primcli 1.67.0 → 1.69.0

package/dist/{notify-session-CeKAcPIX.js → notify-session-CVZtEboh.js}

@@ -1,5 +1,5 @@
 import { b as parseWebhookEvent, c as classifySignalContent, v as isEmailReceivedEvent, y as isTrustedSender } from "./repeats-BL7ZC-_6-BZ-MphTV.js";
-import { F as wakeReadCommand, P as skillFirstLine, Y as wakeInteractionSentence, dn as downloadEmailAttachmentPart } from "./api-command-Dh4hs7kh.js";
+import { F as wakeReadCommand, P as skillFirstLine, Y as wakeInteractionSentence, dn as downloadEmailAttachmentPart } from "./api-command-C58Oh38I.js";
 import { _ as acquireListenLock, g as ListenStateError, y as listenIdentity } from "./shared-mail-files-MwlVE90c.js";
 import { closeSync, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";

package/dist/oclif/auto-signal-worker.js

@@ -1,6 +1,6 @@
-import { A as readThreadContext, En as getSentEmail, Kt as createAuthenticatedCliApiClient } from "../api-command-Dh4hs7kh.js";
+import { A as readThreadContext, En as getSentEmail, Kt as createAuthenticatedCliApiClient } from "../api-command-C58Oh38I.js";
 import { _ as acquireListenLock } from "../shared-mail-files-MwlVE90c.js";
-import { t as sendSignal } from "../signal-command-BxafnMiU.js";
+import { t as sendSignal } from "../signal-command-Dy_oub7_.js";
 import { AUTO_SIGNAL_KIND_ENV, AUTO_WORKING_RENEW_MS, autoSignalsDisabled, clearWorkingSending, markWorkingSending, readAutoClaim, readWorkingLease, recordRenewer, stopWorkingLease, writeWorkingLease } from "./auto-signals.js";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
 import { a as REPEAT_IDLE_MAX_MINUTES, b as parseWebhookEvent, d as parseRepeatTick, f as preparePresenceAliveEmail, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as isEmailReceivedEvent, x as parseFromHeader } from "../repeats-BL7ZC-_6-BZ-MphTV.js";
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DMszFbGn.js";
-import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-Dh4hs7kh.js";
+import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-C58Oh38I.js";
 import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-CeKAcPIX.js";
-import { $ as boundSessionProfiles, A as AgentDisconnectError, B as runContactRequest, C as verificationReplySubmitted, D as createNotificationContactPolicy, E as NetworkAdmissionPendingError, F as addressNoteTarget, G as receiverStatusCommand, H as agentInvitationHash, I as runAddressNotesRequest, J as savedReceiver, K as refusalAfterReplacement, L as ContactsApiError, M as clearRevokedAddresses, N as disconnectAgent, O as evaluateContactPolicy, P as AddressNotesApiError, Q as recordHookMailCheck, R as contactAddress, S as externalReceivingState, T as NETWORK_ADMISSION_PENDING_RETRY_MS, U as connectAgent, V as agentConnectionStatus, W as readAgentInvitation, X as releaseRegistrationsForProfile, Y as MACHINE_RUNTIMES, Z as installClaudeWakeHook, _ as defaultAgentProfileName, _t as upsertManagedBlock, a as endSession, at as ephemeralCliReason, b as runAgentConnect, bt as refreshOwnerMemberAddressPeriodically, c as pendingSessionDisconnects, ct as inspectClaudeHooks, d as registerSession, dt as samePath, et as claudeConfigDir, f as retryPendingDisconnects, ft as writeClaudeSettings, g as connectWarnings, gt as readManagedFile, h as enrollmentResumes, ht as jsonIndentation, i as connectedProfilesForSession, it as ensureHookLauncher, j as claimOverRevokedSetup, k as canonicalContactSelector, l as psProcessInfo, lt as readClaudeSettings, m as enrollAgent, mt as inspectManagedBlock, n as OMP_MAIN, nt as describeSessionHookChange, o as headlessClaudeRun, ot as findOnPath, p as runDetached, pt as MachineFileError, q as saveConnectionName, r as agentConnectionState, rt as describeSessionHookItem, st as hasMachineSessionHooks, t as HOOK_END_GRACE_MS, tt as currentCliLocation, u as readClaudeHookInput, ut as repairClaudeHooks, v as invitationProfileName, vt as writeManagedFile, w as ContactPolicyReadRetryError, x as RECEIVER_MODES, xt as withOwnerMemberAddress, y as pollCheckCommand, yt as readHookLauncherWarning, z as contactAgentAddress } from "../machine-session-s6LvMvRd.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-CVZtEboh.js";
+import { $ as installClaudeWakeHook, A as evaluateContactPolicy, B as contactAddress, C as RECEIVER_MODES, Ct as withOwnerMemberAddress, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as disconnectAgent, G as connectAgent, H as runContactRequest, I as AddressNotesApiError, J as refusalAfterReplacement, K as readAgentInvitation, L as addressNoteTarget, M as AgentDisconnectError, N as claimOverRevokedSetup, O as NetworkAdmissionPendingError, P as clearRevokedAddresses, Q as releaseRegistrationsForProfile, R as runAddressNotesRequest, S as runAgentConnect, St as refreshOwnerMemberAddressPeriodically, T as verificationReplySubmitted, U as agentConnectionStatus, V as contactAgentAddress, W as agentInvitationHash, X as savedReceiver, Y as saveConnectionName, Z as MACHINE_RUNTIMES, _ as enrollmentResumes, _t as jsonIndentation, a as endSession, at as describeSessionHookItem, b as invitationProfileName, bt as writeManagedFile, c as pendingSessionDisconnects, ct as findOnPath, d as registerSession, dt as readClaudeSettings, et as recordHookMailCheck, f as retryPendingDisconnects, ft as repairClaudeHooks, g as enrollAgent, gt as inspectManagedBlock, h as staleSessionAgents, ht as MachineFileError, i as connectedProfilesForSession, it as describeSessionHookChange, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as hasMachineSessionHooks, m as runDetached, mt as writeClaudeSettings, n as OMP_MAIN, nt as claudeConfigDir, o as headlessClaudeRun, ot as ensureHookLauncher, p as revokeStaleSessionAgents, pt as samePath, q as receiverStatusCommand, r as agentConnectionState, rt as currentCliLocation, st as ephemeralCliReason, t as HOOK_END_GRACE_MS, tt as boundSessionProfiles, u as readClaudeHookInput, ut as inspectClaudeHooks, v as connectWarnings, vt as readManagedFile, w as externalReceivingState, x as pollCheckCommand, xt as readHookLauncherWarning, y as defaultAgentProfileName, yt as upsertManagedBlock, z as ContactsApiError } from "../machine-session-CKmn5bvB.js";
 import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-Dsark9hm.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-BxafnMiU.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-Dy_oub7_.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
 import { t as guardJsonOutputCommands } from "../json-output-CEskSQJi.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -36477,7 +36477,7 @@ function withClearedNote(message, cleared) {
 	return `${message} Before that, this run cleared ${cleared.map((row) => `${row.address} (profile ${row.profile})`).join(", ")} on this machine because Primitive confirmed ${cleared.length === 1 ? "its credential was" : "their credentials were"} already revoked; ${cleared.length === 1 ? "it stays" : "they stay"} disconnected.`;
 }
 var AgentConnectCommand = class AgentConnectCommand extends Command {
-	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
+	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, writes a private AGENT_RESUME note holding the command that resumes the bound session ("claude --resume <session>" or "codex resume <session>") once verified (or deletes an existing one when no resumable session is bound), and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
 	static summary = "Connect and verify an agent address";
 	static examples = [
 		"<%= config.bin %> agent connect --session \"$CODEX_THREAD_ID\" --name Research --info \"Reviews pull requests\" --json < private-invitation.txt",
@@ -36699,6 +36699,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 					this.log(`Agent ${output.address}: verification ${output.verification.state}; receiving ${output.receiving.state}; skill ${output.skill.state}.`);
 					this.log(`Select it with ${output.selectProfile}.`);
 					for (const warning of output.warnings) this.log(warning.message);
+					if (output.resumeNote === "failed") this.warn("The AGENT_RESUME note could not be updated. The connection is unaffected.");
 					if (output.ownerNotifications === "silenced") this.log("Owner notifications remain silenced by the existing preference or policy.");
 					if (external && verificationReplySubmitted(output.verification.state)) this.log(output.externalHook === "installed_unverified" ? "External receive hook installed. Idle wake still needs a live mail check." : "External receive hook is unavailable. Pairing may complete, but this session will not wake automatically.");
 					if (poll && "fallbackDetail" in output.receiving) this.log(String(output.receiving.fallbackDetail));
@@ -37599,9 +37600,13 @@ var AgentRuntimeGetCommand = class AgentRuntimeGetCommand extends Command {
 //#endregion
 //#region src/oclif/commands/agent-session-end.ts
 var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
-	static summary = "Disconnect the agent a session registered when it ends";
-	static description = "Disconnects the agent that `primitive agent session-register` created for this session, and removes its exact-session receive hooks. Agents connected any other way are left connected, including an agent later connected into the same profile with `primitive agent connect`. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and disconnects in the background after a grace period: Claude reports the same end for a restart, a switch to another session and a real exit, so a start of the same session within the grace period cancels the end and keeps its agent.";
-	static examples = ["<%= config.bin %> agent session-end --runtime claude --json", "<%= config.bin %> agent session-end --runtime codex --session 11111111-1111-4111-8111-111111111111"];
+	static summary = "Record that a registered session ended";
+	static description = "Marks this session ended and removes its exact-session receive hooks. The agent that `primitive agent session-register` created for the session stays connected, with its credential and profile, so resuming the session (for example `claude --resume`) re-verifies it and reinstalls the hooks at the same address. Its presence lapses on its own once the session stops running. An agent whose session has not started again for 30 days is disconnected by `primitive machine doctor --fix` or the next `agent session-register` on this machine. --revoke disconnects the agent now instead, first deleting its AGENT_RESUME note (reported as resumeNote; a failed deletion is a warning and never stops the disconnect). Agents connected any other way are never disconnected, including an agent later connected into the same profile with `primitive agent connect`. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and finishes in the background after a grace period: Claude reports the same end for a restart, a switch to another session and a real exit, so a start of the same session within the grace period cancels the end.";
+	static examples = [
+		"<%= config.bin %> agent session-end --runtime claude --json",
+		"<%= config.bin %> agent session-end --runtime codex --session 11111111-1111-4111-8111-111111111111",
+		"<%= config.bin %> agent session-end --runtime claude --session 11111111-1111-4111-8111-111111111111 --revoke"
+	];
 	static flags = {
 		runtime: Flags.string({
 			required: true,
@@ -37612,10 +37617,11 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 		grace: Flags.integer({
 			min: 0,
 			max: 3600,
-			description: "Seconds to wait before disconnecting; a start of the same session meanwhile cancels the end"
+			description: "Seconds to wait before the end takes effect; a start of the same session meanwhile cancels it"
 		}),
+		revoke: Flags.boolean({ description: "Disconnect the agent session-register created for this session instead of keeping it for a resume" }),
 		reason: Flags.string({ description: "The runtime's reason for the end, recorded with it" }),
-		hook: Flags.boolean({ description: "Read Claude hook JSON from stdin and disconnect in the background" }),
+		hook: Flags.boolean({ description: "Read Claude hook JSON from stdin and finish in the background" }),
 		json: Flags.boolean({ description: "Print the result as JSON" }),
 		quiet: Flags.boolean({ description: "Print nothing" })
 	};
@@ -37638,6 +37644,7 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 					"--grace",
 					String(HOOK_END_GRACE_MS / 1e3),
 					...input.reason ? ["--reason", input.reason] : [],
+					...flags.revoke ? ["--revoke"] : [],
 					"--quiet"
 				],
 				env: process.env,
@@ -37650,14 +37657,18 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 			runtime,
 			session: flags.session,
 			graceMs: (flags.grace ?? 0) * 1e3,
-			reason: flags.reason ?? null
+			reason: flags.reason ?? null,
+			revoke: flags.revoke === true
 		});
 		const { status, ...rest } = result;
 		if (flags.json) this.log(JSON.stringify({
 			status,
 			...rest
 		}));
-		else if (!flags.quiet) this.log(`${result.status}: ${result.detail}`);
+		else if (!flags.quiet) {
+			this.log(`${result.status}: ${result.detail}`);
+			if (result.resumeNote === "failed") this.warn("The AGENT_RESUME note could not be deleted before the agent was disconnected.");
+		}
 	}
 };
 //#endregion
@@ -37666,7 +37677,7 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 const HOOK_BUDGET_MS = 3e3;
 var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Command {
 	static summary = "Register this coding session with Primitive, once";
-	static description = "Gives the current Claude Code, Codex or omp session an address in your organization using the saved member login, without a browser. Safe to run on every start and resume: a session that already has a profile is only re-verified, and a session whose agent was disconnected or removed never gets a second address. The session ID comes from CLAUDE_CODE_SESSION_ID (Claude), CODEX_THREAD_ID or CODEX_SESSION_ID (Codex), or --session. omp does not expose a session ID to commands, so omp sessions use one generated ID per running omp process, and receiving mail is not supported for them. The agent is named <runtime>-<repository> and gets a private AGENT_INFO note naming the runtime and repository when it has none. Claude sessions receive mail through exact-session hooks; Codex through the native receiver. Non-interactive Claude runs (claude -p and SDK hosts, by CLAUDE_CODE_ENTRYPOINT) are skipped with status skipped_headless. Never blocks a session: every outcome, including no login or no network, exits 0 with a status. --hook reads Claude's or Codex's SessionStart hook input from stdin, returns within a few seconds and finishes slower work in the background.";
+	static description = "Gives the current Claude Code, Codex or omp session an address in your organization using the saved member login, without a browser. Safe to run on every start and resume: a session that already has a profile is only re-verified, and a session that ended and starts again (for example `claude --resume`) keeps its agent and address, and a session whose agent was disconnected or removed never gets a second address. Each run also disconnects the agents of sessions on this machine that ended more than 30 days ago without starting again, only while their profile still holds the credential this command created. The session ID comes from CLAUDE_CODE_SESSION_ID (Claude), CODEX_THREAD_ID or CODEX_SESSION_ID (Codex), or --session. omp does not expose a session ID to commands, so omp sessions use one generated ID per running omp process, and receiving mail is not supported for them. The agent is named <runtime>-<repository> and gets a private AGENT_INFO note naming the runtime and repository when it has none. A connected Claude Code or Codex session also gets a private AGENT_RESUME note holding the one-line command that resumes it (`claude --resume <session>` or `codex resume <session>`), rewritten only when it changes; a failure to write it is reported as a warning and never fails the registration. Claude sessions receive mail through exact-session hooks; Codex through the native receiver. Non-interactive Claude runs (claude -p and SDK hosts, by CLAUDE_CODE_ENTRYPOINT) are skipped with status skipped_headless. Never blocks a session: every outcome, including no login or no network, exits 0 with a status. --hook reads Claude's or Codex's SessionStart hook input from stdin, returns within a few seconds and finishes slower work in the background.";
 	static examples = [
 		"<%= config.bin %> agent session-register --runtime codex --quiet",
 		"<%= config.bin %> agent session-register --runtime claude --json",
@@ -37731,7 +37742,13 @@ var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Comm
 			...rest,
 			...identity
 		}));
-		else if (!flags.quiet) this.log(`${result.status}: ${result.detail}`);
+		else if (!flags.quiet) {
+			this.log(`${result.status}: ${result.detail}`);
+			if (result.resumeNote === "failed") this.warn("The AGENT_RESUME note could not be written. The session is registered; the next start retries it.");
+		}
+		try {
+			await revokeStaleSessionAgents(this.config.configDir, { exclude: result.session });
+		} catch {}
 	}
 };
 //#endregion
@@ -38931,11 +38948,19 @@ async function openConnectedReplyWait(options) {
 				signal: AbortSignal.timeout(2e3)
 			})).cancelRejectedSend(requestId);
 		},
-		async observed(emailId) {
+		/**
+		* The session consumed this reply. Pass the reply itself when it is at
+		* hand, so the older pending notices in its thread are cleared too.
+		*/
+		async observed(emailId, email) {
 			if (options.contactRequest && await store.observeNotifiedContactReply(emailId, requestId, waiter.token)) return;
 			await store.markWaitObserved(emailId, requestId);
 			try {
-				await clearConsumedPendingMail(options.configDir, options.sessionKey, emailId);
+				await clearConsumedPendingMail(options.configDir, options.sessionKey, emailId, email ? {
+					thread_id: email.thread_id ?? null,
+					received_at: email.received_at,
+					recipient: options.from
+				} : null);
 			} catch {}
 		},
 		finish: () => store.finishWait(requestId),
@@ -39274,7 +39299,7 @@ async function requestContact(context, options) {
 				outcome: "sent_awaiting_reply"
 			}
 		};
-		await wait.observed(accepted.id);
+		await wait.observed(accepted.id, accepted);
 		await wait.finish();
 		return {
 			exitCode: 0,
@@ -39407,7 +39432,7 @@ async function waitForContact(context, sentId, timeoutSeconds) {
 				guidance: "Still awaiting acceptance. An active session listener can notify you later. Continue independent work instead of immediately chaining another wait; resume this same request when needed, without resending."
 			}
 		};
-		await wait.observed(accepted.id);
+		await wait.observed(accepted.id, accepted);
 		await wait.finish();
 		return {
 			exitCode: 0,
@@ -41136,7 +41161,7 @@ var ChatCommand = class ChatCommand extends Command {
 						requestId: connectedWait.requestId
 					};
 					saveChatReceipt(receipt);
-					await connectedWait.observed(replyResult.reply.id);
+					await connectedWait.observed(replyResult.reply.id, replyResult.reply);
 					await connectedWait.finish();
 				}
 				progress?.succeed(`Reply received from ${replyResult.reply.from_email}`);
@@ -43076,12 +43101,15 @@ const LINKS_DESCRIPTION = "With --compact, return the target URLs of links as `l
 * Remove the email from the current profile's pending wake notices once the
 * session has read it. Never fails the read.
 */
-async function clearPendingAfterRead(configDir, emailId) {
+async function clearPendingAfterRead(configDir, emailId, known) {
 	try {
 		const profileName = resolveCliAuth({ configDir }).connectedAgent?.profileName;
 		if (!profileName) return;
 		const runtime = currentMailSessionKey();
-		await clearReadPendingMail(configDir, profileName, runtime ? runtime.slice(runtime.indexOf(":") + 1) : null, emailId);
+		await clearReadPendingMail(configDir, profileName, runtime ? runtime.slice(runtime.indexOf(":") + 1) : null, emailId, typeof known?.received_at === "string" ? {
+			thread_id: known.thread_id ?? null,
+			received_at: known.received_at
+		} : null);
 	} catch {}
 }
 const NO_SIGNAL_DESCRIPTION = "With --context, do not report working to the sender, and stop a working report an earlier read of this email started; nothing is sent. By default, reading mail from the verified owner or a same-organization member (not another agent) that a receiver surfaced to this session reports working in the background until you answer (also disabled by PRIMITIVE_NO_AUTO_SIGNALS=1).";
@@ -43150,7 +43178,7 @@ async function runBrief(command, flags) {
 			...brief,
 			working_signal: { stop_command: stop }
 		} : brief, null, 2) : `${renderEmailBrief(brief)}${stop ? `\n${workingStopLine(stop)}` : ""}`);
-		await clearPendingAfterRead(command.config.configDir, detail.id);
+		await clearPendingAfterRead(command.config.configDir, detail.id, detail);
 	});
 }
 const ROUTE_MISSING_NOTICE = "Note: this server does not offer the readable read yet, so a local compact view was printed.\n";
@@ -43180,7 +43208,7 @@ async function runCompact(command, flags) {
 		});
 		if (readable.kind === "ok") {
 			command.log(JSON.stringify(readable.data, null, 2));
-			await clearPendingAfterRead(command.config.configDir, readable.data.id);
+			await clearPendingAfterRead(command.config.configDir, readable.data.id, readable.data);
 			return;
 		}
 		if (readable.kind === "error") {
@@ -43199,7 +43227,7 @@ async function runCompact(command, flags) {
 		}
 		process.stderr.write(ROUTE_MISSING_NOTICE);
 		command.log(JSON.stringify(buildEmailCompact(detail), null, 2));
-		await clearPendingAfterRead(command.config.configDir, detail.id);
+		await clearPendingAfterRead(command.config.configDir, detail.id, detail);
 	});
 }
 /**
@@ -43585,7 +43613,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 					const email = await waiter.next();
 					if (!email) break;
 					printEmail(email);
-					await waiter.observed(email.id);
+					await waiter.observed(email.id, email);
 				}
 				if (matched >= flags.number) {
 					await waiter.finish();
@@ -44928,7 +44956,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^2.0.0";
-const CLI_VERSION_RANGE = "^1.67.0";
+const CLI_VERSION_RANGE = "^1.69.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -49199,6 +49227,13 @@ async function createWakeMail(options) {
 	let wakeContext;
 	let statusEvent;
 	let autoSignal;
+	let held;
+	function surface(wake) {
+		wakeId = wake.wakeId;
+		senderRelation = wake.senderRelation;
+		wakeContext = wake.context;
+		autoSignal = wake.autoSignal;
+	}
 	let pendingRequest;
 	const profileName = identity?.profileName;
 	const outcome = (accepted) => ({
@@ -49437,19 +49472,23 @@ async function createWakeMail(options) {
 				context
 			};
 			else {
-				wakeId = detail.id;
-				senderRelation = admission.senderRelation;
-				wakeContext = context;
-				autoSignal = profileName && autoSignalEligible(detail, {
-					agentAddress: recipient,
-					ownerAddress: identity?.ownerAddress
-				}, admission) ? {
-					emailId: detail.id,
-					profileName,
-					sender,
-					threadId: detail.thread_id ?? null,
-					replyToSentEmailId: detail.reply_to_sent_email_id ?? null
-				} : void 0;
+				const wake = {
+					wakeId: detail.id,
+					senderRelation: admission.senderRelation,
+					context,
+					autoSignal: profileName && autoSignalEligible(detail, {
+						agentAddress: recipient,
+						ownerAddress: identity?.ownerAddress
+					}, admission) ? {
+						emailId: detail.id,
+						profileName,
+						sender,
+						threadId: detail.thread_id ?? null,
+						replyToSentEmailId: detail.reply_to_sent_email_id ?? null
+					} : void 0
+				};
+				if (context.newer !== void 0 && context.newer > 0) held = wake;
+				else surface(wake);
 			}
 			return outcome(true);
 		} catch (error) {
@@ -49465,6 +49504,14 @@ async function createWakeMail(options) {
 		status: () => statusEvent,
 		autoSignal: () => wakeId === autoSignal?.emailId ? autoSignal : void 0,
 		completed: completePending,
+		/** A superseded wake this run accepted and has not surfaced. */
+		held: () => held?.wakeId,
+		/** Surface the held wake, when nothing newer arrived for it. */
+		wakeHeld: () => {
+			if (wakeId || statusEvent || !held) return;
+			surface(held);
+			held = void 0;
+		},
 		receiving: (ready) => {
 			receiving = ready;
 		},
@@ -49474,6 +49521,11 @@ async function createWakeMail(options) {
 //#endregion
 //#region src/oclif/commands/listen.ts
 const RESUME_LOCK_RETRY_MS = 4e3;
+/**
+* How long a wake listener holding a superseded wake (one whose thread has
+* newer mail) waits for that newer mail before waking for the held one.
+*/
+const HELD_WAKE_SETTLE_MS = 5e3;
 const MAIL_CHECK_RECORD_MS = 5e3;
 const RESUME_LOCK_RETRY_STEP_MS = 250;
 function isListenLockContention(error) {
@@ -49933,8 +49985,12 @@ var ListenCommand = class ListenCommand extends Command {
 			if (!target || !options.notifySession || !requestConfig) {
 				let resumeLockDeadline;
 				do {
+					const settle = wake?.held?.() ? AbortSignal.timeout(HELD_WAKE_SETTLE_MS) : void 0;
 					for (;;) try {
-						await runListen(options);
+						await runListen(settle ? {
+							...options,
+							signal: AbortSignal.any([controller.signal, settle])
+						} : options);
 						break;
 					} catch (error) {
 						if (!isListenLockContention(error) || hookEventName !== "SessionStart" || controller.signal.aborted) throw error;
@@ -49944,6 +50000,7 @@ var ListenCommand = class ListenCommand extends Command {
 						await new Promise((resolve) => setTimeout(resolve, Math.min(RESUME_LOCK_RETRY_STEP_MS, remaining)));
 					}
 					wake?.completed();
+					if (settle?.aborted && !controller.signal.aborted) wake?.wakeHeld?.();
 				} while (wake && !wake.wakeId() && !wake.status() && !controller.signal.aborted);
 			} else {
 				const notify = options.notifySession;
@@ -52406,18 +52463,31 @@ async function runMachineDoctor(options) {
 		"profiles.orphaned": {
 			inspect: async () => {
 				const result = await inspectProfiles();
-				const pending = pendingSessionDisconnects(options.configDir);
-				if (!pending.length) return result;
-				const addresses = pending.flatMap((record) => record.address ? [record.address] : []);
-				return check("profiles.orphaned", "fail", `${pending.length} ended sessions still need their agent disconnected${addresses.length ? ` (${addresses.join(", ")})` : ""}; a repair retries it.${result.status === "ok" ? "" : ` ${result.detail}`}`, { fixable: true });
+				const at = options.sessionDisconnect?.now?.() ?? now();
+				const pending = pendingSessionDisconnects(options.configDir, at);
+				const stale = staleSessionAgents(options.configDir, at);
+				if (!pending.length && !stale.length) return result;
+				const addresses = (records) => {
+					const list = records.flatMap((record) => record.address ? [record.address] : []);
+					return list.length ? ` (${list.join(", ")})` : "";
+				};
+				return check("profiles.orphaned", "fail", `${[...pending.length ? [`${pending.length} ended sessions still need their agent disconnected${addresses(pending)}; a repair retries it.`] : [], ...stale.length ? [`${stale.length} sessions ended more than 30 days ago without starting again and still hold the agent session-register created for them${addresses(stale)}; a repair disconnects it.`] : []].join(" ")}${result.status === "ok" ? "" : ` ${result.detail}`}`, { fixable: true });
 			},
 			repair: async () => {
+				const stale = await revokeStaleSessionAgents(options.configDir, {
+					env,
+					fetch: options.fetch,
+					dependencies: {
+						now,
+						...options.sessionDisconnect
+					}
+				});
 				const retried = await retryPendingDisconnects(options.configDir, {
 					env,
 					fetch: options.fetch,
 					...options.sessionDisconnect ? { dependencies: options.sessionDisconnect } : {}
 				});
-				return await moveOrphans() || retried > 0;
+				return await moveOrphans() || retried > 0 || stale > 0;
 			}
 		}
 	};
@@ -56221,6 +56291,11 @@ var ReplyCommand = class ReplyCommand extends Command {
 			const repeatLine = formatRepeatStarted(result, repeat);
 			if (repeatLine) process.stderr.write(`${repeatLine}\n`);
 			if (outcome === "not_sent") restoreAutoWorking(halted);
+			const answered = priorRepliesCheck.status === "checked" && priorRepliesCheck.detail?.id === emailId ? priorRepliesCheck.detail : null;
+			if (outcome !== "not_sent" && outcome !== "uncertain" && sessionKey && auth.connectedAgent) await clearReadPendingMail(this.config.configDir, auth.connectedAgent.profileName, sessionKey.slice(sessionKey.indexOf(":") + 1), emailId, answered ? {
+				thread_id: answered.thread_id ?? null,
+				received_at: answered.received_at
+			} : null).catch(() => void 0);
 			const exitCode = sendOutcomeExitCode(outcome);
 			if (exitCode !== 0) process.exitCode = exitCode;
 		});

package/dist/oclif/receiver-heal.js

@@ -1,6 +1,6 @@
 import { N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, j as AGENT_PROFILE_ENV } from "../cli-config-DMszFbGn.js";
 import { d as readMailJson } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, l as SESSION_UUID, t as notificationScope } from "../notify-session-CeKAcPIX.js";
+import { _ as detectAgentRuntime, l as SESSION_UUID, t as notificationScope } from "../notify-session-CVZtEboh.js";
 import { a as claimBackgroundListenRestart, n as backgroundListenRestartable, r as backgroundListenStatus } from "../listen-background--0peztKE.js";
 import { join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{signal-command-BxafnMiU.js → signal-command-Dy_oub7_.js}

@@ -1,5 +1,5 @@
 import { h as sendPreparedSignal, p as prepareSignalEmail } from "./repeats-BL7ZC-_6-BZ-MphTV.js";
-import { T as bareAddress, Vn as listSentEmails, ar as sendEmail, bt as successfulSendOutcome, en as createEndpoint, it as classifySendError, o as extractErrorPayload, vn as getEmail } from "./api-command-Dh4hs7kh.js";
+import { T as bareAddress, Vn as listSentEmails, ar as sendEmail, bt as successfulSendOutcome, en as createEndpoint, it as classifySendError, o as extractErrorPayload, vn as getEmail } from "./api-command-C58Oh38I.js";
 import { _ as acquireListenLock, b as listenProcessIdentity, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, y as listenIdentity } from "./shared-mail-files-MwlVE90c.js";
 import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply } from "./scoped-chat-Dsark9hm.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-DtKpsgg8.js";

package/dist/skills/primitive-connect/SKILL.md

@@ -158,6 +158,12 @@ line or check result names.
    are responding to, and address each message they sent since your last
    reply; never send a generic status that ignores their question. See
    [Answer the latest message](references/conversations.md#answer-the-latest-message).
+   When the message has other To or Cc recipients, add `--all` so everyone on
+   it stays on it; a plain reply goes to the sender only. Never drop
+   recipients silently: if a reply is deliberately private, say so in it.
+   Continue an existing discussion in its thread rather than with a new
+   `primitive send`; see
+   [Keep one discussion in one thread](references/conversations.md#keep-one-discussion-in-one-thread).
    Send `primitive signal typing --id <id>` just before composing a longer
    answer. If you pause on a request from anyone other than your owner (to
    ask your owner, or to wait on something else), or decide not to act on