@heretek-ai/epistemic-swarm 1.1.0 → 1.1.2

package/dist/tui.js

@@ -517,25 +517,15 @@ var EsRpc = define({
       input: obj({}),
       output: obj({ summary: str, stage: str, pending: strArray }, ["summary", "stage", "pending"])
     },
+    configState: {
+      input: obj({}),
+      output: obj({ config: str, sources: strArray, warnings: strArray }, ["config", "sources", "warnings"])
+    },
     previewApproval: {
       input: obj({ stage: { type: "string", enum: ["frontier", "spec"] } }, ["stage"]),
       output: Preview
     },
-    approve: {
-      input: obj({ stage: { type: "string", enum: ["frontier", "spec"] }, user: str, token: str }, [
-        "stage",
-        "user",
-        "token"
-      ]),
-      output: obj({ message: str }, ["message"]),
-      errors: { refused: obj({ reason: str }, ["reason"]) }
-    },
     previewTrust: { input: obj({}), output: Preview },
-    trust: {
-      input: obj({ user: str, token: str }, ["user", "token"]),
-      output: obj({ message: str }, ["message"]),
-      errors: { refused: obj({ reason: str }, ["reason"]) }
-    },
     previewResume: { input: obj({}), output: Preview },
     previewLspInstall: { input: obj({ id: str }, ["id"]), output: Preview },
     lspInstall: {
@@ -543,17 +533,6 @@ var EsRpc = define({
       output: obj({ message: str }, ["message"]),
       errors: { refused: obj({ reason: str }, ["reason"]) }
     },
-    resume: {
-      input: obj({
-        user: str,
-        token: str,
-        acceptControlDrift: { type: "boolean" },
-        raiseCeilingUSD: { type: "number" },
-        extendRuntime: { type: "boolean" }
-      }, ["user", "token"]),
-      output: obj({ message: str }, ["message"]),
-      errors: { refused: obj({ reason: str }, ["reason"]) }
-    },
     factoryState: {
       input: obj({}),
       output: obj({
@@ -632,6 +611,12 @@ var tui_default = Plugin.define({
       message,
       variant
     });
+    call("configState").then((view) => {
+      for (const warning of view.warnings)
+        toast(warning, "error");
+    }).catch(() => {
+      return;
+    });
     const confirm = async (preview, label) => {
       if (!preview.ok || !preview.token) {
         await context.ui.dialog.alert({
@@ -673,55 +658,59 @@ var tui_default = Plugin.define({
       }));
       if (stage !== "frontier" && stage !== "spec")
         return;
-      const token = await confirm(await call("previewApproval", {
+      const preview = await call("previewApproval", {
         stage
-      }), "Approve");
+      });
+      const token = await confirm(preview, "Approve");
       if (!token)
         return;
-      toast((await call("approve", {
-        stage,
-        user,
-        token
-      })).message, "success");
+      await context.ui.dialog.alert({
+        title: preview.title,
+        message: `${preview.lines.join(`
+`)}
+
+Run \`es approve ${stage}\` at a terminal with your passphrase (1.1.1: approvals need the sealed human key).`
+      });
     });
     const trust = guarded(async () => {
-      const token = await confirm(await call("previewTrust"), "Trust");
+      const preview = await call("previewTrust");
+      const token = await confirm(preview, "Trust");
       if (!token)
         return;
-      toast((await call("trust", {
-        user,
-        token
-      })).message, "success");
+      await context.ui.dialog.alert({
+        title: preview.title,
+        message: `${preview.lines.join(`
+`)}
+
+Run \`es trust\` at a terminal with your passphrase to sign these.`
+      });
     });
     const resume = guarded(async () => {
       const preview = await call("previewResume");
       const token = await confirm(preview, "Resume");
       if (!token)
         return;
+      const lines = preview.lines.join(`
+`);
       const drift = preview.lines.some((line) => line.startsWith("Control-file drift"));
-      let raiseCeilingUSD;
+      let raise = "";
       if (/spend ceiling/i.test(preview.lines[0] ?? "")) {
         const raised = await context.ui.dialog.prompt({
           title: "New spend ceiling (USD)",
           placeholder: "e.g. 50"
         });
-        raiseCeilingUSD = raised ? Number(raised) : undefined;
+        if (raised)
+          raise = ` --raise-ceiling ${raised}`;
       }
-      const extendRuntime = /runtime cap/i.test(preview.lines[0] ?? "");
-      const result = await call("resume", {
-        user,
-        token,
-        ...drift ? {
-          acceptControlDrift: true
-        } : {},
-        ...raiseCeilingUSD ? {
-          raiseCeilingUSD
-        } : {},
-        ...extendRuntime ? {
-          extendRuntime: true
-        } : {}
+      const extend = /runtime cap/i.test(lines) ? " --extend-runtime" : "";
+      const flags = `${drift ? " --accept-drift" : ""}${raise}${extend}`;
+      await context.ui.dialog.alert({
+        title: preview.title,
+        message: `${preview.lines.join(`
+`)}
+
+Run \`es factory resume${flags}\` at a terminal with your passphrase.`
       });
-      toast(result.message, "success");
     });
     const lspInstall = guarded(async (input) => {
       const id = input?.trim() || await context.ui.dialog.prompt({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heretek-ai/epistemic-swarm",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Epistemic Swarm: an AI build factory for OpenCode v2 — grill, research, spec, build, QA and release, gated mechanically.",
   "type": "module",
   "license": "Apache-2.0",
@@ -41,7 +41,7 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@heretek-ai/es-core": "1.1.0",
+    "@heretek-ai/es-core": "1.1.2",
     "@opencode/plugin": "2.0.24"
   },
   "devDependencies": {

package/src/agents.ts

@@ -23,6 +23,9 @@ export function permissionRules(spec: AgentSpec, mcpServers: readonly string[]):
     ...spec.spawns.map((agent) => ({ action: "subagent", resource: agent, effect: "allow" as const })),
     { action: "skill", resource: "*", effect: "deny" },
     ...spec.skills.map((skill) => ({ action: "skill", resource: skill, effect: "allow" as const })),
+    // Code Mode (`execute`) reaches host tools no seat needs, including MCP
+    // resources outside the seat's MCP scope.
+    { action: "execute", resource: "*", effect: "deny" },
   ]
   for (const server of mcpServers)
     if (!spec.mcp.includes(server))

package/src/policy.ts

@@ -1,7 +1,8 @@
 // Mechanical enforcement in the host: every write, edit, patch and shell call
 // from any agent passes through core's policy (canonical paths, control files,
-// seat scopes); factory seats additionally stop on STOP or a halted run, run
-// read-only shells under bubblewrap, and get fast gate feedback after edits.
+// seat scopes), and every shell command runs inside the bubblewrap sandbox its
+// decision names (trust/sandbox.ts). Factory seats additionally stop on STOP
+// or a halted run and get fast gate feedback after edits.
 import path from "node:path"
 import {
   agentSpec,
@@ -13,11 +14,10 @@ import {
   formatDiagnostics,
   formatReport,
   loadGatesConfig,
-  readonlyWrap,
   runGates,
+  sandboxArgv,
   seatOf,
   shellQuote,
-  treeFingerprint,
 } from "@heretek-ai/es-core"
 import { Error as ToolError } from "@opencode/plugin/promise/tool"
 import { HOST_WEB_TOOLS } from "./agents.ts"
@@ -50,8 +50,6 @@ const appendContent = (content: unknown, text: string) =>
       : text
 
 export function createPolicyHooks(runtime: Runtime) {
-  const fingerprints = new Map<string, { dir: string; print: string }>()
-
   const before = async (event: { tool: string; agent: string; id: string; input: unknown }) => {
     const seat = seatOf(event.agent)
     const input = (event.input ?? {}) as Record<string, any>
@@ -88,14 +86,37 @@ export function createPolicyHooks(runtime: Runtime) {
     if (event.tool === "shell" && typeof input.command === "string") {
       const decision = evaluateShell(context, event.agent, input.command, { sandboxAvailable: bwrapAvailable() })
       if (decision.effect === "deny") deny(decision.reason)
-      const cwd =
-        typeof input.workdir === "string"
-          ? path.resolve(runtime.root, input.workdir)
-          : (context.worktree ?? runtime.root)
-      if (decision.effect === "allow" && decision.mode === "readonly-sandbox") {
-        event.input = { ...input, command: readonlyWrap(["sh", "-c", input.command], cwd).map(shellQuote).join(" ") }
-      } else if (decision.effect === "allow" && decision.mode === "readonly-checked") {
-        fingerprints.set(event.id, { dir: cwd, print: await treeFingerprint(cwd) })
+    }
+  }
+
+  /**
+   * The last execute.before hook: re-evaluates the final shell command (a
+   * PreToolUse hook may have rewritten it) and wraps it in its sandbox, so no
+   * later rewrite can run unsandboxed and hook matchers see the plain command.
+   */
+  const sandbox = async (event: { tool: string; agent: string; id: string; input: unknown }) => {
+    const input = (event.input ?? {}) as Record<string, any>
+    if (event.tool === "shell" && typeof input.command === "string") {
+      const context = await runtime.policy()
+      const decision = evaluateShell(context, event.agent, input.command, { sandboxAvailable: bwrapAvailable() })
+      if (decision.effect === "deny") deny(decision.reason)
+      if (decision.effect === "allow" && decision.mode === "sandbox") {
+        const cwd =
+          typeof input.workdir === "string"
+            ? path.resolve(runtime.root, input.workdir)
+            : (context.worktree ?? runtime.root)
+        const argv = sandboxArgv(
+          {
+            kind: decision.kind,
+            root: runtime.root,
+            cwd,
+            stateDir: runtime.stateDir,
+            offline: decision.offline,
+            ...(decision.kind === "programmer" && context.worktree ? { writable: context.worktree } : {}),
+          },
+          ["sh", "-c", input.command],
+        )
+        event.input = { ...input, command: argv.map(shellQuote).join(" ") }
       }
     }
   }
@@ -109,23 +130,6 @@ export function createPolicyHooks(runtime: Runtime) {
     result?: any
   }) => {
     const seat = seatOf(event.agent)
-    const checked = fingerprints.get(event.id)
-    if (checked) {
-      fingerprints.delete(event.id)
-      if ((await treeFingerprint(checked.dir)) !== checked.print) {
-        await runtime.factory
-          .halt(`agent:${event.agent}`, `read-only seat ${event.agent} changed files via the shell`)
-          .catch(() => undefined)
-        if (event.status === "completed")
-          event.result = {
-            ...event.result,
-            content: appendContent(
-              event.result?.content,
-              "VIOLATION: this read-only seat modified the checkout. The factory has been halted.",
-            ),
-          }
-      }
-    }
     if (event.status !== "completed") return
     const input = (event.input ?? {}) as Record<string, any>
     const files =
@@ -165,6 +169,7 @@ export function createPolicyHooks(runtime: Runtime) {
         commands: config.commands.filter((check) => check.kind === "format" || check.kind === "lint"),
       },
       stateDir: runtime.stateDir,
+      sandbox: "required",
     })
     if (report.findings.length || !report.passed)
       event.result = {
@@ -225,5 +230,5 @@ export function createPolicyHooks(runtime: Runtime) {
     for (const key of Object.keys(event.env)) if (/^OPENCODE_(SERVER_)?PASSWORD$/.test(key)) delete event.env[key]
   }
 
-  return { before, after, evaluate, shellEnv }
+  return { before, sandbox, after, evaluate, shellEnv }
 }

package/src/research.ts

@@ -1,65 +1,127 @@
 // Research integration: the configured search provider becomes the host's
-// websearch (results cached content-addressed, so they can be cited), and the
-// host's own webfetch results are cached too.
-import { researchCache, selectProvider } from "@heretek-ai/es-core"
+// websearch, and host web results are cached content-addressed so they can be
+// cited. Caching is for Epistemic Swarm seats in a project that already has a
+// .factory/ directory: the user's own agents get plain results, and no
+// project gains a .factory/ because someone searched the web.
+import { stat } from "node:fs/promises"
+import { factoryLayout, researchCache, seatOf, selectProvider } from "@heretek-ai/es-core"
 import type { Runtime } from "./runtime.ts"
 
+interface SearchHit {
+  readonly url: string
+  readonly title?: string
+  readonly text: string
+}
+
+/** Results the provider returned, waiting for the tool hook (which knows the agent) to cache them. */
+export class PendingSearches {
+  private readonly entries: Array<{ query: string; provider: string; hits: readonly SearchHit[]; at: number }> = []
+  private static readonly TTL_MS = 5 * 60_000
+
+  add(query: string, provider: string, hits: readonly SearchHit[]) {
+    this.prune()
+    this.entries.push({ query, provider, hits, at: Date.now() })
+  }
+
+  /** The oldest unclaimed results for this query (each search is claimed once). */
+  take(query: string) {
+    this.prune()
+    const index = this.entries.findIndex((entry) => entry.query === query)
+    return index < 0 ? undefined : this.entries.splice(index, 1)[0]
+  }
+
+  private prune() {
+    const cutoff = Date.now() - PendingSearches.TTL_MS
+    while (this.entries.length && this.entries[0]!.at < cutoff) this.entries.shift()
+  }
+}
+
+/** Host web results are cached only for an ES seat, in a project that already has .factory/. */
+async function cacheable(runtime: Runtime, agent: string | undefined): Promise<boolean> {
+  if (!seatOf(agent)) return false
+  return stat(factoryLayout(runtime.root).dir).then(
+    (info) => info.isDirectory(),
+    () => false,
+  )
+}
+
 export function registerWebsearch(
   editor: { add(definition: any): void; default: { get(): unknown; set(id: string): void } },
   runtime: Runtime,
+  pending: PendingSearches,
 ) {
   const searxng = runtime.config.research?.searxngUrl
   const env = searxng ? { ...process.env, SEARXNG_URL: searxng } : process.env
   const provider = selectProvider(runtime.options.searchProvider, env)
   if (!provider) return
-  const cache = researchCache(runtime.root)
   editor.add({
     id: "epistemic-swarm",
-    name: `Epistemic Swarm (${provider.id}, cached)`,
+    name: `Epistemic Swarm (${provider.id})`,
     execute: async (input: { query: string; limit?: number }, context: { signal: AbortSignal }) => {
       const results = await provider.search(input.query, { limit: input.limit ?? 8, signal: context.signal, env })
-      const out = []
-      for (const result of results) {
-        const cached = await cache.put({
-          url: result.url,
-          title: result.title,
-          text: result.content ?? result.snippet,
-          provider: provider.id,
-          query: input.query,
-        })
-        out.push({
-          url: result.url,
-          title: result.title,
-          content: `[cached sha256:${cached.meta.sha256}]\n${result.content ?? result.snippet}`,
-          time: {},
-        })
-      }
-      return out
+      const hits = results.map((result) => ({
+        url: result.url,
+        title: result.title,
+        text: result.content ?? result.snippet,
+      }))
+      pending.add(input.query, provider.id, hits)
+      return hits.map((hit) => ({ url: hit.url, title: hit.title, content: hit.text, time: {} }))
     },
   })
   // Additive: become the default only when nothing else is selected.
   if (editor.default.get() === undefined) editor.default.set("epistemic-swarm")
 }
 
-/** Cache host webfetch results so they can be cited as [VERIFIED: sha256:… "quote"]. */
-export function createWebfetchCache(runtime: Runtime) {
-  const cache = researchCache(runtime.root)
-  return async (event: { tool: string; status: string; input: unknown; result?: any }) => {
+const contentText = (content: unknown): string =>
+  typeof content === "string"
+    ? content
+    : Array.isArray(content)
+      ? content.map((part: any) => part?.text ?? "").join("\n")
+      : ""
+
+const prepend = (result: any, note: string) => {
+  const content = result?.content
+  return {
+    ...result,
+    content: typeof content === "string" ? `${note}\n${content}` : [{ type: "text", text: note }, ...(content ?? [])],
+  }
+}
+
+/**
+ * Cache a seat's host webfetch and websearch results so they can be cited as
+ * [VERIFIED: sha256:… "quote"]. Other agents' results pass through untouched.
+ */
+export function createWebCache(runtime: Runtime, pending: PendingSearches) {
+  const cache = researchCache(runtime.root, runtime.stateDir)
+  return async (event: { tool: string; status: string; agent?: string; input: unknown; result?: any }) => {
+    if (event.tool === "websearch") {
+      const query = (event.input as { query?: string } | undefined)?.query
+      const search = typeof query === "string" ? pending.take(query) : undefined
+      if (!search || event.status !== "completed" || !(await cacheable(runtime, event.agent))) return
+      const lines: string[] = []
+      for (const hit of search.hits) {
+        if (!hit.text?.trim()) continue
+        const cached = await cache.put({
+          url: hit.url,
+          title: hit.title,
+          text: hit.text,
+          provider: search.provider,
+          query: search.query,
+        })
+        lines.push(`[cached sha256:${cached.meta.sha256}] ${hit.url}`)
+      }
+      if (lines.length)
+        event.result = prepend(event.result, `${lines.join("\n")}\n(cite with [VERIFIED: sha256:<hash> "exact words"])`)
+      return
+    }
     if (event.tool !== "webfetch" || event.status !== "completed") return
     const url = (event.input as { url?: string } | undefined)?.url
-    const content = event.result?.content
-    const text =
-      typeof content === "string"
-        ? content
-        : Array.isArray(content)
-          ? content.map((part: any) => part?.text ?? "").join("\n")
-          : ""
-    if (!url || text.trim().length < 40) return
+    const text = contentText(event.result?.content)
+    if (!url || text.trim().length < 40 || !(await cacheable(runtime, event.agent))) return
     const cached = await cache.put({ url, text, provider: "webfetch" })
-    const note = `[cached as sha256:${cached.meta.sha256}; cite with [VERIFIED: sha256:${cached.meta.sha256} "exact words"]]`
-    event.result = {
-      ...event.result,
-      content: typeof content === "string" ? `${note}\n${content}` : [{ type: "text", text: note }, ...(content ?? [])],
-    }
+    event.result = prepend(
+      event.result,
+      `[cached as sha256:${cached.meta.sha256}; cite with [VERIFIED: sha256:${cached.meta.sha256} "exact words"]]`,
+    )
   }
 }

package/src/rpc-def.ts

@@ -1,6 +1,7 @@
-// RPC contract between the server plugin and the TUI. These methods are the
-// TUI half of the human-only channel: no agent tool reaches them, and the TUI
-// only calls them after a human confirms a dialog showing what is approved.
+// RPC contract between the server plugin and the TUI. Previews are shown in
+// the TUI; human-only mutations (approve, trust, resume) happen at a terminal
+// with the passphrase (`es approve`, `es trust`, `es factory resume`), never
+// through an agent tool or RPC. Only lspInstall still mutates via RPC.
 import { Rpc } from "@opencode/plugin/rpc"
 
 const obj = (properties: Record<string, unknown>, required: string[] = []) => ({
@@ -26,25 +27,16 @@ export const EsRpc = Rpc.define({
       input: obj({}),
       output: obj({ summary: str, stage: str, pending: strArray }, ["summary", "stage", "pending"]),
     },
+    /** The effective config (JSON), the files it came from, and load warnings to show once. */
+    configState: {
+      input: obj({}),
+      output: obj({ config: str, sources: strArray, warnings: strArray }, ["config", "sources", "warnings"]),
+    },
     previewApproval: {
       input: obj({ stage: { type: "string", enum: ["frontier", "spec"] } }, ["stage"]),
       output: Preview,
     },
-    approve: {
-      input: obj({ stage: { type: "string", enum: ["frontier", "spec"] }, user: str, token: str }, [
-        "stage",
-        "user",
-        "token",
-      ]),
-      output: obj({ message: str }, ["message"]),
-      errors: { refused: obj({ reason: str }, ["reason"]) },
-    },
     previewTrust: { input: obj({}), output: Preview },
-    trust: {
-      input: obj({ user: str, token: str }, ["user", "token"]),
-      output: obj({ message: str }, ["message"]),
-      errors: { refused: obj({ reason: str }, ["reason"]) },
-    },
     previewResume: { input: obj({}), output: Preview },
     previewLspInstall: { input: obj({ id: str }, ["id"]), output: Preview },
     lspInstall: {
@@ -52,20 +44,6 @@ export const EsRpc = Rpc.define({
       output: obj({ message: str }, ["message"]),
       errors: { refused: obj({ reason: str }, ["reason"]) },
     },
-    resume: {
-      input: obj(
-        {
-          user: str,
-          token: str,
-          acceptControlDrift: { type: "boolean" },
-          raiseCeilingUSD: { type: "number" },
-          extendRuntime: { type: "boolean" },
-        },
-        ["user", "token"],
-      ),
-      output: obj({ message: str }, ["message"]),
-      errors: { refused: obj({ reason: str }, ["reason"]) },
-    },
     factoryState: {
       input: obj({}),
       output: obj(

package/src/rpc.ts

@@ -1,7 +1,7 @@
-// Server side of the human-only channel. Each mutating method needs a token
-// from a preview made in the last two minutes over the same subject, so the
-// human confirms exactly what the dialog showed (no swap between preview and
-// confirm).
+// Server side of the TUI previews. Human-only mutations (approve, trust,
+// resume) happen at a terminal with the passphrase-sealed key, never via RPC:
+// the TUI previews, then points at `es approve`, `es trust`, `es factory
+// resume`. Only lspInstall still mutates via a preview token.
 import { randomBytes } from "node:crypto"
 import {
   type ApprovalStage,
@@ -10,7 +10,6 @@ import {
   capabilityLoss,
   commandSetHash,
   describeTarget,
-  factoryLayout,
   factorySummary,
   type HookEngine,
   hashJson,
@@ -22,12 +21,9 @@ import {
   readPlan,
   readResult,
   readScores,
-  recordApproval,
   recordConsent,
   treeCounts,
-  trustProject,
   verifyControl,
-  writeJson,
 } from "@heretek-ai/es-core"
 import type { Runtime } from "./runtime.ts"
 import { pendingApprovals } from "./tools.ts"
@@ -40,7 +36,7 @@ interface Ticket {
 
 const TTL_MS = 120_000
 
-export function createRpcHandlers(runtime: Runtime, notify: () => Promise<void>, hooks?: HookEngine) {
+export function createRpcHandlers(runtime: Runtime, _notify: () => Promise<void>, hooks?: HookEngine) {
   const tickets = new Map<string, Ticket>()
   const issue = (kind: string, subject: unknown) => {
     const token = randomBytes(12).toString("hex")
@@ -84,6 +80,11 @@ export function createRpcHandlers(runtime: Runtime, notify: () => Promise<void>,
         pending: (await pendingApprovals(runtime.root)).map((item) => item.stage),
       }
     },
+    configState: async () => ({
+      config: JSON.stringify(runtime.config),
+      sources: [...runtime.configSources],
+      warnings: [...runtime.warnings],
+    }),
     factoryState: async () => {
       const state = await runtime.factory.read()
       const frontier = await readFrontier(runtime.root).catch(() => undefined)
@@ -204,31 +205,6 @@ export function createRpcHandlers(runtime: Runtime, notify: () => Promise<void>,
         }
       }
     },
-    approve: async (input: unknown, context: any) => {
-      const { stage, user, token } = input as { stage: ApprovalStage; user: string; token: string }
-      try {
-        redeem(token, `approve:${stage}`, (await approvalSubject(runtime.root, stage)).subject)
-        const record = await recordApproval(runtime.root, {
-          stage,
-          channel: "tui",
-          approvedBy: user,
-          stateDir: runtime.stateDir,
-        })
-        await writeJson(
-          factoryLayout(runtime.root).pending,
-          (await pendingApprovals(runtime.root)).filter((item) => item.stage !== stage),
-        )
-        if (stage === "frontier") {
-          const state = await runtime.factory.read()
-          if (!state) await runtime.factory.begin(`human:${user}`)
-          if ((await runtime.factory.read())?.stage === "GRILL") await runtime.factory.beginResearch(`human:${user}`)
-        }
-        await notify()
-        return { message: `Approved ${stage} as ${record.approvedBy}.` }
-      } catch (error) {
-        return refused(context, error)
-      }
-    },
     previewTrust: async () => {
       const subject = await trustSubject()
       const trusted =
@@ -242,27 +218,6 @@ export function createRpcHandlers(runtime: Runtime, notify: () => Promise<void>,
         token: issue("trust", subject.key),
       }
     },
-    trust: async (input: unknown, context: any) => {
-      const { user, token } = input as { user: string; token: string }
-      try {
-        const subject = await trustSubject()
-        redeem(token, "trust", subject.key)
-        await trustProject(runtime.root, subject.gates.hash, subject.gates.lines, {
-          approvedBy: user,
-          stateDir: runtime.stateDir,
-        })
-        if (subject.hooks.hash)
-          await trustProject(runtime.root, subject.hooks.hash, subject.hooks.lines, {
-            approvedBy: user,
-            stateDir: runtime.stateDir,
-            kind: "hooks",
-          })
-        await hooks?.refresh()
-        return { message: `Trusted ${subject.lines.length} command/hook line(s).` }
-      } catch (error) {
-        return refused(context, error)
-      }
-    },
     previewLspInstall: async (input: unknown) => {
       const { id } = input as { id: string }
       const server = (await runtime.lsp.settings()).servers.find((item) => item.id === id)
@@ -321,26 +276,5 @@ export function createRpcHandlers(runtime: Runtime, notify: () => Promise<void>,
         token: issue("resume", state.halt),
       }
     },
-    resume: async (input: unknown, context: any) => {
-      const { user, token, acceptControlDrift, raiseCeilingUSD, extendRuntime } = input as {
-        user: string
-        token: string
-        acceptControlDrift?: boolean
-        raiseCeilingUSD?: number
-        extendRuntime?: boolean
-      }
-      try {
-        redeem(token, "resume", (await runtime.factory.read())?.halt)
-        const state = await runtime.factory.resume(user, {
-          ...(acceptControlDrift ? { acceptControlDrift } : {}),
-          ...(raiseCeilingUSD ? { raiseCeilingUSD } : {}),
-          ...(extendRuntime ? { extendRuntime } : {}),
-        })
-        await notify()
-        return { message: `Resumed at ${state.stage}.` }
-      } catch (error) {
-        return refused(context, error)
-      }
-    },
   }
 }

package/src/runtime.ts

@@ -1,9 +1,12 @@
 // Per-location runtime shared by the plugin's hooks, tools, commands and RPC.
 // Options are layered: the canonical config (global file → project file) with
-// plugin options as the most specific override.
+// plugin options as the most specific override. Plugin options are config
+// keys validated by the same strict schema; unknown keys are ignored with a
+// warning the TUI shows once.
 import {
   stateDir as defaultStateDir,
   type EsConfig,
+  EsConfigSchema,
   Factory,
   gateRunner,
   LspManager,
@@ -12,22 +15,14 @@ import {
 } from "@heretek-ai/es-core"
 import { ghPrOpener } from "./pr.ts"
 
-/** Raw plugin options from opencode.json; every field is optional. */
-export interface RawPluginOptions {
+/** Plugin options from opencode.json, split into config keys and the rest. */
+export interface ParsedOptions {
   /** Override the user-global state dir (signing key, trust store). Tests only. */
   readonly stateDir?: string
-  /** Model per tier, "provider/model". */
-  readonly models?: {
-    readonly fast?: string
-    readonly balanced?: string
-    readonly deep?: string
-    readonly agents?: Readonly<Record<string, string>>
-  }
-  readonly afterEdit?: "fast" | "off"
-  readonly estimate?: { readonly inputPerM?: number; readonly outputPerM?: number }
-  readonly pr?: "gh" | "off"
-  readonly lspAfterEdit?: boolean
-  readonly searchProvider?: "brave" | "firecrawl" | "searxng"
+  /** Config keys (docs/CONFIG.md), layered over the config files and validated with them. */
+  readonly overrides: Readonly<Record<string, unknown>>
+  /** Keys that are not config keys, sorted; ignored with a warning. */
+  readonly unknown: readonly string[]
 }
 
 /** Resolved options: config defaults applied; consumers read this shape. */
@@ -47,16 +42,18 @@ export interface Runtime {
   readonly config: EsConfig
   /** Config files that contributed values, in layer order. */
   readonly configSources: readonly string[]
+  /** Human-facing load warnings (e.g. ignored plugin options), shown once by the TUI. */
+  readonly warnings: readonly string[]
   readonly stateDir: string
   readonly factory: Factory
   readonly lsp: LspManager
   policy(): Promise<PolicyContext>
 }
 
-export async function createRuntime(root: string, raw: RawPluginOptions): Promise<Runtime> {
+export async function createRuntime(root: string, parsed: ParsedOptions): Promise<Runtime> {
   // stateDir is runtime-only; everything else can come from config files.
-  const { stateDir: rawStateDir, ...overrides } = raw
-  const loaded = await loadEsConfig(root, { overrides })
+  const rawStateDir = parsed.stateDir
+  const loaded = await loadEsConfig(root, { overrides: { ...parsed.overrides } })
   const config = loaded.config
   const options: PluginOptions = {
     ...(rawStateDir ? { stateDir: rawStateDir } : {}),
@@ -75,12 +72,14 @@ export async function createRuntime(root: string, raw: RawPluginOptions): Promis
     stateDir,
     researchDepth: config.research.depth,
     ...(config.domainPack ? { domainPack: config.domainPack } : {}),
+    ...(config.audit.phase === "required" ? { auditPhase: "required" as const } : {}),
   })
   return {
     root,
     options,
     config,
     configSources: loaded.sources,
+    warnings: parsed.unknown.length ? [unknownOptionsWarning(parsed.unknown)] : [],
     stateDir,
     factory,
     lsp,
@@ -91,24 +90,30 @@ export async function createRuntime(root: string, raw: RawPluginOptions): Promis
   }
 }
 
-/** Keep only the keys the user actually set, so config files are not clobbered. */
-export function parseOptions(raw: Record<string, unknown> | undefined): RawPluginOptions {
-  const options = raw ?? {}
-  const models =
-    typeof options.models === "object" && options.models ? (options.models as RawPluginOptions["models"]) : undefined
-  const estimate =
-    typeof options.estimate === "object" && options.estimate
-      ? (options.estimate as RawPluginOptions["estimate"])
-      : undefined
-  return {
-    ...(typeof options.stateDir === "string" ? { stateDir: options.stateDir } : {}),
-    ...(models ? { models } : {}),
-    ...(options.afterEdit === "fast" || options.afterEdit === "off" ? { afterEdit: options.afterEdit } : {}),
-    ...(estimate ? { estimate } : {}),
-    ...(options.pr === "gh" || options.pr === "off" ? { pr: options.pr } : {}),
-    ...(typeof options.lspAfterEdit === "boolean" ? { lspAfterEdit: options.lspAfterEdit } : {}),
-    ...(typeof options.searchProvider === "string"
-      ? { searchProvider: options.searchProvider as RawPluginOptions["searchProvider"] }
-      : {}),
+const CONFIG_KEYS: ReadonlySet<string> = new Set(Object.keys(EsConfigSchema.shape))
+
+/**
+ * Split raw plugin options into config keys and the rest. Only keys the user
+ * set are passed on, so config files are not clobbered; their values are
+ * validated by the strict config schema (an invalid value fails the load, as
+ * it would in a config file).
+ */
+export function parseOptions(raw: Record<string, unknown> | undefined): ParsedOptions {
+  const overrides: Record<string, unknown> = {}
+  const unknown: string[] = []
+  let stateDir: string | undefined
+  for (const [key, value] of Object.entries(raw ?? {})) {
+    if (key === "stateDir" && typeof value === "string") stateDir = value
+    else if (CONFIG_KEYS.has(key)) overrides[key] = value
+    else unknown.push(key)
   }
+  return { ...(stateDir ? { stateDir } : {}), overrides, unknown: unknown.sort() }
+}
+
+export function unknownOptionsWarning(keys: readonly string[]): string {
+  return (
+    `Ignored unknown plugin option${keys.length === 1 ? "" : "s"}: ${keys.join(", ")}. ` +
+    "Plugin options take the config keys in docs/CONFIG.md (es config show); " +
+    "0.7-era options such as search_engine, max_iterations and mode were removed in 1.0."
+  )
 }

package/src/server.ts

@@ -5,6 +5,7 @@ import { readdir, readFile } from "node:fs/promises"
 import path from "node:path"
 import {
   describeTarget,
+  ensureEngineKey,
   factoryLayout,
   formatReport,
   git,
@@ -19,7 +20,7 @@ import { compileAgents } from "./agents.ts"
 import { createFactoryContinuation } from "./continue.ts"
 import { createHookBridge } from "./hooks.ts"
 import { createPolicyHooks } from "./policy.ts"
-import { createWebfetchCache, registerWebsearch } from "./research.ts"
+import { createWebCache, PendingSearches, registerWebsearch } from "./research.ts"
 import { createRpcHandlers } from "./rpc.ts"
 import { EsRpc } from "./rpc-def.ts"
 import { createRuntime, parseOptions } from "./runtime.ts"
@@ -33,6 +34,9 @@ export default Plugin.define({
   async setup(ctx) {
     const options = parseOptions(ctx.options as Record<string, unknown>)
     const runtime = await createRuntime(ctx.location.directory, options)
+    // The engine key seals cached sources (#52); create it at setup so the
+    // masked state dir holds the key before any seat runs.
+    await ensureEngineKey(runtime.stateDir)
 
     // Agents: canonical registry → v2 agents with wildcard-deny scoping.
     const servers = await ctx.mcp.list().then(
@@ -66,7 +70,9 @@ export default Plugin.define({
     })
 
     await ctx.tool.transform((editor) => registerTools(editor, runtime))
-    await ctx.websearch.transform((editor) => registerWebsearch(editor as any, runtime))
+    // Search results wait here until the tool hook, which knows the agent, decides whether to cache them.
+    const searches = new PendingSearches()
+    await ctx.websearch.transform((editor) => registerWebsearch(editor as any, runtime, searches))
 
     // Our policy runs first, so its denials win over any user hook.
     const policy = createPolicyHooks(runtime)
@@ -82,8 +88,10 @@ export default Plugin.define({
     }
     await ctx.tool.hook("execute.before", policy.before as any)
     await ctx.tool.hook("execute.before", bridge.before as any)
+    // Last: the final (possibly hook-rewritten) shell command is re-checked and sandboxed.
+    await ctx.tool.hook("execute.before", policy.sandbox as any)
     await ctx.tool.hook("execute.after", policy.after as any)
-    await ctx.tool.hook("execute.after", createWebfetchCache(runtime) as any)
+    await ctx.tool.hook("execute.after", createWebCache(runtime, searches) as any)
     await ctx.tool.hook("execute.after", bridge.after as any)
     await ctx.permission.hook("evaluate", policy.evaluate as any)
     await ctx.permission.hook("evaluate", bridge.evaluate as any)
@@ -312,6 +320,7 @@ export default Plugin.define({
             runtime.configSources.length
               ? `Layers: ${runtime.configSources.join(" → ")} → plugin options`
               : "Layers: defaults only (no config files)",
+            ...runtime.warnings.map((warning) => `Warning: ${warning}`),
             JSON.stringify(runtime.config, null, 2),
           ]
           await ctx.session.synthetic({ sessionID, text: lines.join("\n") } as any)

package/src/tools.ts

@@ -21,6 +21,7 @@ export function registerTools(editor: { add(tool: any): void }, runtime: Runtime
   const research = researchTools({
     root: runtime.root,
     policy: () => runtime.policy(),
+    stateDir: runtime.stateDir,
     ...researchOptions(runtime.config),
   })
   const brainstorm = brainstormTools({

package/src/tui.tsx

@@ -1,7 +1,7 @@
-// Epistemic Swarm TUI plugin: the human-only dialogs. Approvals, trust and
-// resume happen here (or in the `es` CLI), never through an agent tool. Each
-// dialog shows a server-computed preview; confirming redeems that preview's
-// token, so what the human saw is exactly what gets signed.
+// Epistemic Swarm TUI plugin: previews for the human-only actions. Approvals,
+// trust and resume are previewed here, then recorded at a terminal with the
+// passphrase-sealed human key (`es approve`, `es trust`, `es factory resume`),
+// never through an agent tool or RPC. Only lspInstall still mutates via RPC.
 import { userInfo } from "node:os"
 import { Plugin } from "@opencode/plugin/tui"
 import { registerPanels } from "./panels.tsx"
@@ -19,6 +19,12 @@ export default Plugin.define({
     const user = userInfo().username
     const toast = (message: string, variant: "success" | "error" | "info" = "info") =>
       context.ui.toast.show({ title: "Epistemic Swarm", message, variant })
+    // Load warnings (e.g. ignored plugin options) are shown once per TUI start.
+    void call("configState")
+      .then((view: { warnings: string[] }) => {
+        for (const warning of view.warnings) toast(warning, "error")
+      })
+      .catch(() => undefined)
 
     const confirm = async (preview: Preview, label: string) => {
       if (!preview.ok || !preview.token) {
@@ -58,36 +64,44 @@ export default Plugin.define({
               ],
             }))
       if (stage !== "frontier" && stage !== "spec") return
-      const token = await confirm(await call("previewApproval", { stage }), "Approve")
+      const preview: Preview = await call("previewApproval", { stage })
+      const token = await confirm(preview, "Approve")
       if (!token) return
-      toast((await call("approve", { stage, user, token })).message, "success")
+      await context.ui.dialog.alert({
+        title: preview.title,
+        message: `${preview.lines.join("\n")}\n\nRun \`es approve ${stage}\` at a terminal with your passphrase (1.1.1: approvals need the sealed human key).`,
+      })
     })
 
     const trust = guarded(async () => {
-      const token = await confirm(await call("previewTrust"), "Trust")
+      const preview: Preview = await call("previewTrust")
+      const token = await confirm(preview, "Trust")
       if (!token) return
-      toast((await call("trust", { user, token })).message, "success")
+      await context.ui.dialog.alert({
+        title: preview.title,
+        message: `${preview.lines.join("\n")}\n\nRun \`es trust\` at a terminal with your passphrase to sign these.`,
+      })
     })
 
     const resume = guarded(async () => {
       const preview: Preview = await call("previewResume")
       const token = await confirm(preview, "Resume")
       if (!token) return
+      const lines = preview.lines.join("\n")
       const drift = preview.lines.some((line) => line.startsWith("Control-file drift"))
-      let raiseCeilingUSD: number | undefined
+      // The halt reason names the remedy: a ceiling halt takes a new ceiling,
+      // a runtime halt restarts the cap. The values still come from the human.
+      let raise = ""
       if (/spend ceiling/i.test(preview.lines[0] ?? "")) {
         const raised = await context.ui.dialog.prompt({ title: "New spend ceiling (USD)", placeholder: "e.g. 50" })
-        raiseCeilingUSD = raised ? Number(raised) : undefined
+        if (raised) raise = ` --raise-ceiling ${raised}`
       }
-      const extendRuntime = /runtime cap/i.test(preview.lines[0] ?? "")
-      const result = await call("resume", {
-        user,
-        token,
-        ...(drift ? { acceptControlDrift: true } : {}),
-        ...(raiseCeilingUSD ? { raiseCeilingUSD } : {}),
-        ...(extendRuntime ? { extendRuntime: true } : {}),
+      const extend = /runtime cap/i.test(lines) ? " --extend-runtime" : ""
+      const flags = `${drift ? " --accept-drift" : ""}${raise}${extend}`
+      await context.ui.dialog.alert({
+        title: preview.title,
+        message: `${preview.lines.join("\n")}\n\nRun \`es factory resume${flags}\` at a terminal with your passphrase.`,
       })
-      toast(result.message, "success")
     })
 
     const lspInstall = guarded(async (input) => {