@sema-agent/cli 1.0.88 → 1.0.89

package/npm-shrinkwrap.json

@@ -1,16 +1,16 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.88",
+  "version": "1.0.89",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sema-agent/cli",
-      "version": "1.0.88",
+      "version": "1.0.89",
       "license": "BUSL-1.1",
       "dependencies": {
         "@sema-agent/sdk": "7.2.0",
-        "@sema-agent/server": "7.39.0"
+        "@sema-agent/server": "7.41.0"
       },
       "bin": {
         "sema": "sema.js"
@@ -620,9 +620,9 @@
       }
     },
     "node_modules/@sema-agent/core": {
-      "version": "5.53.0",
-      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-5.53.0.tgz",
-      "integrity": "sha512-EbI/NEk+1HH0lUCi4qyE78bsVFgXwZ8Ed7sZxgJ6j0alAk5A/3KJHAzLkHBE+S83JDiAQa/JrojoZr14flllKw==",
+      "version": "5.54.0",
+      "resolved": "https://registry.npmjs.org/@sema-agent/core/-/core-5.54.0.tgz",
+      "integrity": "sha512-PDfPjymn7VjLXf0YX4xm1PILqCBgClS+ajrSnm2VheHG0U3Z2eP2O56vJlSyDWVuqwggJBADf31Zv1zBTQQbzg==",
       "license": "BUSL-1.1",
       "dependencies": {
         "@modelcontextprotocol/sdk": "1.30.0",
@@ -669,12 +669,12 @@
       }
     },
     "node_modules/@sema-agent/server": {
-      "version": "7.39.0",
-      "resolved": "https://registry.npmjs.org/@sema-agent/server/-/server-7.39.0.tgz",
-      "integrity": "sha512-zdAcfeVSjYTU8DBidcW/tlXePRP/hHYYReFQtGz0Uk5LyxBeX1Pi1mHKhv1HL0wDP+ttQoYUL9y9DjHMinuGvA==",
+      "version": "7.41.0",
+      "resolved": "https://registry.npmjs.org/@sema-agent/server/-/server-7.41.0.tgz",
+      "integrity": "sha512-Uj5cbo1xJOhw0LKOZBINGAUmZGva+Km/m5auhvXec4F38iJGtzsMJIe6klELlytXv9YypXXQnzPYyLPA0YmhVQ==",
       "license": "BUSL-1.1",
       "dependencies": {
-        "@sema-agent/core": "^5.52.0",
+        "@sema-agent/core": "^5.53.0",
         "@sema-agent/registry-core": "^0.19.0",
         "e2b": "^2.28.0",
         "libsodium-wrappers": "^0.8.4",
@@ -1484,9 +1484,9 @@
       "license": "ISC"
     },
     "node_modules/jose": {
-      "version": "6.2.9",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.9.tgz",
-      "integrity": "sha512-XrchZOFZUl/T3vTwRe8XK+cJrGtMF4th1ARnDfwbBXFKThGhlsxEE4Zu03AD/bjJSt/9jT/mxrOCkJWOg77aPA==",
+      "version": "6.2.10",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.10.tgz",
+      "integrity": "sha512-iiW7J9qRFlGxvCOIBDBDxFePQSn7ZMAnrYGhrrOo6siO/MIqwfyilLR27pkfDgUk+raLuzADS8A3S/KLBisc0g==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/cli",
-  "version": "1.0.88",
+  "version": "1.0.89",
   "description": "Sema — your own Claude Code-grade coding agent, in the terminal.",
   "license": "BUSL-1.1",
   "bin": {
@@ -23,13 +23,13 @@
   ],
   "dependencies": {
     "@sema-agent/sdk": "7.2.0",
-    "@sema-agent/server": "7.39.0"
+    "@sema-agent/server": "7.41.0"
   },
   "overrides": {
-    "@sema-agent/core": "5.53.0",
+    "@sema-agent/core": "5.54.0",
     "@sema-agent/registry-core": "0.19.0"
   },
-  "semaEngineVersion": "server 7.39.0 / core 5.53.0 / registry-core 0.19.0",
+  "semaEngineVersion": "server 7.41.0 / core 5.54.0 / registry-core 0.19.0",
   "engines": {
     "node": ">=20.3"
   }

package/sema-main.js

@@ -59404,7 +59404,7 @@ function eventToSdkMessage(ev, ctx) {
     // falls back to the mock synthesizer (events.d.ts:79). Not a renderable CC SDKMessage —
     // a side-channel arm `sdkMessagesToCcEvents` reads; CC's own renderer never sees it.
     case "tool_end": {
-      let structured = ev.structured, toolEndErrorCode = ev.errorCode, toolEndSettledBy = ev.settledBy, toolEndApprover = ev.approver;
+      let structured = ev.structured, toolEndErrorCode = ev.errorCode, toolEndSettledBy = ev.settledBy, toolEndApprover = ev.approver, collateralAbort = ev._sema_collateral_abort;
       return projected(stamp(ctx, {
         type: "tool_end_result",
         toolCallId: ev.toolCallId,
@@ -59421,6 +59421,8 @@ function eventToSdkMessage(ev, ctx) {
         // #263 半场:结算种类 + 结算方身份(开集、缺席不铸、在场原样;顶部大段头注是判据本体)。
         ...typeof toolEndSettledBy == "string" && toolEndSettledBy.length > 0 ? { settledBy: toolEndSettledBy } : {},
         ...typeof toolEndApprover == "string" && toolEndApprover.length > 0 ? { approver: toolEndApprover } : {},
+        // #324:连坐 abort 机读位(严格 true 才上臂;见上方头注)。
+        ...collateralAbort === !0 ? { _sema_collateral_abort: !0 } : {},
         ...ev.eventId !== void 0 ? { eventId: ev.eventId } : {},
         ...ev.parentToolCallId !== void 0 ? { parentToolCallId: ev.parentToolCallId } : {}
       }));
@@ -65649,6 +65651,9 @@ function isAskTool(toolName2) {
 function isGatedToolName(name) {
   return isAskToolLoose(name) ? !0 : typeof name != "string" ? !1 : toolNameIsFsWrite(name) || toolNameIsShellExec(name);
 }
+function isFsOrShellToolName(name) {
+  return typeof name == "string" && (toolNameIsFsWrite(name) || toolNameIsShellExec(name));
+}
 function isGatedToolEnd(ev) {
   return isGatedToolName(ev.toolName) ? !0 : toolEndOutputText(ev.output) === ENGINE_ABORT_TOOL_RESULT;
 }
@@ -65703,14 +65708,14 @@ function routeToolEnd(ev, callId, led) {
   throw new Error("frameRouter: tool_end \u6709\u5E8F\u81C2\u5168\u90E8\u843D\u7A7A \u2014\u2014 generic-close \u4E0D\u518D\u662F\u65E0\u6761\u4EF6\u515C\u5E95\u81C2");
 }
 function routeSuspended(ev, ctx) {
-  return ev.gate && isAskToolLoose(ev.gate.toolName) && ctx.taskId.current ? { kind: "park", gate: "ask" } : ev.gate && isToolApprovalGate(ev.gate) && ctx.taskId.current ? { kind: "park", gate: "fs" } : { kind: "yield", events: [ev] };
+  return ev.gate && isAskToolLoose(ev.gate.toolName) && ctx.taskId.current ? (ctx.led.noteParkGate({ fsOrShellFamily: !1 }), { kind: "park", gate: "ask" }) : ev.gate && isToolApprovalGate(ev.gate) && ctx.taskId.current ? (ctx.led.noteParkGate({ fsOrShellFamily: isFsOrShellToolName(ev.gate.toolName) }), { kind: "park", gate: "fs" }) : { kind: "yield", events: [ev] };
 }
 function routeDone(ev, ctx) {
   let { led } = ctx;
   if (isAskGatePark(ev.result))
-    return ctx.taskId.current = ctx.taskId.current ?? ev.result.taskId, { kind: "park", gate: "ask", pendingDone: ev };
+    return ctx.taskId.current = ctx.taskId.current ?? ev.result.taskId, led.noteParkGate({ fsOrShellFamily: !1 }), { kind: "park", gate: "ask", pendingDone: ev };
   if (isFsApprovalPark(ev.result))
-    return ctx.taskId.current = ctx.taskId.current ?? ev.result.taskId, { kind: "park", gate: "fs", pendingDone: ev };
+    return ctx.taskId.current = ctx.taskId.current ?? ev.result.taskId, led.noteParkGate({ fsOrShellFamily: isFsOrShellToolName(ev.result.checkpointGate?.toolName) }), { kind: "park", gate: "fs", pendingDone: ev };
   let events3 = [...led.flushHeld()], r = ev.result, realTaskId = ctx.taskId.current;
   return realTaskId && r && r.taskId === r.sessionId && r.taskId !== realTaskId ? events3.push({ ...ev, result: { ...ev.result, taskId: realTaskId } }) : events3.push(ev), { kind: "end", events: events3 };
 }
@@ -65797,7 +65802,17 @@ var HITL_REJECT_MESSAGE, ENGINE_ABORT_TOOL_RESULT, TOOL_END_ARM_ORDER, TOOL_END_
 
 // node_modules/@sema-agent/client-core/dist/hitl/gateLedger.js
 function createGateLedger() {
-  let startedCalls = /* @__PURE__ */ new Set(), endedCalls = /* @__PURE__ */ new Set(), heldAskEnds = /* @__PURE__ */ new Map(), gatedStartArgsByCall = /* @__PURE__ */ new Map(), deniedCalls = /* @__PURE__ */ new Set(), pendingFsCalls = [], resolvedAnswers = /* @__PURE__ */ new Map(), decidedGates = /* @__PURE__ */ new Set(), lastFsOrShellGatedCall, denyStampNextFsEnd = !1, seq;
+  let startedCalls = /* @__PURE__ */ new Set(), endedCalls = /* @__PURE__ */ new Set(), heldAskEnds = /* @__PURE__ */ new Map(), gatedStartArgsByCall = /* @__PURE__ */ new Map(), deniedCalls = /* @__PURE__ */ new Set(), pendingFsCalls = [], resolvedAnswers = /* @__PURE__ */ new Map(), decidedGates = /* @__PURE__ */ new Set(), fsOrShellFamilyGate = !1, droppedFromBatch = /* @__PURE__ */ new Set(), batchParkCount = 0, heldSinceLastPark = !1, fsOrShellGatedCalls = /* @__PURE__ */ new Set(), lastFsOrShellGatedCall, resolveGateSubjects = () => {
+    if (batchParkCount !== 1 || !fsOrShellFamilyGate)
+      return;
+    for (let id of heldAskEnds.keys())
+      if (!startedCalls.has(id))
+        return;
+    let family = [.../* @__PURE__ */ new Set([...heldAskEnds.keys(), ...droppedFromBatch])].filter((id) => fsOrShellGatedCalls.has(id));
+    return family.length === 1 ? new Set(family) : void 0;
+  }, retireBatchState = () => {
+    fsOrShellFamilyGate = !1, droppedFromBatch.clear(), batchParkCount = 0, heldSinceLastPark = !1;
+  }, denyStampNextFsEnd = !1, seq;
   return {
     noteSeq(ev) {
       let rawSeq = ev.id ?? ev.seq;
@@ -65822,18 +65837,19 @@ function createGateLedger() {
       endedCalls.add(callId);
     },
     hold(callId, ev) {
-      heldAskEnds.set(callId, ev);
+      heldAskEnds.has(callId) || (heldSinceLastPark = !0), heldAskEnds.set(callId, ev);
     },
     dropHeld(callId) {
-      heldAskEnds.delete(callId);
+      heldAskEnds.delete(callId) && droppedFromBatch.add(callId), heldAskEnds.size === 0 && retireBatchState();
     },
     heldCount() {
       return heldAskEnds.size;
     },
     *flushHeld() {
-      for (let [callId, held] of heldAskEnds)
-        endedCalls.add(callId), yield held;
-      heldAskEnds.clear();
+      let subjects = resolveGateSubjects();
+      for (let [callId, ev] of heldAskEnds)
+        endedCalls.add(callId), yield subjects !== void 0 && !subjects.has(callId) ? { ...ev, [SEMA_COLLATERAL_ABORT_KEY]: !0 } : ev;
+      heldAskEnds.clear(), retireBatchState();
     },
     markDenied(callId) {
       deniedCalls.add(callId);
@@ -65861,11 +65877,14 @@ function createGateLedger() {
       return pendingFsCalls.length > 0 ? pendingFsCalls[pendingFsCalls.length - 1] : void 0;
     },
     noteFsOrShellGate(callId) {
-      lastFsOrShellGatedCall = callId;
+      lastFsOrShellGatedCall = callId, fsOrShellGatedCalls.add(callId);
     },
     lastFsOrShellGatedCallId() {
       return lastFsOrShellGatedCall;
     },
+    noteParkGate(evidence) {
+      batchParkCount > 0 && !heldSinceLastPark || (batchParkCount += 1, fsOrShellFamilyGate = evidence.fsOrShellFamily, heldSinceLastPark = !1);
+    },
     rememberAnswer(callId, answered) {
       resolvedAnswers.set(callId, answered);
     },
@@ -65886,8 +65905,9 @@ function createGateLedger() {
     }
   };
 }
-var init_gateLedger = __esm({
+var SEMA_COLLATERAL_ABORT_KEY, init_gateLedger = __esm({
   "node_modules/@sema-agent/client-core/dist/hitl/gateLedger.js"() {
+    SEMA_COLLATERAL_ABORT_KEY = "_sema_collateral_abort";
   }
 });
 
@@ -66078,6 +66098,7 @@ var init_askGateWire = __esm({
     init_frameRouter();
     init_parkResolver();
     init_frameRouter();
+    init_gateLedger();
     init_parkResolver();
   }
 });
@@ -68834,6 +68855,7 @@ __export(dist_exports, {
   SEAT_VALIDATOR_COVERAGE_EXEMPT: () => SEAT_VALIDATOR_COVERAGE_EXEMPT,
   SEAT_VALIDATOR_KEY_COVERAGE: () => SEAT_VALIDATOR_KEY_COVERAGE,
   SELF_ORCHESTRATION_ENV: () => SELF_ORCHESTRATION_ENV,
+  SEMA_COLLATERAL_ABORT_KEY: () => SEMA_COLLATERAL_ABORT_KEY,
   SEND_MESSAGE_REQUEST_KEYS: () => SEND_MESSAGE_REQUEST_KEYS,
   SESSION_SEARCH_RESULT_KEYS: () => SESSION_SEARCH_RESULT_KEYS,
   SKILL_CAPS: () => SKILL_CAPS,
@@ -110687,7 +110709,7 @@ var import_stack_utils, import_jsx_runtime6, cleanupPath, stackUtils, init_Error
 // build-src/src/ink/components/TerminalSizeContext.tsx
 var import_react9, TerminalSizeContext, init_TerminalSizeContext = __esm({
   "build-src/src/ink/components/TerminalSizeContext.tsx"() {
-    import_react9 = __toESM(require_react()), TerminalSizeContext = (0, import_react9.createContext)(null);
+    import_react9 = __toESM(require_react(), 1), TerminalSizeContext = (0, import_react9.createContext)(null);
   }
 });
 
@@ -184639,8 +184661,12 @@ function stripImagesFromMessages(messages) {
     } : message;
   });
 }
+function hasPtlRetryMarkerHead(messages) {
+  let head = messages[0];
+  return head?.type === "user" && head.isMeta === !0 && head.message.content === PTL_RETRY_MARKER;
+}
 function truncateHeadForPTLRetry(messages, ptlResponse) {
-  let input = messages[0]?.type === "user" && messages[0].isMeta && messages[0].message.content === PTL_RETRY_MARKER ? messages.slice(1) : messages, groups = groupMessagesByApiRound(input);
+  let input = hasPtlRetryMarkerHead(messages) ? messages.slice(1) : messages, groups = groupMessagesByApiRound(input);
   if (groups.length < 2) return null;
   let tokenGap = getPromptTooLongTokenGap(ptlResponse), dropCount;
   if (tokenGap !== void 0) {
@@ -184896,11 +184922,14 @@ async function partialCompactConversation(allMessages, pivotIndex, context3, cac
 User context: ${userFeedback}` : hookResult.newCustomInstructions ? customInstructions = hookResult.newCustomInstructions : userFeedback && (customInstructions = `User context: ${userFeedback}`), context3.setStreamMode?.("requesting"), context3.setResponseLength?.(() => 0), context3.onCompactProgress?.({ type: "compact_start" });
     let compactPrompt = getPartialCompactPrompt(customInstructions, direction), summaryRequest = createUserMessage({
       content: compactPrompt
-    }), failureMetadata = {
+    }), apiMessages = direction === "up_to" ? messagesToSummarize : allMessages, retryCacheSafeParams = direction === "up_to" ? { ...cacheSafeParams, forkContextMessages: messagesToSummarize } : cacheSafeParams, summarizedCount = () => {
+      let real = apiMessages.length - (hasPtlRetryMarkerHead(apiMessages) ? 1 : 0);
+      return Math.min(real, messagesToSummarize.length);
+    }, failureMetadata = () => ({
       preCompactTokenCount,
       direction,
-      messagesSummarized: messagesToSummarize.length
-    }, apiMessages = direction === "up_to" ? messagesToSummarize : allMessages, retryCacheSafeParams = direction === "up_to" ? { ...cacheSafeParams, forkContextMessages: messagesToSummarize } : cacheSafeParams, summaryResponse, summary, ptlAttempts = 0;
+      messagesSummarized: summarizedCount()
+    }), summaryResponse, summary, ptlAttempts = 0;
     for (; summaryResponse = await streamCompactSummary({
       messages: apiMessages,
       summaryRequest,
@@ -184913,7 +184942,7 @@ User context: ${userFeedback}` : hookResult.newCustomInstructions ? customInstru
       let truncated = ptlAttempts <= MAX_PTL_RETRIES ? truncateHeadForPTLRetry(apiMessages, summaryResponse) : null;
       if (!truncated)
         throw {
-          ...failureMetadata
+          ...failureMetadata()
         }, new Error(ERROR_MESSAGE_PROMPT_TOO_LONG);
       apiMessages.length - truncated.length, truncated.length, apiMessages = truncated, retryCacheSafeParams = {
         ...retryCacheSafeParams,
@@ -184923,10 +184952,10 @@ User context: ${userFeedback}` : hookResult.newCustomInstructions ? customInstru
     if (summary) {
       if (startsWithApiErrorPrefix(summary) || isGovernanceStopRowText(summary))
         throw {
-          ...failureMetadata
+          ...failureMetadata()
         }, new Error(summary);
     } else throw {
-      ...failureMetadata
+      ...failureMetadata()
     }, new Error(
       "Failed to generate conversation summary - response did not contain valid text content"
     );
@@ -184974,13 +185003,15 @@ User context: ${userFeedback}` : hookResult.newCustomInstructions ? customInstru
     }), postCompactTokenCount = tokenCountFromLastAPIResponse([
       summaryResponse
     ]), compactionUsage = getTokenUsage(summaryResponse);
-    messagesToKeep.length, messagesToSummarize.length, compactionUsage?.input_tokens, compactionUsage?.output_tokens, compactionUsage?.cache_read_input_tokens, compactionUsage?.cache_creation_input_tokens;
+    messagesToKeep.length, summarizedCount(), compactionUsage?.input_tokens, compactionUsage?.output_tokens, compactionUsage?.cache_read_input_tokens, compactionUsage?.cache_creation_input_tokens;
     let lastPreCompactUuid = direction === "up_to" ? allMessages.slice(0, pivotIndex).findLast((m2) => m2.type !== "progress")?.uuid : messagesToKeep.at(-1)?.uuid, boundaryMarker = createCompactBoundaryMessage(
       "manual",
       preCompactTokenCount ?? 0,
       lastPreCompactUuid,
       userFeedback,
-      messagesToSummarize.length
+      // 同族同修:边界标记里的这一位与屏上那一位是**同一个量**,两处读同一个函数,
+      // 否则同一次压缩会在转录里留两个互相矛盾的 N。
+      summarizedCount()
     ), preCompactDiscovered = extractDiscoveredToolNames(allMessages);
     preCompactDiscovered.size > 0 && (boundaryMarker.compactMetadata.preCompactDiscoveredTools = [
       ...preCompactDiscovered
@@ -184991,7 +185022,8 @@ User context: ${userFeedback}` : hookResult.newCustomInstructions ? customInstru
         isCompactSummary: !0,
         ...messagesToKeep.length > 0 ? {
           summarizeMetadata: {
-            messagesSummarized: messagesToSummarize.length,
+            // 屏上 "Summarized N messages" 的 N(CompactSummary.tsx)——读真参与摘要的条数。
+            messagesSummarized: summarizedCount(),
             userContext: userFeedback,
             direction
           }
@@ -304426,7 +304458,7 @@ function useClaudeAiLimits() {
 }
 var import_react69, init_claudeAiLimitsHook = __esm({
   "build-src/src/services/claudeAiLimitsHook.ts"() {
-    import_react69 = __toESM(require_react());
+    import_react69 = __toESM(require_react(), 1);
     init_claudeAiLimits();
   }
 });
@@ -308028,7 +308060,7 @@ function UserToolErrorMessage(t0) {
     verbose,
     isTranscriptMode
   } = t0, param = normalizeEngineReminderParam(rawParam);
-  if (typeof param.content == "string" && (param.content.startsWith(INTERRUPTED_BATCH_FOLD_PREFIX) || param.content.startsWith(REPEATED_NOTICE_FOLD_PREFIX) || param.content.startsWith(REPEATED_ERROR_FOLD_PREFIX)))
+  if (typeof param.content == "string" && (param.content.startsWith(INTERRUPTED_BATCH_FOLD_PREFIX) || param.content.startsWith(REPEATED_NOTICE_FOLD_PREFIX) || param.content.startsWith(REPEATED_ERROR_FOLD_PREFIX) || param.content.startsWith(COLLATERAL_ABORT_FOLD_PREFIX)))
     return /* @__PURE__ */ (0, import_jsx_runtime128.jsx)(MessageResponse, { height: 1, children: /* @__PURE__ */ (0, import_jsx_runtime128.jsx)(ThemedText, { dimColor: !0, children: param.content }) });
   if (typeof param.content == "string" && param.content.includes(INTERRUPT_MESSAGE_FOR_TOOL_USE)) {
     let t12;
@@ -308073,7 +308105,7 @@ function UserToolErrorMessage(t0) {
     isTranscriptMode
   }) ?? /* @__PURE__ */ (0, import_jsx_runtime128.jsx)(FallbackToolUseErrorMessage, { result: param.content, verbose }), $3[7] = isTranscriptMode, $3[8] = param.content, $3[9] = progressMessagesForMessage, $3[10] = tool, $3[11] = tools, $3[12] = verbose, $3[13] = t1) : t1 = $3[13], t1;
 }
-var import_compiler_runtime105, import_jsx_runtime128, INTERRUPTED_BATCH_FOLD_PREFIX, REPEATED_NOTICE_FOLD_PREFIX, REPEATED_ERROR_FOLD_PREFIX, init_UserToolErrorMessage = __esm({
+var import_compiler_runtime105, import_jsx_runtime128, INTERRUPTED_BATCH_FOLD_PREFIX, REPEATED_NOTICE_FOLD_PREFIX, REPEATED_ERROR_FOLD_PREFIX, COLLATERAL_ABORT_FOLD_PREFIX, init_UserToolErrorMessage = __esm({
   "build-src/src/components/messages/UserToolResultMessage/UserToolErrorMessage.tsx"() {
     import_compiler_runtime105 = __toESM(require_compiler_runtime(), 1);
     init_systemReminderTag();
@@ -308087,7 +308119,7 @@ var import_compiler_runtime105, import_jsx_runtime128, INTERRUPTED_BATCH_FOLD_PR
     init_RejectedPlanMessage();
     init_RejectedToolUseMessage();
     import_jsx_runtime128 = __toESM(require_jsx_runtime(), 1);
-    INTERRUPTED_BATCH_FOLD_PREFIX = "Interrupted with the batch: ", REPEATED_NOTICE_FOLD_PREFIX = "Same notice as above \xD7", REPEATED_ERROR_FOLD_PREFIX = "Same error as above \xD7";
+    INTERRUPTED_BATCH_FOLD_PREFIX = "Interrupted with the batch: ", REPEATED_NOTICE_FOLD_PREFIX = "Same notice as above \xD7", REPEATED_ERROR_FOLD_PREFIX = "Same error as above \xD7", COLLATERAL_ABORT_FOLD_PREFIX = "Aborted alongside the pending approval: ";
   }
 });
 
@@ -362727,6 +362759,9 @@ var norm, warnedCrossEndpointEntries, PER_MODEL_BASEURL_MIN, init_modelEndpointS
 var seamQuery_exports = {};
 __export(seamQuery_exports, {
   SCENARIO_KEYS: () => SCENARIO_KEYS,
+  _resetInteractiveCancelStateForTest: () => _resetInteractiveCancelStateForTest,
+  _setInteractiveCancelTimeoutMsForTest: () => _setInteractiveCancelTimeoutMsForTest,
+  bestEffortInteractiveCancel: () => bestEffortInteractiveCancel,
   canUseTool: () => canUseTool,
   cancelEngineRun: () => cancelEngineRun,
   drainingRetryDelayMs: () => drainingRetryDelayMs2,
@@ -363171,7 +363206,7 @@ Fix: run \`sema doctor\` to diagnose, or restart sema to retry.`
     } catch {
     }
   noteEngineTurnStart();
-  let setInProgress = params.toolUseContext?.setInProgressToolUseIDs, engineOpenToolIds = /* @__PURE__ */ new Set();
+  let setInProgress = params.toolUseContext?.setInProgressToolUseIDs, engineOpenToolIds = /* @__PURE__ */ new Set(), foregroundRunRegistered = null;
   try {
     let sessionId = req.sessionId ?? mockClientIds.sessionId;
     try {
@@ -363237,7 +363272,7 @@ Fix: run \`sema doctor\` to diagnose, or restart sema to retry.`
         let reattachArmed = typeof client.runs.get == "function" && !isBgHeadlessWorker(), rawLive = client.tasks.stream(req, {
           signal,
           onRunBound: (id) => {
-            boundRunId = id, armTerminationIntentOnAbort(signal, id);
+            boundRunId = id, armTerminationIntentOnAbort(signal, id), isMainLaneQuerySource(params.querySource) && !isBackgroundJournalSuppressed() && (foregroundInteractiveRunId = id, foregroundRunRegistered = id);
           }
         });
         if (pendingInterruptedSettledRow !== null) {
@@ -363455,7 +363490,7 @@ ${notifSupplement}` : baseErrorContent
         return next;
       });
     }
-    disarmAllEngineDetachHints(params.toolUseContext), setActiveEngineTaskId(null), noteEngineTurnBoundary();
+    disarmAllEngineDetachHints(params.toolUseContext), setActiveEngineTaskId(null), foregroundRunRegistered !== null && foregroundInteractiveRunId === foregroundRunRegistered && (foregroundInteractiveRunId = null), noteEngineTurnBoundary();
   }
 }
 function isHitlClient(c2) {
@@ -363484,6 +363519,52 @@ async function bestEffortDurableCancel() {
   } catch {
   }
 }
+function _setInteractiveCancelTimeoutMsForTest(ms) {
+  escCancelTimeoutOverrideMs = ms;
+}
+function _resetInteractiveCancelStateForTest() {
+  foregroundInteractiveRunId = null, escCancelInFlight.clear(), escCancelTimeoutOverrideMs = null;
+}
+function bestEffortInteractiveCancel() {
+  try {
+    let taskId = foregroundInteractiveRunId;
+    if (taskId === null) return;
+    let runs = client.runs, cancelFn = runs.cancel;
+    if (typeof cancelFn != "function") {
+      escCancelProbe(`no runs.cancel verb on this lane \u2014 nothing sent for ${taskId}`);
+      return;
+    }
+    if (escCancelInFlight.has(taskId)) {
+      escCancelProbe(`a cancel is already in flight for ${taskId} \u2014 this press yields to it`);
+      return;
+    }
+    let prior = terminationIntentSource(taskId);
+    escCancelInFlight.add(taskId), recordTerminationIntent(taskId, "esc-cancel"), (async () => {
+      try {
+        await cancelFn.call(runs, taskId, {
+          signal: AbortSignal.timeout(escCancelTimeoutOverrideMs ?? ESC_CANCEL_TIMEOUT_MS)
+        }), escCancelProbe(`cancel accepted for ${taskId}`);
+      } catch (e) {
+        terminationIntentSource(taskId) === "esc-cancel" && (prior === null ? forgetTerminationIntent(taskId) : recordTerminationIntent(taskId, prior)), escCancelProbe(
+          `cancel refused for ${taskId} (${String(
+            e?.errorCode ?? "transport"
+          )}) \u2014 ledger restored to ${String(prior)}`
+        );
+      } finally {
+        escCancelInFlight.delete(taskId);
+      }
+    })();
+  } catch {
+  }
+}
+function escCancelProbe(msg) {
+  let line = `[sema][seamQuery] esc-cancel: ${msg}`;
+  try {
+    logForDebugging(line);
+  } catch {
+  }
+  process.env.SEMA_DEBUG && console.error(line);
+}
 async function probeEngineRunState(taskId) {
   return (await probeEngineRunLiveness(taskId)).state;
 }
@@ -363602,7 +363683,7 @@ function resumeRunningArmWiring() {
     shellSessionId: () => getSessionId()
   };
 }
-var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, drainingBackoffMs, client, clientExplicitlySet, seamSettings, printResolvedSettingsProvider, seamWebSearch, seamSkills, seamMcp, seamRewindCapture, seamPendingRewind, INTERRUPT_WIRE_MARKER, seamPendingInterrupt, seamHistorySeedPending, seamSandbox, seamAutoSandboxInjected, HISTORY_SEED_MAX_CHARS, SCENARIO_KEYS, API_ERROR_PREFIX, defaultGatePrompt, canUseTool, RUN_PROBE_TIMEOUT_MS, init_seamQuery = __esm({
+var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, drainingBackoffMs, client, clientExplicitlySet, seamSettings, printResolvedSettingsProvider, seamWebSearch, seamSkills, seamMcp, seamRewindCapture, seamPendingRewind, INTERRUPT_WIRE_MARKER, seamPendingInterrupt, seamHistorySeedPending, seamSandbox, seamAutoSandboxInjected, HISTORY_SEED_MAX_CHARS, SCENARIO_KEYS, API_ERROR_PREFIX, defaultGatePrompt, canUseTool, foregroundInteractiveRunId, escCancelInFlight, ESC_CANCEL_TIMEOUT_MS, escCancelTimeoutOverrideMs, RUN_PROBE_TIMEOUT_MS, init_seamQuery = __esm({
   "build-src/src/sema/seamQuery.ts"() {
     init_hotReconcile();
     init_adapter();
@@ -363723,6 +363804,7 @@ var BG_TEAR_MAX_RESENDS, BG_RECOVERY_WAIT_MS, DRAINING_MAX_RETRIES, drainingBack
       updatedInput: input,
       toolUseID
     }), canUseTool = isHitlClient(client) ? makeHitlCanUseTool2(new HitlBridge(client, mockClientIds.taskId), defaultGatePrompt) : makeCanUseTool();
+    foregroundInteractiveRunId = null, escCancelInFlight = /* @__PURE__ */ new Set(), ESC_CANCEL_TIMEOUT_MS = 5e3, escCancelTimeoutOverrideMs = null;
     RUN_PROBE_TIMEOUT_MS = 5e3;
   }
 });
@@ -392957,18 +393039,14 @@ var sema_brand_default, init_sema_brand = __esm({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.88",
+        version: "1.0.89",
         notes: [
-          "Approval cards now show a live countdown to their decision window, with the card turning urgent in the last 60 seconds and withdrawing itself when the window closes \u2014 so a pending approval never silently looks alive after it expired.",
-          "Countdowns only appear on live approvals: when a session re-attaches or resumes, replayed history never fakes a timer (those cards simply show without a countdown, exactly as before).",
-          "When a delegation is refused because all concurrent seats are busy, the transcript now says so and tells you a seat frees up as soon as a sibling agent finishes \u2014 nothing to reconfigure.",
-          "When the retained-window delegation quota is reached, the transcript now points to the actual way forward: continue an existing agent with SendMessage, or wait for old rows to be reaped \u2014 no need to switch sessions.",
-          "Calls to an MCP server that an operator revoked mid-session now explain that the request was never sent and stays refused until the server is approved again.",
-          "Engine updated to server 7.39.0 (core 5.53, including the prompt-cache fix that stops MCP tool refreshes from silently breaking cache reuse every turn)."
+          "When an approval card is waiting for your decision and the engine aborts the other in-flight tool calls running alongside it, the transcript now folds those into one summary line ('Aborted alongside the pending approval: N more tool calls (ctrl+o for detail)') instead of repeating a full error block for each one \u2014 the call you're actually deciding on stays fully visible, full detail is still one ctrl+o away.",
+          "Engine updated to server 7.41.0 (core 5.54)."
         ]
       },
-      productVersion: "1.0.88",
-      announcement: "sema 1.0.88 \u2014 approval cards now show a live countdown to their decision window (live streams only; replayed history never fakes a timer), and delegation/MCP refusals explain the actual next step (wait for a seat, reuse via SendMessage, or re-approve a revoked server)"
+      productVersion: "1.0.89",
+      announcement: "sema 1.0.89 \u2014 tool calls aborted alongside a pending approval now fold into one summary line instead of repeating a full error per call, so the approval you're deciding on doesn't get buried"
     };
   }
 });
@@ -393724,11 +393802,11 @@ function readErrorResult(msg) {
   if (!block2 || block2.type !== "tool_result" || block2.is_error !== !0 || typeof block2.tool_use_id != "string") return null;
   let isPlainText = typeof block2.content == "string", normalized = normalizeResultContent(block2.content);
   if (normalized === null) return null;
-  let text2 = isPlainText ? unwrapWholeSystemReminder(normalized).trim() : normalized, family = familyOf(text2, isPlainText);
+  let text2 = isPlainText ? unwrapWholeSystemReminder(normalized).trim() : normalized, collateral = msg[SEMA_COLLATERAL_ABORT_KEY] === !0, family = familyOf(text2, isPlainText, collateral);
   return family === null ? null : { text: text2, toolUseId: block2.tool_use_id, family };
 }
-function familyOf(text2, isPlainText) {
-  return isPlainText ? text2 === INTERRUPTED_REPEAT_SENTENCE ? "interrupted-batch" : text2.startsWith(APPROVAL_DENIED_ANCHOR) || text2.includes(APPROVAL_WINDOW_ANCHOR) ? "repeated-notice" : "repeated-error" : "repeated-error";
+function familyOf(text2, isPlainText, collateral) {
+  return collateral ? "collateral-abort" : isPlainText ? text2 === INTERRUPTED_REPEAT_SENTENCE ? "interrupted-batch" : text2.startsWith(APPROVAL_DENIED_ANCHOR) || text2.includes(APPROVAL_WINDOW_ANCHOR) ? "repeated-notice" : "repeated-error" : "repeated-error";
 }
 function assistantToolUseId(msg) {
   if (!msg || msg.type !== "assistant") return null;
@@ -393743,6 +393821,7 @@ function foldRow(from, text2, count3) {
   let block2 = firstBlock(from), {
     toolUseResult: _droppedToolUseResult,
     _sema_degraded: _droppedDegraded,
+    [SEMA_COLLATERAL_ABORT_KEY]: _droppedCollateralAbort,
     ...rest
   } = from;
   return {
@@ -393799,14 +393878,8 @@ function collapseRepeatedToolErrors(messages, verbose) {
         let unit = run2[k2];
         unit.span === 2 && result.push(messages[unit.start]);
       }
-      let prefix = first.view.family === "repeated-notice" ? REPEATED_NOTICE_FOLD_PREFIX : REPEATED_ERROR_FOLD_PREFIX;
-      result.push(
-        foldRow(
-          run2[1].result,
-          `${prefix}${String(run2.length - 1)}`,
-          run2.length - 1
-        )
-      );
+      let folded = run2.length - 1, text2 = first.view.family === "repeated-notice" ? `${REPEATED_NOTICE_FOLD_PREFIX}${String(folded)}` : first.view.family === "collateral-abort" ? `${COLLATERAL_ABORT_FOLD_PREFIX}${String(folded)} more tool ${folded === 1 ? "call" : "calls"} (ctrl+o for detail)` : `${REPEATED_ERROR_FOLD_PREFIX}${String(folded)}`;
+      result.push(foldRow(run2[1].result, text2, folded));
     }
     i = j3;
   }
@@ -393814,11 +393887,13 @@ function collapseRepeatedToolErrors(messages, verbose) {
 }
 var INTERRUPTED_REPEAT_SENTENCE, APPROVAL_DENIED_ANCHOR, APPROVAL_WINDOW_ANCHOR, MIN_RUN, init_collapseRepeatedToolErrors = __esm({
   "build-src/src/utils/collapseRepeatedToolErrors.ts"() {
+    init_dist();
     init_UserToolErrorMessage();
     INTERRUPTED_REPEAT_SENTENCE = "[INTERRUPTED] Same as an earlier interrupted call in this batch: it never started and had no side effects \u2014 safe to re-issue.", APPROVAL_DENIED_ANCHOR = 'approval denied for "', APPROVAL_WINDOW_ANCHOR = "was not answered before the approver's own window elapsed", MIN_RUN = {
       "interrupted-batch": 2,
       "repeated-notice": 2,
-      "repeated-error": 3
+      "repeated-error": 3,
+      "collateral-abort": 2
     };
   }
 });
@@ -397312,18 +397387,14 @@ var require_sema_brand = __commonJS({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.88",
+        version: "1.0.89",
         notes: [
-          "Approval cards now show a live countdown to their decision window, with the card turning urgent in the last 60 seconds and withdrawing itself when the window closes \u2014 so a pending approval never silently looks alive after it expired.",
-          "Countdowns only appear on live approvals: when a session re-attaches or resumes, replayed history never fakes a timer (those cards simply show without a countdown, exactly as before).",
-          "When a delegation is refused because all concurrent seats are busy, the transcript now says so and tells you a seat frees up as soon as a sibling agent finishes \u2014 nothing to reconfigure.",
-          "When the retained-window delegation quota is reached, the transcript now points to the actual way forward: continue an existing agent with SendMessage, or wait for old rows to be reaped \u2014 no need to switch sessions.",
-          "Calls to an MCP server that an operator revoked mid-session now explain that the request was never sent and stays refused until the server is approved again.",
-          "Engine updated to server 7.39.0 (core 5.53, including the prompt-cache fix that stops MCP tool refreshes from silently breaking cache reuse every turn)."
+          "When an approval card is waiting for your decision and the engine aborts the other in-flight tool calls running alongside it, the transcript now folds those into one summary line ('Aborted alongside the pending approval: N more tool calls (ctrl+o for detail)') instead of repeating a full error block for each one \u2014 the call you're actually deciding on stays fully visible, full detail is still one ctrl+o away.",
+          "Engine updated to server 7.41.0 (core 5.54)."
         ]
       },
-      productVersion: "1.0.88",
-      announcement: "sema 1.0.88 \u2014 approval cards now show a live countdown to their decision window (live streams only; replayed history never fakes a timer), and delegation/MCP refusals explain the actual next step (wait for a seat, reuse via SendMessage, or re-approve a revoked server)"
+      productVersion: "1.0.89",
+      announcement: "sema 1.0.89 \u2014 tool calls aborted alongside a pending approval now fold into one summary line instead of repeating a full error per call, so the approval you're deciding on doesn't get buried"
     };
   }
 });
@@ -431513,6 +431584,14 @@ function deriveUUID(parentUUID, index) {
   let hex3 = index.toString(16).padStart(12, "0");
   return `${parentUUID.slice(0, 24)}${hex3}`;
 }
+function preserveSemaRenderSidecars(from) {
+  let src = from;
+  if (src === null || typeof src != "object") return {};
+  let out6 = {};
+  for (let key of SEMA_RENDER_SIDECAR_KEYS)
+    src[key] !== void 0 && (out6[key] = src[key]);
+  return out6;
+}
 function normalizeMessages(messages) {
   let isNewChain = !1;
   return messages.flatMap((message) => {
@@ -431573,7 +431652,10 @@ function normalizeMessages(messages) {
               imagePasteIds: imageId !== void 0 ? [imageId] : void 0,
               origin: message.origin
             }),
-            uuid: isNewChain ? deriveUUID(message.uuid, index) : message.uuid
+            uuid: isNewChain ? deriveUUID(message.uuid, index) : message.uuid,
+            // 🔴 sema #324:顶层 sema sidecar 透传 —— 判据与族扫见 SEMA_RENDER_SIDECAR_KEYS 头注
+            //    (白名单重建把它们丢在消费者上游 = 折叠族在真管线上恒不触发)。
+            ...preserveSemaRenderSidecars(message)
           };
         });
       }
@@ -433984,8 +434066,9 @@ ${raw2}
 IMPORTANT: After completing your current task, you MUST address the user's message above. Do not ignore it.`;
   }
 }
-var MEMORY_CORRECTION_HINT, TOOL_REFERENCE_TURN_BOUNDARY, INTERRUPT_MESSAGE, INTERRUPT_MESSAGE_FOR_TOOL_USE, CANCEL_MESSAGE2, REJECT_MESSAGE2, REJECT_MESSAGE_WITH_REASON_PREFIX, SUBAGENT_REJECT_MESSAGE, SUBAGENT_REJECT_MESSAGE_WITH_REASON_PREFIX, PLAN_REJECTION_PREFIX, DENIAL_WORKAROUND_GUIDANCE, NO_RESPONSE_REQUESTED, SYNTHETIC_TOOL_RESULT_PLACEHOLDER, AUTO_MODE_REJECTION_PREFIX, SYNTHETIC_MODEL, SYNTHETIC_MESSAGES, EMPTY_LOOKUPS, EMPTY_STRING_SET, STRIPPED_TAGS_RE, PLAN_PHASE4_CONTROL, PLAN_PHASE4_TRIM, PLAN_PHASE4_CUT, PLAN_PHASE4_CAP, init_messages4 = __esm({
+var MEMORY_CORRECTION_HINT, TOOL_REFERENCE_TURN_BOUNDARY, INTERRUPT_MESSAGE, INTERRUPT_MESSAGE_FOR_TOOL_USE, CANCEL_MESSAGE2, REJECT_MESSAGE2, REJECT_MESSAGE_WITH_REASON_PREFIX, SUBAGENT_REJECT_MESSAGE, SUBAGENT_REJECT_MESSAGE_WITH_REASON_PREFIX, PLAN_REJECTION_PREFIX, DENIAL_WORKAROUND_GUIDANCE, NO_RESPONSE_REQUESTED, SYNTHETIC_TOOL_RESULT_PLACEHOLDER, AUTO_MODE_REJECTION_PREFIX, SYNTHETIC_MODEL, SYNTHETIC_MESSAGES, SEMA_RENDER_SIDECAR_KEYS, EMPTY_LOOKUPS, EMPTY_STRING_SET, STRIPPED_TAGS_RE, PLAN_PHASE4_CONTROL, PLAN_PHASE4_TRIM, PLAN_PHASE4_CUT, PLAN_PHASE4_CAP, init_messages4 = __esm({
   "build-src/src/utils/messages.ts"() {
+    init_dist();
     init_systemReminderTag();
     init_isObject();
     init_last();
@@ -434058,6 +434141,12 @@ Rejected plan:
       REJECT_MESSAGE2,
       NO_RESPONSE_REQUESTED
     ]);
+    SEMA_RENDER_SIDECAR_KEYS = [
+      // 1.0.89 提货批族扫:键名走 client-core 包常量(铸点同一个符号),不再手抄字面量。
+      // `_sema_degraded` 包侧今天没铸出公面常量 ⇒ 保留字面量,那一把到货再换(不硬凑)。
+      SEMA_COLLATERAL_ABORT_KEY,
+      "_sema_degraded"
+    ];
     EMPTY_LOOKUPS = {
       siblingToolUseIDs: /* @__PURE__ */ new Map(),
       progressMessagesByToolUseID: /* @__PURE__ */ new Map(),
@@ -435336,6 +435425,8 @@ var import_react198, EMPTY2, current3, listeners8, init_enginePromptSuggestionsS
 // build-src/src/sema/upstreamBridge.ts
 var upstreamBridge_exports = {};
 __export(upstreamBridge_exports, {
+  collateralAbortCallIdOf: () => collateralAbortCallIdOf,
+  collateralAbortStampTargetOf: () => collateralAbortStampTargetOf,
   deriveNotificationResidualLines: () => deriveNotificationResidualLines,
   engineTaskNotificationDedupKey: () => taskNotificationDedupKeyFromWire,
   sdkMessagesToCcEvents: () => sdkMessagesToCcEvents,
@@ -435429,6 +435520,26 @@ function isTaskNotificationRow(msg) {
 function stampTranscriptArrival(msg) {
   typeof msg.timestamp != "string" && (msg.timestamp = (/* @__PURE__ */ new Date()).toISOString());
 }
+function collateralAbortCallIdOf(frame) {
+  let f = frame;
+  if (f === null || typeof f != "object" || f.type !== "tool_end_result" || f[SEMA_COLLATERAL_ABORT_KEY] !== !0) return;
+  let id = f.toolCallId;
+  if (!(typeof id != "string" || id.length === 0))
+    return id.length <= MAX_COLLATERAL_ABORT_ID_CHARS ? id : void 0;
+}
+function collateralAbortStampTargetOf(msg) {
+  let content = msg?.message?.content;
+  if (!Array.isArray(content)) return;
+  let found;
+  for (let block2 of content) {
+    let b3 = block2;
+    if (b3?.type === "tool_result") {
+      if (found !== void 0 || typeof b3.tool_use_id != "string" || b3.tool_use_id.length === 0) return;
+      found = b3.tool_use_id;
+    }
+  }
+  return found;
+}
 async function* sdkMessagesToCcEvents(sdk, meta3) {
   function streamEvt(event) {
     return {
@@ -435594,10 +435705,20 @@ async function* sdkMessagesToCcEvents(sdk, meta3) {
       rowYielded: !1
     });
   }
-  let macrotask = () => new Promise((resolve57) => setTimeout(resolve57, 0)), curFrame = null, curFrameType = null, curFrameNo = 0, guidanceLane = createToolEndGuidanceLane(), teed = (async function* () {
+  let macrotask = () => new Promise((resolve57) => setTimeout(resolve57, 0)), curFrame = null, curFrameType = null, curFrameNo = 0, guidanceLane = createToolEndGuidanceLane(), collateralAbortCalls = /* @__PURE__ */ new Set();
+  function noteCollateralAbortFrame(m2) {
+    let id = collateralAbortCallIdOf(m2);
+    id !== void 0 && (collateralAbortCalls.size >= MAX_COLLATERAL_ABORT_IDS || collateralAbortCalls.add(id));
+  }
+  function stampCollateralAbort(msg) {
+    if (collateralAbortCalls.size === 0) return;
+    let id = collateralAbortStampTargetOf(msg);
+    id === void 0 || !collateralAbortCalls.has(id) || (msg[SEMA_COLLATERAL_ABORT_KEY] = !0);
+  }
+  let teed = (async function* () {
     for await (let raw2 of sdk) {
       let m2 = raw2;
-      curFrame = m2, curFrameType = typeof m2.type == "string" ? m2.type : null, curFrameNo++, observeFrame(m2), recordAgentToolStatsFromFrame(m2), guidanceLane.note(curFrameNo, m2), yield raw2;
+      curFrame = m2, curFrameType = typeof m2.type == "string" ? m2.type : null, curFrameNo++, observeFrame(m2), recordAgentToolStatsFromFrame(m2), guidanceLane.note(curFrameNo, m2), noteCollateralAbortFrame(m2), yield raw2;
     }
     curFrame = null, curFrameType = null, curFrameNo++;
   })(), seenFrameNo = -1, prevFrameWasStreamEvent = !1, lastOutWasDelta = !1, macrotaskPending = !1;
@@ -435610,17 +435731,17 @@ async function* sdkMessagesToCcEvents(sdk, meta3) {
         let msg = reduceApiErrorEnvelope(out6.message);
         noteModelEvidenceFrom(msg);
         let w2 = notifWatch.get(seenFrameNo);
-        w2 !== void 0 && !w2.rowYielded && isTaskNotificationRow(msg) && (w2.rowYielded = !0), stampTranscriptArrival(msg), yield msg;
+        w2 !== void 0 && !w2.rowYielded && isTaskNotificationRow(msg) && (w2.rowYielded = !0), stampTranscriptArrival(msg), stampCollateralAbort(msg), yield msg;
       } else
         for (let ev of consumeChrome(out6.event)) yield ev;
       lastOutWasDelta = isDelta;
     }
     seenFrameNo >= 0 && guidanceLane.flushFrame(seenFrameNo), notifEpilogue(Number.MAX_SAFE_INTEGER);
   } finally {
-    guidanceLane.discard(), noteBridgeDriveEnd();
+    guidanceLane.discard(), collateralAbortCalls.clear(), noteBridgeDriveEnd();
   }
 }
-var BRIDGE_PROBE_ENV, init_upstreamBridge = __esm({
+var BRIDGE_PROBE_ENV, MAX_COLLATERAL_ABORT_IDS, MAX_COLLATERAL_ABORT_ID_CHARS, init_upstreamBridge = __esm({
   "build-src/src/sema/upstreamBridge.ts"() {
     init_dist();
     init_bridgeAdapter();
@@ -435655,6 +435776,7 @@ var BRIDGE_PROBE_ENV, init_upstreamBridge = __esm({
       tick: "SEMA_TICK_PROBE",
       hook: "SEMA_HOOK_PROBE"
     };
+    MAX_COLLATERAL_ABORT_IDS = 1024, MAX_COLLATERAL_ABORT_ID_CHARS = 256;
   }
 });
 
@@ -451695,7 +451817,7 @@ var init_strict_output_schema = __esm({
 // node_modules/@sema-agent/core/dist/core/mcp.js
 import { tmpdir as tmpdir13 } from "node:os";
 import { join as join170 } from "node:path";
-var MCP_PREFIX, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS, MCP_IDLE_TIMEOUT_HTTP_DEFAULT_MS, MCP_BLOB_DIR, init_mcp4 = __esm({
+var MCP_PREFIX, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS, MCP_IDLE_TIMEOUT_HTTP_DEFAULT_MS, MCP_BLOB_DIR, LIST_ENTRY_FINGERPRINT_MAX_CHARS, LOOP_REWIND_FINGERPRINT_MAX_CHARS, init_mcp4 = __esm({
   "node_modules/@sema-agent/core/dist/core/mcp.js"() {
     init_protocol_table();
     init_protocol_naming();
@@ -451703,6 +451825,7 @@ var MCP_PREFIX, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS, MCP_IDLE_TIMEOUT_HTTP_DEFAULT
     init_stdio3();
     init_streamableHttp();
     init_types12();
+    init_protocol();
     init_image_downsample();
     init_surrogate_safe_slice();
     init_tool_errors();
@@ -451712,7 +451835,7 @@ var MCP_PREFIX, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS, MCP_IDLE_TIMEOUT_HTTP_DEFAULT
     init_strict_output_schema();
     init_protocol_naming();
     init_image_downsample();
-    MCP_PREFIX = MCP_NAMESPACE.prefix, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS = 30 * 6e4, MCP_IDLE_TIMEOUT_HTTP_DEFAULT_MS = 5 * 6e4, MCP_BLOB_DIR = join170(tmpdir13(), "sema-mcp-blobs");
+    MCP_PREFIX = MCP_NAMESPACE.prefix, MCP_IDLE_TIMEOUT_STDIO_DEFAULT_MS = 30 * 6e4, MCP_IDLE_TIMEOUT_HTTP_DEFAULT_MS = 5 * 6e4, MCP_BLOB_DIR = join170(tmpdir13(), "sema-mcp-blobs"), LIST_ENTRY_FINGERPRINT_MAX_CHARS = 8 * 1024, LOOP_REWIND_FINGERPRINT_MAX_CHARS = 1024 * 1024;
   }
 });
 
@@ -451824,12 +451947,30 @@ function parseLeadingCommandName(command8, options) {
       reject: "shell operators (pipes, redirects, ;, &&, command substitution, subshells, variable expansion) are not allowed \u2014 run a single simple command"
     };
   let first = trimmed2.split(/\s+/)[0];
-  return first.includes("/") ? { reject: "the command must be a bare name resolved via PATH (no path prefix)" } : first.includes("=") ? { reject: "leading environment-variable assignments are not allowed" } : /["'{}*?[\]~]/.test(first) ? { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" } : { name: first };
+  return first.includes("/") && options?.pathPrefixedNameIsText !== !0 ? { reject: "the command must be a bare name resolved via PATH (no path prefix)" } : first.includes("=") ? { reject: "leading environment-variable assignments are not allowed" } : /["'{}*?[\]~]/.test(first) ? { reject: "the command name must be a bare token (no quotes, braces, globs, or ~)" } : { name: first };
+}
+function splitShellCompoundSegments(source, options) {
+  if (SHELL_SEGMENT_HARD_REJECT.test(source))
+    return { reject: "redirection, command/variable substitution, subshells, escapes, and line breaks are not allowed" };
+  let scanned = options?.trailingTerminator !== "keep" ? source.replace(/;\s*$/, "") : source, segments = [], pipeFed = [!1], mask = quoteMask(scanned), quoted = (i) => mask.balanced && mask.quoted[i] === !0, cur = "";
+  for (let i = 0; i < scanned.length; i++) {
+    let c2 = scanned[i];
+    if (quoted(i))
+      cur += c2;
+    else if (c2 === "&")
+      if (scanned[i + 1] === "&")
+        segments.push(cur), cur = "", pipeFed.push(!1), i++;
+      else
+        return { reject: "`&` backgrounding is not allowed \u2014 a backgrounded process outlives the command" };
+    else c2 === "|" ? scanned[i + 1] === "|" ? (segments.push(cur), cur = "", pipeFed.push(!1), i++) : (segments.push(cur), cur = "", pipeFed.push(!0)) : c2 === ";" ? (segments.push(cur), cur = "", pipeFed.push(!1)) : cur += c2;
+  }
+  return segments.push(cur), { segments, pipeFed };
 }
-var SHELL_OPERATORS2, init_bash_readonly_classifier = __esm({
+var SHELL_OPERATORS2, SHELL_SEGMENT_HARD_REJECT, init_bash_readonly_classifier = __esm({
   "node_modules/@sema-agent/core/dist/tools/fs/bash-readonly-classifier.js"() {
     init_safety();
     SHELL_OPERATORS2 = /[;&|<>$()`\n\r\\]/;
+    SHELL_SEGMENT_HARD_REJECT = /[<>$()`\n\r\\]/;
   }
 });
 
@@ -452282,6 +452423,25 @@ var init_retain_ledger = __esm({
 import { closeSync as closeSync14, constants as FS, existsSync as existsSync29, fstatSync as fstatSync4, linkSync as linkSync2, mkdirSync as mkdirSync23, openSync as openSync15, readFileSync as readFileSync40, readSync as readSync4, realpathSync as realpathSync12, renameSync as renameSync14, truncateSync, unlinkSync as unlinkSync12, writeFileSync as writeFileSync22, writeSync as writeSync8, fsyncSync as fsyncSync11 } from "node:fs";
 import { basename as basename51, dirname as dirname77, join as join171, resolve as resolvePath3 } from "node:path";
 import { createHash as createHash25, randomBytes as randomBytes25 } from "node:crypto";
+function writeThenLink(target, content) {
+  ensureDir(dirnameOf(target));
+  let tmp = `${target}.${process.pid}.${randomBytes25(6).toString("hex")}.tmp`, linked = !1;
+  try {
+    let fd2 = openSync15(tmp, FS.O_CREAT | FS.O_EXCL | FS.O_WRONLY, 384);
+    try {
+      writeFileSync22(fd2, content), fsyncSync11(fd2);
+    } finally {
+      closeSync14(fd2);
+    }
+    linkSync2(tmp, target), linked = !0;
+  } finally {
+    try {
+      unlinkSync12(tmp);
+    } catch {
+    }
+  }
+  linked && fsyncDir(dirnameOf(target));
+}
 function ensureDir(dir) {
   mkdirSync23(dir, { recursive: !0, mode: 448 });
 }
@@ -452374,7 +452534,48 @@ function truncateTornTail(path28) {
 `);
   truncateSync(path28, lastNl === -1 ? 0 : Buffer.byteLength(raw2.slice(0, lastNl + 1), "utf8"));
 }
-var AppendLog, init_fs_atomic = __esm({
+function acquireStoreDirLock(dir, opts) {
+  let fileName = opts.fileName ?? "LOCK", lockPath2 = join171(dir, fileName), key = `${fileName}@${canonicalStoreKey(dir)}`, lease = (entry2) => {
+    let released = !1;
+    return {
+      lockPath: lockPath2,
+      release: () => {
+        if (!released && (released = !0, heldStoreDirLocks.get(key) === entry2 && (entry2.refs -= 1, !(entry2.refs > 0)))) {
+          if (entry2.lock.release()) {
+            heldStoreDirLocks.delete(key);
+            return;
+          }
+          console.warn(`[sema] file store: the ${opts.label} directory fence at ${lockPath2} could not be handed back \u2014 the removal could not be proven, so a lock file naming this live process (pid ${process.pid}) may still be there. While it is, another process opening that directory is refused by name; the next open of it in THIS process finishes the cleanup or refuses by name. After this process exits the file is reclaimed as a stale lock ONLY if it is readable and its directory writable \u2014 otherwise it has to be removed by hand.`);
+        }
+      }
+    };
+  }, existing = heldStoreDirLocks.get(key);
+  if (existing !== void 0) {
+    if (existing.refs > 0 || existing.lock.resumeAbandoned())
+      return existing.refs += 1, lease(existing);
+    heldStoreDirLocks.delete(key);
+  }
+  let lock2 = new BootLock(lockPath2);
+  try {
+    lock2.acquire();
+  } catch (err8) {
+    if (err8 instanceof FileStoreLockError) {
+      let who = err8.ownerPid !== void 0 ? ` (pid ${err8.ownerPid})` : "", single = "This backend is SINGLE-WRITER per directory: a second process replays a private view (both sides can win a once-only decision) and its next compaction erases the records it never loaded.";
+      throw new FileStoreLockError(err8.code, err8.code === "store.lock_unreadable" ? `file store: the ${opts.label} directory (${dir}) cannot be opened \u2014 ${err8.message}` : err8.code === "store.dir_claiming" ? `file store: another OS process${who} is claiming this data dir \u2014 it is reclaiming the ${opts.label} directory (${dir}) from a lock a crashed owner left behind. ${single} Retry in a moment: either that process finishes and owns the directory, or it dies and the next start reclaims it.` : `file store: another OS process${who} is using the ${opts.label} directory (${dir}). ${single} Stop the other process, point this one at a different data root, or use the pg/tidb backend for real multi-process concurrency.`, err8.code === "store.lock_unreadable" ? err8.lockPath : lockPath2, err8.ownerPid);
+    }
+    throw err8;
+  }
+  let entry = { lock: lock2, refs: 1 };
+  return heldStoreDirLocks.set(key, entry), lease(entry);
+}
+function isProcessRunning4(pid) {
+  try {
+    return process.kill(pid, 0), !0;
+  } catch (err8) {
+    return err8.code === "EPERM";
+  }
+}
+var AppendLog, FileStoreLockError, MAX_RECLAIM_DEPTH, MAX_ACQUIRE_ATTEMPTS, abandonedLocks, BootLock, heldStoreDirLocks, init_fs_atomic = __esm({
   "node_modules/@sema-agent/core/dist/stores/file/fs-atomic.js"() {
     AppendLog = class {
       fd;
@@ -452451,6 +452652,127 @@ var AppendLog, init_fs_atomic = __esm({
         }
       }
     };
+    FileStoreLockError = class extends Error {
+      code;
+      lockPath;
+      ownerPid;
+      name = "FileStoreLockError";
+      constructor(code2, message, lockPath2, ownerPid) {
+        super(message), this.code = code2, this.lockPath = lockPath2, this.ownerPid = ownerPid;
+      }
+    }, MAX_RECLAIM_DEPTH = 8, MAX_ACQUIRE_ATTEMPTS = 4, abandonedLocks = /* @__PURE__ */ new Set(), BootLock = class _BootLock {
+      lockPath;
+      held = !1;
+      spentVerdict;
+      constructor(lockPath2) {
+        this.lockPath = lockPath2;
+      }
+      acquire() {
+        this.acquireWithin(0);
+      }
+      acquireWithin(depth) {
+        for (let attempt = 0; attempt < MAX_ACQUIRE_ATTEMPTS; attempt++) {
+          try {
+            this.writeLock(), this.held = !0, abandonedLocks.delete(this.abandonKey);
+            return;
+          } catch (err8) {
+            if (err8.code !== "EEXIST")
+              throw err8;
+          }
+          let owner = this.inspectLock();
+          if (owner.state === "absent")
+            continue;
+          if (owner.state === "unreadable")
+            throw new FileStoreLockError("store.lock_unreadable", `file store: lock file at ${this.lockPath} is unreadable/corrupt; remove it manually if it is stale`, this.lockPath);
+          if (owner.pid === process.pid && abandonedLocks.has(this.abandonKey)) {
+            this.pruneOwnAbandoned();
+            return;
+          }
+          if (isProcessRunning4(owner.pid))
+            throw new FileStoreLockError("store.dir_in_use", `file store: another instance (pid ${owner.pid}) owns this data dir (${dirnameOf(this.lockPath)})`, this.lockPath, owner.pid);
+          if (depth >= MAX_RECLAIM_DEPTH)
+            throw new FileStoreLockError("store.lock_unreadable", `file store: lock file at ${this.lockPath} is buried under ${depth} nested stale reclaim gates (repeated crashes mid-reclaim); remove the ${basenameOf(this.lockPath)}.claim.* files manually`, this.lockPath);
+          let gate = new _BootLock(`${this.lockPath}.claim.${owner.pid}`);
+          try {
+            gate.acquireWithin(depth + 1);
+          } catch (err8) {
+            throw err8 instanceof FileStoreLockError && err8.code === "store.dir_in_use" && err8.ownerPid !== void 0 ? new FileStoreLockError("store.dir_claiming", `file store: another instance${err8.ownerPid !== void 0 ? ` (pid ${err8.ownerPid})` : ""} is claiming this data dir (${dirnameOf(this.lockPath)}) from a stale lock`, this.lockPath, err8.ownerPid) : err8;
+          }
+          try {
+            let under = this.inspectLock();
+            if (under.state === "owner" && under.pid === owner.pid)
+              try {
+                unlinkSync12(this.lockPath);
+              } catch {
+              }
+            else if (under.state !== "absent")
+              continue;
+            this.publishOrLoseRace();
+            return;
+          } finally {
+            gate.release();
+          }
+        }
+        throw new FileStoreLockError("store.dir_in_use", `file store: ownership of this data dir (${dirnameOf(this.lockPath)}) kept changing under us (${MAX_ACQUIRE_ATTEMPTS} attempts); another instance is starting and stopping on the same directory`, this.lockPath);
+      }
+      publishOrLoseRace() {
+        try {
+          this.writeLock(), this.held = !0, abandonedLocks.delete(this.abandonKey);
+        } catch (err8) {
+          throw err8.code === "EEXIST" ? new FileStoreLockError("store.dir_in_use", "file store: another instance won the lock race for this data dir", this.lockPath) : err8;
+        }
+      }
+      pruneOwnAbandoned() {
+        try {
+          unlinkSync12(this.lockPath);
+        } catch (err8) {
+          throw new FileStoreLockError("store.lock_unreadable", `file store: this process still owns the lock file at ${this.lockPath} from an earlier release that could not remove it, and removing it now failed too (${String(err8.message)}); remove it manually`, this.lockPath, process.pid);
+        }
+        abandonedLocks.delete(this.abandonKey), this.publishOrLoseRace();
+      }
+      writeLock() {
+        writeThenLink(this.lockPath, String(process.pid));
+      }
+      get abandonKey() {
+        return resolvePath3(this.lockPath);
+      }
+      inspectLock() {
+        let raw2;
+        try {
+          raw2 = readFileSync40(this.lockPath, "utf8").trim();
+        } catch (err8) {
+          return err8.code === "ENOENT" ? { state: "absent" } : { state: "unreadable" };
+        }
+        if (!/^[1-9][0-9]*$/.test(raw2))
+          return { state: "unreadable" };
+        let pid = Number.parseInt(raw2, 10);
+        return Number.isInteger(pid) && pid > 0 ? { state: "owner", pid } : { state: "unreadable" };
+      }
+      release() {
+        return this.held ? (this.held = !1, this.spentVerdict = this.removeOwnLock(), this.spentVerdict) : this.spentVerdict ?? !0;
+      }
+      removeOwnLock() {
+        let before = this.inspectLock();
+        if (before.state === "absent" || before.state === "owner" && before.pid !== process.pid)
+          return abandonedLocks.delete(this.abandonKey), !0;
+        if (before.state === "unreadable")
+          return abandonedLocks.add(this.abandonKey), !1;
+        try {
+          unlinkSync12(this.lockPath);
+        } catch {
+        }
+        let after = this.inspectLock(), gone = after.state === "absent" || after.state === "owner" && after.pid !== process.pid;
+        return gone ? abandonedLocks.delete(this.abandonKey) : abandonedLocks.add(this.abandonKey), gone;
+      }
+      resumeAbandoned() {
+        if (this.held)
+          return !0;
+        if (!abandonedLocks.has(this.abandonKey))
+          return !1;
+        let owner = this.inspectLock();
+        return owner.state !== "owner" || owner.pid !== process.pid ? !1 : (this.held = !0, this.spentVerdict = void 0, abandonedLocks.delete(this.abandonKey), !0);
+      }
+    }, heldStoreDirLocks = /* @__PURE__ */ new Map();
   }
 });
 
@@ -453279,6 +453601,28 @@ function foldSpacing(s) {
 function reject2(code2, message) {
   return { reject: { code: code2, message } };
 }
+function commandBasename(name) {
+  return name.slice(name.lastIndexOf("/") + 1);
+}
+function ruleLaneShapeOf(command8, reading) {
+  let split = splitShellCompoundSegments(command8, { trailingTerminator: reading.terminator });
+  if ("reject" in split)
+    return { reject: split.reject };
+  let names = [];
+  for (let segment2 of split.segments) {
+    let floor = parseLeadingCommandName(segment2, { ...RULE_LANE_FLOOR, quotedOperatorsAreText: reading.quotedOperatorsAreText });
+    if ("reject" in floor)
+      return {
+        reject: split.segments.length > 1 ? `the segment "${escapeForDisclosure(segment2.trim())}" is not a single simple command (${floor.reject})` : floor.reject
+      };
+    if (SHELL_RESERVED_WORDS.has(floor.name))
+      return {
+        reject: `"${escapeForDisclosure(floor.name)}" is a shell keyword, not a command name \u2014 a control structure's real program is not named by the text this lane compares`
+      };
+    names.push(floor.name);
+  }
+  return { segments: split.segments, names };
+}
 function escapeForDisclosure(value) {
   let text2;
   try {
@@ -453305,11 +453649,14 @@ function parseAllowRuleText(text2, opts) {
   let content = parsed.ruleContent, prefixBody = /^(.+):\*$/.exec(content)?.[1], match = prefixBody !== void 0 ? "prefix" : "exact", body = prefixBody ?? content;
   if (body.includes("*"))
     return reject2("unsupported.wildcard", `wildcard rule forms are not supported in this version ("${text2}")`);
-  let floor = parseLeadingCommandName(body);
-  if ("reject" in floor)
-    return body.trim() === "" ? reject2("invalid.empty_command", `rule "${text2}" names no command`) : reject2("invalid.not_simple_command", `rule "${text2}" is not a single simple command (${floor.reject})`);
-  if (match === "prefix" && BARE_INTERPRETER_NAMES.has(floor.name) && opts?.direction !== "tighten")
-    return reject2("invalid.bare_interpreter_prefix", `prefix rule "${text2}" is headed by the interpreter "${floor.name}" \u2014 such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
+  let shape = ruleLaneShapeOf(body, MATCH_READING);
+  if ("reject" in shape)
+    return body.trim() === "" ? reject2("invalid.empty_command", `rule "${text2}" names no command`) : reject2("invalid.not_simple_command", `rule "${text2}" is not a command this lane can name (${shape.reject})`);
+  if (match === "prefix" && shape.segments.length > 1)
+    return reject2("invalid.not_simple_command", `prefix rule "${text2}" names more than one command \u2014 a prefix admits anything appended to its body, so only the exact form may name a connector chain`);
+  let head = commandBasename(shape.names[0] ?? "");
+  if (match === "prefix" && BARE_INTERPRETER_NAMES.has(head) && opts?.direction !== "tighten")
+    return reject2("invalid.bare_interpreter_prefix", `prefix rule "${text2}" is headed by the interpreter "${head}" \u2014 such a rule authorizes running arbitrary programs, which one approval click cannot be read as having granted (an exact rule naming the whole command line is accepted)`);
   let command8 = foldSpacing(body);
   return command8 === void 0 ? reject2("invalid.unbalanced_quotes", `rule "${text2}" has unbalanced quoting, so the command it names is not determinable`) : { rule: { rule: formatAllowRuleText(command8, match), tool: "Bash", match, command: command8 } };
 }
@@ -453319,19 +453666,11 @@ function formatAllowRuleText(command8, match) {
 function isRuleLive(rule) {
   return rule.adds.length > 0;
 }
-var MAX_RULE_TEXT_CHARS, BARE_INTERPRETER_NAMES, SUGGESTION_LEXICON, LEXICON_BODIES, CONTROL_CHARS_RE, CONTROL_CHARS_GLOBAL_RE, DISCLOSED_RULE_TEXT_MAX_CHARS, init_permission_rule_model = __esm({
+var MAX_RULE_TEXT_CHARS, BARE_INTERPRETER_NAMES, SHELL_RESERVED_WORDS, SUGGESTION_LEXICON, LEXICON_BODIES, RULE_LANE_FLOOR, MATCH_READING, CONTROL_CHARS_RE, CONTROL_CHARS_GLOBAL_RE, DISCLOSED_RULE_TEXT_MAX_CHARS, init_permission_rule_model = __esm({
   "node_modules/@sema-agent/core/dist/core/permission-rule-model.js"() {
     init_permission_rules();
     init_bash_readonly_classifier();
     MAX_RULE_TEXT_CHARS = 512, BARE_INTERPRETER_NAMES = /* @__PURE__ */ new Set([
-      "bash",
-      "sh",
-      "zsh",
-      "ksh",
-      "csh",
-      "tcsh",
-      "dash",
-      "fish",
       "node",
       "deno",
       "bun",
@@ -453342,15 +453681,108 @@ var MAX_RULE_TEXT_CHARS, BARE_INTERPRETER_NAMES, SUGGESTION_LEXICON, LEXICON_BOD
       "ruby",
       "php",
       "osascript",
-      "env",
+      "java",
+      "dotnet",
+      "mono",
+      "lua",
+      "luajit",
+      "julia",
+      "Rscript",
+      "tclsh",
+      "groovy",
+      "scala",
+      "awk",
+      "gawk",
+      "mawk",
+      "nawk",
+      "sed",
+      "bash",
+      "sh",
+      "zsh",
+      "ksh",
+      "csh",
+      "tcsh",
+      "dash",
+      "fish",
+      "cmd",
+      "powershell",
+      "pwsh",
+      "busybox",
+      "source",
+      ".",
+      "trap",
       "eval",
       "exec",
+      "command",
+      "builtin",
+      "enable",
+      "compgen",
+      "complete",
+      "bind",
+      "mapfile",
+      "readarray",
+      "env",
+      "noglob",
       "xargs",
-      "nohup",
       "sudo",
       "doas",
+      "pkexec",
       "su",
-      "ssh"
+      "runuser",
+      "ssh",
+      "chroot",
+      "setpriv",
+      "nohup",
+      "nice",
+      "ionice",
+      "chrt",
+      "taskset",
+      "stdbuf",
+      "timeout",
+      "time",
+      "watch",
+      "setsid",
+      "flock",
+      "unshare",
+      "nsenter",
+      "script",
+      "numactl",
+      "prlimit",
+      "systemd-run",
+      "parallel",
+      "strace",
+      "ltrace",
+      "valgrind",
+      "gdb",
+      "lldb",
+      "perf",
+      "firejail",
+      "bwrap"
+    ]), SHELL_RESERVED_WORDS = /* @__PURE__ */ new Set([
+      "!",
+      "[[",
+      "]]",
+      "{",
+      "}",
+      "((",
+      "))",
+      "case",
+      "esac",
+      "coproc",
+      "do",
+      "done",
+      "elif",
+      "else",
+      "fi",
+      "for",
+      "function",
+      "if",
+      "in",
+      "select",
+      "then",
+      "time",
+      "until",
+      "while"
     ]), SUGGESTION_LEXICON = [
       "git status",
       "git log",
@@ -453478,6 +453910,7 @@ var MAX_RULE_TEXT_CHARS, BARE_INTERPRETER_NAMES, SUGGESTION_LEXICON, LEXICON_BOD
       "gh search prs",
       "gh search code"
     ], LEXICON_BODIES = SUGGESTION_LEXICON.map((b3) => b3.split(" "));
+    RULE_LANE_FLOOR = { pathPrefixedNameIsText: !0 }, MATCH_READING = { terminator: "keep", quotedOperatorsAreText: !1 };
     CONTROL_CHARS_RE = /[\u0000-\u0008\u000A-\u001F\u007F-\u009F\p{Cf}\u2028\u2029]/u, CONTROL_CHARS_GLOBAL_RE = new RegExp(CONTROL_CHARS_RE.source, "gu"), DISCLOSED_RULE_TEXT_MAX_CHARS = 120;
   }
 });
@@ -455392,17 +455825,24 @@ var LedgerCore, SharedLedgerTable, init_shared_ledger = __esm({
       locks = /* @__PURE__ */ new Map();
       events = 0;
       handle;
+      fence;
+      released = !1;
       constructor(key, paths3, model, table) {
         this.key = key, this.paths = paths3, this.model = model, this.table = table;
       }
       bootstrap() {
-        for (let row2 of readJsonlRecords(this.paths.snapshotPath))
-          this.rows.set(this.model.keyOf(row2), row2);
-        let events3 = readJsonlRecords(this.paths.ledgerPath);
-        this.events = events3.length;
-        for (let ev of events3)
-          this.model.apply(this.rows, ev);
-        this.handle = new AppendLog(this.paths.ledgerPath);
+        this.fence = acquireStoreDirLock(this.paths.dir, { label: this.model.label });
+        try {
+          for (let row2 of readJsonlRecords(this.paths.snapshotPath))
+            this.rows.set(this.model.keyOf(row2), row2);
+          let events3 = readJsonlRecords(this.paths.ledgerPath);
+          this.events = events3.length;
+          for (let ev of events3)
+            this.model.apply(this.rows, ev);
+          this.handle = new AppendLog(this.paths.ledgerPath);
+        } catch (e) {
+          throw this.fence.release(), this.fence = void 0, e;
+        }
       }
       withLock(key, fn2) {
         let run2 = (this.locks.get(key) ?? Promise.resolve()).then(() => fn2(), () => fn2()), tail = run2.then(() => {
@@ -455420,13 +455860,15 @@ var LedgerCore, SharedLedgerTable, init_shared_ledger = __esm({
           }
       }
       compact() {
+        if (this.released)
+          throw new Error("file ledger: this authority was released (its store was closed) \u2014 refusing to compact a directory it no longer owns");
         let lines = [...this.rows.values()].map((r) => JSON.stringify(r)).join(`
 `);
         atomicWriteFile2(this.paths.tmpDir, this.paths.snapshotPath, lines.length ? `${lines}
 ` : ""), this.log.closeForSwap(), atomicWriteFile2(this.paths.tmpDir, this.paths.ledgerPath, ""), this.events = 0;
       }
       release() {
-        this.refs -= 1, !(this.refs > 0) && (this.table.get(this.key) === this && this.table.delete(this.key), this.handle?.close());
+        this.refs -= 1, !(this.refs > 0) && (this.table.get(this.key) === this && this.table.delete(this.key), this.released = !0, this.handle?.close(), this.fence?.release(), this.fence = void 0);
       }
       get pendingEvents() {
         return this.events;
@@ -455508,6 +455950,7 @@ var CHECKPOINT_LEDGER_EVENT_REGISTRY, KNOWN_CHECKPOINT_LEDGER_EVENTS, checkpoint
       steer_append: !0
     }, KNOWN_CHECKPOINT_LEDGER_EVENTS = new Set(Object.keys(CHECKPOINT_LEDGER_EVENT_REGISTRY));
     checkpointLedgers = new SharedLedgerTable({
+      label: "checkpoint ledger",
       keyOf: (cp2) => cp2.token,
       apply: applyCheckpointEvent
     });
@@ -455585,6 +456028,7 @@ var agentLedgers, FileBackgroundAgentStore, init_background_agent_store2 = __esm
     init_shared_ledger();
     init_marker();
     agentLedgers = new SharedLedgerTable({
+      label: "background-agent ledger",
       keyOf: (r) => FileBackgroundAgentStore.key(r.handle, r.scope),
       apply: (rows2, ev) => {
         if (ev.t === "delete") {
@@ -456009,6 +456453,7 @@ var init_file2 = __esm({
     init_strategy_store2();
     init_fs_atomic();
     init_fs_atomic();
+    init_fs_atomic();
     init_marker();
     init_adopt();
   }
@@ -456391,6 +456836,7 @@ var runLedgers, init_workflow_run_store2 = __esm({
     init_shared_ledger();
     init_marker();
     runLedgers = new SharedLedgerTable({
+      label: "workflow-run ledger",
       keyOf: (run2) => run2.id,
       apply: (runs, ev) => {
         if (ev.t === "delete") {
@@ -502060,7 +502506,7 @@ function REPL({
           item.reject(new Error("Prompt cancelled by user"));
         setPromptQueue([]), abortController?.abort("user-cancel");
       } else activeRemote.isRemoteMode ? activeRemote.cancelRequest() : abortController?.abort("user-cancel");
-      setAbortController(null), mrOnTurnComplete(messagesRef.current, !0);
+      activeRemote.isRemoteMode || bestEffortInteractiveCancel(), setAbortController(null), mrOnTurnComplete(messagesRef.current, !0);
     }
   }
   let handleQueuedCommandOnCancel = (0, import_react332.useCallback)(() => {
@@ -532303,7 +532749,7 @@ Usage: sema --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.88", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
+  }).version("sema 1.0.89", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).psHandler([]), process.exit(process.exitCode ?? 0);
   }), program2.command("logs [id]").description("Print a background session's recent terminal output").action(async (id) => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).logsHandler(id, []), process.exit(process.exitCode ?? 0);

package/sema.js

@@ -71,7 +71,7 @@ function installBootSignalTailFrame(argv2 = process.argv.slice(2)) {
 installBootSignalTailFrame();
 
 // build-src/src/sema/preludeEntry.ts
-var versionLine = "sema 1.0.88" ? "sema 1.0.88" : "";
+var versionLine = "sema 1.0.89" ? "sema 1.0.89" : "";
 var argv = process.argv.slice(2);
 var wantsVersionFastPath = argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v");
 if (wantsVersionFastPath && versionLine) {