primcli 1.72.2 → 1.74.0

package/dist/oclif/index.js

@@ -1,12 +1,12 @@
-import { a as REPEAT_IDLE_MAX_MINUTES, b as parseWebhookEvent, d as parseRepeatTick, f as preparePresenceAliveEmail, i as REPEAT_EVERY_MAX_MINUTES, l as parseInteractionEnvelope$1, m as repeatStopCommand, o as REPEAT_MAX_SENDS_MAX, p as prepareSignalEmail, s as buildRepeatStopBody, u as parsePresenceEnvelope, v as isEmailReceivedEvent, x as parseFromHeader } from "../repeats-BL7ZC-_6-CKMKBlx7.js";
-import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfileName, G as PrimitiveApiClient, I as agentProfilesDirectory, M as AGENT_PROFILE_ENV, N as AgentConnectionSetupError, O as loadActiveChatState, P as agentProfileDirectory, T as saveSignupCredentials, U as requireDefaultLoginProfile, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_ADDRESS_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname, z as loadConnectedAgentProfile } from "../cli-config--YTRdJ3t.js";
-import { $ as MAX_SEND_WAIT_TIMEOUT_MS, $n as listSentAttachmentArchiveMembers, $t as refreshStoredCliCredentials, A as formatMailWakeLine, An as getFunction, Ar as updateFunction, At as loadSkillLine, B as clearConsumedPendingMail, Bn as listAgentContacts, Bt as automatedRejectedError, C as hasReplyState, Cn as getAccount, Cr as startAgentClaim, Ct as thrownErrorExitCode, D as bareAddress, Dn as getCreditBalance, Dr as testFunction, E as explainPendingMailNotFound, En as getConversation, Er as stopRepeatFromEmail, Et as connectNextSteps, F as serverRelationship, Fn as getOrgRoutingTopology, Fr as verifyAgentClaim, Ft as AUTOMATED_FILTER_UNSUPPORTED_CODE, G as removePendingMail, Gn as listDomains, Gt as queryUsesAutomated, H as pendingMailPath, Ht as expectedAutomatedVerdicts, In as getRepeatingSend, Ir as verifyAgentSignup, It as AUTOMATED_FLAG_DESCRIPTION, J as readEmailInteraction, Jn as listEndpoints, Jt as withAttachmentWait, K as interactionHumanLine, Kn as listEmailAttachmentArchiveMembers, Kt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, L as wakeReadCommand, Ln as getSentEmail, Lt as AUTOMATED_VALUES, M as readThreadContext, Mn as getFunctionTestRunTrace, Mr as updateRoute, Mt as formatAlreadySentNotice, N as sentInThread, Nn as getInboxStatus, Nr as updateWakeAuthorization, Nt as writeIdempotentReplayBannerIfReplay, O as describeWake, On as getDefaultNetworkAgent, Or as unsetFunctionRoute, Ot as generatedAgentName, P as serverMuted, Pn as getMemory, Pr as updateWakeSchedule, Pt as withFlagSuggestion, Q as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, Qn as listRoutes, Qt as createCliApiClient, R as wakeRecipientField, Rn as getThread, Rt as AutomatedFilterUnsupportedError, S as formatRepliesCell, Sn as downloadSentAttachmentByFilename, Sr as simulateRoute, St as successfulSendOutcome, T as queryUsesAwaiting, Tr as startCliLogin, Tt as cliInvocation, U as readPendingMail, Un as listDefaultNetworkAgents, Ut as hasAutomatedVerdict, V as clearReadPendingMail, Vn as listAgentNetworks, Vt as ensureSearchReportsAutomated, W as recordPendingMail, Wn as listDefaultNetworkMembers, Wt as isAutomatedRejectedError, X as replyInteractionWarning, Xn as listFunctions, Y as replyExpectation, Yn as listFunctionLogs, Yt as ConnectedAgentKeyRequiredError, Zn as listRepeatingSends, Zt as createAuthenticatedCliApiClient, _ as ReplyStateUnsupportedError, _n as deleteWakeSchedule, _r as semanticSearch, _t as sendIdentityFields, a as extractErrorCode, an as cliLogout, ar as pullWebhookEvent, at as checkPriorReplies, b as ensureSearchReportsReplyState, br as setFunctionSecret, bt as sentHistoryWindowStart, c as hasControlCharacter$1, cn as createFunction, ct as excludeSignalReplies, d as runWithTiming, dn as createWakeSchedule, dr as reorderRoutes, dt as formatPriorRepliesCheckSkipped, en as resolveCliApiRequestConfig, er as listSentEmails, et as SEND_OUTCOME_HELP, f as surfaceUnauthorizedHint, fr as replyToEmail, ft as formatPriorRepliesWarning, g as REPLY_STATE_UNSUPPORTED_CODE, gn as deleteWakeAuthorization, gr as searchMemories, gt as reportSendCommandResult, h as AWAITING_VALUES, hn as deleteRoute, hr as searchEmails, ht as priorRepliesThatWentOut, i as createOperationCommand, in as checkDefaultNetworkContactAdmission, ir as pollCliLogin, it as buildThrownSendFailureEnvelope, j as latestOwnOutbound, jn as getFunctionRouting, jr as updateRepeatingSend, jt as currentMailSessionKey, k as displayAddress, kn as getEmail, kr as updateDefaultNetworkMember, kt as identitySuggestions, l as headerFlagName, ln as createRoute, lr as redeemCreditCode, lt as followUpCommandPrefix, m as AWAITING_FLAG_DESCRIPTION, mn as deleteMemory, mr as runWakeSchedule, mt as formatSendRecordFailureSummary, n as API_ERROR_CODES, nn as cancelSentEmail, nr as listWakeDispatches, nt as assertValidIdempotencyKey, o as extractErrorPayload, on as completeWebhookEvent, ot as classifySendError, p as writeErrorWithHints, pr as resendAgentSignupVerification, pt as formatSendFailureSummary, q as interactionNextActions, qn as listEmails, qt as ATTACHMENT_WAIT_MAX_MS, r as TIME_FLAG_DESCRIPTION, rn as cancelSentEmailByIdempotencyKey, rr as listWakeSchedules, rt as buildFollowUpCommand, s as formatErrorPayload, sn as createEndpoint, st as deriveSendIdempotencyKey, t as API_BASE_URL_FLAG_DESCRIPTION, tn as addDefaultNetworkMember, tr as listWakeAuthorizations, tt as apiResultHttpStatus, u as readTextFileFlag, un as createWakeAuthorization, ur as removeDefaultNetworkMember, ut as formatDeletedEarlierSendNotice, v as assertAwaitingFilterRows, vn as downloadEmailAttachmentArchiveMember, vr as sendEmail, vt as sendOutcomeExitCode, w as isAwaitingRejectedError, wn as getAgentContactPolicy, wr as startAgentSignup, x as formatAwaitingCell, xn as downloadSentAttachmentArchiveMember, xr as setMemory, xt as serializeErrorPayload, y as awaitingRejectedError, yn as downloadEmailAttachmentByFilename, yr as setFunctionRoute, yt as sendWaitClampNotice, z as wakeRelationship, zn as getWakeSchedule, zt as assertAutomatedVerdict } from "../api-command-BrwPbyPP.js";
-import { S as resolveListenSubscription, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, x as normalizeListenOrigin, y as listenIdentity } from "../shared-mail-files-MwlVE90c.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-Byt5sPWW.js";
-import { $ as installClaudeWakeHook, A as evaluateContactPolicy, B as contactAddress, C as RECEIVER_MODES, Ct as withOwnerMemberAddress, D as NETWORK_ADMISSION_PENDING_RETRY_MS, E as ContactPolicyReadRetryError, F as disconnectAgent, G as connectAgent, H as runContactRequest, I as AddressNotesApiError, J as refusalAfterReplacement, K as readAgentInvitation, L as addressNoteTarget, M as AgentDisconnectError, N as claimOverRevokedSetup, O as NetworkAdmissionPendingError, P as clearRevokedAddresses, Q as releaseRegistrationsForProfile, R as runAddressNotesRequest, S as runAgentConnect, St as refreshOwnerMemberAddressPeriodically, T as verificationReplySubmitted, U as agentConnectionStatus, V as contactAgentAddress, W as agentInvitationHash, X as savedReceiver, Y as saveConnectionName, Z as MACHINE_RUNTIMES, _ as enrollmentResumes, _t as jsonIndentation, a as endSession, at as describeSessionHookItem, b as invitationProfileName, bt as writeManagedFile, c as pendingSessionDisconnects, ct as findOnPath, d as registerSession, dt as readClaudeSettings, et as recordHookMailCheck, f as retryPendingDisconnects, ft as repairClaudeHooks, g as enrollAgent, gt as inspectManagedBlock, h as staleSessionAgents, ht as MachineFileError, i as connectedProfilesForSession, it as describeSessionHookChange, j as canonicalContactSelector, k as createNotificationContactPolicy, l as psProcessInfo, lt as hasMachineSessionHooks, m as runDetached, mt as writeClaudeSettings, n as OMP_MAIN, nt as claudeConfigDir, o as headlessClaudeRun, ot as ensureHookLauncher, p as revokeStaleSessionAgents, pt as samePath, q as receiverStatusCommand, r as agentConnectionState, rt as currentCliLocation, st as ephemeralCliReason, t as HOOK_END_GRACE_MS, tt as boundSessionProfiles, u as readClaudeHookInput, ut as inspectClaudeHooks, v as connectWarnings, vt as readManagedFile, w as externalReceivingState, x as pollCheckCommand, xt as readHookLauncherWarning, y as defaultAgentProfileName, yt as upsertManagedBlock, z as ContactsApiError } from "../machine-session-Be6j29GE.js";
-import { a as scopedChatSenderTrust, i as readBeforeDeadline, n as isPlainChatReply, o as presenceDisposition, r as isScopedChatReply, s as readPresenceProjection, t as isConnectedChatCredential } from "../scoped-chat-DTFkP360.js";
-import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background--0peztKE.js";
-import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-DeEEZPbQ.js";
+import { $ as AutomatedFilterUnsupportedError, $t as listDomains, A as sleep$3, An as setMemory, At as getAgentContactPolicy, B as hasReplyState, Bn as updateRepeatingSend, Bt as getMemory, C as collectNewAcceptedEmails, Ct as deleteWakeSchedule, D as filtersFromFlags, Dn as sendEmail, Dt as downloadSentAttachmentArchiveMember, E as fetchEmailSearchPage, En as semanticSearch, F as assertAwaitingFilterRows, Fn as stopRepeatFromEmail, Ft as getEmail, Gn as verifyAgentSignup, Gt as getWakeSchedule, H as queryUsesAwaiting, Hn as updateWakeAuthorization, Ht as getRepeatingSend, I as awaitingRejectedError, In as testFunction, It as getFunction, J as parseWebhookEvent, Jt as listAgentContacts, K as isEmailReceivedEvent, L as ensureSearchReportsReplyState, Ln as unsetFunctionRoute, Lt as getFunctionRouting, M as AWAITING_VALUES, Mn as startAgentClaim, Mt as getConversation, N as REPLY_STATE_UNSUPPORTED_CODE, Nn as startAgentSignup, Nt as getCreditBalance, O as quoteDslValue, On as setFunctionRoute, Ot as downloadSentAttachmentByFilename, P as ReplyStateUnsupportedError, Pn as startCliLogin, Pt as getDefaultNetworkAgent, Q as AUTOMATED_VALUES, Qt as listDefaultNetworkMembers, R as formatAwaitingCell, Rn as updateDefaultNetworkMember, Rt as getFunctionTestRunTrace, S as transientFailure, Sn as runWakeSchedule, St as deleteWakeAuthorization, T as encodeReceivedAtSearchCursor, Tn as searchMemories, Tt as downloadEmailAttachmentByFilename, Un as updateWakeSchedule, Ut as getSentEmail, V as isAwaitingRejectedError, Vn as updateRoute, Vt as getOrgRoutingTopology, Wn as verifyAgentClaim, Wt as getThread, X as AUTOMATED_FILTER_UNSUPPORTED_CODE, Y as parseFromHeader, Yt as listAgentNetworks, Z as AUTOMATED_FLAG_DESCRIPTION, Zt as listDefaultNetworkAgents, _ as describeApiFailure, _n as redeemCreditCode, _t as createWakeSchedule, a as REPEAT_IDLE_MAX_MINUTES, an as listRepeatingSends, at as hasAutomatedVerdict, b as retryTransient, bn as replyToEmail, bt as deleteMemory, cn as listSentEmails, ct as cancelSentEmail, d as parseRepeatTick, dn as listWakeSchedules, dt as cliLogout, en as listEmailAttachmentArchiveMembers, et as assertAutomatedVerdict, f as preparePresenceAliveEmail, fn as pollCliLogin, ft as completeWebhookEvent, g as WaitDeadlineReached, gt as createWakeAuthorization, ht as createRoute, i as REPEAT_EVERY_MAX_MINUTES, in as listFunctions, j as AWAITING_FLAG_DESCRIPTION, jn as simulateRoute, k as sinceFromFlags, kn as setFunctionSecret, kt as getAccount, l as parseInteractionEnvelope$1, ln as listWakeAuthorizations, lt as cancelSentEmailByIdempotencyKey, m as repeatStopCommand, mt as createFunction, nn as listEndpoints, o as REPEAT_MAX_SENDS_MAX, on as listRoutes, ot as isAutomatedRejectedError, p as prepareSignalEmail, pn as pullWebhookEvent, pt as createEndpoint, rn as listFunctionLogs, s as buildRepeatStopBody, sn as listSentAttachmentArchiveMembers, st as addDefaultNetworkMember, tn as listEmails, tt as automatedRejectedError, u as parsePresenceEnvelope, un as listWakeDispatches, ut as checkDefaultNetworkContactAdmission, vn as removeDefaultNetworkMember, w as cursorFromAcceptedRows, wn as searchEmails, wt as downloadEmailAttachmentArchiveMember, x as retryingOperation, xn as resendAgentSignupVerification, xt as deleteRoute, y as pauseForTransientFailure, yn as reorderRoutes, z as formatRepliesCell, zn as updateFunction, zt as getInboxStatus } from "../repeats-BL7ZC-_6-B_ESsWTH.js";
+import { A as saveActiveChatState, C as resolveCliAuth, D as deleteChatState, E as chatStatePath, F as agentProfileName, G as PrimitiveApiClient, I as agentProfilesDirectory, M as AGENT_PROFILE_ENV, N as AgentConnectionSetupError, O as loadActiveChatState, P as agentProfileDirectory, T as saveSignupCredentials, U as requireDefaultLoginProfile, _ as deleteCliCredentials, a as normalizeCliEnvironmentName, b as hasStoredCliLogin, c as resolveConfigEnvironment, g as credentialsPath, h as credentialsLockPath, i as loadCliConfig, j as AGENT_ADDRESS_ENV, k as loadChatConversationByLocalId, l as saveCliConfig, m as cliAccessTokenExpiresAt, n as deleteCliConfig, o as redactCliEnvironment, p as acquireCliCredentialsLock, r as emptyCliConfig, s as removeCliEnvironment, u as upsertCliEnvironment, v as deleteCliCredentialsLock, w as saveCliCredentials, x as loadCliCredentials, y as detectPrimitiveKeyEnvMisname, z as loadConnectedAgentProfile } from "../cli-config-C0Y_Ppol.js";
+import { C as resolveListenSubscription, S as normalizeListenOrigin, _ as acquireListenLock, a as mailLockBusy, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, m as withMailLock, o as mailObject, u as privateMailPermissions, y as listenIdentity } from "../shared-mail-files-CZfm7E2k.js";
+import { $ as formatDeletedEarlierSendNotice, A as clearReadPendingMail, At as createCliApiClient, C as serverRelationship, Ct as withFlagSuggestion, D as wakeRelationship, Dt as ConnectedAgentKeyRequiredError, E as wakeRecipientField, Et as withAttachmentWait, F as interactionHumanLine, G as assertValidIdempotencyKey, H as MAX_SEND_WAIT_TIMEOUT_MS, I as interactionNextActions, J as checkPriorReplies, K as buildFollowUpCommand, L as readEmailInteraction, M as readPendingMail, Mt as resolveCliApiRequestConfig, N as recordPendingMail, O as claimPendingMail, P as removePendingMail, Q as followUpCommandPrefix, R as replyExpectation, S as serverMuted, St as writeIdempotentReplayBannerIfReplay, T as wakeReadCommand, Tt as ATTACHMENT_WAIT_MAX_MS, U as SEND_OUTCOME_HELP, V as IDEMPOTENCY_KEY_FLAG_DESCRIPTION, W as apiResultHttpStatus, X as deriveSendIdempotencyKey, Y as classifySendError, Z as excludeSignalReplies, _ as displayAddress, _t as generatedAgentName, a as extractErrorCode, at as reportSendCommandResult, b as readThreadContext, bt as currentMailSessionKey, c as hasControlCharacter$1, ct as sendWaitClampNotice, d as runWithTiming, dt as successfulSendOutcome, et as formatPriorRepliesCheckSkipped, f as surfaceUnauthorizedHint, ft as thrownErrorExitCode, g as describeWake, h as bareAddress, ht as connectNextSteps, i as createOperationCommand, it as priorRepliesThatWentOut, j as pendingMailPath, jt as refreshStoredCliCredentials, k as clearConsumedPendingMail, kt as createAuthenticatedCliApiClient, l as headerFlagName, lt as sentHistoryWindowStart, m as explainPendingMailNotFound, mt as cliInvocation, n as API_ERROR_CODES, nt as formatSendFailureSummary, o as extractErrorPayload, ot as sendIdentityFields, p as writeErrorWithHints, q as buildThrownSendFailureEnvelope, r as TIME_FLAG_DESCRIPTION, rt as formatSendRecordFailureSummary, s as formatErrorPayload, st as sendOutcomeExitCode, t as API_BASE_URL_FLAG_DESCRIPTION, tt as formatPriorRepliesWarning, u as readTextFileFlag, ut as serializeErrorPayload, v as formatMailWakeLine, vt as identitySuggestions, wt as ATTACHMENT_WAIT_FLAG_DESCRIPTION, x as sentInThread, xt as formatAlreadySentNotice, y as latestOwnOutbound, yt as loadSkillLine, z as replyInteractionWarning } from "../api-command-fKP3NYa7.js";
+import { _ as detectAgentRuntime, a as NotificationRetryError, b as installedVersion, c as readConversationStatusContent, d as defaultSessionSocket, f as NativeSessionDisconnectedError, g as connectSkillTarget, h as NotificationOutcomeUnknownError, i as notificationReceiptPage, l as SESSION_UUID$1, m as NativeSessionNotLoadedError, n as notificationSenders, o as isRoutineNotificationContent, p as NativeSessionError, r as openSessionNotifications, s as notificationPartReader, t as notificationScope, v as installConnectSkill, x as readBundledConnectSkill, y as installedConnectSkillFile } from "../notify-session-DJAb9SGm.js";
+import { $ as saveConnectionName, A as ContactPolicyReadRetryError, B as AddressNotesApiError, C as RECEIVER_MODES, Ct as upsertManagedBlock, D as registrationSummary, Dt as refreshOwnerMemberAddressPeriodically, E as failedSessionRegistration, Et as addSessionReceiver, F as canonicalContactSelector, G as contactAgentAddress, H as runAddressNotesRequest, I as AgentDisconnectError, J as agentInvitationHash, K as runContactRequest, L as claimOverRevokedSetup, M as NetworkAdmissionPendingError, N as createNotificationContactPolicy, O as registrationSummaryLine, Ot as withOwnerMemberAddress, P as evaluateContactPolicy, Q as refusalAfterReplacement, R as clearRevokedAddresses, S as runAgentConnect, St as readManagedFile, T as verificationReplySubmitted, Tt as readHookLauncherWarning, U as ContactsApiError, V as addressNoteTarget, W as contactAddress, X as readAgentInvitation, Y as connectAgent, Z as receiverStatusCommand, _ as enrollmentResumes, _t as samePath, a as endSession, at as boundSessionProfiles, b as invitationProfileName, bt as inspectManagedBlock, c as pendingSessionDisconnects, ct as describeSessionHookChange, d as registerSession, dt as ephemeralCliReason, et as savedReceiver, f as retryPendingDisconnects, ft as findOnPath, g as enrollAgent, gt as repairClaudeHooks, h as staleSessionAgents, ht as readClaudeSettings, i as connectedProfilesForSession, it as recordHookMailCheck, j as NETWORK_ADMISSION_PENDING_RETRY_MS, k as waitForRegistrations, l as psProcessInfo, lt as describeSessionHookItem, m as runDetached, mt as inspectClaudeHooks, n as OMP_MAIN, nt as releaseRegistrationsForProfile, o as headlessClaudeRun, ot as claudeConfigDir, p as revokeStaleSessionAgents, pt as hasMachineSessionHooks, q as agentConnectionStatus, r as agentConnectionState, rt as installClaudeWakeHook, st as currentCliLocation, t as HOOK_END_GRACE_MS, tt as MACHINE_RUNTIMES, u as readClaudeHookInput, ut as ensureHookLauncher, v as connectWarnings, vt as writeClaudeSettings, w as externalReceivingState, wt as writeManagedFile, x as pollCheckCommand, xt as jsonIndentation, y as defaultAgentProfileName, yt as MachineFileError, z as disconnectAgent } from "../machine-session-B6V5-grn.js";
+import { a as readBeforeDeadline, c as readPresenceProjection, i as readApiBeforeDeadline, n as isPlainChatReply, o as scopedChatSenderTrust, r as isScopedChatReply, s as presenceDisposition, t as isConnectedChatCredential } from "../scoped-chat-DAiOb622.js";
+import { c as startBackgroundListen, i as backgroundListenToken, l as stopBackgroundListen, o as runBackgroundListen, r as backgroundListenStatus, u as verifyBackgroundListenTarget } from "../listen-background-cD6n8VYO.js";
+import { a as ensureSharedMailSubscription, c as isConnectedAgentKey, d as reserveSharedMailSubscription, f as followEmailConversation, g as EventReceiverError, h as EventConnection, i as sharedMailScope, l as createSharedMailWaiter, m as otherParticipants, n as reconcileChatSend, p as readConversationFollow, r as openSharedMailReceiver, s as AGENT_CONNECTION_REQUIRED_MESSAGE, t as sendSignal, u as openSharedMailStore } from "../signal-command-Cte4mAL3.js";
 import { autoSignalEligible, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, readWorkingLease, restoreAutoWorking } from "./auto-signals.js";
 import { n as jsonOutputRequested, r as runStreamingJson, t as guardJsonOutputCommands } from "../json-output-Ce10AsSb.js";
 import { Args, Command, Errors, Flags, ux } from "@oclif/core";
@@ -40006,7 +40006,7 @@ const RETRYABLE_STATUS = /* @__PURE__ */ new Set([
 	503,
 	504
 ]);
-function sleep$3(ms) {
+function sleep$2(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 /**
@@ -40028,7 +40028,7 @@ async function retryingFetch(url, init, label, maxRetries = DEFAULT_MAX_RETRIES)
 			throw new Error(`${label}: network error after ${attempt} retries: ${networkError?.message ?? networkError}`);
 		}
 		if (res) await res.text().catch(() => {});
-		await sleep$3(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
+		await sleep$2(Math.min(1e3 * 2 ** attempt, 15e3) + Math.floor(Math.random() * 250));
 	}
 }
 async function initiate(opts, manifest) {
@@ -40371,7 +40371,7 @@ function withClearedNote(message, cleared) {
 	return `${message} Before that, this run cleared ${cleared.map((row) => `${row.address} (profile ${row.profile})`).join(", ")} on this machine because Primitive confirmed ${cleared.length === 1 ? "its credential was" : "their credentials were"} already revoked; ${cleared.length === 1 ? "it stays" : "they stay"} disconnected.`;
 }
 var AgentConnectCommand = class AgentConnectCommand extends Command {
-	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, writes a private AGENT_RESUME note holding the command that resumes the bound session ("claude --resume <session>" or "codex resume <session>") once verified (or deletes an existing one when no resumable session is bound), and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
+	static description = `Connect this coding session to Primitive in one call. With --session, the command checks this CLI's capabilities, installs or refreshes the matching primitive-connect skill for the detected runtime (Claude Code or Codex) from files bundled in this CLI, claims the owner's private setup invitation from piped stdin, answers one authenticated setup challenge, enables owner notifications, starts receiving, seeds a private AGENT_INFO note from --name and --info when absent, writes a private AGENT_RESUME note holding the command that resumes the bound session ("claude --resume <session>" or "codex resume <session>") once verified (or deletes an existing one when no resumable session is bound), and prints one JSON result. The receiver defaults to external hooks in Claude Code and the native background listener elsewhere. When the native default cannot work because this machine has no local session socket (for example Codex older than 0.158.0), the command connects with poll receiving instead and reports receiving.fallbackReason and receiving.fallbackDetail. Without a session (no --session, or an empty one) the receiver is poll: for runtimes with no local session ID or hooks, such as a cloud-hosted conversation whose commands run in a separate sandbox, the invitation is claimed and verified the same way, nothing is installed, and the result's receiving.checkCommand is the command the agent runs to check for new mail at the start of each turn and after it sends. Native receiving starts or reuses a supervised background listener and waits briefly for its first successful mail check; external receiving installs the exact Claude session's fail-open Stop hook and resume SessionStart hook after the verification reply; a real idle mail event must still verify wake. The profile defaults to session-<session>, or to connection-<invitation hash prefix> without a session. --resume continues saved progress without reading stdin or replaying a claim or uncertain verification send. After the reply is submitted it waits up to a minute for the server to confirm the connection and reports verification.state verified, or reply_submitted while confirmation is still pending. Verification is separate from receiver health. Both official production (https://api.primitive.dev/v1) and staging (https://api.primitive-staging-1.com/v1) invitations pin their API origin. Never pass an invitation as a command argument. One address per session: an address whose credential Primitive confirms was already revoked (for example, revoked in the app before the owner reconnected it) no longer counts; it is disconnected locally, reported in clearedRevoked, and its saved setup is moved aside so the new invitation can be claimed into the same profile. A profile whose earlier setup or enrollment never saved a credential is not an address: a pasted invitation is claimed into it (its unfinished state is moved aside), and the result's replacedUnfinished says whether that finished the same pending address. Otherwise, if this session already has a connected Primitive address, including one saved in the profile being connected, the command claims nothing, leaves stdin unread, and exits 3 with status already_connected. Its detail names how to continue that profile's own connection when that is the only one: --resume for a setup with saved progress, or --keep-existing to refresh a claim-only profile from the same invitation. Otherwise ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user. Select the saved identity with PRIMITIVE_AGENT_PROFILE. Use --status --json with --profile, with PRIMITIVE_AGENT_PROFILE set, or with --session (the address connected for that session) to inspect saved identity and local receiver health offline; it exits 1 when nothing is configured, and reports the session's last registration failure as registration when one was recorded. A status check before connecting is optional: connect itself claims nothing and exits 3 when the session already has an address. A completed connection's result carries nextSteps, in order: report to the owner in two short sentences, make one offer to rename a generated name and record where the agent runs, and load the primitive-connect skill before handling mail. When the claim reported one, the result also carries the connection's name and nameIsDefault.`;
 	static summary = "Connect and verify an agent address";
 	static examples = [
 		"<%= config.bin %> agent connect --session \"$CODEX_THREAD_ID\" --name Research --info \"Reviews pull requests\" --json < private-invitation.txt",
@@ -40444,12 +40444,14 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 				});
 				if (picked.profile === null && picked.session === null) throw new AgentConnectionSetupError(`Pass --profile <name>, --session <id> or set ${AGENT_PROFILE_ENV}.`);
 				if (picked.profile === null) {
-					const detail = statusProfileMissingDetail(picked.bound);
+					const registration = picked.bound.length === 0 && picked.session ? registrationSummary(this.config.configDir, defaultAgentProfileName(picked.session)) : null;
+					const detail = registration ? `${statusProfileMissingDetail(picked.bound)} ${registrationSummaryLine(registration)}` : statusProfileMissingDetail(picked.bound);
 					this.log(flags.json ? JSON.stringify({
 						status: "not_configured",
 						profileName: null,
 						session: picked.session,
 						...picked.bound.length > 1 ? { profiles: picked.bound } : {},
+						...registration ? { registration } : {},
 						detail
 					}) : detail);
 					process.exitCode = 1;
@@ -40457,20 +40459,25 @@ var AgentConnectCommand = class AgentConnectCommand extends Command {
 				}
 				const profileName = picked.profile;
 				const result = agentConnectionStatus(this.config.configDir, profileName);
+				const registration = registrationSummary(this.config.configDir, profileName);
 				if (result.status !== "configured") {
-					const detail = `Agent profile ${profileName} is not configured. Run \`primitive agent connect\` with the owner's invitation to connect it.`;
+					const detail = registration ? `Agent profile ${profileName} is not configured. ${registrationSummaryLine(registration)}` : `Agent profile ${profileName} is not configured. Run \`primitive agent connect\` with the owner's invitation to connect it.`;
 					this.log(flags.json ? JSON.stringify({
 						...result,
+						...registration ? { registration } : {},
 						detail
 					}) : detail);
 					process.exitCode = 1;
 					return;
 				}
-				if (flags.json) this.log(JSON.stringify(result));
+				if (flags.json) this.log(JSON.stringify(registration?.lastFailure ? {
+					...result,
+					registration
+				} : result));
 				else {
 					const receiving = result.receiving;
 					const why = [receiving.reason, receiving.failureCode !== receiving.reason ? receiving.failureCode : null].filter(Boolean);
-					this.log(`Agent profile ${profileName} is configured for ${result.identity.agentAddress}. Local receiving: ${receiving.state}${why.length ? ` (${why.join(", ")})` : ""}.${receiving.detail ? ` ${receiving.detail}` : ""}${receiving.lastFiredAt ? ` Receive hook last ran at ${receiving.lastFiredAt}.` : ""}${receiving.lastSuccessfulMailCheckAt ? ` Last completed mail check at ${receiving.lastSuccessfulMailCheckAt}.` : ""}`);
+					this.log(`Agent profile ${profileName} is configured for ${result.identity.agentAddress}. Local receiving: ${receiving.state}${why.length ? ` (${why.join(", ")})` : ""}.${receiving.detail ? ` ${receiving.detail}` : ""}${receiving.lastFiredAt ? ` Receive hook last ran at ${receiving.lastFiredAt}.` : ""}${receiving.lastSuccessfulMailCheckAt ? ` Last completed mail check at ${receiving.lastSuccessfulMailCheckAt}.` : ""}${registration?.lastFailure ? ` ${registrationSummaryLine(registration)}` : ""}`);
 				}
 				return;
 			}
@@ -40855,7 +40862,7 @@ function invocation(entry) {
 }
 var AgentEnrollCommand = class AgentEnrollCommand extends Command {
 	static summary = "Give this coding session an address in your organization";
-	static description = `On this trusted machine, use the saved member OAuth login to create one address for the exact loaded session, claim its one-use invitation privately, answer the email challenge, and poll the owner's connection list for confirmed pairing. Native receiving starts when supported. With --receiver external in the exact Claude session, install a fail-open Stop hook and resume SessionStart hook in that runtime's settings after the verification reply; idle wake remains unverified until tested with real mail. With --contact-requests, the login conditionally enables first-contact intake for this exact address after verification, preserving existing policy rules. An explicit disable or uncertain policy update is reported separately without losing pairing or receiver setup. The server allocates a readable address. An uncertain creation resumes the same saved request; recovered results do not include another invitation. Use --continue-setup once to explicitly continue a recovered pending connection. An uncertain continuation or claim is held for owner recovery, never repeated automatically. Requires a verified Primitive-managed domain. This command does not accept API keys, a connection profile, or an invitation argument. One address per session: if this session already has another connected Primitive address, nothing is created and the command exits 3 with status already_connected; ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user.`;
+	static description = `On this trusted machine, use the saved member OAuth login to create one address for the exact loaded session, claim its one-use invitation privately, answer the email challenge, and poll the owner's connection list for confirmed pairing. Native receiving starts when supported. With --receiver external in the exact Claude session, install a fail-open Stop hook and resume SessionStart hook in that runtime's settings after the verification reply; idle wake remains unverified until tested with real mail. With --contact-requests, the login conditionally enables first-contact intake for this exact address after verification, preserving existing policy rules. An explicit disable or uncertain policy update is reported separately without losing pairing or receiver setup. The server allocates a readable address. An uncertain creation resumes the same saved request; recovered results do not include another invitation. Use --continue-setup once to explicitly continue a recovered pending connection. An uncertain continuation is held for owner recovery, never repeated automatically. When a claim left no saved credential (it was never sent, was refused, or its answer was lost), a rerun signed in as the agent's owner in the same organization asks Primitive for one fresh invitation for the same address and claims it; without that login the refusal names the step that finishes it from the app. Each attempt is recorded, without secrets, in the profile's registration log, which agent connect --status reports. Requires a verified Primitive-managed domain. This command does not accept API keys, a connection profile, or an invitation argument. One address per session: if this session already has another connected Primitive address, nothing is created and the command exits 3 with status already_connected; ask the user whether to keep the existing address or disconnect it first, then rerun with --keep-existing or --replace-existing. Never choose for the user.`;
 	static examples = ["<%= config.bin %> agent enroll --session 11111111-1111-4111-8111-111111111111 --name Research --contact-requests --json", "<%= config.bin %> agent enroll --session 11111111-1111-4111-8111-111111111111 --receiver external --name Research --json"];
 	static flags = {
 		session: Flags.string({
@@ -41002,7 +41009,7 @@ var AgentEnrollCommand = class AgentEnrollCommand extends Command {
 			}
 			if (externalHook === "unavailable" || flags["contact-requests"] && result.contactRequestPolicy !== "enabled" || result.connection.status !== "connected" || flags.receiver !== "external" && flags.receiver !== "poll" && result.receiving.state !== "healthy") process.exitCode = 2;
 		} catch (error) {
-			throw new Errors.CLIError(error instanceof AgentConnectionSetupError ? error.message : "Enrollment paused. Preserve this session's private profile and inspect the pending agent in the app before retrying. No second address was requested automatically.", { exit: 1 });
+			throw new Errors.CLIError(error instanceof AgentConnectionSetupError ? error.message : "Enrollment stopped on an unexpected error. Rerun the same command to resume this session's saved enrollment; it never requests a second address.", { exit: 1 });
 		}
 	}
 };
@@ -42601,7 +42608,7 @@ function searchFailure(response) {
 }
 /** Inspect an exact email ID obtained from a targeted query or event journal. */
 async function inspectTargetedReply(params) {
-	const result = await readBeforeDeadline(params.deadline, (signal) => getEmail({
+	const result = await readApiBeforeDeadline(params.deadline, (signal) => getEmail({
 		client: params.apiClient.client,
 		path: { id: params.id },
 		signal,
@@ -42609,7 +42616,8 @@ async function inspectTargetedReply(params) {
 	}));
 	if (result === null) return null;
 	const email = result.data?.data;
-	if (result.error || !email || email.id !== params.id) throw invalid$2(`Could not inspect reply candidate ${params.id}.`);
+	if (result.error) throw invalid$2(`Could not inspect reply candidate ${params.id}: ${describeApiFailure(result)}.`);
+	if (!email || email.id !== params.id) throw invalid$2(`Could not inspect reply candidate ${params.id}.`);
 	const presence = presenceDisposition(email);
 	if (presence !== "ordinary") return {
 		kind: presence === "pending" ? "pending" : "unrelated",
@@ -42685,7 +42693,7 @@ async function inspectTargetedReply(params) {
 /** One targeted recovery page. The event owner decides when recovery is needed. */
 async function readTargetedReplyPage(params) {
 	if (!params.sentId || !params.from || !params.recipient) throw invalid$2("Targeted reply recovery requires the exact sent email, receiving address, and peer.");
-	const result = await readBeforeDeadline(params.deadline, (signal) => searchEmails({
+	const result = await readApiBeforeDeadline(params.deadline, (signal) => searchEmails({
 		client: params.apiClient.client,
 		signal,
 		query: {
@@ -42715,6 +42723,11 @@ async function readTargetedReplyPage(params) {
 }
 //#endregion
 //#region src/oclif/connected-reply-wait.ts
+/**
+* Slack for clock differences between this machine, which records when a
+* wait was created, and the server, which records when mail was received.
+*/
+const REPLY_CLOCK_SKEW_MS = 6e5;
 function recoveryEventId(id) {
 	const h = createHash("sha256").update(`reply-recovery:${id}`).digest("hex");
 	return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
@@ -42802,6 +42815,20 @@ async function openConnectedReplyWait(options) {
 	let closed = false;
 	let closing;
 	const timedOut = () => options.deadline != null && Date.now() >= options.deadline;
+	let earliestReply;
+	/**
+	* The earliest receipt time a reply to this wait's send can have: the wait
+	* is registered before the send, so mail received well before it is
+	* retained history, not a reply.
+	*/
+	async function replyFloor() {
+		if (earliestReply !== void 0) return earliestReply;
+		const intent = await store.readWait(requestId);
+		const created = Date.parse(intent?.createdAt ?? "");
+		const earlier = [options.sentAt, options.since].map((value) => Date.parse(value ?? "")).filter(Number.isFinite);
+		earliestReply = Number.isFinite(created) ? Math.min(created, ...earlier) - REPLY_CLOCK_SKEW_MS : Number.NEGATIVE_INFINITY;
+		return earliestReply;
+	}
 	async function release() {
 		if (released) return;
 		await (await openSharedMailStore({
@@ -42892,6 +42919,7 @@ async function openConnectedReplyWait(options) {
 			requestId = bound.requestId;
 			sentId = bound.sentEmailId ?? void 0;
 			recoveryNeeded = true;
+			earliestReply = void 0;
 		},
 		uncertain: () => store.markWaitUncertain(requestId),
 		async cancelBeforeSend() {
@@ -42981,7 +43009,9 @@ async function openConnectedReplyWait(options) {
 						limit: options.pageSize,
 						cursor: localCursor
 					});
+					const floor = await replyFloor();
 					for (const row of local.emails) {
+						if (!row.details && Date.parse(row.receivedAt) < floor) continue;
 						if (row.details && row.details.authorization !== "pending" && (row.details.peer !== options.recipient || row.details.replyToSentEmailId !== sentId)) continue;
 						const reply = await inspect(row.emailId);
 						if (reply) return reply;
@@ -43658,132 +43688,6 @@ function warnIfSharedProfile(params) {
 	const warning = sharedProfileWarning(params);
 	if (warning) process.stderr.write(`Warning: ${warning}\n`);
 }
-//#endregion
-//#region src/oclif/commands/emails-poll.ts
-function quoteDslValue(value) {
-	if (/^[^\s"]+$/.test(value)) return value;
-	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-function combineQ(q, domain) {
-	const parts = [q?.trim(), domain ? `domain:${quoteDslValue(domain.trim())}` : void 0].filter((part) => Boolean(part));
-	return parts.length > 0 ? parts.join(" ") : void 0;
-}
-function normalizeIsoDate(value, label) {
-	const parsed = new Date(value);
-	if (Number.isNaN(parsed.getTime())) throw new Error(`${label} must be a valid date or ISO-8601 timestamp.`);
-	return parsed.toISOString();
-}
-function filtersFromFlags(flags) {
-	if (flags.automated !== void 0 && !AUTOMATED_VALUES.includes(flags.automated)) throw new Error("--automated must be true or false.");
-	return {
-		automated: flags.automated === void 0 ? void 0 : flags.automated === "true",
-		awaiting: flags.awaiting,
-		body: flags.body,
-		domain: flags.domain,
-		domainId: flags["domain-id"],
-		from: flags.from,
-		hasAttachment: flags["has-attachment"],
-		q: flags.q,
-		replyToSentEmailId: flags["reply-to-sent-email-id"],
-		spamScoreGte: flags["spam-score-gte"],
-		spamScoreLt: flags["spam-score-lt"],
-		subject: flags.subject,
-		to: flags.to
-	};
-}
-function sinceFromFlags(flags) {
-	if (flags.since) return normalizeIsoDate(flags.since, "--since");
-	return flags["include-existing"] ? void 0 : (/* @__PURE__ */ new Date()).toISOString();
-}
-function buildEmailSearchQuery(params) {
-	const query = {
-		include_facets: "false",
-		limit: params.pageSize,
-		snippet: "false",
-		sort: "received_at_asc"
-	};
-	const q = combineQ(params.filters.q, params.filters.domain);
-	if (q) query.q = q;
-	if (params.filters.awaiting) query.awaiting = params.filters.awaiting;
-	if (params.filters.automated !== void 0) query.automated = params.filters.automated ? "true" : "false";
-	if (params.filters.body) query.body = params.filters.body;
-	if (params.filters.domainId) query.domain_id = params.filters.domainId;
-	if (params.filters.from) query.from = params.filters.from;
-	if (params.filters.hasAttachment !== void 0) query.has_attachment = params.filters.hasAttachment ? "true" : "false";
-	if (params.filters.spamScoreGte !== void 0) query.spam_score_gte = params.filters.spamScoreGte;
-	if (params.filters.spamScoreLt !== void 0) query.spam_score_lt = params.filters.spamScoreLt;
-	if (params.filters.replyToSentEmailId) query.reply_to_sent_email_id = params.filters.replyToSentEmailId;
-	if (params.filters.subject) query.subject = params.filters.subject;
-	if (params.filters.to) query.to = params.filters.to;
-	if (params.since) query.date_from = params.since;
-	if (params.cursor) query.cursor = params.cursor;
-	return query;
-}
-function encodeReceivedAtSearchCursor(email) {
-	const raw = `r|${new Date(email.received_at).toISOString()}|${email.id}`;
-	return Buffer.from(raw, "utf8").toString("base64url");
-}
-function cursorFromRows(rows) {
-	const last = rows.at(-1);
-	return last ? encodeReceivedAtSearchCursor(last) : null;
-}
-function cursorFromAcceptedRows(rows) {
-	for (let i = rows.length - 1; i >= 0; i--) {
-		const row = rows[i];
-		if (row.status === "accepted" || row.status === "completed") return encodeReceivedAtSearchCursor(row);
-	}
-	return null;
-}
-function collectNewAcceptedEmails(rows, seenIds) {
-	const fresh = [];
-	for (const row of rows) {
-		if (row.status !== "accepted" && row.status !== "completed") continue;
-		if (seenIds.has(row.id)) continue;
-		seenIds.add(row.id);
-		fresh.push(row);
-	}
-	return fresh;
-}
-async function fetchEmailSearchPage(params) {
-	const result = await searchEmails({
-		client: params.apiClient.client,
-		query: buildEmailSearchQuery({
-			cursor: params.cursor,
-			filters: params.filters,
-			pageSize: params.pageSize,
-			since: params.since
-		}),
-		responseStyle: "fields"
-	});
-	const wantsReplyState = Boolean(params.filters.awaiting) || queryUsesAwaiting(params.filters.q);
-	const wantsAutomated = params.filters.automated !== void 0 || queryUsesAutomated(params.filters.q);
-	if (result.error) {
-		if (wantsReplyState && isAwaitingRejectedError(result.error)) throw awaitingRejectedError("GET /emails/search");
-		if (wantsAutomated && isAutomatedRejectedError(result.error)) throw automatedRejectedError("GET /emails/search");
-		return {
-			ok: false,
-			error: result.error
-		};
-	}
-	const envelope = result.data;
-	const rows = envelope?.data ?? [];
-	if (wantsReplyState) {
-		assertAwaitingFilterRows(rows, "GET /emails/search");
-		if (rows.length === 0) await ensureSearchReportsReplyState(params.apiClient);
-	}
-	if (wantsAutomated) {
-		assertAutomatedVerdict(rows, "GET /emails/search", expectedAutomatedVerdicts(params.filters.automated, params.filters.q));
-		if (rows.length === 0) await ensureSearchReportsAutomated(params.apiClient);
-	}
-	return {
-		ok: true,
-		cursor: envelope?.meta.cursor ?? cursorFromRows(rows),
-		rows
-	};
-}
-function sleep$2(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
 function cliError$6(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
@@ -45399,10 +45303,23 @@ async function waitForReply(params) {
 		deadline: totalDeadline
 	});
 	let strictFilterUnsupported = false;
+	let notBefore = 0;
+	const holdRetryAfter = (failure) => {
+		if (failure.retryAfterMs !== void 0) notBefore = Math.max(notBefore, Date.now() + failure.retryAfterMs);
+	};
 	for (const phase of phases) {
 		if (phase.label === "strict" && strictFilterUnsupported) continue;
+		if (notBefore > Date.now()) {
+			const remaining = totalDeadline === null ? Number.POSITIVE_INFINITY : totalDeadline - Date.now();
+			if (remaining <= notBefore - Date.now()) {
+				await sleep$3(Math.max(0, remaining));
+				return null;
+			}
+			await sleep$3(notBefore - Date.now());
+		}
 		const seenIds = /* @__PURE__ */ new Set();
 		let cursor = null;
+		let failures = 0;
 		while (true) {
 			if (phase.deadline !== null && Date.now() >= phase.deadline) break;
 			const page = await fetchEmailSearchPage({
@@ -45413,14 +45330,25 @@ async function waitForReply(params) {
 				since: params.sentAtIso
 			});
 			if (!page.ok) {
+				const failure = transientFailure(page);
+				if (failure) {
+					if (!await pauseForTransientFailure(failure, failures, {
+						deadline: phase.deadline,
+						notice,
+						onTransientFailure: holdRetryAfter
+					})) break;
+					failures += 1;
+					continue;
+				}
 				const payload = extractErrorPayload(page.error);
-				writeErrorWithHints(payload);
+				writeErrorWithHints(payload, page.response);
 				surfaceUnauthorizedHint({
 					...params.authFailureContext,
 					payload
 				});
 				throw new Errors.CLIError("Failed to poll for reply.", { exit: 1 });
 			}
+			failures = 0;
 			let lastAccepted;
 			for (let i = page.rows.length - 1; i >= 0; i--) {
 				const row = page.rows[i];
@@ -45432,14 +45360,19 @@ async function waitForReply(params) {
 			if (lastAccepted) cursor = encodeReceivedAtSearchCursor(lastAccepted);
 			const matches = collectNewAcceptedEmails(page.rows, seenIds);
 			for (const match of matches) {
-				const full = await getEmail({
+				const full = await retryTransient(() => getEmail({
 					client: params.apiClient.client,
 					path: { id: match.id },
 					responseStyle: "fields"
+				}), {
+					deadline: phase.deadline,
+					notice,
+					onTransientFailure: holdRetryAfter
 				});
+				if (full === null) break;
 				if (full.error) {
 					const payload = extractErrorPayload(full.error);
-					writeErrorWithHints(payload);
+					writeErrorWithHints(payload, full.response);
 					surfaceUnauthorizedHint({
 						...params.authFailureContext,
 						payload
@@ -45463,7 +45396,7 @@ async function waitForReply(params) {
 			if (lastAccepted !== void 0) continue;
 			if (phase.deadline !== null && Date.now() >= phase.deadline) break;
 			if (totalDeadline !== null && Date.now() >= totalDeadline) return null;
-			await sleep$2(params.interval * 1e3);
+			await sleep$3(params.interval * 1e3);
 		}
 	}
 	return null;
@@ -47622,7 +47555,7 @@ async function resolveScopedEmailWait(params) {
 	const requestedTo = to === void 0 ? void 0 : exactAddress(to, "--to");
 	if (Object.values(unsupported).some((value) => value !== void 0 && value !== false)) throw invalid$1("Connected email waits support exact --from, --to, and --reply-to-sent-email-id matching only; search, body, subject, domain, attachment, and spam filters are unavailable.");
 	const sentId = replyToSentEmailId.toLowerCase();
-	const result = await readBeforeDeadline(params.deadline, (signal) => getSentEmail({
+	const result = await readApiBeforeDeadline(params.deadline, (signal) => getSentEmail({
 		signal,
 		client: params.apiClient.client,
 		path: { id: sentId },
@@ -47630,7 +47563,8 @@ async function resolveScopedEmailWait(params) {
 	}));
 	if (result === null) return null;
 	const sent = result.data?.data;
-	if (result.error || !sent || sent.id !== sentId) throw invalid$1("Could not read that sent email with the connected credential. Inspect the existing send before retrying; do not send it again.");
+	if (result.error) throw invalid$1(`Could not read that sent email with the connected credential: ${describeApiFailure(result)}. Inspect the existing send before retrying; do not send it again.`);
+	if (!sent || sent.id !== sentId) throw invalid$1("Could not read that sent email with the connected credential. Inspect the existing send before retrying; do not send it again.");
 	const ownAddress = exactAddress(sent.from_address, "The sent email's from_address");
 	if (sent.from_header != null && sent.from_header !== "") {
 		const header = typeof sent.from_header === "string" ? parseFromHeader(sent.from_header) : null;
@@ -47640,7 +47574,8 @@ async function resolveScopedEmailWait(params) {
 	return {
 		from: ownAddress,
 		recipient,
-		sentId
+		sentId,
+		...typeof sent.created_at === "string" ? { sentAt: sent.created_at } : {}
 	};
 }
 //#endregion
@@ -47665,7 +47600,10 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
   Connected waits share an address event subscription and recover replies with
   exact-parent search. They never scan inbox history. Additional content
   filters. The command never sends mail. On timeout it exits 1; run the same
-  wait again to recover a reply to the existing send without resending it.`;
+  wait again to recover a reply to the existing send without resending it.
+  A rate limit (HTTP 429, honouring Retry-After), a 502, 503 or 504, or a
+  network error during the wait is retried with backoff until --timeout,
+  with one note on stderr per retry.`;
 	static summary = "Wait for matching inbound emails";
 	static examples = [
 		"<%= config.bin %> emails wait --reply-to-sent-email-id <sent-id> --from peer@example.com",
@@ -47776,6 +47714,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 		const idWidth = pickIdWidth(Boolean(process.stdout.isTTY));
 		const seenIds = /* @__PURE__ */ new Set();
 		let cursor = null;
+		let failures = 0;
 		let matched = 0;
 		let headerPrinted = false;
 		const printEmail = (email) => {
@@ -47834,8 +47773,14 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 				throw error;
 			}
 			if (!page.ok) {
+				const failure = transientFailure(page);
+				if (failure) {
+					if (!await pauseForTransientFailure(failure, failures, { deadline })) break;
+					failures += 1;
+					continue;
+				}
 				const payload = extractErrorPayload(page.error);
-				writeErrorWithHints(payload);
+				writeErrorWithHints(payload, page.response);
 				surfaceUnauthorizedHint({
 					auth,
 					baseUrlOverridden,
@@ -47845,6 +47790,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 				process.exitCode = 1;
 				return;
 			}
+			failures = 0;
 			const nextCursor = cursorFromAcceptedRows(page.rows);
 			const cursorAdvanced = Boolean(nextCursor && nextCursor !== cursor);
 			if (nextCursor) cursor = nextCursor;
@@ -47854,7 +47800,7 @@ var EmailsWaitCommand = class EmailsWaitCommand extends Command {
 			}
 			if (cursorAdvanced) continue;
 			if (deadline !== null && Date.now() >= deadline) break;
-			await sleep$2(flags.interval * 1e3);
+			await sleep$3(flags.interval * 1e3);
 		}
 		const message = `Timed out waiting for ${flags.number} matching email${flags.number === 1 ? "" : "s"}; received ${matched}.`;
 		this.timedOut = {
@@ -47948,6 +47894,7 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 		const idWidth = pickIdWidth(Boolean(process.stdout.isTTY));
 		const seenIds = /* @__PURE__ */ new Set();
 		let cursor = null;
+		let failures = 0;
 		let printed = 0;
 		let headerPrinted = false;
 		while (deadline === null || Date.now() < deadline) {
@@ -47965,8 +47912,14 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 				throw error;
 			}
 			if (!page.ok) {
+				const failure = transientFailure(page);
+				if (failure) {
+					if (!await pauseForTransientFailure(failure, failures, { deadline })) break;
+					failures += 1;
+					continue;
+				}
 				const payload = extractErrorPayload(page.error);
-				writeErrorWithHints(payload);
+				writeErrorWithHints(payload, page.response);
 				surfaceUnauthorizedHint({
 					auth,
 					baseUrlOverridden,
@@ -47976,6 +47929,7 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 				process.exitCode = 1;
 				return;
 			}
+			failures = 0;
 			const nextCursor = cursorFromAcceptedRows(page.rows);
 			const cursorAdvanced = Boolean(nextCursor && nextCursor !== cursor);
 			if (nextCursor) cursor = nextCursor;
@@ -47993,7 +47947,7 @@ var EmailsWatchCommand = class EmailsWatchCommand extends Command {
 			}
 			if (cursorAdvanced) continue;
 			if (deadline !== null && Date.now() >= deadline) break;
-			await sleep$2(flags.interval * 1e3);
+			await sleep$3(flags.interval * 1e3);
 		}
 	}
 };
@@ -49155,7 +49109,7 @@ const PRIMITIVE_TEAM_AUTHOR = {
 	url: "https://primitive.dev"
 };
 const SDK_VERSION_RANGE = "^2.0.0";
-const CLI_VERSION_RANGE = "^1.72.2";
+const CLI_VERSION_RANGE = "^1.74.0";
 const ESBUILD_VERSION_RANGE = "^0.27.0";
 function renderHandler() {
 	return `// env.PRIMITIVE_API_KEY, env.PRIMITIVE_WEBHOOK_SECRET, and
@@ -50020,7 +49974,7 @@ var FunctionsLogsCommand = class FunctionsLogsCommand extends Command {
 					return;
 				}
 				completedInitialFollowPoll = true;
-				await sleep$2(flags["poll-interval"] * 1e3);
+				await sleep$3(flags["poll-interval"] * 1e3);
 			}
 		});
 	}
@@ -50931,7 +50885,7 @@ var FunctionsTestFunctionCommand = class FunctionsTestFunctionCommand extends Co
 					trace = fetched;
 					break;
 				}
-				await sleep$2(pollIntervalMs);
+				await sleep$3(pollIntervalMs);
 			}
 			if (!trace) {
 				const finalTrace = ((await getFunctionTestRunTrace({
@@ -51096,6 +51050,32 @@ const DEFAULT_API = {
 	getEmail,
 	listEmails
 };
+/**
+* The API for a wait: a rate limit, gateway failure or network error backs
+* off and reads again until the deadline (null: no deadline), then throws
+* WaitDeadlineReached. These are all reads, so a retry repeats nothing.
+*/
+function waitingInboxApi(deadline, api = DEFAULT_API) {
+	const options = { deadline };
+	return {
+		...api,
+		getConversation: retryingOperation(api.getConversation, options),
+		getEmail: retryingOperation(api.getEmail, options),
+		listEmails: retryingOperation(api.listEmails, options, (input) => {
+			const query = input.query;
+			if (deadline === null || query?.wait === void 0) return input;
+			const remainingMs = deadline - Date.now();
+			if (remainingMs <= 0) return null;
+			return {
+				...input,
+				query: {
+					...query,
+					wait: Math.min(query.wait, Math.floor(remainingMs / 1e3))
+				}
+			};
+		})
+	};
+}
 async function listPage(api, apiClient, query) {
 	let result = await api.listEmails({
 		client: apiClient.client,
@@ -51415,7 +51395,7 @@ var InboxNextCommand = class InboxNextCommand extends Command {
 
   NOT A WORK QUEUE. Nothing is claimed or locked. Two agents running \`inbox next\` on the same inbox get the same email until one of them replies, and both may answer it. Run one agent per inbox, or coordinate outside Primitive.
 
-  --wait blocks until something awaits you. It takes the inbox's newest position before checking, then long-polls from that position, re-checking reply state whenever mail arrives and at least every 30 seconds, so nothing that arrives between the check and the wait is missed.
+  --wait blocks until something awaits you. It takes the inbox's newest position before checking, then long-polls from that position, re-checking reply state whenever mail arrives and at least every 30 seconds, so nothing that arrives between the check and the wait is missed. A rate limit (HTTP 429, honouring Retry-After), a 502, 503 or 504, or a network error during the wait is retried with backoff until --timeout, with one note on stderr per retry; if it lasts until then, the wait exits 5 as if nothing arrived.
 
   --json prints one stable envelope (version 1): \`outcome\` ("email" | "empty" | "error"), \`email\` (id, thread_id, message_id, received_at, from, from_email, to, subject, awaiting, reply_count, last_replied_at, body_text, from_known_address, auth { spf, dmarc }), \`automated\` ({ automated, reasons[], automation_headers_known }, the server's verdict), \`conversation\` (thread_id, subject, message_count, truncated, messages[] with role user|assistant), \`reply_command\`, \`interaction\` ({ hint, kind, fyi, category, plain_reply_completes, no_reply_needed }, decided by the server from a DKIM-authenticated interaction part; null when not reported), \`next_actions\` (the commands that answer the email, best first: each has kind, command, argv, description, placeholders, requires_message; empty when no reply is needed or this CLI cannot answer the interaction), \`automated_awaiting\` ({ total, capped }: automated mail also awaiting a reply, on the empty outcome; null otherwise), and \`error\` ({ code, message }) on failure.
 
@@ -51480,12 +51460,17 @@ var InboxNextCommand = class InboxNextCommand extends Command {
 			process.exitCode = INBOX_NEXT_EXIT_CODES.error;
 		};
 		const deadline = flags.wait && flags.timeout > 0 ? Date.now() + flags.timeout * 1e3 : null;
+		const api = flags.wait ? waitingInboxApi(deadline) : void 0;
 		try {
-			let since = flags.wait ? await baselineCursor({ apiClient }) : null;
+			let since = flags.wait ? await baselineCursor({
+				apiClient,
+				api
+			}) : null;
 			let announcedWait = false;
 			for (;;) {
 				const result = await findNextAwaiting({
 					apiClient,
+					api,
 					includeAutomated: flags["include-automated"]
 				});
 				if (result.outcome === "email" || !flags.wait || since === null) {
@@ -51509,12 +51494,20 @@ var InboxNextCommand = class InboxNextCommand extends Command {
 				const pollStartedAt = Date.now();
 				since = await waitForActivity({
 					apiClient,
+					api,
 					since,
 					seconds: Math.floor(remainingMs / 1e3)
 				});
 				if (since === before && Date.now() - pollStartedAt < 1e3) await sleep$1(1e3);
 			}
 		} catch (error) {
+			if (error instanceof WaitDeadlineReached) {
+				await this.printResult({
+					outcome: "empty",
+					automated_awaiting: null
+				}, bin, flags, apiClient);
+				return;
+			}
 			if (error instanceof ReplyStateUnsupportedError || error instanceof AutomatedFilterUnsupportedError) {
 				fail(error.code, error.message);
 				return;
@@ -52293,6 +52286,15 @@ function openContactRequestNotices(configDir, identity) {
 }
 //#endregion
 //#region src/oclif/conversation-status.ts
+/**
+* An acknowledgement (an `ack` signal, which `primitive reply --fyi` sends)
+* exists so its receiver does not have to act. It never wakes or notifies a
+* session: the event is completed and the message stays readable in its
+* thread. Read, working and typing still reach the session as status.
+*/
+function isQuietConversationStatus(status) {
+	return status.kind === "ack";
+}
 /** A References-derived parent ID cannot prove which Message-ID a signal names. */
 async function readBoundSentMessageId(apiClient, wait, signal) {
 	if (!wait.sentEmailId) return null;
@@ -53026,12 +53028,12 @@ async function runSharedNotificationListen(options) {
 				await store.skipNotification(row.emailId, sessionKey);
 				return true;
 			}
-			if (status && !await conversationStatusDue({
+			if (status && (isQuietConversationStatus(status) || !await conversationStatusDue({
 				configDir: options.configDir,
 				scope,
 				recipient,
 				sessionKey
-			}, status)) {
+			}, status))) {
 				await store.skipNotification(row.emailId, sessionKey);
 				return true;
 			}
@@ -53241,7 +53243,9 @@ async function runStandaloneListen(options) {
 	const random = options.random ?? Math.random;
 	const sleep = options.sleep ?? listenSleep;
 	const stderr = options.stderr ?? process.stderr;
-	const signal = options.signal;
+	const hard = options.signal;
+	const receiving = options.stopReceiving ? AbortSignal.any([hard, options.stopReceiving]) : hard;
+	let signal = receiving;
 	const mode = options.mode ?? "stdout";
 	const events = options.events;
 	if (options.number !== void 0 && (!Number.isSafeInteger(options.number) || options.number < 1)) throw new ListenError("--number must be a positive integer.");
@@ -53398,6 +53402,7 @@ async function runStandaloneListen(options) {
 				continue;
 			}
 			signal.throwIfAborted();
+			signal = hard;
 			let handled;
 			try {
 				handled = await options.handler(delivery, signal);
@@ -53439,6 +53444,7 @@ async function runStandaloneListen(options) {
 				if (!(error instanceof RequestFailure) || error.status !== 409 || error.code !== "stale_delivery") throw error;
 				stderr.write("Delivery ownership expired before confirmation; it may be delivered again.\n");
 			}
+			signal = receiving;
 		}
 	} catch (error) {
 		if (!signal.aborted) throw error;
@@ -53708,6 +53714,7 @@ async function createWakeMail(options) {
 			const sentMessageId = requested && statusContent ? await readBoundSentMessageId(apiClient, requested, signal) : null;
 			if (statusContent && !sentMessageId) return outcome(false);
 			const status = requested ? boundConversationStatus(detail, statusContent, requested, sentMessageId, options.sessionKey) : null;
+			if (status && isQuietConversationStatus(status)) return outcome(true);
 			let admission;
 			let admissionRetry;
 			try {
@@ -53793,14 +53800,16 @@ async function createWakeMail(options) {
 				kind: "mail",
 				context
 			})) return outcome(false);
-			if (admission.kind === "request") pendingRequest = {
-				sender,
-				emailId: detail.id,
-				eventId,
-				decidedSenders: [...policy.members()],
-				context
-			};
-			else {
+			if (admission.kind === "request") {
+				if (pendingRequest) completePending();
+				pendingRequest = {
+					sender,
+					emailId: detail.id,
+					eventId,
+					decidedSenders: [...policy.members()],
+					context
+				};
+			} else {
 				const wake = {
 					wakeId: detail.id,
 					senderRelation: admission.senderRelation,
@@ -53855,6 +53864,11 @@ const RESUME_LOCK_RETRY_MS = 4e3;
 * newer mail) waits for that newer mail before waking for the held one.
 */
 const HELD_WAKE_SETTLE_MS = 5e3;
+/**
+* After a wake, how long the listener keeps taking mail that is already
+* queued, so mail that arrived together is announced together.
+*/
+const WAKE_DRAIN_MS = 1500;
 const MAIL_CHECK_RECORD_MS = 5e3;
 const RESUME_LOCK_RETRY_STEP_MS = 250;
 function isListenLockContention(error) {
@@ -54245,9 +54259,12 @@ var ListenCommand = class ListenCommand extends Command {
 		});
 		let timedOut = false;
 		let lastMailCheckRecord = Number.NEGATIVE_INFINITY;
+		const receiveWindow = new AbortController();
+		const sharedNotify = Boolean(target && flags["notify-session"] && requestConfig);
 		const timer = flags.timeout === void 0 ? void 0 : setTimeout(() => {
 			timedOut = true;
-			controller.abort();
+			receiveWindow.abort();
+			if (sharedNotify) controller.abort();
 		}, flags.timeout * 1e3);
 		const cancel = () => controller.abort();
 		process.on("SIGINT", cancel);
@@ -54291,6 +54308,7 @@ var ListenCommand = class ListenCommand extends Command {
 					socketPath
 				} : void 0,
 				handler: wake?.handler ?? handler,
+				stopReceiving: receiveWindow.signal,
 				stderr: flags.wake ? new Writable({ write(_chunk, _encoding, done) {
 					done();
 				} }) : void 0,
@@ -54318,7 +54336,7 @@ var ListenCommand = class ListenCommand extends Command {
 					for (;;) try {
 						await runListen(settle ? {
 							...options,
-							signal: AbortSignal.any([controller.signal, settle])
+							stopReceiving: AbortSignal.any([receiveWindow.signal, settle])
 						} : options);
 						break;
 					} catch (error) {
@@ -54330,7 +54348,15 @@ var ListenCommand = class ListenCommand extends Command {
 					}
 					wake?.completed();
 					if (settle?.aborted && !controller.signal.aborted) wake?.wakeHeld?.();
-				} while (wake && !wake.wakeId() && !wake.status() && !controller.signal.aborted);
+				} while (wake && !wake.wakeId() && !wake.status() && !controller.signal.aborted && !receiveWindow.signal.aborted);
+				if (wake && hookSessionId && (wake.wakeId() || wake.status()) && !controller.signal.aborted) try {
+					await runListen({
+						...options,
+						number: void 0,
+						stopReceiving: AbortSignal.any([receiveWindow.signal, AbortSignal.timeout(WAKE_DRAIN_MS)])
+					});
+					wake.completed();
+				} catch {}
 			} else {
 				const notify = options.notifySession;
 				let expectedCwd;
@@ -54410,7 +54436,7 @@ var ListenCommand = class ListenCommand extends Command {
 				configDir: this.config.configDir,
 				...auto
 			});
-		} else if (controller.signal.aborted) process.exitCode = timedOut && flags.wake ? 0 : timedOut ? 2 : 130;
+		} else if (controller.signal.aborted || timedOut) process.exitCode = timedOut && flags.wake ? 0 : timedOut ? 2 : 130;
 	}
 };
 //#endregion
@@ -54672,7 +54698,7 @@ var ListenInitCommand = class ListenInitCommand extends Command {
 const UUID$3 = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i;
 var ListenPendingCommand = class ListenPendingCommand extends Command {
 	static summary = "List mail a session's wake listener accepted but not yet read";
-	static description = `Prints the durable pending notices for one Claude Code session of the selected connected profile. A notice is written before its wake event is acknowledged and is removed when the session reads that exact email with \`primitive emails get --id <id>\`. Notices carry only server-derived metadata (sender, thread, whether this profile sent in the thread, newer-mail count), never subject or body. Status notices (kind status) name a peer signal on a message this session sent and have nothing to read; clear them with --clear after delivering them. Unread mail notices are never dropped: at 50 notices the list reports full and newer mail stays queued, unacknowledged, until some are read. Reading never takes the writer lock, so it works while a listener holds it.`;
+	static description = `Prints the durable pending notices for one Claude Code session of the selected connected profile. A notice is written before its wake event is acknowledged and is removed when the session reads that exact email with \`primitive emails get --id <id>\`. Notices carry only server-derived metadata (sender, thread, whether this profile sent in the thread, newer-mail count), never subject or body. Status notices (kind status) name a peer signal on a message this session sent and have nothing to read; clear them with --clear after delivering them. --claim marks exact ids as announced to the session and prints the ids this call claimed as \`claimed\`; receive hooks use it so each email is announced at most once. Past 50 mail notices the oldest announced one gives way; mail the session has not been shown is never dropped, so when all 50 are unannounced the list reports full and newer mail stays queued, unacknowledged. Reading never takes the writer lock, so it works while a listener holds it.`;
 	static examples = ["PRIMITIVE_AGENT_PROFILE=work <%= config.bin %> listen pending --session <claude-session-id>", "PRIMITIVE_AGENT_PROFILE=work <%= config.bin %> listen pending --session <claude-session-id> --clear <email-id>"];
 	static flags = {
 		session: Flags.string({ description: "Claude Code session ID (defaults to CLAUDE_CODE_SESSION_ID in a Claude session)" }),
@@ -54680,6 +54706,11 @@ var ListenPendingCommand = class ListenPendingCommand extends Command {
 			multiple: true,
 			description: "Remove these exact email IDs after delivering them (repeatable)"
 		}),
+		claim: Flags.string({
+			multiple: true,
+			exclusive: ["clear"],
+			description: "Mark these exact email IDs as announced to the session and report which ones this call claimed (repeatable)"
+		}),
 		json: Flags.boolean({ description: "Print JSON (already the default)" })
 	};
 	async run() {
@@ -54692,6 +54723,9 @@ var ListenPendingCommand = class ListenPendingCommand extends Command {
 		if (!session || !UUID$3.test(session)) this.error("Pass --session with the Claude Code session UUID.");
 		const clear = flags.clear ?? [];
 		if (clear.some((id) => !UUID$3.test(id))) this.error("--clear takes exact email UUIDs.");
+		const claim = flags.claim ?? [];
+		if (claim.some((id) => !UUID$3.test(id))) this.error("--claim takes exact email UUIDs.");
+		const claimed = claim.length ? await claimPendingMail(this.config.configDir, profileName, session, claim) : void 0;
 		const notices = clear.length ? await removePendingMail(this.config.configDir, profileName, session, clear) : readPendingMail(this.config.configDir, profileName, session);
 		this.log(JSON.stringify({
 			session_id: session.toLowerCase(),
@@ -54700,6 +54734,7 @@ var ListenPendingCommand = class ListenPendingCommand extends Command {
 			read_command: wakeReadCommand("<id>", profileName),
 			path: pendingMailPath(this.config.configDir, profileName, session),
 			full: notices.length >= 50,
+			...claimed ? { claimed } : {},
 			notices
 		}, null, 2));
 	}
@@ -54852,6 +54887,8 @@ function listenForCopyHotkey(params) {
 //#endregion
 //#region src/oclif/commands/login.ts
 const MAX_CLI_LOGIN_POLL_INTERVAL_SECONDS = 60;
+/** How long a login waits for an in-flight agent registration on this machine. */
+const REGISTRATION_WAIT_MS = 15e3;
 function cliError$3(message) {
 	return new Errors.CLIError(message, { exit: 1 });
 }
@@ -54987,6 +55024,7 @@ var LoginCommand$1 = class extends Command {
 		await this.runBrowserLogin(flags, this.retryCommand());
 	}
 	async runBrowserLogin(flags, retryCommand = this.retryCommand()) {
+		await waitForRegistrations(this.config.configDir, REGISTRATION_WAIT_MS, { onWait: () => process.stderr.write("Waiting a few seconds for this machine's agent registration to finish before changing the login.\n") });
 		let releaseCredentialsLock;
 		try {
 			releaseCredentialsLock = acquireCliCredentialsLock(this.config.configDir);
@@ -56274,7 +56312,7 @@ const TITLES = {
 	"claude.settings_valid": "Claude Code settings file",
 	"claude.hook.session_start": "Claude SessionStart hook",
 	"claude.hook.session_end": "Claude SessionEnd hook",
-	"claude.hook.stop": "Claude per-session receive hooks",
+	"claude.hook.stop": "Claude receive hooks",
 	"claude.instructions": "Claude Code instructions",
 	"codex.hook.session_start": "Codex SessionStart hook",
 	"codex.instructions": "Codex instructions",
@@ -56710,7 +56748,11 @@ async function runMachineDoctor(options) {
 				throw new MachineFileError(`The hook launcher ${cli.launcher?.path ?? ""} could not be written.`);
 			}
 			if (!repaired.changed.size) return id === "claude.hook.stop";
-			writeClaudeSettings({
+			for (const item of repaired.receivers) addSessionReceiver(item.configDir, item.session, {
+				profile: item.profile,
+				address: item.address
+			});
+			if (JSON.stringify(repaired.settings) !== JSON.stringify(settingsRead.settings)) writeClaudeSettings({
 				claudeDir: paths.claudeDir,
 				read: settingsRead.read,
 				settings: repaired.settings,
@@ -59592,7 +59634,7 @@ async function pollForSettlementInteraction(params) {
 		}
 		if (receipt) return receipt;
 		if (deadline !== null && Date.now() >= deadline) break;
-		await sleep$2(params.intervalSeconds * 1e3);
+		await sleep$3(params.intervalSeconds * 1e3);
 	}
 	return null;
 }
@@ -63269,8 +63311,8 @@ function setupChallengeIds(configDir, agent) {
 	const id = savedSetupChallengeId(agentProfileDirectory(configDir, agent.profileName));
 	return id ? [id] : [];
 }
-async function listRows(apiClient, query) {
-	const result = await listEmails({
+async function listRows(api, apiClient, query) {
+	const result = await api.listEmails({
 		client: apiClient.client,
 		query,
 		responseStyle: "fields"
@@ -63282,8 +63324,8 @@ async function listRows(apiClient, query) {
 		cursor: envelope?.meta?.cursor ?? null
 	};
 }
-async function readDetail(apiClient, id) {
-	const result = await getEmail({
+async function readDetail(api, apiClient, id) {
+	const result = await api.getEmail({
 		client: apiClient.client,
 		path: { id },
 		responseStyle: "fields"
@@ -63296,13 +63338,13 @@ async function readDetail(apiClient, id) {
 	const detail = result.data?.data;
 	return detail !== null && typeof detail === "object" ? detail : null;
 }
-async function firstMatch(apiClient, rows, filters, seen) {
+async function firstMatch(api, apiClient, rows, filters, seen) {
 	for (const row of rows) {
 		const id = str(row.id);
 		if (!id || seen.has(id)) continue;
 		seen.add(id);
 		if (!rowMayMatch(row, filters)) continue;
-		const detail = await readDetail(apiClient, id);
+		const detail = await readDetail(api, apiClient, id);
 		if (detail && detailMatches(detail, filters)) return detail;
 	}
 	return null;
@@ -63317,32 +63359,49 @@ function arrivedSince(row, threshold) {
 * the deadline.
 */
 async function waitForEmail(params) {
+	const { deadline } = params;
+	const api = waitingInboxApi(deadline, {
+		getConversation,
+		getEmail,
+		listEmails
+	});
+	try {
+		return await tailForEmail(api, params);
+	} catch (error) {
+		if (error instanceof WaitDeadlineReached) return null;
+		throw error;
+	}
+}
+async function tailForEmail(api, params) {
 	const { apiClient, filters, deadline } = params;
 	const seen = new Set(params.skipIds ?? []);
-	let since = await baselineCursor({ apiClient });
-	const recent = await listRows(apiClient, { limit: EXISTING_PAGE_SIZE });
-	const early = await firstMatch(apiClient, recent.rows.filter((row) => arrivedSince(row, params.startedAt)).reverse(), filters, seen);
+	let since = await baselineCursor({
+		apiClient,
+		api
+	});
+	const recent = await listRows(api, apiClient, { limit: EXISTING_PAGE_SIZE });
+	const early = await firstMatch(api, apiClient, recent.rows.filter((row) => arrivedSince(row, params.startedAt)).reverse(), filters, seen);
 	if (early) return early;
 	if (params.includeExisting) {
-		const found = await firstMatch(apiClient, recent.rows, filters, seen);
+		const found = await firstMatch(api, apiClient, recent.rows, filters, seen);
 		if (found) return found;
 	}
 	for (;;) {
 		const remainingMs = deadline === null ? MAX_LONG_POLL_SECONDS * 1e3 : deadline - Date.now();
 		if (remainingMs <= 0) return null;
 		const startedAt = Date.now();
-		const page = await listRows(apiClient, {
+		const page = await listRows(api, apiClient, {
 			limit: TAIL_PAGE_SIZE,
 			since,
 			wait: Math.max(0, Math.min(MAX_LONG_POLL_SECONDS, Math.floor(remainingMs / 1e3)))
 		});
-		const found = await firstMatch(apiClient, page.rows, filters, seen);
+		const found = await firstMatch(api, apiClient, page.rows, filters, seen);
 		if (found) return found;
 		if (page.rows.length > 0 && page.cursor) {
 			since = page.cursor;
 			continue;
 		}
-		if (Date.now() - startedAt < 1e3) await sleep$2(Math.max(0, Math.min(1e3, remainingMs)));
+		if (Date.now() - startedAt < 1e3) await sleep$3(Math.max(0, Math.min(1e3, remainingMs)));
 	}
 }
 function describeFilters(filters) {
@@ -63364,6 +63423,8 @@ Only mail that arrives after the command starts matches, unless --include-existi
 
 --code prints only the verification or one-time code, with spaces or dashes between its groups removed. --link prints only the most likely verification, sign-in, confirm, magic or reset link, with an obvious click-tracking wrapper removed. Without either, the email is printed: sender, subject, time, its ID and the start of its text, ready for \`primitive reply --id <id>\`. --json prints one object with id, thread_id, from, to, subject, received_at, text and, when asked, code and link (null when none was found).
 
+A rate limit (HTTP 429, honouring Retry-After), a 502, 503 or 504, or a network error during the wait is retried with backoff until --timeout, with one note on stderr per retry; if it lasts until then, the wait times out (exit 5).
+
 Exit codes:
   - 0: a matching email arrived and was printed.
   - 1: error (API failure or authentication).
@@ -64117,10 +64178,10 @@ var WakeSchedulesUpdateCommand = class WakeSchedulesUpdateCommand extends Comman
 };
 //#endregion
 //#region src/oclif/commands/whoami.ts
-function formatWhoamiSummary(account, managedInboxDomain) {
+function formatWhoamiSummary(account, managedInboxDomain, orgName = null) {
 	const lines = [
 		`Authenticated as ${account.email}`,
-		`Account id: ${account.id}`,
+		orgName ? `Organization: ${orgName} (${account.id})` : `Organization id: ${account.id}`,
 		`Plan: ${account.plan}`
 	];
 	if (managedInboxDomain) lines.push(`Managed inbox: any-local-part@${managedInboxDomain}`);
@@ -64209,14 +64270,25 @@ var WhoamiCommand = class WhoamiCommand extends Command {
 				});
 				if (!domainsResult.error) managedInboxDomain = (domainsResult.data?.data ?? []).find((row) => row.verified && row.managed_zone !== null)?.domain ?? null;
 			} catch {}
+			const orgName = auth.credentials?.org_id === account.id ? auth.credentials.org_name ?? null : null;
+			const session = guardedSession(void 0, process.env);
+			let registration = null;
+			try {
+				registration = session ? failedSessionRegistration(this.config.configDir, session) : null;
+			} catch {
+				registration = null;
+			}
 			if (flags.json) {
 				this.log(JSON.stringify({
 					...account,
-					managed_inbox_domain: managedInboxDomain
+					managed_inbox_domain: managedInboxDomain,
+					org_name: orgName,
+					...registration ? { session_registration: registration } : {}
 				}, null, 2));
 				return;
 			}
-			this.log(formatWhoamiSummary(account, managedInboxDomain));
+			this.log(formatWhoamiSummary(account, managedInboxDomain, orgName));
+			if (registration) this.log(registrationSummaryLine(registration));
 		});
 	}
 };