@agentcomms/resend 0.27.1 → 0.29.0

package/README.md

@@ -117,6 +117,11 @@ terminal), `approve` (under `confirm`, a person at a terminal) and `mcp` (it sta
 | `agent-resend mcp install --client <client>` | `comms_server_install` (core) |
 | `agent-resend mcp prune` | `comms_server_prune` (core) |
 
+Every command that reads or changes an account — all but `account`, `doctor`, `send wait`, `approve` and `mcp` — is
+recorded in core's private activity log, the same from a command and a tool: the email ids, subjects and senders it
+touched, a download's file names and sizes, a send's recipients and approval, and how it ended. Never a body or an
+attachment's bytes. `agentcomms activity sessions` shows it, and `agentcomms activity record off` stops it.
+
 Every command takes `--json` for the whole result, with stable exit codes: `0` ok, `10` a send or a change was
 refused or needs approval, `64` usage, `65` bad data, `66` not found, `69` Resend or the secret store unavailable,
 `75` temporary, `77` key or permission needed, `78` configuration problem.

package/dist/cli.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as colorEnabled, A as removeAccountChange, Bt as VERSION, C as inspectKey, Ct as serverPruneChange, D as policyChange, Dt as truncateDisplay, E as policyApprovalRefusal, Ft as RESEND_CALLER, G as UPDATE_CHECK_CHILD_COMMAND, H as CommsError, J as approveRefusedHint, K as agentMarker, M as showAccount, Mt as wholeNumber, Nt as writeResult, O as policyReport, Ot as updateNoticeAtTerminal, P as ResendContext, Q as cliHandoffs, R as checkNewName, S as addAccountChange, St as serverInstallChange, T as modeOf, Tt as terminalUpdateHooks, U as EXIT_CODES, V as CHANNEL_SERVERS, W as PATH_OPTIONS, Y as canPrompt, _ as showSentEmail, _t as renderInstall, a as revokeSendApproval, at as gatedChangeAtTerminal, bt as runCommand, c as downloadReceived, ct as installExitStatus, d as listReceived, et as commandPathOf, f as listScheduled, ft as openCore, g as showReceived, gt as renderApprovalWait, ht as refuseUnclaimedApproval, i as prepareSend, j as sendPolicyOf, jt as waitForApproval, k as policyWanted, l as getMetrics, lt as kindOf, m as listSuppressions, mt as pathOverridesFromCliOptions, n as executeSend, nt as escapeForDisplay, o as sendStatus, ot as handoffSentence, p as listSentEmails, pt as paint, q as approveChangeAtTerminal, r as finishSendApproval, rt as exemptFromUpdateNotice, s as cancelScheduledChange, st as handoffSentenceToFill, t as beginSendApproval, tt as describeFenceReport, u as listDomains, vt as renderPrune, w as listAccounts, x as runDoctor, xt as runUpdateCheckChild, yt as resolvePaths } from "./send-BbyDPqGS.mjs";
+import { $ as colorEnabled, A as removeAccountChange, C as inspectKey, Ct as serverPruneChange, D as policyChange, Dt as truncateDisplay, E as policyApprovalRefusal, G as UPDATE_CHECK_CHILD_COMMAND, H as CommsError, It as RESEND_CALLER, J as approveRefusedHint, K as agentMarker, M as showAccount, Nt as wholeNumber, O as policyReport, Ot as updateNoticeAtTerminal, P as ResendContext, Pt as writeResult, Q as cliHandoffs, R as checkNewName, S as addAccountChange, St as serverInstallChange, T as modeOf, Tt as terminalUpdateHooks, U as EXIT_CODES, V as CHANNEL_SERVERS, Vt as VERSION, W as PATH_OPTIONS, Y as canPrompt, _ as showSentEmail, _t as renderInstall, a as revokeSendApproval, at as gatedChangeAtTerminal, bt as runCommand, c as downloadReceived, ct as installExitStatus, d as listReceived, et as commandPathOf, f as listScheduled, ft as openCore, g as showReceived, gt as renderApprovalWait, ht as refuseUnclaimedApproval, i as prepareSend, j as sendPolicyOf, jt as waitForApproval, k as policyWanted, l as getMetrics, lt as kindOf, m as listSuppressions, mt as pathOverridesFromCliOptions, n as executeSend, nt as escapeForDisplay, o as sendStatus, ot as handoffSentence, p as listSentEmails, pt as paint, q as approveChangeAtTerminal, r as finishSendApproval, rt as exemptFromUpdateNotice, s as cancelScheduledChange, st as handoffSentenceToFill, t as beginSendApproval, tt as describeFenceReport, u as listDomains, vt as renderPrune, w as listAccounts, x as runDoctor, xt as runUpdateCheckChild, yt as resolvePaths } from "./send-BC8FI-_F.mjs";
+import childProcess from "node:child_process";
+import fs from "node:fs";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stripVTControlCharacters } from "node:util";
-import fs from "node:fs";
-import childProcess from "node:child_process";
 import process$1 from "node:process";
 import { EventEmitter } from "node:events";
 import { Writable } from "node:stream";
@@ -3488,7 +3488,7 @@ Exit codes: 0 ok · 1 unexpected · 10 a send or a change was refused or needs a
 	}));
 	const mcp = program.command("mcp").description("run the MCP server on stdio, for a coding agent to connect to").option("--account <name>", "pin the server to one account; every tool then acts on it and no other").action(async (flags) => {
 		ran = true;
-		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-DXuzeDqK.mjs")).startResendStdioServer;
+		const startResendStdioServer = deps.startMcp ?? (await import("./stdio-entry-BvsR_B_w.mjs")).startResendStdioServer;
 		const core = coreForInvocation();
 		await startResendStdioServer({
 			...deps,

package/dist/index.d.mts

@@ -2268,7 +2268,7 @@ declare const ZodReadonly: $constructor<ZodReadonly>;
 /** @deprecated Use z.ZodType (without generics) instead. */
 type ZodTypeAny<Output = unknown, Input = unknown, Internals extends $ZodTypeInternals<Output, Input> = $ZodTypeInternals<Output, Input>> = ZodType<Output, Input, Internals>;
 //#endregion
-//#region ../core/dist/launcher-BzQ9fCW3.d.mts
+//#region ../core/dist/launcher-CtlslgkT.d.mts
 interface RegisteredServer {
   client: string;
   path: string;
@@ -2819,6 +2819,290 @@ interface CliHandoffs {
  */
 type RenameReason = "auto-read" | "type" | "no-extension";
 //#endregion
+//#region src/activity-settings.d.ts
+/**
+ * The activity log's two settings (design 2026-10-25-activity §4.1): `activity.record`, `on` or `off`, and
+ * `activity.retentionDays`, a whole number of days from 1 to 365. Absent, they read as on and 30.
+ *
+ * `config.json` keeps them as `activity: { record, retentionDays }`, a key the schemas do not name, so every release
+ * sharing the file keeps it through its writes, as it keeps `agentLabel` and `behaviour`. It is read only through
+ * `readActivitySettings`, which reads a value it does not understand as recording nothing — never as the default.
+ * `off` and fewer days are the tightenings, which apply at once, and `on` and more days the loosenings, which a person
+ * approves (`classifyChange`). So a hand edit or a later release's word can only make this release record less.
+ *
+ * A retention it cannot read is read as the longest, 365 days, with recording off: what it cannot read must never
+ * delete what is held. Read as one day, a typo — or a later release's word — once deleted all but a day of the log.
+ *
+ * `config.ts` imports this module to judge a change, so it imports nothing at all.
+ */
+declare const ACTIVITY_RECORD_SETTINGS: readonly ["on", "off"];
+type ActivityRecordSetting = (typeof ACTIVITY_RECORD_SETTINGS)[number];
+/** The settings as they apply, and what in the file could not be read as written (empty when all of it could). */
+interface ActivitySettings {
+  readonly record: ActivityRecordSetting;
+  readonly retentionDays: number;
+  /** One sentence for each value read as something stricter than the file says — for `doctor` to show. */
+  readonly problems: readonly string[];
+}
+//#endregion
+//#region src/activity.d.ts
+/**
+ * The activity log (design 2026-10-25-activity, §4 with S1–S5): one line for every call an agent session makes that
+ * reads or writes account data, tied to the session that made it — what it touched, never what it said.
+ *
+ * - **Where:** `<state>/activity/YYYY-MM-DD.jsonl` (the UTC day of the line), each file owner-only (600) in an
+ *   owner-only folder (700), each line appended whole with `appendPrivateLine`, as the audit log's are. Daily files,
+ *   so retention drops whole days (`prune`).
+ * - **What a line holds:** `ActivityLine`, and nothing else. Every line is rebuilt field by field from the fields a
+ *   line has (`activityLineOf`), so a channel that hands over a whole message — body, text, HTML, attachment bytes —
+ *   still writes only its id, subject and sender: the type says so, and the copy makes it so. Subjects and names are
+ *   kept as received, cut to their bounds, and shown only inside the untrusted-content envelope.
+ * - **Never in the way:** `append` never throws into its caller. A line that cannot be written is said once per
+ *   process on stderr, remembered for `doctor`, and the call it describes goes on (§4.6).
+ * - **The audit log is unchanged.** It stays small, content-free and shareable; this one is private.
+ */
+/** What the call did with account data: read it, wrote it, was told of it (an event delivery, S1), or approved it. */
+declare const ACTIVITY_KINDS: readonly ["read", "write", "told", "approval"];
+type ActivityKind = (typeof ACTIVITY_KINDS)[number];
+/** How it ended: done, refused by a policy, an approval or a rule, or failed. */
+declare const ACTIVITY_OUTCOMES: readonly ["ok", "refused", "failed"];
+type ActivityOutcome = (typeof ACTIVITY_OUTCOMES)[number];
+/** Which kind of process recorded it: an MCP server, a CLI call, or the event service's own work. */
+declare const ACTIVITY_SURFACES: readonly ["mcp", "cli", "daemon"];
+type ActivitySurface = (typeof ACTIVITY_SURFACES)[number];
+/** An MCP client's `clientInfo`, as the client reported it: what it said, never proof of what it is (§4.3). */
+interface ClientInfo {
+  readonly name: string;
+  readonly version?: string | undefined;
+}
+/** The account a call acted on: its immutable id, and its name at the time. */
+interface ActivityAccount {
+  readonly id: string;
+  readonly alias: string;
+}
+/** Who sent a message, as its sender wrote it. */
+interface ActivitySender {
+  readonly name?: string | undefined;
+  readonly address?: string | undefined;
+}
+/**
+ * One thing a call touched: a message, a thread, a file. Its id, and for a message its subject and sender, for a
+ * download its file name and size, for a chat message the conversation it is in. Never a body, a preview or bytes.
+ */
+interface ActivityItem {
+  readonly id: string;
+  readonly subject?: string | undefined;
+  readonly from?: ActivitySender | undefined;
+  /** A file's name. */
+  readonly name?: string | undefined;
+  /** A file's size, in bytes. */
+  readonly size?: number | undefined;
+  /** Where it is: a Slack channel's name, say. */
+  readonly conversation?: string | undefined;
+}
+/** A process as `ps` names it: its id, when it started (as `ps` prints it, an identity rather than a time), its name. */
+interface ActivityParent {
+  readonly pid: number;
+  readonly startedAt: string;
+  readonly name: string;
+}
+/**
+ * Which session made a call (S2). A session is an agent window: the processes one parent started in one folder.
+ *
+ * - `key` names the session: a hash of the parent's id, its start and the folder when `grouped`; otherwise a key of
+ *   this process's own, which no other process shares.
+ * - `process` is a random id this process made when it started, and `pid` its process id.
+ * - `folder` is the working folder, as a real path (shown with the home as `~` only at display time), or null when it
+ *   could not be read.
+ * - `parent` is the parent that grouped it — for a CLI call that joined a window, that window's parent.
+ * - `ancestors` (CLI calls only) names up to three processes above it, nearest first, so a person typing in a terminal
+ *   can be told from an agent's shell.
+ */
+interface ActivitySession {
+  readonly key: string;
+  readonly process: string;
+  readonly pid: number;
+  readonly client?: ClientInfo | undefined;
+  readonly folder: string | null;
+  readonly parent?: ActivityParent | undefined;
+  readonly ancestors?: readonly string[] | undefined;
+  readonly grouped: boolean;
+  readonly surface: ActivitySurface;
+}
+/** What a `told` line says of a delivery (S1): the rule that matched and the target it reached. No sender, no payload. */
+interface ActivityTold {
+  readonly rule: string;
+  readonly target: string;
+}
+/**
+ * One call, as the log keeps it (§4.2, S1, S2, S4). Content never: what was touched, by id, subject and sender, and
+ * how it ended.
+ *
+ * - `operation` is the capability id (`gmail.search`), `channel` the channel's word (`gmail`).
+ * - `items` lists at most fifty things touched; `count` says how many there were in all.
+ * - `counts` holds named counts where a channel records no identities (WhatsApp's `chats` and `messages`, S4).
+ * - `query` is a search's words — an agent wrote them, not a sender.
+ * - `recipients` and `approvalId` are a write's, as the audit records them.
+ * - `told` is a delivery's (S1).
+ */
+interface ActivityLine {
+  readonly at: string;
+  readonly channel: string;
+  readonly account: ActivityAccount;
+  readonly operation: string;
+  readonly kind: ActivityKind;
+  readonly outcome: ActivityOutcome;
+  readonly reason?: string | undefined;
+  readonly session: ActivitySession;
+  readonly ms: number;
+  readonly items?: readonly ActivityItem[] | undefined;
+  readonly count?: number | undefined;
+  readonly counts?: Readonly<Record<string, number>> | undefined;
+  readonly query?: string | undefined;
+  readonly recipients?: readonly string[] | undefined;
+  readonly approvalId?: string | undefined;
+  readonly told?: ActivityTold | undefined;
+  /**
+   * The line was cut to `MAX_ACTIVITY_LINE_BYTES`: items, then recipients, dropped from the end, and long words
+   * shortened. `count` still says how many items there were.
+   */
+  readonly truncated?: true | undefined;
+}
+/** A line to append: `at` is now when left out. */
+type ActivityLineInput = Omit<ActivityLine, "at"> & {
+  readonly at?: string | undefined;
+};
+/** How many lines of each kind, and of each outcome. */
+interface ActivityCounts {
+  readonly kind: Readonly<Record<ActivityKind, number>>;
+  readonly outcome: Readonly<Record<ActivityOutcome, number>>;
+}
+/**
+ * One session as `sessions` lists it: where and by what it ran, when it was first and last seen, how many processes
+ * recorded lines for it, and its counts by kind and outcome. Its folder, client and parent are those of its first
+ * server process — or of its first line, when only CLI calls recorded any.
+ */
+interface ActivitySessionSummary {
+  readonly key: string;
+  readonly grouped: boolean;
+  readonly surfaces: readonly ActivitySurface[];
+  readonly folder: string | null;
+  readonly client: ClientInfo | null;
+  readonly parent: ActivityParent | null;
+  readonly firstSeen: string;
+  readonly lastSeen: string;
+  readonly processes: number;
+  readonly channels: readonly string[];
+  readonly accounts: readonly string[];
+  readonly counts: ActivityCounts;
+}
+/** A line that could not be written: when, why, and which process — never anything the line held. */
+interface ActivityFailure {
+  readonly at: string;
+  readonly code: string;
+  readonly message: string;
+  readonly pid: number;
+}
+/** What `doctor` reads of the log: where it is, whether it is private and writable, and the last failure. */
+interface ActivityHealth {
+  readonly directory: string;
+  /** False when nothing was recorded yet. */
+  readonly exists: boolean;
+  /** False when something that is not a folder stands where it goes. */
+  readonly isDirectory: boolean;
+  /** Whether only its owner can read it; null where that cannot be told (Windows), or before it exists. */
+  readonly private: boolean | null;
+  /** Whether today's file can be written: the file when it exists, its folder otherwise. */
+  readonly writable: boolean;
+  /** The days held, oldest first. */
+  readonly days: readonly string[];
+  /** When a line was last written, from the newest file's time; null when there is none. */
+  readonly lastWritten: string | null;
+  /** The last failure any process recorded, or this one remembers. */
+  readonly failure: ActivityFailure | null;
+}
+/** What `show` filters by. `account` is a name or an id; `since` an ISO time. */
+interface ActivityFilters {
+  readonly kind?: ActivityKind | undefined;
+  readonly channel?: string | undefined;
+  readonly account?: string | undefined;
+  readonly outcome?: ActivityOutcome | undefined;
+  readonly since?: string | undefined;
+  /** The most lines to return, newest first: 1000 when left out. */
+  readonly limit?: number | undefined;
+}
+/** One session's lines, newest first, filtered; and what all of its lines in the time asked add up to. */
+interface ActivityShown {
+  readonly lines: ActivityLine[];
+  /** True when more lines matched than `limit`. */
+  readonly more: boolean;
+  /** The session over the time asked, before the other filters; null when it has no line there at all. */
+  readonly summary: ActivitySessionSummary | null;
+}
+interface ActivityLogOptions {
+  now?: (() => Date) | undefined;
+  /**
+   * The settings in force, read afresh for every line, so turning recording off applies at once in every process.
+   * Left out, on and 30 days. A reader that throws — a configuration that cannot be read — is read as off.
+   */
+  settings?: (() => Promise<ActivitySettings>) | undefined;
+  /** Where the once-a-process line about a failure goes: stderr when left out. */
+  warn?: ((line: string) => void) | undefined;
+}
+declare class ActivityLog {
+  #private;
+  readonly directory: string;
+  constructor(stateDir: string, options?: ActivityLogOptions);
+  /** The last line this process could not write, or null. */
+  get lastFailure(): ActivityFailure | null;
+  /**
+   * Appends one line, unless recording is off. True when it was written. Never throws: a line that cannot be written
+   * is said once per process (`warn`, stderr by default), recorded beside the log for `doctor`, and returns false.
+   *
+   * The first call a process makes on each day — this, or any read — first prunes days older than the retention in
+   * force, whether or not recording is on: the log's daily maintenance, best effort.
+   */
+  append(input: ActivityLineInput): Promise<boolean>;
+  /** The days held, oldest first. */
+  days(): Promise<string[]>;
+  /**
+   * Deletes every day whose last line is older than `retentionDays` days: a day goes once all of it is that old, so
+   * every line is kept at least that long and at most a day longer. Whole days only; every other day is left whole.
+   */
+  prune(retentionDays: number): Promise<{
+    deleted: string[];
+  }>;
+  /**
+   * Every session with a line at or after `since` (every day the retention keeps, when left out), newest first. A day
+   * past the retention is never read, whether or not it has been deleted yet.
+   */
+  sessions(options?: {
+    since?: string | undefined;
+  }): Promise<ActivitySessionSummary[]>;
+  /**
+   * One session's lines, newest first, that match every filter given; and its summary over the time asked. Only
+   * lines whose session key is exactly `key` are ever read into the answer, and none of a day past the retention.
+   */
+  show(key: string, filters?: ActivityFilters): Promise<ActivityShown>;
+  /**
+   * The window a CLI call belongs to (S2): the session of a server process, today or yesterday, whose parent is one of
+   * `ancestors` — the nearest first. Null when none is. Read from each day's parents file; a day with none — written
+   * by an earlier build — is read whole, as before.
+   */
+  sessionOfAncestor(ancestors: readonly ActivityParent[]): Promise<{
+    key: string;
+    parent: ActivityParent;
+    folder: string | null;
+  } | null>;
+  /** The last failure recorded by any process — the newer of the file beside the log and this process's own. */
+  readFailure(): Promise<ActivityFailure | null>;
+  /**
+   * What `doctor` shows of the log. It creates nothing; like every read it first deletes the days past the retention,
+   * once a day per process, so the days it lists past the retention are those that could not be deleted.
+   */
+  health(): Promise<ActivityHealth>;
+}
+//#endregion
 //#region src/ledger.d.ts
 interface Caps {
   perHour: number;
@@ -3129,6 +3413,11 @@ interface Core {
   plans: PlanStore;
   taint: TaintStore;
   audit: AuditLog;
+  /**
+   * The activity log (design 2026-10-25-activity): one line per call an agent session makes to account data, private,
+   * by day, under the settings in `config.json`'s `activity`. Never throws into a caller (`ActivityLog.append`).
+   */
+  activity: ActivityLog;
   /** Opens the config directory's one secret backend (as recorded in config, or `kind` before the first write). */
   secrets(kind?: SecretStoreKind): Promise<SecretStore>;
   /**
@@ -4175,6 +4464,16 @@ interface ConfigBody {
    * keep every key they do not name, so older releases keep it too, and judged by `classifyChange`.
    */
   behaviour?: unknown;
+  /**
+   * The activity log's settings (design 2026-10-25-activity §4.1): `{ record: 'on' | 'off', retentionDays: 1..365 }`,
+   * on and 30 when absent.
+   *
+   * `unknown` here, as `agentLabel` and `behaviour` are: it is read only through `readActivitySettings`, which reads a
+   * value it does not understand as recording less — off, and the fewest days — so a hand edit or a later release's
+   * word can only tighten. Kept through every write as the schemas keep every key they do not name, and judged by
+   * `classifyChange`: recording again and keeping more days are loosenings, off and fewer days tightenings.
+   */
+  activity?: unknown;
 }
 interface ConfigV1 extends ConfigBody {
   version: 1;
@@ -12048,6 +12347,11 @@ declare class ResendContext {
   readonly now: () => Date;
   readonly platform: NodeJS.Platform;
   readonly surface: "cli" | "mcp";
+  /**
+   * What the MCP client said it is (`clientInfo`), for the activity log's session: set by the server once it exists,
+   * read when a line is written, since a client says it only on connecting. Never set for the CLI.
+   */
+  clientInfo: (() => ClientInfo | undefined) | undefined;
   /**
    * What every result, refusal and hint names for a person to run: Resend's own CLI as this installation runs it, or
    * core's through its installed dependency (`own`, `core`), quoted for `platform` — or why there is none here.

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { Bt as VERSION, Ft as RESEND_CALLER, H as CommsError, It as REFUSED, Lt as RESEND_API_ORIGIN, N as resendRequest, P as ResendContext, Pt as PACKAGE_NAME, Rt as RESEND_DOWNLOAD_ORIGIN, b as readBody, dt as newBoundary, h as resendId, ut as neutralise, v as addressesOf, wt as stripInvisible, y as attachmentRisks, z as keyPermissionOf, zt as ROUTES } from "./send-BbyDPqGS.mjs";
-import { t as createResendMcpServer } from "./server-stiYlGRn.mjs";
+import { Bt as ROUTES, Ft as PACKAGE_NAME, H as CommsError, It as RESEND_CALLER, Lt as REFUSED, N as resendRequest, P as ResendContext, Rt as RESEND_API_ORIGIN, Vt as VERSION, b as readBody, dt as newBoundary, h as resendId, ut as neutralise, v as addressesOf, wt as stripInvisible, y as attachmentRisks, z as keyPermissionOf, zt as RESEND_DOWNLOAD_ORIGIN } from "./send-BC8FI-_F.mjs";
+import { t as createResendMcpServer } from "./server-7jk5cvX6.mjs";
 //#region src/operations/events.ts
 const BODY_LIMIT = 2e4;
 const STATUS = /* @__PURE__ */ new Set([