@sema-agent/client-core 0.99.0 → 0.100.0

package/dist/i18n/messages.en.d.ts

@@ -183,11 +183,20 @@ declare const EN: {
     'config.mcp.nameBlank': string;
     'config.mcp.nameEdgeWhitespace': string;
     'config.mcp.nameCollides': string;
+    'config.mcp.nameTooLong': string;
+    'config.mcp.identityHeadersBothSet': string;
+    'config.mcp.transportUnreadable': string;
+    'config.mcp.transportInvalid': string;
+    'config.mcp.transportDegraded': string;
     'config.mcp.toolAxesInvalid': string;
     'config.mcp.toolAxesFallbackProblem': string;
     'config.mcp.elicitationInvalid': string;
     'config.mcp.cloudElicitationInvalid': string;
     'config.mcp.cloudToolAxesInvalid': string;
+    'config.mcp.cloudNameUnusable': string;
+    'config.mcp.cloudTransportInvalid': string;
+    'config.mcp.cloudTransportDegraded': string;
+    'config.mcp.cloudTransportDegradedUnreadable': string;
     'approval.boundGrants.notActivated.one': string;
     'approval.boundGrants.notActivated.other': string;
     'approval.boundGrants.listsNoToolsWithNothing.one': string;
@@ -298,10 +307,13 @@ declare const EN: {
     'resume.refusal.park.whyWalltime': string;
     'resume.refusal.park.whyInheritedGate': string;
     'resume.refusal.park.whyConfigRefused': string;
+    'resume.refusal.park.whyDeps': string;
     'resume.refusal.park.whyUnsupported': string;
     'resume.refusal.park.whatDefault': string;
     'resume.refusal.park.head': string;
     'resume.refusal.park.configMayReturn': string;
+    'resume.refusal.park.depsMayReturn': string;
+    'resume.refusal.park.blockedByTail': string;
     'resume.refusal.park.printEnded': string;
     'resume.refusal.park.printHolds': string;
     'resume.refusal.park.interactiveEnded': string;
@@ -377,6 +389,7 @@ declare const EN: {
     'session.selfHeal.row.steered.reported': string;
     'session.selfHeal.row.steered.unknown': string;
     'session.selfHeal.row.steerFailed.rejected': string;
+    'session.selfHeal.row.steerFailed.runEnded': string;
     'session.selfHeal.row.steerFailed.unknown': string;
     'session.selfHeal.row.attach': string;
     'session.selfHeal.row.cancelled.confirmed': string;
@@ -403,6 +416,9 @@ declare const EN: {
     'session.selfHeal.row.notParked.inFlight': string;
     'session.selfHeal.row.stateUnknown': string;
     'session.selfHeal.headless.status': string;
+    'session.selfHeal.endRun.engine': string;
+    'session.selfHeal.wakeOn.engine': string;
+    'session.selfHeal.wakeOn.host': string;
     'session.selfHeal.headless.decide': string;
     'session.selfHeal.headless.statusOnly': string;
     'session.selfHeal.headless.neverReleased': string;
@@ -491,6 +507,7 @@ declare const EN: {
     'session.fileHistoryRefusal.notSaid': string;
     'session.fileHistoryRefusal.unrecognized': string;
     'session.fileHistoryRefusal.unreadable': string;
+    'session.hostSettings.memorySwitchMalformed': string;
     'model.identity.lane.processEnv': string;
     'model.identity.lane.settingsEnv': string;
     'model.identity.lane.modelCatalogFile': string;
@@ -499,6 +516,37 @@ declare const EN: {
     'model.identity.routeGap.fact.endpointMissing': string;
     'model.identity.routeGap.fact.laneCredentialMissing': string;
     'model.identity.routeGap.sentence': string;
+    'model.identity.catalogAdoption.refused': string;
+    'model.identity.catalogAdoption.notResolvable': string;
+    'model.identity.catalogAdoption.notResolvableWithPartial': string;
+    'notice.injectionLane.sentence': string;
+    'notice.injectionLane.item.stdioMcp': string;
+    'notice.injectionLane.item.credentialedMcp': string;
+    'notice.injectionLane.item.taskHooks': string;
+    'notice.injectionLane.itemSeparator': string;
+    'rules.refusal.sentence.one': string;
+    'rules.refusal.sentence.other': string;
+    'rules.refusal.item': string;
+    'rules.refusal.itemSeparator': string;
+    'rules.refusal.list.more': string;
+    'rules.refusal.reason.toolName': string;
+    'rules.refusal.reason.homePath': string;
+    'config.agentsWire.refusedServer.sentence': string;
+    'config.agentsWire.refusedServer.cause.rejected': string;
+    'config.agentsWire.refusedServer.cause.notApproved': string;
+    'config.agentsWire.refusedServer.cause.disabled': string;
+    'config.agentsWire.refusedServer.cause.policyBlocked': string;
+    'config.agentsWire.refusedServer.cause.pluginOnly': string;
+    'config.agentsWire.refusedServer.cause.malformedConfig': string;
+    'config.agentsWire.refusedServer.cause.unknown': string;
+    'config.agentsWire.refusedServer.way.rejected': string;
+    'config.agentsWire.refusedServer.way.notApproved': string;
+    'config.agentsWire.refusedServer.way.disabled': string;
+    'config.agentsWire.refusedServer.way.policyBlocked': string;
+    'config.agentsWire.refusedServer.way.pluginOnly': string;
+    'config.agentsWire.refusedServer.way.malformedConfig': string;
+    'config.agentsWire.refusedServer.way.unknown': string;
+    'config.agentsWire.toolEntry.sentence': string;
     'config.hooks.valueShape.nothing': string;
     'config.hooks.valueShape.null': string;
     'config.hooks.valueShape.array': string;
@@ -697,6 +745,89 @@ declare const EN: {
     'notice.failure.settings.riskJoin': string;
     'notice.failure.wait.one': string;
     'notice.failure.wait.other': string;
+    'rules.issue.emptyTool': string;
+    'rules.issue.paren': string;
+    'rules.issue.toolName': string;
+    'rules.issue.paramSplit': string;
+    'rules.issue.primaryField': string;
+    'rules.issue.capExceeded': string;
+    'rules.issue.behavior': string;
+    'rules.issue.commandRule': string;
+    'rules.issue.entryType': string;
+    'rules.issue.allowRule': string;
+    'rules.issue.paramUnknown': string;
+    'rules.issue.paramNonScalar': string;
+    'rules.issue.toolUnknown': string;
+    'rules.issue.pathBase': string;
+    'rules.issue.mcpParen': string;
+    'rules.issue.coveringParen': string;
+    'rules.issue.paramSplitWithColon': string;
+    'rules.issue.paramSplitNoColon': string;
+    'rules.issue.newerCode': string;
+    'model.probe.verdict.ok': string;
+    'model.probe.verdict.okWaited': string;
+    'model.probe.verdict.auth': string;
+    'model.probe.verdict.unreachable': string;
+    'model.probe.verdict.unreachableWaited': string;
+    'model.probe.verdict.model': string;
+    'model.probe.verdict.shape': string;
+    'model.probe.verdict.busy': string;
+    'model.probe.verdict.noToken': string;
+    'model.probe.verdict.noTokenWaited': string;
+    'model.probe.verdict.other': string;
+    'session.humanTurn.imageUnknownVision.one': string;
+    'session.humanTurn.imageUnknownVision.other': string;
+    'config.scenarioRefusal.source.ruling': string;
+    'config.scenarioRefusal.source.deployment': string;
+    'config.scenarioRefusal.dangling': string;
+    'config.scenarioRefusal.generic': string;
+    'notice.wireRefusal.cancel.approvalSettled': string;
+    'notice.wireRefusal.cancel.runNotRunning': string;
+    'notice.wireRefusal.cancel.unrecognized': string;
+    'notice.wireRefusal.sendAgainAbout': string;
+    'notice.wireRefusal.usageWindow.head': string;
+    'notice.wireRefusal.usageWindow.unknownWait': string;
+    'notice.wireRefusal.fleetLease.head': string;
+    'notice.wireRefusal.fleetLease.authRejected': string;
+    'notice.wireRefusal.fleetLease.unreachable': string;
+    'notice.wireRefusal.fleetLease.unknownWait': string;
+    'notice.wireRefusal.denyAttribution.notInProof': string;
+    'notice.wireRefusal.denyAttribution.decisionConflict': string;
+    'notice.wireRefusal.denyAttribution.retiredKey': string;
+    'notice.wireRefusal.denyAttribution.attributionRejected': string;
+    'notice.wireRefusal.denyAttribution.named': string;
+    'notice.wireRefusal.sessionDelete.unrecognized': string;
+    'notice.wireRefusal.sessionDelete.childrenAlive': string;
+    'notice.wireRefusal.sessionDelete.which': string;
+    'notice.wireRefusal.sessionDelete.whichMore': string;
+    'notice.wireRefusal.sessionDelete.activeRun': string;
+    'notice.wireRefusal.sessionDelete.runId': string;
+    'notice.wireRefusal.bucket.unknown': string;
+    'notice.wireRefusal.bucket.subject.stored': string;
+    'notice.wireRefusal.bucket.subject.fresh': string;
+    'notice.wireRefusal.bucket.list': string;
+    'notice.wireRefusal.bucket.what.overCap.more': string;
+    'notice.wireRefusal.bucket.what.overCap.atMost': string;
+    'notice.wireRefusal.bucket.what.overCap.unknown': string;
+    'notice.wireRefusal.bucket.what.badEntry.at': string;
+    'notice.wireRefusal.bucket.what.badEntry.notList': string;
+    'notice.wireRefusal.bucket.fix.merge': string;
+    'notice.wireRefusal.bucket.fix.entry': string;
+    'notice.wireRefusal.bucket.fix.list': string;
+    'notice.wireRefusal.bucket.next.stored': string;
+    'notice.wireRefusal.bucket.next.fresh': string;
+    'notice.wireRefusal.toolDeclaration': string;
+    'notice.wireRefusal.hostPosture.notLocal': string;
+    'notice.wireRefusal.hostPosture.wholeEnv': string;
+    'notice.wireRefusal.hostPosture.writeFace': string;
+    'notice.wireRefusal.hostPosture.both': string;
+    'notice.wireRefusal.hostPosture.unattributed': string;
+    'notice.wireRefusal.autonomyLane': string;
+    'notice.wireRefusal.userAttachment': string;
+    'notice.wireRefusal.userInvokedSkill': string;
+    'notice.retry.source.unifiedHeader': string;
+    'notice.retry.source.providerCode': string;
+    'notice.retry.source.status': string;
 };
 export declare const EN_MESSAGES: Readonly<typeof EN>;
 export type MessageKey = keyof typeof EN;

package/dist/i18n/messages.en.js

@@ -180,14 +180,23 @@ const EN = {
     'onboard.refusal.writeFailed': 'The model configuration could not be saved.',
     'onboard.refusal.engineIsRemote': "The Cloud engine is in use — local model setup doesn't apply to it. Switch to the local engine first.",
     'onboard.refusal.envCatalogPresent': 'The engine is serving models from environment settings; adding the first catalog model would replace them, so nothing was saved. Add those models to the catalog first.',
-    'config.mcp.nameBlank': 'An MCP server entry{where} has an empty name ({name}), so it was not started. Give it a name, or remove the entry.',
-    'config.mcp.nameEdgeWhitespace': 'MCP server {name}{where} was not started: its name has leading or trailing whitespace, so it would not match the same name in other settings (for example a list of disabled servers). Remove the extra whitespace from the name.',
-    'config.mcp.nameCollides': 'MCP server {name}{where} was not started: its name has leading or trailing whitespace and, without it, would be the same name as another MCP server entry. Remove the extra whitespace from the name, or delete the duplicate entry.',
+    'config.mcp.nameBlank': 'An MCP server entry{where} has a name that cannot be used ({name}), so it was not started. Give it a name, or remove the entry.',
+    'config.mcp.nameEdgeWhitespace': 'MCP server name {name}{where} cannot be used as written, so the server was not started: it would not match the same name in other settings (for example a list of disabled servers). Remove the extra whitespace from the name.',
+    'config.mcp.nameCollides': 'MCP server name {name}{where} cannot be used as written, so the server was not started: without its leading or trailing whitespace it would be the same name as another MCP server entry. Remove the extra whitespace from the name, or delete the duplicate entry.',
+    'config.mcp.nameTooLong': 'MCP server name {name}{where} cannot be used, so the server was not started: server names are limited to 128 characters. Shorten the name.',
+    'config.mcp.identityHeadersBothSet': 'MCP server {name}{where} was not started: it sets both principalHeader and assertionHeader, which name the same identity header — keep only one of the two. The other MCP servers are unaffected.',
+    'config.mcp.transportUnreadable': 'could not be read (a getter or proxy trap on the declaration threw)',
+    'config.mcp.transportInvalid': 'MCP server {name}{where} was not started: its transport setting cannot be used — {path} {problem}. Fix that setting for this server (or remove the server); the other MCP servers are unaffected.',
+    'config.mcp.transportDegraded': 'MCP server {name}{where} was started without part of its transport settings, which cannot be used as written: {lost}. The rest of its settings are applied; fix the settings named above to get them applied too.',
     'config.mcp.toolAxesInvalid': 'MCP server {name}{where} was not started: its toolAxes setting is not valid — {problem}. Fix the toolAxes entry for this server (or remove it); the other MCP servers are unaffected.',
     'config.mcp.toolAxesFallbackProblem': 'the declaration is not a valid set of per-tool safety settings',
     'config.mcp.elicitationInvalid': 'MCP server {name}{where} was not started: its elicitation setting must be true or false. Fix the elicitation entry for this server (or remove it); the other MCP servers are unaffected.',
     'config.mcp.cloudElicitationInvalid': 'cloud config: MCP server entries left out because their elicitation setting is not true or false — fix or remove the elicitation entry: {who}',
     'config.mcp.cloudToolAxesInvalid': 'cloud config: MCP server entries left out because their toolAxes setting is not valid (per-tool safety overrides take only effect, egress and irreversibility, each with a legal value) — fix or remove the toolAxes entry: {who}',
+    'config.mcp.cloudNameUnusable': 'cloud config: MCP server entries left out because their names cannot be used as written (a name over 128 characters, or with leading or trailing whitespace) — fix the names: {who}',
+    'config.mcp.cloudTransportInvalid': 'cloud config: MCP server entries left out because their transport setting cannot be used by the engine as written (for example an address that is not an http(s) URL) — fix the transport setting: {who}',
+    'config.mcp.cloudTransportDegraded': 'cloud config: MCP server entries started without part of their transport settings, which cannot be used as written (the named settings were left out, the rest are applied) — fix the named settings: {who}',
+    'config.mcp.cloudTransportDegradedUnreadable': 'cloud config: the list of MCP server entries started with part of their settings left out could not be read by this client — a server may be running without some of its configured settings and without notice',
     'approval.boundGrants.notActivated.one': "Approving this does not activate the skill shown on the card: 1 entry on its refuse list reads as nothing, and the engine does not drop a refusal it cannot read, so the skill's instructions are not loaded and nothing it lists is granted.",
     'approval.boundGrants.notActivated.other': "Approving this does not activate the skill shown on the card: {count} entries on its refuse list read as nothing, and the engine does not drop a refusal it cannot read, so the skill's instructions are not loaded and nothing it lists is granted.",
     'approval.boundGrants.listsNoToolsWithNothing.one': 'Approving this activates the skill shown on the card; it lists no tools to run without asking and none to refuse. 1 listed entry reads as nothing and grants nothing.',
@@ -298,12 +307,15 @@ const EN = {
     'resume.refusal.park.whyWalltime': 'its run carries a wall-clock time allowance, which this engine version no longer enforces',
     'resume.refusal.park.whyInheritedGate': 'the permission-mode setting it was parked with can no longer be read',
     'resume.refusal.park.whyConfigRefused': 'the engine refuses the task configuration it was parked with',
+    'resume.refusal.park.whyDeps': 'the engine refuses the deployment’s own setup it would resume with (or a policy handed down to it as an inherited constraint) — a problem with the deployment, not with your decision',
     'resume.refusal.park.whyUnsupported': 'it was parked under conditions this engine version does not support (for example, by an earlier engine version)',
     'resume.refusal.park.whatDefault': 'parked step',
     'resume.refusal.park.head': 'This {what} cannot be resumed by this engine version: {why}. The same refusal comes back every time, so answering it again will not help (nothing was decided and nothing was resumed).',
     'resume.refusal.park.configMayReturn': ' If that configuration is restored, the same answer can go through again.',
-    'resume.refusal.park.printEnded': '{head} The engine ended that run ({code}); submit the work again as a new task.',
-    'resume.refusal.park.printHolds': '{head}{configMayReturn} The parked run still holds this session ({code}): cancel it ({cancel}), then submit the work again as a new task.',
+    'resume.refusal.park.depsMayReturn': ' The card stays open: once whoever operates the engine fixes the deployment, the same card can be decided again.',
+    'resume.refusal.park.blockedByTail': ' Admission code: {blockedBy}.',
+    'resume.refusal.park.printEnded': '{head} The engine ended that run ({code}); submit the work again as a new task.{blocked}',
+    'resume.refusal.park.printHolds': '{head}{configMayReturn} The parked run still holds this session ({code}): cancel it ({cancel}), then submit the work again as a new task.{blocked}',
     'resume.refusal.park.interactiveEnded': '{head} The engine ended that parked run, so this conversation is free: send the work again as a new message.',
     'resume.refusal.park.interactiveBusy': '{head}{configMayReturn} The parked run keeps this conversation busy until it is cancelled.',
     'resume.refusal.park.blockedPrint': 'sema will not put the card for run {run} back on screen by itself: this engine version refuses to resume it. Cancel the run ({cancel}) and submit the work again as a new task.',
@@ -373,10 +385,11 @@ const EN = {
     'session.selfHeal.row.steered.next.dismissed': 'You closed that decision card yourself, so sema did not put it back on screen; nothing will resume that run until that decision is made — send a message to bring the card back.',
     'session.selfHeal.row.steered.next.cannotShow': 'sema could not surface that decision card here{noView}, so nothing will resume that run until that decision is made; {wayOut} if you no longer want it.',
     'session.selfHeal.row.steered.queued': 'run {taskId} is not actually working right now: the engine reports it {parked} on a decision it needs from you, so it queued your message on that park instead of running it. {next} {textOnly} Nothing was cancelled, and your message did NOT start a new turn.',
-    'session.selfHeal.row.steered.parkedForWake': 'run {taskId} had already finished, so the engine parked your message on that finished run instead of running it — a parked message is delivered only if this session is woken on the engine (POST /v1/sessions/:id/wake), which sema does not do here. That run is no longer holding this session: send your message again to run it as a new turn — but note that the parked copy is NOT discarded, so if anything ever wakes this session on the engine that instruction would run a second time. {textOnly} Nothing was cancelled.',
+    'session.selfHeal.row.steered.parkedForWake': 'run {taskId} had already finished, so the engine parked your message on that finished run instead of running it — a parked message is delivered only if this session is woken on the engine{wakeOn}, which sema does not do here. That run is no longer holding this session: send your message again to run it as a new turn — but note that the parked copy is NOT discarded, so if anything ever wakes this session on the engine that instruction would run a second time. {textOnly} Nothing was cancelled.',
     'session.selfHeal.row.steered.reported': ' (it reported that run as {status})',
     'session.selfHeal.row.steered.unknown': 'sema handed your message to run {taskId}, but the engine did not say how it will be delivered{reported}. {textOnly} Nothing was cancelled, and your message did NOT start a new turn — {tail}',
     'session.selfHeal.row.steerFailed.rejected': 'Handing your message to the running run (run {taskId}) was refused: {detail}. sema did NOT retry it (a steer is not safe to send twice) and it did NOT cancel that run. Your message was NOT sent; send it again if you still want it.',
+    'session.selfHeal.row.steerFailed.runEnded': 'Run {taskId} had already finished (status {status}) by the time sema tried to hand it your message, so the engine refused it. sema did NOT retry it and did NOT cancel anything. That run no longer holds this session: send your message again to run it as a new turn.',
     'session.selfHeal.row.steerFailed.unknown': 'sema sent your message to the running run (run {taskId}) but could not confirm what happened to it ({detail}). A steer is not safe to send twice, so sema did NOT retry it, and it did NOT cancel that run. That run may or may not have received your message — watch what it does next before sending it again.',
     'session.selfHeal.row.attach': '{disclosure} Your message was NOT sent; send it again once that run has finished.',
     'session.selfHeal.row.cancelled.confirmed': 'You chose to cancel run {taskId}. The engine confirmed it is no longer holding this session, so sema is sending your message now.',
@@ -394,18 +407,21 @@ const EN = {
     'session.selfHeal.row.stale.cancelTimeout.unread': "sema asked the engine to cancel run {taskId} (parked on an approval that no longer exists there) but could not read that run's state back within {waited}, so it cannot confirm whether the session was released. Your message was NOT sent; send it again in a moment (if that run really is gone it will just run), or {wayOut}.",
     'session.selfHeal.row.stale.cancelTimeout.held': 'sema asked the engine to cancel run {taskId} (parked on an approval that no longer exists there), but that run still held this session {waited} later — cancelling is asynchronous and it may still be winding down. Your message was NOT sent; send it again in a moment, or {wayOut}.',
     'session.selfHeal.row.stale.cancelFailed.unknown': 'sema sent the cancel for run {taskId} (parked on an approval that no longer exists on the engine) but could not confirm what happened to it ({detail}), and it could not read that run back as released either. That run may or may not still be holding this session. Your message was NOT sent; send it again in a moment, or {wayOut}.',
-    'session.selfHeal.row.stale.wait.offered': 'Run {taskId} is still parked (status {status}) on an approval that no longer exists on the engine. sema already asked what to do with it and you chose to leave it alone, so it is not asking again. Your message was NOT sent; cancel that run on the engine (POST /v1/runs/{taskId}/cancel — that ends it for good), or {wayOut}.',
-    'session.selfHeal.row.stale.wait.first': 'Run {taskId} is still parked (status {status}) on an approval that no longer exists on the engine, so there is no card left to answer and that run will not settle on its own. sema did NOT cancel it — you chose to leave it alone. Your message was NOT sent; cancel that run on the engine (POST /v1/runs/{taskId}/cancel — that ends it for good), or {wayOut}.',
+    'session.selfHeal.row.stale.wait.offered': 'Run {taskId} is still parked (status {status}) on an approval that no longer exists on the engine. sema already asked what to do with it and you chose to leave it alone, so it is not asking again. Your message was NOT sent; {endRun} (that ends that run for good), or {wayOut}.',
+    'session.selfHeal.row.stale.wait.first': 'Run {taskId} is still parked (status {status}) on an approval that no longer exists on the engine, so there is no card left to answer and that run will not settle on its own. sema did NOT cancel it — you chose to leave it alone. Your message was NOT sent; {endRun} (that ends that run for good), or {wayOut}.',
     'session.selfHeal.row.runNotFound': 'The engine reported this session as held by run {taskId} (status running), but it no longer recognizes that run when asked directly — that claim looks stale (the run most likely no longer exists). sema did not offer to steer or cancel it: there is nothing left to act on. Your message was NOT sent; send it again (if the session really is free it will just run), or {wayOut}.',
     'session.selfHeal.row.runSettled': 'Run {taskId} has already finished (status {status}), but the engine still reported it as holding this session — that claim looks stale or mid-release. sema did not offer to steer or cancel it: the run is over. Your message was NOT sent; send it again (once the claim clears it will just run), or {wayOut}.',
-    'session.selfHeal.row.notParked.offered': 'Run {taskId} is still holding this session (status {status}). sema already asked what to do with it and you chose to leave it alone, so it is not asking again. Your message was NOT sent; wait for that run, cancel it on the engine (POST /v1/runs/{taskId}/cancel), or {wayOut}.',
+    'session.selfHeal.row.notParked.offered': 'Run {taskId} is still holding this session (status {status}). sema already asked what to do with it and you chose to leave it alone, so it is not asking again. Your message was NOT sent; wait for that run, {endRun}, or {wayOut}.',
     'session.selfHeal.row.notParked.parkedOn': 'This session is held by an earlier run (run {taskId}, status {status}) that is waiting on {parkedOn} — it will not finish on its own. sema did NOT cancel it, because cancelling would decide that item for you. Your message was NOT sent; {wayOut} if you no longer want it.',
     'session.selfHeal.row.notParked.inFlight': 'This session already has a run in flight (run {taskId}, status {status}) — most likely a turn you sent to the background. sema did NOT cancel it, because that would throw away work you asked for. Wait for it to finish, or {wayOut}.',
     'session.selfHeal.row.stateUnknown': "A run is still active on this session{handle} and sema could not read that run's state, so it did not touch it ({detail}). sema did NOT send your message: this session cannot start a new turn until that run settles — {wayOut}.",
     'session.selfHeal.headless.status': ' (status {status})',
-    'session.selfHeal.headless.decide': 'This session is held by an earlier run{handle}{status} that is parked waiting on {gate}, so this message was NOT sent. Decide it and the session unlocks: POST {decidePath}. Cancelling instead ({cancelPath}) also unlocks it, but it decides that item against you. Or {freshSession}.{governance}',
-    'session.selfHeal.headless.statusOnly': 'This session is held by an earlier run{handle} with status {status}, so this message was NOT sent. The engine reported no decision pending on that run: if it is still working, wait for it to finish; if it will never settle, release it with {cancelPath} (that discards whatever it was doing). Or {freshSession}.',
-    'session.selfHeal.headless.neverReleased': 'A run is still active on this session{handle} and was never released, so sema did NOT send this message. Nothing here clears on its own. {startOver}, or release the run on the engine: {cancelPath}',
+    'session.selfHeal.endRun.engine': 'cancel that run on the engine ({cancelPath})',
+    'session.selfHeal.wakeOn.engine': ' (POST /v1/sessions/:id/wake)',
+    'session.selfHeal.wakeOn.host': ' ({where})',
+    'session.selfHeal.headless.decide': 'This session is held by an earlier run{handle}{status} that is parked waiting on {gate}, so this message was NOT sent. Decide it and the session unlocks: POST {decidePath}. Ending that run instead also unlocks it, but it decides that item against you: {endRun}. Or {freshSession}.{governance}',
+    'session.selfHeal.headless.statusOnly': 'This session is held by an earlier run{handle} with status {status}, so this message was NOT sent. The engine reported no decision pending on that run: if it is still working, wait for it to finish; if it will never settle, {endRun} — that discards whatever it was doing. Or {freshSession}.',
+    'session.selfHeal.headless.neverReleased': 'A run is still active on this session{handle} and was never released, so sema did NOT send this message. Nothing here clears on its own. {startOver}, or {endRun}.',
     'approval.deniedBy.policy': "denied by this deployment's permission policy",
     'approval.deniedBy.hook': 'denied by a PreToolUse hook',
     'approval.deniedBy.org': 'denied by an organization rule',
@@ -491,6 +507,7 @@ const EN = {
     'session.fileHistoryRefusal.notSaid': 'Nothing was sent: file checkpointing is turned off in your settings, but this engine did not report whether it can stop recording file history for a session, so sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.',
     'session.fileHistoryRefusal.unrecognized': 'Nothing was sent: file checkpointing is turned off in your settings, but this engine reported a file-history capture mode this client does not recognize, so whether it can stop recording file history for a session is unknown and sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.',
     'session.fileHistoryRefusal.unreadable': "Nothing was sent: file checkpointing is turned off in your settings, but this engine's report on whether it can stop recording file history for a session could not be read by this client, so sending now could record it anyway. Trying again will not change that while this engine reports the same; to send and let file history be recorded this time, turn file checkpointing back on in your settings.",
+    'session.hostSettings.memorySwitchMalformed': 'The memory setting in your settings file could not be read, so turning memory off was not applied: this request was sent with memory available. Fix the memory section (memory.enabled must be true or false) to turn it off.',
     'model.identity.lane.processEnv': 'the environment this client was started with',
     'model.identity.lane.settingsEnv': "this client's settings file",
     'model.identity.lane.modelCatalogFile': 'the local model catalog file',
@@ -499,6 +516,37 @@ const EN = {
     'model.identity.routeGap.fact.endpointMissing': 'the model rides the OpenAI-compatible route and no gateway address (MODEL_GATEWAY_BASEURL) is set, and the engine refuses to start without one',
     'model.identity.routeGap.fact.laneCredentialMissing': 'the anthropic channel is selected (MODEL_PROVIDER=anthropic), neither ANTHROPIC_API_KEY nor ANTHROPIC_AUTH_TOKEN is set, and there is no gateway address (MODEL_GATEWAY_BASEURL) to fall back to, so the engine cannot start on any route',
     'model.identity.routeGap.sentence': '{lane} supplies a model name, but the local engine has no route to reach it — {fact}',
+    'model.identity.catalogAdoption.refused': '{lane} lists models, but the engine is reported to refuse this catalog as written, so none of them can serve as its default',
+    'model.identity.catalogAdoption.notResolvable': 'no model name is configured for the local engine to start with — {clause}, and the engine does not start without one',
+    'model.identity.catalogAdoption.notResolvableWithPartial': 'no model name is configured for the local engine to start with — {clause}, and {partial}, and the engine does not start without one',
+    'notice.injectionLane.sentence': "On this engine's {lane} lane the tools run on a different machine than the engine, so the {items} sent with a task run there rather than on this machine — any that rely on programs or credentials on this machine will fail there",
+    'notice.injectionLane.item.stdioMcp': 'local stdio MCP servers',
+    'notice.injectionLane.item.credentialedMcp': 'MCP servers that use credentials from this machine',
+    'notice.injectionLane.item.taskHooks': 'hooks',
+    'notice.injectionLane.itemSeparator': ', ',
+    'rules.refusal.sentence.one': 'permissions: 1 rule will not be enforced — {list}',
+    'rules.refusal.sentence.other': 'permissions: {count} rules will not be enforced — {list}',
+    'rules.refusal.item': '{rule} ({reason})',
+    'rules.refusal.itemSeparator': '; ',
+    'rules.refusal.list.more': '{shown} and {count} more',
+    'rules.refusal.reason.toolName': 'its tool name is not one this engine recognizes',
+    'rules.refusal.reason.homePath': 'it uses a ~/ path this engine cannot anchor — write the path relative to the project or as an absolute path',
+    'config.agentsWire.refusedServer.sentence': 'agents wire: {who}: its tools entry {entry} names a tool of the MCP server {server}, which {cause} — sent as written; this entry gives the agent nothing while that server stays out of the run. {way}',
+    'config.agentsWire.refusedServer.cause.rejected': 'was declined for this project and so is left out of this run',
+    'config.agentsWire.refusedServer.cause.notApproved': 'is not approved for this project and so is left out of this run',
+    'config.agentsWire.refusedServer.cause.disabled': 'is switched off in the MCP settings and so is left out of this run',
+    'config.agentsWire.refusedServer.cause.policyBlocked': 'is blocked by a managed policy list and so is left out of this run',
+    'config.agentsWire.refusedServer.cause.pluginOnly': 'is not allowed because a managed policy restricts MCP servers to plugins, so it is left out of this run',
+    'config.agentsWire.refusedServer.cause.malformedConfig': 'has a configuration the engine would refuse, so it is left out of this run',
+    'config.agentsWire.refusedServer.cause.unknown': 'is left out of this run',
+    'config.agentsWire.refusedServer.way.rejected': 'To give the agent those tools, approve the server for this project again; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.refusedServer.way.notApproved': 'To give the agent those tools, approve the server for this project; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.refusedServer.way.disabled': 'To give the agent those tools, switch the server back on; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.refusedServer.way.policyBlocked': 'Ask whoever manages the policy list to allow the server; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.refusedServer.way.pluginOnly': 'Ask whoever manages the policy to allow the server, or provide it through a plugin; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.refusedServer.way.malformedConfig': 'Fix the server configuration; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.refusedServer.way.unknown': 'Check why the server is left out; otherwise remove the entry from the agent definition.',
+    'config.agentsWire.toolEntry.sentence': 'agents wire: {who}: its tools entry {phrase} — sent as written; the engine judges this entry by its own tool list: an engine that refuses such an entry does not start the run (code config.agent.unknown_tool), and an engine that accepts it gives the agent no tool for this entry unless this run has a tool with exactly that name. Fix the entry in the agent definition.',
     'config.hooks.valueShape.nothing': 'nothing',
     'config.hooks.valueShape.null': 'null',
     'config.hooks.valueShape.array': 'an array',
@@ -697,5 +745,88 @@ const EN = {
     'notice.failure.settings.riskJoin': ', ',
     'notice.failure.wait.one': 'The server asked to retry after 1 second (Retry-After).',
     'notice.failure.wait.other': 'The server asked to retry after {seconds} seconds (Retry-After).',
+    'rules.issue.emptyTool': 'this rule is invalid: it names no tool',
+    'rules.issue.paren': 'this rule is invalid: its parentheses do not parse (escape a literal one as \\( or \\))',
+    'rules.issue.toolName': "this rule is invalid: its tool name is not spelled as a tool name (blanks around the rule, an invisible or disallowed character in the name or before the parenthesis, a leading '-', or the wildcard '*', which names no tool), so it would reach no tool or the wrong one",
+    'rules.issue.paramSplit': 'this rule is invalid: its parentheses do not hold a parameter rule written name:pattern',
+    'rules.issue.primaryField': "this rule is invalid: it patterns the tool's primary field, which matches the whole trimmed string rather than a prefix",
+    'rules.issue.capExceeded': 'this rule set is invalid: it is over one of the deployment caps (rule count, rule length, pattern length, or star count); this client cannot tell which from the code alone',
+    'rules.issue.behavior': 'this rule is invalid: its behavior is neither deny nor ask, so it would never fire',
+    'rules.issue.commandRule': 'this rule is invalid: the command pattern was rejected by the command-rule validator',
+    'rules.issue.entryType': 'this allow list is invalid: it must be a list of rule strings, and it or one of its entries is not a string',
+    'rules.issue.allowRule': 'an allow rule is not supported in a rule set that only says deny or ask — a standing approval belongs on the allow list instead',
+    'rules.issue.paramUnknown': 'this parameter rule is not supported: the tool carries no such parameter, so it could never match',
+    'rules.issue.paramNonScalar': 'this parameter rule is not supported: that parameter holds an object or an array, so it could never match',
+    'rules.issue.toolUnknown': "this rule is not supported on this leg: the resolver it supplied does not know the tool, so the rule's face cannot be checked",
+    'rules.issue.pathBase': 'this path rule is not supported as spelled: the base it is relative to is missing or is not a usable absolute path, so it would reach nothing and is refused rather than compiled',
+    'rules.issue.mcpParen': 'a parenthesised parameter rule is not supported on an MCP tool name',
+    'rules.issue.coveringParen': 'a parenthesised parameter rule is not supported on a covering protocol name — the parameter grammar is keyed by an exact tool name, so no mounted tool could ever bear it',
+    'rules.issue.paramSplitWithColon': 'this rule is invalid: a parameter rule is written name:pattern, and the name before the colon or the pattern after it is empty',
+    'rules.issue.paramSplitNoColon': 'this rule is invalid: there is no colon inside the parentheses, so this is not a parameter rule (a parameter rule is written name:pattern)',
+    'rules.issue.newerCode': 'this rule was refused with {code}, a code newer than this client',
+    'model.probe.verdict.ok': 'The model answered',
+    'model.probe.verdict.okWaited': 'The model answered — first token after {time}',
+    'model.probe.verdict.auth': 'The model service rejected the API key{http}',
+    'model.probe.verdict.unreachable': 'Could not reach the model service',
+    'model.probe.verdict.unreachableWaited': 'Could not reach the model service — no response within {time}',
+    'model.probe.verdict.model': 'The model service does not recognise this model id{http}',
+    'model.probe.verdict.shape': 'This address does not offer the expected interface{http} — check the API shape',
+    'model.probe.verdict.busy': 'The model service is busy right now{http} — retry later or switch model',
+    'model.probe.verdict.noToken': 'The model service answered but sent no token — it may be overloaded',
+    'model.probe.verdict.noTokenWaited': 'The model service answered but sent no token within {time} — it may be overloaded',
+    'model.probe.verdict.other': 'The model service gave an unexpected answer{http}',
+    'session.humanTurn.imageUnknownVision.one': "An @-mentioned image was sent with this message, although the engine's model list does not say whether the model this message uses accepts image input — if it does not, the images may be dropped or the message may be refused",
+    'session.humanTurn.imageUnknownVision.other': "{count} @-mentioned images were sent with this message, although the engine's model list does not say whether the model this message uses accepts image input — if it does not, the images may be dropped or the message may be refused",
+    'config.scenarioRefusal.source.ruling': ', assigned to you by the configuration center,',
+    'config.scenarioRefusal.source.deployment': ", this deployment's default scenario,",
+    'config.scenarioRefusal.dangling': "This deployment cannot resolve your scenario: the scenario{name}{from} does not exist here, so it refuses whatever depends on your scenario — new runs that do not name a scenario, and this session's list of MCP servers · Ask whoever operates the engine to fix the scenario assignment",
+    'config.scenarioRefusal.generic': "This deployment's scenario check refused to resolve your scenario{tail}, so whatever depends on your scenario is not available — this session's list of MCP servers is unknown",
+    'notice.wireRefusal.cancel.approvalSettled': 'The cancel did not apply: the approval this task was waiting on has already been decided or has expired elsewhere · Check what that decision did to the task before doing anything else',
+    'notice.wireRefusal.cancel.runNotRunning': 'The cancel could not be set: the task kept switching between running and waiting while the engine tried · Nothing was changed — send the cancel again',
+    'notice.wireRefusal.cancel.unrecognized': 'The engine refused this cancel with a conflict it did not explain · The task may have just been decided elsewhere, or may have changed state mid-cancel — check its current state, then cancel again if it is still active',
+    'notice.wireRefusal.sendAgainAbout': 'Send it again in about {wait}',
+    'notice.wireRefusal.usageWindow.head': "The deployment's usage window is exhausted, so the engine did not accept this request · Nothing is wrong with the request itself",
+    'notice.wireRefusal.usageWindow.unknownWait': 'The engine did not say how long the window needs — send it again a little later',
+    'notice.wireRefusal.fleetLease.head': 'This deployment could not confirm your usage budget with its quota service, and it refuses billed work while it cannot check, so the engine did not accept this request · Nothing is wrong with the request itself',
+    'notice.wireRefusal.fleetLease.authRejected': "The quota service rejected this engine's credentials — if this keeps happening, whoever operates the engine needs to fix them",
+    'notice.wireRefusal.fleetLease.unreachable': 'The engine could not reach the quota service',
+    'notice.wireRefusal.fleetLease.unknownWait': 'The engine did not say how long to wait — send it again a little later',
+    'notice.wireRefusal.denyAttribution.notInProof': 'The engine refused this refusal before judging it: this deployment signs the decisions it accepts, and the note saying who settled this one is not part of what gets signed · Nothing was decided and the approval is still waiting — send the same decision again without that note',
+    'notice.wireRefusal.denyAttribution.decisionConflict': 'The engine refused this decision before judging it: the body says a policy settled it and also asks to allow the call, and only a person can allow one · Nothing was decided and the approval is still waiting — send it again with the decision and the note in agreement',
+    'notice.wireRefusal.denyAttribution.retiredKey': 'The engine refused this decision before judging it: the note saying who settled it was sent under a name this engine no longer accepts · Nothing was decided and the approval is still waiting — send the decision again with who made it given under the name the engine now takes in its place',
+    'notice.wireRefusal.denyAttribution.attributionRejected': 'The engine would not accept the settlement details this decision carried, so it refused the decision before judging it.{named} · Nothing was decided and the approval is still waiting at the same coordinates — check what that part carried (the only piece this client sets is the note saying who settled the refusal) and decide once more',
+    'notice.wireRefusal.denyAttribution.named': ' It named {field} as the part it would not take.',
+    'notice.wireRefusal.sessionDelete.unrecognized': 'The engine refused to delete this session with a conflict it did not explain · Check whether the session is still listed and whether anything of it is still running, then try the delete again',
+    'notice.wireRefusal.sessionDelete.childrenAlive': 'This session was not deleted: background agents it started are still running where this engine cannot stop them{which} · Nothing was deleted — delete it again once they finish, or stop them where they run first',
+    'notice.wireRefusal.sessionDelete.which': ' ({ids})',
+    'notice.wireRefusal.sessionDelete.whichMore': ' ({ids} and {count} more)',
+    'notice.wireRefusal.sessionDelete.activeRun': 'This session was not deleted: it still has a run in progress{run} · Nothing was deleted — cancel that run or let it finish, then delete the session again',
+    'notice.wireRefusal.sessionDelete.runId': ' (run {id})',
+    'notice.wireRefusal.bucket.unknown': "The engine refused the permission rules in this request's settings as too many or malformed · Nothing was trimmed or dropped — fix the rule lists, then send the request again",
+    'notice.wireRefusal.bucket.subject.stored': 'The engine refused to continue this parked work: in the request stored for it,',
+    'notice.wireRefusal.bucket.subject.fresh': 'The engine refused this request:',
+    'notice.wireRefusal.bucket.list': 'the {bucket} rule list in the permission settings (permissions.{bucket})',
+    'notice.wireRefusal.bucket.what.overCap.more': '{list} has {count} entries, {excess} more than the {cap} the engine accepts',
+    'notice.wireRefusal.bucket.what.overCap.atMost': '{list} has {count} entries, and the engine accepts at most {cap}',
+    'notice.wireRefusal.bucket.what.overCap.unknown': '{list} has more entries than the engine accepts',
+    'notice.wireRefusal.bucket.what.badEntry.at': 'entry {position} of {list} is empty or not text',
+    'notice.wireRefusal.bucket.what.badEntry.notList': '{list} is not a list of rules',
+    'notice.wireRefusal.bucket.fix.merge': 'merge rules into broader patterns or remove some',
+    'notice.wireRefusal.bucket.fix.entry': 'fix or remove that entry, so every entry is a non-empty rule',
+    'notice.wireRefusal.bucket.fix.list': 'make it a list of non-empty rules',
+    'notice.wireRefusal.bucket.next.stored': 'It cannot continue as stored, and the engine refuses the list rather than silently losing rules — {fix}, then submit the work again as a new request',
+    'notice.wireRefusal.bucket.next.fresh': 'Nothing was trimmed or dropped, because the engine refuses the list rather than silently losing rules — {fix}, then send the request again',
+    'notice.wireRefusal.toolDeclaration': "The engine refused to start this run because of a tool this request declares; the engine's own message says which tool and what is wrong with it · This is a problem with the request itself, not a temporary outage — sending the same request again is refused the same way; fix or remove that tool declaration, then send it",
+    'notice.wireRefusal.hostPosture.notLocal': 'This is not a problem with your local settings and not something this client can grant — whoever runs this engine decides it',
+    'notice.wireRefusal.hostPosture.wholeEnv': "The engine refused this request before anything ran: this deployment serves more than one user, so a request may not hand the shell this machine's whole environment · {notLocal}; send it again without the whole-environment setting (or with the default), and the shell gets the default environment, with credential-like variables removed",
+    'notice.wireRefusal.hostPosture.writeFace': 'The engine refused this request before anything ran: this deployment does not let a request lift the write boundary with bypassPermissions · {notLocal}; send it again with another permission mode',
+    'notice.wireRefusal.hostPosture.both': "The engine refused this request before anything ran: the request asked both for the shell to inherit this machine's whole environment and for bypassPermissions, and this deployment refused at least one of them; the refusal does not say which · {notLocal}; send it again without one or both (the whole-environment setting is honored only on a single-user deployment)",
+    'notice.wireRefusal.hostPosture.unattributed': "The engine refused this request before anything ran: this deployment does not accept a setting in it that only a single-user deployment may use; the engine's own message names it · {notLocal}; send it again without that setting",
+    'notice.wireRefusal.autonomyLane': 'The engine did not start this leader run: this deployment runs in plan-only autonomy, and a leader run has no way to have its plan reviewed, so nothing was started · Submit the work as a regular run instead, or ask whoever operates the engine to change its autonomy setting',
+    'notice.wireRefusal.userAttachment': 'This message was not sent: the engine refused the files attached to it — together with the message they are more than it can take in one request on this model, or one of them is in a form it does not accept · Nothing was started and your draft is kept · Remove some attachments or attach smaller parts, then send it again',
+    'notice.wireRefusal.userInvokedSkill': 'The engine did not start this run: a skill named for it is not one this run has loaded, or skills are turned off for this run · Nothing was started and your draft is kept · Check the skill name, or load that skill, then send it again',
+    'notice.retry.source.unifiedHeader': "Judged from the model service's quota headers",
+    'notice.retry.source.providerCode': "Judged from the model service's error code",
+    'notice.retry.source.status': 'Judged from the HTTP status alone',
 };
 export const EN_MESSAGES = Object.freeze(EN);