@sema-agent/cli 1.0.57 → 1.0.58

package/npm-shrinkwrap.json

@@ -1,15 +1,15 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.57",
+  "version": "1.0.58",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sema-agent/cli",
-      "version": "1.0.57",
+      "version": "1.0.58",
       "license": "BUSL-1.1",
       "dependencies": {
-        "@sema-agent/sdk": "0.1.0",
+        "@sema-agent/sdk": "0.1.7",
         "@sema-agent/server": "1.303.0"
       },
       "bin": {
@@ -620,9 +620,9 @@
       }
     },
     "node_modules/@sema-agent/core": {
-      "version": "1.449.0",
-      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-1.449.0.tgz",
-      "integrity": "sha512-96/xytGODYAZZ3A1hz+5DyknCVegqHREl/VmjSwI9dbNacwsEzm5Fb+t7Emq0L0MCMNs57p6ehL7JK7Ip1YMyg==",
+      "version": "1.452.0",
+      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-1.452.0.tgz",
+      "integrity": "sha512-bF//hcLf7dkhFmwPnSe6UOccUJvd/SljrtdRsSsq0SAyTDnmKIuVZnzQqRDp+W7aX/b7TZ5ZhL1pSNTiwtRRZg==",
       "license": "BUSL-1.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.29.0",
@@ -639,9 +639,9 @@
       }
     },
     "node_modules/@sema-agent/registry-core": {
-      "version": "0.10.22",
-      "resolved": "https://registry.npmjs.org/@sema-agent/registry-core/-/registry-core-0.10.22.tgz",
-      "integrity": "sha512-89x+ezW1HmifLJsikhUjyOF8FxOh/lzj7fibOTC1fFjDhItHgn1Hqbz0aEyHgPbBVqPgmpHlK+J0+7vEeqepMQ==",
+      "version": "0.10.23",
+      "resolved": "https://registry.npmjs.org/@sema-agent/registry-core/-/registry-core-0.10.23.tgz",
+      "integrity": "sha512-hFPL5YtNCOUG7zp+NkZSynVwqMoScjuTshH2XYi6816zcALajgSmOvEoTZR1X/Ter9DNcMaGAlaS5OnNtPTuhQ==",
       "license": "BUSL-1.1",
       "dependencies": {
         "zod": "^3.24.0"
@@ -663,9 +663,9 @@
       }
     },
     "node_modules/@sema-agent/sdk": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/@sema-agent/sdk/-/sdk-0.1.0.tgz",
-      "integrity": "sha512-7niJe+whPlC7IBpgTXq5rxTYZfmVvU3Zigjt9Dq4sYnhvQAieNZBEIjOYQNoS/xQDJIEE5E7z4iJLjYM4cmdjA==",
+      "version": "0.1.7",
+      "resolved": "https://registry.npmjs.org/@sema-agent/sdk/-/sdk-0.1.7.tgz",
+      "integrity": "sha512-/jEvBEQyPl2a+5v6laH/VevjpQ3LZqPWAM5OqJ5I/3JbYy5nYQFXjRsTtKLcJ+/0MF6ioE+I9KnHN7pa+zXBJQ==",
       "license": "BUSL-1.1",
       "engines": {
         "node": ">=20"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.57",
+  "version": "1.0.58",
   "description": "Sema — your own Claude Code-grade coding agent, in the terminal.",
   "license": "BUSL-1.1",
   "bin": {
@@ -21,14 +21,14 @@
     "sema"
   ],
   "dependencies": {
-    "@sema-agent/sdk": "0.1.0",
+    "@sema-agent/sdk": "0.1.7",
     "@sema-agent/server": "1.303.0"
   },
   "overrides": {
-    "@sema-agent/core": "1.449.0",
-    "@sema-agent/registry-core": "0.10.22"
+    "@sema-agent/core": "1.452.0",
+    "@sema-agent/registry-core": "0.10.23"
   },
-  "semaEngineVersion": "server 1.303.0 / core 1.449.0 / registry-core 0.10.22",
+  "semaEngineVersion": "server 1.303.0 / core 1.452.0 / registry-core 0.10.23",
   "engines": {
     "node": ">=18"
   }

package/sema.js

@@ -70694,9 +70694,12 @@ function flattenToolOutput(output) {
   }
   return "";
 }
-function bashExitCodeFailed(toolName2, text2) {
+function bashExitCodeFailed(toolName2, text2, structured) {
   if (typeof toolName2 !== "string" || toolName2.toLowerCase() !== "bash")
     return false;
+  const ec2 = structured?.exitCode;
+  if (typeof ec2 === "number")
+    return ec2 !== 0;
   const m2 = /^exit code: (\d+)\b/.exec(text2);
   return m2 !== null && m2[1] !== "0";
 }
@@ -70715,7 +70718,7 @@ function toolEndResultToUserFrame(arm) {
           // truncated 输出如实标注(观察面注记;截断体绝不回喂模型——upstreamBridge 同款)。
           content: arm.truncated === true ? `${text2}
 \u2026(truncated)` : text2,
-          is_error: arm.isError === true || bashExitCodeFailed(arm.toolName, text2)
+          is_error: arm.isError === true || bashExitCodeFailed(arm.toolName, text2, arm.structured)
         }
       ]
     },
@@ -70803,7 +70806,7 @@ function errCodes(e) {
   if (!e || typeof e !== "object")
     return {};
   const o = e;
-  return { code: o.errorCode ?? o.code, name: o.name, status: o.status ?? o.statusCode };
+  return { code: o.errorCode, name: o.name, status: o.status ?? o.statusCode };
 }
 function isSteeringNotRunning(e) {
   const { code: code2, name } = errCodes(e);
@@ -76769,7 +76772,7 @@ function isBindingMismatch(e) {
   if (!e || typeof e !== "object")
     return false;
   const o = e;
-  const code2 = o.errorCode ?? o.code;
+  const code2 = o.errorCode;
   if (code2 === "approval_binding_mismatch")
     return true;
   if (typeof o.name === "string" && o.name === "ApprovalBindingMismatchError")
@@ -223628,12 +223631,7 @@ function toTaskRequest(params) {
   if (wireHooks && process.env.SEMA_DEBUG) {
     console.error(`[sema][seamQuery] hooks wire: ${Object.keys(wireHooks).join("+")} \u2192 TaskRequest.settings.hooks`);
   }
-  const settingsOut = seamSettings || webSearch || ultracode || wireHooks ? {
-    ...seamSettings ?? {},
-    ...webSearch ? { webSearch } : {},
-    ...ultracode ? { ultracode } : {},
-    ...wireHooks ? { hooks: wireHooks } : {}
-  } : void 0;
+  const clientContextFields = clientContextField(getTimeZone());
   const selfOrchestration = process.env.SEMA_LIVE_BASEURL ? selfOrchestrationFromEnv() : void 0;
   if (selfOrchestration && process.env.SEMA_DEBUG) {
     console.error("[sema][seamQuery] selfOrchestration wire: SEMA_SELF_ORCHESTRATION \u2192 TaskRequest.selfOrchestration=true (run_workflow)");
@@ -223695,70 +223693,79 @@ ${objective}`;
       console.error("[sema][seamQuery] sandbox wire: --sandbox auto advisory \u2192 objective (one-shot; model drives SelectEnvironment)");
     }
   }
-  return {
-    objective,
-    // SINGLE NAMESPACE (TP-A Step 2): stamp the SHELL's own sessionId (STATE.sessionId) — NOT the fixed mock
-    // constant — so the engine's session === the shell's session (engineSessionId === shellSessionId). The
-    // engine accepts a caller-supplied sessionId (server.ts:3565 LENGTH-ONLY ≤64; spec.sessionId → acquire →
-    // openOrCreate uses it verbatim), so the first turn's done.result.sessionId echoes back getSessionId().
-    // /fork, /rewind, events.jsonl and the shell's <sessionId>.jsonl all align on ONE id with no mapping.
-    // On the MOCK (offline) path this id is echoed straight back (mockClient: done.sessionId = req.sessionId).
-    // On the LIVE path liveClient.toLiveRequest preserves it (first turn) or reuses the captured id (continuity).
-    sessionId: getSessionId(),
-    ...scenario2 ? { scenario: scenario2 } : {},
-    ...typeof sysPrompt === "string" ? { systemPrompt: sysPrompt } : {},
-    ...reasoningEffort ? { reasoningEffort } : {},
-    // The loaded on-disk skills (.sema/skills/SKILL.md), projected to SkillSpec[] and server-capped
-    // (skillsWire.ts). Present ONLY when launchReplProduction loaded + injected them on the live path; unset
-    // on the mock path and on a skill-less live launch, so neither the mock nor a no-skills request changes
-    // shape. liveClient.toLiveRequest spreads {...req}, so this survives to the live engine untouched.
-    ...seamSkills ? { skills: seamSkills } : {},
-    // The local .mcp.json servers (CC parity), projected to McpServerSpec[] (mcpWire.ts). Present ONLY when
-    // launchReplProduction loaded them on the live path. liveClient.toLiveRequest spreads {...req} so this
-    // survives to the engine, where the SERVICE single-user gate (1.20.0) decides whether to honor it.
-    ...seamMcp ? { mcpServers: seamMcp } : {},
-    // CC Rewind (E18): per-turn capture flag (rewindFiles:true) on normal turns, or a one-shot restore
-    // (resumeAt/rewindFiles/rewindFilesTo) when /rewind armed it. Empty ⇒ no stamp (capture disabled + no arm).
-    ...rewindFields,
-    // CC permission mode (R4): the raw permissionMode intent (service interprets, tighten-only); empty on default.
-    ...permissionFields,
-    // CC /model (WIRE-1): the per-turn selected model; service resolveTaskModel catalog-gates it. Empty on default.
-    ...modelFields,
-    // imagesWire (CC paste-image): the submitted user message's image blocks → engine ImageInput[]. Omit if none.
-    ...images.length > 0 ? { images } : {},
-    // Workflow super-set: the top-level selfOrchestration flag (SEMA_SELF_ORCHESTRATION env opt-in, live-gated).
-    // Present ⇒ the SERVICE mounts core run_workflow (gated on its deployment/tenant policy); absent ⇒ no stamp.
-    ...selfOrchestration ? { selfOrchestration } : {},
-    // Workflow deferred-disclosure ([1052]①): absent = fully exposed (activation turn / opt-out); present =
-    // core 1.314 placeholder-on-wire, schema bytes out of the cache prefix, ToolSearch-activatable.
-    ...deferTools ? { deferTools } : {},
-    ...retainBackground ? { retainBackgroundProcesses: retainBackground } : {},
-    ...promptProfile ? { promptProfile } : {},
-    // Fork super-set: the top-level enableFork flag — EXPLICIT boolean on live (core ≥1.257 treats absent
-    // as granted; the shell's default-OFF product decision must be spelled out). Mock path stays unstamped.
-    ...enableFork !== void 0 ? { enableFork } : {},
-    // Turn-boundary attachments (design/133 + G1): default-on G1 pair on the live path; service → core opt-in.
-    ...attachments ? { attachments } : {},
-    // The resolver's effective settings (hooks/env/model + resolved permissions, live + SEMA_SEND_SETTINGS opt-in)
-    // MERGED with the WebSearch backend config (SEMA_WEBSEARCH_* env / settings.json, its own live-only opt-in) →
-    // the engine's TOB-fleet 透传 field. Both absent ⇒ no `settings` (mock parity + default live behaviour preserved).
-    ...settingsOut ? { settings: settingsOut } : {},
-    // clientContext (clientContextWireCaps, design/112 — core 1.181): the user's LOCAL identity facts (IANA
-    // timeZone from utils/intl `getTimeZone()`, + optional SEMA_USER_EMAIL). The SERVICE relays it to core
-    // `TaskSpec.clientContext` → core localizes the `# Environment` block's "today" to the user's zone (+ a
-    // `(Asia/Tokyo)`-style annotation); absent ⇒ core annotates `(UTC)` so the model knows it's container time.
-    // Benign metadata (no secret), always-derivable ⇒ stamped on every request (mock ignores it; core 1.186
-    // validates the zone and only `timeZone`+`userEmail` are live — `locale` was deleted, never set here).
-    ...clientContextField(getTimeZone()),
-    // [686]② `--sandbox <profile>` (EXPLICIT): the per-task image PROFILE (never a digest — the server
-    // re-resolves fail-closed with the caller's principal). Absent on default/auto/mock (b 口径:缺省不发).
-    ...sandboxFields,
-    // scratchpad 域([816] 壳侧承诺③ / [820]③,scratchpadWireCaps):vendored getScratchpadDir 的
-    // per-session 路径 → TaskRequest.scratchpadDir(server 半场填 envFacts.scratchpadDir + 工厂
-    // exemptDirs;没到货时引擎忽略=无害 additive)。gate off ⇒ 无 stamp;live-gated 同 webSearch
-    // 使 mock 请求形状不变。
-    ...process.env.SEMA_LIVE_BASEURL ? scratchpadDirField() : {}
-  };
+  return buildTaskRequest(
+    {
+      objective,
+      // SINGLE NAMESPACE (TP-A Step 2): stamp the SHELL's own sessionId (STATE.sessionId) — NOT the fixed mock
+      // constant — so the engine's session === the shell's session (engineSessionId === shellSessionId). The
+      // engine accepts a caller-supplied sessionId (server.ts:3565 LENGTH-ONLY ≤64; spec.sessionId → acquire →
+      // openOrCreate uses it verbatim), so the first turn's done.result.sessionId echoes back getSessionId().
+      // /fork, /rewind, events.jsonl and the shell's <sessionId>.jsonl all align on ONE id with no mapping.
+      // On the MOCK (offline) path this id is echoed straight back (mockClient: done.sessionId = req.sessionId).
+      // On the LIVE path liveClient.toLiveRequest preserves it (first turn) or reuses the captured id (continuity).
+      sessionId: getSessionId(),
+      live: Boolean(process.env.SEMA_LIVE_BASEURL),
+      ...scenario2 ? { scenario: scenario2 } : {},
+      ...typeof sysPrompt === "string" ? { systemPrompt: sysPrompt } : {},
+      ...reasoningEffort ? { reasoningEffort } : {},
+      // CC /model (WIRE-1): the per-turn selected model; service resolveTaskModel catalog-gates it. Empty on default.
+      ...modelFields,
+      // imagesWire (CC paste-image): the submitted user message's image blocks → engine ImageInput[]. Omit if none.
+      ...images.length > 0 ? { images } : {},
+      // The loaded on-disk skills (.sema/skills/SKILL.md), projected to SkillSpec[] and server-capped
+      // (skillsWire.ts). Present ONLY when launchReplProduction loaded + injected them on the live path; unset
+      // on the mock path and on a skill-less live launch, so neither the mock nor a no-skills request changes
+      // shape. liveClient.toLiveRequest spreads {...req}, so this survives to the live engine untouched.
+      ...seamSkills ? { skills: seamSkills } : {},
+      // The local .mcp.json servers (CC parity), projected to McpServerSpec[] (mcpWire.ts). Present ONLY when
+      // launchReplProduction loaded them on the live path. liveClient.toLiveRequest spreads {...req} so this
+      // survives to the engine, where the SERVICE single-user gate (1.20.0) decides whether to honor it.
+      ...seamMcp ? { mcpServers: seamMcp } : {},
+      // CC Rewind (E18): per-turn capture flag (rewindFiles:true) on normal turns, or a one-shot restore
+      // (resumeAt/rewindFiles/rewindFilesTo) when /rewind armed it. Empty ⇒ no stamp (capture disabled + no arm).
+      ...Object.keys(rewindFields).length > 0 ? { rewind: rewindFields } : {},
+      // CC permission mode (R4): the raw permissionMode intent (service interprets, tighten-only); empty on default.
+      ...permissionFields,
+      // [686]② `--sandbox <profile>` (EXPLICIT): the per-task image PROFILE (never a digest — the server
+      // re-resolves fail-closed with the caller's principal). Absent on default/auto/mock (b 口径:缺省不发).
+      ...sandboxFields,
+      // Workflow super-set: the top-level selfOrchestration flag (SEMA_SELF_ORCHESTRATION env opt-in, live-gated).
+      // Present ⇒ the SERVICE mounts core run_workflow (gated on its deployment/tenant policy); absent ⇒ no stamp.
+      ...selfOrchestration ? { selfOrchestration } : {},
+      // Workflow deferred-disclosure ([1052]①): absent = fully exposed (activation turn / opt-out); present =
+      // core 1.314 placeholder-on-wire, schema bytes out of the cache prefix, ToolSearch-activatable.
+      ...deferTools ? { deferTools } : {},
+      ...retainBackground ? { retainBackgroundProcesses: retainBackground } : {},
+      ...promptProfile ? { promptProfile } : {},
+      // Fork super-set: the top-level enableFork flag — EXPLICIT boolean on live (core ≥1.257 treats absent
+      // as granted; the shell's default-OFF product decision must be spelled out). Mock path stays unstamped.
+      ...enableFork !== void 0 ? { enableFork } : {},
+      // Turn-boundary attachments (design/133 + G1): default-on G1 pair on the live path; service → core opt-in.
+      ...attachments ? { attachments } : {},
+      // clientContext (clientContextWireCaps, design/112 — core 1.181): the user's LOCAL identity facts (IANA
+      // timeZone from utils/intl `getTimeZone()`, + optional SEMA_USER_EMAIL). The SERVICE relays it to core
+      // `TaskSpec.clientContext` → core localizes the `# Environment` block's "today" to the user's zone (+ a
+      // `(Asia/Tokyo)`-style annotation); absent ⇒ core annotates `(UTC)` so the model knows it's container time.
+      // Benign metadata (no secret), always-derivable ⇒ stamped on every request (mock ignores it; core 1.186
+      // validates the zone and only `timeZone`+`userEmail` are live — `locale` was deleted, never set here).
+      // (包的 input 面按结构收 `Record<string, unknown>`;`ClientContext` 是具名接口无索引签名,故转型。)
+      ...clientContextFields.clientContext ? { clientContext: clientContextFields.clientContext } : {},
+      // scratchpad 域([816] 壳侧承诺③ / [820]③,scratchpadWireCaps):vendored getScratchpadDir 的
+      // per-session 路径 → TaskRequest.scratchpadDir(server 半场填 envFacts.scratchpadDir + 工厂
+      // exemptDirs;没到货时引擎忽略=无害 additive)。gate off ⇒ 无 stamp;端侧保留 live 判读避免在
+      // mock 车道白做一次目录解析(包内 live 门同样兜着)。
+      ...process.env.SEMA_LIVE_BASEURL ? scratchpadDirField() : {},
+      // settings 四源(端各自解析,合并序与「全空则不 stamp」归包):resolver 的 effective 快照 +
+      // WebSearch 后端配置 + ultracode 预设 + 用户 settings 文件 hooks。
+      settings: {
+        ...seamSettings ? { resolved: seamSettings } : {},
+        ...webSearch ? { webSearch } : {},
+        ...ultracode ? { ultracode } : {},
+        ...wireHooks ? { hooks: wireHooks } : {}
+      }
+    },
+    "interactive"
+  );
 }
 function semaApiErrorContent(err8, requestedScenario) {
   const e = err8;
@@ -224071,6 +224078,7 @@ var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, DEFAULT_DRAI
 var init_seamQuery = __esm({
   "build-src/src/sema/seamQuery.ts"() {
     init_adapter();
+    init_dist();
     init_effortWire2();
     init_rewindWireCaps2();
     init_permissionWireCaps2();
@@ -361268,9 +361276,9 @@ function streamingTailWrap(unstableSuffix) {
 var import_compiler_runtime52, import_react48, import_jsx_runtime65, TOKEN_CACHE_MAX, tokenCache, MD_SYNTAX_RE;
 var init_Markdown = __esm({
   "build-src/src/components/Markdown.tsx"() {
-    import_compiler_runtime52 = __toESM(require_compiler_runtime());
+    import_compiler_runtime52 = __toESM(require_compiler_runtime(), 1);
     init_marked_esm();
-    import_react48 = __toESM(require_react());
+    import_react48 = __toESM(require_react(), 1);
     init_useSettings();
     init_ink2();
     init_cliHighlight();
@@ -361278,7 +361286,7 @@ var init_Markdown = __esm({
     init_markdown();
     init_messages4();
     init_MarkdownTable();
-    import_jsx_runtime65 = __toESM(require_jsx_runtime());
+    import_jsx_runtime65 = __toESM(require_jsx_runtime(), 1);
     TOKEN_CACHE_MAX = 500;
     tokenCache = /* @__PURE__ */ new Map();
     MD_SYNTAX_RE = /[#*`|[>\-_~]|\n\n|^\d+\. |\n\d+\. /;
@@ -384297,7 +384305,7 @@ var init_classifierApprovalsHook = __esm({
 var React31, TypedComponent, SentryErrorBoundary;
 var init_SentryErrorBoundary = __esm({
   "build-src/src/components/SentryErrorBoundary.ts"() {
-    React31 = __toESM(require_react(), 1);
+    React31 = __toESM(require_react());
     TypedComponent = React31.Component;
     SentryErrorBoundary = class extends TypedComponent {
       constructor(props) {
@@ -496402,14 +496410,13 @@ var init_sema_brand = __esm({
         _doc: "Rendered as the 'What's new' feed (createWhatsNewFeed). Top version MUST be >= current app version (2.1.187) and newer than config.lastReleaseNotesSeen so the notes display and full-logo mode triggers. Pinned == app version (2.1.187) + lastReleaseNotesSeen (loginState.ts) so getRecentReleaseNotes()===[] \u2192 condensed logo (matches refs/chrome.empty-input.json). \u{1F534} SHAPE: {version, notes[]} \u2014 a bare array silently kills welcome What's-new + /release-notes + changelog pin (2026-07-27 \u6848).",
         version: "2.1.187",
         notes: [
-          "WebFetch answers your question instead of dumping the raw page (engine 1.301+, ~660x less context per fetch)",
-          "--setting-sources '' now truly disables the settings.json env block (matching Claude Code)",
-          "Registry calls now ride the official SDK client (device login names the app correctly on the consent screen)",
-          "The stream-json init frame now lists ToolSearch, matching what the engine actually mounts"
+          "Bash failures now carry is_error in -p stream-json even when output spills to persisted storage (structured exitCode is authoritative)",
+          "sema cloud config no longer hangs forever on an unresponsive registry (SDK client with timeout + auth refresh)",
+          "cloud doctor's worker health check now rejects impostor services on the port (HTTP 200 must also say status ok)"
         ]
       },
-      productVersion: "1.0.57",
-      announcement: "sema 1.0.57 \u2014 Fix batch: WebFetch now truly summarizes (engine-side wiring, ~660x less context per fetch), --setting-sources '' really disables the settings env block, registry calls ride the official SDK, and the init frame reports ToolSearch."
+      productVersion: "1.0.58",
+      announcement: "sema 1.0.58 \u2014 Fix batch: Bash failure flagging survives large-output spills (structured exitCode wins over text sniffing), cloud config gets real timeouts, and doctor spots port impostors."
     };
   }
 });
@@ -502689,14 +502696,13 @@ var require_sema_brand = __commonJS({
         _doc: "Rendered as the 'What's new' feed (createWhatsNewFeed). Top version MUST be >= current app version (2.1.187) and newer than config.lastReleaseNotesSeen so the notes display and full-logo mode triggers. Pinned == app version (2.1.187) + lastReleaseNotesSeen (loginState.ts) so getRecentReleaseNotes()===[] \u2192 condensed logo (matches refs/chrome.empty-input.json). \u{1F534} SHAPE: {version, notes[]} \u2014 a bare array silently kills welcome What's-new + /release-notes + changelog pin (2026-07-27 \u6848).",
         version: "2.1.187",
         notes: [
-          "WebFetch answers your question instead of dumping the raw page (engine 1.301+, ~660x less context per fetch)",
-          "--setting-sources '' now truly disables the settings.json env block (matching Claude Code)",
-          "Registry calls now ride the official SDK client (device login names the app correctly on the consent screen)",
-          "The stream-json init frame now lists ToolSearch, matching what the engine actually mounts"
+          "Bash failures now carry is_error in -p stream-json even when output spills to persisted storage (structured exitCode is authoritative)",
+          "sema cloud config no longer hangs forever on an unresponsive registry (SDK client with timeout + auth refresh)",
+          "cloud doctor's worker health check now rejects impostor services on the port (HTTP 200 must also say status ok)"
         ]
       },
-      productVersion: "1.0.57",
-      announcement: "sema 1.0.57 \u2014 Fix batch: WebFetch now truly summarizes (engine-side wiring, ~660x less context per fetch), --setting-sources '' really disables the settings env block, registry calls ride the official SDK, and the init frame reports ToolSearch."
+      productVersion: "1.0.58",
+      announcement: "sema 1.0.58 \u2014 Fix batch: Bash failure flagging survives large-output spills (structured exitCode wins over text sniffing), cloud config gets real timeouts, and doctor spots port impostors."
     };
   }
 });
@@ -636683,8 +636689,8 @@ async function collectAxesRows(opts, deps2) {
     });
     return rows2;
   }
-  const probeHealth2 = deps2?.probeHealth ?? ((url3) => engineTarget.probeEngineHealthUrl(url3));
-  const health = await probeHealth2(remote);
+  const probeHealth3 = deps2?.probeHealth ?? ((url3) => engineTarget.probeEngineHealthUrl(url3));
+  const health = await probeHealth3(remote);
   if (!health) {
     rows2.push({
       label: "Remote health",
@@ -643779,7 +643785,7 @@ async function* ask(params) {
         if (frame) yield frame;
         continue;
       }
-      if (t2 === "retry_status" || t2 === "turn_usage" || t2 === "task_progress") {
+      if (t2 === "retry_status" || t2 === "turn_usage" || t2 === "task_progress" || t2 === "steering_injected") {
         continue;
       }
       if (t2 === "prompt_suggestions") {
@@ -649846,7 +649852,7 @@ async function probeEngineActiveBgTasksForCli(deps2) {
     if (Array.isArray(drained2)) return { kind: "tasks", engine: remote, tasks: drained2 };
     return { kind: "unavailable", engine: remote, reason: `fleet snapshot failed: ${drained2.error}` };
   }
-  const { getEnginePortFilePath: getEnginePortFilePath2, getEngineTokenFilePath: getEngineTokenFilePath2, isProcessAlive: isProcessAlive2, probeHealth: probeHealth2 } = await Promise.resolve().then(() => (init_engineLifecycleManager(), engineLifecycleManager_exports));
+  const { getEnginePortFilePath: getEnginePortFilePath2, getEngineTokenFilePath: getEngineTokenFilePath2, isProcessAlive: isProcessAlive2, probeHealth: probeHealth3 } = await Promise.resolve().then(() => (init_engineLifecycleManager(), engineLifecycleManager_exports));
   let anchor = null;
   try {
     const parsed = JSON.parse(readFileSync41(getEnginePortFilePath2(), "utf8"));
@@ -649855,7 +649861,7 @@ async function probeEngineActiveBgTasksForCli(deps2) {
   }
   if (!anchor || !isProcessAlive2(anchor.pid)) return { kind: "no-engine" };
   const engine = `127.0.0.1:${anchor.port}`;
-  const health = await probeHealth2(anchor.port);
+  const health = await probeHealth3(anchor.port);
   if (!health) {
     return { kind: "unavailable", engine, reason: `engine anchor alive (pid ${anchor.pid}) but GET /health failed` };
   }
@@ -650044,12 +650050,11 @@ function domainSummary(names) {
 }
 async function cloudConfig(options) {
   try {
-    const { profileName, registryUrl, accessToken } = await getValidAccessToken(options.profile);
+    const { profileName, registryUrl } = await getValidAccessToken(options.profile);
+    const client4 = registryClientForProfile(registryUrl, profileName, { timeoutMs: 3e4 });
     let res;
     try {
-      res = await fetch(`${registryUrl}/api/v1/effective`, {
-        headers: { authorization: `Bearer ${accessToken}` }
-      });
+      res = await client4.requestRaw({ method: "GET", path: "/api/v1/effective" });
     } catch (e) {
       err3(`Error: cannot reach registry at ${registryUrl}: ${e instanceof Error ? e.message : String(e)}`);
       process.exit(1);
@@ -650059,16 +650064,13 @@ async function cloudConfig(options) {
       out("This registry does not serve /api/v1/effective yet \u2014 upgrade the registry to a version with API v1 to use `sema cloud config`.");
       return;
     }
-    if (!res.ok) {
+    if (res.status < 200 || res.status >= 300) {
       err3(`Error: registry returned HTTP ${res.status} for /api/v1/effective`);
       process.exit(1);
     }
-    const text2 = await res.text();
-    let body;
-    try {
-      body = JSON.parse(text2);
-    } catch {
-      err3(`Error: registry returned a non-JSON body for /api/v1/effective`);
+    const body = res.body ?? {};
+    if (typeof body !== "object" || Array.isArray(body)) {
+      err3(`Error: registry returned a non-object body for /api/v1/effective`);
       process.exit(1);
     }
     if (options.json) {
@@ -650396,6 +650398,7 @@ var init_cloud = __esm({
   "build-src/src/cli/handlers/cloud.ts"() {
     init_cloudProfile();
     init_cloudAuth();
+    init_registrySdkClient();
     out = (line) => process.stdout.write(`${line}
 `);
     err3 = (line) => process.stderr.write(`${line}
@@ -652476,7 +652479,7 @@ __export(cloudResources_exports, {
 import { createHash as createHash26 } from "node:crypto";
 import { existsSync as existsSync32, readdirSync as readdirSync12, readFileSync as readFileSync45, statSync as statSync14 } from "node:fs";
 import { basename as basename68, dirname as dirname86, isAbsolute as isAbsolute33, join as join194, resolve as resolve49 } from "node:path";
-import { getEffective as getEffective2, OAuthFlowError as OAuthFlowError3 } from "@sema-agent/sdk/registry";
+import { getEffective as getEffective2, getMeConfig, getScopeConfigDraft as getScopeConfigDraft2, OAuthFlowError as OAuthFlowError3, RegistryApiError as RegistryApiError3 } from "@sema-agent/sdk/registry";
 function fail4(e) {
   err6(`Error: ${e instanceof Error ? e.message : String(e)}`);
   process.exit(1);
@@ -652537,26 +652540,34 @@ async function personalFetch(auth2, path28, init2) {
   }
 }
 async function meConfigGet(auth2, domain2, forUser) {
-  const { status: status3, json: json2 } = await personalFetch(auth2, personalPath(domain2, forUser));
-  if (forUser) {
-    const managed = managedLaneError(forUser, status3, json2);
-    if (managed) throw managed;
-  }
-  if (status3 === 404 || status3 === 501) {
-    throw new CloudAuthError(
-      `this registry does not serve ${personalPath(domain2, forUser).replace(`/${domain2}`, "")} yet (HTTP ${status3}) \u2014 upgrade the registry to a version with the ${forUser ? "admin-managed" : ""} personal config layer`,
-      void 0,
-      status3
-    );
-  }
-  if (status3 !== 200) {
-    throw new CloudAuthError(
-      `registry rejected the personal-config read (HTTP ${status3}${typeof json2.error === "string" ? `: ${json2.error}` : ""})`,
-      typeof json2.error === "string" ? json2.error : void 0,
-      status3
-    );
+  const client4 = registryClientForProfile(auth2.registryUrl, auth2.profileName, { timeoutMs: 3e4 });
+  try {
+    return await getMeConfig(client4, domain2, forUser ? { forUser } : {});
+  } catch (e) {
+    if (e instanceof OAuthFlowError3) {
+      throw new CloudAuthError(`the registry rejected your session (${e.code}) \u2014 sign in again: sema cloud login`, e.code, 401);
+    }
+    if (e instanceof RegistryApiError3) {
+      const json2 = asRec3(e.body) ?? {};
+      if (forUser) {
+        const managed = managedLaneError(forUser, e.status, json2);
+        if (managed) throw managed;
+      }
+      if (e.status === 404 || e.status === 501) {
+        throw new CloudAuthError(
+          `this registry does not serve ${personalPath(domain2, forUser).replace(`/${domain2}`, "")} yet (HTTP ${e.status}) \u2014 upgrade the registry to a version with the ${forUser ? "admin-managed" : ""} personal config layer`,
+          void 0,
+          e.status
+        );
+      }
+      throw new CloudAuthError(
+        `registry rejected the personal-config read (HTTP ${e.status}${typeof json2.error === "string" ? `: ${json2.error}` : ""})`,
+        typeof json2.error === "string" ? json2.error : void 0,
+        e.status
+      );
+    }
+    throw new CloudAuthError(`cannot reach registry at ${auth2.registryUrl}: ${e instanceof Error ? e.message : String(e)}`);
   }
-  return { value: json2.value ?? null, updatedAt: typeof json2.updatedAt === "string" ? json2.updatedAt : null };
 }
 async function meConfigPut(auth2, domain2, value, summary, baseUpdatedAt, forUser) {
   const { status: status3, json: json2 } = await personalFetch(auth2, personalPath(domain2, forUser), {
@@ -652672,9 +652683,17 @@ async function teamFetch(ctx, path28, init2) {
   }
 }
 async function teamConfigGetDraft(ctx, domain2) {
-  const { status: status3, json: json2 } = await teamFetch(ctx, teamConfigPath(ctx, domain2));
-  if (status3 !== 200) throw await teamHttpError(ctx, status3, json2, `reading the team ${domain2} config`, "member (any role)");
-  return { value: json2.value ?? null, version: typeof json2.version === "number" ? json2.version : 0 };
+  try {
+    return await getScopeConfigDraft2(ctx.client, ctx.space, domain2);
+  } catch (e) {
+    if (e instanceof OAuthFlowError3) {
+      throw new CloudAuthError(`the registry rejected your session (${e.code}) \u2014 sign in again: sema cloud login`, e.code, 401);
+    }
+    if (e instanceof RegistryApiError3) {
+      throw await teamHttpError(ctx, e.status, asRec3(e.body) ?? {}, `reading the team ${domain2} config`, "member (any role)");
+    }
+    throw new CloudAuthError(`cannot reach registry at ${ctx.registryUrl}: ${e instanceof Error ? e.message : String(e)}`);
+  }
 }
 async function teamConfigGetPublished(ctx, domain2) {
   const { status: status3, json: json2 } = await teamFetch(ctx, `${teamConfigPath(ctx, domain2)}?source=published`);
@@ -653839,6 +653858,7 @@ import { createRequire as createRequire4 } from "module";
 import { createInterface as createInterface3 } from "readline";
 import { dirname as dirname87, join as join195, resolve as resolve50 } from "path";
 import { getEffective as getEffective3, probeRegistryHealth } from "@sema-agent/sdk/registry";
+import { probeHealth as probeHealth2 } from "@sema-agent/sdk";
 function fail5(e) {
   err7(`Error: ${e instanceof Error ? e.message : String(e)}`);
   process.exit(1);
@@ -654104,7 +654124,10 @@ async function cloudSmoke(options) {
   printRow("registry /api/v1/effective (auth)", effective);
   const workerUrl = options.worker ?? resolved.profile.workerUrl;
   if (workerUrl) {
-    const w2 = await probe2(() => httpCheck(`${normalizeRegistryUrl(workerUrl)}/health`));
+    const w2 = await probe2(async () => {
+      const r = await probeHealth2(normalizeRegistryUrl(workerUrl), 8e3);
+      return r.alive ? { pass: true, detail: `HTTP 200 status=ok${r.health.version ? `, v${r.health.version}` : ""}` } : { pass: false, detail: "status" in r ? `${r.reason} (HTTP ${r.status})` : r.reason };
+    });
     printRow(`worker /health (${workerUrl})`, w2);
     if (!w2.pass) failures++;
   } else {
@@ -667711,7 +667734,7 @@ Auth: unix socket -R \u2192 local proxy`, "info");
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.57", "-v, --version", "Output the version number");
+  }).version("sema 1.0.58", "-v, --version", "Output the version number");
   program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)");
   program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux.");
   if (canUserConfigureAdvisor()) {