@sema-agent/cli 1.0.100 → 1.0.101

package/sema-main.js

@@ -49104,7 +49104,7 @@ function isRewindFamilyCode(code2) {
 function asModelFallbackReason(v2) {
   return v2 === MODEL_FALLBACK_INHERIT_NO_TIER_BINDING ? MODEL_FALLBACK_INHERIT_NO_TIER_BINDING : void 0;
 }
-var LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, LIMITS_ERROR_CODE_PREFIX, USAGE_WINDOW_EXHAUSTED, ENV_LIFETIME_EXPIRED, CONFIG_LIMIT_INVALID, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_REFUSAL_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, DELEGATION_CAP_CODES, MCP_SERVER_REVOKED, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, TOOL_END_INTERRUPTED_CODES, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, ACTIVE_RUN_BUSY_ERROR_CODE, STOP_PARK_ARBITER_UNREACHABLE, STOP_PARK_RESUME_WON, STOP_NOT_LANDED, STOP_NOT_LOCAL, STOP_PARKED, STOP_CONFLICT_CODES, OUTPUT_INVALID, RESUME_AT_ERROR_CODE_PREFIX, REWIND_ERROR_CODE_PREFIXES, RESUME_USAGE_WINDOW_EXHAUSTED, RESUME_PREFLIGHT_REJECTED, RESUME_RETRY_LATER_CODES, DRAINING_ERROR_CODE, SCENARIO_NOT_ALLOWED_ERROR_CODE, STREAM_MAX_DURATION, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, init_engineErrorCodes = __esm({
+var LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, LIMITS_ERROR_CODE_PREFIX, USAGE_WINDOW_EXHAUSTED, ENV_LIFETIME_EXPIRED, CONFIG_LIMIT_INVALID, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_DELEGATION_ENTRY_CAPS, CONFIG_REFUSAL_CODES, DELEGATION_CONCURRENCY_CAP, DELEGATION_SESSION_CAP, DELEGATION_CAP_CODES, MCP_SERVER_REVOKED, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, TOOL_END_INTERRUPTED_CODES, CAPABILITY_SELF_ORCHESTRATION_REQUIRED, ACTIVE_RUN_BUSY_ERROR_CODE, STOP_PARK_ARBITER_UNREACHABLE, STOP_PARK_RESUME_WON, STOP_NOT_LANDED, STOP_NOT_LOCAL, STOP_PARKED, STOP_CONFLICT_CODES, OUTPUT_INVALID, RESUME_AT_ERROR_CODE_PREFIX, REWIND_ERROR_CODE_PREFIXES, RESUME_USAGE_WINDOW_EXHAUSTED, RESUME_PREFLIGHT_REJECTED, RESUME_PLACEMENT_MISMATCH, RESUME_RETRY_LATER_CODES, DRAINING_ERROR_CODE, SCENARIO_NOT_ALLOWED_ERROR_CODE, STREAM_MAX_DURATION, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, init_engineErrorCodes = __esm({
   "node_modules/@sema-agent/client-core/dist/engineErrorCodes.js"() {
     LIMITS_MAX_TOKENS_EXCEEDED = "limits.max_tokens_exceeded", LIMITS_MAX_COST_EXCEEDED = "limits.max_cost_exceeded", LIMITS_MAX_TURNS_EXCEEDED = "limits.max_turns_exceeded", LIMITS_MAX_WALLTIME_EXCEEDED = "limits.max_walltime_exceeded", LIMITS_ERROR_CODE_PREFIX = "limits.";
     USAGE_WINDOW_EXHAUSTED = "usage.window_exhausted", ENV_LIFETIME_EXPIRED = "env.lifetime_expired", CONFIG_LIMIT_INVALID = "config.limit_invalid", CONFIG_STRATEGY_FIND_LIMIT_INVALID = "config.strategy_find_limit_invalid", CONFIG_STRATEGY_MAX_SIZE_INVALID = "config.strategy_max_size_invalid", CONFIG_LIMIT_UNKNOWN_KEY = "config.limit_unknown_key", CONFIG_DELEGATION_ENTRY_CAPS = "config.delegation_entry_caps", CONFIG_REFUSAL_CODES = /* @__PURE__ */ new Set([
@@ -49129,7 +49129,7 @@ var LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TURNS_EXCEE
       STOP_NOT_LOCAL,
       STOP_PARKED
     ], OUTPUT_INVALID = "output.invalid", RESUME_AT_ERROR_CODE_PREFIX = "resume_at.", REWIND_ERROR_CODE_PREFIXES = [RESUME_AT_ERROR_CODE_PREFIX, "rewind_snapshot."];
-    RESUME_USAGE_WINDOW_EXHAUSTED = "resume.usage_window_exhausted", RESUME_PREFLIGHT_REJECTED = "resume.preflight_rejected", RESUME_RETRY_LATER_CODES = Object.freeze([
+    RESUME_USAGE_WINDOW_EXHAUSTED = "resume.usage_window_exhausted", RESUME_PREFLIGHT_REJECTED = "resume.preflight_rejected", RESUME_PLACEMENT_MISMATCH = "resume.placement_mismatch", RESUME_RETRY_LATER_CODES = Object.freeze([
       RESUME_USAGE_WINDOW_EXHAUSTED,
       RESUME_PREFLIGHT_REJECTED
     ]), DRAINING_ERROR_CODE = "draining", SCENARIO_NOT_ALLOWED_ERROR_CODE = "scenario_not_allowed", STREAM_MAX_DURATION = "STREAM_MAX_DURATION", MODEL_FALLBACK_INHERIT_NO_TIER_BINDING = "inherit_no_tier_binding";
@@ -53425,6 +53425,25 @@ function eventToSdkMessage(ev, ctx) {
      */
     case "approval_request":
       return dropped("unsupported_arm", "approval_request");
+    /**
+     * `approval_revoke`(design/172 撤卡帧;server ≥7.55.0 起也进重放,SDK 8.x 才把它写进
+     * `AgentEvent` union —— 0.58.0 sdk 8.2.0 提货批**编译期逼进来**的臂,与 `engine_notice`
+     * / `human_input` 走的是同一条路:臂一进 union,`default` 的 B5 穷举断言当场红)。
+     *
+     * 🔴 **与 `approval_request` 同源同处置,所以并**在它旁边而不是并进上面那两条 —— 它是
+     *    同一条流内审批协议的**撤销**半场(载荷同是 `ApprovalFrameEnvelope`,`schemaVersion`
+     *    未知的帧要按信封先读再窄化)。本包今天**零消费口**:`isToolApprovalFrame` 只认
+     *    legacy 的 `tool_approval` / `tool_approval_complete` 两词,新族两帧一个都不接。
+     * 🔴 分类 = `dropped/unsupported_arm` 而**不是** `nothing/not_in_slice`(与
+     *    `approval_request` 同一条理由,逐字见上一臂):`none` 是静默的,只有 `dropped` 会经
+     *    `reportDroppedFrame` 走宿主 sink + console 留痕。撤卡帧带的是**用户可见的状态迁移**
+     *    (那张卡已经不该再被决断了),悄悄丢掉它比吼一行更坏。
+     * 📋 缺口如实记账(**不**在本批修 —— 与 `approval_request` 是同一条新卡链,属功能不属修复):
+     *    接法在上一臂的「接法」段里写着,撤卡半场按 `approvalId` 撤同一张卡;在那条链落地之前
+     *    **不许**由本切片顺手编一个假 transcript 形来假装接上了。
+     */
+    case "approval_revoke":
+      return dropped("unsupported_arm", "approval_revoke");
     // ── `engine_notice`(#310 / #318 件①,server ≥7.36,契约 = ASSISTANT-WIRE-CONTRACT 附录 D)────
     // 🔴 **到期复核已兑现(sdk 7.4.0 提货,0.48.0)** —— 与 `human_input`(sdk 6.9.0)逐字同一条路。
     //    本臂此前是 switch **之前**的一条 raw 预分派,理由 = 它还没进已发布 SDK 的 `AgentEvent`
@@ -56641,6 +56660,37 @@ var capByBase2, CAP_FALSE_RETRY_TTL_MS2, activeTails, activitySink, tailMetaSink
   }
 });
 
+// node_modules/@sema-agent/client-core/dist/resumeRefusalCopy.js
+function resumeRefusalFromError(err8) {
+  if (typeof err8 != "object" || err8 === null)
+    return null;
+  let code2 = err8.errorCode;
+  if (typeof code2 != "string" || !RESUME_REFUSAL_CODES.includes(code2))
+    return null;
+  if (code2 === RESUME_PLACEMENT_MISMATCH)
+    return { code: code2, waitable: !1 };
+  let timed = resumeRetryLaterFromError(err8);
+  return timed === null ? { code: code2, waitable: !1 } : {
+    code: code2,
+    waitable: timed.waitable,
+    ...timed.retryAfterSec !== void 0 ? { retryAfterSec: timed.retryAfterSec } : {}
+  };
+}
+function resumeRefusalContent(detail) {
+  let parts = [];
+  return detail.code === RESUME_PLACEMENT_MISMATCH ? (parts.push("This resume named a different placement root than the one recorded when the work was parked"), parts.push("The engine refused it before consuming anything \u2014 the parked work is untouched"), parts.push("Retry with the recorded root, or omit the placement root to inherit it"), parts.join(" \xB7 ")) : (parts.push("The deployment's resume preflight refused this attempt"), parts.push("The refusal happened before the commit \u2014 your decision was not consumed"), parts.push(detail.waitable ? "The engine supplied a wait, so this token stays redeemable once the obstacle clears" : "The engine line above says whether this token can still be redeemed"), parts.join(" \xB7 "));
+}
+var RESUME_REFUSAL_CODES, init_resumeRefusalCopy = __esm({
+  "node_modules/@sema-agent/client-core/dist/resumeRefusalCopy.js"() {
+    init_engineErrorCodes();
+    init_wireErrorTriage();
+    RESUME_REFUSAL_CODES = Object.freeze([
+      RESUME_PLACEMENT_MISMATCH,
+      RESUME_PREFLIGHT_REJECTED
+    ]);
+  }
+});
+
 // node_modules/@sema-agent/client-core/dist/sessionMap.js
 function engineNamespaceKeyFor(baseUrl) {
   if (!baseUrl)
@@ -59420,6 +59470,7 @@ var HITL_ASK_QUESTION_ID_PREFIX, PLAN_REVIEW_QUESTION_ID_PREFIX, HITL_FRAME_CALL
 });
 
 // node_modules/@sema-agent/client-core/dist/hitl/toolApprovalWire.js
+import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS } from "@sema-agent/sdk";
 function isFsApprovalGate(gate) {
   return gate ? gate.kind === "tool_approval" ? !0 : typeof gate.toolName == "string" && toolNameIsFsWrite(gate.toolName) : !1;
 }
@@ -59684,13 +59735,46 @@ function isNonNegativeFinite(v2) {
 function isWireRecordCarrier(v2) {
   return typeof v2 == "object" && v2 !== null && !Array.isArray(v2);
 }
+function isRuleOfferMatch(v2) {
+  return typeof v2 == "string" && RULE_OFFER_MATCHES.includes(v2);
+}
 function readRuleTriple(v2) {
   if (v2 === null || typeof v2 != "object")
     return;
   let o = v2;
-  if (!(typeof o.rule != "string" || o.rule === "") && !(o.match !== "exact" && o.match !== "prefix") && !(typeof o.command != "string" || o.command === ""))
+  if (!(typeof o.rule != "string" || o.rule === "") && isRuleOfferMatch(o.match) && !(typeof o.command != "string" || o.command === ""))
     return { rule: o.rule, match: o.match, command: o.command };
 }
+function readRuleOfferBatchMember(v2) {
+  if (v2 === null || typeof v2 != "object")
+    return;
+  let o = v2, seg = o.segment;
+  if (typeof seg != "string" || seg === "")
+    return;
+  let kind = o.kind === void 0 ? "command" : o.kind;
+  if (typeof kind == "string" && RULE_OFFER_BATCH_MEMBER_KINDS.includes(kind)) {
+    if (kind === "directoryRead") {
+      let rule = o.rule, dir = o.directory;
+      return typeof rule != "string" || rule === "" || typeof dir != "string" || dir === "" ? void 0 : { kind: "directoryRead", rule, directory: dir, segment: seg };
+    }
+    if (kind === "command") {
+      let triple = readRuleTriple(v2);
+      return triple === void 0 ? void 0 : { kind: "command", ...triple, segment: seg };
+    }
+  }
+}
+function readUncoveredDetail(v2) {
+  if (!Array.isArray(v2) || v2.length === 0 || v2.length > MAX_RULE_OFFER_UNCOVERED_DETAIL_TOLERATED)
+    return;
+  let out6 = [];
+  for (let raw2 of v2) {
+    if (raw2 === null || typeof raw2 != "object")
+      continue;
+    let o = raw2;
+    typeof o.segment != "string" || o.segment === "" || typeof o.reason == "string" && RULE_OFFER_UNCOVERED_REASONS.includes(o.reason) && out6.push({ segment: o.segment, reason: o.reason });
+  }
+  return out6.length > 0 ? out6 : void 0;
+}
 function readRuleOffers(v2) {
   if (!Array.isArray(v2) || v2.length === 0 || v2.length > MAX_RULE_OFFERS_TOLERATED)
     return;
@@ -59715,16 +59799,23 @@ function readRuleOffers(v2) {
         continue;
       let members = [], memberShapeOk = !0;
       for (let raw2 of o.rules) {
-        let triple = readRuleTriple(raw2), seg = raw2?.segment;
-        if (triple === void 0 || typeof seg != "string" || seg === "") {
+        let member = readRuleOfferBatchMember(raw2);
+        if (member === void 0) {
           memberShapeOk = !1;
           break;
         }
-        members.push({ ...triple, segment: seg });
+        members.push(member);
       }
       if (!memberShapeOk)
         continue;
-      out6.push({ kind: "batch", offerIndex: i, rules: members, uncoveredSegments: uncovered });
+      let detail = readUncoveredDetail(item.uncoveredDetail);
+      out6.push({
+        kind: "batch",
+        offerIndex: i,
+        rules: members,
+        uncoveredSegments: uncovered,
+        ...detail !== void 0 ? { uncoveredDetail: detail } : {}
+      });
       continue;
     }
   }
@@ -59863,7 +59954,7 @@ async function surfaceToolApprovalFrameAndRespond(frame, respond, streamArgs, si
     return hostLog("debug", `liveToolApprovalWire: respond(${decision}) failed for ${frame.approvalId} (status=${respondRefusal?.status ?? "none"} errorCode=${logSafeErrorCode(respondRefusal?.errorCode)} messageLen=${respondRefusal?.message?.length ?? 0}) \u2014 engine self-settles (TTL/abort); the refusal text is handed back on outcome.respondRefusal for the host to surface`), respondRefusal !== void 0 ? { decision: "unresolved", respondRefusal } : { decision: "unresolved" };
   }
 }
-var cardPortByKey, cardPortMissesByKey, TOOL_APPROVAL_FRAME_KEYS_MIRROR, RESPOND_DECISIONS, USELESS_REFUSAL_TEXTS, MACHINE_CODE_SHAPE, FS_WRITE_GATE_ASK_PATTERN, MAX_RULE_OFFERS_TOLERATED, MAX_RULE_OFFER_BATCH_MEMBERS_TOLERATED, MAX_RESPOND_NOTE_CHARS, init_toolApprovalWire = __esm({
+var cardPortByKey, cardPortMissesByKey, TOOL_APPROVAL_FRAME_KEYS_MIRROR, RESPOND_DECISIONS, USELESS_REFUSAL_TEXTS, MACHINE_CODE_SHAPE, FS_WRITE_GATE_ASK_PATTERN, MAX_RULE_OFFERS_TOLERATED, MAX_RULE_OFFER_BATCH_MEMBERS_TOLERATED, MAX_RULE_OFFER_UNCOVERED_DETAIL_TOLERATED, MAX_RESPOND_NOTE_CHARS, init_toolApprovalWire = __esm({
   "node_modules/@sema-agent/client-core/dist/hitl/toolApprovalWire.js"() {
     init_hitlBridge();
     init_host();
@@ -59890,16 +59981,16 @@ var cardPortByKey, cardPortMissesByKey, TOOL_APPROVAL_FRAME_KEYS_MIRROR, RESPOND
       "governanceForced",
       // sdk 6.14.0 追平(#225 件1,client-core 0.26.0):server 7.12.0 起真发规则候选 —— 门
       // (run-approval-frame-keys-test.mjs)在 bump SDK 当天恰红抓获本键缺席,本次补齐。
-      // ⚠️ **退役键**(server 7.46.0 起同文件 0 命中):留在镜像里是因为 sdk 7.2.0 的运行期锚仍含它,
+      // ⚠️ **退役键**(server 7.46.0 起同文件 0 命中):留在镜像里是因为 sdk 8.2.0 的运行期锚仍含它,
       // 删了对账门的「SDK 锚的每个键本仓都有」当场红;本包对它只做归一读(见帧上同名键的 JSDoc)。
       "ruleSuggestions",
       // #334/[5223](client-core 0.43.0):server 7.46.0 起把规则候选整体换成判别联合 `ruleOffers`
       // (core 5.58.0 design/375;engine 7.46.0 fixture 的 `@sema-agent/server/dist/tool-approval.d.ts`
-      // 直证,同文件旧键 0 命中)。sdk 7.2.0 锚**尚无**本键 ⇒ 与 `requiresRealApproval`/窗三键同形=
-      // **领先**,进对账门 AHEAD_OF_ANCHOR 带退出条件登记。
+      // 直证,同文件旧键 0 命中)。✅ **sdk 8.2.0 锚已含本键**(S-134 锚②)⇒ 0.58.0 提货批按退出
+      // 条件删掉了对账门里那条 AHEAD_OF_ANCHOR 领先登记,本键回到「逐元素相等」的常态。
       "ruleOffers",
       // #341/[5214]③(client-core 0.43.0):server 7.46.0 起真发 `inputHasBidi`(E-14 Trojan Source 族;
-      // 7.44 fixture 同文件 0 命中)。同样**领先** sdk 7.2.0 锚 ⇒ AHEAD_OF_ANCHOR 登记。
+      // 7.44 fixture 同文件 0 命中)。仍**领先** sdk 8.2.0 锚(node 直读 18 项无本键)⇒ AHEAD_OF_ANCHOR 登记。
       "inputHasBidi",
       // 🔴 **同形族扫的产物**(client-core 0.43.0,[same-shape-residue-constitution]):本批的病形是
       // 「镜像滞后于 server 实发键」。族扫 = 把 engine 7.46.0 fixture 的 `ToolApprovalFrame` 23 个声明键
@@ -59929,7 +60020,7 @@ var cardPortByKey, cardPortMissesByKey, TOOL_APPROVAL_FRAME_KEYS_MIRROR, RESPOND
       "requiresRealApproval",
       // [4851] 头号请托(client-core 0.38.2):server 7.34.0 起真发窗三键(#288/[4429]② cli 自己请托,
       // server src/tool-approval.ts 三键声明+条件 stamp)。⚠️ 与 requiresRealApproval 同形=**领先** SDK
-      // 运行期锚(sdk 7.2.0 锚 17 项,node 直读实证无三键)⇒ 进对账门 AHEAD_OF_ANCHOR 带退出条件登记
+      // 运行期锚(sdk 8.2.0 锚 18 项,node 直读实证无三键)⇒ 进对账门 AHEAD_OF_ANCHOR 带退出条件登记
       // (SDK 追平当天登记自红逼删)。0.38.1 把三键丢在包边界外 = [4845]「卡到期屏幕零反应」的直接成因
       // (壳读器 readAskDeadlineMs 早已预埋,缺的一直是包边界这一格——#283 逐字同形第四例)。
       "expiresInMs",
@@ -59942,7 +60033,7 @@ var cardPortByKey, cardPortMissesByKey, TOOL_APPROVAL_FRAME_KEYS_MIRROR, RESPOND
     USELESS_REFUSAL_TEXTS = /* @__PURE__ */ new Set(["[object Object]", "null", "undefined", ""]);
     MACHINE_CODE_SHAPE = /^[A-Za-z0-9._:-]{1,64}$/;
     FS_WRITE_GATE_ASK_PATTERN = /^approve write to "([^"]+)"\?$/;
-    MAX_RULE_OFFERS_TOLERATED = 8, MAX_RULE_OFFER_BATCH_MEMBERS_TOLERATED = 8;
+    MAX_RULE_OFFERS_TOLERATED = 8, MAX_RULE_OFFER_BATCH_MEMBERS_TOLERATED = 8, MAX_RULE_OFFER_UNCOVERED_DETAIL_TOLERATED = 32;
     MAX_RESPOND_NOTE_CHARS = 2048;
   }
 });
@@ -63548,7 +63639,9 @@ __export(dist_exports, {
   RESUME_CHOICE_BACKGROUND_LABEL: () => RESUME_CHOICE_BACKGROUND_LABEL,
   RESUME_CHOICE_CANCEL_LABEL: () => RESUME_CHOICE_CANCEL_LABEL,
   RESUME_CHOICE_HEADER: () => RESUME_CHOICE_HEADER,
+  RESUME_PLACEMENT_MISMATCH: () => RESUME_PLACEMENT_MISMATCH,
   RESUME_PREFLIGHT_REJECTED: () => RESUME_PREFLIGHT_REJECTED,
+  RESUME_REFUSAL_CODES: () => RESUME_REFUSAL_CODES,
   RESUME_RETRY_LATER_CODES: () => RESUME_RETRY_LATER_CODES,
   RESUME_RUNNING_GUIDANCE_TAG: () => RESUME_RUNNING_GUIDANCE_TAG,
   RESUME_RUNNING_NO_UI_EXIT_CODE: () => RESUME_RUNNING_NO_UI_EXIT_CODE,
@@ -63557,6 +63650,9 @@ __export(dist_exports, {
   REWIND_ERROR_CODE_PREFIXES: () => REWIND_ERROR_CODE_PREFIXES,
   RULE_NOT_SENT_REJECTED_WARN_TEXT: () => RULE_NOT_SENT_REJECTED_WARN_TEXT,
   RULE_NOT_SENT_WARN_TEXT: () => RULE_NOT_SENT_WARN_TEXT,
+  RULE_OFFER_BATCH_MEMBER_KINDS: () => RULE_OFFER_BATCH_MEMBER_KINDS,
+  RULE_OFFER_MATCHES: () => RULE_OFFER_MATCHES,
+  RULE_OFFER_UNCOVERED_REASONS: () => RULE_OFFER_UNCOVERED_REASONS,
   RUNNING_STATES: () => RUNNING_STATES,
   RUN_BLOCKED_MESSAGE_PREFIX: () => RUN_BLOCKED_MESSAGE_PREFIX,
   RUN_LEVEL_STOP_ERROR_CODES: () => RUN_LEVEL_STOP_ERROR_CODES,
@@ -64114,6 +64210,8 @@ __export(dist_exports, {
   respondToQuestion: () => respondToQuestion,
   resumeAttachReplayDisclosure: () => resumeAttachReplayDisclosure,
   resumeChoiceFromLabels: () => resumeChoiceFromLabels,
+  resumeRefusalContent: () => resumeRefusalContent,
+  resumeRefusalFromError: () => resumeRefusalFromError,
   resumeRetryLaterFromError: () => resumeRetryLaterFromError,
   resumeRunningCancelUnconfirmedRow: () => resumeRunningCancelUnconfirmedRow,
   resumeRunningLivenessRow: () => resumeRunningLivenessRow,
@@ -64320,6 +64418,7 @@ var init_dist = __esm({
     init_engineWireTarget();
     init_principalWire();
     init_wireErrorTriage();
+    init_resumeRefusalCopy();
     init_sessionMap();
     init_detachWire();
     init_workflowMonitor();
@@ -89000,38 +89099,87 @@ var consumedProbe, init_metaComboFallback = __esm({
 // build-src/src/utils/earlyInput.ts
 var earlyInput_exports = {};
 __export(earlyInput_exports, {
+  __earlyInputStateForTests: () => __earlyInputStateForTests,
+  __processChunkForTests: () => __processChunkForTests,
+  __setEarlyInputStateForTests: () => __setEarlyInputStateForTests,
   consumeEarlyInput: () => consumeEarlyInput,
   flushPendingEscape: () => flushPendingEscape,
   foldEarlyInput: () => foldEarlyInput,
   hasEarlyInput: () => hasEarlyInput,
   isCapturingEarlyInput: () => isCapturingEarlyInput,
   releaseEarlyInputForNonReplLane: () => releaseEarlyInputForNonReplLane,
+  replayHandover: () => replayHandover,
   seedEarlyInput: () => seedEarlyInput,
   startCapturingEarlyInput: () => startCapturingEarlyInput,
   stopCapturingEarlyInput: () => stopCapturingEarlyInput
 });
+function earlyInputTrace(line) {
+  try {
+    let argv = process.argv, path28;
+    for (let i = 0; i < argv.length; i++) {
+      let a = argv[i];
+      if (a.startsWith("--debug-file=")) {
+        path28 = a.slice(13);
+        break;
+      }
+      if (a === "--debug-file" && typeof argv[i + 1] == "string") {
+        path28 = argv[i + 1];
+        break;
+      }
+    }
+    if (!path28) return;
+    __require("node:fs").appendFileSync(path28, `${(/* @__PURE__ */ new Date()).toISOString()} [DEBUG] [earlyInput] ${line}
+`);
+  } catch {
+  }
+}
 function startCapturingEarlyInput() {
-  if (!(!process.stdin.isTTY || isCapturing || process.argv.includes("-p") || process.argv.includes("--print"))) {
-    isCapturing = !0, captureArmedStdin = !0, earlyInputBuffer = "", flushPendingEscape();
-    try {
-      process.stdin.setEncoding("utf8"), process.stdin.setRawMode(!0), process.stdin.ref(), readableHandler = () => {
-        let chunk2 = process.stdin.read();
-        for (; chunk2 !== null; )
-          typeof chunk2 == "string" && processChunk(chunk2), chunk2 = process.stdin.read();
-      }, process.stdin.on("readable", readableHandler);
-    } catch {
-      isCapturing = !1;
+  if (!process.stdin.isTTY || isCapturing || process.argv.includes("-p") || process.argv.includes("--print"))
+    return;
+  isCapturing = !0, captureArmedStdin = !0, earlyInputBuffer = "", flushPendingEscape();
+  let handedOver = { chunks: [], stopped: !1 };
+  try {
+    let slot = globalThis[EARLY_INPUT_PRELUDE_SLOT];
+    slot !== void 0 && typeof slot.detach == "function" && (handedOver = slot.detach(), delete globalThis[EARLY_INPUT_PRELUDE_SLOT]);
+  } catch {
+    handedOver = { chunks: [], stopped: !1 };
+  }
+  try {
+    process.stdin.readableEncoding !== "utf8" && process.stdin.setEncoding("utf8"), process.stdin.setRawMode(!0), process.stdin.ref(), readableHandler = () => {
+      let chunk2 = process.stdin.read();
+      for (; chunk2 !== null; )
+        typeof chunk2 == "string" && processChunk(chunk2), chunk2 = process.stdin.read();
+    }, process.stdin.on("readable", readableHandler), replayHandover(handedOver, Date.now()), earlyInputTrace(`capture armed: handover chunks=${String(handedOver.chunks.length)} bytes=${String(handedOver.chunks.reduce((n2, c2) => n2 + c2.s.length, 0))} stopped=${String(handedOver.stopped)} buffer=${String(earlyInputBuffer.length)} capturing=${String(isCapturing)}`);
+  } catch (e) {
+    isCapturing = !1, earlyInputTrace(`capture FAILED: ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
+  }
+}
+function replayHandover(h, now2) {
+  let list = h.chunks;
+  for (let i = 0; i < list.length; i++) {
+    let cur = list[i];
+    if (processChunk(cur.s), !isCapturing) return;
+    if (pendingEscape !== "\x1B") continue;
+    if (i + 1 < list.length) {
+      list[i + 1].t - cur.t > PENDING_ESCAPE_FLUSH_MS && flushPendingEscape();
+      continue;
     }
+    let waited = now2 - cur.t;
+    waited > PENDING_ESCAPE_FLUSH_MS ? flushPendingEscape() : armPendingEscapeFlush(PENDING_ESCAPE_FLUSH_MS - waited);
   }
 }
 function clearPendingEscapeTimer() {
   pendingEscapeTimer !== null && (clearTimeout(pendingEscapeTimer), pendingEscapeTimer = null);
 }
 function flushPendingEscape() {
-  clearPendingEscapeTimer(), pendingEscape = "";
+  clearPendingEscapeTimer(), pendingEscape = "", pendingEscapeDeadline = -1;
 }
-function armPendingEscapeFlush() {
-  clearPendingEscapeTimer(), pendingEscape === "\x1B" && (pendingEscapeTimer = setTimeout(flushPendingEscape, PENDING_ESCAPE_FLUSH_MS), pendingEscapeTimer.unref?.());
+function armPendingEscapeFlush(remainingMs = PENDING_ESCAPE_FLUSH_MS) {
+  if (clearPendingEscapeTimer(), pendingEscape !== "\x1B") {
+    pendingEscapeDeadline = -1;
+    return;
+  }
+  lastArmedEscapeMs = Math.max(0, remainingMs), pendingEscapeDeadline = Date.now() + lastArmedEscapeMs, pendingEscapeTimer = setTimeout(flushPendingEscape, lastArmedEscapeMs), pendingEscapeTimer.unref?.();
 }
 function foldEarlyInput(buffer5, pending4, str3) {
   let buf = buffer5, s = pending4 + str3, i = 0;
@@ -89086,7 +89234,7 @@ function processChunk(str3) {
       break;
     }
   }
-  clearPendingEscapeTimer();
+  pendingEscape === "\x1B" && pendingEscapeDeadline >= 0 && Date.now() > pendingEscapeDeadline && flushPendingEscape(), clearPendingEscapeTimer();
   let folded = foldEarlyInput(earlyInputBuffer, pendingEscape, head);
   if (earlyInputBuffer = folded.buffer, pendingEscape = folded.pending, armPendingEscapeFlush(), tail === "ctrl-c") {
     stopCapturingEarlyInput(), process.exit(130);
@@ -89117,7 +89265,16 @@ function releaseEarlyInputForNonReplLane() {
 function consumeEarlyInput() {
   stopCapturingEarlyInput();
   let input = earlyInputBuffer.trim();
-  return earlyInputBuffer = "", input;
+  return earlyInputTrace(`consume: buffer=${String(earlyInputBuffer.length)} trimmed=${String(input.length)}`), earlyInputBuffer = "", input;
+}
+function __earlyInputStateForTests() {
+  return { buffer: earlyInputBuffer, pending: pendingEscape, capturing: isCapturing, armedMs: lastArmedEscapeMs };
+}
+function __processChunkForTests(str3) {
+  processChunk(str3);
+}
+function __setEarlyInputStateForTests(o) {
+  o.buffer !== void 0 && (earlyInputBuffer = o.buffer), o.pending !== void 0 && (pendingEscape = o.pending), o.capturing !== void 0 && (isCapturing = o.capturing), clearPendingEscapeTimer();
 }
 function hasEarlyInput() {
   return earlyInputBuffer.trim().length > 0;
@@ -89128,11 +89285,13 @@ function seedEarlyInput(text2) {
 function isCapturingEarlyInput() {
   return isCapturing;
 }
-var earlyInputBuffer, isCapturing, captureArmedStdin, readableHandler, pendingEscape, PENDING_ESCAPE_FLUSH_MS, pendingEscapeTimer, init_earlyInput = __esm({
+var earlyInputBuffer, EARLY_INPUT_PRELUDE_SLOT, isCapturing, captureArmedStdin, readableHandler, pendingEscape, PENDING_ESCAPE_FLUSH_MS, pendingEscapeTimer, lastArmedEscapeMs, pendingEscapeDeadline, init_earlyInput = __esm({
   "build-src/src/utils/earlyInput.ts"() {
     init_intl();
-    earlyInputBuffer = "", isCapturing = !1, captureArmedStdin = !1, readableHandler = null;
+    earlyInputBuffer = "";
+    EARLY_INPUT_PRELUDE_SLOT = /* @__PURE__ */ Symbol.for("sema.earlyInputPrelude"), isCapturing = !1, captureArmedStdin = !1, readableHandler = null;
     pendingEscape = "", PENDING_ESCAPE_FLUSH_MS = 50, pendingEscapeTimer = null;
+    lastArmedEscapeMs = -1, pendingEscapeDeadline = -1;
   }
 });
 
@@ -120569,7 +120728,8 @@ beta`,
         type: "engine_notice",
         code: "mcp_server_unavailable",
         message: "the MCP server is not reachable",
-        detail: { serverName: "nope", sessionId: scenarioIds.sessionId },
+        // B-018 debug 不变量哨兵:未登记码的 detail **值**不许落任何日志(只落键名);无秘密纯哨兵串。
+        detail: { serverName: "nope", sessionId: scenarioIds.sessionId, auditDetail: "B018_DETAIL_VALUE_MUST_NOT_BE_LOGGED" },
         sessionId: scenarioIds.sessionId,
         ts: 1700000000001
       };
@@ -175588,7 +175748,7 @@ How to use the statusLine command:
    To display both 5-hour and 7-day limits when available:
    - input=$(cat); five=$(echo "$input" | jq -r '.rate_limits.five_hour.used_percentage // empty'); week=$(echo "$input" | jq -r '.rate_limits.seven_day.used_percentage // empty'); out=""; [ -n "$five" ] && out="5h:$(printf '%.0f' "$five")%"; [ -n "$week" ] && out="$out 7d:$(printf '%.0f' "$week")%"; echo "$out"
 
-2. For longer commands, you can save a new file in the user's ~/.claude directory, e.g.:
+2. For longer commands, you can save a new file in the user's ~/.sema directory, e.g.:
    - ~/.sema/statusline-command.sh and reference that file in the settings.
 
 3. Update the user's ~/.sema/settings.json with:
@@ -284568,7 +284728,7 @@ function FileEditToolUseRejectedMessage(t0) {
 }
 var import_compiler_runtime43, import_jsx_runtime53, MAX_LINES_TO_RENDER, init_FileEditToolUseRejectedMessage = __esm({
   "build-src/src/components/FileEditToolUseRejectedMessage.tsx"() {
-    import_compiler_runtime43 = __toESM(require_compiler_runtime());
+    import_compiler_runtime43 = __toESM(require_compiler_runtime(), 1);
     init_useTerminalSize();
     init_cwd();
     init_ink2();
@@ -284576,7 +284736,7 @@ var import_compiler_runtime43, import_jsx_runtime53, MAX_LINES_TO_RENDER, init_F
     init_MessageResponse();
     init_StructuredDiffList();
     init_stringUtils();
-    import_jsx_runtime53 = __toESM(require_jsx_runtime()), MAX_LINES_TO_RENDER = 10;
+    import_jsx_runtime53 = __toESM(require_jsx_runtime(), 1), MAX_LINES_TO_RENDER = 10;
   }
 });
 
@@ -367524,27 +367684,6 @@ var arm, DEVICE_LANE_ABSENT_CODE, DEVICE_RUN_STORE_ABSENT_CODE, DEVICE_SERVICE_T
   }
 });
 
-// build-src/src/sema/resumeRefusalCopy.ts
-function resumeRefusalFromError(err8) {
-  if (typeof err8 != "object" || err8 === null) return null;
-  let e = err8, code2 = e.errorCode;
-  if (typeof code2 != "string" || !RESUME_REFUSAL_CODES.includes(code2)) return null;
-  let sec = e.retryAfterSec;
-  return {
-    code: code2,
-    ...typeof sec == "number" && Number.isFinite(sec) && sec >= 0 ? { retryAfterSec: sec } : {}
-  };
-}
-function resumeRefusalContent(detail) {
-  let parts = [];
-  return detail.code === "resume.placement_mismatch" ? (parts.push("This resume named a different placement root than the one recorded when the work was parked"), parts.push("The engine refused it before consuming anything \u2014 the parked work is untouched"), parts.push("Retry with the recorded root, or omit the placement root to inherit it")) : (parts.push("The deployment's resume preflight refused this attempt"), parts.push("The refusal happened before the commit \u2014 your decision was not consumed"), parts.push("The engine line above says whether this token can still be redeemed")), parts.join(" \xB7 ");
-}
-var RESUME_REFUSAL_CODES, init_resumeRefusalCopy = __esm({
-  "build-src/src/sema/resumeRefusalCopy.ts"() {
-    RESUME_REFUSAL_CODES = ["resume.placement_mismatch", "resume.preflight_rejected"];
-  }
-});
-
 // build-src/src/sema/scenarioNotAllowedCopy.ts
 function scenarioNotAllowedContent(detail, requestedScenario) {
   let parts = [];
@@ -367585,7 +367724,7 @@ var init_apiErrorSupplement = __esm({
   "build-src/src/sema/apiErrorSupplement.ts"() {
     init_devicesWire();
     init_quotaExhaustedCopy();
-    init_resumeRefusalCopy();
+    init_dist();
     init_scenarioNotAllowedCopy();
   }
 });
@@ -401427,30 +401566,18 @@ var sema_brand_default, init_sema_brand = __esm({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.100",
+        version: "1.0.101",
         notes: [
-          'If the local engine is older than this CLI build and nothing is running (no turn, no background tasks, no other sema session mid-turn), sema now switches to the newer engine on its own and says so in the transcript. When something is running, the footer banner now reads like "engine 7.55.0 running \xB7 7.57.0 installed (fixes not active) \xB7 ctrl+u to switch \u2014 interrupts N background tasks" instead of "engine update ready".',
-          "Approval cards whose window has closed no longer run on a single Yes: the first Yes shows a confirmation that says how long ago the window closed and what happens if you approve late; the second Yes approves. No still denies immediately, and cards inside their window are unchanged.",
-          "Permission rules such as Bash(touch:*) or Bash(npm run build:*) now auto-approve commands that create or write files inside the working directory (default mode). Previously those commands still prompted even with a matching allow rule; commands that write outside the working directory still prompt.",
-          `Choosing "Yes, and don't ask again for: <rule>" on an approval card now saves just that rule. It no longer silently allowed every call of that tool for the rest of the session.`,
-          "Turning file checkpointing off in /config now takes effect on the next turn instead of after a restart.",
-          "When you resume a session whose run is parked on an approval that no longer exists on the engine, sema now offers to cancel that run and send your message, or to leave it, instead of only suggesting /clear.",
-          "A sema started from inside an engine-run command (for example a hook or a Bash step) no longer writes a second state file under ~/.sema, so onboarding, directory trust, and marketplace state are not reset.",
-          "The bundled engine is 7.57.0: model request failures and retries are now written to the engine log, and secrets are scrubbed from stored run results.",
-          "The engine now refuses to let the model rewrite sema's own settings files (anything under ~/.sema and the other configuration roots), and the refusal is shown in the transcript instead of silently failing. Bundled engine is 7.59.0.",
-          "Switching models in /model no longer gets the whole model list rejected when an entry carries display-only keys; the switch takes effect without restarting the engine.",
-          "Typing while the prompt is still starting up no longer echoes raw characters or drops your Enter: keys are captured from the first millisecond and seeded into the input box once it is ready.",
-          "Control keys that arrive in the same burst as text (for example ctrl+U or a slash command typed quickly under load) are handled as keys again instead of landing in the input box as literal characters.",
-          "When the model has not sent its first token yet, the spinner line says so with the elapsed time instead of looking frozen; retry status shows what it is waiting on.",
-          'Messages from sub-agents and from other sema sessions now appear as their own collapsed rows ("Message from @name: \u2026", ctrl+o to expand) instead of being folded into a generic background-task card.',
-          "Tools removed by a model gate are announced once in the transcript with the way to restore them, and /doctor now reports whether auto mode is actually armed on the engine.",
-          "Permission rules and settings descriptions now refer to ~/.sema instead of ~/.claude, so allow rules written for the real configuration directory match.",
-          "MCP server connection warnings are shown once per session instead of on every message, and agent definitions that reference an MCP tool the server does not offer now get a hint instead of silently losing the tool.",
-          "sema ps, sema logs and sema attach exit normally again after printing their result (they no longer hang in the terminal), and ctrl+C works in those commands."
+          "Keys typed in the first second or two after launch \u2014 while the 25MB main bundle is still being parsed \u2014 are now captured by the tiny launcher and seeded into the input box once the prompt is ready, instead of being echoed raw by the terminal or lost. A lone Escape pressed during that window is still treated as Escape, and Ctrl+D still stops the capture.",
+          "Approval cards now show rule offers whose match kind is wildcard or subpath, and batch offers that include a directory-read grant (for example the `cd /srv` segment of a compound command); previously those offers were silently dropped from the card.",
+          "The wording shown when a resume is refused (placement root changed, or the deployment's preflight refused the token) now comes from the shared client library, so every sema client says the same thing; a retry-after window is only shown when the engine actually sent one.",
+          '/doctor has a new "SQL engine" row: on a local single-machine engine it reports none (file stores); on a deployment with a SQL backend it reports the engine, isolation level and transaction mode, and it says "not observed" rather than inventing a value when no engine has answered yet.',
+          "sema ps, sema logs and sema attach no longer hang after printing when Ctrl+D was pressed during startup.",
+          "The bundled engine is 7.60.0 (core 7.5.0): rule stores are unified, the wiring manifest lists MCP servers, and classifier denial-limit fallbacks are marked on the wire."
         ]
       },
-      productVersion: "1.0.100",
-      announcement: `sema 1.0.100 \u2014 the engine now refuses to let the model rewrite sema's own settings file (and says so on screen), switching models in /model takes effect without restarting the engine, typing before the prompt is ready no longer loses your Enter or leaves control characters in the input box, a stall while waiting for the model's first token is shown on the spinner instead of looking frozen, messages from other sessions and sub-agents appear as their own rows, tools removed by a model gate are announced with how to restore them, /doctor reports whether auto mode is actually armed, and sema ps/logs/attach exit cleanly again. Everything listed for 1.0.99 (engine auto-switch, late-approval confirmation, allow rules for file-writing commands, per-rule "don't ask again") ships here too \u2014 1.0.99 was never published.`,
+      productVersion: "1.0.101",
+      announcement: 'sema 1.0.101 \u2014 keys typed in the first seconds after launch (before the main bundle has even loaded) are now captured instead of echoed raw or lost, approval cards show rule offers that use wildcard or subpath matching and directory-read grants, resume refusals share one wording with the other sema clients, /doctor has a new "SQL engine" row, and the bundled engine is 7.60.0.',
       version: "1.0.91"
     };
   }
@@ -405783,30 +405910,18 @@ var require_sema_brand = __commonJS({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.100",
+        version: "1.0.101",
         notes: [
-          'If the local engine is older than this CLI build and nothing is running (no turn, no background tasks, no other sema session mid-turn), sema now switches to the newer engine on its own and says so in the transcript. When something is running, the footer banner now reads like "engine 7.55.0 running \xB7 7.57.0 installed (fixes not active) \xB7 ctrl+u to switch \u2014 interrupts N background tasks" instead of "engine update ready".',
-          "Approval cards whose window has closed no longer run on a single Yes: the first Yes shows a confirmation that says how long ago the window closed and what happens if you approve late; the second Yes approves. No still denies immediately, and cards inside their window are unchanged.",
-          "Permission rules such as Bash(touch:*) or Bash(npm run build:*) now auto-approve commands that create or write files inside the working directory (default mode). Previously those commands still prompted even with a matching allow rule; commands that write outside the working directory still prompt.",
-          `Choosing "Yes, and don't ask again for: <rule>" on an approval card now saves just that rule. It no longer silently allowed every call of that tool for the rest of the session.`,
-          "Turning file checkpointing off in /config now takes effect on the next turn instead of after a restart.",
-          "When you resume a session whose run is parked on an approval that no longer exists on the engine, sema now offers to cancel that run and send your message, or to leave it, instead of only suggesting /clear.",
-          "A sema started from inside an engine-run command (for example a hook or a Bash step) no longer writes a second state file under ~/.sema, so onboarding, directory trust, and marketplace state are not reset.",
-          "The bundled engine is 7.57.0: model request failures and retries are now written to the engine log, and secrets are scrubbed from stored run results.",
-          "The engine now refuses to let the model rewrite sema's own settings files (anything under ~/.sema and the other configuration roots), and the refusal is shown in the transcript instead of silently failing. Bundled engine is 7.59.0.",
-          "Switching models in /model no longer gets the whole model list rejected when an entry carries display-only keys; the switch takes effect without restarting the engine.",
-          "Typing while the prompt is still starting up no longer echoes raw characters or drops your Enter: keys are captured from the first millisecond and seeded into the input box once it is ready.",
-          "Control keys that arrive in the same burst as text (for example ctrl+U or a slash command typed quickly under load) are handled as keys again instead of landing in the input box as literal characters.",
-          "When the model has not sent its first token yet, the spinner line says so with the elapsed time instead of looking frozen; retry status shows what it is waiting on.",
-          'Messages from sub-agents and from other sema sessions now appear as their own collapsed rows ("Message from @name: \u2026", ctrl+o to expand) instead of being folded into a generic background-task card.',
-          "Tools removed by a model gate are announced once in the transcript with the way to restore them, and /doctor now reports whether auto mode is actually armed on the engine.",
-          "Permission rules and settings descriptions now refer to ~/.sema instead of ~/.claude, so allow rules written for the real configuration directory match.",
-          "MCP server connection warnings are shown once per session instead of on every message, and agent definitions that reference an MCP tool the server does not offer now get a hint instead of silently losing the tool.",
-          "sema ps, sema logs and sema attach exit normally again after printing their result (they no longer hang in the terminal), and ctrl+C works in those commands."
+          "Keys typed in the first second or two after launch \u2014 while the 25MB main bundle is still being parsed \u2014 are now captured by the tiny launcher and seeded into the input box once the prompt is ready, instead of being echoed raw by the terminal or lost. A lone Escape pressed during that window is still treated as Escape, and Ctrl+D still stops the capture.",
+          "Approval cards now show rule offers whose match kind is wildcard or subpath, and batch offers that include a directory-read grant (for example the `cd /srv` segment of a compound command); previously those offers were silently dropped from the card.",
+          "The wording shown when a resume is refused (placement root changed, or the deployment's preflight refused the token) now comes from the shared client library, so every sema client says the same thing; a retry-after window is only shown when the engine actually sent one.",
+          '/doctor has a new "SQL engine" row: on a local single-machine engine it reports none (file stores); on a deployment with a SQL backend it reports the engine, isolation level and transaction mode, and it says "not observed" rather than inventing a value when no engine has answered yet.',
+          "sema ps, sema logs and sema attach no longer hang after printing when Ctrl+D was pressed during startup.",
+          "The bundled engine is 7.60.0 (core 7.5.0): rule stores are unified, the wiring manifest lists MCP servers, and classifier denial-limit fallbacks are marked on the wire."
         ]
       },
-      productVersion: "1.0.100",
-      announcement: `sema 1.0.100 \u2014 the engine now refuses to let the model rewrite sema's own settings file (and says so on screen), switching models in /model takes effect without restarting the engine, typing before the prompt is ready no longer loses your Enter or leaves control characters in the input box, a stall while waiting for the model's first token is shown on the spinner instead of looking frozen, messages from other sessions and sub-agents appear as their own rows, tools removed by a model gate are announced with how to restore them, /doctor reports whether auto mode is actually armed, and sema ps/logs/attach exit cleanly again. Everything listed for 1.0.99 (engine auto-switch, late-approval confirmation, allow rules for file-writing commands, per-rule "don't ask again") ships here too \u2014 1.0.99 was never published.`,
+      productVersion: "1.0.101",
+      announcement: 'sema 1.0.101 \u2014 keys typed in the first seconds after launch (before the main bundle has even loaded) are now captured instead of echoed raw or lost, approval cards show rule offers that use wildcard or subpath matching and directory-read grants, resume refusals share one wording with the other sema clients, /doctor has a new "SQL engine" row, and the bundled engine is 7.60.0.',
       version: "1.0.91"
     };
   }
@@ -426866,9 +426981,10 @@ var AUTO_MODE_DENIAL_LIMIT_DEFAULTS, init_auto_mode_defaults = __esm({
 });
 
 // node_modules/@sema-agent/core/dist/core/auto-mode-arming.js
-var init_auto_mode_arming = __esm({
+var NO_BOUND_CEILING, init_auto_mode_arming = __esm({
   "node_modules/@sema-agent/core/dist/core/auto-mode-arming.js"() {
     init_auto_mode_defaults();
+    NO_BOUND_CEILING = Number.POSITIVE_INFINITY;
   }
 });
 
@@ -430108,6 +430224,7 @@ import { tmpdir as tmpdir12 } from "node:os";
 import { join as join153 } from "node:path";
 var MCP_PREFIX, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS, MCP_IDLE_TIMEOUT_HTTP_DEFAULT_MS, MCP_BLOB_DIR, MCP_SCHEMA_CHILD_SEAT, LIST_ENTRY_FINGERPRINT_MAX_CHARS, LOOP_REWIND_FINGERPRINT_MAX_CHARS, init_mcp4 = __esm({
   "node_modules/@sema-agent/core/dist/core/mcp.js"() {
+    init_untrusted_egress();
     init_protocol_table();
     init_protocol_naming();
     init_client5();
@@ -430690,6 +430807,9 @@ function refuseOutOfContractDecision(d4, opts) {
     return d4;
   if (Object.prototype.hasOwnProperty.call(d4, RETIRED_TEXT_FIELD))
     return { action: "deny", message: RETIRED_TEXT_FIELD_DENY_MESSAGE, decisionReason: "rule" };
+  let fb = d4.denialLimitFallback;
+  if (typeof fb == "object" && fb !== null && fb.autoDenyAfterMs !== void 0)
+    return { action: "deny", message: RETIRED_WINDOW_MEMBER_DENY_MESSAGE, decisionReason: "rule" };
   if (opts?.reasonIsNonInput === !0)
     return d4;
   let dr = d4.decisionReason;
@@ -430819,7 +430939,7 @@ function combinePolicies(...policies) {
     }
   };
 }
-var DECISION_REASONS, DECISION_REASON_SET, ALLOW, RETIRED_TEXT_FIELD, RETIRED_TEXT_FIELD_DENY_MESSAGE, COARSE_SHELL_TOOLS, CASE_INSENSITIVE_FS, ASK_DENY_RESOLUTION_VALUES, ASK_DENY_RESOLUTION_SET, coreMintedResolutions, init_tool_policy = __esm({
+var DECISION_REASONS, DECISION_REASON_SET, ALLOW, RETIRED_TEXT_FIELD, RETIRED_WINDOW_MEMBER, RETIRED_WINDOW_MEMBER_DENY_MESSAGE, RETIRED_TEXT_FIELD_DENY_MESSAGE, COARSE_SHELL_TOOLS, CASE_INSENSITIVE_FS, ASK_DENY_RESOLUTION_VALUES, ASK_DENY_RESOLUTION_SET, coreMintedResolutions, init_tool_policy = __esm({
   "node_modules/@sema-agent/core/dist/core/tool-policy.js"() {
     init_ask_class();
     init_auto_mode_arming();
@@ -430830,7 +430950,7 @@ var DECISION_REASONS, DECISION_REASON_SET, ALLOW, RETIRED_TEXT_FIELD, RETIRED_TE
     init_protocol_table();
     init_safety();
     DECISION_REASONS = ["rule", "mode", "hook", "safety", "classifier", "persisted_rule", "sandbox", "org_rule", "org_unavailable"], DECISION_REASON_SET = new Set(DECISION_REASONS);
-    ALLOW = { action: "allow" }, RETIRED_TEXT_FIELD = "reason", RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field \u2014 rename it to "message" (the one text field a decision carries); denied fail-closed rather than executing a decision whose text this layer cannot read`;
+    ALLOW = { action: "allow" }, RETIRED_TEXT_FIELD = "reason", RETIRED_WINDOW_MEMBER = "autoDenyAfterMs", RETIRED_WINDOW_MEMBER_DENY_MESSAGE = `a permission decision's "denialLimitFallback" carries "${RETIRED_WINDOW_MEMBER}" \u2014 the decision names the counts only; the auto-deny window is decided by the ask's route (a live approver arms it, every other route runs none) and cannot be declared by a policy; denied fail-closed rather than silently replacing the declared number`, RETIRED_TEXT_FIELD_DENY_MESSAGE = `a permission decision carries the retired "${RETIRED_TEXT_FIELD}" field \u2014 rename it to "message" (the one text field a decision carries); denied fail-closed rather than executing a decision whose text this layer cannot read`;
     COARSE_SHELL_TOOLS = ["Bash", "Monitor"], CASE_INSENSITIVE_FS = process.platform === "darwin" || process.platform === "win32", ASK_DENY_RESOLUTION_VALUES = [
       "human_refused",
       "window_expired",
@@ -430845,6 +430965,13 @@ var DECISION_REASONS, DECISION_REASON_SET, ALLOW, RETIRED_TEXT_FIELD, RETIRED_TE
   }
 });
 
+// node_modules/@sema-agent/core/dist/core/ask-origin.js
+var ASK_ORIGINS, ASK_ORIGIN_SET, init_ask_origin = __esm({
+  "node_modules/@sema-agent/core/dist/core/ask-origin.js"() {
+    ASK_ORIGINS = ["content_question", "unresolvable", "org_unavailable", "org_rule", "hook", "ask_rule", "denial_limit_fallback", "policy"], ASK_ORIGIN_SET = new Set(ASK_ORIGINS);
+  }
+});
+
 // node_modules/@sema-agent/core/dist/core/permission-rule-model.js
 function foldSpacing(s) {
   let out6 = "", quote2, pendingGap = !1;
@@ -431203,6 +431330,7 @@ var MAX_PENDING_STEER_CHARS, PENDING_STEER_QUEUE_BYTE_BUDGET_BYTES, MAX_PENDING_
     init_harness();
     init_untrusted_text();
     init_tool_policy();
+    init_ask_origin();
     init_permission_rule_model();
     init_untrusted_egress();
     init_ask_question();
@@ -432807,13 +432935,13 @@ function assertRedemptionNotQuarantined(quarantined, delta) {
   if (hit !== void 0)
     throw new Error(`this approval's add (dot ${delta.add.dot.actor}#${delta.add.dot.counter}) was quarantined (${hit.reason}) \u2014 replaying the old record cannot revive it; a new consent (a new ask, a new record, a new dot) is required`);
 }
-var PERMISSION_RULE_WRITER, ADD_ONLY_KEYS, InMemoryPermissionRuleStore, init_permission_rule_store = __esm({
+var PERMISSION_RULE_WRITER, ADD_ONLY_KEYS, InMemoryDurableRulePartition, init_permission_rule_store = __esm({
   "node_modules/@sema-agent/core/dist/core/permission-rule-store.js"() {
     init_canonical_json();
     init_permission_rule_model();
     PERMISSION_RULE_WRITER = "__semaPermissionRuleWriter";
     ADD_ONLY_KEYS = ["add", "redemption", "rule", "command", "match", "tool"];
-    InMemoryPermissionRuleStore = class {
+    InMemoryDurableRulePartition = class {
       actor;
       now;
       durability = "process-local";
@@ -432874,11 +433002,11 @@ var PERMISSION_RULE_WRITER, ADD_ONLY_KEYS, InMemoryPermissionRuleStore, init_per
 });
 
 // node_modules/@sema-agent/core/dist/core/permission-rule-org.js
-var ORG_FETCHED_AT_SKEW_ALLOWANCE_MS, init_permission_rule_org = __esm({
+var ORG_FETCHED_AT_SKEW_ALLOWANCE_MS, UNGOVERNED_ORG_RESOLUTION, init_permission_rule_org = __esm({
   "node_modules/@sema-agent/core/dist/core/permission-rule-org.js"() {
     init_permission_rule_model();
     init_permission_rule_store();
-    ORG_FETCHED_AT_SKEW_ALLOWANCE_MS = 5 * 6e4;
+    ORG_FETCHED_AT_SKEW_ALLOWANCE_MS = 5 * 6e4, UNGOVERNED_ORG_RESOLUTION = Object.freeze({ source: "org", status: "ungoverned", rules: [], disclosures: [] });
   }
 });
 
@@ -433056,8 +433184,10 @@ var init_auto_mode = __esm({
 var init_denial_limit_arms = __esm({
   "node_modules/@sema-agent/core/dist/core/runner/denial-limit-arms.js"() {
     init_auto_mode();
+    init_auto_mode_arming();
     init_types21();
     init_untrusted_text();
+    init_ask_origin();
   }
 });
 
@@ -433228,6 +433358,14 @@ var uplinkSeqGlobal, REVIVE_LEASE_TTL_MS, init_send_message_tool = __esm({
   }
 });
 
+// node_modules/@sema-agent/core/dist/core/runner/prepare-permission-rules.js
+var init_prepare_permission_rules = __esm({
+  "node_modules/@sema-agent/core/dist/core/runner/prepare-permission-rules.js"() {
+    init_permission_rule_model();
+    init_permission_rule_org();
+  }
+});
+
 // node_modules/@sema-agent/core/dist/core/runner/session-rule-policy.js
 var PATH_WRITE_TOOLS, PATH_CONFINABLE_WRITE_TOOLS, init_session_rule_policy = __esm({
   "node_modules/@sema-agent/core/dist/core/runner/session-rule-policy.js"() {
@@ -433257,11 +433395,20 @@ var init_active_skill_scope = __esm({
   }
 });
 
+// node_modules/@sema-agent/core/dist/core/runner/prepare-announce-once.js
+var init_prepare_announce_once = __esm({
+  "node_modules/@sema-agent/core/dist/core/runner/prepare-announce-once.js"() {
+    init_untrusted_egress();
+    init_untrusted_text();
+  }
+});
+
 // node_modules/@sema-agent/core/dist/core/hooks.js
 var objectPrototype, init_hooks3 = __esm({
   "node_modules/@sema-agent/core/dist/core/hooks.js"() {
     init_tool_policy();
     init_ask_class();
+    init_ask_origin();
     init_auto_mode();
     init_untrusted_text();
     init_reminder_mint();
@@ -433273,11 +433420,21 @@ var objectPrototype, init_hooks3 = __esm({
   }
 });
 
+// node_modules/@sema-agent/core/dist/core/sensitive-path-policy.js
+var CASE_INSENSITIVE_FS3, init_sensitive_path_policy = __esm({
+  "node_modules/@sema-agent/core/dist/core/sensitive-path-policy.js"() {
+    init_safety();
+    init_read_deny();
+    CASE_INSENSITIVE_FS3 = process.platform === "darwin" || process.platform === "win32";
+  }
+});
+
 // node_modules/@sema-agent/core/dist/core/write-protect.js
 var freezeTable, WRITE_PROTECTED_DEFAULT_TABLE, init_write_protect = __esm({
   "node_modules/@sema-agent/core/dist/core/write-protect.js"() {
     init_safety();
     init_session_rule_policy();
+    init_sensitive_path_policy();
     freezeTable = (rows2) => Object.freeze(rows2.map((r) => Object.freeze(r))), WRITE_PROTECTED_DEFAULT_TABLE = freezeTable([
       { name: ".gitconfig", kind: "basename" },
       { name: ".gitmodules", kind: "basename" },
@@ -433327,7 +433484,9 @@ var freezeTable, WRITE_PROTECTED_DEFAULT_TABLE, init_write_protect = __esm({
       { name: ".mvn", kind: "segment" },
       { name: ".config/git", kind: "segment-run" },
       { name: ".ssh", kind: "segment" },
-      { name: ".gnupg", kind: "segment" }
+      { name: ".gnupg", kind: "segment" },
+      { name: ".sema.json", kind: "basename" },
+      { name: ".sema", kind: "segment" }
     ]);
   }
 });
@@ -434100,17 +434259,17 @@ var PROMPT_HASH_SALT, DEFAULT_RESOURCE_TTL_MS, USAGE_WINDOW_REAP_MARGIN_MS, DEFA
     init_retain_ledger();
     init_tool_policy();
     init_permission_rule_model();
-    init_permission_rule_store();
+    init_prepare_permission_rules();
     init_active_skill_scope();
     init_turn_attachments();
     init_untrusted_text();
+    init_prepare_announce_once();
     init_reminder_mint();
     init_ask_class();
     init_trace();
     init_session_rule_policy();
     init_hooks3();
     init_write_protect();
-    init_permission_rule_org();
     init_cache_break_detector();
     init_request_params();
     init_route_adjudicator();
@@ -434290,6 +434449,7 @@ var init_runtask = __esm({
     init_hooks3();
     init_human_input_projection();
     init_untrusted_text();
+    init_prepare_announce_once();
     init_session_reconcile();
     init_tool_result_store();
     init_lsp_diagnostics();
@@ -435079,6 +435239,15 @@ var WINDOWS_DEVICE_NAMES, STALE_JOURNAL_MS, init_file_history_store2 = __esm({
   }
 });
 
+// node_modules/@sema-agent/core/dist/core/permission-rule-provider.js
+var init_permission_rule_provider = __esm({
+  "node_modules/@sema-agent/core/dist/core/permission-rule-provider.js"() {
+    init_permission_rule_model();
+    init_permission_rule_store();
+    init_permission_rule_org();
+  }
+});
+
 // node_modules/@sema-agent/core/dist/core/permission-rule-sync.js
 var init_permission_rule_sync = __esm({
   "node_modules/@sema-agent/core/dist/core/permission-rule-sync.js"() {
@@ -435089,9 +435258,16 @@ var init_permission_rule_sync = __esm({
 });
 
 // node_modules/@sema-agent/core/dist/stores/file/permission-rule-store.js
-import { closeSync as closeSync14, constants as FS2, existsSync as existsSync29, fsyncSync as fsyncSync11, lstatSync as lstatSync5, mkdirSync as mkdirSync24, openSync as openSync15, readFileSync as readFileSync42, renameSync as renameSync16, unlinkSync as unlinkSync15, writeFileSync as writeFileSync22 } from "node:fs";
+import { closeSync as closeSync14, constants as FS2, existsSync as existsSync29, fsyncSync as fsyncSync11, lstatSync as lstatSync5, mkdirSync as mkdirSync24, openSync as openSync15, readFileSync as readFileSync42, readdirSync as readdirSync13, renameSync as renameSync16, unlinkSync as unlinkSync15, writeFileSync as writeFileSync22 } from "node:fs";
 import { join as join157 } from "node:path";
 import { createHash as createHash28, randomBytes as randomBytes26 } from "node:crypto";
+function isRuleFile(v2) {
+  let p = v2;
+  return typeof p == "object" && p !== null && p.schemaVersion === 3 && Array.isArray(p.rules) && Array.isArray(p.tombstones) && typeof p.rev == "number" && (p.quarantined === void 0 || Array.isArray(p.quarantined));
+}
+function schemaVersionWord(v2) {
+  return typeof v2 == "object" && v2 !== null ? v2.schemaVersion : void 0;
+}
 function atomicPublish(dir, file2, payload2) {
   let tmp = join157(dir, `.${randomBytes26(8).toString("hex")}.tmp`), fd2;
   try {
@@ -435129,14 +435305,14 @@ function assertSafeDir(dir) {
   if ((st2.mode & 18) !== 0)
     throw new Error(`permission-rule store directory ${dir} is writable by group or others (mode ${(st2.mode & 511).toString(8)}); refusing to use it \u2014 anyone who can write here can grant themselves permissions`);
 }
-var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
+var EMPTY_READ, FileDurableRulePartition, init_permission_rule_store2 = __esm({
   "node_modules/@sema-agent/core/dist/stores/file/permission-rule-store.js"() {
     init_permission_rule_store();
     init_canonical_json();
     init_fs_atomic();
     init_marker();
     EMPTY_READ = { rules: [], tombstones: [], rev: 0 };
-    FilePermissionRuleStore = class {
+    FileDurableRulePartition = class {
       dir;
       file;
       acquireWriteLock;
@@ -435170,8 +435346,8 @@ var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
           let why = `${this.file} is not valid JSON (${err8.message}); refusing the whole file and loading zero rules`;
           return this.disclose(why), { unreadable: why };
         }
-        if (parsed?.schemaVersion !== 1 && parsed?.schemaVersion !== 2 || !Array.isArray(parsed.rules) || !Array.isArray(parsed.tombstones) || typeof parsed.rev != "number" || parsed.quarantined !== void 0 && !Array.isArray(parsed.quarantined)) {
-          let why = `${this.file} does not carry a readable rule-file shape; refusing the whole file and loading zero rules`;
+        if (!isRuleFile(parsed)) {
+          let sv = schemaVersionWord(parsed), why = sv === 1 || sv === 2 ? `${this.file} is a schema ${String(sv)} bucket that was not migrated to schema 3 (written by an older engine after this directory was migrated?); refusing the whole file and loading zero rules` : `${this.file} does not carry a readable rule-file shape; refusing the whole file and loading zero rules`;
           return this.disclose(why), { unreadable: why };
         }
         let { checksum, ...body } = parsed;
@@ -435196,6 +435372,8 @@ var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
       }
       async list() {
         let r = this.read();
+        if ("unreadable" in r)
+          throw new Error(r.unreadable);
         if (!("file" in r))
           return { ...EMPTY_READ };
         let screened = this.screenDurableRows(r.file);
@@ -435210,26 +435388,11 @@ var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
         let r = this.read();
         return "file" in r ? this.screenDurableRows(r.file).quarantined : [];
       }
-      async readOrgState() {
-        let r = this.read();
-        return "file" in r ? r.file.org : void 0;
-      }
-      async installOrgState(state5) {
-        this.acquireWriteLock(), await this.serialize(() => {
-          let cur = this.current();
-          if (cur.org !== void 0 && state5.revisionHighWater < cur.org.revisionHighWater)
-            throw new Error(`refusing to lower the org revision high-water mark (${cur.org.revisionHighWater} \u2192 ${state5.revisionHighWater}) \u2014 an interleaved install must re-read and re-compare`);
-          if (cur.org !== void 0 && state5.snapshot.revision === cur.org.snapshot.revision && canonicalize3(state5.snapshot.rules) !== canonicalize3(cur.org.snapshot.rules))
-            throw new Error(`refusing to replace org revision ${state5.snapshot.revision} with DIFFERENT policy content under the same revision \u2014 content changes must bump the revision`);
-          if (!this.writeAndVerify({ ...cur, schemaVersion: 2, org: state5 }))
-            throw new Error("the permission-rule store did not survive its own write; the org snapshot was not installed");
-        });
-      }
       current() {
         let r = this.read();
         if ("unreadable" in r)
           throw new Error(`refusing to write the permission-rule store while it cannot be read: ${r.unreadable}`);
-        return "absent" in r ? { schemaVersion: 1, actor: `file-${randomBytes26(6).toString("hex")}`, counter: 0, rev: 0, rules: [], tombstones: [] } : {
+        return "absent" in r ? { schemaVersion: 3, actor: `file-${randomBytes26(6).toString("hex")}`, counter: 0, rev: 0, rules: [], tombstones: [] } : {
           schemaVersion: r.file.schemaVersion,
           actor: r.file.actor,
           counter: r.file.counter,
@@ -435237,7 +435400,6 @@ var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
           rules: r.file.rules,
           tombstones: r.file.tombstones,
           ...r.file.sync !== void 0 ? { sync: r.file.sync } : {},
-          ...r.file.org !== void 0 ? { org: r.file.org } : {},
           ...r.file.quarantined !== void 0 ? { quarantined: r.file.quarantined } : {}
         };
       }
@@ -435291,7 +435453,6 @@ var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
               ...cur.sync?.observedVector !== void 0 ? { observedVector: cur.sync.observedVector } : {}
             }, delta, Date.now()), landed = {
               ...cur,
-              schemaVersion: 2,
               rev: cur.rev + 1,
               rules: next2.rules,
               tombstones: next2.tombstones,
@@ -435319,6 +435480,7 @@ var EMPTY_READ, FilePermissionRuleStore, init_permission_rule_store2 = __esm({
 var init_permission_rule_adopt = __esm({
   "node_modules/@sema-agent/core/dist/stores/file/permission-rule-adopt.js"() {
     init_permission_rule_store();
+    init_permission_rule_provider();
     init_permission_rule_sync();
     init_permission_rule_store2();
   }
@@ -435369,15 +435531,6 @@ var init_file2 = __esm({
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/sensitive-path-policy.js
-var CASE_INSENSITIVE_FS3, init_sensitive_path_policy = __esm({
-  "node_modules/@sema-agent/core/dist/core/sensitive-path-policy.js"() {
-    init_safety();
-    init_read_deny();
-    CASE_INSENSITIVE_FS3 = process.platform === "darwin" || process.platform === "win32";
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/fs-write-gate-policy.js
 var init_fs_write_gate_policy = __esm({
   "node_modules/@sema-agent/core/dist/core/fs-write-gate-policy.js"() {
@@ -435576,6 +435729,7 @@ function precheckEditedRuleText2(text2, command8) {
 var init_permission_rule_consent = __esm({
   "node_modules/@sema-agent/core/dist/core/permission-rule-consent.js"() {
     init_permission_rule_model();
+    init_permission_rule_provider();
     init_permission_rule_store();
   }
 });
@@ -436232,6 +436386,7 @@ var init_dist10 = __esm({
     init_cascade();
     init_sql_adapters();
     init_mcp4();
+    init_mcp4();
     init_a2a();
     init_protocol_table();
     init_session_policy_store();
@@ -436314,6 +436469,8 @@ var init_dist10 = __esm({
     init_loop_tick();
     init_tighten_task_spec();
     init_tool_policy();
+    init_ask_origin();
+    init_hooks3();
     init_auto_mode();
     init_auto_mode_defaults();
     init_auto_mode_prompt();
@@ -436324,6 +436481,7 @@ var init_dist10 = __esm({
     init_permission_rule_model();
     init_permission_rule_store();
     init_permission_rule_sync();
+    init_permission_rule_provider();
     init_permission_rule_session();
     init_permission_rule_org();
     init_governance_codes();
@@ -470130,7 +470288,9 @@ __export(agentsWire_exports, {
   RESUME_CHOICE_BACKGROUND_LABEL: () => RESUME_CHOICE_BACKGROUND_LABEL,
   RESUME_CHOICE_CANCEL_LABEL: () => RESUME_CHOICE_CANCEL_LABEL,
   RESUME_CHOICE_HEADER: () => RESUME_CHOICE_HEADER,
+  RESUME_PLACEMENT_MISMATCH: () => RESUME_PLACEMENT_MISMATCH,
   RESUME_PREFLIGHT_REJECTED: () => RESUME_PREFLIGHT_REJECTED,
+  RESUME_REFUSAL_CODES: () => RESUME_REFUSAL_CODES,
   RESUME_RETRY_LATER_CODES: () => RESUME_RETRY_LATER_CODES,
   RESUME_RUNNING_GUIDANCE_TAG: () => RESUME_RUNNING_GUIDANCE_TAG,
   RESUME_RUNNING_NO_UI_EXIT_CODE: () => RESUME_RUNNING_NO_UI_EXIT_CODE,
@@ -470139,6 +470299,9 @@ __export(agentsWire_exports, {
   REWIND_ERROR_CODE_PREFIXES: () => REWIND_ERROR_CODE_PREFIXES,
   RULE_NOT_SENT_REJECTED_WARN_TEXT: () => RULE_NOT_SENT_REJECTED_WARN_TEXT,
   RULE_NOT_SENT_WARN_TEXT: () => RULE_NOT_SENT_WARN_TEXT,
+  RULE_OFFER_BATCH_MEMBER_KINDS: () => RULE_OFFER_BATCH_MEMBER_KINDS,
+  RULE_OFFER_MATCHES: () => RULE_OFFER_MATCHES,
+  RULE_OFFER_UNCOVERED_REASONS: () => RULE_OFFER_UNCOVERED_REASONS,
   RUNNING_STATES: () => RUNNING_STATES,
   RUN_BLOCKED_MESSAGE_PREFIX: () => RUN_BLOCKED_MESSAGE_PREFIX,
   RUN_LEVEL_STOP_ERROR_CODES: () => RUN_LEVEL_STOP_ERROR_CODES,
@@ -470698,6 +470861,8 @@ __export(agentsWire_exports, {
   respondToQuestion: () => respondToQuestion,
   resumeAttachReplayDisclosure: () => resumeAttachReplayDisclosure,
   resumeChoiceFromLabels: () => resumeChoiceFromLabels,
+  resumeRefusalContent: () => resumeRefusalContent,
+  resumeRefusalFromError: () => resumeRefusalFromError,
   resumeRetryLaterFromError: () => resumeRetryLaterFromError,
   resumeRunningCancelUnconfirmedRow: () => resumeRunningCancelUnconfirmedRow,
   resumeRunningLivenessRow: () => resumeRunningLivenessRow,
@@ -470982,6 +471147,72 @@ var init_detachWire2 = __esm({
   }
 });
 
+// build-src/src/sema/sqlEngineCapability.ts
+var sqlEngineCapability_exports = {};
+__export(sqlEngineCapability_exports, {
+  __resetSqlEngineReadingsForTests: () => __resetSqlEngineReadingsForTests,
+  forgetSqlEngineReading: () => forgetSqlEngineReading,
+  noteEngineCapsForSqlEngine: () => noteEngineCapsForSqlEngine,
+  observedSqlEngine: () => observedSqlEngine,
+  projectSqlEngineCapability: () => projectSqlEngineCapability,
+  sqlEngineDoctorDetail: () => sqlEngineDoctorDetail
+});
+function projectSqlEngineCapability(caps) {
+  if (caps === null || typeof caps != "object") return;
+  if (!("sql" in caps)) return { kind: "not_reported" };
+  let sql = caps.sql;
+  if (sql === null) return { kind: "none" };
+  if (sql === void 0) return { kind: "not_reported" };
+  if (typeof sql != "object") return;
+  let s = sql;
+  if (!(typeof s.engine != "string" || s.engine === "") && !(typeof s.isolation != "string" || s.isolation === "") && !(s.txnMode !== null && (typeof s.txnMode != "string" || s.txnMode === "")))
+    return { kind: "present", view: { engine: s.engine, isolation: s.isolation, txnMode: s.txnMode } };
+}
+function noteEngineCapsForSqlEngine(baseUrl, caps) {
+  try {
+    let reading = projectSqlEngineCapability(caps);
+    if (reading === void 0) {
+      readingByBase.delete(baseUrl);
+      return;
+    }
+    readingByBase.set(baseUrl, reading);
+  } catch {
+  }
+}
+function capsBaseUrl5() {
+  let raw2 = process.env.SEMA_LIVE_BASEURL;
+  return typeof raw2 == "string" && raw2.trim() !== "" ? raw2 : void 0;
+}
+function observedSqlEngine(baseUrl = capsBaseUrl5()) {
+  return typeof baseUrl != "string" || baseUrl === "" ? { kind: "unobserved" } : readingByBase.get(baseUrl) ?? { kind: "unobserved" };
+}
+function sqlEngineDoctorDetail(reading) {
+  switch (reading.kind) {
+    case "unobserved":
+      return "not observed \u2014 the engine reports it on /v1/capabilities; this one-shot process has no engine response (run /doctor inside the REPL after a turn)";
+    case "not_reported":
+      return "not reported by this engine \u2014 the capability position needs a newer engine";
+    case "none":
+      return "none \u2014 the engine reports no SQL backend on this deployment (local file stores)";
+    case "present": {
+      let e = cleanUntrustedForDisplay(reading.view.engine, 40), i = cleanUntrustedForDisplay(reading.view.isolation, 40), t2 = reading.view.txnMode === null ? "no txn-mode indicator on this engine" : cleanUntrustedForDisplay(reading.view.txnMode, 40);
+      return `${e} \xB7 isolation ${i} \xB7 txn ${t2}`;
+    }
+  }
+}
+function forgetSqlEngineReading(baseUrl) {
+  typeof baseUrl != "string" || baseUrl === "" || readingByBase.delete(baseUrl);
+}
+function __resetSqlEngineReadingsForTests() {
+  readingByBase.clear();
+}
+var readingByBase, init_sqlEngineCapability = __esm({
+  "build-src/src/sema/sqlEngineCapability.ts"() {
+    init_untrustedDisplayText();
+    readingByBase = /* @__PURE__ */ new Map();
+  }
+});
+
 // build-src/src/sema/engineCapsArm.ts
 function beginCapsTeeEpoch(baseUrl) {
   let next = (capsTeeEpochByBase.get(baseUrl) ?? 0) + 1;
@@ -471006,7 +471237,7 @@ function armEngineCapsProbes(input) {
       return caps;
     }) : capsProbe;
     if (afterEngineRespawn) {
-      resetCapsDiscoveryState(baseUrl), invalidateSelfKnowledgeCap(baseUrl), kickAppendSystemPromptCapProbe(baseUrl, appendCapProbe), invalidateEngineCaps(baseUrl, guardedCapsProbe);
+      resetCapsDiscoveryState(baseUrl), invalidateSelfKnowledgeCap(baseUrl), forgetSqlEngineReading(baseUrl), kickAppendSystemPromptCapProbe(baseUrl, appendCapProbe), invalidateEngineCaps(baseUrl, guardedCapsProbe);
       return;
     }
     kickAppendSystemPromptCapProbe(baseUrl, appendCapProbe), kickEngineCapsProbe(baseUrl, guardedCapsProbe);
@@ -471018,6 +471249,7 @@ var capsTeeEpochByBase, init_engineCapsArm = __esm({
     init_dist();
     init_projectContextCapGate();
     init_selfKnowledge();
+    init_sqlEngineCapability();
     capsTeeEpochByBase = /* @__PURE__ */ new Map();
   }
 });
@@ -471447,7 +471679,7 @@ function createLiveConversationClient(config4) {
     capsTee: (caps) => {
       noteEngineCapsForMcpGate(config4.baseUrl, caps), noteEngineCapsForSessionBackground(config4.baseUrl, caps), noteEngineCapsForProjectContext(config4.baseUrl, caps), readCrashConvergedOnce(client3, config4.baseUrl, { principal: config4.principal }), noteEngineCapsForWorkflowsGate(config4.baseUrl, caps, {
         ...typeof config4.principal == "string" ? { principal: config4.principal } : {}
-      });
+      }), noteEngineCapsForSqlEngine(config4.baseUrl, caps);
     },
     afterEngineRespawn: config4.afterEngineRespawn === !0
   }), prepareTaskAgentsWire({
@@ -471824,6 +472056,7 @@ var ENGINE_TO_CC_TOOL, SUGGESTIONS_TAIL_MAX_ATTEMPTS, SUGGESTIONS_TAIL_RETRY_MS,
     init_engineCapsArm();
     init_crashConvergedNotice();
     init_selfOrchestrationDenial2();
+    init_sqlEngineCapability();
     init_projectContextCapGate();
     init_dist();
     init_dist();
@@ -472521,11 +472754,11 @@ var powerupUnlocked, powerupState_default, init_powerupState = __esm({
 });
 
 // build-src/src/sema/workflowJournalWire.ts
-function capsBaseUrl5() {
+function capsBaseUrl6() {
   let raw2 = process.env.SEMA_LIVE_BASEURL;
   return typeof raw2 == "string" && raw2.trim() !== "" ? raw2 : void 0;
 }
-function workflowJournalAvailable(baseUrl = capsBaseUrl5()) {
+function workflowJournalAvailable(baseUrl = capsBaseUrl6()) {
   return engineCapTrue(baseUrl, WORKFLOW_JOURNAL_CAP);
 }
 function resolveJournalFacade() {
@@ -487837,12 +488070,12 @@ function readOffers(confirm2, key = "ruleOffers") {
       if (!Array.isArray(o.rules) || o.rules.length === 0 || !Number.isSafeInteger(o.uncoveredSegments) || o.uncoveredSegments < 0) continue;
       let members = [], memberShapeOk = !0;
       for (let m2 of o.rules) {
-        let triple = readRuleTriple2(m2), segment2 = m2?.segment;
-        if (triple === void 0 || typeof segment2 != "string" || segment2 === "") {
+        let member = readBatchMember(m2);
+        if (member === void 0) {
           memberShapeOk = !1;
           break;
         }
-        members.push({ ...triple, segment: segment2 });
+        members.push(member);
       }
       if (!memberShapeOk) continue;
       out6.push({ kind: "batch", offerIndex, rules: members, uncoveredSegments: o.uncoveredSegments });
@@ -487851,12 +488084,27 @@ function readOffers(confirm2, key = "ruleOffers") {
   }
   return out6;
 }
+function isRuleOfferMatch2(v2) {
+  return RULE_OFFER_MATCHES.some((m2) => m2 === v2);
+}
 function readRuleTriple2(v2) {
   if (v2 === null || typeof v2 != "object") return;
   let s = v2;
-  if (!(typeof s.rule != "string" || s.rule === "") && !(s.match !== "exact" && s.match !== "prefix"))
+  if (!(typeof s.rule != "string" || s.rule === "") && isRuleOfferMatch2(s.match))
     return { rule: s.rule, match: s.match, command: typeof s.command == "string" ? s.command : "" };
 }
+function readBatchMember(v2) {
+  if (v2 === null || typeof v2 != "object") return;
+  let m2 = v2;
+  if (typeof m2.segment != "string" || m2.segment === "") return;
+  let segment2 = m2.segment, kind = m2.kind === void 0 ? "command" : m2.kind;
+  if (kind === "command") {
+    let triple = readRuleTriple2(v2);
+    return triple === void 0 ? void 0 : { kind: "command", ...triple, segment: segment2 };
+  }
+  if (kind === "directoryRead")
+    return typeof m2.rule != "string" || m2.rule === "" || typeof m2.directory != "string" || m2.directory === "" ? void 0 : { kind: "directoryRead", rule: m2.rule, directory: m2.directory, segment: segment2 };
+}
 function engineRuleSuggestionOptions(confirm2) {
   let offers = readOffers(confirm2);
   if (offers.length === 0) return [];
@@ -512371,7 +512619,7 @@ function _temp158() {
 }
 var import_compiler_runtime307, import_react317, SETTINGS_ERRORS_NOTIFICATION_KEY, init_useSettingsErrors = __esm({
   "build-src/src/hooks/notifs/useSettingsErrors.tsx"() {
-    import_compiler_runtime307 = __toESM(require_compiler_runtime(), 1), import_react317 = __toESM(require_react(), 1);
+    import_compiler_runtime307 = __toESM(require_compiler_runtime()), import_react317 = __toESM(require_react());
     init_notifications2();
     init_state();
     init_allErrors();
@@ -521907,6 +522155,12 @@ async function collectAxesRows(opts, deps2) {
   } catch {
     rows2.push({ label: "Auto mode", status: "warn", detail: "reading unavailable" });
   }
+  try {
+    let { sqlEngineDoctorDetail: sqlEngineDoctorDetail2, observedSqlEngine: observedSqlEngine2 } = await Promise.resolve().then(() => (init_sqlEngineCapability(), sqlEngineCapability_exports)), reading = deps2?.readSqlEngine !== void 0 ? deps2.readSqlEngine() : observedSqlEngine2();
+    rows2.push({ label: "SQL engine", status: "info", detail: sqlEngineDoctorDetail2(reading) });
+  } catch {
+    rows2.push({ label: "SQL engine", status: "warn", detail: "reading unavailable" });
+  }
   let remote = (() => {
     try {
       return engineTarget.configuredEngineUrl();
@@ -525252,7 +525506,7 @@ var CC_DIR5, CC_GLOBAL_FILE2, MCP_SCOPE_LABELS, init_mcpChannels = __esm({
 });
 
 // build-src/src/sema/importSources.ts
-import { existsSync as existsSync34, mkdirSync as mkdirSync27, readdirSync as readdirSync13, readFileSync as readFileSync52, writeFileSync as writeFileSync27 } from "node:fs";
+import { existsSync as existsSync34, mkdirSync as mkdirSync27, readdirSync as readdirSync14, readFileSync as readFileSync52, writeFileSync as writeFileSync27 } from "node:fs";
 import { createHash as createHash31 } from "node:crypto";
 import { homedir as homedir48 } from "node:os";
 import { dirname as dirname89, join as join195, resolve as resolve50, sep as sep43 } from "node:path";
@@ -525261,14 +525515,14 @@ function toSafeName(raw2) {
 }
 function safeReaddirFiles(dir, ext) {
   try {
-    return readdirSync13(dir, { withFileTypes: !0 }).filter((e) => e.isFile() && e.name.endsWith(ext)).map((e) => e.name);
+    return readdirSync14(dir, { withFileTypes: !0 }).filter((e) => e.isFile() && e.name.endsWith(ext)).map((e) => e.name);
   } catch {
     return [];
   }
 }
 function hasNamespacedSubdirs(dir) {
   try {
-    return readdirSync13(dir, { withFileTypes: !0 }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync14(dir, { withFileTypes: !0 }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -526605,14 +526859,15 @@ async function* ask(params) {
             continue;
           }
           if (t2 === "engine_notice") {
-            let en2 = msg, clean9 = (v2) => cleanUntrustedForDisplay(v2, 160), detailText = "";
+            let en2 = msg, clean9 = (v2) => cleanUntrustedForDisplay(v2, 160), detailKeys = "";
             try {
-              detailText = en2.detail === void 0 ? "" : cleanUntrustedForDisplay(JSON.stringify(en2.detail), 400);
+              detailKeys = en2.detail !== null && typeof en2.detail == "object" && !Array.isArray(en2.detail) ? Object.keys(en2.detail).map((k2) => clean9(k2)).join(",") : en2.detail === void 0 ? "" : `<${typeof en2.detail}>`;
             } catch {
-              detailText = "(unserializable)";
+              detailKeys = "(unreadable)";
             }
+            let messageLen = typeof en2.message == "string" ? en2.message.length : 0;
             logForDebugging(
-              `[sema][print] engine_notice swallowed (audit; no stdout parity frame \u2014 see [4429]/#302): code=${clean9(en2.code)} eventId=${clean9(en2.eventId)} eventSeq=${clean9(en2.eventSeq)} ts=${clean9(en2.ts)} sessionId=${clean9(en2.sessionId)} message=${clean9(en2.message)} detail=${detailText}`
+              `[sema][print] engine_notice swallowed (audit; no stdout parity frame \u2014 see [4429]/#302): code=${clean9(en2.code)} eventId=${clean9(en2.eventId)} eventSeq=${clean9(en2.eventSeq)} ts=${clean9(en2.ts)} sessionId=${clean9(en2.sessionId)} messageLen=${String(messageLen)} detailKeys=[${detailKeys}]`
             );
             let noticeKey = `${clean9(en2.eventId)}|${clean9(en2.eventSeq)}|${clean9(en2.code)}`;
             if (!emittedNoticeKeys.has(noticeKey) && isSurfaceableEngineNoticeCode(en2.code)) {
@@ -531150,18 +531405,18 @@ __export(adoptionGuard_exports, {
   countLocalSessionArtifacts: () => countLocalSessionArtifacts,
   remoteSwitchSessionNotice: () => remoteSwitchSessionNotice
 });
-import { readdirSync as readdirSync14, existsSync as existsSync35 } from "node:fs";
+import { readdirSync as readdirSync15, existsSync as existsSync35 } from "node:fs";
 import { join as join198 } from "node:path";
 function countLocalSessionArtifacts() {
   let census = { projects: 0, sessions: 0 };
   try {
     let root2 = getProjectsDir();
     if (!existsSync35(root2)) return census;
-    for (let entry of readdirSync14(root2, { withFileTypes: !0 })) {
+    for (let entry of readdirSync15(root2, { withFileTypes: !0 })) {
       if (!entry.isDirectory()) continue;
       let n2 = 0;
       try {
-        n2 = readdirSync14(join198(root2, entry.name)).filter((f) => f.endsWith(".jsonl")).length;
+        n2 = readdirSync15(join198(root2, entry.name)).filter((f) => f.endsWith(".jsonl")).length;
       } catch {
         continue;
       }
@@ -533086,7 +533341,7 @@ __export(cloudResources_exports, {
   cloudResourceSync: () => cloudResourceSync
 });
 import { createHash as createHash32 } from "node:crypto";
-import { existsSync as existsSync37, readdirSync as readdirSync15, readFileSync as readFileSync56, statSync as statSync17 } from "node:fs";
+import { existsSync as existsSync37, readdirSync as readdirSync16, readFileSync as readFileSync56, statSync as statSync17 } from "node:fs";
 import { basename as basename69, dirname as dirname91, isAbsolute as isAbsolute34, join as join201, resolve as resolve51 } from "node:path";
 import { getEffective as getEffective2, getMeConfig, getScopeConfigDraft as getScopeConfigDraft2, OAuthFlowError as OAuthFlowError3, RegistryApiError as RegistryApiError3 } from "@sema-agent/sdk/registry";
 function fail4(e) {
@@ -533585,7 +533840,7 @@ async function loadLocalSkillEntries() {
   for (let root2 of roots) {
     let dirs = [];
     try {
-      dirs = readdirSync15(root2).filter((d4) => {
+      dirs = readdirSync16(root2).filter((d4) => {
         try {
           return statSync17(join201(root2, d4)).isDirectory() && existsSync37(join201(root2, d4, "SKILL.md"));
         } catch {
@@ -538731,7 +538986,7 @@ import {
   copyFileSync as copyFileSync8,
   existsSync as existsSync39,
   mkdirSync as mkdirSync29,
-  readdirSync as readdirSync16,
+  readdirSync as readdirSync17,
   readFileSync as readFileSync57,
   statSync as statSync19
 } from "node:fs";
@@ -538852,7 +539107,7 @@ function syncTree(srcDir, destDir, labelBase, opts, report) {
     syncPlainFile(srcDir, destDir, labelBase, opts, report);
     return;
   }
-  for (let name of readdirSync16(srcDir)) {
+  for (let name of readdirSync17(srcDir)) {
     let srcChild = join206(srcDir, name), destChild = join206(destDir, name), childStat;
     try {
       childStat = statSync19(srcChild);
@@ -541881,7 +542136,7 @@ var React202, import_jsx_runtime518, lastTierEditError, init_TiersHub = __esm({
 });
 
 // build-src/src/sema/config/skillsChannels.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync30, readdirSync as readdirSync17, readFileSync as readFileSync60, realpathSync as realpathSync17, renameSync as renameSync18, statSync as statSync20 } from "node:fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync30, readdirSync as readdirSync18, readFileSync as readFileSync60, realpathSync as realpathSync17, renameSync as renameSync18, statSync as statSync20 } from "node:fs";
 import { basename as basename72, dirname as dirname96, join as join209 } from "node:path";
 function skillsDirFor(source) {
   return source === "user" ? join209(resolveConfigHome(), "skills") : join209(getCwd(), ".sema", "skills");
@@ -541928,7 +542183,7 @@ function listInstalledSkills() {
   for (let source of sources) {
     let dir = skillsDirFor(source), entries;
     try {
-      entries = readdirSync17(dir).filter((n2) => !n2.startsWith("."));
+      entries = readdirSync18(dir).filter((n2) => !n2.startsWith("."));
     } catch {
       continue;
     }
@@ -544208,7 +544463,7 @@ Usage: sema --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.100", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
+  }).version("sema 1.0.101", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).psHandler([]), process.exit(process.exitCode ?? 0);
   }), program2.command("logs [id]").description("Print a background session's recent terminal output").action(async (id) => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).logsHandler(id, []), process.exit(process.exitCode ?? 0);
@@ -546428,7 +546683,7 @@ var init_schedulerDaemonWire = __esm({
 });
 
 // build-src/src/sema/scheduler/sessionReap.ts
-import { mkdirSync as mkdirSync33, readdirSync as readdirSync18, readFileSync as readFileSync65, unlinkSync as unlinkSync17, writeFileSync as writeFileSync31 } from "node:fs";
+import { mkdirSync as mkdirSync33, readdirSync as readdirSync19, readFileSync as readFileSync65, unlinkSync as unlinkSync17, writeFileSync as writeFileSync31 } from "node:fs";
 import { dirname as dirname99, join as join214 } from "node:path";
 function isSessionLifetimeRecord(r) {
   return r.lifetime === "session";
@@ -546482,7 +546737,7 @@ function removeSchedulerClaim(storePath, pid = process.pid) {
 function readAliveClaimedSessionIds(storePath, opts = {}) {
   let alive = opts.isPidAlive ?? pidAlive3, dir = schedulerClaimsDir(storePath), out6 = /* @__PURE__ */ new Set(), files2;
   try {
-    files2 = readdirSync18(dir);
+    files2 = readdirSync19(dir);
   } catch {
     return out6;
   }
@@ -547240,11 +547495,11 @@ var init_skillsFill = __esm({
 });
 
 // build-src/src/sema/teamOnboarding.ts
-import { existsSync as existsSync43, readdirSync as readdirSync19 } from "fs";
+import { existsSync as existsSync43, readdirSync as readdirSync20 } from "fs";
 function hasWorkspaceData() {
   try {
     let dir = getProjectsDir2();
-    return existsSync43(dir) ? readdirSync19(dir).length > 0 : !1;
+    return existsSync43(dir) ? readdirSync20(dir).length > 0 : !1;
   } catch {
     return !1;
   }