@rosthq/cli 0.7.89 → 0.7.91

package/dist/generated/command-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EA6Q3D,CAAC"}
+{"version":3,"file":"command-manifest.d.ts","sourceRoot":"","sources":["../../src/generated/command-manifest.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAE3E,eAAO,MAAM,gBAAgB,EAAE,SAAS,oBAAoB,EAgR3D,CAAC"}

package/dist/generator/groups.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/generator/groups.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAM1D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKhF,CAAC;AAwsCF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAmPjD,CAAC"}
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/generator/groups.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAM1D,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKhF,CAAC;AAitCF,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAmPjD,CAAC"}

package/dist/index.js

@@ -46341,11 +46341,16 @@ var statusEventPayloadSchema = external_exports.object({
     note: external_exports.string().min(1).optional()
   }).strict()).optional()
 }).strict();
+var escalationCategorySchema = external_exports.enum(["safety_refusal"]);
 var escalationEventPayloadSchema = external_exports.object({
   reason: external_exports.string().min(1),
   charter_clause: external_exports.string().min(1),
   evidence: evidenceSchema,
-  recommended_action: external_exports.string().min(1).optional()
+  recommended_action: external_exports.string().min(1).optional(),
+  // DER-1848: reason-adjacent category. Optional so every existing escalation event
+  // (and every ordinary held call) validates unchanged; present only when the agent
+  // explicitly escalated with a category (today: a safety refusal).
+  category: escalationCategorySchema.optional()
 }).strict();
 var issueEventPayloadSchema = external_exports.object({
   summary: external_exports.string().min(1),
@@ -46504,6 +46509,10 @@ var stewardReplayActionSummarySchema = external_exports.object({
   tool_name: external_exports.string(),
   run_id: uuidSchema20
 }).strict();
+var stewardProposedToolCallSchema = external_exports.object({
+  tool_name: external_exports.string(),
+  args_summary: external_exports.unknown()
+}).strict();
 var stewardEscalationSchema = external_exports.object({
   id: uuidSchema20,
   seat_id: uuidSchema20,
@@ -46513,11 +46522,19 @@ var stewardEscalationSchema = external_exports.object({
   steward_seat_name: external_exports.string(),
   reason: external_exports.string(),
   charter_clause: external_exports.string(),
+  // DER-1848: the first-class escalation category, or null for an ordinary held call.
+  // `safety_refusal` = the agent explicitly declined the task on safety grounds, so
+  // every read surface (command/MCP/web) can render "refused (safety)" distinctly from
+  // a routine held tool call. Sourced from the escalation event payload (no DB column).
+  category: escalationCategorySchema.nullable(),
   // DER-1634: secret-scrubbed evidence the agent attached when it escalated (the DB
   // scrubs it at write time; read projections re-scrub defensively — invariant #5).
   evidence: external_exports.unknown(),
   // DER-1634: scrubbed summary of the durable replay action, or null when there is none.
   replay_action_summary: stewardReplayActionSummarySchema.nullable(),
+  // DER-1818: the held tool call the steward is approving (present-only convention —
+  // omitted entirely when the escalation has no durable replay action).
+  proposed_tool_call: stewardProposedToolCallSchema.optional(),
   recommended_action: external_exports.string().nullable(),
   status: escalationStatusSchema,
   decided_by: uuidSchema20.nullable(),
@@ -46735,6 +46752,108 @@ var workDetailsSchemas = {
   }).strict()
 };
 
+// ../../packages/protocol/src/agent-grant-intervention.ts
+var uuidSchema21 = external_exports.string().uuid();
+var agentGrantBlockerKindSchema = external_exports.enum([
+  "rost_capability",
+  "os_permission",
+  "provider_connection",
+  "vault_credential",
+  "explicit_charter_escalation"
+]);
+var agentGrantInterventionStatusSchema = external_exports.enum([
+  "blocked",
+  "granted",
+  "resumed",
+  "declined",
+  "expired"
+]);
+var agentGrantKindSchema = external_exports.enum(["allow_once", "permanent"]);
+var agentGrantInterventionSchema = external_exports.object({
+  id: uuidSchema21,
+  seat_id: uuidSchema21,
+  seat_name: external_exports.string().nullable(),
+  agent_id: uuidSchema21.nullable(),
+  // The source blocked attempt (audit link); null once the run is retention-purged.
+  run_id: uuidSchema21.nullable(),
+  // The runner the blocker lives on, for os_permission repairs ("Open on Runner").
+  runner_id: uuidSchema21.nullable(),
+  // The linked continuation attempt, populated when a continuation is enqueued.
+  continuation_run_id: uuidSchema21.nullable(),
+  blocker_kind: agentGrantBlockerKindSchema,
+  status: agentGrantInterventionStatusSchema,
+  // The specific capability/scope requested (e.g. "gmail.send"), when applicable.
+  missing_capability: external_exports.string().nullable(),
+  // The specific, factually-stated ask shown to the human (no secrets, no raw UUIDs).
+  missing_grant_summary: external_exports.string(),
+  // Digest of the exact action the one-time grant is bound to. A stale/changed
+  // digest at decide time expires the grant rather than replaying a widened one.
+  action_digest: external_exports.string().nullable(),
+  // Bounded-checkpoint reference (the attempt's saved position/evidence, scrubbed).
+  checkpoint_ref: external_exports.string().nullable(),
+  // True once the blocked attempt released its lease/compute (AC #2 clean termination).
+  compute_released: external_exports.boolean(),
+  grant_kind: agentGrantKindSchema.nullable(),
+  decided_by: uuidSchema21.nullable(),
+  decided_by_name: external_exports.string().nullable(),
+  decided_at: external_exports.string().nullable(),
+  expires_at: external_exports.string().nullable(),
+  created_at: external_exports.string(),
+  updated_at: external_exports.string()
+}).strict();
+var agentGrantInterventionListInputSchema = external_exports.object({
+  // Optional seat filter (a seat-scoped caller is additionally clamped to its own seat).
+  seat_id: uuidSchema21.optional(),
+  // When true, include decided/terminal records (declined/resumed/expired) too;
+  // by default only the actionable open blocked/granted records are returned.
+  include_decided: external_exports.boolean().optional()
+}).strict();
+var agentGrantInterventionListOutputSchema = external_exports.object({
+  interventions: external_exports.array(agentGrantInterventionSchema)
+}).strict();
+var agentGrantInterventionGetInputSchema = external_exports.object({
+  id: uuidSchema21
+}).strict();
+var agentGrantInterventionGetOutputSchema = external_exports.object({
+  intervention: agentGrantInterventionSchema
+}).strict();
+var agentGrantInterventionDecideActionSchema = external_exports.enum(["grant", "decline"]);
+var agentGrantInterventionDecideInputSchema = external_exports.object({
+  intervention_id: uuidSchema21,
+  action: agentGrantInterventionDecideActionSchema,
+  // Defaults to allow_once. `permanent` never auto-widens — it returns
+  // requires_charter_resign so the surface routes the human to a Charter re-sign.
+  grant_kind: agentGrantKindSchema.optional(),
+  // When provided on a grant, must byte-match the record's action_digest (proves
+  // the human is authorizing the SAME exact action the agent blocked on); a
+  // mismatch expires the grant instead of replaying a stale/widened action.
+  action_digest: external_exports.string().optional(),
+  rationale: external_exports.string().trim().min(1).max(2e3).optional()
+}).strict();
+var agentGrantInterventionDecideOutputSchema = external_exports.object({
+  intervention_id: uuidSchema21,
+  status: agentGrantInterventionStatusSchema,
+  continuation_run_id: uuidSchema21.nullable(),
+  // The human decision row written for a grant/decline (invariant #7). Null only
+  // when a permanent grant deferred to a Charter re-sign (no one-time decision made).
+  decision_id: uuidSchema21.nullable(),
+  // True when the human chose the permanent option — the surface must route to a
+  // Charter re-sign; no authority was widened by this call (invariant #10).
+  requires_charter_resign: external_exports.boolean(),
+  // True when authority committed but the continuation enqueue did not complete —
+  // the human can retry ONLY the enqueue via `resume` (never re-grant).
+  enqueue_failed: external_exports.boolean()
+}).strict();
+var agentGrantInterventionResumeInputSchema = external_exports.object({
+  intervention_id: uuidSchema21
+}).strict();
+var agentGrantInterventionResumeOutputSchema = external_exports.object({
+  intervention_id: uuidSchema21,
+  status: agentGrantInterventionStatusSchema,
+  continuation_run_id: uuidSchema21.nullable(),
+  enqueue_failed: external_exports.boolean()
+}).strict();
+
 // ../../packages/protocol/src/index.ts
 var eventTypes = [
   "status",
@@ -46749,7 +46868,7 @@ var eventTypes = [
   "task"
 ];
 var publicMessageTypes = ["status", "handoff", "escalation", "issue"];
-var uuidSchema21 = external_exports.string().uuid();
+var uuidSchema22 = external_exports.string().uuid();
 var evidenceSchema2 = external_exports.array(external_exports.unknown());
 var internalEventPayloadSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine((payload) => !Array.isArray(payload), "Internal event payload must be an object");
 var handoffEventPayloadSchema = external_exports.object({
@@ -46759,24 +46878,24 @@ var handoffEventPayloadSchema = external_exports.object({
     acceptance_criteria: external_exports.array(external_exports.string().min(1)),
     due: external_exports.string().datetime({ offset: true })
   }).strict(),
-  to_seat_id: uuidSchema21
+  to_seat_id: uuidSchema22
 }).strict();
 var intakeEventPayloadSchema = external_exports.discriminatedUnion("action", [
   external_exports.object({
     action: external_exports.literal("uploaded"),
-    document_id: uuidSchema21,
+    document_id: uuidSchema22,
     storage_ref: external_exports.string().min(1)
   }).strict(),
   external_exports.object({
     action: external_exports.literal("parsed"),
-    document_id: uuidSchema21,
+    document_id: uuidSchema22,
     mode: external_exports.enum(["source_tree", "function_first"]),
     seat_count: external_exports.number().int().nonnegative(),
     edge_count: external_exports.number().int().nonnegative()
   }).strict(),
   external_exports.object({
     action: external_exports.literal("failed"),
-    document_id: uuidSchema21,
+    document_id: uuidSchema22,
     reason: external_exports.string().min(1)
   }).strict(),
   external_exports.object({
@@ -46882,9 +47001,9 @@ var publicMessageTypeSchema = external_exports.enum(publicMessageTypes);
 var eventEnvelopeBaseSchema = external_exports.object({
   protocol: external_exports.literal(EVENT_PROTOCOL),
   type: eventTypeSchema,
-  seat_id: uuidSchema21.nullable(),
+  seat_id: uuidSchema22.nullable(),
   occurred_at: external_exports.string().datetime({ offset: true }),
-  goal_ancestry: external_exports.array(uuidSchema21)
+  goal_ancestry: external_exports.array(uuidSchema22)
 }).strict();
 var statusEventEnvelopeSchema = eventEnvelopeBaseSchema.extend({
   type: external_exports.literal("status"),
@@ -48140,7 +48259,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-16.3",
+    version: "2026-07-16.5",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -48855,8 +48974,8 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_start_sync_run\` | \`sync.run.start\` | Ensure a Sync Brief exists so the meeting can begin. | Tenant | Call with \`{}\`. |
 | \`rost_complete_sync_run\` | \`sync.run.complete\` | Record that the Sync meeting completed (idempotent). | Tenant | Call with \`{"sync_brief_id":"<id>"}\`. |
 | \`rost_assign_sync_follow_up\` | \`sync.item.assign\` | Create a follow-up task from a Sync agenda item. | Tenant | Call with brief, owner seat, title, description. |
-| \`rost_list_escalations\` | \`escalation.list\` | List Steward queue escalations (own steward chain for humans, own seat for agents). | Seat or tenant-admin | Call with \`{}\` or \`{"include_decided":true}\`. |
-| \`rost_get_escalation\` | \`escalation.get\` | Read one escalation's secret-scrubbed evidence, recommendation, decision state, and \`replay_action_summary\` (the held tool + originating run a steward approval would replay \u2014 never the raw args). | Seat or tenant-admin | Call with \`{"id":"<escalation-id>"}\`. Resolve/reject are human-only and not exposed over MCP. |
+| \`rost_list_escalations\` | \`escalation.list\` | List Steward queue escalations (own steward chain for humans, own seat for agents). Each escalation that holds a replayable tool call also carries \`proposed_tool_call\` (\`{ tool_name, args_summary }\`, secret-scrubbed \u2014 never raw args). | Seat or tenant-admin | Call with \`{}\` or \`{"include_decided":true}\`. |
+| \`rost_get_escalation\` | \`escalation.get\` | Read one escalation's secret-scrubbed evidence, recommendation, decision state, \`replay_action_summary\` (the held tool + originating run a steward approval would replay \u2014 never the raw args), and \`proposed_tool_call\` (the same held call's \`{ tool_name, args_summary }\` payload, secret-scrubbed, present only when there is one). | Seat or tenant-admin | Call with \`{"id":"<escalation-id>"}\`. Resolve/reject are human-only and not exposed over MCP. |
 | \`rost_find_stale_escalations\` | \`escalation.stale_candidates\` | List aged open escalations on the caller's steward chain that still reference a concrete DER issue or PR, with a per-row confidence tier and evidence. Read-only. | Tenant | Call with optional \`stale_after_days\` and \`limit\`. The bulk override (\`escalation.bulk_resolve\`) is human-only and not exposed over MCP. |
 | \`rost_check_compass_alignment\` | \`compass.alignment\` | Advisory drift check: scores whether cycle goals still ladder to the active vision and flags orphan/contradictory goals. Read-only \u2014 it never edits the Compass or any goal. | Tenant | Call with \`{}\`. |
 | \`rost_team_health_score\` | \`team.health_score\` | Read the single rolled-up 0-100 team-health score (latest month) with its band and label. | Tenant | Call with \`{}\`. |
@@ -48875,6 +48994,9 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_revoke_agent_trusted_grant\` | \`agent.trust.revoke\` | Revoke an active Trusted grant while preserving history. | Tenant | Human steward/admin only; call with \`{"grant_id":"<grant-id>","reason":"..."}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_expire_agent_trusted_grants\` | \`agent.trust.expire\` | Mark overdue active Trusted grants expired and append audit events. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>"}\`. |
 | \`rost_supersede_agent_trusted_grant\` | \`agent.trust.supersede\` | Replace the active Trusted grant with a fresh digest and budget. | Tenant | Human steward/admin only; call with \`{"agent_id":"<agent-id>","expected_scope_digest":"sha256:...","budget_cents":2500}\`. |
+| \`rost_list_blocked_awaiting_grant_interventions\` | \`agent_grant_intervention.list\` | List durable blocked-awaiting-grant agent interventions with their missing grant, blocker kind, checkpoint, and decision state. Returns secret-scrubbed metadata only; a seat-scoped caller is clamped to its own seat. Pass \`include_decided\` to also return terminal (declined/resumed/expired) records. | Seat or tenant-admin | Call with \`{}\` (or \`{"seat_id":"<seat-id>","include_decided":true}\`). |
+| \`rost_decide_a_blocked_agent_grant\` | \`agent_grant_intervention.decide\` | Grant (one-time, exact-action) or decline a blocked agent intervention. A grant writes a human decision and enqueues the linked continuation; the \`permanent\` grant kind never auto-widens \u2014 it returns \`requires_charter_resign\` so the surface routes the human to a Charter re-sign. A supplied \`action_digest\` must byte-match the record's or the grant expires instead of replaying a stale action. Human steward/admin only and human-gated. | Tenant | Call with \`{"intervention_id":"<intervention-id>","action":"grant","grant_kind":"allow_once","action_digest":"sha256:..."}\`; non-interactive callers receive a confirmation handoff. |
+| \`rost_resume_a_granted_agent_intervention\` | \`agent_grant_intervention.resume\` | Retry ONLY the continuation enqueue for an already-granted blocked intervention whose enqueue did not complete. Never re-grants authority (the one-time grant is already committed). Human steward/admin only. | Tenant | Call with \`{"intervention_id":"<intervention-id>"}\`. |
 | \`rost_suggest_setup_capability_grants\` | \`agent_setup.capability_suggestions\` | Suggest deterministic minimum capability grants from the current setup/template and tenant grant availability. | Tenant | Call with \`{"seat_id":"<seat-id>"}\` or \`{"setup_id":"<agent-id>"}\`; no model call and no mutation. |
 | \`rost_list_skills\` | \`skill.list\` | List tenant Skills with application descriptors, dependency metadata, source status, latest version, and assigned Seat count. Seat-scoped reads are available through \`rost://skills\`. | Tenant-admin | Call with \`{}\` or \`{"query":"invoice"}\`. |
 | \`rost_list_rost_skill_catalog\` | \`skill.catalog\` | List entitled {{brand}} catalog Skills. Private catalog source URLs and credentials stay server-side. | Tenant-admin | Call with \`{}\`; use \`{"include_unentitled":true}\` only to inspect tier availability. |
@@ -49738,11 +49860,11 @@ Resolving Friction should produce one of four outcomes: a decision, a task, a Ch
     order: 70,
     title: "Steward queue guide",
     summary: "How Stewards review escalations, approve agent boundaries, and keep agents accountable.",
-    version: "2026-07-04.1",
+    version: "2026-07-16.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["staffing", "operating_rhythm"],
-    relatedCommandIds: ["charter.approve", "agent.go_live", "confirmation.approve", "confirmation.reject", "escalation.raise", "escalation.list", "escalation.get", "escalation.resolve", "escalation.reject"],
+    relatedCommandIds: ["charter.approve", "agent.go_live", "confirmation.approve", "confirmation.reject", "escalation.raise", "escalation.list", "escalation.get", "escalation.resolve", "escalation.reject", "agent_grant_intervention.list", "agent_grant_intervention.decide", "agent_grant_intervention.resume"],
     legal: {
       publicRisk: "low",
       notes: [
@@ -49783,6 +49905,10 @@ The Steward page itself only lists charter-clause escalations (Queue, Escalation
 
 An escalation reaches you the same way no matter how the agent raised it \u2014 in a chat or CLI session, or on its own scheduled cloud run. When the agent stops at a boundary it opens the queue item and sends a notification to the accountable human along the steward chain, preferring a connected Slack channel and falling back to email. If no human occupies the agent's seat, the chain walks up to the next Steward. Delivery is idempotent: a retried run never notifies you twice for the same escalation, and the notification carries only summarized, redacted evidence \u2014 never secret material.
 
+## Safety refusals read distinctly
+
+When an agent declines a task on safety grounds it raises a first-class **safety refusal**, not a silent stall. The escalation carries a \`category\` of \`safety_refusal\` that every read surface (the queue reads, the CLI/MCP \`escalation.list\`/\`escalation.get\` output, and the steward notification) shows differently from an ordinary held tool call \u2014 the notification reads "refused (safety)" and names that the agent declined and is waiting on you. A cloud run that ends because the agent refused is labeled "declined (safety)" in its run summary rather than reported as a plain success, so a refusal is always visible as a refusal.
+
 ## Where notifications land
 
 Every notification sent to you \u2014 escalations, approval requests, sync briefs, and your daily digest \u2014 also appears in your in-app Inbox, with unread state you can clear. A Slack or email delivery that fails is retried automatically on a bounded schedule; once it can no longer be delivered it stays visible in the Inbox rather than being lost. A once-a-day digest rolls up the day's deliverables, open approvals, and exceptions into a single message, so a quiet day stays quiet and a busy one is summarized in one place.
@@ -49795,6 +49921,16 @@ The Steward reads the queue from any surface but decides as a human.
 - Decide: \`{{cli}} escalation resolve\` / \`escalation.resolve\` and \`{{cli}} escalation reject\` / \`escalation.reject\`. \`escalation.resolve\` and \`escalation.reject\` are \`none\` at the confirmation layer, but they are deliberately NOT exposed over MCP \u2014 \`decisions.decided_by\` must be a human, so there is no \`rost_resolve_escalation\` tool. They are kept human-only by that MCP exclusion plus the human-only \`decided_by\`, not by a confirmation gate. The CLI runs them as the authenticated human; an agent session must hand the decision to a person.
 - Approve gated requests: when an escalation or Charter change produces a pending confirmation, the human approves with \`confirmation.approve\` (or rejects with \`confirmation.reject\`). Go-live runs through \`agent.go_live\`.
 
+## Blocked \u2014 awaiting grant
+
+Sometimes an agent cannot proceed because a specific grant is missing \u2014 a tool capability its Charter does not cover, an OS permission on its Runner, a provider connection that needs reconnecting, or a vaulted credential. When that happens the attempt does not sit paused holding compute: it terminates cleanly, releases its lease, and records a durable "blocked \u2014 awaiting grant" item with the exact missing grant and a bounded checkpoint. The item surfaces on the agent's seat and in Home's "Needs you" band with the specific ask and a one-click grant.
+
+Granting is a human decision. A one-time grant authorizes the exact action the agent blocked on and nothing more \u2014 it revalidates your current authority and never widens the Charter; if the action changed since it blocked, the stale grant is refused rather than replayed. Choosing to always allow that capability is a separate Charter re-sign, not a one-click action. Declining keeps the checkpoint for audit and creates no continuation. When you grant, a new linked continuation attempt is created from the checkpoint \u2014 the agent resumes from where it stopped, not from the start.
+
+- Read: \`{{cli}} command run agent_grant_intervention.list --json\` / \`agent_grant_intervention.list\` \u2014 the open blocked items with their blocker kind, missing grant, and checkpoint (secret-scrubbed metadata only).
+- Grant or decline: \`agent_grant_intervention.decide\` (\`action: grant\` or \`decline\`). A grant writes your decision (\`decisions.decided_by\` is you) and enqueues the continuation; a permanent grant returns \`requires_charter_resign\` so you review and re-sign the Charter instead of widening authority in place.
+- Resume: \`agent_grant_intervention.resume\` retries only the continuation enqueue for an already-granted item whose enqueue did not complete \u2014 it never re-grants authority.
+
 ## When to stop for confirmation
 
 Every steward decision is the human gate itself. An agent never calls resolve, reject, approve, or go-live on a human's behalf. It prepares evidence and a recommended action and stops. See the confirmations guide.
@@ -52155,6 +52291,9 @@ function parseSemver(value) {
 
 // src/generated/command-manifest.ts
 var COMMAND_MANIFEST = [
+  { "id": "agent_grant_intervention.decide", "namespace": "agent_grant_intervention", "action": "decide", "title": "Decide a blocked agent grant", "description": "Grant (one-time, exact-action) or decline a blocked agent intervention. A grant writes a human decision and enqueues the linked continuation; a permanent grant returns requires_charter_resign rather than widening authority. Human steward/admin only.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "intervention_id", "flag": "intervention-id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "enum", "required": true, "enumValues": ["grant", "decline"] }, { "name": "grant_kind", "flag": "grant-kind", "type": "enum", "required": false, "enumValues": ["allow_once", "permanent"] }, { "name": "action_digest", "flag": "action-digest", "type": "string", "required": false }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "Grant (one-time, exact-action) or decline a blocked agent intervention; a grant writes the human decision and enqueues the linked continuation, a permanent grant returns requires_charter_resign instead of widening authority. Human steward/admin only." },
+  { "id": "agent_grant_intervention.list", "namespace": "agent_grant_intervention", "action": "list", "title": "List blocked-awaiting-grant interventions", "description": "List durable blocked-awaiting-grant agent interventions with their missing grant, blocker kind, checkpoint, and decision state. Returns secret-scrubbed metadata only. A seat-scoped caller is clamped to its own seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "include_decided", "flag": "include-decided", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List durable blocked-awaiting-grant agent interventions with the exact missing grant, blocker kind, checkpoint, and decision state. Secret-scrubbed metadata only; a seat-scoped caller is clamped to its own seat." },
+  { "id": "agent_grant_intervention.resume", "namespace": "agent_grant_intervention", "action": "resume", "title": "Resume a granted agent intervention", "description": "Retry ONLY the continuation enqueue for an already-granted blocked intervention whose enqueue did not complete. Never re-grants authority (the one-time grant is already committed). Human steward/admin only.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "intervention_id", "flag": "intervention-id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Retry only the continuation enqueue for an already-granted intervention whose enqueue did not complete; never re-grants authority. Human steward/admin only." },
   { "id": "agent_setup.capability_suggestions", "namespace": "agent_setup", "action": "capability_suggestions", "title": "Suggest setup capability grants", "description": "Return deterministic minimum capability suggestions from a stock template and current tenant grant availability. No model call and no authority mutation.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "setup_id", "flag": "setup-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Suggest deterministic minimum capability grants from the setup/template and current tenant grant availability. No model call and no mutation." },
   { "id": "agent_setup.get", "namespace": "agent_setup", "action": "get", "title": "Get agent setup", "description": "Read the resumable agent-setup state: mode, parent, steward, template, lane, schedule, tool decisions, dry run, and next action.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": false }, { "name": "setup_id", "flag": "setup-id", "type": "string", "required": false }], "hasComplexInput": false, "help": "Read the resumable setup state: mode, parent, steward, lane, schedule, tool decisions, dry-run blockers, and the next action." },
   { "id": "agent_setup.relane", "namespace": "agent_setup", "action": "relane", "title": "Re-lane a live agent", "description": "Governed re-lane of a live agent: pause, move to the new lane, force a fresh dry-run rehearsal on that lane, then go live. Owner-only and human-gated; records a rationale.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "seat_id", "flag": "seat-id", "type": "string", "required": true }, { "name": "lane", "flag": "lane", "type": "enum", "required": true, "enumValues": ["cloud", "mcp_session", "runner"] }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Re-lane a live agent (cloud / runner / mcp_session): it pauses, moves to the new lane, forces a fresh dry-run rehearsal on that lane, then goes live \u2014 owner-only, human-gated, with a required rationale. A runner target needs a paired runner; a failed rehearsal leaves the agent paused on the new lane." },
@@ -52233,7 +52372,7 @@ var COMMAND_MANIFEST = [
   { "id": "escalation.bulk_resolve", "namespace": "escalation", "action": "bulk_resolve", "title": "Bulk resolve escalations", "description": "Override (safely close) a batch of stale open escalations in one human-confirmed action, with a required reason. Each escalation is decided independently (partial success) and writes its own human decision; already-decided, not-routed, or missing ids are skipped. Agents cannot bulk-resolve.", "requiredScope": "tenant", "confirmation": "human_required", "exposeOverMcp": false, "fields": [{ "name": "escalation_ids", "flag": "escalation-ids", "type": "array", "required": true, "itemType": "string" }, { "name": "reason", "flag": "reason", "type": "string", "required": true }], "hasComplexInput": false, "help": "Override (safely close) a batch of stale open escalations in one human-confirmed action; each records its own human decision and already-decided, not-routed, or missing ids are skipped. Agents cannot bulk-resolve." },
   { "id": "escalation.get", "namespace": "escalation", "action": "get", "title": "Get escalation", "description": "Read a single escalation the caller is allowed to see (own steward chain for humans, own seat for agents).", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }], "hasComplexInput": false, "help": "Read one escalation's evidence and recommendation before a human resolves or rejects it." },
   { "id": "escalation.list", "namespace": "escalation", "action": "list", "title": "List escalations", "description": "List Steward queue escalations routed to the caller's steward chain (human) or raised by the caller's seat (agent).", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "include_decided", "flag": "include-decided", "type": "boolean", "required": false }], "hasComplexInput": false, "help": "List Steward queue escalations (own chain for humans, own seat for agents) before resolving or routing them." },
-  { "id": "escalation.raise", "namespace": "escalation", "action": "raise", "title": "Raise escalation", "description": "Emit an escalation event and open a Steward queue item for the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "reason", "flag": "reason", "type": "string", "required": true }, { "name": "charter_clause", "flag": "charter-clause", "type": "string", "required": true }, { "name": "recommended_action", "flag": "recommended-action", "type": "string", "required": false }], "hasComplexInput": true, "help": "Raise an escalation to the seat's Steward when a decision exceeds the seat's authority; humans decide." },
+  { "id": "escalation.raise", "namespace": "escalation", "action": "raise", "title": "Raise escalation", "description": "Emit an escalation event and open a Steward queue item for the acting seat.", "requiredScope": "seat", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "reason", "flag": "reason", "type": "string", "required": true }, { "name": "charter_clause", "flag": "charter-clause", "type": "string", "required": true }, { "name": "recommended_action", "flag": "recommended-action", "type": "string", "required": false }, { "name": "category", "flag": "category", "type": "enum", "required": false, "enumValues": ["safety_refusal"] }], "hasComplexInput": true, "help": "Raise an escalation to the seat's Steward when a decision exceeds the seat's authority; humans decide." },
   { "id": "escalation.reject", "namespace": "escalation", "action": "reject", "title": "Reject escalation", "description": "Override an open escalation so the agent must not proceed. Writes a human decision; agents cannot reject.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "Reject (override) an escalation so the agent must not proceed; the decision records the human decider. Agents cannot reject." },
   { "id": "escalation.resolve", "namespace": "escalation", "action": "resolve", "title": "Resolve escalation", "description": "Approve an open escalation (or convert it to Friction). Writes a human decision; agents cannot resolve.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": false, "fields": [{ "name": "id", "flag": "id", "type": "string", "required": true }, { "name": "action", "flag": "action", "type": "enum", "required": false, "enumValues": ["approve", "convert_to_issue"] }, { "name": "rationale", "flag": "rationale", "type": "string", "required": false }], "hasComplexInput": false, "help": "Resolve an escalation as a human Steward; the decision records decided_by as the approving human. Agents cannot resolve." },
   { "id": "escalation.stale_candidates", "namespace": "escalation", "action": "stale_candidates", "title": "Find stale escalations", "description": "List open escalations routed to the caller's steward chain that have aged and still reference a concrete DER issue or PR, with a per-row confidence tier and evidence. Read-only \u2014 it never decides anything.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "stale_after_days", "flag": "stale-after-days", "type": "integer", "required": false }, { "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List aged open escalations in the caller's steward chain that still reference a concrete DER issue or PR \u2014 candidates for a bulk override. Read-only." },
@@ -53139,6 +53278,9 @@ function renderConfirmationList(output) {
     return `${field(record2, "id")}  ${field(record2, "risk_level")}  ${field(record2, "command_id")}  ${field(record2, "summary")}`;
   }).join("\n");
 }
+function safetyRefusalTag(record2) {
+  return record2.category === "safety_refusal" ? "[safety refusal] " : "";
+}
 function renderEscalationList(output) {
   const escalations = asArray(asRecord(output).escalations);
   if (escalations.length === 0) {
@@ -53146,12 +53288,12 @@ function renderEscalationList(output) {
   }
   return escalations.map((escalation) => {
     const record2 = asRecord(escalation);
-    return `${field(record2, "id")}  ${field(record2, "status")}  ${field(record2, "seat_name")}: ${field(record2, "reason")}`;
+    return `${field(record2, "id")}  ${field(record2, "status")}  ${safetyRefusalTag(record2)}${field(record2, "seat_name")}: ${field(record2, "reason")}`;
   }).join("\n");
 }
 function renderEscalationGet(output) {
   const record2 = asRecord(asRecord(output).escalation);
-  return `${field(record2, "id")}  ${field(record2, "status")}  ${field(record2, "seat_name")}
+  return `${field(record2, "id")}  ${field(record2, "status")}  ${safetyRefusalTag(record2)}${field(record2, "seat_name")}
 reason: ${field(record2, "reason")}
 recommended: ${field(record2, "recommended_action")}`;
 }