@agentcomms/whatsapp 0.18.1 → 0.19.0

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as exemptFromUpdateGate, A as requireAccount, B as PATH_OPTIONS, Ct as writeResult, Et as VERSION, F as expandSource, G as approveAndWaitSentence, H as absoluteSearchPath, J as childEnvironment, K as approveChangeAtTerminal, L as CHANNEL_SERVERS, M as storeIdentity, N as checkStorePath, O as PLATFORM, P as defaultStorePath, Q as escapeForDisplay, R as CommsError, S as chatRefOf, St as withFileLock, U as agentMarker, W as approvalsOf, X as colorEnabled, Y as cliHandoffs, Z as commandPathOf, _ as WhatsAppContext, a as CHAT_KINDS, at as lookupName, b as requireSupportedNode, c as searchMessages, ct as openCore, dt as renderInstall, et as gatedChangeAtTerminal, f as draftMessage, ft as renderPrune, gt as serverPruneChange, ht as serverInstallChange, i as probeStore, it as isCommsError, j as requireNamedConfig, k as newWhatsAppAccount, l as Presenter, lt as paint, m as listKey, mt as runCommand, nt as handoffText, o as listChats, ot as nameAvailable, p as Visibility, pt as resolvePaths, q as canPrompt, r as whatsappStatus, rt as installExitStatus, s as readChat, st as nameShapeProblem, t as syncAccount, tt as handoffSentence, u as innerText, ut as pathOverridesFromCliOptions, v as WhatsAppIndex, vt as truncateDisplay, wt as CALLER, xt as windowsSystemProgram, yt as updateGateAtTerminal, z as EXIT_CODES } from "./sync-q1U9jYX3.mjs";
+import { $ as exemptFromUpdateGate, A as requireAccount, B as PATH_OPTIONS, Ct as writeResult, Et as VERSION, F as expandSource, G as approveAndWaitSentence, H as absoluteSearchPath, J as childEnvironment, K as approveChangeAtTerminal, L as CHANNEL_SERVERS, M as storeIdentity, N as checkStorePath, O as PLATFORM, P as defaultStorePath, Q as escapeForDisplay, R as CommsError, S as chatRefOf, St as withFileLock, U as agentMarker, W as approvalsOf, X as colorEnabled, Y as cliHandoffs, Z as commandPathOf, _ as WhatsAppContext, a as CHAT_KINDS, at as lookupName, b as requireSupportedNode, c as searchMessages, ct as openCore, dt as renderInstall, et as gatedChangeAtTerminal, f as draftMessage, ft as renderPrune, gt as serverPruneChange, ht as serverInstallChange, i as probeStore, it as isCommsError, j as requireNamedConfig, k as newWhatsAppAccount, l as Presenter, lt as paint, m as listKey, mt as runCommand, nt as handoffText, o as listChats, ot as nameAvailable, p as Visibility, pt as resolvePaths, q as canPrompt, r as whatsappStatus, rt as installExitStatus, s as readChat, st as nameShapeProblem, t as syncAccount, tt as handoffSentence, u as innerText, ut as pathOverridesFromCliOptions, v as WhatsAppIndex, vt as truncateDisplay, wt as CALLER, xt as windowsSystemProgram, yt as updateGateAtTerminal, z as EXIT_CODES } from "./sync-Q9xVuh21.mjs";
 import { rm } from "node:fs/promises";
 import path, { delimiter, join } from "node:path";
 import { stripVTControlCharacters } from "node:util";
@@ -3582,7 +3582,7 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 		ran = true;
 		exitCode = await runCommand(output(), async () => {
 			requireSupportedNode();
-			await (deps.startMcp ?? (await import("./stdio-entry-DeaLN63P.mjs")).startWhatsAppStdioServer)({
+			await (deps.startMcp ?? (await import("./stdio-entry-c95dpKwO.mjs")).startWhatsAppStdioServer)({
 				env,
 				platform,
 				...deps,

package/dist/index.d.mts

@@ -4277,7 +4277,8 @@ declare namespace external_d_exports {
   export { $brand, $input, $output, BRAND, CompileOptions, GlobalMeta, INVALID, Infer$1 as Infer, IssueData, JSONType, NEVER, $RefinementCtx as RefinementCtx, SafeExtendShape, Schema, TimePrecision, TypeOf, ZodAny, ZodArray, ZodBase64, ZodBase64URL, ZodBigInt, ZodBigIntFormat, ZodBoolean, ZodCIDRv4, ZodCIDRv6, ZodCUID, ZodCUID2, ZodCatch, ZodCodec, ZodCoercedBigInt, ZodCoercedBoolean, ZodCoercedDate, ZodCoercedNumber, ZodCoercedString, ZodCompileAsyncError, ZodCompileUnsupportedError, ZodCreditCard, ZodCustom, ZodCustomStringFormat, ZodDate, ZodDefault, ZodDiscriminatedUnion, ZodE164, ZodEmail, ZodEmoji, ZodEnum, ZodError, ZodErrorMap, ZodExactOptional, ZodFile, ZodFirstPartySchemaTypes, ZodFirstPartyTypeKind, ZodFlattenedError, ZodFloat32, ZodFloat64, ZodFormattedError, ZodFunction, ZodGUID, ZodIBAN, ZodIPv4, ZodIPv6, ZodISODate, ZodISODateTime, ZodISODuration, ZodISOTime, ZodInstanceOf, ZodInt, ZodInt32, ZodInt64, ZodIntersection, ZodIssue, ZodIssueCode, ZodJSONSchema, ZodJSONSchemaInternals, ZodJWT, ZodKSUID, ZodLazy, ZodLiteral, ZodMAC, ZodMap, ZodNaN, ZodNanoID, ZodNever, ZodNonOptional, ZodNull, ZodNullable, ZodNumber, ZodNumberFormat, ZodObject, ZodOptional, ZodPipe, ZodPrefault, ZodPreprocess, ZodPromise, ZodRawShape$1 as ZodRawShape, ZodReadonly, ZodRealError, ZodRecord, ZodSafeParseError, ZodSafeParseResult, ZodSafeParseSuccess, ZodSchema, ZodSet, ZodStandardSchemaWithJSON, ZodString, ZodStringFormat, ZodSuccess, ZodSymbol, ZodTemplateLiteral, ZodTransform, ZodTuple, ZodType, ZodTypeAny, ZodUInt32, ZodUInt64, ZodULID, ZodURL, ZodUUID, ZodUndefined, ZodUnion, ZodUnknown, ZodVoid, ZodXID, ZodXor, _ZodBigInt, _ZodBoolean, _ZodDate, _ZodNumber, _ZodString, _ZodType, _default, _function, any, array, base64, base64url, bigint$1 as bigint, boolean$1 as boolean, _catch as catch, check, cidrv4, cidrv6, clone, codec, coerce_d_exports as coerce, compile, config, index_d_exports$1 as core, creditCard, cuid, cuid2, currencyCode, custom, date$2 as date, decode, decodeAsync, deepPartial, describe, discriminatedUnion, e164, email, emoji, encode, encodeAsync, _endsWith as endsWith, _enum as enum, exactOptional, file, flattenError, float32, float64, formatError, fromJSONSchema, _function as function, getDiscriminatedOption, getErrorMap, globalRegistry, _gt as gt, _gte as gte, guid, hash, hex, hostname, httpUrl, iban, _includes as includes, output$1 as infer, inferFlattenedErrors, inferFormattedError, input, _instanceof as instanceof, int, int32, int64, intersection, invertCodec, ipv4, ipv6, iso_d_exports as iso, json, jwt, keyof, ksuid, lazy, _length as length, literal, index_d_exports$2 as locales, looseObject, looseRecord, _lowercase as lowercase, _lt as lt, _lte as lte, mac, map, _maxLength as maxLength, _maxSize as maxSize, memoizer, meta, _mime as mime, _minLength as minLength, _minSize as minSize, _multipleOf as multipleOf, nan, nanoid, nativeEnum, _negative as negative, never, _nonnegative as nonnegative, nonoptional, _nonpositive as nonpositive, _normalize as normalize, _null as null, nullable, nullish, number$1 as number, object, optional, output, _overwrite as overwrite, parse, parseAsync, partialRecord, pipe, _positive as positive, prefault, preprocess, prettifyError, promise, _properties as properties, _property as property, readonly, record, refine, _regex as regex, regexes_d_exports as regexes, registry, safeDecode, safeDecodeAsync, safeEncode, safeEncodeAsync, safeParse, safeParseAsync, set, setErrorMap, _size as size, _slugify as slugify, _startsWith as startsWith, strictObject, string$1 as string, stringFormat, stringbool, success, superRefine, symbol, templateLiteral, toJSONSchema, _toLowerCase as toLowerCase, _toUpperCase as toUpperCase, toZod, transform, treeifyError, _trim as trim, tuple, uint32, uint64, ulid, _undefined as undefined, union, unknown, _uppercase as uppercase, url, util_d_exports as util, uuid, uuidv4, uuidv6, uuidv7, validate, validateAsync, _void as void, withParser, xid, xor };
 }
 //#endregion
-//#region ../core/dist/change-flow-j65bYTxL.d.mts
+//#region ../core/dist/change-flow-DOyBTYin.d.mts
+//#endregion
 //#region src/config-hooks.d.ts
 /**
  * Test-only pauses inside `ConfigStore.convertToVersion3`, for the tests that prove a write racing the conversion is
@@ -4735,6 +4736,16 @@ interface ConfigBody {
   /** Superseded rotating credentials which still need conclusive per-token cleanup. */
   pendingRevocations?: PendingRevocation[] | undefined;
   defaults: Defaults;
+  /**
+   * How what an agent sends is labelled (design 2026-10-15-agent-label, L5): the word, the name, the rules that say
+   * who a message appears to come from, and each Slack account's agent emoji.
+   *
+   * `unknown` here, on purpose: it is read only through `agentLabelOf`, which reads a value it does not understand
+   * as the stricter one — an unknown word as `agent`, a rule list it cannot read as no rules — so a hand edit or a
+   * later release's key can only tighten. Kept through every write as the schemas keep every key they do not name, and
+   * judged by `classifyChange`.
+   */
+  agentLabel?: unknown;
 }
 interface ConfigV1 extends ConfigBody {
   version: 1;

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { C as chatKindOf, D as text, E as numeric, Et as VERSION, R as CommsError, T as kindOf, Tt as PACKAGE_NAME, _ as WhatsAppContext, d as composeDraft, g as visibilityUnitKey, h as statusAuthor, m as listKey, n as withCheckedCopy, p as Visibility, w as coreDataToIso, x as inspectSchema, y as rebuildIndex } from "./sync-q1U9jYX3.mjs";
-import { t as createWhatsAppMcpServer } from "./server-DeV9ut_P.mjs";
+import { C as chatKindOf, D as text, E as numeric, Et as VERSION, R as CommsError, T as kindOf, Tt as PACKAGE_NAME, _ as WhatsAppContext, d as composeDraft, g as visibilityUnitKey, h as statusAuthor, m as listKey, n as withCheckedCopy, p as Visibility, w as coreDataToIso, x as inspectSchema, y as rebuildIndex } from "./sync-Q9xVuh21.mjs";
+import { t as createWhatsAppMcpServer } from "./server-YS_r6FYq.mjs";
 //#region src/source/event-reader.ts
 function rawFromMe(value) {
 	const number = numeric(value);

package/dist/{server-DeV9ut_P.mjs → server-YS_r6FYq.mjs}

@@ -1,4 +1,4 @@
-import { Et as VERSION, I as strictToolArguments, V as UNTRUSTED_NOTICE, _ as WhatsAppContext, _t as toCommsError, a as CHAT_KINDS, bt as updateToolGate, c as searchMessages, f as draftMessage, o as listChats, r as whatsappStatus, s as readChat, t as syncAccount } from "./sync-q1U9jYX3.mjs";
+import { Et as VERSION, I as strictToolArguments, V as UNTRUSTED_NOTICE, _ as WhatsAppContext, _t as toCommsError, a as CHAT_KINDS, bt as updateToolGate, c as searchMessages, f as draftMessage, o as listChats, r as whatsappStatus, s as readChat, t as syncAccount } from "./sync-Q9xVuh21.mjs";
 import { c as boolean, h as number, x as string } from "./iso-USuVU_sk.mjs";
 import { t as McpServer } from "./mcp-DIH4cS6P-CIWWZQbz.mjs";
 //#region src/mcp/server.ts

package/dist/{stdio-entry-DeaLN63P.mjs → stdio-entry-c95dpKwO.mjs}

@@ -1,4 +1,4 @@
-import { t as createWhatsAppMcpServer } from "./server-DeV9ut_P.mjs";
+import { t as createWhatsAppMcpServer } from "./server-YS_r6FYq.mjs";
 //#region src/mcp/stdio-entry.ts
 /**
 * Starting the stdio server. On stdio, stdout is the protocol, so the console is redirected to stderr first — the

package/dist/{sync-q1U9jYX3.mjs → sync-Q9xVuh21.mjs}

@@ -11,7 +11,7 @@ import { execFile, spawn } from "node:child_process";
 //#endregion
 //#region src/version.ts
 /** The package version, read from package.json at build time. */
-const VERSION$1 = "0.18.1";
+const VERSION$1 = "0.19.0";
 //#endregion
 //#region src/caller.ts
 /** This package's name, as its manifest has it. */
@@ -28,7 +28,7 @@ const CALLER = Object.freeze({
 	packageName: PACKAGE_NAME
 });
 //#endregion
-//#region ../core/dist/update-check-DvZxdFU_.mjs
+//#region ../core/dist/update-check-CVvpp5G8.mjs
 /**
 * Every failure a user or an agent can act on carries a specific, stable code from this registry, a message, an
 * optional one-line hint and structured `details`. The code decides the process exit status; agents and skills branch
@@ -903,6 +903,175 @@ var TaintStore = class {
 		return sortedOrigins([...originEntry(sidecar), ...sidecar !== void 0 && isNewer(entry.at, sidecar.at) ? ["read"] : []]);
 	}
 };
+/**
+* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
+* and the preview renderer (which makes them visible), so the two can never disagree.
+*/
+/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
+const INVISIBLE_RANGES = [
+	[173, 173],
+	[847, 847],
+	[1564, 1564],
+	[4447, 4448],
+	[6068, 6069],
+	[6155, 6159],
+	[8203, 8207],
+	[8232, 8233],
+	[8234, 8238],
+	[8288, 8292],
+	[8294, 8303],
+	[12644, 12644],
+	[65024, 65039],
+	[65279, 65279],
+	[65440, 65440],
+	[917504, 917631]
+];
+function isInvisible(codePoint) {
+	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
+	return false;
+}
+/**
+* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
+* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
+*/
+function isControl(codePoint) {
+	if (codePoint === 9 || codePoint === 10) return false;
+	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
+}
+function isDangerous(codePoint) {
+	return isControl(codePoint) || isInvisible(codePoint);
+}
+/**
+* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
+* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
+*
+* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
+* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
+* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
+*/
+function stripInvisible(text) {
+	let removed = 0;
+	let out = "";
+	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
+	else out += char;
+	return {
+		text: out,
+		removed
+	};
+}
+/**
+* Labelling what an agent sends (design 2026-10-15-agent-label): the phrase `<name> (<word>)`, who a message appears to
+* come from, and which setting changes loosen that. Pure: nothing here reads the configuration or talks to a channel,
+* so every channel decides the same way from the same settings.
+*/
+/** L2: the words a label may use, exactly as written. Adding one is a code change with its own review. */
+const AGENT_LABEL_WORDS = Object.freeze([
+	"agent",
+	"assistant",
+	"twin",
+	"minion",
+	"bot",
+	"fake",
+	"AI"
+]);
+/** L4: the kinds of act a rule may name. Slack posts, replies, reacts, edits and shares files; mail sends and replies. */
+const ACT_KINDS = Object.freeze([
+	"post",
+	"reply",
+	"reaction",
+	"edit",
+	"file",
+	"send"
+]);
+/** L2's characters a name may not hold: parentheses would fake a second label, the rest break an address header. */
+const FORBIDDEN_NAME_CHARACTERS = /[()<>"@,;:\\]/u;
+function isAgentLabelWord(value) {
+	return typeof value === "string" && AGENT_LABEL_WORDS.includes(value);
+}
+/** Why a name cannot be labelled, or undefined when it can. */
+function nameProblem(name) {
+	if (name.length === 0) return "the name is empty";
+	if (name.trim() !== name) return "the name starts or ends with a space";
+	if (FORBIDDEN_NAME_CHARACTERS.test(name)) return "the name holds a parenthesis or one of <>\"@,;:\\";
+	for (const char of name) if (isDangerous(char.codePointAt(0) ?? 0)) return "the name holds a hidden or control character";
+}
+const ruleKey = (rule) => JSON.stringify([
+	rule.account,
+	rule.accountId ?? null,
+	rule.conversation ?? null,
+	rule.kinds === void 0 ? null : [...rule.kinds].sort(),
+	rule.as
+]);
+/**
+* L5: the changes that need the person's confirmation — anything that could leave a message unlabelled or change how
+* the label looks. Adding an `agent` rule or removing a `me` rule tightens, and is not listed.
+*/
+function classifyAgentLabelChange(before, after) {
+	const changes = [];
+	const wordBefore = before?.word ?? "agent";
+	const wordAfter = after?.word ?? "agent";
+	if (wordBefore !== wordAfter) changes.push({
+		path: "agentLabel.word",
+		was: wordBefore,
+		now: wordAfter
+	});
+	if ((before?.name ?? null) !== (after?.name ?? null)) changes.push({
+		path: "agentLabel.name",
+		was: before?.name,
+		now: after?.name
+	});
+	const rulesBefore = new Map((before?.rules ?? []).map((rule) => [ruleKey(rule), rule]));
+	const rulesAfter = new Map((after?.rules ?? []).map((rule) => [ruleKey(rule), rule]));
+	const meAdded = [...rulesAfter].some(([key, rule]) => rule.as === "me" && !rulesBefore.has(key));
+	const agentRemoved = [...rulesBefore].some(([key, rule]) => rule.as === "agent" && !rulesAfter.has(key));
+	if (meAdded || agentRemoved) changes.push({
+		path: "agentLabel.rules",
+		was: before?.rules ?? [],
+		now: after?.rules ?? []
+	});
+	if (JSON.stringify(sorted(before?.slackIcons)) !== JSON.stringify(sorted(after?.slackIcons))) changes.push({
+		path: "agentLabel.slackIcons",
+		was: before?.slackIcons ?? {},
+		now: after?.slackIcons ?? {}
+	});
+	return changes;
+}
+function sorted(record) {
+	return Object.entries(record ?? {}).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+const EMOJI_NAME = /^:[a-z0-9_+'-]{1,100}:$/u;
+function isRule(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const rule = value;
+	if (typeof rule.account !== "string" || rule.account.length === 0) return false;
+	if (rule.as !== "agent" && rule.as !== "me") return false;
+	if (rule.accountId !== void 0 && (typeof rule.accountId !== "string" || rule.accountId.length === 0)) return false;
+	if (rule.conversation !== void 0 && (typeof rule.conversation !== "string" || rule.conversation.length === 0)) return false;
+	if (rule.kinds !== void 0 && !(Array.isArray(rule.kinds) && rule.kinds.length > 0 && rule.kinds.every((kind) => ACT_KINDS.includes(kind)))) return false;
+	return true;
+}
+/**
+* The stored `agentLabel`, read so that a bad value can only tighten. An unknown word reads as `agent`, an invalid
+* name as no name, and a rule list with any invalid rule is ignored whole: dropping one `agent` rule could leave a
+* broader `me` rule in charge. A malformed icon entry is dropped, falling back to the plain photo.
+*/
+function readAgentLabelSettings(raw) {
+	if (typeof raw !== "object" || raw === null) return {};
+	const stored = raw;
+	const settings = {};
+	if (isAgentLabelWord(stored.word)) settings.word = stored.word;
+	if (typeof stored.name === "string" && nameProblem(stored.name) === void 0) settings.name = stored.name;
+	if (Array.isArray(stored.rules) && stored.rules.every(isRule)) settings.rules = stored.rules.map((rule) => ({ ...rule }));
+	if (typeof stored.slackIcons === "object" && stored.slackIcons !== null) {
+		const icons = Object.entries(stored.slackIcons).filter((entry) => typeof entry[1] === "string" && EMOJI_NAME.test(entry[1]));
+		if (icons.length > 0) settings.slackIcons = Object.fromEntries(icons);
+	}
+	return settings;
+}
+/** The person's label settings from a loaded configuration, read as `readAgentLabelSettings` reads them. */
+function agentLabelOf(config) {
+	return readAgentLabelSettings(config.agentLabel);
+}
 /** Every first-party channel, the core first: what core knows about each without installing it. */
 const CHANNEL_SNAPSHOT = [
 	{
@@ -1072,7 +1241,11 @@ const CHANNEL_SNAPSHOT = [
 				word: "slack",
 				can: "post to Slack"
 			},
-			hosts: ["slack.com", "files.slack.com"],
+			hosts: [
+				"slack.com",
+				"files.slack.com",
+				"avatars.slack-edge.com"
+			],
 			approve: "agent-slack approve",
 			skills: {
 				prefix: "slack-",
@@ -2968,6 +3141,99 @@ function commandLinePackage(command, args) {
 	const line = [command, ...withoutPathOptions(args).words].join(" ");
 	return /(@[\w.-]+\/[\w.-]+|(?<=\s)[\w.-]+-mcp)(?=@|\s|$)/.exec(line)?.[1];
 }
+/**
+* The programs this package starts, named so that no folder it happens to be in can stand in for them.
+*
+* A bare name is looked up, and on Windows the lookup starts in the current folder: libuv tries it before `PATH`, and
+* so does every program that looks a name up with `SearchPath` or `CreateProcess`. The current folder is where a
+* command was run or a server was started — and, since a download asks where to save, one of the three places a
+* stranger's file may be saved into. A `reg.exe` or `rundll32.exe` saved there would then be what runs the next time
+* this package reads the registry or opens a browser. So a Windows program is named by its full path, under the Windows
+* folder, and every process started on Windows is told, by `NoDefaultCurrentDirectoryInExePath`, not to look in its
+* own current folder for the programs it starts in turn.
+*/
+/** An environment variable by name, whatever its case: Windows's are case-blind, an object passed in is not. */
+function envValue(env, name) {
+	const wanted = name.toLowerCase();
+	for (const [key, value] of Object.entries(env)) if (key.toLowerCase() === wanted && value) return value;
+}
+/**
+* The Windows folder: `%SystemRoot%` (or `%windir%`) when it names a folder on a drive, and `C:\Windows` otherwise.
+* A value that is not a drive's absolute path — relative, a share, a device path — is not taken: it would be looked up
+* against the current folder, or on another machine, which is what naming the program in full is to avoid.
+*/
+function windowsFolder(env = process.env) {
+	for (const name of ["SystemRoot", "windir"]) {
+		const value = envValue(env, name);
+		if (value !== void 0 && /^[A-Za-z]:[\\/]/.test(value)) return path.win32.resolve(value);
+	}
+	return "C:\\Windows";
+}
+/** A program of Windows's own by its full path: `%SystemRoot%\System32\<name>`, never a bare name to look up. */
+function windowsSystemProgram(name, env = process.env) {
+	return path.win32.join(windowsFolder(env), "System32", name);
+}
+/**
+* The environment a child process is started with: `env` as it is, and on Windows also
+* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
+* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
+* when `PATH` says to.
+*/
+function childEnvironment(env = process.env, platform = process.platform) {
+	if (platform !== "win32") return env;
+	return {
+		...env,
+		NoDefaultCurrentDirectoryInExePath: "1"
+	};
+}
+/**
+* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
+* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
+* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
+*/
+function absoluteSearchPath(entries, platform = process.platform) {
+	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
+}
+/** This Node's real file, or its path as reported when that cannot be resolved. */
+function realFile(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/** Two real paths are one file: compared without case on Windows, whose paths are. */
+function sameRealPath(a, b, platform) {
+	return platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+/** The names `node` is found by in one folder of PATH, as a shell finds it: with each PATHEXT extension on Windows. */
+function nodeNames(env, platform) {
+	if (platform !== "win32") return ["node"];
+	return (env.PATHEXT ?? ".EXE;.CMD;.BAT").split(";").filter(Boolean).map((extension) => `node${extension.toLowerCase()}`);
+}
+/**
+* The path a command names this Node by: the first `node` on `env`'s PATH that is the same real file as
+* `process.execPath`, as PATH spells it; otherwise `process.execPath`. With no `env`, nothing is looked for.
+*
+* Read when a command is located, as everything else in it is (D6): a link removed or repointed later is what the
+* command then meets. Only absolute folders of PATH are read, as the registrations' own search reads them.
+*/
+function nodeProgram(env, platform = process.platform) {
+	const own = process.execPath;
+	if (env === void 0) return own;
+	const real = realFile(own);
+	const search = env.PATH ?? env.Path ?? "";
+	for (const directory of absoluteSearchPath(search.split(delimiter), platform)) for (const name of nodeNames(env, platform)) {
+		const candidate = join(directory, name);
+		try {
+			if (!statSync(candidate).isFile()) continue;
+			accessSync(candidate, constants$1.X_OK);
+			if (!sameRealPath(realpathSync(candidate), real, platform)) continue;
+			return sameRealPath(candidate, own, platform) ? own : candidate;
+		} catch {}
+	}
+	return own;
+}
 const RECEIPT_VERSION = 1;
 const RECEIPT_FILE = "managed-shims.json";
 const MUTATION_LOCK_FILE = "managed-shims.lock";
@@ -3305,59 +3571,6 @@ async function removeManagedShimsForRuntimes(context, runtimes, options = {}) {
 		};
 	});
 }
-/**
-* The programs this package starts, named so that no folder it happens to be in can stand in for them.
-*
-* A bare name is looked up, and on Windows the lookup starts in the current folder: libuv tries it before `PATH`, and
-* so does every program that looks a name up with `SearchPath` or `CreateProcess`. The current folder is where a
-* command was run or a server was started — and, since a download asks where to save, one of the three places a
-* stranger's file may be saved into. A `reg.exe` or `rundll32.exe` saved there would then be what runs the next time
-* this package reads the registry or opens a browser. So a Windows program is named by its full path, under the Windows
-* folder, and every process started on Windows is told, by `NoDefaultCurrentDirectoryInExePath`, not to look in its
-* own current folder for the programs it starts in turn.
-*/
-/** An environment variable by name, whatever its case: Windows's are case-blind, an object passed in is not. */
-function envValue(env, name) {
-	const wanted = name.toLowerCase();
-	for (const [key, value] of Object.entries(env)) if (key.toLowerCase() === wanted && value) return value;
-}
-/**
-* The Windows folder: `%SystemRoot%` (or `%windir%`) when it names a folder on a drive, and `C:\Windows` otherwise.
-* A value that is not a drive's absolute path — relative, a share, a device path — is not taken: it would be looked up
-* against the current folder, or on another machine, which is what naming the program in full is to avoid.
-*/
-function windowsFolder(env = process.env) {
-	for (const name of ["SystemRoot", "windir"]) {
-		const value = envValue(env, name);
-		if (value !== void 0 && /^[A-Za-z]:[\\/]/.test(value)) return path.win32.resolve(value);
-	}
-	return "C:\\Windows";
-}
-/** A program of Windows's own by its full path: `%SystemRoot%\System32\<name>`, never a bare name to look up. */
-function windowsSystemProgram(name, env = process.env) {
-	return path.win32.join(windowsFolder(env), "System32", name);
-}
-/**
-* The environment a child process is started with: `env` as it is, and on Windows also
-* `NoDefaultCurrentDirectoryInExePath=1`, so that the child — `rundll32.exe`, a Node started again — never takes a
-* program from its current folder either. Elsewhere nothing is added: a Unix shell looks in the current folder only
-* when `PATH` says to.
-*/
-function childEnvironment(env = process.env, platform = process.platform) {
-	if (platform !== "win32") return env;
-	return {
-		...env,
-		NoDefaultCurrentDirectoryInExePath: "1"
-	};
-}
-/**
-* The directories of a search path that name a folder on their own: absolute, and on Windows on a drive. An empty
-* entry means the current folder to a Unix shell, and a relative one is read against it; either would make the program
-* found — and run — depend on where this was started, which is where a download may have saved a stranger's file.
-*/
-function absoluteSearchPath(entries, platform = process.platform) {
-	return entries.filter((entry) => platform === "win32" ? /^[A-Za-z]:[\\/]/.test(entry) : entry !== "" && path.posix.isAbsolute(entry));
-}
 /** The install options that pin a server to one account: the generic one, and Gmail's and Slack's own names. */
 const PIN_OPTIONS = Object.freeze([
 	"account",
@@ -4945,62 +5158,6 @@ function connectMailboxWords() {
 */
 const CONVERSION_HOOKS = Symbol("agentcomms.configConversionHooks");
 /**
-* One table of dangerous characters, shared by the inbound sanitiser (which strips them from sender-controlled text)
-* and the preview renderer (which makes them visible), so the two can never disagree.
-*/
-/** Zero-width and formatting characters, bidi controls, variation selectors and Unicode tag characters. */
-const INVISIBLE_RANGES = [
-	[173, 173],
-	[847, 847],
-	[1564, 1564],
-	[4447, 4448],
-	[6068, 6069],
-	[6155, 6159],
-	[8203, 8207],
-	[8232, 8233],
-	[8234, 8238],
-	[8288, 8292],
-	[8294, 8303],
-	[12644, 12644],
-	[65024, 65039],
-	[65279, 65279],
-	[65440, 65440],
-	[917504, 917631]
-];
-function isInvisible(codePoint) {
-	for (const [from, to] of INVISIBLE_RANGES) if (codePoint >= from && codePoint <= to) return true;
-	return false;
-}
-/**
-* C0 controls except tab and newline (ESC, and so every ANSI/OSC sequence, starts here), DEL, and C1 controls (CSI
-* among them). A lone carriage return counts: it moves a terminal cursor back over text already printed.
-*/
-function isControl(codePoint) {
-	if (codePoint === 9 || codePoint === 10) return false;
-	return codePoint < 32 || codePoint === 127 || codePoint >= 128 && codePoint <= 159;
-}
-function isDangerous(codePoint) {
-	return isControl(codePoint) || isInvisible(codePoint);
-}
-/**
-* Strips control characters (ESC, CSI, OSC and the rest), DEL, lone carriage returns, zero-width, bidi-control and tag
-* characters from sender-controlled text; returns the text and how many were removed. CRLF becomes LF first.
-*
-* This lives beside the table rather than in the sanitiser because `neutralise` needs it too, and the two must not
-* drift: a pattern that looks for `</untrusted-content` cannot see it through a zero-width space, so stripping
-* has to happen before any such pattern runs, on every path, not only on the ones that render a body.
-*/
-function stripInvisible(text) {
-	let removed = 0;
-	let out = "";
-	for (const char of text.replace(/\r\n/g, "\n")) if (isDangerous(char.codePointAt(0) ?? 0)) removed += 1;
-	else out += char;
-	return {
-		text: out,
-		removed
-	};
-}
-/**
 * Whether a folder, as written, says where it is on its own: from the home (`~`), or absolute — and on Windows with its
 * drive (`C:\…`) or share (`\\server\share\…`). Windows calls `\outgoing` absolute, but it is on whichever drive is
 * current when it is read, and `C:outgoing` is relative to that drive's current folder; either would move with the
@@ -6114,11 +6271,39 @@ function classifyChange(before, after) {
 	if (before.secrets === void 0 && after.secrets !== void 0 && after.secrets.store !== "keychain") {
 		if (holdsSecrets(before)) loosen("secrets.store", secretsStoreOf(before), after.secrets.store);
 	}
+	for (const loosening of classifyAgentLabelChange(agentLabelOf(before), agentLabelOf(after))) loosen(loosening.path, labelSettingValue(loosening, loosening.was), labelSettingValue(loosening, loosening.now));
 	return {
 		loosened: changes.map((change) => change.path),
 		changes
 	};
 }
+/**
+* One label rule in words, as a preview lists it: `acme/slack in C0ACME for post/reply: me`. No comma inside, since a
+* preview joins a list of them with commas.
+*/
+function agentLabelRuleText(rule) {
+	const where = rule.conversation === void 0 ? "" : ` in ${rule.conversation}`;
+	const kinds = rule.kinds === void 0 ? "" : ` for ${rule.kinds.join("/")}`;
+	return `${rule.account}${where}${kinds}: ${rule.as}`;
+}
+/** A label setting's value as a loosening carries it: the rules in words, the icons as they are, the rest as text. */
+function labelSettingValue(loosening, value) {
+	if (value === void 0 || value === null) return void 0;
+	if (loosening.path === "agentLabel.rules") return value.map(agentLabelRuleText);
+	if (loosening.path === "agentLabel.slackIcons") return { ...value };
+	return String(value);
+}
+/** The label settings a change can write, as the file holds them — raw, as `changedSettings` records every setting. */
+const LABEL_SETTINGS = [
+	"word",
+	"name",
+	"rules",
+	"slackIcons"
+];
+function storedAgentLabel(config) {
+	const stored = config.agentLabel;
+	return typeof stored === "object" && stored !== null && !Array.isArray(stored) ? stored : {};
+}
 /** The settings of a mailbox, and of an account, that a change can write — the ones the classifier judges. */
 const INBOX_SETTINGS = [
 	"sendPolicy",
@@ -6132,7 +6317,7 @@ const ACCOUNT_SETTINGS = [
 ];
 /**
 * Every setting that differs between `before` and `after`, loosened or tightened: the defaults, the secret store,
-* and each mailbox's and account's own settings — including those of one added or removed.
+* the agent label's settings, and each mailbox's and account's own settings — including those of one added or removed.
 *
 * What a change approval binds, beside its loosenings. A preview shows the whole change — "sends approved by never;
 * changes approved by chat" — and binding only the loosenings let a claim drop the tightening a person read, since
@@ -6170,6 +6355,9 @@ function changedSettings(before, after) {
 	const defaultsAfter = after.defaults;
 	for (const key of [.../* @__PURE__ */ new Set([...Object.keys(defaultsBefore), ...Object.keys(defaultsAfter)])].sort()) record(`defaults.${key}`, defaultsBefore[key], defaultsAfter[key]);
 	record("secrets.store", before.secrets?.store, after.secrets?.store);
+	const labelBefore = storedAgentLabel(before);
+	const labelAfter = storedAgentLabel(after);
+	for (const key of LABEL_SETTINGS) record(`agentLabel.${key}`, labelBefore[key], labelAfter[key]);
 	return changes;
 }
 /**
@@ -9304,7 +9492,7 @@ function folding(platform) {
 	return platform === "win32" ? (text) => text.toLowerCase() : (text) => text;
 }
 /** The package version, read from package.json at build time. */
-const VERSION = "0.18.1";
+const VERSION = "0.19.0";
 /**
 * Versions as semver writes and orders them — what an update compares, and what the daily update check's reader needs
 * to decide whether the release it last heard of is newer than the one running.
@@ -9482,8 +9670,10 @@ const CHANNEL_PACKAGES = new Set(CHANNEL_SNAPSHOT.filter(({ manifest }) => manif
 /**
 * Locates the command that runs `request.target`'s CLI with `request.words`, or says why there is none.
 *
-* The program is always this process's Node (`process.execPath`), which must satisfy the target's `engines.node`; no
-* interpreter named anywhere else is run, or asked its version. A TypeScript entry gets `--experimental-strip-types`,
+* The program is always this process's Node, which must satisfy the target's `engines.node`; no interpreter named
+* anywhere else is run, or asked its version. It is named as PATH finds it — the first `node` on `request.env`'s PATH
+* that is the same real file as `process.execPath` — and otherwise by `process.execPath` (CUE-492): the real file only
+* identifies it, and `process.version` is that file's. A TypeScript entry gets `--experimental-strip-types`,
 * which Node 22.12–22.17 needs, and `--experimental-transform-types` only when this source run was started with it;
 * no other flag this process was started with is carried — debug, preload, condition and memory flags are not what the
 * CLI needs. The suite directories the command uses go between the entry and its words, one canonical option each,
@@ -9524,6 +9714,7 @@ function locateCliCommand(request, runtime = {
 		return fail("caller", `${nearest.root} cannot be resolved`);
 	}
 	if (!isAbsolute(process.execPath)) return fail("interpreter", `this Node, ${process.execPath}, is not a full path`);
+	const program = nodeProgram(request.env);
 	const pins = {};
 	for (const key of request.uses) pins[key] = request.paths[key];
 	let words;
@@ -9532,7 +9723,7 @@ function locateCliCommand(request, runtime = {
 	} catch (error) {
 		return fail("arguments", error instanceof Error ? error.message : String(error));
 	}
-	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform);
+	const build = (found) => buildCommand(target, found, words, runtime, callerSource, platform, program);
 	const located = (built, found, direction) => Object.freeze({
 		ok: true,
 		command: built.command,
@@ -9672,7 +9863,7 @@ function locateCliCommand(request, runtime = {
 * Checks what was found and makes its command: the target's Node range against this Node, then the entry — the source
 * CLI or the manifest's bin for the command it declares — as a readable file inside its package.
 */
-function buildCommand(target, found, words, runtime, callerSource, platform) {
+function buildCommand(target, found, words, runtime, callerSource, platform, program) {
 	const engines = found.manifest.engines;
 	const range = typeof engines === "object" && engines !== null ? engines.node : void 0;
 	if (typeof range !== "string") return {
@@ -9709,7 +9900,7 @@ function buildCommand(target, found, words, runtime, callerSource, platform) {
 	return {
 		ok: true,
 		command: new PrintedCommand(GATE, [
-			process.execPath,
+			program,
 			...flags,
 			checked.path,
 			...words
@@ -10013,7 +10204,8 @@ function cliHandoffs(options) {
 			uses: usesOf(use),
 			paths,
 			platform,
-			...registrations === void 0 ? {} : { registrations }
+			...registrations === void 0 ? {} : { registrations },
+			...options.env === void 0 ? {} : { env: options.env }
 		}, ...options.runtime === void 0 ? [] : [options.runtime]);
 		return result.ok ? result.command : result;
 	};
@@ -10546,7 +10738,11 @@ const SETTING_LABELS = {
 	"defaults.downloadsDir": "downloads folder",
 	"defaults.confirm.elicitationClients": "clients trusted to ask for a send approval",
 	"defaults.updateCheck": "daily update check",
-	"secrets.store": "where credentials are kept"
+	"secrets.store": "where credentials are kept",
+	"agentLabel.word": "the word after your name in the agent label",
+	"agentLabel.name": "the name in the agent label",
+	"agentLabel.rules": "who each kind of message appears to come from",
+	"agentLabel.slackIcons": "the icon of the agent’s Slack posts"
 };
 /**
 * What the loosening means for the person, in their terms.
@@ -10571,6 +10767,10 @@ function meaning(field, after, scope) {
 		case "defaults.confirm.elicitationClients": return "these clients may ask you to approve a send in their own window";
 		case "defaults.updateCheck": return "nothing on this machine will ask npm for a newer release, or stop until one is installed";
 		case "secrets.store": return "credentials will move out of the system keychain into files on this disk";
+		case "agentLabel.word": return "what an agent sends will carry this word after your name";
+		case "agentLabel.name": return after === null ? "where a channel has no name of its own for you, an agent’s message will be refused until a name is set" : "where a channel has no name of its own for you, what an agent sends will carry this name";
+		case "agentLabel.rules": return "what a rule sends as `me` goes out as you, with no label: it will look as if you wrote it yourself";
+		case "agentLabel.slackIcons": return "the app’s Slack posts will show this icon beside your name";
 		default: return "";
 	}
 }
@@ -11612,7 +11812,8 @@ async function withManagedShim(context, product, installed) {
 				...context.core.paths,
 				downloadsDir: context.core.paths.dataDir
 			},
-			platform: context.platform
+			platform: context.platform,
+			env: context.env
 		});
 		if (!located.ok) throw new CommsError("CONFIG", `the managed CLI command could not be located: ${located.message}`);
 		shim = await (context.writeShim ?? writeManagedShim)(shimContext, {
@@ -11675,7 +11876,7 @@ function serverPruneChange(core, env, request, own) {
 	};
 	const { packageName, version } = ownProduct(request.channel, own) ?? {
 		packageName: serverFacts(request.channel).packageName,
-		version: "0.18.1"
+		version: "0.19.0"
 	};
 	const product = {
 		packageName,
@@ -12330,7 +12531,7 @@ async function askLine(streams, question) {
 }
 channelServer("core").packageName;
 //#endregion
-//#region ../core/dist/tool-arguments-DLa_xsSp.mjs
+//#region ../core/dist/tool-arguments-BkdTZEb8.mjs
 const APPLIED = Symbol.for("agentcomms.strictToolArguments");
 const TARGET = "draft-2020-12";
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentcomms/whatsapp",
-  "version": "0.18.1",
+  "version": "0.19.0",
   "description": "WhatsApp for coding agents, read-only: list, read and search the chats WhatsApp for Mac keeps on this Mac, and draft replies as links the person sends. No network client; it never sends.",
   "type": "module",
   "license": "MIT",
@@ -34,7 +34,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@agentcomms/core": "0.18.1"
+    "@agentcomms/core": "0.19.0"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "2.3.1",
@@ -98,5 +98,5 @@
     "typecheck": "tsc -p tsconfig.json",
     "test": "node --experimental-strip-types --disable-warning=ExperimentalWarning --test --test-timeout=600000 \"test/**/*.test.ts\""
   },
-  "gitHead": "fc398edc67287e411f8c5cb821f434220cb83aa5"
+  "gitHead": "29a7121620a9ef305a4260f193c40db1980312bd"
 }