baychat 0.7.0 → 0.8.1

package/README.md

@@ -52,6 +52,7 @@ per session, never one that another integration already uses.
 
 | Command | Description |
 |---------|-------------|
+| `baychat login [--token <PAT>] [--base <url>]` | Log this laptop in to BayChat — scan the QR with your phone, approve, and the BayChat MCP server is registered with Claude Code (`claude mcp add`). Then run `/baychat <name>` in any session |
 | `baychat onboard [<conv>]` | **Run first.** Print the agent protocol + your live identity, conversations, and (a) room's context |
 | `baychat pair <code> [--base <url>]` | Redeem a pairing code and store credentials |
 | `baychat link [--name <n>] [--base <url>]` | Link this session by scanning a QR with your phone — no code to copy. Approve on your phone and the token is stored automatically |
@@ -66,6 +67,7 @@ per session, never one that another integration already uses.
 | `baychat fetch <url> [--max-chars <n>]` | Fetch one public `http(s)` page through BayChat and print its readable text (see [Tools](#tools)) |
 | `baychat watch <conv> [--interval <sec>] [--timeout <sec>]` | Block until new messages arrive (exit 0) or timeout (exit 2) |
 | `baychat mcp` | Run a local **stdio MCP server** so MCP-aware clients (Claude Desktop, Claude Code, Cursor) get BayChat as native tools (see below) |
+| `baychat mcp-config [--client codex\|cursor\|desktop]` | Print a paste-ready config that points another MCP client at the **remote** BayChat server. No `--client` lists what's supported (see [Other MCP clients](#other-mcp-clients)) |
 
 `baychat onboard <conv> --catch-up` combines onboarding with a catch-up: after
 the protocol, your identity, conversations, and the room's instructions, it
@@ -283,11 +285,52 @@ on the MCP server entry so the launched process inherits it:
 }
 ```
 
+### Other MCP clients
+
+`baychat login` also gives you a **remote** MCP server — `https://api.baychat.io/api/mcp`,
+standard MCP Streamable HTTP. Any client that supports a remote MCP server and custom headers
+connects with just two values:
+
+- URL — `https://api.baychat.io/api/mcp`
+- Header — `Authorization: Bearer <device token>`
+
+The device token is written to `~/.baychat/credentials.json` (0600) under `device.token` by
+`baychat login`; `BAYCHAT_DEVICE_TOKEN` is used in its place when set.
+
+Don't hand-write any of that — let the CLI print it:
+
+```bash
+baychat mcp-config                    # which clients are supported, and where each config lives
+baychat mcp-config --client cursor    # a config carrying your token, ready to paste
+```
+
+| `--client` | File | Shape |
+|-----------|------|-------|
+| `cursor` | `~/.cursor/mcp.json` (or project `.cursor/mcp.json`) | Cursor speaks remote HTTP natively — `url` + `headers` |
+| `desktop` | `claude_desktop_config.json` | stdio only, so it bridges through `npx -y mcp-remote` |
+| `codex` | `~/.codex/config.toml` | Native Streamable HTTP in TOML — `url` + `http_headers.Authorization` |
+
+The Claude Desktop bridge config passes the header through an env var
+(`--header Authorization:${BAYCHAT_AUTH_HEADER}`) rather than inline, so your token never
+appears in the child process's command line. Restart the client after saving.
+
+Only the config body goes to **stdout** — the destination path and the warnings go to stderr —
+so `baychat mcp-config --client cursor > ~/.cursor/mcp.json` writes a valid file. The output
+contains a live credential: don't commit it or paste it into a shared channel. If you are not
+logged in, or the credential on disk is unusable, the command refuses and tells you to run
+`baychat login` rather than printing a config with an empty token.
+
+`baychat login` registers **Claude Code** for you (`claude mcp add --transport http --scope
+user baychat …`); if the `claude` binary is missing or the add fails, login still succeeds and
+prints the command to run by hand. On Windows `claude` is a `.cmd` shim, which Node can only
+launch through a shell, so the CLI shells out there and quotes each argument itself.
+
 ## Configuration
 
 | Env var | Effect |
 |---------|--------|
-| `BAYCHAT_TOKEN` | Use this API token instead of the credentials file (headless/CI) |
+| `BAYCHAT_TOKEN` | Use this agent API token instead of the credentials file (headless/CI) |
+| `BAYCHAT_DEVICE_TOKEN` | Use this `bay_u_*` device token (from `baychat login`) instead of the credentials file (headless/CI) |
 | `BAYCHAT_API_URL` | API origin (default `https://api.baychat.io`) |
 | `BAYCHAT_CONFIG_DIR` | Credentials/cursor directory (default `~/.baychat`) |
 

package/dist/api.js

@@ -6,6 +6,9 @@ exports.fetchContext = fetchContext;
 exports.pairRequest = pairRequest;
 exports.createLinkRequest = createLinkRequest;
 exports.pollLinkRequest = pollLinkRequest;
+exports.createDeviceLink = createDeviceLink;
+exports.pollDeviceLink = pollDeviceLink;
+exports.deviceMe = deviceMe;
 class ApiError extends Error {
     status;
     code;
@@ -114,3 +117,36 @@ async function pollLinkRequest(baseUrl, id, pollSecret) {
         throw await parseError(res);
     return (await res.json());
 }
+/** Create a device link request. `deviceName` labels the laptop in the approve UI. */
+async function createDeviceLink(baseUrl, deviceName) {
+    const res = await fetch(`${baseUrl}/api/device-links`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(deviceName ? { deviceName } : {}),
+    });
+    if (!res.ok)
+        throw await parseError(res);
+    return (await res.json());
+}
+/**
+ * Poll a device link request with its secret (query string, per the server
+ * contract). Unlike the agent flow this does NOT translate 404 into a status:
+ * pickup is single-use, so 404 covers expired, unknown, wrong-secret and
+ * already-consumed alike. It surfaces as an ApiError and the caller decides —
+ * `cmdLogin` treats it as "expired" and stops polling.
+ */
+async function pollDeviceLink(baseUrl, id, pollSecret) {
+    const res = await fetch(`${baseUrl}/api/device-links/${id}?secret=${encodeURIComponent(pollSecret)}`);
+    if (!res.ok)
+        throw await parseError(res);
+    return (await res.json());
+}
+/** Verify a device token and learn whose Bay it opens (`baychat login --token`). */
+async function deviceMe(baseUrl, token) {
+    const res = await fetch(`${baseUrl}/api/device-credentials/me`, {
+        headers: { Authorization: `Bearer ${token}` },
+    });
+    if (!res.ok)
+        throw await parseError(res);
+    return (await res.json());
+}

package/dist/commands.js

@@ -16,9 +16,15 @@ exports.resetSessionState = resetSessionState;
 exports.cmdCheck = cmdCheck;
 exports.cmdWatch = cmdWatch;
 exports.cmdLink = cmdLink;
+exports.claudeMcpAddSpawn = claudeMcpAddSpawn;
+exports.cmdLogin = cmdLogin;
+exports.deviceExpiryWarning = deviceExpiryWarning;
+exports.printDeviceExpiryWarning = printDeviceExpiryWarning;
 exports.cmdSearch = cmdSearch;
 exports.cmdFetch = cmdFetch;
 exports.cmdQr = cmdQr;
+const node_child_process_1 = require("node:child_process");
+const node_os_1 = __importDefault(require("node:os"));
 const qrcode_1 = __importDefault(require("qrcode"));
 const api_1 = require("./api");
 const protocol_1 = require("./protocol");
@@ -29,9 +35,16 @@ const tools_1 = require("./tools");
 const DEFAULT_BASE_URL = "https://api.baychat.io";
 function requireCredentials() {
     const creds = (0, config_1.loadCredentials)();
-    if (!creds)
-        throw new Error("Not connected. Run: baychat pair <code>");
-    return creds;
+    if (creds)
+        return creds;
+    // A device login (`baychat login`) is not an agent pairing — these commands
+    // speak the agent API and still need one. Telling a logged-in user they are
+    // "not connected" is false and sends them round the wrong loop, so name what
+    // they have and what is missing.
+    const device = (0, config_1.loadDeviceCredentials)();
+    throw new Error(device
+        ? `Logged in as ${device.user.name} (device). No agent paired for this session — run: baychat pair <code>`
+        : "Not connected. Run: baychat pair <code>");
 }
 async function cmdPair(code, baseUrl) {
     const base = (baseUrl || process.env.BAYCHAT_API_URL || DEFAULT_BASE_URL).replace(/\/$/, "");
@@ -42,6 +55,11 @@ async function cmdPair(code, baseUrl) {
     console.log("Credentials saved. Try: baychat whoami");
 }
 async function cmdWhoami() {
+    // Before requireCredentials, which throws for a device-only setup: a lapsing
+    // device login is exactly what a `baychat login`-only user needs to hear, and
+    // it would otherwise be unreachable on the one command people run to check
+    // their connection.
+    printDeviceExpiryWarning();
     const creds = requireCredentials();
     const me = await (0, api_1.apiRequest)(creds, "GET", "/api/agent-api/me");
     console.log(`${me.name} (${me.id}) — status ${me.status} — ${creds.baseUrl}`);
@@ -383,10 +401,15 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  * connection can't be made) are transient. Real 4xx errors are not: they signal
  * a genuine problem the caller must see, so they rethrow. Note ApiError 404 is
  * handled as a terminal "expired" state by callers before reaching here.
+ *
+ * 429 is the one 4xx that belongs on the transient side: it is the server saying
+ * "later", not "no". Aborting on it would kill a link the user is seconds from
+ * approving because the poll loop — or an unrelated tab on the same IP — brushed
+ * a rate limit; the next tick is already an interval away.
  */
 function isTransientPollError(err) {
     if (err instanceof api_1.ApiError)
-        return err.status >= 500;
+        return err.status >= 500 || err.status === 429;
     return err instanceof TypeError; // network-level fetch failure
 }
 async function cmdWatch(conversationId, opts = {}) {
@@ -472,6 +495,256 @@ async function cmdLink(opts = {}) {
     console.log("Link request expired — run baychat link again.");
     return false;
 }
+// ─── Device login (`baychat login`) ────────────────────────────────────────
+// The user-credential twin of `cmdLink`: same reverse-QR mechanics, but the
+// approved token acts as the HUMAN and unlocks the remote MCP server, so one
+// command both logs the laptop in and registers BayChat with Claude Code.
+/** The copy-pasteable `claude mcp add`, with a PLACEHOLDER where the token goes:
+ * printing the real one would leave the secret in scrollback and in any pasted
+ * transcript, which argv exposure (below) does not. */
+function printManualMcpAdd(baseUrl) {
+    console.log(`  claude mcp add --transport http --scope user baychat ${baseUrl}/api/mcp \\`);
+    console.log(`    --header "Authorization: Bearer <your token — in ~/.baychat/credentials.json under device.token>"`);
+}
+/**
+ * cmd.exe quoting: wrap the whole argument so spaces, `&`, `|` and `>` inside it
+ * stay literal. Only usable on values `WINDOWS_UNSAFE` has already cleared.
+ */
+function quoteForCmd(arg) {
+    return `"${arg}"`;
+}
+/**
+ * Characters that survive — or break out of — cmd.exe double quotes.
+ *
+ * A `"` ends the wrapper, so everything after it is parsed as shell syntax. A
+ * `%NAME%` is expanded *inside* quotes. A newline ends the command line. Nothing
+ * else in cmd's metacharacter set (`&`, `|`, `<`, `>`, `^`) is interpreted while
+ * quoted, and `!` only expands under delayed expansion, which `cmd /d /s /c` —
+ * what Node's `shell: true` invokes — does not enable.
+ */
+const WINDOWS_UNSAFE = /["%\u0000-\u001f\u007f]/;
+/**
+ * The spawn recipe for `claude mcp add`, or null when it cannot be run safely.
+ *
+ * On Windows `claude` is a `.cmd` shim, and Node has refused to spawn `.bat` /
+ * `.cmd` without `shell: true` since the CVE-2024-27980 fix (18.20.2 /
+ * 20.12.2+) — it throws EINVAL. Every runtime this package supports (node >=20)
+ * is past that fix, so naming `claude.cmd` explicitly cannot work either: a
+ * shell is the only route.
+ *
+ * The cost of a shell is that arguments become shell syntax. Node does NOT
+ * escape them — with `shell: true` on Windows it joins argv with spaces and
+ * hands the string to `cmd.exe /d /s /c` verbatim — so `Authorization: Bearer
+ * <token>` would arrive as three separate arguments, and a `&` in an
+ * interpolated value would arrive as a command separator. Hence: quote every
+ * argument here, and refuse outright when an interpolated value contains
+ * something quoting cannot contain. Refusing costs the user one manual paste;
+ * guessing would run their token through a command interpreter.
+ *
+ * POSIX keeps `execve` semantics — argv is passed verbatim, there is no shell to
+ * interpret it, and so nothing to quote or refuse.
+ */
+function claudeMcpAddSpawn(platform, baseUrl, token) {
+    const args = [
+        "mcp",
+        "add",
+        "--transport",
+        "http",
+        "--scope",
+        "user",
+        "baychat",
+        `${baseUrl}/api/mcp`,
+        "--header",
+        `Authorization: Bearer ${token}`,
+    ];
+    if (platform !== "win32")
+        return { command: "claude", args, shell: false };
+    if (args.some((a) => WINDOWS_UNSAFE.test(a)))
+        return null;
+    return { command: "claude", args: args.map(quoteForCmd), shell: true };
+}
+/**
+ * Register the remote BayChat MCP server with Claude Code, carrying the device
+ * token as a static Authorization header.
+ *
+ * The token travels in argv, which is briefly visible in a process listing on a
+ * shared machine. That is the accepted trade for a one-command login.
+ *
+ * Neither a missing `claude` binary nor a rejected add is a login failure — the
+ * credential is already saved — so both only print and return. They print
+ * DIFFERENTLY, though: the common non-zero exit is a renewal where an MCP server
+ * named `baychat` already exists, and reporting that as "CLI not found" would
+ * send the user hunting for the wrong problem while Claude Code quietly keeps
+ * the old, expiring token. We surface the real reason and suggest the removal —
+ * we never run it for them, since that server entry may not be ours.
+ */
+function registerWithClaude(baseUrl, token) {
+    const recipe = claudeMcpAddSpawn(process.platform, baseUrl, token);
+    if (!recipe) {
+        // Windows only, and only for a value a quoted cmd.exe argument cannot hold.
+        console.log("\nCould not add BayChat to Claude Code safely on Windows — add it manually:");
+        printManualMcpAdd(baseUrl);
+        return;
+    }
+    // stderr is captured (not ignored) so a failure can quote claude's own words;
+    // the timeout keeps a hung binary from hanging a login whose credential is
+    // already on disk — a timeout lands in the failure branch below as ETIMEDOUT.
+    const res = (0, node_child_process_1.spawnSync)(recipe.command, recipe.args, {
+        encoding: "utf8",
+        stdio: ["ignore", "ignore", "pipe"],
+        timeout: 15_000,
+        killSignal: "SIGKILL",
+        shell: recipe.shell,
+    });
+    // 9009 is cmd.exe's "'claude' is not recognized": with a shell there is no
+    // ENOENT to catch, and reporting a missing binary as a generic failure would
+    // point the user at the renewal advice below instead of at installing it.
+    if (recipe.shell && res.status === 9009) {
+        console.log("\nClaude Code CLI not found — add BayChat manually:");
+        printManualMcpAdd(baseUrl);
+        return;
+    }
+    if (res.error && res.error.code === "ENOENT") {
+        console.log("\nClaude Code CLI not found — add BayChat manually:");
+        printManualMcpAdd(baseUrl);
+        return;
+    }
+    if (res.error || res.status !== 0) {
+        const reason = res.error?.code ??
+            res.error?.message ??
+            `exit ${res.status}`;
+        console.log(`\nCould not add BayChat to Claude Code (${reason}).`);
+        // Defensive redaction: the token is in argv, not in output, but a CLI that
+        // echoes the failing command back would otherwise print it to scrollback.
+        const stderr = String(res.stderr ?? "").split(token).join("<token>").trim();
+        if (stderr)
+            for (const line of stderr.split("\n").slice(0, 3))
+                console.log(`  ${line}`);
+        console.log('\n  If a server named "baychat" is already registered (a renewal), remove it:');
+        console.log("    claude mcp remove baychat");
+        console.log("  then add it back:");
+        printManualMcpAdd(baseUrl);
+        return;
+    }
+    console.log("✓ BayChat added to Claude Code");
+}
+/**
+ * `baychat login` — log this laptop in to BayChat as the human.
+ *
+ * Default path: create a device link request, render its QR, and poll until the
+ * user approves it in the app. `--token <PAT>` skips the QR and verifies a
+ * pasted device credential against `/api/device-credentials/me` before saving
+ * it — a bad token errors out rather than being written to disk.
+ *
+ * The QR, the printed URL and every log line carry only public data; the token
+ * lives in the credentials file (and in the `claude mcp add` handoff) alone.
+ * Returns true when logged in, false on expiry/timeout (exit 2 in index.ts).
+ */
+async function cmdLogin(opts = {}) {
+    const base = (opts.base || process.env.BAYCHAT_API_URL || DEFAULT_BASE_URL).replace(/\/$/, "");
+    if (opts.token) {
+        const me = await (0, api_1.deviceMe)(base, opts.token);
+        (0, config_1.saveDeviceCredentials)({
+            baseUrl: base,
+            token: opts.token,
+            user: me.user,
+            expiresAt: me.expiresAt,
+        });
+        console.log(`✓ Logged in as ${me.user.name} (${me.tenant.name})`);
+        registerWithClaude(base, opts.token);
+        console.log("\n  Run /baychat <name> in any session.");
+        return true;
+    }
+    // The hostname labels this laptop in the approve UI; the server caps the field
+    // at 60 chars, so a long corporate hostname must not 400 the whole login.
+    const request = await (0, api_1.createDeviceLink)(base, node_os_1.default.hostname().slice(0, 60));
+    console.log(await qrcode_1.default.toString(request.url, { type: "terminal", small: true }));
+    console.log(request.url);
+    console.log("Scan with your phone — BayChat will open to approve this laptop.");
+    // Stop polling shortly after the server-declared expiry (+5s for clock skew).
+    const deadline = new Date(request.expiresAt).getTime() + 5_000;
+    const intervalMs = opts.intervalMs ?? 3_000;
+    let warnedUnavailable = false;
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        let status;
+        try {
+            status = await (0, api_1.pollDeviceLink)(base, request.id, request.pollSecret);
+        }
+        catch (err) {
+            // 404 is the terminal state: expired, unknown, or already picked up (the
+            // pickup is single-use). Stop and print the retry hint below.
+            if (err instanceof api_1.ApiError && err.status === 404)
+                break;
+            // A 5xx/network hiccup during an api restart must not orphan a login the
+            // user is about to approve — ride it out and keep polling.
+            if (!isTransientPollError(err))
+                throw err;
+            if (!warnedUnavailable) {
+                console.log("Server unavailable, retrying…");
+                warnedUnavailable = true;
+            }
+            continue;
+        }
+        if (status.status === "approved") {
+            // The base we RESOLVED is the one we save and hand to Claude Code — never
+            // the server's self-reported `status.baseUrl`. That field is the API's
+            // configured public URL (API_BASE_URL), which a local or self-hosted server
+            // usually leaves at the production default: obeying it would take a login
+            // the user aimed at `--base http://localhost:4000` and quietly point both
+            // the credentials file and the registered MCP server at api.baychat.io,
+            // where this token does not exist. `base` is always a resolved non-empty
+            // string (flag → env → default), so there is nothing to fall back to.
+            //
+            // Never print the token — it lives in the credentials file only.
+            (0, config_1.saveDeviceCredentials)({
+                baseUrl: base,
+                token: status.token,
+                user: status.user,
+                expiresAt: status.expiresAt,
+            });
+            console.log(`✓ Logged in as ${status.user.name}`);
+            registerWithClaude(base, status.token);
+            console.log("\n  Run /baychat <name> in any session.");
+            return true;
+        }
+    }
+    console.log("Login request expired — run baychat login again.");
+    return false;
+}
+/**
+ * The renewal nudge for a device credential, or null when none is due. Device
+ * credentials expire (30 days), and the failure mode without a warning is an
+ * MCP server that silently stops answering mid-session.
+ *
+ * An unparseable `expiresAt` (the `BAYCHAT_DEVICE_TOKEN` env path, where the
+ * server is the authority on expiry) yields null rather than a bogus warning.
+ */
+function deviceExpiryWarning(dc, now = new Date()) {
+    const msLeft = new Date(dc.expiresAt).getTime() - now.getTime();
+    if (Number.isNaN(msLeft))
+        return null;
+    if (msLeft <= 0)
+        return "Your BayChat login has expired — run `npx baychat login`.";
+    if (msLeft < 3 * 86_400_000) {
+        const hours = Math.max(1, Math.round(msLeft / 3_600_000));
+        return `Your BayChat login expires in about ${hours}h — run \`npx baychat login\` to renew.`;
+    }
+    return null;
+}
+/**
+ * Print the device-expiry nudge, if one is due, through `print`. Shared by the
+ * CLI (stdout) and the stdio MCP server (stderr — stdout is the JSON-RPC
+ * channel there). No device credentials → nothing to say.
+ */
+function printDeviceExpiryWarning(print = console.log) {
+    const device = (0, config_1.loadDeviceCredentials)();
+    if (!device)
+        return;
+    const warning = deviceExpiryWarning(device);
+    if (warning)
+        print(warning);
+}
 // ─── Agent tools (`search` / `fetch`) ──────────────────────────────────────
 // The shell twins of the `web_search` / `web_fetch` MCP tools — same client
 // functions, same rendering, same untrusted-content notice, so an agent without

package/dist/config.js

@@ -33,38 +33,133 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_API_URL = void 0;
 exports.configDir = configDir;
 exports.saveCredentials = saveCredentials;
 exports.loadCredentials = loadCredentials;
+exports.saveDeviceCredentials = saveDeviceCredentials;
+exports.loadDeviceCredentials = loadDeviceCredentials;
 exports.loadCursor = loadCursor;
 exports.saveCursor = saveCursor;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+exports.DEFAULT_API_URL = "https://api.baychat.io";
 function configDir() {
     return process.env.BAYCHAT_CONFIG_DIR || path.join(os.homedir(), ".baychat");
 }
 const credentialsPath = () => path.join(configDir(), "credentials.json");
 const cursorsPath = () => path.join(configDir(), "cursors.json");
-function saveCredentials(creds) {
+/**
+ * The whole credentials file as a plain object, or `{}` when it is missing or
+ * unreadable. credentials.json holds TWO independent credentials — the agent
+ * pair (`baseUrl`/`token`/`agent`) and the device login (`device`) — so every
+ * write must merge rather than replace: `baychat login` must not log the agent
+ * out, and `baychat pair` must not log the laptop out.
+ */
+function loadFile() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(credentialsPath(), "utf8"));
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        // Missing or corrupt file — treat as empty. Callers turn that into "not
+        // connected"; nothing here is worth surfacing to the user.
+        return {};
+    }
+}
+/**
+ * The same file, read for a WRITE rather than a read.
+ *
+ * `loadFile` treats an unreadable file as `{}` — correct for a read, where the
+ * answer is "not connected". It is NOT correct here: merging onto `{}` means the
+ * next `baychat login` silently overwrites a credentials file it could not parse,
+ * destroying the agent pairing (or device login) that may still be sitting in it,
+ * intact, behind one stray character. A missing file is genuinely empty; anything
+ * else is refused, by name, so the user can look at it before we replace it.
+ *
+ * @throws when the file exists but is not a readable JSON object.
+ */
+function loadFileForMerge() {
+    const file = credentialsPath();
+    let raw;
+    try {
+        raw = fs.readFileSync(file, "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw new Error(`Cannot read ${file}: ${err.message}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        parsed = undefined;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`${file} is not valid JSON — refusing to overwrite it and lose the credential it may still hold. Inspect or delete the file, then run this command again.`);
+    }
+    return parsed;
+}
+/**
+ * Merge `changes` into credentials.json, atomically.
+ *
+ * Written to a temp file and renamed into place: `rename` is atomic on POSIX, so
+ * an interrupted write (^C, a full disk, a crash) leaves the previous file
+ * untouched rather than a truncated one — and a truncated credentials file is
+ * both credentials gone at once, since the agent pairing and the device login
+ * share it. The mode is pinned AFTER the rename because `writeFileSync`'s `mode`
+ * only applies when it creates the file: a leftover temp file from a previous
+ * run keeps its old permissions and carries them across the rename.
+ */
+function writeMerged(changes) {
     fs.mkdirSync(configDir(), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(credentialsPath(), JSON.stringify(creds, null, 2) + "\n", { mode: 0o600 });
+    const file = credentialsPath();
+    const merged = { ...loadFileForMerge(), ...changes };
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(merged, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, file);
+    fs.chmodSync(file, 0o600);
+}
+function saveCredentials(creds) {
+    writeMerged({ baseUrl: creds.baseUrl, token: creds.token, agent: creds.agent });
 }
 function loadCredentials() {
     // Env override first — headless setups pass the token without a pair step.
     if (process.env.BAYCHAT_TOKEN) {
         return {
-            baseUrl: process.env.BAYCHAT_API_URL || "https://api.baychat.io",
+            baseUrl: process.env.BAYCHAT_API_URL || exports.DEFAULT_API_URL,
             token: process.env.BAYCHAT_TOKEN,
             agent: { id: "env", name: "env" },
         };
     }
-    try {
-        return JSON.parse(fs.readFileSync(credentialsPath(), "utf8"));
-    }
-    catch {
+    const file = loadFile();
+    const agent = file.agent;
+    if (typeof file.token !== "string" || !agent)
         return null;
+    return { baseUrl: String(file.baseUrl ?? exports.DEFAULT_API_URL), token: file.token, agent };
+}
+function saveDeviceCredentials(device) {
+    writeMerged({ device });
+}
+function loadDeviceCredentials() {
+    // Same env-override shape as BAYCHAT_TOKEN: a headless/CI box can supply a
+    // device token directly and skip the QR. `expiresAt` is unknown on this path
+    // (the server is the authority) — the empty string means "don't warn".
+    if (process.env.BAYCHAT_DEVICE_TOKEN) {
+        return {
+            baseUrl: process.env.BAYCHAT_API_URL || exports.DEFAULT_API_URL,
+            token: process.env.BAYCHAT_DEVICE_TOKEN,
+            user: { id: "env", name: "env" },
+            expiresAt: "",
+        };
     }
+    const device = loadFile().device;
+    if (!device || typeof device.token !== "string")
+        return null;
+    return device;
 }
 function loadCursors() {
     try {

package/dist/index.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const commands_1 = require("./commands");
 const mcp_1 = require("./mcp");
+const mcp_config_1 = require("./mcp-config");
 const HELP = `baychat — BayChat connector CLI for agent sessions (Claude Code, Codex)
 
 Usage:
@@ -11,6 +12,9 @@ Usage:
                                         live identity, conversations, and room context.
                                         --catch-up also appends the rolling summary +
                                         the messages after its boundary
+  baychat login [--token <PAT>] [--base <url>]
+                                        Log this laptop in to BayChat (QR) and add the
+                                        BayChat MCP server to Claude Code
   baychat pair <code> [--base <url>]   Redeem a pairing code from the BayChat app
   baychat link [--name <n>] [--base <url>]
                                         Link this session via a QR you scan with your phone
@@ -31,6 +35,11 @@ Usage:
                                         (Claude Desktop, Claude Code, Cursor) get BayChat
                                         as native tools. Speaks JSON-RPC on stdout — do not
                                         run it interactively
+  baychat mcp-config [--client codex|cursor|desktop]
+                                        Print a paste-ready MCP config for another
+                                        client, pointed at the remote BayChat server.
+                                        No --client lists what's supported. The config
+                                        goes to stdout, the guidance to stderr
   baychat watch <conversationId> [--interval <sec>] [--timeout <sec>]
                                         Block until new messages arrive (exit 0)
                                         or timeout (exit 2)
@@ -66,6 +75,10 @@ async function main() {
         case "onboard":
             await (0, commands_1.cmdOnboard)(positional(args), { catchUp: args.includes("--catch-up") });
             return 0;
+        case "login": {
+            const loggedIn = await (0, commands_1.cmdLogin)({ base: flag(args, "--base"), token: flag(args, "--token") });
+            return loggedIn ? 0 : 2; // 2 = the link request expired without approval
+        }
         case "pair": {
             if (!args[0])
                 throw new Error("Usage: baychat pair <code>");
@@ -137,6 +150,12 @@ async function main() {
             });
             return got ? 0 : 2;
         }
+        case "mcp-config": {
+            // `--client` with no value is a typo, not a request for the menu: pass the
+            // empty string so it is rejected by name rather than silently listing.
+            (0, mcp_config_1.cmdMcpConfig)(args.includes("--client") ? (flag(args, "--client") ?? "") : undefined);
+            return 0;
+        }
         case "mcp": {
             // Boot the stdio MCP server, then block forever: the transport keeps the
             // process alive on stdin, and falling through to process.exit() would kill