@agentcomms/resend 0.20.0 → 0.21.0

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as colorEnabled, A as removeAccountChange, Bt as VERSION, C as inspectKey, Ct as serverPruneChange, D as policyChange, Dt as truncateDisplay, E as policyApprovalRefusal, Ft as RESEND_CALLER, G as UPDATE_CHECK_CHILD_COMMAND, H as CommsError, J as approveRefusedHint, K as agentMarker, M as showAccount, Mt as wholeNumber, Nt as writeResult, O as policyReport, Ot as updateNoticeAtTerminal, P as ResendContext, Q as cliHandoffs, R as checkNewName, S as addAccountChange, St as serverInstallChange, T as modeOf, Tt as terminalUpdateHooks, U as EXIT_CODES, V as CHANNEL_SERVERS, W as PATH_OPTIONS, Y as canPrompt, _ as showSentEmail, _t as renderInstall, a as revokeSendApproval, at as gatedChangeAtTerminal, bt as runCommand, c as downloadReceived, ct as installExitStatus, d as listReceived, et as commandPathOf, f as listScheduled, ft as openCore, g as showReceived, gt as renderApprovalWait, ht as refuseUnclaimedApproval, i as prepareSend, j as sendPolicyOf, jt as waitForApproval, k as policyWanted, l as getMetrics, lt as kindOf, m as listSuppressions, mt as pathOverridesFromCliOptions, n as executeSend, nt as escapeForDisplay, o as sendStatus, ot as handoffSentence, p as listSentEmails, pt as paint, q as approveChangeAtTerminal, r as finishSendApproval, rt as exemptFromUpdateNotice, s as cancelScheduledChange, st as handoffSentenceToFill, t as beginSendApproval, tt as describeFenceReport, u as listDomains, vt as renderPrune, w as listAccounts, x as runDoctor, xt as runUpdateCheckChild, yt as resolvePaths } from "./send-CE6wM0-w.mjs";
+import { $ as colorEnabled, A as removeAccountChange, Bt as VERSION, C as inspectKey, Ct as serverPruneChange, D as policyChange, Dt as truncateDisplay, E as policyApprovalRefusal, Ft as RESEND_CALLER, G as UPDATE_CHECK_CHILD_COMMAND, H as CommsError, J as approveRefusedHint, K as agentMarker, M as showAccount, Mt as wholeNumber, Nt as writeResult, O as policyReport, Ot as updateNoticeAtTerminal, P as ResendContext, Q as cliHandoffs, R as checkNewName, S as addAccountChange, St as serverInstallChange, T as modeOf, Tt as terminalUpdateHooks, U as EXIT_CODES, V as CHANNEL_SERVERS, W as PATH_OPTIONS, Y as canPrompt, _ as showSentEmail, _t as renderInstall, a as revokeSendApproval, at as gatedChangeAtTerminal, bt as runCommand, c as downloadReceived, ct as installExitStatus, d as listReceived, et as commandPathOf, f as listScheduled, ft as openCore, g as showReceived, gt as renderApprovalWait, ht as refuseUnclaimedApproval, i as prepareSend, j as sendPolicyOf, jt as waitForApproval, k as policyWanted, l as getMetrics, lt as kindOf, m as listSuppressions, mt as pathOverridesFromCliOptions, n as executeSend, nt as escapeForDisplay, o as sendStatus, ot as handoffSentence, p as listSentEmails, pt as paint, q as approveChangeAtTerminal, r as finishSendApproval, rt as exemptFromUpdateNotice, s as cancelScheduledChange, st as handoffSentenceToFill, t as beginSendApproval, tt as describeFenceReport, u as listDomains, vt as renderPrune, w as listAccounts, x as runDoctor, xt as runUpdateCheckChild, yt as resolvePaths } from "./send-tAIE9B1y.mjs";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stripVTControlCharacters } from "node:util";
@@ -3488,7 +3488,7 @@ Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs a
 	}));
 	const mcp = program.command("mcp").description("run the MCP server on stdio, for a coding agent to connect to").option("--account <name>", "pin the server to one account; every tool then acts on it and no other").action(async (flags) => {
 		ran = true;
-		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-BlerMgOC.mjs")).startResendStdioServer;
+		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-DPJKJhGj.mjs")).startResendStdioServer;
 		const core = coreForInvocation();
 		await startResendStdioServer({
 			...deps,

package/dist/index.d.mts

@@ -4322,7 +4322,7 @@ declare namespace external_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor };
 }
 //#endregion
-//#region ../core/dist/launcher-VgihcM7Q.d.mts
+//#region ../core/dist/launcher-BuZRjGA8.d.mts
 //#endregion
 //#region src/config-hooks.d.ts
 /**
@@ -4415,7 +4415,7 @@ interface ResolvedPaths {
    */
   downloadsDir: string;
 }
-type ErrorCode = "UNEXPECTED" | "APPROVAL_REQUIRED" | "APPROVAL_PENDING" | "APPROVAL_EXPIRED" | "APPROVAL_VOID" | "SEND_OUTCOME_UNKNOWN" | "SEND_REFUSED" | "POLICY_NEVER" | "RATE_CAPPED" | "UNSENDABLE_HTML" | "LOOSENING_REFUSED" | "USAGE" | "CURSOR_MISMATCH" | "BAD_DATA" | "REPLY_INVALID" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE" | "SOURCE_UNAVAILABLE" | "SECRET_STORE_UNAVAILABLE" | "TRANSIENT" | "KEYCHAIN_APPROVAL_PENDING" | "LOCK_TIMEOUT" | "AUTH_REQUIRED" | "SCOPE_MISSING" | "WHATSAPP_VISIBILITY_SEAM_REQUIRED" | "CONFIG";
+type ErrorCode = "UNEXPECTED" | "APPROVAL_REQUIRED" | "APPROVAL_PENDING" | "APPROVAL_EXPIRED" | "APPROVAL_VOID" | "SEND_OUTCOME_UNKNOWN" | "SEND_REFUSED" | "POLICY_NEVER" | "RATE_CAPPED" | "UNSENDABLE_HTML" | "LOOSENING_REFUSED" | "NEEDS_NEWER_RELEASE" | "USAGE" | "CURSOR_MISMATCH" | "BAD_DATA" | "REPLY_INVALID" | "NOT_FOUND" | "PROVIDER_UNAVAILABLE" | "SOURCE_UNAVAILABLE" | "SECRET_STORE_UNAVAILABLE" | "TRANSIENT" | "KEYCHAIN_APPROVAL_PENDING" | "LOCK_TIMEOUT" | "AUTH_REQUIRED" | "SCOPE_MISSING" | "WHATSAPP_VISIBILITY_SEAM_REQUIRED" | "CONFIG";
 interface CommsErrorOptions {
   hint?: string;
   details?: Record<string, unknown>;
@@ -4897,6 +4897,18 @@ interface OrganisationRecord {
   } | undefined;
   /** The organisation's update caps, from the file beside its profile; absent when it names none. */
   updates?: OrganisationUpdates | undefined;
+  /**
+   * The entries of the profile's `extensions` this release did not know and skipped, being optional (design 2026-10-19,
+   * X3): the release that first understands each, and the SHA-256 of the entry's canonical JSON — as
+   * `Record<string, OrganisationIgnoredExtension>`. Kept in step with the profile. Absent when none was skipped.
+   *
+   * Held as the file holds it, whatever its shape, and read only through `ignoredListOf`, which keeps the well-formed
+   * entries and names the rest: 0.21.0 is the first release to read it, so a shape a later release or a hand gave it
+   * must never make the whole configuration unreadable, nor be dropped by an unrelated write. Losing it is safe: a
+   * later release that understands an entry judges applying it by its classifier whether or not the list names it —
+   * a tightening at once, anything else approved first, never a repair of drift (X4).
+   */
+  ignoredExtensions?: unknown;
 }
 interface ConfigV2 extends ConfigBody {
   version: 2;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { Bt as VERSION, Ft as RESEND_CALLER, H as CommsError, It as REFUSED, Lt as RESEND_API_ORIGIN, N as resendRequest, P as ResendContext, Pt as PACKAGE_NAME, Rt as RESEND_DOWNLOAD_ORIGIN, b as readBody, dt as newBoundary, h as resendId, ut as neutralise, v as addressesOf, wt as stripInvisible, y as attachmentRisks, z as keyPermissionOf, zt as ROUTES } from "./send-CE6wM0-w.mjs";
-import { t as createResendMcpServer } from "./server-C1sSuZ8K.mjs";
+import { Bt as VERSION, Ft as RESEND_CALLER, H as CommsError, It as REFUSED, Lt as RESEND_API_ORIGIN, N as resendRequest, P as ResendContext, Pt as PACKAGE_NAME, Rt as RESEND_DOWNLOAD_ORIGIN, b as readBody, dt as newBoundary, h as resendId, ut as neutralise, v as addressesOf, wt as stripInvisible, y as attachmentRisks, z as keyPermissionOf, zt as ROUTES } from "./send-tAIE9B1y.mjs";
+import { t as createResendMcpServer } from "./server-CQ9RE8L7.mjs";
 //#region src/operations/events.ts
 const BODY_LIMIT = 2e4;
 const STATUS = /* @__PURE__ */ new Set([

package/dist/{send-CE6wM0-w.mjs → send-tAIE9B1y.mjs}

@@ -1,4 +1,4 @@
-import { S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
+import { C as unknown, S as union, b as strictObject, c as boolean, g as object, h as number, i as _enum, l as discriminatedUnion, m as looseObject, n as datetime, p as literal$1, s as array, x as string, y as record } from "./iso-USuVU_sk.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, unlink, utimes } from "node:fs/promises";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep, win32 } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
@@ -12,7 +12,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$2 = "0.20.0";
+const VERSION$2 = "0.21.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -201,7 +201,7 @@ const RESEND_CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-N_-uYKZQ.mjs
+//#region ../core/dist/update-check-CrKGPUCv.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -279,6 +279,11 @@ const ERROR_REGISTRY = {
 		retryable: false,
 		summary: "a safety setting can only be loosened by a person"
 	},
+	NEEDS_NEWER_RELEASE: {
+		exit: EXIT_CODES.UNEXPECTED,
+		retryable: false,
+		summary: "this needs a later agent-communications; update first, then run it again"
+	},
 	USAGE: {
 		exit: EXIT_CODES.USAGE,
 		retryable: false,
@@ -3973,12 +3978,32 @@ function emptyReceipt() {
 	};
 }
 async function readReceipt(context) {
-	let parsed;
+	let text;
+	try {
+		text = await readFile(receiptPath(context), "utf8");
+	} catch (error) {
+		return error.code === "ENOENT" ? emptyReceipt() : null;
+	}
+	return receiptFrom(text);
+}
+/** `readReceipt`, for a reader that cannot wait: the command locator. */
+function readReceiptSync(context) {
+	let text;
 	try {
-		parsed = JSON.parse(await readFile(receiptPath(context), "utf8"));
+		text = readFileSync(receiptPath(context), "utf8");
 	} catch (error) {
 		return error.code === "ENOENT" ? emptyReceipt() : null;
 	}
+	return receiptFrom(text);
+}
+/** The receipt a file holds, or null when it is not one this installation writes. */
+function receiptFrom(text) {
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		return null;
+	}
 	if (typeof parsed !== "object" || parsed === null || parsed.version !== RECEIPT_VERSION || typeof parsed.shims !== "object" || parsed.shims === null) return null;
 	const shims = {};
 	for (const [binary, value] of Object.entries(parsed.shims)) {
@@ -4140,6 +4165,31 @@ function directoryOnPath(context, directory) {
 function pathNotice(directory) {
 	return `The shim directory ${directory} is not on PATH. For this shell, run: export PATH=${posixWord(directory)}:"$PATH". No shell profile was edited.`;
 }
+/**
+* The managed shim for `binary` that starts `entry`, for a reader that cannot wait — the command locator, which names
+* it in place of a versioned runtime's entry when this installation has no stable launcher for it (0.21): its path as a
+* person puts it on PATH, or null.
+*
+* Only a shim this installation's receipt records at that very place, whose file is still the one it wrote, unchanged,
+* and which starts `entry` — the same file — with a Node that is there: what it runs now is exactly what the command it
+* stands in for would run. Never on a platform that has no shims, and never a file anyone else wrote.
+*/
+function managedShimStarting(context, binary, entry) {
+	if (!managedShimsSupported(context) || !isSafeBinary(binary)) return null;
+	try {
+		const publicPath = managedShimPath(context, binary);
+		const path = join(realpathSync(dirname(publicPath)), basename(publicPath));
+		const recorded = readReceiptSync(context)?.shims[binary];
+		if (recorded === void 0 || recorded.path !== path) return null;
+		if (!lstatSync(path).isFile() || sha256(readFileSync(path, "utf8")) !== recorded.digest) return null;
+		if (realpathSync(recorded.entry) !== realpathSync(entry)) return null;
+		accessSync(recorded.node, constants$1.X_OK);
+		accessSync(path, constants$1.X_OK);
+		return publicPath;
+	} catch {
+		return null;
+	}
+}
 /** Create or repoint one shim, but only while its target is free or still matches this installation's receipt. */
 async function writeManagedShim(context, spec) {
 	checkedBinary(spec.binary);
@@ -4266,6 +4316,114 @@ async function removeManagedShimsForRuntimes(context, runtimes, options = {}) {
 		};
 	});
 }
+/**
+* Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
+* to decide whether the release it last heard of is newer than the one running.
+*
+* Here rather than in `npm.ts`, which also talks to the registry: the reader of `update-check.json` is imported by
+* every server, WhatsApp's included, and must carry no network code at all (design 2026-09-28 §1). `npm.ts` re-exports
+* all of it, so nothing that imported these from there changes.
+*/
+/**
+* A version, exactly as semver writes one: `1.2.3`, `1.2.3-rc.1`, `1.2.3+build`.
+*
+* Anything the registry answers is checked against this before it is used, because a version goes into a directory
+* name (`runtime/<version>-gmail`), a sentence a person approves, and an argument to `npm install`. A registry — or a
+* mirror somebody configured — that answered `../x` or `1.0.0 && …` would otherwise put that in all three.
+*/
+const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+function isVersion(value) {
+	return typeof value === "string" && VERSION_PATTERN.test(value);
+}
+/** Two numeric strings with no leading zeros, compared as numbers of any size. */
+function compareNumeric(a, b) {
+	if (a.length !== b.length) return a.length < b.length ? -1 : 1;
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+/**
+* Semver precedence: -1, 0 or 1, or null when either is not a version.
+*
+* Numbers compare as numbers (`0.10.0` is after `0.9.9`), a prerelease comes before its release, and build metadata
+* counts for nothing. Written out rather than taken from a dependency: it is twenty lines, and the core installs as
+* few packages as it can.
+*/
+function compareVersions(a, b) {
+	const left = VERSION_PATTERN.exec(a);
+	const right = VERSION_PATTERN.exec(b);
+	if (!left || !right) return null;
+	for (const index of [
+		1,
+		2,
+		3
+	]) {
+		const order = compareNumeric(left[index] ?? "0", right[index] ?? "0");
+		if (order !== 0) return order < 0 ? -1 : 1;
+	}
+	const pre = (match) => match[4] === void 0 ? [] : match[4].split(".");
+	const [ours, theirs] = [pre(left), pre(right)];
+	if (ours.length === 0 || theirs.length === 0) return ours.length === theirs.length ? 0 : ours.length === 0 ? 1 : -1;
+	for (let index = 0; index < Math.max(ours.length, theirs.length); index += 1) {
+		const x = ours[index];
+		const y = theirs[index];
+		if (x === void 0) return -1;
+		if (y === void 0) return 1;
+		const [numericX, numericY] = [/^\d+$/.test(x), /^\d+$/.test(y)];
+		if (numericX && numericY) {
+			const order = compareNumeric(x, y);
+			if (order !== 0) return order < 0 ? -1 : 1;
+		} else if (numericX !== numericY) return numericX ? -1 : 1;
+		else if (x !== y) return x < y ? -1 : 1;
+	}
+	return 0;
+}
+/** Whether `version` is older than `latest`: by semver when both are versions, and otherwise whenever they differ. */
+function isBehind(version, latest) {
+	if (version === latest) return false;
+	const order = compareVersions(version, latest);
+	return order === null ? true : order < 0;
+}
+/**
+* Whether a version is a prerelease — `0.8.0-rc.1` — which the daily update check never counts as an update: a
+* machine is not told to "update" to a release candidate, nor a candidate told to go back to the last release.
+*/
+/**
+* A release as this suite publishes one, and the only form a version the registry gave is read or said in: a plain
+* `MAJOR.MINOR.PATCH` (re-review of 0.20.0, severity 6). A prerelease's words and build metadata are the registry's
+* text — `0.20.1+SYSTEM-ignore-…` is valid semver — so a version carrying either is no release here.
+*/
+function isPlainVersion(value) {
+	return typeof value === "string" && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value);
+}
+function isPrerelease(version) {
+	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
+}
+/**
+* Whether `version` is within a package's `engines` range: true or false, or null when the range is not one this reads.
+*
+* Read are the comparators `>=`, `>`, `<=`, `<` and `=` (or none) before a whole version, joined by spaces, which must
+* all hold, and alternatives joined by `||`. That is every range this suite declares (`>=22.12.0`, `>=22.16.0`).
+* Anything else — `^22.12.0`, `>=22`, `22.x` — is null rather than a guess: a command printed to run under this Node
+* is printed only when the range it has to meet says it may. A leading `v`, as `process.version` has it, is read.
+*/
+function satisfiesRange(version, range) {
+	const wanted = version.replace(/^v/, "");
+	if (!isVersion(wanted)) return null;
+	const alternatives = range.split("||").map((alternative) => alternative.trim().split(/\s+/).filter(Boolean));
+	if (alternatives.some((comparators) => comparators.length === 0)) return null;
+	let any = false;
+	for (const comparators of alternatives) {
+		let all = true;
+		for (const comparator of comparators) {
+			const match = /^(>=|<=|>|<|=)?(.+)$/.exec(comparator);
+			const bound = match?.[2] ?? "";
+			if (!isVersion(bound)) return null;
+			const order = compareVersions(wanted, bound);
+			if (!(match?.[1] === ">=" ? order >= 0 : match?.[1] === "<=" ? order <= 0 : match?.[1] === ">" ? order > 0 : match?.[1] === "<" ? order < 0 : order === 0)) all = false;
+		}
+		if (all) any = true;
+	}
+	return any;
+}
 /** The install options that pin a server to one account: the generic one, and Gmail's and Slack's own names. */
 const PIN_OPTIONS = Object.freeze([
 	"account",
@@ -5484,6 +5642,10 @@ async function listManagedRuntimes(dataDir, packageName) {
 *  - only directories directly inside `<data>/runtime`, named like a version, that hold this product's package —
 *    never a symbolic link, never another product's runtime, never anything else in that directory;
 *  - never this release's own;
+*  - never one newer than this release, or than the runtime its stable launcher starts: what an update is installing,
+*    or checking before it switches, is newer than anything a pointer names yet. The update lock keeps a person's
+*    prune from running beside an update (`serverPruneChange`); this keeps that runtime even when no lock is held —
+*    an update interrupted half-way, a prune that is not a person's;
 *  - never one an entry names in a client config `scanRegisteredServers` reads, in any scope — the ones this
 *    environment names, and every one an install recorded registering into, wherever `CLAUDE_CONFIG_DIR` or
 *    `CODEX_HOME` pointed then. When one of those files is there and cannot be read, nothing is removed at all: a
@@ -5561,10 +5723,18 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 		return null;
 	};
 	const current = managedRuntimeDir(context.core.paths.dataDir, product.packageName, product.version);
+	const starts = pointer === void 0 ? null : launcherRuntimeVersion(pointer.current, name);
+	/** Why a runtime newer than this release, or than what the launcher starts, stays; null for any other. */
+	const newer = (version) => {
+		const installing = "an update may be installing it, or checking it before it switches";
+		if (compareVersions(version, product.version) === 1) return `newer than this release, ${product.version}: ${installing}`;
+		if (starts !== null && compareVersions(version, starts) === 1) return `newer than ${starts}, which the stable launcher starts: ${installing}`;
+		return null;
+	};
 	for (const { path, version, aliases } of candidates) {
 		const owner = registered.find((server) => [server.command, ...server.args].some((part) => mentions(aliases, part)));
 		const printed = options.includePrinted ? void 0 : handedOut.find((record) => !record.applied && mentions(aliases, record.runtime));
-		const reason = path === current ? "this release" : pointed(aliases) ?? (owner ? `registered with ${owner.client} as "${owner.name}"${known.has(owner.path) ? "" : ` in ${owner.path}`}` : printed ? `printed for ${printed.client} as "${printed.name}" on ${printed.at.slice(0, 10)}, and where that entry went cannot be read; once it is gone, \`mcp prune --include-printed\` removes this` : processes.some((line) => mentions(aliases, line)) ? "a running process uses it" : null);
+		const reason = path === current ? "this release" : pointed(aliases) ?? newer(version) ?? (owner ? `registered with ${owner.client} as "${owner.name}"${known.has(owner.path) ? "" : ` in ${owner.path}`}` : printed ? `printed for ${printed.client} as "${printed.name}" on ${printed.at.slice(0, 10)}, and where that entry went cannot be read; once it is gone, \`mcp prune --include-printed\` removes this` : processes.some((line) => mentions(aliases, line)) ? "a running process uses it" : null);
 		if (reason) {
 			result.kept.push({
 				path,
@@ -6485,7 +6655,8 @@ const organisationRecordSchema = looseObject({
 		max: string().min(1).optional(),
 		background: boolean().optional(),
 		sha256: string().min(1)
-	}).optional()
+	}).optional(),
+	ignoredExtensions: unknown().optional()
 });
 const formerNameSchema = looseObject({
 	name: nameSchema,
@@ -6603,6 +6774,25 @@ function schemaFor(version, naming = 2) {
 function schemaOf(config) {
 	return schemaFor(config.version, config.version === 3 ? config.naming : void 0);
 }
+function connectedAccounts(config) {
+	const mail = Object.entries(config.inboxes).map(([alias, inbox]) => ({
+		kind: "mail",
+		alias,
+		id: inbox.id,
+		platform: inbox.provider,
+		secretRef: inbox.secretRef,
+		inbox
+	}));
+	const channel = Object.entries(config.accounts).map(([alias, account]) => ({
+		kind: "channel",
+		alias,
+		id: account.id,
+		platform: account.platform,
+		secretRef: account.secretRef,
+		account
+	}));
+	return [...mail, ...channel].sort((a, b) => a.alias.localeCompare(b.alias));
+}
 /** The secret backend in use: the recorded one, or the keychain before anything has been stored. */
 function secretsStoreOf(config) {
 	return config.secrets?.store ?? "keychain";
@@ -7303,7 +7493,7 @@ function classifyChange(before, after) {
 	if (before.secrets === void 0 && after.secrets !== void 0 && after.secrets.store !== "keychain") {
 		if (holdsSecrets(before)) loosen("secrets.store", secretsStoreOf(before), after.secrets.store);
 	}
-	for (const loosening of classifyAgentLabelChange(agentLabelOf(before), agentLabelOf(after))) loosen(loosening.path, labelSettingValue(loosening, loosening.was), labelSettingValue(loosening, loosening.now));
+	for (const loosening of classifyAgentLabelChange(agentLabelOf(before), agentLabelOf(after))) loosen(loosening.path, labelSettingValue(loosening, loosening.was, before), labelSettingValue(loosening, loosening.now, after));
 	return {
 		loosened: changes.map((change) => change.path),
 		changes
@@ -7319,13 +7509,21 @@ function agentLabelRuleText(rule) {
 	return `${rule.account}${where}${kinds}: ${rule.as}`;
 }
 /**
-* A label setting's value as a loosening carries it: the rules in words, the icons and the Slack styles as they are, the
-* rest as text.
+* A label setting's value as a loosening carries it: the rules in words, the icons and the Slack styles by the name of
+* the workspace each is for, in `config` — the side the value was read from — and the rest as text.
+*
+* Icons and styles are stored by the account's id, so they follow a rename; a preview names the workspace as the person
+* knows it, `acme/slack`, never its id, which they have never seen (0.21). The ids are still what an approval binds:
+* `changedSettings` records the stored values as they are. An id that names no connected account — one removed since —
+* has no other name, and keeps its id.
 */
-function labelSettingValue(loosening, value) {
+function labelSettingValue(loosening, value, config) {
 	if (value === void 0 || value === null) return void 0;
 	if (loosening.path === "agentLabel.rules") return value.map(agentLabelRuleText);
-	if (loosening.path === "agentLabel.slackIcons" || loosening.path === "agentLabel.slackStyles") return { ...value };
+	if (loosening.path === "agentLabel.slackIcons" || loosening.path === "agentLabel.slackStyles") {
+		const accounts = connectedAccounts(config);
+		return Object.fromEntries(Object.entries(value).map(([id, entry]) => [accounts.find((account) => account.id === id)?.alias ?? id, entry]));
+	}
 	return String(value);
 }
 /** The label settings a change can write, as the file holds them — raw, as `changedSettings` records every setting. */
@@ -10907,115 +11105,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.20.0";
-/**
-* Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
-* to decide whether the release it last heard of is newer than the one running.
-*
-* Here rather than in `npm.ts`, which also talks to the registry: the reader of `update-check.json` is imported by
-* every server, WhatsApp's included, and must carry no network code at all (design 2026-09-28 §1). `npm.ts` re-exports
-* all of it, so nothing that imported these from there changes.
-*/
-/**
-* A version, exactly as semver writes one: `1.2.3`, `1.2.3-rc.1`, `1.2.3+build`.
-*
-* Anything the registry answers is checked against this before it is used, because a version goes into a directory
-* name (`runtime/<version>-gmail`), a sentence a person approves, and an argument to `npm install`. A registry — or a
-* mirror somebody configured — that answered `../x` or `1.0.0 && …` would otherwise put that in all three.
-*/
-const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\.(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
-function isVersion(value) {
-	return typeof value === "string" && VERSION_PATTERN.test(value);
-}
-/** Two numeric strings with no leading zeros, compared as numbers of any size. */
-function compareNumeric(a, b) {
-	if (a.length !== b.length) return a.length < b.length ? -1 : 1;
-	return a < b ? -1 : a > b ? 1 : 0;
-}
-/**
-* Semver precedence: -1, 0 or 1, or null when either is not a version.
-*
-* Numbers compare as numbers (`0.10.0` is after `0.9.9`), a prerelease comes before its release, and build metadata
-* counts for nothing. Written out rather than taken from a dependency: it is twenty lines, and the core installs as
-* few packages as it can.
-*/
-function compareVersions(a, b) {
-	const left = VERSION_PATTERN.exec(a);
-	const right = VERSION_PATTERN.exec(b);
-	if (!left || !right) return null;
-	for (const index of [
-		1,
-		2,
-		3
-	]) {
-		const order = compareNumeric(left[index] ?? "0", right[index] ?? "0");
-		if (order !== 0) return order < 0 ? -1 : 1;
-	}
-	const pre = (match) => match[4] === void 0 ? [] : match[4].split(".");
-	const [ours, theirs] = [pre(left), pre(right)];
-	if (ours.length === 0 || theirs.length === 0) return ours.length === theirs.length ? 0 : ours.length === 0 ? 1 : -1;
-	for (let index = 0; index < Math.max(ours.length, theirs.length); index += 1) {
-		const x = ours[index];
-		const y = theirs[index];
-		if (x === void 0) return -1;
-		if (y === void 0) return 1;
-		const [numericX, numericY] = [/^\d+$/.test(x), /^\d+$/.test(y)];
-		if (numericX && numericY) {
-			const order = compareNumeric(x, y);
-			if (order !== 0) return order < 0 ? -1 : 1;
-		} else if (numericX !== numericY) return numericX ? -1 : 1;
-		else if (x !== y) return x < y ? -1 : 1;
-	}
-	return 0;
-}
-/** Whether `version` is older than `latest`: by semver when both are versions, and otherwise whenever they differ. */
-function isBehind(version, latest) {
-	if (version === latest) return false;
-	const order = compareVersions(version, latest);
-	return order === null ? true : order < 0;
-}
-/**
-* Whether a version is a prerelease — `0.8.0-rc.1` — which the daily update check never counts as an update: a
-* machine is not told to "update" to a release candidate, nor a candidate told to go back to the last release.
-*/
-/**
-* A release as this suite publishes one, and the only form a version the registry gave is read or said in: a plain
-* `MAJOR.MINOR.PATCH` (re-review of 0.20.0, severity 6). A prerelease's words and build metadata are the registry's
-* text — `0.20.1+SYSTEM-ignore-…` is valid semver — so a version carrying either is no release here.
-*/
-function isPlainVersion(value) {
-	return typeof value === "string" && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(value);
-}
-function isPrerelease(version) {
-	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
-}
-/**
-* Whether `version` is within a package's `engines` range: true or false, or null when the range is not one this reads.
-*
-* Read are the comparators `>=`, `>`, `<=`, `<` and `=` (or none) before a whole version, joined by spaces, which must
-* all hold, and alternatives joined by `||`. That is every range this suite declares (`>=22.12.0`, `>=22.16.0`).
-* Anything else — `^22.12.0`, `>=22`, `22.x` — is null rather than a guess: a command printed to run under this Node
-* is printed only when the range it has to meet says it may. A leading `v`, as `process.version` has it, is read.
-*/
-function satisfiesRange(version, range) {
-	const wanted = version.replace(/^v/, "");
-	if (!isVersion(wanted)) return null;
-	const alternatives = range.split("||").map((alternative) => alternative.trim().split(/\s+/).filter(Boolean));
-	if (alternatives.some((comparators) => comparators.length === 0)) return null;
-	let any = false;
-	for (const comparators of alternatives) {
-		let all = true;
-		for (const comparator of comparators) {
-			const match = /^(>=|<=|>|<|=)?(.+)$/.exec(comparator);
-			const bound = match?.[2] ?? "";
-			if (!isVersion(bound)) return null;
-			const order = compareVersions(wanted, bound);
-			if (!(match?.[1] === ">=" ? order >= 0 : match?.[1] === "<=" ? order <= 0 : match?.[1] === ">" ? order > 0 : match?.[1] === "<" ? order < 0 : order === 0)) all = false;
-		}
-		if (all) any = true;
-	}
-	return any;
-}
+const VERSION = "0.21.0";
 /**
 * The command a person is told to run for one of this suite's own CLIs (design 2026-10-04, D1 and D5; CUE-403).
 *
@@ -11146,7 +11236,13 @@ function locateCliCommand(request, runtime = {
 	} catch (error) {
 		return fail("arguments", error instanceof Error ? error.message : String(error));
 	}
-	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform, program);
+	const build = (found) => stableWayIn(buildCommand(target, found, words, runtime, callerSource, platform, program), found, target, {
+		paths: request.paths,
+		env: request.env,
+		words,
+		platform,
+		program
+	});
 	const located = (built, found, direction) => Object.freeze({
 		ok: true,
 		command: built.command,
@@ -11332,6 +11428,70 @@ function buildCommand(target, found, words, runtime, callerSource, platform, pro
 	};
 }
 /**
+* A managed runtime's command, as its stable way in (0.21). A command naming `<data>/runtime/0.20.0-core/…/cli.mjs`
+* stops working once that runtime is pruned — and the background job prunes old runtimes after each update — so a
+* command printed from a managed runtime of this installation names what stays put instead:
+*
+* - **its stable launcher**, `<data>/launch/<name>` (`launcherPaths`), when it is there and its pointer names a runtime
+*   holding this package at exactly this release, whose CLI can start: the launcher, then the words, as a registration
+*   starts it — on Windows, where the launcher is a script Node runs, this Node first;
+* - else **its managed CLI shim**, where shims are offered, when this installation's receipt records one that is
+*   unchanged and starts this very entry (`managedShimStarting`): a release before the launcher wrote such shims, and
+*   an update rewrites them;
+* - else the runtime's entry, as before.
+*
+* Only for a package inside `<data>/runtime` of the folders this command pins: a checkout, an npx cache, a global
+* install or another data folder's runtime is named as it always was. Checked when the command is printed (D6), as the
+* entry is: a launcher switched later runs what it is then switched to, as every registration that starts it does.
+*/
+function stableWayIn(built, found, target, printing) {
+	if (!built.ok || found.source) return built;
+	const { paths, words, platform, program } = printing;
+	const runtimes = realpathOfExisting(join(paths.dataDir, "runtime"));
+	if (runtimes === null || !isWithin$1(runtimes, found.root) || resolve(runtimes) === resolve(found.root)) return built;
+	const launcher = stableLauncher(paths.dataDir, target.packageName, found.manifest.version, platform);
+	if (launcher !== null) return {
+		ok: true,
+		command: new PrintedCommand(GATE, platform === "win32" ? [
+			program,
+			launcher,
+			...words
+		] : [launcher, ...words], platform, realpathOfExisting(launcher) ?? launcher),
+		entryKind: "launcher"
+	};
+	const shim = managedShimStarting({
+		env: printing.env ?? process.env,
+		dataDir: paths.dataDir,
+		platform
+	}, target.manifest.binary, built.command.entry);
+	if (shim === null) return built;
+	return {
+		ok: true,
+		command: new PrintedCommand(GATE, [shim, ...words], platform, realpathOfExisting(shim) ?? shim),
+		entryKind: "shim"
+	};
+}
+/**
+* This installation's stable launcher for `packageName`, when it starts that package at exactly `version`: the file is
+* there (executable, where it is a shell script), its pointer is one the launcher reads, and the runtime it names holds
+* the package at that version with a CLI the launcher can start. Null otherwise — a pointer that cannot be read too.
+*/
+function stableLauncher(dataDir, packageName, version, platform) {
+	if (typeof version !== "string") return null;
+	try {
+		const name = launcherName(packageName);
+		const { launcher } = launcherPaths(dataDir, name);
+		if (!statSync(launcher).isFile()) return null;
+		accessSync(launcher, platform === "win32" ? constants$1.R_OK : constants$1.X_OK);
+		const pointer = readPointerSync(dataDir, name);
+		if (pointer === void 0 || !launcherCanStartSync(pointer.current, name)) return null;
+		const started = readPackageManifest(join(pointer.current, "node_modules", ...packageName.split("/")));
+		return started?.name === packageName && started.version === version ? launcher : null;
+	} catch {
+		return null;
+	}
+}
+/**
 * The command a package declares for itself: a channel's in its `agentcomms` field, a service's in `agentcommsPackage`
 * (D14). A library declares none, and no package declares both: the registry refuses one that does.
 */
@@ -11913,8 +12073,30 @@ function renderInstall(result, color) {
 	for (const warning of result.warnings) lines.push("", paint(color, "red", warning));
 	return lines.join("\n");
 }
-/** What `mcp prune` removed and kept, and why each one it kept is still needed. */
+/**
+* What `mcp prune` removed and kept, and why each one it kept is still needed. A prune of every managed server lists
+* each server that had a runtime under its own name, in the registry's order.
+*/
 function renderPrune(result, color) {
+	if ("servers" in result) {
+		const groups = result.servers.map((part) => ({
+			label: part.label,
+			lines: pruneLines(part, color)
+		})).filter((group) => group.lines.length > 0).map((group) => [`${group.label}:`, ...group.lines.map((line) => `  ${line}`)].join("\n"));
+		if (groups.length === 0) return `No managed runtimes to remove in ${result.runtimeDir}.`;
+		const unchecked = (result.refusedServers ?? []).map(({ label, refused }) => `${label} (${refused})`);
+		if (unchecked.length > 0) {
+			const its = unchecked.length === 1 ? "its" : "their";
+			groups.push(paint(color, "yellow", `Not checked, so none of ${its} runtimes was removed: ${unchecked.join("; ")}.`));
+		}
+		return groups.join("\n");
+	}
+	const lines = pruneLines(result, color);
+	if (lines.length === 0) lines.push(`No managed runtimes to remove in ${result.runtimeDir}.`);
+	return lines.join("\n");
+}
+/** One server's prune, a line a runtime or shim; none when it had nothing to look at. */
+function pruneLines(result, color) {
 	const lines = [];
 	if (result.refused) lines.push(paint(color, "yellow", `Nothing removed: ${result.refused}.`));
 	const verb = result.dryRun ? "Would remove" : "Removed";
@@ -11922,8 +12104,7 @@ function renderPrune(result, color) {
 	for (const path of result.shims.removed) lines.push(paint(color, "green", `${verb} CLI shim: ${path}`));
 	for (const path of result.shims.kept) lines.push(`Kept foreign CLI shim: ${path}`);
 	for (const item of result.kept) lines.push(`Kept ${item.version} (${item.reason}): ${item.path}`);
-	if (lines.length === 0) lines.push(`No managed runtimes to remove in ${result.runtimeDir}.`);
-	return lines.join("\n");
+	return lines;
 }
 /**
 * What a change is about: the inbox or account by the id it has before the change, or by name alone when this change
@@ -12017,7 +12198,7 @@ async function prepareChange(core, request, options) {
 			preview: renderChangePreview({
 				...record,
 				change: binding
-			}),
+			}, { askedHere: options.askedHere === true }),
 			expiresAt: record.expiresAt,
 			next: nextStep(record.approvalId, policy, core, options),
 			approval: await core.approvals.approvalOf(record)
@@ -12107,7 +12288,7 @@ async function beginChangeApproval(core, approvalId, options) {
 		const challenge = await core.approvals.issueChallenge(approvalId, "change", options.platform);
 		return {
 			approvalId,
-			preview: renderChangePreview(record),
+			preview: renderChangePreview(record, { codeHere: true }),
 			challenge
 		};
 	} catch (error) {
@@ -12287,6 +12468,31 @@ function shown(value) {
 	if (typeof value === "object") return Object.entries(value).map(([key, entry]) => `${key} ${String(entry)}`).join(", ");
 	return String(value);
 }
+/**
+* The label settings kept for each Slack workspace, by its name (`labelSettingValue`), and what a workspace with none
+* has: its style is `app`, and the app's posts show the person's photo.
+*/
+const PER_WORKSPACE = {
+	"agentLabel.slackStyles": "app",
+	"agentLabel.slackIcons": "your Slack photo"
+};
+function recordOf$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/**
+* A setting kept for each workspace, as the person reads it: each workspace it moves, by name, from → to —
+* `in acme/slack: app → labelled` — and none it leaves as it was. Undefined for any other setting, or a value of
+* another shape, which is shown as every other setting is.
+*/
+function perWorkspace(field, before, after) {
+	const none = PER_WORKSPACE[field];
+	const [was, now] = [recordOf$1(before ?? {}), recordOf$1(after ?? {})];
+	if (none === void 0 || was === void 0 || now === void 0) return void 0;
+	const value = (record, name) => Object.hasOwn(record, name) ? String(record[name]) : none;
+	const moved = [.../* @__PURE__ */ new Set([...Object.keys(was), ...Object.keys(now)])].filter((name) => value(was, name) !== value(now, name)).sort();
+	if (moved.length === 0) return void 0;
+	return moved.map((name) => `in ${name}: ${value(was, name)} → ${value(now, name)}`).join(", and ");
+}
 /** One loosening as a line a person reads: what, from, to, and what that means. */
 function describeLoosening(loosening) {
 	const scoped = /^(inboxes|accounts)\.([^.]+)\.(.+)$/.exec(loosening.path);
@@ -12294,7 +12500,8 @@ function describeLoosening(loosening) {
 	const label = SETTING_LABELS[field] ?? field;
 	const what = scoped ? `${scoped[2]} ${label}${loosening.id === void 0 ? " (connected by this change)" : ""}` : label;
 	const words = meaning(field, loosening.after, scoped ? scoped[1] : void 0);
-	return truncateDisplay(`${what}: ${shown(loosening.before)} → ${shown(loosening.after)}${words ? ` — ${words}` : ""}`, 300);
+	const workspaces = scoped ? void 0 : perWorkspace(field, loosening.before, loosening.after);
+	return truncateDisplay(`${workspaces === void 0 ? `${what}: ${shown(loosening.before)} → ${shown(loosening.after)}` : `${what} ${workspaces}`}${words ? ` — ${words}` : ""}`, 300);
 }
 /**
 * The change as a person reads it before agreeing: what it is for, every setting it loosens from → to in words, and
@@ -12304,10 +12511,14 @@ function describeLoosening(loosening) {
 * once as it was prepared (`doneAtOnce`). There it says what is true: those lines, listed apart, are done already, and
 * the rest is what waits for the approval. Decided by that field alone, never by the words of an effect, which can
 * carry text a person or a profile chose; every other preview's header is word for word what it was.
+*
+* It says how the change is approved: under `confirm`, a code typed at a terminal; under `chat`, a yes in the chat —
+* or, `askedHere`, a yes typed here, at this terminal, where a CLI asks the person reading it at once; or, `codeHere`,
+* a code typed here, at this terminal, where `approve <id>` shows a change prepared under `chat` and asks for its code.
 */
-function renderChangePreview(record) {
+function renderChangePreview(record, options = {}) {
 	const { change } = record;
-	const how = changePolicyOf$1(record) === "chat" ? "a yes in the chat" : "a code typed at a terminal";
+	const how = changePolicyOf$1(record) === "chat" ? options.codeHere === true ? "a code typed here, at this terminal" : options.askedHere === true ? "a yes typed here, at this terminal" : "a yes in the chat" : "a code typed at a terminal";
 	const target = change.target;
 	const about = target === null ? "the whole configuration" : `${target.kind} ${target.name}${target.id === void 0 ? ", which this change connects" : ""}`;
 	const doneAlready = (change.doneAtOnce ?? []).length > 0;
@@ -12368,7 +12579,8 @@ async function gatedChange(core, change, options) {
 		prepared: await prepareChange(core, request, {
 			surface: options.surface,
 			channel: options.channel,
-			platform: options.platform
+			platform: options.platform,
+			askedHere: options.askedHere
 		})
 	};
 	const { consent, approval } = await claimChangeApproval(core, options.approvalId, request, {
@@ -12434,15 +12646,17 @@ function changeToolResult(outcome) {
 */
 async function gatedChangeAtTerminal(core, change, options) {
 	const streams = options.streams ?? defaultStreams;
+	const person = agentMarker(options.env) === null && canPrompt(options.env, streams, { json: options.output.json === true });
 	const first = await gatedChange(core, change, {
 		surface: "cli",
 		channel: options.channel,
 		approvalId: options.approvalId,
-		platform: options.output.platform
+		platform: options.output.platform,
+		askedHere: person
 	});
 	if (first.status === "applied") return first.result;
 	const { prepared } = first;
-	if (!(agentMarker(options.env) === null && canPrompt(options.env, streams, { json: options.output.json === true }))) {
+	if (!person) {
 		if (options.output.json !== true) streams.stdout.write(`${prepared.preview}\n\n`);
 		const carrying = [options.approvalFlag ?? "--approval", prepared.approvalId];
 		const handoffs = requireHandoffs(core, options.output.platform);
@@ -12932,9 +13146,10 @@ const GOOGLE_CLIENT_ID_PATTERN = /^[0-9]{1,30}-[a-z0-9]{1,64}\.apps\.googleuserc
 * one place a profile changes the configuration, each change approved first.
 *
 * **A profile is data, never code, and none of it is trusted.** Every field comes from whoever wrote the document, so
-* each has a grammar and a bound, an unknown key is an error, and the two free-text fields are neutralised and put on
-* one line wherever they are shown. The client secret is never shown anywhere — not in a preview, an effect, an error,
-* the audit log, a command's output or a tool's result.
+* each has a grammar and a bound, an unknown key is an error — anywhere but inside `extensions`, the one door a later
+* release's fields come in by (design 2026-10-19) — and the two free-text fields are neutralised and put on one line
+* wherever they are shown. The client secret is never shown anywhere — not in a preview, an effect, an error, the audit
+* log, a command's output or a tool's result.
 */
 /** What a profile says it is, in its first key. */
 const PROFILE_KIND = "organisation-profile";
@@ -12961,6 +13176,18 @@ const slackAppSchema = strictObject({
 	clientId: string().regex(SLACK_CLIENT_ID_PATTERN, "a Slack client id is two runs of digits around a dot"),
 	appId: string().regex(SLACK_APP_ID_PATTERN, "a Slack app id is A followed by 2–20 capital letters or digits").optional()
 });
+/** An extension's name: a lower-case letter, then 1–39 lower-case letters, digits or hyphens (X1). */
+const EXTENSION_NAME_PATTERN = /^[a-z][a-z0-9-]{1,39}$/;
+const extensionEntrySchema = looseObject({
+	required: boolean({ message: "required is true or false: whether a release that does not know it must refuse it" }),
+	since: string({ message: "since is the first release that understands it, as MAJOR.MINOR.PATCH" }).regex(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/, "since is the first release that understands it, as MAJOR.MINOR.PATCH: 0.23.0")
+});
+/**
+* The one door a version-1 profile has for what later releases add (design 2026-10-19, X1): at most 16 entries, each
+* named to the grammar above and each an object carrying `required` and `since`. Its other fields are the extension's;
+* every other object of the profile stays strict.
+*/
+const extensionsSchema = record(string().regex(EXTENSION_NAME_PATTERN, "an extension is named by a lower-case letter, then 1–39 lower-case letters, digits or hyphens"), extensionEntrySchema, { message: "extensions is an object of named entries" }).refine((entries) => Object.keys(entries).length <= 16, { message: `extensions has at most 16 entries` });
 strictObject({
 	agentcomms: literal$1(PROFILE_KIND),
 	version: literal$1(1),
@@ -12980,7 +13207,8 @@ strictObject({
 			read: slackAppSchema.optional(),
 			send: slackAppSchema.optional()
 		})
-	}).optional()
+	}).optional(),
+	extensions: extensionsSchema.optional()
 });
 /**
 * A string that came from a profile, as it is shown anywhere: chat-template tokens, role markers and envelope look-alikes
@@ -14001,6 +14229,49 @@ async function npmGlobalPackages(env, names) {
 	return found;
 }
 /**
+* The machine's one update lock (design 2026-10-16 U5; plan, Review focus 1 and 3): a background run, a person's
+* update (`comms_update`, `agentcomms update`), a rollback and a person's prune (`comms_server_prune`, `mcp prune`)
+* each hold it for as long as they install, switch or prune, so none of them ever overlaps another — two of them would
+* switch the same pointers and prune runtimes the other had just installed, or was still checking.
+*
+* An install can take minutes, so the holder renews it, and a lock left by a process that died is taken over once it
+* has gone unrenewed for ten minutes. Nobody waits for it long: a background run that finds it held stops and runs
+* again the next day, and a person's update is refused at once — before an approval is prepared, where it can be — so
+* no conversation sits behind an install.
+*/
+const UPDATE_LOCK_FILE = ".update.lock";
+function updateLockPath(stateDir) {
+	return join(stateDir, UPDATE_LOCK_FILE);
+}
+const HOLD = {
+	staleMs: 6e5,
+	renewMs: 6e4
+};
+/** Runs `fn` holding the update lock, waiting at most `waitMs` for it; LOCK_TIMEOUT when another holds it. */
+async function withUpdateLock(stateDir, fn, waitMs = 1e3) {
+	return withFileLock(updateLockPath(stateDir), fn, {
+		timeoutMs: waitMs,
+		...HOLD
+	});
+}
+/**
+* A person's update, rollback or prune, holding the update lock: refused, changing nothing, while a background run —
+* or another person's update — holds it. The refusal says what is under way and when to try again.
+*/
+async function withPersonUpdateLock(stateDir, fn, what = "update") {
+	try {
+		return await withUpdateLock(stateDir, fn);
+	} catch (error) {
+		const refused = toCommsError(error);
+		if (refused.code !== "LOCK_TIMEOUT" || !refused.message.includes(".update.lock")) throw error;
+		throw new CommsError("LOCK_TIMEOUT", "nothing was changed: a background update run is under way on this machine, or another update is", { hint: `It installs, checks and switches in a few minutes, and the two never overlap. Run the ${what} again in a few minutes; the doctor and comms_audit_tail say what the run did.` });
+	}
+}
+/** Refuses at once, changing nothing, while the update lock is held: the check a person's update makes as it plans. */
+async function refuseWhileUpdating(stateDir, what = "update") {
+	await withPersonUpdateLock(stateDir, async () => void 0, what);
+}
+/**
 * Every sentence a background run may leave for the next session, and the one way a notice of it is said (design
 * 2026-10-16 U5 step 7, U9; security review of 0.20.0, severity 6): in this package's own words, with nothing in them
 * the registry or a certificate wrote. A release's version is the one thing a sentence takes from outside, and only as a
@@ -14788,18 +15059,24 @@ async function remedyLocated(error, core) {
 * one effect — the removal cannot be taken back — so the approval is bound to exactly that list; and the removal is
 * then restricted to it (`only`), so a runtime that became unused after the list was shown stays.
 *
+* A removal never runs beside an update (`update-lock.ts`): a background run installs a release and checks it before
+* any pointer names it, and a prune beside it would find that runtime unused. So it is refused at once while an update
+* holds the lock — before an approval is prepared — and the removal itself holds the lock, refused in turn when an
+* update has started since. A refusal stops nothing else.
+*
 * `own` is the calling channel's product, from its own `mcp prune`, so the runtime kept as "this release" is the
 * release of the command that was run; checked to be that channel's, as for an install.
 */
 function serverPruneChange(core, env, request, own) {
-	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
+	if (request.channel === void 0 && own === void 0) return everyServerPruneChange(core, env, request);
+	if (request.channel === void 0 || !isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 	const context = {
 		env,
 		core
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.20.0"
+		version: "0.21.0"
 	};
 	const product = {
 		packageName,
@@ -14818,6 +15095,7 @@ function serverPruneChange(core, env, request, own) {
 				after: config,
 				summary: `Show which ${label} runtimes are unused`
 			};
+			await refuseWhileUpdating(core.paths.stateDir, "prune");
 			const preview = await pruneManagedRuntimes(context, product, {
 				...base,
 				dryRun: true
@@ -14826,15 +15104,124 @@ function serverPruneChange(core, env, request, own) {
 			return {
 				before: config,
 				after: config,
-				effects: [...preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`), ...preview.shims.removed.map((path) => `deletes the owned ${label} CLI shim at ${path}`)],
+				effects: pruneEffects(label, preview),
 				summary: `Remove ${approved.length} unused ${label} runtime${approved.length === 1 ? "" : "s"}`
 			};
 		},
-		apply: () => pruneManagedRuntimes(context, product, {
+		apply: () => request.dryRun ? pruneManagedRuntimes(context, product, {
 			...base,
-			dryRun: request.dryRun === true,
-			...request.dryRun ? {} : { only: approved }
-		})
+			dryRun: true
+		}) : withPersonUpdateLock(core.paths.stateDir, () => pruneManagedRuntimes(context, product, {
+			...base,
+			dryRun: false,
+			only: approved
+		}), "prune")
+	};
+}
+/** What a removal of runtimes does, in the preview's words: each runtime, then each owned CLI shim. */
+function pruneEffects(label, preview) {
+	return [...preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`), ...preview.shims.removed.map((path) => `deletes the owned ${label} CLI shim at ${path}`)];
+}
+/**
+* Every managed server's unused runtimes, as one change (0.21): what an update leaves behind is every server's, and
+* `--server` for each was a step a person had to know to take. The servers are the channel registry's (`SERVERS`),
+* channels and declared services alike, never a list written here; each is pruned exactly as `--server` prunes it —
+* this release's runtime, one any client config or printed entry names, one a running process uses, and the runtime
+* its stable launcher starts and the one it keeps for a rollback all stay, each said why.
+*
+* A dry run is free. Otherwise the plan is every server's dry run, shown grouped by server, and the approval is bound to
+* exactly that list; the removal is then restricted to it, so nothing that became unused after it was shown goes. A
+* server whose prune was stopped — a pointer or a config that cannot be read — is named in the preview, beside what the
+* others remove, and in the result's `refusedServers`. The running processes are listed again for each server, just
+* before it is decided, as the prune of one server lists them: a listing taken at the start of the pass would not see
+* a process started from a runtime while the servers before it were pruned. And, as for one server, a removal never
+* runs beside an update.
+*/
+function everyServerPruneChange(core, env, request) {
+	const context = {
+		env,
+		core
+	};
+	const servers = SERVERS.map((server) => ({
+		server,
+		label: serverLabel(server),
+		product: {
+			packageName: serverFacts(server).packageName,
+			version: VERSION
+		}
+	}));
+	const pruneEach = async (options) => {
+		const parts = [];
+		for (const { server, label, product } of servers) {
+			const result = await pruneManagedRuntimes(context, product, {
+				includePrinted: request.includePrinted === true,
+				processes: request.processes ?? runningCommandLines,
+				...options
+			});
+			parts.push({
+				server,
+				label,
+				...result
+			});
+		}
+		return parts;
+	};
+	/** Each server whose prune was stopped, and why. */
+	const refusedOf = (parts) => parts.flatMap(({ server, label, refused }) => refused === void 0 ? [] : [{
+		server,
+		label,
+		refused
+	}]);
+	let approved = [];
+	return {
+		plan: async (config) => {
+			if (request.dryRun) return {
+				before: config,
+				after: config,
+				summary: "Show which runtimes of every managed server are unused"
+			};
+			await refuseWhileUpdating(core.paths.stateDir, "prune");
+			const previews = await pruneEach({ dryRun: true });
+			approved = previews.flatMap((part) => part.removed.map((item) => item.path));
+			const counts = previews.filter((part) => part.removed.length > 0).map((part) => `${part.removed.length} ${part.label}`);
+			const removals = previews.flatMap((part) => pruneEffects(part.label, part));
+			const unchecked = refusedOf(previews).map(({ label, refused }) => `does not check the ${label} runtimes, and removes none of them: ${refused}`);
+			return {
+				before: config,
+				after: config,
+				effects: removals.length > 0 ? [...removals, ...unchecked] : [],
+				summary: `Remove ${approved.length} unused runtime${approved.length === 1 ? "" : "s"}${counts.length > 0 ? `: ${counts.join(", ")}` : ""}`
+			};
+		},
+		apply: async () => {
+			const dryRun = request.dryRun === true;
+			const parts = dryRun ? await pruneEach({ dryRun }) : await withPersonUpdateLock(core.paths.stateDir, () => pruneEach({
+				dryRun,
+				only: approved
+			}), "prune");
+			const looked = parts.filter((part) => part.removed.length + part.kept.length > 0);
+			const refused = looked.length > 0 && looked.every((part) => part.refused !== void 0);
+			const refusedServers = refusedOf(parts);
+			return {
+				runtimeDir: join(core.paths.dataDir, "runtime"),
+				dryRun,
+				removed: parts.flatMap((part) => part.removed.map((item) => ({
+					...item,
+					server: part.server
+				}))),
+				kept: parts.flatMap((part) => part.kept.map((item) => ({
+					...item,
+					server: part.server
+				}))),
+				shims: {
+					removed: parts.flatMap((part) => part.shims.removed),
+					kept: parts.flatMap((part) => part.shims.kept)
+				},
+				...refused ? { refused: [...new Set(looked.map((part) => part.refused))].join("; ") } : {},
+				servers: parts,
+				...refusedServers.length > 0 ? { refusedServers } : {}
+			};
+		}
 	};
 }
 /**
@@ -16110,7 +16497,7 @@ function terminalUpdateHooks(core, env, options = {}) {
 	} };
 }
 //#endregion
-//#region ../core/dist/tool-arguments-4c3WR2Gy.mjs
+//#region ../core/dist/tool-arguments-C8yi7cpo.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**

package/dist/{server-C1sSuZ8K.mjs → server-CQ9RE8L7.mjs}

@@ -1,4 +1,4 @@
-import { A as removeAccountChange, At as waitCallOptions, B as strictToolArguments, Bt as VERSION, D as policyChange, E as policyApprovalRefusal, Et as toCommsError, F as CHANGE_POLICIES, H as CommsError, I as MODES, L as SEND_POLICIES, M as showAccount, O as policyReport, P as ResendContext, X as changeToolResult, Z as checkForUpdates, _ as showSentEmail, c as downloadReceived, d as listReceived, f as listScheduled, g as showReceived, ht as refuseUnclaimedApproval, i as prepareSend, it as gatedChange, jt as waitForApproval, k as policyWanted, kt as updateToolNotice, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, p as listSentEmails, s as cancelScheduledChange, u as listDomains, w as listAccounts, x as runDoctor } from "./send-CE6wM0-w.mjs";
+import { A as removeAccountChange, At as waitCallOptions, B as strictToolArguments, Bt as VERSION, D as policyChange, E as policyApprovalRefusal, Et as toCommsError, F as CHANGE_POLICIES, H as CommsError, I as MODES, L as SEND_POLICIES, M as showAccount, O as policyReport, P as ResendContext, X as changeToolResult, Z as checkForUpdates, _ as showSentEmail, c as downloadReceived, d as listReceived, f as listScheduled, g as showReceived, ht as refuseUnclaimedApproval, i as prepareSend, it as gatedChange, jt as waitForApproval, k as policyWanted, kt as updateToolNotice, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, p as listSentEmails, s as cancelScheduledChange, u as listDomains, w as listAccounts, x as runDoctor } from "./send-tAIE9B1y.mjs";
 import { S as union, c as boolean, g as object, h as number, s as array, x as string } from "./iso-USuVU_sk.mjs";
 import { t as McpServer } from "./mcp-DIH4cS6P-CIWWZQbz.mjs";
 //#region src/mcp/server.ts

package/dist/{stdio-entry-BlerMgOC.mjs → stdio-entry-DPJKJhGj.mjs}

@@ -1,4 +1,4 @@
-import { t as createResendMcpServer } from "./server-C1sSuZ8K.mjs";
+import { t as createResendMcpServer } from "./server-CQ9RE8L7.mjs";
 //#region src/mcp/stdio-entry.ts
 /**
 * Starting the stdio server. On stdio, **stdout is the protocol**: one stray `console.log` corrupts the stream, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcomms/resend",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Resend for coding agents: read domains, sent and received mail, metrics and suppressions, and send mail that nothing sends without a person's approval of exactly what goes out.",
   "type": "module",
   "license": "MIT",
@@ -31,7 +31,7 @@
     "THIRD_PARTY_LICENSES"
   ],
   "dependencies": {
-    "@agentcomms/core": "0.20.0"
+    "@agentcomms/core": "0.21.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "2.1.0"
@@ -107,5 +107,5 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --test --test-timeout=600000 \"test/**/*.test.ts\""
   },
-  "gitHead": "b5e7322e890d2eb6a6f9917612f6d3af1882edbd"
+  "gitHead": "3916bacd2b66e5457624f97cd671bee60e704272"
 }