@agentcomms/resend 0.12.1 → 0.12.3

package/dist/{send-W8SmlF7p.mjs → send-BedjeO_M.mjs}

@@ -4,15 +4,15 @@ import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import "node:readline/promises";
+import { styleText } from "node:util";
 import { homedir, platform, userInfo } from "node:os";
 import { constants as constants$1, realpathSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
-import "node:readline/promises";
-import { styleText } from "node:util";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.12.1";
+const VERSION$1 = "0.12.3";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -187,7 +187,7 @@ function refusedBecause(method, pathname) {
 	return null;
 }
 //#endregion
-//#region ../core/dist/update-check-Ba6REc8M.mjs
+//#region ../core/dist/update-check-Dq-D4bAD.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -564,9 +564,15 @@ async function takeOverStale(lockPath, staleMs) {
 async function withFileLock(lockPath, fn, options = {}) {
 	const timeoutMs = options.timeoutMs ?? 5e3;
 	const staleMs = options.staleMs ?? 3e4;
-	const deadline = Date.now() + timeoutMs;
+	const started = Date.now();
+	let deadline = started + timeoutMs;
+	/** `maxWaitMs`'s end: fixed when the wait begins, whatever the lock does. */
+	const limit = options.maxWaitMs === void 0 ? Number.POSITIVE_INFINITY : started + options.maxWaitMs;
 	const token = randomBytes(12).toString("hex");
 	let lastCode = "EEXIST";
+	/** The token of the holder this caller saw last, and how many times it has seen the lock change hands. */
+	let holder;
+	let handOvers = 0;
 	await ensurePrivateDir(dirname(lockPath));
 	for (;;) try {
 		const handle = await open(lockPath, "wx", 384);
@@ -581,10 +587,20 @@ async function withFileLock(lockPath, fn, options = {}) {
 		const code = error.code;
 		if (!CONTENDED.has(code ?? "")) throw error;
 		lastCode = code ?? lastCode;
-		if (code === "EEXIST" && await isStale(lockPath, await readLock(lockPath), staleMs)) {
-			await takeOverStale(lockPath, staleMs);
-			continue;
+		if (code === "EEXIST") {
+			const body = await readLock(lockPath);
+			if (await isStale(lockPath, body, staleMs)) {
+				await takeOverStale(lockPath, staleMs);
+				continue;
+			}
+			const seen = typeof body?.token === "string" ? body.token : void 0;
+			if (seen !== void 0 && seen !== holder) {
+				if (holder !== void 0) handOvers += 1;
+				holder = seen;
+				if (options.timeoutPerHolder) deadline = Date.now() + timeoutMs;
+			}
 		}
+		if (Date.now() > limit) throw new CommsError("LOCK_TIMEOUT", `gave up waiting for ${lockPath}: the wait hit its overall limit of ${(limit - started) / 1e3} s`, { hint: (handOvers > 0 ? `It changed hands ${handOvers} time(s) while this waited, never to this process: busy rather than stuck. Retry in a moment.` : "Retry in a moment. If it persists and no other process is running, delete the lock file.") + (lastCode === "EEXIST" ? "" : ` (last error: ${lastCode})`) });
 		if (Date.now() > deadline) throw new CommsError("LOCK_TIMEOUT", `another agent-communications process is holding ${lockPath}`, { hint: `Retry in a moment. If it persists and no other process is running, delete the lock file.` + (lastCode === "EEXIST" ? "" : ` (last error: ${lastCode})`) });
 		await setTimeout$1(25 + Math.floor(Math.random() * 50));
 	}
@@ -1195,6 +1211,253 @@ function connectMailboxCommand() {
 	const mail = accountChannels().find((manifest) => manifest.accounts?.map === "inboxes");
 	return mail ? `${mail.binary} inbox add` : void 0;
 }
+/** Crockford-style alphabet without I, L, O and U, so ids and challenges survive being read aloud or retyped. */
+const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function randomString(length) {
+	const bytes = randomBytes(length);
+	let out = "";
+	for (let i = 0; i < length; i += 1) out += ALPHABET[(bytes[i] ?? 0) & 31];
+	return out;
+}
+/** `ap_` + 26 characters: 130 random bits. Validated before an id ever names a file. */
+const APPROVAL_ID_PATTERN = /^ap_[0-9A-HJKMNP-TV-Z]{26}$/;
+const PLAN_TOKEN_PATTERN = /^pl_[0-9A-HJKMNP-TV-Z]{26}$/;
+function newApprovalId() {
+	return `ap_${randomString(26)}`;
+}
+function newPlanToken() {
+	return `pl_${randomString(26)}`;
+}
+const CHALLENGE_LETTERS = "ABCDEFGHJKMNPQRSTVWXYZ";
+/** A short challenge a human types back to approve: letters only, no look-alikes. */
+function newChallenge(length = 4) {
+	let out = "";
+	for (let i = 0; i < length; i += 1) out += CHALLENGE_LETTERS[randomInt(22)];
+	return out;
+}
+/** Challenges are stored only as hashes, so no listing or tool result can reveal one. */
+function hashChallenge(challenge) {
+	return createHash("sha256").update(challenge.trim().toUpperCase()).digest("hex");
+}
+/** Case-insensitive, constant-time comparison of an answer with a stored challenge hash. */
+function challengeMatches(answer, storedHash) {
+	const a = Buffer.from(hashChallenge(answer), "hex");
+	const b = Buffer.from(storedHash, "hex");
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+function okEnvelope(data) {
+	return {
+		ok: true,
+		schemaVersion: 1,
+		data
+	};
+}
+function errorEnvelope(error) {
+	const body = {
+		code: error.code,
+		message: error.message
+	};
+	if (error.hint !== void 0) body.hint = error.hint;
+	if (error.details !== void 0) body.details = error.details;
+	return {
+		ok: false,
+		schemaVersion: 1,
+		error: body
+	};
+}
+const defaultStreams = {
+	stdout: process.stdout,
+	stderr: process.stderr,
+	stdin: process.stdin
+};
+function colorEnabled(env, stream, flag) {
+	if (flag === false) return false;
+	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
+	if (env.TERM === "dumb") return false;
+	if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
+	return Boolean(stream.isTTY);
+}
+/** True when a human could answer a prompt: both ends are terminals, no --json/--no-input, not CI. */
+function canPrompt(env, streams, options) {
+	if (options.json || options.noInput) return false;
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
+	return Boolean(streams.stdin?.isTTY && streams.stdout.isTTY);
+}
+/** Environment variables well-known coding agents set. Used only as a speed bump, never as a security boundary. */
+const AGENT_MARKERS = [
+	"CLAUDECODE",
+	"CLAUDE_CODE_ENTRYPOINT",
+	"CODEX_SANDBOX",
+	"CODEX_HOME",
+	"CURSOR_AGENT",
+	"GEMINI_CLI",
+	"AGENT_COMMS_AGENT"
+];
+function agentMarker(env) {
+	for (const name of AGENT_MARKERS) if (env[name] !== void 0 && env[name] !== "") return name;
+	return null;
+}
+function paint(color, format, text) {
+	return color ? styleText(format, text, { validateStream: false }) : text;
+}
+/**
+* A command line for a person to copy and run, each word quoted only where the shell it is pasted into would need it.
+* Every command this package prints to be run — a change to run again with its approval, a folder to take out, an
+* entry to register again or remove — is quoted here, so no printer quotes for a shell of its own.
+*
+* Everywhere but Windows that shell is a POSIX one, and a word goes in single quotes, inside which nothing is special
+* but the quote itself. Windows has two shells, and neither reads single quotes that way: cmd.exe does not take them
+* as quotes at all, so `'C:\Profiles\First Last\outgoing'` reached the command as two words, quote marks and all, and
+* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A command printed on Windows
+* has to be safe in both, because nothing says which one it will be pasted into (CUE-306) — and safe is not enough:
+* the program has to receive the same words from either. Three readers stand between the line and the program. cmd.exe
+* hands the program the line as it is, and the program's own parser (the C runtime's, Node's) splits it. PowerShell
+* reads the line itself, a double-quoted word with its backslashes as plain characters, and then writes a new command
+* line for the program: Windows PowerShell 5.1 the old way ("Legacy" in about_Parsing, "Passing arguments to native
+* applications") — a word quoted only when it holds whitespace, as it is, and an empty word dropped — and PowerShell
+* 7.3 and later its own way ("Standard") — quoted when it must be, with every backslash before a quote doubled. For a
+* `.cmd` script, which is how npm installs `agentcomms`, `claude` and `codex` on Windows, PowerShell 7 goes back to the
+* old way, and cmd.exe then reads that new line. So on Windows:
+*
+* - A word of letters, digits and `_ + = : . / \`, with `@` and `-` anywhere but first, is left as it is: no reader
+*   does anything with it, and a backslash is an ordinary character to all of them, at the end too. A first `@` is
+*   splatting to PowerShell, and a `,` its array operator — two words — so a word with either is quoted. So is a word
+*   that starts with a digit, which PowerShell may read as a number (`1kb`, `0x10`), and one that starts with `-` but
+*   is not a plain option, which PowerShell may read as a parameter of its own and split (`-name.x`).
+* - A word that double quotes bring through all three readers whole goes in double quotes. Inside them cmd.exe reads
+*   `& | < > ^ ( )` and spaces as ordinary characters, and PowerShell reads everything as ordinary but `$`, the
+*   backtick and a double quote. What is left special in one or the other is kept out: a double quote, which ends the
+*   quoting in both — and PowerShell takes the curly ones, `“ ” „`, for one too; `$` and the backtick, PowerShell's
+*   expansion and escape; `%`, which cmd.exe expands as `%NAME%` before it looks at quotes at all; `!`, which it
+*   expands as `!NAME!` inside quotes too wherever delayed expansion is on, and which then makes a `^` inside quotes an
+*   escape; and any control or formatting character — a line break ends the command in cmd.exe even inside quotes, a
+*   tab pasted into cmd.exe can complete a file name, and a right-to-left override shows a line other than the one
+*   that runs. Three more cannot come through: an empty word, which Windows PowerShell drops; a word ending in a
+*   backslash, which the C runtime reads with the closing quote as `\"` — and doubled for it, PowerShell 7 passes both
+*   backslashes on where cmd.exe and Windows PowerShell pass one; and a word with `& | < > ^ ( )` but no whitespace,
+*   which PowerShell passes to a `.cmd` script unquoted, for cmd.exe to run `&whoami` from or to split at `|`.
+* - With any other word in it, no line is printed at all (`line` is null), and the printers show the command's words
+*   as JSON instead, saying it has to be typed. Not a line with the word left out: a placeholder in its place was
+*   still a command that ran — `claude mcp remove NAME` removed whatever entry was called `NAME`, and an install
+*   hint's `--force` replaced it — and before that, a word quoted for PowerShell's single quotes, which cmd.exe reads
+*   as characters, ran `whoami` from a server named `$x&whoami&`. See `commandAsJson` for why the JSON runs nothing.
+*
+* Everywhere else there is always a line: single quotes make any word safe.
+*/
+function shellCommand(words, platform = process.platform) {
+	if (platform !== "win32") return {
+		words,
+		line: words.map(posixShellWord).join(" "),
+		platform
+	};
+	const printed = words.map(windowsShellWord);
+	return {
+		words,
+		line: printed.includes(null) ? null : printed.join(" "),
+		platform
+	};
+}
+/** The same command with more words at its end — the approval it is to be run again with — for the same shell. */
+function withWords(command, ...more) {
+	return shellCommand([...command.words, ...more], command.platform);
+}
+function posixShellWord(word) {
+	return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* The word as cmd.exe, Windows PowerShell and PowerShell 7 all hand it to a program, or null when no printing of it
+* does (see `shellCommand`). Bare: a plain option, or ordinary characters that do not start like a number.
+*/
+function windowsShellWord(word) {
+	if (/^(?:--?[A-Za-z][A-Za-z0-9-]*|(?!\+?\.?\d)[\w+=:./\\][\w@+=:./\\-]*)$/.test(word)) return word;
+	if (word === "" || word.endsWith("\\")) return null;
+	if (/["$`%!\u201C-\u201E]|[\p{C}\p{Zl}\p{Zp}]/u.test(word)) return null;
+	if (/[&|<>^()]/.test(word) && !/\s/.test(word)) return null;
+	return `"${word}"`;
+}
+/**
+* The words of a command as a JSON array, for a command that cannot be printed as a line: something to read, and to
+* parse, and nothing to run.
+*
+* Pasted into either Windows shell by mistake, it runs nothing. PowerShell refuses it before running anything: a `[`
+* opens a type name, and a quoted string is none. cmd.exe looks for a program called `["agentcomms"` or the like, and
+* finds none — and nothing in the line is anything else to it: every character it acts on, inside quotes or out (`%`,
+* `!`), is written as a `\u` escape, and so is every double quote inside a word, so the quotes cmd.exe sees are the
+* JSON's own, in pairs, and `&`, `|`, `<`, `>`, `^` and the parentheses are only ever inside them, where it reads them
+* as characters. `$` and the backtick are escaped too, so that PowerShell would expand nothing even if it read on, and
+* so is everything outside printable ASCII — a line break, a curly quote, a right-to-left override. A backslash is
+* doubled, as JSON has it.
+*/
+function commandAsJson(words) {
+	const word = (text) => {
+		let json = "";
+		for (let index = 0; index < text.length; index++) {
+			const code = text.charCodeAt(index);
+			const char = text[index];
+			if (char === "\\") json += "\\\\";
+			else if (code >= 32 && code <= 126 && !"\"%!$`".includes(char)) json += char;
+			else json += `\\u${code.toString(16).padStart(4, "0")}`;
+		}
+		return `"${json}"`;
+	};
+	return `[${words.map(word).join(",")}]`;
+}
+/** What is said beside a command shown as JSON. */
+const TO_TYPE = "the command's words, written as JSON: one of them cannot be quoted the same way for cmd.exe and for PowerShell, so type the command yourself, with that word quoted for the shell you use";
+/** A command in backticks, for a sentence — as its words in JSON, saying it has to be typed, when it has no line. */
+function inlineCommand(command) {
+	return command.line === null ? `\`${commandAsJson(command.words)}\` (${TO_TYPE})` : `\`${command.line}\``;
+}
+/** A command as text of its own — a list's line, a field's value — or its words in JSON, saying it has to be typed. */
+function commandText(command) {
+	return command.line === null ? `${commandAsJson(command.words)} (${TO_TYPE})` : command.line;
+}
+/** Writes a successful result: the envelope with --json, otherwise the human rendering. */
+function writeResult(data, options, human, streams = defaultStreams) {
+	if (options.json) {
+		streams.stdout.write(`${JSON.stringify(okEnvelope(data))}\n`);
+		return;
+	}
+	const text = human(data);
+	if (text) streams.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+}
+/** Writes an error and returns the exit code to use. */
+function writeError(error, options, streams = defaultStreams) {
+	const commsError = toCommsError(error);
+	if (options.json) streams.stdout.write(`${JSON.stringify(errorEnvelope(commsError))}\n`);
+	else {
+		streams.stderr.write(`${paint(options.color, "red", "error")}: ${commsError.message}\n`);
+		if (commsError.hint) streams.stderr.write(`${paint(options.color, "dim", "hint")}: ${commsError.hint}\n`);
+	}
+	return commsError.exitCode;
+}
+/** Runs a command body and exits with the documented code. Unexpected errors keep only their message. */
+async function runCommand(options, body, streams = defaultStreams) {
+	try {
+		await body();
+		return EXIT_CODES.OK;
+	} catch (error) {
+		return writeError(error, options, streams);
+	}
+}
+/**
+* The first two steps of `requirePerson` — an agent is refused, then anything without a terminal — for a command
+* whose code is not its own to make up.
+*
+* `agentcomms approve` asks for a code the approval store issued and will check, so it cannot use `askChallenge`;
+* but it refuses in exactly the same order and words, because it is the same gate.
+*/
+function refuseUnlessPerson(env, streams, gate) {
+	const marker = agentMarker(env);
+	if (marker) throw new CommsError("LOOSENING_REFUSED", gate.refusedToAgent, {
+		hint: `Ask the user to run \`${gate.command}\` in their own terminal.`,
+		details: { marker }
+	});
+	const prompting = {};
+	if (gate.json !== void 0) prompting.json = gate.json;
+	if (gate.noInput !== void 0) prompting.noInput = gate.noInput;
+	if (!canPrompt(env, streams, prompting)) throw new CommsError("LOOSENING_REFUSED", gate.refusedWithoutTerminal, { hint: `Run \`${gate.command}\` directly in a terminal.` });
+}
 /**
 * One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
 * and the preview renderer (which makes them visible), so the two can never disagree.
@@ -1855,13 +2118,19 @@ function committedSecretsStore(config) {
 * A different backend asked for is refused, not taken: one backend holds everything here, and changing it has to move
 * what is already stored, which is what `agentcomms secrets migrate` does and nothing else does.
 */
-function secretsStoreFor(config, requested) {
+function secretsStoreFor(config, requested, platform = process.platform) {
 	const committed = committedSecretsStore(config);
 	if (committed === null) return {
 		store: requested ?? "keychain",
 		choosing: true
 	};
-	if (requested !== void 0 && requested !== committed) throw new CommsError("CONFIG", `this configuration already keeps its secrets in the ${committed} store`, { hint: `Everything here uses one store, and changing it moves what is already stored. To change it, run \`agentcomms secrets migrate --to ${requested}\`, then run this again.` });
+	if (requested !== void 0 && requested !== committed) throw new CommsError("CONFIG", `this configuration already keeps its secrets in the ${committed} store`, { hint: `Everything here uses one store, and changing it moves what is already stored. To change it, run ${inlineCommand(shellCommand([
+		"agentcomms",
+		"secrets",
+		"migrate",
+		"--to",
+		requested
+	], platform))}, then run this again.` });
 	return {
 		store: committed,
 		choosing: false
@@ -2404,40 +2673,6 @@ function canonicalLoosening(loosening) {
 function sameLoosening(a, b) {
 	return canonicalLoosening(a) === canonicalLoosening(b);
 }
-/** Crockford-style alphabet without I, L, O and U, so ids and challenges survive being read aloud or retyped. */
-const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function randomString(length) {
-	const bytes = randomBytes(length);
-	let out = "";
-	for (let i = 0; i < length; i += 1) out += ALPHABET[(bytes[i] ?? 0) & 31];
-	return out;
-}
-/** `ap_` + 26 characters: 130 random bits. Validated before an id ever names a file. */
-const APPROVAL_ID_PATTERN = /^ap_[0-9A-HJKMNP-TV-Z]{26}$/;
-const PLAN_TOKEN_PATTERN = /^pl_[0-9A-HJKMNP-TV-Z]{26}$/;
-function newApprovalId() {
-	return `ap_${randomString(26)}`;
-}
-function newPlanToken() {
-	return `pl_${randomString(26)}`;
-}
-const CHALLENGE_LETTERS = "ABCDEFGHJKMNPQRSTVWXYZ";
-/** A short challenge a human types back to approve: letters only, no look-alikes. */
-function newChallenge(length = 4) {
-	let out = "";
-	for (let i = 0; i < length; i += 1) out += CHALLENGE_LETTERS[randomInt(22)];
-	return out;
-}
-/** Challenges are stored only as hashes, so no listing or tool result can reveal one. */
-function hashChallenge(challenge) {
-	return createHash("sha256").update(challenge.trim().toUpperCase()).digest("hex");
-}
-/** Case-insensitive, constant-time comparison of an answer with a stored challenge hash. */
-function challengeMatches(answer, storedHash) {
-	const a = Buffer.from(hashChallenge(answer), "hex");
-	const b = Buffer.from(storedHash, "hex");
-	return a.length === b.length && timingSafeEqual(a, b);
-}
 /**
 * The digest a download's question is bound to: the account, the download, the request, the files it listed and the
 * names it showed them under.
@@ -2588,6 +2823,32 @@ function refusalFor(record) {
 	const kind = approvalKind(record);
 	return kind === "change" ? refuseChange : kind === "download" ? refuseDownload : refuse$1;
 }
+/**
+* A claim whose caller was cancelled before it changed anything (`ClaimOptions.signal`).
+*
+* `USAGE` and `cancelled:`, the words every cancellation in this repository is reported in, with `details.reason`
+* saying so for a caller that branches on it — and in the record's own kind: a question is not an approval, and
+* nothing is sent by answering one. The record is as it was, and the hint says so.
+*/
+function cancelledClaim(record) {
+	const kind = approvalKind(record);
+	if (kind === "download") return new CommsError("USAGE", "cancelled: nothing was saved", {
+		hint: "The question was not used: the same call, made again with the same answer, can still use it until it expires.",
+		details: {
+			choiceId: record.approvalId,
+			state: record.state,
+			reason: "cancelled"
+		}
+	});
+	return new CommsError("USAGE", `cancelled: ${kind === "change" ? "nothing was changed" : "nothing was sent"}`, {
+		hint: "The approval was not used: the same call, made again, can still use it until it expires.",
+		details: {
+			approvalId: record.approvalId,
+			state: record.state,
+			reason: "cancelled"
+		}
+	});
+}
 /** The record as it may be shown to anyone, agents included: never the challenge hash. */
 function publicView(record) {
 	const { challengeHash: _hidden, ...rest } = record;
@@ -2705,19 +2966,23 @@ var ApprovalStore = class {
 	* Nothing written, because the caller made a mistake about an approval that may be perfectly good: voiding a post
 	* somebody is about to approve, because an agent passed its id to a change, would punish the wrong party.
 	*/
-	#requireKind(record, kind) {
+	#requireKind(record, kind, platform) {
 		const actual = approvalKind(record);
 		if (actual === kind) return;
 		const id = record.approvalId;
 		if (actual === "download") throw (kind === "change" ? refuseChange : refuse$1)("USAGE", `${id} is a question about where to save files, not ${kind === "send" ? "a send" : "a configuration change"}`, record, DOWNLOAD_ANSWER_HINT);
 		if (kind === "download") throw refuseDownload("USAGE", `${id} is ${actual === "change" ? "a configuration change" : "a send"}, not a question about where to save files`, record, "Pass the choice id the download’s question came with, and the person’s answer beside it.");
-		throw kind === "send" ? refuse$1("USAGE", `approval ${id} is for a configuration change, not a send`, record, `A person approves it with \`agentcomms approve ${id}\` — or ${channelApproveCommands()}, whichever is installed — and it permits only the change it was prepared for.`) : refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, `It is approved with the command that prepared it — ${channelApproveCommands({ sending: true })} — and permits only that send.`);
+		throw kind === "send" ? refuse$1("USAGE", `approval ${id} is for a configuration change, not a send`, record, `A person approves it with ${inlineCommand(shellCommand([
+			"agentcomms",
+			"approve",
+			id
+		], platform))} — or ${channelApproveCommands()}, whichever is installed — and it permits only the change it was prepared for.`) : refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, `It is approved with the command that prepared it — ${channelApproveCommands({ sending: true })} — and permits only that send.`);
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
-	async issueChallenge(approvalId, kind = "send") {
+	async issueChallenge(approvalId, kind = "send", platform = process.platform) {
 		const challenge = newChallenge();
 		await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, kind);
+			this.#requireKind(current, kind, platform);
 			if (current.state !== "pending") throw this.#stateError(current);
 			return {
 				...current,
@@ -2734,10 +2999,10 @@ var ApprovalStore = class {
 	* A change is approved the same way, with `kind: 'change'` and its digest standing in for the draft (see
 	* `createChange`), so a person's typed code means one thing whichever kind of approval it is typed for.
 	*/
-	async approve(approvalId, via, live, answer, kind = "send") {
+	async approve(approvalId, via, live, answer, kind = "send", platform = process.platform) {
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, kind);
+			this.#requireKind(current, kind, platform);
 			if (current.state !== "pending") throw this.#stateError(current);
 			if (!current.challengeHash) throw refusalFor(current)("APPROVAL_REQUIRED", "no challenge was issued for this approval", current);
 			if (live.draftMessageId !== current.draftMessageId || live.digest !== current.digest) {
@@ -2794,8 +3059,9 @@ var ApprovalStore = class {
 	async claimForSend(approvalId, live, options = {}) {
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "send");
+			this.#requireKind(current, "send", options.platform ?? process.platform);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
+			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (code, reason) => {
 				failure = {
 					code,
@@ -2904,8 +3170,9 @@ var ApprovalStore = class {
 		const digest = changeDigest(live.change);
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "change");
+			this.#requireKind(current, "change", options.platform ?? process.platform);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
+			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (reason) => {
 				failure = {
 					code: "APPROVAL_VOID",
@@ -2919,7 +3186,11 @@ var ApprovalStore = class {
 			};
 			if (digest !== current.digest) return voidWith(current.change ? changeDrift(current.change, live.change) : "the change is not the one that was approved");
 			if (stricterPolicy(live.policy, current.requiredPolicy) !== "chat") {
-				if (current.state !== "approved") throw refuseChange("APPROVAL_PENDING", "this change needs a person to approve it at a terminal first", current, options.pendingHint ?? `Ask the user to run \`agentcomms approve ${approvalId}\` in their own terminal, then try again with the same approval.`);
+				if (current.state !== "approved") throw refuseChange("APPROVAL_PENDING", "this change needs a person to approve it at a terminal first", current, options.pendingHint ?? `Ask the user to run ${inlineCommand(shellCommand([
+					"agentcomms",
+					"approve",
+					approvalId
+				], options.platform ?? process.platform))} in their own terminal, then try again with the same approval.`);
 				if (current.approvedVia !== "terminal") return voidWith("the change policy is confirm, and this was not approved at a terminal");
 			}
 			return {
@@ -2996,13 +3267,13 @@ var ApprovalStore = class {
 	*
 	* Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
 	*/
-	async answerDownload(approvalId, via, answer) {
+	async answerDownload(approvalId, via, answer, platform = process.platform) {
 		const recorded = answer.choice === "other" ? {
 			choice: "other",
 			folder: answer.folder
 		} : { choice: answer.choice };
 		return await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "download");
+			this.#requireKind(current, "download", platform);
 			if (current.state === "approved") throw refuseDownload("APPROVAL_VOID", "the question was answered already, and it is answered once", current);
 			if (current.state !== "pending") throw this.#stateError(current);
 			if (!current.download || downloadDigest(current.download) !== current.digest) throw refuseDownload("APPROVAL_VOID", "the question does not describe the download it is bound to", current);
@@ -3033,13 +3304,17 @@ var ApprovalStore = class {
 	* gave it in the conversation. Under `confirm`, only a question the person answered at a terminal or in a trusted
 	* form can be claimed; a pending one is refused, and left as it is, so they can still answer it. One used, voided or
 	* expired is refused as an approval in that state is.
+	*
+	* `options.signal` is the download's cancellation, asked under the lock as a send's is (`ClaimOptions.signal`): a
+	* download cancelled while this waited saves nothing and leaves the question open, the answer still unused.
 	*/
 	async claimForDownload(approvalId, live, options = {}) {
 		const digest = downloadDigest(live);
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "download");
+			this.#requireKind(current, "download", options.platform ?? process.platform);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
+			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (reason) => {
 				failure = {
 					code: "APPROVAL_VOID",
@@ -4374,13 +4649,13 @@ function snippetFor(client, name, entry) {
 * Project-scoped entries are not looked at: every write here targets user scope, so they are not what would be
 * replaced.
 */
-function claimName(product, options, name, existing) {
+function claimName(product, options, name, existing, platform) {
 	const taken = existing.filter((server) => server.client === options.client && server.name === name && server.scope !== "project");
 	const foreign = taken.find((server) => !isProductServer(server, product));
 	if (foreign) {
 		const what = foreign.packageName ?? (foreign.url ? displayUrl(foreign.url) : void 0) ?? (foreign.command || "something else");
 		const other = name === product.binary ? `${product.binary}-${product.defaultServerName}` : product.binary;
-		throw new CommsError("CONFIG", `${options.client} already has an MCP server called "${name}", and it is not this one (it runs ${what})`, { hint: `Register this one under another name: \`${installCommand$1(product, options, other)}\`. --force does not replace a server this did not install.` });
+		throw new CommsError("CONFIG", `${options.client} already has an MCP server called "${name}", and it is not this one (it runs ${what})`, { hint: `Register this one under another name: ${inlineCommand(installCommand$1(product, options, other, [], platform))}. --force does not replace a server this did not install.` });
 	}
 	if (taken.length > 0 && !options.force) {
 		for (const pin of PIN_OPTIONS) {
@@ -4388,14 +4663,14 @@ function claimName(product, options, name, existing) {
 			const served = taken.map((server) => product.narrowingOf(server.args)[pin]).find(Boolean);
 			if (!wanted || !served || served === wanted) continue;
 			const second = `${product.defaultServerName}-${wanted.split("/")[0]}`;
-			throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `That entry serves ${served}; to serve ${wanted} as well, register a second entry under its own name: \`${installCommand$1(product, options, second === name ? `${name}-2` : second)}\`.` });
+			throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `That entry serves ${served}; to serve ${wanted} as well, register a second entry under its own name: ${inlineCommand(installCommand$1(product, options, second === name ? `${name}-2` : second, [], platform))}.` });
 		}
 		const npx = taken.some((server) => server.args.some((argument) => argument.startsWith(`${product.npxPackage}@`)));
 		const again = {
 			...keepNarrowing(product, options, taken).options,
 			launcher: options.launcher ?? (npx ? "npx" : void 0)
 		};
-		throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `Pass --force to replace it — that is how an upgrade reaches a client: \`${installCommand$1(product, again, name, ["--force"])}\`.` });
+		throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `Pass --force to replace it — that is how an upgrade reaches a client: ${inlineCommand(installCommand$1(product, again, name, ["--force"], platform))}.` });
 	}
 	return taken;
 }
@@ -4438,8 +4713,11 @@ function keepNarrowing(product, options, previous) {
 * workspace on the machine; for Gmail it dropped `--inbox` and `--read-only` the same way. Doctor's repair already
 * rebuilds these flags for exactly that reason. The product's `serverArgs` are the install command's own flags for
 * the pin and the narrowing, so they are repeated as they are.
+*
+* A pin kept from the entry being replaced was read from the client's file, which may hold anything, so on Windows the
+* command can come back with no line to paste; every hint gives it with `inlineCommand`, which shows it as words then.
 */
-function installCommand$1(product, options, name, extra = []) {
+function installCommand$1(product, options, name, extra, platform) {
 	const words = [
 		product.binary,
 		"mcp",
@@ -4451,7 +4729,7 @@ function installCommand$1(product, options, name, extra = []) {
 	words.push(...product.serverArgs(options));
 	if (options.launcher && options.launcher !== "managed") words.push("--launcher", options.launcher);
 	words.push(...extra);
-	return words.map((word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`).join(" ");
+	return shellCommand(words, platform);
 }
 /**
 * A command's exit status and what it printed, kept here and never shown: codex prints an entry's env. Started as
@@ -4494,8 +4772,13 @@ function capture$1(env, command, args) {
 * or a failure that is not "no such server", stops the install: not knowing is not the same as nothing there.
 * Nothing codex prints is repeated, because its answer carries the entry's env.
 */
-async function codexRegistration(env, binary, name, path) {
-	const unknown = () => new CommsError("CONFIG", `codex would not say what it has registered as "${name}", so nothing was written`, { hint: `Look with \`codex mcp get ${name}\`. If it is not an older copy of this server, choose another --name; \`--print\` shows the entry to add by hand.` });
+async function codexRegistration(env, binary, name, path, platform) {
+	const unknown = () => new CommsError("CONFIG", `codex would not say what it has registered as "${name}", so nothing was written`, { hint: `Look with ${inlineCommand(shellCommand([
+		"codex",
+		"mcp",
+		"get",
+		name
+	], platform))}. If it is not an older copy of this server, choose another --name; \`--print\` shows the entry to add by hand.` });
 	let answer;
 	try {
 		answer = await capture$1(env, binary, [
@@ -4598,10 +4881,10 @@ async function preflightInstall(context, product, options) {
 		const blind = scan.unreadable.find((file) => file.path === own);
 		if (blind) throw new CommsError("CONFIG", `${blind.path} could not be read (${blind.reason}), so what is already registered there cannot be checked; nothing was written`, { hint: "Fix the file, or add the entry by hand: `--print` shows it without writing anything." });
 	}
-	let previous = writes ? claimName(product, options, name, existing) : [];
+	let previous = writes ? claimName(product, options, name, existing, context.platform) : [];
 	if (writes && binary && options.client === "codex") {
-		const reported = await codexRegistration(context.env, binary, name, configPath ?? "codex");
-		if (reported) previous = claimName(product, options, name, [reported]);
+		const reported = await codexRegistration(context.env, binary, name, configPath ?? "codex", context.platform);
+		if (reported) previous = claimName(product, options, name, [reported], context.platform);
 	}
 	const { options: effective, kept } = keepNarrowing(product, options, previous);
 	const node = await resolveNode(context.env);
@@ -4726,9 +5009,21 @@ async function mcpInstall(context, product, options, planned) {
 	};
 	const existing = scan.servers;
 	const { cliName, binary, own, configPath, writes } = target;
-	const warnings = (product.warnAbout?.(existing.filter((server) => server.client === options.client)) ?? []).filter(Boolean);
+	const warnings = (product.warnAbout?.(existing.filter((server) => server.client === options.client), context.platform) ?? []).filter(Boolean);
 	if (kept.length > 0) {
-		const removal = options.client === "claude-code" ? `\`claude mcp remove ${name} --scope user\`` : options.client === "codex" ? `\`codex mcp remove ${name}\`` : `delete "${name}" from ${configPath}`;
+		const removal = options.client === "claude-code" ? inlineCommand(shellCommand([
+			"claude",
+			"mcp",
+			"remove",
+			name,
+			"--scope",
+			"user"
+		], context.platform)) : options.client === "codex" ? inlineCommand(shellCommand([
+			"codex",
+			"mcp",
+			"remove",
+			name
+		], context.platform)) : `delete "${name}" from ${configPath}`;
 		warnings.push(`Kept ${kept.join(" ")} from the "${name}" entry this replaced, because this install did not say otherwise. To register it wider on purpose, remove that entry first (${removal}), then install without them.`);
 	}
 	if (!writes) {
@@ -4823,7 +5118,7 @@ async function mcpInstall(context, product, options, planned) {
 					restored = false;
 				}
 				throw new CommsError("CONFIG", restored ? `could not register "${name}"; the previous entry was put back` : `could not register "${name}", and the previous entry could not be put back either — ${cliName} now has no server called "${name}"`, {
-					hint: restored ? "Check the client is not running, then try again." : `Re-register it with \`${installCommand$1(product, effective, name)}\`. The old entry is in ${backupPath}.`,
+					hint: restored ? "Check the client is not running, then try again." : `Re-register it with ${inlineCommand(installCommand$1(product, effective, name, [], context.platform))}. The old entry is in ${backupPath}.`,
 					cause: error
 				});
 			}
@@ -4832,7 +5127,17 @@ async function mcpInstall(context, product, options, planned) {
 		} catch (error) {
 			const message = error instanceof CommsError ? error.message : String(error);
 			if (/already exists/i.test(message)) throw new CommsError("CONFIG", `${cliName} already has an MCP server called "${name}", somewhere this could not read`, {
-				hint: `Look at it with \`${cliName} mcp get ${name}\`. If it is an older ${product.binary}, remove it with \`${cliName} mcp remove ${name}\` and run this again; if not, choose another --name.`,
+				hint: `Look at it with ${inlineCommand(shellCommand([
+					cliName,
+					"mcp",
+					"get",
+					name
+				], context.platform))}. If it is an older ${product.binary}, remove it with ${inlineCommand(shellCommand([
+					cliName,
+					"mcp",
+					"remove",
+					name
+				], context.platform))} and run this again; if not, choose another --name.`,
 				cause: error
 			});
 			throw error;
@@ -5168,19 +5473,32 @@ function rivalPatterns(packages) {
 function escapeRegExp$2(text) {
 	return text.replace(/[\\^$.*+?()[\]{}|/]/g, "\\$&");
 }
-function gmailRemoval({ client, name: server, path, scope }) {
+/**
+* The command that removes a registered server, in its client's own terms — the name as the client's file has it,
+* which may be anything, so on Windows it can have no line to paste, and is shown as its words, to be typed
+* (`shellCommand`). Never as a line with the name left out: that removed whatever entry had the stand-in's name.
+*/
+function removalCommand(client, name, platform) {
+	return commandText(shellCommand([
+		client,
+		"mcp",
+		"remove",
+		name
+	], platform));
+}
+function gmailRemoval({ client, name: server, path, scope }, platform) {
 	if (scope === "project") return `remove "${server}" from the project entry in ${path} by hand`;
 	switch (client) {
-		case "claude-code": return `claude mcp remove ${server}`;
-		case "codex": return `codex mcp remove ${server}`;
+		case "claude-code": return removalCommand("claude", server, platform);
+		case "codex": return removalCommand("codex", server, platform);
 		default: return `remove the "${server}" entry from ${path}, then restart ${client}`;
 	}
 }
 /**
 * Registered servers that are one of `packages` — another server for the same service whose send tools no approval
-* step gates — each with why it matters and how to remove it.
+* step gates — each with why it matters and how to remove it. `platform` is the shell the removal is quoted for.
 */
-function findRivalPackageServers(servers, packages) {
+function findRivalPackageServers(servers, packages, platform = process.platform) {
 	const patterns = rivalPatterns(packages);
 	const findings = [];
 	for (const server of servers) {
@@ -5191,14 +5509,14 @@ function findRivalPackageServers(servers, packages) {
 			...server,
 			packageName: known.name,
 			reason: `${known.name} exposes send tools that no approval step gates`,
-			removal: gmailRemoval(server)
+			removal: gmailRemoval(server, platform)
 		});
 	}
 	return findings;
 }
 /** What registering a server says about the rival packages its manifest names: one line each. */
-function rivalPackageWarnings(servers, packages) {
-	return findRivalPackageServers(servers, packages).map((finding) => `${finding.packageName} is registered with ${finding.client} as "${finding.name}": ${finding.reason}. Remove it: ${finding.removal}`);
+function rivalPackageWarnings(servers, packages, platform = process.platform) {
+	return findRivalPackageServers(servers, packages, platform).map((finding) => `${finding.packageName} is registered with ${finding.client} as "${finding.name}": ${finding.reason}. Remove it: ${finding.removal}`);
 }
 /**
 * Registered servers that name the service's `word` anywhere — their name, command, arguments or URL — and are not
@@ -5284,7 +5602,7 @@ function serverFactsOf({ packageName, manifest }) {
 	if (rivals === void 0) return facts;
 	return {
 		...facts,
-		warnAbout: (servers) => [...rivals.packages ? rivalPackageWarnings(servers, rivals.packages) : [], ...rivals.word !== void 0 && rivals.can !== void 0 ? rivalWordWarnings(servers, rivals.word, rivals.can, facts) : []]
+		warnAbout: (servers, platform) => [...rivals.packages ? rivalPackageWarnings(servers, rivals.packages, platform) : [], ...rivals.word !== void 0 && rivals.can !== void 0 ? rivalWordWarnings(servers, rivals.word, rivals.can, facts) : []]
 	};
 }
 const CHANNEL_SERVERS = Object.freeze(Object.fromEntries(CHANNEL_SNAPSHOT.map((entry) => [entry.manifest.channel, serverFactsOf(entry)])));
@@ -5317,107 +5635,6 @@ function requireChannelManifest(channel) {
 	if (manifest === void 0) throw notAChannel(channel);
 	return manifest;
 }
-function okEnvelope(data) {
-	return {
-		ok: true,
-		schemaVersion: 1,
-		data
-	};
-}
-function errorEnvelope(error) {
-	const body = {
-		code: error.code,
-		message: error.message
-	};
-	if (error.hint !== void 0) body.hint = error.hint;
-	if (error.details !== void 0) body.details = error.details;
-	return {
-		ok: false,
-		schemaVersion: 1,
-		error: body
-	};
-}
-const defaultStreams = {
-	stdout: process.stdout,
-	stderr: process.stderr,
-	stdin: process.stdin
-};
-function colorEnabled(env, stream, flag) {
-	if (flag === false) return false;
-	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
-	if (env.TERM === "dumb") return false;
-	if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
-	return Boolean(stream.isTTY);
-}
-/** True when a human could answer a prompt: both ends are terminals, no --json/--no-input, not CI. */
-function canPrompt(env, streams, options) {
-	if (options.json || options.noInput) return false;
-	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
-	return Boolean(streams.stdin?.isTTY && streams.stdout.isTTY);
-}
-/** Environment variables well-known coding agents set. Used only as a speed bump, never as a security boundary. */
-const AGENT_MARKERS = [
-	"CLAUDECODE",
-	"CLAUDE_CODE_ENTRYPOINT",
-	"CODEX_SANDBOX",
-	"CODEX_HOME",
-	"CURSOR_AGENT",
-	"GEMINI_CLI",
-	"AGENT_COMMS_AGENT"
-];
-function agentMarker(env) {
-	for (const name of AGENT_MARKERS) if (env[name] !== void 0 && env[name] !== "") return name;
-	return null;
-}
-function paint(color, format, text) {
-	return color ? styleText(format, text, { validateStream: false }) : text;
-}
-/** Writes a successful result: the envelope with --json, otherwise the human rendering. */
-function writeResult(data, options, human, streams = defaultStreams) {
-	if (options.json) {
-		streams.stdout.write(`${JSON.stringify(okEnvelope(data))}\n`);
-		return;
-	}
-	const text = human(data);
-	if (text) streams.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
-}
-/** Writes an error and returns the exit code to use. */
-function writeError(error, options, streams = defaultStreams) {
-	const commsError = toCommsError(error);
-	if (options.json) streams.stdout.write(`${JSON.stringify(errorEnvelope(commsError))}\n`);
-	else {
-		streams.stderr.write(`${paint(options.color, "red", "error")}: ${commsError.message}\n`);
-		if (commsError.hint) streams.stderr.write(`${paint(options.color, "dim", "hint")}: ${commsError.hint}\n`);
-	}
-	return commsError.exitCode;
-}
-/** Runs a command body and exits with the documented code. Unexpected errors keep only their message. */
-async function runCommand(options, body, streams = defaultStreams) {
-	try {
-		await body();
-		return EXIT_CODES.OK;
-	} catch (error) {
-		return writeError(error, options, streams);
-	}
-}
-/**
-* The first two steps of `requirePerson` — an agent is refused, then anything without a terminal — for a command
-* whose code is not its own to make up.
-*
-* `agentcomms approve` asks for a code the approval store issued and will check, so it cannot use `askChallenge`;
-* but it refuses in exactly the same order and words, because it is the same gate.
-*/
-function refuseUnlessPerson(env, streams, gate) {
-	const marker = agentMarker(env);
-	if (marker) throw new CommsError("LOOSENING_REFUSED", gate.refusedToAgent, {
-		hint: `Ask the user to run \`${gate.command}\` in their own terminal.`,
-		details: { marker }
-	});
-	const prompting = {};
-	if (gate.json !== void 0) prompting.json = gate.json;
-	if (gate.noInput !== void 0) prompting.noInput = gate.noInput;
-	if (!canPrompt(env, streams, prompting)) throw new CommsError("LOOSENING_REFUSED", gate.refusedWithoutTerminal, { hint: `Run \`${gate.command}\` directly in a terminal.` });
-}
 /**
 * One renderer for every surface a send preview is shown on — the chat, an elicitation form, a terminal. Text the
 * draft's author controls (body, subject, display names, file names, link text) must not be able to change how the
@@ -5583,9 +5800,9 @@ function renderUpdate(result, color) {
 	if (result.next) lines.push("", result.next);
 	return lines.join("\n");
 }
-/** The terminal command that approves a change, for the channel that asked. */
-function approveCommandOf(options) {
-	return options.approveCommand ?? "agentcomms approve";
+/** The channel's fixed approval-command prefix with this generated id, rendered by the common shell rule. */
+function changeApprovalCommand(approveCommand, approvalId, platform = process.platform) {
+	return shellCommand([...(approveCommand ?? "agentcomms approve").trim().split(/\s+/), approvalId], platform);
 }
 /**
 * The change policy that governs a change, as `config` stands: the strictest of the policies over everything the change
@@ -5696,7 +5913,7 @@ async function prepareChange(core, request, options) {
 				change: binding
 			}),
 			expiresAt: record.expiresAt,
-			next: nextStep(record.approvalId, policy, approveCommandOf(options))
+			next: nextStep(record.approvalId, policy, options)
 		};
 	} catch (error) {
 		await auditRefusal(core, "change.prepare", error, {
@@ -5727,7 +5944,10 @@ async function claimChange(core, approvalId, expect, options) {
 		const record = await core.approvals.claimForChange(approvalId, {
 			change: binding,
 			policy
-		}, { pendingHint: `Ask the user to run \`${approveCommandOf(options)} ${approvalId}\` in their own terminal, then try again with the same approval.` });
+		}, {
+			pendingHint: `Ask the user to run ${inlineCommand(changeApprovalCommand(options.approveCommand, approvalId, options.platform))} in their own terminal, then try again with the same approval.`,
+			platform: options.platform
+		});
 		const decided = stricterPolicy(policy, record.requiredPolicy) === "chat" ? "chat" : "confirm";
 		await auditChange(core, {
 			operation: "change.claim",
@@ -5775,7 +5995,7 @@ async function beginChangeApproval(core, approvalId, options) {
 	let record;
 	try {
 		record = await changeRecord(core, approvalId);
-		const challenge = await core.approvals.issueChallenge(approvalId, "change");
+		const challenge = await core.approvals.issueChallenge(approvalId, "change", options.platform);
 		return {
 			approvalId,
 			preview: renderChangePreview(record),
@@ -5800,7 +6020,7 @@ async function finishChangeApproval(core, approvalId, answer, options) {
 		const approved = await core.approvals.approve(approvalId, "terminal", {
 			draftMessageId: digest,
 			digest
-		}, answer, "change");
+		}, answer, "change", options.platform);
 		await auditChange(core, {
 			operation: "change.approve",
 			outcome: "ok",
@@ -5856,8 +6076,8 @@ async function revokeChange(core, approvalId, reason, options) {
 function changePolicyOf$1(record) {
 	return record.requiredPolicy === "chat" ? "chat" : "confirm";
 }
-function nextStep(approvalId, policy, approveCommand) {
-	return policy === "chat" ? `Show this preview to the user and ask. If they say yes, claim approval ${approvalId} and apply the change; if not, revoke it.` : `The change policy is confirm: ask the user to run \`${approveCommand} ${approvalId}\` in their own terminal and type the code it shows. Then claim approval ${approvalId} and apply the change.`;
+function nextStep(approvalId, policy, options) {
+	return policy === "chat" ? `Show this preview to the user and ask. If they say yes, claim approval ${approvalId} and apply the change; if not, revoke it.` : `The change policy is confirm: ask the user to run ${inlineCommand(changeApprovalCommand(options.approveCommand, approvalId, options.platform))} in their own terminal and type the code it shows. Then claim approval ${approvalId} and apply the change.`;
 }
 /**
 * One line per step of a change approval: who asked, from which surface, under which policy, and how it ended.
@@ -5978,21 +6198,25 @@ function renderChangePreview(record) {
 * it on the second call, with its id.
 *
 * A change that loosens no setting and does nothing irreversible is applied directly: asking a person to agree to
-* something that needs no agreement teaches them to agree without reading. It refuses an approval id, as a report
-* refuses one (`refuseApprovalWithoutChange`), rather than applying and dropping it: the update check's stop lets a
-* call claiming an approval through (design 2026-09-28 §2), and one that is then never claimed would carry any
-* approval the store holds — one an agent had just had prepared for "not now", say — past the stop, to a tightening
-* or a cancellation made where the call itself was stopped.
+* something that needs no agreement teaches them to agree without reading. It refuses an approval id — in the change's
+* own words when it has them (`refuseApproval`) — as a report refuses one (`refuseApprovalWithoutChange`), rather than
+* applying and dropping it: the update check's stop lets a call claiming an approval through (design 2026-09-28 §2),
+* and one that is then never claimed would carry any approval the store holds — one an agent had just had prepared for
+* "not now", say — past the stop, to a tightening or a cancellation made where the call itself was stopped.
 */
 async function gatedChange(core, change, options) {
 	const request = await change.plan(await core.config.load());
 	const loosens = classifyChange(request.before, request.after).loosened.length > 0;
 	const acts = (request.effects ?? []).length > 0;
 	if (!loosens && !acts) {
-		if (options.approvalId) throw new CommsError("USAGE", "nothing was changed: as things stand this change needs no approval, so it takes none", {
-			hint: "Make the same call again without the approval: it applies at once and asks nobody. An approval is spent only on the change it was prepared for.",
-			details: { approvalId: options.approvalId }
-		});
+		if (options.approvalId) {
+			const refusal = await change.refuseApproval?.(options.approvalId);
+			if (refusal !== void 0) throw refusal;
+			throw new CommsError("USAGE", "nothing was changed: as things stand this change needs no approval, so it takes none", {
+				hint: "Make the same call again without the approval: it applies at once and asks nobody. An approval is spent only on the change it was prepared for.",
+				details: { approvalId: options.approvalId }
+			});
+		}
 		return {
 			status: "applied",
 			result: await change.apply(void 0, request)
@@ -6002,12 +6226,14 @@ async function gatedChange(core, change, options) {
 		status: "approval-required",
 		prepared: await prepareChange(core, request, {
 			surface: options.surface,
-			approveCommand: options.approveCommand
+			approveCommand: options.approveCommand,
+			platform: options.platform
 		})
 	};
 	const consent = await claimChange(core, options.approvalId, request, {
 		surface: options.surface,
-		approveCommand: options.approveCommand
+		approveCommand: options.approveCommand,
+		platform: options.platform
 	});
 	return {
 		status: "applied",
@@ -6069,14 +6295,17 @@ async function gatedChangeAtTerminal(core, change, options) {
 	const first = await gatedChange(core, change, {
 		surface: "cli",
 		approvalId: options.approvalId,
-		approveCommand
+		approveCommand,
+		platform: options.output.platform
 	});
 	if (first.status === "applied") return first.result;
 	const { prepared } = first;
 	if (!(agentMarker(options.env) === null && canPrompt(options.env, streams, { json: options.output.json === true }))) {
 		if (options.output.json !== true) streams.stdout.write(`${prepared.preview}\n\n`);
+		const carrying = [options.approvalFlag ?? "--approval", prepared.approvalId];
+		const { command } = options;
 		throw new CommsError("APPROVAL_PENDING", `this change needs approval first: ${prepared.summary}`, {
-			hint: approvalHint(prepared, `${options.command} ${options.approvalFlag ?? "--approval"} ${prepared.approvalId}`, approveCommand),
+			hint: approvalHint(prepared, typeof command === "string" ? `${command} ${carrying.join(" ")}` : withWords(command, ...carrying), approveCommand, options.output.platform),
 			details: {
 				approvalId: prepared.approvalId,
 				policy: prepared.policy,
@@ -6097,7 +6326,8 @@ async function gatedChangeAtTerminal(core, change, options) {
 	const second = await gatedChange(core, change, {
 		surface: "cli",
 		approvalId: prepared.approvalId,
-		approveCommand
+		approveCommand,
+		platform: options.output.platform
 	});
 	if (second.status !== "applied") throw new CommsError("UNEXPECTED", "the approved change asked for approval again");
 	return second.result;
@@ -6109,8 +6339,9 @@ async function gatedChangeAtTerminal(core, change, options) {
 * Shared with a command that reports a waiting change rather than failing on it — `agent-gmail setup`, which stops at
 * its registration step and says why in its report — so the two say it in the same words.
 */
-function approvalHint(prepared, rerun, approveCommand) {
-	return prepared.policy === "confirm" ? `Show the person the preview. They run \`${approveCommandOf({ approveCommand })} ${prepared.approvalId}\`; then run \`${rerun}\`.` : `Show the person the preview. Once they say yes, run \`${rerun}\`.`;
+function approvalHint(prepared, rerun, approveCommand, platform = typeof rerun === "string" ? process.platform : rerun.platform) {
+	const run = typeof rerun === "string" ? `\`${rerun}\`` : inlineCommand(rerun);
+	return prepared.policy === "confirm" ? `Show the person the preview. They run ${inlineCommand(changeApprovalCommand(approveCommand, prepared.approvalId, platform))}; then run ${run}.` : `Show the person the preview. Once they say yes, run ${run}.`;
 }
 /**
 * Approves a configuration change at a terminal, the way a person approves a send: read the preview, type the code.
@@ -6130,7 +6361,11 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 		refuseUnlessPerson(env, streams, {
 			refusedToAgent: "only a person can approve a change, not an agent",
 			refusedWithoutTerminal: "approving a change needs an interactive terminal",
-			command: `agentcomms approve ${approvalId}`,
+			command: commandText(shellCommand([
+				"agentcomms",
+				"approve",
+				approvalId
+			], output.platform)),
 			color: output.color,
 			json: output.json
 		});
@@ -6792,7 +7027,7 @@ async function npmInstallGlobal(env, spec) {
 	}
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.12.1";
+const VERSION = "0.12.3";
 /**
 * Registering, pruning and listing the MCP servers of every channel, from the core.
 *
@@ -7050,7 +7285,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.12.1"
+		version: "0.12.3"
 	};
 	const product = {
 		packageName,
@@ -7396,8 +7631,13 @@ async function latestReleases(names, latestVersion) {
 	if (first?.problem) throw new CommsError("PROVIDER_UNAVAILABLE", `${first.problem}${problems.length > 1 ? ` (and ${problems.length - 1} more)` : ""}`, { hint: "Nothing was checked or changed. Try again once the registry can be reached; `npm view <package> version` shows what npm itself reads." });
 	return Object.fromEntries(answers.map((answer) => [answer.name, answer.version ?? ""]));
 }
-/** How to register an entry again by hand: its channel's own `mcp install`, with every flag that decides its reach. */
-function installCommand(item) {
+/**
+* How to register an entry again by hand: its channel's own `mcp install`, with every flag that decides its reach.
+*
+* The entry's name and pins are read from the client's file, which may hold anything, so on Windows the command may
+* have no line to paste: the reasons below give it with `inlineCommand`, which shows it as words then.
+*/
+function installCommand(item, platform) {
 	const facts = channelServer(item.channel);
 	const words = [
 		facts.binary,
@@ -7408,7 +7648,7 @@ function installCommand(item) {
 	];
 	if (item.name !== facts.defaultServerName) words.push("--name", item.name);
 	words.push(...item.narrowing, "--force");
-	return words.join(" ");
+	return shellCommand(words, platform);
 }
 /**
 * Why a registration that is behind cannot be registered again from here, or undefined when it can.
@@ -7419,13 +7659,13 @@ function installCommand(item) {
 * been renamed or removed: registering it again would register a server that is refused when it starts.
 */
 async function whyNotUpdatable(context, config, item, narrowing) {
-	if (item.launcher !== "managed" && item.launcher !== "npx") return `it was not written by \`mcp install\`, so how it starts cannot be carried over; register it again with \`${installCommand(item)}\``;
+	if (item.launcher !== "managed" && item.launcher !== "npx") return `it was not written by \`mcp install\`, so how it starts cannot be carried over; register it again with ${inlineCommand(installCommand(item, context.platform))}`;
 	if (item.scope !== "user") return `it is registered for one project (in ${item.path}), and \`mcp install\` registers at user scope only; register it again from that project with ${item.client}'s own command`;
 	const target = await installTarget(context, {
 		client: item.client,
 		apply: true
 	});
-	if (!target.writes) return target.cliName ? `\`${target.cliName}\` is not ${clientCliSearch(context.env)}, so the entry cannot be replaced from here; run \`${installCommand(item)}\` where it is` : `this environment names no ${item.client} configuration to write to`;
+	if (!target.writes) return target.cliName ? `\`${target.cliName}\` is not ${clientCliSearch(context.env)}, so the entry cannot be replaced from here; run ${inlineCommand(installCommand(item, context.platform))} where it is` : `this environment names no ${item.client} configuration to write to`;
 	const own = pinOption(item.channel);
 	const pin = own === void 0 || own === "readOnly" ? void 0 : narrowing[own];
 	if (pin !== void 0) {
@@ -7469,7 +7709,8 @@ async function runtimesNeeded(dataDir, latest, managed) {
 async function inspect(core, env, deps) {
 	const context = {
 		env,
-		core
+		core,
+		platform: deps.platform
 	};
 	const scan = await scanRegisteredServers(env);
 	const unreadable = [...scan.unreadable];
@@ -7778,7 +8019,7 @@ async function planRegistrations(context, candidates, request) {
 		}
 		const keeps = narrowingArgs(item.channel, preflight.effective);
 		if (JSON.stringify(keeps) !== JSON.stringify(item.narrowing)) {
-			leave(item, `registering it again would not keep exactly ${item.narrowing.length > 0 ? item.narrowing.join(" ") : "no pin"}: ${item.client} itself has the entry as ${keeps.length > 0 ? keeps.join(" ") : "not pinned"}. Register it again yourself with the pins it should have: \`${installCommand(item)}\``);
+			leave(item, `registering it again would not keep exactly ${item.narrowing.length > 0 ? item.narrowing.join(" ") : "no pin"}: ${item.client} itself has the entry as ${keeps.length > 0 ? keeps.join(" ") : "not pinned"}. Register it again yourself with the pins it should have: ${inlineCommand(installCommand(item, context.platform))}`);
 			continue;
 		}
 		steps.push({
@@ -7803,7 +8044,8 @@ async function planRegistrations(context, candidates, request) {
 function updateChange(core, env, request = {}, deps = {}) {
 	const context = {
 		env,
-		core
+		core,
+		platform: deps.platform
 	};
 	let planned = null;
 	return {
@@ -7837,9 +8079,69 @@ function updateChange(core, env, request = {}, deps = {}) {
 			const result = await applyUpdate(context, planned, deps);
 			await recordFound(core, env, planned.report, deps, result);
 			return result;
+		},
+		refuseApproval: (approvalId) => {
+			if (planned === null) throw new CommsError("UNEXPECTED", "the update was refused before it was planned");
+			return nothingToApply(core, approvalId, planned);
 		}
 	};
 }
+/**
+* The refusal for an approval handed to an update with no step left in it (CUE-303).
+*
+* An update needs an approval only for its steps, so one with none takes no approval, and the general refusal said to
+* call again without it, as "it applies at once". An approval is prepared for an update while something is behind,
+* and it is usually claimed minutes later; meanwhile another session, or the person at a terminal, may have applied
+* the update. Then nothing is behind, calling again applies nothing, and "applies at once" read as an update about to
+* happen. So this says what is so: there is nothing to apply — nothing behind at all, or nothing that can be updated
+* from here — and the approval was not used, with what had become of it.
+*
+* The store is asked as it is. Its `get` answers null for an approval it does not have, and throws for anything else:
+* an id that is not one, a record it cannot read or parse. Every one of those was caught and said as "not used" with
+* nothing more, so a corrupt approval file or a permissions problem read as an approval that was simply not there.
+* Now a record that cannot be read goes up as itself, as it would from any other call that reads an approval, and an
+* id that is not one is said to be that.
+*/
+async function nothingToApply(core, approvalId, planned) {
+	if (!APPROVAL_ID_PATTERN.test(approvalId)) return new CommsError("USAGE", `nothing was changed: "${approvalId}" is not an approval id`, {
+		hint: "An approval id is the `approvalId` a call that needs approval returns, and nothing here needs one: a check — comms_update with `check`, or `agentcomms update --check` at a terminal — shows what is behind.",
+		details: { approvalId }
+	});
+	const record = await core.approvals.get(approvalId);
+	const unused = `so there is nothing to apply; the approval ${approvalId} was not used (${whatBecameOf(record)})`;
+	const details = {
+		approvalId,
+		...record ? { state: record.state } : {}
+	};
+	if (planned.nothingBehind) return new CommsError("USAGE", `nothing was changed: nothing is behind the latest release, ${unused}`, {
+		hint: "Nothing needs doing: a check — comms_update with `check`, or `agentcomms update --check` at a terminal — shows everything here up to date. A release published later is another update, with a preview and an approval of its own.",
+		details
+	});
+	return new CommsError("USAGE", `nothing was changed: what is behind cannot be updated from here, ${unused}`, {
+		hint: "Each is left for a person: a check — comms_update with `check`, or `agentcomms update --check` at a terminal — lists them, with why and what to run. The same call without the approval reports them too, and changes nothing.",
+		details
+	});
+}
+/**
+* What had become of an approval, for `nothingToApply`: none at all, or each state an approval can be in, by name.
+*
+* A record, so that a state added to the store is a type error here rather than a refusal that says nothing. The
+* send states are here too: any approval's id can be handed to an update, a send's among them, and this reads the
+* record before anything looks at its kind.
+*/
+function whatBecameOf(record) {
+	if (record === null) return "there is no approval by that id";
+	return {
+		pending: `it was still waiting to be approved, and lapses at ${record.expiresAt}`,
+		approved: `it had been approved, and lapses unspent at ${record.expiresAt}`,
+		sending: "it is an approval to send, and that send is under way",
+		used: "it had been spent already",
+		failed: "it had been spent on a send that failed",
+		unknown: "it had been spent on a send whose outcome was never recorded",
+		expired: `it had expired at ${record.expiresAt}`,
+		revoked: "it had been revoked"
+	}[record.state] ?? `it is ${JSON.stringify(record.state)}, a state this version does not know`;
+}
 /** The product a runtime of `packageName` is installed as: the channel whose package it is. */
 function runtimeProduct(packageName, version) {
 	const channel = CHANNELS.find((each) => channelServer(each).packageName === packageName);
@@ -8660,7 +8962,7 @@ function terminalUpdateHooks(core, env, options) {
 	};
 }
 //#endregion
-//#region ../core/dist/tool-arguments-CohGlMUZ.mjs
+//#region ../core/dist/tool-arguments-BMgRZ6DZ.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -19865,7 +20167,7 @@ function keyPermissionOf(account) {
 * wrong. Core's schema reads any mode word so that one odd account cannot make the whole file unreadable; acting on
 * one is refused here, as Slack refuses its own.
 */
-function checkedAccount(name, account) {
+function checkedAccount(name, account, platform = process.platform) {
 	const problem = (() => {
 		if (account.platform !== "resend") return `it is a ${account.platform} account`;
 		if (!MODES.includes(String(account.mode))) return `its mode is "${String(account.mode)}", and a Resend account is in read or send mode`;
@@ -19875,57 +20177,67 @@ function checkedAccount(name, account) {
 		if (lock !== void 0 && (typeof lock !== "string" || !DOMAIN.test(lock))) return "its domainLock is not a domain";
 		return null;
 	})();
-	if (problem !== null) throw new CommsError("CONFIG", `"${name}" is not a Resend account this release can act on: ${problem}`, { hint: `Remove it with \`agent-resend account remove ${name}\` and add it again, or fix it in the configuration file.` });
+	if (problem !== null) throw new CommsError("CONFIG", `"${name}" is not a Resend account this release can act on: ${problem}`, { hint: `Remove it with ${inlineCommand(shellCommand([
+		"agent-resend",
+		"account",
+		"remove",
+		name
+	], platform))} and add it again, or fix it in the configuration file.` });
 	return account;
 }
 function notFound(name) {
 	return () => new CommsError("NOT_FOUND", `there is no Resend account called "${name}"`, { hint: "List them with `agent-resend account list`; a person adds one with `agent-resend account add <org/resend>`." });
 }
 /** Every Resend account in `config`, checked, by name. */
-function resendAccounts(config) {
+function resendAccounts(config, platform = process.platform) {
 	return Object.entries(config.accounts).filter(([, account]) => account.platform === PLATFORM).map(([name, account]) => ({
 		name,
-		account: checkedAccount(name, account)
+		account: checkedAccount(name, account, platform)
 	})).sort((a, b) => a.name < b.name ? -1 : 1);
 }
 /**
 * The account by name, or a refusal that says what to do — through core's `resolveName`, so a name that was replaced
 * is refused with the one it has now rather than reported as unknown.
 */
-function requireAccount(config, name) {
+function requireAccount(config, name, platform = process.platform) {
 	const { alias, account } = resolveName(config, "account", name, notFound(name));
 	if (account.platform !== "resend") throw notFound(name)();
 	return {
 		name: alias,
-		account: checkedAccount(alias, account)
+		account: checkedAccount(alias, account, platform)
 	};
 }
 /** The account under exactly this name, or null: no former names, no refusal. */
-function lookupAccount(config, name) {
+function lookupAccount(config, name, platform = process.platform) {
 	const account = lookupName(config, "account", name);
 	if (!account || account.platform !== "resend") return null;
 	return {
 		name,
-		account: checkedAccount(name, account)
+		account: checkedAccount(name, account, platform)
 	};
 }
 /** The account by its immutable id, under whatever name it has now. */
-function accountById(config, id) {
+function accountById(config, id, platform = process.platform) {
 	const found = findById(config, "account", id);
 	if (!found || found.account.platform !== "resend") return null;
 	return {
 		name: found.alias,
-		account: checkedAccount(found.alias, found.account)
+		account: checkedAccount(found.alias, found.account, platform)
 	};
 }
 /**
 * Refuses a name a new account cannot take — core's rule, for either config version: the grammar and the platform,
 * free in both maps, and never a former name — with this package's own hint for one already connected.
 */
-function checkNewName(config, name) {
+function checkNewName(config, name, platform = process.platform) {
 	const check = nameAvailable(config, "account", name, PLATFORM);
 	if (check.ok) return;
-	if (lookupName(config, "account", name) || lookupName(config, "inbox", name)) throw new CommsError("USAGE", `there is already an account called "${name}"`, { hint: `Choose another name, or remove that one first with \`agent-resend account remove ${name}\`.` });
+	if (lookupName(config, "account", name) || lookupName(config, "inbox", name)) throw new CommsError("USAGE", `there is already an account called "${name}"`, { hint: `Choose another name, or remove that one first with ${inlineCommand(shellCommand([
+		"agent-resend",
+		"account",
+		"remove",
+		name
+	], platform))}.` });
 	throw check.error;
 }
 /** `config` with `account` under `name`. */
@@ -19961,20 +20273,22 @@ function changePolicyIn(config, account) {
 */
 var AccountStore = class {
 	#load;
-	constructor(load) {
+	#platform;
+	constructor(load, platform = process.platform) {
 		this.#load = load;
+		this.#platform = platform;
 	}
 	async list() {
-		return resendAccounts(await this.#load());
+		return resendAccounts(await this.#load(), this.#platform);
 	}
 	async find(name) {
-		return lookupAccount(await this.#load(), name);
+		return lookupAccount(await this.#load(), name, this.#platform);
 	}
 	async findById(id) {
-		return accountById(await this.#load(), id);
+		return accountById(await this.#load(), id, this.#platform);
 	}
 	async require(name) {
-		return requireAccount(await this.#load(), name);
+		return requireAccount(await this.#load(), name, this.#platform);
 	}
 };
 var Throttle = class {
@@ -19982,12 +20296,38 @@ var Throttle = class {
 	#now;
 	#sleep;
 	#interval;
+	/**
+	* Five seconds **for each holder** of the lock, not for the whole line of callers ahead.
+	*
+	* Every Resend request on this machine takes this one lock, and an agent asking six accounts at once puts six
+	* callers on it at the same moment. With the timeout counted from when each began to wait, the sixth had to see
+	* five holders through inside one five-second budget; on a heavily loaded machine (a load of 97 on ten cores, in
+	* the pre-push run that showed it) the read and the fsynced write under the lock slow down with everything else,
+	* and it gave up with "another process is holding" while the lock was being handed on exactly as it should be. A
+	* person with several accounts and a busy machine would have had requests refused for no reason but the queue.
+	* Counted per holder, a caller gives up only once one holder has kept the lock for five seconds: the stuck lock
+	* the timeout is there for.
+	*
+	* Each request takes the lock once, to reserve its slot, and does its waiting outside it, so the line is only the
+	* requests in flight. But the lock is polled, not queued: whoever looks first after a release takes it, and a
+	* request that keeps looking at the wrong moment watches later ones go ahead of it, for as long as later ones keep
+	* arriving — and several servers each paging through sent mail keep them arriving. So the wait also has an end
+	* that no hand-over moves, `LOCK_MAX_WAIT_MS`, and past it the request is refused as a busy lock rather than left
+	* hanging. `after` waits the same way, because a stop it gave up on recording is a 429 that every other account
+	* carries on into.
+	*/
+	#lock;
 	/** Takes no account on purpose: see above. Every throttle on a state directory is the same one. */
 	constructor(stateDir, options = {}) {
 		this.path = join(stateDir, "resend", "throttle.json");
 		this.#now = options.now ?? Date.now;
 		this.#sleep = options.sleep ?? ((ms) => setTimeout$1(ms).then(() => void 0));
 		this.#interval = options.intervalMs ?? 500;
+		this.#lock = {
+			timeoutPerHolder: true,
+			maxWaitMs: options.lockMaxWaitMs ?? 3e4,
+			...options.lockTimeoutMs === void 0 ? {} : { timeoutMs: options.lockTimeoutMs }
+		};
 	}
 	async #read() {
 		try {
@@ -20004,6 +20344,10 @@ var Throttle = class {
 			throw error;
 		}
 	}
+	/** Runs `fn` holding the machine's one throttle lock, waiting for it as `#lock` says. */
+	#locked(fn) {
+		return withFileLock(`${this.path}.lock`, fn, this.#lock);
+	}
 	/** When Resend will next be asked anything from this machine, or null when it is not holding off. */
 	async blockedUntil() {
 		const state = await this.#read();
@@ -20031,7 +20375,7 @@ var Throttle = class {
 	* later.
 	*/
 	async before() {
-		const wait = await withFileLock(`${this.path}.lock`, async () => {
+		const wait = await this.#locked(async () => {
 			const state = await this.#read();
 			this.#refuseIfHeld(state);
 			const now = this.#now();
@@ -20062,7 +20406,7 @@ var Throttle = class {
 		else if (seconds("ratelimit-remaining") === 0) stopFor = seconds("ratelimit-reset") ?? 1;
 		if (stopFor === null) return null;
 		const until = this.#now() + Math.max(1, stopFor) * 1e3;
-		await withFileLock(`${this.path}.lock`, async () => {
+		await this.#locked(async () => {
 			const state = await this.#read();
 			await writeFileAtomic(this.path, JSON.stringify({
 				...state,
@@ -20079,6 +20423,7 @@ var ResendContext = class {
 	core;
 	env;
 	now;
+	platform;
 	surface;
 	accounts;
 	#fetch;
@@ -20088,8 +20433,9 @@ var ResendContext = class {
 		this.env = options.env ?? process.env;
 		this.core = options.core ?? openCore({ env: this.env });
 		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+		this.platform = options.platform ?? process.platform;
 		this.surface = options.surface ?? "cli";
-		this.accounts = new AccountStore(() => this.core.config.load());
+		this.accounts = new AccountStore(() => this.core.config.load(), this.platform);
 		this.#fetch = options.fetch;
 		this.#throttle = new Throttle(this.core.paths.stateDir, options.throttle);
 	}
@@ -20138,7 +20484,12 @@ var ResendContext = class {
 	/** A transport for a connected account: its key from the secret store, the machine's throttle, and any open permit. */
 	async transport(named, permit) {
 		const key = await (await this.secrets()).get(named.account.secretRef);
-		if (key === null || key.trim() === "") throw new CommsError("AUTH_REQUIRED", `the key for "${named.name}" is not in the secret store`, { hint: `A person removes the account and adds it again: \`agent-resend account add ${named.name}\`.` });
+		if (key === null || key.trim() === "") throw new CommsError("AUTH_REQUIRED", `the key for "${named.name}" is not in the secret store`, { hint: `A person removes the account and adds it again: ${inlineCommand(shellCommand([
+			"agent-resend",
+			"account",
+			"add",
+			named.name
+		], this.platform))}.` });
 		return {
 			fetch: this.#fetch,
 			key,
@@ -20286,15 +20637,17 @@ function codeFor(status, name) {
 		message: "Resend refused the request"
 	};
 }
-/**
-* Whether a failed write can have taken effect.
-*
-* A 4xx is Resend refusing to act — except 409, which means another request with this idempotency key exists or is
-* in flight, so something may already have gone. A 5xx, a timeout or a dropped connection says nothing either way.
-*/
-function outcomeOf(status) {
-	if (status === void 0) return "unknown";
-	return status >= 400 && status < 500 && status !== 409 && status !== 408 ? "not-sent" : "unknown";
+const REFUSED_BEFORE_ACTING = /* @__PURE__ */ new Set([
+	400,
+	401,
+	403,
+	404,
+	422,
+	429
+]);
+/** Whether a failed write can have taken effect. */
+function writeOutcomeOf(status) {
+	return status !== void 0 && REFUSED_BEFORE_ACTING.has(status) ? "not-sent" : "unknown";
 }
 /** One API request. Resolves to the parsed JSON body of a 2xx, or throws a `CommsError` whose text holds no key. */
 async function resendRequest(transport, method, path, options = {}) {
@@ -20367,7 +20720,7 @@ async function resendRequest(transport, method, path, options = {}) {
 			resendError: name,
 			stage: "http",
 			...stopFor !== null ? { retryAfterSeconds: stopFor } : {},
-			...writing ? { outcome: outcomeOf(response.status) } : {}
+			...writing ? { outcome: writeOutcomeOf(response.status) } : {}
 		}
 	});
 }
@@ -20713,11 +21066,11 @@ function viewOf(named, config) {
 }
 async function listAccounts(context) {
 	const config = await context.config();
-	return { accounts: resendAccounts(config).map((named) => viewOf(named, config)) };
+	return { accounts: resendAccounts(config, context.platform).map((named) => viewOf(named, config)) };
 }
 async function showAccount(context, name) {
 	const config = await context.config();
-	return viewOf(requireAccount(config, name), config);
+	return viewOf(requireAccount(config, name, context.platform), config);
 }
 /** A mode word checked by the operation, so both surfaces refuse it in the same words. */
 function modeOf(raw) {
@@ -20736,8 +21089,8 @@ function changePolicyOf(raw) {
 	throw new CommsError("USAGE", `"${String(raw)}" is not a change policy: use chat or confirm`);
 }
 /** Refuses a key that is already connected, under any name: one key, one account. */
-function refuseConnectedKey(config, fingerprint) {
-	const same = resendAccounts(config).find((named) => named.account.workspace === fingerprint);
+function refuseConnectedKey(config, fingerprint, platform) {
+	const same = resendAccounts(config, platform).find((named) => named.account.workspace === fingerprint);
 	if (same) throw new CommsError("USAGE", `this key is already connected as "${same.name}"`, { hint: "One key, one account. Change that one with `agent-resend account policy`." });
 }
 /**
@@ -20772,8 +21125,8 @@ function addAccountChange(context, request, inspection) {
 		...domainLock ? { domainLock } : {}
 	};
 	const connect = (config) => {
-		checkNewName(config, request.name);
-		refuseConnectedKey(config, fingerprint);
+		checkNewName(config, request.name, context.platform);
+		refuseConnectedKey(config, fingerprint, context.platform);
 		return withAccount(config, request.name, account);
 	};
 	return {
@@ -20789,7 +21142,7 @@ function addAccountChange(context, request, inspection) {
 			};
 		},
 		apply: async (consent) => {
-			const { store, choosing } = secretsStoreFor(await context.config(), void 0);
+			const { store, choosing } = secretsStoreFor(await context.config(), void 0, context.platform);
 			const secrets = await context.core.secrets(store);
 			await secrets.set(account.secretRef, request.key.trim());
 			let written;
@@ -20830,7 +21183,7 @@ function addAccountChange(context, request, inspection) {
 function removeAccountChange(context, name) {
 	return {
 		plan: (config) => {
-			const found = requireAccount(config, name);
+			const found = requireAccount(config, name, context.platform);
 			return {
 				account: found.name,
 				before: config,
@@ -20840,15 +21193,25 @@ function removeAccountChange(context, name) {
 			};
 		},
 		apply: async (_consent, request) => {
-			const approved = requireAccount(request.before, name).account;
+			const approved = requireAccount(request.before, name, context.platform).account;
 			const removed = await withCredentialsLock(context.core.paths.configDir, async () => {
-				const found = requireAccount(await context.config(), name);
-				if (found.account.id !== approved.id) throw new CommsError("CONFIG", `"${name}" changed after its removal was approved, so nothing was removed`, { hint: `Look at it with \`agent-resend account show ${name}\`, and remove it again if you still want it gone.` });
+				const found = requireAccount(await context.config(), name, context.platform);
+				if (found.account.id !== approved.id) throw new CommsError("CONFIG", `"${name}" changed after its removal was approved, so nothing was removed`, { hint: `Look at it with ${inlineCommand(shellCommand([
+					"agent-resend",
+					"account",
+					"show",
+					name
+				], context.platform))}, and remove it again if you still want it gone.` });
 				const secrets = await context.secrets();
 				await secrets.delete(found.account.secretRef).catch(() => false);
 				await context.core.config.update((current) => {
-					if (secretsStoreOf(current) !== secrets.kind) throw new CommsError("TRANSIENT", `the secret store changed while "${name}" was being removed`, { hint: `Run \`agent-resend account remove ${name}\` again.` });
-					const held = accountById(current, found.account.id);
+					if (secretsStoreOf(current) !== secrets.kind) throw new CommsError("TRANSIENT", `the secret store changed while "${name}" was being removed`, { hint: `Run ${inlineCommand(shellCommand([
+						"agent-resend",
+						"account",
+						"remove",
+						name
+					], context.platform))} again.` });
+					const held = accountById(current, found.account.id, context.platform);
 					if (!held) return current;
 					return withoutAccount(current, held.name);
 				});
@@ -20900,7 +21263,7 @@ function reportOf(named, config) {
 }
 async function policyReport(context, name) {
 	const config = await context.config();
-	return reportOf(requireAccount(config, name), config);
+	return reportOf(requireAccount(config, name, context.platform), config);
 }
 /**
 * Why a policy report refuses the approval it is handed, in the words of the surface it came from, as core's
@@ -20942,7 +21305,7 @@ function policyChange(context, name, wanted) {
 	].filter(Boolean).join(", ");
 	return {
 		plan: (config) => {
-			const found = checked(requireAccount(config, name));
+			const found = checked(requireAccount(config, name, context.platform));
 			return {
 				account: found.name,
 				before: config,
@@ -20951,10 +21314,10 @@ function policyChange(context, name, wanted) {
 			};
 		},
 		apply: async (consent, request) => {
-			const approved = requireAccount(request.before, name).account;
+			const approved = requireAccount(request.before, name, context.platform).account;
 			let written;
 			const config = await context.core.config.update((current) => {
-				const held = accountById(current, approved.id);
+				const held = accountById(current, approved.id, context.platform);
 				if (!held) throw new CommsError("CONFIG", `"${name}" changed while its policy was being set, so nothing was set`, { hint: "Check it with `agent-resend account list`, then set the policy again." });
 				written = {
 					name: held.name,
@@ -21001,7 +21364,17 @@ async function checkAccount(context, named, offline) {
 			name: "key stored",
 			ok: false,
 			detail: "the key is missing from the secret store",
-			fix: `agent-resend account remove ${named.name}, then agent-resend account add ${named.name}`
+			fix: `${commandText(shellCommand([
+				"agent-resend",
+				"account",
+				"remove",
+				named.name
+			], context.platform))}, then ${commandText(shellCommand([
+				"agent-resend",
+				"account",
+				"add",
+				named.name
+			], context.platform))}`
 		});
 	} catch (error) {
 		checks.push({
@@ -22048,8 +22421,15 @@ async function ownRecord(context, named, approvalId) {
 	if (!record || approvalKind(record) !== "send" || record.inboxId !== named.account.id) throw new CommsError("NOT_FOUND", `there is no send approval ${approvalId} for "${named.name}"`, { hint: "Approvals last ten minutes. Prepare the send again." });
 	return record;
 }
-function requireSendMode(named) {
-	if (named.account.mode !== "send") throw new CommsError("SCOPE_MISSING", `"${named.name}" is in read mode, so it sends nothing`, { hint: `A person can allow sending with \`agent-resend account policy ${named.name} --mode send\`, which is a change they approve.` });
+function requireSendMode(named, platform) {
+	if (named.account.mode !== "send") throw new CommsError("SCOPE_MISSING", `"${named.name}" is in read mode, so it sends nothing`, { hint: `A person can allow sending with ${inlineCommand(shellCommand([
+		"agent-resend",
+		"account",
+		"policy",
+		named.name,
+		"--mode",
+		"send"
+	], platform))}, which is a change they approve.` });
 }
 /**
 * Whether the From domain may send, checked before an approval exists.
@@ -22116,8 +22496,12 @@ function expectationOf(message) {
 		subject: message.subject
 	};
 }
-function describePolicy(effective, approvalId, flags) {
-	if (effective === "confirm") return `Policy: confirm${flags.length > 0 ? ` (${flags.join(", ")})` : ""} — a person runs \`agent-resend approve ${approvalId}\` at their own terminal before this can go.`;
+function describePolicy(effective, approvalId, flags, platform) {
+	if (effective === "confirm") return `Policy: confirm${flags.length > 0 ? ` (${flags.join(", ")})` : ""} — a person runs ${inlineCommand(shellCommand([
+		"agent-resend",
+		"approve",
+		approvalId
+	], platform))} at their own terminal before this can go.`;
 	return "Policy: chat — send only after the user approves this exact preview.";
 }
 function previewOf(options) {
@@ -22155,7 +22539,7 @@ function previewOf(options) {
 		thread: message.inReplyTo ? `reply to ${message.inReplyTo}${message.references.length > 1 ? ` (${message.references.length} references)` : ""}` : void 0,
 		links: options.built.links,
 		warnings,
-		policy: describePolicy(options.effective, options.approvalId, options.flags)
+		policy: describePolicy(options.effective, options.approvalId, options.flags, options.platform)
 	});
 }
 async function attachPolicy(context) {
@@ -22173,10 +22557,17 @@ async function attachPolicy(context) {
 */
 async function prepareSend(context, name, input) {
 	const named = await context.accounts.require(name);
-	requireSendMode(named);
+	requireSendMode(named, context.platform);
 	const config = await context.config();
 	const livePolicy = named.account.sendPolicy ?? config.defaults.sendPolicy;
-	if (livePolicy === "never") throw new CommsError("POLICY_NEVER", `sending from ${name} is turned off (policy: never)`, { hint: `A person can change it with \`agent-resend account policy ${name} --send confirm\`.` });
+	if (livePolicy === "never") throw new CommsError("POLICY_NEVER", `sending from ${name} is turned off (policy: never)`, { hint: `A person can change it with ${inlineCommand(shellCommand([
+		"agent-resend",
+		"account",
+		"policy",
+		name,
+		"--send",
+		"confirm"
+	], context.platform))}.` });
 	const built = await buildMessage(input, {
 		now: context.now(),
 		attach: await attachPolicy(context)
@@ -22228,7 +22619,8 @@ async function prepareSend(context, name, input) {
 			study,
 			domainNote,
 			effective,
-			flags: study.flags
+			flags: study.flags,
+			platform: context.platform
 		}),
 		policy: livePolicy,
 		effectivePolicy: effective,
@@ -22236,7 +22628,11 @@ async function prepareSend(context, name, input) {
 		reach,
 		expect: record.expect,
 		expiresAt: record.expiresAt,
-		nextStep: effective === "confirm" ? `Show the preview to the user, then have them run \`agent-resend approve ${record.approvalId}\` in their own terminal. You cannot approve this yourself. Then execute it with the same approval id and the recipients and subject shown.` : "Show the preview to the user verbatim and wait for an explicit yes. Then execute it with the same approval id and the recipients and subject shown above."
+		nextStep: effective === "confirm" ? `Show the preview to the user, then have them run ${inlineCommand(shellCommand([
+			"agent-resend",
+			"approve",
+			record.approvalId
+		], context.platform))} in their own terminal. You cannot approve this yourself. Then execute it with the same approval id and the recipients and subject shown.` : "Show the preview to the user verbatim and wait for an explicit yes. Then execute it with the same approval id and the recipients and subject shown above."
 	};
 }
 /** The stored message and its attachments' bytes, checked again: a file changed since the preview voids the send. */
@@ -22299,13 +22695,64 @@ function describeState(state) {
 	switch (state) {
 		case "used": return "this approval has already been used — the email was sent once, and is not sent again";
 		case "sending": return "this approval is being sent by another process right now";
-		case "failed": return "the send under this approval failed or its outcome is unknown; it is never sent again under it";
+		case "failed": return "the send under this approval was refused; nothing was sent";
 		case "unknown": return "a process stopped mid-send under this approval; whether the email went is not known";
 		case "expired": return "this approval has expired";
 		case "revoked": return "this approval was cancelled or voided";
 		default: return `this approval is ${state}`;
 	}
 }
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** Keeps the failure that stopped the send visible, adding only what could not be settled afterwards. */
+function noSendError(error, unrecorded) {
+	const original = error instanceof CommsError ? error : new CommsError("UNEXPECTED", messageOf(error), { cause: error });
+	const hint = [original.hint, ...unrecorded].filter((part) => part !== void 0);
+	return new CommsError(original.code, original.message, {
+		...hint.length === 0 ? {} : { hint: hint.join(" ") },
+		...original.details === void 0 ? {} : { details: original.details },
+		cause: error
+	});
+}
+/** Settles a failure known to have happened before Resend sent anything, without one failed write skipping another. */
+async function recordNoSend(context, records, options, error) {
+	const unrecorded = [];
+	const said = messageOf(error);
+	try {
+		await records.release(options.accountId, options.approvalId);
+	} catch (failure) {
+		unrecorded.push(`the capacity slot could not be released (${messageOf(failure)})`);
+	}
+	try {
+		await context.core.approvals.complete(options.approvalId, { error: said });
+	} catch (failure) {
+		unrecorded.push(`the approval could not be marked failed (${messageOf(failure)})`);
+	}
+	try {
+		await records.record(options.accountId, {
+			approvalId: options.approvalId,
+			event: "failed",
+			error: said.slice(0, 300)
+		});
+	} catch (failure) {
+		unrecorded.push(`the send record could not record the failure (${messageOf(failure)})`);
+	}
+	try {
+		await context.core.audit.append({
+			inboxId: options.accountId,
+			alias: options.name,
+			operation: "resend.send.execute",
+			outcome: "failed",
+			surface: context.surface,
+			approvalId: options.approvalId,
+			reason: [said.slice(0, 200), ...unrecorded].join("; ")
+		});
+	} catch (failure) {
+		unrecorded.push(`the audit log could not record the failure (${messageOf(failure)})`);
+	}
+	return noSendError(error, unrecorded);
+}
 /**
 * Step three, and the only place mail leaves.
 *
@@ -22314,10 +22761,17 @@ function describeState(state) {
 */
 async function executeSend(context, name, options) {
 	const named = await context.accounts.require(name);
-	requireSendMode(named);
+	requireSendMode(named, context.platform);
 	const known = await ownRecord(context, named, options.approvalId);
 	if (known.state !== "pending" && known.state !== "approved") throw new CommsError("APPROVAL_VOID", `nothing was sent: ${describeState(known.state)}`, {
-		hint: known.state === "failed" || known.state === "unknown" ? `Check what happened with \`agent-resend send status ${options.approvalId} --account ${name}\` before anything else.` : "Prepare the send again if it should still go.",
+		hint: known.state === "unknown" ? `Check what happened with ${inlineCommand(shellCommand([
+			"agent-resend",
+			"send",
+			"status",
+			options.approvalId,
+			"--account",
+			name
+		], context.platform))} before anything else.` : "Prepare the send again if it should still go.",
 		details: {
 			approvalId: options.approvalId,
 			state: known.state
@@ -22340,89 +22794,143 @@ async function executeSend(context, name, options) {
 		inboxSub: named.account.userId,
 		policy: livePolicy,
 		expect: options.expect
-	}, { pendingHint: `Ask the user to run \`agent-resend approve ${options.approvalId}\` in their own terminal, then execute it again with the same approval. You cannot approve it yourself.` });
+	}, {
+		pendingHint: `Ask the user to run ${inlineCommand(shellCommand([
+			"agent-resend",
+			"approve",
+			options.approvalId
+		], context.platform))} in their own terminal, then execute it again with the same approval. You cannot approve it yourself.`,
+		platform: context.platform
+	});
 	const records = new SendRecords(context.core.paths.stateDir, context.now);
 	const message = prepared.message;
 	const recipients = uniqueRecipients(message);
+	const bookkeeping = {
+		name,
+		accountId: named.account.id,
+		approvalId: options.approvalId
+	};
 	try {
 		await records.reserve(named.account.id, options.approvalId, config.defaults.sendCaps);
 	} catch (error) {
-		await context.core.approvals.complete(options.approvalId, { error: "rate capped" });
-		throw error;
+		throw await recordNoSend(context, records, bookkeeping, error);
+	}
+	try {
+		await records.record(named.account.id, {
+			approvalId: options.approvalId,
+			event: "attempt",
+			recipients,
+			subject: message.subject,
+			scheduledAt: message.scheduledAt
+		});
+		await context.core.audit.append({
+			inboxId: named.account.id,
+			alias: name,
+			operation: "resend.send.execute",
+			outcome: "started",
+			surface: context.surface,
+			approvalId: options.approvalId,
+			recipients: recipients.map(canonicalAddress)
+		}, { durable: true });
+	} catch (error) {
+		throw await recordNoSend(context, records, bookkeeping, error);
 	}
-	await records.record(named.account.id, {
-		approvalId: options.approvalId,
-		event: "attempt",
-		recipients,
-		subject: message.subject,
-		scheduledAt: message.scheduledAt
-	});
-	await context.core.audit.append({
-		inboxId: named.account.id,
-		alias: name,
-		operation: "resend.send.execute",
-		outcome: "started",
-		surface: context.surface,
-		approvalId: options.approvalId,
-		recipients: recipients.map(canonicalAddress)
-	}, { durable: true });
 	let resendId;
+	let requestIssued = false;
+	const innerFetch = transport.fetch ?? fetch;
+	const trackedTransport = {
+		...transport,
+		fetch: async (...args) => {
+			requestIssued = true;
+			return innerFetch(...args);
+		}
+	};
 	try {
-		const response = await spendOn(permit, options.approvalId, "emails.send", () => resendRequest(transport, "POST", "/emails", {
+		const response = await spendOn(permit, options.approvalId, "emails.send", () => resendRequest(trackedTransport, "POST", "/emails", {
 			body: payloadOf(message, options.approvalId, contents),
 			idempotencyKey: options.approvalId
 		}));
 		if (typeof response.id !== "string" || response.id === "") throw new CommsError("PROVIDER_UNAVAILABLE", "Resend accepted the send but returned no email id", { details: { outcome: "unknown" } });
 		resendId = response.id;
 	} catch (error) {
+		if (!requestIssued) throw await recordNoSend(context, records, bookkeeping, error);
 		const outcome = error instanceof CommsError && error.details?.outcome === "not-sent" ? "not-sent" : error instanceof CommsError && error.code === "SEND_REFUSED" ? "not-sent" : "unknown";
 		const said = error instanceof Error ? error.message : String(error);
-		await context.core.approvals.complete(options.approvalId, { error: outcome === "unknown" ? `outcome unknown: ${said}` : said });
-		if (outcome === "not-sent") await records.release(named.account.id, options.approvalId);
+		if (outcome === "not-sent") throw await recordNoSend(context, records, bookkeeping, error);
+		const unrecorded = [];
+		try {
+			await records.record(named.account.id, {
+				approvalId: options.approvalId,
+				event: "unknown",
+				error: said.slice(0, 300)
+			});
+		} catch (failure) {
+			unrecorded.push(`the send record could not record this (${failure instanceof Error ? failure.message : String(failure)})`);
+		}
+		try {
+			await context.core.audit.append({
+				inboxId: named.account.id,
+				alias: name,
+				operation: "resend.send.execute",
+				outcome: "failed",
+				surface: context.surface,
+				approvalId: options.approvalId,
+				reason: `outcome unknown: ${said.slice(0, 200)}`
+			});
+		} catch (failure) {
+			unrecorded.push(`the audit log could not record this (${failure instanceof Error ? failure.message : String(failure)})`);
+		}
+		throw new CommsError("TRANSIENT", `whether the email was sent is not known: ${said}`, {
+			hint: [`Do not send it again. Check the Resend dashboard or ask the recipient, and check with ${inlineCommand(shellCommand([
+				"agent-resend",
+				"send",
+				"status",
+				options.approvalId,
+				"--account",
+				name
+			], context.platform))}; this approval is not used again.`, ...unrecorded].join(" "),
+			details: {
+				...error instanceof CommsError ? error.details : {},
+				approvalId: options.approvalId,
+				outcome: "unknown"
+			},
+			cause: error
+		});
+	}
+	const unrecorded = [];
+	try {
+		await context.core.approvals.complete(options.approvalId, { sentMessageId: resendId });
+	} catch (error) {
+		unrecorded.push(`the approval could not be marked used (${error instanceof Error ? error.message : String(error)}), so it will read as unknown`);
+	}
+	try {
 		await records.record(named.account.id, {
 			approvalId: options.approvalId,
-			event: outcome === "unknown" ? "unknown" : "failed",
-			error: said.slice(0, 300)
+			event: "sent",
+			resendId
 		});
+	} catch (error) {
+		unrecorded.push(`the send record could not record it (${error instanceof Error ? error.message : String(error)})`);
+	}
+	try {
 		await context.core.audit.append({
 			inboxId: named.account.id,
 			alias: name,
 			operation: "resend.send.execute",
-			outcome: "failed",
+			outcome: "ok",
 			surface: context.surface,
 			approvalId: options.approvalId,
-			reason: outcome === "unknown" ? `outcome unknown: ${said.slice(0, 200)}` : said.slice(0, 200)
+			ids: { resendIds: [resendId] },
+			recipients: [
+				...claimed.expect.to,
+				...claimed.expect.cc,
+				...claimed.expect.bcc
+			].map(canonicalAddress),
+			reason: [`digest ${digest.slice(0, 12)} · policy ${livePolicy} · ${claimed.approvedVia ?? "chat"}`, ...unrecorded].join(" · ")
 		});
-		if (outcome === "unknown") throw new CommsError("TRANSIENT", `whether the email was sent is not known: ${said}`, {
-			hint: `Do not send it again. Check with \`agent-resend send status ${options.approvalId} --account ${name}\`; Resend would also refuse a repeat under this approval for 24 hours.`,
-			details: {
-				approvalId: options.approvalId,
-				outcome: "unknown"
-			}
-		});
-		throw error;
+	} catch (error) {
+		unrecorded.push(`the audit log could not record it (${error instanceof Error ? error.message : String(error)})`);
 	}
-	await context.core.approvals.complete(options.approvalId, { sentMessageId: resendId });
-	await records.record(named.account.id, {
-		approvalId: options.approvalId,
-		event: "sent",
-		resendId
-	});
-	await context.core.audit.append({
-		inboxId: named.account.id,
-		alias: name,
-		operation: "resend.send.execute",
-		outcome: "ok",
-		surface: context.surface,
-		approvalId: options.approvalId,
-		ids: { resendIds: [resendId] },
-		recipients: [
-			...claimed.expect.to,
-			...claimed.expect.cc,
-			...claimed.expect.bcc
-		].map(canonicalAddress),
-		reason: `digest ${digest.slice(0, 12)} · policy ${livePolicy} · ${claimed.approvedVia ?? "chat"}`
-	});
 	return {
 		account: name,
 		approvalId: options.approvalId,
@@ -22432,7 +22940,8 @@ async function executeSend(context, name, options) {
 		to: claimed.expect.to,
 		cc: claimed.expect.cc,
 		bcc: claimed.expect.bcc,
-		subject: claimed.expect.subject
+		subject: claimed.expect.subject,
+		...unrecorded.length > 0 ? { note: unrecorded.join("; ") } : {}
 	};
 }
 /**
@@ -22528,7 +23037,7 @@ async function beginSendApproval(context, approvalId) {
 	const config = await context.config();
 	const study = await studyRecipients(context, named, prepared.message, config.defaults.riskEscalation);
 	const effective = stricterPolicy(named.account.sendPolicy ?? config.defaults.sendPolicy, record.requiredPolicy);
-	const challenge = await context.core.approvals.issueChallenge(approvalId);
+	const challenge = await context.core.approvals.issueChallenge(approvalId, "send", context.platform);
 	return {
 		approvalId,
 		account: named.name,
@@ -22543,7 +23052,8 @@ async function beginSendApproval(context, approvalId) {
 			study,
 			domainNote: prepared.warnings[0] ?? "",
 			effective,
-			flags: record.riskFlags
+			flags: record.riskFlags,
+			platform: context.platform
 		}),
 		challenge
 	};
@@ -22554,7 +23064,7 @@ async function finishSendApproval(context, approvalId, answer) {
 	const approved = await context.core.approvals.approve(approvalId, "terminal", {
 		draftMessageId: digest,
 		digest
-	}, answer);
+	}, answer, "send", context.platform);
 	await context.core.audit.append({
 		inboxId: named.account.id,
 		alias: named.name,
@@ -22580,4 +23090,4 @@ async function revokeSendApproval(context, approvalId) {
 	});
 }
 //#endregion
-export { installExitStatus as $, CHANGE_POLICIES as A, agentMarker as B, policyChange as C, sendPolicyOf as D, removeAccountChange as E, CHANNEL_SERVERS as F, changeToolResult as G, approvalsOf as H, CommsError as I, commandPathOf as J, checkForUpdates as K, EXIT_CODES as L, SEND_POLICIES as M, checkNewName as N, showAccount as O, strictToolArguments as P, gatedChangeAtTerminal as Q, SEND_LOOKUP as R, policyApprovalRefusal as S, policyWanted as T, approveChangeAtTerminal as U, approvalKind as V, canPrompt as W, exemptFromUpdateGate as X, escapeForDisplay as Y, gatedChange as Z, runDoctor as _, RESEND_DOWNLOAD_ORIGIN as _t, revokeSendApproval as a, runCommand as at, listAccounts as b, downloadReceived as c, serverPruneChange as ct, listReceived as d, truncateDisplay as dt, openCore as et, listScheduled as f, updateGateAtTerminal as ft, showSentEmail as g, RESEND_API_ORIGIN as gt, showReceived as h, REFUSED as ht, prepareSend as i, renderPrune as it, MODES as j, ResendContext as k, getMetrics as l, terminalUpdateHooks as lt, listSuppressions as m, writeResult as mt, executeSend as n, refuseUnclaimedApproval as nt, sendStatus as o, runUpdateCheckChild as ot, listSentEmails as p, updateToolGate as pt, colorEnabled as q, finishSendApproval as r, renderInstall as rt, cancelScheduledChange as s, serverInstallChange as st, beginSendApproval as t, paint as tt, listDomains as u, toCommsError as ut, addAccountChange as v, ROUTES as vt, policyReport as w, modeOf as x, inspectKey as y, VERSION$1 as yt, UPDATE_CHECK_CHILD_COMMAND as z };
+export { inlineCommand as $, CHANGE_POLICIES as A, agentMarker as B, policyChange as C, sendPolicyOf as D, removeAccountChange as E, CHANNEL_SERVERS as F, changeToolResult as G, approvalsOf as H, CommsError as I, commandPathOf as J, checkForUpdates as K, EXIT_CODES as L, SEND_POLICIES as M, checkNewName as N, showAccount as O, strictToolArguments as P, gatedChangeAtTerminal as Q, SEND_LOOKUP as R, policyApprovalRefusal as S, policyWanted as T, approveChangeAtTerminal as U, approvalKind as V, canPrompt as W, exemptFromUpdateGate as X, escapeForDisplay as Y, gatedChange as Z, runDoctor as _, REFUSED as _t, revokeSendApproval as a, renderPrune as at, listAccounts as b, ROUTES as bt, downloadReceived as c, serverInstallChange as ct, listReceived as d, terminalUpdateHooks as dt, installExitStatus as et, listScheduled as f, toCommsError as ft, showSentEmail as g, writeResult as gt, showReceived as h, updateToolGate as ht, prepareSend as i, renderInstall as it, MODES as j, ResendContext as k, getMetrics as l, serverPruneChange as lt, listSuppressions as m, updateGateAtTerminal as mt, executeSend as n, paint as nt, sendStatus as o, runCommand as ot, listSentEmails as p, truncateDisplay as pt, colorEnabled as q, finishSendApproval as r, refuseUnclaimedApproval as rt, cancelScheduledChange as s, runUpdateCheckChild as st, beginSendApproval as t, openCore as tt, listDomains as u, shellCommand as ut, addAccountChange as v, RESEND_API_ORIGIN as vt, policyReport as w, modeOf as x, VERSION$1 as xt, inspectKey as y, RESEND_DOWNLOAD_ORIGIN as yt, UPDATE_CHECK_CHILD_COMMAND as z };