baychat 0.35.3 → 0.36.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.35.3",
+  "version": "0.36.0",
   "displayName": "BayChat",
   "description": "Wakes this Claude Code session the moment a BayChat message arrives: no Monitor, no 30-minute deadline. Uses the baychat CLI already on this computer (npm install -g baychat, then baychat login).",
   "author": {

package/dist/approve-hook.js

@@ -103,6 +103,7 @@ const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
 const claude_link_1 = require("./channel/claude-link");
+const compound_command_1 = require("./denied/compound-command");
 function allowDecision() {
     return {
         hookSpecificOutput: {
@@ -210,6 +211,12 @@ function describeToolRequest(toolName, toolInput) {
         return "(its parameters could not be displayed)";
     }
 }
+/** A shell command that is more than one, as the shell reads it (denied/compound-command.ts). */
+function isChained(toolName, toolInput) {
+    if (toolName !== "Bash")
+        return false;
+    return (0, compound_command_1.compoundKind)(str((toolInput ?? {}).command)) !== null;
+}
 /** The question the card asks. Blunt on purpose: this is a shell on a server, read on a phone,
  *  and the safe answer has to be the obvious one. */
 function composeQuestion(params) {
@@ -225,6 +232,7 @@ function composeQuestion(params) {
         params.cwd ? `Working directory: ${params.cwd}` : "",
         params.permissionMode ? `Permission mode: ${params.permissionMode}` : "",
         "",
+        isChained(params.toolName, params.toolInput) ? compound_command_1.CHAINED_LINE : "",
         "Allowing runs it on that machine, now. If you did not expect this, deny.",
     ].filter((l) => l !== undefined);
     return clip(lines.join("\n").replace(/\n{3,}/g, "\n\n").trim(), QUESTION_MAX);
@@ -291,7 +299,7 @@ async function decideApproval(rawStdin, argv = [], deps = {}) {
         // re-arms across bounded holds until somebody taps (approval-wait.ts). Every outcome that is
         // not "answered with index 0" becomes a deny below.
         const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session: opts.session, question, options: [...exports.APPROVE_OPTIONS] }, deadline, { now, sleep, log }, "baychat approve-hook");
-        return verdictOf(outcome, opts.waitSeconds);
+        return verdictOf(outcome, opts.waitSeconds, isChained(toolName, input.tool_input));
     }
     catch (err) {
         // The catch that makes the guarantee true. Anything at all — a thrown non-Error, an OOM in a
@@ -309,12 +317,13 @@ async function decideApproval(rawStdin, argv = [], deps = {}) {
  * asymmetry is the point: a future server change can make this hook over-refuse, and can never
  * make it over-permit.
  */
-function verdictOf(outcome, waitSeconds) {
+function verdictOf(outcome, waitSeconds, chained = false) {
     switch (outcome.kind) {
         case "answered":
             if (outcome.index === ALLOW_INDEX)
                 return allowDecision();
-            return deny(`answered "${outcome.answer ?? exports.APPROVE_OPTIONS[1]}" in BayChat.`);
+            // The deny's message is what Claude reads: the way out of a refused chain, not a retry of it.
+            return deny(`answered "${outcome.answer ?? exports.APPROVE_OPTIONS[1]}" in BayChat.`, chained ? compound_command_1.SPLIT_HINT : "");
         case "cancelled":
             return deny("the decision was withdrawn in BayChat without an answer.");
         case "deadline":

package/dist/denied/claims.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimDeniedEvent = claimDeniedEvent;
+// One card per denial. A session BayChat launched has its own PermissionDenied hook (in its
+// `--settings` file) AND the BayChat plugin's (hooks/hooks.json), and Claude Code runs both on
+// the same event: the first to create the event's claim file asks; the other leaves it.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+/** Claims older than this are swept on the next claim: a denial is answered within its hook's wait. */
+const CLAIM_TTL_MS = 2 * 24 * 3600_000;
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const claimsDir = () => path.join((0, config_1.configDir)(), "denied-claims");
+/** True for the first hook to claim `toolUseId`. An id that is no safe file name claims nothing. */
+function claimDeniedEvent(toolUseId, nowMs = Date.now()) {
+    if (!SAFE_ID.test(toolUseId))
+        return false;
+    const dir = claimsDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    sweep(dir, nowMs);
+    try {
+        fs.writeFileSync(path.join(dir, toolUseId), "", { flag: "wx", mode: 0o600 });
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EEXIST")
+            return false;
+        throw err;
+    }
+}
+function sweep(dir, nowMs) {
+    for (const name of fs.readdirSync(dir)) {
+        try {
+            const file = path.join(dir, name);
+            if (nowMs - fs.statSync(file).mtimeMs > CLAIM_TTL_MS)
+                fs.rmSync(file, { force: true });
+        }
+        catch {
+            /* gone already, or another hook's: the next sweep tries again */
+        }
+    }
+}

package/dist/denied/compound-command.js

@@ -0,0 +1,51 @@
+"use strict";
+// Is a shell command ONE command, or several? Read the way a shell reads it — quotes and
+// backslashes first — never by searching the text for `&&`: `echo "a && b"` is one command.
+//
+// It matters because Claude Code checks a chain subcommand by subcommand (permissions docs,
+// "Compound commands"): a chain can only be allowed once, and the chain as typed never matches
+// the rules saved for it. Pure: no files, no network.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SPLIT_HINT = exports.CHAINED_LINE = void 0;
+exports.compoundKind = compoundKind;
+/** Why `command` is more than one command ("nested" wins over "chain"), or null when it is one. Never throws. */
+function compoundKind(command) {
+    let quote = null;
+    let chain = false;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        if (quote === "'") {
+            if (c === "'")
+                quote = null;
+            continue;
+        }
+        if (c === "\\") {
+            i++;
+            continue;
+        }
+        // The shell still runs a substitution inside double quotes.
+        if (c === "`" || (c === "$" && next === "("))
+            return "nested";
+        if (quote === '"') {
+            if (c === '"')
+                quote = null;
+            continue;
+        }
+        if (c === "'" || c === '"')
+            quote = c;
+        else if (c === "(" || c === ")")
+            return "nested";
+        else if (c === ";" || c === "|" || c === "\n" || c === "\r")
+            chain = true;
+        // `&&` is a chain; a lone `&` sends to the background; `2>&1` and `&>` are redirections.
+        else if (c === "&" && (next === "&" || (command[i - 1] !== ">" && next !== ">")))
+            chain = true;
+    }
+    return chain ? "chain" : null;
+}
+/** The card's line for a command that is more than one (approve-hook, permission-rule). */
+exports.CHAINED_LINE = "This is a chained command: it can only be allowed once.";
+/** What the agent is told when a chain is refused: Claude Code reads a PermissionRequest deny's message. */
+exports.SPLIT_HINT = "It was a chained command: do not retry the chain. Run single commands, or write a script to a file " +
+    "and run it with one command, using absolute paths.";

package/dist/denied/opt-in.js

@@ -33,36 +33,50 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DENIED_CARD_DEFAULT = void 0;
+exports.deniedCardMode = deniedCardMode;
 exports.deniedCardEnabled = deniedCardEnabled;
 exports.enableDeniedCard = enableDeniedCard;
 exports.disableDeniedCard = disableDeniedCard;
 // Whether this computer's owner turned the denied-command card on (`baychat permissions on`).
 //
-// OFF UNTIL SOMEBODY ASKS FOR IT, like approve-hook was: the card lets a phone add a permission
-// rule on this computer, so it exists only after a deliberate act. The switch is a file in
-// `~/.baychat`, read when BayChat's launcher writes a session's `--settings` file
-// (relay/launcher/approval-settings.ts), so it takes effect for sessions started after it changes.
+// "ALLOW ONCE" UNTIL SOMEBODY ASKS FOR MORE: the card lets a phone add a permission rule on this
+// computer, so keeping one ("Always") needs a deliberate act at the terminal; `DENIED_CARD_DEFAULT`
+// is the owner's call for "nobody chose". The switch is a file in `~/.baychat`, read when BayChat's
+// launcher writes a session's `--settings` file (relay/launcher/approval-settings.ts), and by the
+// plugin's own hook on each denial (denied-hook --plugin), for sessions started by hand.
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const optInFile = () => path.join((0, config_1.configDir)(), "denied-card.json");
-/** True only when the switch file says so. Any doubt — missing, unreadable, malformed — is off. */
-function deniedCardEnabled() {
+/** WHEN NOBODY CHOSE (no switch file): the owner's decision, kept as one line. Karmen, 2026-10-29: on,
+ *  "Allow once" only — each tap allows one exact command one time; "Always" needs `baychat permissions on`. */
+exports.DENIED_CARD_DEFAULT = "once";
+/** The switch: what its file says, the default without one, off on any doubt (unreadable, malformed). */
+function deniedCardMode() {
     try {
-        const parsed = JSON.parse(fs.readFileSync(optInFile(), "utf8"));
-        return parsed?.enabled === true;
+        const enabled = JSON.parse(fs.readFileSync(optInFile(), "utf8"))?.enabled;
+        return enabled === true ? "on" : "off";
     }
     catch (err) {
-        if (err.code !== "ENOENT") {
-            process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
-        }
-        return false;
+        if (err.code === "ENOENT")
+            return exports.DENIED_CARD_DEFAULT;
+        process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
+        return "off";
     }
 }
+/** True only when the owner turned the card on, Always included. */
+function deniedCardEnabled() {
+    return deniedCardMode() === "on";
+}
 function enableDeniedCard(now = new Date()) {
-    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled: true, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
+    writeSwitch(true, now);
+}
+/** Written, not deleted: an explicit off outranks any default. */
+function disableDeniedCard(now = new Date()) {
+    writeSwitch(false, now);
 }
-function disableDeniedCard() {
-    fs.rmSync(optInFile(), { force: true });
+function writeSwitch(enabled, now) {
+    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
 }

package/dist/denied/permission-rule.js

@@ -22,17 +22,19 @@
 // The card text is built from `shown`, which masks obvious secrets; the rule is built from the
 // real text, because a rule that differs from the call matches nothing.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_RULE_COMMAND_LENGTH = void 0;
+exports.CHAINED_LIMITATION = exports.MAX_RULE_COMMAND_LENGTH = void 0;
 exports.planDeniedCall = planDeniedCall;
 exports.callKeyOf = callKeyOf;
 exports.sameCall = sameCall;
 exports.redactSecrets = redactSecrets;
+const compound_command_1 = require("./compound-command");
 /** Longer than this is not a command a person can check on a phone, nor one a rule should hold. */
 exports.MAX_RULE_COMMAND_LENGTH = 1000;
 /** Claude Code itself saves at most five rules for one approved chain (permissions docs). */
 const MAX_CHAIN_PARTS = 5;
+/** What the card says for every chain: the agent reads it too (the deny message, approve-hook). */
+exports.CHAINED_LIMITATION = `${compound_command_1.CHAINED_LINE} Ask the session to split it into single commands or a script it runs with one command.`;
 /** `&&`, `||`, `|&`, `;`, `|`, and a lone `&` that is not part of a redirection (`2>&1`, `&>`). */
-const CHAIN_OPERATOR = /&&|\|\||\|&|;|\||(?<![>&])&(?![>&])/;
 const CHAIN_SPLIT = /\s*(?:&&|\|\||\|&|;|\||(?<![>&])&(?![>&]))\s*/;
 const NESTED_COMMAND = /`|\$\(|[()]/;
 const MCP_TOOL = /^mcp__[A-Za-z0-9_-]+__[A-Za-z0-9_.-]+$/;
@@ -75,23 +77,22 @@ function planBash(command) {
             "approve it at the computer.");
     }
     const call = { tool: "Bash", subject: command };
-    if (CHAIN_OPERATOR.test(command)) {
+    // A chain as the shell reads it (compound-command.ts): `echo "a && b"` is one command.
+    if ((0, compound_command_1.compoundKind)(command) === "chain") {
         if (/["'\\]/.test(command)) {
-            return nothing(shown, "It chains several commands and quotes text, so BayChat cannot split it safely; ask the session to " +
-                "run them one at a time.");
+            return nothing(shown, `${exports.CHAINED_LIMITATION} It also quotes text, so BayChat cannot split it safely; approve it at the computer.`);
         }
         const parts = command.split(CHAIN_SPLIT);
         if (parts.some((p) => p === "") || parts.length > MAX_CHAIN_PARTS) {
-            return nothing(shown, "BayChat cannot split this chain into exact commands; approve it at the computer.");
+            return nothing(shown, `${exports.CHAINED_LIMITATION} BayChat cannot split this one; approve it at the computer.`);
         }
         return {
             shown,
             onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
             alwaysAllowed: false,
             // One plain line on WHY, because the usual cause is the agent's own habit (`cd … && x | tail`)
-            // and the fix is for the session to run the command by itself.
-            limitation: `"Always" isn't offered: this chains ${parts.length} commands, and a saved rule only ever covers one plain ` +
-                `command. Run it on its own (no cd … &&, no | tail) to be offered "Always".`,
+            // and the fix is for the session to run single commands.
+            limitation: exports.CHAINED_LIMITATION,
             call,
         };
     }

package/dist/denied-hook.js

@@ -88,11 +88,13 @@ const approve_hook_1 = require("./approve-hook");
 const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
+const claims_1 = require("./denied/claims");
 const confirm_1 = require("./denied/confirm");
 const grants_1 = require("./denied/grants");
 const hook_log_1 = require("./denied/hook-log");
 const live_session_1 = require("./denied/live-session");
 const notice_1 = require("./denied/notice");
+const opt_in_1 = require("./denied/opt-in");
 const permission_rule_1 = require("./denied/permission-rule");
 const settings_rules_1 = require("./denied/settings-rules");
 const transcript_1 = require("./denied/transcript");
@@ -180,6 +182,7 @@ function parseArgs(argv) {
     return {
         session: at("--session"),
         fromClaude: argv.includes("--session-from-claude"),
+        plugin: argv.includes("--plugin"),
         waitSeconds: Number.isFinite(rawTimeout) && rawTimeout > 0 ? rawTimeout : approve_hook_1.DEFAULT_WAIT_SECONDS,
     };
 }
@@ -227,6 +230,22 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             log(`${LOG_LABEL}: this session has not joined BayChat yet; the denial stands.`);
             return null;
         }
+        // The switch decides on every denial: the plugin's hook runs in every session, and a launched
+        // session's own hook was written while the switch was not off (it may have changed since).
+        const mode = (deps.cardMode ?? opt_in_1.deniedCardMode)();
+        if (mode === "off") {
+            log(`${LOG_LABEL}: the denied-command card is off on this computer; the denial stands.`);
+            return null;
+        }
+        const eventId = str(input.tool_use_id);
+        if (opts.plugin && !eventId) {
+            log(`${LOG_LABEL}: the event has no tool_use_id to take it by; the denial stands.`);
+            return null;
+        }
+        if (eventId && !(deps.claimEvent ?? claims_1.claimDeniedEvent)(eventId)) {
+            log(`${LOG_LABEL}: another BayChat hook already took this denial.`);
+            return null;
+        }
         const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
         if (!device) {
             log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
@@ -301,7 +320,13 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
                 limitation: `BayChat can't allow it from here: ${choice.why}, so no rule can be saved. ` +
                     "Approve it at the computer (/permissions → Recently denied).",
             }
-            : planned;
+            : mode === "once" && planned.alwaysAllowed
+                ? {
+                    ...planned,
+                    alwaysAllowed: false,
+                    limitation: "\"Always\" is off on this computer (`baychat permissions on` at the computer turns it on).",
+                }
+                : planned;
         const target = choice.scope === "none" ? undefined : choice;
         const question = composeDeniedQuestion({
             who,

package/dist/mcp.js

@@ -252,6 +252,9 @@ async function handleSendMessage(args) {
             // message that quotes nothing must not claim to quote something.
             ...(args.replyToMessageId ? { replyToMessageId: args.replyToMessageId } : {}),
             ...(args.card ? { card: args.card } : {}),
+            ...(args.threadRootId ? { threadRootId: args.threadRootId } : {}),
+            ...(args.handoff !== undefined ? { handoff: args.handoff } : {}),
+            ...(args.result !== undefined ? { result: args.result } : {}),
         });
         const carried = ids.length > 0 ? ` with ${ids.length} attachment${ids.length === 1 ? "" : "s"}` : "";
         return (0, mcp_result_1.ok)(`Sent message ${message.id} at ${message.createdAt}${carried}.`, message);

package/dist/permissions-command.js

@@ -26,9 +26,12 @@ async function cmdPermissions(args, deps = {}) {
     const [sub = "list", ...rest] = args;
     switch (sub) {
         case "list": {
-            out((0, opt_in_1.deniedCardEnabled)()
-                ? "The denied-command card is ON for sessions BayChat starts (`baychat permissions off` turns it off)."
-                : "The denied-command card is OFF (`baychat permissions on` turns it on).");
+            const mode = (0, opt_in_1.deniedCardMode)();
+            out(mode === "on"
+                ? "The denied-command card is ON, with Always, for sessions joined to BayChat (`baychat permissions off` turns it off)."
+                : mode === "once"
+                    ? "The denied-command card offers Allow once for sessions joined to BayChat (`baychat permissions on` adds Always, `off` turns it off)."
+                    : "The denied-command card is OFF (`baychat permissions on` turns it on).");
             const grants = (0, grants_1.listGrants)();
             if (grants.length === 0) {
                 out("BayChat keeps no permission rules on this computer.");
@@ -60,13 +63,13 @@ async function cmdPermissions(args, deps = {}) {
                 return 1;
             }
             (0, opt_in_1.enableDeniedCard)();
-            out("The denied-command card is ON. Sessions BayChat starts from now on will put a card in BayChat when");
+            out("The denied-command card is ON, with Always. A session joined to BayChat puts a card in BayChat when");
             out("Claude Code's auto mode blocks a call. Read docs/features/DENIED_COMMAND_CARD.md for what it can and can't allow.");
             return 0;
         }
         case "off":
             (0, opt_in_1.disableDeniedCard)();
-            out("The denied-command card is OFF for sessions BayChat starts from now on. Rules it kept stay until removed.");
+            out("The denied-command card is OFF. Rules it kept stay until removed.");
             return 0;
         case "sweep": {
             const now = deps.now ?? Date.now;