baychat 0.35.4 → 0.37.0

package/dist/denied/permission-rule.js

@@ -22,17 +22,19 @@
 // The card text is built from `shown`, which masks obvious secrets; the rule is built from the
 // real text, because a rule that differs from the call matches nothing.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_RULE_COMMAND_LENGTH = void 0;
+exports.CHAINED_LIMITATION = exports.MAX_RULE_COMMAND_LENGTH = void 0;
 exports.planDeniedCall = planDeniedCall;
 exports.callKeyOf = callKeyOf;
 exports.sameCall = sameCall;
 exports.redactSecrets = redactSecrets;
+const compound_command_1 = require("./compound-command");
 /** Longer than this is not a command a person can check on a phone, nor one a rule should hold. */
 exports.MAX_RULE_COMMAND_LENGTH = 1000;
 /** Claude Code itself saves at most five rules for one approved chain (permissions docs). */
 const MAX_CHAIN_PARTS = 5;
+/** What the card says for every chain: the agent reads it too (the deny message, approve-hook). */
+exports.CHAINED_LIMITATION = `${compound_command_1.CHAINED_LINE} Ask the session to split it into single commands or a script it runs with one command.`;
 /** `&&`, `||`, `|&`, `;`, `|`, and a lone `&` that is not part of a redirection (`2>&1`, `&>`). */
-const CHAIN_OPERATOR = /&&|\|\||\|&|;|\||(?<![>&])&(?![>&])/;
 const CHAIN_SPLIT = /\s*(?:&&|\|\||\|&|;|\||(?<![>&])&(?![>&]))\s*/;
 const NESTED_COMMAND = /`|\$\(|[()]/;
 const MCP_TOOL = /^mcp__[A-Za-z0-9_-]+__[A-Za-z0-9_.-]+$/;
@@ -75,23 +77,22 @@ function planBash(command) {
             "approve it at the computer.");
     }
     const call = { tool: "Bash", subject: command };
-    if (CHAIN_OPERATOR.test(command)) {
+    // A chain as the shell reads it (compound-command.ts): `echo "a && b"` is one command.
+    if ((0, compound_command_1.compoundKind)(command) === "chain") {
         if (/["'\\]/.test(command)) {
-            return nothing(shown, "It chains several commands and quotes text, so BayChat cannot split it safely; ask the session to " +
-                "run them one at a time.");
+            return nothing(shown, `${exports.CHAINED_LIMITATION} It also quotes text, so BayChat cannot split it safely; approve it at the computer.`);
         }
         const parts = command.split(CHAIN_SPLIT);
         if (parts.some((p) => p === "") || parts.length > MAX_CHAIN_PARTS) {
-            return nothing(shown, "BayChat cannot split this chain into exact commands; approve it at the computer.");
+            return nothing(shown, `${exports.CHAINED_LIMITATION} BayChat cannot split this one; approve it at the computer.`);
         }
         return {
             shown,
             onceRules: [...new Set(parts.map((p) => `Bash(${p})`))],
             alwaysAllowed: false,
             // One plain line on WHY, because the usual cause is the agent's own habit (`cd … && x | tail`)
-            // and the fix is for the session to run the command by itself.
-            limitation: `"Always" isn't offered: this chains ${parts.length} commands, and a saved rule only ever covers one plain ` +
-                `command. Run it on its own (no cd … &&, no | tail) to be offered "Always".`,
+            // and the fix is for the session to run single commands.
+            limitation: exports.CHAINED_LIMITATION,
             call,
         };
     }

package/dist/denied-hook.js

@@ -88,11 +88,13 @@ const approve_hook_1 = require("./approve-hook");
 const approval_wait_1 = require("./approval-wait");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
+const claims_1 = require("./denied/claims");
 const confirm_1 = require("./denied/confirm");
 const grants_1 = require("./denied/grants");
 const hook_log_1 = require("./denied/hook-log");
 const live_session_1 = require("./denied/live-session");
 const notice_1 = require("./denied/notice");
+const opt_in_1 = require("./denied/opt-in");
 const permission_rule_1 = require("./denied/permission-rule");
 const settings_rules_1 = require("./denied/settings-rules");
 const transcript_1 = require("./denied/transcript");
@@ -180,6 +182,7 @@ function parseArgs(argv) {
     return {
         session: at("--session"),
         fromClaude: argv.includes("--session-from-claude"),
+        plugin: argv.includes("--plugin"),
         waitSeconds: Number.isFinite(rawTimeout) && rawTimeout > 0 ? rawTimeout : approve_hook_1.DEFAULT_WAIT_SECONDS,
     };
 }
@@ -227,6 +230,22 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
             log(`${LOG_LABEL}: this session has not joined BayChat yet; the denial stands.`);
             return null;
         }
+        // The switch decides on every denial: the plugin's hook runs in every session, and a launched
+        // session's own hook was written while the switch was not off (it may have changed since).
+        const mode = (deps.cardMode ?? opt_in_1.deniedCardMode)();
+        if (mode === "off") {
+            log(`${LOG_LABEL}: the denied-command card is off on this computer; the denial stands.`);
+            return null;
+        }
+        const eventId = str(input.tool_use_id);
+        if (opts.plugin && !eventId) {
+            log(`${LOG_LABEL}: the event has no tool_use_id to take it by; the denial stands.`);
+            return null;
+        }
+        if (eventId && !(deps.claimEvent ?? claims_1.claimDeniedEvent)(eventId)) {
+            log(`${LOG_LABEL}: another BayChat hook already took this denial.`);
+            return null;
+        }
         const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
         if (!device) {
             log(`${LOG_LABEL}: this machine is not logged in to BayChat (\`baychat login\`); the denial stands.`);
@@ -301,7 +320,13 @@ async function decideDenied(rawStdin, argv = [], deps = {}) {
                 limitation: `BayChat can't allow it from here: ${choice.why}, so no rule can be saved. ` +
                     "Approve it at the computer (/permissions → Recently denied).",
             }
-            : planned;
+            : mode === "once" && planned.alwaysAllowed
+                ? {
+                    ...planned,
+                    alwaysAllowed: false,
+                    limitation: "\"Always\" is off on this computer (`baychat permissions on` at the computer turns it on).",
+                }
+                : planned;
         const target = choice.scope === "none" ? undefined : choice;
         const question = composeDeniedQuestion({
             who,

package/dist/launch/command.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.trustByHand = exports.CODEX_UNATTENDED_NOTICE = exports.APPROVALS_NOTICE = exports.LAUNCH_USAGE = void 0;
+exports.trustByHand = exports.CODEX_UNATTENDED_NOTICE = exports.AGENT_STARTS_NOTICE = exports.APPROVALS_NOTICE = exports.LAUNCH_USAGE = void 0;
 exports.cmdLaunch = cmdLaunch;
 const path = __importStar(require("path"));
 const args_1 = require("../args");
@@ -41,13 +41,18 @@ const multiplexer_launch_1 = require("../multiplexer-launch");
 const policy_1 = require("../relay/acp/policy");
 const claude_trust_1 = require("./claude-trust");
 const policy_2 = require("./policy");
-exports.LAUNCH_USAGE = `Usage: baychat launch add <folder> [--label <label>] [--runtime claude,codex] [--max <n>] [--unattended]
+exports.LAUNCH_USAGE = `Usage: baychat launch add <folder> [--label <label>] [--runtime claude,codex] [--max <n>] [--unattended] [--agent-starts]
                                   Let BayChat start sessions in <folder> from the app
                                   (--unattended: also let it start Codex there, which then never asks)
+                                  (--agent-starts: agents you allowed "Always" may start sessions there without asking you each time)
        baychat launch list         The folders BayChat may start sessions in
        baychat launch remove <id>  Stop offering one of them`;
 /** Printed by every `add`: the one thing a person must know before saying yes. */
 exports.APPROVALS_NOTICE = "Claude Code sessions started here from BayChat ask for approvals in BayChat.";
+/** Printed by an `add … --agent-starts`: what the second key opens, and what it never does. */
+exports.AGENT_STARTS_NOTICE = "Agents you allowed with \"Always for this agent here\" on their card may start sessions here without asking you each time — " +
+    "only for this folder, computer and runtime, for 30 days, and only with no task or one of your own messages as the task: a task an agent or anyone else writes still asks. " +
+    "Those sessions ask for approvals in BayChat like any other; they never start Codex unattended. Revoke an agent in Settings → Devices.";
 /** Printed when Codex is offered: what it may do without asking, and what it asks on the phone. */
 exports.CODEX_UNATTENDED_NOTICE = "Codex started here from BayChat is run by the relay (Codex 0.160 or newer): it can change files in this folder without asking, with no network, " +
     "and asks for approval in BayChat — on the session owner's phone — before anything more (a command outside its sandbox, network access, files elsewhere). " +
@@ -89,6 +94,7 @@ async function addSpot(args, deps) {
     const runtimeList = (0, args_1.flag)(args, "--runtime");
     const maxRaw = (0, args_1.flag)(args, "--max");
     const unattended = args.includes("--unattended");
+    const agentStarts = args.includes("--agent-starts");
     const valued = new Set([label, runtimeList, maxRaw].filter((v) => v !== undefined));
     const folderArg = args.find((a) => !a.startsWith("--") && !valued.has(a));
     if (unattended && !(runtimeList ?? "").split(",").map((r) => r.trim()).includes("codex")) {
@@ -127,11 +133,14 @@ async function addSpot(args, deps) {
         runtimes: [...new Set(requested)],
         maxSessions,
         ...(unattended ? { unattendedCodex: true } : {}),
+        ...(agentStarts ? { agentStarts: true } : {}),
     };
     (0, policy_2.saveLaunchPolicy)((0, policy_2.upsertSpot)(policy, spot), deps.policyFile);
     deps.print(`${existing ? "Updated" : "Added"} "${spot.label}" (${spot.id}): ${spot.path}`);
     deps.print(`  Agents: ${spot.runtimes.join(", ")} · at most ${spot.maxSessions} at once`);
     deps.print(`  ${exports.APPROVALS_NOTICE}`);
+    if (spot.agentStarts)
+        deps.print(`  ${exports.AGENT_STARTS_NOTICE}`);
     if (spot.runtimes.includes("codex")) {
         deps.print(spot.unattendedCodex
             ? `  ${exports.CODEX_UNATTENDED_NOTICE}`
@@ -176,8 +185,10 @@ function listSpots(deps) {
         deps.print("BayChat may not start sessions on this computer. Add a folder with `baychat launch add <folder>`.");
         return 0;
     }
-    for (const s of policy.spots)
-        deps.print(`${s.id}  "${s.label}"  ${s.path}  [${s.runtimes.join(", ")}] max ${s.maxSessions}`);
+    for (const s of policy.spots) {
+        const flags = [s.unattendedCodex ? "unattended Codex" : "", s.agentStarts ? "agent starts" : ""].filter(Boolean);
+        deps.print(`${s.id}  "${s.label}"  ${s.path}  [${s.runtimes.join(", ")}] max ${s.maxSessions}${flags.length ? `  (${flags.join(", ")})` : ""}`);
+    }
     return 0;
 }
 function removeSpotById(args, deps) {

package/dist/launch/policy.js

@@ -136,7 +136,7 @@ function resolveSpotFolder(spot) {
 function parseSpot(entry) {
     if (!entry || typeof entry !== "object")
         return null;
-    const { id, label, path: p, runtimes, maxSessions, unattendedCodex } = entry;
+    const { id, label, path: p, runtimes, maxSessions, unattendedCodex, agentStarts } = entry;
     if (typeof id !== "string" || !exports.SPOT_ID_RE.test(id))
         return null;
     if (typeof label !== "string" || label.trim().length === 0 || label.length > exports.SPOT_LABEL_MAX)
@@ -150,5 +150,15 @@ function parseSpot(entry) {
         return null;
     if (unattendedCodex !== undefined && unattendedCodex !== true)
         return null;
-    return { id, label, path: p, runtimes: [...new Set(runtimes)], maxSessions, ...(unattendedCodex ? { unattendedCodex } : {}) };
+    if (agentStarts !== undefined && agentStarts !== true)
+        return null;
+    return {
+        id,
+        label,
+        path: p,
+        runtimes: [...new Set(runtimes)],
+        maxSessions,
+        ...(unattendedCodex ? { unattendedCodex } : {}),
+        ...(agentStarts ? { agentStarts } : {}),
+    };
 }

package/dist/main.js

@@ -6,6 +6,7 @@ const approve_hook_1 = require("./approve-hook");
 const denied_hook_1 = require("./denied-hook");
 const permissions_command_1 = require("./permissions-command");
 const context_hooks_command_1 = require("./context-hooks-command");
+const channel_check_1 = require("./channel/channel-check");
 const session_name_1 = require("./session-name");
 const start_command_1 = require("./start-command");
 const update_command_1 = require("./update-command");
@@ -337,6 +338,9 @@ async function main() {
             return await (0, permissions_command_1.cmdPermissions)(args);
         case "context-hooks":
             return await (0, context_hooks_command_1.cmdContextHooks)(args);
+        case "channel-check":
+            // The plugin's SessionStart (compact) hook. Never throws, always 0 (channel/channel-check.ts).
+            return await (0, channel_check_1.cmdChannelCheck)();
         case "doctor":
             // Deliberately placed with the setup commands: it is the thing you run
             // when one of them did not take, and the one command that inspects all

package/dist/mcp.js

@@ -252,6 +252,9 @@ async function handleSendMessage(args) {
             // message that quotes nothing must not claim to quote something.
             ...(args.replyToMessageId ? { replyToMessageId: args.replyToMessageId } : {}),
             ...(args.card ? { card: args.card } : {}),
+            ...(args.threadRootId ? { threadRootId: args.threadRootId } : {}),
+            ...(args.handoff !== undefined ? { handoff: args.handoff } : {}),
+            ...(args.result !== undefined ? { result: args.result } : {}),
         });
         const carried = ids.length > 0 ? ` with ${ids.length} attachment${ids.length === 1 ? "" : "s"}` : "";
         return (0, mcp_result_1.ok)(`Sent message ${message.id} at ${message.createdAt}${carried}.`, message);

package/dist/permissions-command.js

@@ -26,9 +26,12 @@ async function cmdPermissions(args, deps = {}) {
     const [sub = "list", ...rest] = args;
     switch (sub) {
         case "list": {
-            out((0, opt_in_1.deniedCardEnabled)()
-                ? "The denied-command card is ON for sessions BayChat starts (`baychat permissions off` turns it off)."
-                : "The denied-command card is OFF (`baychat permissions on` turns it on).");
+            const mode = (0, opt_in_1.deniedCardMode)();
+            out(mode === "on"
+                ? "The denied-command card is ON, with Always, for sessions joined to BayChat (`baychat permissions off` turns it off)."
+                : mode === "once"
+                    ? "The denied-command card offers Allow once for sessions joined to BayChat (`baychat permissions on` adds Always, `off` turns it off)."
+                    : "The denied-command card is OFF (`baychat permissions on` turns it on).");
             const grants = (0, grants_1.listGrants)();
             if (grants.length === 0) {
                 out("BayChat keeps no permission rules on this computer.");
@@ -60,13 +63,13 @@ async function cmdPermissions(args, deps = {}) {
                 return 1;
             }
             (0, opt_in_1.enableDeniedCard)();
-            out("The denied-command card is ON. Sessions BayChat starts from now on will put a card in BayChat when");
+            out("The denied-command card is ON, with Always. A session joined to BayChat puts a card in BayChat when");
             out("Claude Code's auto mode blocks a call. Read docs/features/DENIED_COMMAND_CARD.md for what it can and can't allow.");
             return 0;
         }
         case "off":
             (0, opt_in_1.disableDeniedCard)();
-            out("The denied-command card is OFF for sessions BayChat starts from now on. Rules it kept stay until removed.");
+            out("The denied-command card is OFF. Rules it kept stay until removed.");
             return 0;
         case "sweep": {
             const now = deps.now ?? Date.now;