@sema-agent/cli 1.0.97 → 1.0.98

package/sema-main.js

@@ -9192,9 +9192,9 @@ var _SessionToolRunner_instances, _SessionToolRunner_consumed, _SessionToolRunne
             yield next.value;
           }
           await streamPromise;
-          let pending3;
-          for (; (pending3 = __classPrivateFieldGet(this, _SessionToolRunner_results, "f").tryShift()) !== void 0; )
-            yield pending3;
+          let pending4;
+          for (; (pending4 = __classPrivateFieldGet(this, _SessionToolRunner_results, "f").tryShift()) !== void 0; )
+            yield pending4;
         } finally {
           __classPrivateFieldGet(this, _SessionToolRunner_controller, "f").abort(), __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_disarmIdleTimer).call(this), await streamPromise;
           try {
@@ -9245,22 +9245,22 @@ var _SessionToolRunner_instances, _SessionToolRunner_consumed, _SessionToolRunne
      * already attached (see {@link SessionToolRunner.#streamLoop}).
      */
     async function() {
-      let ctrl = __classPrivateFieldGet(this, _SessionToolRunner_controller, "f"), pending3 = [], lastWasEndTurn = !1;
+      let ctrl = __classPrivateFieldGet(this, _SessionToolRunner_controller, "f"), pending4 = [], lastWasEndTurn = !1;
       try {
         for await (let ev of this.client.beta.sessions.events.list(this.sessionId, { limit: 1e3 }, __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_requestOptions).call(this)))
-          __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_ingestHistory).call(this, ev, pending3), lastWasEndTurn = isEndTurnIdle(ev);
+          __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_ingestHistory).call(this, ev, pending4), lastWasEndTurn = isEndTurnIdle(ev);
       } catch (e) {
         ctrl.signal.throwIfAborted(), __classPrivateFieldGet(this, _SessionToolRunner_logger, "f").warn("reconcile list failed", { error: String(e) });
-        for (let ev of pending3)
+        for (let ev of pending4)
           __classPrivateFieldGet(this, _SessionToolRunner_seen, "f").delete(ev.id);
         return;
       }
-      let unanswered = pending3.filter((ev) => !__classPrivateFieldGet(this, _SessionToolRunner_answered, "f").has(ev.id));
+      let unanswered = pending4.filter((ev) => !__classPrivateFieldGet(this, _SessionToolRunner_answered, "f").has(ev.id));
       lastWasEndTurn && unanswered.length === 0 ? __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_armIdleTimer).call(this) : __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_disarmIdleTimer).call(this);
       for (let ev of unanswered)
         await __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_execute).call(this, ev);
-    }, _SessionToolRunner_ingestHistory = function(ev, pending3) {
-      ev.type === "agent.tool_use" || ev.type === "agent.custom_tool_use" ? (__classPrivateFieldGet(this, _SessionToolRunner_seen, "f").add(ev.id), __classPrivateFieldGet(this, _SessionToolRunner_answered, "f").has(ev.id) || pending3.push(ev)) : ev.type === "user.tool_result" ? __classPrivateFieldGet(this, _SessionToolRunner_answered, "f").add(ev.tool_use_id) : ev.type === "user.custom_tool_result" && __classPrivateFieldGet(this, _SessionToolRunner_answered, "f").add(ev.custom_tool_use_id);
+    }, _SessionToolRunner_ingestHistory = function(ev, pending4) {
+      ev.type === "agent.tool_use" || ev.type === "agent.custom_tool_use" ? (__classPrivateFieldGet(this, _SessionToolRunner_seen, "f").add(ev.id), __classPrivateFieldGet(this, _SessionToolRunner_answered, "f").has(ev.id) || pending4.push(ev)) : ev.type === "user.tool_result" ? __classPrivateFieldGet(this, _SessionToolRunner_answered, "f").add(ev.tool_use_id) : ev.type === "user.custom_tool_result" && __classPrivateFieldGet(this, _SessionToolRunner_answered, "f").add(ev.custom_tool_use_id);
     }, _SessionToolRunner_handleStreamEvent = /** Returns true when the runner should exit. */
     async function(ev) {
       switch (isEndTurnIdle(ev) ? __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_armIdleTimer).call(this) : __classPrivateFieldGet(this, _SessionToolRunner_instances, "m", _SessionToolRunner_disarmIdleTimer).call(this), ev.type) {
@@ -48312,8 +48312,8 @@ function memoizeWithTTLAsync(f, cacheLifetimeMs = 300 * 1e3) {
   let cache6 = /* @__PURE__ */ new Map(), inFlight5 = /* @__PURE__ */ new Map(), memoized = async (...args) => {
     let key = jsonStringify(args), cached6 = cache6.get(key), now2 = Date.now();
     if (!cached6) {
-      let pending3 = inFlight5.get(key);
-      if (pending3) return pending3;
+      let pending4 = inFlight5.get(key);
+      if (pending4) return pending4;
       let promise2 = f(...args);
       inFlight5.set(key, promise2);
       try {
@@ -49065,8 +49065,8 @@ function publishEngineAgentPanelEvent(ev) {
 }
 function subscribeEngineAgentPanel(fn2) {
   if (listener = fn2, buffer.length > 0) {
-    let pending3 = buffer.splice(0, buffer.length);
-    for (let ev of pending3)
+    let pending4 = buffer.splice(0, buffer.length);
+    for (let ev of pending4)
       try {
         fn2(ev);
       } catch {
@@ -51139,7 +51139,7 @@ var STRUCTURED_DETAIL_TYPES, MAX_STRUCTURED_FIELD_CHARS, WF_TERMINAL_STATUSES, P
 
 // node_modules/@sema-agent/client-core/dist/adapt/toolCards.js
 function createToolCardLedger(ctx, idOf) {
-  let pending3 = /* @__PURE__ */ new Map(), assistantResponseId = null, lastLiveTodos = [];
+  let pending4 = /* @__PURE__ */ new Map(), assistantResponseId = null, lastLiveTodos = [];
   function* buildToolResult(p, end) {
     let isError = end?.isError ?? !1, body = end && end.output !== void 0 ? wireOutputToBody(p.name, end.output, isError, end.truncated === !0, flattenWireOutput, end.structured) : degradedToolResultBody(isError);
     if ((p.name === "Bash" || p.name === "Monitor") && !isError && end?.output !== void 0) {
@@ -51178,18 +51178,18 @@ function createToolCardLedger(ctx, idOf) {
     }, ctx.now());
   }
   function* closeCard(p, end) {
-    pending3.delete(p.id), assistantResponseId = null, yield* buildToolResult(p, end);
+    pending4.delete(p.id), assistantResponseId = null, yield* buildToolResult(p, end);
   }
   return {
-    has: (id) => pending3.has(id),
-    peek: (id) => pending3.get(id),
-    entries: () => pending3.entries(),
+    has: (id) => pending4.has(id),
+    peek: (id) => pending4.get(id),
+    entries: () => pending4.entries(),
     open: (p) => {
-      pending3.set(p.id, p);
+      pending4.set(p.id, p);
     },
     close: closeCard,
     *sweep() {
-      for (let [, p] of pending3)
+      for (let [, p] of pending4)
         yield* closeCard(p);
     },
     mintResponseId: (frame) => assistantResponseId ??= `msg_sema_${idOf(frame, "resp")}`,
@@ -53328,11 +53328,27 @@ function classifierDenyFromToolEnd(ev) {
   let tail = message.slice(form.length), reason = tail.startsWith(": ") ? tail.slice(2).trim() : void 0;
   return { message, ...reason !== void 0 && reason.length > 0 ? { reason } : {} };
 }
+function toolNameKey(name) {
+  return name.replace(/[\s_-]+/g, "").toLowerCase();
+}
+function classifierDenyDisplay(toolName2, args) {
+  let fallback = toolName2.length > 0 ? toolName2 : "tool", key = DISPLAY_ARG_KEY_BY_TOOL.get(toolNameKey(toolName2));
+  if (key === void 0 || args === null || typeof args != "object")
+    return bounded(fallback);
+  let raw2 = args[key];
+  return typeof raw2 != "string" || raw2.trim().length === 0 ? bounded(fallback) : bounded(raw2);
+}
+function bounded(s) {
+  if (s.length <= CLASSIFIER_DENY_DISPLAY_MAX)
+    return s;
+  let keep = CLASSIFIER_DENY_DISPLAY_MAX - 1, cut = s.slice(0, keep), last3 = cut.charCodeAt(cut.length - 1), next = s.charCodeAt(keep);
+  return last3 >= 55296 && last3 <= 56319 && next >= 56320 && next <= 57343 && (cut = cut.slice(0, -1)), `${cut}\u2026`;
+}
 function classifierDenyNoticeText(toolName2, reason) {
   let r = reason ?? "";
   return r.length > NOTICE_REASON_MAX && (r = `${r.slice(0, NOTICE_REASON_MAX - 1)}\u2026`), `${toolName2.length > 0 ? toolName2.toLowerCase() : "tool"} denied by auto mode${r ? ` \xB7 ${r}` : ""} \xB7 /permissions`;
 }
-var CLASSIFIER_DENY_SIGNATURE, NOTICE_REASON_MAX, CLASSIFIER_DENY_FORMS, init_classifierVerdictWire = __esm({
+var CLASSIFIER_DENY_SIGNATURE, NOTICE_REASON_MAX, CLASSIFIER_DENY_FORMS, CLASSIFIER_DENY_DISPLAY_MAX, DISPLAY_ARG_KEY_BY_TOOL, init_classifierVerdictWire = __esm({
   "node_modules/@sema-agent/client-core/dist/classifierVerdictWire.js"() {
     init_systemReminderTag();
     CLASSIFIER_DENY_SIGNATURE = "auto-mode classifier blocked this call", NOTICE_REASON_MAX = 80;
@@ -53341,6 +53357,17 @@ var CLASSIFIER_DENY_SIGNATURE, NOTICE_REASON_MAX, CLASSIFIER_DENY_FORMS, init_cl
       "auto-mode classifier blocked this call at an inherited ancestor layer",
       CLASSIFIER_DENY_SIGNATURE
     ];
+    CLASSIFIER_DENY_DISPLAY_MAX = 200, DISPLAY_ARG_KEY_BY_TOOL = /* @__PURE__ */ new Map([
+      ["bash", "command"],
+      ["read", "file_path"],
+      ["fileread", "file_path"],
+      ["write", "file_path"],
+      ["filewrite", "file_path"],
+      ["edit", "file_path"],
+      ["fileedit", "file_path"],
+      ["multiedit", "file_path"],
+      ["notebookedit", "notebook_path"]
+    ]);
   }
 });
 
@@ -54007,8 +54034,8 @@ function rewindSpecForMode(mode, targetEntryId) {
       return { rewindFilesTo: targetEntryId };
   }
 }
-function projectRewind(pending3, captureEnabled) {
-  return pending3 ? { ...pending3 } : captureEnabled ? { rewindFiles: !0 } : {};
+function projectRewind(pending4, captureEnabled) {
+  return pending4 ? { ...pending4 } : captureEnabled ? { rewindFiles: !0 } : {};
 }
 var init_rewindWireCaps = __esm({
   "node_modules/@sema-agent/client-core/dist/rewindWireCaps.js"() {
@@ -55388,14 +55415,14 @@ async function waitForClaimRelease(taskId, deps2) {
   }
 }
 async function attemptActiveRunSelfHeal(signal, runs, deps2) {
-  let pending3 = !1;
+  let pending4 = !1;
   try {
-    pending3 = deps2?.hasPendingDecision?.() === !0;
+    pending4 = deps2?.hasPendingDecision?.() === !0;
   } catch {
-    pending3 = !1;
+    pending4 = !1;
   }
   let callerAborted = () => deps2?.signal?.aborted === !0;
-  if (pending3 && typeof deps2?.listOwnedPendingApprovals == "function" && !callerAborted()) {
+  if (pending4 && typeof deps2?.listOwnedPendingApprovals == "function" && !callerAborted()) {
     let recheckCtl = new AbortController(), onCallerAbort = () => {
       recheckCtl.abort(deps2.signal?.reason);
     };
@@ -55404,13 +55431,13 @@ async function attemptActiveRunSelfHeal(signal, runs, deps2) {
       await Promise.race([
         deps2.listOwnedPendingApprovals({ signal: recheckCtl.signal }),
         claimPollSleep(OWNED_PENDING_RECHECK_TIMEOUT_MS, recheckCtl.signal).then(() => null)
-      ]) === 0 && !callerAborted() && (pending3 = !1);
+      ]) === 0 && !callerAborted() && (pending4 = !1);
     } catch {
     } finally {
       deps2.signal?.removeEventListener("abort", onCallerAbort), recheckCtl.abort(new Error("owned-pending recheck settled"));
     }
   }
-  if (pending3)
+  if (pending4)
     return { kind: "decision-pending", taskId: signal.activeTaskId };
   let taskId = signal.activeTaskId;
   if (taskId === null)
@@ -58533,6 +58560,9 @@ var wireSessionStopHookPrompt, wireSessionStopHookCcSemantics, GOAL_STOP_HOOK_WI
 });
 
 // node_modules/@sema-agent/client-core/dist/hooksWireCaps.js
+function hooksLockedToPluginOnly(policyValue) {
+  return policyValue === !0 ? !0 : Array.isArray(policyValue) ? policyValue.includes("hooks") : !1;
+}
 function hooksOfSource(source) {
   try {
     let s = hostSettings()?.getSettingsForSource(source);
@@ -58565,7 +58595,9 @@ function hooksForWire() {
     hostLog("debug", "hooksWireCaps: disableAllHooks (managed) \u2014 no hooks projected to the engine");
     return;
   }
-  let managedOnly = policy2?.allowManagedHooksOnly === !0, sources = managedOnly ? ["policySettings"] : ["policySettings", ...EDITABLE_HOOK_SOURCES], merged = {};
+  let pluginOnlyHooks = hooksLockedToPluginOnly(policy2?.strictPluginOnlyCustomization);
+  pluginOnlyHooks && hostLog("debug", "hooksWireCaps: strictPluginOnlyCustomization locks the hooks surface (managed) \u2014 only policySettings hooks projected to the engine");
+  let managedOnly = policy2?.allowManagedHooksOnly === !0 || pluginOnlyHooks, sources = managedOnly ? ["policySettings"] : ["policySettings", ...EDITABLE_HOOK_SOURCES], merged = {};
   for (let source of sources) {
     let hooks2 = hooksOfSource(source);
     if (hooks2)
@@ -60178,8 +60210,8 @@ async function findPendingForTask(client3, taskId, matches2, opts, callId, ident
   } catch (e) {
     return { ok: !1, reason: `approvals.list failed: ${String(e)}` };
   }
-  let decidable = rows2.filter((r) => askParkForeignGateKind(r) === null), identityRow = callId !== void 0 ? decidable.find((r) => r.taskId === taskId && (r.boundCallId === callId || r.toolCallId === callId)) : void 0, identityConflicts = identityRow !== void 0 && !identityAccepts(identityRow), pool = identityConflicts ? decidable.filter((r) => identityAccepts(r)) : decidable, pending3 = (identityConflicts ? void 0 : identityRow) ?? pool.find((r) => r.taskId === taskId && matches2(typeof r.toolName == "string" ? r.toolName : void 0)) ?? pool.find((r) => r.taskId === taskId);
-  return pending3 ? { ok: !0, pending: pending3, gatedCallId: pending3.toolCallId ?? pending3.boundCallId ?? void 0 } : { ok: !1, reason: "no pending checkpoint for this run (resolved/expired?)", code: "no_pending" };
+  let decidable = rows2.filter((r) => askParkForeignGateKind(r) === null), identityRow = callId !== void 0 ? decidable.find((r) => r.taskId === taskId && (r.boundCallId === callId || r.toolCallId === callId)) : void 0, identityConflicts = identityRow !== void 0 && !identityAccepts(identityRow), pool = identityConflicts ? decidable.filter((r) => identityAccepts(r)) : decidable, pending4 = (identityConflicts ? void 0 : identityRow) ?? pool.find((r) => r.taskId === taskId && matches2(typeof r.toolName == "string" ? r.toolName : void 0)) ?? pool.find((r) => r.taskId === taskId);
+  return pending4 ? { ok: !0, pending: pending4, gatedCallId: pending4.toolCallId ?? pending4.boundCallId ?? void 0 } : { ok: !1, reason: "no pending checkpoint for this run (resolved/expired?)", code: "no_pending" };
 }
 function makeHitlCanUseTool(bridge3, prompt) {
   return async (tool, input, _toolUseContext, _assistantMessage, toolUseID, forceDecision) => {
@@ -60345,12 +60377,12 @@ var DEFAULT_DENY_REASON, MAX_DENY_REASON_CHARS, HitlSafetyError, DECIDE_TRANSPOR
        * `HitlSafetyError('binding_mismatch')` — the caller re-presents, NEVER auto-retries.
        */
       async decideTool(outcome, toolUseID, opts, preResolvedPending) {
-        let pending3 = preResolvedPending ?? await this.pendingForDecide(toolUseID, opts);
-        if (!pending3)
+        let pending4 = preResolvedPending ?? await this.pendingForDecide(toolUseID, opts);
+        if (!pending4)
           throw new HitlSafetyError("no pending checkpoint to decide (resolved/expired under the human) \u2014 refetch + re-present", "no_pending");
         let decision = outcome.decision === "approve" ? {
           decision: "approve",
-          ...this.bindingOf(pending3),
+          ...this.bindingOf(pending4),
           // updatedInput is applied AFTER the binding check; binding still binds the ORIGINAL input.
           ...outcome.updatedInput !== void 0 ? { updatedInput: outcome.updatedInput } : {},
           // accept-session 的 durable-park 半场(server 1.191 decide 契约 `remember:"session"` →
@@ -60360,10 +60392,10 @@ var DEFAULT_DENY_REASON, MAX_DENY_REASON_CHARS, HitlSafetyError, DECIDE_TRANSPOR
           ...outcome.remember !== void 0 ? { remember: outcome.remember } : {}
         } : {
           decision: "deny",
-          ...this.bindingOf(pending3),
+          ...this.bindingOf(pending4),
           ...outcome.reason !== void 0 ? { reason: outcome.reason } : {}
         };
-        return this.decideRaw(pending3.sessionId, decision, opts);
+        return this.decideRaw(pending4.sessionId, decision, opts);
       }
       // ── §3. AskUserQuestion: answer through the same gate ───────────────────────
       /**
@@ -60385,15 +60417,15 @@ var DEFAULT_DENY_REASON, MAX_DENY_REASON_CHARS, HitlSafetyError, DECIDE_TRANSPOR
        */
       async answerQuestion(answers, toolUseID, opts, preResolvedPending) {
         assertAnswersSendable(answers);
-        let pending3 = preResolvedPending ?? await this.pendingForDecide(toolUseID, opts);
-        if (!pending3)
+        let pending4 = preResolvedPending ?? await this.pendingForDecide(toolUseID, opts);
+        if (!pending4)
           throw new HitlSafetyError("no pending AskUserQuestion checkpoint to answer \u2014 refetch + re-present", "no_pending");
         let decision = {
           decision: "approve",
           answer: { answers: answers.map((a) => marshalAnswer(a)) },
-          ...this.bindingOf(pending3)
+          ...this.bindingOf(pending4)
         };
-        return this.decideRaw(pending3.sessionId, decision, opts);
+        return this.decideRaw(pending4.sessionId, decision, opts);
       }
       // ── §4. plan_review: the distinct wire ──────────────────────────────────────
       /**
@@ -60659,47 +60691,47 @@ async function surfaceFsApprovalAndDecide(deps2, taskId, argsByCall, signal, par
   );
   if (!found.ok)
     return { kind: "failed", reason: found.reason, ...found.code !== void 0 ? { code: found.code } : {} };
-  let { pending: pending3, gatedCallId } = found, toolName2 = typeof pending3.toolName == "string" ? pending3.toolName : "", args = (gatedCallId !== void 0 ? argsByCall.get(gatedCallId) : void 0) ?? pending3.input ?? {};
+  let { pending: pending4, gatedCallId } = found, toolName2 = typeof pending4.toolName == "string" ? pending4.toolName : "", args = (gatedCallId !== void 0 ? argsByCall.get(gatedCallId) : void 0) ?? pending4.input ?? {};
   if (typeof args != "object" || args === null)
     return { kind: "failed", gatedCallId, reason: "gate has no tool input payload" };
-  let bridge3 = new HitlBridge(deps2.client, taskId), callKey = approvalCallKey(gatedCallId, taskId), ruleOffersReadOnly = readOfferSupply(pending3.ruleOffers, pending3.ruleSuggestions), durableProbeCause = pending3.riskDescriptor?.probeCause;
+  let bridge3 = new HitlBridge(deps2.client, taskId), callKey = approvalCallKey(gatedCallId, taskId), ruleOffersReadOnly = readOfferSupply(pending4.ruleOffers, pending4.ruleSuggestions), durableProbeCause = pending4.riskDescriptor?.probeCause;
   deps2.onPresented?.();
   let card = await surfaceApprovalCard({
     toolName: toolName2,
     args,
     callKey,
     ...signal ? { signal } : {},
-    ...pending3.governanceForced === !0 ? { governanceForced: !0 } : {},
+    ...pending4.governanceForced === !0 ? { governanceForced: !0 } : {},
     // S-30①(0.48.0):durable 行的 bidi 披露位随卡透传。**同一个病形的第 N 例** —— 这处「行 → 卡」
     // 重铸是闭形的,server ≥7.53 起行上就有的这一位在这里整键丢失([C170] 那次 ruleSuggestions /
     // governanceForced 逐字同一个坐标)。本批由 durable-card 门 ⑦ 段的**富行键集普查**当天抓出
     // (红文逐字:「无账:hasBidiControls」),不是人眼发现的。
     // 🔴 条件 stamp **只认严格 true**,与 governanceForced / inputHasBidi 同族:上游契约是
     //    「`true` 或缺席,恒不写 false/null」,这里认宽了就会把一个 falsy 值渲成披露。
-    ...pending3.hasBidiControls === !0 ? { hasBidiControls: !0 } : {},
+    ...pending4.hasBidiControls === !0 ? { hasBidiControls: !0 } : {},
     ...ruleOffersReadOnly !== void 0 ? { ruleOffersReadOnly } : {},
     ...isWireRecordCarrier(durableProbeCause) ? { probeCause: durableProbeCause } : {},
     // #348(0.44.0)durable 腿的对偶:行上**本来就存着**这个值(server `parked-decide.ts`;SDK
     // `PendingCheckpoint.toolCallId?: string | null` 直证)。与活卡帧腿同一个卡位、同一条缺席纪律 ——
     // `null`(SDK 声明的第二种缺席形)与空串一并降键缺席,绝不把 `null` 折成串。
-    ...typeof pending3.toolCallId == "string" && pending3.toolCallId !== "" ? { toolCallId: pending3.toolCallId } : {}
+    ...typeof pending4.toolCallId == "string" && pending4.toolCallId !== "" ? { toolCallId: pending4.toolCallId } : {}
   });
   switch (card.kind) {
     case "failed":
       return { kind: "failed", gatedCallId, reason: card.reason };
     case "aborted":
-      return observeCancelByDeny(bridge3.decideTool({ decision: "deny", reason: "Interrupted by user" }, gatedCallId, void 0, pending3), taskId), { kind: "aborted", gatedCallId };
+      return observeCancelByDeny(bridge3.decideTool({ decision: "deny", reason: "Interrupted by user" }, gatedCallId, void 0, pending4), taskId), { kind: "aborted", gatedCallId };
     case "allow":
       try {
         if (card.allowSession)
           try {
-            return await bridge3.decideTool({ decision: "approve", remember: "session", ...card.updatedInput !== void 0 ? { updatedInput: card.updatedInput } : {} }, gatedCallId, signal ? { signal } : void 0, pending3), { kind: "decided", gatedCallId };
+            return await bridge3.decideTool({ decision: "approve", remember: "session", ...card.updatedInput !== void 0 ? { updatedInput: card.updatedInput } : {} }, gatedCallId, signal ? { signal } : void 0, pending4), { kind: "decided", gatedCallId };
           } catch (e) {
             if (e instanceof HitlSafetyError || e instanceof DecideTransportRetryExhaustedError || readDecideCurrentPending(e) !== void 0)
               throw e;
             hostLog("debug", `liveToolApprovalWire: decide(approve+remember) failed (${String(e)}) \u2014 falling back to plain approve`);
           }
-        return await bridge3.decideTool({ decision: "approve", ...card.updatedInput !== void 0 ? { updatedInput: card.updatedInput } : {} }, gatedCallId, signal ? { signal } : void 0, pending3), { kind: "decided", gatedCallId };
+        return await bridge3.decideTool({ decision: "approve", ...card.updatedInput !== void 0 ? { updatedInput: card.updatedInput } : {} }, gatedCallId, signal ? { signal } : void 0, pending4), { kind: "decided", gatedCallId };
       } catch (e) {
         let currentPending = readDecideCurrentPending(e);
         return {
@@ -60713,7 +60745,7 @@ async function surfaceFsApprovalAndDecide(deps2, taskId, argsByCall, signal, par
       }
     case "deny":
       try {
-        return await bridge3.decideTool({ decision: "deny", reason: denyReasonForWire(card.reason, `task ${taskId}`) ?? DEFAULT_DENY_REASON }, gatedCallId, signal ? { signal } : void 0, pending3), { kind: "decided", gatedCallId, denied: !0 };
+        return await bridge3.decideTool({ decision: "deny", reason: denyReasonForWire(card.reason, `task ${taskId}`) ?? DEFAULT_DENY_REASON }, gatedCallId, signal ? { signal } : void 0, pending4), { kind: "decided", gatedCallId, denied: !0 };
       } catch (e) {
         let currentPending = readDecideCurrentPending(e);
         return {
@@ -61215,16 +61247,16 @@ async function routeToolApprovalFrame(ev, ctx) {
   return decision === "deny" && !fromSubagent && (gatedCallId !== void 0 ? led.markDenied(gatedCallId) : led.armDenyStamp()), { kind: "skip" };
 }
 function routeToolStart(ev, callId, led) {
-  return led.markStarted(callId) ? (isGatedToolName(ev.toolName) && (led.noteGatedStart(callId, ev), typeof ev.toolName == "string" && toolNameIsFsWrite(ev.toolName) && led.pushFsCall(callId), typeof ev.toolName == "string" && (toolNameIsFsWrite(ev.toolName) || toolNameIsShellExec(ev.toolName)) && led.noteFsOrShellGate(callId)), { kind: "yield", events: [ev] }) : { kind: "skip" };
+  return led.noteStart(callId, ev), led.markStarted(callId) ? (isGatedToolName(ev.toolName) && (led.noteGatedStart(callId, ev), typeof ev.toolName == "string" && toolNameIsFsWrite(ev.toolName) && led.pushFsCall(callId), typeof ev.toolName == "string" && (toolNameIsFsWrite(ev.toolName) || toolNameIsShellExec(ev.toolName)) && led.noteFsOrShellGate(callId)), { kind: "yield", events: [ev] }) : { kind: "skip" };
 }
 function routeToolEnd(ev, callId, led) {
   if (led.isEnded(callId))
-    return { kind: "skip" };
+    return led.dropStartArgs(callId), { kind: "skip" };
   led.dropFsCall(callId);
   for (let arm3 of TOOL_END_ARMS) {
     let action = arm3.run(ev, callId, led);
     if (action)
-      return action;
+      return led.dropStartArgs(callId), action;
   }
   throw new Error("frameRouter: tool_end \u6709\u5E8F\u81C2\u5168\u90E8\u843D\u7A7A \u2014\u2014 generic-close \u4E0D\u518D\u662F\u65E0\u6761\u4EF6\u515C\u5E95\u81C2");
 }
@@ -61269,8 +61301,11 @@ var HITL_REJECT_MESSAGE, HITL_INTERRUPT_MESSAGE_FOR_TOOL_USE, RUN_CANCELLED_ERRO
           if (ev.isError !== !0 || led.isDenied(callId))
             return;
           let verdict = classifierDenyFromToolEnd(ev);
-          if (verdict)
-            return led.markEnded(callId), led.dropHeld(callId), surfaceForCurrentSession()?.surfaceClassifierDeny(typeof ev.toolName == "string" ? ev.toolName : "tool", verdict), hostLog("debug", `liveHitlAskWire: classifier deny verdict on ${callId} (${String(ev.toolName)}) \u2014 labeled render + notice`), { kind: "yield", events: [{ ...ev, output: verdict.message, structured: void 0 }] };
+          if (!verdict)
+            return;
+          led.markEnded(callId), led.dropHeld(callId);
+          let startArgs = led.startArgs().get(callId);
+          return surfaceForCurrentSession()?.surfaceClassifierDeny(typeof ev.toolName == "string" ? ev.toolName : "tool", verdict, { toolCallId: callId, ...startArgs !== void 0 ? { args: startArgs } : {} }), hostLog("debug", `liveHitlAskWire: classifier deny verdict on ${callId} (${String(ev.toolName)}) \u2014 labeled render + notice`), { kind: "yield", events: [{ ...ev, output: verdict.message, structured: void 0 }] };
         }
       },
       {
@@ -61349,7 +61384,7 @@ var installed, init_editedRuleTextPrecheck = __esm({
 
 // node_modules/@sema-agent/client-core/dist/hitl/gateLedger.js
 function createGateLedger() {
-  let startedCalls = /* @__PURE__ */ new Set(), endedCalls = /* @__PURE__ */ new Set(), heldAskEnds = /* @__PURE__ */ new Map(), gatedStartArgsByCall = /* @__PURE__ */ new Map(), deniedCalls = /* @__PURE__ */ new Set(), pendingFsCalls = [], resolvedAnswers = /* @__PURE__ */ new Map(), decidedGates = /* @__PURE__ */ new Set(), alreadyResolvedKey, alreadyResolvedStreak = 0, fsOrShellFamilyGate = !1, droppedFromBatch = /* @__PURE__ */ new Set(), batchParkCount = 0, heldSinceLastPark = !1, fsOrShellGatedCalls = /* @__PURE__ */ new Set(), lastFsOrShellGatedCall, resolveGateSubjects = () => {
+  let startedCalls = /* @__PURE__ */ new Set(), endedCalls = /* @__PURE__ */ new Set(), heldAskEnds = /* @__PURE__ */ new Map(), gatedStartArgsByCall = /* @__PURE__ */ new Map(), startArgsByCall = /* @__PURE__ */ new Map(), deniedCalls = /* @__PURE__ */ new Set(), pendingFsCalls = [], resolvedAnswers = /* @__PURE__ */ new Map(), decidedGates = /* @__PURE__ */ new Set(), alreadyResolvedKey, alreadyResolvedStreak = 0, fsOrShellFamilyGate = !1, droppedFromBatch = /* @__PURE__ */ new Set(), batchParkCount = 0, heldSinceLastPark = !1, fsOrShellGatedCalls = /* @__PURE__ */ new Set(), lastFsOrShellGatedCall, resolveGateSubjects = () => {
     if (batchParkCount !== 1 || !fsOrShellFamilyGate)
       return;
     for (let id of heldAskEnds.keys())
@@ -61393,6 +61428,20 @@ function createGateLedger() {
     gatedStartArgs() {
       return gatedStartArgsByCall;
     },
+    noteStart(callId, ev) {
+      for (startArgsByCall.delete(callId), startArgsByCall.set(callId, ev.args); startArgsByCall.size > 256; ) {
+        let oldest = startArgsByCall.keys().next();
+        if (oldest.done === !0)
+          break;
+        startArgsByCall.delete(oldest.value);
+      }
+    },
+    startArgs() {
+      return startArgsByCall;
+    },
+    dropStartArgs(callId) {
+      startArgsByCall.delete(callId);
+    },
     isEnded(callId) {
       return endedCalls.has(callId);
     },
@@ -61543,9 +61592,9 @@ async function surfaceGateAndDecide(deps2, taskId, askArgsByCall, signal, parkGa
   );
   if (!found.ok)
     return { kind: "failed", reason: found.reason, ...found.code !== void 0 ? { code: found.code } : {} };
-  let { pending: pending3, gatedCallId } = found, fromArgs = gatedCallId ? askArgsByCall.get(gatedCallId)?.questions : void 0, fromPending = pending3.input?.questions, questions = Array.isArray(fromArgs) && fromArgs.length > 0 ? fromArgs : fromPending;
+  let { pending: pending4, gatedCallId } = found, fromArgs = gatedCallId ? askArgsByCall.get(gatedCallId)?.questions : void 0, fromPending = pending4.input?.questions, questions = Array.isArray(fromArgs) && fromArgs.length > 0 ? fromArgs : fromPending;
   if (!Array.isArray(questions) || questions.length === 0) {
-    let truncated = pending3.input?.truncated === !0;
+    let truncated = pending4.input?.truncated === !0;
     return {
       kind: "failed",
       gatedCallId,
@@ -61565,10 +61614,10 @@ async function surfaceGateAndDecide(deps2, taskId, askArgsByCall, signal, parkGa
     signal?.addEventListener("abort", onAbort, { once: !0 }), onPresented?.(), publishQuestionFrame({ type: "question", questionId, questions });
   }), bridge3 = new HitlBridge(deps2.client, taskId);
   if (answer === null)
-    return observeCancelByDeny(bridge3.decideTool({ decision: "deny", reason: "Interrupted by user" }, gatedCallId, void 0, pending3), taskId), { kind: "aborted", gatedCallId };
+    return observeCancelByDeny(bridge3.decideTool({ decision: "deny", reason: "Interrupted by user" }, gatedCallId, void 0, pending4), taskId), { kind: "aborted", gatedCallId };
   try {
     let entries = answer.answers ?? [];
-    return entries.some((a) => (a.selected?.length ?? 0) > 0 || (a.note?.length ?? 0) > 0) ? (await bridge3.answerQuestion(entries, gatedCallId, signal ? { signal } : void 0, pending3), { kind: "decided", gatedCallId, answered: toAnsweredOutput(questions, answer) }) : (await bridge3.decideTool({ decision: "deny", reason: "User declined to answer" }, gatedCallId, signal ? { signal } : void 0, pending3), { kind: "decided", gatedCallId });
+    return entries.some((a) => (a.selected?.length ?? 0) > 0 || (a.note?.length ?? 0) > 0) ? (await bridge3.answerQuestion(entries, gatedCallId, signal ? { signal } : void 0, pending4), { kind: "decided", gatedCallId, answered: toAnsweredOutput(questions, answer) }) : (await bridge3.decideTool({ decision: "deny", reason: "User declined to answer" }, gatedCallId, signal ? { signal } : void 0, pending4), { kind: "decided", gatedCallId });
   } catch (e) {
     let code2 = e instanceof HitlSafetyError && isGateFailureCode(e.code) ? e.code : void 0, currentPending = readDecideCurrentPending(e);
     return {
@@ -62146,8 +62195,8 @@ function pendingRowIsOwnedByThisSession(row2, deps2) {
   let sessionId = (deps2?.currentSessionId ?? (() => hostSessionFor(sessionKey)?.currentSessionId()))(), rowSessionId = typeof row2.sessionId == "string" ? row2.sessionId : "";
   return typeof sessionId == "string" && sessionId.length > 0 && rowSessionId.length > 0 && rowSessionId === sessionId;
 }
-function askQuestionsFromPending(pending3) {
-  let input = pending3.input;
+function askQuestionsFromPending(pending4) {
+  let input = pending4.input;
   if (typeof input != "object" || input === null)
     return null;
   let qs = input.questions;
@@ -62272,8 +62321,8 @@ var DECISION_NOTE_NOTICE_KEY, init_approvalDecisionNoteAudit = __esm({
 
 // node_modules/@sema-agent/client-core/dist/hitl/askParkRowRouting.js
 function classifyAskParkRows(rows2, taskId, deps2) {
-  let isOwned = deps2?.isOwned ?? ((row2) => pendingRowIsOwnedByThisSession(row2, deps2?.ownership)), own2 = rows2.find((r) => r.taskId === taskId), sole = rows2.length === 1 ? rows2[0] : void 0, soleUnowned = sole !== void 0 && !isOwned(sole), pending3 = own2 ?? (soleUnowned ? void 0 : sole);
-  if (pending3 === void 0)
+  let isOwned = deps2?.isOwned ?? ((row2) => pendingRowIsOwnedByThisSession(row2, deps2?.ownership)), own2 = rows2.find((r) => r.taskId === taskId), sole = rows2.length === 1 ? rows2[0] : void 0, soleUnowned = sole !== void 0 && !isOwned(sole), pending4 = own2 ?? (soleUnowned ? void 0 : sole);
+  if (pending4 === void 0)
     return {
       kind: "unborn",
       reason: rows2.length === 0 ? (
@@ -62282,11 +62331,11 @@ function classifyAskParkRows(rows2, taskId, deps2) {
         `no pending row at all for task ${taskId} \u2014 either an orphan park (a seat held with no decision outstanding) or the next gate's row is not minted yet`
       ) : soleUnowned ? `the only pending row (task ${String(sole?.taskId)} / session ${String(sole?.sessionId)}) could not be proven to belong to this client (not in its own-run ledger, session id absent or different) \u2014 refusing to surface an approval that may be another session's` : `${String(rows2.length)} pending rows but none for task ${taskId} \u2014 ambiguous queue, refusing to surface an unrelated row`
     };
-  let foreignKind = askParkForeignGateKind(pending3);
+  let foreignKind = askParkForeignGateKind(pending4);
   return foreignKind !== null ? {
     kind: "unborn",
-    reason: `the visible pending row (task ${String(pending3.taskId)}) is parked on a '${foreignKind}' gate \u2014 not an ask/approval gate; this arm will not surface or decide it, and it may also be the previous gate's row still visible during a transition`
-  } : { kind: "row", row: pending3 };
+    reason: `the visible pending row (task ${String(pending4.taskId)}) is parked on a '${foreignKind}' gate \u2014 not an ask/approval gate; this arm will not surface or decide it, and it may also be the previous gate's row still visible during a transition`
+  } : { kind: "row", row: pending4 };
 }
 function askParkRowGateKind(row2) {
   return typeof row2.gateKind == "string" && row2.gateKind.length > 0 ? row2.gateKind : null;
@@ -64553,6 +64602,7 @@ __export(dist_exports, {
   CHROME_EVENT_KINDS: () => CHROME_EVENT_KINDS,
   CLAIM_HELD_STATES: () => CLAIM_HELD_STATES,
   CLAIM_RELEASED_STATES: () => CLAIM_RELEASED_STATES,
+  CLASSIFIER_DENY_DISPLAY_MAX: () => CLASSIFIER_DENY_DISPLAY_MAX,
   CLASSIFIER_DENY_SIGNATURE: () => CLASSIFIER_DENY_SIGNATURE,
   CLIENT_VERBS: () => CLIENT_VERBS,
   CONFIG_DELEGATION_ENTRY_CAPS: () => CONFIG_DELEGATION_ENTRY_CAPS,
@@ -64843,6 +64893,7 @@ __export(dist_exports, {
   catalogCachePath: () => catalogCachePath,
   catalogShaUrlFor: () => catalogShaUrlFor,
   ccStopSemanticsFromVersion: () => ccStopSemanticsFromVersion,
+  classifierDenyDisplay: () => classifierDenyDisplay,
   classifierDenyFromToolEnd: () => classifierDenyFromToolEnd,
   classifierDenyNoticeText: () => classifierDenyNoticeText,
   classifyAskParkChainFailure: () => classifyAskParkChainFailure,
@@ -84167,6 +84218,22 @@ var cachedLayers, init_userSetting = __esm({
 });
 
 // build-src/src/sema/overrides/settings-187.ts
+var settings_187_exports = {};
+__export(settings_187_exports, {
+  semaAgentPushNotifEnabled: () => semaAgentPushNotifEnabled,
+  semaAutoCompactEnabled: () => semaAutoCompactEnabled,
+  semaEditorMode: () => semaEditorMode,
+  semaFileCheckpointingEnabled: () => semaFileCheckpointingEnabled,
+  semaInputNeededNotifEnabled: () => semaInputNeededNotifEnabled,
+  semaPreferredNotifChannel: () => semaPreferredNotifChannel,
+  semaRemoteControlAtStartup: () => semaRemoteControlAtStartup,
+  semaShowMessageTimestamps: () => semaShowMessageTimestamps,
+  semaShowTurnDuration: () => semaShowTurnDuration,
+  semaTerminalProgressBarEnabled: () => semaTerminalProgressBarEnabled,
+  semaUserSetting: () => semaUserSetting,
+  semaVerbose: () => semaVerbose,
+  writeMigratedUserSetting: () => writeMigratedUserSetting
+});
 function writeMigratedUserSetting(patch2) {
   let result = updateSettingsForSource(
     "userSettings",
@@ -84210,6 +84277,14 @@ function semaRemoteControlAtStartup() {
   let v2 = resolveUserSetting("remoteControlAtStartup");
   return typeof v2 == "boolean" ? v2 : void 0;
 }
+function semaInputNeededNotifEnabled() {
+  let v2 = resolveUserSetting("inputNeededNotifEnabled");
+  return typeof v2 == "boolean" ? v2 : void 0;
+}
+function semaAgentPushNotifEnabled() {
+  let v2 = resolveUserSetting("agentPushNotifEnabled");
+  return typeof v2 == "boolean" ? v2 : void 0;
+}
 function semaPreferredNotifChannel() {
   let v2 = resolveUserSetting("preferredNotifChannel");
   return typeof v2 == "string" && NOTIF_CHANNELS.has(v2) ? v2 : void 0;
@@ -88371,13 +88446,13 @@ function chordExactlyMatches(chord, binding) {
   }
   return !0;
 }
-function resolveKeyWithChordState(input, key, activeContexts, bindings, pending3) {
-  if (key.escape && pending3 !== null)
+function resolveKeyWithChordState(input, key, activeContexts, bindings, pending4) {
+  if (key.escape && pending4 !== null)
     return { type: "chord_cancelled" };
   let currentKeystroke = buildKeystroke(input, key);
   if (!currentKeystroke)
-    return pending3 !== null ? { type: "chord_cancelled" } : { type: "none" };
-  let testChord = pending3 ? [...pending3, currentKeystroke] : [currentKeystroke], ctxSet = new Set(activeContexts), contextBindings = bindings.filter((b3) => ctxSet.has(b3.context)), chordWinners = /* @__PURE__ */ new Map();
+    return pending4 !== null ? { type: "chord_cancelled" } : { type: "none" };
+  let testChord = pending4 ? [...pending4, currentKeystroke] : [currentKeystroke], ctxSet = new Set(activeContexts), contextBindings = bindings.filter((b3) => ctxSet.has(b3.context)), chordWinners = /* @__PURE__ */ new Map();
   for (let binding of contextBindings)
     binding.chord.length > testChord.length && chordPrefixMatches(testChord, binding) && chordWinners.set(chordToString(binding.chord), binding.action);
   let hasLongerChords = !1;
@@ -88391,7 +88466,7 @@ function resolveKeyWithChordState(input, key, activeContexts, bindings, pending3
   let exactMatch;
   for (let binding of contextBindings)
     chordExactlyMatches(testChord, binding) && (exactMatch = binding);
-  return exactMatch ? exactMatch.action === null ? { type: "unbound" } : { type: "match", action: exactMatch.action } : pending3 !== null ? { type: "chord_cancelled" } : { type: "none" };
+  return exactMatch ? exactMatch.action === null ? { type: "unbound" } : { type: "match", action: exactMatch.action } : pending4 !== null ? { type: "chord_cancelled" } : { type: "none" };
 }
 var init_resolver = __esm({
   "build-src/src/keybindings/resolver.ts"() {
@@ -90432,8 +90507,8 @@ Error generating stack: ` + x3.message + `
           concurrentQueues[i++] = null;
           var lane = concurrentQueues[i];
           if (concurrentQueues[i++] = null, queue3 !== null && update2 !== null) {
-            var pending3 = queue3.pending;
-            pending3 === null ? update2.next = update2 : (update2.next = pending3.next, pending3.next = update2), queue3.pending = update2;
+            var pending4 = queue3.pending;
+            pending4 === null ? update2.next = update2 : (update2.next = pending4.next, pending4.next = update2), queue3.pending = update2;
           }
           lane !== 0 && markUpdateLaneFromFiberToRoot(fiber, update2, lane);
         }
@@ -90487,8 +90562,8 @@ Error generating stack: ` + x3.message + `
         var updateQueue = fiber.updateQueue;
         if (updateQueue === null) return null;
         if (updateQueue = updateQueue.shared, (executionContext & 2) !== 0) {
-          var pending3 = updateQueue.pending;
-          return pending3 === null ? update2.next = update2 : (update2.next = pending3.next, pending3.next = update2), updateQueue.pending = update2, update2 = getRootForUpdatedFiber(fiber), markUpdateLaneFromFiberToRoot(fiber, null, lane), update2;
+          var pending4 = updateQueue.pending;
+          return pending4 === null ? update2.next = update2 : (update2.next = pending4.next, pending4.next = update2), updateQueue.pending = update2, update2 = getRootForUpdatedFiber(fiber), markUpdateLaneFromFiberToRoot(fiber, null, lane), update2;
         }
         return enqueueUpdate$1(fiber, updateQueue, update2, lane), getRootForUpdatedFiber(fiber);
       }
@@ -91368,8 +91443,8 @@ Error generating stack: ` + x3.message + `
       }
       function enqueueRenderPhaseUpdate(queue3, update2) {
         didScheduleRenderPhaseUpdateDuringThisPass = didScheduleRenderPhaseUpdate = !0;
-        var pending3 = queue3.pending;
-        pending3 === null ? update2.next = update2 : (update2.next = pending3.next, pending3.next = update2), queue3.pending = update2;
+        var pending4 = queue3.pending;
+        pending4 === null ? update2.next = update2 : (update2.next = pending4.next, pending4.next = update2), queue3.pending = update2;
       }
       function entangleTransitionUpdate(root2, queue3, lane) {
         if ((lane & 4194048) !== 0) {
@@ -98823,8 +98898,8 @@ It can also happen if the client has a browser extension installed which messes
           concurrentQueues[i++] = null;
           var lane = concurrentQueues[i];
           if (concurrentQueues[i++] = null, queue3 !== null && update2 !== null) {
-            var pending3 = queue3.pending;
-            pending3 === null ? update2.next = update2 : (update2.next = pending3.next, pending3.next = update2), queue3.pending = update2;
+            var pending4 = queue3.pending;
+            pending4 === null ? update2.next = update2 : (update2.next = pending4.next, pending4.next = update2), queue3.pending = update2;
           }
           lane !== 0 && markUpdateLaneFromFiberToRoot(fiber, update2, lane);
         }
@@ -100162,8 +100237,8 @@ Incoming: %s`,
       }
       function enqueueRenderPhaseUpdate(queue3, update2) {
         didScheduleRenderPhaseUpdateDuringThisPass = didScheduleRenderPhaseUpdate = !0;
-        var pending3 = queue3.pending;
-        pending3 === null ? update2.next = update2 : (update2.next = pending3.next, pending3.next = update2), queue3.pending = update2;
+        var pending4 = queue3.pending;
+        pending4 === null ? update2.next = update2 : (update2.next = pending4.next, pending4.next = update2), queue3.pending = update2;
       }
       function entangleTransitionUpdate(root2, queue3, lane) {
         if ((lane & 4194048) !== 0) {
@@ -114598,8 +114673,8 @@ function consumeFollowScroll() {
   let f = followScroll;
   return followScroll = null, f;
 }
-function drainAdaptive(node, pending3, innerHeight) {
-  let sign = pending3 > 0 ? 1 : -1, abs = Math.abs(pending3), applied = 0;
+function drainAdaptive(node, pending4, innerHeight) {
+  let sign = pending4 > 0 ? 1 : -1, abs = Math.abs(pending4), applied = 0;
   abs > SCROLL_MAX_PENDING && (applied += sign * (abs - SCROLL_MAX_PENDING), abs = SCROLL_MAX_PENDING);
   let step = abs <= SCROLL_INSTANT_THRESHOLD ? abs : abs < SCROLL_HIGH_PENDING ? SCROLL_STEP_MED : SCROLL_STEP_HIGH;
   applied += sign * step;
@@ -114610,12 +114685,12 @@ function drainAdaptive(node, pending3, innerHeight) {
   }
   return node.pendingScrollDelta = rem > 0 ? sign * rem : void 0, applied;
 }
-function drainProportional(node, pending3, innerHeight) {
-  let abs = Math.abs(pending3), cap2 = Math.max(1, innerHeight - 1), step = Math.min(cap2, Math.max(SCROLL_MIN_PER_FRAME, abs * 3 >> 2));
+function drainProportional(node, pending4, innerHeight) {
+  let abs = Math.abs(pending4), cap2 = Math.max(1, innerHeight - 1), step = Math.min(cap2, Math.max(SCROLL_MIN_PER_FRAME, abs * 3 >> 2));
   if (abs <= step)
-    return node.pendingScrollDelta = void 0, pending3;
-  let applied = pending3 > 0 ? step : -step;
-  return node.pendingScrollDelta = pending3 - applied, applied;
+    return node.pendingScrollDelta = void 0, pending4;
+  let applied = pending4 > 0 ? step : -step;
+  return node.pendingScrollDelta = pending4 - applied, applied;
 }
 function wrapWithOsc8Link(text2, url3) {
   return `${OSC2}8;;${url3}${BEL2}${text2}${OSC2}8;;${BEL2}`;
@@ -114846,11 +114921,11 @@ function renderNodeToOutput(node, output, {
             viewportBottom: vpTop + innerHeight - 1
           };
         }
-        let cur = node.scrollTop ?? 0, pending3 = node.pendingScrollDelta, cMin = node.scrollClampMin, cMax = node.scrollClampMax, haveClamp = cMin !== void 0 && cMax !== void 0;
-        if (pending3 !== void 0 && pending3 !== 0) {
-          let eff = haveClamp && (pending3 < 0 && cur < cMin || pending3 > 0 && cur > cMax) ? Math.min(4, innerHeight >> 3) : innerHeight;
-          cur += isXtermJsHost() ? drainAdaptive(node, pending3, eff) : drainProportional(node, pending3, eff);
-        } else pending3 === 0 && (node.pendingScrollDelta = void 0);
+        let cur = node.scrollTop ?? 0, pending4 = node.pendingScrollDelta, cMin = node.scrollClampMin, cMax = node.scrollClampMax, haveClamp = cMin !== void 0 && cMax !== void 0;
+        if (pending4 !== void 0 && pending4 !== 0) {
+          let eff = haveClamp && (pending4 < 0 && cur < cMin || pending4 > 0 && cur > cMax) ? Math.min(4, innerHeight >> 3) : innerHeight;
+          cur += isXtermJsHost() ? drainAdaptive(node, pending4, eff) : drainProportional(node, pending4, eff);
+        } else pending4 === 0 && (node.pendingScrollDelta = void 0);
         let scrollTop = Math.max(0, Math.min(cur, maxScroll)), clamped = haveClamp ? Math.max(cMin, Math.min(scrollTop, cMax)) : scrollTop;
         if (node.scrollTop = scrollTop, scrollTop !== cur && (node.pendingScrollDelta = void 0), node.pendingScrollDelta !== void 0 && (scrollDrainNode = node), scrollTop = clamped, content && contentYoga) {
           let contentX = x3 + contentYoga.getComputedLeft(), contentY = y2 + contentYoga.getComputedTop() - scrollTop, contentCached = nodeCache.get(content), hint = null;
@@ -127850,8 +127925,8 @@ var require_pool_base = __commonJS({
       }
       get [kPending]() {
         let ret = this[kQueued];
-        for (let { [kPending]: pending3 } of this[kClients])
-          ret += pending3;
+        for (let { [kPending]: pending4 } of this[kClients])
+          ret += pending4;
         return ret;
       }
       get [kRunning]() {
@@ -131068,17 +131143,17 @@ var require_mock_agent = __commonJS({
       }
       pendingInterceptors() {
         let mockAgentClients = this[kClients];
-        return Array.from(mockAgentClients.entries()).flatMap(([origin2, dispatcher2]) => dispatcher2[kDispatches].map((dispatch) => ({ ...dispatch, origin: origin2 }))).filter(({ pending: pending3 }) => pending3);
+        return Array.from(mockAgentClients.entries()).flatMap(([origin2, dispatcher2]) => dispatcher2[kDispatches].map((dispatch) => ({ ...dispatch, origin: origin2 }))).filter(({ pending: pending4 }) => pending4);
       }
       assertNoPendingInterceptors({ pendingInterceptorsFormatter = new PendingInterceptorsFormatter() } = {}) {
-        let pending3 = this.pendingInterceptors();
-        if (pending3.length !== 0)
+        let pending4 = this.pendingInterceptors();
+        if (pending4.length !== 0)
           throw new UndiciError(
-            pending3.length === 1 ? `1 interceptor is pending:
+            pending4.length === 1 ? `1 interceptor is pending:
 
-${pendingInterceptorsFormatter.format(pending3)}`.trim() : `${pending3.length} interceptors are pending:
+${pendingInterceptorsFormatter.format(pending4)}`.trim() : `${pending4.length} interceptors are pending:
 
-${pendingInterceptorsFormatter.format(pending3)}`.trim()
+${pendingInterceptorsFormatter.format(pending4)}`.trim()
           );
       }
     };
@@ -140533,10 +140608,21 @@ var import_react25, current, listeners4, init_retryStatusStore = __esm({
 
 // build-src/src/sema/transcriptSystemNotice.ts
 function registerTranscriptSystemNoticeSink(fn2) {
-  return sink = fn2, () => {
+  if (sink = fn2, pending.length > 0) {
+    let batch = pending.splice(0, pending.length);
+    for (let text2 of batch)
+      try {
+        fn2(text2);
+      } catch {
+      }
+  }
+  return () => {
     sink === fn2 && (sink = null);
   };
 }
+function queueTranscriptSystemNotice(text2) {
+  return surfaceTranscriptSystemNotice(text2) ? !0 : (pending.length >= PENDING_MAX && pending.shift(), pending.push(text2), !1);
+}
 function surfaceTranscriptSystemNotice(text2) {
   if (sink === null) return !1;
   try {
@@ -140561,9 +140647,9 @@ function surfaceTranscriptMessage(message) {
     return !1;
   }
 }
-var sink, messageSink, init_transcriptSystemNotice = __esm({
+var sink, PENDING_MAX, pending, messageSink, init_transcriptSystemNotice = __esm({
   "build-src/src/sema/transcriptSystemNotice.ts"() {
-    sink = null;
+    sink = null, PENDING_MAX = 16, pending = [];
     messageSink = null;
   }
 });
@@ -142718,8 +142804,8 @@ async function invalidateOAuthCacheIfDiskChanged() {
   }
 }
 function handleOAuth401Error(failedAccessToken) {
-  let pending3 = pending401Handlers.get(failedAccessToken);
-  if (pending3) return pending3;
+  let pending4 = pending401Handlers.get(failedAccessToken);
+  if (pending4) return pending4;
   let promise2 = handleOAuth401ErrorImpl(failedAccessToken).finally(() => {
     pending401Handlers.delete(failedAccessToken);
   });
@@ -179363,8 +179449,8 @@ var inputSchema, outputSchema, cachedDeferredToolNames, getToolDescriptionMemoiz
         let { query: query2, max_results = 5 } = input, deferredTools = tools.filter(isDeferredTool);
         maybeInvalidateCache(deferredTools);
         function getPendingServerNames() {
-          let pending3 = getAppState().mcp.clients.filter((c2) => c2.type === "pending");
-          return pending3.length > 0 ? pending3.map((s) => s.name) : void 0;
+          let pending4 = getAppState().mcp.clients.filter((c2) => c2.type === "pending");
+          return pending4.length > 0 ? pending4.map((s) => s.name) : void 0;
         }
         function logSearchOutcome(matches3, queryType) {
           matches3.length, deferredTools.length, matches3.length > 0;
@@ -261138,10 +261224,10 @@ function useExitOnCtrlCD(useKeybindingsHook, onInterrupt, onExit2, isActive2 = !
     pending: !1,
     keyName: null
   }), exitFn = (0, import_react40.useMemo)(() => onExit2 ?? exit3, [onExit2, exit3]), handleCtrlCDoublePress = useDoublePress(
-    (pending3) => setExitState({ pending: pending3, keyName: "Ctrl-C" }),
+    (pending4) => setExitState({ pending: pending4, keyName: "Ctrl-C" }),
     exitFn
   ), handleCtrlDDoublePress = useDoublePress(
-    (pending3) => setExitState({ pending: pending3, keyName: "Ctrl-D" }),
+    (pending4) => setExitState({ pending: pending4, keyName: "Ctrl-D" }),
     exitFn
   ), handleInterrupt = (0, import_react40.useCallback)(() => {
     onInterrupt?.() || handleCtrlCDoublePress();
@@ -283828,7 +283914,7 @@ function FileEditToolUseRejectedMessage(t0) {
 }
 var import_compiler_runtime43, import_jsx_runtime53, MAX_LINES_TO_RENDER, init_FileEditToolUseRejectedMessage = __esm({
   "build-src/src/components/FileEditToolUseRejectedMessage.tsx"() {
-    import_compiler_runtime43 = __toESM(require_compiler_runtime(), 1);
+    import_compiler_runtime43 = __toESM(require_compiler_runtime());
     init_useTerminalSize();
     init_cwd();
     init_ink2();
@@ -283836,7 +283922,7 @@ var import_compiler_runtime43, import_jsx_runtime53, MAX_LINES_TO_RENDER, init_F
     init_MessageResponse();
     init_StructuredDiffList();
     init_stringUtils();
-    import_jsx_runtime53 = __toESM(require_jsx_runtime(), 1), MAX_LINES_TO_RENDER = 10;
+    import_jsx_runtime53 = __toESM(require_jsx_runtime()), MAX_LINES_TO_RENDER = 10;
   }
 });
 
@@ -289889,8 +289975,8 @@ function bindSessionPersistencePaths() {
     setLiveSessionMapPath(mapPath, getSessionId());
     let engineSid = restoreLiveSessionId();
     try {
-      let marker = mapPath.replace(/\.session-map\.json$/, IMPORT_SEED_MARKER_SUFFIX), pending3 = !engineSid && marker !== mapPath && existsSync20(marker);
-      setSeamHistorySeedPending(pending3), pending3 && logForDebugging(`sessionPersistenceWire: import-seed marker found (${marker}) + no engine continuity \u2192 history seed armed`);
+      let marker = mapPath.replace(/\.session-map\.json$/, IMPORT_SEED_MARKER_SUFFIX), pending4 = !engineSid && marker !== mapPath && existsSync20(marker);
+      setSeamHistorySeedPending(pending4), pending4 && logForDebugging(`sessionPersistenceWire: import-seed marker found (${marker}) + no engine continuity \u2192 history seed armed`);
     } catch (err8) {
       setSeamHistorySeedPending(!1), logForDebugging(`sessionPersistenceWire: import-seed arm check failed: ${err8}`);
     }
@@ -289972,9 +290058,9 @@ async function reconcileResumeJournal(probe3, cancelRun, runningArm) {
       sessionId: runningArm?.shellSessionId?.() ?? getSessionId()
     };
     if (resumeRunningArmAwaitsUser(deps2)) {
-      let pending3 = runResumeRunningArm(req, deps2);
-      return pending3.catch(() => {
-      }), { decision, recovery: "left_running_choice", runningArm: pending3 };
+      let pending4 = runResumeRunningArm(req, deps2);
+      return pending4.catch(() => {
+      }), { decision, recovery: "left_running_choice", runningArm: pending4 };
     }
     let armed3 = await runResumeRunningArm(req, deps2);
     return { decision, recovery: "left_running_no_ui", runningArm: Promise.resolve(armed3) };
@@ -290322,8 +290408,8 @@ async function driveLateDurableDecide(o) {
   if (client3 === null) return "unavailable";
   let rows2;
   try {
-    let pending3 = (await client3.approvals.list()).pending;
-    rows2 = Array.isArray(pending3) ? pending3 : [];
+    let pending4 = (await client3.approvals.list()).pending;
+    rows2 = Array.isArray(pending4) ? pending4 : [];
   } catch (e) {
     return process.env.SEMA_DEBUG && semaDebugLine(`[sema][askParkExpiry] late decide: approvals.list failed (${String(e)}) \u2014 falling back to the live respond leg`), "unavailable";
   }
@@ -290364,7 +290450,7 @@ function classifyLateDecideOutcome(reply) {
   let e = reply.error;
   if (typeof e != "object" || e === null) return { kind: "unknown" };
   let status3 = e.status, code2 = e.errorCode;
-  return typeof code2 == "string" && REAPED_CODES.includes(code2) ? { kind: "expired-reaped" } : typeof code2 == "string" && SETTLED_ELSEWHERE_CODES.includes(code2) ? { kind: "settled-elsewhere" } : status3 === 404 || status3 === 410 ? { kind: "settled-elsewhere" } : { kind: "unknown" };
+  return typeof code2 == "string" && REAPED_CODES.includes(code2) ? { kind: "expired-reaped" } : typeof code2 == "string" && SETTLED_ELSEWHERE_CODES.includes(code2) ? { kind: "settled-elsewhere" } : status3 === 404 || status3 === 410 || typeof code2 == "string" && code2.startsWith("not_found.") ? { kind: "settled-elsewhere", probeWorthy: !0 } : { kind: "unknown" };
 }
 function readTaskId(body) {
   if (typeof body != "object" || body === null) return;
@@ -290419,7 +290505,14 @@ function surfaceLateRespondOutcome(approvalId, ack) {
 function withParkDecideOutcome(client3, opts) {
   let approvalsHost = client3.approvals;
   if (typeof approvalsHost != "object" || approvalsHost === null || typeof approvalsHost.decide != "function") return client3;
-  let spoken = !1, sawInconclusive = !1, say = (outcome, verb) => {
+  let spoken = !1, sawInconclusive = !1, withReapedProbe = async (outcome) => {
+    if (outcome.kind !== "settled-elsewhere" || outcome.probeWorthy !== !0 || opts?.reapedProbe === void 0) return outcome;
+    try {
+      if (await opts.reapedProbe() === !0) return { kind: "expired-reaped" };
+    } catch {
+    }
+    return outcome;
+  }, say = (outcome, verb) => {
     if (outcome.kind === "unknown") {
       sawInconclusive = !0;
       return;
@@ -290449,8 +290542,8 @@ function withParkDecideOutcome(client3, opts) {
         }
         return typeof out6?.then != "function" ? (say(classifyLateDecideOutcome({ ok: !0, body: out6 }), verb), out6) : out6.then(
           (body) => (say(classifyLateDecideOutcome({ ok: !0, body }), verb), body),
-          (e) => {
-            throw say(classifyLateDecideOutcome({ ok: !1, error: e }), verb), e;
+          async (e) => {
+            throw say(await withReapedProbe(classifyLateDecideOutcome({ ok: !1, error: e })), verb), e;
           }
         );
       };
@@ -290505,6 +290598,22 @@ var liveApprovalCards, init_liveApprovalCardHandles = __esm({
   }
 });
 
+// build-src/src/sema/runReapedProbe.ts
+async function runReapedByDeadline(client3, taskId) {
+  let runs = client3?.runs;
+  if (typeof runs?.get != "function") return !1;
+  try {
+    return (await runs.get(taskId))?.errorCode === REAPED_CODE;
+  } catch {
+    return !1;
+  }
+}
+var REAPED_CODE, init_runReapedProbe = __esm({
+  "build-src/src/sema/runReapedProbe.ts"() {
+    REAPED_CODE = "approval.expired";
+  }
+});
+
 // build-src/src/sema/decideRetry.ts
 function retryDelayMs() {
   return delayOverrideMs ?? DECIDE_RETRY_DELAY_MS;
@@ -290664,13 +290773,13 @@ function rowArmSingleFlight() {
   let epoch = getLiveSessionEpoch();
   return (rowArmFlight === null || epoch !== rowArmFlightEpoch) && (rowArmFlightEpoch = epoch, rowArmFlight = createRowArmSingleFlight()), rowArmFlight;
 }
-function armPendingRowCoalesced(flight, taskId, pending3, client3, opts) {
-  let identity3 = askParkRowIdentity(taskId, pending3);
+function armPendingRowCoalesced(flight, taskId, pending4, client3, opts) {
+  let identity3 = askParkRowIdentity(taskId, pending4);
   return flight.size() > 0 && process.env.SEMA_DEBUG && semaDebugLine(
     `[sema][askParkReopen] row-arm single flight holds ${String(flight.size())} in-flight chain(s); a card for row ${identity3.armedKey} that is already being presented will be joined instead of minting a second one (requested by task ${taskId})`
-  ), flight.join(identity3.armedKey, () => armPendingRow(taskId, pending3, client3, identity3, opts));
+  ), flight.join(identity3.armedKey, () => armPendingRow(taskId, pending4, client3, identity3, opts));
 }
-async function armPendingRow(taskId, pending3, client3, identity3, opts) {
+async function armPendingRow(taskId, pending4, client3, identity3, opts) {
   try {
     let { rowTaskId, gatedCallId, armedKey } = identity3, circuitKey = gatedCallId ?? "";
     if (decideCircuitOpen(circuitKey))
@@ -290733,11 +290842,11 @@ async function armPendingRow(taskId, pending3, client3, identity3, opts) {
       }).then(() => {
         startReopen();
       });
-    }, askQuestions = askQuestionsFromPending(pending3), questionGate = askParkRowArm(pending3) === "question";
+    }, askQuestions = askQuestionsFromPending(pending4), questionGate = askParkRowArm(pending4) === "question";
     if (process.env.SEMA_DEBUG) {
-      let rowGateKind = typeof pending3.gateKind == "string" && pending3.gateKind.length > 0 ? pending3.gateKind : null;
+      let rowGateKind = typeof pending4.gateKind == "string" && pending4.gateKind.length > 0 ? pending4.gateKind : null;
       semaDebugLine(
-        `[sema][askParkReopen] routing row (task ${rowTaskId} \xB7 gateKind ${rowGateKind ?? "null"} \xB7 toolName ${String(pending3.toolName ?? "null")} \xB7 callId ${String(gatedCallId ?? "null")}) \u21D2 ${questionGate ? "question" : "tool-gate"} arm`
+        `[sema][askParkReopen] routing row (task ${rowTaskId} \xB7 gateKind ${rowGateKind ?? "null"} \xB7 toolName ${String(pending4.toolName ?? "null")} \xB7 callId ${String(gatedCallId ?? "null")}) \u21D2 ${questionGate ? "question" : "tool-gate"} arm`
       );
     }
     if (questionGate) {
@@ -290778,17 +290887,19 @@ async function armPendingRow(taskId, pending3, client3, identity3, opts) {
               retractApprovalCard(armedKey, cause);
             },
             // L-83:question 卡一定是人答的;「late」只对窗真关过的卡说。
-            late: () => approvalCardWindowClosed(armedKey)
+            late: () => approvalCardWindowClosed(armedKey),
+            // L-81:decide 404 族 ⇒ 读 run 终态定「真被收割」。
+            reapedProbe: () => runReapedByDeadline(client3, rowTaskId)
           }
         ), deliver = async () => {
           roundOutcome2 = "failed-round";
           try {
             let bridge3 = new HitlBridge(forensicClient, rowTaskId), entries = answer.answers ?? [];
-            return entries.some((a) => (a.selected?.length ?? 0) > 0 || (a.note?.length ?? 0) > 0) ? await bridge3.answerQuestion(entries, gatedCallId, void 0, pending3) : await bridge3.decideTool(
+            return entries.some((a) => (a.selected?.length ?? 0) > 0 || (a.note?.length ?? 0) > 0) ? await bridge3.answerQuestion(entries, gatedCallId, void 0, pending4) : await bridge3.decideTool(
               { decision: "deny", reason: "question dismissed without an answer" },
               gatedCallId,
               void 0,
-              pending3
+              pending4
             ), { ok: !0 };
           } catch (e) {
             if (!await rowStillPending())
@@ -290829,7 +290940,7 @@ async function armPendingRow(taskId, pending3, client3, identity3, opts) {
       return process.env.SEMA_DEBUG && semaDebugLine(
         `[sema][askParkReopen] tool-gate arm for task ${rowTaskId} has no approval card port installed (headless / print lane, or the host never called installApprovalCardPort) \u2014 reporting reopened:false`
       ), { kind: "verdict", verdict: { reopened: !1 } };
-    let rowDeadline = parkRowDeadlineState(pending3, Date.now());
+    let rowDeadline = parkRowDeadlineState(pending4, Date.now());
     registerParkRowCard(armedKey, rowDeadline.kind === "none" ? void 0 : rowDeadline.deadlineMs);
     let cardPresented = !1, unsubscribeArm = onGateArmed((key) => {
       key === armedKey && (cardPresented = !0);
@@ -290852,7 +290963,9 @@ async function armPendingRow(taskId, pending3, client3, identity3, opts) {
           retractApprovalCard(armedKey, cause);
         },
         presented: () => cardPresented,
-        late: () => approvalCardWindowClosed(armedKey)
+        late: () => approvalCardWindowClosed(armedKey),
+        // L-81:decide 404 族 ⇒ 读 run 终态定「真被收割」。
+        reapedProbe: () => runReapedByDeadline(client3, rowTaskId)
       }
     ), runToolChain = async () => {
       roundOutcome = "failed-round";
@@ -290923,6 +291036,7 @@ var reopenSeq, ownershipDeps, inFlightReopenByTask, rowWaitOverrideMs, rowPollOv
     init_decideForensics();
     init_askParkExpiry();
     init_liveApprovalCardHandles();
+    init_runReapedProbe();
     init_decideRetry();
     init_failOpen();
     reopenSeq = 0, ownershipDeps = {
@@ -291912,8 +292026,8 @@ async function stopEngineSideAgentRow(taskId) {
   }
 }
 function killAllRunningAgentTasks(tasks3, setAppState, hooks2) {
-  let pending3 = 0, loopDone = !1, batchFired = !1, maybeSettleBatch = () => {
-    batchFired || !loopDone || pending3 > 0 || (batchFired = !0, hooks2?.onBatchSettled?.());
+  let pending4 = 0, loopDone = !1, batchFired = !1, maybeSettleBatch = () => {
+    batchFired || !loopDone || pending4 > 0 || (batchFired = !0, hooks2?.onBatchSettled?.());
   }, flip2 = (taskId) => {
     hooks2?.beforeKill?.(taskId), killAsyncAgent(taskId, setAppState), hooks2?.onRowSettled?.(taskId, { stopped: !0 });
   };
@@ -291923,9 +292037,9 @@ function killAllRunningAgentTasks(tasks3, setAppState, hooks2) {
         flip2(taskId);
         continue;
       }
-      pending3++, (async () => {
+      pending4++, (async () => {
         let outcome = await stopEngineSideAgentRow(taskId);
-        outcome.stopped ? flip2(taskId) : hooks2?.onRowSettled?.(taskId, outcome), pending3--, maybeSettleBatch();
+        outcome.stopped ? flip2(taskId) : hooks2?.onRowSettled?.(taskId, outcome), pending4--, maybeSettleBatch();
       })();
     }
   loopDone = !0, maybeSettleBatch();
@@ -293085,17 +293199,17 @@ function startLLMRequestPerfettoSpan(args) {
 }
 function endLLMRequestPerfettoSpan(spanId, metadata2) {
   if (!isEnabled || !spanId) return;
-  let pending3 = pendingSpans.get(spanId);
-  if (!pending3) return;
-  let endTime = getTimestamp2(), duration3 = endTime - pending3.startTime, promptTokens = metadata2.promptTokens ?? pending3.args.prompt_tokens, ttftMs = metadata2.ttftMs, ttltMs = metadata2.ttltMs, outputTokens = metadata2.outputTokens, cacheReadTokens = metadata2.cacheReadTokens, itps = ttftMs !== void 0 && promptTokens !== void 0 && ttftMs > 0 ? Math.round(promptTokens / (ttftMs / 1e3) * 100) / 100 : void 0, samplingMs = ttltMs !== void 0 && ttftMs !== void 0 ? ttltMs - ttftMs : void 0, otps = samplingMs !== void 0 && outputTokens !== void 0 && samplingMs > 0 ? Math.round(outputTokens / (samplingMs / 1e3) * 100) / 100 : void 0, cacheHitRate = cacheReadTokens !== void 0 && promptTokens !== void 0 && promptTokens > 0 ? Math.round(cacheReadTokens / promptTokens * 1e4) / 100 : void 0, requestSetupMs = metadata2.requestSetupMs, attemptStartTimes = metadata2.attemptStartTimes, args = {
-    ...pending3.args,
+  let pending4 = pendingSpans.get(spanId);
+  if (!pending4) return;
+  let endTime = getTimestamp2(), duration3 = endTime - pending4.startTime, promptTokens = metadata2.promptTokens ?? pending4.args.prompt_tokens, ttftMs = metadata2.ttftMs, ttltMs = metadata2.ttltMs, outputTokens = metadata2.outputTokens, cacheReadTokens = metadata2.cacheReadTokens, itps = ttftMs !== void 0 && promptTokens !== void 0 && ttftMs > 0 ? Math.round(promptTokens / (ttftMs / 1e3) * 100) / 100 : void 0, samplingMs = ttltMs !== void 0 && ttftMs !== void 0 ? ttltMs - ttftMs : void 0, otps = samplingMs !== void 0 && outputTokens !== void 0 && samplingMs > 0 ? Math.round(outputTokens / (samplingMs / 1e3) * 100) / 100 : void 0, cacheHitRate = cacheReadTokens !== void 0 && promptTokens !== void 0 && promptTokens > 0 ? Math.round(cacheReadTokens / promptTokens * 1e4) / 100 : void 0, requestSetupMs = metadata2.requestSetupMs, attemptStartTimes = metadata2.attemptStartTimes, args = {
+    ...pending4.args,
     ttft_ms: ttftMs,
     ttlt_ms: ttltMs,
     prompt_tokens: promptTokens,
     output_tokens: outputTokens,
     cache_read_tokens: cacheReadTokens,
     cache_creation_tokens: metadata2.cacheCreationTokens,
-    message_id: metadata2.messageId ?? pending3.args.message_id,
+    message_id: metadata2.messageId ?? pending4.args.message_id,
     success: metadata2.success ?? !0,
     error: metadata2.error,
     duration_ms: duration3 / 1e3,
@@ -293106,14 +293220,14 @@ function endLLMRequestPerfettoSpan(spanId, metadata2) {
     cache_hit_rate_pct: cacheHitRate
   }, setupUs = requestSetupMs !== void 0 && requestSetupMs > 0 ? requestSetupMs * 1e3 : 0;
   if (setupUs > 0) {
-    let setupEndTs = pending3.startTime + setupUs;
+    let setupEndTs = pending4.startTime + setupUs;
     if (events2.push({
       name: "Request Setup",
       cat: "api,setup",
       ph: "B",
-      ts: pending3.startTime,
-      pid: pending3.agentInfo.processId,
-      tid: pending3.agentInfo.threadId,
+      ts: pending4.startTime,
+      pid: pending4.agentInfo.processId,
+      tid: pending4.agentInfo.threadId,
       args: {
         request_setup_ms: requestSetupMs,
         attempt_count: attemptStartTimes?.length ?? 1
@@ -293121,22 +293235,22 @@ function endLLMRequestPerfettoSpan(spanId, metadata2) {
     }), attemptStartTimes && attemptStartTimes.length > 1) {
       let baseWallMs = attemptStartTimes[0];
       for (let i = 0; i < attemptStartTimes.length - 1; i++) {
-        let attemptStartUs = pending3.startTime + (attemptStartTimes[i] - baseWallMs) * 1e3, attemptEndUs = pending3.startTime + (attemptStartTimes[i + 1] - baseWallMs) * 1e3;
+        let attemptStartUs = pending4.startTime + (attemptStartTimes[i] - baseWallMs) * 1e3, attemptEndUs = pending4.startTime + (attemptStartTimes[i + 1] - baseWallMs) * 1e3;
         events2.push({
           name: `Attempt ${i + 1} (retry)`,
           cat: "api,retry",
           ph: "B",
           ts: attemptStartUs,
-          pid: pending3.agentInfo.processId,
-          tid: pending3.agentInfo.threadId,
+          pid: pending4.agentInfo.processId,
+          tid: pending4.agentInfo.threadId,
           args: { attempt: i + 1 }
         }), events2.push({
           name: `Attempt ${i + 1} (retry)`,
           cat: "api,retry",
           ph: "E",
           ts: attemptEndUs,
-          pid: pending3.agentInfo.processId,
-          tid: pending3.agentInfo.threadId
+          pid: pending4.agentInfo.processId,
+          tid: pending4.agentInfo.threadId
         });
       }
     }
@@ -293145,19 +293259,19 @@ function endLLMRequestPerfettoSpan(spanId, metadata2) {
       cat: "api,setup",
       ph: "E",
       ts: setupEndTs,
-      pid: pending3.agentInfo.processId,
-      tid: pending3.agentInfo.threadId
+      pid: pending4.agentInfo.processId,
+      tid: pending4.agentInfo.threadId
     });
   }
   if (ttftMs !== void 0) {
-    let firstTokenStartTs = pending3.startTime + setupUs, firstTokenEndTs = firstTokenStartTs + ttftMs * 1e3;
+    let firstTokenStartTs = pending4.startTime + setupUs, firstTokenEndTs = firstTokenStartTs + ttftMs * 1e3;
     events2.push({
       name: "First Token",
       cat: "api,ttft",
       ph: "B",
       ts: firstTokenStartTs,
-      pid: pending3.agentInfo.processId,
-      tid: pending3.agentInfo.threadId,
+      pid: pending4.agentInfo.processId,
+      tid: pending4.agentInfo.threadId,
       args: {
         ttft_ms: ttftMs,
         prompt_tokens: promptTokens,
@@ -293169,8 +293283,8 @@ function endLLMRequestPerfettoSpan(spanId, metadata2) {
       cat: "api,ttft",
       ph: "E",
       ts: firstTokenEndTs,
-      pid: pending3.agentInfo.processId,
-      tid: pending3.agentInfo.threadId
+      pid: pending4.agentInfo.processId,
+      tid: pending4.agentInfo.threadId
     });
     let actualSamplingMs = ttltMs !== void 0 ? ttltMs - ttftMs - setupUs / 1e3 : void 0;
     actualSamplingMs !== void 0 && actualSamplingMs > 0 && (events2.push({
@@ -293178,8 +293292,8 @@ function endLLMRequestPerfettoSpan(spanId, metadata2) {
       cat: "api,sampling",
       ph: "B",
       ts: firstTokenEndTs,
-      pid: pending3.agentInfo.processId,
-      tid: pending3.agentInfo.threadId,
+      pid: pending4.agentInfo.processId,
+      tid: pending4.agentInfo.threadId,
       args: {
         sampling_ms: actualSamplingMs,
         output_tokens: outputTokens,
@@ -293190,17 +293304,17 @@ function endLLMRequestPerfettoSpan(spanId, metadata2) {
       cat: "api,sampling",
       ph: "E",
       ts: firstTokenEndTs + actualSamplingMs * 1e3,
-      pid: pending3.agentInfo.processId,
-      tid: pending3.agentInfo.threadId
+      pid: pending4.agentInfo.processId,
+      tid: pending4.agentInfo.threadId
     }));
   }
   events2.push({
-    name: pending3.name,
-    cat: pending3.category,
+    name: pending4.name,
+    cat: pending4.category,
     ph: "E",
     ts: endTime,
-    pid: pending3.agentInfo.processId,
-    tid: pending3.agentInfo.threadId,
+    pid: pending4.agentInfo.processId,
+    tid: pending4.agentInfo.threadId,
     args
   }), pendingSpans.delete(spanId);
 }
@@ -293227,18 +293341,18 @@ function startInteractionPerfettoSpan(userPrompt) {
 }
 function endInteractionPerfettoSpan(spanId) {
   if (!isEnabled || !spanId) return;
-  let pending3 = pendingSpans.get(spanId);
-  if (!pending3) return;
-  let endTime = getTimestamp2(), duration3 = endTime - pending3.startTime;
+  let pending4 = pendingSpans.get(spanId);
+  if (!pending4) return;
+  let endTime = getTimestamp2(), duration3 = endTime - pending4.startTime;
   events2.push({
-    name: pending3.name,
-    cat: pending3.category,
+    name: pending4.name,
+    cat: pending4.category,
     ph: "E",
     ts: endTime,
-    pid: pending3.agentInfo.processId,
-    tid: pending3.agentInfo.threadId,
+    pid: pending4.agentInfo.processId,
+    tid: pending4.agentInfo.threadId,
     args: {
-      ...pending3.args,
+      ...pending4.args,
       duration_ms: duration3 / 1e3
     }
   }), pendingSpans.delete(spanId);
@@ -298216,10 +298330,10 @@ function KeybindingSetup({
     activeContextsRef.current.delete(context_0);
   }, []), clearChordTimeout = (0, import_react59.useCallback)(() => {
     chordTimeoutRef.current && (clearTimeout(chordTimeoutRef.current), chordTimeoutRef.current = null);
-  }, []), setPendingChord = (0, import_react59.useCallback)((pending3) => {
-    clearChordTimeout(), pending3 !== null && (chordTimeoutRef.current = setTimeout((pendingChordRef_0, setPendingChordState_0) => {
+  }, []), setPendingChord = (0, import_react59.useCallback)((pending4) => {
+    clearChordTimeout(), pending4 !== null && (chordTimeoutRef.current = setTimeout((pendingChordRef_0, setPendingChordState_0) => {
       logForDebugging("[keybindings] Chord timeout - cancelling"), pendingChordRef_0.current = null, setPendingChordState_0(null);
-    }, CHORD_TIMEOUT_MS, pendingChordRef, setPendingChordState)), pendingChordRef.current = pending3, setPendingChordState(pending3);
+    }, CHORD_TIMEOUT_MS, pendingChordRef, setPendingChordState)), pendingChordRef.current = pending4, setPendingChordState(pending4);
   }, [clearChordTimeout]);
   return (0, import_react59.useEffect)(() => {
     initializeKeybindingWatcher();
@@ -303706,10 +303820,10 @@ function TaskListV2({
       ts_0 && now2 - ts_0 < RECENT_COMPLETED_TTL_MS ? recentCompleted.push(task) : olderCompleted.push(task);
     }
     recentCompleted.sort(byIdAsc), olderCompleted.sort(byIdAsc);
-    let inProgress = tasks3.filter((t_8) => t_8.status === "in_progress").sort(byIdAsc), pending3 = tasks3.filter((t_9) => t_9.status === "pending").sort((a, b3) => {
+    let inProgress = tasks3.filter((t_8) => t_8.status === "in_progress").sort(byIdAsc), pending4 = tasks3.filter((t_9) => t_9.status === "pending").sort((a, b3) => {
       let aBlocked = a.blockedBy.some((id_1) => unresolvedTaskIds.has(id_1)), bBlocked = b3.blockedBy.some((id_2) => unresolvedTaskIds.has(id_2));
       return aBlocked !== bBlocked ? aBlocked ? 1 : -1 : byIdAsc(a, b3);
-    }), prioritized = [...recentCompleted, ...inProgress, ...pending3, ...olderCompleted];
+    }), prioritized = [...recentCompleted, ...inProgress, ...pending4, ...olderCompleted];
     visibleTasks2 = prioritized.slice(0, maxDisplay), hiddenTasks = prioritized.slice(maxDisplay);
   } else
     visibleTasks2 = [...tasks3].sort(byIdAsc), hiddenTasks = [];
@@ -359525,10 +359639,10 @@ async function registerSeedMarketplaces() {
   if (changed > 0) {
     let wrote = 0;
     return updateKnownMarketplacesConfig((live) => {
-      let pending3 = [...desiredByName].filter(
+      let pending4 = [...desiredByName].filter(
         ([name, desired]) => !isEqual_default(live[name], desired)
       );
-      return pending3.length === 0 ? live : (wrote = pending3.length, { ...live, ...Object.fromEntries(pending3) });
+      return pending4.length === 0 ? live : (wrote = pending4.length, { ...live, ...Object.fromEntries(pending4) });
     }), logForDebugging(
       `Synced ${wrote} marketplace(s) from seed dir(s) (${changed} candidate(s) computed outside the lock)`
     ), wrote > 0;
@@ -366780,33 +366894,33 @@ var init_engineSessionParam2 = __esm({
 // build-src/src/sema/interruptMarkerLatch.ts
 function setSeamPendingInterrupt(next) {
   if (!next) {
-    pending = !1, haltUnconsumed = !1, outstandingHaltTaskId = void 0;
+    pending2 = !1, haltUnconsumed = !1, outstandingHaltTaskId = void 0;
     return;
   }
   if (haltUnconsumed) {
-    haltUnconsumed = !1, outstandingHaltTaskId = void 0, pending = !1;
+    haltUnconsumed = !1, outstandingHaltTaskId = void 0, pending2 = !1;
     return;
   }
-  pending = !0;
+  pending2 = !0;
 }
 function noteHaltRequested(taskId) {
   typeof taskId != "string" || taskId.length === 0 || (outstandingHaltTaskId = taskId);
 }
 function isSeamPendingInterrupt() {
-  return pending;
+  return pending2;
 }
 function takeSeamPendingInterrupt() {
-  let armed3 = pending;
-  return pending = !1, haltUnconsumed = !1, outstandingHaltTaskId = void 0, armed3;
+  let armed3 = pending2;
+  return pending2 = !1, haltUnconsumed = !1, outstandingHaltTaskId = void 0, armed3;
 }
 function retractSeamPendingInterrupt(noticeTaskId) {
   if (!(typeof noticeTaskId == "string" && noticeTaskId.length > 0 && outstandingHaltTaskId !== void 0 && noticeTaskId === outstandingHaltTaskId)) return { attributed: !1, wasArmed: !1 };
-  let wasArmed = pending;
-  return pending = !1, haltUnconsumed = !0, { attributed: !0, wasArmed };
+  let wasArmed = pending2;
+  return pending2 = !1, haltUnconsumed = !0, { attributed: !0, wasArmed };
 }
-var pending, haltUnconsumed, outstandingHaltTaskId, init_interruptMarkerLatch = __esm({
+var pending2, haltUnconsumed, outstandingHaltTaskId, init_interruptMarkerLatch = __esm({
   "build-src/src/sema/interruptMarkerLatch.ts"() {
-    pending = !1, haltUnconsumed = !1;
+    pending2 = !1, haltUnconsumed = !1;
   }
 });
 
@@ -367162,8 +367276,8 @@ function publishEngineBgShellPanelEvent(ev) {
 }
 function subscribeEngineBgShellPanel(fn2) {
   if (listener3 = fn2, buffer3.length > 0) {
-    let pending3 = buffer3.splice(0, buffer3.length);
-    for (let ev of pending3)
+    let pending4 = buffer3.splice(0, buffer3.length);
+    for (let ev of pending4)
       try {
         fn2(ev);
       } catch {
@@ -369315,8 +369429,8 @@ function setSeamPendingRewind(spec) {
     } catch {
     }
 }
-function setSeamHistorySeedPending(pending3) {
-  seamHistorySeedPending = pending3;
+function setSeamHistorySeedPending(pending4) {
+  seamHistorySeedPending = pending4;
 }
 function isSeamHistorySeedPending() {
   return seamHistorySeedPending;
@@ -373715,8 +373829,8 @@ function usePasteHandler({
       isPasting,
       pastePending: pastePendingRef.current
     })) {
-      let pending3 = pendingReturnRef.current;
-      pendingReturnRef.current = null, onInput(pending3.input, pending3.key);
+      let pending4 = pendingReturnRef.current;
+      pendingReturnRef.current = null, onInput(pending4.input, pending4.key);
     }
   }), import_react94.default.useEffect(() => () => {
     isMountedRef.current = !1;
@@ -395015,8 +395129,8 @@ function ManagePlugins({
   }, handleSingleOperationRef = (0, import_react146.useRef)(handleSingleOperation);
   handleSingleOperationRef.current = handleSingleOperation, (0, import_react146.useEffect)(() => {
     if (viewState === "plugin-details" && selectedPlugin && pendingAutoActionRef.current) {
-      let pending3 = pendingAutoActionRef.current;
-      if (pendingAutoActionRef.current = void 0, pending3 === "configure") {
+      let pending4 = pendingAutoActionRef.current;
+      if (pendingAutoActionRef.current = void 0, pending4 === "configure") {
         let schema = selectedPlugin.plugin.manifest.userConfig;
         schema && Object.keys(schema).length > 0 ? setViewState({
           type: "configuring-options",
@@ -395024,7 +395138,7 @@ function ManagePlugins({
         }) : setResult(`Plugin "${selectedPlugin.plugin.manifest.displayName ?? selectedPlugin.plugin.name}" declares no userConfig options.`);
         return;
       }
-      handleSingleOperationRef.current(pending3);
+      handleSingleOperationRef.current(pending4);
     }
   }, [viewState, selectedPlugin, setResult]);
   let handleToggle = React85.useCallback(() => {
@@ -400226,20 +400340,20 @@ var sema_brand_default, init_sema_brand = __esm({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.97",
+        version: "1.0.98",
         notes: [
-          "If the engine crashes while an approval is still waiting, the next start says so: one transcript line lists the approvals that were converged to denied, split into those that look safe to re-run (based on what was recorded) and those a human should check first. sema never re-runs anything on its own.",
-          "--tools and --disallowedTools now reach the engine on both lanes: in interactive sessions and in -p runs, a tool outside the allowed set is denied by policy before any approval dialog, matching the built-in-set semantics of the upstream CLI. (--allowedTools is still shell-local; see the known-issues ledger.)",
-          "Sandbox settings changed from the UI (/sandbox exclude, the sandbox toggles) are persisted to your user settings so lower-trust project files cannot relax them. Note: these settings govern the shell's local `!` commands; the engine-side Bash sandbox is not yet enforced by this release.",
-          "With SEMA_SEND_SETTINGS=full, only the settings keys the engine accepts are sent (env, model, outputStyle, permissions.{allow,ask,deny,defaultMode,disableAutoMode}, ultracode, webSearch); unsupported keys are dropped locally instead of failing the request, and SEMA_DEBUG names what was dropped.",
-          "When an engine declines workflow orchestration for a request (server 7.57.0+ multi-tenant deployments without an entitlement resolver), sema re-sends the request once without it and says so in one line; /workflows and /effort ultracode explain that workflows are unavailable on that deployment instead of failing silently.",
-          "Approval cards that reach the end of their live window are no longer left hanging: the card says the request moved to the durable queue and is still decidable, shows the deadline when the engine reports one, and a late decision gets a one-line outcome instead of silence.",
-          "A turn that keeps re-parking on the same approval no longer runs for 15 minutes and then fails with 'gate hop limit (24) exceeded': sema re-attaches a bounded number of times, shows a status row while it does, and when it stops it says the real reason (the approval was decided but the engine parked the same call again, or nothing decidable could be read). Legitimate approvals are never capped \u2014 25 or 70 distinct gates in one turn are all answered.",
-          "After resuming a session whose previous turn was parked on an approval, if your permission rules decide that approval on their own, sema says so and the run resumes; your message is no longer refused with 'could not reopen that card'."
+          "Print mode (-p) now picks up the project's .mcp.json. It was being read before the configuration gate opened, so the servers were silently dropped; the same run now sends them to the engine like the interactive session does.",
+          "/permissions \u203A Recent Denials rows now show the denied Bash command or the file path, so three denied Bash calls no longer look identical.",
+          "MCP servers you disable in /mcp are no longer sent to the engine (in both the interactive session and -p).",
+          `Bash approval cards for engine-run commands are titled "Bash command (unsandboxed)" while sandboxing is on, and /sandbox status says the sandbox covers the local ! shell only \u2014 the engine's Bash is not sandboxed.`,
+          "Notices that fire before the screen mounts (shared-deployment MCP warning, crash-converged approvals, imported settings) now land in the transcript instead of vanishing with the boot output.",
+          'A parked approval answered after the engine reaped it now says "nothing was run" only when the run really expired; otherwise it says the decision may already have landed elsewhere.',
+          "settings.outputStyle now reaches the engine in the default settings mode and in -p; turning fileCheckpointingEnabled off in /config really stops per-turn snapshot capture; and when the programmatic-allow budget is used up the transcript says so once.",
+          "The notice for a session marked externally exposed no longer claims its memory was quarantined; it says later harvests are withheld for review, which is true in every mode."
         ]
       },
-      productVersion: "1.0.97",
-      announcement: "sema 1.0.97 \u2014 crash-converged approvals are disclosed on the next start, --tools/--disallowedTools are enforced on the interactive lane too, approval cards no longer go silent at window expiry, parked approvals no longer spin into 'gate hop limit (24) exceeded', and the settings wire is aligned with the engine's accepted key set",
+      productVersion: "1.0.98",
+      announcement: "sema 1.0.98 \u2014 print mode (-p) now loads the project's .mcp.json, /permissions Recent Denials show the denied command or file instead of just the tool name, boot-time notices reach the transcript, engine-run Bash cards no longer imply sandboxing, and disabled MCP servers stay disabled on the engine too.",
       version: "1.0.91"
     };
   }
@@ -404280,8 +404394,8 @@ function VirtualMessageList({
     phantomBurstRef.current = 0;
     let ord = wantLast ? positions.length - 1 : 0;
     searchState.current.screenOrd = ord, startPtrRef.current = -1, highlightRef.current(ord);
-    let pending3 = pendingStepRef.current;
-    pending3 && (pendingStepRef.current = 0, stepRef.current(pending3));
+    let pending4 = pendingStepRef.current;
+    pending4 && (pendingStepRef.current = 0, stepRef.current(pending4));
   }, [seekGen]);
   function jump(i, wantLast) {
     let s = scrollRef.current;
@@ -404495,12 +404609,12 @@ function StickyTracker({
         break;
       }
     }
-  let baseOffset = firstVisibleTop >= 0 ? firstVisibleTop - offsets[firstVisible] : 0, estimate = idx >= 0 ? Math.max(0, baseOffset + offsets[idx]) : -1, pending3 = (0, import_react166.useRef)({
+  let baseOffset = firstVisibleTop >= 0 ? firstVisibleTop - offsets[firstVisible] : 0, estimate = idx >= 0 ? Math.max(0, baseOffset + offsets[idx]) : -1, pending4 = (0, import_react166.useRef)({
     idx: -1,
     tries: 0
   }), suppress = (0, import_react166.useRef)("none"), lastIdx = (0, import_react166.useRef)(-1);
   return (0, import_react166.useEffect)(() => {
-    if (pending3.current.idx >= 0) return;
+    if (pending4.current.idx >= 0) return;
     if (suppress.current === "armed") {
       suppress.current = "force";
       return;
@@ -404522,19 +404636,19 @@ function StickyTracker({
       scrollTo: () => {
         setStickyPrompt("clicked"), suppress.current = "armed";
         let el = getItemElement(capturedIdx);
-        el ? scrollRef.current?.scrollToElement(el, 1) : (scrollRef.current?.scrollTo(capturedEstimate), pending3.current = {
+        el ? scrollRef.current?.scrollToElement(el, 1) : (scrollRef.current?.scrollTo(capturedEstimate), pending4.current = {
           idx: capturedIdx,
           tries: 0
         });
       }
     });
   }), (0, import_react166.useEffect)(() => {
-    if (pending3.current.idx < 0) return;
-    let el = getItemElement(pending3.current.idx);
-    el ? (scrollRef.current?.scrollToElement(el, 1), pending3.current = {
+    if (pending4.current.idx < 0) return;
+    let el = getItemElement(pending4.current.idx);
+    el ? (scrollRef.current?.scrollToElement(el, 1), pending4.current = {
       idx: -1,
       tries: 0
-    }) : ++pending3.current.tries > 5 && (pending3.current = {
+    }) : ++pending4.current.tries > 5 && (pending4.current = {
       idx: -1,
       tries: 0
     });
@@ -404572,20 +404686,20 @@ var require_sema_brand = __commonJS({
         _doc: "displayName/email \u7559 null = \u8FD0\u884C\u65F6\u56DE\u9000(\u540D\u5B57\u53D6\u672C\u673A OS \u7528\u6237\u540D,\u90AE\u7BB1\u4E0D\u663E\u793A)\u3002\u522B\u70E7\u4E2A\u4EBA\u4FE1\u606F\u8FDB\u54C1\u724C\u6587\u4EF6(F-S1-1:\u65B0\u7528\u6237\u66FE\u770B\u5230 Welcome back Clay!)\u3002"
       },
       whatsNew: {
-        version: "1.0.97",
+        version: "1.0.98",
         notes: [
-          "If the engine crashes while an approval is still waiting, the next start says so: one transcript line lists the approvals that were converged to denied, split into those that look safe to re-run (based on what was recorded) and those a human should check first. sema never re-runs anything on its own.",
-          "--tools and --disallowedTools now reach the engine on both lanes: in interactive sessions and in -p runs, a tool outside the allowed set is denied by policy before any approval dialog, matching the built-in-set semantics of the upstream CLI. (--allowedTools is still shell-local; see the known-issues ledger.)",
-          "Sandbox settings changed from the UI (/sandbox exclude, the sandbox toggles) are persisted to your user settings so lower-trust project files cannot relax them. Note: these settings govern the shell's local `!` commands; the engine-side Bash sandbox is not yet enforced by this release.",
-          "With SEMA_SEND_SETTINGS=full, only the settings keys the engine accepts are sent (env, model, outputStyle, permissions.{allow,ask,deny,defaultMode,disableAutoMode}, ultracode, webSearch); unsupported keys are dropped locally instead of failing the request, and SEMA_DEBUG names what was dropped.",
-          "When an engine declines workflow orchestration for a request (server 7.57.0+ multi-tenant deployments without an entitlement resolver), sema re-sends the request once without it and says so in one line; /workflows and /effort ultracode explain that workflows are unavailable on that deployment instead of failing silently.",
-          "Approval cards that reach the end of their live window are no longer left hanging: the card says the request moved to the durable queue and is still decidable, shows the deadline when the engine reports one, and a late decision gets a one-line outcome instead of silence.",
-          "A turn that keeps re-parking on the same approval no longer runs for 15 minutes and then fails with 'gate hop limit (24) exceeded': sema re-attaches a bounded number of times, shows a status row while it does, and when it stops it says the real reason (the approval was decided but the engine parked the same call again, or nothing decidable could be read). Legitimate approvals are never capped \u2014 25 or 70 distinct gates in one turn are all answered.",
-          "After resuming a session whose previous turn was parked on an approval, if your permission rules decide that approval on their own, sema says so and the run resumes; your message is no longer refused with 'could not reopen that card'."
+          "Print mode (-p) now picks up the project's .mcp.json. It was being read before the configuration gate opened, so the servers were silently dropped; the same run now sends them to the engine like the interactive session does.",
+          "/permissions \u203A Recent Denials rows now show the denied Bash command or the file path, so three denied Bash calls no longer look identical.",
+          "MCP servers you disable in /mcp are no longer sent to the engine (in both the interactive session and -p).",
+          `Bash approval cards for engine-run commands are titled "Bash command (unsandboxed)" while sandboxing is on, and /sandbox status says the sandbox covers the local ! shell only \u2014 the engine's Bash is not sandboxed.`,
+          "Notices that fire before the screen mounts (shared-deployment MCP warning, crash-converged approvals, imported settings) now land in the transcript instead of vanishing with the boot output.",
+          'A parked approval answered after the engine reaped it now says "nothing was run" only when the run really expired; otherwise it says the decision may already have landed elsewhere.',
+          "settings.outputStyle now reaches the engine in the default settings mode and in -p; turning fileCheckpointingEnabled off in /config really stops per-turn snapshot capture; and when the programmatic-allow budget is used up the transcript says so once.",
+          "The notice for a session marked externally exposed no longer claims its memory was quarantined; it says later harvests are withheld for review, which is true in every mode."
         ]
       },
-      productVersion: "1.0.97",
-      announcement: "sema 1.0.97 \u2014 crash-converged approvals are disclosed on the next start, --tools/--disallowedTools are enforced on the interactive lane too, approval cards no longer go silent at window expiry, parked approvals no longer spin into 'gate hop limit (24) exceeded', and the settings wire is aligned with the engine's accepted key set",
+      productVersion: "1.0.98",
+      announcement: "sema 1.0.98 \u2014 print mode (-p) now loads the project's .mcp.json, /permissions Recent Denials show the denied command or file instead of just the tool name, boot-time notices reach the transcript, engine-run Bash cards no longer imply sandboxing, and disabled MCP servers stay disabled on the engine too.",
       version: "1.0.91"
     };
   }
@@ -407660,12 +407774,12 @@ function SkillsMenu({ onExit: onExit2, commands }) {
   }, []), { addNotification } = useNotifications(), flushRef = React99.useRef(() => {
   });
   flushRef.current = () => {
-    let pending3 = failedWritesRef.current.size;
-    if (pending3 === 0) return;
+    let pending4 = failedWritesRef.current.size;
+    if (pending4 === 0) return;
     let { error: error51 } = flushFailedWrites();
     error51 && addNotification({
       key: "skills-override-save-failed",
-      text: `Could not save ${pending3} skill ${plural(pending3, "override")}: ${error51.message}`,
+      text: `Could not save ${pending4} skill ${plural(pending4, "override")}: ${error51.message}`,
       priority: "high",
       timeoutMs: 12e3
     });
@@ -427487,7 +427601,7 @@ async function deliverToRunningAgentLane(core, id, access7, notification, opts)
     return { ok: !1, reason: "not_found" };
   if (handle2.status !== "running")
     return { ok: !1, reason: "not_running" };
-  let bounded = (p, fallback, onTimeout) => new Promise((resolve57) => {
+  let bounded2 = (p, fallback, onTimeout) => new Promise((resolve57) => {
     let t2 = setTimeout(() => {
       try {
         onTimeout?.();
@@ -427505,12 +427619,12 @@ async function deliverToRunningAgentLane(core, id, access7, notification, opts)
     if (handle2.channelState !== "attaching")
       return { ok: !1, reason: "no_channel" };
     let q2 = handle2.preAttachQueue ??= [];
-    return q2.length >= 8 ? { ok: !1, reason: "queue_full" } : bounded(new Promise((resolve57) => {
+    return q2.length >= 8 ? { ok: !1, reason: "queue_full" } : bounded2(new Promise((resolve57) => {
       q2.push([notification, opts, resolve57]);
     }), { ok: !0, disposition: "pending" });
   }
   let detachOnTimeout;
-  return await bounded(new Promise((resolve57) => {
+  return await bounded2(new Promise((resolve57) => {
     let inflight3 = handle2.inFlightDirect ??= /* @__PURE__ */ new Set(), settleOnce = (r) => {
       inflight3.has(settleOnce) && (inflight3.delete(settleOnce), resolve57(r));
     };
@@ -442268,7 +442382,7 @@ var command6, sandbox_default, init_sandbox = __esm({
         let currentlyEnabled = SandboxManager2.isSandboxingEnabled(), autoAllow = SandboxManager2.isAutoAllowBashIfSandboxedEnabled(), allowUnsandboxed = SandboxManager2.areUnsandboxedCommandsAllowed(), isLocked = SandboxManager2.areSandboxSettingsLockedByPolicy(), hasDeps = SandboxManager2.checkDependencies().errors.length === 0, icon;
         hasDeps ? icon = currentlyEnabled ? figures_default.tick : figures_default.circle : icon = figures_default.warning;
         let statusText = "sandbox disabled";
-        return currentlyEnabled && (statusText = autoAllow ? "sandbox enabled (auto-allow)" : "sandbox enabled", statusText += allowUnsandboxed ? ", fallback allowed" : ""), isLocked && (statusText += " (managed)"), `${icon} ${statusText} (\u23CE to configure)`;
+        return currentlyEnabled && (statusText = autoAllow ? "sandbox enabled (auto-allow)" : "sandbox enabled", statusText += allowUnsandboxed ? ", fallback allowed" : ""), isLocked && (statusText += " (managed)"), currentlyEnabled && (statusText += " \xB7 local ! shell only (engine-run Bash is not sandboxed)"), `${icon} ${statusText} (\u23CE to configure)`;
       },
       argumentHint: 'exclude "command pattern"',
       get isHidden() {
@@ -443575,27 +443689,27 @@ var exportCommand, export_default, init_export2 = __esm({
 function recordModelConfigOverrideNotice(model, field, value) {
   let name = model.trim();
   if (!name) return;
-  let byField = pending2.get(name);
-  byField || (byField = /* @__PURE__ */ new Map(), pending2.set(name, byField)), byField.set(field, value);
+  let byField = pending3.get(name);
+  byField || (byField = /* @__PURE__ */ new Map(), pending3.set(name, byField)), byField.set(field, value);
 }
 function resetModelConfigOverrideNotices() {
-  pending2.clear();
+  pending3.clear();
 }
 function consumeModelConfigOverrideNotice(fmt) {
-  if (pending2.size === 0) return null;
+  if (pending3.size === 0) return null;
   let parts = [];
-  for (let [model, byField] of pending2) {
+  for (let [model, byField] of pending3) {
     let fields = ["contextWindow", "maxTokens"].filter((f) => byField.has(f)).map((f) => `${FIELD_LABEL[f]} ${fmt(byField.get(f))}`);
     fields.length > 0 && parts.push(`${model}: ${fields.join(", ")}`);
   }
-  return pending2.clear(), parts.length === 0 ? null : ` \xB7 Saved ${parts.join(" \xB7 ")} \u2014 in effect now; the engine applies it on its next start`;
+  return pending3.clear(), parts.length === 0 ? null : ` \xB7 Saved ${parts.join(" \xB7 ")} \u2014 in effect now; the engine applies it on its next start`;
 }
-var FIELD_LABEL, pending2, init_modelCtxOverrideNotice = __esm({
+var FIELD_LABEL, pending3, init_modelCtxOverrideNotice = __esm({
   "build-src/src/sema/modelCtxOverrideNotice.ts"() {
     FIELD_LABEL = {
       contextWindow: "context",
       maxTokens: "max tokens"
-    }, pending2 = /* @__PURE__ */ new Map();
+    }, pending3 = /* @__PURE__ */ new Map();
   }
 });
 
@@ -464831,8 +464945,10 @@ function detailOf(e) {
 function engineNoticeLine(rawCode, rawMessage, rawDetail) {
   let detail = rawDetail !== null && typeof rawDetail == "object" ? rawDetail : {};
   switch (typeof rawCode == "string" ? rawCode : "") {
-    case "memory.session_polluted":
-      return "Engine notice: this session is marked externally exposed \u2014 memory harvested from it is quarantined";
+    case "memory.session_polluted": {
+      let reason = typeof detail.reason == "string" ? cleanUntrustedForDisplay(detail.reason, 60) : "";
+      return `Engine notice: this session is marked externally exposed${reason.length > 0 ? ` (${reason})` : ""} \u2014 its later memory harvests are withheld for review (what each one contained is announced separately)`;
+    }
     case "memory.harvest_quarantined": {
       let count3 = finiteNumber(detail.count), moved = finiteNumber(detail.moved), escalated = finiteNumber(detail.escalated), counts2 = [
         count3 !== void 0 ? `withheld ${String(count3)}` : null,
@@ -464850,6 +464966,34 @@ function engineNoticeLine(rawCode, rawMessage, rawDetail) {
     // (core types.d.ts:queued 回执过的 steer/follow-up 在 run 结束时仍在队,绝不重投)——
     // 必须点名丢的是哪句+给出重发指路;双码分臂(detail 键名 steer/followUp 不同,core 明写
     // 「a consumer routing on code alone must not mistake a stranded follow-up for a stranded steer」)。
+    // 片5 5a③(core 7.3.x [6258] 闭集加员 `peer.held_settled` / `peer.idle_subscription`;design/385 Slice 4):
+    // 跨会话 held 队列的结局与 idle 订阅回执。文案锚 CC250 `[cross-session-inbound] …` 字面族
+    // (CC250 语料字节偏移 852639 一带:「held peer message approved but policy is now refuse」「approved but DROPPED by
+    // the ingress guard on release」);detail 两闭集(settlement / reason)按 core 文档逐词,闭集外一律
+    // 落通用句「held peer message settled: <settlement>/<reason>」—— 不编、不丢帧。seq/fromSession 是
+    // UNTRUSTED wire 值:消毒后进文案,缺哪个不渲哪个。
+    case "peer.held_settled": {
+      let settlement = typeof detail.settlement == "string" ? detail.settlement : "", reason = typeof detail.reason == "string" ? detail.reason : "", seq = finiteNumber(detail.seq), from = typeof detail.fromSession == "string" ? cleanUntrustedForDisplay(detail.fromSession, 40) : "", who = `${seq !== void 0 ? ` #${String(seq)}` : ""}${from.length > 0 ? ` from ${from}` : ""}`, held = finiteNumber(detail.heldCount), body;
+      if (settlement === "delivered" && reason === "approved") body = `held peer message${who} approved and delivered`;
+      else if (settlement === "delivered" && reason === "rejudge") body = `held peer message${who} re-judged and delivered (policy now accepts)`;
+      else if (settlement === "dropped" && reason === "rejudge") body = `held peer message${who} approved but policy is now refuse \u2014 dropped`;
+      else if (settlement === "dropped" && reason === "inject_failed") body = `held peer message${who} approved but DROPPED by the ingress guard on release`;
+      else if (reason === "evicted" && (settlement === "expired" || settlement === "dropped")) body = `held peer message${who} ${settlement} \u2014 held queue full${held !== void 0 ? ` (${String(held)} held)` : ""}, oldest evicted`;
+      else if (settlement === "expired" && reason === "deadline") body = `held peer message${who} expired at the review deadline \u2014 not delivered`;
+      else if (settlement === "expired" && reason === "cancelled") body = `held peer message${who} cancelled \u2014 not delivered`;
+      else if (settlement === "expired" && reason === "shutdown") body = `shutdown: settling held peer message${who} as expired \u2014 not delivered`;
+      else if (settlement === "denied") body = `held peer message${who} denied \u2014 not delivered`;
+      else if (settlement === "refused") body = `held peer message${who} refused by policy \u2014 not delivered`;
+      else {
+        let s1 = settlement.length > 0 ? cleanUntrustedForDisplay(settlement, 24) : "unknown", r1 = reason.length > 0 ? cleanUntrustedForDisplay(reason, 24) : "unknown";
+        body = `held peer message${who} settled: ${s1}/${r1}`;
+      }
+      return `[cross-session-inbound] ${body}`;
+    }
+    case "peer.idle_subscription": {
+      let outcome = typeof detail.outcome == "string" ? cleanUntrustedForDisplay(detail.outcome, 24) : "unknown", from = typeof detail.fromSession == "string" ? cleanUntrustedForDisplay(detail.fromSession, 40) : "", live = detail.live === !0 ? "live" : detail.live === !1 ? "not live" : "", tail = [from.length > 0 ? `peer ${from}` : null, live.length > 0 ? live : null].filter((x3) => x3 !== null).join(", ");
+      return `[Cross-session idle notice] ${outcome}${tail.length > 0 ? ` (${tail})` : ""}`;
+    }
     case "task.user_steer_undrained": {
       let steer = typeof detail.steer == "string" ? cleanUntrustedForDisplay(detail.steer, 80) : "";
       return `Engine notice: your steer${steer.length > 0 ? ` ("${steer}")` : ""} was never consumed \u2014 the run ended before any turn could pick it up, and it will not be redelivered; send it again if you still want it`;
@@ -465912,8 +466056,10 @@ function buildWireSettingsStamp(mode, full, opts = {}) {
     ...deny2.length ? { deny: deny2 } : {},
     ...ask2.length ? { ask: ask2 } : {}
   };
-  if (mode === "rules")
-    return Object.keys(safePerms).length ? { permissions: safePerms } : void 0;
+  if (mode === "rules") {
+    let rulesOut = {};
+    return Object.keys(safePerms).length && (rulesOut.permissions = safePerms), typeof full.outputStyle == "string" && full.outputStyle !== "" && (rulesOut.outputStyle = full.outputStyle), Object.keys(rulesOut).length ? rulesOut : void 0;
+  }
   let { allow: _allow, deny: _deny, ask: _ask, ...permRest } = perms, fullPerms = { ...permRest, ...safePerms }, { hooks: _hooks, ...fullSansHooks } = full, out6 = {}, droppedTop = [];
   for (let [k2, v2] of Object.entries(fullSansHooks))
     k2 !== "permissions" && (WIRE_SETTINGS_TOP_KEYS.has(k2) ? out6[k2] = v2 : droppedTop.push(k2));
@@ -465962,13 +466108,14 @@ var cliToolFlagsSnapshot, WIRE_SETTINGS_TOP_KEYS, WIRE_PERMISSIONS_KEYS, init_se
 });
 
 // build-src/src/sema/classifierVerdictWire.ts
-function surfaceClassifierDeny(toolName2, verdict) {
+function surfaceClassifierDeny(toolName2, verdict, ctx) {
   try {
     (init_autoModeDenials(), __toCommonJS(autoModeDenials_exports)).recordAutoModeDenial?.({
       toolName: toolName2,
-      // display:wire 的 tool_end 不带 args(args 在 tool_start;本桥只为 ask/fs 工具留存),
-      // 克制起见用 toolName 兜底 —— 裁决 reason 单列一栏,信息不丢。
-      display: toolName2,
+      // L-69⑨(client-core 0.52.0):包侧 deny 臂现在把这一只 call 的 tool_start args 经 ctx 交过来,
+      // 行文案由包内 classifierDenyDisplay 三端同形判定(Bash ⇒ command / fs 工具 ⇒ file_path / 其它 ⇒ toolName;
+      // 台账缺席 ⇒ 回落 toolName)。args 是 UNTRUSTED wire 值:展示消毒在端(本行),包内只截长度。
+      display: cleanUntrustedForDisplay(classifierDenyDisplay(toolName2, ctx?.args), 200),
       reason: verdict.reason ?? verdict.message,
       timestamp: Date.now()
     });
@@ -465994,6 +466141,7 @@ var NOTICE_KEY, NOTICE_TIMEOUT_MS, noticeTimeoutOverrideForTest, init_classifier
     init_dist();
     init_debug();
     init_wireNoticePort();
+    init_untrustedDisplayText();
     NOTICE_KEY = "auto-mode-denied", NOTICE_TIMEOUT_MS = 1e4, noticeTimeoutOverrideForTest = null;
   }
 });
@@ -466396,19 +466544,32 @@ function evaluateEngineGateSyncAllow(req) {
       `engineGateSyncAllow: gate for "${req.toolName}" AUTO-ALLOWED by mode posture (${verdict.reason}; mode=${ctx?.mode ?? "none"})`
     ), verdict;
   }
-  return budgetUsed >= cap() ? (budgetExhaustedLogged || (budgetExhaustedLogged = !0, logForDebugging(
-    `engineGateSyncAllow: programmatic-allow budget exhausted (${budgetUsed}/${cap()}) \u2014 every further gate goes back to the approval card`
-  )), {
-    allow: !1,
-    reason: "programmatic-allow budget exhausted",
-    autoFallbackReason: "engine_gate_budget_exhausted"
-  }) : (budgetUsed++, verdict);
+  if (budgetUsed >= cap()) {
+    if (!budgetExhaustedLogged) {
+      budgetExhaustedLogged = !0, logForDebugging(
+        `engineGateSyncAllow: programmatic-allow budget exhausted (${budgetUsed}/${cap()}) \u2014 every further gate goes back to the approval card`
+      );
+      try {
+        surfaceTranscriptSystemNotice(
+          `sema: the programmatic-allow budget for this session is used up (${String(budgetUsed)}/${String(cap())}) \u2014 rules will no longer auto-approve; every further gate goes back to the approval card (raise SEMA_GATE_SYNC_ALLOW_BUDGET before launch to change the cap)`
+        );
+      } catch {
+      }
+    }
+    return {
+      allow: !1,
+      reason: "programmatic-allow budget exhausted",
+      autoFallbackReason: "engine_gate_budget_exhausted"
+    };
+  }
+  return budgetUsed++, verdict;
 }
 var SYNC_ALLOW_MODES, DEFAULT_BUDGET, NO_SYNC_ALLOW_ATTRIBUTION, budgetUsed, budgetCap, budgetExhaustedLogged, FS_WRITE_TOOL_LOADERS, init_engineGateSyncAllow = __esm({
   "build-src/src/sema/engineGateSyncAllow.ts"() {
     init_appStateRef();
     init_envKnobs();
     init_debug();
+    init_transcriptSystemNotice();
     SYNC_ALLOW_MODES = /* @__PURE__ */ new Set(["default", "acceptEdits", "auto"]), DEFAULT_BUDGET = 100, NO_SYNC_ALLOW_ATTRIBUTION = "engine_gate_no_sync_allow", budgetUsed = 0, budgetCap = null, budgetExhaustedLogged = !1;
     FS_WRITE_TOOL_LOADERS = {
       Write: () => (init_FileWriteTool(), __toCommonJS(FileWriteTool_exports)).FileWriteTool,
@@ -468071,6 +468232,7 @@ __export(agentsWire_exports, {
   CHROME_EVENT_KINDS: () => CHROME_EVENT_KINDS,
   CLAIM_HELD_STATES: () => CLAIM_HELD_STATES,
   CLAIM_RELEASED_STATES: () => CLAIM_RELEASED_STATES,
+  CLASSIFIER_DENY_DISPLAY_MAX: () => CLASSIFIER_DENY_DISPLAY_MAX,
   CLASSIFIER_DENY_SIGNATURE: () => CLASSIFIER_DENY_SIGNATURE,
   CLIENT_VERBS: () => CLIENT_VERBS,
   CONFIG_DELEGATION_ENTRY_CAPS: () => CONFIG_DELEGATION_ENTRY_CAPS,
@@ -468362,6 +468524,7 @@ __export(agentsWire_exports, {
   catalogCachePath: () => catalogCachePath,
   catalogShaUrlFor: () => catalogShaUrlFor,
   ccStopSemanticsFromVersion: () => ccStopSemanticsFromVersion,
+  classifierDenyDisplay: () => classifierDenyDisplay,
   classifierDenyFromToolEnd: () => classifierDenyFromToolEnd,
   classifierDenyNoticeText: () => classifierDenyNoticeText,
   classifyAskParkChainFailure: () => classifyAskParkChainFailure,
@@ -468942,16 +469105,17 @@ function noteEngineCapsForMcpGate(baseUrl, caps) {
     if (typeof caps != "object" || caps === null || caps.mcpInjection !== !1 || warnedBases.has(baseUrl)) return;
     let n2 = getSeamMcp()?.length ?? 0;
     if (n2 === 0) return;
-    warnedBases.add(baseUrl), process.stderr.write(
-      `[sema] mcp wire: this engine does not mount client-supplied MCP servers (capabilities.mcpInjection=false \u2014 shared deployment) \u2014 ${n2} configured MCP server${n2 === 1 ? "" : "s"} will not be available in this session
-`
-    );
+    warnedBases.add(baseUrl);
+    let line = `[sema] mcp wire: this engine does not mount client-supplied MCP servers (capabilities.mcpInjection=false \u2014 shared deployment) \u2014 ${n2} configured MCP server${n2 === 1 ? "" : "s"} will not be available in this session`;
+    queueTranscriptSystemNotice(line) || process.stderr.write(`${line}
+`);
   } catch {
   }
 }
 var warnedBases, init_mcpInjectionGate = __esm({
   "build-src/src/sema/mcpInjectionGate.ts"() {
     init_seamQuery();
+    init_transcriptSystemNotice();
     warnedBases = /* @__PURE__ */ new Set();
   }
 });
@@ -471279,9 +471443,9 @@ function Header({
     /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(ThemedText, { dimColor: !0, wrap: "truncate", children: stats3 })
   ] });
 }
-function buildHeader(run2, pending3) {
+function buildHeader(run2, pending4) {
   let name = run2.name ? `dynamic workflow: ${run2.name}` : "dynamic workflow", subtext = run2.description ?? run2.summary, parts = [];
-  if ((!pending3 || run2.agentCount > 0) && parts.push(`${run2.agentCount} ${plural(run2.agentCount, "agent")}`), run2.totalTokens > 0 && parts.push(`${fmtTokens2(run2.totalTokens)} tokens`), parts.push(run2.status), run2.status === "running" && run2.phases.length > 1) {
+  if ((!pending4 || run2.agentCount > 0) && parts.push(`${run2.agentCount} ${plural(run2.agentCount, "agent")}`), run2.totalTokens > 0 && parts.push(`${fmtTokens2(run2.totalTokens)} tokens`), parts.push(run2.status), run2.status === "running" && run2.phases.length > 1) {
     let current6 = [...run2.phases].reverse().find((p) => p.status === "running") ?? [...run2.phases].reverse().find((p) => p.status !== "not-started");
     current6 && parts.push(`phase: ${current6.title}`);
   }
@@ -471298,9 +471462,9 @@ function WorkflowDetailDialog2({
   onPause,
   onResume,
   initialPhaseIndex,
-  pending: pending3
+  pending: pending4
 }) {
-  let termSize = useTerminalSize(), { rows: rows2 } = useModalOrTerminalSize(termSize), insideModal = useIsInsideModal(), { columns } = termSize, width = Math.max(24, columns - 6), singlePaneWidth = Math.max(12, width - 6), phases = workflow.phases, header = (0, import_react204.useMemo)(() => buildHeader(workflow, pending3), [workflow, pending3]), [phaseIdx, setPhaseIdx] = (0, import_react204.useState)(
+  let termSize = useTerminalSize(), { rows: rows2 } = useModalOrTerminalSize(termSize), insideModal = useIsInsideModal(), { columns } = termSize, width = Math.max(24, columns - 6), singlePaneWidth = Math.max(12, width - 6), phases = workflow.phases, header = (0, import_react204.useMemo)(() => buildHeader(workflow, pending4), [workflow, pending4]), [phaseIdx, setPhaseIdx] = (0, import_react204.useState)(
     initialPhaseIndex !== void 0 ? Math.max(0, initialPhaseIndex) : 0
   ), [agentIdx, setAgentIdx] = (0, import_react204.useState)(0), [level, setLevel] = (0, import_react204.useState)(
     initialPhaseIndex !== void 0 ? "agents" : "phases"
@@ -471558,7 +471722,7 @@ function WorkflowDetailDialog2({
   ] }) : body = /* @__PURE__ */ (0, import_jsx_runtime360.jsxs)(import_jsx_runtime360.Fragment, { children: [
     /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(Header, { name: header.name, subtext: header.subtext, stats: header.stats }),
     !tight && /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(ThemedBox_default, { height: 1 }),
-    /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(ThemedText, { dimColor: !0, children: pending3 ? "Loading agents\u2026" : "No agents yet." }),
+    /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(ThemedText, { dimColor: !0, children: pending4 ? "Loading agents\u2026" : "No agents yet." }),
     /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(ThemedBox_default, { flexGrow: 1 })
   ] }), /* @__PURE__ */ (0, import_jsx_runtime360.jsx)(ThemedBox_default, { flexDirection: "column", tabIndex: 0, autoFocus: !0, onKeyDown, children: /* @__PURE__ */ (0, import_jsx_runtime360.jsxs)(
     ThemedBox_default,
@@ -488058,7 +488222,7 @@ function BashPermissionRequestInner({
     sandboxingEnabled: sandboxingEnabled_0,
     isSandboxed: isSandboxed_0
   } = (0, import_react227.useMemo)(() => {
-    let destructiveWarning = getFeatureValue_CACHED_MAY_BE_STALE2("tengu_destructive_command_warning", !1) ? getDestructiveCommandWarning(command8) : null, sandboxingEnabled = SandboxManager2.isSandboxingEnabled(), isSandboxed = sandboxingEnabled && shouldUseSandbox(toolUseConfirm.input);
+    let destructiveWarning = getFeatureValue_CACHED_MAY_BE_STALE2("tengu_destructive_command_warning", !1) ? getDestructiveCommandWarning(command8) : null, sandboxingEnabled = SandboxManager2.isSandboxingEnabled(), engineLane = wasGateArmed(toolUseConfirm.toolUseID), isSandboxed = sandboxingEnabled && !engineLane && shouldUseSandbox(toolUseConfirm.input);
     return {
       destructiveWarning,
       sandboxingEnabled,
@@ -488205,6 +488369,7 @@ var import_compiler_runtime256, import_react227, import_jsx_runtime397, init_Bas
     init_bashClassifier();
     init_PermissionUpdate();
     init_sandbox_adapter();
+    init_armedGateRegistry2();
     init_select();
     init_ShimmerChar();
     init_useShimmerAnimation();
@@ -510413,7 +510578,7 @@ function _temp158() {
 }
 var import_compiler_runtime307, import_react317, SETTINGS_ERRORS_NOTIFICATION_KEY, init_useSettingsErrors = __esm({
   "build-src/src/hooks/notifs/useSettingsErrors.tsx"() {
-    import_compiler_runtime307 = __toESM(require_compiler_runtime()), import_react317 = __toESM(require_react());
+    import_compiler_runtime307 = __toESM(require_compiler_runtime(), 1), import_react317 = __toESM(require_react(), 1);
     init_notifications2();
     init_state();
     init_allErrors();
@@ -513247,8 +513412,8 @@ function REPL({
   (0, import_react336.useEffect)(() => {
     let unregister = registerTranscriptSystemNoticeSink((text2) => {
       setMessages((prev) => [...prev, createSystemMessage(text2, "warning")]);
-    }), pending3 = drainPendingCcImportBootNotice();
-    pending3 !== null && setMessages((prev) => [...prev, createSystemMessage(pending3, "info")]);
+    }), pending4 = drainPendingCcImportBootNotice();
+    pending4 !== null && setMessages((prev) => [...prev, createSystemMessage(pending4, "info")]);
     let crashConverged = drainPendingCrashConvergedNotice();
     return crashConverged !== null && setMessages((prev) => [...prev, createSystemMessage(crashConverged, "warning")]), unregister;
   }, [setMessages]);
@@ -514082,8 +514247,8 @@ Error: sandbox required but unavailable: ${reason}
     }
   }, [onQueryImpl, setAppState, resetLoadingState, queryGuard, mrOnBeforeQuery, mrOnTurnComplete]), initialMessageRef = (0, import_react336.useRef)(!1);
   (0, import_react336.useEffect)(() => {
-    let pending3 = initialMessage;
-    if (!pending3 || isLoading || initialMessageRef.current) return;
+    let pending4 = initialMessage;
+    if (!pending4 || isLoading || initialMessageRef.current) return;
     initialMessageRef.current = !0;
     async function processInitialMessage(initialMsg) {
       if (initialMsg.clearContext) {
@@ -514151,7 +514316,7 @@ Error: sandbox required but unavailable: ${reason}
         ref.current = !1;
       }, 100, initialMessageRef);
     }
-    processInitialMessage(pending3);
+    processInitialMessage(pending4);
   }, [initialMessage, isLoading, setMessages, setAppState, onQuery, mainLoopModel, tools]);
   let onAgentSubmitRef = (0, import_react336.useRef)(null), onSubmit = (0, import_react336.useCallback)(async (input, helpers, speculationAccept, options) => {
     if (repinScroll(), !speculationAccept && !input.trim().startsWith("/")) {
@@ -515041,9 +515206,9 @@ Note: ctrl + z now suspends Sema, ctrl + _ undoes input.
       hasAcknowledgedCostThreshold: !0
     }));
   } }), idleReturnDialog = focusedInputDialog === "idle-return" && idleReturnPending && /* @__PURE__ */ (0, import_jsx_runtime489.jsx)(IdleReturnDialog, { idleMinutes: idleReturnPending.idleMinutes, totalInputTokens: getTotalInputTokens(), onDone: async (action) => {
-    let pending3 = idleReturnPending;
-    if (setIdleReturnPending(null), Math.round(pending3.idleMinutes), messagesRef.current.length, getTotalInputTokens(), action === "dismiss") {
-      setInputValue(pending3.input);
+    let pending4 = idleReturnPending;
+    if (setIdleReturnPending(null), Math.round(pending4.idleMinutes), messagesRef.current.length, getTotalInputTokens(), action === "dismiss") {
+      setInputValue(pending4.input);
       return;
     }
     if (action === "never" && saveGlobalConfig((current6) => current6.idleReturnDismissed ? current6 : {
@@ -515063,7 +515228,7 @@ Note: ctrl + z now suspends Sema, ctrl + _ undoes input.
         setConversationId
       }), haikuTitleAttemptedRef.current = !1, setHaikuTitle(void 0), bashTools.current.clear(), bashToolsProcessedIdx.current = 0;
     }
-    skipIdleCheckRef.current = !0, onSubmitRef.current(pending3.input, {
+    skipIdleCheckRef.current = !0, onSubmitRef.current(pending4.input, {
       setCursorOffset: () => {
       },
       clearBuffer: () => {
@@ -530250,8 +530415,8 @@ async function cloudPublishApprove(options) {
   try {
     let ctx = await resolveCtx(options.profile), space = options.space ?? ctx.activeScope, { status: ps, json: pj } = await api(ctx, `/api/v1/scopes/${encodeURIComponent(space)}/publish/pending`);
     if (ps !== 200) throw adminHttpError(ctx, ps, pj, `reading the pending publish request of space '${space}'`, "the v1 publish API");
-    let pending3 = asRec2(pj.pending);
-    if (pending3 || (err4(`Error: space '${space}' has no pending publish request \u2014 nothing to approve. Open one: sema cloud publish --space ${space}`), process.exit(1)), out2(`Pending publish request \xB7 space '${space}' \xB7 ${ctx.registryUrl}`), out2(`  requested by ${asStr3(pending3.requestedBy) ?? "?"} at ${asStr3(pending3.requestedAt) ?? "?"} (draft v${asNum2(pending3.draftVersion) ?? "?"})`), out2(`  approvals so far: ${asNum2(pending3.approvals) ?? 0}${asArr2(pending3.approvedBy).length > 0 ? ` (${asArr2(pending3.approvedBy).join(", ")})` : ""}`), out2("  approving may RELEASE the draft to every member of this space (when yours is the final approval)."), !await confirmDanger(`Approve the publish request for space '${space}'?`, options.yes)) {
+    let pending4 = asRec2(pj.pending);
+    if (pending4 || (err4(`Error: space '${space}' has no pending publish request \u2014 nothing to approve. Open one: sema cloud publish --space ${space}`), process.exit(1)), out2(`Pending publish request \xB7 space '${space}' \xB7 ${ctx.registryUrl}`), out2(`  requested by ${asStr3(pending4.requestedBy) ?? "?"} at ${asStr3(pending4.requestedAt) ?? "?"} (draft v${asNum2(pending4.draftVersion) ?? "?"})`), out2(`  approvals so far: ${asNum2(pending4.approvals) ?? 0}${asArr2(pending4.approvedBy).length > 0 ? ` (${asArr2(pending4.approvedBy).join(", ")})` : ""}`), out2("  approving may RELEASE the draft to every member of this space (when yours is the final approval)."), !await confirmDanger(`Approve the publish request for space '${space}'?`, options.yes)) {
       out2("Cancelled \u2014 the request is still pending.");
       return;
     }
@@ -531864,9 +532029,9 @@ function domainDiffLine(kind, draftValue, pubValue) {
 async function runPublish(ctx, yes, standalone) {
   let publishPath = `/api/v1/scopes/${encodeURIComponent(ctx.space)}/publish`, { status: status3, json: json2 } = await teamFetch(ctx, publishPath);
   if (status3 !== 200) throw await teamHttpError(ctx, status3, json2, `reading the publish state of space '${ctx.space}'`, "member (any role)");
-  let publishedMeta = asRec3(json2.published), pending3 = asRec3(json2.pending), approvalsRequired = typeof json2.approvalsRequired == "number" ? json2.approvalsRequired : void 0, approvalsDisplay = approvalsRequired ?? "?", mayRequireApprovals = approvalsRequired === void 0 || approvalsRequired > 0;
-  if (pending3) {
-    out4(`Space '${ctx.space}' already has a PENDING publish request \u2014 the draft is NOT live yet:`), out4(`  requested by ${asStr4(pending3.requestedBy) ?? "?"} at ${asStr4(pending3.requestedAt) ?? "?"} (draft v${pending3.draftVersion ?? "?"})`), out4(`  approvals: ${typeof pending3.approvals == "number" ? pending3.approvals : 0}/${approvalsDisplay} \u2014 approvers act via POST ${publishPath}/approve (or the web console)`), out4("  a new publish request cannot be opened until this one is approved or withdrawn."), standalone && process.exit(1);
+  let publishedMeta = asRec3(json2.published), pending4 = asRec3(json2.pending), approvalsRequired = typeof json2.approvalsRequired == "number" ? json2.approvalsRequired : void 0, approvalsDisplay = approvalsRequired ?? "?", mayRequireApprovals = approvalsRequired === void 0 || approvalsRequired > 0;
+  if (pending4) {
+    out4(`Space '${ctx.space}' already has a PENDING publish request \u2014 the draft is NOT live yet:`), out4(`  requested by ${asStr4(pending4.requestedBy) ?? "?"} at ${asStr4(pending4.requestedAt) ?? "?"} (draft v${pending4.draftVersion ?? "?"})`), out4(`  approvals: ${typeof pending4.approvals == "number" ? pending4.approvals : 0}/${approvalsDisplay} \u2014 approvers act via POST ${publishPath}/approve (or the web console)`), out4("  a new publish request cannot be opened until this one is approved or withdrawn."), standalone && process.exit(1);
     return;
   }
   let lines = [], draftVersion;
@@ -542120,7 +542285,7 @@ Usage: sema --remote "your task description"`, () => gracefulShutdown(1));
         pendingHookMessages
       }, renderAndRun);
     }
-  }).version("sema 1.0.97", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
+  }).version("sema 1.0.98", "-v, --version", "Output the version number"), program2.option("-w, --worktree [name]", "Create a new git worktree for this session (optionally specify a name)"), program2.option("--tmux", "Create a tmux session for the worktree (requires --worktree). Uses iTerm2 native panes when available; use --tmux=classic for traditional tmux."), canUserConfigureAdvisor() && program2.addOption(new Option("--advisor <model>", "Enable the server-side advisor tool with the specified model (alias or full ID).").hideHelp()), program2.addOption(new Option("--bg, --background", "Start the session as a background agent and return immediately (manage with `sema agents`)")), program2.command("ps").description("List background sessions").action(async () => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).psHandler([]), process.exit(process.exitCode ?? 0);
   }), program2.command("logs [id]").description("Print a background session's recent terminal output").action(async (id) => {
     await (await Promise.resolve().then(() => (init_bg2(), bg_exports))).logsHandler(id, []), process.exit(process.exitCode ?? 0);
@@ -544530,6 +544695,25 @@ var PUMP_SOURCE, init_teamMcpPump = __esm({
   }
 });
 
+// build-src/src/sema/mcpDisabledFilter.ts
+function filterDisabledMcpServers(servers, isDisabled) {
+  let out6 = {};
+  for (let [name, cfg] of Object.entries(servers)) {
+    let disabled = !0;
+    try {
+      disabled = isDisabled(name);
+    } catch {
+      disabled = !0;
+    }
+    disabled || (out6[name] = cfg);
+  }
+  return out6;
+}
+var init_mcpDisabledFilter = __esm({
+  "build-src/src/sema/mcpDisabledFilter.ts"() {
+  }
+});
+
 // build-src/src/sema/mcpWire.ts
 var mcpWire_exports = {};
 __export(mcpWire_exports, {
@@ -544542,7 +544726,7 @@ __export(mcpWire_exports, {
 async function loadMcpSpecs() {
   try {
     let { servers } = await getAllMcpConfigs();
-    return mcpConfigsToSpecs(servers);
+    return mcpConfigsToSpecs(filterDisabledMcpServers(servers, isMcpServerDisabled));
   } catch {
     return [];
   }
@@ -544586,6 +544770,7 @@ async function loadMcpConfigFlagSpecs(argv) {
 var init_mcpWire = __esm({
   "build-src/src/sema/mcpWire.ts"() {
     init_config3();
+    init_mcpDisabledFilter();
     init_dist();
     init_dist();
   }
@@ -544632,7 +544817,8 @@ async function tryCloudWires() {
   }
 }
 async function injectSkillsAndMcpWires(cwd5, opts = {}) {
-  if (await tryCloudWires()) return;
+  let { enableConfigs: enableConfigs2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+  if (enableConfigs2(), await tryCloudWires()) return;
   let skillsWire = (async () => {
     if (process.env.SEMA_NO_SKILLS_WIRE !== "1")
       try {
@@ -547832,8 +548018,8 @@ var IDLE_EXIT_MS, DISPATCH_SCAN_MS, DAEMON_LOG_ROTATE_BYTES, ADOPTED_SWEEP_MS, C
           if (isPidAlive(adoptedWorker.pid)) return { ok: !1, code: "short-alive" };
           this.adopted.delete(short);
         }
-        let pending3 = this.pendingRespawns.get(short);
-        pending3 && (clearTimeout(pending3), this.pendingRespawns.delete(short));
+        let pending4 = this.pendingRespawns.get(short);
+        pending4 && (clearTimeout(pending4), this.pendingRespawns.delete(short));
         let existing = await readJobState(short);
         if (existing?.pid && existing.pid > 1) {
           let alive = !1;
@@ -549028,7 +549214,7 @@ async function launchReplProduction() {
         }
       if (process.env.SEMA_NO_REWIND_CAPTURE !== "1")
         try {
-          let { getGlobalConfig: getGlobalConfig5 } = await Promise.resolve().then(() => (init_config(), config_exports)), { setSeamRewindCapture: setSeamRewindCapture2 } = await Promise.resolve().then(() => (init_seamQuery(), seamQuery_exports)), enabled = getGlobalConfig5().fileCheckpointingEnabled !== !1;
+          let { semaFileCheckpointingEnabled: semaFileCheckpointingEnabled2 } = await Promise.resolve().then(() => (init_settings_187(), settings_187_exports)), { setSeamRewindCapture: setSeamRewindCapture2 } = await Promise.resolve().then(() => (init_seamQuery(), seamQuery_exports)), enabled = semaFileCheckpointingEnabled2() !== !1;
           setSeamRewindCapture2(enabled), process.env.SEMA_DEBUG && console.error(`[sema] rewind capture wire: ${enabled ? "on" : "off"} (per-turn rewindFiles snapshot)`);
         } catch (eRw) {
           process.env.SEMA_DEBUG && console.error("[sema] rewind capture wire soft-failed:", eRw);