@sema-agent/client-core 0.100.0 → 0.101.0

package/dist/i18n/messages.en.js

@@ -190,13 +190,33 @@ const EN = {
     'config.mcp.transportDegraded': 'MCP server {name}{where} was started without part of its transport settings, which cannot be used as written: {lost}. The rest of its settings are applied; fix the settings named above to get them applied too.',
     'config.mcp.toolAxesInvalid': 'MCP server {name}{where} was not started: its toolAxes setting is not valid — {problem}. Fix the toolAxes entry for this server (or remove it); the other MCP servers are unaffected.',
     'config.mcp.toolAxesFallbackProblem': 'the declaration is not a valid set of per-tool safety settings',
+    'config.mcp.toolFacesInvalid': 'MCP server {name}{where} was not started: its toolFaces setting is not valid — {problem}. Fix the toolFaces entry for this server (or remove it); the other MCP servers are unaffected.',
+    'config.mcp.toolFacesFallbackProblem': 'the declaration is not a valid set of per-tool display and approval settings',
+    'config.mcp.toolFacesUnreadable': 'the setting could not be read (a getter or proxy trap on it threw)',
     'config.mcp.elicitationInvalid': 'MCP server {name}{where} was not started: its elicitation setting must be true or false. Fix the elicitation entry for this server (or remove it); the other MCP servers are unaffected.',
+    'config.mcp.entryNotObject': 'MCP server {name}{where} was not started: its entry in the configuration is not an object. An MCP server entry must be an object with a command (a local server) or a url (a remote server). Fix or remove the entry; the other MCP servers are unaffected.',
+    'config.mcp.entryUnreadable': 'MCP server {name}{where} was not started: its entry in the configuration could not be read (a getter or proxy trap on it threw). Fix or remove the entry; the other MCP servers are unaffected.',
+    'config.mcp.entryNotObjectProblem': 'the entry is not an object (an object with a command or a url is expected)',
+    'config.mcp.transportTypeUnsupported': 'this transport type cannot be carried on the request (only stdio and http are supported)',
+    'config.mcp.transportIdentityBothSetProblem': 'both principalHeader and assertionHeader are set, and they name the same identity header — keep only one of the two',
+    'config.mcp.allowToolsInvalid': 'MCP server {name}{where} was not started: its allowTools setting cannot be used — {problem}. Fix the allowTools entry for this server (a list of tool-name strings); the other MCP servers are unaffected.',
+    'config.mcp.allowToolsNotArray': '{path} must be an array of strings (got {got})',
+    'config.mcp.allowToolsElementNotString': '{path} must be a string (got {got})',
+    'config.mcp.allowToolsHole': '{path} is missing: a list with gaps is not allowed, every position must hold a string',
+    'config.mcp.allowToolsUnreadable': '{path} could not be read (a getter or proxy trap on it threw)',
+    'config.mcp.allowToolsTooMany': '{path} has too many entries to check (more than {got})',
     'config.mcp.cloudElicitationInvalid': 'cloud config: MCP server entries left out because their elicitation setting is not true or false — fix or remove the elicitation entry: {who}',
+    'config.mcp.cloudAllowToolsInvalid': 'cloud config: MCP server entries left out because their allowTools setting is not a list of tool-name strings — fix the allowTools entry: {who}',
+    'config.mcp.cloudEntryUnreadable': 'cloud config: MCP server entries left out because the entry could not be read (a getter or proxy trap on it threw) — fix or remove the entry: {who}',
     'config.mcp.cloudToolAxesInvalid': 'cloud config: MCP server entries left out because their toolAxes setting is not valid (per-tool safety overrides take only effect, egress and irreversibility, each with a legal value) — fix or remove the toolAxes entry: {who}',
+    'config.mcp.cloudToolFacesInvalid': 'cloud config: MCP server entries left out because their toolFaces setting is not valid (per-tool display and approval settings) — fix or remove the toolFaces entry: {who}',
     'config.mcp.cloudNameUnusable': 'cloud config: MCP server entries left out because their names cannot be used as written (a name over 128 characters, or with leading or trailing whitespace) — fix the names: {who}',
     'config.mcp.cloudTransportInvalid': 'cloud config: MCP server entries left out because their transport setting cannot be used by the engine as written (for example an address that is not an http(s) URL) — fix the transport setting: {who}',
     'config.mcp.cloudTransportDegraded': 'cloud config: MCP server entries started without part of their transport settings, which cannot be used as written (the named settings were left out, the rest are applied) — fix the named settings: {who}',
     'config.mcp.cloudTransportDegradedUnreadable': 'cloud config: the list of MCP server entries started with part of their settings left out could not be read by this client — a server may be running without some of its configured settings and without notice',
+    'config.skills.cloudToolListInvalid': 'cloud config: skills left out because their allowedTools or disallowedTools list is not a list of strings (a skill list is sent as written or not at all, never trimmed) — fix or remove the list: {who}',
+    'config.skills.cloudDroppedUnreadable': 'cloud config: the list of skills left out because of an unusable tool list could not be read by this client — a skill may be missing without notice',
+    'config.skills.toolListTooMany': 'has too many entries to check (more than {got}) — the list is refused rather than read in part or cut down',
     'approval.boundGrants.notActivated.one': "Approving this does not activate the skill shown on the card: 1 entry on its refuse list reads as nothing, and the engine does not drop a refusal it cannot read, so the skill's instructions are not loaded and nothing it lists is granted.",
     'approval.boundGrants.notActivated.other': "Approving this does not activate the skill shown on the card: {count} entries on its refuse list read as nothing, and the engine does not drop a refusal it cannot read, so the skill's instructions are not loaded and nothing it lists is granted.",
     'approval.boundGrants.listsNoToolsWithNothing.one': 'Approving this activates the skill shown on the card; it lists no tools to run without asking and none to refuse. 1 listed entry reads as nothing and grants nothing.',
@@ -217,6 +237,13 @@ const EN = {
     'approval.settle.cause.broadcastLost': 'it never reached any open connection',
     'approval.settle.cause.streamDisconnected': 'the connection carrying this card dropped',
     'approval.settle.cause.undeliverable': 'it could not be delivered to any approval surface',
+    'approval.decision.grantChanged': 'The engine refused this approval because the skill grant it was bound to has changed since the card was shown · Nothing was decided and the request is still waiting, but approving it again will be refused the same way · Deny this request so the model can activate the skill again',
+    'approval.decision.settledElsewhereContrary.deniedFirst': 'This request was already answered elsewhere and denied, so your approval did not take effect.',
+    'approval.decision.settledElsewhereContrary.approvedFirst': 'This request was already answered elsewhere and approved, so your denial did not take effect.',
+    'approval.decision.unconfirmedAfterRetry': "It is not known whether your answer took effect: an earlier attempt to send it was not confirmed, and by the time it was sent again the request was no longer waiting · Check the task's current state before acting on it",
+    'notice.decide.rowUnrevivable': 'The engine can no longer recover this approval card, so neither approving nor denying it will take effect · The card can only be cleared on the server side — wait for that, or contact whoever operates the engine',
+    'approval.askPark.autoReopenBlocked.policyInteractive': "The engine's admission policy refused to resume this parked step (run {run}), so sema will not put its card back on screen by itself. Switch to a permission mode this deployment allows, or ask whoever operates the deployment, then send a message to bring the card back.",
+    'approval.askPark.autoReopenBlocked.policyPrint': "The engine's admission policy refused to resume this parked step (run {run}), so sema will not put its card back on screen by itself. Switch to a permission mode this deployment allows, or ask whoever operates the deployment, then send a message to bring the card back; or stop the run ({cancel}).",
     'approval.settle.subject.named': 'the approval request for {tool}',
     'approval.settle.subject.generic': 'this approval request',
     'approval.settle.endedKnown': '{subject} ended on the engine without an answer: {clause}. Nothing was approved from this card; if the step is still needed, ask for it again.',
@@ -270,10 +297,17 @@ const EN = {
     'resume.reopen.first.toolContractMismatch': 'The tool this approval was granted for has changed since the approval was recorded',
     'resume.reopen.content': '{first} · The engine re-parked the work before consuming anything — the approval is still pending and your decision was not consumed · Re-fetch the pending approvals and decide again on an engine where the same tool is available',
     'session.inheritEnv.notConfirmed': 'The engine has not confirmed that it withholds its own credentials from tool shells, so the tool shell gets a filtered environment (credential-looking variables such as GH_TOKEN are omitted) until the engine is upgraded.',
+    'session.inheritEnv.valuesNotConfirmed': 'The engine keeps its own credential variables out of tool shells but has not confirmed that it also keeps out copies of them under other names (such as a model key you also exported as OPENAI_API_KEY), so the tool shell gets a filtered environment (credential-looking variables such as GH_TOKEN are omitted) until the engine confirms that.',
     'session.inheritEnv.withheld.all': "Not sent with this request: the engine's version is not known yet, and an engine that does not know the setting that lets the shell inherit this machine's whole environment refuses the whole request, so it was held back; this run's shell gets the default environment, with credential-like variables removed, and on an engine that does know the setting, leaving it out also clears an earlier whole-environment choice for this session.",
     'session.inheritEnv.withheld.scrub': "Not sent with this request: the engine's version is not known yet, so the default-environment setting was left out; that has the same effect, because leaving it out also gives this run the default environment (credential-like variables removed).",
     'session.inheritEnv.withheld.unknown': 'Not sent with this request: the shell-environment setting was held back for a reason this version does not recognize.',
     'session.inheritEnv.refusal': "The engine refused this request as invalid, under a refusal code that many different request fields share · This request asked for the shell to inherit this machine's whole environment, which the engine accepts only when tools run directly on its own machine and the request belongs to a session; if that is what it refused, send it again without that setting (or with the default)",
+    'session.inheritEnv.refusalNamed': "The engine refused the setting that lets the shell inherit this machine's whole environment, which it accepts only when tools run directly on its own machine and the request belongs to a session · Send the request again without that setting (or with the default)",
+    'session.projectMemory.withheld.absent': 'Not sent with this request: this engine does not declare support for the setting that stops project instruction files from being read, and an engine that does not know it refuses the whole request, so it was held back; those files are still sent to the model.',
+    'session.projectMemory.withheld.declined': 'Not sent with this request: this engine declares that it does not support the setting that stops project instruction files from being read, so it was held back; those files are still sent to the model.',
+    'session.projectMemory.withheld.unreadable': "Not sent with this request: the engine's capabilities could not be read, so it is not known whether it supports the setting that stops project instruction files from being read, and an engine that does not know it refuses the whole request, so it was held back; those files are still sent to the model.",
+    'session.projectMemory.withheld.unknown': 'Not sent with this request: the setting that stops project instruction files from being read was held back for a reason this version does not recognize.',
+    'session.policy.withheld.namespaceCoveringUnconfirmed': 'Not written to this session’s rule record: this rule names a server or agent peer as a whole, or a group of its tools by pattern, and the engine has not confirmed that this record reads such a rule as a group — an engine that matches the record by exact tool name would block none of those tools.',
     'session.fileHistoryLeg.notHonored': 'The engine is still capturing file history for this session, though your settings asked it not to.',
     'resume.refusal.placementMismatch': 'This resume named a different placement root than the one recorded when the work was parked · The engine refused it before consuming anything — the parked work is untouched · Retry with the recorded root, or omit the placement root to inherit it',
     'resume.refusal.preflightWaitable': "The deployment's resume preflight refused this attempt · The refusal happened before the commit — your decision was not consumed · The engine supplied a wait, so this token stays redeemable once the obstacle clears",
@@ -355,6 +389,7 @@ const EN = {
     'session.selfHeal.injected.resendingInferred': '{lead} was held back because this session was busy with an earlier reply{id}; that reply is now reported as finished, so sema is sending the message now — nothing for you to do (if the session has not quite freed up yet, it may be held back once more).',
     'session.selfHeal.injected.handedOffFollowing': '{lead} was passed to the reply already in progress{id} instead of starting a new one. sema is following that reply and will show whatever it asks for next; nothing for you to do now.',
     'session.selfHeal.injected.handedOffWatch': '{lead} was passed to the reply already in progress{id} instead of starting a new one — watch that reply for what it does with it.',
+    'session.selfHeal.injected.interruptedFinishing': '{lead} was not delivered: the earlier reply{id} that was stopped is still finishing, so sema did not send it and did not retry — the model has not seen it. Give it a moment, then try again.',
     'session.selfHeal.injected.notDelivered': '{lead} was not delivered: this session was still busy with an earlier reply{id}, and there was no open card you could answer to free it{noView}. sema did not retry, so the model has not seen it.',
     'session.selfHeal.decisionInFlight': 'The previous turn is parked {parkedOn} and your answer to that card is still on its way to the engine, so sema did not show the card again — answering it a second time would send a second decision. It did NOT cancel the run. Your message was NOT sent; send it again in a moment, once the engine has applied that decision.',
     'session.selfHeal.parkedOn.ask': 'waiting for your decision (run {taskId})',
@@ -372,7 +407,7 @@ const EN = {
     'session.selfHeal.row.planReopenFailed.dismissed': 'The previous turn is parked waiting for a plan review (run {taskId}), and you closed its approval card — {closed}. It did NOT cancel the run — that would have discarded the plan for you. Your message was NOT sent; send it again to bring the card back.',
     'session.selfHeal.row.planReopenFailed.withKeep': 'The previous turn is parked waiting for a plan review (run {taskId}) and sema could not reopen that approval card{noView}. It did NOT cancel the run — that would have discarded the plan for you. Your message was NOT sent. To keep this conversation, {keep}: the card comes back when the session resumes, if it is still waiting. Or {wayOut} if you no longer want that plan.{viaEngine}',
     'session.selfHeal.row.planReopenFailed.noKeep': 'The previous turn is parked waiting for a plan review (run {taskId}) and sema could not reopen that approval card{noView}. It did NOT cancel the run — that would have discarded the plan for you. Your message was NOT sent; {wayOut} if you no longer want that plan.{viaEngine}',
-    'session.selfHeal.row.steered.textOnly': 'Only the TEXT of your message was handed over — a steer carries no attachments, so any images in that submission were NOT sent.',
+    'session.selfHeal.row.steered.textOnly': 'Only the TEXT of your message was handed over — if that submission also had images or attachments, they were NOT sent.',
     'session.selfHeal.row.steered.tail.following': 'sema is following that run and will surface whatever it asks for next.',
     'session.selfHeal.row.steered.tail.watch': 'watch that run for what it does with it.',
     'session.selfHeal.row.steered.unknownTail.following': 'sema is following that run and will surface whatever it asks for next before you send it again.',
@@ -417,6 +452,8 @@ const EN = {
     'session.selfHeal.row.stateUnknown': "A run is still active on this session{handle} and sema could not read that run's state, so it did not touch it ({detail}). sema did NOT send your message: this session cannot start a new turn until that run settles — {wayOut}.",
     'session.selfHeal.headless.status': ' (status {status})',
     'session.selfHeal.endRun.engine': 'cancel that run on the engine ({cancelPath})',
+    'session.selfHeal.endRun.engineInteractive': 'end run {taskId} on the engine',
+    'session.selfHeal.endRun.engineInteractive.noId': 'end that run on the engine',
     'session.selfHeal.wakeOn.engine': ' (POST /v1/sessions/:id/wake)',
     'session.selfHeal.wakeOn.host': ' ({where})',
     'session.selfHeal.headless.decide': 'This session is held by an earlier run{handle}{status} that is parked waiting on {gate}, so this message was NOT sent. Decide it and the session unlocks: POST {decidePath}. Ending that run instead also unlocks it, but it decides that item against you: {endRun}. Or {freshSession}.{governance}',
@@ -465,6 +502,8 @@ const EN = {
     'approval.mandate.word.probeUnanswered': 'the check run on this call did not answer (it timed out or failed; this client cannot tell which), so whether the call stays inside the directories allowed for this session is unknown',
     'approval.mandate.word.writeProtection': "this change lands on a protected location (the agent's own configuration), which is confirmed one change at a time",
     'approval.mandate.word.targetUnresolved': 'where this change lands on disk could not be determined (a link on the way could not be examined, or the target could not be resolved), so whether it lands on a guarded location is unknown',
+    'approval.mandate.word.crossBoundaryTaint': "this run executes on a device outside the deployment's trust boundary and the deployment serves several tenants, so a write on the organisation's side — or a call bound for the device after a read from somewhere else — is confirmed by the deployment's approver for this call alone",
+    'approval.mandate.wayOut.crossBoundaryTaint': "an allow that comes from configuration — a setting that allows everything, or a policy's own answer — is refused for this call, so what you approve or deny here is what settles it",
     'approval.mandate.unknownWord': 'the reason reported for this confirmation is not one this client recognises, so it shows no reason',
     'approval.card.payloadUnreadable': 'This client cannot read the format of this approval card, so only its basic facts are shown — decide from those, or deny it if you are not sure what it will do.',
     'approval.card.more.one': '1 more reason for this card is not shown.',
@@ -508,6 +547,22 @@ const EN = {
     'session.fileHistoryRefusal.unrecognized': 'Nothing was sent: file checkpointing is turned off in your settings, but this engine reported a file-history capture mode this client does not recognize, so whether it can stop recording file history for a session is unknown and sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.',
     'session.fileHistoryRefusal.unreadable': "Nothing was sent: file checkpointing is turned off in your settings, but this engine's report on whether it can stop recording file history for a session could not be read by this client, so sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.",
     'session.hostSettings.memorySwitchMalformed': 'The memory setting in your settings file could not be read, so turning memory off was not applied: this request was sent with memory available. Fix the memory section (memory.enabled must be true or false) to turn it off.',
+    'session.hostSettings.fileHistoryRestoreConflict': 'Nothing was sent: file checkpointing was turned off in your settings after this request was prepared, but this request also restores files from a checkpoint, and a request cannot do both. To restore the files, turn file checkpointing back on in your settings; otherwise send the request without the file restore.',
+    'session.hostSettings.projectionUnchecked': 'The settings for this request could not be checked before sending, so the request is not sent. Reload your settings and try again.',
+    'session.hostSettings.projectionUncheckedPortsMissing': 'The settings for this request could not be checked before sending, so the request is not sent: this app has not installed the permission rule checks it needs ({ports}). Reloading your settings will not fix this; the app needs to install them.',
+    'session.hostSettings.projectionUncheckedJudgeFailed': 'The settings for this request could not be checked before sending, so the request is not sent: the permission rule check this app installed failed while checking them. Reloading your settings will not fix this; the app needs to fix that check.',
+    'session.hostSettings.managedUnreadable': "Nothing was sent: your administrator's managed settings could not be read right now, so the restrictions they set cannot be applied. Requests are sent again once the managed settings can be read.",
+    'session.hostSettings.layerNotLoaded.hold.unreadable': '{layer} could not be read, so the rules and hooks in that file would not apply to this request. Continue without these settings, or cancel and fix the file first.',
+    'session.hostSettings.layerNotLoaded.hold.rejected': '{layer} were not loaded because a hook guarding tool use in that file is malformed, so the rules and hooks in that file would not apply to this request. Continue without these settings, or cancel and fix the file first.',
+    'session.hostSettings.layerNotLoaded.sent.unreadable': '{layer} could not be read: this request was sent without the rules and hooks in that file.',
+    'session.hostSettings.layer.policySettings': 'Managed settings',
+    'session.hostSettings.layer.userSettings': 'Your user settings',
+    'session.hostSettings.layer.projectSettings': 'The project settings',
+    'session.hostSettings.layer.localSettings': 'The local project settings',
+    'session.hostSettings.layer.flagSettings': 'The settings passed at launch',
+    'session.hostSettings.heldPrevious': 'A settings file could not be read cleanly just now (it may be in the middle of being saved), so the permission rules from the last clean read are still applied.',
+    'session.hostSettings.styleMissing': 'The output style "{name}" selected in your settings could not be found or read, so it is not applied to this request.',
+    'session.hostSettings.styleSafeMode': 'Safe mode is on, so the output style from your settings is not applied.',
     'model.identity.lane.processEnv': 'the environment this client was started with',
     'model.identity.lane.settingsEnv': "this client's settings file",
     'model.identity.lane.modelCatalogFile': 'the local model catalog file',
@@ -524,6 +579,11 @@ const EN = {
     'notice.injectionLane.item.credentialedMcp': 'MCP servers that use credentials from this machine',
     'notice.injectionLane.item.taskHooks': 'hooks',
     'notice.injectionLane.itemSeparator': ', ',
+    'notice.wayOut.checkCredentials': 'The model service rejected the credentials this run used — check them, then try again',
+    'notice.wayOut.checkCredentialsFrom': 'The model service rejected the credentials this run used (source: {source}) — check them, then try again',
+    'notice.wayOut.switchModel': 'The model service cannot serve this request right now — try another model',
+    'notice.wayOut.wait': 'The model service is still working on this request — wait a moment, then try again',
+    'notice.wayOut.fixRequest': 'The model service refused this request — change the request before sending it again; sending it as it is will not help',
     'rules.refusal.sentence.one': 'permissions: 1 rule will not be enforced — {list}',
     'rules.refusal.sentence.other': 'permissions: {count} rules will not be enforced — {list}',
     'rules.refusal.item': '{rule} ({reason})',
@@ -531,6 +591,10 @@ const EN = {
     'rules.refusal.list.more': '{shown} and {count} more',
     'rules.refusal.reason.toolName': 'its tool name is not one this engine recognizes',
     'rules.refusal.reason.homePath': 'it uses a ~/ path this engine cannot anchor — write the path relative to the project or as an absolute path',
+    'rules.refusal.reason.neverMatches': 'this rule form cannot match as a deny or ask rule for this tool, so the engine would never apply it — to block the tool altogether, write its name alone',
+    'rules.nearMiss.sentence.one': 'permissions: 1 rule names a tool by a spelling no tool of this run answers to, so it can never match — {list}',
+    'rules.nearMiss.sentence.other': 'permissions: {count} rules name a tool by a spelling no tool of this run answers to, so they can never match — {list}',
+    'rules.nearMiss.reason': 'write the name as "{mounted}"',
     'config.agentsWire.refusedServer.sentence': 'agents wire: {who}: its tools entry {entry} names a tool of the MCP server {server}, which {cause} — sent as written; this entry gives the agent nothing while that server stays out of the run. {way}',
     'config.agentsWire.refusedServer.cause.rejected': 'was declined for this project and so is left out of this run',
     'config.agentsWire.refusedServer.cause.notApproved': 'is not approved for this project and so is left out of this run',
@@ -560,6 +624,13 @@ const EN = {
     'config.hooks.forWire.planPassedBare': 'hooksForWire: pass { plan } with the plan returned by hooksWirePlan() for this turn — the plan itself was passed; wrap it as { plan }.',
     'config.hooks.forWire.planMissing': 'hooksForWire: pass { plan } with the plan returned by hooksWirePlan() for this turn — opts.plan is missing.',
     'config.hooks.forWire.planNotPlan': 'hooksForWire: pass { plan } with the plan returned by hooksWirePlan() for this turn — opts.plan is not such a plan (got {shape}).',
+    'config.hooks.salvage.managedPartial': '{layer}: {what}. Because these are managed hooks, requests are not sent until the managed settings are fixed; ask your administrator to fix them.',
+    'config.hooks.httpPolicy.urlNotListed': "HTTP hook blocked: {url} does not match any pattern in allowedHttpHookUrls ({layer}) (a pattern's * matches within one URL part) — this {event} hook does not run.",
+    'config.hooks.httpPolicy.urlListEmpty': 'HTTP hook blocked: allowedHttpHookUrls is empty ({layer}), so no HTTP hook runs — the {event} hook for {url} does not run.',
+    'config.hooks.httpPolicy.urlListMalformed': 'HTTP hook blocked: allowedHttpHookUrls is not a list of strings ({layer}), so it is read as empty and no HTTP hook runs — the {event} hook for {url} does not run.',
+    'config.hooks.httpPolicy.envListMalformed': 'HTTP hook {url} ({event}) runs without environment variables: httpHookAllowedEnvVars is not a list of strings ({layer}), so it is read as empty.',
+    'config.hooks.httpPolicy.layerUnreadable': 'HTTP hook blocked: the settings of {layer} could not be read, so its allowedHttpHookUrls cannot be checked and no HTTP hook runs — the {event} hook for {url} does not run.',
+    'config.hooks.layerWithheld.trust': '{layer}: hooks will not run — this client has no workspace-trust step, and hooks in repository-controlled settings are only allowed once the workspace is trusted. Hooks from user, flag and managed settings are unaffected.',
     'config.taskRequest.memoryOff.settingsSectionNotObject': 'memoryOffDeclared: the memory section of settings must be an object — got {shape}.',
     'config.taskRequest.memoryOff.enabledNotBoolean': 'memoryOffDeclared: memory.enabled in settings must be a boolean when present — got {shape}.',
     'config.taskRequest.inputKeysUnreadable': 'buildTaskRequest: the key set / property descriptors of the input could not be read (a proxy trap threw) — the declarations cannot be snapshotted safely, so assembly was refused. The error text reports shapes only and never echoes values.',
@@ -571,6 +642,7 @@ const EN = {
     'config.taskRequest.requireExisting.layerAssembly': 'this layer rejects it before assembly so it does not cost a round trip.',
     'config.taskRequest.requireExisting.layerLive': 'this layer (the live defaults layer) re-checks after placement: the mock session constant supplied by the host made this layer remove the session id, and there is no captured session id, while the assertion is not removed (removing it would silently open a new session when none is found) — so it is rejected before sending, without a round trip.',
     'config.taskRequest.requireExisting.noSession': '{where}: requireExistingSession: true asks to continue an existing session, but sessionId is not a session id ({shape}) — there is no session to continue. The upstream service rejects this shape too (it neither opens a new session nor continues anything); {layer} Fix: pass the id of the session to continue as sessionId; to start a new session, omit requireExistingSession (or pass false). The error text reports shapes only and never echoes values.',
+    'config.taskRequest.submissionIdentityMalformed': 'buildTaskRequest: the lane argument accepts a lane word ({lanes}) or a submission identity {surface, origin, tools} whose three slots are own data properties holding words from their closed sets (surface: {surfaces}; origin: {origins}; tools: {tools}) — got {shape}. A malformed identity yields neither a lane nor an origin, and guessing one (falling back to the interactive lane, or to "written by the user") would send a request the submitter did not describe, so it was refused before the input was read. The error text reports shapes only and never echoes values.',
     'config.assembly.thrownDuringAssembly': '{who}: an error occurred during assembly, so assembly was refused (the original thrown value is in cause).',
     'session.steerRefusal.notRunning.happened': 'that run is not accepting messages right now — it has just finished, is running on another server, or is not the active run of its session',
     'session.steerRefusal.notRunning.nextStep': 'check its current state and send the message to the run that is active',
@@ -638,6 +710,17 @@ const EN = {
     'notice.capability.hands.unknownRosterUnreadable': 'whether this run has file-and-shell tools is unknown — the tool roster could not be read in the shape this reader knows',
     'notice.capability.hands.unknownMountConditionAbsent': 'whether this run has file-and-shell tools is unknown — this engine does not report which condition mounted each tool, so an empty count here would be a fact about the reader, not about the run',
     'rules.sessionPolicy.tighten.written': 'Session rules saved (version {rev}) — the record now holds everything it already had plus the entries sent here, and it applies from this session’s next tool gate onward; the step already running is not interrupted.',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.counts': "Still running, and possibly started before this session's first rule: {list}. Anything that started before that first rule keeps running without this one — to make the rule apply to it now, stop it.",
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.unreadable': "This client could not read which background agents or workflows are running now. Anything that started before this session's first rule keeps running without this one — stop whatever must not keep running without it.",
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.unseen': 'Work whose start has not reached this client yet may not read this rule either.',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.one': '{n} background agent',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.many': '{n} background agents',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.one': '{n} workflow',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.many': '{n} workflows',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.one': '{n} background item this client stopped tracking',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.many': '{n} background items this client stopped tracking',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.two': '{a} and {b}',
+    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.three': '{a}, {b} and {c}',
     'rules.sessionPolicy.tighten.conflict': 'Session rules were changed by someone else while this tightening was being written, twice in a row — nothing was written. Re-read the current rules and try again, or let the other writer finish first.',
     'rules.sessionPolicy.tighten.loosenForbidden': 'The engine refused this write because it would relax the session rules: at least one entry sent here widens what is allowed rather than narrowing it. Only entries that add restrictions are accepted on this path.',
     'rules.sessionPolicy.tighten.capabilityAbsent': 'This deployment does not keep per-session tool rules, so there is nothing to tighten here.',
@@ -696,6 +779,7 @@ const EN = {
     'rules.match.namePrefix': 'skill name prefix match',
     'rules.match.host': 'web domain match (one host)',
     'rules.match.subdomain': 'web domain match (every host under the domain)',
+    'rules.match.pattern': 'command pattern match (a star placed anywhere in the command)',
     'rules.match.unreported': 'an unreported match form',
     'rules.match.unknown': 'a match form this build does not know',
     'model.tier.blurb.ultra': 'reserved above max — binds when a stronger model lands',
@@ -704,11 +788,14 @@ const EN = {
     'model.tier.blurb.flash': 'fast + cheap — titles, recaps, volume work',
     'model.tier.blurb.lite': 'cheapest — bulk classification, simple lookups',
     'model.catalog.candidateRejected': 'The deployment refused its most recent configuration change{which} and is still running on the configuration before it — models or settings added by that change are not in effect',
+    'model.notServed.withDefault': "The model {model} is not available in this engine's model catalog, so this session uses the engine's default model {default}",
+    'model.notServed.noDefault': "The model {model} is not available in this engine's model catalog, so this session leaves the choice of model to the engine",
     'notice.failure.headline.connectionLostNotSent': 'The engine is unreachable — your message did not run. Check that the engine is up, then send it again.',
     'notice.failure.headline.connectionLost': 'The connection to the engine was lost — it is not known whether your message ran. Check the run’s status, or reattach to it, before sending it again.',
     'notice.failure.headline.timeout': 'The event stream went silent — the run may still be going on the engine. Check its status before sending again.',
     'notice.failure.headline.parked': 'The event stream ended while the run had not reached a terminal state — the run is likely parked waiting for a decision, not crashed. Check its status and decide anything pending; the turn did not complete here.',
     'notice.failure.headline.internal': 'This client hit an internal error — it is a bug in the client, not an engine outage, and the turn did not complete.',
+    'notice.failure.headline.causeUnreadable': 'The reason for this failure could not be read (part of the error object was unreadable) — it is not known whether the engine received your message. Check the run’s status, or reattach to it, before sending it again.',
     'notice.failure.quota.fiveHour': 'Your 5-hour quota is used up',
     'notice.failure.quota.weekly': 'Your weekly quota is used up',
     'notice.failure.quota.budgetPersonal': 'Your personal budget is used up',
@@ -754,6 +841,7 @@ const EN = {
     'rules.issue.behavior': 'this rule is invalid: its behavior is neither deny nor ask, so it would never fire',
     'rules.issue.commandRule': 'this rule is invalid: the command pattern was rejected by the command-rule validator',
     'rules.issue.entryType': 'this allow list is invalid: it must be a list of rule strings, and it or one of its entries is not a string',
+    'rules.issue.nameAmbiguous': 'this rule is invalid: the name it gives matches more than one of the values this tool offers, which differ only by case, spacing or punctuation, so which one it means cannot be told — write the exact one',
     'rules.issue.allowRule': 'an allow rule is not supported in a rule set that only says deny or ask — a standing approval belongs on the allow list instead',
     'rules.issue.paramUnknown': 'this parameter rule is not supported: the tool carries no such parameter, so it could never match',
     'rules.issue.paramNonScalar': 'this parameter rule is not supported: that parameter holds an object or an array, so it could never match',
@@ -775,8 +863,37 @@ const EN = {
     'model.probe.verdict.noToken': 'The model service answered but sent no token — it may be overloaded',
     'model.probe.verdict.noTokenWaited': 'The model service answered but sent no token within {time} — it may be overloaded',
     'model.probe.verdict.other': 'The model service gave an unexpected answer{http}',
-    'session.humanTurn.imageUnknownVision.one': "An @-mentioned image was sent with this message, although the engine's model list does not say whether the model this message uses accepts image input — if it does not, the images may be dropped or the message may be refused",
-    'session.humanTurn.imageUnknownVision.other': "{count} @-mentioned images were sent with this message, although the engine's model list does not say whether the model this message uses accepts image input — if it does not, the images may be dropped or the message may be refused",
+    'session.humanTurn.imageUnknownVision.one': "An image was sent with this message, although the engine's model list does not say whether the model this message uses accepts image input — if it does not, the image may be dropped or the message may be refused",
+    'session.humanTurn.imageUnknownVision.other': "{count} images were sent with this message, although the engine's model list does not say whether the model this message uses accepts image input — if it does not, the images may be dropped or the message may be refused",
+    'session.humanTurn.modelFragment': ' ({model})',
+    'session.humanTurn.refused.empty': 'Nothing was sent: a message needs some text of its own — an image or an attachment cannot be sent on its own',
+    'session.humanTurn.refused.malformedInput': 'Nothing was sent: this client could not read the message it was asked to send — that is a bug in the client, not in your message',
+    'session.humanTurn.refused.malformedItem': 'Nothing was sent: one entry of this message could not be read — that is a bug in the client, not in your message',
+    'session.humanTurn.refused.duplicateUuid': 'Nothing was sent: two entries of this batch carry the same id — that is a bug in the client, not in your message',
+    'session.humanTurn.refused.riderCollidesPrimary': 'Nothing was sent: an item riding along with one entry carries the id of another entry — that is a bug in the client, not in your message',
+    'session.humanTurn.refused.oversize': 'Nothing was sent: this message is too large to send even with every attachment cut down to a reference — shorten it or attach less',
+    'session.humanTurn.held.noText': 'This message is held and will be sent as a new message when the current run ends: it has no text to add to the run in progress',
+    'session.humanTurn.held.reminderTag': 'This message is held and will be sent as a new message when the current run ends: its text contains a reserved tag, which cannot be added to a run in progress',
+    'session.humanTurn.held.controlChar': 'This message is held and will be sent as a new message when the current run ends: its text contains control characters, which cannot be added to a run in progress',
+    'session.humanTurn.held.tooLong': 'This message is held and will be sent as a new message when the current run ends: its text is longer than a note added to a run in progress can be',
+    'session.humanTurn.degraded.visionNo.one': '1 image was not sent: the model{model} cannot read images',
+    'session.humanTurn.degraded.visionNo.other': '{count} images were not sent: the model{model} cannot read images',
+    'session.humanTurn.degraded.imageTooLarge.one': '1 image was not sent: it is larger than the engine accepts for a single image',
+    'session.humanTurn.degraded.imageTooLarge.other': '{count} images were not sent: each is larger than the engine accepts for a single image',
+    'session.humanTurn.degraded.seatCount.one': '1 image was not sent: one message can carry only so many images',
+    'session.humanTurn.degraded.seatCount.other': '{count} images were not sent: one message can carry only so many images',
+    'session.humanTurn.degraded.seatTotal.one': '1 image was not sent: together the images in this message are too large',
+    'session.humanTurn.degraded.seatTotal.other': '{count} images were not sent: together the images in this message are too large',
+    'session.humanTurn.degraded.bodyBudget.one': '1 attached item was sent without its content: the message is too large to send in full',
+    'session.humanTurn.degraded.bodyBudget.other': '{count} attached items were sent without their content: the message is too large to send in full',
+    'session.humanTurn.degraded.steerAdmission.one': '1 attached item was sent as a reference only: its content cannot be added to a run in progress',
+    'session.humanTurn.degraded.steerAdmission.other': '{count} attached items were sent as a reference only: their content cannot be added to a run in progress',
+    'session.humanTurn.degraded.noImageSeat.one': '1 image was not sent: images cannot be added to a run in progress — send it as a new message when the run ends',
+    'session.humanTurn.degraded.noImageSeat.other': '{count} images were not sent: images cannot be added to a run in progress — send them as a new message when the run ends',
+    'session.humanTurn.degraded.noAttachmentIdSeat.one': '1 uploaded file was not attached: files cannot be added to a run in progress — send it as a new message when the run ends',
+    'session.humanTurn.degraded.noAttachmentIdSeat.other': '{count} uploaded files were not attached: files cannot be added to a run in progress — send them as a new message when the run ends',
+    'session.humanTurn.printVision.no': 'The model{model} cannot read images, so the images in this prompt were not sent',
+    'session.humanTurn.printVision.unknown': "The engine's model list does not say whether the model{model} accepts image input — the images in this prompt were sent anyway; if it does not, they may be dropped or the request may be refused",
     'config.scenarioRefusal.source.ruling': ', assigned to you by the configuration center,',
     'config.scenarioRefusal.source.deployment': ", this deployment's default scenario,",
     'config.scenarioRefusal.dangling': "This deployment cannot resolve your scenario: the scenario{name}{from} does not exist here, so it refuses whatever depends on your scenario — new runs that do not name a scenario, and this session's list of MCP servers · Ask whoever operates the engine to fix the scenario assignment",
@@ -823,10 +940,75 @@ const EN = {
     'notice.wireRefusal.hostPosture.both': "The engine refused this request before anything ran: the request asked both for the shell to inherit this machine's whole environment and for bypassPermissions, and this deployment refused at least one of them; the refusal does not say which · {notLocal}; send it again without one or both (the whole-environment setting is honored only on a single-user deployment)",
     'notice.wireRefusal.hostPosture.unattributed': "The engine refused this request before anything ran: this deployment does not accept a setting in it that only a single-user deployment may use; the engine's own message names it · {notLocal}; send it again without that setting",
     'notice.wireRefusal.autonomyLane': 'The engine did not start this leader run: this deployment runs in plan-only autonomy, and a leader run has no way to have its plan reviewed, so nothing was started · Submit the work as a regular run instead, or ask whoever operates the engine to change its autonomy setting',
-    'notice.wireRefusal.userAttachment': 'This message was not sent: the engine refused the files attached to it — together with the message they are more than it can take in one request on this model, or one of them is in a form it does not accept · Nothing was started and your draft is kept · Remove some attachments or attach smaller parts, then send it again',
-    'notice.wireRefusal.userInvokedSkill': 'The engine did not start this run: a skill named for it is not one this run has loaded, or skills are turned off for this run · Nothing was started and your draft is kept · Check the skill name, or load that skill, then send it again',
+    'notice.wireRefusal.unsupportedRule': 'The engine refused this request, so none of it took effect: a rule in it is a form the engine does not support — {detail} · Remove or rewrite that rule (to stop a tool altogether, write its name alone), then send it again',
+    'notice.wireRefusal.unsupportedRule.other': 'The engine refused this request, so none of it took effect: {count} rules in it are forms the engine does not support — {detail} · Remove or rewrite those rules (to stop a tool altogether, write its name alone), then send it again',
+    'notice.wireRefusal.unsupportedRule.stored': 'The engine refused to continue this work: the request stored for it has a rule in it that is a form the engine does not support — {detail} · It cannot continue as stored. Remove or rewrite that rule (to stop a tool altogether, write its name alone), cancel the work if it is still suspended, then submit it again as a new request',
+    'notice.wireRefusal.unsupportedRule.stored.other': 'The engine refused to continue this work: the request stored for it has {count} rules in it that are forms the engine does not support — {detail} · It cannot continue as stored. Remove or rewrite those rules (to stop a tool altogether, write its name alone), cancel the work if it is still suspended, then submit it again as a new request',
+    'notice.prepareRefusal.draftKept': 'Your draft is kept',
+    'notice.prepareRefusal.mcpServerNameCollision': 'The engine refused this run at setup: two MCP servers declared for it cannot be told apart — the same name written twice, or names the engine turns into one tool-name prefix (for example “a.b” and “a_b”), so their tool names would collide · The engine’s own error text names them · Sending the same request again is refused the same way; give one of them another name, or remove one of them, wherever MCP servers are configured for this run (ask whoever operates the engine if the deployment declares them), then send it',
     'notice.retry.source.unifiedHeader': "Judged from the model service's quota headers",
     'notice.retry.source.providerCode': "Judged from the model service's error code",
     'notice.retry.source.status': 'Judged from the HTTP status alone',
+    'session.toolResult.media.kind.image': 'image',
+    'session.toolResult.media.kind.document': 'document',
+    'session.toolResult.media.notDelivered.descriptor': '[{kind} not delivered: {mimeType}, {bytes} B]',
+    'session.toolResult.media.notDelivered.descriptorNoMime': '[{kind} not delivered: {bytes} B]',
+    'session.toolResult.media.notDelivered.omitted.one': '[{blocks} media block not delivered: {bytes} B in total]',
+    'session.toolResult.media.notDelivered.omitted.other': '[{blocks} media blocks not delivered: {bytes} B in total]',
+    'session.workflowResume.line': 'resume: {detail}',
+    'session.workflowResume.counts': 'replayed {replayed} of {journaled} journaled results',
+    'session.workflowResume.countsOnly': 'replayed {replayed} journaled results',
+    'session.workflowResume.noJournal': 'found no journal entries — nothing replayed, the whole script re-ran live',
+    'session.workflowResume.stopAt': 'replay stopped at agent #{ordinal} ({reason}) — this call and every later call ran live',
+    'session.workflowResume.stopAtNoReason': 'replay stopped at agent #{ordinal} — this call and every later call ran live',
+    'session.workflowResume.stop': 'replay stopped ({reason}) — this call and every later call ran live',
+    'notice.providerRejection.quotaExhausted': 'The model provider refused this request (HTTP {status}): this account cannot be served by the model service until someone acts or its usage window resets — check the provider account or use another model.',
+    'notice.usageLimit.autoResume.fired': 'Usage limit available again · continuing now',
+    'notice.usageLimit.autoResume.reset': 'Usage limit has reset · press enter to continue',
+    'notice.usageLimit.autoResume.breaker': 'Automatic continue stopped after repeated usage-limit hits',
+    'notice.usageLimit.autoResume.superseded': 'Automatic continue skipped · you sent another message first',
+    'notice.usageLimit.autoResume.notReplayable': 'Automatic continue is unavailable for this message · it cannot be re-sent unchanged',
+    'notice.usageLimit.autoResume.contextChanged': 'Automatic continue skipped · the context it was armed in has changed (conversation, working directory, history or permission mode)',
+    'notice.usageLimit.autoResume.escaped': 'Automatic continue cancelled · /rate-limit-options to re-arm',
+    'notice.usageLimit.autoResume.horizon': 'Usage limit reached · resets in more than 24 hours · /rate-limit-options to wait anyway',
+    'notice.usageLimit.autoResume.armed.at': 'Usage limit reached · continuing automatically at {time} · esc to cancel',
+    'notice.usageLimit.autoResume.armed.shortly': 'Usage limit reached · continuing shortly · esc to cancel',
+    'notice.usageLimit.autoResume.option.cancel': 'Stop and wait for limit to reset',
+    'notice.usageLimit.autoResume.option.cancelAuto': 'Stop the automatic continue',
+    'notice.usageLimit.autoResume.option.auto': 'Continue automatically when it resets',
+    'notice.usageLimit.autoResume.option.autoHorizon': 'Continue automatically when it resets (the limit resets in more than 24 hours)',
+    'notice.usageLimit.autoResume.disabled.breaker': 'automatic continue stopped after repeated usage-limit hits',
+    'notice.usageLimit.autoResume.disabled.notReplayable': 'this message cannot be re-sent unchanged (attachments or a command)',
+    'notice.usageLimit.autoResume.disabled.contextChanged': 'the context it was armed in is gone',
+    'notice.usageLimit.autoResume.disabled.noResetInstant': 'this quota window has no scheduled reset time',
+    'notice.usageLimit.autoResume.disabled.nothingWaiting': 'there is no usage-limited message waiting to be sent',
+    'session.selfHeal.row.interrupted.settled': 'The turn you interrupted has finished stopping on the engine (run {taskId}), so sema is sending your message now as a new turn.',
+    'session.selfHeal.row.interrupted.stillFinishing': 'The turn you interrupted is still finishing on the engine (run {taskId}, {waited} so far), so your message was NOT sent. Give it a moment, then send it again.',
+    'session.rewind.conversationOnly.withCodeRoute': 'Rewound the conversation only — this engine does not confirm that it can restore files in a combined rewind; to roll files back, run /rewind again and choose "Restore code".',
+    'session.rewind.conversationOnly.noCodeRoute': 'Rewound the conversation only — this engine does not confirm that it can restore files in a combined rewind, so files were not rolled back.',
+    'config.hooks.matcher.unjudged.eventOutOfScope': 'this check does not evaluate matchers for that event',
+    'config.hooks.matcher.unjudged.notAString': 'it is not a string',
+    'config.hooks.matcher.unjudged.oversize': 'it is too long to check',
+    'config.hooks.matcher.unjudged.patternUnsupported': 'it uses a regular-expression feature this check does not evaluate',
+    'config.hooks.matcher.unjudged.overBudget': 'it is a regular expression too costly for this check to evaluate',
+    'config.hooks.matcher.unjudged.unknown': 'this check could not read it',
+    'doctor.wiring.fleetTranscripts.full': 'background subagent transcripts: full — this deployment keeps background subagent handles across an engine restart',
+    'doctor.wiring.fleetTranscripts.noPromise': 'background subagent transcripts: {tier} — this deployment does not promise that background subagent handles survive an engine restart',
+    'doctor.wiring.fleetTranscripts.unknownTier': 'background subagent transcripts: an unknown level ("{tier}") — read it as no promise that background subagent handles survive an engine restart',
+    'config.attachments.refusal.credentialShapedWord': 'looks like a credential rather than an attachments list, so it was not used and is not shown here — a credential does not belong in this setting.',
+    'session.subagent.delegatedPrompt.absence.notOwnedAfterRestart': "This subagent's prompt cannot be shown: this process has no record of where its conversation is stored (the record lives in memory, so it is empty after a restart or when the run was continued from another shell).",
+    'session.subagent.delegatedPrompt.absence.notInStore': "This subagent's prompt cannot be shown: the engine's session store has no conversation for it.",
+    'session.subagent.delegatedPrompt.absence.forbidden': "This subagent's prompt cannot be shown: the engine refused access to its conversation.",
+    'session.subagent.delegatedPrompt.absence.promptAbsent': "This subagent's conversation was read, but it holds no delegated prompt to show.",
+    'session.subagent.delegatedPrompt.absence.unknown': "This subagent's prompt could not be read just now.",
+    'rules.sessionPolicy.tighten.unknown.sessionOwnerless.noIdentity': 'This session has no owner, so a rule written for it could never be read back; nothing was written.',
+    'rules.sessionPolicy.tighten.unknown.storeCorrupt.noOperator': 'The engine could not establish which version this session’s rules are at and refused to stamp a new one, so nothing was written. The entries sent here are not the problem — this deployment has no operator to look at the rule store, so whoever runs it has to.',
+    'rules.sessionPolicy.deployment.noOperator.readStoreCorrupt': 'The engine could not establish which version this session’s rules are at, so it would not hand the record over. This deployment has no operator to look at the rule store — whoever runs it has to.',
+    'rules.sessionPolicy.deployment.noOperator.removeLoosenForbidden': 'The engine refused to take these entries out of this session’s rule record: on this engine only an operator can remove entries from it, and this deployment has none, so the record is unchanged. Continue in a new session.',
+    'rules.sessionPolicy.deployment.noOperator.removeReadStoreCorrupt': 'The engine could not establish which version this session’s rules are at, so nothing was changed. This deployment has no operator to look at the rule store — whoever runs it has to.',
+    'rules.sessionPolicy.deployment.noOperator.removeWriteStoreCorrupt': 'The engine could not establish which version this session’s rules are at and refused to stamp a new one, so nothing was changed. This deployment has no operator to look at the rule store — whoever runs it has to.',
+    'config.hooks.plan.reason.compactionLocalFallback': 'this compaction is summarized on this client because the engine session is unavailable, so the engine will not run it and this client runs it itself',
+    'session.hooks.compactTransition.disclosure.engineOutcomeUnknown': 'The compaction request had already been sent to the engine when the summary fell back to this client, so whether the engine ran the compaction hooks cannot be told here, and this client did not run them again.',
+    'session.hooks.compactTransition.disclosure.neitherRan': 'The compaction hooks did not run this time: the engine did not compact here and this client could not start its own summary. If the engine still compacts later it will run them then.',
 };
 export const EN_MESSAGES = Object.freeze(EN);