@agentcomms/whatsapp 0.12.2 → 0.12.3

package/dist/cli.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { $ as renderPrune, A as CommsError, B as colorEnabled, C as checkStorePath, F as approvalsOf, G as installExitStatus, H as escapeForDisplay, I as approveChangeAtTerminal, J as nameAvailable, K as isCommsError, L as canPrompt, M as absoluteSearchPath, N as agentMarker, O as CHANNELS, P as approvalKind, Q as renderInstall, R as channelManifest, S as storeIdentity, T as expandSource, U as exemptFromUpdateGate, V as commandPathOf, W as gatedChangeAtTerminal, X as openCore, Y as nameShapeProblem, Z as paint, _ as chatRefOf, a as listChats, at as updateGateAtTerminal, b as requireAccount, c as Presenter, ct as withFileLock, d as draftMessage, et as runCommand, f as Visibility, g as requireSupportedNode, h as WhatsAppIndex, i as CHAT_KINDS, it as truncateDisplay, j as EXIT_CODES, k as CHANNEL_SERVERS, l as innerText, lt as writeResult, m as WhatsAppContext, n as whatsappStatus, nt as serverPruneChange, o as readChat, p as listKey, q as lookupName, r as probeStore, s as searchMessages, st as windowsSystemProgram, t as syncAccount, tt as serverInstallChange, ut as VERSION, v as PLATFORM, w as defaultStorePath, x as requireNamedConfig, y as newWhatsAppAccount, z as childEnvironment } from "./sync-C2_cXhZ0.mjs";
+import { $ as paint, A as CommsError, B as colorEnabled, C as checkStorePath, F as approvalsOf, G as gatedChangeAtTerminal, H as commandText, I as approveChangeAtTerminal, J as isCommsError, K as inlineCommand, L as canPrompt, M as absoluteSearchPath, N as agentMarker, O as CHANNELS, P as approvalKind, Q as openCore, R as channelManifest, S as storeIdentity, T as expandSource, U as escapeForDisplay, V as commandPathOf, W as exemptFromUpdateGate, X as nameAvailable, Y as lookupName, Z as nameShapeProblem, _ as chatRefOf, a as listChats, at as shellCommand, b as requireAccount, c as Presenter, ct as updateGateAtTerminal, d as draftMessage, dt as withFileLock, et as renderInstall, f as Visibility, ft as writeResult, g as requireSupportedNode, h as WhatsAppIndex, i as CHAT_KINDS, it as serverPruneChange, j as EXIT_CODES, k as CHANNEL_SERVERS, l as innerText, m as WhatsAppContext, n as whatsappStatus, nt as runCommand, o as readChat, p as listKey, pt as VERSION, q as installExitStatus, r as probeStore, rt as serverInstallChange, s as searchMessages, st as truncateDisplay, t as syncAccount, tt as renderPrune, ut as windowsSystemProgram, v as PLATFORM, w as defaultStorePath, x as requireNamedConfig, y as newWhatsAppAccount, z as childEnvironment } from "./sync-DJlsr6xq.mjs";
 import { rm } from "node:fs/promises";
 import path, { delimiter, join } from "node:path";
-import fs, { accessSync, constants as constants$1 } from "node:fs";
 import { stripVTControlCharacters } from "node:util";
+import fs, { accessSync, constants as constants$1 } from "node:fs";
 import childProcess, { spawn } from "node:child_process";
 import process$1 from "node:process";
 import { EventEmitter } from "node:events";
@@ -2994,12 +2994,17 @@ const WHATSAPP_MCP = {
 function refuseAnAgent(context, command, what) {
 	const marker = agentMarker(context.env);
 	if (marker !== null || context.surface !== "cli") throw new CommsError("LOOSENING_REFUSED", `only a person ${what}`, {
-		hint: `Ask the person to run \`agent-whatsapp ${command}\` in their own terminal.`,
+		hint: `Ask the person to run ${inlineCommand(command)} in their own terminal.`,
 		...marker === null ? {} : { details: { marker } }
 	});
 }
 async function addAccount(context, request) {
-	refuseAnAgent(context, `add ${request.name}`, "chooses which WhatsApp store an agent may read");
+	refuseAnAgent(context, shellCommand([
+		"agent-whatsapp",
+		"add",
+		request.name,
+		...request.source === void 0 ? [] : ["--source", request.source]
+	], context.platform), "chooses which WhatsApp store an agent may read");
 	const problem = nameShapeProblem(request.name, PLATFORM);
 	if (problem) throw new CommsError("USAGE", problem);
 	const isDefault = request.source === void 0;
@@ -3013,7 +3018,11 @@ async function addAccount(context, request) {
 	const refuseTaken = (config) => {
 		requireNamedConfig(config);
 		const free = nameAvailable(config, "account", request.name, PLATFORM);
-		if (!free.ok) throw lookupName(config, "account", request.name)?.platform === "whatsapp" ? new CommsError("USAGE", `"${request.name}" is already added`, { hint: `Remove it first with \`agent-whatsapp remove ${request.name}\` to point it at another store.` }) : free.error;
+		if (!free.ok) throw lookupName(config, "account", request.name)?.platform === "whatsapp" ? new CommsError("USAGE", `"${request.name}" is already added`, { hint: `Remove it first with ${inlineCommand(shellCommand([
+			"agent-whatsapp",
+			"remove",
+			request.name
+		], context.platform))} to point it at another store.` }) : free.error;
 		for (const [name, other] of Object.entries(config.accounts)) {
 			if (other.platform !== "whatsapp") continue;
 			if (context.storeOf(other).path === path || other.workspace === identity.workspace) throw new CommsError("USAGE", `that store is already added, as "${name}"`, { hint: "One name per message store." });
@@ -3043,7 +3052,12 @@ async function addAccount(context, request) {
 			default: isDefault,
 			id: account.workspace
 		},
-		next: `agent-whatsapp sync --account ${request.name}`
+		next: commandText(shellCommand([
+			"agent-whatsapp",
+			"sync",
+			"--account",
+			request.name
+		], context.platform))
 	};
 }
 /**
@@ -3052,8 +3066,12 @@ async function addAccount(context, request) {
 */
 const REMOVE_WAIT_MS = 6e4;
 async function removeAccount(context, request) {
-	refuseAnAgent(context, `remove ${request.name}`, "removes a WhatsApp account");
-	const { account } = requireAccount(await context.config(), request.name);
+	refuseAnAgent(context, shellCommand([
+		"agent-whatsapp",
+		"remove",
+		request.name
+	], context.platform), "removes a WhatsApp account");
+	const { account } = requireAccount(await context.config(), request.name, context.platform);
 	await withFileLock(context.syncLock(account), async () => {
 		await context.core.config.update((config) => {
 			if (lookupName(config, "account", request.name)?.id !== account.id) throw new CommsError("TRANSIENT", `"${request.name}" changed while it was being removed`, { hint: "Nothing was removed. Run it again." });
@@ -3097,7 +3115,7 @@ function effectOf(lists) {
 async function named(context, name, account, chatId) {
 	let index;
 	try {
-		index = await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(void 0));
+		index = await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(void 0), context.platform);
 	} catch (error) {
 		if (!isCommsError(error) || error.details?.reason !== "NOT_SYNCED") throw error;
 		return {
@@ -3118,7 +3136,12 @@ async function named(context, name, account, chatId) {
 }
 /** The one path every list change takes: the person check first, before any input is read. */
 async function change(context, command, request, next) {
-	refuseAnAgent(context, command, "changes which chats an agent may see");
+	refuseAnAgent(context, shellCommand([
+		"agent-whatsapp",
+		command,
+		...request.chat === void 0 ? [] : [request.chat],
+		...request.account === void 0 ? [] : ["--account", request.account]
+	], context.platform), "changes which chats an agent may see");
 	const chatId = request.chat === void 0 ? void 0 : chatRefOf(request.chat, { international: true }).id;
 	const { name, account } = await context.account(request.account);
 	const { before, after } = await context.lists.update(account.id, (lists) => next(lists, chatId));
@@ -3128,7 +3151,12 @@ async function change(context, command, request, next) {
 		deny: [...after.deny],
 		changed: JSON.stringify(before) !== JSON.stringify(after),
 		effect: effectOf(after),
-		next: `agent-whatsapp sync --account ${name}`,
+		next: commandText(shellCommand([
+			"agent-whatsapp",
+			"sync",
+			"--account",
+			name
+		], context.platform)),
 		...chatId === void 0 ? {} : await named(context, name, account, chatId)
 	};
 }
@@ -3215,7 +3243,7 @@ function renderAdded(result, color) {
 function renderRemoved(result, color) {
 	return `${paint(color, "green", "Removed")} ${result.account}, and its local index. WhatsApp's own store was not touched.`;
 }
-function renderStatus(result, color) {
+function renderStatus(result, color, platform = process.platform) {
 	const lines = [];
 	if (result.accounts.length === 0) lines.push(`No WhatsApp account yet. ${result.setup ?? ""}`);
 	for (const account of result.accounts) {
@@ -3229,7 +3257,12 @@ function renderStatus(result, color) {
 			lines.push(`  index   ${account.index.chats} chats, ${account.index.messages} messages, ${account.index.media} with media, ${account.index.statusChats} status-update chat(s) · synced ${account.index.indexedAt}`);
 			if (account.index.unattributedStatus > 0) lines.push(`          ${unattributed(account.index.unattributedStatus)}`);
 			for (const entry of account.index.degraded) lines.push(paint(color, "dim", `          without ${entry.part}: ${entry.costs}`));
-		} else lines.push(`  index   not synced yet — agent-whatsapp sync --account ${account.account}`);
+		} else lines.push(`  index   not synced yet — ${commandText(shellCommand([
+			"agent-whatsapp",
+			"sync",
+			"--account",
+			account.account
+		], platform))}`);
 	}
 	lines.push("", paint(color, "dim", `Reads: ${result.reads}.`), paint(color, "dim", `Sends: ${result.sends}.`));
 	return lines.join("\n");
@@ -3338,6 +3371,7 @@ async function run(argv, deps = {}) {
 		stdin: process.stdin
 	};
 	const env = deps.env ?? process.env;
+	const platform = deps.platform ?? process.platform;
 	const open = deps.open ?? openLink;
 	const program = new Command();
 	let exitCode = 0;
@@ -3365,7 +3399,8 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 		const options = program.opts();
 		return {
 			json: Boolean(options.json),
-			color: colorEnabled(env, streams.stdout, options.color)
+			color: colorEnabled(env, streams.stdout, options.color),
+			platform
 		};
 	};
 	/**
@@ -3451,7 +3486,7 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 			account: flags.account === void 0 ? void 0 : String(flags.account),
 			check: flags.check !== false
 		});
-		writeResult(result, options, () => renderStatus(result, options.color), streams);
+		writeResult(result, options, () => renderStatus(result, options.color, context.platform), streams);
 	}));
 	accountOption(program.command("sync")).description("copy WhatsApp's store privately, check it, and rebuild the local index from the copy").action(act(async (context, options, flags) => {
 		const result = await syncAccount(context, { account: String(flags.account) });
@@ -3509,16 +3544,25 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 	program.command("approve <approvalId>").description("approve a change at this terminal — registering or pruning this server — by reading it and typing the code back; WhatsApp never sends, so there is no message to approve").action(act(async (context, options, approvalId) => {
 		const marker = agentMarker(env);
 		if (marker) throw new CommsError("APPROVAL_REQUIRED", "only a person can approve a change, not an agent", {
-			hint: `Ask the person to run \`agent-whatsapp approve ${approvalId}\` in their own terminal.`,
+			hint: `Ask the person to run ${inlineCommand(shellCommand([
+				"agent-whatsapp",
+				"approve",
+				approvalId
+			], context.platform))} in their own terminal.`,
 			details: { marker }
 		});
-		if (!canPrompt(env, streams, { json: options.json })) throw new CommsError("APPROVAL_REQUIRED", "approving a change needs an interactive terminal", { hint: `Run \`agent-whatsapp approve ${approvalId}\` directly in a terminal.` });
+		if (!canPrompt(env, streams, { json: options.json })) throw new CommsError("APPROVAL_REQUIRED", "approving a change needs an interactive terminal", { hint: `Run ${inlineCommand(shellCommand([
+			"agent-whatsapp",
+			"approve",
+			approvalId
+		], context.platform))} directly in a terminal.` });
 		const pending = await context.core.approvals.get(approvalId);
 		if (!pending) throw new CommsError("NOT_FOUND", `no approval ${approvalId}`, { hint: "It may have expired, been used, or been cancelled. Prepare the change again." });
 		if (approvalKind(pending) !== "change") throw new CommsError("USAGE", `approval ${approvalId} is for a send, and WhatsApp never sends`, { hint: `Approve it with the command that prepared it — ${sendApproveCommands()} — not this one.` });
 		const outcome = await approveChangeAtTerminal(context.core, approvalId, env, {
 			json: options.json,
-			color: options.color
+			color: options.color,
+			platform: context.platform
 		}, streams);
 		streams.stdout.write(outcome.state === "approved" ? "Approved. This command approves; the change is applied by the command that prepared it.\n" : "Cancelled. Nothing was changed.\n");
 	}));
@@ -3534,9 +3578,9 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 		ran = true;
 		exitCode = await runCommand(output(), async () => {
 			requireSupportedNode();
-			const { startWhatsAppStdioServer } = await import("./stdio-entry-irMynM6w.mjs");
-			await startWhatsAppStdioServer({
+			await (deps.startMcp ?? (await import("./stdio-entry-CAM7LpPv.mjs")).startWhatsAppStdioServer)({
 				env,
+				platform,
 				...flags.account ? { account: String(flags.account) } : {}
 			});
 		}, streams);
@@ -3559,7 +3603,7 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 		const launcher = flags.launcher;
 		const name = flags.name;
 		await context.migration();
-		const again = [
+		const again = shellCommand([
 			"agent-whatsapp",
 			"mcp",
 			"install",
@@ -3570,7 +3614,7 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 			...launcher !== void 0 ? ["--launcher", launcher] : [],
 			...flags.verify === false ? ["--no-verify"] : [],
 			...flags.force === true ? ["--force"] : []
-		].join(" ");
+		], context.platform);
 		const result = await changeAt(context, serverInstallChange(context.core, env, {
 			channel: "whatsapp",
 			client: flags.client,
@@ -3590,7 +3634,12 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 			channel: "whatsapp",
 			dryRun: flags.dryRun === true,
 			includePrinted: flags.includePrinted === true
-		}, WHATSAPP_MCP), flags, `agent-whatsapp mcp prune${flags.includePrinted === true ? " --include-printed" : ""}`);
+		}, WHATSAPP_MCP), flags, shellCommand([
+			"agent-whatsapp",
+			"mcp",
+			"prune",
+			...flags.includePrinted === true ? ["--include-printed"] : []
+		], context.platform));
 		writeResult(result, output(), () => renderPrune(result, options.color), streams);
 	}));
 	try {

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { u as composeDraft, ut as VERSION } from "./sync-C2_cXhZ0.mjs";
-import { t as createWhatsAppMcpServer } from "./server-ag_r78jB.mjs";
+import { pt as VERSION, u as composeDraft } from "./sync-DJlsr6xq.mjs";
+import { t as createWhatsAppMcpServer } from "./server-B1EmZ6FZ.mjs";
 //#region src/index.ts
 /**
 * The library entry of `@agentcomms/whatsapp`.

package/dist/{server-ag_r78jB.mjs → server-B1EmZ6FZ.mjs}

@@ -1,4 +1,4 @@
-import { D as strictToolArguments, E as UNTRUSTED_NOTICE, a as listChats, d as draftMessage, i as CHAT_KINDS, m as WhatsAppContext, n as whatsappStatus, o as readChat, ot as updateToolGate, rt as toCommsError, s as searchMessages, t as syncAccount, ut as VERSION } from "./sync-C2_cXhZ0.mjs";
+import { D as strictToolArguments, E as UNTRUSTED_NOTICE, a as listChats, d as draftMessage, i as CHAT_KINDS, lt as updateToolGate, m as WhatsAppContext, n as whatsappStatus, o as readChat, ot as toCommsError, pt as VERSION, s as searchMessages, t as syncAccount } from "./sync-DJlsr6xq.mjs";
 import { c as boolean, h as number, x as string } from "./schemas-DiGKNDNq.mjs";
 import { t as McpServer } from "./mcp-DXXb3Vv3-Co5BzjYe.mjs";
 //#region src/mcp/server.ts

package/dist/{stdio-entry-irMynM6w.mjs → stdio-entry-CAM7LpPv.mjs}

@@ -1,4 +1,4 @@
-import { t as createWhatsAppMcpServer } from "./server-ag_r78jB.mjs";
+import { t as createWhatsAppMcpServer } from "./server-B1EmZ6FZ.mjs";
 //#region src/mcp/stdio-entry.ts
 /**
 * Starting the stdio server. On stdio, stdout is the protocol, so the console is redirected to stderr first — the

package/dist/{sync-C2_cXhZ0.mjs → sync-DJlsr6xq.mjs}

@@ -4,16 +4,16 @@ import path, { basename, delimiter, dirname, isAbsolute, join, resolve, sep } fr
 import { domainToASCII, fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomBytes, randomInt, timingSafeEqual } from "node:crypto";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { styleText } from "node:util";
 import { homedir, platform, userInfo } from "node:os";
 import { constants as constants$1 } from "node:fs";
-import { styleText } from "node:util";
 import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.12.2";
+const VERSION$1 = "0.12.3";
 //#endregion
-//#region ../core/dist/update-check-B-WYPZae.mjs
+//#region ../core/dist/update-check-Dq-D4bAD.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -966,6 +966,253 @@ function connectMailboxCommand() {
 	const mail = accountChannels().find((manifest) => manifest.accounts?.map === "inboxes");
 	return mail ? `${mail.binary} inbox add` : void 0;
 }
+/** Crockford-style alphabet without I, L, O and U, so ids and challenges survive being read aloud or retyped. */
+const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function randomString(length) {
+	const bytes = randomBytes(length);
+	let out = "";
+	for (let i = 0; i < length; i += 1) out += ALPHABET[(bytes[i] ?? 0) & 31];
+	return out;
+}
+/** `ap_` + 26 characters: 130 random bits. Validated before an id ever names a file. */
+const APPROVAL_ID_PATTERN = /^ap_[0-9A-HJKMNP-TV-Z]{26}$/;
+const PLAN_TOKEN_PATTERN = /^pl_[0-9A-HJKMNP-TV-Z]{26}$/;
+function newApprovalId() {
+	return `ap_${randomString(26)}`;
+}
+function newPlanToken() {
+	return `pl_${randomString(26)}`;
+}
+const CHALLENGE_LETTERS = "ABCDEFGHJKMNPQRSTVWXYZ";
+/** A short challenge a human types back to approve: letters only, no look-alikes. */
+function newChallenge(length = 4) {
+	let out = "";
+	for (let i = 0; i < length; i += 1) out += CHALLENGE_LETTERS[randomInt(22)];
+	return out;
+}
+/** Challenges are stored only as hashes, so no listing or tool result can reveal one. */
+function hashChallenge(challenge) {
+	return createHash("sha256").update(challenge.trim().toUpperCase()).digest("hex");
+}
+/** Case-insensitive, constant-time comparison of an answer with a stored challenge hash. */
+function challengeMatches(answer, storedHash) {
+	const a = Buffer.from(hashChallenge(answer), "hex");
+	const b = Buffer.from(storedHash, "hex");
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+function okEnvelope(data) {
+	return {
+		ok: true,
+		schemaVersion: 1,
+		data
+	};
+}
+function errorEnvelope(error) {
+	const body = {
+		code: error.code,
+		message: error.message
+	};
+	if (error.hint !== void 0) body.hint = error.hint;
+	if (error.details !== void 0) body.details = error.details;
+	return {
+		ok: false,
+		schemaVersion: 1,
+		error: body
+	};
+}
+const defaultStreams = {
+	stdout: process.stdout,
+	stderr: process.stderr,
+	stdin: process.stdin
+};
+function colorEnabled(env, stream, flag) {
+	if (flag === false) return false;
+	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
+	if (env.TERM === "dumb") return false;
+	if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
+	return Boolean(stream.isTTY);
+}
+/** True when a human could answer a prompt: both ends are terminals, no --json/--no-input, not CI. */
+function canPrompt(env, streams, options) {
+	if (options.json || options.noInput) return false;
+	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
+	return Boolean(streams.stdin?.isTTY && streams.stdout.isTTY);
+}
+/** Environment variables well-known coding agents set. Used only as a speed bump, never as a security boundary. */
+const AGENT_MARKERS = [
+	"CLAUDECODE",
+	"CLAUDE_CODE_ENTRYPOINT",
+	"CODEX_SANDBOX",
+	"CODEX_HOME",
+	"CURSOR_AGENT",
+	"GEMINI_CLI",
+	"AGENT_COMMS_AGENT"
+];
+function agentMarker(env) {
+	for (const name of AGENT_MARKERS) if (env[name] !== void 0 && env[name] !== "") return name;
+	return null;
+}
+function paint(color, format, text) {
+	return color ? styleText(format, text, { validateStream: false }) : text;
+}
+/**
+* A command line for a person to copy and run, each word quoted only where the shell it is pasted into would need it.
+* Every command this package prints to be run — a change to run again with its approval, a folder to take out, an
+* entry to register again or remove — is quoted here, so no printer quotes for a shell of its own.
+*
+* Everywhere but Windows that shell is a POSIX one, and a word goes in single quotes, inside which nothing is special
+* but the quote itself. Windows has two shells, and neither reads single quotes that way: cmd.exe does not take them
+* as quotes at all, so `'C:\Profiles\First Last\outgoing'` reached the command as two words, quote marks and all, and
+* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A command printed on Windows
+* has to be safe in both, because nothing says which one it will be pasted into (CUE-306) — and safe is not enough:
+* the program has to receive the same words from either. Three readers stand between the line and the program. cmd.exe
+* hands the program the line as it is, and the program's own parser (the C runtime's, Node's) splits it. PowerShell
+* reads the line itself, a double-quoted word with its backslashes as plain characters, and then writes a new command
+* line for the program: Windows PowerShell 5.1 the old way ("Legacy" in about_Parsing, "Passing arguments to native
+* applications") — a word quoted only when it holds whitespace, as it is, and an empty word dropped — and PowerShell
+* 7.3 and later its own way ("Standard") — quoted when it must be, with every backslash before a quote doubled. For a
+* `.cmd` script, which is how npm installs `agentcomms`, `claude` and `codex` on Windows, PowerShell 7 goes back to the
+* old way, and cmd.exe then reads that new line. So on Windows:
+*
+* - A word of letters, digits and `_ + = : . / \`, with `@` and `-` anywhere but first, is left as it is: no reader
+*   does anything with it, and a backslash is an ordinary character to all of them, at the end too. A first `@` is
+*   splatting to PowerShell, and a `,` its array operator — two words — so a word with either is quoted. So is a word
+*   that starts with a digit, which PowerShell may read as a number (`1kb`, `0x10`), and one that starts with `-` but
+*   is not a plain option, which PowerShell may read as a parameter of its own and split (`-name.x`).
+* - A word that double quotes bring through all three readers whole goes in double quotes. Inside them cmd.exe reads
+*   `& | < > ^ ( )` and spaces as ordinary characters, and PowerShell reads everything as ordinary but `$`, the
+*   backtick and a double quote. What is left special in one or the other is kept out: a double quote, which ends the
+*   quoting in both — and PowerShell takes the curly ones, `“ ” „`, for one too; `$` and the backtick, PowerShell's
+*   expansion and escape; `%`, which cmd.exe expands as `%NAME%` before it looks at quotes at all; `!`, which it
+*   expands as `!NAME!` inside quotes too wherever delayed expansion is on, and which then makes a `^` inside quotes an
+*   escape; and any control or formatting character — a line break ends the command in cmd.exe even inside quotes, a
+*   tab pasted into cmd.exe can complete a file name, and a right-to-left override shows a line other than the one
+*   that runs. Three more cannot come through: an empty word, which Windows PowerShell drops; a word ending in a
+*   backslash, which the C runtime reads with the closing quote as `\"` — and doubled for it, PowerShell 7 passes both
+*   backslashes on where cmd.exe and Windows PowerShell pass one; and a word with `& | < > ^ ( )` but no whitespace,
+*   which PowerShell passes to a `.cmd` script unquoted, for cmd.exe to run `&whoami` from or to split at `|`.
+* - With any other word in it, no line is printed at all (`line` is null), and the printers show the command's words
+*   as JSON instead, saying it has to be typed. Not a line with the word left out: a placeholder in its place was
+*   still a command that ran — `claude mcp remove NAME` removed whatever entry was called `NAME`, and an install
+*   hint's `--force` replaced it — and before that, a word quoted for PowerShell's single quotes, which cmd.exe reads
+*   as characters, ran `whoami` from a server named `$x&whoami&`. See `commandAsJson` for why the JSON runs nothing.
+*
+* Everywhere else there is always a line: single quotes make any word safe.
+*/
+function shellCommand(words, platform = process.platform) {
+	if (platform !== "win32") return {
+		words,
+		line: words.map(posixShellWord).join(" "),
+		platform
+	};
+	const printed = words.map(windowsShellWord);
+	return {
+		words,
+		line: printed.includes(null) ? null : printed.join(" "),
+		platform
+	};
+}
+/** The same command with more words at its end — the approval it is to be run again with — for the same shell. */
+function withWords(command, ...more) {
+	return shellCommand([...command.words, ...more], command.platform);
+}
+function posixShellWord(word) {
+	return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* The word as cmd.exe, Windows PowerShell and PowerShell 7 all hand it to a program, or null when no printing of it
+* does (see `shellCommand`). Bare: a plain option, or ordinary characters that do not start like a number.
+*/
+function windowsShellWord(word) {
+	if (/^(?:--?[A-Za-z][A-Za-z0-9-]*|(?!\+?\.?\d)[\w+=:./\\][\w@+=:./\\-]*)$/.test(word)) return word;
+	if (word === "" || word.endsWith("\\")) return null;
+	if (/["$`%!\u201C-\u201E]|[\p{C}\p{Zl}\p{Zp}]/u.test(word)) return null;
+	if (/[&|<>^()]/.test(word) && !/\s/.test(word)) return null;
+	return `"${word}"`;
+}
+/**
+* The words of a command as a JSON array, for a command that cannot be printed as a line: something to read, and to
+* parse, and nothing to run.
+*
+* Pasted into either Windows shell by mistake, it runs nothing. PowerShell refuses it before running anything: a `[`
+* opens a type name, and a quoted string is none. cmd.exe looks for a program called `["agentcomms"` or the like, and
+* finds none — and nothing in the line is anything else to it: every character it acts on, inside quotes or out (`%`,
+* `!`), is written as a `\u` escape, and so is every double quote inside a word, so the quotes cmd.exe sees are the
+* JSON's own, in pairs, and `&`, `|`, `<`, `>`, `^` and the parentheses are only ever inside them, where it reads them
+* as characters. `$` and the backtick are escaped too, so that PowerShell would expand nothing even if it read on, and
+* so is everything outside printable ASCII — a line break, a curly quote, a right-to-left override. A backslash is
+* doubled, as JSON has it.
+*/
+function commandAsJson(words) {
+	const word = (text) => {
+		let json = "";
+		for (let index = 0; index < text.length; index++) {
+			const code = text.charCodeAt(index);
+			const char = text[index];
+			if (char === "\\") json += "\\\\";
+			else if (code >= 32 && code <= 126 && !"\"%!$`".includes(char)) json += char;
+			else json += `\\u${code.toString(16).padStart(4, "0")}`;
+		}
+		return `"${json}"`;
+	};
+	return `[${words.map(word).join(",")}]`;
+}
+/** What is said beside a command shown as JSON. */
+const TO_TYPE = "the command's words, written as JSON: one of them cannot be quoted the same way for cmd.exe and for PowerShell, so type the command yourself, with that word quoted for the shell you use";
+/** A command in backticks, for a sentence — as its words in JSON, saying it has to be typed, when it has no line. */
+function inlineCommand(command) {
+	return command.line === null ? `\`${commandAsJson(command.words)}\` (${TO_TYPE})` : `\`${command.line}\``;
+}
+/** A command as text of its own — a list's line, a field's value — or its words in JSON, saying it has to be typed. */
+function commandText(command) {
+	return command.line === null ? `${commandAsJson(command.words)} (${TO_TYPE})` : command.line;
+}
+/** Writes a successful result: the envelope with --json, otherwise the human rendering. */
+function writeResult(data, options, human, streams = defaultStreams) {
+	if (options.json) {
+		streams.stdout.write(`${JSON.stringify(okEnvelope(data))}\n`);
+		return;
+	}
+	const text = human(data);
+	if (text) streams.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
+}
+/** Writes an error and returns the exit code to use. */
+function writeError(error, options, streams = defaultStreams) {
+	const commsError = toCommsError(error);
+	if (options.json) streams.stdout.write(`${JSON.stringify(errorEnvelope(commsError))}\n`);
+	else {
+		streams.stderr.write(`${paint(options.color, "red", "error")}: ${commsError.message}\n`);
+		if (commsError.hint) streams.stderr.write(`${paint(options.color, "dim", "hint")}: ${commsError.hint}\n`);
+	}
+	return commsError.exitCode;
+}
+/** Runs a command body and exits with the documented code. Unexpected errors keep only their message. */
+async function runCommand(options, body, streams = defaultStreams) {
+	try {
+		await body();
+		return EXIT_CODES.OK;
+	} catch (error) {
+		return writeError(error, options, streams);
+	}
+}
+/**
+* The first two steps of `requirePerson` — an agent is refused, then anything without a terminal — for a command
+* whose code is not its own to make up.
+*
+* `agentcomms approve` asks for a code the approval store issued and will check, so it cannot use `askChallenge`;
+* but it refuses in exactly the same order and words, because it is the same gate.
+*/
+function refuseUnlessPerson(env, streams, gate) {
+	const marker = agentMarker(env);
+	if (marker) throw new CommsError("LOOSENING_REFUSED", gate.refusedToAgent, {
+		hint: `Ask the user to run \`${gate.command}\` in their own terminal.`,
+		details: { marker }
+	});
+	const prompting = {};
+	if (gate.json !== void 0) prompting.json = gate.json;
+	if (gate.noInput !== void 0) prompting.noInput = gate.noInput;
+	if (!canPrompt(env, streams, prompting)) throw new CommsError("LOOSENING_REFUSED", gate.refusedWithoutTerminal, { hint: `Run \`${gate.command}\` directly in a terminal.` });
+}
 /**
 * One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
 * and the preview renderer (which makes them visible), so the two can never disagree.
@@ -1967,40 +2214,6 @@ function canonicalLoosening(loosening) {
 function sameLoosening(a, b) {
 	return canonicalLoosening(a) === canonicalLoosening(b);
 }
-/** Crockford-style alphabet without I, L, O and U, so ids and challenges survive being read aloud or retyped. */
-const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function randomString(length) {
-	const bytes = randomBytes(length);
-	let out = "";
-	for (let i = 0; i < length; i += 1) out += ALPHABET[(bytes[i] ?? 0) & 31];
-	return out;
-}
-/** `ap_` + 26 characters: 130 random bits. Validated before an id ever names a file. */
-const APPROVAL_ID_PATTERN = /^ap_[0-9A-HJKMNP-TV-Z]{26}$/;
-const PLAN_TOKEN_PATTERN = /^pl_[0-9A-HJKMNP-TV-Z]{26}$/;
-function newApprovalId() {
-	return `ap_${randomString(26)}`;
-}
-function newPlanToken() {
-	return `pl_${randomString(26)}`;
-}
-const CHALLENGE_LETTERS = "ABCDEFGHJKMNPQRSTVWXYZ";
-/** A short challenge a human types back to approve: letters only, no look-alikes. */
-function newChallenge(length = 4) {
-	let out = "";
-	for (let i = 0; i < length; i += 1) out += CHALLENGE_LETTERS[randomInt(22)];
-	return out;
-}
-/** Challenges are stored only as hashes, so no listing or tool result can reveal one. */
-function hashChallenge(challenge) {
-	return createHash("sha256").update(challenge.trim().toUpperCase()).digest("hex");
-}
-/** Case-insensitive, constant-time comparison of an answer with a stored challenge hash. */
-function challengeMatches(answer, storedHash) {
-	const a = Buffer.from(hashChallenge(answer), "hex");
-	const b = Buffer.from(storedHash, "hex");
-	return a.length === b.length && timingSafeEqual(a, b);
-}
 /**
 * The digest a download's question is bound to: the account, the download, the request, the files it listed and the
 * names it showed them under.
@@ -2289,19 +2502,23 @@ var ApprovalStore = class {
 	* Nothing written, because the caller made a mistake about an approval that may be perfectly good: voiding a post
 	* somebody is about to approve, because an agent passed its id to a change, would punish the wrong party.
 	*/
-	#requireKind(record, kind) {
+	#requireKind(record, kind, platform) {
 		const actual = approvalKind(record);
 		if (actual === kind) return;
 		const id = record.approvalId;
 		if (actual === "download") throw (kind === "change" ? refuseChange : refuse)("USAGE", `${id} is a question about where to save files, not ${kind === "send" ? "a send" : "a configuration change"}`, record, DOWNLOAD_ANSWER_HINT);
 		if (kind === "download") throw refuseDownload("USAGE", `${id} is ${actual === "change" ? "a configuration change" : "a send"}, not a question about where to save files`, record, "Pass the choice id the download’s question came with, and the person’s answer beside it.");
-		throw kind === "send" ? refuse("USAGE", `approval ${id} is for a configuration change, not a send`, record, `A person approves it with \`agentcomms approve ${id}\` — or ${channelApproveCommands()}, whichever is installed — and it permits only the change it was prepared for.`) : refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, `It is approved with the command that prepared it — ${channelApproveCommands({ sending: true })} — and permits only that send.`);
+		throw kind === "send" ? refuse("USAGE", `approval ${id} is for a configuration change, not a send`, record, `A person approves it with ${inlineCommand(shellCommand([
+			"agentcomms",
+			"approve",
+			id
+		], platform))} — or ${channelApproveCommands()}, whichever is installed — and it permits only the change it was prepared for.`) : refuseChange("USAGE", `approval ${id} is for a send, not a configuration change`, record, `It is approved with the command that prepared it — ${channelApproveCommands({ sending: true })} — and permits only that send.`);
 	}
 	/** Issues a new challenge to show a human; only its hash is kept. */
-	async issueChallenge(approvalId, kind = "send") {
+	async issueChallenge(approvalId, kind = "send", platform = process.platform) {
 		const challenge = newChallenge();
 		await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, kind);
+			this.#requireKind(current, kind, platform);
 			if (current.state !== "pending") throw this.#stateError(current);
 			return {
 				...current,
@@ -2318,10 +2535,10 @@ var ApprovalStore = class {
 	* A change is approved the same way, with `kind: 'change'` and its digest standing in for the draft (see
 	* `createChange`), so a person's typed code means one thing whichever kind of approval it is typed for.
 	*/
-	async approve(approvalId, via, live, answer, kind = "send") {
+	async approve(approvalId, via, live, answer, kind = "send", platform = process.platform) {
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, kind);
+			this.#requireKind(current, kind, platform);
 			if (current.state !== "pending") throw this.#stateError(current);
 			if (!current.challengeHash) throw refusalFor(current)("APPROVAL_REQUIRED", "no challenge was issued for this approval", current);
 			if (live.draftMessageId !== current.draftMessageId || live.digest !== current.digest) {
@@ -2378,7 +2595,7 @@ var ApprovalStore = class {
 	async claimForSend(approvalId, live, options = {}) {
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "send");
+			this.#requireKind(current, "send", options.platform ?? process.platform);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
 			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (code, reason) => {
@@ -2489,7 +2706,7 @@ var ApprovalStore = class {
 		const digest = changeDigest(live.change);
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "change");
+			this.#requireKind(current, "change", options.platform ?? process.platform);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
 			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (reason) => {
@@ -2505,7 +2722,11 @@ var ApprovalStore = class {
 			};
 			if (digest !== current.digest) return voidWith(current.change ? changeDrift(current.change, live.change) : "the change is not the one that was approved");
 			if (stricterPolicy(live.policy, current.requiredPolicy) !== "chat") {
-				if (current.state !== "approved") throw refuseChange("APPROVAL_PENDING", "this change needs a person to approve it at a terminal first", current, options.pendingHint ?? `Ask the user to run \`agentcomms approve ${approvalId}\` in their own terminal, then try again with the same approval.`);
+				if (current.state !== "approved") throw refuseChange("APPROVAL_PENDING", "this change needs a person to approve it at a terminal first", current, options.pendingHint ?? `Ask the user to run ${inlineCommand(shellCommand([
+					"agentcomms",
+					"approve",
+					approvalId
+				], options.platform ?? process.platform))} in their own terminal, then try again with the same approval.`);
 				if (current.approvedVia !== "terminal") return voidWith("the change policy is confirm, and this was not approved at a terminal");
 			}
 			return {
@@ -2582,13 +2803,13 @@ var ApprovalStore = class {
 	*
 	* Only a pending question can be answered, and only once: a second answer is refused, not taken over the first.
 	*/
-	async answerDownload(approvalId, via, answer) {
+	async answerDownload(approvalId, via, answer, platform = process.platform) {
 		const recorded = answer.choice === "other" ? {
 			choice: "other",
 			folder: answer.folder
 		} : { choice: answer.choice };
 		return await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "download");
+			this.#requireKind(current, "download", platform);
 			if (current.state === "approved") throw refuseDownload("APPROVAL_VOID", "the question was answered already, and it is answered once", current);
 			if (current.state !== "pending") throw this.#stateError(current);
 			if (!current.download || downloadDigest(current.download) !== current.digest) throw refuseDownload("APPROVAL_VOID", "the question does not describe the download it is bound to", current);
@@ -2627,7 +2848,7 @@ var ApprovalStore = class {
 		const digest = downloadDigest(live);
 		let failure = null;
 		const result = await this.#transition(approvalId, (current) => {
-			this.#requireKind(current, "download");
+			this.#requireKind(current, "download", options.platform ?? process.platform);
 			if (current.state !== "pending" && current.state !== "approved") throw this.#stateError(current);
 			if (options.signal?.aborted) throw cancelledClaim(current);
 			const voidWith = (reason) => {
@@ -2898,219 +3119,6 @@ function nameAvailable(config, kind, name, platform) {
 	}
 	return { ok: true };
 }
-function okEnvelope(data) {
-	return {
-		ok: true,
-		schemaVersion: 1,
-		data
-	};
-}
-function errorEnvelope(error) {
-	const body = {
-		code: error.code,
-		message: error.message
-	};
-	if (error.hint !== void 0) body.hint = error.hint;
-	if (error.details !== void 0) body.details = error.details;
-	return {
-		ok: false,
-		schemaVersion: 1,
-		error: body
-	};
-}
-const defaultStreams = {
-	stdout: process.stdout,
-	stderr: process.stderr,
-	stdin: process.stdin
-};
-function colorEnabled(env, stream, flag) {
-	if (flag === false) return false;
-	if (env.NO_COLOR !== void 0 && env.NO_COLOR !== "") return false;
-	if (env.TERM === "dumb") return false;
-	if (env.FORCE_COLOR !== void 0 && env.FORCE_COLOR !== "0") return true;
-	return Boolean(stream.isTTY);
-}
-/** True when a human could answer a prompt: both ends are terminals, no --json/--no-input, not CI. */
-function canPrompt(env, streams, options) {
-	if (options.json || options.noInput) return false;
-	if (env.CI && env.CI !== "0" && env.CI !== "false") return false;
-	return Boolean(streams.stdin?.isTTY && streams.stdout.isTTY);
-}
-/** Environment variables well-known coding agents set. Used only as a speed bump, never as a security boundary. */
-const AGENT_MARKERS = [
-	"CLAUDECODE",
-	"CLAUDE_CODE_ENTRYPOINT",
-	"CODEX_SANDBOX",
-	"CODEX_HOME",
-	"CURSOR_AGENT",
-	"GEMINI_CLI",
-	"AGENT_COMMS_AGENT"
-];
-function agentMarker(env) {
-	for (const name of AGENT_MARKERS) if (env[name] !== void 0 && env[name] !== "") return name;
-	return null;
-}
-function paint(color, format, text) {
-	return color ? styleText(format, text, { validateStream: false }) : text;
-}
-/**
-* A command line for a person to copy and run, each word quoted only where the shell it is pasted into would need it.
-* Every command this package prints to be run — a change to run again with its approval, a folder to take out, an
-* entry to register again or remove — is quoted here, so no printer quotes for a shell of its own.
-*
-* Everywhere but Windows that shell is a POSIX one, and a word goes in single quotes, inside which nothing is special
-* but the quote itself. Windows has two shells, and neither reads single quotes that way: cmd.exe does not take them
-* as quotes at all, so `'C:\Profiles\First Last\outgoing'` reached the command as two words, quote marks and all, and
-* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A command printed on Windows
-* has to be safe in both, because nothing says which one it will be pasted into (CUE-306) — and safe is not enough:
-* the program has to receive the same words from either. Three readers stand between the line and the program. cmd.exe
-* hands the program the line as it is, and the program's own parser (the C runtime's, Node's) splits it. PowerShell
-* reads the line itself, a double-quoted word with its backslashes as plain characters, and then writes a new command
-* line for the program: Windows PowerShell 5.1 the old way ("Legacy" in about_Parsing, "Passing arguments to native
-* applications") — a word quoted only when it holds whitespace, as it is, and an empty word dropped — and PowerShell
-* 7.3 and later its own way ("Standard") — quoted when it must be, with every backslash before a quote doubled. For a
-* `.cmd` script, which is how npm installs `agentcomms`, `claude` and `codex` on Windows, PowerShell 7 goes back to the
-* old way, and cmd.exe then reads that new line. So on Windows:
-*
-* - A word of letters, digits and `_ + = : . / \`, with `@` and `-` anywhere but first, is left as it is: no reader
-*   does anything with it, and a backslash is an ordinary character to all of them, at the end too. A first `@` is
-*   splatting to PowerShell, and a `,` its array operator — two words — so a word with either is quoted. So is a word
-*   that starts with a digit, which PowerShell may read as a number (`1kb`, `0x10`), and one that starts with `-` but
-*   is not a plain option, which PowerShell may read as a parameter of its own and split (`-name.x`).
-* - A word that double quotes bring through all three readers whole goes in double quotes. Inside them cmd.exe reads
-*   `& | < > ^ ( )` and spaces as ordinary characters, and PowerShell reads everything as ordinary but `$`, the
-*   backtick and a double quote. What is left special in one or the other is kept out: a double quote, which ends the
-*   quoting in both — and PowerShell takes the curly ones, `“ ” „`, for one too; `$` and the backtick, PowerShell's
-*   expansion and escape; `%`, which cmd.exe expands as `%NAME%` before it looks at quotes at all; `!`, which it
-*   expands as `!NAME!` inside quotes too wherever delayed expansion is on, and which then makes a `^` inside quotes an
-*   escape; and any control or formatting character — a line break ends the command in cmd.exe even inside quotes, a
-*   tab pasted into cmd.exe can complete a file name, and a right-to-left override shows a line other than the one
-*   that runs. Three more cannot come through: an empty word, which Windows PowerShell drops; a word ending in a
-*   backslash, which the C runtime reads with the closing quote as `\"` — and doubled for it, PowerShell 7 passes both
-*   backslashes on where cmd.exe and Windows PowerShell pass one; and a word with `& | < > ^ ( )` but no whitespace,
-*   which PowerShell passes to a `.cmd` script unquoted, for cmd.exe to run `&whoami` from or to split at `|`.
-* - With any other word in it, no line is printed at all (`line` is null), and the printers show the command's words
-*   as JSON instead, saying it has to be typed. Not a line with the word left out: a placeholder in its place was
-*   still a command that ran — `claude mcp remove NAME` removed whatever entry was called `NAME`, and an install
-*   hint's `--force` replaced it — and before that, a word quoted for PowerShell's single quotes, which cmd.exe reads
-*   as characters, ran `whoami` from a server named `$x&whoami&`. See `commandAsJson` for why the JSON runs nothing.
-*
-* Everywhere else there is always a line: single quotes make any word safe.
-*/
-function shellCommand(words, platform = process.platform) {
-	if (platform !== "win32") return {
-		words,
-		line: words.map(posixShellWord).join(" "),
-		platform
-	};
-	const printed = words.map(windowsShellWord);
-	return {
-		words,
-		line: printed.includes(null) ? null : printed.join(" "),
-		platform
-	};
-}
-/** The same command with more words at its end — the approval it is to be run again with — for the same shell. */
-function withWords(command, ...more) {
-	return shellCommand([...command.words, ...more], command.platform);
-}
-function posixShellWord(word) {
-	return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
-}
-/**
-* The word as cmd.exe, Windows PowerShell and PowerShell 7 all hand it to a program, or null when no printing of it
-* does (see `shellCommand`). Bare: a plain option, or ordinary characters that do not start like a number.
-*/
-function windowsShellWord(word) {
-	if (/^(?:--?[A-Za-z][A-Za-z0-9-]*|(?!\+?\.?\d)[\w+=:./\\][\w@+=:./\\-]*)$/.test(word)) return word;
-	if (word === "" || word.endsWith("\\")) return null;
-	if (/["$`%!\u201C-\u201E]|[\p{C}\p{Zl}\p{Zp}]/u.test(word)) return null;
-	if (/[&|<>^()]/.test(word) && !/\s/.test(word)) return null;
-	return `"${word}"`;
-}
-/**
-* The words of a command as a JSON array, for a command that cannot be printed as a line: something to read, and to
-* parse, and nothing to run.
-*
-* Pasted into either Windows shell by mistake, it runs nothing. PowerShell refuses it before running anything: a `[`
-* opens a type name, and a quoted string is none. cmd.exe looks for a program called `["agentcomms"` or the like, and
-* finds none — and nothing in the line is anything else to it: every character it acts on, inside quotes or out (`%`,
-* `!`), is written as a `\u` escape, and so is every double quote inside a word, so the quotes cmd.exe sees are the
-* JSON's own, in pairs, and `&`, `|`, `<`, `>`, `^` and the parentheses are only ever inside them, where it reads them
-* as characters. `$` and the backtick are escaped too, so that PowerShell would expand nothing even if it read on, and
-* so is everything outside printable ASCII — a line break, a curly quote, a right-to-left override. A backslash is
-* doubled, as JSON has it.
-*/
-function commandAsJson(words) {
-	const word = (text) => {
-		let json = "";
-		for (let index = 0; index < text.length; index++) {
-			const code = text.charCodeAt(index);
-			const char = text[index];
-			if (char === "\\") json += "\\\\";
-			else if (code >= 32 && code <= 126 && !"\"%!$`".includes(char)) json += char;
-			else json += `\\u${code.toString(16).padStart(4, "0")}`;
-		}
-		return `"${json}"`;
-	};
-	return `[${words.map(word).join(",")}]`;
-}
-/** What is said beside a command shown as JSON. */
-const TO_TYPE = "the command's words, written as JSON: one of them cannot be quoted the same way for cmd.exe and for PowerShell, so type the command yourself, with that word quoted for the shell you use";
-/** A command in backticks, for a sentence — as its words in JSON, saying it has to be typed, when it has no line. */
-function inlineCommand(command) {
-	return command.line === null ? `\`${commandAsJson(command.words)}\` (${TO_TYPE})` : `\`${command.line}\``;
-}
-/** A command as text of its own — a list's line, a field's value — or its words in JSON, saying it has to be typed. */
-function commandText(command) {
-	return command.line === null ? `${commandAsJson(command.words)} (${TO_TYPE})` : command.line;
-}
-/** Writes a successful result: the envelope with --json, otherwise the human rendering. */
-function writeResult(data, options, human, streams = defaultStreams) {
-	if (options.json) {
-		streams.stdout.write(`${JSON.stringify(okEnvelope(data))}\n`);
-		return;
-	}
-	const text = human(data);
-	if (text) streams.stdout.write(text.endsWith("\n") ? text : `${text}\n`);
-}
-/** Writes an error and returns the exit code to use. */
-function writeError(error, options, streams = defaultStreams) {
-	const commsError = toCommsError(error);
-	if (options.json) streams.stdout.write(`${JSON.stringify(errorEnvelope(commsError))}\n`);
-	else {
-		streams.stderr.write(`${paint(options.color, "red", "error")}: ${commsError.message}\n`);
-		if (commsError.hint) streams.stderr.write(`${paint(options.color, "dim", "hint")}: ${commsError.hint}\n`);
-	}
-	return commsError.exitCode;
-}
-/** Runs a command body and exits with the documented code. Unexpected errors keep only their message. */
-async function runCommand(options, body, streams = defaultStreams) {
-	try {
-		await body();
-		return EXIT_CODES.OK;
-	} catch (error) {
-		return writeError(error, options, streams);
-	}
-}
-/**
-* The first two steps of `requirePerson` — an agent is refused, then anything without a terminal — for a command
-* whose code is not its own to make up.
-*
-* `agentcomms approve` asks for a code the approval store issued and will check, so it cannot use `askChallenge`;
-* but it refuses in exactly the same order and words, because it is the same gate.
-*/
-function refuseUnlessPerson(env, streams, gate) {
-	const marker = agentMarker(env);
-	if (marker) throw new CommsError("LOOSENING_REFUSED", gate.refusedToAgent, {
-		hint: `Ask the user to run \`${gate.command}\` in their own terminal.`,
-		details: { marker }
-	});
-	const prompting = {};
-	if (gate.json !== void 0) prompting.json = gate.json;
-	if (gate.noInput !== void 0) prompting.noInput = gate.noInput;
-	if (!canPrompt(env, streams, prompting)) throw new CommsError("LOOSENING_REFUSED", gate.refusedWithoutTerminal, { hint: `Run \`${gate.command}\` directly in a terminal.` });
-}
 /**
 * Enough of TOML to read codex's `config.toml`, and a refusal for anything else.
 *
@@ -4544,7 +4552,7 @@ async function mcpInstall(context, product, options, planned) {
 	};
 	const existing = scan.servers;
 	const { cliName, binary, own, configPath, writes } = target;
-	const warnings = (product.warnAbout?.(existing.filter((server) => server.client === options.client)) ?? []).filter(Boolean);
+	const warnings = (product.warnAbout?.(existing.filter((server) => server.client === options.client), context.platform) ?? []).filter(Boolean);
 	if (kept.length > 0) {
 		const removal = options.client === "claude-code" ? inlineCommand(shellCommand([
 			"claude",
@@ -5050,8 +5058,8 @@ function findRivalPackageServers(servers, packages, platform = process.platform)
 	return findings;
 }
 /** What registering a server says about the rival packages its manifest names: one line each. */
-function rivalPackageWarnings(servers, packages) {
-	return findRivalPackageServers(servers, packages).map((finding) => `${finding.packageName} is registered with ${finding.client} as "${finding.name}": ${finding.reason}. Remove it: ${finding.removal}`);
+function rivalPackageWarnings(servers, packages, platform = process.platform) {
+	return findRivalPackageServers(servers, packages, platform).map((finding) => `${finding.packageName} is registered with ${finding.client} as "${finding.name}": ${finding.reason}. Remove it: ${finding.removal}`);
 }
 /**
 * Registered servers that name the service's `word` anywhere — their name, command, arguments or URL — and are not
@@ -5137,7 +5145,7 @@ function serverFactsOf({ packageName, manifest }) {
 	if (rivals === void 0) return facts;
 	return {
 		...facts,
-		warnAbout: (servers) => [...rivals.packages ? rivalPackageWarnings(servers, rivals.packages) : [], ...rivals.word !== void 0 && rivals.can !== void 0 ? rivalWordWarnings(servers, rivals.word, rivals.can, facts) : []]
+		warnAbout: (servers, platform) => [...rivals.packages ? rivalPackageWarnings(servers, rivals.packages, platform) : [], ...rivals.word !== void 0 && rivals.can !== void 0 ? rivalWordWarnings(servers, rivals.word, rivals.can, facts) : []]
 	};
 }
 const CHANNEL_SERVERS = Object.freeze(Object.fromEntries(CHANNEL_SNAPSHOT.map((entry) => [entry.manifest.channel, serverFactsOf(entry)])));
@@ -5228,9 +5236,9 @@ function renderPrune(result, color) {
 	if (lines.length === 0) lines.push(`No managed runtimes to remove in ${result.runtimeDir}.`);
 	return lines.join("\n");
 }
-/** The terminal command that approves a change, for the channel that asked. */
-function approveCommandOf(options) {
-	return options.approveCommand ?? "agentcomms approve";
+/** The channel's fixed approval-command prefix with this generated id, rendered by the common shell rule. */
+function changeApprovalCommand(approveCommand, approvalId, platform = process.platform) {
+	return shellCommand([...(approveCommand ?? "agentcomms approve").trim().split(/\s+/), approvalId], platform);
 }
 /**
 * The change policy that governs a change, as `config` stands: the strictest of the policies over everything the change
@@ -5341,7 +5349,7 @@ async function prepareChange(core, request, options) {
 				change: binding
 			}),
 			expiresAt: record.expiresAt,
-			next: nextStep(record.approvalId, policy, approveCommandOf(options))
+			next: nextStep(record.approvalId, policy, options)
 		};
 	} catch (error) {
 		await auditRefusal(core, "change.prepare", error, {
@@ -5372,7 +5380,10 @@ async function claimChange(core, approvalId, expect, options) {
 		const record = await core.approvals.claimForChange(approvalId, {
 			change: binding,
 			policy
-		}, { pendingHint: `Ask the user to run \`${approveCommandOf(options)} ${approvalId}\` in their own terminal, then try again with the same approval.` });
+		}, {
+			pendingHint: `Ask the user to run ${inlineCommand(changeApprovalCommand(options.approveCommand, approvalId, options.platform))} in their own terminal, then try again with the same approval.`,
+			platform: options.platform
+		});
 		const decided = stricterPolicy(policy, record.requiredPolicy) === "chat" ? "chat" : "confirm";
 		await auditChange(core, {
 			operation: "change.claim",
@@ -5420,7 +5431,7 @@ async function beginChangeApproval(core, approvalId, options) {
 	let record;
 	try {
 		record = await changeRecord(core, approvalId);
-		const challenge = await core.approvals.issueChallenge(approvalId, "change");
+		const challenge = await core.approvals.issueChallenge(approvalId, "change", options.platform);
 		return {
 			approvalId,
 			preview: renderChangePreview(record),
@@ -5445,7 +5456,7 @@ async function finishChangeApproval(core, approvalId, answer, options) {
 		const approved = await core.approvals.approve(approvalId, "terminal", {
 			draftMessageId: digest,
 			digest
-		}, answer, "change");
+		}, answer, "change", options.platform);
 		await auditChange(core, {
 			operation: "change.approve",
 			outcome: "ok",
@@ -5501,8 +5512,8 @@ async function revokeChange(core, approvalId, reason, options) {
 function changePolicyOf(record) {
 	return record.requiredPolicy === "chat" ? "chat" : "confirm";
 }
-function nextStep(approvalId, policy, approveCommand) {
-	return policy === "chat" ? `Show this preview to the user and ask. If they say yes, claim approval ${approvalId} and apply the change; if not, revoke it.` : `The change policy is confirm: ask the user to run \`${approveCommand} ${approvalId}\` in their own terminal and type the code it shows. Then claim approval ${approvalId} and apply the change.`;
+function nextStep(approvalId, policy, options) {
+	return policy === "chat" ? `Show this preview to the user and ask. If they say yes, claim approval ${approvalId} and apply the change; if not, revoke it.` : `The change policy is confirm: ask the user to run ${inlineCommand(changeApprovalCommand(options.approveCommand, approvalId, options.platform))} in their own terminal and type the code it shows. Then claim approval ${approvalId} and apply the change.`;
 }
 /**
 * One line per step of a change approval: who asked, from which surface, under which policy, and how it ended.
@@ -5651,12 +5662,14 @@ async function gatedChange(core, change, options) {
 		status: "approval-required",
 		prepared: await prepareChange(core, request, {
 			surface: options.surface,
-			approveCommand: options.approveCommand
+			approveCommand: options.approveCommand,
+			platform: options.platform
 		})
 	};
 	const consent = await claimChange(core, options.approvalId, request, {
 		surface: options.surface,
-		approveCommand: options.approveCommand
+		approveCommand: options.approveCommand,
+		platform: options.platform
 	});
 	return {
 		status: "applied",
@@ -5677,7 +5690,8 @@ async function gatedChangeAtTerminal(core, change, options) {
 	const first = await gatedChange(core, change, {
 		surface: "cli",
 		approvalId: options.approvalId,
-		approveCommand
+		approveCommand,
+		platform: options.output.platform
 	});
 	if (first.status === "applied") return first.result;
 	const { prepared } = first;
@@ -5686,7 +5700,7 @@ async function gatedChangeAtTerminal(core, change, options) {
 		const carrying = [options.approvalFlag ?? "--approval", prepared.approvalId];
 		const { command } = options;
 		throw new CommsError("APPROVAL_PENDING", `this change needs approval first: ${prepared.summary}`, {
-			hint: approvalHint(prepared, typeof command === "string" ? `${command} ${carrying.join(" ")}` : withWords(command, ...carrying), approveCommand),
+			hint: approvalHint(prepared, typeof command === "string" ? `${command} ${carrying.join(" ")}` : withWords(command, ...carrying), approveCommand, options.output.platform),
 			details: {
 				approvalId: prepared.approvalId,
 				policy: prepared.policy,
@@ -5707,7 +5721,8 @@ async function gatedChangeAtTerminal(core, change, options) {
 	const second = await gatedChange(core, change, {
 		surface: "cli",
 		approvalId: prepared.approvalId,
-		approveCommand
+		approveCommand,
+		platform: options.output.platform
 	});
 	if (second.status !== "applied") throw new CommsError("UNEXPECTED", "the approved change asked for approval again");
 	return second.result;
@@ -5719,9 +5734,9 @@ async function gatedChangeAtTerminal(core, change, options) {
 * Shared with a command that reports a waiting change rather than failing on it — `agent-gmail setup`, which stops at
 * its registration step and says why in its report — so the two say it in the same words.
 */
-function approvalHint(prepared, rerun, approveCommand) {
+function approvalHint(prepared, rerun, approveCommand, platform = typeof rerun === "string" ? process.platform : rerun.platform) {
 	const run = typeof rerun === "string" ? `\`${rerun}\`` : inlineCommand(rerun);
-	return prepared.policy === "confirm" ? `Show the person the preview. They run \`${approveCommandOf({ approveCommand })} ${prepared.approvalId}\`; then run ${run}.` : `Show the person the preview. Once they say yes, run ${run}.`;
+	return prepared.policy === "confirm" ? `Show the person the preview. They run ${inlineCommand(changeApprovalCommand(approveCommand, prepared.approvalId, platform))}; then run ${run}.` : `Show the person the preview. Once they say yes, run ${run}.`;
 }
 /**
 * Approves a configuration change at a terminal, the way a person approves a send: read the preview, type the code.
@@ -5741,7 +5756,11 @@ async function approveChangeAtTerminal(core, approvalId, env, output, streams =
 		refuseUnlessPerson(env, streams, {
 			refusedToAgent: "only a person can approve a change, not an agent",
 			refusedWithoutTerminal: "approving a change needs an interactive terminal",
-			command: `agentcomms approve ${approvalId}`,
+			command: commandText(shellCommand([
+				"agentcomms",
+				"approve",
+				approvalId
+			], output.platform)),
 			color: output.color,
 			json: output.json
 		});
@@ -6258,7 +6277,7 @@ function isPrerelease(version) {
 	return VERSION_PATTERN.exec(version)?.[4] !== void 0;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.12.2";
+const VERSION = "0.12.3";
 /**
 * Registering, pruning and listing the MCP servers of every channel, from the core.
 *
@@ -6516,7 +6535,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: channelServer(request.channel).packageName,
-		version: "0.12.2"
+		version: "0.12.3"
 	};
 	const product = {
 		packageName,
@@ -7140,7 +7159,7 @@ async function askLine(streams, question) {
 }
 channelServer("core").packageName;
 //#endregion
-//#region ../core/dist/tool-arguments-BMmJnuY4.mjs
+//#region ../core/dist/tool-arguments-BMgRZ6DZ.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -8561,13 +8580,17 @@ function notFound(config, name) {
 * is not a store path this package would read, is refused rather than acted on: nothing here would know what it
 * means, and the vocabulary is closed (design §5).
 */
-function requireAccount(config, name) {
+function requireAccount(config, name, platform = process.platform) {
 	if (name === void 0 || name === "") throw new CommsError("USAGE", "which WhatsApp account? there is no default", { hint: "Pass the account, as `organisation/whatsapp`." });
 	requireNamedConfig(config);
 	const { account } = resolveName(config, "account", name, notFound(config, name));
 	if (account.platform !== "whatsapp") throw notFound(config, name)();
 	const mode = account.mode ?? account.tier;
-	if (mode !== "read") throw new CommsError("CONFIG", `"${name}" is recorded in mode "${String(mode)}", and WhatsApp accounts only read`, { hint: `Nothing was read. Remove it with \`agent-whatsapp remove ${name}\` and add it again.` });
+	if (mode !== "read") throw new CommsError("CONFIG", `"${name}" is recorded in mode "${String(mode)}", and WhatsApp accounts only read`, { hint: `Nothing was read. Remove it with ${inlineCommand(shellCommand([
+		"agent-whatsapp",
+		"remove",
+		name
+	], platform))} and add it again.` });
 	const source = account.source;
 	if (source !== void 0 && (typeof source !== "string" || basename(source) !== "ChatStorage.sqlite")) throw new CommsError("CONFIG", `"${name}" names a store this package does not read`, { hint: `Only a file called ${STORE_FILE} is read. Remove the account and add it again.` });
 	return {
@@ -9219,13 +9242,18 @@ var WhatsAppIndex = class WhatsAppIndex {
 		this.#db = db;
 	}
 	/** Every read opens the index through here, and cannot without the account's lists. */
-	static async open(directory, accountName, visibility) {
+	static async open(directory, accountName, visibility, platform = process.platform) {
 		const path = join(directory, INDEX_FILE);
 		try {
 			await stat(path);
 		} catch {
 			throw new CommsError("NOT_FOUND", `"${accountName}" has not been synced yet, so there is nothing to read`, {
-				hint: `Run \`agent-whatsapp sync --account ${accountName}\` (or the whatsapp_sync tool) first.`,
+				hint: `Run ${inlineCommand(shellCommand([
+					"agent-whatsapp",
+					"sync",
+					"--account",
+					accountName
+				], platform))} (or the whatsapp_sync tool) first.`,
 				details: { reason: "NOT_SYNCED" }
 			});
 		}
@@ -9233,7 +9261,12 @@ var WhatsAppIndex = class WhatsAppIndex {
 		const db = await openDatabase(path, { readOnly: true });
 		if (db.prepare("SELECT value FROM meta WHERE key = 'format'").get()?.value !== String(2)) {
 			db.close();
-			throw new CommsError("CONFIG", `the index for "${accountName}" was written by another version of this package`, { hint: `Run \`agent-whatsapp sync --account ${accountName}\` to rebuild it.` });
+			throw new CommsError("CONFIG", `the index for "${accountName}" was written by another version of this package`, { hint: `Run ${inlineCommand(shellCommand([
+				"agent-whatsapp",
+				"sync",
+				"--account",
+				accountName
+			], platform))} to rebuild it.` });
 		}
 		db.function("agent_sees_chat", { deterministic: true }, (id) => visibility.seesChat(String(id)) ? 1 : 0);
 		db.function("agent_kind", { deterministic: true }, (id) => chatKindOf(String(id)));
@@ -9701,6 +9734,7 @@ var WhatsAppContext = class {
 	env;
 	now;
 	surface;
+	platform;
 	core;
 	lists;
 	/** The name a pinned server was started for, as given. */
@@ -9713,6 +9747,7 @@ var WhatsAppContext = class {
 		this.env = options.env ?? process.env;
 		this.now = options.now ?? (() => /* @__PURE__ */ new Date());
 		this.surface = options.surface ?? "cli";
+		this.platform = options.platform ?? process.platform;
 		this.core = openCore({
 			env: this.env,
 			now: this.now
@@ -9723,7 +9758,7 @@ var WhatsAppContext = class {
 		this.#source = {
 			io: options.sourceIo,
 			timeoutMs: options.sourceTimeoutMs,
-			platform: options.platform
+			platform: this.platform
 		};
 	}
 	/** The spike's accounts moved in, once per process; what happened, when there was a spike file to move. */
@@ -9753,7 +9788,7 @@ var WhatsAppContext = class {
 	*/
 	async checkPin() {
 		if (this.pinned === void 0) return;
-		this.#pinnedId = requireAccount(await this.config(), this.pinned).account.id;
+		this.#pinnedId = requireAccount(await this.config(), this.pinned, this.platform).account.id;
 	}
 	/** The name a call acts on: the one it gave, checked against the pin when there is one. */
 	async #nameFor(config, named) {
@@ -9769,7 +9804,7 @@ var WhatsAppContext = class {
 	/** One account, resolved and checked, with the person's lists for it — which every read applies. */
 	async account(named) {
 		const config = await this.config();
-		const { name, account } = requireAccount(config, await this.#nameFor(config, named));
+		const { name, account } = requireAccount(config, await this.#nameFor(config, named), this.platform);
 		return {
 			name,
 			account,
@@ -9991,7 +10026,7 @@ async function draftMessage(context, request) {
 	for (const { name, account, lists } of scope) {
 		let index;
 		try {
-			index = await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(lists));
+			index = await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(lists), context.platform);
 		} catch (error) {
 			if (scope.length > 1 && isCommsError(error) && error.details?.reason === "NOT_SYNCED") continue;
 			throw error;
@@ -10176,7 +10211,7 @@ async function openIndex(context, accountName) {
 	const { name, account, lists } = await context.account(accountName);
 	return {
 		name,
-		index: await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(lists))
+		index: await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(lists), context.platform)
 	};
 }
 async function listChats(context, request) {
@@ -10616,7 +10651,7 @@ async function statusOf(context, named, check) {
 	}
 	let index = { synced: false };
 	try {
-		const opened = await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(lists));
+		const opened = await WhatsAppIndex.open(context.accountDir(account), name, new Visibility(lists), context.platform);
 		try {
 			const stats = opened.stats();
 			index = {
@@ -10747,4 +10782,4 @@ async function syncAccount(context, request) {
 	});
 }
 //#endregion
-export { renderPrune as $, CommsError as A, colorEnabled as B, checkStorePath as C, strictToolArguments as D, UNTRUSTED_NOTICE as E, approvalsOf as F, installExitStatus as G, escapeForDisplay as H, approveChangeAtTerminal as I, nameAvailable as J, isCommsError as K, canPrompt as L, absoluteSearchPath as M, agentMarker as N, CHANNELS as O, approvalKind as P, renderInstall as Q, channelManifest as R, storeIdentity as S, expandSource as T, exemptFromUpdateGate as U, commandPathOf as V, gatedChangeAtTerminal as W, openCore as X, nameShapeProblem as Y, paint as Z, chatRefOf as _, listChats as a, updateGateAtTerminal as at, requireAccount as b, Presenter as c, withFileLock as ct, draftMessage as d, runCommand as et, Visibility as f, requireSupportedNode as g, WhatsAppIndex as h, CHAT_KINDS as i, truncateDisplay as it, EXIT_CODES as j, CHANNEL_SERVERS as k, innerText as l, writeResult as lt, WhatsAppContext as m, whatsappStatus as n, serverPruneChange as nt, readChat as o, updateToolGate as ot, listKey as p, lookupName as q, probeStore as r, toCommsError as rt, searchMessages as s, windowsSystemProgram as st, syncAccount as t, serverInstallChange as tt, composeDraft as u, VERSION$1 as ut, PLATFORM as v, defaultStorePath as w, requireNamedConfig as x, newWhatsAppAccount as y, childEnvironment as z };
+export { paint as $, CommsError as A, colorEnabled as B, checkStorePath as C, strictToolArguments as D, UNTRUSTED_NOTICE as E, approvalsOf as F, gatedChangeAtTerminal as G, commandText as H, approveChangeAtTerminal as I, isCommsError as J, inlineCommand as K, canPrompt as L, absoluteSearchPath as M, agentMarker as N, CHANNELS as O, approvalKind as P, openCore as Q, channelManifest as R, storeIdentity as S, expandSource as T, escapeForDisplay as U, commandPathOf as V, exemptFromUpdateGate as W, nameAvailable as X, lookupName as Y, nameShapeProblem as Z, chatRefOf as _, listChats as a, shellCommand as at, requireAccount as b, Presenter as c, updateGateAtTerminal as ct, draftMessage as d, withFileLock as dt, renderInstall as et, Visibility as f, writeResult as ft, requireSupportedNode as g, WhatsAppIndex as h, CHAT_KINDS as i, serverPruneChange as it, EXIT_CODES as j, CHANNEL_SERVERS as k, innerText as l, updateToolGate as lt, WhatsAppContext as m, whatsappStatus as n, runCommand as nt, readChat as o, toCommsError as ot, listKey as p, VERSION$1 as pt, installExitStatus as q, probeStore as r, serverInstallChange as rt, searchMessages as s, truncateDisplay as st, syncAccount as t, renderPrune as tt, composeDraft as u, windowsSystemProgram as ut, PLATFORM as v, defaultStorePath as w, requireNamedConfig as x, newWhatsAppAccount as y, childEnvironment as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcomms/whatsapp",
-  "version": "0.12.2",
+  "version": "0.12.3",
   "description": "WhatsApp for coding agents, read-only: list, read and search the chats WhatsApp for Mac keeps on this Mac, and draft replies as links the person sends. No network client; it never sends.",
   "type": "module",
   "license": "MIT",
@@ -38,7 +38,7 @@
     "@modelcontextprotocol/server": "^2.0.0",
     "commander": "^15.0.0",
     "zod": "^4.6.5",
-    "@agentcomms/core": "0.12.2"
+    "@agentcomms/core": "0.12.3"
   },
   "agentcomms": {
     "contract": 1,
@@ -87,5 +87,5 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --disable-warning=ExperimentalWarning --test --test-timeout=600000 \"test/**/*.test.ts\""
   },
-  "gitHead": "224763228ecc63ce403f0d12988865cfaa981f2a"
+  "gitHead": "1945e1e3a0532c20d3da33ad9f84ceeda88c30a2"
 }