@agentwhy/cli 0.1.0 → 0.2.1

package/dist/report/watch/agent-alert.js

@@ -1,3 +1,4 @@
+import { sumRefusedByOthers } from '../refusals.js';
 export const ALERT_THRESHOLDS = ['value', 'reached', 'refused'];
 /**
  * What is said when nobody has said otherwise: only a value written from a protected file. The other two are worth
@@ -32,6 +33,7 @@ export function alertOf(report, agentIndex) {
     const wroteItself = node.wroteValue === true || node.wroteOnward === true || usedItself;
     const reached = reachedFromReturn > 0 || node.filesReached > 0 || reachedBelow;
     const refusedAttempts = subtree.reduce((sum, agent) => sum + agent.refusedAttempts, 0);
+    const byOthers = sumRefusedByOthers(subtree.map((agent) => agent.refusedByOthers));
     const filesReached = own.length > 0 ? reachedFromReturn : reachedBelow ? undefined : node.filesReached;
     const level = wroteOrReturnedValue || wroteItself ? 'value' : reached ? 'reached' : refusedAttempts > 0 ? 'refused' : 'nothing';
     return {
@@ -40,6 +42,7 @@ export function alertOf(report, agentIndex) {
         ...(node.type === undefined ? {} : { type: node.type }),
         ...(filesReached === undefined ? {} : { filesReached }),
         refusedAttempts,
+        ...(byOthers === undefined ? {} : { refusedByOthers: byOthers }),
     };
 }
 /** Whether a level is strong enough to be said, under the threshold asked for. */

package/dist/report/watch/codex-turn-format.js

@@ -0,0 +1,69 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
+import { join } from 'node:path';
+import { SETTINGS_FILES } from '../../adapter/claude-code/contract/settings.js';
+import { refuseProjectAbove, refuseRulesOf } from '../../adapter/claude-code/settings/refuse-project.js';
+import { codexReaderOf } from '../../adapter/codex/hooks/reader.js';
+import { codexConversationOf } from '../../adapter/codex/hooks/codex-conversation.js';
+import { codexStopFolder, parseCodexStopInput } from '../../adapter/codex/hooks/stop-input.js';
+import { sessionKey } from '../../core/session-catalogue.js';
+import { FileAccessError } from '../../ports/file-access-error.js';
+import { CODEX_REQUESTS } from './render/codex-request-words.js';
+/**
+ * Codex's end of a turn, for `watch` (`2026-10-02-codex-says-it-too.md` CX1-CX7): its `Stop` read by Codex's names,
+ * who reads it from its rollout, the commands agentwhy stopped in the turn, Codex's requests, a Codex session's key, and
+ * the project's rules - the ones Codex's `refuse` reads.
+ */
+export function codexTurnFormat(files, refusals, threadIndexPath, home) {
+    return {
+        readStop: parseCodexStopInput,
+        readerOf: (turn) => codexReaderOf(files, turn.transcriptPath),
+        stoppedIn: (text) => refusals.find(text),
+        requests: CODEX_REQUESTS,
+        sessionKey: (id) => sessionKey({ id, provider: 'codex' }),
+        settingsFor: (text) => rulesOfProject(files, codexStopFolder(text), home),
+        // CX8: one conversation across the session ids the Codex apps give it (CXB5).
+        conversationOf: (turn) => codexConversationOf(files, threadIndexPath, turn.sessionId),
+        // CX9 with AO5: watched where a project above the turn's folder runs `refuse` - as `refuse --codex` finds it.
+        watchedHere: async (text) => {
+            const folder = codexStopFolder(text);
+            return folder !== undefined && (await refuseProjectAbove(files, folder, home)) !== undefined;
+        },
+    };
+}
+/**
+ * CX5 with AO5, AO6: the project is found as `refuse --codex` finds it - the nearest folder short of home whose Claude
+ * Code settings run `refuse` - and its rules are the settings file that project's `refuse` command names. Found by
+ * review: guessing the local file first read no rules where a project keeps them in the shared one, and so said a chat
+ * was clean over a file `refuse` protects. Where it names none, the local file, then the shared one, as before. A
+ * policy file is not a settings path, so it reads as none.
+ */
+async function rulesOfProject(files, folder, home) {
+    if (folder === undefined)
+        return undefined;
+    const found = await refuseProjectAbove(files, folder, home);
+    if (found === undefined)
+        return undefined;
+    const rules = refuseRulesOf(found);
+    if (rules.policyPath !== undefined)
+        return undefined;
+    if (rules.settingsPath !== undefined)
+        return rules.settingsPath;
+    for (const name of [SETTINGS_FILES.local, SETTINGS_FILES.shared]) {
+        const settings = join(found.project, SETTINGS_FILES.directory, name);
+        if (await readable(files, settings))
+            return settings;
+    }
+    return undefined;
+}
+async function readable(files, path) {
+    try {
+        await files.readText(path);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof FileAccessError)
+            return false;
+        throw error;
+    }
+}

package/dist/report/watch/notice-choices.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 /**
  * The choices a notice can be given, in a module of their own so that both the code that says a notice and the code
  * that remembers what a person chose can name them without depending on each other.

package/dist/report/watch/notice-settings.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { dirname } from 'node:path';
 import { longestMatch, NO_PREFERENCES, preferencesFor, readPreferences, withProjectChoices, writtenPreferences, } from './preferences.js';
 /**

package/dist/report/watch/preferences.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { isJsonObject, parseJsonObject } from '../../shared/json.js';
 import { ALERT_THRESHOLDS } from './agent-alert.js';
 import { CLEAN_MODES, NOTICE_CHANNELS, NOTICE_LANGS, SAID_AS, } from './notice-choices.js';

package/dist/report/watch/render/codex-request-words.js

@@ -0,0 +1,106 @@
+/*
+ * The stopped limit says "now": told to never read the file another way, the agent refused to try again later in the
+ * same conversation after the person had switched the file to Track (seen by the maintainer, 2026-10-02). The hook is
+ * the gate, not the agent's memory of this sentence.
+ */
+/**
+ * What Codex's agent is handed (`2026-10-02-codex-says-it-too.md` CX2, CX3, amended 2026-10-02). Codex shows it whole, in
+ * a bubble above the reply (CXB1, CKB14), and the maintainer found the first wording - written to the agent, with the
+ * report's command in it - too long and not understandable for the person who reads it first. So each is written to the
+ * person: what happened and what to do, in one or two sentences of the glossary's words, in the language chosen for
+ * agentwhy; then, in brackets and marked as the AI's ("For the AI:", chosen by the maintainer so a person does not read it
+ * as said to them), the one thing the agent is asked - one short sentence back - with the limit that keeps
+ * the file safe: never show a key, never read a stopped file another way. No command, no report offered: the report is
+ * one step away in Conversations, and a command in that bubble is a line a person cannot read.
+ */
+export const CODEX_REQUESTS = {
+    stopped: (paths, lang) => STOPPED[lang](listed(paths, lang), paths.length === 1),
+    keys: (files, _command, lang) => KEYS[lang](listed(files.map(String), lang), files.length <= 1),
+    template: (files, _command, lang) => TEMPLATE[lang](listed(files.map(String), lang), files.length <= 1),
+    data: (files, _command, lang) => DATA[lang](listed(files.map(String), lang), files.length <= 1),
+    told: (files, _command, lang, foldsTurn) => TOLD[lang](listed(files.map(String), lang), files.length <= 1, foldsTurn === true),
+    quiet: (lang, foldsTurn) => QUIET[lang](foldsTurn === true),
+};
+const STOPPED = {
+    en: (files, one) => `**agentwhy** stopped your AI from reading the private ${one ? 'file' : 'files'} ${files}. ` +
+        `(For the AI: reply in one short sentence, and don't try to read ${one ? 'it' : 'them'} another way now.)`,
+    pl: (files, one) => `**agentwhy** nie pozwolił AI odczytać ${one ? 'prywatnego pliku' : 'prywatnych plików'} ${files}. ` +
+        `(Dla AI: odpowiedz jednym krótkim zdaniem i nie próbuj teraz odczytać ${one ? 'go' : 'ich'} inaczej.)`,
+    de: (files, one) => `**agentwhy** hat deine KI daran gehindert, ${one ? 'die private Datei' : 'die privaten Dateien'} ${files} zu lesen. ` +
+        `(Für die KI: antworte in einem kurzen Satz und versuch jetzt nicht, sie anders zu lesen.)`,
+};
+const KEYS = {
+    en: (files, one) => `**agentwhy**: a key from the private ${one ? 'file' : 'files'} ${files} is now in this chat. Make a new key ` +
+        `today where it was created; deleting the chat won't undo it. (For the AI: reply in one short sentence; don't show the key.)`,
+    pl: (files, one) => `**agentwhy**: klucz z ${one ? 'prywatnego pliku' : 'prywatnych plików'} ${files} jest teraz w tej rozmowie. ` +
+        `Zrób dziś nowy klucz tam, gdzie go utworzono; usunięcie rozmowy tego nie cofnie. (Dla AI: odpowiedz jednym krótkim ` +
+        `zdaniem; nie pokazuj klucza.)`,
+    de: (files, one) => `**agentwhy**: Ein Schlüssel aus ${one ? 'der privaten Datei' : 'den privaten Dateien'} ${files} ist jetzt ` +
+        `in diesem Chat. Erstelle heute dort einen neuen, wo er erstellt wurde; den Chat zu löschen hilft nicht. (Für die KI: ` +
+        `antworte in einem kurzen Satz; zeig den Schlüssel nicht.)`,
+};
+/** A template's value may be a placeholder: only a real key is to be made new (S6, `template`). */
+const TEMPLATE = {
+    en: (files, one) => `**agentwhy**: a value from the template ${one ? 'file' : 'files'} ${files} is now in this chat. If it's a ` +
+        `real key, make a new one where it was created. (For the AI: reply in one short sentence; don't show the value.)`,
+    pl: (files, one) => `**agentwhy**: wartość z ${one ? 'pliku-szablonu' : 'plików-szablonów'} ${files} jest teraz w tej rozmowie. ` +
+        `Jeśli to prawdziwy klucz, zrób nowy tam, gdzie go utworzono. (Dla AI: odpowiedz jednym krótkim zdaniem; ` +
+        `nie pokazuj tej wartości.)`,
+    de: (files, one) => `**agentwhy**: Ein Wert aus ${one ? 'der Vorlagendatei' : 'den Vorlagendateien'} ${files} ist jetzt in ` +
+        `diesem Chat. Ist es ein echter Schlüssel, erstelle dort einen neuen, wo er erstellt wurde. (Für die KI: antworte in ` +
+        `einem kurzen Satz; zeig den Wert nicht.)`,
+};
+/** Data cannot be made new, so nothing is asked to be changed (S6, `data`): what cannot be taken back, and where to look. */
+const DATA = {
+    en: (files, one) => `**agentwhy**: private data from the private ${one ? 'file' : 'files'} ${files} is now in this chat. It ` +
+        `can't be taken back; agentwhy's report shows how to limit the damage. (For the AI: reply in one short sentence; don't repeat the data.)`,
+    pl: (files, one) => `**agentwhy**: prywatne dane z ${one ? 'prywatnego pliku' : 'prywatnych plików'} ${files} są teraz w tej ` +
+        `rozmowie. Nie da się tego cofnąć; raport agentwhy pokazuje, jak ograniczyć szkody. (Dla AI: odpowiedz jednym krótkim ` +
+        `zdaniem; nie powtarzaj tych danych.)`,
+    de: (files, one) => `**agentwhy**: Private Daten aus ${one ? 'der privaten Datei' : 'den privaten Dateien'} ${files} sind jetzt ` +
+        `in diesem Chat. Das lässt sich nicht zurücknehmen; der Bericht von agentwhy zeigt, wie du den Schaden begrenzt. (Für ` +
+        `die KI: antworte in einem kurzen Satz; wiederhole die Daten nicht.)`,
+};
+/**
+ * Where the app folds the turn away (`foldsTurn`, the desktop app, CXB5's display note), told and quiet ask the
+ * answer back - decided by the maintainer, 2026-10-02, after a control run: with a block, the whole Apache-licence
+ * answer sat behind "Worked for ...", and the visible reply was one line about private files. The full answer, not a
+brief one: the maintainer tried "repeat your answer" the same day and found the visible repeat more condensed than
+the original the fold hides. A told file is one the
+ * person lets their AI read, so the repeat carries nothing that may not be here; keys, data and a stopped command
+ * keep their limits - what their fold hides is what must not be repeated. VS Code's Codex folds nothing, so there
+ * the one short sentence stays and nothing is said twice.
+ */
+const TOLD = {
+    en: (files, one, folds) => `**agentwhy**: your AI read the private ${one ? 'file' : 'files'} ${files}, which you let it read. ` +
+        `Nothing to do. (For the AI: ${folds ? 'repeat your full answer for the user, then that nothing needs doing' : 'reply in one short sentence'}.)`,
+    pl: (files, one, folds) => `**agentwhy**: AI przeczytało ${one ? 'prywatny plik' : 'prywatne pliki'} ${files}, na ${one ? 'który' : 'które'} ` +
+        `pozwoliłeś. Nic nie trzeba robić. (Dla AI: ${folds ? 'powtórz całą swoją odpowiedź dla użytkownika i dodaj, że nic nie trzeba robić' : 'odpowiedz jednym krótkim zdaniem'}.)`,
+    de: (files, one, folds) => `**agentwhy**: Deine KI hat ${one ? 'die private Datei' : 'die privaten Dateien'} ${files} gelesen, die du ` +
+        `ihr erlaubt hast. Nichts zu tun. (Für die KI: ${folds ? 'wiederhole deine ganze Antwort für den Nutzer und ergänze, dass nichts zu tun ist' : 'antworte in einem kurzen Satz'}.)`,
+};
+const QUIET = {
+    en: (folds) => '**agentwhy** is keeping watch over your private files: none has been opened so far. ' +
+        `(For the AI: ${folds ? 'repeat your full answer for the user, then this in one sentence' : 'reply in one short sentence'}.)`,
+    pl: (folds) => '**agentwhy** pilnuje twoich prywatnych plików: jak dotąd żaden nie został otwarty. ' +
+        `(Dla AI: ${folds ? 'powtórz całą swoją odpowiedź dla użytkownika i dodaj to jednym zdaniem' : 'odpowiedz jednym krótkim zdaniem'}.)`,
+    de: (folds) => '**agentwhy** passt auf deine privaten Dateien auf: Bisher wurde keine geöffnet. ' +
+        `(Für die KI: ${folds ? 'wiederhole deine ganze Antwort für den Nutzer und ergänze dies in einem Satz' : 'antworte in einem kurzen Satz'}.)`,
+};
+/** At most three files by name, then how many more: a request a person reads is not a list. */
+function listed(paths, lang) {
+    const named = [...new Set(paths)].slice(0, 3);
+    const rest = new Set(paths).size - named.length;
+    const and = AND[lang];
+    if (rest > 0)
+        named.push(MORE[lang](rest));
+    if (named.length <= 1)
+        return named[0] ?? '';
+    return `${named.slice(0, -1).join(', ')} ${and} ${named.at(-1)}`;
+}
+const AND = { en: 'and', pl: 'i', de: 'und' };
+const MORE = {
+    en: (count) => `${count} more`,
+    pl: (count) => `${count} innych`,
+    de: (count) => `${count} weitere`,
+};

package/dist/report/watch/render/instruction-words.js

@@ -12,24 +12,114 @@
  * - **Only what the records establish.** A session handed a claim that did not match its own context refused it and
  *   said so to the person (R12b). The consequence is worded as what the records show - the conversation and the
  *   session's own files - and not as a fact about a provider's infrastructure.
+ *
+ * *Fourth version, 2026-10-02 (`the-agent-tells-you.md` R12c):* the third was relayed in full, and in full it was three
+ * paragraphs - session records, rotating a credential - which the maintainer, reading it in the Claude desktop app,
+ * found too long for someone who does not write code. So it asks for what the Codex request already asks for (CK13 of
+ * `codex-blocks-too`): at most three short sentences, opening with agentwhy's name, in the glossary's words (a private
+ * file, a key, make a new one). Everything the third kept safe is kept.
  */
 export function instructionFor(files, command) {
     const named = files.slice(0, NAMED_AT_MOST);
     const rest = files.length - named.length;
     const which = named.length === 0
-        ? 'a protected file'
-        : `the protected ${named.length === 1 ? 'file' : 'files'} ${list(named)}${rest === 0 ? '' : ` and ${rest} more`}`;
+        ? 'a private file'
+        : `the private ${named.length === 1 ? 'file' : 'files'} ${list(named)}${rest === 0 ? '' : ` and ${rest} more`}`;
     // What the agent is asked not to do is said about the same files it was just told about, in the same words.
     const them = named.length <= 1 ? 'it' : 'them';
     return [
-        `agentwhy, the local tool this user runs, checked this turn: a value from ${which} is in this conversation.`,
-        'Tell the user, in one short message in the language of this conversation, that agentwhy found this, what it',
-        'means - the value went wherever this conversation goes and stays in the session records kept on this machine,',
-        'so deleting messages does not recall it - and that rotating that credential where it was issued is what undoes',
-        `it. You read ${named.length === 0 ? 'it' : which} in this conversation, so you can see the finding yourself.`,
-        `Do not open or read ${them} again, and do not repeat the value.`,
-        `Then ask whether to open agentwhy's report for this session, and run \`${command}\` only if they say yes.`,
-        'Do not continue the earlier task in this message.',
+        `agentwhy, the local tool this user runs, checked this turn: a key from ${which} is now in this conversation.`,
+        'Tell the user in at most three short sentences, in the language of this conversation and in plain everyday words',
+        'for someone who does not write code, starting with **agentwhy**: that agentwhy noticed this; that they should make',
+        'a new key today where this one was issued, because deleting the chat does not undo it; and ask whether to open',
+        `agentwhy's report, running \`${command}\` only if they say yes.`,
+        `You read ${named.length === 0 ? 'it' : which} in this conversation, so you can see this yourself.`,
+        `Do not open or read ${them} again, do not repeat the key, and do not continue the earlier task in this message.`,
+    ].join(' ');
+}
+/**
+ * The same, for private files the person lets the agent read - tracked rather than blocked in agentwhy's Settings
+ * (F57; `the-chat-says-what-the-report-says.md` S6 and §6, `told`). Asked for by the maintainer on 2026-10-02: the
+ * words for a blocked file, "make a new key today", are for a file read that should not have been, and said of a file
+ * the person allowed they are an alarm about nothing. So the agent says it read a file it was allowed to, that nothing
+ * needs to change, and offers the report, which shows what was read. The rest is `instructionFor`'s.
+ */
+export function toldInstructionFor(files, command) {
+    const named = files.slice(0, NAMED_AT_MOST);
+    const rest = files.length - named.length;
+    const which = named.length === 0
+        ? 'a private file'
+        : `the private ${named.length === 1 ? 'file' : 'files'} ${list(named)}${rest === 0 ? '' : ` and ${rest} more`}`;
+    const them = named.length <= 1 ? 'it' : 'them';
+    return [
+        `agentwhy, the local tool this user runs, checked this turn: you read ${which}, which this user lets you read -`,
+        `they set ${them} to be tracked, not blocked, in agentwhy's settings.`,
+        'Tell the user in at most two short sentences, in the language of this conversation and in plain everyday words for',
+        'someone who does not write code, starting with **agentwhy**: that agentwhy noticed you read a private file they',
+        'allowed, so nothing needs to change; and ask whether to open agentwhy\'s report, which shows what was read, running',
+        `\`${command}\` only if they say yes.`,
+        `Do not open or read ${them} again, do not repeat anything from ${them}, and do not continue the earlier task in this message.`,
+    ].join(' ');
+}
+/**
+ * The same, for private data - a file of the conversation's that agentwhy recognises no key in (`the-chat-says-what-the-
+ * report-says.md` S1, S6 and §6, `data`). A key can be replaced and data cannot, so "make a new key" said of a customer
+ * list is advice that does nothing - the agent contradicted it in the session that found this (§1). The agent says what
+ * cannot be taken back and offers the report, which shows how to limit the damage and protect the file.
+ */
+export function dataInstructionFor(files, command) {
+    const { which, them } = named(files);
+    return [
+        `agentwhy, the local tool this user runs, checked this turn: private data from ${which} is now in this conversation,`,
+        'and agentwhy recognises no key in it.',
+        'Tell the user in at most three short sentences, in the language of this conversation and in plain everyday words',
+        'for someone who does not write code, starting with **agentwhy**: that agentwhy noticed this; that it cannot be taken',
+        'back, and agentwhy\'s report shows how to limit the damage and protect the file; and ask whether to open it, running',
+        `\`${command}\` only if they say yes.`,
+        `You read ${which} in this conversation, so you can see this yourself.`,
+        `Do not open or read ${them} again, do not repeat anything from ${them}, and do not continue the earlier task in this message.`,
+    ].join(' ');
+}
+/**
+ * The same, for a file named as a template - `.env.example` (S6, `template`): its value may be a placeholder or a real
+ * key, and the agent read it, so it can say which it looks like - without repeating it.
+ */
+export function templateInstructionFor(files, command) {
+    const { which, them } = named(files);
+    return [
+        `agentwhy, the local tool this user runs, checked this turn: a value from ${which}, named as a template, is now in`,
+        'this conversation. Tell the user in at most three short sentences, in the language of this conversation and in plain',
+        'everyday words for someone who does not write code, starting with **agentwhy**: that agentwhy noticed this; whether',
+        'the value looks like a real key or a placeholder, and that a real one should be made new where it was issued; and ask',
+        `whether to open agentwhy's report, running \`${command}\` only if they say yes.`,
+        `You read ${which} in this conversation, so you can see this yourself.`,
+        `Do not open or read ${them} again, do not repeat the value, and do not continue the earlier task in this message.`,
+    ].join(' ');
+}
+/** The files an instruction names - three at most, then how many more - and the pronoun that refers back to them. */
+function named(files) {
+    const shown = files.slice(0, NAMED_AT_MOST);
+    const rest = files.length - shown.length;
+    return {
+        which: shown.length === 0
+            ? 'a private file'
+            : `the private ${shown.length === 1 ? 'file' : 'files'} ${list(shown)}${rest === 0 ? '' : ` and ${rest} more`}`,
+        them: shown.length <= 1 ? 'it' : 'them',
+    };
+}
+/**
+ * The first quiet turn of a session, said by the agent (`the-agent-tells-you.md` R5, amended 2026-10-02): where the line
+ * is folded away or easily passed, the one sentence that says agentwhy is keeping watch. agentwhy's claim, passed on as
+ * agentwhy's, so the agent is not asked to vouch for files it cannot know are private; nothing to offer, since there
+ * is nothing to see in a report.
+ */
+export function cleanInstruction() {
+    return [
+        'agentwhy, the local tool this user runs, checked this conversation so far: none of the private files it watches',
+        'has been opened. Tell the user in one short sentence, in the language of this conversation and in plain everyday',
+        'words for someone who does not write code, starting with **agentwhy**: that agentwhy is keeping watch over their',
+        'private files and none has been opened so far. Do not ask anything, and do not continue the earlier task in this',
+        'message.',
     ].join(' ');
 }
 /**
@@ -39,10 +129,14 @@ export function instructionFor(files, command) {
 const NAMED_AT_MOST = 3;
 /**
  * The command the agent offers to run: this session by its id, and nothing of what the report holds (R18, R19), with
- * agentwhy invoked the way the hook invokes it.
+ * agentwhy invoked the way the hook invokes it. *Changed 2026-10-02 (`2026-10-02-said-where-the-person-is.md` SW10):*
+ * `start` writing every conversation of the project, opening this one's report among them, so its "All conversations"
+ * leads back to them - `report --open` opened a page alone, with nowhere to go back to. *Changed again the same day
+ * (`2026-10-02-a-page-not-a-file.md` PF5):* served from the background (`--detach`), so the page is live - marks, Settings,
+ * new conversations - and the agent's call still returns at once; a server already running for the project is reused.
  */
 export function reportCommand(sessionId, invocation) {
-    return `${invocation} report --input ${sessionId} --open --quiet`;
+    return `${invocation} start --detach --session ${sessionId} --quiet`;
 }
 function list(files) {
     const [one, two, three] = files;
@@ -52,3 +146,11 @@ function list(files) {
         return `${one} and ${two}`;
     return String(one);
 }
+/** Claude Code's: the language is the conversation's, which the agent answers in whatever it is asked in. */
+export const CLAUDE_CODE_REQUESTS = {
+    keys: (files, command) => instructionFor(files, command),
+    template: (files, command) => templateInstructionFor(files, command),
+    data: (files, command) => dataInstructionFor(files, command),
+    told: (files, command) => toldInstructionFor(files, command),
+    quiet: () => cleanInstruction(),
+};

package/dist/report/watch/render/notice-words.js

@@ -17,6 +17,8 @@ const NOTE = 'NOTE:';
  * both read; `tests/report/watch/render/notice-words.test.ts` holds each one to it.
  */
 export const NOTICE_BUDGET = 150;
+/** How a refusal by a rule is said, in one agent's notice and in the line that counts several. */
+const RULE_REFUSED = 'a rule refused';
 /**
  * Who is speaking, for the one channel with no title of its own. A terminal notification and a system notification
  * are drawn with `NOTICE_TITLE` above them; the line in the conversation arrives under a frame Claude Code writes
@@ -33,6 +35,17 @@ const NOT_CHECKED = {
     session: "Finished agent not checked: the session's records could not be read.",
     'agent-not-found': "Finished agent not checked: it is not in the session's records yet.",
 };
+/**
+ * A helper that kept no record (`when-an-agent-finishes.md` R4a), in the person's language and the glossary's words -
+ * in the Claude desktop app it is often the only notice that reaches them. Said once a session, and it says so: a
+ * person who hears it once should not take a quiet later turn for a later helper that was checked. No `Details:`, since
+ * the report holds nothing about it.
+ */
+const NO_RECORD_WORDS = {
+    en: "A helper finished without leaving a record, so I can't check what it did. I say this once per chat.",
+    pl: 'Zakończył się pomocnik, który nie zostawił zapisu, więc nie sprawdzę, co robił. Mówię to raz na rozmowę.',
+    de: 'Ein Helfer ist fertig und hat nichts aufgezeichnet, daher kann ich nicht prüfen, was er tat. Ich sage das einmal pro Chat.',
+};
 /**
  * One notice in words, or no words for nothing to say (`specs/2026-09-16-when-an-agent-finishes.md` R5-R7, R15). It
  * reads counts and enumerations only - the agent's type, how many files, how many attempts - so no path, value,
@@ -46,6 +59,12 @@ export class NoticeWordsRenderer {
                 return '';
             case 'not-checked':
                 return `${NOT_CHECKED[notice.reason]} ${DETAILS}`;
+            case 'no-record':
+                return NO_RECORD_WORDS[notice.lang];
+            case 'told':
+                return TOLD_WORDS[notice.lang];
+            case 'read':
+                return READ_WORDS[notice.lang][notice.what];
             case 'alert':
                 return `${sentenceOf(notice.alert)} ${DETAILS}`;
             case 'turn':
@@ -58,6 +77,38 @@ export class NoticeWordsRenderer {
         }
     }
 }
+/**
+ * A key from a private file the person lets their AI read (`the-chat-says-what-the-report-says.md` §5, the `told` row):
+ * the words proposed there, unchanged. Not `ROTATE` - the person allowed the read in Settings, and nothing needs to
+ * change.
+ */
+/**
+ * A private file's text in the conversation, by what it held (`the-chat-says-what-the-report-says.md` S8, §5): agentwhy's
+ * voice, as the clean line's; what to do before `Details`, inside the budget; no path and no service (S9). A template
+ * asks to check, since its value may be a placeholder; data cannot be changed, so it asks to see what to do.
+ */
+const READ_WORDS = {
+    en: {
+        keys: 'I keep watch over your private files. A key from one of them is now in this conversation — change it. Details: agentwhy report --open',
+        template: 'I keep watch over your private files. A key from one of them is now in this conversation — check it. Details: agentwhy report --open',
+        data: 'I keep watch over your private files. Private data from one of them is now in this conversation — see what to do: agentwhy report --open',
+    },
+    pl: {
+        keys: 'Pilnuję twoich prywatnych plików. Klucz z jednego z nich jest teraz w tej rozmowie — zmień go. Szczegóły: agentwhy report --open',
+        template: 'Pilnuję twoich prywatnych plików. Klucz z jednego z nich jest teraz w tej rozmowie — sprawdź go. Szczegóły: agentwhy report --open',
+        data: 'Pilnuję twoich prywatnych plików. Prywatne dane z jednego z nich są teraz w tej rozmowie — zobacz, co zrobić: agentwhy report --open',
+    },
+    de: {
+        keys: 'Ich passe auf deine privaten Dateien auf. Ein Schlüssel daraus ist jetzt in dieser Unterhaltung — ändere ihn. Details: agentwhy report --open',
+        template: 'Ich passe auf deine privaten Dateien auf. Ein Schlüssel daraus ist jetzt in dieser Unterhaltung — prüfe ihn. Details: agentwhy report --open',
+        data: 'Ich passe auf deine privaten Dateien auf. Private Daten daraus sind jetzt in dieser Unterhaltung. Was tun: agentwhy report --open',
+    },
+};
+const TOLD_WORDS = {
+    en: 'I keep watch over your private files. Your AI read one you let it read. Nothing to do. Details: agentwhy report --open',
+    pl: 'Pilnuję twoich prywatnych plików. AI przeczytało jeden, na który mu pozwoliłeś. Nic nie trzeba robić. Szczegóły: agentwhy report --open',
+    de: 'Ich passe auf deine privaten Dateien auf. Deine KI hat eine gelesen, die du ihr erlaubt hast. Nichts zu tun. Details: agentwhy report --open',
+};
 /**
  * A turn that found nothing (R4-R6), in the language the person reads (R29). Three lines, and the difference between
  * them is the whole point:
@@ -75,7 +126,14 @@ export class NoticeWordsRenderer {
  */
 function cleanWords(first, counts, lang) {
     const words = CLEAN_WORDS[lang];
-    const earlier = counts.values > 0 ? words.valueEarlier(counts.values) : counts.reached > 0 ? words.reachedEarlier(counts.reached) : undefined;
+    const told = counts.told ?? 0;
+    const data = counts.data ?? 0;
+    // The gravest first: a key that should not be here, then private data, then a private file opened, then one the
+    // person lets their AI read.
+    const earlier = counts.values > 0 ? words.valueEarlier(counts.values)
+        : data > 0 ? words.dataEarlier(data)
+            : counts.reached > 0 ? words.reachedEarlier(counts.reached)
+                : told > 0 ? words.toldEarlier(told) : undefined;
     if (earlier !== undefined)
         return `${words.nothingNew} ${earlier} ${words.details}: agentwhy report --open`;
     return first ? words.first : words.turn;
@@ -87,6 +145,8 @@ const CLEAN_WORDS = {
         nothingNew: 'Nothing new now.',
         valueEarlier: (count) => `Earlier in this chat your AI read ${count === 1 ? 'a key' : `${count} keys`} from a private file.`,
         reachedEarlier: (count) => `Earlier in this chat your AI opened ${count === 1 ? 'a private file' : `${count} private files`}.`,
+        toldEarlier: (count) => `Earlier in this chat your AI read ${count === 1 ? 'a private file' : `${count} private files`} you let it read.`,
+        dataEarlier: (count) => `Earlier in this chat your AI read private data from ${count === 1 ? 'a private file' : `${count} private files`}.`,
         details: 'Details',
     },
     pl: {
@@ -95,6 +155,8 @@ const CLEAN_WORDS = {
         nothingNew: 'Teraz nic nowego.',
         valueEarlier: (count) => `Wcześniej w tej rozmowie AI przeczytało ${count === 1 ? 'klucz' : `${count} ${polish(count, 'klucze', 'kluczy')}`} z prywatnego pliku.`,
         reachedEarlier: (count) => `Wcześniej w tej rozmowie AI otworzyło ${count === 1 ? 'prywatny plik' : `${count} ${polish(count, 'prywatne pliki', 'prywatnych plików')}`}.`,
+        toldEarlier: (count) => `Wcześniej w tej rozmowie AI przeczytało ${count === 1 ? 'prywatny plik' : `${count} ${polish(count, 'prywatne pliki', 'prywatnych plików')}`}, na ${count === 1 ? 'który' : 'które'} mu pozwoliłeś.`,
+        dataEarlier: (count) => `Wcześniej w tej rozmowie AI przeczytało prywatne dane z ${count === 1 ? 'prywatnego pliku' : `${count} prywatnych plików`}.`,
         details: 'Szczegóły',
     },
     de: {
@@ -103,6 +165,8 @@ const CLEAN_WORDS = {
         nothingNew: 'Jetzt nichts Neues.',
         valueEarlier: (count) => `Vorhin hat deine KI ${count === 1 ? 'einen Schlüssel' : `${count} Schlüssel`} aus einer privaten Datei gelesen.`,
         reachedEarlier: (count) => `Vorhin hat deine KI ${count === 1 ? 'eine private Datei' : `${count} private Dateien`} geöffnet.`,
+        toldEarlier: (count) => `Vorhin hat deine KI ${count === 1 ? 'eine private Datei' : `${count} private Dateien`} gelesen, die du ihr erlaubt hast.`,
+        dataEarlier: (count) => `Vorhin hat deine KI private Daten aus ${count === 1 ? 'einer privaten Datei' : `${count} privaten Dateien`} gelesen.`,
         details: 'Details',
     },
 };
@@ -128,10 +192,13 @@ function sentenceOf(alert) {
      * story: where a file was reached or a value written, those words come first and the refusals go unmentioned -
      * they are what a notification cuts first, and the report has them either way.
      * The rule is the subject, not the agent: "a rule refused" reads the same for a delegated agent and for the
-     * conversation itself, where "this conversation was refused" would not.
+     * conversation itself, where "this conversation was refused" would not. A rule is named only where a rule refused
+     * them all (`who-stopped-it` WS5): what auto mode or the person stopped is said as stopped, by nobody's rule.
      */
     if (alert.level === 'refused') {
-        return `${NOTE} a rule refused ${plural(alert.refusedAttempts, 'attempt', 'attempts')} at protected files; nothing was reached.`;
+        return alert.refusedByOthers === undefined
+            ? `${NOTE} ${RULE_REFUSED} ${plural(alert.refusedAttempts, 'attempt', 'attempts')} at protected files; nothing was reached.`
+            : `${NOTE} ${plural(alert.refusedAttempts, 'attempt', 'attempts')} at protected files ${alert.refusedAttempts === 1 ? 'was' : 'were'} stopped; nothing was reached.`;
     }
     if (alert.own === true) {
         return alert.level === 'value'
@@ -166,7 +233,10 @@ export function turnWords(remembered) {
     const reached = checked.filter((alert) => alert.level === 'value' || alert.level === 'reached');
     const values = reached.filter((alert) => alert.level === 'value').length;
     const head = reached.length === 0
-        ? `${NOTE} a rule refused attempts by ${plural(checked.length, 'agent', 'agents')}; nothing was reached`
+        // A rule is credited only where a rule refused every one of them (WS5): the record says where it did not.
+        ? checked.every((alert) => alert.notByRule !== true)
+            ? `${NOTE} ${RULE_REFUSED} attempts by ${plural(checked.length, 'agent', 'agents')}; nothing was reached`
+            : `${NOTE} attempts by ${plural(checked.length, 'agent', 'agents')} at protected files were stopped; nothing was reached`
         : values === 0
             ? `${CHECK} ${plural(reached.length, 'agent', 'agents')} reached protected files; no value found in their messages`
             : values === reached.length