primcli 1.47.0 → 1.49.0

package/dist/oclif/index.js

@@ -1,13 +1,13 @@
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DGrZCUfw.js";
-import { $ as buildThrownSendFailureEnvelope, $n as stopRepeatFromEmail, $t as getAgentContactPolicy, A as readThreadContext, An as listWakeSchedules, At as queryUsesAutomated, B as recordPendingMail, Bn as resendAgentSignupVerification, Bt as createEndpoint, C as queryUsesAwaiting, Cn as listFunctionLogs, Ct as AutomatedFilterUnsupportedError, D as displayAddress, Dn as listSentEmails, Dt as expectedAutomatedVerdicts, E as describeWake, En as listRoutes, Et as ensureSearchReportsAutomated, F as wakeRecipientField, Ft as resolveCliApiRequestConfig, G as replyExpectation, Gn as sendEmail, H as interactionHumanLine, Hn as searchEmails, Ht as createRoute, I as wakeRelationship, In as redeemCreditCode, It as addDefaultNetworkMember, J as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Jn as setMemory, Jt as deleteRoute, K as replyInteractionWarning, Kn as setFunctionRoute, L as clearReadPendingMail, Ln as removeDefaultNetworkMember, Lt as checkDefaultNetworkContactAdmission, M as serverMuted, Mn as pullWebhookEvent, Mt as createAuthenticatedCliApiClient, N as serverRelationship, Nt as createCliApiClient, O as formatWakeContext, On as listWakeAuthorizations, Ot as hasAutomatedVerdict, P as wakeReadCommand, Pt as refreshStoredCliCredentials, Q as buildFollowUpCommand, Qn as startCliLogin, Qt as getAccount, R as pendingMailPath, Rn as reorderRoutes, Rt as cliLogout, S as isAwaitingRejectedError, Sn as listEndpoints, St as AUTOMATED_VALUES, T as bareAddress, Tn as listRepeatingSends, Tt as automatedRejectedError, U as interactionNextActions, Un as searchMemories, Ut as createWakeAuthorization, V as removePendingMail, Vn as runWakeSchedule, Vt as createFunction, W as readEmailInteraction, Wn as semanticSearch, Wt as createWakeSchedule, X as apiResultHttpStatus, Xn as startAgentClaim, Xt as deleteWakeSchedule, Y as SEND_OUTCOME_HELP, Yn as simulateRoute, Yt as deleteWakeAuthorization, Z as assertValidIdempotencyKey, Zn as startAgentSignup, _ as awaitingRejectedError, _t as formatAlreadySentNotice, a as extractErrorCode, an as getFunction, ar as updateRoute, at as formatPriorRepliesWarning, b as formatRepliesCell, bn as listDomains, bt as AUTOMATED_FILTER_UNSUPPORTED_CODE, c as readTextFileFlag, cn as getInboxStatus, cr as verifyAgentClaim, ct as priorRepliesThatWentOut, d as writeErrorWithHints, dn as getRepeatingSend, dt as sendOutcomeExitCode, er as testFunction, et as checkPriorReplies, f as AWAITING_FLAG_DESCRIPTION, fn as getSentEmail, ft as sentHistoryWindowStart, g as assertAwaitingFilterRows, gn as listAgentNetworks, gt as currentMailSessionKey, h as ReplyStateUnsupportedError, hn as listAgentContacts, ht as thrownErrorExitCode, i as createOperationCommand, in as getEmail, ir as updateRepeatingSend, it as formatPriorRepliesCheckSkipped, j as sentInThread, jn as pollCliLogin, k as latestOwnOutbound, kn as listWakeDispatches, kt as isAutomatedRejectedError, l as runWithTiming, ln as getMemory, lr as verifyAgentSignup, lt as reportSendCommandResult, m as REPLY_STATE_UNSUPPORTED_CODE, mn as getWakeSchedule, mt as successfulSendOutcome, n as API_ERROR_CODES, nn as getCreditBalance, nr as updateDefaultNetworkMember, nt as deriveSendIdempotencyKey, o as extractErrorPayload, on as getFunctionRouting, or as updateWakeAuthorization, ot as formatSendFailureSummary, p as AWAITING_VALUES, pn as getThread, pt as serializeErrorPayload, q as wakeInteractionSentence, qn as setFunctionSecret, qt as deleteMemory, r as TIME_FLAG_DESCRIPTION, rn as getDefaultNetworkAgent, rr as updateFunction, rt as formatDeletedEarlierSendNotice, s as formatErrorPayload, sn as getFunctionTestRunTrace, sr as updateWakeSchedule, st as formatSendRecordFailureSummary, t as API_BASE_URL_FLAG_DESCRIPTION, tn as getConversation, tr as unsetFunctionRoute, tt as classifySendError, u as surfaceUnauthorizedHint, un as getOrgRoutingTopology, ut as sendIdentityFields, v as ensureSearchReportsReplyState, vn as listDefaultNetworkAgents, vt as writeIdempotentReplayBannerIfReplay, w as explainPendingMailNotFound, wn as listFunctions, wt as assertAutomatedVerdict, x as hasReplyState, xn as listEmails, xt as AUTOMATED_FLAG_DESCRIPTION, y as formatAwaitingCell, yn as listDefaultNetworkMembers, yt as withFlagSuggestion, z as readPendingMail, zn as replyToEmail, zt as completeWebhookEvent } from "../api-command-C1JvJqV0.js";
+import { $ as buildThrownSendFailureEnvelope, $n as stopRepeatFromEmail, $t as getAgentContactPolicy, A as readThreadContext, An as listWakeSchedules, At as queryUsesAutomated, B as recordPendingMail, Bn as resendAgentSignupVerification, Bt as createEndpoint, C as queryUsesAwaiting, Cn as listFunctionLogs, Ct as AutomatedFilterUnsupportedError, D as displayAddress, Dn as listSentEmails, Dt as expectedAutomatedVerdicts, E as describeWake, En as listRoutes, Et as ensureSearchReportsAutomated, F as wakeRecipientField, Ft as resolveCliApiRequestConfig, G as replyExpectation, Gn as sendEmail, H as interactionHumanLine, Hn as searchEmails, Ht as createRoute, I as wakeRelationship, In as redeemCreditCode, It as addDefaultNetworkMember, J as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Jn as setMemory, Jt as deleteRoute, K as replyInteractionWarning, Kn as setFunctionRoute, L as clearReadPendingMail, Ln as removeDefaultNetworkMember, Lt as checkDefaultNetworkContactAdmission, M as serverMuted, Mn as pullWebhookEvent, Mt as createAuthenticatedCliApiClient, N as serverRelationship, Nt as createCliApiClient, O as formatWakeContext, On as listWakeAuthorizations, Ot as hasAutomatedVerdict, P as wakeReadCommand, Pt as refreshStoredCliCredentials, Q as buildFollowUpCommand, Qn as startCliLogin, Qt as getAccount, R as pendingMailPath, Rn as reorderRoutes, Rt as cliLogout, S as isAwaitingRejectedError, Sn as listEndpoints, St as AUTOMATED_VALUES, T as bareAddress, Tn as listRepeatingSends, Tt as automatedRejectedError, U as interactionNextActions, Un as searchMemories, Ut as createWakeAuthorization, V as removePendingMail, Vn as runWakeSchedule, Vt as createFunction, W as readEmailInteraction, Wn as semanticSearch, Wt as createWakeSchedule, X as apiResultHttpStatus, Xn as startAgentClaim, Xt as deleteWakeSchedule, Y as SEND_OUTCOME_HELP, Yn as simulateRoute, Yt as deleteWakeAuthorization, Z as assertValidIdempotencyKey, Zn as startAgentSignup, _ as awaitingRejectedError, _t as formatAlreadySentNotice, a as extractErrorCode, an as getFunction, ar as updateRoute, at as formatPriorRepliesWarning, b as formatRepliesCell, bn as listDomains, bt as AUTOMATED_FILTER_UNSUPPORTED_CODE, c as readTextFileFlag, cn as getInboxStatus, cr as verifyAgentClaim, ct as priorRepliesThatWentOut, d as writeErrorWithHints, dn as getRepeatingSend, dt as sendOutcomeExitCode, er as testFunction, et as checkPriorReplies, f as AWAITING_FLAG_DESCRIPTION, fn as getSentEmail, ft as sentHistoryWindowStart, g as assertAwaitingFilterRows, gn as listAgentNetworks, gt as currentMailSessionKey, h as ReplyStateUnsupportedError, hn as listAgentContacts, ht as thrownErrorExitCode, i as createOperationCommand, in as getEmail, ir as updateRepeatingSend, it as formatPriorRepliesCheckSkipped, j as sentInThread, jn as pollCliLogin, k as latestOwnOutbound, kn as listWakeDispatches, kt as isAutomatedRejectedError, l as runWithTiming, ln as getMemory, lr as verifyAgentSignup, lt as reportSendCommandResult, m as REPLY_STATE_UNSUPPORTED_CODE, mn as getWakeSchedule, mt as successfulSendOutcome, n as API_ERROR_CODES, nn as getCreditBalance, nr as updateDefaultNetworkMember, nt as deriveSendIdempotencyKey, o as extractErrorPayload, on as getFunctionRouting, or as updateWakeAuthorization, ot as formatSendFailureSummary, p as AWAITING_VALUES, pn as getThread, pt as serializeErrorPayload, q as wakeInteractionSentence, qn as setFunctionSecret, qt as deleteMemory, r as TIME_FLAG_DESCRIPTION, rn as getDefaultNetworkAgent, rr as updateFunction, rt as formatDeletedEarlierSendNotice, s as formatErrorPayload, sn as getFunctionTestRunTrace, sr as updateWakeSchedule, st as formatSendRecordFailureSummary, t as API_BASE_URL_FLAG_DESCRIPTION, tn as getConversation, tr as unsetFunctionRoute, tt as classifySendError, u as surfaceUnauthorizedHint, un as getOrgRoutingTopology, ut as sendIdentityFields, v as ensureSearchReportsReplyState, vn as listDefaultNetworkAgents, vt as writeIdempotentReplayBannerIfReplay, w as explainPendingMailNotFound, wn as listFunctions, wt as assertAutomatedVerdict, x as hasReplyState, xn as listEmails, xt as AUTOMATED_FLAG_DESCRIPTION, y as formatAwaitingCell, yn as listDefaultNetworkMembers, yt as withFlagSuggestion, z as readPendingMail, zn as replyToEmail, zt as completeWebhookEvent } from "../api-command-BixHVNwQ.js";
 import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-SPPcis9g.js";
-import { $ as describeSessionHookItem, A as NetworkAdmissionPendingError, B as runContactRequest, C as pollCheckCommand, D as verificationReplySubmitted, E as RECEIVER_MODES, F as addressNoteTarget, G as receiverStatusCommand, H as agentInvitationHash, I as runAddressNotesRequest, J as recordHookMailCheck, K as savedReceiver, L as ContactsApiError, M as evaluateContactPolicy, N as canonicalContactSelector, O as ContactPolicyReadRetryError, P as AddressNotesApiError, Q as describeSessionHookChange, R as contactAddress, S as invitationProfileName, T as withOwnerMemberAddress, U as connectAgent, V as agentConnectionStatus, W as readAgentInvitation, X as claudeConfigDir, Y as boundSessionProfiles, Z as currentCliLocation, _ as disconnectAgent, a as endSession, at as samePath, b as identitySuggestions, c as pendingSessionDisconnects, ct as inspectManagedBlock, d as registerSession, dt as upsertManagedBlock, et as ephemeralCliReason, f as retryPendingDisconnects, ft as writeManagedFile, g as AgentDisconnectError, h as enrollmentResumes, i as connectedProfilesForSession, it as repairClaudeHooks, j as createNotificationContactPolicy, k as NETWORK_ADMISSION_PENDING_RETRY_MS, l as psProcessInfo, lt as jsonIndentation, m as enrollAgent, n as OMP_MAIN, nt as inspectClaudeHooks, o as headlessClaudeRun, ot as writeClaudeSettings, p as runDetached, q as installClaudeWakeHook, r as agentConnectionState, rt as readClaudeSettings, st as MachineFileError, t as MACHINE_RUNTIMES, tt as findOnPath, u as readClaudeHookInput, ut as readManagedFile, v as cliInvocation, w as runAgentConnect, x as defaultAgentProfileName, y as generatedAgentName, z as contactAgentAddress } from "../machine-session-Dr5W2fHb.js";
-import { _ as NativeSessionDisconnectedError, a as readBundledConnectSkill, b as NotificationOutcomeUnknownError, c as openSessionNotifications, d as isRoutineNotificationContent, f as notificationPartReader, g as defaultSessionSocket, i as installedVersion, l as notificationReceiptPage, m as SESSION_UUID$1, o as notificationScope, p as readConversationStatusContent, r as installConnectSkill, s as notificationSenders, t as connectSkillTarget, u as NotificationRetryError, v as NativeSessionError, y as NativeSessionNotLoadedError } from "../connect-skill-CH2pq436.js";
-import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-CyLc8VBn.js";
-import { a as REPEAT_IDLE_MAX_MINUTES, d as parseRepeatTick, f as preparePresenceAliveEmail, g as isEmailReceivedEvent, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as parseWebhookEvent, y as parseFromHeader } from "../repeats-D2xtLium-DdiJECLI.js";
-import { a as ensureSharedMailSubscription, c as reserveSharedMailSubscription, d as otherParticipants, f as EventConnection, h as pushFile, i as sharedMailScope, l as followEmailConversation, m as pullFile, n as reconcileChatSend, o as createSharedMailWaiter, p as EventReceiverError, r as openSharedMailReceiver, s as openSharedMailStore, t as sendSignal, u as readConversationFollow } from "../signal-command-Dbyqyas9.js";
-import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-DhxtuNXs.js";
-import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, restoreAutoWorking } from "./auto-signals.js";
+import { $ as currentCliLocation, A as NETWORK_ADMISSION_PENDING_RETRY_MS, B as contactAgentAddress, C as invitationProfileName, D as externalReceivingState, E as RECEIVER_MODES, F as AddressNotesApiError, G as readAgentInvitation, H as agentConnectionStatus, I as addressNoteTarget, J as savedReceiver, K as receiverStatusCommand, L as runAddressNotesRequest, M as createNotificationContactPolicy, N as evaluateContactPolicy, O as verificationReplySubmitted, P as canonicalContactSelector, Q as claudeConfigDir, R as ContactsApiError, S as defaultAgentProfileName, T as runAgentConnect, U as agentInvitationHash, V as runContactRequest, W as connectAgent, X as recordHookMailCheck, Y as installClaudeWakeHook, Z as boundSessionProfiles, _ as disconnectAgent, _t as readHookLauncherWarning, a as endSession, at as hasMachineSessionHooks, b as identitySuggestions, c as pendingSessionDisconnects, ct as repairClaudeHooks, d as registerSession, dt as MachineFileError, et as describeSessionHookChange, f as retryPendingDisconnects, ft as inspectManagedBlock, g as AgentDisconnectError, gt as writeManagedFile, h as enrollmentResumes, ht as upsertManagedBlock, i as connectedProfilesForSession, it as findOnPath, j as NetworkAdmissionPendingError, k as ContactPolicyReadRetryError, l as psProcessInfo, lt as samePath, m as enrollAgent, mt as readManagedFile, n as OMP_MAIN, nt as ensureHookLauncher, o as headlessClaudeRun, ot as inspectClaudeHooks, p as runDetached, pt as jsonIndentation, q as refusalAfterReplacement, r as agentConnectionState, rt as ephemeralCliReason, st as readClaudeSettings, t as MACHINE_RUNTIMES, tt as describeSessionHookItem, u as readClaudeHookInput, ut as writeClaudeSettings, v as cliInvocation, vt as refreshOwnerMemberAddressPeriodically, w as pollCheckCommand, x as connectWarnings, y as generatedAgentName, yt as withOwnerMemberAddress, z as contactAddress } from "../machine-session-BEkDi4_N.js";
+import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-DSLrmgWQ.js";
+import { _ as NativeSessionDisconnectedError, a as readBundledConnectSkill, b as NotificationOutcomeUnknownError, c as openSessionNotifications, d as isRoutineNotificationContent, f as notificationPartReader, g as defaultSessionSocket, i as installedVersion, l as notificationReceiptPage, m as SESSION_UUID$1, o as notificationScope, p as readConversationStatusContent, r as installConnectSkill, s as notificationSenders, t as connectSkillTarget, u as NotificationRetryError, v as NativeSessionError, y as NativeSessionNotLoadedError } from "../connect-skill-DBkhFAkO.js";
+import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-CMfxkeVP.js";
+import { a as REPEAT_IDLE_MAX_MINUTES, d as parseRepeatTick, f as preparePresenceAliveEmail, g as isEmailReceivedEvent, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as parseWebhookEvent, y as parseFromHeader } from "../repeats-D2xtLium-B8Wq41vG.js";
+import { a as ensureSharedMailSubscription, c as reserveSharedMailSubscription, d as otherParticipants, f as EventConnection, h as pushFile, i as sharedMailScope, l as followEmailConversation, m as pullFile, n as reconcileChatSend, o as createSharedMailWaiter, p as EventReceiverError, r as openSharedMailReceiver, s as openSharedMailStore, t as sendSignal, u as readConversationFollow } from "../signal-command-D0Rig6eA.js";
+import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, restoreAutoWorking } from "./auto-signals.js";
 import { t as guardJsonOutputCommands } from "../json-output-Cf-GFeff.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
 import { chmodSync, closeSync, constants, cpSync, existsSync, fstatSync, fsyncSync, linkSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
@@ -272,7 +272,7 @@ const openapiDocument = {
 		"/cli/signup/start": { "post": {
 			"operationId": "startCliSignup",
 			"summary": "Start CLI account signup",
-			"description": "Starts a terminal-native CLI signup. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+			"description": "Starts a terminal-native CLI signup. The API creates a pending\nsignup session, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
 			"tags": ["CLI"],
 			"security": [],
 			"requestBody": {
@@ -334,7 +334,7 @@ const openapiDocument = {
 		"/cli/signup/verify": { "post": {
 			"operationId": "verifyCliSignup",
 			"summary": "Verify CLI signup and create OAuth session",
-			"description": "Verifies the email code for a CLI signup session and creates the\naccount. When the session was started with a `signup_code`, the\nreserved code is redeemed; sessions started without a code skip\nthe redemption step. Either way an org-scoped OAuth CLI session\nis created and the token set is returned exactly once. This\nendpoint does not require an API key.\n",
+			"description": "Verifies the email code for a CLI signup session and creates the\naccount. An org-scoped OAuth CLI session is created and the\ntoken set is returned exactly once. This endpoint does not\nrequire an API key.\n",
 			"tags": ["CLI"],
 			"security": [],
 			"requestBody": {
@@ -354,7 +354,7 @@ const openapiDocument = {
 					}] } } }
 				},
 				"400": {
-					"description": "Invalid request, invalid verification code, expired token, invalid signup code, rejected password, or account creation failure",
+					"description": "Invalid request, invalid verification code, expired token, rejected password, or account creation failure",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"429": { "$ref": "#/components/responses/RateLimited" }
@@ -363,7 +363,7 @@ const openapiDocument = {
 		"/agent/signup/start": { "post": {
 			"operationId": "startAgentSignup",
 			"summary": "Start agent account signup",
-			"description": "Starts an agent-native signup session. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+			"description": "Starts an agent-native signup session. The API creates a pending\nsignup session, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
 			"tags": ["Agent"],
 			"security": [],
 			"requestBody": {
@@ -425,7 +425,7 @@ const openapiDocument = {
 		"/agent/signup/verify": { "post": {
 			"operationId": "verifyAgentSignup",
 			"summary": "Verify agent signup and create OAuth tokens",
-			"description": "Verifies the email code for an agent signup session and creates\nthe account when needed. When the session was started with a\n`signup_code`, the reserved code is redeemed; sessions started\nwithout a code skip the redemption step. An org-scoped OAuth\nsession for CLI authentication is minted and the raw tokens are\nreturned exactly once. For existing users, the optional `org_id`\nselects which accessible workspace should receive the new\nsession (no signup-code redemption is performed for existing\nusers regardless of how the session was started).\n",
+			"description": "Verifies the email code for an agent signup session and creates\nthe account when needed. An org-scoped OAuth session for CLI\nauthentication is minted and the raw tokens are returned exactly\nonce. For existing users, the optional `org_id` selects which\naccessible workspace should receive the new session.\n",
 			"tags": ["Agent"],
 			"security": [],
 			"requestBody": {
@@ -445,7 +445,7 @@ const openapiDocument = {
 					}] } } }
 				},
 				"400": {
-					"description": "Invalid request, invalid verification code, expired token, invalid signup code, or account creation failure",
+					"description": "Invalid request, invalid verification code, expired token, or account creation failure",
 					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }
 				},
 				"403": { "$ref": "#/components/responses/Forbidden" },
@@ -9765,7 +9765,6 @@ const openapiDocument = {
 									"access_denied",
 									"expired_token",
 									"invalid_device_code",
-									"invalid_signup_code",
 									"invalid_signup_token",
 									"invalid_verification_code",
 									"email_delivery_failed",
@@ -10070,12 +10069,6 @@ const openapiDocument = {
 						"format": "email",
 						"maxLength": 254
 					},
-					"signup_code": {
-						"type": "string",
-						"minLength": 1,
-						"maxLength": 128,
-						"description": "Optional signup code. Omit if you do not have one."
-					},
 					"terms_accepted": {
 						"type": "boolean",
 						"const": true,
@@ -10255,12 +10248,6 @@ const openapiDocument = {
 						"format": "email",
 						"maxLength": 254
 					},
-					"signup_code": {
-						"type": "string",
-						"minLength": 1,
-						"maxLength": 128,
-						"description": "Optional signup code. Omit if you do not have one."
-					},
 					"terms_accepted": {
 						"type": "boolean",
 						"const": true,
@@ -17470,7 +17457,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "start-agent-signup",
-		"description": "Starts an agent-native signup session. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+		"description": "Starts an agent-native signup session. The API creates a pending\nsignup session, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "startAgentSignup",
@@ -17486,12 +17473,6 @@ const operationManifest = [
 					"format": "email",
 					"maxLength": 254
 				},
-				"signup_code": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 128,
-					"description": "Optional signup code. Omit if you do not have one."
-				},
 				"terms_accepted": {
 					"type": "boolean",
 					"const": true,
@@ -17626,7 +17607,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "verify-agent-signup",
-		"description": "Verifies the email code for an agent signup session and creates\nthe account when needed. When the session was started with a\n`signup_code`, the reserved code is redeemed; sessions started\nwithout a code skip the redemption step. An org-scoped OAuth\nsession for CLI authentication is minted and the raw tokens are\nreturned exactly once. For existing users, the optional `org_id`\nselects which accessible workspace should receive the new\nsession (no signup-code redemption is performed for existing\nusers regardless of how the session was started).\n",
+		"description": "Verifies the email code for an agent signup session and creates\nthe account when needed. An org-scoped OAuth session for CLI\nauthentication is minted and the raw tokens are returned exactly\nonce. For existing users, the optional `org_id` selects which\naccessible workspace should receive the new session.\n",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "verifyAgentSignup",
@@ -19817,7 +19798,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "start-cli-signup",
-		"description": "Starts a terminal-native CLI signup. `signup_code` is optional;\nomit it to sign up without one. The API creates a pending signup\nsession, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
+		"description": "Starts a terminal-native CLI signup. The API creates a pending\nsignup session, sends an email verification code, and returns an opaque\nsignup token used by the resend and verify steps. This endpoint\ndoes not require an API key.\n",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "startCliSignup",
@@ -19833,12 +19814,6 @@ const operationManifest = [
 					"format": "email",
 					"maxLength": 254
 				},
-				"signup_code": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 128,
-					"description": "Optional signup code. Omit if you do not have one."
-				},
 				"terms_accepted": {
 					"type": "boolean",
 					"const": true,
@@ -19899,7 +19874,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": true,
 		"command": "verify-cli-signup",
-		"description": "Verifies the email code for a CLI signup session and creates the\naccount. When the session was started with a `signup_code`, the\nreserved code is redeemed; sessions started without a code skip\nthe redemption step. Either way an org-scoped OAuth CLI session\nis created and the token set is returned exactly once. This\nendpoint does not require an API key.\n",
+		"description": "Verifies the email code for a CLI signup session and creates the\naccount. An org-scoped OAuth CLI session is created and the\ntoken set is returned exactly once. This endpoint does not\nrequire an API key.\n",
 		"hasJsonBody": true,
 		"method": "POST",
 		"operationId": "verifyCliSignup",
@@ -35277,9 +35252,25 @@ function readCursor(path) {
 	} catch {}
 	return null;
 }
-/** Setup challenges and presence probes come from the control address. */
-function isControlMail(email, identity) {
-	return email.presence_control !== void 0 || email.sender.trim().toLowerCase() === identity.ownerAddress.trim().toLowerCase();
+/**
+* Mail the CLI handles itself: a presence probe whose authenticated
+* projection marks it as control mail (verified, or pending while its proof
+* settles; a rejected one is ordinary mail), and the exact setup challenge
+* this profile's setup recorded. Nothing is judged by sender or subject: the
+* owner can write from the control address, and that email is listed like
+* any other.
+*/
+function isControlMail(email, setupChallengeId) {
+	return presenceDisposition(email) !== "ordinary" || setupChallengeId !== null && email.id === setupChallengeId;
+}
+/** The setup challenge's email ID saved by this profile's setup, if any. */
+function savedSetupChallengeId(directory) {
+	try {
+		const id = readMailJson(join(directory, "setup.json"))?.challenge?.id;
+		return typeof id === "string" && id.length > 0 ? id : null;
+	} catch {
+		return null;
+	}
 }
 async function checkAgentMail(options) {
 	const { identity } = options;
@@ -35288,9 +35279,14 @@ async function checkAgentMail(options) {
 	const release = acquireListenLock(directory, "mail-check");
 	const readCommand = (id) => `PRIMITIVE_AGENT_PROFILE=${identity.profileName} ${options.invocation ?? "primitive"} emails get --id ${id} --brief`;
 	const to = identity.agentAddress.toLowerCase();
+	const ownerMember = (options.ownerMemberAddress ?? (() => refreshOwnerMemberAddressPeriodically({
+		configDir: options.configDir,
+		profileName: identity.profileName
+	})))().catch(() => identity.ownerMemberAddress ?? null);
 	try {
 		const path = join(directory, CURSOR_FILE);
 		const saved = readCursor(path);
+		const setupChallenge = savedSetupChallengeId(directory);
 		let cursor = saved;
 		const emails = [];
 		let controlSkipped = 0;
@@ -35310,7 +35306,7 @@ async function checkAgentMail(options) {
 			});
 			if (result.error || !result.data) throw new MailCheckApiError(result.error);
 			const rows = result.data.data ?? [];
-			for (const row of rows) if (isControlMail(row, identity)) controlSkipped++;
+			for (const row of rows) if (isControlMail(row, setupChallenge)) controlSkipped++;
 			else emails.push({
 				id: row.id,
 				received_at: row.received_at,
@@ -35329,6 +35325,7 @@ async function checkAgentMail(options) {
 			emails,
 			more,
 			control_skipped: controlSkipped,
+			owner_member_address: await ownerMember,
 			profile: identity.profileName,
 			to,
 			read_command: readCommand("<id>")
@@ -35353,9 +35350,9 @@ var AgentCheckMailCommand = class AgentCheckMailCommand extends Command {
 	static summary = "Check a connected agent's mail since its last check";
 	static description = `Print the mail that reached the selected connected agent profile since its previous check, oldest first, once, without waiting. This is how an agent connected with poll receiving (no local session ID or hooks, so nothing can wake it) receives mail: run it at the start of each turn and after sending, then read each email with its \`read_command\`, which selects this profile: an email is readable only under the profile that received it.
 
-Acknowledgements marked fyi and mail in muted threads are left out. Setup and presence mail from the connection's control address is handled by the CLI and only counted. The position is saved privately with the profile and moves forward only after mail was read, so mail is reported again rather than lost when a check fails or is interrupted; deduplicate by email ID. The first check starts before the address's first email. \`more: true\` means more new mail remains: handle these and check again.
+Acknowledgements marked fyi and mail in muted threads are left out. Presence probes and this profile's setup challenge are handled by the CLI and only counted in \`control_skipped\`; any other email from the connection's control address, such as one the owner wrote from it, is listed like any other email. The position is saved privately with the profile and moves forward only after mail was read, so mail is reported again rather than lost when a check fails or is interrupted; deduplicate by email ID. The first check starts before the address's first email. \`more: true\` means more new mail remains: handle these and check again.
 
-Requires a connected agent profile selected with ${AGENT_PROFILE_ENV}. Output is one JSON document: \`outcome\` ("mail" | "empty"), \`emails\` (id, received_at, sender, thread_id, to, and the read_command that reads that email under this profile; never subject or body), \`more\`, \`control_skipped\`, \`profile\`, \`to\` (the address this profile receives for) and \`read_command\` (the template with <id>).`;
+Requires a connected agent profile selected with ${AGENT_PROFILE_ENV}. Output is one JSON document: \`outcome\` ("mail" | "empty"), \`emails\` (id, received_at, sender, thread_id, to, and the read_command that reads that email under this profile; never subject or body), \`more\`, \`control_skipped\`, \`owner_member_address\` (the owner's personal address, where reports and questions go, or null when none is known; refreshed from the server every few minutes), \`profile\`, \`to\` (the address this profile receives for) and \`read_command\` (the template with <id>).`;
 	static examples = [`${AGENT_PROFILE_ENV}=connection-0123456789ab <%= config.bin %> agent check-mail --json`];
 	static flags = { json: Flags.boolean({ description: "Print JSON (already the default)" }) };
 	async run() {
@@ -35514,7 +35511,7 @@ function invocation$1(entry) {
 	return entry && /[\\/]_npx[\\/]/.test(entry) ? "npx -y primitive@latest" : "primitive";
 }
 var AgentConnectCommand = class AgentConnectCommand extends Command {
-	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, or with PRIMITIVE_AGENT_PROFILE set, to inspect saved identity and local receiver health offline; it exits 1 when the profile is not configured.`;
+	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, or with PRIMITIVE_AGENT_PROFILE set, to inspect saved identity and local receiver health offline; it exits 1 when the profile is not configured.`;
 	static summary = "Connect and verify an agent address";
 	static examples = [
 		"<%= config.bin %> agent connect --session \"$CODEX_THREAD_ID\" --name Research --info \"Reviews pull requests\" --json < private-invitation.txt",
@@ -35577,6 +35574,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 	async run() {
 		const { flags } = await this.parse(AgentConnectCommand);
 		let pollProfile;
+		let replaced = [];
 		try {
 			if (flags.status) {
 				const profileName = flags.profile ?? (process.env["PRIMITIVE_AGENT_PROFILE"]?.trim() || void 0);
@@ -35608,7 +35606,6 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 				invitationText ??= await readAgentInvitation(process.stdin, process.stdin.isTTY);
 				return invitationText;
 			};
-			let replaced = [];
 			let replaceExisting;
 			const guardSession = flags.resume ? null : flags.session !== void 0 ? session?.toLowerCase() ?? null : guardedSession(void 0);
 			if (guardSession && !flags["keep-existing"]) {
@@ -35684,8 +35681,10 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 				else {
 					this.log(`Agent ${output.address}: verification ${output.verification.state}; receiving ${output.receiving.state}; skill ${output.skill.state}.`);
 					this.log(`Select it with ${output.selectProfile}.`);
+					for (const warning of output.warnings) this.log(warning.message);
 					if (output.ownerNotifications === "silenced") this.log("Owner notifications remain silenced by the existing preference or policy.");
 					if (external && verificationReplySubmitted(output.verification.state)) this.log(output.externalHook === "installed_unverified" ? "External receive hook installed. Idle wake still needs a live mail check." : "External receive hook is unavailable. Pairing may complete, but this session will not wake automatically.");
+					if (poll && "fallbackDetail" in output.receiving) this.log(String(output.receiving.fallbackDetail));
 					if (poll && "checkCommand" in output.receiving) this.log(`Nothing wakes this session for new mail. Check it at the start of each turn and after sending with: ${output.receiving.checkCommand}`);
 					if (output.status !== "connected") this.log(`Resume: ${output.resumeCommand}`);
 				}
@@ -35705,16 +35704,23 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 				configDir: this.config.configDir,
 				onlyIfUnknown: claimed.status === "claimed"
 			});
+			const warnings = connectWarnings(this.config.configDir, result.identity.profileName);
 			if (flags.json) this.log(JSON.stringify(replaced.length ? {
 				...result,
+				warnings,
 				replacedExisting: replaced
-			} : result));
+			} : {
+				...result,
+				warnings
+			}));
 			else {
 				this.log(result.status === "claimed" ? "Agent profile saved. Email readiness is not yet verified." : "Agent profile already configured; no claim was sent.");
 				this.log(`Select it with PRIMITIVE_AGENT_PROFILE=${result.identity.profileName}.`);
 				this.log(result.ownerReportGuidance);
+				for (const warning of warnings) this.log(warning.message);
 			}
-		} catch (error) {
+		} catch (caught) {
+			const error = refusalAfterReplacement(caught, replaced);
 			throw new Errors.CLIError(error instanceof AgentConnectionSetupError ? error.message : flags.session?.trim() ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${flags.profile ?? defaultAgentProfileName(flags.session.trim())} --session ${flags.session.trim()}${flags.receiver ? ` --receiver ${flags.receiver}` : ""} --resume --json. Do not manually resend verification or reclaim the invitation.` : pollProfile ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${pollProfile} --receiver poll --resume --json. Do not manually resend verification or reclaim the invitation.` : "Agent setup did not complete. Preserve the private profile and request a fresh owner invitation if a claim may have been submitted.", { exit: 1 });
 		}
 	}
@@ -36000,6 +36006,7 @@ var AgentEnrollCommand = class AgentEnrollCommand extends Command {
 				agentAddress: result.identity.agentAddress,
 				sessionId: flags.session
 			}) : null;
+			const warnings = connectWarnings(this.config.configDir, result.identity.profileName);
 			const output = result.receiving.state === "poll" ? {
 				...result,
 				receiving: {
@@ -36007,10 +36014,20 @@ var AgentEnrollCommand = class AgentEnrollCommand extends Command {
 					mode: "poll",
 					checkCommand: pollCheckCommand(invocation(process.argv[1]), result.identity.profileName)
 				},
-				externalHook
+				externalHook,
+				warnings
+			} : flags.receiver === "external" && result.connection.status !== "owner_inactive" ? {
+				...result,
+				receiving: {
+					...result.receiving,
+					state: externalReceivingState(externalHook)
+				},
+				externalHook,
+				warnings
 			} : {
 				...result,
-				externalHook
+				externalHook,
+				warnings
 			};
 			const identity = identitySuggestions({
 				invocation: invocation(process.argv[1]),
@@ -36028,8 +36045,9 @@ var AgentEnrollCommand = class AgentEnrollCommand extends Command {
 			};
 			if (flags.json) this.log(JSON.stringify(printed));
 			else {
-				this.log(`Agent ${result.identity.agentAddress}: pairing ${result.connection.status}; verification ${result.verification.state}; receiving ${result.receiving.state}.`);
+				this.log(`Agent ${result.identity.agentAddress}: pairing ${result.connection.status}; verification ${result.verification.state}; receiving ${output.receiving.state}.`);
 				this.log(`Select it with PRIMITIVE_AGENT_PROFILE=${result.identity.profileName}.`);
+				for (const warning of warnings) this.log(warning.message);
 				if (flags["contact-requests"]) this.log(`Contact requests: ${result.contactRequestPolicy}.`);
 				if (result.contactRequestPolicy === "owner_disabled") this.log("The owner disabled contact requests for this address. Review the policy in the app if you want them enabled.");
 				if (result.contactRequestPolicy === "unavailable") this.log("Contact-request policy could not be confirmed. Receiving can still be configured; rerun this exact enrollment after policy access is restored.");
@@ -36654,6 +36672,66 @@ var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Comm
 	}
 };
 //#endregion
+//#region src/oclif/commands/agent-status.ts
+/**
+* Picks the profile `agent status` reads: an explicit --profile, then
+* PRIMITIVE_AGENT_PROFILE, then the one address connected for this runtime
+* session. Null when none applies or the session has several addresses.
+*/
+function statusProfile(params) {
+	const env = params.env ?? process.env;
+	const chosen = params.profile ?? (env["PRIMITIVE_AGENT_PROFILE"]?.trim() || void 0);
+	if (chosen) return { profile: chosen };
+	const session = guardedSession(void 0, env);
+	if (!session) return {
+		profile: null,
+		bound: []
+	};
+	const { others } = inspectSessionAddresses({
+		configDir: params.configDir,
+		session
+	});
+	const only = others.length === 1 ? others[0] : void 0;
+	return only ? { profile: only.profile } : {
+		profile: null,
+		bound: others.map((row) => row.profile)
+	};
+}
+/** A hidden alias of `agent connect --status`, for the command agents guess. */
+var AgentStatusCommand = class AgentStatusCommand extends Command {
+	static hidden = true;
+	static summary = "Show this agent's saved connection (agent connect --status)";
+	static description = `Same as \`agent connect --status\`: read the saved identity and local receiver health offline. The profile is --profile, else ${AGENT_PROFILE_ENV}, else the one address connected for this runtime session.`;
+	static flags = {
+		profile: Flags.string({ description: "Local agent profile name" }),
+		json: Flags.boolean({ description: "Print the status as JSON" })
+	};
+	async run() {
+		const { flags } = await this.parse(AgentStatusCommand);
+		const picked = statusProfile({
+			configDir: this.config.configDir,
+			profile: flags.profile
+		});
+		if (picked.profile === null) {
+			const detail = picked.bound.length > 1 ? `This session has several connected profiles (${picked.bound.join(", ")}). Pass --profile <name>.` : `No Primitive address is connected for this session. Pass --profile <name> or set ${AGENT_PROFILE_ENV} to inspect a saved profile.`;
+			this.log(flags.json ? JSON.stringify({
+				status: "not_configured",
+				profileName: null,
+				...picked.bound.length > 1 ? { profiles: picked.bound } : {},
+				detail
+			}) : detail);
+			process.exitCode = 1;
+			return;
+		}
+		await AgentConnectCommand.run([
+			"--status",
+			"--profile",
+			picked.profile,
+			...flags.json ? ["--json"] : []
+		], this.config);
+	}
+};
+//#endregion
 //#region src/oclif/commands/agent-upgrade.ts
 /**
 * Interactive upgrade of an emailless agent account to a full developer
@@ -41530,7 +41608,7 @@ async function buildEmailBrief(input) {
 				connected_agent_verified: detail.sender_connected_agent_verified === true
 			},
 			thread_id: threadId,
-			in_thread: sentInThread(thread, self) ?? null,
+			in_thread: sentInThread(thread, self, input.isOwnSignal) ?? null,
 			...alsoAddressed(otherParticipants(detail, self)),
 			attachments: briefAttachments(detail, { hideInteractionPart: interaction?.hint === "card" || interaction?.hint === "status" }),
 			newer: thread?.newerInboundCount === void 0 ? null : {
@@ -41639,6 +41717,7 @@ async function runBrief(command, flags) {
 			client: apiClient.client,
 			detail,
 			connected,
+			isOwnSignal: (sentId) => isSentSignal(command.config.configDir, sentId),
 			signal: AbortSignal.timeout(3e4)
 		});
 		command.log(flags.json ? JSON.stringify(brief, null, 2) : renderEmailBrief(brief));
@@ -43341,8 +43420,8 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	name: "Primitive Team",
 	url: "https://primitive.dev"
 };
-const SDK_VERSION_RANGE = "^1.34.0";
-const CLI_VERSION_RANGE = "^1.47.0";
+const SDK_VERSION_RANGE = "^1.35.0";
+const CLI_VERSION_RANGE = "^1.49.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -46873,6 +46952,7 @@ async function runSharedNotificationListen(options) {
 						contact: !authorization?.contactRequest
 					}),
 					localInThread: false,
+					isOwnSignal: (sentId) => isSentSignal(options.configDir, sentId),
 					signal: nextSignal
 				});
 			} catch {
@@ -47588,6 +47668,10 @@ async function createWakeMail(options) {
 	});
 	const identity = auth.connectedAgent;
 	const recipient = identity?.agentAddress;
+	if (identity) refreshOwnerMemberAddressPeriodically({
+		configDir: options.configDir,
+		profileName: identity.profileName
+	});
 	const policy = recipient ? apiContactPolicy(apiClient.client, recipient, options.contactRequests) : void 0;
 	const notices = identity && options.contactRequests ? openContactRequestNotices(options.configDir, identity) : void 0;
 	const activatedAt = notices ? Date.parse(notices.activate()) : 0;
@@ -47824,6 +47908,7 @@ async function createWakeMail(options) {
 					contact: admission.kind === "allowed"
 				}),
 				localInThread: Boolean(requested || followed),
+				isOwnSignal: (sentId) => isSentSignal(options.configDir, sentId),
 				signal
 			});
 			if (!await recordNotice(detail, {
@@ -48969,8 +49054,7 @@ const DEFAULT_SIGNUP_COMMAND_COPY = {
 	actionGerund: "creating a new account",
 	confirmCommand: (email) => `signup confirm ${email} <code>`,
 	resendCommand: (email) => `signup resend ${email}`,
-	startCommand: (email) => `signup ${email}`,
-	codeRequired: false
+	startCommand: (email) => `signup ${email}`
 };
 function cliError$2(message) {
 	return new Errors.CLIError(message, { exit: 1 });
@@ -49252,16 +49336,12 @@ async function startSignup(params) {
 	}
 	if (params.flags.force) deletePendingAgentSignup(params.configDir);
 	const confirmTermsFn = params.deps.confirmTerms ?? confirmTerms;
-	const promptRequiredFn = params.deps.promptRequired ?? promptRequired;
 	const startFn = params.deps.startAgentSignup ?? startAgentSignup;
-	const rawSignupCode = params.flags["signup-code"];
-	const signupCode = (rawSignupCode && rawSignupCode.trim().length > 0 ? rawSignupCode : void 0) ?? (copy.codeRequired ? await promptRequiredFn("Signup code: ") : void 0);
 	if (!params.flags["accept-terms"]) await confirmTermsFn();
 	const started = await startFn({
 		body: {
 			device_name: params.flags["device-name"] ?? hostname(),
 			email: params.email,
-			...signupCode ? { signup_code: signupCode } : {},
 			terms_accepted: true
 		},
 		client: params.apiClient.client,
@@ -49489,10 +49569,6 @@ function commonStartFlags() {
 		force: Flags.boolean({
 			char: "f",
 			description: "Replace saved credentials or pending signup state when needed"
-		}),
-		"signup-code": Flags.string({
-			description: "Optional signup code. Omit if you do not have one.",
-			env: "PRIMITIVE_SIGNUP_CODE"
 		})
 	};
 }
@@ -49506,7 +49582,6 @@ var SignupCommand = class SignupCommand extends Command {
 	static examples = [
 		"<%= config.bin %> signup user@example.com",
 		"<%= config.bin %> signup user@example.com --accept-terms",
-		"<%= config.bin %> signup user@example.com --signup-code invite-code --accept-terms",
 		"<%= config.bin %> signup confirm user@example.com 123456"
 	];
 	static flags = commonStartFlags();
@@ -49883,7 +49958,7 @@ function shellQuote(value) {
 }
 const MANAGED_SUFFIX = /\bagent session-register --runtime codex --hook\s*$/;
 function codexHookCommand(cli) {
-	return `${shellQuote(cli.node)} ${shellQuote(cli.entry)} agent session-register --runtime codex --hook`;
+	return `${shellQuote(cli.runtimeNode)} ${shellQuote(cli.entry)} agent session-register --runtime codex --hook`;
 }
 /** A SessionStart hook this CLI installed, from any CLI path or version. */
 function isManaged(hook) {
@@ -50109,6 +50184,10 @@ function repairCodexHook(settings, cli) {
 		changed
 	};
 }
+/** Whether Codex hooks.json carries the SessionStart hook, from any CLI path. */
+function hasCodexSessionHook(settings) {
+	return managedPositions(settings).length > 0;
+}
 function writeCodexHooks(params) {
 	const original = params.read.state === "present" ? params.read.text : null;
 	const indent = original === null ? 2 : jsonIndentation(original);
@@ -50347,6 +50426,29 @@ async function ownerConnectionStatuses(credentials, fetchImpl) {
 	}
 	return partial();
 }
+/** Whether any saved agent profile still holds a credential. */
+function connectedProfileSaved(configDir) {
+	let names;
+	try {
+		names = readdirSync(join(agentProfilesDirectory(configDir), "profiles"));
+	} catch {
+		return false;
+	}
+	return names.some((name) => {
+		try {
+			agentProfileName(name);
+			return loadConnectedAgentProfile(configDir, name) !== null;
+		} catch {
+			return false;
+		}
+	});
+}
+/**
+* Why a machine-wide check does not apply: agents on this machine were
+* connected one session at a time with `agent connect`, and no member login
+* (which machine-wide session registration needs) is saved.
+*/
+const PER_CONNECTION_SKIP = "Not set up: agents on this machine were connected one session at a time with `primitive agent connect`, which does not need it. To register every session on this machine automatically, sign in with `primitive login`, then run `primitive machine doctor --fix`.";
 function check(id, status, detail, extra = {}) {
 	return {
 		id,
@@ -50371,9 +50473,21 @@ async function runMachineDoctor(options) {
 	const selected = (runtime) => !options.runtimes || options.runtimes.has(runtime);
 	const present = Object.fromEntries(MACHINE_RUNTIMES.map((runtime) => [runtime, runtimePresent(runtime, paths, env)]));
 	const skipRuntime = (runtime) => !selected(runtime) ? "Not selected with --runtime." : !present[runtime] ? `${runtime === "claude" ? "Claude Code" : runtime === "codex" ? "Codex" : "omp"} was not found on this machine.` : null;
-	const cli = currentCliLocation(options.cliEntry, env, options.execPath);
+	const cli = currentCliLocation(options.cliEntry, env, options.execPath, {
+		configDir: options.configDir,
+		platform: options.platform
+	});
 	const ephemeral = cli ? ephemeralCliReason(cli.entry) : null;
-	const hookBlocked = !cli ? "This CLI's hook scripts were not found next to it." : ephemeral ? `This CLI runs from ${ephemeral}, which can be deleted; install it with \`npm install -g primitive\` before repairing hooks.` : null;
+	const ephemeralBlocked = ephemeral ? `This CLI runs from ${ephemeral}, which can be deleted; install it with \`npm install -g primitive\` before repairing hooks.` : null;
+	const hookBlocked = !cli ? "This CLI's hook scripts were not found next to it." : cli.launcher ? null : ephemeralBlocked;
+	const codexBlocked = !cli ? "This CLI's hook scripts were not found next to it." : ephemeralBlocked;
+	const perConnection = !(() => {
+		try {
+			return loadCliCredentials(options.configDir) !== null;
+		} catch {
+			return true;
+		}
+	})() && connectedProfileSaved(options.configDir);
 	const skillEnv = {
 		...env,
 		CLAUDE_CONFIG_DIR: paths.claudeDir,
@@ -50400,6 +50514,7 @@ async function runMachineDoctor(options) {
 				path: target,
 				action: "edit_file"
 			});
+			if (perConnection && (read.state === "absent" || inspectManagedBlock(read.text, body).state === "missing")) return check(id, "skip", PER_CONNECTION_SKIP, { path: target });
 			if (read.state === "absent") return check(id, "fail", `${target} does not exist yet.`, {
 				path: target,
 				fixable: true
@@ -50444,6 +50559,7 @@ async function runMachineDoctor(options) {
 			} catch {
 				info = null;
 			}
+			if (!info && perConnection) return check(id, "skip", PER_CONNECTION_SKIP, { path: target });
 			if (!info) return check(id, "fail", `Not installed at ${target}.`, {
 				path: target,
 				fixable: true
@@ -50502,12 +50618,20 @@ async function runMachineDoctor(options) {
 		},
 		restoreProfiles: options.profiles
 	};
+	const launcherMissing = () => !!cli?.launcher && settingsRead.ok && !existsSync(cli.launcher.path) && JSON.stringify(settingsRead.settings).includes(JSON.stringify(cli.launcher.path));
 	const hookCheck = (id) => ({
 		inspect: () => {
 			const skip = skipRuntime("claude");
 			if (skip) return check(id, "skip", skip);
 			if (!settingsRead.ok) return check(id, "fail", "Claude settings.json is invalid; repair it first.", { path: join(paths.claudeDir, "settings.json") });
-			const finding = inspectClaudeHooks(settingsRead.settings, hookContext)[id];
+			if (perConnection && id !== "claude.hook.stop" && !hasMachineSessionHooks(settingsRead.settings)) return check(id, "skip", PER_CONNECTION_SKIP, { path: join(paths.claudeDir, "settings.json") });
+			const inspected = inspectClaudeHooks(settingsRead.settings, hookContext)[id];
+			const finding = inspected.status === "fail" && launcherMissing() ? {
+				...inspected,
+				detail: `${inspected.detail} The hook launcher ${cli?.launcher?.path} is missing; a repair writes it again.`
+			} : inspected;
+			const launcherWarning = id === "claude.hook.stop" && cli?.launcher ? readHookLauncherWarning(options.configDir) : null;
+			if (launcherWarning && finding.status === "ok") return check(id, "warn", `${finding.detail} The last hook run reported: ${launcherWarning}`, { path: join(paths.claudeDir, "settings.json") });
 			return check(id, finding.status, finding.detail, {
 				fixable: finding.fixable,
 				path: join(paths.claudeDir, "settings.json"),
@@ -50522,9 +50646,17 @@ async function runMachineDoctor(options) {
 		repair: () => {
 			if (!settingsRead.ok) return false;
 			const findings = inspectClaudeHooks(settingsRead.settings, hookContext);
-			const ids = HOOK_CHECK_IDS.filter((hook) => (hook === id || !options.only || options.only.has(hook)) && findings[hook].status === "fail" && findings[hook].fixable);
+			const machineHooksSkipped = perConnection && !hasMachineSessionHooks(settingsRead.settings);
+			const ids = HOOK_CHECK_IDS.filter((hook) => (hook === "claude.hook.stop" || !machineHooksSkipped) && (hook === id || !options.only || options.only.has(hook)) && findings[hook].status === "fail" && findings[hook].fixable);
 			const repaired = repairClaudeHooks(settingsRead.settings, hookContext, new Set(ids), { profiles: options.profiles });
-			if (!repaired.changed.size) return false;
+			const restoreLauncher = launcherMissing();
+			if (!repaired.changed.size && !restoreLauncher) return false;
+			if (cli && hookBlocked === null) try {
+				ensureHookLauncher(cli);
+			} catch {
+				throw new MachineFileError(`The hook launcher ${cli.launcher?.path ?? ""} could not be written.`);
+			}
+			if (!repaired.changed.size) return id === "claude.hook.stop";
 			writeClaudeSettings({
 				claudeDir: paths.claudeDir,
 				read: settingsRead.read,
@@ -50547,17 +50679,21 @@ async function runMachineDoctor(options) {
 				path: read.path,
 				action: "edit_file"
 			});
+			if (perConnection && !hasCodexSessionHook(read.settings)) return check(id, "skip", PER_CONNECTION_SKIP, { path: read.path });
 			const configToml = readManagedFile(join(paths.codexHome, "config.toml"));
-			const finding = inspectCodexHook(read, hookContext, configToml.state === "present" ? configToml.text : null);
+			const finding = inspectCodexHook(read, {
+				cli,
+				blocked: codexBlocked
+			}, configToml.state === "present" ? configToml.text : null);
 			return check(id, finding.status, finding.detail, {
 				fixable: finding.fixable,
 				path: read.path,
-				...finding.status === "fail" && !finding.fixable && hookBlocked ? { action: "install_cli" } : {}
+				...finding.status === "fail" && !finding.fixable && codexBlocked ? { action: "install_cli" } : {}
 			});
 		},
 		repair: () => {
 			const read = readCodexHooks(paths.codexHome);
-			if (!read.ok || !cli || hookBlocked) return false;
+			if (!read.ok || !cli || codexBlocked) return false;
 			const repaired = repairCodexHook(read.settings, cli);
 			if (!repaired.changed) return false;
 			writeCodexHooks({
@@ -50670,10 +50806,18 @@ async function runMachineDoctor(options) {
 		} },
 		"cli.path_stable": { inspect: () => {
 			if (!cli) return check("cli.path_stable", "fail", "The running CLI's files could not be located.", { action: "install_cli" });
-			if (ephemeral) return check("cli.path_stable", "fail", `This CLI runs from ${ephemeral}; hooks pointing at it would break. Install it globally with \`npm install -g primitive\`.`, {
+			if (ephemeral && !cli.launcher) return check("cli.path_stable", "fail", `This CLI runs from ${ephemeral}; hooks pointing at it would break. Install it globally with \`npm install -g primitive\`.`, {
 				action: "install_cli",
 				path: cli.entry
 			});
+			if (ephemeral) {
+				const launcherNote = `This CLI runs from ${ephemeral}. Claude Code hooks run through ${cli.launcher?.path}, which uses the \`primitive\` on PATH or fetches this version again with npx if the cache is removed.`;
+				const codexRead = readCodexHooks(paths.codexHome);
+				return selected("codex") && present.codex && !(perConnection && codexRead.ok && !hasCodexSessionHook(codexRead.settings)) ? check("cli.path_stable", "warn", `${launcherNote} The Codex SessionStart hook names the CLI directly; install it globally with \`npm install -g primitive\` so that hook keeps working.`, {
+					action: "install_cli",
+					path: cli.entry
+				}) : check("cli.path_stable", "ok", launcherNote, { path: cli.entry });
+			}
 			const onPath = findOnPath("primitive", env);
 			if (onPath && !samePath(onPath, cli.entry)) return check("cli.path_stable", "warn", `\`primitive\` on PATH is ${onPath}, but this run is ${cli.entry}; hooks follow the copy that runs the doctor.`, { path: cli.entry });
 			return check("cli.path_stable", "ok", `Hooks use ${cli.node} and ${cli.entry}.`, { path: cli.entry });
@@ -50685,7 +50829,7 @@ async function runMachineDoctor(options) {
 			} catch {
 				return check("auth.member_login", "fail", "The saved login file is unreadable. Sign in again.", { action: "login" });
 			}
-			if (!saved) return check("auth.member_login", "fail", "No saved member login on this machine.", { action: "login" });
+			if (!saved) return perConnection ? check("auth.member_login", "skip", "No member login is saved. Agents on this machine were connected with `primitive agent connect` and use their own saved credentials; sign in with `primitive login` only to register every session on this machine automatically.") : check("auth.member_login", "fail", "No saved member login on this machine.", { action: "login" });
 			let credentials;
 			try {
 				credentials = await refreshStoredCliCredentials({
@@ -50839,7 +50983,7 @@ function renderCheck(check) {
 }
 var MachineDoctorCommand = class MachineDoctorCommand extends Command {
 	static summary = "Check, and optionally repair, this machine's Primitive setup for coding agents";
-	static description = "Checks everything that lets Claude Code, Codex and omp sessions on this machine register with Primitive and answer mail: the CLI install and version, the saved member login, Claude settings and Primitive's SessionStart, SessionEnd and per-session receive hooks, the managed instruction block in each runtime's global instructions file, the bundled primitive-connect skill, and saved agent profiles disconnected in Primitive. Each check reports ok, warn, fail or skip, whether it can be repaired automatically, and an action (login, install_cli, update_cli, edit_file) when only a person can fix it. --fix repairs what it safely can: it only adds, rewrites or removes Primitive-owned hooks, blocks and skill copies, backs up any existing file beside it as <file>.primitive-bak-<timestamp> before changing it, writes atomically, and changes nothing when nothing drifted, so it is safe to run on a timer. Malformed or hand-edited files it cannot parse are reported and left unchanged. Exits 0 when every check is ok or skipped, 1 otherwise.";
+	static description = "Checks everything that lets Claude Code, Codex and omp sessions on this machine register with Primitive and answer mail: the CLI install and version, the saved member login, Claude settings and Primitive's SessionStart, SessionEnd and per-session receive hooks, the managed instruction block in each runtime's global instructions file, the bundled primitive-connect skill, and saved agent profiles disconnected in Primitive. Each check reports ok, warn, fail or skip, whether it can be repaired automatically, and an action (login, install_cli, update_cli, edit_file) when only a person can fix it. --fix repairs what it safely can: it only adds, rewrites or removes Primitive-owned hooks, blocks and skill copies, backs up any existing file beside it as <file>.primitive-bak-<timestamp> before changing it, writes atomically, and changes nothing when nothing drifted, so it is safe to run on a timer. Malformed or hand-edited files it cannot parse are reported and left unchanged. On a machine whose agents were all connected with `agent connect` and that has no saved member login, machine-wide setup it does not use (the member login, SessionStart and SessionEnd hooks, instruction blocks, skills) is reported as skip, and --fix does not add it. Exits 0 when every check is ok or skipped, 1 otherwise.";
 	static examples = [
 		"<%= config.bin %> machine doctor",
 		"<%= config.bin %> machine doctor --json",
@@ -55823,40 +55967,35 @@ const SIGNIN_OTP_COPY = {
 	actionGerund: "signing in",
 	confirmCommand: (email) => `signin otp confirm ${email} <code>`,
 	resendCommand: (email) => `signin otp resend ${email}`,
-	startCommand: (email) => `signin otp ${email}`,
-	codeRequired: true
+	startCommand: (email) => `signin otp ${email}`
 };
 const SIGNIN_EMAIL_COPY = {
 	actionNoun: "sign-in",
 	actionGerund: "signing in",
 	confirmCommand: (email) => `signin confirm ${email} <code>`,
 	resendCommand: (email) => `signin resend ${email}`,
-	startCommand: (email) => `signin ${email}`,
-	codeRequired: true
+	startCommand: (email) => `signin ${email}`
 };
 const LOGIN_EMAIL_COPY = {
 	actionNoun: "login",
 	actionGerund: "logging in",
 	confirmCommand: (email) => `login confirm ${email} <code>`,
 	resendCommand: (email) => `login resend ${email}`,
-	startCommand: (email) => `login ${email}`,
-	codeRequired: true
+	startCommand: (email) => `login ${email}`
 };
 const LOGIN_OTP_COPY = {
 	actionNoun: "login",
 	actionGerund: "logging in",
 	confirmCommand: (email) => `login otp confirm ${email} <code>`,
 	resendCommand: (email) => `login otp resend ${email}`,
-	startCommand: (email) => `login otp ${email}`,
-	codeRequired: true
+	startCommand: (email) => `login otp ${email}`
 };
 const OTP_COPY = {
 	actionNoun: "email-code auth",
 	actionGerund: "authenticating",
 	confirmCommand: (email) => `otp confirm ${email} <code>`,
 	resendCommand: (email) => `otp resend ${email}`,
-	startCommand: (email) => `otp ${email}`,
-	codeRequired: true
+	startCommand: (email) => `otp ${email}`
 };
 function acquireCredentialsLock(configDir) {
 	try {
@@ -55877,10 +56016,6 @@ function commonOtpStartFlags() {
 		force: Flags.boolean({
 			char: "f",
 			description: "Replace saved credentials or pending email-code auth state when needed"
-		}),
-		"signup-code": Flags.string({
-			description: "Signup code required to start email-code sign-in",
-			env: "PRIMITIVE_SIGNUP_CODE"
 		})
 	};
 }
@@ -55891,15 +56026,15 @@ var SigninCommand = class extends LoginCommand$1 {
 	}) };
 	static description = `Sign in or log in to an existing Primitive account and save an org-scoped OAuth session locally.
 
-Run \`primitive signin <email> --signup-code <code> --accept-terms\` for email-code sign-in, then \`primitive signin confirm <email> <code>\`. Run \`primitive signin\` with no email to use browser approval; \`primitive signin browser\` is the explicit browser form. \`primitive login\` supports the same flows with login-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form. For new account creation, use \`primitive signup <email>\`.`;
+Run \`primitive signin <email> --accept-terms\` for email-code sign-in, then \`primitive signin confirm <email> <code>\`. Run \`primitive signin\` with no email to use browser approval; \`primitive signin browser\` is the explicit browser form. \`primitive login\` supports the same flows with login-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form. For new account creation, use \`primitive signup <email>\`.`;
 	static summary = "Sign in to an existing account";
 	static examples = [
 		"<%= config.bin %> signin",
 		"<%= config.bin %> signin browser",
 		"<%= config.bin %> signin --no-browser",
-		"<%= config.bin %> signin user@example.com --signup-code invite-code --accept-terms",
+		"<%= config.bin %> signin user@example.com --accept-terms",
 		"<%= config.bin %> signin confirm user@example.com 123456",
-		"<%= config.bin %> signin otp user@example.com --signup-code invite-code --accept-terms",
+		"<%= config.bin %> signin otp user@example.com --accept-terms",
 		"<%= config.bin %> signin otp confirm user@example.com 123456"
 	];
 	static flags = {
@@ -55914,7 +56049,7 @@ Run \`primitive signin <email> --signup-code <code> --accept-terms\` for email-c
 		const commandClass = this.constructor;
 		const { args, flags } = await this.parse(commandClass);
 		if (!args.email) {
-			if (flags["signup-code"] || flags["accept-terms"]) throw cliError(`Email-code auth needs an email address. Run \`primitive ${this.emailCodeCopy().startCommand("<email>")} --signup-code <code> --accept-terms\`.`);
+			if (flags["accept-terms"]) throw cliError(`Email-code auth needs an email address. Run \`primitive ${this.emailCodeCopy().startCommand("<email>")} --accept-terms\`.`);
 			await this.runBrowserLogin(flags, this.retryCommand());
 			return;
 		}
@@ -55941,15 +56076,15 @@ var LoginCommand = class extends SigninCommand {
 	static args = SigninCommand.args;
 	static description = `Log in or sign in to an existing Primitive account and save an org-scoped OAuth session locally.
 
-Run \`primitive login <email> --signup-code <code> --accept-terms\` for email-code login, then \`primitive login confirm <email> <code>\`. Run \`primitive login\` with no email to use browser approval; \`primitive login browser\` is the explicit browser form. \`primitive signin\` supports the same flows with signin-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form. For new account creation, use \`primitive signup <email>\`.`;
+Run \`primitive login <email> --accept-terms\` for email-code login, then \`primitive login confirm <email> <code>\`. Run \`primitive login\` with no email to use browser approval; \`primitive login browser\` is the explicit browser form. \`primitive signin\` supports the same flows with signin-shaped commands. \`primitive otp <email>\` is the shortest email-code auth form. For new account creation, use \`primitive signup <email>\`.`;
 	static summary = "Log in to an existing account";
 	static examples = [
 		"<%= config.bin %> login",
 		"<%= config.bin %> login browser",
 		"<%= config.bin %> login --no-browser",
-		"<%= config.bin %> login user@example.com --signup-code invite-code --accept-terms",
+		"<%= config.bin %> login user@example.com --accept-terms",
 		"<%= config.bin %> login confirm user@example.com 123456",
-		"<%= config.bin %> login otp user@example.com --signup-code invite-code --accept-terms",
+		"<%= config.bin %> login otp user@example.com --accept-terms",
 		"<%= config.bin %> login otp confirm user@example.com 123456"
 	];
 	static flags = SigninCommand.flags;
@@ -55991,9 +56126,9 @@ var SigninOtpCommand = class extends Command {
 		description: "Email address to sign in with",
 		required: false
 	}) };
-	static description = "Start email-code sign-in using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally. Requires a signup code.";
+	static description = "Start email-code sign-in using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally.";
 	static summary = "Start OTP sign-in";
-	static examples = ["<%= config.bin %> signin otp user@example.com --signup-code invite-code --accept-terms", "<%= config.bin %> signin otp confirm user@example.com 123456"];
+	static examples = ["<%= config.bin %> signin otp user@example.com --accept-terms", "<%= config.bin %> signin otp confirm user@example.com 123456"];
 	static flags = commonOtpStartFlags();
 	async run() {
 		const commandClass = this.constructor;
@@ -56016,9 +56151,9 @@ var SigninOtpCommand = class extends Command {
 };
 var LoginOtpCommand = class extends SigninOtpCommand {
 	static args = SigninOtpCommand.args;
-	static description = "Start email-code login using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally. Requires a signup code.";
+	static description = "Start email-code login using Primitive's signup/auth OTP flow, send a verification code, and save the pending token locally.";
 	static summary = "Start OTP login";
-	static examples = ["<%= config.bin %> login otp user@example.com --signup-code invite-code --accept-terms", "<%= config.bin %> login otp confirm user@example.com 123456"];
+	static examples = ["<%= config.bin %> login otp user@example.com --accept-terms", "<%= config.bin %> login otp confirm user@example.com 123456"];
 	static flags = SigninOtpCommand.flags;
 	emailCodeCopy() {
 		return LOGIN_OTP_COPY;
@@ -56026,9 +56161,9 @@ var LoginOtpCommand = class extends SigninOtpCommand {
 };
 var OtpCommand = class extends SigninOtpCommand {
 	static args = SigninOtpCommand.args;
-	static description = "Start email-code authentication, send a verification code, and save the pending token locally. Requires a signup code.";
+	static description = "Start email-code authentication, send a verification code, and save the pending token locally.";
 	static summary = "Start email-code auth";
-	static examples = ["<%= config.bin %> otp user@example.com --signup-code invite-code --accept-terms", "<%= config.bin %> otp confirm user@example.com 123456"];
+	static examples = ["<%= config.bin %> otp user@example.com --accept-terms", "<%= config.bin %> otp confirm user@example.com 123456"];
 	static flags = SigninOtpCommand.flags;
 	emailCodeCopy() {
 		return OTP_COPY;
@@ -57478,6 +57613,7 @@ const COMMANDS = {
 	completion: CompletionCommand,
 	"agent:upgrade": AgentUpgradeCommand,
 	"agent:connect": AgentConnectCommand,
+	"agent:status": AgentStatusCommand,
 	"agent:check-mail": AgentCheckMailCommand,
 	"agent:disconnect": AgentDisconnectCommand,
 	"agent:enroll": AgentEnrollCommand,