primcli 1.68.0 → 1.69.0

package/dist/{api-command-D7DPn2Ro.js → api-command-C58Oh38I.js}

@@ -5361,7 +5361,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-7bISVcRb.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-CKmn5bvB.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)

package/dist/{machine-session-7bISVcRb.js → machine-session-CKmn5bvB.js}

@@ -1,8 +1,8 @@
 import { S as __exportAll } from "./repeats-BL7ZC-_6-BZ-MphTV.js";
 import { B as parseOwnerMemberAddress, F as agentProfilesDirectory, I as connectedAgentIdentity, L as connectedApiBaseUrl, M as AgentConnectionSetupError, N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, U as saveConnectedAgentProfile, V as profileAlreadyConnectedMessage, W as PrimitiveApiClient, j as AGENT_PROFILE_ENV, x as loadCliCredentials, z as parseConnectedAgentProfile } from "./cli-config-DMszFbGn.js";
-import { Ct as cliInvocation, Jn as putAgentContactPolicy, Jt as refreshStoredCliCredentials, Pn as listDomains, Tt as defaultConnectionName, Vn as listSentEmails, Yn as putContact, an as deleteAgentContact, ar as sendEmail, jn as listContacts, kn as listAgentContacts, mn as getContact, nr as searchEmails, on as deleteContact, pn as getAgentContactPolicy, qn as putAgentContact, vn as getEmail } from "./api-command-D7DPn2Ro.js";
+import { Ct as cliInvocation, Jn as putAgentContactPolicy, Jt as refreshStoredCliCredentials, Pn as listDomains, Tt as defaultConnectionName, Vn as listSentEmails, Yn as putContact, an as deleteAgentContact, ar as sendEmail, jn as listContacts, kn as listAgentContacts, mn as getContact, nr as searchEmails, on as deleteContact, pn as getAgentContactPolicy, qn as putAgentContact, vn as getEmail } from "./api-command-C58Oh38I.js";
 import { _ as acquireListenLock, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, o as mailObject, r as mailAddress, s as mailString } from "./shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, d as defaultSessionSocket, f as NativeSessionDisconnectedError, l as SESSION_UUID, t as notificationScope, u as connectNativeSession, v as installConnectSkill, x as readBundledConnectSkill } from "./notify-session-Cp0Kkstb.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, d as defaultSessionSocket, f as NativeSessionDisconnectedError, l as SESSION_UUID, t as notificationScope, u as connectNativeSession, v as installConnectSkill, x as readBundledConnectSkill } from "./notify-session-CVZtEboh.js";
 import { a as scopedChatSenderTrust } from "./scoped-chat-Dsark9hm.js";
 import { l as stopBackgroundListen, r as backgroundListenStatus } from "./listen-background--0peztKE.js";
 import { t as readSharedMailOwner } from "./shared-mail-watch-DtKpsgg8.js";
@@ -2507,7 +2507,7 @@ async function runAddressNotesRequest(client, request) {
 		if (request.ifAbsent) condition = { if_absent: true };
 		else if (ifVersion) condition = { if_version: ifVersion };
 		else try {
-			condition = { if_version: (await getNote(client, address, name)).version };
+			condition = { if_version: (await getNote(client, address, name, request.signal)).version };
 		} catch (error) {
 			if (!(error instanceof AddressNotesApiError) || error.status !== 404) throw error;
 			condition = { if_absent: true };
@@ -2525,10 +2525,11 @@ async function runAddressNotesRequest(client, request) {
 				...request.visibility ? { visibility: request.visibility } : {}
 			},
 			headers: { "Content-Type": "application/json" },
-			responseStyle: "fields"
+			responseStyle: "fields",
+			...request.signal ? { signal: request.signal } : {}
 		})), address, name);
 	}
-	const version = ifVersion ?? (await getNote(client, address, name)).version;
+	const version = ifVersion ?? (await getNote(client, address, name, request.signal)).version;
 	const data = await result(client.delete({
 		security,
 		url: "/address-notes/{address}/{name}",
@@ -2537,12 +2538,127 @@ async function runAddressNotesRequest(client, request) {
 			name
 		},
 		query: { if_version: version },
-		responseStyle: "fields"
+		responseStyle: "fields",
+		...request.signal ? { signal: request.signal } : {}
 	}));
 	if (!data || typeof data !== "object" || Array.isArray(data) || typeof data.deleted !== "boolean") throw new Error("The address notes API returned an invalid deletion response.");
 	return data;
 }
 //#endregion
+//#region src/oclif/agent-resume-note.ts
+/**
+* The address note holding the command that resumes the coding session an
+* agent is bound to, so an app can offer to reopen that exact session.
+*/
+const RESUME_NOTE_NAME = "AGENT_RESUME";
+/**
+* Each note request gets this long. The note is best effort and runs inside
+* registration, connect, disconnect and their hooks, so a stalled request
+* must never hold them up.
+*/
+const NOTE_REQUEST_TIMEOUT_MS = 1e4;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* The AGENT_RESUME value for a session: `claude --resume <uuid>` for Claude
+* Code or `codex resume <uuid>` for Codex, with the ID lowercased. Any other
+* runtime, or an ID that is not a UUID, has no value.
+*/
+function resumeNoteValue(runtime, sessionId) {
+	const id = sessionId?.trim().toLowerCase() ?? "";
+	if (!UUID.test(id)) return null;
+	if (runtime === "claude") return `claude --resume ${id}`;
+	if (runtime === "codex") return `codex resume ${id}`;
+	return null;
+}
+function client(profile, fetchImpl) {
+	return new PrimitiveApiClient({
+		apiKey: profile.api_key,
+		apiBaseUrl: profile.api_base_url,
+		...fetchImpl ? { fetch: fetchImpl } : {}
+	}).client;
+}
+/** The current note, or null when the address has none. */
+async function currentNote(api, address, timeoutMs) {
+	try {
+		return await runAddressNotesRequest(api, {
+			action: "get",
+			address,
+			name: RESUME_NOTE_NAME,
+			signal: AbortSignal.timeout(timeoutMs)
+		});
+	} catch (error) {
+		if (error instanceof AddressNotesApiError && error.status === 404) return null;
+		throw error;
+	}
+}
+/**
+* Write the AGENT_RESUME note for a connected profile's address. Skips the
+* write when the note already holds the same value, so a resume hook that
+* runs on every start does not rewrite it. `rewrite` writes it anyway, so a
+* new claim leaves the note no older than the connection it belongs to.
+* Never throws.
+*/
+async function publishResumeNote(options) {
+	const timeoutMs = options.timeoutMs ?? 1e4;
+	const value = resumeNoteValue(options.runtime, options.sessionId);
+	if (value === null) return "skipped";
+	try {
+		const profile = loadConnectedAgentProfile(options.configDir, options.profileName);
+		if (!profile) return "skipped";
+		const api = client(profile, options.fetch);
+		const address = profile.agent_address;
+		const current = await currentNote(api, address, timeoutMs);
+		if (current?.value === value && !options.rewrite) return "unchanged";
+		await runAddressNotesRequest(api, {
+			action: "set",
+			address,
+			name: RESUME_NOTE_NAME,
+			value,
+			visibility: "private",
+			signal: AbortSignal.timeout(timeoutMs),
+			...current?.version ? { ifVersion: current.version } : { ifAbsent: true }
+		});
+		return "written";
+	} catch {
+		return "failed";
+	}
+}
+/**
+* Delete the AGENT_RESUME note with this credential, before it is revoked.
+* Never throws.
+*/
+async function clearResumeNote(profile, fetchImpl, timeoutMs = NOTE_REQUEST_TIMEOUT_MS) {
+	try {
+		const api = client(profile, fetchImpl);
+		const current = await currentNote(api, profile.agent_address, timeoutMs);
+		if (!current) return "absent";
+		await runAddressNotesRequest(api, {
+			action: "delete",
+			address: profile.agent_address,
+			name: RESUME_NOTE_NAME,
+			signal: AbortSignal.timeout(timeoutMs),
+			...current.version ? { ifVersion: current.version } : {}
+		});
+		return "cleared";
+	} catch {
+		return "failed";
+	}
+}
+/**
+* Delete the AGENT_RESUME note of a connected profile's address, for a
+* connection that binds no resumable session, so a command left by an older
+* session never points at the wrong conversation. Never throws.
+*/
+async function clearProfileResumeNote(options) {
+	try {
+		const profile = loadConnectedAgentProfile(options.configDir, options.profileName);
+		if (!profile) return "skipped";
+		return await clearResumeNote(profile, options.fetch);
+	} catch {
+		return "failed";
+	}
+}
+//#endregion
 //#region src/oclif/agent-disconnect.ts
 var AgentDisconnectError = class extends Error {};
 /** The profile no longer holds the credential the caller expected to revoke. */
@@ -2676,6 +2792,12 @@ async function disconnectAgent(params) {
 		}) : null;
 		if (receiver && !receiverStopped(receiver)) throw new AgentDisconnectError("The bound receiver has not confirmed stopping. The connection and credential were preserved. Check listener status before retrying.");
 		const previous = confirmedLocally(directory, profile);
+		let resumeNote = "skipped";
+		if (!previous) try {
+			resumeNote = await (params.clearResumeNote ?? clearResumeNote)(profile, params.fetch);
+		} catch {
+			resumeNote = "failed";
+		}
 		const revocation = previous ? "previously_confirmed" : await revoke(profile, params.fetch);
 		if (!previous) try {
 			writeMailJson(confirmationPath(directory, profile), {
@@ -2708,7 +2830,8 @@ async function disconnectAgent(params) {
 			identity: connectedAgentIdentity(profileName, profile),
 			receiver,
 			revocation,
-			externalHook
+			externalHook,
+			resumeNote
 		};
 	} catch (error) {
 		if (error instanceof AgentDisconnectError) throw error;
@@ -2818,6 +2941,7 @@ async function clearRevokedAddresses(params) {
 				stopReceiver: params.stopReceiver,
 				now: params.now,
 				env: params.env,
+				clearResumeNote: async () => "skipped",
 				expected: {
 					address: checked.agent_address,
 					invitationHash: checked.invitation_hash
@@ -4028,6 +4152,17 @@ function defaults(options) {
 			});
 		},
 		seedAgentInfo: (profileName, value) => seedAgentInfoNote(options.configDir, profileName, value),
+		publishResumeNote: (profileName, runtime, session) => publishResumeNote({
+			configDir: options.configDir,
+			profileName,
+			runtime,
+			sessionId: session,
+			rewrite: true
+		}),
+		clearResumeNote: (profileName) => clearProfileResumeNote({
+			configDir: options.configDir,
+			profileName
+		}),
 		refreshOwnerMemberAddress: (profileName) => refreshOwnerMemberAddress({
 			configDir: options.configDir,
 			profileName
@@ -4224,6 +4359,12 @@ async function runAgentConnect(options) {
 			reason: "already_present"
 		});
 	}
+	let resumeNote = "skipped";
+	if (verified) try {
+		resumeNote = session && runtime ? await dependencies.publishResumeNote(result.identity.profileName, runtime, session) : await dependencies.clearResumeNote(result.identity.profileName);
+	} catch {
+		resumeNote = "failed";
+	}
 	const receiving = receiver === "external" ? {
 		...result.receiving,
 		state: externalReceivingState(externalHook),
@@ -4279,6 +4420,7 @@ async function runAgentConnect(options) {
 		receiving,
 		...result.ownerNotifications ? { ownerNotifications: result.ownerNotifications } : {},
 		agentInfo: agentInfoState,
+		resumeNote,
 		skipped,
 		warnings,
 		selectProfile: `PRIMITIVE_AGENT_PROFILE=${result.identity.profileName}`,
@@ -5164,7 +5306,7 @@ async function cleanUpReplacedRegistration(configDir, record, current, deps, env
 		await deps.revokeByAddress(configDir, address, fetchImpl);
 	} catch {}
 }
-async function disconnectSessionAgent(configDir, record, deps, env, fetchImpl, enrollmentSettled = false) {
+async function disconnectSessionAgent(configDir, record, deps, env, fetchImpl, enrollmentSettled = false, report = {}) {
 	try {
 		const current = loadConnectedAgentProfile(configDir, record.profile);
 		if (current) {
@@ -5174,7 +5316,7 @@ async function disconnectSessionAgent(configDir, record, deps, env, fetchImpl, e
 			};
 			if (!holdsRegisteredCredential(configDir, record, current)) return await release(current);
 			try {
-				await deps.disconnect({
+				const disconnected = await deps.disconnect({
 					configDir,
 					profileName: record.profile,
 					fetch: fetchImpl,
@@ -5184,6 +5326,7 @@ async function disconnectSessionAgent(configDir, record, deps, env, fetchImpl, e
 						invitationHash: current.invitation_hash
 					}
 				});
+				if (disconnected?.resumeNote) report.resumeNote = disconnected.resumeNote;
 			} catch (error) {
 				if (!(error instanceof AgentCredentialChangedError)) throw error;
 				const holder = loadConnectedAgentProfile(configDir, record.profile);
@@ -5203,8 +5346,8 @@ async function disconnectSessionAgent(configDir, record, deps, env, fetchImpl, e
 		return "pending";
 	}
 }
-async function finishSessionDisconnect(configDir, record, deps, env, fetchImpl, enrollmentSettled = false) {
-	const outcome = await disconnectSessionAgent(configDir, record, deps, env, fetchImpl, enrollmentSettled);
+async function finishSessionDisconnect(configDir, record, deps, env, fetchImpl, enrollmentSettled = false, report = {}) {
+	const outcome = await disconnectSessionAgent(configDir, record, deps, env, fetchImpl, enrollmentSettled, report);
 	const saved = await updateSessionRecord(configDir, record.session, (current) => {
 		if (current?.createdBy !== "session-register" || current.disconnect === "done") return current;
 		if (outcome === "released") return releasedRecord(current, "credential_changed", deps.now());
@@ -5252,6 +5395,13 @@ async function registerSession(options) {
 		installClaudeHook: installClaudeWakeHook,
 		seedAgentInfo: (configDir, profileName, value) => seedAgentInfoNote(configDir, profileName, value, options.fetch),
 		connectionState: (profile) => agentConnectionState(profile, options.fetch),
+		publishResumeNote: (configDir, profileName, runtime, sessionId) => publishResumeNote({
+			configDir,
+			profileName,
+			runtime,
+			sessionId,
+			fetch: options.fetch
+		}),
 		ompSession: ompProcessSession,
 		...DISCONNECT_DEFAULTS
 	}, options.dependencies);
@@ -5382,6 +5532,14 @@ async function registerSession(options) {
 				agentInfo: seeded
 			} : current);
 		};
+		const finishResumeNote = async () => {
+			if (runtime === "omp") return {};
+			try {
+				return { resumeNote: await deps.publishResumeNote(options.configDir, profileName, runtime, sessionId) };
+			} catch {
+				return { resumeNote: "failed" };
+			}
+		};
 		const claudeHook = (agentAddress) => {
 			const outcome = deps.installClaudeHook({
 				cliPath: options.cliPath,
@@ -5424,10 +5582,12 @@ async function registerSession(options) {
 			if (state === "connected") {
 				const hooked = installHook(existing);
 				await finishAgentInfo();
+				const resumeNote = await finishResumeNote();
 				return {
 					...withAddress,
 					receiving: RECEIVING[runtime],
 					status: "already_registered",
+					...resumeNote,
 					detail: hooked === "installed" ? "This session is already connected." : hooked === "held" ? HELD_DETAIL : "This session is already connected, but its receive hook could not be installed. Run `primitive machine doctor`."
 				};
 			}
@@ -5495,7 +5655,11 @@ async function registerSession(options) {
 		const status = result.connection.status;
 		let hooked = "installed";
 		if (runtime === "claude" && submitted && status !== "owner_inactive") hooked = claudeHook(address);
-		if (status === "connected") await finishAgentInfo();
+		let resumeNote = {};
+		if (status === "connected") {
+			await finishAgentInfo();
+			resumeNote = await finishResumeNote();
+		}
 		const withAddress = {
 			...known,
 			address,
@@ -5507,6 +5671,7 @@ async function registerSession(options) {
 			status: "registered",
 			name,
 			nameIsDefault: name === record.name,
+			...resumeNote,
 			detail: hooked === "installed" ? `Connected as ${address}.` : hooked === "held" ? `Connected as ${address}. ${HELD_DETAIL}` : `Connected as ${address}, but the receive hook could not be installed. Run \`primitive machine doctor\`.`
 		};
 		if (status === "revoked" || status === "owner_inactive") return {
@@ -5701,7 +5866,8 @@ async function endSession(options) {
 			status: "kept",
 			detail: KEPT_DETAIL
 		};
-		const outcome = await finishSessionDisconnect(options.configDir, record, deps, env, options.fetch);
+		const report = {};
+		const outcome = await finishSessionDisconnect(options.configDir, record, deps, env, options.fetch, false, report);
 		if (outcome === "released") return {
 			...known,
 			status: "left_connected",
@@ -5710,6 +5876,7 @@ async function endSession(options) {
 		return outcome === "done" ? {
 			...known,
 			status: "disconnected",
+			...report.resumeNote ? { resumeNote: report.resumeNote } : {},
 			detail: "This session's agent was disconnected."
 		} : {
 			...known,

package/dist/{notify-session-Cp0Kkstb.js → notify-session-CVZtEboh.js}

@@ -1,5 +1,5 @@
 import { b as parseWebhookEvent, c as classifySignalContent, v as isEmailReceivedEvent, y as isTrustedSender } from "./repeats-BL7ZC-_6-BZ-MphTV.js";
-import { F as wakeReadCommand, P as skillFirstLine, Y as wakeInteractionSentence, dn as downloadEmailAttachmentPart } from "./api-command-D7DPn2Ro.js";
+import { F as wakeReadCommand, P as skillFirstLine, Y as wakeInteractionSentence, dn as downloadEmailAttachmentPart } from "./api-command-C58Oh38I.js";
 import { _ as acquireListenLock, g as ListenStateError, y as listenIdentity } from "./shared-mail-files-MwlVE90c.js";
 import { closeSync, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";

package/dist/oclif/auto-signal-worker.js

@@ -1,6 +1,6 @@
-import { A as readThreadContext, En as getSentEmail, Kt as createAuthenticatedCliApiClient } from "../api-command-D7DPn2Ro.js";
+import { A as readThreadContext, En as getSentEmail, Kt as createAuthenticatedCliApiClient } from "../api-command-C58Oh38I.js";
 import { _ as acquireListenLock } from "../shared-mail-files-MwlVE90c.js";
-import { t as sendSignal } from "../signal-command-Bi2U2BR_.js";
+import { t as sendSignal } from "../signal-command-Dy_oub7_.js";
 import { AUTO_SIGNAL_KIND_ENV, AUTO_WORKING_RENEW_MS, autoSignalsDisabled, clearWorkingSending, markWorkingSending, readAutoClaim, readWorkingLease, recordRenewer, stopWorkingLease, writeWorkingLease } from "./auto-signals.js";
 import { join } from "node:path";
 import { homedir } from "node:os";

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
 import { a as REPEAT_IDLE_MAX_MINUTES, b as parseWebhookEvent, d as parseRepeatTick, f as preparePresenceAliveEmail, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as isEmailReceivedEvent, x as parseFromHeader } from "../repeats-BL7ZC-_6-BZ-MphTV.js";
 import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfilesDirectory, H as requireDefaultLoginProfile, M as AgentConnectionSetupError, N as agentProfileDirectory, O as loadActiveChatState, P as agentProfileName, R as loadConnectedAgentProfile, T as saveSignupCredentials, W as PrimitiveApiClient, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_PROFILE_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname } from "../cli-config-DMszFbGn.js";
-import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-D7DPn2Ro.js";
+import { $ as apiResultHttpStatus, $n as replyToEmail, $t as completeWebhookEvent, A as readThreadContext, An as listAgentNetworks, At as formatAlreadySentNotice, B as pendingMailPath, Bn as listRoutes, Bt as expectedAutomatedVerdicts, C as queryUsesAwaiting, Cn as getMemory, Cr as verifyAgentSignup, Ct as cliInvocation, D as displayAddress, Dn as getThread, Dt as identitySuggestions, E as describeWake, En as getSentEmail, Et as generatedAgentName, F as wakeReadCommand, Fn as listEmails, Ft as AUTOMATED_VALUES, G as interactionNextActions, Gn as pollCliLogin, H as recordPendingMail, Hn as listWakeAuthorizations, Ht as isAutomatedRejectedError, I as wakeRecipientField, In as listEndpoints, It as AutomatedFilterUnsupportedError, J as replyInteractionWarning, Jt as refreshStoredCliCredentials, K as readEmailInteraction, Kn as pullWebhookEvent, Kt as createAuthenticatedCliApiClient, L as wakeRelationship, Ln as listFunctionLogs, Lt as assertAutomatedVerdict, M as serverMuted, Mn as listDefaultNetworkAgents, Mt as withFlagSuggestion, N as serverRelationship, Nn as listDefaultNetworkMembers, Nt as AUTOMATED_FILTER_UNSUPPORTED_CODE, O as formatMailWakeLine, On as getWakeSchedule, Ot as loadSkillLine, Pn as listDomains, Pt as AUTOMATED_FLAG_DESCRIPTION, Q as SEND_OUTCOME_HELP, Qn as reorderRoutes, Qt as cliLogout, R as clearConsumedPendingMail, Rn as listFunctions, Rt as automatedRejectedError, S as isAwaitingRejectedError, Sn as getInboxStatus, Sr as verifyAgentClaim, T as bareAddress, Tn as getRepeatingSend, U as removePendingMail, Un as listWakeDispatches, Ut as queryUsesAutomated, V as readPendingMail, Vn as listSentEmails, Vt as hasAutomatedVerdict, W as interactionHumanLine, Wn as listWakeSchedules, Wt as ConnectedAgentKeyRequiredError, X as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Xn as redeemCreditCode, Xt as addDefaultNetworkMember, Yt as resolveCliApiRequestConfig, Z as MAX_SEND_WAIT_TIMEOUT_MS, Zn as removeDefaultNetworkMember, Zt as checkDefaultNetworkContactAdmission, _ as awaitingRejectedError, _n as getDefaultNetworkAgent, _r as updateFunction, _t as sendWaitClampNotice, a as extractErrorCode, ar as sendEmail, at as deriveSendIdempotencyKey, b as formatRepliesCell, bn as getFunctionRouting, br as updateWakeAuthorization, bt as successfulSendOutcome, c as readTextFileFlag, cn as deleteRoute, cr as setMemory, ct as formatDeletedEarlierSendNotice, d as writeErrorWithHints, dr as startAgentSignup, dt as formatSendFailureSummary, en as createEndpoint, er as resendAgentSignupVerification, et as assertValidIdempotencyKey, f as AWAITING_FLAG_DESCRIPTION, fn as getAccount, fr as startCliLogin, ft as formatSendRecordFailureSummary, g as assertAwaitingFilterRows, gn as getCreditBalance, gr as updateDefaultNetworkMember, gt as sendOutcomeExitCode, h as ReplyStateUnsupportedError, hn as getConversation, hr as unsetFunctionRoute, ht as sendIdentityFields, i as createOperationCommand, in as createWakeSchedule, ir as semanticSearch, it as classifySendError, j as sentInThread, jt as writeIdempotentReplayBannerIfReplay, k as latestOwnOutbound, kn as listAgentContacts, kt as currentMailSessionKey, l as runWithTiming, ln as deleteWakeAuthorization, lr as simulateRoute, lt as formatPriorRepliesCheckSkipped, m as REPLY_STATE_UNSUPPORTED_CODE, mr as testFunction, mt as reportSendCommandResult, n as API_ERROR_CODES, nn as createRoute, nr as searchEmails, nt as buildThrownSendFailureEnvelope, o as extractErrorPayload, or as setFunctionRoute, ot as excludeSignalReplies, p as AWAITING_VALUES, pn as getAgentContactPolicy, pr as stopRepeatFromEmail, pt as priorRepliesThatWentOut, q as replyExpectation, qt as createCliApiClient, r as TIME_FLAG_DESCRIPTION, rn as createWakeAuthorization, rr as searchMemories, rt as checkPriorReplies, s as formatErrorPayload, sn as deleteMemory, sr as setFunctionSecret, st as followUpCommandPrefix, t as API_BASE_URL_FLAG_DESCRIPTION, tn as createFunction, tr as runWakeSchedule, tt as buildFollowUpCommand, u as surfaceUnauthorizedHint, un as deleteWakeSchedule, ur as startAgentClaim, ut as formatPriorRepliesWarning, v as ensureSearchReportsReplyState, vn as getEmail, vr as updateRepeatingSend, vt as sentHistoryWindowStart, w as explainPendingMailNotFound, wn as getOrgRoutingTopology, wt as connectNextSteps, x as hasReplyState, xn as getFunctionTestRunTrace, xr as updateWakeSchedule, xt as thrownErrorExitCode, y as formatAwaitingCell, yn as getFunction, yr as updateRoute, yt as serializeErrorPayload, z as clearReadPendingMail, zn as listRepeatingSends, zt as ensureSearchReportsAutomated } from "../api-command-C58Oh38I.js";
 import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-Cp0Kkstb.js";
-import { $ as installClaudeWakeHook, A as evaluateContactPolicy, B as contactAddress, C as RECEIVER_MODES, Ct as withOwnerMemberAddress, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as disconnectAgent, G as connectAgent, H as runContactRequest, I as AddressNotesApiError, J as refusalAfterReplacement, K as readAgentInvitation, L as addressNoteTarget, M as AgentDisconnectError, N as claimOverRevokedSetup, O as NetworkAdmissionPendingError, P as clearRevokedAddresses, Q as releaseRegistrationsForProfile, R as runAddressNotesRequest, S as runAgentConnect, St as refreshOwnerMemberAddressPeriodically, T as verificationReplySubmitted, U as agentConnectionStatus, V as contactAgentAddress, W as agentInvitationHash, X as savedReceiver, Y as saveConnectionName, Z as MACHINE_RUNTIMES, _ as enrollmentResumes, _t as jsonIndentation, a as endSession, at as describeSessionHookItem, b as invitationProfileName, bt as writeManagedFile, c as pendingSessionDisconnects, ct as findOnPath, d as registerSession, dt as readClaudeSettings, et as recordHookMailCheck, f as retryPendingDisconnects, ft as repairClaudeHooks, g as enrollAgent, gt as inspectManagedBlock, h as staleSessionAgents, ht as MachineFileError, i as connectedProfilesForSession, it as describeSessionHookChange, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as hasMachineSessionHooks, m as runDetached, mt as writeClaudeSettings, n as OMP_MAIN, nt as claudeConfigDir, o as headlessClaudeRun, ot as ensureHookLauncher, p as revokeStaleSessionAgents, pt as samePath, q as receiverStatusCommand, r as agentConnectionState, rt as currentCliLocation, st as ephemeralCliReason, t as HOOK_END_GRACE_MS, tt as boundSessionProfiles, u as readClaudeHookInput, ut as inspectClaudeHooks, v as connectWarnings, vt as readManagedFile, w as externalReceivingState, x as pollCheckCommand, xt as readHookLauncherWarning, y as defaultAgentProfileName, yt as upsertManagedBlock, z as ContactsApiError } from "../machine-session-7bISVcRb.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-CVZtEboh.js";
+import { $ as installClaudeWakeHook, A as evaluateContactPolicy, B as contactAddress, C as RECEIVER_MODES, Ct as withOwnerMemberAddress, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as disconnectAgent, G as connectAgent, H as runContactRequest, I as AddressNotesApiError, J as refusalAfterReplacement, K as readAgentInvitation, L as addressNoteTarget, M as AgentDisconnectError, N as claimOverRevokedSetup, O as NetworkAdmissionPendingError, P as clearRevokedAddresses, Q as releaseRegistrationsForProfile, R as runAddressNotesRequest, S as runAgentConnect, St as refreshOwnerMemberAddressPeriodically, T as verificationReplySubmitted, U as agentConnectionStatus, V as contactAgentAddress, W as agentInvitationHash, X as savedReceiver, Y as saveConnectionName, Z as MACHINE_RUNTIMES, _ as enrollmentResumes, _t as jsonIndentation, a as endSession, at as describeSessionHookItem, b as invitationProfileName, bt as writeManagedFile, c as pendingSessionDisconnects, ct as findOnPath, d as registerSession, dt as readClaudeSettings, et as recordHookMailCheck, f as retryPendingDisconnects, ft as repairClaudeHooks, g as enrollAgent, gt as inspectManagedBlock, h as staleSessionAgents, ht as MachineFileError, i as connectedProfilesForSession, it as describeSessionHookChange, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as hasMachineSessionHooks, m as runDetached, mt as writeClaudeSettings, n as OMP_MAIN, nt as claudeConfigDir, o as headlessClaudeRun, ot as ensureHookLauncher, p as revokeStaleSessionAgents, pt as samePath, q as receiverStatusCommand, r as agentConnectionState, rt as currentCliLocation, st as ephemeralCliReason, t as HOOK_END_GRACE_MS, tt as boundSessionProfiles, u as readClaudeHookInput, ut as inspectClaudeHooks, v as connectWarnings, vt as readManagedFile, w as externalReceivingState, x as pollCheckCommand, xt as readHookLauncherWarning, y as defaultAgentProfileName, yt as upsertManagedBlock, z as ContactsApiError } from "../machine-session-CKmn5bvB.js";
 import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-Dsark9hm.js";
 import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-Bi2U2BR_.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-Dy_oub7_.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
 import { t as guardJsonOutputCommands } from "../json-output-CEskSQJi.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -36477,7 +36477,7 @@ function withClearedNote(message, cleared) {
 	return `${message} Before that, this run cleared ${cleared.map((row) => `${row.address} (profile ${row.profile})`).join(", ")} on this machine because Primitive confirmed ${cleared.length === 1 ? "its credential was" : "their credentials were"} already revoked; ${cleared.length === 1 ? "it stays" : "they stay"} disconnected.`;
 }
 var AgentConnectCommand = class AgentConnectCommand extends Command {
-	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
+	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, writes a private AGENT_RESUME note holding the command that resumes the bound session ("claude --resume <session>" or "codex resume <session>") once verified (or deletes an existing one when no resumable session is bound), and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
 	static summary = "Connect and verify an agent address";
 	static examples = [
 		"<%= config.bin %> agent connect --session \"$CODEX_THREAD_ID\" --name Research --info \"Reviews pull requests\" --json < private-invitation.txt",
@@ -36699,6 +36699,7 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 					this.log(`Agent ${output.address}: verification ${output.verification.state}; receiving ${output.receiving.state}; skill ${output.skill.state}.`);
 					this.log(`Select it with ${output.selectProfile}.`);
 					for (const warning of output.warnings) this.log(warning.message);
+					if (output.resumeNote === "failed") this.warn("The AGENT_RESUME note could not be updated. The connection is unaffected.");
 					if (output.ownerNotifications === "silenced") this.log("Owner notifications remain silenced by the existing preference or policy.");
 					if (external && verificationReplySubmitted(output.verification.state)) this.log(output.externalHook === "installed_unverified" ? "External receive hook installed. Idle wake still needs a live mail check." : "External receive hook is unavailable. Pairing may complete, but this session will not wake automatically.");
 					if (poll && "fallbackDetail" in output.receiving) this.log(String(output.receiving.fallbackDetail));
@@ -37600,7 +37601,7 @@ var AgentRuntimeGetCommand = class AgentRuntimeGetCommand extends Command {
 //#region src/oclif/commands/agent-session-end.ts
 var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 	static summary = "Record that a registered session ended";
-	static description = "Marks this session ended and removes its exact-session receive hooks. The agent that `primitive agent session-register` created for the session stays connected, with its credential and profile, so resuming the session (for example `claude --resume`) re-verifies it and reinstalls the hooks at the same address. Its presence lapses on its own once the session stops running. An agent whose session has not started again for 30 days is disconnected by `primitive machine doctor --fix` or the next `agent session-register` on this machine. --revoke disconnects the agent now instead. Agents connected any other way are never disconnected, including an agent later connected into the same profile with `primitive agent connect`. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and finishes in the background after a grace period: Claude reports the same end for a restart, a switch to another session and a real exit, so a start of the same session within the grace period cancels the end.";
+	static description = "Marks this session ended and removes its exact-session receive hooks. The agent that `primitive agent session-register` created for the session stays connected, with its credential and profile, so resuming the session (for example `claude --resume`) re-verifies it and reinstalls the hooks at the same address. Its presence lapses on its own once the session stops running. An agent whose session has not started again for 30 days is disconnected by `primitive machine doctor --fix` or the next `agent session-register` on this machine. --revoke disconnects the agent now instead, first deleting its AGENT_RESUME note (reported as resumeNote; a failed deletion is a warning and never stops the disconnect). Agents connected any other way are never disconnected, including an agent later connected into the same profile with `primitive agent connect`. Never blocks or fails a session: every outcome exits 0 with a status. --hook reads Claude's SessionEnd hook input from stdin and finishes in the background after a grace period: Claude reports the same end for a restart, a switch to another session and a real exit, so a start of the same session within the grace period cancels the end.";
 	static examples = [
 		"<%= config.bin %> agent session-end --runtime claude --json",
 		"<%= config.bin %> agent session-end --runtime codex --session 11111111-1111-4111-8111-111111111111",
@@ -37664,7 +37665,10 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 			status,
 			...rest
 		}));
-		else if (!flags.quiet) this.log(`${result.status}: ${result.detail}`);
+		else if (!flags.quiet) {
+			this.log(`${result.status}: ${result.detail}`);
+			if (result.resumeNote === "failed") this.warn("The AGENT_RESUME note could not be deleted before the agent was disconnected.");
+		}
 	}
 };
 //#endregion
@@ -37673,7 +37677,7 @@ var AgentSessionEndCommand = class AgentSessionEndCommand extends Command {
 const HOOK_BUDGET_MS = 3e3;
 var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Command {
 	static summary = "Register this coding session with Primitive, once";
-	static description = "Gives the current Claude Code, Codex or omp session an address in your organization using the saved member login, without a browser. Safe to run on every start and resume: a session that already has a profile is only re-verified, and a session that ended and starts again (for example `claude --resume`) keeps its agent and address, and a session whose agent was disconnected or removed never gets a second address. Each run also disconnects the agents of sessions on this machine that ended more than 30 days ago without starting again, only while their profile still holds the credential this command created. The session ID comes from CLAUDE_CODE_SESSION_ID (Claude), CODEX_THREAD_ID or CODEX_SESSION_ID (Codex), or --session. omp does not expose a session ID to commands, so omp sessions use one generated ID per running omp process, and receiving mail is not supported for them. The agent is named <runtime>-<repository> and gets a private AGENT_INFO note naming the runtime and repository when it has none. Claude sessions receive mail through exact-session hooks; Codex through the native receiver. Non-interactive Claude runs (claude -p and SDK hosts, by CLAUDE_CODE_ENTRYPOINT) are skipped with status skipped_headless. Never blocks a session: every outcome, including no login or no network, exits 0 with a status. --hook reads Claude's or Codex's SessionStart hook input from stdin, returns within a few seconds and finishes slower work in the background.";
+	static description = "Gives the current Claude Code, Codex or omp session an address in your organization using the saved member login, without a browser. Safe to run on every start and resume: a session that already has a profile is only re-verified, and a session that ended and starts again (for example `claude --resume`) keeps its agent and address, and a session whose agent was disconnected or removed never gets a second address. Each run also disconnects the agents of sessions on this machine that ended more than 30 days ago without starting again, only while their profile still holds the credential this command created. The session ID comes from CLAUDE_CODE_SESSION_ID (Claude), CODEX_THREAD_ID or CODEX_SESSION_ID (Codex), or --session. omp does not expose a session ID to commands, so omp sessions use one generated ID per running omp process, and receiving mail is not supported for them. The agent is named <runtime>-<repository> and gets a private AGENT_INFO note naming the runtime and repository when it has none. A connected Claude Code or Codex session also gets a private AGENT_RESUME note holding the one-line command that resumes it (`claude --resume <session>` or `codex resume <session>`), rewritten only when it changes; a failure to write it is reported as a warning and never fails the registration. Claude sessions receive mail through exact-session hooks; Codex through the native receiver. Non-interactive Claude runs (claude -p and SDK hosts, by CLAUDE_CODE_ENTRYPOINT) are skipped with status skipped_headless. Never blocks a session: every outcome, including no login or no network, exits 0 with a status. --hook reads Claude's or Codex's SessionStart hook input from stdin, returns within a few seconds and finishes slower work in the background.";
 	static examples = [
 		"<%= config.bin %> agent session-register --runtime codex --quiet",
 		"<%= config.bin %> agent session-register --runtime claude --json",
@@ -37738,7 +37742,10 @@ var AgentSessionRegisterCommand = class AgentSessionRegisterCommand extends Comm
 			...rest,
 			...identity
 		}));
-		else if (!flags.quiet) this.log(`${result.status}: ${result.detail}`);
+		else if (!flags.quiet) {
+			this.log(`${result.status}: ${result.detail}`);
+			if (result.resumeNote === "failed") this.warn("The AGENT_RESUME note could not be written. The session is registered; the next start retries it.");
+		}
 		try {
 			await revokeStaleSessionAgents(this.config.configDir, { exclude: result.session });
 		} catch {}
@@ -44949,7 +44956,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^2.0.0";
-const CLI_VERSION_RANGE = "^1.68.0";
+const CLI_VERSION_RANGE = "^1.69.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and

package/dist/oclif/receiver-heal.js

@@ -1,6 +1,6 @@
 import { N as agentProfileDirectory, P as agentProfileName, R as loadConnectedAgentProfile, j as AGENT_PROFILE_ENV } from "../cli-config-DMszFbGn.js";
 import { d as readMailJson } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, l as SESSION_UUID, t as notificationScope } from "../notify-session-Cp0Kkstb.js";
+import { _ as detectAgentRuntime, l as SESSION_UUID, t as notificationScope } from "../notify-session-CVZtEboh.js";
 import { a as claimBackgroundListenRestart, n as backgroundListenRestartable, r as backgroundListenStatus } from "../listen-background--0peztKE.js";
 import { join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{signal-command-Bi2U2BR_.js → signal-command-Dy_oub7_.js}

@@ -1,5 +1,5 @@
 import { h as sendPreparedSignal, p as prepareSignalEmail } from "./repeats-BL7ZC-_6-BZ-MphTV.js";
-import { T as bareAddress, Vn as listSentEmails, ar as sendEmail, bt as successfulSendOutcome, en as createEndpoint, it as classifySendError, o as extractErrorPayload, vn as getEmail } from "./api-command-D7DPn2Ro.js";
+import { T as bareAddress, Vn as listSentEmails, ar as sendEmail, bt as successfulSendOutcome, en as createEndpoint, it as classifySendError, o as extractErrorPayload, vn as getEmail } from "./api-command-C58Oh38I.js";
 import { _ as acquireListenLock, b as listenProcessIdentity, c as mailTime, d as readMailJson, f as removeMailFile, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, n as invalidSharedMail, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString, t as SharedMailStateError, v as compareListenProcessIdentity, y as listenIdentity } from "./shared-mail-files-MwlVE90c.js";
 import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply } from "./scoped-chat-Dsark9hm.js";
 import { n as tryOwnSharedMail, r as waitForSharedMailChange, t as readSharedMailOwner } from "./shared-mail-watch-DtKpsgg8.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "primcli",
-  "version": "1.68.0",
+  "version": "1.69.0",
   "description": "Official Primitive CLI: deploy Primitive Functions, send and inspect mail, manage endpoints, all from the terminal. Wraps the @primitivedotdev/sdk runtime client with one-shot commands.",
   "type": "module",
   "sideEffects": false,