@epoch-agent/cli 0.2.0 → 0.3.1

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
-  writeProviderKey
-} from "./chunk-UEHBHZCZ.js";
+  writeProviderSecret
+} from "./chunk-4SOT24BS.js";
 // src/index.ts
 import { Command } from "commander";
-import { t as t38 } from "@epoch-agent/infra";
+import { t as t39 } from "@epoch-agent/infra";
 // src/commands/agents.ts
 import { AGENT_ROLE_DIAG_MODULE, findRole, roleSourceLabel } from "@epoch-agent/core";
 import { t as t2 } from "@epoch-agent/infra";
@@ -331,9 +331,122 @@ function registerCompletionCommand(program2) {
     process.stdout.write(renderCompletion(program2, shell));
   });
 }
+// src/commands/compliance.ts
+import {
+  ComplianceEngine,
+  DEFAULT_COMPLIANCE_SETTINGS,
+  loadConfig,
+  loadLexiconFiles,
+  resolveComplianceDir,
+  resolveComplianceDirs
+} from "@epoch-agent/core";
+import { t as t4 } from "@epoch-agent/infra";
+// src/paths.ts
+import { existsSync, mkdirSync } from "fs";
+import { hasProviderCredentials } from "@epoch-agent/core";
+import { configPath, envPath, resolveHomeDir } from "@epoch-agent/infra";
+var EPOCH_HOME = resolveHomeDir();
+var CONFIG_PATH = configPath(EPOCH_HOME);
+var ENV_PATH = envPath(EPOCH_HOME);
+function ensureEpochHome() {
+  if (!existsSync(EPOCH_HOME)) mkdirSync(EPOCH_HOME, { recursive: true });
+}
+function hasCredentials() {
+  return hasProviderCredentials(EPOCH_HOME);
+}
+// src/commands/compliance.ts
+var log2 = (msg) => process.stdout.write(msg + "\n");
+function buildEngine() {
+  const config = loadConfig(void 0, { homeDir: EPOCH_HOME });
+  const settings = {
+    enabled: config.compliance?.enabled ?? DEFAULT_COMPLIANCE_SETTINGS.enabled,
+    scope: { ...DEFAULT_COMPLIANCE_SETTINGS.scope, ...config.compliance?.scope },
+    skipCodeBlocks: config.compliance?.skipCodeBlocks ?? DEFAULT_COMPLIANCE_SETTINGS.skipCodeBlocks,
+    maxHoldChars: config.compliance?.maxHoldChars ?? DEFAULT_COMPLIANCE_SETTINGS.maxHoldChars,
+    actions: { ...DEFAULT_COMPLIANCE_SETTINGS.actions, ...config.compliance?.actions }
+  };
+  const userDir = resolveComplianceDir(config.homeDir);
+  const dirs = resolveComplianceDirs({ userDir, trusted: false });
+  const rules = [];
+  const exempt = [];
+  for (const spec of dirs.dirs) {
+    const loaded = loadLexiconFiles(spec.dir, spec.source);
+    rules.push(...loaded.rules);
+    exempt.push(...loaded.exempt);
+  }
+  return { engine: new ComplianceEngine({ settings, rules, exempt }), settings, dir: userDir };
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+  return Buffer.concat(chunks).toString("utf-8");
+}
+function checkText(text) {
+  const { engine, settings } = buildEngine();
+  if (!settings.enabled) {
+    log2(t4("compliance_cmd.disabled"));
+    return 0;
+  }
+  const gate = engine.inspect(text);
+  if (!gate) {
+    log2(t4("compliance_cmd.clean"));
+    return 0;
+  }
+  const { text: released, verdict } = gate;
+  log2(t4("compliance_cmd.verdict", { action: verdict.action, count: verdict.hits.length }));
+  for (const hit of verdict.hits) {
+    log2(
+      t4("compliance_cmd.hit", {
+        category: hit.category,
+        action: hit.action,
+        rule: hit.ruleId,
+        excerpt: text.slice(hit.start, hit.end)
+      })
+    );
+  }
+  if (verdict.action === "block") log2(t4("compliance_cmd.blocked"));
+  else log2(t4("compliance_cmd.released", { text: released }));
+  return verdict.action === "warn" ? 0 : 1;
+}
+function printStatus() {
+  const { engine, settings, dir } = buildEngine();
+  log2(t4("compliance_cmd.status_enabled", { enabled: String(settings.enabled) }));
+  log2(
+    t4("compliance_cmd.status_rules", {
+      active: engine.activeRuleCount,
+      builtin: engine.counts.builtin,
+      user: engine.counts.user
+    })
+  );
+  log2(t4("compliance_cmd.status_dir", { dir }));
+  log2(
+    t4("compliance_cmd.status_scope", {
+      output: String(settings.scope.output),
+      input: String(settings.scope.input),
+      code: String(settings.skipCodeBlocks)
+    })
+  );
+  for (const [category, action] of Object.entries(settings.actions)) {
+    log2(t4("compliance_cmd.status_action", { category, action }));
+  }
+  log2(t4("compliance_cmd.status_project_note"));
+}
+function registerComplianceCommand(program2) {
+  const cmd = program2.command("compliance").description(t4("compliance_cmd.cmd_root"));
+  cmd.command("check", { isDefault: true }).description(t4("compliance_cmd.cmd_check")).argument("[text]", t4("compliance_cmd.arg_text")).option("--stdin", t4("compliance_cmd.opt_stdin")).action(async (text, opts) => {
+    const input2 = opts.stdin ? await readStdin() : text;
+    if (!input2) {
+      log2(t4("compliance_cmd.need_text"));
+      process.exitCode = 2;
+      return;
+    }
+    process.exitCode = checkText(input2);
+  });
+  cmd.command("status").description(t4("compliance_cmd.cmd_status")).action(() => printStatus());
+}
 // src/commands/config.ts
 import { existsSync as existsSync2, readFileSync } from "fs";
-import { maskApiKey, t as t4 } from "@epoch-agent/infra";
+import { maskApiKey, t as t5 } from "@epoch-agent/infra";
 import {
   API_KEY_ENV_VARS,
   isPermissionLevel,
@@ -354,35 +467,48 @@ import {
   unsetSectionField,
   writeConfigYaml
 } from "@epoch-agent/infra";
-// src/paths.ts
-import { existsSync, mkdirSync } from "fs";
-import { hasProviderCredentials } from "@epoch-agent/core";
-import { configPath, envPath, resolveHomeDir } from "@epoch-agent/infra";
-var EPOCH_HOME = resolveHomeDir();
-var CONFIG_PATH = configPath(EPOCH_HOME);
-var ENV_PATH = envPath(EPOCH_HOME);
-function ensureEpochHome() {
-  if (!existsSync(EPOCH_HOME)) mkdirSync(EPOCH_HOME, { recursive: true });
-}
-function hasCredentials() {
-  return hasProviderCredentials(EPOCH_HOME);
-}
 // src/commands/config.ts
-var log2 = (msg) => {
+var log3 = (msg) => {
   process.stdout.write(msg + "\n");
 };
 function isPositiveNumber(v) {
   const n = Number(v);
   return Number.isFinite(n) && n > 0;
 }
+function isPositiveInt(v) {
+  return isPositiveNumber(v) && Number.isInteger(Number(v));
+}
 var BUDGET_FIELDS = {
   maxCostUsd: isPositiveNumber,
   maxTokens: isPositiveNumber,
   warnAtPercent: (v) => isPositiveNumber(v) && Number(v) <= 100,
   onUnknownPricing: (v) => v === "block" || v === "warn"
 };
+var SCALAR_FIELDS = {
+  maxTurns: isPositiveInt,
+  contextLength: isPositiveInt
+};
+var SECTION_FIELDS = {
+  budget: BUDGET_FIELDS,
+  compression: {
+    enabled: (v) => v === "true" || v === "false",
+    threshold: (v) => Number.isFinite(Number(v)) && Number(v) > 0 && Number(v) <= 1
+  }
+};
 function knownKeys() {
-  return `provider, model, models.utility, permission, shell, ` + Object.keys(BUDGET_FIELDS).map((f) => `budget.${f}`).join(", ");
+  const nested = Object.entries(SECTION_FIELDS).flatMap(
+    ([section, fields]) => Object.keys(fields).map((field) => `${section}.${field}`)
+  );
+  return [
+    "provider",
+    "model",
+    "models.utility",
+    "fallback.model",
+    "permission",
+    "shell",
+    ...Object.keys(SCALAR_FIELDS),
+    ...nested
+  ].join(", ");
 }
 function maskSecrets(yaml) {
   return yaml.replace(/^(\s*(?:apiKey|api_key|token|secret)\s*:\s*)(.+)$/gim, (_m, head, raw) => {
@@ -392,111 +518,111 @@ function maskSecrets(yaml) {
   });
 }
 function registerConfigCommand(program2) {
-  const cmd = program2.command("config").description(t4("cli.config.summary"));
-  cmd.command("show").description(t4("cli.config.show")).option("--raw", t4("cli.config.opt_raw")).action((opts) => {
+  const cmd = program2.command("config").description(t5("cli.config.summary"));
+  cmd.command("show").description(t5("cli.config.show")).option("--raw", t5("cli.config.opt_raw")).action((opts) => {
     if (!existsSync2(CONFIG_PATH)) {
-      log2(t4("cli.config.not_configured"));
+      log3(t5("cli.config.not_configured"));
     } else {
       const yaml = readFileSync(CONFIG_PATH, "utf-8").trim();
-      log2(opts.raw ? yaml : maskSecrets(yaml));
+      log3(opts.raw ? yaml : maskSecrets(yaml));
     }
   });
-  cmd.command("path").description(t4("cli.config.path")).action(() => log2(CONFIG_PATH));
-  cmd.command("get").description(t4("cli.config.get")).argument("<key>", t4("cli.config.keys")).action((key) => {
+  cmd.command("path").description(t5("cli.config.path")).action(() => log3(CONFIG_PATH));
+  cmd.command("get").description(t5("cli.config.get")).argument("<key>", t5("cli.config.keys")).action((key) => {
     const value = readKey(
       readConfigYaml(CONFIG_PATH),
       key === "provider" ? "provider.type" : key
     );
-    if (value === void 0) throw new CliError(t4("cli.config.unset_key", { key }));
-    log2(value);
+    if (value === void 0) throw new CliError(t5("cli.config.unset_key", { key }));
+    log3(value);
   });
-  cmd.command("set").description(t4("cli.config.set")).argument("<key>", t4("cli.config.keys")).argument("<value>", t4("cli.config.value")).action((key, value) => {
+  cmd.command("set").description(t5("cli.config.set")).argument("<key>", t5("cli.config.keys")).argument("<value>", t5("cli.config.value")).action((key, value) => {
     ensureEpochHome();
     writeConfigYaml(CONFIG_PATH, applySet(readConfigYaml(CONFIG_PATH), key, value));
-    log2(`\u2705 ${key} = ${value}`);
+    log3(`\u2705 ${key} = ${value}`);
   });
-  cmd.command("unset").description(t4("cli.config.unset")).argument("<key>", t4("cli.config.keys_unset")).action((key) => {
+  cmd.command("unset").description(t5("cli.config.unset")).argument("<key>", t5("cli.config.keys_unset")).action((key) => {
     ensureEpochHome();
     writeConfigYaml(CONFIG_PATH, applyUnset(readConfigYaml(CONFIG_PATH), key));
-    log2(`\u2705 ${t4("cli.config.removed", { key })}`);
+    log3(`\u2705 ${t5("cli.config.removed", { key })}`);
   });
   registerSchemaCommand(cmd);
   registerSecretCommand(cmd);
 }
 function registerSchemaCommand(cmd) {
-  cmd.command("schema").description(t4("cli.config.schema")).action(async () => {
+  cmd.command("schema").description(t5("cli.config.schema")).action(async () => {
     const { resolveProjectRoot: resolveProjectRoot4 } = await import("@epoch-agent/core");
     const root = resolveProjectRoot4(process.cwd());
     const { writeProjectSchemas } = await import("./schema-file-DH6X4N4K.js");
     const written = await writeProjectSchemas(root);
-    for (const entry of written) log2(`\u2705 ${entry.path}`);
-    log2("");
-    log2(t4("cli.config.schema_paste_hint"));
-    log2(`  { "$schema": "${written[0]?.reference ?? ""}", \u2026 }`);
+    for (const entry of written) log3(`\u2705 ${entry.path}`);
+    log3("");
+    log3(t5("cli.config.schema_paste_hint"));
+    log3(`  { "$schema": "${written[0]?.reference ?? ""}", \u2026 }`);
   });
 }
 function registerSecretCommand(cmd) {
-  cmd.command("secret").description(t4("cli.config.secret")).option("--export", t4("cli.config.opt_export")).action(async (opts) => {
+  cmd.command("secret").description(t5("cli.config.secret")).option("--export", t5("cli.config.opt_export")).action(async (opts) => {
     const { ensureSecretsReady } = await import("@epoch-agent/runtime");
     await ensureSecretsReady();
     const { getSecretStore } = await import("@epoch-agent/infra");
     const store = getSecretStore();
-    if (!store) throw new CliError(t4("cli.config.secret_not_ready"));
+    if (!store) throw new CliError(t5("cli.config.secret_not_ready"));
     if (opts.export) await exportSecrets(store);
     else await printSecretStatus(store);
   });
 }
 async function printSecretStatus(store) {
-  log2(
-    `${store.encrypted ? "\u2713" : "\u26A0"} ${t4("cli.config.secret_backend", {
+  log3(
+    `${store.encrypted ? "\u2713" : "\u26A0"} ${t5("cli.config.secret_backend", {
       backend: store.backend,
       detail: store.detail
     })}`
   );
   const names = (await store.list()).filter((n) => API_KEY_ENV_VARS.includes(n));
   if (names.length === 0) {
-    log2(t4("cli.config.secret_empty"));
+    log3(t5("cli.config.secret_empty"));
     return;
   }
-  for (const name of names) log2(`  ${name}`);
+  for (const name of names) log3(`  ${name}`);
 }
 async function exportSecrets(store) {
   const { isNonInteractive: isNonInteractive9 } = await import("@epoch-agent/core");
   if (isNonInteractive9()) {
-    throw new CliError(t4("cli.config.export_needs_tty"), 1, t4("cli.config.export_needs_tty_hint"));
+    throw new CliError(t5("cli.config.export_needs_tty"), 1, t5("cli.config.export_needs_tty_hint"));
   }
   const { confirm } = await import("@inquirer/prompts");
-  log2(t4("cli.config.export_about_to", { path: ENV_PATH }));
-  if (!await confirm({ message: t4("cli.config.export_confirm"), default: false })) {
-    log2(t4("cli.config.cancelled"));
+  log3(t5("cli.config.export_about_to", { path: ENV_PATH }));
+  if (!await confirm({ message: t5("cli.config.export_confirm"), default: false })) {
+    log3(t5("cli.config.cancelled"));
     return;
   }
   const again = await confirm({
-    message: t4("cli.config.export_confirm_again", { path: ENV_PATH }),
+    message: t5("cli.config.export_confirm_again", { path: ENV_PATH }),
     default: false
   });
   if (!again) {
-    log2(t4("cli.config.cancelled"));
+    log3(t5("cli.config.cancelled"));
     return;
   }
   ensureEpochHome();
-  const { exportSecretsToEnv } = await import("./env-file-O6P454IQ.js");
+  const { exportSecretsToEnv } = await import("./env-file-ERS45V7K.js");
   const written = await exportSecretsToEnv(store, ENV_PATH, API_KEY_ENV_VARS);
   if (written.length === 0) {
-    log2(t4("cli.config.export_nothing"));
+    log3(t5("cli.config.export_nothing"));
     return;
   }
-  log2(`\u2705 ${t4("cli.config.export_done", { count: written.length, path: ENV_PATH })}`);
-  log2(t4("cli.config.export_done_note"));
+  log3(`\u2705 ${t5("cli.config.export_done", { count: written.length, path: ENV_PATH })}`);
+  log3(t5("cli.config.export_done_note"));
 }
 function applySet(yaml, key, value) {
   switch (key) {
     case "provider":
       if (!isProviderType(value)) {
         throw new CliError(
-          t4("cli.config.unknown_provider", { value }),
+          t5("cli.config.unknown_provider", { value }),
           1,
-          t4("cli.config.supported", { list: PROVIDER_TYPES.join(", ") })
+          t5("cli.config.supported", { list: PROVIDER_TYPES.join(", ") })
         );
       }
       return yaml.replace(/^(\s*)type:.*$/m, `$1type: ${value}`);
@@ -505,134 +631,146 @@ function applySet(yaml, key, value) {
     case "permission":
       if (!isPermissionLevel(value)) {
         throw new CliError(
-          t4("cli.config.unknown_permission", { value }),
+          t5("cli.config.unknown_permission", { value }),
           1,
-          t4("cli.config.supported", { list: PERMISSION_LEVELS.join(", ") })
+          t5("cli.config.supported", { list: PERMISSION_LEVELS.join(", ") })
         );
       }
       return setScalar(yaml, "permission", value);
     case "shell": {
       if (!SHELL_KINDS.includes(value)) {
         throw new CliError(
-          t4("cli.config.unknown_shell", { value }),
+          t5("cli.config.unknown_shell", { value }),
           1,
-          t4("cli.config.supported", { list: SHELL_KINDS.join(", ") })
+          t5("cli.config.supported", { list: SHELL_KINDS.join(", ") })
         );
       }
       return setScalar(yaml, "shell", value);
     }
-    case "models.utility": {
+    case "models.utility":
+    case "fallback.model": {
       if (!parseModelRef(value)) {
-        throw new CliError(t4("cli.config.utility_empty"), 1, t4("cli.config.utility_hint"));
+        throw new CliError(t5("cli.config.utility_empty"), 1, t5("cli.config.utility_hint"));
       }
-      return setSectionField(yaml, "models", "utility", value);
+      const [section, field] = key.split(".");
+      return setSectionField(yaml, section, field, value);
     }
     default: {
-      const field = budgetField(key);
-      const validate = BUDGET_FIELDS[field];
-      if (!validate)
+      const scalar = SCALAR_FIELDS[key];
+      if (scalar) {
+        if (!scalar(value)) throw new CliError(t5("cli.config.bad_value", { key, value }));
+        return setScalar(yaml, key, value);
+      }
+      const [section, field] = splitSection(key);
+      const validate = field === void 0 ? void 0 : SECTION_FIELDS[section]?.[field];
+      if (!validate || field === void 0)
         throw new CliError(
-          t4("cli.config.unknown_key", { key }),
+          t5("cli.config.unknown_key", { key }),
           1,
-          t4("cli.config.supported", { list: knownKeys() })
+          t5("cli.config.supported", { list: knownKeys() })
         );
-      if (!validate(value)) throw new CliError(t4("cli.config.bad_value", { key, value }));
-      return setSectionField(yaml, "budget", field, value);
+      if (!validate(value)) throw new CliError(t5("cli.config.bad_value", { key, value }));
+      return setSectionField(yaml, section, field, value);
     }
   }
 }
 function applyUnset(yaml, key) {
   if (key === "model" || key === "permission" || key === "shell") return unsetScalar(yaml, key);
+  if (SCALAR_FIELDS[key]) return unsetScalar(yaml, key);
   if (key === "models.utility") return unsetSectionField(yaml, "models", "utility");
-  const field = budgetField(key);
-  if (BUDGET_FIELDS[field]) return unsetSectionField(yaml, "budget", field);
-  throw new CliError(t4("cli.config.cannot_unset", { key }), 1, t4("cli.config.can_unset"));
+  if (key === "fallback.model") return unsetSectionField(yaml, "fallback", "model");
+  const [section, field] = splitSection(key);
+  if (field !== void 0 && SECTION_FIELDS[section]?.[field]) {
+    return unsetSectionField(yaml, section, field);
+  }
+  throw new CliError(t5("cli.config.cannot_unset", { key }), 1, t5("cli.config.can_unset"));
 }
-function budgetField(key) {
-  return key.startsWith("budget.") ? key.slice("budget.".length) : "";
+function splitSection(key) {
+  const dot = key.indexOf(".");
+  return dot < 0 ? [key, void 0] : [key.slice(0, dot), key.slice(dot + 1)];
 }
 // src/commands/mcp.ts
-import { t as t5, uiDateLocale } from "@epoch-agent/infra";
+import { t as t6, uiDateLocale } from "@epoch-agent/infra";
 import {
   listMcpServers,
   mcpLogin,
   mcpLogout,
   probeMcpServer
 } from "@epoch-agent/runtime";
-var log3 = (msg) => process.stdout.write(msg + "\n");
+var log4 = (msg) => process.stdout.write(msg + "\n");
 var warn = (msg) => process.stderr.write(msg + "\n");
 function stateLabel(state) {
   switch (state) {
     case "not-applicable":
-      return t5("mcp.state_not_applicable");
+      return t6("mcp.state_not_applicable");
     case "bearer-header":
-      return t5("mcp.state_bearer");
+      return t6("mcp.state_bearer");
     case "authorized":
-      return t5("mcp.state_authorized");
+      return t6("mcp.state_authorized");
     case "refreshable":
-      return t5("mcp.state_refreshable");
+      return t6("mcp.state_refreshable");
     case "logged-out":
-      return t5("mcp.state_logged_out");
+      return t6("mcp.state_logged_out");
   }
 }
 function registerMcpCommand(program2) {
-  const cmd = program2.command("mcp").description(t5("mcp.cmd_root"));
-  cmd.command("list", { isDefault: true }).description(t5("mcp.cmd_list")).action(() => guardAsync(() => printList()));
-  cmd.command("status").description(t5("mcp.cmd_status")).argument("<name>", t5("mcp.arg_name")).action(
+  const cmd = program2.command("mcp").description(t6("mcp.cmd_root"));
+  cmd.command("list", { isDefault: true }).description(t6("mcp.cmd_list")).action(() => guardAsync(() => printList()));
+  cmd.command("status").description(t6("mcp.cmd_status")).argument("<name>", t6("mcp.arg_name")).action(
     (name) => guardAsync(async () => {
-      log3(t5("mcp.connecting", { name }));
+      log4(t6("mcp.connecting", { name }));
       const result = await probeMcpServer(name, { homeDir: EPOCH_HOME });
       if (!result.connected) {
         warn(
-          result.error ? t5("mcp.connect_failed_reason", { reason: result.error }) : t5("mcp.connect_failed")
+          result.error ? t6("mcp.connect_failed_reason", { reason: result.error }) : t6("mcp.connect_failed")
         );
-        if (result.needsLogin) warn(t5("mcp.needs_login", { name }));
+        if (result.needsLogin) warn(t6("mcp.needs_login", { name }));
         process.exit(1);
       }
-      log3(`\u2713 ${t5("mcp.connected", { count: result.toolNames.length })}`);
-      for (const tool of result.toolNames) log3(`  ${tool}`);
+      log4(`\u2713 ${t6("mcp.connected", { count: result.toolNames.length })}`);
+      for (const tool of result.toolNames) log4(`  ${tool}`);
     })
   );
-  cmd.command("login").description(t5("mcp.cmd_login")).argument("<name>", t5("mcp.arg_name")).option("--port <port>", t5("mcp.opt_port")).option("--scope <scope>", t5("mcp.opt_scope")).action(
+  cmd.command("login").description(t6("mcp.cmd_login")).argument("<name>", t6("mcp.arg_name")).option("--port <port>", t6("mcp.opt_port")).option("--scope <scope>", t6("mcp.opt_scope")).action(
     (name, opts) => guardAsync(async () => {
       const port = opts.port === void 0 ? void 0 : parsePort(opts.port);
       const { refreshedOnly } = await mcpLogin(name, {
         homeDir: EPOCH_HOME,
         ...port === void 0 ? {} : { port },
         ...opts.scope === void 0 ? {} : { scope: opts.scope },
-        print: log3
+        print: log4
       });
-      log3(
-        refreshedOnly ? `\u2713 ${t5("mcp.refreshed", { name })}` : `\u2713 ${t5("mcp.authorized", { name })}`
+      log4(
+        refreshedOnly ? `\u2713 ${t6("mcp.refreshed", { name })}` : `\u2713 ${t6("mcp.authorized", { name })}`
       );
     })
   );
-  cmd.command("logout").description(t5("mcp.cmd_logout")).argument("<name>", t5("mcp.arg_name")).action(
+  cmd.command("logout").description(t6("mcp.cmd_logout")).argument("<name>", t6("mcp.arg_name")).action(
     (name) => guardAsync(async () => {
       const removed = await mcpLogout(name, { homeDir: EPOCH_HOME });
-      log3(removed ? `\u2713 ${t5("mcp.removed", { name })}` : t5("mcp.nothing_stored", { name }));
+      log4(removed ? `\u2713 ${t6("mcp.removed", { name })}` : t6("mcp.nothing_stored", { name }));
     })
   );
 }
 async function printList() {
   const { servers, issues, configPath: configPath2 } = await listMcpServers({ homeDir: EPOCH_HOME });
   for (const issue of issues)
-    warn(t5("mcp.config_issue", { path: issue.path, message: issue.message }));
-  log3(t5("mcp.list_head", { path: configPath2 }));
+    warn(t6("mcp.config_issue", { path: issue.path, message: issue.message }));
+  log4(t6("mcp.list_head", { path: configPath2 }));
   if (servers.length === 0) {
-    log3(t5("mcp.list_empty"));
+    log4(t6("mcp.list_empty"));
     return;
   }
-  for (const s of servers) log3(`  ${describe(s)}`);
+  for (const s of servers) log4(`  ${describe(s)}`);
 }
 function describe(s) {
   const target = s.config.transport === "stdio" ? s.config.command : s.config.url;
   const parts = [
     `${s.config.name}  [${s.config.transport}]  ${target ?? ""}`,
-    t5("mcp.auth_line", { state: stateLabel(s.auth.state) })
+    t6("mcp.auth_line", { state: stateLabel(s.auth.state) })
   ];
   if (s.auth.expiresAt) {
-    parts[1] += t5("mcp.expires_at", {
+    parts[1] += t6("mcp.expires_at", {
       when: new Date(s.auth.expiresAt).toLocaleString(uiDateLocale())
     });
   }
@@ -641,42 +779,42 @@ function describe(s) {
 function parsePort(raw) {
   const port = Number(raw);
   if (!Number.isInteger(port) || port < 1024 || port > 65535) {
-    throw new Error(t5("mcp.bad_port", { raw }));
+    throw new Error(t6("mcp.bad_port", { raw }));
   }
   return port;
 }
 function guardAsync(fn) {
   fn().catch((err2) => {
-    warn(t5("mcp.error", { message: err2 instanceof Error ? err2.message : String(err2) }));
+    warn(t6("mcp.error", { message: err2 instanceof Error ? err2.message : String(err2) }));
     process.exit(1);
   });
 }
 // src/commands/model.ts
 import { input, password, select } from "@inquirer/prompts";
 import { isNonInteractive, readProviderKeyEnv } from "@epoch-agent/core";
-import { t as t6 } from "@epoch-agent/infra";
+import { t as t7 } from "@epoch-agent/infra";
 import {
   apiKeyEnvVar,
   PROVIDER_INFOS,
   PROVIDER_TYPES as PROVIDER_TYPES2
 } from "@epoch-agent/protocol";
 import { providerLabel } from "@epoch-agent/runtime";
-var log4 = (msg) => process.stdout.write(msg + "\n");
+var log5 = (msg) => process.stdout.write(msg + "\n");
 var CUSTOM = "__custom__";
 function registerModelCommand(program2) {
-  program2.command("model").description(t6("model.cmd_root")).option("-r, --refresh", t6("model.opt_refresh")).action(async (opts) => {
+  program2.command("model").description(t7("model.cmd_root")).option("-r, --refresh", t7("model.opt_refresh")).action(async (opts) => {
     ensureEpochHome();
     if (opts.refresh) return refreshCache();
     if (isNonInteractive()) {
-      throw new CliError(t6("model.needs_tty"), 1, t6("model.needs_tty_hint"));
+      throw new CliError(t7("model.needs_tty"), 1, t7("model.needs_tty_hint"));
     }
     await runWizard();
   });
 }
 async function refreshCache() {
   const { clearModelCache } = await import("@epoch-agent/core");
-  for (const t39 of PROVIDER_TYPES2) clearModelCache(EPOCH_HOME, t39);
-  log4(t6("model.cache_cleared"));
+  for (const t40 of PROVIDER_TYPES2) clearModelCache(EPOCH_HOME, t40);
+  log5(t7("model.cache_cleared"));
 }
 function readCurrentSelection() {
   const yaml = readConfigYaml(CONFIG_PATH);
@@ -686,7 +824,7 @@ async function runWizard() {
   await ensureSecrets();
   const current = readCurrentSelection();
   const provider = await select({
-    message: t6("model.pick_provider"),
+    message: t7("model.pick_provider"),
     choices: providerChoices(current.provider),
     pageSize: listPageSize(PROVIDER_INFOS.filter((p) => p.interactive).length),
     ...isKnownProvider(current.provider) ? { default: current.provider } : {}
@@ -695,42 +833,42 @@ async function runWizard() {
   const keyForDiscover = await resolveApiKey(provider);
   const { discoverModels } = await import("@epoch-agent/core");
   const result = await discoverModels(EPOCH_HOME, provider, keyForDiscover, baseUrl);
-  log4(describeDiscovery(result.source, result.models.length, keyForDiscover !== ""));
+  log5(describeDiscovery(result.source, result.models.length, keyForDiscover !== ""));
   const model = await pickModel(result.models, result.source, carriedModel(provider, current));
   let yaml = readConfigYaml(CONFIG_PATH);
   yaml = setSectionField(yaml, "provider", "type", provider);
   if (baseUrl) yaml = setSectionField(yaml, "provider", "baseUrl", baseUrl);
   yaml = setScalar(yaml, "model", model);
   writeConfigYaml(CONFIG_PATH, yaml);
-  log4(`
+  log5(`
 \u2705 ${provider} / ${model}
-${t6("model.ready")}`);
+${t7("model.ready")}`);
 }
 async function ensureSecrets() {
   try {
     const { ensureSecretsReady } = await import("@epoch-agent/runtime");
     await ensureSecretsReady();
   } catch (err2) {
-    log4(t6("model.secret_init_failed", { reason: describeError(err2) }));
+    log5(t7("model.secret_init_failed", { reason: describeError(err2) }));
   }
 }
 async function resolveApiKey(provider) {
   const envKey = apiKeyEnvVar(provider);
   if (!envKey) return "";
   const existing = readProviderKeyEnv(EPOCH_HOME)[envKey];
-  const message = existing ? t6("model.api_key_existing", { envKey }) : t6("model.api_key", { envKey });
+  const message = existing ? t7("model.api_key_existing", { envKey }) : t7("model.api_key", { envKey });
   const typed = (await password({ message, mask: "*" })).trim();
   if (!typed) return existing ?? "";
   await saveApiKey(envKey, typed);
   return typed;
 }
 async function saveApiKey(envKey, apiKey) {
-  const result = await writeProviderKey(envKey, apiKey, ENV_PATH);
-  log4(result.encrypted ? t6("model.key_stored", { detail: result.detail }) : `  \u26A0 ${result.detail}`);
+  const result = await writeProviderSecret(envKey, apiKey, ENV_PATH);
+  log5(result.encrypted ? t7("model.key_stored", { detail: result.detail }) : `  \u26A0 ${result.detail}`);
 }
 async function askBaseUrl() {
   const answer = (await input({
-    message: t6("model.ask_base_url"),
+    message: t7("model.ask_base_url"),
     default: "http://localhost:8080/v1"
   })).trim();
   return answer || void 0;
@@ -739,17 +877,17 @@ async function pickModel(models, source, currentModel) {
   const choices3 = modelChoices(models, source, currentModel);
   if (choices3.length === 0) {
     const fallback2 = currentModel ?? "gpt-4o-mini";
-    return await input({ message: t6("model.type_model"), default: fallback2 }) || fallback2;
+    return await input({ message: t7("model.type_model"), default: fallback2 }) || fallback2;
   }
   const picked = await select({
-    message: t6("model.pick_model"),
+    message: t7("model.pick_model"),
     choices: choices3,
     pageSize: listPageSize(choices3.length),
     ...currentModel && models.includes(currentModel) ? { default: currentModel } : {}
   });
   if (picked !== CUSTOM) return picked;
   const fallback = currentModel ?? models[0] ?? "gpt-4o-mini";
-  return await input({ message: t6("model.type_model"), default: fallback }) || fallback;
+  return await input({ message: t7("model.type_model"), default: fallback }) || fallback;
 }
 function isKnownProvider(value) {
   return PROVIDER_INFOS.some((p) => p.interactive && p.type === value);
@@ -761,7 +899,7 @@ function providerChoices(currentProvider) {
   return PROVIDER_INFOS.filter((p) => p.interactive).map((p) => {
     const label = providerLabel(p);
     return {
-      name: p.type === currentProvider ? t6("model.current", { label }) : label,
+      name: p.type === currentProvider ? t7("model.current", { label }) : label,
       value: p.type
     };
   });
@@ -769,16 +907,16 @@ function providerChoices(currentProvider) {
 function modelChoices(models, source, currentModel) {
   if (models.length === 0) return [];
   const choices3 = models.map((m) => ({
-    name: m === currentModel ? t6("model.current", { label: m }) : m,
+    name: m === currentModel ? t7("model.current", { label: m }) : m,
     value: m
   }));
   if (currentModel && !models.includes(currentModel)) {
     choices3.unshift({
-      name: t6("model.current_not_listed", { label: currentModel }),
+      name: t7("model.current_not_listed", { label: currentModel }),
       value: currentModel
     });
   }
-  if (source !== "live") choices3.push({ name: t6("model.custom_entry"), value: CUSTOM });
+  if (source !== "live") choices3.push({ name: t7("model.custom_entry"), value: CUSTOM });
   return choices3;
 }
 function listPageSize(itemCount, rows = process.stdout.rows) {
@@ -786,10 +924,10 @@ function listPageSize(itemCount, rows = process.stdout.rows) {
   return Math.min(itemCount, Math.max(3, height - 3));
 }
 function describeDiscovery(source, count, hasKey) {
-  if (source === "live") return t6("model.from_api", { count });
-  const why = hasKey ? t6("model.why_fetch_failed") : t6("model.why_no_key");
-  const what = source === "cache" ? t6("model.fallback_cache") : t6("model.fallback_static");
-  return t6("model.fallback_line", { why, what });
+  if (source === "live") return t7("model.from_api", { count });
+  const why = hasKey ? t7("model.why_fetch_failed") : t7("model.why_no_key");
+  const what = source === "cache" ? t7("model.fallback_cache") : t7("model.fallback_static");
+  return t7("model.fallback_line", { why, what });
 }
 function describeError(err2) {
   return err2 instanceof Error ? err2.message : String(err2);
@@ -818,98 +956,98 @@ import {
   marketplacesPath,
   pluginsDir,
   pluginsStatePath,
-  t as t7
+  t as t8
 } from "@epoch-agent/infra";
-var log5 = (msg) => {
+var log6 = (msg) => {
   process.stdout.write(msg + "\n");
 };
 function locations() {
   return { pluginsDir: pluginsDir(EPOCH_HOME), statePath: pluginsStatePath(EPOCH_HOME) };
 }
 function registerPluginCommand(program2) {
-  const cmd = program2.command("plugin").description(t7("plugin.cmd_root"));
+  const cmd = program2.command("plugin").description(t8("plugin.cmd_root"));
   registerBasics(cmd);
   registerLifecycle(cmd);
   registerMarketplace(cmd);
 }
 function registerBasics(cmd) {
-  cmd.command("list", { isDefault: true }).alias("ls").description(t7("plugin.cmd_list")).option("--verbose", t7("plugin.opt_verbose")).action((opts) => {
+  cmd.command("list", { isDefault: true }).alias("ls").description(t8("plugin.cmd_list")).option("--verbose", t8("plugin.opt_verbose")).action((opts) => {
     printList2(opts.verbose === true);
   });
-  cmd.command("install").alias("add").description(t7("plugin.cmd_install")).argument("<source>", t7("plugin.arg_source")).option("-y, --yes", t7("plugin.opt_yes_install")).action(async (source, opts) => {
+  cmd.command("install").alias("add").description(t8("plugin.cmd_install")).argument("<source>", t8("plugin.arg_source")).option("-y, --yes", t8("plugin.opt_yes_install")).action(async (source, opts) => {
     await runInstall(source, opts.yes === true);
   });
-  cmd.command("validate").description(t7("plugin.cmd_validate")).argument("[path]", t7("plugin.arg_dir")).action((path) => {
+  cmd.command("validate").description(t8("plugin.cmd_validate")).argument("[path]", t8("plugin.arg_dir")).action((path) => {
     validateDir(path ?? process.cwd());
   });
 }
 function registerLifecycle(cmd) {
-  cmd.command("uninstall").alias("rm").description(t7("plugin.cmd_uninstall")).argument("<name>", t7("plugin.arg_name")).action(async (name) => {
+  cmd.command("uninstall").alias("rm").description(t8("plugin.cmd_uninstall")).argument("<name>", t8("plugin.arg_name")).action(async (name) => {
     const outcome = await uninstallPlugin(name, { statePath: pluginsStatePath(EPOCH_HOME) });
     if (!outcome.ok) throw new CliError(outcome.reason);
-    log5(`\u2713 ${outcome.message}`);
+    log6(`\u2713 ${outcome.message}`);
   });
-  cmd.command("disable").description(t7("plugin.cmd_disable")).argument("<name>", t7("plugin.arg_name")).action(async (name) => {
+  cmd.command("disable").description(t8("plugin.cmd_disable")).argument("<name>", t8("plugin.arg_name")).action(async (name) => {
     await toggle(name, false);
   });
-  cmd.command("enable").description(t7("plugin.cmd_enable")).argument("<name>", t7("plugin.arg_name")).action(async (name) => {
+  cmd.command("enable").description(t8("plugin.cmd_enable")).argument("<name>", t8("plugin.arg_name")).action(async (name) => {
     await toggle(name, true);
   });
-  cmd.command("update").description(t7("plugin.cmd_update")).argument("<name>", t7("plugin.arg_name")).option("-y, --yes", t7("plugin.opt_yes")).action(async (name, opts) => {
+  cmd.command("update").description(t8("plugin.cmd_update")).argument("<name>", t8("plugin.arg_name")).option("-y, --yes", t8("plugin.opt_yes")).action(async (name, opts) => {
     await runUpdate(name, opts.yes === true);
   });
 }
 function registerMarketplace(cmd) {
-  const market = cmd.command("marketplace").alias("mp").description(t7("plugin.cmd_market"));
-  market.command("add").description(t7("plugin.cmd_market_add")).argument("<source>", t7("plugin.arg_market_source")).action(async (source) => {
+  const market = cmd.command("marketplace").alias("mp").description(t8("plugin.cmd_market"));
+  market.command("add").description(t8("plugin.cmd_market_add")).argument("<source>", t8("plugin.arg_market_source")).action(async (source) => {
     const outcome = await addMarketplace(source, { statePath: marketplacesPath(EPOCH_HOME) });
     if (!outcome.ok) throw new CliError(outcome.reason);
     const count = outcome.record.catalog.plugins.length;
-    log5(`\u2713 ${t7("plugin.market_added", { name: outcome.record.name, count })}`);
-    log5(t7("plugin.market_added_hint"));
+    log6(`\u2713 ${t8("plugin.market_added", { name: outcome.record.name, count })}`);
+    log6(t8("plugin.market_added_hint"));
   });
-  market.command("list", { isDefault: true }).alias("ls").description(t7("plugin.cmd_market_list")).action(printMarketplaces);
-  market.command("remove").alias("rm").description(t7("plugin.cmd_market_remove")).argument("<name>", t7("plugin.arg_market_name")).action(async (name) => {
+  market.command("list", { isDefault: true }).alias("ls").description(t8("plugin.cmd_market_list")).action(printMarketplaces);
+  market.command("remove").alias("rm").description(t8("plugin.cmd_market_remove")).argument("<name>", t8("plugin.arg_market_name")).action(async (name) => {
     const outcome = await removeMarketplace(name, { statePath: marketplacesPath(EPOCH_HOME) });
     if (!outcome.ok)
-      throw new CliError(outcome.reason ?? t7("plugin.market_remove_failed", { name }));
-    log5(`\u2713 ${t7("plugin.market_removed", { name })}`);
+      throw new CliError(outcome.reason ?? t8("plugin.market_remove_failed", { name }));
+    log6(`\u2713 ${t8("plugin.market_removed", { name })}`);
   });
-  market.command("update").description(t7("plugin.cmd_market_update")).argument("<name>", t7("plugin.arg_market_name")).action(async (name) => {
+  market.command("update").description(t8("plugin.cmd_market_update")).argument("<name>", t8("plugin.arg_market_name")).action(async (name) => {
     const outcome = await updateMarketplace(name, { statePath: marketplacesPath(EPOCH_HOME) });
     if (!outcome.ok) throw new CliError(outcome.reason);
-    log5(
-      `\u2713 ${t7("plugin.market_updated", {
+    log6(
+      `\u2713 ${t8("plugin.market_updated", {
         name,
         count: outcome.record.catalog.plugins.length
       })}`
     );
   });
-  cmd.command("search").description(t7("plugin.cmd_search")).argument("[keyword]", t7("plugin.arg_keyword")).action((keyword) => {
+  cmd.command("search").description(t8("plugin.cmd_search")).argument("[keyword]", t8("plugin.arg_keyword")).action((keyword) => {
     printSearch(keyword ?? "");
   });
 }
 function printList2(verbose) {
   const artifacts = loadPlugins({ statePath: pluginsStatePath(EPOCH_HOME) });
   if (artifacts.loaded.length === 0 && artifacts.skipped.length === 0) {
-    log5(t7("plugin.none_installed"));
-    log5(t7("plugin.none_installed_hint"));
+    log6(t8("plugin.none_installed"));
+    log6(t8("plugin.none_installed_hint"));
     return;
   }
-  log5(`${t7("plugin.installed_head", { path: pluginsStatePath(EPOCH_HOME) })}
+  log6(`${t8("plugin.installed_head", { path: pluginsStatePath(EPOCH_HOME) })}
 `);
   for (const plugin of artifacts.loaded) {
-    log5(loadedLine(plugin));
+    log6(loadedLine(plugin));
     if (!verbose) continue;
     for (const line of renderInventory(scanPluginDir(plugin.dir, plugin.name))) {
-      log5(`    ${line}`);
+      log6(`    ${line}`);
     }
-    log5("");
+    log6("");
   }
-  for (const skipped of artifacts.skipped) log5(skippedLine(skipped));
-  if (artifacts.skipped.length > 0) log5(`
+  for (const skipped of artifacts.skipped) log6(skippedLine(skipped));
+  if (artifacts.skipped.length > 0) log6(`
 ${markLegend()}`);
-  for (const detail of issueDetails(artifacts.issues)) log5(`
+  for (const detail of issueDetails(artifacts.issues)) log6(`
 \u26A0 ${detail}`);
 }
 function loadedLine(plugin) {
@@ -918,7 +1056,7 @@ function loadedLine(plugin) {
 function countsLine(counts) {
   const parts = [];
   const add = (n, key) => {
-    if (n > 0) parts.push(t7(key, { count: n }));
+    if (n > 0) parts.push(t8(key, { count: n }));
   };
   add(counts.commands, "plugin.n_commands");
   add(counts.roles, "plugin.n_roles");
@@ -926,84 +1064,84 @@ function countsLine(counts) {
   add(counts.hooks, "plugin.n_hooks");
   add(counts.denyRules, "plugin.n_deny");
   add(counts.mcpServers, "plugin.n_mcp");
-  return parts.length === 0 ? t7("plugin.brings_nothing") : parts.join(" \xB7 ");
+  return parts.length === 0 ? t8("plugin.brings_nothing") : parts.join(" \xB7 ");
 }
 function markLegend() {
-  return t7("plugin.mark_legend");
+  return t8("plugin.mark_legend");
 }
 function skippedLine(skipped) {
   return `  ${skipped.disabled ? "\u25CB" : "\u2717"} ${skipped.name}  ${skipped.reason}`;
 }
 async function runInstall(input2, yes) {
   if (!yes && isNonInteractive2()) {
-    throw new CliError(t7("plugin.install_needs_tty"), 1, t7("plugin.install_needs_tty_hint"));
+    throw new CliError(t8("plugin.install_needs_tty"), 1, t8("plugin.install_needs_tty_hint"));
   }
   const ref = resolveMarketplaceRef(input2, marketplacesPath(EPOCH_HOME));
   if (ref && !ref.ok) throw new CliError(ref.reason);
   const source = ref?.ok ? ref.ref.source : input2;
-  if (ref?.ok) log5(`${input2} \u2192 ${source}`);
+  if (ref?.ok) log6(`${input2} \u2192 ${source}`);
   const outcome = await installPlugin(source, {
     ...locations(),
     epochVersion: currentEpochVersion(),
-    onProgress: log5,
+    onProgress: log6,
     ...ref?.ok ? { marketplace: ref.ref.marketplace } : {},
     ...yes ? {} : { confirm: askInstall }
   });
   if (!outcome.ok) {
     if (outcome.cancelled) {
-      log5(t7("plugin.nothing_installed"));
+      log6(t8("plugin.nothing_installed"));
       return;
     }
-    throw new CliError(t7("plugin.install_failed", { source, reason: outcome.reason }));
+    throw new CliError(t8("plugin.install_failed", { source, reason: outcome.reason }));
   }
-  log5(
+  log6(
     `
-\u2713 ${t7("plugin.installed", {
+\u2713 ${t8("plugin.installed", {
       name: outcome.record.name,
       version: outcome.record.version,
       path: outcome.record.path
     })}`
   );
   if (outcome.record.linked) {
-    log5(t7("plugin.installed_linked"));
+    log6(t8("plugin.installed_linked"));
   }
-  log5(t7("plugin.installed_restart"));
+  log6(t8("plugin.installed_restart"));
 }
 async function runUpdate(name, yes) {
   if (!yes && isNonInteractive2()) {
-    throw new CliError(t7("plugin.update_needs_tty"), 1, t7("plugin.update_needs_tty_hint"));
+    throw new CliError(t8("plugin.update_needs_tty"), 1, t8("plugin.update_needs_tty_hint"));
   }
   const outcome = await updatePlugin(name, {
     ...locations(),
     epochVersion: currentEpochVersion(),
-    onProgress: log5,
+    onProgress: log6,
     ...yes ? {} : { confirm: askInstall }
   });
   if (!outcome.ok) throw new CliError(outcome.reason);
-  log5(
-    `\u2713 ${"message" in outcome ? outcome.message : t7("plugin.updated_to", { version: outcome.record.version })}`
+  log6(
+    `\u2713 ${"message" in outcome ? outcome.message : t8("plugin.updated_to", { version: outcome.record.version })}`
   );
 }
 async function askInstall(preview2) {
-  for (const line of renderPreview(preview2)) log5(line);
+  for (const line of renderPreview(preview2)) log6(line);
   const { confirm } = await import("@inquirer/prompts");
-  return confirm({ message: t7("plugin.confirm_install"), default: false });
+  return confirm({ message: t8("plugin.confirm_install"), default: false });
 }
 function renderPreview(preview2) {
   const { manifest, source, inventory } = preview2;
   const lines = [""];
-  lines.push(t7("plugin.will_install", { name: manifest.name, version: manifest.version }));
+  lines.push(t8("plugin.will_install", { name: manifest.name, version: manifest.version }));
   if (manifest.description) lines.push(`  ${manifest.description}`);
-  lines.push(t7("plugin.preview_source", { raw: source.raw, type: source.type }));
-  if (source.sha256) lines.push(t7("plugin.preview_sha", { sha: source.sha256 }));
-  if (manifest.author) lines.push(t7("plugin.preview_author", { name: manifest.author.name }));
-  if (manifest.homepage) lines.push(t7("plugin.preview_homepage", { url: manifest.homepage }));
+  lines.push(t8("plugin.preview_source", { raw: source.raw, type: source.type }));
+  if (source.sha256) lines.push(t8("plugin.preview_sha", { sha: source.sha256 }));
+  if (manifest.author) lines.push(t8("plugin.preview_author", { name: manifest.author.name }));
+  if (manifest.homepage) lines.push(t8("plugin.preview_homepage", { url: manifest.homepage }));
   if (preview2.versionUnmet) {
     const { required, current } = preview2.versionUnmet;
-    lines.push(`  ${t7("plugin.preview_version_unmet", { required, current })}`);
+    lines.push(`  ${t8("plugin.preview_version_unmet", { required, current })}`);
   }
   lines.push("");
-  lines.push(t7("plugin.brings_head_indented"));
+  lines.push(t8("plugin.brings_head_indented"));
   for (const line of renderInventory(inventory)) lines.push(`  ${line}`);
   lines.push("");
   return lines;
@@ -1011,105 +1149,105 @@ function renderPreview(preview2) {
 function renderInventory(inv) {
   const lines = [];
   if (inventoryTotal(inv) === 0) {
-    lines.push(t7("plugin.inventory_empty"));
+    lines.push(t8("plugin.inventory_empty"));
   }
   if (inv.commands.length > 0)
-    lines.push(t7("plugin.inv_commands", { count: inv.commands.length, names: list(inv.commands) }));
+    lines.push(t8("plugin.inv_commands", { count: inv.commands.length, names: list(inv.commands) }));
   if (inv.roles.length > 0)
-    lines.push(t7("plugin.inv_roles", { count: inv.roles.length, names: list(inv.roles) }));
+    lines.push(t8("plugin.inv_roles", { count: inv.roles.length, names: list(inv.roles) }));
   if (inv.skills.length > 0)
-    lines.push(t7("plugin.inv_skills", { count: inv.skills.length, names: list(inv.skills) }));
+    lines.push(t8("plugin.inv_skills", { count: inv.skills.length, names: list(inv.skills) }));
   if (inv.hooks.length > 0) {
-    const tally = inv.hooks.map((h) => `${h.type} \xD7 ${h.count}`).join(t7("plugin.inv_join"));
-    lines.push(t7("plugin.inv_hooks", { tally }));
+    const tally = inv.hooks.map((h) => `${h.type} \xD7 ${h.count}`).join(t8("plugin.inv_join"));
+    lines.push(t8("plugin.inv_hooks", { tally }));
   }
-  if (inv.denyRules > 0) lines.push(t7("plugin.inv_deny", { count: inv.denyRules }));
+  if (inv.denyRules > 0) lines.push(t8("plugin.inv_deny", { count: inv.denyRules }));
   if (inv.mcpServers.length > 0) {
     lines.push(
-      t7("plugin.preview_mcp", {
+      t8("plugin.preview_mcp", {
         count: inv.mcpServers.length,
         names: list(inv.mcpServers)
       })
     );
   }
   if (inv.ignoredBuckets.length > 0) {
-    lines.push(t7("plugin.inv_ignored", { buckets: inv.ignoredBuckets.join(" / ") }));
+    lines.push(t8("plugin.inv_ignored", { buckets: inv.ignoredBuckets.join(" / ") }));
   }
   if (inv.jsTools) {
-    lines.push(t7("plugin.inv_js_tools"));
+    lines.push(t8("plugin.inv_js_tools"));
   }
   for (const detail of issueDetails(inv.issues)) lines.push(`\u26A0 ${detail}`);
   return lines;
 }
 function list(names) {
   const shown = names.slice(0, 8).join(", ");
-  return names.length > 8 ? t7("plugin.list_more", { shown, n: names.length - 8 }) : shown;
+  return names.length > 8 ? t8("plugin.list_more", { shown, n: names.length - 8 }) : shown;
 }
 function printMarketplaces() {
   const state = readMarketplaces(marketplacesPath(EPOCH_HOME));
-  for (const detail of issueDetails(state.issues)) log5(`\u26A0 ${detail}`);
+  for (const detail of issueDetails(state.issues)) log6(`\u26A0 ${detail}`);
   if (state.records.length === 0) {
-    log5(t7("plugin.no_markets"));
-    log5(t7("plugin.no_markets_hint"));
+    log6(t8("plugin.no_markets"));
+    log6(t8("plugin.no_markets_hint"));
     return;
   }
-  log5(`${t7("plugin.markets_head", { path: marketplacesPath(EPOCH_HOME) })}
+  log6(`${t8("plugin.markets_head", { path: marketplacesPath(EPOCH_HOME) })}
 `);
   for (const record of state.records) {
     const owner = record.catalog.owner ? `  by ${record.catalog.owner.name}` : "";
-    log5(
-      `  ${record.name}  ${t7("plugin.market_plugin_count", {
+    log6(
+      `  ${record.name}  ${t8("plugin.market_plugin_count", {
         count: record.catalog.plugins.length
       })}  \u2190 ${record.source}${owner}`
     );
-    if (record.catalog.description) log5(`    ${record.catalog.description}`);
+    if (record.catalog.description) log6(`    ${record.catalog.description}`);
   }
 }
 function printSearch(keyword) {
   const statePath = marketplacesPath(EPOCH_HOME);
   if (readMarketplaces(statePath).records.length === 0) {
-    log5(t7("plugin.search_no_markets"));
+    log6(t8("plugin.search_no_markets"));
     return;
   }
   const hits = searchMarketplaces(keyword, statePath);
   if (hits.length === 0) {
-    log5(keyword ? t7("plugin.search_no_hit", { keyword }) : t7("plugin.search_all_empty"));
+    log6(keyword ? t8("plugin.search_no_hit", { keyword }) : t8("plugin.search_all_empty"));
     return;
   }
-  log5(`${t7("plugin.search_count", { n: hits.length })}
+  log6(`${t8("plugin.search_count", { n: hits.length })}
 `);
   for (const hit of hits) {
     const category = hit.entry.category ? `  [${hit.entry.category}]` : "";
-    log5(`  ${hit.ref}${category}`);
-    if (hit.entry.description) log5(`    ${hit.entry.description}`);
+    log6(`  ${hit.ref}${category}`);
+    if (hit.entry.description) log6(`    ${hit.entry.description}`);
   }
-  log5(`
-${t7("plugin.search_install_hint", { ref: hits[0]?.ref ?? t7("plugin.ref_placeholder") })}`);
+  log6(`
+${t8("plugin.search_install_hint", { ref: hits[0]?.ref ?? t8("plugin.ref_placeholder") })}`);
 }
 async function toggle(name, enabled) {
   const outcome = await setPluginEnabled(name, enabled, {
     statePath: pluginsStatePath(EPOCH_HOME)
   });
   if (!outcome.ok) throw new CliError(outcome.reason);
-  log5(`\u2713 ${outcome.message}`);
+  log6(`\u2713 ${outcome.message}`);
 }
 function validateDir(dir) {
   const read = readPluginManifest(dir);
   if (!read.manifest) {
     const detail = issueDetails(read.issues).map((d) => `  - ${d}`).join("\n");
-    throw new CliError(`${t7("plugin.validate_bad", { dir })}
+    throw new CliError(`${t8("plugin.validate_bad", { dir })}
 ${detail}`);
   }
   const manifest = read.manifest;
-  log5(`\u2713 ${t7("plugin.validate_ok", { name: manifest.name, version: manifest.version })}`);
-  if (manifest.epochVersion) log5(`  epochVersion: ${manifest.epochVersion}`);
-  for (const detail of issueDetails(read.issues)) log5(`\u26A0 ${detail}`);
-  log5(`
-${t7("plugin.brings_head")}`);
+  log6(`\u2713 ${t8("plugin.validate_ok", { name: manifest.name, version: manifest.version })}`);
+  if (manifest.epochVersion) log6(`  epochVersion: ${manifest.epochVersion}`);
+  for (const detail of issueDetails(read.issues)) log6(`\u26A0 ${detail}`);
+  log6(`
+${t8("plugin.brings_head")}`);
   const inventory = scanPluginDir(dir, manifest.name);
-  for (const line of renderInventory(inventory)) log5(`  ${line}`);
+  for (const line of renderInventory(inventory)) log6(`  ${line}`);
   if (inventory.issues.length > 0) {
-    throw new CliError(t7("plugin.inv_issues", { count: inventory.issues.length }));
+    throw new CliError(t8("plugin.inv_issues", { count: inventory.issues.length }));
   }
 }
 // src/commands/run.ts
@@ -1117,7 +1255,7 @@ import { existsSync as existsSync6 } from "fs";
 import { dirname as dirname3, join as join5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { isNonInteractive as isNonInteractive8, OPERATION_TYPES as OPERATION_TYPES3, PERMISSION_LEVELS as PERMISSION_LEVELS3 } from "@epoch-agent/core";
-import { t as t24 } from "@epoch-agent/infra";
+import { t as t25 } from "@epoch-agent/infra";
 import {
   HEADLESS_INPUT_FORMATS as HEADLESS_INPUT_FORMATS2,
   HEADLESS_OUTPUT_FORMATS as HEADLESS_OUTPUT_FORMATS2,
@@ -1125,13 +1263,13 @@ import {
 } from "@epoch-agent/protocol";
 // src/headless/session.ts
 import { OPERATION_TYPES } from "@epoch-agent/core";
-import { t as t11 } from "@epoch-agent/infra";
+import { t as t12 } from "@epoch-agent/infra";
 import { buildRuntime } from "@epoch-agent/runtime";
 // src/commands/run-flags.ts
 import { existsSync as existsSync3 } from "fs";
 import { delimiter, resolve } from "path";
 import { isOperationType, resolveWorkspace } from "@epoch-agent/core";
-import { t as t8 } from "@epoch-agent/infra";
+import { t as t9 } from "@epoch-agent/infra";
 import {
   HEADLESS_INPUT_FORMATS,
   HEADLESS_OUTPUT_FORMATS,
@@ -1151,14 +1289,14 @@ function parseResumeArg(raw) {
 }
 function assertResumeFlagsExclusive(opts) {
   if (opts.continue === true && opts.resume !== void 0) {
-    throw new CliError(t8("flags.resume_conflict"), 1, t8("flags.resume_conflict_hint"));
+    throw new CliError(t9("flags.resume_conflict"), 1, t9("flags.resume_conflict_hint"));
   }
 }
 function applySettingsPath(path) {
   if (!path) return;
   const abs = resolve(path);
   if (!existsSync3(abs)) {
-    throw new CliError(t8("flags.settings_missing", { path }), 1, t8("flags.resolved_to", { abs }));
+    throw new CliError(t9("flags.settings_missing", { path }), 1, t9("flags.resolved_to", { abs }));
   }
   process.env.EPOCH_SETTINGS = abs;
 }
@@ -1169,9 +1307,9 @@ function applyAddDirs(dirs) {
   const fatal = issues.filter((i) => i.kind !== "redundant");
   if (fatal.length > 0) {
     throw new CliError(
-      t8("flags.add_dir_unusable", { inputs: fatal.map((i) => i.input).join(", ") }),
+      t9("flags.add_dir_unusable", { inputs: fatal.map((i) => i.input).join(", ") }),
       1,
-      fatal.map((i) => i.detail).join(t8("flags.detail_sep"))
+      fatal.map((i) => i.detail).join(t9("flags.detail_sep"))
     );
   }
   process.env.EPOCH_ADD_DIR = abs.join(delimiter);
@@ -1203,17 +1341,17 @@ function resolveOutputFormat(opts) {
   const explicit = opts.outputFormat;
   if (explicit !== void 0 && !isHeadlessOutputFormat(explicit)) {
     throw new CliError(
-      t8("flags.output_format_unknown", { value: explicit }),
+      t9("flags.output_format_unknown", { value: explicit }),
       1,
-      t8("flags.choices", { choices: HEADLESS_OUTPUT_FORMATS.join(" / ") })
+      t9("flags.choices", { choices: HEADLESS_OUTPUT_FORMATS.join(" / ") })
     );
   }
   if (explicit === void 0) return opts.json === true ? "json" : "text";
   if (opts.json === true && explicit !== "json") {
     throw new CliError(
-      t8("flags.json_conflict", { value: explicit }),
+      t9("flags.json_conflict", { value: explicit }),
       1,
-      t8("flags.json_conflict_hint")
+      t9("flags.json_conflict_hint")
     );
   }
   return explicit;
@@ -1222,9 +1360,9 @@ function resolveHeadlessFormats(opts) {
   const raw = opts.inputFormat;
   if (raw !== void 0 && !isHeadlessInputFormat(raw)) {
     throw new CliError(
-      t8("flags.input_format_unknown", { value: raw }),
+      t9("flags.input_format_unknown", { value: raw }),
       1,
-      t8("flags.choices", { choices: HEADLESS_INPUT_FORMATS.join(" / ") })
+      t9("flags.choices", { choices: HEADLESS_INPUT_FORMATS.join(" / ") })
     );
   }
   const input2 = raw ?? "text";
@@ -1234,7 +1372,7 @@ function resolveHeadlessFormats(opts) {
   }
   const output = resolveOutputFormat(opts);
   if (output !== "stream-json") {
-    throw new CliError(t8("flags.stream_pair", { output }), 1, t8("flags.stream_pair_hint"));
+    throw new CliError(t9("flags.stream_pair", { output }), 1, t9("flags.stream_pair_hint"));
   }
   return { input: input2, output };
 }
@@ -1245,9 +1383,9 @@ function resolveApproverProgram(raw) {
   const abs = resolve(value);
   if (!existsSync3(abs)) {
     throw new CliError(
-      t8("flags.prompt_tool_missing", { value }),
+      t9("flags.prompt_tool_missing", { value }),
       1,
-      t8("flags.prompt_tool_missing_hint", { abs })
+      t9("flags.prompt_tool_missing_hint", { abs })
     );
   }
   return `"${abs}"`;
@@ -1265,15 +1403,15 @@ function parsePositive(raw, flag, extra = () => true) {
   const n = Number(raw);
   if (!Number.isFinite(n) || n <= 0 || !extra(n)) {
     throw new CliError(
-      t8("flags.not_a_number", { flag, raw }),
+      t9("flags.not_a_number", { flag, raw }),
       1,
-      flag === "--max-turns" ? t8("flags.want_positive_int") : t8("flags.want_positive")
+      flag === "--max-turns" ? t9("flags.want_positive_int") : t9("flags.want_positive")
     );
   }
   return n;
 }
 // src/headless/driver.ts
-import { t as t10 } from "@epoch-agent/infra";
+import { t as t11 } from "@epoch-agent/infra";
 // src/headless/emit.ts
 import {
   HEADLESS_PROTOCOL_VERSION
@@ -1390,14 +1528,14 @@ function initInfoOf(runtime, cwd) {
     model: runtime.config.model,
     ...provider ? { provider } : {},
     permissionLevel: runtime.permissions.level(),
-    tools: runtime.tools.map((t39) => t39.name),
+    tools: runtime.tools.map((t40) => t40.name),
     usageScope: runtime.usageScope,
     diagnostics: runtime.diagnostics
   };
 }
 // src/headless/read.ts
 import { createInterface } from "readline";
-import { t as t9 } from "@epoch-agent/infra";
+import { t as t10 } from "@epoch-agent/infra";
 import {
   APPROVAL_OUTCOMES,
   HEADLESS_INPUT_EVENT_TYPES,
@@ -1413,17 +1551,17 @@ function parseInputLine(line) {
   } catch (err2) {
     return {
       ok: false,
-      message: t9("headless_input.bad_json", { why: describe2(err2), preview: preview(text) })
+      message: t10("headless_input.bad_json", { why: describe2(err2), preview: preview(text) })
     };
   }
   if (!isRecord(raw)) {
-    return { ok: false, message: t9("headless_input.not_object", { preview: preview(text) }) };
+    return { ok: false, message: t10("headless_input.not_object", { preview: preview(text) }) };
   }
   const type = raw["type"];
   if (typeof type !== "string" || !HEADLESS_INPUT_EVENT_TYPES.has(type)) {
     return {
       ok: false,
-      message: t9("headless_input.bad_type", {
+      message: t10("headless_input.bad_type", {
         value: JSON.stringify(type),
         choices: [...HEADLESS_INPUT_EVENT_TYPES].join(" / ")
       })
@@ -1437,15 +1575,15 @@ function parseInputLine(line) {
 function parseUserMessage(raw) {
   const content = raw["content"];
   if (typeof content === "string") {
-    if (!content.trim()) return { ok: false, message: t9("headless_input.msg_empty") };
+    if (!content.trim()) return { ok: false, message: t10("headless_input.msg_empty") };
     return { ok: true, event: { type: "user-message", content } };
   }
   if (!Array.isArray(content) || content.length === 0) {
-    return { ok: false, message: t9("headless_input.msg_bad_content") };
+    return { ok: false, message: t10("headless_input.msg_bad_content") };
   }
   const bad = content.findIndex((p) => !isRecord(p) || typeof p["type"] !== "string");
   if (bad >= 0) {
-    return { ok: false, message: t9("headless_input.msg_bad_part", { index: bad }) };
+    return { ok: false, message: t10("headless_input.msg_bad_part", { index: bad }) };
   }
   return {
     ok: true,
@@ -1455,13 +1593,13 @@ function parseUserMessage(raw) {
 function parseApprovalResponse(raw) {
   const requestId = raw["requestId"];
   if (typeof requestId !== "string" || !requestId) {
-    return { ok: false, message: t9("headless_input.approval_no_id") };
+    return { ok: false, message: t10("headless_input.approval_no_id") };
   }
   const outcome = raw["outcome"];
   if (typeof outcome !== "string" || !isApprovalOutcome(outcome)) {
     return {
       ok: false,
-      message: t9("headless_input.approval_bad_outcome", {
+      message: t10("headless_input.approval_bad_outcome", {
         value: JSON.stringify(outcome),
         choices: APPROVAL_OUTCOMES.join(" / ")
       })
@@ -1469,7 +1607,7 @@ function parseApprovalResponse(raw) {
   }
   const note = raw["note"];
   if (note !== void 0 && typeof note !== "string") {
-    return { ok: false, message: t9("headless_input.approval_bad_note") };
+    return { ok: false, message: t10("headless_input.approval_bad_note") };
   }
   return {
     ok: true,
@@ -1484,19 +1622,19 @@ function parseApprovalResponse(raw) {
 function parseQuestionResponse(raw) {
   const requestId = raw["requestId"];
   if (typeof requestId !== "string" || !requestId) {
-    return { ok: false, message: t9("headless_input.question_no_id") };
+    return { ok: false, message: t10("headless_input.question_no_id") };
   }
   if (!isQuestionAnswerMap(raw["answers"])) {
     return {
       ok: false,
-      message: t9("headless_input.question_bad_answers", {
+      message: t10("headless_input.question_bad_answers", {
         json: '{"answers":{},"skipped":true}'
       })
     };
   }
   const skipped = raw["skipped"];
   if (skipped !== void 0 && typeof skipped !== "boolean") {
-    return { ok: false, message: t9("headless_input.question_bad_skipped") };
+    return { ok: false, message: t10("headless_input.question_bad_skipped") };
   }
   return {
     ok: true,
@@ -1539,7 +1677,7 @@ async function driveStreamJson(opts) {
     const parsed = parseInputLine(line);
     if (parsed === void 0) continue;
     if (!parsed.ok) {
-      warn4(t10("headless_driver.bad_input", { message: parsed.message }));
+      warn4(t11("headless_driver.bad_input", { message: parsed.message }));
       state.sawBadInput = true;
       continue;
     }
@@ -1574,7 +1712,7 @@ var DriverState = class {
     }
     if (event.type === "approval-response") {
       if (!this.emitter.respondApproval(event.requestId, event.outcome, event.note)) {
-        this.warn(t10("headless_driver.unknown_request", { id: event.requestId }));
+        this.warn(t11("headless_driver.unknown_request", { id: event.requestId }));
       }
       return false;
     }
@@ -1584,7 +1722,7 @@ var DriverState = class {
         ...event.skipped ? { skipped: true } : {}
       };
       if (!this.emitter.respondQuestion(event.requestId, answer)) {
-        this.warn(t10("headless_driver.unknown_request", { id: event.requestId }));
+        this.warn(t11("headless_driver.unknown_request", { id: event.requestId }));
       }
       return false;
     }
@@ -1646,11 +1784,11 @@ var DriverState = class {
   reapLostHost() {
     const approvals = this.emitter.abandonApprovals();
     if (approvals > 0) {
-      this.warn(t10("headless_driver.abandoned_approvals", { count: approvals }));
+      this.warn(t11("headless_driver.abandoned_approvals", { count: approvals }));
     }
     const questions = this.emitter.abandonQuestions();
     if (questions > 0) {
-      this.warn(t10("headless_driver.abandoned_questions", { count: questions }));
+      this.warn(t11("headless_driver.abandoned_questions", { count: questions }));
     }
     this.queue.length = 0;
     this.controller?.abort();
@@ -1675,9 +1813,9 @@ async function runStreamJsonSession(opts) {
   const { policy: headless, invalid } = parseHeadlessFlags(opts);
   if (invalid.length > 0) {
     throw new CliError(
-      t11("run_once.err_bad_operation", { values: invalid.join(", ") }),
+      t12("run_once.err_bad_operation", { values: invalid.join(", ") }),
       EXIT_CODES.FAILURE,
-      t11("run_once.err_bad_operation_hint", { choices: OPERATION_TYPES.join(" / ") })
+      t12("run_once.err_bad_operation_hint", { choices: OPERATION_TYPES.join(" / ") })
     );
   }
   const limits = parseCallLimits(opts);
@@ -1706,21 +1844,21 @@ function reportDeadRuntime(runtime) {
   const detail = runtime.diagnostics.join("; ");
   emitter.agentEvent({
     type: "error",
-    message: detail ? t11("headless_session.no_provider_detail", {
-      message: t11("run_once.err_no_provider"),
+    message: detail ? t12("headless_session.no_provider_detail", {
+      message: t12("run_once.err_no_provider"),
       detail
-    }) : t11("run_once.err_no_provider")
+    }) : t12("run_once.err_no_provider")
   });
   emitter.result({ ok: false, reason: "error", text: "", turns: 0 });
   return EXIT_CODES.FAILURE;
 }
 function warnInertFlags(opts) {
   if ((opts.allowTool ?? []).length > 0 || (opts.allowOperation ?? []).length > 0) {
-    process.stderr.write(`${t11("headless_session.inert_allow")}
+    process.stderr.write(`${t12("headless_session.inert_allow")}
 `);
   }
   if ((opts.image ?? []).length > 0) {
-    process.stderr.write(`${t11("headless_session.inert_image")}
+    process.stderr.write(`${t12("headless_session.inert_image")}
 `);
   }
 }
@@ -1730,17 +1868,17 @@ import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as rea
 import { get } from "https";
 import { dirname as dirname2, join as join3 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { t as t14 } from "@epoch-agent/infra";
+import { t as t15 } from "@epoch-agent/infra";
 // src/version.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
-import { t as t13 } from "@epoch-agent/infra";
+import { t as t14 } from "@epoch-agent/infra";
 // src/installation.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync4, realpathSync } from "fs";
 import { join } from "path";
-import { normalizeForMatch, t as t12 } from "@epoch-agent/infra";
+import { normalizeForMatch, t as t13 } from "@epoch-agent/infra";
 var PATH_RULES = [
   {
     patterns: [
@@ -1754,7 +1892,7 @@ var PATH_RULES = [
     build: () => ({
       packageManager: "npx",
       isGlobal: false,
-      note: t12("installation.npx")
+      note: t13("installation.npx")
     })
   },
   {
@@ -1763,7 +1901,7 @@ var PATH_RULES = [
       packageManager: "volta",
       isGlobal: true,
       updateCommand: `volta install ${pkg}@latest`,
-      note: t12("installation.volta")
+      note: t13("installation.volta")
     })
   },
   {
@@ -1777,7 +1915,7 @@ var PATH_RULES = [
       packageManager: "pnpm",
       isGlobal: true,
       updateCommand: `pnpm add -g ${pkg}@latest`,
-      note: t12("installation.pnpm")
+      note: t13("installation.pnpm")
     })
   },
   {
@@ -1791,7 +1929,7 @@ var PATH_RULES = [
       packageManager: "yarn",
       isGlobal: true,
       updateCommand: `yarn global add ${pkg}@latest`,
-      note: t12("installation.yarn")
+      note: t13("installation.yarn")
     })
   },
   {
@@ -1800,7 +1938,7 @@ var PATH_RULES = [
       packageManager: "bun",
       isGlobal: true,
       updateCommand: `bun add -g ${pkg}@latest`,
-      note: t12("installation.bun")
+      note: t13("installation.bun")
     })
   }
 ];
@@ -1820,7 +1958,7 @@ function detectHomebrew(realPath, formula) {
         packageManager: "homebrew",
         isGlobal: true,
         updateCommand: `brew upgrade ${formula}`,
-        note: t12("installation.homebrew")
+        note: t13("installation.homebrew")
       };
     }
   } catch {
@@ -1845,12 +1983,12 @@ function detectLocalInstall(matchPath, cwd) {
   return {
     packageManager: manager,
     isGlobal: false,
-    note: t12("installation.local")
+    note: t13("installation.local")
   };
 }
 function getInstallationInfo(packageName, cliPath = process.argv[1]) {
   if (!cliPath) {
-    return { packageManager: "unknown", isGlobal: false, note: t12("installation.unknown") };
+    return { packageManager: "unknown", isGlobal: false, note: t13("installation.unknown") };
   }
   try {
     const realPath = realpathSync(cliPath).replace(/\\/g, "/");
@@ -1863,7 +2001,7 @@ function getInstallationInfo(packageName, cliPath = process.argv[1]) {
       return {
         packageManager: "source",
         isGlobal: false,
-        note: t12("installation.source")
+        note: t13("installation.source")
       };
     }
     const brew = detectHomebrew(realPath, packageName.replace(/^@[^/]+\//, ""));
@@ -1874,10 +2012,10 @@ function getInstallationInfo(packageName, cliPath = process.argv[1]) {
       packageManager: "npm",
       isGlobal: true,
       updateCommand: `npm install -g ${packageName}@latest`,
-      note: t12("installation.npm")
+      note: t13("installation.npm")
     };
   } catch {
-    return { packageManager: "unknown", isGlobal: false, note: t12("installation.unknown") };
+    return { packageManager: "unknown", isGlobal: false, note: t13("installation.unknown") };
   }
 }
 // src/version.ts
@@ -1901,9 +2039,9 @@ function describeVersion(packageName) {
   return [
     VERSION,
     `Node: ${process.version} (${process.platform}/${process.arch})`,
-    t13("version.install", {
+    t14("version.install", {
       manager: info.packageManager,
-      global: info.isGlobal ? t13("installation.global_suffix") : "",
+      global: info.isGlobal ? t14("installation.global_suffix") : "",
       note: info.note
     })
   ].join("\n");
@@ -2047,7 +2185,7 @@ function readUpdateNotice(options = {}) {
     name,
     current: version,
     latest: cache.latest,
-    message: t14("update_check.available", { name, current: version, latest: cache.latest })
+    message: t15("update_check.available", { name, current: version, latest: cache.latest })
   };
 }
 async function refreshUpdateCache(options = {}) {
@@ -2076,7 +2214,7 @@ async function refreshUpdateCache(options = {}) {
     name,
     current: version,
     latest,
-    message: t14("update_check.available", { name, current: version, latest })
+    message: t15("update_check.available", { name, current: version, latest })
   };
 }
 function scheduleUpdateCheck(options = {}) {
@@ -2114,7 +2252,7 @@ import { execFile } from "child_process";
 import { randomBytes } from "crypto";
 import { mkdirSync as mkdirSync3 } from "fs";
 import { basename, join as join4, resolve as resolve2 } from "path";
-import { t as t15, worktreesDir } from "@epoch-agent/infra";
+import { t as t16, worktreesDir } from "@epoch-agent/infra";
 var TIMEOUT_MS = 6e4;
 function git(args, cwd) {
   return new Promise((done) => {
@@ -2135,13 +2273,13 @@ function git(args, cwd) {
   });
 }
 function firstLine(text) {
-  return text.trim().split("\n")[0]?.trim() ?? t15("git.unknown_reason");
+  return text.trim().split("\n")[0]?.trim() ?? t16("git.unknown_reason");
 }
 async function createWorktree(cwd = process.cwd(), container = worktreesDir()) {
   const repoRoot = await resolveRepoRoot(cwd);
   const head = await git(["rev-parse", "HEAD"], repoRoot);
   if (!head.ok) {
-    throw new CliError(t15("worktree.err_no_commit"), 1, t15("worktree.err_no_commit_hint"));
+    throw new CliError(t16("worktree.err_no_commit"), 1, t16("worktree.err_no_commit_hint"));
   }
   const baseRef = head.stdout.trim();
   const shortId = randomBytes(3).toString("hex");
@@ -2150,20 +2288,20 @@ async function createWorktree(cwd = process.cwd(), container = worktreesDir()) {
   mkdirSync3(container, { recursive: true });
   const added = await git(["worktree", "add", "-b", branch, path, baseRef], repoRoot);
   if (!added.ok) {
-    throw new CliError(t15("worktree.err_add_failed", { path }), 1, firstLine(added.stderr));
+    throw new CliError(t16("worktree.err_add_failed", { path }), 1, firstLine(added.stderr));
   }
   return { repoRoot, path, branch, baseRef };
 }
 async function resolveRepoRoot(cwd) {
   const root = await git(["rev-parse", "--show-toplevel"], cwd);
   if (root.missing) {
-    throw new CliError(t15("worktree.err_git_missing"), 1, t15("worktree.err_git_missing_hint"));
+    throw new CliError(t16("worktree.err_git_missing"), 1, t16("worktree.err_git_missing_hint"));
   }
   if (!root.ok) {
     throw new CliError(
-      t15("worktree.err_not_a_repo"),
+      t16("worktree.err_not_a_repo"),
       1,
-      t15("worktree.err_not_a_repo_hint", { cwd, why: firstLine(root.stderr) })
+      t16("worktree.err_not_a_repo_hint", { cwd, why: firstLine(root.stderr) })
     );
   }
   return resolve2(root.stdout.trim());
@@ -2181,16 +2319,16 @@ async function inspectWorktree(session) {
   };
 }
 function worktreeKeepReason(state) {
-  if (state.dirty === null || state.ahead === null) return t15("worktree.keep_unknown");
-  if (state.dirty > 0) return t15("worktree.keep_dirty", { count: state.dirty });
-  if (state.ahead > 0) return t15("worktree.keep_ahead", { count: state.ahead });
+  if (state.dirty === null || state.ahead === null) return t16("worktree.keep_unknown");
+  if (state.dirty > 0) return t16("worktree.keep_dirty", { count: state.dirty });
+  if (state.ahead > 0) return t16("worktree.keep_ahead", { count: state.ahead });
   return null;
 }
 function worktreeBanner(session) {
-  const dir = t15("worktree.banner_dir", { path: session.path });
-  const branch = t15("worktree.banner_branch", { branch: session.branch });
+  const dir = t16("worktree.banner_dir", { path: session.path });
+  const branch = t16("worktree.banner_branch", { branch: session.branch });
   return `
-${t15("worktree.banner")}
+${t16("worktree.banner")}
    ${dir}
    ${branch}
 `;
@@ -2202,23 +2340,23 @@ async function finishWorktree(session, opts) {
   if (forced !== null) {
     print(
       `
-${t15("worktree.kept_forced", { reason: forced })}
+${t16("worktree.kept_forced", { reason: forced })}
    ${session.path}
-   ${t15("worktree.banner_branch", { branch: session.branch })}`
+   ${t16("worktree.banner_branch", { branch: session.branch })}`
     );
     return;
   }
   const remove = opts.interactive ? await (opts.ask ?? askRemove)(session) : false;
   if (!remove) {
     print(`
-${t15("worktree.kept", { path: session.path, branch: session.branch })}`);
+${t16("worktree.kept", { path: session.path, branch: session.branch })}`);
     return;
   }
   const failure = await removeWorktree(session);
   print(
     failure === null ? `
-${t15("worktree.removed", { path: session.path, branch: session.branch })}` : `
-${t15("worktree.remove_failed", { path: session.path })}
+${t16("worktree.removed", { path: session.path, branch: session.branch })}` : `
+${t16("worktree.remove_failed", { path: session.path })}
    ${failure}`
   );
 }
@@ -2226,7 +2364,7 @@ async function removeWorktree(session) {
   const removed = await git(["worktree", "remove", session.path], session.repoRoot);
   if (!removed.ok) return firstLine(removed.stderr);
   const branch = await git(["branch", "-D", session.branch], session.repoRoot);
-  return branch.ok ? null : t15("worktree.branch_remove_failed", {
+  return branch.ok ? null : t16("worktree.branch_remove_failed", {
     branch: session.branch,
     why: firstLine(branch.stderr)
   });
@@ -2235,7 +2373,7 @@ async function askRemove(session) {
   const { confirm } = await import("@inquirer/prompts");
   try {
     return await confirm({
-      message: t15("worktree.ask_remove", { path: session.path }),
+      message: t16("worktree.ask_remove", { path: session.path }),
       default: false
     });
   } catch {
@@ -2244,7 +2382,7 @@ async function askRemove(session) {
 }
 // src/commands/run-once.ts
 import { formatUsd, imageFromPath, OPERATION_TYPES as OPERATION_TYPES2 } from "@epoch-agent/core";
-import { t as t21 } from "@epoch-agent/infra";
+import { t as t22 } from "@epoch-agent/infra";
 import {
   promptTokens
 } from "@epoch-agent/protocol";
@@ -2253,38 +2391,38 @@ import { buildRuntime as buildRuntime2, listBackgroundTasks } from "@epoch-agent
 import {
   isNonInteractive as isNonInteractive3
 } from "@epoch-agent/core";
-import { t as t16 } from "@epoch-agent/infra";
+import { t as t17 } from "@epoch-agent/infra";
 function typeLabel(type) {
   switch (type) {
     case "file_read":
-      return t16("tui.approval.type_file_read");
+      return t17("tui.approval.type_file_read");
     case "file_write":
-      return t16("tui.approval.type_file_write");
+      return t17("tui.approval.type_file_write");
     case "command":
-      return t16("tui.approval.type_command");
+      return t17("tui.approval.type_command");
     case "network":
-      return t16("tui.approval.type_network");
+      return t17("tui.approval.type_network");
     case "code_exec":
-      return t16("tui.approval.type_code_exec");
+      return t17("tui.approval.type_code_exec");
   }
 }
 function formatApprovalRequest(req) {
   if (req.plan) {
     return [
-      t16("approval.plan_head"),
-      t16("approval.plan_previous_level", { level: req.plan.previousLevel }),
+      t17("approval.plan_head"),
+      t17("approval.plan_previous_level", { level: req.plan.previousLevel }),
       "",
       ...req.plan.markdown.split("\n").map((l) => `   ${l}`)
     ];
   }
   const lines = [
-    t16("approval.asks", { tool: req.toolName, what: typeLabel(req.type) }),
-    t16("approval.target", { target: req.target || t16("approval.target_none") })
+    t17("approval.asks", { tool: req.toolName, what: typeLabel(req.type) }),
+    t17("approval.target", { target: req.target || t17("approval.target_none") })
   ];
   if (req.detail && req.detail !== req.target) {
-    lines.push(t16("approval.detail", { detail: req.detail.slice(0, 300) }));
+    lines.push(t17("approval.detail", { detail: req.detail.slice(0, 300) }));
   }
-  if (req.reason) lines.push(t16("approval.reason", { reason: req.reason }));
+  if (req.reason) lines.push(t17("approval.reason", { reason: req.reason }));
   return lines;
 }
 function createInteractiveApproval(opts = {}) {
@@ -2292,15 +2430,15 @@ function createInteractiveApproval(opts = {}) {
   return async (req) => {
     if (!interactive()) {
       if (opts.permission?.()?.isPreauthorized(req.toolName, req.type)) {
-        console.error(t16("approval.headless_allowed", { tool: req.toolName, target: req.target }));
+        console.error(t17("approval.headless_allowed", { tool: req.toolName, target: req.target }));
         return "allow-once";
       }
       console.error(
-        `${t16("approval.headless_denied", {
+        `${t17("approval.headless_denied", {
           tool: req.toolName,
           target: req.target
         })}
-${t16("approval.headless_denied_hint", { tool: req.toolName })}`
+${t17("approval.headless_denied_hint", { tool: req.toolName })}`
       );
       return "deny";
     }
@@ -2309,12 +2447,12 @@ ${t16("approval.headless_denied_hint", { tool: req.toolName })}`
     const { select: select2 } = await import("@inquirer/prompts");
     try {
       return await select2({
-        message: t16("approval.ask"),
+        message: t17("approval.ask"),
         choices: [
-          { name: t16("tui.approval.allow_once"), value: "allow-once" },
-          { name: t16("tui.approval.allow_session"), value: "allow-session" },
-          { name: t16("approval.allow_always_cli"), value: "allow-always" },
-          { name: t16("tui.approval.deny"), value: "deny" }
+          { name: t17("tui.approval.allow_once"), value: "allow-once" },
+          { name: t17("tui.approval.allow_session"), value: "allow-session" },
+          { name: t17("approval.allow_always_cli"), value: "allow-always" },
+          { name: t17("tui.approval.deny"), value: "deny" }
         ],
         default: "allow-once"
       });
@@ -2328,21 +2466,21 @@ async function askPlan(proposal) {
   const choices3 = [
     ...proposal.canExecute ? [
       {
-        name: t16("approval.plan_execute_back", {
-          label: t16("approval.plan_execute"),
+        name: t17("approval.plan_execute_back", {
+          label: t17("approval.plan_execute"),
           level: proposal.previousLevel
         }),
         value: "plan-execute"
       }
     ] : [],
-    { name: t16("approval.plan_readonly"), value: "plan-readonly" },
-    { name: t16("approval.plan_revise"), value: "plan-revise" },
-    { name: t16("approval.deny"), value: "deny" }
+    { name: t17("approval.plan_readonly"), value: "plan-readonly" },
+    { name: t17("approval.plan_revise"), value: "plan-revise" },
+    { name: t17("approval.deny"), value: "deny" }
   ];
   try {
-    const outcome = await select2({ message: t16("approval.plan_ask"), choices: choices3 });
+    const outcome = await select2({ message: t17("approval.plan_ask"), choices: choices3 });
     if (outcome !== "plan-revise") return outcome;
-    const note = (await input2({ message: t16("approval.plan_revise_ask") })).trim();
+    const note = (await input2({ message: t17("approval.plan_revise_ask") })).trim();
     return note ? { outcome, note } : outcome;
   } catch {
     return "deny";
@@ -2355,7 +2493,7 @@ import {
   matchPreauthorization,
   mergeHeadlessPolicy
 } from "@epoch-agent/core";
-import { t as t17 } from "@epoch-agent/infra";
+import { t as t18 } from "@epoch-agent/infra";
 import { APPROVAL_OUTCOMES as APPROVAL_OUTCOMES2, isApprovalOutcome as isApprovalOutcome2 } from "@epoch-agent/protocol";
 var APPROVER_TIMEOUT_MS = 6e4;
 var MAX_STDOUT_BYTES = 64 * 1024;
@@ -2365,22 +2503,22 @@ function clip(s) {
 }
 function parseApproverVerdict(stdout) {
   const text = stdout.trim();
-  if (!text) return { ok: false, why: t17("approver.no_output") };
+  if (!text) return { ok: false, why: t18("approver.no_output") };
   let raw;
   try {
     raw = JSON.parse(text);
   } catch {
-    return { ok: false, why: t17("approver.not_json", { text: clip(text) }) };
+    return { ok: false, why: t18("approver.not_json", { text: clip(text) }) };
   }
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    return { ok: false, why: t17("approver.not_object", { text: clip(text) }) };
+    return { ok: false, why: t18("approver.not_object", { text: clip(text) }) };
   }
   const rec = raw;
   const outcome = rec["outcome"];
   if (typeof outcome !== "string" || !isApprovalOutcome2(outcome)) {
     return {
       ok: false,
-      why: t17("approver.bad_outcome", {
+      why: t18("approver.bad_outcome", {
         value: clip(String(outcome)),
         choices: APPROVAL_OUTCOMES2.join(" / ")
       })
@@ -2416,7 +2554,7 @@ function askExternalApprover(program2, payload, opts = {}) {
     });
     const timer = setTimeout(() => {
       child.kill("SIGKILL");
-      settle({ ok: false, why: t17("approver.timeout", { ms: timeoutMs }) });
+      settle({ ok: false, why: t18("approver.timeout", { ms: timeoutMs }) });
     }, timeoutMs);
     const done = (v) => {
       clearTimeout(timer);
@@ -2426,15 +2564,15 @@ function askExternalApprover(program2, payload, opts = {}) {
       out2 += d.toString("utf-8");
       if (out2.length > MAX_STDOUT_BYTES) {
         child.kill("SIGKILL");
-        done({ ok: false, why: t17("approver.too_much_output", { bytes: MAX_STDOUT_BYTES }) });
+        done({ ok: false, why: t18("approver.too_much_output", { bytes: MAX_STDOUT_BYTES }) });
       }
     });
     child.on("error", (err2) => {
-      done({ ok: false, why: t17("approver.spawn_failed", { message: err2.message }) });
+      done({ ok: false, why: t18("approver.spawn_failed", { message: err2.message }) });
     });
     child.on("close", (code) => {
       if (code !== 0) {
-        done({ ok: false, why: t17("approver.bad_exit", { code: code ?? -1 }) });
+        done({ ok: false, why: t18("approver.bad_exit", { code: code ?? -1 }) });
         return;
       }
       done(parseApproverVerdict(out2));
@@ -2468,7 +2606,7 @@ function createExternalApproval(opts) {
     const hit = req.plan ? null : opts.preauth?.(req) ?? null;
     if (hit) {
       write(
-        `${t17("approver.audit_preauth", {
+        `${t18("approver.audit_preauth", {
           tool: req.toolName,
           target: req.target,
           reason: hit
@@ -2480,7 +2618,7 @@ function createExternalApproval(opts) {
     const verdict = await ask(payloadOf(req, cwd, opts.sessionId?.()));
     if (!verdict.ok) {
       write(
-        `${t17("approver.audit_rejected", {
+        `${t18("approver.audit_rejected", {
           tool: req.toolName,
           target: req.target,
           why: verdict.why
@@ -2492,7 +2630,7 @@ function createExternalApproval(opts) {
     const { outcome } = verdict.answer;
     const vars = { tool: req.toolName, target: req.target, outcome };
     write(
-      `${outcome === "deny" ? t17("approver.audit_denied", vars) : t17("approver.audit_allowed", vars)}
+      `${outcome === "deny" ? t18("approver.audit_denied", vars) : t18("approver.audit_allowed", vars)}
 `
     );
     return verdict.answer;
@@ -2500,35 +2638,35 @@ function createExternalApproval(opts) {
 }
 // src/headless/tasks.ts
 import { describeBackgroundTask } from "@epoch-agent/core";
-import { t as t18 } from "@epoch-agent/infra";
+import { t as t19 } from "@epoch-agent/infra";
 function backgroundTaskSummary(all) {
-  const tasks = all.filter((t39) => t39.kind === "command");
+  const tasks = all.filter((t40) => t40.kind === "command");
   if (tasks.length === 0) return "";
-  const running = tasks.filter((t39) => t39.status === "running").length;
-  const head = running > 0 ? t18("background_tasks.head_running", { total: tasks.length, running }) : t18("background_tasks.head_done", { total: tasks.length });
-  return [head, ...tasks.map((t39) => `  ${describeBackgroundTask(t39)}`)].join("\n");
+  const running = tasks.filter((t40) => t40.status === "running").length;
+  const head = running > 0 ? t19("background_tasks.head_running", { total: tasks.length, running }) : t19("background_tasks.head_done", { total: tasks.length });
+  return [head, ...tasks.map((t40) => `  ${describeBackgroundTask(t40)}`)].join("\n");
 }
 // src/import-prompt.ts
 import {
   createImportGate,
   ImportTrustStore,
   isNonInteractive as isNonInteractive6,
-  loadConfig as loadConfig2,
+  loadConfig as loadConfig3,
   resolveProjectRoot as resolveProjectRoot2,
   scanInstructions,
   setImportGate,
   TrustManager as TrustManager2
 } from "@epoch-agent/core";
-import { t as t20, trustedImportsPath, trustPath as trustPath2 } from "@epoch-agent/infra";
+import { t as t21, trustedImportsPath, trustPath as trustPath2 } from "@epoch-agent/infra";
 // src/trust-prompt.ts
 import {
   findProjectInstructions,
   isNonInteractive as isNonInteractive5,
-  loadConfig,
+  loadConfig as loadConfig2,
   resolveProjectRoot,
   TrustManager
 } from "@epoch-agent/core";
-import { t as t19, trustPath } from "@epoch-agent/infra";
+import { t as t20, trustPath } from "@epoch-agent/infra";
 function trustPromptTarget(deps) {
   if (!deps.gateEnabled) return null;
   if (!deps.interactive) return null;
@@ -2541,29 +2679,29 @@ function trustPromptTarget(deps) {
 function applyTrustChoice(store, root, choice) {
   if (choice.kind === "trust") {
     store.record(root, "trusted", choice.scope);
-    const suffix = choice.scope === "directory-tree" ? t19("trust_prompt.granted_tree_suffix") : "";
-    return t19("trust_prompt.granted", { root, suffix });
+    const suffix = choice.scope === "directory-tree" ? t20("trust_prompt.granted_tree_suffix") : "";
+    return t20("trust_prompt.granted", { root, suffix });
   }
   if (choice.kind === "never") {
     store.record(root, "untrusted", "directory");
-    return t19("trust_prompt.denied", { root });
+    return t20("trust_prompt.denied", { root });
   }
-  return t19("trust_prompt.skipped");
+  return t20("trust_prompt.skipped");
 }
 function trustPromptMessage(target) {
   return [
     `
-${t19("trust_prompt.head", { path: target.instructionsPath })}`,
-    `  ${t19("trust_prompt.why")}`,
+${t20("trust_prompt.head", { path: target.instructionsPath })}`,
+    `  ${t20("trust_prompt.why")}`,
     ""
   ].join("\n");
 }
 function choices() {
   return [
-    { name: t19("trust_prompt.choice_skip"), value: { kind: "skip" } },
-    { name: t19("trust_prompt.choice_dir"), value: { kind: "trust", scope: "directory" } },
-    { name: t19("trust_prompt.choice_tree"), value: { kind: "trust", scope: "directory-tree" } },
-    { name: t19("trust_prompt.choice_never"), value: { kind: "never" } }
+    { name: t20("trust_prompt.choice_skip"), value: { kind: "skip" } },
+    { name: t20("trust_prompt.choice_dir"), value: { kind: "trust", scope: "directory" } },
+    { name: t20("trust_prompt.choice_tree"), value: { kind: "trust", scope: "directory-tree" } },
+    { name: t20("trust_prompt.choice_never"), value: { kind: "never" } }
   ];
 }
 function restoreStdinDefault() {
@@ -2572,7 +2710,7 @@ function restoreStdinDefault() {
   stdin.resume();
 }
 async function maybePromptForTrust(opts = {}) {
-  const config = opts.config ?? loadConfig();
+  const config = opts.config ?? loadConfig2();
   const store = opts.store ?? new TrustManager(trustPath(config.homeDir));
   const print = opts.print ?? ((msg) => process.stdout.write(msg + "\n"));
   const target = trustPromptTarget({
@@ -2594,7 +2732,7 @@ async function maybePromptForTrust(opts = {}) {
     print(applyTrustChoice(store, target.root, choice));
   } catch (err2) {
     print(
-      t19("trust_prompt.write_failed", {
+      t20("trust_prompt.write_failed", {
         message: err2 instanceof Error ? err2.message : String(err2)
       })
     );
@@ -2606,7 +2744,7 @@ async function askTrustChoice(_target) {
   try {
     const options = choices();
     return await select2({
-      message: t19("trust_prompt.ask"),
+      message: t20("trust_prompt.ask"),
       choices: [...options],
       default: options[0]?.value
     });
@@ -2639,38 +2777,38 @@ function externalImportTargets(deps) {
 function importPromptMessage(target) {
   return [
     `
-${t20("import_prompt.head", { from: target.from })}`,
+${t21("import_prompt.head", { from: target.from })}`,
     `    ${target.path}`,
-    `  ${t20("import_prompt.spec", { spec: target.spec })}`,
-    `  ${t20("import_prompt.why")}`,
+    `  ${t21("import_prompt.spec", { spec: target.spec })}`,
+    `  ${t21("import_prompt.why")}`,
     ""
   ].join("\n");
 }
 function applyImportChoice(store, target, choice) {
   if (choice.kind === "once") {
     store.allowOnce(target.path);
-    return t20("import_prompt.once", { path: target.path });
+    return t21("import_prompt.once", { path: target.path });
   }
   if (choice.kind === "remember") {
     store.remember(target.path);
-    return t20("import_prompt.remembered", { path: target.path });
+    return t21("import_prompt.remembered", { path: target.path });
   }
   if (choice.kind === "never") {
     store.denyAll();
-    return t20("import_prompt.never");
+    return t21("import_prompt.never");
   }
-  return t20("import_prompt.skipped", { path: target.path });
+  return t21("import_prompt.skipped", { path: target.path });
 }
 function choices2() {
   return [
-    { name: t20("import_prompt.choice_skip"), value: { kind: "skip" } },
-    { name: t20("import_prompt.choice_once"), value: { kind: "once" } },
-    { name: t20("import_prompt.choice_remember"), value: { kind: "remember" } },
-    { name: t20("import_prompt.choice_never"), value: { kind: "never" } }
+    { name: t21("import_prompt.choice_skip"), value: { kind: "skip" } },
+    { name: t21("import_prompt.choice_once"), value: { kind: "once" } },
+    { name: t21("import_prompt.choice_remember"), value: { kind: "remember" } },
+    { name: t21("import_prompt.choice_never"), value: { kind: "never" } }
   ];
 }
 async function maybePromptForExternalImports(opts = {}) {
-  const config = opts.config ?? loadConfig2();
+  const config = opts.config ?? loadConfig3();
   const store = opts.store ?? new ImportTrustStore(trustedImportsPath(config.homeDir));
   const print = opts.print ?? ((msg) => process.stdout.write(msg + "\n"));
   const targets = externalImportTargets({
@@ -2693,7 +2831,7 @@ async function maybePromptForExternalImports(opts = {}) {
         print(applyImportChoice(store, target, choice));
       } catch (err2) {
         print(
-          t20("import_prompt.write_failed", {
+          t21("import_prompt.write_failed", {
             message: err2 instanceof Error ? err2.message : String(err2)
           })
         );
@@ -2711,7 +2849,7 @@ async function askImportChoice(_target) {
   try {
     const options = choices2();
     return await select2({
-      message: t20("import_prompt.ask"),
+      message: t21("import_prompt.ask"),
       choices: [...options],
       default: options[0]?.value
     });
@@ -2762,7 +2900,7 @@ function createStreamWriter(enabled, sink) {
   };
 }
 // src/commands/run-once.ts
-async function readStdin() {
+async function readStdin2() {
   if (process.stdin.isTTY) return "";
   const chunks = [];
   for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
@@ -2788,7 +2926,7 @@ function composeContent(query, images) {
     throw new CliError(
       err2 instanceof Error ? err2.message : String(err2),
       EXIT_CODES.FAILURE,
-      t21("run_once.err_image")
+      t22("run_once.err_image")
     );
   }
 }
@@ -2797,9 +2935,9 @@ async function runOnce(query, opts, resumeId) {
   const { policy: headless, invalid } = parseHeadlessFlags(opts);
   if (invalid.length > 0) {
     throw new CliError(
-      t21("run_once.err_bad_operation", { values: invalid.join(", ") }),
+      t22("run_once.err_bad_operation", { values: invalid.join(", ") }),
       EXIT_CODES.FAILURE,
-      t21("run_once.err_bad_operation_hint", { choices: OPERATION_TYPES2.join(" / ") })
+      t22("run_once.err_bad_operation_hint", { choices: OPERATION_TYPES2.join(" / ") })
     );
   }
   const format = resolveOutputFormat(opts);
@@ -2829,10 +2967,10 @@ async function runOnce(query, opts, resumeId) {
     const detail = runtime.diagnostics.join("\n  ");
     await runtime.dispose();
     throw new CliError(
-      t21("run_once.err_no_provider"),
+      t22("run_once.err_no_provider"),
       EXIT_CODES.FAILURE,
-      detail ? `${t21("run_once.err_no_provider_diag")}
-  ${detail}` : t21("run_once.err_no_provider_hint")
+      detail ? `${t22("run_once.err_no_provider_diag")}
+  ${detail}` : t22("run_once.err_no_provider_hint")
     );
   }
   try {
@@ -2840,7 +2978,7 @@ async function runOnce(query, opts, resumeId) {
     if (resumeId) {
       const restored = runtime.session.getHistory().length;
       process.stderr.write(
-        `${t21("run_once.resumed", {
+        `${t22("run_once.resumed", {
           id: resumeId.slice(0, SHORT_ID_LEN),
           count: restored
         })}
@@ -2903,7 +3041,7 @@ function collect2(out2, ev, w) {
   } else if (ev.type === "usage") {
     out2.usage = ev.cumulative;
   } else if (ev.type === "error") {
-    out2.text = t21("run_once.error_prefix", { message: ev.message });
+    out2.text = t22("run_once.error_prefix", { message: ev.message });
     process.exitCode = EXIT_CODES.FAILURE;
   } else if (ev.type === "finish") {
     out2.finishReason = ev.reason;
@@ -2938,14 +3076,14 @@ function emitOutcome(out2, opts, format, emitter, tasks = []) {
     return;
   }
   if (out2.reasoning) {
-    process.stderr.write(`${t21("run_once.reasoning_head")}
+    process.stderr.write(`${t22("run_once.reasoning_head")}
 ${out2.reasoning}
 
 `);
   }
   if (opts.stream === false && out2.text) process.stdout.write(out2.text + "\n");
   if (out2.aborted) process.stderr.write(`
-${t21("run_once.aborted")}
+${t22("run_once.aborted")}
 `);
   if (taskLines) process.stderr.write(taskLines + "\n");
   const summary = formatSummary(out2.usage, out2.budgetExceeded);
@@ -2962,10 +3100,10 @@ function noteworthy(diagnostics, verbose) {
 }
 function formatSummary(usage, budgetExceeded) {
   if (!usage) return "";
-  const cached = usage.cacheHitTokens ? t21("run_once.cache_hit", { count: usage.cacheHitTokens }) : "";
+  const cached = usage.cacheHitTokens ? t22("run_once.cache_hit", { count: usage.cacheHitTokens }) : "";
   const tokens = `${promptTokens(usage)} in${cached} / ${usage.outputTokens} out`;
-  const cost = usage.costUsd === void 0 ? t21("run_once.cost_unknown") : formatUsd(usage.costUsd);
-  const stopped = budgetExceeded ? t21("run_once.budget_reached") : "";
+  const cost = usage.costUsd === void 0 ? t22("run_once.cost_unknown") : formatUsd(usage.costUsd);
+  const stopped = budgetExceeded ? t22("run_once.budget_reached") : "";
   return `\u2500 ${tokens}  \xB7  ${cost}${stopped}`;
 }
 function reportHeadlessAudit(permission) {
@@ -2974,7 +3112,7 @@ function reportHeadlessAudit(permission) {
   for (const e of audit) {
     const vars = { tool: e.toolName, target: e.target, reason: e.reason };
     process.stderr.write(
-      `${e.outcome === "granted" ? t21("run_once.audit_granted", vars) : t21("run_once.audit_denied", vars)}
+      `${e.outcome === "granted" ? t22("run_once.audit_granted", vars) : t22("run_once.audit_denied", vars)}
 `
     );
   }
@@ -2984,7 +3122,7 @@ function reportHeadlessAudit(permission) {
 }
 // src/commands/run-overrides.ts
 import { isPermissionLevel as isPermissionLevel2, PERMISSION_LEVELS as PERMISSION_LEVELS2 } from "@epoch-agent/core";
-import { t as t22 } from "@epoch-agent/infra";
+import { t as t23 } from "@epoch-agent/infra";
 import { isProviderType as isProviderType2, PROVIDER_TYPES as PROVIDER_TYPES3 } from "@epoch-agent/protocol";
 function applyRunFlags(opts) {
   applySettingsPath(opts.settings);
@@ -3003,9 +3141,9 @@ function applyOverrides(opts) {
   if (opts.provider) {
     if (!isProviderType2(opts.provider)) {
       throw new CliError(
-        t22("flags.provider_unknown", { value: opts.provider }),
+        t23("flags.provider_unknown", { value: opts.provider }),
         1,
-        t22("flags.choices", { choices: PROVIDER_TYPES3.join(", ") })
+        t23("flags.choices", { choices: PROVIDER_TYPES3.join(", ") })
       );
     }
     process.env.EPOCH_PROVIDER = opts.provider;
@@ -3013,9 +3151,9 @@ function applyOverrides(opts) {
   if (opts.permission) {
     if (!isPermissionLevel2(opts.permission)) {
       throw new CliError(
-        t22("flags.permission_unknown", { value: opts.permission }),
+        t23("flags.permission_unknown", { value: opts.permission }),
         1,
-        t22("flags.choices", { choices: PERMISSION_LEVELS2.join(", ") })
+        t23("flags.choices", { choices: PERMISSION_LEVELS2.join(", ") })
       );
     }
     process.env.EPOCH_PERMISSION = opts.permission;
@@ -3026,9 +3164,9 @@ function assertModelName(value, flag) {
   const spec = value.trim();
   if (MODEL_ID.test(spec)) return value;
   throw new CliError(
-    t22("flags.model_not_a_name", { flag, value }),
+    t23("flags.model_not_a_name", { flag, value }),
     1,
-    t22("flags.model_not_a_name_hint", { value: spec })
+    t23("flags.model_not_a_name_hint", { value: spec })
   );
 }
 function assertHttpUrl(value) {
@@ -3038,60 +3176,60 @@ function assertHttpUrl(value) {
   } catch {
   }
   throw new CliError(
-    t22("flags.base_url_invalid", { value }),
+    t23("flags.base_url_invalid", { value }),
     1,
-    t22("flags.base_url_invalid_hint", { value: value.trim() })
+    t23("flags.base_url_invalid_hint", { value: value.trim() })
   );
 }
 // src/commands/sessions.ts
 import { isNonInteractive as isNonInteractive7, resolveProjectRoot as resolveProjectRoot3, SessionManager } from "@epoch-agent/core";
-import { dbPath, t as t23, uiDateLocale as uiDateLocale2 } from "@epoch-agent/infra";
-var log6 = (msg) => process.stdout.write(msg + "\n");
+import { dbPath, t as t24, uiDateLocale as uiDateLocale2 } from "@epoch-agent/infra";
+var log7 = (msg) => process.stdout.write(msg + "\n");
 var SHORT_ID_LEN2 = 8;
 var PICK_LIMIT = 20;
 function whenOf(startedAt) {
-  return startedAt ? new Date(startedAt).toLocaleString(uiDateLocale2()) : t23("sessions.when_unknown");
+  return startedAt ? new Date(startedAt).toLocaleString(uiDateLocale2()) : t24("sessions.when_unknown");
 }
 function titleOf(s) {
-  return s.title || s.preview || t23("sessions.untitled");
+  return s.title || s.preview || t24("sessions.untitled");
 }
 function registerSessionsCommand(program2) {
-  const cmd = program2.command("sessions").alias("session").description(t23("sessions.cmd_root"));
-  cmd.command("list").description(t23("sessions.cmd_list")).option("-n, --limit <n>", t23("sessions.opt_limit"), "10").action((opts) => {
+  const cmd = program2.command("sessions").alias("session").description(t24("sessions.cmd_root"));
+  cmd.command("list").description(t24("sessions.cmd_list")).option("-n, --limit <n>", t24("sessions.opt_limit"), "10").action((opts) => {
     withSessions((sm) => {
       const r = sm.list({ limit: parseInt(opts.limit, 10) });
       if (r.sessions.length === 0) {
-        log6(`  ${t23("sessions.list_empty")}`);
+        log7(`  ${t24("sessions.list_empty")}`);
         return;
       }
       for (const s of r.sessions) {
-        log6(`  ${s.id.slice(0, SHORT_ID_LEN2)}  ${whenOf(s.startedAt)}  ${titleOf(s)}`);
+        log7(`  ${s.id.slice(0, SHORT_ID_LEN2)}  ${whenOf(s.startedAt)}  ${titleOf(s)}`);
       }
     });
   });
-  cmd.command("resume").description(t23("sessions.cmd_resume")).argument("[id]", t23("sessions.arg_id")).argument("[query]", t23("sessions.arg_query")).action(async (id, query) => {
+  cmd.command("resume").description(t24("sessions.cmd_resume")).argument("[id]", t24("sessions.arg_id")).argument("[query]", t24("sessions.arg_query")).action(async (id, query) => {
     const resolved = resolveSessionId(id);
     if (!resolved.ok) {
       throw new CliError(resolved.error, EXIT_CODES.FAILURE);
     }
-    await runOnce(query || t23("sessions.default_query"), {}, resolved.id);
+    await runOnce(query || t24("sessions.default_query"), {}, resolved.id);
   });
 }
 function resolveSessionId(input2) {
   return withSessions((sm) => {
     if (!input2) {
       const latest = sm.getLatest()?.meta.id;
-      return latest ? { ok: true, id: latest } : { ok: false, error: t23("sessions.err_none") };
+      return latest ? { ok: true, id: latest } : { ok: false, error: t24("sessions.err_none") };
     }
     if (sm.get(input2)) return { ok: true, id: input2 };
     const candidates = sm.list({ limit: 200 }).sessions.filter((s) => s.id.startsWith(input2)).map((s) => s.id);
     if (candidates.length === 1) return { ok: true, id: candidates[0] };
     if (candidates.length === 0) {
-      return { ok: false, error: t23("sessions.err_not_found", { input: input2 }) };
+      return { ok: false, error: t24("sessions.err_not_found", { input: input2 }) };
     }
     return {
       ok: false,
-      error: t23("sessions.err_ambiguous", { input: input2, count: candidates.length })
+      error: t24("sessions.err_ambiguous", { input: input2, count: candidates.length })
     };
   });
 }
@@ -3102,9 +3240,9 @@ function latestSessionIdForProject(cwd = process.cwd()) {
 async function pickSessionId() {
   if (isNonInteractive7()) {
     throw new CliError(
-      t23("sessions.err_needs_id"),
+      t24("sessions.err_needs_id"),
       EXIT_CODES.FAILURE,
-      t23("sessions.err_needs_id_hint")
+      t24("sessions.err_needs_id_hint")
     );
   }
   const rows = withSessions(
@@ -3112,22 +3250,22 @@ async function pickSessionId() {
       id: s.id,
       title: titleOf(s),
       when: whenOf(s.startedAt),
-      where: s.cwd ?? t23("sessions.cwd_unrecorded"),
+      where: s.cwd ?? t24("sessions.cwd_unrecorded"),
       messageCount: s.messageCount
     }))
   );
   if (rows.length === 0) {
-    log6(t23("sessions.pick_empty"));
+    log7(t24("sessions.pick_empty"));
     return void 0;
   }
   const { select: select2 } = await import("@inquirer/prompts");
   try {
     return await select2({
-      message: t23("sessions.pick_prompt"),
+      message: t24("sessions.pick_prompt"),
       choices: rows.map((r) => ({
         name: `${r.id.slice(0, SHORT_ID_LEN2)}  ${r.when}  ${r.title}`,
         value: r.id,
-        description: `${t23("tui.resume.message_count", { n: r.messageCount })} \xB7 ${r.where}`
+        description: `${t24("tui.resume.message_count", { n: r.messageCount })} \xB7 ${r.where}`
       })),
       pageSize: 12
     });
@@ -3144,27 +3282,27 @@ function withSessions(fn) {
   }
 }
 // src/commands/run.ts
-var log7 = (msg) => {
+var log8 = (msg) => {
   process.stdout.write(msg + "\n");
 };
 function registerRunCommand(program2) {
-  program2.argument("[query]", t24("run.arg_query")).option("--allow-tool <name>", t24("run.opt_allow_tool"), collect, []).option(
+  program2.argument("[query]", t25("run.arg_query")).option("--allow-tool <name>", t25("run.opt_allow_tool"), collect, []).option(
     "--allow-operation <type>",
-    t24("run.opt_allow_operation", { types: OPERATION_TYPES3.join(" / ") }),
+    t25("run.opt_allow_operation", { types: OPERATION_TYPES3.join(" / ") }),
     collect,
     []
-  ).option("-i, --image <path>", t24("run.opt_image"), collect, []).option("-c, --continue", t24("run.opt_continue")).option("-r, --resume [id]", t24("run.opt_resume")).option("-m, --model <name>", t24("run.opt_model")).option("--fallback-model <name>", t24("run.opt_fallback_model")).option("-p, --provider <type>", t24("run.opt_provider", { types: PROVIDER_TYPES4.join(" / ") })).option("--base-url <url>", t24("run.opt_base_url")).option(
+  ).option("-i, --image <path>", t25("run.opt_image"), collect, []).option("-c, --continue", t25("run.opt_continue")).option("-r, --resume [id]", t25("run.opt_resume")).option("-m, --model <name>", t25("run.opt_model")).option("--fallback-model <name>", t25("run.opt_fallback_model")).option("-p, --provider <type>", t25("run.opt_provider", { types: PROVIDER_TYPES4.join(" / ") })).option("--base-url <url>", t25("run.opt_base_url")).option(
     "--permission <level>",
-    t24("run.opt_permission", { levels: PERMISSION_LEVELS3.join(" / ") })
-  ).option("--settings <file>", t24("run.opt_settings")).option("--add-dir <dir>", t24("run.opt_add_dir"), collect, []).option("--agent <role>", t24("run.opt_agent")).option("--worktree", t24("run.opt_worktree")).option("--json", t24("run.opt_json")).option(
+    t25("run.opt_permission", { levels: PERMISSION_LEVELS3.join(" / ") })
+  ).option("--settings <file>", t25("run.opt_settings")).option("--add-dir <dir>", t25("run.opt_add_dir"), collect, []).option("--agent <role>", t25("run.opt_agent")).option("--worktree", t25("run.opt_worktree")).option("--json", t25("run.opt_json")).option(
     "--output-format <fmt>",
-    t24("run.opt_output_format", { formats: HEADLESS_OUTPUT_FORMATS2.join(" / ") })
+    t25("run.opt_output_format", { formats: HEADLESS_OUTPUT_FORMATS2.join(" / ") })
   ).option(
     "--input-format <fmt>",
-    t24("run.opt_input_format", { formats: HEADLESS_INPUT_FORMATS2.join(" / ") })
-  ).option("--permission-prompt-tool <program>", t24("run.opt_permission_prompt_tool")).option("--max-turns <n>", t24("run.opt_max_turns")).option("--max-budget-usd <x>", t24("run.opt_max_budget")).option("--no-stream", t24("run.opt_no_stream")).option("-v, --verbose", t24("run.opt_verbose")).option("-V, --version", t24("run.opt_version")).action(async (query, opts) => {
+    t25("run.opt_input_format", { formats: HEADLESS_INPUT_FORMATS2.join(" / ") })
+  ).option("--permission-prompt-tool <program>", t25("run.opt_permission_prompt_tool")).option("--max-turns <n>", t25("run.opt_max_turns")).option("--max-budget-usd <x>", t25("run.opt_max_budget")).option("--no-stream", t25("run.opt_no_stream")).option("-v, --verbose", t25("run.opt_verbose")).option("-V, --version", t25("run.opt_version")).action(async (query, opts) => {
     if (opts.version === true) {
-      log7(describeVersion(selfPackage().name));
+      log8(describeVersion(selfPackage().name));
       return;
     }
     applyRunFlags(opts);
@@ -3174,39 +3312,39 @@ function registerRunCommand(program2) {
     if (formats.input === "stream-json") {
       if (opts.continue === true || resumeArg.kind !== "off") {
         throw new CliError(
-          t24("run.conflict_resume"),
+          t25("run.conflict_resume"),
           EXIT_CODES.FAILURE,
-          t24("run.conflict_resume_hint")
+          t25("run.conflict_resume_hint")
         );
       }
       if (opts.worktree === true) {
         throw new CliError(
-          t24("run.conflict_worktree"),
+          t25("run.conflict_worktree"),
           EXIT_CODES.FAILURE,
-          t24("run.conflict_worktree_hint")
+          t25("run.conflict_worktree_hint")
         );
       }
       if (opts.permissionPromptTool !== void 0) {
         throw new CliError(
-          t24("run.conflict_prompt_tool"),
+          t25("run.conflict_prompt_tool"),
           EXIT_CODES.FAILURE,
-          t24("run.conflict_prompt_tool_hint")
+          t25("run.conflict_prompt_tool_hint")
         );
       }
       if (!hasCredentials()) {
         throw new CliError(
-          t24("run.no_credentials_stream"),
+          t25("run.no_credentials_stream"),
           EXIT_CODES.FAILURE,
-          t24("run.no_credentials_hint")
+          t25("run.no_credentials_hint")
         );
       }
       process.exitCode = await runStreamJsonSession(opts);
       return;
     }
     const carried = resumeArg.kind === "pick" ? resumeArg.query : void 0;
-    const prompt = composePrompt(query ?? carried, await readStdin());
+    const prompt = composePrompt(query ?? carried, await readStdin2());
     if (!hasCredentials()) {
-      log7(t24("run.welcome"));
+      log8(t25("run.welcome"));
       return;
     }
     const resumeId = await resolveResumeTarget(opts, resumeArg);
@@ -3232,7 +3370,7 @@ async function resolveResumeTarget(opts, resumeArg) {
   if (opts.continue === true) {
     const latest = latestSessionIdForProject();
     if (!latest) {
-      process.stderr.write(`${t24("run.no_history")}
+      process.stderr.write(`${t25("run.no_history")}
 `);
     }
     return latest;
@@ -3243,7 +3381,7 @@ async function resolveResumeTarget(opts, resumeArg) {
       throw new CliError(
         resolved.error,
         EXIT_CODES.FAILURE,
-        t24("run.resume_not_id_hint")
+        t25("run.resume_not_id_hint")
       );
     }
     return resolved.id;
@@ -3262,7 +3400,7 @@ function resolveTuiEntry(baseDir, exists = existsSync6) {
 async function launchTui(resumeId) {
   const target = resolveTuiEntry(dirname3(fileURLToPath3(import.meta.url)));
   if (!target) {
-    process.stderr.write(`${t24("run.tui_entry_missing")}
+    process.stderr.write(`${t25("run.tui_entry_missing")}
 `);
     process.exitCode = EXIT_CODES.FAILURE;
     return;
@@ -3277,7 +3415,7 @@ async function launchTui(resumeId) {
   });
   await new Promise((done) => {
     child.on("error", (err2) => {
-      process.stderr.write(`${t24("run.tui_spawn_failed", { message: err2.message })}
+      process.stderr.write(`${t25("run.tui_spawn_failed", { message: err2.message })}
 `);
       process.exitCode = EXIT_CODES.FAILURE;
       done();
@@ -3289,13 +3427,13 @@ async function launchTui(resumeId) {
   });
 }
 // src/commands/schedule.ts
-import { t as t32 } from "@epoch-agent/infra";
+import { t as t33 } from "@epoch-agent/infra";
 // src/schedule/add.ts
 import {
   SCHEDULE_DEFAULTS,
   validateSchedule
 } from "@epoch-agent/core";
-import { automationWorkDir, t as t27 } from "@epoch-agent/infra";
+import { automationWorkDir, t as t28 } from "@epoch-agent/infra";
 import {
   isOperationType as isOperationType2,
   isPermissionLevel as isPermissionLevel3,
@@ -3304,7 +3442,7 @@ import {
   SCHEDULE_INTERVAL_MINUTES
 } from "@epoch-agent/protocol";
 // src/schedule/labels.ts
-import { t as t25 } from "@epoch-agent/infra";
+import { t as t26 } from "@epoch-agent/infra";
 import {
   collectPendingApprovals
 } from "@epoch-agent/protocol";
@@ -3356,35 +3494,35 @@ var DRIFT_KEYS = {
   "never-registered": "schedule.drift.never_registered"
 };
 function renderIssues(issues) {
-  return issues.map((i) => `  \xB7 ${t25(ISSUE_KEYS[i.code], { detail: i.detail ?? "" })}`).join("\n");
+  return issues.map((i) => `  \xB7 ${t26(ISSUE_KEYS[i.code], { detail: i.detail ?? "" })}`).join("\n");
 }
 function statusLabel(status) {
   const mark = status === "ok" ? "\u2705" : status === "failed" || status === "denied" ? "\u274C" : "\u26A0\uFE0F";
-  return `${mark} ${t25(STATUS_KEYS[status])}`;
+  return `${mark} ${t26(STATUS_KEYS[status])}`;
 }
 function driftLabel(kind) {
-  return t25(DRIFT_KEYS[kind]);
+  return t26(DRIFT_KEYS[kind]);
 }
 function describeTrigger(trigger) {
   if (trigger.kind === "interval") {
-    return trigger.everyMinutes < 60 ? t25("schedule.trigger.every_minutes", { n: trigger.everyMinutes }) : t25("schedule.trigger.every_hours", { n: trigger.everyMinutes / 60 });
+    return trigger.everyMinutes < 60 ? t26("schedule.trigger.every_minutes", { n: trigger.everyMinutes }) : t26("schedule.trigger.every_hours", { n: trigger.everyMinutes / 60 });
   }
   if (trigger.kind === "once") {
-    return t25("schedule.trigger.once", { date: trigger.date, at: trigger.at });
+    return t26("schedule.trigger.once", { date: trigger.date, at: trigger.at });
   }
-  if (trigger.cycle === "daily") return t25("schedule.trigger.daily", { at: trigger.at });
+  if (trigger.cycle === "daily") return t26("schedule.trigger.daily", { at: trigger.at });
   if (trigger.cycle === "weekly") {
-    const days = trigger.weekdays.map((d) => t25(WEEKDAY_KEYS[d])).join("/");
-    return t25("schedule.trigger.weekly", { days, at: trigger.at });
+    const days = trigger.weekdays.map((d) => t26(WEEKDAY_KEYS[d])).join("/");
+    return t26("schedule.trigger.weekly", { days, at: trigger.at });
   }
-  return t25("schedule.trigger.monthly", { days: trigger.days.join("/"), at: trigger.at });
+  return t26("schedule.trigger.monthly", { days: trigger.days.join("/"), at: trigger.at });
 }
 function permissionLabel(level) {
-  if (level === "plan") return t25("schedule.permission.plan");
-  if (level === "acceptEdits") return t25("schedule.permission.accept_edits");
-  if (level === "bypass") return t25("schedule.permission.bypass");
-  if (level === "auto") return t25("schedule.permission.auto");
-  return t25("schedule.permission.default");
+  if (level === "plan") return t26("schedule.permission.plan");
+  if (level === "acceptEdits") return t26("schedule.permission.accept_edits");
+  if (level === "bypass") return t26("schedule.permission.bypass");
+  if (level === "auto") return t26("schedule.permission.auto");
+  return t26("schedule.permission.default");
 }
 // src/schedule/shared.ts
 import { realpathSync as realpathSync2 } from "fs";
@@ -3393,8 +3531,8 @@ import {
   ScheduleRegistrar,
   ScheduleStore
 } from "@epoch-agent/core";
-import { dbPath as dbPath2, t as t26, uiDateLocale as uiDateLocale3 } from "@epoch-agent/infra";
-var log8 = (msg) => void process.stdout.write(`${msg}
+import { dbPath as dbPath2, t as t27, uiDateLocale as uiDateLocale3 } from "@epoch-agent/infra";
+var log9 = (msg) => void process.stdout.write(`${msg}
 `);
 var warn2 = (msg) => void process.stderr.write(`${msg}
 `);
@@ -3422,24 +3560,24 @@ function mustFind(store, idOrPrefix) {
   if (hits.length === 1) return hits[0];
   if (hits.length === 0) {
     throw new CliError(
-      t26("schedule.err_not_found", { id: idOrPrefix }),
+      t27("schedule.err_not_found", { id: idOrPrefix }),
       EXIT_CODES.FAILURE,
-      t26("schedule.err_not_found_hint")
+      t27("schedule.err_not_found_hint")
     );
   }
   throw new CliError(
-    t26("schedule.err_ambiguous", { id: idOrPrefix }),
+    t27("schedule.err_ambiguous", { id: idOrPrefix }),
     EXIT_CODES.FAILURE,
     hits.map((h) => `  ${h.id}  ${h.name}`).join("\n")
   );
 }
 function reportRegistration(outcome, fatal) {
   if (outcome.ok) {
-    if (outcome.warnings.includes("source")) warn2(t26("schedule.warn_source_entry"));
+    if (outcome.warnings.includes("source")) warn2(t27("schedule.warn_source_entry"));
     return;
   }
-  const message = outcome.reason === "unsupported-platform" ? t26("schedule.err_platform_unsupported") : outcome.reason === "backend-error" ? t26("schedule.err_backend", { detail: outcome.detail }) : outcome.refusal === "npx" ? t26("schedule.err_npx") : t26("schedule.err_no_host_runner");
-  const hint = outcome.reason === "refused" && outcome.refusal === "npx" ? t26("schedule.err_npx_hint") : outcome.reason === "refused" ? t26("schedule.err_no_host_runner_hint") : void 0;
+  const message = outcome.reason === "unsupported-platform" ? t27("schedule.err_platform_unsupported") : outcome.reason === "backend-error" ? t27("schedule.err_backend", { detail: outcome.detail }) : outcome.refusal === "npx" ? t27("schedule.err_npx") : t27("schedule.err_no_host_runner");
+  const hint = outcome.reason === "refused" && outcome.refusal === "npx" ? t27("schedule.err_npx_hint") : outcome.reason === "refused" ? t27("schedule.err_no_host_runner_hint") : void 0;
   if (!fatal) {
     warn2(message);
     if (hint) warn2(hint);
@@ -3477,7 +3615,7 @@ async function runAdd(opts) {
     });
     if (validation.issues.length > 0) {
       throw new CliError(
-        t27("schedule.err_invalid"),
+        t28("schedule.err_invalid"),
         EXIT_CODES.FAILURE,
         renderIssues(validation.issues)
       );
@@ -3507,26 +3645,26 @@ async function fillInteractively(opts) {
   if (!missing) return opts;
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
     throw new CliError(
-      t27("schedule.err_missing_flags"),
+      t28("schedule.err_missing_flags"),
       EXIT_CODES.FAILURE,
-      t27("schedule.err_missing_flags_hint")
+      t28("schedule.err_missing_flags_hint")
     );
   }
   const { input: input2, select: select2 } = await import("@inquirer/prompts");
   const next = { ...opts };
-  next.name ||= await input2({ message: t27("schedule.ask_name") });
-  next.prompt ||= await input2({ message: t27("schedule.ask_prompt") });
+  next.name ||= await input2({ message: t28("schedule.ask_name") });
+  next.prompt ||= await input2({ message: t28("schedule.ask_prompt") });
   if (!hasTrigger) {
-    const at = await input2({ message: t27("schedule.ask_at"), default: "09:00" });
+    const at = await input2({ message: t28("schedule.ask_at"), default: "09:00" });
     next.daily = at;
   }
-  next.budget ||= await input2({ message: t27("schedule.ask_budget"), default: "0.50" });
+  next.budget ||= await input2({ message: t28("schedule.ask_budget"), default: "0.50" });
   next.permission ||= await select2({
-    message: t27("schedule.ask_permission"),
+    message: t28("schedule.ask_permission"),
     choices: [
-      { name: t27("schedule.permission.default"), value: "default" },
-      { name: t27("schedule.permission.plan"), value: "plan" },
-      { name: t27("schedule.permission.accept_edits"), value: "acceptEdits" }
+      { name: t28("schedule.permission.default"), value: "default" },
+      { name: t28("schedule.permission.plan"), value: "plan" },
+      { name: t28("schedule.permission.accept_edits"), value: "acceptEdits" }
     ]
   });
   return next;
@@ -3535,8 +3673,8 @@ function parseTrigger(opts) {
   const given = [opts.daily, opts.weekly, opts.monthly, opts.every, opts.once].filter(
     (v) => v !== void 0
   );
-  if (given.length === 0) throw new CliError(t27("schedule.err_no_trigger"), EXIT_CODES.FAILURE);
-  if (given.length > 1) throw new CliError(t27("schedule.err_many_triggers"), EXIT_CODES.FAILURE);
+  if (given.length === 0) throw new CliError(t28("schedule.err_no_trigger"), EXIT_CODES.FAILURE);
+  if (given.length > 1) throw new CliError(t28("schedule.err_many_triggers"), EXIT_CODES.FAILURE);
   if (opts.daily !== void 0) return { kind: "cron", cycle: "daily", at: opts.daily };
   if (opts.weekly !== void 0) {
     return {
@@ -3560,14 +3698,14 @@ function parseTrigger(opts) {
   return { kind: "interval", everyMinutes: parseEvery(opts.every) };
 }
 function requireAt(opts) {
-  if (!opts.at) throw new CliError(t27("schedule.err_at_required"), EXIT_CODES.FAILURE);
+  if (!opts.at) throw new CliError(t28("schedule.err_at_required"), EXIT_CODES.FAILURE);
   return opts.at;
 }
 function parseWeekday(raw) {
   const idx = WEEKDAY_CODES.indexOf(raw.trim().toUpperCase());
   if (idx < 0) {
     throw new CliError(
-      t27("schedule.err_weekday", { value: raw }),
+      t28("schedule.err_weekday", { value: raw }),
       EXIT_CODES.FAILURE,
       WEEKDAY_CODES.join(",")
     );
@@ -3579,9 +3717,9 @@ function parseEvery(raw) {
   const minutes = m ? Number(m[1]) * (m[2]?.toLowerCase() === "h" ? 60 : 1) : Number.NaN;
   if (!SCHEDULE_INTERVAL_MINUTES.includes(minutes)) {
     throw new CliError(
-      t27("schedule.err_every", { value: raw }),
+      t28("schedule.err_every", { value: raw }),
       EXIT_CODES.FAILURE,
-      t27("schedule.err_every_hint", {
+      t28("schedule.err_every_hint", {
         values: SCHEDULE_INTERVAL_MINUTES.map((n) => n < 60 ? `${n}m` : `${n / 60}h`).join(" / ")
       })
     );
@@ -3592,7 +3730,7 @@ function parsePermission(raw) {
   if (raw === void 0) return "default";
   if (!isPermissionLevel3(raw)) {
     throw new CliError(
-      t27("schedule.err_permission", { value: raw }),
+      t28("schedule.err_permission", { value: raw }),
       EXIT_CODES.FAILURE,
       PERMISSION_LEVELS4.join(" / ")
     );
@@ -3604,7 +3742,7 @@ function parseOperations(raw) {
   for (const value of raw ?? []) {
     if (!isOperationType2(value)) {
       throw new CliError(
-        t27("schedule.err_operation", { value }),
+        t28("schedule.err_operation", { value }),
         EXIT_CODES.FAILURE,
         OPERATION_TYPES4.join(" / ")
       );
@@ -3617,9 +3755,9 @@ function buildInput(opts, trigger, permission) {
   const budget = Number(opts.budget);
   if (!Number.isFinite(budget) || budget <= 0) {
     throw new CliError(
-      t27("schedule.err_budget", { value: opts.budget ?? "" }),
+      t28("schedule.err_budget", { value: opts.budget ?? "" }),
       EXIT_CODES.FAILURE,
-      t27("schedule.err_budget_hint")
+      t28("schedule.err_budget_hint")
     );
   }
   return {
@@ -3655,52 +3793,52 @@ function applyDefaultAllowlist(store, def, opts) {
   }) ?? def;
 }
 function printSummary(def) {
-  log8(t27("schedule.created", { id: def.id, name: def.name }));
-  log8("");
-  log8(t27("schedule.created_next", { id: def.id.slice(0, 12) }));
+  log9(t28("schedule.created", { id: def.id, name: def.name }));
+  log9("");
+  log9(t28("schedule.created_next", { id: def.id.slice(0, 12) }));
 }
 // src/schedule/doctor.ts
 import { diagnoseSchedules, pruneSchedules, repairSchedules } from "@epoch-agent/core";
-import { t as t28 } from "@epoch-agent/infra";
+import { t as t29 } from "@epoch-agent/infra";
 async function runDoctor(opts) {
   const ctx = await openSchedule();
   try {
     const deps = { store: ctx.store, backend: ctx.backend, registrar: ctx.registrar };
     const report = await diagnoseSchedules(deps);
     if (report.unsupported) {
-      warn2(t28("schedule.doctor_unsupported"));
+      warn2(t29("schedule.doctor_unsupported"));
       return;
     }
     if (report.drifts.length === 0) {
-      log8(t28("schedule.doctor_clean", { n: report.checked }));
+      log9(t29("schedule.doctor_clean", { n: report.checked }));
       return;
     }
-    log8(t28("schedule.doctor_found", { n: report.drifts.length }));
+    log9(t29("schedule.doctor_found", { n: report.drifts.length }));
     for (const drift of report.drifts) {
-      log8(
+      log9(
         `  \xB7 ${driftLabel(drift.kind)}  ${drift.name ?? drift.scheduleId ?? ""} [${drift.osTaskId || "\u2014"}]${drift.detail ? `
       ${drift.detail}` : ""}`
       );
     }
     if (opts.repair !== true && opts.prune !== true) {
-      log8("");
-      log8(t28("schedule.doctor_hint"));
+      log9("");
+      log9(t29("schedule.doctor_hint"));
       return;
     }
     if (opts.repair === true) {
       for (const outcome of await repairSchedules(report.drifts, deps)) {
         const label = outcome.drift.name ?? outcome.drift.scheduleId ?? "";
-        if (outcome.ok) log8(t28("schedule.doctor_repaired", { name: label }));
+        if (outcome.ok) log9(t29("schedule.doctor_repaired", { name: label }));
         else
-          warn2(t28("schedule.doctor_repair_failed", { name: label, detail: outcome.detail ?? "" }));
+          warn2(t29("schedule.doctor_repair_failed", { name: label, detail: outcome.detail ?? "" }));
       }
     }
     if (opts.prune === true) {
       for (const outcome of await pruneSchedules(report.drifts, deps)) {
-        if (outcome.ok) log8(t28("schedule.doctor_pruned", { id: outcome.drift.osTaskId }));
+        if (outcome.ok) log9(t29("schedule.doctor_pruned", { id: outcome.drift.osTaskId }));
         else {
           warn2(
-            t28("schedule.doctor_prune_failed", {
+            t29("schedule.doctor_prune_failed", {
               id: outcome.drift.osTaskId,
               detail: outcome.detail ?? ""
             })
@@ -3714,15 +3852,15 @@ async function runDoctor(opts) {
   }
 }
 // src/schedule/manage.ts
-import { automationLogsDir, t as t29 } from "@epoch-agent/infra";
+import { automationLogsDir, t as t30 } from "@epoch-agent/infra";
 async function runSetEnabled(idOrPrefix, enabled) {
   const ctx = await openSchedule();
   try {
     const def = mustFind(ctx.store, idOrPrefix);
     const outcome = await ctx.registrar.setEnabled(def, enabled);
     reportRegistration(outcome, false);
-    log8(
-      enabled ? t29("schedule.enabled_done", { name: def.name }) : t29("schedule.disabled_done", { name: def.name })
+    log9(
+      enabled ? t30("schedule.enabled_done", { name: def.name }) : t30("schedule.disabled_done", { name: def.name })
     );
   } finally {
     ctx.close();
@@ -3734,14 +3872,14 @@ async function runRemove(idOrPrefix) {
     const def = mustFind(ctx.store, idOrPrefix);
     if (def.osTaskId) reportRegistration(await ctx.registrar.unregister(def), false);
     ctx.store.remove(def.id);
-    log8(t29("schedule.removed", { name: def.name }));
-    log8(t29("schedule.removed_logs_kept", { dir: automationLogsDir(def.id, ctx.homeDir) }));
+    log9(t30("schedule.removed", { name: def.name }));
+    log9(t30("schedule.removed_logs_kept", { dir: automationLogsDir(def.id, ctx.homeDir) }));
   } finally {
     ctx.close();
   }
 }
 // src/schedule/run.ts
-import { t as t30 } from "@epoch-agent/infra";
+import { t as t31 } from "@epoch-agent/infra";
 import { unfixedRules } from "@epoch-agent/protocol";
 import { fireSchedule } from "@epoch-agent/runtime";
 async function runFire(scheduleId, homeDir) {
@@ -3754,9 +3892,9 @@ async function runFire(scheduleId, homeDir) {
     ctx.close();
   }
   if (result.missing) {
-    warn2(t30("schedule.fire_missing", { id: scheduleId }));
+    warn2(t31("schedule.fire_missing", { id: scheduleId }));
   } else if (result.disabled) {
-    warn2(t30("schedule.fire_disabled", { id: scheduleId }));
+    warn2(t31("schedule.fire_disabled", { id: scheduleId }));
   } else {
     warn2(`${statusLabel(result.status)}${result.detail ? `  ${result.detail}` : ""}`);
   }
@@ -3766,14 +3904,14 @@ async function runManual(idOrPrefix, opts) {
   const ctx = await openSchedule();
   try {
     const def = mustFind(ctx.store, idOrPrefix);
-    log8(t30("schedule.run_start", { name: def.name }));
+    log9(t31("schedule.run_start", { name: def.name }));
     const result = await fireSchedule({
       scheduleId: def.id,
       homeDir: ctx.homeDir,
       manual: true,
       registrar: ctx.registrar
     });
-    log8(`${statusLabel(result.status)}${result.detail ? `  ${result.detail}` : ""}`);
+    log9(`${statusLabel(result.status)}${result.detail ? `  ${result.detail}` : ""}`);
     const pending = result.run?.pendingApprovals ?? [];
     if (pending.length === 0) {
       process.exitCode = result.exitCode;
@@ -3782,21 +3920,21 @@ async function runManual(idOrPrefix, opts) {
     printPending(pending);
     if (opts.fix === true) {
       const added = applyFix(ctx.store, def.id, pending);
-      log8(added.length > 0 ? t30("schedule.fix_done", { n: added.length }) : t30("schedule.fix_none"));
+      log9(added.length > 0 ? t31("schedule.fix_done", { n: added.length }) : t31("schedule.fix_none"));
       return;
     }
-    log8(t30("schedule.fix_hint", { id: def.id.slice(0, 12) }));
+    log9(t31("schedule.fix_hint", { id: def.id.slice(0, 12) }));
     process.exitCode = result.exitCode;
   } finally {
     ctx.close();
   }
 }
 function printPending(pending) {
-  log8("");
-  log8(t30("schedule.pending_header", { n: pending.length }));
+  log9("");
+  log9(t31("schedule.pending_header", { n: pending.length }));
   for (const item of pending) {
-    log8(`  \xB7 ${t30("schedule.pending_line", { tool: item.toolName, target: item.target })}`);
-    if (item.suggestedRule) log8(`    \u2192 ${item.suggestedRule}`);
+    log9(`  \xB7 ${t31("schedule.pending_line", { tool: item.toolName, target: item.target })}`);
+    if (item.suggestedRule) log9(`    \u2192 ${item.suggestedRule}`);
   }
 }
 function applyFix(store, scheduleId, pending) {
@@ -3808,23 +3946,23 @@ function applyFix(store, scheduleId, pending) {
 }
 // src/schedule/view.ts
 import { nextRunAt, readRecording } from "@epoch-agent/core";
-import { t as t31 } from "@epoch-agent/infra";
+import { t as t32 } from "@epoch-agent/infra";
 async function runList() {
   const ctx = await openSchedule();
   try {
     const defs = ctx.store.list();
     if (defs.length === 0) {
-      log8(t31("schedule.list_empty"));
-      log8(t31("schedule.list_empty_hint"));
+      log9(t32("schedule.list_empty"));
+      log9(t32("schedule.list_empty_hint"));
       return;
     }
-    log8(t31("schedule.list_header"));
+    log9(t32("schedule.list_header"));
     for (const def of defs) {
-      const next = def.enabled ? formatWhen(nextRunAt(def.trigger, Date.now(), def.startDate, def.endDate) ?? void 0) : t31("schedule.disabled_mark");
+      const next = def.enabled ? formatWhen(nextRunAt(def.trigger, Date.now(), def.startDate, def.endDate) ?? void 0) : t32("schedule.disabled_mark");
       const danger = def.permission === "bypass" ? " \u{1F534}" : "";
-      log8(
+      log9(
         `  ${def.id.slice(0, 12)}  ${def.name}${danger}
-      ${describeTrigger(def.trigger)}  \xB7  ${t31("schedule.col_next")} ${next}  \xB7  ${t31("schedule.col_last")} ${def.lastStatus ? statusLabel(def.lastStatus) : "\u2014"}  \xB7  ${permissionLabel(def.permission)}`
+      ${describeTrigger(def.trigger)}  \xB7  ${t32("schedule.col_next")} ${next}  \xB7  ${t32("schedule.col_last")} ${def.lastStatus ? statusLabel(def.lastStatus) : "\u2014"}  \xB7  ${permissionLabel(def.permission)}`
       );
     }
   } finally {
@@ -3835,45 +3973,45 @@ async function runShow(idOrPrefix) {
   const ctx = await openSchedule();
   try {
     const def = mustFind(ctx.store, idOrPrefix);
-    log8(`${def.name}  (${def.id})`);
-    log8(`  ${t31("schedule.field_enabled")}: ${def.enabled ? t31("schedule.yes") : t31("schedule.no")}`);
-    log8(`  ${t31("schedule.field_trigger")}: ${describeTrigger(def.trigger)}`);
+    log9(`${def.name}  (${def.id})`);
+    log9(`  ${t32("schedule.field_enabled")}: ${def.enabled ? t32("schedule.yes") : t32("schedule.no")}`);
+    log9(`  ${t32("schedule.field_trigger")}: ${describeTrigger(def.trigger)}`);
     if (def.startDate ?? def.endDate) {
-      log8(`  ${t31("schedule.field_window")}: ${def.startDate ?? "\u2014"} .. ${def.endDate ?? "\u2014"}`);
+      log9(`  ${t32("schedule.field_window")}: ${def.startDate ?? "\u2014"} .. ${def.endDate ?? "\u2014"}`);
     }
-    log8(
-      `  ${t31("schedule.field_next")}: ${formatWhen(
+    log9(
+      `  ${t32("schedule.field_next")}: ${formatWhen(
         nextRunAt(def.trigger, Date.now(), def.startDate, def.endDate) ?? void 0
       )}`
     );
-    log8(`  ${t31("schedule.field_workdir")}: ${def.workDir}`);
-    if (def.model) log8(`  ${t31("schedule.field_model")}: ${def.model}`);
-    log8(`  ${t31("schedule.field_permission")}: ${permissionLabel(def.permission)}`);
-    log8(
-      `  ${t31("schedule.field_limits")}: ` + t31("schedule.limits_value", {
+    log9(`  ${t32("schedule.field_workdir")}: ${def.workDir}`);
+    if (def.model) log9(`  ${t32("schedule.field_model")}: ${def.model}`);
+    log9(`  ${t32("schedule.field_permission")}: ${permissionLabel(def.permission)}`);
+    log9(
+      `  ${t32("schedule.field_limits")}: ` + t32("schedule.limits_value", {
         turns: def.maxTurns,
         budget: def.maxBudgetUsd.toFixed(2),
         minutes: Math.round(def.timeoutMs / 6e4)
       })
     );
-    log8(`  ${t31("schedule.field_backend")}: ${def.osBackend}  ${def.osTaskId || "\u2014"}`);
-    log8(`  ${t31("schedule.field_prompt")}:`);
-    for (const line of def.prompt.split("\n")) log8(`    ${line}`);
-    log8("");
+    log9(`  ${t32("schedule.field_backend")}: ${def.osBackend}  ${def.osTaskId || "\u2014"}`);
+    log9(`  ${t32("schedule.field_prompt")}:`);
+    for (const line of def.prompt.split("\n")) log9(`    ${line}`);
+    log9("");
     printAllowlist(def);
-    log8("");
-    log8(t31("schedule.field_last_run", { when: formatWhen(def.lastRunAt) }));
+    log9("");
+    log9(t32("schedule.field_last_run", { when: formatWhen(def.lastRunAt) }));
   } finally {
     ctx.close();
   }
 }
 function printAllowlist(def) {
   if (def.permission === "bypass") {
-    log8(t31("schedule.allowlist_bypass"));
+    log9(t32("schedule.allowlist_bypass"));
     return;
   }
   if (def.permission === "plan") {
-    log8(t31("schedule.allowlist_readonly"));
+    log9(t32("schedule.allowlist_readonly"));
     return;
   }
   const lines = [
@@ -3881,9 +4019,9 @@ function printAllowlist(def) {
     ...def.allowOperations.map((v) => `    ${v}`),
     ...def.allowRules.map((v) => `    ${v}`)
   ];
-  log8(t31("schedule.allowlist_header"));
-  log8(lines.length > 0 ? lines.join("\n") : `    ${t31("schedule.allowlist_empty")}`);
-  log8(t31("schedule.allowlist_scope_note"));
+  log9(t32("schedule.allowlist_header"));
+  log9(lines.length > 0 ? lines.join("\n") : `    ${t32("schedule.allowlist_empty")}`);
+  log9(t32("schedule.allowlist_scope_note"));
 }
 async function runLogs(idOrPrefix, limit, tail) {
   const ctx = await openSchedule();
@@ -3891,7 +4029,7 @@ async function runLogs(idOrPrefix, limit, tail) {
     const def = mustFind(ctx.store, idOrPrefix);
     const runs = ctx.store.listRuns(def.id, limit);
     if (runs.length === 0) {
-      log8(t31("schedule.logs_empty"));
+      log9(t32("schedule.logs_empty"));
       return;
     }
     for (const run of runs) printRun(run);
@@ -3901,31 +4039,31 @@ async function runLogs(idOrPrefix, limit, tail) {
   }
 }
 function printRun(run) {
-  log8(
-    `  ${formatWhen(run.startedAt)}  ${statusLabel(run.status)}  ` + t31("schedule.run_meta", {
+  log9(
+    `  ${formatWhen(run.startedAt)}  ${statusLabel(run.status)}  ` + t32("schedule.run_meta", {
       turns: run.turns,
       cost: run.costUsd.toFixed(4),
-      manual: run.manual ? t31("schedule.run_manual") : ""
+      manual: run.manual ? t32("schedule.run_manual") : ""
     })
   );
-  if (run.reason) log8(`      ${run.reason}`);
+  if (run.reason) log9(`      ${run.reason}`);
   for (const pending of run.pendingApprovals) {
-    log8(
-      `      \u26A0 ${t31("schedule.pending_line", { tool: pending.toolName, target: pending.target })}`
+    log9(
+      `      \u26A0 ${t32("schedule.pending_line", { tool: pending.toolName, target: pending.target })}`
     );
     if (pending.suggestedRule) {
-      log8(`        ${t31("schedule.pending_fix", { rule: pending.suggestedRule })}`);
+      log9(`        ${t32("schedule.pending_fix", { rule: pending.suggestedRule })}`);
     }
   }
 }
 function printRecording(run) {
   if (!run.logPath) return;
-  log8("");
-  log8(t31("schedule.logs_recording", { path: run.logPath }));
+  log9("");
+  log9(t32("schedule.logs_recording", { path: run.logPath }));
   for (const envelope of readRecording(run.logPath)) {
     const event = envelope.event;
     if (event.type === "text-delta" && event.text) process.stdout.write(event.text);
-    else if (event.type === "error" && event.message) log8(`
+    else if (event.type === "error" && event.message) log9(`
 [error] ${event.message}`);
   }
   process.stdout.write("\n");
@@ -3933,19 +4071,19 @@ function printRecording(run) {
 // src/commands/schedule.ts
 var DEFAULT_LOG_LIMIT = 10;
 function registerScheduleCommand(program2) {
-  const cmd = program2.command("schedule").description(t32("cli.schedule.summary"));
-  cmd.command("add").description(t32("cli.schedule.add")).option("--name <name>", t32("cli.schedule.opt_name")).option("--prompt <text>", t32("cli.schedule.opt_prompt")).option("--daily <HH:mm>", t32("cli.schedule.opt_daily")).option("--weekly <days>", t32("cli.schedule.opt_weekly")).option("--monthly <days>", t32("cli.schedule.opt_monthly")).option("--every <interval>", t32("cli.schedule.opt_every")).option("--once <YYYY-MM-DD>", t32("cli.schedule.opt_once")).option("--at <HH:mm>", t32("cli.schedule.opt_at")).option("--start <YYYY-MM-DD>", t32("cli.schedule.opt_start")).option("--end <YYYY-MM-DD>", t32("cli.schedule.opt_end")).option("--workdir <dir>", t32("cli.schedule.opt_workdir")).option("--model <model>", t32("cli.schedule.opt_model")).option("--permission <level>", t32("cli.schedule.opt_permission")).option("--allow-tool <name>", t32("cli.schedule.opt_allow_tool"), collect3, []).option("--allow-operation <type>", t32("cli.schedule.opt_allow_operation"), collect3, []).option("--allow-rule <rule>", t32("cli.schedule.opt_allow_rule"), collect3, []).option("--max-turns <n>", t32("cli.schedule.opt_max_turns")).option("--budget <usd>", t32("cli.schedule.opt_budget")).option("--timeout <minutes>", t32("cli.schedule.opt_timeout")).option("--disabled", t32("cli.schedule.opt_disabled")).option("--i-understand-bypass", t32("cli.schedule.opt_bypass_ack")).action((opts) => runAdd(opts));
-  cmd.command("list", { isDefault: true }).description(t32("cli.schedule.list")).action(() => runList());
-  cmd.command("show").description(t32("cli.schedule.show")).argument("<id>", t32("cli.schedule.arg_id")).action((id) => runShow(id));
-  cmd.command("enable").description(t32("cli.schedule.enable")).argument("<id>", t32("cli.schedule.arg_id")).action((id) => runSetEnabled(id, true));
-  cmd.command("disable").description(t32("cli.schedule.disable")).argument("<id>", t32("cli.schedule.arg_id")).action((id) => runSetEnabled(id, false));
-  cmd.command("rm").alias("remove").description(t32("cli.schedule.rm")).argument("<id>", t32("cli.schedule.arg_id")).action((id) => runRemove(id));
-  cmd.command("run").description(t32("cli.schedule.run")).argument("<id>", t32("cli.schedule.arg_id")).option("--fix", t32("cli.schedule.opt_fix")).action((id, opts) => runManual(id, opts));
-  cmd.command("logs").description(t32("cli.schedule.logs")).argument("<id>", t32("cli.schedule.arg_id")).option("-n, --limit <n>", t32("cli.schedule.opt_limit"), String(DEFAULT_LOG_LIMIT)).option("--tail", t32("cli.schedule.opt_tail")).action(
+  const cmd = program2.command("schedule").description(t33("cli.schedule.summary"));
+  cmd.command("add").description(t33("cli.schedule.add")).option("--name <name>", t33("cli.schedule.opt_name")).option("--prompt <text>", t33("cli.schedule.opt_prompt")).option("--daily <HH:mm>", t33("cli.schedule.opt_daily")).option("--weekly <days>", t33("cli.schedule.opt_weekly")).option("--monthly <days>", t33("cli.schedule.opt_monthly")).option("--every <interval>", t33("cli.schedule.opt_every")).option("--once <YYYY-MM-DD>", t33("cli.schedule.opt_once")).option("--at <HH:mm>", t33("cli.schedule.opt_at")).option("--start <YYYY-MM-DD>", t33("cli.schedule.opt_start")).option("--end <YYYY-MM-DD>", t33("cli.schedule.opt_end")).option("--workdir <dir>", t33("cli.schedule.opt_workdir")).option("--model <model>", t33("cli.schedule.opt_model")).option("--permission <level>", t33("cli.schedule.opt_permission")).option("--allow-tool <name>", t33("cli.schedule.opt_allow_tool"), collect3, []).option("--allow-operation <type>", t33("cli.schedule.opt_allow_operation"), collect3, []).option("--allow-rule <rule>", t33("cli.schedule.opt_allow_rule"), collect3, []).option("--max-turns <n>", t33("cli.schedule.opt_max_turns")).option("--budget <usd>", t33("cli.schedule.opt_budget")).option("--timeout <minutes>", t33("cli.schedule.opt_timeout")).option("--disabled", t33("cli.schedule.opt_disabled")).option("--i-understand-bypass", t33("cli.schedule.opt_bypass_ack")).action((opts) => runAdd(opts));
+  cmd.command("list", { isDefault: true }).description(t33("cli.schedule.list")).action(() => runList());
+  cmd.command("show").description(t33("cli.schedule.show")).argument("<id>", t33("cli.schedule.arg_id")).action((id) => runShow(id));
+  cmd.command("enable").description(t33("cli.schedule.enable")).argument("<id>", t33("cli.schedule.arg_id")).action((id) => runSetEnabled(id, true));
+  cmd.command("disable").description(t33("cli.schedule.disable")).argument("<id>", t33("cli.schedule.arg_id")).action((id) => runSetEnabled(id, false));
+  cmd.command("rm").alias("remove").description(t33("cli.schedule.rm")).argument("<id>", t33("cli.schedule.arg_id")).action((id) => runRemove(id));
+  cmd.command("run").description(t33("cli.schedule.run")).argument("<id>", t33("cli.schedule.arg_id")).option("--fix", t33("cli.schedule.opt_fix")).action((id, opts) => runManual(id, opts));
+  cmd.command("logs").description(t33("cli.schedule.logs")).argument("<id>", t33("cli.schedule.arg_id")).option("-n, --limit <n>", t33("cli.schedule.opt_limit"), String(DEFAULT_LOG_LIMIT)).option("--tail", t33("cli.schedule.opt_tail")).action(
     (id, opts) => runLogs(id, Number(opts.limit ?? DEFAULT_LOG_LIMIT), opts.tail === true)
   );
-  cmd.command("fire").description(t32("cli.schedule.fire")).argument("<id>", t32("cli.schedule.arg_id")).option("--home <dir>", t32("cli.schedule.opt_home")).action((id, opts) => runFire(id, opts.home));
-  cmd.command("doctor").description(t32("cli.schedule.doctor")).option("--repair", t32("cli.schedule.opt_repair")).option("--prune", t32("cli.schedule.opt_prune")).action((opts) => runDoctor(opts));
+  cmd.command("fire").description(t33("cli.schedule.fire")).argument("<id>", t33("cli.schedule.arg_id")).option("--home <dir>", t33("cli.schedule.opt_home")).action((id, opts) => runFire(id, opts.home));
+  cmd.command("doctor").description(t33("cli.schedule.doctor")).option("--repair", t33("cli.schedule.opt_repair")).option("--prune", t33("cli.schedule.opt_prune")).action((opts) => runDoctor(opts));
 }
 function collect3(value, previous) {
   return [...previous, value];
@@ -3956,7 +4094,7 @@ import { statfs } from "fs/promises";
 import {
   describeIsolation,
   getConfigIssues,
-  loadConfig as loadConfig3,
+  loadConfig as loadConfig4,
   SANDBOX_COVERS,
   SANDBOX_EXCLUDES
 } from "@epoch-agent/core";
@@ -3964,17 +4102,13 @@ import {
   allJobs,
   confine,
   resolveProfile,
-  t as t34
+  t as t35
 } from "@epoch-agent/infra";
 import { hasFailure } from "@epoch-agent/protocol";
-import {
-  classifyTerminal,
-  probeShiftEnter
-} from "@epoch-agent/tui";
 // src/statusline.ts
 import { execFile as execFile2 } from "child_process";
 import { sanitizeToolOutput } from "@epoch-agent/core";
-import { shellSpawnArgs, t as t33 } from "@epoch-agent/infra";
+import { shellSpawnArgs, t as t34 } from "@epoch-agent/infra";
 var TIMEOUT_MS2 = 2e3;
 var MAX_WIDTH = 60;
 var MAX_BUFFER = 64 * 1024;
@@ -4002,7 +4136,7 @@ function runStatusLineCommand(command, cwd) {
           const killed = err2.killed === true;
           settle({
             text: null,
-            error: killed ? t33("statusline.timeout", { ms: TIMEOUT_MS2 }) : err2.message.trim()
+            error: killed ? t34("statusline.timeout", { ms: TIMEOUT_MS2 }) : err2.message.trim()
           });
           return;
         }
@@ -4016,12 +4150,12 @@ async function probeStatusLine(config, cwd) {
   if (!command) return null;
   const result = await runStatusLineCommand(command, cwd);
   if (result.text === null) {
-    return { command, ok: false, detail: result.error ?? t33("statusline.no_output") };
+    return { command, ok: false, detail: result.error ?? t34("statusline.no_output") };
   }
   return { command, ok: true, detail: result.text };
 }
 // src/commands/status.ts
-var log9 = (msg) => {
+var log10 = (msg) => {
   process.stdout.write(msg + "\n");
 };
 var STATUS_MARK = {
@@ -4049,10 +4183,10 @@ async function describeDisk(path = ".") {
   }
 }
 function describeConfig() {
-  if (!existsSync7(CONFIG_PATH)) return t34("cli.status.config_absent");
-  loadConfig3();
+  if (!existsSync7(CONFIG_PATH)) return t35("cli.status.config_absent");
+  loadConfig4();
   const n = getConfigIssues().length;
-  return n === 0 ? t34("cli.status.config_present") : t34("cli.status.config_present_with_issues", { count: n });
+  return n === 0 ? t35("cli.status.config_present") : t35("cli.status.config_present_with_issues", { count: n });
 }
 async function describeSecretBackend() {
   try {
@@ -4060,18 +4194,18 @@ async function describeSecretBackend() {
     const store = await createSecretStore();
     return store.encrypted ? store.detail : `\u26A0 ${store.detail}`;
   } catch (err2) {
-    return t34("cli.status.secret_probe_failed", {
+    return t35("cli.status.secret_probe_failed", {
       message: err2 instanceof Error ? err2.message : String(err2)
     });
   }
 }
 function workspaceLines(rt) {
-  const lines = [`  ${t34("cli.doctor.workspace_root", { root: rt.workspace.root })}`];
+  const lines = [`  ${t35("cli.doctor.workspace_root", { root: rt.workspace.root })}`];
   lines.push(
-    `  ${rt.trusted ? t34("cli.doctor.workspace_trusted") : t34("cli.doctor.workspace_untrusted")}`
+    `  ${rt.trusted ? t35("cli.doctor.workspace_trusted") : t35("cli.doctor.workspace_untrusted")}`
   );
   lines.push(
-    `  ${rt.workspace.extra.length === 0 ? t34("cli.doctor.workspace_no_extra") : t34("cli.doctor.workspace_extra", { count: rt.workspace.extra.length })}`
+    `  ${rt.workspace.extra.length === 0 ? t35("cli.doctor.workspace_no_extra") : t35("cli.doctor.workspace_extra", { count: rt.workspace.extra.length })}`
   );
   for (const dir of rt.workspace.extra) lines.push(`    \xB7 ${dir}`);
   return lines;
@@ -4079,94 +4213,94 @@ function workspaceLines(rt) {
 function sandboxLines(cwd, sandbox) {
   const iso = describeIsolation();
   const lines = [`
-${t34("cli.doctor.sandbox_head")}`];
+${t35("cli.doctor.sandbox_head")}`];
   if (iso.backend === "none") {
     lines.push(`  ${STATUS_MARK.skipped} ${iso.detail}`);
     lines.push(
-      `  ${STATUS_MARK.warn} ${t34(
+      `  ${STATUS_MARK.warn} ${t35(
         iso.reason === "platform-unsupported" ? "cli.doctor.sandbox_absent_by_design" : "cli.doctor.sandbox_absent_tools"
       )}`
     );
     return lines;
   }
   lines.push(
-    `  ${STATUS_MARK.ok} ${t34("cli.doctor.sandbox_backend", { backend: iso.backend, platform: iso.platform })}`
+    `  ${STATUS_MARK.ok} ${t35("cli.doctor.sandbox_backend", { backend: iso.backend, platform: iso.platform })}`
   );
-  lines.push(`  \xB7 ${t34("cli.doctor.sandbox_code_exec", { detail: iso.detail })}`);
+  lines.push(`  \xB7 ${t35("cli.doctor.sandbox_code_exec", { detail: iso.detail })}`);
   const probe = (mode) => confine("/bin/sh", ["-c", "true"], { mode, workspaceRoot: cwd, allowNetwork: true });
   for (const mode of ["workspace-write", "read-only"]) {
     const c = probe(mode);
     if (!c.confined) continue;
-    lines.push(`  \xB7 ${t34("cli.doctor.sandbox_terminal", { mode, enforcement: c.enforcement })}`);
-    if (c.enforcement === "partial") lines.push(`    ${t34("cli.doctor.sandbox_partial_devnull")}`);
+    lines.push(`  \xB7 ${t35("cli.doctor.sandbox_terminal", { mode, enforcement: c.enforcement })}`);
+    if (c.enforcement === "partial") lines.push(`    ${t35("cli.doctor.sandbox_partial_devnull")}`);
   }
   const writable = probe("workspace-write");
   if (writable.confined) {
-    lines.push(`  \xB7 ${t34("cli.doctor.sandbox_writable")}`);
+    lines.push(`  \xB7 ${t35("cli.doctor.sandbox_writable")}`);
     for (const dir of writable.writableDirs) lines.push(`    \xB7 ${dir}`);
   }
   lines.push(
-    sandbox?.terminal === false ? `  ${STATUS_MARK.warn} ${t34("cli.doctor.sandbox_switch_off")}` : `  ${STATUS_MARK.ok} ${t34("cli.doctor.sandbox_switch_on")}`
+    sandbox?.terminal === false ? `  ${STATUS_MARK.warn} ${t35("cli.doctor.sandbox_switch_off")}` : `  ${STATUS_MARK.ok} ${t35("cli.doctor.sandbox_switch_on")}`
   );
-  lines.push(`  \xB7 ${t34("cli.doctor.sandbox_covers", { tools: SANDBOX_COVERS.join(", ") })}`);
+  lines.push(`  \xB7 ${t35("cli.doctor.sandbox_covers", { tools: SANDBOX_COVERS.join(", ") })}`);
   lines.push(
-    SANDBOX_EXCLUDES.length === 0 ? `  ${STATUS_MARK.ok} ${t34("cli.doctor.sandbox_excludes_none")}` : `  ${STATUS_MARK.warn} ${t34("cli.doctor.sandbox_excludes", { tools: SANDBOX_EXCLUDES.join(", ") })}`
+    SANDBOX_EXCLUDES.length === 0 ? `  ${STATUS_MARK.ok} ${t35("cli.doctor.sandbox_excludes_none")}` : `  ${STATUS_MARK.warn} ${t35("cli.doctor.sandbox_excludes", { tools: SANDBOX_EXCLUDES.join(", ") })}`
   );
   return lines;
 }
 function ftsLines(health) {
   const lines = [`
-${t34("cli.doctor.fts_head")}`];
+${t35("cli.doctor.fts_head")}`];
   const indexed = health.tables.map((tb) => `${tb.table} ${tb.rows}`).join(" \xB7 ");
-  lines.push(`  \xB7 ${t34("cli.doctor.fts_rows", { messages: health.messages, indexed })}`);
+  lines.push(`  \xB7 ${t35("cli.doctor.fts_rows", { messages: health.messages, indexed })}`);
   const behind = health.tables.filter((tb) => tb.rows !== health.messages);
   lines.push(
-    behind.length === 0 ? `  ${STATUS_MARK.ok} ${t34("cli.doctor.fts_in_sync")}` : (
-      `  ${STATUS_MARK.warn} ${t34("cli.doctor.fts_out_of_sync", {
+    behind.length === 0 ? `  ${STATUS_MARK.ok} ${t35("cli.doctor.fts_in_sync")}` : (
+      `  ${STATUS_MARK.warn} ${t35("cli.doctor.fts_out_of_sync", {
         tables: behind.map((tb) => `${tb.table} (${tb.rows - health.messages})`).join(", ")
       })}`
     )
   );
   lines.push(
-    health.missingTriggers.length === 0 ? `  ${STATUS_MARK.ok} ${t34("cli.doctor.fts_triggers_ok")}` : `  ${STATUS_MARK.failed} ${t34("cli.doctor.fts_triggers_missing", {
+    health.missingTriggers.length === 0 ? `  ${STATUS_MARK.ok} ${t35("cli.doctor.fts_triggers_ok")}` : `  ${STATUS_MARK.failed} ${t35("cli.doctor.fts_triggers_missing", {
       triggers: health.missingTriggers.join(", ")
     })}`
   );
   for (const tb of health.tables) {
     if (tb.error !== null) {
       lines.push(
-        `  ${STATUS_MARK.failed} ${t34("cli.doctor.fts_corrupt", { table: tb.table, detail: tb.error })}`
+        `  ${STATUS_MARK.failed} ${t35("cli.doctor.fts_corrupt", { table: tb.table, detail: tb.error })}`
       );
     }
     if (tb.drift !== null) {
       lines.push(
-        `  ${STATUS_MARK.warn} ${t34("cli.doctor.fts_drift", { table: tb.table, detail: tb.drift })}`
+        `  ${STATUS_MARK.warn} ${t35("cli.doctor.fts_drift", { table: tb.table, detail: tb.drift })}`
       );
     }
   }
   if (health.tables.some((tb) => !tb.external)) {
-    lines.push(`  ${STATUS_MARK.warn} ${t34("cli.doctor.fts_legacy_schema")}`);
+    lines.push(`  ${STATUS_MARK.warn} ${t35("cli.doctor.fts_legacy_schema")}`);
   }
   if (health.indexBytes !== void 0) {
-    lines.push(`  \xB7 ${t34("cli.doctor.fts_size", { size: formatBytes(health.indexBytes) })}`);
+    lines.push(`  \xB7 ${t35("cli.doctor.fts_size", { size: formatBytes(health.indexBytes) })}`);
   }
   if (health.space?.fileBytes !== void 0) {
     lines.push(
-      `  \xB7 ${t34("cli.doctor.fts_space", {
+      `  \xB7 ${t35("cli.doctor.fts_space", {
         file: formatBytes(health.space.fileBytes),
         free: formatBytes(health.space.freeBytes)
       })}`
     );
-    lines.push(`  \xB7 ${t34("cli.doctor.fts_reclaim_hint")}`);
+    lines.push(`  \xB7 ${t35("cli.doctor.fts_reclaim_hint")}`);
   }
   return lines;
 }
 function reclaimLines(report) {
   const lines = [`
-${t34("cli.doctor.reclaim_head")}`];
+${t35("cli.doctor.reclaim_head")}`];
   const secs = (ms) => `${(ms / 1e3).toFixed(1)}s`;
   lines.push(
-    `  ${STATUS_MARK.ok} ${t34("cli.doctor.reclaim_optimize", {
+    `  ${STATUS_MARK.ok} ${t35("cli.doctor.reclaim_optimize", {
       before: formatBytes(report.before.freeBytes),
       after: formatBytes(report.afterOptimize.freeBytes),
       ms: secs(report.optimizeMs)
@@ -4174,7 +4308,7 @@ ${t34("cli.doctor.reclaim_head")}`];
   );
   if (report.vacuumed) {
     lines.push(
-      `  ${STATUS_MARK.ok} ${t34("cli.doctor.reclaim_vacuum", {
+      `  ${STATUS_MARK.ok} ${t35("cli.doctor.reclaim_vacuum", {
         before: formatBytes(report.before.pageBytes),
         after: formatBytes(report.after.pageBytes),
         ms: secs(report.vacuumMs)
@@ -4182,14 +4316,14 @@ ${t34("cli.doctor.reclaim_head")}`];
     );
     const saved = report.before.pageBytes - report.after.pageBytes;
     lines.push(
-      `  ${STATUS_MARK.ok} ${t34("cli.doctor.reclaim_total", {
+      `  ${STATUS_MARK.ok} ${t35("cli.doctor.reclaim_total", {
         saved: formatBytes(saved),
         pct: `${(saved / Math.max(1, report.before.pageBytes) * 100).toFixed(1)}%`
       })}`
     );
   } else if (report.vacuumError !== null) {
     lines.push(
-      `  ${STATUS_MARK.warn} ${t34("cli.doctor.reclaim_vacuum_skipped", {
+      `  ${STATUS_MARK.warn} ${t35("cli.doctor.reclaim_vacuum_skipped", {
         detail: report.vacuumError
       })}`
     );
@@ -4209,17 +4343,17 @@ function hookLines(rt) {
   const { sources } = rt.hook;
   if (sources.length === 0) return [];
   const lines = [`
-${t34("cli.doctor.hook_head")}`];
+${t35("cli.doctor.hook_head")}`];
   for (const source of sources) {
-    const label = t34(HOOK_SOURCE_LABEL[source.kind]);
+    const label = t35(HOOK_SOURCE_LABEL[source.kind]);
     if (source.skipped) {
       lines.push(`  ${STATUS_MARK.skipped} ${label}: ${source.path}`);
-      lines.push(`      ${t34("cli.doctor.hook_skipped")}`);
+      lines.push(`      ${t35("cli.doctor.hook_skipped")}`);
       continue;
     }
     const name = source.plugin === void 0 ? label : `${label} ${source.plugin}`;
     lines.push(
-      `  ${STATUS_MARK.ok} ${name}: ${source.path}${t34("cli.doctor.hook_count", {
+      `  ${STATUS_MARK.ok} ${name}: ${source.path}${t35("cli.doctor.hook_count", {
         n: source.count
       })}`
     );
@@ -4233,65 +4367,65 @@ var JOB_KIND_LABEL = {
 };
 function jobLines(jobs) {
   const lines = [`
-${t34("cli.doctor.jobs_head")}`];
+${t35("cli.doctor.jobs_head")}`];
   const running = jobs.filter((job) => job.status === "running");
   if (running.length === 0) {
-    lines.push(`  ${STATUS_MARK.ok} ${t34("cli.doctor.jobs_none")}`);
+    lines.push(`  ${STATUS_MARK.ok} ${t35("cli.doctor.jobs_none")}`);
     return lines;
   }
-  lines.push(`  ${STATUS_MARK.warn} ${t34("cli.doctor.jobs_running", { n: running.length })}`);
+  lines.push(`  ${STATUS_MARK.warn} ${t35("cli.doctor.jobs_running", { n: running.length })}`);
   for (const job of running) {
     lines.push(
-      `    \xB7 ${t34("cli.doctor.jobs_line", {
-        kind: t34(JOB_KIND_LABEL[job.kind]),
+      `    \xB7 ${t35("cli.doctor.jobs_line", {
+        kind: t35(JOB_KIND_LABEL[job.kind]),
         id: job.id,
         label: job.label
       })}`
     );
   }
-  lines.push(`  \xB7 ${t34("cli.doctor.jobs_lifetime")}`);
+  lines.push(`  \xB7 ${t35("cli.doctor.jobs_lifetime")}`);
   return lines;
 }
 function terminalLines(result, terminal) {
   const head = `
-${t34("cli.doctor.terminal_head")}`;
+${t35("cli.doctor.terminal_head")}`;
   if (!result.ok) {
     if (result.failure.kind === "no-tty") {
       return [
         head,
-        `  ${STATUS_MARK.warn} ${t34("cli.doctor.terminal_no_tty")}`,
-        `  \xB7 ${t34("cli.doctor.terminal_alternatives")}`
+        `  ${STATUS_MARK.warn} ${t35("cli.doctor.terminal_no_tty")}`,
+        `  \xB7 ${t35("cli.doctor.terminal_alternatives")}`
       ];
     }
     return [
       head,
-      `  ${STATUS_MARK.warn} ${t34("cli.doctor.terminal_timeout", { n: result.failure.timeoutMs / 1e3 })}`
+      `  ${STATUS_MARK.warn} ${t35("cli.doctor.terminal_timeout", { n: result.failure.timeoutMs / 1e3 })}`
     ];
   }
   switch (result.sample.kind) {
     case "shift-enter":
-      return [head, `  ${STATUS_MARK.ok} ${t34("cli.doctor.terminal_shift_enter")}`];
+      return [head, `  ${STATUS_MARK.ok} ${t35("cli.doctor.terminal_shift_enter")}`];
     case "enter-only":
       if (terminal?.kind === "apple-terminal") {
         return [
           head,
-          `  ${STATUS_MARK.warn} ${t34("cli.doctor.terminal_apple")}`,
-          `  \xB7 ${t34("cli.doctor.terminal_alternatives")}`
+          `  ${STATUS_MARK.warn} ${t35("cli.doctor.terminal_apple")}`,
+          `  \xB7 ${t35("cli.doctor.terminal_alternatives")}`
         ];
       }
       return [
         head,
-        `  ${STATUS_MARK.warn} ${t34("cli.doctor.terminal_enter_only")}`,
-        `  \xB7 ${t34("cli.doctor.terminal_alternatives")}`,
-        `  \xB7 ${t34("cli.doctor.terminal_setup_hint")}`
+        `  ${STATUS_MARK.warn} ${t35("cli.doctor.terminal_enter_only")}`,
+        `  \xB7 ${t35("cli.doctor.terminal_alternatives")}`,
+        `  \xB7 ${t35("cli.doctor.terminal_setup_hint")}`
       ];
     case "other":
       return [
         head,
-        `  ${STATUS_MARK.warn} ${t34("cli.doctor.terminal_other", { hex: result.sample.hex })}`
+        `  ${STATUS_MARK.warn} ${t35("cli.doctor.terminal_other", { hex: result.sample.hex })}`
       ];
     case "interrupted":
-      return [head, `  \xB7 ${t34("cli.doctor.terminal_interrupted")}`];
+      return [head, `  \xB7 ${t35("cli.doctor.terminal_interrupted")}`];
   }
 }
 async function statusLineLines(config, cwd) {
@@ -4299,95 +4433,96 @@ async function statusLineLines(config, cwd) {
   if (!probe) return [];
   return [
     `
-${t34("cli.doctor.status_line_head")}`,
-    `  ${t34("cli.doctor.status_line_command", { command: probe.command })}`,
-    `  ${probe.ok ? t34("cli.doctor.status_line_ok", { detail: probe.detail }) : t34("cli.doctor.status_line_broken", { detail: probe.detail })}`
+${t35("cli.doctor.status_line_head")}`,
+    `  ${t35("cli.doctor.status_line_command", { command: probe.command })}`,
+    `  ${probe.ok ? t35("cli.doctor.status_line_ok", { detail: probe.detail }) : t35("cli.doctor.status_line_broken", { detail: probe.detail })}`
   ];
 }
 function registerStatusCommands(program2) {
-  program2.command("status").description(t34("cli.status.cmd_root")).action(async () => {
-    log9(
+  program2.command("status").description(t35("cli.status.cmd_root")).action(async () => {
+    log10(
       [
-        t34("cli.status.version", { version: VERSION }),
+        t35("cli.status.version", { version: VERSION }),
         `Node: ${process.version} (${process.platform}/${process.arch})`,
-        t34("cli.status.home", { path: EPOCH_HOME }),
+        t35("cli.status.home", { path: EPOCH_HOME }),
         `Profile: ${resolveProfile()}`,
-        t34("cli.status.credentials", {
-          state: hasCredentials() ? t34("cli.status.credentials_set") : t34("cli.status.credentials_unset")
+        t35("cli.status.credentials", {
+          state: hasCredentials() ? t35("cli.status.credentials_set") : t35("cli.status.credentials_unset")
         }),
-        t34("cli.status.secret_backend", { detail: await describeSecretBackend() }),
+        t35("cli.status.secret_backend", { detail: await describeSecretBackend() }),
         `config.yaml: ${describeConfig()}`,
-        `.env: ${existsSync7(ENV_PATH) ? t34("cli.status.env_present") : t34("cli.status.env_absent")}`
+        `.env: ${existsSync7(ENV_PATH) ? t35("cli.status.env_present") : t35("cli.status.env_absent")}`
       ].join("\n")
     );
   });
-  program2.command("doctor").description(t34("cli.doctor.cmd_root")).option("--reclaim", t34("cli.doctor.reclaim_opt")).action(async (opts) => {
-    log9(t34("cli.doctor.node", { version: process.version }));
+  program2.command("doctor").description(t35("cli.doctor.cmd_root")).option("--reclaim", t35("cli.doctor.reclaim_opt")).action(async (opts) => {
+    log10(t35("cli.doctor.node", { version: process.version }));
     const avail = await describeDisk();
-    if (avail) log9(t34("cli.doctor.disk", { avail }));
-    log9(`${hasCredentials() ? "\u2713" : "\u25CB"} ${t34("cli.doctor.credentials")}`);
-    const configIssues = existsSync7(CONFIG_PATH) ? (loadConfig3(), getConfigIssues()) : [];
+    if (avail) log10(t35("cli.doctor.disk", { avail }));
+    log10(`${hasCredentials() ? "\u2713" : "\u25CB"} ${t35("cli.doctor.credentials")}`);
+    const configIssues = existsSync7(CONFIG_PATH) ? (loadConfig4(), getConfigIssues()) : [];
     const configMark = !existsSync7(CONFIG_PATH) ? "\u25CB" : configIssues.length > 0 ? "\u26A0" : "\u2713";
-    log9(`${configMark} config: ${CONFIG_PATH}`);
+    log10(`${configMark} config: ${CONFIG_PATH}`);
     try {
       const { buildRuntime: buildRuntime4 } = await import("@epoch-agent/runtime");
       const rt = await buildRuntime4({ installSignalHandlers: true });
-      log9(`
-${t34("cli.doctor.workspace_head")}`);
-      for (const line of workspaceLines(rt)) log9(line);
-      for (const line of sandboxLines(rt.workspace.root, rt.config.sandbox)) log9(line);
-      for (const line of hookLines(rt)) log9(line);
-      for (const line of jobLines(allJobs().map((j) => j.info))) log9(line);
+      log10(`
+${t35("cli.doctor.workspace_head")}`);
+      for (const line of workspaceLines(rt)) log10(line);
+      for (const line of sandboxLines(rt.workspace.root, rt.config.sandbox)) log10(line);
+      for (const line of hookLines(rt)) log10(line);
+      for (const line of jobLines(allJobs().map((j) => j.info))) log10(line);
+      const { classifyTerminal, probeShiftEnter } = await import("@epoch-agent/tui");
       for (const line of terminalLines(
-        await probeShiftEnter({ prompt: t34("cli.doctor.terminal_prompt"), timeoutMs: 8e3 }),
+        await probeShiftEnter({ prompt: t35("cli.doctor.terminal_prompt"), timeoutMs: 8e3 }),
         classifyTerminal(process.env)
       ))
-        log9(line);
-      for (const line of await statusLineLines(rt.config, process.cwd())) log9(line);
+        log10(line);
+      for (const line of await statusLineLines(rt.config, process.cwd())) log10(line);
       if (rt.sessionStore) {
         try {
-          for (const line of ftsLines(rt.sessionStore.ftsHealth())) log9(line);
+          for (const line of ftsLines(rt.sessionStore.ftsHealth())) log10(line);
         } catch (err2) {
-          log9(`
-${t34("cli.doctor.fts_head")}`);
-          log9(
-            `  ${STATUS_MARK.warn} ${t34("cli.doctor.fts_probe_failed", {
+          log10(`
+${t35("cli.doctor.fts_head")}`);
+          log10(
+            `  ${STATUS_MARK.warn} ${t35("cli.doctor.fts_probe_failed", {
               detail: err2 instanceof Error ? err2.message : String(err2)
             })}`
           );
         }
         if (opts.reclaim) {
           try {
-            for (const line of reclaimLines(rt.sessionStore.reclaimFts())) log9(line);
+            for (const line of reclaimLines(rt.sessionStore.reclaimFts())) log10(line);
           } catch (err2) {
-            log9(`
-${t34("cli.doctor.reclaim_head")}`);
-            log9(
-              `  ${STATUS_MARK.failed} ${t34("cli.doctor.reclaim_failed", {
+            log10(`
+${t35("cli.doctor.reclaim_head")}`);
+            log10(
+              `  ${STATUS_MARK.failed} ${t35("cli.doctor.reclaim_failed", {
                 detail: err2 instanceof Error ? err2.message : String(err2)
               })}`
             );
           }
         }
       }
-      log9(`
-${t34("cli.doctor.modules_head")}`);
+      log10(`
+${t35("cli.doctor.modules_head")}`);
       const order = { failed: 0, warn: 1, skipped: 2, ok: 3 };
       const sorted = [...rt.diagnosticList].sort(
         (a, b) => (order[a.status] ?? 9) - (order[b.status] ?? 9)
       );
-      for (const d of sorted) log9(`  ${STATUS_MARK[d.status]} ${d.module}: ${d.detail}`);
+      for (const d of sorted) log10(`  ${STATUS_MARK[d.status]} ${d.module}: ${d.detail}`);
       await rt.dispose();
       if (hasFailure(rt.diagnosticList)) {
         const bad = rt.diagnosticList.filter((d) => d.status === "failed").length;
-        log9(`
-${t34("cli.doctor.modules_failed", { count: bad })}`);
+        log10(`
+${t35("cli.doctor.modules_failed", { count: bad })}`);
         process.exitCode = EXIT_CODES.FAILURE;
       }
     } catch (err2) {
-      log9(
+      log10(
         `
-${t34("cli.doctor.build_failed", {
+${t35("cli.doctor.build_failed", {
           message: err2 instanceof Error ? err2.message : String(err2)
         })}`
       );
@@ -4397,21 +4532,21 @@ ${t34("cli.doctor.build_failed", {
 // src/commands/trust.ts
 import { existsSync as existsSync8, realpathSync as realpathSync3 } from "fs";
 import { resolve as resolve3 } from "path";
-import { loadConfig as loadConfig4, TrustManager as TrustManager3 } from "@epoch-agent/core";
-import { t as t35, trustPath as trustPath3, uiDateLocale as uiDateLocale4 } from "@epoch-agent/infra";
-var log10 = (msg) => process.stdout.write(msg + "\n");
+import { loadConfig as loadConfig5, TrustManager as TrustManager3 } from "@epoch-agent/core";
+import { t as t36, trustPath as trustPath3, uiDateLocale as uiDateLocale4 } from "@epoch-agent/infra";
+var log11 = (msg) => process.stdout.write(msg + "\n");
 var warn3 = (msg) => process.stderr.write(msg + "\n");
 function scopeLabel(scope) {
-  return scope === "directory-tree" ? t35("trust.scope_tree") : t35("trust.scope_dir");
+  return scope === "directory-tree" ? t36("trust.scope_tree") : t36("trust.scope_dir");
 }
 function levelLabel(level) {
   switch (level) {
     case "trusted":
-      return t35("trust.level_trusted");
+      return t36("trust.level_trusted");
     case "untrusted":
-      return t35("trust.level_untrusted");
+      return t36("trust.level_untrusted");
     case "unknown":
-      return t35("trust.level_unknown");
+      return t36("trust.level_unknown");
   }
 }
 function physicalPath(input2) {
@@ -4424,63 +4559,63 @@ function physicalPath(input2) {
   }
 }
 function registerTrustCommand(program2) {
-  const cmd = program2.command("trust").description(t35("trust.cmd_root"));
-  cmd.command("list", { isDefault: true }).description(t35("trust.cmd_list")).action(() => withTrust((tm) => printList3(tm)));
-  cmd.command("add").description(t35("trust.cmd_add")).argument("[path]", t35("trust.arg_path_default")).option("--tree", t35("trust.opt_tree_add")).action((path, opts) => {
+  const cmd = program2.command("trust").description(t36("trust.cmd_root"));
+  cmd.command("list", { isDefault: true }).description(t36("trust.cmd_list")).action(() => withTrust((tm) => printList3(tm)));
+  cmd.command("add").description(t36("trust.cmd_add")).argument("[path]", t36("trust.arg_path_default")).option("--tree", t36("trust.opt_tree_add")).action((path, opts) => {
     withTrust((tm) => {
       const dir = physicalPath(path ?? process.cwd());
       tm.record(dir, "trusted", opts.tree ? "directory-tree" : "directory");
-      log10(
-        `\u2713 ${t35("trust.added", {
+      log11(
+        `\u2713 ${t36("trust.added", {
           dir,
           scope: scopeLabel(opts.tree ? "directory-tree" : "directory")
         })}`
       );
     });
   });
-  cmd.command("deny").description(t35("trust.cmd_deny")).argument("[path]", t35("trust.arg_path_default")).option("--tree", t35("trust.opt_tree_deny")).action((path, opts) => {
+  cmd.command("deny").description(t36("trust.cmd_deny")).argument("[path]", t36("trust.arg_path_default")).option("--tree", t36("trust.opt_tree_deny")).action((path, opts) => {
     withTrust((tm) => {
       const dir = physicalPath(path ?? process.cwd());
       tm.record(dir, "untrusted", opts.tree ? "directory-tree" : "directory");
-      log10(
-        `\u2717 ${t35("trust.denied", {
+      log11(
+        `\u2717 ${t36("trust.denied", {
           dir,
           scope: scopeLabel(opts.tree ? "directory-tree" : "directory")
         })}`
       );
     });
   });
-  cmd.command("remove").alias("rm").description(t35("trust.cmd_remove")).argument("<path>", t35("trust.arg_path")).action((path) => {
+  cmd.command("remove").alias("rm").description(t36("trust.cmd_remove")).argument("<path>", t36("trust.arg_path")).action((path) => {
     withTrust((tm) => {
       const dir = physicalPath(path);
       if (!tm.list().some((r) => resolve3(r.path) === dir)) {
-        warn3(t35("trust.no_record", { dir }));
+        warn3(t36("trust.no_record", { dir }));
         process.exit(1);
       }
       tm.revoke(dir);
-      log10(t35("trust.removed", { dir, level: levelLabel(tm.check(dir)) }));
+      log11(t36("trust.removed", { dir, level: levelLabel(tm.check(dir)) }));
     });
   });
 }
 function printList3(tm) {
-  if (loadConfig4().trust?.enabled === false) {
-    warn3(t35("trust.gate_off"));
+  if (loadConfig5().trust?.enabled === false) {
+    warn3(t36("trust.gate_off"));
   }
-  log10(t35("trust.list_head", { path: trustPath3(EPOCH_HOME) }));
+  log11(t36("trust.list_head", { path: trustPath3(EPOCH_HOME) }));
   const records = [...tm.list()].sort((a, b) => a.path.localeCompare(b.path));
   if (records.length === 0) {
-    log10(t35("trust.list_empty"));
+    log11(t36("trust.list_empty"));
   }
   for (const r of records) {
     const mark = r.level === "trusted" ? "\u2713" : "\u2717";
-    const when = r.decidedAt ? new Date(r.decidedAt).toLocaleString(uiDateLocale4()) : t35("trust.when_unknown");
-    log10(`  ${mark} ${r.path}  [${scopeLabel(r.scope)}]  ${when}`);
+    const when = r.decidedAt ? new Date(r.decidedAt).toLocaleString(uiDateLocale4()) : t36("trust.when_unknown");
+    log11(`  ${mark} ${r.path}  [${scopeLabel(r.scope)}]  ${when}`);
   }
   const cwd = process.cwd();
-  log10(
+  log11(
     `
-${t35("trust.cwd_line", { cwd })}
-${t35("trust.cwd_verdict", { level: levelLabel(tm.check(cwd)) })}`
+${t36("trust.cwd_line", { cwd })}
+${t36("trust.cwd_verdict", { level: levelLabel(tm.check(cwd)) })}`
   );
 }
 function withTrust(fn) {
@@ -4489,46 +4624,46 @@ function withTrust(fn) {
   try {
     fn(tm);
   } catch (err2) {
-    warn3(t35("trust.error", { message: err2 instanceof Error ? err2.message : String(err2) }));
+    warn3(t36("trust.error", { message: err2 instanceof Error ? err2.message : String(err2) }));
     process.exit(1);
   }
 }
 // src/commands/upgrade.ts
-import { t as t36 } from "@epoch-agent/infra";
-var log11 = (msg) => process.stdout.write(`${msg}
+import { t as t37 } from "@epoch-agent/infra";
+var log12 = (msg) => process.stdout.write(`${msg}
 `);
 function registerUpgradeCommand(program2) {
-  program2.command("upgrade").description(t36("upgrade.cmd_root")).action(async () => {
+  program2.command("upgrade").description(t37("upgrade.cmd_root")).action(async () => {
     const self = selfPackage();
     const info = getInstallationInfo(self.name);
-    log11(t36("upgrade.current", { version: self.version }));
-    log11(
-      t36("upgrade.installed_via", {
+    log12(t37("upgrade.current", { version: self.version }));
+    log12(
+      t37("upgrade.installed_via", {
         manager: info.packageManager,
-        global: info.isGlobal ? t36("installation.global_suffix") : "",
+        global: info.isGlobal ? t37("installation.global_suffix") : "",
         note: info.note
       })
     );
     const notice = isUpdateCheckDisabled() ? readUpdateNotice() : await refreshUpdateCache({ ttlMs: 0 }).catch(() => null);
     if (notice) {
-      log11(`
-${t36("upgrade.available", { current: notice.current, latest: notice.latest })}`);
-    } else log11(`
-${t36("upgrade.none")}`);
+      log12(`
+${t37("upgrade.available", { current: notice.current, latest: notice.latest })}`);
+    } else log12(`
+${t37("upgrade.none")}`);
     if (info.updateCommand) {
-      log11(`
-${t36("upgrade.how")}
+      log12(`
+${t37("upgrade.how")}
   ${info.updateCommand}`);
-      log11(`
-${t36("upgrade.why_manual")}`);
+      log12(`
+${t37("upgrade.why_manual")}`);
     }
   });
-  program2.command(UPDATE_CHECK_SUBCOMMAND, { hidden: true }).description(t36("upgrade.cmd_refresh")).action(async () => {
+  program2.command(UPDATE_CHECK_SUBCOMMAND, { hidden: true }).description(t37("upgrade.cmd_refresh")).action(async () => {
     await refreshUpdateCache().catch(() => null);
   });
 }
 // src/commands/web.ts
-import { t as t37 } from "@epoch-agent/infra";
+import { t as t38 } from "@epoch-agent/infra";
 import { buildRuntime as buildRuntime3 } from "@epoch-agent/runtime";
 import {
   createWebServer,
@@ -4575,7 +4710,7 @@ var err = (msg) => {
 `);
 };
 function registerWebCommand(program2) {
-  program2.command("web").description(t37("cli.web.summary")).option("-p, --port <port>", t37("cli.web.opt_port", { port: DEFAULT_WEB_PORT })).option("--host <host>", t37("cli.web.opt_host", { host: DEFAULT_WEB_HOST })).option("--token <token>", t37("cli.web.opt_token")).option("--no-open", t37("cli.web.opt_no_open")).option("--json", t37("cli.web.opt_json")).option("--plugins", t37("cli.web.opt_plugins")).action(async (opts, command) => {
+  program2.command("web").description(t38("cli.web.summary")).option("-p, --port <port>", t38("cli.web.opt_port", { port: DEFAULT_WEB_PORT })).option("--host <host>", t38("cli.web.opt_host", { host: DEFAULT_WEB_HOST })).option("--token <token>", t38("cli.web.opt_token")).option("--no-open", t38("cli.web.opt_no_open")).option("--json", t38("cli.web.opt_json")).option("--plugins", t38("cli.web.opt_plugins")).action(async (opts, command) => {
     await runWeb({ ...opts, json: jsonRequested(opts.json, command.parent?.opts()["json"]) });
   });
 }
@@ -4584,7 +4719,7 @@ function jsonRequested(own, fromProgram) {
 }
 async function runWeb(opts) {
   const port = parsePort2(opts.port);
-  if (port === null) return fail(t37("cli.web.err_port", { value: String(opts.port) }));
+  if (port === null) return fail(t38("cli.web.err_port", { value: String(opts.port) }));
   const binding = decideBinding({
     ...opts.host === void 0 ? {} : { host: opts.host },
     ...port === void 0 ? {} : { port },
@@ -4611,8 +4746,8 @@ async function runWeb(opts) {
   if (opts.open && !openInBrowser(server.url)) say(browserFailed());
   installShutdown(server, say);
 }
-var missingWebRoot = () => t37("cli.web.missing_root");
-var browserFailed = () => `  ${t37("cli.web.browser_failed")}`;
+var missingWebRoot = () => t38("cli.web.missing_root");
+var browserFailed = () => `  ${t38("cli.web.browser_failed")}`;
 function pluginsOption(plugins) {
   return plugins ? { hostMarketplaces: { sources: [] } } : {};
 }
@@ -4624,7 +4759,7 @@ async function boot(binding, plugins) {
   });
   if (!runtime.session) {
     await runtime.dispose();
-    fail(`${t37("cli.web.no_provider")}
+    fail(`${t38("cli.web.no_provider")}
 ${runtime.diagnostics.join("\n")}`);
     return null;
   }
@@ -4646,11 +4781,11 @@ function announceLines(input2) {
   const human = [];
   if (!input2.json) {
     human.push(`  Epoch Web  http://${input2.host}:${input2.port}`);
-    human.push(`  ${t37("cli.web.open_this")}
+    human.push(`  ${t38("cli.web.open_this")}
   ${input2.url}`);
   }
   if (input2.lanExposed) {
-    human.push(`  ${t37("cli.web.lan_exposed")}`);
+    human.push(`  ${t38("cli.web.lan_exposed")}`);
   }
   if (input2.placeholder) human.push(`  \u26A0 ${missingWebRoot()}`);
   if (!input2.json) return { human };
@@ -4668,7 +4803,7 @@ function installShutdown(server, say) {
     if (shuttingDown) process.exit(1);
     shuttingDown = true;
     say(`
-  ${t37("cli.web.shutting_down")}`);
+  ${t38("cli.web.shutting_down")}`);
     server.close().then(
       () => process.exit(0),
       () => process.exit(1)
@@ -4687,18 +4822,18 @@ function fail(message) {
   process.exit(1);
 }
 // src/language.ts
-import { loadConfig as loadConfig5 } from "@epoch-agent/core";
+import { loadConfig as loadConfig6 } from "@epoch-agent/core";
 import { resolveLang, setLang } from "@epoch-agent/infra";
 function applyConfiguredLanguage() {
   try {
-    setLang(resolveLang(loadConfig5().display?.language));
+    setLang(resolveLang(loadConfig6().display?.language));
   } catch {
   }
 }
 // src/index.ts
 applyConfiguredLanguage();
 var program = new Command();
-program.name("epoch").description(t38("cli.program_description"));
+program.name("epoch").description(t39("cli.program_description"));
 registerConfigCommand(program);
 registerMcpCommand(program);
 registerModelCommand(program);
@@ -4707,6 +4842,7 @@ registerSessionsCommand(program);
 registerAgentsCommand(program);
 registerPluginCommand(program);
 registerTrustCommand(program);
+registerComplianceCommand(program);
 registerScheduleCommand(program);
 registerUpgradeCommand(program);
 registerWebCommand(program);