baychat 0.34.1 → 0.35.0

package/dist/relay/codex-approvals.js

@@ -0,0 +1,390 @@
+"use strict";
+// Codex's approval requests, as BayChat decision cards (2026-10-23).
+//
+// WHAT THIS IS. A relay-run Codex turn (`codex app-server`, codex-app-server.ts) runs with
+// `approvalPolicy: "on-request"` when everyone who woke it may command the session. Codex then
+// stops and ASKS before it runs a command outside its sandbox, writes a file, widens its own
+// permissions or calls an MCP tool — as JSON-RPC requests from the server to us. This module is
+// the pure half of answering them: what the card says, which buttons it has, and what each tap
+// (or no tap) means in the protocol's own words. No I/O here; the runner (codex-runner.ts) asks
+// the phone and remembers what was allowed for the session.
+//
+// THE BUTTONS. "Allow once", "Allow for this session", "Deny". The middle one is GUARDED — the
+// app confirms it on the device (Face ID / a confirm step) before sending, because it answers
+// every later identical request without asking (the card API's `guardedOptions`). No answer
+// within the card's time is a Deny, and the card is withdrawn.
+//
+// NEVER AN AMENDMENT. Codex offers "allow commands like this forever" (execpolicy amendments) and
+// "allow this host forever" (network policy amendments). Both write rules that outlive the
+// session and the person who tapped, so this relay never sends them: the strongest answer it
+// gives is `acceptForSession`.
+//
+// Protocol shapes are the official 0.160 schema's (`openai/codex@rust-v0.160.0`,
+// `codex-rs/app-server-protocol/schema/json/`), not guesses.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODEX_CARD_WAIT_SECONDS = exports.CODEX_GUARDED_OPTIONS = exports.CODEX_APPROVE_OPTIONS = void 0;
+exports.isCodexApprovalMethod = isCodexApprovalMethod;
+exports.cachedItemFrom = cachedItemFrom;
+exports.fileChangesFrom = fileChangesFrom;
+exports.choiceAt = choiceAt;
+exports.planCodexCard = planCodexCard;
+exports.composeCodexQuestion = composeCodexQuestion;
+exports.looksSecret = looksSecret;
+exports.describePermissions = describePermissions;
+exports.decisionFor = decisionFor;
+exports.isBayChatMcpApproval = isBayChatMcpApproval;
+exports.sessionAllowKey = sessionAllowKey;
+exports.commandKeyCwd = commandKeyCwd;
+exports.describeForLog = describeForLog;
+exports.clean = clean;
+/** The card's buttons when everything can be shown: index 1 is guarded. */
+exports.CODEX_APPROVE_OPTIONS = ["Allow once", "Allow for this session", "Deny"];
+/** Confirmed on the device before it is sent: it answers later requests without asking. */
+exports.CODEX_GUARDED_OPTIONS = [1];
+/** How long a card is waited on before it counts as Deny and is withdrawn (the owner's call: 10 min). */
+exports.CODEX_CARD_WAIT_SECONDS = 600;
+/** The card API's limit on a question (apps/api/src/lib/cards.ts). */
+const QUESTION_MAX = 2_000;
+/** How much of a command the card shows. */
+const COMMAND_MAX = 600;
+/** How much of one path the card shows (the middle is elided). */
+const PATH_MAX = 160;
+/** How many files, or permission entries of one kind, a card lists. More than that and it says so. */
+const LIST_MAX = 12;
+/** How much of a NEW file's contents the card shows. */
+const ADD_EXCERPT_MAX = 300;
+function isCodexApprovalMethod(method) {
+    return (method === "item/commandExecution/requestApproval" ||
+        method === "item/fileChange/requestApproval" ||
+        method === "item/permissions/requestApproval" ||
+        method === "mcpServer/elicitation/request");
+}
+/** Read one item from `item/started` / `item/fileChange/patchUpdated`, defensively. */
+function cachedItemFrom(raw) {
+    const item = (raw ?? {});
+    const id = typeof item.id === "string" ? item.id : "";
+    if (!id)
+        return undefined;
+    if (item.type === "fileChange")
+        return { type: "fileChange", id, changes: fileChangesFrom(item.changes) };
+    if (item.type === "commandExecution")
+        return { type: "commandExecution", id, command: str(item.command), cwd: str(item.cwd) };
+    return undefined;
+}
+function fileChangesFrom(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.flatMap((c) => {
+        const change = (c ?? {});
+        const kindObj = (change.kind ?? {});
+        const kind = kindObj.type === "add" || kindObj.type === "delete" ? kindObj.type : "update";
+        if (typeof change.path !== "string")
+            return [];
+        const movePath = typeof kindObj.move_path === "string" ? kindObj.move_path : undefined;
+        return [{ path: change.path, kind, ...(movePath ? { movePath } : {}), diff: str(change.diff) }];
+    });
+}
+/** The button that was tapped, as a choice; null (no answer, or an index the card never had) is a refusal. */
+function choiceAt(card, index) {
+    return index === null ? null : (card.choices[index] ?? null);
+}
+/**
+ * The card for one approval request, or a refusal when no card could honestly show it. At most
+ * 2,000 characters, every control and invisible character a renderer could act on removed — this
+ * is text Codex (and so, indirectly, anyone in the room) chose.
+ */
+function planCodexCard(req, ctx) {
+    const p = req.params;
+    const who = `Codex on ${clean(ctx.host)} (session "${clean(ctx.session)}")`;
+    /** Lines that must always be on the card, in order. */
+    const head = [];
+    /** The variable-length part, clipped to whatever room is left. */
+    let body = "";
+    let complete = true;
+    let sessionNote = "";
+    const reason = str(p.reason);
+    switch (req.method) {
+        case "item/commandExecution/requestApproval": {
+            const command = str(p.command) || (req.item?.type === "commandExecution" ? req.item.command : "");
+            const cwd = str(p.cwd) || (req.item?.type === "commandExecution" ? req.item.cwd : "");
+            head.push(p.kind === "writeStdin" ? `${who} wants to send input to a running command.` : `${who} wants to run a command.`);
+            if (cwd)
+                head.push(`In: ${shortPath(cwd)}`);
+            const net = (p.networkApprovalContext ?? null);
+            if (net && typeof net.host === "string")
+                head.push(`Network: it wants to reach ${clean(net.host)}${typeof net.protocol === "string" ? ` (${clean(net.protocol)})` : ""}`);
+            const shown = clipWithCount(collapse(clean(command, true)) || "(no command given)", COMMAND_MAX);
+            if (shown.clipped)
+                complete = false;
+            body = shown.text;
+            sessionNote = `"Allow for this session" lets this exact command run again here without asking — and that covers whatever the scripts it runs contain when they run.`;
+            break;
+        }
+        case "item/fileChange/requestApproval": {
+            const changes = req.item?.type === "fileChange" ? req.item.changes : [];
+            head.push(`${who} wants to change ${changes.length === 1 ? "1 file" : changes.length > 1 ? `${changes.length} files` : "files (Codex did not say which)"}.`);
+            if (changes.length === 0)
+                complete = false;
+            const root = str(p.grantRoot);
+            if (root) {
+                head.push(`It also asks to write ANYWHERE under ${shortPath(root)} for the rest of the session.`);
+                complete = false; // a whole folder is never remembered
+            }
+            for (const c of changes.slice(0, LIST_MAX))
+                head.push(`${c.kind} ${shortPath(c.path)}${c.movePath ? ` → ${shortPath(c.movePath)}` : ""}`);
+            if (changes.length > LIST_MAX) {
+                head.push(`…and ${changes.length - LIST_MAX} more file(s) not listed`);
+                complete = false;
+            }
+            body = changes.map(contentsFor).filter(Boolean).join("\n");
+            sessionNote = `"Allow for this session" lets changes to exactly these files through without asking.`;
+            break;
+        }
+        case "item/permissions/requestApproval": {
+            const described = describePermissions(p.permissions);
+            if (described.refuse)
+                return { kind: "refuse", reason: described.refuse };
+            head.push(`${who} wants more access:`, ...described.lines);
+            if (str(p.cwd))
+                head.push(`In: ${shortPath(str(p.cwd))}`);
+            break;
+        }
+        case "mcpServer/elicitation/request": {
+            head.push(`${who}: the tool server "${clean(str(p.serverName))}" asks:`);
+            const shown = clipWithCount(collapse(clean(str(p.message), true)), COMMAND_MAX);
+            body = shown.text;
+            break;
+        }
+    }
+    if (reason)
+        head.push(`Why: ${clipWithCount(clean(reason), 300).text}`);
+    const offerSession = complete && sessionNote !== "";
+    const tail = ["", ...(offerSession ? [sessionNote] : []), "Allowing does it on that computer, now. If you did not expect this, deny."];
+    const fixed = [...head, "", "", ...tail].join("\n");
+    // The lines a decision turns on must all fit; a request too big to show is not asked about.
+    if (fixed.length > QUESTION_MAX)
+        return { kind: "refuse", reason: "it is too big to show on one card" };
+    const room = Math.max(0, QUESTION_MAX - fixed.length - 40);
+    let question;
+    if (body) {
+        const shown = clipWithCount(body, room);
+        question = [...head, "", shown.text, ...tail].join("\n");
+    }
+    else {
+        question = [...head, ...tail].join("\n");
+    }
+    question = question.replace(/\n{3,}/g, "\n\n").trim().slice(0, QUESTION_MAX);
+    const labels = offerSession ? [...exports.CODEX_APPROVE_OPTIONS] : ["Allow once", "Deny"];
+    const choices = offerSession ? ["once", "session", "deny"] : ["once", "deny"];
+    return { kind: "card", card: { question, labels, choices, guardedOptions: offerSession ? [...exports.CODEX_GUARDED_OPTIONS] : [], rememberable: offerSession } };
+}
+/** The card's question alone (tests and logs). A refused request has none. */
+function composeCodexQuestion(req, ctx) {
+    const plan = planCodexCard(req, ctx);
+    return plan.kind === "card" ? plan.card.question : `(refused without asking: ${plan.reason})`;
+}
+/** Paths whose contents never go on a card: they very likely hold a secret. */
+const SECRET_PATH = [
+    /(^|[\\/])\.env(\.[^\\/]*)?$/i,
+    /credential/i,
+    /secret/i,
+    /password|passwd/i,
+    /token/i,
+    /\.(pem|key|p12|pfx|jks|keystore|kdbx|gpg|asc)$/i,
+    /(^|[\\/])id_[a-z0-9]+(\.pub)?$/i,
+    /(^|[\\/])\.(ssh|aws|gnupg|kube|docker)[\\/]/i,
+    /(^|[\\/])\.(npmrc|netrc|pypirc|pgpass|git-credentials)$/i,
+];
+function looksSecret(path) {
+    return SECRET_PATH.some((re) => re.test(path));
+}
+/**
+ * What a card shows of one file's contents. In 0.160 an add's or a delete's `diff` is the WHOLE
+ * file, so: a deletion shows nothing, a new file a short excerpt, a path that looks like it holds
+ * a secret nothing at all.
+ */
+function contentsFor(change) {
+    if (!change.diff)
+        return "";
+    const where = shortPath(change.path);
+    if (change.kind === "delete")
+        return `(${where} is deleted — its contents are not shown)`;
+    if (looksSecret(change.path) || (change.movePath && looksSecret(change.movePath)))
+        return `(${where} — contents not shown)`;
+    if (change.kind === "add") {
+        const shown = clipWithCount(clean(change.diff, true), ADD_EXCERPT_MAX);
+        return `New file ${where}:\n${shown.text}`;
+    }
+    return clean(change.diff, true);
+}
+const SPECIAL_KIND = {
+    root: "the WHOLE disk",
+    minimal: "the minimal system paths",
+    tmpdir: "the temp folder ($TMPDIR)",
+    slash_tmp: "/tmp",
+};
+/** One file-system target, named so a person can see exactly what it is. */
+function describeTarget(raw) {
+    const where = (raw ?? {});
+    if (where.type === "path")
+        return { text: shortPath(str(where.path)), root: str(where.path) === "/" };
+    if (where.type === "glob_pattern")
+        return { text: `files matching ${clean(str(where.pattern))}`, root: false };
+    if (where.type === "special") {
+        const value = (where.value ?? {});
+        const kind = str(value.kind);
+        const sub = str(value.subpath);
+        if (kind === "project_roots")
+            return { text: `the project folders${sub ? ` (${shortPath(sub)})` : ""}`, root: false };
+        if (kind === "unknown")
+            return { text: `"${shortPath(str(value.path))}"${sub ? ` (${shortPath(sub)})` : ""} — a special path this relay does not know`, root: false };
+        const known = SPECIAL_KIND[kind];
+        return { text: known ?? `an unrecognised special path "${clean(kind)}"`, root: kind === "root" };
+    }
+    return { text: `an unrecognised path ${clean(JSON.stringify(where).slice(0, 80))}`, root: false };
+}
+/**
+ * Every grant a permissions request asks for, as card lines — or a refusal when the card could
+ * not list them all, or one of them is write access to the whole disk. Never fewer lines than
+ * grants: `decisionFor` grants the request as a whole.
+ */
+function describePermissions(raw) {
+    const perms = (raw ?? {});
+    const lines = [];
+    const fs = (perms.fileSystem ?? null);
+    if (fs) {
+        const write = Array.isArray(fs.write) ? fs.write : [];
+        const read = Array.isArray(fs.read) ? fs.read : [];
+        const entries = Array.isArray(fs.entries) ? fs.entries : [];
+        if (write.length > LIST_MAX || read.length > LIST_MAX || entries.length > LIST_MAX) {
+            return { lines, refuse: `it asked for more file-system access than a card can list (${write.length} write, ${read.length} read, ${entries.length} entries)` };
+        }
+        for (const w of write) {
+            if (str(w) === "/")
+                return { lines, refuse: "it asked to write to the whole disk" };
+            lines.push(`Write: ${shortPath(str(w))}`);
+        }
+        for (const r of read)
+            lines.push(`Read: ${str(r) === "/" ? "the WHOLE disk" : shortPath(str(r))}`);
+        for (const e of entries) {
+            const entry = (e ?? {});
+            const access = str(entry.access);
+            const target = describeTarget(entry.path);
+            if (target.root && access === "write")
+                return { lines, refuse: "it asked to write to the whole disk" };
+            if (access !== "read" && access !== "write" && access !== "deny")
+                return { lines, refuse: `it asked for an access mode this relay does not know ("${clean(access)}")` };
+            lines.push(`${access === "write" ? "Write" : access === "read" ? "Read" : "Keep closed"}: ${target.text}`);
+        }
+        if (typeof fs.globScanMaxDepth === "number")
+            lines.push(`(patterns are searched up to ${fs.globScanMaxDepth} folder(s) deep)`);
+    }
+    const net = (perms.network ?? null);
+    if (net && net.enabled === true)
+        lines.push("Network: ON, to any host");
+    return { lines: lines.length > 0 ? lines : ["(Codex did not say what access.)"] };
+}
+/**
+ * What to send back for a choice — or for `null`, which is no answer at all (deadline, withdrawn,
+ * unreachable, an index the card never had) and is ALWAYS the refusal.
+ */
+function decisionFor(req, choice) {
+    const allow = choice === "once" || choice === "session";
+    const forSession = choice === "session";
+    switch (req.method) {
+        case "item/commandExecution/requestApproval":
+        case "item/fileChange/requestApproval":
+            return { decision: allow ? (forSession ? "acceptForSession" : "accept") : "decline" };
+        case "item/permissions/requestApproval":
+            // Exactly what was requested — and the card listed all of it — or nothing.
+            return allow ? { permissions: req.params.permissions ?? {}, scope: forSession ? "session" : "turn" } : { permissions: {}, scope: "turn" };
+        case "mcpServer/elicitation/request":
+            return allow ? { action: "accept", content: {} } : { action: "decline" };
+    }
+}
+/**
+ * Is this elicitation Codex asking whether it may call one of BAYCHAT'S OWN tools (`send_message`
+ * and the rest)? Those are the session's voice in the room — asking the owner's phone before every
+ * reply would make the session unusable, and the turn is already one they allowed. Only an
+ * approval of an MCP tool call (`_meta.codex_approval_kind: "mcp_tool_call"`) from the server
+ * entry BayChat is configured under counts; any other server, or any other kind of elicitation
+ * (a form asking for input), does not.
+ */
+function isBayChatMcpApproval(params, entry) {
+    const meta = (params._meta ?? null);
+    return params.serverName === entry && meta?.codex_approval_kind === "mcp_tool_call";
+}
+/**
+ * The key "Allow for this session" is remembered under, or undefined when the request cannot be
+ * named exactly enough to be allowed again without asking. A command: its exact text in its exact
+ * folder. A file change: its exact set of paths, in the session's folder. Nothing broader —
+ * "allowed `npm test` here" must never cover `npm test && curl …`, nor one file another.
+ */
+function sessionAllowKey(req, sessionCwd = "") {
+    if (req.method === "item/commandExecution/requestApproval") {
+        if (req.params.kind === "writeStdin")
+            return undefined; // input to a live process is never the same twice
+        if (req.params.networkApprovalContext)
+            return undefined; // a host is not a command
+        const command = str(req.params.command) || (req.item?.type === "commandExecution" ? req.item.command : "");
+        const cwd = str(req.params.cwd) || (req.item?.type === "commandExecution" ? req.item.cwd : "") || sessionCwd;
+        return command ? `command\u0000${cwd}\u0000${command}` : undefined;
+    }
+    if (req.method === "item/fileChange/requestApproval") {
+        if (str(req.params.grantRoot))
+            return undefined; // a whole folder is a different request
+        const paths = req.item?.type === "fileChange" ? req.item.changes.map((c) => (c.movePath ? `${c.path}\u0000${c.movePath}` : c.path)) : [];
+        return paths.length ? `files\u0000${sessionCwd}\u0000${[...new Set(paths)].sort().join("\u0001")}` : undefined;
+    }
+    return undefined;
+}
+/** The folder a remembered command runs in, for forgetting it when files under it change. */
+function commandKeyCwd(key) {
+    return key.startsWith("command\u0000") ? key.split("\u0000")[1] : undefined;
+}
+/** A short line for the session log: what was asked, never more than one line. */
+function describeForLog(req) {
+    switch (req.method) {
+        case "item/commandExecution/requestApproval":
+            return `command: ${clipWithCount(collapse(clean(str(req.params.command) || (req.item?.type === "commandExecution" ? req.item.command : ""))), 200).text}`;
+        case "item/fileChange/requestApproval":
+            return `files: ${req.item?.type === "fileChange" ? req.item.changes.map((c) => `${c.kind} ${shortPath(c.path)}`).join(", ") : "(unknown)"}`;
+        case "item/permissions/requestApproval": {
+            const d = describePermissions(req.params.permissions);
+            return `permissions: ${d.refuse ?? d.lines.join("; ")}`;
+        }
+        case "mcpServer/elicitation/request":
+            return `elicitation from ${clean(str(req.params.serverName))}`;
+    }
+}
+function str(value) {
+    return typeof value === "string" ? value : "";
+}
+/** Clip to `max`, saying how much was left out; `clipped` tells the caller the card is incomplete. */
+function clipWithCount(text, max) {
+    if (text.length <= max)
+        return { text, clipped: false };
+    const keep = Math.max(0, max - 40);
+    return { text: `${text.slice(0, keep)}… [${text.length - keep} more characters not shown]`, clipped: true };
+}
+/** Runs of spaces or tabs as one space, and blank lines as one line break: padding cannot push a
+ *  part of a command off the card. */
+function collapse(text) {
+    return text.replace(/[ \t]{2,}/g, " ").replace(/\n\s*\n+/g, "\n").trim();
+}
+/** A path, cleaned, with its middle elided past PATH_MAX. */
+function shortPath(path) {
+    const p = clean(path);
+    return p.length <= PATH_MAX ? p : `${p.slice(0, 60)}…${p.slice(-(PATH_MAX - 61))}`;
+}
+// C0 controls except tab and newline, DEL, C1 controls; the bidi and invisible-direction marks that
+// could make a line DISPLAY as something it is not; zero-width characters and the BOM that can hide
+// text; and the Unicode line/paragraph separators a renderer may break on.
+const CONTROL = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF]/g;
+const SEPARATORS = /[\u2028\u2029\u0085]/g;
+const ANSI = /\u001B\[[0-?]*[ -/]*[@-~]|\u001B\][^\u0007\u001B]*(?:\u0007|\u001B\\)?/g;
+/** Strip escapes and control characters. `multiline` keeps line breaks (a diff); else they become spaces. */
+function clean(text, multiline = false) {
+    const out = text.replace(ANSI, "").replace(/\r\n?/g, "\n").replace(SEPARATORS, "\n").replace(CONTROL, "");
+    return multiline ? out : out.replace(/\s*\n\s*/g, " ").trim();
+}

package/dist/relay/codex-commands.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCodexSessionCommand = runCodexSessionCommand;
+const codex_version_1 = require("./codex-version");
+/**
+ * The session commands for a Codex session the RELAY runs (`target.codex`, codex-runner.ts) —
+ * there is no terminal to type `/compact` or `/new` into, so each means what the runner can do.
+ * Kept out of `daemon.ts`, which only calls in.
+ *
+ * Returns true when the command was answered here; false hands it back to the daemon (`/help`).
+ * A Codex in a terminal never reaches this: its commands are typed into its pane as before.
+ * Every path replies — a command produces no agent turn, so silence would read as failure.
+ */
+async function runCodexSessionCommand(codex, session, target, message, command, say) {
+    if (!target.codex)
+        return false;
+    if (command.mode) {
+        await say(`"${session}" has no modes: it works in its folder without network, and asks you on your phone before anything more.`);
+        return true;
+    }
+    switch (command.id) {
+        case "compact":
+            if ((0, codex_version_1.codexExecFallback)()) {
+                await say(`/compact for "${session}" needs \`codex app-server\`, which BAYCHAT_CODEX_TRANSPORT=exec turns off on that computer.`);
+                return true;
+            }
+            await say(codex.compact(session, message.conversationId)
+                ? `Compacting "${session}"'s memory${codex.status(session).running ? " after its current turn" : ""} — it will say when it is done.`
+                : `"${session}" has nothing to compact yet.`);
+            return true;
+        case "stop":
+            await say(codex.stop(session) ? `Stopped "${session}". Anything it had already done stays done.` : `"${session}" is not doing anything right now.`);
+            return true;
+        case "clear":
+        case "new":
+            // There is no terminal to type into: forgetting the thread IS the fresh chat. The running
+            // turn is stopped first, or it would finish into the memory being closed.
+            codex.stop(session);
+            codex.reset(session);
+            await say(`"${session}" will start a fresh conversation with your next message. Its earlier memory is closed, and nothing allowed "for this session" carries over.`);
+            return true;
+        case "exit":
+            await say(`"${session}" is run by the relay on that computer and has no terminal to detach. Use /stop to cancel a running turn.`);
+            return true;
+        case "status": {
+            const s = codex.status(session);
+            const allowed = codex.allowedCount(session);
+            await say([
+                `Session "${session}" — Codex run by the relay, no terminal`,
+                `  folder: ${target.codex.cwd}`,
+                "  approvals: asked on your phone (no network unless you allow it)",
+                `  now: ${s.running ? "working on a turn" : "idle"}, ${s.queued} message(s) waiting`,
+                `  memory: ${target.codex.threadId ? "kept between messages" : "fresh on the next message"}`,
+                `  allowed for this session: ${allowed === 0 ? "nothing" : `${allowed} exact request(s)`}`,
+            ].join("\n"));
+            return true;
+        }
+        default:
+            return false;
+    }
+}