@rosthq/cli 0.7.111 → 0.7.113

package/dist/forge-workspace.d.ts

@@ -1,6 +1,8 @@
 import { type StepLedger } from "./step-ledger.js";
 export declare const MODEL_SPAWN_ENV_ALLOWLIST: readonly ["PATH", "HOME", "USER", "LANG", "LC_ALL", "TMPDIR", "SHELL", "NODE_OPTIONS"];
-export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function buildModelSpawnEnv(base: NodeJS.ProcessEnv, claudeConfigDir?: string): NodeJS.ProcessEnv;
+export declare function resolveSourceClaudeConfigDir(base: NodeJS.ProcessEnv): string;
+export declare function provisionIsolatedClaudeConfigDir(base: NodeJS.ProcessEnv, configDir: string): Promise<string>;
 export type ForgeCredential = {
     token: string;
     expiresAt: string;

package/dist/forge-workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAW7E;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}
+{"version":3,"file":"forge-workspace.d.ts","sourceRoot":"","sources":["../src/forge-workspace.ts"],"names":[],"mappings":"AA4CA,OAAO,EAAqB,KAAK,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AASrF,eAAO,MAAM,yBAAyB,wFAc5B,CAAC;AAEX,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,UAAU,EAOvB,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAAC,UAAU,CAiBnB;AAcD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAQ5E;AAOD,wBAAsB,gCAAgC,CACpD,IAAI,EAAE,MAAM,CAAC,UAAU,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAejB;AAID,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAG3B,QAAQ,EAAE,MAAM,CAAC;IAGjB,WAAW,EAAE,MAAM,CAAC;IAGpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAKlB,OAAO,EAAE,MAAM,CAAC;IAIhB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEvD,MAAM,MAAM,4BAA4B,GAAG;IAEzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,OAAO,EAAE,qBAAqB,CAAC;IAE/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAI5B,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAyOF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqB5E;AAqJD,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAiB1G;AASD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,UAAU,EAAE,eAAe,CAAC;IAE5B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CA0C1G;AAiDD,wBAAsB,aAAa,CACjC,EAAE,EAAE,cAAc,EAClB,UAAU,EAAE,eAAe,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA4BvC;AAsBD,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAiC/E;AAcD,MAAM,MAAM,2BAA2B,GAAG;IACxC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAE9D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,eAAe,CAAC;IAG5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAGzB,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAE7B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IAGf,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AA+GF,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE1G;AA4CD,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IAEf,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC;AAIF,MAAM,MAAM,mBAAmB,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,OAAO,GACP,SAAS,GACT,QAAQ,GACR,SAAS,CAAC;AAEd,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CA4BxF;AAsBD,MAAM,MAAM,aAAa,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI5D,wBAAsB,qBAAqB,CAAC,OAAO,EAAE;IACnD,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAajC;AAED,MAAM,MAAM,iBAAiB,GAEzB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAE9C;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAQzB,wBAAsB,gBAAgB,CAAC,OAAO,EAAE;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAwC7B;AAID,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAgBD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0BxH;AAiBD,wBAAsB,eAAe,CAAC,EAAE,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvE"}

package/dist/index.js

@@ -38746,6 +38746,7 @@ var catalogEntries = CATALOG_ENTRIES.map(enrichCatalogEntry);
 var catalogById = new Map(catalogEntries.map((entry) => [entry.id, entry]));
 
 // ../../packages/protocol/src/skills.ts
+var SKILL_DESCRIPTION_MAX_CHARS = 500;
 var skillVisibilitySchema = external_exports.enum(["private", "seat", "tenant"]);
 var skillStatusSchema = external_exports.enum(["draft", "pending_review", "published", "archived"]);
 var skillSourceTypeSchema = external_exports.enum([
@@ -38762,12 +38763,14 @@ var skillCatalogTierSchema = external_exports.enum(["free", "pro", "enterprise",
 var skillLocalClientSchema = external_exports.enum(["claude-code", "codex", "cursor"]);
 var skillSlugSchema = external_exports.string().regex(/^[a-z0-9][a-z0-9-]{1,80}$/);
 var skillNameSchema = external_exports.string().trim().min(1).max(120);
-var skillApplicationSchema = external_exports.object({
+var skillApplicationShape = {
   domain: external_exports.string().trim().min(1).max(80).optional(),
   summary: external_exports.string().trim().min(1).max(500),
   best_for: external_exports.array(external_exports.string().trim().min(1).max(160)).max(20).default([]),
   not_for: external_exports.array(external_exports.string().trim().min(1).max(160)).max(20).default([])
-}).strict();
+};
+var skillApplicationSchema = external_exports.object(skillApplicationShape).strict();
+var skillApplicationInputSchema = external_exports.object(skillApplicationShape);
 var skillToolDependencySchema = external_exports.object({
   tool: external_exports.string().trim().min(1).max(120),
   min_scope_tier: toolScopeTierSchema,
@@ -38787,7 +38790,7 @@ var skillValidationIssueSchema = external_exports.object({
 var normalizedSkillPackageSchema = external_exports.object({
   slug: skillSlugSchema,
   name: skillNameSchema,
-  description: external_exports.string().trim().min(1).max(300),
+  description: external_exports.string().trim().min(1).max(SKILL_DESCRIPTION_MAX_CHARS),
   visibility: skillVisibilitySchema,
   application: skillApplicationSchema,
   frontmatter: external_exports.record(external_exports.string(), external_exports.unknown()),
@@ -40689,7 +40692,7 @@ var aicosPulseSnapshotSchema = external_exports.object({
 // ../../packages/protocol/src/command-introspection.ts
 var requiredScopeSchema = external_exports.enum(["tenant_admin", "tenant", "seat", "user"]);
 var confirmationSchema = external_exports.enum(["none", "human_required", "credential_flow", "dangerous"]);
-var trustedExecutionModeSchema = external_exports.enum(["eligible", "always_human", "not_applicable"]);
+var trustedExecutionModeSchema = external_exports.enum(["eligible", "eligible_bounded", "always_human", "not_applicable"]);
 var trustedExecutionRiskFlagSchema = external_exports.enum([
   "admin",
   "credential",
@@ -48239,7 +48242,7 @@ Drafting can be assisted by agents. Activation is a human decision. When authori
     order: 40,
     title: "Agent staffing playbook",
     summary: "How to decide whether a seat should be human, agent, or hybrid, and how to go live safely.",
-    version: "2026-07-14.2",
+    version: "2026-07-20.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -48297,7 +48300,7 @@ Two creation paths, both draft-first. Read the stock-agents guide for templates
 - From a template: list with \`agent_template.list\` / \`rost_list_agent_templates\`, then \`agent.create_from_template\` / \`rost_create_agent_from_template\` with \`seat_id\` and \`template_slug\`. Returns a draft agent and draft Charter only.
 - Custom: \`agent_setup.start\` / \`rost_start_agent_setup\` (returns a \`setup_id\`), iterate with \`agent_setup.get\` and \`agent_setup.update\`, then \`agent.create_custom\` / \`rost_create_custom_agent\`. Stage tools with \`agent.configure_tools\` (vault refs only) and sandbox with \`agent.run_dry_run\`.
 - Inspect runtime: \`agent.status\` / \`rost_get_agent_status\` with \`{"seat_id":"<seat-id>"}\` returns lane, live state, steward chain, dry-run result, and Runner availability.
-- Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. The command is ungated but still requires a live staffed agent and the normal server-side tool guard.
+- Run on demand: \`{{cli}} agent run-now --seat-id <seat-id>\` / \`agent.run_now\` / \`rost_run_agent_now\` queues an immediate live run without changing the saved schedule. Cloud agents dispatch to the Inngest executor; runner agents queue work for the paired runner. It is \`human_required\` (DER-1766/DER-2081): a human requesting a run acts directly, an agent re-running its OWN seat (same-seat) may auto-execute under a standing Trusted grant, and a cross-seat dispatch (one seat running a different seat's agent) always asks a human. It still requires a live staffed agent and passes the normal server-side tool guard.
 - Audit what an agent did (Trust Card): \`{{cli}} command agent.list_runs --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_runs\` returns the seat's run history with per-run Skill activation counts plus tool-call, guard-denied, and guard-held counts; \`{{cli}} agent get-run --seat-id <seat-id> --run-id <run-id>\` / \`agent.get_run\` / \`rost_get_agent_run_diagnostics\` reads one run's transcript reference, token/cost usage, outcome, product-visible run errors, and any Skill versions/files loaded for that run. Pass \`--transcript\` (\`{"transcript":true}\`) to also return the persisted, secret-scrubbed session transcript for that run when one exists \u2014 cloud-lane and runner turns persist a bounded transcript at turn end. Final run outcomes are no longer chopped to a short summary; the full report survives. Loaded Skill file hashes and sizes identify the immutable source package; the runtime may still bound or truncate prompt text before sending it to the model. \`{{cli}} command agent.list_tool_calls --json '{"seat_id":"<seat-id>"}'\` / \`rost_list_agent_tool_calls\` returns the tool-call ledger with each call's guard result. Both list commands include \`denied_tool_call_count\` and \`held_tool_call_count\` rollups: hard guard denials stay separate from actions escalated for review. Pass \`{"seat_id":"<seat-id>","held_only":true}\` to \`agent.list_tool_calls\` for only the held calls. The web seat page shows the same facts as a Trust Card, and its Activity tab additionally renders the full persisted transcript and artifacts rail for a selected session inline (no \`--transcript\` flag needed there) alongside the business-activity ledger (\`work.record\`/\`work.list\`) \u2014 counter tiles and a run-grouped feed with each record's verb, object, outcome, evidence, and \`template_ref\` when one was used.
 
 ## Review readiness before go-live
@@ -48312,7 +48315,7 @@ The lane a live agent runs on \u2014 cloud (the {{brand}}-managed runtime), a pa
 
 ## When to stop for confirmation
 
-\`agent.create_from_template\`, \`agent.create_custom\`, \`staffing.assign_user\`, \`agent.go_live\`, \`agent.update_schedule\`, \`agent_setup.relane\`, and \`mcp_token.create\` are \`human_required\`; \`agent.configure_tools\` and \`credential.ingress\` are \`credential_flow\` (both gate through the vault-backed credential path with human approval; \`agent.configure_tools\` stages the request and only \`credential.ingress\` takes the raw secret, as a vault reference); \`agent.decommission\` is \`dangerous\`. \`agent.run_now\` is not human-gated because it does not expand authority or change the schedule; it only queues an immediate run for an already-live agent. An agent may draft, configure (with vault refs), dry-run, and request an on-demand run; the human approves go-live, credentials, schedule changes, and decommission. \`run_dry_run\` is ungated by human approval, but it is **precondition-gated**: the seat's permission manifest must be signed first (\`charter.sign_manifest\`). Attempting a dry run before sign-off returns a clean \`COMMAND_PRECONDITION_FAILED\` naming \`charter.sign_manifest\`, not a generic failure. Go-live after a passed dry run is \`human_required\`. See the confirmations guide.
+\`agent.create_from_template\`, \`agent.create_custom\`, \`staffing.assign_user\`, \`agent.go_live\`, \`agent.update_schedule\`, \`agent_setup.relane\`, and \`mcp_token.create\` are \`human_required\`; \`agent.configure_tools\` and \`credential.ingress\` are \`credential_flow\` (both gate through the vault-backed credential path with human approval; \`agent.configure_tools\` stages the request and only \`credential.ingress\` takes the raw secret, as a vault reference); \`agent.decommission\` is \`dangerous\`. \`agent.run_now\` is \`human_required\` (DER-1766/DER-2081): a cross-seat run always asks, while a same-seat re-run of the acting seat's own live agent may auto-execute only under a standing Trusted grant. An agent may draft, configure (with vault refs), dry-run, and request an on-demand run; the human approves go-live, credentials, schedule changes, and decommission. \`run_dry_run\` is ungated by human approval, but it is **precondition-gated**: the seat's permission manifest must be signed first (\`charter.sign_manifest\`). Attempting a dry run before sign-off returns a clean \`COMMAND_PRECONDITION_FAILED\` naming \`charter.sign_manifest\`, not a generic failure. Go-live after a passed dry run is \`human_required\`. See the confirmations guide.
 
 ## Non-negotiables
 
@@ -50009,7 +50012,7 @@ Set \`ROST_SKILL_INSTALL_ROOT\` only for a sandbox or CI override. Local copies
     order: 55,
     title: "Agent reference map",
     summary: "Where CLI sessions, MCP clients, and in-app agents should retrieve {{brand}} guidance before recommending setup changes.",
-    version: "2026-07-15.1",
+    version: "2026-07-20.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "graph_design", "charter_design", "staffing", "operating_rhythm"],
@@ -50123,6 +50126,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Run the weekly Sync (compile, run, complete, assign): sync-rhythm-playbook.
 - Operate local runners and work orders: runner-guide.
 - Approve or reject a pending confirmation (human only): confirmations-guide.
+- Explain what a command or agent can do automatically versus what always asks a human, or how Trusted mode and the auto band work: governed-command-capability-matrix, then confirmations-guide.
 - Manage members, settings, and notifications: settings-guide, settings-members-and-invites-guide, notifications-guide.
 - Explain company-wide billing, payment, invoices, or usage true-ups: billing-and-pricing-guide, then settings-guide.
 - Diagnose a failure on any surface: troubleshooting-guide, then security-model-guide.
@@ -50133,7 +50137,7 @@ Read the listed guide before recommending or running each workflow. Every workfl
 - Graph design: responsibility-graph-playbook
 - Charter design: charter-design-playbook, charter-authoring-deep-dive
 - Staffing: agent-staffing-playbook, add-agents-guide, custom-agents-guide, agent-builder-guide, agent-definition-import-guide, how-agents-work, tool-access-and-vault, available-tools-guide, skill-builder-guide, agent-skill-authoring-guide, agent-skill-setup-guide, mcp-and-cli-guide, stock-agents-guide
-- Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, steward-queue-guide, sync-rhythm-playbook, notifications-guide
+- Operating rhythm: aicos-chat-guide, cascade-guide, signal-guide, friction-guide, confirmations-guide, governed-command-capability-matrix, steward-queue-guide, sync-rhythm-playbook, notifications-guide
 - Local agents and runners: mcp-and-cli-guide, runner-guide, agent-reference-map
 - Security and troubleshooting: ai-model-data-handling-guide, security-model-guide, troubleshooting-guide
 
@@ -50708,6 +50712,86 @@ The billing area in Settings answers:
 Settings labels subscription usage separately from the setup model allowance and the inference hard cap. Payment methods and invoice payment stay in Stripe. {{brand}} renders subscription ids/status and invoice summaries only; it does not store card, bank, payment-method, or invoice-payment details.
 
 Do not claim that a live charge happened unless Stripe test/live evidence proves it. For internal or design-partner validation, use Stripe test mode only unless a human owner explicitly completes a real live-payment step.`
+  },
+  {
+    slug: "governed-command-capability-matrix",
+    order: 72,
+    title: "Governed command capability matrix",
+    summary: "How to read {{brand}}'s command capability classification: the four confirmation classes, the Trusted-eligibility classes, the five-command auto band, and the always-human floor.",
+    version: "2026-07-20.1",
+    public: true,
+    audiences: ["human", "cli", "mcp", "in_app_agent"],
+    stages: ["charter_design", "staffing", "operating_rhythm"],
+    relatedCommandIds: [
+      "command.list",
+      "command.describe",
+      "agent.update_schedule",
+      "goal.bind_measurable",
+      "skill.assign_to_seat",
+      "friction.resolve",
+      "agent.run_now",
+      "agent.trust.create",
+      "confirmation.approve"
+    ],
+    legal: {
+      publicRisk: "low",
+      notes: [
+        "Describes {{brand}}-native command governance classification; no third-party or proprietary content."
+      ]
+    },
+    sources: [
+      {
+        label: "Governed command capability matrix (generated)",
+        internalPath: "docs/reference/governed-command-capability-matrix.md",
+        note: "Authoritative, command-by-command capability table regenerated from the command registry (`pnpm generate:capability-matrix`) and kept in sync by a drift test."
+      }
+    ],
+    body: `# Governed command capability matrix
+
+Every {{brand}} command that changes state \u2014 through the human app, the CLI, an MCP client, or the in-app AI Chief of Staff \u2014 carries the same registry-derived governance classification. This guide answers the question every agent and every human operator eventually asks: what can my agents do right now, and how do I change that? Which commands ask a human every time, which can automate under Trusted mode, and which stay off-limits to automation no matter what.
+
+The full command-by-command table is generated directly from the command registry and lives at \`docs/reference/governed-command-capability-matrix.md\`. A drift test keeps it honest: it fails CI the moment the registry changes without the table being regenerated, so the table can never quietly go stale. This guide is the curated companion \u2014 read it first to understand the classification scheme, then open the generated table to look up any specific command's exact row.
+
+## The four confirmation classes
+
+Every command declares one of four confirmation classes:
+
+- **None** \u2014 no human gate at all. The command runs immediately (for example a status update, a work log entry, or a task creation the acting seat already owns).
+- **Human required** \u2014 the durable-change default. The command mints a pending confirmation a human must approve before it takes effect, unless it qualifies for Trusted auto-band execution (below).
+- **Credential flow** \u2014 the command routes through the vault-backed credential flow. A raw secret never appears in a prompt, a log, or a CLI argument.
+- **Dangerous** \u2014 an irreversible or high-blast-radius action (for example decommissioning an agent) that always asks, with extra confirmation friction.
+
+## The Trusted-eligibility classes
+
+Turning on Trusted mode for a seat does not change a command's confirmation class. It changes whether that seat may execute a \`human_required\` command's proposal automatically, under a standing authorization a human deliberately established. Every action taken this way is still recorded as its own human-authorized decision \u2014 Trusted mode automates the button-press, not the accountability. Every command falls into one of four Trusted-eligibility classes:
+
+- **Auto** \u2014 a small, confirmation-free allowlist of low-risk worker actions (status updates, task creation, work logging, and similar) that already run without a human gate and are safe for a Trusted agent to keep doing unattended.
+- **Auto-bounded** \u2014 a \`human_required\` command that may auto-execute under Trusted, but only for a narrow, founder-approved bounded sub-case of its input (the five-command auto band, below). Every other input on the same command still mints a normal human confirmation.
+- **Always ask** \u2014 a command carrying a protected risk category (credential, spend, external send, production/go-live, destructive, self-approval, or admin) or otherwise gated. Trusted mode never changes this; it always asks a human.
+- **Not applicable** \u2014 a discovery or read command with no durable action to automate.
+
+## The five-command auto band
+
+Exactly five commands carry an auto band today \u2014 a founder-approved, narrow bounded sub-case where a \`human_required\` command may auto-execute under a standing Trusted grant on a human-initiated turn. Any input outside the described bound still mints a human confirmation:
+
+1. **\`agent.update_schedule\`** (schedule set) \u2014 setting or changing a seat's routine schedule. Clearing a schedule is out of band and still asks.
+2. **\`goal.bind_measurable\`** (informs Signal bind) \u2014 binding a Signal in the conservative "informs" role, which never drives goal status. A "drives status" binding is out of band and still asks.
+3. **\`skill.assign_to_seat\`** (published skill assign) \u2014 assigning an already-published, immutable skill version to a seat. A proposed (non-approved) assignment, or a version that does not resolve to a published skill, is out of band and still asks.
+4. **\`friction.resolve\`** (routine Friction resolve) \u2014 resolving a Friction the acting seat already owns within its own member-seat subtree. A Friction outside that subtree, or a turn with no identifiable human initiator, is out of band and still asks.
+5. **\`agent.run_now\`** (same-seat run now) \u2014 re-running the acting seat's own live agent. A cross-seat dispatch, where one seat runs a different seat's agent, is out of band and still asks.
+
+Widening this set, or adding a sixth command, is a deliberate founder decision \u2014 not something a code change alone can slip in. The registry enforces it: a command cannot carry an auto band unless it is one of these five ids.
+
+## The always-human floor
+
+A command carrying any of these risk categories always asks a human, even under Trusted mode: credential handling, spend or billing changes, external sends (invitations, outbound messages), production or go-live actions, destructive actions, self-approval of your own confirmation, or an admin-scope change. No autonomy setting removes this floor. It is a deliberate, conservative-by-default boundary \u2014 see confirmations-guide for how human gates work end to end.
+
+## Where to look up a specific command
+
+- The generated, authoritative table: \`docs/reference/governed-command-capability-matrix.md\` \u2014 one row per command with its required scope, confirmation class, Trusted mode, autonomy class, auto-band class (when it has one), MCP exposure, CLI availability, and whether the AI Chief of Staff can reach it as a governed tool call.
+- A single command's exact schema and classification: {{cli}} command schema <id> (CLI) or rost_describe_command (MCP).
+- How pending confirmations are approved or rejected: confirmations-guide.
+- How Trusted grants are created, inspected, and revoked: agent-staffing-playbook.`
   },
   {
     slug: "settings-guide",
@@ -50920,7 +51004,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-20.1",
+    version: "2026-07-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -51016,7 +51100,7 @@ Use this flow when a headless or desktop runner cannot use the interactive web c
 
 ## When to stop for confirmation
 
-\`runner.pairing.start\`, \`work_order.enqueue\`, and \`agent.run_now\` are \`none\`, so they do not create a separate pending confirmation, but \`runner.pairing.start\` is still owner/admin-only at the command authorization layer. \`runner.revoke\` and \`work_order.cancel\` are \`human_required\`. List and status reads are not gated. Revoking a runner or cancelling work is the human-approved act. An agent inspects runner state and proposes the action.
+\`runner.pairing.start\` and \`work_order.enqueue\` are \`none\`, so they do not create a separate pending confirmation, but \`runner.pairing.start\` is still owner/admin-only at the command authorization layer. \`runner.revoke\`, \`work_order.cancel\`, and \`agent.run_now\` are \`human_required\` (DER-1766/DER-2081): a cross-seat run always asks, and a same-seat re-run of the acting seat's own agent may auto-execute only under a standing Trusted grant. List and status reads are not gated. Revoking a runner or cancelling work is the human-approved act. An agent inspects runner state and proposes the action.
 
 ## Guardrails
 
@@ -52916,7 +53000,7 @@ var COMMAND_MANIFEST = [
   { "id": "agent.resume", "namespace": "agent", "action": "resume", "title": "Resume agent", "description": "Resume a paused agent back to live. Blocks if the steward chain no longer resolves to a human.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resume a paused agent back to live; the no-orphan guard blocks a resume whose steward chain no longer resolves to a human." },
   { "id": "agent.run_dry_run", "namespace": "agent", "action": "run_dry_run", "title": "Run agent dry run", "description": "Run the sandbox dry run for a draft agent. Durable and idempotent per Charter version; a passed result is reused, never re-run.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "charter_version_id", "flag": "charter-version-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Run the sandbox dry run for a draft agent after the manifest is signed; the result is durable and idempotent per Charter version, and a passed run is reused.", "example": { "seat_id": "0190aaaa-aaaa-7aaa-8aaa-aaaaaaaaaaaa", "charter_version_id": "0190cccc-cccc-7ccc-8ccc-cccccccccccc" } },
   { "id": "agent.run_heartbeats", "namespace": "agent", "action": "run_heartbeats", "title": "Get run heartbeats", "description": "Reads the per-seat run-heartbeat roll-up (quiet-but-healthy vs stalled) for long-running agent programs.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_ids", "flag": "seat-ids", "type": "array", "required": false, "itemType": "string" }], "hasComplexInput": false, "help": "Read the per-seat run-heartbeat roll-up to tell a quiet-but-healthy long-running agent program apart from a stalled one." },
-  { "id": "agent.run_now", "namespace": "agent", "action": "run_now", "title": "Run agent now", "description": "Queue and dispatch an immediate work order for a live cloud or runner agent on a seat. task_id is cloud-lane only; a runner-lane agent rejects it.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Queue and dispatch an immediate live agent run without changing the agent's saved schedule. task_id is cloud-lane only; a runner-lane agent rejects it (run task-linked runner work as an interactive agent turn)." },
+  { "id": "agent.run_now", "namespace": "agent", "action": "run_now", "title": "Run agent now", "description": "Queue and dispatch an immediate work order for a live cloud or runner agent on a seat. task_id is cloud-lane only; a runner-lane agent rejects it.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Queue and dispatch an immediate live agent run without changing the agent's saved schedule. task_id is cloud-lane only; a runner-lane agent rejects it (run task-linked runner work as an interactive agent turn)." },
   { "id": "agent.show_markdown", "namespace": "agent", "action": "show_markdown", "title": "Show agent setup as markdown", "description": "Compose a seat's agent setup, steward, model, tools, and Charter into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Render a seat's agent setup, model, steward, tools, and Charter as a clean markdown card to show your human a quick review." },
   { "id": "agent.status", "namespace": "agent", "action": "status", "title": "Get agent status", "description": "Return the agent occupancy, lane, schedule, live/offline state, steward chain, dry-run result, and Runner availability for a seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Check an agent's lane, live state, steward chain, dry-run result, and Runner availability before relying on it." },
   { "id": "agent.trust.create", "namespace": "agent", "action": "trust.create", "title": "Create agent Trusted grant", "description": "Create a bounded Trusted execution grant for a live agent after a human steward/admin signs the current activation receipt digest.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "agent_id", "flag": "agent-id", "type": "string", "required": true }, { "name": "expected_scope_digest", "flag": "expected-scope-digest", "type": "string", "required": true }, { "name": "budget_cents", "flag": "budget-cents", "type": "integer", "required": true }, { "name": "expires_at", "flag": "expires-at", "type": "string", "required": false }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Create a bounded Trusted execution grant only after reviewing the activation receipt digest, budget, and always-human boundary. Human steward/admin only." },
@@ -55723,7 +55807,8 @@ var RUNNER_ASKPASS_DIR = path4.join(tmpdir(), "rost-runner-askpass");
 var RUNNER_TEMP_PREFIXES = [
   "rost-runner-mcp-",
   "rost-runner-sandbox-",
-  "rost-runner-askpass-"
+  "rost-runner-askpass-",
+  "rost-runner-claude-config-"
 ];
 var RUNNER_TEMP_STARTUP_SWEEP_MAX_AGE_MS = 60 * 60 * 1e3;
 var RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS = 45 * 60 * 1e3;
@@ -56820,7 +56905,7 @@ function parseSemver2(value) {
 import { execFile as execFileCallback5, spawn } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
 import { constants as fsConstants2 } from "node:fs";
-import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile5, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
+import { access as access3, chmod as chmod2, mkdir as mkdir5, readFile as readFile6, rename, rm as rm5, statfs, writeFile as writeFile5 } from "node:fs/promises";
 import { cpus, homedir as homedir4, hostname as hostname3, platform, totalmem, tmpdir as tmpdir2 } from "node:os";
 import path7 from "node:path";
 import { setTimeout as sleep3 } from "node:timers/promises";
@@ -56829,7 +56914,8 @@ import { promisify as promisify5 } from "node:util";
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, lstat, mkdir as mkdir4, mkdtemp, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import { chmod, lstat, mkdir as mkdir4, mkdtemp, readFile as readFile5, realpath, rm as rm4, stat as stat3, writeFile as writeFile4 } from "node:fs/promises";
+import os2 from "node:os";
 import path6 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
@@ -56908,7 +56994,7 @@ var MODEL_SPAWN_ENV_ALLOWLIST = [
   "SHELL",
   "NODE_OPTIONS"
 ];
-function buildModelSpawnEnv(base) {
+function buildModelSpawnEnv(base, claudeConfigDir) {
   const out = {};
   for (const key of MODEL_SPAWN_ENV_ALLOWLIST) {
     const value = base[key];
@@ -56916,8 +57002,36 @@ function buildModelSpawnEnv(base) {
       out[key] = value;
     }
   }
+  if (typeof claudeConfigDir === "string" && claudeConfigDir.length > 0) {
+    out.CLAUDE_CONFIG_DIR = claudeConfigDir;
+  }
   return out;
 }
+var CLAUDE_CONFIG_AUTH_FILES = [".credentials.json", ".claude.json"];
+function resolveSourceClaudeConfigDir(base) {
+  const explicit = base.CLAUDE_CONFIG_DIR;
+  if (typeof explicit === "string" && explicit.length > 0) {
+    return explicit;
+  }
+  const home = base.HOME;
+  const homeDir = typeof home === "string" && home.length > 0 ? home : os2.homedir();
+  return path6.join(homeDir, ".claude");
+}
+async function provisionIsolatedClaudeConfigDir(base, configDir) {
+  await mkdir4(configDir, { recursive: true, mode: 448 });
+  await chmod(configDir, 448);
+  const source = resolveSourceClaudeConfigDir(base);
+  for (const file2 of CLAUDE_CONFIG_AUTH_FILES) {
+    try {
+      const data = await readFile5(path6.join(source, file2));
+      const dest = path6.join(configDir, file2);
+      await writeFile4(dest, data, { mode: 384 });
+      await chmod(dest, 384);
+    } catch {
+    }
+  }
+  return configDir;
+}
 var GIT_HARDENING_ARGS = [
   "-c",
   "core.hooksPath=/dev/null",
@@ -58111,7 +58225,7 @@ async function pairIfNeeded(client, fetchImpl, appUrl2, config2, io) {
 }
 async function loadState(filePath, expectedTenantId) {
   try {
-    const parsed = JSON.parse(await readFile5(filePath, "utf8"));
+    const parsed = JSON.parse(await readFile6(filePath, "utf8"));
     if (typeof parsed.runner_id === "string" && typeof parsed.runner_secret === "string") {
       if (expectedTenantId && parsed.tenant_id !== expectedTenantId) {
         return null;
@@ -58578,6 +58692,9 @@ function resolveTurnPlan(input) {
     return {
       profile: "read_status",
       claudeAllowedTools: [...input.kind === "turn_execution" ? RUNNER_AICOS_TURN_TOOLS : RUNNER_WORK_ORDER_TOOLS],
+      // DER-2104: the read stub is MCP-only — no local built-ins. `--tools ""` now enforces
+      // that (previously nothing did, so a stub turn silently inherited full local access).
+      localBuiltinTools: [],
       codexSandbox: "read-only",
       outputFormat: input.kind === "turn_execution" ? "json" : "text",
       repoDir: null,
@@ -58592,6 +58709,9 @@ function resolveTurnPlan(input) {
       ...execution.allowed_mcp_tools.map(claudeMcpToolName),
       ...claudeLocalToolsFor(execution.local_tools)
     ],
+    // DER-2104: the same built-in set, but as the `--tools` HARD whitelist (not the
+    // auto-approve list). `none` → `[]` → `--tools ""` → zero built-ins for a seat_work turn.
+    localBuiltinTools: claudeLocalToolsFor(execution.local_tools),
     codexSandbox: execution.local_tools === "workspace_write" ? "workspace-write" : "read-only",
     // Forge build/review turns emit a structured JSON envelope (reusing the AICOS
     // --output-format json pattern) so their summary is a real contract, not a stdout slice.
@@ -58641,8 +58761,19 @@ function buildTurnCommand(input) {
       "--mcp-config",
       configPath,
       "--strict-mcp-config",
+      // DER-2104: --tools is the HARD built-in whitelist. `--tools ""` (empty join for
+      // local_tools "none") removes Bash/Read/Write/Edit/… entirely, and the operator's
+      // settings.json cannot widen it — the real enforcement of `local_tools`. --allowedTools
+      // stays as the auto-approve list for the governed MCP + any declared local built-ins.
+      "--tools",
+      plan.localBuiltinTools.join(","),
       "--allowedTools",
       plan.claudeAllowedTools.join(","),
+      // DER-2104: unattended turns must never wait on a prompt — dontAsk auto-denies any tool
+      // call that would otherwise prompt. Governed MCP tools and the declared local built-ins
+      // are in --allowedTools (auto-approved, never prompt), so this only denies the unexpected.
+      "--permission-mode",
+      "dontAsk",
       "--output-format",
       plan.outputFormat,
       // DER-1397: turn off Claude Code's own nested Bash sandbox when the outer seatbelt confines
@@ -58894,6 +59025,10 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
+  const claudeConfigDir = runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
+    process.env,
+    path7.join(tmpdir2(), `rost-runner-claude-config-${createHash2("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`)
+  ) : null;
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(ctx.state, workOrder) : void 0;
   const built = buildTurnCommand({
     runtime,
@@ -58922,7 +59057,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
     // A Forge turn's cwd is its worktree; every other turn stays in tmpdir.
     cwd: plan.repoDir ?? tmpdir2(),
     timeoutMs: plan.timeoutMs,
-    env: buildModelSpawnEnv(process.env),
+    env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0),
     expectSessionEnvelope,
     resumeSessionId,
     // T1.6: only Forge turns carry a structured evidence contract worth parsing.
@@ -58951,6 +59086,9 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  if (claudeConfigDir) {
+    void rm5(claudeConfigDir, { recursive: true, force: true });
+  }
   void sweepOrphanedTurnTempFiles();
   if (forgePrep) {
     if (plan.profile === "forge_build" && result.ok && forgePrep.credential.canPush) {
@@ -59098,6 +59236,10 @@ async function spawnMergeConflictModel(ctx, input) {
   await writeFile5(configPath, `${mcpConfig}
 `, { mode: 384 });
   await chmod2(configPath, 384);
+  const claudeConfigDir = input.runtime === "claude" ? await provisionIsolatedClaudeConfigDir(
+    process.env,
+    path7.join(tmpdir2(), `rost-runner-claude-config-${createHash2("sha256").update(`${configPath}:cfg`).digest("hex").slice(0, 16)}`)
+  ) : null;
   const plan = resolveTurnPlan({ kind: "work_order", execution: input.execution, repoDir: input.workspace.worktreeDir });
   const prompt = [
     "You are resolving a merge conflict on a pull request branch so it can merge into the base branch.",
@@ -59127,7 +59269,7 @@ async function spawnMergeConflictModel(ctx, input) {
     cwd: input.workspace.worktreeDir,
     timeoutMs: plan.timeoutMs,
     // The model gets the EXPLICIT allowlist env — never the merge token, GIT_ASKPASS, or the bearer.
-    env: buildModelSpawnEnv(process.env),
+    env: buildModelSpawnEnv(process.env, claudeConfigDir ?? void 0),
     expectSessionEnvelope: false
   });
   const exitClass = classifyModelExit(result);
@@ -59143,6 +59285,9 @@ async function spawnMergeConflictModel(ctx, input) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  if (claudeConfigDir) {
+    void rm5(claudeConfigDir, { recursive: true, force: true });
+  }
   void sweepOrphanedTurnTempFiles();
   return result;
 }