@vincentt-xr/cli 0.21.0 → 0.22.0

package/MIGRATION.md

@@ -3,6 +3,21 @@
 Per version, newest first. Read by the platform's own version surface and served to
 creators' agents. Accurate or absent, never speculative (B-F5-2).
 
+## 0.22.0
+
+required: false
+No action required. Behaviour that changed:
+- `vincentt dx enable` at a terminal now asks `Allow unattended reports on your account? [y/N]` and, on `y`, records the grant on your Vincentt account first, then sets this machine. Success reads `Enabled for your account. Reports may now be sent without a prompt from any machine signed in to it.`
+- If the account does not record the grant, `vincentt dx enable` changes nothing and exits 1 with `✗ Vincentt did not record your consent.`, `✗ Too many consent changes. Wait a minute and try again.`, or `✗ Could not reach Vincentt to record your consent.` A refused sign-in exits 4 and a too-old CLI exits 5, as on other verbs.
+- Unattended `vincentt dx --send` and `vincentt report` now check the account first. An account grant sends; an account that is not granted refuses (exit 1) and clears this machine's setting, so turning reports off in the console or on another machine reaches this one. This machine's setting is used on its own only when the account cannot be reached. An interactive session still asks and makes no account check.
+- The `Unattended send: ENABLED since <day> (<n> days)` line now ends with where the answer came from: `· granted from the CLI`, `· granted in the console`, `· on your account`, or `· this machine (account not checked)`. `vincentt dx` and `vincentt version` check the account for up to 3 seconds first; `vincentt version` never fails because of that check.
+- `vincentt dx --json` adds `dxConsent`: `{"state": "on" | "off" | "unknown", "checked": "account" | "machine", "at"?, "via"?}`. `dxSendEnabled` and `dxSendEnabledAt` still describe this machine's setting.
+- `vincentt preview` has a new ending: when the preview server answers the tunnel with a reply this CLI cannot accept, the preview ends once with `✗ Preview stopped: the preview server sent an invalid reply. Update the CLI or try again later.` (exit 1) instead of reconnecting every few seconds indefinitely. The screen names the upgrade command and `vincentt preview`.
+- `vincentt publish` refuses the whole publish, listing the files, when a folder in the build output turns into a link to somewhere outside it while publish reads it. Let the build finish, then publish again.
+- `vincentt publish` refuses to upload when the platform's upload link does not carry the checksum publish computed for that file; nothing is sent, and the screen names the file.
+- A folder or file in the build output that publish cannot read now ends the publish with the "changed while publish was reading it" screen naming the path inside the build output, instead of a raw error message holding the full path.
+- File names printed on publish refusal screens show bidirectional and direction-mark characters as visible `\uXXXX` escapes.
+
 ## 0.21.0
 
 required: false

package/dist/cli/index.js

@@ -29,7 +29,7 @@ import { listProjectsCommand } from "../lib/listProjects.js";
 import { initCommand } from "../lib/initCommand.js";
 import { linkCommand, printUnreachable, unlinkCommand } from "../lib/projects.js";
 import { whoamiCommand } from "../lib/whoami.js";
-import { renderVersion, versionReport } from "../lib/version.js";
+import { renderVersion, VERSION_ACCOUNT_TIMEOUT_MS, versionReport, } from "../lib/version.js";
 import { diagQuery, diagRead, previewStart, previewStop, previewStopSignal, projectCreate, } from "../lib/lifecycle.js";
 import { publishCommand } from "../publish/command.js";
 import { stdinAsk, stdinConfirm } from "../publish/prompt.js";
@@ -53,7 +53,7 @@ import * as feedbackCopy from "../lib/feedbackCopy.js";
 import { record as recordInvocation } from "../dx/journal.js";
 import { dxDisableCommand, dxEnableCommand, dxSendCommand, parseDxOptions, runDx, sinceUsageLines, } from "../dx/command.js";
 import { httpConsentBackend, runConsentInBrowser } from "../dx/consent.js";
-import { DX_UNATTENDED_SUNSET, loadEnablement } from "../dx/enablement.js";
+import { DX_UNATTENDED_SUNSET, loadEnablement, resolveConsentView, } from "../dx/enablement.js";
 import { journalEnabled, journalPath, readJournal } from "../dx/journal.js";
 import { postReport } from "../dx/send.js";
 import { nudgeFor } from "../dx/nudge.js";
@@ -1139,14 +1139,22 @@ function cliVersion() {
     }
 }
 async function version() {
+    const now = Date.now();
     const report = await versionReport(projectDir(), {
         cliVersion: cliVersion(),
         allowCustomApi: has("--allow-custom-api"),
+        consent: {
+            auth: dxAuth,
+            readAccount: (auth) => httpConsentBackend().read(auth.apiUrl, auth.pat, now, VERSION_ACCOUNT_TIMEOUT_MS),
+            clearLocal: () => writeDxEnablement(undefined),
+        },
     });
     for (const line of renderVersion(report))
         console.log(line);
 }
 // ---- dx ---------------------------------------------------------------------
+/** The account bound on `vincentt dx` (f7 Scenario 3c); the send gate uses the default. */
+const DX_ACCOUNT_TIMEOUT_MS = 3_000;
 /**
  * The API host + PAT for a dx call, or undefined when signed out.
  *
@@ -1197,6 +1205,7 @@ async function dx() {
                     onProgress: (l) => console.log(l),
                 });
             },
+            grantAccountConsent: (auth) => consent.grant(auth.apiUrl, auth.pat, now),
             revokeAccountConsent: (auth) => consent.revoke(auth.apiUrl, auth.pat),
         };
         process.exitCode = options.enable
@@ -1214,7 +1223,15 @@ async function dx() {
     // relaxation, not throw through it.
     const enablement = await loadEnablement(now);
     if (!options.send) {
-        process.exitCode = runDx(argv, (l) => console.log(l), () => enablement);
+        // The report tail and `dxConsent` read the account first, bounded at 3 s.
+        const view = await resolveConsentView({
+            auth: await dxAuth(),
+            readAccount: (auth) => httpConsentBackend().read(auth.apiUrl, auth.pat, now, DX_ACCOUNT_TIMEOUT_MS),
+            local: () => enablement,
+            clearLocal: () => writeDxEnablement(undefined),
+            timeoutMs: DX_ACCOUNT_TIMEOUT_MS,
+        });
+        process.exitCode = runDx(argv, (l) => console.log(l), () => view.local, () => view);
         return;
     }
     // `--send` is the one path out of this machine, so it resolves auth the way
@@ -1231,10 +1248,9 @@ async function dx() {
         confirm: (q) => stdinConfirm()(`${q} [y/N] `, false),
         interactive,
         enablement: () => enablement,
-        // The third arm: the account-wide grant, read from /me. Consulted only when the
-        // first two have not already allowed the send, and allowed to throw — a /me that
-        // is unreachable falls back to the other two arms rather than blocking.
+        // The account decides when it answers; never read on an interactive session.
         accountConsent: (auth) => httpConsentBackend().read(auth.apiUrl, auth.pat, now),
+        clearEnablement: () => writeDxEnablement(undefined),
         // `--dir`-or-cwd, the same resolution every other verb uses, so `--dir`
         // works on a send as it does everywhere else.
         cwd: projectDir(),
@@ -1276,6 +1292,7 @@ async function report() {
         interactive,
         enablement: () => enablement,
         accountConsent: (auth) => httpConsentBackend().read(auth.apiUrl, auth.pat, now),
+        clearEnablement: () => writeDxEnablement(undefined),
         // `--dir`-or-cwd, the same resolution every other verb uses, so `--dir`
         // works on a report as it does everywhere else.
         cwd: projectDir(),

package/dist/dx/command.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentDecision } from "./consent.js";
-import type { Enablement } from "./enablement.js";
+import type { ConsentDecision, GrantResult } from "./consent.js";
+import type { AccountRead, ConsentView, Enablement } from "./enablement.js";
 import type { JournalEntry, JournalWindow } from "./journal.js";
 import type { WireReport } from "./send.js";
 import { type BuiltWith } from "../platform/resolve.js";
@@ -11,10 +11,15 @@ export interface DxDeps {
     enabled: () => boolean;
     path: () => string;
     /**
-     * Durable unattended-send state. Optional so the many callers that only read
-     * the journal need not resolve it; absent reads as not enabled.
+     * This machine's copy of the grant (the local flag). Optional so the many callers that
+     * only read the journal need not resolve it; absent reads as not enabled.
      */
     enablement?: () => Enablement;
+    /**
+     * The account-first answer the report tail and `dxConsent` show. Absent falls back to
+     * the local flag, reported as checked on this machine only.
+     */
+    consentView?: () => ConsentView;
 }
 /** How far back a report looks. */
 export interface DxWindow {
@@ -53,7 +58,7 @@ export declare function sinceUsageLines(raw: string): string[];
 export declare function parseDxOptions(args: string[]): DxOptions;
 export declare function dxCommand(deps: DxDeps, options: DxOptions): number;
 /** Wire the command to the real journal. */
-export declare function runDx(args: string[], print: (line: string) => void, enablement?: () => Enablement): number;
+export declare function runDx(args: string[], print: (line: string) => void, enablement?: () => Enablement, consentView?: () => ConsentView): number;
 export interface DxEnableDeps {
     print: (line: string) => void;
     now: () => number;
@@ -89,6 +94,14 @@ export interface DxEnableDeps {
      * no socket, no browser, and no clock to test.
      */
     consentInBrowser?: () => Promise<ConsentDecision>;
+    /**
+     * POST /me/dx-consent with the PAT, on the terminal path. Rejects only with the version
+     * refusal or the sign-in error; every other outcome is a GrantResult.
+     */
+    grantAccountConsent?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<GrantResult>;
     /**
      * DELETE /me/dx-consent. Used only by `disable`, and allowed to throw — the caller
      * treats a network failure as "local revoke still stands", never as a reason to leave
@@ -103,11 +116,13 @@ export interface DxEnableDeps {
  * `vincentt dx enable` — grant durable permission to send DX reports without asking
  * first.
  *
- * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
+ * TWO PATHS to ONE account grant, and which one runs is decided by whether there is a
+ * terminal to ask in:
  *
- *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
- *     can read the disclosure where they stand; sending them to a browser would be
- *     ceremony.
+ *   - At a TTY: the terminal prompt. A person is already here and can read the
+ *     disclosure where they stand; sending them to a browser would be ceremony. On `y`
+ *     the CLI POSTs /me/dx-consent with the PAT, and writes the local flag only after
+ *     the account recorded the grant.
  *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
  *     creator driving the CLI through a coding agent has no terminal, so the old code
  *     refused and the flow dead-ended. It now opens the console, where a human can
@@ -130,8 +145,8 @@ export declare function dxEnableCommand(deps: DxEnableDeps, sunset: number): Pro
  * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
  * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
  * clearing only the local flag would leave the account grant standing, so the very next
- * `--send` would be authorized by arm (c) and the command would appear not to have
- * worked.
+ * `--send` would be authorized by the account and the command would appear not to
+ * have worked.
  *
  * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
  * cannot fail and the one that stops THIS machine, which is the machine the creator is
@@ -168,18 +183,19 @@ export interface DxSendDeps extends DxDeps {
      * convenience, not authorization.
      */
     interactive: () => boolean;
-    /** Durable unattended-send state, read strictly. Absent reads as not enabled. */
+    /** This machine's flag, read strictly. Absent reads as not enabled. */
     enablement?: () => Enablement;
     /**
-     * The ACCOUNT's consent, read from GET /me. The third arm of the gate.
-     *
-     * Allowed to throw, and its throw is not fatal — see the gate below. Absent (the dep
-     * not wired at all) reads as not consented, never as "unknown, so allow".
+     * The ACCOUNT's consent, read from GET /me. Allowed to throw; a throw reads as
+     * unreadable. Absent reads as unreadable too: it can only let a valid local flag stand,
+     * never authorize on its own.
      */
     accountConsent?: (auth: {
         apiUrl: string;
         pat: string;
-    }) => Promise<Enablement>;
+    }) => Promise<AccountRead>;
+    /** Clears this machine's flag when the account answers "not granted". */
+    clearEnablement?: () => Promise<unknown>;
     /**
      * The version set. Injectable so a fixed set — or a REJECTING promise, the arm
      * proving a fault omits — can be driven with no filesystem. Defaults to the one
@@ -188,6 +204,46 @@ export interface DxSendDeps extends DxDeps {
     builtWith?: () => Promise<BuiltWith | undefined>;
     cwd?: string;
 }
+/** What the send gate needs. `dx --send` and `report` both satisfy it. */
+export interface SendGateDeps {
+    interactive: () => boolean;
+    enablement?: () => Enablement;
+    accountConsent?: (auth: {
+        apiUrl: string;
+        pat: string;
+    }) => Promise<AccountRead>;
+    clearEnablement?: () => Promise<unknown>;
+}
+export type SendGate = {
+    arm: "interactive";
+} | {
+    arm: "unattended";
+    enablement: Enablement;
+} | {
+    arm: "refused";
+};
+/**
+ * The one consent gate both send paths call (f7 Scenario 3), checked in order:
+ *
+ *   1. an interactive session → ask, then send. No /me read at all, so a creator at their
+ *      own terminal is never blocked by an API being slow or down.
+ *   2. signed in and GET /me answers: a strict grant sends (source: account); any other
+ *      200 clears this machine's flag and refuses.
+ *   3. /me cannot be read and this machine's flag is valid → send (source: machine).
+ *
+ * An unreadable /me never authorizes by itself; it only lets an existing local flag stand.
+ */
+export declare function gateSend(deps: SendGateDeps, auth: {
+    apiUrl: string;
+    pat: string;
+} | undefined): Promise<SendGate>;
+/**
+ * The gate's refusal. It NAMES the enabling command: a refusal is an answer to a
+ * command the caller typed, which makes it SOLICITED output — the prohibition is on
+ * UNBIDDEN output instructing a caller. A refusal naming nothing leaves a human at
+ * exit 1 with no path forward, for no security gain.
+ */
+export declare const SEND_REFUSAL_LINES: readonly string[];
 /**
  * `vincentt dx --send`.
  *
@@ -195,6 +251,6 @@ export interface DxSendDeps extends DxDeps {
  * who cannot see what leaves their machine before it leaves has not agreed to
  * anything:
  *
- *     friction → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
+ *     friction → auth → GATE → RESOLVE → build → SHOW → ask → post
  */
 export declare function dxSendCommand(deps: DxSendDeps, options: DxOptions): Promise<number>;

package/dist/dx/command.js

@@ -1,9 +1,10 @@
 import { findClusters, rankClusters } from "./clusters.js";
-import { enablementLine } from "./enablement.js";
+import { dxConsentJson, enablementLine, resolveConsentView } from "./enablement.js";
 import { journalEnabled, journalPath, readJournal } from "./journal.js";
 import { buildReport, renderPayload } from "./send.js";
 import { resolveBuiltWith } from "../platform/resolve.js";
 import { EXIT } from "../lib/exitCodes.js";
+import { isAuthRefused } from "../shared/authError.js";
 import { UpgradeRequiredError } from "../shared/upgradeError.js";
 const MINUTE_MS = 60 * 1000;
 const HOUR_MS = 60 * MINUTE_MS;
@@ -121,19 +122,27 @@ export function dxCommand(deps, options) {
         return 0;
     }
     const clusters = rankClusters(findClusters(entries));
-    const enablement = deps.enablement?.() ?? { enabled: false };
+    const local = deps.enablement?.() ?? { enabled: false };
+    const view = deps.consentView?.() ?? {
+        shown: local,
+        local,
+        checked: "machine",
+        signedIn: false,
+    };
     if (options.json) {
         // The JSON object carries enablement as FIELDS because --json is the path an
         // AGENT reads, and an agent that can send unattended should be able to see
-        // that it can.
+        // that it can. `dxSendEnabled*` stay this machine's flag; `dxConsent` is the
+        // account-first answer and says where it was checked.
         deps.print(JSON.stringify({
             window: options.window.label,
             runs: entries.length,
             clusters,
-            dxSendEnabled: enablement.enabled,
-            ...(enablement.enabled && enablement.at !== undefined
-                ? { dxSendEnabledAt: enablement.at }
+            dxSendEnabled: view.local.enabled,
+            ...(view.local.enabled && view.local.at !== undefined
+                ? { dxSendEnabledAt: view.local.at }
                 : {}),
+            dxConsent: dxConsentJson(view),
         }, null, 2));
         return 0;
     }
@@ -163,13 +172,13 @@ export function dxCommand(deps, options) {
     // Beside it, and ONLY when enabled. Enablement is durable and has no expiry, so
     // this line is the mitigation rather than a status decoration; printing an
     // `off` counterpart on every run is how it would get skimmed past.
-    const line = enablementLine(enablement, deps.now());
+    const line = enablementLine(view.shown, deps.now());
     if (line !== undefined)
         deps.print(line);
     return 0;
 }
 /** Wire the command to the real journal. */
-export function runDx(args, print, enablement = () => ({ enabled: false })) {
+export function runDx(args, print, enablement = () => ({ enabled: false }), consentView) {
     return dxCommand({
         entries: (window) => readJournal(window),
         print,
@@ -177,6 +186,7 @@ export function runDx(args, print, enablement = () => ({ enabled: false })) {
         enabled: () => journalEnabled(),
         path: journalPath,
         enablement,
+        consentView,
     }, parseDxOptions(args));
 }
 /** A date a human can read, for the sunset refusal. */
@@ -187,11 +197,13 @@ function sunsetDate(sunset) {
  * `vincentt dx enable` — grant durable permission to send DX reports without asking
  * first.
  *
- * TWO PATHS, and which one runs is decided by whether there is a terminal to ask in:
+ * TWO PATHS to ONE account grant, and which one runs is decided by whether there is a
+ * terminal to ask in:
  *
- *   - At a TTY: the original terminal prompt, unchanged. A person is already here and
- *     can read the disclosure where they stand; sending them to a browser would be
- *     ceremony.
+ *   - At a TTY: the terminal prompt. A person is already here and can read the
+ *     disclosure where they stand; sending them to a browser would be ceremony. On `y`
+ *     the CLI POSTs /me/dx-consent with the PAT, and writes the local flag only after
+ *     the account recorded the grant.
  *   - With no TTY: the BROWSER path. This is the case the feature exists for — a
  *     creator driving the CLI through a coding agent has no terminal, so the old code
  *     refused and the flow dead-ended. It now opens the console, where a human can
@@ -223,44 +235,87 @@ export async function dxEnableCommand(deps, sunset) {
     // signed out cannot complete either path, and reading a consent disclosure before
     // being told so is wasted attention.
     const auth = await deps.auth?.();
-    if (auth === undefined) {
-        deps.print("");
-        deps.print("  Allowing unattended reports is recorded on your Vincentt account, and");
-        deps.print("  this machine is not signed in. Nothing was changed.");
-        deps.print("");
-        deps.print("  Run `vincentt login` first.");
-        deps.print("");
-        return EXIT.NOT_AUTHENTICATED;
-    }
+    if (auth === undefined)
+        return signedOutRefusal(deps);
     if (!deps.interactive()) {
         return enableViaBrowser(deps);
     }
     // What is being granted, INCLUDING the note risk. The note is the part a
     // creator does not picture: enablement is what lets an agent compose prose they
     // have not read and put it on the wire.
+    // The wording names the ACCOUNT because the answer reaches every machine on it; a
+    // prompt that said "this machine" would ask for less than it grants.
     deps.print("");
     deps.print("  Unattended DX submission");
     deps.print("");
-    deps.print("  Your agent will be able to send friction reports from this machine without");
-    deps.print("  asking you first. A report includes a note, which is sent exactly as written.");
-    deps.print("  An agent may compose a note you have not read.");
+    deps.print("  Your agent will be able to send friction reports without asking you first,");
+    deps.print("  from any machine signed in to your Vincentt account. A report includes a note,");
+    deps.print("  which is sent exactly as written. An agent may compose a note you have not read.");
     deps.print("");
-    deps.print("  This stays on until you run `vincentt dx disable`.");
+    deps.print("  This stays on until you run `vincentt dx disable` or turn it off in the console.");
     deps.print("");
-    if (!(await deps.confirm("Enable on this machine?"))) {
+    if (!(await deps.confirm("Allow unattended reports on your account?"))) {
         deps.print("");
         deps.print("  Not enabled.");
         deps.print("");
         return 0;
     }
-    // Written on every enable, so the age reports from the LATEST grant rather than
-    // the first — a re-enable is a fresh decision and dates from when it was made.
-    await deps.save({ at: new Date(deps.now()).toISOString() });
+    return grantAtTerminal(deps, auth);
+}
+/**
+ * The terminal grant: the account first, then this machine's copy.
+ *
+ * ORDER IS THE PROPERTY. A local flag written before the account recorded the grant is a
+ * machine-only grant, which is exactly what this path no longer makes; so every failure
+ * arm returns before `save` and leaves config.json untouched. A 426 or 401 propagates,
+ * so the caller renders the shared version or sign-in refusal.
+ *
+ * The local date is the ACCOUNT's, so a re-grant re-dates both and the age always
+ * reports from the latest grant.
+ */
+async function grantAtTerminal(deps, auth) {
+    let result;
+    try {
+        result =
+            deps.grantAccountConsent === undefined
+                ? { kind: "unreachable" }
+                : await deps.grantAccountConsent(auth);
+    }
+    catch (err) {
+        if (err instanceof UpgradeRequiredError)
+            throw err;
+        if (isAuthRefused(err))
+            return signedOutRefusal(deps);
+        result = { kind: "unreachable" };
+    }
+    if (result.kind !== "granted" || result.enablement.at === undefined) {
+        deps.print("");
+        deps.print(`  ✗ ${GRANT_FAILURE[result.kind === "granted" ? "not_granted" : result.kind]}`);
+        deps.print("  Nothing was changed.");
+        deps.print("");
+        return 1;
+    }
+    await deps.save({ at: result.enablement.at });
     deps.print("");
-    deps.print("  Enabled. Reports may now be sent without a prompt.");
+    deps.print("  Enabled for your account. Reports may now be sent without a prompt from any");
+    deps.print("  machine signed in to it.");
     deps.print("");
     return 0;
 }
+const GRANT_FAILURE = {
+    not_granted: "Vincentt did not record your consent.",
+    rate_limited: "Too many consent changes. Wait a minute and try again.",
+    unreachable: "Could not reach Vincentt to record your consent.",
+};
+function signedOutRefusal(deps) {
+    deps.print("");
+    deps.print("  Allowing unattended reports is recorded on your Vincentt account, and");
+    deps.print("  this machine is not signed in. Nothing was changed.");
+    deps.print("");
+    deps.print("  Run `vincentt login` first.");
+    deps.print("");
+    return EXIT.NOT_AUTHENTICATED;
+}
 /**
  * The no-TTY arm: hand the decision to a human in a browser.
  *
@@ -325,8 +380,8 @@ async function enableViaBrowser(deps) {
  * Clears BOTH local keys AND revokes the account grant when there is a PAT to do it
  * with. Both halves are needed: a creator who runs `disable` means "stop sending", and
  * clearing only the local flag would leave the account grant standing, so the very next
- * `--send` would be authorized by arm (c) and the command would appear not to have
- * worked.
+ * `--send` would be authorized by the account and the command would appear not to
+ * have worked.
  *
  * ORDER IS DELIBERATE: local first, network second. The local clear is the one that
  * cannot fail and the one that stops THIS machine, which is the machine the creator is
@@ -371,6 +426,41 @@ export async function dxDisableCommand(deps) {
     deps.print("");
     return 0;
 }
+/**
+ * The one consent gate both send paths call (f7 Scenario 3), checked in order:
+ *
+ *   1. an interactive session → ask, then send. No /me read at all, so a creator at their
+ *      own terminal is never blocked by an API being slow or down.
+ *   2. signed in and GET /me answers: a strict grant sends (source: account); any other
+ *      200 clears this machine's flag and refuses.
+ *   3. /me cannot be read and this machine's flag is valid → send (source: machine).
+ *
+ * An unreadable /me never authorizes by itself; it only lets an existing local flag stand.
+ */
+export async function gateSend(deps, auth) {
+    if (deps.interactive())
+        return { arm: "interactive" };
+    const view = await resolveConsentView({
+        auth,
+        readAccount: deps.accountConsent,
+        local: () => deps.enablement?.() ?? { enabled: false },
+        clearLocal: () => deps.clearEnablement?.() ?? Promise.resolve(),
+    });
+    return view.shown.enabled
+        ? { arm: "unattended", enablement: view.shown }
+        : { arm: "refused" };
+}
+/**
+ * The gate's refusal. It NAMES the enabling command: a refusal is an answer to a
+ * command the caller typed, which makes it SOLICITED output — the prohibition is on
+ * UNBIDDEN output instructing a caller. A refusal naming nothing leaves a human at
+ * exit 1 with no path forward, for no security gain.
+ */
+export const SEND_REFUSAL_LINES = [
+    "Sending a report needs consent that has not been given on this account.",
+    "`vincentt dx enable` opens the Vincentt console so you can allow it.",
+    "It takes one click, and it works from here.",
+];
 /**
  * `vincentt dx --send`.
  *
@@ -378,7 +468,7 @@ export async function dxDisableCommand(deps) {
  * who cannot see what leaves their machine before it leaves has not agreed to
  * anything:
  *
- *     friction → GATE (three arms) → auth → RESOLVE → build → SHOW → ask → post
+ *     friction → auth → GATE → RESOLVE → build → SHOW → ask → post
  */
 export async function dxSendCommand(deps, options) {
     if (!deps.enabled()) {
@@ -411,59 +501,20 @@ export async function dxSendCommand(deps, options) {
     // the check sits on the act being authorized rather than on a flag that only
     // modifies how it is confirmed.
     //
-    // The second arm is the SUPPORTED unattended path: a person, at a terminal,
-    // ran `vincentt dx enable` on this machine. That is a prior deliberate act
-    // rather than a per-send answer, which is what makes it consent at all.
+    // The unattended path is a prior deliberate act — a person granted it on the
+    // account, at a terminal or in the console — rather than a per-send answer, which
+    // is what makes it consent at all. See gateSend for the order.
     //
-    // The THIRD arm is the same kind of prior deliberate act, made in the console and
-    // recorded on the ACCOUNT rather than on this machine. It exists because the second
-    // arm cannot be reached at all by the creator this feature is for: driving the CLI
-    // through a coding agent, there is no terminal to run `dx enable` in.
-    const localEnablement = deps.enablement?.() ?? { enabled: false };
-    const interactive = deps.interactive();
-    // Auth is resolved BEFORE the gate now, because arm (c) needs a credential to read
-    // /me. The signed-out refusal still comes AFTER the gate, so a caller with neither a
+    // Auth is resolved BEFORE the gate, because the account read needs a credential.
+    // The signed-out refusal still comes AFTER the gate, so a caller with neither a
     // terminal nor consent gets the refusal about consent — the thing they need to fix —
     // rather than being sent to `login` first and only then told that logging in was not
     // sufficient.
     const auth = await deps.auth();
-    // Arm (c) is consulted ONLY when the first two have not already allowed the send.
-    // Skipping it otherwise is not just an optimization: it keeps `--send` from making a
-    // network call it does not need, so a creator at their own terminal is never blocked
-    // by an API being slow or down.
-    let accountEnablement = { enabled: false };
-    if (!interactive && !localEnablement.enabled && auth !== undefined) {
-        try {
-            accountEnablement = (await deps.accountConsent?.(auth)) ?? { enabled: false };
-        }
-        catch {
-            // A NETWORK FAILURE FALLS BACK TO THE OTHER TWO ARMS, and since we only get here
-            // when both have already said no, that means refusing. This is the fail-CLOSED
-            // direction: an unreachable API can never authorize a send.
-            //
-            // The swallow is deliberate and is the whole point of the arm's placement — a
-            // /me that is down must never BLOCK a send that (a) or (b) already allows, and it
-            // cannot, because those paths never reach this call at all.
-            accountEnablement = { enabled: false };
-        }
-    }
-    // The grant that authorizes this send, and the one whose age gets reported. The local
-    // flag wins when both exist: it is the more specific statement (this machine) and it
-    // is the one `dx disable` can always clear.
-    const enablement = localEnablement.enabled
-        ? localEnablement
-        : accountEnablement;
-    if (!interactive && !enablement.enabled) {
-        // This refusal NAMES the enabling command. A refusal is an answer to a
-        // command the caller typed, which makes it SOLICITED output — the
-        // prohibition is on UNBIDDEN output instructing a caller (the nudge names
-        // neither `enable` nor `--send`, and still must not). A refusal naming
-        // nothing satisfies the letter of that rule and leaves a human at exit 1
-        // with no path forward, for no security gain: guessability was never the
-        // threat.
-        deps.print("Sending a report needs consent that has not been given on this account.");
-        deps.print("`vincentt dx enable` opens the Vincentt console so you can allow it.");
-        deps.print("It takes one click, and it works from here.");
+    const gate = await gateSend(deps, auth);
+    if (gate.arm === "refused") {
+        for (const l of SEND_REFUSAL_LINES)
+            deps.print(l);
         return 1;
     }
     if (auth === undefined) {
@@ -492,9 +543,9 @@ export async function dxSendCommand(deps, options) {
     const report = buildReport(clusters, deps.cliVersion(), options.note, builtWith);
     // Above the payload, on the unattended path only: name that this is enabled,
     // how old the grant is, WHERE it was granted, and that nothing is going to ask.
-    const unattended = !interactive && enablement.enabled;
-    if (unattended) {
-        const line = enablementLine(enablement, deps.now());
+    const unattended = gate.arm === "unattended";
+    if (gate.arm === "unattended") {
+        const line = enablementLine(gate.enablement, deps.now());
         if (line !== undefined) {
             deps.print("");
             deps.print(`${line}. Not asking.`);
@@ -512,8 +563,8 @@ export async function dxSendCommand(deps, options) {
     for (const l of renderPayload(report))
         deps.print(l);
     deps.print("");
-    // The enabled machine does not ask. --yes still means only "skip the question"
-    // and is inert without one of the two arms above.
+    // The unattended path does not ask. --yes still means only "skip the question"
+    // and is inert without a grant.
     if (!unattended && !options.yes && !(await deps.confirm("Send this report?"))) {
         deps.print("Not sent.");
         return 0;