baychat 0.33.1 → 0.33.3

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.33.1",
+  "version": "0.33.3",
   "displayName": "BayChat",
   "description": "Wakes this Claude Code session the moment a BayChat message arrives: no Monitor, no 30-minute deadline. Uses the baychat CLI already on this computer (npm install -g baychat, then baychat login).",
   "author": {

package/dist/auto-update/policy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HELD_FRESH_MS = exports.QUIET_MS = exports.CARD_POLL_MS = exports.ASK_AGAIN_MS = exports.HINT_COOLDOWN_MS = exports.HINT_SPREAD_MS = exports.HINT_MIN_MS = exports.CHECK_INTERVAL_MS = exports.AUTO_UPDATE_ENV = void 0;
+exports.HELD_FRESH_MS = exports.QUIET_MS = exports.CARD_POLL_MS = exports.ASK_AGAIN_MS = exports.HINT_RECHECK_MS = exports.HINT_COOLDOWN_MS = exports.HINT_SPREAD_MS = exports.HINT_MIN_MS = exports.CHECK_INTERVAL_MS = exports.AUTO_UPDATE_ENV = void 0;
 exports.planUpdate = planUpdate;
 exports.autoUpdateOffReason = autoUpdateOffReason;
 exports.nextCheckAt = nextCheckAt;
@@ -54,9 +54,12 @@ const FIRST_CHECK_SPREAD_MS = 10 * MINUTE;
  *  1–5 minutes — spread so a fleet that hears the same frame never asks npm together. */
 exports.HINT_MIN_MS = MINUTE;
 exports.HINT_SPREAD_MS = 4 * MINUTE;
-/** A hint right after a check is not taken: a server that names a release on every reconnect
- *  must not become an npm query on every reconnect. */
+/** A hint never brings a check closer than this to the last one: a server that names a release
+ *  on every reconnect must not become an npm query on every reconnect. */
 exports.HINT_COOLDOWN_MS = 15 * MINUTE;
+/** The server can name a release before npm has it (deployed first, published after): npm is
+ *  asked again this long after each answer that is still older, then the hint is given up. */
+exports.HINT_RECHECK_MS = [15 * MINUTE, 30 * MINUTE, HOUR];
 /** A check that failed (offline, npm down) is tried again sooner than a day, then backs off. */
 const CHECK_RETRY_MS = HOUR;
 /** A failed install of one version waits a day, then two, … up to a week. A newer version resets it. */

package/dist/auto-update/updater.js

@@ -17,10 +17,6 @@ class AutoUpdater {
     running = false;
     stopped = false;
     lastCardPoll = 0;
-    /** A release the server named (hint.ts), and when npm is asked about it. In memory only: a
-     *  restarted relay hears the next `ready` frame anyway. */
-    hinted;
-    hintCheckAt;
     constructor(deps) {
         this.deps = deps;
         this.startedAt = deps.now();
@@ -28,6 +24,7 @@ class AutoUpdater {
     }
     /** Finish an update the previous relay installed, then look at the state once a minute. */
     start() {
+        this.freshStart();
         void this.runExclusive(() => this.finishPendingUpdate());
         this.timer = setInterval(() => void this.tick(), exports.TICK_MS);
         this.timer.unref();
@@ -50,34 +47,86 @@ class AutoUpdater {
             failure: state.failure?.reason,
         };
     }
+    /**
+     * New code is a new chance. Check failures recorded by ANOTHER version say nothing about this
+     * one — the failure may be the very bug this version fixes. Real case, 2026-10-21: relays that
+     * failed 11 times on 0.33.0 ("npm was not found on PATH") carried that backoff into 0.33.1, which
+     * fixed it, and would not have asked npm again for a day. So the schedule starts over, and the
+     * first check comes 5–15 minutes after this start.
+     */
+    freshStart() {
+        const state = this.deps.loadState();
+        if (!state.current || state.current === this.deps.current)
+            return;
+        if (state.lastCheckAt === undefined && !state.checkFailures)
+            return;
+        const was = state.current;
+        state.lastCheckAt = undefined;
+        state.checkFailures = undefined;
+        state.lastCheckError = undefined;
+        state.current = this.deps.current;
+        this.deps.saveState(state);
+        this.deps.log(`auto-update: now running ${this.deps.current} (checks were recorded by ${was}); asking npm afresh`);
+    }
     /**
      * The server's feed named `version` as the newest BayChat (hint.ts). Newer than this copy, and
      * newer than what npm last said: ask npm in 1–5 minutes instead of at the daily check. Only the
      * moment moves — npm still names the version, and planUpdate still decides what happens.
      *
-     * The moment never moves earlier than the backoff allows: not within HINT_COOLDOWN_MS of the
-     * last check, and not while a failed check waits out its retry (npm down stays npm down,
-     * however often the server reconnects).
+     * The moment never moves earlier than the backoff allows (`hintDue`): not within
+     * HINT_COOLDOWN_MS of the last check, not before a failed check's retry. The hint is kept, on
+     * disk, rather than dropped: a server deployed before the npm publish names a version npm does
+     * not have yet (2026-10-21, 0.33.2: the hint's check came 1 minute before the publish), so npm
+     * is asked again after each HINT_RECHECK_MS step until it names that version, then given up.
      */
     hint(version) {
         const { mode } = this.mode();
         if (mode === "off" || mode === "none")
             return;
         const ahead = (0, self_upgrade_1.compareVersions)(version, this.deps.current);
-        if (ahead === undefined || ahead <= 0 || this.hinted === version)
+        if (ahead === undefined || ahead <= 0)
             return;
         const state = this.deps.loadState();
         const known = state.latest ? (0, self_upgrade_1.compareVersions)(state.latest, version) : undefined;
         if (known !== undefined && known >= 0)
             return; // npm already named it (or newer)
-        const now = this.deps.now();
-        if (state.lastCheckAt !== undefined && now - state.lastCheckAt < policy_1.HINT_COOLDOWN_MS)
+        if (validHint(state.hint)?.version === version)
+            return; // waiting on it, or gave up on it
+        const nextAt = this.hintDue(state, this.deps.now() + policy_1.HINT_MIN_MS + this.deps.random() * policy_1.HINT_SPREAD_MS);
+        state.hint = { version, attempts: 0, nextAt };
+        this.deps.saveState(state);
+        this.deps.log(`auto-update: the server names ${version}; asking npm in ${Math.ceil((nextAt - this.deps.now()) / 60_000)} min`);
+    }
+    /** The earliest a hinted check may run: `wanted`, or later if the backoff says so. */
+    hintDue(state, wanted) {
+        let at = wanted;
+        if (state.lastCheckAt !== undefined)
+            at = Math.max(at, state.lastCheckAt + policy_1.HINT_COOLDOWN_MS);
+        if ((state.checkFailures ?? 0) > 0)
+            at = Math.max(at, (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread));
+        return at;
+    }
+    /** After a check: the hint is answered (npm names it, or this copy has it), retried, or given up. */
+    settleHint(state, now, wasDue) {
+        const hint = validHint(state.hint);
+        if (!hint)
+            return void (state.hint = undefined);
+        const latest = state.latest ? (0, self_upgrade_1.compareVersions)(state.latest, hint.version) : undefined;
+        if ((latest !== undefined && latest >= 0) || (0, self_upgrade_1.compareVersions)(hint.version, this.deps.current) !== 1) {
+            state.hint = undefined;
+            return;
+        }
+        if (!wasDue || hint.nextAt === undefined)
             return;
-        if ((state.checkFailures ?? 0) > 0 && now < (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread))
+        const attempts = hint.attempts + 1;
+        const wait = policy_1.HINT_RECHECK_MS[attempts - 1];
+        if (wait === undefined) {
+            state.hint = { version: hint.version, attempts };
+            this.deps.log(`auto-update: npm still does not have ${hint.version}; the daily check takes over`);
             return;
-        this.hinted = version;
-        this.hintCheckAt = now + policy_1.HINT_MIN_MS + this.deps.random() * policy_1.HINT_SPREAD_MS;
-        this.deps.log(`auto-update: the server names ${version}; asking npm within minutes`);
+        }
+        state.hint = { version: hint.version, attempts, nextAt: now + wait };
+        this.deps.log(`auto-update: npm does not have ${hint.version} yet; asking again in ${wait / 60_000} min`);
     }
     /** One look at the state. Never throws; never runs twice at once. */
     async tick() {
@@ -97,11 +146,10 @@ class AutoUpdater {
             if (mode === "off" || mode === "none")
                 return;
             const now = this.deps.now();
-            const hinted = this.hintCheckAt !== undefined && now >= this.hintCheckAt;
-            if (hinted || now >= (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread)) {
-                this.hintCheckAt = undefined;
-                await this.check(state, mode);
-            }
+            const hintAt = validHint(state.hint)?.nextAt;
+            const hinted = hintAt !== undefined && now >= hintAt;
+            if (hinted || now >= (0, policy_1.nextCheckAt)(state, this.startedAt, this.spread))
+                await this.check(state, mode, hinted);
             if (mode !== "auto")
                 return;
             if (state.card?.requestId && now - this.lastCardPoll >= policy_1.CARD_POLL_MS)
@@ -129,20 +177,25 @@ class AutoUpdater {
             return { mode: "notify", reason: "for a relay started by hand (install with `baychat update`)" };
         return { mode: "auto" };
     }
-    /** Ask npm, and decide. */
-    async check(state, mode) {
+    /** Ask npm, and decide. `hinted`: the check a server's hint asked for (counts as a hint attempt). */
+    async check(state, mode, hinted = false) {
         const looked = await this.deps.lookupLatest();
-        state.lastCheckAt = this.deps.now();
+        const now = this.deps.now();
+        state.lastCheckAt = now;
         if (!looked.ok) {
-            // Offline, npm down: quiet. Tried again within the hour, then less often.
+            // Offline, npm down: quiet. Tried again within the hour, then less often — a waiting hint too.
             state.checkFailures = (state.checkFailures ?? 0) + 1;
             state.lastCheckError = looked.reason;
+            const hint = validHint(state.hint);
+            if (hint?.nextAt !== undefined)
+                state.hint = { ...hint, nextAt: this.hintDue(state, now) };
             this.deps.log(`auto-update: could not ask npm (${looked.reason})`);
             return this.deps.saveState(state);
         }
         state.checkFailures = 0;
         state.lastCheckError = undefined;
         state.latest = looked.release.version;
+        this.settleHint(state, now, hinted);
         const plan = (0, policy_1.planUpdate)(this.deps.current, looked.release);
         if (plan.kind === "current") {
             // Updated some other way (`baychat update`), or nothing new: nothing may stay on the phone.
@@ -355,6 +408,15 @@ class AutoUpdater {
     }
 }
 exports.AutoUpdater = AutoUpdater;
+/** The persisted hint, if it is one: the state file is ours, but a hand edit or an older shape must
+ *  not stop the updater. */
+function validHint(raw) {
+    if (!raw || typeof raw !== "object" || typeof raw.version !== "string" || typeof raw.attempts !== "number")
+        return undefined;
+    if (raw.nextAt !== undefined && typeof raw.nextAt !== "number")
+        return undefined;
+    return raw;
+}
 function errText(err) {
     return err instanceof Error ? err.message : String(err);
 }

package/dist/bay-mcp.js

@@ -20,6 +20,7 @@ exports.realClaudeRun = realClaudeRun;
 exports.syncBayEntriesWithClaude = syncBayEntriesWithClaude;
 exports.applyBayEntries = applyBayEntries;
 const node_child_process_1 = require("node:child_process");
+const windows_cmd_1 = require("./windows-cmd");
 const client_config_writer_1 = require("./client-config-writer");
 const client_paths_1 = require("./client-paths");
 const mcp_dialects_1 = require("./mcp-dialects");
@@ -96,21 +97,20 @@ function claudeBayAddArgs(name, baseUrl, token) {
         `Authorization: Bearer ${token}`,
     ];
 }
-/** Characters cmd.exe quoting cannot hold (commands.ts `WINDOWS_UNSAFE`). */
-const WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
 /** Run `claude <args>` the way `registerWithClaude` does, or null when it cannot run safely. */
 function realClaudeRun(platform = process.platform) {
     return (args) => {
-        const shell = platform === "win32";
-        if (shell && args.some((a) => WINDOWS_UNSAFE.test(a))) {
+        const windows = platform === "win32";
+        if (windows && args.some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a))) {
             return { status: null, stderr: "", error: new Error("unsafe argument for cmd.exe") };
         }
-        const res = (0, node_child_process_1.spawnSync)("claude", shell ? args.map((a) => `"${a}"`) : args, {
+        const run = windows ? (0, windows_cmd_1.cmdExeSpawn)("claude", args.map(windows_cmd_1.quoteForCmd)) : { command: "claude", args };
+        const res = (0, node_child_process_1.spawnSync)(run.command, run.args, {
             encoding: "utf8",
             stdio: ["ignore", "ignore", "pipe"],
             timeout: 15_000,
             killSignal: "SIGKILL",
-            shell,
+            windowsVerbatimArguments: windows,
         });
         return { status: res.status, stderr: String(res.stderr ?? ""), ...(res.error ? { error: res.error } : {}) };
     };

package/dist/channel/launch.js

@@ -113,7 +113,11 @@ function channelLaunchFor(claudePath, deps = {}) {
     return { on: true, args: [detect_1.DEV_CHANNELS_FLAG, ...entries], env: { ...exports.CHANNEL_ENV } };
 }
 function probeVersion(claudePath) {
-    const probe = (0, node_child_process_1.spawnSync)(claudePath, ["--version"], { encoding: "utf8", timeout: 10_000 });
+    // claude.cmd on Windows cannot be spawned as is (EINVAL), and then the channel stayed off.
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(claudePath, process.platform), ["--version"]);
+    if (!run.ok)
+        return undefined;
+    const probe = (0, node_child_process_1.spawnSync)(run.file, run.args, { encoding: "utf8", timeout: 10_000, windowsVerbatimArguments: run.verbatim });
     return probe.error || probe.status !== 0 ? undefined : String(probe.stdout ?? "");
 }
 /**

package/dist/commands.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.realConfigIo = exports.WINDOWS_UNSAFE = exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
+exports.realConfigIo = exports.WINDOWS_UNSAFE = exports.quoteForCmd = exports.cmdExeSpawn = exports.CATCHUP_UNTRUSTED_REMINDER = void 0;
 exports.requireCredentials = requireCredentials;
 exports.cmdPair = cmdPair;
 exports.cmdWhoami = cmdWhoami;
@@ -18,7 +18,7 @@ exports.resetSessionState = resetSessionState;
 exports.cmdCheck = cmdCheck;
 exports.cmdWatch = cmdWatch;
 exports.cmdLink = cmdLink;
-exports.quoteForCmd = quoteForCmd;
+exports.claudeSpawn = claudeSpawn;
 exports.claudeMcpAddSpawn = claudeMcpAddSpawn;
 exports.refreshConnectedClients = refreshConnectedClients;
 exports.registerWithClaude = registerWithClaude;
@@ -37,6 +37,7 @@ const protocol_1 = require("./protocol");
 const connection_qr_1 = require("./connection-qr");
 const config_1 = require("./config");
 const bay_mcp_1 = require("./bay-mcp");
+const windows_cmd_1 = require("./windows-cmd");
 const context_1 = require("./context");
 const runtime_install_1 = require("./runtime-install");
 const credential_refresh_1 = require("./credential-refresh");
@@ -570,44 +571,37 @@ function printManualMcpAdd(baseUrl) {
     console.log(`  claude mcp add --transport http --scope user baychat ${baseUrl}/api/mcp \\`);
     console.log(`    --header "Authorization: Bearer <your token — in ~/.baychat/credentials.json under device.token>"`);
 }
+var windows_cmd_2 = require("./windows-cmd");
+Object.defineProperty(exports, "cmdExeSpawn", { enumerable: true, get: function () { return windows_cmd_2.cmdExeSpawn; } });
+Object.defineProperty(exports, "quoteForCmd", { enumerable: true, get: function () { return windows_cmd_2.quoteForCmd; } });
+Object.defineProperty(exports, "WINDOWS_UNSAFE", { enumerable: true, get: function () { return windows_cmd_2.WINDOWS_UNSAFE; } });
 /**
- * cmd.exe quoting: wrap the whole argument so spaces, `&`, `|` and `>` inside it
- * stay literal. Only usable on values `WINDOWS_UNSAFE` has already cleared.
- */
-function quoteForCmd(arg) {
-    return `"${arg}"`;
-}
-/**
- * Characters that survive — or break out of — cmd.exe double quotes.
- *
- * A `"` ends the wrapper, so everything after it is parsed as shell syntax. A
- * `%NAME%` is expanded *inside* quotes. A newline ends the command line. Nothing
- * else in cmd's metacharacter set (`&`, `|`, `<`, `>`, `^`) is interpreted while
- * quoted, and `!` only expands under delayed expansion, which `cmd /d /s /c` —
- * what Node's `shell: true` invokes — does not enable.
- */
-exports.WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
-/**
- * The spawn recipe for `claude mcp add`, or null when it cannot be run safely.
+ * The spawn recipe for `claude <args>`, or null when it cannot be run safely.
  *
  * On Windows `claude` is a `.cmd` shim, and Node has refused to spawn `.bat` /
- * `.cmd` without `shell: true` since the CVE-2024-27980 fix (18.20.2 /
- * 20.12.2+) — it throws EINVAL. Every runtime this package supports (node >=20)
- * is past that fix, so naming `claude.cmd` explicitly cannot work either: a
- * shell is the only route.
+ * `.cmd` directly since the CVE-2024-27980 fix (18.20.2 / 20.12.2+) — it throws
+ * EINVAL. Every runtime this package supports (node >=20) is past that fix, so
+ * naming `claude.cmd` explicitly cannot work either: cmd.exe is the only route
+ * (`cmdExeSpawn`, the same line `shell: true` used to build).
  *
- * The cost of a shell is that arguments become shell syntax. Node does NOT
- * escape them — with `shell: true` on Windows it joins argv with spaces and
- * hands the string to `cmd.exe /d /s /c` verbatim — so `Authorization: Bearer
- * <token>` would arrive as three separate arguments, and a `&` in an
- * interpolated value would arrive as a command separator. Hence: quote every
- * argument here, and refuse outright when an interpolated value contains
- * something quoting cannot contain. Refusing costs the user one manual paste;
- * guessing would run their token through a command interpreter.
+ * The cost of cmd.exe is that arguments become shell syntax. It gets one string
+ * of argv joined with spaces, so `Authorization: Bearer <token>` would arrive as
+ * three separate arguments, and a `&` in an interpolated value would arrive as a
+ * command separator. Hence: quote every argument here, and refuse outright when
+ * a value contains something quoting cannot contain. Refusing costs the user one
+ * manual paste; guessing would run their token through a command interpreter.
  *
  * POSIX keeps `execve` semantics — argv is passed verbatim, there is no shell to
  * interpret it, and so nothing to quote or refuse.
  */
+function claudeSpawn(platform, args) {
+    if (platform !== "win32")
+        return { command: "claude", args, viaCmd: false };
+    if (args.some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a)))
+        return null;
+    return { ...(0, windows_cmd_1.cmdExeSpawn)("claude", args.map(windows_cmd_1.quoteForCmd)), viaCmd: true };
+}
+/** `claude mcp add` for the remote BayChat server — see `claudeSpawn`. */
 function claudeMcpAddSpawn(platform, baseUrl, token) {
     const args = [
         "mcp",
@@ -621,11 +615,7 @@ function claudeMcpAddSpawn(platform, baseUrl, token) {
         "--header",
         `Authorization: Bearer ${token}`,
     ];
-    if (platform !== "win32")
-        return { command: "claude", args, shell: false };
-    if (args.some((a) => exports.WINDOWS_UNSAFE.test(a)))
-        return null;
-    return { command: "claude", args: args.map(quoteForCmd), shell: true };
+    return claudeSpawn(platform, args);
 }
 /**
  * Register the remote BayChat MCP server with Claude Code, carrying the device
@@ -705,9 +695,9 @@ function registerWithClaude(baseUrl, token) {
         stdio: ["ignore", "ignore", "pipe"],
         timeout: 15_000,
         killSignal: "SIGKILL",
-        shell: recipe.shell,
+        windowsVerbatimArguments: recipe.viaCmd,
     });
-    // 9009 is cmd.exe's "'claude' is not recognized": with a shell there is no
+    // 9009 is cmd.exe's "'claude' is not recognized": through cmd.exe there is no
     // ENOENT to catch, and reporting a missing binary as a generic failure would
     // point the user at the renewal advice below instead of at installing it.
     // "already exists" is what a RENEWAL looks like, and it was being reported as
@@ -716,18 +706,20 @@ function registerWithClaude(baseUrl, token) {
     // scheduled state of a credential with an expiry, so it is handled, not
     // reported.
     if (res.status !== 0 && /already exists/i.test(String(res.stderr ?? ""))) {
-        const removed = (0, node_child_process_1.spawnSync)(recipe.command, ["mcp", "remove", "baychat"], {
+        // Fixed words only, so this recipe is never null where `recipe` was not.
+        const remove = claudeSpawn(process.platform, ["mcp", "remove", "baychat"]);
+        const removed = (0, node_child_process_1.spawnSync)(remove.command, remove.args, {
             encoding: "utf8",
             stdio: ["ignore", "ignore", "pipe"],
             timeout: 15_000,
-            shell: recipe.shell,
+            windowsVerbatimArguments: remove.viaCmd,
         });
         if (removed.status === 0) {
             const readded = (0, node_child_process_1.spawnSync)(recipe.command, recipe.args, {
                 encoding: "utf8",
                 stdio: ["ignore", "ignore", "pipe"],
                 timeout: 15_000,
-                shell: recipe.shell,
+                windowsVerbatimArguments: recipe.viaCmd,
             });
             if (readded.status === 0) {
                 console.log("✓ BayChat re-registered with Claude Code (credential renewed)");
@@ -736,7 +728,7 @@ function registerWithClaude(baseUrl, token) {
             }
         }
     }
-    if (recipe.shell && res.status === 9009) {
+    if (recipe.viaCmd && res.status === 9009) {
         console.log("\nClaude Code CLI not found — add BayChat manually:");
         printManualMcpAdd(baseUrl);
         return false;

package/dist/connect-cursor.js

@@ -25,9 +25,11 @@ function cursorLoginState(statusOutput) {
 }
 function runAgentStatus(binaryPath) {
     // No shell: the path came from PATH resolution. A Windows `.cmd` shim needs its interpreter named.
-    const plan = (0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform);
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform), ["status"]);
+    if (!run.ok)
+        return Promise.resolve(run.reason);
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)(plan.file, [...plan.prefixArgs, "status"], { timeout: STATUS_TIMEOUT_MS, windowsHide: true, shell: false }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(run.file, run.args, { timeout: STATUS_TIMEOUT_MS, windowsHide: true, shell: false, windowsVerbatimArguments: run.verbatim }, (err, stdout, stderr) => {
             const said = `${stdout ?? ""}${stderr ?? ""}`;
             // A failed run is still an answer: "Not logged in" may come with a non-zero exit.
             resolve(said || (err ? err.message : ""));

package/dist/doctor-command.js

@@ -147,9 +147,14 @@ async function currentDoctorEnv() {
             // Same .cmd rule as the probe: an npm-installed CLI on Windows is a shim
             // that cannot be spawned without a shell, and this call would otherwise
             // throw EINVAL and be reported as "could not run `codex mcp list`".
-            const plan = (0, runtime_binary_1.spawnPlanFor)(resolved.path, process.platform);
+            const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(resolved.path, process.platform), ["mcp", "list"]);
+            if (!run.ok)
+                return null;
+            // execFileSync passes this on to spawnSync, which honours it; its option type leaves it out.
+            const verbatim = { windowsVerbatimArguments: run.verbatim };
             try {
-                return (0, child_process_1.execFileSync)(plan.file, [...plan.prefixArgs, "mcp", "list"], {
+                return (0, child_process_1.execFileSync)(run.file, run.args, {
+                    ...verbatim,
                     encoding: "utf8",
                     timeout: MCP_LIST_TIMEOUT_MS,
                     stdio: ["ignore", "pipe", "pipe"],

package/dist/multiplexer-launch.js

@@ -74,6 +74,7 @@ const path = __importStar(require("path"));
 const readline = __importStar(require("readline"));
 const config_1 = require("./config");
 const terminal_pane_1 = require("./relay/terminal-pane");
+const runtime_binary_1 = require("./runtime-binary");
 /**
  * Start `program` where session commands can reach it — inside tmux or screen when possible —
  * and return its exit status. Never refuses to start the agent: every failure on the way falls
@@ -93,9 +94,16 @@ async function launchAgent(program, naming, deps = realLaunchDeps()) {
         return runHere(program, deps);
     return result.status ?? 0;
 }
-/** Run the agent in this terminal, as it would run without BayChat. */
+/** Run the agent in this terminal, as it would run without BayChat. On Windows an npm-installed
+ *  agent is a `.cmd` shim, which Node will not spawn directly (EINVAL): `spawnPlanFor` starts
+ *  what the shim runs. */
 function runHere(program, deps = realLaunchDeps()) {
-    const result = deps.run(program.binary, program.args, { ...deps.env, ...program.env });
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(program.binary, deps.platform), program.args);
+    if (!run.ok) {
+        deps.say(`Could not start ${path.basename(program.binary)}: ${run.reason}.`);
+        return 1;
+    }
+    const result = deps.run(run.file, run.args, { ...deps.env, ...program.env }, run.verbatim);
     if (result.error) {
         deps.say(`Could not start ${path.basename(program.binary)}: ${result.error.message}`);
         return 1;
@@ -222,8 +230,8 @@ function realLaunchDeps() {
         env: process.env,
         atTerminal: !!process.stdin.isTTY && !!process.stdout.isTTY,
         pid: process.pid,
-        run: (file, args, env) => {
-            const r = (0, child_process_1.spawnSync)(file, args, { stdio: "inherit", env });
+        run: (file, args, env, verbatim) => {
+            const r = (0, child_process_1.spawnSync)(file, args, { stdio: "inherit", env, windowsVerbatimArguments: verbatim });
             return { status: r.status, ...(r.error ? { error: r.error } : {}) };
         },
         works: (program) => {

package/dist/relay/acp/client.js

@@ -71,11 +71,14 @@ async function runAcpTurn(req, deps) {
     let child;
     try {
         // A Windows `.cmd` shim needs its interpreter named — same fix as `codex-app-server.ts`.
-        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform);
-        child = deps.spawn(plan.file, [...plan.prefixArgs, ...req.args], {
+        const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(req.binaryPath, deps.platform ?? process.platform), req.args);
+        if (!run.ok)
+            return failed("spawn", `the agent could not be started: ${run.reason}`);
+        child = deps.spawn(run.file, run.args, {
             cwd: req.cwd,
             env: req.env,
             shell: false,
+            windowsVerbatimArguments: run.verbatim,
             windowsHide: true,
             stdio: ["pipe", "pipe", "pipe"],
         });

package/dist/relay/adapters.js

@@ -397,6 +397,7 @@ function runHeadless(file, args, opts = {}) {
     return new Promise((resolve) => {
         const child = (0, child_process_1.spawn)(file, args, {
             windowsHide: true,
+            windowsVerbatimArguments: opts.windowsVerbatimArguments,
             cwd: opts.cwd,
             // An npm-installed runtime is a script with a `#!/usr/bin/env node`
             // shebang, and the daemon's systemd PATH has no node. See ./spawn-env.ts.

package/dist/relay/codex-app-server.js

@@ -53,9 +53,13 @@ function runCodexTurn(req, deps) {
         // `delivery failed for CodexTest: spawn EINVAL` on every wake — the
         // transport failing before the handshake, on a machine where Codex was
         // installed and working.
-        const plan = (0, runtime_binary_1.spawnPlanFor)(req.binaryPath, process.platform);
-        const child = spawn(plan.file, [...plan.prefixArgs, "app-server"], {
+        // `app-server` is a fixed word, so a plan always yields argv — `!ok` is unreachable here.
+        const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(req.binaryPath, process.platform), ["app-server"]);
+        if (!run.ok)
+            return resolve({ kind: "failed", transportUnusable: true, reason: run.reason });
+        const child = spawn(run.file, run.args, {
             windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
             cwd: req.cwd,
             // Same reason as `runHeadless`: an npm-installed codex is a script with a
             // `#!/usr/bin/env node` shebang and the daemon's PATH has no node. Both

package/dist/relay/codex-queue.js

@@ -39,18 +39,14 @@ function queueToThread(input) {
     // interpreter is named explicitly. NEVER `shell: true`: the message is text
     // written by other people in the room, and a shell string would make `$(…)`
     // in a chat message run on this box.
-    const plan = (0, runtime_binary_1.spawnPlanFor)(input.binaryPath, input.platform ?? process.platform);
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(input.binaryPath, input.platform ?? process.platform), ["queue", "--thread", input.threadId, "--message", input.message]);
+    if (!run.ok)
+        return Promise.resolve({ kind: "failed", reason: run.reason });
     return new Promise((resolve) => {
-        runner(plan.file, [
-            ...plan.prefixArgs,
-            "queue",
-            "--thread",
-            input.threadId,
-            "--message",
-            input.message,
-        ], {
+        runner(run.file, run.args, {
             cwd: input.cwd,
             windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
             env: (0, spawn_env_1.headlessSpawnEnv)(),
             timeout: input.timeoutMs ?? QUEUE_TIMEOUT_MS,
             maxBuffer: 1024 * 1024,
@@ -80,11 +76,14 @@ function queueToThread(input) {
 }
 /** Verify native queue support without submitting a message or changing a task. */
 function verifyCodexQueue(binaryPath) {
-    const plan = (0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform);
+    const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(binaryPath, process.platform), ["queue", "--help"]);
+    if (!run.ok)
+        return Promise.reject(new Error(run.reason));
     return new Promise((resolve, reject) => {
-        (0, child_process_1.execFile)(plan.file, [...plan.prefixArgs, "queue", "--help"], {
+        (0, child_process_1.execFile)(run.file, run.args, {
             env: (0, spawn_env_1.headlessSpawnEnv)(),
             windowsHide: true,
+            windowsVerbatimArguments: run.verbatim,
             timeout: 5_000,
             maxBuffer: 64 * 1024,
         }, (error, stdout) => {

package/dist/relay/daemon.js

@@ -1281,12 +1281,19 @@ class RelayDaemon {
             // the path — resolution or the session's own runtimeBin — so the decision
             // lives here, after both, rather than inside either. Never a shell: these
             // args carry the wake prompt, and therefore other people's message text.
-            const plan = (0, runtime_binary_1.spawnPlanFor)(executable, process.platform);
+            const run = (0, runtime_binary_1.planArgv)((0, runtime_binary_1.spawnPlanFor)(executable, process.platform), args);
+            if (!run.ok) {
+                // A .cmd we cannot start directly, and a prompt cmd.exe would read as syntax: say so
+                // rather than run it through cmd.exe anyway.
+                this.record({ kind: "pending", session, reason: run.reason }, session, batch);
+                return;
+            }
             // The session's own directory when we know it: `cwd` is only where the
             // attach process ran, and `codex exec` refuses to start outside a trusted
             // directory at all.
-            const { exitCode, stderr } = await this.spawnHeadless(plan.file, [...plan.prefixArgs, ...args], {
+            const { exitCode, stderr } = await this.spawnHeadless(run.file, run.args, {
                 cwd: resolved.resumeCwd ?? resolved.cwd,
+                ...(run.verbatim ? { windowsVerbatimArguments: true } : {}),
             });
             if (exitCode !== 0) {
                 // The binary ran and the turn still failed, so what we resolved may be

package/dist/runtime-binary.js

@@ -36,10 +36,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveRuntimeBinary = resolveRuntimeBinary;
 exports.describeResolution = describeResolution;
 exports.spawnPlanFor = spawnPlanFor;
+exports.planArgv = planArgv;
 exports.probeBinaryVersion = probeBinaryVersion;
 exports.summarizeProbe = summarizeProbe;
 exports.currentBinaryEnv = currentBinaryEnv;
 exports.summarizeResolutionFailure = summarizeResolutionFailure;
+const windows_cmd_1 = require("./windows-cmd");
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const spawn_env_1 = require("./relay/spawn-env");
@@ -190,9 +192,9 @@ function joinPath(dir, file, platform) {
 }
 /**
  * @param candidate an executable path already resolved by `resolveRuntimeBinary`
- * @returns file + prefix args to spawn it with, always `shell: false`
+ * @returns what to spawn; turn it into argv with `planArgv`, always `shell: false`
  */
-function spawnPlanFor(candidate, platform) {
+function spawnPlanFor(candidate, platform, io = windows_cmd_1.realShimIo) {
     // A SCRIPT NEEDS ITS INTERPRETER, on every platform.
     //
     // The managed Codex fallback records `<CODEX_MANAGED_PACKAGE_ROOT>/bin/codex.js`
@@ -207,10 +209,31 @@ function spawnPlanFor(candidate, platform) {
     // `runtimeBin` is recorded by the session in the first place.
     if (/\.(mjs|cjs|js)$/i.test(candidate))
         return { file: process.execPath, prefixArgs: [candidate] };
-    const needsInterpreter = platform === "win32" && /\.(cmd|bat)$/i.test(candidate);
-    if (!needsInterpreter)
+    if (platform !== "win32" || !/\.(cmd|bat)$/i.test(candidate))
         return { file: candidate, prefixArgs: [] };
-    return { file: "cmd.exe", prefixArgs: ["/d", "/s", "/c", candidate] };
+    const target = (0, windows_cmd_1.npmShimTarget)(candidate, io);
+    if (target?.kind === "exe")
+        return { file: target.path, prefixArgs: [] };
+    if (target?.kind === "node")
+        return { file: target.node ?? process.execPath, prefixArgs: [target.script] };
+    return { file: candidate, prefixArgs: [], viaCmd: true };
+}
+/**
+ * The argv for a plan. For a `.cmd` run through cmd.exe, one quoted line passed verbatim — and a
+ * refusal, never a guess, when an argument holds `"`, `%` or a line break, which cmd.exe would read
+ * as syntax inside quotes too.
+ */
+function planArgv(plan, args) {
+    if (!plan.viaCmd)
+        return { ok: true, file: plan.file, args: [...plan.prefixArgs, ...args], verbatim: false };
+    if ([plan.file, ...args].some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a))) {
+        return {
+            ok: false,
+            reason: `${plan.file} is a .cmd BayChat cannot start directly, and an argument holds " or % or a line break, which cannot be passed safely through cmd.exe`,
+        };
+    }
+    const line = (0, windows_cmd_1.cmdExeSpawn)((0, windows_cmd_1.quoteForCmd)(plan.file), args.map(windows_cmd_1.quoteForCmd));
+    return { ok: true, file: line.command, args: line.args, verbatim: true };
 }
 /** How long a `--version` probe may run before it is treated as broken. */
 const PROBE_TIMEOUT_MS = 5_000;
@@ -220,9 +243,11 @@ const PROBE_TIMEOUT_MS = 5_000;
  * probe: no shell, the environment the agent will get, `summarizeProbe` decides.
  */
 function probeBinaryVersion(binaryPath, env) {
-    const plan = spawnPlanFor(binaryPath, process.platform);
+    const run = planArgv(spawnPlanFor(binaryPath, process.platform), ["--version"]);
+    if (!run.ok)
+        return Promise.resolve(summarizeProbe({ status: null, stdout: "", stderr: "", error: new Error(run.reason) }));
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)(plan.file, [...plan.prefixArgs, "--version"], { timeout: PROBE_TIMEOUT_MS, windowsHide: true, shell: false, env, encoding: "utf8" }, (err, stdout, stderr) => {
+        (0, child_process_1.execFile)(run.file, run.args, { timeout: PROBE_TIMEOUT_MS, windowsHide: true, shell: false, windowsVerbatimArguments: run.verbatim, env, encoding: "utf8" }, (err, stdout, stderr) => {
             const status = err ? (typeof err.code === "number" ? err.code : null) : 0;
             // A non-zero exit is still a run: only a failure to run at all is an `error`.
             const failedToRun = err && typeof err.code !== "number" ? err : undefined;
@@ -304,12 +329,15 @@ function currentBinaryEnv(override, env = process.env, execPath = process.execPa
             }
         },
         probe(candidate) {
-            const plan = spawnPlanFor(candidate, process.platform);
-            const run = (0, child_process_1.spawnSync)(plan.file, [...plan.prefixArgs, "--version"], {
+            const planned = planArgv(spawnPlanFor(candidate, process.platform), ["--version"]);
+            if (!planned.ok)
+                return summarizeProbe({ status: null, stdout: "", stderr: "", error: new Error(planned.reason) });
+            const run = (0, child_process_1.spawnSync)(planned.file, planned.args, {
                 windowsHide: true,
                 timeout: PROBE_TIMEOUT_MS,
                 encoding: "utf8",
                 shell: false,
+                windowsVerbatimArguments: planned.verbatim,
                 // THE PROBE MUST BE ABLE TO START WHAT IT IS PROBING.
                 //
                 // An npm runtime is a `#!/usr/bin/env node` script, and a spawn inherits

package/dist/self-upgrade.js

@@ -50,7 +50,7 @@ exports.ownVersion = ownVersion;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const commands_1 = require("./commands");
+const windows_cmd_1 = require("./windows-cmd");
 /** A path as the filesystem sees it: every symlink on the way resolved. */
 function resolveEntry(file) {
     try {
@@ -275,23 +275,25 @@ function npmCommand(execPath, platform, pathEnv, exists) {
     return { command: beside, path: pathEnv ? `${dir}${sep}${pathEnv}` : dir };
 }
 /** Run npm for real, without blocking the event loop (the relay keeps serving while npm runs).
- *  Windows' npm is a `.cmd` shim, which Node will only start through a shell, so every argument
- *  is first checked against what cmd.exe could misread and then quoted. */
+ *  Windows' npm is a `.cmd` shim, which Node will only start through cmd.exe (`cmdExeSpawn`), so
+ *  every argument is first checked against what cmd.exe could misread and then quoted. */
 function realNpm(args, timeoutMs) {
     const windows = process.platform === "win32";
-    if (windows && args.some((a) => commands_1.WINDOWS_UNSAFE.test(a))) {
+    if (windows && args.some((a) => windows_cmd_1.WINDOWS_UNSAFE.test(a))) {
         return Promise.resolve({ status: null, stdout: "", stderr: "", error: new Error("a path npm needs cannot be passed safely through cmd.exe") });
     }
     const found = npmCommand(process.execPath, process.platform, process.env.PATH, fs.existsSync);
     // A Node directory cmd.exe could misread is not run through it: PATH's npm then, as before.
-    const npm = windows && commands_1.WINDOWS_UNSAFE.test(found.command) ? { command: "npm", path: process.env.PATH } : found;
+    const npm = windows && windows_cmd_1.WINDOWS_UNSAFE.test(found.command) ? { command: "npm", path: process.env.PATH } : found;
     // Through cmd.exe the command is a string too: a path with spaces must arrive as one word.
-    const command = windows && npm.command !== "npm" ? (0, commands_1.quoteForCmd)(npm.command) : npm.command;
+    const run = windows
+        ? (0, windows_cmd_1.cmdExeSpawn)(npm.command !== "npm" ? (0, windows_cmd_1.quoteForCmd)(npm.command) : npm.command, args.map(windows_cmd_1.quoteForCmd))
+        : { command: npm.command, args };
     return new Promise((resolve) => {
-        (0, child_process_1.execFile)(command, windows ? args.map(commands_1.quoteForCmd) : args, {
+        (0, child_process_1.execFile)(run.command, run.args, {
             encoding: "utf8",
             timeout: timeoutMs,
-            shell: windows,
+            windowsVerbatimArguments: windows,
             windowsHide: true,
             maxBuffer: 16 * 1024 * 1024,
             env: { ...process.env, ...(npm.path !== undefined ? { PATH: npm.path } : {}) },

package/dist/windows-cmd.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * Starting a Windows `.cmd` shim (npm, claude) safely. Node will not spawn a `.cmd` directly
+ * (CVE-2024-27980), and `shell: true` with an argument list is deprecated (DEP0190), so the shim
+ * runs through cmd.exe, named explicitly, with every argument checked and quoted here first.
+ * Its own module because commands.ts, bay-mcp.ts and self-upgrade.ts all need it, and
+ * commands.ts already imports bay-mcp.ts.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realShimIo = exports.WINDOWS_UNSAFE = void 0;
+exports.quoteForCmd = quoteForCmd;
+exports.cmdExeSpawn = cmdExeSpawn;
+exports.cmdExePath = cmdExePath;
+exports.npmShimTarget = npmShimTarget;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * cmd.exe quoting: wrap the whole argument so spaces, `&`, `|` and `>` inside it
+ * stay literal. Only usable on values `WINDOWS_UNSAFE` has already cleared.
+ *
+ * Backslashes at the very end are doubled: the program behind the shim splits its
+ * command line by the C runtime's rules, where `\"` is an escaped quote, so
+ * `"C:\proj\"` would swallow the closing quote and merge with the next argument.
+ * Doubled, they read back as the backslashes they were.
+ */
+function quoteForCmd(arg) {
+    return `"${arg.replace(/(\\+)$/, "$1$1")}"`;
+}
+/**
+ * Characters that survive — or break out of — cmd.exe double quotes.
+ *
+ * A `"` ends the wrapper, so everything after it is parsed as shell syntax. A
+ * `%NAME%` is expanded *inside* quotes. A newline ends the command line. Nothing
+ * else in cmd's metacharacter set (`&`, `|`, `<`, `>`, `^`) is interpreted while
+ * quoted, and `!` only expands under delayed expansion, which `cmdExeSpawn`
+ * switches off with `/v:off` (the registry can switch it on for every cmd.exe).
+ */
+exports.WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
+/**
+ * Run a `.cmd` shim through cmd.exe, invoked EXPLICITLY, so the spawn itself needs no `shell: true`.
+ *
+ * `shell: true` with an argument list is deprecated (DEP0190) because Node only joins the list with
+ * spaces — newer Node may refuse it outright. This builds the very line Node built for it,
+ * `cmd.exe /d /s /c "<command> <args>"`, so cmd.exe sees the same line as before, plus `/v:off`:
+ * `/d` skips AutoRun, `/v:off` keeps `!VAR!` literal, `/s` strips exactly the outer quotes, `/c`
+ * runs and exits. Spawn it with `shell: false`
+ * and `windowsVerbatimArguments: true`, or Node would quote the line a second time.
+ *
+ * The caller still owns the quoting: `command` and every arg must already be safe for cmd.exe
+ * (`WINDOWS_UNSAFE` cleared, then `quoteForCmd`) — this only removes the deprecated route.
+ */
+function cmdExeSpawn(command, quotedArgs, env = process.env) {
+    return { command: cmdExePath(env), args: ["/d", "/v:off", "/s", "/c", `"${[command, ...quotedArgs].join(" ")}"`] };
+}
+/**
+ * cmd.exe by its full path, as Node's own `shell: true` took it from ComSpec. A bare `cmd.exe` is
+ * looked up in the current folder FIRST, so `baychat claude` run inside a cloned repo that ships a
+ * `cmd.exe` would start that file.
+ */
+function cmdExePath(env = process.env) {
+    return env.ComSpec ?? env.COMSPEC ?? path.win32.join(env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows", "System32", "cmd.exe");
+}
+exports.realShimIo = {
+    read: (file) => {
+        try {
+            return fs.readFileSync(file, "utf8");
+        }
+        catch {
+            // Unreadable is "not a shim we understand": the caller falls back to cmd.exe.
+            return undefined;
+        }
+    },
+    exists: (file) => fs.existsSync(file),
+};
+/** A shim is a few hundred bytes; anything this big is not one npm wrote. */
+const SHIM_MAX_BYTES = 16 * 1024;
+/** `%dp0%\` (cmd-shim today) or `%~dp0\` (older npm): the shim's own folder. */
+const DP0 = /^(?:%dp0%|%~dp0)\\/i;
+/**
+ * The program an npm `.cmd` shim runs, so it can be started directly — no cmd.exe at all, and so
+ * nothing in the arguments (a wake prompt with `"`, `%`, `&`) is ever read as cmd syntax.
+ *
+ * npm's shims end in one line that runs one file from the shim's folder with `%*`. Exactly one
+ * such file, present on disk, of a kind we know (`.exe`, or a script run by node) — anything else
+ * is undefined, and the caller uses cmd.exe with its stricter rules.
+ */
+function npmShimTarget(shim, io = exports.realShimIo) {
+    const text = io.read(shim);
+    if (!text || text.length > SHIM_MAX_BYTES)
+        return undefined;
+    const line = text.split(/\r?\n/).reverse().find((l) => l.includes("%*"));
+    if (!line)
+        return undefined;
+    const dir = path.win32.dirname(shim);
+    const local = [...line.matchAll(/"([^"]*)"/g)]
+        .map((m) => m[1])
+        .filter((t) => DP0.test(t))
+        .map((t) => path.win32.join(dir, t.replace(DP0, "")));
+    const scripts = local.filter((f) => /\.[cm]?js$/i.test(f));
+    if (scripts.length === 1) {
+        if (!io.exists(scripts[0]))
+            return undefined;
+        const node = path.win32.join(dir, "node.exe");
+        return { kind: "node", script: scripts[0], ...(io.exists(node) ? { node } : {}) };
+    }
+    if (local.length === 1 && /\.exe$/i.test(local[0]) && io.exists(local[0]))
+        return { kind: "exe", path: local[0] };
+    return undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.33.1",
+  "version": "0.33.3",
   "description": "BayChat connector CLI — pair an agent session (Claude Code, Codex, Cursor) with BayChat, or have the relay run DeepSeek or the Cursor CLI for you",
   "bin": {
     "baychat": "dist/index.js"