baychat 0.36.0 → 0.38.0

package/dist/relay/launcher/handle.js

@@ -39,6 +39,9 @@ async function handleLaunch(launch, deps, io) {
         return refused("NAME_INVALID");
     if (launch.kind === "STOP")
         return stopSession(launch, deps);
+    const agentProblem = agentStartRefusal(launch, deps);
+    if (agentProblem)
+        return agentProblem;
     if ((0, acp_launch_1.isAcpLaunchRuntime)(launch.runtime))
         return startAcp(launch, deps);
     if (launch.runtime === "codex" && deps.codex && (0, codex_version_1.codexExecFallback)() && inDefaultBay(launch, deps)) {
@@ -58,6 +61,38 @@ async function handleLaunch(launch, deps, io) {
         return { status: "STARTED" };
     return watchForDevChannelWarning(launch, started.entry, deps, io);
 }
+/**
+ * An AGENT's start (Phase 4, docs/features/AUTOMATIONS_AND_PACKAGES.md §4.3–4.4), before anything
+ * else about it: undefined when it may go on.
+ *
+ * TWO KEYS. One that went through the owner's standing permission with no card ("agent-grant"),
+ * and a schedule's run ("schedule" — a standing permission too), needs the computer's own yes as
+ * well — the spot's `agentStarts`, which only `baychat launch add … --agent-starts` at this
+ * computer writes — or it is refused AGENT_STARTS_NOT_ALLOWED. A spot that no longer exists is
+ * left to `spotFor` (SPOT_UNKNOWN). A card-allowed start needs no flag.
+ *
+ * NEVER UNATTENDED. Any agent's start runs with its normal approval cards on the owner's phone:
+ * Claude Code with its approve hook, Codex only as the relay runs it (app-server, approvals on the
+ * phone) — never the Codex TUI with `--ask-for-approval never`, which a start in another Bay, or a
+ * relay without the Codex runner, would otherwise open. Those are refused as not offered yet.
+ */
+function agentStartRefusal(launch, deps) {
+    if (launch.startedBy === "person")
+        return undefined;
+    if (launch.startedBy === "agent-grant" || launch.startedBy === "schedule") {
+        const spot = deps.loadPolicy()?.spots.find((s) => s.id === launch.spotId);
+        if (spot && !spot.agentStarts) {
+            const who = launch.startedBy === "schedule" ? "schedules" : "agents";
+            deps.log(`launch ${launch.id}: refused, ${who} may not start sessions in "${spot.label}" without asking. Run \`baychat launch add <folder> --agent-starts\` here to allow it.`);
+            return refused("AGENT_STARTS_NOT_ALLOWED");
+        }
+    }
+    if (launch.runtime === "codex" && !relayRunsCodex(launch, deps)) {
+        deps.log(`launch ${launch.id}: refused, an agent's or a schedule's Codex start runs only as the relay runs it, with approvals on the phone`);
+        return refused(inDefaultBay(launch, deps) ? "RUNTIME_NOT_YET" : "OTHER_BAY_NOT_YET");
+    }
+    return undefined;
+}
 /** The checks every START makes before anything runs: the spot, the runtime, the room, the folder. */
 function spotFor(launch, deps) {
     const spot = deps.loadPolicy()?.spots.find((s) => s.id === launch.spotId);
@@ -530,6 +565,10 @@ function parseLaunch(raw) {
     const listen = l.listen === undefined || l.listen === "channel" ? "channel" : l.listen === "monitor" ? "monitor" : null;
     if (!listen)
         return null;
+    // Missing = an older server = a person's start. Anything unknown is malformed, never a person.
+    const startedBy = l.startedBy === undefined ? "person" : STARTED_BY.find((s) => s === l.startedBy);
+    if (!startedBy)
+        return null;
     return {
         id: l.id,
         kind: l.kind,
@@ -545,8 +584,10 @@ function parseLaunch(raw) {
         commandAuthorized: l.commandAuthorized === true,
         // Only an explicit "any" on a STOP widens it; anything else is the launcher's own sessions.
         ...(l.kind === "STOP" && l.scope === "any" ? { scope: "any" } : {}),
+        startedBy,
     };
 }
+const STARTED_BY = ["person", "agent-card", "agent-grant", "schedule"];
 /**
  * Which of this computer's Bay connections a launch joins on. `entry` is the MCP connection to
  * name in the `/baychat` line — undefined when there is only one, so there is nothing to choose

package/dist/relay/launcher/loop.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.deviceRequest = void 0;
+exports.deviceRequest = exports.LAUNCH_LEVEL = void 0;
 exports.startLauncher = startLauncher;
 const fs = __importStar(require("fs"));
 const api_1 = require("../../api");
@@ -241,6 +241,13 @@ function realLoopDeps(auth, log, signal, { forgetSession, registeredSession, reg
             : {}),
     };
 }
+/**
+ * This relay's launch level (security sweep S4, 29 Oct): 1 = it honours `startedBy` and a folder's
+ * `--agent-starts`, so the server may hand it a standing permission's start (an agent's "Always",
+ * a schedule). Sent as a header on every device-API call — never in the capabilities body, whose
+ * strict schema on an older server would refuse the whole report.
+ */
+exports.LAUNCH_LEVEL = 1;
 /**
  * The device API, with an abort signal and a deadline. Unlike `apiRequest` it accepts the empty
  * `204` the capabilities PUT and the report answer with.
@@ -248,7 +255,7 @@ function realLoopDeps(auth, log, signal, { forgetSession, registeredSession, reg
 const deviceRequest = async (auth, method, apiPath, body, signal) => {
     const res = await fetch(`${auth.baseUrl}${apiPath}`, {
         method,
-        headers: { Authorization: `Bearer ${auth.token}`, "Content-Type": "application/json" },
+        headers: { Authorization: `Bearer ${auth.token}`, "Content-Type": "application/json", "X-BayChat-Launch-Level": String(exports.LAUNCH_LEVEL) },
         body: body === undefined ? undefined : JSON.stringify(body),
         signal: AbortSignal.any([signal, AbortSignal.timeout(WAIT_SECONDS * 1000 + REQUEST_GRACE_MS)]),
     });

package/hooks/hooks.json

@@ -1,5 +1,5 @@
 {
-  "description": "BayChat's denied-command card for every session, also ones started by hand: an auto-mode denial becomes a card in the session's BayChat chat once it has joined (docs/features/DENIED_COMMAND_CARD.md). No PostToolUse hook: it would start baychat on every tool call.",
+  "description": "BayChat's denied-command card for every session, also ones started by hand: an auto-mode denial becomes a card in the session's BayChat chat once it has joined (docs/features/DENIED_COMMAND_CARD.md). After a compact, a channel session is told when its BayChat feed is down (channel-check). A question left open in the terminal (a permission dialog, an MCP form) becomes one line on the owner's phone (notify-hook). No PostToolUse hook: it would start baychat on every tool call.",
   "hooks": {
     "PermissionDenied": [
       {
@@ -13,6 +13,30 @@
           }
         ]
       }
+    ],
+    "SessionStart": [
+      {
+        "matcher": "compact",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "baychat channel-check",
+            "timeout": 10
+          }
+        ]
+      }
+    ],
+    "Notification": [
+      {
+        "matcher": "permission_prompt|elicitation_dialog|elicitation_url_dialog",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "baychat notify-hook",
+            "timeout": 30
+          }
+        ]
+      }
     ]
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "BayChat connector CLI — pair an agent session (Claude Code, Codex, Cursor) with BayChat, or have the relay run DeepSeek or the Cursor CLI for you",
   "bin": {
     "baychat": "dist/index.js"