@agentcomms/resend 0.9.0 → 0.11.0

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as openCore, B as approvalKind, C as policyChange, D as sendPolicyOf, E as removeAccountChange, F as CHANNEL_SERVERS, H as approveChangeAtTerminal, I as CommsError, J as escapeForDisplay, K as colorEnabled, L as EXIT_CODES, N as checkNewName, O as showAccount, Q as installExitStatus, R as SEND_LOOKUP, S as policyApprovalRefusal, T as policyWanted, U as canPrompt, V as approvalsOf, Y as exemptFromUpdateGate, Z as gatedChangeAtTerminal, _ as runDoctor, _t as VERSION, a as revokeSendApproval, at as serverInstallChange, b as listAccounts, c as downloadReceived, d as listReceived, et as paint, f as listScheduled, ft as writeResult, g as showSentEmail, h as showReceived, i as prepareSend, it as runCommand, k as ResendContext, l as getMetrics, lt as truncateDisplay, m as listSuppressions, n as executeSend, nt as renderInstall, o as sendStatus, ot as serverPruneChange, p as listSentEmails, q as commandPathOf, r as finishSendApproval, rt as renderPrune, s as cancelScheduledChange, st as terminalUpdateHooks, t as beginSendApproval, tt as refuseUnclaimedApproval, u as listDomains, ut as updateGateAtTerminal, v as addAccountChange, w as policyReport, x as modeOf, y as inspectKey, z as agentMarker } from "./send-D9aAM9kv.mjs";
+import { $ as openCore, B as approvalKind, C as policyChange, D as sendPolicyOf, E as removeAccountChange, F as CHANNEL_SERVERS, H as approveChangeAtTerminal, I as CommsError, J as escapeForDisplay, K as colorEnabled, L as EXIT_CODES, N as checkNewName, O as showAccount, Q as installExitStatus, R as SEND_LOOKUP, S as policyApprovalRefusal, T as policyWanted, U as canPrompt, V as approvalsOf, Y as exemptFromUpdateGate, Z as gatedChangeAtTerminal, _ as runDoctor, _t as VERSION, a as revokeSendApproval, at as serverInstallChange, b as listAccounts, c as downloadReceived, d as listReceived, et as paint, f as listScheduled, ft as writeResult, g as showSentEmail, h as showReceived, i as prepareSend, it as runCommand, k as ResendContext, l as getMetrics, lt as truncateDisplay, m as listSuppressions, n as executeSend, nt as renderInstall, o as sendStatus, ot as serverPruneChange, p as listSentEmails, q as commandPathOf, r as finishSendApproval, rt as renderPrune, s as cancelScheduledChange, st as terminalUpdateHooks, t as beginSendApproval, tt as refuseUnclaimedApproval, u as listDomains, ut as updateGateAtTerminal, v as addAccountChange, w as policyReport, x as modeOf, y as inspectKey, z as agentMarker } from "./send-CgN2O8kG.mjs";
 import path from "node:path";
 import childProcess from "node:child_process";
 import { createInterface } from "node:readline/promises";
@@ -3405,7 +3405,7 @@ is out: update first, or put it off (agentcomms update, agentcomms update --late
 	}));
 	const mcp = program.command("mcp").description("run the MCP server on stdio, for a coding agent to connect to").option("--account <name>", "pin the server to one account; every tool then acts on it and no other").action(async (flags) => {
 		ran = true;
-		const { startResendStdioServer } = await import("./stdio-entry-F1YLLUXd.mjs");
+		const { startResendStdioServer } = await import("./stdio-entry-u9u7Mn18.mjs");
 		await startResendStdioServer({
 			...deps,
 			env,

package/dist/index.d.mts

@@ -11797,6 +11797,11 @@ interface LooseningConsent {
    */
   changes?: readonly Loosening[] | undefined;
 }
+/**
+ * Why a saved name has {@link DOWNLOAD_SUFFIX} after it: a name tools read or run on their own (`auto-read`), an
+ * extension that is not one of the inert ones (`type`), or no extension at all (`no-extension`).
+ */
+type RenameReason = "auto-read" | "type" | "no-extension";
 //#endregion
 //#region src/approvals.d.ts
 /**
@@ -11812,17 +11817,26 @@ interface LooseningConsent {
  *
  * A change approval (`kind: 'change'`) lives in the same store and goes through the same states, except that its
  * claim goes straight to `used`: what it permits is a write to the configuration, which the claimant makes itself.
+ *
+ * So does a download's question (`kind: 'download'`): where to save the files a Gmail or Slack download names. It is
+ * held to the change policy of the mailbox or workspace it is about, as every other change there is. Under `chat` the
+ * person's answer, relayed from the chat, claims it straight from `pending`. Under `confirm` it has to be answered
+ * where an agent cannot answer for them — at their own terminal, or in a form a trusted client shows them — which
+ * records the answer and moves it to `approved`; only then is it claimed, straight to `used`, and the recorded answer
+ * is the one that saves. It gets the store's expiry, its single use and its binding for the reason a change does: an
+ * answer given for three invoices must not save the next conversation's files, nor be spent twice.
  */
 type ApprovalState = "pending" | "approved" | "sending" | "used" | "failed" | "unknown" | "expired" | "revoked";
 type ApprovalChannel = "elicitation" | "terminal";
 /**
- * What an approval permits: a send (a mail, a post, a reaction) or a change to the configuration.
+ * What an approval permits: a send (a mail, a post, a reaction), a change to the configuration, or a download saved
+ * where the person said.
  *
- * One store for both, so a change gets the machinery a send already has — expiry, single use, the typed code — and
- * a kind on every record, so that neither can be spent as the other. Without it, a person who approved a post at a
+ * One store for all three, so a change gets the machinery a send already has — expiry, single use, the typed code —
+ * and a kind on every record, so that none can be spent as another. Without it, a person who approved a post at a
  * terminal would also have approved whatever change an agent claimed under the same id.
  */
-type ApprovalKind = "send" | "change";
+type ApprovalKind = "send" | "change" | "download";
 /** The inbox or account a change is about. `id` is absent when the change connects it, and it does not exist yet. */
 interface ChangeTarget {
   kind: "inbox" | "account";
@@ -11850,6 +11864,70 @@ interface ChangeBinding {
   /** What it does outside the configuration, in words: a sign-in, a registration, files removed. */
   effects: string[];
 }
+/**
+ * Exactly which download a question was asked for, stored on the record so the answer can be held to it.
+ *
+ * The files are the ones the question listed, by the platform's own ids — `<message id>/<part id>` for Gmail, the file
+ * id for Slack — in the order they were listed: a claim for any other set is a claim for a download the person was
+ * not asked about. So are the names they would be saved under, in the same order: a Slack file renamed between the
+ * question and the answer would otherwise be saved under a name the person was never shown. The folders are the two
+ * the question showed, as absolute paths. They are not part of the digest, because they are what the answer *means*
+ * rather than what it is for: `downloads` in the answer is the path the person read, even when an agent runs the
+ * download again from another folder.
+ */
+interface DownloadBinding {
+  /** One line about the download, for a listing: "where to save 2 files from acme/gmail". Not part of the digest. */
+  summary: string;
+  /** The mailbox or workspace the files come from, by the id it has now. */
+  target: {
+    kind: "inbox" | "account";
+    name: string;
+    id: string;
+  };
+  /** Which download asked: `attachments.download`, `files.download`. */
+  operation: string;
+  /** The request as the caller made it, in the words of its own arguments: the selection, and how many at most. */
+  request: Record<string, unknown>;
+  /** The files the question listed, by the platform's ids, in order. */
+  files: string[];
+  /** The names those files would be saved under, as the question listed them, in the same order. */
+  names: string[];
+  /** The two folders the question offered, as absolute paths. */
+  folders: {
+    downloads: string;
+    current: string;
+  };
+  /**
+   * The files as the question listed them to the person — the names they would be saved under, their sizes, why a
+   * name has `.download` after it, and their risk flags — so a terminal or a form can show the question, and its
+   * warnings, again. Not part of the digest: the ids and names above are.
+   */
+  listing?: ListedFile[] | undefined;
+  /** The person's answer, when they gave it where an agent cannot: at a terminal, or in a trusted client's form. */
+  answer?: RecordedSaveAnswer | undefined;
+}
+/** One file as a question lists it. */
+interface ListedFile {
+  /** The name it would be saved under: the sender's made safe, with `.download` after it unless it is inert. */
+  name: string;
+  size: number | null;
+  /** Why `.download` is after its name; absent when the name is the sender's, made safe. */
+  renamed?: RenameReason | undefined;
+  /** Its risk flags, as the file's own listing gives them. */
+  flags?: string[] | undefined;
+}
+/**
+ * An answer recorded on a question: one of the two folders it offered, or the folder the person named, as an absolute
+ * path — resolved where they typed it, so it means the folder they read.
+ */
+type RecordedSaveAnswer = {
+  readonly choice: "downloads" | "current";
+} | {
+  readonly choice: "other";
+  readonly folder: string;
+};
+/** What a claim of a download's question is held to: all of the binding but its summary and the folders it offered. */
+type DownloadRequest = Pick<DownloadBinding, "target" | "operation" | "request" | "files" | "names">;
 interface Expectation {
   to: string[];
   cc: string[];
@@ -11888,6 +11966,8 @@ interface ApprovalRecord {
   reason?: string | undefined;
   /** For a change: exactly what it permits. `digest` is `changeDigest` of this. */
   change?: ChangeBinding | undefined;
+  /** For a download's question: what it asked about, and the folders it offered. `digest` is `downloadDigest`. */
+  download?: DownloadBinding | undefined;
 }
 interface CreateApprovalInput {
   inboxId: string;
@@ -11933,6 +12013,7 @@ declare class ApprovalStore {
   constructor(stateDir: string, options?: {
     now?: () => Date;
     ttlMs?: number;
+    downloadTtlMs?: number;
   });
   create(input: CreateApprovalInput): Promise<ApprovalRecord>;
   get(approvalId: string): Promise<ApprovalRecord | null>;
@@ -11979,6 +12060,52 @@ declare class ApprovalStore {
    * person to have typed the code at a terminal first; until then the refusal leaves the record as it is.
    */
   claimForChange(approvalId: string, live: LiveChange, options?: ClaimOptions): Promise<ApprovalRecord>;
+  /**
+   * A download's question, pending, bound to `downloadDigest(input.download)` — computed here, never taken from the
+   * caller, as a change's digest is. It stands in for the draft revision too.
+   *
+   * `policy` is the change policy of the mailbox or workspace the files come from, as it stands when the question is
+   * asked: where a stranger's files land on this machine is a change to it, and is answered the way that account's
+   * other changes are approved. A claim holds the question to the stricter of this and the policy then.
+   */
+  createDownload(input: {
+    download: DownloadBinding;
+    policy: ChangePolicy;
+  }): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Records the person's answer to a download's question, given where an agent cannot give it: at their own terminal,
+   * or in a form a trusted client showed them. The question moves to `approved`, carrying the answer, and waits for
+   * the download to claim it — which it may then do under `confirm`, and which saves where this answer says.
+   *
+   * Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
+   */
+  answerDownload(approvalId: string, via: ApprovalChannel, answer: RecordedSaveAnswer): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
+  /**
+   * Claims a download's question, once, for the download the caller is about to make — and returns it, with the
+   * folders it offered, so that `downloads` and `current` in the answer mean the paths the person read, and with the
+   * answer the person recorded, when they recorded one.
+   *
+   * `live` is the download as the caller computes it now: the same account, the same request, the same files under
+   * the same names — the person answered for those files and no others. Any other is refused, and the question left
+   * open, as it was: a second call that got an argument wrong is the agent's slip, not the person's, and voiding the
+   * question for it would make the person answer again for nothing. It still expires, and is claimed once.
+   *
+   * `options.policy` is the change policy of that account now, and the stricter of it and the one the question was
+   * asked under decides. Under `chat`, a pending question is claimed with the answer the caller carries: the person
+   * gave it in the conversation. Under `confirm`, only a question the person answered at a terminal or in a trusted
+   * form can be claimed; a pending one is refused, and left as it is, so they can still answer it. One used, voided or
+   * expired is refused as an approval in that state is.
+   */
+  claimForDownload(approvalId: string, live: DownloadRequest, options?: {
+    policy?: ChangePolicy | undefined;
+    pendingHint?: string | undefined;
+  }): Promise<ApprovalRecord & {
+    download: DownloadBinding;
+  }>;
   /** Records the outcome of the one send attempt. */
   complete(approvalId: string, outcome: {
     sentMessageId: string;
@@ -12078,7 +12205,10 @@ interface ResolvedPaths {
   secretsDir: string;
   /** Managed runtime installs for MCP clients. */
   dataDir: string;
-  /** Default root for attachment downloads and exports. */
+  /**
+   * Default root for exports and for the files Resend's received mail carries. A Gmail attachment or a Slack file is
+   * not saved here: those downloads ask the person where to save (`save-destination.ts`).
+   */
   downloadsDir: string;
 }
 //#endregion

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { _t as VERSION, gt as ROUTES, ht as RESEND_DOWNLOAD_ORIGIN, mt as RESEND_API_ORIGIN, pt as REFUSED } from "./send-D9aAM9kv.mjs";
-import { t as createResendMcpServer } from "./server-Cr9ZXT1i.mjs";
+import { _t as VERSION, gt as ROUTES, ht as RESEND_DOWNLOAD_ORIGIN, mt as RESEND_API_ORIGIN, pt as REFUSED } from "./send-CgN2O8kG.mjs";
+import { t as createResendMcpServer } from "./server-DYhcD72L.mjs";
 //#region src/index.ts
 /**
 * The library entry of `@agentcomms/resend`.

package/dist/{send-D9aAM9kv.mjs → send-CgN2O8kG.mjs}

@@ -1,10 +1,10 @@
 import { b as strictObject, c as boolean, h as number, i as _enum, m as looseObject, p as literal$1, s as array, x as string, y as record } from "./schemas-DiGKNDNq.mjs";
 import { access, chmod, constants, link, lstat, mkdir, open, readFile, readdir, readlink, realpath, rename, rm, stat, utimes } from "node:fs/promises";
-import { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import path, { basename, delimiter, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
-import { homedir, platform } from "node:os";
+import { homedir, platform, userInfo } from "node:os";
 import { execFile, spawn } from "node:child_process";
 import "node:readline/promises";
 import { styleText } from "node:util";
@@ -12,7 +12,7 @@ import { constants as constants$1 } from "node:fs";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.9.0";
+const VERSION$1 = "0.11.0";
 //#endregion
 //#region src/api/routes.ts
 /**
@@ -187,7 +187,7 @@ function refusedBecause(method, pathname) {
 	return null;
 }
 //#endregion
-//#region ../core/dist/update-gate-BwIKJmH7.mjs
+//#region ../core/dist/update-gate-BMcLWU3V.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -1278,7 +1278,7 @@ const APP_DIR_NAME = "agent-communications";
 function resolvePaths(options = {}) {
 	const env = options.env ?? process.env;
 	const platform = options.platform ?? process.platform;
-	const home = options.home ?? ((platform === "win32" ? env.USERPROFILE : env.HOME) || homedir());
+	const home = options.home ?? homeOf(env, platform);
 	const configDir = resolve(env.AGENT_COMMS_CONFIG_DIR || (env.XDG_CONFIG_HOME ? join(env.XDG_CONFIG_HOME, "agent-communications") : platform === "win32" ? join(env.APPDATA || join(home, "AppData", "Roaming"), "agent-communications") : join(home, ".config", "agent-communications")));
 	const explicitConfigDir = Boolean(env.AGENT_COMMS_CONFIG_DIR);
 	const localRoot = platform === "win32" && !explicitConfigDir ? join(env.LOCALAPPDATA || join(home, "AppData", "Local"), APP_DIR_NAME) : configDir;
@@ -1290,10 +1290,40 @@ function resolvePaths(options = {}) {
 		downloadsDir: resolve(join(home, "Downloads", APP_DIR_NAME))
 	};
 }
-/** Expands a leading `~` to the home directory. Nothing else is expanded. */
-function expandHome(path, home = homedir()) {
+/**
+* The home the environment names, which is where Node's own `homedir()` looks for the running process — `HOME`, or
+* `USERPROFILE` on Windows. Asking `homedir()` directly ignored an environment passed in, so every test that gave the
+* harness a temporary HOME still had its data and downloads resolved to the real ones: one day of test runs left 748
+* backups of fixture entries in the maintainer's own data directory.
+*
+* Its own function since a download asks where to save: the person's Downloads folder is `<this>/Downloads`, and a
+* folder they type as `~/…` is expanded from it — the same home every other path here is resolved from. When the
+* environment names none, the account's own home is taken ({@link accountHome}); `account` is for a test to say what
+* that is.
+*/
+function homeOf(env = process.env, platform = process.platform, account = accountHome) {
+	return (platform === "win32" ? env.USERPROFILE : env.HOME) || account();
+}
+/**
+* The home the account itself has, for when the environment names none: the password database's (`os.userInfo()`),
+* which no variable moves, rather than `homedir()`, which reads `HOME` first — from this process's environment, not the
+* one the caller passed, and so from somewhere the caller did not say. Only when there is no such entry — some
+* containers run as an id with none — is `homedir()` asked instead.
+*/
+function accountHome() {
+	try {
+		const home = userInfo().homedir;
+		if (home) return home;
+	} catch {}
+	return homedir();
+}
+/**
+* Expands a leading `~` to the home directory. Nothing else is expanded. `joinPaths` is the platform's own, for a path
+* judged for another platform than this one: a Linux home joined on Windows would otherwise take its backslashes.
+*/
+function expandHome(path, home = homedir(), joinPaths = join) {
 	if (path === "~") return home;
-	if (path.startsWith("~/") || path.startsWith("~\\")) return join(home, path.slice(2));
+	if (path.startsWith("~/") || path.startsWith("~\\")) return joinPaths(home, path.slice(2));
 	return path;
 }
 /**
@@ -2131,6 +2161,55 @@ function challengeMatches(answer, storedHash) {
 	const b = Buffer.from(storedHash, "hex");
 	return a.length === b.length && timingSafeEqual(a, b);
 }
+/**
+* The digest a download's question is bound to: the account, the download, the request, the files it listed and the
+* names it showed them under.
+*
+* The files and names keep their order, since the question showed them in it; the request is canonical JSON, so the
+* same arguments digest the same however an object happened to list its keys.
+*/
+function downloadDigest(download) {
+	return sha256Hex(canonicalJson$1({
+		kind: "download",
+		target: {
+			kind: download.target.kind,
+			name: download.target.name,
+			id: download.target.id
+		},
+		operation: download.operation,
+		request: download.request,
+		files: [...download.files],
+		names: [...download.names]
+	}));
+}
+/**
+* Why a download claimed is not the one its question was asked for, in a sentence — the first difference found. Only
+* the words; what refuses is the digest.
+*/
+function downloadDrift(asked, now) {
+	if (asked.target.id !== now.target.id || asked.target.kind !== now.target.kind) return `the question was about ${asked.target.name}, not ${now.target.name}`;
+	if (asked.operation !== now.operation) return "the question was asked for another kind of download";
+	if (canonicalJson$1(asked.request) !== canonicalJson$1(now.request)) return "the question was asked about a different request: other messages, other files or another limit";
+	if (canonicalJson$1(asked.files) !== canonicalJson$1(now.files)) return "the files are not the ones the question listed";
+	const renamed = asked.files.find((_, index) => asked.names[index] !== now.names[index]);
+	if (renamed !== void 0) return `${renamed} would now be saved under another name than the one the question showed: it was renamed since`;
+	return "the download is not the one the question was asked for";
+}
+/**
+* Why a download's question cannot be claimed under this change policy — the stricter of `livePolicy` and the one it
+* was asked under — or null. Changes nothing, so a download can ask before it looks at a folder, and the store asks
+* again as it claims.
+*
+* Under `chat` nothing stops it: the person's answer, relayed from the conversation, is the answer. Anything stricter
+* needs the answer recorded on the question by a channel an agent cannot answer — the person's own terminal, or a
+* form a trusted client showed them. An answer carried in a tool's arguments or a command's flags is refused however
+* it was worded, with the command that answers it named, and the question left open for the person.
+*/
+function downloadClaimRefusal(record, livePolicy, pendingHint) {
+	if (stricterPolicy(livePolicy, record.requiredPolicy) === "chat") return null;
+	if (record.state === "approved" && (record.approvedVia === "terminal" || record.approvedVia === "elicitation") && record.download?.answer !== void 0) return null;
+	return refuseDownload("APPROVAL_PENDING", "the change policy here is confirm, so the person answers where to save themselves — at their own terminal, not through an agent", record, pendingHint ?? "Ask the person to answer it at their own terminal, with the approve command of the channel the files come from and this choice id; then make the download again with the choice id alone.");
+}
 /** The kind of a record. Absent is a send: every record written before changes had approvals. */
 function approvalKind(record) {
 	return record.kind ?? "send";
@@ -2179,6 +2258,11 @@ function changeDrift(approved, now) {
 	if (canonicalJson$1(approved.effects) !== canonicalJson$1(now.effects)) return "what it does outside the configuration is not what was approved";
 	return "the change is not the one that was approved";
 }
+/**
+* What to do with a download's question, for a caller that took it for something else: it is answered, not approved
+* with a code — in the chat, or at the person's own terminal with the command of the channel that asked.
+*/
+const DOWNLOAD_ANSWER_HINT = "It is answered, not approved with a code: the person says where in the chat, or — under a confirm change policy — at their own terminal, with the `approve` command of the channel the files come from and this id. The download that asked is then made again with this id.";
 const POLICY_RANK = {
 	chat: 0,
 	confirm: 1,
@@ -2207,9 +2291,25 @@ function refuseChange(code, reason, record, hint) {
 		} : {}
 	});
 }
+/**
+* The same refusal for a download's question, which saves nothing until it is claimed.
+*
+* Its hint says to ask again rather than to prepare anything: what the person is shown again is the question, and it
+* is the download itself that asks it.
+*/
+function refuseDownload(code, reason, record, hint) {
+	return new CommsError(code, `nothing was saved: ${reason}`, {
+		hint: hint ?? "Make the download again without an answer, and show the person the new question.",
+		details: record ? {
+			choiceId: record.approvalId,
+			state: record.state
+		} : {}
+	});
+}
 /** The refusal in the words of the record's own kind. */
 function refusalFor(record) {
-	return approvalKind(record) === "change" ? refuseChange : refuse$1;
+	const kind = approvalKind(record);
+	return kind === "change" ? refuseChange : kind === "download" ? refuseDownload : refuse$1;
 }
 /** The record as it may be shown to anyone, agents included: never the challenge hash. */
 function publicView(record) {
@@ -2220,10 +2320,12 @@ var ApprovalStore = class {
 	directory;
 	#now;
 	#ttlMs;
+	#downloadTtlMs;
 	constructor(stateDir, options = {}) {
 		this.directory = join(stateDir, "approvals");
 		this.#now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.#ttlMs = options.ttlMs ?? 6e5;
+		this.#downloadTtlMs = options.downloadTtlMs ?? 18e5;
 	}
 	#path(approvalId, suffix = ".json") {
 		if (!APPROVAL_ID_PATTERN.test(approvalId)) throw refuse$1("USAGE", `"${approvalId}" is not an approval id`);
@@ -2311,6 +2413,11 @@ var ApprovalStore = class {
 	}
 	#stateError(record) {
 		const refusal = refusalFor(record);
+		if (approvalKind(record) === "download") {
+			if (record.state === "expired") return refusal("APPROVAL_EXPIRED", "the question expired before it was answered", record);
+			if (record.state === "revoked") return refusal("APPROVAL_VOID", `the question was voided (${record.reason ?? "revoked"})`, record);
+			return refusal("APPROVAL_VOID", record.state === "used" ? "the question was answered already, and an answer is used once" : `the question is ${record.state}`, record);
+		}
 		if (record.state === "expired") return refusal("APPROVAL_EXPIRED", "the approval expired before it was used", record);
 		if (record.state === "revoked") return refusal("APPROVAL_VOID", `the approval was voided (${record.reason ?? "revoked"})`, record);
 		return refusal("APPROVAL_REQUIRED", `the approval is ${record.state}`, record);
@@ -2322,8 +2429,11 @@ var ApprovalStore = class {
 	* somebody is about to approve, because an agent passed its id to a change, would punish the wrong party.
 	*/
 	#requireKind(record, kind) {
-		if (approvalKind(record) === kind) return;
+		const actual = approvalKind(record);
+		if (actual === kind) return;
 		const id = record.approvalId;
+		if (actual === "download") throw (kind === "change" ? refuseChange : refuse$1)("USAGE", `${id} is a question about where to save files, not ${kind === "send" ? "a send" : "a configuration change"}`, record, DOWNLOAD_ANSWER_HINT);
+		if (kind === "download") throw refuseDownload("USAGE", `${id} is ${actual === "change" ? "a configuration change" : "a send"}, not a question about where to save files`, record, "Pass the choice id the download’s question came with, and the person’s answer beside it.");
 		throw kind === "send" ? refuse$1("USAGE", `approval ${id} is for a configuration change, not a send`, record, `A person approves it with \`agentcomms approve ${id}\` — or ${channelApproveCommands()}, whichever is installed — and it permits only the change it was prepared for.`) : refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, `It is approved with the command that prepared it — ${channelApproveCommands({ sending: true })} — and permits only that send.`);
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
@@ -2545,6 +2655,139 @@ var ApprovalStore = class {
 		await this.#markClaimed(result);
 		return result;
 	}
+	/**
+	* A download's question, pending, bound to `downloadDigest(input.download)` — computed here, never taken from the
+	* caller, as a change's digest is. It stands in for the draft revision too.
+	*
+	* `policy` is the change policy of the mailbox or workspace the files come from, as it stands when the question is
+	* asked: where a stranger's files land on this machine is a change to it, and is answered the way that account's
+	* other changes are approved. A claim holds the question to the stricter of this and the policy then.
+	*/
+	async createDownload(input) {
+		const now = this.#now();
+		const download = {
+			summary: input.download.summary,
+			target: { ...input.download.target },
+			operation: input.download.operation,
+			request: JSON.parse(canonicalJson$1(input.download.request)),
+			files: [...input.download.files],
+			names: [...input.download.names],
+			folders: {
+				downloads: input.download.folders.downloads,
+				current: input.download.folders.current
+			},
+			...input.download.listing === void 0 ? {} : { listing: input.download.listing.map((file) => ({
+				name: file.name,
+				size: file.size,
+				...file.renamed === void 0 ? {} : { renamed: file.renamed },
+				...file.flags === void 0 || file.flags.length === 0 ? {} : { flags: [...file.flags] }
+			})) }
+		};
+		const digest = downloadDigest(download);
+		const policy = input.policy === "chat" ? "chat" : "confirm";
+		const record = {
+			approvalId: newApprovalId(),
+			kind: "download",
+			digestVersion: 1,
+			inboxId: download.target.id,
+			draftId: "download",
+			draftMessageId: digest,
+			digest,
+			policy,
+			requiredPolicy: policy,
+			riskFlags: [],
+			expect: {
+				to: [],
+				cc: [],
+				bcc: [],
+				subject: download.summary
+			},
+			challengeAttempts: 0,
+			state: "pending",
+			createdAt: now.toISOString(),
+			expiresAt: new Date(now.getTime() + this.#downloadTtlMs).toISOString(),
+			updatedAt: now.toISOString(),
+			download
+		};
+		await this.#write(record);
+		return record;
+	}
+	/**
+	* Records the person's answer to a download's question, given where an agent cannot give it: at their own terminal,
+	* or in a form a trusted client showed them. The question moves to `approved`, carrying the answer, and waits for
+	* the download to claim it — which it may then do under `confirm`, and which saves where this answer says.
+	*
+	* Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
+	*/
+	async answerDownload(approvalId, via, answer) {
+		const recorded = answer.choice === "other" ? {
+			choice: "other",
+			folder: answer.folder
+		} : { choice: answer.choice };
+		return await this.#transition(approvalId, (current) => {
+			this.#requireKind(current, "download");
+			if (current.state === "approved") throw refuseDownload("APPROVAL_VOID", "the question was answered already, and it is answered once", current);
+			if (current.state !== "pending") throw this.#stateError(current);
+			if (!current.download || downloadDigest(current.download) !== current.digest) throw refuseDownload("APPROVAL_VOID", "the question does not describe the download it is bound to", current);
+			return {
+				...current,
+				state: "approved",
+				approvedVia: via,
+				approvedDigest: current.digest,
+				download: {
+					...current.download,
+					answer: recorded
+				}
+			};
+		});
+	}
+	/**
+	* Claims a download's question, once, for the download the caller is about to make — and returns it, with the
+	* folders it offered, so that `downloads` and `current` in the answer mean the paths the person read, and with the
+	* answer the person recorded, when they recorded one.
+	*
+	* `live` is the download as the caller computes it now: the same account, the same request, the same files under
+	* the same names — the person answered for those files and no others. Any other is refused, and the question left
+	* open, as it was: a second call that got an argument wrong is the agent's slip, not the person's, and voiding the
+	* question for it would make the person answer again for nothing. It still expires, and is claimed once.
+	*
+	* `options.policy` is the change policy of that account now, and the stricter of it and the one the question was
+	* asked under decides. Under `chat`, a pending question is claimed with the answer the caller carries: the person
+	* gave it in the conversation. Under `confirm`, only a question the person answered at a terminal or in a trusted
+	* form can be claimed; a pending one is refused, and left as it is, so they can still answer it. One used, voided or
+	* expired is refused as an approval in that state is.
+	*/
+	async claimForDownload(approvalId, live, options = {}) {
+		const digest = downloadDigest(live);
+		let failure = null;
+		const result = await this.#transition(approvalId, (current) => {
+			this.#requireKind(current, "download");
+			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
+			const voidWith = (reason) => {
+				failure = {
+					code: "APPROVAL_VOID",
+					reason
+				};
+				return {
+					...current,
+					state: "revoked",
+					reason
+				};
+			};
+			if (!current.download || downloadDigest(current.download) !== current.digest) return voidWith("the question does not describe the download it is bound to");
+			if (digest !== current.digest) throw refuseDownload("USAGE", `${downloadDrift(current.download, live)}; the question is still open`, current, "Call again with the same arguments the question was asked with, and its choice id. If the files themselves changed, make the download again without an answer, and show the person the new question.");
+			const refusal = downloadClaimRefusal(current, options.policy ?? "chat", options.pendingHint);
+			if (refusal !== null) throw refusal;
+			return {
+				...current,
+				state: "used"
+			};
+		});
+		const failed = failure;
+		if (failed) throw refuseDownload(failed.code, failed.reason, result);
+		await this.#markClaimed(result);
+		return result;
+	}
 	/** Records the outcome of the one send attempt. */
 	async complete(approvalId, outcome) {
 		return this.#transition(approvalId, (current) => {
@@ -3425,6 +3668,27 @@ function packageFrom(server) {
 	const line = [server.command, ...server.args].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
+/**
+* The environment a child process is started with: `env` as it is, and on Windows also
+* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
+* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
+* when `PATH` says to.
+*/
+function childEnvironment(env = process.env, platform = process.platform) {
+	if (platform !== "win32") return env;
+	return {
+		...env,
+		NoDefaultCurrentDirectoryInExePath: "1"
+	};
+}
+/**
+* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
+* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
+* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
+*/
+function absoluteSearchPath(entries, platform = process.platform) {
+	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
+}
 /** The install options that pin a server to one account: the generic one, and Gmail's and Slack's own names. */
 const PIN_OPTIONS = Object.freeze([
 	"account",
@@ -3480,9 +3744,14 @@ function clientCliSearch(env) {
 /**
 * The first of `directories` that holds an executable `name`. PATH is read by the caller, once: a test that counts
 * how often the installer looks at PATH counts exactly the looks it means.
+*
+* Only absolute directories are looked in, whoever the caller. An empty entry of PATH is the current folder to a
+* shell, and a relative one is read against it: the `node`, `npx` or `claude` found there — and then run, or written
+* into a client's config to be run — would be whatever is in the folder this was started from, which is where a
+* download may have saved a stranger's file.
 */
 async function executableIn(name, directories, env) {
-	const paths = directories.filter(Boolean);
+	const paths = absoluteSearchPath(directories);
 	const extensions = process.platform === "win32" ? (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";") : [""];
 	for (const directory of paths) for (const extension of extensions) {
 		const candidate = join(directory, name + extension.toLowerCase());
@@ -3654,13 +3923,20 @@ async function findNpmCli() {
 	} catch {}
 	throw new CommsError("CONFIG", "npm could not be found next to this Node installation", { hint: "Install with `--launcher npx` instead, which runs the published package directly." });
 }
+/**
+* A command run to its end. Its environment is this process's, and on Windows also tells it never to take a program
+* from its current folder: `npm` and a client's command both start programs of their own by name.
+*/
 function run(command, args) {
 	return new Promise((resolvePromise, reject) => {
-		const child = spawn(command, args, { stdio: [
-			"ignore",
-			"ignore",
-			"pipe"
-		] });
+		const child = spawn(command, args, {
+			stdio: [
+				"ignore",
+				"ignore",
+				"pipe"
+			],
+			env: childEnvironment(process.env)
+		});
 		let stderr = "";
 		child.stderr?.on("data", (chunk) => {
 			stderr += String(chunk);
@@ -3886,14 +4162,20 @@ function installCommand$1(product, options, name, extra = []) {
 	words.push(...extra);
 	return words.map((word) => /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`).join(" ");
 }
-/** A command's exit status and what it printed, kept here and never shown: codex prints an entry's env. */
+/**
+* A command's exit status and what it printed, kept here and never shown: codex prints an entry's env. Started as
+* `run` starts one, so that on Windows it takes no program from its current folder either.
+*/
 function capture$1(command, args) {
 	return new Promise((resolvePromise, reject) => {
-		const child = spawn(command, args, { stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		] });
+		const child = spawn(command, args, {
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: childEnvironment(process.env)
+		});
 		let stdout = "";
 		let stderr = "";
 		child.stdout?.on("data", (chunk) => {
@@ -4346,11 +4628,27 @@ async function verifyEntry(entry, product) {
 		await client.close().catch(() => void 0);
 	}
 }
-/** Every running process's command line, or null when they cannot be listed. */
-async function runningCommandLines() {
+/** Where `ps` is looked for, in order: the system's own directories, never PATH. */
+const PS_DIRECTORIES = ["/bin", "/usr/bin"];
+/**
+* Every running process's command line, or null when they cannot be listed.
+*
+* `ps` is started by its full path, `/bin/ps` or else `/usr/bin/ps`, never by its bare name: a name is looked up, and
+* a lookup can reach the folder this was started from — where a download may have saved a stranger's `ps`, which would
+* then run, and whose answer would decide what is deleted. With neither there, the processes cannot be listed.
+*
+* `directories` and `list` are for tests: where to look for `ps`, and what runs the one found.
+*/
+async function runningCommandLines(options = {}) {
 	if (process.platform === "win32") return null;
+	const ps = await executableIn("ps", options.directories ?? PS_DIRECTORIES, process.env);
+	if (ps === null) return null;
+	return (options.list ?? commandLinesFrom)(ps);
+}
+/** What `ps` at this path says is running: one command line per process, or null when it fails. */
+function commandLinesFrom(ps) {
 	return new Promise((resolvePromise) => {
-		execFile("ps", [
+		execFile(ps, [
 			"-A",
 			"-o",
 			"args="
@@ -5193,6 +5491,7 @@ async function claimChange(core, approvalId, expect, options) {
 async function changeRecord(core, approvalId) {
 	const record = await core.approvals.get(approvalId);
 	if (!record) throw new CommsError("NOT_FOUND", `no approval ${approvalId}`, { hint: "Prepare the change again; an approval expires ten minutes after it is made." });
+	if (approvalKind(record) === "download") throw new CommsError("USAGE", `${approvalId} is a question about where to save files, not a configuration change`, { hint: DOWNLOAD_ANSWER_HINT });
 	if (approvalKind(record) !== "change") throw new CommsError("USAGE", `approval ${approvalId} is for a send, not a configuration change`, { hint: `Approve it with the command that prepared it: ${channelApproveCommands({ sending: true })}.` });
 	if (!record.change || changeDigest(record.change) !== record.digest) throw new CommsError("BAD_DATA", "this approval does not describe the change it is bound to", {
 		hint: "Nothing was approved. Prepare the change again.",
@@ -6135,11 +6434,14 @@ async function npmLatestVersion(packageName, options) {
 	if (typeof latest !== "string") throw new Error(`${where} names no \`latest\` release`);
 	return latest;
 }
-/** A command's exit status and output, given up on after `timeoutMs`. */
+/**
+* A command's exit status and output, given up on after `timeoutMs`. npm starts programs of its own by name — scripts,
+* `node-gyp`, a shell — so on Windows it is told never to take one from its current folder.
+*/
 function capture(args, env, timeoutMs) {
 	return new Promise((resolve, reject) => {
 		const child = spawn(process.execPath, args, {
-			env,
+			env: childEnvironment(env),
 			stdio: [
 				"ignore",
 				"pipe",
@@ -6223,7 +6525,7 @@ async function npmInstallGlobal(env, spec) {
 	}
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.9.0";
+const VERSION = "0.11.0";
 /**
 * Registering, pruning and listing the MCP servers of every channel, from the core.
 *
@@ -6478,7 +6780,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.9.0"
+		version: "0.11.0"
 	};
 	const product = {
 		packageName,
@@ -7577,6 +7879,10 @@ const SEND_LOOKUP = Object.freeze({
 	lookup: true
 });
 Object.freeze({ kind: "change" });
+Object.freeze({
+	kind: "download",
+	argument: "choiceId"
+});
 /**
 * Whether a call claims an approval the person already gave (§2): an approval this machine's approval store holds —
 * every channel keeps its approvals there — that is still waiting to be used, pending or approved, and of the kind the
@@ -7628,7 +7934,8 @@ function updateToolGate(options) {
 			surface: "server"
 		});
 		if (pending === null) return null;
-		if (await claimsApproval(options.core, args.approvalId, options.approvals?.[tool])) return null;
+		const claim = options.approvals?.[tool];
+		if (await claimsApproval(options.core, args[claim?.argument ?? "approvalId"], claim)) return null;
 		return stoppedCall(pending, {
 			server: options.server,
 			tool
@@ -7693,9 +8000,10 @@ function commandPathOf(command) {
 }
 /**
 * The approvals a Commander command claims: its `--approval`, the `--mcp-approval` Gmail's `setup` carries beside it,
-* and an argument named `approvalId` — `agent-gmail send cancel <approvalId>`, `agent-resend send execute
-* <approvalId>`, the commands whose tools take it as `approvalId`. What the gate hands `claimsApproval`, as a tool
-* call's `approvalId` is handed it. Commander has read the arguments by the time a `preAction` hook runs.
+* the `--choice` a download carries its question's id in, and an argument named `approvalId` — `agent-gmail send
+* cancel <approvalId>`, `agent-resend send execute <approvalId>`, the commands whose tools take it as `approvalId`.
+* What the gate hands `claimsApproval`, as a tool call's `approvalId` is handed it. Commander has read the arguments
+* by the time a `preAction` hook runs.
 */
 function approvalsOf(command) {
 	const options = command.opts();
@@ -7703,6 +8011,7 @@ function approvalsOf(command) {
 	return [
 		options.approval,
 		options.mcpApproval,
+		options.choice,
 		...named
 	];
 }
@@ -7849,7 +8158,7 @@ async function askLine(streams, question) {
 	}
 }
 //#endregion
-//#region ../core/dist/tool-arguments-Cx3Of7xZ.mjs
+//#region ../core/dist/tool-arguments-5aAzuZnA.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -7867,7 +8176,7 @@ const TARGET = "draft-2020-12";
 * in, because what it asks the registry with is each server's own — and WhatsApp's is nothing at all. A call it
 * answers reaches nothing, as a refused one does.
 */
-function strictToolArguments(server, refuse, gate) {
+function strictToolArguments(server, refuse, gate, retired = {}) {
 	const target = server;
 	if (typeof target.registerTool !== "function") throw new Error("strictToolArguments needs an MCP server: this has no registerTool");
 	if (target[APPLIED]) return;
@@ -7883,7 +8192,7 @@ function strictToolArguments(server, refuse, gate) {
 			inputSchema: passThrough(schema)
 		}, async (input, context) => {
 			const parsed = await schema.safeParseAsync(input ?? {});
-			if (!parsed.success) return refuse(refusal(name, published, input, parsed.error.issues));
+			if (!parsed.success) return refuse(refusal(name, published, input, parsed.error.issues, retired[name] ?? {}));
 			const stopped = gate ? await gate(name, parsed.data) : null;
 			if (stopped !== null) return stopped;
 			return declared ? handler(parsed.data, context) : handler(context);
@@ -7927,12 +8236,22 @@ function passThrough(schema) {
 	} };
 }
 /** A USAGE refusal naming what was wrong and what the tool takes. */
-function refusal(tool, published, input, issues) {
+function refusal(tool, published, input, issues, retired) {
 	const properties = published.properties ?? {};
 	const takes = Object.keys(properties);
 	const required = new Set(published.required ?? []);
 	const signature = takes.length === 0 ? `${tool} takes no arguments.` : `${tool} takes ${spoken(takes.map((key) => required.has(key) ? `\`${key}\` (required)` : `\`${key}\``), "and")}.`;
 	const unknown = issues.flatMap((issue) => issue.code === "unrecognized_keys" && issue.path.length === 0 ? issue.keys : []);
+	const removed = unknown.filter((key) => Object.hasOwn(retired, key));
+	if (removed.length > 0) return new CommsError("USAGE", `${tool} no longer takes ${spoken(removed.map((key) => `\`${key}\``), "or")}`, {
+		hint: removed.map((key) => retired[key]).join(" "),
+		details: {
+			tool,
+			retired: removed,
+			unknown,
+			takes
+		}
+	});
 	if (unknown.length > 0) return new CommsError("USAGE", `${tool} does not take ${spoken(unknown.map((key) => `\`${key}\``), "or")}`, {
 		hint: takes.length === 0 ? signature : `${signature} Leave out anything else.`,
 		details: {
@@ -17629,7 +17948,7 @@ strictObject({
 		if (manifest.skills.contract !== `skills/_shared/contract-${family}.md`) issue(["skills", "contract"], `skills/_shared/contract-${family}.md: a skill's contract is chosen by its prefix`);
 	}
 });
-const WINDOWS_RESERVED = /^(con|prn|aux|nul|com[0-9]|lpt[0-9])$/i;
+const WINDOWS_RESERVED = /^(con|prn|aux|nul|conin\$|conout\$|com[0-9¹²³]|lpt[0-9¹²³])$/i;
 const UNSAFE_FILENAME_CHARS = /[/\\\u0000-\u001f\u007f<>:"|?*]/g;
 /** Truncates a string to at most `maxBytes` UTF-8 bytes without splitting a code point. */
 function truncateBytes(value, maxBytes) {
@@ -17653,7 +17972,7 @@ function safeFilename(name, maxBytes = 255, fallback = "attachment") {
 	cleaned = cleaned.replace(/^[.\s]+/, "").replace(/[.\s]+$/, "");
 	if (cleaned === "") cleaned = fallback;
 	const extension = extname(cleaned);
-	if (WINDOWS_RESERVED.test(cleaned.split(".")[0] ?? cleaned)) cleaned = `_${cleaned}`;
+	if (WINDOWS_RESERVED.test((cleaned.split(".")[0] ?? cleaned).trimEnd())) cleaned = `_${cleaned}`;
 	if (Buffer.byteLength(cleaned, "utf8") <= maxBytes) return cleaned;
 	const keptExtension = Buffer.byteLength(extension, "utf8") < maxBytes / 2 ? extension : "";
 	return truncateBytes(keptExtension ? cleaned.slice(0, -keptExtension.length) : cleaned, maxBytes - Buffer.byteLength(keptExtension, "utf8")) + keptExtension;
@@ -17708,7 +18027,7 @@ async function createUniqueFile(directory, filename) {
 			throw error;
 		}
 	}
-	throw new CommsError("BAD_DATA", `could not find a free file name for ${filename} in ${directory}`);
+	throw new CommsError("BAD_DATA", `could not find a free file name in ${directory}: the name and every numbered one after it are taken`);
 }
 /**
 * Default places attachments may never be read from, whatever the allowed roots say. `~/.*` means every dot-entry
@@ -17749,7 +18068,7 @@ async function checkAttachable(path, policy) {
 		throw new CommsError("NOT_FOUND", `attachment not found: ${path}`);
 	}
 	if (!(await stat(real)).isFile()) throw new CommsError("BAD_DATA", `not a regular file: ${path}`);
-	if (!(await Promise.all(policy.roots.map((root) => realOrResolved(expandHome(root, home))))).some((root) => isInside(real, root))) throw new CommsError("BAD_DATA", `attachments must come from an allowed folder; ${path} is outside them`, { hint: "Move the file into an allowed folder, or add its folder to defaults.attachRoots with the CLI." });
+	if (!(await Promise.all(policy.roots.map((root) => realOrResolved(expandHome(root, home))))).some((root) => isInside(real, root))) throw new CommsError("BAD_DATA", `attachments must come from an allowed folder; ${path} is outside them`, { hint: "Copy the file under your home folder — not into one of its hidden folders — and name the copy instead." });
 	const name = basename(real);
 	const homeDir = await realOrResolved(home ?? (await import("node:os")).homedir());
 	for (const entry of policy.deny) {

package/dist/{server-Cr9ZXT1i.mjs → server-DYhcD72L.mjs}

@@ -1,4 +1,4 @@
-import { A as CHANGE_POLICIES, C as policyChange, E as removeAccountChange, G as checkForUpdates, I as CommsError, M as SEND_POLICIES, O as showAccount, P as strictToolArguments, R as SEND_LOOKUP, S as policyApprovalRefusal, T as policyWanted, W as changeToolResult, X as gatedChange, _ as runDoctor, _t as VERSION, b as listAccounts, c as downloadReceived, ct as toCommsError, d as listReceived, dt as updateToolGate, f as listScheduled, g as showSentEmail, h as showReceived, i as prepareSend, j as MODES, k as ResendContext, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, p as listSentEmails, s as cancelScheduledChange, tt as refuseUnclaimedApproval, u as listDomains, w as policyReport } from "./send-D9aAM9kv.mjs";
+import { A as CHANGE_POLICIES, C as policyChange, E as removeAccountChange, G as checkForUpdates, I as CommsError, M as SEND_POLICIES, O as showAccount, P as strictToolArguments, R as SEND_LOOKUP, S as policyApprovalRefusal, T as policyWanted, W as changeToolResult, X as gatedChange, _ as runDoctor, _t as VERSION, b as listAccounts, c as downloadReceived, ct as toCommsError, d as listReceived, dt as updateToolGate, f as listScheduled, g as showSentEmail, h as showReceived, i as prepareSend, j as MODES, k as ResendContext, l as getMetrics, m as listSuppressions, n as executeSend, o as sendStatus, p as listSentEmails, s as cancelScheduledChange, tt as refuseUnclaimedApproval, u as listDomains, w as policyReport } from "./send-CgN2O8kG.mjs";
 import { S as union, c as boolean, g as object, h as number, s as array, x as string } from "./schemas-DiGKNDNq.mjs";
 import { t as McpServer } from "./mcp-DXXb3Vv3-Co5BzjYe.mjs";
 //#region src/mcp/server.ts

package/dist/{stdio-entry-F1YLLUXd.mjs → stdio-entry-u9u7Mn18.mjs}

@@ -1,4 +1,4 @@
-import { t as createResendMcpServer } from "./server-Cr9ZXT1i.mjs";
+import { t as createResendMcpServer } from "./server-DYhcD72L.mjs";
 //#region src/mcp/stdio-entry.ts
 /**
 * Starting the stdio server. On stdio, **stdout is the protocol**: one stray `console.log` corrupts the stream, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcomms/resend",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Resend for coding agents: read domains, sent and received mail, metrics and suppressions, and send mail that nothing sends without a person's approval of exactly what goes out.",
   "type": "module",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "@modelcontextprotocol/server": "^2.0.0",
     "commander": "^15.0.0",
     "zod": "^4.6.5",
-    "@agentcomms/core": "0.9.0"
+    "@agentcomms/core": "0.11.0"
   },
   "publishConfig": {
     "access": "public"
@@ -94,5 +94,5 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --test --test-timeout=600000 \"test/**/*.test.ts\""
   },
-  "gitHead": "7db27256fda2e40fcc2a4958c50bf77bff871ef1"
+  "gitHead": "bcc1392f8380dbf523a910a87de652a18faead6f"
 }