baychat 0.39.0 → 0.41.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "baychat",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "displayName": "BayChat",
   "description": "Wakes this Claude Code session the moment a BayChat message arrives: no Monitor, no 30-minute deadline. Uses the baychat CLI already on this computer (npm install -g baychat, then baychat login).",
   "author": {

package/README.md

@@ -918,6 +918,10 @@ instruction):
 | `get_note` | Read one note in full (and the version to edit from) |
 | `create_note` | Write a note for the project or the chat; it lands on the shelf (people pin) |
 | `update_note` | Edit a note from the version you read; if someone saved since, nothing is overwritten and you get theirs to merge |
+| `list_board_cards` | The to-dos on the boards of the chat's project, by column, with the board's table fields and each to-do's values; `mine` marks the ones you may move or edit |
+| `add_board_card` | Add a to-do: yours by default (claim the work you are doing); one for a person or nobody is only a suggestion until a person accepts it |
+| `move_board_card` | Move one of your to-dos to another column (Doing, Done, Blocked) |
+| `update_board_card` | Edit the title, notes, dates or table values of one of your to-dos (money in integer cents) |
 | `get_conversation_summary` | The rolling catch-up summary (decisions, tasks, questions, facts + source ids) |
 | `get_messages` | Recent messages enriched with sender, mentions, and `shouldRespond` |
 | `send_message` | Send a message into a conversation |

package/dist/approval-wait.js

@@ -53,7 +53,11 @@ async function askOwnerAndWait(device, ask, deadlineMs, deps, label) {
                 options: ask.options,
                 ...(ask.guardedOptions?.length ? { guardedOptions: ask.guardedOptions } : {}),
                 direct: true,
-                wait: holdSeconds(deadlineMs - deps.now()),
+                wait: deps.onCard ? 1 : holdSeconds(deadlineMs - deps.now()),
+                // When THIS process stops waiting (AGENT_STOP_UNDO.md T14): a Bay's undo window holds an
+                // answer only if it can still be delivered before then — otherwise the server sends it at
+                // once, so a short `--timeout` never turns a phone's "yes" into a deny. Older servers ignore it.
+                waitUntil: new Date(deadlineMs).toISOString(),
             });
         }
         catch (err) {
@@ -62,6 +66,12 @@ async function askOwnerAndWait(device, ask, deadlineMs, deps, label) {
         const requestId = typeof reply.requestId === "string" ? reply.requestId : "";
         if (!requestId)
             return { kind: "failed", reason: "BayChat did not return an approval id" };
+        try {
+            deps.onCard?.(requestId);
+        }
+        catch (err) {
+            deps.log(`${label}: could not note the card (${reasonOf(err)})`);
+        }
         // Wait. Re-arm across the bounded holds exactly as `await_approval` does. Marked while it
         // waits, so the relay's automatic update never restarts BayChat under an open question.
         const unmark = (0, waiting_cards_1.markWaitingCard)(requestId);
@@ -133,9 +143,11 @@ async function waitOnOwnerQuestion(device, requestId, deadlineMs, deps, label) {
  * effort and NEVER THROWS: a card left pending is harmless — the answer would reach nobody — so
  * a failure here is only logged.
  */
-async function withdrawOwnerQuestion(device, requestId, log) {
+async function withdrawOwnerQuestion(device, requestId, log, 
+/** "answered_elsewhere": it was answered in the session's own terminal — the card says so. */
+reason) {
     try {
-        await (0, api_1.apiRequest)(device, "POST", `/api/device-api/approvals/${encodeURIComponent(requestId)}/withdraw`, {});
+        await (0, api_1.apiRequest)(device, "POST", `/api/device-api/approvals/${encodeURIComponent(requestId)}/withdraw`, reason ? { reason } : {});
     }
     catch (err) {
         log(`could not withdraw the card ${requestId} (${reasonOf(err)})`);

package/dist/approve-hook.js

@@ -38,6 +38,8 @@ exports.allowDecision = allowDecision;
 exports.denyDecision = denyDecision;
 exports.describeToolRequest = describeToolRequest;
 exports.composeQuestion = composeQuestion;
+exports.answeredInTerminal = answeredInTerminal;
+exports.setHeldCardForTest = setHeldCardForTest;
 exports.decideApproval = decideApproval;
 exports.sessionFromClaude = sessionFromClaude;
 exports.linkFromClaude = linkFromClaude;
@@ -62,8 +64,9 @@ exports.cmdApproveHook = cmdApproveHook;
 // THE ONE RULE: EVERY PATH OUT OF HERE PRINTS A DECISION.
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 //
-// Claude Code hooks FAIL OPEN. Verified against the current hooks reference, all of these mean
-// "the tool call proceeds through the normal permission flow":
+// A broken hook decides NOTHING. All of these render no decision, and Claude Code then shows its
+// own terminal permission prompt — the "normal permission flow" (a timeout and an exit 1 with
+// non-JSON output were tested 30 Oct with Claude Code 2.1.314: the prompt came up, nothing ran):
 //
 //   • the hook times out                    • it exits 1 (or any code but 2)
 //   • stdout is empty, or is not JSON       • stdout is JSON that fails schema validation
@@ -76,12 +79,14 @@ exports.cmdApproveHook = cmdApproveHook;
 // So the fail-closed guarantee is entirely this file's. Every abnormal path — no credential, DNS
 // failure, connection refused, 500, 401, unparseable body, ambiguous session, our own deadline,
 // an exception nobody predicted — is converted into an explicit DENY object and exit 0. There is
-// no `process.exit(1)` anywhere below, because exit 1 ALLOWS.
+// no `process.exit(1)` anywhere below: exit 1 decides nothing and leaves the terminal prompt, which
+// nobody at a phone can answer.
 //
 // Two consequences worth stating plainly:
 //
-//   1. OUR WAIT MUST END BEFORE THE HANDLER'S `timeout`. A hook that times out allows, so a
-//      deadline we control (which denies) must always be reached first. Hence
+//   1. OUR WAIT MUST END BEFORE THE HANDLER'S `timeout`. A hook that times out renders no
+//      decision (the terminal prompt comes back; tested 30 Oct with Claude Code 2.1.314), so a deadline we control,
+//      which denies explicitly and says why, must always be reached first. Hence
 //      DEFAULT_WAIT_SECONDS < RECOMMENDED_HANDLER_TIMEOUT_SECONDS, and the docs say to raise
 //      both together or neither.
 //   2. STDOUT IS THE DECISION CHANNEL. Nothing else may ever be written to it — "Stdout must
@@ -98,11 +103,13 @@ exports.cmdApproveHook = cmdApproveHook;
 //
 // The card itself never expires: the ApprovalRequest row stays PENDING for as long as it takes,
 // exactly like a terminal prompt. Our deadline bounds only how long THIS PROCESS waits, and it
-// exists solely because the alternative (being killed by the handler timeout) would allow.
+// exists because the alternative (being killed by the handler timeout) decides nothing: the
+// terminal prompt reappears with no word to the phone about why.
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const approval_wait_1 = require("./approval-wait");
+const card_key_1 = require("./card-key");
 const config_1 = require("./config");
 const hook_stdin_1 = require("./hook-stdin");
 const claude_link_1 = require("./channel/claude-link");
@@ -151,8 +158,8 @@ function denyClosed(reason) {
 /**
  * How long this process waits before denying, in seconds.
  *
- * An hour, not forever: the handler's own `timeout` would otherwise kill us first, and a
- * killed hook ALLOWS. This number and the `timeout` in settings.json are one setting in two
+ * An hour, not forever: the handler's own `timeout` would otherwise kill us first, and a killed
+ * hook decides nothing (the terminal prompt comes back; tested 30 Oct with Claude Code 2.1.314). This number and the `timeout` in settings.json are one setting in two
  * places — see the doc.
  */
 exports.DEFAULT_WAIT_SECONDS = 3600;
@@ -271,6 +278,45 @@ exports.APPROVE_OPTIONS = ["Allow this once", "Deny"];
 /** The ONLY index that means yes. Anything else — a second option, a third, an index the server
  *  invented — is a deny, so a mismatch between these labels and the answer can only fail safe. */
 const ALLOW_INDEX = 0;
+/**
+ * The card this process is waiting on right now, for `answeredInTerminal`: the credential, and the
+ * card's id once BayChat has made it. One hook run per process, so one card.
+ */
+let heldCard = null;
+/** How long a terminal answer waits for a card id still on its way, and for the withdrawal itself. */
+const SIGNAL_GRACE_MS = 2_000;
+/**
+ * Claude Code ended this hook mid-wait — measured on 2.1.316: a "No" at the terminal sends SIGTERM
+ * (a "Yes" leaves the hook parked; the after-hook closes that card). Close the card "answered at the
+ * computer" so it leaves Needs you, then the deny: EVERY PATH PRINTS A DECISION, even one Claude Code
+ * no longer reads. Bounded: a slow BayChat only leaves the card for "Mark done". NEVER THROWS.
+ */
+async function answeredInTerminal(deps = {}) {
+    try {
+        const held = heldCard;
+        if (held) {
+            const grace = deps.graceMs ?? SIGNAL_GRACE_MS;
+            const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+            // A card made in the hook's first second may not have its id yet.
+            for (let waited = 0; !held.cardId && waited < grace; waited += 100)
+                await sleep(100);
+            if (held.cardId) {
+                await Promise.race([
+                    (deps.withdraw ?? approval_wait_1.withdrawOwnerQuestion)(held.device, held.cardId, held.log, "answered_elsewhere"),
+                    sleep(grace),
+                ]);
+            }
+        }
+    }
+    catch {
+        // The deny below is the guarantee; the withdrawal is a courtesy to the phone.
+    }
+    return deny("it was answered in the terminal.");
+}
+/** Test seam: what `answeredInTerminal` would close. */
+function setHeldCardForTest(card) {
+    heldCard = card;
+}
 function parseArgs(argv) {
     const at = (name) => {
         const i = argv.indexOf(name);
@@ -328,13 +374,32 @@ async function decideApproval(rawStdin, argv = [], deps = {}) {
         // not "answered with index 0" becomes a deny below.
         // While the card is on the phone, notify-hook stays quiet for this session: one prompt, one
         // thing on the phone (notify-state.ts).
+        // The mark also names the call, and the card once it exists: answered at the keyboard instead,
+        // the after-hook closes it (card-after.ts), and a SIGTERM closes it here (`answeredInTerminal`).
         const claudeSession = str(input.session_id);
-        (0, notify_state_1.markCardPending)(claudeSession);
+        const key = (0, card_key_1.cardKeyOf)(toolName, input.tool_input);
+        (0, notify_state_1.markCardPending)(claudeSession, {}, key ? { key } : undefined);
+        heldCard = { device, cardId: undefined, log };
         let outcome;
         try {
-            outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session: opts.session, question, options: [...exports.APPROVE_OPTIONS] }, deadline, { now, sleep, log }, "baychat approve-hook");
+            outcome = await (0, approval_wait_1.askOwnerAndWait)(device, { session: opts.session, question, options: [...exports.APPROVE_OPTIONS] }, deadline, {
+                now,
+                sleep,
+                log,
+                onCard: (cardId) => {
+                    if (heldCard)
+                        heldCard.cardId = cardId;
+                    (0, notify_state_1.markCardPending)(claudeSession, {}, { cardId, key });
+                    // Already answered at the keyboard, before the card had an id: close it now. The wait
+                    // then sees "withdrawn" and this prints its deny.
+                    if (key && (0, notify_state_1.takeSettled)(claudeSession) === key) {
+                        void (deps.withdraw ?? approval_wait_1.withdrawOwnerQuestion)(device, cardId, log, "answered_elsewhere");
+                    }
+                },
+            }, "baychat approve-hook");
         }
         finally {
+            heldCard = null;
             (0, notify_state_1.clearCardPending)(claudeSession);
         }
         return verdictOf(outcome, opts.waitSeconds, isChained(toolName, input.tool_input));
@@ -366,7 +431,7 @@ function verdictOf(outcome, waitSeconds, chained = false) {
             return deny("the decision was withdrawn in BayChat without an answer.");
         case "deadline":
             return deny(`nobody answered within ${waitSeconds}s.`, "The decision card is still in BayChat; this call was refused because waiting longer " +
-                "would have let the hook time out, and a timed-out hook silently ALLOWS.");
+                "would have let the hook time out, which hands the decision back to the terminal prompt.");
         case "failed":
             return denyClosed(outcome.reason);
         case "unrecognised":
@@ -508,6 +573,20 @@ function noDecisionNotice(deps = {}) {
  * call PROCEEDS — so exiting 1 on failure would be precisely backwards.
  */
 async function cmdApproveHook(argv = [], stdin = process.stdin, deps = {}) {
+    // Ended mid-wait (a "No" at the terminal sends SIGTERM): close the card, then print the deny — once.
+    let printed = false;
+    const onSignal = () => {
+        if (printed)
+            return;
+        printed = true;
+        void answeredInTerminal().then((denied) => {
+            process.stdout.write(`${JSON.stringify(denied)}\n`);
+            process.exit(0);
+        });
+    };
+    const signals = ["SIGTERM", "SIGINT", "SIGHUP"];
+    for (const sig of signals)
+        process.on(sig, onSignal);
     let decision;
     try {
         decision = await decideApprovalOrDefer(await (0, hook_stdin_1.readStdin)(stdin), argv);
@@ -518,6 +597,12 @@ async function cmdApproveHook(argv = [], stdin = process.stdin, deps = {}) {
         process.stderr.write(`baychat approve-hook: ${err instanceof Error ? err.message : String(err)}\n`);
         decision = denyClosed("the approval gate could not run");
     }
+    for (const sig of signals)
+        process.off(sig, onSignal);
+    // A signal already printed its deny; one decision on stdout, never two.
+    if (printed)
+        return 0;
+    printed = true;
     // No decision: `--session-from-claude` with no session found — Claude Code's own dialog, plus a
     // line saying why when this is a channel session that lost its link.
     if (decision === null) {

package/dist/card-after.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.settleAnsweredCard = settleAnsweredCard;
+// The after-hook's half of "Needs you closes itself" (fix/needs-you-closes-itself, 2 Nov 2026).
+//
+// Measured on Claude Code 2.1.316: while approve-hook waits on its card, the terminal dialog is open
+// too. Answered "Yes" at the keyboard, the tool runs and PostToolUse fires — and approve-hook is NOT
+// stopped, so its card would stay in Needs you for up to an hour. Here the finished call is compared
+// with the session's pending card (notify-state.ts, written by approve-hook): the same call closes the
+// card "answered at the computer"; approve-hook then sees "withdrawn", prints its deny and leaves.
+//
+// It runs on every matching tool call (inside the async `denied-after` hook), so it reads ONE local
+// file first and touches the network only when that file names this very call. Loads no CLI.
+const approval_wait_1 = require("./approval-wait");
+const card_key_1 = require("./card-key");
+const config_1 = require("./config");
+const notify_state_1 = require("./notify-state");
+/** Close the session's card if THIS finished call is the one it asked about. NEVER THROWS. */
+async function settleAnsweredCard(input, deps = {}) {
+    const log = deps.log ?? ((line) => process.stderr.write(`${line}\n`));
+    try {
+        const call = (input && typeof input === "object" ? input : {});
+        const session = typeof call.session_id === "string" ? call.session_id : "";
+        if (!session)
+            return "none";
+        const pending = (0, notify_state_1.readPendingCard)(session, { dir: deps.dir });
+        if (!pending)
+            return "none";
+        const key = (0, card_key_1.cardKeyOf)(typeof call.tool_name === "string" ? call.tool_name : "", call.tool_input);
+        if (!key || pending.key !== key)
+            return "other-call";
+        if (!pending.cardId) {
+            // Answered at the keyboard before BayChat had even made the card: approve-hook closes it.
+            (0, notify_state_1.markSettled)(session, key, { dir: deps.dir });
+            return "settled-early";
+        }
+        const device = (deps.loadDevice ?? config_1.loadDeviceCredentials)();
+        if (!device)
+            return "none";
+        await (deps.withdraw ?? ((d, id) => (0, approval_wait_1.withdrawOwnerQuestion)(d, id, log, "answered_elsewhere")))(device, pending.cardId);
+        return "withdrawn";
+    }
+    catch (err) {
+        log(`baychat after-hook: could not close an answered card (${err instanceof Error ? err.message : String(err)})`);
+        return "none";
+    }
+}

package/dist/card-key.js

@@ -0,0 +1,27 @@
+"use strict";
+// Which call a permission card asks about, as a key both of Claude Code's events can produce
+// (fix/needs-you-closes-itself). The PermissionRequest hook gets no `tool_use_id` — only the tool and
+// its input — and PostToolUse gets the same two, so the key is built from those alone. Pure.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cardKeyOf = cardKeyOf;
+/** `Bash:<command>`; any other tool `<name>:<its input, keys sorted>`; undefined when it cannot be named. */
+function cardKeyOf(toolName, toolInput) {
+    if (!toolName)
+        return undefined;
+    const input = toolInput && typeof toolInput === "object" && !Array.isArray(toolInput) ? toolInput : {};
+    if (toolName === "Bash") {
+        // Only the command: Claude Code may add a description or a timeout on one side and not the other.
+        const command = typeof input.command === "string" ? input.command.trim() : "";
+        return command ? `Bash:${command}` : undefined;
+    }
+    return `${toolName}:${stable(input)}`;
+}
+function stable(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stable).join(",")}]`;
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stable(v)}`).join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}

package/dist/denied/after-hook.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.afterCall = afterCall;
 exports.cmdDeniedAfter = cmdDeniedAfter;
 // `baychat denied-after` — the PostToolUse / PostToolUseFailure hook that takes an "Allow once"
-// rule back out as soon as the retried call has run.
+// rule back out as soon as the retried call has run, and closes a permission card whose call was
+// answered at the keyboard instead (card-after.ts, fix/needs-you-closes-itself).
 //
 // It is installed beside `denied-hook` (relay/launcher/approval-settings.ts) as an ASYNC hook:
 // Claude Code starts it and moves on, so it adds nothing to any tool call's latency, and it prints
@@ -14,6 +15,7 @@ exports.cmdDeniedAfter = cmdDeniedAfter;
 // and every run here sweeps too — including a grant whose deferred confirmation never finished,
 // which is taken back and the owner told (confirm.ts; it loads only the card client and config,
 // no MCP SDK and none of the CLI's commands).
+const card_after_1 = require("../card-after");
 const hook_stdin_1 = require("../hook-stdin");
 const confirm_1 = require("./confirm");
 const grants_1 = require("./grants");
@@ -21,9 +23,12 @@ const permission_rule_1 = require("./permission-rule");
 /** Handle one finished call. NEVER THROWS; diagnostics go to stderr. */
 async function afterCall(rawStdin, log = defaultLog) {
     try {
+        const input = JSON.parse(rawStdin);
+        // A permission card answered at the keyboard instead: close it (card-after.ts — one local file
+        // read unless this very call has a card on the phone).
+        await (0, card_after_1.settleAnsweredCard)(input, { log });
         if (!(0, grants_1.hasGrantsToSweep)())
             return;
-        const input = JSON.parse(rawStdin);
         const call = typeof input.tool_name === "string" ? (0, permission_rule_1.callKeyOf)(input.tool_name, input.tool_input) : undefined;
         if (call && typeof input.session_id === "string")
             await (0, grants_1.consumeOnceGrants)(input.session_id, call);

package/dist/launch/claude-trust.js

@@ -176,7 +176,9 @@ function trustProblemText(reason, file) {
 }
 /**
  * Set `projects[folder].hasTrustDialogAccepted = true` and nothing else. `folder` should be the
- * realpath (the spot's stored path). Called ONLY from `baychat launch add` after a person said y.
+ * realpath (the spot's stored path). Called from `baychat launch add` after a person said y, and from
+ * the relay for the owner's "Allow… in this folder" on their phone — only for a folder that person
+ * opened to it (`phoneMayAllow`, relay/launcher/spot-request.ts).
  */
 function trustFolder(folder, file = claudeConfigPath()) {
     // Write through a symlinked ~/.claude.json (dotfile managers) instead of replacing the link.

package/dist/launch/codex-trust.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexConfigPath = void 0;
+exports.isCodexFolderTrusted = isCodexFolderTrusted;
+exports.codexTrustProblemText = codexTrustProblemText;
+exports.trustCodexFolder = trustCodexFolder;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const codex_launch_1 = require("../relay/launcher/codex-launch");
+Object.defineProperty(exports, "codexConfigPath", { enumerable: true, get: function () { return codex_launch_1.codexConfigPath; } });
+function read(file) {
+    try {
+        return { ok: true, raw: fs.readFileSync(file, "utf8") };
+    }
+    catch (err) {
+        return { ok: false, reason: err.code === "ENOENT" ? "CONFIG_MISSING" : "CONFIG_UNREADABLE" };
+    }
+}
+/** Read-only, by the relay's own rule: the folder's own table says trusted. */
+function isCodexFolderTrusted(folder, file = (0, codex_launch_1.codexConfigPath)()) {
+    const r = read(file);
+    if (!r.ok)
+        return false;
+    // codexLaunchProblem also wants the MCP entry; ask it only about trust by handing it a config that has one.
+    const withEntry = `[mcp_servers.baychat]\n${r.raw}`;
+    return (0, codex_launch_1.codexLaunchProblem)(folder, () => withEntry) === undefined;
+}
+/** A sentence for each problem, for the person at the terminal. */
+function codexTrustProblemText(reason, file) {
+    switch (reason) {
+        case "CONFIG_MISSING":
+            return `${file} does not exist yet (Codex has not run on this computer).`;
+        case "CONFIG_UNREADABLE":
+            return `${file} could not be read.`;
+        case "PATH_UNSAFE":
+            return "the folder's name has a line break, or both a quote and a backslash, which BayChat will not write into Codex's config.";
+        case "CONFIG_UNKNOWN_FORM":
+            return `${file} already names this folder in a form BayChat does not edit, so it was left alone. Set the trust in Codex itself.`;
+        case "CONFIG_CHANGING":
+            return `${file} kept changing while BayChat tried to write it (is Codex busy?).`;
+        case "WRITE_FAILED":
+            return `${file} could not be written.`;
+    }
+}
+/** The folder as a TOML key: a basic string, else a literal string, else null (neither can hold it). */
+function tomlKey(folder) {
+    if (/[\n\r]/.test(folder))
+        return null;
+    if (!/["\\]/.test(folder))
+        return `"${folder}"`;
+    if (!folder.includes("'"))
+        return `'${folder}'`;
+    return null;
+}
+/**
+ * The config with `folder` trusted: its table's level set in place, or one table appended — or null when the
+ * folder is already a key in some other form, where an appended table would be a duplicate key.
+ */
+function withTrust(raw, folder) {
+    const header = new RegExp(`^[ \\t]*\\[projects\\.${(0, codex_launch_1.codexProjectKeyRe)(folder)}\\][ \\t]*$`, "m");
+    const found = header.exec(raw);
+    if (found) {
+        const start = found.index + found[0].length;
+        const next = raw.slice(start).search(/^[ \t]*\[/m);
+        const end = next === -1 ? raw.length : start + next;
+        const body = raw.slice(start, end);
+        const level = /^([ \t]*trust_level[ \t]*=[ \t]*)("[^"\n]*"|'[^'\n]*')/m;
+        const nextBody = level.test(body) ? body.replace(level, '$1"trusted"') : `\ntrust_level = "trusted"${body}`;
+        return raw.slice(0, start) + nextBody + raw.slice(end);
+    }
+    const otherForm = new RegExp(`${(0, codex_launch_1.codexProjectKeyRe)(folder)}\\s*(?:=|\\.)`);
+    if (otherForm.test(raw))
+        return null;
+    const sep = raw === "" || raw.endsWith("\n") ? "" : "\n";
+    return `${raw}${sep}\n[projects.${tomlKey(folder)}]\ntrust_level = "trusted"\n`;
+}
+/**
+ * Trust `folder` (the spot's stored realpath) for Codex. Called from `baychat launch add` after a person at this
+ * computer said y, and from the relay for the owner's "Allow… in this folder" on their phone — only for a folder
+ * that person opened to it (`phoneMayAllow`, relay/launcher/spot-request.ts).
+ */
+function trustCodexFolder(folder, file = (0, codex_launch_1.codexConfigPath)()) {
+    if (tomlKey(folder) === null)
+        return { ok: false, reason: "PATH_UNSAFE" };
+    // Write through a symlinked config (dotfile managers) instead of replacing the link.
+    let target = file;
+    try {
+        target = fs.realpathSync(file);
+    }
+    catch {
+        // Missing: read() reports it below.
+    }
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const r = read(target);
+        // A fresh Codex install has its folder but no config.toml yet (vps, 4 Nov): create it holding only this
+        // table, 0600, and only if nothing appeared there meanwhile (`wx`). No folder: Codex has not run here.
+        if (!r.ok && r.reason === "CONFIG_MISSING" && fs.existsSync(path.dirname(target))) {
+            try {
+                fs.writeFileSync(target, (withTrust("", folder) ?? "").replace(/^\n/, ""), { mode: 0o600, flag: "wx" });
+                fs.chmodSync(target, 0o600); // writeFile's mode is masked by the umask
+                return { ok: true, changed: true };
+            }
+            catch (err) {
+                if (err.code === "EEXIST")
+                    continue; // Codex wrote it first: start over.
+                return { ok: false, reason: "WRITE_FAILED" };
+            }
+        }
+        if (!r.ok)
+            return r;
+        if (isCodexFolderTrusted(folder, target))
+            return { ok: true, changed: false };
+        const text = withTrust(r.raw, folder);
+        if (text === null)
+            return { ok: false, reason: "CONFIG_UNKNOWN_FORM" };
+        let mode;
+        try {
+            mode = fs.statSync(target).mode & 0o777;
+            const bak = `${target}.bak`;
+            fs.copyFileSync(target, bak);
+            fs.chmodSync(bak, mode);
+        }
+        catch {
+            return { ok: false, reason: "WRITE_FAILED" };
+        }
+        const tmp = path.join(path.dirname(target), `.${path.basename(target)}.baychat-${process.pid}-${Date.now()}.tmp`);
+        try {
+            fs.writeFileSync(tmp, text, { mode });
+            fs.chmodSync(tmp, mode); // writeFile's mode is masked by the umask
+            // If Codex rewrote it since we read it, start over rather than rename our older copy over its newer one.
+            if (fs.readFileSync(target, "utf8") !== r.raw) {
+                fs.rmSync(tmp, { force: true });
+                continue;
+            }
+            fs.renameSync(tmp, target);
+            return { ok: true, changed: true };
+        }
+        catch {
+            fs.rmSync(tmp, { force: true });
+            return { ok: false, reason: "WRITE_FAILED" };
+        }
+    }
+    return { ok: false, reason: "CONFIG_CHANGING" };
+}