baychat 0.39.0 → 0.40.0

package/dist/relay/daemon.js

@@ -48,6 +48,7 @@ const bay_deleted_1 = require("../bay-deleted");
 const context_report_1 = require("../context-report");
 const codex_context_1 = require("./codex-context");
 const session_commands_1 = require("./session-commands");
+const terminal_stop_1 = require("./terminal-stop");
 const terminal_pane_1 = require("./terminal-pane");
 const compact_command_1 = require("./compact-command");
 const fresh_start_1 = require("./fresh-start");
@@ -651,6 +652,13 @@ class RelayDaemon {
         // own app-server daemon, for the thread the join corroborated (codex-control.ts).
         if (await this.runJoinedCodexCommand(session, target, command, compact.focus, say))
             return;
+        // `/stop` for a session in someone's own terminal (the app's Stop): owner only, one interrupt
+        // through `interruptPane` (terminal-stop.ts). Relay-run sessions keep their own `/stop` below.
+        if (command.id === "stop" && !target.acp && !target.codex) {
+            if (target.delivery === "channel" && !this.channelLinked(session))
+                return say((0, channel_sessions_1.channelGoneReason)(session));
+            return (0, terminal_stop_1.runTerminalStop)(session, target, message, say);
+        }
         // `/mode-*`, `/stop`, and what `/status` `/exit` `/clear` `/new` mean with no terminal.
         if (await (0, commands_1.runAcpSessionCommand)(this.acp, session, target, message, command, say))
             return;

package/dist/relay/launcher/approval-settings.js

@@ -114,19 +114,26 @@ function permissionHook(cli, flags) {
                 ],
             },
         ],
+        ...afterHooks(cli),
     };
 }
-/** The tools the after-hook watches: the ones a once-rule can be written for (permission-rule.ts). */
-const DENIED_AFTER_MATCHER = "Bash|WebFetch|mcp__.*";
+/**
+ * The tools the after-hook watches: every tool that can draw a permission dialog — a card answered at
+ * the keyboard is closed from here (card-after.ts) — which covers the once-rule tools too
+ * (permission-rule.ts: Bash, WebFetch, MCP).
+ */
+const AFTER_MATCHER = "Bash|Edit|Write|MultiEdit|NotebookEdit|WebFetch|WebSearch|mcp__.*";
 /** The after-hook is async and returns in milliseconds; this bounds only a wedged one. */
-const DENIED_AFTER_TIMEOUT_SECONDS = 30;
+const AFTER_TIMEOUT_SECONDS = 30;
 /**
- * The denied-command card's hooks (docs/features/DENIED_COMMAND_CARD.md). `flags` are the same
- * session flags approve-hook gets in that file.
+ * The async after-hook (`denied-after`): takes an "Allow once" rule back out, and closes a permission
+ * card answered in the terminal instead (fix/needs-you-closes-itself — measured on Claude Code
+ * 2.1.316, a "Yes" at the keyboard leaves approve-hook parked and its card open). In every file that
+ * has approve-hook, whatever the denied-card switch says.
  */
-function deniedCardHooks(cli, flags) {
+function afterHooks(cli) {
     const after = {
-        matcher: DENIED_AFTER_MATCHER,
+        matcher: AFTER_MATCHER,
         hooks: [
             {
                 type: "command",
@@ -134,10 +141,17 @@ function deniedCardHooks(cli, flags) {
                 args: [cli.entry, "denied-after"],
                 // Never in a tool call's way: Claude Code starts it and carries on.
                 async: true,
-                timeout: DENIED_AFTER_TIMEOUT_SECONDS,
+                timeout: AFTER_TIMEOUT_SECONDS,
             },
         ],
     };
+    return { PostToolUse: [after], PostToolUseFailure: [after] };
+}
+/**
+ * The denied-command card's hooks (docs/features/DENIED_COMMAND_CARD.md). `flags` are the same
+ * session flags approve-hook gets in that file.
+ */
+function deniedCardHooks(cli, flags) {
     return {
         PermissionDenied: [
             {
@@ -155,8 +169,7 @@ function deniedCardHooks(cli, flags) {
                 ],
             },
         ],
-        PostToolUse: [after],
-        PostToolUseFailure: [after],
+        ...afterHooks(cli),
     };
 }
 /** `settings` with the denied-command card's hooks added beside its own. Pure. */

package/dist/relay/pane-interrupt.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERRUPT_KEYS = void 0;
+exports.isBusy = isBusy;
+exports.interruptPane = interruptPane;
+const child_process_1 = require("child_process");
+const terminal_pane_1 = require("./terminal-pane");
+/**
+ * Stop: interrupt the turn a terminal session is working on (docs/design/AGENT_STOP_UNDO.md §2.5).
+ *
+ * ── THE ONLY KEYSTROKE PATH THAT IS NOT TEXT ─────────────────────────────────────────
+ *
+ * `typeIntoPane` types TEXT, always with `-l`, so nothing it sends can ever be read as a key name.
+ * Stop needs one real key, so it lives here, apart, and is narrower still:
+ *
+ *   1. the same pane checks as every keystroke (`verifyPane`: this user's socket, the runtime still
+ *      in the foreground — a shell left behind is never typed into);
+ *   2. TWO looks 700 ms apart must both show the runtime's own "working" line — no work, no key;
+ *   3. ONE key from a frozen table, by key name, with no `-l` and no Enter;
+ *   4. one more look after 1 s: the working line gone is DONE, still there is FAILED. No second key.
+ *
+ * Escape, not Ctrl-C: in Claude Code and Codex, Esc interrupts the current turn and keeps the
+ * session; Ctrl-C twice EXITS Claude Code, so a doubled Ctrl-C would be an End by accident. The wire
+ * carries the command name `interrupt`, never a key: the key is decided here and only here.
+ */
+exports.INTERRUPT_KEYS = Object.freeze({ claude: "Escape", codex: "Escape" });
+/**
+ * The line each runtime shows while a turn runs. A runtime without a row is never busy.
+ *
+ * Claude Code, captured on this Mac 1 Nov 2026 (native build, a turn running):
+ *   "· Infusing… (3m 25s · ↓ 12.3k tokens · thought for 1s)"
+ * — a spinner glyph, a gerund ending in "…", then "(" and the elapsed time. Older builds added
+ * "· esc to interrupt"; the current one does not, so the time is what proves a turn runs. A finished
+ * turn reads "✻ Worked for 3m 25s" (no "…", no "("), which must NOT match.
+ * Codex: "• Working (8s • esc to interrupt)".
+ */
+const BUSY_LINES = Object.freeze({
+    claude: /^\s*\S\s+\S+…\s+\((?:\d+h\s+)?(?:\d+m\s+)?\d+s\b|esc to interrupt/im,
+    codex: /esc to interrupt/i,
+});
+/** The first look, the second look, and the check after the key, in ms. */
+const SECOND_LOOK_MS = 700;
+const AFTER_KEY_MS = 1000;
+/**
+ * How many lines at the bottom of the pane are read. The working line sits right above the input
+ * box (captured 1 Nov: 8 lines from the bottom, under a two-line tip). Anything higher up is the
+ * conversation — and a chat, a log or a review can QUOTE a working line there while the session is
+ * idle (vps, review of fc377a96e), which must never earn an Escape.
+ */
+const BOTTOM_LINES = 12;
+/** Does this capture show `runtime` working on a turn right now? Only its bottom counts. */
+function isBusy(runtime, capture) {
+    const line = BUSY_LINES[runtime];
+    if (!line)
+        return false;
+    const lines = capture.split("\n");
+    // capture-pane pads to the pane's height with empty lines; the bottom is the last line drawn.
+    while (lines.length > 0 && lines[lines.length - 1].trim() === "")
+        lines.pop();
+    return line.test(lines.slice(-BOTTOM_LINES).join("\n"));
+}
+/** Interrupt the session's current turn, or say honestly why not. Never throws. */
+async function interruptPane(handle, runtime, deps = {}) {
+    if (handle.kind !== "tmux") {
+        return { outcome: "UNREACHABLE", reason: `${handle.kind} can't be stopped from BayChat yet — tmux can.` };
+    }
+    const key = exports.INTERRUPT_KEYS[runtime];
+    if (!key)
+        return { outcome: "UNREACHABLE", reason: `${runtime} can't be stopped from BayChat.` };
+    const check = (deps.verify ?? terminal_pane_1.verifyPane)(handle, runtime, undefined, deps.ownerPid);
+    if (!check.ok)
+        return { outcome: "UNREACHABLE", reason: check.reason };
+    const capture = deps.capture ?? capturePane;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const exec = deps.exec ?? runQuietly;
+    try {
+        if (!isBusy(runtime, await capture(handle)))
+            return { outcome: "NOTHING_RUNNING" };
+        await sleep(SECOND_LOOK_MS);
+        if (!isBusy(runtime, await capture(handle)))
+            return { outcome: "NOTHING_RUNNING" };
+    }
+    catch (err) {
+        return { outcome: "UNREACHABLE", reason: `the pane could not be read: ${errText(err)}` };
+    }
+    try {
+        // A KEY NAME, deliberately without `-l`; and no Enter.
+        await exec("tmux", ["-S", handle.socket, "send-keys", "-t", handle.pane, key]);
+    }
+    catch (err) {
+        return { outcome: "FAILED", reason: `tmux refused the key: ${errText(err)}` };
+    }
+    await sleep(AFTER_KEY_MS);
+    try {
+        return isBusy(runtime, await capture(handle)) ? { outcome: "FAILED", reason: "it is still working" } : { outcome: "DONE" };
+    }
+    catch (err) {
+        return { outcome: "FAILED", reason: `the pane could not be read after the key: ${errText(err)}` };
+    }
+}
+function capturePane(handle) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)("tmux", ["-S", handle.socket, "capture-pane", "-p", "-t", handle.pane], { timeout: 5_000, encoding: "utf8" }, (err, out) => err ? reject(err) : resolve(String(out)));
+    });
+}
+function runQuietly(file, args) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(file, args, { timeout: 5_000 }, (err) => (err ? reject(err) : resolve()));
+    });
+}
+function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/relay/session-commands.js

@@ -29,7 +29,7 @@ exports.SESSION_COMMANDS = [
     { id: "mode-read", trigger: "/mode-read", mode: "read", summary: "Relay-run agents: may read files, no commands, no writes. Owner or anyone with command access." },
     { id: "mode-ask", trigger: "/mode-ask", mode: "ask", summary: "Relay-run agents: may run commands; writes ask on your phone first. Owner or anyone with command access." },
     { id: "mode-full", trigger: "/mode-full", mode: "full", summary: "Relay-run agents: may write inside its folder without asking. Owner or anyone with command access." },
-    { id: "stop", trigger: "/stop", summary: "Relay-run agents: stop the turn that is running now." },
+    { id: "stop", trigger: "/stop", summary: "Stop the turn that is running now (its owner; a terminal session needs tmux)." },
     {
         id: "exit",
         trigger: "/exit",

package/dist/relay/terminal-stop.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runTerminalStop = runTerminalStop;
+const pane_interrupt_1 = require("./pane-interrupt");
+/**
+ * `/stop` for a session running in someone's own terminal (AGENT_STOP_UNDO.md §2) — what the app's
+ * Stop button sends, and what the owner may type in a chat.
+ *
+ * OWNER ONLY. Stop is a keystroke into a terminal on the owner's own computer; a person she granted
+ * command access may tidy a session, never stop it (§2.2). `senderIsOwner` is decided by the server
+ * at hand-over, so this is the second check after the app's route.
+ *
+ * One interrupt (`interruptPane`: two looks, one Escape, one look after) and one reply that says what
+ * the pane showed. Relay-run sessions (ACP, Codex) keep their own `/stop`; this is only reached for a
+ * session in a terminal.
+ */
+async function runTerminalStop(session, target, message, say, deps = {}) {
+    if (message.senderIsOwner !== true) {
+        await say(`Only the owner of "${session}" can stop it.`);
+        return;
+    }
+    if (!target.pane) {
+        await say(`"${session}" isn't in a tmux terminal, so BayChat can't stop it. Stop it in its own terminal.`);
+        return;
+    }
+    const interrupt = deps.interrupt ?? ((handle, runtime, opts) => (0, pane_interrupt_1.interruptPane)(handle, runtime, opts));
+    const result = await interrupt(target.pane, target.runtime, { ownerPid: target.ownerPid });
+    await say(stopReply(session, result));
+}
+function stopReply(session, result) {
+    switch (result.outcome) {
+        case "DONE":
+            return `Stopped "${session}". It is waiting for you; anything it already did stays done.`;
+        case "NOTHING_RUNNING":
+            return `"${session}" was not working on anything, so nothing was sent.`;
+        case "FAILED":
+            return `"${session}" did not stop (${result.reason ?? "it is still working"}). Stop it in its own terminal.`;
+        default:
+            return `"${session}" can't be stopped from BayChat (${result.reason ?? "its terminal can't be reached"}). Stop it in its own terminal.`;
+    }
+}

package/dist/relay/updates.js

@@ -22,11 +22,13 @@ const project_notes_1 = require("./project-notes");
  *     app offers it, and BayChat starts one itself, only while every polling relay says so.
  *   - `notice`: it shows sessions BayChat's 90% memory notice (context-notice.ts, protocol 1.17),
  *     so it may be handed it — and have it marked sent.
+ *   - `interrupt`: its `/stop` reaches a session in a tmux terminal too (terminal-stop.ts: owner
+ *     only, one Escape) — the app offers Stop only while every polling relay says so.
  *
  * ONE list for every door: this long-poll's query, the WebSocket `hello` (ws.ts splits this same
  * string) and so the device feed's feature record.
  */
-exports.RELAY_FEATURES = "brief,compact,freshstart,notes,notice";
+exports.RELAY_FEATURES = "brief,compact,freshstart,notes,notice,interrupt";
 /** Server clamps `wait` into [1s, 30s]; 25s stays under the usual 60s proxy idle timeout. */
 const WAIT_SECONDS = 25;
 /** Backoff bounds for transient failures (5xx, 429, network). */

package/dist/tool-defs.js

@@ -224,8 +224,8 @@ exports.CONVERSATION_TOOL_DEFS = [
             "acknowledge (react instead). Be concise; @mention a person only when you need them (it " +
             "reaches them even if muted). Answering a specific message: pass replyToMessageId, which " +
             "quotes it and marks it ✅ for you (a progress update: done=false). To relay a " +
-            "calendar event or an email pass `card`, with `content` as a one-line plain-text fallback. " +
-            "Decisions go through request_approval, not here.",
+            "calendar event or an email, or to show a chart or a page, pass `card`, with `content` as a one-line " +
+            "plain-text fallback. Decisions go through request_approval, not here.",
         inputSchema: {
             conversationId: zod_1.z.string().describe(CONVERSATION_ID),
             content: zod_1.z.string().describe("Message text."),
@@ -255,13 +255,17 @@ exports.CONVERSATION_TOOL_DEFS = [
                 .describe("Ids of files you already uploaded, attached in order."),
             card: zod_1.z
                 .object({
-                type: zod_1.z.enum(["card.calendar", "card.email"]),
+                type: zod_1.z.enum(["card.calendar", "card.email", "card.chart", "card.page"]),
                 payload: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()),
             })
                 .optional()
                 .describe("Render as a card. card.calendar: title, start, end (ISO 8601), location, attendees " +
                 "[{name,address}], notes. card.email: subject, from {name,address} (display only), " +
-                "snippet, body, timestamp. A card OR attachments, never both."),
+                "snippet, body, timestamp. card.chart: title, kind bar|line, labels[2-31], " +
+                "series[1-3]{name?, values[] (one per label), highlight?[] (indexes)}, unit?, note?, " +
+                "key? (same key again = its next version, v2). Data only: BayChat draws it. " +
+                "card.page: title, body (markdown, ≤20,000 chars; no HTML, images show as links), key?. " +
+                "A card OR attachments, never both."),
         },
         _meta: exports.ALWAYS_LOAD_META,
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.39.0",
+  "version": "0.40.0",
   "description": "BayChat connector CLI — pair an agent session (Claude Code, Codex, Cursor) with BayChat, or have the relay run DeepSeek or the Cursor CLI for you",
   "bin": {
     "baychat": "dist/index.js"