@sema-agent/client-core 0.104.1 → 0.106.0

package/dist/hostTurnSettings.js

@@ -1,7 +1,7 @@
 import { SETTINGS_CLASSIFY_HOOKS_CONFIG } from './generated/settingsSchemaFns.js';
 import { hostLog } from './host.js';
 import { layerNotAppliedRefusesTurn, salvageSettingsHooksEntries } from './settingsHooksSalvage.js';
-import { ADOPTED_LAYERS, HOST_SETTINGS_LAYERS, HostSettingsSourceShapeError, permissionRulesOf, MANAGED_READING_DISPOSITIONS, adoptHostSettingsRead, mintHostSettingsSession, readHostSettingsOnce, remintSameContent, sessionSnapshotOf, settingsValueOf, sourceOfRead, } from './hostSettingsSource.js';
+import { ADOPTED_LAYERS, HOST_SETTINGS_LAYERS, HostSettingsSourceShapeError, TIGHTEN_ONLY_HOST_SETTINGS_LAYERS, permissionBucketOf, permissionRulesOf, MANAGED_READING_DISPOSITIONS, adoptHostSettingsRead, mintHostSettingsSession, readHostSettingsOnce, remintSameContent, sessionSnapshotOf, settingsValueOf, sourceOfRead, } from './hostSettingsSource.js';
 import { hooksWirePlan } from './hooksWireCaps.js';
 import { submissionSurfaceOf } from './request/submissionIdentity.js';
 import { displayUntrusted } from './displayUntrusted.js';
@@ -10,7 +10,9 @@ import { fileHistoryTightenVerdict, fileHistoryUnjudgedRefusal } from './fileHis
 import { msg, renderMessage } from './i18n/translate.js';
 import { newRulePortsProjection, projectPermissionsDeclaration, rulePortsMissingOf, WIRE_RULE_TRUST_ORDER } from './permissionsDeclaration.js';
 import { assemblyRefusalOf } from './wireFailureShape.js';
-import { layerAdmitted } from './settingsLayerAdmission.js';
+import { permissionRuleLayersOn } from './permissionsAllowGrantCapability.js';
+import { layerAdmissionReading, layerAdmitted } from './settingsLayerAdmission.js';
+import { SETTINGS_BUILD_LAYER_PARTS_UNREAD_NOTICE } from './generated/settingsSchemaFns.js';
 import { appendOwnElement, ownDataField } from './ownKey.js';
 export const HOST_SUPPLIED_KEYS = Object.freeze(['settings.hooks', 'settings.resolved', 'settings.webSearch', 'settings.outputStyle', 'memory', 'fileHistory']);
 export const HOST_SETTING_CAUSES = Object.freeze([
@@ -41,6 +43,7 @@ const HOST_SETTING_NOTICE_TEXT = {
     'HS-HELD-PREVIOUS': () => renderMessage(msg('session.hostSettings.heldPrevious')),
     'HS-STYLE-MISSING': (what) => renderMessage(msg('session.hostSettings.styleMissing', { name: what })),
     'HS-STYLE-SAFE': () => renderMessage(msg('session.hostSettings.styleSafeMode')),
+    'HS-LAYER-PARTS-UNREAD': (line) => line,
 };
 const KEY_NOUN = {
     'settings.hooks': 'the hooks',
@@ -366,10 +369,60 @@ function stringListOf(v) {
 function permissionMemberAdmitted(layer, read, bucket) {
     return layerAdmitted(layer, read.trust, 'permissions', bucket);
 }
+function managedRulesOnly(read) {
+    const policyDoc = read.layers.policySettings.doc;
+    return MANAGED_READING_DISPOSITIONS[read.managed].ruleScope === 'by-switch' && policyDoc !== null && managedOnlySwitchOn(policyDoc);
+}
+const TIGHTEN_ONLY_LAYER_BUCKETS = Object.freeze(['deny', 'ask']);
+function tightenOnlyBucketsRead(read, layer) {
+    if (managedRulesOnly(read))
+        return [];
+    const doc = read.layers[layer].doc;
+    return TIGHTEN_ONLY_LAYER_BUCKETS.filter((bucket) => permissionMemberAdmitted(layer, read, bucket) && permissionBucketOf(doc, bucket) !== undefined);
+}
+function tightenOnlyLayerPartsUnread(read, layer, permissionsRead) {
+    const doc = read.layers[layer].doc;
+    if (doc === null)
+        return [];
+    const readBuckets = permissionsRead ? tightenOnlyBucketsRead(read, layer) : [];
+    const parts = [];
+    const rec = doc;
+    for (const key of Object.keys(rec)) {
+        const v = rec[key];
+        if (key !== 'permissions')
+            appendOwnElement(parts, key);
+        else if (typeof v !== 'object' || v === null || Array.isArray(v))
+            appendOwnElement(parts, key);
+        else
+            for (const member of Object.keys(v))
+                if (!readBuckets.includes(member))
+                    appendOwnElement(parts, `${key}.${member}`);
+    }
+    for (const c of read.layers[layer].carriers)
+        if (c.status === 'loaded-partial')
+            for (const k of c.issues ?? [])
+                if (!parts.includes(k))
+                    appendOwnElement(parts, k);
+    return parts;
+}
+function tightenOnlyLayerNotices(read, permissionsRead) {
+    const out = [];
+    for (const layer of TIGHTEN_ONLY_HOST_SETTINGS_LAYERS) {
+        const snap = read.layers[layer];
+        if (!snap.enabled || snap.doc === null)
+            continue;
+        const parts = tightenOnlyLayerPartsUnread(read, layer, permissionsRead);
+        const loaded = snap.carriers.filter((c) => c.status === 'loaded' || c.status === 'loaded-partial').map((c) => c.id);
+        const file = (loaded.length > 0 ? loaded : snap.carriers.map((c) => c.id)).join(', ');
+        const n = SETTINGS_BUILD_LAYER_PARTS_UNREAD_NOTICE({ source: layer, workspace: layerAdmissionReading(read.trust), file, parts });
+        if (n !== undefined)
+            appendOwnElement(out, notice('HS-LAYER-PARTS-UNREAD', 'session', displayUntrusted(n.line)));
+    }
+    return out;
+}
 function allowAdmittedFor(read) {
     const disp = MANAGED_READING_DISPOSITIONS[read.managed];
-    const policyDoc = read.layers.policySettings.doc;
-    const managedOnlySwitch = disp.ruleScope === 'by-switch' && policyDoc !== null && managedOnlySwitchOn(policyDoc);
+    const managedOnlySwitch = managedRulesOnly(read);
     const degrade = disp.ruleScope === 'degrade';
     return (layer) => {
         if (degrade || managedOnlySwitch)
@@ -386,17 +439,17 @@ function allowAdmittedFor(read) {
     };
 }
 function badPermissionsSource() {
-    return new HostSourceShapeError(`hostTurnSettings: sources.resolved must be 'none' or { allowGrantReading, cliArg?, session?, clientOwnedServers?, serverVersion? } — since 0.101.0 the permission rules of the settings files come from the settings the entry reads; do not pass snapshot — got something else (the value is not echoed).`);
+    return new HostSourceShapeError(`hostTurnSettings: sources.resolved must be 'none' or { allowGrantReading, cliArg?, session?, clientOwnedServers? } — since 0.101.0 the permission rules of the settings files come from the settings the entry reads; do not pass snapshot — got something else (the value is not echoed).`);
 }
-function permissionsArm(src, side, adoption) {
+function readPermissionSource(src) {
     const key = 'settings.resolved';
     if (src.kind === 'missing')
-        return missingArm(key);
+        return { kind: 'arm', arm: missingArm(key) };
     if (src.kind === 'threw')
-        return unreadableArm(key);
+        return { kind: 'arm', arm: unreadableArm(key) };
     const v = src.value;
     if (v === 'none')
-        return noSourceArm(key);
+        return { kind: 'arm', arm: noSourceArm(key) };
     let allowGrantReading;
     let cliAllow;
     let cliDeny;
@@ -404,18 +457,15 @@ function permissionsArm(src, side, adoption) {
     let sesAsk;
     let owned;
     let ownedRaw;
-    let serverVersion;
     try {
         if (!isRecordShape(v) || Object.hasOwn(v, 'snapshot') || !Object.hasOwn(v, 'allowGrantReading'))
             throw badPermissionsSource();
-        const sver = ownDataOf(v, 'serverVersion');
-        serverVersion = sver.ok && typeof sver.value === 'string' ? sver.value : undefined;
         const g = ownDataOf(v, 'allowGrantReading');
         const c = ownDataOf(v, 'cliArg');
         const se = ownDataOf(v, 'session');
         const o = ownDataOf(v, 'clientOwnedServers');
         if (!g.ok || !c.ok || !se.ok || !o.ok)
-            return unreadableArm(key);
+            return { kind: 'arm', arm: unreadableArm(key) };
         allowGrantReading = g.value;
         const cv = c.value;
         const sv = se.value;
@@ -428,7 +478,7 @@ function permissionsArm(src, side, adoption) {
         const sd = sv === undefined ? { ok: true, value: undefined } : ownDataOf(sv, 'deny');
         const sa = sv === undefined ? { ok: true, value: undefined } : ownDataOf(sv, 'ask');
         if (!ca.ok || !cd.ok || !sd.ok || !sa.ok)
-            return unreadableArm(key);
+            return { kind: 'arm', arm: unreadableArm(key) };
         cliAllow = stringListOf(ca.value);
         cliDeny = stringListOf(cd.value);
         sesDeny = stringListOf(sd.value);
@@ -439,16 +489,32 @@ function permissionsArm(src, side, adoption) {
     catch (e) {
         if (e instanceof HostSourceShapeError)
             throw e;
-        return unreadableArm(key);
+        return { kind: 'arm', arm: unreadableArm(key) };
     }
     if (cliAllow === undefined || cliDeny === undefined || sesDeny === undefined || sesAsk === undefined || (owned === undefined && ownedRaw !== undefined))
         throw badPermissionsSource();
+    return { kind: 'facts', allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned };
+}
+function permissionsArm(facts, side, adoption, layered) {
+    const key = 'settings.resolved';
+    if (facts.kind === 'arm')
+        return facts.arm;
+    const { allowGrantReading, cliAllow, cliDeny, sesDeny, sesAsk, owned } = facts;
     if (side.kind === 'missing')
         return missingArm(key);
     const buckets = { deny: [], ask: [], allow: [] };
     const origins = { deny: new Map(), ask: new Map(), allow: new Map() };
     const rank = (o) => WIRE_RULE_TRUST_ORDER.indexOf(o);
+    const contributions = { deny: [], ask: [] };
+    const contributed = { deny: new Set(), ask: new Set() };
     const add = (bucket, rule, origin) => {
+        if (bucket !== 'allow') {
+            const k = JSON.stringify([origin, rule]);
+            if (!contributed[bucket].has(k)) {
+                contributed[bucket].add(k);
+                appendOwnElement(contributions[bucket], freeze({ rule, origin }));
+            }
+        }
         const prev = origins[bucket].get(rule);
         if (prev === undefined) {
             appendOwnElement(buckets[bucket], rule);
@@ -465,7 +531,7 @@ function permissionsArm(src, side, adoption) {
         const read = side.read;
         const disp = MANAGED_READING_DISPOSITIONS[read.managed];
         const policyDoc = read.layers.policySettings.doc;
-        const managedOnlySwitch = disp.ruleScope === 'by-switch' && policyDoc !== null && managedOnlySwitchOn(policyDoc);
+        const managedOnlySwitch = managedRulesOnly(read);
         const degrade = disp.ruleScope === 'degrade';
         try {
             for (const bucket of Object.keys(buckets)) {
@@ -489,6 +555,10 @@ function permissionsArm(src, side, adoption) {
                     for (const r of adoption?.extraTighten[bucket] ?? [])
                         if (permissionMemberAdmitted(r.layer, read, bucket))
                             add(bucket, r.rule, r.layer);
+                for (const l of TIGHTEN_ONLY_HOST_SETTINGS_LAYERS)
+                    for (const bucket of tightenOnlyBucketsRead(read, l))
+                        for (const r of permissionRulesOf(read.layers[l].doc, bucket))
+                            add(bucket, r, l);
             }
         }
         catch (error) {
@@ -504,7 +574,7 @@ function permissionsArm(src, side, adoption) {
     let declared;
     if (projectionError === undefined) {
         try {
-            const d = projectPermissionsDeclaration({ deny: buckets.deny, ask: buckets.ask, allow: buckets.allow, origins, cliDeny, settingsRead: 'clean', ...(owned !== undefined && owned.length > 0 ? { clientOwnedServers: owned } : {}), ...(serverVersion !== undefined ? { serverVersion } : {}) }, allowGrantReading, portsProjection);
+            const d = projectPermissionsDeclaration({ deny: buckets.deny, ask: buckets.ask, allow: buckets.allow, origins, cliDeny, settingsRead: 'clean', ...(owned !== undefined && owned.length > 0 ? { clientOwnedServers: owned } : {}) }, allowGrantReading, portsProjection, layered ? freeze({ deny: freeze([...contributions.deny]), ask: freeze([...contributions.ask]) }) : undefined);
             declared = d.permissions !== undefined ? { permissions: d.permissions } : undefined;
         }
         catch (error) {
@@ -567,8 +637,11 @@ function notLoadedLayers(read, plan) {
     }
     return out;
 }
+const isTightenOnlyLayer = (l) => TIGHTEN_ONLY_HOST_SETTINGS_LAYERS.includes(l);
 function notLoadedSentence(n, form) {
     const layer = msg(`session.hostSettings.layer.${n.layer}`);
+    if (isTightenOnlyLayer(n.layer))
+        return renderMessage(msg(form === 'hold' ? 'session.hostSettings.layerNotLoaded.restrictions.hold' : 'session.hostSettings.layerNotLoaded.restrictions.sent', { layer }));
     return renderMessage(msg(form === 'hold' ? `session.hostSettings.layerNotLoaded.hold.${n.how}` : 'session.hostSettings.layerNotLoaded.sent.unreadable', { layer }));
 }
 function settingsSideOf(input) {
@@ -615,10 +688,12 @@ export function buildHostTurnSettings(input, judges) {
     if (rawSide.kind === 'read')
         for (const line of rawSide.read.debug)
             hostLog('debug', line);
-    const adoption = rawSide.kind === 'read' ? adoptHostSettingsRead(rawSide.read, session, allowAdmittedFor(rawSide.read)) : undefined;
+    const permissionSource = readPermissionSource(read('resolved'));
+    const layeredRules = permissionSource.kind === 'facts' && permissionRuleLayersOn(permissionSource.allowGrantReading);
+    const adoption = rawSide.kind === 'read' ? adoptHostSettingsRead(rawSide.read, session, allowAdmittedFor(rawSide.read), layeredRules) : undefined;
     const side = adoption !== undefined ? { kind: 'read', read: adoption.read } : rawSide;
     const nextSession = adoption?.session ?? remintSameContent(session);
-    const resolvedArm = permissionsArm(read('resolved'), side, adoption);
+    const resolvedArm = permissionsArm(permissionSource, side, adoption, layeredRules);
     let resolvedCarried = resolvedArm.carried;
     let resolvedError;
     if (resolvedCarried !== undefined) {
@@ -660,17 +735,19 @@ export function buildHostTurnSettings(input, judges) {
     if (notLoaded.length > 0) {
         const key = `hs1-${fnv1a(JSON.stringify(notLoaded.map((n) => n.key)))}`;
         const ask = surface === 'interactive' && !session.consented.includes(key);
-        const layers = freeze(notLoaded.map((n) => n.layer));
-        const cause = notLoaded.some((n) => n.how === 'unreadable') ? 'source_unreadable' : 'source_rejected';
-        const reshape = (a) => {
+        const reshape = (a, feeds) => {
             const d = a.row.disposition;
             if (d === 'refuse_turn' || d === 'unwired' || a.row.cause === 'no_source')
                 return a;
+            const mine = notLoaded.filter((n) => feeds(n.layer));
+            if (mine.length === 0)
+                return a;
+            const cause = mine.some((n) => n.how === 'unreadable') ? 'source_unreadable' : 'source_rejected';
             const disposition = ask ? 'hold_for_consent' : a.carried !== undefined ? 'carry_partial' : 'withhold_notice';
-            return { ...a, row: freeze({ key: a.row.key, cause, disposition, layers }) };
+            return { ...a, row: freeze({ key: a.row.key, cause, disposition, layers: freeze(mine.map((n) => n.layer)) }) };
         };
         const before = armsByKey;
-        armsByKey = [{ ...reshape(before[0]), ...(hooks.plan !== undefined ? { plan: hooks.plan } : {}) }, reshape(before[1]), before[2], before[3], before[4], before[5]];
+        armsByKey = [{ ...reshape(before[0], (l) => !isTightenOnlyLayer(l)), ...(hooks.plan !== undefined ? { plan: hooks.plan } : {}) }, reshape(before[1], () => true), before[2], before[3], before[4], before[5]];
         if (ask && armsByKey.slice(0, 2).some((a) => a.row.disposition === 'hold_for_consent'))
             consentKey = key;
         for (const n of notLoaded) {
@@ -690,7 +767,11 @@ export function buildHostTurnSettings(input, judges) {
     }
     const arms = armsByKey;
     const rows = freeze(arms.map((a) => a.row));
-    const notices = freeze([...arms.flatMap((a) => a.notices), ...notLoadedNotices, ...heldNotices]);
+    const resolvedOut = arms[1]?.row.disposition === 'carry' || arms[1]?.row.disposition === 'carry_partial' || arms[1]?.row.disposition === 'hold_for_consent' ? resolvedCarried : undefined;
+    const permissionsRow = arms[1]?.row;
+    const permissionsRead = permissionsRow !== undefined && permissionsRow.disposition !== 'refuse_turn' && permissionsRow.disposition !== 'unwired' && permissionsRow.cause !== 'no_source';
+    const partsNotices = side.kind === 'read' ? tightenOnlyLayerNotices(side.read, permissionsRead) : [];
+    const notices = freeze([...arms.flatMap((a) => a.notices), ...notLoadedNotices, ...heldNotices, ...partsNotices]);
     const refusal = arms.find((a) => a.row.disposition === 'refuse_turn');
     const verdict = refusal !== undefined
         ? freeze({ kind: 'refuse', notice: refusal.notices[0] ?? notices.find((n) => n.plane === 'turn') ?? notice('HS-PROJECTION', 'turn') })
@@ -702,7 +783,6 @@ export function buildHostTurnSettings(input, judges) {
         return a.row.disposition === 'carry' || a.row.disposition === 'carry_partial' || a.row.disposition === 'hold_for_consent' ? a.carried : undefined;
     };
     const hooksCarried = carriedOf(0);
-    const resolvedOut = arms[1]?.row.disposition === 'carry' || arms[1]?.row.disposition === 'carry_partial' || arms[1]?.row.disposition === 'hold_for_consent' ? resolvedCarried : undefined;
     const carried = freeze({
         ...(hooksCarried !== undefined ? { hooks: hooksCarried } : {}),
         ...(resolvedOut !== undefined ? { resolved: resolvedOut } : {}),

package/dist/i18n/messages.en.d.ts

@@ -122,6 +122,11 @@ declare const EN: {
     'session.devices.probeFailedTransport': string;
     'session.devices.probeFailedRefused': string;
     'session.devices.probeFailedUnreadable': string;
+    'session.engine.selfNotLocal': string;
+    'session.engine.dispatch.notWired': string;
+    'session.engine.dispatch.scopeMismatch': string;
+    'session.engine.dispatch.scopeUnproven': string;
+    'session.engine.dispatch.unresolved': string;
     'config.cloudLogin.accessDenied': string;
     'config.cloudLogin.expiredToken': string;
     'config.cloudLogin.invalidGrant': string;
@@ -141,6 +146,7 @@ declare const EN: {
     'config.engineTarget.loginFailed': string;
     'config.engineTarget.storageUnavailable': string;
     'config.engineTarget.noLocalRuntime': string;
+    'config.engineTarget.serverBelowSupportFloor': string;
     'config.engineTarget.input': string;
     'config.engineTarget.unknown': string;
     'onboard.probe.endpointReachable': string;
@@ -187,6 +193,8 @@ declare const EN: {
     'config.mcp.nameReserved': string;
     'config.mcp.identityHeadersBothSet': string;
     'config.mcp.transportUnreadable': string;
+    'config.mcp.transportNotAdvertised': string;
+    'config.mcp.transportsNone': string;
     'config.mcp.transportInvalid': string;
     'config.mcp.transportDegraded': string;
     'config.mcp.toolAxesInvalid': string;
@@ -238,6 +246,7 @@ declare const EN: {
     'approval.settle.cause.broadcastLost': string;
     'approval.settle.cause.streamDisconnected': string;
     'approval.settle.cause.undeliverable': string;
+    'approval.decide.requiresBinding': string;
     'approval.decision.grantChanged': string;
     'approval.decision.settledElsewhereContrary.deniedFirst': string;
     'approval.decision.settledElsewhereContrary.approvedFirst': string;
@@ -293,6 +302,13 @@ declare const EN: {
     'session.crashConverged.cause.neutral': string;
     'session.crashConverged.cause.withClause': string;
     'session.corrupt.content': string;
+    'session.projectSeed.invalid': string;
+    'session.projectSeed.invalidAt': string;
+    'session.projectSeed.laneNotIsolated': string;
+    'session.projectSeed.seedFixed': string;
+    'session.projectSeed.boundElsewhere': string;
+    'session.projectSeed.laneUnknown': string;
+    'session.projectSeed.missing': string;
     'resume.reopen.first.envFailed': string;
     'resume.reopen.first.toolUnavailable': string;
     'resume.reopen.first.toolContractMismatch': string;
@@ -392,6 +408,8 @@ declare const EN: {
     'session.selfHeal.injected.handedOffWatch': string;
     'session.selfHeal.injected.interruptedFinishing': string;
     'session.selfHeal.injected.notDelivered': string;
+    'session.selfHeal.injected.redundant': string;
+    'session.selfHeal.injected.deferred': string;
     'session.selfHeal.decisionInFlight': string;
     'session.selfHeal.parkedOn.ask': string;
     'session.selfHeal.parkedOn.plan': string;
@@ -543,10 +561,28 @@ declare const EN: {
     'approval.boundGrants.denyPart.one': string;
     'approval.boundGrants.denyPart.other': string;
     'approval.boundGrants.activates': string;
+    'approval.boundGrants.allowPart.named.one': string;
+    'approval.boundGrants.allowPart.named.other': string;
+    'approval.boundGrants.denyPart.named.one': string;
+    'approval.boundGrants.denyPart.named.other': string;
+    'approval.boundGrants.more': string;
     'session.fileHistoryRefusal.notYet': string;
     'session.fileHistoryRefusal.notSaid': string;
     'session.fileHistoryRefusal.unrecognized': string;
     'session.fileHistoryRefusal.unreadable': string;
+    'session.memoryErase.personalStoreUnjudged': string;
+    'session.memorySync.parked.one': string;
+    'session.memorySync.parked.other': string;
+    'session.memorySync.parkedUnnamed.one': string;
+    'session.memorySync.parkedUnnamed.other': string;
+    'session.memorySync.wayOut.deleteCursor': string;
+    'session.memorySync.wayOut.unrecognized': string;
+    'session.memorySyncTrigger.notConfigured': string;
+    'session.memorySyncTrigger.noSettledRun': string;
+    'session.memorySyncTrigger.runUnobserved': string;
+    'session.memorySyncTrigger.memoryNotMounted': string;
+    'session.memorySyncTrigger.noLeaf': string;
+    'session.memorySyncTrigger.unobtainable': string;
     'session.hostSettings.memorySwitchMalformed': string;
     'session.hostSettings.fileHistoryRestoreConflict': string;
     'session.hostSettings.projectionUnchecked': string;
@@ -556,11 +592,14 @@ declare const EN: {
     'session.hostSettings.layerNotLoaded.hold.unreadable': string;
     'session.hostSettings.layerNotLoaded.hold.rejected': string;
     'session.hostSettings.layerNotLoaded.sent.unreadable': string;
+    'session.hostSettings.layerNotLoaded.restrictions.hold': string;
+    'session.hostSettings.layerNotLoaded.restrictions.sent': string;
     'session.hostSettings.layer.policySettings': string;
     'session.hostSettings.layer.userSettings': string;
     'session.hostSettings.layer.projectSettings': string;
     'session.hostSettings.layer.localSettings': string;
     'session.hostSettings.layer.flagSettings': string;
+    'session.hostSettings.layer.foreignProjectSettings': string;
     'session.hostSettings.heldPrevious': string;
     'session.hostSettings.styleMissing': string;
     'session.hostSettings.styleSafeMode': string;
@@ -594,7 +633,6 @@ declare const EN: {
     'rules.refusal.list.more': string;
     'rules.refusal.reason.toolName': string;
     'rules.refusal.reason.homePath': string;
-    'rules.refusal.reason.neverMatches': string;
     'rules.nearMiss.sentence.one': string;
     'rules.nearMiss.sentence.other': string;
     'rules.nearMiss.reason': string;
@@ -670,6 +708,18 @@ declare const EN: {
     'session.steerRefusal.advice': string;
     'session.steerRefusal.hostQueue.queued': string;
     'session.steerRefusal.hostQueue.dropped': string;
+    'session.permissionModeSwitch.applied': string;
+    'session.permissionModeSwitch.folded': string;
+    'session.permissionModeSwitch.reason.entryFloor': string;
+    'session.permissionModeSwitch.reason.disableAutoMode': string;
+    'session.permissionModeSwitch.reason.engine': string;
+    'session.permissionModeSwitch.notPersisted': string;
+    'session.permissionModeSwitch.notRunning': string;
+    'session.permissionModeSwitch.notFound': string;
+    'session.permissionModeSwitch.refused': string;
+    'session.permissionModeSwitch.refusedWithCode': string;
+    'session.permissionModeSwitch.unconfirmed': string;
+    'session.permissionModeSwitch.unavailable': string;
     'notice.capability.subject.userInvokedSkills': string;
     'notice.capability.subject.skillToolLists': string;
     'notice.capability.subject.permissionRulesWrite': string;
@@ -713,17 +763,6 @@ declare const EN: {
     'notice.capability.hands.unknownRosterUnreadable': string;
     'notice.capability.hands.unknownMountConditionAbsent': string;
     'rules.sessionPolicy.tighten.written': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.counts': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.unreadable': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.unseen': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.one': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.many': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.one': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.many': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.one': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.many': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.two': string;
-    'rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.three': string;
     'rules.sessionPolicy.tighten.conflict': string;
     'rules.sessionPolicy.tighten.loosenForbidden': string;
     'rules.sessionPolicy.tighten.capabilityAbsent': string;
@@ -1053,6 +1092,40 @@ declare const EN: {
     'config.mods.refusal.by': string;
     'config.mods.rewrite.resultInPlace': string;
     'config.mods.rewrite.inputBy': string;
+    'follow.notFollowed.headRun': string;
+    'follow.notFollowed.headTurn': string;
+    'follow.notFollowed.reason.exhaustedDraining': string;
+    'follow.notFollowed.reason.exhaustedConnectionLost': string;
+    'follow.notFollowed.reason.exhaustedStreamCap': string;
+    'follow.notFollowed.reason.exhausted': string;
+    'follow.notFollowed.reason.badInput': string;
+    'follow.notFollowed.reason.noRunId': string;
+    'follow.notFollowed.reason.runUnknown': string;
+    'follow.notFollowed.reason.unspecified': string;
+    'follow.notFollowed.endingUnknown': string;
+    'follow.notFollowed.exit.reattach': string;
+    'follow.notFollowed.exit.checkRuns': string;
+    'follow.notFollowed.exit.runUnknown': string;
+    'follow.notFollowed.idleTear': string;
+    'follow.notFollowed.idleGrace': string;
+    'approval.planReview.note.empty': string;
+    'approval.planReview.note.marked': string;
+    'approval.planReview.note.tooLarge': string;
+    'approval.planReview.note.notCarried': string;
+    'approval.planReview.note.unknown': string;
+    'approval.planReview.askAgain.shown': string;
+    'approval.planReview.askAgain.marked': string;
+    'approval.planReview.askAgain.tooLarge': string;
+    'approval.planReview.askAgain.notCarried': string;
+    'approval.planReview.askAgain.unknown': string;
+    'approval.planReview.askAgain.withNote': string;
+    'approval.planReview.decision.notSent': string;
+    'approval.planReview.decision.refused': string;
+    'approval.planReview.decision.cardMissing': string;
+    'approval.planReview.decision.gateMoved': string;
+    'approval.planReview.decision.gateUntrusted': string;
+    'approval.planReview.option.askAgain.label': string;
+    'approval.planReview.option.askAgain.description': string;
 };
 export declare const EN_MESSAGES: Readonly<typeof EN>;
 export type MessageKey = keyof typeof EN;