@sema-agent/client-core 0.97.1 → 0.99.0

package/dist/fleet/fleetLedger.js

@@ -44,7 +44,7 @@ export function readEngineActiveBgTasksFor(sessionKey) {
     for (const view of viewsFor(sessionKey)) {
         try {
             const r = view.read();
-            if (r.connected)
+            if (r.fresh)
                 fresh = true;
             for (const row of r.rows)
                 byId.set(row.id, row);
@@ -146,7 +146,6 @@ export function createFleetLedger(hooks = {}, opts = {}) {
     let droppedUnknownFrame = 0;
     let droppedForeignBgNotification = 0;
     let droppedStaleIngress = 0;
-    let connected = false;
     let version = null;
     let scoped = null;
     let sessionScopedMeta;
@@ -154,12 +153,12 @@ export function createFleetLedger(hooks = {}, opts = {}) {
     let disposed = false;
     let epochSeq = 0;
     let liveStreamEpoch = 0;
+    let deliveredStreamEpoch = 0;
     let liveSnapshotEpoch = 0;
     let streamAnchor;
-    let everIssuedStream = false;
     let contentAnchor;
     let contentAnchorSet = false;
-    let ledgerWrites = 0;
+    const streamDelivering = () => !disposed && liveStreamEpoch !== 0 && deliveredStreamEpoch === liveStreamEpoch;
     const debug = (line) => {
         if (engineWireDebugEnabled())
             hostLog('debug', line);
@@ -242,7 +241,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                     continue;
                 rows.push(toBgTask(r.row, true));
             }
-            return { connected, rows };
+            return { fresh: streamDelivering(), rows };
         },
         sessionScoped: () => sessionScopedMeta,
         clearRetained: () => {
@@ -259,7 +258,6 @@ export function createFleetLedger(hooks = {}, opts = {}) {
         views.add(bgView);
     }
     function applyFrame(frame, ing) {
-        ledgerWrites++;
         switch (frame.type) {
             case 'meta': {
                 version = frame.version;
@@ -324,7 +322,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                     if (parentOwned)
                         recordOwnEngineRun(childTid);
                     if (parentOwned || sessionScopedMeta === true) {
-                        recordBgParentRun(childTid, parentTid, ing?.session, ing?.sessionKey);
+                        recordBgParentRun(childTid, parentTid, ing.session, ing.sessionKey);
                     }
                     else {
                         debug(`[fleet-frame] task row parent-map SKIPPED foreign/unowned(row=${row.id} parent=${parentTid})`);
@@ -409,7 +407,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
             return;
         }
         const serverFailClosed = bgNotifyFailClosedMeta && sessionScopedMeta === true;
-        const anchor = ing !== null ? ing.session : engineSessionParamFor(sessionKey);
+        const anchor = ing.session;
         const ownByRoot = typeof n.rootSessionId === 'string' &&
             n.rootSessionId.length > 0 &&
             n.rootSessionId === anchor;
@@ -423,16 +421,14 @@ export function createFleetLedger(hooks = {}, opts = {}) {
             return;
         }
         const defaultSlot = sessionKey === DEFAULT_SESSION_KEY;
-        const viaIngress = ing !== null;
-        const ownRootTrusted = defaultSlot || viaIngress;
         const serverFailClosedTrusted = defaultSlot;
         const trustedSessionArm = serverFailClosed && serverFailClosedTrusted
             ? 'server_fail_closed'
-            : ownByRoot && ownRootTrusted
+            : ownByRoot
                 ? 'own_root'
                 : undefined;
         const evidence = trustedSessionArm ??
-            (serverFailClosed || ownByRoot
+            (serverFailClosed
                 ? 'session_anchor_untrusted'
                 : typeof n.parentTaskId === 'string' && n.parentTaskId.length > 0
                     ? 'own_parent'
@@ -446,7 +442,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
         }
         if (isSdkFleetTaskTerminal(n.status)) {
             if (typeof n.parentTaskId === 'string' && n.parentTaskId) {
-                recordBgParentRun(n.taskId, n.parentTaskId, ing?.session, ing?.sessionKey);
+                recordBgParentRun(n.taskId, n.parentTaskId, ing.session, ing.sessionKey);
             }
             if (typeof n.transcriptId === 'string' && n.transcriptId.length > 0) {
                 recordEngineTranscriptId(n.taskId, n.transcriptId);
@@ -629,9 +625,13 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                         ` type=${String(frame.type)})`);
                     return;
                 }
-                applyFrame(frame, { session, sessionKey });
+                if (kind === 'stream')
+                    deliveredStreamEpoch = epoch;
+                else
+                    closed = true;
                 contentAnchor = session;
                 contentAnchorSet = true;
+                applyFrame(frame, { session, sessionKey });
             },
             close() {
                 closed = true;
@@ -649,8 +649,7 @@ export function createFleetLedger(hooks = {}, opts = {}) {
         bgNotifyFailClosedMeta = false;
         debug(`[fleet-frame] 连接级 meta 复位(${why})—— 新连接自报之前不许沿用上一条连接的让位/信任位`);
     };
-    const hasLedgerContent = () => taskMap.size > 0 || wfMap.size > 0 || retained.size > 0;
-    const shouldResetContentFor = (session) => contentAnchorSet ? contentAnchor !== session : hasLedgerContent();
+    const shouldResetContentFor = (session) => contentAnchorSet && contentAnchor !== session;
     const resetLedgerContentOnSessionChange = (from, to) => {
         taskMap.clear();
         wfMap.clear();
@@ -664,21 +663,14 @@ export function createFleetLedger(hooks = {}, opts = {}) {
             '(换会话不是重连:再渲上一会话的行就是跨会话残影)');
     };
     return {
-        applyFrame(frame) {
-            if (disposed)
-                return;
-            applyFrame(frame, null);
-        },
         issueStream() {
             const session = engineSessionParamFor(sessionKey);
-            if (shouldResetContentFor(session)) {
-                resetLedgerContentOnSessionChange(contentAnchorSet ? contentAnchor : '<兼容入口,归属不可知>', session);
-            }
+            if (shouldResetContentFor(session))
+                resetLedgerContentOnSessionChange(contentAnchor, session);
             resetConnectionMeta('新 stream ingress');
             const epoch = ++epochSeq;
             liveStreamEpoch = epoch;
             streamAnchor = session;
-            everIssuedStream = true;
             liveSnapshotEpoch = 0;
             debug(`[fleet-frame] ingress issued(kind=stream key=${sessionKey} epoch=${epoch} session=${session ?? '-'})`);
             return {
@@ -688,13 +680,11 @@ export function createFleetLedger(hooks = {}, opts = {}) {
         },
         issueSnapshot(snapOpts) {
             const inStreamMode = liveStreamEpoch !== 0;
-            const compatStreamLive = !inStreamMode && connected && !everIssuedStream;
-            const duringLiveStream = inStreamMode || compatStreamLive;
+            const duringLiveStream = inStreamMode;
             const session = inStreamMode ? streamAnchor : engineSessionParamFor(sessionKey);
             if (!duringLiveStream) {
-                if (shouldResetContentFor(session)) {
-                    resetLedgerContentOnSessionChange(contentAnchorSet ? contentAnchor : '<兼容入口,归属不可知>', session);
-                }
+                if (shouldResetContentFor(session))
+                    resetLedgerContentOnSessionChange(contentAnchor, session);
                 resetConnectionMeta('快照连接:SDK 封装吞掉了它自己的 meta,不许沿用别条连接的信任位');
             }
             if (inStreamMode) {
@@ -704,9 +694,8 @@ export function createFleetLedger(hooks = {}, opts = {}) {
             const epoch = ++epochSeq;
             liveSnapshotEpoch = epoch;
             debug(`[fleet-frame] ingress issued(kind=snapshot key=${sessionKey} epoch=${epoch} session=${session ?? '-'})`);
-            const writesAtIssue = ledgerWrites;
             const issuedDuringStream = duringLiveStream;
-            const base = makeIngress('snapshot', epoch, session, () => liveSnapshotEpoch === epoch && !issuedDuringStream && ledgerWrites === writesAtIssue);
+            const base = makeIngress('snapshot', epoch, session, () => liveSnapshotEpoch === epoch && !issuedDuringStream);
             return {
                 ...base,
                 applySnapshot(snapshot) {
@@ -723,12 +712,8 @@ export function createFleetLedger(hooks = {}, opts = {}) {
                 },
             };
         },
-        setConnected(v) {
-            connected = v;
-        },
         project,
         status: () => ({
-            connected,
             version,
             scoped,
             sessionScoped: sessionScopedMeta,

package/dist/fleet/fleetProjection.d.ts

@@ -1,5 +1,5 @@
-import type { FleetTaskRow, FleetWorkflowRow } from '@sema-agent/sdk';
-export type FleetTaskStatus = 'queued' | 'running' | 'waiting' | 'stopping' | 'awaiting approval' | 'idle' | 'completed' | 'failed' | 'killed';
+import type { FleetTaskRow, FleetWorkflowRow, FleetTaskStatus } from '@sema-agent/sdk';
+export type { FleetTaskStatus };
 export interface FleetTaskView {
     id: string;
     name: string;

package/dist/fleet/fleetProjection.js

@@ -4,7 +4,10 @@ import { cycleSeqValue } from '../cycleOrder.js';
 import { frozenSet } from '../frozenSet.js';
 import { CORE_RESERVED_AGENT_NAMES } from '../generated/engineFactTables.js';
 export function coerceTaskStatus(s) {
-    switch (s) {
+    if (s === 'parked')
+        return 'awaiting approval';
+    const word = s;
+    switch (word) {
         case 'queued':
         case 'running':
         case 'waiting':
@@ -14,11 +17,12 @@ export function coerceTaskStatus(s) {
         case 'completed':
         case 'failed':
         case 'killed':
-            return s;
-        case 'parked':
-            return 'awaiting approval';
-        default:
+            return word;
+        default: {
+            const unhandled = word;
+            void unhandled;
             return 'idle';
+        }
     }
 }
 export function coerceWorkflowStatus(s) {
@@ -49,11 +53,9 @@ function deriveAgentLabel(agentType, agentName, name, id) {
     const tail = rowIdTail(id).slice(-8);
     return tail ? `agent ${tail}` : 'agent';
 }
-const CONTROL_VERB_LEGACY_NAMES = ['Task', 'Fork'];
 const CONTROL_VERB_GOAL_NAMES = ['DeclareDone'];
 export const CONTROL_TOOL_VERBS = frozenSet([
     ...CORE_RESERVED_AGENT_NAMES,
-    ...CONTROL_VERB_LEGACY_NAMES,
     ...CONTROL_VERB_GOAL_NAMES,
 ]);
 export function projectDescription(description) {
@@ -350,5 +352,5 @@ export const FLEET_TASK_ROW_KEYS_NOT_PROJECTED = {
     },
 };
 export const FLEET_WORKFLOW_ROW_KEYS_NOT_PROJECTED = {};
-const _fleetViewKeyPins = [true, true, true, true, true, true, true, true, true, true];
+const _fleetViewKeyPins = [true, true, true, true, true, true, true, true];
 void _fleetViewKeyPins;

package/dist/frameBinding.d.ts

@@ -0,0 +1,8 @@
+import type { AgentEvent } from '@sema-agent/sdk';
+import type { EngineBoundRun } from './engineRowRef.js';
+import type { ApprovalFrameContext } from './eventLeg.js';
+export declare function registerApprovalFrameContext(frame: AgentEvent, ctx: ApprovalFrameContext): void;
+export declare function approvalFrameContextOfFrame(frame: object | null | undefined): ApprovalFrameContext | undefined;
+export declare function registerFrameBinding(frame: AgentEvent, binding: EngineBoundRun): void;
+export declare function frameBindingOf(frame: AgentEvent): EngineBoundRun | undefined;
+export declare function inheritFrameBinding<T extends AgentEvent>(from: AgentEvent, to: T): T;

package/dist/frameBinding.js

@@ -0,0 +1,35 @@
+const frameBindings = new WeakMap();
+const approvalFrameContexts = new WeakMap();
+export function registerApprovalFrameContext(frame, ctx) {
+    if (typeof frame !== 'object' || frame === null || approvalFrameContexts.has(frame))
+        return;
+    approvalFrameContexts.set(frame, ctx);
+}
+export function approvalFrameContextOfFrame(frame) {
+    return typeof frame === 'object' && frame !== null ? approvalFrameContexts.get(frame) : undefined;
+}
+export function registerFrameBinding(frame, binding) {
+    if (typeof frame !== 'object' || frame === null)
+        return;
+    if (binding.taskId === undefined && binding.sessionId === undefined)
+        return;
+    if (frameBindings.has(frame))
+        return;
+    frameBindings.set(frame, binding);
+}
+export function frameBindingOf(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return undefined;
+    return frameBindings.get(frame);
+}
+export function inheritFrameBinding(from, to) {
+    if (typeof from !== 'object' || from === null || typeof to !== 'object' || to === null || from === to)
+        return to;
+    const binding = frameBindings.get(from);
+    if (binding !== undefined && !frameBindings.has(to))
+        frameBindings.set(to, binding);
+    const ctx = approvalFrameContexts.get(from);
+    if (ctx !== undefined && !approvalFrameContexts.has(to))
+        approvalFrameContexts.set(to, ctx);
+    return to;
+}

package/dist/gateFailureCodes.d.ts

@@ -0,0 +1,2 @@
+export declare function isGateStandingErrorCode(code: string | null | undefined, retriable?: boolean): boolean;
+export declare function isCodeClassifiedGateFailure(code: string | null | undefined, retriable?: boolean): boolean;

package/dist/gateFailureCodes.js

@@ -0,0 +1,15 @@
+import { DECIDE_WORKFLOW_PARK_FORKED, DECIDE_WORKFLOW_PARKS_UNREADABLE, PARKED_RESUME_STARTUP_FAILED, RESUME_POLICY_FOLD_CODE, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, isRefusedParkCode } from './engineErrorCodes.js';
+import { RESUME_REFUSAL_CODES } from './resumeRefusalCopy.js';
+export function isGateStandingErrorCode(code, retriable) {
+    return (code === RESUME_POLICY_FOLD_CODE ||
+        code === 'corrupt' ||
+        (isRefusedParkCode(code) && retriable === true) ||
+        (typeof code === 'string' && RESUME_REOPEN_CODES.includes(code) && retriable === true) ||
+        code === DECIDE_WORKFLOW_PARKS_UNREADABLE ||
+        code === DECIDE_WORKFLOW_PARK_FORKED);
+}
+export function isCodeClassifiedGateFailure(code, retriable) {
+    return (isGateStandingErrorCode(code, retriable) ||
+        code === PARKED_RESUME_STARTUP_FAILED ||
+        (typeof code === 'string' && (RESUME_RETRY_LATER_CODES.includes(code) || RESUME_REFUSAL_CODES.includes(code))));
+}

package/dist/gateOutcome.d.ts

@@ -32,7 +32,7 @@ export interface GateModeReleaseView {
     mandate?: string;
     reason?: string;
 }
-export declare const GATE_MODE_RELEASE_REASON_WORDS: readonly ["rule_unreadable", "target_unresolved"];
+export declare const GATE_MODE_RELEASE_REASON_WORDS: readonly ["target_unresolved"];
 export type GateModeReleaseReasonWord = (typeof CORE_MODE_RELEASE_REASONS)[number];
 export declare function isGateModeReleaseReasonWord(v: unknown): v is GateModeReleaseReasonWord;
 export declare function modeReleaseReasonSentence(reason: string | null | undefined): string | undefined;
@@ -58,10 +58,12 @@ export interface SettlementView {
     when?: number;
     note?: string;
 }
+export type GateRecordSeat = 'settlement' | 'cause' | 'classifier';
 export interface GateOutcomeView {
     disposition: GateDispositionView;
     settlement?: SettlementView;
     origin?: string;
+    unreadable?: readonly GateRecordSeat[];
 }
 export declare function gateOutcomeOf(frame: unknown): GateOutcomeView | undefined;
 export declare function isGateParkedToolEnd(frame: unknown): boolean;

package/dist/gateOutcome.js

@@ -10,7 +10,6 @@ export function isGateModeReleaseReasonWord(v) {
     return typeof v === 'string' && CORE_MODE_RELEASE_REASONS.includes(v);
 }
 const MODE_RELEASE_SENTENCE_BY_REASON = Object.freeze({
-    rule_unreadable: 'The permission mode let this call run without asking, even though it could not be checked against your saved permission rules.',
     target_unresolved: 'The permission mode let this call run without asking, even though it could not be determined where its write lands on disk, so whether it lands on a guarded location is unknown.',
 });
 const MODE_RELEASE_UNRECOGNISED_SENTENCE = 'The permission mode let this call run without asking, for a reason this client does not recognise.';
@@ -65,6 +64,9 @@ export function createReleaseDisclosureLedger() {
     });
 }
 export const SETTLEMENT_KIND_WORDS = CORE_SETTLEMENT_KINDS;
+function isGateRecordSeat(x) {
+    return x === 'settlement' || x === 'cause' || x === 'classifier';
+}
 function readWho(v) {
     if (typeof v !== 'object' || v === null || Array.isArray(v))
         return undefined;
@@ -151,6 +153,15 @@ function readClassifierRound(raw) {
     }
     return view;
 }
+function carriedUnreadableSeats(v) {
+    const out = new Set();
+    if (!Array.isArray(v))
+        return out;
+    for (const x of v)
+        if (isGateRecordSeat(x))
+            out.add(x);
+    return out;
+}
 function readGateRecord(frame) {
     if (typeof frame !== 'object' || frame === null || Array.isArray(frame))
         return undefined;
@@ -158,6 +169,7 @@ function readGateRecord(frame) {
     if (typeof g !== 'object' || g === null || Array.isArray(g))
         return undefined;
     const raw = g;
+    const carried = carriedUnreadableSeats(raw.unreadable);
     const d = raw.disposition;
     if (typeof d !== 'object' || d === null || Array.isArray(d))
         return undefined;
@@ -180,7 +192,7 @@ function readGateRecord(frame) {
         if (deniedBy === undefined)
             return undefined;
         const causeRaw = dr.cause;
-        causePresent = causeRaw !== undefined;
+        causePresent = causeRaw !== undefined || carried.has('cause');
         const cause = str(causeRaw);
         const mode = str(dr.mode);
         const askClass = str(dr.askClass);
@@ -201,24 +213,47 @@ function readGateRecord(frame) {
     const settlementRaw = raw.settlement;
     const settlement = readSettlement(settlementRaw);
     const origin = readAskOrigin(raw);
+    const settlementPresent = settlementRaw !== undefined || carried.has('settlement');
+    const classifierPresent = classifierRaw !== undefined || carried.has('classifier');
+    const missing = {
+        settlement: settlementPresent && settlement === undefined,
+        cause: causePresent && disposition.kind === 'denied' && disposition.cause === undefined,
+        classifier: classifierPresent && disposition.classifier === undefined,
+    };
+    const unreadable = Object.keys(missing).filter((seat) => missing[seat]);
     return {
         view: {
             disposition,
             ...(settlement !== undefined ? { settlement } : {}),
             ...(origin !== undefined ? { origin } : {}),
+            ...(unreadable.length > 0 ? { unreadable: Object.freeze(unreadable) } : {}),
         },
-        settlementPresent: settlementRaw !== undefined,
+        settlementPresent,
         causePresent,
-        classifierPresent: classifierRaw !== undefined,
+        classifierPresent,
     };
 }
 export function gateOutcomeOf(frame) {
     return readGateRecord(frame)?.view;
 }
 export function isGateParkedToolEnd(frame) {
-    if (typeof frame !== 'object' || frame === null || Array.isArray(frame))
+    if (typeof frame !== 'object' || frame === null)
+        return false;
+    try {
+        if (Array.isArray(frame))
+            return false;
+        if (readOwnDataValue(frame, 'errorCode') === GATE_PARKED_ERROR_CODE)
+            return true;
+        if (readOwnDataValue(frame, 'role') !== 'toolResult')
+            return false;
+        const details = readOwnDataValue(frame, 'details');
+        if (typeof details !== 'object' || details === null || Array.isArray(details))
+            return false;
+        return readOwnDataValue(details, 'code') === GATE_PARKED_ERROR_CODE;
+    }
+    catch {
         return false;
-    return frame.errorCode === GATE_PARKED_ERROR_CODE;
+    }
 }
 export function gateModeRelease(g) {
     return g?.disposition.kind === 'allowed' ? g.disposition.released : undefined;
@@ -257,8 +292,6 @@ export function ccToolDenialKindForToolEnd(frame) {
     const stamped = frame._sema_denial_kind;
     if (isCcToolDenialKind(stamped))
         return stamped;
-    if (frame._sema_denial_unclassified === true)
-        return undefined;
     const record = readGateRecord(frame);
     const outcome = record?.view;
     const kind = outcome?.settlement?.kind;

package/dist/gateVocabulary.d.ts

@@ -1,4 +1,5 @@
 import { CORE_DENIED_BY_VALUES, CORE_PERSISTED_RULE_MANDATES } from './generated/engineFactTables.js';
+import type { UiLanguage } from './env/uiLanguage.js';
 export declare const CC_TOOL_DENIAL_KINDS: readonly ["user-rejected", "permission-rule", "automode-blocked", "automode-unavailable", "automode-parsing-error", "interrupted", "cancelled"];
 export type CcToolDenialKind = (typeof CC_TOOL_DENIAL_KINDS)[number];
 export declare function isCcToolDenialKind(v: unknown): v is CcToolDenialKind;
@@ -7,10 +8,15 @@ export declare function ccToolDenialKindForSettledBy(settledBy: unknown): CcTool
 export type GateDeniedByWord = (typeof CORE_DENIED_BY_VALUES)[number];
 export declare const GATE_DENIED_BY_WORDS: readonly GateDeniedByWord[];
 export declare function isGateDeniedByWord(v: unknown): v is GateDeniedByWord;
-export declare function gateDeniedByDetail(deniedBy: unknown): string;
-export declare function askOriginDetail(origin: unknown): string;
-export declare function mandatedApprovalDetail(): string;
+export declare function gateDeniedByDetail(deniedBy: unknown, lang?: UiLanguage): string;
+export declare function askOriginDetail(origin: unknown, lang?: UiLanguage): string;
+export declare function askOriginNoteOf(origin: string | undefined, lang?: UiLanguage): string | undefined;
+export declare function ruleOffersAbsenceDetail(reason: string | undefined, opts?: {
+    readonly deploymentListSessionRow?: boolean;
+}, lang?: UiLanguage): string | undefined;
+export declare function ruleOfferUncoveredDetail(reason: string | undefined, lang?: UiLanguage): string;
+export declare function mandatedApprovalDetail(lang?: UiLanguage): string;
 export declare const APPROVAL_MANDATE_WORDS: readonly (typeof CORE_PERSISTED_RULE_MANDATES)[number][];
 export type ApprovalMandateWord = (typeof APPROVAL_MANDATE_WORDS)[number];
 export declare function isApprovalMandateWord(v: unknown): v is ApprovalMandateWord;
-export declare function approvalMandateDetail(word: ApprovalMandateWord): string;
+export declare function approvalMandateDetail(word: ApprovalMandateWord, lang?: UiLanguage): string;

package/dist/gateVocabulary.js

@@ -1,4 +1,6 @@
 import { CORE_DENIED_BY_VALUES, CORE_PERSISTED_RULE_MANDATES } from './generated/engineFactTables.js';
+import { guardedRead, readOwnDataValue } from './ownKey.js';
+import { msg, renderMessage } from './i18n/translate.js';
 export const CC_TOOL_DENIAL_KINDS = Object.freeze([
     'user-rejected',
     'permission-rule',
@@ -24,52 +26,110 @@ export function ccToolDenialKindForSettledBy(settledBy) {
 export const GATE_DENIED_BY_WORDS = Object.freeze([...CORE_DENIED_BY_VALUES]);
 const _deniedByWordsPin = true;
 void _deniedByWordsPin;
-const DENIED_BY_SENTENCES = Object.freeze({
-    policy: "denied by this deployment's permission policy",
-    hook: 'denied by a PreToolUse hook',
-    org: 'denied by an organization rule',
-    persisted_rule: 'denied by a persisted rule',
-    classifier: 'denied by the auto-mode classifier',
-    compliance: 'denied by a compliance lock',
-    write_protection: 'denied because the write landed on a write-protected path',
-    ask_resolution: 'denied when the approval was resolved',
-    read_boundary: 'denied by the read boundary',
-    mode: "denied by this session's permission mode",
+const DENIED_BY_KEYS = Object.freeze({
+    policy: 'approval.deniedBy.policy',
+    hook: 'approval.deniedBy.hook',
+    org: 'approval.deniedBy.org',
+    persisted_rule: 'approval.deniedBy.persistedRule',
+    classifier: 'approval.deniedBy.classifier',
+    compliance: 'approval.deniedBy.compliance',
+    write_protection: 'approval.deniedBy.writeProtection',
+    ask_resolution: 'approval.deniedBy.askResolution',
+    read_boundary: 'approval.deniedBy.readBoundary',
+    mode: 'approval.deniedBy.mode',
 });
 export function isGateDeniedByWord(v) {
     return typeof v === 'string' && GATE_DENIED_BY_WORDS.includes(v);
 }
-export function gateDeniedByDetail(deniedBy) {
-    if (typeof deniedBy === 'string' && Object.hasOwn(DENIED_BY_SENTENCES, deniedBy)) {
-        return DENIED_BY_SENTENCES[deniedBy];
+export function gateDeniedByDetail(deniedBy, lang) {
+    if (typeof deniedBy === 'string' && Object.hasOwn(DENIED_BY_KEYS, deniedBy)) {
+        return renderMessage(msg(DENIED_BY_KEYS[deniedBy]), lang);
     }
-    const word = typeof deniedBy === 'string' && deniedBy.length > 0 ? deniedBy : '(none)';
-    return `denied by a layer this build does not know (${word}) — this build does not know this layer name, so it cannot say which layer refused this call or why`;
+    const word = typeof deniedBy === 'string' && deniedBy.length > 0 ? deniedBy : msg('approval.card.noWord');
+    return renderMessage(msg('approval.deniedBy.unknown', { word }), lang);
 }
-const ASK_ORIGIN_SENTENCES = Object.freeze({
-    content_question: 'the tool itself asked you a question',
-    ancestor_marked: 'an ancestor marked this call (an inherited approver-unavailable float, or a durable mandate; this client cannot tell which from the origin alone): it must reach the park with no synchronous decision-maker in between',
-    org_unavailable: 'the organization policy was unavailable, so this call asks',
-    org_rule: 'an organization rule asks about this call',
-    rule_store_unavailable: 'this call could not be checked against your standing deny/ask rules, so it asks',
-    hook: 'a PreToolUse hook asked about this call',
-    ask_rule: 'a persisted ask rule matches this call',
-    denial_limit_fallback: 'the auto-mode classifier hit its denial limit and handed this call back to you',
-    shell_gate_tighten: 'the coarse shell check rates this command above the tier it lets through, so it asks',
-    safety_tighten: 'the gate tightened on this call’s own facts (network egress, irreversibility, or a protected write; this client cannot tell which from the origin alone)',
-    policy: 'this deployment’s permission policy asks about this call',
+const ASK_ORIGIN_KEYS = Object.freeze({
+    content_question: 'approval.origin.contentQuestion',
+    plan_review: 'approval.origin.planReview',
+    ancestor_marked: 'approval.origin.ancestorMarked',
+    org_unavailable: 'approval.origin.orgUnavailable',
+    org_rule: 'approval.origin.orgRule',
+    rule_store_unavailable: 'approval.origin.ruleStoreUnavailable',
+    hook: 'approval.origin.hook',
+    ask_rule: 'approval.origin.askRule',
+    denial_limit_fallback: 'approval.origin.denialLimitFallback',
+    shell_gate_tighten: 'approval.origin.shellGateTighten',
+    safety_tighten: 'approval.origin.safetyTighten',
+    policy: 'approval.origin.policy',
 });
-export function askOriginDetail(origin) {
-    const known = typeof origin === 'string' && Object.hasOwn(ASK_ORIGIN_SENTENCES, origin)
-        ? ASK_ORIGIN_SENTENCES[origin]
+export function askOriginDetail(origin, lang) {
+    const known = typeof origin === 'string' && Object.hasOwn(ASK_ORIGIN_KEYS, origin)
+        ? ASK_ORIGIN_KEYS[origin]
         : undefined;
     if (known !== undefined)
-        return known;
-    const word = typeof origin === 'string' && origin.length > 0 ? origin : '(none)';
-    return `this call asks; its origin ${word} is a word newer than this client, so answer it as usual`;
+        return renderMessage(msg(known), lang);
+    const word = typeof origin === 'string' && origin.length > 0 ? origin : msg('approval.card.noWord');
+    return renderMessage(unknownAskOriginSentence(word), lang);
 }
-export function mandatedApprovalDetail() {
-    return 'no saved allow rule and no remembered answer can retire this question; each call is settled on its own — by you here or by an automatic check the deployment runs — and an answer covers only that call';
+function unknownAskOriginSentence(word) {
+    return word === undefined ? msg('approval.origin.unknownNoWord') : msg('approval.origin.unknownWithWord', { word });
+}
+const ASK_ORIGIN_QUIET = Object.freeze({
+    content_question: true,
+    plan_review: true,
+    ancestor_marked: false,
+    org_unavailable: false,
+    org_rule: false,
+    rule_store_unavailable: false,
+    hook: false,
+    ask_rule: true,
+    denial_limit_fallback: false,
+    shell_gate_tighten: false,
+    safety_tighten: false,
+    policy: true,
+});
+export function askOriginNoteOf(origin, lang) {
+    if (typeof origin !== 'string' || origin === '')
+        return undefined;
+    if (Object.hasOwn(ASK_ORIGIN_QUIET, origin)) {
+        return ASK_ORIGIN_QUIET[origin] === true ? undefined : askOriginDetail(origin, lang);
+    }
+    return renderMessage(unknownAskOriginSentence(undefined), lang);
+}
+const RULE_OFFERS_ABSENCE_KEYS = Object.freeze({
+    mandated: { line: null },
+    allow_outranked: { line: 'approval.ruleOffer.absence.allowOutranked' },
+    ask_rule_matched: {
+        line: 'approval.ruleOffer.absence.askRuleMatched',
+        deploymentList: 'approval.ruleOffer.absence.askRuleMatchedDeploymentList',
+    },
+    lane_cannot_speak: { line: 'approval.ruleOffer.absence.laneCannotSpeak' },
+});
+export function ruleOffersAbsenceDetail(reason, opts, lang) {
+    if (typeof reason !== 'string' || reason === '')
+        return undefined;
+    if (Object.hasOwn(RULE_OFFERS_ABSENCE_KEYS, reason)) {
+        const entry = RULE_OFFERS_ABSENCE_KEYS[reason];
+        if (entry.line === null)
+            return undefined;
+        const onList = guardedRead(() => readOwnDataValue(opts, 'deploymentListSessionRow')) === true;
+        return renderMessage(msg(onList && entry.deploymentList !== undefined ? entry.deploymentList : entry.line), lang);
+    }
+    return renderMessage(msg('approval.ruleOffer.absence.unknown'), lang);
+}
+const RULE_OFFER_UNCOVERED_KEYS = Object.freeze({
+    redirection: 'approval.ruleOffer.uncovered.redirection',
+    no_rule_form: 'approval.ruleOffer.uncovered.noRuleForm',
+    cap_overflow: 'approval.ruleOffer.uncovered.capOverflow',
+});
+export function ruleOfferUncoveredDetail(reason, lang) {
+    if (typeof reason === 'string' && Object.hasOwn(RULE_OFFER_UNCOVERED_KEYS, reason)) {
+        return renderMessage(msg(RULE_OFFER_UNCOVERED_KEYS[reason]), lang);
+    }
+    return renderMessage(msg('approval.ruleOffer.uncovered.unknown'), lang);
+}
+export function mandatedApprovalDetail(lang) {
+    return renderMessage(msg('approval.mandate.generic'), lang);
 }
 export const APPROVAL_MANDATE_WORDS = Object.freeze([...CORE_PERSISTED_RULE_MANDATES]);
 const _mandateWordsPin = true;
@@ -77,18 +137,18 @@ void _mandateWordsPin;
 export function isApprovalMandateWord(v) {
     return APPROVAL_MANDATE_SET.has(v);
 }
-const APPROVAL_MANDATE_SENTENCES = Object.freeze({
-    operator_always: 'this deployment requires a separate confirmation for each shell command, and this call is one of them',
-    tool_marks: 'this tool declares that it reaches outside this machine or makes changes that cannot be undone',
-    probe_mandate: 'the check run on this call marked it as needing its own confirmation (the built-in shell check does so for a read outside the directories allowed for this session)',
-    probe_unanswered: 'the check run on this call did not answer (it timed out or failed; this client cannot tell which), so whether the call stays inside the directories allowed for this session is unknown',
-    write_protection: "this change lands on a protected location (the agent's own configuration), which is confirmed one change at a time",
-    target_unresolved: 'where this change lands on disk could not be determined (a link on the way could not be examined, or the target could not be resolved), so whether it lands on a guarded location is unknown',
+const APPROVAL_MANDATE_KEYS = Object.freeze({
+    operator_always: 'approval.mandate.word.operatorAlways',
+    tool_marks: 'approval.mandate.word.toolMarks',
+    probe_mandate: 'approval.mandate.word.probeMandate',
+    probe_unanswered: 'approval.mandate.word.probeUnanswered',
+    write_protection: 'approval.mandate.word.writeProtection',
+    target_unresolved: 'approval.mandate.word.targetUnresolved',
 });
 const APPROVAL_MANDATE_SET = new Set(APPROVAL_MANDATE_WORDS);
-export function approvalMandateDetail(word) {
-    if (typeof word === 'string' && Object.hasOwn(APPROVAL_MANDATE_SENTENCES, word)) {
-        return APPROVAL_MANDATE_SENTENCES[word];
+export function approvalMandateDetail(word, lang) {
+    if (typeof word === 'string' && Object.hasOwn(APPROVAL_MANDATE_KEYS, word)) {
+        return renderMessage(msg(APPROVAL_MANDATE_KEYS[word]), lang);
     }
-    return 'the reason reported for this confirmation is not one this client recognises, so it shows no reason';
+    return renderMessage(msg('approval.mandate.unknownWord'), lang);
 }