@rosthq/cli 0.7.55 → 0.7.62

package/dist/index.js

@@ -13258,6 +13258,7 @@ var require_main3 = __commonJS({
 
 // src/index.ts
 import { realpathSync as realpathSync3 } from "node:fs";
+import { createInterface } from "node:readline/promises";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -39054,6 +39055,23 @@ var agentBuilderToolProposalSchema = external_exports.object({
   connected: external_exports.boolean(),
   declined: external_exports.boolean()
 }).strict();
+var agentBuilderConfirmationEvidenceSchema = external_exports.object({
+  source: external_exports.object({
+    kind: external_exports.enum(["transcript", "artifact"]),
+    summary: external_exports.string().trim().min(1).max(240)
+  }).strict().optional(),
+  proposedLifecycleCommand: external_exports.object({
+    commandId: external_exports.enum(["agent.create_custom", "agent.configure_tools", "agent.run_dry_run", "agent.go_live"]),
+    summary: external_exports.string().trim().min(1).max(360),
+    inputSummary: external_exports.string().trim().min(1).max(360).optional()
+  }).strict(),
+  stageAudit: external_exports.object({
+    guardResult: external_exports.enum(["allowed", "denied_manifest", "denied_budget", "escalated", "denied_tenant_policy"]),
+    outcome: external_exports.string().trim().min(1).max(120),
+    manifestClause: external_exports.string().trim().min(1).max(240).optional(),
+    toolCallId: external_exports.string().trim().min(1).max(120).optional()
+  }).strict().optional()
+}).strict();
 var agentBuilderQuestionSchema = external_exports.object({
   id: external_exports.string().trim().min(1).max(120),
   field: external_exports.enum([
@@ -39089,6 +39107,7 @@ var agentBuilderPendingConfirmationCardSchema = external_exports.object({
   humanGateLabel: external_exports.string().trim().min(1).max(120),
   riskLevel: external_exports.enum(["normal", "sensitive", "dangerous"]),
   confirmationId: external_exports.string().trim().min(1).max(120).optional(),
+  evidence: agentBuilderConfirmationEvidenceSchema.optional(),
   approveVia: external_exports.object({
     webUrl: external_exports.string().trim().min(1).max(500).optional(),
     cliCommand: external_exports.string().trim().min(1).max(500).optional()
@@ -39193,6 +39212,13 @@ var AGENT_POLICY_DEFAULT = {
   max_autonomous_risk: AGENT_POLICY_PROFILE_CEILINGS.balanced
 };
 
+// ../../packages/protocol/src/confirmation-policy.ts
+var CLI_CONFIRMATION_MODES = ["trusted_operator", "careful"];
+var cliConfirmationModeSchema = external_exports.enum(CLI_CONFIRMATION_MODES);
+var storedConfirmationPolicySchema = external_exports.object({
+  cli_mode: cliConfirmationModeSchema
+}).strict();
+
 // ../../packages/protocol/src/aicos.ts
 var uuidSchema5 = external_exports.string().uuid();
 var jsonObjectSchema = external_exports.record(external_exports.string(), external_exports.unknown());
@@ -39307,7 +39333,12 @@ var aicosPendingTurnSchema = external_exports.object({
   linkedRunId: uuidSchema5.nullable(),
   interactiveDeadline: external_exports.string().datetime({ offset: true }),
   terminalReason: external_exports.string().min(1).max(120).nullable().default(null),
+  claimLatencyMs: external_exports.number().int().nonnegative().nullable().default(null),
+  runtimeDurationMs: external_exports.number().int().nonnegative().nullable().default(null),
   totalDurationMs: external_exports.number().int().nonnegative().nullable().default(null),
+  createdAt: external_exports.string().datetime({ offset: true }),
+  claimedAt: external_exports.string().datetime({ offset: true }).nullable().default(null),
+  startedAt: external_exports.string().datetime({ offset: true }).nullable().default(null),
   updatedAt: external_exports.string().datetime({ offset: true })
 }).strict();
 var aicosMessageRoleSchema = external_exports.enum(["user", "assistant", "tool", "system"]);
@@ -39434,17 +39465,38 @@ var AICOS_ATTACHMENT_CONTENT_TYPES = ["image/png", "image/jpeg", "image/webp", "
 var AICOS_ATTACHMENT_MAX_BYTES = 10 * 1024 * 1024;
 var AICOS_MAX_ATTACHMENTS_PER_TURN = 4;
 var aicosAttachmentContentTypeSchema = external_exports.enum(AICOS_ATTACHMENT_CONTENT_TYPES);
+var AICOS_ATTACHMENT_READINESS = ["ready", "unavailable", "expired"];
+var aicosAttachmentReadinessSchema = external_exports.enum(AICOS_ATTACHMENT_READINESS);
 var aicosAttachmentSchema = external_exports.object({
   id: uuidSchema5,
   contentType: aicosAttachmentContentTypeSchema,
   sizeBytes: external_exports.number().int().positive(),
   width: external_exports.number().int().positive().nullable(),
   height: external_exports.number().int().positive().nullable(),
-  filename: external_exports.string().max(255).nullable()
+  filename: external_exports.string().max(255).nullable(),
+  // DER-1470: null/absent ref_status reads as "ready" (usable) for back-compat.
+  readiness: aicosAttachmentReadinessSchema.default("ready")
 }).strict();
 var aicosAttachmentUploadResultSchema = external_exports.object({
   attachment: aicosAttachmentSchema
 }).strict();
+var aicosRunnerAttachmentRefSchema = external_exports.object({
+  id: uuidSchema5,
+  content_type: aicosAttachmentContentTypeSchema,
+  size_bytes: external_exports.number().int().positive(),
+  width: external_exports.number().int().positive().nullable(),
+  height: external_exports.number().int().positive().nullable(),
+  filename: external_exports.string().max(255).nullable(),
+  signed_url: external_exports.string().url().nullable(),
+  signed_url_expires_in_seconds: external_exports.number().int().positive().nullable(),
+  expires_at: external_exports.string().datetime({ offset: true }).nullable(),
+  readiness: aicosAttachmentReadinessSchema
+}).strict();
+var AICOS_RUNNER_ATTACHMENT_OUTCOMES = ["used", "expired", "load_failed"];
+var aicosRunnerAttachmentOutcomeSchema = external_exports.object({
+  id: uuidSchema5,
+  outcome: external_exports.enum(AICOS_RUNNER_ATTACHMENT_OUTCOMES)
+}).strict();
 var aicosMessageSchema = external_exports.object({
   id: uuidSchema5,
   sessionId: uuidSchema5,
@@ -39486,6 +39538,7 @@ var aicosAgentBuilderMetadataSchema = external_exports.object({
   agentBuilder: agentBuilderCompilationSchema
 }).strict();
 var aicosTurnRequestSchema = external_exports.object({
+  requestId: uuidSchema5,
   sessionId: uuidSchema5.nullable().optional(),
   purpose: aicosConversationPurposeSchema.default("general"),
   // Empty is permitted only when attachments are present (an image-only turn);
@@ -41153,6 +41206,8 @@ var MCP_ONBOARDING_TOOL_NAMES = {
   setCompass: `${MCP_TOOL_PREFIX}_set_compass`,
   staffSeat: `${MCP_TOOL_PREFIX}_staff_seat`
 };
+var FORGE_TURN_HARD_CEILING_SECONDS = 30 * 60;
+var FORGE_TURN_PHASE_OVERHEAD_SECONDS = 20 * 60;
 
 // ../../packages/protocol/src/mcp-onboarding.ts
 var MCP_TOKEN_ABSOLUTE_MAX_EXPIRY_MS = (MCP_TOKEN_NO_EXPIRY_SENTINEL_DAYS + 1) * 24 * 60 * 60 * 1e3;
@@ -41340,7 +41395,15 @@ var pendingConfirmationSchema = external_exports.object({
   }).strict()
 }).strict();
 var confirmationApproveInputSchema = external_exports.object({
-  confirmation_id: external_exports.string().min(1)
+  confirmation_id: external_exports.string().min(1),
+  // DER-1490 — the auditable "reviewed" signal. The CLI sets it true ONLY after
+  // rendering the confirmation gate to (and, at an interactive TTY, getting an
+  // explicit `y` from) the human. Absent = a silent auto-replay; the server refuses
+  // that path under the tenant's `careful` mode, and for `dangerous` risk in either
+  // mode (see requiresReviewSignal). It is an explicit auditable field, not a TTY
+  // heuristic — the server cannot cryptographically distinguish a human `y` from an
+  // agent replaying a live session token (both arrive as source cli, actor.kind user).
+  reviewed: external_exports.boolean().optional()
 }).strict();
 var confirmationRejectInputSchema = external_exports.object({
   confirmation_id: external_exports.string().min(1),
@@ -41887,7 +41950,7 @@ var fleetDigestAgentSchema = fleetOverviewRowSchema.extend({
   spend_7d_usd: external_exports.string(),
   spend_30d_usd: external_exports.string(),
   cost_drift_percent: external_exports.number().int().nullable(),
-  health_status: external_exports.enum(["needs_review", "stale", "setup_gap", "healthy"]),
+  health_status: external_exports.enum(["needs_review", "stale", "setup_gap", "awaiting_data", "healthy"]),
   health_reasons: external_exports.array(external_exports.string()),
   recent_failed_runs: external_exports.array(fleetDigestRunSchema),
   unresolved_errors: external_exports.array(fleetDigestErrorSchema),
@@ -42127,6 +42190,7 @@ var runnerExecutionStateSchema = external_exports.enum([
   "processing",
   "idle_unproven",
   "queued_unclaimed",
+  "model_account_exhausted",
   "missing_runtime",
   "not_connected",
   "revoked",
@@ -42142,8 +42206,9 @@ var runnerExecutionReadinessSchema = external_exports.object({
   recent_completed_at: isoDateTime4.nullable(),
   recent_failed_at: isoDateTime4.nullable()
 }).strict();
+var runnerSandboxPostureSchema = external_exports.enum(["guard", "strict", "off", "none", "unknown"]);
 var runnerPostureSchema = external_exports.object({
-  sandbox: external_exports.enum(["guard", "strict", "off", "none", "unknown"]),
+  sandbox: runnerSandboxPostureSchema,
   network: external_exports.enum(["allow", "deny", "unknown"]),
   capability_set: external_exports.array(external_exports.string())
 }).strict();
@@ -42385,6 +42450,17 @@ var agentPolicyUpdateInputSchema = external_exports.object({
     });
   }
 });
+var confirmationPolicyDtoSchema = external_exports.object({
+  cli_mode: cliConfirmationModeSchema,
+  explicit: external_exports.boolean()
+}).strict();
+var confirmationPolicyGetInputSchema = external_exports.object({}).strict();
+var confirmationPolicyGetOutputSchema = external_exports.object({
+  confirmation_policy: confirmationPolicyDtoSchema
+}).strict();
+var confirmationPolicyUpdateInputSchema = external_exports.object({
+  cli_mode: cliConfirmationModeSchema
+}).strict();
 var tenantSpendStatusSchema = external_exports.object({
   spend_usd: external_exports.string(),
   soft_cap_usd: external_exports.string().nullable(),
@@ -42880,6 +42956,20 @@ var softwareTerminationBoundSchema = external_exports.object({
   max_wall_clock_seconds: external_exports.number().int().positive().max(7 * 24 * 60 * 60).optional(),
   cost_budget_usd: external_exports.number().nonnegative().max(1e6).optional()
 }).strict();
+var softwarePhaseSchedulerStateSchema = external_exports.object({
+  status: external_exports.enum(["queued", "parked", "not_configured"]),
+  reason: external_exports.enum([
+    "phase_run_not_found",
+    "missing_owning_seat",
+    "missing_runner_agent",
+    "runner_not_paired",
+    "work_order_expired",
+    "runner_offline"
+  ]).nullable(),
+  message: external_exports.string(),
+  remediation_href: external_exports.string().nullable(),
+  work_order_id: uuid10.nullable()
+});
 var softwareBuildRequestSummarySchema = external_exports.object({
   id: uuid10,
   software_project_id: uuid10,
@@ -42894,7 +42984,8 @@ var softwareBuildRequestSummarySchema = external_exports.object({
   max_wall_clock_seconds: external_exports.number().int().nullable(),
   cost_budget_usd: external_exports.string().nullable(),
   iterations_used: external_exports.number().int(),
-  created_at: external_exports.string()
+  created_at: external_exports.string(),
+  scheduler_state: softwarePhaseSchedulerStateSchema.nullable()
 });
 var softwarePhaseRunSummarySchema = external_exports.object({
   id: uuid10,
@@ -42903,7 +42994,8 @@ var softwarePhaseRunSummarySchema = external_exports.object({
   attempt_no: external_exports.number().int(),
   entered_at: external_exports.string().nullable(),
   exited_at: external_exports.string().nullable(),
-  created_at: external_exports.string()
+  created_at: external_exports.string(),
+  scheduler_state: softwarePhaseSchedulerStateSchema.nullable()
 });
 var softwareGateSummarySchema = external_exports.object({
   id: uuid10,
@@ -43054,7 +43146,8 @@ var softwareRequestCreateOutputSchema = external_exports.object({
   software_project_id: uuid10,
   status: softwareRequestStatusSchema,
   current_phase: softwarePhaseSchema,
-  phase_run_id: uuid10
+  phase_run_id: uuid10,
+  scheduler_state: softwarePhaseSchedulerStateSchema
 });
 var softwareRequestListInputSchema = external_exports.object({
   limit: external_exports.number().int().positive().max(200).optional()
@@ -44175,6 +44268,13 @@ var issueEventPayloadSchema = external_exports.object({
   severity: external_exports.enum(["low", "med", "high", "critical"])
 }).strict();
 
+// ../../packages/protocol/src/held-tool-action.ts
+var heldToolActionReplaySchema = external_exports.object({
+  tool_name: external_exports.string().min(1),
+  args: external_exports.record(external_exports.string(), external_exports.unknown()),
+  run_id: external_exports.string().uuid()
+}).strict();
+
 // ../../packages/protocol/src/operating.ts
 var uuidSchema17 = external_exports.string().uuid();
 var taskListInputSchema = external_exports.object({}).strict();
@@ -44340,7 +44440,12 @@ var escalationDecisionOutputSchema = external_exports.object({
   status: escalationStatusSchema,
   decision_id: uuidSchema18,
   decided_by: uuidSchema18,
-  issue_id: uuidSchema18.nullable()
+  issue_id: uuidSchema18.nullable(),
+  // DER-1478: true when the resolved escalation carries a durable replay_action
+  // (an approval-gated connector write) that the approvals path should actuate
+  // after this decision is recorded. Omitted (not false) for non-connector
+  // escalations to keep existing callers' output shape unchanged.
+  replay_action_pending: external_exports.boolean().optional()
 }).strict();
 
 // ../../packages/protocol/src/index.ts
@@ -44766,7 +44871,7 @@ The Compass is drafted, then activated by a human through supersession.
     order: 15,
     title: "AICOS chat guide",
     summary: "How the AI Chief of Staff chat works in the authenticated app shell and what it can safely do today.",
-    version: "2026-07-08.1",
+    version: "2026-07-10.2",
     public: true,
     audiences: ["human", "in_app_agent"],
     stages: ["company_setup", "operating_rhythm"],
@@ -44834,10 +44939,12 @@ Each turn carries server-normalized page context: route template, current path,
 
 The current chat harness shows the effective lane and model. Cloud is the default and remains the enforced lane during onboarding, even if a post-onboarding lane has been selected. After onboarding, an owner or admin can select cloud, runner, or MCP only when the server says that lane is ready. Lane changes update the governed AICOS agent seat and write an append-only audit event; the browser never decides tenant authority or runner/MCP readiness.
 
-AICOS also has an explicit brain selection. Cloud can use the included managed allowance or a tenant Anthropic key (BYOK). Runner can target the paired machine's Claude subscription or Codex subscription. MCP is labeled as the MCP client. Read this selection with \`aicos.brain_settings.get\`; owners can update it with \`aicos.brain_settings.update\` (CLI flags: \`--lane\`, \`--cloud-brain managed|byok\`, \`--runner-brain claude-cli|codex-cli\`). BYOK requires an active tenant Anthropic key. Runner and MCP answers are labeled in the transcript and do not consume the managed cloud allowance.
+AICOS also has an explicit brain selection. Cloud can use the included managed allowance or a tenant Anthropic key (BYOK). Runner brain preference still records Claude or Codex, but interactive AICOS runner turns are currently gated to Claude while the Codex path remains unverified. MCP is labeled as the MCP client. Read this selection with \`aicos.brain_settings.get\`; owners can update it with \`aicos.brain_settings.update\` (CLI flags: \`--lane\`, \`--cloud-brain managed|byok\`, \`--runner-brain claude-cli|codex-cli\`). BYOK requires an active tenant Anthropic key. Choosing \`codex-cli\` for AICOS runner mode is currently rejected with a precondition error until the governed interactive runner path is verified. Runner and MCP answers are labeled in the transcript and do not consume the managed cloud allowance. If the selected runner reports that its active local model account has exhausted its allowance, Settings surfaces **Allowance exhausted** before the user sends another AICOS turn so they can switch lanes, switch runner accounts, or keep working manually instead of waiting on a doomed runner round-trip.
 
 Runner mode uses the same AICOS sessions and transcript. Interactive chat turns are tracked separately from scheduled work orders: each user message has one user-owned turn execution with a short deadline, so two users' chat messages cannot collapse into the same scheduled-work slot. Scheduled and Forge runner work still use work orders. Runner claim packets carry ids and execution metadata, not the user's free-text request. After claim, the local runner calls the governed AICOS context-load tool, which re-checks seat scope and returns the bounded transcript, session summary, route context, tenant clock, grounding text, and source counts authorized for that turn. For execute-ready runners, the claim also carries a server-built Seat work contract that names the governed runtime profile, the AICOS context-loader tool, and the Seat's permission manifest; action attempts still route through command guards, tool-call audit, and pending confirmations. The runner treats loaded tenant clock, context, and contract as authoritative instead of substituting its own runtime clock, local files, or self-invented authority. A runner must be paired, execute-ready, and backed by the live AICOS agent before it can be selected.
 
+Cloud and runner submissions carry a stable request ID. Distinct requests that compete while a turn is active receive HTTP \`409\` with code \`AICOS_TURN_CONFLICT\`; the losing request writes no partial user message and consumes none of its attachments. Runner acquisition commits its user message, execution, attachment links, queued transcript projection, and session snapshot together, so a failed projection leaves none of them half-written. Retrying the same request ID returns the original turn and does not rerun the model, builder, onboarding, or runner-queue side effects, even if the currently selected lane or runner readiness changed after the original submission.
+
 When a runner claims an interactive AICOS turn, the runner reports start and final result back to {{brand}}. The turn row records claim/start/finish timing, terminal reason, model label, and token counts when the runner or cloud path provides them. The server appends exactly one assistant transcript message for the result, links that message to run evidence, and treats duplicate or late result reports as idempotent. If the runner answer includes a validated in-app link, the web panel can surface the same consent-required navigation suggestion once polling sees that the pending turn is terminal. If a queued, claimed, or running interactive turn passes its short deadline before a runner writes back, the turn is marked offline and the transcript receives a terminal assistant message instead of leaving a permanent "queued" placeholder.
 
 While a runner turn is queued, claimed, or running, the chat panel keeps showing the pending state and polls the session until the answer or terminal status arrives. The composer, model picker, and lane picker are disabled during that active turn so a second browser tab or direct API call cannot overlap another runner turn in the same thread. Terminal runner statuses such as failed, offline, or canceled stay visible only while they are still the latest user turn; if the user continues the conversation in another lane, the stale terminal marker is no longer projected at the bottom of the thread.
@@ -44852,7 +44959,7 @@ You can attach images to a message from the composer. {{brand}} accepts PNG, JPE
 
 AICOS can also retrieve bounded summaries from prior sessions owned by the same tenant user and surface them as session-memory read models. Setup-limited users do not retrieve sensitive historical run or company-memory summaries through this path. This is a practical memory seam for AICOS continuity; it is not yet the future Company Brain, and it does not make unaccepted knowledge authoritative.
 
-Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK, billing, or manual continuation. The chat transcript and Settings surface the exhaustion reason and provide direct paths to add a tenant Anthropic key or review the plan. Because the DER-1068 implementation still uses the deterministic harness, it does not create fake llm_calls rows or settle fake allowance usage; reservation/settlement belongs to the real provider call path.
+Platform allowance and BYOK state are checked before routing; an exhausted included allowance keeps AICOS in guided mode and points the user toward BYOK, billing, or manual continuation. The chat transcript and Settings surface the exhaustion reason and provide direct paths to add a tenant Anthropic key or review the plan. Cloud AICOS provider attempts write canonical run evidence and one linked \`llm_calls\` row with source metadata \`aicos_chat\`, prompt version, latency, token usage, cost, key source, and typed outcome. Managed-key turns consult the tenant hard cap before provider execution; BYOK turns never fall back to the managed platform key. Provider timeouts, provider server errors, empty output, and BYOK credential or allowance failures stay visible as terminal failed turns with retry or Settings recovery instead of being converted into a successful generic answer.
 
 During onboarding, the deterministic harness may execute only explicit low-risk draft actions. In the Responsibility Graph step, a user with setup/action authority can ask AICOS to create one named draft seat per turn; the seat stays vacant, is traceable to the AICOS message through artifact sources, and still needs human review before staffing, Charters, manifests, or go-live. Compass and Charter help remains draft guidance and clarifying questions until the live drafting planner lands. AICOS never silently finishes onboarding, approves Compass or Charter content, signs manifests, goes live, stores credentials, changes autonomy policy, or invites external people; those actions remain human-confirmed.
 
@@ -44915,7 +45022,7 @@ Treat AICOS as a coordinator over the operating system. It can become more usefu
     order: 20,
     title: "Responsibility Graph playbook",
     summary: "How to build a functions-first graph with seats, owners, Stewards, vacancies, and clean authority.",
-    version: "2026-07-07.2",
+    version: "2026-07-10.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["graph_design", "staffing"],
@@ -44959,7 +45066,7 @@ The graph always resolves to a single canonical root seat (Founder & CEO in the
 
 AICOS always stays a peer of the root (never a child of its steward) and never appears as an orphan in the unassigned set \u2014 this is intentional and not a data-quality issue.
 
-Seats that do not reach the single root through the resolved parent chain are listed as **unassigned** (with \`unassigned: true\` and no incoming edge). Each \`graph.get\` node carries an \`unassigned\` boolean, and the CLI \`rost graph show\` output prints unassigned seats under a separate \`Unassigned\` section so operators can see which parts of the chart need attention. The web canvas parks unassigned seats at the bottom of the chart instead of inventing fake root edges.
+Seats that do not reach the single root through the resolved parent chain are listed as **unassigned** (with \`unassigned: true\` and no incoming edge). Each \`graph.get\` node carries an \`unassigned\` boolean, and the CLI \`rost graph show\` output prints unassigned seats under a separate \`Unassigned\` section so operators can see which parts of the chart need attention. The web canvas parks unassigned seats at the bottom of the chart instead of inventing fake root edges, and when any exist a floating **Unassigned seats \u2014 needs attention** panel lists them by name; selecting one flies the canvas to that seat so the gap is one click from a fix, not just visible in the baseline row.
 
 ## Forge Developer Team seats are pinned
 
@@ -44992,7 +45099,9 @@ The graph also carries a mission-control panel. It pulls the same operational st
 
 ## An agent seat's profile
 
-A staffed agent's seat page opens on a profile built to answer one question in ten seconds: what is this agent, what does it know, what can it touch, and who is accountable. The hero shows live/paused/draft status, a one-line description, and when it last ran; a right-hand fact sheet stays visible on every tab with the Charter version, Skills, Connections (with a "connect" prompt when a Skill needs a provider that is not yet linked), an Access summary, and tool/held/model counts. Four tabs organize the rest: **Overview** (recent runs as one-line summaries, 30-day cost by model, and a version-history feed that tracks the agent itself as an actor alongside human Charter decisions), **Charter** (the accepted Charter rendered as a document \u2014 purpose, responsibilities, owned measurables, decision authority \u2014 with its version chip, signer, and an Amend action that opens the same draft-and-confirm amendment flow as the Charter Builder), **Access** (plain-language cards for what the agent does while you are watching versus running unattended, then every granted tool grouped under its Connection with a one-line description and Read/Draft/Held status), and **Activity** (the full Trust Card below). AICOS's seat keeps its own operations panel instead of this profile, because it is the company's foundation seat rather than a generic staffed agent.
+A staffed non-AICOS agent's seat page uses one profile shell with eight URL-addressable tabs: **Overview**, **Charter**, **Tools & connections**, **Skills**, **Autonomy**, **Signals**, **Activity**, and **Settings**. The hero shows status, Charter purpose, Steward, seat path, lane, model, and last run. The sidebar keeps access, connection, tool/Skill/Signal/escalation/Charter counters, and schedule facts visible while the tabs organize the existing read models and controls. Legacy links such as \`#agent-ops\`, \`#recent-runs\`, and \`#run-<id>\` select the matching Settings or Activity tab. Human seats and the AICOS foundation seat keep their dedicated pages. Members without sensitive-data access see the same shell with explicit unavailable states for run, tool-call, cost, connection-status, and escalation facts; the page never broadens Trust Card access or turns an unavailable read into a confident empty/disconnected claim.
+
+Agent creation at \`/agents/new\` begins with four doors: **Describe the job** opens the existing in-app builder, **Start from a template** opens the stock-template picker, **Build manually** opens the custom setup path, and **Import** opens an in-app format explainer. Definition-file import is roadmap-only and never opens a bare file picker; operators can instead continue to the existing-agent pairing flow. Existing \`?mode=template|custom|existing\` and \`?seat=\` resume links continue directly to their current flows.
 
 ## Review an agent seat's delivered work
 
@@ -45575,7 +45684,7 @@ Use the lower-level commands after health names a finding: \`agent.get_run\` for
     order: 46,
     title: "Tool access and vault",
     summary: "How to give agents access to tools without exposing raw credentials or expanding authority by accident.",
-    version: "2026-07-02.3",
+    version: "2026-07-02.4",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -45633,7 +45742,7 @@ Google can be connected from Settings once the workspace OAuth app is configured
 
 CLI and MCP can inspect connector readiness without seeing secrets: \`integration.list\` / \`rost_list_integrations\` lists connected providers and health metadata, \`integration.status\` / \`rost_get_integration_status\` reads one provider by id or name, and \`integration.test\` / \`rost_test_integration_connection\` runs the installed provider-specific health check. For Google, the test refreshes the vaulted OAuth credential and reads the Gmail profile, then records only account, scope, and health metadata.
 
-\`integration.connect_rest\` / \`rost_connect_rest_integration\` creates or rotates the supported Baserow REST integration through the credential flow. It stores the token in the vault, persists only endpoint/account metadata plus a tenant-scoped integration row, marks the adapter as \`rest\`, and returns no vault ref or secret. Because the input includes a raw secret, generated CLI argv refuses the command; use Settings or the command API credential flow instead of shell arguments.
+\`integration.connect_rest\` creates or rotates the supported Baserow REST integration through the credential flow. It stores the token in the vault, persists only endpoint/account metadata plus a tenant-scoped integration row, marks the adapter as \`rest\`, and returns no vault ref or secret. Because the input includes a raw secret, generated CLI argv refuses the command and it is deliberately not exposed as an agent-callable MCP tool; run it from Settings or the command API credential flow instead of shell arguments.
 
 \`integration.readiness\` / \`{{cli}} integration readiness --provider google --json\` / \`rost_check_integration_readiness\` returns the operator setup checklist: app configuration status, tenant connection state, granted scopes, latest test state, the demo-safe partner path, external verification/CASA caveats, handler availability, and the next operator action. The checklist is metadata-only. It never returns access tokens, refresh tokens, client secrets, vault refs, or raw provider responses. Settings deliberately keeps the live Google card narrower: connected account, last successful test, granted capabilities, and connect/reconnect/test actions.
 
@@ -45653,7 +45762,7 @@ There is exactly one way to give a connected tool its credential, and it is the
 
 - Stage tools on a draft agent: \`agent.configure_tools\` / \`rost_configure_agent_tools\` \u2014 connect or decline proposed tools and stage credential-ingress requests. Pass vault references, never raw secret material.
 - Inspect connector readiness: \`integration.list\` / \`rost_list_integrations\`, \`integration.status\` / \`rost_get_integration_status\`, and \`integration.test\` / \`rost_test_integration_connection\` return provider metadata and health only.
-- Store a secret: \`credential.ingress\` / \`rost_store_credential\` (scope: seat) persists only a vault reference. \`credential.ingress\` is \`credential_flow\` \u2014 it returns a pending confirmation and runs only with a real human-provided secret, captured as a vault reference. (Because it redacts that secret, the pending confirmation also shows a high-risk badge \u2014 see the confirmations guide for badge-versus-level.)
+- Store a secret: \`credential.ingress\` (scope: seat) persists only a vault reference. It is \`credential_flow\` \u2014 because it carries a real human-provided secret it runs only through the Settings vault-ingress flow (a human session); generated CLI argv refuses it and it is deliberately not an agent-callable MCP tool. (Because it redacts that secret, its confirmation also shows a high-risk badge \u2014 see the confirmations guide for badge-versus-level.)
 - Sign the manifest: \`charter.sign_manifest\` / \`rost_sign_charter_manifest\` requests human confirmation for the seat's permission manifest.
 - Mint local access: prefer \`{{cli}} mcp install\` for users; \`mcp_token.create\` is \`human_required\` and returns the token once. List metadata with \`mcp_token.list\` (never token material); revoke with \`mcp_token.revoke\`.
 
@@ -45721,7 +45830,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-05.7",
+    version: "2026-07-10.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -46082,7 +46191,7 @@ A leaked tenant-admin token can administer the whole tenant, not just one seat.
 
 ### Storing the Anthropic key and other credentials
 
-Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key, or \`rost_store_credential\` (\`credential.ingress\`) for other secrets; \`rost_configure_agent_tools\` stages credential requests but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
+Storing the tenant model key or any other secret goes through **credential ingress** as a vault reference \u2014 the secret is never pasted into a prompt, config, or log. Use \`rost_save_tenant_anthropic_key\` (\`tenant.anthropic_key.save\`) for the tenant Anthropic key; other secrets go through the Settings vault-ingress flow (\`credential.ingress\`), a human-only interactive flow that is deliberately not an agent-callable MCP tool and refuses raw secrets over CLI argv. \`rost_configure_agent_tools\` stages credential *requests* (provider, scope, and label only) but never accepts raw secrets. Credential storage is a gated \`credential_flow\` confirmation that a human approves. For the vault model and the security posture behind this, see the security-model-guide and the tool-access-and-vault guide; for model-bound data, BYOK provider handling, and local-client provider settings, see the ai-model-data-handling-guide; for the confirmation gate, see the confirmations-guide.
 
 ## When to use MCP or CLI
 
@@ -46187,7 +46296,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} integration list|readiness|status|test\` / credential flow for Baserow REST connect | \`integration.connect_rest\`, \`integration.list\`, \`integration.readiness\`, \`integration.status\`, \`integration.test\` | Create a vault-backed Baserow REST integration through the credential flow, list connector metadata, read setup-readiness, read one connector's health, and run provider-specific tests without exposing credentials. | Tenant-admin for connect; tenant for reads/tests | \`{{cli}} integration readiness --provider google --json\` |
 | \`{{cli}} system health\` | \`system.health\` | Read the scoped system-health snapshot across agent runs, unresolved errors, Signals, Cascade setup, work loop, integrations, runners, notifications, and Sync Brief readiness. | Tenant, member, or seat token | \`{{cli}} system health --json\`; \`{{cli}} system health --seat <id> --json\` |
 | \`{{cli}} command usage.report|usage.snapshot\` | \`usage.report\`, \`usage.snapshot\` | Read the AI-workforce ROI report (per-period agent turns, token/run cost, human-accepted value, exceptions, approvals) from immutable usage snapshots, and freeze a period's totals into a new snapshot (insert-only, idempotent). | Tenant | \`{{cli}} command usage.report --json\`; \`{{cli}} command usage.snapshot --json\` |
-| \`{{cli}} settings get|update|product-learning|agent-policy|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`settings.agent_policy.get\`, \`settings.agent_policy.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, read or set the company autonomy ceiling, and rename the company. Budget, product-learning, and policy updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings agent-policy get --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
+| \`{{cli}} settings get|update|product-learning|agent-policy|confirmation-mode|rename\` | \`settings.get\`, \`settings.update\`, \`settings.product_learning.get\`, \`settings.product_learning.update\`, \`settings.agent_policy.get\`, \`settings.agent_policy.update\`, \`settings.confirmation_policy.get\`, \`settings.confirmation_policy.update\`, \`tenant.rename\` | Read tenant settings, update budget caps, read or update product-learning participation, read or set the company autonomy ceiling, read or set the CLI confirmation mode, and rename the company. Budget, product-learning, and policy updates stop at human confirmation in non-interactive CLI/MCP sessions; company rename is owner-only and human-gated. | Tenant / Tenant-admin for updates | \`{{cli}} settings product-learning get --json\`; \`{{cli}} settings agent-policy get --json\`; \`{{cli}} settings confirmation-mode get --json\`; \`{{cli}} settings rename --company "Acme Operations"\` |
 | \`{{cli}} member invite|update|remove\` | \`member.invite\`, \`member.update\`, \`member.remove\` | Manage tenant members; execution requires an owner or admin membership. | Tenant | \`{{cli}} member invite --email ops@example.com --role member\` |
 | \`{{cli}} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show\` | \`agent_template.list\`, \`agent.create_from_template\`, \`agent.create_custom\`, \`agent_setup.get\`, \`agent_setup.update\`, \`agent.configure_tools\`, \`agent.run_dry_run\`, \`agent.go_live\`, \`agent.status\`, \`agent.run_now\`, \`agent.fleet_digest\`, \`agent.get_run\`, \`agent.show_markdown\` | Run the full agent setup and operation flow: list templates, create a draft from a template or guided custom answers (with \`--model\` and \`--effort\`), read or answer setup state, connect or decline tools, dry-run, go live, run on demand, capture the fleet-health digest, read one run's transcript/error diagnostics, and show a markdown readout. Human CLI dry-runs print the rehearsal transcript and, when present, the per-tool preview labels (\`Would run\`, \`Blocked\`, \`Escalated\`) before go-live. Create and go-live stop at human gates; the dry-run is ungated by human approval but requires a signed manifest first. | Tenant and seat | \`{{cli}} agent fleet-digest --json\` |
 | \`{{cli}} tools list\` | \`tool.catalog\` | List the discoverable tool catalog the builder reads (id, scope tiers, credential requirement, access policy, and execution-boundary guidance). | Tenant | \`{{cli}} tools list --json\` |
@@ -46200,7 +46309,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
 | \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
 | \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
-| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. Pause halts new runner claims at the next task checkpoint, cancel drives terminal canceled, and resume requeues from the last completed task checkpoint. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
+| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Request create/list/show return \`scheduler_state\`: \`queued\` when a runner work order exists, \`parked\` when the Forge team is staffed but no paired online runner can claim it, and \`not_configured\` when the runner-lane Forge Seat is missing. Parked and not-configured states link to \`/settings/runners/setup\`; runner pairing or the repair sweep re-enqueues the same pending intake idempotently. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
 
 Skills wrapper help:
 
@@ -46293,8 +46402,6 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_skip_charter_draft\` | \`charter.skip\` | Mark a Charter draft as skipped. | Seat or tenant-admin | Call only when a human defers the seat. |
 | \`rost_apply_charter_seat_type_recommendation\` | \`charter.apply_seat_type_recommendation\` | Apply a Charter's seat-type recommendation. | Seat or tenant-admin | Call after reviewing the draft. |
 | \`rost_sign_charter_manifest\` | \`charter.sign_manifest\` | Request human confirmation for a permission manifest. | Seat or tenant-admin | Use after tool permissions are reviewed. |
-| \`rost_approve_pending_confirmation\` | \`confirmation.approve\` | Approve a pending confirmation. | Tenant | Call with \`{"confirmation_id":"<confirmation-id>"}\`. |
-| \`rost_reject_pending_confirmation\` | \`confirmation.reject\` | Reject a pending confirmation. | Tenant | Call with \`{"confirmation_id":"<confirmation-id>"}\`. |
 | \`rost_draft_compass\` | \`compass.draft\` | Create a Compass draft. | Tenant | Call with a concise Compass document. |
 | \`rost_update_compass_draft\` | \`compass.update_draft\` | Replace a Compass draft document. | Tenant | Call with the \`compass_version_id\` from \`compass.draft\` as \`draft_id\` and the updated document. |
 | \`rost_approve_compass_version\` | \`compass.approve_version\` | Activate a Compass version by supersession. | Tenant | Call after human review. |
@@ -46304,7 +46411,6 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_assign_user_to_seat\` | \`staffing.assign_user\` | Assign a human user occupancy to a seat. | Seat or tenant-admin | Call with \`seat_id\` and \`user_id\`. |
 | \`rost_assign_dry_run_agent_to_seat\` | \`staffing.assign_agent_dry_run\` | Assign an agent occupancy in dry-run mode. | Seat or tenant-admin | Call only after Steward chain is clear. |
 | \`rost_staff_seat\` | \`staffing.assign\` | Compatibility helper for human, agent, or hybrid staffing. | Seat or tenant-admin | Call with \`seat_id\` and \`occupant\`. |
-| \`rost_store_credential\` | \`credential.ingress\` | Store a secret through the vault and persist only a vault reference. | Seat or tenant-admin | Use vault-backed values only. |
 | \`rost_go_live\` | \`agent.go_live\` | Promote a dry-run agent seat to live. | Seat or tenant-admin | Call after human approval. |
 | \`rost_create_mcp_token\` | \`mcp_token.create\` | Mint a tenant-admin or seat-scoped MCP token. | Tenant | Prefer \`{{cli}} mcp install\` for users. |
 | \`rost_revoke_mcp_token\` | \`mcp_token.revoke\` | Revoke an MCP token immediately. | Tenant | Call with \`token_id\`. |
@@ -46358,7 +46464,6 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_resolve_error_log\` | \`error_log.resolve\` | Acknowledge or resolve an error log with a required human reason and optional task, issue, or PR link. | Tenant | Call with \`error_log_id\`, \`reason\`, and \`disposition\` \`acknowledged\` or \`resolved\`. |
 | \`rost_supersede_error_log\` | \`error_log.supersede\` | Mark an older error log as superseded by a newer in-tenant error log. | Tenant | Call with \`error_log_id\`, \`new_error_log_id\`, and \`reason\`. |
 | \`rost_list_integrations\` | \`integration.list\` | List connected integration metadata and latest health state. | Tenant | Call with \`{}\` or \`{"provider":"google"}\`; no secrets or vault refs are returned. |
-| \`rost_connect_rest_integration\` | \`integration.connect_rest\` | Create or rotate the vault-backed Baserow REST integration for Signal pulls. | Tenant-admin | Use the credential flow with provider \`baserow\`, HTTPS endpoint, scope, secret name, and secret; no vault refs or secrets are returned. |
 | \`rost_check_integration_readiness\` | \`integration.readiness\` | Return the connector setup checklist: OAuth env/callback, tenant connection, scopes, latest test state, external verification/CASA, handler availability, and DER-coded next actions. | Tenant | Call with \`{"provider":"google"}\`; metadata only, no secrets or vault refs. |
 | \`rost_get_integration_status\` | \`integration.status\` | Read one integration's metadata by provider or integration id. | Tenant | Call with \`{"provider":"google"}\` or \`{"integration_id":"<id>"}\`. |
 | \`rost_test_integration_connection\` | \`integration.test\` | Run the provider-specific connection test and update integration health. | Tenant | Call with \`{"provider":"google"}\`; result is bounded metadata only. |
@@ -46374,8 +46479,10 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_update_product_learning_policy\` | \`settings.product_learning.update\` | Set product-learning mode. | Tenant-admin | Human-gated; call with \`{"mode":"enabled"}\`, \`{"mode":"disabled"}\`, or \`{"mode":"enterprise_contract"}\`. |
 | \`rost_get_company_autonomy_ceiling\` | \`settings.agent_policy.get\` | Read the company autonomy ceiling (Company Guardrails): profile, enforcement, and max_autonomous_risk. | Tenant | Call with \`{}\`; metadata only. |
 | \`rost_set_company_autonomy_ceiling\` | \`settings.agent_policy.update\` | Set the company autonomy ceiling. | Tenant-admin | Owner-only, human-gated; call with \`{"profile":"locked_down"}\` (or \`balanced\`/\`high_autonomy\`, or \`{"profile":"custom","max_autonomous_risk":"high"}\`). Enforced by default. |
+| \`rost_get_cli_confirmation_mode\` | \`settings.confirmation_policy.get\` | Read the CLI confirmation mode: \`careful\` (the strict default \u2014 the CLI cannot silently auto-approve a pending confirmation) or \`trusted_operator\` (an owner opt-in). | Tenant | Call with \`{}\`; metadata only. |
+| \`rost_set_cli_confirmation_mode\` | \`settings.confirmation_policy.update\` | Set the CLI confirmation mode. | Tenant-admin | Owner-only, human-gated; call with \`{"cli_mode":"trusted_operator"}\` (or \`{"cli_mode":"careful"}\`). Choosing \`trusted_operator\` establishes an ADR-0018 \xA76 standing authorization; a \`dangerous\`-risk confirmation always requires interactive human review in either mode. |
 | \`rost_get_aicos_brain_settings\` | \`aicos.brain_settings.get\` | Read AICOS lane and brain labels for cloud managed/BYOK, runner Claude/Codex, and MCP client. | Tenant | Call with \`{}\`; returns enum labels only, never keys, vault refs, or runner secrets. |
-| \`rost_update_aicos_brain_settings\` | \`aicos.brain_settings.update\` | Update AICOS lane and cloud/runner brain preferences. | Tenant-admin | Owner-only and human-gated; call with \`{"lane":"runner","runner_brain":"codex-cli"}\` or \`{"cloud_brain":"byok"}\`. BYOK requires an active tenant Anthropic key. |
+| \`rost_update_aicos_brain_settings\` | \`aicos.brain_settings.update\` | Update AICOS lane and cloud/runner brain preferences. | Tenant-admin | Owner-only and human-gated; call with \`{"lane":"runner","runner_brain":"claude-cli"}\` or \`{"cloud_brain":"byok"}\`. BYOK requires an active tenant Anthropic key. For AICOS, selecting \`codex-cli\` is currently rejected until the governed interactive runner path is verified. |
 | \`rost_list_signals\` | \`signal.list\` | List measurables with their latest reading and on/off-track state. | Seat or tenant-admin | Call with \`{}\` to find measurable ids. |
 | \`rost_get_signal\` | \`signal.get\` | Read a measurable with its full reading history. | Seat or tenant-admin | Call with \`{"measurable_id":"<id>"}\`. |
 | \`rost_confirm_signal_reading\` | \`signal.confirm_reading\` | Confirm an unconfirmed reading as human-verified. | Seat or tenant-admin | Humans confirm; call with \`{"reading_id":"<id>"}\`. |
@@ -46442,13 +46549,13 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_revoke_skill_from_seat\` | \`skill.revoke_from_seat\` | Human-gated revocation that stops future Skill use without deleting historical activations. | Tenant-admin | Call with \`{"assignment_id":"<assignment-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
 | \`rost_create_a_forge_project\` | \`software_factory.project.create\` | Create an active Forge software project before binding repositories or opening build requests. Tenant-admin, human-gated, and entitlement-gated. | Tenant-admin | Call with \`{"name":"Leiluna app","slug":"leiluna-app","base_branch":"main"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"project":"<slug-or-name>","title":"Add invoice export"}\` (or \`{"software_project_id":"<project-id>", ...}\`). |
+| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run and returns \`scheduler_state\` so MCP callers can distinguish queued work from \`parked\` runner setup or \`not_configured\` staffing gaps. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"project":"<slug-or-name>","title":"Add invoice export"}\` (or \`{"software_project_id":"<project-id>", ...}\`). |
 | \`rost_pause_a_forge_build_request\` | \`software_factory.request.pause\` | Pause an in-flight Forge build request. New runner claims stop immediately; running work halts at the next task checkpoint. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Operator hold"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_cancel_a_forge_build_request\` | \`software_factory.request.cancel\` | Cancel a Forge build request and expire active runner work orders. This is terminal; use pause for reversible holds. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Out of scope"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_resume_a_forge_build_request\` | \`software_factory.request.resume\` | Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Budget raised"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_forge_projects\` | \`software_factory.project.list\` | List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. | Tenant | Call with \`{}\`; use the returned \`id\` as \`software_project_id\`. |
-| \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, and risk. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
-| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, phase-run history, and gates. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
+| \`rost_list_forge_build_requests\` | \`software_factory.request.list\` | The Forge control-room board: build requests with status, current phase, risk, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"limit":20}\`. |
+| \`rost_show_a_forge_build_request\` | \`software_factory.request.show\` | The Forge request detail: the request, current phase, phase-run history, gates, and current \`scheduler_state\` remediation. Read-only; requires the Forge add-on. | Tenant | Call with \`{"build_request_id":"<request-id>"}\`. |
 | \`rost_advance_a_forge_build_request_phase\` | \`software_factory.phase.advance\` | Advance a build request to its next phase; the server enforces the closed phase state machine and rejects an illegal transition. | Tenant | Call with \`{"build_request_id":"<request-id>","to_phase":"discovery_scoping"}\`. |
 | \`rost_decide_a_forge_gate\` | \`software_factory.gate.decide\` | A human approves or rejects a Forge gate; an agent caller routes to \`/approvals\` and can never self-approve. Sensitive gates record a linked human decision. | Tenant | Call with \`{"gate_id":"<gate-id>","decision":"approve"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_answer_forge_plan_clarifications\` | \`software_factory.request.answer_clarification\` | Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review; answers append to the versioned planning artifact and never widen authority or automation mode. | Tenant | Call with \`{"build_request_id":"<request-id>","answers":[{"question":"Which database?","answer":"Postgres"}],"mark_ready_for_plan_review":true}\`. |
@@ -46472,7 +46579,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_create_a_forge_vercel_preview_deployment\` | \`software_factory.vercel.deploy_preview\` | Create a Vercel preview deployment for a linked project after Forge deploy-preview authority, the Vercel OAuth vault-ref connection, and required preview secret/config grants are verified. | Tenant | Call with \`{"software_project_id":"<project-id>","commit_sha":"<sha>","git_ref":"feature/example","seat_id":"<seat-id>"}\`; returns deployment metadata, not tokens. |
 | \`rost_list_forge_runner_capacity\` | \`software_factory.capacity.list\` | List Forge runner capacity observations (advisory scheduling input only, never an authority input). Read-only; requires the Forge add-on. | Tenant | Call with \`{}\` or \`{"runner_id":"<runner-id>"}\`. |
 
-The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, request pause/cancel/resume controls, runner capacity, configuration status, and Developer Team install. A request detail page shows phase history, open gates, plan progress, loop/time/cost ceilings, and latest plan-review questions from \`software_factory.request.show\`; answering a clarification, approving a plan, rejecting it, pausing, canceling, or resuming calls the same Forge commands exposed over CLI/MCP. Lifecycle controls deliberately stage pending confirmations before changing runner state. The install button also stages a pending confirmation before durable seats, Skills, authority grants, or live agent activation are applied; the install page states plainly that approving activates the 7 agents at a pull-request-only, observe-first posture and surfaces the company autonomy ceiling.
+The web Forge control room at \`/forge\` uses the same command path for project selection, build request creation/list/detail reads, request pause/cancel/resume controls, runner capacity, configuration status, and Developer Team install. Request cards and detail pages surface \`scheduler_state\` directly: queued work shows its work-order state, parked work explains that no paired online runner is available, and not-configured work sends the operator to \`/settings/runners/setup\`. A request detail page also shows phase history, open gates, plan progress, loop/time/cost ceilings, and latest plan-review questions from \`software_factory.request.show\`; answering a clarification, approving a plan, rejecting it, pausing, canceling, or resuming calls the same Forge commands exposed over CLI/MCP. Lifecycle controls deliberately stage pending confirmations before changing runner state. The install button also stages a pending confirmation before durable seats, Skills, authority grants, or live agent activation are applied; the install page states plainly that approving activates the 7 agents at a pull-request-only, observe-first posture and surfaces the company autonomy ceiling.
 
 #### Forge GitHub App access
 
@@ -47072,7 +47179,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-04.2",
+    version: "2026-07-08.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -47135,6 +47242,10 @@ Avoid vanity numbers, manual-only status fields, and metrics nobody can act on.
 
 A human can run the whole loop from the Signal page. The page opens answer-first \u2014 one computed line ("2 of 14 measurables need attention," or "All 14 measurables on target" when nothing needs you) with only the exception rows fully visible; healthy measurables collapse to a single "N on target" count you can expand. Every create/edit action lives behind the one "+ Add" button, which opens a drawer with four segments: **Log reading** records a human reading (the same \`signal.correct_reading\` path, or a row's own "Log reading" button seeds the drawer to that measurable), **New measurable** creates one against a seat (the \`measurable.create\` path, plus adopting from the template catalog), **Sources**, and **CSV import**. You do not need an agent to keep Signal current.
 
+## Per-seat budget alerts
+
+The Signal page shows a seat-cost strip: each seat's trailing 30-day agent run spend. On top of that you can set a per-seat soft budget alert \u2014 a spend threshold in USD. When a seat's 30-day spend approaches its threshold (at 80%) or crosses it, a visible alert appears in the cost strip on the scorecard. This alert is advisory only: it never blocks a run or pauses an agent (hard budget enforcement is a separate, later capability). Set a threshold from the cost strip by choosing an agent seat and entering an amount, or leave the amount blank to clear it. Thresholds are per tenant and per seat; setting one records a durable event.
+
 ## Import a scorecard from CSV
 
 To move off a spreadsheet or another operating tool, open the Signal page's "+ Add" drawer and choose the "CSV import" segment (the \`signal.import\` command, also available on CLI/MCP). Each row becomes a measurable owned by the seat whose name matches the row's owner, with its target, unit, direction, cadence, and trailing readings. Import is idempotent \u2014 re-importing upserts by period \u2014 and a row whose cadence conflicts with an existing measurable is reported and skipped, not overwritten.
@@ -47496,11 +47607,11 @@ Do not claim that a live charge happened unless Stripe test/live evidence proves
     order: 72,
     title: "Settings guide",
     summary: "How to use Settings as the control plane for company access, channels, providers, tokens, and operating defaults.",
-    version: "2026-07-04.3",
+    version: "2026-07-09.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
-    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
+    relatedCommandIds: ["onboarding.create_invite", "mcp_token.create", "mcp_token.revoke", "mcp_token.list", "integration.list", "integration.readiness", "integration.status", "integration.test", "settings.get", "settings.update", "tenant.rename", "settings.sync_brief_scope.get", "settings.sync_brief_scope.update", "settings.product_learning.get", "settings.product_learning.update", "settings.agent_policy.get", "settings.agent_policy.update", "settings.confirmation_policy.get", "settings.confirmation_policy.update", "aicos.brain_settings.get", "aicos.brain_settings.update"],
     legal: { publicRisk: "low", notes: ["{{brand}}-native settings guidance."] },
     sources: [
       {
@@ -47521,7 +47632,7 @@ Start with members and invites, then provider and channel connections, then MCP
 
 Settings is reached from the footer gear in the left sidebar (the nav collapse moved it out of the primary item list). It is a left-rail master\u2013detail layout: a grouped rail (General, Team & Access, Billing, AI & Agents, Connections, Advanced) selects one section at a time, shown in the detail pane. The active section is a URL search param, so \`/settings?section=<id>\` is linkable and survives a refresh. The Connections section is the workspace-level provider surface: Google, Slack, QuickBooks, local runners, seat-scoped agent tokens, and stored secrets appear as provider cards with status, used-for chips, actions, and the shared Access language (**Off / Read / Draft / Act with approval**). Detailed management forms for tokens, channels, runners, provider links, and stored vault entries remain reachable from those cards.
 
-Legacy hash deep-links still resolve \u2014 \`/settings#integrations\`, \`#channels\`, and \`#vault\` redirect to \`?section=connections\`; other hashes such as \`#members\` and \`#guardrails\` redirect to their matching section. \`#runners\` is the one exception: it keeps resolving to the dedicated Connected machines management table (not the Connections overview), since System Health and seat pages deep-link there expecting the per-runner revoke actions. Documented shortcut links resolve to the right section instead of a dead end: \`/settings/integrations\` and \`/readiness\` open the Connections section (connector readiness lives inside it, not on a standalone page), \`/settings/policy\` opens the Product learning section, and MCP/CLI access tokens live in the Agent access tokens section (not a separate \`/mcp\` page \u2014 \`/mcp\` is the MCP protocol endpoint itself, not a browsable settings screen). The Advanced group links out to \`/migration/ninety\`, the one settings-adjacent page with no home in the grouped rail. After you save a change, the app keeps you on the section you edited rather than returning to the top.
+Section state is fully server-side: every in-app link, redirect, and save uses \`?section=<id>\`, never a \`#anchor\` \u2014 there is no client-side hash shim to desync from. Documented shortcut pages redirect straight to the right section instead of a dead end: \`/settings/integrations\` and \`/readiness\` redirect to \`?section=connections\` (connector readiness lives inside the Connections overview, not on a standalone page), \`/settings/members\` redirects to \`?section=members\`, \`/settings/policy\` redirects to \`?section=guardrails\`, and MCP/CLI access tokens live in the Agent access tokens section (not a separate \`/mcp\` page \u2014 \`/mcp\` is the MCP protocol endpoint itself, not a browsable settings screen). The Advanced group links out to \`/migration/ninety\`, the one settings-adjacent page with no home in the grouped rail. Every settings form carries the section it lives in, so saving a change redirects back to that same section with no flash, instead of returning to the top.
 
 ## What belongs in Settings
 
@@ -47577,7 +47688,7 @@ Agents that run on {{brand}}-managed inference draw against a tenant inference b
 - Set the hard cap with \`settings.update\` (CLI: \`{{cli}} settings update --hard-cap-usd <amount>\`). The optional soft cap warns before the hard cap and must be less than or equal to it.
 - The sandbox dry run is free and is never blocked by the cap, so a fresh company can charter, dry-run, and take an agent live before setting a budget. The cap applies only to real managed-inference runs.
 - A company that brings its own provider key (BYOK) is metered on that key and is not subject to the {{brand}}-managed hard cap. BYOK changes the provider account used for eligible cloud calls, not the Charter, tool guard, human gate, or data-retention posture; see the ai-model-data-handling-guide before making provider-handling claims.
-- AICOS cloud brain selection is managed with \`aicos.brain_settings.get\` and owner-gated \`aicos.brain_settings.update\`. Managed cloud answers draw from the included allowance; BYOK cloud answers meter against the tenant key. Runner Claude, Runner Codex, and MCP client answers are labeled separately and do not draw from the managed cloud allowance.
+- AICOS cloud brain selection is managed with \`aicos.brain_settings.get\` and owner-gated \`aicos.brain_settings.update\`. Managed cloud answers draw from the included allowance; BYOK cloud answers meter against the tenant key. Runner Claude and MCP client answers are labeled separately and do not draw from the managed cloud allowance. The AICOS Codex runner choice remains gated off until the governed interactive runner path is verified.
 
 ## Company autonomy ceiling (Company Guardrails)
 
@@ -47590,6 +47701,15 @@ The company autonomy ceiling is a single tenant-wide dial that caps how much ANY
 - An explicitly set ceiling is ENFORCED by default. Enforcement has two modes: \`enforce\` blocks an over-ceiling autonomous call and routes it to the steward (it is never a dead-end deny \u2014 a human can still approve), and \`observe\` allows the call but logs it. The platform default for a company that never set a policy is balanced + observe, so existing live agents are never retro-bricked.
 - When enforcement is on, signing a manifest or taking an agent live is REFUSED if the manifest grants always_allow to a tool whose risk exceeds the ceiling; the error names the exact ceiling, tool, and risk in its \`details\`. Lower that tool to always_ask, or raise the ceiling, then retry.
 
+## CLI confirmation mode
+
+The CLI confirmation mode is a separate tenant-wide dial. It does not change what an agent may do (that is the company autonomy ceiling above); it changes whether the {{cli}} CLI tool itself may stand in for a human at an already-gated confirmation.
+
+- \`careful\` is the strict default for every company, including internal ones. The server refuses the CLI's silent auto-replay of a pending confirmation \u2014 a human must review it before it is approved.
+- \`trusted_operator\` is a deliberate tenant_admin opt-in (an ADR-0018 \xA76 standing authorization) that lets the CLI silently auto-approve a non-\`dangerous\` confirmation. A \`dangerous\`-risk confirmation always requires interactive human review, in either mode.
+- Read it with \`settings.confirmation_policy.get\` (CLI: \`{{cli}} settings confirmation-mode get\`). Set it with \`settings.confirmation_policy.update\` (CLI: \`{{cli}} settings confirmation-mode set --mode trusted_operator\`). Owner-only and human-gated.
+- Stored at \`tenants.settings.confirmation_policy\`; enforced server-side in \`confirmation.approve\`, so a stale or modified local CLI cannot bypass it.
+
 ## Agent guidance
 
 Agents may explain which setting is needed and why. They should not ask users to paste secrets into chat or tool arguments. When credentials are required, route the user to the vault-backed setup flow.`
@@ -47639,7 +47759,7 @@ When a user asks to add a person, clarify whether they mean app access, seat occ
     order: 74,
     title: "Notifications guide",
     summary: "How {{brand}} should notify humans about decisions, escalations, stale work, and agent boundaries.",
-    version: "2026-06-27.1",
+    version: "2026-07-09.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -47664,6 +47784,7 @@ Notifications should move decisions to the right human without turning {{brand}}
 - A Signal is broken or stale.
 - A Friction item needs a decision.
 - A Sync decision creates a handoff.
+- A seat's reporting line or parent changes (\`seat.reparent\`, a seat merge, or \`agent_setup.update\`) \u2014 the affected seat's Steward and the tenant owners get an in-app notification, so a structural change is never silent (the DER-1388 incident this closes was only caught because a human happened to notice the org chart looked wrong).
 
 ## Diagnose failed deliveries
 
@@ -47678,7 +47799,7 @@ Every notification should include the seat, cause, evidence, and requested decis
     order: 75,
     title: "Local runner guide",
     summary: "How local agent sessions and runner surfaces should operate through {{brand}} without bypassing Charters or audit.",
-    version: "2026-07-07.3",
+    version: "2026-07-10.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
@@ -47730,11 +47851,11 @@ The runner bearer secret is stored locally and is never displayed. Each claimed
 
 ## Interactive AICOS runner turns
 
-AICOS runner chat uses the same runner process but not the scheduled work-order queue. The runner claims an \`agent_turn_executions\` item for one user message, starts it, executes the local Claude or Codex runtime with bounded AICOS context, then reports the final assistant answer back to {{brand}}. Execute-ready AICOS claims include a server-built Seat work contract: the governed runtime profile, the AICOS context-loader tool, and the Seat permission manifest. Actions invoked from that local runtime still pass through command guards, \`tool_calls\` audit, pending confirmations, human gates, and tenant isolation before anything durable changes. The transcript write-back is server-owned: one terminal result creates one assistant message, links it to run evidence, and records the final turn status, terminal reason, timings, model, and token telemetry when present. Retrying the same final report does not append a second answer. If an interactive turn expires while queued, claimed, or running, {{brand}} marks it offline and appends a visible terminal assistant message so the user is not left waiting on a stale queued state.
+AICOS runner chat uses the same runner process but not the scheduled work-order queue. The runner claims an \`agent_turn_executions\` item for one user message, starts it, executes the local Claude runtime with bounded AICOS context, then reports the final assistant answer back to {{brand}}. Execute-ready AICOS claims include a server-built Seat work contract: the governed runtime profile, the AICOS context-loader tool, and the Seat permission manifest. Actions invoked from that local runtime still pass through command guards, \`tool_calls\` audit, pending confirmations, human gates, and tenant isolation before anything durable changes. The transcript write-back is server-owned: one terminal result creates one assistant message, links it to run evidence, and records the final turn status, terminal reason, timings, model, and token telemetry when present. Retrying the same final report does not append a second answer. Codex remains unavailable for interactive AICOS runner turns until the governed runner path is verified. If an interactive turn expires while queued, claimed, or running, {{brand}} marks it offline and appends a visible terminal assistant message so the user is not left waiting on a stale queued state.
 
 ## Forge scheduler work
 
-When the Forge add-on is enabled, Forge phase work uses the same runner work-order lane. A Forge phase with an owning runner-agent Seat is linked to a normal \`work_orders\` row; the runner claims it, starts it, reports the result, and the server advances the linked phase. There is no separate local lease store.
+When the Forge add-on is enabled, Forge phase work uses the same runner work-order lane. A Forge phase with an owning runner-agent Seat is linked to a normal \`work_orders\` row only when a paired online runner can claim it; otherwise the phase stays pending with \`scheduler_state.status = "parked"\` and the remediation link points to \`/settings/runners/setup\`. Pairing a runner or the repair sweep re-enqueues the same pending phase idempotently, so operators do not get duplicate intake rows or silent expiring work orders. The runner claims queued work, starts it, reports the result, and the server advances the linked phase. There is no separate local lease store.
 
 A build request decomposes into changesets and tasks tracked as queryable execution state. A changeset is the pull-request boundary and the revert unit (default one per request; additional changesets only on a named split criterion such as risk isolation or a reviewability-size budget). A task is one coding session inside a changeset, carrying its own verification and a per-task checkpoint that is the safe resume and pause boundary. Plan-conformance findings loop a changeset back to implementation; a finding can only be accepted, rather than resolved, through a recorded human decision.
 
@@ -48616,7 +48737,7 @@ This worked document **omits** \`unanswered_boundaries\` and \`seat_type_recomme
     order: 43,
     title: "Agent builder guide",
     summary: "The full agent setup sequence on the CLI/MCP path \u2014 seat, steward, job, boundaries, tools, credentials, model, schedule, dry-run, go-live \u2014 with the structured model config and access tiers.",
-    version: "2026-06-29.1",
+    version: "2026-07-10.1",
     public: true,
     audiences: ["cli", "mcp", "in_app_agent"],
     stages: ["staffing"],
@@ -48660,7 +48781,7 @@ Building teams of controlled agent workers is the product's core differentiator.
 ## The full setup sequence
 
 1. **Seat** \u2014 the agent occupies a seat in the Responsibility Graph (a function, not a person). Create or pick the seat first.
-2. **Steward** \u2014 every agent needs a human steward chain (invariant: no orphan agents). Set \`steward_seat_id\` so the chain resolves to a human; without it the occupancy is blocked.
+2. **Steward** \u2014 every agent needs a human steward chain (invariant: no orphan agents). When the creating human occupies a qualifying seat, setup defaults the new agent's Steward to that seat and, for an unplaced fresh seat, uses it as the parent. You can still set \`steward_seat_id\` explicitly; an explicit Steward wins. Without a qualifying creator seat or explicit Steward, the occupancy is blocked and \`agent_setup.get\` returns remediation candidates.
 3. **Job** \u2014 what the seat owns. On \`agent.create_custom\` this is the operational answers (what it owns, what success looks like, what it must never do alone); for a strong contract, submit the full Charter directly via \`charter.update_draft\` (see the charter-authoring deep-dive).
 4. **Boundaries** \u2014 the Charter's \`decision_authority\` (can-do / must-ask / never / escalate), \`escalation_rules\`, and \`budget\`. Conservative by default: send/spend/irreversible actions are approval-gated or escalated.
 5. **Tools** \u2014 pick from the discoverable catalog (\`{{cli}} tools list\`); each tool has a default scope tier and access policy. Connect or decline via \`agent.configure_tools\`. Selecting a tool records permission; live handlers execute later only behind the signed manifest, server guard, required credential or binding, and connector-specific approval boundary.
@@ -48949,6 +49070,13 @@ var approveViaSchema = external_exports.object({
 var pendingConfirmationSchema2 = external_exports.object({
   confirmationId: external_exports.string().min(1),
   commandId: external_exports.string().min(1),
+  // DER-1490: carried through so an inline auto-approve can always render the
+  // gate before approving (D4-i). Optional/tolerant — an older/malformed
+  // response still resolves confirmationId/commandId, just without the extra
+  // gate detail.
+  summary: external_exports.string().optional().catch(void 0),
+  riskLevel: external_exports.enum(["normal", "sensitive", "dangerous"]).optional().catch(void 0),
+  diff: external_exports.unknown().optional(),
   approveVia: approveViaSchema.optional().catch(void 0)
 }).passthrough();
 var confirmationApprovalOutputSchema = external_exports.object({
@@ -49065,16 +49193,22 @@ function brandEnvKey3(suffix) {
 async function renderMcpInstall(input) {
   const stderrLines = [];
   const canAutoApprove = input.canAutoApprove ?? false;
+  const reviewed = input.reviewed ?? false;
+  const approval = {
+    canAutoApprove,
+    reviewed,
+    pushStderr: (line) => stderrLines.push(line)
+  };
   if (input.options.rotateTokenId === void 0 && input.options.scope === void 0) {
     throw new Error(MISSING_SCOPE_MESSAGE);
   }
-  const mintScope = input.options.rotateTokenId === void 0 ? { scope: input.options.scope, ...input.options.seatId === void 0 ? {} : { seatId: input.options.seatId } } : await resolveRotationScope(input.client, input.options, canAutoApprove);
-  const token = await createMcpToken(input.client, mcpTokenCreateBody(mintScope, input.options.expiry), canAutoApprove);
+  const mintScope = input.options.rotateTokenId === void 0 ? { scope: input.options.scope, ...input.options.seatId === void 0 ? {} : { seatId: input.options.seatId } } : await resolveRotationScope(input.client, input.options, approval);
+  const token = await createMcpToken(input.client, mcpTokenCreateBody(mintScope, input.options.expiry), approval);
   let rotationOldRevoked = null;
   if (input.options.rotateTokenId !== void 0) {
     const oldTokenId = input.options.rotateTokenId;
     try {
-      const output = await executeWithConfirmation(input.client, "mcp_token.revoke", { token_id: oldTokenId }, canAutoApprove);
+      const output = await executeWithConfirmation(input.client, "mcp_token.revoke", { token_id: oldTokenId }, approval);
       const revoke = mcpTokenRevokeOutputSchema2.safeParse(output);
       rotationOldRevoked = revoke.success && revoke.data.revoked === true;
       if (!rotationOldRevoked) {
@@ -49155,9 +49289,9 @@ function mcpTokenCreateBody(mint, expiry) {
   }
   return base;
 }
-async function resolveRotationScope(client, options, canAutoApprove) {
+async function resolveRotationScope(client, options, approval) {
   const oldTokenId = options.rotateTokenId;
-  const listOutput = await executeWithConfirmation(client, "mcp_token.list", { include_revoked: true }, canAutoApprove);
+  const listOutput = await executeWithConfirmation(client, "mcp_token.list", { include_revoked: true }, approval);
   const parsed = mcpTokenListOutputSchema2.safeParse(listOutput);
   if (!parsed.success) {
     throw new Error("Could not read the token list to rotate \u2014 mcp_token.list returned an unexpected shape.");
@@ -49220,11 +49354,11 @@ function revokeFailureReason(error51) {
   }
   return "unknown error";
 }
-async function createMcpToken(client, body, canAutoApprove) {
-  const output = await executeWithConfirmation(client, "mcp_token.create", body, canAutoApprove);
+async function createMcpToken(client, body, approval) {
+  const output = await executeWithConfirmation(client, "mcp_token.create", body, approval);
   return mcpTokenOutputSchema.parse(output);
 }
-async function executeWithConfirmation(client, commandId, body, canAutoApprove) {
+async function executeWithConfirmation(client, commandId, body, approval) {
   try {
     const result = await client.execute(commandId, body);
     return result.output;
@@ -49233,7 +49367,7 @@ async function executeWithConfirmation(client, commandId, body, canAutoApprove)
     if (!pending) {
       throw error51;
     }
-    if (!canAutoApprove) {
+    if (!approval.canAutoApprove) {
       throw new PendingConfirmationError({
         confirmationId: pending.confirmationId,
         commandId: pending.commandId,
@@ -49241,13 +49375,33 @@ async function executeWithConfirmation(client, commandId, body, canAutoApprove)
         ...pending.approveVia?.webUrl === void 0 ? {} : { approveUrl: pending.approveVia.webUrl }
       });
     }
+    approval.pushStderr(renderPendingConfirmationGate(pending));
     const approved = await client.execute("confirmation.approve", {
-      confirmation_id: pending.confirmationId
+      confirmation_id: pending.confirmationId,
+      // DER-1490: never claim a review that didn't happen — omit the field
+      // entirely rather than sending `reviewed: false` (the server treats
+      // "absent" and "false" the same, but an absent field is honest about there
+      // being no signal either way).
+      ...approval.reviewed ? { reviewed: true } : {}
     });
     const approvalOutput = confirmationApprovalOutputSchema.parse(approved.output);
     return approvalOutput.output;
   }
 }
+function renderPendingConfirmationGate(pending) {
+  const lines = [`Confirmation required: ${pending.commandId} (${pending.confirmationId})`];
+  if (pending.summary !== void 0) {
+    lines.push(redactForLog(pending.summary));
+  }
+  if (pending.riskLevel !== void 0) {
+    lines.push(`Risk level: ${pending.riskLevel}`);
+  }
+  if (pending.diff !== void 0) {
+    lines.push(`Diff:
+${redactForLog(pending.diff)}`);
+  }
+  return lines.join("\n");
+}
 function pendingCommandConfirmation(error51, commandId) {
   if (!(error51 instanceof CommandClientError) || error51.status !== 409 || !error51.response || error51.response.ok) {
     return null;
@@ -49569,9 +49723,9 @@ var COMMAND_MANIFEST = [
   { "id": "compass.set", "namespace": "compass", "action": "set", "title": "Set Compass", "description": "Compatibility command for the DER-626 MCP Compass tool.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "draft_id", "flag": "draft-id", "type": "string", "required": false }, { "name": "approve", "flag": "approve", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Set Compass drafts in the product's own vocabulary and approve only with explicit human confirmation." },
   { "id": "compass.show_markdown", "namespace": "compass", "action": "show_markdown", "title": "Show Compass as markdown", "description": "Compose the current Compass and its open gaps into a clean, human-skimmable markdown card for review.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Render the current Compass and its open gaps as a clean markdown card to show your human a quick review." },
   { "id": "compass.update_draft", "namespace": "compass", "action": "update_draft", "title": "Update Compass draft", "description": "Replace a draft Compass document.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "draft_id", "flag": "draft-id", "type": "string", "required": true }], "hasComplexInput": true, "help": "Pass the compass_version_id returned by compass.draft as draft_id; update_draft replaces only an unpublished draft in this tenant." },
-  { "id": "confirmation.approve", "namespace": "confirmation", "action": "approve", "title": "Approve pending confirmation", "description": "Approve an in-flight confirmation and execute the original command as the approving human.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Approve pending confirmations only when the requested durable change is clear to the human owner." },
+  { "id": "confirmation.approve", "namespace": "confirmation", "action": "approve", "title": "Approve pending confirmation", "description": "Approve an in-flight confirmation and execute the original command as the approving human.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reviewed", "flag": "reviewed", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "Approve pending confirmations only when the requested durable change is clear to the human owner." },
   { "id": "confirmation.reject", "namespace": "confirmation", "action": "reject", "title": "Reject pending confirmation", "description": "Reject an in-flight confirmation without executing the original command.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "confirmation_id", "flag": "confirmation-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject pending confirmations when authority, evidence, or human intent is unclear." },
-  { "id": "credential.ingress", "namespace": "credential", "action": "ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }], "hasComplexInput": false, "secretBlocked": true, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs." },
+  { "id": "credential.ingress", "namespace": "credential", "action": "ingress", "title": "Store credential", "description": "Store a secret through the vault and persist only the credential vault reference.", "requiredScope": "seat", "confirmation": "credential_flow", "exposeOverMcp": false, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "provider", "flag": "provider", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }], "hasComplexInput": false, "secretBlocked": true, "help": "Ingress credentials only through vault-backed flows; never place raw secrets in prompts, logs, or docs." },
   { "id": "deliverable.accept", "namespace": "deliverable", "action": "accept", "title": "Accept deliverable value", "description": "Record a human-confirmed accepted value (USD) on a deliverable. Humans decide; agents cannot self-accept. Re-accepting records a correction as a new event; prior events are never mutated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "deliverable_id", "flag": "deliverable-id", "type": "string", "required": true }, { "name": "impact_value_usd", "flag": "impact-value-usd", "type": "number", "required": true }], "hasComplexInput": false, "help": "Record a human-confirmed accepted value (USD) on a deliverable; owner-only and human-gated. Humans decide \u2014 agents cannot self-accept. Re-accepting records a correction as a new event." },
   { "id": "deliverable.attach", "namespace": "deliverable", "action": "attach", "title": "Attach agent deliverable", "description": "Attach a deliverable to a source run, task, or work order for the acting seat. Source refs are validated server-side.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "run_id", "flag": "run-id", "type": "string", "required": false }, { "name": "task_id", "flag": "task-id", "type": "string", "required": false }, { "name": "work_order_id", "flag": "work-order-id", "type": "string", "required": false }, { "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }], "hasComplexInput": true, "help": "Attach a scrubbed deliverable to a source run, task, or work order that belongs to the acting seat." },
   { "id": "deliverable.create", "namespace": "deliverable", "action": "create", "title": "Create agent deliverable", "description": "Create an agent deliverable for the acting seat. The deliverable is scrubbed for secrets before storage.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "kind", "flag": "kind", "type": "enum", "required": false, "enumValues": ["brief", "work_evidence", "artifact", "report", "other"] }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "summary", "flag": "summary", "type": "string", "required": false }, { "name": "content", "flag": "content", "type": "string", "required": false }, { "name": "delivered_at", "flag": "delivered-at", "type": "string", "required": false }], "hasComplexInput": true, "help": "Create a scrubbed durable work output for the acting seat without making a durable company decision." },
@@ -49604,7 +49758,7 @@ var COMMAND_MANIFEST = [
   { "id": "goal.unbind_measurable", "namespace": "goal", "action": "unbind_measurable", "title": "Unbind a Signal from a Cascade goal", "description": "Remove a measurable's drives_status binding from a goal. The goal keeps its last status; unbinding only stops future signal-driven updates.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "measurable_id", "flag": "measurable-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Remove a Signal's drives_status binding from a goal; the goal keeps its last status and stops receiving signal-driven updates." },
   { "id": "goal.update", "namespace": "goal", "action": "update", "title": "Update Cascade goal", "description": "Update a goal's title or definition of done. Topology (parent/seat) and status have dedicated commands.", "requiredScope": "tenant_admin", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "goal_id", "flag": "goal-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": false }, { "name": "definition_of_done", "flag": "definition-of-done", "type": "string", "required": false }], "hasComplexInput": false, "help": "Update a goal's title or definition of done; topology and status have dedicated commands." },
   { "id": "graph.get", "namespace": "graph", "action": "get", "title": "Get Responsibility Graph", "description": "Return the tenant's Responsibility Graph: seats, edges, root, occupants, and status rollups.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read the Responsibility Graph to discover seat ids, parentage, occupants, and status before mutating or routing work." },
-  { "id": "integration.connect_rest", "namespace": "integration", "action": "connect_rest", "title": "Connect REST integration", "description": "Create or rotate the tenant Baserow REST integration using a vault-backed secret. Stores endpoint metadata only; never returns secrets or vault refs.", "requiredScope": "tenant_admin", "confirmation": "credential_flow", "exposeOverMcp": true, "fields": [{ "name": "provider", "flag": "provider", "type": "enum", "required": true, "enumValues": ["baserow"] }, { "name": "endpoint_url", "flag": "endpoint-url", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }, { "name": "account_label", "flag": "account-label", "type": "string", "required": false }], "hasComplexInput": false, "secretBlocked": true, "help": "Create or rotate a vault-backed Baserow REST integration for Signal pulls. Use the credential flow; never pass secrets through CLI argv." },
+  { "id": "integration.connect_rest", "namespace": "integration", "action": "connect_rest", "title": "Connect REST integration", "description": "Create or rotate the tenant Baserow REST integration using a vault-backed secret. Stores endpoint metadata only; never returns secrets or vault refs.", "requiredScope": "tenant_admin", "confirmation": "credential_flow", "exposeOverMcp": false, "fields": [{ "name": "provider", "flag": "provider", "type": "enum", "required": true, "enumValues": ["baserow"] }, { "name": "endpoint_url", "flag": "endpoint-url", "type": "string", "required": true }, { "name": "scope_description", "flag": "scope-description", "type": "string", "required": true }, { "name": "secret_name", "flag": "secret-name", "type": "string", "required": true }, { "name": "account_label", "flag": "account-label", "type": "string", "required": false }], "hasComplexInput": false, "secretBlocked": true, "help": "Create or rotate a vault-backed Baserow REST integration for Signal pulls. Use the credential flow; never pass secrets through CLI argv." },
   { "id": "integration.discover", "namespace": "integration", "action": "discover", "title": "Discover a connection for signals", "description": "Read-only introspection of a connected source for signal binding. Returns non-secret adapter metadata and a rest-for-signals recipe skeleton to author against signal.preview. Exposes no secrets.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "integration_id", "flag": "integration-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read-only introspection of a connected source: returns non-secret metadata + a recipe skeleton to author a signal pull against. No network." },
   { "id": "integration.list", "namespace": "integration", "action": "list", "title": "List integrations", "description": "List tenant integration metadata and health status. Returns account/scopes/capabilities only; never secrets or vault refs.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "provider", "flag": "provider", "type": "string", "required": false }], "hasComplexInput": false, "help": "List connected integrations and their metadata-only health state before enabling a connector-backed tool." },
   { "id": "integration.readiness", "namespace": "integration", "action": "readiness", "title": "Check integration readiness", "description": "Return a safe connector setup checklist for operators and agents. Starts with Google and exposes no secrets.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "provider", "flag": "provider", "type": "enum", "required": false, "enumValues": ["google"] }], "hasComplexInput": false, "help": "Read the connector setup checklist before relying on Google-backed agent work; the checklist names missing config, connection, scopes, external verification, and handler blockers." },
@@ -49646,6 +49800,8 @@ var COMMAND_MANIFEST = [
   { "id": "seat.set_type", "namespace": "seat", "action": "set_type", "title": "Set seat type", "description": "Set a Responsibility Graph seat type.", "requiredScope": "seat", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "seat_type", "flag": "seat-type", "type": "enum", "required": true, "enumValues": ["human", "agent", "hybrid"] }], "hasComplexInput": false, "help": "Seat type should follow the work, risk, measurable, and stewardship model." },
   { "id": "settings.agent_policy.get", "namespace": "settings", "action": "agent_policy.get", "title": "Get company autonomy ceiling", "description": "Read this company's Company Guardrails ceiling (ADR-0007): the profile, enforcement mode, and the most an agent may do autonomously (max_autonomous_risk). Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read this company's autonomy ceiling (Company Guardrails, ADR-0007): profile, enforcement mode, and the most an agent may do autonomously." },
   { "id": "settings.agent_policy.update", "namespace": "settings", "action": "agent_policy.update", "title": "Set company autonomy ceiling", "description": "Set the Company Guardrails ceiling (ADR-0007): a named profile (locked_down, balanced, high_autonomy) or custom + max_autonomous_risk. Tenant-admin and human-gated. An explicitly set ceiling is ENFORCED by default; pass enforcement=observe to stage a change without blocking.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "profile", "flag": "profile", "type": "enum", "required": true, "enumValues": ["locked_down", "balanced", "high_autonomy", "custom"] }, { "name": "max_autonomous_risk", "flag": "max-autonomous-risk", "type": "enum", "required": false, "enumValues": ["low", "medium", "high", "critical"] }, { "name": "enforcement", "flag": "enforcement", "type": "enum", "required": false, "enumValues": ["observe", "enforce"] }], "hasComplexInput": false, "help": "Set the company autonomy ceiling: a profile (locked_down, balanced, high_autonomy) or custom + max_autonomous_risk. Owner-only, human-gated, and enforced by default." },
+  { "id": "settings.confirmation_policy.get", "namespace": "settings", "action": "confirmation_policy.get", "title": "Get CLI confirmation mode", "description": "Read this company's CLI confirmation mode (DER-1490): careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations). Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read this company's CLI confirmation mode: careful (the strict default \u2014 the CLI cannot silently auto-approve a confirmation) or trusted_operator (an owner opt-in permitting silent auto-approval of non-dangerous confirmations)." },
+  { "id": "settings.confirmation_policy.update", "namespace": "settings", "action": "confirmation_policy.update", "title": "Set CLI confirmation mode", "description": "Set this company's CLI confirmation mode (DER-1490): careful (strict \u2014 no silent CLI auto-approval) or trusted_operator (owner opt-in permitting silent auto-approval of non-dangerous confirmations; dangerous confirmations always require an interactive review). Owner-only and human-gated: choosing trusted_operator establishes an ADR-0018 \xA76 standing authorization.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "cli_mode", "flag": "cli-mode", "type": "enum", "required": true, "enumValues": ["trusted_operator", "careful"] }], "hasComplexInput": false, "help": "Set the CLI confirmation mode to careful or trusted_operator. Owner-only and human-gated; trusted_operator establishes a standing authorization and dangerous confirmations still require an interactive review." },
   { "id": "settings.get", "namespace": "settings", "action": "get", "title": "Get tenant settings", "description": "Read tenant operating settings: plan, status, spend/budgets, integration status, and notification preferences. Returns metadata only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read tenant operating settings: plan, spend, budgets, integration status, and notification preferences. No secrets." },
   { "id": "settings.product_learning.get", "namespace": "settings", "action": "product_learning.get", "title": "Get product-learning policy", "description": "Read whether product/page/recommendation analytics may be recorded for this tenant. Security and audit logs remain enabled in every mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "Read whether product/page/recommendation analytics are allowed for the tenant; security and audit logs always stay enabled." },
   { "id": "settings.product_learning.update", "namespace": "settings", "action": "product_learning.update", "title": "Update product-learning policy", "description": "Set tenant product-learning participation. Disabled and enterprise-contract modes block generic product analytics writes, but not security/audit logs.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "mode", "flag": "mode", "type": "enum", "required": true, "enumValues": ["enabled", "disabled", "enterprise_contract"] }], "hasComplexInput": false, "help": "Set tenant product-learning mode to enabled, disabled, or enterprise_contract; the change is human-gated." },
@@ -50623,6 +50779,14 @@ function renderAgentPolicySet(output) {
   const policy = asRecord(asRecord(output).agent_policy);
   return `Set company autonomy ceiling to ${field(policy, "profile")} (max_autonomous_risk=${field(policy, "max_autonomous_risk")}, enforcement=${field(policy, "enforcement")}).`;
 }
+function renderConfirmationModeGet(output) {
+  const policy = asRecord(asRecord(output).confirmation_policy);
+  return `confirmation_policy cli_mode=${field(policy, "cli_mode")}  explicit=${field(policy, "explicit")}`;
+}
+function renderConfirmationModeSet(output) {
+  const policy = asRecord(asRecord(output).confirmation_policy);
+  return `Updated CLI confirmation mode to ${field(policy, "cli_mode")}.`;
+}
 function renderMemberInvite(output) {
   const record2 = asRecord(output);
   return `Invited ${field(record2, "email")} as ${field(record2, "role")} (invite ${field(record2, "invite_id")}).`;
@@ -51186,6 +51350,13 @@ var agentPolicySetHandler = bespoke("settings.agent_policy.update", (parsed) =>
     enforcement: optionalValue(parsed, "enforcement")
   });
 }, renderAgentPolicySet);
+var confirmationModeSetHandler = bespoke("settings.confirmation_policy.update", (parsed) => {
+  const mode = optionalValue(parsed, "mode");
+  if (mode !== "careful" && mode !== "trusted_operator") {
+    throw new UsageError("Provide --mode careful|trusted_operator.");
+  }
+  return { cli_mode: mode };
+}, renderConfirmationModeSet);
 var seatDecommissionHandler = (context, rest) => {
   const parsed = parseFlags(rest, /* @__PURE__ */ new Set(["dry-run", "preview", "yes", "y"]));
   if (parsed.flags.has("dry-run") || parsed.flags.has("preview")) {
@@ -51207,6 +51378,13 @@ var settingsAgentPolicyHandler = (context, rest) => dispatch(context, "settings
   },
   set: (ctx, r) => agentPolicySetHandler(ctx, r)
 }, `Usage: ${context.binName} settings agent-policy get|set --profile locked_down|balanced|high_autonomy|custom [--max-autonomous-risk <r>] [--enforcement enforce|observe]`);
+var settingsConfirmationModeHandler = (context, rest) => dispatch(context, "settings confirmation-mode", rest, {
+  get: (ctx, r) => {
+    const parsed = parseFlags(r, /* @__PURE__ */ new Set(["yes", "y"]));
+    return execute(ctx, parsed, "settings.confirmation_policy.get", {}, renderConfirmationModeGet);
+  },
+  set: (ctx, r) => confirmationModeSetHandler(ctx, r)
+}, `Usage: ${context.binName} settings confirmation-mode get|set --mode careful|trusted_operator`);
 var agentSetupHandler = (context, rest) => dispatch(context, "agent setup", rest, {
   status: (ctx, r) => {
     const parsed = parseFlags(r, /* @__PURE__ */ new Set(["yes", "y"]));
@@ -51385,6 +51563,7 @@ var GROUP_SPECS = {
       update: { commandId: "settings.update", handler: settingsUpdateHandler, render: renderSettingsUpdate },
       "product-learning": { commandId: "settings.product_learning.get", handler: settingsProductLearningHandler },
       "agent-policy": { commandId: "settings.agent_policy.get", handler: settingsAgentPolicyHandler },
+      "confirmation-mode": { commandId: "settings.confirmation_policy.get", handler: settingsConfirmationModeHandler },
       rename: { commandId: "tenant.rename", handler: settingsRenameHandler, render: renderTenantRename }
     }
   },
@@ -51501,6 +51680,8 @@ var EXTRA_SURFACED = /* @__PURE__ */ new Set([
   // settings product-learning update
   "settings.agent_policy.update",
   // settings agent-policy set
+  "settings.confirmation_policy.update",
+  // settings confirmation-mode set
   "skill.import_github"
   // skills import github
 ]);
@@ -51604,7 +51785,7 @@ function operationUsageLines(bin) {
     `${bin} runner install-service|start|stop|restart|status|logs|uninstall --name <name>`,
     `${bin} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume`,
     `${bin} notification settings|test|errors`,
-    `${bin} settings get|update|product-learning|agent-policy|rename`,
+    `${bin} settings get|update|product-learning|agent-policy|confirmation-mode|rename`,
     `${bin} member invite|update|remove`,
     `${bin} agent templates|create|setup|tools|dry-run|go-live|status|run-now|fleet-digest|get-run|show`,
     `${bin} tools list`,
@@ -51922,9 +52103,10 @@ async function executeSkillCommand(context, commandId, body, options = {}) {
   } catch (error51) {
     const pending = context.io.interactive === true ? pendingConfirmationFromError(error51) : null;
     if (pending && pending.commandId === commandId) {
+      renderPendingConfirmationGate2(context.io, pending);
       context.io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the interactive CLI user.
 `);
-      const approved = await context.client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
+      const approved = await context.client.execute("confirmation.approve", { confirmation_id: pending.confirmationId, reviewed: true });
       return asRecord2(approved.output).output ?? approved.output;
     }
     throw error51;
@@ -52170,7 +52352,30 @@ function pendingConfirmationFromError(error51) {
   if (typeof confirmationId !== "string" || confirmationId.length === 0 || typeof commandId !== "string" || commandId.length === 0) {
     return null;
   }
-  return { confirmationId, commandId };
+  const summary = typeof details.summary === "string" ? details.summary : void 0;
+  const riskLevel = typeof details.riskLevel === "string" ? details.riskLevel : void 0;
+  return {
+    confirmationId,
+    commandId,
+    ...summary === void 0 ? {} : { summary },
+    ...riskLevel === void 0 ? {} : { riskLevel },
+    ...details.diff === void 0 ? {} : { diff: details.diff }
+  };
+}
+function renderPendingConfirmationGate2(io, pending) {
+  if (pending.summary !== void 0) {
+    io.stderr.write(`${redactForLog(pending.summary)}
+`);
+  }
+  if (pending.riskLevel !== void 0) {
+    io.stderr.write(`Risk level: ${pending.riskLevel}
+`);
+  }
+  if (pending.diff !== void 0) {
+    io.stderr.write(`Diff:
+${redactForLog(pending.diff)}
+`);
+  }
 }
 
 // src/doctor.ts
@@ -52179,12 +52384,286 @@ import { access as access2 } from "node:fs/promises";
 import { delimiter } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
+// src/runner-sandbox.ts
+import { existsSync as existsSync2, realpathSync } from "node:fs";
+import { readdir, rm as rm2, stat as stat2 } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path3 from "node:path";
+var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+var RUNNER_ASKPASS_DIR = path3.join(tmpdir(), "rost-runner-askpass");
+var RUNNER_TEMP_PREFIXES = [
+  "rost-runner-mcp-",
+  "rost-runner-sandbox-",
+  "rost-runner-askpass-"
+];
+var RUNNER_TEMP_STARTUP_SWEEP_MAX_AGE_MS = 60 * 60 * 1e3;
+var RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS = 45 * 60 * 1e3;
+var SENSITIVE_READ_SUBPATHS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".config/gcloud",
+  ".config/gh",
+  ".kube",
+  ".docker",
+  ".npmrc"
+];
+var SENSITIVE_READ_LITERALS = [".netrc"];
+var SENSITIVE_WRITE_SUBPATHS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".config/git",
+  "bin",
+  "Library/LaunchAgents"
+];
+var SENSITIVE_WRITE_LITERALS = [
+  ".gitconfig",
+  ".zshrc",
+  ".zprofile",
+  ".zshenv",
+  ".zlogin",
+  ".bashrc",
+  ".bash_profile",
+  ".bash_login",
+  ".profile"
+];
+function parseSandboxMode(value) {
+  const normalized = (value ?? "auto").trim().toLowerCase();
+  if (normalized === "off" || normalized === "strict" || normalized === "auto" || normalized === "") {
+    return normalized === "" ? "auto" : normalized;
+  }
+  return "auto";
+}
+function parseSandboxNetwork(value) {
+  const normalized = (value ?? "").trim().toLowerCase();
+  if (normalized === "" || normalized === "allow") {
+    return { allowNetwork: true, unrecognized: null };
+  }
+  if (normalized === "deny") {
+    return { allowNetwork: false, unrecognized: null };
+  }
+  return { allowNetwork: true, unrecognized: value ?? "" };
+}
+function sbplString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function subpath(value) {
+  return `(subpath ${sbplString(value)})`;
+}
+function literal2(value) {
+  return `(literal ${sbplString(value)})`;
+}
+var CLAUDE_TEMP_SBPL_REGEX = '(regex #"^/private/tmp/claude-[^/]+")';
+var STRICT_SYSTEM_READ_SUBPATHS = [
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/System",
+  "/Library",
+  "/private/etc",
+  "/private/var/db",
+  "/dev",
+  "/opt",
+  "/nix"
+];
+function buildSeatbeltProfile(input) {
+  const home = input.homeDir.replace(/\/+$/, "");
+  const lines = ["(version 1)"];
+  const denyReadBaseSubpaths = input.denyReadPaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
+  const denyReadLiterals = input.denyReadPaths.filter((p) => !p.endsWith("/")).map(literal2);
+  const denyWriteSubpaths = input.denyWritePaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
+  const denyWriteLiterals = input.denyWritePaths.filter((p) => !p.endsWith("/")).map(literal2);
+  const credentialReadDenies = [
+    ...SENSITIVE_READ_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
+    ...SENSITIVE_READ_LITERALS.map((rel) => literal2(`${home}/${rel}`))
+  ];
+  if (input.strict) {
+    lines.push("(deny default)");
+    lines.push("(allow process*)");
+    lines.push("(allow sysctl-read)");
+    lines.push("(allow mach-lookup)");
+    lines.push("(allow iokit-open)");
+    lines.push("(allow system-socket)");
+    lines.push("(allow signal (target self))");
+    lines.push("(allow file-read-metadata)");
+    const strictReads = [
+      // The root directory NODE itself (not its children — `literal`, never `subpath`).
+      // dyld resolves the `/System/Volumes/Preboot/Cryptexes` firmlink to load the arm64
+      // shared cache at process start, and that resolution reads `/`; without this a
+      // deny-default profile SIGABRTs every spawned runtime (cat/node/claude) before it
+      // runs. `(literal "/")` grants only the root dir listing/metadata (no secret), while
+      // every child path stays individually deny-gated. (Guard never hits this branch.)
+      literal2("/"),
+      ...STRICT_SYSTEM_READ_SUBPATHS.map(subpath),
+      subpath(`${home}/.claude`),
+      subpath(`${home}/.codex`),
+      subpath(input.tmpDir)
+    ];
+    lines.push(`(allow file-read* ${strictReads.join(" ")})`);
+  } else {
+    lines.push("(allow default)");
+  }
+  lines.push("(deny appleevent-send)");
+  if (denyReadBaseSubpaths.length > 0) {
+    lines.push(`(deny file-read* ${denyReadBaseSubpaths.join(" ")})`);
+  }
+  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath), CLAUDE_TEMP_SBPL_REGEX];
+  lines.push(`(allow file-read* ${workspaceReads.join(" ")})`);
+  lines.push("(deny file-write*)");
+  const allowWrites = [
+    subpath(input.workspaceDir),
+    subpath(input.tmpDir),
+    subpath(`${home}/.claude`),
+    subpath(`${home}/.codex`),
+    ...input.allowWritePaths.map(subpath),
+    CLAUDE_TEMP_SBPL_REGEX,
+    // DER-1398: Claude Code's per-session + per-command temp dirs.
+    subpath("/dev/fd"),
+    literal2("/dev/null"),
+    literal2("/dev/stdout"),
+    literal2("/dev/stderr"),
+    literal2("/dev/tty"),
+    literal2("/dev/dtracehelper")
+  ];
+  lines.push(`(allow file-write* ${allowWrites.join(" ")})`);
+  const lastReadDenies = [
+    ...credentialReadDenies,
+    ...denyReadLiterals,
+    ...input.denyReadLastSubpaths.map((p) => subpath(p.replace(/\/+$/, "")))
+  ];
+  lines.push(`(deny file-read* ${lastReadDenies.join(" ")})`);
+  const denyWrites = [
+    ...SENSITIVE_WRITE_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
+    ...SENSITIVE_WRITE_LITERALS.map((rel) => literal2(`${home}/${rel}`)),
+    // Caller-supplied write-denies (e.g. `<baseRepo>/.git/hooks` + `.git/config`) last so
+    // they override the allowWritePaths re-allow of the shared object store above, while
+    // `.git/{objects,refs,worktrees,logs,index,HEAD}` stay writable for local commits.
+    ...denyWriteSubpaths,
+    ...denyWriteLiterals
+  ];
+  lines.push(`(deny file-write* ${denyWrites.join(" ")})`);
+  lines.push('(deny mach-lookup (global-name "com.apple.coreservices.appleevents"))');
+  if (!input.allowNetwork) {
+    lines.push("(deny network*)");
+  } else if (input.strict) {
+    lines.push("(allow network*)");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function canonical(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function canonicalFile(p) {
+  return path3.join(canonical(path3.dirname(p)), path3.basename(p));
+}
+function isSandboxExecAvailable() {
+  try {
+    return existsSync2(SANDBOX_EXEC_PATH);
+  } catch {
+    return false;
+  }
+}
+function resolveSandboxSpec(options) {
+  if (options.mode === "off") {
+    return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
+  }
+  if (options.platform !== "darwin") {
+    return { kind: "none", reason: `no OS sandbox on ${options.platform} (seatbelt is macOS-only; Linux confinement is a follow-up)` };
+  }
+  const available = options.sandboxExecAvailable ?? isSandboxExecAvailable();
+  if (!available) {
+    return { kind: "none", reason: `sandbox-exec not found at ${SANDBOX_EXEC_PATH}` };
+  }
+  const workspaceDir = canonical(options.workspaceDir);
+  const tmpDir = canonical(options.tmpDir);
+  const homeDir = canonical(options.homeDir);
+  const allowNetwork = options.allowNetwork ?? true;
+  const denyReadPaths = [canonicalFile(options.stateFile)];
+  if (options.runnerBaseDir) {
+    denyReadPaths.push(`${canonical(options.runnerBaseDir).replace(/\/+$/, "")}/`);
+  }
+  const denyWritePaths = (options.denyWritePaths ?? []).map(
+    (p) => p.endsWith("/") ? `${canonical(p.replace(/\/+$/, ""))}/` : canonicalFile(p)
+  );
+  denyWritePaths.push(`${canonicalFile(RUNNER_ASKPASS_DIR)}/`);
+  const allowWritePaths = (options.allowWritePaths ?? []).map(canonical);
+  const denyReadLastSubpaths = [`${canonicalFile(RUNNER_ASKPASS_DIR)}/`];
+  const profile = buildSeatbeltProfile({
+    workspaceDir,
+    tmpDir,
+    homeDir,
+    denyReadPaths,
+    denyReadLastSubpaths,
+    allowWritePaths,
+    denyWritePaths,
+    allowNetwork,
+    strict: options.mode === "strict"
+  });
+  return {
+    kind: "seatbelt",
+    reason: options.mode === "strict" ? "seatbelt (strict: deny-default reads + write confinement)" : "seatbelt (guard: deny sensitive reads/writes)",
+    profile,
+    allowNetwork
+  };
+}
+function forgeBuildUnsupportedReason(platform2) {
+  if (platform2 === "darwin") {
+    return null;
+  }
+  return `Forge build execution is unsupported on this host: no macOS seatbelt (sandbox-exec) confinement is available on '${platform2}', so this runner cannot prove filesystem/egress isolation for an untrusted build turn. The server will not offer Forge-phase work to this runner \u2014 unless its tenant is on the narrow, operator-established trust allowlist (FORGE_SANDBOX_TRUSTED_TENANT_IDS) \u2014 until real Linux confinement (namespaces/Landlock, tracked as a DER-1343 follow-up) ships.`;
+}
+function wrapCommandWithSandbox(spec, command, args, profilePath) {
+  if (spec.kind === "none" || profilePath === null) {
+    return { command, args, profilePath: null };
+  }
+  return {
+    command: SANDBOX_EXEC_PATH,
+    args: ["-f", profilePath, command, ...args],
+    profilePath
+  };
+}
+async function sweepStaleRunnerTempFiles(dir, options = {}) {
+  const maxAgeMs = options.maxAgeMs ?? RUNNER_TEMP_STARTUP_SWEEP_MAX_AGE_MS;
+  const now = options.now ?? Date.now();
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return [];
+  }
+  const removed = [];
+  await Promise.all(
+    entries.map(async (name) => {
+      if (!RUNNER_TEMP_PREFIXES.some((prefix) => name.startsWith(prefix))) {
+        return;
+      }
+      const full = path3.join(dir, name);
+      try {
+        const info = await stat2(full);
+        if (now - info.mtimeMs < maxAgeMs) {
+          return;
+        }
+        await rm2(full, { recursive: true, force: true });
+        removed.push(name);
+      } catch {
+      }
+    })
+  );
+  return removed;
+}
+
 // src/runner-service.ts
 import { execFile as execFileCallback2 } from "node:child_process";
-import { realpathSync } from "node:fs";
-import { access, mkdir as mkdir2, readFile as readFile3, readdir, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { access, mkdir as mkdir2, readFile as readFile3, readdir as readdir2, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
+import path4 from "node:path";
 import { promisify as promisify2 } from "node:util";
 var execFile2 = promisify2(execFileCallback2);
 var SERVICE_VERBS = ["install-service", "start", "stop", "restart", "status", "logs", "uninstall"];
@@ -52201,9 +52680,9 @@ function isRunnerServiceInvocation(args) {
 function runnerServicePaths(homeDir, runnerName) {
   const safeName = safeRunnerName(runnerName);
   return {
-    launchAgentPath: path3.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
-    stateFile: path3.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
-    logDir: path3.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
+    launchAgentPath: path4.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
+    stateFile: path4.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
+    logDir: path4.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
   };
 }
 function renderLaunchdPlist(config2) {
@@ -52245,9 +52724,9 @@ ${config2.allowDevelopmentAppUrl === true ? `    <key>${allowInsecureAppUrlEnv}<
   <key>RunAtLoad</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${escapePlist(path3.join(config2.logDir, "stdout.log"))}</string>
+  <string>${escapePlist(path4.join(config2.logDir, "stdout.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${escapePlist(path3.join(config2.logDir, "stderr.log"))}</string>
+  <string>${escapePlist(path4.join(config2.logDir, "stderr.log"))}</string>
 </dict>
 </plist>
 `;
@@ -52315,8 +52794,8 @@ async function installService(options) {
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
   await mkdir2(paths.logDir, { recursive: true });
-  await mkdir2(path3.dirname(paths.stateFile), { recursive: true });
-  await mkdir2(path3.dirname(paths.launchAgentPath), { recursive: true });
+  await mkdir2(path4.dirname(paths.stateFile), { recursive: true });
+  await mkdir2(path4.dirname(paths.launchAgentPath), { recursive: true });
   if (options.userCode !== void 0) {
     const paired = await pairRunnerOnce(options, safeName, paths.stateFile, options.userCode);
     if (!paired) {
@@ -52471,8 +52950,8 @@ async function logsService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
-  const stdoutLog = path3.join(paths.logDir, "stdout.log");
-  const stderrLog = path3.join(paths.logDir, "stderr.log");
+  const stdoutLog = path4.join(paths.logDir, "stdout.log");
+  const stderrLog = path4.join(paths.logDir, "stderr.log");
   options.io.stdout.write(
     `${[
       `runner service logs for ${label}:`,
@@ -52503,7 +52982,7 @@ async function uninstallService(options) {
   await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
   let removed = false;
   try {
-    await rm2(paths.launchAgentPath, { force: true });
+    await rm3(paths.launchAgentPath, { force: true });
     removed = true;
   } catch (error51) {
     options.io.stderr.write(
@@ -52576,10 +53055,10 @@ function serviceTargets(uid, label) {
 }
 async function inspectRunnerServiceInstallations(options = {}) {
   const homeDir = options.homeDir ?? homedir2();
-  const launchAgentsDir = path3.join(homeDir, "Library", "LaunchAgents");
+  const launchAgentsDir = path4.join(homeDir, "Library", "LaunchAgents");
   let names = [];
   try {
-    const entries = await readdir(launchAgentsDir);
+    const entries = await readdir2(launchAgentsDir);
     names = entries.map((entry) => runnerNameFromPlist(entry)).filter((value) => value !== null).sort((left, right) => left.localeCompare(right));
   } catch {
     return [];
@@ -52705,11 +53184,11 @@ function resolveNodePath() {
 }
 function buildServicePath(nodePath, homeDir) {
   const entries = [
-    path3.dirname(nodePath),
+    path4.dirname(nodePath),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    path3.join(homeDir, ".local", "bin"),
-    path3.join(homeDir, "bin"),
+    path4.join(homeDir, ".local", "bin"),
+    path4.join(homeDir, "bin"),
     "/usr/bin",
     "/bin",
     "/usr/sbin",
@@ -52758,7 +53237,7 @@ function resolveBinPath() {
     return cliBrand.binName;
   }
   try {
-    return realpathSync(entry);
+    return realpathSync2(entry);
   } catch {
     return entry;
   }
@@ -52897,6 +53376,10 @@ async function runDoctor(options) {
   lines.push(`version: ${currentVersion ?? "unknown"}`);
   const pathStatus = await checkPath(env);
   lines.push(pathStatus);
+  const forgeUnsupportedReason = forgeBuildUnsupportedReason(process.platform);
+  if (forgeUnsupportedReason) {
+    lines.push(`forge_build: unsupported - ${forgeUnsupportedReason}`);
+  }
   try {
     const session = await store.read();
     lines.push(`session: ${session ? `present (${store.describe()})` : `missing - run ${cliBrand.binName} login --device`}`);
@@ -53016,9 +53499,8 @@ import { promisify as promisify5 } from "node:util";
 // src/forge-workspace.ts
 import { execFile as execFileCallback4 } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, mkdir as mkdir3, rm as rm3, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path4 from "node:path";
+import { chmod, lstat, mkdir as mkdir3, mkdtemp, realpath, rm as rm4, stat as stat3, writeFile as writeFile3 } from "node:fs/promises";
+import path5 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify4 } from "node:util";
 
@@ -53155,20 +53637,20 @@ function shortRequestId(buildRequestId) {
   return slice.length > 0 ? slice : createHash("sha1").update(buildRequestId).digest("hex").slice(0, 8);
 }
 function requestRoot(baseDir, buildRequestId) {
-  return path4.join(baseDir, "work", shortRequestId(buildRequestId));
+  return path5.join(baseDir, "work", shortRequestId(buildRequestId));
 }
 function baseRepoDir(baseDir, buildRequestId) {
-  return path4.join(requestRoot(baseDir, buildRequestId), "base");
+  return path5.join(requestRoot(baseDir, buildRequestId), "base");
 }
 function branchName(buildRequestId, changeset) {
   const short = shortRequestId(buildRequestId);
   return changeset.total > 1 ? `forge/${short}-cs${changeset.ordinal}` : `forge/${short}`;
 }
 function buildWorktreeDir(baseDir, buildRequestId, ordinal) {
-  return path4.join(requestRoot(baseDir, buildRequestId), `cs${ordinal}`);
+  return path5.join(requestRoot(baseDir, buildRequestId), `cs${ordinal}`);
 }
 function reviewWorktreeDir(baseDir, buildRequestId, ordinal) {
-  return path4.join(requestRoot(baseDir, buildRequestId), `review-cs${ordinal}`);
+  return path5.join(requestRoot(baseDir, buildRequestId), `review-cs${ordinal}`);
 }
 function remoteUrlFor(options) {
   if (options.remoteUrl) {
@@ -53178,14 +53660,14 @@ function remoteUrlFor(options) {
 }
 async function pathExists(target) {
   try {
-    await stat2(target);
+    await stat3(target);
     return true;
   } catch {
     return false;
   }
 }
 async function isGitRepo(dir) {
-  return await pathExists(path4.join(dir, ".git")) || await pathExists(path4.join(dir, "HEAD"));
+  return await pathExists(path5.join(dir, ".git")) || await pathExists(path5.join(dir, "HEAD"));
 }
 async function runGit(args, cwd, timeoutMs = LOCAL_GIT_TIMEOUT_MS) {
   try {
@@ -53237,13 +53719,31 @@ async function withNetworkRetries(op, fn, retryCounter) {
   }
   throw new Error(`${op} exhausted retries: ${lastError instanceof Error ? redactSecrets(lastError.message) : redactSecrets(String(lastError))}`);
 }
-async function openAskpassSession(credential) {
-  const helperPath = path4.join(
-    // Same temp root the runner uses; the `rost-runner-askpass-` prefix is on the
-    // startup sweep's reap list, so a killed turn's orphan is cleaned up.
-    tmpdir(),
-    `rost-runner-askpass-${createHash("sha256").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.sh`
-  );
+async function canonicalAskpassBase(baseDir) {
+  return path5.join(await realpath(path5.dirname(baseDir)), path5.basename(baseDir));
+}
+async function prepareAskpassTurnDir(baseDir) {
+  await mkdir3(baseDir, { recursive: true, mode: 448 });
+  const baseInfo = await lstat(baseDir);
+  if (baseInfo.isSymbolicLink() || !baseInfo.isDirectory()) {
+    throw new Error(`refusing to use askpass dir ${baseDir}: not a real directory (possible symlink attack)`);
+  }
+  if (typeof process.getuid === "function" && baseInfo.uid !== process.getuid()) {
+    throw new Error(`refusing to use askpass dir ${baseDir}: not owned by this user (possible pre-planted dir)`);
+  }
+  await chmod(baseDir, 448);
+  const turnDir = await mkdtemp(path5.join(baseDir, "rost-runner-askpass-"));
+  const canonicalBase = await canonicalAskpassBase(baseDir);
+  const realTurn = await realpath(turnDir);
+  if (path5.dirname(realTurn) !== canonicalBase) {
+    await rm4(turnDir, { recursive: true, force: true });
+    throw new Error(`refusing to use askpass dir ${turnDir}: resolved outside ${canonicalBase} (possible symlink attack)`);
+  }
+  return turnDir;
+}
+async function openAskpassSession(credential, baseDir = RUNNER_ASKPASS_DIR) {
+  const turnDir = await prepareAskpassTurnDir(baseDir);
+  const helperPath = path5.join(turnDir, "askpass.sh");
   const helper = [
     "#!/bin/sh",
     "# One-shot Forge GIT_ASKPASS helper. Contains no secret; reads the token from env.",
@@ -53266,7 +53766,7 @@ async function openAskpassSession(credential) {
   return {
     env,
     cleanup: async () => {
-      await rm3(helperPath, { force: true });
+      await rm4(turnDir, { recursive: true, force: true });
     }
   };
 }
@@ -53304,8 +53804,8 @@ async function localBranchExists(baseRepo, branch) {
 async function worktreeRegistered(baseRepo, worktreeDir) {
   try {
     const listing = await runGit(["worktree", "list", "--porcelain"], baseRepo);
-    const target = path4.resolve(worktreeDir);
-    return listing.split("\n").some((line) => line.startsWith("worktree ") && path4.resolve(line.slice("worktree ".length).trim()) === target);
+    const target = path5.resolve(worktreeDir);
+    return listing.split("\n").some((line) => line.startsWith("worktree ") && path5.resolve(line.slice("worktree ".length).trim()) === target);
   } catch {
     return false;
   }
@@ -53316,7 +53816,7 @@ async function configureForgeIdentity(baseRepo) {
 }
 async function ensureBaseClone(input) {
   const baseRepo = baseRepoDir(input.baseDir, input.buildRequestId);
-  await mkdir3(path4.dirname(baseRepo), { recursive: true, mode: 448 });
+  await mkdir3(path5.dirname(baseRepo), { recursive: true, mode: 448 });
   await withLedgerStep(input.ledger, "clone", (retryCounter) => withAskpass(input.credential, async (netEnv) => {
     if (await isGitRepo(baseRepo)) {
       await runGitNetwork("git fetch", ["fetch", "--prune", "--quiet", input.url, "+refs/heads/*:refs/remotes/origin/*"], netEnv, baseRepo, FETCH_TIMEOUT_MS, retryCounter);
@@ -53365,7 +53865,7 @@ async function prepareMergeWorkspace(options) {
     ledger: options.ledger
   });
   const branch = options.headBranch;
-  const worktreeDir = path4.join(requestRoot(options.baseDir, options.buildRequestId), "merge");
+  const worktreeDir = path5.join(requestRoot(options.baseDir, options.buildRequestId), "merge");
   const originDefault = `origin/${options.repo.default_branch}`;
   const originHead = `origin/${branch}`;
   await withLedgerStep(options.ledger, "branch", async () => {
@@ -53402,7 +53902,7 @@ async function prepareReviewWorktree(options, baseRepo) {
   if (await worktreeRegistered(baseRepo, worktreeDir)) {
     await removeWorktree(baseRepo, worktreeDir);
   } else if (await pathExists(worktreeDir)) {
-    await rm3(worktreeDir, { recursive: true, force: true });
+    await rm4(worktreeDir, { recursive: true, force: true });
     await runGit(["worktree", "prune"], baseRepo).catch(() => void 0);
   }
   await runGit(["worktree", "add", "--detach", worktreeDir, headSha], baseRepo);
@@ -53735,267 +54235,18 @@ async function removeWorktree(baseRepo, worktreeDir) {
   try {
     await runGit(["worktree", "remove", "--force", worktreeDir], baseRepo);
   } catch {
-    await rm3(worktreeDir, { recursive: true, force: true });
+    await rm4(worktreeDir, { recursive: true, force: true });
   }
   await runGit(["worktree", "prune"], baseRepo).catch(() => void 0);
 }
 async function removeWorkspace(ws) {
   if (!await pathExists(ws.baseRepo)) {
-    await rm3(ws.worktreeDir, { recursive: true, force: true });
+    await rm4(ws.worktreeDir, { recursive: true, force: true });
     return;
   }
   await removeWorktree(ws.baseRepo, ws.worktreeDir);
 }
 
-// src/runner-sandbox.ts
-import { existsSync as existsSync2, realpathSync as realpathSync2 } from "node:fs";
-import { readdir as readdir2, rm as rm4, stat as stat3 } from "node:fs/promises";
-import path5 from "node:path";
-var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
-var RUNNER_TEMP_PREFIXES = [
-  "rost-runner-mcp-",
-  "rost-runner-sandbox-",
-  "rost-runner-askpass-"
-];
-var SENSITIVE_READ_SUBPATHS = [
-  ".ssh",
-  ".aws",
-  ".gnupg",
-  ".config/gcloud",
-  ".config/gh",
-  ".kube",
-  ".docker",
-  ".npmrc"
-];
-var SENSITIVE_READ_LITERALS = [".netrc"];
-var SENSITIVE_WRITE_SUBPATHS = [
-  ".ssh",
-  ".aws",
-  ".gnupg",
-  ".config/git",
-  "bin",
-  "Library/LaunchAgents"
-];
-var SENSITIVE_WRITE_LITERALS = [
-  ".gitconfig",
-  ".zshrc",
-  ".zprofile",
-  ".zshenv",
-  ".zlogin",
-  ".bashrc",
-  ".bash_profile",
-  ".bash_login",
-  ".profile"
-];
-function parseSandboxMode(value) {
-  const normalized = (value ?? "auto").trim().toLowerCase();
-  if (normalized === "off" || normalized === "strict" || normalized === "auto" || normalized === "") {
-    return normalized === "" ? "auto" : normalized;
-  }
-  return "auto";
-}
-function parseSandboxNetwork(value) {
-  const normalized = (value ?? "").trim().toLowerCase();
-  if (normalized === "" || normalized === "allow") {
-    return { allowNetwork: true, unrecognized: null };
-  }
-  if (normalized === "deny") {
-    return { allowNetwork: false, unrecognized: null };
-  }
-  return { allowNetwork: true, unrecognized: value ?? "" };
-}
-function sbplString(value) {
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
-}
-function subpath(value) {
-  return `(subpath ${sbplString(value)})`;
-}
-function literal2(value) {
-  return `(literal ${sbplString(value)})`;
-}
-var CLAUDE_TEMP_SBPL_REGEX = '(regex #"^/private/tmp/claude-[^/]+")';
-var STRICT_SYSTEM_READ_SUBPATHS = [
-  "/usr",
-  "/bin",
-  "/sbin",
-  "/System",
-  "/Library",
-  "/private/etc",
-  "/private/var/db",
-  "/dev",
-  "/opt",
-  "/nix"
-];
-function buildSeatbeltProfile(input) {
-  const home = input.homeDir.replace(/\/+$/, "");
-  const lines = ["(version 1)"];
-  const denyReadBaseSubpaths = input.denyReadPaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
-  const denyReadLiterals = input.denyReadPaths.filter((p) => !p.endsWith("/")).map(literal2);
-  const denyWriteSubpaths = input.denyWritePaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
-  const denyWriteLiterals = input.denyWritePaths.filter((p) => !p.endsWith("/")).map(literal2);
-  const credentialReadDenies = [
-    ...SENSITIVE_READ_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
-    ...SENSITIVE_READ_LITERALS.map((rel) => literal2(`${home}/${rel}`))
-  ];
-  if (input.strict) {
-    lines.push("(deny default)");
-    lines.push("(allow process*)");
-    lines.push("(allow sysctl-read)");
-    lines.push("(allow mach-lookup)");
-    lines.push("(allow iokit-open)");
-    lines.push("(allow system-socket)");
-    lines.push("(allow signal (target self))");
-    lines.push("(allow file-read-metadata)");
-    const strictReads = [
-      ...STRICT_SYSTEM_READ_SUBPATHS.map(subpath),
-      subpath(`${home}/.claude`),
-      subpath(`${home}/.codex`),
-      subpath(input.tmpDir)
-    ];
-    lines.push(`(allow file-read* ${strictReads.join(" ")})`);
-  } else {
-    lines.push("(allow default)");
-  }
-  lines.push("(deny appleevent-send)");
-  if (denyReadBaseSubpaths.length > 0) {
-    lines.push(`(deny file-read* ${denyReadBaseSubpaths.join(" ")})`);
-  }
-  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath), CLAUDE_TEMP_SBPL_REGEX];
-  lines.push(`(allow file-read* ${workspaceReads.join(" ")})`);
-  lines.push("(deny file-write*)");
-  const allowWrites = [
-    subpath(input.workspaceDir),
-    subpath(input.tmpDir),
-    subpath(`${home}/.claude`),
-    subpath(`${home}/.codex`),
-    ...input.allowWritePaths.map(subpath),
-    CLAUDE_TEMP_SBPL_REGEX,
-    // DER-1398: Claude Code's per-session + per-command temp dirs.
-    subpath("/dev/fd"),
-    literal2("/dev/null"),
-    literal2("/dev/stdout"),
-    literal2("/dev/stderr"),
-    literal2("/dev/tty"),
-    literal2("/dev/dtracehelper")
-  ];
-  lines.push(`(allow file-write* ${allowWrites.join(" ")})`);
-  lines.push(`(deny file-read* ${[...credentialReadDenies, ...denyReadLiterals].join(" ")})`);
-  const denyWrites = [
-    ...SENSITIVE_WRITE_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
-    ...SENSITIVE_WRITE_LITERALS.map((rel) => literal2(`${home}/${rel}`)),
-    // Caller-supplied write-denies (e.g. `<baseRepo>/.git/hooks` + `.git/config`) last so
-    // they override the allowWritePaths re-allow of the shared object store above, while
-    // `.git/{objects,refs,worktrees,logs,index,HEAD}` stay writable for local commits.
-    ...denyWriteSubpaths,
-    ...denyWriteLiterals
-  ];
-  lines.push(`(deny file-write* ${denyWrites.join(" ")})`);
-  lines.push('(deny mach-lookup (global-name "com.apple.coreservices.appleevents"))');
-  if (!input.allowNetwork) {
-    lines.push("(deny network*)");
-  } else if (input.strict) {
-    lines.push("(allow network*)");
-  }
-  return `${lines.join("\n")}
-`;
-}
-function canonical(p) {
-  try {
-    return realpathSync2(p);
-  } catch {
-    return p;
-  }
-}
-function canonicalFile(p) {
-  return path5.join(canonical(path5.dirname(p)), path5.basename(p));
-}
-function isSandboxExecAvailable() {
-  try {
-    return existsSync2(SANDBOX_EXEC_PATH);
-  } catch {
-    return false;
-  }
-}
-function resolveSandboxSpec(options) {
-  if (options.mode === "off") {
-    return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
-  }
-  if (options.platform !== "darwin") {
-    return { kind: "none", reason: `no OS sandbox on ${options.platform} (seatbelt is macOS-only; Linux confinement is a follow-up)` };
-  }
-  const available = options.sandboxExecAvailable ?? isSandboxExecAvailable();
-  if (!available) {
-    return { kind: "none", reason: `sandbox-exec not found at ${SANDBOX_EXEC_PATH}` };
-  }
-  const workspaceDir = canonical(options.workspaceDir);
-  const tmpDir = canonical(options.tmpDir);
-  const homeDir = canonical(options.homeDir);
-  const allowNetwork = options.allowNetwork ?? true;
-  const denyReadPaths = [canonicalFile(options.stateFile)];
-  if (options.runnerBaseDir) {
-    denyReadPaths.push(`${canonical(options.runnerBaseDir).replace(/\/+$/, "")}/`);
-  }
-  const denyWritePaths = (options.denyWritePaths ?? []).map(
-    (p) => p.endsWith("/") ? `${canonical(p.replace(/\/+$/, ""))}/` : canonicalFile(p)
-  );
-  const allowWritePaths = (options.allowWritePaths ?? []).map(canonical);
-  const profile = buildSeatbeltProfile({
-    workspaceDir,
-    tmpDir,
-    homeDir,
-    denyReadPaths,
-    allowWritePaths,
-    denyWritePaths,
-    allowNetwork,
-    strict: options.mode === "strict"
-  });
-  return {
-    kind: "seatbelt",
-    reason: options.mode === "strict" ? "seatbelt (strict: deny-default reads + write confinement)" : "seatbelt (guard: deny sensitive reads/writes)",
-    profile,
-    allowNetwork
-  };
-}
-function wrapCommandWithSandbox(spec, command, args, profilePath) {
-  if (spec.kind === "none" || profilePath === null) {
-    return { command, args, profilePath: null };
-  }
-  return {
-    command: SANDBOX_EXEC_PATH,
-    args: ["-f", profilePath, command, ...args],
-    profilePath
-  };
-}
-async function sweepStaleRunnerTempFiles(dir, options = {}) {
-  const maxAgeMs = options.maxAgeMs ?? 60 * 60 * 1e3;
-  const now = options.now ?? Date.now();
-  let entries;
-  try {
-    entries = await readdir2(dir);
-  } catch {
-    return [];
-  }
-  const removed = [];
-  await Promise.all(
-    entries.map(async (name) => {
-      if (!RUNNER_TEMP_PREFIXES.some((prefix) => name.startsWith(prefix))) {
-        return;
-      }
-      const full = path5.join(dir, name);
-      try {
-        const info = await stat3(full);
-        if (now - info.mtimeMs < maxAgeMs) {
-          return;
-        }
-        await rm4(full, { force: true });
-        removed.push(name);
-      } catch {
-      }
-    })
-  );
-  return removed;
-}
-
 // src/runner-serve.ts
 var execFile5 = promisify5(execFileCallback5);
 var RUNNER_WORK_ORDER_TOOLS = [
@@ -54011,7 +54262,6 @@ var RUNNER_AICOS_TURN_TOOLS = [
 var CLAUDE_WORKSPACE_WRITE_LOCAL_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep", "Bash"];
 var CLAUDE_READ_LOCAL_TOOLS = ["Read", "Glob", "Grep"];
 var READ_STUB_TIMEOUT_MS = 18e4;
-var FORGE_TURN_HARD_CEILING_SECONDS = 30 * 60;
 function claudeMcpToolName(name) {
   return name.startsWith("mcp__") ? name : `mcp__rost__${name}`;
 }
@@ -54039,12 +54289,19 @@ ${usage()}
 `);
   if (config2.sandboxNetworkWarning) {
     options.io.stderr.write(`warning: ${config2.sandboxNetworkWarning}
+`);
+  }
+  const forgeUnsupportedReason = forgeBuildUnsupportedReason(process.platform);
+  if (forgeUnsupportedReason) {
+    options.io.stdout.write(`forge build: ${forgeUnsupportedReason}
 `);
   }
   try {
     const swept = await sweepStaleRunnerTempFiles(tmpdir2());
-    if (swept.length > 0) {
-      options.io.stdout.write(`swept ${swept.length} stale runner temp file(s)
+    const sweptAskpass = await sweepStaleRunnerTempFiles(RUNNER_ASKPASS_DIR);
+    const total = swept.length + sweptAskpass.length;
+    if (total > 0) {
+      options.io.stdout.write(`swept ${total} stale runner temp file(s)
 `);
     }
   } catch {
@@ -54081,9 +54338,19 @@ ${usage()}
       }
       if (localRuntime) {
         activeSessions += 1;
+        const stopTurnHeartbeat = startTurnHeartbeat({
+          fetchImpl,
+          appUrl: options.appUrl,
+          secret: state.runner_secret,
+          intervalMs: config2.heartbeatMs,
+          capabilities,
+          io: options.io,
+          telemetry: () => detectTelemetry(capabilities, env, activeSessions, cliVersion)
+        });
         try {
           await claimAndExecute(fetchImpl, options.appUrl, state, config2, options.io, localRuntime);
         } finally {
+          stopTurnHeartbeat();
           activeSessions = Math.max(0, activeSessions - 1);
         }
       }
@@ -54115,6 +54382,44 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     }
   }
 }
+function startTurnHeartbeat(deps) {
+  let stopped = false;
+  let inFlight = false;
+  const timer = setInterval(() => {
+    if (stopped || inFlight) {
+      return;
+    }
+    inFlight = true;
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), deps.intervalMs);
+    timeout.unref?.();
+    void (async () => {
+      try {
+        const response = await post2(deps.fetchImpl, deps.appUrl, "/api/runner/heartbeat", {
+          capabilities: deps.capabilities,
+          telemetry: deps.telemetry()
+        }, deps.secret, controller.signal);
+        if (!stopped && response.status !== 200) {
+          deps.io.stderr.write(`turn heartbeat ${response.status}: ${redactForLog(JSON.stringify(response.json))}
+`);
+        }
+      } catch (error51) {
+        if (!stopped) {
+          deps.io.stderr.write(`turn heartbeat error (continuing): ${redactForLog(error51 instanceof Error ? error51.message : String(error51))}
+`);
+        }
+      } finally {
+        clearTimeout(timeout);
+        inFlight = false;
+      }
+    })();
+  }, deps.intervalMs);
+  timer.unref?.();
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}
 function resolveAccountAlias(env) {
   return (env.RUNNER_MODEL_ACCOUNT_ALIAS ?? env.ROST_RUNNER_MODEL_ACCOUNT_ALIAS ?? "").trim() || "default";
 }
@@ -54355,7 +54660,7 @@ async function startPairing(client, config2) {
 }
 async function detectCapabilities(cliVersion, env, homeDir) {
   const [claude, codex, git, gh, forgeDiskFreeMb] = await Promise.all([
-    probe("claude"),
+    probeClaude(),
     probe("codex"),
     probeGit(),
     probeGh(),
@@ -54416,6 +54721,48 @@ async function probe(command) {
     return { installed: false, version: null, auth_state: "unknown" };
   }
 }
+async function probeClaude() {
+  const base = await probe("claude");
+  if (!base.installed) {
+    return {
+      ...base,
+      account_alias: null,
+      rate_limited_until: null,
+      resident_session: {
+        status: "unsupported",
+        transport: null,
+        reason: "Claude CLI is not installed on this runner."
+      }
+    };
+  }
+  const streamJsonSupported = await probeClaudeStreamJsonInterface();
+  return {
+    ...base,
+    account_alias: null,
+    rate_limited_until: null,
+    resident_session: streamJsonSupported ? {
+      status: "prototype_gated",
+      transport: "stream-json",
+      reason: "Claude CLI exposes stream-json I/O, but the long-lived resident session path remains explicitly gated until multi-turn subscription behavior is proven on a paired runner."
+    } : {
+      status: "unsupported",
+      transport: null,
+      reason: "Claude CLI on this runner does not expose the required stream-json I/O surface for a resident session prototype."
+    }
+  };
+}
+async function probeClaudeStreamJsonInterface() {
+  try {
+    const { stdout, stderr } = await execFile5("claude", ["--help"], { timeout: 1500, maxBuffer: 1024 * 1024 });
+    return supportsClaudeStreamJsonInterface(`${stdout ?? ""}
+${stderr ?? ""}`);
+  } catch {
+    return false;
+  }
+}
+function supportsClaudeStreamJsonInterface(helpText2) {
+  return helpText2.includes("--input-format") && helpText2.includes("--output-format") && helpText2.includes("stream-json");
+}
 async function probeGit() {
   try {
     const { stdout, stderr } = await execFile5("git", ["--version"], { timeout: 1500 });
@@ -54453,7 +54800,7 @@ async function probeForgeDiskFreeMb(homeDir) {
     return null;
   }
 }
-async function post2(fetchImpl, appUrl2, pathName, body, token) {
+async function post2(fetchImpl, appUrl2, pathName, body, token, signal) {
   const headers = { "content-type": "application/json" };
   if (token) {
     headers.authorization = `Bearer ${token}`;
@@ -54461,7 +54808,10 @@ async function post2(fetchImpl, appUrl2, pathName, body, token) {
   const response = await fetchImpl(`${appUrl2.replace(/\/+$/, "")}${pathName}`, {
     method: "POST",
     headers,
-    body: JSON.stringify(body)
+    body: JSON.stringify(body),
+    // Optional per-call abort. Callers that pass no signal are unchanged; only the turn
+    // keepalive uses it to bound a hung POST so its in-flight guard always releases (DER-1484).
+    ...signal ? { signal } : {}
   });
   const text = await response.text();
   let json2;
@@ -54938,6 +55288,13 @@ function buildTurnPrompt(input) {
     `Claimed ${kind === "turn_execution" ? "turn execution" : "work order"} context: ${JSON.stringify(context).slice(0, 8e3)}`
   ].filter((line) => line.length > 0).join("\n");
 }
+async function sweepOrphanedTurnTempFiles() {
+  try {
+    await sweepStaleRunnerTempFiles(tmpdir2(), { maxAgeMs: RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS });
+    await sweepStaleRunnerTempFiles(RUNNER_ASKPASS_DIR, { maxAgeMs: RUNNER_TEMP_TURN_SWEEP_MAX_AGE_MS });
+  } catch {
+  }
+}
 async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   const execution = parseRunnerExecutionContract(workOrder);
   if (execution?.profile === "forge_merge") {
@@ -55020,6 +55377,7 @@ async function spawnRunnerTurn(ctx, workOrder, runtime, kind) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  void sweepOrphanedTurnTempFiles();
   if (forgePrep) {
     if (plan.profile === "forge_build" && result.ok && forgePrep.credential.canPush) {
       result = await finalizeForgeBuildPush(ctx, forgePrep, result);
@@ -55211,6 +55569,7 @@ async function spawnMergeConflictModel(ctx, input) {
   if (sandboxProfilePath) {
     void rm5(sandboxProfilePath, { force: true });
   }
+  void sweepOrphanedTurnTempFiles();
   return result;
 }
 async function runForgeMergeTurn(ctx, workOrder, execution, runtime) {
@@ -55308,6 +55667,20 @@ async function executeForgeMerge(ctx, input) {
 function scrubTranscriptSessionIds(value) {
   return value.replace(/("?(?:session_id|sessionId)"?\s*[:=]\s*"?)[A-Za-z0-9._-]+("?)/gi, "$1[redacted]$2");
 }
+function killProcessTree(child) {
+  const pid = child.pid;
+  if (typeof pid === "number") {
+    try {
+      process.kill(-pid, "SIGKILL");
+      return;
+    } catch {
+    }
+  }
+  try {
+    child.kill("SIGKILL");
+  } catch {
+  }
+}
 function runModelProcess(input) {
   return new Promise((resolve2) => {
     let settled = false;
@@ -55321,12 +55694,20 @@ function runModelProcess(input) {
     const child = spawn(input.command, input.args, {
       cwd: input.cwd,
       env: input.env,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      // DER-1569 FIX 1: give the turn its OWN process group so a timeout SIGKILL reaps the
+      // WHOLE tree, not just the direct child. sandbox-exec execvp's into the model (pid
+      // preserved), and the model's Bash tool forks build/test grandchildren that inherit this
+      // pgid; a plain `child.kill()` signals only the direct pid and orphans them to init.
+      // `detached` makes the child a group leader (pgid == child.pid) so `process.kill(-pid)`
+      // in killProcessTree hits the model and every descendant. We still await `close`, so the
+      // reference is kept (no `unref()`); the parent lifecycle is unchanged.
+      detached: true
     });
     let out = "";
     let err = "";
     const timer = setTimeout(() => {
-      child.kill("SIGKILL");
+      killProcessTree(child);
       const partial2 = scrubTranscriptSessionIds(redactForLog((out || err || "").trim()));
       finish({
         ok: false,
@@ -55544,6 +55925,15 @@ function usage() {
 }
 
 // src/index.ts
+async function defaultConfirmPrompt(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(`${question} `)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
 async function main(argv = process.argv.slice(2), options = {}) {
   const io = options.io ?? {
     stdout: process.stdout,
@@ -55552,7 +55942,10 @@ async function main(argv = process.argv.slice(2), options = {}) {
     // and stdout must be TTYs. A piped/headless/agent session fails this and so
     // will not auto-approve its own mint/revoke confirmation unless skip-
     // permissions is explicitly enabled.
-    interactive: process.stdin.isTTY === true && process.stdout.isTTY === true
+    interactive: process.stdin.isTTY === true && process.stdout.isTTY === true,
+    // DER-1490: a real session prompts the human on stdin before approving a
+    // pending confirmation gate.
+    confirm: defaultConfirmPrompt
   };
   const login = options.login ?? loginWithBrowser;
   const deviceLogin = options.deviceLogin ?? loginWithDeviceCode;
@@ -55982,11 +56375,13 @@ async function executeMcp(io, client, appUrl2, args, env = process.env) {
     const options = parseMcpInstallOptions(args.slice(1));
     const envSkipPermissions = env[`${cliBrand.envPrefix}_CLI_SKIP_PERMISSIONS`] === "1";
     const canAutoApprove = io.interactive === true || options.skipPermissions || envSkipPermissions;
+    const reviewed = io.interactive === true;
     const rendered = await renderMcpInstall({
       client,
       appUrl: appUrl2,
       options,
-      canAutoApprove
+      canAutoApprove,
+      reviewed
     });
     io.stdout.write(rendered.stdout);
     if (rendered.stderr) {
@@ -56056,15 +56451,21 @@ async function printCommandOutput(io, client, commandId, body = {}, format, opti
     return 0;
   } catch (error51) {
     const envAutoConfirm = process.env[`${cliBrand.envPrefix}_CLI_AUTO_CONFIRM`] === "1";
-    if (io.interactive === true || options.autoConfirm === true || envAutoConfirm) {
-      const pending = pendingConfirmationFromError2(error51);
-      if (pending && pending.commandId === commandId) {
-        const reason = io.interactive === true ? "interactive CLI user" : options.autoConfirm === true ? "explicit CLI auto-confirm" : `${cliBrand.envPrefix}_CLI_AUTO_CONFIRM environment auto-confirm`;
-        io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the ${reason}.
-`);
+    const pending = pendingConfirmationFromError2(error51);
+    if (pending && pending.commandId === commandId && (io.interactive === true || options.autoConfirm === true || envAutoConfirm)) {
+      renderPendingConfirmationGate3(io, pending);
+      if (io.interactive === true) {
+        const approved = io.confirm !== void 0 && await io.confirm(`Approve ${pending.commandId} (confirmation ${pending.confirmationId})? [y/N]`);
+        if (!approved) {
+          io.stderr.write("Not approved.\n");
+          return 1;
+        }
         try {
-          const approved = await client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
-          const approvedOutput = asRecord3(approved.output).output ?? approved.output;
+          const approvedResult = await client.execute("confirmation.approve", {
+            confirmation_id: pending.confirmationId,
+            reviewed: true
+          });
+          const approvedOutput = asRecord3(approvedResult.output).output ?? approvedResult.output;
           const rendered = format ? format(approvedOutput) : JSON.stringify(approvedOutput, null, 2);
           io.stdout.write(`${rendered}
 `);
@@ -56073,6 +56474,19 @@ async function printCommandOutput(io, client, commandId, body = {}, format, opti
           return printCommandError2(io, approvalError);
         }
       }
+      const reason = options.autoConfirm === true ? "explicit CLI auto-confirm" : `${cliBrand.envPrefix}_CLI_AUTO_CONFIRM environment auto-confirm`;
+      io.stderr.write(`Approving ${pending.commandId} confirmation ${pending.confirmationId} as the ${reason}.
+`);
+      try {
+        const approvedResult = await client.execute("confirmation.approve", { confirmation_id: pending.confirmationId });
+        const approvedOutput = asRecord3(approvedResult.output).output ?? approvedResult.output;
+        const rendered = format ? format(approvedOutput) : JSON.stringify(approvedOutput, null, 2);
+        io.stdout.write(`${rendered}
+`);
+        return 0;
+      } catch (approvalError) {
+        return printCommandError2(io, approvalError);
+      }
     }
     return printCommandError2(io, error51);
   }
@@ -56095,7 +56509,32 @@ function pendingConfirmationFromError2(error51) {
   if (typeof confirmationId !== "string" || confirmationId.length === 0 || typeof commandId !== "string" || commandId.length === 0) {
     return null;
   }
-  return { confirmationId, commandId };
+  const summary = typeof details.summary === "string" ? details.summary : void 0;
+  const riskLevel = typeof details.riskLevel === "string" ? details.riskLevel : void 0;
+  return {
+    confirmationId,
+    commandId,
+    ...summary === void 0 ? {} : { summary },
+    ...riskLevel === void 0 ? {} : { riskLevel },
+    ...details.diff === void 0 ? {} : { diff: details.diff }
+  };
+}
+function renderPendingConfirmationGate3(io, pending) {
+  io.stderr.write(`Confirmation required: ${pending.commandId} (${pending.confirmationId})
+`);
+  if (pending.summary !== void 0) {
+    io.stderr.write(`${redactForLog(pending.summary)}
+`);
+  }
+  if (pending.riskLevel !== void 0) {
+    io.stderr.write(`Risk level: ${pending.riskLevel}
+`);
+  }
+  if (pending.diff !== void 0) {
+    io.stderr.write(`Diff:
+${redactForLog(pending.diff)}
+`);
+  }
 }
 function printCommandError2(io, error51) {
   if (error51 instanceof CommandClientError && error51.response && !error51.response.ok) {