@agentcomms/whatsapp 0.17.0 → 0.18.1

package/dist/{sync-7LwbofMr.mjs → sync-q1U9jYX3.mjs}

@@ -11,7 +11,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.17.0";
+const VERSION$1 = "0.18.1";
 //#endregion
 //#region src/caller.ts
 /** This package's name, as its manifest has it. */
@@ -28,7 +28,7 @@ const CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-XMsGuXRl.mjs
+//#region ../core/dist/update-check-DvZxdFU_.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -1139,6 +1139,24 @@ const CHANNEL_SNAPSHOT = [
 		}
 	}
 ];
+/** Every declared service server: what core knows about it without installing it. */
+const SERVICE_SNAPSHOT = [{
+	packageName: "@agentcomms/events-daemon",
+	declaration: {
+		kind: "service",
+		binary: "agent-events",
+		server: {
+			defaultName: "events",
+			entry: "src/mcp/server.ts",
+			factory: "createEventsMcpServer"
+		},
+		operations: "src/operations",
+		skills: {
+			prefix: "agentcomms-",
+			contract: "skills/_shared/contract-events.md"
+		}
+	}
+}];
 const DISCLOSURE_VERSION_KINDS = [
 	"rule",
 	"target",
@@ -1326,8 +1344,8 @@ function bindingDigestOf(record) {
 * Everywhere but Windows that shell is a POSIX one, and a word goes in single quotes, inside which nothing is special
 * but the quote itself. Windows has two shells, and neither reads single quotes that way: cmd.exe does not take them
 * as quotes at all, so `'C:\Profiles\First Last\outgoing'` reached the command as two words, quote marks and all, and
-* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A command printed on Windows
-* has to be safe in both, because nothing says which one it will be pasted into (CUE-306) — and safe is not enough:
+* PowerShell does, but escapes a quote inside them by doubling it rather than as `'\''`. A common line printed on
+* Windows has to be safe in both — and safe is not enough:
 * the program has to receive the same words from either. Three readers stand between the line and the program. cmd.exe
 * hands the program the line as it is, and the program's own parser (the C runtime's, Node's) splits it. PowerShell
 * reads the line itself, a double-quoted word with its backslashes as plain characters, and then writes a new command
@@ -1354,15 +1372,17 @@ function bindingDigestOf(record) {
 *   backslash, which the C runtime reads with the closing quote as `\"` — and doubled for it, PowerShell 7 passes both
 *   backslashes on where cmd.exe and Windows PowerShell pass one; and a word with `& | < > ^ ( )` but no whitespace,
 *   which PowerShell passes to a `.cmd` script unquoted, for cmd.exe to run `&whoami` from or to split at `|`.
-* - With any other word in it, no line is printed at all (`line` is null), and the printers show the command's words
+* - With any other word in it, the common renderer has no line, and the printers show the command's words
 *   as JSON instead, saying it has to be typed. Not a line with the word left out: a placeholder in its place was
 *   still a command that ran — `claude mcp remove NAME` removed whatever entry was called `NAME`, and an install
 *   hint's `--force` replaced it — and before that, a word quoted for PowerShell's single quotes, which cmd.exe reads
 *   as characters, ran `whoami` from a server named `$x&whoami&`. See `commandAsJson` for why the JSON runs nothing.
 *
-* - The program itself has to be left as it is. Quoted, it is a string to PowerShell rather than a command — PowerShell
-*   runs a quoted program only after `&`, which cmd.exe reads as the end of a command — so a program whose path needs
-*   quotes, as `C:\Program Files\nodejs\node.exe` does, leaves the command with no line either (CUE-403).
+* - The program itself has to be left as it is in the common form. Quoted, it is a string to PowerShell rather than a
+*   command. When its path needs quoting, CUE-410 may emit a labelled PowerShell line: `&`, then every word in single
+*   quotes, with an inner single quote doubled. Empty words, trailing backslashes, double quotes and control or
+*   formatting characters retain the inert-JSON fallback because their native-program boundary cannot be proved
+*   across the supported PowerShell versions.
 *
 * Everywhere else there is always a line: single quotes make any word safe.
 *
@@ -1378,9 +1398,23 @@ function quoteCommand(words, platform) {
 	};
 	const printed = words.map(windowsShellWord);
 	const programBare = words.length === 0 || printed[0] === words[0];
+	if (!printed.includes(null) && programBare) return {
+		words,
+		line: printed.join(" "),
+		platform
+	};
+	if (!programBare && printed.slice(1).every((word) => word !== null)) {
+		const powershell = words.map(powerShellWord);
+		if (!powershell.includes(null)) return {
+			words,
+			line: `& ${powershell.join(" ")}`,
+			platform,
+			shell: "powershell"
+		};
+	}
 	return {
 		words,
-		line: printed.includes(null) || !programBare ? null : printed.join(" "),
+		line: null,
 		platform
 	};
 }
@@ -1393,6 +1427,14 @@ function quotedLineWithWordsToFill(command, ...toFill) {
 	if (command.line === null) return null;
 	const sentinel = command.words.indexOf("--");
 	if (sentinel < 0) return [command.line, ...toFill].join(" ");
+	if (command.shell === "powershell") {
+		const printed = command.words.map((each) => powerShellWord(each));
+		return `& ${[
+			...printed.slice(0, sentinel),
+			...toFill,
+			...printed.slice(sentinel)
+		].join(" ")}`;
+	}
 	const word = command.platform === "win32" ? windowsShellWord : posixShellWord;
 	const printed = command.words.map((each) => word(each));
 	return [
@@ -1420,6 +1462,11 @@ function windowsShellWord(word) {
 	if (/[&|<>^()]/.test(word) && !/\s/.test(word)) return null;
 	return `"${word}"`;
 }
+/** One native-command word in a PowerShell single-quoted literal, or null when a one-line call is not provable. */
+function powerShellWord(word) {
+	if (word === "" || word.endsWith("\\") || /["\u201C-\u201E]|[\p{C}\p{Zl}\p{Zp}]/u.test(word)) return null;
+	return `'${word.replaceAll("'", "''")}'`;
+}
 /**
 * The words of a command as a JSON array, for a command that cannot be printed as a line: something to read, and to
 * parse, and nothing to run.
@@ -1450,17 +1497,19 @@ function commandAsJson(words) {
 /** What is said beside a command shown as JSON. */
 const TO_TYPE = "the command's words, written as JSON: one of them cannot be quoted the same way for cmd.exe and for PowerShell, so type the command yourself, with that word quoted for the shell you use";
 /** What is said beside a command shown as JSON because its program's path needs quotes. */
-const TO_TYPE_PROGRAM = "the command's words, written as JSON: the program's path needs quotes, and PowerShell runs a quoted program only after `&`, which cmd.exe does not accept, so type the command yourself, with each word quoted for the shell you use and, in PowerShell, `&` before the program";
+const TO_TYPE_PROGRAM = "the command's words, written as JSON: the program's path needs quoting and at least one word cannot be represented safely in a one-line PowerShell call, so type the command yourself, with each word quoted for the shell you use and, in PowerShell, `&` before the program";
 function toType(command) {
 	return programNeedsQuotes(command) ? TO_TYPE_PROGRAM : TO_TYPE;
 }
 /** Quoted words in backticks, for a sentence — as words in JSON, saying it has to be typed, when there is no line. */
 function inlineQuoted(command) {
-	return command.line === null ? `\`${commandAsJson(command.words)}\` (${toType(command)})` : `\`${command.line}\``;
+	if (command.line === null) return `\`${commandAsJson(command.words)}\` (${toType(command)})`;
+	return `\`${command.line}\`${command.shell === "powershell" ? " (PowerShell)" : ""}`;
 }
 /** Quoted words as text of their own — a list's line, a field's value — or as words in JSON, saying to type them. */
 function quotedText(command) {
-	return command.line === null ? `${commandAsJson(command.words)} (${toType(command)})` : command.line;
+	if (command.line === null) return `${commandAsJson(command.words)} (${toType(command)})`;
+	return command.shell === "powershell" ? `PowerShell:\n${command.line}` : command.line;
 }
 /**
 * The same command with words the agent is to fill in — a placeholder such as `<folder>` — before its first `--`: for
@@ -1924,7 +1973,7 @@ function handoffSentence(handoff, say, options = {}) {
 function handoffSentenceToFill(handoff, toFill, say, options = {}) {
 	if (!isCommand(handoff)) return noCommand(handoff, options);
 	const line = lineWithWordsToFill(handoff, ...toFill);
-	if (line !== null) return say(`\`${line}\``);
+	if (line !== null) return say(`\`${line}\`${handoff.shell === "powershell" ? " (PowerShell)" : ""}`);
 	return say(inlineQuoted(quotedWithWordsToFill(handoff, toFill)));
 }
 /**
@@ -2124,7 +2173,7 @@ function nearestPackage(start) {
 * Whether `path` is `root` or inside it, by whole path segments: `/x/core-evil` is not inside `/x/core`, which a
 * comparison of strings would say it was. Both are taken as given; a caller compares real paths with real paths.
 */
-function isWithin(root, path) {
+function isWithin$1(root, path) {
 	const between = relative(resolve(root), resolve(path));
 	return between === "" || !isAbsolute(between) && between !== ".." && !/^\.\.[\\/]/.test(between);
 }
@@ -2194,15 +2243,18 @@ var ExternalCommand = class {
 	#reason;
 	/** The words, as the program is to receive them. */
 	words;
-	/** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+	/** The line to paste; null when no supported common or labelled shell rendering is safe. */
 	line;
 	platform;
+	shell;
 	constructor(gate, words, platform, reason) {
 		if (gate !== GATE$1) throw new TypeError("an external command is made by externalCommand, and only there");
 		this.#reason = reason;
 		this.words = Object.freeze([...words]);
-		this.line = quoteCommand(this.words, platform).line;
+		const quoted = quoteCommand(this.words, platform);
+		this.line = quoted.line;
 		this.platform = platform;
+		if (quoted.shell !== void 0) this.shell = quoted.shell;
 		Object.freeze(this);
 	}
 	/** Why this program, which is not part of this suite, is one a person may be told to run. */
@@ -2916,6 +2968,343 @@ function commandLinePackage(command, args) {
 	const line = [command, ...withoutPathOptions(args).words].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
+const RECEIPT_VERSION = 1;
+const RECEIPT_FILE = "managed-shims.json";
+const MUTATION_LOCK_FILE = "managed-shims.lock";
+const POSIX_SHIM_MODE = 493;
+const WINDOWS_SHIM_NOTICE = "Managed CLI shims are not offered on Windows yet because cmd.exe re-parses arguments forwarded through .cmd files, including shell metacharacters. Use the full-path command or the labelled PowerShell & line the result provides.";
+function platformOf(context) {
+	return context.platform ?? process.platform;
+}
+/** Why the selected platform has no managed shim in this release. */
+function managedShimUnsupportedNotice(context = {}) {
+	return platformOf(context) === "win32" ? WINDOWS_SHIM_NOTICE : "Managed CLI shims are offered only on macOS and Linux in this release. Use the full-path command the result provides.";
+}
+/** The per-user directory managed installs put their command shims in. */
+function managedShimDirectory(context) {
+	if (!managedShimsSupported(context)) throw new CommsError("CONFIG", managedShimUnsupportedNotice(context));
+	return join(homeDirectory(context.env), ".local", "bin");
+}
+/** Managed CLI shims are POSIX-only until Windows has an argument-forwarding form that does not re-parse input. */
+function managedShimsSupported(context = {}) {
+	const platform = platformOf(context);
+	return platform === "darwin" || platform === "linux";
+}
+/** A managed shim's name: one plain command word, never a path, so joining it to the directory stays inside it. */
+function isSafeBinary(binary) {
+	return /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(binary);
+}
+function checkedBinary(binary) {
+	if (!isSafeBinary(binary)) throw new CommsError("CONFIG", `${JSON.stringify(binary)} is not a safe managed CLI binary name`);
+	return binary;
+}
+/** The exact path for one declared binary's managed shim. */
+function managedShimPath(context, binary) {
+	return join(managedShimDirectory(context), checkedBinary(binary));
+}
+function receiptPath(context) {
+	return join(context.dataDir, RECEIPT_FILE);
+}
+function emptyReceipt() {
+	return {
+		version: RECEIPT_VERSION,
+		shims: {}
+	};
+}
+async function readReceipt(context) {
+	let parsed;
+	try {
+		parsed = JSON.parse(await readFile(receiptPath(context), "utf8"));
+	} catch (error) {
+		return error.code === "ENOENT" ? emptyReceipt() : null;
+	}
+	if (typeof parsed !== "object" || parsed === null || parsed.version !== RECEIPT_VERSION || typeof parsed.shims !== "object" || parsed.shims === null) return null;
+	const shims = {};
+	for (const [binary, value] of Object.entries(parsed.shims)) {
+		if (!isSafeBinary(binary) || typeof value !== "object" || value === null || ![
+			"path",
+			"digest",
+			"node",
+			"entry"
+		].every((key) => typeof value[key] === "string")) return null;
+		shims[binary] = value;
+	}
+	return {
+		version: RECEIPT_VERSION,
+		shims
+	};
+}
+async function writeReceipt(context, receipt) {
+	await writeFileAtomic(receiptPath(context), `${JSON.stringify(receipt, null, 2)}\n`);
+}
+function sha256(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+function posixWord(word) {
+	return `'${word.replaceAll("'", `'"'"'`)}'`;
+}
+function shimSource(spec) {
+	return `#!/bin/sh\n# managed CLI shim v1\nexec ${spec.command.map(posixWord).join(" ")} "$@"\n`;
+}
+async function pinShimDirectory(context, create) {
+	const publicDirectory = managedShimDirectory(context);
+	if (create) await mkdir(publicDirectory, {
+		recursive: true,
+		mode: 493
+	});
+	let resolved;
+	try {
+		resolved = await realpath(publicDirectory);
+	} catch (error) {
+		if (!create && error.code === "ENOENT") return null;
+		throw error;
+	}
+	return {
+		public: publicDirectory,
+		resolved
+	};
+}
+async function assertPinnedDirectory(directory) {
+	let now;
+	try {
+		now = await realpath(directory.public);
+	} catch {
+		throw new CommsError("CONFIG", `the managed shim directory's resolved directory changed from ${directory.resolved} during the operation`, { hint: "Nothing was changed. Inspect the directory link, then run the install, update or prune again." });
+	}
+	if (now !== directory.resolved) throw new CommsError("CONFIG", `the managed shim directory's resolved directory changed from ${directory.resolved} to ${now} during the operation`, { hint: "Nothing was changed. Inspect the directory link, then run the install, update or prune again." });
+}
+async function regularFileBytes(path) {
+	try {
+		if (!(await lstat(path)).isFile()) return null;
+		return await readFile(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function pathExists(path) {
+	try {
+		await lstat(path);
+		return true;
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+/** Serialize this installation's receipt and shim mutations across its processes. */
+async function withMutationLock(context, change) {
+	await mkdir(context.dataDir, {
+		recursive: true,
+		mode: 448
+	});
+	return withFileLock(join(context.dataDir, MUTATION_LOCK_FILE), change, {
+		timeoutMs: 5e3,
+		staleMs: 3e4,
+		renewMs: 1e4,
+		...context.lockOptions
+	});
+}
+/** Publish complete shim bytes only if the target is still absent. */
+async function createShimExclusive(directory, path, source) {
+	const nonce = randomBytes(6).toString("hex");
+	const temp = join(directory.resolved, `.${basename(path)}.${nonce}.tmp`);
+	await assertPinnedDirectory(directory);
+	const handle = await open(temp, "wx", POSIX_SHIM_MODE);
+	try {
+		await handle.writeFile(source);
+		await handle.sync();
+	} finally {
+		await handle.close();
+	}
+	await assertPinnedDirectory(directory);
+	await chmod(temp, POSIX_SHIM_MODE);
+	try {
+		await assertPinnedDirectory(directory);
+		await link(temp, path);
+	} finally {
+		await assertPinnedDirectory(directory);
+		await rm(temp, { force: true });
+	}
+}
+/** Restore an object moved aside without ever replacing a raced object at its public path. */
+async function restoreMoved(directory, path, moved) {
+	try {
+		await assertPinnedDirectory(directory);
+		await link(moved, path);
+	} catch (error) {
+		if (error.code === "EEXIST") return false;
+		throw error;
+	}
+	await assertPinnedDirectory(directory);
+	await rm(moved);
+	return true;
+}
+/**
+* Move the exact current object aside atomically, then prove that object still has the owned digest. A raced foreign
+* file is put back; if another object has already occupied its path, both are preserved and the change is refused.
+*/
+async function moveOwned(directory, path, digest, suffix, before) {
+	await before?.(path);
+	await assertPinnedDirectory(directory);
+	const moved = join(directory.resolved, `.${basename(path)}.${randomBytes(6).toString("hex")}.${suffix}`);
+	try {
+		await rename(path, moved);
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	const bytes = await regularFileBytes(moved);
+	if (bytes !== null && sha256(bytes) === digest) return moved;
+	if (!await restoreMoved(directory, path, moved)) throw new CommsError("CONFIG", `${path} changed during a managed shim operation; its bytes were preserved at ${moved}`, { hint: "Resolve the two files by hand, then run the install, update or prune again." });
+	return null;
+}
+/** Remove only the exact object whose bytes prove it is still owned. */
+async function removeOwned(directory, path, digest, before) {
+	const moved = await moveOwned(directory, path, digest, "remove", before);
+	if (moved === null) return false;
+	await assertPinnedDirectory(directory);
+	await rm(moved);
+	return true;
+}
+function normalPath(path, platform) {
+	const trimmed = path.replace(/[\\/]+$/, "");
+	return platform === "win32" ? trimmed.toLowerCase() : trimmed;
+}
+function directoryOnPath(context, directory) {
+	const platform = platformOf(context);
+	const value = context.env.PATH ?? context.env.Path ?? "";
+	const separator = platform === "win32" ? ";" : ":";
+	return value.split(separator).filter(Boolean).some((part) => normalPath(part, platform) === normalPath(directory, platform));
+}
+function pathNotice(directory) {
+	return `The shim directory ${directory} is not on PATH. For this shell, run: export PATH=${posixWord(directory)}:"$PATH". No shell profile was edited.`;
+}
+/** Create or repoint one shim, but only while its target is free or still matches this installation's receipt. */
+async function writeManagedShim(context, spec) {
+	checkedBinary(spec.binary);
+	const directory = await pinShimDirectory(context, true);
+	if (directory === null) throw new CommsError("UNEXPECTED", "the managed shim directory was not created");
+	const publicPath = join(directory.public, spec.binary);
+	const path = join(directory.resolved, spec.binary);
+	const result = (status) => {
+		const onPath = directoryOnPath(context, directory.public);
+		return {
+			path: publicPath,
+			directory: directory.public,
+			status,
+			onPath,
+			...onPath ? {} : { pathNotice: pathNotice(directory.public) }
+		};
+	};
+	return withMutationLock(context, async () => {
+		const receipt = await readReceipt(context);
+		const recorded = receipt?.shims[spec.binary];
+		const current = await regularFileBytes(path);
+		const owned = receipt !== null && recorded !== void 0 && recorded.path === path && current !== null && sha256(current) === recorded.digest;
+		if (await pathExists(path) && !owned) return result("foreign");
+		if (receipt === null || recorded !== void 0 && recorded.path !== path) return result("foreign");
+		const node = spec.command[0];
+		if (node === void 0) throw new CommsError("CONFIG", "the managed shim command has no program");
+		const source = shimSource(spec);
+		const digest = sha256(source);
+		let previous = null;
+		if (owned) {
+			previous = await moveOwned(directory, path, recorded.digest, "old", context.hooks?.beforeReplace);
+			if (previous === null) return result("foreign");
+		}
+		try {
+			await createShimExclusive(directory, path, source);
+		} catch (error) {
+			if (previous !== null) {
+				if (!await restoreMoved(directory, path, previous)) throw new CommsError("CONFIG", `${path} was occupied while its owned shim was being updated; the old shim remains at ${previous}`, {
+					hint: "Resolve the two files by hand, then run the managed install again.",
+					cause: error
+				});
+			}
+			if (error.code === "EEXIST") return result("foreign");
+			throw error;
+		}
+		receipt.shims[spec.binary] = {
+			path,
+			digest,
+			node,
+			entry: spec.entry
+		};
+		try {
+			await assertPinnedDirectory(directory);
+			await writeReceipt(context, receipt);
+		} catch (error) {
+			const removed = await removeOwned(directory, path, digest);
+			if (previous !== null && removed && !await restoreMoved(directory, path, previous)) throw new CommsError("CONFIG", `the shim receipt failed and the old shim could not be restored from ${previous}`, {
+				hint: "Restore that file to the reported shim path, then run the managed install again.",
+				cause: error
+			});
+			throw error;
+		}
+		if (previous !== null) {
+			await assertPinnedDirectory(directory);
+			await rm(previous);
+		}
+		return result(owned ? "updated" : "created");
+	});
+}
+function isWithin(root, path) {
+	const child = relative(root, path);
+	return child === "" || !child.startsWith("..") && !isAbsolute(child);
+}
+/** Remove unchanged owned shims whose recorded entry is inside one of the runtimes prune removed. */
+async function removeManagedShimsForRuntimes(context, runtimes, options = {}) {
+	if (!managedShimsSupported(context)) return {
+		removed: [],
+		kept: []
+	};
+	const directory = await pinShimDirectory(context, false);
+	if (directory === null) return {
+		removed: [],
+		kept: []
+	};
+	return withMutationLock(context, async () => {
+		const receipt = await readReceipt(context);
+		if (receipt === null) return {
+			removed: [],
+			kept: []
+		};
+		const removed = [];
+		const kept = [];
+		let changed = false;
+		for (const [binary, recorded] of Object.entries(receipt.shims)) {
+			if (!runtimes.some((runtime) => isWithin(runtime, recorded.entry))) continue;
+			const publicPath = join(directory.public, binary);
+			const path = join(directory.resolved, binary);
+			if (recorded.path !== path) {
+				kept.push(recorded.path);
+				continue;
+			}
+			if (options.dryRun) {
+				const bytes = await regularFileBytes(path);
+				if (bytes !== null && sha256(bytes) === recorded.digest) removed.push(publicPath);
+				else if (await pathExists(path)) kept.push(publicPath);
+				continue;
+			}
+			if (await removeOwned(directory, path, recorded.digest, context.hooks?.beforeRemove)) {
+				delete receipt.shims[binary];
+				changed = true;
+				removed.push(publicPath);
+			} else if (!await pathExists(path)) {
+				delete receipt.shims[binary];
+				changed = true;
+			} else kept.push(publicPath);
+		}
+		if (changed) {
+			await assertPinnedDirectory(directory);
+			await writeReceipt(context, receipt);
+		}
+		return {
+			removed,
+			kept
+		};
+	});
+}
 /**
 * The programs this package starts, named so that no folder it happens to be in can stand in for them.
 *
@@ -4032,8 +4421,8 @@ async function mergeIntoJsonConfig(path, client, name, entry) {
 }
 /** Starts the server exactly as a client would, and completes the handshake. */
 async function verifyEntry(entry, product) {
-	const { Client } = await import("./dist-COPefvtq-COGS2a-K.mjs");
-	const { StdioClientTransport } = await import("./stdio-CHZ2WRcx-B2_wGdA5.mjs");
+	const { Client } = await import("./dist-C7DG2LdL-l0mj9_dH.mjs");
+	const { StdioClientTransport } = await import("./stdio-CyjIgrch-59zcjSEt.mjs");
 	const client = new Client({
 		name: `${product.binary}-install-check`,
 		version: product.version
@@ -4088,6 +4477,14 @@ function commandLinesFrom(ps) {
 	});
 }
 const RUNTIME_NAME = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]*)?$/;
+/** Whether a runtime's own manifest, the one the installer writes, names this package as what it installs. */
+async function pinsPackage(runtime, packageName) {
+	try {
+		return typeof JSON.parse(await readFile(join(runtime, "package.json"), "utf8")).dependencies?.[packageName] === "string";
+	} catch {
+		return false;
+	}
+}
 /**
 * This product's managed runtimes on disk, oldest name first: every directory directly inside `<data>/runtime`,
 * named like a version, that holds this product's package — never a symbolic link, never another product's runtime,
@@ -4116,6 +4513,7 @@ async function listManagedRuntimes(dataDir, packageName) {
 		} catch {
 			continue;
 		}
+		if (!name.endsWith(suffix) && !await pinsPackage(path, packageName)) continue;
 		found.push({
 			path,
 			version: name.endsWith(suffix) ? name.slice(0, -suffix.length) : name
@@ -4158,7 +4556,11 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 		runtimeDir: join(context.core.paths.dataDir, "runtime"),
 		dryRun: options.dryRun === true,
 		removed: [],
-		kept: []
+		kept: [],
+		shims: {
+			removed: [],
+			kept: []
+		}
 	};
 	const candidates = [];
 	for (const { path, version } of await listManagedRuntimes(context.core.paths.dataDir, product.packageName)) {
@@ -4225,6 +4627,11 @@ async function pruneManagedRuntimes(context, product, options = {}) {
 		const left = handedOut.filter((record) => !gone.some((path) => mentions([path], record.runtime)));
 		if (left.length !== handedOut.length) await writeFileAtomic(ledger, left.map((record) => `${JSON.stringify(record)}\n`).join(""));
 	}
+	if (result.removed.length > 0) result.shims = await removeManagedShimsForRuntimes({
+		env: context.env,
+		dataDir: context.core.paths.dataDir,
+		platform: context.platform
+	}, result.removed.map((item) => item.path), { dryRun: result.dryRun });
 	return result;
 }
 /** Every runtime the installer handed out, or null when the record is there and cannot be read. */
@@ -4357,6 +4764,8 @@ function rivalWordWarnings(servers, word, can, product) {
 }
 /** Every channel in core's snapshot, the core first. */
 const CHANNELS = Object.freeze(CHANNEL_SNAPSHOT.map((entry) => entry.manifest.channel));
+/** Every declared MCP server, channels first and then services, with no separate hand-kept list. */
+const SERVERS = Object.freeze([...CHANNELS, ...SERVICE_SNAPSHOT.map((entry) => entry.declaration.server.defaultName)]);
 /**
 * The value a pin's flag carries in an entry's arguments: `--account acme/resend`, or `--account=acme/resend` — the
 * first given, in either form.
@@ -4417,8 +4826,28 @@ function serverFactsOf({ packageName, manifest }) {
 	};
 }
 const CHANNEL_SERVERS = Object.freeze(Object.fromEntries(CHANNEL_SNAPSHOT.map((entry) => [entry.manifest.channel, serverFactsOf(entry)])));
+/** Service server facts, derived from each service package's declaration. */
+const SERVICE_SERVERS = Object.freeze(Object.fromEntries(SERVICE_SNAPSHOT.map(({ packageName, declaration }) => [declaration.server.defaultName, {
+	packageName,
+	binary: declaration.binary,
+	defaultServerName: declaration.server.defaultName,
+	npxPackage: packageName,
+	npxArgs: ["mcp"],
+	serverArgs: () => [],
+	narrowingOf: () => ({})
+}])));
+/** All managed servers, derived from channel manifests and service declarations. */
+const SERVERS_BY_ID = Object.freeze({
+	...CHANNEL_SERVERS,
+	...SERVICE_SERVERS
+});
 /** How each server is named to a person: in a preview, and in what a tool returns. */
 const CHANNEL_LABELS = Object.freeze(Object.fromEntries(CHANNEL_SNAPSHOT.map((entry) => [entry.manifest.channel, entry.manifest.label])));
+/** Labels for every managed server; a service declares its public server name. */
+const SERVER_LABELS = Object.freeze({
+	...CHANNEL_LABELS,
+	...Object.fromEntries(SERVICE_SNAPSHOT.map(({ declaration }) => [declaration.server.defaultName, declaration.server.defaultName]))
+});
 /** A channel's manifest, from core's snapshot. */
 function channelManifest(channel) {
 	return CHANNEL_SNAPSHOT.find((entry) => entry.manifest.channel === channel)?.manifest;
@@ -4426,19 +4855,32 @@ function channelManifest(channel) {
 function isChannel(value) {
 	return typeof value === "string" && CHANNELS.includes(value);
 }
+/** Whether a word identifies any channel or service server in this release. */
+function isServer(value) {
+	return typeof value === "string" && SERVERS.includes(value);
+}
 /** Refuses a word that is not a channel of this release, naming the ones that are. */
 function notAChannel(value) {
 	return new CommsError("USAGE", `"${String(value)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 }
+/** Refuses a word that is not a declared server of this release. */
+function notAServer(value) {
+	return new CommsError("USAGE", `"${String(value)}" is not a server`, { hint: `One of: ${SERVERS.join(", ")}.` });
+}
 /** A channel's server facts, by its word; refused for a word that is not a channel. */
 function channelServer(channel) {
 	if (!isChannel(channel)) throw notAChannel(channel);
 	return CHANNEL_SERVERS[channel];
 }
-/** How a channel's server is named to a person, by its word; refused for a word that is not a channel. */
-function channelLabel(channel) {
-	if (!isChannel(channel)) throw notAChannel(channel);
-	return CHANNEL_LABELS[channel];
+/** A channel or service's server facts, by its declared server name. */
+function serverFacts(server) {
+	if (!isServer(server)) throw notAServer(server);
+	return SERVERS_BY_ID[server];
+}
+/** How a channel or service server is named to a person. */
+function serverLabel(server) {
+	if (!isServer(server)) throw notAServer(server);
+	return SERVER_LABELS[server];
 }
 /** A channel's manifest, by its word; refused for a word that is not a channel. */
 function requireChannelManifest(channel) {
@@ -8862,7 +9304,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.17.0";
+const VERSION = "0.18.1";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -8998,15 +9440,18 @@ var PrintedCommand = class {
 	#entry;
 	/** The words, as the program is to receive them: this Node, its flags, the entry, then the CLI's own words. */
 	words;
-	/** The line to paste; null when one of the words has no printing that every Windows shell passes on alike. */
+	/** The line to paste; null when no supported common or labelled shell rendering is safe. */
 	line;
 	platform;
+	shell;
 	constructor(gate, words, platform, entry) {
 		if (gate !== GATE) throw new TypeError("a printed command is made by locateCliCommand, and only there");
 		this.#entry = entry;
 		this.words = Object.freeze([...words]);
-		this.line = quoteCommand(this.words, platform).line;
+		const quoted = quoteCommand(this.words, platform);
+		this.line = quoted.line;
 		this.platform = platform;
+		if (quoted.shell !== void 0) this.shell = quoted.shell;
 		Object.freeze(this);
 	}
 	/**
@@ -9033,7 +9478,7 @@ const STRIP_TYPES = "--experimental-strip-types";
 const TRANSFORM_TYPES = "--experimental-transform-types";
 /** The suite's packages, by name, and its channel packages, which reach core through their own dependency on it. */
 const SUITE_PACKAGES = new Set(CHANNEL_SNAPSHOT.map(({ packageName }) => packageName));
-const CHANNEL_PACKAGES$1 = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manifest.channel !== "core").map(({ packageName }) => packageName));
+const CHANNEL_PACKAGES = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manifest.channel !== "core").map(({ packageName }) => packageName));
 /**
 * Locates the command that runs `request.target`'s CLI with `request.words`, or says why there is none.
 *
@@ -9116,7 +9561,7 @@ function locateCliCommand(request, runtime = {
 			sameCheckout: true
 		});
 	}
-	if (target.manifest.channel === "core" && CHANNEL_PACKAGES$1.has(caller.packageName)) {
+	if (target.manifest.channel === "core" && CHANNEL_PACKAGES.has(caller.packageName)) {
 		const installed = installedPackage(dirname(callerFile), target.packageName);
 		if (installed === null) return fail("core", `${caller.packageName} has no ${target.packageName} installed where it can find one`);
 		const manifest = readPackageManifest(installed);
@@ -9144,7 +9589,9 @@ function locateCliCommand(request, runtime = {
 	}
 	if (!SUITE_PACKAGES.has(caller.packageName)) return fail("direction", `${caller.packageName} is not a package of this suite`);
 	if (request.registrations === void 0) return fail("no-registrations", "nothing registered was given to look through for another product's command");
-	const facts = registrationFactsOf(target);
+	const channelTarget = CHANNEL_SNAPSHOT.find((entry) => entry.packageName === target.packageName);
+	if (channelTarget === void 0) return fail("direction", `${target.packageName} is not a channel package this locator can find through a registration`);
+	const facts = registrationFactsOf(channelTarget);
 	const notUsed = [];
 	const usable = [];
 	let engineRange;
@@ -9242,8 +9689,7 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	let entry;
 	if (found.source) entry = join(found.root, "src", "cli.ts");
 	else {
-		const declared = found.manifest.agentcomms;
-		const binary = typeof declared === "object" && declared !== null ? declared.binary : void 0;
+		const binary = declaredBinary(found.manifest);
 		const bin = found.manifest.bin;
 		const path = binary === target.manifest.binary && typeof bin === "object" && bin !== null && Object.hasOwn(bin, target.manifest.binary) ? bin[target.manifest.binary] : void 0;
 		if (typeof path !== "string" || path.length === 0) return {
@@ -9272,6 +9718,16 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	};
 }
 /**
+* The command a package declares for itself: a channel's in its `agentcomms` field, a service's in `agentcommsPackage`
+* (D14). A library declares none, and no package declares both: the registry refuses one that does.
+*/
+function declaredBinary(manifest) {
+	const channel = manifest.agentcomms;
+	if (typeof channel === "object" && channel !== null) return channel.binary;
+	const service = manifest.agentcommsPackage;
+	if (typeof service === "object" && service !== null && service.kind === "service") return service.binary;
+}
+/**
 * The target's package a registration's files lead to, or null: a script it starts, real or as written when it is
 * gone, inside the package (or inside the product's own server wrapper, which depends on it); or, for the product's
 * own command, the package that command links into or that npm installed beside it.
@@ -9403,7 +9859,7 @@ function notLocated(target, version, reason, detail, nodeVersion, extra) {
 * anywhere else for the product, PATH included, and a later locate checks the path again.
 */
 function checkedEntry(root, entry) {
-	if (!isWithin(root, entry)) return {
+	if (!isWithin$1(root, entry)) return {
 		ok: false,
 		why: `${entry} is outside its package, ${root}`
 	};
@@ -9416,7 +9872,7 @@ function checkedEntry(root, entry) {
 			why: `${entry} is not there`
 		};
 	}
-	if (!isWithin(root, real)) return {
+	if (!isWithin$1(root, real)) return {
 		ok: false,
 		why: `${entry} leads to ${real}, outside its package, ${root}`
 	};
@@ -9751,6 +10207,10 @@ function renderInstall(result, color) {
 		lines.push(paint(color, "bold", `Add this to ${result.configPath ?? `the MCP configuration of ${result.client}`}:`), result.snippet.trimEnd());
 	}
 	if (result.backupPath) lines.push(`The entry it replaced was saved to ${result.backupPath}.`);
+	if (result.shim && result.shim.status !== "foreign") lines.push(`CLI shim ${result.shim.status}: ${result.shim.path}.`);
+	if (result.shimFailure) lines.push(paint(color, "yellow", `CLI shim failed: ${result.shimFailure}.`));
+	if (result.shimNotice) lines.push(paint(color, "yellow", result.shimNotice));
+	if (result.shim?.pathNotice) lines.push(result.shim.pathNotice);
 	if (result.verification === "passed") lines.push(paint(color, "green", `Checked: ${result.verifyDetail}`));
 	else if (result.verification === "failed") {
 		lines.push(paint(color, "red", `Failed to start: ${result.verifyDetail ?? "no reason given"}`));
@@ -9765,6 +10225,8 @@ function renderPrune(result, color) {
 	if (result.refused) lines.push(paint(color, "yellow", `Nothing removed: ${result.refused}.`));
 	const verb = result.dryRun ? "Would remove" : "Removed";
 	for (const item of result.removed) lines.push(paint(color, "green", `${verb} ${item.version}: ${item.path}`));
+	for (const path of result.shims.removed) lines.push(paint(color, "green", `${verb} CLI shim: ${path}`));
+	for (const path of result.shims.kept) lines.push(`Kept foreign CLI shim: ${path}`);
 	for (const item of result.kept) lines.push(`Kept ${item.version} (${item.reason}): ${item.path}`);
 	if (lines.length === 0) lines.push(`No managed runtimes to remove in ${result.runtimeDir}.`);
 	return lines.join("\n");
@@ -10857,10 +11319,10 @@ strictObject({
 	sha256: string().regex(/^[0-9a-f]{64}$/, "a SHA-256 is 64 lowercase hex digits")
 });
 /**
-* Registering, pruning and listing the MCP servers of every channel, from the core.
+* Registering, pruning and listing every declared channel or service MCP server, from the core.
 *
-* `agentcomms mcp install` registers the core server; `comms_server_install` registers any channel's; and
-* `agent-gmail mcp install` and `agent-slack mcp install` register their own. All four are the one change here, over
+* `agentcomms mcp install` registers core or a declared service; `comms_server_install` registers any declared
+* server; and channel CLIs register their own. They are the one change here, over
 * the shared installer (`mcp-install.ts`), and all go through the change flow: registering a server is a loosening in
 * the design's terms (§3.1) — it hands a client a new set of tools — and so is asked for once and applied on the
 * second call with the approval. Printing an entry registers nothing and asks nobody.
@@ -10871,7 +11333,7 @@ strictObject({
 * the other — or worse, a channel's own command would register with no approval at all, which is what it did.
 *
 * The version installed is this core's own, or the calling channel's when it passes its product. The packages are
-* released together, at one version, so the core that is asked to install Gmail installs the Gmail of its own release.
+* released together, at one version, so the core asked to install Gmail or events installs its own release.
 */
 const CLIENTS = Object.freeze([
 	"claude-code",
@@ -10912,10 +11374,10 @@ const exists = (path) => access(path, constants.R_OK).then(() => true, () => fal
 * core depends on none of them. So the channel is looked for beside this core — `packages/gmail` next to
 * `packages/core` in a checkout — and from source when this core runs from source, as the channel CLIs do.
 */
-async function localModuleUrl(channel) {
+async function localModuleUrl(server) {
 	const coreRoot = await corePackageRoot();
-	const unscopedName = channelServer(channel).packageName.split("/").at(-1) ?? channel;
-	const root = channel === "core" ? coreRoot : join(dirname(coreRoot), unscopedName);
+	const unscopedName = serverFacts(server).packageName.split("/").at(-1) ?? server;
+	const root = server === "core" ? coreRoot : join(dirname(coreRoot), unscopedName);
 	const source = join(root, "src", "cli.ts");
 	const built = join(root, "dist", "cli.mjs");
 	const fromSource = fileURLToPath(import.meta.url).endsWith(".ts");
@@ -10923,7 +11385,7 @@ async function localModuleUrl(channel) {
 		if (!await exists(cli)) continue;
 		return pathToFileURL(cli === source ? join(root, "src", "mcp", "module.ts") : join(root, "dist", "module.mjs")).href;
 	}
-	throw new CommsError("USAGE", `\`--launcher local\` registers a checkout's own code, and there is no ${channelServer(channel).packageName} beside this one`, { hint: `Looked in ${root}. Use the managed launcher, or run the install from that checkout.` });
+	throw new CommsError("USAGE", `\`--launcher local\` registers a checkout's own code, and there is no ${serverFacts(server).packageName} beside this one`, { hint: `Looked in ${root}. Use the managed launcher, or run the install from that checkout.` });
 }
 /**
 * The product the shared installer registers, for one channel: at this core's version unless another is named.
@@ -10933,11 +11395,11 @@ async function localModuleUrl(channel) {
 * newer release here is all it takes to register one this core is older than — which is what `agentcomms update` does.
 * `comms_server_install` and every `mcp install` name none, and register their own release as they always have.
 */
-async function channelProduct(channel, launcher, version = VERSION) {
+async function serverProduct(server, launcher, version = VERSION) {
 	return {
-		...channelServer(channel),
+		...serverFacts(server),
 		version,
-		moduleUrl: launcher === "local" ? await localModuleUrl(channel) : ""
+		moduleUrl: launcher === "local" ? await localModuleUrl(server) : ""
 	};
 }
 /**
@@ -10950,8 +11412,8 @@ async function channelProduct(channel, launcher, version = VERSION) {
 * registered, from the channel; a product for another package would register something else under those words, and
 * the person would have approved a sentence that was not true.
 */
-function ownProduct(channel, own) {
-	if (own !== void 0 && own.packageName !== channelServer(channel).packageName) throw new CommsError("UNEXPECTED", `${own.packageName} is not the ${channelLabel(channel)} server's package, so it cannot register that server`);
+function ownProduct(server, own) {
+	if (own !== void 0 && own.packageName !== serverFacts(server).packageName) throw new CommsError("UNEXPECTED", `${own.packageName} is not the ${serverLabel(server)} server's package, so it cannot register that server`);
 	return own;
 }
 /**
@@ -10961,11 +11423,11 @@ function ownProduct(channel, own) {
 * register a server reaching every workspace for a caller who believed they had pinned it.
 */
 function checkRequest(request) {
-	if (!isChannel(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
+	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 	if (!CLIENTS.includes(request.client)) throw new CommsError("USAGE", `"${String(request.client)}" is not a client this can register with`, { hint: `One of: ${CLIENTS.join(", ")}.` });
 	if (request.launcher !== void 0 && !LAUNCHERS.includes(request.launcher)) throw new CommsError("USAGE", `"${String(request.launcher)}" is not a launcher`, { hint: `One of: ${LAUNCHERS.join(", ")}.` });
 	if (request.name !== void 0) checkServerName(request.name);
-	const label = channelLabel(request.channel);
+	const label = serverLabel(request.channel);
 	const refuse = (option) => {
 		const owner = narrowingOwner(option);
 		throw new CommsError("USAGE", owner === void 0 ? `\`${option}\` is not an option of the ${label} server` : `\`${option}\` is an option of the ${owner.label} server; the ${label} server has no such option`);
@@ -11001,7 +11463,7 @@ function checkPin(config, request) {
 		return;
 	}
 	const { account } = resolveName(config, "account", pin);
-	if (account.platform !== request.channel) throw new CommsError("USAGE", `"${pin}" is not a ${channelLabel(request.channel)} ${accountNoun(request.channel)}`);
+	if (account.platform !== request.channel) throw new CommsError("USAGE", `"${pin}" is not a ${serverLabel(request.channel)} ${accountNoun(request.channel)}`);
 }
 function installOptions(request) {
 	const own = pinOption(request.channel);
@@ -11020,7 +11482,7 @@ function installOptions(request) {
 	};
 }
 /**
-* Registering one channel's server with one client, as a change.
+* Registering one declared server with one client, as a change.
 *
 * The effects are what a person is agreeing to, one sentence each, and everything that decides what the server may
 * reach is in them — which server, which client, under which name, pinned to what, replacing what, started how. The
@@ -11035,21 +11497,22 @@ function installOptions(request) {
 * resolves another — `CLAUDE_CONFIG_DIR` set to another account's, a PATH that finds another node, a core running
 * from another build of the checkout — is another registration, refused as one.
 */
-function serverInstallChange(core, env, request, own) {
+function serverInstallChange(core, env, request, own, deps = {}) {
 	checkRequest(request);
 	ownProduct(request.channel, own);
 	const context = {
 		env,
-		core
+		core,
+		...deps.platform === void 0 ? {} : { platform: deps.platform }
 	};
-	const facts = channelServer(request.channel);
-	const label = channelLabel(request.channel);
+	const facts = serverFacts(request.channel);
+	const label = serverLabel(request.channel);
 	const noun = accountNoun(request.channel);
 	const pinName = pinOption(request.channel);
 	const switchable = hasNarrowing(request.channel, "readOnly");
 	const name = request.name ?? facts.defaultServerName;
 	const launcher = request.launcher ?? "managed";
-	const productNow = async () => own ?? await channelProduct(request.channel, request.launcher);
+	const productNow = async () => own ?? await serverProduct(request.channel, request.launcher);
 	let planned;
 	return {
 		plan: async (config) => {
@@ -11080,6 +11543,14 @@ function serverInstallChange(core, env, request, own) {
 				else if (launcher === "local") effects.push(`${request.client} will start it from ${await localCliEntry(product.moduleUrl)}`);
 			}
 			if (request.print !== true && launcher === "managed" && await reusableRuntime(core.paths.dataDir, facts.packageName, version) === null) effects.push(`installs ${facts.packageName}@${version} from npm into ${managedRuntimeDir(core.paths.dataDir, facts.packageName, version)}`);
+			if (request.print !== true && launcher === "managed" && managedShimsSupported(context)) {
+				const path = managedShimPath({
+					env,
+					dataDir: core.paths.dataDir,
+					platform: context.platform
+				}, facts.binary);
+				effects.push(`writes or repoints the owned CLI shim at ${path}; a foreign file there is left unchanged`);
+			}
 			return {
 				before: config,
 				after: config,
@@ -11089,9 +11560,10 @@ function serverInstallChange(core, env, request, own) {
 		},
 		apply: async () => {
 			if (planned === void 0) throw new CommsError("UNEXPECTED", "the registration was applied before it was planned");
-			const result = await mcpInstall(context, planned.product, installOptions(request), planned.install).catch(async (error) => {
+			const installed = await mcpInstall(context, planned.product, installOptions(request), planned.install).catch(async (error) => {
 				throw await remedyLocated(error, core);
 			});
+			const result = request.print === true ? installed : await withManagedShim(context, planned.product, installed);
 			return {
 				...result,
 				restart: result.applied ? `Restart ${request.client} to load "${result.name}": no MCP client loads a new server into a session that is already running.` : null
@@ -11100,6 +11572,68 @@ function serverInstallChange(core, env, request, own) {
 	};
 }
 /**
+* A managed install's CLI shim (CUE-406), once the registration's outcome is known: the command the locator finds in
+* the runtime the entry starts, written where nothing is or over this installation's own unchanged shim, and never
+* over anything else. A shim that cannot be written leaves the registration as it went, and says how to repair both.
+* The installer may not import the locator, so the operation writes it — for `mcp install` and `update` alike.
+*/
+async function withManagedShim(context, product, installed) {
+	if (installed.launcher !== "managed") return installed;
+	const cliEntry = installed.entry.args[0];
+	if (cliEntry === void 0) throw new CommsError("UNEXPECTED", "the managed entry has no CLI path");
+	const shimContext = {
+		env: context.env,
+		dataDir: context.core.paths.dataDir,
+		platform: context.platform
+	};
+	if (!managedShimsSupported(shimContext)) return {
+		...installed,
+		shimNotice: managedShimUnsupportedNotice(shimContext)
+	};
+	const warnings = [...installed.warnings];
+	let shim;
+	let shimFailure;
+	try {
+		const located = locateCliCommand({
+			caller: {
+				url: pathToFileURL(cliEntry).href,
+				packageName: product.packageName
+			},
+			target: {
+				packageName: product.packageName,
+				manifest: {
+					label: product.defaultServerName,
+					binary: product.binary
+				}
+			},
+			words: [],
+			uses: [],
+			paths: {
+				...context.core.paths,
+				downloadsDir: context.core.paths.dataDir
+			},
+			platform: context.platform
+		});
+		if (!located.ok) throw new CommsError("CONFIG", `the managed CLI command could not be located: ${located.message}`);
+		shim = await (context.writeShim ?? writeManagedShim)(shimContext, {
+			binary: product.binary,
+			command: located.command.words,
+			entry: located.command.entry
+		});
+	} catch (error) {
+		shimFailure = error instanceof Error ? error.message : String(error);
+		const path = join(homeDirectory(context.env), ".local", "bin", product.binary);
+		warnings.push(`The MCP registration ${installed.applied ? "succeeded" : "was not changed"}, but the CLI shim at ${path} could not be written (${shimFailure}). Fix that shim directory, then run this managed install again with \`--force\`; the owned registration is replaced without widening it and the shim is repaired.`);
+	}
+	if (shim?.status === "foreign") warnings.push(`${shim.path} already exists but was not written by this installation, so it was left unchanged; move it aside and run this managed install again with \`--force\` to create the CLI shim at that path.`);
+	return {
+		...installed,
+		warnings,
+		...shim === void 0 ? {} : { shim },
+		...shimFailure === void 0 ? {} : { shimFailure }
+	};
+}
+/**
 * A refusal of `mcp install` with its remedy — another install of the same product — said with the command located:
 * the printing package's own, core's, or another product's found among this machine's registrations (CUE-403). The
 * installer says only the words; it may not import the locator.
@@ -11107,17 +11641,24 @@ function serverInstallChange(core, env, request, own) {
 async function remedyLocated(error, core) {
 	const remedy = installRemedyOf(error);
 	if (remedy === void 0 || !(error instanceof CommsError)) return error;
-	const channel = CHANNELS.find((each) => channelServer(each).binary === remedy.binary);
-	if (channel === void 0) return error;
+	const server = SERVERS.find((each) => serverFacts(each).binary === remedy.binary);
+	if (server === void 0) return error;
 	const maker = await requireHandoffs(core).registered();
+	const handoff = isChannel(server) ? maker.of(server, remedy.words) : maker.core([
+		"mcp",
+		"install",
+		"--server",
+		server,
+		...remedy.words.slice(2)
+	]);
 	return new CommsError(error.code, error.message, {
-		hint: handoffSentence(maker.of(channel, remedy.words), remedy.say),
+		hint: handoffSentence(handoff, remedy.say),
 		...error.details === void 0 ? {} : { details: error.details },
 		...error.cause === void 0 ? {} : { cause: error.cause }
 	});
 }
 /**
-* Removing a channel's unused managed runtimes, as a change.
+* Removing a declared server's unused managed runtimes, as a change.
 *
 * A dry run is free: it removes nothing. Otherwise the plan is that same dry run, and each runtime it would remove is
 * one effect — the removal cannot be taken back — so the approval is bound to exactly that list; and the removal is
@@ -11127,20 +11668,20 @@ async function remedyLocated(error, core) {
 * release of the command that was run; checked to be that channel's, as for an install.
 */
 function serverPruneChange(core, env, request, own) {
-	if (!isChannel(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
+	if (!isServer(request.channel)) throw new CommsError("USAGE", `"${String(request.channel)}" is not a channel`, { hint: `One of: ${CHANNELS.join(", ")}.` });
 	const context = {
 		env,
 		core
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
-		packageName: channelServer(request.channel).packageName,
-		version: "0.17.0"
+		packageName: serverFacts(request.channel).packageName,
+		version: "0.18.1"
 	};
 	const product = {
 		packageName,
 		version
 	};
-	const label = channelLabel(request.channel);
+	const label = serverLabel(request.channel);
 	const base = {
 		includePrinted: request.includePrinted === true,
 		...request.processes ? { processes: request.processes } : {}
@@ -11161,7 +11702,7 @@ function serverPruneChange(core, env, request, own) {
 			return {
 				before: config,
 				after: config,
-				effects: preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`),
+				effects: [...preview.removed.map((item) => `deletes the unused ${label} runtime ${item.version} at ${item.path}`), ...preview.shims.removed.map((path) => `deletes the owned ${label} CLI shim at ${path}`)],
 				summary: `Remove ${approved.length} unused ${label} runtime${approved.length === 1 ? "" : "s"}`
 			};
 		},
@@ -11434,13 +11975,14 @@ function updateStopMessage(pending, where, commands) {
 * the yes is a different change, and the claim is refused. Nothing behind, nothing is prepared.
 */
 /**
-* The packages this suite publishes, whose latest releases an update reads: every channel's, from the manifests, and
-* every package a channel's server is run through by `npx` when that is another one — Gmail's `gmail-mcp`.
+* The packages this suite publishes, whose latest releases an update reads: every declared server owner's, from the
+* channel and service declarations, and every package a server is run through by `npx` when that is another one —
+* Gmail's `gmail-mcp`.
 */
-const CHANNEL_PACKAGES = Object.freeze(CHANNELS.map((channel) => channelServer(channel).packageName));
-const SERVER_PACKAGES = Object.freeze(CHANNELS.map((channel) => channelServer(channel).npxPackage).filter((name) => !CHANNEL_PACKAGES.includes(name)));
-Object.freeze([.../* @__PURE__ */ new Set([...CHANNEL_PACKAGES, ...SERVER_PACKAGES])].sort());
-channelServer("core").packageName;
+const OWNER_PACKAGES = Object.freeze(SERVERS.map((server) => serverFacts(server).packageName));
+const SERVER_PACKAGES = Object.freeze(SERVERS.map((server) => serverFacts(server).npxPackage).filter((name) => !OWNER_PACKAGES.includes(name)));
+Object.freeze([.../* @__PURE__ */ new Set([...OWNER_PACKAGES, ...SERVER_PACKAGES])].sort());
+serverFacts("core").packageName;
 /**
 * "Not now": no server or command on this machine stops for the update until the next local midnight.
 *
@@ -11788,7 +12330,7 @@ async function askLine(streams, question) {
 }
 channelServer("core").packageName;
 //#endregion
-//#region ../core/dist/tool-arguments-rfCRYwaZ.mjs
+//#region ../core/dist/tool-arguments-DLa_xsSp.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**
@@ -12096,10 +12638,60 @@ new TextEncoder();
 const base64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 const base64Lookup = /* @__PURE__ */ new Uint8Array(256);
 for (let i = 0; i < 64; i++) base64Lookup[base64Chars.charCodeAt(i)] = i;
+new Set([
+	"unicode-1-1-utf-8 unicode11utf8 unicode20utf8 utf-8 utf8 x-unicode20utf8",
+	"866 cp866 csibm866 ibm866",
+	"csisolatin2 iso-8859-2 iso-ir-101 iso8859-2 iso88592 iso_8859-2 iso_8859-2:1987 l2 latin2",
+	"csisolatin3 iso-8859-3 iso-ir-109 iso8859-3 iso88593 iso_8859-3 iso_8859-3:1988 l3 latin3",
+	"csisolatin4 iso-8859-4 iso-ir-110 iso8859-4 iso88594 iso_8859-4 iso_8859-4:1988 l4 latin4",
+	"csisolatincyrillic cyrillic iso-8859-5 iso-ir-144 iso8859-5 iso88595 iso_8859-5 iso_8859-5:1988",
+	"arabic asmo-708 csiso88596e csiso88596i csisolatinarabic ecma-114 iso-8859-6 iso-8859-6-e",
+	"iso-8859-6-i iso-ir-127 iso8859-6 iso88596 iso_8859-6 iso_8859-6:1987",
+	"csisolatingreek ecma-118 elot_928 greek greek8 iso-8859-7 iso-ir-126 iso8859-7 iso88597 iso_8859-7",
+	"iso_8859-7:1987 sun_eu_greek",
+	"csiso88598e csisolatinhebrew hebrew iso-8859-8 iso-8859-8-e iso-ir-138 iso8859-8 iso88598 iso_8859-8",
+	"iso_8859-8:1988 visual",
+	"csiso88598i iso-8859-8-i logical",
+	"csisolatin6 iso-8859-10 iso-ir-157 iso8859-10 iso885910 l6 latin6",
+	"iso-8859-13 iso8859-13 iso885913",
+	"iso-8859-14 iso8859-14 iso885914",
+	"csisolatin9 iso-8859-15 iso8859-15 iso885915 iso_8859-15 l9",
+	"iso-8859-16",
+	"cskoi8r koi koi8 koi8-r koi8_r",
+	"koi8-ru koi8-u",
+	"csmacintosh mac macintosh x-mac-roman",
+	"dos-874 iso-8859-11 iso8859-11 iso885911 tis-620 windows-874",
+	"cp1250 windows-1250 x-cp1250",
+	"cp1251 windows-1251 x-cp1251",
+	"ansi_x3.4-1968 ascii cp1252 cp819 csisolatin1 ibm819 iso-8859-1 iso-ir-100 iso8859-1 iso88591",
+	"iso_8859-1 iso_8859-1:1987 l1 latin1 us-ascii windows-1252 x-cp1252",
+	"cp1253 windows-1253 x-cp1253",
+	"cp1254 csisolatin5 iso-8859-9 iso-ir-148 iso8859-9 iso88599 iso_8859-9 iso_8859-9:1989 l5 latin5",
+	"windows-1254 x-cp1254",
+	"cp1255 windows-1255 x-cp1255",
+	"cp1256 windows-1256 x-cp1256",
+	"cp1257 windows-1257 x-cp1257",
+	"cp1258 windows-1258 x-cp1258",
+	"x-mac-cyrillic x-mac-ukrainian",
+	"chinese csgb2312 csiso58gb231280 gb2312 gb_2312 gb_2312-80 gbk iso-ir-58 x-gbk",
+	"gb18030",
+	"big5 big5-hkscs cn-big5 csbig5 x-x-big5",
+	"cseucpkdfmtjapanese euc-jp x-euc-jp",
+	"csiso2022jp iso-2022-jp",
+	"csshiftjis ms932 ms_kanji shift-jis shift_jis sjis windows-31j x-sjis",
+	"cseuckr csksc56011987 euc-kr iso-ir-149 korean ks_c_5601-1987 ks_c_5601-1989 ksc5601 ksc_5601",
+	"windows-949",
+	"csiso2022kr hz-gb-2312 iso-2022-cn iso-2022-cn-ext iso-2022-kr replacement",
+	"unicodefffe utf-16be",
+	"csunicode iso-10646-ucs-2 ucs-2 unicode unicodefeff utf-16 utf-16le",
+	"x-user-defined"
+].join(" ").split(" "));
+new TextDecoder();
 const ENCODED_WORD_PATTERN = "=\\?([^?\\s]+)\\?([QqBb])\\?([^?]*)\\?=";
 new RegExp(ENCODED_WORD_PATTERN, "g");
 new RegExp(`^(?:${ENCODED_WORD_PATTERN}\\s*)+$`);
 new TextDecoder("utf-8", { ignoreBOM: true });
+new Uint8Array([10]);
 //#endregion
 //#region ../../node_modules/.pnpm/deepmerge-ts@8.0.2/node_modules/deepmerge-ts/dist/index.mjs
 /**