@astrosheep/keiyaku 2.8.0 → 2.8.2

package/build/cli/parse.js

@@ -1,5 +1,6 @@
 import { FlowError } from "../flow-error.js";
 import { agentNameSchema } from "../config/settings.js";
+import { isResponseArtifactId } from "../core/response-artifact-id.js";
 import { BOOLEAN_FLAGS, CONTROL_FLAGS, HELP_FLAGS, SHORT_FLAG_ALIASES, VALUE_FLAGS, } from "./flags.js";
 /** Commands that may carry an explicit commission selector (@ or --contract). */
 const COMMISSION_SELECTOR_COMMANDS = new Set([
@@ -8,6 +9,7 @@ const COMMISSION_SELECTOR_COMMANDS = new Set([
     "call",
     "wait",
     "tell",
+    "kill",
     "log",
     "renew",
     "petition",
@@ -20,6 +22,7 @@ const CLI_COMMAND_ORDER = [
     "revive",
     "wait",
     "tell",
+    "kill",
     "log",
     "akuma list",
     "akuma ls",
@@ -40,10 +43,11 @@ const COMMAND_FLAGS = {
     // contract is parseable on bind only so the mouth can reject it with bind-specific copy.
     bind: ["cwd", "repo", "contract", "after", "exclusive", "draft-only"],
     arc: ["cwd", "repo", "contract", "waive"],
-    call: ["cwd", "repo", "contract", "akuma", "model", "effort", "incognito", "bare", "detach"],
+    call: ["cwd", "repo", "contract", "akuma", "model", "effort", "incognito", "bare", "detach", "alias"],
     revive: ["cwd", "repo", "model", "effort"],
     wait: ["cwd", "repo", "contract", "timeout"],
     tell: ["cwd", "repo", "contract", "effort"],
+    kill: ["cwd", "repo", "contract"],
     log: ["cwd", "repo", "contract"],
     akuma: [],
     "akuma ls": ["cwd", "repo"],
@@ -57,7 +61,7 @@ const COMMAND_FLAGS = {
     forfeit: ["cwd", "repo", "contract", "reason"],
     guide: [],
     completion: ["cwd", "repo", "shell", "word", "previous", "complete"],
-    status: ["cwd", "repo", "target"],
+    status: ["cwd", "repo", "target", "all"],
     "dump-env": [],
 };
 const STDIN_COMMANDS = new Set(["bind", "arc", "amend"]);
@@ -95,9 +99,11 @@ export function commandPositionalRange(command) {
     if (command === "revive")
         return { min: 1, max: 1, label: "<artifact-id>" };
     if (command === "wait")
-        return { min: 1, max: 1, label: "<short-id>" };
+        return { min: 1, max: 1, label: "<projection-address>" };
     if (command === "tell")
         return { min: 2, max: 2, label: "<projection> <message>" };
+    if (command === "kill")
+        return { min: 1, max: 1, label: "<projection-address>" };
     if (isCallCommand(command))
         return { min: 0, max: 1 };
     return { min: 0, max: 0 };
@@ -129,6 +135,9 @@ function assignFlag(flags, name, value) {
         case "projection":
             flags.projection = String(value);
             return;
+        case "alias":
+            flags.alias = String(value);
+            return;
         case "timeout":
             flags.timeoutMs = parseWaitTimeout(String(value));
             return;
@@ -182,6 +191,9 @@ function assignFlag(flags, name, value) {
         case "complete":
             flags.complete = Boolean(value);
             return;
+        case "all":
+            flags.all = Boolean(value);
+            return;
         case "target":
             if (flags.target !== undefined) {
                 throw new FlowError("EMPTY_PARAM", "option --target may only be specified once");
@@ -244,21 +256,28 @@ function readValueFlag(name, token, eq, tokens, index) {
 function commissionConflictMessage(atForm, contractForm) {
     return `commission address supplied twice: ${atForm} and --contract ${contractForm}; use exactly one form`;
 }
-function noteContractFlag(flags, raw, previousRaw) {
-    if (previousRaw !== undefined || flags.contractId !== undefined) {
-        throw new FlowError("EMPTY_PARAM", `commission address supplied twice: --contract ${previousRaw ?? flags.contractId} and --contract ${raw}; use exactly one form`);
-    }
-    assignFlag(flags, "contract", raw);
-    return raw;
+function formatSelectorList(items) {
+    if (items.length <= 1)
+        return items[0] ?? "";
+    if (items.length === 2)
+        return `${items[0]} and ${items[1]}`;
+    return `${items.slice(0, -1).join(", ")}, and ${items[items.length - 1]}`;
+}
+function multiCommissionSelectorMessage(command, spellings) {
+    return `${command} accepts one commission address; got ${formatSelectorList(spellings)}`;
+}
+function commissionSelectorSpelling(source, value, rawToken) {
+    if (source === "at-address")
+        return rawToken ?? `@${value}`;
+    return `--contract ${rawToken ?? value}`;
 }
 export function parseCliArgs(tokens) {
     const { head, payload } = splitAtLiteralBoundary(tokens);
     const flags = {};
     const free = [];
     const seenFlagNames = new Set();
-    let atContractId;
-    let atToken;
-    let contractFlagRaw;
+    const atTokens = [];
+    const contractFlagRaws = [];
     let helpRequested = false;
     for (let index = 0; index < head.length; index += 1) {
         const token = head[index];
@@ -267,11 +286,7 @@ export function parseCliArgs(tokens) {
             continue;
         }
         if (token.startsWith("@")) {
-            if (atContractId !== undefined) {
-                throw new FlowError("EMPTY_PARAM", "command accepts at most one contract address");
-            }
-            atToken = token;
-            atContractId = normalizeContractAddress(token);
+            atTokens.push(token);
             continue;
         }
         if (/^-[A-Za-z]$/.test(token)) {
@@ -288,7 +303,7 @@ export function parseCliArgs(tokens) {
                 }
                 index += 1;
                 if (name === "contract") {
-                    contractFlagRaw = noteContractFlag(flags, value, contractFlagRaw);
+                    contractFlagRaws.push(value);
                 }
                 else {
                     assignFlag(flags, name, value);
@@ -307,6 +322,9 @@ export function parseCliArgs(tokens) {
         }
         const eq = token.indexOf("=");
         const name = parseFlagName(eq === -1 ? token : token.slice(0, eq));
+        if (name === "place") {
+            throw new FlowError("EMPTY_PARAM", "unknown option --place; use @addr or --contract <addr>");
+        }
         if (!CONTROL_FLAGS.has(name)) {
             throw new FlowError("EMPTY_PARAM", `unknown option: --${name}`);
         }
@@ -315,7 +333,7 @@ export function parseCliArgs(tokens) {
             const { value, nextIndex } = readValueFlag(name, token, eq, head, index);
             index = nextIndex;
             if (name === "contract") {
-                contractFlagRaw = noteContractFlag(flags, value, contractFlagRaw);
+                contractFlagRaws.push(value);
             }
             else {
                 assignFlag(flags, name, value);
@@ -329,14 +347,23 @@ export function parseCliArgs(tokens) {
             assignFlag(flags, name, true);
         }
     }
-    if (atContractId !== undefined && flags.contractId !== undefined) {
-        throw new FlowError("EMPTY_PARAM", commissionConflictMessage(atToken ?? `@${atContractId}`, contractFlagRaw ?? flags.contractId));
+    const { command, rest } = resolveCommand(free);
+    if (atTokens.length > 0 && contractFlagRaws.length > 0) {
+        throw new FlowError("EMPTY_PARAM", commissionConflictMessage(atTokens[0], contractFlagRaws[0]));
+    }
+    if (atTokens.length > 1) {
+        throw new FlowError("EMPTY_PARAM", multiCommissionSelectorMessage(command, atTokens));
+    }
+    if (contractFlagRaws.length > 1) {
+        throw new FlowError("EMPTY_PARAM", multiCommissionSelectorMessage(command, contractFlagRaws.map((raw) => `--contract ${raw}`)));
     }
-    if (atContractId !== undefined) {
-        flags.contractId = atContractId;
+    if (atTokens.length === 1) {
+        flags.contractId = normalizeContractAddress(atTokens[0]);
         flags.contractAddressSource = "at-address";
     }
-    const { command, rest } = resolveCommand(free);
+    else if (contractFlagRaws.length === 1) {
+        assignFlag(flags, "contract", contractFlagRaws[0]);
+    }
     if (helpRequested) {
         return {
             command,
@@ -362,6 +389,17 @@ export function parseCliArgs(tokens) {
             ? `bind creates a commission and does not accept @${flags.contractId}; use -C/--cwd to select the repository`
             : `contract address @${flags.contractId} is not valid for ${command}`);
     }
+    if ((command === "wait" || command === "tell") && flags.contractId !== undefined) {
+        const selectorSpelling = commissionSelectorSpelling(flags.contractAddressSource === "at-address" ? "at-address" : "explicit-flag", flags.contractId, flags.contractAddressSource === "at-address" ? atTokens[0] : contractFlagRaws[0]);
+        const scopeOnlyMessage = `${command} requires a projection id or alias; ${selectorSpelling} only limits projection lookup, so add the projection address`;
+        if (command === "wait" && rest.length + payload.length === 0) {
+            throw new FlowError("EMPTY_PARAM", scopeOnlyMessage);
+        }
+        if (command === "tell" && rest.length === 0) {
+            // Payload after -- is the message body, never the projection address.
+            throw new FlowError("EMPTY_PARAM", scopeOnlyMessage);
+        }
+    }
     const positional = [...rest, ...payload];
     if (isCallCommand(command)) {
         if (flags.akuma) {
@@ -374,6 +412,9 @@ export function parseCliArgs(tokens) {
             if (!name) {
                 throw new FlowError("EMPTY_PARAM", `${command} requires an agent name; use \`keiyaku ${command} NAME [prompt|-]\``);
             }
+            if (isResponseArtifactId(name)) {
+                throw new FlowError("EMPTY_PARAM", `artifact ${name} is a response artifact; call expects an Akuma profile name`);
+            }
             const parsedName = agentNameSchema.safeParse(name);
             if (!parsedName.success) {
                 throw new FlowError("EMPTY_PARAM", `${command} requires a valid agent name before the optional prompt`);

package/build/cli/projection-address.js

@@ -1,11 +1,98 @@
-import { resolveProjectionPrefix } from "../core/projection-core.js";
-import { FlowError } from "../flow-error.js";
-export function resolveProjectionAddress(cwd, prefix, contractId) {
-    const resolved = resolveProjectionPrefix(cwd, prefix, contractId);
-    if (resolved.status === "resolved")
-        return resolved.id;
-    if (resolved.status === "none") {
-        throw new FlowError("EMPTY_PARAM", `projection not resolved${contractId ? ` within @${contractId}` : ""}: ${prefix}`);
-    }
-    throw new FlowError("EMPTY_PARAM", `projection address is ambiguous${contractId ? ` within @${contractId}` : ""}: ${prefix}; candidates:\n${resolved.candidates.join("\n")}`);
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { AddressResolutionError, buildObjectResolutionAttempt, } from "../core/addressing.js";
+import { resolveProjectionCoordinate } from "../core/projection-coordinate.js";
+import { isProjectionId, projectionDir } from "../core/projection-core.js";
+import { isProjectionAlias, readProjectionAlias } from "../core/projection-alias.js";
+import { readProjectionIdentity } from "../core/projection-identity.js";
+import { isResponseArtifactId } from "../core/response-artifact-id.js";
+import { isErrnoException } from "../errno.js";
+function isRealDirectory(directory) {
+    try {
+        return fs.lstatSync(directory).isDirectory();
+    }
+    catch (error) {
+        if (isErrnoException(error) && error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+export async function resolveProjectionAddress(input) {
+    const workdir = path.resolve(input.cwd);
+    // Scoped lookup reuses the commission carrier's repository root: zero Git probes.
+    // Unscoped lookup performs exactly one coordinate probe.
+    let repo;
+    let physicalRoot;
+    let attempt;
+    if (input.scope) {
+        repo = input.scope.repo;
+        physicalRoot = input.scope.repo.stableRoot;
+        attempt = buildObjectResolutionAttempt({
+            repo,
+            workdir,
+            expected: "projection",
+            supplied: input.address,
+            scope: {
+                commissionId: input.scope.binding.commissionId,
+                asTyped: input.scope.spelling.asTyped,
+            },
+            inference: ["commission-scoped projection lookup"],
+        });
+    }
+    else {
+        const coordinate = resolveProjectionCoordinate(input.cwd);
+        repo = coordinate.authority.kind === "repository"
+            ? { kind: "repository", stableRoot: coordinate.authority.stableRoot }
+            : { kind: "user" };
+        physicalRoot = coordinate.physicalRoot;
+        attempt = buildObjectResolutionAttempt({
+            repo,
+            workdir,
+            expected: "projection",
+            supplied: input.address,
+            inference: ["projection directory lookup"],
+        });
+    }
+    if (isResponseArtifactId(input.address)) {
+        throw new AddressResolutionError("EMPTY_PARAM", `artifact ${input.address} is a response artifact; ${input.verb} expects a projection id or alias`, { ...attempt, actual: "artifact" });
+    }
+    const suffix = input.scope
+        ? `within ${input.scope.spelling.asTyped}`
+        : repo.kind === "repository" ? `in repository ${repo.stableRoot}` : `in workdir ${workdir}`;
+    let id;
+    let alias;
+    if (input.address.includes("/")) {
+        if (!isProjectionId(input.address))
+            throw new AddressResolutionError("EMPTY_PARAM", `projection ${input.address} has no match ${suffix}`, attempt);
+        id = input.address;
+    }
+    else {
+        if (!isProjectionAlias(input.address))
+            throw new AddressResolutionError("EMPTY_PARAM", `projection alias ${input.address} has no match ${suffix}`, attempt);
+        const target = readProjectionAlias(physicalRoot, input.address);
+        if (!target)
+            throw new AddressResolutionError("EMPTY_PARAM", `projection alias ${input.address} has no match ${suffix}`, attempt);
+        id = target;
+        alias = input.address;
+    }
+    const directory = projectionDir(physicalRoot, id);
+    if (!isRealDirectory(directory)) {
+        const subject = alias ? `projection alias ${alias} points to missing projection ${id}` : `projection ${id}`;
+        throw new AddressResolutionError("EMPTY_PARAM", `${subject} has no match ${suffix}`, attempt);
+    }
+    let identity;
+    try {
+        identity = readProjectionIdentity(directory);
+    }
+    catch (error) {
+        if (error instanceof Error && /ENOENT|no such file/i.test(error.message)) {
+            const subject = alias ? `projection alias ${alias} points to missing projection ${id}` : `projection ${id}`;
+            throw new AddressResolutionError("EMPTY_PARAM", `${subject} has no match ${suffix}`, attempt);
+        }
+        throw error;
+    }
+    if (input.scope && (identity.binding.kind !== "commission" || identity.binding.commissionId !== input.scope.binding.commissionId)) {
+        throw new AddressResolutionError("EMPTY_PARAM", `projection ${id} has no match ${suffix}`, attempt);
+    }
+    return { id, ...(alias ? { alias } : {}) };
 }

package/build/cli/render/address.js

@@ -25,7 +25,7 @@ export function renderResolvedAddressReceipt(address, facts = {}) {
                 `repo ${address.repo.stableRoot}`,
                 `workdir ${address.workdir}`,
                 facts.artifactId ? `artifact ${facts.artifactId}` : undefined,
-                facts.projectionId ? `projection ${facts.projectionId}` : undefined,
+                facts.projectionId ? `projection ${facts.projectionId}${facts.projectionAlias ? ` (${facts.projectionAlias})` : ""}` : undefined,
             ].filter((part) => part !== undefined).join(" · ");
         }
         const repository = address.repo.kind === "repository"
@@ -37,7 +37,7 @@ export function renderResolvedAddressReceipt(address, facts = {}) {
             repository,
             `workdir ${address.workdir}`,
             facts.artifactId ? `artifact ${facts.artifactId}` : undefined,
-            facts.projectionId ? `projection ${facts.projectionId}` : undefined,
+            facts.projectionId ? `projection ${facts.projectionId}${facts.projectionAlias ? ` (${facts.projectionAlias})` : ""}` : undefined,
         ].filter((part) => part !== undefined).join(" · ");
     }
     return [
@@ -46,7 +46,7 @@ export function renderResolvedAddressReceipt(address, facts = {}) {
         `repo ${address.repo.stableRoot}`,
         `target ${address.target.branch}`,
         facts.artifactId ? `artifact ${facts.artifactId}` : undefined,
-        facts.projectionId ? `projection ${facts.projectionId}` : undefined,
+        facts.projectionId ? `projection ${facts.projectionId}${facts.projectionAlias ? ` (${facts.projectionAlias})` : ""}` : undefined,
         `via ${sourceLabel(address)}`,
     ].filter((part) => part !== undefined).join(" · ");
 }
@@ -61,7 +61,16 @@ function renderAttemptCandidate(candidate) {
         candidate.matchedBy ? `matched by ${candidate.matchedBy}` : undefined,
     ].filter((part) => part !== undefined).join(" · ");
 }
+function isCommissionResolutionAttempt(attempt) {
+    return attempt.expected === "commission";
+}
 export function renderResolutionAttemptPreamble(attempt) {
+    if (!isCommissionResolutionAttempt(attempt)) {
+        return [
+            attempt.repo.kind === "repository" ? `At repo ${attempt.repo.stableRoot}` : "At no repository",
+            attempt.scope ? `scope ${attempt.scope.asTyped}` : undefined,
+        ].filter((part) => part !== undefined).join(" · ");
+    }
     const parts = [
         attempt.repo.kind === "repository" ? `At repo ${attempt.repo.stableRoot}` : "At no repository",
         attempt.spelling ? `address ${attempt.spelling.asTyped}` : undefined,

package/build/cli/render/call.js

@@ -2,10 +2,12 @@ import { assembleResponse, buildPayload, buildSection, formatMaybe, formatWarnin
 import { WARNING_SECTION_TITLE } from "./response-style.js";
 import { CONTENT_SECTION_TITLE, formatPersistenceSummary, formatCallCompletionHeading, formatCallNextAction, INFO_AKUMA_MAX_CHARS, projectionRejoinHintLines, } from "./shared.js";
 import { carryAddress, prependAddressReceipt, renderResolvedAddressReceipt } from "./address.js";
-export function renderAdoptedLaunchReceipt(address, projectionId) {
+export function renderAdoptedLaunchReceipt(address, projectionId, alias, previousAliasTarget) {
     return [
-        renderResolvedAddressReceipt(address, { projectionId }),
-        ...projectionRejoinHintLines(projectionId),
+        renderResolvedAddressReceipt(address, { projectionId, ...(alias ? { projectionAlias: alias } : {}) }),
+        ...(alias ? [`alias ${alias} → ${projectionId}`] : []),
+        ...(alias && previousAliasTarget ? [`(moved from ${previousAliasTarget}, still running)`] : []),
+        ...projectionRejoinHintLines(alias ?? projectionId),
     ].join("\n");
 }
 export function buildCallResponse(result, input) {
@@ -15,8 +17,11 @@ export function buildCallResponse(result, input) {
         const { session: _session, evidenceCwd: _evidenceCwd, address: _address, foregroundWait: _foregroundWait, ...responseData } = result;
         const output = {
             text: input.addressPlacement === "stdout"
-                ? renderAdoptedLaunchReceipt(result.address, result.projection.id)
-                : projectionRejoinHintLines(result.projection.id).join("\n"),
+                ? renderAdoptedLaunchReceipt(result.address, result.projection.id, result.projection.alias, result.projection.previousAliasTarget)
+                : [
+                    ...(result.projection.alias ? [`alias ${result.projection.alias} → ${result.projection.id}`] : []),
+                    ...projectionRejoinHintLines(result.projection.alias ?? result.projection.id),
+                ].join("\n"),
             payload: buildPayload(responseData),
         };
         switch (input.addressPlacement) {

package/build/cli/render/shared.js

@@ -135,14 +135,14 @@ export function projectionRejoinHintLines(projectionId) {
 }
 export function formatCallNextAction(input) {
     if (input.projection?.phase === "active") {
-        return projectionRejoinHintLines(input.projection.id).join("\n");
+        return projectionRejoinHintLines(input.projection.alias ?? input.projection.id).join("\n");
     }
     if (input.projection?.phase === "done") {
         return [
             "The akuma is back.",
             ...(input.artifactId ? [`record: ${input.artifactId}`] : []),
             "talk to it:",
-            `  » keiyaku tell ${input.projection.id} "your words"`,
+            `  » keiyaku tell ${input.projection.alias ?? input.projection.id} "your words"`,
         ].join("\n");
     }
     return "⟶ keiyaku status";

package/build/cli/render/status.js

@@ -15,6 +15,16 @@ function renderProjectionDiagnostics(row) {
         return "";
     return ` · diag ${row.diagnostics.map((diagnostic) => diagnostic.detail).join("; ")}`;
 }
+function renderProjectionOmission(board) {
+    if (!board.omitted)
+        return undefined;
+    const counts = ["failed", "dead", "done", "dismissed"]
+        .flatMap((state) => {
+        const count = board.omitted?.byState[state] ?? 0;
+        return count > 0 ? [`${count} ${state}`] : [];
+    });
+    return `  · +${board.omitted.total} not shown (${counts.join(" · ")}) — keiyaku status --all`;
+}
 function renderProjectionAge(row) {
     if (row.state === "done")
         return "done";
@@ -63,18 +73,19 @@ function renderProjectionRow(row) {
         : row.state === "startup-timeout"
             ? "minting"
             : row.state);
+    const identity = row.alias ? `${row.id} (${row.alias})` : row.id;
     let heading;
     if (row.state === "startup-timeout" || row.state === "unknown") {
         const akuma = (row.akuma ?? "(unknown)").padEnd(18);
-        heading = `  ${glyph} ${row.id}    ${akuma} ${renderProjectionAge(row)}`.trimEnd();
+        heading = `  ${glyph} ${identity}    ${akuma} ${renderProjectionAge(row)}${renderProjectionDiagnostics(row)}`.trimEnd();
     }
     else if (row.state === "minting") {
-        heading = `  ${glyph} ${row.id.padEnd(18)} (minting)${renderProjectionDiagnostics(row)}`.trimEnd();
+        heading = `  ${glyph} ${identity.padEnd(18)} (minting)${renderProjectionDiagnostics(row)}`.trimEnd();
     }
     else {
         const age = renderProjectionAge(row).padEnd(9);
         const akuma = (row.akuma ?? "(unknown)").padEnd(18);
-        heading = `  ${glyph} ${row.id}    ${akuma} ${age}${renderProjectionTellCounts(row)}${renderProjectionDiagnostics(row)}`.trimEnd();
+        heading = `  ${glyph} ${identity}    ${akuma} ${age}${renderProjectionTellCounts(row)}${renderProjectionDiagnostics(row)}`.trimEnd();
     }
     const activity = renderProjectionActivityLine(row);
     return activity ? [heading, activity] : [heading];
@@ -82,7 +93,11 @@ function renderProjectionRow(row) {
 export function renderProjectionStatusSection(board) {
     if (!board || board.rows.length === 0)
         return "";
-    return `${STATUS_PROJECTION_SECTION_TITLE}\n${board.rows.flatMap(renderProjectionRow).join("\n")}\n`;
+    const lines = board.rows.flatMap(renderProjectionRow);
+    const omission = renderProjectionOmission(board);
+    if (omission)
+        lines.push(omission);
+    return `${STATUS_PROJECTION_SECTION_TITLE}\n${lines.join("\n")}\n`;
 }
 function renderClaimReconciliationSection(recon) {
     if (!recon)

package/build/cli/render/wait.js

@@ -3,7 +3,7 @@ import { displayColumns, resolveLineColumns, truncateColumns } from "./line-widt
 import { projectionRejoinHintLines, textResponse } from "./shared.js";
 const WAIT_HEADER_MAX_COLUMNS = 60;
 function shortAddress(projectionId) {
-    return /-([0-9a-f]{8})$/.exec(projectionId)?.[1] ?? projectionId;
+    return /\/([0-9a-f]{8})$/.exec(projectionId)?.[1] ?? projectionId;
 }
 function phaseState(phase) {
     switch (phase) {
@@ -42,7 +42,7 @@ function waitStateText(snapshot) {
     }
 }
 function projectionIdentityParts(projectionId) {
-    const match = /^(.*)-([0-9a-f]{8})$/.exec(projectionId);
+    const match = /^(.*)\/([0-9a-f]{8})$/.exec(projectionId);
     return match ? { slug: match[1], shortId: match[2] } : { slug: "", shortId: projectionId };
 }
 function waitHeader(projectionId, akuma, snapshot, outputColumns) {
@@ -215,7 +215,7 @@ export function buildWaitResponse(projectionId, result, options = {}) {
     if (rendered.lines.length === 0 && state === "running") {
         lines.push("   not a word out of it yet — pulse is steady");
     }
-    const nextActions = nextActionLines(projectionId, result, state);
+    const nextActions = nextActionLines(options.alias ?? projectionId, result, state);
     if (rendered.hasMutationFiles && nextActions.length > 0)
         lines.push("");
     lines.push(...nextActions);

package/build/config/provider-policy-ownership.js

@@ -0,0 +1,39 @@
+const EMPTY_OWNERSHIP = Object.freeze({
+    access: Object.freeze([]),
+    network: Object.freeze([]),
+    webSearch: Object.freeze([]),
+});
+function owns(config, key) {
+    return Object.prototype.hasOwnProperty.call(config, key);
+}
+export function nativePolicyOwnership(instanceName, instance) {
+    if (instance.kind !== "codex-sdk" && instance.kind !== "codex-app-server") {
+        return EMPTY_OWNERSHIP;
+    }
+    const config = instance.config;
+    if (!config)
+        return EMPTY_OWNERSHIP;
+    const access = [];
+    const network = [];
+    const webSearch = [];
+    const add = (target, key) => {
+        target.push({ path: `providers.${instanceName}.config.${key}`, value: config[key] });
+    };
+    if (owns(config, "sandbox_mode"))
+        add(access, "sandbox_mode");
+    if (owns(config, "approval_policy"))
+        add(access, "approval_policy");
+    for (const key of Object.keys(config)) {
+        if (key !== "sandbox_workspace_write" && !key.startsWith("sandbox_workspace_write."))
+            continue;
+        add(access, key);
+        add(network, key);
+    }
+    if (owns(config, "web_search"))
+        add(webSearch, "web_search");
+    return Object.freeze({
+        access: Object.freeze(access),
+        network: Object.freeze(network),
+        webSearch: Object.freeze(webSearch),
+    });
+}

package/build/config/settings.js

@@ -41,19 +41,9 @@ const CODEX_SDK_FORBIDDEN_THREAD_OPTIONS_KEYS = [
 const FORBIDDEN_CONFIG_KEYS = [
     "model",
     "model_reasoning_effort",
-    "sandbox_mode",
-    "sandbox_workspace_write",
-    "web_search",
-    "approval_policy",
 ];
 function isConfigKeyForbidden(key) {
-    // Exact match for model, model_reasoning_effort, sandbox_mode, web_search, approval_policy
-    if (FORBIDDEN_CONFIG_KEYS.includes(key))
-        return true;
-    // sandbox_workspace_write also rejects dotted subkeys from adapter-native TOML flattening
-    if (key.startsWith("sandbox_workspace_write."))
-        return true;
-    return false;
+    return FORBIDDEN_CONFIG_KEYS.includes(key);
 }
 const claudeSettingSourceSchema = z.enum(CLAUDE_SETTING_SOURCES);
 const writableRootItemSchema = z.string().superRefine((value, ctx) => {