@sema-agent/client-core 0.99.0 → 0.100.0

package/dist/settingsCredentialKeyPaths.js

@@ -0,0 +1,219 @@
+import { looksLikeKnownSecret, queryCarriesCredential } from './displayUntrusted.js';
+const CREDENTIAL_WORDS = new Set([
+    'key', 'keys', 'apikey', 'token', 'tokens', 'secret', 'secrets', 'password', 'passwd', 'pass', 'pwd', 'pin', 'otp',
+    'auth', 'authorization', 'credential', 'credentials', 'cookie', 'cookies', 'session', 'private', 'cert', 'signature', 'salt',
+]);
+const CREDENTIAL_STEMS = ['PASSWORD', 'PASSWD', 'SECRET', 'TOKEN', 'APIKEY', 'CREDENTIAL', 'COOKIE', 'PRIVATE'];
+const CREDENTIAL_SUFFIXES = ['PASS', 'PWD', 'KEY', 'AUTH'];
+const SECRET_CONFIG_NAME = /(?:^|[-_.])(?:token|key|secret|password|authorization|credential|cookie)s?$/i;
+export function credentialNameWords(name) {
+    if (typeof name !== 'string')
+        return [];
+    return name
+        .replace(/([A-Z])(?=[A-Z][a-z])/g, '$1_')
+        .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+        .split(/[_\-.\s]+/)
+        .filter((w) => w.length > 0)
+        .map((w) => w.toLowerCase());
+}
+export function isCredentialEnvName(name) {
+    if (typeof name !== 'string')
+        return false;
+    if (credentialNameWords(name).some((w) => CREDENTIAL_WORDS.has(w)))
+        return true;
+    const upper = name.toUpperCase();
+    return CREDENTIAL_STEMS.some((stem) => upper.includes(stem)) || CREDENTIAL_SUFFIXES.some((suffix) => upper.endsWith(suffix));
+}
+export function isCredentialConfigKey(name) {
+    if (typeof name !== 'string')
+        return false;
+    const words = credentialNameWords(name);
+    const last = words[words.length - 1];
+    return SECRET_CONFIG_NAME.test(name) || (last !== undefined && CREDENTIAL_WORDS.has(last));
+}
+const DECIMAL_INTEGER_RE = /^\s*\d+\s*$/;
+function stringCarriesCredential(value) {
+    if (looksLikeKnownSecret(value))
+        return true;
+    const text = value.trim();
+    if (!text.includes('://'))
+        return false;
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        return false;
+    }
+    if (url.username !== '' || url.password !== '')
+        return true;
+    return url.search.length > 1 && queryCarriesCredential(url.search.slice(1));
+}
+const ENV_ASSIGNMENT_RE = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s;
+const LONG_OPTION_RE = /^--?([A-Za-z][A-Za-z0-9_-]*)(?:=(.*))?$/s;
+const HEADER_FORM_RE = /^\s*([A-Za-z][A-Za-z0-9_-]*)\s*:\s*\S/;
+function argvFindings(args) {
+    const hits = new Map();
+    const add = (i, numericByNameOnly) => {
+        hits.set(i, (hits.get(i) ?? true) && numericByNameOnly);
+    };
+    const valueCarries = (value) => {
+        const header = HEADER_FORM_RE.exec(value);
+        return stringCarriesCredential(value) || (header !== null && isCredentialConfigKey(header[1] ?? ''));
+    };
+    args.forEach((arg, i) => {
+        if (valueCarries(arg))
+            add(i, false);
+        const assignment = ENV_ASSIGNMENT_RE.exec(arg);
+        if (assignment !== null && assignment[2] !== '') {
+            const assigned = assignment[2] ?? '';
+            if (valueCarries(assigned))
+                add(i, false);
+            if (isCredentialEnvName(assignment[1] ?? ''))
+                add(i, DECIMAL_INTEGER_RE.test(assigned));
+        }
+        const option = LONG_OPTION_RE.exec(arg);
+        if (option === null)
+            return;
+        const inline = option[2];
+        if (inline !== undefined && inline !== '' && valueCarries(inline))
+            add(i, false);
+        const optionName = option[1] ?? '';
+        if (optionName.length <= 1 || !isCredentialEnvName(optionName))
+            return;
+        if (inline !== undefined) {
+            if (inline !== '')
+                add(i, DECIMAL_INTEGER_RE.test(inline));
+        }
+        else {
+            const next = args[i + 1];
+            if (next !== undefined && next !== '')
+                add(i + 1, DECIMAL_INTEGER_RE.test(next));
+        }
+    });
+    return hits;
+}
+function isPresent(value) {
+    return value !== undefined && value !== null && value !== '' && value !== false;
+}
+function arrayKindOf(node) {
+    try {
+        return Array.isArray(node);
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownKeysOf(node) {
+    try {
+        return Object.keys(node);
+    }
+    catch {
+        return undefined;
+    }
+}
+function readSlot(node, key) {
+    try {
+        return { ok: true, value: node[key] };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+export function settingsCredentialKeyPaths(doc) {
+    const found = [];
+    if (doc === null || doc === undefined || typeof doc !== 'object')
+        return found;
+    const finding = (path, numericByNameOnly) => (numericByNameOnly ? { path, numericByNameOnly: true } : { path });
+    const ancestors = new WeakSet();
+    const stack = [{ node: doc, path: '', inEnv: false }];
+    while (stack.length > 0) {
+        const frame = stack.pop();
+        if (frame === undefined)
+            continue;
+        const { node, path, inEnv } = frame;
+        if (frame.exit === true) {
+            ancestors.delete(node);
+            continue;
+        }
+        if (ancestors.has(node))
+            continue;
+        ancestors.add(node);
+        stack.push({ node, path, inEnv, exit: true });
+        const isArray = arrayKindOf(node);
+        if (isArray === undefined) {
+            if (path !== '')
+                found.push(finding(path, false));
+            continue;
+        }
+        if (isArray) {
+            let items;
+            try {
+                items = Array.from(node);
+            }
+            catch {
+                if (path !== '')
+                    found.push(finding(path, false));
+                continue;
+            }
+            if (items.length > 0 && items.every((item) => typeof item === 'string')) {
+                const hits = argvFindings(items);
+                for (const i of [...hits.keys()].sort((a, b) => a - b))
+                    found.push(finding(`${path}[${i}]`, hits.get(i) === true));
+                continue;
+            }
+            items.forEach((item, i) => {
+                const itemPath = `${path}[${i}]`;
+                if (typeof item === 'string') {
+                    if (stringCarriesCredential(item))
+                        found.push(finding(itemPath, false));
+                }
+                else if (item !== null && typeof item === 'object') {
+                    stack.push({ node: item, path: itemPath, inEnv: false });
+                }
+            });
+            continue;
+        }
+        const keys = ownKeysOf(node);
+        if (keys === undefined) {
+            if (path !== '')
+                found.push(finding(path, false));
+            continue;
+        }
+        for (const key of keys) {
+            const keyPath = path === '' ? key : `${path}.${key}`;
+            const nameIsCredential = inEnv ? isCredentialEnvName(key) : isCredentialConfigKey(key);
+            const slot = readSlot(node, key);
+            if (!slot.ok) {
+                if (nameIsCredential)
+                    found.push(finding(keyPath, false));
+                continue;
+            }
+            const value = slot.value;
+            if (typeof value === 'string') {
+                const byValue = stringCarriesCredential(value);
+                if (byValue || (nameIsCredential && isPresent(value)))
+                    found.push(finding(keyPath, !byValue && DECIMAL_INTEGER_RE.test(value)));
+                continue;
+            }
+            if (value !== null && typeof value === 'object') {
+                let nonEmpty;
+                try {
+                    nonEmpty = Array.isArray(value) ? value.length > 0 : Object.keys(value).length > 0;
+                }
+                catch {
+                    nonEmpty = true;
+                }
+                if (nameIsCredential && nonEmpty) {
+                    found.push(finding(keyPath, false));
+                    continue;
+                }
+                stack.push({ node: value, path: keyPath, inEnv: key === 'env' });
+                continue;
+            }
+            if (nameIsCredential && isPresent(value))
+                found.push(finding(keyPath, typeof value === 'number'));
+        }
+    }
+    return found;
+}

package/dist/skillsWireCaps.d.ts

@@ -1,8 +1,5 @@
 import type { SkillSpec } from '@sema-agent/sdk';
 import { type SkillToolListsReading } from './skillToolListsCapability.js';
-export declare const SKILL_CAPS: {
-    readonly content: 1048576;
-};
 export interface SkillCmdLike {
     type?: string;
     name?: string;

package/dist/skillsWireCaps.js

@@ -1,8 +1,7 @@
 import { skillToolListsAvailable } from './skillToolListsCapability.js';
-export const SKILL_CAPS = { content: 1_048_576 };
 export function toCappedSpec(name, description, whenToUse, body) {
     const n = name.trim();
-    const c = body.trim().slice(0, SKILL_CAPS.content);
+    const c = body.trim();
     if (!n || !c)
         return null;
     const desc = [description.trim(), whenToUse.trim()]

package/dist/subagentContentStore.d.ts

@@ -44,6 +44,7 @@ export declare const SUBAGENT_CONTENT_STORE_DEFAULTS: Readonly<SubagentContentSt
 export declare function configureSubagentContentStore(next: Partial<SubagentContentStoreConfig>): void;
 export declare function subagentContentStoreConfig(): SubagentContentStoreConfig;
 export declare function __resetSubagentContentStoreConfigForTests(): void;
+export declare function bindSubagentIdentityReader(fn: (id: string) => readonly string[] | undefined): void;
 export declare function registerSubagentContentAlias(parentToolCallId: string, taskId: string): void;
 export declare function registerSubagentAlias(parentToolCallId: string, taskId: string): void;
 export declare function publishSubagentContentEvent(ev: SubagentContentEvent): void;

package/dist/subagentContentStore.js

@@ -229,8 +229,40 @@ function dropTask(key) {
     totalBytes -= s.bytes;
     tasks.delete(key);
 }
+let subagentIdsReader;
+export function bindSubagentIdentityReader(fn) {
+    subagentIdsReader = fn;
+}
+function sameSubagentIds(id) {
+    let ids;
+    try {
+        ids = subagentIdsReader?.(id);
+    }
+    catch {
+        ids = undefined;
+    }
+    if (ids === undefined)
+        return [id];
+    return ids.includes(id) ? ids : [...ids, id];
+}
+function homeKeyOf(key) {
+    return sameSubagentIds(key).find((id) => tasks.has(id)) ?? key;
+}
+function contentKeyOf(taskId) {
+    const ids = sameSubagentIds(taskId);
+    const direct = ids.find((id) => tasks.has(id));
+    if (direct !== undefined)
+        return direct;
+    for (const id of ids) {
+        const parked = taskToParent.get(id)?.card;
+        if (parked !== undefined && tasks.has(parked))
+            return parked;
+    }
+    return '';
+}
 const parentToTask = new Map();
 const taskToParent = new Map();
+let parentStampSeq = 0;
 let notifyListener = null;
 const pendingNotify = new Set();
 let notifyTimer = null;
@@ -383,7 +415,8 @@ function aliasContentKey(parentToolCallId, taskId) {
 export function registerSubagentAlias(parentToolCallId, taskId) {
     if (!aliasContentKey(parentToolCallId, taskId))
         return;
-    taskToParent.set(taskId, parentToolCallId);
+    if (taskToParent.get(taskId)?.card !== parentToolCallId)
+        taskToParent.set(taskId, { card: parentToolCallId, stamp: ++parentStampSeq });
 }
 function replaySeen(s, ev) {
     const id = ev.eventId;
@@ -459,7 +492,7 @@ function canonicalKey(ev) {
     return parentToTask.get(ev.parentToolCallId) ?? ev.parentToolCallId;
 }
 export function publishSubagentContentEvent(ev) {
-    const key = canonicalKey(ev);
+    const key = homeKeyOf(canonicalKey(ev));
     const s = stateFor(key, ev.parentToolCallId);
     switch (ev.type) {
         case 'text_delta':
@@ -561,15 +594,17 @@ export function publishSubagentContentEvent(ev) {
     scheduleNotify(key);
 }
 export function pushSubagentLocalEcho(taskId, text) {
-    const s = stateFor(taskId, tasks.get(taskId)?.parentToolCallId ?? '');
+    const known = contentKeyOf(taskId);
+    const key = known !== '' ? known : taskId;
+    const s = stateFor(key, tasks.get(key)?.parentToolCallId ?? '');
     flushBuffers(s);
     pushItem(s, { kind: 'echo', text });
     enforceTaskCap(s);
-    enforceTotalCap(taskId);
-    scheduleNotify(taskId);
+    enforceTotalCap(key);
+    scheduleNotify(key);
 }
 export function getSubagentContentSnapshot(taskId) {
-    const key = tasks.has(taskId) ? taskId : (taskToParent.get(taskId) ?? '');
+    const key = contentKeyOf(taskId);
     const s = tasks.get(key);
     if (!s)
         return null;
@@ -615,17 +650,42 @@ export function planSubagentViewSlots(taskId) {
     return out;
 }
 export function parentToolCallIdOf(taskId) {
-    return taskToParent.get(taskId) ?? tasks.get(taskId)?.parentToolCallId;
+    const ids = sameSubagentIds(taskId);
+    let stated;
+    let statedStamp = -1;
+    for (const id of ids) {
+        const hit = taskToParent.get(id);
+        if (hit === undefined)
+            continue;
+        if (stated === undefined || hit.stamp > statedStamp) {
+            stated = hit.card;
+            statedStamp = hit.stamp;
+        }
+    }
+    if (stated !== undefined)
+        return stated;
+    for (const id of ids) {
+        const fromContent = tasks.get(id)?.parentToolCallId;
+        if (fromContent !== undefined)
+            return fromContent;
+    }
+    return undefined;
 }
 export function settleSubagentContent(taskId) {
-    const s = tasks.get(taskId);
+    const key = contentKeyOf(taskId);
+    const s = tasks.get(key);
     if (!s)
         return;
     flushBuffers(s);
-    scheduleNotify(taskId);
+    scheduleNotify(key);
 }
 export function clearSubagentContent(taskId) {
-    dropTask(taskId);
+    for (;;) {
+        const key = contentKeyOf(taskId);
+        if (key === '')
+            return;
+        dropTask(key);
+    }
 }
 const bgFacts = new Map();
 export function recordBgTerminalFacts(taskId, facts) {
@@ -641,10 +701,12 @@ export function recordBgTerminalFacts(taskId, facts) {
     scheduleNotify(taskId);
 }
 export function clearBgTerminalFacts(taskId) {
-    bgFacts.delete(taskId);
+    for (const id of sameSubagentIds(taskId))
+        bgFacts.delete(id);
 }
 export function getBgTerminalFacts(taskId) {
-    const key = bgFacts.has(taskId) ? taskId : (taskToParent.get(taskId) ?? '');
+    const ids = sameSubagentIds(taskId);
+    const key = ids.find((id) => bgFacts.has(id)) ?? ids.map((id) => taskToParent.get(id)?.card).find((c) => c !== undefined) ?? '';
     touchLru(bgFacts, key);
     return bgFacts.get(key);
 }
@@ -665,15 +727,35 @@ export function recordBgParentRun(taskId, runId, sessionId, sessionKey) {
 export function recordSubagentOwner(taskId, runId, sessionId, sessionKey) {
     if (!taskId || typeof runId !== 'string' || runId === '' || taskId === runId)
         return;
-    if (bgParentRun.size >= MAX_BG_PARENT_RUNS && !bgParentRun.has(taskId)) {
+    const ids = sameSubagentIds(taskId);
+    const heldKeys = ids.filter((k) => bgParentRun.has(k));
+    const heldRecs = [];
+    for (const k of heldKeys) {
+        const rec = bgParentRun.get(k);
+        if (rec !== undefined)
+            heldRecs.push(rec);
+    }
+    if (bgParentRun.size >= MAX_BG_PARENT_RUNS && heldKeys.length === 0) {
         const oldest = bgParentRun.keys().next().value;
         if (oldest !== undefined)
             bgParentRun.delete(oldest);
     }
-    const quarantinedRun = conflictQuarantine.get(taskId);
-    if (quarantinedRun !== undefined && quarantinedRun === runId)
+    const quarantinedHere = ids.some((k) => conflictQuarantine.get(k) === runId);
+    if (quarantinedHere)
+        return;
+    const sameRunHeld = heldRecs.filter((r) => r.runId === runId);
+    const heldSlots = new Set(sameRunHeld.map((r) => r.sessionKey ?? DEFAULT_SESSION_KEY));
+    if (sameRunHeld.length > 1 && heldSlots.size > 1) {
+        ownerSessionConflictCount++;
+        const pairOf = (r) => ({
+            ...(r.sessionId !== undefined ? { sessionId: r.sessionId } : {}),
+            ...(r.sessionKey !== undefined ? { sessionKey: r.sessionKey } : {}),
+        });
+        lastOwnerSessionConflict = { taskId, runId, prior: pairOf(sameRunHeld[0]), next: pairOf(sameRunHeld[1]) };
+        quarantineRun(ids, runId);
         return;
-    const prior = bgParentRun.get(taskId);
+    }
+    const prior = heldRecs.find((r) => r.runId === runId) ?? heldRecs[0];
     const sameRun = prior?.runId === runId;
     const incoming = typeof sessionId === 'string' && sessionId !== '' ? sessionId : undefined;
     const incomingKey = typeof sessionKey === 'string' && sessionKey !== '' ? sessionKey : undefined;
@@ -707,16 +789,13 @@ export function recordSubagentOwner(taskId, runId, sessionId, sessionKey) {
         const priorSlot = prior?.sessionKey ?? DEFAULT_SESSION_KEY;
         const nextSlot = nextPair.sessionKey ?? DEFAULT_SESSION_KEY;
         if (priorSlot !== nextSlot) {
-            bgParentRun.delete(taskId);
-            if (conflictQuarantine.size >= MAX_BG_PARENT_RUNS && !conflictQuarantine.has(taskId)) {
-                const oldestQ = conflictQuarantine.keys().next().value;
-                if (oldestQ !== undefined)
-                    conflictQuarantine.delete(oldestQ);
-            }
-            conflictQuarantine.set(taskId, runId);
+            quarantineRun(ids, runId);
             return;
         }
     }
+    for (const k of ids)
+        if (k !== taskId)
+            bgParentRun.delete(k);
     bgParentRun.delete(taskId);
     bgParentRun.set(taskId, { runId, ...nextPair });
 }
@@ -733,14 +812,43 @@ export function recordSubagentOwnerFromProgress(ev, ownerRunId, ownerSessionId,
     recordSubagentOwner(o.taskId, ownerRunId, ownerSessionId, ownerSessionKey);
 }
 export function getBgParentRun(taskId) {
-    touchLru(bgParentRun, taskId);
-    return bgParentRun.get(taskId)?.runId;
+    return getBgParentRunOwner(taskId)?.runId;
 }
 export function getBgParentRunOwner(taskId) {
     if (typeof taskId !== 'string' || taskId === '')
         return undefined;
-    touchLru(bgParentRun, taskId);
-    return bgParentRun.get(taskId);
+    const live = liveOwnerEntries(sameSubagentIds(taskId));
+    const first = live[0];
+    if (first === undefined)
+        return undefined;
+    if (!live.every(([, rec]) => sameOwnerRecord(rec, first[1])))
+        return undefined;
+    touchLru(bgParentRun, first[0]);
+    return first[1];
+}
+function liveOwnerEntries(ids) {
+    const out = [];
+    for (const k of ids) {
+        const rec = bgParentRun.get(k);
+        if (rec === undefined)
+            continue;
+        if (ids.some((q) => conflictQuarantine.get(q) === rec.runId))
+            continue;
+        out.push([k, rec]);
+    }
+    return out;
+}
+const sameOwnerRecord = (a, b) => a.runId === b.runId && a.sessionId === b.sessionId && a.sessionKey === b.sessionKey;
+function quarantineRun(ids, runId) {
+    for (const k of ids) {
+        bgParentRun.delete(k);
+        if (conflictQuarantine.size >= MAX_BG_PARENT_RUNS && !conflictQuarantine.has(k)) {
+            const oldestQ = conflictQuarantine.keys().next().value;
+            if (oldestQ !== undefined)
+                conflictQuarantine.delete(oldestQ);
+        }
+        conflictQuarantine.set(k, runId);
+    }
 }
 export function __resetSubagentOwnerLedgerForTests() {
     bgParentRun.clear();

package/dist/toolsFlagNames.d.ts

@@ -0,0 +1,8 @@
+export interface ToolsFlagNames {
+    readonly kept: readonly string[];
+    readonly excluded: readonly string[];
+    readonly bare: boolean;
+    readonly detached: readonly string[];
+    readonly scoped: readonly string[];
+}
+export declare function parseToolsFlagNames(values: readonly string[]): ToolsFlagNames;

package/dist/toolsFlagNames.js

@@ -0,0 +1,110 @@
+function readableStrings(values) {
+    const out = [];
+    try {
+        if (!Array.isArray(values))
+            return out;
+        const n = values.length;
+        for (let i = 0; i < n; i++) {
+            try {
+                const v = values[i];
+                if (typeof v === 'string')
+                    out.push(v);
+            }
+            catch {
+                continue;
+            }
+        }
+    }
+    catch {
+        return out;
+    }
+    return out;
+}
+function splitToolsFlagTokens(values) {
+    const out = [];
+    for (const value of values) {
+        if (value === '')
+            continue;
+        let cur = '';
+        let inParen = false;
+        for (const ch of value) {
+            if (ch === '(') {
+                inParen = true;
+                cur += ch;
+            }
+            else if (ch === ')') {
+                inParen = false;
+                cur += ch;
+            }
+            else if (ch === ',') {
+                if (inParen)
+                    cur += ch;
+                else {
+                    if (cur.trim() !== '')
+                        out.push(cur.trim());
+                    cur = '';
+                }
+            }
+            else if (ch === ' ') {
+                if (inParen)
+                    cur += ch;
+                else if (cur.trim() !== '') {
+                    out.push(cur.trim());
+                    cur = '';
+                }
+            }
+            else if (cur !== '' || ch.trim() !== '') {
+                cur += ch;
+            }
+        }
+        if (cur.trim() !== '')
+            out.push(cur.trim());
+    }
+    return out;
+}
+export function parseToolsFlagNames(values) {
+    const tokens = splitToolsFlagTokens(readableStrings(values));
+    const kept = [];
+    const excluded = new Set();
+    const detached = [];
+    const scoped = [];
+    let bare = false;
+    for (let i = 0; i < tokens.length; i++) {
+        let token = tokens[i];
+        if (token === undefined)
+            continue;
+        if (!token.startsWith('!')) {
+            kept.push(token);
+            continue;
+        }
+        let name = token.slice(1);
+        if (name === '') {
+            const next = tokens[i + 1];
+            if (next === undefined || next.startsWith('!') || next.startsWith('(')) {
+                bare = true;
+                continue;
+            }
+            i++;
+            detached.push(next);
+            token = `!${next}`;
+            name = next;
+        }
+        const paren = name.indexOf('(');
+        if (paren === 0) {
+            bare = true;
+            continue;
+        }
+        if (paren > 0) {
+            name = name.slice(0, paren);
+            scoped.push(token);
+        }
+        excluded.add(name);
+    }
+    return Object.freeze({
+        kept: Object.freeze(kept),
+        excluded: Object.freeze([...excluded]),
+        bare,
+        detached: Object.freeze(detached),
+        scoped: Object.freeze(scoped),
+    });
+}

package/dist/turnFailurePresentation.js

@@ -3,12 +3,13 @@ import { classifyTurnWireError, effectiveWireErrorCode, isPreStreamDrainingRejec
 import { isSseIdleError } from './sseIdleTriage.js';
 import { isCodeClassifiedGateFailure } from './gateFailureCodes.js';
 import { CORRUPT_ROW_ERROR_CODE, CORRUPT_SESSION_ERROR_CODE, MEMORY_CONTROL_PLANE_CORRUPT, SCENARIO_ASSIGNMENT_UNKNOWN_ERROR_CODE } from './engineErrorCodes.js';
-import { bodyShapeRefusalFromError, bodyShapeRefusalTouchesSettings, fleetLeaseUnavailableContent, fleetLeaseUnavailableFromError, hostPostureRefusalContent, hostPostureRefusalFromError, settingsPermissionBucketRefusalContent, settingsPermissionBucketRefusalFromError, toolDeclarationRefusalContent, toolDeclarationRefusalFromError, usageWindowExhaustedContent, usageWindowExhaustedFromError, } from './wireRefusalCopy.js';
+import { admissionWallRefusalContent, admissionWallRefusalFromError, bodyShapeRefusalFromError, bodyShapeRefusalTouchesSettings, fleetLeaseUnavailableContent, fleetLeaseUnavailableFromError, hostPostureRefusalContent, hostPostureRefusalFromError, fieldLimitRefusalContent, fieldLimitRefusalFromError, toolDeclarationRefusalContent, toolDeclarationRefusalFromError, usageWindowExhaustedContent, usageWindowExhaustedFromError, userAttachmentRefusalFromError, } from './wireRefusalCopy.js';
 import { THROWN_SLOT_UNREADABLE, readErrorNumber, readThrownSlot, wireFailureTextsOf } from './wireFailureShape.js';
 import { provablyNotSent } from './engineWireFor.js';
 import { corruptStoredRowContent, scenarioDenyFromError, scenarioNotAllowedContent } from './wireErrorTriage.js';
 import { checkpointUnsupportedVersionContent, checkpointUnsupportedVersionFromError, requireExistingSessionRefusalContent, requireExistingSessionRefusalFromError, resumeContextUnavailableContent, resumeContextUnavailableFromError, resumePolicyBlockContent, resumePolicyBlockFromError, resumeRefusalContent, resumeRefusalFromError, } from './resumeRefusalCopy.js';
 import { resumeReopenContent, resumeReopenFromError } from './hitl/suspendedReopen.js';
+import { prepareRefusalCodeOf, prepareRefusalNoteOf } from './prepareRefusal.js';
 import { isCorruptSessionError } from './corruptSession.js';
 import { corruptSessionContent } from './corruptSessionCopy.js';
 import { inheritEnvRefusalContent, inheritEnvRefusalFromError } from './inheritEnvWire.js';
@@ -309,25 +310,32 @@ function turnFailureNotesOf(err, verdict, ctx, waitSec, lang) {
             lines.push(corruptSessionContent(lang));
         const usageWindow = quota || scenarioDeny || resumeRefusal || resumeReopen || resumeGone ? null : usageWindowExhaustedFromError(err);
         if (usageWindow)
-            lines.push(usageWindowExhaustedContent(usageWindow));
+            lines.push(usageWindowExhaustedContent(usageWindow, lang));
         const hostPosture = quota || scenarioDeny || resumeRefusal || resumeReopen || resumeGone || storedRowWhere !== undefined ? null : hostPostureRefusalFromError(err, sentRequest);
         if (hostPosture)
-            lines.push(hostPostureRefusalContent(hostPosture));
+            lines.push(hostPostureRefusalContent(hostPosture, lang));
         const inheritEnv = hostPosture ? null : inheritEnvRefusalFromError(err, sentRequest);
         if (inheritEnv)
             lines.push(inheritEnvRefusalContent(inheritEnv, lang));
-        const bucket = inheritEnv ? null : settingsPermissionBucketRefusalFromError(err);
+        const bucket = inheritEnv ? null : fieldLimitRefusalFromError(err);
         const toolDecl = toolDeclarationRefusalFromError(err);
         if (toolDecl)
-            lines.push(toolDeclarationRefusalContent(toolDecl));
+            lines.push(toolDeclarationRefusalContent(toolDecl, lang));
+        const prepareCode = toolDecl ? undefined : prepareRefusalCodeOf(err);
+        const prepareNote = prepareCode === undefined ? undefined : prepareRefusalNoteOf(prepareCode, userAttachmentRefusalFromError(err) ?? undefined);
+        if (prepareNote !== undefined)
+            lines.push(prepareNote);
+        const wall = admissionWallRefusalFromError(err);
+        if (wall)
+            lines.push(admissionWallRefusalContent(wall));
         const lease = fleetLeaseUnavailableFromError(err);
         if (lease)
-            lines.push(fleetLeaseUnavailableContent(lease));
+            lines.push(fleetLeaseUnavailableContent(lease, lang));
         const policyBlock = quota || scenarioDeny || resumeRefusal || resumeReopen || resumeGone || usageWindow || hostPosture ? null : resumePolicyBlockFromError(err);
         if (policyBlock)
             lines.push(resumePolicyBlockContent(policyBlock, lang));
         if (bucket)
-            lines.push(settingsPermissionBucketRefusalContent(bucket));
+            lines.push(fieldLimitRefusalContent(bucket, lang));
         const settingsRefusal = settingsBodyShapeNote(err, sentRequest, lang);
         if (settingsRefusal !== undefined)
             lines.push(settingsRefusal);