baychat 0.35.4 → 0.37.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.35.4",
+  "version": "0.37.0",
   "displayName": "BayChat",
   "description": "Wakes this Claude Code session the moment a BayChat message arrives: no Monitor, no 30-minute deadline. Uses the baychat CLI already on this computer (npm install -g baychat, then baychat login).",
   "author": {

package/dist/approve-hook.js

@@ -40,6 +40,7 @@ exports.describeToolRequest = describeToolRequest;
 exports.composeQuestion = composeQuestion;
 exports.decideApproval = decideApproval;
 exports.sessionFromClaude = sessionFromClaude;
+exports.linkFromClaude = linkFromClaude;
 exports.procStatFields = procStatFields;
 exports.procStartTicks = procStartTicks;
 exports.psParentOf = psParentOf;
@@ -103,6 +104,7 @@ const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
 const claude_link_1 = require("./channel/claude-link");
+const compound_command_1 = require("./denied/compound-command");
 function allowDecision() {
     return {
         hookSpecificOutput: {
@@ -210,6 +212,12 @@ function describeToolRequest(toolName, toolInput) {
         return "(its parameters could not be displayed)";
     }
 }
+/** A shell command that is more than one, as the shell reads it (denied/compound-command.ts). */
+function isChained(toolName, toolInput) {
+    if (toolName !== "Bash")
+        return false;
+    return (0, compound_command_1.compoundKind)(str((toolInput ?? {}).command)) !== null;
+}
 /** The question the card asks. Blunt on purpose: this is a shell on a server, read on a phone,
  *  and the safe answer has to be the obvious one. */
 function composeQuestion(params) {
@@ -225,6 +233,7 @@ function composeQuestion(params) {
         params.cwd ? `Working directory: ${params.cwd}` : "",
         params.permissionMode ? `Permission mode: ${params.permissionMode}` : "",
         "",
+        isChained(params.toolName, params.toolInput) ? compound_command_1.CHAINED_LINE : "",
         "Allowing runs it on that machine, now. If you did not expect this, deny.",
     ].filter((l) => l !== undefined);
     return clip(lines.join("\n").replace(/\n{3,}/g, "\n\n").trim(), QUESTION_MAX);
@@ -291,7 +300,7 @@ async function decideApproval(rawStdin, argv = [], deps = {}) {
         // re-arms across bounded holds until somebody taps (approval-wait.ts). Every outcome that is
         // not "answered with index 0" becomes a deny below.
         const outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session: opts.session, question, options: [...exports.APPROVE_OPTIONS] }, deadline, { now, sleep, log }, "baychat approve-hook");
-        return verdictOf(outcome, opts.waitSeconds);
+        return verdictOf(outcome, opts.waitSeconds, isChained(toolName, input.tool_input));
     }
     catch (err) {
         // The catch that makes the guarantee true. Anything at all — a thrown non-Error, an OOM in a
@@ -309,12 +318,13 @@ async function decideApproval(rawStdin, argv = [], deps = {}) {
  * asymmetry is the point: a future server change can make this hook over-refuse, and can never
  * make it over-permit.
  */
-function verdictOf(outcome, waitSeconds) {
+function verdictOf(outcome, waitSeconds, chained = false) {
     switch (outcome.kind) {
         case "answered":
             if (outcome.index === ALLOW_INDEX)
                 return allowDecision();
-            return deny(`answered "${outcome.answer ?? exports.APPROVE_OPTIONS[1]}" in BayChat.`);
+            // The deny's message is what Claude reads: the way out of a refused chain, not a retry of it.
+            return deny(`answered "${outcome.answer ?? exports.APPROVE_OPTIONS[1]}" in BayChat.`, chained ? compound_command_1.SPLIT_HINT : "");
         case "cancelled":
             return deny("the decision was withdrawn in BayChat without an answer.");
         case "deadline":
@@ -341,6 +351,10 @@ exports.MAX_CLAUDE_HOPS = 4;
  * Claude Code's own dialog.
  */
 function sessionFromClaude(deps = {}) {
+    return linkFromClaude(deps)?.session;
+}
+/** The channel's record for the Claude Code this hook runs under (claude-link.ts). Never throws. */
+function linkFromClaude(deps = {}) {
     const parentOf = deps.parentOf ?? psParentOf;
     const isAlive = deps.isAlive ?? claude_link_1.pidAlive;
     const readLink = deps.readLink ?? ((pid) => (0, claude_link_1.readClaudeLink)(pid));
@@ -357,7 +371,7 @@ function sessionFromClaude(deps = {}) {
                 const written = Date.parse(link.writtenAt);
                 const stale = age !== undefined && Number.isFinite(written) && written < now() - age - 5_000;
                 if (!stale)
-                    return link.session;
+                    return link;
             }
             pid = parentOf(pid);
         }

package/dist/channel/channel-check.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FEED_RETRYING_HINT = exports.FEED_DOWN_HINT = void 0;
+exports.channelCheckLine = channelCheckLine;
+exports.cmdChannelCheck = cmdChannelCheck;
+/**
+ * `baychat channel-check` — the SessionStart hook (matcher `compact`) that says when this session's
+ * BayChat feed is down after a compact (Chat_claude, 29 Oct: the feed died silently at a compact and
+ * 15 minutes of @mentions went unheard). A SessionStart hook's output reaches the model; a
+ * PostCompact one's does not, and `context-hook` runs async and prints nothing on purpose.
+ *
+ * Only for a Claude Code started with the BayChat channel (detect.ts). Its channel server records
+ * the feed's health in `claude-sessions/<pid>.json` (claude-link.ts): no record, or one that says
+ * `retrying`, prints one line telling the session to call `listen`. NEVER FAILS OR BLOCKS: any
+ * error reading either is treated as "down" for a channel session and prints the hint; exit is 0.
+ */
+const approve_hook_1 = require("../approve-hook");
+const detect_1 = require("./detect");
+exports.FEED_DOWN_HINT = "BayChat feed down: call the BayChat channel's listen tool with your session name, then get_messages to catch up.";
+exports.FEED_RETRYING_HINT = "BayChat feed down (retrying in the background): call the BayChat channel's listen tool with your session name, then get_messages to catch up.";
+/** The line to print, or undefined when there is nothing to say. Never throws. */
+function channelCheckLine(deps = {}) {
+    let active = false;
+    try {
+        active = (deps.detect ?? (() => (0, detect_1.detectChannel)()))().active;
+    }
+    catch {
+        return undefined;
+    }
+    if (!active)
+        return undefined;
+    let link;
+    try {
+        link = (deps.link ?? approve_hook_1.linkFromClaude)();
+    }
+    catch {
+        return exports.FEED_DOWN_HINT;
+    }
+    if (!link)
+        return exports.FEED_DOWN_HINT;
+    return link.feed === "retrying" ? exports.FEED_RETRYING_HINT : undefined;
+}
+async function cmdChannelCheck(deps = {}) {
+    try {
+        const line = channelCheckLine(deps);
+        if (line)
+            (deps.out ?? ((l) => console.log(l)))(line);
+    }
+    catch {
+        // Nothing: a hook that fails must never stand in the way of the session.
+    }
+    return 0;
+}

package/dist/channel/claude-link.js

@@ -69,7 +69,11 @@ function writeClaudeLink(pid, session, opts = {}) {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     sweepDeadLinks(dir, opts.isAlive ?? pidAlive);
     const file = claudeLinkPath(pid, dir);
-    const record = { session, writtenAt: (opts.now ?? (() => new Date()))().toISOString() };
+    const record = {
+        session,
+        writtenAt: (opts.now ?? (() => new Date()))().toISOString(),
+        ...(opts.feed ? { feed: opts.feed } : {}),
+    };
     // Write-then-rename, so the hook never reads half a file.
     const tmp = `${file}.${process.pid}.tmp`;
     fs.writeFileSync(tmp, `${JSON.stringify(record)}\n`, { mode: 0o600 });
@@ -89,7 +93,8 @@ function readClaudeLink(pid, dir = claudeSessionsDir()) {
         const raw = JSON.parse(fs.readFileSync(claudeLinkPath(pid, dir), "utf8"));
         if (typeof raw.session !== "string" || !raw.session.trim() || raw.session.length > 60 || typeof raw.writtenAt !== "string")
             return undefined;
-        return { session: raw.session, writtenAt: raw.writtenAt };
+        const feed = raw.feed === "retrying" ? "retrying" : raw.feed === "open" ? "open" : undefined;
+        return { session: raw.session, writtenAt: raw.writtenAt, ...(feed ? { feed } : {}) };
     }
     catch {
         return undefined;
@@ -124,9 +129,9 @@ function pidAlive(pid) {
 /** The real link: keyed by this process's parent — the Claude Code that started the channel server. */
 function realClaudeLink(log, pid = process.ppid) {
     return {
-        write: (session) => {
+        write: (session, feed) => {
             try {
-                writeClaudeLink(pid, session);
+                writeClaudeLink(pid, session, feed ? { feed } : {});
             }
             catch (err) {
                 // Approvals then stay in the terminal for this session: the hook finds no link and says nothing.

package/dist/channel/feed.js

@@ -29,6 +29,18 @@ class ChannelFeed {
     retryTimer;
     watchdogTimer;
     lastTick = 0;
+    /**
+     * A re-listen is starting a new feed for this session (server.ts). The server closes this one
+     * with 4000 once the new one is seated: taken quietly, because the new feed is this session's.
+     */
+    replacing = false;
+    /** The server closed this feed during a replacement that then failed: reconnect on cancel. */
+    closedForReplacement = false;
+    /**
+     * Down with nothing else running (a first start that failed): retried for as long as the
+     * channel lives, never given up on, and a `reset` once it is back — so the session catches up.
+     */
+    down = false;
     now;
     setTimer;
     clearTimer;
@@ -60,13 +72,13 @@ class ChannelFeed {
         const minted = await this.deps.mint(undefined);
         if (!minted.ok) {
             this.state = "stopped";
-            return { ok: false, detail: minted.detail };
+            return { ok: false, detail: minted.detail, fatal: minted.fatal };
         }
         const ready = await new Promise((resolve) => {
             const timer = this.setTimer(() => {
                 this.teardown();
                 this.state = "stopped";
-                resolve({ ok: false, detail: "The BayChat feed did not answer within 10 seconds." });
+                resolve({ ok: false, detail: "The BayChat feed did not answer within 10 seconds.", fatal: false });
             }, this.deps.readyTimeoutMs ?? READY_TIMEOUT_MS);
             this.open(minted.ticket, {
                 onReady: () => {
@@ -77,14 +89,41 @@ class ChannelFeed {
                     this.clearTimer(timer);
                     this.teardown();
                     this.state = "stopped";
-                    resolve({ ok: false, detail });
+                    resolve({ ok: false, detail, fatal: false });
                 },
             });
         });
-        if (ready.ok)
+        if (ready.ok) {
             this.armWatchdog();
+            this.deps.onHealth?.(true);
+        }
         return ready;
     }
+    /** A new feed for this session is starting: a 4000 from the server is that, not an ending. */
+    expectReplacement() {
+        this.replacing = true;
+    }
+    /** The new feed did not start: this one carries on, and reconnects if the server closed it. */
+    cancelReplacement() {
+        this.replacing = false;
+        if (this.closedForReplacement && this.state !== "stopped") {
+            this.closedForReplacement = false;
+            this.scheduleReconnect("was closed for a re-listen that did not start");
+        }
+    }
+    /**
+     * A first start that failed for now, with no other feed for this session: keep trying in the
+     * background (backoff up to a minute, never giving up), say so now, and say `reset` once back.
+     */
+    retryInBackground(detail) {
+        this.down = true;
+        this.state = "retrying";
+        this.attempt = 0;
+        this.deps.onHealth?.(false);
+        void this.deps.push(`BayChat's feed for session "${this.deps.session}" is down (${detail}); retrying in the background. ` +
+            `Until it is back this session does not hear the Bay. A reset event follows when it is back; then catch up with get_messages.`, this.meta({ event: "stopped" }));
+        this.scheduleReconnect(`did not start (${detail})`);
+    }
     /** Stop for good: no reconnect, no watchdog. Used on replace and on process exit. */
     stop() {
         const was = this.state;
@@ -174,6 +213,13 @@ class ChannelFeed {
                         this.state = "open";
                         this.attempt = 0;
                         this.log(`feed for ${this.deps.session} ready`);
+                        if (this.down) {
+                            this.down = false;
+                            this.armWatchdog();
+                            void this.pushReset();
+                        }
+                        if (!first)
+                            this.deps.onHealth?.(true);
                         first?.onReady();
                         return;
                     }
@@ -194,6 +240,12 @@ class ChannelFeed {
                         first.onFailBeforeReady(`The BayChat feed closed before it was ready (${code}${reason ? `: ${reason}` : ""}).`);
                         return;
                     }
+                    if (code === exports.CLOSE_STOPPED && this.replacing) {
+                        // The re-listen's new feed was seated: it is this session's now (server.ts stops this one).
+                        this.log(`feed for ${this.deps.session} closed for its replacement`);
+                        this.closedForReplacement = true;
+                        return;
+                    }
                     if (code === exports.CLOSE_STOPPED) {
                         // Stopped or replaced on purpose — by stop_listening, end_session, or a newer
                         // listener for this session. Reconnecting would fight whichever replaced it.
@@ -217,7 +269,9 @@ class ChannelFeed {
     scheduleReconnect(why) {
         if (this.state === "stopped")
             return;
-        if (this.attempt >= exports.MAX_FAILED_RECONNECTS) {
+        if (this.state === "open")
+            this.deps.onHealth?.(false);
+        if (!this.down && this.attempt >= exports.MAX_FAILED_RECONNECTS) {
             this.log(`feed for ${this.deps.session} gave up after ${this.attempt} failed reconnects (${why})`);
             this.stop();
             void this.pushStopped(`${this.attempt} reconnects in a row failed (last: ${why})`);

package/dist/channel/server.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ChannelService = exports.nodeFeedConnect = exports.CHANNEL_INSTRUCTIONS = void 0;
+exports.ChannelService = exports.nodeFeedConnect = exports.LISTEN_RETRY_MS = exports.CHANNEL_INSTRUCTIONS = void 0;
 exports.realCommandLink = realCommandLink;
 exports.relaySocketFor = relaySocketFor;
 exports.realLogin = realLogin;
@@ -102,6 +102,12 @@ const LISTEN_TOOL = {
         required: ["session"],
     },
 };
+/**
+ * Waits between `listen`'s attempts at a feed that failed for now (a network error, a 5xx): three
+ * attempts over about ten seconds before it answers (Chat_claude, 29 Oct: one "fetch failed" right
+ * after a compact was the whole answer, and the session heard nothing for 15 minutes).
+ */
+exports.LISTEN_RETRY_MS = [2_000, 6_000];
 /**
  * The real command link: the relay socket of the session's Bay, and the pane and Claude Code
  * process THIS process inherited — Claude Code starts the channel server, so its `$TMUX` and its
@@ -297,24 +303,36 @@ class ChannelService {
             return toolResult("failed", `Failed: ${detail} Use listen_messages and a native Monitor instead.`, { session, stage: "login", detail });
         }
         const key = `${bayName ?? ""}\u0000${session}`;
-        this.feeds.get(key)?.stop();
+        // A RE-LISTEN KEEPS WHAT RUNS until its new feed is seated (Chat_claude, 29 Oct): stopping the
+        // old feed first meant one failed mint cost the session a working feed. The old feed's relay
+        // link is reused too — a new registration would replace it at the relay, failed start or not.
+        const previous = this.feeds.get(key);
+        const live = previous && previous.currentState !== "stopped" ? previous : undefined;
+        const reused = live ? this.links.get(key) : undefined;
         // COMMANDS FIRST, so the first ticket already says whether this computer's relay runs them.
         // When that changes (the relay starts, stops or restarts), the feed is reopened so the
         // server's view follows (realtime/remote-listeners.ts). Never a reason to fail `listen`.
-        let feed;
-        const link = this.openCommandLink(key, session, bay, bayName, (registered) => feed?.reopen(registered ? "now has this computer's relay running its commands" : "lost this computer's relay"));
-        if (link)
+        const link = reused ??
+            this.openCommandLink(key, session, bay, bayName, (registered) => this.feeds.get(key)?.reopen(registered ? "now has this computer's relay running its commands" : "lost this computer's relay"));
+        if (link && !reused)
             await link.start();
-        feed = new feed_1.ChannelFeed({
+        const feed = new feed_1.ChannelFeed({
             session,
             ...(bayName ? { bayName } : {}),
             mint: (cursor) => mintTicket(this.deps, { bay, session, cursor, ...(link?.registered ? { commands: "relay" } : {}) }),
             onStop: () => {
+                // Replaced by a re-listen: the link and the hook's record are the new feed's now.
+                if (this.feeds.get(key) !== feed)
+                    return;
                 this.closeCommandLink(key, link);
                 // A stopped feed: the hook must not keep sending cards in a name that may be gone.
                 if (bay === undefined)
                     this.deps.claudeLink?.remove(session);
             },
+            onHealth: (up) => {
+                if (bay === undefined && this.feeds.get(key) === feed)
+                    this.deps.claudeLink?.write(session, up ? "open" : "retrying");
+            },
             connect: this.deps.connect,
             status: async () => {
                 try {
@@ -332,23 +350,40 @@ class ChannelService {
             log: this.deps.log,
             ...this.deps.feedOverrides,
         });
-        this.feeds.set(key, feed);
-        const started = await feed.start();
+        live?.expectReplacement();
+        const started = await this.startWithRetries(feed, session);
         if (!started.ok) {
-            this.feeds.delete(key);
-            this.closeCommandLink(key, link);
+            this.deps.log(`listen ${session}: the feed did not start: ${started.detail}`);
+            if (live) {
+                // The feed that was running carries on; only the new one is given up.
+                live.cancelReplacement();
+                return toolResult("active", `Active: a new feed could not start (${started.detail}), so the feed already running for session "${session}" ` +
+                    `keeps going. Messages still arrive as <channel> events; do NOT open a Monitor or call listen_messages.`, { session, ...(bayName ? { bay: bayName } : {}), kept: true, detail: started.detail });
+            }
+            if (!started.fatal) {
+                // Nothing else runs for this session: retry in the background rather than go quiet.
+                this.feeds.set(key, feed);
+                this.last = { key, session, bay };
+                feed.retryInBackground(started.detail);
+                return toolResult("retrying", `Retrying: the BayChat feed for session "${session}" could not start (${started.detail}). It keeps retrying in the ` +
+                    `background, and a <channel event="reset"> says when it is back — then catch up with get_messages. Until then, ` +
+                    `read get_messages when you expect a message. Do NOT open a Monitor: it would compete with this feed.`, { session, ...(bayName ? { bay: bayName } : {}), stage: "feed", detail: started.detail });
+            }
+            if (!reused)
+                this.closeCommandLink(key, link);
             if (this.last?.key === key)
                 this.last = undefined;
-            this.deps.log(`listen ${session}: the feed did not start: ${started.detail}`);
             return toolResult("failed", `Failed: ${started.detail} Use listen_messages and a native Monitor instead.`, { session, stage: "feed", detail: started.detail });
         }
+        this.feeds.set(key, feed);
+        live?.stop();
         this.last = { key, session, bay };
         // Approvals for `baychat claude` / `baychat start` (approve-hook --session-from-claude): this
         // Claude Code is now this session. Only for the default Bay, the one the hook's device login
         // asks; a session on another Bay keeps its prompts in the terminal (and clears an older link,
         // so a card never goes out in a name this Claude Code has moved on from).
         if (bay === undefined)
-            this.deps.claudeLink?.write(session);
+            this.deps.claudeLink?.write(session, "open");
         else
             this.deps.claudeLink?.remove(undefined);
         return toolResult("active", `Active: session "${session}"${bayName ? ` (${bayName})` : ""} now hears the Bay through the channel. New messages ` +
@@ -357,6 +392,19 @@ class ChannelService {
             `to catch up on anything from before listening.` +
             (link ? ` ${link.describeReach()}` : ""), { session, ...(bayName ? { bay: bayName } : {}), how: evidence.how, commands: link?.state.kind ?? "off" });
     }
+    /** `feed.start()`, again after a failure for now; a final one (a gone session) answers at once. */
+    async startWithRetries(feed, session) {
+        const sleep = this.deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+        let started = await feed.start();
+        for (const wait of exports.LISTEN_RETRY_MS) {
+            if (started.ok || started.fatal)
+                return started;
+            this.deps.log(`listen ${session}: ${started.detail}; trying again in ${wait / 1000}s`);
+            await sleep(wait);
+            started = await feed.start();
+        }
+        return started;
+    }
     /**
      * Register this session's commands with the relay (relay-link.ts). A fresh start's note
      * request comes back over it and is handed to the session as an event — the relay drops a

package/dist/denied/claims.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimDeniedEvent = claimDeniedEvent;
+// One card per denial. A session BayChat launched has its own PermissionDenied hook (in its
+// `--settings` file) AND the BayChat plugin's (hooks/hooks.json), and Claude Code runs both on
+// the same event: the first to create the event's claim file asks; the other leaves it.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("../config");
+/** Claims older than this are swept on the next claim: a denial is answered within its hook's wait. */
+const CLAIM_TTL_MS = 2 * 24 * 3600_000;
+const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
+const claimsDir = () => path.join((0, config_1.configDir)(), "denied-claims");
+/** True for the first hook to claim `toolUseId`. An id that is no safe file name claims nothing. */
+function claimDeniedEvent(toolUseId, nowMs = Date.now()) {
+    if (!SAFE_ID.test(toolUseId))
+        return false;
+    const dir = claimsDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    sweep(dir, nowMs);
+    try {
+        fs.writeFileSync(path.join(dir, toolUseId), "", { flag: "wx", mode: 0o600 });
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EEXIST")
+            return false;
+        throw err;
+    }
+}
+function sweep(dir, nowMs) {
+    for (const name of fs.readdirSync(dir)) {
+        try {
+            const file = path.join(dir, name);
+            if (nowMs - fs.statSync(file).mtimeMs > CLAIM_TTL_MS)
+                fs.rmSync(file, { force: true });
+        }
+        catch {
+            /* gone already, or another hook's: the next sweep tries again */
+        }
+    }
+}

package/dist/denied/compound-command.js

@@ -0,0 +1,51 @@
+"use strict";
+// Is a shell command ONE command, or several? Read the way a shell reads it — quotes and
+// backslashes first — never by searching the text for `&&`: `echo "a && b"` is one command.
+//
+// It matters because Claude Code checks a chain subcommand by subcommand (permissions docs,
+// "Compound commands"): a chain can only be allowed once, and the chain as typed never matches
+// the rules saved for it. Pure: no files, no network.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SPLIT_HINT = exports.CHAINED_LINE = void 0;
+exports.compoundKind = compoundKind;
+/** Why `command` is more than one command ("nested" wins over "chain"), or null when it is one. Never throws. */
+function compoundKind(command) {
+    let quote = null;
+    let chain = false;
+    for (let i = 0; i < command.length; i++) {
+        const c = command[i];
+        const next = command[i + 1];
+        if (quote === "'") {
+            if (c === "'")
+                quote = null;
+            continue;
+        }
+        if (c === "\\") {
+            i++;
+            continue;
+        }
+        // The shell still runs a substitution inside double quotes.
+        if (c === "`" || (c === "$" && next === "("))
+            return "nested";
+        if (quote === '"') {
+            if (c === '"')
+                quote = null;
+            continue;
+        }
+        if (c === "'" || c === '"')
+            quote = c;
+        else if (c === "(" || c === ")")
+            return "nested";
+        else if (c === ";" || c === "|" || c === "\n" || c === "\r")
+            chain = true;
+        // `&&` is a chain; a lone `&` sends to the background; `2>&1` and `&>` are redirections.
+        else if (c === "&" && (next === "&" || (command[i - 1] !== ">" && next !== ">")))
+            chain = true;
+    }
+    return chain ? "chain" : null;
+}
+/** The card's line for a command that is more than one (approve-hook, permission-rule). */
+exports.CHAINED_LINE = "This is a chained command: it can only be allowed once.";
+/** What the agent is told when a chain is refused: Claude Code reads a PermissionRequest deny's message. */
+exports.SPLIT_HINT = "It was a chained command: do not retry the chain. Run single commands, or write a script to a file " +
+    "and run it with one command, using absolute paths.";

package/dist/denied/opt-in.js

@@ -33,36 +33,50 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DENIED_CARD_DEFAULT = void 0;
+exports.deniedCardMode = deniedCardMode;
 exports.deniedCardEnabled = deniedCardEnabled;
 exports.enableDeniedCard = enableDeniedCard;
 exports.disableDeniedCard = disableDeniedCard;
 // Whether this computer's owner turned the denied-command card on (`baychat permissions on`).
 //
-// OFF UNTIL SOMEBODY ASKS FOR IT, like approve-hook was: the card lets a phone add a permission
-// rule on this computer, so it exists only after a deliberate act. The switch is a file in
-// `~/.baychat`, read when BayChat's launcher writes a session's `--settings` file
-// (relay/launcher/approval-settings.ts), so it takes effect for sessions started after it changes.
+// "ALLOW ONCE" UNTIL SOMEBODY ASKS FOR MORE: the card lets a phone add a permission rule on this
+// computer, so keeping one ("Always") needs a deliberate act at the terminal; `DENIED_CARD_DEFAULT`
+// is the owner's call for "nobody chose". The switch is a file in `~/.baychat`, read when BayChat's
+// launcher writes a session's `--settings` file (relay/launcher/approval-settings.ts), and by the
+// plugin's own hook on each denial (denied-hook --plugin), for sessions started by hand.
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const config_1 = require("../config");
 const optInFile = () => path.join((0, config_1.configDir)(), "denied-card.json");
-/** True only when the switch file says so. Any doubt — missing, unreadable, malformed — is off. */
-function deniedCardEnabled() {
+/** WHEN NOBODY CHOSE (no switch file): the owner's decision, kept as one line. Karmen, 2026-10-29: on,
+ *  "Allow once" only — each tap allows one exact command one time; "Always" needs `baychat permissions on`. */
+exports.DENIED_CARD_DEFAULT = "once";
+/** The switch: what its file says, the default without one, off on any doubt (unreadable, malformed). */
+function deniedCardMode() {
     try {
-        const parsed = JSON.parse(fs.readFileSync(optInFile(), "utf8"));
-        return parsed?.enabled === true;
+        const enabled = JSON.parse(fs.readFileSync(optInFile(), "utf8"))?.enabled;
+        return enabled === true ? "on" : "off";
     }
     catch (err) {
-        if (err.code !== "ENOENT") {
-            process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
-        }
-        return false;
+        if (err.code === "ENOENT")
+            return exports.DENIED_CARD_DEFAULT;
+        process.stderr.write(`baychat: ${optInFile()} could not be read, so the denied-command card is off.\n`);
+        return "off";
     }
 }
+/** True only when the owner turned the card on, Always included. */
+function deniedCardEnabled() {
+    return deniedCardMode() === "on";
+}
 function enableDeniedCard(now = new Date()) {
-    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled: true, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
+    writeSwitch(true, now);
+}
+/** Written, not deleted: an explicit off outranks any default. */
+function disableDeniedCard(now = new Date()) {
+    writeSwitch(false, now);
 }
-function disableDeniedCard() {
-    fs.rmSync(optInFile(), { force: true });
+function writeSwitch(enabled, now) {
+    fs.mkdirSync((0, config_1.configDir)(), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(optInFile(), `${JSON.stringify({ enabled, since: now.toISOString() }, null, 2)}\n`, { mode: 0o600 });
 }