@agentcomms/resend 0.13.0 → 0.13.1

package/dist/{send-D2ZOWO_6.mjs → send-DtBNDnE4.mjs}

@@ -4,15 +4,15 @@ import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { homedir, platform, userInfo } from "node:os";
 import "node:readline/promises";
 import { styleText } from "node:util";
-import { homedir, platform, userInfo } from "node:os";
-import { constants as constants$1, realpathSync } from "node:fs";
+import { accessSync, constants as constants$1, readFileSync, realpathSync, statSync } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.13.0";
+const VERSION$1 = "0.13.1";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -187,7 +187,21 @@ function refusedBecause(method, pathname) {
 	return null;
 }
 //#endregion
-//#region ../core/dist/update-check-C8sNjCez.mjs
+//#region src/caller.ts
+/** This package's name, as its manifest has it: what core checks a caller against. */
+const PACKAGE_NAME = "@agentcomms/resend";
+/**
+* This package as core's caller (CUE-403; CONTRIBUTING.md, "Telling a person what to run"): one of its own modules and
+* its name, so every command it prints for a person runs this installation, with its folders pinned. Its CLI and its
+* server open core with it, and nothing else does. Bundled, this module is part of the bundle's file — still inside
+* this package — so the check that the caller is this package holds in the published build as in a checkout.
+*/
+const RESEND_CALLER = Object.freeze({
+	url: import.meta.url,
+	packageName: PACKAGE_NAME
+});
+//#endregion
+//#region ../core/dist/update-check-BPwwmUCi.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -1049,7 +1063,7 @@ const CHANNEL_SNAPSHOT = [
 				guarantee: {
 					ceiling: "code",
 					floor: "code",
-					why: "Resend has no read-only key, and a full-access key can also manage domains and keys: read mode, and send mode's limit to sending, are enforced by agent-resend's own code. A sending-access key can only send, and Resend enforces that."
+					why: "Resend has no read-only key, and a full-access key can also manage domains and keys: read mode, and send mode's limit to sending, are enforced by this package's own code. A sending-access key can only send, and Resend enforces that."
 				}
 			},
 			narrowing: [{
@@ -1169,25 +1183,6 @@ function manifestOf(channel) {
 function accountChannels() {
 	return MANIFESTS.filter((manifest) => manifest.accounts !== void 0);
 }
-/**
-* Words as a list a person reads: `a`, `a or b`, `a, b or c` — with `oxford`, `a, b, or c` once there are three.
-*/
-function listed(words, conjunction, options = {}) {
-	if (words.length <= 1) return words.join("");
-	const last = words.at(-1);
-	const rest = words.slice(0, -1);
-	return `${rest.join(", ")}${options.oxford && rest.length > 1 ? "," : ""} ${conjunction} ${last}`;
-}
-/**
-* Every channel's own approve command, quoted: "`agent-gmail approve` or `agent-slack approve`".
-*
-* `sending` keeps only the channels whose accounts can be in `send`: the commands that can have prepared a send. A
-* channel that never sends — WhatsApp — has an approve command for the changes its `mcp install` and `mcp prune`
-* make, and naming it where the approval in hand is a send would send a person to a command that never prepared one.
-*/
-function channelApproveCommands(options = {}) {
-	return listed(accountChannels().filter((manifest) => options.sending !== true || manifest.accounts?.modes.includes("send") === true).flatMap((manifest) => manifest.approve ? [`\`${manifest.approve}\``] : []), "or");
-}
 /** The noun for one account on `channel` — `mailbox`, `workspace` — or `account` for a channel that names none. */
 function accountNoun(channel) {
 	return manifestOf(channel)?.accounts?.noun ?? "account";
@@ -1205,106 +1200,20 @@ function narrowingOwner(option) {
 	return MANIFESTS.find((manifest) => manifest.narrowing?.some((narrowing) => narrowing.option === option));
 }
 /**
-* The command that connects a mailbox, for a hint about there being none: the `inbox add` of the channel whose
-* accounts are mailboxes, in the `inboxes` map.
+* How a mailbox is connected, for a hint about there being none: the `inbox add` of the channel whose accounts are
+* mailboxes, in the `inboxes` map — named in words, "Gmail's inbox add", never as a command. Core does not have that
+* channel's CLI, and finds it only among this machine's registrations (CUE-403); a hint made where none were read must
+* not invent the command from the manifest's binary.
 */
-function connectMailboxCommand() {
+function connectMailboxWords() {
 	const mail = accountChannels().find((manifest) => manifest.accounts?.map === "inboxes");
-	return mail ? `${mail.binary} inbox add` : void 0;
-}
-/** Crockford-style alphabet without I, L, O and U, so ids and challenges survive being read aloud or retyped. */
-const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function randomString(length) {
-	const bytes = randomBytes(length);
-	let out = "";
-	for (let i = 0; i < length; i += 1) out += ALPHABET[(bytes[i] ?? 0) & 31];
-	return out;
-}
-/** `ap_` + 26 characters: 130 random bits. Validated before an id ever names a file. */
-const APPROVAL_ID_PATTERN = /^ap_[0-9A-HJKMNP-TV-Z]{26}$/;
-const PLAN_TOKEN_PATTERN = /^pl_[0-9A-HJKMNP-TV-Z]{26}$/;
-function newApprovalId() {
-	return `ap_${randomString(26)}`;
-}
-function newPlanToken() {
-	return `pl_${randomString(26)}`;
-}
-const CHALLENGE_LETTERS = "ABCDEFGHJKMNPQRSTVWXYZ";
-/** A short challenge a human types back to approve: letters only, no look-alikes. */
-function newChallenge(length = 4) {
-	let out = "";
-	for (let i = 0; i < length; i += 1) out += CHALLENGE_LETTERS[randomInt(22)];
-	return out;
-}
-/** Challenges are stored only as hashes, so no listing or tool result can reveal one. */
-function hashChallenge(challenge) {
-	return createHash("sha256").update(challenge.trim().toUpperCase()).digest("hex");
-}
-/** Case-insensitive, constant-time comparison of an answer with a stored challenge hash. */
-function challengeMatches(answer, storedHash) {
-	const a = Buffer.from(hashChallenge(answer), "hex");
-	const b = Buffer.from(storedHash, "hex");
-	return a.length === b.length && timingSafeEqual(a, b);
-}
-function okEnvelope(data) {
-	return {
-		ok: true,
-		schemaVersion: 1,
-		data
-	};
-}
-function errorEnvelope(error) {
-	const body = {
-		code: error.code,
-		message: error.message
-	};
-	if (error.hint !== void 0) body.hint = error.hint;
-	if (error.details !== void 0) body.details = error.details;
-	return {
-		ok: false,
-		schemaVersion: 1,
-		error: body
-	};
-}
-const defaultStreams = {
-	stdout: process.stdout,
-	stderr: process.stderr,
-	stdin: process.stdin
-};
-function colorEnabled(env, stream, flag) {
-	if (flag === false) return false;
-	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
-	if (env.TERM === "dumb") return false;
-	if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
-	return Boolean(stream.isTTY);
-}
-/** True when a human could answer a prompt: both ends are terminals, no --json/--no-input, not CI. */
-function canPrompt(env, streams, options) {
-	if (options.json || options.noInput) return false;
-	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
-	return Boolean(streams.stdin?.isTTY && streams.stdout.isTTY);
-}
-/** Environment variables well-known coding agents set. Used only as a speed bump, never as a security boundary. */
-const AGENT_MARKERS = [
-	"CLAUDECODE",
-	"CLAUDE_CODE_ENTRYPOINT",
-	"CODEX_SANDBOX",
-	"CODEX_HOME",
-	"CURSOR_AGENT",
-	"GEMINI_CLI",
-	"AGENT_COMMS_AGENT"
-];
-function agentMarker(env) {
-	for (const name of AGENT_MARKERS) if (env[name] !== void 0 && env[name] !== "") return name;
-	return null;
-}
-function paint(color, format, text) {
-	return color ? styleText(format, text, { validateStream: false }) : text;
+	return mail ? `${mail.label}'s inbox add` : void 0;
 }
 /**
 * A command line for a person to copy and run, each word quoted only where the shell it is pasted into would need it.
-* Every command this package prints to be run — a change to run again with its approval, a folder to take out, an
-* entry to register again or remove — is quoted here, so no printer quotes for a shell of its own.
+* Every command this suite prints to be run — a change to run again with its approval, a folder to take out, an entry
+* to register again or remove — is quoted here, when the locator or `externalCommand` makes it, so no printer quotes
+* for a shell of its own.
 *
 * Everywhere but Windows that shell is a POSIX one, and a word goes in single quotes, inside which nothing is special
 * but the quote itself. Windows has two shells, and neither reads single quotes that way: cmd.exe does not take them
@@ -1343,31 +1252,58 @@ function paint(color, format, text) {
 *   hint's `--force` replaced it — and before that, a word quoted for PowerShell's single quotes, which cmd.exe reads
 *   as characters, ran `whoami` from a server named `$x&whoami&`. See `commandAsJson` for why the JSON runs nothing.
 *
+* - The program itself has to be left as it is. Quoted, it is a string to PowerShell rather than a command — PowerShell
+*   runs a quoted program only after `&`, which cmd.exe reads as the end of a command — so a program whose path needs
+*   quotes, as `C:\Program Files\nodejs\node.exe` does, leaves the command with no line either (CUE-403).
+*
 * Everywhere else there is always a line: single quotes make any word safe.
+*
+* Not a way to make a command for a person: what it returns is not one, and nothing that shows a command takes it. One
+* of this suite's own commands comes from `locateCliCommand`, any other program's from `externalCommand`, and each of
+* them quotes its words here.
 */
-function shellCommand(words, platform = process.platform) {
+function quoteCommand(words, platform) {
 	if (platform !== "win32") return {
 		words,
 		line: words.map(posixShellWord).join(" "),
 		platform
 	};
 	const printed = words.map(windowsShellWord);
+	const programBare = words.length === 0 || printed[0] === words[0];
 	return {
 		words,
-		line: printed.includes(null) ? null : printed.join(" "),
+		line: printed.includes(null) || !programBare ? null : printed.join(" "),
 		platform
 	};
 }
-/** The same command with more words at its end — the approval it is to be run again with — for the same shell. */
-function withWords(command, ...more) {
-	return shellCommand([...command.words, ...more], command.platform);
+/**
+* A printed command's line with words the agent is to fill in — a placeholder such as `<folder>`, printed as written,
+* never quoted as a word — before the command's first `--`, where the CLI still reads them as options. Null when the
+* command has no line.
+*/
+function quotedLineWithWordsToFill(command, ...toFill) {
+	if (command.line === null) return null;
+	const sentinel = command.words.indexOf("--");
+	if (sentinel < 0) return [command.line, ...toFill].join(" ");
+	const word = command.platform === "win32" ? windowsShellWord : posixShellWord;
+	const printed = command.words.map((each) => word(each));
+	return [
+		...printed.slice(0, sentinel),
+		...toFill,
+		...printed.slice(sentinel)
+	].join(" ");
+}
+/** Whether a Windows command has no line because its program's path needs quotes, which PowerShell would not run. */
+function programNeedsQuotes(command) {
+	const [program] = command.words;
+	return command.platform === "win32" && program !== void 0 && windowsShellWord(program) !== program;
 }
 function posixShellWord(word) {
 	return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
 }
 /**
 * The word as cmd.exe, Windows PowerShell and PowerShell 7 all hand it to a program, or null when no printing of it
-* does (see `shellCommand`). Bare: a plain option, or ordinary characters that do not start like a number.
+* does (see `quoteCommand`). Bare: a plain option, or ordinary characters that do not start like a number.
 */
 function windowsShellWord(word) {
 	if (/^(?:--?[A-Za-z][A-Za-z0-9-]*|(?!\+?\.?\d)[\w+=:./\\][\w@+=:./\\-]*)$/.test(word)) return word;
@@ -1405,140 +1341,189 @@ function commandAsJson(words) {
 }
 /** What is said beside a command shown as JSON. */
 const TO_TYPE = "the command's words, written as JSON: one of them cannot be quoted the same way for cmd.exe and for PowerShell, so type the command yourself, with that word quoted for the shell you use";
-/** A command in backticks, for a sentence — as its words in JSON, saying it has to be typed, when it has no line. */
-function inlineCommand(command) {
-	return command.line === null ? `\`${commandAsJson(command.words)}\` (${TO_TYPE})` : `\`${command.line}\``;
-}
-/** A command as text of its own — a list's line, a field's value — or its words in JSON, saying it has to be typed. */
-function commandText(command) {
-	return command.line === null ? `${commandAsJson(command.words)} (${TO_TYPE})` : command.line;
+/** What is said beside a command shown as JSON because its program's path needs quotes. */
+const TO_TYPE_PROGRAM = "the command's words, written as JSON: the program's path needs quotes, and PowerShell runs a quoted program only after `&`, which cmd.exe does not accept, so type the command yourself, with each word quoted for the shell you use and, in PowerShell, `&` before the program";
+function toType(command) {
+	return programNeedsQuotes(command) ? TO_TYPE_PROGRAM : TO_TYPE;
 }
-/** Writes a successful result: the envelope with --json, otherwise the human rendering. */
-function writeResult(data, options, human, streams = defaultStreams) {
-	if (options.json) {
-		streams.stdout.write(`${JSON.stringify(okEnvelope(data))}\n`);
-		return;
-	}
-	const text = human(data);
-	if (text) streams.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
-}
-/** Writes an error and returns the exit code to use. */
-function writeError(error, options, streams = defaultStreams) {
-	const commsError = toCommsError(error);
-	if (options.json) streams.stdout.write(`${JSON.stringify(errorEnvelope(commsError))}\n`);
-	else {
-		streams.stderr.write(`${paint(options.color, "red", "error")}: ${commsError.message}\n`);
-		if (commsError.hint) streams.stderr.write(`${paint(options.color, "dim", "hint")}: ${commsError.hint}\n`);
-	}
-	return commsError.exitCode;
+/** Quoted words in backticks, for a sentence — as words in JSON, saying it has to be typed, when there is no line. */
+function inlineQuoted(command) {
+	return command.line === null ? `\`${commandAsJson(command.words)}\` (${toType(command)})` : `\`${command.line}\``;
 }
-/** Runs a command body and exits with the documented code. Unexpected errors keep only their message. */
-async function runCommand(options, body, streams = defaultStreams) {
-	try {
-		await body();
-		return EXIT_CODES.OK;
-	} catch (error) {
-		return writeError(error, options, streams);
-	}
+/** Quoted words as text of their own — a list's line, a field's value — or as words in JSON, saying to type them. */
+function quotedText(command) {
+	return command.line === null ? `${commandAsJson(command.words)} (${toType(command)})` : command.line;
 }
 /**
-* The first two steps of `requirePerson` — an agent is refused, then anything without a terminal — for a command
-* whose code is not its own to make up.
-*
-* `agentcomms approve` asks for a code the approval store issued and will check, so it cannot use `askChallenge`;
-* but it refuses in exactly the same order and words, because it is the same gate.
+* The same command with words the agent is to fill in — a placeholder such as `<folder>` — before its first `--`: for
+* showing as words in JSON when the command has no line. With a line, `quotedLineWithWordsToFill` prints them as they
+* are written instead, never quoted as a word.
 */
-function refuseUnlessPerson(env, streams, gate) {
-	const marker = agentMarker(env);
-	if (marker) throw new CommsError("LOOSENING_REFUSED", gate.refusedToAgent, {
-		hint: `Ask the user to run \`${gate.command}\` in their own terminal.`,
-		details: { marker }
-	});
-	const prompting = {};
-	if (gate.json !== void 0) prompting.json = gate.json;
-	if (gate.noInput !== void 0) prompting.noInput = gate.noInput;
-	if (!canPrompt(env, streams, prompting)) throw new CommsError("LOOSENING_REFUSED", gate.refusedWithoutTerminal, { hint: `Run \`${gate.command}\` directly in a terminal.` });
+function quotedWithWordsToFill(command, toFill) {
+	const sentinel = command.words.indexOf("--");
+	const at = sentinel < 0 ? command.words.length : sentinel;
+	return quoteCommand([
+		...command.words.slice(0, at),
+		...toFill,
+		...command.words.slice(at)
+	], command.platform);
 }
-/**
-* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
-* and the preview renderer (which makes them visible), so the two can never disagree.
-*/
-/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
-const INVISIBLE_RANGES = [
-	[173, 173],
-	[847, 847],
-	[1564, 1564],
-	[4447, 4448],
-	[6068, 6069],
-	[6155, 6159],
-	[8203, 8207],
-	[8232, 8233],
-	[8234, 8238],
-	[8288, 8292],
-	[8294, 8303],
-	[12644, 12644],
-	[65024, 65039],
-	[65279, 65279],
-	[65440, 65440],
-	[917504, 917631]
-];
-function isInvisible(codePoint) {
-	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
-	return false;
+/** Crockford-style alphabet without I, L, O and U, so ids and challenges survive being read aloud or retyped. */
+const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function randomString(length) {
+	const bytes = randomBytes(length);
+	let out = "";
+	for (let i = 0; i < length; i += 1) out += ALPHABET[(bytes[i] ?? 0) & 31];
+	return out;
 }
-/**
-* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
-* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
-*/
-function isControl(codePoint) {
-	if (codePoint === 9 || codePoint === 10) return false;
-	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+/** `ap_` + 26 characters: 130 random bits. Validated before an id ever names a file. */
+const APPROVAL_ID_PATTERN = /^ap_[0-9A-HJKMNP-TV-Z]{26}$/;
+const PLAN_TOKEN_PATTERN = /^pl_[0-9A-HJKMNP-TV-Z]{26}$/;
+function newApprovalId() {
+	return `ap_${randomString(26)}`;
 }
-function isDangerous(codePoint) {
-	return isControl(codePoint) || isInvisible(codePoint);
+function newPlanToken() {
+	return `pl_${randomString(26)}`;
 }
-/**
-* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
-* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
-*
-* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
-* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
-* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
-*/
-function stripInvisible(text) {
-	let removed = 0;
+const CHALLENGE_LETTERS = "ABCDEFGHJKMNPQRSTVWXYZ";
+/** A short challenge a human types back to approve: letters only, no look-alikes. */
+function newChallenge(length = 4) {
 	let out = "";
-	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
-	else out += char;
+	for (let i = 0; i < length; i += 1) out += CHALLENGE_LETTERS[randomInt(22)];
+	return out;
+}
+/** Challenges are stored only as hashes, so no listing or tool result can reveal one. */
+function hashChallenge(challenge) {
+	return createHash("sha256").update(challenge.trim().toUpperCase()).digest("hex");
+}
+/** Case-insensitive, constant-time comparison of an answer with a stored challenge hash. */
+function challengeMatches(answer, storedHash) {
+	const a = Buffer.from(hashChallenge(answer), "hex");
+	const b = Buffer.from(storedHash, "hex");
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+function okEnvelope(data) {
 	return {
-		text: out,
-		removed
+		ok: true,
+		schemaVersion: 1,
+		data
+	};
+}
+function errorEnvelope(error) {
+	const body = {
+		code: error.code,
+		message: error.message
+	};
+	if (error.hint !== void 0) body.hint = error.hint;
+	if (error.details !== void 0) body.details = error.details;
+	return {
+		ok: false,
+		schemaVersion: 1,
+		error: body
 	};
 }
 const APP_DIR_NAME = "agent-communications";
-/**
-* Where everything lives. `AGENT_COMMS_CONFIG_DIR` wins; then `XDG_CONFIG_HOME` (honoured on macOS too, because that is
-* where agents and people look first); then `~/.config` on macOS and Linux, `%APPDATA%` on Windows.
-*
-* On Windows, state and the file secret store go under `%LOCALAPPDATA%` rather than beside the config: `%APPDATA%` is
-* the roaming profile, which a domain copies between machines — and refresh tokens, approvals and audit records are
-* exactly what should not travel that way. An explicit `AGENT_COMMS_CONFIG_DIR` keeps everything together, because
-* someone who names a directory means that directory.
-*/
+/** The five suite directories a CLI can pin independently. */
+const PATH_OPTIONS = [
+	{
+		key: "configDir",
+		option: "config-dir",
+		flag: "--config-dir"
+	},
+	{
+		key: "stateDir",
+		option: "state-dir",
+		flag: "--state-dir"
+	},
+	{
+		key: "dataDir",
+		option: "data-dir",
+		flag: "--data-dir"
+	},
+	{
+		key: "secretsDir",
+		option: "secrets-dir",
+		flag: "--secrets-dir"
+	},
+	{
+		key: "downloadsDir",
+		option: "downloads-dir",
+		flag: "--downloads-dir"
+	}
+];
+/**
+* Words with the five path options and their values taken out where an option parser would read them — before the
+* first `--`, in both the `--x value` and `--x=value` forms — and every word from `--` on kept as it is.
+*
+* What a registered entry is recognised by. A pinned folder is a folder: `/tmp/@agentcomms/slack`, or one ending in
+* `packages/slack/src/cli.ts`, read as a package or an entry, made a Gmail registration Slack's. `dangling` says a
+* spaced option had no value before `--` or the end, which is a broken entry rather than one to guess about.
+*/
+function withoutPathOptions(words) {
+	const flags = PATH_OPTIONS.map(({ flag }) => flag);
+	const kept = [];
+	let dangling = false;
+	for (let index = 0; index < words.length; index += 1) {
+		const word = words[index];
+		if (word === "--") {
+			kept.push(...words.slice(index));
+			break;
+		}
+		if (flags.includes(word)) {
+			const value = words[index + 1];
+			if (value === void 0 || value === "--") dangling = true;
+			else index += 1;
+			continue;
+		}
+		if (flags.some((flag) => word.startsWith(`${flag}=`))) continue;
+		kept.push(word);
+	}
+	return {
+		words: kept,
+		dangling
+	};
+}
+/**
+* Where everything lives. `AGENT_COMMS_CONFIG_DIR` wins; then `XDG_CONFIG_HOME` (honoured on macOS too, because that is
+* where agents and people look first); then `~/.config` on macOS and Linux, `%APPDATA%` on Windows.
+*
+* On Windows, state and the file secret store go under `%LOCALAPPDATA%` rather than beside the config: `%APPDATA%` is
+* the roaming profile, which a domain copies between machines — and refresh tokens, approvals and audit records are
+* exactly what should not travel that way. An explicit `AGENT_COMMS_CONFIG_DIR` keeps everything together, because
+* someone who names a directory means that directory.
+*/
 function resolvePaths(options = {}) {
+	return resolvePathIdentity(options).paths;
+}
+/** Resolves the environment/default identity, then overlays each explicit pin without re-deriving any sibling. */
+function resolvePathIdentity(options = {}) {
 	const env = options.env ?? process.env;
 	const platform = options.platform ?? process.platform;
 	const home = options.home ?? homeOf(env, platform);
 	const configDir = resolve(env.AGENT_COMMS_CONFIG_DIR || (env.XDG_CONFIG_HOME ? join(env.XDG_CONFIG_HOME, "agent-communications") : platform === "win32" ? join(env.APPDATA || join(home, "AppData", "Roaming"), "agent-communications") : join(home, ".config", "agent-communications")));
 	const explicitConfigDir = Boolean(env.AGENT_COMMS_CONFIG_DIR);
 	const localRoot = platform === "win32" && !explicitConfigDir ? join(env.LOCALAPPDATA || join(home, "AppData", "Local"), APP_DIR_NAME) : configDir;
-	return {
+	const derived = {
 		configDir,
 		stateDir: resolve(env.AGENT_COMMS_STATE_DIR || join(localRoot, "state")),
 		secretsDir: resolve(join(localRoot, "secrets")),
 		dataDir: resolve(env.AGENT_COMMS_DATA_DIR || (platform === "win32" ? join(env.LOCALAPPDATA || join(home, "AppData", "Local"), "agent-communications") : env.XDG_DATA_HOME ? join(env.XDG_DATA_HOME, "agent-communications") : join(home, ".local", "share", "agent-communications"))),
 		downloadsDir: resolve(join(home, "Downloads", APP_DIR_NAME))
 	};
+	const pathOverrides = {};
+	for (const { key } of PATH_OPTIONS) {
+		const value = options.pathOverrides?.[key];
+		if (value === void 0) continue;
+		if (value.length === 0) throw new TypeError(`${key} cannot be empty`);
+		pathOverrides[key] = resolve(value);
+	}
+	return {
+		paths: {
+			...derived,
+			...pathOverrides
+		},
+		pathOverrides: Object.freeze(pathOverrides)
+	};
 }
 /**
 * The home the environment names, which is where Node's own `homedir()` looks for the running process — `HOME`, or
@@ -1608,6 +1593,294 @@ function shortenHome(path, home, platform = process.platform) {
 function homeDirectory(env = process.env) {
 	return env.HOME || env.USERPROFILE || homedir();
 }
+const defaultStreams = {
+	stdout: process.stdout,
+	stderr: process.stderr,
+	stdin: process.stdin
+};
+/** Converts the shared parser's five global option values into independently applied core path pins. */
+function pathOverridesFromCliOptions(values) {
+	const overrides = {};
+	for (const { key, option, flag } of PATH_OPTIONS) {
+		const value = values[option];
+		if (value === void 0) continue;
+		if (value.length === 0) throw new CommsError("USAGE", `${flag} needs a non-empty directory`);
+		overrides[key] = value;
+	}
+	return overrides;
+}
+/** Inserts generated option words immediately before the first end-of-options sentinel. */
+function insertWordsBeforeSentinel(words, ...inserted) {
+	const sentinel = words.indexOf("--");
+	const at = sentinel < 0 ? words.length : sentinel;
+	return [
+		...words.slice(0, at),
+		...inserted,
+		...words.slice(at)
+	];
+}
+/**
+* Removes the named options only where the CLI parser can see them: before the first `--`. Both `--x value` and
+* `--x=value` are removed. The sentinel and every positional word after it are byte-for-byte data.
+*/
+function withoutOptionsBeforeSentinel(words, flags) {
+	const kept = [];
+	for (let index = 0; index < words.length; index += 1) {
+		const word = words[index];
+		if (word === "--") {
+			kept.push(...words.slice(index));
+			break;
+		}
+		const spaced = flags.find((flag) => word === flag);
+		if (spaced !== void 0) {
+			const value = words[index + 1];
+			if (value === void 0 || value === "--") throw new CommsError("USAGE", `${spaced} needs a value before --`);
+			index += 1;
+			continue;
+		}
+		if (flags.some((flag) => word.startsWith(`${flag}=`))) continue;
+		kept.push(word);
+	}
+	return kept;
+}
+/**
+* Replaces every pre-sentinel suite path option with one canonical pin per supplied directory. `insertAt` counts
+* words after the old pins are removed: zero puts global options after the executable held elsewhere, one puts them
+* after an entry/package word. Downloads are included only when the caller supplies that pin.
+*/
+function normalizePathOptionWords(words, pins, insertAt) {
+	const stripped = withoutOptionsBeforeSentinel(words, PATH_OPTIONS.map(({ flag }) => flag));
+	const sentinel = stripped.indexOf("--");
+	const optionsEnd = sentinel < 0 ? stripped.length : sentinel;
+	if (!Number.isSafeInteger(insertAt) || insertAt < 0 || insertAt > optionsEnd) throw new TypeError(`path-option insertion point ${insertAt} is outside the option words`);
+	const pathWords = PATH_OPTIONS.flatMap(({ key, flag }) => {
+		const value = pins[key];
+		if (value === void 0) return [];
+		if (value.length === 0) throw new CommsError("USAGE", `${flag} needs a non-empty directory`);
+		return [flag, resolve(value)];
+	});
+	return [
+		...stripped.slice(0, insertAt),
+		...pathWords,
+		...stripped.slice(insertAt)
+	];
+}
+function colorEnabled(env, stream, flag) {
+	if (flag === false) return false;
+	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
+	if (env.TERM === "dumb") return false;
+	if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
+	return Boolean(stream.isTTY);
+}
+/** True when a human could answer a prompt: both ends are terminals, no --json/--no-input, not CI. */
+function canPrompt(env, streams, options) {
+	if (options.json || options.noInput) return false;
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
+	return Boolean(streams.stdin?.isTTY && streams.stdout.isTTY);
+}
+/** Environment variables well-known coding agents set. Used only as a speed bump, never as a security boundary. */
+const AGENT_MARKERS = [
+	"CLAUDECODE",
+	"CLAUDE_CODE_ENTRYPOINT",
+	"CODEX_SANDBOX",
+	"CODEX_HOME",
+	"CURSOR_AGENT",
+	"GEMINI_CLI",
+	"AGENT_COMMS_AGENT"
+];
+function agentMarker(env) {
+	for (const name of AGENT_MARKERS) if (env[name] !== void 0 && env[name] !== "") return name;
+	return null;
+}
+function paint(color, format, text) {
+	return color ? styleText(format, text, { validateStream: false }) : text;
+}
+/** A command in backticks, for a sentence — as its words in JSON, saying it has to be typed, when it has no line. */
+function inlineCommand(command) {
+	return inlineQuoted(command);
+}
+/** A command as text of its own — a list's line, a field's value — or its words in JSON, saying it has to be typed. */
+function commandText(command) {
+	return quotedText(command);
+}
+/**
+* A command's line with words the agent is to fill in — a placeholder such as `<folder>`, printed as written, never
+* quoted as a word — before the command's first `--`, where the CLI still reads them as options. Null when the
+* command has no line.
+*/
+function lineWithWordsToFill(command, ...toFill) {
+	return quotedLineWithWordsToFill(command, ...toFill);
+}
+/** Writes a successful result: the envelope with --json, otherwise the human rendering. */
+function writeResult(data, options, human, streams = defaultStreams) {
+	if (options.json) {
+		streams.stdout.write(`${JSON.stringify(okEnvelope(data))}\n`);
+		return;
+	}
+	const text = human(data);
+	if (text) streams.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+}
+/** Writes an error and returns the exit code to use. */
+function writeError(error, options, streams = defaultStreams) {
+	const commsError = toCommsError(error);
+	if (options.json) streams.stdout.write(`${JSON.stringify(errorEnvelope(commsError))}\n`);
+	else {
+		streams.stderr.write(`${paint(options.color, "red", "error")}: ${commsError.message}\n`);
+		if (commsError.hint) streams.stderr.write(`${paint(options.color, "dim", "hint")}: ${commsError.hint}\n`);
+	}
+	return commsError.exitCode;
+}
+/** Runs a command body and exits with the documented code. Unexpected errors keep only their message. */
+async function runCommand(options, body, streams = defaultStreams) {
+	try {
+		await body();
+		return EXIT_CODES.OK;
+	} catch (error) {
+		return writeError(error, options, streams);
+	}
+}
+/**
+* The first two steps of `requirePerson` — an agent is refused, then anything without a terminal — for a command
+* whose code is not its own to make up.
+*
+* `agentcomms approve` asks for a code the approval store issued and will check, so it cannot use `askChallenge`;
+* but it refuses in exactly the same order and words, because it is the same gate.
+*/
+function refuseUnlessPerson(env, streams, gate) {
+	const marker = agentMarker(env);
+	if (marker) throw new CommsError("LOOSENING_REFUSED", gate.refusedToAgent, {
+		hint: gateSentence(gate.command, (command) => `Ask the user to run ${command} in their own terminal.`),
+		details: { marker }
+	});
+	const prompting = {};
+	if (gate.json !== void 0) prompting.json = gate.json;
+	if (gate.noInput !== void 0) prompting.noInput = gate.noInput;
+	if (!canPrompt(env, streams, prompting)) throw new CommsError("LOOSENING_REFUSED", gate.refusedWithoutTerminal, { hint: gateSentence(gate.command, (command) => `Run ${command} directly in a terminal.`) });
+}
+/** A gate's command in a sentence: in backticks, or the sentence saying why there is none in its place. */
+function gateSentence(command, say) {
+	return "message" in command ? command.message : say(inlineCommand(command));
+}
+/**
+* The handoffs a store or a deep function was given (`core.handoffs`, handed on by `openCore`), for the command one of
+* its refusals names. A programming error when there are none: the package that opened core did not give it its
+* caller (`openCore({ caller })`), and there is no command to print in its place — not a bare name, not a guess.
+*/
+function requiredHandoffs(handoffs) {
+	if (handoffs === void 0) throw new TypeError("core was opened without its caller, so it cannot locate a command: pass openCore({ caller })");
+	return handoffs;
+}
+/** Whether a handoff is a command to run, rather than the sentence saying why there is none. */
+function isCommand(handoff) {
+	return !("message" in handoff);
+}
+/**
+* A handoff as a value of its own — a list's line, a field's value: the command's line, or its words as JSON with what
+* to do when no line is safe in every Windows shell; or, with no command, the sentence saying why.
+*/
+function handoffText(handoff) {
+	return isCommand(handoff) ? commandText(handoff) : handoff.message;
+}
+/**
+* A remedy, a line per argument: one part, or the parts of one line in order — `[remove, ', then add it again']`.
+* A command is shown as `handoffText` shows it: its line, its words as JSON with what to do when no Windows line is
+* safe, or why there is none here.
+*/
+function remedy(...lines) {
+	const part = (each) => typeof each === "string" ? each : handoffText(each);
+	return lines.map((line) => Array.isArray(line) ? line.map(part).join("") : part(line)).join("\n");
+}
+/** The sentence saying why there is no command, after another way when there is one. */
+function noCommand(handoff, options) {
+	return options.instead === void 0 ? handoff.message : `${options.instead} ${handoff.message}`;
+}
+/**
+* A sentence that gives the command, in backticks, made by `say`; or, with no command, the sentence saying why there is
+* none — after `instead`, when given — never `say` with something else in the command's place.
+*/
+function handoffSentence(handoff, say, options = {}) {
+	return isCommand(handoff) ? say(inlineCommand(handoff)) : noCommand(handoff, options);
+}
+/**
+* As `handoffSentence`, for a command with words the agent is to fill in — a placeholder such as `<folder>`, printed as
+* written — before its first `--`. With no line to show them in, the command is shown as its words, placeholders among
+* them, saying it has to be typed.
+*/
+function handoffSentenceToFill(handoff, toFill, say, options = {}) {
+	if (!isCommand(handoff)) return noCommand(handoff, options);
+	const line = lineWithWordsToFill(handoff, ...toFill);
+	if (line !== null) return say(`\`${line}\``);
+	return say(inlineQuoted(quotedWithWordsToFill(handoff, toFill)));
+}
+/**
+* Commands that each could do it — one per channel, say — as one phrase: the commands joined by "or", then, for each
+* that has none here, the sentence saying why. `none` is said when not one of them is a command.
+*/
+function handoffChoices(handoffs, none, options = {}) {
+	const commands = handoffs.filter((handoff) => isCommand(handoff)).map((handoff) => inlineCommand(handoff));
+	const missing = handoffs.filter((handoff) => !isCommand(handoff));
+	const reasons = [...new Set(missing.map((handoff) => handoff.message))].join(" ");
+	if (commands.length === 0) return `${none} ${reasons}`.trim();
+	const conjunction = options.conjunction ?? "or";
+	const joined = commands.length === 1 ? commands[0] : `${commands.slice(0, -1).join(", ")} ${conjunction} ${commands.at(-1)}`;
+	return reasons === "" ? joined : `${joined} (${reasons.replace(/\.$/, "")})`;
+}
+/**
+* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
+* and the preview renderer (which makes them visible), so the two can never disagree.
+*/
+/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
+const INVISIBLE_RANGES = [
+	[173, 173],
+	[847, 847],
+	[1564, 1564],
+	[4447, 4448],
+	[6068, 6069],
+	[6155, 6159],
+	[8203, 8207],
+	[8232, 8233],
+	[8234, 8238],
+	[8288, 8292],
+	[8294, 8303],
+	[12644, 12644],
+	[65024, 65039],
+	[65279, 65279],
+	[65440, 65440],
+	[917504, 917631]
+];
+function isInvisible(codePoint) {
+	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
+	return false;
+}
+/**
+* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
+* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
+*/
+function isControl(codePoint) {
+	if (codePoint === 9 || codePoint === 10) return false;
+	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function isDangerous(codePoint) {
+	return isControl(codePoint) || isInvisible(codePoint);
+}
+/**
+* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
+* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
+*
+* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
+* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
+* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
+*/
+function stripInvisible(text) {
+	let removed = 0;
+	let out = "";
+	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
+	else out += char;
+	return {
+		text: out,
+		removed
+	};
+}
 const WINDOWS_RESERVED$1 = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹²³])$/i;
 const UNSAFE_FILENAME_CHARS = /[/\\\u0000-\u001f\u007f<>:"|?*]/g;
 /** Truncates a string to at most `maxBytes` UTF-8 bytes without splitting a code point. */
@@ -1740,7 +2013,14 @@ async function checkAttachable(path, policy) {
 		throw new CommsError("NOT_FOUND", `attachment not found: ${path}`);
 	}
 	if (!(await stat(real)).isFile()) throw new CommsError("BAD_DATA", `not a regular file: ${path}`);
-	if (!(await Promise.all(policy.roots.filter((root) => namesItsPlace(root)).map((root) => realOrResolved(expandHome(root, home))))).some((root) => isInside(real, root))) throw new CommsError("BAD_DATA", `attachments must come from an allowed folder; ${path} is outside them`, { hint: "Copy the file under your home folder — not into one of its hidden folders — and name the copy instead, or allow its folder with `agentcomms attach roots add <folder>` (needs your approval)." });
+	if (!(await Promise.all(policy.roots.filter((root) => namesItsPlace(root)).map((root) => realOrResolved(expandHome(root, home))))).some((root) => isInside(real, root))) {
+		const allow = handoffSentenceToFill(requiredHandoffs(policy.handoffs).core([
+			"attach",
+			"roots",
+			"add"
+		]), ["<folder>"], (command) => `allow its folder with ${command} (needs your approval).`, { instead: "allow its folder with comms_attach from a chat (needs your approval)." });
+		throw new CommsError("BAD_DATA", `attachments must come from an allowed folder; ${path} is outside them`, { hint: `Copy the file under your home folder — not into one of its hidden folders — and name the copy instead, or ${allow}` });
+	}
 	const name = basename(real);
 	const homeDir = await realOrResolved(home ?? (await import("node:os")).homedir());
 	for (const entry of policy.deny) {
@@ -2216,21 +2496,24 @@ function committedSecretsStore(config) {
 * asked for, the keychain by default. `choosing` says this command is the one choosing it.
 *
 * A different backend asked for is refused, not taken: one backend holds everything here, and changing it has to move
-* what is already stored, which is what `agentcomms secrets migrate` does and nothing else does.
+* what is already stored, which is what `agentcomms secrets migrate` does and nothing else does. The refusal names that
+* command, made by `handoffs` — the caller's, located (CUE-403).
 */
-function secretsStoreFor(config, requested, platform = process.platform) {
+function secretsStoreFor(config, requested, handoffs) {
 	const committed = committedSecretsStore(config);
 	if (committed === null) return {
 		store: requested ?? "keychain",
 		choosing: true
 	};
-	if (requested !== void 0 && requested !== committed) throw new CommsError("CONFIG", `this configuration already keeps its secrets in the ${committed} store`, { hint: `Everything here uses one store, and changing it moves what is already stored. To change it, run ${inlineCommand(shellCommand([
-		"agentcomms",
-		"secrets",
-		"migrate",
-		"--to",
-		requested
-	], platform))}, then run this again.` });
+	if (requested !== void 0 && requested !== committed) {
+		const migrate = handoffSentence(handoffs.core([
+			"secrets",
+			"migrate",
+			"--to",
+			requested
+		]), (command) => `To change it, run ${command}, then run this again.`, { instead: "To change it, call comms_secrets_migrate from a chat, then run this again." });
+		throw new CommsError("CONFIG", `this configuration already keeps its secrets in the ${committed} store`, { hint: `Everything here uses one store, and changing it moves what is already stored. ${migrate}` });
+	}
 	return {
 		store: committed,
 		choosing: false
@@ -2292,10 +2575,20 @@ function parseConfig$1(text, source = "config.json") {
 var ConfigStore = class {
 	path;
 	#lockPath;
+	#handoffs;
 	#cache = null;
-	constructor(configDir) {
+	/**
+	* @param options.handoffs the printing package's handoffs (`core.handoffs`, CUE-403), for the command a refusal
+	*   names; left out, a refusal that has to name one is a programming error (`requiredHandoffs`).
+	*/
+	constructor(configDir, options = {}) {
 		this.path = join(configDir, "config.json");
 		this.#lockPath = join(configDir, ".config.lock");
+		this.#handoffs = options.handoffs;
+	}
+	/** "Run the names migration again", as core's command — located from whatever is printing — or the tool. */
+	#namesMigrateAgain(why) {
+		return handoffSentence(requiredHandoffs(this.#handoffs).core(["names", "migrate"]), (command) => `Run ${command} again ${why}.`, { instead: `Call comms_names_migrate again ${why}.` });
 	}
 	/** The current config; an empty one when the file does not exist yet. */
 	async load() {
@@ -2328,7 +2621,7 @@ var ConfigStore = class {
 				this.#cache = null;
 				const current = structuredClone(await this.load());
 				const next = await mutator(structuredClone(current));
-				if (next.version !== current.version) throw new CommsError("CONFIG", `refusing to change the config version from ${current.version} to ${String(next.version)}`, { hint: "Only `agentcomms names migrate` changes the version. This is a bug — please report it." });
+				if (next.version !== current.version) throw new CommsError("CONFIG", `refusing to change the config version from ${current.version} to ${String(next.version)}`, { hint: "Only the names migration changes the version. This is a bug — please report it." });
 				const parsed = schemaFor(current.version).safeParse(next);
 				if (!parsed.success) throw new CommsError("CONFIG", `refusing to write invalid config: ${describeIssues(parsed.error, current.version)}`);
 				if (current.version === 2 && parsed.data.version === 2) {
@@ -2339,7 +2632,7 @@ var ConfigStore = class {
 				const allowed = new Set(options.consent?.paths ?? []);
 				const unconsented = loosened.filter((path) => !allowed.has(path));
 				if (unconsented.length > 0) throw new CommsError("LOOSENING_REFUSED", `this change loosens a safety setting: ${unconsented.join(", ")}`, {
-					hint: "A person approves a loosening, from a chat or at a terminal. From a chat, the tool that makes the change returns a preview and an approval id: the person says yes in the chat (change policy `chat`) or runs `agentcomms approve <id>` at their own terminal (`confirm`), and the tool is called again with the id. At a terminal, run the matching command and approve the change it shows.",
+					hint: "A person approves a loosening, from a chat or at a terminal. From a chat, the tool that makes the change returns a preview and an approval id: the person says yes in the chat (change policy `chat`) or runs the approve command the result gives at their own terminal (`confirm`), and the tool is called again with the id. At a terminal, run the matching command and approve the change it shows.",
 					details: { paths: unconsented }
 				});
 				const approved = options.consent?.changes;
@@ -2399,13 +2692,13 @@ var ConfigStore = class {
 			const raw = await readFileIfExists(this.path);
 			const current = raw === null ? emptyConfig() : parseConfig$1(raw, this.path);
 			if (current.version === 2) {
-				if (!migrationApplied(current, rows)) throw new CommsError("TRANSIENT", "the names were migrated while this ran, and not to these names", { hint: "Run `agentcomms names migrate` again to see what they are called now." });
+				if (!migrationApplied(current, rows)) throw new CommsError("TRANSIENT", "the names were migrated while this ran, and not to these names", { hint: this.#namesMigrateAgain("to see what they are called now") });
 				return {
 					status: "already-migrated",
 					config: current
 				};
 			}
-			if (configFingerprint(current) !== expected) throw new CommsError("TRANSIENT", "the configuration changed after the preview was made", { hint: "Run `agentcomms names migrate` again to see the mapping for the configuration as it is now." });
+			if (configFingerprint(current) !== expected) throw new CommsError("TRANSIENT", "the configuration changed after the preview was made", { hint: this.#namesMigrateAgain("to see the mapping for the configuration as it is now") });
 			const parsed = configV2Schema.safeParse(build(structuredClone(current)));
 			if (!parsed.success) throw new CommsError("CONFIG", `refusing to write invalid config: ${describeIssues(parsed.error, 2)}`);
 			const unchanged = onlyKeysRenamed(current, parsed.data);
@@ -2968,13 +3261,40 @@ function publicView(record) {
 	const { challengeHash: _hidden, ...rest } = record;
 	return rest;
 }
+/**
+* The refusals of a send's approval offered to a change. They name each sending channel's `approve`; another product's
+* is found only among the registrations read for it, which the store does not read under its lock — so a caller that
+* can read them says it again with them (`sendApprovesHint`).
+*/
+const MISDIRECTED_SENDS = /* @__PURE__ */ new WeakSet();
+/**
+* What an agent is told when a change waits for a person at a terminal: the printing package's own `approve` with this
+* id, located, or why there is none here.
+*/
+function approvePendingHint(handoffs, approvalId, platform) {
+	const located = requiredHandoffs(handoffs);
+	return handoffSentence(located.on(platform ?? located.platform).own(["approve", approvalId]), (command) => `Ask the user to run ${command} in their own terminal, then try again with the same approval.`);
+}
+/** Whether `error` is the refusal of a send's approval offered as a change's. */
+function isMisdirectedSend(error) {
+	return error instanceof CommsError && MISDIRECTED_SENDS.has(error);
+}
+/**
+* What approves the send `approvalId`: the `approve` of every channel that sends, one of which prepared it — a send
+* record does not say which (D1). Each is a located command, or why it has none here.
+*/
+function sendApprovesHint(maker, approvalId) {
+	return `It is approved with the command that prepared it — ${handoffChoices(accountChannels().filter((manifest) => manifest.accounts?.modes.includes("send") === true).map((manifest) => maker.of(manifest.channel, ["approve", approvalId])), "and none is locatable here:")} — and permits only that send.`;
+}
 var ApprovalStore = class {
 	directory;
 	#now;
 	#ttlMs;
 	#downloadTtlMs;
+	#handoffs;
 	constructor(stateDir, options = {}) {
 		this.directory = join(stateDir, "approvals");
+		this.#handoffs = options.handoffs;
 		this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.#ttlMs = options.ttlMs ?? 6e5;
 		this.#downloadTtlMs = options.downloadTtlMs ?? 18e5;
@@ -3080,17 +3400,17 @@ var ApprovalStore = class {
 	* Nothing written, because the caller made a mistake about an approval that may be perfectly good: voiding a post
 	* somebody is about to approve, because an agent passed its id to a change, would punish the wrong party.
 	*/
-	#requireKind(record, kind, platform) {
+	#requireKind(record, kind, platform, handoffs = this.#handoffs) {
+		const maker = () => requiredHandoffs(handoffs).on(platform);
 		const actual = approvalKind(record);
 		if (actual === kind) return;
 		const id = record.approvalId;
 		if (actual === "download") throw (kind === "change" ? refuseChange : refuse$1)("USAGE", `${id} is a question about where to save files, not ${kind === "send" ? "a send" : "a configuration change"}`, record, DOWNLOAD_ANSWER_HINT);
 		if (kind === "download") throw refuseDownload("USAGE", `${id} is ${actual === "change" ? "a configuration change" : "a send"}, not a question about where to save files`, record, "Pass the choice id the download’s question came with, and the person’s answer beside it.");
-		throw kind === "send" ? refuse$1("USAGE", `approval ${id} is for a configuration change, not a send`, record, `A person approves it with ${inlineCommand(shellCommand([
-			"agentcomms",
-			"approve",
-			id
-		], platform))} — or ${channelApproveCommands()}, whichever is installed — and it permits only the change it was prepared for.`) : refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, `It is approved with the command that prepared it — ${channelApproveCommands({ sending: true })} — and permits only that send.`);
+		if (kind === "send") throw refuse$1("USAGE", `approval ${id} is for a configuration change, not a send`, record, handoffSentence(maker().own(["approve", id]), (command) => `A person approves it with ${command}, and it permits only the change it was prepared for.`));
+		const misdirected = refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, sendApprovesHint(maker(), id));
+		MISDIRECTED_SENDS.add(misdirected);
+		throw misdirected;
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
 	async issueChallenge(approvalId, kind = "send", platform = process.platform) {
@@ -3173,7 +3493,7 @@ var ApprovalStore = class {
 	async claimForSend(approvalId, live, options = {}) {
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "send", options.platform ?? process.platform);
+			this.#requireKind(current, "send", options.platform ?? process.platform, options.handoffs ?? this.#handoffs);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
 			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (code, reason) => {
@@ -3285,7 +3605,7 @@ var ApprovalStore = class {
 		const digest = changeDigest(live.change);
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "change", options.platform ?? process.platform);
+			this.#requireKind(current, "change", options.platform ?? process.platform, options.handoffs ?? this.#handoffs);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
 			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (reason) => {
@@ -3301,11 +3621,7 @@ var ApprovalStore = class {
 			};
 			if (digest !== current.digest) return voidWith(current.change ? changeDrift(current.change, live.change) : "the change is not the one that was approved");
 			if (stricterPolicy(live.policy, current.requiredPolicy) !== "chat") {
-				if (current.state !== "approved") throw refuseChange("APPROVAL_PENDING", "this change needs a person to approve it at a terminal first", current, options.pendingHint ?? `Ask the user to run ${inlineCommand(shellCommand([
-					"agentcomms",
-					"approve",
-					approvalId
-				], options.platform ?? process.platform))} in their own terminal, then try again with the same approval.`);
+				if (current.state !== "approved") throw refuseChange("APPROVAL_PENDING", "this change needs a person to approve it at a terminal first", current, options.pendingHint ?? approvePendingHint(options.handoffs ?? this.#handoffs, approvalId, options.platform));
 				if (current.approvedVia !== "terminal") return voidWith("the change policy is confirm, and this was not approved at a terminal");
 			}
 			return {
@@ -3427,7 +3743,7 @@ var ApprovalStore = class {
 		const digest = downloadDigest(live);
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "download", options.platform ?? process.platform);
+			this.#requireKind(current, "download", options.platform ?? process.platform, options.handoffs ?? this.#handoffs);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
 			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (reason) => {
@@ -3578,125 +3894,99 @@ var AuditLog = class {
 		return out.reverse();
 	}
 };
-const MAP = {
-	inbox: "inboxes",
-	account: "accounts"
-};
+/** Every command a manifest declares — each channel's `binary` and its server's other `bins` — lowercased. */
+const SUITE_COMMANDS = new Set(CHANNEL_SNAPSHOT.flatMap(({ manifest }) => [manifest.binary, ...manifest.server.bins ?? []]).map((name) => name.toLowerCase()));
+/** The extensions Windows finds an executable by: `agent-gmail.cmd` is `agent-gmail`. */
+const EXECUTABLE_EXTENSION = /\.(?:cmd|exe|bat|ps1|com)$/i;
 /**
-* An own property only.
-*
-* A name is user input and the maps are plain objects, so `config.inboxes.constructor` is a function — and a lookup
-* of an inbox called `constructor`, which version 1 allows, found it.
+* The suite command a word names as a program — its last path part, without a Windows extension, compared without
+* case as Windows compares executable names — or null.
 */
-function own$1(map, key) {
-	return Object.hasOwn(map, key) ? map[key] : void 0;
+function suiteCommandOf(word) {
+	const name = (word.split(/[\\/]/).at(-1) ?? "").replace(EXECUTABLE_EXTENSION, "").toLowerCase();
+	return SUITE_COMMANDS.has(name) ? name : null;
 }
-function resolveName(config, kind, name, notFound) {
-	if (kind === "inbox") {
-		const inbox = own$1(config.inboxes, name);
-		if (inbox) return {
-			alias: name,
-			inbox
-		};
-	} else {
-		const account = own$1(config.accounts, name);
-		if (account) return {
-			alias: name,
-			account
-		};
-	}
-	const renamed = formerNameRefusal(config, kind, name);
-	if (renamed) throw renamed;
-	throw notFound?.() ?? defaultNotFound(config, kind, name);
-}
-/** What to say when there are no mailboxes at all: the command that connects one, from the mail channel's manifest. */
-function noInboxesHint() {
-	const connect = connectMailboxCommand();
-	return connect ? `No inboxes yet: add one with \`${connect}\`.` : "No inboxes yet.";
+/** A parsed `package.json`, as an object, or null when there is none, it cannot be read, or it is not an object. */
+function readPackageManifest(dir) {
+	const read = readPackageFile(dir);
+	return read === "absent" ? null : read;
 }
-function defaultNotFound(config, kind, name) {
-	if (kind === "inbox") {
-		const known = Object.keys(config.inboxes);
-		return new CommsError("NOT_FOUND", `no inbox called "${name}"`, { hint: known.length ? `Known inboxes: ${known.join(", ")}.` : noInboxesHint() });
+/** `absent` when the directory has no `package.json`; otherwise what it says, or null when that cannot be read. */
+function readPackageFile(dir) {
+	let text;
+	try {
+		text = readFileSync(join(dir, "package.json"), "utf8");
+	} catch (error) {
+		const code = error.code;
+		return code === "ENOENT" || code === "ENOTDIR" ? "absent" : null;
+	}
+	try {
+		const parsed = JSON.parse(text);
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
 	}
-	return new CommsError("NOT_FOUND", `no account called "${name}"`);
-}
-function lookupName(config, kind, name) {
-	return kind === "inbox" ? own$1(config.inboxes, name) : own$1(config.accounts, name);
 }
-function findById(config, kind, id) {
-	if (kind === "inbox") {
-		for (const [alias, inbox] of Object.entries(config.inboxes)) if (inbox.id === id) return {
-			alias,
-			inbox
+/**
+* The nearest package at or above `start`: the first directory with a `package.json`, and what it says (null when it
+* cannot be read or parsed). Not the nearest one with a particular name — the package a module belongs to is the
+* nearest one, as Node itself decides, and a caller that names a different one has to be told so.
+*/
+function nearestPackage(start) {
+	let dir = resolve(start);
+	for (;;) {
+		const manifest = readPackageFile(dir);
+		if (manifest !== "absent") return {
+			root: dir,
+			manifest
 		};
-	} else for (const [alias, account] of Object.entries(config.accounts)) if (account.id === id) return {
-		alias,
-		account
-	};
-	return null;
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
 }
 /**
-* The refusal for a former name, or null when `name` is not one.
-*
-* The replacement is looked up by id rather than read from the record, so a chain of renames ends at the name the
-* account has today — and an account removed since its rename is said to be gone, rather than pointing somebody at a
-* name that now belongs to nothing.
+* Whether `path` is `root` or inside it, by whole path segments: `/x/core-evil` is not inside `/x/core`, which a
+* comparison of strings would say it was. Both are taken as given; a caller compares real paths with real paths.
 */
-function formerNameRefusal(config, kind, name) {
-	if (config.version !== 2) return null;
-	const former = own$1(config.formerNames[MAP[kind]], name);
-	if (!former) return null;
-	const current = kind === "inbox" ? findById(config, "inbox", former.id) : findById(config, "account", former.id);
-	if (!current) return new CommsError("NOT_FOUND", `"${name}" was renamed to "${former.name}", which has since been removed`, { details: {
-		formerName: name,
-		id: former.id
-	} });
-	return new CommsError("NOT_FOUND", `"${name}" was renamed to "${current.alias}"`, {
-		hint: `Use "${current.alias}".`,
-		details: {
-			formerName: name,
-			currentName: current.alias,
-			id: former.id
-		}
-	});
+function isWithin(root, path) {
+	const between = relative(resolve(root), resolve(path));
+	return between === "" || !isAbsolute(between) && between !== ".." && !/^\.\.[\\/]/.test(between);
+}
+/** The real path of `path`, or of its deepest ancestor that exists with the rest joined on; null when none does. */
+function realpathOfExisting(path) {
+	let current = resolve(path);
+	const rest = [];
+	for (;;) try {
+		const real = realpathSync(current);
+		return rest.length === 0 ? real : join(real, ...rest.reverse());
+	} catch {
+		const parent = dirname(current);
+		if (parent === current) return null;
+		rest.push(basename(current));
+		current = parent;
+	}
 }
 /**
-* Whether `name` may be given to a new or renamed account of this kind and platform.
-*
-* Each version keeps its own rule, because version 1's differ by kind today and must not change under a file an
-* older release also writes: a mailbox name need only be free among mailboxes, a workspace name among both. Version
-* 2 is stricter and the same for both: the grammar, the platform, free in both maps, and never a former name of
-* either kind.
-*
-* A check, not a reservation. Callers repeat it inside the config write, where the schema enforces the same rules
-* again for version 2, because anything can happen between asking and writing.
+* The root of the suite package `path` is in — itself or any ancestor whose `package.json` names a package of this
+* suite — as written and after resolving links, or null. Every ancestor is looked at, not only the nearest package:
+* a file in `packages/gmail/node_modules/x` is still inside Gmail's root.
 */
-function nameAvailable(config, kind, name, platform) {
-	const refuse = (error) => ({
-		ok: false,
-		error
-	});
-	if (config.version === 1) {
-		if (RESERVED_ALIASES.has(name)) return refuse(new CommsError("USAGE", `"${name}" is reserved`, { hint: "Choose another name." }));
-		if (!isValidAlias(name)) return refuse(new CommsError("USAGE", `"${name}" is not a usable name`, { hint: "Lower-case letters, digits and dashes, up to 32 characters, not starting with a dash." }));
-		if (kind === "inbox" ? own$1(config.inboxes, name) : own$1(config.inboxes, name) ?? own$1(config.accounts, name)) return refuse(new CommsError("CONFIG", `"${name}" is already connected`, { hint: "Choose another name." }));
-		return { ok: true };
-	}
-	const problem = nameShapeProblem(name, platform);
-	if (problem) return refuse(new CommsError("USAGE", problem));
-	if (own$1(config.inboxes, name) || own$1(config.accounts, name)) return refuse(new CommsError("CONFIG", `"${name}" is already connected`, { hint: "Choose another name." }));
-	for (const map of ["inboxes", "accounts"]) {
-		const former = own$1(config.formerNames[map], name);
-		if (former) return refuse(new CommsError("CONFIG", `"${name}" was the name of another account and cannot be used again`, {
-			hint: "A former name keeps pointing people at the account that had it. Choose another name.",
-			details: {
-				formerName: name,
-				id: former.id
-			}
-		}));
+function suitePackageRootOf(path) {
+	const candidates = [resolve(path)];
+	const real = realpathOfExisting(path);
+	if (real !== null && real !== candidates[0]) candidates.push(real);
+	for (const candidate of candidates) {
+		let dir = candidate;
+		for (;;) {
+			const name = readPackageManifest(dir)?.name;
+			if (typeof name === "string" && name.startsWith("@agentcomms/")) return dir;
+			const parent = dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
 	}
-	return { ok: true };
+	return null;
 }
 /**
 * Enough of TOML to read codex's `config.toml`, and a refusal for anything else.
@@ -4332,10 +4622,126 @@ async function scanRegisteredServers(env = process.env, platform = process.platf
 	};
 }
 function packageFrom(server) {
-	const line = [server.command, ...server.args].join(" ");
+	return commandLinePackage(server.command, server.args);
+}
+/**
+* The npm package an entry's command line launches, when one can be read from it: `@scope/name`, or a bare `…-mcp`.
+* Read from the words left once the suite's path options are taken out (`withoutPathOptions`): a pinned folder such as
+* `/tmp/@agentcomms/slack` is not a package, and read as one it made a Gmail entry Slack's.
+*/
+function commandLinePackage(command, args) {
+	const line = [command, ...withoutPathOptions(args).words].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
 /**
+* A command for a person to run that is not this suite's: `chmod`, or an MCP client's own `claude mcp …` and
+* `codex mcp …` (design 2026-10-04, D5).
+*
+* Every command printed for a person is one of two kinds. One of this suite's own CLIs is a `PrintedCommand`, which
+* only the locator makes (`cli-command.ts`): it names this Node and a checked file of the product, because a bare
+* `agent-gmail` is not on the PATH of most people it is printed for (CUE-403). Anything else is an `ExternalCommand`,
+* made here and nowhere else, with the reason that program is one a person may be told to run.
+*
+* So that this is not a way round the locator, `externalCommand` refuses words that would start one of this suite's
+* products by another route: a word containing one of the suite's commands — in any case, alone, as a path's last
+* part or inside a wrapper's payload (`sh -c "agent-gmail …"`) — a word naming a package of the suite
+* (`npx @agentcomms/gmail`), or a path inside the root of a suite package, as written or through a link
+* (`node …/packages/gmail/dist/cli.mjs`). Every word is looked at, not only the first: the program is often a wrapper.
+*
+* This module is a leaf: it reads the manifests' facts and the files a path names, and imports nothing that registers,
+* scans or locates, so nothing it refuses can be routed back through it.
+*/
+/** The gate a constructor call has to pass: only this module holds it. */
+const GATE$1 = Symbol("externalCommand");
+/**
+* One reviewed command of a program that is not this suite's. Rendered as every printed command is — a line to paste,
+* or on Windows its words as JSON when no line is safe in every shell (`inlineCommand`, `commandText`).
+*
+* A class with a private field, so the type is nominal: an object literal with the same fields is not one, and nor is
+* a spread copy of one with other words in it. Only the type is exported; the class is not.
+*/
+var ExternalCommand = class {
+	#reason;
+	/** The words, as the program is to receive them. */
+	words;
+	/** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+	line;
+	platform;
+	constructor(gate, words, platform, reason) {
+		if (gate !== GATE$1) throw new TypeError("an external command is made by externalCommand, and only there");
+		this.#reason = reason;
+		this.words = Object.freeze([...words]);
+		this.line = quoteCommand(this.words, platform).line;
+		this.platform = platform;
+		Object.freeze(this);
+	}
+	/** Why this program, which is not part of this suite, is one a person may be told to run. */
+	get reason() {
+		return this.#reason;
+	}
+	/** As JSON, the text it always was: its line, or its words as JSON with what to do (as a `PrintedCommand`). */
+	toJSON() {
+		return quotedText(this);
+	}
+	/** Never interpolated: rendered with `commandText` or `inlineCommand`. */
+	[Symbol.toPrimitive]() {
+		throw new TypeError("an external command is rendered with commandText or inlineCommand, never interpolated");
+	}
+};
+/** A package specifier of the suite, with either separator: `@agentcomms/gmail`, `node_modules\@agentcomms\gmail`. */
+const SUITE_PACKAGE = /@agentcomms[\\/]/i;
+/**
+* The parts of a word a shell or a wrapper could take as a command name: split wherever a character could not be part
+* of one, so `sh -c "cd x && agent-gmail approve"`, `--run=agent-gmail` and `C:\npm\agent-gmail.cmd` each yield
+* `agent-gmail`. Compared without case, as Windows compares executable names; on a case-sensitive system that refuses
+* a little more than it must, and nothing that it should not.
+*/
+function commandNames(word) {
+	return word.split(/[^A-Za-z0-9._-]+/).map((part) => part.replace(/^\.+|\.+$/g, "").replace(EXECUTABLE_EXTENSION, "").toLowerCase()).filter(Boolean);
+}
+/**
+* The paths in a word: the word itself, and each part of it between spaces, quotes, `=` and a shell's separators, that
+* is absolute, `~/…`, or a `file:` URL. A relative path is not resolved: the folder a person pastes the command in is
+* not known here, and a server called `7/gmail` is a name, not a path.
+*/
+function pathsIn(word) {
+	const paths = [];
+	for (const part of [word, ...word.split(/[\s"'`=;&|<>(),]+/)]) {
+		if (part.length === 0) continue;
+		if (/^file:/i.test(part)) try {
+			paths.push(fileURLToPath(part));
+		} catch {}
+		else if (part === "~" || /^~[\\/]/.test(part)) paths.push(join(homedir(), part.slice(2)));
+		else if (isAbsolute(part)) paths.push(part);
+	}
+	return paths;
+}
+/** Why these words must not be an external command, or null when they may be. */
+function refusal$1(words) {
+	for (const [index, word] of words.entries()) {
+		if (SUITE_PACKAGE.test(word)) return `word ${index} names a package of this suite`;
+		for (const path of pathsIn(word)) {
+			const root = suitePackageRootOf(path);
+			if (root !== null) return `word ${index} is a path inside ${root}, a package of this suite`;
+		}
+		if (commandNames(word).some((name) => SUITE_COMMANDS.has(name))) return `word ${index} names a command of this suite`;
+	}
+	return null;
+}
+/**
+* The one way to make an `ExternalCommand`: `words` for a program that is not this suite's, and `reason`, why a person
+* may be told to run it. Throws a `TypeError` for words that would start a product of this suite (see the module), so
+* a call site whose words come from somewhere else — a server's name read from a client's file, a folder — says what
+* to do in prose instead when one is refused. `platform` is the shell it is quoted for.
+*/
+function externalCommand(words, reason, platform = process.platform) {
+	if (words.length === 0 || (words[0] ?? "").length === 0) throw new TypeError("an external command needs a program");
+	if (reason.trim().length === 0) throw new TypeError("an external command needs the reason it may be run");
+	const refused = refusal$1(words);
+	if (refused !== null) throw new TypeError(`not an external command: ${refused}; a command of this suite comes from locateCliCommand`);
+	return new ExternalCommand(GATE$1, words, platform, reason);
+}
+/**
 * The environment a child process is started with: `env` as it is, and on Windows also
 * `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
 * program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
@@ -4434,28 +4840,55 @@ async function resolveNode(env) {
 	return await whichExecutable("node", env) ?? process.execPath;
 }
 function minimalEnv(context, node) {
-	const env = {
-		AGENT_COMMS_CONFIG_DIR: context.core.paths.configDir,
-		PATH: [
-			dirname(node),
-			"/usr/local/bin",
-			"/usr/bin",
-			"/bin"
-		].join(delimiter)
-	};
+	const env = { PATH: [
+		dirname(node),
+		"/usr/local/bin",
+		"/usr/bin",
+		"/bin"
+	].join(delimiter) };
 	if (process.platform === "linux") for (const key of ["DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR"]) {
 		const value = context.env[key];
 		if (value) env[key] = value;
 	}
 	return env;
 }
+/** The complete suite identity every installer-written server registration carries. Downloads are operation-local. */
+function registrationPathArgs(context) {
+	const { configDir, stateDir, dataDir, secretsDir } = context.core.paths;
+	return [
+		"--config-dir",
+		configDir,
+		"--state-dir",
+		stateDir,
+		"--data-dir",
+		dataDir,
+		"--secrets-dir",
+		secretsDir
+	];
+}
 function unscoped(packageName) {
 	return packageName.split("/").at(-1) ?? packageName;
 }
-function escapeRegExp$1(text) {
+function escapeRegExp$2(text) {
 	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 /**
+* An MCP client's own command about one of its entries — `claude mcp get <name>`, `codex mcp remove <name>` — in
+* backticks for a hint, or, when there is none to give, `instead`.
+*
+* The client's program, so an external command (`externalCommand`), and the name is whatever the entry is called. A
+* name that is also one of this suite's commands — the core server's own default, `agentcomms`, is one — is refused
+* there, because such a word is how a suite command would get round the locator; the hint then says the same thing in
+* words rather than printing a command with that name in it.
+*/
+function clientCommandHint(words, platform, instead) {
+	try {
+		return inlineCommand(externalCommand(words, "the MCP client's own command reads or removes an entry of its own configuration", platform));
+	} catch {
+		return instead;
+	}
+}
+/**
 * The directory the managed launcher installs one product's exact version into: `<data>/runtime/<version>-<name>`.
 *
 * Exported so that everything which reads these paths back — both doctors, `prune`, the tests — builds them here
@@ -4476,11 +4909,12 @@ function managedRuntimeEntry(dataDir, packageName, version) {
 *
 * Both `runtime/0.4.0/…` (every Gmail install before the move) and `runtime/0.4.0-gmail/…` (every install
 * since) are read, and a prerelease keeps its own hyphen: `0.5.0-rc.1-gmail` is `0.5.0-rc.1`. Either separator,
-* and allowed to start the string, so a Windows or a relative path is not missed.
+* and allowed to start the string, so a Windows or a relative path is not missed. On Windows (`platform`), whose
+* paths are not case-sensitive, the folder names are read without case; the version keeps the case it has.
 */
-function managedRuntimeVersion(path, packageName) {
-	const scope = packageName.split("/").map(escapeRegExp$1).join("[/\\\\]");
-	return new RegExp(`(?:^|[/\\\\])runtime[/\\\\]([^/\\\\]+?)(?:-${escapeRegExp$1(unscoped(packageName))})?[/\\\\]node_modules[/\\\\]${scope}[/\\\\]`).exec(path)?.[1] ?? null;
+function managedRuntimeVersion(path, packageName, platform) {
+	const scope = packageName.split("/").map(escapeRegExp$2).join("[/\\\\]");
+	return new RegExp(`(?:^|[/\\\\])runtime[/\\\\]([^/\\\\]+?)(?:-${escapeRegExp$2(unscoped(packageName))})?[/\\\\]node_modules[/\\\\]${scope}[/\\\\]`, platform === "win32" ? "i" : "").exec(path)?.[1] ?? null;
 }
 /**
 * The version one argument of a registered entry pins, or null when it pins none.
@@ -4488,10 +4922,10 @@ function managedRuntimeVersion(path, packageName) {
 * Two launchers pin, and they look nothing alike: `managed` writes a runtime path, `npx` a package spec. Reading
 * only the first reported an `npx`-pinned install as current for ever. `local` pins nothing and is ignored.
 */
-function pinnedVersion(argument, product) {
-	const names = [.../* @__PURE__ */ new Set([product.packageName, product.npxPackage])].map(escapeRegExp$1).join("|");
-	const spec = new RegExp(`^(?:${names})@(\\d[^\\s]*)$`);
-	return managedRuntimeVersion(argument, product.packageName) ?? spec.exec(argument)?.[1] ?? null;
+function pinnedVersion(argument, product, platform) {
+	const names = [.../* @__PURE__ */ new Set([product.packageName, product.npxPackage])].map(escapeRegExp$2).join("|");
+	const spec = new RegExp(`^(?:${names})@(\\d[^\\s]*)$`, platform === "win32" ? "i" : "");
+	return managedRuntimeVersion(argument, product.packageName, platform) ?? spec.exec(argument)?.[1] ?? null;
 }
 /**
 * Whether a registered entry starts this product's server.
@@ -4501,11 +4935,20 @@ function pinnedVersion(argument, product) {
 * by, compared as whole runs of segments — `@agentcomms/gmail-evil/dist/cli.mjs`, `@agentcomms/gmail/dist/
 * index.mjs` and `packages/gmail/src/nested/cli.ts` are all near misses, and each was once accepted by a looser
 * match somewhere in this repository.
+*
+* Only the entry's own words are read: the suite's path options and their values are taken out first, because a pinned
+* folder that ends in `packages/slack/src/cli.ts` is a folder, not Slack (`withoutPathOptions`). On Windows
+* (`platform`), whose file names are not case-sensitive, the command's name and every path segment are compared
+* without case, as Windows itself finds them; everywhere else exactly. Left out, it compares exactly.
 */
-function isProductServer(server, product) {
-	const launched = (server.command.split(/[\\/]+/).at(-1) ?? "").replace(/\.(?:cmd|exe|bat|ps1)$/i, "");
-	if (launched && [product.binary, ...product.bins ?? []].includes(launched)) return true;
-	if (server.packageName) return server.packageName === product.packageName || server.packageName === product.npxPackage;
+function isProductServer(server, product, platform) {
+	const fold = platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
+	const launched = fold((server.command.split(/[\\/]+/).at(-1) ?? "").replace(/\.(?:cmd|exe|bat|ps1)$/i, ""));
+	if (launched && [product.binary, ...product.bins ?? []].map(fold).includes(launched)) return true;
+	if (server.packageName) {
+		const named = fold(server.packageName);
+		return named === fold(product.packageName) || named === fold(product.npxPackage);
+	}
 	const short = unscoped(product.packageName);
 	const entries = [
 		[
@@ -4528,9 +4971,9 @@ function isProductServer(server, product) {
 		],
 		...product.entryFiles ?? []
 	];
-	return [server.command, ...server.args].some((part) => {
-		const segments = part.split(/[\\/]+/).filter(Boolean);
-		return entries.some((entry) => segments.length >= entry.length && entry.every((wanted, index) => segments[segments.length - entry.length + index] === wanted));
+	return [server.command, ...withoutPathOptions(server.args).words].some((part) => {
+		const segments = part.split(/[\\/]+/).filter(Boolean).map(fold);
+		return entries.some((entry) => segments.length >= entry.length && entry.every((wanted, index) => segments[segments.length - entry.length + index] === fold(wanted)));
 	});
 }
 /**
@@ -4626,6 +5069,7 @@ async function buildEntry(context, product, options, apply, resolved) {
 	const launcher = options.launcher ?? "managed";
 	const { node } = resolved;
 	const env = minimalEnv(context, node);
+	const pathArgs = registrationPathArgs(context);
 	const serverArgs = product.serverArgs(options);
 	if (launcher === "npx") return {
 		entry: {
@@ -4633,6 +5077,7 @@ async function buildEntry(context, product, options, apply, resolved) {
 			args: [
 				"-y",
 				`${product.npxPackage}@${product.version}`,
+				...pathArgs,
 				...product.npxArgs ?? [],
 				...serverArgs
 			],
@@ -4649,6 +5094,7 @@ async function buildEntry(context, product, options, apply, resolved) {
 				args: [
 					...entryPath.endsWith(".ts") ? ["--experimental-strip-types", "--disable-warning=ExperimentalWarning"] : [],
 					entryPath,
+					...pathArgs,
 					"mcp",
 					...serverArgs
 				],
@@ -4666,6 +5112,7 @@ async function buildEntry(context, product, options, apply, resolved) {
 				command: node,
 				args: [
 					ready ?? managedRuntimeEntry(dataDir, product.packageName, product.version),
+					...pathArgs,
 					"mcp",
 					...serverArgs
 				],
@@ -4680,6 +5127,7 @@ async function buildEntry(context, product, options, apply, resolved) {
 			command: node,
 			args: [
 				await installManagedRuntime(context, product, product.version),
+				...pathArgs,
 				"mcp",
 				...serverArgs
 			],
@@ -4764,13 +5212,17 @@ function snippetFor(client, name, entry) {
 * Project-scoped entries are not looked at: every write here targets user scope, so they are not what would be
 * replaced.
 */
-function claimName(product, options, name, existing, platform) {
+function claimName(product, options, name, existing, _platform) {
 	const taken = existing.filter((server) => server.client === options.client && server.name === name && server.scope !== "project");
 	const foreign = taken.find((server) => !isProductServer(server, product));
 	if (foreign) {
 		const what = foreign.packageName ?? (foreign.url ? displayUrl(foreign.url) : void 0) ?? (foreign.command || "something else");
 		const other = name === product.binary ? `${product.binary}-${product.defaultServerName}` : product.binary;
-		throw new CommsError("CONFIG", `${options.client} already has an MCP server called "${name}", and it is not this one (it runs ${what})`, { hint: `Register this one under another name: ${inlineCommand(installCommand$1(product, options, other, [], platform))}. --force does not replace a server this did not install.` });
+		throw refusedWithRemedy("CONFIG", `${options.client} already has an MCP server called "${name}", and it is not this one (it runs ${what})`, {
+			binary: product.binary,
+			words: installWords(product, options, other, []),
+			say: (command) => `Register this one under another name: ${command}. --force does not replace a server this did not install.`
+		});
 	}
 	if (taken.length > 0 && !options.force) {
 		for (const pin of PIN_OPTIONS) {
@@ -4778,14 +5230,22 @@ function claimName(product, options, name, existing, platform) {
 			const served = taken.map((server) => product.narrowingOf(server.args)[pin]).find(Boolean);
 			if (!wanted || !served || served === wanted) continue;
 			const second = `${product.defaultServerName}-${wanted.split("/")[0]}`;
-			throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `That entry serves ${served}; to serve ${wanted} as well, register a second entry under its own name: ${inlineCommand(installCommand$1(product, options, second === name ? `${name}-2` : second, [], platform))}.` });
+			throw refusedWithRemedy("CONFIG", `${options.client} already has this server registered as "${name}"`, {
+				binary: product.binary,
+				words: installWords(product, options, second === name ? `${name}-2` : second, []),
+				say: (command) => `That entry serves ${served}; to serve ${wanted} as well, register a second entry under its own name: ${command}.`
+			});
 		}
 		const npx = taken.some((server) => server.args.some((argument) => argument.startsWith(`${product.npxPackage}@`)));
 		const again = {
 			...keepNarrowing(product, options, taken).options,
 			launcher: options.launcher ?? (npx ? "npx" : void 0)
 		};
-		throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `Pass --force to replace it — that is how an upgrade reaches a client: ${inlineCommand(installCommand$1(product, again, name, ["--force"], platform))}.` });
+		throw refusedWithRemedy("CONFIG", `${options.client} already has this server registered as "${name}"`, {
+			binary: product.binary,
+			words: installWords(product, again, name, ["--force"]),
+			say: (command) => `Pass --force to replace it — that is how an upgrade reaches a client: ${command}.`
+		});
 	}
 	return taken;
 }
@@ -4821,20 +5281,17 @@ function keepNarrowing(product, options, previous) {
 	};
 }
 /**
-* The `mcp install` that repeats this one under `name`, with every flag that decides what the server may reach.
+* The `mcp install` that repeats this one under `name`, with every flag that decides what the server may reach: its
+* words after the program.
 *
 * The hints used to be `mcp install --client <c> --force` whatever had been asked. Refused for `--name slack-acme
 * --workspace acme/slack`, the hint registered a second server under the default name, pinned to nothing — every
 * workspace on the machine; for Gmail it dropped `--inbox` and `--read-only` the same way. Doctor's repair already
 * rebuilds these flags for exactly that reason. The product's `serverArgs` are the install command's own flags for
 * the pin and the narrowing, so they are repeated as they are.
-*
-* A pin kept from the entry being replaced was read from the client's file, which may hold anything, so on Windows the
-* command can come back with no line to paste; every hint gives it with `inlineCommand`, which shows it as words then.
 */
-function installCommand$1(product, options, name, extra, platform) {
+function installWords(product, options, name, extra) {
 	const words = [
-		product.binary,
 		"mcp",
 		"install",
 		"--client",
@@ -4844,7 +5301,24 @@ function installCommand$1(product, options, name, extra, platform) {
 	words.push(...product.serverArgs(options));
 	if (options.launcher && options.launcher !== "managed") words.push("--launcher", options.launcher);
 	words.push(...extra);
-	return shellCommand(words, platform);
+	return words;
+}
+const REMEDIES = /* @__PURE__ */ new WeakMap();
+/** The remedy a refusal of `mcp install` carries, for the operation that called it to locate; undefined for any other. */
+function installRemedyOf(error) {
+	return typeof error === "object" && error !== null ? REMEDIES.get(error) : void 0;
+}
+/**
+* A refusal whose remedy is another install: until the caller locates it, its hint says the words in prose — never a
+* command with a bare program.
+*/
+function refusedWithRemedy(code, message, remedy, options = {}) {
+	const error = new CommsError(code, message, {
+		hint: remedy.say(`its own \`mcp install\` with ${remedy.words.slice(2).join(" ")}`),
+		...options.cause === void 0 ? {} : { cause: options.cause }
+	});
+	REMEDIES.set(error, remedy);
+	return error;
 }
 /**
 * A command's exit status and what it printed, kept here and never shown: codex prints an entry's env. Started as
@@ -4887,16 +5361,16 @@ function capture$1(env, command, args) {
 * or a failure that is not "no such server", stops the install: not knowing is not the same as nothing there.
 * Nothing codex prints is repeated, because its answer carries the entry's env.
 */
-async function codexRegistration(env, binary, name, path, platform) {
-	const unknown = () => new CommsError("CONFIG", `codex would not say what it has registered as "${name}", so nothing was written`, { hint: `Look with ${inlineCommand(shellCommand([
+async function codexRegistration(env, cliPath, name, path, platform) {
+	const unknown = () => new CommsError("CONFIG", `codex would not say what it has registered as "${name}", so nothing was written`, { hint: `Look with ${clientCommandHint([
 		"codex",
 		"mcp",
 		"get",
 		name
-	], platform))}. If it is not an older copy of this server, choose another --name; \`--print\` shows the entry to add by hand.` });
+	], platform, `codex's own \`mcp get\`, for the entry called "${name}"`)}. If it is not an older copy of this server, choose another --name; \`--print\` shows the entry to add by hand.` });
 	let answer;
 	try {
-		answer = await capture$1(env, binary, [
+		answer = await capture$1(env, cliPath, [
 			"mcp",
 			"get",
 			name,
@@ -4951,15 +5425,15 @@ async function backUp(context, client, name, previous, now) {
 async function installTarget(context, options) {
 	const apply = options.apply ?? true;
 	const cliName = options.client === "claude-code" ? "claude" : options.client === "codex" ? "codex" : null;
-	const binary = cliName ? await findClientCli(cliName, context.env) : null;
+	const cliPath = cliName ? await findClientCli(cliName, context.env) : null;
 	const own = knownClientConfigs(context.env).find((file) => file.client === options.client)?.path;
 	const configPath = options.client === "claude-code" ? void 0 : own;
 	return {
 		cliName,
-		binary,
+		cliPath,
 		own,
 		configPath,
-		writes: apply && (cliName ? binary !== null : configPath !== void 0)
+		writes: apply && (cliName ? cliPath !== null : configPath !== void 0)
 	};
 }
 /**
@@ -4991,14 +5465,14 @@ async function preflightInstall(context, product, options) {
 	const scan = await scanRegisteredServers(context.env);
 	const existing = scan.servers;
 	const target = await installTarget(context, options);
-	const { binary, own, configPath, writes } = target;
+	const { cliPath, own, configPath, writes } = target;
 	if (writes) {
 		const blind = scan.unreadable.find((file) => file.path === own);
 		if (blind) throw new CommsError("CONFIG", `${blind.path} could not be read (${blind.reason}), so what is already registered there cannot be checked; nothing was written`, { hint: "Fix the file, or add the entry by hand: `--print` shows it without writing anything." });
 	}
 	let previous = writes ? claimName(product, options, name, existing, context.platform) : [];
-	if (writes && binary && options.client === "codex") {
-		const reported = await codexRegistration(context.env, binary, name, configPath ?? "codex", context.platform);
+	if (writes && cliPath && options.client === "codex") {
+		const reported = await codexRegistration(context.env, cliPath, name, configPath ?? "codex", context.platform);
 		if (reported) previous = claimName(product, options, name, [reported], context.platform);
 	}
 	const { options: effective, kept } = keepNarrowing(product, options, previous);
@@ -5043,7 +5517,7 @@ function plannedInstall(preflight) {
 	return {
 		writes: target.writes,
 		cliName: target.cliName,
-		binary: target.binary,
+		cliPath: target.cliPath,
 		configPath: target.configPath ?? null,
 		own: target.own ?? null,
 		replaces: previous.map((server) => JSON.stringify([
@@ -5077,7 +5551,7 @@ function planDrift(product, client, name, planned, now) {
 	if (planned.writes !== now.writes) {
 		if (cli !== null) drift.push(now.writes ? `${cli} was not on PATH when this was planned, and is now, so it would register the server rather than print its entry` : `${cli} was on PATH when this was planned, and is not now, so it would only print the entry`);
 		else drift.push(now.writes ? "it would write the entry rather than print it" : "it would only print the entry");
-	} else if (planned.binary !== now.binary) drift.push(`it would register through another ${cli ?? "client CLI"} than the one planned: ${now.binary}`);
+	} else if (planned.cliPath !== now.cliPath) drift.push(`it would register through another ${cli ?? "client CLI"} than the one planned: ${now.cliPath}`);
 	if (planned.configPath !== now.configPath || planned.own !== now.own) drift.push(`${client}'s config is now ${now.own ?? now.configPath ?? "nowhere"}, not ${planned.own ?? planned.configPath ?? "nowhere"}`);
 	if (JSON.stringify(planned.replaces) !== JSON.stringify(now.replaces)) drift.push(`what is registered as "${name}" is not what it was planned to replace`);
 	if (JSON.stringify(planned.narrowing) !== JSON.stringify(now.narrowing)) {
@@ -5123,22 +5597,23 @@ async function mcpInstall(context, product, options, planned) {
 		...pinsOf(planned.narrowing)
 	};
 	const existing = scan.servers;
-	const { cliName, binary, own, configPath, writes } = target;
+	const { cliName, cliPath, own, configPath, writes } = target;
 	const warnings = (product.warnAbout?.(existing.filter((server) => server.client === options.client), context.platform) ?? []).filter(Boolean);
 	if (kept.length > 0) {
-		const removal = options.client === "claude-code" ? inlineCommand(shellCommand([
+		const byHand = `delete "${name}" from ${configPath}`;
+		const removal = options.client === "claude-code" ? clientCommandHint([
 			"claude",
 			"mcp",
 			"remove",
 			name,
 			"--scope",
 			"user"
-		], context.platform)) : options.client === "codex" ? inlineCommand(shellCommand([
+		], context.platform, byHand) : options.client === "codex" ? clientCommandHint([
 			"codex",
 			"mcp",
 			"remove",
 			name
-		], context.platform)) : `delete "${name}" from ${configPath}`;
+		], context.platform, byHand) : byHand;
 		warnings.push(`Kept ${kept.join(" ")} from the "${name}" entry this replaced, because this install did not say otherwise. To register it wider on purpose, remove that entry first (${removal}), then install without them.`);
 	}
 	if (!writes) {
@@ -5166,7 +5641,7 @@ async function mcpInstall(context, product, options, planned) {
 	let method = "printed";
 	let applied = false;
 	let notApplied;
-	if (cliName && binary && writes) {
+	if (cliName && cliPath && writes) {
 		const codexEnv = (values) => Object.entries(values ?? {}).flatMap(([key, value]) => ["--env", `${key}=${value}`]);
 		const args = options.client === "claude-code" ? [
 			"mcp",
@@ -5198,13 +5673,13 @@ async function mcpInstall(context, product, options, planned) {
 				name
 			];
 			try {
-				await run(context.env, binary, removal);
+				await run(context.env, cliPath, removal);
 			} catch (error) {
 				const message = error instanceof CommsError ? error.message : String(error);
 				if (!/no (mcp )?server|not found|does not exist/i.test(message)) throw error;
 			}
 			try {
-				await run(context.env, binary, args);
+				await run(context.env, cliPath, args);
 			} catch (error) {
 				const restore = options.client === "claude-code" ? [
 					"mcp",
@@ -5228,31 +5703,36 @@ async function mcpInstall(context, product, options, planned) {
 				];
 				let restored = true;
 				try {
-					await run(context.env, binary, restore);
+					await run(context.env, cliPath, restore);
 				} catch {
 					restored = false;
 				}
-				throw new CommsError("CONFIG", restored ? `could not register "${name}"; the previous entry was put back` : `could not register "${name}", and the previous entry could not be put back either — ${cliName} now has no server called "${name}"`, {
-					hint: restored ? "Check the client is not running, then try again." : `Re-register it with ${inlineCommand(installCommand$1(product, effective, name, [], context.platform))}. The old entry is in ${backupPath}.`,
+				if (restored) throw new CommsError("CONFIG", `could not register "${name}"; the previous entry was put back`, {
+					hint: "Check the client is not running, then try again.",
 					cause: error
 				});
+				throw refusedWithRemedy("CONFIG", `could not register "${name}", and the previous entry could not be put back either — ${cliName} now has no server called "${name}"`, {
+					binary: product.binary,
+					words: installWords(product, effective, name, []),
+					say: (command) => `Re-register it with ${command}. The old entry is in ${backupPath}.`
+				}, { cause: error });
 			}
 		} else try {
-			await run(context.env, binary, args);
+			await run(context.env, cliPath, args);
 		} catch (error) {
 			const message = error instanceof CommsError ? error.message : String(error);
 			if (/already exists/i.test(message)) throw new CommsError("CONFIG", `${cliName} already has an MCP server called "${name}", somewhere this could not read`, {
-				hint: `Look at it with ${inlineCommand(shellCommand([
+				hint: `Look at it with ${clientCommandHint([
 					cliName,
 					"mcp",
 					"get",
 					name
-				], context.platform))}. If it is an older ${product.binary}, remove it with ${inlineCommand(shellCommand([
+				], context.platform, `${cliName}'s own \`mcp get\`, for the entry called "${name}"`)}. If it is an older copy of this server, remove it with ${clientCommandHint([
 					cliName,
 					"mcp",
 					"remove",
 					name
-				], context.platform))} and run this again; if not, choose another --name.`,
+				], context.platform, `${cliName}'s own \`mcp remove\``)} and run this again; if not, choose another --name.`,
 				cause: error
 			});
 			throw error;
@@ -5527,46 +6007,964 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 			});
 			continue;
 		}
-		if (!result.dryRun) await rm(path, { recursive: true });
-		result.removed.push({
-			path,
-			version
-		});
-	}
-	if (options.includePrinted && !result.dryRun && result.removed.length > 0) {
-		const gone = result.removed.map((item) => item.path);
-		const left = handedOut.filter((record) => !gone.some((path) => mentions([path], record.runtime)));
-		if (left.length !== handedOut.length) await writeFileAtomic(ledger, left.map((record) => `${JSON.stringify(record)}\n`).join(""));
-	}
-	return result;
+		if (!result.dryRun) await rm(path, { recursive: true });
+		result.removed.push({
+			path,
+			version
+		});
+	}
+	if (options.includePrinted && !result.dryRun && result.removed.length > 0) {
+		const gone = result.removed.map((item) => item.path);
+		const left = handedOut.filter((record) => !gone.some((path) => mentions([path], record.runtime)));
+		if (left.length !== handedOut.length) await writeFileAtomic(ledger, left.map((record) => `${JSON.stringify(record)}\n`).join(""));
+	}
+	return result;
+}
+/** Every runtime the installer handed out, or null when the record is there and cannot be read. */
+async function readHandedOut(path) {
+	let text;
+	try {
+		text = await readFile(path, "utf8");
+	} catch (error) {
+		return error.code === "ENOENT" ? [] : null;
+	}
+	const records = [];
+	for (const line of text.split("\n")) {
+		if (!line.trim()) continue;
+		try {
+			const record = JSON.parse(line);
+			if (typeof record.runtime !== "string") return null;
+			records.push({
+				at: String(record.at ?? ""),
+				client: String(record.client ?? ""),
+				name: String(record.name ?? ""),
+				runtime: record.runtime,
+				...typeof record.config === "string" ? { config: record.config } : {},
+				...record.applied === true ? { applied: true } : {}
+			});
+		} catch {
+			return null;
+		}
+	}
+	return records;
+}
+/** A channel's registration facts, from its manifest. */
+function registrationFactsOf({ packageName, manifest }) {
+	return {
+		packageName,
+		npxPackage: manifest.server.npxPackage,
+		binary: manifest.binary,
+		...manifest.server.bins === void 0 ? {} : { bins: manifest.server.bins },
+		...manifest.server.entryFiles === void 0 ? {} : { entryFiles: manifest.server.entryFiles }
+	};
+}
+/** How a registered entry starts its server: the launcher `mcp install` wrote it with, or `other` for one it did not. */
+function launcherOf(server, facts, platform) {
+	const fold = folding(platform);
+	const parts = [server.command, ...server.args];
+	if (parts.some((part) => managedRuntimeVersion(part, facts.packageName, platform) !== null)) return "managed";
+	if (server.args.some((arg) => fold(arg).startsWith(fold(`${facts.npxPackage}@`)))) return "npx";
+	const local = new RegExp("[/\\\\]packages[/\\\\][^/\\\\]+[/\\\\](?:src[/\\\\]cli\\.ts|dist[/\\\\]cli\\.mjs)$", platform === "win32" ? "i" : "");
+	if (parts.some((part) => local.test(part))) return "local";
+	return "other";
+}
+/** The version an entry pins — a managed runtime's or an npx spec's — or null for one that pins none. */
+function registrationVersion(server, facts, platform) {
+	return server.args.map((arg) => pinnedVersion(arg, facts, platform)).find((found) => found !== null) ?? null;
+}
+PATH_OPTIONS.filter(({ key }) => key !== "downloadsDir");
+/**
+* Whether an entry starts this product, judged on its own words: the suite's path options and their values are taken
+* out, and the package its command line launches is read again from what is left rather than taken from the entry.
+* A folder pinned as `/tmp/@agentcomms/slack` never makes a Gmail registration Slack's.
+*/
+function startsProduct(server, facts, platform) {
+	const { words: args } = withoutPathOptions(server.args);
+	const packageName = commandLinePackage(server.command, args);
+	return isProductServer({
+		command: server.command,
+		args,
+		...packageName === void 0 ? {} : { packageName }
+	}, facts, platform);
+}
+/**
+* A command's name as Windows finds it — its last path segment without `.cmd`, `.exe`, `.bat` or `.ps1` — without case
+* on Windows (`platform`), and exactly elsewhere.
+*/
+function commandStem(command, platform) {
+	return folding(platform)((command.split(/[\\/]+/).at(-1) ?? "").replace(/\.(?:cmd|exe|bat|ps1)$/i, ""));
+}
+/** Whether npx runs the entry: its program is npx, or it names the product's package at a version, as npx does. */
+function isNpxRegistration(server, facts, platform) {
+	return commandStem(server.command, platform) === "npx" || launcherOf(server, facts, platform) === "npx";
+}
+/**
+* The files an entry names as what it starts, as it writes them: every script among its words before `--` once the
+* path options are out (an interpreter's flags may name one too, so each is a candidate, not the answer), and its
+* program when that is one of the product's own commands — a link into the package, or a script npm wrote beside it.
+*/
+function registrationFiles(server, facts, platform) {
+	const { words } = withoutPathOptions(server.args);
+	const sentinel = words.indexOf("--");
+	const options = sentinel < 0 ? words : words.slice(0, sentinel);
+	const fold = folding(platform);
+	return {
+		scripts: options.flatMap((word) => [word, ...word.startsWith("--") && word.includes("=") ? [word.slice(word.indexOf("=") + 1)] : []]).filter((word) => !word.startsWith("-") && /\.(?:[cm]?js|[cm]?ts)$/i.test(word)),
+		command: [facts.binary, ...facts.bins ?? []].map(fold).includes(commandStem(server.command, platform)) ? server.command : null
+	};
+}
+function folding(platform) {
+	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
+}
+/** The package version, read from package.json at build time. */
+const VERSION = "0.13.1";
+/**
+* Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
+* to decide whether the release it last heard of is newer than the one running.
+*
+* Here rather than in `npm.ts`, which also talks to the registry: the reader of `update-check.json` is imported by
+* every server, WhatsApp's included, and must carry no network code at all (design 2026-09-28 §1). `npm.ts` re-exports
+* all of it, so nothing that imported these from there changes.
+*/
+/**
+* A version, exactly as semver writes one: `1.2.3`, `1.2.3-rc.1`, `1.2.3+build`.
+*
+* Anything the registry answers is checked against this before it is used, because a version goes into a directory
+* name (`runtime/<version>-gmail`), a sentence a person approves, and an argument to `npm install`. A registry — or a
+* mirror somebody configured — that answered `../x` or `1.0.0 && …` would otherwise put that in all three.
+*/
+const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function isVersion(value) {
+	return typeof value === "string" && VERSION_PATTERN.test(value);
+}
+/** Two numeric strings with no leading zeros, compared as numbers of any size. */
+function compareNumeric(a, b) {
+	if (a.length !== b.length) return a.length < b.length ? -1 : 1;
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+/**
+* Semver precedence: -1, 0 or 1, or null when either is not a version.
+*
+* Numbers compare as numbers (`0.10.0` is after `0.9.9`), a prerelease comes before its release, and build metadata
+* counts for nothing. Written out rather than taken from a dependency: it is twenty lines, and the core installs as
+* few packages as it can.
+*/
+function compareVersions(a, b) {
+	const left = VERSION_PATTERN.exec(a);
+	const right = VERSION_PATTERN.exec(b);
+	if (!left || !right) return null;
+	for (const index of [
+		1,
+		2,
+		3
+	]) {
+		const order = compareNumeric(left[index] ?? "0", right[index] ?? "0");
+		if (order !== 0) return order < 0 ? -1 : 1;
+	}
+	const pre = (match) => match[4] === void 0 ? [] : match[4].split(".");
+	const [ours, theirs] = [pre(left), pre(right)];
+	if (ours.length === 0 || theirs.length === 0) return ours.length === theirs.length ? 0 : ours.length === 0 ? 1 : -1;
+	for (let index = 0; index < Math.max(ours.length, theirs.length); index += 1) {
+		const x = ours[index];
+		const y = theirs[index];
+		if (x === void 0) return -1;
+		if (y === void 0) return 1;
+		const [numericX, numericY] = [/^\d+$/.test(x), /^\d+$/.test(y)];
+		if (numericX && numericY) {
+			const order = compareNumeric(x, y);
+			if (order !== 0) return order < 0 ? -1 : 1;
+		} else if (numericX !== numericY) return numericX ? -1 : 1;
+		else if (x !== y) return x < y ? -1 : 1;
+	}
+	return 0;
+}
+/** Whether `version` is older than `latest`: by semver when both are versions, and otherwise whenever they differ. */
+function isBehind(version, latest) {
+	if (version === latest) return false;
+	const order = compareVersions(version, latest);
+	return order === null ? true : order < 0;
+}
+/**
+* Whether a version is a prerelease — `0.8.0-rc.1` — which the daily update check never counts as an update: a
+* machine is not told to "update" to a release candidate, nor a candidate told to go back to the last release.
+*/
+function isPrerelease(version) {
+	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
+}
+/**
+* Whether `version` is within a package's `engines` range: true or false, or null when the range is not one this reads.
+*
+* Read are the comparators `>=`, `>`, `<=`, `<` and `=` (or none) before a whole version, joined by spaces, which must
+* all hold, and alternatives joined by `||`. That is every range this suite declares (`>=22.12.0`, `>=22.16.0`).
+* Anything else — `^22.12.0`, `>=22`, `22.x` — is null rather than a guess: a command printed to run under this Node
+* is printed only when the range it has to meet says it may. A leading `v`, as `process.version` has it, is read.
+*/
+function satisfiesRange(version, range) {
+	const wanted = version.replace(/^v/, "");
+	if (!isVersion(wanted)) return null;
+	const alternatives = range.split("||").map((alternative) => alternative.trim().split(/\s+/).filter(Boolean));
+	if (alternatives.some((comparators) => comparators.length === 0)) return null;
+	let any = false;
+	for (const comparators of alternatives) {
+		let all = true;
+		for (const comparator of comparators) {
+			const match = /^(>=|<=|>|<|=)?(.+)$/.exec(comparator);
+			const bound = match?.[2] ?? "";
+			if (!isVersion(bound)) return null;
+			const order = compareVersions(wanted, bound);
+			if (!(match?.[1] === ">=" ? order >= 0 : match?.[1] === "<=" ? order <= 0 : match?.[1] === ">" ? order > 0 : match?.[1] === "<" ? order < 0 : order === 0)) all = false;
+		}
+		if (all) any = true;
+	}
+	return any;
+}
+/**
+* The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
+*
+* A bare `agent-gmail approve …` is not runnable for most of the people it is printed for: a package run by npx, by a
+* managed runtime or from a checkout puts nothing on their PATH. So every such command names this process's Node and
+* a checked file of the product it runs, with the suite directories it uses pinned as options — and when no file can
+* be checked, there is no command at all, only a sentence saying what is missing. The caller says which package it is
+* and what to run; it never supplies the program or quotes the line.
+*
+* Three directions. A product's own CLI is found from the product itself, walking from one of its own modules to its
+* manifest: no registration is ever asked. A channel's handoff to core is found the way the channel itself finds core,
+* through its installed dependency, and only the same release. Another product's command is found among the servers
+* registered with the person's MCP clients, which the caller scanned and passes in: only a file-backed registration of
+* exactly the printing package's version, checked on disk. Nothing a registration names is run, or asked anything —
+* not even its interpreter for a version: no installer wrote down where a scanned entry came from, so none is trusted
+* to run (D1). This module never scans, spawns or probes.
+*
+* What is checked is checked when the command is printed, not for ever (D6): the file it names is real, readable and
+* inside its package then, and a later change to that installation is a later fact.
+*/
+/** The gate a constructor call has to pass: only this module holds it. */
+const GATE = Symbol("locateCliCommand");
+/**
+* A command that runs one of this suite's own CLIs, made only by `locateCliCommand`. Rendered as every printed command
+* is — a line to paste, or on Windows its words as JSON when no line is safe in every shell (`inlineCommand`,
+* `commandText`).
+*
+* A class with a private field, so the type is nominal: an object literal with the same fields is not one, and nor is
+* a spread copy of one with other words in it, as it would be with a symbol-keyed brand. Only the type is exported;
+* the class and its gate are not.
+*/
+var PrintedCommand = class {
+	#entry;
+	/** The words, as the program is to receive them: this Node, its flags, the entry, then the CLI's own words. */
+	words;
+	/** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+	line;
+	platform;
+	constructor(gate, words, platform, entry) {
+		if (gate !== GATE) throw new TypeError("a printed command is made by locateCliCommand, and only there");
+		this.#entry = entry;
+		this.words = Object.freeze([...words]);
+		this.line = quoteCommand(this.words, platform).line;
+		this.platform = platform;
+		Object.freeze(this);
+	}
+	/**
+	* The real path of the file it runs, as it was checked when the command was located: a fact about then (D6). The
+	* command names this path and nothing else, so what runs is whatever is there when the person runs it.
+	*/
+	get entry() {
+		return this.#entry;
+	}
+	/**
+	* As JSON — a result's field written out by `--json`, or returned to an MCP client — it is the text it always was:
+	* its line, or its words as JSON with what to do when no Windows line is safe (`commandText`). Rendered where it
+	* leaves the process, so a field can hold the command itself and the wire stays the same.
+	*/
+	toJSON() {
+		return quotedText(this);
+	}
+	/** Never interpolated: a sentence gives a command through `handoffSentence`, a value through `handoffText`. */
+	[Symbol.toPrimitive]() {
+		throw new TypeError("a printed command is rendered with handoffText or handoffSentence, never interpolated");
+	}
+};
+const STRIP_TYPES = "--experimental-strip-types";
+const TRANSFORM_TYPES = "--experimental-transform-types";
+/** The suite's packages, by name, and its channel packages, which reach core through their own dependency on it. */
+const SUITE_PACKAGES = new Set(CHANNEL_SNAPSHOT.map(({ packageName }) => packageName));
+const CHANNEL_PACKAGES$1 = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manifest.channel !== "core").map(({ packageName }) => packageName));
+/**
+* Locates the command that runs `request.target`'s CLI with `request.words`, or says why there is none.
+*
+* The program is always this process's Node (`process.execPath`), which must satisfy the target's `engines.node`; no
+* interpreter named anywhere else is run, or asked its version. A TypeScript entry gets `--experimental-strip-types`,
+* which Node 22.12–22.17 needs, and `--experimental-transform-types` only when this source run was started with it;
+* no other flag this process was started with is carried — debug, preload, condition and memory flags are not what the
+* CLI needs. The suite directories the command uses go between the entry and its words, one canonical option each,
+* before any `--`.
+*
+* Synchronous, so a hint or a renderer can call it where it builds its sentence; for another product the caller scans
+* the registrations first and passes them in (`request.registrations`).
+*/
+function locateCliCommand(request, runtime = {
+	version: process.version,
+	execArgv: process.execArgv
+}) {
+	const { caller, target } = request;
+	const [first] = request.words;
+	if (first !== void 0 && (isAbsolute(first) || suiteCommandOf(first) !== null)) throw new TypeError(`the words to run start after the program: ${JSON.stringify(first)} is one`);
+	const platform = request.platform ?? process.platform;
+	let version = VERSION;
+	const fail = (reason, detail, extra = {}) => notLocated(target, version, reason, detail, runtime.version, extra);
+	let callerFile;
+	try {
+		callerFile = fileURLToPath(caller.url);
+	} catch {
+		return fail("caller", `${caller.url} is not a module on this machine`);
+	}
+	const callerSource = callerFile.endsWith(".ts");
+	const nearest = nearestPackage(dirname(callerFile));
+	const callerManifest = nearest?.manifest ?? null;
+	if (nearest === null || callerManifest === null || callerManifest.name !== caller.packageName) {
+		const name = typeof callerManifest?.name === "string" ? callerManifest.name : "no named package";
+		return fail("manifest", `the package ${callerFile} belongs to is ${name}, not ${caller.packageName}`);
+	}
+	const callerVersion = typeof callerManifest.version === "string" ? callerManifest.version : null;
+	if (callerVersion !== null) version = callerVersion;
+	let callerRoot;
+	try {
+		callerRoot = realpathSync(nearest.root);
+	} catch {
+		return fail("caller", `${nearest.root} cannot be resolved`);
+	}
+	if (!isAbsolute(process.execPath)) return fail("interpreter", `this Node, ${process.execPath}, is not a full path`);
+	const pins = {};
+	for (const key of request.uses) pins[key] = request.paths[key];
+	let words;
+	try {
+		words = normalizePathOptionWords(request.words, pins, 0);
+	} catch (error) {
+		return fail("arguments", error instanceof Error ? error.message : String(error));
+	}
+	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform);
+	const located = (built, found, direction) => Object.freeze({
+		ok: true,
+		command: built.command,
+		basis: Object.freeze({
+			callerSource,
+			callerRoot,
+			callerVersion,
+			targetRoot: found.root,
+			targetVersion: typeof found.manifest.version === "string" ? found.manifest.version : null,
+			callerWorkspace: null,
+			targetWorkspace: null,
+			entryKind: built.entryKind,
+			...direction
+		})
+	});
+	if (caller.packageName === target.packageName) {
+		const found = {
+			root: callerRoot,
+			manifest: callerManifest,
+			source: callerSource
+		};
+		const built = build(found);
+		if (!built.ok) return fail(built.reason, built.detail, { nodeRange: built.nodeRange });
+		return located(built, found, {
+			direction: "own",
+			sameCheckout: true
+		});
+	}
+	if (target.manifest.channel === "core" && CHANNEL_PACKAGES$1.has(caller.packageName)) {
+		const installed = installedPackage(dirname(callerFile), target.packageName);
+		if (installed === null) return fail("core", `${caller.packageName} has no ${target.packageName} installed where it can find one`);
+		const manifest = readPackageManifest(installed);
+		if (manifest === null || manifest.name !== target.packageName) return fail("manifest", `the package found as ${target.packageName}, at ${installed}, is not that package`);
+		if (manifest.version !== version) {
+			const theirs = typeof manifest.version === "string" ? manifest.version : "of no version";
+			return fail("version", `${caller.packageName} ${version} finds ${target.packageName} ${theirs}, at ${installed}`);
+		}
+		const callerWorkspace = workspaceOf(callerRoot);
+		const targetWorkspace = workspaceOf(installed);
+		const sameCheckout = callerWorkspace !== null && callerWorkspace === targetWorkspace;
+		const found = {
+			root: installed,
+			manifest,
+			source: callerSource && sameCheckout
+		};
+		const built = build(found);
+		if (!built.ok) return fail(built.reason, built.detail, { nodeRange: built.nodeRange });
+		return located(built, found, {
+			direction: "channel-to-core",
+			callerWorkspace,
+			targetWorkspace,
+			sameCheckout
+		});
+	}
+	if (!SUITE_PACKAGES.has(caller.packageName)) return fail("direction", `${caller.packageName} is not a package of this suite`);
+	if (request.registrations === void 0) return fail("no-registrations", "nothing registered was given to look through for another product's command");
+	const facts = registrationFactsOf(target);
+	const notUsed = [];
+	const usable = [];
+	let engineRange;
+	for (const server of request.registrations) {
+		if (!startsProduct(server, facts, platform)) continue;
+		const reject = (why) => notUsed.push(Object.freeze({
+			client: server.client,
+			path: server.path,
+			name: server.name,
+			why
+		}));
+		if (isNpxRegistration(server, facts, platform)) {
+			reject("npx");
+			continue;
+		}
+		if (withoutPathOptions(server.args).dangling) {
+			reject("arguments");
+			continue;
+		}
+		const launcher = launcherOf(server, facts, platform);
+		const files = registrationFiles(server, facts, platform);
+		if (![...files.scripts, ...files.command === null ? [] : [files.command]].some((file) => isAbsolute(file))) {
+			reject("no-file");
+			continue;
+		}
+		const found = registeredPackage(files, target, facts);
+		if (found === null) {
+			reject("no-package");
+			continue;
+		}
+		const managedAt = launcher === "managed" ? registrationVersion(server, facts, platform) : version;
+		if (found.manifest.version !== version || managedAt !== version) {
+			reject("version");
+			continue;
+		}
+		const built = build(found);
+		if (!built.ok) {
+			reject(built.reason);
+			if (built.reason === "engine") engineRange ??= built.nodeRange;
+			continue;
+		}
+		usable.push({
+			server,
+			launcher,
+			built,
+			found
+		});
+	}
+	const rank = ({ server, launcher }) => [
+		launcher === "managed" ? "0" : "1",
+		server.client,
+		server.path,
+		server.name,
+		server.command,
+		...server.args
+	];
+	const [best] = usable.sort((a, b) => compareWords(rank(a), rank(b)));
+	if (best === void 0) {
+		if (engineRange !== void 0) return fail("engine", `it needs Node ${engineRange}, and this is Node ${runtime.version}`, {
+			nodeRange: engineRange,
+			registrations: notUsed
+		});
+		return fail("not-registered", notRegistered(notUsed, version), { registrations: notUsed });
+	}
+	const { client, path, name } = best.server;
+	return located(best.built, best.found, {
+		direction: "cross-product",
+		sameCheckout: false,
+		registration: Object.freeze({
+			client,
+			path,
+			name,
+			launcher: best.launcher
+		})
+	});
+}
+/**
+* Checks what was found and makes its command: the target's Node range against this Node, then the entry — the source
+* CLI or the manifest's bin for the command it declares — as a readable file inside its package.
+*/
+function buildCommand(target, found, words, runtime, callerSource, platform) {
+	const engines = found.manifest.engines;
+	const range = typeof engines === "object" && engines !== null ? engines.node : void 0;
+	if (typeof range !== "string") return {
+		ok: false,
+		reason: "engine",
+		detail: `${target.packageName} at ${found.root} declares no Node range this can check`
+	};
+	if (satisfiesRange(runtime.version, range) !== true) return {
+		ok: false,
+		reason: "engine",
+		detail: `it needs Node ${range}, and this is Node ${runtime.version}`,
+		nodeRange: range
+	};
+	let entry;
+	if (found.source) entry = join(found.root, "src", "cli.ts");
+	else {
+		const declared = found.manifest.agentcomms;
+		const binary = typeof declared === "object" && declared !== null ? declared.binary : void 0;
+		const bin = found.manifest.bin;
+		const path = binary === target.manifest.binary && typeof bin === "object" && bin !== null && Object.hasOwn(bin, target.manifest.binary) ? bin[target.manifest.binary] : void 0;
+		if (typeof path !== "string" || path.length === 0) return {
+			ok: false,
+			reason: "bin",
+			detail: `the bin of ${target.packageName} at ${found.root} does not name the command it declares`
+		};
+		entry = resolve(found.root, path);
+	}
+	const checked = checkedEntry(found.root, entry);
+	if (checked.ok === false) return {
+		ok: false,
+		reason: "entry",
+		detail: checked.why
+	};
+	const flags = /\.[cm]?ts$/.test(checked.path) ? [STRIP_TYPES, ...callerSource && runtime.execArgv.includes(TRANSFORM_TYPES) ? [TRANSFORM_TYPES] : []] : [];
+	return {
+		ok: true,
+		command: new PrintedCommand(GATE, [
+			process.execPath,
+			...flags,
+			checked.path,
+			...words
+		], platform, checked.path),
+		entryKind: found.source ? "source" : "bin"
+	};
+}
+/**
+* The target's package a registration's files lead to, or null: a script it starts, real or as written when it is
+* gone, inside the package (or inside the product's own server wrapper, which depends on it); or, for the product's
+* own command, the package that command links into or that npm installed beside it.
+*/
+function registeredPackage(files, target, facts) {
+	for (const script of files.scripts) {
+		if (!isAbsolute(script)) continue;
+		const found = packageAround(script, target, facts);
+		if (found !== null) {
+			const source = join(found.root, "src", "cli.ts");
+			const real = realpathOfExisting(script);
+			return {
+				...found,
+				source: real !== null && sameFile(real, source)
+			};
+		}
+	}
+	const { command } = files;
+	if (command === null || !isAbsolute(command)) return null;
+	const linked = packageAround(command, target, facts);
+	if (linked !== null) return {
+		...linked,
+		source: false
+	};
+	const dir = dirname(command);
+	for (const candidate of [join(dir, "node_modules"), join(dir, "..", "lib", "node_modules")]) {
+		let root;
+		try {
+			root = realpathSync(join(candidate, ...target.packageName.split("/")));
+		} catch {
+			continue;
+		}
+		const manifest = readPackageManifest(root);
+		if (manifest?.name === target.packageName) return {
+			root,
+			manifest,
+			source: false
+		};
+	}
+	return null;
+}
+/** The target's package that `file` is in — directly, or through the product's server wrapper, which depends on it. */
+function packageAround(file, target, facts) {
+	const real = realpathOfExisting(file);
+	if (real === null) return null;
+	const nearest = nearestPackage(dirname(real));
+	if (nearest === null || nearest.manifest === null) return null;
+	let root;
+	try {
+		root = realpathSync(nearest.root);
+	} catch {
+		return null;
+	}
+	if (nearest.manifest.name === target.packageName) return {
+		root,
+		manifest: nearest.manifest
+	};
+	if (facts.npxPackage === target.packageName || nearest.manifest.name !== facts.npxPackage) return null;
+	const installed = installedPackage(root, target.packageName);
+	const manifest = installed === null ? null : readPackageManifest(installed);
+	return installed !== null && manifest?.name === target.packageName ? {
+		root: installed,
+		manifest
+	} : null;
+}
+function sameFile(a, b) {
+	try {
+		return realpathSync(a) === realpathSync(b);
+	} catch {
+		return false;
+	}
+}
+/** Two lists of words in order: the first that differs decides, and a list that runs out first comes first. */
+function compareWords(a, b) {
+	for (let index = 0; index < Math.min(a.length, b.length); index += 1) {
+		const [x, y] = [a[index], b[index]];
+		if (x !== y) return x < y ? -1 : 1;
+	}
+	return a.length - b.length;
+}
+/** Why no registration of another product could be used, in a clause: how many were looked at, and what each was. */
+function notRegistered(notUsed, version) {
+	if (notUsed.length === 0) return "no MCP client on this machine has it registered";
+	const said = {
+		npx: "run by npx, which is never used for this",
+		arguments: "with a path option that has no value",
+		"no-file": "not started from a file named by its full path",
+		"no-package": "whose package cannot be found or read",
+		version: "of another or an unknown version",
+		engine: "whose Node range this Node is outside, or which declares none",
+		bin: "whose package does not name its command",
+		entry: "whose command file is missing, unreadable or outside its package"
+	};
+	const counts = /* @__PURE__ */ new Map();
+	for (const { why } of notUsed) counts.set(why, (counts.get(why) ?? 0) + 1);
+	const parts = [...counts].map(([why, count]) => `${count} ${said[why]}`);
+	return `none of ${notUsed.length === 1 ? "the 1 registration" : `the ${notUsed.length} registrations`} of it is ${version} in a file this can check (${parts.join("; ")})`;
+}
+function notLocated(target, version, reason, detail, nodeVersion, extra) {
+	const named = `${target.manifest.label} ${version} (${target.packageName})`;
+	const { nodeRange, registrations } = extra;
+	const message = nodeRange === void 0 ? `${named} is not locatable here: ${detail}. Install or update it through your usual route, then try again.` : `${named} needs Node ${nodeRange}, and this is Node ${nodeVersion}, so there is no command to run it with here. Run it again under a Node in that range.`;
+	const notLocated = {
+		ok: false,
+		reason,
+		product: target.manifest.label,
+		package: target.packageName,
+		version,
+		...nodeRange === void 0 ? {} : { nodeRange },
+		...registrations === void 0 ? {} : { registrations: Object.freeze([...registrations]) },
+		detail,
+		message
+	};
+	Object.defineProperties(notLocated, {
+		toJSON: { value: () => message },
+		[Symbol.toPrimitive]: { value: () => {
+			throw new TypeError("a missing command is said with handoffText or handoffSentence, never interpolated");
+		} }
+	});
+	return Object.freeze(notLocated);
+}
+/**
+* The entry's real path, when it is a readable regular file inside its package's real root by whole segments — as
+* written and after links are resolved — or why not.
+*
+* Checked now, for the command printed now (D6). This does not make the path durable: an npx cache evicted, a global
+* install upgraded in place or a file replaced after this is what the command meets when it runs — a missing file
+* fails with Node's own error naming it, a replaced one runs as it then is. Nothing here, or in the command, looks
+* anywhere else for the product, PATH included, and a later locate checks the path again.
+*/
+function checkedEntry(root, entry) {
+	if (!isWithin(root, entry)) return {
+		ok: false,
+		why: `${entry} is outside its package, ${root}`
+	};
+	let real;
+	try {
+		real = realpathSync(entry);
+	} catch {
+		return {
+			ok: false,
+			why: `${entry} is not there`
+		};
+	}
+	if (!isWithin(root, real)) return {
+		ok: false,
+		why: `${entry} leads to ${real}, outside its package, ${root}`
+	};
+	try {
+		if (!statSync(real).isFile()) return {
+			ok: false,
+			why: `${entry} is not a file`
+		};
+		accessSync(real, constants$1.R_OK);
+	} catch {
+		return {
+			ok: false,
+			why: `${entry} cannot be read`
+		};
+	}
+	return {
+		ok: true,
+		path: real
+	};
+}
+/**
+* The real root of the package `name` installed for a module in `start`, found as Node's own resolution finds one: in
+* `node_modules` of each directory from there up. Not resolved through its `exports` — core's point at a build, and
+* which entry to run is decided here — and never from a global folder, which `import` does not read either.
+*/
+function installedPackage(start, name) {
+	let dir = resolve(start);
+	for (;;) {
+		if (basename(dir) !== "node_modules") {
+			const candidate = join(dir, "node_modules", ...name.split("/"));
+			try {
+				if (statSync(candidate).isDirectory()) return realpathSync(candidate);
+			} catch {}
+		}
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/**
+* The real repository checkout whose workspace lists `root` as one of its packages, or null: the nearest
+* `pnpm-workspace.yaml` above it, and its `packages` globs. A package under the checkout but not one of them — an
+* installed copy in its `node_modules` — is not a workspace package of it.
+*/
+function workspaceOf(root) {
+	let dir = dirname(root);
+	for (;;) {
+		const globs = workspaceGlobs(dir);
+		if (globs !== null) return inWorkspace(relative(dir, root).split(sep), globs) ? dir : null;
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+/** The `packages` globs of `dir/pnpm-workspace.yaml`, or null when there is no such file. */
+function workspaceGlobs(dir) {
+	let text;
+	try {
+		text = readFileSync(join(dir, "pnpm-workspace.yaml"), "utf8");
+	} catch (error) {
+		const code = error.code;
+		return code === "ENOENT" || code === "ENOTDIR" ? null : [];
+	}
+	const unquote = (glob) => glob.trim().replace(/^(['"])(.*)\1$/, "$2");
+	const lines = text.split(/\r?\n/);
+	const at = lines.findIndex((line) => /^packages\s*:/.test(line));
+	if (at < 0) return [];
+	const inline = /^packages\s*:\s*\[(.*)\]\s*(?:#.*)?$/.exec(lines[at]);
+	if (inline) return (inline[1] ?? "").split(",").map(unquote).filter(Boolean);
+	const globs = [];
+	for (const line of lines.slice(at + 1)) {
+		if (/^\s*(?:#.*)?$/.test(line)) continue;
+		const item = /^\s+-\s*(.*?)\s*(?:#.*)?$/.exec(line);
+		if (!item) break;
+		globs.push(unquote(item[1] ?? ""));
+	}
+	return globs;
+}
+/** Whether a path, as segments from the workspace root, is one of its packages: some glob takes it and no `!` one. */
+function inWorkspace(segments, globs) {
+	const matches = (glob) => segmentsMatch(segments, glob.replace(/^\.\//, "").replace(/\/+$/, "").split("/").filter((part) => part !== "."));
+	const included = globs.filter((glob) => !glob.startsWith("!"));
+	const excluded = globs.filter((glob) => glob.startsWith("!")).map((glob) => glob.slice(1));
+	return included.some(matches) && !excluded.some(matches);
+}
+function segmentsMatch(path, pattern) {
+	const [head, ...rest] = pattern;
+	if (head === void 0) return path.length === 0;
+	if (head === "**") return segmentsMatch(path, rest) || path.length > 0 && segmentsMatch(path.slice(1), pattern);
+	const [segment] = path;
+	if (segment === void 0) return false;
+	return new RegExp(`^${head.split("*").map(escapeRegExp$1).join("[^/]*")}$`).test(segment) && segmentsMatch(path.slice(1), rest);
+}
+function escapeRegExp$1(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* The commands a package tells a person to run, made once per printing process (design 2026-10-04, D1 and D5;
+* CUE-403). How a channel migrates a handoff to these is in CONTRIBUTING.md, "Telling a person what to run".
+*
+* A package makes them from where it is — a module of its own and its package name, the caller — with the folders and
+* shell of the process printing: `openCore({ caller })` puts them on `core.handoffs`. Each method takes the CLI's own
+* words, never the program, and returns a `Handoff`: a located `PrintedCommand`, or why there is none here. Nothing
+* here quotes a line by hand, names a bare binary, or guesses an installation.
+*/
+/** The suite folders every CLI command opens: what a command is pinned to unless it says otherwise. */
+const HANDOFF_FOLDERS = Object.freeze([
+	"configDir",
+	"stateDir",
+	"dataDir",
+	"secretsDir"
+]);
+Object.freeze({
+	url: import.meta.url,
+	packageName: "@agentcomms/core"
+});
+/** A channel of this release, by its word; a programming error for a word that is none. */
+function entryOf(channel) {
+	const entry = CHANNEL_SNAPSHOT.find((each) => each.manifest.channel === channel);
+	if (entry === void 0) throw new TypeError(`"${channel}" is not a channel of this release`);
+	return entry;
+}
+/** The folders a command is pinned to. */
+function usesOf(use) {
+	return [...use?.uses ?? HANDOFF_FOLDERS, ...use?.downloads ? ["downloadsDir"] : []];
+}
+/** The commands a package prints, located from `caller` (CONTRIBUTING.md, "Telling a person what to run"). */
+function cliHandoffs(options) {
+	const { caller, paths, registrations } = options;
+	const platform = options.platform ?? process.platform;
+	const own = CHANNEL_SNAPSHOT.find((entry) => entry.packageName === caller.packageName);
+	if (own === void 0) throw new TypeError(`${caller.packageName} is not a package of this suite`);
+	const locate = (target, words, use) => {
+		const result = locateCliCommand({
+			caller,
+			target,
+			words,
+			uses: usesOf(use),
+			paths,
+			platform,
+			...registrations === void 0 ? {} : { registrations }
+		}, ...options.runtime === void 0 ? [] : [options.runtime]);
+		return result.ok ? result.command : result;
+	};
+	const handoffs = Object.freeze({
+		caller,
+		platform,
+		own: (words, use) => locate(own, words, use),
+		core: (words, use) => locate(entryOf("core"), words, use),
+		of: (channel, words, use) => locate(entryOf(channel), words, use),
+		on: (other) => other === platform ? handoffs : cliHandoffs({
+			...options,
+			platform: other
+		}),
+		registered: async () => cliHandoffs({
+			...options,
+			registrations: (await scanRegisteredServers(options.env ?? process.env, platform)).servers
+		}),
+		withRegistrations: (servers) => cliHandoffs({
+			...options,
+			registrations: servers
+		})
+	});
+	return handoffs;
+}
+/**
+* `core.handoffs` — quoted for `platform` when one is given — for anything that prints a command. A programming error
+* when core was opened without its caller: the package has to give it one (`openCore({ caller })`), and there is no
+* bare name to print instead.
+*/
+function requireHandoffs(core, platform) {
+	const handoffs = requiredHandoffs(core.handoffs);
+	return platform === void 0 ? handoffs : handoffs.on(platform);
+}
+const MAP = {
+	inbox: "inboxes",
+	account: "accounts"
+};
+/**
+* An own property only.
+*
+* A name is user input and the maps are plain objects, so `config.inboxes.constructor` is a function — and a lookup
+* of an inbox called `constructor`, which version 1 allows, found it.
+*/
+function own$1(map, key) {
+	return Object.hasOwn(map, key) ? map[key] : void 0;
+}
+function resolveName(config, kind, name, notFound) {
+	if (kind === "inbox") {
+		const inbox = own$1(config.inboxes, name);
+		if (inbox) return {
+			alias: name,
+			inbox
+		};
+	} else {
+		const account = own$1(config.accounts, name);
+		if (account) return {
+			alias: name,
+			account
+		};
+	}
+	const renamed = formerNameRefusal(config, kind, name);
+	if (renamed) throw renamed;
+	throw notFound?.() ?? defaultNotFound(config, kind, name);
+}
+/** What to say when there are no mailboxes at all: how one is connected, in words (`connectMailboxWords`). */
+function noInboxesHint() {
+	const connect = connectMailboxWords();
+	return connect ? `No inboxes yet: add one with ${connect}, at a terminal or from a chat.` : "No inboxes yet.";
+}
+function defaultNotFound(config, kind, name) {
+	if (kind === "inbox") {
+		const known = Object.keys(config.inboxes);
+		return new CommsError("NOT_FOUND", `no inbox called "${name}"`, { hint: known.length ? `Known inboxes: ${known.join(", ")}.` : noInboxesHint() });
+	}
+	return new CommsError("NOT_FOUND", `no account called "${name}"`);
+}
+function lookupName(config, kind, name) {
+	return kind === "inbox" ? own$1(config.inboxes, name) : own$1(config.accounts, name);
+}
+function findById(config, kind, id) {
+	if (kind === "inbox") {
+		for (const [alias, inbox] of Object.entries(config.inboxes)) if (inbox.id === id) return {
+			alias,
+			inbox
+		};
+	} else for (const [alias, account] of Object.entries(config.accounts)) if (account.id === id) return {
+		alias,
+		account
+	};
+	return null;
+}
+/**
+* The refusal for a former name, or null when `name` is not one.
+*
+* The replacement is looked up by id rather than read from the record, so a chain of renames ends at the name the
+* account has today — and an account removed since its rename is said to be gone, rather than pointing somebody at a
+* name that now belongs to nothing.
+*/
+function formerNameRefusal(config, kind, name) {
+	if (config.version !== 2) return null;
+	const former = own$1(config.formerNames[MAP[kind]], name);
+	if (!former) return null;
+	const current = kind === "inbox" ? findById(config, "inbox", former.id) : findById(config, "account", former.id);
+	if (!current) return new CommsError("NOT_FOUND", `"${name}" was renamed to "${former.name}", which has since been removed`, { details: {
+		formerName: name,
+		id: former.id
+	} });
+	return new CommsError("NOT_FOUND", `"${name}" was renamed to "${current.alias}"`, {
+		hint: `Use "${current.alias}".`,
+		details: {
+			formerName: name,
+			currentName: current.alias,
+			id: former.id
+		}
+	});
 }
-/** Every runtime the installer handed out, or null when the record is there and cannot be read. */
-async function readHandedOut(path) {
-	let text;
-	try {
-		text = await readFile(path, "utf8");
-	} catch (error) {
-		return error.code === "ENOENT" ? [] : null;
+/**
+* Whether `name` may be given to a new or renamed account of this kind and platform.
+*
+* Each version keeps its own rule, because version 1's differ by kind today and must not change under a file an
+* older release also writes: a mailbox name need only be free among mailboxes, a workspace name among both. Version
+* 2 is stricter and the same for both: the grammar, the platform, free in both maps, and never a former name of
+* either kind.
+*
+* A check, not a reservation. Callers repeat it inside the config write, where the schema enforces the same rules
+* again for version 2, because anything can happen between asking and writing.
+*/
+function nameAvailable(config, kind, name, platform) {
+	const refuse = (error) => ({
+		ok: false,
+		error
+	});
+	if (config.version === 1) {
+		if (RESERVED_ALIASES.has(name)) return refuse(new CommsError("USAGE", `"${name}" is reserved`, { hint: "Choose another name." }));
+		if (!isValidAlias(name)) return refuse(new CommsError("USAGE", `"${name}" is not a usable name`, { hint: "Lower-case letters, digits and dashes, up to 32 characters, not starting with a dash." }));
+		if (kind === "inbox" ? own$1(config.inboxes, name) : own$1(config.inboxes, name) ?? own$1(config.accounts, name)) return refuse(new CommsError("CONFIG", `"${name}" is already connected`, { hint: "Choose another name." }));
+		return { ok: true };
 	}
-	const records = [];
-	for (const line of text.split("\n")) {
-		if (!line.trim()) continue;
-		try {
-			const record = JSON.parse(line);
-			if (typeof record.runtime !== "string") return null;
-			records.push({
-				at: String(record.at ?? ""),
-				client: String(record.client ?? ""),
-				name: String(record.name ?? ""),
-				runtime: record.runtime,
-				...typeof record.config === "string" ? { config: record.config } : {},
-				...record.applied === true ? { applied: true } : {}
-			});
-		} catch {
-			return null;
-		}
+	const problem = nameShapeProblem(name, platform);
+	if (problem) return refuse(new CommsError("USAGE", problem));
+	if (own$1(config.inboxes, name) || own$1(config.accounts, name)) return refuse(new CommsError("CONFIG", `"${name}" is already connected`, { hint: "Choose another name." }));
+	for (const map of ["inboxes", "accounts"]) {
+		const former = own$1(config.formerNames[map], name);
+		if (former) return refuse(new CommsError("CONFIG", `"${name}" was the name of another account and cannot be used again`, {
+			hint: "A former name keeps pointing people at the account that had it. Choose another name.",
+			details: {
+				formerName: name,
+				id: former.id
+			}
+		}));
 	}
-	return records;
+	return { ok: true };
 }
 /**
 * A pattern for each package a channel's manifest names as a rival (`rivals.packages`).
@@ -5577,36 +6975,45 @@ async function readHandedOut(path) {
 function rivalPatterns(packages) {
 	return packages.map(({ name, unscoped }) => {
 		const bare = name.includes("/") ? name.slice(name.indexOf("/") + 1) : name;
-		const whole = name.startsWith("@") ? escapeRegExp$2(name) : `(?<![\\w@/-])${escapeRegExp$2(name)}`;
-		const alone = unscoped && name.startsWith("@") ? `|(?<![\\w@/-])${escapeRegExp$2(bare)}` : "";
+		const whole = name.startsWith("@") ? escapeRegExp$3(name) : `(?<![\\w@/-])${escapeRegExp$3(name)}`;
+		const alone = unscoped && name.startsWith("@") ? `|(?<![\\w@/-])${escapeRegExp$3(bare)}` : "";
 		return {
 			pattern: new RegExp(`${whole}${alone}`),
 			name
 		};
 	});
 }
-function escapeRegExp$2(text) {
+function escapeRegExp$3(text) {
 	return text.replace(/[\\^$.*+?()[\]{}|/]/g, "\\$&");
 }
 /**
 * The command that removes a registered server, in its client's own terms — the name as the client's file has it,
 * which may be anything, so on Windows it can have no line to paste, and is shown as its words, to be typed
-* (`shellCommand`). Never as a line with the name left out: that removed whatever entry had the stand-in's name.
+* (`quoteCommand`). Never as a line with the name left out: that removed whatever entry had the stand-in's name.
+*
+* The client's own command, so an external one (`externalCommand`). A name that is also one of this suite's commands,
+* or a path into one of its packages, is refused there, since such words are how a suite command would get round the
+* locator; that entry is removed by hand instead, from the file that holds it.
 */
-function removalCommand(client, name, platform) {
-	return commandText(shellCommand([
-		client,
-		"mcp",
-		"remove",
-		name
-	], platform));
+function removalCommand(client, server, platform) {
+	try {
+		return remedy(externalCommand([
+			client,
+			"mcp",
+			"remove",
+			server.name
+		], "the MCP client's own command removes an entry from its own configuration", platform));
+	} catch {
+		return remedy(`remove "${server.name}" from ${server.path} by hand, then restart ${server.client}`);
+	}
 }
-function gmailRemoval({ client, name: server, path, scope }, platform) {
-	if (scope === "project") return `remove "${server}" from the project entry in ${path} by hand`;
+function gmailRemoval(registered, platform) {
+	const { client, name: server, path, scope } = registered;
+	if (scope === "project") return remedy(`remove "${server}" from the project entry in ${path} by hand`);
 	switch (client) {
-		case "claude-code": return removalCommand("claude", server, platform);
-		case "codex": return removalCommand("codex", server, platform);
-		default: return `remove the "${server}" entry from ${path}, then restart ${client}`;
+		case "claude-code": return removalCommand("claude", registered, platform);
+		case "codex": return removalCommand("codex", registered, platform);
+		default: return remedy(`remove the "${server}" entry from ${path}, then restart ${client}`);
 	}
 }
 /**
@@ -5617,7 +7024,7 @@ function findRivalPackageServers(servers, packages, platform = process.platform)
 	const patterns = rivalPatterns(packages);
 	const findings = [];
 	for (const server of servers) {
-		const line = [server.command, ...server.args].join(" ");
+		const line = [server.command, ...withoutPathOptions(server.args).words].join(" ");
 		const known = patterns.find((candidate) => candidate.pattern.test(line));
 		if (!known) continue;
 		findings.push({
@@ -5638,11 +7045,11 @@ function rivalPackageWarnings(servers, packages, platform = process.platform) {
 * `product` itself: a channel's `rivals.word`, for a service with too many other servers to list.
 */
 function findRivalWordServers(servers, word, product) {
-	const pattern = new RegExp(escapeRegExp$2(word), "i");
+	const pattern = new RegExp(escapeRegExp$3(word), "i");
 	return servers.filter((server) => !isProductServer(server, product) && pattern.test([
 		server.name,
 		server.command,
-		...server.args,
+		...withoutPathOptions(server.args).words,
 		server.url ?? ""
 	].join(" ")));
 }
@@ -5915,10 +7322,6 @@ function renderUpdate(result, color) {
 	if (result.next) lines.push("", result.next);
 	return lines.join("\n");
 }
-/** The channel's fixed approval-command prefix with this generated id, rendered by the common shell rule. */
-function changeApprovalCommand(approveCommand, approvalId, platform = process.platform) {
-	return shellCommand([...(approveCommand ?? "agentcomms approve").trim().split(/\s+/), approvalId], platform);
-}
 /**
 * The change policy that governs a change, as `config` stands: the strictest of the policies over everything the change
 * touches.
@@ -6030,7 +7433,7 @@ async function prepareChange(core, request, options) {
 				change: binding
 			}),
 			expiresAt: record.expiresAt,
-			next: nextStep(record.approvalId, policy, options)
+			next: nextStep(record.approvalId, policy, core, options)
 		};
 	} catch (error) {
 		await auditRefusal(core, "change.prepare", error, {
@@ -6062,8 +7465,9 @@ async function claimChange(core, approvalId, expect, options) {
 			change: binding,
 			policy
 		}, {
-			pendingHint: `Ask the user to run ${inlineCommand(changeApprovalCommand(options.approveCommand, approvalId, options.platform))} in their own terminal, then try again with the same approval.`,
-			platform: options.platform
+			pendingHint: handoffSentence(requireHandoffs(core, options.platform).own(["approve", approvalId]), (command) => `Ask the user to run ${command} in their own terminal, then try again with the same approval.`),
+			platform: options.platform,
+			handoffs: core.handoffs
 		});
 		const decided = stricterPolicy(policy, record.requiredPolicy) === "chat" ? "chat" : "confirm";
 		await auditChange(core, {
@@ -6081,7 +7485,11 @@ async function claimChange(core, approvalId, expect, options) {
 			paths: binding.loosened.map((loosening) => loosening.path),
 			changes: binding.loosened
 		};
-	} catch (error) {
+	} catch (caught) {
+		const error = isMisdirectedSend(caught) ? new CommsError(caught.code, caught.message, {
+			hint: sendApprovesHint(await requireHandoffs(core, options.platform).registered(), approvalId),
+			...caught.details === void 0 ? {} : { details: caught.details }
+		}) : caught;
 		await auditRefusal(core, "change.claim", error, {
 			surface: options.surface,
 			approvalId,
@@ -6092,11 +7500,11 @@ async function claimChange(core, approvalId, expect, options) {
 	}
 }
 /** A change approval, checked to be one and to describe the change its digest binds. */
-async function changeRecord(core, approvalId) {
+async function changeRecord(core, approvalId, options = {}) {
 	const record = await core.approvals.get(approvalId);
 	if (!record) throw new CommsError("NOT_FOUND", `no approval ${approvalId}`, { hint: "Prepare the change again; an approval expires ten minutes after it is made." });
 	if (approvalKind(record) === "download") throw new CommsError("USAGE", `${approvalId} is a question about where to save files, not a configuration change`, { hint: DOWNLOAD_ANSWER_HINT });
-	if (approvalKind(record) !== "change") throw new CommsError("USAGE", `approval ${approvalId} is for a send, not a configuration change`, { hint: `Approve it with the command that prepared it: ${channelApproveCommands({ sending: true })}.` });
+	if (approvalKind(record) !== "change") throw new CommsError("USAGE", `approval ${approvalId} is for a send, not a configuration change`, { hint: sendApprovesHint(await requireHandoffs(core, options.platform).registered(), approvalId) });
 	if (!record.change || changeDigest(record.change) !== record.digest) throw new CommsError("BAD_DATA", "this approval does not describe the change it is bound to", {
 		hint: "Nothing was approved. Prepare the change again.",
 		details: { approvalId }
@@ -6111,7 +7519,7 @@ async function changeRecord(core, approvalId) {
 async function beginChangeApproval(core, approvalId, options) {
 	let record;
 	try {
-		record = await changeRecord(core, approvalId);
+		record = await changeRecord(core, approvalId, options);
 		const challenge = await core.approvals.issueChallenge(approvalId, "change", options.platform);
 		return {
 			approvalId,
@@ -6132,7 +7540,7 @@ async function beginChangeApproval(core, approvalId, options) {
 async function finishChangeApproval(core, approvalId, answer, options) {
 	let record;
 	try {
-		record = await changeRecord(core, approvalId);
+		record = await changeRecord(core, approvalId, options);
 		const digest = changeDigest(record.change);
 		const approved = await core.approvals.approve(approvalId, "terminal", {
 			draftMessageId: digest,
@@ -6193,8 +7601,8 @@ async function revokeChange(core, approvalId, reason, options) {
 function changePolicyOf$1(record) {
 	return record.requiredPolicy === "chat" ? "chat" : "confirm";
 }
-function nextStep(approvalId, policy, options) {
-	return policy === "chat" ? `Show this preview to the user and ask. If they say yes, claim approval ${approvalId} and apply the change; if not, revoke it.` : `The change policy is confirm: ask the user to run ${inlineCommand(changeApprovalCommand(options.approveCommand, approvalId, options.platform))} in their own terminal and type the code it shows. Then claim approval ${approvalId} and apply the change.`;
+function nextStep(approvalId, policy, core, options) {
+	return policy === "chat" ? `Show this preview to the user and ask. If they say yes, claim approval ${approvalId} and apply the change; if not, revoke it.` : handoffSentence(requireHandoffs(core, options.platform).own(["approve", approvalId]), (command) => `The change policy is confirm: ask the user to run ${command} in their own terminal and type the code it shows. Then claim approval ${approvalId} and apply the change.`);
 }
 /**
 * One line per step of a change approval: who asked, from which surface, under which policy, and how it ended.
@@ -6354,13 +7762,11 @@ async function gatedChange(core, change, options) {
 		status: "approval-required",
 		prepared: await prepareChange(core, request, {
 			surface: options.surface,
-			approveCommand: options.approveCommand,
 			platform: options.platform
 		})
 	};
 	const consent = await claimChange(core, options.approvalId, request, {
 		surface: options.surface,
-		approveCommand: options.approveCommand,
 		platform: options.platform
 	});
 	return {
@@ -6419,11 +7825,9 @@ function changeToolResult(outcome) {
 */
 async function gatedChangeAtTerminal(core, change, options) {
 	const streams = options.streams ?? defaultStreams;
-	const { approveCommand } = options;
 	const first = await gatedChange(core, change, {
 		surface: "cli",
 		approvalId: options.approvalId,
-		approveCommand,
 		platform: options.output.platform
 	});
 	if (first.status === "applied") return first.result;
@@ -6431,9 +7835,9 @@ async function gatedChangeAtTerminal(core, change, options) {
 	if (!(agentMarker(options.env) === null && canPrompt(options.env, streams, { json: options.output.json === true }))) {
 		if (options.output.json !== true) streams.stdout.write(`${prepared.preview}\n\n`);
 		const carrying = [options.approvalFlag ?? "--approval", prepared.approvalId];
-		const { command } = options;
+		const handoffs = requireHandoffs(core, options.output.platform);
 		throw new CommsError("APPROVAL_PENDING", `this change needs approval first: ${prepared.summary}`, {
-			hint: options.pendingHint?.(prepared) ?? approvalHint(prepared, typeof command === "string" ? `${command} ${carrying.join(" ")}` : withWords(command, ...carrying), approveCommand, options.output.platform),
+			hint: options.pendingHint?.(prepared) ?? approvalHint(prepared, handoffs[options.rerunOn ?? "own"](insertWordsBeforeSentinel(options.rerun, ...carrying)), handoffs),
 			details: {
 				approvalId: prepared.approvalId,
 				policy: prepared.policy,
@@ -6454,7 +7858,6 @@ async function gatedChangeAtTerminal(core, change, options) {
 	const second = await gatedChange(core, change, {
 		surface: "cli",
 		approvalId: prepared.approvalId,
-		approveCommand,
 		platform: options.output.platform
 	});
 	if (second.status !== "applied") throw new CommsError("UNEXPECTED", "the approved change asked for approval again");
@@ -6467,9 +7870,13 @@ async function gatedChangeAtTerminal(core, change, options) {
 * Shared with a command that reports a waiting change rather than failing on it — `agent-gmail setup`, which stops at
 * its registration step and says why in its report — so the two say it in the same words.
 */
-function approvalHint(prepared, rerun, approveCommand, platform = typeof rerun === "string" ? process.platform : rerun.platform) {
-	const run = typeof rerun === "string" ? `\`${rerun}\`` : inlineCommand(rerun);
-	return prepared.policy === "confirm" ? `Show the person the preview. They run ${inlineCommand(changeApprovalCommand(approveCommand, prepared.approvalId, platform))}; then run ${run}.` : `Show the person the preview. Once they say yes, run ${run}.`;
+function approvalHint(prepared, rerun, maker) {
+	const run = isCommand(rerun) ? inlineCommand(rerun) : null;
+	const rerunSaid = isCommand(rerun) ? "" : rerun.message;
+	if (prepared.policy !== "confirm") return run === null ? `Show the person the preview. ${rerunSaid}` : `Show the person the preview. Once they say yes, run ${run}.`;
+	const approve = maker.own(["approve", prepared.approvalId]);
+	if (isCommand(approve) && run !== null) return `Show the person the preview. They run ${inlineCommand(approve)}; then run ${run}.`;
+	return `Show the person the preview. ${handoffSentence(approve, (command) => `They run ${command}.`)} ${run === null ? rerunSaid : `Then run ${run}.`}`;
 }
 /**
 * Approves a configuration change at a terminal, the way a person approves a send: read the preview, type the code.
@@ -6489,11 +7896,7 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 		refuseUnlessPerson(env, streams, {
 			refusedToAgent: "only a person can approve a change, not an agent",
 			refusedWithoutTerminal: "approving a change needs an interactive terminal",
-			command: commandText(shellCommand([
-				"agentcomms",
-				"approve",
-				approvalId
-			], output.platform)),
+			command: requireHandoffs(core, output.platform).own(["approve", approvalId]),
 			color: output.color,
 			json: output.json
 		});
@@ -6679,11 +8082,17 @@ const KEYCHAIN_SERVICE = "agent-communications";
 * answer an OS prompt, so it must not hang.
 */
 const KEYCHAIN_TIMEOUT_MS = 12e3;
+/** "Run the doctor": core's, located from whatever is printing, or why there is none here. */
+function doctorSentence(handoffs, say) {
+	return handoffSentence(requiredHandoffs(handoffs).core(["doctor"]), say, { instead: "Call comms_doctor from a chat." });
+}
 var FileSecretStore = class {
 	kind = "file";
 	directory;
-	constructor(directory) {
+	#handoffs;
+	constructor(directory, options = {}) {
 		this.directory = directory;
+		this.#handoffs = options.handoffs;
 	}
 	#path(ref) {
 		return join(this.directory, `${createHash("sha256").update(ref).digest("hex").slice(0, 32)}.json`);
@@ -6703,7 +8112,7 @@ var FileSecretStore = class {
 		} catch (error) {
 			if (error.code === "ENOENT") return null;
 			throw new CommsError("SECRET_STORE_UNAVAILABLE", "a stored secret file could not be read", {
-				hint: "Run `agentcomms doctor`; re-authorise the inbox if the file is damaged.",
+				hint: `${doctorSentence(this.#handoffs, (command) => `Run ${command}.`)} Re-authorise the inbox if the file is damaged.`,
 				cause: error
 			});
 		}
@@ -6738,10 +8147,10 @@ async function loadKeyringModule() {
 var KeychainTimeout = class extends Error {
 	name = "KeychainTimeout";
 };
-function keychainError(action, cause, timeoutMs) {
+function keychainError(action, cause, timeoutMs, handoffs) {
 	const timedOut = cause instanceof KeychainTimeout;
 	return new CommsError(timedOut ? "KEYCHAIN_APPROVAL_PENDING" : "SECRET_STORE_UNAVAILABLE", timedOut ? `the system keychain did not answer within ${Math.round(timeoutMs / 1e3)}s while trying to ${action}` : `the system keychain refused to ${action} (it may be locked, or access was denied)`, {
-		hint: timedOut ? "Look for a system dialog asking to allow access to the keychain, then retry. Run `agentcomms doctor` for details." : "Unlock the keychain and retry, or run `agentcomms doctor`. On macOS a Node upgrade can require allowing access again.",
+		hint: timedOut ? `Look for a system dialog asking to allow access to the keychain, then retry. ${doctorSentence(handoffs, (command) => `Run ${command} for details.`)}` : `Unlock the keychain and retry. ${doctorSentence(handoffs, (command) => `Run ${command} for details.`)} On macOS a Node upgrade can require allowing access again.`,
 		details: { reason: timedOut ? "KEYCHAIN_APPROVAL_PENDING" : "KEYCHAIN_UNAVAILABLE" },
 		cause
 	});
@@ -6766,6 +8175,7 @@ var KeychainSecretStore = class {
 	#module;
 	#timeoutMs;
 	#namespace;
+	#handoffs;
 	/** One keychain call at a time: parallel calls would each raise their own OS prompt and exhaust the thread pool. */
 	#queue = Promise.resolve();
 	/**
@@ -6779,17 +8189,18 @@ var KeychainSecretStore = class {
 	* @param namespace keeps entries of different config directories apart (a test run or a second setup must never
 	*   read or overwrite another's `client:default:secret`); see {@link keychainNamespace}.
 	*/
-	constructor(module, namespace, timeoutMs = KEYCHAIN_TIMEOUT_MS) {
+	constructor(module, namespace, timeoutMs = KEYCHAIN_TIMEOUT_MS, options = {}) {
 		this.#module = module;
 		this.#namespace = namespace;
 		this.#timeoutMs = timeoutMs;
+		this.#handoffs = options.handoffs;
 	}
 	#entry(ref) {
 		return new this.#module.AsyncEntry(KEYCHAIN_SERVICE, `${this.#namespace}:${ref}`, { linux: { store: "secret-service" } });
 	}
 	#serial(action, fn) {
 		const run = this.#queue.then(async () => {
-			if (this.#stuck) throw keychainError(action, new KeychainTimeout(), this.#timeoutMs);
+			if (this.#stuck) throw keychainError(action, new KeychainTimeout(), this.#timeoutMs, this.#handoffs);
 			const native = fn();
 			try {
 				return await raceTimeout(native, this.#timeoutMs);
@@ -6801,7 +8212,7 @@ var KeychainSecretStore = class {
 						if (this.#stuck === stuck) this.#stuck = null;
 					});
 				}
-				throw keychainError(action, error, this.#timeoutMs);
+				throw keychainError(action, error, this.#timeoutMs, this.#handoffs);
 			}
 		});
 		this.#queue = run.catch(() => void 0);
@@ -6841,10 +8252,11 @@ function keychainNamespace(configDir) {
 }
 /** Opens the backend recorded in config for an inbox or client. */
 async function openSecretStore(kind, options) {
-	if (kind === "file") return new FileSecretStore(options.secretsDir);
+	const told = { handoffs: options.handoffs };
+	if (kind === "file") return new FileSecretStore(options.secretsDir, told);
 	const keyring = options.keyring === void 0 ? await loadKeyringModule() : options.keyring;
 	if (!keyring) throw new CommsError("SECRET_STORE_UNAVAILABLE", "secrets are kept in the system keychain, but the keychain module is missing", { hint: "Reinstall with optional dependencies, or re-add the inbox with --store file." });
-	return new KeychainSecretStore(keyring, options.namespace);
+	return new KeychainSecretStore(keyring, options.namespace, KEYCHAIN_TIMEOUT_MS, told);
 }
 var InboxStateStore = class {
 	directory;
@@ -6878,25 +8290,37 @@ var InboxStateStore = class {
 	}
 };
 function openCore(options = {}) {
-	const paths = resolvePaths(options);
+	const { paths, pathOverrides } = resolvePathIdentity(options);
 	const now = options.now ?? (() => /* @__PURE__ */ new Date());
-	const config = new ConfigStore(paths.configDir);
+	const handoffs = options.caller === void 0 ? void 0 : cliHandoffs({
+		caller: options.caller,
+		paths,
+		platform: options.platform,
+		env: options.env
+	});
+	const config = new ConfigStore(paths.configDir, { handoffs });
 	let cached = null;
 	return {
 		paths,
+		pathOverrides,
 		config,
 		states: new InboxStateStore(paths.stateDir),
-		approvals: new ApprovalStore(paths.stateDir, { now }),
+		approvals: new ApprovalStore(paths.stateDir, {
+			now,
+			handoffs
+		}),
 		ledger: new SendLedger(paths.stateDir, now),
 		plans: new PlanStore(paths.stateDir, now),
 		taint: new TaintStore(paths.stateDir, now),
 		audit: new AuditLog(paths.stateDir, now),
+		handoffs,
 		async secrets(kind) {
 			const chosen = kind ?? secretsStoreOf(await config.load());
 			if (cached?.kind === chosen) return cached.store;
 			const store = await openSecretStore(chosen, {
 				secretsDir: paths.secretsDir,
-				namespace: keychainNamespace(paths.configDir)
+				namespace: keychainNamespace(paths.configDir),
+				handoffs
 			});
 			cached = {
 				kind: chosen,
@@ -7095,79 +8519,6 @@ strictObject({
 	appId: string().regex(SLACK_APP_ID_PATTERN, "a Slack app id is A followed by 2–20 capital letters or digits").optional(),
 	sha256: string().regex(/^[0-9a-f]{64}$/, "a SHA-256 is 64 lowercase hex digits")
 });
-/**
-* Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
-* to decide whether the release it last heard of is newer than the one running.
-*
-* Here rather than in `npm.ts`, which also talks to the registry: the reader of `update-check.json` is imported by
-* every server, WhatsApp's included, and must carry no network code at all (design 2026-09-28 §1). `npm.ts` re-exports
-* all of it, so nothing that imported these from there changes.
-*/
-/**
-* A version, exactly as semver writes one: `1.2.3`, `1.2.3-rc.1`, `1.2.3+build`.
-*
-* Anything the registry answers is checked against this before it is used, because a version goes into a directory
-* name (`runtime/<version>-gmail`), a sentence a person approves, and an argument to `npm install`. A registry — or a
-* mirror somebody configured — that answered `../x` or `1.0.0 && …` would otherwise put that in all three.
-*/
-const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
-function isVersion(value) {
-	return typeof value === "string" && VERSION_PATTERN.test(value);
-}
-/** Two numeric strings with no leading zeros, compared as numbers of any size. */
-function compareNumeric(a, b) {
-	if (a.length !== b.length) return a.length < b.length ? -1 : 1;
-	return a < b ? -1 : a > b ? 1 : 0;
-}
-/**
-* Semver precedence: -1, 0 or 1, or null when either is not a version.
-*
-* Numbers compare as numbers (`0.10.0` is after `0.9.9`), a prerelease comes before its release, and build metadata
-* counts for nothing. Written out rather than taken from a dependency: it is twenty lines, and the core installs as
-* few packages as it can.
-*/
-function compareVersions(a, b) {
-	const left = VERSION_PATTERN.exec(a);
-	const right = VERSION_PATTERN.exec(b);
-	if (!left || !right) return null;
-	for (const index of [
-		1,
-		2,
-		3
-	]) {
-		const order = compareNumeric(left[index] ?? "0", right[index] ?? "0");
-		if (order !== 0) return order < 0 ? -1 : 1;
-	}
-	const pre = (match) => match[4] === void 0 ? [] : match[4].split(".");
-	const [ours, theirs] = [pre(left), pre(right)];
-	if (ours.length === 0 || theirs.length === 0) return ours.length === theirs.length ? 0 : ours.length === 0 ? 1 : -1;
-	for (let index = 0; index < Math.max(ours.length, theirs.length); index += 1) {
-		const x = ours[index];
-		const y = theirs[index];
-		if (x === void 0) return -1;
-		if (y === void 0) return 1;
-		const [numericX, numericY] = [/^\d+$/.test(x), /^\d+$/.test(y)];
-		if (numericX && numericY) {
-			const order = compareNumeric(x, y);
-			if (order !== 0) return order < 0 ? -1 : 1;
-		} else if (numericX !== numericY) return numericX ? -1 : 1;
-		else if (x !== y) return x < y ? -1 : 1;
-	}
-	return 0;
-}
-/** Whether `version` is older than `latest`: by semver when both are versions, and otherwise whenever they differ. */
-function isBehind(version, latest) {
-	if (version === latest) return false;
-	const order = compareVersions(version, latest);
-	return order === null ? true : order < 0;
-}
-/**
-* Whether a version is a prerelease — `0.8.0-rc.1` — which the daily update check never counts as an update: a
-* machine is not told to "update" to a release candidate, nor a candidate told to go back to the last release.
-*/
-function isPrerelease(version) {
-	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
-}
 const DEFAULT_REGISTRY = "https://registry.npmjs.org/";
 /**
 * The registry npm itself would read: `npm_config_registry` when it is set — which npm sets for everything it runs,
@@ -7313,8 +8664,6 @@ async function npmInstallGlobal(env, spec) {
 		throw new Error(`npm install --global ${spec} failed${said ? `: ${said}` : ""}`);
 	}
 }
-/** The package version, read from package.json at build time. */
-const VERSION = "0.13.0";
 /**
 * Registering, pruning and listing the MCP servers of every channel, from the core.
 *
@@ -7515,7 +8864,9 @@ function serverInstallChange(core, env, request, own) {
 			checkPin(config, request);
 			const product = await productNow();
 			const { version } = product;
-			const preflight = await preflightInstall(context, product, installOptions(request));
+			const preflight = await preflightInstall(context, product, installOptions(request)).catch(async (error) => {
+				throw await remedyLocated(error, core);
+			});
 			const { target, previous, effective, kept, command } = preflight;
 			planned = {
 				product,
@@ -7546,7 +8897,9 @@ function serverInstallChange(core, env, request, own) {
 		},
 		apply: async () => {
 			if (planned === void 0) throw new CommsError("UNEXPECTED", "the registration was applied before it was planned");
-			const result = await mcpInstall(context, planned.product, installOptions(request), planned.install);
+			const result = await mcpInstall(context, planned.product, installOptions(request), planned.install).catch(async (error) => {
+				throw await remedyLocated(error, core);
+			});
 			return {
 				...result,
 				restart: result.applied ? `Restart ${request.client} to load "${result.name}": no MCP client loads a new server into a session that is already running.` : null
@@ -7555,6 +8908,23 @@ function serverInstallChange(core, env, request, own) {
 	};
 }
 /**
+* A refusal of `mcp install` with its remedy — another install of the same product — said with the command located:
+* the printing package's own, core's, or another product's found among this machine's registrations (CUE-403). The
+* installer says only the words; it may not import the locator.
+*/
+async function remedyLocated(error, core) {
+	const remedy = installRemedyOf(error);
+	if (remedy === void 0 || !(error instanceof CommsError)) return error;
+	const channel = CHANNELS.find((each) => channelServer(each).binary === remedy.binary);
+	if (channel === void 0) return error;
+	const maker = await requireHandoffs(core).registered();
+	return new CommsError(error.code, error.message, {
+		hint: handoffSentence(maker.of(channel, remedy.words), remedy.say),
+		...error.details === void 0 ? {} : { details: error.details },
+		...error.cause === void 0 ? {} : { cause: error.cause }
+	});
+}
+/**
 * Removing a channel's unused managed runtimes, as a change.
 *
 * A dry run is free: it removes nothing. Otherwise the plan is that same dry run, and each runtime it would remove is
@@ -7572,7 +8942,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.13.0"
+		version: "0.13.1"
 	};
 	const product = {
 		packageName,
@@ -7610,14 +8980,6 @@ function serverPruneChange(core, env, request, own) {
 		})
 	};
 }
-/** How a registered entry starts its server: the launcher `mcp install` wrote it with, or `other` for one it did not. */
-function launcherOf(server, facts) {
-	const parts = [server.command, ...server.args];
-	if (parts.some((part) => managedRuntimeVersion(part, facts.packageName) !== null)) return "managed";
-	if (server.args.some((arg) => arg.startsWith(`${facts.npxPackage}@`))) return "npx";
-	if (parts.some((part) => /[/\\]packages[/\\][^/\\]+[/\\](?:src[/\\]cli\.ts|dist[/\\]cli\.mjs)$/.test(part))) return "local";
-	return "other";
-}
 /**
 * The daily update check, as every server and command reads it (design 2026-09-28): one file per machine,
 * `update-check.json` in the state directory, saying when the registry was last asked, the latest release it named,
@@ -7821,40 +9183,52 @@ async function pendingUpdate(options) {
 	};
 	return verdict;
 }
-/**
-* The two ways on, as a tool call and as a command — and the command through npx, for a machine with no `agentcomms`
-* installed: one that runs only a plugin's server, say, has neither the core server nor the command.
-*/
-const UPDATE_WAYS = Object.freeze({
-	update: {
-		tool: "comms_update",
-		command: "agentcomms update",
-		npx: "npx -y @agentcomms/core@latest update"
-	},
-	later: {
-		tool: "comms_update",
-		arguments: { later: true },
-		command: "agentcomms update --later",
-		npx: "npx -y @agentcomms/core@latest update --later"
-	}
-});
+function updateCommands(core, platform) {
+	const handoffs = requireHandoffs(core, platform);
+	return {
+		update: handoffs.core(["update"]),
+		later: handoffs.core(["update", "--later"])
+	};
+}
+/** One of them in a sentence `say` makes: in backticks, or, with no command here, the sentence saying why. */
+function updateCommandSaid(commands, which, say) {
+	return handoffSentence(commands[which], say);
+}
+function updateWaysOf(commands) {
+	return {
+		update: {
+			tool: "comms_update",
+			command: commands.update
+		},
+		later: {
+			tool: "comms_update",
+			arguments: { later: true },
+			command: commands.later
+		}
+	};
+}
+/** A channel's product name, from core's snapshot of the manifests: `Gmail`. */
+function labelOf(channel) {
+	return CHANNEL_SNAPSHOT.find((entry) => entry.manifest.channel === channel)?.manifest.label ?? channel;
+}
 /**
 * What a stopped tool call says, in words an agent passes on: the owner's sentence first, then the versions, then the
 * two ways on — the update, from chat or a terminal, or "not now", which the person approves like any other change.
 */
-function updateStopMessage(pending, where) {
+function updateStopMessage(pending, where, commands) {
+	const server = where.channel === "core" ? "the core server" : `the ${labelOf(where.channel)} server`;
 	const didNotRun = `Nothing was done: ${where.tool} did not run.`;
-	const later = `Not now: call comms_update with \`later: true\` — a change the person approves — and nothing stops again until midnight; the next request after it asks again. At a terminal: \`${UPDATE_WAYS.later.command}\` (\`${UPDATE_WAYS.later.npx}\` where agentcomms is not installed).`;
+	const later = `Not now: call comms_update with \`later: true\` — a change the person approves — and nothing stops again until midnight; the next request after it asks again. ${updateCommandSaid(commands, "later", (command) => `At a terminal: ${command}.`)}`;
 	if (pending.kind === "restart") return [
 		"Hang on a minute, the update is installed, but this server isn't running it yet. Restart the client first.",
-		`This is ${where.server} ${pending.running}; ${pending.latest} is installed on this machine — every registration of this server names it — and a client starts it only once it is restarted. ${didNotRun}`,
+		`This is ${server}, ${pending.running}; ${pending.latest} is installed on this machine — every registration of this server names it — and a client starts it only once it is restarted. ${didNotRun}`,
 		`Ask the person to restart the MCP client — quit it and open it again — and carry on after. ${later}`
 	].join("\n");
 	return [
 		UPDATE_FIRST,
-		`This is ${where.server} ${pending.running}; the latest release is ${pending.latest}. ${didNotRun}`,
+		`This is ${server}, ${pending.running}; the latest release is ${pending.latest}. ${didNotRun}`,
 		"Ask the person which they want:",
-		`- Update now: call comms_update on the agentcomms (core) server. It shows every step and asks before it changes anything; restart the client after. At a terminal: \`${UPDATE_WAYS.update.command}\` (\`${UPDATE_WAYS.update.npx}\` where agentcomms is not installed). A server comms_update does not find registered here — a plugin's, an extension's — is updated where it was installed.`,
+		`- Update now: call comms_update on the core server. It shows every step and asks before it changes anything; restart the client after. ${updateCommandSaid(commands, "update", (command) => `At a terminal: ${command}.`)} A server comms_update does not find registered here — a plugin's, an extension's — is updated where it was installed.`,
 		`- ${later}`
 	].join("\n");
 }
@@ -7919,15 +9293,15 @@ async function latestReleases(names, latestVersion) {
 	return Object.fromEntries(answers.map((answer) => [answer.name, answer.version ?? ""]));
 }
 /**
-* How to register an entry again by hand: its channel's own `mcp install`, with every flag that decides its reach.
+* How to register an entry again by hand: its channel's own `mcp install`, with every flag that decides its reach —
+* located as that channel's command among this machine's registrations, or why it is not locatable here (CUE-403).
 *
 * The entry's name and pins are read from the client's file, which may hold anything, so on Windows the command may
-* have no line to paste: the reasons below give it with `inlineCommand`, which shows it as words then.
+* have no line to paste: the reasons below give it with `handoffSentence`, which shows it as words then.
 */
-function installCommand(item, platform) {
+function installHandoff(item, handoffs) {
 	const facts = channelServer(item.channel);
 	const words = [
-		facts.binary,
 		"mcp",
 		"install",
 		"--client",
@@ -7935,7 +9309,7 @@ function installCommand(item, platform) {
 	];
 	if (item.name !== facts.defaultServerName) words.push("--name", item.name);
 	words.push(...item.narrowing, "--force");
-	return shellCommand(words, platform);
+	return handoffs.of(item.channel, words);
 }
 /**
 * Why a registration that is behind cannot be registered again from here, or undefined when it can.
@@ -7945,14 +9319,14 @@ function installCommand(item, platform) {
 * whose CLI is not here are each left for a person, with what to run. So is one pinned to an account that has since
 * been renamed or removed: registering it again would register a server that is refused when it starts.
 */
-async function whyNotUpdatable(context, config, item, narrowing) {
-	if (item.launcher !== "managed" && item.launcher !== "npx") return `it was not written by \`mcp install\`, so how it starts cannot be carried over; register it again with ${inlineCommand(installCommand(item, context.platform))}`;
+async function whyNotUpdatable(context, config, item, narrowing, handoffs) {
+	if (item.launcher !== "managed" && item.launcher !== "npx") return `it was not written by \`mcp install\`, so how it starts cannot be carried over; ${handoffSentence(installHandoff(item, handoffs), (command) => `register it again with ${command}`)}`;
 	if (item.scope !== "user") return `it is registered for one project (in ${item.path}), and \`mcp install\` registers at user scope only; register it again from that project with ${item.client}'s own command`;
 	const target = await installTarget(context, {
 		client: item.client,
 		apply: true
 	});
-	if (!target.writes) return target.cliName ? `\`${target.cliName}\` is not ${clientCliSearch(context.env)}, so the entry cannot be replaced from here; run ${inlineCommand(installCommand(item, context.platform))} where it is` : `this environment names no ${item.client} configuration to write to`;
+	if (!target.writes) return target.cliName ? `\`${target.cliName}\` is not ${clientCliSearch(context.env)}, so the entry cannot be replaced from here; ${handoffSentence(installHandoff(item, handoffs), (command) => `run ${command} where it is`)}` : `this environment names no ${item.client} configuration to write to`;
 	const own = pinOption(item.channel);
 	const pin = own === void 0 || own === "readOnly" ? void 0 : narrowing[own];
 	if (pin !== void 0) {
@@ -8000,6 +9374,7 @@ async function inspect(core, env, deps) {
 		platform: deps.platform
 	};
 	const scan = await scanRegisteredServers(env);
+	const handoffs = requireHandoffs(core, deps.platform).withRegistrations(scan.servers);
 	const unreadable = [...scan.unreadable];
 	const found = registrations(scan.servers).map(({ channel, server }) => {
 		const facts = channelServer(channel);
@@ -8007,7 +9382,7 @@ async function inspect(core, env, deps) {
 			channel,
 			server,
 			narrowing: facts.narrowingOf(server.args),
-			version: server.args.map((arg) => pinnedVersion(arg, facts)).find((pinned) => pinned !== null) ?? null,
+			version: registrationVersion(server, facts),
 			package: server.args.some((arg) => arg.startsWith(`${facts.npxPackage}@`)) ? facts.npxPackage : facts.packageName
 		};
 	});
@@ -8063,7 +9438,7 @@ async function inspect(core, env, deps) {
 			upToDate.push(item);
 			continue;
 		}
-		const reason = await whyNotUpdatable(context, config, item, entry.narrowing);
+		const reason = await whyNotUpdatable(context, config, item, entry.narrowing, handoffs);
 		const listed = {
 			...item,
 			updatable: reason === void 0,
@@ -8116,6 +9491,7 @@ async function inspect(core, env, deps) {
 			unpinned,
 			unreadable
 		},
+		handoffs,
 		candidates,
 		manual,
 		globals
@@ -8274,7 +9650,7 @@ function counted(count, one, many) {
 * has. When it is not — the client itself reports the entry otherwise than its file does, say — registering again
 * would change what the server may reach, so the entry is left for a person rather than widened or narrowed.
 */
-async function planRegistrations(context, candidates, request) {
+async function planRegistrations(context, candidates, request, handoffs) {
 	const steps = [];
 	const manual = [];
 	const leave = (item, reason) => manual.push({
@@ -8306,7 +9682,7 @@ async function planRegistrations(context, candidates, request) {
 		}
 		const keeps = narrowingArgs(item.channel, preflight.effective);
 		if (JSON.stringify(keeps) !== JSON.stringify(item.narrowing)) {
-			leave(item, `registering it again would not keep exactly ${item.narrowing.length > 0 ? item.narrowing.join(" ") : "no pin"}: ${item.client} itself has the entry as ${keeps.length > 0 ? keeps.join(" ") : "not pinned"}. Register it again yourself with the pins it should have: ${inlineCommand(installCommand(item, context.platform))}`);
+			leave(item, `registering it again would not keep exactly ${item.narrowing.length > 0 ? item.narrowing.join(" ") : "no pin"}: ${item.client} itself has the entry as ${keeps.length > 0 ? keeps.join(" ") : "not pinned"}. ${handoffSentence(installHandoff(item, handoffs), (command) => `Register it again yourself with the pins it should have: ${command}`)}`);
 			continue;
 		}
 		steps.push({
@@ -8338,7 +9714,7 @@ function updateChange(core, env, request = {}, deps = {}) {
 	return {
 		plan: async (config) => {
 			const inspection = await inspect(core, env, deps);
-			const { steps, manual } = await planRegistrations(context, inspection.candidates, request);
+			const { steps, manual } = await planRegistrations(context, inspection.candidates, request, inspection.handoffs);
 			const runtimes = await runtimesNeeded(core.paths.dataDir, inspection.report.latest, steps.map((step) => step.item));
 			planned = {
 				report: inspection.report,
@@ -8346,6 +9722,7 @@ function updateChange(core, env, request = {}, deps = {}) {
 				runtimes,
 				registrations: steps,
 				globals: inspection.globals,
+				handoffs: inspection.handoffs,
 				manual: [...inspection.manual, ...manual],
 				nothingBehind: inspection.report.behind.length === 0
 			};
@@ -8390,8 +9767,9 @@ function updateChange(core, env, request = {}, deps = {}) {
 * id that is not one is said to be that.
 */
 async function nothingToApply(core, approvalId, planned) {
+	const check = (say) => handoffSentence(planned.handoffs.core(["update", "--check"]), say);
 	if (!APPROVAL_ID_PATTERN.test(approvalId)) return new CommsError("USAGE", `nothing was changed: "${approvalId}" is not an approval id`, {
-		hint: "An approval id is the `approvalId` a call that needs approval returns, and nothing here needs one: a check — comms_update with `check`, or `agentcomms update --check` at a terminal — shows what is behind.",
+		hint: check((command) => `An approval id is the \`approvalId\` a call that needs approval returns, and nothing here needs one: a check — comms_update with \`check\`, or ${command} at a terminal — shows what is behind.`),
 		details: { approvalId }
 	});
 	const record = await core.approvals.get(approvalId);
@@ -8401,11 +9779,11 @@ async function nothingToApply(core, approvalId, planned) {
 		...record ? { state: record.state } : {}
 	};
 	if (planned.nothingBehind) return new CommsError("USAGE", `nothing was changed: nothing is behind the latest release, ${unused}`, {
-		hint: "Nothing needs doing: a check — comms_update with `check`, or `agentcomms update --check` at a terminal — shows everything here up to date. A release published later is another update, with a preview and an approval of its own.",
+		hint: check((command) => `Nothing needs doing: a check — comms_update with \`check\`, or ${command} at a terminal — shows everything here up to date. A release published later is another update, with a preview and an approval of its own.`),
 		details
 	});
 	return new CommsError("USAGE", `nothing was changed: what is behind cannot be updated from here, ${unused}`, {
-		hint: "Each is left for a person: a check — comms_update with `check`, or `agentcomms update --check` at a terminal — lists them, with why and what to run. The same call without the approval reports them too, and changes nothing.",
+		hint: check((command) => `Each is left for a person: a check — comms_update with \`check\`, or ${command} at a terminal — lists them, with why and what to run. The same call without the approval reports them too, and changes nothing.`),
 		details
 	});
 }
@@ -8435,8 +9813,13 @@ function runtimeProduct(packageName, version) {
 	if (channel === void 0) throw new CommsError("UNEXPECTED", `${packageName} is not a channel's package`);
 	return channelProduct(channel, "managed", version);
 }
-/** Every channel's `mcp prune`, as a person types it: "`agentcomms mcp prune`, `agent-gmail mcp prune` and …". */
-const PRUNE_COMMANDS = listed(CHANNELS.map((channel) => `\`${channelServer(channel).binary} mcp prune\``), "and");
+/**
+* Every channel's `mcp prune`, as a person runs it at a terminal: each located among this machine's registrations, and
+* for one that is not, why — never a bare name (CUE-403).
+*/
+function pruneCommands(handoffs) {
+	return handoffChoices(CHANNELS.map((channel) => handoffs.of(channel, ["mcp", "prune"])), "none of their commands is locatable here:", { conjunction: "and" });
+}
 function message(error) {
 	return error instanceof CommsError ? error.message : error instanceof Error ? error.message : String(error);
 }
@@ -8546,7 +9929,7 @@ async function applyUpdate(context, planned, deps) {
 	const ok = steps.every(worked);
 	const status = steps.length === 0 ? planned.nothingBehind ? "up-to-date" : "manual" : ok ? "updated" : "failed";
 	const clients = [...new Set(steps.flatMap((step) => step.kind === "registration" && step.outcome === "registered" ? [step.client] : []))];
-	const next = clients.length > 0 ? `Restart ${clients.length === 1 ? clients[0] : `${clients.slice(0, -1).join(", ")} and ${clients.at(-1)}`} to load the new servers: no MCP client loads a new server into a session that is already running. Then, from the restarted server, prune the runtimes the old versions leave behind: comms_server_prune for each channel — at a terminal, ${PRUNE_COMMANDS}.` : null;
+	const next = clients.length > 0 ? `Restart ${clients.length === 1 ? clients[0] : `${clients.slice(0, -1).join(", ")} and ${clients.at(-1)}`} to load the new servers: no MCP client loads a new server into a session that is already running. Then, from the restarted server, prune the runtimes the old versions leave behind: comms_server_prune for each channel — at a terminal, ${pruneCommands(planned.handoffs)}.` : null;
 	return {
 		status,
 		latest: planned.latest,
@@ -8664,8 +10047,9 @@ function updateToolGate(options) {
 		if (await claimsApproval(options.core, args[claim?.argument ?? "approvalId"], claim)) return null;
 		return stoppedCall(pending, {
 			server: options.server,
+			channel: options.channel,
 			tool
-		});
+		}, updateCommands(options.core));
 	};
 }
 /**
@@ -8673,15 +10057,17 @@ function updateToolGate(options) {
 * a client that shows the model only text blocks (Cursor) reads it there. Claude Code and Codex show only
 * `structuredContent`, so the same words are its `message`, with the versions and the two ways on beside them.
 */
-function stoppedCall(pending, where) {
-	const message = updateStopMessage(pending, where);
+function stoppedCall(pending, where, commands) {
+	const message = updateStopMessage(pending, where, commands);
+	const ways = updateWaysOf(commands);
+	const leaving = (value) => JSON.parse(JSON.stringify(value));
 	return {
 		isError: true,
 		content: [{
 			type: "text",
 			text: message
 		}],
-		structuredContent: { error: {
+		structuredContent: leaving({ error: {
 			code: "UPDATE_REQUIRED",
 			message,
 			hint: pending.kind === "restart" ? "Restart the MCP client, or put the stop off until midnight with comms_update `later: true` once the person agrees." : "Update with comms_update (the person approves its preview), or put it off until midnight with comms_update `later: true` once the person agrees.",
@@ -8691,10 +10077,10 @@ function stoppedCall(pending, where) {
 				running: pending.running,
 				latest: pending.latest,
 				installed: pending.kind === "restart",
-				update: UPDATE_WAYS.update,
-				later: UPDATE_WAYS.later
+				update: ways.update,
+				later: ways.later
 			}
-		} }
+		} })
 	};
 }
 /** The commands never stopped, by their first word; `mcp` alone runs a server, which stops each call itself. */
@@ -8790,19 +10176,21 @@ async function updateGateAtTerminal(options) {
 		...where
 	});
 	if (pending === null) return null;
-	if (!(agentMarker(env) === null && canPrompt(env, streams, {
+	const person = agentMarker(env) === null && canPrompt(env, streams, {
 		json: output.json,
 		noInput: options.noInput === true
-	}))) throw updateRequired(pending, options.binary);
+	});
+	const commands = updateCommands(core, output.platform);
+	if (!person) throw updateRequired(pending, cliOf(options.channel), commands);
 	const bold = (word) => paint(output.color, "bold", word);
 	const answer = (await askLine(streams, pending.kind === "restart" ? `${pending.latest} is installed (this is ${pending.running}). Switch ${bold("now")}, ${bold("later")} today, or ${bold("cancel")}? ` : `${pending.latest} is out (you have ${pending.running}). Update ${bold("now")}, ${bold("later")} today, or ${bold("cancel")}? `)).trim().toLowerCase();
 	if (answer === "now" || answer === "update") {
 		if (pending.kind === "restart") {
-			streams.stdout.write(`${pending.latest} is installed globally; this ${options.binary} is ${pending.running}, started from somewhere else — npx's cache, a project's own install, a checkout. Run your command again from the installed one. ${options.binary} did not run.\n`);
+			streams.stdout.write(`${pending.latest} is installed globally; this ${cliOf(options.channel)} is ${pending.running}, started from somewhere else — npx's cache, a project's own install, a checkout. Run your command again from the installed one. The command did not run.\n`);
 			return EXIT_CODES.UPDATE;
 		}
 		if (!options.update) {
-			streams.stdout.write(`${options.binary} reads only this machine and cannot fetch the update itself. Run \`${UPDATE_WAYS.update.command}\` (\`${UPDATE_WAYS.update.npx}\` where agentcomms is not installed), then run your command again.\n`);
+			streams.stdout.write(`This ${cliOf(options.channel)} reads only this machine and cannot fetch the update itself. ${updateCommandSaid(commands, "update", (command) => `Run ${command}, then run your command again.`)}\n`);
 			return EXIT_CODES.UPDATE;
 		}
 		return afterUpdate(await options.update(), options, pending);
@@ -8811,39 +10199,50 @@ async function updateGateAtTerminal(options) {
 		const result = await gatedChangeAtTerminal(core, updateLaterChange(core, { now }), {
 			env,
 			output,
-			command: UPDATE_WAYS.later.command,
-			approveCommand: options.approveCommand,
+			rerun: ["update", "--later"],
+			rerunOn: "core",
 			answered: true,
 			streams
 		});
 		streams.stderr.write(`Put off until midnight${result.latest ? `: ${result.latest} will be asked about again tomorrow` : ""}.\n`);
 		return null;
 	}
-	throw new CommsError("USAGE", `cancelled: ${options.binary} did not run, and nothing was changed`, { hint: `Update with \`${UPDATE_WAYS.update.command}\`, or put it off until tomorrow with \`${UPDATE_WAYS.later.command}\`.` });
+	throw new CommsError("USAGE", "cancelled: the command did not run, and nothing was changed", { hint: bothSaid(commands, (update, later) => `Update with ${update}, or put it off until tomorrow with ${later}.`) });
+}
+/**
+* The CLI a gate stops, in product words — "Gmail CLI", "core CLI" — for its sentences: never its binary, which is no
+* command most people can run, and which a sentence would read as one (CUE-403).
+*/
+function cliOf(channel) {
+	if (channel === "core") return "core CLI";
+	return `${CHANNEL_SNAPSHOT.find((entry) => entry.manifest.channel === channel)?.manifest.label ?? channel} CLI`;
 }
 /**
 * The stop where nobody can be asked: the command does not run. "Update" names the update and "not now"; "restart"
 * — the update installed, and an older copy running — says to run the command from the installed one.
 */
-function updateRequired(pending, binary) {
-	const later = `\`${UPDATE_WAYS.later.command}\` to put it off until tomorrow`;
-	const npx = `Where agentcomms is not installed: \`${UPDATE_WAYS.update.npx}\`, and \`${UPDATE_WAYS.later.npx}\`.`;
+function updateRequired(pending, cli, commands) {
+	const ways = updateWaysOf(commands);
 	const details = {
 		running: pending.running,
 		latest: pending.latest,
 		installed: pending.kind === "restart",
-		update: UPDATE_WAYS.update,
-		later: UPDATE_WAYS.later
+		update: ways.update,
+		later: ways.later
 	};
-	if (pending.kind === "restart") return new CommsError("UPDATE_REQUIRED", `Hang on a minute, the update is installed, but this command isn't running it yet. ${pending.latest} is installed globally, and this ${binary} is ${pending.running}: run the command again from the installed one, or ${later}`, {
-		hint: `Nothing was done. An older copy is running — npx's cache, a project's own install, a checkout. "Not now" is a change a person approves: an agent gets the preview and an approval id (exit 10), and runs the same command again with --approval <id> once the person agrees. ${npx}`,
+	if (pending.kind === "restart") return new CommsError("UPDATE_REQUIRED", `Hang on a minute, the update is installed, but this command isn't running it yet. ${pending.latest} is installed globally, and this ${cli} is ${pending.running}: ${handoffSentence(commands.later, (later) => `run the command again from the installed one, or ${later} to put it off until tomorrow`)}`, {
+		hint: `Nothing was done. An older copy is running — npx's cache, a project's own install, a checkout. "Not now" is a change a person approves: an agent gets the preview and an approval id (exit 10), and runs the same command again with --approval <id> once the person agrees.`,
 		details
 	});
-	return new CommsError("UPDATE_REQUIRED", `${UPDATE_FIRST} ${pending.latest} is out (you have ${pending.running}): run \`${UPDATE_WAYS.update.command}\` first, or ${later}`, {
-		hint: `Nothing was done. Both are changes a person approves: an agent gets the preview and an approval id (exit 10), and runs the same command again with --approval <id> once the person agrees. ${npx}`,
+	return new CommsError("UPDATE_REQUIRED", `${UPDATE_FIRST} ${pending.latest} is out (you have ${pending.running}): ${bothSaid(commands, (update, later) => `run ${update} first, or ${later} to put it off until tomorrow`)}`, {
+		hint: `Nothing was done. Both are changes a person approves: an agent gets the preview and an approval id (exit 10), and runs the same command again with --approval <id> once the person agrees.`,
 		details
 	});
 }
+/** The update and "not now" in one sentence; with no command here — the same core gives both or neither — why not. */
+function bothSaid(commands, say) {
+	return handoffSentence(commands.update, (update) => handoffSentence(commands.later, (later) => say(update, later)));
+}
 /**
 * What the terminal says after the person's "now", and the exit status. "Updated. Run your command again." only when
 * the update did everything and this command's release is now installed where it runs from — its global package at
@@ -8851,8 +10250,10 @@ function updateRequired(pending, binary) {
 * script that goes on after `cmd && next` must not take it for the command's success.
 */
 async function afterUpdate(outcome, options, before) {
-	const { streams, binary } = options;
-	const notRun = `${binary} did not run`;
+	const { streams } = options;
+	const cli = cliOf(options.channel);
+	const notRun = "The command did not run";
+	const commands = updateCommands(options.core, options.output.platform);
 	if (outcome === "failed") {
 		streams.stdout.write(`${notRun}: the update did not finish — each step says how it went, above.\n`);
 		return EXIT_CODES.UNAVAILABLE;
@@ -8866,10 +10267,10 @@ async function afterUpdate(outcome, options, before) {
 			streams.stdout.write("Updated. Run your command again.\n");
 			return EXIT_CODES.OK;
 		}
-		streams.stdout.write(`${before.latest} is installed here: run your command again from it. ${notRun}.\n`);
+		streams.stdout.write(`${before.latest} is installed here: run your command again from it. It did not run.\n`);
 		return EXIT_CODES.UPDATE;
 	}
-	streams.stdout.write(`${notRun}: the update did not bring it to ${before.latest}. \`${UPDATE_WAYS.update.command}\` updates what this machine registers and has installed globally — what it found is said above — and this ${binary} ${before.running} is started from somewhere else: npx's cache, a project's own install, a checkout. Run it from ${before.latest}, or put this off until tomorrow with \`${UPDATE_WAYS.later.command}\`.\n`);
+	streams.stdout.write(`${notRun}: the update did not bring it to ${before.latest}. The update moves what this machine registers and has installed globally — what it found is said above — and this ${cli}, ${before.running}, is started from somewhere else: npx's cache, a project's own install, a checkout. ${handoffSentence(commands.later, (later) => `Run it from ${before.latest}, or put this off until tomorrow with ${later}.`)}\n`);
 	return EXIT_CODES.UPDATE;
 }
 async function askLine(streams, question) {
@@ -9143,18 +10544,20 @@ async function handUpdateCheckToChild(core, env, options) {
 		const claimedAt = await claimUpdateCheck(core, { now: options.now });
 		if (claimedAt === null) return;
 		const entry = options.entry === void 0 ? updateCheckChildEntry() : options.entry;
-		if (!(entry !== null && await startUpdateCheckChild(entry, claimedAt, env, deadline))) await askUnderClaim(core, env, claimedAt, { now: options.now });
+		if (!(entry !== null && await startUpdateCheckChild(entry, claimedAt, core.paths, env, deadline))) await askUnderClaim(core, env, claimedAt, { now: options.now });
 	} catch {}
 }
 /**
 * Starts the child and waits, until `deadline` at most, for it to say the ask is over, or to end. False when it could
 * not be started at all; then nothing was asked, and the claim is still this process's to ask under.
 */
-async function startUpdateCheckChild(entry, claimedAt, env, deadline) {
+async function startUpdateCheckChild(entry, claimedAt, paths, env, deadline) {
 	let child;
 	try {
+		const pathArgs = PATH_OPTIONS.flatMap(({ key, flag }) => [flag, paths[key]]);
 		child = spawn(entry.command, [
 			...entry.args,
+			...pathArgs,
 			UPDATE_CHECK_CHILD_COMMAND,
 			claimedAt
 		], {
@@ -9199,7 +10602,7 @@ async function startUpdateCheckChild(entry, claimedAt, env, deadline) {
 * already gone on, and the ask is finished all the same. Results are written only while the claim is this child's.
 */
 async function runUpdateCheckChild(core, env, claimedAt) {
-	if (claimedAt === void 0 || !Number.isFinite(Date.parse(claimedAt))) throw new CommsError("USAGE", `${UPDATE_CHECK_CHILD_COMMAND} takes the time of the claim it asks under`, { hint: "Nothing runs this but a command finishing the day’s update check; `agentcomms update --check` asks now." });
+	if (claimedAt === void 0 || !Number.isFinite(Date.parse(claimedAt))) throw new CommsError("USAGE", `${UPDATE_CHECK_CHILD_COMMAND} takes the time of the claim it asks under`, { hint: handoffSentence(requireHandoffs(core).core(["update", "--check"]), (command) => `Nothing runs this but a command finishing the day’s update check; ${command} asks now.`) });
 	try {
 		if ((await readUpdateCheck(core.paths.stateDir)).checking === claimedAt) await askUnderClaim(core, env, claimedAt);
 	} finally {
@@ -9238,8 +10641,8 @@ function terminalUpdateHooks(core, env, options) {
 			const result = await gatedChangeAtTerminal(core, updateChange(core, env, {}, options.deps), {
 				env,
 				output: options.output,
-				command: "agentcomms update",
-				approveCommand: options.approveCommand,
+				rerun: ["update"],
+				rerunOn: "core",
 				streams: options.streams
 			});
 			writeResult(result, options.output, (r) => renderUpdate(r, options.output.color), options.streams);
@@ -9249,7 +10652,7 @@ function terminalUpdateHooks(core, env, options) {
 	};
 }
 //#endregion
-//#region ../core/dist/tool-arguments-JmEBiWPl.mjs
+//#region ../core/dist/tool-arguments-BcYu_EPp.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -19009,7 +20412,7 @@ strictObject({
 		}))) !== JSON.stringify(narrowing)) issue(["narrowing"], kept ? `${kept.label}'s server is pinned by ${narrowingWords(narrowing)}, as its entries have always been written` : `\`inbox\`, \`--read-only\` and \`workspace\` are Gmail's and Slack's; a channel after them is pinned by ${narrowingWords(narrowing)} and nothing else`);
 	}
 	if (isCore) {
-		if (manifest.binary !== CORE_BINARY) issue(["binary"], `the core's command is \`${CORE_BINARY}\``);
+		if (manifest.binary !== CORE_BINARY) issue(["binary"], "is not the core's own command name");
 	} else if (!CHANNEL_BINARY.test(manifest.binary)) issue(["binary"], "a channel's command is `agent-<something>`");
 	(manifest.server.bins ?? []).forEach((bin, index) => {
 		if (!CHANNEL_BINARY.test(bin)) issue([
@@ -19033,7 +20436,7 @@ strictObject({
 		if (rivals.word === void 0 && rivals.packages === void 0) issue(["rivals"], "a word or packages");
 		if (rivals.word === void 0 !== (rivals.can === void 0)) issue(["rivals"], "`word` and `can` come together: what a server matching the word can do unapproved");
 	}
-	if (manifest.approve !== void 0 && !manifest.approve.startsWith(`${manifest.binary} `)) issue(["approve"], `the channel's own command: \`${manifest.binary} …\``);
+	if (manifest.approve !== void 0 && !manifest.approve.startsWith(`${manifest.binary} `)) issue(["approve"], "must start with the channel's own command, its `binary`, and a space");
 	if (manifest.skills) {
 		const family = manifest.skills.prefix.slice(0, -1);
 		if (manifest.skills.contract !== `skills/_shared/contract-${family}.md`) issue(["skills", "contract"], `skills/_shared/contract-${family}.md: a skill's contract is chosen by its prefix`);
@@ -20349,6 +21752,9 @@ function hiddenReason(element) {
 * What stays here is what core cannot say about a Resend account: that its mode is one of the two words (a record
 * with any other is refused, never read as something narrower), what its key can do, and that its secret reference
 * is its own.
+*
+* A refusal here names the command that repairs it, made by `handoffs` — the context's, Resend's own CLI as this
+* installation runs it (CUE-403) — or says why there is none here.
 */
 const PLATFORM = "resend";
 const MODES = ["read", "send"];
@@ -20376,7 +21782,7 @@ function keyPermissionOf(account) {
 * wrong. Core's schema reads any mode word so that one odd account cannot make the whole file unreadable; acting on
 * one is refused here, as Slack refuses its own.
 */
-function checkedAccount(name, account, platform = process.platform) {
+function checkedAccount(name, account, handoffs) {
 	const problem = (() => {
 		if (account.platform !== "resend") return `it is a ${account.platform} account`;
 		if (!MODES.includes(String(account.mode))) return `its mode is "${String(account.mode)}", and a Resend account is in read or send mode`;
@@ -20386,67 +21792,65 @@ function checkedAccount(name, account, platform = process.platform) {
 		if (lock !== void 0 && (typeof lock !== "string" || !DOMAIN.test(lock))) return "its domainLock is not a domain";
 		return null;
 	})();
-	if (problem !== null) throw new CommsError("CONFIG", `"${name}" is not a Resend account this release can act on: ${problem}`, { hint: `Remove it with ${inlineCommand(shellCommand([
-		"agent-resend",
+	if (problem !== null) throw new CommsError("CONFIG", `"${name}" is not a Resend account this release can act on: ${problem}`, { hint: handoffSentence(handoffs.own([
 		"account",
 		"remove",
 		name
-	], platform))} and add it again, or fix it in the configuration file.` });
+	]), (command) => `Remove it with ${command} and add it again, or fix it in the configuration file.`, { instead: "Fix it in the configuration file." }) });
 	return account;
 }
-function notFound(name) {
-	return () => new CommsError("NOT_FOUND", `there is no Resend account called "${name}"`, { hint: "List them with `agent-resend account list`; a person adds one with `agent-resend account add <org/resend>`." });
+function notFound(name, handoffs) {
+	return () => new CommsError("NOT_FOUND", `there is no Resend account called "${name}"`, { hint: handoffSentence(handoffs.own(["account", "list"]), (listed) => handoffSentenceToFill(handoffs.own(["account", "add"]), ["<org/resend>"], (adding) => `List them with ${listed}; a person adds one with ${adding}.`)) });
 }
 /** Every Resend account in `config`, checked, by name. */
-function resendAccounts(config, platform = process.platform) {
+function resendAccounts(config, handoffs) {
 	return Object.entries(config.accounts).filter(([, account]) => account.platform === PLATFORM).map(([name, account]) => ({
 		name,
-		account: checkedAccount(name, account, platform)
+		account: checkedAccount(name, account, handoffs)
 	})).sort((a, b) => a.name < b.name ? -1 : 1);
 }
 /**
 * The account by name, or a refusal that says what to do — through core's `resolveName`, so a name that was replaced
 * is refused with the one it has now rather than reported as unknown.
 */
-function requireAccount(config, name, platform = process.platform) {
-	const { alias, account } = resolveName(config, "account", name, notFound(name));
-	if (account.platform !== "resend") throw notFound(name)();
+function requireAccount(config, name, handoffs) {
+	const { alias, account } = resolveName(config, "account", name, notFound(name, handoffs));
+	if (account.platform !== "resend") throw notFound(name, handoffs)();
 	return {
 		name: alias,
-		account: checkedAccount(alias, account, platform)
+		account: checkedAccount(alias, account, handoffs)
 	};
 }
 /** The account under exactly this name, or null: no former names, no refusal. */
-function lookupAccount(config, name, platform = process.platform) {
+function lookupAccount(config, name, handoffs) {
 	const account = lookupName(config, "account", name);
 	if (!account || account.platform !== "resend") return null;
 	return {
 		name,
-		account: checkedAccount(name, account, platform)
+		account: checkedAccount(name, account, handoffs)
 	};
 }
 /** The account by its immutable id, under whatever name it has now. */
-function accountById(config, id, platform = process.platform) {
+function accountById(config, id, handoffs) {
 	const found = findById(config, "account", id);
 	if (!found || found.account.platform !== "resend") return null;
 	return {
 		name: found.alias,
-		account: checkedAccount(found.alias, found.account, platform)
+		account: checkedAccount(found.alias, found.account, handoffs)
 	};
 }
 /**
 * Refuses a name a new account cannot take — core's rule, for either config version: the grammar and the platform,
 * free in both maps, and never a former name — with this package's own hint for one already connected.
 */
-function checkNewName(config, name, platform = process.platform) {
+function checkNewName(config, name, handoffs) {
 	const check = nameAvailable(config, "account", name, PLATFORM);
 	if (check.ok) return;
-	if (lookupName(config, "account", name) || lookupName(config, "inbox", name)) throw new CommsError("USAGE", `there is already an account called "${name}"`, { hint: `Choose another name, or remove that one first with ${inlineCommand(shellCommand([
-		"agent-resend",
+	if (lookupName(config, "account", name) || lookupName(config, "inbox", name)) throw new CommsError("USAGE", `there is already an account called "${name}"`, { hint: handoffSentence(handoffs.own([
 		"account",
 		"remove",
 		name
-	], platform))}.` });
+	]), (command) => `Choose another name, or remove that one first with ${command}.`, { instead: "Choose another name." }) });
 	throw check.error;
 }
 /** `config` with `account` under `name`. */
@@ -20482,22 +21886,22 @@ function changePolicyIn(config, account) {
 */
 var AccountStore = class {
 	#load;
-	#platform;
-	constructor(load, platform = process.platform) {
+	#handoffs;
+	constructor(load, handoffs) {
 		this.#load = load;
-		this.#platform = platform;
+		this.#handoffs = handoffs;
 	}
 	async list() {
-		return resendAccounts(await this.#load(), this.#platform);
+		return resendAccounts(await this.#load(), this.#handoffs);
 	}
 	async find(name) {
-		return lookupAccount(await this.#load(), name, this.#platform);
+		return lookupAccount(await this.#load(), name, this.#handoffs);
 	}
 	async findById(id) {
-		return accountById(await this.#load(), id, this.#platform);
+		return accountById(await this.#load(), id, this.#handoffs);
 	}
 	async require(name) {
-		return requireAccount(await this.#load(), name, this.#platform);
+		return requireAccount(await this.#load(), name, this.#handoffs);
 	}
 };
 var Throttle = class {
@@ -20628,23 +22032,44 @@ var Throttle = class {
 //#endregion
 //#region src/context.ts
 const TEAM_DOMAINS_TTL_MS = 3e5;
+/**
+* The commands this package prints, located from it (CUE-403): core has to have been opened with Resend as its caller.
+* A core opened without one — or as another package — would print bare names, or that package's commands for Resend's,
+* so it is a programming error here rather than a sentence a person reads.
+*/
+function resendHandoffs(core) {
+	const handoffs = requireHandoffs(core);
+	if (handoffs.caller.packageName !== "@agentcomms/resend") throw new TypeError(`core was opened as ${handoffs.caller.packageName}, so it would print that package's commands for Resend's: open it with RESEND_CALLER`);
+	return handoffs;
+}
 var ResendContext = class {
 	core;
 	env;
 	now;
 	platform;
 	surface;
+	/**
+	* What every result, refusal and hint names for a person to run: Resend's own CLI as this installation runs it, or
+	* core's through its installed dependency (`own`, `core`), quoted for `platform` — or why there is none here.
+	*/
+	handoffs;
 	accounts;
 	#fetch;
 	#throttle;
 	#teamDomains = /* @__PURE__ */ new Map();
 	constructor(options = {}) {
 		this.env = options.env ?? process.env;
-		this.core = options.core ?? openCore({ env: this.env });
+		this.core = options.core ?? openCore({
+			env: this.env,
+			platform: options.platform ?? process.platform,
+			...options.pathOverrides ? { pathOverrides: options.pathOverrides } : {},
+			caller: RESEND_CALLER
+		});
 		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.platform = options.platform ?? process.platform;
 		this.surface = options.surface ?? "cli";
-		this.accounts = new AccountStore(() => this.core.config.load(), this.platform);
+		this.handoffs = resendHandoffs(this.core).on(this.platform);
+		this.accounts = new AccountStore(() => this.core.config.load(), this.handoffs);
 		this.#fetch = options.fetch;
 		this.#throttle = new Throttle(this.core.paths.stateDir, options.throttle);
 	}
@@ -20693,12 +22118,11 @@ var ResendContext = class {
 	/** A transport for a connected account: its key from the secret store, the machine's throttle, and any open permit. */
 	async transport(named, permit) {
 		const key = await (await this.secrets()).get(named.account.secretRef);
-		if (key === null || key.trim() === "") throw new CommsError("AUTH_REQUIRED", `the key for "${named.name}" is not in the secret store`, { hint: `A person removes the account and adds it again: ${inlineCommand(shellCommand([
-			"agent-resend",
+		if (key === null || key.trim() === "") throw new CommsError("AUTH_REQUIRED", `the key for "${named.name}" is not in the secret store`, { hint: handoffSentence(this.handoffs.own([
 			"account",
 			"add",
 			named.name
-		], this.platform))}.` });
+		]), (command) => `A person removes the account and adds it again: ${command}.`) });
 		return {
 			fetch: this.#fetch,
 			key,
@@ -20818,7 +22242,7 @@ function codeFor(status, name) {
 	if (name === "restricted_api_key" && status === 401) return {
 		code: "SCOPE_MISSING",
 		message: "this account’s key can only send email; Resend refuses everything else with it",
-		hint: "Reads need a full-access key. Add one under another name with `agent-resend account add`."
+		hint: "Reads need a full-access key. A person adds one under another account name, at their own terminal."
 	};
 	if (status === 401 || name === "restricted_api_key" || name === "suspended_api_key") return {
 		code: "AUTH_REQUIRED",
@@ -21049,7 +22473,8 @@ async function readAttachment(path, policy) {
 	const real = await checkAttachable(path, {
 		roots: [...policy.roots],
 		deny: [...defaultAttachDeny(policy.configDir, policy.env), ...policy.deny],
-		home
+		home,
+		handoffs: policy.handoffs
 	});
 	if ((await stat(real)).size > 41943040) throw bad(`${basename(real)} is larger than Resend accepts`);
 	const bytes = new Uint8Array(await readFile(real));
@@ -21251,8 +22676,8 @@ function keyFingerprint(key) {
 }
 /** The plain statement `account show` and `doctor` make about who enforces what. */
 function guaranteeOf(account) {
-	if (keyPermissionOf(account) === "sending_access") return `This key can only send: Resend enforces that, and refuses it every read.${account.domainLock ? ` It was declared restricted to ${account.domainLock} when it was added; that is not something agent-resend can check without sending, so Resend enforces it, not this package.` : ""} agent-resend still sends only after a person approves each email.`;
-	return account.mode === "read" ? "Read-only is enforced by agent-resend’s own code, not by the key. Resend has no read-only key: this full-access key could send mail, delete domains and create API keys in anything else that held it. agent-resend refuses every send from this account while it is in read mode." : "This full-access key can do anything at Resend. agent-resend sends only after a person approves each email, and never manages domains, keys or webhooks — but the key itself would not stop anything else that held it.";
+	if (keyPermissionOf(account) === "sending_access") return `This key can only send: Resend enforces that, and refuses it every read.${account.domainLock ? ` It was declared restricted to ${account.domainLock} when it was added; that is not something this package can check without sending, so Resend enforces it, not this package.` : ""} This package still sends only after a person approves each email.`;
+	return account.mode === "read" ? "Read-only is enforced by this package’s own code, not by the key. Resend has no read-only key: this full-access key could send mail, delete domains and create API keys in anything else that held it. This package refuses every send from this account while it is in read mode." : "This full-access key can do anything at Resend. This package sends only after a person approves each email, and never manages domains, keys or webhooks — but the key itself would not stop anything else that held it.";
 }
 function viewOf(named, config) {
 	const { account } = named;
@@ -21275,11 +22700,11 @@ function viewOf(named, config) {
 }
 async function listAccounts(context) {
 	const config = await context.config();
-	return { accounts: resendAccounts(config, context.platform).map((named) => viewOf(named, config)) };
+	return { accounts: resendAccounts(config, context.handoffs).map((named) => viewOf(named, config)) };
 }
 async function showAccount(context, name) {
 	const config = await context.config();
-	return viewOf(requireAccount(config, name, context.platform), config);
+	return viewOf(requireAccount(config, name, context.handoffs), config);
 }
 /** A mode word checked by the operation, so both surfaces refuse it in the same words. */
 function modeOf(raw) {
@@ -21298,9 +22723,13 @@ function changePolicyOf(raw) {
 	throw new CommsError("USAGE", `"${String(raw)}" is not a change policy: use chat or confirm`);
 }
 /** Refuses a key that is already connected, under any name: one key, one account. */
-function refuseConnectedKey(config, fingerprint, platform) {
-	const same = resendAccounts(config, platform).find((named) => named.account.workspace === fingerprint);
-	if (same) throw new CommsError("USAGE", `this key is already connected as "${same.name}"`, { hint: "One key, one account. Change that one with `agent-resend account policy`." });
+function refuseConnectedKey(config, fingerprint, handoffs) {
+	const same = resendAccounts(config, handoffs).find((named) => named.account.workspace === fingerprint);
+	if (same) throw new CommsError("USAGE", `this key is already connected as "${same.name}"`, { hint: handoffSentence(handoffs.own([
+		"account",
+		"policy",
+		same.name
+	]), (command) => `One key, one account. Change that one with ${command}, adding --send, --mode or --change.`) });
 }
 /**
 * Connects an account, once the key has been inspected — a `GatedChange`, so connecting one in `send` mode, or with
@@ -21334,8 +22763,8 @@ function addAccountChange(context, request, inspection) {
 		...domainLock ? { domainLock } : {}
 	};
 	const connect = (config) => {
-		checkNewName(config, request.name, context.platform);
-		refuseConnectedKey(config, fingerprint, context.platform);
+		checkNewName(config, request.name, context.handoffs);
+		refuseConnectedKey(config, fingerprint, context.handoffs);
 		return withAccount(config, request.name, account);
 	};
 	return {
@@ -21351,7 +22780,7 @@ function addAccountChange(context, request, inspection) {
 			};
 		},
 		apply: async (consent) => {
-			const { store, choosing } = secretsStoreFor(await context.config(), void 0, context.platform);
+			const { store, choosing } = secretsStoreFor(await context.config(), void 0, context.handoffs);
 			const secrets = await context.core.secrets(store);
 			await secrets.set(account.secretRef, request.key.trim());
 			let written;
@@ -21392,7 +22821,7 @@ function addAccountChange(context, request, inspection) {
 function removeAccountChange(context, name) {
 	return {
 		plan: (config) => {
-			const found = requireAccount(config, name, context.platform);
+			const found = requireAccount(config, name, context.handoffs);
 			return {
 				account: found.name,
 				before: config,
@@ -21402,25 +22831,23 @@ function removeAccountChange(context, name) {
 			};
 		},
 		apply: async (_consent, request) => {
-			const approved = requireAccount(request.before, name, context.platform).account;
+			const approved = requireAccount(request.before, name, context.handoffs).account;
 			const removed = await withCredentialsLock(context.core.paths.configDir, async () => {
-				const found = requireAccount(await context.config(), name, context.platform);
-				if (found.account.id !== approved.id) throw new CommsError("CONFIG", `"${name}" changed after its removal was approved, so nothing was removed`, { hint: `Look at it with ${inlineCommand(shellCommand([
-					"agent-resend",
+				const found = requireAccount(await context.config(), name, context.handoffs);
+				if (found.account.id !== approved.id) throw new CommsError("CONFIG", `"${name}" changed after its removal was approved, so nothing was removed`, { hint: handoffSentence(context.handoffs.own([
 					"account",
 					"show",
 					name
-				], context.platform))}, and remove it again if you still want it gone.` });
+				]), (command) => `Look at it with ${command}, and remove it again if you still want it gone.`) });
 				const secrets = await context.secrets();
 				await secrets.delete(found.account.secretRef).catch(() => false);
 				await context.core.config.update((current) => {
-					if (secretsStoreOf(current) !== secrets.kind) throw new CommsError("TRANSIENT", `the secret store changed while "${name}" was being removed`, { hint: `Run ${inlineCommand(shellCommand([
-						"agent-resend",
+					if (secretsStoreOf(current) !== secrets.kind) throw new CommsError("TRANSIENT", `the secret store changed while "${name}" was being removed`, { hint: handoffSentence(context.handoffs.own([
 						"account",
 						"remove",
 						name
-					], context.platform))} again.` });
-					const held = accountById(current, found.account.id, context.platform);
+					]), (command) => `Run ${command} again.`) });
+					const held = accountById(current, found.account.id, context.handoffs);
 					if (!held) return current;
 					return withoutAccount(current, held.name);
 				});
@@ -21472,7 +22899,7 @@ function reportOf(named, config) {
 }
 async function policyReport(context, name) {
 	const config = await context.config();
-	return reportOf(requireAccount(config, name, context.platform), config);
+	return reportOf(requireAccount(config, name, context.handoffs), config);
 }
 /**
 * Why a policy report refuses the approval it is handed, in the words of the surface it came from, as core's
@@ -21514,7 +22941,7 @@ function policyChange(context, name, wanted) {
 	].filter(Boolean).join(", ");
 	return {
 		plan: (config) => {
-			const found = checked(requireAccount(config, name, context.platform));
+			const found = checked(requireAccount(config, name, context.handoffs));
 			return {
 				account: found.name,
 				before: config,
@@ -21523,11 +22950,11 @@ function policyChange(context, name, wanted) {
 			};
 		},
 		apply: async (consent, request) => {
-			const approved = requireAccount(request.before, name, context.platform).account;
+			const approved = requireAccount(request.before, name, context.handoffs).account;
 			let written;
 			const config = await context.core.config.update((current) => {
-				const held = accountById(current, approved.id, context.platform);
-				if (!held) throw new CommsError("CONFIG", `"${name}" changed while its policy was being set, so nothing was set`, { hint: "Check it with `agent-resend account list`, then set the policy again." });
+				const held = accountById(current, approved.id, context.handoffs);
+				if (!held) throw new CommsError("CONFIG", `"${name}" changed while its policy was being set, so nothing was set`, { hint: handoffSentence(context.handoffs.own(["account", "list"]), (command) => `Check it with ${command}, then set the policy again.`) });
 				written = {
 					name: held.name,
 					account: next(checked(held).account)
@@ -21559,7 +22986,17 @@ function policyChange(context, name, wanted) {
 * own promise rather than the key's: a person deciding how much to trust an agent with a full-access key should not
 * have to find that out from the source.
 */
-const READ_ONLY_STATEMENT = "Read-only is enforced by agent-resend’s own code, not by the key: Resend has no read-only API key, and a full-access key can also send, delete domains and create keys. A sending-only key can only send; Resend enforces that one.";
+const READ_ONLY_STATEMENT = "Read-only is enforced by this package’s own code, not by the key: Resend has no read-only API key, and a full-access key can also send, delete domains and create keys. A sending-only key can only send; Resend enforces that one.";
+/** Two commands to run one after the other, as a fix: both located, or the reason there is none — said once. */
+function thenFix(first, second) {
+	if (!isCommand(first)) return remedy(first);
+	if (!isCommand(second)) return remedy(second);
+	return remedy([
+		first,
+		", then ",
+		second
+	]);
+}
 async function checkAccount(context, named, offline) {
 	const checks = [];
 	let key = null;
@@ -21573,24 +23010,22 @@ async function checkAccount(context, named, offline) {
 			name: "key stored",
 			ok: false,
 			detail: "the key is missing from the secret store",
-			fix: `${commandText(shellCommand([
-				"agent-resend",
+			fix: thenFix(context.handoffs.own([
 				"account",
 				"remove",
 				named.name
-			], context.platform))}, then ${commandText(shellCommand([
-				"agent-resend",
+			]), context.handoffs.own([
 				"account",
 				"add",
 				named.name
-			], context.platform))}`
+			]))
 		});
 	} catch (error) {
 		checks.push({
 			name: "key stored",
 			ok: false,
 			detail: toCommsError(error).message,
-			fix: "agentcomms doctor"
+			fix: remedy(context.handoffs.core(["doctor"]))
 		});
 	}
 	const blocked = await context.throttle().blockedUntil();
@@ -21610,7 +23045,7 @@ async function checkAccount(context, named, offline) {
 			name: "key permission",
 			ok: false,
 			detail: "recorded as sending-only, but Resend let it read — it has full access",
-			fix: `remove and add ${named.name} again so its permission is recorded as it is`
+			fix: remedy(`remove and add ${named.name} again so its permission is recorded as it is`)
 		});
 		else checks.push({
 			name: "key works",
@@ -21627,13 +23062,13 @@ async function checkAccount(context, named, offline) {
 			name: "key permission",
 			ok: false,
 			detail: "recorded as full access, but Resend now refuses it every read",
-			fix: `remove and add ${named.name} again with the key you mean`
+			fix: remedy(`remove and add ${named.name} again with the key you mean`)
 		});
 		else checks.push({
 			name: "key works",
 			ok: false,
 			detail: comms.message,
-			...comms.hint ? { fix: comms.hint } : {}
+			...comms.hint ? { fix: remedy(comms.hint) } : {}
 		});
 	}
 	return {
@@ -21653,7 +23088,7 @@ async function runDoctor(context, options = {}) {
 		name: "node",
 		ok: nodeOk,
 		detail: `Node ${process.versions.node}`,
-		...nodeOk ? {} : { fix: "Install Node 22.12 or newer." }
+		...nodeOk ? {} : { fix: remedy("Install Node 22.12 or newer.") }
 	});
 	let store = "unknown";
 	try {
@@ -21668,7 +23103,7 @@ async function runDoctor(context, options = {}) {
 			name: "config",
 			ok: false,
 			detail: toCommsError(error).message,
-			fix: "agentcomms doctor"
+			fix: remedy(context.handoffs.core(["doctor"]))
 		});
 	}
 	let named = [];
@@ -22086,12 +23521,16 @@ function domainRow(entry) {
 }
 /** The team's domains; with `domain`, that one with the DNS records it needs. */
 async function listDomains(context, name, options = {}) {
-	return whenReadable(context, name, async (_named, transport) => {
+	return whenReadable(context, name, async (named, transport) => {
 		const domains = ((await resendRequest(transport, "GET", "/domains")).data ?? []).map(domainRow);
 		if (options.domain === void 0) return { domains };
 		const wanted = options.domain.trim().toLowerCase();
 		const found = domains.find((domain) => domain.name.toLowerCase() === wanted || domain.id === wanted);
-		if (!found) throw new CommsError("NOT_FOUND", `"${options.domain}" is not one of this team’s domains`, { hint: "List them with `agent-resend domains --account <org/resend>`." });
+		if (!found) throw new CommsError("NOT_FOUND", `"${options.domain}" is not one of this team’s domains`, { hint: handoffSentence(context.handoffs.own([
+			"domains",
+			"--account",
+			named.name
+		]), (command) => `List them with ${command}.`) });
 		const detail = await resendRequest(transport, "GET", `/domains/${resendId(found.id, "domain id")}`);
 		const records = (Array.isArray(detail.records) ? detail.records : []).map((record) => ({
 			record: text(record.record),
@@ -22371,7 +23810,7 @@ const DAY = /^\d{4}-\d{2}-\d{2}/;
 /** The downloads root: `~/Downloads/agent-communications` unless core's config says otherwise. */
 async function downloadsRoot(context) {
 	const configured = (await context.config()).defaults.downloadsDir;
-	const root = configured ? expandHome(configured, homeDirectory(context.env)) : context.core.paths.downloadsDir;
+	const root = context.core.pathOverrides.downloadsDir ?? (configured ? expandHome(configured, homeDirectory(context.env)) : context.core.paths.downloadsDir);
 	await ensurePrivateDir(root);
 	return root;
 }
@@ -22630,15 +24069,28 @@ async function ownRecord(context, named, approvalId) {
 	if (!record || approvalKind(record) !== "send" || record.inboxId !== named.account.id) throw new CommsError("NOT_FOUND", `there is no send approval ${approvalId} for "${named.name}"`, { hint: "Approvals last ten minutes. Prepare the send again." });
 	return record;
 }
-function requireSendMode(named, platform) {
-	if (named.account.mode !== "send") throw new CommsError("SCOPE_MISSING", `"${named.name}" is in read mode, so it sends nothing`, { hint: `A person can allow sending with ${inlineCommand(shellCommand([
-		"agent-resend",
+function requireSendMode(named, handoffs) {
+	if (named.account.mode !== "send") throw new CommsError("SCOPE_MISSING", `"${named.name}" is in read mode, so it sends nothing`, { hint: handoffSentence(handoffs.own([
 		"account",
 		"policy",
 		named.name,
 		"--mode",
 		"send"
-	], platform))}, which is a change they approve.` });
+	]), (command) => `A person can allow sending with ${command}, which is a change they approve.`) });
+}
+/** Resend's own `approve` for this send, located: what a person runs at their own terminal under `confirm`. */
+function approveCommand(handoffs, approvalId) {
+	return handoffs.own(["approve", approvalId]);
+}
+/** Resend's own `send status` for this send, located: how a send whose outcome is not known is checked. */
+function statusCommand(handoffs, approvalId, name) {
+	return handoffs.own([
+		"send",
+		"status",
+		approvalId,
+		"--account",
+		name
+	]);
 }
 /**
 * Whether the From domain may send, checked before an approval exists.
@@ -22653,8 +24105,18 @@ async function checkFromDomain(context, named, domain) {
 		return `From domain ${domain}: not checked — a sending-only key cannot read the domain list; Resend refuses an unverified domain`;
 	}
 	const found = ((await resendRequest(await context.transport(named), "GET", "/domains")).data ?? []).find((entry) => String(entry.name ?? "").toLowerCase() === domain);
-	if (!found) throw new CommsError("BAD_DATA", `${domain} is not one of this Resend team's domains, so nothing can be sent from it`, { hint: "Send from an address at a verified domain: see `agent-resend domains`." });
-	if (found.status !== "verified") throw new CommsError("BAD_DATA", `${domain} is not verified at Resend (status: ${String(found.status)})`, { hint: "A person finishes the DNS records for it first: `agent-resend domains --domain <name>` lists them." });
+	if (!found) throw new CommsError("BAD_DATA", `${domain} is not one of this Resend team's domains, so nothing can be sent from it`, { hint: handoffSentence(context.handoffs.own([
+		"domains",
+		"--account",
+		named.name
+	]), (command) => `Send from an address at a verified domain: see ${command}.`) });
+	if (found.status !== "verified") throw new CommsError("BAD_DATA", `${domain} is not verified at Resend (status: ${String(found.status)})`, { hint: handoffSentence(context.handoffs.own([
+		"domains",
+		"--account",
+		named.name,
+		"--domain",
+		domain
+	]), (command) => `A person finishes the DNS records for it first: ${command} lists them.`) });
 	const sending = found.capabilities?.sending;
 	if (sending !== void 0 && sending !== "enabled") throw new CommsError("BAD_DATA", `${domain} is verified, but sending from it is ${String(sending)}`);
 	return `From domain ${domain}: verified for sending at Resend`;
@@ -22705,12 +24167,12 @@ function expectationOf(message) {
 		subject: message.subject
 	};
 }
-function describePolicy(effective, approvalId, flags, platform) {
-	if (effective === "confirm") return `Policy: confirm${flags.length > 0 ? ` (${flags.join(", ")})` : ""} — a person runs ${inlineCommand(shellCommand([
-		"agent-resend",
-		"approve",
-		approvalId
-	], platform))} at their own terminal before this can go.`;
+/**
+* The preview's policy line. Under `confirm` it names Resend's own `approve`, located by the process that renders it —
+* the preparing one, then the approving one: a send's approval is bound to the message's digest, not to this line.
+*/
+function describePolicy(effective, approvalId, flags, handoffs) {
+	if (effective === "confirm") return `Policy: confirm${flags.length > 0 ? ` (${flags.join(", ")})` : ""} — ${handoffSentence(approveCommand(handoffs, approvalId), (command) => `a person runs ${command} at their own terminal before this can go.`, { instead: "a person approves it at their own terminal before this can go." })}`;
 	return "Policy: chat — send only after the user approves this exact preview.";
 }
 function previewOf(options) {
@@ -22720,7 +24182,12 @@ function previewOf(options) {
 		`Reach: ${reach.length} unique recipient(s) — To ${message.to.length} · Cc ${message.cc.length} · Bcc ${message.bcc.length}${reach.length > 10 ? ` — more than 10, so a person approves it at a terminal` : ""}`,
 		options.domainNote,
 		...message.bcc.length > 0 ? [`${message.bcc.length} blind recipient(s) — the others will not see them`] : [],
-		...message.scheduledAt ? [`Scheduled for ${message.scheduledAt}; until then it can be cancelled with \`agent-resend scheduled cancel\``] : ["Sends as soon as it is approved and executed"],
+		...message.scheduledAt ? [handoffSentenceToFill(options.handoffs.own([
+			"scheduled",
+			"cancel",
+			"--account",
+			options.name
+		]), ["<id>"], (command) => `Scheduled for ${message.scheduledAt}; until then it can be cancelled with ${command}`, { instead: `Scheduled for ${message.scheduledAt}; until then it can be cancelled with resend_scheduled_cancel.` })] : ["Sends as soon as it is approved and executed"],
 		...options.study.warnings,
 		...options.built.warnings
 	];
@@ -22748,7 +24215,7 @@ function previewOf(options) {
 		thread: message.inReplyTo ? `reply to ${message.inReplyTo}${message.references.length > 1 ? ` (${message.references.length} references)` : ""}` : void 0,
 		links: options.built.links,
 		warnings,
-		policy: describePolicy(options.effective, options.approvalId, options.flags, options.platform)
+		policy: describePolicy(options.effective, options.approvalId, options.flags, options.handoffs)
 	});
 }
 async function attachPolicy(context) {
@@ -22757,7 +24224,8 @@ async function attachPolicy(context) {
 		configDir: context.core.paths.configDir,
 		env: context.env,
 		roots: config.defaults.attachRoots,
-		deny: config.defaults.attachDeny
+		deny: config.defaults.attachDeny,
+		handoffs: context.handoffs
 	};
 }
 /**
@@ -22766,17 +24234,16 @@ async function attachPolicy(context) {
 */
 async function prepareSend(context, name, input) {
 	const named = await context.accounts.require(name);
-	requireSendMode(named, context.platform);
+	requireSendMode(named, context.handoffs);
 	const config = await context.config();
 	const livePolicy = named.account.sendPolicy ?? config.defaults.sendPolicy;
-	if (livePolicy === "never") throw new CommsError("POLICY_NEVER", `sending from ${name} is turned off (policy: never)`, { hint: `A person can change it with ${inlineCommand(shellCommand([
-		"agent-resend",
+	if (livePolicy === "never") throw new CommsError("POLICY_NEVER", `sending from ${name} is turned off (policy: never)`, { hint: handoffSentence(context.handoffs.own([
 		"account",
 		"policy",
 		name,
 		"--send",
 		"confirm"
-	], context.platform))}.` });
+	]), (command) => `A person can change it with ${command}.`) });
 	const built = await buildMessage(input, {
 		now: context.now(),
 		attach: await attachPolicy(context)
@@ -22829,7 +24296,7 @@ async function prepareSend(context, name, input) {
 			domainNote,
 			effective,
 			flags: study.flags,
-			platform: context.platform
+			handoffs: context.handoffs
 		}),
 		policy: livePolicy,
 		effectivePolicy: effective,
@@ -22837,11 +24304,7 @@ async function prepareSend(context, name, input) {
 		reach,
 		expect: record.expect,
 		expiresAt: record.expiresAt,
-		nextStep: effective === "confirm" ? `Show the preview to the user, then have them run ${inlineCommand(shellCommand([
-			"agent-resend",
-			"approve",
-			record.approvalId
-		], context.platform))} in their own terminal. You cannot approve this yourself. Then execute it with the same approval id and the recipients and subject shown.` : "Show the preview to the user verbatim and wait for an explicit yes. Then execute it with the same approval id and the recipients and subject shown above."
+		nextStep: effective === "confirm" ? `${handoffSentence(approveCommand(context.handoffs, record.approvalId), (command) => `Show the preview to the user, then have them run ${command} in their own terminal.`, { instead: "Show the preview to the user; they approve it at their own terminal." })} You cannot approve this yourself. Then execute it with the same approval id and the recipients and subject shown.` : "Show the preview to the user verbatim and wait for an explicit yes. Then execute it with the same approval id and the recipients and subject shown above."
 	};
 }
 /** The stored message and its attachments' bytes, checked again: a file changed since the preview voids the send. */
@@ -22970,17 +24433,10 @@ async function recordNoSend(context, records, options, error) {
 */
 async function executeSend(context, name, options) {
 	const named = await context.accounts.require(name);
-	requireSendMode(named, context.platform);
+	requireSendMode(named, context.handoffs);
 	const known = await ownRecord(context, named, options.approvalId);
 	if (known.state !== "pending" && known.state !== "approved") throw new CommsError("APPROVAL_VOID", `nothing was sent: ${describeState(known.state)}`, {
-		hint: known.state === "unknown" ? `Check what happened with ${inlineCommand(shellCommand([
-			"agent-resend",
-			"send",
-			"status",
-			options.approvalId,
-			"--account",
-			name
-		], context.platform))} before anything else.` : "Prepare the send again if it should still go.",
+		hint: known.state === "unknown" ? handoffSentence(statusCommand(context.handoffs, options.approvalId, name), (command) => `Check what happened with ${command} before anything else.`, { instead: "Check what happened with resend_send_status before anything else." }) : "Prepare the send again if it should still go.",
 		details: {
 			approvalId: options.approvalId,
 			state: known.state
@@ -23004,11 +24460,7 @@ async function executeSend(context, name, options) {
 		policy: livePolicy,
 		expect: options.expect
 	}, {
-		pendingHint: `Ask the user to run ${inlineCommand(shellCommand([
-			"agent-resend",
-			"approve",
-			options.approvalId
-		], context.platform))} in their own terminal, then execute it again with the same approval. You cannot approve it yourself.`,
+		pendingHint: `${handoffSentence(approveCommand(context.handoffs, options.approvalId), (command) => `Ask the user to run ${command} in their own terminal, then execute it again with the same approval.`, { instead: "Ask the user to approve it at their own terminal, then execute it again with the same approval." })} You cannot approve it yourself.`,
 		platform: context.platform
 	});
 	const records = new SendRecords(context.core.paths.stateDir, context.now);
@@ -23090,14 +24542,7 @@ async function executeSend(context, name, options) {
 			unrecorded.push(`the audit log could not record this (${failure instanceof Error ? failure.message : String(failure)})`);
 		}
 		throw new CommsError("TRANSIENT", `whether the email was sent is not known: ${said}`, {
-			hint: [`Do not send it again. Check the Resend dashboard or ask the recipient, and check with ${inlineCommand(shellCommand([
-				"agent-resend",
-				"send",
-				"status",
-				options.approvalId,
-				"--account",
-				name
-			], context.platform))}; this approval is not used again.`, ...unrecorded].join(" "),
+			hint: [`Do not send it again. ${handoffSentence(statusCommand(context.handoffs, options.approvalId, name), (command) => `Check the Resend dashboard or ask the recipient, and check with ${command}; this approval is not used again.`, { instead: "Check the Resend dashboard or ask the recipient, and check with resend_send_status; this approval is not used again." })}`, ...unrecorded].join(" "),
 			details: {
 				...error instanceof CommsError ? error.details : {},
 				approvalId: options.approvalId,
@@ -23262,7 +24707,7 @@ async function beginSendApproval(context, approvalId) {
 			domainNote: prepared.warnings[0] ?? "",
 			effective,
 			flags: record.riskFlags,
-			platform: context.platform
+			handoffs: context.handoffs
 		}),
 		challenge
 	};
@@ -23299,4 +24744,4 @@ async function revokeSendApproval(context, approvalId) {
 	});
 }
 //#endregion
-export { inlineCommand as $, CHANGE_POLICIES as A, agentMarker as B, policyChange as C, sendPolicyOf as D, removeAccountChange as E, CHANNEL_SERVERS as F, changeToolResult as G, approvalsOf as H, CommsError as I, commandPathOf as J, checkForUpdates as K, EXIT_CODES as L, SEND_POLICIES as M, checkNewName as N, showAccount as O, strictToolArguments as P, gatedChangeAtTerminal as Q, SEND_LOOKUP as R, policyApprovalRefusal as S, policyWanted as T, approveChangeAtTerminal as U, approvalKind as V, canPrompt as W, exemptFromUpdateGate as X, escapeForDisplay as Y, gatedChange as Z, runDoctor as _, REFUSED as _t, revokeSendApproval as a, renderPrune as at, listAccounts as b, ROUTES as bt, downloadReceived as c, serverInstallChange as ct, listReceived as d, terminalUpdateHooks as dt, installExitStatus as et, listScheduled as f, toCommsError as ft, showSentEmail as g, writeResult as gt, showReceived as h, updateToolGate as ht, prepareSend as i, renderInstall as it, MODES as j, ResendContext as k, getMetrics as l, serverPruneChange as lt, listSuppressions as m, updateGateAtTerminal as mt, executeSend as n, paint as nt, sendStatus as o, runCommand as ot, listSentEmails as p, truncateDisplay as pt, colorEnabled as q, finishSendApproval as r, refuseUnclaimedApproval as rt, cancelScheduledChange as s, runUpdateCheckChild as st, beginSendApproval as t, openCore as tt, listDomains as u, shellCommand as ut, addAccountChange as v, RESEND_API_ORIGIN as vt, policyReport as w, modeOf as x, VERSION$1 as xt, inspectKey as y, RESEND_DOWNLOAD_ORIGIN as yt, UPDATE_CHECK_CHILD_COMMAND as z };
+export { gatedChange as $, CHANGE_POLICIES as A, UPDATE_CHECK_CHILD_COMMAND as B, policyChange as C, REFUSED as Ct, sendPolicyOf as D, VERSION$1 as Dt, removeAccountChange as E, ROUTES as Et, CHANNEL_SERVERS as F, canPrompt as G, approvalKind as H, CommsError as I, cliHandoffs as J, changeToolResult as K, EXIT_CODES as L, SEND_POLICIES as M, checkNewName as N, showAccount as O, strictToolArguments as P, exemptFromUpdateGate as Q, PATH_OPTIONS as R, policyApprovalRefusal as S, RESEND_CALLER as St, policyWanted as T, RESEND_DOWNLOAD_ORIGIN as Tt, approvalsOf as U, agentMarker as V, approveChangeAtTerminal as W, commandPathOf as X, colorEnabled as Y, escapeForDisplay as Z, runDoctor as _, truncateDisplay as _t, revokeSendApproval as a, paint as at, listAccounts as b, writeResult as bt, downloadReceived as c, renderInstall as ct, listReceived as d, runCommand as dt, gatedChangeAtTerminal as et, listScheduled as f, runUpdateCheckChild as ft, showSentEmail as g, toCommsError as gt, showReceived as h, terminalUpdateHooks as ht, prepareSend as i, openCore as it, MODES as j, ResendContext as k, getMetrics as l, renderPrune as lt, listSuppressions as m, serverPruneChange as mt, executeSend as n, handoffSentenceToFill as nt, sendStatus as o, pathOverridesFromCliOptions as ot, listSentEmails as p, serverInstallChange as pt, checkForUpdates as q, finishSendApproval as r, installExitStatus as rt, cancelScheduledChange as s, refuseUnclaimedApproval as st, beginSendApproval as t, handoffSentence as tt, listDomains as u, resolvePaths as ut, addAccountChange as v, updateGateAtTerminal as vt, policyReport as w, RESEND_API_ORIGIN as wt, modeOf as x, PACKAGE_NAME as xt, inspectKey as y, updateToolGate as yt, SEND_LOOKUP as z };