agent-yes 1.271.0 → 1.272.0

package/dist/{SUPPORTED_CLIS-lreAQcHS.js → SUPPORTED_CLIS-C1rgBiLd.js}

@@ -1,12 +1,12 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-DCtcFwZ7.js";
-import "./ts-BG759sO1.js";
+import "./versionChecker-D9LB-MW5.js";
+import "./ts-Bb-h7XQP.js";
 import "./todoAutomation-BETGOik9.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-Dq4KY2IV.js";
 import "./pidStore-DJqSZPJi.js";
 import "./messageLog-BYFwioFY.js";
 import "./todoStore-Wk8U4zJ8.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-3wwg1X8T.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DFOStQkx.js";
 
 export { SUPPORTED_CLIS };

package/dist/{SUPPORTED_CLIS-3wwg1X8T.js → SUPPORTED_CLIS-DFOStQkx.js}

@@ -1,8 +1,8 @@
-import { t as CLIS_CONFIG } from "./ts-BG759sO1.js";
+import { t as CLIS_CONFIG } from "./ts-Bb-h7XQP.js";
 
 //#region ts/SUPPORTED_CLIS.ts
 const SUPPORTED_CLIS = Object.keys(CLIS_CONFIG);
 
 //#endregion
 export { SUPPORTED_CLIS as t };
-//# sourceMappingURL=SUPPORTED_CLIS-3wwg1X8T.js.map
+//# sourceMappingURL=SUPPORTED_CLIS-DFOStQkx.js.map

package/dist/{agentShare-DnewJUOO.js → agentShare-CLhjMsHZ.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-Dq4KY2IV.js";
 import "./messageLog-BYFwioFY.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import { B as resolveOne } from "./subcommands-C3NO344d.js";
+import { B as resolveOne } from "./subcommands-DKqbwkvb.js";
 import "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";
@@ -230,4 +230,4 @@ function transformEvent(rawEvent, agentId, forwarded) {
 
 //#endregion
 export { createScopedShare, listShares, revokeAllShares, revokeShare };
-//# sourceMappingURL=agentShare-DnewJUOO.js.map
+//# sourceMappingURL=agentShare-CLhjMsHZ.js.map

package/dist/{callback-D521tLFf.js → callback-BVKHRbUE.js}

@@ -1,5 +1,5 @@
 import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
-import { B as resolveOne } from "./subcommands-C3NO344d.js";
+import { B as resolveOne } from "./subcommands-DKqbwkvb.js";
 import { a as mintCapability, o as parseExpires } from "./callbackCore-Bbe7rpN2.js";
 import { randomBytes } from "node:crypto";
 import { chmodSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -72,7 +72,7 @@ async function resolveBase(flag) {
 	if (flag) return flag;
 	if (process.env.AGENT_YES_CALLBACK_BASE) return process.env.AGENT_YES_CALLBACK_BASE;
 	try {
-		const { resolveLocalServeUrl } = await import("./serve-XWSfUL8i.js");
+		const { resolveLocalServeUrl } = await import("./serve-Dw0x9Of9.js");
 		const url = await resolveLocalServeUrl();
 		if (url) return url;
 	} catch {}
@@ -187,4 +187,4 @@ async function cmdCallback(rest) {
 
 //#endregion
 export { loadOrCreateCallbackSecret as i, isCallbackRevoked as n, loadCallbackSecretReadOnly as r, cmdCallback as t };
-//# sourceMappingURL=callback-D521tLFf.js.map
+//# sourceMappingURL=callback-BVKHRbUE.js.map

package/dist/{callback-Besk3KFx.js → callback-C64-nP2U.js}

@@ -3,11 +3,11 @@ import "./globalPidIndex-Dq4KY2IV.js";
 import "./messageLog-BYFwioFY.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import "./subcommands-C3NO344d.js";
+import "./subcommands-DKqbwkvb.js";
 import "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";
 import "./callbackCore-Bbe7rpN2.js";
-import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-D521tLFf.js";
+import { i as loadOrCreateCallbackSecret, n as isCallbackRevoked, r as loadCallbackSecretReadOnly, t as cmdCallback } from "./callback-BVKHRbUE.js";
 
 export { cmdCallback };

package/dist/cli.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env bun
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
 import { n as logger } from "./logger-CDIsZ-Pp.js";
-import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-DCtcFwZ7.js";
-import { r as getRustBinary } from "./rustBinary-BK03gMMg.js";
+import { i as versionString, n as displayVersion, t as checkAndAutoUpdate } from "./versionChecker-D9LB-MW5.js";
+import { r as getRustBinary } from "./rustBinary-ISnNc7Uf.js";
 import { argv } from "process";
 import { spawn } from "child_process";
 import ms from "ms";
@@ -295,7 +295,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 	const rawArg = process.argv[2];
 	const managerCommands = !invokedCliName(process.argv);
 	const isHelpFlag = rawArg === "-h" || rawArg === "--help";
-	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken, isBareManagerInvocation } = await import("./subcommands-ByZspogJ.js");
+	const { isSubcommand, runSubcommand, cmdHelp, isUnknownManagerToken, isBareManagerInvocation } = await import("./subcommands-TAOmVCxo.js");
 	if (isHelpFlag && process.argv.length === 3) {
 		await cmdHelp(managerCommands);
 		process.exit(0);
@@ -309,7 +309,7 @@ function buildRustArgs(argv, cliFromScript, supportedClis) {
 		process.exit(code ?? 0);
 	}
 	{
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-lreAQcHS.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-C1rgBiLd.js");
 		if (isUnknownManagerToken(rawArg, managerCommands, SUPPORTED_CLIS)) {
 			process.stderr.write(`ay: unknown subcommand or CLI '${rawArg}'.\n    See 'ay help' for subcommands. To run an agent, name a CLI:\n    'ay <cli> …' (e.g. 'ay claude …') or 'ay --cli <cli> …'.\n`);
 			process.exit(1);
@@ -360,7 +360,7 @@ if (config.useRust) {
 		}
 	}
 	if (rustBinary) {
-		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-lreAQcHS.js");
+		const { SUPPORTED_CLIS } = await import("./SUPPORTED_CLIS-C1rgBiLd.js");
 		const rustArgs = buildRustArgs(process.argv, config.cli, SUPPORTED_CLIS);
 		if (config.verbose) {
 			console.log(`[rust] Using binary: ${rustBinary}`);

package/dist/{cmdPs-4An2s2t8.js → cmdPs-Cu__YsO7.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-Dq4KY2IV.js";
 import "./messageLog-BYFwioFY.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import { O as listRecords, d as deriveLiveState, et as buildAgentForest, tt as flattenForest } from "./subcommands-C3NO344d.js";
+import { O as listRecords, d as deriveLiveState, et as buildAgentForest, tt as flattenForest } from "./subcommands-DKqbwkvb.js";
 import "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";
@@ -574,4 +574,4 @@ function readPpidSync(pid) {
 
 //#endregion
 export { cmdPs };
-//# sourceMappingURL=cmdPs-4An2s2t8.js.map
+//# sourceMappingURL=cmdPs-Cu__YsO7.js.map

package/dist/index.js

@@ -1,6 +1,6 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-DCtcFwZ7.js";
-import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-BG759sO1.js";
+import "./versionChecker-D9LB-MW5.js";
+import { a as hasTodoStore, i as answerAsk, l as AgentContext, n as agentYes, o as listAsks, r as config, s as listAsksForProject, t as CLIS_CONFIG } from "./ts-Bb-h7XQP.js";
 import { a as renderTree, c as describeBlock, i as renderDigest, l as monitorHint, o as unblockedTasks, r as openBlockers, t as reconcileTodos, u as removeControlCharacters } from "./todoAutomation-BETGOik9.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-Dq4KY2IV.js";

package/dist/{notifyDaemon-kIOLWrEI.js → notifyDaemon-BmtjtW5L.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-Dq4KY2IV.js";
 import "./messageLog-BYFwioFY.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import { L as renderLogTailLines, O as listRecords, d as deriveLiveState, x as isPidAlive } from "./subcommands-C3NO344d.js";
+import { L as renderLogTailLines, O as listRecords, d as deriveLiveState, x as isPidAlive } from "./subcommands-DKqbwkvb.js";
 import { f as readInbox, g as daemonLockOwnerPath, h as daemonLockDir, i as gcInboxes, l as listInboxParents, m as shouldStealLock, n as appendEvent, s as hostId, u as liveWatchers, x as notifyDir } from "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";
@@ -863,4 +863,4 @@ async function ensureDaemon() {
 
 //#endregion
 export { daemonStatus, ensureDaemon, requestDaemonStop, runDaemon };
-//# sourceMappingURL=notifyDaemon-kIOLWrEI.js.map
+//# sourceMappingURL=notifyDaemon-BmtjtW5L.js.map

package/dist/{parentPingLoop-D2A9Fkhf.js → parentPingLoop-BtggDU06.js}

@@ -338,7 +338,7 @@ async function isParentWatching(parentWrapperPid, parentAgentPid, selfAgentPid,
 		logger.debug("[parent-ping] watcher lookup failed:", error);
 	}
 	try {
-		const { lastReadAt, READ_WINDOW_MS } = await import("./subcommands-ByZspogJ.js");
+		const { lastReadAt, READ_WINDOW_MS } = await import("./subcommands-TAOmVCxo.js");
 		const last = await lastReadAt(`agent:${parentAgentPid}`, selfAgentPid);
 		if (last !== null && now - last <= READ_WINDOW_MS) return true;
 	} catch (error) {
@@ -466,4 +466,4 @@ function startParentPingLoop(opts) {
 
 //#endregion
 export { startParentPingLoop };
-//# sourceMappingURL=parentPingLoop-D2A9Fkhf.js.map
+//# sourceMappingURL=parentPingLoop-BtggDU06.js.map

package/dist/{rustBinary-BK03gMMg.js → rustBinary-ISnNc7Uf.js}

@@ -1,4 +1,4 @@
-import { r as getInstalledPackage } from "./versionChecker-DCtcFwZ7.js";
+import { r as getInstalledPackage } from "./versionChecker-D9LB-MW5.js";
 import { execFileSync } from "child_process";
 import { existsSync, mkdirSync, unlinkSync } from "fs";
 import { chmod, copyFile } from "fs/promises";
@@ -243,4 +243,4 @@ async function getRustBinary(options = {}) {
 
 //#endregion
 export { findTrayLauncher as n, getRustBinary as r, findSpawnHiddenLauncher as t };
-//# sourceMappingURL=rustBinary-BK03gMMg.js.map
+//# sourceMappingURL=rustBinary-ISnNc7Uf.js.map

package/dist/{schedule-BdK4RVQ5.js → schedule-D37Q9LGO.js}

@@ -1,13 +1,13 @@
 import "./logger-CDIsZ-Pp.js";
-import "./versionChecker-DCtcFwZ7.js";
-import "./ts-BG759sO1.js";
+import "./versionChecker-D9LB-MW5.js";
+import "./ts-Bb-h7XQP.js";
 import "./todoAutomation-BETGOik9.js";
 import "./JsonlStore-CPGIR0Wy.js";
 import "./globalPidIndex-Dq4KY2IV.js";
 import "./pidStore-DJqSZPJi.js";
 import "./messageLog-BYFwioFY.js";
 import "./todoStore-Wk8U4zJ8.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-3wwg1X8T.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DFOStQkx.js";
 import { f as resolveSpawnCwd } from "./workspaceConfig-EK7XNsgR.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-CKc1BN5J.js";
 import { createHash } from "node:crypto";
@@ -154,4 +154,4 @@ async function cmdSchedule(rest) {
 
 //#endregion
 export { cmdSchedule };
-//# sourceMappingURL=schedule-BdK4RVQ5.js.map
+//# sourceMappingURL=schedule-D37Q9LGO.js.map

package/dist/{serve-XWSfUL8i.js → serve-Dw0x9Of9.js}

@@ -1,7 +1,7 @@
 import "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-DCtcFwZ7.js";
-import { t as findSpawnHiddenLauncher } from "./rustBinary-BK03gMMg.js";
-import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-BG759sO1.js";
+import { r as getInstalledPackage } from "./versionChecker-D9LB-MW5.js";
+import { t as findSpawnHiddenLauncher } from "./rustBinary-ISnNc7Uf.js";
+import { c as permissionBadge, i as answerAsk, o as listAsks, u as CLAUDE_SESSION_PIN_ENV } from "./ts-Bb-h7XQP.js";
 import { t as agentYesHome$1 } from "./agentYesHome-CtmsY6I-.js";
 import { u as removeControlCharacters } from "./todoAutomation-BETGOik9.js";
 import "./JsonlStore-CPGIR0Wy.js";
@@ -12,18 +12,18 @@ import { t as pgidForWrapper } from "./reaper-C4BvNylH.js";
 import "./todoStore-Wk8U4zJ8.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-3wwg1X8T.js";
-import { $ as TYPING_BADGE, B as resolveOne, F as recentMessageEdges, G as snapshotStatus, I as recentReadEdges, L as renderLogTailLines, M as readLogForRender, N as readNotes, O as listRecords, P as readPtysize, Q as withIpcLock, R as renderRawLog, T as isUserTyping, Z as writeToIpc, f as deriveLiveStatus, g as extractTaskCounts, h as extractNeedsInput, l as controlCodeFromName, p as extractBadges, z as renderRawLogLines } from "./subcommands-C3NO344d.js";
+import { t as SUPPORTED_CLIS } from "./SUPPORTED_CLIS-DFOStQkx.js";
+import { $ as TYPING_BADGE, B as resolveOne, F as recentMessageEdges, G as snapshotStatus, I as recentReadEdges, L as renderLogTailLines, M as readLogForRender, N as readNotes, O as listRecords, P as readPtysize, Q as withIpcLock, R as renderRawLog, T as isUserTyping, Z as writeToIpc, f as deriveLiveStatus, g as extractTaskCounts, h as extractNeedsInput, l as controlCodeFromName, p as extractBadges, z as renderRawLogLines } from "./subcommands-DKqbwkvb.js";
 import { c as isTransientLockMkdirError } from "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";
 import { i as frameVisitorMessage, s as verifyCapability, t as MAX_CALLBACK_MSG_BYTES } from "./callbackCore-Bbe7rpN2.js";
-import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-D521tLFf.js";
+import { n as isCallbackRevoked, r as loadCallbackSecretReadOnly } from "./callback-BVKHRbUE.js";
 import { a as getProvisionRoot, d as isProvisionAllowed, f as resolveSpawnCwd, i as getProvisionHook, l as hasProvisionHook, o as getSpawnHook, t as allowsSkipPermissions, u as hasSpawnHook } from "./workspaceConfig-EK7XNsgR.js";
 import { n as liveEnv, t as ensureNodeRuntime } from "./nodeRuntime-CKc1BN5J.js";
-import { i as importProvisionModule } from "./ws-DO1UpPDw.js";
+import { i as importProvisionModule } from "./ws-BFli3FKi.js";
 import { r as spawnRejectionReason } from "./spawnGate-CS3oFdJ9.js";
-import { i as launchTray } from "./trayApp-CcQDIINw.js";
+import { i as launchTray } from "./trayApp-BsETHuMR.js";
 import yargs from "yargs";
 import { appendFile, mkdir, open, readFile, readdir, rename, rm, stat, unlink, writeFile } from "fs/promises";
 import { arch, cpus, freemem, homedir, hostname, loadavg, platform, totalmem, uptime, userInfo } from "os";
@@ -2436,7 +2436,7 @@ Options:
 			}
 		});
 		if (req.method === "GET" && p === "/api/ws") {
-			const ws = await import("./ws-Bk2cJphr.js");
+			const ws = await import("./ws-CklRMQwW.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2456,7 +2456,7 @@ Options:
 		if (req.method === "GET" && p === "/api/ws/status") {
 			const dirRaw = url.searchParams.get("path");
 			if (!dirRaw) return new Response("missing ?path=<workspace dir>", { status: 400 });
-			const ws = await import("./ws-Bk2cJphr.js");
+			const ws = await import("./ws-CklRMQwW.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -2478,7 +2478,7 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/ws/repos") {
-			const ws = await import("./ws-Bk2cJphr.js");
+			const ws = await import("./ws-CklRMQwW.js");
 			try {
 				await ws.loadProvision();
 			} catch (e) {
@@ -2559,7 +2559,7 @@ Options:
 			const m = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/.exec(repoParam);
 			if (!m || m[1] === "." || m[1] === ".." || m[2] === "." || m[2] === "..") return new Response("missing/invalid ?repo=<owner>/<repo>", { status: 400 });
 			const [, owner, repo] = m;
-			const ws = await import("./ws-Bk2cJphr.js");
+			const ws = await import("./ws-CklRMQwW.js");
 			let prov;
 			try {
 				prov = await ws.loadProvision();
@@ -3470,7 +3470,7 @@ Options:
 			const perm = body.perm ?? "r";
 			if (perm !== "r" && perm !== "rw") return new Response(`invalid perm ${perm} (want r or rw)`, { status: 400 });
 			try {
-				const { createScopedShare } = await import("./agentShare-DnewJUOO.js");
+				const { createScopedShare } = await import("./agentShare-CLhjMsHZ.js");
 				const share = await createScopedShare({
 					agent: body.agent,
 					perm,
@@ -3485,12 +3485,12 @@ Options:
 			}
 		}
 		if (req.method === "GET" && p === "/api/shares") {
-			const { listShares } = await import("./agentShare-DnewJUOO.js");
+			const { listShares } = await import("./agentShare-CLhjMsHZ.js");
 			return Response.json(listShares());
 		}
 		const revokeM = /^\/api\/share\/([^/]+)$/.exec(p);
 		if (req.method === "DELETE" && revokeM) {
-			const { revokeShare } = await import("./agentShare-DnewJUOO.js");
+			const { revokeShare } = await import("./agentShare-CLhjMsHZ.js");
 			const ok = revokeShare(decodeURIComponent(revokeM[1]));
 			return new Response(ok ? "revoked" : "no such share", { status: ok ? 200 : 404 });
 		}
@@ -3795,7 +3795,7 @@ Options:
 	const shutdown = (resolve) => {
 		if (heartbeat) clearInterval(heartbeat);
 		closeShare?.();
-		import("./agentShare-DnewJUOO.js").then((m) => m.revokeAllShares()).catch(() => {});
+		import("./agentShare-CLhjMsHZ.js").then((m) => m.revokeAllShares()).catch(() => {});
 		server?.stop();
 		Promise.resolve(releaseHostLock?.()).catch(() => {}).then(resolve);
 	};
@@ -3808,4 +3808,4 @@ Options:
 
 //#endregion
 export { cmdServe, loadTokenReadOnly, mintScopedTermToken, resolveDaemonHttpBase, resolveLocalServeUrl };
-//# sourceMappingURL=serve-XWSfUL8i.js.map
+//# sourceMappingURL=serve-Dw0x9Of9.js.map

package/dist/{setup-B-Cui8R6.js → setup-BmBjOyza.js}

@@ -40,7 +40,7 @@ async function cmdSetup(rest) {
 	} catch {}
 	if (noShare) return 0;
 	process.stdout.write(`\nsharing this machine to agent-yes.com…\n`);
-	const { cmdServe } = await import("./serve-XWSfUL8i.js");
+	const { cmdServe } = await import("./serve-Dw0x9Of9.js");
 	return cmdServe([
 		"install",
 		"--share",
@@ -50,4 +50,4 @@ async function cmdSetup(rest) {
 
 //#endregion
 export { cmdSetup };
-//# sourceMappingURL=setup-B-Cui8R6.js.map
+//# sourceMappingURL=setup-BmBjOyza.js.map

package/dist/{subcommands-C3NO344d.js → subcommands-DKqbwkvb.js}

@@ -907,7 +907,7 @@ async function runSubcommand(argv) {
 		switch (sub) {
 			case "ls":
 			case "list": return await cmdLs(rest);
-			case "ps": return await (await import("./cmdPs-4An2s2t8.js")).cmdPs(rest);
+			case "ps": return await (await import("./cmdPs-Cu__YsO7.js")).cmdPs(rest);
 			case "status": return await cmdStatus(rest);
 			case "whoami": return await cmdWhoami(rest);
 			case "result": return await cmdResult(rest);
@@ -954,35 +954,35 @@ async function runSubcommand(argv) {
 				return cmdCh(rest);
 			}
 			case "term": {
-				const { cmdTerm } = await import("./terminal-BxWNOBW4.js");
+				const { cmdTerm } = await import("./terminal-BQ79zaFa.js");
 				return cmdTerm(rest);
 			}
 			case "widget": {
-				const { cmdWidget } = await import("./widget-DobxsxXa.js");
+				const { cmdWidget } = await import("./widget-gRjJprB5.js");
 				return cmdWidget(rest);
 			}
 			case "mint": {
-				const { cmdMint } = await import("./widget-DobxsxXa.js");
+				const { cmdMint } = await import("./widget-gRjJprB5.js");
 				return cmdMint(rest);
 			}
 			case "serve": {
-				const { cmdServe } = await import("./serve-XWSfUL8i.js");
+				const { cmdServe } = await import("./serve-Dw0x9Of9.js");
 				return cmdServe(rest);
 			}
 			case "tray": {
-				const { cmdTray } = await import("./trayApp-XJit7gRr.js");
+				const { cmdTray } = await import("./trayApp-BHx2FN2d.js");
 				return cmdTray(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-B-Cui8R6.js");
+				const { cmdSetup } = await import("./setup-BmBjOyza.js");
 				return cmdSetup(rest);
 			}
 			case "ws": {
-				const { cmdWs } = await import("./ws-Bk2cJphr.js");
+				const { cmdWs } = await import("./ws-CklRMQwW.js");
 				return cmdWs(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-BdK4RVQ5.js");
+				const { cmdSchedule } = await import("./schedule-D37Q9LGO.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
@@ -994,7 +994,7 @@ async function runSubcommand(argv) {
 				return cmdExpose(rest);
 			}
 			case "callback": {
-				const { cmdCallback } = await import("./callback-Besk3KFx.js");
+				const { cmdCallback } = await import("./callback-C64-nP2U.js");
 				return cmdCallback(rest);
 			}
 			case "reap":
@@ -3500,7 +3500,7 @@ async function cmdAttach(rest) {
 	const winsizeDir = path.join(ayHome, "winsize");
 	await mkdir(winsizeDir, { recursive: true });
 	const winsizePath = path.join(winsizeDir, String(record.pid));
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-XWSfUL8i.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-Dw0x9Of9.js");
 	const daemonBase = await resolveDaemonHttpBase().catch(() => null);
 	const daemonToken = daemonBase ? await loadTokenReadOnly().catch(() => null) ?? "" : "";
 	const capViewer = `attach:${process.pid}`;
@@ -4210,7 +4210,7 @@ async function cmdNotify(rest) {
 	}
 	const ensure = async () => {
 		if (!argv["ensure-daemon"]) return;
-		const { ensureDaemon } = await import("./notifyDaemon-kIOLWrEI.js");
+		const { ensureDaemon } = await import("./notifyDaemon-BmtjtW5L.js");
 		await ensureDaemon().catch(() => null);
 	};
 	await heartbeatWatcher(parent, selfStartedAt);
@@ -4284,7 +4284,7 @@ async function cmdNotifyCursor(args) {
 }
 async function cmdNotifyd(rest) {
 	const sub = rest[0] ?? "status";
-	const daemon = await import("./notifyDaemon-kIOLWrEI.js");
+	const daemon = await import("./notifyDaemon-BmtjtW5L.js");
 	switch (sub) {
 		case "run": return daemon.runDaemon();
 		case "once": return daemon.runDaemon({ once: true });
@@ -4311,4 +4311,4 @@ async function cmdNotifyd(rest) {
 
 //#endregion
 export { TYPING_BADGE as $, menuSelectKeys as A, resolveOne as B, isSubcommand as C, lastStdinAt as D, lastReadAt as E, recentMessageEdges as F, snapshotStatus as G, resolveResumeArgs as H, recentReadEdges as I, submitAndConfirm as J, stdinActivityPath as K, renderLogTailLines as L, readLogForRender as M, readNotes as N, listRecords as O, readPtysize as P, withIpcLock as Q, renderRawLog as R, isSlashCommand as S, isUserTyping as T, restartHintLines as U, resolveReadWindow as V, runSubcommand as W, writeKeysPaced as X, waitForLogQuiet as Y, writeToIpc as Z, finalizedLines as _, TYPING_WINDOW_MS as a, isExitRequest as b, cmdHelp as c, deriveLiveState as d, buildAgentForest as et, deriveLiveStatus as f, extractTaskCounts as g, extractNeedsInput as h, READ_WINDOW_MS as i, readAgentPtysize as j, matchKeyword as k, controlCodeFromName as l, extractMenu as m, MAX_RENDER_BYTES as n, backoffWhileTyping as o, extractBadges as p, stopTipForCli as q, READ_PAGE_DEFAULT as r, cmdDeepseek as s, GRACEFUL_EXIT_COMMANDS as t, flattenForest as tt, cursorAbs as u, isAgentStuck as v, isUnknownManagerToken as w, isPidAlive as x, isBareManagerInvocation as y, renderRawLogLines as z };
-//# sourceMappingURL=subcommands-C3NO344d.js.map
+//# sourceMappingURL=subcommands-DKqbwkvb.js.map

package/dist/{subcommands-ByZspogJ.js → subcommands-TAOmVCxo.js}

@@ -3,7 +3,7 @@ import "./globalPidIndex-Dq4KY2IV.js";
 import "./messageLog-BYFwioFY.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import { A as menuSelectKeys, B as resolveOne, C as isSubcommand, D as lastStdinAt, E as lastReadAt, F as recentMessageEdges, G as snapshotStatus, H as resolveResumeArgs, I as recentReadEdges, J as submitAndConfirm, K as stdinActivityPath, L as renderLogTailLines, M as readLogForRender, N as readNotes, O as listRecords, P as readPtysize, R as renderRawLog, S as isSlashCommand, T as isUserTyping, U as restartHintLines, V as resolveReadWindow, W as runSubcommand, X as writeKeysPaced, Y as waitForLogQuiet, Z as writeToIpc, _ as finalizedLines, a as TYPING_WINDOW_MS, b as isExitRequest, c as cmdHelp, d as deriveLiveState, f as deriveLiveStatus, g as extractTaskCounts, h as extractNeedsInput, i as READ_WINDOW_MS, j as readAgentPtysize, k as matchKeyword, l as controlCodeFromName, m as extractMenu, n as MAX_RENDER_BYTES, o as backoffWhileTyping, p as extractBadges, q as stopTipForCli, r as READ_PAGE_DEFAULT, s as cmdDeepseek, t as GRACEFUL_EXIT_COMMANDS, u as cursorAbs, v as isAgentStuck, w as isUnknownManagerToken, x as isPidAlive, y as isBareManagerInvocation, z as renderRawLogLines } from "./subcommands-C3NO344d.js";
+import { A as menuSelectKeys, B as resolveOne, C as isSubcommand, D as lastStdinAt, E as lastReadAt, F as recentMessageEdges, G as snapshotStatus, H as resolveResumeArgs, I as recentReadEdges, J as submitAndConfirm, K as stdinActivityPath, L as renderLogTailLines, M as readLogForRender, N as readNotes, O as listRecords, P as readPtysize, R as renderRawLog, S as isSlashCommand, T as isUserTyping, U as restartHintLines, V as resolveReadWindow, W as runSubcommand, X as writeKeysPaced, Y as waitForLogQuiet, Z as writeToIpc, _ as finalizedLines, a as TYPING_WINDOW_MS, b as isExitRequest, c as cmdHelp, d as deriveLiveState, f as deriveLiveStatus, g as extractTaskCounts, h as extractNeedsInput, i as READ_WINDOW_MS, j as readAgentPtysize, k as matchKeyword, l as controlCodeFromName, m as extractMenu, n as MAX_RENDER_BYTES, o as backoffWhileTyping, p as extractBadges, q as stopTipForCli, r as READ_PAGE_DEFAULT, s as cmdDeepseek, t as GRACEFUL_EXIT_COMMANDS, u as cursorAbs, v as isAgentStuck, w as isUnknownManagerToken, x as isPidAlive, y as isBareManagerInvocation, z as renderRawLogLines } from "./subcommands-DKqbwkvb.js";
 import "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";

package/dist/{terminal-BxWNOBW4.js → terminal-BQ79zaFa.js}

@@ -98,7 +98,7 @@ async function cmdTermMint(args) {
 	if (flags.ro && flags.interactive) throw new Error("--ro and --interactive are mutually exclusive");
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
 	const canSend = flags.interactive === true;
-	const { mintScopedTermToken } = await import("./serve-XWSfUL8i.js");
+	const { mintScopedTermToken } = await import("./serve-Dw0x9Of9.js");
 	const r = await mintScopedTermToken(pid, {
 		ttlSec,
 		canSend
@@ -135,4 +135,4 @@ async function cmdTerm(args) {
 
 //#endregion
 export { cmdTerm };
-//# sourceMappingURL=terminal-BxWNOBW4.js.map
+//# sourceMappingURL=terminal-BQ79zaFa.js.map

package/dist/trayApp-BHx2FN2d.js

@@ -0,0 +1,5 @@
+import "./versionChecker-D9LB-MW5.js";
+import "./rustBinary-ISnNc7Uf.js";
+import { a as trayHiddenMarker, i as launchTray, n as hasDesktop, r as isTrayHidden, t as cmdTray } from "./trayApp-BsETHuMR.js";
+
+export { cmdTray };

package/dist/{trayApp-CcQDIINw.js → trayApp-BsETHuMR.js}

@@ -1,4 +1,4 @@
-import { n as findTrayLauncher } from "./rustBinary-BK03gMMg.js";
+import { n as findTrayLauncher } from "./rustBinary-ISnNc7Uf.js";
 import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
 import { existsSync } from "node:fs";
 import path from "node:path";
@@ -97,4 +97,4 @@ async function cmdTray(args) {
 
 //#endregion
 export { trayHiddenMarker as a, launchTray as i, hasDesktop as n, isTrayHidden as r, cmdTray as t };
-//# sourceMappingURL=trayApp-CcQDIINw.js.map
+//# sourceMappingURL=trayApp-BsETHuMR.js.map

package/dist/{ts-BG759sO1.js → ts-Bb-h7XQP.js}

@@ -1,6 +1,6 @@
 import { n as __esmMin, r as __exportAll } from "./chunk-cZBX9HZv.js";
 import { n as logger, t as addTransport } from "./logger-CDIsZ-Pp.js";
-import { r as getInstalledPackage } from "./versionChecker-DCtcFwZ7.js";
+import { r as getInstalledPackage } from "./versionChecker-D9LB-MW5.js";
 import { t as agentYesHome } from "./agentYesHome-CtmsY6I-.js";
 import { u as removeControlCharacters } from "./todoAutomation-BETGOik9.js";
 import { i as shouldUseLock, r as releaseLock, t as acquireLock } from "./runningLock-DBoONoM-.js";
@@ -2074,7 +2074,7 @@ async function agentYes({ cli, cliArgs = [], skipPermissions = false, prompt, ro
 	}, 100);
 	const cleanupHeartbeat = () => clearInterval(heartbeatInterval);
 	shell.onExit(cleanupHeartbeat);
-	const { startParentPingLoop } = await import("./parentPingLoop-D2A9Fkhf.js");
+	const { startParentPingLoop } = await import("./parentPingLoop-BtggDU06.js");
 	const parentPingLoop = startParentPingLoop({
 		parentPid,
 		selfWrapperPid: process.pid,
@@ -2338,4 +2338,4 @@ function sleep(ms) {
 
 //#endregion
 export { hasTodoStore as a, permissionBadge as c, answerAsk as i, AgentContext as l, agentYes as n, listAsks as o, config as r, listAsksForProject as s, CLIS_CONFIG as t, CLAUDE_SESSION_PIN_ENV as u };
-//# sourceMappingURL=ts-BG759sO1.js.map
+//# sourceMappingURL=ts-Bb-h7XQP.js.map

package/dist/{versionChecker-DCtcFwZ7.js → versionChecker-D9LB-MW5.js}

@@ -7,7 +7,7 @@ import { fileURLToPath } from "url";
 
 //#region package.json
 var name = "agent-yes";
-var version = "1.271.0";
+var version = "1.272.0";
 
 //#endregion
 //#region ts/versionChecker.ts
@@ -215,4 +215,4 @@ async function displayVersion() {
 
 //#endregion
 export { versionString as i, displayVersion as n, getInstalledPackage as r, checkAndAutoUpdate as t };
-//# sourceMappingURL=versionChecker-DCtcFwZ7.js.map
+//# sourceMappingURL=versionChecker-D9LB-MW5.js.map

package/dist/{widget-DobxsxXa.js → widget-gRjJprB5.js}

@@ -28,7 +28,7 @@ function parseFlags(args, known) {
 }
 /** Resolve the local daemon base URL + token (flags override discovery). */
 async function daemonTarget(flags) {
-	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-XWSfUL8i.js");
+	const { resolveDaemonHttpBase, loadTokenReadOnly } = await import("./serve-Dw0x9Of9.js");
 	const base = typeof flags.base === "string" ? flags.base : await resolveDaemonHttpBase();
 	if (!base) throw new Error("no running ay serve daemon found — start `ay serve` or pass --base <url> (e.g. http://127.0.0.1:PORT)");
 	const token = typeof flags.token === "string" ? flags.token : await loadTokenReadOnly() ?? "";
@@ -186,7 +186,7 @@ async function cmdMint(args) {
 	const bad = caps.filter((c) => !KNOWN_CAPS.has(c));
 	if (bad.length) throw new Error(`unknown cap(s): ${bad.join(", ")} (valid: ${[...KNOWN_CAPS].join(", ")})`);
 	const ttlSec = parseTtlSec(typeof flags.ttl === "string" ? flags.ttl : "15m");
-	const { mintScopedTermToken } = await import("./serve-XWSfUL8i.js");
+	const { mintScopedTermToken } = await import("./serve-Dw0x9Of9.js");
 	const r = await mintScopedTermToken(target, {
 		ttlSec,
 		caps
@@ -202,4 +202,4 @@ async function cmdMint(args) {
 
 //#endregion
 export { cmdMint, cmdWidget };
-//# sourceMappingURL=widget-DobxsxXa.js.map
+//# sourceMappingURL=widget-gRjJprB5.js.map

package/dist/{ws-DO1UpPDw.js → ws-BFli3FKi.js}

@@ -1,4 +1,4 @@
-import { O as listRecords } from "./subcommands-C3NO344d.js";
+import { O as listRecords } from "./subcommands-DKqbwkvb.js";
 import { a as getProvisionRoot } from "./workspaceConfig-EK7XNsgR.js";
 import { existsSync } from "fs";
 import { lstat, opendir } from "fs/promises";
@@ -424,4 +424,4 @@ async function cmdWs(args) {
 
 //#endregion
 export { isPathInside as a, walkWorkspaces as c, importProvisionModule as i, workspaceStatus as l, cmdWs as n, loadProvision as o, collectWorkspaces as r, resolveOperand as s, WS_JSON_SCHEMA as t };
-//# sourceMappingURL=ws-DO1UpPDw.js.map
+//# sourceMappingURL=ws-BFli3FKi.js.map

package/dist/{ws-Bk2cJphr.js → ws-CklRMQwW.js}

@@ -3,10 +3,10 @@ import "./globalPidIndex-Dq4KY2IV.js";
 import "./messageLog-BYFwioFY.js";
 import "./e2e-OLfcNxiv.js";
 import "./configShared-DYxlvrH0.js";
-import "./subcommands-C3NO344d.js";
+import "./subcommands-DKqbwkvb.js";
 import "./notifyStore-Dus2D1XA.js";
 import "./webrtcLink-B72AQ2eb.js";
 import "./remotes-IzQHupeo.js";
-import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-DO1UpPDw.js";
+import { a as isPathInside, c as walkWorkspaces, i as importProvisionModule, l as workspaceStatus, n as cmdWs, o as loadProvision, r as collectWorkspaces, s as resolveOperand, t as WS_JSON_SCHEMA } from "./ws-BFli3FKi.js";
 
 export { WS_JSON_SCHEMA, cmdWs, collectWorkspaces, isPathInside, loadProvision, walkWorkspaces, workspaceStatus };

package/lab/ui/lab/index.md

@@ -79,6 +79,22 @@ machine, and any one person's attention.** The long version is a post below —
 address space, a bus that humans are also on, and delegation with accountability, and it is honest
 about the four places the current system is still cluttered.
 
+## The ecosystem
+
+agent-yes is the fleet. Around it sit tools that give the fleet somewhere to *reach* — each a
+standalone CLI in its own right, each usable without the others:
+
+| | |
+| --- | --- |
+| **[agent-yes](https://github.com/snomiao/agent-yes)** | run, watch, message and delegate to a fleet of AI coding agents |
+| **[slack-term](https://github.com/snomiao/slack-term)** | the human-comms surface — read and write Slack from a terminal, with a confirm gate built for operators who are sometimes machines |
+
+The connective tissue is a shared stance rather than a shared library: file-based state over
+daemons, one command surface across two runtimes, gates on the irreversible and warnings on the
+merely unwise, and a hard rule that no real operational data lands in a public repo. Both projects
+arrived at the same interrupt-safety reasoning against completely different substrates — one over
+`pids.jsonl` and a FIFO, the other over Slack reactions.
+
 ---
 
 ## Notes

package/lab/ui/lab/posts/2026-08-11-slack-term-safe-writes.md

@@ -0,0 +1,240 @@
+---
+title: A confirm code that goes stale — how slack-term makes agents safe to give a voice
+tag: Ecosystem
+summary: slack-term is the agent-yes fleet's human-comms surface. Its confirm gate hashes the destination, the actor and the conversation's current last message — so it expires the moment anything that mattered moves. Plus what it gets right, and where it is thinner than its README claims.
+---
+
+<p class="lede">An agent that can only read is a curiosity. An agent that can write into the
+channel where your colleagues work is either infrastructure or a hazard, and which one it is
+comes down to a handful of design decisions. <a
+href="https://github.com/snomiao/slack-term">slack-term</a> is the Slack CLI the agent-yes fleet
+uses to talk to humans, and it is worth reading for one idea in particular: a confirmation code
+that <b>goes stale when the conversation moves</b>.</p>
+
+## Where it sits in the ecosystem
+
+agent-yes gives a fleet of agents an address space — they can be listed, tailed, messaged and
+delegated to. But a fleet that can only talk to itself is a closed loop. The parts of the system
+that face *humans* are the ones that decide whether any of it is useful: `ay callback` puts a reply
+box on a published report, `ay ch` gives humans and agents one channel, and slack-term takes the
+fleet into the place work already happens.
+
+That last one carries a different risk profile from the rest. A callback widget is send-only into a
+terminal you own. Posting to `#general` is irreversible, public, and attributed to *you*. So the
+interesting engineering is not the Slack API wrapper — it is everything built around the moment of
+writing.
+
+## The gate: hash the write, not the intent
+
+Every gated write — `send`, `edit`, `delete`, `upload`, `schedule`, `channel create`, `drafts` —
+runs twice. The first run previews and prints a 4-hex code; the second run must present it:
+
+```
+$ slack send "#general" "deploying v2 now"
+From: @alice (U00000001) — Acme
+To:   #general
+...preview of the channel's recent messages...
+Rerun with --code=3f9c
+
+$ slack send "#general" "deploying v2 now" --code=3f9c
+```
+
+The code is not a nonce and there is no server, no session, and no stored state. It is
+`sha256(parts.join("\n")).slice(0, 4)` — recomputed from scratch on both runs. What goes into
+`parts` is the whole design (`ts/cli.ts:1433`):
+
+```js
+const code = safetyCode(channelId, threadTs ?? "", lastText, message, self?.userId ?? "");
+```
+
+Read that as a list of things that must not have changed between preview and confirm:
+
+- **`channelId` + `threadTs`** — a code minted for one destination cannot confirm a send to another.
+- **`self.userId`** — the acting identity. Preview as one profile, switch, confirm → the code is
+  dead. Every gate prints a `From: @handle (Uxxxx) — Workspace` line naming who it will act as, and
+  binds that identity into the code, so the label cannot drift from the act.
+- **`lastText`** — **the destination's current last message.**
+
+That third one is the good idea. If anyone posts between your preview and your confirm, the code
+you were given no longer verifies, and you are shown the conversation again before you can proceed.
+It is a time-of-check/time-of-use defense built out of content rather than a clock: **no timestamp,
+no expiry, no session — freshness is derived from the thing that would make you change your mind.**
+For `edit` and `delete`, the same trick binds the target's *current remote text*, so you cannot
+edit-over something that was rewritten while you were reading it.
+
+## Gates block, guards warn
+
+Four heuristics fire around a send, and not one of them can stop it:
+
+| | |
+| --- | --- |
+| **near-duplicate** | character-bigram Dice similarity over normalized text; warns at ≥0.82 against messages already in the thread |
+| **unreplied** | the destination's last message is already yours — you are about to double-post, so it prints a ready-to-paste `slack edit` command for that message instead |
+| **self-DM** | DMing yourself with your own user token delivers but never notifies |
+| **mentions** | `@handle` tokens that could not be resolved will post as plain text and notify nobody |
+
+All four are `console.error` and fall through. The only hard stop in the whole path is a missing or
+wrong `--code`.
+
+That split is worth stating as a rule, because it is what keeps the system coherent: **irreversible
+things get a gate; advisory things get a line on stderr.** Heuristics that can block teach people to
+reach for a bypass flag — and the moment a bypass flag exists, it will eventually be used on the
+real gate too. Because the fuzzy signals stay advisory, the repo ships **no `--yes`, no `--force`,
+no `SKIP_CONFIRM`** at all.
+
+## The honest part: it is a review gate, not an authorization gate
+
+Here is the thing the project is refreshingly clear-eyed about. The gate holds no secret. The
+expected code is deterministic, and the CLI prints it straight back to you on a wrong-code retry:
+
+```
+Code mismatch (got 0000, expected 3f9c)
+Rerun with --code=3f9c
+```
+
+Any script can defeat that in two lines — and the repo's own test suite does exactly that, regexing
+`--code=([0-9a-f]{4})` out of stderr at roughly 19 call sites. The Rust implementation says so in
+its own source: *"Always print the hash so scripts can capture and rerun."*
+
+So the gate is not a permission boundary. It is a **forced-review step**: it makes the default path
+one where a human or an agent must look at a rendered preview of exactly what will be posted, where,
+and as whom, before anything happens. An agent determined to route around it can. The value is that
+nothing does so *by accident* — and accident, not malice, is what actually posts to the wrong
+channel at 3am.
+
+Calling that out is better engineering than pretending otherwise, because a team that believes a
+review gate is an authorization gate will eventually put something behind it that needed a real one.
+
+## Display names are attacker-controlled
+
+Anyone in a Slack workspace can set their own display name, and that name gets drawn into your
+terminal — inside the confirm preview you are about to make a decision from.
+`stripTerminalControls()` (`ts/cli.ts:811`) removes ANSI CSI sequences, all C0/C1 control characters
+including a lone ESC, **and Unicode bidi controls** (LRM/RLM, LRE/RLE/PDF/LRO/RLO, LRI/RLI/FSI/PDI).
+
+Stripping ANSI is common. Remembering that a right-to-left override can visually reorder the line
+that is supposed to be telling you what you are about to send is not. Sanitizing *the preview
+itself* follows from taking the gate seriously: a preview that can be made to lie is worse than no
+preview, because it is trusted.
+
+The coverage is deliberate but not yet total — it is applied to the sender label and the mention
+previews; the gate's own quoted message previews and channel labels still render Slack-controlled
+text unstripped.
+
+## A denylist stored as hashes
+
+The repo is public and its test fixtures come from real Slack recordings, so it treats its own
+corpus as a leak risk. `.githooks/denylist.sha256` holds ~26 SHA-256 hashes and no plaintext, and
+says why in the file:
+
+> Stored as hashes on purpose: this repo is public, so it must not spell out the real names and IDs
+> it is protecting.
+
+A plaintext list of the names you are protecting is itself the disclosure. There is a second-order
+reason too: plaintext would be rewritten by any future history scrub, silently inverting what the
+hook blocks.
+
+Two modes, and the docs are explicit about why both must exist:
+
+| mode | sees | role |
+| --- | --- | --- |
+| default | the **staged diff** — added lines only | commit hook |
+| `--all` | **every tracked file** | `prepublishOnly` + CI |
+
+The commit hook is *structurally blind* to data already sitting in the tree: committed once, never
+re-added by any later diff, therefore invisible to every future staged scan. That blind spot is not
+hypothetical — it is how real workspace data once reached npm, and the whole-tree gate exists
+specifically to close it. One scanner, three enforcement points (hook, CI, publish), no
+reimplementation per venue.
+
+The placeholder scheme deserves a mention because it is *machine-decidable* rather than a style
+guide. A real Slack ID is a type letter followed by 8+ `[A-Z0-9]` **whose tail mixes letters and
+digits**; a `0000` run separately marks an ID as fake. Testing the tail rather than the whole string
+is load-bearing: the leading `C` of `C00000001` would otherwise count as "the letter" and make every
+placeholder read as real. It scans fixture **filenames** as well as bodies.
+
+## Built so an agent is a good citizen
+
+The affordances that only make sense when the operator is a machine:
+
+- **Reaction-as-ack is deliberately ungated** — "a reaction is trivial and fully reversible, and the
+  whole point is a lightweight ack." The cheap polite action stays frictionless while the loud one
+  stays gated. 👀 for *seen*, ✅ for *done*, ⏳ for *working on it* — a thread that does not grow.
+- **`--unreplied`** — "only conversations whose last word isn't mine." Whose ball it is, computed
+  rather than guessed.
+- **`[+N replies]`** — Slack's history endpoint returns thread parents but no replies, so a naive
+  renderer hides entire conversations. Marking them means a reader is never misled into thinking it
+  has read everything.
+- **stdout is data, stderr is commentary** in the streaming path, so `slack tail "#general" | grep
+  deploy` sees messages and not chrome.
+- **Output is valid input** — a printed permalink or ISO stamp can be pasted straight back as a
+  target, with strict parsers that throw rather than guess.
+- **`SKILL.md` ships in the npm tarball** with agent-skill frontmatter, so it triggers on how a user
+  *talks* ("any mentions?", "DM @person") rather than on the tool's name.
+
+Then there is `ts/todo.ts`, which encodes task state entirely in Slack reactions — 📌 marker,
+✅/🚫/👀/⏳ progress, stacking reason flags — with no external store, so humans see the same state in
+the Slack UI that the agent queries. Two comments in that file are the best writing in either repo.
+
+The first records a **measured negative result**:
+
+> the obvious alternative — posting a machine-readable token like `todo:v1 blocked-on=@alice` — does
+> NOT work: Slack's full-text index splits on punctuation, so a quoted search for "blocked-on"
+> returns 0 hits (measured), and "1.91" matches 1.91.0.
+
+The second explains an ordering invariant:
+
+> **ORDER IS THE WHOLE POINT**: `reactions.add` runs FIRST, then removes. Never invert this.
+> Removing first leaves a window with zero progress reactions; a crash, a 429 or a Ctrl-C inside
+> that window drops the task out of every `todo ls` query permanently, with nothing left to point at
+> it.
+
+Add-first's worst case is a message carrying two progress reactions — harmless, *because the
+invariant is "at least one, readers collapse by priority" rather than "exactly one."* Choosing the
+weaker invariant is what makes the operation safe to interrupt. Removes are awaited serially because
+`Promise.all` would drop the ordering guarantee. That is the same reasoning agent-yes applies to its
+own file-based fabric, arrived at independently against a completely different substrate.
+
+## Where it is thinner than it looks
+
+A fair reading has to include these.
+
+**Credentials at rest are unhardened.** `~/.config/slack-cli/profiles.json` holds tokens and session
+cookies and is written with `writeFileSync` and no `mode` argument, so it lands at the process umask
+— typically world-readable. There is no `chmod` call anywhere in `ts/` or `rs/`. For a project this
+careful about every other boundary, this is the odd one out.
+
+**"Verified byte-for-byte" oversells the parity test.** The mechanism is real and well-built —
+byte-identical stdout from both runtimes against a mock server, with an isolated `HOME` so no real
+profile bleeds in — but it covers **2 of 23 commands** (`news`, `search`), and it *skips silently*
+when the Rust binary or the fixtures are absent. A gate that skips by default is not a gate. Worse,
+the one thing that most needs to match across implementations — the write gate — is the thing that
+matches least: the Rust `send` uses `--confirm` rather than `--code`, binds neither the thread nor
+the acting identity, and collapses to `sha256(message)` when its context fetch comes back empty.
+
+The two runtimes are not really peers; one is the product and the other is a frozen subset. Compare
+agent-yes, which has the same TS/Rust split and solves it with the opposite polarity: it does not
+diff behavior, it *pins the surface* — a test parses both `ts/subcommands.ts` and `rs/src/cli.rs` as
+text and fails when the subcommand lists disagree, and everything else lives in a parity table
+allowed to say "not planned." Enforce the surface, negotiate the behavior.
+
+**`SKILL.md` still points agents at a deprecated package.** It says to install `@snomiao/slack`; the
+README marks that deprecated in favour of `slack-term`. Of the three, this is the one that actively
+misleads, because SKILL.md is the file an agent reads.
+
+## What carries over
+
+Three ideas here are worth stealing regardless of Slack:
+
+1. **Bind your confirmation to the state that would change your mind.** Not a nonce, not a
+   timestamp — the destination, the actor, and the conversation's current last message. It goes
+   stale exactly when it should.
+2. **Gates block, guards warn — and never mix them.** One hard stop, uniformly applied, is
+   comprehensible and needs no bypass flag. The moment a fuzzy heuristic can block, someone builds a
+   `--force`, and then it is on the real gate too.
+3. **Say which one you built.** A forced-review step and an authorization boundary look similar from
+   the outside and fail very differently. Naming it correctly is what stops someone putting
+   something behind it that needed the other kind.
+
+<p class="note">Related: <a href="./2026-08-11-an-address-space-for-agents">an address space for
+agents</a> — why a fleet needs a bus that humans are on too.</p>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-yes",
-  "version": "1.271.0",
+  "version": "1.272.0",
   "description": "A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.",
   "keywords": [
     "ai",

package/dist/trayApp-XJit7gRr.js

@@ -1,5 +0,0 @@
-import "./versionChecker-DCtcFwZ7.js";
-import "./rustBinary-BK03gMMg.js";
-import { a as trayHiddenMarker, i as launchTray, n as hasDesktop, r as isTrayHidden, t as cmdTray } from "./trayApp-CcQDIINw.js";
-
-export { cmdTray };