@sema-agent/client-core 0.111.0 → 0.112.1

package/dist/i18n/messages.en.d.ts

@@ -211,6 +211,20 @@ declare const EN: {
     'onboard.plan.envNotObject': string;
     'onboard.plan.envCatalogPresent': string;
     'onboard.input.keyInFields': string;
+    'model.pool.add.duplicate': string;
+    'model.pool.add.probeFailed': string;
+    'model.pool.add.probeUnverified': string;
+    'model.pool.add.pinMoved': string;
+    'model.pool.notFound': string;
+    'model.pool.importEnv.notYet': string;
+    'model.pool.tier.badGroup': string;
+    'model.pool.tier.noGroup': string;
+    'model.pool.tier.groupExists': string;
+    'model.pool.channel.badPick': string;
+    'model.pool.discover.status': string;
+    'model.pool.discover.notList': string;
+    'model.pool.discover.timeout': string;
+    'model.pool.discover.unreachable': string;
     'onboard.refusal.input': string;
     'onboard.refusal.probeFailed': string;
     'onboard.refusal.probeUnverified': string;
@@ -291,6 +305,7 @@ declare const EN: {
     'approval.rowUnresumable.askNotSurfaced': string;
     'approval.park.stillParked': string;
     'approval.park.refusedNotResumable': string;
+    'approval.park.newerWorker': string;
     'approval.park.resume.card': string;
     'approval.park.resume.speak': string;
     'approval.park.argsFromModelCall': string;
@@ -433,6 +448,9 @@ declare const EN: {
     'resume.refusal.park.printHolds': string;
     'resume.refusal.park.interactiveEnded': string;
     'resume.refusal.park.interactiveBusy': string;
+    'resume.refusal.park.whyNewerEngine': string;
+    'resume.refusal.park.interactiveNewerWorker': string;
+    'resume.refusal.park.printNewerWorker': string;
     'resume.refusal.park.blockedPrint': string;
     'resume.refusal.park.blockedInteractive': string;
     'session.selfHeal.wayOut.interactive': string;
@@ -687,6 +705,21 @@ declare const EN: {
     'session.hostSettings.styleSafeMode': string;
     'session.hostSettings.styleOversize': string;
     'session.hostSettings.styleUnreadable': string;
+    'session.hostSettings.allowKept.managed.inProgress.one': string;
+    'session.hostSettings.allowKept.managed.inProgress.other': string;
+    'session.hostSettings.allowKept.managed.failed.one': string;
+    'session.hostSettings.allowKept.managed.failed.other': string;
+    'session.hostSettings.allowKept.managed.unknown.one': string;
+    'session.hostSettings.allowKept.managed.unknown.other': string;
+    'session.hostSettings.allowKept.generic.one': string;
+    'session.hostSettings.allowKept.generic.other': string;
+    'session.hostSettings.allowKept.why.problems': string;
+    'session.hostSettings.allowKept.why.problemsWhere': string;
+    'session.hostSettings.allowKept.why.counted.one': string;
+    'session.hostSettings.allowKept.why.counted.other': string;
+    'session.hostSettings.allowKept.why.countedWhere.one': string;
+    'session.hostSettings.allowKept.why.countedWhere.other': string;
+    'session.hostSettings.allowKept.why.unreadable': string;
     'model.identity.lane.processEnv': string;
     'model.identity.lane.settingsEnv': string;
     'model.identity.lane.modelCatalogFile': string;
@@ -698,6 +731,24 @@ declare const EN: {
     'model.identity.catalogAdoption.refused': string;
     'model.identity.catalogAdoption.notResolvable': string;
     'model.identity.catalogAdoption.notResolvableWithPartial': string;
+    'model.configGap.head.model': string;
+    'model.configGap.head.gatewayUrl': string;
+    'model.configGap.head.apiKey': string;
+    'model.configGap.head.anthropicKey': string;
+    'model.configGap.head.incomplete': string;
+    'model.configGap.item.model': string;
+    'model.configGap.item.gatewayUrl': string;
+    'model.configGap.item.apiKey': string;
+    'model.configGap.item.anthropicKey': string;
+    'model.configGap.lead.one': string;
+    'model.configGap.lead.two': string;
+    'model.configGap.lead.three': string;
+    'model.configGap.reason.noModel': string;
+    'model.configGap.reason.anthropicCatalog.one': string;
+    'model.configGap.reason.anthropicCatalog.other': string;
+    'model.configGap.reason.gatewayCatalog.one': string;
+    'model.configGap.reason.gatewayCatalog.other': string;
+    'model.configGap.detail.withReason': string;
     'notice.injectionLane.sentence': string;
     'notice.injectionLane.item.stdioMcp': string;
     'notice.injectionLane.item.credentialedMcp': string;
@@ -1344,6 +1395,77 @@ declare const EN: {
     'config.mods.session.unarmed': string;
     'config.hooks.roster.unreadable': string;
     'config.hooks.roster.unarmed': string;
+    'config.localConfig.refused.invalidRequest': string;
+    'config.localConfig.refused.scopeUnreadable': string;
+    'config.localConfig.refused.scopeUnwritable': string;
+    'config.localConfig.refused.untrustedFolder': string;
+    'config.localConfig.refused.policyDenied': string;
+    'config.localConfig.refused.notFound': string;
+    'config.localConfig.refused.alreadyExists': string;
+    'config.localConfig.refused.lockBusy': string;
+    'config.localConfig.refused.lockFailed': string;
+    'config.localConfig.refused.changedDuringWrite': string;
+    'config.localConfig.refused.writeFailed': string;
+    'config.localConfig.refused.notWritten': string;
+    'config.localConfig.refused.skillLockedByHigherLayer': string;
+    'config.localConfig.refused.skillManagedByPlugin': string;
+    'config.localConfig.refused.skillLockedByAuthor': string;
+    'config.localConfig.refused.skillNameUnstorable': string;
+    'config.localConfig.refused.entryInUse': string;
+    'config.localConfig.refused.credentialUnpaired': string;
+    'config.localConfig.refused.envCatalogPresent': string;
+    'config.localConfig.refused.probeFailed': string;
+    'config.localConfig.refused.probeUnverified': string;
+    'config.localConfig.unavailable.engineIsRemote': string;
+    'config.localConfig.unavailable.notSingleUser': string;
+    'config.localConfig.unavailable.configHomeUnpinned': string;
+    'config.localConfig.unavailable.domainNotHosted': string;
+    'config.localConfig.unknown.commitUnconfirmed': string;
+    'config.localConfig.unknown.reportUnreadable': string;
+    'config.localConfig.applied.nextTurn': string;
+    'config.localConfig.applied.engineReload': string;
+    'config.localConfig.applied.nextEngineStart': string;
+    'config.localConfig.applied.unchanged': string;
+    'config.localConfig.preview.nextTurn': string;
+    'config.localConfig.preview.engineReload': string;
+    'config.localConfig.preview.nextEngineStart': string;
+    'config.localConfig.preview.unchanged': string;
+    'config.localConfig.residue.orphanKeySlot': string;
+    'config.localConfig.residue.legacyTierGroupsLeft': string;
+    'config.localConfig.disclosure.decidedBy': string;
+    'config.localConfig.disclosure.shadowed': string;
+    'config.localConfig.disclosure.tierGroupOverridden': string;
+    'config.localConfig.disclosure.tierGroupOverriddenNamed': string;
+    'config.localConfig.layer.userSettings': string;
+    'config.localConfig.layer.projectSettings': string;
+    'config.localConfig.layer.localSettings': string;
+    'config.localConfig.layer.globalConfig': string;
+    'config.localConfig.layer.projectMcp': string;
+    'config.localConfig.layer.models': string;
+    'config.localConfig.layer.deploymentMcp': string;
+    'config.localConfig.layer.policySettings': string;
+    'config.localConfig.layer.other': string;
+    'config.localConfig.refused.nameUnusable': string;
+    'config.localConfig.refused.nameReserved': string;
+    'config.localConfig.refused.mcpEntryInvalid': string;
+    'config.localConfig.refused.ambiguousScope': string;
+    'config.localConfig.refused.credentialsNeedReentry': string;
+    'config.localConfig.refused.baseConflict': string;
+    'config.mcpServers.notice.shadowed': string;
+    'config.mcpServers.notice.endpointDiffers': string;
+    'config.mcpServers.notice.deploymentWins': string;
+    'config.mcpServers.notice.envMissing': string;
+    'config.mcpServers.notice.narrowingWouldConflict': string;
+    'config.mcpServers.withheld.narrowingConflict': string;
+    'config.mcpServers.withheld.narrowingInvalid': string;
+    'config.mcpServers.withheld.layerUnreadable': string;
+    'config.mcpServers.withheld.policyLocked': string;
+    'config.mcpServers.problem.nameReserved': string;
+    'config.mcpServers.approvalsWithheld': string;
+    'config.mcpServers.probe.removed': string;
+    'config.mcpServers.probe.notActive': string;
+    'config.mcpServers.probe.envMissing': string;
+    'config.mcpServers.probe.editRefusal': string;
     'follow.notFollowed.headRun': string;
     'follow.notFollowed.headTurn': string;
     'follow.notFollowed.reason.exhaustedDraining': string;
@@ -1376,6 +1498,8 @@ declare const EN: {
     'approval.planReview.decision.cardMissing': string;
     'approval.planReview.decision.gateMoved': string;
     'approval.planReview.decision.gateUntrusted': string;
+    'approval.planReview.decision.sentWithoutGateId': string;
+    'approval.planReview.bridge.gateIdMissing': string;
     'approval.planReview.option.askAgain.label': string;
     'approval.planReview.option.askAgain.description': string;
     'localEngine.behind.cliUpdate': string;
@@ -1549,6 +1673,47 @@ declare const EN: {
     'localEngine.health.answer.ok': string;
     'localEngine.health.answer.notOkHttp': string;
     'localEngine.health.answer.notOkStatus': string;
+    'centerTrust.refusal.badInput': string;
+    'centerTrust.refusal.empty': string;
+    'centerTrust.refusal.tooLong': string;
+    'centerTrust.refusal.unsafeCharacter': string;
+    'centerTrust.refusal.scheme': string;
+    'centerTrust.refusal.userinfo': string;
+    'centerTrust.refusal.percentInHost': string;
+    'centerTrust.refusal.unparseable': string;
+    'centerTrust.refusal.query': string;
+    'centerTrust.refusal.fragment': string;
+    'centerTrust.refusal.trailingDot': string;
+    'centerTrust.refusal.ipNotCanonical': string;
+    'centerTrust.refusal.plaintextRemote': string;
+    'centerTrust.refusal.path': string;
+    'centerTrust.refusal.fingerprint': string;
+    'centerTrust.refusal.tooManyFingerprints': string;
+    'centerTrust.refusal.prefix': string;
+    'centerTrust.refusal.parserUnavailable': string;
+    'centerTrust.refusal.bodyTooLarge': string;
+    'centerTrust.refusal.bodyNotJson': string;
+    'centerTrust.refusal.bodyShape': string;
+    'centerTrust.refusal.servedCount': string;
+    'centerTrust.refusal.certificateTooLarge': string;
+    'centerTrust.refusal.certificateNotCanonical': string;
+    'centerTrust.refusal.certificateUnparseable': string;
+    'centerTrust.refusal.servedDuplicate': string;
+    'centerTrust.refusal.namedNotServed': string;
+    'centerTrust.refusal.anchorNotSelfSigned': string;
+    'centerTrust.refusal.unconfiguredWithFingerprints': string;
+    'centerTrust.refusal.cancelled': string;
+    'centerTrust.refusal.timedOut': string;
+    'centerTrust.refusal.transportFailed': string;
+    'centerTrust.refusal.contentType': string;
+    'centerTrust.refusal.caUnavailable': string;
+    'centerTrust.refusal.endpointMissing': string;
+    'centerTrust.refusal.unexpectedStatus': string;
+    'centerTrust.refusal.retryAfterUnusable': string;
+    'centerTrust.refusal.retryAfterTooLong': string;
+    'centerTrust.refusal.retriesExhausted': string;
+    'centerTrust.refusal.budgetExhausted': string;
+    'centerTrust.refusal.unknown': string;
 };
 export declare const EN_MESSAGES: Readonly<typeof EN>;
 export type MessageKey = keyof typeof EN;

package/dist/i18n/messages.en.js

@@ -211,6 +211,20 @@ const EN = {
     'onboard.plan.envNotObject': 'The settings file has an "env" that is not an object — not rewriting it.',
     'onboard.plan.envCatalogPresent': 'The engine is serving "{model}" from environment settings and the catalog has no enabled model; a first catalog model would replace the environment models. Add them to the catalog first.',
     'onboard.input.keyInFields': 'The model ID / base URL contains the API key — check the fields.',
+    'model.pool.add.duplicate': '"{model}" is listed twice in this batch with the same address — add it once.',
+    'model.pool.add.probeFailed': 'The provider rejected "{model}" (key, model name or reply format) — fix it and check again.',
+    'model.pool.add.probeUnverified': '"{model}" hasn\'t been checked against its provider (or the check couldn\'t finish) — check it again, or save it as unverified.',
+    'model.pool.add.pinMoved': 'The model list changed while "{name}" was being saved (its name or stored key moved) — nothing was added. Try again.',
+    'model.pool.notFound': 'There is no model named "{name}" in the model list.',
+    'model.pool.importEnv.notYet': 'The engine is serving "{model}" from its environment settings. This app can\'t copy environment models into the model list yet — add them by hand (address and key) first, then add more.',
+    'model.pool.tier.badGroup': 'A tier group name must start with a letter or digit and use only letters, digits, ".", "_" or "-".',
+    'model.pool.tier.noGroup': 'There is no tier group named "{group}".',
+    'model.pool.tier.groupExists': 'A tier group named "{group}" already exists.',
+    'model.pool.channel.badPick': 'The picked profile or models were not found in what this app read from that source.',
+    'model.pool.discover.status': 'The model list request answered HTTP {status}.',
+    'model.pool.discover.notList': 'The endpoint did not answer with a model list.',
+    'model.pool.discover.timeout': 'The model list request timed out.',
+    'model.pool.discover.unreachable': 'The endpoint could not be reached: {cause}',
     'onboard.refusal.input': 'The model setup is incomplete or not in the expected shape — nothing was saved.',
     'onboard.refusal.probeFailed': 'The provider did not accept this setup — nothing was saved.',
     'onboard.refusal.probeUnverified': "The provider couldn't be checked, so nothing was saved — try again, or save it as unverified.",
@@ -291,6 +305,7 @@ const EN = {
     'approval.rowUnresumable.askNotSurfaced': 'the pending row (task {taskId}) cannot be continued by this engine, so it is not surfaced as a card that can be answered: {sentence}',
     'approval.park.stillParked': '{gate} gate could not be answered: {reason} — the run is still parked on this approval.',
     'approval.park.refusedNotResumable': '{gate} gate could not be answered: {reason} — this engine cannot resume this approval as things stand; cancel the run if it is still parked.',
+    'approval.park.newerWorker': '{gate} gate could not be answered: {reason} — the run is still parked on this approval, but {wayOut}.',
     'approval.park.resume.card': '{gate} gate could not be answered: {reason} — the run is still parked on this approval: decide it on the card when it is shown again, or cancel the run.',
     'approval.park.resume.speak': '{gate} gate could not be answered: {reason} — the run is still parked on this approval: send a message to reopen the card, then decide it there, or cancel the run.',
     'approval.park.argsFromModelCall': "the pending approval record has no tool arguments that will run, so the arguments shown are the model's original call from the conversation — if they were changed after that call (for example by a hook), what runs differs from what is shown. Edits are not accepted on this card: the arguments shown are not the ones that will run",
@@ -433,6 +448,9 @@ const EN = {
     'resume.refusal.park.printHolds': '{head}{configMayReturn} The parked run still holds this session ({code}): cancel it ({cancel}), then submit the work again as a new task.{blocked}',
     'resume.refusal.park.interactiveEnded': '{head} The engine ended that parked run, so this conversation is free: send the work again as a new message.',
     'resume.refusal.park.interactiveBusy': '{head}{configMayReturn} The parked run keeps this conversation busy until it is cancelled.',
+    'resume.refusal.park.whyNewerEngine': 'it was parked by a newer engine version than this one',
+    'resume.refusal.park.interactiveNewerWorker': '{head}{configMayReturn} The parked run still holds this conversation, but {wayOut}.',
+    'resume.refusal.park.printNewerWorker': '{head}{configMayReturn} The parked run still holds this session ({code}), but {wayOut} ({cancel}).{blocked}',
     'resume.refusal.park.blockedPrint': 'sema will not put the card for run {run} back on screen by itself: this engine version refuses to resume it. Cancel the run ({cancel}) and submit the work again as a new task.',
     'resume.refusal.park.blockedInteractive': 'sema will not put the card for run {run} back on screen by itself: this engine version refuses to resume it. To free this conversation, send a message — sema then offers to cancel that run (if the card comes back instead, answer it first), after which you can send the work again as a new message.',
     'session.selfHeal.wayOut.interactive': 'run /clear to keep working in a fresh session',
@@ -687,6 +705,21 @@ const EN = {
     'session.hostSettings.styleSafeMode': 'Safe mode is on, so the output style from your settings is not applied.',
     'session.hostSettings.styleOversize': 'Your output style was not applied to this request: together with the built-in product context it is longer than the {limit}-character limit. Shorten the style to apply it.',
     'session.hostSettings.styleUnreadable': 'Your output style could not be read as text, so it is not applied to this request.',
+    'session.hostSettings.allowKept.managed.inProgress.one': '{held} permissions.allow rule was not sent to the engine for this run because the managed policy for your account has not been received yet (sema keeps fetching it; allow rules apply once it arrives). Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.inProgress.other': '{held} permissions.allow rules were not sent to the engine for this run because the managed policy for your account has not been received yet (sema keeps fetching it; allow rules apply once it arrives). Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.failed.one': '{held} permissions.allow rule was not sent to the engine for this run because the managed policy for your account has not been received yet (this run will not fetch again; the next run retries). Run again to retry fetching it (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.failed.other': '{held} permissions.allow rules were not sent to the engine for this run because the managed policy for your account has not been received yet (this run will not fetch again; the next run retries). Run again to retry fetching it (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.unknown.one': '{held} permissions.allow rule was not sent to the engine for this run because the managed policy for your account has not been received yet. Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.managed.unknown.other': '{held} permissions.allow rules were not sent to the engine for this run because the managed policy for your account has not been received yet. Run again once it has been received (deny and ask rules, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.generic.one': '{held} permissions.allow rule was not sent to the engine for this run because {why}; an allow rule from a settings file is only sent from a settings read with no problems. Fix the reported settings, then run again (deny and ask rules from this read, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.generic.other': '{held} permissions.allow rules were not sent to the engine for this run because {why}; an allow rule from a settings file is only sent from a settings read with no problems. Fix the reported settings, then run again (deny and ask rules from this read, and rules given with --allowedTools, are still sent).',
+    'session.hostSettings.allowKept.why.problems': 'the settings read reported problems',
+    'session.hostSettings.allowKept.why.problemsWhere': 'the settings read reported problems ({where})',
+    'session.hostSettings.allowKept.why.counted.one': 'the settings read reported {count} problem',
+    'session.hostSettings.allowKept.why.counted.other': 'the settings read reported {count} problems',
+    'session.hostSettings.allowKept.why.countedWhere.one': 'the settings read reported {count} problem ({where})',
+    'session.hostSettings.allowKept.why.countedWhere.other': 'the settings read reported {count} problems ({where})',
+    'session.hostSettings.allowKept.why.unreadable': 'the health of this settings read could not be checked',
     'model.identity.lane.processEnv': 'the environment this client was started with',
     'model.identity.lane.settingsEnv': "this client's settings file",
     'model.identity.lane.modelCatalogFile': 'the local model catalog file',
@@ -698,6 +731,24 @@ const EN = {
     'model.identity.catalogAdoption.refused': '{lane} lists models, but the engine is reported to refuse this catalog as written, so none of them can serve as its default',
     'model.identity.catalogAdoption.notResolvable': 'no model name is configured for the local engine to start with — {clause}, and the engine does not start without one',
     'model.identity.catalogAdoption.notResolvableWithPartial': 'no model name is configured for the local engine to start with — {clause}, and {partial}, and the engine does not start without one',
+    'model.configGap.head.model': 'no model is configured yet',
+    'model.configGap.head.gatewayUrl': 'no model gateway base URL is configured',
+    'model.configGap.head.apiKey': 'no API key is configured',
+    'model.configGap.head.anthropicKey': 'no Anthropic key is configured (ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN)',
+    'model.configGap.head.incomplete': 'model configuration is incomplete',
+    'model.configGap.item.model': 'the model name (MODEL_ID)',
+    'model.configGap.item.gatewayUrl': 'the gateway base URL (MODEL_GATEWAY_BASEURL)',
+    'model.configGap.item.apiKey': 'the API key (MODEL_API_KEY)',
+    'model.configGap.item.anthropicKey': 'an Anthropic key (ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN)',
+    'model.configGap.lead.one': '{a} is not configured',
+    'model.configGap.lead.two': '{a} and {b} are not configured',
+    'model.configGap.lead.three': '{a}, {b} and {c} are not configured',
+    'model.configGap.reason.noModel': 'the engine does not start without a model name',
+    'model.configGap.reason.anthropicCatalog.one': "the model catalog's only enabled entry is on the anthropic channel, so the engine cannot serve it",
+    'model.configGap.reason.anthropicCatalog.other': "the model catalog's {count} enabled entries are all on the anthropic channel, so the engine cannot serve any of them",
+    'model.configGap.reason.gatewayCatalog.one': "the model catalog's only enabled entry has no base URL of its own, so the engine cannot serve it",
+    'model.configGap.reason.gatewayCatalog.other': "none of the model catalog's {count} enabled entries has a base URL of its own, so the engine cannot serve any of them",
+    'model.configGap.detail.withReason': '{missing} — {reason}',
     'notice.injectionLane.sentence': "On this engine's {lane} lane the tools run on a different machine than the engine, so the {items} sent with a task run there rather than on this machine — any that rely on programs or credentials on this machine will fail there",
     'notice.injectionLane.item.stdioMcp': 'local stdio MCP servers',
     'notice.injectionLane.item.credentialedMcp': 'MCP servers that use credentials from this machine',
@@ -1344,6 +1395,77 @@ const EN = {
     'config.mods.session.unarmed': 'Mods show up here once this conversation has run on this engine',
     'config.hooks.roster.unreadable': "This conversation's hooks plan couldn't be read",
     'config.hooks.roster.unarmed': 'Hooks show up here once this app has this conversation open',
+    'config.localConfig.refused.invalidRequest': 'The change could not be read as a valid request — nothing was saved.',
+    'config.localConfig.refused.scopeUnreadable': "The configuration file can't be read, so it was not overwritten — nothing was saved.",
+    'config.localConfig.refused.scopeUnwritable': "This setting can't be saved in that file — it would not take effect there. Nothing was saved.",
+    'config.localConfig.refused.untrustedFolder': "This folder isn't trusted, so its settings files can't carry this setting — nothing was saved.",
+    'config.localConfig.refused.policyDenied': "Your organization's managed settings don't allow this change — nothing was saved.",
+    'config.localConfig.refused.notFound': 'The item to change was not found — nothing was saved.',
+    'config.localConfig.refused.alreadyExists': 'That item already exists — nothing was saved.',
+    'config.localConfig.refused.lockBusy': 'Another program is changing this configuration right now — nothing was saved. Try again in a moment.',
+    'config.localConfig.refused.lockFailed': "The configuration file couldn't be locked for writing (a permission or folder problem) — the file was not changed.",
+    'config.localConfig.refused.changedDuringWrite': 'Another program changed this configuration while saving — nothing was saved. Try again.',
+    'config.localConfig.refused.writeFailed': "The configuration file couldn't be written — the file was not changed.",
+    'config.localConfig.refused.notWritten': 'The change was not saved.',
+    'config.localConfig.refused.skillLockedByHigherLayer': "A higher-priority configuration sets this skill's state; it cannot be changed here.",
+    'config.localConfig.refused.skillManagedByPlugin': 'A plugin skill is managed with the plugin, not here.',
+    'config.localConfig.refused.skillLockedByAuthor': "This skill's own file turns model invocation off; its state cannot be changed here.",
+    'config.localConfig.refused.skillNameUnstorable': "Settings can't store an entry with this skill's name; rename its folder or file to configure it.",
+    'config.localConfig.refused.entryInUse': 'That model is still in use (as the default model, by a role, or in an old tier setting) — point those at another model first. Nothing was saved.',
+    'config.localConfig.refused.credentialUnpaired': "That model couldn't be reached with the key or address it has — nothing was saved.",
+    'config.localConfig.refused.envCatalogPresent': 'The engine is using the models set in its environment; adding one here would take those out of use. Import the environment models first — nothing was saved.',
+    'config.localConfig.refused.probeFailed': 'The provider showed that a model in this change is set up wrong (key, model name or reply format) — nothing was saved.',
+    'config.localConfig.refused.probeUnverified': "A model in this change hasn't been checked against its provider (or the check couldn't finish) — nothing was saved. Check it again, or save it as unverified.",
+    'config.localConfig.unavailable.engineIsRemote': "The Cloud engine is in use — local configuration doesn't apply to it. Switch to the local engine first.",
+    'config.localConfig.unavailable.notSingleUser': "This engine isn't confirmed to serve only you, so local configuration isn't used with it.",
+    'config.localConfig.unavailable.configHomeUnpinned': "This app hasn't settled which configuration folder to use, so local configuration is neither shown nor changed.",
+    'config.localConfig.unavailable.domainNotHosted': "This app doesn't offer this kind of configuration change on this device yet.",
+    'config.localConfig.unknown.commitUnconfirmed': "It isn't certain whether the change was saved — refresh to check.",
+    'config.localConfig.unknown.reportUnreadable': "The app's answer after saving couldn't be read, so it isn't certain whether the change was saved — refresh to check.",
+    'config.localConfig.applied.nextTurn': 'Saved. It takes effect from the next turn.',
+    'config.localConfig.applied.engineReload': 'Saved. The engine picks it up when it next reloads its configuration, usually within a minute.',
+    'config.localConfig.applied.nextEngineStart': 'Saved. It takes effect the next time the local engine starts.',
+    'config.localConfig.applied.unchanged': 'Already set this way — nothing needed to change.',
+    'config.localConfig.preview.nextTurn': 'Not saved yet. Once saved, it takes effect from the next turn.',
+    'config.localConfig.preview.engineReload': 'Not saved yet. Once saved, the engine picks it up when it next reloads its configuration.',
+    'config.localConfig.preview.nextEngineStart': 'Not saved yet. Once saved, it takes effect the next time the local engine starts.',
+    'config.localConfig.preview.unchanged': 'Already set this way — saving would change nothing.',
+    'config.localConfig.residue.orphanKeySlot': 'A stored key slot was left with no model using it; it does nothing.',
+    'config.localConfig.residue.legacyTierGroupsLeft': 'The old tier settings were left in the settings file; they are no longer used.',
+    'config.localConfig.disclosure.decidedBy': 'The setting in effect comes from {layer}.',
+    'config.localConfig.disclosure.shadowed': 'This setting is overridden by {layer}, so it has no effect for now.',
+    'config.localConfig.disclosure.tierGroupOverridden': 'Some tier groups in your old settings share a name with groups already in {layer}; the ones in {layer} were kept and the old ones were not copied over.',
+    'config.localConfig.disclosure.tierGroupOverriddenNamed': 'These tier groups in your old settings share a name with groups already in {layer}; the ones in {layer} were kept and the old ones were not copied over: {names}.',
+    'config.localConfig.layer.userSettings': 'your user settings',
+    'config.localConfig.layer.projectSettings': "this project's shared settings",
+    'config.localConfig.layer.localSettings': "this project's local settings",
+    'config.localConfig.layer.globalConfig': "this app's state file",
+    'config.localConfig.layer.projectMcp': "this project's MCP server file",
+    'config.localConfig.layer.models': 'the model catalog',
+    'config.localConfig.layer.deploymentMcp': "the engine's MCP server declaration",
+    'config.localConfig.layer.policySettings': "your organization's managed settings",
+    'config.localConfig.layer.other': 'another settings file',
+    'config.localConfig.refused.nameUnusable': 'That server name can\'t be used — nothing was saved.',
+    'config.localConfig.refused.nameReserved': 'That server name is reserved by the app\'s own built-in server — nothing was saved.',
+    'config.localConfig.refused.mcpEntryInvalid': 'The server entry has problems that would keep it from loading — nothing was saved.',
+    'config.localConfig.refused.ambiguousScope': 'A server with that name is configured in more than one place; choose which one to change — nothing was saved.',
+    'config.localConfig.refused.credentialsNeedReentry': 'The server\'s address or command changed, so the secrets stored for it must be entered again or removed — nothing was saved.',
+    'config.localConfig.refused.baseConflict': 'This server\'s configuration changed after it was shown — nothing was saved. Refresh and try again.',
+    'config.mcpServers.notice.shadowed': 'A server with the same name in the {scope} configuration takes precedence over this one.',
+    'config.mcpServers.notice.endpointDiffers': 'A server with the same name in the {scope} configuration points somewhere else.',
+    'config.mcpServers.notice.deploymentWins': 'The engine\'s own deployment declares a server with this name; the deployment\'s server is used instead.',
+    'config.mcpServers.notice.envMissing': 'These variables are not set, so they stay as written: {names}.',
+    'config.mcpServers.notice.narrowingWouldConflict': 'Other places ({scopes}) declare a different tool list for this name; the server will not load until they agree.',
+    'config.mcpServers.withheld.narrowingConflict': 'Not loaded: the places that configure this server disagree on its tool list.',
+    'config.mcpServers.withheld.narrowingInvalid': 'Not loaded: a tool list for this server is written incorrectly in one of the places that configure it.',
+    'config.mcpServers.withheld.layerUnreadable': 'Not loaded: a configuration file that can add or limit MCP servers could not be read, so no MCP servers are loaded until it is fixed.',
+    'config.mcpServers.withheld.policyLocked': 'Not loaded: your organization\'s managed settings only allow the MCP servers it provides.',
+    'config.mcpServers.problem.nameReserved': 'This name belongs to the app\'s own built-in server.',
+    'config.mcpServers.approvalsWithheld': 'MCP approvals written in {layer} are not used because this folder is not trusted.',
+    'config.mcpServers.probe.removed': 'Nothing to test: this change removes the server.',
+    'config.mcpServers.probe.notActive': 'Nothing to test: the server would not be active after this change.',
+    'config.mcpServers.probe.envMissing': 'Not tested: some variables the server uses are not set.',
+    'config.mcpServers.probe.editRefusal': 'Not tested: the change itself could not be accepted.',
     'follow.notFollowed.headRun': 'This screen is no longer following run {taskId}{reason}{ending}{exit}',
     'follow.notFollowed.headTurn': "This screen is no longer following this turn's run{reason}{ending}{exit}",
     'follow.notFollowed.reason.exhaustedDraining': ": the engine instance serving it was going down when its last event stream closed, and this client's re-attach allowance has run out.",
@@ -1375,7 +1497,9 @@ const EN = {
     'approval.planReview.decision.refused': 'This {decision} was not applied: the engine refused it and changed nothing.',
     'approval.planReview.decision.cardMissing': 'Approving a plan needs the card that showed it, and none came with this approval.',
     'approval.planReview.decision.gateMoved': 'The plan on this card is no longer the one waiting for approval.',
-    'approval.planReview.decision.gateUntrusted': "The engine could not recognise this review's gate id (the server's record of it looks damaged; an operator should check it). The card still shows the plan that is waiting: answering again sends the answer without the gate id, and that answer is not protected against the plan having changed.",
+    'approval.planReview.decision.gateUntrusted': "The engine could not recognise this review's gate id (the server's record of it looks damaged; an operator should check it). Until it is fixed, approving this plan from here is refused the same way and changes nothing. Rejecting it or asking for a new plan is sent without the gate id: that does not approve anything, but if the plan has changed in the meantime it acts on whichever plan is waiting then, which may be one nobody here has seen. Cancelling the task also works.",
+    'approval.planReview.decision.sentWithoutGateId': 'This answer was sent without the gate id. If it took effect, it acted on whichever plan review the engine was waiting on when it arrived, which is not necessarily the plan on this card.',
+    'approval.planReview.bridge.gateIdMissing': 'Approving or editing a plan needs the gate id of the review card the user saw, and this decision did not carry one, so nothing was sent. Decide from the review card, which carries the gate id, or reject the plan or cancel the task instead.',
     'approval.planReview.option.askAgain.label': 'No, ask for the plan to be presented again',
     'approval.planReview.option.askAgain.description': 'Do not approve; ask the model to present the plan again',
     'localEngine.behind.cliUpdate': 'The local engine (version {running}) is newer than this Sema ({own}), so this Sema cannot start new work on it. Run `sema update`, then reopen this session.',
@@ -1549,5 +1673,46 @@ const EN = {
     'localEngine.health.answer.ok': 'answered with status "ok"',
     'localEngine.health.answer.notOkHttp': 'answered HTTP {http}',
     'localEngine.health.answer.notOkStatus': 'answered HTTP {http} but not with status "ok"',
+    'centerTrust.refusal.badInput': 'This check was given a value it cannot read; that is a defect in the client, not in what you entered.',
+    'centerTrust.refusal.empty': 'No address was given.',
+    'centerTrust.refusal.tooLong': 'The address is too long (at most {addressMax} characters, and at most {authorityMax} for the host part).',
+    'centerTrust.refusal.unsafeCharacter': 'The address contains whitespace, a control character or a backslash.',
+    'centerTrust.refusal.scheme': 'The address must be written in full, starting with `https://` for an invitation link, or with `http://` or `https://` for a center address.',
+    'centerTrust.refusal.userinfo': 'The address must not carry a user name or password before the host.',
+    'centerTrust.refusal.percentInHost': 'The host part of the address must not contain percent-encoding.',
+    'centerTrust.refusal.unparseable': 'The address is not a parseable http(s) URL.',
+    'centerTrust.refusal.query': 'The address must not carry a query (`?`).',
+    'centerTrust.refusal.fragment': 'The address must not carry a fragment (`#`); only an invitation link may end with a `#ca=` list of fingerprints.',
+    'centerTrust.refusal.trailingDot': 'The host name must not end with a dot.',
+    'centerTrust.refusal.ipNotCanonical': 'An IP address must be written in its standard form (for example `127.0.0.1`, not a shortened or hexadecimal form).',
+    'centerTrust.refusal.plaintextRemote': 'Plain `http://` is allowed only for this machine; a remote center must use `https://`.',
+    'centerTrust.refusal.path': 'The address path is not allowed: an invitation link takes no path, and a center address path must not start with `//` or contain `.` or `..` segments.',
+    'centerTrust.refusal.fingerprint': 'A fingerprint must be `sha256:` followed by 64 hexadecimal digits (an invitation link takes lowercase digits only).',
+    'centerTrust.refusal.tooManyFingerprints': 'At most {fingerprintsMax} fingerprints can be given.',
+    'centerTrust.refusal.prefix': 'A fingerprint must start with `sha256:`.',
+    'centerTrust.refusal.parserUnavailable': "This client cannot read certificates on this platform, so it cannot pin the center's certificate.",
+    'centerTrust.refusal.bodyTooLarge': "The center's certificate answer is larger than {bodyMax} bytes.",
+    'centerTrust.refusal.bodyNotJson': "The center's certificate answer is not valid UTF-8 JSON.",
+    'centerTrust.refusal.bodyShape': "The center's certificate answer does not have the expected shape.",
+    'centerTrust.refusal.servedCount': 'The center must serve from 1 to {servedMax} certificates.',
+    'centerTrust.refusal.certificateTooLarge': 'A certificate from the center is longer than {pemMax} characters.',
+    'centerTrust.refusal.certificateNotCanonical': 'A certificate from the center is not exactly one certificate in standard PEM form (64-character lines, LF line ends) with standard DER lengths.',
+    'centerTrust.refusal.certificateUnparseable': 'A certificate from the center could not be read on this platform.',
+    'centerTrust.refusal.servedDuplicate': 'The center served the same certificate more than once.',
+    'centerTrust.refusal.namedNotServed': 'A fingerprint you gave does not match any certificate the center serves.',
+    'centerTrust.refusal.anchorNotSelfSigned': 'A certificate you named is not self-signed, so it cannot be pinned as a trust anchor.',
+    'centerTrust.refusal.unconfiguredWithFingerprints': 'You gave fingerprints, but the center says it has no certificate authority configured.',
+    'centerTrust.refusal.cancelled': "Fetching the center's certificates was cancelled.",
+    'centerTrust.refusal.timedOut': "Fetching the center's certificates timed out (each attempt waits at most {roundSec} seconds).",
+    'centerTrust.refusal.transportFailed': 'The center could not be reached to fetch its certificates.',
+    'centerTrust.refusal.contentType': "The center's certificate answer is not JSON (wrong content type).",
+    'centerTrust.refusal.caUnavailable': 'The center reports that its certificate authority is unavailable right now.',
+    'centerTrust.refusal.endpointMissing': 'The center does not offer certificates for pinning (it may be an older version).',
+    'centerTrust.refusal.unexpectedStatus': 'The center answered the certificate request with an unexpected status.',
+    'centerTrust.refusal.retryAfterUnusable': 'The center asked to retry later without a usable wait time, so the client stopped.',
+    'centerTrust.refusal.retryAfterTooLong': 'The center asked to wait more than {waitCapSec} seconds before retrying, so the client stopped; try again later.',
+    'centerTrust.refusal.retriesExhausted': 'The center kept asking to retry; the client stopped after {attemptsMax} attempts.',
+    'centerTrust.refusal.budgetExhausted': "Fetching the center's certificates used up its {budgetSec}-second time budget.",
+    'centerTrust.refusal.unknown': "The center's certificate could not be checked.",
 };
 export const EN_MESSAGES = Object.freeze(EN);