primcli 1.74.1 → 1.75.0

package/dist/{machine-session-B6V5-grn.js → machine-session-Cq_nD5eF.js}

@@ -1,11 +1,11 @@
-import { $t as listDomains, At as getAgentContactPolicy, Dn as sendEmail, Ft as getEmail, Jt as listAgentContacts, Kn as __exportAll, Kt as inviteAgentConnection, Xt as listContacts, cn as listSentEmails, gn as putContact, hn as putAgentContactPolicy, jt as getContact, mn as putAgentContact, qt as listAgentConnections, vt as deleteAgentContact, wn as searchEmails, yt as deleteContact } from "./repeats-BL7ZC-_6-B_ESsWTH.js";
-import { B as parseConnectedAgentProfile, F as agentProfileName, G as PrimitiveApiClient, H as profileAlreadyConnectedMessage, I as agentProfilesDirectory, L as connectedAgentIdentity, M as AGENT_PROFILE_ENV, N as AgentConnectionSetupError, P as agentProfileDirectory, R as connectedApiBaseUrl, V as parseOwnerMemberAddress, W as saveConnectedAgentProfile, x as loadCliCredentials, z as loadConnectedAgentProfile } from "./cli-config-C0Y_Ppol.js";
-import { _ as acquireListenLock, b as listenLockHeld, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString } from "./shared-mail-files-CZfm7E2k.js";
-import { gt as defaultConnectionName, jt as refreshStoredCliCredentials, mt as cliInvocation } from "./api-command-fKP3NYa7.js";
-import { _ as detectAgentRuntime, a as NotificationRetryError, d as defaultSessionSocket, f as NativeSessionDisconnectedError, l as SESSION_UUID, t as notificationScope, u as connectNativeSession, v as installConnectSkill, x as readBundledConnectSkill } from "./notify-session-DJAb9SGm.js";
-import { o as scopedChatSenderTrust } from "./scoped-chat-DAiOb622.js";
-import { l as stopBackgroundListen, r as backgroundListenStatus } from "./listen-background-cD6n8VYO.js";
-import { t as readSharedMailOwner } from "./shared-mail-watch-DyQB0MK0.js";
+import { B as parseConnectedAgentProfile, F as agentProfileName, G as PrimitiveApiClient, H as profileAlreadyConnectedMessage, I as agentProfilesDirectory, L as connectedAgentIdentity, M as AGENT_PROFILE_ENV, N as AgentConnectionSetupError, P as agentProfileDirectory, R as connectedApiBaseUrl, V as parseOwnerMemberAddress, W as saveConnectedAgentProfile, x as loadCliCredentials, z as loadConnectedAgentProfile } from "./cli-config-B80p0pLk.js";
+import { $t as listDomains, At as getAgentContactPolicy, Dn as sendEmail, Ft as getEmail, Jt as listAgentContacts, Kn as __exportAll, Kt as inviteAgentConnection, Xt as listContacts, cn as listSentEmails, gn as putContact, hn as putAgentContactPolicy, jt as getContact, mn as putAgentContact, qt as listAgentConnections, vt as deleteAgentContact, wn as searchEmails, yt as deleteContact } from "./repeats-Dj_o6c-X-LyCkKYjp.js";
+import { Pt as refreshStoredCliCredentials, gt as defaultConnectionName, mt as cliInvocation, xt as detectAgentRuntime } from "./api-command-rlS3eTlZ.js";
+import { _ as acquireListenLock, b as listenLockHeld, c as mailTime, d as readMailJson, f as removeMailFile, g as ListenStateError, h as writeMailJson, i as mailId, l as privateMailDirectory, o as mailObject, p as syncMailDirectory, r as mailAddress, s as mailString } from "./shared-mail-files-BAQSGxxz.js";
+import { _ as installConnectSkill, a as NotificationRetryError, b as readBundledConnectSkill, d as defaultSessionSocket, f as NativeSessionDisconnectedError, l as SESSION_UUID, t as notificationScope, u as connectNativeSession } from "./notify-session-CbY4FYUt.js";
+import { l as stopBackgroundListen, r as backgroundListenStatus } from "./listen-background-C0F9gNDD.js";
+import { t as readSharedMailOwner } from "./shared-mail-watch-BAPMsFNv.js";
+import { o as scopedChatSenderTrust } from "./scoped-chat-B0thCwME.js";
 import { accessSync, chmodSync, closeSync, constants, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID } from "node:crypto";
 import { basename, delimiter, dirname, isAbsolute, join, resolve } from "node:path";
@@ -14,7 +14,7 @@ import { execFile, execFileSync, spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { promisify } from "node:util";
 import { createConnection } from "node:net";
-//#region src/oclif/owner-member-address.ts
+// src/oclif/owner-member-address.ts
 const REFRESH_TIMEOUT_MS = 5e3;
 const MAX_RESPONSE_BYTES$1 = 65536;
 /** Reads at most MAX_RESPONSE_BYTES, stopping as soon as the body exceeds it. */
@@ -145,8 +145,7 @@ async function withOwnerMemberAddress(result, params) {
 		ownerReportGuidance: ownerReportGuidance(identity)
 	};
 }
-//#endregion
-//#region src/oclif/claude-session-receivers.ts
+// src/oclif/claude-session-receivers.ts
 const FILE = /^([0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12})\.json$/;
 const LOCK_WAIT$2 = new Int32Array(new SharedArrayBuffer(4));
 function sessionReceiversDirectory(configDir) {
@@ -285,8 +284,7 @@ function pruneSessionReceivers(configDir) {
 	}
 	return dropped;
 }
-//#endregion
-//#region src/oclif/hook-launcher.ts
+// src/oclif/hook-launcher.ts
 /**
 * Claude Code hooks run Primitive through a small POSIX launcher instead of a
 * pinned Node binary. A version manager (nvm, n, asdf) or a package-runner
@@ -468,8 +466,7 @@ function readHookLauncherWarning(configDir) {
 		return null;
 	}
 }
-//#endregion
-//#region src/oclif/machine-files.ts
+// src/oclif/machine-files.ts
 /** Hand-edited files larger than this are reported, never rewritten. */
 const MAX_MANAGED_FILE_BYTES = 1048576;
 /** Backups kept per file; older Primitive backups of the same file are pruned. */
@@ -695,8 +692,7 @@ function upsertManagedBlock(text, body) {
 function jsonIndentation(text) {
 	return /^[{[][^\n]*\n([ \t]+)\S/.exec(text)?.[1] ?? 2;
 }
-//#endregion
-//#region src/oclif/claude-machine-hooks.ts
+// src/oclif/claude-machine-hooks.ts
 function record$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -1556,8 +1552,7 @@ function repairClaudeHooks(settings, context, checks, options = {}) {
 		receivers
 	};
 }
-//#endregion
-//#region src/oclif/claude-wake-install.ts
+// src/oclif/claude-wake-install.ts
 const RECEIVE_EVENTS = [
 	"Stop",
 	"SessionStart",
@@ -1846,8 +1841,7 @@ function uninstallClaudeWakeHook(options) {
 		return false;
 	}
 }
-//#endregion
-//#region src/oclif/session-records.ts
+// src/oclif/session-records.ts
 const MACHINE_RUNTIMES = [
 	"claude",
 	"codex",
@@ -2016,8 +2010,7 @@ async function releaseRegistrationsForProfile(params) {
 		} catch {}
 	}
 }
-//#endregion
-//#region src/oclif/agent-connect.ts
+// src/oclif/agent-connect.ts
 const MAX_INVITATION_BYTES = 4096;
 const MAX_RESPONSE_BYTES = 32768;
 const UNCERTAIN_CLAIM = "Setup did not complete safely. The invitation may have been consumed. Request a fresh invitation from the owner; do not retry this invitation.";
@@ -2104,6 +2097,22 @@ function removeEmptyDirectory(path) {
 		rmdirSync(path);
 	} catch {}
 }
+const CONNECTION_ID = /^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+/** The whole of one setup challenge marker; its first group is the connection id. */
+const CHALLENGE_MARKER = /^primitive-connection:([a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}):[1-9]\d*$/;
+/** The challenge hints a claim response carries. Unusable values are dropped. */
+function claimedChallenge(value) {
+	const data = value?.data;
+	const connection = data?.connection;
+	const connectionId = typeof connection?.id === "string" && CONNECTION_ID.test(connection.id) ? connection.id : void 0;
+	const claimedAt = typeof connection?.claimed_at === "string" ? Date.parse(connection.claimed_at) : NaN;
+	const marker = typeof data?.challenge_marker === "string" ? CHALLENGE_MARKER.exec(data.challenge_marker) : null;
+	return {
+		...marker && (!connectionId || marker[1] === connectionId) ? { marker: marker[0] } : {},
+		...connectionId ? { connectionId } : {},
+		...Number.isFinite(claimedAt) ? { claimedAt: new Date(claimedAt).toISOString() } : {}
+	};
+}
 const CONNECTION_NAME_FILE = "connection-name.json";
 /**
 * The display name this profile's claim reported, saved beside the profile
@@ -2409,6 +2418,7 @@ async function connectAgent(params) {
 			const body = await readClaimResponse(response);
 			const profile = profileFromClaim(body, invitation, invitationHash, params.now ?? Date.now);
 			const name = claimedConnectionName(body);
+			const challenge = claimedChallenge(body);
 			saveConnectedAgentProfile(params.configDir, profileName, profile);
 			try {
 				await releaseRegistrationsForClaim({
@@ -2430,7 +2440,8 @@ async function connectAgent(params) {
 			return {
 				status: "claimed",
 				identity: connectedAgentIdentity(profileName, profile),
-				...name === void 0 ? {} : { name }
+				...name === void 0 ? {} : { name },
+				...Object.keys(challenge).length ? { challenge } : {}
 			};
 		} catch (error) {
 			if (error instanceof AgentInvitationRejectedError) throw error;
@@ -2440,8 +2451,7 @@ async function connectAgent(params) {
 		release();
 	}
 }
-//#endregion
-//#region src/oclif/contacts.ts
+// src/oclif/contacts.ts
 var ContactsApiError = class extends Error {
 	payload;
 	directoryAvailable = false;
@@ -2638,8 +2648,7 @@ async function runContactRequest(client, request) {
 		throw error;
 	}
 }
-//#endregion
-//#region src/oclif/address-notes.ts
+// src/oclif/address-notes.ts
 var AddressNotesApiError = class extends Error {
 	payload;
 	status;
@@ -2772,8 +2781,7 @@ async function runAddressNotesRequest(client, request) {
 	if (!data || typeof data !== "object" || Array.isArray(data) || typeof data.deleted !== "boolean") throw new Error("The address notes API returned an invalid deletion response.");
 	return data;
 }
-//#endregion
-//#region src/oclif/agent-resume-note.ts
+// src/oclif/agent-resume-note.ts
 /**
 * The address note holding the command that resumes the coding session an
 * agent is bound to, so an app can offer to reopen that exact session.
@@ -2886,8 +2894,7 @@ async function clearProfileResumeNote(options) {
 		return "failed";
 	}
 }
-//#endregion
-//#region src/oclif/agent-disconnect.ts
+// src/oclif/agent-disconnect.ts
 var AgentDisconnectError = class extends Error {};
 /** The profile no longer holds the credential the caller expected to revoke. */
 var AgentCredentialChangedError = class extends AgentDisconnectError {};
@@ -3185,8 +3192,7 @@ async function clearRevokedAddresses(params) {
 		cleared
 	};
 }
-//#endregion
-//#region src/oclif/agent-setup-read.ts
+// src/oclif/agent-setup-read.ts
 function retryDelay(response, attempt, now) {
 	const raw = response?.headers.get("retry-after")?.trim();
 	if (raw && /^\d+(?:\.\d+)?$/.test(raw)) {
@@ -3223,8 +3229,7 @@ async function readSetupApi(budget, stage, read) {
 		budget.retries++;
 	}
 }
-//#endregion
-//#region src/oclif/contact-rule-matcher.ts
+// src/oclif/contact-rule-matcher.ts
 const localPart = /^[a-z0-9!#$%&'+/=^_`{|}~-]+(?:\.[a-z0-9!#$%&'+/=^_`{|}~-]+)*$/;
 const patternPart = /^[a-z0-9.!#$%&'+/=^_`{|}~*-]+$/;
 const label = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -3301,8 +3306,7 @@ function matchesContactSelector(input, sender) {
 	const [localPattern, hostPattern] = splitAddress(selector.value) ?? [];
 	return Boolean(localPattern && hostPattern && matchesDomain(hostPattern, host) && matchesLocal(localPattern, local));
 }
-//#endregion
-//#region src/oclif/contact-policy.ts
+// src/oclif/contact-policy.ts
 function record(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid contact policy.");
 	return value;
@@ -3638,8 +3642,7 @@ function createNotificationContactPolicy(options) {
 		}
 	};
 }
-//#endregion
-//#region src/oclif/registration-log.ts
+// src/oclif/registration-log.ts
 /**
 * A short private record of this profile's registration attempts, so a
 * stuck registration can be explained by `agent connect --status` and
@@ -3772,8 +3775,7 @@ function failedSessionRegistration(configDir, session) {
 	const summary = registrationSummary(configDir, profile);
 	return summary?.lastFailure ? summary : null;
 }
-//#endregion
-//#region src/oclif/agent-setup.ts
+// src/oclif/agent-setup.ts
 const SUBJECT = "Connect your agent to Primitive";
 const MARKER = /\bprimitive-connection:([a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}):([1-9]\d*)\b/g;
 const fail = (message) => new AgentConnectionSetupError(message);
@@ -3869,6 +3871,32 @@ async function checkVerification(context, timeoutMs) {
 		return { state: "unavailable" };
 	}
 }
+async function readClaim(context) {
+	try {
+		const response = await context.fetch(`${context.profile.api_base_url}/agent-connections/me`, {
+			method: "GET",
+			redirect: "error",
+			signal: AbortSignal.timeout(5e3),
+			headers: {
+				authorization: `Bearer ${context.profile.api_key}`,
+				accept: "application/json"
+			}
+		});
+		if (response.status !== 200) {
+			await response.body?.cancel();
+			return {};
+		}
+		const text = await response.text();
+		if (text.length > 65536) return {};
+		const body = JSON.parse(text);
+		const address = body?.data?.connection?.address;
+		if (body?.success !== true || typeof address !== "string" || address.toLowerCase() !== context.identity.agentAddress.toLowerCase()) return {};
+		const { marker: _marker, ...hint } = claimedChallenge(body);
+		return hint;
+	} catch {
+		return {};
+	}
+}
 /**
 * Poll until the server reports the connection verified, the budget runs out,
 * or the status read is unavailable. Elapsed time is the larger of the clock
@@ -3892,8 +3920,41 @@ async function awaitVerification(context, dependencies, timeoutMs) {
 		waited += wait;
 	}
 }
+const OPTIONAL_STATE_KEYS = [
+	"receiverMode",
+	"challengeMarker",
+	"challengeConnectionId"
+];
+/**
+* How far before the claim's server time the search starts. With the exact
+* marker the window only bounds the search, so it allows generous skew
+* between the database and the mail pipeline clocks. Without it the window
+* is what excludes an earlier challenge, so it starts at the claim itself:
+* the server sends the challenge only after the claim commits.
+*/
+const MARKER_WINDOW_MS = 6e4;
+/**
+* Points this setup at the challenge its claim started. Leaves the state
+* unchanged when the claim said too little, which keeps the earlier rule.
+*/
+function narrowToClaim(state, claim) {
+	const claimedAt = claim?.claimedAt ? Date.parse(claim.claimedAt) : NaN;
+	if (claim?.marker) {
+		state.challengeMarker = claim.marker;
+		if (Number.isFinite(claimedAt)) state.since = (/* @__PURE__ */ new Date(claimedAt - MARKER_WINDOW_MS)).toISOString();
+	} else if (claim?.connectionId && Number.isFinite(claimedAt)) {
+		state.challengeConnectionId = claim.connectionId;
+		state.since = new Date(claimedAt).toISOString();
+	}
+}
+function expectedChallenge(state) {
+	return {
+		...state.challengeMarker ? { marker: state.challengeMarker } : {},
+		...state.challengeConnectionId ? { connectionId: state.challengeConnectionId } : {}
+	};
+}
 function parseState(value) {
-	const keys = [
+	const row = mailObject(value, [...[
 		"version",
 		"session",
 		"invitationHash",
@@ -3902,9 +3963,8 @@ function parseState(value) {
 		"challenge",
 		"phase",
 		"receipt"
-	];
-	const row = mailObject(value, value && typeof value === "object" && Object.hasOwn(value, "receiverMode") ? [...keys, "receiverMode"] : keys);
-	if (row.version !== 1 || row.receiverMode !== void 0 && !RECEIVER_MODES.includes(row.receiverMode) || typeof row.contactRequests !== "boolean" || ![
+	], ...OPTIONAL_STATE_KEYS.filter((key) => value && typeof value === "object" && Object.hasOwn(value, key))]);
+	if (row.version !== 1 || row.challengeMarker !== void 0 && (typeof row.challengeMarker !== "string" || !CHALLENGE_MARKER.test(row.challengeMarker)) || row.challengeConnectionId !== void 0 && (typeof row.challengeConnectionId !== "string" || !CONNECTION_ID.test(row.challengeConnectionId)) || row.receiverMode !== void 0 && !RECEIVER_MODES.includes(row.receiverMode) || typeof row.contactRequests !== "boolean" || ![
 		"waiting",
 		"sending",
 		"sent"
@@ -3930,23 +3990,28 @@ function parseState(value) {
 			messageId: mailString(challenge.messageId, 1e3),
 			marker: mailString(challenge.marker, 100)
 		} : null,
-		receipt
+		receipt,
+		...typeof row.challengeMarker === "string" ? { challengeMarker: row.challengeMarker } : {},
+		...typeof row.challengeConnectionId === "string" ? { challengeConnectionId: row.challengeConnectionId } : {}
 	};
 	if (state.phase !== "waiting" && !state.challenge || state.phase === "sent" && !state.receipt) throw fail("Saved setup progress is inconsistent. Preserve its private files.");
 	return state;
 }
 /** Match only authenticated owner mail. Subject/search results alone grant no authority. */
-function setupChallenge(detail, identity, since) {
+function setupChallenge(detail, identity, since, expected = {}) {
 	if (detail.subject !== SUBJECT || detail.recipient.toLowerCase() !== identity.agentAddress || detail.to_email.toLowerCase() !== identity.agentAddress || !["accepted", "completed"].includes(detail.status) || !detail.message_id || /[\r\n]/.test(detail.message_id) || detail.parsed?.status !== "complete" || Date.parse(detail.received_at) < Date.parse(since) || !Number.isFinite(Date.parse(detail.received_at)) || !scopedChatSenderTrust(detail, identity.ownerAddress).trusted) return null;
 	const markers = [...new Set((detail.body_text ?? "").match(MARKER) ?? [])];
 	if (markers.length !== 1) return null;
+	const marker = markers[0] ?? "";
+	if (expected.marker && marker !== expected.marker) return null;
+	if (expected.connectionId && !marker.startsWith(`primitive-connection:${expected.connectionId}:`)) return null;
 	return {
 		id: mailId(detail.id),
 		messageId: detail.message_id,
 		marker: markers[0] ?? ""
 	};
 }
-async function findChallenge(context, since) {
+async function findChallenge(context, since, expected = {}) {
 	const page = await readSetupApi(context.readBudget, "challenge search", (signal) => searchEmails({
 		client: context.client.client,
 		query: {
@@ -3971,8 +4036,14 @@ async function findChallenge(context, since) {
 			responseStyle: "fields"
 		}));
 		if (response.error || !response.data?.data) throw fail("The setup challenge could not be read. Resume this profile; do not claim again.");
-		const match = setupChallenge(response.data.data, context.identity, since);
-		if (match) matches.push(match);
+		const match = setupChallenge(response.data.data, context.identity, since, expected);
+		if (match && !matches.some((seen) => seen.messageId === match.messageId && seen.marker === match.marker)) matches.push(match);
+	}
+	if (expected.connectionId && !expected.marker && matches.length > 1) {
+		const generation = (row) => Number(row.marker.slice(row.marker.lastIndexOf(":") + 1));
+		const top = Math.max(...matches.map(generation));
+		const current = matches.filter((row) => generation(row) === top);
+		if (current.length === 1) return current[0] ?? null;
 	}
 	if (matches.length > 1) throw fail("Several recent setup challenges match. No challenge was guessed or answered. Ask the owner to confirm the current challenge.");
 	return matches[0] ?? null;
@@ -4061,6 +4132,7 @@ async function nativeSessionPreflight(session) {
 function defaults$1() {
 	return {
 		checkVerification,
+		readClaim,
 		now: Date.now,
 		sleep: async (ms) => {
 			await setTimeout$1(ms);
@@ -4240,6 +4312,8 @@ async function setupAgent(params) {
 	};
 	let discardStub = false;
 	let claimedName;
+	let claimedChallengeHint;
+	let claimedThisRun = false;
 	const takeEnrollment = () => {
 		try {
 			releaseEnrollment = acquireListenLock(join(directory, "enrollment"), ENROLLMENT_LOCK_SCOPE);
@@ -4298,7 +4372,7 @@ async function setupAgent(params) {
 				writeMailJson(path, state);
 			}
 			try {
-				claimedName = (await connectAgent({
+				const claim = await connectAgent({
 					configDir: params.configDir,
 					profileName,
 					invitation: params.invitation ?? "",
@@ -4306,7 +4380,10 @@ async function setupAgent(params) {
 					presence: true,
 					claimLockHeld: releaseClaim !== void 0,
 					claimLockWaitMs: params.claimLockWaitMs ?? CLAIM_LOCK_WAIT_MS
-				})).name;
+				});
+				claimedName = claim.name;
+				claimedChallengeHint = claim.challenge;
+				claimedThisRun = claim.status === "claimed";
 				if (retireEnrollment) moveAside(join(directory, "enrollment", "state.json"), new Date(dependencies.now()));
 				if (replacedUnfinished?.address) appendRegistrationLog(params.configDir, profileName, {
 					event: "replaced_unfinished",
@@ -4334,6 +4411,12 @@ async function setupAgent(params) {
 				releaseClaim = void 0;
 			}
 		}
+		if (state && claimedChallengeHint) {
+			narrowToClaim(state, claimedChallengeHint);
+			try {
+				writeMailJson(join(directory, "setup.json"), state);
+			} catch {}
+		}
 		const profile = loadConnectedAgentProfile(params.configDir, profileName);
 		if (!profile) throw fail(unfinishedSetupStep(pendingEnrollmentAddress(directory)));
 		if (!state || profile.invitation_hash !== state.invitationHash) throw fail("The claim has no matching saved credential. Preserve private state and request a fresh invitation; do not replay this one.");
@@ -4394,15 +4477,18 @@ async function setupAgent(params) {
 			state.phase = "sent";
 			writeMailJson(path, state);
 		}
+		if (state.phase === "waiting" && !claimedThisRun && !state.challengeMarker && !state.challengeConnectionId) narrowToClaim(state, await dependencies.readClaim(context));
 		if (state.phase === "waiting") {
 			const deadline = dependencies.now() + timeoutMs;
 			do {
-				state.challenge = await dependencies.findChallenge(context, state.since);
+				state.challenge = await dependencies.findChallenge(context, state.since, expectedChallenge(state));
 				if (state.challenge || dependencies.now() >= deadline) break;
 				await dependencies.sleep(Math.min(1500, deadline - dependencies.now()));
 			} while (dependencies.now() <= deadline);
 			if (!state.challenge) return result("not_started");
 			state.phase = "sending";
+			delete state.challengeMarker;
+			delete state.challengeConnectionId;
 			writeMailJson(path, state);
 			try {
 				state.receipt = parseReceipt(await dependencies.sendVerification({
@@ -4432,8 +4518,7 @@ async function setupAgent(params) {
 		if (discardStub) removeEmptyDirectory(directory);
 	}
 }
-//#endregion
-//#region src/oclif/agent-connect-flow.ts
+// src/oclif/agent-connect-flow.ts
 /** What this CLI version can do in one `agent connect --session` call. */
 const AGENT_CONNECT_CAPABILITIES = [
 	"invitation_claim_from_stdin",
@@ -4885,8 +4970,7 @@ async function runAgentConnect(options) {
 		externalHook
 	};
 }
-//#endregion
-//#region src/oclif/agent-enroll.ts
+// src/oclif/agent-enroll.ts
 const RESPONSE_LIMIT = 32768;
 const CONNECTION_LIST_LIMIT = 131072;
 const CONFIRMATION_BUDGET_MS = 12e4;
@@ -5634,32 +5718,8 @@ async function enrollAgent(params) {
 		release();
 	}
 }
-//#endregion
-//#region src/oclif/machine-session.ts
-var machine_session_exports = /* @__PURE__ */ __exportAll({
-	HOOK_END_GRACE_MS: () => HOOK_END_GRACE_MS,
-	OMP_MAIN: () => OMP_MAIN,
-	RECONNECT_HINT: () => RECONNECT_HINT,
-	STALE_SESSION_MS: () => STALE_SESSION_MS,
-	agentConnectionState: () => agentConnectionState,
-	agentInfoForSession: () => agentInfoForSession,
-	connectedProfilesForSession: () => connectedProfilesForSession,
-	defaultSessionName: () => defaultSessionName,
-	endSession: () => endSession,
-	headlessClaudeRun: () => headlessClaudeRun,
-	ompProcessSession: () => ompProcessSession,
-	pendingSessionDisconnects: () => pendingSessionDisconnects,
-	psProcessInfo: () => psProcessInfo,
-	readClaudeHookInput: () => readClaudeHookInput,
-	registerSession: () => registerSession,
-	retryPendingDisconnects: () => retryPendingDisconnects,
-	revokeStaleSessionAgents: () => revokeStaleSessionAgents,
-	revokeWithMemberLogin: () => revokeWithMemberLogin,
-	runDetached: () => runDetached,
-	runtimeSessionId: () => runtimeSessionId,
-	staleSessionAgents: () => staleSessionAgents,
-	workspaceName: () => workspaceName
-});
+// src/oclif/machine-session.ts
+var machine_session_exports = /* @__PURE__ */ __exportAll({ connectedProfilesForSession: () => connectedProfilesForSession });
 /** The repository (or directory) a session works in, for its default name. */
 function workspaceName(cwd) {
 	let current = resolve(cwd);
@@ -6406,13 +6466,6 @@ async function registerSession(options) {
 * within this window cancels the end.
 */
 const HOOK_END_GRACE_MS = 3e5;
-/**
-* How long an ended session keeps the agent `session-register` created for
-* it. A session that has not started again for this long has its agent
-* disconnected by `machine doctor --fix` or the next registration on this
-* machine, so closed sessions do not keep live credentials forever.
-*/
-const STALE_SESSION_MS = 2592e6;
 /** The end of this record is a hook's, still waiting. */
 function deferredEnd(record) {
 	return Boolean(record?.endedAt) && record?.disconnect === "deferred";
@@ -6771,5 +6824,4 @@ async function runDetached(params) {
 		return "failed";
 	}
 }
-//#endregion
 export { saveConnectionName as $, ContactPolicyReadRetryError as A, AddressNotesApiError as B, RECEIVER_MODES as C, upsertManagedBlock as Ct, registrationSummary as D, refreshOwnerMemberAddressPeriodically as Dt, failedSessionRegistration as E, addSessionReceiver as Et, canonicalContactSelector as F, contactAgentAddress as G, runAddressNotesRequest as H, AgentDisconnectError as I, agentInvitationHash as J, runContactRequest as K, claimOverRevokedSetup as L, NetworkAdmissionPendingError as M, createNotificationContactPolicy as N, registrationSummaryLine as O, withOwnerMemberAddress as Ot, evaluateContactPolicy as P, refusalAfterReplacement as Q, clearRevokedAddresses as R, runAgentConnect as S, readManagedFile as St, verificationReplySubmitted as T, readHookLauncherWarning as Tt, ContactsApiError as U, addressNoteTarget as V, contactAddress as W, readAgentInvitation as X, connectAgent as Y, receiverStatusCommand as Z, enrollmentResumes as _, samePath as _t, endSession as a, boundSessionProfiles as at, invitationProfileName as b, inspectManagedBlock as bt, pendingSessionDisconnects as c, describeSessionHookChange as ct, registerSession as d, ephemeralCliReason as dt, savedReceiver as et, retryPendingDisconnects as f, findOnPath as ft, enrollAgent as g, repairClaudeHooks as gt, staleSessionAgents as h, readClaudeSettings as ht, connectedProfilesForSession as i, recordHookMailCheck as it, NETWORK_ADMISSION_PENDING_RETRY_MS as j, waitForRegistrations as k, psProcessInfo as l, describeSessionHookItem as lt, runDetached as m, inspectClaudeHooks as mt, OMP_MAIN as n, releaseRegistrationsForProfile as nt, headlessClaudeRun as o, claudeConfigDir as ot, revokeStaleSessionAgents as p, hasMachineSessionHooks as pt, agentConnectionStatus as q, agentConnectionState as r, installClaudeWakeHook as rt, machine_session_exports as s, currentCliLocation as st, HOOK_END_GRACE_MS as t, MACHINE_RUNTIMES as tt, readClaudeHookInput as u, ensureHookLauncher as ut, connectWarnings as v, writeClaudeSettings as vt, externalReceivingState as w, writeManagedFile as wt, pollCheckCommand as x, jsonIndentation as xt, defaultAgentProfileName as y, MachineFileError as yt, disconnectAgent as z };

package/dist/{notify-session-DJAb9SGm.js → notify-session-CbY4FYUt.js}

@@ -1,6 +1,6 @@
-import { Et as downloadEmailAttachmentPart, J as parseWebhookEvent, K as isEmailReceivedEvent, c as classifySignalContent, q as isTrustedSender } from "./repeats-BL7ZC-_6-B_ESsWTH.js";
-import { _ as acquireListenLock, g as ListenStateError, y as listenIdentity } from "./shared-mail-files-CZfm7E2k.js";
-import { B as wakeInteractionSentence, T as wakeReadCommand, w as skillFirstLine } from "./api-command-fKP3NYa7.js";
+import { Et as downloadEmailAttachmentPart, J as parseWebhookEvent, K as isEmailReceivedEvent, c as classifySignalContent, q as isTrustedSender } from "./repeats-Dj_o6c-X-LyCkKYjp.js";
+import { B as wakeInteractionSentence, T as wakeReadCommand, w as skillFirstLine } from "./api-command-rlS3eTlZ.js";
+import { _ as acquireListenLock, g as ListenStateError, y as listenIdentity } from "./shared-mail-files-BAQSGxxz.js";
 import { closeSync, copyFileSync, existsSync, fsyncSync, lstatSync, mkdirSync, openSync, opendirSync, readFileSync, readdirSync, readlinkSync, renameSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { createHash, randomUUID, scryptSync } from "node:crypto";
 import { dirname, isAbsolute, join, normalize, resolve } from "node:path";
@@ -8,22 +8,8 @@ import { homedir } from "node:os";
 import { lstat, realpath } from "node:fs/promises";
 import { isDeepStrictEqual } from "node:util";
 import WebSocket from "ws";
-//#region src/oclif/connect-skill.ts
+// src/oclif/connect-skill.ts
 const CONNECT_SKILL_NAME = "primitive-connect";
-const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-/**
-* The runtime whose tool environment names this exact session. A session ID
-* that matches neither runtime's variable has no detectable runtime.
-*/
-function detectAgentRuntime(session, env = process.env) {
-	const wanted = session.toLowerCase();
-	const claude = env.CLAUDE_CODE_SESSION_ID?.trim().toLowerCase();
-	const codex = (env.CODEX_THREAD_ID?.trim() || env.CODEX_SESSION_ID?.trim())?.toLowerCase();
-	if (!UUID.test(wanted)) return null;
-	if (claude === wanted && codex !== wanted) return "claude";
-	if (codex === wanted && claude !== wanted) return "codex";
-	return null;
-}
 function connectSkillTarget(options) {
 	const env = options.env ?? process.env;
 	const cwd = resolve(options.cwd ?? process.cwd());
@@ -288,8 +274,7 @@ function installConnectSkill(options) {
 		};
 	}
 }
-//#endregion
-//#region src/oclif/notify-session-errors.ts
+// src/oclif/notify-session-errors.ts
 var NativeSessionError = class extends ListenStateError {
 	submitted;
 	constructor(message, submitted = false) {
@@ -315,8 +300,7 @@ var NotificationOutcomeUnknownError = class extends NativeSessionError {
 		super(message, true);
 	}
 };
-//#endregion
-//#region src/oclif/notify-session-native.ts
+// src/oclif/notify-session-native.ts
 /** Codex explicitly refused this input before adding it to the turn queue. */
 var NativeTurnNotSubmittedError = class extends NativeSessionError {
 	constructor() {
@@ -580,8 +564,7 @@ async function connectNativeSession(options) {
 		}
 	};
 }
-//#endregion
-//#region src/oclif/notify-session-content.ts
+// src/oclif/notify-session-content.ts
 var NotificationRetryError = class extends ListenStateError {};
 function notificationPartReader(client) {
 	return async (emailId, partIndex, signal) => {
@@ -683,8 +666,7 @@ async function classifyNotificationContent(email, readPart, signal) {
 	if (classification.classification === "unavailable") throw new NotificationRetryError("Interaction classification is unavailable; retrying through the delivery queue.");
 	return classification;
 }
-//#endregion
-//#region src/oclif/notify-session-state.ts
+// src/oclif/notify-session-state.ts
 const invalid = () => new ListenStateError("Notification receipts are unavailable or inconsistent. Preserve this state to avoid duplicate notifications.");
 function uuid(value) {
 	if (typeof value !== "string" || !SESSION_UUID.test(value)) throw invalid();
@@ -934,8 +916,7 @@ function notificationReceiptPage(configDir, scope, threadId, options = {}) {
 		nextCursor: hasMore ? ids.at(-1) ?? null : null
 	};
 }
-//#endregion
-//#region src/oclif/notify-session.ts
+// src/oclif/notify-session.ts
 function notificationScope(origin, apiKey) {
 	if (!apiKey?.startsWith("pconn_")) throw new ListenStateError("--notify-session requires a connected-agent credential scoped to its own address.");
 	return listenIdentity(origin, `connection:${scryptSync(apiKey, "primitive-listener-identity-v1", 32).toString("hex")}`);
@@ -1133,5 +1114,4 @@ async function openSessionNotifications(options) {
 }
 var ContactNoticeSuppressed = class extends Error {};
 var ContactNoticeDeferred = class extends Error {};
-//#endregion
-export { detectAgentRuntime as _, NotificationRetryError as a, installedVersion as b, readConversationStatusContent as c, defaultSessionSocket as d, NativeSessionDisconnectedError as f, connectSkillTarget as g, NotificationOutcomeUnknownError as h, notificationReceiptPage as i, SESSION_UUID as l, NativeSessionNotLoadedError as m, notificationSenders as n, isRoutineNotificationContent as o, NativeSessionError as p, openSessionNotifications as r, notificationPartReader as s, notificationScope as t, connectNativeSession as u, installConnectSkill as v, readBundledConnectSkill as x, installedConnectSkillFile as y };
+export { installConnectSkill as _, NotificationRetryError as a, readBundledConnectSkill as b, readConversationStatusContent as c, defaultSessionSocket as d, NativeSessionDisconnectedError as f, connectSkillTarget as g, NotificationOutcomeUnknownError as h, notificationReceiptPage as i, SESSION_UUID as l, NativeSessionNotLoadedError as m, notificationSenders as n, isRoutineNotificationContent as o, NativeSessionError as p, openSessionNotifications as r, notificationPartReader as s, notificationScope as t, connectNativeSession as u, installedConnectSkillFile as v, installedVersion as y };

package/dist/oclif/auto-signal-worker.js

@@ -1,11 +1,11 @@
-import { Ut as getSentEmail } from "../repeats-BL7ZC-_6-B_ESsWTH.js";
-import { _ as acquireListenLock } from "../shared-mail-files-CZfm7E2k.js";
-import { b as readThreadContext, kt as createAuthenticatedCliApiClient } from "../api-command-fKP3NYa7.js";
-import { t as sendSignal } from "../signal-command-Cte4mAL3.js";
+import { Ut as getSentEmail } from "../repeats-Dj_o6c-X-LyCkKYjp.js";
+import { Mt as createAuthenticatedCliApiClient, b as readThreadContext } from "../api-command-rlS3eTlZ.js";
 import { AUTO_SIGNAL_KIND_ENV, AUTO_WORKING_RENEW_MS, autoSignalsDisabled, clearWorkingSending, markWorkingSending, readAutoClaim, readWorkingLease, recordRenewer, stopWorkingLease, writeWorkingLease } from "./auto-signals.js";
+import { _ as acquireListenLock } from "../shared-mail-files-BAQSGxxz.js";
+import { t as sendSignal } from "../signal-command-DCPsJBdz.js";
 import { join } from "node:path";
 import { homedir } from "node:os";
-//#region src/oclif/auto-signal-worker.ts
+// src/oclif/auto-signal-worker.ts
 function configDirectory(env) {
 	if (env.PRIMITIVE_CONFIG_DIR) return env.PRIMITIVE_CONFIG_DIR;
 	return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "primitive");
@@ -164,5 +164,4 @@ async function runAutoSignalWorker(env = process.env, deps = {}) {
 		}
 	} catch {}
 }
-//#endregion
 export { runAutoSignalWorker };

package/dist/oclif/auto-signals.js

@@ -1,11 +1,11 @@
-import { d as readMailJson, h as writeMailJson, i as mailId, l as privateMailDirectory, r as mailAddress } from "../shared-mail-files-CZfm7E2k.js";
-import { n as isPlainChatReply, o as scopedChatSenderTrust } from "../scoped-chat-DAiOb622.js";
+import { n as isPlainChatReply, o as scopedChatSenderTrust } from "../scoped-chat-B0thCwME.js";
+import { d as readMailJson, h as writeMailJson, i as mailId, l as privateMailDirectory, r as mailAddress } from "../shared-mail-files-BAQSGxxz.js";
 import { existsSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
-//#region src/oclif/auto-signals.ts
+// src/oclif/auto-signals.ts
 /**
 * Automatic communication signals. When mail from the verified owner or a
 * verified same-organization member is surfaced to an agent session, the CLI
@@ -612,5 +612,4 @@ function resumeAutoWorking(configDir, options = {}) {
 		return 0;
 	}
 }
-//#endregion
 export { AUTO_SIGNALS_OPT_OUT_ENV, AUTO_SIGNAL_EMAIL_ENV, AUTO_SIGNAL_KIND_ENV, AUTO_SIGNAL_WORKER_ENV, AUTO_WORKING_CAP_MS, AUTO_WORKING_EXPIRES_SECONDS, AUTO_WORKING_RENEW_MS, activeWorkingLeases, autoSignalEligible, autoSignalEntrypoint, autoSignalsDisabled, claimAutoRead, clearWorkingSending, dispatchAutoRead, dispatchAutoWorking, haltAutoWorking, isSentSignal, markWorkingSending, readAutoClaim, readWorkingLease, recordRenewer, recordSentSignal, releaseStopHold, renewerAlive, restoreAutoWorking, restoreWorkingLease, resumeAutoWorking, spawnAutoSignalWorker, startWorkingLease, stopWorkingLease, writeWorkingLease };