@sema-agent/cli 1.0.76 → 1.0.77

package/sema-main.js

@@ -39088,9 +39088,9 @@ var require_abort = __commonJS({
   "node_modules/asynckit/lib/abort.js"(exports2, module2) {
     module2.exports = abort;
     function abort(state4) {
-      Object.keys(state4.jobs).forEach(clean5.bind(state4)), state4.jobs = {};
+      Object.keys(state4.jobs).forEach(clean6.bind(state4)), state4.jobs = {};
     }
-    function clean5(key) {
+    function clean6(key) {
       typeof this.jobs[key] == "function" && this.jobs[key]();
     }
   }
@@ -55606,7 +55606,7 @@ function isRewindFamilyCode(code2) {
 function asModelFallbackReason(v2) {
   return v2 === MODEL_FALLBACK_INHERIT_NO_TIER_BINDING ? MODEL_FALLBACK_INHERIT_NO_TIER_BINDING : void 0;
 }
-var LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, USAGE_WINDOW_EXHAUSTED, ENV_LIFETIME_EXPIRED, CONFIG_LIMIT_INVALID, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_REFUSAL_CODES, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, TOOL_END_INTERRUPTED_CODES, ACTIVE_RUN_BUSY_ERROR_CODE, STOP_PARK_ARBITER_UNREACHABLE, STOP_PARK_RESUME_WON, STOP_NOT_LANDED, STOP_NOT_LOCAL, STOP_PARKED, STOP_CONFLICT_CODES, OUTPUT_INVALID, REWIND_ERROR_CODE_PREFIXES, STREAM_MAX_DURATION, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, init_engineErrorCodes = __esm({
+var LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TURNS_EXCEEDED, LIMITS_MAX_WALLTIME_EXCEEDED, USAGE_WINDOW_EXHAUSTED, ENV_LIFETIME_EXPIRED, CONFIG_LIMIT_INVALID, CONFIG_STRATEGY_FIND_LIMIT_INVALID, CONFIG_STRATEGY_MAX_SIZE_INVALID, CONFIG_LIMIT_UNKNOWN_KEY, CONFIG_REFUSAL_CODES, TOOL_END_INTERRUPTED_NEVER_STARTED, TOOL_END_INTERRUPTED_OUTCOME_UNKNOWN, TOOL_END_INTERRUPTED_CODES, ACTIVE_RUN_BUSY_ERROR_CODE, STOP_PARK_ARBITER_UNREACHABLE, STOP_PARK_RESUME_WON, STOP_NOT_LANDED, STOP_NOT_LOCAL, STOP_PARKED, STOP_CONFLICT_CODES, OUTPUT_INVALID, RESUME_AT_ERROR_CODE_PREFIX, REWIND_ERROR_CODE_PREFIXES, DRAINING_ERROR_CODE, SCENARIO_NOT_ALLOWED_ERROR_CODE, STREAM_MAX_DURATION, MODEL_FALLBACK_INHERIT_NO_TIER_BINDING, init_engineErrorCodes = __esm({
   "node_modules/@sema-agent/client-core/dist/engineErrorCodes.js"() {
     LIMITS_MAX_TOKENS_EXCEEDED = "limits.max_tokens_exceeded", LIMITS_MAX_COST_EXCEEDED = "limits.max_cost_exceeded", LIMITS_MAX_TURNS_EXCEEDED = "limits.max_turns_exceeded", LIMITS_MAX_WALLTIME_EXCEEDED = "limits.max_walltime_exceeded", USAGE_WINDOW_EXHAUSTED = "usage.window_exhausted", ENV_LIFETIME_EXPIRED = "env.lifetime_expired", CONFIG_LIMIT_INVALID = "config.limit_invalid", CONFIG_STRATEGY_FIND_LIMIT_INVALID = "config.strategy_find_limit_invalid", CONFIG_STRATEGY_MAX_SIZE_INVALID = "config.strategy_max_size_invalid", CONFIG_LIMIT_UNKNOWN_KEY = "config.limit_unknown_key", CONFIG_REFUSAL_CODES = /* @__PURE__ */ new Set([
       CONFIG_LIMIT_INVALID,
@@ -55624,8 +55624,8 @@ var LIMITS_MAX_TOKENS_EXCEEDED, LIMITS_MAX_COST_EXCEEDED, LIMITS_MAX_TURNS_EXCEE
       STOP_NOT_LANDED,
       STOP_NOT_LOCAL,
       STOP_PARKED
-    ], OUTPUT_INVALID = "output.invalid", REWIND_ERROR_CODE_PREFIXES = ["resume_at.", "rewind_snapshot."];
-    STREAM_MAX_DURATION = "STREAM_MAX_DURATION", MODEL_FALLBACK_INHERIT_NO_TIER_BINDING = "inherit_no_tier_binding";
+    ], OUTPUT_INVALID = "output.invalid", RESUME_AT_ERROR_CODE_PREFIX = "resume_at.", REWIND_ERROR_CODE_PREFIXES = [RESUME_AT_ERROR_CODE_PREFIX, "rewind_snapshot."];
+    DRAINING_ERROR_CODE = "draining", SCENARIO_NOT_ALLOWED_ERROR_CODE = "scenario_not_allowed", STREAM_MAX_DURATION = "STREAM_MAX_DURATION", MODEL_FALLBACK_INHERIT_NO_TIER_BINDING = "inherit_no_tier_binding";
   }
 });
 
@@ -58146,6 +58146,15 @@ var SSE_HEARTBEAT_GRACE_ENV, SSE_GRACE_MIN_MS, SSE_GRACE_MAX_MS, SDK_DEFAULT_GRA
   }
 });
 
+// node_modules/@sema-agent/client-core/dist/principalWire.js
+function normalizeWirePrincipal(v2) {
+  return v2 !== void 0 && v2.trim() !== "" ? v2 : void 0;
+}
+var init_principalWire = __esm({
+  "node_modules/@sema-agent/client-core/dist/principalWire.js"() {
+  }
+});
+
 // node_modules/@sema-agent/client-core/dist/engineWireSdk.js
 import { AgentClient } from "@sema-agent/sdk";
 function isLoopbackWireUrl(url3) {
@@ -58164,10 +58173,11 @@ function wireAuthTokenFor(baseUrl, token) {
 }
 function makeEngineWireClient(cfg) {
   try {
-    let base = {
+    let principal = normalizeWirePrincipal(cfg.principal), base = {
       baseUrl: cfg.baseUrl,
       // F-011 停发:缺席/空串=不给键(SDK 6.11 缺席=不发 x-agent-principal 头,owner-null)。
-      ...cfg.principal !== void 0 && cfg.principal !== "" ? { principal: cfg.principal } : {},
+      // A-028.10(0.30.3):空串判升级为 trim 判(principalWire 同尺)——全空白值同罪,归缺席。
+      ...principal !== void 0 ? { principal } : {},
       ...cfg.timeoutMs !== void 0 ? { timeoutMs: cfg.timeoutMs } : {},
       maxRetries: cfg.maxRetries ?? 0,
       ...cfg.fetchImpl ? { fetch: cfg.fetchImpl } : {}
@@ -58179,6 +58189,7 @@ function makeEngineWireClient(cfg) {
 }
 var init_engineWireSdk = __esm({
   "node_modules/@sema-agent/client-core/dist/engineWireSdk.js"() {
+    init_principalWire();
   }
 });
 
@@ -60010,14 +60021,14 @@ function claimProbeLease(caller, remainingMs) {
   };
 }
 async function waitForClaimRelease(taskId, deps2) {
-  let now2 = typeof deps2.now == "function" ? deps2.now : () => Date.now(), sleep10 = typeof deps2.sleep == "function" ? deps2.sleep : claimPollSleep, budgetMs = Number.isFinite(deps2.budgetMs) && deps2.budgetMs > 0 ? deps2.budgetMs : 0, startedAt = now2(), deadline = startedAt + budgetMs, waited = () => now2() - startedAt, isAborted3 = () => deps2.signal?.aborted === !0, delay = CANCEL_POLL_START_MS, lastStatus = null;
+  let now2 = typeof deps2.now == "function" ? deps2.now : () => Date.now(), sleep9 = typeof deps2.sleep == "function" ? deps2.sleep : claimPollSleep, budgetMs = Number.isFinite(deps2.budgetMs) && deps2.budgetMs > 0 ? deps2.budgetMs : 0, startedAt = now2(), deadline = startedAt + budgetMs, waited = () => now2() - startedAt, isAborted3 = () => deps2.signal?.aborted === !0, delay = CANCEL_POLL_START_MS, lastStatus = null;
   for (; ; ) {
     if (isAborted3())
       return { released: !1, waitedMs: waited(), aborted: !0, lastStatus };
     let remaining = deadline - now2();
     if (remaining <= 0)
       return { released: !1, waitedMs: waited(), aborted: !1, lastStatus };
-    if (await sleep10(Math.min(delay, remaining), deps2.signal), isAborted3())
+    if (await sleep9(Math.min(delay, remaining), deps2.signal), isAborted3())
       return { released: !1, waitedMs: waited(), aborted: !0, lastStatus };
     delay = Math.min(Math.round(delay * 1.5), CANCEL_POLL_MAX_MS);
     let status3, lease = claimProbeLease(deps2.signal, deadline - now2());
@@ -60027,8 +60038,11 @@ async function waitForClaimRelease(taskId, deps2) {
         ...deps2.session !== void 0 ? { session: deps2.session } : {}
       }));
     } catch {
-      if (lastStatus = null, lease.release(), isAborted3())
+      if (lease.release(), isAborted3())
         return { released: !1, waitedMs: waited(), aborted: !0, lastStatus };
+      if (lease.signal.aborted)
+        continue;
+      lastStatus = null;
       continue;
     }
     if (lease.release(), lastStatus = status3, status3 !== null && CLAIM_RELEASED_STATES.includes(status3))
@@ -60042,6 +60056,22 @@ async function attemptActiveRunSelfHeal(signal, runs, deps2) {
   } catch {
     pending2 = !1;
   }
+  let callerAborted = () => deps2?.signal?.aborted === !0;
+  if (pending2 && typeof deps2?.listOwnedPendingApprovals == "function" && !callerAborted()) {
+    let recheckCtl = new AbortController(), onCallerAbort = () => {
+      recheckCtl.abort(deps2.signal?.reason);
+    };
+    deps2.signal?.addEventListener("abort", onCallerAbort, { once: !0 });
+    try {
+      await Promise.race([
+        deps2.listOwnedPendingApprovals({ signal: recheckCtl.signal }),
+        claimPollSleep(OWNED_PENDING_RECHECK_TIMEOUT_MS, recheckCtl.signal).then(() => null)
+      ]) === 0 && !callerAborted() && (pending2 = !1);
+    } catch {
+    } finally {
+      deps2.signal?.removeEventListener("abort", onCallerAbort), recheckCtl.abort(new Error("owned-pending recheck settled"));
+    }
+  }
   if (pending2)
     return { kind: "decision-pending", taskId: signal.activeTaskId };
   let taskId = signal.activeTaskId;
@@ -60235,13 +60265,13 @@ function activeRunBusyHeadlessRow(signal, copy2) {
   let startOver = `${freshSession.charAt(0).toUpperCase()}${freshSession.slice(1)}`;
   return `This session is locked by an earlier run${handle2} that was never released, so this message was NOT sent. Nothing here clears on its own. ${startOver}, or release the run on the engine: ${cancelPath}`;
 }
-var PLAN_REVIEW_GATE_KIND, PLAN_REVIEW_GATE_KINDS, ASK_PARK_GATE_KINDS, PLAN_REVIEW_STATES, ASK_PARK_STATES, RUNNING_STATES, CLAIM_RELEASED_STATES, CLAIM_HELD_STATES, CANCEL_RELEASE_WAIT_MS, CANCEL_POLL_START_MS, CANCEL_POLL_MAX_MS, DEFAULT_WAY_OUT, DEFAULT_FRESH_SESSION, init_activeRunSelfHeal = __esm({
+var PLAN_REVIEW_GATE_KIND, PLAN_REVIEW_GATE_KINDS, ASK_PARK_GATE_KINDS, PLAN_REVIEW_STATES, ASK_PARK_STATES, RUNNING_STATES, CLAIM_RELEASED_STATES, CLAIM_HELD_STATES, CANCEL_RELEASE_WAIT_MS, OWNED_PENDING_RECHECK_TIMEOUT_MS, CANCEL_POLL_START_MS, CANCEL_POLL_MAX_MS, INTERACTIVE_WAY_OUT, DEFAULT_WAY_OUT, DEFAULT_FRESH_SESSION, init_activeRunSelfHeal = __esm({
   "node_modules/@sema-agent/client-core/dist/adapter/activeRunSelfHeal.js"() {
     init_abortableSleep();
     PLAN_REVIEW_GATE_KIND = "plan_review", PLAN_REVIEW_GATE_KINDS = [PLAN_REVIEW_GATE_KIND, "dry_run_review"], ASK_PARK_GATE_KINDS = ["human", "irreversible_ask", "policy_ask", "tool_approval"];
     PLAN_REVIEW_STATES = ["needs_review"], ASK_PARK_STATES = ["suspended"], RUNNING_STATES = ["running"], CLAIM_RELEASED_STATES = ["completed", "failed", "blocked", "timeout"], CLAIM_HELD_STATES = ["running", "suspended", "needs_review"];
-    CANCEL_RELEASE_WAIT_MS = 1e4, CANCEL_POLL_START_MS = 200, CANCEL_POLL_MAX_MS = 2e3;
-    DEFAULT_WAY_OUT = "run /clear to keep working in a fresh session", DEFAULT_FRESH_SESSION = "start a new session (drop --resume/--continue)";
+    CANCEL_RELEASE_WAIT_MS = 1e4, OWNED_PENDING_RECHECK_TIMEOUT_MS = 4e3, CANCEL_POLL_START_MS = 200, CANCEL_POLL_MAX_MS = 2e3;
+    INTERACTIVE_WAY_OUT = "run /clear to keep working in a fresh session", DEFAULT_WAY_OUT = INTERACTIVE_WAY_OUT, DEFAULT_FRESH_SESSION = "start a new session (drop --resume/--continue)";
   }
 });
 
@@ -60300,7 +60330,7 @@ function buildTaskRequest(input, lane) {
 }
 function applyLiveRequestDefaults(req, host) {
   let out6 = { ...req };
-  if (out6.cwd == null && host.cwd !== void 0 && (out6.cwd = host.cwd), out6.additionalDirectories === void 0 && (host.additionalDirectories?.length ?? 0) > 0 && (out6.additionalDirectories = [...host.additionalDirectories ?? []]), out6.forwardSubagentEvents === void 0 && (out6.forwardSubagentEvents = !0), out6.retainSubagentSessions === void 0 && (out6.retainSubagentSessions = !0), out6.agents === void 0 && host.agents !== void 0 && (out6.agents = host.agents), typeof out6.scenario == "string" && host.mockScenarioKeys?.has(out6.scenario) && delete out6.scenario, host.selfKnowledge !== void 0)
+  if (out6.cwd == null && host.cwd !== void 0 && (out6.cwd = host.cwd), out6.additionalDirectories === void 0 && (host.additionalDirectories?.length ?? 0) > 0 && (out6.additionalDirectories = [...host.additionalDirectories ?? []]), out6.additionalReadDirectories === void 0 && (host.additionalReadDirectories?.length ?? 0) > 0 && (out6.additionalReadDirectories = [...host.additionalReadDirectories ?? []]), out6.forwardSubagentEvents === void 0 && (out6.forwardSubagentEvents = !0), out6.retainSubagentSessions === void 0 && (out6.retainSubagentSessions = !0), out6.agents === void 0 && host.agents !== void 0 && (out6.agents = host.agents), typeof out6.scenario == "string" && host.mockScenarioKeys?.has(out6.scenario) && delete out6.scenario, host.selfKnowledge !== void 0)
     if (host.appendSystemPromptCapable)
       out6.appendSystemPrompt = host.selfKnowledge.forAppend;
     else {
@@ -60387,6 +60417,7 @@ var REQUEST_FIELD_MATRIX, LIVE_DEFAULT_FIELDS, laneHas, init_taskRequest = __esm
     ], LIVE_DEFAULT_FIELDS = [
       "cwd",
       "additionalDirectories",
+      "additionalReadDirectories",
       "forwardSubagentEvents",
       "retainSubagentSessions",
       "agents",
@@ -61009,17 +61040,21 @@ function engineWireTarget() {
 }
 function engineWireTargetFor(sessionKey) {
   let installed3 = installedByKey.get(sessionKey) ?? null;
-  if (installed3 !== null)
-    return installed3;
+  if (installed3 !== null) {
+    if (normalizeWirePrincipal(installed3.principal) === installed3.principal)
+      return installed3;
+    let { principal: _dropped, ...rest } = installed3;
+    return rest;
+  }
   let env5 = hostEnv(), baseUrl = env5.SEMA_LIVE_BASEURL;
-  return baseUrl ? {
+  if (!baseUrl)
+    return null;
+  let envPrincipal = normalizeWirePrincipal(env5.SEMA_LIVE_PRINCIPAL);
+  return {
     baseUrl,
-    // principal must match the run's owner (stamped by the live stream) — the owner-gated routes answer
-    // 404 for non-owners (no existence oracle). F-011 停发([3279]):缺席=不发头,owner-null 两侧
-    // 对齐(server 7.8.1 读写面窄互认盖存量);显式 SEMA_LIVE_PRINCIPAL 恒赢,绝不铸哨兵值。
     ...env5.SEMA_LIVE_TOKEN ? { token: env5.SEMA_LIVE_TOKEN } : {},
-    ...env5.SEMA_LIVE_PRINCIPAL ? { principal: env5.SEMA_LIVE_PRINCIPAL } : {}
-  } : null;
+    ...envPrincipal !== void 0 ? { principal: envPrincipal } : {}
+  };
 }
 function engineWireDebugEnabled() {
   return !!hostEnv().SEMA_DEBUG;
@@ -61028,6 +61063,7 @@ var installedByKey, init_engineWireTarget = __esm({
   "node_modules/@sema-agent/client-core/dist/engineWireTarget.js"() {
     init_hostEnv();
     init_sessionSlot();
+    init_principalWire();
     installedByKey = createSessionSlot();
   }
 });
@@ -61861,6 +61897,92 @@ var capByBase2, CAP_FALSE_RETRY_TTL_MS2, activeTails, activitySink, init_engineS
   }
 });
 
+// node_modules/@sema-agent/client-core/dist/wireErrorTriage.js
+function wireErrorDetail(err8) {
+  let e = err8, cause = e?.cause;
+  return typeof cause?.message == "string" && cause.message.length > 0 && cause.message || typeof e?.message == "string" && e.message.length > 0 && e.message || String(err8);
+}
+function classifyTurnWireError(err8) {
+  let e = err8;
+  if (typeof e?.status == "number") {
+    let errorCode = typeof e.errorCode == "string" && e.errorCode.length > 0 ? e.errorCode : void 0, message = typeof e.message == "string" && e.message.length > 0 ? e.message : String(err8);
+    return { kind: "http", status: e.status, ...errorCode !== void 0 ? { errorCode } : {}, message };
+  }
+  if ((typeof err8 == "object" && err8 !== null && typeof err8.name == "string" ? err8.name : void 0) === "StreamEndedWithoutTerminalError")
+    return { kind: "stream-ended-without-terminal" };
+  let detail = wireErrorDetail(err8);
+  return e?.cause !== void 0 || WIRE_NETWORK_ERROR_PATTERN.test(detail) ? { kind: "transport", detail } : { kind: "internal", name: err8 instanceof Error ? err8.name : typeof err8, detail };
+}
+function isWireTransportError(err8) {
+  let e = err8;
+  return typeof e?.status == "number" ? !1 : e?.cause !== void 0 || WIRE_NETWORK_ERROR_PATTERN.test(wireErrorDetail(err8));
+}
+function isPreStreamDrainingReject(err8) {
+  let e = err8;
+  return typeof e?.status == "number" && e.status === 503 && e.errorCode === DRAINING_ERROR_CODE;
+}
+function isResumeAtRejection(err8) {
+  let e = err8;
+  return typeof e?.errorCode == "string" && e.errorCode.startsWith(RESUME_AT_ERROR_CODE_PREFIX);
+}
+function drainingRetryDelayMs(err8, attempt, opts) {
+  let ra = err8?.retryAfterMs;
+  if (typeof ra == "number" && Number.isFinite(ra) && ra >= 0)
+    return Math.min(ra, opts?.retryAfterCapMs ?? 15e3);
+  let ladder = opts?.ladder && opts.ladder.length > 0 ? opts.ladder : [1e3, 2e3, 4e3];
+  return ladder[Math.min(attempt, ladder.length - 1)] ?? 1e3;
+}
+function scenarioDenyFromError(err8) {
+  if (typeof err8 != "object" || err8 === null)
+    return null;
+  let e = err8;
+  return e.status !== 400 || e.errorCode !== SCENARIO_NOT_ALLOWED_ERROR_CODE ? null : { allowlist: Array.isArray(e.allowlist) ? e.allowlist.filter((x3) => typeof x3 == "string" && x3.length > 0) : [] };
+}
+var WIRE_NETWORK_ERROR_PATTERN, init_wireErrorTriage = __esm({
+  "node_modules/@sema-agent/client-core/dist/wireErrorTriage.js"() {
+    init_engineErrorCodes();
+    WIRE_NETWORK_ERROR_PATTERN = /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|EHOSTUNREACH|ENETUNREACH|EPIPE|socket hang up|UND_ERR|terminated|other side closed/i;
+  }
+});
+
+// node_modules/@sema-agent/client-core/dist/sessionMap.js
+function engineNamespaceKeyFor(baseUrl) {
+  if (!baseUrl)
+    return "local";
+  try {
+    return new URL(baseUrl).origin.toLowerCase();
+  } catch {
+    return baseUrl.toLowerCase();
+  }
+}
+function mergeSessionMapRecord(prior, partial2, now2 = isoNow) {
+  let shellSessionId = partial2.shellSessionId ?? prior?.shellSessionId;
+  return shellSessionId ? { ok: !0, record: { ...prior, ...partial2, shellSessionId, updatedAt: now2() } } : { ok: !1, reason: "no-shell-session-id" };
+}
+function mergeEngineEntry(prior, key, partial2, shellSessionId, now2 = isoNow) {
+  let priorEntry = prior?.engines?.[key], engineSessionId = partial2.engineSessionId ?? priorEntry?.engineSessionId;
+  if (!engineSessionId)
+    return { ok: !1, reason: "no-engine-session-id" };
+  let sid = shellSessionId ?? prior?.shellSessionId;
+  if (!sid)
+    return { ok: !1, reason: "no-shell-session-id" };
+  let entry = { ...priorEntry, ...partial2, engineSessionId, updatedAt: now2() };
+  return {
+    ok: !0,
+    record: {
+      ...prior,
+      shellSessionId: sid,
+      engines: { ...prior?.engines, [key]: entry },
+      updatedAt: now2()
+    }
+  };
+}
+var isoNow, init_sessionMap = __esm({
+  "node_modules/@sema-agent/client-core/dist/sessionMap.js"() {
+    isoNow = () => (/* @__PURE__ */ new Date()).toISOString();
+  }
+});
+
 // node_modules/@sema-agent/client-core/dist/detachWire.js
 function headlessDetachDisabledByEnv(env5 = hostEnv()) {
   return envFlagOff(env5[HEADLESS_DETACH_ENV]);
@@ -64892,11 +65014,30 @@ function setFor(sessionKey) {
   let s = armedGatesByKey.get(sessionKey);
   return s || (s = /* @__PURE__ */ new Set(), armedGatesByKey.set(sessionKey, s)), s;
 }
+function listenersFor(sessionKey) {
+  let s = armedListenersByKey.get(sessionKey);
+  return s || (s = /* @__PURE__ */ new Set(), armedListenersByKey.set(sessionKey, s)), s;
+}
+function genMapFor(sessionKey) {
+  let m2 = planReviewGenByKey.get(sessionKey);
+  return m2 || (m2 = /* @__PURE__ */ new Map(), planReviewGenByKey.set(sessionKey, m2)), m2;
+}
+function notedIdsFor(sessionKey) {
+  let s = notedPlanReviewIdsByKey.get(sessionKey);
+  return s || (s = /* @__PURE__ */ new Set(), notedPlanReviewIdsByKey.set(sessionKey, s)), s;
+}
+function emitGateArmedEventFor(sessionKey, key) {
+  for (let listener5 of [...listenersFor(sessionKey)])
+    try {
+      listener5(key);
+    } catch {
+    }
+}
 function registerArmedGate(key) {
   registerArmedGateFor(DEFAULT_SESSION_KEY, key);
 }
 function registerArmedGateFor(sessionKey, key) {
-  typeof key == "string" && key.length > 0 && setFor(sessionKey).add(key);
+  typeof key != "string" || key.length === 0 || (setFor(sessionKey).add(key), emitGateArmedEventFor(sessionKey, key));
 }
 function wasGateArmed(key) {
   return wasGateArmedFor(DEFAULT_SESSION_KEY, key);
@@ -64910,20 +65051,86 @@ function clearArmedGate(key) {
 function clearArmedGateFor(sessionKey, key) {
   typeof key == "string" && key.length > 0 && armedGatesByKey.get(sessionKey)?.delete(key);
 }
+function onGateArmed(listener5) {
+  return onGateArmedFor(DEFAULT_SESSION_KEY, listener5);
+}
+function onGateArmedFor(sessionKey, listener5) {
+  let listeners10 = listenersFor(sessionKey);
+  return listeners10.add(listener5), () => {
+    listeners10.delete(listener5);
+  };
+}
+function _setGateArmedWaitMsForTest(ms) {
+  gateArmedWaitOverrideMs = ms;
+}
+function gateArmedWaitMs() {
+  return gateArmedWaitOverrideMs ?? GATE_ARMED_WAIT_MS;
+}
+function waitForGateArmed(keys2, timeoutMs) {
+  return waitForGateArmedFor(DEFAULT_SESSION_KEY, keys2, timeoutMs);
+}
+function waitForGateArmedFor(sessionKey, keys2, timeoutMs) {
+  let wanted = new Set(keys2.filter((k2) => typeof k2 == "string" && k2.length > 0));
+  if (wanted.size === 0)
+    return Promise.resolve(!1);
+  let listeners10 = listenersFor(sessionKey);
+  return new Promise((resolve57) => {
+    let listener5 = (key) => {
+      wanted.has(key) && (listeners10.delete(listener5), clearTimeout(timer2), resolve57(!0));
+    };
+    listeners10.add(listener5);
+    let timer2 = setTimeout(() => {
+      listeners10.delete(listener5), resolve57(!1);
+    }, timeoutMs);
+  });
+}
+function armedKeyForQuestionIdFor(sessionKey, questionId) {
+  let base = armedKeyFromQuestionId(questionId);
+  return base.startsWith(PLAN_REVIEW_QUESTION_ID_PREFIX) ? planReviewArmedKeyFor(sessionKey, base.slice(PLAN_REVIEW_QUESTION_ID_PREFIX.length)) : base;
+}
 function registerArmedGateFromQuestionId(questionId) {
   registerArmedGateFromQuestionIdFor(DEFAULT_SESSION_KEY, questionId);
 }
 function registerArmedGateFromQuestionIdFor(sessionKey, questionId) {
-  typeof questionId != "string" || questionId.length === 0 || registerArmedGateFor(sessionKey, armedKeyFromQuestionId(questionId));
+  if (typeof questionId != "string" || questionId.length === 0)
+    return;
+  questionId.startsWith(PLAN_REVIEW_QUESTION_ID_PREFIX) && !questionId.includes(REOPEN_ID_TAIL) && notedPlanReviewIdsByKey.get(sessionKey)?.delete(questionId);
+  let normalized = armedKeyForQuestionIdFor(sessionKey, questionId);
+  registerArmedGateFor(sessionKey, normalized), questionId !== normalized && emitGateArmedEventFor(sessionKey, questionId);
+}
+function planReviewArmedKey(taskId) {
+  return planReviewArmedKeyFor(DEFAULT_SESSION_KEY, taskId);
+}
+function planReviewArmedKeyFor(sessionKey, taskId) {
+  let gen = planReviewGenByKey.get(sessionKey)?.get(taskId) ?? 0, canonical2 = planReviewQuestionId(taskId);
+  return gen > 0 ? `${canonical2}#g${String(gen)}` : canonical2;
+}
+function notePlanReviewAnswered(questionId) {
+  notePlanReviewAnsweredFor(DEFAULT_SESSION_KEY, questionId);
+}
+function notePlanReviewAnsweredFor(sessionKey, questionId) {
+  if (typeof questionId != "string" || !questionId.startsWith(PLAN_REVIEW_QUESTION_ID_PREFIX))
+    return;
+  let noted = notedIdsFor(sessionKey);
+  if (noted.has(questionId))
+    return;
+  noted.add(questionId);
+  let base = questionId.slice(PLAN_REVIEW_QUESTION_ID_PREFIX.length), cut = base.indexOf(REOPEN_ID_TAIL), taskId = cut >= 0 ? base.slice(0, cut) : base;
+  if (taskId.length === 0)
+    return;
+  clearArmedGateFor(sessionKey, planReviewArmedKeyFor(sessionKey, taskId));
+  let gens = genMapFor(sessionKey);
+  gens.set(taskId, (gens.get(taskId) ?? 0) + 1);
 }
 function _resetArmedGateRegistryForTest() {
-  armedGatesByKey.clear();
+  armedGatesByKey.clear(), armedListenersByKey.clear(), planReviewGenByKey.clear(), notedPlanReviewIdsByKey.clear();
 }
-var armedGatesByKey, init_armedGateRegistry = __esm({
+var armedGatesByKey, armedListenersByKey, planReviewGenByKey, notedPlanReviewIdsByKey, GATE_ARMED_WAIT_MS, gateArmedWaitOverrideMs, init_armedGateRegistry = __esm({
   "node_modules/@sema-agent/client-core/dist/hitl/armedGateRegistry.js"() {
     init_sessionSlot();
     init_gateIdentity();
-    armedGatesByKey = createSessionSlot();
+    armedGatesByKey = createSessionSlot(), armedListenersByKey = createSessionSlot(), planReviewGenByKey = createSessionSlot(), notedPlanReviewIdsByKey = createSessionSlot();
+    GATE_ARMED_WAIT_MS = 5e3, gateArmedWaitOverrideMs = null;
   }
 });
 
@@ -64932,6 +65139,12 @@ function planReviewDecisionFromAnswer(answer) {
   let selected = answer?.answers?.[0]?.selected?.[0];
   return selected === APPROVE_LABEL ? "approve" : selected === REJECT_LABEL ? "reject" : "dismissed";
 }
+function notePlanReviewAnsweredIfDecisive(questionId, answer) {
+  notePlanReviewAnsweredIfDecisiveFor(DEFAULT_SESSION_KEY, questionId, answer);
+}
+function notePlanReviewAnsweredIfDecisiveFor(sessionKey, questionId, answer) {
+  planReviewDecisionFromAnswer(answer ?? { answers: [] }) !== "dismissed" && notePlanReviewAnsweredFor(sessionKey, questionId);
+}
 function isPlanReviewPark(result) {
   let r = result;
   return !!r && r.status === "needs_review" && r.checkpointGate?.kind === "plan_review" && typeof r.taskId == "string" && r.taskId.length > 0;
@@ -64974,7 +65187,7 @@ function armPlanReviewApproval(result) {
     let questionId = planReviewQuestionId(taskId), unregister = registerLocalQuestionResponder(questionId, async (_id, answer) => {
       unregister(), armedPlanReviewTaskIds.delete(taskId);
       let decided = planReviewDecisionFromAnswer(answer);
-      return decided === "dismissed" ? { ok: !0 } : (clearArmedGate(planReviewQuestionId(taskId)), decidePlanReview(taskId, decided), { ok: !0 });
+      return decided === "dismissed" ? { ok: !0 } : (notePlanReviewAnswered(questionId), decidePlanReview(taskId, decided), { ok: !0 });
     });
     return publishPlanReviewCard(taskId), hostLog("debug", `planReviewWire: approval card armed for parked plan (task ${taskId})`), !0;
   } catch (e) {
@@ -65049,19 +65262,29 @@ function _resetActiveReopenRespondersForTest() {
   activeReopenResponders.clear();
 }
 function reopenPlanReviewCard(taskId, opts) {
+  let receiptMs = opts?.presentationReceiptMs, settleOnReceipt = (receipt, firstSight) => receipt.then((presented) => presented ? { reopened: !0, firstSight } : { reopened: !1 }, () => ({ reopened: !1 }));
   try {
     if (typeof taskId != "string" || taskId.length === 0)
-      return { reopened: !1 };
+      return receiptMs === void 0 ? { reopened: !1 } : Promise.resolve({ reopened: !1 });
     let sessionKey = opts?.sessionKey ?? DEFAULT_SESSION_KEY;
     if (!hasQuestionOverlayFor(sessionKey))
-      return { reopened: !1 };
-    let canonicalId = planReviewQuestionId(taskId), firstSight = !wasGateArmedFor(sessionKey, canonicalId);
-    if (!(opts?.mintFreshQuestionId !== !1) && hasLocalQuestionResponder(canonicalId))
-      return opts?.deliverDecision !== void 0 && hostLog("debug", `planReviewWire: reopen canonical-reuse branch for task ${taskId} ignores opts.deliverDecision (answers route through the existing arm responder \u2014 documented exception)`), retireActiveReopen(sessionKey, canonicalId), publishQuestionFrameFor(sessionKey, {
+      return receiptMs === void 0 ? { reopened: !1 } : Promise.resolve({ reopened: !1 });
+    let canonicalId = planReviewQuestionId(taskId), armedKey = planReviewArmedKeyFor(sessionKey, taskId), firstSight = !wasGateArmedFor(sessionKey, armedKey);
+    if (!(opts?.mintFreshQuestionId !== !1) && hasLocalQuestionResponder(canonicalId)) {
+      if (opts?.deliverDecision !== void 0 && hostLog("debug", `planReviewWire: reopen canonical-reuse branch for task ${taskId} ignores opts.deliverDecision (answers route through the existing arm responder \u2014 documented exception)`), retireActiveReopen(sessionKey, canonicalId), receiptMs !== void 0) {
+        let receipt = waitForGateArmedFor(sessionKey, [canonicalId], receiptMs);
+        return publishQuestionFrameFor(sessionKey, {
+          type: "question",
+          questionId: canonicalId,
+          questions: planReviewQuestions(ARM_QUESTION)
+        }), settleOnReceipt(receipt, firstSight);
+      }
+      return publishQuestionFrameFor(sessionKey, {
         type: "question",
         questionId: canonicalId,
         questions: planReviewQuestions(ARM_QUESTION)
-      }), registerArmedGateFor(sessionKey, canonicalId), { reopened: !0, firstSight };
+      }), registerArmedGateFor(sessionKey, armedKey), { reopened: !0, firstSight };
+    }
     retireActiveReopen(sessionKey, canonicalId), unregisterLocalQuestionResponder(canonicalId) && hostLog("debug", `planReviewWire: reopen retired the canonical responder for task ${taskId} (single-active discipline)`), publishQuestionFrameFor(sessionKey, { type: "question_complete", questionId: canonicalId });
     let questionId = `${canonicalId}${REOPEN_ID_TAIL}${reopenIdSuffix()}`, deliver = opts?.deliverDecision ?? ((tid, decision) => {
       decidePlanReview(tid, decision);
@@ -65070,7 +65293,7 @@ function reopenPlanReviewCard(taskId, opts) {
       let decided = planReviewDecisionFromAnswer(answer);
       if (decided === "dismissed")
         return { ok: !0 };
-      clearArmedGateFor(sessionKey, canonicalId);
+      notePlanReviewAnsweredFor(sessionKey, questionId);
       try {
         await deliver(taskId, decided);
       } catch (e) {
@@ -65078,13 +65301,21 @@ function reopenPlanReviewCard(taskId, opts) {
       }
       return { ok: !0 };
     });
-    return activeReopenResponders.set(activeKey, { questionId, unregister }), registerArmedGateFor(sessionKey, canonicalId), publishQuestionFrameFor(sessionKey, {
+    if (activeReopenResponders.set(activeKey, { questionId, unregister }), receiptMs !== void 0) {
+      let receipt = waitForGateArmedFor(sessionKey, [questionId], receiptMs);
+      return publishQuestionFrameFor(sessionKey, {
+        type: "question",
+        questionId,
+        questions: planReviewQuestions(REOPEN_QUESTION)
+      }), settleOnReceipt(receipt, firstSight);
+    }
+    return registerArmedGateFor(sessionKey, armedKey), publishQuestionFrameFor(sessionKey, {
       type: "question",
       questionId,
       questions: planReviewQuestions(REOPEN_QUESTION)
     }), { reopened: !0, firstSight };
   } catch {
-    return { reopened: !1 };
+    return receiptMs === void 0 ? { reopened: !1 } : Promise.resolve({ reopened: !1 });
   }
 }
 var PLAN_REVIEW_RESUME_TIMEOUT_MS, PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT_LABEL, APPROVE_LABEL, REJECT_LABEL, armedPlanReviewTaskIds, ARM_QUESTION, REOPEN_QUESTION, activeReopenResponders, init_planReviewWire = __esm({
@@ -65106,9 +65337,12 @@ var PLAN_REVIEW_RESUME_TIMEOUT_MS, PLAN_REVIEW_APPROVE_LABEL, PLAN_REVIEW_REJECT
 
 // node_modules/@sema-agent/client-core/dist/hitl/parkOwnership.js
 function pendingRowIsOwnedByThisSession(row2, deps2) {
-  let sessionKey = deps2?.sessionKey ?? DEFAULT_SESSION_KEY, rowTaskId = typeof row2.taskId == "string" ? row2.taskId : "", ownRun = deps2?.isOwnRun ?? (sessionKey === DEFAULT_SESSION_KEY ? isOwnEngineRun : void 0);
-  if (ownRun !== void 0 && rowTaskId.length > 0 && ownRun(rowIdTail(rowTaskId)))
-    return !0;
+  let sessionKey = deps2?.sessionKey ?? DEFAULT_SESSION_KEY, rowTaskId = typeof row2.taskId == "string" ? row2.taskId : "";
+  if (rowTaskId.length > 0) {
+    let tail = rowIdTail(rowTaskId);
+    if (deps2?.isOwnRun !== void 0 && deps2.isOwnRun(tail) || sessionKey === DEFAULT_SESSION_KEY && isOwnEngineRun(tail))
+      return !0;
+  }
   let sessionId = (deps2?.currentSessionId ?? (() => hostSessionFor(sessionKey)?.currentSessionId()))(), rowSessionId = typeof row2.sessionId == "string" ? row2.sessionId : "";
   return typeof sessionId == "string" && sessionId.length > 0 && rowSessionId.length > 0 && rowSessionId === sessionId;
 }
@@ -65136,7 +65370,7 @@ function parkRowPollDelay(ms, signal) {
   return abortableSleep(ms, signal ?? new AbortController().signal);
 }
 async function waitForParkRowBirth(deps2) {
-  let now2 = typeof deps2.now == "function" ? deps2.now : () => Date.now(), sleep10 = typeof deps2.sleep == "function" ? deps2.sleep : parkRowPollDelay, budgetMs = Number.isFinite(deps2.budgetMs) && deps2.budgetMs > 0 ? deps2.budgetMs : 0, intervalMs = Number.isFinite(deps2.intervalMs) && deps2.intervalMs > 0 ? deps2.intervalMs : 1, startedAt = now2(), probes = 0, lastReason = "no decidable pending row for this park", aborted2 = () => deps2.signal?.aborted === !0, safeProbe = async (attempt, signal) => {
+  let now2 = typeof deps2.now == "function" ? deps2.now : () => Date.now(), sleep9 = typeof deps2.sleep == "function" ? deps2.sleep : parkRowPollDelay, budgetMs = Number.isFinite(deps2.budgetMs) && deps2.budgetMs > 0 ? deps2.budgetMs : 0, intervalMs = Number.isFinite(deps2.intervalMs) && deps2.intervalMs > 0 ? deps2.intervalMs : 1, startedAt = now2(), probes = 0, lastReason = "no decidable pending row for this park", aborted2 = () => deps2.signal?.aborted === !0, safeProbe = async (attempt, signal) => {
     try {
       return await deps2.probe(attempt, signal);
     } catch (e) {
@@ -65203,7 +65437,7 @@ async function waitForParkRowBirth(deps2) {
     let remainingMs = budgetMs - (now2() - startedAt);
     if (remainingMs <= 0)
       return { kind: "unborn", reason: lastReason, waitedMs: now2() - startedAt, probes };
-    if (await sleep10(Math.min(intervalMs, remainingMs), deps2.signal), aborted2())
+    if (await sleep9(Math.min(intervalMs, remainingMs), deps2.signal), aborted2())
       return { kind: "aborted", waitedMs: now2() - startedAt, probes };
   }
 }
@@ -65385,6 +65619,175 @@ var RESUME_CHOICE_ATTACH_LABEL, RESUME_CHOICE_CANCEL_LABEL, RESUME_CHOICE_BACKGR
   }
 });
 
+// node_modules/@sema-agent/client-core/dist/hitl/persistedRulesWire.js
+function persistedRulesLaneAvailable(baseUrl) {
+  return engineCapTrue(baseUrl, "permissionRules");
+}
+function persistedRulesGovernanceAvailable(baseUrl) {
+  return engineCapTrue(baseUrl, "permissionRulesRevoke") && engineCapTrue(baseUrl, "permissionRules");
+}
+function errShape(e) {
+  let o = e ?? {};
+  return {
+    ...typeof o.status == "number" ? { status: o.status } : {},
+    ...typeof o.errorCode == "string" ? { errorCode: o.errorCode } : {},
+    message: typeof o.message == "string" && o.message !== "" ? o.message : String(e)
+  };
+}
+function retryAfterSecOf(e) {
+  let ms = e.retryAfterMs;
+  if (!(typeof ms != "number" || !Number.isFinite(ms) || ms < 0))
+    return Math.ceil(ms / 1e3);
+}
+function classifyRulesFailure(e) {
+  let { status: status3, errorCode, message } = errShape(e);
+  if (status3 === 501 || errorCode === "capability.rule_store_required")
+    return { kind: "lane-unavailable", message };
+  if (status3 === 404)
+    return errorCode === "not_found.route" ? { kind: "route-missing", message } : errorCode === "not_found.rule_ticket" ? { kind: "ticket-dead", message } : { kind: "error", message };
+  if (errorCode === "state.rule_import_retry") {
+    let sec = retryAfterSecOf(e);
+    return { kind: "retry-same-ticket", message, ...sec !== void 0 ? { retryAfterSec: sec } : {} };
+  }
+  return errorCode === "state.rule_remove_failed" ? { kind: "retryable", message } : status3 === 400 && errorCode === "request.query_invalid" ? { kind: "cursor-stale", message } : status3 === 413 ? { kind: "too-many-candidates", message } : status3 === 403 && errorCode === "auth.operator_only" ? { kind: "forbidden", message } : { kind: "error", message };
+}
+async function listAllPersistedRules(facade, params = {}, opts) {
+  let { cursor: callerCursor, ...cleanParams3 } = params;
+  callerCursor !== void 0 && hostLog("debug", "persistedRulesWire: caller-supplied cursor ignored by listAllPersistedRules \u2014 a drain that starts mid-keyset cannot prove completeness, so it always starts from the top");
+  for (let attempt = 0; attempt < 2; attempt++) {
+    let rules = [], cursor, rev2 = null, restart = !1;
+    for (let page = 0; page < MAX_PAGES; page++) {
+      let res;
+      try {
+        res = await facade.list({ limit: PAGE_LIMIT, ...cleanParams3, ...cursor !== void 0 ? { cursor } : {} }, opts);
+      } catch (e) {
+        let failure = classifyRulesFailure(e);
+        if (failure.kind === "cursor-stale" && cursor !== void 0 && attempt === 0) {
+          hostLog("debug", "persistedRulesWire: rule list cursor was minted on another rev/principal/scope \u2014 dropping it and re-listing from the top (never resuming a stale keyset)"), restart = !0;
+          break;
+        }
+        return { ok: !1, failure };
+      }
+      if (typeof res != "object" || res === null || !Array.isArray(res.rules) || typeof res.rev != "number" || !Number.isFinite(res.rev))
+        return {
+          ok: !1,
+          failure: {
+            kind: "error",
+            message: "rule list page was malformed (missing/ill-typed rules array or rev on a 2xx) \u2014 refusing to certify it as a complete governance list"
+          }
+        };
+      if (rev2 !== null && res.rev !== rev2)
+        return {
+          ok: !1,
+          failure: {
+            kind: "error",
+            message: `rule list rev changed mid-drain (page rev ${res.rev} \u2260 first page rev ${rev2}) on a 2xx \u2014 refusing to stitch a mixed snapshot into one governance list`
+          }
+        };
+      for (let r of res.rules) {
+        let rr = r;
+        if (rr === null || typeof rr != "object" || typeof rr.rule != "string" || rr.rule === "" || typeof rr.scope != "string" || rr.scope === "")
+          return {
+            ok: !1,
+            failure: {
+              kind: "error",
+              message: "rule list page carried a malformed rule row (missing/ill-typed rule or scope) \u2014 refusing to present a list that hides or garbles live rules"
+            }
+          };
+      }
+      rev2 = res.rev, rules.push(...res.rules);
+      let next = res.nextCursor;
+      if (next === void 0)
+        return { ok: !0, rules, rev: rev2 };
+      if (typeof next != "string" || next === "")
+        return {
+          ok: !1,
+          failure: {
+            kind: "error",
+            message: "rule list page carried a malformed nextCursor (neither absent nor a non-empty string) \u2014 refusing to guess where the list ends"
+          }
+        };
+      cursor = next;
+    }
+    if (!restart)
+      return {
+        ok: !1,
+        failure: {
+          kind: "error",
+          message: `rule list did not terminate within ${MAX_PAGES} pages \u2014 refusing to present a partial governance list`
+        }
+      };
+  }
+  return { ok: !1, failure: { kind: "cursor-stale", message: "rule list kept changing under the cursor \u2014 try again" } };
+}
+function classifySkippedReason(reason) {
+  let text2 = typeof reason == "string" ? reason : String(reason), idx = text2.indexOf(":");
+  if (idx <= 0)
+    return { text: text2 };
+  let head = text2.slice(0, idx);
+  return /^[a-z][a-z0-9_]*(\.[a-z0-9_]+)*$/.test(head) ? { code: head, text: text2 } : { text: text2 };
+}
+function readRulePersistOutcome(ack) {
+  let parsed = readToolApprovalRespondAck(ack);
+  return parsed === void 0 ? { state: "unknown" } : parsed.rulePersisted === !0 ? { state: "persisted" } : parsed.rulePersisted === !1 ? {
+    state: "refused",
+    ...typeof parsed.ruleRefusal == "string" ? { reason: parsed.ruleRefusal } : {}
+  } : { state: "unknown" };
+}
+var PAGE_LIMIT, MAX_PAGES, init_persistedRulesWire = __esm({
+  "node_modules/@sema-agent/client-core/dist/hitl/persistedRulesWire.js"() {
+    init_engineCapsCache();
+    init_host();
+    init_toolApprovalWire();
+    PAGE_LIMIT = 200, MAX_PAGES = 25;
+  }
+});
+
+// node_modules/@sema-agent/client-core/dist/hitl/localAllowRule.js
+function parseLocalAllowRule(rule, expectedToolName, deps2) {
+  if (typeof rule != "string" || rule === "")
+    return { ok: !1, error: "rule text is empty" };
+  let value;
+  try {
+    value = deps2.parseRule(rule);
+  } catch (e) {
+    return { ok: !1, error: `rule text did not parse (${String(e)})` };
+  }
+  return typeof value.toolName != "string" || value.toolName === "" ? { ok: !1, error: "rule text carries no tool name" } : value.ruleContent === void 0 || value.ruleContent === "" ? {
+    ok: !1,
+    error: "candidate is a whole-tool allow rule (broader than this ask) \u2014 not offered locally"
+  } : expectedToolName !== void 0 && value.toolName !== expectedToolName ? {
+    ok: !1,
+    error: `candidate names tool "${value.toolName}" but this ask is for "${expectedToolName}" \u2014 a rule for another tool would never match`
+  } : hasLiteralAnchor(value.ruleContent) ? value.toolName === BASH_TOOL_NAME_FOR_RULES && deps2.bashRuleContentHasDangerousBarePrefix(value.ruleContent) ? {
+    ok: !1,
+    error: "candidate is a bare interpreter/wrapper prefix (bash/sh/env/sudo/\u2026) \u2014 persisting it would authorize arbitrary commands, not offered locally"
+  } : deps2.isDangerousBashPermission(value.toolName, value.ruleContent) || deps2.isDangerousPowerShellPermission(value.toolName, value.ruleContent) ? {
+    ok: !1,
+    error: "candidate allow-rule matches a code-execution interpreter/wrapper pattern (python/node/eval/ssh/\u2026) \u2014 persisting it would authorize arbitrary code, not offered locally"
+  } : { ok: !0, value, canonical: deps2.formatRule(value) } : {
+    ok: !1,
+    error: "candidate is all wildcard (matches every command for this tool) \u2014 equivalent to a whole-tool allow, not offered locally"
+  };
+}
+function hasLiteralAnchor(ruleContent) {
+  let out6 = "";
+  for (let i = 0; i < ruleContent.length; i++) {
+    let ch2 = ruleContent[i];
+    if (ch2 === "\\" && i + 1 < ruleContent.length) {
+      out6 += ruleContent[i + 1], i++;
+      continue;
+    }
+    ch2 !== "*" && (out6 += ch2);
+  }
+  return out6.trim() !== "";
+}
+var BASH_TOOL_NAME_FOR_RULES, init_localAllowRule = __esm({
+  "node_modules/@sema-agent/client-core/dist/hitl/localAllowRule.js"() {
+    BASH_TOOL_NAME_FOR_RULES = "Bash";
+  }
+});
+
 // node_modules/@sema-agent/client-core/dist/hitl/approvalsFeed.js
 function digestOf(rows2) {
   return rows2.map((r) => [r.sessionId ?? "", r.taskId ?? "", r.toolCallId ?? "", r.boundCallId ?? "", r.boundInputHash ?? "", r.toolName ?? ""].join("
")).sort().join("");
@@ -67067,6 +67470,7 @@ __export(dist_exports, {
   DEVICE_CODE_MAX_LIFETIME_MS: () => DEVICE_CODE_MAX_LIFETIME_MS,
   DEVICE_CODE_MIN_INTERVAL_MS: () => DEVICE_CODE_MIN_INTERVAL_MS,
   DIFF_TIMEOUT_MS: () => DIFF_TIMEOUT_MS,
+  DRAINING_ERROR_CODE: () => DRAINING_ERROR_CODE,
   EDIT_NOT_FORWARDED_WARN_TEXT: () => EDIT_NOT_FORWARDED_WARN_TEXT,
   ENABLE_FORK_ENV: () => ENABLE_FORK_ENV,
   ENGINE_ABORT_TOOL_RESULT: () => ENGINE_ABORT_TOOL_RESULT,
@@ -67104,6 +67508,7 @@ __export(dist_exports, {
   HitlBridge: () => HitlBridge,
   HitlSafetyError: () => HitlSafetyError,
   IDLE_FLUSH_MS: () => IDLE_FLUSH_MS,
+  INTERACTIVE_WAY_OUT: () => INTERACTIVE_WAY_OUT,
   INTERNAL_SDK_ARM_TYPES: () => INTERNAL_SDK_ARM_TYPES,
   LIMITS_MAX_COST_EXCEEDED: () => LIMITS_MAX_COST_EXCEEDED,
   LIMITS_MAX_TOKENS_EXCEEDED: () => LIMITS_MAX_TOKENS_EXCEEDED,
@@ -67152,6 +67557,7 @@ __export(dist_exports, {
   REMEMBER_NOT_APPLIED_WARN_TEXT: () => REMEMBER_NOT_APPLIED_WARN_TEXT,
   REOPEN_ID_TAIL: () => REOPEN_ID_TAIL,
   REQUEST_FIELD_MATRIX: () => REQUEST_FIELD_MATRIX,
+  RESUME_AT_ERROR_CODE_PREFIX: () => RESUME_AT_ERROR_CODE_PREFIX,
   RESUME_CHOICE_ATTACH_LABEL: () => RESUME_CHOICE_ATTACH_LABEL,
   RESUME_CHOICE_BACKGROUND_LABEL: () => RESUME_CHOICE_BACKGROUND_LABEL,
   RESUME_CHOICE_CANCEL_LABEL: () => RESUME_CHOICE_CANCEL_LABEL,
@@ -67166,6 +67572,7 @@ __export(dist_exports, {
   SANDBOX_NO_IMAGE_INDEX_400_ANCHOR: () => SANDBOX_NO_IMAGE_INDEX_400_ANCHOR,
   SANDBOX_NO_PUBLISHED_IMAGE_404_ANCHOR: () => SANDBOX_NO_PUBLISHED_IMAGE_404_ANCHOR,
   SCENARIO_NAME_RE: () => SCENARIO_NAME_RE,
+  SCENARIO_NOT_ALLOWED_ERROR_CODE: () => SCENARIO_NOT_ALLOWED_ERROR_CODE,
   SDK_DEFAULT_GRACE_MS: () => SDK_DEFAULT_GRACE_MS,
   SEARCH_PROVIDER_PRESETS: () => SEARCH_PROVIDER_PRESETS,
   SEAT_CHROME_ENVELOPE_KEYS: () => SEAT_CHROME_ENVELOPE_KEYS,
@@ -67213,6 +67620,7 @@ __export(dist_exports, {
   WEB_SEARCH_ENV_KEYS: () => WEB_SEARCH_ENV_KEYS,
   WEB_SEARCH_MAX_RESULTS_MAX: () => WEB_SEARCH_MAX_RESULTS_MAX,
   WEB_SEARCH_MAX_RESULTS_MIN: () => WEB_SEARCH_MAX_RESULTS_MIN,
+  WIRE_NETWORK_ERROR_PATTERN: () => WIRE_NETWORK_ERROR_PATTERN,
   WORKFLOW_DEFER_ENV: () => WORKFLOW_DEFER_ENV,
   WORKFLOW_TOOL_NAMES: () => WORKFLOW_TOOL_NAMES,
   __activeTailCountForTests: () => __activeTailCountForTests,
@@ -67245,6 +67653,7 @@ __export(dist_exports, {
   _resetNotificationQueuePortForTest: () => _resetNotificationQueuePortForTest,
   _resetScratchpadEnsuredForTest: () => _resetScratchpadEnsuredForTest,
   _resetUltracodePreset: () => _resetUltracodePreset,
+  _setGateArmedWaitMsForTest: () => _setGateArmedWaitMsForTest,
   _setWatcherTimingForTest: () => _setWatcherTimingForTest,
   _tickWatchOnceForTest: () => _tickWatchOnceForTest,
   activeEngineRunId: () => activeEngineRunId,
@@ -67290,7 +67699,10 @@ __export(dist_exports, {
   classifyAskParkChainFailure: () => classifyAskParkChainFailure,
   classifyAskParkRows: () => classifyAskParkRows,
   classifyHookNoticeFrame: () => classifyHookNoticeFrame,
+  classifyRulesFailure: () => classifyRulesFailure,
+  classifySkippedReason: () => classifySkippedReason,
   classifyTaskStopConflict: () => classifyTaskStopConflict,
+  classifyTurnWireError: () => classifyTurnWireError,
   clearAllRetainedFleetRows: () => clearAllRetainedFleetRows,
   clearAllRetainedFleetRowsFor: () => clearAllRetainedFleetRowsFor,
   clearArmedGate: () => clearArmedGate,
@@ -67335,6 +67747,7 @@ __export(dist_exports, {
   deviceAuthProviderFor: () => deviceAuthProviderFor,
   diagnoseSseIdleTear: () => diagnoseSseIdleTear,
   doneToSdkResult: () => doneToSdkResult,
+  drainingRetryDelayMs: () => drainingRetryDelayMs,
   dropQueuedNotificationsForRun: () => dropQueuedNotificationsForRun,
   effortToReasoningEffort: () => effortToReasoningEffort,
   enableForkFromEnv: () => enableForkFromEnv,
@@ -67345,6 +67758,7 @@ __export(dist_exports, {
   engineCapsSettled: () => engineCapsSettled,
   engineCcStopSemantics: () => engineCcStopSemantics,
   engineLimitsSupportWarning: () => engineLimitsSupportWarning,
+  engineNamespaceKeyFor: () => engineNamespaceKeyFor,
   engineOwnedRowIds: () => engineOwnedRowIds,
   engineRowNeedsStopConfirm: () => engineRowNeedsStopConfirm,
   engineSessionParam: () => engineSessionParam,
@@ -67379,6 +67793,7 @@ __export(dist_exports, {
   fleetViewStubRowIds: () => fleetViewStubRowIds,
   fmtCtxOut: () => fmtCtxOut,
   fmtTokens: () => fmtTokens,
+  gateArmedWaitMs: () => gateArmedWaitMs,
   gateKind: () => gateKind,
   getBgParentRun: () => getBgParentRun,
   getBgTerminalFacts: () => getBgTerminalFacts,
@@ -67462,6 +67877,8 @@ __export(dist_exports, {
   isOwnEngineRun: () => isOwnEngineRun,
   isOwnWorkflowRun: () => isOwnWorkflowRun,
   isPlanReviewPark: () => isPlanReviewPark,
+  isPreStreamDrainingReject: () => isPreStreamDrainingReject,
+  isResumeAtRejection: () => isResumeAtRejection,
   isRewindFamilyCode: () => isRewindFamilyCode,
   isRunStreamActive: () => isRunStreamActive,
   isSeatModelCatalog: () => isSeatModelCatalog,
@@ -67472,10 +67889,12 @@ __export(dist_exports, {
   isToolApprovalFrame: () => isToolApprovalFrame,
   isToolApprovalGate: () => isToolApprovalGate,
   isToolPermissionRequest: () => isToolPermissionRequest,
+  isWireTransportError: () => isWireTransportError,
   isWorkflowAgentTaskId: () => isWorkflowAgentTaskId,
   isWorkflowCompletionCardEnqueued: () => isWorkflowCompletionCardEnqueued,
   kickEngineCapsProbe: () => kickEngineCapsProbe,
   limitsForPrint: () => limitsForPrint,
+  listAllPersistedRules: () => listAllPersistedRules,
   listNotifiedRuns: () => listNotifiedRuns,
   listOwnWorkflowRuns: () => listOwnWorkflowRuns,
   listWorkflowCompletionCardsEnqueued: () => listWorkflowCompletionCardsEnqueued,
@@ -67492,7 +67911,9 @@ __export(dist_exports, {
   markUserModelPickThisSession: () => markUserModelPickThisSession,
   mcpConfigToSpec: () => mcpConfigToSpec,
   mcpConfigsToSpecs: () => mcpConfigsToSpecs,
+  mergeEngineEntry: () => mergeEngineEntry,
   mergeProviderLayers: () => mergeProviderLayers,
+  mergeSessionMapRecord: () => mergeSessionMapRecord,
   mergeTaskOutput: () => mergeTaskOutput,
   modelFacingParseCalls: () => modelFacingParseCalls,
   modelFromAppState: () => modelFromAppState,
@@ -67500,11 +67921,18 @@ __export(dist_exports, {
   normalizeLiveModelRef: () => normalizeLiveModelRef,
   normalizeShellPermissionModeForWire: () => normalizeShellPermissionModeForWire,
   normalizeTaskNotification: () => normalizeTaskNotification,
+  normalizeWirePrincipal: () => normalizeWirePrincipal,
+  notePlanReviewAnswered: () => notePlanReviewAnswered,
+  notePlanReviewAnsweredFor: () => notePlanReviewAnsweredFor,
+  notePlanReviewAnsweredIfDecisive: () => notePlanReviewAnsweredIfDecisive,
+  notePlanReviewAnsweredIfDecisiveFor: () => notePlanReviewAnsweredIfDecisiveFor,
   noteWorkflowCompletionCardEnqueued: () => noteWorkflowCompletionCardEnqueued,
   notificationDropCounters: () => notificationDropCounters,
   notificationQueuePortMisses: () => notificationQueuePortMisses,
   observeCancelByDeny: () => observeCancelByDeny,
   onEngineTaskBound: () => onEngineTaskBound,
+  onGateArmed: () => onGateArmed,
+  onGateArmedFor: () => onGateArmedFor,
   onQuestionFrame: () => onQuestionFrame,
   onQuestionFrameFor: () => onQuestionFrameFor,
   oneShotFromEnv: () => oneShotFromEnv,
@@ -67518,6 +67946,7 @@ __export(dist_exports, {
   parseCatalogSources: () => parseCatalogSources,
   parseFinalVerifyArgv: () => parseFinalVerifyArgv,
   parseLimitsArgv: () => parseLimitsArgv,
+  parseLocalAllowRule: () => parseLocalAllowRule,
   parseModelFacingBash: () => parseModelFacingBash,
   parseModelFacingTaskOutput: () => parseModelFacingTaskOutput,
   parseNoFinalVerifyArgv: () => parseNoFinalVerifyArgv,
@@ -67528,9 +67957,13 @@ __export(dist_exports, {
   pendingRowIsOwnedByThisSession: () => pendingRowIsOwnedByThisSession,
   permissionModeField: () => permissionModeField,
   permissionModeFromArgv: () => permissionModeFromArgv,
+  persistedRulesGovernanceAvailable: () => persistedRulesGovernanceAvailable,
+  persistedRulesLaneAvailable: () => persistedRulesLaneAvailable,
   pickCheapCandidate: () => pickCheapCandidate,
   pickDelegatedPrompt: () => pickDelegatedPrompt,
   planModeExplicitlyRequested: () => planModeExplicitlyRequested,
+  planReviewArmedKey: () => planReviewArmedKey,
+  planReviewArmedKeyFor: () => planReviewArmedKeyFor,
   planReviewDecisionFromAnswer: () => planReviewDecisionFromAnswer,
   planReviewQuestionId: () => planReviewQuestionId,
   planSubagentViewSlots: () => planSubagentViewSlots,
@@ -67562,6 +67995,7 @@ __export(dist_exports, {
   readDecisionNoteAudit: () => readDecisionNoteAudit,
   readEngineActiveBgTasks: () => readEngineActiveBgTasks,
   readEngineActiveBgTasksFor: () => readEngineActiveBgTasksFor,
+  readRulePersistOutcome: () => readRulePersistOutcome,
   readSteerDelivery: () => readSteerDelivery,
   readSteerReceiptStatus: () => readSteerReceiptStatus,
   readToolApprovalRespondAck: () => readToolApprovalRespondAck,
@@ -67617,6 +68051,7 @@ __export(dist_exports, {
   sandboxDegradeHint: () => sandboxDegradeHint,
   sandboxRequestFields: () => sandboxRequestFields,
   sanitizeToolUseBlock: () => sanitizeToolUseBlock,
+  scenarioDenyFromError: () => scenarioDenyFromError,
   scenarioForPrint: () => scenarioForPrint,
   scratchpadDirField: () => scratchpadDirField,
   searchPresetTableViolations: () => searchPresetTableViolations,
@@ -67690,6 +68125,8 @@ __export(dist_exports, {
   versionSupportsDetach: () => versionSupportsDetach,
   versionSupportsLimits: () => versionSupportsLimits,
   waitForClaimRelease: () => waitForClaimRelease,
+  waitForGateArmed: () => waitForGateArmed,
+  waitForGateArmedFor: () => waitForGateArmedFor,
   waitForParkRowBirth: () => waitForParkRowBirth,
   wasGateArmed: () => wasGateArmed,
   wasGateArmedFor: () => wasGateArmedFor,
@@ -67789,6 +68226,9 @@ var init_dist = __esm({
     init_engineSubagentTail();
     init_engineSessionParam();
     init_engineWireTarget();
+    init_principalWire();
+    init_wireErrorTriage();
+    init_sessionMap();
     init_detachWire();
     init_workflowMonitor();
     init_workflowClient();
@@ -67809,6 +68249,8 @@ var init_dist = __esm({
     init_approvalDecisionNoteAudit();
     init_askParkRowRouting();
     init_resumeRunningCard();
+    init_persistedRulesWire();
+    init_localAllowRule();
     init_approvalsFeed();
     init_compensations();
     init_printNotification();
@@ -106717,11 +107159,11 @@ var require_valid = __commonJS({
 var require_clean = __commonJS({
   "node_modules/semver/functions/clean.js"(exports2, module2) {
     "use strict";
-    var parse12 = require_parse2(), clean5 = (version4, options) => {
+    var parse12 = require_parse2(), clean6 = (version4, options) => {
       let s = parse12(version4.trim().replace(/^[=v]+/, ""), options);
       return s ? s.version : null;
     };
-    module2.exports = clean5;
+    module2.exports = clean6;
   }
 });
 
@@ -107509,11 +107951,11 @@ var require_subset = __commonJS({
 var require_semver2 = __commonJS({
   "node_modules/semver/index.js"(exports2, module2) {
     "use strict";
-    var internalRe = require_re(), constants7 = require_constants2(), SemVer = require_semver(), identifiers = require_identifiers(), parse12 = require_parse2(), valid = require_valid(), clean5 = require_clean(), inc = require_inc(), diff2 = require_diff(), major2 = require_major(), minor2 = require_minor(), patch2 = require_patch(), prerelease = require_prerelease(), compare = require_compare(), rcompare = require_rcompare(), compareLoose = require_compare_loose(), compareBuild = require_compare_build(), sort = require_sort(), rsort = require_rsort(), gt2 = require_gt(), lt2 = require_lt(), eq2 = require_eq(), neq = require_neq(), gte2 = require_gte(), lte = require_lte(), cmp = require_cmp(), coerce5 = require_coerce(), truncate4 = require_truncate(), Comparator = require_comparator(), Range2 = require_range2(), satisfies2 = require_satisfies(), toComparators = require_to_comparators(), maxSatisfying = require_max_satisfying(), minSatisfying = require_min_satisfying(), minVersion = require_min_version(), validRange = require_valid2(), outside = require_outside(), gtr = require_gtr(), ltr = require_ltr(), intersects = require_intersects(), simplifyRange = require_simplify(), subset = require_subset();
+    var internalRe = require_re(), constants7 = require_constants2(), SemVer = require_semver(), identifiers = require_identifiers(), parse12 = require_parse2(), valid = require_valid(), clean6 = require_clean(), inc = require_inc(), diff2 = require_diff(), major2 = require_major(), minor2 = require_minor(), patch2 = require_patch(), prerelease = require_prerelease(), compare = require_compare(), rcompare = require_rcompare(), compareLoose = require_compare_loose(), compareBuild = require_compare_build(), sort = require_sort(), rsort = require_rsort(), gt2 = require_gt(), lt2 = require_lt(), eq2 = require_eq(), neq = require_neq(), gte2 = require_gte(), lte = require_lte(), cmp = require_cmp(), coerce5 = require_coerce(), truncate4 = require_truncate(), Comparator = require_comparator(), Range2 = require_range2(), satisfies2 = require_satisfies(), toComparators = require_to_comparators(), maxSatisfying = require_max_satisfying(), minSatisfying = require_min_satisfying(), minVersion = require_min_version(), validRange = require_valid2(), outside = require_outside(), gtr = require_gtr(), ltr = require_ltr(), intersects = require_intersects(), simplifyRange = require_simplify(), subset = require_subset();
     module2.exports = {
       parse: parse12,
       valid,
-      clean: clean5,
+      clean: clean6,
       inc,
       diff: diff2,
       major: major2,
@@ -114575,8 +115017,8 @@ function useTerminalTitle(title) {
   let writeRaw = (0, import_react23.useContext)(TerminalWriteContext);
   (0, import_react23.useEffect)(() => {
     if (title === null || !writeRaw) return;
-    let clean5 = stripAnsi(title);
-    process.platform === "win32" ? process.title = clean5 : writeRaw(osc(OSC.SET_TITLE_AND_ICON, clean5));
+    let clean6 = stripAnsi(title);
+    process.platform === "win32" ? process.title = clean6 : writeRaw(osc(OSC.SET_TITLE_AND_ICON, clean6));
   }, [title, writeRaw]);
 }
 var import_react23, init_use_terminal_title = __esm({
@@ -114701,265 +115143,15 @@ var init_types8 = __esm({
 });
 
 // build-src/src/sema/activeRunSelfHeal.ts
-function activeRunBusySignal2(ev) {
-  if (typeof ev != "object" || ev === null || !("type" in ev)) return null;
-  let type = ev.type, carrier;
-  if (type === "done") {
-    if (!("result" in ev)) return null;
-    let result = ev.result;
-    if (typeof result != "object" || result === null || !("status" in result) || result.status !== "failed") return null;
-    carrier = result;
-  } else if (type === "failed")
-    carrier = ev;
-  else
-    return null;
-  let errorCode = "errorCode" in carrier ? carrier.errorCode : void 0, activeTaskId = "activeTaskId" in carrier ? carrier.activeTaskId : void 0, activeTaskStatus = "activeTaskStatus" in carrier ? carrier.activeTaskStatus : void 0, rawGate = "pendingGate" in carrier ? carrier.pendingGate : void 0, codeHit = errorCode === ACTIVE_RUN_BUSY_ERROR_CODE, handle2 = typeof activeTaskId == "string" && activeTaskId.length > 0 ? activeTaskId : null;
-  if (!codeHit && handle2 === null) return null;
-  let pendingGate = null;
-  if (typeof rawGate == "object" && rawGate !== null) {
-    let k2 = "kind" in rawGate ? rawGate.kind : void 0, p = "decidePath" in rawGate ? rawGate.decidePath : void 0, g6 = "governanceForced" in rawGate ? rawGate.governanceForced : void 0;
-    pendingGate = {
-      kind: typeof k2 == "string" && k2.length > 0 ? k2 : null,
-      decidePath: typeof p == "string" && p.length > 0 ? p : null,
-      ...g6 === !0 ? { governanceForced: !0 } : {}
-    };
-  }
-  return {
-    activeTaskId: handle2,
-    activeTaskStatus: typeof activeTaskStatus == "string" && activeTaskStatus.length > 0 ? activeTaskStatus : null,
-    pendingGate
-  };
+function attemptActiveRunSelfHeal2(signal, runs, deps2) {
+  let override = cancelReleaseWaitOverrideMs, merged = override === null || deps2?.cancelReleaseWaitMs !== void 0 ? deps2 : { ...deps2 ?? {}, cancelReleaseWaitMs: override };
+  return attemptActiveRunSelfHeal(signal, runs, merged);
 }
-function describeFailure2(e) {
-  if (typeof e == "object" && e !== null && "message" in e) {
-    let m2 = e.message;
-    if (typeof m2 == "string" && m2.length > 0) return m2.length > 200 ? `${m2.slice(0, 200)}\u2026` : m2;
-  }
-  return "the engine gave no detail";
-}
-function readStatus2(record2) {
-  if (typeof record2 != "object" || record2 === null || !("status" in record2)) return null;
-  let st2 = record2.status;
-  return typeof st2 == "string" && st2.length > 0 ? st2 : null;
-}
-function steerFailureClass(e) {
-  let status3 = e?.status;
-  return typeof status3 == "number" && status3 >= 400 && status3 < 500 ? "rejected" : "unknown";
-}
-function readDelivery(receipt) {
-  if (typeof receipt != "object" || receipt === null || !("delivery" in receipt)) return null;
-  let d4 = receipt.delivery;
-  return typeof d4 == "string" && d4.length > 0 ? d4 : null;
-}
-function readReceiptStatus(receipt) {
-  if (typeof receipt != "object" || receipt === null || !("status" in receipt)) return null;
-  let s = receipt.status;
-  return typeof s == "string" && s.length > 0 ? s : null;
-}
-function cancelReleaseWaitMs() {
-  return cancelReleaseWaitOverrideMs ?? CANCEL_RELEASE_WAIT_MS2;
-}
-function sleep2(ms, signal) {
-  return signal?.aborted === !0 ? Promise.resolve() : new Promise((resolve57) => {
-    let timer2 = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort), resolve57();
-    }, ms), onAbort = () => {
-      clearTimeout(timer2), resolve57();
-    };
-    signal?.addEventListener("abort", onAbort, { once: !0 });
-  });
-}
-function claimProbeSignal(caller, deadline) {
-  let remaining = Math.max(1, deadline - Date.now()), budget = AbortSignal.timeout(remaining);
-  if (caller === void 0) return budget;
-  if (typeof AbortSignal.any == "function") return AbortSignal.any([caller, budget]);
-  let ac = new AbortController(), abort = (s) => ac.abort(s.reason);
-  return caller.aborted ? abort(caller) : caller.addEventListener("abort", () => abort(caller), { once: !0 }), budget.addEventListener("abort", () => abort(budget), { once: !0 }), ac.signal;
-}
-async function waitForClaimRelease2(taskId, get4, budgetMs, signal) {
-  let startedAt = Date.now(), deadline = startedAt + budgetMs, waited = () => Date.now() - startedAt, isAborted3 = () => signal?.aborted === !0, delay = CANCEL_POLL_START_MS2;
-  for (; ; ) {
-    if (isAborted3()) return { released: !1, waitedMs: waited(), aborted: !0 };
-    let remaining = deadline - Date.now();
-    if (remaining <= 0) return { released: !1, waitedMs: waited(), aborted: !1 };
-    if (await sleep2(Math.min(delay, remaining), signal), isAborted3()) return { released: !1, waitedMs: waited(), aborted: !0 };
-    delay = Math.min(Math.round(delay * 1.5), CANCEL_POLL_MAX_MS2);
-    let status3;
-    try {
-      status3 = readStatus2(await get4(taskId, { signal: claimProbeSignal(signal, deadline) }));
-    } catch (e) {
-      if (isAborted3()) return { released: !1, waitedMs: waited(), aborted: !0 };
-      if (e?.status === 404) return { released: !0, waitedMs: waited(), aborted: !1 };
-      continue;
-    }
-    if (status3 !== null && CLAIM_RELEASED_STATES2.includes(status3)) return { released: !0, waitedMs: waited(), aborted: !1 };
-  }
-}
-async function attemptActiveRunSelfHeal2(signal, runs, deps2) {
-  let pending2 = !1;
-  try {
-    pending2 = deps2?.hasPendingDecision?.() === !0;
-  } catch {
-    pending2 = !1;
-  }
-  if (pending2 && deps2?.listOwnedPendingApprovals !== void 0)
-    try {
-      await deps2.listOwnedPendingApprovals() === 0 && (pending2 = !1);
-    } catch {
-    }
-  if (pending2) return { kind: "decision-pending", taskId: signal.activeTaskId };
-  let taskId = signal.activeTaskId;
-  if (taskId === null)
-    return {
-      kind: "state-unknown",
-      taskId: null,
-      detail: "the engine did not name the run that holds this session"
-    };
-  let planVerdict2 = async () => {
-    try {
-      return await deps2?.reopenPlanReview?.(taskId) ?? { reopened: !1 };
-    } catch {
-      return { reopened: !1 };
-    }
-  }, askVerdict2 = async () => {
-    try {
-      return await deps2?.reopenAskPark?.(taskId) ?? { reopened: !1 };
-    } catch {
-      return { reopened: !1 };
-    }
-  }, reopenPlanArm = async () => {
-    let verdict = await planVerdict2();
-    return verdict.reopened === !0 ? { kind: "plan-review-reopened", taskId, firstSight: verdict.firstSight === !0 } : { kind: "plan-review-reopen-failed", taskId, decidePath: signal.pendingGate?.decidePath ?? null };
-  }, reopenAskArm = async () => {
-    let verdict = await askVerdict2();
-    return verdict.reopened === !0 ? { kind: "ask-reopened", taskId, firstSight: verdict.firstSight === !0 } : { kind: "ask-reopen-failed", taskId, decidePath: signal.pendingGate?.decidePath ?? null };
-  }, runningChoiceArm2 = async (status4) => {
-    let notParked = { kind: "not-parked", taskId, status: status4 }, offer = deps2?.offerRunningChoice;
-    if (typeof offer != "function") return notParked;
-    let text2 = typeof deps2?.deniedMessage == "string" ? deps2.deniedMessage : "", steer = typeof runs?.steer == "function" ? runs.steer.bind(runs) : void 0, cancel = typeof runs?.cancel == "function" ? runs.cancel.bind(runs) : void 0, get4 = typeof runs?.get == "function" ? runs.get.bind(runs) : void 0, canSteer = typeof steer == "function" && text2.length > 0, canCancel = typeof cancel == "function" && typeof get4 == "function";
-    if (!canSteer && !canCancel) return notParked;
-    let choice = "wait";
-    try {
-      choice = await offer({ taskId, status: status4, canSteer, canCancel }) ?? "wait";
-    } catch {
-      choice = "wait";
-    }
-    if (choice === "steer" && canSteer && steer !== void 0)
-      try {
-        let receipt = await steer(taskId, { text: text2 }), delivery = readDelivery(receipt), receiptStatus = readReceiptStatus(receipt);
-        if (delivery === "queued") {
-          let verdict = receiptStatus !== null && PLAN_REVIEW_STATES2.includes(receiptStatus) ? await planVerdict2() : receiptStatus !== null && ASK_PARK_STATES2.includes(receiptStatus) ? await askVerdict2() : null;
-          return { kind: "running-steered", taskId, delivery, status: receiptStatus, reopened: verdict };
-        }
-        return { kind: "running-steered", taskId, delivery, status: receiptStatus, reopened: null };
-      } catch (e) {
-        return { kind: "running-steer-failed", taskId, detail: describeFailure2(e), delivery: steerFailureClass(e) };
-      }
-    if (choice === "cancel" && canCancel && cancel !== void 0 && get4 !== void 0) {
-      try {
-        await cancel(taskId);
-      } catch (e) {
-        return { kind: "running-cancel-failed", taskId, detail: describeFailure2(e) };
-      }
-      let verdict = await waitForClaimRelease2(taskId, get4, cancelReleaseWaitMs(), deps2?.signal);
-      return verdict.released ? { kind: "running-cancelled", taskId } : { kind: "running-cancel-timeout", taskId, waitedMs: verdict.waitedMs, aborted: verdict.aborted };
-    }
-    return notParked;
-  }, gateKind2 = signal.pendingGate?.kind ?? null;
-  if (gateKind2 !== null && PLAN_REVIEW_GATE_KINDS2.includes(gateKind2)) return reopenPlanArm();
-  if (gateKind2 !== null && ASK_PARK_GATE_KINDS2.includes(gateKind2)) return reopenAskArm();
-  let status3 = signal.activeTaskStatus;
-  if (status3 === null) {
-    if (typeof runs?.get != "function")
-      return { kind: "state-unknown", taskId, detail: "this client exposes no durable run verbs" };
-    let record2;
-    try {
-      record2 = await runs.get(taskId);
-    } catch (e) {
-      return { kind: "state-unknown", taskId, detail: describeFailure2(e) };
-    }
-    status3 = readStatus2(record2);
-  }
-  return status3 === null ? { kind: "state-unknown", taskId, detail: "the engine reported no status for that run" } : gateKind2 !== null ? { kind: "not-parked", taskId, status: status3 } : PLAN_REVIEW_STATES2.includes(status3) ? reopenPlanArm() : ASK_PARK_STATES2.includes(status3) ? reopenAskArm() : RUNNING_STATES2.includes(status3) ? runningChoiceArm2(status3) : { kind: "not-parked", taskId, status: status3 };
-}
-function gateKindPhrase2(kind) {
-  return kind ? `a ${kind} decision` : "a decision";
-}
-function decidePathClause2(signal) {
-  let decidePath = signal?.pendingGate?.decidePath;
-  return decidePath ? ` The engine says that run is waiting on ${gateKindPhrase2(signal?.pendingGate?.kind)} and that it is decided at POST ${decidePath} \u2014 deciding it releases the session.` : "";
-}
-function activeRunSelfHealRow2(outcome, signal) {
-  let base = activeRunSelfHealBaseRow2(outcome, signal);
-  switch (outcome.kind) {
-    // 这两条是「用户此刻卡住了、而且没有别的把手」的结局 —— wire 给的 decide 入口在这里才有用。
-    case "not-parked":
-    case "state-unknown":
-      return base + decidePathClause2(signal) + governanceOriginClause2(signal);
-    // 其余结局手上都另有一张更好的把手(重开的卡 / 已开的卡 / 失败臂基句自己渲的 decidePath)
-    // (重开的卡 / 已开的卡 / 基句自己渲的 decidePath)—— 再叠一条引擎路由只会稀释那一个动作。
-    default:
-      return base + governanceOriginClause2(signal);
-  }
-}
-function governanceOriginClause2(signal) {
-  return signal?.pendingGate?.governanceForced === !0 ? " That gate is enforced by this deployment's governance policy, not by a permission rule you set." : "";
-}
-function activeRunSelfHealBaseRow2(outcome, signal) {
-  switch (outcome.kind) {
-    case "decision-pending":
-      return `This session is held by an earlier turn${outcome.taskId ? ` (run ${outcome.taskId})` : ""} that is waiting on a decision you have not made yet, and there is a decision card open for it. sema did NOT cancel it \u2014 answering that card is what releases the session, and cancelling would decide it for you. Your message was NOT sent; answer the open card and send it again.`;
-    case "ask-reopened":
-      return outcome.firstSight ? `The previous turn advanced to a decision it needs from you (run ${outcome.taskId}), which is why nothing new could start \u2014 sema has surfaced that decision card. Answer it and send your message again. (sema did NOT cancel the run: cancelling would have decided it for you.)` : `The previous turn is parked waiting for your decision (run ${outcome.taskId}), which is why nothing new could start \u2014 that card was closed without being answered, so sema reopened it. Answer it and send your message again. (sema did NOT cancel the run: cancelling would have decided it for you.)`;
-    case "plan-review-reopened":
-      return outcome.firstSight ? `The previous turn produced a plan that is waiting for your review (run ${outcome.taskId}), which is why nothing new could start \u2014 sema has surfaced the review card. Answer it and send your message again. (sema did NOT cancel the run: cancelling would have thrown the plan away on your behalf.)` : `The previous turn is parked waiting for you to review its plan (run ${outcome.taskId}), which is why nothing new could start \u2014 that approval card was closed without being answered, so sema reopened it. Answer it and send your message again. (sema did NOT cancel the run: cancelling would have thrown the plan away on your behalf.)`;
-    case "ask-reopen-failed": {
-      let viaEngine = outcome.decidePath ? ` You can also decide it on the engine directly: POST ${outcome.decidePath}.` : "";
-      return `The previous turn is parked waiting for your decision (run ${outcome.taskId}) and sema could not reopen that card here. It did NOT cancel the run \u2014 that would have decided it for you. Your message was NOT sent; ${INTERACTIVE_WAY_OUT} if you no longer want it.${viaEngine}`;
-    }
-    case "plan-review-reopen-failed": {
-      let viaEngine = outcome.decidePath ? ` You can also decide it on the engine directly: POST ${outcome.decidePath}.` : "";
-      return `The previous turn is parked waiting for a plan review (run ${outcome.taskId}) and sema could not reopen that approval card. It did NOT cancel the run \u2014 that would have discarded the plan for you. Your message was NOT sent; ${INTERACTIVE_WAY_OUT} if you no longer want that plan.${viaEngine}`;
-    }
-    // ── C3 三选卡的四种动作结局(选 ③/没答/没呈上都落 not-parked,见下)────────────────────
-    case "running-steered": {
-      let handle2 = `run ${outcome.taskId}`, textOnly = "Only the TEXT of your message was handed over \u2014 a steer carries no attachments, so any images in that submission were NOT sent.";
-      if (outcome.delivery === "applied")
-        return `sema handed your message to the run that is already working (${handle2}) \u2014 the engine applied it to that run, so it is picked up at that run's next step. ${textOnly} Nothing was cancelled, and your message did NOT start a new turn \u2014 watch that run for what it does with it.`;
-      if (outcome.delivery === "queued") {
-        let parked = outcome.status ? `parked (status ${outcome.status})` : "parked", next = outcome.reopened?.reopened === !0 ? "sema has surfaced that decision card \u2014 answering it is what lets that run resume and pick your message up." : `sema could not surface that decision card here, so nothing will resume that run until that decision is made; ${INTERACTIVE_WAY_OUT} if you no longer want it.`;
-        return `${handle2} is not actually working right now: the engine reports it ${parked} on a decision it needs from you, so it queued your message on that park instead of running it. ${next} ${textOnly} Nothing was cancelled, and your message did NOT start a new turn.`;
-      }
-      return outcome.delivery === "parked_for_wake" ? `${handle2} had already finished, so the engine parked your message on that finished run instead of running it \u2014 a parked message is delivered only if this session is woken on the engine (POST /v1/sessions/:id/wake), which sema does not do here. That run is no longer holding this session: send your message again to run it as a new turn. ${textOnly} Nothing was cancelled.` : `sema handed your message to ${handle2}, but the engine did not say how it will be delivered${outcome.status ? ` (it reported that run as ${outcome.status})` : ""}. ${textOnly} Nothing was cancelled, and your message did NOT start a new turn \u2014 watch that run before sending it again.`;
-    }
-    case "running-steer-failed":
-      return outcome.delivery === "rejected" ? `The engine rejected handing your message to the running run (run ${outcome.taskId}): ${outcome.detail}. sema did NOT retry it (a steer is not safe to send twice) and it did NOT cancel that run. Your message was NOT sent; send it again if you still want it.` : `sema sent your message to the running run (run ${outcome.taskId}) but could not confirm what happened to it (${outcome.detail}). A steer is not safe to send twice, so sema did NOT retry it, and it did NOT cancel that run. That run may or may not have received your message \u2014 watch what it does next before sending it again.`;
-    case "running-cancelled":
-      return `You chose to cancel run ${outcome.taskId}. The engine confirmed it is no longer holding this session, so sema is sending your message now.`;
-    case "running-cancel-timeout": {
-      let waited = `${String(Math.max(1, Math.round(outcome.waitedMs / 1e3)))}s`;
-      return outcome.aborted ? `sema asked the engine to cancel run ${outcome.taskId} and you interrupted while it was still confirming (${waited} in). Cancelling is asynchronous, so that run may still be winding down and may still hold this session. Your message was NOT sent; send it again in a moment, or ${INTERACTIVE_WAY_OUT}.` : `sema asked the engine to cancel run ${outcome.taskId}, but that run still held this session ${waited} later \u2014 cancelling is asynchronous and it may still be winding down. Your message was NOT sent; send it again in a moment, or ${INTERACTIVE_WAY_OUT}.`;
-    }
-    case "running-cancel-failed":
-      return `sema could not cancel run ${outcome.taskId} (${outcome.detail}), so that run is still holding this session and your message was NOT sent. Send it again to retry, or ${INTERACTIVE_WAY_OUT}.`;
-    case "not-parked":
-      return signal?.pendingGate ? `This session is held by an earlier run (run ${outcome.taskId}, status ${outcome.status}) that is waiting on ${gateKindPhrase2(signal.pendingGate.kind)} \u2014 it will not finish on its own. sema did NOT cancel it, because cancelling would decide that item for you. Your message was NOT sent; ${INTERACTIVE_WAY_OUT} if you no longer want it.` : `This session already has a run in flight (run ${outcome.taskId}, status ${outcome.status}) \u2014 most likely a turn you sent to the background. sema did NOT cancel it, because that would throw away work you asked for. Wait for it to finish, or ${INTERACTIVE_WAY_OUT}.`;
-    case "state-unknown":
-      return `This session is locked by an earlier run${outcome.taskId ? ` (run ${outcome.taskId})` : ""} and sema could not read that run's state, so it did not touch it (${outcome.detail}). Your message was NOT sent. This session cannot start a new turn until that run settles \u2014 ${INTERACTIVE_WAY_OUT}.`;
-  }
-}
-function activeRunBusyHeadlessRow2(signal) {
-  let activeTaskId = signal.activeTaskId, handle2 = activeTaskId ? ` (run ${activeTaskId})` : "", cancelPath = `POST /v1/runs/${activeTaskId ?? "<id>"}/cancel`, status3 = signal.activeTaskStatus, decidePath = signal.pendingGate?.decidePath ?? null, freshSession = "start a new session (drop --resume/--continue)";
-  return decidePath ? `This session is held by an earlier run${handle2}${status3 ? ` (status ${status3})` : ""} that is parked waiting on ${gateKindPhrase2(signal.pendingGate?.kind)}, so this message was NOT sent. Decide it and the session unlocks: POST ${decidePath}. Cancelling instead (${cancelPath}) also unlocks it, but it decides that item against you. Or ${freshSession}.` + // 出身归因同款(见 governanceOriginClause):这条车道更需要它 —— 没有卡可看,
-  // 用户唯一能读到的就是这一段话。
-  governanceOriginClause2(signal) : status3 ? `This session is held by an earlier run${handle2} with status ${status3}, so this message was NOT sent. The engine reported no decision pending on that run: if it is still working, wait for it to finish; if it will never settle, release it with ${cancelPath} (that discards whatever it was doing). Or ${freshSession}.` : `This session is locked by an earlier run${handle2} that was never released, so this message was NOT sent. Nothing here clears on its own. Start a new session (drop --resume/--continue), or release the run on the engine: ${cancelPath}`;
-}
-var PLAN_REVIEW_STATES2, ASK_PARK_STATES2, PLAN_REVIEW_GATE_KINDS2, ASK_PARK_GATE_KINDS2, RUNNING_STATES2, CLAIM_RELEASED_STATES2, CANCEL_RELEASE_WAIT_MS2, CANCEL_POLL_START_MS2, CANCEL_POLL_MAX_MS2, cancelReleaseWaitOverrideMs, INTERACTIVE_WAY_OUT, init_activeRunSelfHeal2 = __esm({
+var cancelReleaseWaitOverrideMs, init_activeRunSelfHeal2 = __esm({
   "build-src/src/sema/activeRunSelfHeal.ts"() {
     init_dist();
-    PLAN_REVIEW_STATES2 = ["needs_review"], ASK_PARK_STATES2 = ["suspended"], PLAN_REVIEW_GATE_KINDS2 = ["plan_review", "dry_run_review"], ASK_PARK_GATE_KINDS2 = ["human", "irreversible_ask", "policy_ask", "tool_approval"], RUNNING_STATES2 = ["running"], CLAIM_RELEASED_STATES2 = ["completed", "failed", "blocked", "timeout"];
-    CANCEL_RELEASE_WAIT_MS2 = 1e4, CANCEL_POLL_START_MS2 = 200, CANCEL_POLL_MAX_MS2 = 2e3, cancelReleaseWaitOverrideMs = null;
-    INTERACTIVE_WAY_OUT = "run /clear to keep working in a fresh session";
+    init_dist();
+    cancelReleaseWaitOverrideMs = null;
   }
 });
 
@@ -114977,7 +115169,7 @@ __export(runStream_exports, {
 function watchActiveRunBusy(events3, seen2) {
   return (async function* () {
     for await (let ev of events3) {
-      let busy = activeRunBusySignal2(ev);
+      let busy = activeRunBusySignal(ev);
       busy && (seen2.busy = busy), yield ev;
     }
   })();
@@ -115025,7 +115217,7 @@ function rewriteActiveRunBusyRow(msgs, seen2) {
             ...m2,
             message: {
               ...envelope,
-              content: [{ type: "text", text: activeRunBusyHeadlessRow2(busy) }]
+              content: [{ type: "text", text: activeRunBusyHeadlessRow(busy) }]
             }
           };
           continue;
@@ -115049,13 +115241,13 @@ function hostSink(e, billTurnCosts = !0) {
     return;
   }
   if (e.kind === "human_input") {
-    let clean5 = (v2) => (
+    let clean6 = (v2) => (
       // eslint-disable-next-line no-control-regex
       String(v2 ?? "").replace(/[\x00-\x1f\x7f]/g, ".").slice(0, 120)
-    ), who = e.actor?.id ? `${clean5(e.actor.id)}${e.actor.hostAsserted === !0 ? "" : " (unverified)"}` : "unattributed";
+    ), who = e.actor?.id ? `${clean6(e.actor.id)}${e.actor.hostAsserted === !0 ? "" : " (unverified)"}` : "unattributed";
     Promise.resolve().then(() => (init_debug(), debug_exports)).then(
       (m2) => m2.logForDebugging(
-        `[sema][wire] human_input ledger: carrier=${clean5(e.carrier)} source=${clean5(e.source)} delivery=${clean5(e.delivery)} actor=${who}${e.eventId ? ` eventId=${clean5(e.eventId)}` : ""}`
+        `[sema][wire] human_input ledger: carrier=${clean6(e.carrier)} source=${clean6(e.source)} delivery=${clean6(e.delivery)} actor=${who}${e.eventId ? ` eventId=${clean6(e.eventId)}` : ""}`
       )
     ).catch(() => {
     });
@@ -115073,10 +115265,10 @@ function _resetHostDroppedFrameMemoForTest() {
   reportedDroppedTypes2.clear();
 }
 function hostDroppedFrameSink(info) {
-  let clean5 = (v2) => (
+  let clean6 = (v2) => (
     // eslint-disable-next-line no-control-regex
     String(v2).replace(/[\x00-\x1f\x7f]/g, ".").slice(0, 120)
-  ), type = clean5(info.type), line = `[sema][wire] dropped engine frame: type=${type} why=${clean5(info.why)} \u2014 this build's projector has no arm for it (engine newer than the client, or a malformed frame). It renders NOWHERE.`;
+  ), type = clean6(info.type), line = `[sema][wire] dropped engine frame: type=${type} why=${clean6(info.why)} \u2014 this build's projector has no arm for it (engine newer than the client, or a malformed frame). It renders NOWHERE.`;
   Promise.resolve().then(() => (init_debug(), debug_exports)).then((m2) => {
     m2.logForDebugging(line, { level: "warn" }), !m2.isDebugMode() && process.env.USER_TYPE !== "ant" && consoleLegForDroppedFrame(type, line);
   }).catch(() => consoleLegForDroppedFrame(type, line));
@@ -138794,7 +138986,7 @@ var KEYCHAIN_PREFETCH_TIMEOUT_MS, legacyApiKeyPrefetch, prefetchPromise, init_ke
 });
 
 // build-src/src/utils/sleep.ts
-function sleep3(ms, signal, opts) {
+function sleep2(ms, signal, opts) {
   return new Promise((resolve57, reject3) => {
     if (signal?.aborted) {
       opts?.throwOnAbort || opts?.abortError ? reject3(opts.abortError?.() ?? new Error("aborted")) : resolve57();
@@ -139221,7 +139413,7 @@ async function checkGcpCredentialsValid() {
       scopes: ["https://www.googleapis.com/auth/cloud-platform"]
     }), probe3 = (async () => {
       await (await auth2.getClient()).getAccessToken();
-    })(), timeout3 = sleep3(GCP_CREDENTIALS_CHECK_TIMEOUT_MS).then(() => {
+    })(), timeout3 = sleep2(GCP_CREDENTIALS_CHECK_TIMEOUT_MS).then(() => {
       throw new GcpCredentialsTimeoutError("GCP credentials check timed out");
     });
     return await Promise.race([probe3, timeout3]), !0;
@@ -139425,7 +139617,7 @@ async function checkAndRefreshOAuthTokenIfNeededImpl(retryCount, force) {
   try {
     release2 = await lock(claudeDir), noteStorageLockAcquired();
   } catch (err8) {
-    return err8.code === "ELOCKED" ? retryCount < 5 ? (retryCount + 1, await sleep3(1e3 + Math.random() * 1e3), checkAndRefreshOAuthTokenIfNeededImpl(retryCount + 1, force)) : !1 : (logError(err8), errorMessage(
+    return err8.code === "ELOCKED" ? retryCount < 5 ? (retryCount + 1, await sleep2(1e3 + Math.random() * 1e3), checkAndRefreshOAuthTokenIfNeededImpl(retryCount + 1, force)) : !1 : (logError(err8), errorMessage(
       err8
     ), !1);
   }
@@ -143465,7 +143657,7 @@ async function cleanupWorktree() {
         ...current5,
         activeWorktreeSession: void 0
       })), !hookBased && worktreeBranch) {
-        await sleep3(100);
+        await sleep2(100);
         let { code: deleteBranchCode, stderr: deleteBranchError } = await execFileNoThrowWithCwd(
           gitExe(),
           ["branch", "-D", worktreeBranch],
@@ -176808,19 +177000,17 @@ function acquireFileLockSyncRetrying(path28) {
     return;
   }
 }
-function engineNamespaceKeyFor(baseUrl) {
-  if (!baseUrl) return "local";
-  try {
-    return new URL(baseUrl).origin.toLowerCase();
-  } catch {
-    return baseUrl.toLowerCase();
-  }
+function logMergeSkip(reason, key) {
+  logForDebugging(
+    reason === "no-engine-session-id" ? `sessionIdMapping: persistEngineEntry(${key}) skipped \u2014 no engineSessionId` : "sessionIdMapping: persist skipped \u2014 no shellSessionId"
+  );
 }
 var LOCK_STALE_MS3, SessionIdMapping, init_sessionIdMapping = __esm({
   "build-src/src/sema/sessionIdMapping.ts"() {
     init_debug();
     init_lockfile();
     init_slowOperations();
+    init_dist();
     LOCK_STALE_MS3 = 1e4;
     SessionIdMapping = class {
       path;
@@ -176856,21 +177046,21 @@ var LOCK_STALE_MS3, SessionIdMapping, init_sessionIdMapping = __esm({
        */
       persist(partial2) {
         if (!this.path || process.env.SEMA_NO_PERSIST_WIRE === "1") {
-          let prior = this.freshPrior(), shellSessionId = partial2.shellSessionId ?? prior?.shellSessionId;
-          if (!shellSessionId) {
-            logForDebugging("sessionIdMapping: persist skipped \u2014 no shellSessionId");
+          let verdict = mergeSessionMapRecord(this.freshPrior(), partial2);
+          if (!verdict.ok) {
+            logMergeSkip(verdict.reason);
             return;
           }
-          this.cache = { ...prior, ...partial2, shellSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+          this.cache = verdict.record;
           return;
         }
-        let next = this.lockedReadMergeWrite(this.path, (prior) => {
-          let shellSessionId = partial2.shellSessionId ?? prior?.shellSessionId;
-          if (!shellSessionId) {
-            logForDebugging("sessionIdMapping: persist skipped \u2014 no shellSessionId");
+        let next = this.storeFor(this.path).readMergeWrite((prior) => {
+          let verdict = mergeSessionMapRecord(prior, partial2);
+          if (!verdict.ok) {
+            logMergeSkip(verdict.reason);
             return;
           }
-          return { ...prior, ...partial2, shellSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+          return verdict.record;
         });
         next && (this.cache = next);
       }
@@ -176893,43 +177083,21 @@ var LOCK_STALE_MS3, SessionIdMapping, init_sessionIdMapping = __esm({
        */
       persistEngineEntry(key, partial2, shellSessionId) {
         if (!this.path || process.env.SEMA_NO_PERSIST_WIRE === "1") {
-          let prior = this.freshPrior(), priorEntry = prior?.engines?.[key], engineSessionId = partial2.engineSessionId ?? priorEntry?.engineSessionId;
-          if (!engineSessionId) {
-            logForDebugging(`sessionIdMapping: persistEngineEntry(${key}) skipped \u2014 no engineSessionId`);
-            return;
-          }
-          let sid = shellSessionId ?? prior?.shellSessionId;
-          if (!sid) {
-            logForDebugging("sessionIdMapping: persist skipped \u2014 no shellSessionId");
+          let verdict = mergeEngineEntry(this.freshPrior(), key, partial2, shellSessionId);
+          if (!verdict.ok) {
+            logMergeSkip(verdict.reason, key);
             return;
           }
-          let entry = { ...priorEntry, ...partial2, engineSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-          this.cache = {
-            ...prior,
-            shellSessionId: sid,
-            engines: { ...prior?.engines, [key]: entry },
-            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-          };
+          this.cache = verdict.record;
           return;
         }
-        let next = this.lockedReadMergeWrite(this.path, (prior) => {
-          let priorEntry = prior?.engines?.[key], engineSessionId = partial2.engineSessionId ?? priorEntry?.engineSessionId;
-          if (!engineSessionId) {
-            logForDebugging(`sessionIdMapping: persistEngineEntry(${key}) skipped \u2014 no engineSessionId`);
+        let next = this.storeFor(this.path).readMergeWrite((prior) => {
+          let verdict = mergeEngineEntry(prior, key, partial2, shellSessionId);
+          if (!verdict.ok) {
+            logMergeSkip(verdict.reason, key);
             return;
           }
-          let sid = shellSessionId ?? prior?.shellSessionId;
-          if (!sid) {
-            logForDebugging("sessionIdMapping: persist skipped \u2014 no shellSessionId");
-            return;
-          }
-          let entry = { ...priorEntry, ...partial2, engineSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-          return {
-            ...prior,
-            shellSessionId: sid,
-            engines: { ...prior?.engines, [key]: entry },
-            updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-          };
+          return verdict.record;
         });
         next && (this.cache = next);
       }
@@ -176946,6 +177114,17 @@ var LOCK_STALE_MS3, SessionIdMapping, init_sessionIdMapping = __esm({
       _reset() {
         this.path = void 0, this.cache = void 0;
       }
+      /**
+       * A-028.12:包 `SessionMapStorePort` 的 cli 文件实现(read = 无副作用新鲜读盘;
+       * readMergeWrite = 锁内读-合-写)。端口在这里**真被消费**(persist/persistEngineEntry 经它写),
+       * 不是装饰性 satisfies —— web 半场用 localStorage 实现同一契约。
+       */
+      storeFor(path28) {
+        return {
+          read: () => this.readRecordFromDisk(path28),
+          readMergeWrite: (build2) => this.lockedReadMergeWrite(path28, build2)
+        };
+      }
       /**
        * M1 修 core: lock `path`, read the FRESH on-disk record (not `this.cache` / not a pre-lock read),
        * let `build` compute the next record from that fresh prior, and atomically persist it — all inside
@@ -178203,15 +178382,7 @@ function validateEngineUrlTransport(url3) {
   );
 }
 function resolveLiveAuthToken(baseUrl, token = process.env.SEMA_LIVE_TOKEN) {
-  return token || (baseUrl && isLoopbackEngineUrl(baseUrl) ? { mode: "loopback-unauthed" } : "anon");
-}
-function isLoopbackEngineUrl(url3) {
-  try {
-    let h = new URL(url3).hostname;
-    return h === "127.0.0.1" || h === "localhost" || h === "::1" || h === "[::1]";
-  } catch {
-    return !1;
-  }
+  return resolveWireAuth(baseUrl, token);
 }
 function configuredEngineUrl() {
   let v2 = settingsEnv()[ENGINE_URL_ENV] ?? process.env[ENGINE_URL_ENV];
@@ -178318,14 +178489,6 @@ function enginePinUnreachableHint(pin) {
   \xB7 Leftover from an older install, or want the shell-managed engine back? ${removal} \u2014 the next launch self-spawns a local engine.
   \xB7 Not sure? Run \`sema doctor\` to see the engine status.`;
 }
-function isEngineTransportError(err8) {
-  let e = err8;
-  if (typeof e?.status == "number") return !1;
-  let cause = e?.cause, detail = typeof cause?.message == "string" && cause.message.length > 0 && cause.message || typeof e?.message == "string" && e.message.length > 0 && e.message || String(err8);
-  return e?.cause !== void 0 || /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|EHOSTUNREACH|ENETUNREACH|EPIPE|socket hang up|UND_ERR|terminated|other side closed/i.test(
-    detail
-  );
-}
 function noteEnginePinUnreachable(pin) {
   enginePinUnreachable = pin;
 }
@@ -178451,7 +178614,7 @@ function noteRemoteResumeWarning() {
 function remoteResumeWarningActive() {
   return remoteResumeWarning;
 }
-var ENGINE_URL_ENV, TRUSTED_ENGINE_HOSTS_KEY, enginePinUnreachable, SYNC_ENGINE_URL_ENV, AUTO_SYNC_SOURCE_LABEL, AUTO_SYNC_LOCKED_BY_POLICY_ERROR, DEFAULT_BIND_HOST, engineRoutingRefusal, remoteResumeWarning, init_engineTarget = __esm({
+var ENGINE_URL_ENV, TRUSTED_ENGINE_HOSTS_KEY, isLoopbackEngineUrl, isEngineTransportError, enginePinUnreachable, SYNC_ENGINE_URL_ENV, AUTO_SYNC_SOURCE_LABEL, AUTO_SYNC_LOCKED_BY_POLICY_ERROR, DEFAULT_BIND_HOST, engineRoutingRefusal, remoteResumeWarning, init_engineTarget = __esm({
   "build-src/src/sema/engineTarget.ts"() {
     init_concurrencyTestHooks();
     init_envUtils();
@@ -178460,8 +178623,10 @@ var ENGINE_URL_ENV, TRUSTED_ENGINE_HOSTS_KEY, enginePinUnreachable, SYNC_ENGINE_
     init_enginePortDerive();
     init_envKnobs();
     init_cloudExecutionPolicy();
+    init_dist();
     ENGINE_URL_ENV = "SEMA_ENGINE_URL", TRUSTED_ENGINE_HOSTS_KEY = "trustedEngineHosts";
-    enginePinUnreachable = null;
+    isLoopbackEngineUrl = isLoopbackWireUrl;
+    isEngineTransportError = isWireTransportError, enginePinUnreachable = null;
     SYNC_ENGINE_URL_ENV = "SEMA_SYNC_ENGINE_URL", AUTO_SYNC_SOURCE_LABEL = {
       "sync-target": "sync target",
       "org-default": "org default",
@@ -178771,67 +178936,9 @@ var mockClientIds, init_mockClient = __esm({
 });
 
 // build-src/src/sema/armedGateRegistry.ts
-function emitGateArmedEvent(key) {
-  for (let listener5 of [...armedListeners])
-    try {
-      listener5(key);
-    } catch {
-    }
-}
-function registerArmedGate2(key) {
-  typeof key != "string" || key.length === 0 || (armedKeys.add(key), emitGateArmedEvent(key));
-}
-function wasGateArmed2(key) {
-  return typeof key == "string" && key.length > 0 && armedKeys.has(key);
-}
-function onGateArmed(listener5) {
-  return armedListeners.add(listener5), () => {
-    armedListeners.delete(listener5);
-  };
-}
-function gateArmedWaitMs() {
-  return gateArmedWaitOverrideMs ?? GATE_ARMED_WAIT_MS;
-}
-function waitForGateArmed(keys2, timeoutMs) {
-  let wanted = new Set(keys2.filter((k2) => typeof k2 == "string" && k2.length > 0));
-  return wanted.size === 0 ? Promise.resolve(!1) : new Promise((resolve57) => {
-    let listener5 = (key) => {
-      wanted.has(key) && (armedListeners.delete(listener5), clearTimeout(timer2), resolve57(!0));
-    };
-    armedListeners.add(listener5);
-    let timer2 = setTimeout(() => {
-      armedListeners.delete(listener5), resolve57(!1);
-    }, timeoutMs);
-  });
-}
-function armedKeyFromQuestionId2(questionId) {
-  let trimmed2 = armedKeyFromQuestionId(questionId);
-  return trimmed2.startsWith(PLAN_REVIEW_QUESTION_ID_PREFIX) ? planReviewArmedKey(trimmed2.slice(PLAN_REVIEW_QUESTION_ID_PREFIX.length)) : trimmed2;
-}
-function registerArmedGateFromQuestionId2(questionId) {
-  if (typeof questionId != "string" || questionId.length === 0) return;
-  let normalized = armedKeyFromQuestionId2(questionId);
-  registerArmedGate2(normalized), questionId !== normalized && emitGateArmedEvent(questionId);
-}
-function planReviewArmedKey(taskId) {
-  let gen = planReviewGenByTask.get(taskId) ?? 0, canonical2 = planReviewQuestionId(taskId);
-  return gen > 0 ? `${canonical2}#g${String(gen)}` : canonical2;
-}
-function notePlanReviewAnswered(questionId) {
-  if (typeof questionId != "string" || !questionId.startsWith(PLAN_REVIEW_QUESTION_ID_PREFIX) || notedPlanReviewQuestionIds.has(questionId)) return;
-  notedPlanReviewQuestionIds.add(questionId);
-  let base = questionId.slice(PLAN_REVIEW_QUESTION_ID_PREFIX.length), cut = base.indexOf(REOPEN_ID_TAIL), taskId = cut >= 0 ? base.slice(0, cut) : base;
-  taskId.length !== 0 && planReviewGenByTask.set(taskId, (planReviewGenByTask.get(taskId) ?? 0) + 1);
-}
-function notePlanReviewAnsweredIfDecisive(questionId, answer) {
-  planReviewDecisionFromAnswer(answer ?? { answers: [] }) !== "dismissed" && notePlanReviewAnswered(questionId);
-}
-var armedKeys, armedListeners, GATE_ARMED_WAIT_MS, gateArmedWaitOverrideMs, planReviewGenByTask, notedPlanReviewQuestionIds, init_armedGateRegistry2 = __esm({
+var init_armedGateRegistry2 = __esm({
   "build-src/src/sema/armedGateRegistry.ts"() {
     init_dist();
-    armedKeys = /* @__PURE__ */ new Set(), armedListeners = /* @__PURE__ */ new Set();
-    GATE_ARMED_WAIT_MS = 5e3, gateArmedWaitOverrideMs = null;
-    planReviewGenByTask = /* @__PURE__ */ new Map(), notedPlanReviewQuestionIds = /* @__PURE__ */ new Set();
   }
 });
 
@@ -178878,81 +178985,33 @@ __export(planReviewReopen_exports, {
   _resetPlanReviewReopenSeqForTest: () => _resetPlanReviewReopenSeqForTest,
   reopenPlanReviewCard: () => reopenPlanReviewCard2
 });
-function retireActiveReopen2(canonicalId) {
-  let prev = activeReopenByCanonical.get(canonicalId);
-  if (prev) {
-    activeReopenByCanonical.delete(canonicalId);
+function deliverPlanReviewDecision(taskId, decision) {
+  decidePlanReview(taskId, decision).catch((e) => {
     try {
-      prev.unregister();
+      let line = "sema: your plan review decision could not be delivered to the engine \u2014 the session may still be held; send your message again to retry";
+      surfaceTranscriptSystemNotice(line) || process.stderr.write(`${line}
+`), process.env.SEMA_DEBUG && console.error(`[sema][planReviewReopen] decide (${decision}, run ${taskId}) threw unexpectedly: ${String(e)}`);
     } catch {
     }
-    publishQuestionFrame({ type: "question_complete", questionId: prev.questionId });
-  }
+  });
 }
 function _resetPlanReviewReopenSeqForTest() {
-  reopenSeq = 0;
-  for (let [, entry] of activeReopenByCanonical)
-    try {
-      entry.unregister();
-    } catch (e) {
-      failOpen("plan-review-reopen-unregister", void 0, String(e));
-    }
-  activeReopenByCanonical.clear();
+  _resetActiveReopenRespondersForTest();
 }
 async function reopenPlanReviewCard2(taskId) {
-  try {
-    if (typeof taskId != "string" || taskId.length === 0) return { reopened: !1 };
-    if (!hasQuestionOverlay()) return { reopened: !1 };
-    let armedKey = planReviewArmedKey(taskId), firstSight = !wasGateArmed2(armedKey), canonicalId = planReviewQuestionId(taskId);
-    retireActiveReopen2(canonicalId), reopenSeq += 1;
-    let questionId = `${canonicalId}${REOPEN_ID_TAIL}${String(reopenSeq)}`, unregister = registerLocalQuestionResponder(questionId, async (id, answer) => {
-      activeReopenByCanonical.get(canonicalId)?.questionId === questionId && activeReopenByCanonical.delete(canonicalId);
-      let decision = planReviewDecisionFromAnswer(answer);
-      return decision === "dismissed" ? { ok: !0 } : (notePlanReviewAnswered(id), decidePlanReview(taskId, decision).catch((e) => {
-        try {
-          let line = "sema: your plan review decision could not be delivered to the engine \u2014 the session may still be held; send your message again to retry";
-          surfaceTranscriptSystemNotice(line) || process.stderr.write(`${line}
-`), process.env.SEMA_DEBUG && console.error(`[sema][planReviewReopen] decide (${decision}, run ${taskId}) threw unexpectedly: ${String(e)}`);
-        } catch {
-        }
-      }), { ok: !0 });
-    });
-    activeReopenByCanonical.set(canonicalId, { questionId, unregister });
-    let frame = {
-      type: "question",
-      questionId,
-      questions: [
-        {
-          header: "Plan review",
-          question: "This plan is still waiting for your review \u2014 it is what is holding this session. Approve it and start the implementation?",
-          options: [
-            {
-              label: APPROVE_LABEL2,
-              description: "Resume the task now and execute the plan (runs to completion engine-side)"
-            },
-            {
-              label: REJECT_LABEL2,
-              description: "Discard this plan and stay in plan mode to refine it"
-            }
-          ],
-          multiSelect: !1
-        }
-      ]
-    }, receipt = waitForGateArmed([questionId], gateArmedWaitMs());
-    return publishQuestionFrame(frame), await receipt ? { reopened: !0, firstSight } : (process.env.SEMA_DEBUG && console.error(
-      `[sema][planReviewReopen] question frame ${questionId} published but no presentation receipt arrived within ${String(gateArmedWaitMs())}ms \u2014 reporting reopened:false (the overlay did not enqueue the card)`
-    ), { reopened: !1 });
-  } catch {
-    return { reopened: !1 };
-  }
+  let verdict = await reopenPlanReviewCard(taskId, {
+    presentationReceiptMs: gateArmedWaitMs(),
+    deliverDecision: deliverPlanReviewDecision
+  });
+  return verdict.reopened === !1 && process.env.SEMA_DEBUG && console.error(
+    hasQuestionOverlay() ? `[sema][planReviewReopen] reopen for task ${taskId} got no presentation receipt within ${String(gateArmedWaitMs())}ms \u2014 reporting reopened:false (the overlay did not enqueue the card)` : `[sema][planReviewReopen] reopen for task ${taskId} has no overlay subscriber (headless / REPL not mounted) \u2014 reporting reopened:false`
+  ), verdict;
 }
-var APPROVE_LABEL2, REJECT_LABEL2, reopenSeq, activeReopenByCanonical, init_planReviewReopen = __esm({
+var init_planReviewReopen = __esm({
   "build-src/src/sema/planReviewReopen.ts"() {
     init_dist();
     init_armedGateRegistry2();
     init_transcriptSystemNotice();
-    init_failOpen();
-    APPROVE_LABEL2 = PLAN_REVIEW_APPROVE_LABEL, REJECT_LABEL2 = PLAN_REVIEW_REJECT_LABEL, reopenSeq = 0, activeReopenByCanonical = /* @__PURE__ */ new Map();
   }
 });
 
@@ -178960,7 +179019,7 @@ var APPROVE_LABEL2, REJECT_LABEL2, reopenSeq, activeReopenByCanonical, init_plan
 function retryDelayMs() {
   return delayOverrideMs ?? DECIDE_RETRY_DELAY_MS;
 }
-function sleep4(ms) {
+function sleep3(ms) {
   return new Promise((resolve57) => {
     setTimeout(resolve57, ms);
   });
@@ -178986,7 +179045,7 @@ async function attemptDecideWithOneRetry(opts) {
       }
     process.env.SEMA_DEBUG && console.error(
       `[sema][decideRetry] ${opts.label} failed (${first.detail}) \u2014 retrying once in ${String(retryDelayMs())}ms`
-    ), await sleep4(retryDelayMs());
+    ), await sleep3(retryDelayMs());
     let second = await opts.attempt();
     return second.ok ? !0 : (surface(second.detail), !1);
   } catch (e) {
@@ -179010,8 +179069,8 @@ __export(askParkReopen_exports, {
   countOwnedPendingApprovals: () => countOwnedPendingApprovals,
   reopenAskParkCard: () => reopenAskParkCard
 });
-async function countOwnedPendingApprovals(client3) {
-  return ((await client3.approvals.list()).pending ?? []).filter((row2) => pendingRowIsOwnedByThisSession(row2, ownershipDeps)).length;
+async function countOwnedPendingApprovals(client3, signal) {
+  return ((await client3.approvals.list(signal ? { signal } : void 0)).pending ?? []).filter((row2) => pendingRowIsOwnedByThisSession(row2, ownershipDeps)).length;
 }
 function reopenAskParkCard(taskId, client3, signal) {
   if (typeof taskId != "string" || taskId.length === 0) return Promise.resolve({ reopened: !1 });
@@ -179095,7 +179154,7 @@ function armPendingRowCoalesced(flight, taskId, pending2, client3) {
 }
 async function armPendingRow(taskId, pending2, client3, identity3) {
   try {
-    let { rowTaskId, gatedCallId, armedKey } = identity3, firstSight = !wasGateArmed2(armedKey), rowStillPending = async () => {
+    let { rowTaskId, gatedCallId, armedKey } = identity3, firstSight = !wasGateArmed(armedKey), rowStillPending = async () => {
       try {
         return askParkRowStillPending((await client3.approvals.list()).pending, identity3);
       } catch {
@@ -179119,8 +179178,8 @@ async function armPendingRow(taskId, pending2, client3, identity3) {
           `[sema][askParkReopen] row (task ${rowTaskId}) routed to the question arm but carries no question payload \u2014 refusing to mint an empty card, reporting reopened:false`
         ), { kind: "verdict", verdict: { reopened: !1 } };
       let attributedQuestions = rowTaskId !== taskId ? questions.map((q2, i) => i === 0 ? { ...q2, question: `[pending on run ${rowTaskId}] ${q2.question}` } : q2) : questions;
-      reopenSeq2 += 1;
-      let questionId = `ask-park:${rowTaskId}${REOPEN_ID_TAIL}${String(reopenSeq2)}`, unregister = registerLocalQuestionResponder(questionId, async (_id, answer) => {
+      reopenSeq += 1;
+      let questionId = `ask-park:${rowTaskId}${REOPEN_ID_TAIL}${String(reopenSeq)}`, unregister = registerLocalQuestionResponder(questionId, async (_id, answer) => {
         try {
           unregister();
         } catch (e) {
@@ -179151,7 +179210,7 @@ async function armPendingRow(taskId, pending2, client3, identity3) {
         questionId,
         questions: attributedQuestions
       }, receipt2 = waitForGateArmed([questionId], gateArmedWaitMs());
-      return publishQuestionFrame(frame), await receipt2 ? (registerArmedGate2(armedKey), { kind: "verdict", verdict: { reopened: !0, firstSight } }) : (process.env.SEMA_DEBUG && console.error(
+      return publishQuestionFrame(frame), await receipt2 ? (registerArmedGate(armedKey), { kind: "verdict", verdict: { reopened: !0, firstSight } }) : (process.env.SEMA_DEBUG && console.error(
         `[sema][askParkReopen] question frame ${questionId} published but no presentation receipt arrived within ${String(gateArmedWaitMs())}ms \u2014 reporting reopened:false (the overlay did not enqueue the card)`
       ), { kind: "verdict", verdict: { reopened: !1 } });
     }
@@ -179201,14 +179260,14 @@ async function armPendingRow(taskId, pending2, client3, identity3) {
     ), { kind: "verdict", verdict: { reopened: !1 } };
   }
 }
-var reopenSeq2, ownershipDeps, inFlightReopenByTask, rowWaitOverrideMs, rowPollOverrideMs, rowArmFlightEpoch, rowArmFlight, init_askParkReopen = __esm({
+var reopenSeq, ownershipDeps, inFlightReopenByTask, rowWaitOverrideMs, rowPollOverrideMs, rowArmFlightEpoch, rowArmFlight, init_askParkReopen = __esm({
   "build-src/src/sema/askParkReopen.ts"() {
     init_dist();
     init_liveSessionStore();
     init_armedGateRegistry2();
     init_decideRetry();
     init_failOpen();
-    reopenSeq2 = 0, ownershipDeps = {
+    reopenSeq = 0, ownershipDeps = {
       currentSessionId: getLiveSessionId,
       isOwnRun: (taskIdTail) => {
         if (isOwnEngineRun(taskIdTail)) return !0;
@@ -179528,7 +179587,7 @@ async function* withInteractiveReattach(live, o) {
   }
 }
 async function* reattachLoop(machine, taskId, deps2, readLastEventId, writeLastEventId, originalTear) {
-  let { windowMs } = tuning(), now2 = deps2.now ?? Date.now, sleep10 = deps2.sleep ?? abortAwareSleep, log2 = deps2.log ?? (() => {
+  let { windowMs } = tuning(), now2 = deps2.now ?? Date.now, sleep9 = deps2.sleep ?? abortAwareSleep, log2 = deps2.log ?? (() => {
   }), deadline = now2() + windowMs, attempt = 0, lastState2 = null, serverRetryAfterMs;
   for (log2(`[sema][reattach] live stream tore mid-turn for run ${taskId} \u2014 entering the reattach window (${String(windowMs)}ms)`); !machine.stopped && now2() < deadline; ) {
     attempt += 1, machine.noteAttempt(attempt), machine.setPhase("probing");
@@ -179568,7 +179627,7 @@ async function* reattachLoop(machine, taskId, deps2, readLastEventId, writeLastE
     if (machine.stopped) break;
     let backoff3 = reattachBackoffMs(attempt), delay = serverRetryAfterMs !== void 0 ? Math.max(backoff3, serverRetryAfterMs) : backoff3;
     if (serverRetryAfterMs = void 0, now2() + delay >= deadline) break;
-    machine.setPhase("waiting"), await sleep10(delay, machine.signal);
+    machine.setPhase("waiting"), await sleep9(delay, machine.signal);
   }
   if (machine.stopped) {
     log2(`[sema][reattach] reconnect stopped by the user after ${String(attempt)} attempt(s) \u2014 no further requests`);
@@ -180790,11 +180849,6 @@ var MONTH_ABBR, init_quotaExhaustedCopy = __esm({
 });
 
 // build-src/src/sema/scenarioNotAllowedCopy.ts
-function scenarioDenyFromError(err8) {
-  if (typeof err8 != "object" || err8 === null) return null;
-  let e = err8;
-  return e.status !== 400 || e.errorCode !== "scenario_not_allowed" ? null : { allowlist: Array.isArray(e.allowlist) ? e.allowlist.filter((x3) => typeof x3 == "string" && x3.length > 0) : [] };
-}
 function scenarioNotAllowedContent(detail, requestedScenario) {
   let parts = [];
   return parts.push(
@@ -180803,6 +180857,7 @@ function scenarioNotAllowedContent(detail, requestedScenario) {
 }
 var init_scenarioNotAllowedCopy = __esm({
   "build-src/src/sema/scenarioNotAllowedCopy.ts"() {
+    init_dist();
   }
 });
 
@@ -182142,7 +182197,7 @@ async function killEngineChildWithAutopsyWindow(child, opts) {
   let t0 = Date.now();
   for (; Date.now() - t0 < windowMs; ) {
     if (child.exitCode !== null || child.signalCode !== null) return;
-    await sleep5(pollMs);
+    await sleep4(pollMs);
   }
   if (child.exitCode === null && child.signalCode === null)
     try {
@@ -182480,18 +182535,18 @@ async function reapStaleEngine(portFile, opts) {
     };
     signal("SIGTERM");
     let t0 = Date.now();
-    for (; Date.now() - t0 < SHUTDOWN_GRACE_MS && isProcessAlive(portFile.pid); ) await sleep5(200);
+    for (; Date.now() - t0 < SHUTDOWN_GRACE_MS && isProcessAlive(portFile.pid); ) await sleep4(200);
     if (isProcessAlive(portFile.pid)) {
       logForDebugging(
         `[engine-lifecycle] reap pid=${portFile.pid}: no exit in ${SHUTDOWN_GRACE_MS}ms \u2192 second SIGTERM (engine hardShutdown)`
       ), signal("SIGTERM");
       let t1 = Date.now();
-      for (; Date.now() - t1 < SHUTDOWN_SECOND_TERM_GRACE_MS && isProcessAlive(portFile.pid); ) await sleep5(200);
+      for (; Date.now() - t1 < SHUTDOWN_SECOND_TERM_GRACE_MS && isProcessAlive(portFile.pid); ) await sleep4(200);
     }
     if (isProcessAlive(portFile.pid)) {
       logForDebugging(`[engine-lifecycle] reap pid=${portFile.pid}: still alive after second SIGTERM \u2192 SIGKILL`), signal("SIGKILL");
       let t2 = Date.now();
-      for (; Date.now() - t2 < 2e3 && isProcessAlive(portFile.pid); ) await sleep5(200);
+      for (; Date.now() - t2 < 2e3 && isProcessAlive(portFile.pid); ) await sleep4(200);
     }
   }
   let portPath = getEnginePortFilePath();
@@ -182756,7 +182811,7 @@ async function waitForLockOrAttach(portFilePath, configHome) {
   let budget = engineLockWaitBudgetMs(), t0 = Date.now();
   for (; Date.now() - t0 < budget; ) {
     let remaining = budget - (Date.now() - t0);
-    await sleep5(Math.max(1, Math.min(ENGINE_LOCK_WAIT_POLL_MS, remaining)));
+    await sleep4(Math.max(1, Math.min(ENGINE_LOCK_WAIT_POLL_MS, remaining)));
     try {
       let release2 = await lock(portFilePath, { stale: LOCK_OPTS2.stale });
       return logForDebugging(
@@ -182842,11 +182897,11 @@ async function waitForHealthy(port2, child) {
     if (delay === null) break;
     delay === HEALTH_POLL_EXTENDED_INTERVAL_MS && !extensionLogged && (extensionLogged = !0, logForDebugging(
       "[engine-lifecycle] engine is slow to start (possibly high load) \u2014 child is alive, extending health wait to 60s total"
-    )), await sleep5(delay);
+    )), await sleep4(delay);
   }
   return await probeHealth(port2);
 }
-function sleep5(ms) {
+function sleep4(ms) {
   return new Promise((resolve57) => setTimeout(resolve57, ms));
 }
 function startHealthCheckLoop(instance2, onDead) {
@@ -182967,7 +183022,7 @@ async function runEngineDeadRespawn(deps2) {
     "[engine-lifecycle] host terminal is gone \u2014 refusing engine respawn, shutting down the orphaned shell"
   ), teardownOwnedEngineSync("orphan-respawn-guard"), process.exit(129)), deadRespawnInFlight) return !1;
   deadRespawnInFlight = !0;
-  let now2 = deps2.now ?? Date.now, doSleep = deps2.sleep ?? sleep5, backoff3 = deps2.backoffMs ?? [1e3, 5e3, 15e3];
+  let now2 = deps2.now ?? Date.now, doSleep = deps2.sleep ?? sleep4, backoff3 = deps2.backoffMs ?? [1e3, 5e3, 15e3];
   try {
     let t2 = now2();
     if (lastRespawnOkAt !== null && t2 - lastRespawnOkAt >= CRASH_LOOP_WINDOW_MS && (cooldownRetryLevel = 0, cooldownRetriesUsed = 0, cooldownSpentMs = 0), recentDeathTimestamps = recentDeathTimestamps.filter((d4) => t2 - d4 < CRASH_LOOP_WINDOW_MS), recentDeathTimestamps.push(t2), recentDeathTimestamps.length > CRASH_LOOP_MAX_DEATHS) {
@@ -183167,7 +183222,7 @@ async function waitForExit(pid, timeoutMs) {
   let deadline = Date.now() + timeoutMs;
   for (; Date.now() < deadline; ) {
     if (!isProcessAlive(pid)) return !0;
-    await sleep5(100);
+    await sleep4(100);
   }
   return !isProcessAlive(pid);
 }
@@ -183910,7 +183965,7 @@ __export(seamQuery_exports, {
   SCENARIO_KEYS: () => SCENARIO_KEYS,
   canUseTool: () => canUseTool,
   cancelEngineRun: () => cancelEngineRun,
-  drainingRetryDelayMs: () => drainingRetryDelayMs,
+  drainingRetryDelayMs: () => drainingRetryDelayMs2,
   getSeamHitlClient: () => getSeamHitlClient,
   getSeamMcp: () => getSeamMcp,
   getSeamSandbox: () => getSeamSandbox,
@@ -183945,22 +184000,10 @@ function hasHitlVerbs(c2) {
   return typeof o.approvals?.list == "function" && typeof o.approvals?.decide == "function" && typeof o.assistant?.planReview == "function" && typeof o.assistant?.resume == "function";
 }
 function setDrainingBackoffForTest(ms) {
-  drainingBackoffMs = ms && ms.length > 0 ? ms : DEFAULT_DRAINING_BACKOFF_MS;
+  drainingBackoffMs = ms && ms.length > 0 ? ms : void 0;
 }
-function isPreStreamDrainingReject(err8) {
-  let e = err8;
-  return typeof e?.status == "number" && e.status === 503 && e.errorCode === "draining";
-}
-function isResumeAtRejection(err8) {
-  let e = err8;
-  return typeof e?.errorCode == "string" && e.errorCode.startsWith("resume_at.");
-}
-function drainingRetryDelayMs(err8, attempt) {
-  let ra = err8?.retryAfterMs;
-  if (typeof ra == "number" && Number.isFinite(ra) && ra >= 0)
-    return Math.min(ra, DRAINING_RETRY_AFTER_CAP_MS);
-  let ladder = drainingBackoffMs;
-  return ladder[Math.min(attempt, ladder.length - 1)] ?? 1e3;
+function drainingRetryDelayMs2(err8, attempt) {
+  return drainingRetryDelayMs(err8, attempt, drainingBackoffMs ? { ladder: drainingBackoffMs } : void 0);
 }
 function isBgHeadlessWorker() {
   return process.env.SEMA_CODE_SESSION_KIND === "bg" && !!process.env.SEMA_JOB_DIR && !!process.env.SEMA_LIVE_BASEURL;
@@ -184274,23 +184317,18 @@ ${objective}`, process.env.SEMA_DEBUG && console.error("[sema][seamQuery] interr
   );
 }
 function semaApiErrorContent(err8, requestedScenario) {
-  let e = err8;
-  if (typeof e?.status == "number") {
-    let code2 = typeof e.errorCode == "string" && e.errorCode.length > 0 ? ` ${e.errorCode}` : "", msg = typeof e.message == "string" && e.message.length > 0 ? e.message : String(err8), lines = [`${API_ERROR_PREFIX}: ${e.status}${code2} \xB7 ${msg}`], supplement = semaApiErrorSupplement(err8, requestedScenario);
+  let verdict = classifyTurnWireError(err8);
+  if (verdict.kind === "http") {
+    let code2 = verdict.errorCode !== void 0 ? ` ${verdict.errorCode}` : "", lines = [`${API_ERROR_PREFIX}: ${verdict.status}${code2} \xB7 ${verdict.message}`], supplement = semaApiErrorSupplement(err8, requestedScenario);
     supplement && lines.push(supplement);
     let sandboxHint = sandboxDegradeHint(err8);
     return sandboxHint && lines.push(sandboxHint), lines.join(`
 `);
   }
-  let cause = e?.cause, detail = typeof cause?.message == "string" && cause.message.length > 0 && cause.message || typeof e?.message == "string" && e.message.length > 0 && e.message || String(err8), isNetworkError = e?.cause !== void 0 || /fetch failed|ECONNREFUSED|ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|EHOSTUNREACH|ENETUNREACH|EPIPE|socket hang up|UND_ERR|terminated|other side closed/i.test(
-    detail
-  );
-  if (err8 instanceof Error && err8.name === "StreamEndedWithoutTerminalError")
+  if (verdict.kind === "stream-ended-without-terminal")
     return `${API_ERROR_PREFIX}: the event stream ended while the run had not reached a terminal state \u2014 the run is likely parked waiting for an approval decision (suspended / needs_review), not crashed. Check /tasks for its real status and decide any pending approval; the turn did not complete on this screen.`;
-  if (!isNetworkError) {
-    let name = err8 instanceof Error ? err8.name : typeof err8;
-    return `${API_ERROR_PREFIX}: internal shell error (${name}: ${detail}) \u2014 this is a bug in the sema shell, not an engine outage; the turn did not complete. Re-run with SEMA_DEBUG=1 and report it.`;
-  }
+  if (verdict.kind === "internal")
+    return `${API_ERROR_PREFIX}: internal shell error (${verdict.name}: ${verdict.detail}) \u2014 this is a bug in the sema shell, not an engine outage; the turn did not complete. Re-run with SEMA_DEBUG=1 and report it.`;
   let pinHint = "";
   try {
     let pin = activeEnginePin();
@@ -184298,7 +184336,7 @@ function semaApiErrorContent(err8, requestedScenario) {
 ${enginePinUnreachableHint(pin)}`);
   } catch {
   }
-  return `${API_ERROR_PREFIX}: ${detail} \xB7 the engine is unreachable \u2014 your message did not run; check the engine is up, then send it again.${pinHint}`;
+  return `${API_ERROR_PREFIX}: ${verdict.detail} \xB7 the engine is unreachable \u2014 your message did not run; check the engine is up, then send it again.${pinHint}`;
 }
 function apiErrorRow(content) {
   return createAssistantAPIErrorMessage({ content, error: "unknown" });
@@ -184445,7 +184483,7 @@ Fix: run \`sema doctor\` to diagnose, or restart sema to retry.`
               let notice = fileLinkNoticeText(ev);
               notice !== null && surfaceFileLinkNotice(notice);
             }
-            let busy = activeRunBusySignal2(ev);
+            let busy = activeRunBusySignal(ev);
             if (busy) {
               busySignal = busy;
               return;
@@ -184501,7 +184539,9 @@ Fix: run \`sema doctor\` to diagnose, or restart sema to retry.`
                 // **属主** pending 行数,恰 0 = 脏值正面证据 ⇒ 放行真分诊;归属过滤见
                 // countOwnedPendingApprovals 头注(引擎全局队列有别家陈年行,裸计数恒非零
                 // = 防御恒不触发)。mock 车道无 approvals 面 ⇒ 读口不装 = 旧行为(S-g)。
-                listOwnedPendingApprovals: () => countOwnedPendingApprovals(hitl)
+                // 🔴 opts.signal = 包内复核竞速的合流截止口(4s 窗 × turn Esc),透传进
+                // approvals.list —— 超时/中止掐的是底层请求,不是只掐 await(复审轮二)。
+                listOwnedPendingApprovals: (opts) => countOwnedPendingApprovals(hitl, opts?.signal)
               } : {};
             })(),
             // C3([3777]/[3779])running 形的三选卡口。**一条用户消息至多一张**(runningChoiceOffered
@@ -184521,14 +184561,14 @@ Fix: run \`sema doctor\` to diagnose, or restart sema to retry.`
             //    车B 的消费面(deps.signal)逐字不变。
             ...signal ? { signal } : {}
           });
-          if (yield apiErrorRow(activeRunSelfHealRow2(outcome, detectedBusy)), outcome.kind === "running-cancelled" && !signal?.aborted) {
+          if (yield apiErrorRow(activeRunSelfHealRow(outcome, detectedBusy)), outcome.kind === "running-cancelled" && !signal?.aborted) {
             retryStream = !0;
             continue;
           }
         }
       } catch (err8) {
         if (!signal?.aborted && !engineFrameSeen && isPreStreamDrainingReject(err8) && drainingRetries < DRAINING_MAX_RETRIES) {
-          let waitMs = drainingRetryDelayMs(err8, drainingRetries);
+          let waitMs = drainingRetryDelayMs2(err8, drainingRetries);
           if (drainingRetries++, process.env.SEMA_DEBUG && console.error(
             `[sema][seamQuery] engine draining (pre-stream 503) \u2014 retrying submit ${drainingRetries}/${DRAINING_MAX_RETRIES} in ${waitMs}ms`
           ), await new Promise((res) => setTimeout(res, waitMs)), !signal?.aborted) {
@@ -184741,7 +184781,7 @@ function resumeRunningArmWiring() {
     shellSessionId: () => getSessionId()
   };
 }
-var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, DEFAULT_DRAINING_BACKOFF_MS, DRAINING_RETRY_AFTER_CAP_MS, drainingBackoffMs, client, clientExplicitlySet, seamSettings, seamWebSearch, seamSkills, seamMcp, seamRewindCapture, seamPendingRewind, INTERRUPT_WIRE_MARKER, seamPendingInterrupt, seamHistorySeedPending, seamSandbox, seamAutoSandboxInjected, HISTORY_SEED_MAX_CHARS, SCENARIO_KEYS, API_ERROR_PREFIX, defaultGatePrompt, canUseTool, RUN_PROBE_TIMEOUT_MS, init_seamQuery = __esm({
+var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, drainingBackoffMs, client, clientExplicitlySet, seamSettings, seamWebSearch, seamSkills, seamMcp, seamRewindCapture, seamPendingRewind, INTERRUPT_WIRE_MARKER, seamPendingInterrupt, seamHistorySeedPending, seamSandbox, seamAutoSandboxInjected, HISTORY_SEED_MAX_CHARS, SCENARIO_KEYS, API_ERROR_PREFIX, defaultGatePrompt, canUseTool, RUN_PROBE_TIMEOUT_MS, init_seamQuery = __esm({
   "build-src/src/sema/seamQuery.ts"() {
     init_adapter();
     init_dist();
@@ -184763,6 +184803,7 @@ var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, DEFAULT_DRAI
     init_dist();
     init_dist();
     init_dist();
+    init_dist();
     init_deferSessionExemption();
     init_debug();
     init_hooksWireCaps2();
@@ -184798,7 +184839,7 @@ var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, DEFAULT_DRAI
     init_log2();
     init_engineRuntimeStatus();
     init_activeRunSelfHeal2();
-    BG_TEAR_MAX_RESENDS = 2, BG_RECOVERY_WAIT_MS = 12e4, DRAINING_MAX_RETRIES = 3, DEFAULT_DRAINING_BACKOFF_MS = [1e3, 2e3, 4e3], DRAINING_RETRY_AFTER_CAP_MS = 15e3, drainingBackoffMs = DEFAULT_DRAINING_BACKOFF_MS;
+    BG_TEAR_MAX_RESENDS = 2, BG_RECOVERY_WAIT_MS = 12e4, DRAINING_MAX_RETRIES = 3;
     client = makeMockClient(), clientExplicitlySet = !1;
     seamRewindCapture = !0;
     INTERRUPT_WIRE_MARKER = "[Request interrupted by user]", seamPendingInterrupt = !1;
@@ -201033,7 +201074,7 @@ var require_ceylon = __commonJS({
 // node_modules/highlight.js/lib/languages/clean.js
 var require_clean2 = __commonJS({
   "node_modules/highlight.js/lib/languages/clean.js"(exports2, module2) {
-    function clean5(hljs2) {
+    function clean6(hljs2) {
       return {
         name: "Clean",
         aliases: [
@@ -201089,7 +201130,7 @@ var require_clean2 = __commonJS({
         ]
       };
     }
-    module2.exports = clean5;
+    module2.exports = clean6;
   }
 });
 
@@ -257943,7 +257984,7 @@ function stripUnderlineAnsi(content) {
 }
 var import_compiler_runtime24, React16, import_jsx_runtime27, MAX_JSON_FORMAT_LENGTH, URL_IN_JSON, init_OutputLine = __esm({
   "build-src/src/components/shell/OutputLine.tsx"() {
-    import_compiler_runtime24 = __toESM(require_compiler_runtime(), 1), React16 = __toESM(require_react(), 1);
+    import_compiler_runtime24 = __toESM(require_compiler_runtime()), React16 = __toESM(require_react());
     init_useTerminalSize();
     init_ink2();
     init_hyperlink();
@@ -257952,7 +257993,7 @@ var import_compiler_runtime24, React16, import_jsx_runtime27, MAX_JSON_FORMAT_LE
     init_MessageResponse();
     init_messageActions();
     init_ExpandShellOutputContext();
-    import_jsx_runtime27 = __toESM(require_jsx_runtime(), 1);
+    import_jsx_runtime27 = __toESM(require_jsx_runtime());
     MAX_JSON_FORMAT_LENGTH = 1e4;
     URL_IN_JSON = /https?:\/\/[^\s"'<>\\]+/g;
   }
@@ -262544,7 +262585,7 @@ var import_xss2, AUTH_REQUEST_TIMEOUT_MS, MAX_LOCK_RETRIES, SENSITIVE_OAUTH_PARA
               logMCPDebug(
                 this.serverName,
                 `Refresh lock held by another process, waiting (attempt ${retry + 1}/${MAX_LOCK_RETRIES})`
-              ), await sleep3(1e3 + Math.random() * 1e3);
+              ), await sleep2(1e3 + Math.random() * 1e3);
               continue;
             }
             logMCPDebug(
@@ -262685,7 +262726,7 @@ var import_xss2, AUTH_REQUEST_TIMEOUT_MS, MAX_LOCK_RETRIES, SENSITIVE_OAUTH_PARA
             logMCPDebug(
               this.serverName,
               `Token refresh failed, retrying in ${delayMs}ms (attempt ${attempt}/3)`
-            ), await sleep3(delayMs);
+            ), await sleep2(delayMs);
           }
       }
     };
@@ -263926,7 +263967,7 @@ async function findAvailableIDE() {
   let startTime = Date.now();
   for (; Date.now() - startTime < 3e4 && !signal.aborted; ) {
     if (getIsScrollDraining()) {
-      await sleep3(1e3, signal);
+      await sleep2(1e3, signal);
       continue;
     }
     let ides = await detectIDEs(!1);
@@ -263934,7 +263975,7 @@ async function findAvailableIDE() {
       return null;
     if (ides.length === 1)
       return ides[0];
-    await sleep3(1e3, signal);
+    await sleep2(1e3, signal);
   }
   return null;
 }
@@ -264038,7 +264079,7 @@ async function installIDEExtension(ideType) {
         return await installFromArtifactory(command8);
       let version4 = await getInstalledVSCodeExtensionVersion(command8);
       if (!version4 || lt(version4, getClaudeCodeVersion())) {
-        await sleep3(500);
+        await sleep2(500);
         let result = await execFileNoThrowWithCwd(
           command8,
           ["--force", "--install-extension", "anthropic.claude-code"],
@@ -264306,7 +264347,7 @@ async function installFromArtifactory(command8) {
       }), writeStream = getFsImplementation().createWriteStream(tempVsixPath);
       await new Promise((resolve57, reject3) => {
         vsixResponse.data.pipe(writeStream), writeStream.on("finish", resolve57), writeStream.on("error", reject3);
-      }), await sleep3(500);
+      }), await sleep2(500);
       let result = await execFileNoThrowWithCwd(
         command8,
         ["--force", "--install-extension", tempVsixPath],
@@ -268672,18 +268713,17 @@ var FINGERPRINT_SALT, init_fingerprint = __esm({
 
 // build-src/src/sema/livePrincipal.ts
 function resolveLivePrincipal() {
-  let v2 = process.env.SEMA_LIVE_PRINCIPAL;
-  return v2 && v2.trim() !== "" ? v2 : void 0;
+  return normalizeWirePrincipal(process.env.SEMA_LIVE_PRINCIPAL);
 }
 function resolveFleetPrincipal() {
-  let v2 = process.env.SEMA_FLEET_PRINCIPAL;
-  return v2 && v2.trim() !== "" ? v2 : resolveLivePrincipal();
+  return normalizeWirePrincipal(process.env.SEMA_FLEET_PRINCIPAL) ?? resolveLivePrincipal();
 }
 function describeLivePrincipal() {
   return resolveLivePrincipal() ?? "absent(owner-null)";
 }
 var init_livePrincipal = __esm({
   "build-src/src/sema/livePrincipal.ts"() {
+    init_dist();
   }
 });
 
@@ -270679,7 +270719,7 @@ var McpAuthError, McpSessionExpiredError, McpToolCallError_I_VERIFIED_THIS_IS_NO
                       ), resolve57());
                     }, 600);
                     try {
-                      if (await sleep3(100), !resolved) {
+                      if (await sleep2(100), !resolved) {
                         try {
                           process.kill(childPid, 0), logMCPDebug(
                             name,
@@ -270695,7 +270735,7 @@ var McpAuthError, McpSessionExpiredError, McpToolCallError_I_VERIFIED_THIS_IS_NO
                           resolved = !0, clearInterval(checkInterval), clearTimeout(failsafeTimeout), resolve57();
                           return;
                         }
-                        if (await sleep3(400), !resolved)
+                        if (await sleep2(400), !resolved)
                           try {
                             process.kill(childPid, 0), logMCPDebug(
                               name,
@@ -274687,7 +274727,7 @@ function createLSPServerInstance(name, config4) {
           let delay = RETRY_BASE_DELAY_MS * Math.pow(2, attempt);
           logForDebugging(
             `LSP request '${method}' to '${name}' got ContentModified error, retrying in ${delay}ms (attempt ${attempt + 1}/${MAX_RETRIES_FOR_TRANSIENT_ERRORS})\u2026`
-          ), await sleep3(delay);
+          ), await sleep2(delay);
           continue;
         }
         break;
@@ -281346,9 +281386,9 @@ function checkStartProcess(parsed) {
           }
         }
       if (cmd.args.some((a) => {
-        let clean5 = a.replace(/`/g, "");
+        let clean6 = a.replace(/`/g, "");
         return /^[-\u2013\u2014\u2015/]v[a-z]*:['"` ]*runas['"` ]*$/i.test(
-          clean5
+          clean6
         );
       }))
         return {
@@ -286127,7 +286167,7 @@ function FileEditToolUseRejectedMessage(t0) {
 }
 var import_compiler_runtime43, import_jsx_runtime52, MAX_LINES_TO_RENDER, init_FileEditToolUseRejectedMessage = __esm({
   "build-src/src/components/FileEditToolUseRejectedMessage.tsx"() {
-    import_compiler_runtime43 = __toESM(require_compiler_runtime());
+    import_compiler_runtime43 = __toESM(require_compiler_runtime(), 1);
     init_useTerminalSize();
     init_cwd();
     init_ink2();
@@ -286135,7 +286175,7 @@ var import_compiler_runtime43, import_jsx_runtime52, MAX_LINES_TO_RENDER, init_F
     init_MessageResponse();
     init_StructuredDiffList();
     init_stringUtils();
-    import_jsx_runtime52 = __toESM(require_jsx_runtime()), MAX_LINES_TO_RENDER = 10;
+    import_jsx_runtime52 = __toESM(require_jsx_runtime(), 1), MAX_LINES_TO_RENDER = 10;
   }
 });
 
@@ -294728,7 +294768,7 @@ async function* withRetry(getClient, operation, options) {
         }
         let retryAfterMs = getRetryAfterMs(error51);
         if (retryAfterMs !== null && retryAfterMs < SHORT_RETRY_THRESHOLD_MS) {
-          await sleep3(retryAfterMs, options.signal, { abortError });
+          await sleep2(retryAfterMs, options.signal, { abortError });
           continue;
         }
         let cooldownMs = Math.max(
@@ -294814,11 +294854,11 @@ async function* withRetry(getClient, operation, options) {
             maxRetries
           ));
           let chunk2 = Math.min(remaining, HEARTBEAT_INTERVAL_MS2);
-          await sleep3(chunk2, options.signal, { abortError }), remaining -= chunk2;
+          await sleep2(chunk2, options.signal, { abortError }), remaining -= chunk2;
         }
         attempt >= maxRetries && (attempt = maxRetries);
       } else
-        error51 instanceof APIError && (yield createSystemAPIErrorMessage(error51, delayMs, attempt, maxRetries)), await sleep3(delayMs, options.signal, { abortError });
+        error51 instanceof APIError && (yield createSystemAPIErrorMessage(error51, delayMs, attempt, maxRetries)), await sleep2(delayMs, options.signal, { abortError });
     }
   }
   throw new CannotRetryError(lastError, retryContext);
@@ -296573,7 +296613,7 @@ async function waitForSessionMemoryExtraction() {
   for (; extractionStartedAt; ) {
     if (Date.now() - extractionStartedAt > EXTRACTION_STALE_THRESHOLD_MS || Date.now() - startTime > EXTRACTION_WAIT_TIMEOUT_MS)
       return;
-    await sleep3(1e3);
+    await sleep2(1e3);
   }
 }
 async function getSessionMemoryContent() {
@@ -299857,7 +299897,7 @@ async function streamCompactSummary({
       if (context3.abortController.signal.aborted)
         throw new Error(ERROR_MESSAGE_USER_ABORT);
       if (attempt < maxAttempts) {
-        await sleep3(getRetryDelay(attempt), context3.abortController.signal, {
+        await sleep2(getRetryDelay(attempt), context3.abortController.signal, {
           abortError: () => new APIUserAbortError()
         });
         continue;
@@ -301111,7 +301151,7 @@ async function gracefulShutdown(exitCode = 0, reason = "other", options) {
   try {
     await Promise.race([
       Promise.all([shutdown1PEventLogging(), shutdownDatadog()]),
-      sleep3(500)
+      sleep2(500)
     ]);
   } catch {
   }
@@ -301506,7 +301546,7 @@ async function fetchWithRetry(cachedChecksum) {
     let delayMs = getRetryDelay(attempt);
     logForDebugging(
       `Policy limits: Retry ${attempt}/${DEFAULT_MAX_RETRIES2} after ${delayMs}ms`
-    ), await sleep3(delayMs);
+    ), await sleep2(delayMs);
   }
   return lastResult2;
 }
@@ -304001,7 +304041,7 @@ async function fetchWithRetry2(cachedChecksum) {
     let delayMs = getRetryDelay(attempt);
     logForDebugging(
       `Remote settings: Retry ${attempt}/${DEFAULT_MAX_RETRIES3} after ${delayMs}ms`
-    ), await sleep3(delayMs);
+    ), await sleep2(delayMs);
   }
   return lastResult2;
 }
@@ -306333,7 +306373,7 @@ async function downloadAndVerifyBinary(binaryUrl, expectedChecksum, binaryPath,
       if (isStallTimeout ? lastError = new StallTimeoutError() : lastError = toError(error51), isStallTimeout && attempt < MAX_DOWNLOAD_RETRIES) {
         logForDebugging(
           `Download stalled on attempt ${attempt}/${MAX_DOWNLOAD_RETRIES}, retrying...`
-        ), await sleep3(1e3);
+        ), await sleep2(1e3);
         continue;
       }
       throw lastError;
@@ -306687,7 +306727,7 @@ async function tryWithVersionLock(versionFilePath, callback, retries = 0) {
           minTimeout * Math.pow(2, attempts - 1),
           maxTimeout
         );
-        await sleep3(timeout3);
+        await sleep2(timeout3);
       }
     }
     return logLockAcquisitionError(
@@ -312749,7 +312789,7 @@ async function waitForNextPromptOrShutdown(identity3, abortController, taskId, g
         from: "user"
       };
     }
-    if (pollCount > 0 && await sleep3(500), pollCount++, abortController.signal.aborted)
+    if (pollCount > 0 && await sleep2(500), pollCount++, abortController.signal.aborted)
       return logForDebugging(
         `[inProcessRunner] ${identity3.agentName} aborted while waiting (poll #${pollCount})`
       ), { type: "aborted" };
@@ -313936,7 +313976,7 @@ __export(TmuxBackend_exports, {
   TmuxBackend: () => TmuxBackend
 });
 function waitForPaneShellReady() {
-  return sleep3(PANE_SHELL_INIT_DELAY_MS);
+  return sleep2(PANE_SHELL_INIT_DELAY_MS);
 }
 function acquirePaneCreationLock() {
   let release2, newLock = new Promise((resolve57) => {
@@ -316475,7 +316515,7 @@ async function axiosGetWithRetry(url3, config4) {
       let delay = TELEPORT_RETRY_DELAYS[attempt] ?? 2e3;
       logForDebugging(
         `Teleport request failed (attempt ${attempt + 1}/${MAX_TELEPORT_RETRIES + 1}), retrying in ${delay}ms: ${errorMessage(error51)}`
-      ), await sleep3(delay);
+      ), await sleep2(delay);
     }
   throw lastError;
 }
@@ -316972,7 +317012,7 @@ function useClaudeAiLimits() {
 }
 var import_react69, init_claudeAiLimitsHook = __esm({
   "build-src/src/services/claudeAiLimitsHook.ts"() {
-    import_react69 = __toESM(require_react(), 1);
+    import_react69 = __toESM(require_react());
     init_claudeAiLimits();
   }
 });
@@ -323650,7 +323690,7 @@ async function appendSessionLogImpl(sessionId, entry, url3, headers) {
     let delayMs = Math.min(BASE_DELAY_MS2 * Math.pow(2, attempt - 1), 8e3);
     logForDebugging(
       `Remote persistence attempt ${attempt}/${MAX_RETRIES} failed, retrying in ${delayMs}ms\u2026`
-    ), await sleep3(delayMs);
+    ), await sleep2(delayMs);
   }
   return !1;
 }
@@ -323887,7 +323927,7 @@ async function ensureDaemonRunning() {
     { detached: !0, stdio: "ignore", env: process.env, windowsHide: !0 }
   ).unref());
   for (let i = 0; i < 100; i++)
-    if (await sleep7(150), info = await readDaemonInfo(), info && isDaemonAlive(info) && await pingOk(info)) return info;
+    if (await sleep6(150), info = await readDaemonInfo(), info && isDaemonAlive(info) && await pingOk(info)) return info;
   return null;
 }
 function daemonStartupFailureMessage(registeredLate) {
@@ -323923,7 +323963,7 @@ async function dispatchJob(job) {
     return { ok: !1, code: "daemon-unreachable" };
   }
   for (let i = 0; i < 40; i++) {
-    await sleep7(200);
+    await sleep6(200);
     try {
       let r = await daemonRpc(info, { op: "await-ack", short: job.short }, 2e3), mapped = mapResponse(r);
       if (mapped) return mapped;
@@ -323951,11 +323991,11 @@ async function dispatchJob(job) {
     }
   return { ok: !1, code: "daemon-unreachable" };
 }
-var MAX_RPC_BYTES, sleep7, init_client7 = __esm({
+var MAX_RPC_BYTES, sleep6, init_client7 = __esm({
   "build-src/src/daemon/client.ts"() {
     init_envUtils();
     init_state2();
-    MAX_RPC_BYTES = 1048576, sleep7 = (ms) => new Promise((r) => setTimeout(r, ms));
+    MAX_RPC_BYTES = 1048576, sleep6 = (ms) => new Promise((r) => setTimeout(r, ms));
   }
 });
 
@@ -323969,7 +324009,7 @@ async function waitPidGone(pid, deadlineMs) {
   let until = Date.now() + deadlineMs;
   for (; Date.now() < until; ) {
     if (!isPidAlive(pid)) return !0;
-    await sleep8(100);
+    await sleep7(100);
   }
   return !isPidAlive(pid);
 }
@@ -323979,7 +324019,7 @@ async function stopDaemonWorker(short) {
     try {
       let r = await daemonRpc(info, { op: "kill", short }, 1e4);
       for (let i = 0; !r.ok && r.code === "ESTARTING" && i < 10; i++)
-        await sleep8(200), r = await daemonRpc(info, { op: "kill", short }, 1e4);
+        await sleep7(200), r = await daemonRpc(info, { op: "kill", short }, 1e4);
       if (r.ok) return { confirmed: !0 };
       if (r.code !== "ENOJOB")
         return { confirmed: !1, error: r.message ?? r.code };
@@ -324061,11 +324101,11 @@ async function respawnJob(short, opts = {}) {
     error: "Previous session is still shutting down \u2014 try again in a moment"
   } : { ok: !1, alive: !1, error: "Couldn't reach the daemon (not running)" };
 }
-var sleep8, init_respawn = __esm({
+var sleep7, init_respawn = __esm({
   "build-src/src/daemon/respawn.ts"() {
     init_client7();
     init_state2();
-    sleep8 = (ms) => new Promise((r) => setTimeout(r, ms));
+    sleep7 = (ms) => new Promise((r) => setTimeout(r, ms));
   }
 });
 
@@ -325319,7 +325359,7 @@ async function retryWithBackoff(operation, attemptFn) {
       `${operation} attempt ${attempt}/${MAX_RETRIES2} failed: ${lastError}`
     ), attempt < MAX_RETRIES2) {
       let delayMs = BASE_DELAY_MS3 * Math.pow(2, attempt - 1);
-      logDebug(`Retrying ${operation} in ${delayMs}ms...`), await sleep3(delayMs);
+      logDebug(`Retrying ${operation} in ${delayMs}ms...`), await sleep2(delayMs);
     }
   }
   throw new Error(`${lastError} after ${MAX_RETRIES2} attempts`);
@@ -328602,7 +328642,7 @@ var import_jsx_runtime140, proactiveModule, PROGRESS_THRESHOLD_MS2, isBackground
           let hasPendingRequiredServers = appState.mcp.clients.some((c2) => c2.type === "pending" && requiredMcpServers.some((pattern) => c2.name.toLowerCase().includes(pattern.toLowerCase()))), currentAppState = appState;
           if (hasPendingRequiredServers) {
             let deadline = Date.now() + 3e4;
-            for (; Date.now() < deadline && (await sleep3(500), currentAppState = toolUseContext.getAppState(), !(currentAppState.mcp.clients.some((c2) => c2.type === "failed" && requiredMcpServers.some((pattern) => c2.name.toLowerCase().includes(pattern.toLowerCase()))) || !currentAppState.mcp.clients.some((c2) => c2.type === "pending" && requiredMcpServers.some((pattern) => c2.name.toLowerCase().includes(pattern.toLowerCase()))))); )
+            for (; Date.now() < deadline && (await sleep2(500), currentAppState = toolUseContext.getAppState(), !(currentAppState.mcp.clients.some((c2) => c2.type === "failed" && requiredMcpServers.some((pattern) => c2.name.toLowerCase().includes(pattern.toLowerCase()))) || !currentAppState.mcp.clients.some((c2) => c2.type === "pending" && requiredMcpServers.some((pattern) => c2.name.toLowerCase().includes(pattern.toLowerCase()))))); )
               ;
           }
           let serversWithTools = [];
@@ -328859,7 +328899,7 @@ var import_jsx_runtime140, proactiveModule, PROGRESS_THRESHOLD_MS2, isBackground
                       let stopBackgroundedSummarization;
                       try {
                         await Promise.race([agentIterator.return(void 0).catch(() => {
-                        }), sleep3(1e3)]);
+                        }), sleep2(1e3)]);
                         let tracker = createProgressTracker(), resolveActivity2 = createActivityDescriptionResolver(toolUseContext.options.tools);
                         for (let existingMsg of agentMessages)
                           updateProgressFromMessage(tracker, existingMsg, resolveActivity2, toolUseContext.options.tools);
@@ -345693,7 +345733,7 @@ async function waitForTaskCompletion(taskId, getAppState, timeoutMs, abortContro
       return null;
     if (task.status !== "running" && task.status !== "pending")
       return task;
-    await sleep3(100);
+    await sleep2(100);
   }
   return getAppState().tasks?.[taskId] ?? null;
 }
@@ -373094,7 +373134,7 @@ async function flushPromptHistory(retries) {
     try {
       await immediateFlushHistory();
     } finally {
-      isWriting = !1, pendingEntries.length > 0 && (await sleep3(500), flushPromptHistory(retries + 1));
+      isWriting = !1, pendingEntries.length > 0 && (await sleep2(500), flushPromptHistory(retries + 1));
     }
   }
 }
@@ -400115,20 +400155,18 @@ var sema_brand_default, init_sema_brand = __esm({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.76",
+        version: "1.0.77",
         notes: [
-          "The agents panel no longer opens mid-turn: while a turn is in flight, the left-arrow key stays with the composer, and the footer hint plus the background-agent placeholder only advertise \u2190 when the prompt is idle and empty \u2014 the panel can no longer yank the screen away from a streaming turn",
-          "ctrl+b (send the current work to the background) no longer takes the turn's already-backgrounded subagents down with it",
-          "Resuming a session with a parked approval no longer risks a false deadlock: the ownership recheck that guards card re-presentation now recognizes runs by their persisted task id as well as the in-process ledger, so a first-turn park \u2192 kill \u2192 resume re-presents exactly one live card",
-          `Approval-card rule suggestions got stricter and more honest: interpreter-style commands (python, node, npx, eval, exec, ssh and friends) are never offered as persistent allow rules in any spelling, and "won't ask again" is only claimed when the rule took effect live \u2014 otherwise the card says it fully applies after restart`,
-          "Background subagents stream their transcript into the viewing pane while they run (per-agent detail stream), and the idle placeholder points at the agents panel instead of a stale hint",
-          "Task list rendering no longer collapses rows in fullscreen (alt-screen) terminals",
-          "Durable run controls from a reconnected session no longer fail due to a lost client binding on the run verbs",
-          "Engine unchanged at 7.19.0 (same pin as 1.0.75); this release is a shell-side interaction-safety and correctness batch"
+          "Engine upgraded to 7.22.0 (from 7.19.0): reversibility probes, memory-governance surfaces, and full status-frame disclosure land in the wire this shell speaks",
+          "Approval cards now explain why a command tripped the reversibility probe: a one-line note names the probe cause (for example an unbounded recursive read) and the directories it rooted in, alongside the existing governance and wire notes",
+          "ctrl+b (send to background) stays honest on remote-hosted turns: the shell records the engine's session-backgroundable capability during handshake and keeps the local backgrounding shortcut scoped to turns it actually owns \u2014 remote lanes get a structured verdict instead of a silent no-op",
+          "The engine-fence suite gained a full 7.22.0 lane (41 live checks) and the 7.18 fence re-run stays green on the new engine, so wire regressions in approvals, session reads, and SSE cleanup surface before a release rather than after",
+          "Two upstream default flips are now pinned by tests so they cannot silently drift: shell-history files are readable by built-in tools (deny still available via explicit configuration), and a throwing activity listener no longer fails the whole leg",
+          "client-core 0.30.3: principal handling gained a single normalization primitive (an all-whitespace principal now means absent \u2014 no more blank identity headers), turn-error classification and session-id mapping moved to shared single sources, and approval-card rule suggestions share one persistence verdict across surfaces"
         ]
       },
-      productVersion: "1.0.76",
-      announcement: `sema 1.0.76 \u2014 Interaction-safety batch: the agents panel no longer opens mid-turn (\u2190 stays with the composer while a turn is in flight, and every hint that advertises it follows the same predicate), ctrl+b no longer takes backgrounded subagents down with it, and resume ownership rechecks recognize persisted task ids so parked approvals re-present exactly once instead of dead-locking. Approval-card rule suggestions refuse interpreter-family commands in every spelling and only claim "won't ask again" when the rule applied live. Background subagents stream their transcripts into the viewer, and fullscreen task lists render without row collapse. Engine unchanged at 7.19.0.`
+      productVersion: "1.0.77",
+      announcement: "sema 1.0.77 \u2014 Engine 7.22.0 pickup: approval cards now name the reversibility-probe cause and its root directories, the shell records the engine's session-backgroundable capability at handshake (ctrl+b stays scoped to turns the shell owns, with a structured verdict instead of a silent no-op on remote lanes), and a full 7.22.0 live fence (41 checks) plus the 7.18 fence re-run guard approvals, session reads, and SSE cleanup against wire regressions. Two upstream default flips are pinned by tests (shell-history readable by built-ins; a throwing activity listener no longer fails the leg). client-core 0.30.3: blank principals mean absent (no more blank identity headers), and turn-error classification, session-id mapping, and rule-persistence verdicts are single-sourced across surfaces."
     };
   }
 });
@@ -404175,7 +404213,7 @@ function VirtualMessageList({
         if (indexWarmed.current) return 0;
         let msgs = jumpState.current.messages, CHUNK = 500, workMs = 0, wallStart = performance.now();
         for (let i = 0; i < msgs.length; i += CHUNK) {
-          await sleep3(0);
+          await sleep2(0);
           let t0 = performance.now(), end2 = Math.min(i + CHUNK, msgs.length);
           for (let j3 = i; j3 < end2; j3++)
             extractSearchText(msgs[j3]);
@@ -404331,20 +404369,18 @@ var require_sema_brand = __commonJS({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.76",
+        version: "1.0.77",
         notes: [
-          "The agents panel no longer opens mid-turn: while a turn is in flight, the left-arrow key stays with the composer, and the footer hint plus the background-agent placeholder only advertise \u2190 when the prompt is idle and empty \u2014 the panel can no longer yank the screen away from a streaming turn",
-          "ctrl+b (send the current work to the background) no longer takes the turn's already-backgrounded subagents down with it",
-          "Resuming a session with a parked approval no longer risks a false deadlock: the ownership recheck that guards card re-presentation now recognizes runs by their persisted task id as well as the in-process ledger, so a first-turn park \u2192 kill \u2192 resume re-presents exactly one live card",
-          `Approval-card rule suggestions got stricter and more honest: interpreter-style commands (python, node, npx, eval, exec, ssh and friends) are never offered as persistent allow rules in any spelling, and "won't ask again" is only claimed when the rule took effect live \u2014 otherwise the card says it fully applies after restart`,
-          "Background subagents stream their transcript into the viewing pane while they run (per-agent detail stream), and the idle placeholder points at the agents panel instead of a stale hint",
-          "Task list rendering no longer collapses rows in fullscreen (alt-screen) terminals",
-          "Durable run controls from a reconnected session no longer fail due to a lost client binding on the run verbs",
-          "Engine unchanged at 7.19.0 (same pin as 1.0.75); this release is a shell-side interaction-safety and correctness batch"
+          "Engine upgraded to 7.22.0 (from 7.19.0): reversibility probes, memory-governance surfaces, and full status-frame disclosure land in the wire this shell speaks",
+          "Approval cards now explain why a command tripped the reversibility probe: a one-line note names the probe cause (for example an unbounded recursive read) and the directories it rooted in, alongside the existing governance and wire notes",
+          "ctrl+b (send to background) stays honest on remote-hosted turns: the shell records the engine's session-backgroundable capability during handshake and keeps the local backgrounding shortcut scoped to turns it actually owns \u2014 remote lanes get a structured verdict instead of a silent no-op",
+          "The engine-fence suite gained a full 7.22.0 lane (41 live checks) and the 7.18 fence re-run stays green on the new engine, so wire regressions in approvals, session reads, and SSE cleanup surface before a release rather than after",
+          "Two upstream default flips are now pinned by tests so they cannot silently drift: shell-history files are readable by built-in tools (deny still available via explicit configuration), and a throwing activity listener no longer fails the whole leg",
+          "client-core 0.30.3: principal handling gained a single normalization primitive (an all-whitespace principal now means absent \u2014 no more blank identity headers), turn-error classification and session-id mapping moved to shared single sources, and approval-card rule suggestions share one persistence verdict across surfaces"
         ]
       },
-      productVersion: "1.0.76",
-      announcement: `sema 1.0.76 \u2014 Interaction-safety batch: the agents panel no longer opens mid-turn (\u2190 stays with the composer while a turn is in flight, and every hint that advertises it follows the same predicate), ctrl+b no longer takes backgrounded subagents down with it, and resume ownership rechecks recognize persisted task ids so parked approvals re-present exactly once instead of dead-locking. Approval-card rule suggestions refuse interpreter-family commands in every spelling and only claim "won't ask again" when the rule applied live. Background subagents stream their transcripts into the viewer, and fullscreen task lists render without row collapse. Engine unchanged at 7.19.0.`
+      productVersion: "1.0.77",
+      announcement: "sema 1.0.77 \u2014 Engine 7.22.0 pickup: approval cards now name the reversibility-probe cause and its root directories, the shell records the engine's session-backgroundable capability at handshake (ctrl+b stays scoped to turns the shell owns, with a structured verdict instead of a silent no-op on remote lanes), and a full 7.22.0 live fence (41 checks) plus the 7.18 fence re-run guard approvals, session reads, and SSE cleanup against wire regressions. Two upstream default flips are pinned by tests (shell-history readable by built-ins; a throwing activity listener no longer fails the leg). client-core 0.30.3: blank principals mean absent (no more blank identity headers), and turn-error classification, session-id mapping, and rule-persistence verdicts are single-sourced across surfaces."
     };
   }
 });
@@ -407531,7 +407567,7 @@ async function pollForApprovedExitPlanMode(sessionId, timeoutMs, onPhaseChange,
           scanner.rejectCount,
           { cause: e }
         );
-      await sleep3(POLL_INTERVAL_MS2);
+      await sleep2(POLL_INTERVAL_MS2);
       continue;
     }
     let result;
@@ -407563,7 +407599,7 @@ async function pollForApprovedExitPlanMode(sessionId, timeoutMs, onPhaseChange,
         scanner.rejectCount
       );
     let quietIdle = (sessionStatus === "idle" || sessionStatus === "requires_action") && newEvents.length === 0, phase = scanner.hasPendingPlan ? "plan_ready" : quietIdle ? "needs_input" : "running";
-    phase !== lastPhase && (logForDebugging(`[ultraplan] phase ${lastPhase} \u2192 ${phase}`), lastPhase = phase, onPhaseChange?.(phase)), await sleep3(POLL_INTERVAL_MS2);
+    phase !== lastPhase && (logForDebugging(`[ultraplan] phase ${lastPhase} \u2192 ${phase}`), lastPhase = phase, onPhaseChange?.(phase)), await sleep2(POLL_INTERVAL_MS2);
   }
   throw new UltraplanPollError(
     scanner.everSeenPending ? `no approval after ${timeoutMs / 1e3}s` : `ExitPlanMode never reached after ${timeoutMs / 1e3}s (the remote container failed to start, or session ID mismatch?)`,
@@ -412562,11 +412598,11 @@ function capsBaseUrl2() {
   let raw2 = process.env.SEMA_LIVE_BASEURL;
   return typeof raw2 == "string" && raw2.trim() !== "" ? raw2 : void 0;
 }
-function persistedRulesLaneAvailable(baseUrl = capsBaseUrl2()) {
-  return engineCapTrue(baseUrl, "permissionRules");
+function persistedRulesLaneAvailable2(baseUrl = capsBaseUrl2()) {
+  return persistedRulesLaneAvailable(baseUrl);
 }
-function persistedRulesGovernanceAvailable(baseUrl = capsBaseUrl2()) {
-  return engineCapTrue(baseUrl, "permissionRulesRevoke") && engineCapTrue(baseUrl, "permissionRules");
+function persistedRulesGovernanceAvailable2(baseUrl = capsBaseUrl2()) {
+  return persistedRulesGovernanceAvailable(baseUrl);
 }
 async function resolveRulesFacade() {
   if (facadeOverride) return facadeOverride;
@@ -412600,67 +412636,6 @@ async function kickRulesCapsProbe() {
     logForDebugging(`persistedRulesWire: capability re-probe failed (cache stays unresolved): ${String(e)}`);
   });
 }
-function errShape(e) {
-  let o = e ?? {};
-  return {
-    ...typeof o.status == "number" ? { status: o.status } : {},
-    ...typeof o.errorCode == "string" ? { errorCode: o.errorCode } : {},
-    message: typeof o.message == "string" && o.message !== "" ? o.message : String(e)
-  };
-}
-function retryAfterSecOf(e) {
-  let ms = e.retryAfterMs;
-  if (!(typeof ms != "number" || !Number.isFinite(ms) || ms < 0))
-    return Math.ceil(ms / 1e3);
-}
-function classifyRulesFailure(e) {
-  let { status: status3, errorCode, message } = errShape(e);
-  if (status3 === 501 || errorCode === "capability.rule_store_required")
-    return { kind: "lane-unavailable", message };
-  if (status3 === 404)
-    return errorCode === "not_found.route" ? { kind: "route-missing", message } : errorCode === "not_found.rule_ticket" ? { kind: "ticket-dead", message } : { kind: "error", message };
-  if (errorCode === "state.rule_import_retry") {
-    let sec = retryAfterSecOf(e);
-    return { kind: "retry-same-ticket", message, ...sec !== void 0 ? { retryAfterSec: sec } : {} };
-  }
-  return errorCode === "state.rule_remove_failed" ? { kind: "retryable", message } : status3 === 400 && errorCode === "request.query_invalid" ? { kind: "cursor-stale", message } : status3 === 413 ? { kind: "too-many-candidates", message } : status3 === 403 && errorCode === "auth.operator_only" ? { kind: "forbidden", message } : { kind: "error", message };
-}
-async function listAllPersistedRules(facade, params = {}, opts) {
-  for (let attempt = 0; attempt < 2; attempt++) {
-    let rules = [], cursor, rev2 = 0, restart = !1;
-    for (let page = 0; page < MAX_PAGES; page++) {
-      let res;
-      try {
-        res = await facade.list(
-          { limit: PAGE_LIMIT, ...params, ...cursor !== void 0 ? { cursor } : {} },
-          opts
-        );
-      } catch (e) {
-        let failure = classifyRulesFailure(e);
-        if (failure.kind === "cursor-stale" && cursor !== void 0 && attempt === 0) {
-          logForDebugging(
-            "persistedRulesWire: rule list cursor was minted on another rev/principal/scope \u2014 dropping it and re-listing from the top (never resuming a stale keyset)"
-          ), restart = !0;
-          break;
-        }
-        return { ok: !1, failure };
-      }
-      rev2 = typeof res.rev == "number" ? res.rev : rev2, Array.isArray(res.rules) && rules.push(...res.rules);
-      let next = res.nextCursor;
-      if (typeof next != "string" || next === "") return { ok: !0, rules, rev: rev2 };
-      cursor = next;
-    }
-    if (!restart)
-      return {
-        ok: !1,
-        failure: {
-          kind: "error",
-          message: `rule list did not terminate within ${MAX_PAGES} pages \u2014 refusing to present a partial governance list`
-        }
-      };
-  }
-  return { ok: !1, failure: { kind: "cursor-stale", message: "rule list kept changing under the cursor \u2014 try again" } };
-}
 async function revokePersistedRule(facade, input, opts) {
   try {
     return { ok: !0, result: await facade.revoke(input, opts) };
@@ -412682,12 +412657,6 @@ async function redeemCcRuleImport(facade, ticket, opts) {
     return { ok: !1, failure: classifyRulesFailure(e) };
   }
 }
-function classifySkippedReason(reason) {
-  let text2 = typeof reason == "string" ? reason : String(reason), idx = text2.indexOf(":");
-  if (idx <= 0) return { text: text2 };
-  let head = text2.slice(0, idx);
-  return /^[a-z][a-z0-9_]*(\.[a-z0-9_]+)*$/.test(head) ? { code: head, text: text2 } : { text: text2 };
-}
 function ccRoot() {
   return process.env.SEMA_CC_ROOT || join156(homedir41(), CC_DIR4);
 }
@@ -412791,13 +412760,6 @@ function buildToolApprovalRespondBody(input) {
     ...input.note !== void 0 ? { note: input.note } : {}
   };
 }
-function readRulePersistOutcome(ack) {
-  let o = ack ?? {};
-  return o.rulePersisted === !0 ? { state: "persisted" } : o.rulePersisted === !1 ? {
-    state: "refused",
-    ...typeof o.ruleRefusal == "string" && o.ruleRefusal !== "" ? { reason: o.ruleRefusal } : {}
-  } : { state: "unknown" };
-}
 function surfaceRulePersistOutcome(ack) {
   let outcome = readRulePersistOutcome(ack);
   if (outcome.state === "unknown") return;
@@ -412818,7 +412780,7 @@ function surfaceRulePersistOutcome(ack) {
   }
 }
 function surfaceLocalRulePersistOutcome(outcome) {
-  let text2 = outcome.ok ? outcome.appliedLive ? "Saved: won't ask again for this rule" : "Saved to settings \u2014 fully applies after restart (this session may ask once more)" : `"Don't ask again" was not saved (${outcome.error}) \u2014 the one-time approval is still being submitted`;
+  let text2 = outcome.ok ? outcome.redemptionGated === "budget-disabled" ? "Saved to settings \u2014 but automatic approval is disabled (SEMA_GATE_SYNC_ALLOW_BUDGET=0), so this rule will not silence asks until that changes" : outcome.redemptionGated === "budget-exhausted" ? "Saved to settings \u2014 but this session's automatic-approval budget is used up, so it may keep asking (fully applies after restart)" : outcome.appliedLive ? "Saved: won't ask again for this rule" : "Saved to settings \u2014 fully applies after restart (this session may ask once more)" : `"Don't ask again" was not saved (${outcome.error}) \u2014 the one-time approval is still being submitted`;
   try {
     surfaceWireNotice(
       {
@@ -412834,15 +412796,15 @@ function surfaceLocalRulePersistOutcome(outcome) {
     logForDebugging(`persistedRulesWire: surfacing local rule-persist outcome failed (non-fatal): ${String(e)}`);
   }
 }
-var facadeOverride, PAGE_LIMIT, MAX_PAGES, CC_DIR4, LAYER_BYTE_CAP, RULE_PERSIST_NOTICE_KEY, RULE_PERSIST_NOTICE_DEFAULT_MS, rulePersistNoticeMs, init_persistedRulesWire = __esm({
+var facadeOverride, CC_DIR4, LAYER_BYTE_CAP, RULE_PERSIST_NOTICE_KEY, RULE_PERSIST_NOTICE_DEFAULT_MS, rulePersistNoticeMs, init_persistedRulesWire2 = __esm({
   "build-src/src/sema/persistedRulesWire.ts"() {
     init_main2();
     init_dist();
     init_debug();
     init_wireNoticePort();
     init_livePrincipal();
+    init_dist();
     facadeOverride = null;
-    PAGE_LIMIT = 200, MAX_PAGES = 25;
     CC_DIR4 = ".claude";
     LAYER_BYTE_CAP = 16 * 1024;
     RULE_PERSIST_NOTICE_KEY = "rule-persist-outcome", RULE_PERSIST_NOTICE_DEFAULT_MS = 8e3, rulePersistNoticeMs = RULE_PERSIST_NOTICE_DEFAULT_MS;
@@ -412851,7 +412813,7 @@ var facadeOverride, PAGE_LIMIT, MAX_PAGES, CC_DIR4, LAYER_BYTE_CAP, RULE_PERSIST
 
 // build-src/src/sema/onboard/ccRulesImport.ts
 function detectCcRulesImport(cwd5) {
-  if (!persistedRulesLaneAvailable()) return { offer: !1, layers: [], why: "lane-unavailable" };
+  if (!persistedRulesLaneAvailable2()) return { offer: !1, layers: [], why: "lane-unavailable" };
   let { layers: layers2 } = collectCcSettingsLayers(cwd5);
   return layers2.length === 0 ? { offer: !1, layers: [], why: "no-cc-settings" } : { offer: !0, layers: layers2 };
 }
@@ -412887,7 +412849,7 @@ function makeSingleFlightGate() {
 }
 var init_ccRulesImport = __esm({
   "build-src/src/sema/onboard/ccRulesImport.ts"() {
-    init_persistedRulesWire();
+    init_persistedRulesWire2();
   }
 });
 
@@ -412921,7 +412883,7 @@ function writeCcImportMarker(marker) {
 var init_ccImportMarker = __esm({
   "build-src/src/sema/rules/ccImportMarker.ts"() {
     init_envUtils();
-    init_persistedRulesWire();
+    init_persistedRulesWire2();
   }
 });
 
@@ -413108,7 +413070,7 @@ var React104, import_jsx_runtime305, init_CcRulesImportFlow = __esm({
     init_select();
     init_ink2();
     init_debug();
-    init_persistedRulesWire();
+    init_persistedRulesWire2();
     init_ccImportMarker();
     init_ccRulesImport();
     import_jsx_runtime305 = __toESM(require_jsx_runtime(), 1);
@@ -413130,14 +413092,14 @@ function originsLabel(rule) {
   return seen2.length === 0 ? "unknown origin" : seen2.map((o) => o === "user" ? "approved on a card" : o === "imported-cc" ? "imported" : o === "starter" ? "preset" : o).join(" + ");
 }
 function usePersistedRulesGovernanceVisible() {
-  let [visible, setVisible] = React105.useState(() => persistedRulesGovernanceAvailable());
+  let [visible, setVisible] = React105.useState(() => persistedRulesGovernanceAvailable2());
   return React105.useEffect(() => {
     if (visible) return;
     let alive = !0, timer2 = setInterval(() => {
-      alive && persistedRulesGovernanceAvailable() && (setVisible(!0), clearInterval(timer2));
+      alive && persistedRulesGovernanceAvailable2() && (setVisible(!0), clearInterval(timer2));
     }, CAPS_POLL_MS);
     return kickRulesCapsProbe().then(() => {
-      alive && persistedRulesGovernanceAvailable() && (setVisible(!0), clearInterval(timer2));
+      alive && persistedRulesGovernanceAvailable2() && (setVisible(!0), clearInterval(timer2));
     }), () => {
       alive = !1, clearInterval(timer2);
     };
@@ -413279,7 +413241,7 @@ var React105, import_jsx_runtime306, CAPS_POLL_MS, init_PersistedRulesTab = __es
     init_ink2();
     init_select();
     init_Tabs();
-    init_persistedRulesWire();
+    init_persistedRulesWire2();
     init_detectSources();
     init_ccRulesImport();
     init_CcRulesImportFlow();
@@ -432779,12 +432741,12 @@ async function* sdkMessagesToCcEvents(sdk, meta3) {
       // 绝不铸 transcript 行(帧不带正文,替引擎编话=谎),落 debug 审计留痕(「这条 run 被谁插过话」
       // 可查);wire 值 UNTRUSTED,白名单键+控制字符消毒。
       case "human_input": {
-        let clean5 = (v2) => (
+        let clean6 = (v2) => (
           // eslint-disable-next-line no-control-regex
           String(v2 ?? "").replace(/[\x00-\x1f\x7f]/g, ".").slice(0, 120)
-        ), who = e.actor?.id ? `${clean5(e.actor.id)}${e.actor.hostAsserted === !0 ? "" : " (unverified)"}` : "unattributed";
+        ), who = e.actor?.id ? `${clean6(e.actor.id)}${e.actor.hostAsserted === !0 ? "" : " (unverified)"}` : "unattributed";
         return logForDebugging(
-          `[sema][bridge] human_input ledger frame (audit): carrier=${clean5(e.carrier)} eventId=${clean5(e.eventId)} by=${who}`
+          `[sema][bridge] human_input ledger frame (audit): carrier=${clean6(e.carrier)} eventId=${clean6(e.eventId)} by=${who}`
         ), [];
       }
       default:
@@ -432873,8 +432835,121 @@ var BRIDGE_PROBE_ENV, init_upstreamBridge = __esm({
 });
 
 // node_modules/@sema-agent/core/dist/tools/fs/read-deny.js
-var init_read_deny = __esm({
+function resolveReadDenyBuiltins(config4) {
+  let activeTiers;
+  if (config4?.tiers === void 0)
+    activeTiers = new Set(READ_DENY_DEFAULT_TIERS);
+  else {
+    if (!Array.isArray(config4.tiers))
+      throw new Error(`readDenyBuiltinTiers: expected an array of tier names, got ${JSON.stringify(config4.tiers)}.`);
+    for (let t2 of config4.tiers)
+      if (typeof t2 != "string" || !READ_DENY_BUILTIN_TIERS.includes(t2))
+        throw new Error(`readDenyBuiltinTiers: unknown tier ${JSON.stringify(t2)} \u2014 known tiers: ${READ_DENY_BUILTIN_TIERS.join(", ")}.`);
+    activeTiers = new Set(config4.tiers);
+  }
+  let excluded;
+  if (config4?.exclude === void 0)
+    excluded = /* @__PURE__ */ new Set();
+  else {
+    if (!Array.isArray(config4.exclude))
+      throw new Error(`readDenyBuiltinExclude: expected an array of built-in row names (canonical pattern texts), got ${JSON.stringify(config4.exclude)}.`);
+    for (let name of config4.exclude)
+      if (typeof name != "string" || !READ_FACE_BUILTIN_DENY_TABLE.some((r) => r.pattern === name))
+        throw new Error(`readDenyBuiltinExclude: ${JSON.stringify(name)} names no built-in row \u2014 row names are the canonical pattern texts of READ_FACE_BUILTIN_DENY_TABLE (e.g. ".ssh", ".config/gcloud").`);
+    excluded = new Set(config4.exclude);
+  }
+  return READ_FACE_BUILTIN_DENY_TABLE.filter((r) => activeTiers.has(r.tier) && !excluded.has(r.pattern));
+}
+var READ_DENY_BUILTIN_TIERS, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_DEFAULT_TIERS, READ_FACE_DEFAULT_DENY_ENTRIES, init_read_deny = __esm({
   "node_modules/@sema-agent/core/dist/tools/fs/read-deny.js"() {
+    READ_DENY_BUILTIN_TIERS = ["credentials", "shell-history", "browser", "wallet"], READ_FACE_BUILTIN_DENY_TABLE = [
+      { pattern: ".ssh", tier: "credentials" },
+      { pattern: "id_rsa*", tier: "credentials" },
+      { pattern: "id_ed25519*", tier: "credentials" },
+      { pattern: "id_ecdsa*", tier: "credentials" },
+      { pattern: ".gnupg", tier: "credentials" },
+      { pattern: ".aws", tier: "credentials" },
+      { pattern: ".config/gcloud", tier: "credentials" },
+      { pattern: ".azure", tier: "credentials" },
+      { pattern: ".kube", tier: "credentials" },
+      { pattern: ".netrc", tier: "credentials" },
+      { pattern: "_netrc", tier: "credentials" },
+      { pattern: ".git-credentials", tier: "credentials" },
+      { pattern: ".docker/config.json", tier: "credentials" },
+      { pattern: ".config/gh", tier: "credentials" },
+      { pattern: ".npmrc", tier: "credentials" },
+      { pattern: ".pypirc", tier: "credentials" },
+      { pattern: ".local/share/keyrings", tier: "credentials" },
+      { pattern: "Library/Keychains", tier: "credentials" },
+      { pattern: ".bash_history", tier: "shell-history" },
+      { pattern: ".zsh_history", tier: "shell-history" },
+      { pattern: "Library/Application Support/Google/Chrome", tier: "browser" },
+      { pattern: "Library/Application Support/Firefox", tier: "browser" },
+      { pattern: "Library/Safari", tier: "browser" },
+      { pattern: ".config/google-chrome", tier: "browser" },
+      { pattern: ".config/chromium", tier: "browser" },
+      { pattern: ".mozilla/firefox", tier: "browser" },
+      { pattern: "AppData/Local/Google/Chrome/User Data", tier: "browser" },
+      { pattern: "AppData/Local/Microsoft/Edge/User Data", tier: "browser" },
+      { pattern: "AppData/Roaming/Mozilla/Firefox", tier: "browser" },
+      { pattern: ".bitcoin", tier: "wallet" },
+      { pattern: ".ethereum", tier: "wallet" },
+      { pattern: ".electrum", tier: "wallet" },
+      { pattern: "Library/Application Support/Exodus", tier: "wallet" },
+      { pattern: "Library/Application Support/Ledger Live", tier: "wallet" },
+      { pattern: "wallet.dat", tier: "wallet" }
+    ], READ_DENY_DEFAULT_TIERS = READ_DENY_BUILTIN_TIERS.filter((t2) => t2 !== "shell-history");
+    READ_FACE_DEFAULT_DENY_ENTRIES = resolveReadDenyBuiltins().map((r) => r.pattern);
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/safe-notify.js
+function createSafeNotifier(opts) {
+  let onError = opts?.onError, sites, total = 0, record2 = (site, thrown) => {
+    let error51 = thrown instanceof Error ? thrown : new Error(String(thrown));
+    total += 1, sites === void 0 && (sites = /* @__PURE__ */ new Map());
+    let state4 = sites.get(site);
+    if (state4 !== void 0) {
+      state4.count += 1, state4.last = error51;
+      return;
+    }
+    if (sites.set(site, { count: 1, last: error51 }), onError !== void 0)
+      try {
+        onError({ site, error: error51, failures: 1 });
+      } catch {
+      }
+  };
+  return {
+    notify(run2, site) {
+      try {
+        return run2(), !0;
+      } catch (e) {
+        return record2(site, e), !1;
+      }
+    },
+    async notifyAsync(run2, site) {
+      try {
+        return await run2(), !0;
+      } catch (e) {
+        return record2(site, e), !1;
+      }
+    },
+    get failures() {
+      return total;
+    },
+    failuresAt(site) {
+      return sites?.get(site)?.count ?? 0;
+    },
+    lastErrorAt(site) {
+      return sites?.get(site)?.last;
+    },
+    failedSites() {
+      return sites === void 0 ? [] : [...sites.keys()];
+    }
+  };
+}
+var init_safe_notify = __esm({
+  "node_modules/@sema-agent/core/dist/core/safe-notify.js"() {
   }
 });
 
@@ -442853,9 +442928,9 @@ var init_union_priority_sort = __esm({
 // node_modules/typebox/build/value/clean/from_union.mjs
 function FromUnion9(context3, type, value) {
   for (let schema of UnionPrioritySort(type.anyOf)) {
-    let clean5 = FromType19(context3, schema, Clone2(value));
-    if (Check2(context3, schema, clean5))
-      return clean5;
+    let clean6 = FromType19(context3, schema, Clone2(value));
+    if (Check2(context3, schema, clean6))
+      return clean6;
   }
   return value;
 }
@@ -446130,56 +446205,6 @@ var REVIVED_ROW_CLEARED_FIELDS, BackgroundAgentStoreError, STALE_RUNNING_REAP_AT
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/safe-notify.js
-function createSafeNotifier(opts) {
-  let onError = opts?.onError, sites, total = 0, record2 = (site, thrown) => {
-    let error51 = thrown instanceof Error ? thrown : new Error(String(thrown));
-    total += 1, sites === void 0 && (sites = /* @__PURE__ */ new Map());
-    let state4 = sites.get(site);
-    if (state4 !== void 0) {
-      state4.count += 1, state4.last = error51;
-      return;
-    }
-    if (sites.set(site, { count: 1, last: error51 }), onError !== void 0)
-      try {
-        onError({ site, error: error51, failures: 1 });
-      } catch {
-      }
-  };
-  return {
-    notify(run2, site) {
-      try {
-        return run2(), !0;
-      } catch (e) {
-        return record2(site, e), !1;
-      }
-    },
-    async notifyAsync(run2, site) {
-      try {
-        return await run2(), !0;
-      } catch (e) {
-        return record2(site, e), !1;
-      }
-    },
-    get failures() {
-      return total;
-    },
-    failuresAt(site) {
-      return sites?.get(site)?.count ?? 0;
-    },
-    lastErrorAt(site) {
-      return sites?.get(site)?.last;
-    },
-    failedSites() {
-      return sites === void 0 ? [] : [...sites.keys()];
-    }
-  };
-}
-var init_safe_notify = __esm({
-  "node_modules/@sema-agent/core/dist/core/safe-notify.js"() {
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/workflow-run-store.js
 function summarizeWorkflowRun(run2) {
   let latestPhase = run2.phases.at(-1);
@@ -448998,6 +449023,8 @@ var init_fs_bash = __esm({
     init_remote_env3();
     init_gh_rate_limit();
     init_fs_shared();
+    init_checkpoint_store();
+    init_untrusted_text();
     init_bash_readonly_classifier();
   }
 });
@@ -451022,6 +451049,7 @@ var objectPrototype, init_hooks7 = __esm({
     init_tool_policy();
     init_ask_class();
     init_untrusted_text();
+    init_checkpoint_store();
     init_ask_question();
     init_safe_notify();
     init_permission_rule_org();
@@ -451029,12 +451057,6 @@ var objectPrototype, init_hooks7 = __esm({
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/session-reconcile.js
-var init_session_reconcile = __esm({
-  "node_modules/@sema-agent/core/dist/core/session-reconcile.js"() {
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/cache-break-detector.js
 var SERVER_GAP_MS, init_cache_break_detector = __esm({
   "node_modules/@sema-agent/core/dist/core/cache-break-detector.js"() {
@@ -451262,24 +451284,12 @@ var MEMORY_INDEX_MAX_BYTES, init_engine4 = __esm({
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/locked-config.js
-var init_locked_config = __esm({
-  "node_modules/@sema-agent/core/dist/core/locked-config.js"() {
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/compliance.js
 var init_compliance = __esm({
   "node_modules/@sema-agent/core/dist/core/compliance.js"() {
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/retention.js
-var init_retention = __esm({
-  "node_modules/@sema-agent/core/dist/core/retention.js"() {
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/memory-engine/dual-root.js
 var init_dual_root = __esm({
   "node_modules/@sema-agent/core/dist/core/memory-engine/dual-root.js"() {
@@ -451302,6 +451312,101 @@ var init_prepare_memory = __esm({
   }
 });
 
+// node_modules/@sema-agent/core/dist/core/locked-config.js
+var init_locked_config = __esm({
+  "node_modules/@sema-agent/core/dist/core/locked-config.js"() {
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/retention.js
+var init_retention = __esm({
+  "node_modules/@sema-agent/core/dist/core/retention.js"() {
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/usage-window-store.js
+var EMPTY_USAGE_WINDOW_RECORD, init_usage_window_store = __esm({
+  "node_modules/@sema-agent/core/dist/core/usage-window-store.js"() {
+    EMPTY_USAGE_WINDOW_RECORD = Object.freeze({
+      slots: Object.freeze([]),
+      buckets: Object.freeze([])
+    });
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/wiring-manifest.js
+var init_wiring_manifest = __esm({
+  "node_modules/@sema-agent/core/dist/core/wiring-manifest.js"() {
+    init_canonical_json();
+    init_checkpoint_store();
+    init_ask_question();
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/runner/prepare-config-doors.js
+var TASK_LIMIT_KEY_DICT, TASK_LIMIT_KEYS, init_prepare_config_doors = __esm({
+  "node_modules/@sema-agent/core/dist/core/runner/prepare-config-doors.js"() {
+    init_timeout();
+    init_fs();
+    init_checkpoint_store();
+    init_locked_config();
+    init_retention();
+    init_roles();
+    init_usage_window_store();
+    init_wiring_manifest();
+    TASK_LIMIT_KEY_DICT = {
+      maxTokens: !0,
+      maxCostUsd: !0,
+      maxTurns: !0,
+      maxWalltimeMs: !0,
+      maxOutputTokens: !0,
+      approachNotice: !0,
+      budgetStreamCancel: !0,
+      degrade: !0,
+      brainCallGuardrailMs: !0
+    }, TASK_LIMIT_KEYS = Object.keys(TASK_LIMIT_KEY_DICT);
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/runner/prepare-safety-scan.js
+var NAMESPACED_NAME_SHAPES, init_prepare_safety_scan = __esm({
+  "node_modules/@sema-agent/core/dist/core/runner/prepare-safety-scan.js"() {
+    init_protocol_table();
+    init_fs();
+    init_tool_result_store();
+    init_present_plan_tool();
+    NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/session-reconcile.js
+var init_session_reconcile = __esm({
+  "node_modules/@sema-agent/core/dist/core/session-reconcile.js"() {
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/runner/prepare-acquire-reconcile.js
+var init_prepare_acquire_reconcile = __esm({
+  "node_modules/@sema-agent/core/dist/core/runner/prepare-acquire-reconcile.js"() {
+    init_session4();
+    init_session_reconcile();
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/with-retry.js
+var init_with_retry = __esm({
+  "node_modules/@sema-agent/core/dist/core/with-retry.js"() {
+  }
+});
+
+// node_modules/@sema-agent/core/dist/core/runner/prepare-workspace-restore.js
+var init_prepare_workspace_restore = __esm({
+  "node_modules/@sema-agent/core/dist/core/runner/prepare-workspace-restore.js"() {
+    init_remote_env3();
+    init_with_retry();
+  }
+});
+
 // node_modules/@sema-agent/core/dist/prompt-assembly/composer.js
 var SINGLE_BLOCK_LAYOUT, init_composer = __esm({
   "node_modules/@sema-agent/core/dist/prompt-assembly/composer.js"() {
@@ -451361,12 +451466,6 @@ var init_stub_env = __esm({
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/with-retry.js
-var init_with_retry = __esm({
-  "node_modules/@sema-agent/core/dist/core/with-retry.js"() {
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/runner/teardown-bounded.js
 var init_teardown_bounded = __esm({
   "node_modules/@sema-agent/core/dist/core/runner/teardown-bounded.js"() {
@@ -451489,28 +451588,9 @@ var init_session_file_state_replay = __esm({
   }
 });
 
-// node_modules/@sema-agent/core/dist/core/wiring-manifest.js
-var init_wiring_manifest = __esm({
-  "node_modules/@sema-agent/core/dist/core/wiring-manifest.js"() {
-    init_canonical_json();
-    init_checkpoint_store();
-    init_ask_question();
-  }
-});
-
-// node_modules/@sema-agent/core/dist/core/usage-window-store.js
-var EMPTY_USAGE_WINDOW_RECORD, init_usage_window_store = __esm({
-  "node_modules/@sema-agent/core/dist/core/usage-window-store.js"() {
-    EMPTY_USAGE_WINDOW_RECORD = Object.freeze({
-      slots: Object.freeze([]),
-      buckets: Object.freeze([])
-    });
-  }
-});
-
 // node_modules/@sema-agent/core/dist/core/runner/prepare-task.js
 import { createHash as createHash27, randomBytes as randomBytes27 } from "node:crypto";
-var PROMPT_HASH_SALT, TASK_LIMIT_KEY_DICT, TASK_LIMIT_KEYS, DEFAULT_RESOURCE_TTL_MS, USAGE_WINDOW_REAP_MARGIN_MS, DEFAULT_UNATTENDED_APPROVAL_TTL_MS, NAMESPACED_NAME_SHAPES, init_prepare_task = __esm({
+var PROMPT_HASH_SALT, DEFAULT_RESOURCE_TTL_MS, USAGE_WINDOW_REAP_MARGIN_MS, DEFAULT_UNATTENDED_APPROVAL_TTL_MS, init_prepare_task = __esm({
   "node_modules/@sema-agent/core/dist/core/runner/prepare-task.js"() {
     init_harness();
     init_auto_compaction();
@@ -451540,7 +451620,6 @@ var PROMPT_HASH_SALT, TASK_LIMIT_KEY_DICT, TASK_LIMIT_KEYS, DEFAULT_RESOURCE_TTL
     init_session_rule_policy();
     init_hooks7();
     init_permission_rule_org();
-    init_session_reconcile();
     init_cache_break_detector();
     init_request_params();
     init_timeout();
@@ -451559,11 +451638,13 @@ var PROMPT_HASH_SALT, TASK_LIMIT_KEY_DICT, TASK_LIMIT_KEYS, DEFAULT_RESOURCE_TTL
     init_content_origin();
     init_delegation_provenance();
     init_memory4();
-    init_locked_config();
     init_compliance();
-    init_retention();
     init_memory_admission();
     init_prepare_memory();
+    init_prepare_config_doors();
+    init_prepare_safety_scan();
+    init_prepare_acquire_reconcile();
+    init_prepare_workspace_restore();
     init_default6();
     init_assemble();
     init_tool_catalog();
@@ -451577,7 +451658,6 @@ var PROMPT_HASH_SALT, TASK_LIMIT_KEY_DICT, TASK_LIMIT_KEYS, DEFAULT_RESOURCE_TTL
     init_context_guard();
     init_stub_env();
     init_remote_env3();
-    init_with_retry();
     init_teardown_bounded();
     init_background_shell();
     init_task_registry();
@@ -451600,17 +451680,9 @@ var PROMPT_HASH_SALT, TASK_LIMIT_KEY_DICT, TASK_LIMIT_KEYS, DEFAULT_RESOURCE_TTL
     init_usage_window_store();
     init_types26();
     init_checkpoint_store();
-    PROMPT_HASH_SALT = randomBytes27(16), TASK_LIMIT_KEY_DICT = {
-      maxTokens: !0,
-      maxCostUsd: !0,
-      maxTurns: !0,
-      maxWalltimeMs: !0,
-      maxOutputTokens: !0,
-      approachNotice: !0,
-      budgetStreamCancel: !0,
-      degrade: !0,
-      brainCallGuardrailMs: !0
-    }, TASK_LIMIT_KEYS = Object.keys(TASK_LIMIT_KEY_DICT), DEFAULT_RESOURCE_TTL_MS = 720 * 60 * 60 * 1e3, USAGE_WINDOW_REAP_MARGIN_MS = 3600 * 1e3, DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 720 * 60 * 60 * 1e3, NAMESPACED_NAME_SHAPES = PROTOCOL_TABLE.map((ns) => `${ns.prefix}<peer>__<tool>`).join(", ");
+    init_prepare_config_doors();
+    init_prepare_workspace_restore();
+    PROMPT_HASH_SALT = randomBytes27(16), DEFAULT_RESOURCE_TTL_MS = 720 * 60 * 60 * 1e3, USAGE_WINDOW_REAP_MARGIN_MS = 3600 * 1e3, DEFAULT_UNATTENDED_APPROVAL_TTL_MS = 720 * 60 * 60 * 1e3;
   }
 });
 
@@ -451675,6 +451747,7 @@ var init_tool_output_projection = __esm({
 var SNAPSHOT_TOO_LARGE_TTL_MS, init_runtask = __esm({
   "node_modules/@sema-agent/core/dist/core/runner/runtask.js"() {
     init_read_deny();
+    init_safe_notify();
     init_harness();
     init_llm2();
     init_checkpoint_store();
@@ -462899,7 +462972,7 @@ var WorkerStateUploader, init_WorkerStateUploader = __esm({
         let current5 = payload2, failures = 0;
         for (; !this.closed; ) {
           if (await this.config.send(current5)) return;
-          failures++, await sleep3(this.retryDelay(failures)), this.pending && !this.closed && (current5 = coalescePatches(current5, this.pending), this.pending = null);
+          failures++, await sleep2(this.retryDelay(failures)), this.pending && !this.closed && (current5 = coalescePatches(current5, this.pending), this.pending = null);
         }
       }
       retryDelay(failures) {
@@ -463463,7 +463536,7 @@ var DEFAULT_HEARTBEAT_INTERVAL_MS, STREAM_EVENT_FLUSH_INTERVAL_MS, CCRInitError,
               { level: "warn" }
             ), attempt < 10) {
               let delay = Math.min(500 * 2 ** (attempt - 1), 3e4) + Math.random() * 500;
-              await sleep3(delay);
+              await sleep2(delay);
             }
             continue;
           }
@@ -463474,7 +463547,7 @@ var DEFAULT_HEARTBEAT_INTERVAL_MS, STREAM_EVENT_FLUSH_INTERVAL_MS, CCRInitError,
             { level: "warn" }
           ), attempt < 10) {
             let delay = Math.min(500 * 2 ** (attempt - 1), 3e4) + Math.random() * 500;
-            await sleep3(delay);
+            await sleep2(delay);
           }
         }
         return logForDebugging("CCRClient: GET retries exhausted", { level: "error" }), logForDiagnosticsNoPII("error", "cli_worker_get_retries_exhausted", {
@@ -463855,7 +463928,7 @@ var RECONNECT_BASE_DELAY_MS, RECONNECT_MAX_DELAY_MS, RECONNECT_GIVE_UP_MS, LIVEN
             POST_BASE_DELAY_MS * Math.pow(2, attempt - 1),
             POST_MAX_DELAY_MS
           );
-          await sleep3(delayMs);
+          await sleep2(delayMs);
         }
       }
       // -----------------------------------------------------------------------
@@ -464950,7 +465023,7 @@ async function startWorkPollLoop({
                   break;
                 }
               }
-              hbCycles++, await sleep3(
+              hbCycles++, await sleep2(
                 hbConfig.non_exclusive_heartbeat_interval_ms,
                 cap2.signal
               ), cap2.cleanup();
@@ -464966,14 +465039,14 @@ async function startWorkPollLoop({
           let sleepMs2 = atCapMs > 0 ? atCapMs : pollConfig.non_exclusive_heartbeat_interval_ms;
           if (sleepMs2 > 0) {
             let cap2 = capacitySignal(), sleepStart = Date.now();
-            await sleep3(sleepMs2, cap2.signal), cap2.cleanup();
+            await sleep2(sleepMs2, cap2.signal), cap2.cleanup();
             let overrun = Date.now() - sleepStart - sleepMs2;
             overrun > 6e4 && (logForDebugging(
               `[bridge:repl] At-capacity sleep overran by ${Math.round(overrun / 1e3)}s \u2014 process suspension detected, forcing one fast-poll cycle`
             ), suspensionDetected = !0);
           }
         } else
-          await sleep3(pollConfig.poll_interval_ms_not_at_capacity, signal);
+          await sleep2(pollConfig.poll_interval_ms_not_at_capacity, signal);
         continue;
       }
       let secret;
@@ -465096,7 +465169,7 @@ async function startWorkPollLoop({
           } catch {
           }
       }
-      await sleep3(backoff3, signal);
+      await sleep2(backoff3, signal);
     }
   }
   logForDebugging(
@@ -465639,7 +465712,7 @@ async function withRetry3(fn2, label, cfg) {
       let base = cfg.init_retry_base_delay_ms * 2 ** (attempt - 1), jitter2 = base * cfg.init_retry_jitter_fraction * (2 * Math.random() - 1), delay = Math.min(base + jitter2, cfg.init_retry_max_delay_ms);
       logForDebugging(
         `[remote-bridge] ${label} failed (attempt ${attempt}/${max2}), retrying in ${Math.round(delay)}ms`
-      ), await sleep3(delay);
+      ), await sleep2(delay);
     }
   }
   return null;
@@ -465908,7 +465981,7 @@ async function initReplBridge(options) {
   });
 }
 function deriveTitle(raw2) {
-  let clean5 = stripDisplayTagsAllowEmpty(raw2), flat = (/^(.*?[.!?])\s/.exec(clean5)?.[1] ?? clean5).replace(/\s+/g, " ").trim();
+  let clean6 = stripDisplayTagsAllowEmpty(raw2), flat = (/^(.*?[.!?])\s/.exec(clean6)?.[1] ?? clean6).replace(/\s+/g, " ").trim();
   if (flat)
     return flat.length > TITLE_MAX_LEN ? flat.slice(0, TITLE_MAX_LEN - 1) + "\u2026" : flat;
 }
@@ -467032,6 +467105,47 @@ var RENDERED_UUID_PREFIX_LEN, init_rewindArm = __esm({
   }
 });
 
+// build-src/src/sema/sessionBackgroundArm.ts
+function engineHostsTheTurn(env5 = process.env) {
+  let live = env5.SEMA_LIVE_BASEURL;
+  return typeof live == "string" && live.length > 0;
+}
+function remoteHostsTheTurn(readGlobal = getIsRemoteMode, readPosture = hasRemoteConnection) {
+  try {
+    return readGlobal() || readPosture();
+  } catch {
+    return !0;
+  }
+}
+function noteEngineCapsForSessionBackground(baseUrl, caps) {
+  try {
+    if (typeof caps != "object" || caps === null) return;
+    let v2 = caps.sessionBackgroundable;
+    sessionBackgroundableByBase.set(baseUrl, v2 === !0 ? "advertised" : v2 === !1 ? "declined" : "unknown");
+  } catch {
+  }
+}
+function engineSessionBackgroundableCap(baseUrl) {
+  return sessionBackgroundableByBase.get(baseUrl) ?? "unknown";
+}
+function noteRemoteLaneEngagement(engaged) {
+  remoteLaneEngaged = engaged === !0;
+}
+function sessionBackgroundingVerdict(env5 = process.env) {
+  let cap2 = engineSessionBackgroundableCap(env5.SEMA_LIVE_BASEURL ?? "");
+  return remoteLaneEngaged ? { available: !1, lane: "remote-lane", sessionBackgroundable: cap2 } : engineHostsTheTurn(env5) ? { available: !1, lane: "engine", sessionBackgroundable: cap2 } : remoteHostsTheTurn() ? { available: !1, lane: "remote", sessionBackgroundable: cap2 } : { available: !0 };
+}
+function sessionBackgroundingAvailable(env5 = process.env) {
+  return sessionBackgroundingVerdict(env5).available;
+}
+var sessionBackgroundableByBase, remoteLaneEngaged, init_sessionBackgroundArm = __esm({
+  "build-src/src/sema/sessionBackgroundArm.ts"() {
+    init_state();
+    init_remoteWriteSeam();
+    sessionBackgroundableByBase = /* @__PURE__ */ new Map(), remoteLaneEngaged = !1;
+  }
+});
+
 // build-src/src/sema/footerFleetRows.ts
 function sameShape(a, b3) {
   if (a.viewedRowPresent !== b3.viewedRowPresent || a.taskRowIds.length !== b3.taskRowIds.length || a.workflowIds.length !== b3.workflowIds.length) return !1;
@@ -469650,9 +469764,9 @@ var pyright_default, init_pyright = __esm({
 });
 
 // build-src/src/utils/bash/specs/sleep.ts
-var sleep9, sleep_default, init_sleep3 = __esm({
+var sleep8, sleep_default, init_sleep3 = __esm({
   "build-src/src/utils/bash/specs/sleep.ts"() {
-    sleep9 = {
+    sleep8 = {
       name: "sleep",
       description: "Delay for a specified amount of time",
       args: {
@@ -469660,7 +469774,7 @@ var sleep9, sleep_default, init_sleep3 = __esm({
         description: "Duration to sleep (seconds or with suffix like 5s, 2m, 1h)",
         isOptional: !1
       }
-    }, sleep_default = sleep9;
+    }, sleep_default = sleep8;
   }
 });
 
@@ -469878,47 +469992,283 @@ var NUMERIC, ENV_VAR, WRAPPER_COMMANDS, toArray4, init_prefix2 = __esm({
   }
 });
 
-// build-src/src/sema/localAllowRuleWrite.ts
-function parseLocalAllowRule(rule, expectedToolName) {
-  if (typeof rule != "string" || rule === "")
-    return { ok: !1, error: "rule text is empty" };
-  let value;
+// build-src/src/sema/engineGateSyncAllow.ts
+function cap() {
+  return budgetCap !== null || (budgetCap = loudEnvInt("SEMA_GATE_SYNC_ALLOW_BUDGET", { min: 0, fallback: DEFAULT_BUDGET })), budgetCap;
+}
+function engineGateSyncAllowBudget() {
+  return { used: budgetUsed, cap: cap() };
+}
+function readPermissionContext() {
+  try {
+    return getAppStateStoreRef()?.getState?.()?.toolPermissionContext ?? null;
+  } catch {
+    return null;
+  }
+}
+function canonicalToolName(name) {
+  let n2 = name.replace(/[\s_-]+/g, "").toLowerCase();
+  return n2 === "bash" ? { canonical: "Bash", family: "bash" } : n2 === "write" || n2 === "filewrite" ? { canonical: "Write", family: "fsWrite", pathKey: "file_path" } : n2 === "edit" || n2 === "fileedit" ? { canonical: "Edit", family: "fsWrite", pathKey: "file_path" } : n2 === "multiedit" ? { canonical: "MultiEdit", family: "fsWrite", pathKey: "file_path" } : n2 === "notebookedit" ? { canonical: "NotebookEdit", family: "fsWrite", pathKey: "notebook_path" } : n2 === "read" || n2 === "fileread" ? { canonical: "Read", family: "fsRead", pathKey: "file_path" } : n2 === "webfetch" ? { canonical: "WebFetch", family: "webFetch" } : n2 === "agent" ? { canonical: "Agent", family: "agent" } : n2 === "powershell" ? { canonical: "PowerShell", family: "powershell" } : { canonical: name, family: "other" };
+}
+function permissionsModule() {
+  return init_permissions2(), __toCommonJS(permissions_exports2);
+}
+function filesystemModule() {
+  return init_filesystem(), __toCommonJS(filesystem_exports);
+}
+function bashPermissionsModule() {
+  return init_bashPermissions(), __toCommonJS(bashPermissions_exports);
+}
+function bashCommandsModule() {
+  return init_commands(), __toCommonJS(commands_exports);
+}
+function powershellPermissionsModule() {
+  return init_powershellPermissions(), __toCommonJS(powershellPermissions_exports);
+}
+function webFetchRuleContent(args) {
+  let url3 = args.url;
+  if (typeof url3 != "string" || url3 === "") return null;
+  try {
+    return `domain:${new URL(url3).hostname}`;
+  } catch {
+    return null;
+  }
+}
+function ruleCoord(rule) {
+  let v2 = rule.ruleValue, shape = v2.ruleContent !== void 0 ? `content-rule\xB7len${v2.ruleContent.length}` : "bare";
+  return `${v2.toolName} (${shape}) [${rule.source}]`;
+}
+function hasContentDenyRules(ctx, canonical2) {
+  try {
+    return permissionsModule().getDenyRules(ctx).some((r) => r.ruleValue.toolName === canonical2 && r.ruleValue.ruleContent !== void 0);
+  } catch {
+    return !0;
+  }
+}
+function familyIdentityPresent(family, pathKey2, args) {
+  if (family === "bash" || family === "powershell")
+    return typeof args.command == "string" && args.command.trim() !== "";
+  if (family === "fsWrite" || family === "fsRead") {
+    let p = args[pathKey2 ?? "file_path"];
+    return typeof p == "string" && p !== "";
+  }
+  return family === "webFetch" ? webFetchRuleContent(args) !== null : family === "agent" ? typeof args.subagent_type == "string" && args.subagent_type !== "" : !1;
+}
+function denyVerdict(ctx, req) {
+  let { canonical: canonical2, family, pathKey: pathKey2 } = canonicalToolName(req.toolName), perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 }, toolRule = perms.getDenyRuleForTool(ctx, tool);
+  if (toolRule !== null) return { allow: !1, deny: !0, reason: `deny rule ${ruleCoord(toolRule)}` };
+  if (typeof req.args != "object" || req.args === null) return null;
+  let args = req.args, denyHit = (rule) => rule ? { allow: !1, deny: !0, reason: `deny rule ${ruleCoord(rule)}` } : null;
+  if (family === "bash") {
+    let command8 = args.command;
+    if (typeof command8 == "string" && command8.trim() !== "") {
+      let segments = bashCommandsModule().splitCommand_DEPRECATED(command8);
+      if (segments.length > bashPermissionsModule().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK)
+        throw new Error(
+          `compound command has ${segments.length} subcommands (cap ${bashPermissionsModule().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK}) \u2014 fail-closed to card`
+        );
+      let candidates = segments.length > 1 ? [command8, ...segments] : [command8], candidateEvalFailed = null;
+      for (let cand of candidates)
+        if (!(typeof cand != "string" || cand.trim() === ""))
+          try {
+            let result = bashPermissionsModule().bashToolCheckPermission({ command: cand }, ctx);
+            if (result.behavior === "deny" && result.decisionReason?.type === "rule") {
+              let rule = result.decisionReason.rule;
+              return {
+                allow: !1,
+                deny: !0,
+                reason: `deny rule ${rule ? ruleCoord(rule) : "(bash content rule)"}`
+              };
+            }
+          } catch (e) {
+            candidateEvalFailed = e;
+          }
+      if (candidateEvalFailed !== null) throw candidateEvalFailed;
+    }
+  } else if (family === "powershell") {
+    let command8 = args.command;
+    if (typeof command8 == "string" && command8.trim() !== "") {
+      let fragments = /[`'"]/.test(command8) ? [] : command8.split(/[;|\n\r{}()&]+/).filter((f) => f.trim() !== "");
+      if (fragments.length > bashPermissionsModule().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK)
+        throw new Error(
+          `powershell command has ${fragments.length} fragments (cap ${bashPermissionsModule().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK}) \u2014 fail-closed to card`
+        );
+      let candidates = fragments.length > 1 ? [command8, ...fragments] : [command8], candidateEvalFailed = null;
+      for (let cand of candidates)
+        try {
+          let result = powershellPermissionsModule().powershellToolCheckPermission(
+            { command: cand },
+            ctx
+          );
+          if (result.behavior === "deny" && result.decisionReason?.type === "rule") {
+            let rule = result.decisionReason.rule;
+            return {
+              allow: !1,
+              deny: !0,
+              reason: `deny rule ${rule ? ruleCoord(rule) : "(powershell content rule)"}`
+            };
+          }
+        } catch (e) {
+          candidateEvalFailed = e;
+        }
+      if (candidateEvalFailed !== null) throw candidateEvalFailed;
+    }
+  } else if (family === "fsWrite" || family === "fsRead") {
+    let path28 = args[pathKey2 ?? "file_path"];
+    if (typeof path28 == "string" && path28 !== "") {
+      let toolType = family === "fsWrite" ? "edit" : "read";
+      return denyHit(filesystemModule().matchingRuleForInput(path28, ctx, toolType, "deny"));
+    }
+  } else if (family === "webFetch") {
+    let content = webFetchRuleContent(args);
+    if (content !== null)
+      return denyHit(perms.getRuleByContentsForToolName(ctx, canonical2, "deny").get(content));
+  } else if (family === "agent") {
+    let agentType = args.subagent_type;
+    if (typeof agentType == "string" && agentType !== "")
+      return denyHit(perms.getDenyRuleForAgent(ctx, canonical2, agentType));
+  }
+  return null;
+}
+function bashVerdict(ctx, args) {
+  let command8 = args.command;
+  if (typeof command8 != "string" || command8.trim() === "")
+    return { allow: !1, reason: "bash gate carries no command string" };
+  let result = bashPermissionsModule().bashToolCheckPermission(
+    { command: command8 },
+    ctx
+  );
+  return result.behavior !== "allow" ? { allow: !1, reason: `bash rules say ${String(result.behavior)}` } : result.decisionReason?.type !== "rule" ? { allow: !1, reason: `bash allow came from ${String(result.decisionReason?.type)}, not a remembered rule` } : { allow: !0, reason: "remembered Bash allow rule" };
+}
+function fsWriteVerdict(ctx, canonical2, pathKey2, args) {
+  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
+  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
+  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
+  let path28 = args[pathKey2];
+  if (typeof path28 != "string" || path28 === "")
+    return { allow: !1, reason: "fs-write gate carries no path identity (scoped rules unverifiable)" };
+  let fs15 = filesystemModule();
+  return fs15.matchingRuleForInput(path28, ctx, "edit", "deny") !== null ? { allow: !1, reason: "path deny rule" } : fs15.matchingRuleForInput(path28, ctx, "edit", "ask") !== null ? { allow: !1, reason: "path ask rule" } : fs15.matchingRuleForInput(path28, ctx, "edit", "allow") !== null ? { allow: !0, reason: "remembered path allow rule" } : perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this write" };
+}
+function fsReadVerdict(ctx, canonical2, pathKey2, args) {
+  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
+  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
+  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
+  let path28 = args[pathKey2];
+  if (typeof path28 == "string" && path28 !== "") {
+    let fs15 = filesystemModule();
+    if (fs15.matchingRuleForInput(path28, ctx, "read", "deny") !== null) return { allow: !1, reason: "path deny rule" };
+    if (fs15.matchingRuleForInput(path28, ctx, "read", "ask") !== null) return { allow: !1, reason: "path ask rule" };
+    if (fs15.matchingRuleForInput(path28, ctx, "read", "allow") !== null)
+      return { allow: !0, reason: "remembered read-path allow rule" };
+  }
+  return perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this read" };
+}
+function webFetchVerdict(ctx, canonical2, args) {
+  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
+  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
+  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
+  let content = webFetchRuleContent(args);
+  if (content !== null) {
+    if (perms.getRuleByContentsForToolName(ctx, canonical2, "deny").get(content) !== void 0)
+      return { allow: !1, reason: "domain deny rule" };
+    if (perms.getRuleByContentsForToolName(ctx, canonical2, "ask").get(content) !== void 0)
+      return { allow: !1, reason: "domain ask rule" };
+    if (perms.getRuleByContentsForToolName(ctx, canonical2, "allow").get(content) !== void 0)
+      return { allow: !0, reason: "remembered WebFetch domain allow rule" };
+  }
+  return perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this fetch" };
+}
+function agentVerdict(ctx, canonical2, args) {
+  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
+  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
+  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
+  let agentType = args.subagent_type;
+  return typeof agentType == "string" && agentType !== "" && perms.getAskRules(ctx).some((r) => r.ruleValue.toolName === canonical2 && r.ruleValue.ruleContent === agentType) ? { allow: !1, reason: "agent-type ask rule" } : perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this agent spawn" };
+}
+function genericVerdict(ctx, canonical2) {
+  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
+  return perms.getDenyRuleForTool(ctx, tool) !== null ? { allow: !1, reason: "tool-level deny rule" } : perms.getAskRuleForTool(ctx, tool) !== null ? { allow: !1, reason: "tool-level ask rule" } : perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this tool" };
+}
+function _evaluateWithContextForTest(ctx, req) {
+  if (ctx === null) return { allow: !1, reason: "no toolPermissionContext on this lane" };
   try {
-    value = permissionRuleValueFromString(rule);
+    let denied = denyVerdict(ctx, req);
+    if (denied !== null) return denied;
   } catch (e) {
-    return { ok: !1, error: `rule text did not parse (${String(e)})` };
+    return logForDebugging(`engineGateSyncAllow: deny-rule evaluation threw for "${req.toolName}": ${String(e)}`), { allow: !1, reason: "deny-rule evaluation failed" };
   }
-  if (typeof value.toolName != "string" || value.toolName === "")
-    return { ok: !1, error: "rule text carries no tool name" };
-  if (value.ruleContent === void 0 || value.ruleContent === "")
-    return {
-      ok: !1,
-      error: "candidate is a whole-tool allow rule (broader than this ask) \u2014 not offered locally"
-    };
-  if (expectedToolName !== void 0 && value.toolName !== expectedToolName)
-    return {
-      ok: !1,
-      error: `candidate names tool "${value.toolName}" but this ask is for "${expectedToolName}" \u2014 a rule for another tool would never match`
-    };
-  if (!hasLiteralAnchor(value.ruleContent))
+  if (req.governanceForced === !0)
     return {
-      ok: !1,
-      error: "candidate is all wildcard (matches every command for this tool) \u2014 equivalent to a whole-tool allow, not offered locally"
+      allow: !1,
+      reason: "governance-forced gate: posture/saved-rule auto-allow suspended (deployment governance requires an explicit decision)"
     };
-  if (value.toolName === BASH_TOOL_NAME_FOR_RULES && bashPermissionsModule().bashRuleContentHasDangerousBarePrefix(value.ruleContent))
-    return {
-      ok: !1,
-      error: "candidate is a bare interpreter/wrapper prefix (bash/sh/env/sudo/\u2026) \u2014 persisting it would authorize arbitrary commands, not offered locally"
+  if (ctx.mode === "bypassPermissions") {
+    if (typeof req.args != "object" || req.args === null || Array.isArray(req.args))
+      return { allow: !1, reason: "bypassPermissions posture withheld: gate carries no tool input record (argsOmitted?)" };
+    let { canonical: canonical3, family: family2, pathKey: pathKey3 } = canonicalToolName(req.toolName);
+    return hasContentDenyRules(ctx, canonical3) && !familyIdentityPresent(family2, pathKey3, req.args) ? {
+      allow: !1,
+      reason: "bypassPermissions posture withheld: content-scoped deny rules exist for this tool but the gate carries no verifiable identity (argsOmitted?)"
+    } : {
+      allow: !0,
+      postureAllow: !0,
+      reason: "bypassPermissions posture auto-approves the engine gate (deny rules evaluated first)"
     };
-  {
-    let setup2 = permissionSetupModule2();
-    if (setup2.isDangerousBashPermission(value.toolName, value.ruleContent) || setup2.isDangerousPowerShellPermission(value.toolName, value.ruleContent))
-      return {
-        ok: !1,
-        error: "candidate allow-rule matches a code-execution interpreter/wrapper pattern (python/node/eval/ssh/\u2026) \u2014 persisting it would authorize arbitrary code, not offered locally"
-      };
   }
-  return { ok: !0, value, canonical: permissionRuleValueToString(value) };
+  if (!SYNC_ALLOW_MODES.has(ctx.mode)) return { allow: !1, reason: `mode ${ctx.mode} never auto-allows` };
+  if (typeof req.args != "object" || req.args === null)
+    return { allow: !1, reason: "gate carries no tool input (argsOmitted?)" };
+  let args = req.args, { canonical: canonical2, family, pathKey: pathKey2 } = canonicalToolName(req.toolName);
+  try {
+    return family === "bash" ? bashVerdict(ctx, args) : family === "powershell" ? genericVerdict(ctx, canonical2) : family === "fsWrite" ? fsWriteVerdict(ctx, canonical2, pathKey2 ?? "file_path", args) : family === "fsRead" ? fsReadVerdict(ctx, canonical2, pathKey2 ?? "file_path", args) : family === "webFetch" ? webFetchVerdict(ctx, canonical2, args) : family === "agent" ? agentVerdict(ctx, canonical2, args) : genericVerdict(ctx, canonical2);
+  } catch (e) {
+    return logForDebugging(`engineGateSyncAllow: rule evaluation threw for "${req.toolName}": ${String(e)}`), { allow: !1, reason: "rule evaluation failed" };
+  }
+}
+function evaluateEngineGateSyncAllow(req) {
+  let ctx = readPermissionContext(), verdict = _evaluateWithContextForTest(ctx, req);
+  if (verdict.allow === !1 && verdict.deny === !0)
+    return logForDebugging(
+      `engineGateSyncAllow: gate for "${req.toolName}" AUTO-DENIED by permission rule (${verdict.reason}; mode=${ctx?.mode ?? "none"})`
+    ), verdict;
+  if (!verdict.allow) {
+    let allowRuleCount = -1;
+    try {
+      ctx && (allowRuleCount = permissionsModule().getAllowRules(ctx).length);
+    } catch {
+    }
+    return logForDebugging(
+      `engineGateSyncAllow: no sync allow for "${req.toolName}" (${verdict.reason}; mode=${ctx?.mode ?? "none"}, allowRules=${allowRuleCount})`
+    ), verdict;
+  }
+  return verdict.postureAllow === !0 ? (logForDebugging(
+    `engineGateSyncAllow: gate for "${req.toolName}" AUTO-ALLOWED by bypassPermissions posture (${verdict.reason})`
+  ), verdict) : budgetUsed >= cap() ? (budgetExhaustedLogged || (budgetExhaustedLogged = !0, logForDebugging(
+    `engineGateSyncAllow: programmatic-allow budget exhausted (${budgetUsed}/${cap()}) \u2014 every further gate goes back to the approval card`
+  )), { allow: !1, reason: "programmatic-allow budget exhausted" }) : (budgetUsed++, verdict);
+}
+var SYNC_ALLOW_MODES, DEFAULT_BUDGET, budgetUsed, budgetCap, budgetExhaustedLogged, init_engineGateSyncAllow = __esm({
+  "build-src/src/sema/engineGateSyncAllow.ts"() {
+    init_appStateRef();
+    init_envKnobs();
+    init_debug();
+    SYNC_ALLOW_MODES = /* @__PURE__ */ new Set(["default", "acceptEdits", "auto"]), DEFAULT_BUDGET = 100, budgetUsed = 0, budgetCap = null, budgetExhaustedLogged = !1;
+  }
+});
+
+// build-src/src/sema/localAllowRuleWrite.ts
+function localAllowRuleDeps() {
+  return {
+    parseRule: (rule) => permissionRuleValueFromString(rule),
+    formatRule: (value) => permissionRuleValueToString(value),
+    bashRuleContentHasDangerousBarePrefix: (ruleContent) => bashPermissionsModule2().bashRuleContentHasDangerousBarePrefix(ruleContent),
+    isDangerousBashPermission: (toolName2, ruleContent) => permissionSetupModule2().isDangerousBashPermission(toolName2, ruleContent),
+    isDangerousPowerShellPermission: (toolName2, ruleContent) => permissionSetupModule2().isDangerousPowerShellPermission(toolName2, ruleContent)
+  };
+}
+function parseLocalAllowRule2(rule, expectedToolName) {
+  return parseLocalAllowRule(rule, expectedToolName, localAllowRuleDeps());
 }
 function localAllowRulesPermittedByPolicy() {
   try {
@@ -469927,25 +470277,13 @@ function localAllowRulesPermittedByPolicy() {
     return !1;
   }
 }
-function hasLiteralAnchor(ruleContent) {
-  let out6 = "";
-  for (let i = 0; i < ruleContent.length; i++) {
-    let ch2 = ruleContent[i];
-    if (ch2 === "\\" && i + 1 < ruleContent.length) {
-      out6 += ruleContent[i + 1], i++;
-      continue;
-    }
-    ch2 !== "*" && (out6 += ch2);
-  }
-  return out6.trim() !== "";
-}
 function permissionUpdateModule() {
   return init_PermissionUpdate(), __toCommonJS(PermissionUpdate_exports);
 }
 function permissionsLoaderModule() {
   return init_permissionsLoader(), __toCommonJS(permissionsLoader_exports);
 }
-function bashPermissionsModule() {
+function bashPermissionsModule2() {
   return init_bashPermissions(), __toCommonJS(bashPermissions_exports);
 }
 function permissionSetupModule2() {
@@ -469954,8 +470292,16 @@ function permissionSetupModule2() {
 function leaderBridgeModule() {
   return init_leaderPermissionBridge(), __toCommonJS(leaderPermissionBridge_exports);
 }
+function redemptionGate() {
+  try {
+    let { used, cap: cap2 } = engineGateSyncAllowBudget();
+    if (cap2 === 0) return "budget-disabled";
+    if (used >= cap2) return "budget-exhausted";
+  } catch {
+  }
+}
 function persistLocalAllowRule(rule) {
-  let parsed = parseLocalAllowRule(rule);
+  let parsed = parseLocalAllowRule2(rule);
   if (!parsed.ok)
     return logForDebugging(`localAllowRuleWrite: refusing to persist a rule candidate \u2014 ${parsed.error}`), { ok: !1, error: parsed.error };
   let update2 = {
@@ -469985,7 +470331,7 @@ function persistLocalAllowRule(rule) {
   try {
     let setCtx = leaderBridgeModule().getLeaderSetToolPermissionContext(), state4 = getAppStateStoreRef()?.getState?.();
     if (setCtx && state4?.toolPermissionContext)
-      return setCtx(mod.applyPermissionUpdate(state4.toolPermissionContext, update2)), { ok: !0, appliedLive: !0 };
+      return setCtx(mod.applyPermissionUpdate(state4.toolPermissionContext, update2)), { ok: !0, appliedLive: !0, ...gatedStamp() };
     logForDebugging(
       "localAllowRuleWrite: rule persisted to local settings, but this lane has no in-memory permission context to update (it will take effect on next start)"
     );
@@ -469994,14 +470340,19 @@ function persistLocalAllowRule(rule) {
       `localAllowRuleWrite: rule persisted, but applying it to the in-memory permission context failed (non-fatal): ${String(e)}`
     );
   }
-  return { ok: !0, appliedLive: !1 };
+  return { ok: !0, appliedLive: !1, ...gatedStamp() };
 }
-var BASH_TOOL_NAME_FOR_RULES, init_localAllowRuleWrite = __esm({
+function gatedStamp() {
+  let gate = redemptionGate();
+  return gate !== void 0 ? { redemptionGated: gate } : {};
+}
+var init_localAllowRuleWrite = __esm({
   "build-src/src/sema/localAllowRuleWrite.ts"() {
     init_permissionRuleParser();
+    init_dist();
     init_debug();
     init_appStateRef();
-    BASH_TOOL_NAME_FOR_RULES = "Bash";
+    init_engineGateSyncAllow();
   }
 });
 
@@ -470046,7 +470397,7 @@ function tryEngineRulePersistSelection(confirm2, value, onDone) {
 function readLocalRedeemable(confirm2) {
   let expected = typeof confirm2.tool?.name == "string" ? confirm2.tool.name : void 0, out6 = [];
   for (let s of readSuggestions(confirm2, "ruleSuggestionsReadOnly")) {
-    let parsed = parseLocalAllowRule(s.rule, expected);
+    let parsed = parseLocalAllowRule2(s.rule, expected);
     parsed.ok && out6.push({ rule: s.rule, canonical: parsed.canonical });
   }
   return out6;
@@ -491796,7 +492147,7 @@ async function reconcileResumePendingApprovals(deps2) {
       debug3("an owned pending row carries no taskId handle \u2014 both reopen arms address by taskId, nothing to reopen"), verdict.skipped.push({ taskId: null, reason: "no-task-handle" });
       continue;
     }
-    let kind = gateKindOf(row2), arm = kind === null ? null : ASK_PARK_GATE_KINDS2.includes(kind) ? "ask" : PLAN_REVIEW_GATE_KINDS2.includes(kind) ? "plan" : null;
+    let kind = gateKindOf(row2), arm = kind === null ? null : ASK_PARK_GATE_KINDS.includes(kind) ? "ask" : PLAN_REVIEW_GATE_KINDS.includes(kind) ? "plan" : null;
     if (arm === null) {
       debug3(
         `owned pending row (task ${taskId}) is parked on gate kind '${kind ?? "<absent>"}' \u2014 not in either triage table, refusing to route it into a known reopen arm`
@@ -492064,7 +492415,7 @@ function useLiveQuestionOverlay({
             }
             alive && (setToolUseConfirmQueue(
               (queue3) => queue3.some((e) => e.toolUseID === frame.questionId) ? queue3 : [...queue3, entry]
-            ), registerArmedGateFromQuestionId2(frame.questionId));
+            ), registerArmedGateFromQuestionId(frame.questionId));
           }
         })();
       } else frame.type === "question_complete" && (completedBeforeDialog.add(frame.questionId), setToolUseConfirmQueue((queue3) => queue3.filter((e) => e.toolUseID !== frame.questionId)));
@@ -492129,28 +492480,6 @@ var import_compiler_runtime299, import_react298, init_useIDEIntegration = __esm(
   }
 });
 
-// build-src/src/sema/sessionBackgroundArm.ts
-function engineHostsTheTurn(env5 = process.env) {
-  let live = env5.SEMA_LIVE_BASEURL;
-  return typeof live == "string" && live.length > 0;
-}
-function remoteHostsTheTurn(readGlobal = getIsRemoteMode, readPosture = hasRemoteConnection) {
-  try {
-    return readGlobal() || readPosture();
-  } catch {
-    return !0;
-  }
-}
-function sessionBackgroundingAvailable(env5 = process.env) {
-  return !engineHostsTheTurn(env5) && !remoteHostsTheTurn();
-}
-var init_sessionBackgroundArm = __esm({
-  "build-src/src/sema/sessionBackgroundArm.ts"() {
-    init_state();
-    init_remoteWriteSeam();
-  }
-});
-
 // build-src/src/components/SessionBackgroundHint.tsx
 function SessionBackgroundHint(t0) {
   let $3 = (0, import_compiler_runtime300.c)(10), {
@@ -495342,7 +495671,7 @@ function _temp158() {
 }
 var import_compiler_runtime308, import_react313, SETTINGS_ERRORS_NOTIFICATION_KEY, init_useSettingsErrors = __esm({
   "build-src/src/hooks/notifs/useSettingsErrors.tsx"() {
-    import_compiler_runtime308 = __toESM(require_compiler_runtime(), 1), import_react313 = __toESM(require_react(), 1);
+    import_compiler_runtime308 = __toESM(require_compiler_runtime()), import_react313 = __toESM(require_react());
     init_notifications2();
     init_state();
     init_allErrors();
@@ -498247,7 +498576,11 @@ function REPL({
     setIsLoading: setIsExternalLoading,
     setToolUseConfirmQueue,
     tools: combinedInitialTools
-  }), activeRemote = sshRemote.isRemoteMode ? sshRemote : directConnect.isRemoteMode ? directConnect : remoteSession, [pastedContents, setPastedContents] = (0, import_react332.useState)({}), [submitCount, setSubmitCount] = (0, import_react332.useState)(0), responseLengthRef = (0, import_react332.useRef)(0), apiMetricsRef2 = (0, import_react332.useRef)([]), setResponseLength = (0, import_react332.useCallback)((f) => {
+  }), activeRemote = sshRemote.isRemoteMode ? sshRemote : directConnect.isRemoteMode ? directConnect : remoteSession;
+  (0, import_react332.useLayoutEffect)(() => {
+    noteRemoteLaneEngagement(activeRemote.isRemoteMode);
+  }, [activeRemote.isRemoteMode]);
+  let [pastedContents, setPastedContents] = (0, import_react332.useState)({}), [submitCount, setSubmitCount] = (0, import_react332.useState)(0), responseLengthRef = (0, import_react332.useRef)(0), apiMetricsRef2 = (0, import_react332.useRef)([]), setResponseLength = (0, import_react332.useCallback)((f) => {
     let prev = responseLengthRef.current;
     if (responseLengthRef.current = f(prev), responseLengthRef.current > prev) {
       let entries = apiMetricsRef2.current;
@@ -500120,6 +500453,7 @@ var import_compiler_runtime325, React175, import_react332, import_jsx_runtime477
     init_userMessageSelect();
     init_engineAgentView();
     init_appStateRef();
+    init_sessionBackgroundArm();
     init_chrome_agentprogress();
     init_selectors();
     init_dist();
@@ -509532,265 +509866,41 @@ var NOTICE_KEY, NOTICE_TIMEOUT_MS, init_classifierVerdictWire2 = __esm({
   }
 });
 
-// build-src/src/sema/engineGateSyncAllow.ts
-function cap() {
-  return budgetCap !== null || (budgetCap = loudEnvInt("SEMA_GATE_SYNC_ALLOW_BUDGET", { min: 0, fallback: DEFAULT_BUDGET })), budgetCap;
-}
-function readPermissionContext() {
-  try {
-    return getAppStateStoreRef()?.getState?.()?.toolPermissionContext ?? null;
-  } catch {
-    return null;
-  }
-}
-function canonicalToolName(name) {
-  let n2 = name.replace(/[\s_-]+/g, "").toLowerCase();
-  return n2 === "bash" ? { canonical: "Bash", family: "bash" } : n2 === "write" || n2 === "filewrite" ? { canonical: "Write", family: "fsWrite", pathKey: "file_path" } : n2 === "edit" || n2 === "fileedit" ? { canonical: "Edit", family: "fsWrite", pathKey: "file_path" } : n2 === "multiedit" ? { canonical: "MultiEdit", family: "fsWrite", pathKey: "file_path" } : n2 === "notebookedit" ? { canonical: "NotebookEdit", family: "fsWrite", pathKey: "notebook_path" } : n2 === "read" || n2 === "fileread" ? { canonical: "Read", family: "fsRead", pathKey: "file_path" } : n2 === "webfetch" ? { canonical: "WebFetch", family: "webFetch" } : n2 === "agent" ? { canonical: "Agent", family: "agent" } : n2 === "powershell" ? { canonical: "PowerShell", family: "powershell" } : { canonical: name, family: "other" };
-}
-function permissionsModule() {
-  return init_permissions2(), __toCommonJS(permissions_exports2);
-}
-function filesystemModule() {
-  return init_filesystem(), __toCommonJS(filesystem_exports);
-}
-function bashPermissionsModule2() {
-  return init_bashPermissions(), __toCommonJS(bashPermissions_exports);
-}
-function bashCommandsModule() {
-  return init_commands(), __toCommonJS(commands_exports);
-}
-function powershellPermissionsModule() {
-  return init_powershellPermissions(), __toCommonJS(powershellPermissions_exports);
-}
-function webFetchRuleContent(args) {
-  let url3 = args.url;
-  if (typeof url3 != "string" || url3 === "") return null;
-  try {
-    return `domain:${new URL(url3).hostname}`;
-  } catch {
-    return null;
-  }
-}
-function ruleCoord(rule) {
-  let v2 = rule.ruleValue, shape = v2.ruleContent !== void 0 ? `content-rule\xB7len${v2.ruleContent.length}` : "bare";
-  return `${v2.toolName} (${shape}) [${rule.source}]`;
-}
-function hasContentDenyRules(ctx, canonical2) {
-  try {
-    return permissionsModule().getDenyRules(ctx).some((r) => r.ruleValue.toolName === canonical2 && r.ruleValue.ruleContent !== void 0);
-  } catch {
-    return !0;
-  }
-}
-function familyIdentityPresent(family, pathKey2, args) {
-  if (family === "bash" || family === "powershell")
-    return typeof args.command == "string" && args.command.trim() !== "";
-  if (family === "fsWrite" || family === "fsRead") {
-    let p = args[pathKey2 ?? "file_path"];
-    return typeof p == "string" && p !== "";
-  }
-  return family === "webFetch" ? webFetchRuleContent(args) !== null : family === "agent" ? typeof args.subagent_type == "string" && args.subagent_type !== "" : !1;
+// build-src/src/sema/probeCauseNote.ts
+function readOperands(v2) {
+  if (typeof v2 != "object" || v2 === null) return;
+  let o = v2;
+  if (!(!Array.isArray(o.shown) || o.shown.some((s) => typeof s != "string")) && !(typeof o.total != "number" || !Number.isInteger(o.total) || o.total < 0) && !(o.total < o.shown.length))
+    return { shown: o.shown, total: o.total };
 }
-function denyVerdict(ctx, req) {
-  let { canonical: canonical2, family, pathKey: pathKey2 } = canonicalToolName(req.toolName), perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 }, toolRule = perms.getDenyRuleForTool(ctx, tool);
-  if (toolRule !== null) return { allow: !1, deny: !0, reason: `deny rule ${ruleCoord(toolRule)}` };
-  if (typeof req.args != "object" || req.args === null) return null;
-  let args = req.args, denyHit = (rule) => rule ? { allow: !1, deny: !0, reason: `deny rule ${ruleCoord(rule)}` } : null;
-  if (family === "bash") {
-    let command8 = args.command;
-    if (typeof command8 == "string" && command8.trim() !== "") {
-      let segments = bashCommandsModule().splitCommand_DEPRECATED(command8);
-      if (segments.length > bashPermissionsModule2().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK)
-        throw new Error(
-          `compound command has ${segments.length} subcommands (cap ${bashPermissionsModule2().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK}) \u2014 fail-closed to card`
-        );
-      let candidates = segments.length > 1 ? [command8, ...segments] : [command8], candidateEvalFailed = null;
-      for (let cand of candidates)
-        if (!(typeof cand != "string" || cand.trim() === ""))
-          try {
-            let result = bashPermissionsModule2().bashToolCheckPermission({ command: cand }, ctx);
-            if (result.behavior === "deny" && result.decisionReason?.type === "rule") {
-              let rule = result.decisionReason.rule;
-              return {
-                allow: !1,
-                deny: !0,
-                reason: `deny rule ${rule ? ruleCoord(rule) : "(bash content rule)"}`
-              };
-            }
-          } catch (e) {
-            candidateEvalFailed = e;
-          }
-      if (candidateEvalFailed !== null) throw candidateEvalFailed;
-    }
-  } else if (family === "powershell") {
-    let command8 = args.command;
-    if (typeof command8 == "string" && command8.trim() !== "") {
-      let fragments = /[`'"]/.test(command8) ? [] : command8.split(/[;|\n\r{}()&]+/).filter((f) => f.trim() !== "");
-      if (fragments.length > bashPermissionsModule2().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK)
-        throw new Error(
-          `powershell command has ${fragments.length} fragments (cap ${bashPermissionsModule2().MAX_SUBCOMMANDS_FOR_SECURITY_CHECK}) \u2014 fail-closed to card`
-        );
-      let candidates = fragments.length > 1 ? [command8, ...fragments] : [command8], candidateEvalFailed = null;
-      for (let cand of candidates)
-        try {
-          let result = powershellPermissionsModule().powershellToolCheckPermission(
-            { command: cand },
-            ctx
-          );
-          if (result.behavior === "deny" && result.decisionReason?.type === "rule") {
-            let rule = result.decisionReason.rule;
-            return {
-              allow: !1,
-              deny: !0,
-              reason: `deny rule ${rule ? ruleCoord(rule) : "(powershell content rule)"}`
-            };
-          }
-        } catch (e) {
-          candidateEvalFailed = e;
-        }
-      if (candidateEvalFailed !== null) throw candidateEvalFailed;
+function readProbeCauseKey(source) {
+  if (typeof source != "object" || source === null) return;
+  let raw2 = source.probeCause;
+  if (typeof raw2 != "object" || raw2 === null) return;
+  let o = raw2;
+  if (typeof o.code != "string" || o.code.length === 0) return;
+  let roots = readOperands(o.roots);
+  if (roots !== void 0) {
+    if (o.further !== void 0) {
+      let further = readOperands(o.further);
+      return further === void 0 ? void 0 : { code: o.code, roots, further };
     }
-  } else if (family === "fsWrite" || family === "fsRead") {
-    let path28 = args[pathKey2 ?? "file_path"];
-    if (typeof path28 == "string" && path28 !== "") {
-      let toolType = family === "fsWrite" ? "edit" : "read";
-      return denyHit(filesystemModule().matchingRuleForInput(path28, ctx, toolType, "deny"));
-    }
-  } else if (family === "webFetch") {
-    let content = webFetchRuleContent(args);
-    if (content !== null)
-      return denyHit(perms.getRuleByContentsForToolName(ctx, canonical2, "deny").get(content));
-  } else if (family === "agent") {
-    let agentType = args.subagent_type;
-    if (typeof agentType == "string" && agentType !== "")
-      return denyHit(perms.getDenyRuleForAgent(ctx, canonical2, agentType));
+    return { code: o.code, roots };
   }
-  return null;
 }
-function bashVerdict(ctx, args) {
-  let command8 = args.command;
-  if (typeof command8 != "string" || command8.trim() === "")
-    return { allow: !1, reason: "bash gate carries no command string" };
-  let result = bashPermissionsModule2().bashToolCheckPermission(
-    { command: command8 },
-    ctx
-  );
-  return result.behavior !== "allow" ? { allow: !1, reason: `bash rules say ${String(result.behavior)}` } : result.decisionReason?.type !== "rule" ? { allow: !1, reason: `bash allow came from ${String(result.decisionReason?.type)}, not a remembered rule` } : { allow: !0, reason: "remembered Bash allow rule" };
+function clean5(v2, max2) {
+  return v2.replace(/[\x00-\x1f\x7f]/g, ".").slice(0, max2);
 }
-function fsWriteVerdict(ctx, canonical2, pathKey2, args) {
-  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
-  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
-  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
-  let path28 = args[pathKey2];
-  if (typeof path28 != "string" || path28 === "")
-    return { allow: !1, reason: "fs-write gate carries no path identity (scoped rules unverifiable)" };
-  let fs15 = filesystemModule();
-  return fs15.matchingRuleForInput(path28, ctx, "edit", "deny") !== null ? { allow: !1, reason: "path deny rule" } : fs15.matchingRuleForInput(path28, ctx, "edit", "ask") !== null ? { allow: !1, reason: "path ask rule" } : fs15.matchingRuleForInput(path28, ctx, "edit", "allow") !== null ? { allow: !0, reason: "remembered path allow rule" } : perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this write" };
-}
-function fsReadVerdict(ctx, canonical2, pathKey2, args) {
-  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
-  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
-  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
-  let path28 = args[pathKey2];
-  if (typeof path28 == "string" && path28 !== "") {
-    let fs15 = filesystemModule();
-    if (fs15.matchingRuleForInput(path28, ctx, "read", "deny") !== null) return { allow: !1, reason: "path deny rule" };
-    if (fs15.matchingRuleForInput(path28, ctx, "read", "ask") !== null) return { allow: !1, reason: "path ask rule" };
-    if (fs15.matchingRuleForInput(path28, ctx, "read", "allow") !== null)
-      return { allow: !0, reason: "remembered read-path allow rule" };
-  }
-  return perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this read" };
-}
-function webFetchVerdict(ctx, canonical2, args) {
-  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
-  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
-  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
-  let content = webFetchRuleContent(args);
-  if (content !== null) {
-    if (perms.getRuleByContentsForToolName(ctx, canonical2, "deny").get(content) !== void 0)
-      return { allow: !1, reason: "domain deny rule" };
-    if (perms.getRuleByContentsForToolName(ctx, canonical2, "ask").get(content) !== void 0)
-      return { allow: !1, reason: "domain ask rule" };
-    if (perms.getRuleByContentsForToolName(ctx, canonical2, "allow").get(content) !== void 0)
-      return { allow: !0, reason: "remembered WebFetch domain allow rule" };
-  }
-  return perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this fetch" };
-}
-function agentVerdict(ctx, canonical2, args) {
-  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
-  if (perms.getDenyRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level deny rule" };
-  if (perms.getAskRuleForTool(ctx, tool) !== null) return { allow: !1, reason: "tool-level ask rule" };
-  let agentType = args.subagent_type;
-  return typeof agentType == "string" && agentType !== "" && perms.getAskRules(ctx).some((r) => r.ruleValue.toolName === canonical2 && r.ruleValue.ruleContent === agentType) ? { allow: !1, reason: "agent-type ask rule" } : perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this agent spawn" };
-}
-function genericVerdict(ctx, canonical2) {
-  let perms = permissionsModule(), tool = { name: canonical2, mcpInfo: void 0 };
-  return perms.getDenyRuleForTool(ctx, tool) !== null ? { allow: !1, reason: "tool-level deny rule" } : perms.getAskRuleForTool(ctx, tool) !== null ? { allow: !1, reason: "tool-level ask rule" } : perms.toolAlwaysAllowedRule(ctx, tool) !== null ? { allow: !0, reason: "remembered whole-tool allow rule" } : { allow: !1, reason: "no remembered allow rule for this tool" };
-}
-function _evaluateWithContextForTest(ctx, req) {
-  if (ctx === null) return { allow: !1, reason: "no toolPermissionContext on this lane" };
-  try {
-    let denied = denyVerdict(ctx, req);
-    if (denied !== null) return denied;
-  } catch (e) {
-    return logForDebugging(`engineGateSyncAllow: deny-rule evaluation threw for "${req.toolName}": ${String(e)}`), { allow: !1, reason: "deny-rule evaluation failed" };
-  }
-  if (req.governanceForced === !0)
-    return {
-      allow: !1,
-      reason: "governance-forced gate: posture/saved-rule auto-allow suspended (deployment governance requires an explicit decision)"
-    };
-  if (ctx.mode === "bypassPermissions") {
-    if (typeof req.args != "object" || req.args === null || Array.isArray(req.args))
-      return { allow: !1, reason: "bypassPermissions posture withheld: gate carries no tool input record (argsOmitted?)" };
-    let { canonical: canonical3, family: family2, pathKey: pathKey3 } = canonicalToolName(req.toolName);
-    return hasContentDenyRules(ctx, canonical3) && !familyIdentityPresent(family2, pathKey3, req.args) ? {
-      allow: !1,
-      reason: "bypassPermissions posture withheld: content-scoped deny rules exist for this tool but the gate carries no verifiable identity (argsOmitted?)"
-    } : {
-      allow: !0,
-      postureAllow: !0,
-      reason: "bypassPermissions posture auto-approves the engine gate (deny rules evaluated first)"
-    };
-  }
-  if (!SYNC_ALLOW_MODES.has(ctx.mode)) return { allow: !1, reason: `mode ${ctx.mode} never auto-allows` };
-  if (typeof req.args != "object" || req.args === null)
-    return { allow: !1, reason: "gate carries no tool input (argsOmitted?)" };
-  let args = req.args, { canonical: canonical2, family, pathKey: pathKey2 } = canonicalToolName(req.toolName);
-  try {
-    return family === "bash" ? bashVerdict(ctx, args) : family === "powershell" ? genericVerdict(ctx, canonical2) : family === "fsWrite" ? fsWriteVerdict(ctx, canonical2, pathKey2 ?? "file_path", args) : family === "fsRead" ? fsReadVerdict(ctx, canonical2, pathKey2 ?? "file_path", args) : family === "webFetch" ? webFetchVerdict(ctx, canonical2, args) : family === "agent" ? agentVerdict(ctx, canonical2, args) : genericVerdict(ctx, canonical2);
-  } catch (e) {
-    return logForDebugging(`engineGateSyncAllow: rule evaluation threw for "${req.toolName}": ${String(e)}`), { allow: !1, reason: "rule evaluation failed" };
-  }
+function operandsText(f) {
+  let shown = f.shown.slice(0, 8).map((p) => clean5(p, 120)), more = Math.max(0, f.total - shown.length);
+  return shown.length === 0 ? `${String(f.total)} total` : more > 0 ? `${shown.join(", ")} (+${String(more)} more)` : shown.join(", ");
 }
-function evaluateEngineGateSyncAllow(req) {
-  let ctx = readPermissionContext(), verdict = _evaluateWithContextForTest(ctx, req);
-  if (verdict.allow === !1 && verdict.deny === !0)
-    return logForDebugging(
-      `engineGateSyncAllow: gate for "${req.toolName}" AUTO-DENIED by permission rule (${verdict.reason}; mode=${ctx?.mode ?? "none"})`
-    ), verdict;
-  if (!verdict.allow) {
-    let allowRuleCount = -1;
-    try {
-      ctx && (allowRuleCount = permissionsModule().getAllowRules(ctx).length);
-    } catch {
-    }
-    return logForDebugging(
-      `engineGateSyncAllow: no sync allow for "${req.toolName}" (${verdict.reason}; mode=${ctx?.mode ?? "none"}, allowRules=${allowRuleCount})`
-    ), verdict;
-  }
-  return verdict.postureAllow === !0 ? (logForDebugging(
-    `engineGateSyncAllow: gate for "${req.toolName}" AUTO-ALLOWED by bypassPermissions posture (${verdict.reason})`
-  ), verdict) : budgetUsed >= cap() ? (budgetExhaustedLogged || (budgetExhaustedLogged = !0, logForDebugging(
-    `engineGateSyncAllow: programmatic-allow budget exhausted (${budgetUsed}/${cap()}) \u2014 every further gate goes back to the approval card`
-  )), { allow: !1, reason: "programmatic-allow budget exhausted" }) : (budgetUsed++, verdict);
+function probeCauseNoteText(pc) {
+  let parts = [`reversibility probe: ${clean5(pc.code, 200)} \u2014 roots: ${operandsText(pc.roots)}`];
+  return pc.further !== void 0 && parts.push(`further: ${operandsText(pc.further)}`), parts.join(" \u2014 ");
 }
-var SYNC_ALLOW_MODES, DEFAULT_BUDGET, budgetUsed, budgetCap, budgetExhaustedLogged, init_engineGateSyncAllow = __esm({
-  "build-src/src/sema/engineGateSyncAllow.ts"() {
-    init_appStateRef();
-    init_envKnobs();
-    init_debug();
-    SYNC_ALLOW_MODES = /* @__PURE__ */ new Set(["default", "acceptEdits", "auto"]), DEFAULT_BUDGET = 100, budgetUsed = 0, budgetCap = null, budgetExhaustedLogged = !1;
+var init_probeCauseNote = __esm({
+  "build-src/src/sema/probeCauseNote.ts"() {
   }
 });
 
@@ -509838,6 +509948,14 @@ function stubToolUseContext() {
     options: {}
   };
 }
+function composeCardWireNote(req) {
+  let probeCause = readProbeCauseKey(req), parts = [
+    ...req.governanceForced === !0 ? ["Required by deployment governance \u2014 permission-mode overrides do not apply"] : [],
+    ...req.wireNote !== void 0 ? [req.wireNote] : [],
+    ...probeCause !== void 0 ? [probeCauseNoteText(probeCause)] : []
+  ];
+  return parts.length > 0 ? parts.join(" \xB7 ") : void 0;
+}
 function shellApprovalCardPort(req) {
   let setQueue = getLeaderToolUseConfirmQueue();
   if (!setQueue) {
@@ -509933,12 +510051,11 @@ function shellApprovalCardPort(req) {
       // (AUTONOMY/commandPolicy/MANUAL_MODE_SHELL_GATE/SENSITIVE_WRITE_PATTERNS),权限模式
       // 表态掀不掉——呈现走 wireNote 超集车道(dim 行,与 argsOmitted 提示同位,可叠加)。
       // 🔴 缺席 ≠ false:键只在为真时在场;缺席帧绝不合成治理句(缺席=无治理来源证据)。
-      ...req.governanceForced === !0 || req.wireNote !== void 0 ? {
-        wireNote: [
-          ...req.governanceForced === !0 ? ["Required by deployment governance \u2014 permission-mode overrides do not apply"] : [],
-          ...req.wireNote !== void 0 ? [req.wireNote] : []
-        ].join(" \xB7 ")
-      } : {},
+      // #280 件4:probeCause 探针因由句并入同车道(组装单源 composeCardWireNote,见其顶注)。
+      ...(() => {
+        let wireNote = composeCardWireNote(req);
+        return wireNote !== void 0 ? { wireNote } : {};
+      })(),
       permissionPromptStartTimeMs: Date.now(),
       onUserInteraction() {
       },
@@ -509973,7 +510090,7 @@ function shellApprovalCardPort(req) {
       }
     };
     try {
-      setQueue((queue3) => [...queue3, confirm2]), registerArmedGate2(callKey);
+      setQueue((queue3) => [...queue3, confirm2]), registerArmedGate(callKey);
     } catch (e) {
       settle2({ kind: "failed", reason: `enqueue ToolUseConfirm failed: ${String(e)}` });
     }
@@ -509991,7 +510108,8 @@ var asWireTool, forcedToolLoadFailureForTest, forcedToolNilExportForTest, loadFi
     init_debug();
     init_engineGateSyncAllow();
     init_localAllowRuleWrite();
-    init_persistedRulesWire();
+    init_probeCauseNote();
+    init_persistedRulesWire2();
     init_armedGateRegistry2();
     init_dist();
     asWireTool = (t2) => t2, forcedToolLoadFailureForTest = null, forcedToolNilExportForTest = null, loadFileWrite = () => (init_FileWriteTool(), __toCommonJS(FileWriteTool_exports)).FileWriteTool, loadFileEdit = () => (init_FileEditTool(), __toCommonJS(FileEditTool_exports)).FileEditTool, loadNotebookEdit = () => (init_NotebookEditTool(), __toCommonJS(NotebookEditTool_exports)).NotebookEditTool, loadBash = () => (init_BashTool(), __toCommonJS(BashTool_exports)).BashTool, loadEngineWorkflow = () => (init_EngineWorkflowTool(), __toCommonJS(EngineWorkflowTool_exports)).EngineWorkflowTool, KNOWN_TOOL_LOADERS = {
@@ -510124,6 +510242,8 @@ function askCallKey(askId) {
 function approvalCardRequestFrom(frame, opts) {
   let card = frame.card, notes = [riskNoteFor(card.risk)];
   card.argsOmitted === !0 && notes.push("arguments omitted by the engine (over the 16 KiB cap) \u2014 this does NOT mean the call has no arguments");
+  let probeCause = readProbeCauseKey(card);
+  probeCause !== void 0 && notes.push(probeCauseNoteText(probeCause));
   let args = card.argsOmitted === !0 || typeof card.args != "object" || card.args === null ? {} : card.args;
   return {
     toolName: card.toolName,
@@ -510410,6 +510530,7 @@ var STREAM_APPROVAL_CAP, ASK_DECISION_DISABLED_CODE, IDEMPOTENCY_KEY_MAX, PARKIN
     init_dist();
     init_debug();
     init_appStateRef();
+    init_probeCauseNote();
     init_wireNoticePort();
     STREAM_APPROVAL_CAP = "streamApproval", ASK_DECISION_DISABLED_CODE = "feature.approval_ask_disabled", IDEMPOTENCY_KEY_MAX = 255, PARKING_POLL_MAX = 2, PARKING_POLL_DELAY_MS = 400, CAPS_SETTLE_BUDGET_MS = 1500, LEGACY_SETTLE_GRACE_MS = 750, MAX_DECISION_NOTE_CHARS = 2048, TEARDOWN_BUDGET_MS = 1e3;
     TYPED_NAME_TO_KIND = /* @__PURE__ */ new Map([
@@ -510848,7 +510969,7 @@ async function* withDurableSuggestionsTail(events3, taskId, runsGet, opts) {
   for await (let ev of events3)
     ev?.type === "suggestions" && (settledOnStream = !0), yield ev;
   if (settledOnStream || !promptSuggestionsOptIn() || opts?.signal?.aborted) return;
-  let sleep10 = opts?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))), now2 = opts?.now ?? Date.now, t0 = now2();
+  let sleep9 = opts?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))), now2 = opts?.now ?? Date.now, t0 = now2();
   for (let attempt = 1; attempt <= SUGGESTIONS_TAIL_MAX_ATTEMPTS; attempt++) {
     let rec;
     try {
@@ -510865,7 +510986,7 @@ async function* withDurableSuggestionsTail(events3, taskId, runsGet, opts) {
     }
     if (attempt >= SUGGESTIONS_TAIL_MAX_ATTEMPTS) return;
     let wait = Math.min(SUGGESTIONS_TAIL_RETRY_MS * attempt, SUGGESTIONS_TAIL_RETRY_CAP_MS), left = SUGGESTIONS_TAIL_BUDGET_MS - (now2() - t0);
-    if (left <= 0 || opts?.signal?.aborted || (await sleep10(Math.min(wait, left)), opts?.signal?.aborted)) return;
+    if (left <= 0 || opts?.signal?.aborted || (await sleep9(Math.min(wait, left)), opts?.signal?.aborted)) return;
   }
 }
 async function* normalizeToolNames(events3) {
@@ -510906,53 +511027,53 @@ function promptSuggestionsOptIn() {
   return v2 === "1" || v2 === "true" || v2 === "yes" || v2 === "on";
 }
 function toLiveRequest(req, capturedSessionId) {
-  let out6 = { ...req };
-  if (out6.cwd == null && (out6.cwd = process.cwd()), out6.additionalDirectories === void 0)
-    try {
-      let dirs = getAppStateStoreRef()?.getState().toolPermissionContext?.additionalWorkingDirectories;
-      if (dirs && dirs.size > 0)
-        out6.additionalDirectories = [...dirs.keys()];
-      else if (dirs === void 0) {
-        let boot = getBootAdditionalDirectories();
-        boot && boot.length > 0 && (out6.additionalDirectories = [...boot]);
-      }
-    } catch {
-    }
-  if (out6.additionalReadDirectories === void 0) {
-    let configHome;
-    try {
-      configHome = getClaudeConfigHomeDir();
-    } catch {
-      configHome = void 0;
+  let additionalDirectories;
+  try {
+    let dirs = getAppStateStoreRef()?.getState().toolPermissionContext?.additionalWorkingDirectories;
+    if (dirs && dirs.size > 0)
+      additionalDirectories = [...dirs.keys()];
+    else if (dirs === void 0) {
+      let boot = getBootAdditionalDirectories();
+      boot && boot.length > 0 && (additionalDirectories = [...boot]);
     }
-    let roots = hostDefaultReadRoots({
-      configHome,
-      tmpdir: osTmpdir2(),
-      tmpdirEnv: process.env.TMPDIR,
-      homeDir: safeHomedir(),
-      cwd: out6.cwd ?? process.cwd(),
-      // 符号链接解析器:词法闸挡不住 `TMPDIR=/looks/fine`→`/`(复审轮二 [high])。
-      // 只用于**判决**,上 wire 的仍是词法值 —— canonicalize 是 core 的活,壳不写第二份。
-      realpath: realpathSyncNative
-    });
-    roots.length > 0 && (out6.additionalReadDirectories = roots);
-  }
-  if (out6.forwardSubagentEvents === void 0 && (out6.forwardSubagentEvents = !0), out6.retainSubagentSessions === void 0 && (out6.retainSubagentSessions = !0), out6.agents === void 0) {
-    let agentsField = taskAgentsField();
-    agentsField.agents && (out6.agents = agentsField.agents);
-  }
-  if (typeof out6.scenario == "string" && SEMA_MOCK_SCENARIO_KEYS.has(out6.scenario) && delete out6.scenario, appendSystemPromptCapable(liveCapsBaseUrl)) {
-    let existing = out6.appendSystemPrompt;
-    out6.appendSystemPrompt = withSelfKnowledgeAppend(existing);
-  } else {
-    let settings2 = out6.settings ?? {};
-    out6.settings = { ...settings2, outputStyle: withSelfKnowledgeOutputStyle(settings2.outputStyle) };
-  }
-  if (out6.suggestNextPrompts === void 0 && out6.verify === void 0 && out6.cascade === void 0 && promptSuggestionsOptIn() && (out6.suggestNextPrompts = !0), out6.compactionModel === void 0) {
-    let cheap = process.env.MODEL_CHEAP_ID?.trim();
-    cheap && engineCapTrue(liveCapsBaseUrl, "compactionModel") && getLiveModelCatalog()?.models.some((m2) => m2.name === cheap || m2.id === cheap) === !0 && (out6.compactionModel = cheap);
+  } catch {
   }
-  return capturedSessionId ? out6.sessionId = capturedSessionId : out6.sessionId === mockClientIds.sessionId && delete out6.sessionId, out6;
+  let configHome;
+  try {
+    configHome = getClaudeConfigHomeDir();
+  } catch {
+    configHome = void 0;
+  }
+  let readRoots = hostDefaultReadRoots({
+    configHome,
+    tmpdir: osTmpdir2(),
+    tmpdirEnv: process.env.TMPDIR,
+    homeDir: safeHomedir(),
+    cwd: req.cwd ?? process.cwd(),
+    // 符号链接解析器只用于**判决**,上 wire 的仍是词法值(canonicalize 是 core 的活)。
+    realpath: realpathSyncNative
+  }), compactionModel, cheap = process.env.MODEL_CHEAP_ID?.trim();
+  cheap && engineCapTrue(liveCapsBaseUrl, "compactionModel") && getLiveModelCatalog()?.models.some((m2) => m2.name === cheap || m2.id === cheap) === !0 && (compactionModel = cheap);
+  let agentsField = taskAgentsField(), existingAppend = req.appendSystemPrompt, existingOutputStyle = (req.settings ?? {}).outputStyle, reqLike = { ...req };
+  return applyLiveRequestDefaults(reqLike, {
+    cwd: process.cwd(),
+    ...additionalDirectories !== void 0 ? { additionalDirectories } : {},
+    additionalReadDirectories: readRoots,
+    ...agentsField.agents ? { agents: agentsField.agents } : {},
+    mockScenarioKeys: SEMA_MOCK_SCENARIO_KEYS,
+    appendSystemPromptCapable: appendSystemPromptCapable(liveCapsBaseUrl),
+    selfKnowledge: {
+      forAppend: withSelfKnowledgeAppend(existingAppend),
+      forOutputStyle: withSelfKnowledgeOutputStyle(existingOutputStyle)
+    },
+    suggestNextPrompts: promptSuggestionsOptIn(),
+    ...compactionModel !== void 0 ? { compactionModel } : {},
+    ...capturedSessionId !== void 0 ? { capturedSessionId } : {},
+    mockSessionIdConstant: mockClientIds.sessionId
+    // 出参定向转换(type-hygiene 基线 7→8 随批抬,理由注释即此行):包按结构操作返回
+    // TaskRequestLike(Record 宽形),真 wire 形仍是 TaskRequest —— seamQuery.toTaskRequest
+    // 出口的同款收窄惯例(同一转换形)。
+  });
 }
 async function* captureSessionId(events3, onSession, wasEarlyAcquired, getEarlyTaskId, isCurrentEpoch) {
   for await (let ev of events3) {
@@ -510995,7 +511116,7 @@ function createLiveConversationClient(config4) {
     () => client3.capabilities()
   ), kickEngineCapsProbe(
     config4.baseUrl,
-    () => client3.capabilities().then((caps) => (noteEngineCapsForMcpGate(config4.baseUrl, caps), caps))
+    () => client3.capabilities().then((caps) => (noteEngineCapsForMcpGate(config4.baseUrl, caps), noteEngineCapsForSessionBackground(config4.baseUrl, caps), caps))
   ), prepareTaskAgentsWire({
     baseUrl: config4.baseUrl,
     // loopback-unauthed = 不传 token(agentsWireCaps 对缺省 token 自然零 Authorization 头)。
@@ -511274,7 +511395,7 @@ function createLiveConversationClient(config4) {
 }
 var ENGINE_TO_CC_TOOL, SUGGESTIONS_TAIL_MAX_ATTEMPTS, SUGGESTIONS_TAIL_RETRY_MS, SUGGESTIONS_TAIL_RETRY_CAP_MS, SUGGESTIONS_TAIL_BUDGET_MS, SEMA_MOCK_SCENARIO_KEYS, liveCapsBaseUrl, liveClient_default, init_liveClient = __esm({
   "build-src/src/sema/liveClient.ts"() {
-    init_persistedRulesWire();
+    init_persistedRulesWire2();
     init_rewindAnchorStore();
     init_engineToolDetach();
     init_dist();
@@ -511296,11 +511417,13 @@ var ENGINE_TO_CC_TOOL, SUGGESTIONS_TAIL_MAX_ATTEMPTS, SUGGESTIONS_TAIL_RETRY_MS,
     init_dist();
     init_agentsWire();
     init_mcpInjectionGate();
+    init_sessionBackgroundArm();
     init_detachWire2();
     init_dist();
     init_selfKnowledge();
     init_dist();
     init_dist();
+    init_dist();
     init_mockClient();
     init_seamQuery();
     ENGINE_TO_CC_TOOL = {
@@ -511987,12 +512110,12 @@ async function* ask(params) {
       }
       if (!(t2 === "retry_status" || t2 === "turn_usage" || t2 === "task_progress" || t2 === "steering_injected")) {
         if (t2 === "human_input") {
-          let hi = msg, clean5 = (v2) => (
+          let hi = msg, clean6 = (v2) => (
             // eslint-disable-next-line no-control-regex
             String(v2 ?? "").replace(/[\x00-\x1f\x7f]/g, ".").slice(0, 120)
-          ), who = hi.actor?.id ? `${clean5(hi.actor.id)}${hi.actor.hostAsserted === !0 ? "" : " (unverified)"}` : "unattributed";
+          ), who = hi.actor?.id ? `${clean6(hi.actor.id)}${hi.actor.hostAsserted === !0 ? "" : " (unverified)"}` : "unattributed";
           logForDebugging(
-            `[sema][print] human_input ledger frame (audit): carrier=${clean5(hi.carrier)} eventId=${clean5(hi.eventId)} by=${who}`
+            `[sema][print] human_input ledger frame (audit): carrier=${clean6(hi.carrier)} eventId=${clean6(hi.eventId)} by=${who}`
           );
           continue;
         }
@@ -513236,7 +513359,7 @@ function runHeadlessStreaming(structuredIO, mcpClients, commands, tools, initial
         10
       );
       if (timeoutMs > 0) {
-        let timeout3 = sleep3(timeoutMs).then(() => "timeout");
+        let timeout3 = sleep2(timeoutMs).then(() => "timeout");
         await Promise.race([pluginInstallPromise, timeout3]) === "timeout" && (logError(
           new Error(
             `SEMA_CODE_SYNC_PLUGIN_INSTALL: plugin installation timed out after ${timeoutMs}ms`
@@ -513482,7 +513605,7 @@ function runHeadlessStreaming(structuredIO, mcpClients, commands, tools, initial
           let state4 = getAppState(), hasRunningBg = getRunningTasks(state4).some(
             (t2) => isBackgroundTask(t2) && t2.type !== "in_process_teammate"
           ), hasDeliverableEngineWork = outstandingDeliverableWorkflowCount() > 0, hasMainThreadQueued = peek(isMainThread) !== void 0;
-          (hasRunningBg || hasMainThreadQueued || hasDeliverableEngineWork) && (waitingForAgents = !0, hasMainThreadQueued || (runPhase = "waiting_for_agents", await sleep3(100)));
+          (hasRunningBg || hasMainThreadQueued || hasDeliverableEngineWork) && (waitingForAgents = !0, hasMainThreadQueued || (runPhase = "waiting_for_agents", await sleep2(100)));
         }
       } while (waitingForAgents);
       heldBackResult && (output.enqueue(heldBackResult), heldBackResult = null, suggestionState.pendingSuggestion && (output.enqueue(suggestionState.pendingSuggestion), suggestionState.pendingLastEmittedEntry && (suggestionState.lastEmitted = {
@@ -513607,7 +513730,7 @@ ${m2.text}
             }), run2();
             return;
           }
-          await sleep3(500);
+          await sleep2(500);
         }
       }
     }
@@ -513620,7 +513743,7 @@ ${m2.text}
       mode: "prompt",
       value: SHUTDOWN_TEAM_PROMPT,
       uuid: randomUUID57()
-    }), run2()) : (suggestionState.inflightPromise && await Promise.race([suggestionState.inflightPromise, sleep3(5e3)]), suggestionState.abortController?.abort(), suggestionState.abortController = null, await finalizePendingAsyncHooks(), unsubscribeSkillChanges(), unsubscribeAuthStatus?.(), statusListeners.delete(rateLimitListener), output.done()));
+    }), run2()) : (suggestionState.inflightPromise && await Promise.race([suggestionState.inflightPromise, sleep2(5e3)]), suggestionState.abortController?.abort(), suggestionState.abortController = null, await finalizePendingAsyncHooks(), unsubscribeSkillChanges(), unsubscribeAuthStatus?.(), statusListeners.delete(rateLimitListener), output.done()));
   }, cronScheduler = null, sendControlResponseSuccess = function(message, response) {
     output.enqueue({
       type: "control_response",
@@ -514381,7 +514504,7 @@ ${m2.text}
         }), run2();
       }
     }
-    inputClosed = !0, cronScheduler?.stop(), running || (suggestionState.inflightPromise && await Promise.race([suggestionState.inflightPromise, sleep3(5e3)]), suggestionState.abortController?.abort(), suggestionState.abortController = null, await finalizePendingAsyncHooks(), unsubscribeSkillChanges(), unsubscribeAuthStatus?.(), statusListeners.delete(rateLimitListener), output.done());
+    inputClosed = !0, cronScheduler?.stop(), running || (suggestionState.inflightPromise && await Promise.race([suggestionState.inflightPromise, sleep2(5e3)]), suggestionState.abortController?.abort(), suggestionState.abortController = null, await finalizePendingAsyncHooks(), unsubscribeSkillChanges(), unsubscribeAuthStatus?.(), statusListeners.delete(rateLimitListener), output.done());
   })(), output;
 }
 function createCanUseToolWithPermissionPrompt(permissionPromptTool) {
@@ -518761,8 +518884,8 @@ function buildModelsValue(currentValue, uploaded, localRoles) {
   return Object.keys(roles).length > 0 && (value.roles = roles), Array.isArray(cur?.atModelAllowlist) && (value.atModelAllowlist = cur.atModelAllowlist), value;
 }
 function headerRefEnvName(server, header) {
-  let clean5 = (s) => s.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  return `SEMA_MCP_${clean5(server) || "SERVER"}_${clean5(header) || "HEADER"}`;
+  let clean6 = (s) => s.toUpperCase().replace(/[^A-Z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  return `SEMA_MCP_${clean6(server) || "SERVER"}_${clean6(header) || "HEADER"}`;
 }
 function prepareMcp(name, c2) {
   let kind = asStr4(c2.type) ?? "stdio", display2 = `${name}  (${kind}${kind === "stdio" ? `: ${asStr4(c2.command) ?? "?"}` : `: ${asStr4(c2.url) ?? "?"}`})`;
@@ -521072,7 +521195,7 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
                 cap2.cleanup();
                 break;
               }
-              hbCycles++, await sleep3(
+              hbCycles++, await sleep2(
                 hbConfig.non_exclusive_heartbeat_interval_ms,
                 cap2.signal
               ), cap2.cleanup();
@@ -521082,18 +521205,18 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
               `[bridge:poll] Heartbeat poll_due after ${hbCycles} cycles \u2014 falling through to pollForWork`
             ), hbResult === "auth_failed" || hbResult === "fatal") {
               let cap2 = capacityWake.signal();
-              await sleep3(
+              await sleep2(
                 atCapMs > 0 ? atCapMs : pollConfig.non_exclusive_heartbeat_interval_ms,
                 cap2.signal
               ), cap2.cleanup();
             }
           } else if (atCapMs > 0) {
             let cap2 = capacityWake.signal();
-            await sleep3(atCapMs, cap2.signal), cap2.cleanup();
+            await sleep2(atCapMs, cap2.signal), cap2.cleanup();
           }
         } else {
           let interval = activeSessions.size > 0 ? pollConfig.multisession_poll_interval_ms_partial_capacity : pollConfig.multisession_poll_interval_ms_not_at_capacity;
-          await sleep3(interval, loopSignal);
+          await sleep2(interval, loopSignal);
         }
         continue;
       }
@@ -521103,15 +521226,15 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
           `[bridge:work] Skipping already-completed workId=${work.id}`
         ), atCapacityBeforeSwitch) {
           let cap2 = capacityWake.signal();
-          pollConfig.non_exclusive_heartbeat_interval_ms > 0 ? (await heartbeatActiveWorkItems(), await sleep3(
+          pollConfig.non_exclusive_heartbeat_interval_ms > 0 ? (await heartbeatActiveWorkItems(), await sleep2(
             pollConfig.non_exclusive_heartbeat_interval_ms,
             cap2.signal
-          )) : pollConfig.multisession_poll_interval_ms_at_capacity > 0 && await sleep3(
+          )) : pollConfig.multisession_poll_interval_ms_at_capacity > 0 && await sleep2(
             pollConfig.multisession_poll_interval_ms_at_capacity,
             cap2.signal
           ), cap2.cleanup();
         } else
-          await sleep3(1e3, loopSignal);
+          await sleep2(1e3, loopSignal);
         continue;
       }
       let secret;
@@ -521131,10 +521254,10 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
           )
         ), atCapacityBeforeSwitch) {
           let cap2 = capacityWake.signal();
-          pollConfig.non_exclusive_heartbeat_interval_ms > 0 ? (await heartbeatActiveWorkItems(), await sleep3(
+          pollConfig.non_exclusive_heartbeat_interval_ms > 0 ? (await heartbeatActiveWorkItems(), await sleep2(
             pollConfig.non_exclusive_heartbeat_interval_ms,
             cap2.signal
-          )) : pollConfig.multisession_poll_interval_ms_at_capacity > 0 && await sleep3(
+          )) : pollConfig.multisession_poll_interval_ms_at_capacity > 0 && await sleep2(
             pollConfig.multisession_poll_interval_ms_at_capacity,
             cap2.signal
           ), cap2.cleanup();
@@ -521198,7 +521321,7 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
                 if (attempt < 2) {
                   if (logForDebugging(
                     `[bridge:session] CCR v2: registerWorker attempt ${attempt} failed, retrying: ${errMsg}`
-                  ), await sleep3(2e3, loopSignal), loopSignal.aborted) break;
+                  ), await sleep2(2e3, loopSignal), loopSignal.aborted) break;
                   continue;
                 }
                 logger.logError(
@@ -521360,10 +521483,10 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
       }
       if (atCapacityBeforeSwitch) {
         let cap2 = capacityWake.signal();
-        pollConfig.non_exclusive_heartbeat_interval_ms > 0 ? (await heartbeatActiveWorkItems(), await sleep3(
+        pollConfig.non_exclusive_heartbeat_interval_ms > 0 ? (await heartbeatActiveWorkItems(), await sleep2(
           pollConfig.non_exclusive_heartbeat_interval_ms,
           cap2.signal
-        )) : pollConfig.multisession_poll_interval_ms_at_capacity > 0 && await sleep3(
+        )) : pollConfig.multisession_poll_interval_ms_at_capacity > 0 && await sleep2(
           pollConfig.multisession_poll_interval_ms_at_capacity,
           cap2.signal
         ), cap2.cleanup();
@@ -521404,7 +521527,7 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
         ), logger.updateReconnectingStatus(
           formatDelay(delay),
           formatDuration(elapsed)
-        ), getPollIntervalConfig().non_exclusive_heartbeat_interval_ms > 0 && await heartbeatActiveWorkItems(), await sleep3(delay, loopSignal);
+        ), getPollIntervalConfig().non_exclusive_heartbeat_interval_ms > 0 && await heartbeatActiveWorkItems(), await sleep2(delay, loopSignal);
       } else {
         let now2 = Date.now();
         lastPollErrorTime !== null && now2 - lastPollErrorTime > pollSleepDetectionThresholdMs(backoffConfig) && (logForDebugging(
@@ -521429,7 +521552,7 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
         ), logger.updateReconnectingStatus(
           formatDelay(delay),
           formatDuration(elapsed)
-        ), getPollIntervalConfig().non_exclusive_heartbeat_interval_ms > 0 && await heartbeatActiveWorkItems(), await sleep3(delay, loopSignal);
+        ), getPollIntervalConfig().non_exclusive_heartbeat_interval_ms > 0 && await heartbeatActiveWorkItems(), await sleep2(delay, loopSignal);
       }
     }
   }
@@ -521456,7 +521579,7 @@ async function runBridgeLoop(config4, environmentId, environmentSecret, api2, sp
     let timeout3 = new AbortController();
     await Promise.race([
       Promise.allSettled([...activeSessions.values()].map((h) => h.done)),
-      sleep3(backoffConfig.shutdownGraceMs ?? 3e4, timeout3.signal)
+      sleep2(backoffConfig.shutdownGraceMs ?? 3e4, timeout3.signal)
     ]), timeout3.abort();
     for (let [sid, handle2] of activeSessions.entries())
       logForDebugging(`[bridge:shutdown] Force-killing stuck sessionId=${sid}`), handle2.forceKill();
@@ -521542,7 +521665,7 @@ async function stopWorkWithRetry(api2, environmentId, workId, logger, baseDelayM
         let delay = addJitter(baseDelayMs * Math.pow(2, attempt - 1));
         logger.logVerbose(
           `Failed to stop work ${workId} (attempt ${attempt}/3), retrying in ${formatDelay(delay)}: ${errMsg}`
-        ), await sleep3(delay);
+        ), await sleep2(delay);
       } else
         logger.logError(
           `Failed to stop work ${workId} after 3 attempts: ${errMsg}`
@@ -521746,7 +521869,7 @@ async function bridgeMain(args) {
     used_create_session_in_dir: parsedCreateSessionInDir !== void 0
   }), await Promise.race([
     Promise.all([shutdown1PEventLogging(), shutdownDatadog()]),
-    sleep3(500, void 0, { unref: !0 })
+    sleep2(500, void 0, { unref: !0 })
   ]).catch(() => {
   }), console.error(
     "Error: Multi-session Remote Control is not enabled for your account yet."
@@ -529396,7 +529519,7 @@ Usage: sema --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.76", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
+  }).version("sema 1.0.77", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).psHandler([]), process.exit(process.exitCode ?? 0);
   }), program2.command("logs [id]").description("Print a background session's recent terminal output").action(async (id) => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).logsHandler(id, []), process.exit(process.exitCode ?? 0);
@@ -535522,10 +535645,10 @@ async function deleteJobFromView(short) {
     return `Worktree ${keptReason === "dirty" ? "has uncommitted changes" : "could not be removed"} \u2014 kept at ${keptWorktree}`;
 }
 async function renameJobFromView(short, name) {
-  let clean5 = cleanName(name);
+  let clean6 = cleanName(name);
   await patchJobState(short, {
-    name: clean5,
-    nameSource: clean5 ? "user" : void 0
+    name: clean6,
+    nameSource: clean6 ? "user" : void 0
   });
 }
 function jobLabel(j3) {