)((0, windows_cmd_1.quoteForCmd)(plan.file), args.map(windows_cmd_1.quoteForCmd));
+    return { ok: true, file: line.command, args: line.args, verbatim: true };
 }
 /** How long a `--version` probe may run before it is treated as broken. */
 const PROBE_TIMEOUT_MS = 5_000;
@@ -220,9 +243,11 @@ const PROBE_TIMEOUT_MS = 5_000;
  * probe: no shell, the environment the agent will get, `summarizeProbe` decides.
  */
 function probeBinaryVersion(binaryPath, env) {
-    const plan = spawnPlanFor(binaryPath, process.platform);
+    const run = planArgv(spawnPlanFor(binaryPath, process.platform), ["--version"]);
+    if (!run.ok)
+        return Promise.resolve(summarizeProbe({ status: null, stdout: "", stderr: "", error: new Error(run.reason) }));
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)(plan.file, [...plan.prefixArgs, "--version"], { timeout: PROBE_TIMEOUT_MS, windowsHide: true, shell: false, env, encoding: "utf8" }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(run.file, run.args, { timeout: PROBE_TIMEOUT_MS, windowsHide: true, shell: false, windowsVerbatimArguments: run.verbatim, env, encoding: "utf8" }, (err, stdout, stderr) => {
             const status = err ? (typeof err.code === "number" ? err.code : null) : 0;
             // A non-zero exit is still a run: only a failure to run at all is an `error`.
             const failedToRun = err && typeof err.code !== "number" ? err : undefined;
@@ -304,12 +329,15 @@ function currentBinaryEnv(override, env = process.env, execPath = process.execPa
             }
         },
         probe(candidate) {
-            const plan = spawnPlanFor(candidate, process.platform);
-            const run = (0, child_process_1.spawnSync)(plan.file, [...plan.prefixArgs, "--version"], {
+            const planned = planArgv(spawnPlanFor(candidate, process.platform), ["--version"]);
+            if (!planned.ok)
+                return summarizeProbe({ status: null, stdout: "", stderr: "", error: new Error(planned.reason) });
+            const run = (0, child_process_1.spawnSync)(planned.file, planned.args, {
                 windowsHide: true,
                 timeout: PROBE_TIMEOUT_MS,
                 encoding: "utf8",
                 shell: false,
+                windowsVerbatimArguments: planned.verbatim,
                 // THE PROBE MUST BE ABLE TO START WHAT IT IS PROBING.
                 //
                 // An npm runtime is a `#!/usr/bin/env node` script, and a spawn inherits

package/dist/self-upgrade.js

@@ -42,6 +42,7 @@ exports.upgradePackage = upgradePackage;
 exports.lookupLatest = lookupLatest;
 exports.installRelease = installRelease;
 exports.describeOutcome = describeOutcome;
+exports.npmCommand = npmCommand;
 exports.realNpm = realNpm;
 exports.readPackageVersion = readPackageVersion;
 exports.packageEntry = packageEntry;
@@ -49,7 +50,7 @@ exports.ownVersion = ownVersion;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const commands_1 = require("./commands");
+const windows_cmd_1 = require("./windows-cmd");
 /** A path as the filesystem sees it: every symlink on the way resolved. */
 function resolveEntry(file) {
     try {
@@ -249,16 +250,54 @@ function npmFailure(r) {
     const lines = r.stderr.split("\n").map((l) => l.trim()).filter(Boolean);
     return lines.slice(-3).join(" ") || `npm exited with ${r.status}`;
 }
+/**
+ * Which npm to run, and the PATH to run it with: the npm installed beside the Node running this
+ * code, when there is one — else plain `npm` from PATH.
+ *
+ * A relay under systemd or launchd does not read a shell profile, so with Node from nvm (or any
+ * version manager) its PATH holds no npm at all: every automatic update on such a computer failed
+ * with "npm was not found on PATH" (Karmen's PC, 2026-10-21: 11 failed checks, never one update).
+ * The Node that is running is the Node that installed this copy, and its npm sits next to it. That
+ * directory also goes first on the child's PATH, because npm itself starts with
+ * `#!/usr/bin/env node`, which must find a node too.
+ *
+ * Which global folder that npm calls its own (Volta, asdf, a custom `prefix`) does not matter:
+ * installRelease always passes `--prefix <the running copy's prefix>`, which npm puts above its
+ * own config (checked 2026-10-21 with npm_config_prefix pointing elsewhere: the install landed in
+ * `--prefix`), and then believes only the version on disk there.
+ */
+function npmCommand(execPath, platform, pathEnv, exists) {
+    const dir = path.dirname(execPath);
+    const beside = path.join(dir, platform === "win32" ? "npm.cmd" : "npm");
+    if (!exists(beside))
+        return { command: "npm", path: pathEnv };
+    const sep = platform === "win32" ? ";" : ":";
+    return { command: beside, path: pathEnv ? `${dir}${sep}${pathEnv}` : dir };
+}
 /** Run npm for real, without blocking the event loop (the relay keeps serving while npm runs).
- *  Windows' npm is a `.cmd` shim, which Node will only start through a shell, so every argument
- *  is first checked against what cmd.exe could misread and then quoted. */
+ *  Windows' npm is a `.cmd` shim, which Node will only start through cmd.exe (`cmdExeSpawn`), so
+ *  every argument is first checked against what cmd.exe could misread and then quoted. */
 function realNpm(args, timeoutMs) {
     const windows = process.platform === "win32";
-    if (windows && args.some((a) => commands_1.WINDOWS_UNSAFE.test(a))) {
+    if (windows && args.some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a))) {
         return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") });
     }
+    const found = npmCommand(process.execPath, process.platform, process.env.PATH, fs.existsSync);
+    // A Node directory cmd.exe could misread is not run through it: PATH's npm then, as before.
+    const npm = windows && windows_cmd_1.WINDOWS_UNSAFE.test(found.command) ? { command: "npm", path: process.env.PATH } : found;
+    // Through cmd.exe the command is a string too: a path with spaces must arrive as one word.
+    const run = windows
+        ? (0, windows_cmd_1.cmdExeSpawn)(npm.command !== "npm" ? (0, windows_cmd_1.quoteForCmd)(npm.command) : npm.command, args.map(windows_cmd_1.quoteForCmd))
+        : { command: npm.command, args };
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)("npm", windows ? args.map(commands_1.quoteForCmd) : args, { encoding: "utf8", timeout: timeoutMs, shell: windows, windowsHide: true, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(run.command, run.args, {
+            encoding: "utf8",
+            timeout: timeoutMs,
+            windowsVerbatimArguments: windows,
+            windowsHide: true,
+            maxBuffer: 16 * 1024 * 1024,
+            env: { ...process.env, ...(npm.path !== undefined ? { PATH: npm.path } : {}) },
+        }, (err, stdout, stderr) => {
             if (!err)
                 return resolve({ status: 0, stdout, stderr });
             const code = err.code;

package/dist/windows-cmd.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * Starting a Windows `.cmd` shim (npm, claude) safely. Node will not spawn a `.cmd` directly
+ * (CVE-2024-27980), and `shell: true` with an argument list is deprecated (DEP0190), so the shim
+ * runs through cmd.exe, named explicitly, with every argument checked and quoted here first.
+ * Its own module because commands.ts, bay-mcp.ts and self-upgrade.ts all need it, and
+ * commands.ts already imports bay-mcp.ts.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realShimIo = exports.WINDOWS_UNSAFE = void 0;
+exports.quoteForCmd = quoteForCmd;
+exports.cmdExeSpawn = cmdExeSpawn;
+exports.cmdExePath = cmdExePath;
+exports.npmShimTarget = npmShimTarget;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * cmd.exe quoting: wrap the whole argument so spaces, `&`, `|` and `>` inside it
+ * stay literal. Only usable on values `WINDOWS_UNSAFE` has already cleared.
+ *
+ * Backslashes at the very end are doubled: the program behind the shim splits its
+ * command line by the C runtime's rules, where `\"` is an escaped quote, so
+ * `"C:\proj\"` would swallow the closing quote and merge with the next argument.
+ * Doubled, they read back as the backslashes they were.
+ */
+function quoteForCmd(arg) {
+    return `"${arg.replace(/(\\+)$/, "$1$1")}"`;
+}
+/**
+ * Characters that survive — or break out of — cmd.exe double quotes.
+ *
+ * A `"` ends the wrapper, so everything after it is parsed as shell syntax. A
+ * `%NAME%` is expanded *inside* quotes. A newline ends the command line. Nothing
+ * else in cmd's metacharacter set (`&`, `|`, `<`, `>`, `^`) is interpreted while
+ * quoted, and `!` only expands under delayed expansion, which `cmdExeSpawn`
+ * switches off with `/v:off` (the registry can switch it on for every cmd.exe).
+ */
+exports.WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
+/**
+ * Run a `.cmd` shim through cmd.exe, invoked EXPLICITLY, so the spawn itself needs no `shell: true`.
+ *
+ * `shell: true` with an argument list is deprecated (DEP0190) because Node only joins the list with
+ * spaces — newer Node may refuse it outright. This builds the very line Node built for it,
+ * `cmd.exe /d /s /c "<command> <args>"`, so cmd.exe sees the same line as before, plus `/v:off`:
+ * `/d` skips AutoRun, `/v:off` keeps `!VAR!` literal, `/s` strips exactly the outer quotes, `/c`
+ * runs and exits. Spawn it with `shell: false`
+ * and `windowsVerbatimArguments: true`, or Node would quote the line a second time.
+ *
+ * The caller still owns the quoting: `command` and every arg must already be safe for cmd.exe
+ * (`WINDOWS_UNSAFE` cleared, then `quoteForCmd`) — this only removes the deprecated route.
+ */
+function cmdExeSpawn(command, quotedArgs, env = process.env) {
+    return { command: cmdExePath(env), args: ["/d", "/v:off", "/s", "/c", `"${[command, ...quotedArgs].join(" ")}"`] };
+}
+/**
+ * cmd.exe by its full path, as Node's own `shell: true` took it from ComSpec. A bare `cmd.exe` is
+ * looked up in the current folder FIRST, so `baychat claude` run inside a cloned repo that ships a
+ * `cmd.exe` would start that file.
+ */
+function cmdExePath(env = process.env) {
+    return env.ComSpec ?? env.COMSPEC ?? path.win32.join(env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows", "System32", "cmd.exe");
+}
+exports.realShimIo = {
+    read: (file) => {
+        try {
+            return fs.readFileSync(file, "utf8");
+        }
+        catch {
+            // Unreadable is "not a shim we understand": the caller falls back to cmd.exe.
+            return undefined;
+        }
+    },
+    exists: (file) => fs.existsSync(file),
+};
+/** A shim is a few hundred bytes; anything this big is not one npm wrote. */
+const SHIM_MAX_BYTES = 16 * 1024;
+/** `%dp0%\` (cmd-shim today) or `%~dp0\` (older npm): the shim's own folder. */
+const DP0 = /^(?:%dp0%|%~dp0)\\/i;
+/**
+ * The program an npm `.cmd` shim runs, so it can be started directly — no cmd.exe at all, and so
+ * nothing in the arguments (a wake prompt with `"`, `%`, `&`) is ever read as cmd syntax.
+ *
+ * npm's shims end in one line that runs one file from the shim's folder with `%*`. Exactly one
+ * such file, present on disk, of a kind we know (`.exe`, or a script run by node) — anything else
+ * is undefined, and the caller uses cmd.exe with its stricter rules.
+ */
+function npmShimTarget(shim, io = exports.realShimIo) {
+    const text = io.read(shim);
+    if (!text || text.length > SHIM_MAX_BYTES)
+        return undefined;
+    const line = text.split(/\r?\n/).reverse().find((l) => l.includes("%*"));
+    if (!line)
+        return undefined;
+    const dir = path.win32.dirname(shim);
+    const local = [...line.matchAll(/"([^"]*)"/g)]
+        .map((m) => m[1])
+        .filter((t) => DP0.test(t))
+        .map((t) => path.win32.join(dir, t.replace(DP0, "")));
+    const scripts = local.filter((f) => /\.[cm]?js$/i.test(f));
+    if (scripts.length === 1) {
+        if (!io.exists(scripts[0]))
+            return undefined;
+        const node = path.win32.join(dir, "node.exe");
+        return { kind: "node", script: scripts[0], ...(io.exists(node) ? { node } : {}) };
+    }
+    if (local.length === 1 && /\.exe$/i.test(local[0]) && io.exists(local[0]))
+        return { kind: "exe", path: local[0] };
+    return undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.33.0",
+  "version": "0.33.2",
   "description": "BayChat connector CLI — pair an agent session (Claude Code, Codex, Cursor) with BayChat, or have the relay run DeepSeek or the Cursor CLI for you",
   "bin": {
     "baychat": "dist/index.js"