@jevitate/cli 0.28.0 → 0.29.0

package/dist/logs-retention.js

@@ -2,6 +2,7 @@ import { readFileSync, readdirSync, rmSync, rmdirSync, statSync } from "node:fs"
 import { join } from "node:path";
 import { resolveDataDir } from "./data-dir.js";
 import { clock } from "@jevitate/domain";
+import { isLiveVerifyReceipt } from "./journey-verify-checkpoint.js";
 export const DEFAULT_LOGS_RETENTION = { ttlDays: 14, keepLatest: 50 };
 export class LogsConfigError extends Error {
     code = "E_LOGS_CONFIG";
@@ -41,6 +42,28 @@ export function loadLogsRetention(path = resolveDataDir(["config.json"])) {
     return { ttlDays: int("ttlDays"), keepLatest: int("keepLatest") };
 }
 const RUN_KEY = /^([a-z][a-z-]*-\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z)/;
+/** #787: a proof's durable progress: one receipt per Journey, replaced as the proof moves. */
+const VERIFY_PROGRESS_DIR = "verify-progress";
+/**
+ * #787: the proof receipts under `logs/verify-progress/`, each its own run. A receipt whose verifier is
+ * still live stays, however old (its proof may be mid-way). One that cannot be read is judged by age.
+ */
+function verifyProgressIn(root) {
+    const dir = join(root, VERIFY_PROGRESS_DIR);
+    let names;
+    try {
+        names = readdirSync(dir);
+    }
+    catch (e) {
+        if (typeof e === "object" && e !== null && "code" in e && e.code === "ENOENT")
+            return [];
+        throw e;
+    }
+    return names.flatMap((name) => {
+        const path = join(dir, name);
+        return isLiveVerifyReceipt(path) ? [] : [{ key: `${VERIFY_PROGRESS_DIR}/${name}`, paths: [path], mtimeMs: statSync(path).mtimeMs }];
+    });
+}
 function runsIn(root) {
     let dates;
     try {
@@ -68,9 +91,11 @@ function runsIn(root) {
 export function pruneLogs(root, retention, opts = {}) {
     const nowMs = opts.nowMs ?? clock.now();
     const { runs, dateDirs } = runsIn(root);
-    const newestFirst = [...runs].sort((a, b) => b.mtimeMs - a.mtimeMs);
+    const receipts = verifyProgressIn(root);
     const cutoff = nowMs - retention.ttlDays * 86_400_000;
-    const doomed = newestFirst.slice(retention.keepLatest).filter((r) => r.mtimeMs < cutoff);
+    // Receipts keep their own `keepLatest`: a project's many proofs never crowd out its runs, or the reverse.
+    const expired = (pool) => [...pool].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(retention.keepLatest).filter((r) => r.mtimeMs < cutoff);
+    const doomed = [...expired(runs), ...expired(receipts)];
     if (opts.dryRun !== true) {
         for (const r of doomed)
             for (const p of r.paths)
@@ -80,6 +105,6 @@ export function pruneLogs(root, retention, opts = {}) {
                 rmdirSync(d);
         }
     }
-    return { root, removed: doomed.map((r) => r.key).sort(), keptRuns: runs.length - doomed.length };
+    return { root, removed: doomed.map((r) => r.key).sort(), keptRuns: runs.length + receipts.length - doomed.length };
 }
 //# sourceMappingURL=logs-retention.js.map

package/dist/logs-retention.js.map

@@ -1 +1 @@
-{"version":3,"file":"logs-retention.js","sourceRoot":"","sources":["../src/logs-retention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAczC,MAAM,CAAC,MAAM,sBAAsB,GAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAErF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,eAAwB,CAAC;CAC1C;AAED,8HAA8H;AAC9H,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,sBAAsB,CAAC;QAC7G,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5I,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACrI,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAA2B,EAAU,EAAE;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,UAAU,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,GAAG,4DAA4D,CAAC;AAQ7E,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACjH,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgD,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5G,CAAC;AASD,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAwB,EAAE,OAA+D,EAAE;IACjI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC,OAAO,GAAG,UAAU,CAAC;IACtD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IACzF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AACnG,CAAC"}
+{"version":3,"file":"logs-retention.js","sourceRoot":"","sources":["../src/logs-retention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAcrE,MAAM,CAAC,MAAM,sBAAsB,GAAkB,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;AAErF,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,GAAG,eAAwB,CAAC;CAC1C;AAED,8HAA8H;AAC9H,MAAM,UAAU,iBAAiB,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,aAAa,CAAC,CAAC;IACtE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,sBAAsB,CAAC;QAC7G,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5I,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,sBAAsB,CAAC;IACtD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACrI,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,CAA2B,EAAU,EAAE;QAClD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,sBAAsB,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,GAAG,IAAI,UAAU,CAAC,wCAAwC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrK,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,OAAO,GAAG,4DAA4D,CAAC;AAQ7E,8FAA8F;AAC9F,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAE9C;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC5C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACzF,MAAM,CAAC,CAAC;IACV,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,mBAAmB,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACjH,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgD,CAAC;IACtE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACpC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAC5D,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5G,CAAC;AASD,sGAAsG;AACtG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,SAAwB,EAAE,OAA+D,EAAE;IACjI,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC,OAAO,GAAG,UAAU,CAAC;IACtD,0GAA0G;IAC1G,MAAM,OAAO,GAAG,CAAC,IAAoB,EAAS,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;IAC/J,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK;gBAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;AACrH,CAAC"}

package/dist/mask-values.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `text` with every value in it replaced, whatever its case, longest value first. A host reaches here
+ * lower-cased and in punycode, as `URL` has it, so a value is looked for in that form too.
+ */
+export declare function maskValues(text: string, values: readonly string[], mask: string): string;

package/dist/mask-values.js

@@ -0,0 +1,12 @@
+import { domainToASCII } from "node:url";
+/**
+ * `text` with every value in it replaced, whatever its case, longest value first. A host reaches here
+ * lower-cased and in punycode, as `URL` has it, so a value is looked for in that form too.
+ */
+export function maskValues(text, values, mask) {
+    const forms = values.flatMap((v) => (v === "" ? [] : [v, domainToASCII(v)])).filter((f) => f !== "");
+    return [...new Set(forms)]
+        .sort((a, b) => b.length - a.length)
+        .reduce((out, form) => out.split(new RegExp(form.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "giu")).join(mask), text);
+}
+//# sourceMappingURL=mask-values.js.map

package/dist/mask-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask-values.js","sourceRoot":"","sources":["../src/mask-values.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAyB,EAAE,IAAY;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;SACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;SACnC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AACvH,CAAC"}

package/dist/mcp-api.d.ts

@@ -96,6 +96,8 @@ export interface McpApiDeps {
     environmentsFile?: string;
     /** `~/.jevitate/targets.json` override (environment sessions, verify_fix target config). */
     targetsConfigPath?: string;
+    /** #790: test seam for the logs root run records go under (default: the project's `.jevitate/logs`). */
+    runRecordLogsRoot?: string;
     /**
      * #255 (`run_journey {selfHeal: hybrid|full}`): builds the self-heal gateways exactly as the CLI's
      * `--real`/`--fake-ai` do (`buildExploreGateways`). Absent: a heal mode is refused (setup_required).

package/dist/mcp-api.js

@@ -3,9 +3,12 @@ import { withSiteGate } from "./site-gate-cli.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { ALLOWED_TOOLS, FORBIDDEN_TOOLS } from "@jevitate/mcp-facade";
-import { envCredentialStore } from "@jevitate/ai-core";
+import { ALL_CREDENTIAL_KEYS, envCredentialStore } from "@jevitate/ai-core";
 import { safeRunPolicy as defaultRunPolicy } from "@jevitate/domain";
 import { runJourneyProgrammatically } from "./journey-api.js";
+import { assertMcpRunnable } from "./journey-stale-api.js";
+import { runAsMcpInvocation } from "./approval-provenance.js";
+import { withJourneyRunRecord } from "./journey-run-record.js";
 import { runVerifyFix } from "./verify-fix-api.js";
 import { defaultMcpPathRoots } from "./mcp-paths.js";
 import { currentEngineInfo } from "./engine.js";
@@ -44,10 +47,16 @@ function assertAllowlisted(name) {
  */
 export function buildMcpTools(deps) {
     const runJourney = deps.runJourney ??
-        ((id, params, storageState, o) => withSiteGate(deps.sitePolicyDbPath, (siteGate) => runJourneyProgrammatically({
+        ((id, params, storageState, o) => 
+        // #789: an MCP invocation, so the run guard applies (and an approval made here would say `mcp`).
+        runAsMcpInvocation(() => withJourneyRunRecord({ channel: "mcp", id, params, logsRoot: deps.runRecordLogsRoot }, (runRecorder) => withSiteGate(deps.sitePolicyDbPath, (siteGate) => runJourneyProgrammatically({
             dir: deps.journeysDir,
             id,
             params,
+            runRecorder,
+            // #788: only a promoted Journey with a current approval runs over MCP, refused before any browser.
+            assertRunnable: (stored) => assertMcpRunnable(stored, deps.journeysDir),
+            ...(deps.targetsConfigPath === undefined ? {} : { runGuardTargetsFile: deps.targetsConfigPath }),
             policy: o?.policy ?? defaultRunPolicy(),
             ...(storageState !== undefined ? { storageState } : {}),
             ...(siteGate === undefined ? {} : { siteGate }),
@@ -60,7 +69,7 @@ export function buildMcpTools(deps) {
             ...(o?.fixtures === undefined ? {} : { fixtures: o.fixtures }),
             ...(o?.actionDeltas === true ? { actionDeltas: true } : {}),
             ...(o?.stepResponseTimeoutMs === undefined ? {} : { stepResponseTimeoutMs: o.stepResponseTimeoutMs }),
-        })));
+        })))));
     const pathRoots = deps.pathRoots ?? defaultMcpPathRoots();
     const credentialStore = deps.credentialStore ?? envCredentialStore();
     // verify_fix: replays a persisted finding by (result id, fingerprint) — never a caller-supplied
@@ -71,8 +80,15 @@ export function buildMcpTools(deps) {
     const verifyFixImpl = deps.verifyFix ??
         ((a) => runVerifyFix({
             targets: loadTargetsFile(deps.targetsConfigPath),
+            ...(deps.targetsConfigPath === undefined ? {} : { runGuardTargetsFile: deps.targetsConfigPath }),
             resultPath: a.resultPath,
             fingerprint: a.fingerprint,
+            // #767: the tool's report is persisted too (the terminal layer does nothing inside an MCP
+            // call, by design) — the returned `resultPath` names it.
+            resultArtifact: true,
+            // Masked from the report and its artifact, as the CLI masks `--secret`: a tool call has no such
+            // argument, and runVerifyFix adds what it resolves itself (invariant auth tokens, fixture secrets).
+            secrets: ALL_CREDENTIAL_KEYS.flatMap((key) => credentialStore.read(key) ?? []),
             ...(a.storageState === undefined ? {} : { storageState: a.storageState }),
             ...(a.browser === undefined ? {} : { browser: a.browser }),
             ...(a.replays === undefined ? {} : { replays: a.replays }),

package/dist/mcp-api.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-api.js","sourceRoot":"","sources":["../src/mcp-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAuB,MAAM,oCAAoC,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAwE,MAAM,sBAAsB,CAAC;AAG5I,OAAO,EAAE,kBAAkB,EAAuE,MAAM,mBAAmB,CAAC;AAI5H,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAkB,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAkD,MAAM,qBAAqB,CAAC;AAKnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAmB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAuK9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;AAEnD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;QACf,CAAC,CAAC,EAAU,EAAE,MAA8B,EAAE,YAAqB,EAAE,CAAwB,EAAE,EAAE,CAC/F,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAC/C,0BAA0B,CAAC;YACzB,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,EAAE;YACF,MAAM;YACN,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,gBAAgB,EAAE;YACvC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,CAAC,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACpE,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvE,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,GAAG,CAAC,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YACjE,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvE,GAAG,CAAC,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9D,GAAG,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,CAAC,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE,CAAC;SACtG,CAAC,CACH,CAAC,CAAC;IACP,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC;IAErE,gGAAgG;IAChG,4FAA4F;IAC5F,0FAA0F;IAC1F,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS;QACd,CAAC,CAAC,CAAmB,EAAE,EAAE,CACvB,YAAY,CAAC;YACX,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAChD,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;YAC/E,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAChE,GAAG,CAAC,CAAC,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,EAAE,CAAC;YACvG,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9C,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;SACtF,CAAC,CAAC,CAAC;IAER,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAExF,MAAM,KAAK,GAA0C;QACnD,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,UAAU,CAAC,GAAG,CAAC;KACnB,CAAC;IAEF,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAGrB,MAAM,cAAc,GAClB,CAAC,IAAY,EAAsB,EAAE,CACrC,KAAK,IAAI,EAAE,CACT,WAAW,CAAC;QACV,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,SAAS,IAAI,kDAAkD;KACzE,CAAC,CAAC;IAEP,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,8BAA8B,IAAI,oBAAoB;YACnE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC/C,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtD,kGAAkG;IAClG,yFAAyF;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,YAAY,MAAM,CAAC,OAAO,YAAY,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,OAAO,GAAG;KAC7F,EACD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;KACpG,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;QACzF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAmB,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAmB,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC;gBACjB,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAmB,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgB;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"mcp-api.js","sourceRoot":"","sources":["../src/mcp-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAuB,MAAM,oCAAoC,CAAC;AACxH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAwE,MAAM,sBAAsB,CAAC;AAG5I,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAuE,MAAM,mBAAmB,CAAC;AAIjJ,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAkB,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAkD,MAAM,qBAAqB,CAAC;AAKnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,iBAAiB,EAAmB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAyK9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,aAAa,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAS,eAAe,CAAC,CAAC;AAEnD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAGD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,MAAM,UAAU,GACd,IAAI,CAAC,UAAU;QACf,CAAC,CAAC,EAAU,EAAE,MAA8B,EAAE,YAAqB,EAAE,CAAwB,EAAE,EAAE;QAC/F,iGAAiG;QACjG,kBAAkB,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,EAAE,CAChL,0BAA0B,CAAC;YACzB,GAAG,EAAE,IAAI,CAAC,WAAW;YACrB,EAAE;YACF,MAAM;YACN,WAAW;YACX,mGAAmG;YACnG,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAChG,MAAM,EAAE,CAAC,EAAE,MAAM,IAAI,gBAAgB,EAAE;YACvC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,CAAC,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC;YACpE,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvE,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC3D,GAAG,CAAC,CAAC,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YACjE,GAAG,CAAC,CAAC,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACvE,GAAG,CAAC,CAAC,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC9D,GAAG,CAAC,CAAC,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,CAAC,EAAE,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,qBAAqB,EAAE,CAAC;SACtG,CAAC,CACH,CAAC,CAAC,CAAC,CAAC;IACT,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,mBAAmB,EAAE,CAAC;IAC1D,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,EAAE,CAAC;IAErE,gGAAgG;IAChG,4FAA4F;IAC5F,0FAA0F;IAC1F,+FAA+F;IAC/F,6FAA6F;IAC7F,MAAM,aAAa,GACjB,IAAI,CAAC,SAAS;QACd,CAAC,CAAC,CAAmB,EAAE,EAAE,CACvB,YAAY,CAAC;YACX,OAAO,EAAE,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAChG,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,0FAA0F;YAC1F,yDAAyD;YACzD,cAAc,EAAE,IAAI;YACpB,gGAAgG;YAChG,oGAAoG;YACpG,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9E,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC;YAC/E,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;YACzE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAChE,GAAG,CAAC,CAAC,CAAC,sBAAsB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,CAAC,sBAAsB,EAAE,CAAC;YACvG,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YACpD,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAC9C,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;SACtF,CAAC,CAAC,CAAC;IAER,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAExF,MAAM,KAAK,GAA0C;QACnD,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,YAAY,CAAC,GAAG,CAAC;QACpB,GAAG,UAAU,CAAC,GAAG,CAAC;KACnB,CAAC;IAEF,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAGrB,MAAM,cAAc,GAClB,CAAC,IAAY,EAAsB,EAAE,CACrC,KAAK,IAAI,EAAE,CACT,WAAW,CAAC;QACV,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,SAAS,IAAI,kDAAkD;KACzE,CAAC,CAAC;IAEP,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAChC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,8BAA8B,IAAI,oBAAoB;YACnE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE;YAC/C,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;SAC9B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtD,kGAAkG;IAClG,yFAAyF;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW,EAAE,YAAY,MAAM,CAAC,OAAO,YAAY,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,OAAO,GAAG;KAC7F,EACD,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;KACpG,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAA2B,EAAE;QACzF,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QACjD,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,EAAE,CAAmB,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC,CAAmB,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,WAAW,CAAC;gBACjB,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAmB,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAgB;IACnD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/mcp-cli-runner.d.ts

@@ -17,6 +17,8 @@ import { type Command } from "commander";
  *   into a typed usage refusal (exit 64).
  * - `process.exitCode` (how every action reports its contract code) is saved, read and restored,
  *   and calls are serialised, so one call's code never leaks into another's or into the server's.
+ * - #787: a read that must answer while a long call holds the queue (`journey verify --status`) runs
+ *   beside it. It touches no shared state: only its own refusal sets an exit code, undone at once.
  * - #437: every call runs inside `runAsMcpInvocation`, so an approval it makes (`promote_journey`,
  *   `approve_demo`) never prompts and is recorded with provenance channel `mcp`.
  */
@@ -25,7 +27,11 @@ export interface CliRunOutcome {
     readonly stdout: string;
     /** The command's contract exit code (exit-codes.ts). */
     readonly exitCode: number;
+    /** #789: the run guard ended a replay in this call: the tool's answer, however the command handled the error. */
+    readonly refusal?: Error;
 }
-export type McpCliRunner = (argv: readonly string[]) => Promise<CliRunOutcome>;
+export type McpCliRunner = (argv: readonly string[], options?: {
+    readonly unqueued?: boolean;
+}) => Promise<CliRunOutcome>;
 /** A runner over `build()` — called once per invocation, so no program state is shared between calls. */
 export declare function makeInProcessCliRunner(build: () => Command): McpCliRunner;

package/dist/mcp-cli-runner.js

@@ -18,13 +18,16 @@ export function makeInProcessCliRunner(build) {
         }, () => undefined);
         const saved = process.exitCode;
         process.exitCode = undefined;
+        const invocation = {};
         try {
             // #437: an approval made inside an MCP tool call is recorded as channel `mcp` (an agent's).
-            await runAsMcpInvocation(() => program.parseAsync([...argv], { from: "user" }));
+            await runAsMcpInvocation(() => program.parseAsync([...argv], { from: "user" }), invocation);
             const code = process.exitCode;
-            return { stdout, exitCode: code === undefined ? 0 : Number(code) };
+            return { stdout, exitCode: code === undefined ? 0 : Number(code), ...(invocation.refusal === undefined ? {} : { refusal: invocation.refusal }) };
         }
         catch (err) {
+            if (invocation.refusal !== undefined)
+                return { stdout, exitCode: EXIT_CODES.inconclusive, refusal: invocation.refusal };
             if (err instanceof CommanderError) {
                 const envelope = { v: 1, ok: false, error: { code: "E_CLI_USAGE", message: err.message.replace(/^error: /, "") } };
                 return { stdout: `${stdout}${JSON.stringify(envelope)}\n`, exitCode: EXIT_CODES.usage };
@@ -37,7 +40,31 @@ export function makeInProcessCliRunner(build) {
             process.exitCode = saved;
         }
     };
-    return (argv) => {
+    // Only file reads and resolved promises, so no call in the queue can run in between. A call's own exit code is never reset: it may hold the queue's.
+    const runBeside = async (argv) => {
+        let stdout = "";
+        const program = build();
+        configureTree(program, (s) => {
+            stdout += s;
+        }, () => undefined);
+        const held = process.exitCode;
+        try {
+            await runAsMcpInvocation(() => program.parseAsync([...argv], { from: "user" }));
+            return { stdout, exitCode: process.exitCode === held ? 0 : Number(process.exitCode) };
+        }
+        catch (err) {
+            const usage = err instanceof CommanderError;
+            const envelope = { v: 1, ok: false, error: { code: usage ? "E_CLI_USAGE" : "E_CLI_INTERNAL", message: err instanceof Error ? err.message.replace(/^error: /, "") : String(err) } };
+            return { stdout: `${stdout}${JSON.stringify(envelope)}\n`, exitCode: usage ? EXIT_CODES.usage : EXIT_CODES.inconclusive };
+        }
+        finally {
+            if (process.exitCode !== held)
+                process.exitCode = held;
+        }
+    };
+    return (argv, options) => {
+        if (options?.unqueued === true)
+            return runBeside(argv);
         const next = queue.then(() => runOne(argv));
         queue = next.catch(() => undefined);
         return next;

package/dist/mcp-cli-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-cli-runner.js","sourceRoot":"","sources":["../src/mcp-cli-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAgB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAiC9D,SAAS,aAAa,CAAC,GAAY,EAAE,KAA0B,EAAE,OAA4B;IAC3F,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ;QAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,EAAE,IAAuB,EAA0B,EAAE;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;QACxB,aAAa,CACX,OAAO,EACP,CAAC,CAAC,EAAE,EAAE;YACJ,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC/B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC;YACH,4FAA4F;YAC5F,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAuC,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnH,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1F,CAAC;YACD,kGAAkG;YAClG,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnI,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;QACjG,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,EAAE,EAAE;QACd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-cli-runner.js","sourceRoot":"","sources":["../src/mcp-cli-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAgB,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAAsB,MAAM,0BAA0B,CAAC;AAqClF,SAAS,aAAa,CAAC,GAAY,EAAE,KAA0B,EAAE,OAA4B;IAC3F,GAAG,CAAC,YAAY,EAAE,CAAC;IACnB,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ;QAAE,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,KAAoB;IACzD,IAAI,KAAK,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,KAAK,EAAE,IAAuB,EAA0B,EAAE;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;QACxB,aAAa,CACX,OAAO,EACP,CAAC,CAAC,EAAE,EAAE;YACJ,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC/B,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;QAC7B,MAAM,UAAU,GAAkB,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,4FAA4F;YAC5F,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,OAAO,CAAC,QAAuC,CAAC;YAC7D,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACnJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;YACxH,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnH,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1F,CAAC;YACD,kGAAkG;YAClG,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnI,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,YAAY,EAAE,CAAC;QACjG,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC;IACF,qJAAqJ;IACrJ,MAAM,SAAS,GAAG,KAAK,EAAE,IAAuB,EAA0B,EAAE;QAC1E,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC;QACxB,aAAa,CACX,OAAO,EACP,CAAC,CAAC,EAAE,EAAE;YACJ,MAAM,IAAI,CAAC,CAAC;QACd,CAAC,EACD,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,cAAc,CAAC;YAC5C,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,gBAAgB,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACnL,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC5H,CAAC;gBAAS,CAAC;YACT,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACzD,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,EAAE,QAAQ,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC"}

package/dist/mcp-cli-tools.d.ts

@@ -79,6 +79,11 @@ export interface CliCommandSpec {
     readonly params: Readonly<Record<string, CliParam>>;
     /** Every flag of the command that is NOT an MCP argument, with why (checked by the parity guard). */
     readonly omitted: Readonly<Record<string, string>>;
+    /**
+     * The Journeys a `--param` of this command goes to, so a secret parameter's value is refused before
+     * the command runs (secret-params.ts). Every command taking `--param` has one (checked by a guard).
+     */
+    readonly paramJourneys?: (args: McpArgs) => readonly unknown[];
 }
 export interface CliToolSpec {
     readonly name: string;
@@ -86,6 +91,8 @@ export interface CliToolSpec {
     /** One command, or several selected by an `action` argument (a family of small commands). */
     readonly command?: CliCommandSpec;
     readonly actions?: Readonly<Record<string, CliCommandSpec>>;
+    /** #787: this call only reads, and must answer while a long call of the same server holds the queue. */
+    readonly answersWhileBusy?: (args: McpArgs) => boolean;
 }
 export declare const OMIT: {
     readonly json: "always set: the tool returns the command's JSON envelope";
@@ -93,7 +100,7 @@ export declare const OMIT: {
     readonly browserBin: "which browser binary, channel and Chromium switches launch is the operator's setting (the server's own launch), never an MCP argument";
     readonly storeDir: "store and results locations are the server's (the `jevitate mcp` defaults / --dir): an MCP argument never picks which directory is read or written as a store";
     readonly envSecret: "binds an environment variable (or a literal secret) the run types or redacts: a request never chooses which of the operator's variables is read — secret fields come from targets.json (secretFields/personas)";
-    readonly mcpOrigins: "#484: an MCP caller never names origins — a replay reaches only operator-configured origins; over MCP use 'env' (an environment in environments.json), or verify-fix --allow on the CLI";
+    readonly mcpOrigins: "#484: a request adds no origin to a replay's allowlist by flag: over MCP use 'env' (an environment in environments.json), or verify-fix --allow on the CLI. Where a tool takes 'baseUrl', that argument can still name an origin the configuration doesn't know (docs/safety.md)";
     readonly logCmd: "server-log sources can run commands and read arbitrary files: operator-declared only (targets.json logSources/allowLogCmd)";
     readonly logTriage: "#313: sends the run's recorded log text (redacted) to the judgment model — an operator opt-in for their own logs, never a request's choice";
     readonly hangWrites: "re-sending a paid/destructive write is the operator's call (targets.json safety.hangReplayWrites)";
@@ -136,4 +143,5 @@ export declare function runCliTool(spec: CliToolSpec, args: McpArgs, deps: {
     runCli?: McpCliRunner;
     roots: readonly string[];
     redact: (text: string) => string;
+    journeysDir: string;
 }): Promise<CliToolOutcome>;

package/dist/mcp-cli-tools.js

@@ -3,6 +3,8 @@ import { confineMcpPath, McpPathError } from "./mcp-paths.js";
 import { resolve as resolvePath } from "node:path";
 import { homeDataRoot } from "./project-dir.js";
 import { CATALOG_EXPORT_FORMATS } from "./catalog-bundle-api.js";
+import { RunGuardRefusedError, runGuardRefusalBody } from "./mcp-run-guard.js";
+import { secretParamRefusalBody, secretParamsCarried } from "./secret-params.js";
 // ── Why a flag is not an MCP argument ──────────────────────────────────────────────────────────
 export const OMIT = {
     json: "always set: the tool returns the command's JSON envelope",
@@ -10,7 +12,7 @@ export const OMIT = {
     browserBin: "which browser binary, channel and Chromium switches launch is the operator's setting (the server's own launch), never an MCP argument",
     storeDir: "store and results locations are the server's (the `jevitate mcp` defaults / --dir): an MCP argument never picks which directory is read or written as a store",
     envSecret: "binds an environment variable (or a literal secret) the run types or redacts: a request never chooses which of the operator's variables is read — secret fields come from targets.json (secretFields/personas)",
-    mcpOrigins: "#484: an MCP caller never names origins — a replay reaches only operator-configured origins; over MCP use 'env' (an environment in environments.json), or verify-fix --allow on the CLI",
+    mcpOrigins: "#484: a request adds no origin to a replay's allowlist by flag: over MCP use 'env' (an environment in environments.json), or verify-fix --allow on the CLI. Where a tool takes 'baseUrl', that argument can still name an origin the configuration doesn't know (docs/safety.md)",
     logCmd: "server-log sources can run commands and read arbitrary files: operator-declared only (targets.json logSources/allowLogCmd)",
     logTriage: "#313: sends the run's recorded log text (redacted) to the judgment model — an operator opt-in for their own logs, never a request's choice",
     hangWrites: "re-sending a paid/destructive write is the operator's call (targets.json safety.hangReplayWrites)",
@@ -231,6 +233,7 @@ export const CLI_TOOL_SPECS = [
             "With approve: true, applies the reviewed draft (shows the diff; refused with E_JOURNEY_ANNOTATIONS_STALE if the Journey changed since the draft) — the same proposal/approval semantics as the CLI. Drafting needs real or fakeAi.",
         command: {
             path: "journey annotate",
+            paramJourneys: (a) => [a["id"]],
             params: { ...EXTENSION, id: pos(), approve: b("--approve"), params: { kind: "params", flag: "--param" }, storageState: session("--storage-state"), fixtures: path("--fixtures"), fixtureIdentity: FIXTURE_IDENTITY, screenshots: { kind: "screenshots", flag: "--screenshots" }, actionDeltas: b("--action-deltas"), ...ENVIRONMENT, ...EMULATION, ...AI },
             omitted: { ...LOCATION_FLAGS, "--dir": OMIT.storeDir, ...HOOK_FLAGS, ...BROWSER_FLAGS, ...JSON_FLAG },
         },
@@ -240,6 +243,7 @@ export const CLI_TOOL_SPECS = [
         description: "`jevitate journey demo <id>` (#248): replay a Journey as a narrated demo — a WebM video with .vtt subtitles (video: a .webm path) and/or a Markdown step-by-step guide with screenshots (guide: a .md path). A Journey that no longer replays fails (exit 1). Paths inside the project or ~/.jevitate.",
         command: {
             path: "journey demo",
+            paramJourneys: (a) => [a["id"]],
             params: {
                 id: pos(),
                 ...EXTENSION,
@@ -261,14 +265,17 @@ export const CLI_TOOL_SPECS = [
     },
     {
         name: "verify_journey",
-        description: "`jevitate journey verify <id> --plan|--mutate` (#402): plan previews the exact mutations, assertion pairings, unpaired assertions and minimum replay count without opening a browser; mutate proves each assertion can fail by replaying the Journey once, then once per mutation. Mutations only skip steps, abort the app's own writes or alter checked non-secret inputs; nothing is fabricated. Set exactly one of plan or mutate.",
+        description: "`jevitate journey verify <id> --plan|--mutate|--status` (#402): plan previews the exact mutations, assertion pairings, unpaired assertions and minimum replay count without opening a browser; mutate proves each assertion can fail by replaying the Journey as recorded, then once per mutation, with independence, control and closing replays around them. Mutations only skip steps, abort the app's own writes or alter checked non-secret inputs; nothing is fabricated. status (#787) reads a proof's durable progress and whether its verifier is live, exited or stale: no browser, no hook, nothing of the app's. resume, with mutate, continues an interrupted proof of the same Journey and configuration, reusing finished pairs after the base replay passes again; any mismatch, a damaged or over-24h checkpoint, or a live verifier is refused by name (data.reason) and never starts over. Set exactly one of plan, mutate or status.",
         command: {
             path: "journey verify",
+            paramJourneys: (a) => [a["id"]],
             params: {
                 id: pos(),
                 ...EXTENSION,
                 mutate: b("--mutate"),
                 plan: b("--plan"),
+                status: b("--status"),
+                resume: b("--resume"),
                 params: { kind: "params", flag: "--param" },
                 storageState: session("--storage-state"),
                 fixtures: path("--fixtures"),
@@ -278,12 +285,15 @@ export const CLI_TOOL_SPECS = [
             },
             omitted: { ...LOCATION_FLAGS, "--dir": OMIT.storeDir, "--allow": OMIT.mcpOrigins, ...HOOK_FLAGS, ...BROWSER_FLAGS, ...JSON_FLAG },
         },
+        // The command takes `status` first and runs no proof, whatever else is set.
+        answersWhileBusy: (args) => args["status"] === true,
     },
     {
         name: "journey_readiness",
         description: "`jevitate journey readiness <id> [--with <toId>] --json` (#581): one readiness receipt for a Journey or a linked pair — lint, schema, the #582 handoff, the #583 boundary, strict review, annotations, catalog links/approvals, the recorded mutation proof (fresh only while bound to the current review hash) and promotion, each pass / fail / inconclusive / stale / not-run / awaiting-human. mode: report (default; no browser, sends nothing) | replay (baseline run, or the chain for a pair with requests) | prove (replay plus verify --mutate). replay/prove need env or baseUrl, refuse an environment flagged production and refuse missing params by name, all before any browser. verdict: technically-ready (exit 0) | blocked (1) | inconclusive / incomplete (2); a passing replay never hides an inconclusive proof. Approvals are listed under awaitingHuman and never acted on; the receipt carries no param value, page text or secret.",
         command: {
             path: "journey readiness",
+            paramJourneys: (a) => [a["id"], a["with"]],
             params: {
                 id: pos(),
                 with: s("--with"),
@@ -318,6 +328,7 @@ export const CLI_TOOL_SPECS = [
         description: "`jevitate journey chain --from <discover> --to <reply> --requests <file>` (#580): run a discover Journey once, then a prepare-only reply Journey once per approved request in the JSON Lines file ({commentId, account, replyText}) matched to a discovered record by commentId AND account. Both Journeys must be promoted. #608: params supplies explicit producer (discover) params, validated against the producer's schema before anything runs. Unmatched requests never run; an empty discovery stops the chain (no target is guessed). The result names ids and outcomes only, never record or reply text. Exit 0 only when every request matched and its run was ok.",
         command: {
             path: "journey chain",
+            paramJourneys: (a) => [a["from"], a["to"]],
             params: {
                 from: s("--from", { required: true }),
                 to: s("--to", { required: true }),
@@ -400,6 +411,7 @@ export const CLI_TOOL_SPECS = [
             "For a PROMOTED target prefer queue_exploration (queue + poll). Model-driven strategies need real or fakeAi. Media: recordVideo, screenshots, evidenceVideo. Sessions: storageState, persona/actor entries 'name=<storageState path>'; authCheck (off/auto/urlExcludes:/selector:) ends a run on an expired session as auth-expired (inconclusive), re-signing a persona in once when its personas file declares login parameters.",
         command: {
             path: "explore",
+            paramJourneys: (a) => [a["fromJourney"]],
             params: { tags: TAGS, ...EXTENSION,
                 url: s("--url"),
                 targetId: s("--target"),
@@ -760,6 +772,7 @@ export const CLI_TOOL_SPECS = [
         description: "`jevitate load run <journeyId>`: replay a Journey concurrently (concurrency × iterations) against an authorized origin and report latency/errors.",
         command: {
             path: "load run",
+            paramJourneys: (a) => [a["journeyId"]],
             params: {
                 tags: TAGS,
                 journeyId: pos(),
@@ -914,6 +927,8 @@ export const CLI_TOOL_SPECS = [
             remove: { path: "source remove", params: { name: pos() }, omitted: JSON_FLAG },
             run: {
                 path: "source run",
+                // The Journey is resolved through the source's run gate: runSourceJourney refuses there.
+                paramJourneys: () => [],
                 params: { tags: TAGS, ...EXTENSION, name: pos(), journeyId: pos(), params: { kind: "params", flag: "--param" }, storageState: session("--storage-state"), ...EMULATION },
                 omitted: { ...BROWSER_FLAGS, ...JSON_FLAG },
             },
@@ -1174,12 +1189,22 @@ export async function runCliTool(spec, args, deps) {
             throw err;
         return { isError: true, body };
     }
+    const paramJourneys = commandFor(spec, args).paramJourneys;
+    if (paramJourneys !== undefined) {
+        const carried = await secretParamsCarried(deps.journeysDir, paramJourneys(args), args["params"]);
+        if (carried.length > 0)
+            return { isError: true, body: secretParamRefusalBody(carried) };
+    }
     if (deps.runCli === undefined) {
         return { isError: true, body: { error: "not_configured", message: `${spec.name} runs \`jevitate ${commandFor(spec, args).path}\` in process, which this server was not given` } };
     }
-    const { stdout: raw, exitCode } = await deps.runCli(argv);
+    const { stdout: raw, exitCode, refusal } = await (spec.answersWhileBusy?.(args) === true ? deps.runCli(argv, { unqueued: true }) : deps.runCli(argv));
     const stdout = deps.redact(raw);
     let envelope = lastEnvelope(stdout);
+    // #789: a refused replay is the answer, whatever the command made of it. What the command did report before it stays beside it.
+    if (refusal instanceof RunGuardRefusedError) {
+        return { isError: true, body: { ...runGuardRefusalBody(refusal), ...(envelope?.data === undefined || envelope.data === null ? {} : { partial: envelope.data }) } };
+    }
     if (envelope === undefined && exitCode === 0) {
         // A command without --json (`recording promote`) prints its result as plain JSON.
         try {
@@ -1192,7 +1217,7 @@ export async function runCliTool(spec, args, deps) {
     if (envelope === undefined)
         return { isError: true, body: { error: "internal", message: "the command printed no JSON envelope", exitCode } };
     if (!envelope.ok) {
-        return { isError: true, body: { error: exitCode === 64 ? "invalid_args" : "refused", code: envelope.error?.code ?? "E_UNKNOWN", message: envelope.error?.message ?? "refused", exitCode } };
+        return { isError: true, body: { error: exitCode === 64 ? "invalid_args" : "refused", code: envelope.error?.code ?? "E_UNKNOWN", message: envelope.error?.message ?? "refused", exitCode, ...(envelope.data === undefined ? {} : { data: envelope.data }) } };
     }
     // 0/1/3/4 are answers; 2 (proved nothing) is never a pass.
     return { isError: exitCode === 2 || exitCode >= 64, body: { exitCode, data: envelope.data ?? null } };