@agentcomms/resend 0.10.0 → 0.12.0

package/dist/{send-Ba1caJ6x.mjs → send-B75DtFiy.mjs}

@@ -5,14 +5,14 @@ import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { homedir, platform, userInfo } from "node:os";
+import { constants as constants$1, realpathSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 import "node:readline/promises";
 import { styleText } from "node:util";
-import { constants as constants$1 } from "node:fs";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.10.0";
+const VERSION$1 = "0.12.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -187,7 +187,7 @@ function refusedBecause(method, pathname) {
 	return null;
 }
 //#endregion
-//#region ../core/dist/update-gate-BiceOnzC.mjs
+//#region ../core/dist/update-check-pKViNOsH.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -1196,74 +1196,60 @@ function connectMailboxCommand() {
 	return mail ? `${mail.binary} inbox add` : void 0;
 }
 /**
-* The grammar of an account name in version 2 of the config: `<organisation>/<platform>[-<qualifier>]`.
-*
-* `cue/gmail` is the CUE++ mailbox, `cue/slack` the CUE++ workspace, `wf/gmail-tech` a second Wherefrom mailbox. The
-* first half says who an account belongs to and the second what it is — and the schema checks the second half against
-* the account itself, so a name cannot claim to be a Slack workspace while naming a mailbox.
-*
-* Kept apart from `config.ts`, with no imports, so the schema and the helpers built on it can both depend on it
-* without depending on each other.
-*/
-/**
-* Organisation names Windows cannot use as a directory.
-*
-* The organisation becomes a folder — downloads land in `downloads/cue/gmail/…` — and `con`, `nul` and the rest are
-* device names on Windows in every directory, with or without an extension. Refused here rather than discovered the
-* first time somebody on Windows saves an attachment.
+* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
+* and the preview renderer (which makes them visible), so the two can never disagree.
 */
-const WINDOWS_RESERVED$1 = [
-	"con",
-	"prn",
-	"aux",
-	"nul",
-	...range$1("com"),
-	...range$1("lpt")
+/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
+const INVISIBLE_RANGES = [
+	[173, 173],
+	[847, 847],
+	[1564, 1564],
+	[4447, 4448],
+	[6068, 6069],
+	[6155, 6159],
+	[8203, 8207],
+	[8232, 8233],
+	[8234, 8238],
+	[8288, 8292],
+	[8294, 8303],
+	[12644, 12644],
+	[65024, 65039],
+	[65279, 65279],
+	[65440, 65440],
+	[917504, 917631]
 ];
-function range$1(prefix) {
-	return Array.from({ length: 9 }, (_, index) => `${prefix}${index + 1}`);
+function isInvisible(codePoint) {
+	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
+	return false;
 }
-const ORG = "[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?";
-const PLATFORM$1 = "[a-z][a-z0-9]{0,15}";
 /**
-* The whole grammar as one expression, so a record key can be checked by the schema without a second pass.
-*
-* Segments never start or end with a hyphen, and the character set is `[a-z0-9/-]` and nothing else: no `.`, so no
-* `..`; no whitespace, no controls, no upper case, nothing that looks like something else.
+* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
+* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
 */
-const NAME_PATTERN = new RegExp(`^(?!(?:${WINDOWS_RESERVED$1.join("|")})/)(${ORG})/(${PLATFORM$1})(?:-([a-z0-9](?:[a-z0-9-]{0,14}[a-z0-9])?))?$`);
-/** A platform word on its own — `gmail`, `slack` — which is also a channel's word in its manifest. */
-const PLATFORM_PATTERN = new RegExp(`^${PLATFORM$1}$`);
-const NAME_MESSAGE = "names look like organisation/platform, optionally with a qualifier: cue/gmail, wf/gmail-tech, cue/slack";
-/** The three parts of a valid name, or null for anything the grammar refuses. */
-function parseName(name) {
-	const match = NAME_PATTERN.exec(name);
-	if (!match) return null;
-	const [, org = "", platform = "", qualifier] = match;
-	return qualifier === void 0 ? {
-		org,
-		platform
-	} : {
-		org,
-		platform,
-		qualifier
-	};
+function isControl(codePoint) {
+	if (codePoint === 9 || codePoint === 10) return false;
+	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function isDangerous(codePoint) {
+	return isControl(codePoint) || isInvisible(codePoint);
 }
 /**
-* Why a name is refused, in words a person can act on — or null when it is fine.
+* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
+* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
 *
-* `platform` is what the account actually is. Checked here as well as in the schema, so the error arrives when the
-* name is proposed rather than as a refused config write after a sign-in has already been spent.
+* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
+* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
+* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
 */
-function nameShapeProblem(name, platform) {
-	const parsed = parseName(name);
-	if (!parsed) {
-		const org = name.split("/")[0] ?? "";
-		if (WINDOWS_RESERVED$1.includes(org)) return `"${org}" cannot be an organisation name: Windows reserves it, and the organisation becomes a folder`;
-		return `"${name}" is not a valid name: it should be the organisation, a slash, then ${platform} — for example acme/${platform}, or acme/${platform}-support for a second one`;
-	}
-	if (parsed.platform !== platform) return `"${name}" ends in /${parsed.platform}, but this is a ${platform} account`;
-	return null;
+function stripInvisible(text) {
+	let removed = 0;
+	let out = "";
+	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
+	else out += char;
+	return {
+		text: out,
+		removed
+	};
 }
 const APP_DIR_NAME = "agent-communications";
 /**
@@ -1327,6 +1313,23 @@ function expandHome(path, home = homedir(), joinPaths = join) {
 	return path;
 }
 /**
+* A path as a preview shows it: the home at its start written `~`, the way a person reads and types it. The inverse of
+* `expandHome`, and like it, nothing else is touched. Case is ignored on Windows, whose paths are not case-sensitive.
+*/
+function shortenHome(path, home, platform = process.platform) {
+	if (!home) return path;
+	const same = (a, b) => platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+	let end = home.length;
+	while (end > 0 && (home[end - 1] === "/" || home[end - 1] === "\\")) end -= 1;
+	const root = home.slice(0, end);
+	if (same(path, root)) return "~";
+	for (const separator of platform === "win32" ? ["\\", "/"] : ["/"]) {
+		const prefix = `${root}${separator}`;
+		if (path.length > prefix.length && same(path.slice(0, prefix.length), prefix)) return `~${separator}${path.slice(prefix.length)}`;
+	}
+	return path;
+}
+/**
 * The user's home directory, read from an environment.
 *
 * Windows does not set `HOME`; it sets `USERPROFILE`. Call sites that wrote `env.HOME ?? ''` and handed the result to
@@ -1341,6 +1344,265 @@ function expandHome(path, home = homedir(), joinPaths = join) {
 function homeDirectory(env = process.env) {
 	return env.HOME || env.USERPROFILE || homedir();
 }
+const WINDOWS_RESERVED$1 = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹²³])$/i;
+const UNSAFE_FILENAME_CHARS = /[/\\\u0000-\u001f\u007f<>:"|?*]/g;
+/** Truncates a string to at most `maxBytes` UTF-8 bytes without splitting a code point. */
+function truncateBytes(value, maxBytes) {
+	let out = "";
+	let bytes = 0;
+	for (const char of value) {
+		const size = Buffer.byteLength(char, "utf8");
+		if (bytes + size > maxBytes) break;
+		out += char;
+		bytes += size;
+	}
+	return out;
+}
+/**
+* A file name that is safe to create on macOS, Linux and Windows: NFC-normalised, no separators or control
+* characters, no leading or trailing dots and spaces, not a Windows reserved device name, at most `maxBytes` UTF-8
+* bytes with the extension kept. Never empty.
+*/
+function safeFilename(name, maxBytes = 255, fallback = "attachment") {
+	let cleaned = [...name.normalize("NFC")].filter((character) => !isDangerous(character.codePointAt(0) ?? 0)).join("").replace(UNSAFE_FILENAME_CHARS, "_").replace(/\s+/g, " ");
+	cleaned = cleaned.replace(/^[.\s]+/, "").replace(/[.\s]+$/, "");
+	if (cleaned === "") cleaned = fallback;
+	const extension = extname(cleaned);
+	if (WINDOWS_RESERVED$1.test((cleaned.split(".")[0] ?? cleaned).trimEnd())) cleaned = `_${cleaned}`;
+	if (Buffer.byteLength(cleaned, "utf8") <= maxBytes) return cleaned;
+	const keptExtension = Buffer.byteLength(extension, "utf8") < maxBytes / 2 ? extension : "";
+	return truncateBytes(keptExtension ? cleaned.slice(0, -keptExtension.length) : cleaned, maxBytes - Buffer.byteLength(keptExtension, "utf8")) + keptExtension;
+}
+/** True when `candidate` is `root` itself or strictly inside it (lexically). */
+function isInside(candidate, root) {
+	const path = relative(resolve(root), resolve(candidate));
+	return path === "" || !path.startsWith(`..${sep}`) && path !== ".." && !isAbsolute(path);
+}
+async function realpathOfExistingAncestor(path) {
+	let current = resolve(path);
+	const tail = [];
+	for (;;) try {
+		const real = await realpath(current);
+		return tail.length ? join(real, ...tail.reverse()) : real;
+	} catch (error) {
+		const parent = dirname(current);
+		if (error.code !== "ENOENT" || parent === current) throw error;
+		tail.push(basename(current));
+		current = parent;
+	}
+}
+/**
+* Resolves `target` for writing and proves it stays inside `root` after symlinks in its existing ancestors are
+* followed. Throws BAD_DATA otherwise. The root must already exist.
+*/
+async function resolveInsideRoot(root, target) {
+	const realRoot = await realpath(root);
+	const lexical = resolve(root, target);
+	if (!isInside(lexical, root)) throw new CommsError("BAD_DATA", `refusing to write outside ${root}`, { details: { target } });
+	if (!isInside(await realpathOfExistingAncestor(lexical), realRoot)) throw new CommsError("BAD_DATA", `refusing to write through a link that leaves ${root}`, { details: { target } });
+	return lexical;
+}
+/**
+* Creates a new file for writing without following a symlink at the final component and without overwriting an
+* existing file. Picks `name-2.ext`, `name-3.ext`… when the name is taken.
+*/
+async function createUniqueFile(directory, filename) {
+	const extension = extname(filename);
+	const stem = extension ? filename.slice(0, -extension.length) : filename;
+	const noFollow = process.platform === "win32" ? 0 : constants$1.O_NOFOLLOW;
+	for (let attempt = 1; attempt < 1e3; attempt += 1) {
+		const name = attempt === 1 ? filename : `${stem}-${attempt}${extension}`;
+		const path = join(directory, name);
+		try {
+			return {
+				path,
+				handle: await open(path, constants$1.O_WRONLY | constants$1.O_CREAT | constants$1.O_EXCL | noFollow, 384)
+			};
+		} catch (error) {
+			if (error.code === "EEXIST") continue;
+			throw error;
+		}
+	}
+	throw new CommsError("BAD_DATA", `could not find a free file name in ${directory}: the name and every numbered one after it are taken`);
+}
+/**
+* Default places attachments may never be read from, whatever the allowed roots say. `~/.*` means every dot-entry
+* directly under home — SSH, cloud, npm, git and shell credentials, agent configs; `**∕.git/**` any repository's git
+* directory; `**∕.env*` dotenv files anywhere.
+*/
+function defaultAttachDeny(configDir, env = process.env) {
+	const deny = [
+		configDir,
+		"~/.*",
+		"~/Library",
+		"**/.git/**",
+		"**/.env*"
+	];
+	if (env.APPDATA) deny.push(env.APPDATA);
+	if (env.LOCALAPPDATA) deny.push(env.LOCALAPPDATA);
+	return deny;
+}
+async function realOrResolved(path) {
+	try {
+		return await realpath(path);
+	} catch {
+		return resolve(path);
+	}
+}
+/**
+* Whether a folder, as written, says where it is on its own: from the home (`~`), or absolute — and on Windows with its
+* drive (`C:\…`) or share (`\\server\share\…`). Windows calls `\outgoing` absolute, but it is on whichever drive is
+* current when it is read, and `C:outgoing` is relative to that drive's current folder; either would move with the
+* process that reads it. A folder in the configuration that does not name its place — written by hand before 0.12.0,
+* say — allows nothing, and `agentcomms attach` takes none (#45).
+*/
+function namesItsPlace(path, platform = process.platform) {
+	if (path === "~" || path.startsWith("~/") || path.startsWith("~\\")) return true;
+	if (platform === "win32") return /^[A-Za-z]:[\\/]/.test(path) || /^[\\/]{2}[^\\/?.][^\\/]*[\\/][^\\/]+/.test(path);
+	return isAbsolute(path);
+}
+/**
+* Proves a local file may be attached to a draft: it resolves (following links) to a regular file inside one of the
+* allowed roots and inside none of the deny entries. A deny entry of the form `**` + `/name*` matches by file name
+* prefix (so `.env*` matches `.env` and `.env.local`). Returns the real path.
+*/
+async function checkAttachable(path, policy) {
+	const home = policy.home;
+	const requested = resolve(expandHome(path, home));
+	let real;
+	try {
+		real = await realpath(requested);
+	} catch {
+		throw new CommsError("NOT_FOUND", `attachment not found: ${path}`);
+	}
+	if (!(await stat(real)).isFile()) throw new CommsError("BAD_DATA", `not a regular file: ${path}`);
+	if (!(await Promise.all(policy.roots.filter((root) => namesItsPlace(root)).map((root) => realOrResolved(expandHome(root, home))))).some((root) => isInside(real, root))) throw new CommsError("BAD_DATA", `attachments must come from an allowed folder; ${path} is outside them`, { hint: "Copy the file under your home folder — not into one of its hidden folders — and name the copy instead, or allow its folder with `agentcomms attach roots add <folder>` (needs your approval)." });
+	const name = basename(real);
+	const homeDir = await realOrResolved(home ?? (await import("node:os")).homedir());
+	for (const entry of policy.deny) {
+		if (entry === "~/.*") {
+			if (isInside(real, homeDir)) {
+				const first = relative(homeDir, real).split(sep)[0] ?? "";
+				if (first.startsWith(".")) throw new CommsError("BAD_DATA", `refusing to attach a file from ~/${first}: hidden folders in your home are never attached`);
+			}
+			continue;
+		}
+		if (entry === "**/.git/**") {
+			if (real.split(sep).some((segment) => segment.toLowerCase() === ".git")) throw new CommsError("BAD_DATA", "refusing to attach a file from a .git folder");
+			continue;
+		}
+		if (entry.startsWith("**/")) {
+			const pattern = entry.slice(3).toLowerCase();
+			const candidate = name.toLowerCase();
+			const prefix = pattern.endsWith("*") ? pattern.slice(0, -1) : pattern;
+			if (pattern.endsWith("*") ? candidate.startsWith(prefix) : candidate === prefix) throw new CommsError("BAD_DATA", `refusing to attach ${name}: files matching ${entry} are never attached`);
+			continue;
+		}
+		const denied = await realOrResolved(expandHome(entry, home));
+		if (isInside(real, denied)) throw new CommsError("BAD_DATA", `refusing to attach a file from ${entry}`);
+	}
+	return real;
+}
+/**
+* A caller-supplied subdirectory, checked before it is joined to anything.
+*
+* `path.join` is not a boundary, and it was being used as one. `join('work', '../personal')` is `'personal'`: the
+* alias segment is cancelled, the result still resolves inside the downloads root, so `resolveInsideRoot` allows it
+* — and one mailbox's files are written into another mailbox's folder, over the `manifest.json` that is that
+* mailbox's own record of where its attachments came from. `join('work', '/etc/cron.d')` is `'work/etc/cron.d'`:
+* the leading separator is simply dropped, so an absolute path that every document describes as refused is quietly
+* accepted under a name the caller never asked for.
+*
+* Neither is an escape from the root, which is why neither showed up as a jail failure. In one respect they are
+* worse than an escape: they succeed, and report a path the caller was never told about.
+*
+* So the check happens here, on the caller's own string, before any join — absolute paths and `..` are refused
+* rather than normalised away. A nested `reports/august` is fine; that is what the option is for.
+*/
+function relativeSubpath(out, field = "out") {
+	const value = (out ?? "").trim();
+	if (!value) return "";
+	const refuse = (why) => {
+		throw new CommsError("BAD_DATA", `${field} must be a relative subpath: ${why}`, {
+			hint: "Pass something like \"reports/august\". It is always placed inside this account’s own folder.",
+			details: { value }
+		});
+	};
+	if (isAbsolute(value) || /^[A-Za-z]:/.test(value) || value.startsWith("/") || value.startsWith("\\")) refuse("it is an absolute path");
+	const segments = value.split(/[/\\]+/);
+	if (segments.includes("..")) refuse("it climbs out with \"..\"");
+	return segments.filter((segment) => segment && segment !== ".").join("/");
+}
+/**
+* The grammar of an account name in version 2 of the config: `<organisation>/<platform>[-<qualifier>]`.
+*
+* `cue/gmail` is the CUE++ mailbox, `cue/slack` the CUE++ workspace, `wf/gmail-tech` a second Wherefrom mailbox. The
+* first half says who an account belongs to and the second what it is — and the schema checks the second half against
+* the account itself, so a name cannot claim to be a Slack workspace while naming a mailbox.
+*
+* Kept apart from `config.ts`, with no imports, so the schema and the helpers built on it can both depend on it
+* without depending on each other.
+*/
+/**
+* Organisation names Windows cannot use as a directory.
+*
+* The organisation becomes a folder — downloads land in `downloads/cue/gmail/…` — and `con`, `nul` and the rest are
+* device names on Windows in every directory, with or without an extension. Refused here rather than discovered the
+* first time somebody on Windows saves an attachment.
+*/
+const WINDOWS_RESERVED = [
+	"con",
+	"prn",
+	"aux",
+	"nul",
+	...range$1("com"),
+	...range$1("lpt")
+];
+function range$1(prefix) {
+	return Array.from({ length: 9 }, (_, index) => `${prefix}${index + 1}`);
+}
+const ORG = "[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?";
+const PLATFORM$1 = "[a-z][a-z0-9]{0,15}";
+/**
+* The whole grammar as one expression, so a record key can be checked by the schema without a second pass.
+*
+* Segments never start or end with a hyphen, and the character set is `[a-z0-9/-]` and nothing else: no `.`, so no
+* `..`; no whitespace, no controls, no upper case, nothing that looks like something else.
+*/
+const NAME_PATTERN = new RegExp(`^(?!(?:${WINDOWS_RESERVED.join("|")})/)(${ORG})/(${PLATFORM$1})(?:-([a-z0-9](?:[a-z0-9-]{0,14}[a-z0-9])?))?$`);
+/** A platform word on its own — `gmail`, `slack` — which is also a channel's word in its manifest. */
+const PLATFORM_PATTERN = new RegExp(`^${PLATFORM$1}$`);
+const NAME_MESSAGE = "names look like organisation/platform, optionally with a qualifier: cue/gmail, wf/gmail-tech, cue/slack";
+/** The three parts of a valid name, or null for anything the grammar refuses. */
+function parseName(name) {
+	const match = NAME_PATTERN.exec(name);
+	if (!match) return null;
+	const [, org = "", platform = "", qualifier] = match;
+	return qualifier === void 0 ? {
+		org,
+		platform
+	} : {
+		org,
+		platform,
+		qualifier
+	};
+}
+/**
+* Why a name is refused, in words a person can act on — or null when it is fine.
+*
+* `platform` is what the account actually is. Checked here as well as in the schema, so the error arrives when the
+* name is proposed rather than as a refused config write after a sign-in has already been spent.
+*/
+function nameShapeProblem(name, platform) {
+	const parsed = parseName(name);
+	if (!parsed) {
+		const org = name.split("/")[0] ?? "";
+		if (WINDOWS_RESERVED.includes(org)) return `"${org}" cannot be an organisation name: Windows reserves it, and the organisation becomes a folder`;
+		return `"${name}" is not a valid name: it should be the organisation, a slash, then ${platform} — for example acme/${platform}, or acme/${platform}-support for a second one`;
+	}
+	if (parsed.platform !== platform) return `"${name}" ends in /${parsed.platform}, but this is a ${platform} account`;
+	return null;
+}
 /**
 * Whether this release may write version 2 of the config.
 *
@@ -1947,8 +2209,17 @@ const POLICY_RANK$1 = {
 * user a consent prompt for a change that is not one. Linux is case-sensitive, so case is kept.
 */
 function normalisePath(path) {
-	const expanded = withoutTrailingSeparators(resolve(expandHome(path.trim(), homedir())));
-	return platform() === "darwin" || platform() === "win32" ? expanded.toLowerCase() : expanded;
+	return comparablePath(resolve(expandHome(path.trim(), homedir())));
+}
+/**
+* An absolute path in the form two paths are compared in here: no trailing separator, and case folded on macOS and
+* Windows, whose filesystems are case-insensitive by default (see `normalisePath`). The top of a disk keeps its
+* separator — `/`, `C:\` — so it is not read as no path at all.
+*/
+function comparablePath(absolute) {
+	const stripped = withoutTrailingSeparators(absolute);
+	const kept = stripped === "" || /^[A-Za-z]:$/.test(stripped) ? absolute.slice(0, stripped.length + 1) : stripped;
+	return platform() === "darwin" || platform() === "win32" ? kept.toLowerCase() : kept;
 }
 /**
 * The path with any separators at its end removed. A loop, not `/[/\\]+$/`: that pattern backtracks over every run of
@@ -1963,9 +2234,14 @@ function withoutTrailingSeparators(path) {
 function holdsSecrets(config) {
 	return Object.values(config.clients).some((client) => Boolean(client.secretRef)) || Object.values(config.inboxes).some((inbox) => Boolean(inbox.secretRef)) || Object.values(config.accounts).some((account) => Boolean(account.secretRef));
 }
-/** True when `candidate` is the same directory as `parent`, or inside it. Both may be unset. */
+/**
+* True when `candidate` is the same directory as `parent`, or inside it. Both may be unset. Both are compared as
+* written, so both have to be in one form first: `normalisePath`, or `comparablePath` of a real path. A parent that is
+* the top of a disk — `/`, `c:\` — holds everything on it.
+*/
 function isInsideDirectory(candidate, parent) {
 	if (!candidate || !parent) return false;
+	if (parent.endsWith("/") || parent.endsWith("\\")) return candidate.startsWith(parent);
 	return candidate === parent || candidate.startsWith(`${parent}/`) || candidate.startsWith(`${parent}\\`);
 }
 /**
@@ -2038,10 +2314,11 @@ function classifyChange(before, after) {
 	if (b.riskEscalation && !a.riskEscalation) loosen("defaults.riskEscalation", b.riskEscalation, a.riskEscalation);
 	if (updateCheckSetting(before) === "on" && updateCheckSetting(after) === "off") loosen("defaults.updateCheck", updateCheckSetting(before), updateCheckSetting(after));
 	if (a.sendCaps.perHour > b.sendCaps.perHour || a.sendCaps.perDay > b.sendCaps.perDay) loosen("defaults.sendCaps", b.sendCaps, a.sendCaps);
-	const roots = (list) => new Set(list.map(normalisePath));
-	const before_roots = roots(b.attachRoots);
+	const roots = (list) => new Set(list.map((path) => comparablePath(resolve(expandHome(path, homedir())))));
+	const readRoots = (list) => roots(list.filter((root) => namesItsPlace(root)));
+	const before_roots = readRoots(b.attachRoots);
 	const after_deny = roots(a.attachDeny);
-	if ([...roots(a.attachRoots)].some((root) => !before_roots.has(root))) loosen("defaults.attachRoots", b.attachRoots, a.attachRoots);
+	if ([...readRoots(a.attachRoots)].some((root) => !before_roots.has(root))) loosen("defaults.attachRoots", b.attachRoots, a.attachRoots);
 	if ([...roots(b.attachDeny)].some((deny) => !after_deny.has(deny))) loosen("defaults.attachDeny", b.attachDeny, a.attachDeny);
 	const downloadsBefore = b.downloadsDir === void 0 ? void 0 : normalisePath(b.downloadsDir);
 	const downloadsAfter = a.downloadsDir === void 0 ? void 0 : normalisePath(a.downloadsDir);
@@ -3900,7 +4177,7 @@ async function installManagedRuntime(context, product, version) {
 		private: true
 	}, null, 2)}\n`);
 	const npmCli = await findNpmCli();
-	await run(process.execPath, [
+	await run(context.env, process.execPath, [
 		npmCli,
 		"install",
 		"--prefix",
@@ -3924,10 +4201,12 @@ async function findNpmCli() {
 	throw new CommsError("CONFIG", "npm could not be found next to this Node installation", { hint: "Install with `--launcher npx` instead, which runs the published package directly." });
 }
 /**
-* A command run to its end. Its environment is this process's, and on Windows also tells it never to take a program
-* from its current folder: `npm` and a client's command both start programs of their own by name.
+* A command run to its end, in `env`: the environment the install resolved its target from — which client config,
+* which client CLI, which node — and not this process's, which may be another. On Windows it also tells the command
+* never to take a program from its current folder: `npm` and a client's command both start programs of their own by
+* name.
 */
-function run(command, args) {
+function run(env, command, args) {
 	return new Promise((resolvePromise, reject) => {
 		const child = spawn(command, args, {
 			stdio: [
@@ -3935,7 +4214,7 @@ function run(command, args) {
 				"ignore",
 				"pipe"
 			],
-			env: childEnvironment(process.env)
+			env: childEnvironment(env)
 		});
 		let stderr = "";
 		child.stderr?.on("data", (chunk) => {
@@ -3948,14 +4227,19 @@ function run(command, args) {
 		});
 	});
 }
-async function buildEntry(context, product, options, apply) {
+/**
+* The entry for one server, starting the command its preflight resolved (`resolved`): what the plan named and the
+* person approved. Nothing here looks on PATH again — a node or an npx that turned up since would be another command
+* than the one the preview said.
+*/
+async function buildEntry(context, product, options, apply, resolved) {
 	const launcher = options.launcher ?? "managed";
-	const node = await resolveNode(context.env);
+	const { node } = resolved;
 	const env = minimalEnv(context, node);
 	const serverArgs = product.serverArgs(options);
 	if (launcher === "npx") return {
 		entry: {
-			command: await whichExecutable("npx", context.env) ?? "npx",
+			command: resolved.command,
 			args: [
 				"-y",
 				`${product.npxPackage}@${product.version}`,
@@ -4099,6 +4383,13 @@ function claimName(product, options, name, existing) {
 		throw new CommsError("CONFIG", `${options.client} already has an MCP server called "${name}", and it is not this one (it runs ${what})`, { hint: `Register this one under another name: \`${installCommand$1(product, options, other)}\`. --force does not replace a server this did not install.` });
 	}
 	if (taken.length > 0 && !options.force) {
+		for (const pin of PIN_OPTIONS) {
+			const wanted = options[pin];
+			const served = taken.map((server) => product.narrowingOf(server.args)[pin]).find(Boolean);
+			if (!wanted || !served || served === wanted) continue;
+			const second = `${product.defaultServerName}-${wanted.split("/")[0]}`;
+			throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `That entry serves ${served}; to serve ${wanted} as well, register a second entry under its own name: \`${installCommand$1(product, options, second === name ? `${name}-2` : second)}\`.` });
+		}
 		const npx = taken.some((server) => server.args.some((argument) => argument.startsWith(`${product.npxPackage}@`)));
 		const again = {
 			...keepNarrowing(product, options, taken).options,
@@ -4164,9 +4455,10 @@ function installCommand$1(product, options, name, extra = []) {
 }
 /**
 * A command's exit status and what it printed, kept here and never shown: codex prints an entry's env. Started as
-* `run` starts one, so that on Windows it takes no program from its current folder either.
+* `run` starts one — in the environment the target was resolved from — so that on Windows it takes no program from its
+* current folder either.
 */
-function capture$1(command, args) {
+function capture$1(env, command, args) {
 	return new Promise((resolvePromise, reject) => {
 		const child = spawn(command, args, {
 			stdio: [
@@ -4174,7 +4466,7 @@ function capture$1(command, args) {
 				"pipe",
 				"pipe"
 			],
-			env: childEnvironment(process.env)
+			env: childEnvironment(env)
 		});
 		let stdout = "";
 		let stderr = "";
@@ -4202,11 +4494,11 @@ function capture$1(command, args) {
 * or a failure that is not "no such server", stops the install: not knowing is not the same as nothing there.
 * Nothing codex prints is repeated, because its answer carries the entry's env.
 */
-async function codexRegistration(binary, name, path) {
+async function codexRegistration(env, binary, name, path) {
 	const unknown = () => new CommsError("CONFIG", `codex would not say what it has registered as "${name}", so nothing was written`, { hint: `Look with \`codex mcp get ${name}\`. If it is not an older copy of this server, choose another --name; \`--print\` shows the entry to add by hand.` });
 	let answer;
 	try {
-		answer = await capture$1(binary, [
+		answer = await capture$1(env, binary, [
 			"mcp",
 			"get",
 			name,
@@ -4308,21 +4600,48 @@ async function preflightInstall(context, product, options) {
 	}
 	let previous = writes ? claimName(product, options, name, existing) : [];
 	if (writes && binary && options.client === "codex") {
-		const reported = await codexRegistration(binary, name, configPath ?? "codex");
+		const reported = await codexRegistration(context.env, binary, name, configPath ?? "codex");
 		if (reported) previous = claimName(product, options, name, [reported]);
 	}
 	const { options: effective, kept } = keepNarrowing(product, options, previous);
+	const node = await resolveNode(context.env);
+	const command = (options.launcher ?? "managed") === "npx" ? await resolveNpx(context.env, node) : node;
 	return {
 		scan,
 		target,
 		previous,
 		effective,
-		kept
+		kept,
+		node,
+		command
 	};
 }
+/**
+* The `npx` an npx entry starts, as a full path: from PATH, or beside the `node` found, where npm installs it.
+*
+* Never the bare name. An entry that says only `npx` is resolved by the client, later, in its own environment — its
+* PATH, and on Windows its current folder — so the approval would bind a word, and the program run would be whichever
+* the client found. With no `npx` either way, nothing is written.
+*/
+async function resolveNpx(env, node) {
+	const found = await whichExecutable("npx", env) ?? await executableIn("npx", [dirname(node)], env);
+	if (found !== null) return found;
+	throw new CommsError("CONFIG", "npx could not be found, on PATH or beside node, so nothing was written", { hint: "Install Node.js with npm, which brings npx, or register with the managed launcher — the default — which needs no npx." });
+}
+/**
+* Where an install puts the entry and what the entry starts, as one sentence of the preview a person approves: the
+* client's own config file and the command, each with the home written `~`. In the approval's digest with the rest, so
+* a claim from an environment that resolves another file or another command — `CLAUDE_CONFIG_DIR` set to another
+* account's, a PATH that finds another node — is another change, and refused.
+*/
+function entryDestination(client, target, command, env) {
+	const home = homeDirectory(env);
+	const file = target.own ?? target.configPath;
+	return `the entry goes in ${file === void 0 ? `${client}'s own configuration` : shortenHome(file, home)}, and ${client} will start it with ${shortenHome(command, home)}`;
+}
 /** The plan a preflight arrived at, in the form `mcpInstall` compares: see `PlannedInstall`. */
 function plannedInstall(preflight) {
-	const { target, previous, effective } = preflight;
+	const { target, previous, effective, node, command } = preflight;
 	return {
 		writes: target.writes,
 		cliName: target.cliName,
@@ -4344,7 +4663,9 @@ function plannedInstall(preflight) {
 			inbox: effective.inbox ?? null,
 			workspace: effective.workspace ?? null,
 			readOnly: effective.readOnly === true
-		}
+		},
+		node,
+		command
 	};
 }
 /**
@@ -4368,6 +4689,8 @@ function planDrift(product, client, name, planned, now) {
 		}).join(" ") || "no pin";
 		drift.push(`the server would start with ${flags(now.narrowing)}, not ${flags(planned.narrowing)}`);
 	}
+	if (planned.command !== now.command) drift.push(`it would start the server with ${now.command}, not ${planned.command}`);
+	else if (planned.node !== now.node) drift.push(`it would run under the node at ${now.node}, not ${planned.node}`);
 	return drift;
 }
 /** The planned pin and `--read-only`, as the options that start the server: each one given, none left to be found. */
@@ -4411,7 +4734,7 @@ async function mcpInstall(context, product, options, planned) {
 	if (!writes) {
 		if (existing.find((server) => server.client === options.client && server.name === name && server.scope !== "project" && !isProductServer(server, product))) warnings.push(`${options.client} already has a different server called "${name}"; pasting this would replace it. Use --name to choose another name.`);
 	}
-	const { entry, launcher, runtimeMissing } = await buildEntry(context, product, effective, apply);
+	const { entry, launcher, runtimeMissing } = await buildEntry(context, product, effective, apply, preflight);
 	const snippet = snippetFor(options.client, name, entry);
 	const backupPath = previous.length > 0 ? await backUp(context, options.client, name, previous, /* @__PURE__ */ new Date()) : void 0;
 	const ledger = handedOutRuntimesPath(context.core.paths.dataDir);
@@ -4465,13 +4788,13 @@ async function mcpInstall(context, product, options, planned) {
 				name
 			];
 			try {
-				await run(binary, removal);
+				await run(context.env, binary, removal);
 			} catch (error) {
 				const message = error instanceof CommsError ? error.message : String(error);
 				if (!/no (mcp )?server|not found|does not exist/i.test(message)) throw error;
 			}
 			try {
-				await run(binary, args);
+				await run(context.env, binary, args);
 			} catch (error) {
 				const restore = options.client === "claude-code" ? [
 					"mcp",
@@ -4495,7 +4818,7 @@ async function mcpInstall(context, product, options, planned) {
 				];
 				let restored = true;
 				try {
-					await run(binary, restore);
+					await run(context.env, binary, restore);
 				} catch {
 					restored = false;
 				}
@@ -4505,7 +4828,7 @@ async function mcpInstall(context, product, options, planned) {
 				});
 			}
 		} else try {
-			await run(binary, args);
+			await run(context.env, binary, args);
 		} catch (error) {
 			const message = error instanceof CommsError ? error.message : String(error);
 			if (/already exists/i.test(message)) throw new CommsError("CONFIG", `${cliName} already has an MCP server called "${name}", somewhere this could not read`, {
@@ -4994,62 +5317,6 @@ function requireChannelManifest(channel) {
 	if (manifest === void 0) throw notAChannel(channel);
 	return manifest;
 }
-/**
-* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
-* and the preview renderer (which makes them visible), so the two can never disagree.
-*/
-/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
-const INVISIBLE_RANGES = [
-	[173, 173],
-	[847, 847],
-	[1564, 1564],
-	[4447, 4448],
-	[6068, 6069],
-	[6155, 6159],
-	[8203, 8207],
-	[8232, 8233],
-	[8234, 8238],
-	[8288, 8292],
-	[8294, 8303],
-	[12644, 12644],
-	[65024, 65039],
-	[65279, 65279],
-	[65440, 65440],
-	[917504, 917631]
-];
-function isInvisible(codePoint) {
-	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
-	return false;
-}
-/**
-* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
-* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
-*/
-function isControl(codePoint) {
-	if (codePoint === 9 || codePoint === 10) return false;
-	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
-}
-function isDangerous(codePoint) {
-	return isControl(codePoint) || isInvisible(codePoint);
-}
-/**
-* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
-* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
-*
-* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
-* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
-* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
-*/
-function stripInvisible(text) {
-	let removed = 0;
-	let out = "";
-	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
-	else out += char;
-	return {
-		text: out,
-		removed
-	};
-}
 function okEnvelope(data) {
 	return {
 		ok: true,
@@ -6525,7 +6792,7 @@ async function npmInstallGlobal(env, spec) {
 	}
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.10.0";
+const VERSION = "0.12.0";
 /**
 * Registering, pruning and listing the MCP servers of every channel, from the core.
 *
@@ -6700,9 +6967,10 @@ function installOptions(request) {
 *
 * `own` is the calling channel's product, from its own `mcp install`: see `ownProduct`. The sentences depend on the
 * request and the machine, not on which surface prepared them, so an approval prepared by one is claimed by the
-* other. The one sentence that names code — `--launcher local`, which starts a checkout — names the file that will be
-* started; a core running from another build of the checkout than the channel's command names another file, and that
-* is another registration, refused as one.
+* other. The sentences that name code name it as this environment resolves it: the client's config file and the node
+* or npx the entry starts (#46), and for `--launcher local` the checkout's file. A claim from an environment that
+* resolves another — `CLAUDE_CONFIG_DIR` set to another account's, a PATH that finds another node, a core running
+* from another build of the checkout — is another registration, refused as one.
 */
 function serverInstallChange(core, env, request, own) {
 	checkRequest(request);
@@ -6726,7 +6994,7 @@ function serverInstallChange(core, env, request, own) {
 			const product = await productNow();
 			const { version } = product;
 			const preflight = await preflightInstall(context, product, installOptions(request));
-			const { target, previous, effective, kept } = preflight;
+			const { target, previous, effective, kept, command } = preflight;
 			planned = {
 				product,
 				install: plannedInstall(preflight)
@@ -6735,12 +7003,14 @@ function serverInstallChange(core, env, request, own) {
 			if (target.writes) {
 				const pinned = pinName === void 0 || pinName === "readOnly" ? void 0 : effective[pinName];
 				const pins = [pinned !== void 0 ? `pinned to the ${noun} ${pinned}` : "", effective.readOnly ? "read-only" : ""].filter(Boolean);
-				const replacing = previous.length > 0 ? `, replacing its own earlier entry of that name${kept.length > 0 ? ` and keeping ${kept.join(" ")} from it` : ""}` : "";
+				const what = (pinName === void 0 || pinName === "readOnly" ? [] : [...new Set(previous.map((server) => facts.narrowingOf(server.args)[pinName] ?? null))]).map((pin) => pin === null ? `every ${noun}` : `the ${noun} ${pin}`).join(" and ");
+				const replacing = previous.length > 0 ? `, replacing its own earlier entry of that name${what ? `, which served ${what}${kept.length > 0 ? "," : ""}` : ""}${kept.length > 0 ? ` and keeping ${kept.join(" ")} from it` : ""}` : "";
 				effects.push(`registers the ${label} MCP server with ${request.client} as "${name}"${pins.length > 0 ? `, ${pins.join(", ")}` : ""}${replacing}`);
 				const everyAccount = pinName !== void 0 && pinned === void 0;
 				const everyTool = switchable && effective.readOnly !== true;
 				if (everyAccount) effects.push(`not pinned: it reaches every ${noun} on this machine${everyTool ? ", with every tool" : ""}`);
 				else if (everyTool) effects.push(`not read-only: it has every tool for ${pinned}, including those that change it`);
+				effects.push(entryDestination(request.client, target, command, env));
 				if (launcher === "npx") effects.push(`${request.client} will fetch ${facts.npxPackage}@${version} from npm each time it starts it`);
 				else if (launcher === "local") effects.push(`${request.client} will start it from ${await localCliEntry(product.moduleUrl)}`);
 			}
@@ -6780,7 +7050,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.10.0"
+		version: "0.12.0"
 	};
 	const product = {
 		packageName,
@@ -7450,7 +7720,11 @@ function registrationEffects(step) {
 	const { item } = step;
 	const reach = reachOf(item.channel, channelServer(item.channel).narrowingOf(item.narrowing));
 	const entry = `registers the ${channelLabel(item.channel)} MCP server with ${item.client} as "${item.name}" again (${item.scope} scope, ${item.launcher} launcher), at ${item.latest} in place of ${item.version}${reach ? ` — ${reach}, as now` : ""}`;
-	return item.launcher === "npx" ? [entry, `${item.client} will fetch ${item.package}@${item.latest} from npm each time it starts "${item.name}"`] : [entry];
+	return item.launcher === "npx" ? [
+		entry,
+		step.destination,
+		`${item.client} will fetch ${item.package}@${item.latest} from npm each time it starts "${item.name}"`
+	] : [entry, step.destination];
 }
 /** Every step as the sentences a person reads, in the order the steps are taken. */
 function effectsOf(planned) {
@@ -7510,7 +7784,9 @@ async function planRegistrations(context, candidates, request) {
 		steps.push({
 			item,
 			product,
-			options
+			options,
+			install: plannedInstall(preflight),
+			destination: entryDestination(item.client, preflight.target, preflight.command, context.env)
 		});
 	}
 	return {
@@ -7605,7 +7881,7 @@ async function applyUpdate(context, planned, deps) {
 			});
 		}
 	}
-	for (const { item, product, options } of planned.registrations) {
+	for (const { item, product, options, install } of planned.registrations) {
 		const base = {
 			kind: "registration",
 			channel: item.channel,
@@ -7631,7 +7907,7 @@ async function applyUpdate(context, planned, deps) {
 			const result = await mcpInstall(context, product, {
 				...options,
 				...pins
-			});
+			}, install);
 			if (!result.applied) {
 				steps.push({
 					...base,
@@ -7659,217 +7935,78 @@ async function applyUpdate(context, planned, deps) {
 	for (const global of planned.globals) {
 		const base = {
 			kind: "global",
-			package: global.package,
-			from: global.version,
-			to: global.latest
-		};
-		try {
-			await installGlobal(`${global.package}@${global.latest}`);
-			steps.push({
-				...base,
-				outcome: "updated"
-			});
-		} catch (error) {
-			steps.push({
-				...base,
-				outcome: "failed",
-				detail: message(error)
-			});
-		}
-	}
-	const worked = (step) => step.kind === "registration" ? step.outcome === "registered" && step.verification !== "failed" : step.outcome !== "failed";
-	const ok = steps.every(worked);
-	const status = steps.length === 0 ? planned.nothingBehind ? "up-to-date" : "manual" : ok ? "updated" : "failed";
-	const clients = [...new Set(steps.flatMap((step) => step.kind === "registration" && step.outcome === "registered" ? [step.client] : []))];
-	const next = clients.length > 0 ? `Restart ${clients.length === 1 ? clients[0] : `${clients.slice(0, -1).join(", ")} and ${clients.at(-1)}`} to load the new servers: no MCP client loads a new server into a session that is already running. Then, from the restarted server, prune the runtimes the old versions leave behind: comms_server_prune for each channel — at a terminal, ${PRUNE_COMMANDS}.` : null;
-	return {
-		status,
-		latest: planned.latest,
-		steps,
-		manual: planned.manual,
-		ok,
-		next
-	};
-}
-/**
-* "Not now": no server or command on this machine stops for the update until the next local midnight.
-*
-* `plan` reads the file on both calls, so a claim made after midnight — a different midnight in the sentence — or
-* for a newer release is a different change, and refused.
-*/
-function updateLaterChange(core, options = {}) {
-	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	let planned = null;
-	return {
-		plan: async (config) => {
-			const record = await readUpdateCheck(core.paths.stateDir);
-			const until = nextLocalMidnight(now());
-			const latest = countedLatest(record);
-			const changed = record.snoozedUntil === null || Date.parse(record.snoozedUntil) < until.getTime();
-			planned = {
-				until,
-				latest,
-				changed
-			};
-			const what = latest === null ? "the daily update check" : `the update to ${latest}`;
-			return {
-				before: config,
-				after: config,
-				effects: changed ? [`puts off ${what} until midnight, local time (${localStamp(until)}): until then no server or command on this machine stops for it, and the first request after asks again`] : [],
-				summary: latest === null ? "Skip the daily update check until tomorrow" : `Skip the update to ${latest} until tomorrow`
-			};
-		},
-		apply: async () => {
-			if (planned === null) throw new CommsError("UNEXPECTED", "not now was applied before it was planned");
-			const { until, latest, changed } = planned;
-			if (changed) await changeUpdateCheck(core.paths.stateDir, (record) => ({ record: {
-				...record,
-				snoozedUntil: until.toISOString()
-			} }));
-			return {
-				snoozedUntil: (await readUpdateCheck(core.paths.stateDir)).snoozedUntil,
-				latest,
-				changed
-			};
-		}
-	};
-}
-/**
-* The daily update check's checker: the half that asks the registry (design 2026-09-28 §1).
-*
-* At most once in 24 hours for the whole machine, it reads the `latest` dist-tag of `@agentcomms/core` — every
-* package here is released together under one version, so that one number is the latest of each — and runs the same
-* "what is behind" check `comms_update` runs with `check`, handing it that number, so the registry is asked once. What
-* it found goes in `update-check.json`, where every server and command reads it.
-*
-* Two processes finding the file a day old at the same moment do not both ask: the first to take the file's lock
-* claims the check (`checking`), and the second, reading the file under the same lock, finds it claimed. The day's
-* `lastChecked` is written when the ask is over, so an ask cut short — a command the person interrupted, a server
-* whose client closed it — does not use up the day: its claim runs out (`UPDATE_CHECK_LEASE_MS`) and the next process
-* asks. An ask that fails — offline, a registry that does not answer — is recorded as the day's ask, keeps the last
-* result, and stops nothing. It never throws.
-*
-* Nothing here gives up on the registry sooner than the registry's own timeout: a command at a terminal stops
-* *waiting* after about three seconds and goes on, and the check carries on beside it. Cut off at three seconds, a
-* registry that takes five would have been asked every day and heard from never.
-*
-* WhatsApp imports none of this: see `update-state.ts`.
-*/
-const CORE_PACKAGE = channelServer("core").packageName;
-/** The check, when it is on and due: once in 24 hours per machine, recorded in `update-check.json`. */
-async function checkForUpdates(core, env, options = {}) {
-	const stateDir = core.paths.stateDir;
-	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	try {
-		if (!(await updateCheckEnabled(core, env)).on) return {
-			asked: false,
-			record: await readUpdateCheck(stateDir)
-		};
-		const claim = await changeUpdateCheck(stateDir, (record) => {
-			const claimedAt = now();
-			if (!updateCheckDue(record, claimedAt) || updateCheckUnderway(record, claimedAt)) return null;
-			const checking = claimedAt.toISOString();
-			return {
-				record: {
-					...record,
-					checking
-				},
-				result: checking
-			};
-		}).catch(() => null);
-		if (claim?.result === void 0) return {
-			asked: false,
-			record: await readUpdateCheck(stateDir)
-		};
-		await ask(core, env, {
-			...options,
-			now,
-			claimedAt: claim.result
-		});
-		return {
-			asked: true,
-			record: await readUpdateCheck(stateDir)
-		};
-	} catch {
-		return {
-			asked: false,
-			record: await readUpdateCheck(stateDir).catch(() => ({ ...EMPTY_UPDATE_CHECK }))
-		};
-	}
-}
-async function ask(core, env, options) {
-	const deps = options.deps ?? {};
-	/**
-	* The ask is over: what it found is written, the day's check recorded as of the claim, and the claim given up — if
-	* the claim is still this ask's. A check a person asked for, or an update, records what it found and gives up any
-	* claim as it does; so does another process once this claim ran out and it claimed the check itself. Either way
-	* what is in the file is newer than what this ask found, and writing over it would put back the machine as it was
-	* before an update: "update" where "restart" is right.
-	*/
-	const settle = (found) => changeUpdateCheck(core.paths.stateDir, (record) => record.checking === options.claimedAt ? { record: {
-		...record,
-		...found,
-		lastChecked: options.claimedAt,
-		checking: null
-	} } : null).catch(() => void 0);
-	const reason = (error) => (error instanceof Error ? error.message : String(error)).slice(0, 300);
-	let latest;
-	try {
-		latest = await (deps.latestVersion ?? ((name) => npmLatestVersion(name, { env })))(CORE_PACKAGE);
-		if (!isVersion(latest)) throw new Error(`the npm registry names ${JSON.stringify(String(latest)).slice(0, 60)} as the latest release, which is not a version`);
-	} catch (error) {
-		await settle({ lastError: reason(error) });
-		return;
-	}
-	if (isPrerelease(latest)) {
-		await settle({
-			latest,
-			behind: null,
-			current: null,
-			lastError: null
-		});
-		return;
-	}
-	try {
-		await updateCheck(core, env, {
-			...deps,
-			latestVersion: async () => latest,
-			now: options.now
-		}, options.claimedAt);
-	} catch (error) {
-		await settle({
-			latest,
-			behind: null,
-			current: null,
-			lastError: reason(error)
-		});
+			package: global.package,
+			from: global.version,
+			to: global.latest
+		};
+		try {
+			await installGlobal(`${global.package}@${global.latest}`);
+			steps.push({
+				...base,
+				outcome: "updated"
+			});
+		} catch (error) {
+			steps.push({
+				...base,
+				outcome: "failed",
+				detail: message(error)
+			});
+		}
 	}
+	const worked = (step) => step.kind === "registration" ? step.outcome === "registered" && step.verification !== "failed" : step.outcome !== "failed";
+	const ok = steps.every(worked);
+	const status = steps.length === 0 ? planned.nothingBehind ? "up-to-date" : "manual" : ok ? "updated" : "failed";
+	const clients = [...new Set(steps.flatMap((step) => step.kind === "registration" && step.outcome === "registered" ? [step.client] : []))];
+	const next = clients.length > 0 ? `Restart ${clients.length === 1 ? clients[0] : `${clients.slice(0, -1).join(", ")} and ${clients.at(-1)}`} to load the new servers: no MCP client loads a new server into a session that is already running. Then, from the restarted server, prune the runtimes the old versions leave behind: comms_server_prune for each channel — at a terminal, ${PRUNE_COMMANDS}.` : null;
+	return {
+		status,
+		latest: planned.latest,
+		steps,
+		manual: planned.manual,
+		ok,
+		next
+	};
 }
 /**
-* What a command at a terminal hands the update gate (`updateGateAtTerminal`): the check, and the update itself for
-* the person's "now" — its own preview and yes.
+* "Not now": no server or command on this machine stops for the update until the next local midnight.
 *
-* Every command but WhatsApp's is given these. WhatsApp's is given neither, and reads the file as it is.
+* `plan` reads the file on both calls, so a claim made after midnight — a different midnight in the sentence — or
+* for a newer release is a different change, and refused.
 */
-function terminalUpdateHooks(core, env, options) {
+function updateLaterChange(core, options = {}) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	let planned = null;
 	return {
-		check: async () => {
-			await checkForUpdates(core, env, {
-				deps: options.deps,
-				now: options.now
-			});
+		plan: async (config) => {
+			const record = await readUpdateCheck(core.paths.stateDir);
+			const until = nextLocalMidnight(now());
+			const latest = countedLatest(record);
+			const changed = record.snoozedUntil === null || Date.parse(record.snoozedUntil) < until.getTime();
+			planned = {
+				until,
+				latest,
+				changed
+			};
+			const what = latest === null ? "the daily update check" : `the update to ${latest}`;
+			return {
+				before: config,
+				after: config,
+				effects: changed ? [`puts off ${what} until midnight, local time (${localStamp(until)}): until then no server or command on this machine stops for it, and the first request after asks again`] : [],
+				summary: latest === null ? "Skip the daily update check until tomorrow" : `Skip the update to ${latest} until tomorrow`
+			};
 		},
-		update: async () => {
-			const result = await gatedChangeAtTerminal(core, updateChange(core, env, {}, options.deps), {
-				env,
-				output: options.output,
-				command: "agentcomms update",
-				approveCommand: options.approveCommand,
-				streams: options.streams
-			});
-			writeResult(result, options.output, (r) => renderUpdate(r, options.output.color), options.streams);
-			if (!result.ok) return "failed";
-			return result.status === "updated" && result.manual.length === 0 ? "updated" : "short";
+		apply: async () => {
+			if (planned === null) throw new CommsError("UNEXPECTED", "not now was applied before it was planned");
+			const { until, latest, changed } = planned;
+			if (changed) await changeUpdateCheck(core.paths.stateDir, (record) => ({ record: {
+				...record,
+				snoozedUntil: until.toISOString()
+			} }));
+			return {
+				snoozedUntil: (await readUpdateCheck(core.paths.stateDir)).snoozedUntil,
+				latest,
+				changed
+			};
 		}
 	};
 }
@@ -8015,6 +8152,7 @@ function approvalsOf(command) {
 		...named
 	];
 }
+const TERMINAL_CHECK_WAIT_MS = 3e3;
 /**
 * The update gate at a terminal, before a command runs. Resolves to null to run the command, or to the exit status to
 * end with instead; throws `UPDATE_REQUIRED` (exit 11) where nobody can be asked.
@@ -8118,47 +8256,411 @@ function updateRequired(pending, binary) {
 	});
 }
 /**
-* What the terminal says after the person's "now", and the exit status. "Updated. Run your command again." only when
-* the update did everything and this command's release is now installed where it runs from — its global package at
-* the latest. Anything short of that says what, and ends with a status that is not 0: the command has not run, and a
-* script that goes on after `cmd && next` must not take it for the command's success.
+* What the terminal says after the person's "now", and the exit status. "Updated. Run your command again." only when
+* the update did everything and this command's release is now installed where it runs from — its global package at
+* the latest. Anything short of that says what, and ends with a status that is not 0: the command has not run, and a
+* script that goes on after `cmd && next` must not take it for the command's success.
+*/
+async function afterUpdate(outcome, options, before) {
+	const { streams, binary } = options;
+	const notRun = `${binary} did not run`;
+	if (outcome === "failed") {
+		streams.stdout.write(`${notRun}: the update did not finish — each step says how it went, above.\n`);
+		return EXIT_CODES.UNAVAILABLE;
+	}
+	const after = updateVerdict(await readUpdateCheck(options.core.paths.stateDir), options.running, {
+		channel: options.channel,
+		surface: "command"
+	});
+	if (after === null || after.kind === "restart") {
+		if (outcome === "updated") {
+			streams.stdout.write("Updated. Run your command again.\n");
+			return EXIT_CODES.OK;
+		}
+		streams.stdout.write(`${before.latest} is installed here: run your command again from it. ${notRun}.\n`);
+		return EXIT_CODES.UPDATE;
+	}
+	streams.stdout.write(`${notRun}: the update did not bring it to ${before.latest}. \`${UPDATE_WAYS.update.command}\` updates what this machine registers and has installed globally — what it found is said above — and this ${binary} ${before.running} is started from somewhere else: npx's cache, a project's own install, a checkout. Run it from ${before.latest}, or put this off until tomorrow with \`${UPDATE_WAYS.later.command}\`.\n`);
+	return EXIT_CODES.UPDATE;
+}
+async function askLine(streams, question) {
+	const { createInterface } = await import("node:readline/promises");
+	const rl = createInterface({
+		input: streams.stdin,
+		output: streams.stderr
+	});
+	try {
+		return await rl.question(question);
+	} finally {
+		rl.close();
+	}
+}
+/**
+* The daily update check's checker: the half that asks the registry (design 2026-09-28 §1).
+*
+* At most once in 24 hours for the whole machine, it reads the `latest` dist-tag of `@agentcomms/core` — every
+* package here is released together under one version, so that one number is the latest of each — and runs the same
+* "what is behind" check `comms_update` runs with `check`, handing it that number, so the registry is asked once. What
+* it found goes in `update-check.json`, where every server and command reads it.
+*
+* Two processes finding the file a day old at the same moment do not both ask: the first to take the file's lock
+* claims the check (`checking`), and the second, reading the file under the same lock, finds it claimed. The day's
+* `lastChecked` is written when the ask is over, so an ask cut short — a command the person interrupted, a server
+* whose client closed it — does not use up the day: its claim runs out (`UPDATE_CHECK_LEASE_MS`) and the next process
+* asks. An ask that fails — offline, a registry that does not answer — is recorded as the day's ask, keeps the last
+* result, and stops nothing. It never throws.
+*
+* Nothing here gives up on the registry sooner than the registry's own timeout: a command at a terminal stops
+* *waiting* after about three seconds and goes on, and the check carries on beside it — in a detached child of its
+* own (`UPDATE_CHECK_CHILD_COMMAND`), so the command's process, and its output, end when the command does (#48). Cut
+* off at three seconds, a registry that takes five would have been asked every day and heard from never.
+*
+* WhatsApp imports none of this: see `update-state.ts`.
+*/
+const CORE_PACKAGE = channelServer("core").packageName;
+/** The check, when it is on and due: once in 24 hours per machine, recorded in `update-check.json`. */
+async function checkForUpdates(core, env, options = {}) {
+	const stateDir = core.paths.stateDir;
+	try {
+		if (!(await updateCheckEnabled(core, env)).on) return {
+			asked: false,
+			record: await readUpdateCheck(stateDir)
+		};
+		const claimedAt = await claimUpdateCheck(core, options);
+		if (claimedAt === null) return {
+			asked: false,
+			record: await readUpdateCheck(stateDir)
+		};
+		await askUnderClaim(core, env, claimedAt, options);
+		return {
+			asked: true,
+			record: await readUpdateCheck(stateDir)
+		};
+	} catch {
+		return {
+			asked: false,
+			record: await readUpdateCheck(stateDir).catch(() => ({ ...EMPTY_UPDATE_CHECK }))
+		};
+	}
+}
+/**
+* The day's claim, when the check is due and nobody else is asking: the claim's time, written to the file as
+* `checking`, or null — not due, claimed by another process, or the file could not be written. Whoever is handed the
+* time asks under it (`askUnderClaim`). Whether the check is on at all is the caller's to decide first.
+*
+* Under the lock, due or not — and claimed by another process or not — is decided on the file as it is now, and the
+* claim written before anyone asks, so of two processes that both found it a day old, one asks. The time is read under
+* the lock too: read before it, the second process's time could be earlier than the first's claim, which reads as a
+* clock gone back.
+*/
+async function claimUpdateCheck(core, options = {}) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	return (await changeUpdateCheck(core.paths.stateDir, (record) => {
+		const claimedAt = now();
+		if (!updateCheckDue(record, claimedAt) || updateCheckUnderway(record, claimedAt)) return null;
+		const checking = claimedAt.toISOString();
+		return {
+			record: {
+				...record,
+				checking
+			},
+			result: checking
+		};
+	}).catch(() => null))?.result ?? null;
+}
+/**
+* The ask, under a claim already taken (`claimUpdateCheck`): the registry, then `comms_update`'s own check. What it
+* found is written — the day's check recorded, and the claim given up — only while the claim in the file is still
+* `claimedAt`. It claims nothing itself.
+*/
+async function askUnderClaim(core, env, claimedAt, options = {}) {
+	await ask(core, env, {
+		...options,
+		now: options.now ?? (() => /* @__PURE__ */ new Date()),
+		claimedAt
+	});
+}
+async function ask(core, env, options) {
+	const deps = options.deps ?? {};
+	/**
+	* The ask is over: what it found is written, the day's check recorded as of the claim, and the claim given up — if
+	* the claim is still this ask's. A check a person asked for, or an update, records what it found and gives up any
+	* claim as it does; so does another process once this claim ran out and it claimed the check itself. Either way
+	* what is in the file is newer than what this ask found, and writing over it would put back the machine as it was
+	* before an update: "update" where "restart" is right.
+	*/
+	const settle = (found) => changeUpdateCheck(core.paths.stateDir, (record) => record.checking === options.claimedAt ? { record: {
+		...record,
+		...found,
+		lastChecked: options.claimedAt,
+		checking: null
+	} } : null).catch(() => void 0);
+	const reason = (error) => (error instanceof Error ? error.message : String(error)).slice(0, 300);
+	let latest;
+	try {
+		latest = await (deps.latestVersion ?? ((name) => npmLatestVersion(name, { env })))(CORE_PACKAGE);
+		if (!isVersion(latest)) throw new Error(`the npm registry names ${JSON.stringify(String(latest)).slice(0, 60)} as the latest release, which is not a version`);
+	} catch (error) {
+		await settle({ lastError: reason(error) });
+		return;
+	}
+	if (isPrerelease(latest)) {
+		await settle({
+			latest,
+			behind: null,
+			current: null,
+			lastError: null
+		});
+		return;
+	}
+	try {
+		await updateCheck(core, env, {
+			...deps,
+			latestVersion: async () => latest,
+			now: options.now
+		}, options.claimedAt);
+	} catch (error) {
+		await settle({
+			latest,
+			behind: null,
+			current: null,
+			lastError: reason(error)
+		});
+	}
+}
+/**
+* The hidden command every CLI that asks the registry answers to — `agentcomms`, `agent-gmail`, `agent-slack`,
+* `agent-resend` — with the claim's time after it: the ask a command handed on (`terminalUpdateHooks`). Not in any
+* help, never stopped by the update gate, and nothing a person or an agent runs.
+*/
+const UPDATE_CHECK_CHILD_COMMAND = "update-check-child";
+/**
+* How to start the CLI this process is running: this Node, the flags it was started with, and the script it runs —
+* when that script is a CLI's entry, `cli.mjs` built or `cli.ts` from a checkout. Links are followed first: npm's
+* `agentcomms` is a link to `dist/cli.mjs`, and on Windows its `.cmd` shim has already started Node on the `.mjs`, so
+* no shim is ever started here. Every package that answers the hidden command bundles this function into its own
+* build, so the entry is the running script, not this module's neighbour — core's own CLI, next to a bundled copy of
+* core, is not the command the person ran.
+*
+* Null when the script is not a CLI's entry: a CLI's `run()` called from something else, a test runner for one. The
+* check is then asked in this process, as it always was.
+*/
+function updateCheckChildEntry(script = process.argv[1], execArgv = process.execArgv) {
+	if (!script) return null;
+	let path;
+	try {
+		path = realpathSync.native(script);
+	} catch {
+		return null;
+	}
+	if (!/^cli\.(?:mjs|ts)$/.test(basename(path))) return null;
+	return {
+		command: process.execPath,
+		args: [...withoutDebugger(execArgv), path]
+	};
+}
+/**
+* Node's own flags, less a debugger's. A child started with `--inspect-brk` would wait for a debugger nobody attaches
+* until its claim ran out, and one with `--inspect` would ask for the port the command already holds. The rest —
+* `--experimental-strip-types` for a checkout, say — the child needs as the command did.
+*/
+function withoutDebugger(execArgv) {
+	return keptWords(execArgv.map((word) => ({
+		word,
+		raw: word
+	}))).map(({ raw }) => raw);
+}
+/** Words as Node reads them, each with how it was written, less a debugger's; `--inspect-port 9229` is two words. */
+function keptWords(words) {
+	const kept = [];
+	for (let index = 0; index < words.length; index++) {
+		const word = words[index];
+		const equals = word.word.indexOf("=");
+		const name = (equals < 0 ? word.word : word.word.slice(0, equals)).replaceAll("_", "-");
+		if (!/^--(?:inspect|debug)(?:-brk(?:-node)?|-port|-wait)?$/.test(name)) {
+			kept.push(word);
+			continue;
+		}
+		if (equals < 0 && /^--(?:inspect|debug)-port$/.test(name)) index++;
+	}
+	return kept;
+}
+/**
+* `NODE_OPTIONS` split as Node splits it: at a space — not a tab or a new line — except inside double quotes, where a backslash takes the
+* character after it as it is. Each word keeps how it was written, so what is kept goes to the child unchanged —
+* `--require "/tmp/with --inspect hook.js"` is one word, and not a debugger's.
+*/
+function nodeOptionWords(options) {
+	const words = [];
+	let index = 0;
+	while (index < options.length) {
+		while (index < options.length && options[index] === " ") index++;
+		if (index >= options.length) break;
+		const start = index;
+		let word = "";
+		let quoted = false;
+		for (; index < options.length; index++) {
+			const character = options[index] ?? "";
+			if (quoted) {
+				if (character === "\\" && index + 1 < options.length) word += options[++index];
+				else if (character === "\"") quoted = false;
+				else word += character;
+			} else if (character === " ") break;
+			else if (character === "\"") quoted = true;
+			else word += character;
+		}
+		words.push({
+			word,
+			raw: options.slice(start, index)
+		});
+	}
+	return words;
+}
+/**
+* The child's environment: the command's, with a debugger's flags taken out of `NODE_OPTIONS` too. Node reads
+* `NODE_OPTIONS` before any flag, so a command debugged through it — `NODE_OPTIONS=--inspect-brk` — would start a child
+* that waits for a debugger, holds its claim until the lease runs out, and outlives the command. Every other option in
+* it is kept as written; with none left, `NODE_OPTIONS` is left out. On Windows a variable's name is the same in any
+* case, so `node_options` is read, and taken out, as `NODE_OPTIONS` is.
+*/
+function updateCheckChildEnvironment(env, platform = process.platform) {
+	const child = { ...childEnvironment(env, platform) };
+	const names = Object.keys(child).filter((name) => platform === "win32" ? name.toUpperCase() === "NODE_OPTIONS" : name === "NODE_OPTIONS");
+	if (names.length === 0) return child;
+	const kept = names.map((name) => keptWords(nodeOptionWords(child[name] ?? "")).map(({ raw }) => raw).join(" ")).filter((options) => options !== "").join(" ");
+	for (const name of names) delete child[name];
+	if (kept !== "") child.NODE_OPTIONS = kept;
+	return child;
+}
+/**
+* The day's check at a terminal, handed on (#48). The command claims the check itself, as it always has, so only one
+* process asks — then starts this CLI again, detached, with the hidden command and the claim's time, and waits up to
+* the gate's three seconds for it to say the ask is over. After that it lets go of the child, which carries on alone,
+* and the command's process ends when the command does: before, it lived until the ask was over — the registry's ten
+* seconds, then `npm ls`'s minute — and a `$(…)`, a pipe or an agent's shell waited with it. A fast answer is written
+* before the wait ends, and the gate reads the file after it, so it still stops the day's first command.
+*
+* The child holds none of the command's output — stdin, stdout and stderr ignored, only the IPC channel for its one
+* message — or whatever reads that output would wait for the child as it waited for the check. Detached, so a
+* Ctrl-C at the terminal does not cut the ask short, and hidden, so Windows opens no console for it.
+*
+* When the child cannot be started — no entry to start, a program not there or not allowed — the check is asked in
+* this process instead, as it was before. It never throws.
+*/
+async function handUpdateCheckToChild(core, env, options) {
+	const deadline = Date.now() + TERMINAL_CHECK_WAIT_MS;
+	try {
+		if (!(await updateCheckEnabled(core, env)).on) return;
+		const claimedAt = await claimUpdateCheck(core, { now: options.now });
+		if (claimedAt === null) return;
+		const entry = options.entry === void 0 ? updateCheckChildEntry() : options.entry;
+		if (!(entry !== null && await startUpdateCheckChild(entry, claimedAt, env, deadline))) await askUnderClaim(core, env, claimedAt, { now: options.now });
+	} catch {}
+}
+/**
+* Starts the child and waits, until `deadline` at most, for it to say the ask is over, or to end. False when it could
+* not be started at all; then nothing was asked, and the claim is still this process's to ask under.
 */
-async function afterUpdate(outcome, options, before) {
-	const { streams, binary } = options;
-	const notRun = `${binary} did not run`;
-	if (outcome === "failed") {
-		streams.stdout.write(`${notRun}: the update did not finish — each step says how it went, above.\n`);
-		return EXIT_CODES.UNAVAILABLE;
+async function startUpdateCheckChild(entry, claimedAt, env, deadline) {
+	let child;
+	try {
+		child = spawn(entry.command, [
+			...entry.args,
+			UPDATE_CHECK_CHILD_COMMAND,
+			claimedAt
+		], {
+			detached: true,
+			windowsHide: true,
+			stdio: [
+				"ignore",
+				"ignore",
+				"ignore",
+				"ipc"
+			],
+			env: updateCheckChildEnvironment(env)
+		});
+	} catch {
+		return false;
 	}
-	const after = updateVerdict(await readUpdateCheck(options.core.paths.stateDir), options.running, {
-		channel: options.channel,
-		surface: "command"
+	let failed = false;
+	child.on("error", () => {
+		if (child.pid === void 0) failed = true;
 	});
-	if (after === null || after.kind === "restart") {
-		if (outcome === "updated") {
-			streams.stdout.write("Updated. Run your command again.\n");
-			return EXIT_CODES.OK;
-		}
-		streams.stdout.write(`${before.latest} is installed here: run your command again from it. ${notRun}.\n`);
-		return EXIT_CODES.UPDATE;
-	}
-	streams.stdout.write(`${notRun}: the update did not bring it to ${before.latest}. \`${UPDATE_WAYS.update.command}\` updates what this machine registers and has installed globally — what it found is said above — and this ${binary} ${before.running} is started from somewhere else: npx's cache, a project's own install, a checkout. Run it from ${before.latest}, or put this off until tomorrow with \`${UPDATE_WAYS.later.command}\`.\n`);
-	return EXIT_CODES.UPDATE;
-}
-async function askLine(streams, question) {
-	const { createInterface } = await import("node:readline/promises");
-	const rl = createInterface({
-		input: streams.stdin,
-		output: streams.stderr
+	await new Promise((resolve) => {
+		const timer = setTimeout(resolve, Math.max(0, deadline - Date.now()));
+		const done = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		child.once("error", done);
+		child.once("exit", done);
+		child.on("message", (message) => {
+			if (message?.type === "settled") done();
+		});
 	});
+	if (child.connected) child.disconnect();
+	child.unref();
+	return !failed;
+}
+/**
+* The hidden command's work, in the child a command started (`UPDATE_CHECK_CHILD_COMMAND`): the ask, under the claim
+* the command took and handed over. It claims nothing itself, and asks only while the file still holds that claim —
+* a claim that ran out, and that another process took since, is that process's to ask under. It says `settled` to the
+* command if the command is still listening, lets go of the channel, and ends; a command that stopped listening has
+* already gone on, and the ask is finished all the same. Results are written only while the claim is this child's.
+*/
+async function runUpdateCheckChild(core, env, claimedAt) {
+	if (claimedAt === void 0 || !Number.isFinite(Date.parse(claimedAt))) throw new CommsError("USAGE", `${UPDATE_CHECK_CHILD_COMMAND} takes the time of the claim it asks under`, { hint: "Nothing runs this but a command finishing the day’s update check; `agentcomms update --check` asks now." });
 	try {
-		return await rl.question(question);
+		if ((await readUpdateCheck(core.paths.stateDir)).checking === claimedAt) await askUnderClaim(core, env, claimedAt);
 	} finally {
-		rl.close();
+		settled();
 	}
 }
+/** Tells the command that started this child the ask is over, if it is still listening, and closes the channel. */
+function settled() {
+	if (!process.send || !process.connected) return;
+	process.send({ type: "settled" }, void 0, {}, () => {
+		if (process.connected) process.disconnect();
+	});
+}
+/**
+* What a command at a terminal hands the update gate (`updateGateAtTerminal`): the check, and the update itself for
+* the person's "now" — its own preview and yes.
+*
+* Every command but WhatsApp's is given these. WhatsApp's is given neither, and reads the file as it is.
+*/
+function terminalUpdateHooks(core, env, options) {
+	return {
+		check: async () => {
+			if (options.deps !== void 0) {
+				await checkForUpdates(core, env, {
+					deps: options.deps,
+					now: options.now
+				});
+				return;
+			}
+			await handUpdateCheckToChild(core, env, {
+				now: options.now,
+				entry: options.childEntry
+			});
+		},
+		update: async () => {
+			const result = await gatedChangeAtTerminal(core, updateChange(core, env, {}, options.deps), {
+				env,
+				output: options.output,
+				command: "agentcomms update",
+				approveCommand: options.approveCommand,
+				streams: options.streams
+			});
+			writeResult(result, options.output, (r) => renderUpdate(r, options.output.color), options.streams);
+			if (!result.ok) return "failed";
+			return result.status === "updated" && result.manual.length === 0 ? "updated" : "short";
+		}
+	};
+}
 //#endregion
-//#region ../core/dist/tool-arguments-De_3CNxx.mjs
+//#region ../core/dist/tool-arguments-Bc-xUPsF.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -17948,183 +18450,6 @@ strictObject({
 		if (manifest.skills.contract !== `skills/_shared/contract-${family}.md`) issue(["skills", "contract"], `skills/_shared/contract-${family}.md: a skill's contract is chosen by its prefix`);
 	}
 });
-const WINDOWS_RESERVED = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹²³])$/i;
-const UNSAFE_FILENAME_CHARS = /[/\\\u0000-\u001f\u007f<>:"|?*]/g;
-/** Truncates a string to at most `maxBytes` UTF-8 bytes without splitting a code point. */
-function truncateBytes(value, maxBytes) {
-	let out = "";
-	let bytes = 0;
-	for (const char of value) {
-		const size = Buffer.byteLength(char, "utf8");
-		if (bytes + size > maxBytes) break;
-		out += char;
-		bytes += size;
-	}
-	return out;
-}
-/**
-* A file name that is safe to create on macOS, Linux and Windows: NFC-normalised, no separators or control
-* characters, no leading or trailing dots and spaces, not a Windows reserved device name, at most `maxBytes` UTF-8
-* bytes with the extension kept. Never empty.
-*/
-function safeFilename(name, maxBytes = 255, fallback = "attachment") {
-	let cleaned = [...name.normalize("NFC")].filter((character) => !isDangerous(character.codePointAt(0) ?? 0)).join("").replace(UNSAFE_FILENAME_CHARS, "_").replace(/\s+/g, " ");
-	cleaned = cleaned.replace(/^[.\s]+/, "").replace(/[.\s]+$/, "");
-	if (cleaned === "") cleaned = fallback;
-	const extension = extname(cleaned);
-	if (WINDOWS_RESERVED.test((cleaned.split(".")[0] ?? cleaned).trimEnd())) cleaned = `_${cleaned}`;
-	if (Buffer.byteLength(cleaned, "utf8") <= maxBytes) return cleaned;
-	const keptExtension = Buffer.byteLength(extension, "utf8") < maxBytes / 2 ? extension : "";
-	return truncateBytes(keptExtension ? cleaned.slice(0, -keptExtension.length) : cleaned, maxBytes - Buffer.byteLength(keptExtension, "utf8")) + keptExtension;
-}
-/** True when `candidate` is `root` itself or strictly inside it (lexically). */
-function isInside(candidate, root) {
-	const path = relative(resolve(root), resolve(candidate));
-	return path === "" || !path.startsWith(`..${sep}`) && path !== ".." && !isAbsolute(path);
-}
-async function realpathOfExistingAncestor(path) {
-	let current = resolve(path);
-	const tail = [];
-	for (;;) try {
-		const real = await realpath(current);
-		return tail.length ? join(real, ...tail.reverse()) : real;
-	} catch (error) {
-		const parent = dirname(current);
-		if (error.code !== "ENOENT" || parent === current) throw error;
-		tail.push(basename(current));
-		current = parent;
-	}
-}
-/**
-* Resolves `target` for writing and proves it stays inside `root` after symlinks in its existing ancestors are
-* followed. Throws BAD_DATA otherwise. The root must already exist.
-*/
-async function resolveInsideRoot(root, target) {
-	const realRoot = await realpath(root);
-	const lexical = resolve(root, target);
-	if (!isInside(lexical, root)) throw new CommsError("BAD_DATA", `refusing to write outside ${root}`, { details: { target } });
-	if (!isInside(await realpathOfExistingAncestor(lexical), realRoot)) throw new CommsError("BAD_DATA", `refusing to write through a link that leaves ${root}`, { details: { target } });
-	return lexical;
-}
-/**
-* Creates a new file for writing without following a symlink at the final component and without overwriting an
-* existing file. Picks `name-2.ext`, `name-3.ext`… when the name is taken.
-*/
-async function createUniqueFile(directory, filename) {
-	const extension = extname(filename);
-	const stem = extension ? filename.slice(0, -extension.length) : filename;
-	const noFollow = process.platform === "win32" ? 0 : constants$1.O_NOFOLLOW;
-	for (let attempt = 1; attempt < 1e3; attempt += 1) {
-		const name = attempt === 1 ? filename : `${stem}-${attempt}${extension}`;
-		const path = join(directory, name);
-		try {
-			return {
-				path,
-				handle: await open(path, constants$1.O_WRONLY | constants$1.O_CREAT | constants$1.O_EXCL | noFollow, 384)
-			};
-		} catch (error) {
-			if (error.code === "EEXIST") continue;
-			throw error;
-		}
-	}
-	throw new CommsError("BAD_DATA", `could not find a free file name in ${directory}: the name and every numbered one after it are taken`);
-}
-/**
-* Default places attachments may never be read from, whatever the allowed roots say. `~/.*` means every dot-entry
-* directly under home — SSH, cloud, npm, git and shell credentials, agent configs; `**∕.git/**` any repository's git
-* directory; `**∕.env*` dotenv files anywhere.
-*/
-function defaultAttachDeny(configDir, env = process.env) {
-	const deny = [
-		configDir,
-		"~/.*",
-		"~/Library",
-		"**/.git/**",
-		"**/.env*"
-	];
-	if (env.APPDATA) deny.push(env.APPDATA);
-	if (env.LOCALAPPDATA) deny.push(env.LOCALAPPDATA);
-	return deny;
-}
-async function realOrResolved(path) {
-	try {
-		return await realpath(path);
-	} catch {
-		return resolve(path);
-	}
-}
-/**
-* Proves a local file may be attached to a draft: it resolves (following links) to a regular file inside one of the
-* allowed roots and inside none of the deny entries. A deny entry of the form `**` + `/name*` matches by file name
-* prefix (so `.env*` matches `.env` and `.env.local`). Returns the real path.
-*/
-async function checkAttachable(path, policy) {
-	const home = policy.home;
-	const requested = resolve(expandHome(path, home));
-	let real;
-	try {
-		real = await realpath(requested);
-	} catch {
-		throw new CommsError("NOT_FOUND", `attachment not found: ${path}`);
-	}
-	if (!(await stat(real)).isFile()) throw new CommsError("BAD_DATA", `not a regular file: ${path}`);
-	if (!(await Promise.all(policy.roots.map((root) => realOrResolved(expandHome(root, home))))).some((root) => isInside(real, root))) throw new CommsError("BAD_DATA", `attachments must come from an allowed folder; ${path} is outside them`, { hint: "Move the file into an allowed folder, or add its folder to defaults.attachRoots with the CLI." });
-	const name = basename(real);
-	const homeDir = await realOrResolved(home ?? (await import("node:os")).homedir());
-	for (const entry of policy.deny) {
-		if (entry === "~/.*") {
-			if (isInside(real, homeDir)) {
-				const first = relative(homeDir, real).split(sep)[0] ?? "";
-				if (first.startsWith(".")) throw new CommsError("BAD_DATA", `refusing to attach a file from ~/${first}: hidden folders in your home are never attached`);
-			}
-			continue;
-		}
-		if (entry === "**/.git/**") {
-			if (real.split(sep).some((segment) => segment.toLowerCase() === ".git")) throw new CommsError("BAD_DATA", "refusing to attach a file from a .git folder");
-			continue;
-		}
-		if (entry.startsWith("**/")) {
-			const pattern = entry.slice(3).toLowerCase();
-			const candidate = name.toLowerCase();
-			const prefix = pattern.endsWith("*") ? pattern.slice(0, -1) : pattern;
-			if (pattern.endsWith("*") ? candidate.startsWith(prefix) : candidate === prefix) throw new CommsError("BAD_DATA", `refusing to attach ${name}: files matching ${entry} are never attached`);
-			continue;
-		}
-		const denied = await realOrResolved(expandHome(entry, home));
-		if (isInside(real, denied)) throw new CommsError("BAD_DATA", `refusing to attach a file from ${entry}`);
-	}
-	return real;
-}
-/**
-* A caller-supplied subdirectory, checked before it is joined to anything.
-*
-* `path.join` is not a boundary, and it was being used as one. `join('work', '../personal')` is `'personal'`: the
-* alias segment is cancelled, the result still resolves inside the downloads root, so `resolveInsideRoot` allows it
-* — and one mailbox's files are written into another mailbox's folder, over the `manifest.json` that is that
-* mailbox's own record of where its attachments came from. `join('work', '/etc/cron.d')` is `'work/etc/cron.d'`:
-* the leading separator is simply dropped, so an absolute path that every document describes as refused is quietly
-* accepted under a name the caller never asked for.
-*
-* Neither is an escape from the root, which is why neither showed up as a jail failure. In one respect they are
-* worse than an escape: they succeed, and report a path the caller was never told about.
-*
-* So the check happens here, on the caller's own string, before any join — absolute paths and `..` are refused
-* rather than normalised away. A nested `reports/august` is fine; that is what the option is for.
-*/
-function relativeSubpath(out, field = "out") {
-	const value = (out ?? "").trim();
-	if (!value) return "";
-	const refuse = (why) => {
-		throw new CommsError("BAD_DATA", `${field} must be a relative subpath: ${why}`, {
-			hint: "Pass something like \"reports/august\". It is always placed inside this account’s own folder.",
-			details: { value }
-		});
-	};
-	if (isAbsolute(value) || /^[A-Za-z]:/.test(value) || value.startsWith("/") || value.startsWith("\\")) refuse("it is an absolute path");
-	const segments = value.split(/[/\\]+/);
-	if (segments.includes("..")) refuse("it climbs out with \"..\"");
-	return segments.filter((segment) => segment && segment !== ".").join("/");
-}
 /**
 * Email HTML is attacker-controlled. Before any of it becomes text a model reads, this removes what a human reading
 * the message in a mail client would not see — the channel used by hidden-text prompt injection (e.g. zero-size or
@@ -22255,4 +22580,4 @@ async function revokeSendApproval(context, approvalId) {
 	});
 }
 //#endregion
-export { openCore as $, CHANGE_POLICIES as A, approvalKind as B, policyChange as C, sendPolicyOf as D, removeAccountChange as E, CHANNEL_SERVERS as F, checkForUpdates as G, approveChangeAtTerminal as H, CommsError as I, escapeForDisplay as J, colorEnabled as K, EXIT_CODES as L, SEND_POLICIES as M, checkNewName as N, showAccount as O, strictToolArguments as P, installExitStatus as Q, SEND_LOOKUP as R, policyApprovalRefusal as S, policyWanted as T, canPrompt as U, approvalsOf as V, changeToolResult as W, gatedChange as X, exemptFromUpdateGate as Y, gatedChangeAtTerminal as Z, runDoctor as _, VERSION$1 as _t, revokeSendApproval as a, serverInstallChange as at, listAccounts as b, downloadReceived as c, toCommsError as ct, listReceived as d, updateToolGate as dt, paint as et, listScheduled as f, writeResult as ft, showSentEmail as g, ROUTES as gt, showReceived as h, RESEND_DOWNLOAD_ORIGIN as ht, prepareSend as i, runCommand as it, MODES as j, ResendContext as k, getMetrics as l, truncateDisplay as lt, listSuppressions as m, RESEND_API_ORIGIN as mt, executeSend as n, renderInstall as nt, sendStatus as o, serverPruneChange as ot, listSentEmails as p, REFUSED as pt, commandPathOf as q, finishSendApproval as r, renderPrune as rt, cancelScheduledChange as s, terminalUpdateHooks as st, beginSendApproval as t, refuseUnclaimedApproval as tt, listDomains as u, updateGateAtTerminal as ut, addAccountChange as v, policyReport as w, modeOf as x, inspectKey as y, agentMarker as z };
+export { installExitStatus as $, CHANGE_POLICIES as A, agentMarker as B, policyChange as C, sendPolicyOf as D, removeAccountChange as E, CHANNEL_SERVERS as F, changeToolResult as G, approvalsOf as H, CommsError as I, commandPathOf as J, checkForUpdates as K, EXIT_CODES as L, SEND_POLICIES as M, checkNewName as N, showAccount as O, strictToolArguments as P, gatedChangeAtTerminal as Q, SEND_LOOKUP as R, policyApprovalRefusal as S, policyWanted as T, approveChangeAtTerminal as U, approvalKind as V, canPrompt as W, exemptFromUpdateGate as X, escapeForDisplay as Y, gatedChange as Z, runDoctor as _, RESEND_DOWNLOAD_ORIGIN as _t, revokeSendApproval as a, runCommand as at, listAccounts as b, downloadReceived as c, serverPruneChange as ct, listReceived as d, truncateDisplay as dt, openCore as et, listScheduled as f, updateGateAtTerminal as ft, showSentEmail as g, RESEND_API_ORIGIN as gt, showReceived as h, REFUSED as ht, prepareSend as i, renderPrune as it, MODES as j, ResendContext as k, getMetrics as l, terminalUpdateHooks as lt, listSuppressions as m, writeResult as mt, executeSend as n, refuseUnclaimedApproval as nt, sendStatus as o, runUpdateCheckChild as ot, listSentEmails as p, updateToolGate as pt, colorEnabled as q, finishSendApproval as r, renderInstall as rt, cancelScheduledChange as s, serverInstallChange as st, beginSendApproval as t, paint as tt, listDomains as u, toCommsError as ut, addAccountChange as v, ROUTES as vt, policyReport as w, modeOf as x, inspectKey as y, VERSION$1 as yt, UPDATE_CHECK_CHILD_COMMAND as z };