@agentcomms/whatsapp 0.11.0 → 0.12.1

package/dist/cli.mjs

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { $ as renderPrune, A as CommsError, B as colorEnabled, C as checkStorePath, F as approvalsOf, G as installExitStatus, H as escapeForDisplay, I as approveChangeAtTerminal, J as nameAvailable, K as isCommsError, L as canPrompt, M as absoluteSearchPath, N as agentMarker, O as CHANNELS, P as approvalKind, Q as renderInstall, R as channelManifest, S as storeIdentity, T as expandSource, U as exemptFromUpdateGate, V as commandPathOf, W as gatedChangeAtTerminal, X as openCore, Y as nameShapeProblem, Z as paint, _ as chatRefOf, a as listChats, at as updateGateAtTerminal, b as requireAccount, c as Presenter, ct as withFileLock, d as draftMessage, et as runCommand, f as Visibility, g as requireSupportedNode, h as WhatsAppIndex, i as CHAT_KINDS, it as truncateDisplay, j as EXIT_CODES, k as CHANNEL_SERVERS, l as innerText, lt as writeResult, m as WhatsAppContext, n as whatsappStatus, nt as serverPruneChange, o as readChat, p as listKey, q as lookupName, r as probeStore, s as searchMessages, st as windowsSystemProgram, t as syncAccount, tt as serverInstallChange, ut as VERSION, v as PLATFORM, w as defaultStorePath, x as requireNamedConfig, y as newWhatsAppAccount, z as childEnvironment } from "./sync-CinH_TIY.mjs";
+import { $ as renderPrune, A as CommsError, B as colorEnabled, C as checkStorePath, F as approvalsOf, G as installExitStatus, H as escapeForDisplay, I as approveChangeAtTerminal, J as nameAvailable, K as isCommsError, L as canPrompt, M as absoluteSearchPath, N as agentMarker, O as CHANNELS, P as approvalKind, Q as renderInstall, R as channelManifest, S as storeIdentity, T as expandSource, U as exemptFromUpdateGate, V as commandPathOf, W as gatedChangeAtTerminal, X as openCore, Y as nameShapeProblem, Z as paint, _ as chatRefOf, a as listChats, at as updateGateAtTerminal, b as requireAccount, c as Presenter, ct as withFileLock, d as draftMessage, et as runCommand, f as Visibility, g as requireSupportedNode, h as WhatsAppIndex, i as CHAT_KINDS, it as truncateDisplay, j as EXIT_CODES, k as CHANNEL_SERVERS, l as innerText, lt as writeResult, m as WhatsAppContext, n as whatsappStatus, nt as serverPruneChange, o as readChat, p as listKey, q as lookupName, r as probeStore, s as searchMessages, st as windowsSystemProgram, t as syncAccount, tt as serverInstallChange, ut as VERSION, v as PLATFORM, w as defaultStorePath, x as requireNamedConfig, y as newWhatsAppAccount, z as childEnvironment } from "./sync-BiO86eEl.mjs";
 import { rm } from "node:fs/promises";
 import path, { delimiter, join } from "node:path";
+import fs, { accessSync, constants as constants$1 } from "node:fs";
 import childProcess, { spawn } from "node:child_process";
 import { stripVTControlCharacters } from "node:util";
-import fs, { accessSync, constants as constants$1 } from "node:fs";
 import process$1 from "node:process";
 import { EventEmitter } from "node:events";
 //#region ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
@@ -3534,7 +3534,7 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 		ran = true;
 		exitCode = await runCommand(output(), async () => {
 			requireSupportedNode();
-			const { startWhatsAppStdioServer } = await import("./stdio-entry-r40LJtFu.mjs");
+			const { startWhatsAppStdioServer } = await import("./stdio-entry-BznXKJaK.mjs");
 			await startWhatsAppStdioServer({
 				env,
 				...flags.account ? { account: String(flags.account) } : {}

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { u as composeDraft, ut as VERSION } from "./sync-CinH_TIY.mjs";
-import { t as createWhatsAppMcpServer } from "./server-BLF6Xumr.mjs";
+import { u as composeDraft, ut as VERSION } from "./sync-BiO86eEl.mjs";
+import { t as createWhatsAppMcpServer } from "./server-BHwKQeXq.mjs";
 //#region src/index.ts
 /**
 * The library entry of `@agentcomms/whatsapp`.

package/dist/{server-BLF6Xumr.mjs → server-BHwKQeXq.mjs}

@@ -1,4 +1,4 @@
-import { D as strictToolArguments, E as UNTRUSTED_NOTICE, a as listChats, d as draftMessage, i as CHAT_KINDS, m as WhatsAppContext, n as whatsappStatus, o as readChat, ot as updateToolGate, rt as toCommsError, s as searchMessages, t as syncAccount, ut as VERSION } from "./sync-CinH_TIY.mjs";
+import { D as strictToolArguments, E as UNTRUSTED_NOTICE, a as listChats, d as draftMessage, i as CHAT_KINDS, m as WhatsAppContext, n as whatsappStatus, o as readChat, ot as updateToolGate, rt as toCommsError, s as searchMessages, t as syncAccount, ut as VERSION } from "./sync-BiO86eEl.mjs";
 import { c as boolean, h as number, x as string } from "./schemas-DiGKNDNq.mjs";
 import { t as McpServer } from "./mcp-DXXb3Vv3-Co5BzjYe.mjs";
 //#region src/mcp/server.ts

package/dist/{stdio-entry-r40LJtFu.mjs → stdio-entry-BznXKJaK.mjs}

@@ -1,4 +1,4 @@
-import { t as createWhatsAppMcpServer } from "./server-BLF6Xumr.mjs";
+import { t as createWhatsAppMcpServer } from "./server-BHwKQeXq.mjs";
 //#region src/mcp/stdio-entry.ts
 /**
 * Starting the stdio server. On stdio, stdout is the protocol, so the console is redirected to stderr first — the

package/dist/{sync-CinH_TIY.mjs → sync-BiO86eEl.mjs}

@@ -5,15 +5,15 @@ import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { homedir, platform, userInfo } from "node:os";
+import { constants as constants$1 } from "node:fs";
 import { execFile, spawn } from "node:child_process";
 import { styleText } from "node:util";
-import { constants as constants$1 } from "node:fs";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.11.0";
+const VERSION$1 = "0.12.1";
 //#endregion
-//#region ../core/dist/update-gate-BMcLWU3V.mjs
+//#region ../core/dist/update-check-Ba6REc8M.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -951,74 +951,60 @@ function connectMailboxCommand() {
 	return mail ? `${mail.binary} inbox add` : void 0;
 }
 /**
-* The grammar of an account name in version 2 of the config: `<organisation>/<platform>[-<qualifier>]`.
-*
-* `cue/gmail` is the CUE++ mailbox, `cue/slack` the CUE++ workspace, `wf/gmail-tech` a second Wherefrom mailbox. The
-* first half says who an account belongs to and the second what it is — and the schema checks the second half against
-* the account itself, so a name cannot claim to be a Slack workspace while naming a mailbox.
-*
-* Kept apart from `config.ts`, with no imports, so the schema and the helpers built on it can both depend on it
-* without depending on each other.
-*/
-/**
-* Organisation names Windows cannot use as a directory.
-*
-* The organisation becomes a folder — downloads land in `downloads/cue/gmail/…` — and `con`, `nul` and the rest are
-* device names on Windows in every directory, with or without an extension. Refused here rather than discovered the
-* first time somebody on Windows saves an attachment.
+* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
+* and the preview renderer (which makes them visible), so the two can never disagree.
 */
-const WINDOWS_RESERVED = [
-	"con",
-	"prn",
-	"aux",
-	"nul",
-	...range$1("com"),
-	...range$1("lpt")
+/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
+const INVISIBLE_RANGES = [
+	[173, 173],
+	[847, 847],
+	[1564, 1564],
+	[4447, 4448],
+	[6068, 6069],
+	[6155, 6159],
+	[8203, 8207],
+	[8232, 8233],
+	[8234, 8238],
+	[8288, 8292],
+	[8294, 8303],
+	[12644, 12644],
+	[65024, 65039],
+	[65279, 65279],
+	[65440, 65440],
+	[917504, 917631]
 ];
-function range$1(prefix) {
-	return Array.from({ length: 9 }, (_, index) => `${prefix}${index + 1}`);
+function isInvisible(codePoint) {
+	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
+	return false;
 }
-const ORG = "[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?";
-const PLATFORM$1 = "[a-z][a-z0-9]{0,15}";
 /**
-* The whole grammar as one expression, so a record key can be checked by the schema without a second pass.
-*
-* Segments never start or end with a hyphen, and the character set is `[a-z0-9/-]` and nothing else: no `.`, so no
-* `..`; no whitespace, no controls, no upper case, nothing that looks like something else.
+* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
+* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
 */
-const NAME_PATTERN = new RegExp(`^(?!(?:${WINDOWS_RESERVED.join("|")})/)(${ORG})/(${PLATFORM$1})(?:-([a-z0-9](?:[a-z0-9-]{0,14}[a-z0-9])?))?$`);
-/** A platform word on its own — `gmail`, `slack` — which is also a channel's word in its manifest. */
-const PLATFORM_PATTERN = new RegExp(`^${PLATFORM$1}$`);
-const NAME_MESSAGE = "names look like organisation/platform, optionally with a qualifier: cue/gmail, wf/gmail-tech, cue/slack";
-/** The three parts of a valid name, or null for anything the grammar refuses. */
-function parseName(name) {
-	const match = NAME_PATTERN.exec(name);
-	if (!match) return null;
-	const [, org = "", platform = "", qualifier] = match;
-	return qualifier === void 0 ? {
-		org,
-		platform
-	} : {
-		org,
-		platform,
-		qualifier
-	};
+function isControl(codePoint) {
+	if (codePoint === 9 || codePoint === 10) return false;
+	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function isDangerous(codePoint) {
+	return isControl(codePoint) || isInvisible(codePoint);
 }
 /**
-* Why a name is refused, in words a person can act on — or null when it is fine.
+* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
+* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
 *
-* `platform` is what the account actually is. Checked here as well as in the schema, so the error arrives when the
-* name is proposed rather than as a refused config write after a sign-in has already been spent.
+* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
+* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
+* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
 */
-function nameShapeProblem(name, platform) {
-	const parsed = parseName(name);
-	if (!parsed) {
-		const org = name.split("/")[0] ?? "";
-		if (WINDOWS_RESERVED.includes(org)) return `"${org}" cannot be an organisation name: Windows reserves it, and the organisation becomes a folder`;
-		return `"${name}" is not a valid name: it should be the organisation, a slash, then ${platform} — for example acme/${platform}, or acme/${platform}-support for a second one`;
-	}
-	if (parsed.platform !== platform) return `"${name}" ends in /${parsed.platform}, but this is a ${platform} account`;
-	return null;
+function stripInvisible(text) {
+	let removed = 0;
+	let out = "";
+	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
+	else out += char;
+	return {
+		text: out,
+		removed
+	};
 }
 const APP_DIR_NAME = "agent-communications";
 /**
@@ -1082,6 +1068,23 @@ function expandHome(path, home = homedir(), joinPaths = join) {
 	return path;
 }
 /**
+* A path as a preview shows it: the home at its start written `~`, the way a person reads and types it. The inverse of
+* `expandHome`, and like it, nothing else is touched. Case is ignored on Windows, whose paths are not case-sensitive.
+*/
+function shortenHome(path, home, platform = process.platform) {
+	if (!home) return path;
+	const same = (a, b) => platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+	let end = home.length;
+	while (end > 0 && (home[end - 1] === "/" || home[end - 1] === "\\")) end -= 1;
+	const root = home.slice(0, end);
+	if (same(path, root)) return "~";
+	for (const separator of platform === "win32" ? ["\\", "/"] : ["/"]) {
+		const prefix = `${root}${separator}`;
+		if (path.length > prefix.length && same(path.slice(0, prefix.length), prefix)) return `~${separator}${path.slice(prefix.length)}`;
+	}
+	return path;
+}
+/**
 * The user's home directory, read from an environment.
 *
 * Windows does not set `HOME`; it sets `USERPROFILE`. Call sites that wrote `env.HOME ?? ''` and handed the result to
@@ -1097,6 +1100,88 @@ function homeDirectory(env = process.env) {
 	return env.HOME || env.USERPROFILE || homedir();
 }
 /**
+* Whether a folder, as written, says where it is on its own: from the home (`~`), or absolute — and on Windows with its
+* drive (`C:\…`) or share (`\\server\share\…`). Windows calls `\outgoing` absolute, but it is on whichever drive is
+* current when it is read, and `C:outgoing` is relative to that drive's current folder; either would move with the
+* process that reads it. A folder in the configuration that does not name its place — written by hand before 0.12.0,
+* say — allows nothing, and `agentcomms attach` takes none (#45).
+*/
+function namesItsPlace(path, platform = process.platform) {
+	if (path === "~" || path.startsWith("~/") || path.startsWith("~\\")) return true;
+	if (platform === "win32") return /^[A-Za-z]:[\\/]/.test(path) || /^[\\/]{2}[^\\/?.][^\\/]*[\\/][^\\/]+/.test(path);
+	return isAbsolute(path);
+}
+/**
+* The grammar of an account name in version 2 of the config: `<organisation>/<platform>[-<qualifier>]`.
+*
+* `cue/gmail` is the CUE++ mailbox, `cue/slack` the CUE++ workspace, `wf/gmail-tech` a second Wherefrom mailbox. The
+* first half says who an account belongs to and the second what it is — and the schema checks the second half against
+* the account itself, so a name cannot claim to be a Slack workspace while naming a mailbox.
+*
+* Kept apart from `config.ts`, with no imports, so the schema and the helpers built on it can both depend on it
+* without depending on each other.
+*/
+/**
+* Organisation names Windows cannot use as a directory.
+*
+* The organisation becomes a folder — downloads land in `downloads/cue/gmail/…` — and `con`, `nul` and the rest are
+* device names on Windows in every directory, with or without an extension. Refused here rather than discovered the
+* first time somebody on Windows saves an attachment.
+*/
+const WINDOWS_RESERVED = [
+	"con",
+	"prn",
+	"aux",
+	"nul",
+	...range$1("com"),
+	...range$1("lpt")
+];
+function range$1(prefix) {
+	return Array.from({ length: 9 }, (_, index) => `${prefix}${index + 1}`);
+}
+const ORG = "[a-z0-9](?:[a-z0-9-]{0,30}[a-z0-9])?";
+const PLATFORM$1 = "[a-z][a-z0-9]{0,15}";
+/**
+* The whole grammar as one expression, so a record key can be checked by the schema without a second pass.
+*
+* Segments never start or end with a hyphen, and the character set is `[a-z0-9/-]` and nothing else: no `.`, so no
+* `..`; no whitespace, no controls, no upper case, nothing that looks like something else.
+*/
+const NAME_PATTERN = new RegExp(`^(?!(?:${WINDOWS_RESERVED.join("|")})/)(${ORG})/(${PLATFORM$1})(?:-([a-z0-9](?:[a-z0-9-]{0,14}[a-z0-9])?))?$`);
+/** A platform word on its own — `gmail`, `slack` — which is also a channel's word in its manifest. */
+const PLATFORM_PATTERN = new RegExp(`^${PLATFORM$1}$`);
+const NAME_MESSAGE = "names look like organisation/platform, optionally with a qualifier: cue/gmail, wf/gmail-tech, cue/slack";
+/** The three parts of a valid name, or null for anything the grammar refuses. */
+function parseName(name) {
+	const match = NAME_PATTERN.exec(name);
+	if (!match) return null;
+	const [, org = "", platform = "", qualifier] = match;
+	return qualifier === void 0 ? {
+		org,
+		platform
+	} : {
+		org,
+		platform,
+		qualifier
+	};
+}
+/**
+* Why a name is refused, in words a person can act on — or null when it is fine.
+*
+* `platform` is what the account actually is. Checked here as well as in the schema, so the error arrives when the
+* name is proposed rather than as a refused config write after a sign-in has already been spent.
+*/
+function nameShapeProblem(name, platform) {
+	const parsed = parseName(name);
+	if (!parsed) {
+		const org = name.split("/")[0] ?? "";
+		if (WINDOWS_RESERVED.includes(org)) return `"${org}" cannot be an organisation name: Windows reserves it, and the organisation becomes a folder`;
+		return `"${name}" is not a valid name: it should be the organisation, a slash, then ${platform} — for example acme/${platform}, or acme/${platform}-support for a second one`;
+	}
+	if (parsed.platform !== platform) return `"${name}" ends in /${parsed.platform}, but this is a ${platform} account`;
+	return null;
+}
+/**
 * Whether this release may write version 2 of the config.
 *
 * Not while any reader that shares the file might still be one that cannot read it. So the release that teaches every
@@ -1671,8 +1756,17 @@ const POLICY_RANK$1 = {
 * user a consent prompt for a change that is not one. Linux is case-sensitive, so case is kept.
 */
 function normalisePath(path) {
-	const expanded = withoutTrailingSeparators(resolve(expandHome(path.trim(), homedir())));
-	return platform() === "darwin" || platform() === "win32" ? expanded.toLowerCase() : expanded;
+	return comparablePath(resolve(expandHome(path.trim(), homedir())));
+}
+/**
+* An absolute path in the form two paths are compared in here: no trailing separator, and case folded on macOS and
+* Windows, whose filesystems are case-insensitive by default (see `normalisePath`). The top of a disk keeps its
+* separator — `/`, `C:\` — so it is not read as no path at all.
+*/
+function comparablePath(absolute) {
+	const stripped = withoutTrailingSeparators(absolute);
+	const kept = stripped === "" || /^[A-Za-z]:$/.test(stripped) ? absolute.slice(0, stripped.length + 1) : stripped;
+	return platform() === "darwin" || platform() === "win32" ? kept.toLowerCase() : kept;
 }
 /**
 * The path with any separators at its end removed. A loop, not `/[/\\]+$/`: that pattern backtracks over every run of
@@ -1687,9 +1781,14 @@ function withoutTrailingSeparators(path) {
 function holdsSecrets(config) {
 	return Object.values(config.clients).some((client) => Boolean(client.secretRef)) || Object.values(config.inboxes).some((inbox) => Boolean(inbox.secretRef)) || Object.values(config.accounts).some((account) => Boolean(account.secretRef));
 }
-/** True when `candidate` is the same directory as `parent`, or inside it. Both may be unset. */
+/**
+* True when `candidate` is the same directory as `parent`, or inside it. Both may be unset. Both are compared as
+* written, so both have to be in one form first: `normalisePath`, or `comparablePath` of a real path. A parent that is
+* the top of a disk — `/`, `c:\` — holds everything on it.
+*/
 function isInsideDirectory(candidate, parent) {
 	if (!candidate || !parent) return false;
+	if (parent.endsWith("/") || parent.endsWith("\\")) return candidate.startsWith(parent);
 	return candidate === parent || candidate.startsWith(`${parent}/`) || candidate.startsWith(`${parent}\\`);
 }
 /**
@@ -1762,10 +1861,11 @@ function classifyChange(before, after) {
 	if (b.riskEscalation && !a.riskEscalation) loosen("defaults.riskEscalation", b.riskEscalation, a.riskEscalation);
 	if (updateCheckSetting(before) === "on" && updateCheckSetting(after) === "off") loosen("defaults.updateCheck", updateCheckSetting(before), updateCheckSetting(after));
 	if (a.sendCaps.perHour > b.sendCaps.perHour || a.sendCaps.perDay > b.sendCaps.perDay) loosen("defaults.sendCaps", b.sendCaps, a.sendCaps);
-	const roots = (list) => new Set(list.map(normalisePath));
-	const before_roots = roots(b.attachRoots);
+	const roots = (list) => new Set(list.map((path) => comparablePath(resolve(expandHome(path, homedir())))));
+	const readRoots = (list) => roots(list.filter((root) => namesItsPlace(root)));
+	const before_roots = readRoots(b.attachRoots);
 	const after_deny = roots(a.attachDeny);
-	if ([...roots(a.attachRoots)].some((root) => !before_roots.has(root))) loosen("defaults.attachRoots", b.attachRoots, a.attachRoots);
+	if ([...readRoots(a.attachRoots)].some((root) => !before_roots.has(root))) loosen("defaults.attachRoots", b.attachRoots, a.attachRoots);
 	if ([...roots(b.attachDeny)].some((deny) => !after_deny.has(deny))) loosen("defaults.attachDeny", b.attachDeny, a.attachDeny);
 	const downloadsBefore = b.downloadsDir === void 0 ? void 0 : normalisePath(b.downloadsDir);
 	const downloadsAfter = a.downloadsDir === void 0 ? void 0 : normalisePath(a.downloadsDir);
@@ -3626,7 +3726,7 @@ async function installManagedRuntime(context, product, version) {
 		private: true
 	}, null, 2)}\n`);
 	const npmCli = await findNpmCli();
-	await run(process.execPath, [
+	await run(context.env, process.execPath, [
 		npmCli,
 		"install",
 		"--prefix",
@@ -3650,10 +3750,12 @@ async function findNpmCli() {
 	throw new CommsError("CONFIG", "npm could not be found next to this Node installation", { hint: "Install with `--launcher npx` instead, which runs the published package directly." });
 }
 /**
-* A command run to its end. Its environment is this process's, and on Windows also tells it never to take a program
-* from its current folder: `npm` and a client's command both start programs of their own by name.
+* A command run to its end, in `env`: the environment the install resolved its target from — which client config,
+* which client CLI, which node — and not this process's, which may be another. On Windows it also tells the command
+* never to take a program from its current folder: `npm` and a client's command both start programs of their own by
+* name.
 */
-function run(command, args) {
+function run(env, command, args) {
 	return new Promise((resolvePromise, reject) => {
 		const child = spawn(command, args, {
 			stdio: [
@@ -3661,7 +3763,7 @@ function run(command, args) {
 				"ignore",
 				"pipe"
 			],
-			env: childEnvironment(process.env)
+			env: childEnvironment(env)
 		});
 		let stderr = "";
 		child.stderr?.on("data", (chunk) => {
@@ -3674,14 +3776,19 @@ function run(command, args) {
 		});
 	});
 }
-async function buildEntry(context, product, options, apply) {
+/**
+* The entry for one server, starting the command its preflight resolved (`resolved`): what the plan named and the
+* person approved. Nothing here looks on PATH again — a node or an npx that turned up since would be another command
+* than the one the preview said.
+*/
+async function buildEntry(context, product, options, apply, resolved) {
 	const launcher = options.launcher ?? "managed";
-	const node = await resolveNode(context.env);
+	const { node } = resolved;
 	const env = minimalEnv(context, node);
 	const serverArgs = product.serverArgs(options);
 	if (launcher === "npx") return {
 		entry: {
-			command: await whichExecutable("npx", context.env) ?? "npx",
+			command: resolved.command,
 			args: [
 				"-y",
 				`${product.npxPackage}@${product.version}`,
@@ -3825,6 +3932,13 @@ function claimName(product, options, name, existing) {
 		throw new CommsError("CONFIG", `${options.client} already has an MCP server called "${name}", and it is not this one (it runs ${what})`, { hint: `Register this one under another name: \`${installCommand$1(product, options, other)}\`. --force does not replace a server this did not install.` });
 	}
 	if (taken.length > 0 && !options.force) {
+		for (const pin of PIN_OPTIONS) {
+			const wanted = options[pin];
+			const served = taken.map((server) => product.narrowingOf(server.args)[pin]).find(Boolean);
+			if (!wanted || !served || served === wanted) continue;
+			const second = `${product.defaultServerName}-${wanted.split("/")[0]}`;
+			throw new CommsError("CONFIG", `${options.client} already has this server registered as "${name}"`, { hint: `That entry serves ${served}; to serve ${wanted} as well, register a second entry under its own name: \`${installCommand$1(product, options, second === name ? `${name}-2` : second)}\`.` });
+		}
 		const npx = taken.some((server) => server.args.some((argument) => argument.startsWith(`${product.npxPackage}@`)));
 		const again = {
 			...keepNarrowing(product, options, taken).options,
@@ -3890,9 +4004,10 @@ function installCommand$1(product, options, name, extra = []) {
 }
 /**
 * A command's exit status and what it printed, kept here and never shown: codex prints an entry's env. Started as
-* `run` starts one, so that on Windows it takes no program from its current folder either.
+* `run` starts one — in the environment the target was resolved from — so that on Windows it takes no program from its
+* current folder either.
 */
-function capture$1(command, args) {
+function capture$1(env, command, args) {
 	return new Promise((resolvePromise, reject) => {
 		const child = spawn(command, args, {
 			stdio: [
@@ -3900,7 +4015,7 @@ function capture$1(command, args) {
 				"pipe",
 				"pipe"
 			],
-			env: childEnvironment(process.env)
+			env: childEnvironment(env)
 		});
 		let stdout = "";
 		let stderr = "";
@@ -3928,11 +4043,11 @@ function capture$1(command, args) {
 * or a failure that is not "no such server", stops the install: not knowing is not the same as nothing there.
 * Nothing codex prints is repeated, because its answer carries the entry's env.
 */
-async function codexRegistration(binary, name, path) {
+async function codexRegistration(env, binary, name, path) {
 	const unknown = () => new CommsError("CONFIG", `codex would not say what it has registered as "${name}", so nothing was written`, { hint: `Look with \`codex mcp get ${name}\`. If it is not an older copy of this server, choose another --name; \`--print\` shows the entry to add by hand.` });
 	let answer;
 	try {
-		answer = await capture$1(binary, [
+		answer = await capture$1(env, binary, [
 			"mcp",
 			"get",
 			name,
@@ -4034,21 +4149,48 @@ async function preflightInstall(context, product, options) {
 	}
 	let previous = writes ? claimName(product, options, name, existing) : [];
 	if (writes && binary && options.client === "codex") {
-		const reported = await codexRegistration(binary, name, configPath ?? "codex");
+		const reported = await codexRegistration(context.env, binary, name, configPath ?? "codex");
 		if (reported) previous = claimName(product, options, name, [reported]);
 	}
 	const { options: effective, kept } = keepNarrowing(product, options, previous);
+	const node = await resolveNode(context.env);
+	const command = (options.launcher ?? "managed") === "npx" ? await resolveNpx(context.env, node) : node;
 	return {
 		scan,
 		target,
 		previous,
 		effective,
-		kept
+		kept,
+		node,
+		command
 	};
 }
+/**
+* The `npx` an npx entry starts, as a full path: from PATH, or beside the `node` found, where npm installs it.
+*
+* Never the bare name. An entry that says only `npx` is resolved by the client, later, in its own environment — its
+* PATH, and on Windows its current folder — so the approval would bind a word, and the program run would be whichever
+* the client found. With no `npx` either way, nothing is written.
+*/
+async function resolveNpx(env, node) {
+	const found = await whichExecutable("npx", env) ?? await executableIn("npx", [dirname(node)], env);
+	if (found !== null) return found;
+	throw new CommsError("CONFIG", "npx could not be found, on PATH or beside node, so nothing was written", { hint: "Install Node.js with npm, which brings npx, or register with the managed launcher — the default — which needs no npx." });
+}
+/**
+* Where an install puts the entry and what the entry starts, as one sentence of the preview a person approves: the
+* client's own config file and the command, each with the home written `~`. In the approval's digest with the rest, so
+* a claim from an environment that resolves another file or another command — `CLAUDE_CONFIG_DIR` set to another
+* account's, a PATH that finds another node — is another change, and refused.
+*/
+function entryDestination(client, target, command, env) {
+	const home = homeDirectory(env);
+	const file = target.own ?? target.configPath;
+	return `the entry goes in ${file === void 0 ? `${client}'s own configuration` : shortenHome(file, home)}, and ${client} will start it with ${shortenHome(command, home)}`;
+}
 /** The plan a preflight arrived at, in the form `mcpInstall` compares: see `PlannedInstall`. */
 function plannedInstall(preflight) {
-	const { target, previous, effective } = preflight;
+	const { target, previous, effective, node, command } = preflight;
 	return {
 		writes: target.writes,
 		cliName: target.cliName,
@@ -4070,7 +4212,9 @@ function plannedInstall(preflight) {
 			inbox: effective.inbox ?? null,
 			workspace: effective.workspace ?? null,
 			readOnly: effective.readOnly === true
-		}
+		},
+		node,
+		command
 	};
 }
 /**
@@ -4094,6 +4238,8 @@ function planDrift(product, client, name, planned, now) {
 		}).join(" ") || "no pin";
 		drift.push(`the server would start with ${flags(now.narrowing)}, not ${flags(planned.narrowing)}`);
 	}
+	if (planned.command !== now.command) drift.push(`it would start the server with ${now.command}, not ${planned.command}`);
+	else if (planned.node !== now.node) drift.push(`it would run under the node at ${now.node}, not ${planned.node}`);
 	return drift;
 }
 /** The planned pin and `--read-only`, as the options that start the server: each one given, none left to be found. */
@@ -4137,7 +4283,7 @@ async function mcpInstall(context, product, options, planned) {
 	if (!writes) {
 		if (existing.find((server) => server.client === options.client && server.name === name && server.scope !== "project" && !isProductServer(server, product))) warnings.push(`${options.client} already has a different server called "${name}"; pasting this would replace it. Use --name to choose another name.`);
 	}
-	const { entry, launcher, runtimeMissing } = await buildEntry(context, product, effective, apply);
+	const { entry, launcher, runtimeMissing } = await buildEntry(context, product, effective, apply, preflight);
 	const snippet = snippetFor(options.client, name, entry);
 	const backupPath = previous.length > 0 ? await backUp(context, options.client, name, previous, /* @__PURE__ */ new Date()) : void 0;
 	const ledger = handedOutRuntimesPath(context.core.paths.dataDir);
@@ -4191,13 +4337,13 @@ async function mcpInstall(context, product, options, planned) {
 				name
 			];
 			try {
-				await run(binary, removal);
+				await run(context.env, binary, removal);
 			} catch (error) {
 				const message = error instanceof CommsError ? error.message : String(error);
 				if (!/no (mcp )?server|not found|does not exist/i.test(message)) throw error;
 			}
 			try {
-				await run(binary, args);
+				await run(context.env, binary, args);
 			} catch (error) {
 				const restore = options.client === "claude-code" ? [
 					"mcp",
@@ -4221,7 +4367,7 @@ async function mcpInstall(context, product, options, planned) {
 				];
 				let restored = true;
 				try {
-					await run(binary, restore);
+					await run(context.env, binary, restore);
 				} catch {
 					restored = false;
 				}
@@ -4231,7 +4377,7 @@ async function mcpInstall(context, product, options, planned) {
 				});
 			}
 		} else try {
-			await run(binary, args);
+			await run(context.env, binary, args);
 		} catch (error) {
 			const message = error instanceof CommsError ? error.message : String(error);
 			if (/already exists/i.test(message)) throw new CommsError("CONFIG", `${cliName} already has an MCP server called "${name}", somewhere this could not read`, {
@@ -4720,62 +4866,6 @@ function requireChannelManifest(channel) {
 	if (manifest === void 0) throw notAChannel(channel);
 	return manifest;
 }
-/**
-* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
-* and the preview renderer (which makes them visible), so the two can never disagree.
-*/
-/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
-const INVISIBLE_RANGES = [
-	[173, 173],
-	[847, 847],
-	[1564, 1564],
-	[4447, 4448],
-	[6068, 6069],
-	[6155, 6159],
-	[8203, 8207],
-	[8232, 8233],
-	[8234, 8238],
-	[8288, 8292],
-	[8294, 8303],
-	[12644, 12644],
-	[65024, 65039],
-	[65279, 65279],
-	[65440, 65440],
-	[917504, 917631]
-];
-function isInvisible(codePoint) {
-	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
-	return false;
-}
-/**
-* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
-* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
-*/
-function isControl(codePoint) {
-	if (codePoint === 9 || codePoint === 10) return false;
-	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
-}
-function isDangerous(codePoint) {
-	return isControl(codePoint) || isInvisible(codePoint);
-}
-/**
-* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
-* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
-*
-* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
-* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
-* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
-*/
-function stripInvisible(text) {
-	let removed = 0;
-	let out = "";
-	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
-	else out += char;
-	return {
-		text: out,
-		removed
-	};
-}
 function okEnvelope(data) {
 	return {
 		ok: true,
@@ -5958,7 +6048,7 @@ function isPrerelease(version) {
 	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.11.0";
+const VERSION = "0.12.1";
 /**
 * Registering, pruning and listing the MCP servers of every channel, from the core.
 *
@@ -6133,9 +6223,10 @@ function installOptions(request) {
 *
 * `own` is the calling channel's product, from its own `mcp install`: see `ownProduct`. The sentences depend on the
 * request and the machine, not on which surface prepared them, so an approval prepared by one is claimed by the
-* other. The one sentence that names code — `--launcher local`, which starts a checkout — names the file that will be
-* started; a core running from another build of the checkout than the channel's command names another file, and that
-* is another registration, refused as one.
+* other. The sentences that name code name it as this environment resolves it: the client's config file and the node
+* or npx the entry starts (#46), and for `--launcher local` the checkout's file. A claim from an environment that
+* resolves another — `CLAUDE_CONFIG_DIR` set to another account's, a PATH that finds another node, a core running
+* from another build of the checkout — is another registration, refused as one.
 */
 function serverInstallChange(core, env, request, own) {
 	checkRequest(request);
@@ -6159,7 +6250,7 @@ function serverInstallChange(core, env, request, own) {
 			const product = await productNow();
 			const { version } = product;
 			const preflight = await preflightInstall(context, product, installOptions(request));
-			const { target, previous, effective, kept } = preflight;
+			const { target, previous, effective, kept, command } = preflight;
 			planned = {
 				product,
 				install: plannedInstall(preflight)
@@ -6168,12 +6259,14 @@ function serverInstallChange(core, env, request, own) {
 			if (target.writes) {
 				const pinned = pinName === void 0 || pinName === "readOnly" ? void 0 : effective[pinName];
 				const pins = [pinned !== void 0 ? `pinned to the ${noun} ${pinned}` : "", effective.readOnly ? "read-only" : ""].filter(Boolean);
-				const replacing = previous.length > 0 ? `, replacing its own earlier entry of that name${kept.length > 0 ? ` and keeping ${kept.join(" ")} from it` : ""}` : "";
+				const what = (pinName === void 0 || pinName === "readOnly" ? [] : [...new Set(previous.map((server) => facts.narrowingOf(server.args)[pinName] ?? null))]).map((pin) => pin === null ? `every ${noun}` : `the ${noun} ${pin}`).join(" and ");
+				const replacing = previous.length > 0 ? `, replacing its own earlier entry of that name${what ? `, which served ${what}${kept.length > 0 ? "," : ""}` : ""}${kept.length > 0 ? ` and keeping ${kept.join(" ")} from it` : ""}` : "";
 				effects.push(`registers the ${label} MCP server with ${request.client} as "${name}"${pins.length > 0 ? `, ${pins.join(", ")}` : ""}${replacing}`);
 				const everyAccount = pinName !== void 0 && pinned === void 0;
 				const everyTool = switchable && effective.readOnly !== true;
 				if (everyAccount) effects.push(`not pinned: it reaches every ${noun} on this machine${everyTool ? ", with every tool" : ""}`);
 				else if (everyTool) effects.push(`not read-only: it has every tool for ${pinned}, including those that change it`);
+				effects.push(entryDestination(request.client, target, command, env));
 				if (launcher === "npx") effects.push(`${request.client} will fetch ${facts.npxPackage}@${version} from npm each time it starts it`);
 				else if (launcher === "local") effects.push(`${request.client} will start it from ${await localCliEntry(product.moduleUrl)}`);
 			}
@@ -6213,7 +6306,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.11.0"
+		version: "0.12.1"
 	};
 	const product = {
 		packageName,
@@ -6552,7 +6645,6 @@ function updateLaterChange(core, options = {}) {
 		}
 	};
 }
-channelServer("core").packageName;
 Object.freeze({
 	kind: "send",
 	lookup: true
@@ -6836,8 +6928,9 @@ async function askLine(streams, question) {
 		rl.close();
 	}
 }
+channelServer("core").packageName;
 //#endregion
-//#region ../core/dist/tool-arguments-5aAzuZnA.mjs
+//#region ../core/dist/tool-arguments-CohGlMUZ.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcomms/whatsapp",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "WhatsApp for coding agents, read-only: list, read and search the chats WhatsApp for Mac keeps on this Mac, and draft replies as links the person sends. No network client; it never sends.",
   "type": "module",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "@modelcontextprotocol/server": "^2.0.0",
     "commander": "^15.0.0",
     "zod": "^4.6.5",
-    "@agentcomms/core": "0.11.0"
+    "@agentcomms/core": "0.12.1"
   },
   "agentcomms": {
     "contract": 1,
@@ -87,5 +87,5 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --disable-warning=ExperimentalWarning --test --test-timeout=600000 \"test/**/*.test.ts\""
   },
-  "gitHead": "bcc1392f8380dbf523a910a87de652a18faead6f"
+  "gitHead": "62c13e382939518b8464df3e0f582d07b3bea4cd"
 }