primcli 1.63.0 → 1.64.0

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { a as REPEAT_IDLE_MAX_MINUTES, d as parseRepeatTick, f as preparePresenceAliveEmail, g as isEmailReceivedEvent, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as parseWebhookEvent, y as parseFromHeader } from "../repeats-x4QM2yoG-DTpqXyRo.js";
+import { a as REPEAT_IDLE_MAX_MINUTES, b as parseWebhookEvent, d as parseRepeatTick, f as preparePresenceAliveEmail, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as isEmailReceivedEvent, x as parseFromHeader } from "../repeats-BL7ZC-_6-Dzangtkf.js";
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DMszFbGn.js";
-import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-CDjvGDQS.js";
+import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-C3XihKH7.js";
 import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-7JzG7GNX.js";
-import { $ as describeSessionHookItem, A as evaluateContactPolicy, B as agentInvitationHash, C as RECEIVER_MODES, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as ContactsApiError, G as saveConnectionName, H as readAgentInvitation, I as contactAddress, J as recordHookMailCheck, K as savedReceiver, L as contactAgentAddress, M as AddressNotesApiError, N as addressNoteTarget, O as NetworkAdmissionPendingError, P as runAddressNotesRequest, Q as describeSessionHookChange, R as runContactRequest, S as runAgentConnect, T as verificationReplySubmitted, U as receiverStatusCommand, V as connectAgent, W as refusalAfterReplacement, X as claudeConfigDir, Y as boundSessionProfiles, Z as currentCliLocation, _ as disconnectAgent, _t as withOwnerMemberAddress, a as endSession, at as readClaudeSettings, b as invitationProfileName, c as pendingSessionDisconnects, ct as writeClaudeSettings, d as registerSession, dt as jsonIndentation, et as ensureHookLauncher, f as retryPendingDisconnects, ft as readManagedFile, g as AgentDisconnectError, gt as refreshOwnerMemberAddressPeriodically, h as enrollmentResumes, ht as readHookLauncherWarning, i as connectedProfilesForSession, it as inspectClaudeHooks, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as MachineFileError, m as enrollAgent, mt as writeManagedFile, n as OMP_MAIN, nt as findOnPath, o as headlessClaudeRun, ot as repairClaudeHooks, p as runDetached, pt as upsertManagedBlock, q as installClaudeWakeHook, r as agentConnectionState, rt as hasMachineSessionHooks, st as samePath, t as MACHINE_RUNTIMES, tt as ephemeralCliReason, u as readClaudeHookInput, ut as inspectManagedBlock, v as connectWarnings, w as externalReceivingState, x as pollCheckCommand, y as defaultAgentProfileName, z as agentConnectionStatus } from "../machine-session-NjXIXTRX.js";
-import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-BvkUTggT.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-Bzcs3VBe.js";
+import { $ as boundSessionProfiles, A as AgentDisconnectError, B as runContactRequest, C as verificationReplySubmitted, D as createNotificationContactPolicy, E as NetworkAdmissionPendingError, F as addressNoteTarget, G as receiverStatusCommand, H as agentInvitationHash, I as runAddressNotesRequest, J as savedReceiver, K as refusalAfterReplacement, L as ContactsApiError, M as clearRevokedAddresses, N as disconnectAgent, O as evaluateContactPolicy, P as AddressNotesApiError, Q as recordHookMailCheck, R as contactAddress, S as externalReceivingState, T as NETWORK_ADMISSION_PENDING_RETRY_MS, U as connectAgent, V as agentConnectionStatus, W as readAgentInvitation, X as releaseRegistrationsForProfile, Y as MACHINE_RUNTIMES, Z as installClaudeWakeHook, _ as defaultAgentProfileName, _t as upsertManagedBlock, a as endSession, at as ephemeralCliReason, b as runAgentConnect, bt as refreshOwnerMemberAddressPeriodically, c as pendingSessionDisconnects, ct as inspectClaudeHooks, d as registerSession, dt as samePath, et as claudeConfigDir, f as retryPendingDisconnects, ft as writeClaudeSettings, g as connectWarnings, gt as readManagedFile, h as enrollmentResumes, ht as jsonIndentation, i as connectedProfilesForSession, it as ensureHookLauncher, j as claimOverRevokedSetup, k as canonicalContactSelector, l as psProcessInfo, lt as readClaudeSettings, m as enrollAgent, mt as inspectManagedBlock, n as OMP_MAIN, nt as describeSessionHookChange, o as headlessClaudeRun, ot as findOnPath, p as runDetached, pt as MachineFileError, q as saveConnectionName, r as agentConnectionState, rt as describeSessionHookItem, st as hasMachineSessionHooks, t as HOOK_END_GRACE_MS, tt as currentCliLocation, u as readClaudeHookInput, ut as repairClaudeHooks, v as invitationProfileName, vt as writeManagedFile, w as ContactPolicyReadRetryError, x as RECEIVER_MODES, xt as withOwnerMemberAddress, y as pollCheckCommand, yt as readHookLauncherWarning, z as contactAgentAddress } from "../machine-session-B3JznlvO.js";
+import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-BW041zEY.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-50rw5Sh-.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-CgNIftzG.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
 import { t as guardJsonOutputCommands } from "../json-output-CEskSQJi.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -2409,7 +2409,7 @@ const openapiDocument = {
 		"/webhooks/deliveries": { "get": {
 			"operationId": "listDeliveries",
 			"summary": "List webhook deliveries",
-			"description": "Returns a paginated list of webhook delivery attempts. Each delivery\nincludes a nested `email` object with sender, recipient, and subject.\n",
+			"description": "Returns a paginated list of webhook delivery attempts, newest first.\nA delivery of an inbound email includes a nested `email` object with\nsender, recipient, and subject. A delivery of an opt-in\n`sent_email.*` event has `email_id` and `email` set to null and\n`sent_email_id` set to the send it is about. Filter by `event_type`\nand `sent_email_id` to find the deliveries of one send.\n",
 			"tags": ["Webhook Deliveries"],
 			"parameters": [
 				{ "$ref": "#/components/parameters/Cursor" },
@@ -2423,6 +2423,25 @@ const openapiDocument = {
 					},
 					"description": "Filter by email ID"
 				},
+				{
+					"name": "event_type",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 200
+					},
+					"description": "Only deliveries of this event type, for example `sent_email.failed`. Deliveries recorded before event types existed have none and never match."
+				},
+				{
+					"name": "sent_email_id",
+					"in": "query",
+					"schema": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"description": "Only deliveries of `sent_email.*` events about this sent email."
+				},
 				{
 					"name": "status",
 					"in": "query",
@@ -2432,7 +2451,8 @@ const openapiDocument = {
 							"pending",
 							"delivered",
 							"header_confirmed",
-							"failed"
+							"failed",
+							"skipped_by_rules"
 						]
 					},
 					"description": "Filter by delivery status"
@@ -2478,14 +2498,14 @@ const openapiDocument = {
 				"required": true,
 				"schema": {
 					"type": "string",
-					"pattern": "^\\d+$"
+					"pattern": "^(\\d+|[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$"
 				},
-				"description": "Delivery ID (numeric)"
+				"description": "Delivery ID, as `id` in the deliveries list: a numeric string or a UUID."
 			}],
 			"post": {
 				"operationId": "replayDelivery",
 				"summary": "Replay a webhook delivery",
-				"description": "Re-sends the stored webhook payload from a previous delivery attempt.\nIf the original endpoint is still active, it is targeted. If the\noriginal endpoint was deleted, the oldest active endpoint is used.\nDeactivated endpoints cannot be replayed to. Rate limited per-org,\nsharing an org-wide budget with email replays.\n",
+				"description": "Re-sends a previous delivery to its original endpoint. If that\nendpoint was deleted or deactivated, the replay is rejected.\nSupports inbound email deliveries and `sent_email.*` deliveries.\nAn inbound email delivery is replayed with its original stored\npayload and event id. A `sent_email.*` delivery is replayed with the\nsame event id but a payload rebuilt from the send as it is now; it\nis rejected if the send was deleted or the endpoint is no longer an\nactive http endpoint. Rate limited per-org, sharing an org-wide\nbudget with email replays.\n",
 				"tags": ["Webhook Deliveries"],
 				"responses": {
 					"200": {
@@ -12806,6 +12826,11 @@ const openapiDocument = {
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -14337,7 +14362,8 @@ const openapiDocument = {
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					},
 					"created_at": {
@@ -14460,7 +14486,8 @@ const openapiDocument = {
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					},
 					"is_route_target": {
@@ -14498,7 +14525,8 @@ const openapiDocument = {
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					}
 				},
@@ -15182,11 +15210,21 @@ const openapiDocument = {
 				"properties": {
 					"id": {
 						"type": "string",
-						"description": "Delivery ID (numeric string)"
+						"description": "Delivery ID: a numeric string or a UUID. Pass it to the replay operation as is."
 					},
 					"email_id": {
-						"type": "string",
-						"format": "uuid"
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The inbound email this delivery is about. Null for deliveries that are not about a received email, such as `sent_email.*` events."
+					},
+					"event_type": {
+						"type": ["string", "null"],
+						"description": "The delivered event type, for example `email.received` or `sent_email.delivered`. Null for deliveries recorded before event types existed."
+					},
+					"sent_email_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The sent email a `sent_email.*` delivery is about. Null for every other delivery."
 					},
 					"org_id": {
 						"type": "string",
@@ -15196,19 +15234,27 @@ const openapiDocument = {
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": ["string", "null"],
+						"description": "The endpoint's URL. For a function-backed endpoint, an opaque `function://<id>` identifier rather than a callable URL."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
 							"pending",
 							"delivered",
 							"header_confirmed",
-							"failed"
+							"failed",
+							"skipped_by_rules"
 						]
 					},
 					"attempt_count": { "type": "integer" },
 					"duration_ms": { "type": ["integer", "null"] },
 					"last_error": { "type": ["string", "null"] },
+					"last_error_code": {
+						"type": ["string", "null"],
+						"description": "A stable code for the last failure, for example `http_500`."
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -15221,10 +15267,11 @@ const openapiDocument = {
 						"type": ["object", "null"],
 						"properties": {
 							"sender": { "type": "string" },
-							"recipient": { "type": "string" },
+							"recipient": { "type": ["string", "null"] },
 							"subject": { "type": ["string", "null"] }
 						},
-						"required": ["sender", "recipient"]
+						"required": ["sender", "recipient"],
+						"description": "Null for deliveries that are not about a received email."
 					}
 				},
 				"required": [
@@ -24736,7 +24783,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				},
 				"is_route_target": {
@@ -24808,7 +24856,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				},
 				"created_at": {
@@ -24988,7 +25037,8 @@ const operationManifest = [
 							"items": {
 								"type": "string",
 								"minLength": 1
-							}
+							},
+							"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 						} }
 					},
 					"created_at": {
@@ -25394,7 +25444,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				}
 			},
@@ -25458,7 +25509,8 @@ const operationManifest = [
 						"items": {
 							"type": "string",
 							"minLength": 1
-						}
+						},
+						"description": "Event types this endpoint subscribes to, matched by exact string. Omitted means every event type except the opt-in `sent_email.*` events (`sent_email.accepted`, `sent_email.delivered`, `sent_email.failed`, `sent_email.completed`), which an endpoint receives only when it lists them, and only for sends made after it first listed one. An endpoint that lists `sent_email.*` events and also handles inbound mail must keep its inbound event types (such as `email.received`) in the list. An empty array is rejected; omit the field instead."
 					} }
 				},
 				"created_at": {
@@ -31368,6 +31420,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -32103,6 +32160,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -32603,6 +32665,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -33122,6 +33189,11 @@ const operationManifest = [
 						"type": "string",
 						"description": "Bare email address parsed from `to_header`."
 					},
+					"recipient_count": {
+						"type": ["integer", "null"],
+						"minimum": 0,
+						"description": "Every recipient of the send, To, Cc and Bcc together, each address counted once: the size of `to_addresses`, `cc` and `bcc` combined without duplicates. On a mail relay send `bcc` lists every hidden recipient. Null when the request uses an address-bound agent connection key whose address is not the sender, because the count would reveal Bcc recipients. The `sent_email` object of the `sent_email.*` webhook events carries the same field."
+					},
 					"subject": { "type": "string" },
 					"body_size_bytes": {
 						"type": "integer",
@@ -35340,7 +35412,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-deliveries",
-		"description": "Returns a paginated list of webhook delivery attempts. Each delivery\nincludes a nested `email` object with sender, recipient, and subject.\n",
+		"description": "Returns a paginated list of webhook delivery attempts, newest first.\nA delivery of an inbound email includes a nested `email` object with\nsender, recipient, and subject. A delivery of an opt-in\n`sent_email.*` event has `email_id` and `email` set to null and\n`sent_email_id` set to the send it is about. Filter by `event_type`\nand `sent_email_id` to find the deliveries of one send.\n",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listDeliveries",
@@ -35371,13 +35443,28 @@ const operationManifest = [
 				"required": false,
 				"type": "string"
 			},
+			{
+				"description": "Only deliveries of this event type, for example `sent_email.failed`. Deliveries recorded before event types existed have none and never match.",
+				"enum": null,
+				"name": "event_type",
+				"required": false,
+				"type": "string"
+			},
+			{
+				"description": "Only deliveries of `sent_email.*` events about this sent email.",
+				"enum": null,
+				"name": "sent_email_id",
+				"required": false,
+				"type": "string"
+			},
 			{
 				"description": "Filter by delivery status",
 				"enum": [
 					"pending",
 					"delivered",
 					"header_confirmed",
-					"failed"
+					"failed",
+					"skipped_by_rules"
 				],
 				"name": "status",
 				"required": false,
@@ -35406,11 +35493,21 @@ const operationManifest = [
 				"properties": {
 					"id": {
 						"type": "string",
-						"description": "Delivery ID (numeric string)"
+						"description": "Delivery ID: a numeric string or a UUID. Pass it to the replay operation as is."
 					},
 					"email_id": {
-						"type": "string",
-						"format": "uuid"
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The inbound email this delivery is about. Null for deliveries that are not about a received email, such as `sent_email.*` events."
+					},
+					"event_type": {
+						"type": ["string", "null"],
+						"description": "The delivered event type, for example `email.received` or `sent_email.delivered`. Null for deliveries recorded before event types existed."
+					},
+					"sent_email_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The sent email a `sent_email.*` delivery is about. Null for every other delivery."
 					},
 					"org_id": {
 						"type": "string",
@@ -35420,19 +35517,27 @@ const operationManifest = [
 						"type": "string",
 						"format": "uuid"
 					},
-					"endpoint_url": { "type": "string" },
+					"endpoint_url": {
+						"type": ["string", "null"],
+						"description": "The endpoint's URL. For a function-backed endpoint, an opaque `function://<id>` identifier rather than a callable URL."
+					},
 					"status": {
 						"type": "string",
 						"enum": [
 							"pending",
 							"delivered",
 							"header_confirmed",
-							"failed"
+							"failed",
+							"skipped_by_rules"
 						]
 					},
 					"attempt_count": { "type": "integer" },
 					"duration_ms": { "type": ["integer", "null"] },
 					"last_error": { "type": ["string", "null"] },
+					"last_error_code": {
+						"type": ["string", "null"],
+						"description": "A stable code for the last failure, for example `http_500`."
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -35445,10 +35550,11 @@ const operationManifest = [
 						"type": ["object", "null"],
 						"properties": {
 							"sender": { "type": "string" },
-							"recipient": { "type": "string" },
+							"recipient": { "type": ["string", "null"] },
 							"subject": { "type": ["string", "null"] }
 						},
-						"required": ["sender", "recipient"]
+						"required": ["sender", "recipient"],
+						"description": "Null for deliveries that are not about a received email."
 					}
 				},
 				"required": [
@@ -35473,13 +35579,13 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "replay-delivery",
-		"description": "Re-sends the stored webhook payload from a previous delivery attempt.\nIf the original endpoint is still active, it is targeted. If the\noriginal endpoint was deleted, the oldest active endpoint is used.\nDeactivated endpoints cannot be replayed to. Rate limited per-org,\nsharing an org-wide budget with email replays.\n",
+		"description": "Re-sends a previous delivery to its original endpoint. If that\nendpoint was deleted or deactivated, the replay is rejected.\nSupports inbound email deliveries and `sent_email.*` deliveries.\nAn inbound email delivery is replayed with its original stored\npayload and event id. A `sent_email.*` delivery is replayed with the\nsame event id but a payload rebuilt from the send as it is now; it\nis rejected if the send was deleted or the endpoint is no longer an\nactive http endpoint. Rate limited per-org, sharing an org-wide\nbudget with email replays.\n",
 		"hasJsonBody": false,
 		"method": "POST",
 		"operationId": "replayDelivery",
 		"path": "/webhooks/deliveries/{id}/replay",
 		"pathParams": [{
-			"description": "Delivery ID (numeric)",
+			"description": "Delivery ID, as `id` in the deliveries list: a numeric string or a UUID.",
 			"enum": null,
 			"name": "id",
 			"required": true,
@@ -36137,6 +36243,11 @@ async function replaceSessionAddresses(params) {
 				const directory = agentProfileDirectory(params.configDir, profile);
 				archive(join(directory, "setup.json"), stamp);
 				archive(join(directory, "enrollment", "state.json"), stamp);
+				await releaseRegistrationsForProfile({
+					configDir: params.configDir,
+					profileName: profile,
+					now: params.now
+				});
 			}
 		} catch (error) {
 			const done = replaced.length ? ` Already disconnected: ${replaced.map((r) => r.address).join(", ")}.` : "";
@@ -36188,8 +36299,16 @@ function statusProfileMissingDetail(bound) {
 function invocation$1(entry) {
 	return entry && /[\\/]_npx[\\/]/.test(entry) ? "npx -y primitive@latest" : "primitive";
 }
+/**
+* Names the addresses this run cleared as already revoked, so a later
+* refusal or failure that says nothing changed is not taken literally.
+*/
+function withClearedNote(message, cleared) {
+	if (!cleared.length) return message;
+	return `${message} Before that, this run cleared ${cleared.map((row) => `${row.address} (profile ${row.profile})`).join(", ")} on this machine because Primitive confirmed ${cleared.length === 1 ? "its credential was" : "their credentials were"} already revoked; ${cleared.length === 1 ? "it stays" : "they stay"} disconnected.`;
+}
 var AgentConnectCommand = class AgentConnectCommand extends Command {
-	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
+	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
 	static summary = "Connect and verify an agent address";
 	static examples = [
 		"<%= config.bin %> agent connect --session \"$CODEX_THREAD_ID\" --name Research --info \"Reviews pull requests\" --json < private-invitation.txt",
@@ -36250,6 +36369,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 		const { flags } = await this.parse(AgentConnectCommand);
 		let pollProfile;
 		let replaced = [];
+		let cleared = [];
 		try {
 			if (flags.status) {
 				const statusSession = flags.session?.trim();
@@ -36321,10 +36441,25 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 					address: check.target.address
 				}];
 				if (bound.length > 0 && !flags["replace-existing"]) {
-					const continuation = check.target && targetContinuation(this.config.configDir, check.target.profile, claimOnly);
+					const result = await clearRevokedAddresses({
+						configDir: this.config.configDir,
+						rows: bound,
+						disconnect: disconnectAgent
+					});
+					bound = result.remaining;
+					cleared = result.cleared;
+					if (!flags.json) for (const row of cleared) this.log(`Cleared ${row.address} (profile ${row.profile}): Primitive confirmed its credential was already revoked.`);
+				}
+				if (bound.length > 0 && !flags["replace-existing"]) {
+					const continuation = check.target && bound.some((row) => row.profile === check.target?.profile) && targetContinuation(this.config.configDir, check.target.profile, claimOnly);
 					const refusal = alreadyConnected(guardSession, bound, "connect", continuation || void 0);
-					if (flags.json) this.log(JSON.stringify(refusal));
-					else this.log(refusal.detail);
+					const detail = withClearedNote(refusal.detail, cleared);
+					if (flags.json) this.log(JSON.stringify(cleared.length ? {
+						...refusal,
+						detail,
+						clearedRevoked: cleared
+					} : refusal));
+					else this.log(detail);
 					process.exitCode = 3;
 					return;
 				}
@@ -36386,10 +36521,11 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 						guidance: `${output.guidance} Next: ${nextSteps.join(" ")}`
 					} : {}
 				};
-				if (flags.json) this.log(JSON.stringify(replaced.length ? {
+				if (flags.json) this.log(JSON.stringify({
 					...suggested,
-					replacedExisting: replaced
-				} : suggested));
+					...replaced.length ? { replacedExisting: replaced } : {},
+					...cleared.length ? { clearedRevoked: cleared } : {}
+				}));
 				else {
 					this.log(`Agent ${output.address}: verification ${output.verification.state}; receiving ${output.receiving.state}; skill ${output.skill.state}.`);
 					this.log(`Select it with ${output.selectProfile}.`);
@@ -36411,25 +36547,29 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 			}
 			if (!flags.profile) throw new AgentConnectionSetupError("Pass --profile for claim-only.");
 			const invitation = await readInvitationOnce();
-			agentInvitationHash(invitation);
+			const invitationHash = agentInvitationHash(invitation);
 			await replaceExisting?.();
-			const claimed = await connectAgent({
+			const profileName = flags.profile;
+			const claimed = await claimOverRevokedSetup({
 				configDir: this.config.configDir,
-				profileName: flags.profile,
-				invitation
-			});
+				profileName,
+				invitationHash
+			}, (claimLockHeld) => connectAgent({
+				configDir: this.config.configDir,
+				profileName,
+				invitation,
+				claimLockHeld
+			}));
 			const result = await withOwnerMemberAddress(claimed, {
 				configDir: this.config.configDir,
 				onlyIfUnknown: claimed.status === "claimed"
 			});
 			const warnings = connectWarnings(this.config.configDir, result.identity.profileName);
-			if (flags.json) this.log(JSON.stringify(replaced.length ? {
+			if (flags.json) this.log(JSON.stringify({
 				...result,
 				warnings,
-				replacedExisting: replaced
-			} : {
-				...result,
-				warnings
+				...replaced.length ? { replacedExisting: replaced } : {},
+				...cleared.length ? { clearedRevoked: cleared } : {}
 			}));
 			else {
 				this.log(result.status === "claimed" ? "Agent profile saved. Email readiness is not yet verified." : "Agent profile already configured; no claim was sent.");
@@ -36439,7 +36579,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 			}
 		} catch (caught) {
 			const error = refusalAfterReplacement(caught, replaced);
-			throw new Errors.CLIError(error instanceof AgentConnectionSetupError ? error.message : flags.session?.trim() ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${flags.profile ?? defaultAgentProfileName(flags.session.trim())} --session ${flags.session.trim()}${flags.receiver ? ` --receiver ${flags.receiver}` : ""} --resume --json. Do not manually resend verification or reclaim the invitation.` : pollProfile ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${pollProfile} --receiver poll --resume --json. Do not manually resend verification or reclaim the invitation.` : "Agent setup did not complete. Preserve the private profile and request a fresh owner invitation if a claim may have been submitted.", { exit: 1 });
+			throw new Errors.CLIError(withClearedNote(error instanceof AgentConnectionSetupError ? error.message : flags.session?.trim() ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${flags.profile ?? defaultAgentProfileName(flags.session.trim())} --session ${flags.session.trim()}${flags.receiver ? ` --receiver ${flags.receiver}` : ""} --resume --json. Do not manually resend verification or reclaim the invitation.` : pollProfile ? `Setup paused. Preserve the private profile and run ${invocation$1(process.argv[1])} agent connect --profile ${pollProfile} --receiver poll --resume --json. Do not manually resend verification or reclaim the invitation.` : "Agent setup did not complete. Preserve the private profile and request a fresh owner invitation if a claim may have been submitted.", cleared), { exit: 1 });
 		}
 	}
 };
@@ -36620,7 +36760,7 @@ var AgentContactsUpdateCommand = class AgentContactsUpdateCommand extends Comman
 //#endregion
 //#region src/oclif/commands/agent-disconnect.ts
 var AgentDisconnectCommand = class AgentDisconnectCommand extends Command {
-	static description = "Disconnect exactly one saved connected-agent profile. Stop its tracked bound receiver, revoke only that address's bound credential at its pinned Primitive origin, then remove only the local credential after confirmed revocation. Mail, notes, setup evidence and notification receipts remain. This does not permanently remove the connection record; an owner or admin can do that separately.";
+	static description = "Disconnect exactly one saved connected-agent profile. Stop its tracked bound receiver, revoke only that address's bound credential at its pinned Primitive origin, then remove only the local credential after confirmed revocation. When Primitive refuses the credential as unauthorized because it was already revoked (in the app or from another machine), the same credential is checked once more and, only if that confirms it no longer authenticates, the disconnect completes and reports revocation already_revoked; a server error or network failure is never treated as confirmation. Mail, notes, setup evidence and notification receipts remain. This does not permanently remove the connection record; an owner or admin can do that separately.";
 	static summary = "Disconnect one connected agent";
 	static examples = ["<%= config.bin %> agent disconnect --profile work", "<%= config.bin %> agent disconnect --profile work --json"];
 	static flags = {
@@ -37291,7 +37431,7 @@ var AgentRuntimeGetCommand = class AgentRuntimeGetCommand extends Command {
 //#region src/oclif/commands/agent-session-end.ts
 var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 	static summary = "Disconnect the agent a session registered when it ends";
-	static description = "Disconnects the agent that `primitive agent session-register` created for this session, and removes its exact-session receive hooks. Agents connected any other way are left connected. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and disconnects in the background.";
+	static description = "Disconnects the agent that `primitive agent session-register` created for this session, and removes its exact-session receive hooks. Agents connected any other way are left connected, including an agent later connected into the same profile with `primitive agent connect`. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and disconnects in the background after a grace period: Claude reports the same end for a restart, a switch to another session and a real exit, so a start of the same session within the grace period cancels the end and keeps its agent.";
 	static examples = ["<%= config.bin %> agent session-end --runtime claude --json", "<%= config.bin %> agent session-end --runtime codex --session 11111111-1111-4111-8111-111111111111"];
 	static flags = {
 		runtime: Flags.string({
@@ -37300,6 +37440,12 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 			description: "The coding agent runtime this session runs in"
 		}),
 		session: Flags.string({ description: "Exact session UUID; defaults to the runtime's own session ID" }),
+		grace: Flags.integer({
+			min: 0,
+			max: 3600,
+			description: "Seconds to wait before disconnecting; a start of the same session meanwhile cancels the end"
+		}),
+		reason: Flags.string({ description: "The runtime's reason for the end, recorded with it" }),
 		hook: Flags.boolean({ description: "Read Claude hook JSON from stdin and disconnect in the background" }),
 		json: Flags.boolean({ description: "Print the result as JSON" }),
 		quiet: Flags.boolean({ description: "Print nothing" })
@@ -37320,6 +37466,9 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 					runtime,
 					"--session",
 					input.sessionId,
+					"--grace",
+					String(HOOK_END_GRACE_MS / 1e3),
+					...input.reason ? ["--reason", input.reason] : [],
 					"--quiet"
 				],
 				env: process.env,
@@ -37330,7 +37479,9 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 		const result = await endSession({
 			configDir: this.config.configDir,
 			runtime,
-			session: flags.session
+			session: flags.session,
+			graceMs: (flags.grace ?? 0) * 1e3,
+			reason: flags.reason ?? null
 		});
 		const { status, ...rest } = result;
 		if (flags.json) this.log(JSON.stringify({
@@ -44604,7 +44755,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^2.0.0";
-const CLI_VERSION_RANGE = "^1.63.0";
+const CLI_VERSION_RANGE = "^1.64.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and