@ghostlytools/cli 1.2.0 → 1.2.1

package/dist/ghostly.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as __exportAll } from "./assets/rolldown-runtime-8H4AJuhK.js";
-import { $ as SSHSIG_NAMESPACE, $a as readAppRevocations, $n as engineError, An as encodeDnsQuery, Ao as signalHasVideo, At as didJwsAlg, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Co as RTC_CONFIG, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Do as callSignalHeardAt, Dt as checkDidJws, Ec as setLinkTraceSink, En as decodeDnsResponse, Eo as callRtcConfig, Et as DidError, Fa as RUN_RESULTS, Fc as openRelayPayload, Fn as recordsFromWellKnown, Ft as didWebFileUrl, Gc as fromBase64Url$1, Hc as MAX_AVATAR_LENGTH, Ht as staticDidDocument, Ia as STATUS_CARD_LIMITS, Ii as identityStatement, In as recordsName, It as didWebHost, Ja as appFingerprint, Jc as toZ32, Jt as resolveDidDht, Ka as APP_PREFIXES, Kc as randomBytes$1, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as buttonLabelClash, Ln as txtValue, Lt as normalizeDid, Ma as replySnippet, Mc as RELAY_PAYLOAD_MAX_BYTES, Mn as nip05RootKey, Mt as didWebDocumentUrl, Ni as boundVerifiedIdentity, Nn as normalizeDomain, Nt as didWebFile, On as domainTxtRecord, Oo as extractParamsFromSdp, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Pt as didWebFileNames, Ra as checkStatusCard, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as CALL_SIGNAL_MAX_AGE_MS, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, To as buildSdpFromSignal, Uc as sanitizeAvatar, Ur as TYPING_KINDS, Ut as strictBase64Url, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as checkAppRevokeStatement, Xc as utf8Encode, Ya as appRef, Yc as utf8Decode, Ys as inviteLink, Z as groupName, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, eo as signAppObject, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ho as GhostlyHttpError, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jt as didSignedMessages, kn as domainWellKnownFile, ko as parseCallSignal, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, no as canonicalJson, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oc as seedSigner, or as groupFileFallback, ot as verifyBitcoinMessage, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qa as APP_STATEMENT_LIMITS, qc as toBase64Url, qi as irohRelayUrl, ra as sanitizeFileName, ro as canonicalJsonBytes, rt as sameSshKey, s as readAppStore, sa as baseMime, sr as isGroupMessageId, st as BitcoinAddressError, to as signAppRevocation, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wo as answersOffer, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yo as LIMITS, yt as parseAtprotoDidDocument, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-BMUcYQ7b.js";
+import { $ as SSHSIG_NAMESPACE, $a as appRef, $c as randomBytes$1, $n as engineError, An as encodeDnsQuery, Ao as RTC_CONFIG, At as didJwsAlg, Ba as cardLine, Bn as resolveLightningDestination, Bt as parseDidSignaturePaste, Cn as homeserverWebEndpoint, Ct as DID_DOCUMENT_MAX_BYTES$1, Dn as dnsProofName, Dt as checkDidJws, En as decodeDnsResponse, Eo as LIMITS, Et as DidError, Fa as PR_CHECKS, Fn as recordsFromWellKnown, Fo as extractParamsFromSdp, Ft as didWebFileUrl, Ha as checkStatusCard, Hc as openRelayPayload, Ht as staticDidDocument, Ia as PR_STATES, Ii as identityStatement, In as recordsName, Io as parseCallSignal, It as didWebHost, Jt as resolveDidDht, Ki as irohDescriptor, Kr as sanitizeTypingStatus, La as RUN_RESULTS, Ln as txtValue, Lo as signalHasVideo, Lt as normalizeDid, Ma as replySnippet, Mn as nip05RootKey, Mo as buildSdpFromSignal, Mt as didWebDocumentUrl, Nc as setLinkTraceSink, Ni as boundVerifiedIdentity, Nn as normalizeDomain, No as callRtcConfig, Nt as didWebFile, On as domainTxtRecord, Ot as checkDidSignature, Pa as ITEM_STATES, Pn as recordsFromTxt, Po as callSignalHeardAt, Pt as didWebFileNames, Qa as appFingerprint, Qc as fromBase64Url$1, Ra as STATUS_CARD_LIMITS, Rn as wellKnownUrl, Rt as parseDid, Sn as pubkyProofPath, So as GhostlyHttpError, St as verifyAtprotoRecordProof, Tn as DOMAIN_FILE_MAX_BYTES, Ur as TYPING_KINDS, Ut as strictBase64Url, Va as cardUrl, Vn as decodeBolt11, Vr as transferEnded, Vt as signingKeys, Wr as TYPING_REFRESH_MS, Xa as APP_PREFIXES, Xc as sanitizeAvatar, Yc as MAX_AVATAR_LENGTH, Z as groupName, Za as APP_STATEMENT_LIMITS, _ as readAppBundle, _n as isPubkyProofFolder, _t as isAtprotoDid, aa as PLAYABLE_AUDIO, ao as signAppObject, ar as fetchesByItself, at as verifySshSignature, bn as pubkyProofCapability, bt as shortAtprotoDid, c as signAppStore, ca as fileMessageText, ci as checkPushEndpoint, co as canonicalJsonBytes, ct as decodeAnyBitcoinAddress, dr as readGroupWantNo, dt as ATPROTO_PROOF_COLLECTION, ea as readImageMeta, el as toBase64Url, eo as checkAppRevokeStatement, er as engineText, et as SshSigError, ft as ATPROTO_PROOF_SCOPE, g as isAppUrl, gn as isPubkyKey, gt as checkAtprotoProofRecord, h as checkAppManifest, hn as PUBKY_PROOF_MAX_BYTES, ht as atprotoProofRkey, ia as sanitizeMime, in as WALLET_NETWORKS, io as readAppRevocations, ir as GROUP_WANT_NO_FRAME, it as sshSignCommand, ji as IdentityCheckUnavailable, jn as isPublicAddress, jo as answersOffer, jt as didSignedMessages, kn as domainWellKnownFile, ko as CALL_SIGNAL_MAX_AGE_MS, kt as didGhostlyServiceEntry, l as APP_BUNDLE_LIMITS, la as parseVoiceMeta, ln as walletNetworkOf, lr as readGroupHave, lt as ATPROTO_DECLARED_SCOPE, m as assembleAppBundle, ma as RateWindow, mt as atprotoProofRecord, n as appStoreDecision, nc as inviteLink, nl as utf8Decode, nr as GROUP_HAVE_FRAME, nt as parseSshSignature, o as checkAppStoreIndex, oa as VOICE_LIMITS, oo as signAppRevocation, or as groupFileFallback, ot as verifyBitcoinMessage, pc as seedSigner, pi as BUTTONS_CAPABILITY, pt as atprotoDidMethod, qi as irohRelayUrl, ra as sanitizeFileName, rl as utf8Encode, rt as sameSshKey, s as readAppStore, sa as baseMime, so as canonicalJson, sr as isGroupMessageId, st as BitcoinAddressError, tl as toZ32, tr as GROUP_FILE_LIMITS, tt as parseSshPublicKey, ua as voicePeaksOf, ur as readGroupWant, ut as ATPROTO_FULL_SCOPE, vn as newPubkyProofFolder, vt as normalizeAtprotoHandle, wn as pubkyHomeserverOf, wt as DID_FILE_MAX_BYTES, xn as pubkyProofFile, xt as AtprotoProofError, yn as normalizePubkyKey, yt as parseAtprotoDidDocument, za as buttonLabelClash, zc as RELAY_PAYLOAD_MAX_BYTES, zn as requestLnurlInvoice, zr as ChatFiles, zt as parseDidDocument } from "./assets/src-aKGjb_yz.js";
 import { c as fileStore, f as store$1, i as STORES, m as wrap, o as databaseName, p as transact, u as openDb } from "./assets/idb-CTF6LF5B.js";
 import { a as fileBytesOf, i as fileBytes, l as FILE_BYTES_STEP } from "./assets/fileBytes-BcYZhNgF.js";
 import { createRequire } from "node:module";
@@ -14,11 +14,11 @@ import { schnorr } from "@noble/curves/secp256k1.js";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
 import { access, constants, link, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { decode, npubEncode } from "nostr-tools/nip19";
 import { BunkerSigner } from "nostr-tools/nip46";
 import { SimplePool } from "nostr-tools/pool";
 import { generateSecretKey } from "nostr-tools/pure";
-import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer as createServer$1 } from "node:http";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
@@ -35,7 +35,7 @@ import { IDBFactory, IDBKeyRange as IDBKeyRange$1, IDBTransaction } from "fake-i
 import { format } from "node:util";
 var package_default = {
 	name: "@ghostlytools/cli",
-	version: "1.2.0",
+	version: "1.2.1",
 	type: "module",
 	description: "Ghostly for bots and terminals: the app's own engine, headless on Node, behind a daemon and a `ghostly` command with JSON output.",
 	license: "MIT",
@@ -139,7 +139,7 @@ var CliError = class extends Error {
 /** Anything thrown, as the error a bot sees: the engine's own refusals keep their words. */
 function asCliError(error) {
 	if (error instanceof CliError) return error;
-	if (error && typeof error === "object" && "code" in error && "message" in error && typeof error.code === "string" && error.code in EXIT) return new CliError(error.code, String(error.message));
+	if (error && typeof error === "object" && "code" in error && "message" in error && typeof error.code === "string" && Object.hasOwn(EXIT, error.code)) return new CliError(error.code, String(error.message));
 	const local = localFileError(error);
 	if (local) return local;
 	const unopened = profileOpenError(error);
@@ -291,7 +291,9 @@ function globalOption(arg) {
 }
 /**
 * Global options given before the command (`ghostly --profile bot send …`) move after it, where every command's
-* parser reads them. Stops at `--` and at the first word that is not a global option.
+* parser reads them. Stops at `--` and at the first word that is not a global option. They go before the first word
+* after the command's that starts with a dash (its first option, or the `--` that ends them), else at the end: never
+* between an option and its value, which may itself be `--` (`--pretty profile set --name --`).
 */
 function liftGlobals(argv) {
 	const lifted = [];
@@ -306,11 +308,11 @@ function liftGlobals(argv) {
 		i += takesValue ? 2 : 1;
 	}
 	const rest = argv.slice(i);
-	const end = rest.indexOf("--");
-	return end === -1 ? [...rest, ...lifted] : [
-		...rest.slice(0, end),
+	const dash = rest[0] === "--" ? 0 : rest.findIndex((word, i) => i > 0 && word.startsWith("-"));
+	return dash === -1 ? [...rest, ...lifted] : [
+		...rest.slice(0, dash),
 		...lifted,
-		...rest.slice(end)
+		...rest.slice(dash)
 	];
 }
 //#endregion
@@ -814,64 +816,104 @@ var CONTACT_KEY = /^[ybndrfg8ejkmcpqxot1uwisza345h769]{52}$/;
 * itself (which the contact controls, so it never wins over a label).
 */
 function findChat(links, ref) {
+	return chatBy(links, ref).link;
+}
+/** `findChat`, and whether only the name the contact gave itself (`theirName`) found the chat. */
+function chatBy(links, ref) {
 	const exact = links.find((link) => link.id === ref);
-	if (exact) return exact;
+	if (exact) return {
+		link: exact,
+		theirName: false
+	};
 	if (CONTACT_KEY.test(ref)) {
 		const byKey = links.filter((link) => link.peerPubKeyZ32 === ref);
-		if (byKey.length === 1) return byKey[0];
+		if (byKey.length === 1) return {
+			link: byKey[0],
+			theirName: false
+		};
 		if (byKey.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one chat: use its id`, { matches: byKey.map((link) => link.id) });
 		throw new CliError("not_found", `No chat with ${JSON.stringify(ref)}`);
 	}
 	const byPrefix = links.filter((link) => link.id.startsWith(ref));
-	if (byPrefix.length === 1) return byPrefix[0];
+	if (byPrefix.length === 1) return {
+		link: byPrefix[0],
+		theirName: false
+	};
 	const lower = ref.toLowerCase();
 	const named = (name) => name?.trim().toLowerCase() === lower;
 	const byLabel = links.filter((link) => named(link.label));
 	const byName = byLabel.length ? byLabel : links.filter((link) => named(link.peerNick));
-	if (byName.length === 1) return byName[0];
+	if (byName.length === 1) return {
+		link: byName[0],
+		theirName: !byLabel.length
+	};
 	if (byPrefix.length > 1 || byName.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one chat: use its id`, { matches: [...byPrefix, ...byName].map((link) => link.id) });
 	throw new CliError("not_found", `No chat ${JSON.stringify(ref)}`);
 }
+/** Only an invitation so far: this profile is not in the group (yet), and whoever invited chose its name. */
+var invitedOnly = (group) => group.status === void 0 && !!group.invitation;
+/**
+* A group by its id, by a unique prefix of its id, or by its name. A group this profile is in wins over an invitation
+* with the same prefix or name (the one who invites chooses those); an invitation is still found by its id, and by
+* prefix or name where no group of this profile has it.
+*/
 function findGroup(groups, ref) {
 	const exact = groups.find((group) => group.id === ref);
 	if (exact) return exact;
-	const byPrefix = groups.filter((group) => group.id.startsWith(ref));
+	const mineFirst = (found) => {
+		const mine = found.filter((group) => !invitedOnly(group));
+		return mine.length ? mine : found;
+	};
+	const byPrefix = mineFirst(groups.filter((group) => group.id.startsWith(ref)));
 	if (byPrefix.length === 1) return byPrefix[0];
-	const byName = groups.filter((group) => group.name.trim().toLowerCase() === ref.toLowerCase());
+	const byName = mineFirst(groups.filter((group) => group.name.trim().toLowerCase() === ref.toLowerCase()));
 	if (byName.length === 1) return byName[0];
 	if (byPrefix.length > 1 || byName.length > 1) throw new CliError("bad_request", `${JSON.stringify(ref)} names more than one group: use its id`, { matches: [...byPrefix, ...byName].map((group) => group.id) });
 	throw new CliError("not_found", `No group ${JSON.stringify(ref)}`);
 }
-var chatOf = (ctx, params) => findChat(state(ctx).links, str(params, "chat", true));
 /**
-* A chat or a group, as `forward` names them: `group:<id>` is a group; anything else a chat first (id, prefix or name),
-* then a group. `linkId` is what the engine calls it.
+* A chat or a group, where a command takes either: `group:<id>` is a group; anything else a chat first (`findChat`),
+* then a group. A chat found only by the name its contact gave itself never takes what also names a group: a group's
+* own id is that group, and a prefix or the name of a group this profile is in is refused, with both ids. With neither,
+* the error says what `findChat` would.
 */
-function chatOrGroup(ctx, ref) {
-	if (ref.startsWith("group:")) {
-		const group = findGroup(state(ctx).groups, ref.slice(6));
-		return {
-			id: group.id,
-			linkId: `group:${group.id}`,
-			group: true
-		};
-	}
+function findChatOrGroup(links, groups, ref) {
+	if (ref.startsWith("group:")) return { group: findGroup(groups, ref.slice(6)) };
+	let chat;
 	try {
-		const link = findChat(state(ctx).links, ref);
-		return {
-			id: link.id,
-			linkId: link.id,
-			group: false
-		};
+		chat = chatBy(links, ref);
 	} catch (error) {
 		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
-		const group = findGroup(state(ctx).groups, ref);
-		return {
-			id: group.id,
-			linkId: `group:${group.id}`,
-			group: true
-		};
+		try {
+			return { group: findGroup(groups, ref) };
+		} catch (inner) {
+			throw inner instanceof CliError && inner.code !== "not_found" ? inner : error;
+		}
 	}
+	if (!chat.theirName) return { link: chat.link };
+	const exact = groups.find((group) => group.id === ref);
+	if (exact) return { group: exact };
+	const lower = ref.toLowerCase();
+	const also = groups.filter((group) => !invitedOnly(group) && (group.id.startsWith(ref) || group.name.trim().toLowerCase() === lower));
+	if (also.length) throw new CliError("bad_request", `${JSON.stringify(ref)} names a chat (the name its contact chose) and a group: use the chat's id or group:<id>`, {
+		chat: chat.link.id,
+		groups: also.map((group) => group.id)
+	});
+	return { link: chat.link };
+}
+var chatOf = (ctx, params) => findChat(state(ctx).links, str(params, "chat", true));
+/** A chat or a group as `findChatOrGroup` reads it. `linkId` is what the engine calls it. */
+function chatOrGroup(ctx, ref) {
+	const found = findChatOrGroup(state(ctx).links, state(ctx).groups, ref);
+	return "group" in found ? {
+		id: found.group.id,
+		linkId: `group:${found.group.id}`,
+		group: true
+	} : {
+		id: found.link.id,
+		linkId: found.link.id,
+		group: false
+	};
 }
 var groupOf = (ctx, params) => findGroup(state(ctx).groups, str(params, "group", true));
 /** Resolves with `check`'s first defined answer: now, or on a later state; `timeout` error after `ms`. */
@@ -2375,24 +2417,8 @@ function filesOf(messages, transfers) {
 		transfer: transfers[m.file.id] ?? null
 	}));
 }
-/**
-* The chat a file command names, or else a group (`group:<id>`, or a group's id, prefix or name where no chat has it),
-* as `forward` reads them. A name that is neither says what a chat would.
-*/
-function chatOrGroupOf(ctx, params) {
-	const ref = str(params, "chat", true);
-	if (ref.startsWith("group:")) return { group: findGroup(state(ctx).groups, ref.slice(6)) };
-	try {
-		return { link: chatOf(ctx, params) };
-	} catch (error) {
-		if (!(error instanceof CliError) || error.code !== "not_found") throw error;
-		try {
-			return { group: findGroup(state(ctx).groups, ref) };
-		} catch {
-			throw error;
-		}
-	}
-}
+/** The chat or the group a file command names (`findChatOrGroup`). */
+var chatOrGroupOf = (ctx, params) => findChatOrGroup(state(ctx).links, state(ctx).groups, str(params, "chat", true));
 /**
 * The chat or group a file belongs to: a file id starts with its chat's id (a group's file with `group-<id>-`), so it
 * may be left out; given, it must be the file's own. `where` is what the answer names it by.
@@ -2529,6 +2555,15 @@ function fitName(name) {
 	while (stem.length && !fits(stem.join("").trimEnd() + extension)) stem.pop();
 	return (stem.join("").trimEnd() || "file") + extension;
 }
+/**
+* The name `file save --dir` writes a file under. Its sender chose it, and the folder is one scripts and people run
+* tools in: a name that starts with a dash is an option to the tool a `*` hands it to ("-rf", "--checkpoint-action=…"),
+* so it gets a `_` first, as a Windows device name does in `sanitizeFileName`.
+*/
+function saveName(name) {
+	const clean = sanitizeFileName(name);
+	return fitName(clean.startsWith("-") ? `_${clean}` : clean);
+}
 var ACTIONS = [
 	"accept",
 	"decline",
@@ -2717,7 +2752,7 @@ var FILE_METHODS = {
 			size: transfer.size
 		};
 	},
-	/** Writes a received (or sent) file to disk: into `dir` under its own name, or to `path`. Never over a file unless `force`. */
+	/** Writes a received (or sent) file to disk: into `dir` under its own name (`saveName`), or to `path`. Never over a file unless `force`. */
 	async "file.save"(ctx, params) {
 		const fileId = str(params, "file", true);
 		if (params.chat !== void 0) fileChat(ctx, params, fileId);
@@ -2730,7 +2765,7 @@ var FILE_METHODS = {
 		if (stored.leftOut) throw new CliError("not_found", "Not in this backup: the light backup this profile was restored from left the file out");
 		const transfer = state(ctx).transfers[fileId] ?? stored.transfer;
 		if (transfer && transfer.state !== "done") throw new CliError("unavailable", `The file is not all here yet (${transfer.transferred} of ${transfer.size} bytes)`);
-		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), fitName(sanitizeFileName(stored.metadata.name)));
+		const target = str(params, "path") ? resolve(str(params, "path", true)) : join(resolve(str(params, "dir") ?? "."), saveName(stored.metadata.name));
 		const flags = bool(params, "force") ? "w" : "wx";
 		let out;
 		try {
@@ -2922,12 +2957,74 @@ function checked$1(card) {
 	if ("error" in result) throw new CliError("bad_request", `Status card: ${result.error}`, { card });
 	return result.card;
 }
-/** The latest message of mine in this chat or group with a card of this kind and id: the one an update edits. */
+/** Every text in a card's fields (title, step, items, runs, links…), as the contact's app may show it. */
+function cardTexts(value, out = []) {
+	if (typeof value === "string") out.push(value);
+	else if (Array.isArray(value)) for (const item of value) cardTexts(item, out);
+	else if (isObject(value)) for (const item of Object.values(value)) cardTexts(item, out);
+	return out;
+}
+/**
+* The secret guard `send` has (docs/CLI.md § Safety): a card whose text looks like a seed, a private key or a Cashu
+* token goes only with `--force`. `fields` are what this command gives (an update's own, not the card it merges over).
+* A card's text is read as given and as the card carries it (`cardLine`): a line loses its invisible characters on the
+* way, so a key one of them broke in two is whole again on the card. The fallback text goes as it is, as `send`'s.
+*/
+function guardSecrets(fields, params, verb) {
+	if (bool(params, "force")) return;
+	const check = (text) => {
+		const secret = findSecret(text);
+		if (secret) throw new CliError("confirm", `The card's text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; ${verb} it with --force if you mean to`, { kind: secret.kind });
+	};
+	for (const text of cardTexts([fields, params.run])) {
+		check(text);
+		check(cardLine(text, Infinity) ?? "");
+	}
+	if (typeof params.text === "string") check(params.text);
+}
+/** Per card (its chat or group, its kind and its id): the message of mine that carries it, as this process last saw it. */
+var carriers = /* @__PURE__ */ new WeakMap();
+var carrierKey = (linkId, kind, id) => `${linkId}\n${kind}\n${id}`;
+function carriersOf(ctx) {
+	let map = carriers.get(ctx);
+	if (map) return map;
+	carriers.set(ctx, map = /* @__PURE__ */ new Map());
+	const cards = map;
+	ctx.hub.onEvent((event) => {
+		if (event.type !== "message.sent" && event.type !== "group.sent") return;
+		const message = event.message;
+		const card = message?.card;
+		if (typeof message?.id !== "string" || typeof card?.id !== "string" || card.kind !== "task" && card.kind !== "routine" && card.kind !== "usage") return;
+		carried(cards, carrierKey(event.type === "group.sent" ? `group:${String(event.group)}` : String(event.chat), card.kind, card.id), message.id);
+	});
+	return map;
+}
+function carried(cards, key, messageId) {
+	cards.delete(key);
+	cards.set(key, messageId);
+	if (cards.size > 1e3) cards.delete(cards.keys().next().value);
+}
+/**
+* The latest message of mine in this chat or group with a card of this kind and id: the one an update edits. A card
+* this process sent or found before is read by its message's key, so its updates cost the same in a long chat as in a
+* short one; only a card not seen yet (the first update after a start, a one-shot) is looked for in the whole history.
+*/
 async function cardMessage(ctx, target, kind, id) {
+	const cards = carriersOf(ctx), key = carrierKey(target.linkId, kind, id);
+	const carries = (message) => message?.sender === "me" && message.card?.kind === kind && message.card.id === id;
+	const known = cards.get(key);
+	if (known !== void 0) {
+		const message = await node(ctx).getMessage(target.linkId, known);
+		if (carries(message)) return message;
+		cards.delete(key);
+	}
 	const messages = target.group ? await node(ctx).groupMessages({ groupId: target.id }) : await node(ctx).getMessages(target.linkId);
+	if (cards.has(key)) return cardMessage(ctx, target, kind, id);
 	for (let i = messages.length - 1; i >= 0; i--) {
 		const message = messages[i];
-		if (message.sender === "me" && message.card?.kind === kind && message.card.id === id) return message;
+		if (!carries(message)) continue;
+		carried(cards, key, message.id);
+		return message;
 	}
 	throw new CliError("not_found", `No ${kind} ${JSON.stringify(id)} of yours in this ${target.group ? "group" : "chat"}: send it first with ghostly ${kind} send`);
 }
@@ -2955,6 +3052,7 @@ async function parentThere(ctx, target, card) {
 async function sendCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const fields = fieldsOf(params);
+	guardSecrets(fields, params, "send");
 	const now = Date.now();
 	const id = typeof fields.id === "string" && fields.id ? fields.id : `${kind}-${toBase64Url(randomBytes$1(6))}`;
 	const card = checked$1(withRun({
@@ -2985,6 +3083,7 @@ async function sendCard(ctx, params, kind) {
 			card
 		});
 		if (result.error || !result.messageId) throw new CliError(result.refused ? "refused" : "unavailable", result.error ?? "Nothing to send");
+		carried(carriersOf(ctx), carrierKey(target.linkId, kind, id), result.messageId);
 		const edges = wait === "sent" ? await waitForGroupFrame(ctx, target.id, result.messageId, void 0, ms) : void 0;
 		return answer(target, kind, id, result.messageId, {
 			card,
@@ -2998,6 +3097,7 @@ async function sendCard(ctx, params, kind) {
 	});
 	if (result.error) throw new CliError(result.refused ? "refused" : "unavailable", result.error);
 	if (!result.messageId) throw new CliError("bad_request", "Nothing to send");
+	carried(carriersOf(ctx), carrierKey(target.linkId, kind, id), result.messageId);
 	let message = await node(ctx).getMessage(target.linkId, result.messageId);
 	if (wait !== "none") message = await waitForMessage(ctx, target.linkId, result.messageId, wait, ms);
 	return answer(target, kind, id, result.messageId, {
@@ -3024,6 +3124,7 @@ async function updateCard(ctx, params, kind) {
 	const target = chatOrGroup(ctx, str(params, "chat", true));
 	const id = str(params, kind, true);
 	const patch = fieldsOf(params);
+	guardSecrets(patch, params, "update");
 	const message = await cardMessage(ctx, target, kind, id);
 	if ((message.edit?.seq ?? 0) >= STATUS_CARD_LIMITS.edits) throw new CliError("refused", `This ${kind}'s message took ${STATUS_CARD_LIMITS.edits} updates, the most one takes: start a new card with ghostly ${kind} send (a new --id, or the same one: the newest card of an id stands for it)`, {
 		messageId: message.id,
@@ -3065,7 +3166,7 @@ async function updateCard(ctx, params, kind) {
 		pace.last = Date.now();
 		await editCard(ctx, target, message.id, card, text);
 	}
-	let edited = target.group ? (await node(ctx).groupMessages({ groupId: target.id })).find((m) => m.id === message.id) : await node(ctx).getMessage(target.linkId, message.id);
+	let edited = await node(ctx).getMessage(target.linkId, message.id);
 	if (wait === "confirmed" && edited?.edit?.pending) edited = await waitForEdit(ctx, target.linkId, message.id, ms);
 	const edges = wait === "sent" && edited?.edit ? await waitForGroupFrame(ctx, target.id, message.id, edited.edit.seq, ms) : void 0;
 	return answer(target, kind, id, message.id, {
@@ -3272,6 +3373,7 @@ async function updateButtons(ctx, params) {
 		edits: message.edit.seq
 	});
 	const before = message.card;
+	if (chosen !== void 0 && !before.buttons.some((b) => b.id === chosen)) throw new CliError("bad_request", `That message has no button ${JSON.stringify(chosen)}; its buttons: ${before.buttons.map((b) => b.id).join(", ")}`, { card: before });
 	const card = checked({
 		...before,
 		...chosen !== void 0 && { chosen },
@@ -3669,10 +3771,15 @@ function groupJson(group, showSecret = false) {
 * Group administration and pictures (WISP 1100, phase 3): what the app's group menu and profile screen do. The
 * engine enforces who may do what (the admin); these check the arguments and name members.
 */
-/** A member by key, unique key prefix or name; never this profile itself. */
+/**
+* A member by key, unique key prefix or name; never this profile itself. A whole key is that member, whatever another
+* member calls itself; a prefix and a name stand side by side (two members is an error, not a guess).
+*/
 function findMember(group, ref) {
 	const lower = ref.toLowerCase();
-	const matches = group.members.filter((m) => !m.me && (m.key === ref || m.key.startsWith(ref) || m.nick?.trim().toLowerCase() === lower));
+	const others = group.members.filter((m) => !m.me);
+	const byKey = others.filter((m) => m.key === ref);
+	const matches = byKey.length ? byKey : others.filter((m) => m.key.startsWith(ref) || m.nick?.trim().toLowerCase() === lower);
 	if (matches.length === 1) return matches[0];
 	throw new CliError(matches.length ? "bad_request" : "not_found", matches.length ? `${JSON.stringify(ref)} names more than one member` : `No member ${JSON.stringify(ref)} in ${group.name}`);
 }
@@ -3789,6 +3896,63 @@ var GROUP_ADMIN_METHODS = {
 	}
 };
 //#endregion
+//#region src/turnRefs.ts
+/**
+* The id an agent turn names its message by (docs/CLI.md § Agent turns). A message is stored under an id its sender
+* chose most of (`peer_<the id they sent>`), so a turn carries this one instead, made here from the chat (or group) and
+* that id: `t_` and 32 hex digits, in which nobody can write a word. Every command that takes a message's id takes it.
+*/
+function turnRef(where, messageId) {
+	return "t_" + createHash("sha256").update(`${where}\n${messageId}`).digest("hex").slice(0, 32);
+}
+var TURN_REF = /^t_[0-9a-f]{32}$/;
+var isRef = (value) => typeof value === "string" && TURN_REF.test(value);
+/**
+* `params` with each turn's id in `message`, `reply` and `messages` as the id its message is stored under: looked for
+* among the chat's (or group's) newest messages first, where a turn's almost always is, then in all of them. One that
+* names no message stays as given, and its command says so as for any unknown id.
+*/
+async function withStoredIds(ctx, params) {
+	const wanted = new Set([
+		params.message,
+		params.reply,
+		...Array.isArray(params.messages) ? params.messages : []
+	].filter(isRef));
+	if (!wanted.size) return params;
+	let target = null;
+	try {
+		if (typeof params.group === "string") {
+			const group = findGroup(state(ctx).groups, params.group);
+			target = {
+				id: group.id,
+				linkId: `group:${group.id}`,
+				group: true
+			};
+		} else if (typeof params.chat === "string") target = chatOrGroup(ctx, params.chat);
+	} catch {}
+	if (!target) return params;
+	const { id, linkId, group } = target;
+	const found = /* @__PURE__ */ new Map();
+	const look = (messages) => {
+		for (const message of messages) {
+			const ref = turnRef(id, message.id);
+			if (wanted.has(ref)) found.set(ref, message.id);
+		}
+		return found.size === wanted.size;
+	};
+	if (!look((await node(ctx).messagePage({
+		linkId,
+		limit: 200
+	})).messages)) look(group ? await node(ctx).groupMessages({ groupId: id }) : await node(ctx).getMessages(linkId));
+	const stored = (value) => isRef(value) ? found.get(value) ?? value : value;
+	return {
+		...params,
+		...params.message !== void 0 && { message: stored(params.message) },
+		...params.reply !== void 0 && { reply: stored(params.reply) },
+		...Array.isArray(params.messages) && { messages: params.messages.map(stored) }
+	};
+}
+//#endregion
 //#region ../browser/src/proofs/bitcoinWallets.ts
 /** What a proof proves and what it does not; shown next to every Bitcoin proof, given or received. */
 var BITCOIN_PROOF_LIMITS = [
@@ -12504,7 +12668,7 @@ var METHODS = {
 	async "settings.set"(ctx, params) {
 		const patch = {};
 		for (const [key, value] of Object.entries(params)) {
-			const kind = SETTABLE[key];
+			const kind = Object.hasOwn(SETTABLE, key) ? SETTABLE[key] : void 0;
 			if (!kind) throw new CliError("bad_request", `${key} is not a setting the CLI changes (${Object.keys(SETTABLE).join(", ")})`);
 			if (kind === "strings" && !(Array.isArray(value) && value.every((v) => typeof v === "string"))) throw new CliError("bad_request", `${key} must be a list of strings`);
 			if (kind === "string" && typeof value !== "string") throw new CliError("bad_request", `${key} must be a string`);
@@ -12826,7 +12990,8 @@ var METHODS = {
 	},
 	async "chat.transport"(ctx, params) {
 		const link = chatOf(ctx, params);
-		const transport = TRANSPORT_NAMES[str(params, "transport", true)];
+		const name = str(params, "transport", true);
+		const transport = Object.hasOwn(TRANSPORT_NAMES, name) ? TRANSPORT_NAMES[name] : void 0;
 		if (!transport) throw new CliError("bad_request", `transport must be one of auto, dht, webrtc, iroh, hyperdht`);
 		await node(ctx).setChatTransport({
 			linkId: link.id,
@@ -13209,12 +13374,12 @@ function history(messages, params, json = messageJson) {
 	};
 }
 Object.keys(METHODS);
-/** Runs one method of the API. */
+/** Runs one method of the API: one the table lists itself (`constructor`, which every object has, is none). */
 async function callApi(ctx, method, params = {}) {
-	const run = METHODS[method];
+	const run = Object.hasOwn(METHODS, method) ? METHODS[method] : void 0;
 	if (!run) throw new CliError("not_found", `No method ${method}`);
 	if (params === null || typeof params !== "object" || Array.isArray(params)) throw new CliError("bad_request", "params must be an object");
-	return run(ctx, params);
+	return run(ctx, await withStoredIds(ctx, params));
 }
 //#endregion
 //#region src/privateFolder.ts
@@ -14318,6 +14483,17 @@ var showSecret = { "show-secret": {
 	description: "Print the group's entry link (anyone who has it can join)"
 } };
 var secret = (options) => options["show-secret"] === true ? { showSecret: true } : {};
+/**
+* `--for` of the typing commands: the seconds it is kept on, 1 to 600, and never with `--stop`. A usage error (exit 2)
+* that names the flag: before, the API's own check answered ("for must be a number from 1 to 600", exit 1).
+*/
+function typingFor(options) {
+	const seconds = options.for;
+	if (seconds === void 0) return void 0;
+	if (typeof seconds !== "number" || !(seconds >= 1 && seconds <= 600)) throw new CliError("usage", `--for takes a number of seconds from 1 to 600, not ${JSON.stringify(seconds)}`);
+	if (options.stop === true) throw new CliError("usage", "--for keeps it on: not with --stop");
+	return seconds;
+}
 /** A history cursor: a timestamp when it is all digits, else a message id. */
 function cursor(value) {
 	if (value === void 0) return void 0;
@@ -14359,6 +14535,10 @@ var cardOptions = {
 	text: {
 		type: "string",
 		description: "The text older apps show instead (default: written from the card)"
+	},
+	force: {
+		type: "boolean",
+		description: "Send even if the card's text looks like a seed, a key or ecash"
 	}
 };
 /** `--link label=https://…` or a bare link, as a card's links. */
@@ -14392,7 +14572,26 @@ function itemOf(value) {
 		text: value.slice(colon + 1).trim()
 	};
 }
-/** A task's fields from its flags; what was not given is left out, so an update changes only what it names. */
+/** `--progress`, `--left`: a percent, or a usage error that names the flag. */
+function percent(options, flag) {
+	const value = options[flag];
+	if (value !== void 0 && !(typeof value === "number" && value >= 0 && value <= 100)) throw new CliError("usage", `--${flag} takes a percent from 0 to 100, not ${JSON.stringify(value)}`);
+}
+/** The flags of a task's pull request, and the field of `pr` each one gives. */
+var PR_FLAGS = [
+	["pr-url", "url"],
+	["pr-number", "number"],
+	["additions", "additions"],
+	["deletions", "deletions"],
+	["files", "files"],
+	["pr-state", "state"],
+	["pr-checks", "checks"]
+];
+/**
+* A task's fields from its flags; what was not given is left out, so an update changes only what it names. What a flag
+* got wrong is a usage error (exit 2) that names the flag: before, it reached the card's own check and failed as
+* `bad_request` (exit 1) in the card's words ("Status card: done is at most total").
+*/
 function taskFields(options) {
 	const fields = { ...cardJson(options.json) };
 	const set = (key, value) => {
@@ -14401,6 +14600,7 @@ function taskFields(options) {
 	set("id", options.id);
 	set("title", options.title);
 	set("status", options.status);
+	percent(options, "progress");
 	set("progress", options.progress);
 	set("step", options.step);
 	set("branch", options.branch);
@@ -14409,22 +14609,18 @@ function taskFields(options) {
 		if (!match) throw new CliError("usage", `--steps takes done/total, like 2/5, not ${JSON.stringify(options.steps)}`);
 		fields.done = Number(match[1]);
 		fields.total = Number(match[2]);
+		if (Number(match[2]) < 1 || Number(match[1]) > Number(match[2])) throw new CliError("usage", `--steps takes done/total with done at most total, like 2/5, not ${JSON.stringify(options.steps)}`);
 	}
+	if (options["pr-url"] !== void 0 && !cardUrl(options["pr-url"])) throw new CliError("usage", `--pr-url takes an https link of at most ${STATUS_CARD_LIMITS.url} characters, not ${JSON.stringify(options["pr-url"])}`);
+	for (const [flag, words] of [["pr-state", PR_STATES], ["pr-checks", PR_CHECKS]]) if (options[flag] !== void 0 && !words.includes(options[flag])) throw new CliError("usage", `--${flag} takes ${listed(words)}, not ${JSON.stringify(options[flag])}`);
 	const pr = {};
-	for (const [flag, key] of [
-		["pr-url", "url"],
-		["pr-number", "number"],
-		["additions", "additions"],
-		["deletions", "deletions"],
-		["files", "files"],
-		["pr-state", "state"],
-		["pr-checks", "checks"]
-	]) if (options[flag] !== void 0) pr[key] = options[flag];
+	for (const [flag, key] of PR_FLAGS) if (options[flag] !== void 0) pr[key] = options[flag];
 	if (Object.keys(pr).length) fields.pr = {
 		...fields.pr && typeof fields.pr === "object" ? fields.pr : {},
 		...pr
 	};
 	if (Array.isArray(options.item) && options.item.length) fields.items = options.item.map(itemOf);
+	if (Array.isArray(options.tag) && options.tag.length > STATUS_CARD_LIMITS.tags) throw new CliError("usage", `--tag is given at most ${STATUS_CARD_LIMITS.tags} times, not ${options.tag.length}`);
 	if (Array.isArray(options.tag) && options.tag.length) fields.tags = options.tag;
 	set("parent", options.parent);
 	const links = cardLinks(options.link);
@@ -14441,6 +14637,25 @@ function needs(card, fields, usage) {
 	if (missing.length) throw new CliError("usage", `${missing.join(" and ")} ${missing.length > 1 ? "are" : "is"} needed: ghostly ${usage}`);
 	return card;
 }
+/**
+* A new task's pull request goes by its link: `--pr-state` and the like without `--pr-url` (or `pr.url` in `--json`)
+* are a usage error that names them. An update's card may have the link already, so only a send asks.
+*/
+function prLinked(card, options, usage) {
+	const given = PR_FLAGS.filter(([flag]) => options[flag] !== void 0).map(([flag]) => `--${flag}`);
+	if (!given.length || card.pr.url !== void 0) return card;
+	throw new CliError("usage", `${given.join(" and ")} ${given.length > 1 ? "go" : "goes"} with --pr-url: ghostly ${usage}`);
+}
+/**
+* A usage card says how much is left: `--left`, or `--used` with `--limit`, as flags or in `--json`. The one that is
+* missing is a usage error that names the flag.
+*/
+function quota(card, usage) {
+	const used = card.used !== void 0;
+	if (used !== (card.limit !== void 0)) throw new CliError("usage", `--${used ? "used" : "limit"} goes with --${used ? "limit" : "used"}: ghostly ${usage}`);
+	if (card.left === void 0 && !used) throw new CliError("usage", `--left is needed (or --used with --limit): ghostly ${usage}`);
+	return card;
+}
 /** A time a command names: milliseconds, or a date the JavaScript Date reads (`2026-09-30T01:00:00Z`). */
 function cardTime(value, flag) {
 	if (value === void 0) return void 0;
@@ -14589,6 +14804,7 @@ function usageWindowOf(value) {
 /** A usage card's fields from its flags (WISP 405 § Usage); `--json` gives any of them, the flags win over it. */
 function usageFields(options) {
 	const fields = { ...cardJson(options.json) };
+	percent(options, "left");
 	for (const key of [
 		"id",
 		"left",
@@ -14646,7 +14862,8 @@ var usageOptions = {
 		description: "Every 1:1 chat with a contact, instead of one chat"
 	},
 	json: cardOptions.json,
-	text: cardOptions.text
+	text: cardOptions.text,
+	force: cardOptions.force
 };
 //#endregion
 //#region src/commands/calls.ts
@@ -14718,6 +14935,7 @@ var commands$7 = {
 };
 //#endregion
 //#region src/commands/chats.ts
+var BUTTON_UPDATE = "button update <chat|group> <message> [--chosen <button>] [--close] [--text <text>] [--force] [--wait none|confirmed|sent] [--timeout s]";
 /** Invites, chats and messages: one entry per command, in alphabetical order (test/commands.test.ts checks). */
 var commands$6 = {
 	"button press": {
@@ -14746,7 +14964,7 @@ var commands$6 = {
 	},
 	"button update": {
 		method: "button.update",
-		usage: "button update <chat|group> <message> [--chosen <button>] [--close] [--text <text>] [--force] [--wait none|confirmed|sent] [--timeout s]",
+		usage: BUTTON_UPDATE,
 		summary: "Show the answer on a message's buttons (--chosen), close them, or change its text (the messageId send --button gave)",
 		args: ["chat", "message"],
 		options: {
@@ -14769,16 +14987,19 @@ var commands$6 = {
 			},
 			timeout: groupWait.timeout
 		},
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			message: a.message,
-			chosen: options.chosen,
-			close: options.close === true,
-			text: options.text,
-			force: options.force === true,
-			wait: options.wait,
-			timeout: options.timeout
-		})
+		params: ({ options }, a) => {
+			if (!options.chosen && options.close !== true && !options.text) throw new CliError("usage", `Give --chosen, --close or --text: ghostly ${BUTTON_UPDATE}`);
+			return {
+				chat: a.chat,
+				message: a.message,
+				chosen: options.chosen,
+				close: options.close === true,
+				text: options.text,
+				force: options.force === true,
+				wait: options.wait,
+				timeout: options.timeout
+			};
+		}
 	},
 	"chat connect": {
 		method: "chat.connect",
@@ -14882,10 +15103,13 @@ var commands$6 = {
 			type: "string",
 			description: "The code the contact reads out"
 		} },
-		params: ({ options }, { chat }) => ({
-			chat,
-			code: options.code
-		})
+		params: ({ options }, { chat }) => {
+			if (typeof options.code !== "string" || !options.code.trim()) throw new CliError("usage", "--code is needed: ghostly chat verify <chat> --code <code>");
+			return {
+				chat,
+				code: options.code
+			};
+		}
 	},
 	"chat wait": {
 		method: "chat.wait",
@@ -14996,18 +15220,22 @@ var commands$6 = {
 	},
 	"pin": {
 		method: "chat.pin",
-		usage: "pin <chat|group> <message> [--remove]",
+		usage: "pin <chat|group> <message> | --remove",
 		summary: "Pin a message at the top of a chat or group (one per chat: it replaces the pinned one); --remove unpins",
-		args: ["chat", "message"],
+		args: ["chat", "message...?"],
 		options: { remove: {
 			type: "boolean",
-			description: "Unpin the chat's pinned message"
+			description: "Unpin the chat's pinned message (it names no message)"
 		} },
-		params: ({ options }, a) => ({
-			chat: a.chat,
-			message: a.message,
-			remove: options.remove === true
-		})
+		params: ({ options }, a) => {
+			if (a.message === void 0 && options.remove !== true) throw new CliError("usage", "Missing <message>: ghostly pin <chat|group> <message> | --remove");
+			if (a.message?.includes(" ")) throw new CliError("usage", "Too many arguments: ghostly pin <chat|group> <message> | --remove");
+			return {
+				chat: a.chat,
+				message: a.message,
+				remove: options.remove === true
+			};
+		}
 	},
 	"react": {
 		method: "chat.react",
@@ -15031,7 +15259,7 @@ var commands$6 = {
 	},
 	"routine send": {
 		method: "routine.send",
-		usage: "routine send <chat|group> --name <name> --schedule \"every day 01:00\" [--cron \"0 1 * * *\"] [--state active|paused] [--next <time>] [--run ok|failed|skipped[:summary]] [--link url]... [--id id] [--json json|-|file] [--wait none|sent|delivered] [--timeout s]",
+		usage: "routine send <chat|group> --name <name> --schedule \"every day 01:00\" [--cron \"0 1 * * *\"] [--state active|paused] [--next <time>] [--run ok|failed|skipped[:summary]] [--link url]... [--id id] [--json json|-|file] [--force] [--wait none|sent|delivered] [--timeout s]",
 		summary: "Send a routine card (something a bot runs on a schedule: its last run and the next) to a chat or group",
 		args: ["chat"],
 		options: {
@@ -15048,13 +15276,14 @@ var commands$6 = {
 			card: needs(routineFields(options), [["name", "name"], ["schedule", "schedule"]], "routine send <chat|group> --name <name> --schedule \"every day 01:00\""),
 			run: runOf(options.run),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"routine update": {
 		method: "routine.update",
-		usage: "routine update <chat|group> <routine> [--run ok|failed|skipped[:summary]] [--next <time>] [--state active|paused] [--schedule ...] [--json json|-|file] [--wait none|confirmed|sent] [--timeout s]",
+		usage: "routine update <chat|group> <routine> [--run ok|failed|skipped[:summary]] [--next <time>] [--state active|paused] [--schedule ...] [--json json|-|file] [--force] [--wait none|confirmed|sent] [--timeout s]",
 		summary: "Update a routine card you sent: record a run, the next one, a pause (at most one update per 2.5 s; sooner ones merge)",
 		args: ["chat", "routine"],
 		options: {
@@ -15071,13 +15300,14 @@ var commands$6 = {
 			card: routineFields(options),
 			run: runOf(options.run),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"task send": {
 		method: "task.send",
-		usage: "task send <chat|group> --title <title> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url url --pr-number n --additions n --deletions n --files n --pr-state s --pr-checks c] [--branch b] [--tag label]... [--parent task] [--link url]... [--id id] [--json json|-|file] [--wait none|sent|delivered] [--timeout s]",
+		usage: "task send <chat|group> --title <title> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url url --pr-number n --additions n --deletions n --files n --pr-state s --pr-checks c] [--branch b] [--tag label]... [--parent task] [--link url]... [--id id] [--json json|-|file] [--force] [--wait none|sent|delivered] [--timeout s]",
 		summary: "Send a task card (a bot's work: status, progress, its PR) to a chat or group; prints its id and message",
 		args: ["chat"],
 		options: {
@@ -15091,15 +15321,16 @@ var commands$6 = {
 		},
 		params: ({ options }, { chat }) => ({
 			chat,
-			card: needs(taskFields(options), [["title", "title"]], "task send <chat|group> --title <title>"),
+			card: prLinked(needs(taskFields(options), [["title", "title"]], "task send <chat|group> --title <title>"), options, "task send <chat|group> --title <title> --pr-url <url>"),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
 	},
 	"task update": {
 		method: "task.update",
-		usage: "task update <chat|group> <task> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url ...] [--pr-state s] [--pr-checks c] [--tag label]... [--parent task] [--json json|-|file] [--wait none|confirmed|sent] [--timeout s]",
+		usage: "task update <chat|group> <task> [--status s] [--progress n | --steps a/b] [--step \"...\"] [--item state:text]... [--pr-url ...] [--pr-state s] [--pr-checks c] [--tag label]... [--parent task] [--json json|-|file] [--force] [--wait none|confirmed|sent] [--timeout s]",
 		summary: "Update a task card you sent: the fields given, merged over it (at most one update per 2.5 s; sooner ones merge)",
 		args: ["chat", "task"],
 		options: {
@@ -15115,6 +15346,7 @@ var commands$6 = {
 			task: a.task,
 			card: taskFields(options),
 			text: options.text,
+			force: options.force === true,
 			wait: options.wait,
 			timeout: options.timeout
 		})
@@ -15147,12 +15379,12 @@ var commands$6 = {
 			stop: options.stop === true,
 			kind: options.kind,
 			status: options.status,
-			for: options.for
+			for: typingFor(options)
 		})
 	},
 	"usage send": {
 		method: "usage.send",
-		usage: "usage send [<chat|group>] [--all] --left <percent> [--window \"5 h\"] [--resets <time>] [--label Claude] [--account <name>] [--also week=80@<time>]... [--used n --limit n] [--id id] [--json json|-|file] [--wait none|sent] [--timeout s]",
+		usage: "usage send [<chat|group>] [--all] --left <percent> [--window \"5 h\"] [--resets <time>] [--label Claude] [--account <name>] [--also week=80@<time>]... [--used n --limit n] [--id id] [--json json|-|file] [--force] [--wait none|sent] [--timeout s]",
 		summary: "Say how much of your quota is left (a bot's usage card, one per chat, updated in place); --all for every 1:1 chat",
 		args: ["chat?"],
 		options: {
@@ -15164,8 +15396,9 @@ var commands$6 = {
 			return {
 				chat,
 				all: options.all === true,
-				card: usageFields(options),
+				card: quota(usageFields(options), "usage send <chat|--all> --left <percent>"),
 				text: options.text,
+				force: options.force === true,
 				wait: options.wait,
 				timeout: options.timeout
 			};
@@ -15662,7 +15895,7 @@ var commands$3 = {
 			stop: options.stop === true,
 			kind: options.kind,
 			status: options.status,
-			for: options.for
+			for: typingFor(options)
 		})
 	}
 };
@@ -16455,6 +16688,12 @@ var PlaybackQueue = class {
 		this.length = 0;
 		return ms;
 	}
+	/** Drops up to that much from the front, in whole frames (audio whose time went by); returns how much, in milliseconds. */
+	skip(ms) {
+		const frames = Math.min(Math.floor(ms / 20), Math.floor(this.length / this.frame));
+		if (frames > 0) this.take(frames * this.frame);
+		return Math.max(0, frames) * 20;
+	}
 	take(bytes) {
 		const out = Buffer.allocUnsafe(bytes);
 		let filled = 0;
@@ -16682,6 +16921,10 @@ var ReorderBuffer = class {
 		}
 	}
 };
+//#endregion
+//#region src/calls/audio.ts
+/** The longest stall of the sender whose frames are still sent after it (see `catchUp`). */
+var MAX_CATCH_UP_MS = 1e3;
 /**
 * One call's audio: every 20 ms a frame from the queue (the program's audio, or silence) is encoded and sent; what
 * comes in is put back in order, decoded, and handed on in 20 ms frames as soon as it is. Nothing waits on a clock
@@ -16699,7 +16942,17 @@ var CallAudio = class {
 	timer = null;
 	startedAt = 0;
 	ticks = 0;
+	/** What was left in the queue after the last frame sent: the program's audio written ahead of the call. */
+	ahead = 0;
+	/** After a stall that was not replayed: how much of its audio is still to drop, down to what queue, and until when. */
+	owed = 0;
+	kept = 0;
+	owedUntil = 0;
 	talking = false;
+	/** The last silent frame's packet, how many silent frames in a row gave it, and that packet once it is kept (see `settle`). */
+	lastQuiet = null;
+	same = 0;
+	quiet = null;
 	stopped = false;
 	/** Frames sent and received, for `call list`. */
 	sent = 0;
@@ -16734,16 +16987,40 @@ var CallAudio = class {
 	tick() {
 		if (this.stopped) return;
 		const { frame, silent } = this.queue.next();
+		const still = silent || frame.equals(this.silence);
 		let payload;
-		try {
-			payload = this.options.encoder.encode(frame, this.samples);
-		} catch {
-			return;
+		if (still && this.quiet) payload = this.quiet;
+		else {
+			try {
+				payload = this.options.encoder.encode(frame, this.samples);
+			} catch {
+				return;
+			}
+			this.settle(still, payload);
 		}
 		const marker = !silent && !this.talking;
 		this.talking = !silent;
 		this.options.track.send(this.writer.packet(payload, marker));
 		this.sent++;
+		this.ahead = this.queue.queuedMs;
+	}
+	/**
+	* Keeps the packet silence encodes to once the encoder gave it SETTLED_FRAMES times in a row: it is sent again for
+	* the silent frames that follow, without the encoder, until the program's audio is back.
+	*/
+	settle(still, payload) {
+		if (!still) {
+			this.lastQuiet = null;
+			this.quiet = null;
+			this.same = 0;
+			return;
+		}
+		if (this.lastQuiet?.equals(payload)) {
+			if (++this.same >= 25) this.quiet = this.lastQuiet;
+			return;
+		}
+		this.lastQuiet = Buffer.from(payload);
+		this.same = 1;
 	}
 	/** Handles one packet from the track. Exposed for tests. */
 	receive(packet) {
@@ -16778,14 +17055,57 @@ var CallAudio = class {
 		const due = this.startedAt + (this.ticks + 1) * 20;
 		this.timer = setTimeout(() => {
 			if (this.stopped) return;
-			if (now() - due > 1e3) {
-				this.startedAt = now();
-				this.ticks = 0;
-			} else this.ticks++;
-			this.tick();
-			this.schedule();
+			if (now() - due < 20) {
+				this.ticks++;
+				this.drop();
+				this.tick();
+				this.schedule();
+				return;
+			}
+			setImmediate(() => {
+				if (this.stopped) return;
+				this.catchUp(now() - due);
+				this.schedule();
+			});
 		}, Math.max(0, due - now()));
 	}
+	/**
+	* Meets the clock again after the loop was busy: every frame that is due goes out at once, so a loop that turns
+	* slower than a frame for a while (every 40 ms under a large file) keeps up, and a program writing at real time
+	* stays there. The contact's jitter buffer takes the short burst. A stall past MAX_CATCH_UP_MS is not replayed: the
+	* clock starts again and what the program wrote during it is dropped, or it would be heard that much late for the
+	* rest of the call.
+	*/
+	catchUp(late) {
+		const now = this.options.now ?? Date.now;
+		if (late > 1e3) {
+			this.owed = late;
+			this.kept = this.ahead;
+			this.owedUntil = now() + MAX_CATCH_UP_MS;
+			this.startedAt = now();
+			this.ticks = 0;
+			this.drop();
+			this.tick();
+			return;
+		}
+		do {
+			this.ticks++;
+			this.drop();
+			this.tick();
+		} while (this.startedAt + (this.ticks + 1) * 20 <= now());
+	}
+	/**
+	* Drops the audio of a stall that was not replayed, as it is read: a long one does not fit the program's socket, so
+	* the rest of it comes over the next turns. What was queued before the stall (a clip written ahead) is kept.
+	*/
+	drop() {
+		if (this.owed <= 0) return;
+		if ((this.options.now ?? Date.now)() > this.owedUntil) {
+			this.owed = 0;
+			return;
+		}
+		this.owed -= this.queue.skip(Math.min(this.owed, this.queue.queuedMs - this.kept));
+	}
 };
 //#endregion
 //#region src/calls/media.ts
@@ -17258,6 +17578,8 @@ var CallManager = class {
 		this.callable(call.chat);
 		call.rate = rateOf(options.rate, call.rate);
 		const stack = await this.stack();
+		if (call.ended) throw new CliError("unavailable", "The call ended before it was answered");
+		if (call.state !== "ringing") throw new CliError("refused", "That call is not ringing here");
 		call.state = "connecting";
 		this.disarm(call);
 		try {
@@ -17364,10 +17686,18 @@ var CallManager = class {
 		this.calls.set(call.id, call);
 		return call;
 	}
-	/** The call's socket (open from now on: a program may connect before the media is up) and its media. */
+	/**
+	* The call's socket (open from now on: a program may connect before the media is up) and its media. A call that
+	* ended while its socket opened closes it here: `end` found none to close, and nothing lists the call any more.
+	*/
 	async attach(call, create) {
 		const queue = call.queue = new PlaybackQueue(call.rate);
-		call.socket = await AudioSocket.open(audioSocketPath(this.host.profileDir, call.id), call.rate, { onAudio: (chunk) => queue.push(chunk) });
+		const socket = await AudioSocket.open(audioSocketPath(this.host.profileDir, call.id), call.rate, { onAudio: (chunk) => queue.push(chunk) });
+		if (call.ended) {
+			await socket.close();
+			return;
+		}
+		call.socket = socket;
 		await this.connect(call, create);
 	}
 	/**
@@ -17375,6 +17705,7 @@ var CallManager = class {
 	* the call ended, or asked for a newer connection, while this one was made: then it is closed.
 	*/
 	async connect(call, create) {
+		if (call.ended) return false;
 		const attempt = ++call.attempt;
 		call.media?.close();
 		call.media = null;
@@ -19608,14 +19939,14 @@ async function startRuntime(paths, options = {}) {
 	(await import("./assets/ghostly_iroh_web-Dvzh3Y6E.js")).initSync({ module: irohWasmBytes() });
 	const [{ registerFileBytes }, { NodeFileBytes }] = await Promise.all([import("./assets/fileBytes-BcYZhNgF.js").then((n) => n.o), import("./assets/fileBytes-Dbifu5I5.js")]);
 	registerFileBytes("native", async () => new NodeFileBytes(paths.files), true);
-	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-BGXmSYx_.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
+	const [{ EngineServer }, { createHyperEndpoint }] = await Promise.all([import("./assets/server-D5FBZYW8.js").then((n) => n.t), import("./assets/endpoint-pgFkR2AS.js")]);
 	const network = hyperdhtNetwork();
 	const dht = mainlineNetwork();
-	const mainline = dht.off ? null : new (await (import("./assets/mainline-BueFJx3f.js"))).Mainline({
+	const mainline = dht.off ? null : new (await (import("./assets/mainline-DVYdrus6.js"))).Mainline({
 		bootstrap: dht.bootstrap,
 		host: dht.host
 	});
-	const transport = mainline || pinned ? new (await (import("./assets/mainline-BueFJx3f.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
+	const transport = mainline || pinned ? new (await (import("./assets/mainline-DVYdrus6.js"))).RelaysAndDht(mainline, pinned ? { relays: pinned } : {}, !!pinned) : null;
 	const server = new EngineServer({
 		...transport ? { transport } : {},
 		irohWeb: true,
@@ -19926,19 +20257,21 @@ function toTurn(event) {
 }
 function turn(event, source, where, message) {
 	const file = message.file;
+	const place = where.chat ?? where.group ?? "", messageId = turnRef(place, message.id);
 	return {
 		seq: event.seq,
-		id: `agent.turn:${event.id}`,
+		id: `agent.turn:${source}:${place}:${messageId}`,
 		type: "agent.turn",
 		at: event.at,
 		source,
 		...where,
-		messageId: message.id,
+		messageId,
 		timestamp: message.timestamp,
 		...message.press ? { press: message.press } : {},
 		untrusted: {
 			text: message.text,
 			name: message.nick ?? null,
+			messageId: message.id,
 			...message.replyTo ? { replyTo: {
 				id: message.replyTo.id,
 				snippet: message.replyTo.snippet
@@ -20127,7 +20460,14 @@ function requireProfile(g) {
 		createProfile(g.home, g.profile);
 		return;
 	}
-	throw new CliError("not_found", `No profile ${g.profile}: make it with \`ghostly profile create ${g.profile}\``);
+	throw noProfile(g);
+}
+function noProfile(g) {
+	return new CliError("not_found", `No profile ${g.profile}: make it with \`ghostly profile create ${g.profile}\``);
+}
+/** For a command that only reads: a mistyped profile is named as one, and `default` is not made by asking about it. */
+function knownProfile(g) {
+	if (g.profile !== "default" && !profileExists(g.home, g.profile)) throw noProfile(g);
 }
 /** Said on stderr when the daemon runs another release than this command (it started before an upgrade). */
 function versionWarning(daemon, cli) {
@@ -20591,6 +20931,7 @@ async function daemonCommand(argv) {
 		"restart"
 	].includes(sub)) noMoreThan(0, parsed.positionals, sub ? `daemon ${sub}` : "daemon [--detach]");
 	if (sub === "status") {
+		knownProfile(g);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) {
 			print({
@@ -20612,6 +20953,7 @@ async function daemonCommand(argv) {
 		return;
 	}
 	if (sub === "stop") {
+		knownProfile(g);
 		const client = await connectDaemon(g.paths.socket);
 		if (!client) throw new CliError("not_found", `No daemon runs profile ${g.profile}`);
 		print({
@@ -21132,7 +21474,8 @@ async function main(input) {
 	}
 	const [first, second] = argv;
 	const two = second && !second.startsWith("-") ? `${first} ${second}` : "";
-	if (first === "profile" && !COMMANDS[two]) {
+	const text = (name) => Object.hasOwn(TEXT_COMMANDS, name), table = (name) => Object.hasOwn(COMMANDS, name);
+	if (first === "profile" && !table(two)) {
 		await profileCommand(second, argv.slice(2));
 		return 0;
 	}
@@ -21160,19 +21503,19 @@ async function main(input) {
 		await callPipeCommand(argv.slice(2));
 		return -1;
 	}
-	if (two && TEXT_COMMANDS[two]) {
+	if (two && text(two)) {
 		await textCommand(two, argv.slice(2));
 		return 0;
 	}
-	if (two && COMMANDS[two]) {
+	if (two && table(two)) {
 		await tableCommand(two, argv.slice(2));
 		return 0;
 	}
-	if (TEXT_COMMANDS[first]) {
+	if (text(first)) {
 		await textCommand(first, argv.slice(1));
 		return 0;
 	}
-	if (COMMANDS[first]) {
+	if (table(first)) {
 		await tableCommand(first, argv.slice(1));
 		return 0;
 	}